dst_api.c revision 65d148653577aec0bd9eadaac9d2a063922e0cf0
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley/*
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews * Portions Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence * Portions Copyright (C) 1999-2003 Internet Software Consortium.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews *
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews * Permission to use, copy, modify, and/or distribute this software for any
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews * purpose with or without fee is hereby granted, provided that the above
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley * copyright notice and this permission notice appear in all copies.
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley *
28a8f5b0de57d269cf2845c69cb6abe18cbd3b3aMark Andrews * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
9c3531d72aeaad6c5f01efe6a1c82023e1379e4dDavid Lawrence * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
f1788d67add6bf3d301e91b3f54fa3c90a87328eBrian Wellington * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
364a82f7c25b62967678027043425201a5e5171aBob Halley *
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley *
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence * Permission to use, copy, modify, and/or distribute this software for any
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence * purpose with or without fee is hereby granted, provided that the above
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley * copyright notice and this permission notice appear in all copies.
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley *
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
c1ee8bb4ba3e9ab1463403ed685729631de406b1Mark Andrews * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley */
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley/*
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley * Principal Author: Brian Wellington
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews * $Id: dst_api.c,v 1.49 2010/01/11 23:48:37 tbox Exp $
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley */
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley/*! \file */
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <config.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews#include <stdlib.h>
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews#include <time.h>
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews#include <isc/buffer.h>
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews#include <isc/dir.h>
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews#include <isc/entropy.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <isc/fsaccess.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <isc/hmacsha.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <isc/lex.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <isc/mem.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <isc/once.h>
c03bb27f0675a6e60ceea66b451548e8481bc05cMark Andrews#include <isc/print.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <isc/random.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <isc/string.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <isc/time.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <isc/util.h>
6e49e91bd08778d7eae45a2229dcf41ed97cc636David Lawrence
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <dns/fixedname.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <dns/keyvalues.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <dns/name.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <dns/rdata.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <dns/rdataclass.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <dns/ttl.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <dns/types.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include <dst/result.h>
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#include "dst_internal.h"
6e49e91bd08778d7eae45a2229dcf41ed97cc636David Lawrence
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#define DST_AS_STR(t) ((t).value.as_textregion.base)
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halleystatic dst_func_t *dst_t_func[DST_MAX_ALGS];
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#ifdef BIND9
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halleystatic isc_entropy_t *dst_entropy_pool = NULL;
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#endif
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halleystatic unsigned int dst_entropy_flags = 0;
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halleystatic isc_boolean_t dst_initialized = ISC_FALSE;
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halleyvoid gss_log(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halleyisc_mem_t *dst__memory_pool = NULL;
368b37b616234fce3d23099eb180f1dd38e1fb62Mark Andrews
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley/*
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley * Static functions.
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley */
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halleystatic dst_key_t * get_key_struct(dns_name_t *name,
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley unsigned int alg,
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley unsigned int flags,
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley unsigned int protocol,
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley unsigned int bits,
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley dns_rdataclass_t rdclass,
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley isc_mem_t *mctx);
7cd4c3ddd1baf5f2b204562fdba3da37c716cc78Andreas Gustafssonstatic isc_result_t write_public_key(const dst_key_t *key, int type,
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley const char *directory);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrewsstatic isc_result_t buildfilename(dns_name_t *name,
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews dns_keytag_t id,
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews unsigned int alg,
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews unsigned int type,
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews const char *directory,
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews isc_buffer_t *out);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrewsstatic isc_result_t computeid(dst_key_t *key);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrewsstatic isc_result_t frombuffer(dns_name_t *name,
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews unsigned int alg,
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews unsigned int flags,
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews unsigned int protocol,
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews dns_rdataclass_t rdclass,
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews isc_buffer_t *source,
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews isc_mem_t *mctx,
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews dst_key_t **keyp);
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrewsstatic isc_result_t algorithm_status(unsigned int alg);
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrewsstatic isc_result_t addsuffix(char *filename, int len,
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews const char *dirname, const char *ofilename,
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley const char *suffix);
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#define RETERR(x) \
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley do { \
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley result = (x); \
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley if (result != ISC_R_SUCCESS) \
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley goto out; \
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley } while (0)
66b2f0d4bfa342770aa5e26a005a0c0ec5071231Bob Halley
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#define CHECKALG(alg) \
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halley do { \
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halley isc_result_t _r; \
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halley _r = algorithm_status(alg); \
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (_r != ISC_R_SUCCESS) \
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley return (_r); \
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley } while (0); \
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley#if defined(OPENSSL) && defined(BIND9)
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halleystatic void *
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halleydefault_memalloc(void *arg, size_t size) {
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley UNUSED(arg);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley if (size == 0U)
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley size = 1;
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley return (malloc(size));
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley}
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halleystatic void
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halleydefault_memfree(void *arg, void *ptr) {
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews UNUSED(arg);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews free(ptr);
29d52c001ff976561669375cf0c866b815a90c49Mark Andrews}
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#endif
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrewsisc_result_t
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrewsdst_lib_init(isc_mem_t *mctx, isc_entropy_t *ectx, unsigned int eflags) {
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (dst_lib_init2(mctx, ectx, NULL, eflags));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews}
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley
7cd4c3ddd1baf5f2b204562fdba3da37c716cc78Andreas Gustafssonisc_result_t
66b2f0d4bfa342770aa5e26a005a0c0ec5071231Bob Halleydst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
6e49e91bd08778d7eae45a2229dcf41ed97cc636David Lawrence const char *engine, unsigned int eflags) {
4607e7a9b8dfb1b41c70e51c2b603daaf22cf302Mark Andrews isc_result_t result;
4607e7a9b8dfb1b41c70e51c2b603daaf22cf302Mark Andrews
4607e7a9b8dfb1b41c70e51c2b603daaf22cf302Mark Andrews REQUIRE(mctx != NULL);
4607e7a9b8dfb1b41c70e51c2b603daaf22cf302Mark Andrews#ifdef BIND9
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley REQUIRE(ectx != NULL);
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#else
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley UNUSED(ectx);
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#endif
66b2f0d4bfa342770aa5e26a005a0c0ec5071231Bob Halley REQUIRE(dst_initialized == ISC_FALSE);
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley#ifndef OPENSSL
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley UNUSED(engine);
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley#endif
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley dst__memory_pool = NULL;
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley
93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews#if defined(OPENSSL) && defined(BIND9)
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley UNUSED(mctx);
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley /*
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews * When using --with-openssl, there seems to be no good way of not
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews * leaking memory due to the openssl error handling mechanism.
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley * Avoid assertions by using a local memory context and not checking
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley * for leaks on exit. Note: as there are leaks we cannot use
66b2f0d4bfa342770aa5e26a005a0c0ec5071231Bob Halley * ISC_MEMFLAG_INTERNAL as it will free up memory still being used
66b2f0d4bfa342770aa5e26a005a0c0ec5071231Bob Halley * by libcrypto.
