1 /*
2 * Portions Copyright (C) 2004-2013, 2015, 2016 Internet Systems Consortium, Inc. ("ISC")
3 * Portions Copyright (C) 1999-2003 Internet Software Consortium.
4 *
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
10 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
11 * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
12 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
15 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 *
17 * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
18 *
19 * Permission to use, copy, modify, and/or distribute this software for any
20 * purpose with or without fee is hereby granted, provided that the above
21 * copyright notice and this permission notice appear in all copies.
22 *
23 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
24 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
25 * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
26 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
27 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
28 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
29 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
30 */
31
32 /*
33 * Principal Author: Brian Wellington
34 * $Id: dst_api.c,v 1.65 2011/10/20 21:20:02 marka Exp $
35 */
36
37 /*! \file */
38
39 #include <config.h>
40
41 #include <stdlib.h>
42 #include <time.h>
43
44 #include <isc/buffer.h>
45 #include <isc/dir.h>
46 #include <isc/entropy.h>
47 #include <isc/fsaccess.h>
48 #include <isc/hmacsha.h>
49 #include <isc/lex.h>
50 #include <isc/mem.h>
51 #include <isc/once.h>
52 #include <isc/platform.h>
53 #include <isc/print.h>
54 #include <isc/refcount.h>
55 #include <isc/random.h>
56 #include <isc/string.h>
57 #include <isc/time.h>
58 #include <isc/util.h>
59 #include <isc/file.h>
60
61 #define DST_KEY_INTERNAL
62
63 #include <dns/fixedname.h>
64 #include <dns/keyvalues.h>
65 #include <dns/name.h>
66 #include <dns/rdata.h>
67 #include <dns/rdataclass.h>
68 #include <dns/ttl.h>
69 #include <dns/types.h>
70
71 #include <dst/result.h>
72
73 #include "dst_internal.h"
74
75 #define DST_AS_STR(t) ((t).value.as_textregion.base)
76
77 static dst_func_t *dst_t_func[DST_MAX_ALGS];
78 #ifdef BIND9
79 static isc_entropy_t *dst_entropy_pool = NULL;
80 #endif
81 static unsigned int dst_entropy_flags = 0;
82 static isc_boolean_t dst_initialized = ISC_FALSE;
83
84 void gss_log(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
85
86 isc_mem_t *dst__memory_pool = NULL;
87
88 /*
89 * Static functions.
90 */
91 static dst_key_t * get_key_struct(dns_name_t *name,
92 unsigned int alg,
93 unsigned int flags,
94 unsigned int protocol,
95 unsigned int bits,
96 dns_rdataclass_t rdclass,
97 dns_ttl_t ttl,
98 isc_mem_t *mctx);
99 static isc_result_t write_public_key(const dst_key_t *key, int type,
100 const char *directory);
101 static isc_result_t buildfilename(dns_name_t *name,
102 dns_keytag_t id,
103 unsigned int alg,
104 unsigned int type,
105 const char *directory,
106 isc_buffer_t *out);
107 static isc_result_t computeid(dst_key_t *key);
108 static isc_result_t frombuffer(dns_name_t *name,
109 unsigned int alg,
110 unsigned int flags,
111 unsigned int protocol,
112 dns_rdataclass_t rdclass,
113 isc_buffer_t *source,
114 isc_mem_t *mctx,
115 dst_key_t **keyp);
116
117 static isc_result_t algorithm_status(unsigned int alg);
118
119 static isc_result_t addsuffix(char *filename, int len,
120 const char *dirname, const char *ofilename,
121 const char *suffix);
122
123 #define RETERR(x) \
124 do { \
125 result = (x); \
126 if (result != ISC_R_SUCCESS) \
127 goto out; \
128 } while (0)
129
130 #define CHECKALG(alg) \
131 do { \
132 isc_result_t _r; \
133 _r = algorithm_status(alg); \
134 if (_r != ISC_R_SUCCESS) \
135 return (_r); \
136 } while (0); \
137
138 #if defined(OPENSSL) && defined(BIND9)
139 static void *
default_memalloc(void * arg,size_t size)140 default_memalloc(void *arg, size_t size) {
141 UNUSED(arg);
142 if (size == 0U)
143 size = 1;
144 return (malloc(size));
145 }
146
147 static void
default_memfree(void * arg,void * ptr)148 default_memfree(void *arg, void *ptr) {
149 UNUSED(arg);
150 free(ptr);
151 }
152 #endif
153
154 isc_result_t
dst_lib_init(isc_mem_t * mctx,isc_entropy_t * ectx,unsigned int eflags)155 dst_lib_init(isc_mem_t *mctx, isc_entropy_t *ectx, unsigned int eflags) {
156 return (dst_lib_init2(mctx, ectx, NULL, eflags));
157 }
158
159 isc_result_t
dst_lib_init2(isc_mem_t * mctx,isc_entropy_t * ectx,const char * engine,unsigned int eflags)160 dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
161 const char *engine, unsigned int eflags) {
162 isc_result_t result;
163
164 REQUIRE(mctx != NULL);
165 #ifdef BIND9
166 REQUIRE(ectx != NULL);
167 #else
168 UNUSED(ectx);
169 #endif
170 REQUIRE(dst_initialized == ISC_FALSE);
171
172 #ifndef OPENSSL
173 UNUSED(engine);
174 #endif
175
176 dst__memory_pool = NULL;
177
178 #if defined(OPENSSL) && defined(BIND9)
179 UNUSED(mctx);
180 /*
181 * When using --with-openssl, there seems to be no good way of not
182 * leaking memory due to the openssl error handling mechanism.
