4 * contains the functions needed for TSIG [RFC2845]
6 * (c) 2005-2006 NLnet Labs
7 * See the file LICENSE for the license
10 #include <ldns/config.h>
12 #include <ldns/ldns.h>
17 #include <openssl/hmac.h>
18 #include <openssl/md5.h>
22 ldns_tsig_algorithm(ldns_tsig_credentials *tc)
28 ldns_tsig_keyname(ldns_tsig_credentials *tc)
34 ldns_tsig_keydata(ldns_tsig_credentials *tc)
40 ldns_tsig_keyname_clone(ldns_tsig_credentials *tc)
42 return strdup(tc->keyname);
46 ldns_tsig_keydata_clone(ldns_tsig_credentials *tc)
48 return strdup(tc->keydata);
52 * Makes an exact copy of the wire, but with the tsig rr removed
55 ldns_tsig_prepare_pkt_wire(uint8_t *wire, size_t wire_len, size_t *result_len)
57 uint8_t *wire2 = NULL;
69 if(wire_len < LDNS_HEADER_SIZE) {
72 /* fake parse the wire */
73 qd_count = LDNS_QDCOUNT(wire);
74 an_count = LDNS_ANCOUNT(wire);
75 ns_count = LDNS_NSCOUNT(wire);
76 ar_count = LDNS_ARCOUNT(wire);
84 pos = LDNS_HEADER_SIZE;
86 for (i = 0; i < qd_count; i++) {
87 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_QUESTION);
88 if (status != LDNS_STATUS_OK) {
94 for (i = 0; i < an_count; i++) {
95 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_ANSWER);
96 if (status != LDNS_STATUS_OK) {
102 for (i = 0; i < ns_count; i++) {
103 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_AUTHORITY);
104 if (status != LDNS_STATUS_OK) {
110 for (i = 0; i < ar_count; i++) {
111 status = ldns_wire2rr(&rr, wire, wire_len, &pos,
112 LDNS_SECTION_ADDITIONAL);
113 if (status != LDNS_STATUS_OK) {
120 wire2 = LDNS_XMALLOC(uint8_t, *result_len);
124 memcpy(wire2, wire, *result_len);
126 ldns_write_uint16(wire2 + LDNS_ARCOUNT_OFF, ar_count);
132 static const EVP_MD *
133 ldns_digest_function(char *name)
135 /* these are the mandatory algorithms from RFC4635 */
136 /* The optional algorithms are not yet implemented */
137 if (strlen(name) == 12 && strncasecmp(name, "hmac-sha256.", 11) == 0) {
138 #ifdef HAVE_EVP_SHA256
143 } else if (strlen(name) == 10 && strncasecmp(name, "hmac-sha1.", 9) == 0)
145 else if (strlen(name) == 25 && strncasecmp(name,
146 "hmac-md5.sig-alg.reg.int.", 25) == 0)
155 ldns_tsig_mac_new(ldns_rdf **tsig_mac, uint8_t *pkt_wire, size_t pkt_wire_size,
156 const char *key_data, ldns_rdf *key_name_rdf, ldns_rdf *fudge_rdf,
157 ldns_rdf *algorithm_rdf, ldns_rdf *time_signed_rdf, ldns_rdf *error_rdf,
158 ldns_rdf *other_data_rdf, ldns_rdf *orig_mac_rdf, int tsig_timers_only)
162 unsigned char *mac_bytes;
163 unsigned char *key_bytes;
165 const EVP_MD *digester;
166 char *algorithm_name;
167 unsigned int md_len = EVP_MAX_MD_SIZE;
168 ldns_rdf *result = NULL;
169 ldns_buffer *data_buffer = NULL;
172 * prepare the digestable information
174 data_buffer = ldns_buffer_new(LDNS_MAX_PACKETLEN);
176 return LDNS_STATUS_MEM_ERR;
178 /* if orig_mac is not NULL, add it too */
180 (void) ldns_rdf2buffer_wire(data_buffer, orig_mac_rdf);
182 ldns_buffer_write(data_buffer, pkt_wire, pkt_wire_size);
183 if (!tsig_timers_only) {
184 (void)ldns_rdf2buffer_wire(data_buffer, key_name_rdf);
185 ldns_buffer_write_u16(data_buffer, LDNS_RR_CLASS_ANY);
186 ldns_buffer_write_u32(data_buffer, 0);
187 (void)ldns_rdf2buffer_wire(data_buffer, algorithm_rdf);
189 (void)ldns_rdf2buffer_wire(data_buffer, time_signed_rdf);
190 (void)ldns_rdf2buffer_wire(data_buffer, fudge_rdf);
191 if (!tsig_timers_only) {
192 (void)ldns_rdf2buffer_wire(data_buffer, error_rdf);
