bin/named/tsigconf.c

	tsigconf.c revision c6d4f781529d2f28693546b25b2967d44ec89e60
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews/*
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews * Copyright (C) 1999-2001  Internet Software Consortium.
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews *
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews * Permission to use, copy, modify, and distribute this software for any
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews * purpose with or without fee is hereby granted, provided that the above
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews * copyright notice and this permission notice appear in all copies.
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews *
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews * PERFORMANCE OF THIS SOFTWARE.
850a31f07e132ecb33dd7d0e5d6fc2fd3eae30f9Mark Andrews */
6c52944ef2281095d1c317a45ea013b8f3cfa135Mark Andrews
6c52944ef2281095d1c317a45ea013b8f3cfa135Mark Andrews/* $Id: tsigconf.c,v 1.26 2006/01/27 02:35:14 marka Exp $ */
6c52944ef2281095d1c317a45ea013b8f3cfa135Mark Andrews
/*! \file */

#include <config.h>

#include <isc/base64.h>
#include <isc/buffer.h>
#include <isc/mem.h>
#include <isc/string.h>

#include <isccfg/cfg.h>

#include <dns/tsig.h>
#include <dns/result.h>

#include <named/log.h>

#include <named/config.h>
#include <named/tsigconf.h>

static isc_result_t
add_initial_keys(cfg_obj_t *list, dns_tsig_keyring_t *ring, isc_mem_t *mctx) {
    dns_tsigkey_t *tsigkey = NULL;
    cfg_listelt_t *element;
    cfg_obj_t *key = NULL;
    const char *keyid = NULL;
    unsigned char *secret = NULL;
    int secretalloc = 0;
    int secretlen = 0;
    isc_result_t ret;
    isc_stdtime_t now;
    isc_uint16_t bits;

    for (element = cfg_list_first(list);
         element != NULL;
         element = cfg_list_next(element))
    {
        cfg_obj_t *algobj = NULL;
        cfg_obj_t *secretobj = NULL;
        dns_name_t keyname;
        dns_name_t *alg;
        const char *algstr;
        char keynamedata[1024];
        isc_buffer_t keynamesrc, keynamebuf;
        const char *secretstr;
        isc_buffer_t secretbuf;

        key = cfg_listelt_value(element);
        keyid = cfg_obj_asstring(cfg_map_getname(key));

        algobj = NULL;
        secretobj = NULL;
        (void)cfg_map_get(key, "algorithm", &algobj);
        (void)cfg_map_get(key, "secret", &secretobj);
        INSIST(algobj != NULL && secretobj != NULL);

        /*
         * Create the key name.
         */
        dns_name_init(&keyname, NULL);
        isc_buffer_init(&keynamesrc, keyid, strlen(keyid));
        isc_buffer_add(&keynamesrc, strlen(keyid));
        isc_buffer_init(&keynamebuf, keynamedata, sizeof(keynamedata));
        ret = dns_name_fromtext(&keyname, &keynamesrc, dns_rootname,
                    ISC_TRUE, &keynamebuf);
        if (ret != ISC_R_SUCCESS)
            goto failure;

        /*
         * Create the algorithm.
         */
        algstr = cfg_obj_asstring(algobj);
        if (ns_config_getkeyalgorithm(algstr, &alg, &bits)
            != ISC_R_SUCCESS) {
            cfg_obj_log(algobj, ns_g_lctx, ISC_LOG_ERROR,
                    "key '%s': has a unsupported algorithm '%s'",
                    keyid, algstr);
            ret = DNS_R_BADALG;
            goto failure;
        }

        secretstr = cfg_obj_asstring(secretobj);
        secretalloc = secretlen = strlen(secretstr) * 3 / 4;
        secret = isc_mem_get(mctx, secretlen);
        if (secret == NULL) {
            ret = ISC_R_NOMEMORY;
            goto failure;
        }
        isc_buffer_init(&secretbuf, secret, secretlen);
        ret = isc_base64_decodestring(secretstr, &secretbuf);
        if (ret != ISC_R_SUCCESS)
            goto failure;
        secretlen = isc_buffer_usedlength(&secretbuf);

        isc_stdtime_get(&now);
        ret = dns_tsigkey_create(&keyname, alg, secret, secretlen,
                     ISC_FALSE, NULL, now, now,
                     mctx, ring, &tsigkey);
        isc_mem_put(mctx, secret, secretalloc);
        secret = NULL;
        if (ret != ISC_R_SUCCESS)
            goto failure;
        /*
         * Set digest bits.
         */
        dst_key_setbits(tsigkey->key, bits);
        dns_tsigkey_detach(&tsigkey);
    }

    return (ISC_R_SUCCESS);

 failure:
    cfg_obj_log(key, ns_g_lctx, ISC_LOG_ERROR,
            "configuring key '%s': %s", keyid,
            isc_result_totext(ret));

    if (secret != NULL)
        isc_mem_put(mctx, secret, secretalloc);
    return (ret);
}

isc_result_t
ns_tsigkeyring_fromconfig(cfg_obj_t *config, cfg_obj_t *vconfig,
              isc_mem_t *mctx, dns_tsig_keyring_t **ringp)
{
    cfg_obj_t *maps[3];
    cfg_obj_t *keylist;
    dns_tsig_keyring_t *ring = NULL;
    isc_result_t result;
    int i;

    i = 0;
    if (config != NULL)
        maps[i++] = config;
    if (vconfig != NULL)
        maps[i++] = cfg_tuple_get(vconfig, "options");
    maps[i] = NULL;

    result = dns_tsigkeyring_create(mctx, &ring);
    if (result != ISC_R_SUCCESS)
        return (result);

    for (i = 0; ; i++) {
        if (maps[i] == NULL)
            break;
        keylist = NULL;
        result = cfg_map_get(maps[i], "key", &keylist);
        if (result != ISC_R_SUCCESS)
            continue;
        result = add_initial_keys(keylist, ring, mctx);
        if (result != ISC_R_SUCCESS)
            goto failure;
    }

    *ringp = ring;
    return (ISC_R_SUCCESS);

 failure:
    dns_tsigkeyring_destroy(&ring);
    return (result);
}