Home | History | Annotate | Line # | Download | only in named
tsigconf.c revision 1.1.1.1 
      1 /*	$NetBSD: tsigconf.c,v 1.1.1.1 2018/08/12 12:07:41 christos Exp $	*/
      2 
      3 /*
      4  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
      5  *
      6  * This Source Code Form is subject to the terms of the Mozilla Public
      7  * License, v. 2.0. If a copy of the MPL was not distributed with this
      8  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
      9  *
     10  * See the COPYRIGHT file distributed with this work for additional
     11  * information regarding copyright ownership.
     12  */
     13 
     14 
     15 /*! \file */
     16 
     17 #include <config.h>
     18 
     19 #include <isc/base64.h>
     20 #include <isc/buffer.h>
     21 #include <isc/mem.h>
     22 #include <isc/string.h>
     23 #include <isc/util.h>
     24 
     25 #include <isccfg/cfg.h>
     26 
     27 #include <dns/tsig.h>
     28 #include <dns/result.h>
     29 
     30 #include <named/log.h>
     31 
     32 #include <named/config.h>
     33 #include <named/tsigconf.h>
     34 
     35 static isc_result_t
     36 add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
     37 		 isc_mem_t *mctx)
     38 {
     39 	dns_tsigkey_t *tsigkey = NULL;
     40 	const cfg_listelt_t *element;
     41 	const cfg_obj_t *key = NULL;
     42 	const char *keyid = NULL;
     43 	unsigned char *secret = NULL;
     44 	int secretalloc = 0;
     45 	int secretlen = 0;
     46 	isc_result_t ret;
     47 	isc_stdtime_t now;
     48 	isc_uint16_t bits;
     49 
     50 	for (element = cfg_list_first(list);
     51 	     element != NULL;
     52 	     element = cfg_list_next(element))
     53 	{
     54 		const cfg_obj_t *algobj = NULL;
     55 		const cfg_obj_t *secretobj = NULL;
     56 		dns_name_t keyname;
     57 		const dns_name_t *alg;
     58 		const char *algstr;
     59 		char keynamedata[1024];
     60 		isc_buffer_t keynamesrc, keynamebuf;
     61 		const char *secretstr;
     62 		isc_buffer_t secretbuf;
     63 
     64 		key = cfg_listelt_value(element);
     65 		keyid = cfg_obj_asstring(cfg_map_getname(key));
     66 
     67 		algobj = NULL;
     68 		secretobj = NULL;
     69 		(void)cfg_map_get(key, "algorithm", &algobj);
     70 		(void)cfg_map_get(key, "secret", &secretobj);
     71 		INSIST(algobj != NULL && secretobj != NULL);
     72 
     73 		/*
     74 		 * Create the key name.
     75 		 */
     76 		dns_name_init(&keyname, NULL);
     77 		isc_buffer_constinit(&keynamesrc, keyid, strlen(keyid));
     78 		isc_buffer_add(&keynamesrc, strlen(keyid));
     79 		isc_buffer_init(&keynamebuf, keynamedata, sizeof(keynamedata));
     80 		ret = dns_name_fromtext(&keyname, &keynamesrc, dns_rootname,
     81 					DNS_NAME_DOWNCASE, &keynamebuf);
     82 		if (ret != ISC_R_SUCCESS)
     83 			goto failure;
     84 
     85 		/*
     86 		 * Create the algorithm.
     87 		 */
     88 		algstr = cfg_obj_asstring(algobj);
     89 		if (named_config_getkeyalgorithm(algstr, &alg, &bits)
     90 		    != ISC_R_SUCCESS) {
     91 			cfg_obj_log(algobj, named_g_lctx, ISC_LOG_ERROR,
     92 				    "key '%s': has a "
     93 				    "unsupported algorithm '%s'",
     94 				    keyid, algstr);
     95 			ret = DNS_R_BADALG;
     96 			goto failure;
     97 		}
     98 
     99 		secretstr = cfg_obj_asstring(secretobj);
    100 		secretalloc = secretlen = strlen(secretstr) * 3 / 4;
    101 		secret = isc_mem_get(mctx, secretlen);
    102 		if (secret == NULL) {
    103 			ret = ISC_R_NOMEMORY;
    104 			goto failure;
    105 		}
    106 		isc_buffer_init(&secretbuf, secret, secretlen);
    107 		ret = isc_base64_decodestring(secretstr, &secretbuf);
    108 		if (ret != ISC_R_SUCCESS)
    109 			goto failure;
    110 		secretlen = isc_buffer_usedlength(&secretbuf);
    111 
    112 		isc_stdtime_get(&now);
    113 		ret = dns_tsigkey_create(&keyname, alg, secret, secretlen,
    114 					 ISC_FALSE, NULL, now, now,
    115 					 mctx, ring, &tsigkey);
    116 		isc_mem_put(mctx, secret, secretalloc);
    117 		secret = NULL;
    118 		if (ret != ISC_R_SUCCESS)
    119 			goto failure;
    120 		/*
    121 		 * Set digest bits.
    122 		 */
    123 		dst_key_setbits(tsigkey->key, bits);
    124 		dns_tsigkey_detach(&tsigkey);
    125 	}
    126 
    127 	return (ISC_R_SUCCESS);
    128 
    129  failure:
    130 	cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
    131 		    "configuring key '%s': %s", keyid,
    132 		    isc_result_totext(ret));
    133 
    134 	if (secret != NULL)
    135 		isc_mem_put(mctx, secret, secretalloc);
    136 	return (ret);
    137 }
    138 
    139 isc_result_t
    140 named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
    141 			     isc_mem_t *mctx, dns_tsig_keyring_t **ringp)
    142 {
    143 	const cfg_obj_t *maps[3];
    144 	const cfg_obj_t *keylist;
    145 	dns_tsig_keyring_t *ring = NULL;
    146 	isc_result_t result;
    147 	int i;
    148 
    149 	REQUIRE(ringp != NULL && *ringp == NULL);
    150 
    151 	i = 0;
    152 	if (config != NULL)
    153 		maps[i++] = config;
    154 	if (vconfig != NULL)
    155 		maps[i++] = cfg_tuple_get(vconfig, "options");
    156 	maps[i] = NULL;
    157 
    158 	result = dns_tsigkeyring_create(mctx, &ring);
    159 	if (result != ISC_R_SUCCESS)
    160 		return (result);
    161 
    162 	for (i = 0; ; i++) {
    163 		if (maps[i] == NULL)
    164 			break;
    165 		keylist = NULL;
    166 		result = cfg_map_get(maps[i], "key", &keylist);
    167 		if (result != ISC_R_SUCCESS)
    168 			continue;
    169 		result = add_initial_keys(keylist, ring, mctx);
    170 		if (result != ISC_R_SUCCESS)
    171 			goto failure;
    172 	}
    173 
    174 	*ringp = ring;
    175 	return (ISC_R_SUCCESS);
    176 
    177  failure:
    178 	dns_tsigkeyring_detach(&ring);
    179 	return (result);
    180 }
    181