183 * Avoid assertions by using a local memory context and not checking
184 * for leaks on exit. Note: as there are leaks we cannot use
185 * ISC_MEMFLAG_INTERNAL as it will free up memory still being used
186 * by libcrypto.
187 */
188 result = isc_mem_createx2(0, 0, default_memalloc, default_memfree,
189 NULL, &dst__memory_pool, 0);
190 if (result != ISC_R_SUCCESS)
191 return (result);
192 isc_mem_setname(dst__memory_pool, "dst", NULL);
193 #ifndef OPENSSL_LEAKS
194 isc_mem_setdestroycheck(dst__memory_pool, ISC_FALSE);
195 #endif
196 #else
197 isc_mem_attach(mctx, &dst__memory_pool);
198 #endif
199 #ifdef BIND9
200 isc_entropy_attach(ectx, &dst_entropy_pool);
201 #endif
202 dst_entropy_flags = eflags;
203
204 dst_result_register();
205
206 memset(dst_t_func, 0, sizeof(dst_t_func));
207 RETERR(dst__hmacmd5_init(&dst_t_func[DST_ALG_HMACMD5]));
208 RETERR(dst__hmacsha1_init(&dst_t_func[DST_ALG_HMACSHA1]));
209 RETERR(dst__hmacsha224_init(&dst_t_func[DST_ALG_HMACSHA224]));
210 RETERR(dst__hmacsha256_init(&dst_t_func[DST_ALG_HMACSHA256]));
211 RETERR(dst__hmacsha384_init(&dst_t_func[DST_ALG_HMACSHA384]));
212 RETERR(dst__hmacsha512_init(&dst_t_func[DST_ALG_HMACSHA512]));
213 #ifdef OPENSSL
214 RETERR(dst__openssl_init(engine));
215 RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSAMD5],
216 DST_ALG_RSAMD5));
217 RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSASHA1],
218 DST_ALG_RSASHA1));
219 RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_NSEC3RSASHA1],
220 DST_ALG_NSEC3RSASHA1));
221 RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSASHA256],
222 DST_ALG_RSASHA256));
223 RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSASHA512],
224 DST_ALG_RSASHA512));
225 #ifdef HAVE_OPENSSL_DSA
226 RETERR(dst__openssldsa_init(&dst_t_func[DST_ALG_DSA]));
227 RETERR(dst__openssldsa_init(&dst_t_func[DST_ALG_NSEC3DSA]));
228 #endif
229 RETERR(dst__openssldh_init(&dst_t_func[DST_ALG_DH]));
230 #ifdef HAVE_OPENSSL_GOST
231 RETERR(dst__opensslgost_init(&dst_t_func[DST_ALG_ECCGOST]));
232 #endif
233 #ifdef HAVE_OPENSSL_ECDSA
234 RETERR(dst__opensslecdsa_init(&dst_t_func[DST_ALG_ECDSA256]));
235 RETERR(dst__opensslecdsa_init(&dst_t_func[DST_ALG_ECDSA384]));
236 #endif
237 #endif /* OPENSSL */
238 #ifdef GSSAPI
239 RETERR(dst__gssapi_init(&dst_t_func[DST_ALG_GSSAPI]));
240 #endif
241 dst_initialized = ISC_TRUE;
242 return (ISC_R_SUCCESS);
243
244 out:
245 /* avoid immediate crash! */
246 dst_initialized = ISC_TRUE;
247 dst_lib_destroy();
248 return (result);
249 }
250
251 void
dst_lib_destroy(void)252 dst_lib_destroy(void) {
253 int i;
254 RUNTIME_CHECK(dst_initialized == ISC_TRUE);
255 dst_initialized = ISC_FALSE;
256
257 for (i = 0; i < DST_MAX_ALGS; i++)
258 if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL)
259 dst_t_func[i]->cleanup();
260 #ifdef OPENSSL
261 dst__openssl_destroy();
262 #endif
263 if (dst__memory_pool != NULL)
264 isc_mem_detach(&dst__memory_pool);
265 #ifdef BIND9
266 if (dst_entropy_pool != NULL)
267 isc_entropy_detach(&dst_entropy_pool);
268 #endif
269 }
270
271 isc_boolean_t
dst_algorithm_supported(unsigned int alg)272 dst_algorithm_supported(unsigned int alg) {
