2N/A#ifndef LINT
2N/Astatic const char rcsid[] = "$Header: /proj/cvs/prod/libbind/dst/dst_api.c,v 1.17 2007/09/24 17:18:25 each Exp $";
2N/A#endif
2N/A
2N/A/*
2N/A * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
2N/A *
2N/A * Permission to use, copy modify, and distribute this software for any
2N/A * purpose with or without fee is hereby granted, provided that the above
2N/A * copyright notice and this permission notice appear in all copies.
2N/A *
2N/A * THE SOFTWARE IS PROVIDED "AS IS" AND TRUSTED INFORMATION SYSTEMS
2N/A * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
2N/A * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
2N/A * TRUSTED INFORMATION SYSTEMS BE LIABLE FOR ANY SPECIAL, DIRECT,
2N/A * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
2N/A * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
2N/A * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
2N/A * WITH THE USE OR PERFORMANCE OF THE SOFTWARE.
2N/A */
2N/A/*
2N/A * This file contains the interface between the DST API and the crypto API.
2N/A * This is the only file that needs to be changed if the crypto system is
2N/A * changed. Exported functions are:
2N/A * void dst_init() Initialize the toolkit
2N/A * int dst_check_algorithm() Function to determines if alg is suppored.
2N/A * int dst_compare_keys() Function to compare two keys for equality.
2N/A * int dst_sign_data() Incremental signing routine.
2N/A * int dst_verify_data() Incremental verify routine.
2N/A * int dst_generate_key() Function to generate new KEY
2N/A * DST_KEY *dst_read_key() Function to retrieve private/public KEY.
2N/A * void dst_write_key() Function to write out a key.
2N/A * DST_KEY *dst_dnskey_to_key() Function to convert DNS KEY RR to a DST
2N/A * KEY structure.
2N/A * int dst_key_to_dnskey() Function to return a public key in DNS
2N/A * format binary
2N/A * DST_KEY *dst_buffer_to_key() Converst a data in buffer to KEY
2N/A * int *dst_key_to_buffer() Writes out DST_KEY key matterial in buffer
2N/A * void dst_free_key() Releases all memory referenced by key structure
2N/A */
2N/A
2N/A#include "port_before.h"
2N/A#include <stdio.h>
2N/A#include <errno.h>
2N/A#include <fcntl.h>
2N/A#include <stdlib.h>
2N/A#include <unistd.h>
2N/A#include <string.h>
2N/A#include <memory.h>
2N/A#include <ctype.h>
2N/A#include <time.h>
2N/A#include <sys/param.h>
2N/A#include <sys/stat.h>
2N/A#include <sys/socket.h>
2N/A#include <netinet/in.h>
2N/A#include <arpa/nameser.h>
2N/A#include <resolv.h>
2N/A
2N/A#include "dst_internal.h"
2N/A#include "port_after.h"
2N/A
2N/A/* static variables */
2N/Astatic int done_init = 0;
2N/Adst_func *dst_t_func[DST_MAX_ALGS];
2N/Aconst char *key_file_fmt_str = "Private-key-format: v%s\nAlgorithm: %d (%s)\n";
2N/Aconst char *dst_path = "";
2N/A
2N/A/* internal I/O functions */
2N/Astatic DST_KEY *dst_s_read_public_key(const char *in_name,
2N/A const u_int16_t in_id, int in_alg);
2N/Astatic int dst_s_read_private_key_file(char *name, DST_KEY *pk_key,
2N/A u_int16_t in_id, int in_alg);
2N/Astatic int dst_s_write_public_key(const DST_KEY *key);
2N/Astatic int dst_s_write_private_key(const DST_KEY *key);
2N/A
2N/A/* internal function to set up data structure */
2N/Astatic DST_KEY *dst_s_get_key_struct(const char *name, const int alg,
2N/A const int flags, const int protocol,
2N/A const int bits);
2N/A
2N/A/*%
2N/A * dst_init
2N/A * This function initializes the Digital Signature Toolkit.
2N/A * Right now, it just checks the DSTKEYPATH environment variable.
2N/A * Parameters
2N/A * none
2N/A * Returns
2N/A * none
2N/A */
2N/Avoid
2N/Adst_init()
2N/A{
2N/A char *s;
2N/A int len;
2N/A
2N/A if (done_init != 0)
2N/A return;
2N/A done_init = 1;
2N/A
2N/A s = getenv("DSTKEYPATH");
2N/A len = 0;
2N/A if (s) {
2N/A struct stat statbuf;
2N/A
2N/A len = strlen(s);
2N/A if (len > PATH_MAX) {
2N/A EREPORT(("%s is longer than %d characters, ignoring\n",
2N/A s, PATH_MAX));
2N/A } else if (stat(s, &statbuf) != 0 || !S_ISDIR(statbuf.st_mode)) {
2N/A EREPORT(("%s is not a valid directory\n", s));
2N/A } else {
2N/A char *tmp;
2N/A tmp = (char *) malloc(len + 2);
2N/A memcpy(tmp, s, len + 1);
2N/A if (tmp[strlen(tmp) - 1] != '/') {
2N/A tmp[strlen(tmp) + 1] = 0;
2N/A tmp[strlen(tmp)] = '/';
2N/A }
2N/A dst_path = tmp;
2N/A }
2N/A }
2N/A memset(dst_t_func, 0, sizeof(dst_t_func));
2N/A /* first one is selected */
2N/A dst_hmac_md5_init();
2N/A}
2N/A
2N/A/*%
2N/A * dst_check_algorithm
2N/A * This function determines if the crypto system for the specified
2N/A * algorithm is present.