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley */
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley result = isc_mem_createx2(0, 0, default_memalloc, default_memfree,
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley NULL, &dst__memory_pool, 0);
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley if (result != ISC_R_SUCCESS)
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley return (result);
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley isc_mem_setname(dst__memory_pool, "dst", NULL);
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley#ifndef OPENSSL_LEAKS
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley isc_mem_setdestroycheck(dst__memory_pool, ISC_FALSE);
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley#endif
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley#else
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley isc_mem_attach(mctx, &dst__memory_pool);
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence#endif
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence#ifdef BIND9
fbe2cff19f5cddc67b967764ad95038dfcafc85aEvan Hunt isc_entropy_attach(ectx, &dst_entropy_pool);
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley#endif
b5fff54fe9335b20c02d749831fc0eaeda97198fBrian Wellington dst_entropy_flags = eflags;
b5fff54fe9335b20c02d749831fc0eaeda97198fBrian Wellington
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews dst_result_register();
32f985bcf464816d3a8700185afdebb122cb4cecMark Andrews
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley memset(dst_t_func, 0, sizeof(dst_t_func));
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley RETERR(dst__hmacmd5_init(&dst_t_func[DST_ALG_HMACMD5]));
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley RETERR(dst__hmacsha1_init(&dst_t_func[DST_ALG_HMACSHA1]));
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley RETERR(dst__hmacsha224_init(&dst_t_func[DST_ALG_HMACSHA224]));
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley RETERR(dst__hmacsha256_init(&dst_t_func[DST_ALG_HMACSHA256]));
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley RETERR(dst__hmacsha384_init(&dst_t_func[DST_ALG_HMACSHA384]));
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley RETERR(dst__hmacsha512_init(&dst_t_func[DST_ALG_HMACSHA512]));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#ifdef OPENSSL
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews RETERR(dst__openssl_init(engine));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSAMD5],
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews DST_ALG_RSAMD5));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSASHA1],
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews DST_ALG_RSASHA1));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_NSEC3RSASHA1],
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews DST_ALG_NSEC3RSASHA1));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSASHA256],
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews DST_ALG_RSASHA256));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSASHA512],
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews DST_ALG_RSASHA512));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#ifdef HAVE_OPENSSL_DSA
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews RETERR(dst__openssldsa_init(&dst_t_func[DST_ALG_DSA]));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews RETERR(dst__openssldsa_init(&dst_t_func[DST_ALG_NSEC3DSA]));
e0df061f35a26d2bbd0986aa889f88b3710b32d4Bob Halley#endif
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley RETERR(dst__openssldh_init(&dst_t_func[DST_ALG_DH]));
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#endif /* OPENSSL */
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#ifdef GSSAPI
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley RETERR(dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]));
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#endif
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley dst_initialized = ISC_TRUE;
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley return (ISC_R_SUCCESS);
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halley
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halley out:
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halley /* avoid immediate crash! */
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halley dst_initialized = ISC_TRUE;
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halley dst_lib_destroy();
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halley return (result);
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halley}
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halley
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halleyvoid
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halleydst_lib_destroy(void) {
c1ee8bb4ba3e9ab1463403ed685729631de406b1Mark Andrews int i;
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halley RUNTIME_CHECK(dst_initialized == ISC_TRUE);
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halley dst_initialized = ISC_FALSE;
66b2f0d4bfa342770aa5e26a005a0c0ec5071231Bob Halley
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley for (i = 0; i < DST_MAX_ALGS; i++)
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL)
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley dst_t_func[i]->cleanup();
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley#ifdef OPENSSL
1f1d36a87b65186d9f89aac7f456ab1fd2a39ef6Andreas Gustafsson dst__openssl_destroy();
1f1d36a87b65186d9f89aac7f456ab1fd2a39ef6Andreas Gustafsson#endif
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews if (dst__memory_pool != NULL)
48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews isc_mem_detach(&dst__memory_pool);
66b2f0d4bfa342770aa5e26a005a0c0ec5071231Bob Halley#ifdef BIND9
6de9744cf9c64be2145f663e4051196a4eaa9d45Evan Hunt if (dst_entropy_pool != NULL)
421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews isc_entropy_detach(&dst_entropy_pool);
421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews#endif
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews}
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halleyisc_boolean_t
55254a46f91419b92eee0d20dfb958e8dd52526cBob Halleydst_algorithm_supported(unsigned int alg) {
08af8bf5ade4131fe44926ad04fd489e64a620bbBob Halley REQUIRE(dst_initialized == ISC_TRUE);
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley if (alg >= DST_MAX_ALGS || dst_t_func[alg] == NULL)
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley return (ISC_FALSE);
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley return (ISC_TRUE);
b2ca6fd3a8293440b4d263723525396059cf2400Brian Wellington}
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halleyisc_result_t
c03bb27f0675a6e60ceea66b451548e8481bc05cMark Andrewsdst_context_create(dst_key_t *key, isc_mem_t *mctx, dst_context_t **dctxp) {
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley dst_context_t *dctx;
8569ab045a4cf6ecd1b5a3354ddb1c93ef34ea57Brian Wellington isc_result_t result;
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley REQUIRE(dst_initialized == ISC_TRUE);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley REQUIRE(VALID_KEY(key));
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley REQUIRE(mctx != NULL);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley REQUIRE(dctxp != NULL && *dctxp == NULL);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley if (key->func->createctx == NULL)
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley return (DST_R_UNSUPPORTEDALG);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley if (key->keydata.generic == NULL)
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley return (DST_R_NULLKEY);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
569d094440399b000e059d4cb3434391c2c4d330Michael Graff dctx = isc_mem_get(mctx, sizeof(dst_context_t));
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley if (dctx == NULL)
6de9744cf9c64be2145f663e4051196a4eaa9d45Evan Hunt return (ISC_R_NOMEMORY);
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley dctx->key = key;
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley dctx->mctx = mctx;
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley result = key->func->createctx(key, dctx);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (result != ISC_R_SUCCESS) {
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews isc_mem_put(mctx, dctx, sizeof(dst_context_t));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (result);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews }
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dctx->magic = CTX_MAGIC;
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews *dctxp = dctx;
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley return (ISC_R_SUCCESS);
6e49e91bd08778d7eae45a2229dcf41ed97cc636David Lawrence}
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halleyvoid
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halleydst_context_destroy(dst_context_t **dctxp) {
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley dst_context_t *dctx;
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews REQUIRE(dctxp != NULL && VALID_CTX(*dctxp));
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews dctx = *dctxp;
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley INSIST(dctx->key->func->destroyctx != NULL);
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley dctx->key->func->destroyctx(dctx);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley dctx->magic = 0;
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley isc_mem_put(dctx->mctx, dctx, sizeof(dst_context_t));
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley *dctxp = NULL;
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley}
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
6e49e91bd08778d7eae45a2229dcf41ed97cc636David Lawrenceisc_result_t
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halleydst_context_adddata(dst_context_t *dctx, const isc_region_t *data) {
368b37b616234fce3d23099eb180f1dd38e1fb62Mark Andrews REQUIRE(VALID_CTX(dctx));
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley REQUIRE(data != NULL);
6e49e91bd08778d7eae45a2229dcf41ed97cc636David Lawrence INSIST(dctx->key->func->adddata != NULL);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley return (dctx->key->func->adddata(dctx, data));
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley}
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halleyisc_result_t
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halleydst_context_sign(dst_context_t *dctx, isc_buffer_t *sig) {
b2ca6fd3a8293440b4d263723525396059cf2400Brian Wellington dst_key_t *key;
b2ca6fd3a8293440b4d263723525396059cf2400Brian Wellington
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington REQUIRE(VALID_CTX(dctx));