273 REQUIRE(dst_initialized == ISC_TRUE);
274
275 if (alg >= DST_MAX_ALGS || dst_t_func[alg] == NULL)
276 return (ISC_FALSE);
277 return (ISC_TRUE);
278 }
279
280 isc_result_t
dst_context_create(dst_key_t * key,isc_mem_t * mctx,dst_context_t ** dctxp)281 dst_context_create(dst_key_t *key, isc_mem_t *mctx, dst_context_t **dctxp) {
282 return (dst_context_create2(key, mctx,
283 DNS_LOGCATEGORY_GENERAL, dctxp));
284 }
285
286 isc_result_t
dst_context_create2(dst_key_t * key,isc_mem_t * mctx,isc_logcategory_t * category,dst_context_t ** dctxp)287 dst_context_create2(dst_key_t *key, isc_mem_t *mctx,
288 isc_logcategory_t *category, dst_context_t **dctxp) {
289 dst_context_t *dctx;
290 isc_result_t result;
291
292 REQUIRE(dst_initialized == ISC_TRUE);
293 REQUIRE(VALID_KEY(key));
294 REQUIRE(mctx != NULL);
295 REQUIRE(dctxp != NULL && *dctxp == NULL);
296
297 if (key->func->createctx == NULL)
298 return (DST_R_UNSUPPORTEDALG);
299 if (key->keydata.generic == NULL)
300 return (DST_R_NULLKEY);
301
302 dctx = isc_mem_get(mctx, sizeof(dst_context_t));
303 if (dctx == NULL)
304 return (ISC_R_NOMEMORY);
305 memset(dctx, 0, sizeof(*dctx));
306 dst_key_attach(key, &dctx->key);
307 isc_mem_attach(mctx, &dctx->mctx);
308 dctx->category = category;
309 result = key->func->createctx(key, dctx);
310 if (result != ISC_R_SUCCESS) {
311 if (dctx->key != NULL)
312 dst_key_free(&dctx->key);
313 isc_mem_putanddetach(&dctx->mctx, dctx, sizeof(dst_context_t));
314 return (result);
315 }
316 dctx->magic = CTX_MAGIC;
317 *dctxp = dctx;
318 return (ISC_R_SUCCESS);
319 }
320
321 void
dst_context_destroy(dst_context_t ** dctxp)322 dst_context_destroy(dst_context_t **dctxp) {
323 dst_context_t *dctx;
324
325 REQUIRE(dctxp != NULL && VALID_CTX(*dctxp));
326
327 dctx = *dctxp;
328 INSIST(dctx->key->func->destroyctx != NULL);
329 dctx->key->func->destroyctx(dctx);
330 if (dctx->key != NULL)
331 dst_key_free(&dctx->key);
332 dctx->magic = 0;
333 isc_mem_putanddetach(&dctx->mctx, dctx, sizeof(dst_context_t));
334 *dctxp = NULL;
335 }
336
337 isc_result_t
dst_context_adddata(dst_context_t * dctx,const isc_region_t * data)338 dst_context_adddata(dst_context_t *dctx, const isc_region_t *data) {
339 REQUIRE(VALID_CTX(dctx));
340 REQUIRE(data != NULL);
341 INSIST(dctx->key->func->adddata != NULL);
342
343 return (dctx->key->func->adddata(dctx, data));
344 }
345
346 isc_result_t
dst_context_sign(dst_context_t * dctx,isc_buffer_t * sig)347 dst_context_sign(dst_context_t *dctx, isc_buffer_t *sig) {
348 dst_key_t *key;
349
350 REQUIRE(VALID_CTX(dctx));
351 REQUIRE(sig != NULL);
352
353 key = dctx->key;
354 CHECKALG(key->key_alg);
355 if (key->keydata.generic == NULL)
356 return (DST_R_NULLKEY);
357
358 if (key->func->sign == NULL)
359 return (DST_R_NOTPRIVATEKEY);
360 if (key->func->isprivate == NULL ||
361 key->func->isprivate(key) == ISC_FALSE)
362 return (DST_R_NOTPRIVATEKEY);
363
364 return (key->func->sign(dctx, sig));
365 }
366
367 isc_result_t
dst_context_verify(dst_context_t * dctx,isc_region_t * sig)368 dst_context_verify(dst_context_t *dctx, isc_region_t *sig) {