2N/A * Parameters
2N/A * alg 1 KEY_RSA
2N/A * 3 KEY_DSA
2N/A * 157 KEY_HMAC_MD5
2N/A * future algorithms TBD and registered with IANA.
2N/A * Returns
2N/A * 1 - The algorithm is available.
2N/A * 0 - The algorithm is not available.
2N/A */
2N/Aint
2N/Adst_check_algorithm(const int alg)
2N/A{
2N/A return (dst_t_func[alg] != NULL);
2N/A}
2N/A
2N/A/*%
2N/A * dst_s_get_key_struct
2N/A * This function allocates key structure and fills in some of the
2N/A * fields of the structure.
2N/A * Parameters:
2N/A * name: the name of the key
2N/A * alg: the algorithm number
2N/A * flags: the dns flags of the key
2N/A * protocol: the dns protocol of the key
2N/A * bits: the size of the key
2N/A * Returns:
2N/A * NULL if error
2N/A * valid pointer otherwise
2N/A */
2N/Astatic DST_KEY *
2N/Adst_s_get_key_struct(const char *name, const int alg, const int flags,
2N/A const int protocol, const int bits)
2N/A{
2N/A DST_KEY *new_key = NULL;
2N/A
2N/A if (dst_check_algorithm(alg)) /*%< make sure alg is available */
2N/A new_key = (DST_KEY *) malloc(sizeof(*new_key));
2N/A if (new_key == NULL)
2N/A return (NULL);
2N/A
2N/A memset(new_key, 0, sizeof(*new_key));
2N/A new_key->dk_key_name = strdup(name);
2N/A if (new_key->dk_key_name == NULL) {
2N/A free(new_key);
2N/A return (NULL);
2N/A }
2N/A new_key->dk_alg = alg;
2N/A new_key->dk_flags = flags;
2N/A new_key->dk_proto = protocol;
2N/A new_key->dk_KEY_struct = NULL;
2N/A new_key->dk_key_size = bits;
2N/A new_key->dk_func = dst_t_func[alg];
2N/A return (new_key);
2N/A}
2N/A
2N/A/*%
2N/A * dst_compare_keys
2N/A * Compares two keys for equality.
2N/A * Parameters
2N/A * key1, key2 Two keys to be compared.
2N/A * Returns
2N/A * 0 The keys are equal.
2N/A * non-zero The keys are not equal.
2N/A */
2N/A
2N/Aint
2N/Adst_compare_keys(const DST_KEY *key1, const DST_KEY *key2)
2N/A{
2N/A if (key1 == key2)
2N/A return (0);
2N/A if (key1 == NULL || key2 == NULL)
2N/A return (4);
2N/A if (key1->dk_alg != key2->dk_alg)
2N/A return (1);
2N/A if (key1->dk_key_size != key2->dk_key_size)
2N/A return (2);
2N/A if (key1->dk_id != key2->dk_id)
2N/A return (3);
2N/A return (key1->dk_func->compare(key1, key2));
2N/A}
2N/A
2N/A/*%
2N/A * dst_sign_data
2N/A * An incremental signing function. Data is signed in steps.
2N/A * First the context must be initialized (SIG_MODE_INIT).
2N/A * Then data is hashed (SIG_MODE_UPDATE). Finally the signature
2N/A * itself is created (SIG_MODE_FINAL). This function can be called
2N/A * once with INIT, UPDATE and FINAL modes all set, or it can be
2N/A * called separately with a different mode set for each step. The
2N/A * UPDATE step can be repeated.
2N/A * Parameters
2N/A * mode A bit mask used to specify operation(s) to be performed.
2N/A * SIG_MODE_INIT 1 Initialize digest
2N/A * SIG_MODE_UPDATE 2 Add data to digest
2N/A * SIG_MODE_FINAL 4 Generate signature
2N/A * from signature
2N/A * SIG_MODE_ALL (SIG_MODE_INIT,SIG_MODE_UPDATE,SIG_MODE_FINAL
2N/A * data Data to be signed.
2N/A * len The length in bytes of data to be signed.
2N/A * in_key Contains a private key to sign with.
2N/A * KEY structures should be handled (created, converted,
2N/A * compared, stored, freed) by the DST.
2N/A * signature
2N/A * The location to which the signature will be written.
2N/A * sig_len Length of the signature field in bytes.
2N/A * Return
2N/A * 0 Successfull INIT or Update operation
2N/A * &gt;0 success FINAL (sign) operation
2N/A * &lt;0 failure
2N/A */
2N/A
2N/Aint
2N/Adst_sign_data(const int mode, DST_KEY *in_key, void **context,
2N/A const u_char *data, const int len,
2N/A u_char *signature, const int sig_len)
2N/A{
2N/A DUMP(data, mode, len, "dst_sign_data()");
2N/A
2N/A if (mode & SIG_MODE_FINAL &&
2N/A (in_key->dk_KEY_struct == NULL || signature == NULL))
2N/A return (MISSING_KEY_OR_SIGNATURE);
2N/A
2N/A if (in_key->dk_func && in_key->dk_func->sign)
2N/A return (in_key->dk_func->sign(mode, in_key, context, data, len,
2N/A signature, sig_len));
2N/A return (UNKNOWN_KEYALG);
2N/A}
2N/A
2N/A/*%
2N/A * dst_verify_data
2N/A * An incremental verify function. Data is verified in steps.
2N/A * First the context must be initialized (SIG_MODE_INIT).
2N/A * Then data is hashed (SIG_MODE_UPDATE). Finally the signature
2N/A * is verified (SIG_MODE_FINAL). This function can be called
2N/A * once with INIT, UPDATE and FINAL modes all set, or it can be
2N/A * called separately with a different mode set for each step. The
2N/A * UPDATE step can be repeated.
