tsigconf.c revision fb01226bcd598c36b5edc566489c890c39f03ed3
/*
* Copyright (C) 1999, 2000 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
* CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
* DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
* PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
* ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
* SOFTWARE.
*/
#include <config.h>
#include <isc/base64.h>
#include <isc/lex.h>
#include <isc/stdtime.h>
#include <dns/confctx.h>
#include <dns/confkeys.h>
#include <dns/name.h>
#include <dns/tsigconf.h>
static isc_result_t
add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring,
isc_mem_t *mctx)
{
isc_lex_t *lex = NULL;
dns_c_kdef_t *key;
unsigned char *secret = NULL;
int secretalloc = 0;
int secretlen = 0;
isc_result_t ret;
isc_stdtime_t now;
key = ISC_LIST_HEAD(list->keydefs);
while (key != NULL) {
dns_name_t keyname;
dns_name_t alg;
char keynamedata[1024], algdata[1024];
isc_buffer_t keynamesrc, keynamebuf, algsrc, algbuf;
isc_buffer_t secretsrc, secretbuf;
dns_name_init(&keyname, NULL);
dns_name_init(&alg, NULL);
/* Create the key name */
isc_buffer_init(&keynamesrc, key->keyid, strlen(key->keyid),
ISC_BUFFERTYPE_TEXT);
isc_buffer_add(&keynamesrc, strlen(key->keyid));
isc_buffer_init(&keynamebuf, keynamedata, sizeof(keynamedata),
ISC_BUFFERTYPE_BINARY);
ret = dns_name_fromtext(&keyname, &keynamesrc, dns_rootname,
ISC_TRUE, &keynamebuf);
if (ret != ISC_R_SUCCESS)
goto failure;
/* Create the algorithm */
if (strcasecmp(key->algorithm, "hmac-md5") == 0)
alg = *dns_tsig_hmacmd5_name;
else {
isc_buffer_init(&algsrc, key->algorithm,
strlen(key->algorithm),
ISC_BUFFERTYPE_TEXT);
isc_buffer_add(&algsrc, strlen(key->algorithm));
isc_buffer_init(&algbuf, algdata, sizeof(algdata),
ISC_BUFFERTYPE_BINARY);
ret = dns_name_fromtext(&alg, &algsrc, dns_rootname,
ISC_TRUE, &algbuf);
if (ret != ISC_R_SUCCESS)
goto failure;
}
if (strlen(key->secret) % 4 != 0) {
ret = ISC_R_BADBASE64;
goto failure;
}
secretalloc = secretlen = strlen(key->secret) * 3 / 4;
secret = isc_mem_get(mctx, secretlen);
if (secret == NULL) {
ret = ISC_R_NOMEMORY;
goto failure;
}
isc_buffer_init(&secretsrc, key->secret, strlen(key->secret),
ISC_BUFFERTYPE_TEXT);
isc_buffer_add(&secretsrc, strlen(key->secret));
isc_buffer_init(&secretbuf, secret, secretlen,
ISC_BUFFERTYPE_BINARY);
ret = isc_lex_create(mctx, strlen(key->secret), &lex);
if (ret != ISC_R_SUCCESS)
goto failure;
ret = isc_lex_openbuffer(lex, &secretsrc);
if (ret != ISC_R_SUCCESS)
goto failure;
ret = isc_base64_tobuffer(lex, &secretbuf, -1);
if (ret != ISC_R_SUCCESS)
goto failure;
secretlen = ISC_BUFFER_USEDCOUNT(&secretbuf);
isc_lex_close(lex);
isc_lex_destroy(&lex);
isc_stdtime_get(&now);
ret = dns_tsigkey_create(&keyname, &alg, secret, secretlen,
ISC_FALSE, NULL, now, now,
mctx, ring, NULL);
isc_mem_put(mctx, secret, secretalloc);
secret = NULL;
if (ret != ISC_R_SUCCESS)
goto failure;
key = ISC_LIST_NEXT(key, next);
}
return (ISC_R_SUCCESS);
failure:
if (lex != NULL)
isc_lex_destroy(&lex);
if (secret != NULL)
isc_mem_put(mctx, secret, secretlen);
return (ret);
}
isc_result_t
dns_tsigkeyring_fromconfig(dns_c_ctx_t *confctx, isc_mem_t *mctx,
dns_tsig_keyring_t **ringp)
{
dns_c_kdeflist_t *keylist = NULL;
dns_tsig_keyring_t *ring = NULL;
isc_result_t result;
result = dns_tsigkeyring_create(mctx, &ring);
if (result != ISC_R_SUCCESS)
return (result);
result = dns_c_ctx_getkdeflist(confctx, &keylist);
if (result == ISC_R_SUCCESS)
result = add_initial_keys(keylist, ring, mctx);
else if (result == ISC_R_NOTFOUND)
result = ISC_R_SUCCESS;
if (result != ISC_R_SUCCESS)
goto failure;
*ringp = ring;
return (ISC_R_SUCCESS);
failure:
dns_tsigkeyring_destroy(&ring);
return (result);
}