369 REQUIRE(VALID_CTX(dctx));
370 REQUIRE(sig != NULL);
371
372 CHECKALG(dctx->key->key_alg);
373 if (dctx->key->keydata.generic == NULL)
374 return (DST_R_NULLKEY);
375 if (dctx->key->func->verify == NULL)
376 return (DST_R_NOTPUBLICKEY);
377
378 return (dctx->key->func->verify(dctx, sig));
379 }
380
381 isc_result_t
dst_context_verify2(dst_context_t * dctx,unsigned int maxbits,isc_region_t * sig)382 dst_context_verify2(dst_context_t *dctx, unsigned int maxbits,
383 isc_region_t *sig)
384 {
385 REQUIRE(VALID_CTX(dctx));
386 REQUIRE(sig != NULL);
387
388 CHECKALG(dctx->key->key_alg);
389 if (dctx->key->keydata.generic == NULL)
390 return (DST_R_NULLKEY);
391 if (dctx->key->func->verify == NULL &&
392 dctx->key->func->verify2 == NULL)
393 return (DST_R_NOTPUBLICKEY);
394
395 return (dctx->key->func->verify2 != NULL ?
396 dctx->key->func->verify2(dctx, maxbits, sig) :
397 dctx->key->func->verify(dctx, sig));
398 }
399
400 isc_result_t
dst_key_computesecret(const dst_key_t * pub,const dst_key_t * priv,isc_buffer_t * secret)401 dst_key_computesecret(const dst_key_t *pub, const dst_key_t *priv,
402 isc_buffer_t *secret)
403 {
404 REQUIRE(dst_initialized == ISC_TRUE);
405 REQUIRE(VALID_KEY(pub) && VALID_KEY(priv));
406 REQUIRE(secret != NULL);
407
408 CHECKALG(pub->key_alg);
409 CHECKALG(priv->key_alg);
410
411 if (pub->keydata.generic == NULL || priv->keydata.generic == NULL)
412 return (DST_R_NULLKEY);
413
414 if (pub->key_alg != priv->key_alg ||
415 pub->func->computesecret == NULL ||
416 priv->func->computesecret == NULL)
417 return (DST_R_KEYCANNOTCOMPUTESECRET);
418
419 if (dst_key_isprivate(priv) == ISC_FALSE)
420 return (DST_R_NOTPRIVATEKEY);
421
422 return (pub->func->computesecret(pub, priv, secret));
423 }
424
425 isc_result_t
dst_key_tofile(const dst_key_t * key,int type,const char * directory)426 dst_key_tofile(const dst_key_t *key, int type, const char *directory) {
427 isc_result_t ret = ISC_R_SUCCESS;
428
429 REQUIRE(dst_initialized == ISC_TRUE);
430 REQUIRE(VALID_KEY(key));
431 REQUIRE((type & (DST_TYPE_PRIVATE | DST_TYPE_PUBLIC)) != 0);
432
433 CHECKALG(key->key_alg);
434
435 if (key->func->tofile == NULL)
436 return (DST_R_UNSUPPORTEDALG);
437
438 if (type & DST_TYPE_PUBLIC) {
439 ret = write_public_key(key, type, directory);
440 if (ret != ISC_R_SUCCESS)
441 return (ret);
442 }
443
444 if ((type & DST_TYPE_PRIVATE) &&
445 (key->key_flags & DNS_KEYFLAG_TYPEMASK) != DNS_KEYTYPE_NOKEY)
446 return (key->func->tofile(key, directory));
447 else
448 return (ISC_R_SUCCESS);
449 }
450
451 void
dst_key_setexternal(dst_key_t * key,isc_boolean_t value)452 dst_key_setexternal(dst_key_t *key, isc_boolean_t value) {
453 key->external = value;
454 }
455
456 isc_boolean_t
dst_key_isexternal(dst_key_t * key)457 dst_key_isexternal(dst_key_t *key) {
458 return (key->external);
459 }
460
461 isc_result_t
dst_key_fromfile(dns_name_t * name,dns_keytag_t id,unsigned int alg,int type,const char * directory,isc_mem_t * mctx,dst_key_t ** keyp)462 dst_key_fromfile(dns_name_t *name, dns_keytag_t id,
463 unsigned int alg, int type, const char *directory,
464 isc_mem_t *mctx, dst_key_t **keyp)