2N/A * Parameters
2N/A * mode Operations to perform this time.
2N/A * SIG_MODE_INIT 1 Initialize digest
2N/A * SIG_MODE_UPDATE 2 add data to digest
2N/A * SIG_MODE_FINAL 4 verify signature
2N/A * SIG_MODE_ALL
2N/A * (SIG_MODE_INIT,SIG_MODE_UPDATE,SIG_MODE_FINAL)
2N/A * data Data to pass through the hash function.
2N/A * len Length of the data in bytes.
2N/A * in_key Key for verification.
2N/A * signature Location of signature.
2N/A * sig_len Length of the signature in bytes.
2N/A * Returns
2N/A * 0 Verify success
2N/A * Non-Zero Verify Failure
2N/A */
2N/A
2N/Aint
2N/Adst_verify_data(const int mode, DST_KEY *in_key, void **context,
2N/A const u_char *data, const int len,
2N/A const u_char *signature, const int sig_len)
2N/A{
2N/A DUMP(data, mode, len, "dst_verify_data()");
2N/A if (mode & SIG_MODE_FINAL &&
2N/A (in_key->dk_KEY_struct == NULL || signature == NULL))
2N/A return (MISSING_KEY_OR_SIGNATURE);
2N/A
2N/A if (in_key->dk_func == NULL || in_key->dk_func->verify == NULL)
2N/A return (UNSUPPORTED_KEYALG);
2N/A return (in_key->dk_func->verify(mode, in_key, context, data, len,
2N/A signature, sig_len));
2N/A}
2N/A
2N/A/*%
2N/A * dst_read_private_key
2N/A * Access a private key. First the list of private keys that have
2N/A * already been read in is searched, then the key accessed on disk.
2N/A * If the private key can be found, it is returned. If the key cannot
2N/A * be found, a null pointer is returned. The options specify required
2N/A * key characteristics. If the private key requested does not have
2N/A * these characteristics, it will not be read.
2N/A * Parameters
2N/A * in_keyname The private key name.
2N/A * in_id The id of the private key.
2N/A * options DST_FORCE_READ Read from disk - don't use a previously
2N/A * read key.
2N/A * DST_CAN_SIGN The key must be useable for signing.
2N/A * DST_NO_AUTHEN The key must be useable for authentication.
2N/A * DST_STANDARD Return any key
2N/A * Returns
2N/A * NULL If there is no key found in the current directory or
2N/A * this key has not been loaded before.
2N/A * !NULL Success - KEY structure returned.
2N/A */
2N/A
2N/ADST_KEY *
2N/Adst_read_key(const char *in_keyname, const u_int16_t in_id,
2N/A const int in_alg, const int type)
2N/A{
2N/A char keyname[PATH_MAX];
2N/A DST_KEY *dg_key = NULL, *pubkey = NULL;
2N/A
2N/A if (!dst_check_algorithm(in_alg)) { /*%< make sure alg is available */
2N/A EREPORT(("dst_read_private_key(): Algorithm %d not suppored\n",
2N/A in_alg));
2N/A return (NULL);
2N/A }
2N/A if ((type & (DST_PUBLIC | DST_PRIVATE)) == 0)
2N/A return (NULL);
2N/A if (in_keyname == NULL) {
2N/A EREPORT(("dst_read_private_key(): Null key name passed in\n"));
2N/A return (NULL);
2N/A } else if (strlen(in_keyname) >= sizeof(keyname)) {
2N/A EREPORT(("dst_read_private_key(): keyname too big\n"));
2N/A return (NULL);
2N/A } else
2N/A strcpy(keyname, in_keyname);
2N/A
2N/A /* before I read in the public key, check if it is allowed to sign */
2N/A if ((pubkey = dst_s_read_public_key(keyname, in_id, in_alg)) == NULL)
2N/A return (NULL);
2N/A
2N/A if (type == DST_PUBLIC)
2N/A return pubkey;
2N/A
2N/A if (!(dg_key = dst_s_get_key_struct(keyname, pubkey->dk_alg,
2N/A pubkey->dk_flags, pubkey->dk_proto,
2N/A 0)))
2N/A return (dg_key);
2N/A /* Fill in private key and some fields in the general key structure */
2N/A if (dst_s_read_private_key_file(keyname, dg_key, pubkey->dk_id,
2N/A pubkey->dk_alg) == 0)
2N/A dg_key = dst_free_key(dg_key);
2N/A
2N/A (void)dst_free_key(pubkey);
2N/A return (dg_key);
2N/A}
2N/A
2N/Aint
2N/Adst_write_key(const DST_KEY *key, const int type)
2N/A{
2N/A int pub = 0, priv = 0;
2N/A
2N/A if (key == NULL)
2N/A return (0);
2N/A if (!dst_check_algorithm(key->dk_alg)) { /*%< make sure alg is available */
2N/A EREPORT(("dst_write_key(): Algorithm %d not suppored\n",
2N/A key->dk_alg));
2N/A return (UNSUPPORTED_KEYALG);
2N/A }
2N/A if ((type & (DST_PRIVATE|DST_PUBLIC)) == 0)
2N/A return (0);
2N/A
2N/A if (type & DST_PUBLIC)
2N/A if ((pub = dst_s_write_public_key(key)) < 0)
2N/A return (pub);
2N/A if (type & DST_PRIVATE)
2N/A if ((priv = dst_s_write_private_key(key)) < 0)
2N/A return (priv);
2N/A return (priv+pub);
2N/A}
2N/A
2N/A/*%
2N/A * dst_write_private_key
2N/A * Write a private key to disk. The filename will be of the form:
2N/A * K&lt;key-&gt;dk_name&gt;+&lt;key-&gt;dk_alg+&gt;&lt;key-d&gt;k_id.&gt;&lt;private key suffix&gt;.