193 (void)ldns_rdf2buffer_wire(data_buffer, other_data_rdf);
196 wireformat = (char *) data_buffer->_data;
197 wiresize = (int) ldns_buffer_position(data_buffer);
199 algorithm_name = ldns_rdf2str(algorithm_rdf);
200 if(!algorithm_name) {
201 ldns_buffer_free(data_buffer);
202 return LDNS_STATUS_MEM_ERR;
205 /* prepare the key */
206 key_bytes = LDNS_XMALLOC(unsigned char,
207 ldns_b64_pton_calculate_size(strlen(key_data)));
209 LDNS_FREE(algorithm_name);
210 ldns_buffer_free(data_buffer);
211 return LDNS_STATUS_MEM_ERR;
213 key_size = ldns_b64_pton(key_data, key_bytes,
214 ldns_b64_pton_calculate_size(strlen(key_data)));
216 LDNS_FREE(algorithm_name);
217 LDNS_FREE(key_bytes);
218 ldns_buffer_free(data_buffer);
219 /* LDNS_STATUS_INVALID_B64 */
220 return LDNS_STATUS_INVALID_B64;
223 /* 2 spare bytes for the length */
224 mac_bytes = LDNS_XMALLOC(unsigned char, md_len+2);
226 LDNS_FREE(algorithm_name);
227 LDNS_FREE(key_bytes);
228 ldns_buffer_free(data_buffer);
229 return LDNS_STATUS_MEM_ERR;
231 memset(mac_bytes, 0, md_len+2);
233 digester = ldns_digest_function(algorithm_name);
236 (void) HMAC(digester, key_bytes, key_size, (void *)wireformat,
237 (size_t) wiresize, mac_bytes + 2, &md_len);
239 ldns_write_uint16(mac_bytes, md_len);
240 result = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_INT16_DATA, md_len + 2,
243 LDNS_FREE(algorithm_name);
244 LDNS_FREE(mac_bytes);
245 LDNS_FREE(key_bytes);
246 ldns_buffer_free(data_buffer);
247 return LDNS_STATUS_CRYPTO_UNKNOWN_ALGO;
250 LDNS_FREE(algorithm_name);
251 LDNS_FREE(mac_bytes);
252 LDNS_FREE(key_bytes);
253 ldns_buffer_free(data_buffer);
257 return LDNS_STATUS_OK;
259 #endif /* HAVE_SSL */
264 ldns_pkt_tsig_verify(ldns_pkt *pkt, uint8_t *wire, size_t wirelen, const char *key_name,
265 const char *key_data, ldns_rdf *orig_mac_rdf)
267 return ldns_pkt_tsig_verify_next(pkt, wire, wirelen, key_name, key_data, orig_mac_rdf, 0);
271 ldns_pkt_tsig_verify_next(ldns_pkt *pkt, uint8_t *wire, size_t wirelen, const char* key_name,
272 const char *key_data, ldns_rdf *orig_mac_rdf, int tsig_timers_only)
275 ldns_rdf *algorithm_rdf;
276 ldns_rdf *time_signed_rdf;
277 ldns_rdf *orig_id_rdf;
279 ldns_rdf *other_data_rdf;
280 ldns_rdf *pkt_mac_rdf;
281 ldns_rdf *my_mac_rdf;
282 ldns_rdf *key_name_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, key_name);
283 uint16_t pkt_id, orig_pkt_id;
286 uint8_t *prepared_wire = NULL;
287 size_t prepared_wire_size = 0;
289 ldns_rr *orig_tsig = ldns_pkt_tsig(pkt);
292 ldns_rdf_deep_free(key_name_rdf);
295 algorithm_rdf = ldns_rr_rdf(orig_tsig, 0);
296 time_signed_rdf = ldns_rr_rdf(orig_tsig, 1);
297 fudge_rdf = ldns_rr_rdf(orig_tsig, 2);
298 pkt_mac_rdf = ldns_rr_rdf(orig_tsig, 3);
299 orig_id_rdf = ldns_rr_rdf(orig_tsig, 4);
300 error_rdf = ldns_rr_rdf(orig_tsig, 5);
301 other_data_rdf = ldns_rr_rdf(orig_tsig, 6);
303 /* remove temporarily */
304 ldns_pkt_set_tsig(pkt, NULL);
305 /* temporarily change the id to the original id */
306 pkt_id = ldns_pkt_id(pkt);
307 orig_pkt_id = ldns_rdf2native_int16(orig_id_rdf);
308 ldns_pkt_set_id(pkt, orig_pkt_id);
310 prepared_wire = ldns_tsig_prepare_pkt_wire(wire, wirelen, &prepared_wire_size);
312 status = ldns_tsig_mac_new(&my_mac_rdf, prepared_wire, prepared_wire_size,
313 key_data, key_name_rdf, fudge_rdf, algorithm_rdf,
314 time_signed_rdf, error_rdf, other_data_rdf, orig_mac_rdf, tsig_timers_only);
316 LDNS_FREE(prepared_wire);
318 if (status != LDNS_STATUS_OK) {