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington REQUIRE(sig != NULL);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley key = dctx->key;
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley CHECKALG(key->key_alg);
94a08e09db3dc844b6ee4841c368a2d7074a9c3fAndreas Gustafsson if (key->keydata.generic == NULL)
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley return (DST_R_NULLKEY);
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley if (key->func->sign == NULL)
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley return (DST_R_NOTPRIVATEKEY);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley if (key->func->isprivate == NULL ||
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley key->func->isprivate(key) == ISC_FALSE)
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley return (DST_R_NOTPRIVATEKEY);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
8569ab045a4cf6ecd1b5a3354ddb1c93ef34ea57Brian Wellington return (key->func->sign(dctx, sig));
8569ab045a4cf6ecd1b5a3354ddb1c93ef34ea57Brian Wellington}
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halleyisc_result_t
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halleydst_context_verify(dst_context_t *dctx, isc_region_t *sig) {
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley REQUIRE(VALID_CTX(dctx));
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley REQUIRE(sig != NULL);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley CHECKALG(dctx->key->key_alg);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley if (dctx->key->keydata.generic == NULL)
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley return (DST_R_NULLKEY);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley if (dctx->key->func->verify == NULL)
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley return (DST_R_NOTPUBLICKEY);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence return (dctx->key->func->verify(dctx, sig));
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley}
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halleyisc_result_t
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halleydst_key_computesecret(const dst_key_t *pub, const dst_key_t *priv,
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff isc_buffer_t *secret)
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley{
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley REQUIRE(dst_initialized == ISC_TRUE);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley REQUIRE(VALID_KEY(pub) && VALID_KEY(priv));
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley REQUIRE(secret != NULL);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley CHECKALG(pub->key_alg);
c866769e664ba0a6a5e6f9375245f5ccca393009David Lawrence CHECKALG(priv->key_alg);
c866769e664ba0a6a5e6f9375245f5ccca393009David Lawrence
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley if (pub->keydata.generic == NULL || priv->keydata.generic == NULL)
c866769e664ba0a6a5e6f9375245f5ccca393009David Lawrence return (DST_R_NULLKEY);
c866769e664ba0a6a5e6f9375245f5ccca393009David Lawrence
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley if (pub->key_alg != priv->key_alg ||
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley pub->func->computesecret == NULL ||
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley priv->func->computesecret == NULL)
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (DST_R_KEYCANNOTCOMPUTESECRET);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (dst_key_isprivate(priv) == ISC_FALSE)
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (DST_R_NOTPRIVATEKEY);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (pub->func->computesecret(pub, priv, secret));
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley}
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrenceisc_result_t
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halleydst_key_tofile(const dst_key_t *key, int type, const char *directory) {
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley isc_result_t ret = ISC_R_SUCCESS;
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
c866769e664ba0a6a5e6f9375245f5ccca393009David Lawrence REQUIRE(dst_initialized == ISC_TRUE);
c866769e664ba0a6a5e6f9375245f5ccca393009David Lawrence REQUIRE(VALID_KEY(key));
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley REQUIRE((type & (DST_TYPE_PRIVATE | DST_TYPE_PUBLIC)) != 0);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley CHECKALG(key->key_alg);
948eabe2a254a8a278ef6325f3790e75329ee656Bob Halley
4e142a5bccd2944174ad9ae58d86cf03e170054dBob Halley if (key->func->tofile == NULL)
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (DST_R_UNSUPPORTEDALG);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (type & DST_TYPE_PUBLIC) {
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews ret = write_public_key(key, type, directory);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (ret != ISC_R_SUCCESS)
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (ret);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews }
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if ((type & DST_TYPE_PRIVATE) &&
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews (key->key_flags & DNS_KEYFLAG_TYPEMASK) != DNS_KEYTYPE_NOKEY)
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (key->func->tofile(key, directory));
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews else
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (ISC_R_SUCCESS);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews}
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrewsisc_result_t
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrewsdst_key_fromfile(dns_name_t *name, dns_keytag_t id,
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews unsigned int alg, int type, const char *directory,
80b782f356f0692c11b4e52e8dd46ec41704e5a2Mark Andrews isc_mem_t *mctx, dst_key_t **keyp)
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews{
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews char filename[ISC_DIR_NAMEMAX];
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_buffer_t b;
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dst_key_t *key;
80b782f356f0692c11b4e52e8dd46ec41704e5a2Mark Andrews isc_result_t result;
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews REQUIRE(dst_initialized == ISC_TRUE);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews REQUIRE(dns_name_isabsolute(name));
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews REQUIRE((type & (DST_TYPE_PRIVATE | DST_TYPE_PUBLIC)) != 0);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews REQUIRE(mctx != NULL);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews REQUIRE(keyp != NULL && *keyp == NULL);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews CHECKALG(alg);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_buffer_init(&b, filename, sizeof(filename));
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews result = buildfilename(name, id, alg, type, directory, &b);
80b782f356f0692c11b4e52e8dd46ec41704e5a2Mark Andrews if (result != ISC_R_SUCCESS)
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (result);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews key = NULL;
80b782f356f0692c11b4e52e8dd46ec41704e5a2Mark Andrews result = dst_key_fromnamedfile(filename, NULL, type, mctx, &key);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (result != ISC_R_SUCCESS)
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (result);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews result = computeid(key);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (result != ISC_R_SUCCESS) {
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dst_key_free(&key);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (result);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews }
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (!dns_name_equal(name, key->key_name) || id != key->key_id ||
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews alg != key->key_alg) {
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dst_key_free(&key);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (DST_R_INVALIDPRIVATEKEY);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews }
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews key->key_id = id;
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews *keyp = key;
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (ISC_R_SUCCESS);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews}
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrewsisc_result_t
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrewsdst_key_fromnamedfile(const char *filename, const char *dirname,
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews int type, isc_mem_t *mctx, dst_key_t **keyp)
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews{
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_result_t result;
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dst_key_t *pubkey = NULL, *key = NULL;
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews char *newfilename = NULL;
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews int newfilenamelen = 0;
80b782f356f0692c11b4e52e8dd46ec41704e5a2Mark Andrews isc_lex_t *lex = NULL;
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews REQUIRE(dst_initialized == ISC_TRUE);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews REQUIRE(filename != NULL);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews REQUIRE((type & (DST_TYPE_PRIVATE | DST_TYPE_PUBLIC)) != 0);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews REQUIRE(mctx != NULL);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews REQUIRE(keyp != NULL && *keyp == NULL);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews /* If an absolute path is specified, don't use the key directory */
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews#ifndef WIN32
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (filename[0] == '/')
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dirname = NULL;
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews#else /* WIN32 */
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (filename[0] == '/' || filename[0] == '\\')
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews dirname = NULL;
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews#endif
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews newfilenamelen = strlen(filename) + 5;
32f985bcf464816d3a8700185afdebb122cb4cecMark Andrews if (dirname != NULL)
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews newfilenamelen += strlen(dirname) + 1;
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews newfilename = isc_mem_get(mctx, newfilenamelen);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (newfilename == NULL)
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (ISC_R_NOMEMORY);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews result = addsuffix(newfilename, newfilenamelen,