2N/A * If there is already a file with this name, an error is returned.
2N/A *
2N/A * Parameters
2N/A * key A DST managed key structure that contains
2N/A * all information needed about a key.
2N/A * Return
2N/A * &gt;= 0 Correct behavior. Returns length of encoded key value
2N/A * written to disk.
2N/A * &lt; 0 error.
2N/A */
2N/A
2N/Astatic int
2N/Adst_s_write_private_key(const DST_KEY *key)
2N/A{
2N/A u_char encoded_block[RAW_KEY_SIZE];
2N/A char file[PATH_MAX];
2N/A int len;
2N/A FILE *fp;
2N/A
2N/A /* First encode the key into the portable key format */
2N/A if (key == NULL)
2N/A return (-1);
2N/A if (key->dk_KEY_struct == NULL)
2N/A return (0); /*%< null key has no private key */
2N/A if (key->dk_func == NULL || key->dk_func->to_file_fmt == NULL) {
2N/A EREPORT(("dst_write_private_key(): Unsupported operation %d\n",
2N/A key->dk_alg));
2N/A return (-5);
2N/A } else if ((len = key->dk_func->to_file_fmt(key, (char *)encoded_block,
2N/A sizeof(encoded_block))) <= 0) {
2N/A EREPORT(("dst_write_private_key(): Failed encoding private RSA bsafe key %d\n", len));
2N/A return (-8);
2N/A }
2N/A /* Now I can create the file I want to use */
2N/A dst_s_build_filename(file, key->dk_key_name, key->dk_id, key->dk_alg,
2N/A PRIVATE_KEY, PATH_MAX);
2N/A
2N/A /* Do not overwrite an existing file */
2N/A if ((fp = dst_s_fopen(file, "w", 0600)) != NULL) {
2N/A int nn;
2N/A if ((nn = fwrite(encoded_block, 1, len, fp)) != len) {
2N/A EREPORT(("dst_write_private_key(): Write failure on %s %d != %d errno=%d\n",
2N/A file, len, nn, errno));
2N/A fclose(fp);
2N/A return (-5);
2N/A }
2N/A fclose(fp);
2N/A } else {
2N/A EREPORT(("dst_write_private_key(): Can not create file %s\n"
2N/A ,file));
2N/A return (-6);
2N/A }
2N/A memset(encoded_block, 0, len);
2N/A return (len);
2N/A}
2N/A
2N/A/*%
2N/A*
2N/A * dst_read_public_key
2N/A * Read a public key from disk and store in a DST key structure.
2N/A * Parameters
2N/A * in_name K&lt;in_name&gt;&lt;in_id&gt;.&lt;public key suffix&gt; is the
2N/A * filename of the key file to be read.
2N/A * Returns
2N/A * NULL If the key does not exist or no name is supplied.
2N/A * NON-NULL Initialized key structure if the key exists.
2N/A */
2N/A
2N/Astatic DST_KEY *
2N/Adst_s_read_public_key(const char *in_name, const u_int16_t in_id, int in_alg)
2N/A{
2N/A int flags, proto, alg, len, dlen;
2N/A int c;
2N/A char name[PATH_MAX], enckey[RAW_KEY_SIZE], *notspace;
2N/A u_char deckey[RAW_KEY_SIZE];
2N/A FILE *fp;
2N/A
2N/A if (in_name == NULL) {
2N/A EREPORT(("dst_read_public_key(): No key name given\n"));
2N/A return (NULL);
2N/A }
2N/A if (dst_s_build_filename(name, in_name, in_id, in_alg, PUBLIC_KEY,
2N/A PATH_MAX) == -1) {
2N/A EREPORT(("dst_read_public_key(): Cannot make filename from %s, %d, and %s\n",
2N/A in_name, in_id, PUBLIC_KEY));
2N/A return (NULL);
2N/A }
2N/A /*
2N/A * Open the file and read it's formatted contents up to key
2N/A * File format:
2N/A * domain.name [ttl] [IN] KEY &lt;flags&gt; &lt;protocol&gt; &lt;algorithm&gt; &lt;key&gt;
2N/A * flags, proto, alg stored as decimal (or hex numbers FIXME).
2N/A * (FIXME: handle parentheses for line continuation.)