319 ldns_rdf_deep_free(key_name_rdf);
322 /* Put back the values */
323 ldns_pkt_set_tsig(pkt, orig_tsig);
324 ldns_pkt_set_id(pkt, pkt_id);
326 ldns_rdf_deep_free(key_name_rdf);
328 if (ldns_rdf_compare(pkt_mac_rdf, my_mac_rdf) == 0) {
329 ldns_rdf_deep_free(my_mac_rdf);
332 ldns_rdf_deep_free(my_mac_rdf);
336 #endif /* HAVE_SSL */
340 ldns_pkt_tsig_sign(ldns_pkt *pkt, const char *key_name, const char *key_data,
341 uint16_t fudge, const char *algorithm_name, ldns_rdf *query_mac)
343 return ldns_pkt_tsig_sign_next(pkt, key_name, key_data, fudge, algorithm_name, query_mac, 0);
347 ldns_pkt_tsig_sign_next(ldns_pkt *pkt, const char *key_name, const char *key_data,
348 uint16_t fudge, const char *algorithm_name, ldns_rdf *query_mac, int tsig_timers_only)
351 ldns_rdf *key_name_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, key_name);
352 ldns_rdf *fudge_rdf = NULL;
353 ldns_rdf *orig_id_rdf = NULL;
354 ldns_rdf *algorithm_rdf;
355 ldns_rdf *error_rdf = NULL;
356 ldns_rdf *mac_rdf = NULL;
357 ldns_rdf *other_data_rdf = NULL;
359 ldns_status status = LDNS_STATUS_OK;
361 uint8_t *pkt_wire = NULL;
364 struct timeval tv_time_signed;
365 uint8_t *time_signed = NULL;
366 ldns_rdf *time_signed_rdf = NULL;
368 algorithm_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, algorithm_name);
369 if(!key_name_rdf || !algorithm_rdf) {
370 status = LDNS_STATUS_MEM_ERR;
374 /* eww don't have create tsigtime rdf yet :( */
376 if (gettimeofday(&tv_time_signed, NULL) == 0) {
377 time_signed = LDNS_XMALLOC(uint8_t, 6);
379 status = LDNS_STATUS_MEM_ERR;
382 ldns_write_uint64_as_uint48(time_signed,
383 (uint64_t)tv_time_signed.tv_sec);
385 status = LDNS_STATUS_INTERNAL_ERR;
389 time_signed_rdf = ldns_rdf_new(LDNS_RDF_TYPE_TSIGTIME, 6, time_signed);
390 if(!time_signed_rdf) {
391 LDNS_FREE(time_signed);
392 status = LDNS_STATUS_MEM_ERR;
396 fudge_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, fudge);
398 orig_id_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, ldns_pkt_id(pkt));
400 error_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, 0);
402 other_data_rdf = ldns_native2rdf_int16_data(0, NULL);
404 if(!fudge_rdf || !orig_id_rdf || !error_rdf || !other_data_rdf) {
405 status = LDNS_STATUS_MEM_ERR;
409 if (ldns_pkt2wire(&pkt_wire, pkt, &pkt_wire_len) != LDNS_STATUS_OK) {
410 status = LDNS_STATUS_ERR;
414 status = ldns_tsig_mac_new(&mac_rdf, pkt_wire, pkt_wire_len,
415 key_data, key_name_rdf, fudge_rdf, algorithm_rdf,
416 time_signed_rdf, error_rdf, other_data_rdf, query_mac, tsig_timers_only);
424 /* Create the TSIG RR */
425 tsig_rr = ldns_rr_new();
427 status = LDNS_STATUS_MEM_ERR;
430 ldns_rr_set_owner(tsig_rr, key_name_rdf);
431 ldns_rr_set_class(tsig_rr, LDNS_RR_CLASS_ANY);
432 ldns_rr_set_type(tsig_rr, LDNS_RR_TYPE_TSIG);
433 ldns_rr_set_ttl(tsig_rr, 0);
435 ldns_rr_push_rdf(tsig_rr, algorithm_rdf);
436 ldns_rr_push_rdf(tsig_rr, time_signed_rdf);
437 ldns_rr_push_rdf(tsig_rr, fudge_rdf);
438 ldns_rr_push_rdf(tsig_rr, mac_rdf);
439 ldns_rr_push_rdf(tsig_rr, orig_id_rdf);
440 ldns_rr_push_rdf(tsig_rr, error_rdf);
441 ldns_rr_push_rdf(tsig_rr, other_data_rdf);
443 ldns_pkt_set_tsig(pkt, tsig_rr);
449 ldns_rdf_free(key_name_rdf);
450 ldns_rdf_free(algorithm_rdf);
451 ldns_rdf_free(time_signed_rdf);
452 ldns_rdf_free(fudge_rdf);
453 ldns_rdf_free(orig_id_rdf);
454 ldns_rdf_free(error_rdf);
455 ldns_rdf_free(other_data_rdf);
458 #endif /* HAVE_SSL */