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dirname, filename, ".key");
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews INSIST(result == ISC_R_SUCCESS);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
7ac0df532272d803c3f72ff7a109587e92622f5aMark Andrews result = dst_key_read_public(newfilename, type, mctx, &pubkey);
7ac0df532272d803c3f72ff7a109587e92622f5aMark Andrews isc_mem_put(mctx, newfilename, newfilenamelen);
d0eb2cc33c5db3366a16b1cb0abcca6ec7c8ee3cTatuya JINMEI 神明達哉 newfilename = NULL;
d0eb2cc33c5db3366a16b1cb0abcca6ec7c8ee3cTatuya JINMEI 神明達哉 if (result != ISC_R_SUCCESS)
d0eb2cc33c5db3366a16b1cb0abcca6ec7c8ee3cTatuya JINMEI 神明達哉 return (result);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if ((type & (DST_TYPE_PRIVATE | DST_TYPE_PUBLIC)) == DST_TYPE_PUBLIC ||
0cae66577c69c89086cd065bb297690072b471b4Mark Andrews (pubkey->key_flags & DNS_KEYFLAG_TYPEMASK) == DNS_KEYTYPE_NOKEY) {
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews result = computeid(pubkey);
092d3b76db6b93b8029bd7d083e74fc80fb41858Mark Andrews if (result != ISC_R_SUCCESS) {
a8da00ef95ba37b9d071c2b8db1a0c967e060106Mark Andrews dst_key_free(&pubkey);
a8da00ef95ba37b9d071c2b8db1a0c967e060106Mark Andrews return (result);
7ac0df532272d803c3f72ff7a109587e92622f5aMark Andrews }
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews *keyp = pubkey;
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (ISC_R_SUCCESS);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews }
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews result = algorithm_status(pubkey->key_alg);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (result != ISC_R_SUCCESS) {
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dst_key_free(&pubkey);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (result);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews }
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews key = get_key_struct(pubkey->key_name, pubkey->key_alg,
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews pubkey->key_flags, pubkey->key_proto, 0,
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews pubkey->key_class, mctx);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (key == NULL) {
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dst_key_free(&pubkey);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (ISC_R_NOMEMORY);
6de9744cf9c64be2145f663e4051196a4eaa9d45Evan Hunt }
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (key->func->parse == NULL)
93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews RETERR(DST_R_UNSUPPORTEDALG);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews newfilenamelen = strlen(filename) + 9;
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews if (dirname != NULL)
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews newfilenamelen += strlen(dirname) + 1;
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews newfilename = isc_mem_get(mctx, newfilenamelen);
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews if (newfilename == NULL)
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews RETERR(ISC_R_NOMEMORY);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews result = addsuffix(newfilename, newfilenamelen,
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dirname, filename, ".private");
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews INSIST(result == ISC_R_SUCCESS);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews RETERR(isc_lex_create(mctx, 1500, &lex));
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews RETERR(isc_lex_openfile(lex, newfilename));
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_mem_put(mctx, newfilename, newfilenamelen);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews RETERR(key->func->parse(key, lex, pubkey));
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_lex_destroy(&lex);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews RETERR(computeid(key));
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if (pubkey->key_id != key->key_id)
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews RETERR(DST_R_INVALIDPRIVATEKEY);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dst_key_free(&pubkey);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews *keyp = key;
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (ISC_R_SUCCESS);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews out:
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews if (pubkey != NULL)
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dst_key_free(&pubkey);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (newfilename != NULL)
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews isc_mem_put(mctx, newfilename, newfilenamelen);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (lex != NULL)
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews isc_lex_destroy(&lex);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dst_key_free(&key);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (result);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews}
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrewsisc_result_t
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrewsdst_key_todns(const dst_key_t *key, isc_buffer_t *target) {
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews REQUIRE(dst_initialized == ISC_TRUE);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews REQUIRE(VALID_KEY(key));
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews REQUIRE(target != NULL);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews CHECKALG(key->key_alg);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if (key->func->todns == NULL)
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews return (DST_R_UNSUPPORTEDALG);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if (isc_buffer_availablelength(target) < 4)
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews return (ISC_R_NOSPACE);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews isc_buffer_putuint16(target, (isc_uint16_t)(key->key_flags & 0xffff));
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews isc_buffer_putuint8(target, (isc_uint8_t)key->key_proto);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews isc_buffer_putuint8(target, (isc_uint8_t)key->key_alg);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if (key->key_flags & DNS_KEYFLAG_EXTENDED) {
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if (isc_buffer_availablelength(target) < 2)
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews return (ISC_R_NOSPACE);
515c7f3c43f76d7b439905b18009105364b36100Automatic Updater isc_buffer_putuint16(target,
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews (isc_uint16_t)((key->key_flags >> 16)
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews & 0xffff));
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews }
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews if (key->keydata.generic == NULL) /*%< NULL KEY */
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews return (ISC_R_SUCCESS);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews return (key->func->todns(key, target));
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews}
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrewsisc_result_t
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrewsdst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews{
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews isc_uint8_t alg, proto;
6de9744cf9c64be2145f663e4051196a4eaa9d45Evan Hunt isc_uint32_t flags, extflags;
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews dst_key_t *key = NULL;
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews dns_keytag_t id;
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews isc_region_t r;
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews isc_result_t result;
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews REQUIRE(dst_initialized);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews isc_buffer_remainingregion(source, &r);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if (isc_buffer_remaininglength(source) < 4)
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews return (DST_R_INVALIDPUBLICKEY);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews flags = isc_buffer_getuint16(source);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews proto = isc_buffer_getuint8(source);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews alg = isc_buffer_getuint8(source);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
ce9f893e21d2ffc6f6a78bf226c038c396740aebEvan Hunt id = dst_region_computeid(&r, alg);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if (flags & DNS_KEYFLAG_EXTENDED) {
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if (isc_buffer_remaininglength(source) < 2)
ce9f893e21d2ffc6f6a78bf226c038c396740aebEvan Hunt return (DST_R_INVALIDPUBLICKEY);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews extflags = isc_buffer_getuint16(source);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews flags |= (extflags << 16);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews }
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews result = frombuffer(name, alg, flags, proto, rdclass, source,
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews mctx, &key);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if (result != ISC_R_SUCCESS)
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews return (result);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews key->key_id = id;
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews *keyp = key;
ce9f893e21d2ffc6f6a78bf226c038c396740aebEvan Hunt return (ISC_R_SUCCESS);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews}
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrewsisc_result_t
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrewsdst_key_frombuffer(dns_name_t *name, unsigned int alg,
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews unsigned int flags, unsigned int protocol,
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews dns_rdataclass_t rdclass,
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews{
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews dst_key_t *key = NULL;
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews isc_result_t result;
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews REQUIRE(dst_initialized);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews result = frombuffer(name, alg, flags, protocol, rdclass, source,
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews mctx, &key);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if (result != ISC_R_SUCCESS)
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews return (result);