2N/A */
2N/A if ((fp = dst_s_fopen(name, "r", 0)) == NULL) {
2N/A EREPORT(("dst_read_public_key(): Public Key not found %s\n",
2N/A name));
2N/A return (NULL);
2N/A }
2N/A /* Skip domain name, which ends at first blank */
2N/A while ((c = getc(fp)) != EOF)
2N/A if (isspace(c))
2N/A break;
2N/A /* Skip blank to get to next field */
2N/A while ((c = getc(fp)) != EOF)
2N/A if (!isspace(c))
2N/A break;
2N/A
2N/A /* Skip optional TTL -- if initial digit, skip whole word. */
2N/A if (isdigit(c)) {
2N/A while ((c = getc(fp)) != EOF)
2N/A if (isspace(c))
2N/A break;
2N/A while ((c = getc(fp)) != EOF)
2N/A if (!isspace(c))
2N/A break;
2N/A }
2N/A /* Skip optional "IN" */
2N/A if (c == 'I' || c == 'i') {
2N/A while ((c = getc(fp)) != EOF)
2N/A if (isspace(c))
2N/A break;
2N/A while ((c = getc(fp)) != EOF)
2N/A if (!isspace(c))
2N/A break;
2N/A }
2N/A /* Locate and skip "KEY" */
2N/A if (c != 'K' && c != 'k') {
2N/A EREPORT(("\"KEY\" doesn't appear in file: %s", name));
2N/A return NULL;
2N/A }
2N/A while ((c = getc(fp)) != EOF)
2N/A if (isspace(c))
2N/A break;
2N/A while ((c = getc(fp)) != EOF)
2N/A if (!isspace(c))
2N/A break;
2N/A ungetc(c, fp); /*%< return the charcter to the input field */
2N/A /* Handle hex!! FIXME. */
2N/A
2N/A if (fscanf(fp, "%d %d %d", &flags, &proto, &alg) != 3) {
2N/A EREPORT(("dst_read_public_key(): Can not read flag/proto/alg field from %s\n"
2N/A ,name));
2N/A return (NULL);
2N/A }
2N/A /* read in the key string */
2N/A fgets(enckey, sizeof(enckey), fp);
2N/A
2N/A /* If we aren't at end-of-file, something is wrong. */
2N/A while ((c = getc(fp)) != EOF)
2N/A if (!isspace(c))
2N/A break;
2N/A if (!feof(fp)) {
2N/A EREPORT(("Key too long in file: %s", name));
2N/A return NULL;
2N/A }
2N/A fclose(fp);
2N/A
2N/A if ((len = strlen(enckey)) <= 0)
2N/A return (NULL);
2N/A
2N/A /* discard \n */
2N/A enckey[--len] = '\0';
2N/A
2N/A /* remove leading spaces */
2N/A for (notspace = (char *) enckey; isspace((*notspace)&0xff); len--)
2N/A notspace++;
2N/A
2N/A dlen = b64_pton(notspace, deckey, sizeof(deckey));
2N/A if (dlen < 0) {
2N/A EREPORT(("dst_read_public_key: bad return from b64_pton = %d",
2N/A dlen));
2N/A return (NULL);
2N/A }
2N/A /* store key and info in a key structure that is returned */
2N/A/* return dst_store_public_key(in_name, alg, proto, 666, flags, deckey,
2N/A dlen);*/
2N/A return dst_buffer_to_key(in_name, alg, flags, proto, deckey, dlen);
2N/A}
2N/A
2N/A/*%
2N/A * dst_write_public_key
2N/A * Write a key to disk in DNS format.
2N/A * Parameters
2N/A * key Pointer to a DST key structure.
2N/A * Returns
2N/A * 0 Failure
2N/A * 1 Success
2N/A */
2N/A
2N/Astatic int
2N/Adst_s_write_public_key(const DST_KEY *key)
2N/A{
2N/A FILE *fp;
2N/A char filename[PATH_MAX];
2N/A u_char out_key[RAW_KEY_SIZE];
2N/A char enc_key[RAW_KEY_SIZE];
2N/A int len = 0;
2N/A int mode;
2N/A
2N/A memset(out_key, 0, sizeof(out_key));
2N/A if (key == NULL) {
2N/A EREPORT(("dst_write_public_key(): No key specified \n"));
2N/A return (0);
2N/A } else if ((len = dst_key_to_dnskey(key, out_key, sizeof(out_key)))< 0)
2N/A return (0);
2N/A
2N/A /* Make the filename */
2N/A if (dst_s_build_filename(filename, key->dk_key_name, key->dk_id,
2N/A key->dk_alg, PUBLIC_KEY, PATH_MAX) == -1) {
2N/A EREPORT(("dst_write_public_key(): Cannot make filename from %s, %d, and %s\n",
2N/A key->dk_key_name, key->dk_id, PUBLIC_KEY));
2N/A return (0);
2N/A }
2N/A /* XXX in general this should be a check for symmetric keys */
2N/A mode = (key->dk_alg == KEY_HMAC_MD5) ? 0600 : 0644;
2N/A /* create public key file */
2N/A if ((fp = dst_s_fopen(filename, "w+", mode)) == NULL) {
2N/A EREPORT(("DST_write_public_key: open of file:%s failed (errno=%d)\n",
2N/A filename, errno));
2N/A return (0);
2N/A }
2N/A /*write out key first base64 the key data */
2N/A if (key->dk_flags & DST_EXTEND_FLAG)
2N/A b64_ntop(&out_key[6], len - 6, enc_key, sizeof(enc_key));
2N/A else
2N/A b64_ntop(&out_key[4], len - 4, enc_key, sizeof(enc_key));
2N/A fprintf(fp, "%s IN KEY %d %d %d %s\n",
2N/A key->dk_key_name,
2N/A key->dk_flags, key->dk_proto, key->dk_alg, enc_key);
2N/A fclose(fp);
2N/A return (1);
2N/A}
2N/A
2N/A/*%
2N/A * dst_dnskey_to_public_key
2N/A * This function converts the contents of a DNS KEY RR into a DST
2N/A * key structure.
2N/A * Paramters
2N/A * len Length of the RDATA of the KEY RR RDATA
2N/A * rdata A pointer to the the KEY RR RDATA.
2N/A * in_name Key name to be stored in key structure.
2N/A * Returns
2N/A * NULL Failure
2N/A * NON-NULL Success. Pointer to key structure.
2N/A * Caller's responsibility to free() it.
