contrib/bind-9.2.4rc7/bin/named/tsigconf.c

   1 /*
   2  * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
   3  * Copyright (C) 1999-2001  Internet Software Consortium.
   4  *
   5  * Permission to use, copy, modify, and distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  10  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  11  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  12  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  13  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  14  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  15  * PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 /* $Id: tsigconf.c,v 1.21.2.1 2004/03/09 06:09:20 marka Exp $ */
  19
  20 #include <config.h>
  21
  22 #include <isc/base64.h>
  23 #include <isc/buffer.h>
  24 #include <isc/mem.h>
  25 #include <isc/string.h>
  26
  27 #include <isccfg/cfg.h>
  28
  29 #include <dns/tsig.h>
  30 #include <dns/result.h>
  31
  32 #include <named/log.h>
  33
  34 #include <named/config.h>
  35 #include <named/tsigconf.h>
  36
  37 static isc_result_t
  38 add_initial_keys(cfg_obj_t *list, dns_tsig_keyring_t *ring, isc_mem_t *mctx) {
  39         cfg_listelt_t *element;
  40         cfg_obj_t *key = NULL;
  41         char *keyid = NULL;
  42         unsigned char *secret = NULL;
  43         int secretalloc = 0;
  44         int secretlen = 0;
  45         isc_result_t ret;
  46         isc_stdtime_t now;
  47
  48         for (element = cfg_list_first(list);
  49              element != NULL;
  50              element = cfg_list_next(element))
  51         {
  52                 cfg_obj_t *algobj = NULL;
  53                 cfg_obj_t *secretobj = NULL;
  54                 dns_name_t keyname;
  55                 dns_name_t *alg;
  56                 char *algstr;
  57                 char keynamedata[1024];
  58                 isc_buffer_t keynamesrc, keynamebuf;
  59                 char *secretstr;
  60                 isc_buffer_t secretbuf;
  61
  62                 key = cfg_listelt_value(element);
  63                 keyid = cfg_obj_asstring(cfg_map_getname(key));
  64
  65                 algobj = NULL;
  66                 secretobj = NULL;
  67                 (void)cfg_map_get(key, "algorithm", &algobj);
  68                 (void)cfg_map_get(key, "secret", &secretobj);
  69                 INSIST(algobj != NULL && secretobj != NULL);
  70
  71                 /*
  72                  * Create the key name.
  73                  */
  74                 dns_name_init(&keyname, NULL);
  75                 isc_buffer_init(&keynamesrc, keyid, strlen(keyid));
  76                 isc_buffer_add(&keynamesrc, strlen(keyid));
  77                 isc_buffer_init(&keynamebuf, keynamedata, sizeof(keynamedata));
  78                 ret = dns_name_fromtext(&keyname, &keynamesrc, dns_rootname,
  79                                         ISC_TRUE, &keynamebuf);
  80                 if (ret != ISC_R_SUCCESS)
  81                         goto failure;
  82
  83                 /*
  84                  * Create the algorithm.
  85                  */
  86                 algstr = cfg_obj_asstring(algobj);
  87                 if (ns_config_getkeyalgorithm(algstr, &alg) != ISC_R_SUCCESS) {
  88                         cfg_obj_log(algobj, ns_g_lctx, ISC_LOG_ERROR,
  89                                     "key '%s': the only supported algorithm "
  90                                     "is hmac-md5", keyid);
  91                         ret = DNS_R_BADALG;
  92                         goto failure;
  93                 }
  94
  95                 secretstr = cfg_obj_asstring(secretobj);
  96                 secretalloc = secretlen = strlen(secretstr) * 3 / 4;
  97                 secret = isc_mem_get(mctx, secretlen);
  98                 if (secret == NULL) {
  99                         ret = ISC_R_NOMEMORY;
 100                         goto failure;
 101                 }
 102                 isc_buffer_init(&secretbuf, secret, secretlen);
 103                 ret = isc_base64_decodestring(secretstr, &secretbuf);
 104                 if (ret != ISC_R_SUCCESS)
 105                         goto failure;
 106                 secretlen = isc_buffer_usedlength(&secretbuf);
 107
 108                 isc_stdtime_get(&now);
 109                 ret = dns_tsigkey_create(&keyname, alg, secret, secretlen,
 110                                          ISC_FALSE, NULL, now, now,
 111                                          mctx, ring, NULL);
 112                 isc_mem_put(mctx, secret, secretalloc);
 113                 secret = NULL;
 114                 if (ret != ISC_R_SUCCESS)
 115                         goto failure;
 116         }
 117
 118         return (ISC_R_SUCCESS);
 119
 120  failure:
 121         cfg_obj_log(key, ns_g_lctx, ISC_LOG_ERROR,
 122                     "configuring key '%s': %s", keyid,
 123                     isc_result_totext(ret));
 124
 125         if (secret != NULL)
 126                 isc_mem_put(mctx, secret, secretalloc);
 127         return (ret);
 128
 129 }
 130
 131 isc_result_t
 132 ns_tsigkeyring_fromconfig(cfg_obj_t *config, cfg_obj_t *vconfig,
 133                           isc_mem_t *mctx, dns_tsig_keyring_t **ringp)
 134 {
 135         cfg_obj_t *maps[3];
 136         cfg_obj_t *keylist;
 137         dns_tsig_keyring_t *ring = NULL;
 138         isc_result_t result;
 139         int i;
 140
 141         i = 0;
 142         if (config != NULL)
 143                 maps[i++] = config;
 144         if (vconfig != NULL)
 145                 maps[i++] = cfg_tuple_get(vconfig, "options");
 146         maps[i] = NULL;
 147
 148         result = dns_tsigkeyring_create(mctx, &ring);
 149         if (result != ISC_R_SUCCESS)
 150                 return (result);
 151
 152         for (i = 0; ; i++) {
 153                 if (maps[i] == NULL)
 154                         break;
 155                 keylist = NULL;
 156                 result = cfg_map_get(maps[i], "key", &keylist);
 157                 if (result != ISC_R_SUCCESS)
 158                         continue;
 159                 result = add_initial_keys(keylist, ring, mctx);
 160                 if (result != ISC_R_SUCCESS)
 161                         goto failure;
 162         }
 163
 164         *ringp = ring;
 165         return (ISC_R_SUCCESS);
 166
 167  failure:
 168         dns_tsigkeyring_destroy(&ring);
 169         return (result);
 170 }