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews result = computeid(key);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if (result != ISC_R_SUCCESS) {
cccfafa31131844c3b82e4c92f87f243d7ca3287Mark Andrews dst_key_free(&key);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews return (result);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews }
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews *keyp = key;
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews return (ISC_R_SUCCESS);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews}
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrewsisc_result_t
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrewsdst_key_tobuffer(const dst_key_t *key, isc_buffer_t *target) {
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews REQUIRE(dst_initialized == ISC_TRUE);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews REQUIRE(VALID_KEY(key));
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews REQUIRE(target != NULL);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews CHECKALG(key->key_alg);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (key->func->todns == NULL)
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (DST_R_UNSUPPORTEDALG);
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (key->func->todns(key, target));
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews}
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
80b782f356f0692c11b4e52e8dd46ec41704e5a2Mark Andrewsisc_result_t
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrewsdst_key_privatefrombuffer(dst_key_t *key, isc_buffer_t *buffer) {
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews isc_lex_t *lex = NULL;
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_result_t result = ISC_R_SUCCESS;
ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews REQUIRE(dst_initialized == ISC_TRUE);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews REQUIRE(VALID_KEY(key));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews REQUIRE(!dst_key_isprivate(key));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews REQUIRE(buffer != NULL);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (key->func->parse == NULL)
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews RETERR(DST_R_UNSUPPORTEDALG);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews RETERR(isc_lex_create(key->mctx, 1500, &lex));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews RETERR(isc_lex_openbuffer(lex, buffer));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews RETERR(key->func->parse(key, lex, NULL));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews out:
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (lex != NULL)
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews isc_lex_destroy(&lex);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (result);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews}
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6de9744cf9c64be2145f663e4051196a4eaa9d45Evan Huntgss_ctx_id_t
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrewsdst_key_getgssctx(const dst_key_t *key)
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews{
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews REQUIRE(key != NULL);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (key->keydata.gssctx);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews}
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrewsisc_result_t
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrewsdst_key_fromgssapi(dns_name_t *name, gss_ctx_id_t gssctx, isc_mem_t *mctx,
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dst_key_t **keyp)
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews{
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dst_key_t *key;
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews REQUIRE(gssctx != NULL);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews REQUIRE(keyp != NULL && *keyp == NULL);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews key = get_key_struct(name, DST_ALG_GSSAPI, 0, DNS_KEYPROTO_DNSSEC,
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews 0, dns_rdataclass_in, mctx);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (key == NULL)
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (ISC_R_NOMEMORY);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews key->keydata.gssctx = gssctx;
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews *keyp = key;
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (ISC_R_SUCCESS);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews}
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrewsisc_result_t
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrewsdst_key_fromlabel(dns_name_t *name, int alg, unsigned int flags,
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews unsigned int protocol, dns_rdataclass_t rdclass,
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews const char *engine, const char *label, const char *pin,
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews isc_mem_t *mctx, dst_key_t **keyp)
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews{
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dst_key_t *key;
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews isc_result_t result;
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews REQUIRE(dst_initialized == ISC_TRUE);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews REQUIRE(dns_name_isabsolute(name));
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews REQUIRE(mctx != NULL);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews REQUIRE(keyp != NULL && *keyp == NULL);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews REQUIRE(label != NULL);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews CHECKALG(alg);
b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews key = get_key_struct(name, alg, flags, protocol, 0, rdclass, mctx);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (key == NULL)
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (ISC_R_NOMEMORY);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (key->func->fromlabel == NULL) {
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dst_key_free(&key);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (DST_R_UNSUPPORTEDALG);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews }
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews result = key->func->fromlabel(key, engine, label, pin);
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (result != ISC_R_SUCCESS) {
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dst_key_free(&key);
return (result);
}
result = computeid(key);
if (result != ISC_R_SUCCESS) {
dst_key_free(&key);
return (result);
}
*keyp = key;
return (ISC_R_SUCCESS);
}
isc_result_t
dst_key_generate(dns_name_t *name, unsigned int alg,
unsigned int bits, unsigned int param,
unsigned int flags, unsigned int protocol,
dns_rdataclass_t rdclass,
isc_mem_t *mctx, dst_key_t **keyp)
{
return (dst_key_generate2(name, alg, bits, param, flags, protocol,
rdclass, mctx, keyp, NULL));
}
isc_result_t
dst_key_generate2(dns_name_t *name, unsigned int alg,
unsigned int bits, unsigned int param,
unsigned int flags, unsigned int protocol,
dns_rdataclass_t rdclass,
isc_mem_t *mctx, dst_key_t **keyp,
void (*callback)(int))
{
dst_key_t *key;
isc_result_t ret;
REQUIRE(dst_initialized == ISC_TRUE);
REQUIRE(dns_name_isabsolute(name));
REQUIRE(mctx != NULL);
REQUIRE(keyp != NULL && *keyp == NULL);
CHECKALG(alg);
key = get_key_struct(name, alg, flags, protocol, bits, rdclass, mctx);
if (key == NULL)
return (ISC_R_NOMEMORY);
if (bits == 0) { /*%< NULL KEY */
key->key_flags |= DNS_KEYTYPE_NOKEY;
*keyp = key;
return (ISC_R_SUCCESS);
}
if (key->func->generate == NULL) {
dst_key_free(&key);
return (DST_R_UNSUPPORTEDALG);
}
ret = key->func->generate(key, param, callback);
if (ret != ISC_R_SUCCESS) {
dst_key_free(&key);
return (ret);
}
ret = computeid(key);
if (ret != ISC_R_SUCCESS) {
dst_key_free(&key);
return (ret);
}
*keyp = key;
return (ISC_R_SUCCESS);
}
isc_result_t
dst_key_getnum(const dst_key_t *key, int type, isc_uint32_t *valuep)
{
REQUIRE(VALID_KEY(key));
REQUIRE(valuep != NULL);
REQUIRE(type <= DST_MAX_NUMERIC);
if (!key->numset[type])
return (ISC_R_NOTFOUND);
*valuep = key->nums[type];
return (ISC_R_SUCCESS);
}
void
dst_key_setnum(dst_key_t *key, int type, isc_uint32_t value)
{
REQUIRE(VALID_KEY(key));
REQUIRE(type <= DST_MAX_NUMERIC);
key->nums[type] = value;
key->numset[type] = ISC_TRUE;
}
void
dst_key_unsetnum(dst_key_t *key, int type)
{
REQUIRE(VALID_KEY(key));
REQUIRE(type <= DST_MAX_NUMERIC);
key->numset[type] = ISC_FALSE;
}
isc_result_t
dst_key_gettime(const dst_key_t *key, int type, isc_stdtime_t *timep) {
REQUIRE(VALID_KEY(key));
REQUIRE(timep != NULL);
REQUIRE(type <= DST_MAX_TIMES);
if (!key->timeset[type])
return (ISC_R_NOTFOUND);
*timep = key->times[type];
return (ISC_R_SUCCESS);
}
void
dst_key_settime(dst_key_t *key, int type, isc_stdtime_t when) {
REQUIRE(VALID_KEY(key));
REQUIRE(type <= DST_MAX_TIMES);
key->times[type] = when;
key->timeset[type] = ISC_TRUE;
}
void
dst_key_unsettime(dst_key_t *key, int type) {
REQUIRE(VALID_KEY(key));
REQUIRE(type <= DST_MAX_TIMES);
key->timeset[type] = ISC_FALSE;
}
isc_result_t
dst_key_getprivateformat(const dst_key_t *key, int *majorp, int *minorp) {
REQUIRE(VALID_KEY(key));
REQUIRE(majorp != NULL);
REQUIRE(minorp != NULL);
*majorp = key->fmt_major;
*minorp = key->fmt_minor;
return (ISC_R_SUCCESS);
}
void
dst_key_setprivateformat(dst_key_t *key, int major, int minor) {
REQUIRE(VALID_KEY(key));
key->fmt_major = major;
key->fmt_minor = minor;
}
static isc_boolean_t
comparekeys(const dst_key_t *key1, const dst_key_t *key2,
isc_boolean_t match_revoked_key,
isc_boolean_t (*compare)(const dst_key_t *key1,
const dst_key_t *key2))
{
REQUIRE(dst_initialized == ISC_TRUE);
REQUIRE(VALID_KEY(key1));
REQUIRE(VALID_KEY(key2));
if (key1 == key2)
return (ISC_TRUE);
if (key1 == NULL || key2 == NULL)
return (ISC_FALSE);
if (key1->key_alg != key2->key_alg)
return (ISC_FALSE);
/*
* For all algorithms except RSAMD5, revoking the key
* changes the key ID, increasing it by 128. If we want to
* be able to find matching keys even if one of them is the
* revoked version of the other one, then we need to check
* for that possibility.
*/
if (key1->key_id != key2->key_id) {
if (!match_revoked_key)
return (ISC_FALSE);
if (key1->key_alg == DST_ALG_RSAMD5)
return (ISC_FALSE);
if ((key1->key_flags & DNS_KEYFLAG_REVOKE) ==
(key2->key_flags & DNS_KEYFLAG_REVOKE))
return (ISC_FALSE);
if ((key1->key_flags & DNS_KEYFLAG_REVOKE) != 0 &&
key1->key_id != ((key2->key_id + 128) & 0xffff))
return (ISC_FALSE);
if ((key2->key_flags & DNS_KEYFLAG_REVOKE) != 0 &&
key2->key_id != ((key1->key_id + 128) & 0xffff))
return (ISC_FALSE);
}
if (compare != NULL)
return (compare(key1, key2));
else
return (ISC_FALSE);
}
/*
* Compares only the public portion of two keys, by converting them
* both to wire format and comparing the results.