2N/A */
2N/A
2N/ADST_KEY *
2N/Adst_dnskey_to_key(const char *in_name, const u_char *rdata, const int len)
2N/A{
2N/A DST_KEY *key_st;
2N/A int alg ;
2N/A int start = DST_KEY_START;
2N/A
2N/A if (rdata == NULL || len <= DST_KEY_ALG) /*%< no data */
2N/A return (NULL);
2N/A alg = (u_int8_t) rdata[DST_KEY_ALG];
2N/A if (!dst_check_algorithm(alg)) { /*%< make sure alg is available */
2N/A EREPORT(("dst_dnskey_to_key(): Algorithm %d not suppored\n",
2N/A alg));
2N/A return (NULL);
2N/A }
2N/A
2N/A if (in_name == NULL)
2N/A return (NULL);
2N/A
2N/A if ((key_st = dst_s_get_key_struct(in_name, alg, 0, 0, 0)) == NULL)
2N/A return (NULL);
2N/A
2N/A key_st->dk_id = dst_s_dns_key_id(rdata, len);
2N/A key_st->dk_flags = dst_s_get_int16(rdata);
2N/A key_st->dk_proto = (u_int16_t) rdata[DST_KEY_PROT];
2N/A if (key_st->dk_flags & DST_EXTEND_FLAG) {
2N/A u_int32_t ext_flags;
2N/A ext_flags = (u_int32_t) dst_s_get_int16(&rdata[DST_EXT_FLAG]);
2N/A key_st->dk_flags = key_st->dk_flags | (ext_flags << 16);
2N/A start += 2;
2N/A }
2N/A /*
2N/A * now point to the begining of the data representing the encoding
2N/A * of the key
2N/A */
2N/A if (key_st->dk_func && key_st->dk_func->from_dns_key) {
2N/A if (key_st->dk_func->from_dns_key(key_st, &rdata[start],
2N/A len - start) > 0)
2N/A return (key_st);
2N/A } else
2N/A EREPORT(("dst_dnskey_to_public_key(): unsuppored alg %d\n",
2N/A alg));
2N/A
2N/A SAFE_FREE(key_st);
2N/A return (key_st);
2N/A}
2N/A
2N/A/*%
2N/A * dst_public_key_to_dnskey
2N/A * Function to encode a public key into DNS KEY wire format
2N/A * Parameters
2N/A * key Key structure to encode.
2N/A * out_storage Location to write the encoded key to.
2N/A * out_len Size of the output array.
2N/A * Returns
2N/A * <0 Failure
2N/A * >=0 Number of bytes written to out_storage
2N/A */
2N/A
2N/Aint
2N/Adst_key_to_dnskey(const DST_KEY *key, u_char *out_storage,
2N/A const int out_len)
2N/A{
2N/A u_int16_t val;
2N/A int loc = 0;
2N/A int enc_len = 0;
2N/A if (key == NULL)
2N/A return (-1);
2N/A
2N/A if (!dst_check_algorithm(key->dk_alg)) { /*%< make sure alg is available */
2N/A EREPORT(("dst_key_to_dnskey(): Algorithm %d not suppored\n",
2N/A key->dk_alg));
2N/A return (UNSUPPORTED_KEYALG);
2N/A }
2N/A memset(out_storage, 0, out_len);
2N/A val = (u_int16_t)(key->dk_flags & 0xffff);
2N/A dst_s_put_int16(out_storage, val);
2N/A loc += 2;
2N/A
2N/A out_storage[loc++] = (u_char) key->dk_proto;
2N/A out_storage[loc++] = (u_char) key->dk_alg;
2N/A
2N/A if (key->dk_flags > 0xffff) { /*%< Extended flags */
2N/A val = (u_int16_t)((key->dk_flags >> 16) & 0xffff);
2N/A dst_s_put_int16(&out_storage[loc], val);
2N/A loc += 2;
2N/A }
2N/A if (key->dk_KEY_struct == NULL)
2N/A return (loc);
2N/A if (key->dk_func && key->dk_func->to_dns_key) {
2N/A enc_len = key->dk_func->to_dns_key(key,
2N/A (u_char *) &out_storage[loc],
2N/A out_len - loc);
2N/A if (enc_len > 0)
2N/A return (enc_len + loc);
2N/A else
2N/A return (-1);
2N/A } else
2N/A EREPORT(("dst_key_to_dnskey(): Unsupported ALG %d\n",
2N/A key->dk_alg));
2N/A return (-1);
2N/A}
2N/A
2N/A/*%
2N/A * dst_buffer_to_key
2N/A * Function to encode a string of raw data into a DST key
2N/A * Parameters
2N/A * alg The algorithm (HMAC only)
2N/A * key A pointer to the data
2N/A * keylen The length of the data
2N/A * Returns
2N/A * NULL an error occurred
2N/A * NON-NULL the DST key
2N/A */
2N/ADST_KEY *
2N/Adst_buffer_to_key(const char *key_name, /*!< name of the key */
2N/A const int alg, /*!< algorithm */
2N/A const int flags, /*!< dns flags */
2N/A const int protocol, /*!< dns protocol */
2N/A const u_char *key_buf, /*!< key in dns wire fmt */
2N/A const int key_len) /*!< size of key */
2N/A{
2N/A
2N/A DST_KEY *dkey = NULL;
2N/A int dnslen;
2N/A u_char dns[2048];
2N/A
2N/A if (!dst_check_algorithm(alg)) { /*%< make sure alg is available */
2N/A EREPORT(("dst_buffer_to_key(): Algorithm %d not suppored\n", alg));
2N/A return (NULL);
2N/A }
2N/A
2N/A dkey = dst_s_get_key_struct(key_name, alg, flags, protocol, -1);
2N/A
2N/A if (dkey == NULL || dkey->dk_func == NULL ||
2N/A dkey->dk_func->from_dns_key == NULL)
2N/A return (dst_free_key(dkey));
2N/A
2N/A if (dkey->dk_func->from_dns_key(dkey, key_buf, key_len) < 0) {
2N/A EREPORT(("dst_buffer_to_key(): dst_buffer_to_hmac failed\n"));
2N/A return (dst_free_key(dkey));
2N/A }
2N/A
2N/A dnslen = dst_key_to_dnskey(dkey, dns, sizeof(dns));
2N/A dkey->dk_id = dst_s_dns_key_id(dns, dnslen);
2N/A return (dkey);
2N/A}
2N/A
2N/Aint
2N/Adst_key_to_buffer(DST_KEY *key, u_char *out_buff, int buf_len)
2N/A{
2N/A int len;
2N/A /* this function will extrac the secret of HMAC into a buffer */
2N/A if (key == NULL)
2N/A return (0);
2N/A if (key->dk_func != NULL && key->dk_func->to_dns_key != NULL) {
2N/A len = key->dk_func->to_dns_key(key, out_buff, buf_len);
2N/A if (len < 0)
2N/A return (0);
2N/A return (len);
2N/A }
2N/A return (0);
2N/A}
2N/A
2N/A/*%
2N/A * dst_s_read_private_key_file
2N/A * Function reads in private key from a file.
2N/A * Fills out the KEY structure.
2N/A * Parameters
2N/A * name Name of the key to be read.
2N/A * pk_key Structure that the key is returned in.
2N/A * in_id Key identifier (tag)
2N/A * Return
2N/A * 1 if everthing works
2N/A * 0 if there is any problem
2N/A */
2N/A
2N/Astatic int
2N/Adst_s_read_private_key_file(char *name, DST_KEY *pk_key, u_int16_t in_id,
2N/A int in_alg)
2N/A{
2N/A int cnt, alg, len, major, minor, file_major, file_minor;
2N/A int ret, id;
2N/A char filename[PATH_MAX];
2N/A u_char in_buff[RAW_KEY_SIZE], *p;
2N/A FILE *fp;
2N/A int dnslen;
2N/A u_char dns[2048];
2N/A
2N/A if (name == NULL || pk_key == NULL) {
2N/A EREPORT(("dst_read_private_key_file(): No key name given\n"));
2N/A return (0);
2N/A }
2N/A /* Make the filename */
2N/A if (dst_s_build_filename(filename, name, in_id, in_alg, PRIVATE_KEY,
2N/A PATH_MAX) == -1) {
2N/A EREPORT(("dst_read_private_key(): Cannot make filename from %s, %d, and %s\n",
2N/A name, in_id, PRIVATE_KEY));
2N/A return (0);
2N/A }
2N/A /* first check if we can find the key file */
2N/A if ((fp = dst_s_fopen(filename, "r", 0)) == NULL) {
2N/A EREPORT(("dst_s_read_private_key_file: Could not open file %s in directory %s\n",
2N/A filename, dst_path[0] ? dst_path :
2N/A (char *) getcwd(NULL, PATH_MAX - 1)));
2N/A return (0);
2N/A }
2N/A /* now read the header info from the file */
2N/A if ((cnt = fread(in_buff, 1, sizeof(in_buff), fp)) < 5) {
2N/A fclose(fp);
2N/A EREPORT(("dst_s_read_private_key_file: error reading file %s (empty file)\n",
2N/A filename));
2N/A return (0);
2N/A }
2N/A /* decrypt key */
2N/A fclose(fp);
2N/A if (memcmp(in_buff, "Private-key-format: v", 20) != 0)
2N/A goto fail;
2N/A len = cnt;
2N/A p = in_buff;
2N/A
2N/A if (!dst_s_verify_str((const char **) (void *)&p,
2N/A "Private-key-format: v")) {
2N/A EREPORT(("dst_s_read_private_key_file(): Not a Key file/Decrypt failed %s\n", name));
2N/A goto fail;
2N/A }
2N/A /* read in file format */
2N/A sscanf((char *)p, "%d.%d", &file_major, &file_minor);
2N/A sscanf(KEY_FILE_FORMAT, "%d.%d", &major, &minor);
2N/A if (file_major < 1) {
2N/A EREPORT(("dst_s_read_private_key_file(): Unknown keyfile %d.%d version for %s\n",
2N/A file_major, file_minor, name));
2N/A goto fail;
2N/A } else if (file_major > major || file_minor > minor)
2N/A EREPORT((
2N/A "dst_s_read_private_key_file(): Keyfile %s version higher than mine %d.%d MAY FAIL\n",
2N/A name, file_major, file_minor));
2N/A
2N/A while (*p++ != '\n') ; /*%< skip to end of line */
2N/A
2N/A if (!dst_s_verify_str((const char **) (void *)&p, "Algorithm: "))
2N/A goto fail;
2N/A
2N/A if (sscanf((char *)p, "%d", &alg) != 1)
2N/A goto fail;
2N/A while (*p++ != '\n') ; /*%< skip to end of line */
2N/A
2N/A if (pk_key->dk_key_name && !strcmp(pk_key->dk_key_name, name))
2N/A SAFE_FREE2(pk_key->dk_key_name, strlen(pk_key->dk_key_name));
2N/A pk_key->dk_key_name = (char *) strdup(name);
2N/A
2N/A /* allocate and fill in key structure */
2N/A if (pk_key->dk_func == NULL || pk_key->dk_func->from_file_fmt == NULL)
2N/A goto fail;
2N/A
2N/A ret = pk_key->dk_func->from_file_fmt(pk_key, (char *)p, &in_buff[len] - p);
2N/A if (ret < 0)
2N/A goto fail;
2N/A
2N/A dnslen = dst_key_to_dnskey(pk_key, dns, sizeof(dns));
2N/A id = dst_s_dns_key_id(dns, dnslen);
2N/A
2N/A /* Make sure the actual key tag matches the input tag used in the filename
2N/A */
2N/A if (id != in_id) {
2N/A EREPORT(("dst_s_read_private_key_file(): actual tag of key read %d != input tag used to build filename %d.\n", id, in_id));
2N/A goto fail;
2N/A }
2N/A pk_key->dk_id = (u_int16_t) id;
2N/A pk_key->dk_alg = alg;
2N/A memset(in_buff, 0, cnt);
2N/A return (1);
2N/A
2N/A fail:
2N/A memset(in_buff, 0, cnt);
2N/A return (0);
2N/A}
2N/A
2N/A/*%
2N/A * Generate and store a public/private keypair.