*/
static isc_boolean_t
pub_compare(const dst_key_t *key1, const dst_key_t *key2) {
isc_result_t result;
unsigned char buf1[DST_KEY_MAXSIZE], buf2[DST_KEY_MAXSIZE];
isc_buffer_t b1, b2;
isc_region_t r1, r2;
isc_buffer_init(&b1, buf1, sizeof(buf1));
result = dst_key_todns(key1, &b1);
if (result != ISC_R_SUCCESS)
return (ISC_FALSE);
/* Zero out flags. */
buf1[0] = buf1[1] = 0;
if ((key1->key_flags & DNS_KEYFLAG_EXTENDED) != 0)
isc_buffer_subtract(&b1, 2);
isc_buffer_init(&b2, buf2, sizeof(buf2));
result = dst_key_todns(key2, &b2);
if (result != ISC_R_SUCCESS)
return (ISC_FALSE);
/* Zero out flags. */
buf2[0] = buf2[1] = 0;
if ((key2->key_flags & DNS_KEYFLAG_EXTENDED) != 0)
isc_buffer_subtract(&b2, 2);
isc_buffer_usedregion(&b1, &r1);
/* Remove extended flags. */
if ((key1->key_flags & DNS_KEYFLAG_EXTENDED) != 0) {
memmove(&buf1[4], &buf1[6], r1.length - 6);
r1.length -= 2;
}
isc_buffer_usedregion(&b2, &r2);
/* Remove extended flags. */
if ((key2->key_flags & DNS_KEYFLAG_EXTENDED) != 0) {
memmove(&buf2[4], &buf2[6], r2.length - 6);
r2.length -= 2;
}
return (ISC_TF(isc_region_compare(&r1, &r2) == 0));
}
isc_boolean_t
dst_key_compare(const dst_key_t *key1, const dst_key_t *key2) {
return (comparekeys(key1, key2, ISC_FALSE, key1->func->compare));
}
isc_boolean_t
dst_key_pubcompare(const dst_key_t *key1, const dst_key_t *key2,
isc_boolean_t match_revoked_key)
{
return (comparekeys(key1, key2, match_revoked_key, pub_compare));
}
isc_boolean_t
dst_key_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
REQUIRE(dst_initialized == ISC_TRUE);
REQUIRE(VALID_KEY(key1));
REQUIRE(VALID_KEY(key2));
if (key1 == key2)
return (ISC_TRUE);
if (key1 == NULL || key2 == NULL)
return (ISC_FALSE);
if (key1->key_alg == key2->key_alg &&
key1->func->paramcompare != NULL &&
key1->func->paramcompare(key1, key2) == ISC_TRUE)
return (ISC_TRUE);
else
return (ISC_FALSE);
}
void
dst_key_free(dst_key_t **keyp) {
isc_mem_t *mctx;
dst_key_t *key;
REQUIRE(dst_initialized == ISC_TRUE);
REQUIRE(keyp != NULL && VALID_KEY(*keyp));
key = *keyp;
mctx = key->mctx;
if (key->keydata.generic != NULL) {
INSIST(key->func->destroy != NULL);
key->func->destroy(key);
}
if (key->engine != NULL)
isc_mem_free(mctx, key->engine);
if (key->label != NULL)
isc_mem_free(mctx, key->label);
dns_name_free(key->key_name, mctx);
isc_mem_put(mctx, key->key_name, sizeof(dns_name_t));
memset(key, 0, sizeof(dst_key_t));
isc_mem_put(mctx, key, sizeof(dst_key_t));
*keyp = NULL;
}
isc_boolean_t
dst_key_isprivate(const dst_key_t *key) {
REQUIRE(VALID_KEY(key));
INSIST(key->func->isprivate != NULL);
return (key->func->isprivate(key));
}
isc_result_t
dst_key_buildfilename(const dst_key_t *key, int type,
const char *directory, isc_buffer_t *out) {
REQUIRE(VALID_KEY(key));
REQUIRE(type == DST_TYPE_PRIVATE || type == DST_TYPE_PUBLIC ||
type == 0);
return (buildfilename(key->key_name, key->key_id, key->key_alg,
type, directory, out));
}
isc_result_t
dst_key_sigsize(const dst_key_t *key, unsigned int *n) {
REQUIRE(dst_initialized == ISC_TRUE);
REQUIRE(VALID_KEY(key));
REQUIRE(n != NULL);
/* XXXVIX this switch statement is too sparse to gen a jump table. */
switch (key->key_alg) {
case DST_ALG_RSAMD5:
case DST_ALG_RSASHA1:
case DST_ALG_NSEC3RSASHA1:
case DST_ALG_RSASHA256:
case DST_ALG_RSASHA512:
*n = (key->key_size + 7) / 8;
break;
case DST_ALG_DSA:
case DST_ALG_NSEC3DSA:
*n = DNS_SIG_DSASIGSIZE;
break;
case DST_ALG_HMACMD5:
*n = 16;
break;
case DST_ALG_HMACSHA1:
*n = ISC_SHA1_DIGESTLENGTH;
break;
case DST_ALG_HMACSHA224:
*n = ISC_SHA224_DIGESTLENGTH;
break;
case DST_ALG_HMACSHA256:
*n = ISC_SHA256_DIGESTLENGTH;
break;
case DST_ALG_HMACSHA384:
*n = ISC_SHA384_DIGESTLENGTH;
break;
case DST_ALG_HMACSHA512:
*n = ISC_SHA512_DIGESTLENGTH;
break;
case DST_ALG_GSSAPI:
*n = 128; /*%< XXX */
break;
case DST_ALG_DH:
default:
return (DST_R_UNSUPPORTEDALG);
}
return (ISC_R_SUCCESS);
}
isc_result_t
dst_key_secretsize(const dst_key_t *key, unsigned int *n) {
REQUIRE(dst_initialized == ISC_TRUE);
REQUIRE(VALID_KEY(key));
REQUIRE(n != NULL);
if (key->key_alg == DST_ALG_DH)
*n = (key->key_size + 7) / 8;
else
return (DST_R_UNSUPPORTEDALG);
return (ISC_R_SUCCESS);
}
/*%
* Set the flags on a key, then recompute the key ID
*/
isc_result_t
dst_key_setflags(dst_key_t *key, isc_uint32_t flags) {
REQUIRE(VALID_KEY(key));
key->key_flags = flags;
return (computeid(key));
}
void
dst_key_format(dst_key_t *key, char *cp, unsigned int size) {
char namestr[DNS_NAME_FORMATSIZE];
char algstr[DNS_NAME_FORMATSIZE];
dns_name_format(dst_key_name(key), namestr, sizeof(namestr));
dns_secalg_format((dns_secalg_t) dst_key_alg(key), algstr,
sizeof(algstr));
snprintf(cp, size, "%s/%s/%d", namestr, algstr, dst_key_id(key));
}
/***
*** Static methods
***/
/*%
* Allocates a key structure and fills in some of the fields.
*/
static dst_key_t *
get_key_struct(dns_name_t *name, unsigned int alg,
unsigned int flags, unsigned int protocol,
unsigned int bits, dns_rdataclass_t rdclass,
isc_mem_t *mctx)
{
dst_key_t *key;
isc_result_t result;
int i;
key = (dst_key_t *) isc_mem_get(mctx, sizeof(dst_key_t));
if (key == NULL)
return (NULL);
memset(key, 0, sizeof(dst_key_t));
key->magic = KEY_MAGIC;
key->key_name = isc_mem_get(mctx, sizeof(dns_name_t));
if (key->key_name == NULL) {
isc_mem_put(mctx, key, sizeof(dst_key_t));
return (NULL);
}
dns_name_init(key->key_name, NULL);
result = dns_name_dup(name, mctx, key->key_name);
if (result != ISC_R_SUCCESS) {
isc_mem_put(mctx, key->key_name, sizeof(dns_name_t));
isc_mem_put(mctx, key, sizeof(dst_key_t));
return (NULL);
}
key->key_alg = alg;
key->key_flags = flags;
key->key_proto = protocol;
key->mctx = mctx;
key->keydata.generic = NULL;
key->key_size = bits;
key->key_class = rdclass;
key->func = dst_t_func[alg];
key->fmt_major = 0;
key->fmt_minor = 0;
for (i = 0; i < (DST_MAX_TIMES + 1); i++) {
key->times[i] = 0;
key->timeset[i] = ISC_FALSE;
}
return (key);
}
/*%
* Reads a public key from disk
*/
isc_result_t
dst_key_read_public(const char *filename, int type,
isc_mem_t *mctx, dst_key_t **keyp)
{
u_char rdatabuf[DST_KEY_MAXSIZE];
isc_buffer_t b;
dns_fixedname_t name;
isc_lex_t *lex = NULL;
isc_token_t token;
isc_result_t ret;
dns_rdata_t rdata = DNS_RDATA_INIT;
unsigned int opt = ISC_LEXOPT_DNSMULTILINE;
dns_rdataclass_t rdclass = dns_rdataclass_in;
isc_lexspecials_t specials;
isc_uint32_t ttl;
isc_result_t result;
dns_rdatatype_t keytype;
/*
* Open the file and read its formatted contents
* File format:
* domain.name [ttl] [class] [KEY|DNSKEY] <flags> <protocol> <algorithm> <key>
*/
/* 1500 should be large enough for any key */
ret = isc_lex_create(mctx, 1500, &lex);
if (ret != ISC_R_SUCCESS)
goto cleanup;
memset(specials, 0, sizeof(specials));
specials['('] = 1;
specials[')'] = 1;
specials['"'] = 1;
isc_lex_setspecials(lex, specials);
isc_lex_setcomments(lex, ISC_LEXCOMMENT_DNSMASTERFILE);
ret = isc_lex_openfile(lex, filename);
if (ret != ISC_R_SUCCESS)
goto cleanup;
#define NEXTTOKEN(lex, opt, token) { \
ret = isc_lex_gettoken(lex, opt, token); \
if (ret != ISC_R_SUCCESS) \
goto cleanup; \
}
#define BADTOKEN() { \
ret = ISC_R_UNEXPECTEDTOKEN; \
goto cleanup; \
}
/* Read the domain name */
NEXTTOKEN(lex, opt, &token);
if (token.type != isc_tokentype_string)
BADTOKEN();
/*
* We don't support "@" in .key files.
*/
if (!strcmp(DST_AS_STR(token), "@"))
BADTOKEN();
dns_fixedname_init(&name);
isc_buffer_init(&b, DST_AS_STR(token), strlen(DST_AS_STR(token)));
isc_buffer_add(&b, strlen(DST_AS_STR(token)));
ret = dns_name_fromtext(dns_fixedname_name(&name), &b, dns_rootname,
0, NULL);
if (ret != ISC_R_SUCCESS)
goto cleanup;
/* Read the next word: either TTL, class, or 'KEY' */
NEXTTOKEN(lex, opt, &token);
if (token.type != isc_tokentype_string)
BADTOKEN();
/* If it's a TTL, read the next one */
result = dns_ttl_fromtext(&token.value.as_textregion, &ttl);
if (result == ISC_R_SUCCESS)
NEXTTOKEN(lex, opt, &token);
if (token.type != isc_tokentype_string)
BADTOKEN();
ret = dns_rdataclass_fromtext(&rdclass, &token.value.as_textregion);
if (ret == ISC_R_SUCCESS)
NEXTTOKEN(lex, opt, &token);
if (token.type != isc_tokentype_string)
BADTOKEN();
if (strcasecmp(DST_AS_STR(token), "DNSKEY") == 0)
keytype = dns_rdatatype_dnskey;
else if (strcasecmp(DST_AS_STR(token), "KEY") == 0)
keytype = dns_rdatatype_key; /*%< SIG(0), TKEY */
else
BADTOKEN();
if (((type & DST_TYPE_KEY) != 0 && keytype != dns_rdatatype_key) ||
((type & DST_TYPE_KEY) == 0 && keytype != dns_rdatatype_dnskey)) {
ret = DST_R_BADKEYTYPE;
goto cleanup;
}
isc_buffer_init(&b, rdatabuf, sizeof(rdatabuf));
ret = dns_rdata_fromtext(&rdata, rdclass, keytype, lex, NULL,
ISC_FALSE, mctx, &b, NULL);
if (ret != ISC_R_SUCCESS)
goto cleanup;
ret = dst_key_fromdns(dns_fixedname_name(&name), rdclass, &b, mctx,
keyp);
if (ret != ISC_R_SUCCESS)
goto cleanup;
cleanup:
if (lex != NULL)
isc_lex_destroy(&lex);
return (ret);
}
static isc_boolean_t
issymmetric(const dst_key_t *key) {
REQUIRE(dst_initialized == ISC_TRUE);
REQUIRE(VALID_KEY(key));
/* XXXVIX this switch statement is too sparse to gen a jump table. */
switch (key->key_alg) {
case DST_ALG_RSAMD5:
case DST_ALG_RSASHA1:
case DST_ALG_NSEC3RSASHA1:
case DST_ALG_RSASHA256:
case DST_ALG_RSASHA512:
case DST_ALG_DSA:
case DST_ALG_NSEC3DSA:
case DST_ALG_DH:
return (ISC_FALSE);
case DST_ALG_HMACMD5:
case DST_ALG_GSSAPI:
return (ISC_TRUE);
default:
return (ISC_FALSE);
}
}
/*%
* Write key timing metadata to a file pointer, preceded by 'tag'
*/
static void
printtime(const dst_key_t *key, int type, const char *tag, FILE *stream) {
isc_result_t result;
const char *output;
isc_stdtime_t when;
time_t t;
result = dst_key_gettime(key, type, &when);
if (result == ISC_R_NOTFOUND)
return;
/* time_t and isc_stdtime_t might be different sizes */
t = when;
output = ctime(&t);
fprintf(stream, "%s: %s", tag, output);
}
/*%
* Writes a public key to disk in DNS format.
*/
static isc_result_t
write_public_key(const dst_key_t *key, int type, const char *directory) {
FILE *fp;
isc_buffer_t keyb, textb, fileb, classb;
isc_region_t r;
char filename[ISC_DIR_NAMEMAX];
unsigned char key_array[DST_KEY_MAXSIZE];
char text_array[DST_KEY_MAXTEXTSIZE];
char class_array[10];
isc_result_t ret;
dns_rdata_t rdata = DNS_RDATA_INIT;
isc_fsaccess_t access;
REQUIRE(VALID_KEY(key));
isc_buffer_init(&keyb, key_array, sizeof(key_array));
isc_buffer_init(&textb, text_array, sizeof(text_array));
isc_buffer_init(&classb, class_array, sizeof(class_array));
ret = dst_key_todns(key, &keyb);
if (ret != ISC_R_SUCCESS)
return (ret);
isc_buffer_usedregion(&keyb, &r);
dns_rdata_fromregion(&rdata, key->key_class, dns_rdatatype_dnskey, &r);
ret = dns_rdata_totext(&rdata, (dns_name_t *) NULL, &textb);
if (ret != ISC_R_SUCCESS)
return (DST_R_INVALIDPUBLICKEY);
ret = dns_rdataclass_totext(key->key_class, &classb);
if (ret != ISC_R_SUCCESS)
return (DST_R_INVALIDPUBLICKEY);
/*
* Make the filename.
*/
isc_buffer_init(&fileb, filename, sizeof(filename));
ret = dst_key_buildfilename(key, DST_TYPE_PUBLIC, directory, &fileb);
if (ret != ISC_R_SUCCESS)
return (ret);
/*
* Create public key file.