2N/A * Keys will be stored in formatted files.
2N/A *
2N/A * Parameters
2N/A &
2N/A *\par name Name of the new key. Used to create key files
2N/A *\li K&lt;name&gt;+&lt;alg&gt;+&lt;id&gt;.public and K&lt;name&gt;+&lt;alg&gt;+&lt;id&gt;.private.
2N/A *\par bits Size of the new key in bits.
2N/A *\par exp What exponent to use:
2N/A *\li 0 use exponent 3
2N/A *\li non-zero use Fermant4
2N/A *\par flags The default value of the DNS Key flags.
2N/A *\li The DNS Key RR Flag field is defined in RFC2065,
2N/A * section 3.3. The field has 16 bits.
2N/A *\par protocol
2N/A *\li Default value of the DNS Key protocol field.
2N/A *\li The DNS Key protocol field is defined in RFC2065,
2N/A * section 3.4. The field has 8 bits.
2N/A *\par alg What algorithm to use. Currently defined:
2N/A *\li KEY_RSA 1
2N/A *\li KEY_DSA 3
2N/A *\li KEY_HMAC 157
2N/A *\par out_id The key tag is returned.
2N/A *
2N/A * Return
2N/A *\li NULL Failure
2N/A *\li non-NULL the generated key pair
2N/A * Caller frees the result, and its dk_name pointer.
2N/A */
2N/ADST_KEY *
2N/Adst_generate_key(const char *name, const int bits, const int exp,
2N/A const int flags, const int protocol, const int alg)
2N/A{
2N/A DST_KEY *new_key = NULL;
2N/A int dnslen;
2N/A u_char dns[2048];
2N/A
2N/A if (name == NULL)
2N/A return (NULL);
2N/A
2N/A if (!dst_check_algorithm(alg)) { /*%< make sure alg is available */
2N/A EREPORT(("dst_generate_key(): Algorithm %d not suppored\n", alg));
2N/A return (NULL);
2N/A }
2N/A
2N/A new_key = dst_s_get_key_struct(name, alg, flags, protocol, bits);
2N/A if (new_key == NULL)
2N/A return (NULL);
2N/A if (bits == 0) /*%< null key we are done */
2N/A return (new_key);
2N/A if (new_key->dk_func == NULL || new_key->dk_func->generate == NULL) {
2N/A EREPORT(("dst_generate_key_pair():Unsupported algorithm %d\n",
2N/A alg));
2N/A return (dst_free_key(new_key));
2N/A }
2N/A if (new_key->dk_func->generate(new_key, exp) <= 0) {
2N/A EREPORT(("dst_generate_key_pair(): Key generation failure %s %d %d %d\n",
2N/A new_key->dk_key_name, new_key->dk_alg,
2N/A new_key->dk_key_size, exp));
2N/A return (dst_free_key(new_key));
2N/A }
2N/A
2N/A dnslen = dst_key_to_dnskey(new_key, dns, sizeof(dns));
2N/A if (dnslen != UNSUPPORTED_KEYALG)
2N/A new_key->dk_id = dst_s_dns_key_id(dns, dnslen);
2N/A else
2N/A new_key->dk_id = 0;
2N/A
2N/A return (new_key);
2N/A}
2N/A
2N/A/*%
2N/A * Release all data structures pointed to by a key structure.
2N/A *
2N/A * Parameters
2N/A *\li f_key Key structure to be freed.
2N/A */
2N/A
2N/ADST_KEY *
2N/Adst_free_key(DST_KEY *f_key)
2N/A{
2N/A
2N/A if (f_key == NULL)
2N/A return (f_key);
2N/A if (f_key->dk_func && f_key->dk_func->destroy)
2N/A f_key->dk_KEY_struct =
2N/A f_key->dk_func->destroy(f_key->dk_KEY_struct);
2N/A else {
2N/A EREPORT(("dst_free_key(): Unknown key alg %d\n",
2N/A f_key->dk_alg));
2N/A }
2N/A if (f_key->dk_KEY_struct) {
2N/A free(f_key->dk_KEY_struct);
2N/A f_key->dk_KEY_struct = NULL;
2N/A }
2N/A if (f_key->dk_key_name)
2N/A SAFE_FREE(f_key->dk_key_name);
2N/A SAFE_FREE(f_key);
2N/A return (NULL);
2N/A}
2N/A
2N/A/*%
2N/A * Return the maximim size of signature from the key specified in bytes
2N/A *
2N/A * Parameters
2N/A *\li key
2N/A *
2N/A * Returns
2N/A * \li bytes
2N/A */
2N/Aint
2N/Adst_sig_size(DST_KEY *key) {
2N/A switch (key->dk_alg) {
2N/A case KEY_HMAC_MD5:
2N/A return (16);
2N/A case KEY_HMAC_SHA1:
2N/A return (20);
2N/A case KEY_RSA:
2N/A return (key->dk_key_size + 7) / 8;
2N/A case KEY_DSA:
2N/A return (40);
2N/A default:
2N/A EREPORT(("dst_sig_size(): Unknown key alg %d\n", key->dk_alg));
2N/A return -1;
2N/A }
2N/A}
2N/A
2N/A/*! \file */