*/
if ((fp = fopen(filename, "w")) == NULL)
return (DST_R_WRITEERROR);
if (issymmetric(key)) {
access = 0;
isc_fsaccess_add(ISC_FSACCESS_OWNER,
ISC_FSACCESS_READ | ISC_FSACCESS_WRITE,
&access);
(void)isc_fsaccess_set(filename, access);
}
/* Write key information in comments */
if ((type & DST_TYPE_KEY) == 0) {
fprintf(fp, "; This is a %s%s-signing key, keyid %d, for ",
(key->key_flags & DNS_KEYFLAG_REVOKE) != 0 ?
"revoked " :
"",
(key->key_flags & DNS_KEYFLAG_KSK) != 0 ?
"key" :
"zone",
key->key_id);
ret = dns_name_print(key->key_name, fp);
if (ret != ISC_R_SUCCESS) {
fclose(fp);
return (ret);
}
fputc('\n', fp);
printtime(key, DST_TIME_CREATED, "; Created", fp);
printtime(key, DST_TIME_PUBLISH, "; Publish", fp);
printtime(key, DST_TIME_ACTIVATE, "; Activate", fp);
printtime(key, DST_TIME_REVOKE, "; Revoke", fp);
printtime(key, DST_TIME_INACTIVE, "; Inactive", fp);
printtime(key, DST_TIME_DELETE, "; Delete", fp);
}
/* Now print the actual key */
ret = dns_name_print(key->key_name, fp);
fprintf(fp, " ");
isc_buffer_usedregion(&classb, &r);
isc_util_fwrite(r.base, 1, r.length, fp);
if ((type & DST_TYPE_KEY) != 0)
fprintf(fp, " KEY ");
else
fprintf(fp, " DNSKEY ");
isc_buffer_usedregion(&textb, &r);
isc_util_fwrite(r.base, 1, r.length, fp);
fputc('\n', fp);
fflush(fp);
if (ferror(fp))
ret = DST_R_WRITEERROR;
fclose(fp);
return (ret);
}
static isc_result_t
buildfilename(dns_name_t *name, dns_keytag_t id,
unsigned int alg, unsigned int type,
const char *directory, isc_buffer_t *out)
{
const char *suffix = "";
unsigned int len;
isc_result_t result;
REQUIRE(out != NULL);
if ((type & DST_TYPE_PRIVATE) != 0)
suffix = ".private";
else if (type == DST_TYPE_PUBLIC)
suffix = ".key";
if (directory != NULL) {
if (isc_buffer_availablelength(out) < strlen(directory))
return (ISC_R_NOSPACE);
isc_buffer_putstr(out, directory);
if (strlen(directory) > 0U &&
directory[strlen(directory) - 1] != '/')
isc_buffer_putstr(out, "/");
}
if (isc_buffer_availablelength(out) < 1)
return (ISC_R_NOSPACE);
isc_buffer_putstr(out, "K");
result = dns_name_tofilenametext(name, ISC_FALSE, out);
if (result != ISC_R_SUCCESS)
return (result);
len = 1 + 3 + 1 + 5 + strlen(suffix) + 1;
if (isc_buffer_availablelength(out) < len)
return (ISC_R_NOSPACE);
sprintf((char *) isc_buffer_used(out), "+%03d+%05d%s", alg, id,
suffix);
isc_buffer_add(out, len);
return (ISC_R_SUCCESS);
}
static isc_result_t
computeid(dst_key_t *key) {
isc_buffer_t dnsbuf;
unsigned char dns_array[DST_KEY_MAXSIZE];
isc_region_t r;
isc_result_t ret;
isc_buffer_init(&dnsbuf, dns_array, sizeof(dns_array));
ret = dst_key_todns(key, &dnsbuf);
if (ret != ISC_R_SUCCESS)
return (ret);
isc_buffer_usedregion(&dnsbuf, &r);
key->key_id = dst_region_computeid(&r, key->key_alg);
return (ISC_R_SUCCESS);
}
static isc_result_t
frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
unsigned int protocol, dns_rdataclass_t rdclass,
isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
{
dst_key_t *key;
isc_result_t ret;
REQUIRE(dns_name_isabsolute(name));
REQUIRE(source != NULL);
REQUIRE(mctx != NULL);
REQUIRE(keyp != NULL && *keyp == NULL);
key = get_key_struct(name, alg, flags, protocol, 0, rdclass, mctx);
if (key == NULL)
return (ISC_R_NOMEMORY);
if (isc_buffer_remaininglength(source) > 0) {
ret = algorithm_status(alg);
if (ret != ISC_R_SUCCESS) {
dst_key_free(&key);
return (ret);
}
if (key->func->fromdns == NULL) {
dst_key_free(&key);
return (DST_R_UNSUPPORTEDALG);
}
ret = key->func->fromdns(key, source);
if (ret != ISC_R_SUCCESS) {
dst_key_free(&key);
return (ret);
}
}
*keyp = key;
return (ISC_R_SUCCESS);
}
static isc_result_t
algorithm_status(unsigned int alg) {
REQUIRE(dst_initialized == ISC_TRUE);
if (dst_algorithm_supported(alg))
return (ISC_R_SUCCESS);
#ifndef OPENSSL
if (alg == DST_ALG_RSAMD5 || alg == DST_ALG_RSASHA1 ||
alg == DST_ALG_DSA || alg == DST_ALG_DH ||
alg == DST_ALG_HMACMD5 || alg == DST_ALG_NSEC3DSA ||
alg == DST_ALG_NSEC3RSASHA1 ||
alg == DST_ALG_RSASHA256 || alg == DST_ALG_RSASHA512)
return (DST_R_NOCRYPTO);
#endif
return (DST_R_UNSUPPORTEDALG);
}
static isc_result_t
addsuffix(char *filename, int len, const char *odirname,
const char *ofilename, const char *suffix)
{
int olen = strlen(ofilename);
int n;
if (olen > 1 && ofilename[olen - 1] == '.')
olen -= 1;
else if (olen > 8 && strcmp(ofilename + olen - 8, ".private") == 0)
olen -= 8;
else if (olen > 4 && strcmp(ofilename + olen - 4, ".key") == 0)
olen -= 4;
if (odirname == NULL)
n = snprintf(filename, len, "%.*s%s", olen, ofilename, suffix);
else
n = snprintf(filename, len, "%s/%.*s%s",
odirname, olen, ofilename, suffix);
if (n < 0)
return (ISC_R_FAILURE);
if (n >= len)
return (ISC_R_NOSPACE);
return (ISC_R_SUCCESS);
}
isc_result_t
dst__entropy_getdata(void *buf, unsigned int len, isc_boolean_t pseudo) {
#ifdef BIND9
unsigned int flags = dst_entropy_flags;
if (len == 0)
return (ISC_R_SUCCESS);
if (pseudo)
flags &= ~ISC_ENTROPY_GOODONLY;
else
flags |= ISC_ENTROPY_BLOCKING;
return (isc_entropy_getdata(dst_entropy_pool, buf, len, NULL, flags));
#else
UNUSED(buf);
UNUSED(len);
UNUSED(pseudo);
return (ISC_R_NOTIMPLEMENTED);
#endif
}
unsigned int
dst__entropy_status(void) {
#ifdef BIND9
#ifdef GSSAPI
unsigned int flags = dst_entropy_flags;
isc_result_t ret;
unsigned char buf[32];
static isc_boolean_t first = ISC_TRUE;
if (first) {
/* Someone believes RAND_status() initializes the PRNG */
flags &= ~ISC_ENTROPY_GOODONLY;
ret = isc_entropy_getdata(dst_entropy_pool, buf,
sizeof(buf), NULL, flags);
INSIST(ret == ISC_R_SUCCESS);
isc_entropy_putdata(dst_entropy_pool, buf,
sizeof(buf), 2 * sizeof(buf));
first = ISC_FALSE;
}
#endif
return (isc_entropy_status(dst_entropy_pool));
#else
return (0);
#endif
}