465 {
466 char filename[ISC_DIR_NAMEMAX];
467 isc_buffer_t b;
468 dst_key_t *key;
469 isc_result_t result;
470
471 REQUIRE(dst_initialized == ISC_TRUE);
472 REQUIRE(dns_name_isabsolute(name));
473 REQUIRE((type & (DST_TYPE_PRIVATE | DST_TYPE_PUBLIC)) != 0);
474 REQUIRE(mctx != NULL);
475 REQUIRE(keyp != NULL && *keyp == NULL);
476
477 CHECKALG(alg);
478
479 isc_buffer_init(&b, filename, sizeof(filename));
480 result = buildfilename(name, id, alg, type, directory, &b);
481 if (result != ISC_R_SUCCESS)
482 return (result);
483
484 key = NULL;
485 result = dst_key_fromnamedfile(filename, NULL, type, mctx, &key);
486 if (result != ISC_R_SUCCESS)
487 return (result);
488
489 result = computeid(key);
490 if (result != ISC_R_SUCCESS) {
491 dst_key_free(&key);
492 return (result);
493 }
494
495 if (!dns_name_equal(name, key->key_name) || id != key->key_id ||
496 alg != key->key_alg) {
497 dst_key_free(&key);
498 return (DST_R_INVALIDPRIVATEKEY);
499 }
500
501 *keyp = key;
502 return (ISC_R_SUCCESS);
503 }
504
505 isc_result_t
dst_key_fromnamedfile(const char * filename,const char * dirname,int type,isc_mem_t * mctx,dst_key_t ** keyp)506 dst_key_fromnamedfile(const char *filename, const char *dirname,
507 int type, isc_mem_t *mctx, dst_key_t **keyp)
508 {
509 isc_result_t result;
510 dst_key_t *pubkey = NULL, *key = NULL;
511 char *newfilename = NULL;
512 int newfilenamelen = 0;
513 isc_lex_t *lex = NULL;
514
515 REQUIRE(dst_initialized == ISC_TRUE);
516 REQUIRE(filename != NULL);
517 REQUIRE((type & (DST_TYPE_PRIVATE | DST_TYPE_PUBLIC)) != 0);
518 REQUIRE(mctx != NULL);
519 REQUIRE(keyp != NULL && *keyp == NULL);
520
521 /* If an absolute path is specified, don't use the key directory */
522 #ifndef WIN32
523 if (filename[0] == '/')
524 dirname = NULL;
525 #else /* WIN32 */
526 if (filename[0] == '/' || filename[0] == '\\')
527 dirname = NULL;
528 #endif
529
530 newfilenamelen = strlen(filename) + 5;
531 if (dirname != NULL)
532 newfilenamelen += strlen(dirname) + 1;
533 newfilename = isc_mem_get(mctx, newfilenamelen);
534 if (newfilename == NULL)
535 return (ISC_R_NOMEMORY);
536 result = addsuffix(newfilename, newfilenamelen,
537 dirname, filename, ".key");
538 INSIST(result == ISC_R_SUCCESS);
539
540 result = dst_key_read_public(newfilename, type, mctx, &pubkey);
541 isc_mem_put(mctx, newfilename, newfilenamelen);
542 newfilename = NULL;
543 RETERR(result);
544
545 if ((type & (DST_TYPE_PRIVATE | DST_TYPE_PUBLIC)) == DST_TYPE_PUBLIC ||
546 (pubkey->key_flags & DNS_KEYFLAG_TYPEMASK) == DNS_KEYTYPE_NOKEY) {
547 result = computeid(pubkey);
548 if (result != ISC_R_SUCCESS) {
549 dst_key_free(&pubkey);
550 return (result);
551 }
552
553 *keyp = pubkey;
554 return (ISC_R_SUCCESS);
555 }
556
557 result = algorithm_status(pubkey->key_alg);
558 if (result != ISC_R_SUCCESS) {
559 dst_key_free(&pubkey);
560 return (result);
561 }
562
563 key = get_key_struct(pubkey->key_name, pubkey->key_alg,
564 pubkey->key_flags, pubkey->key_proto, 0,
565 pubkey->key_class, pubkey->key_ttl, mctx);
566 if (key == NULL) {
567 dst_key_free(&pubkey);
568 return (ISC_R_NOMEMORY);
569 }
570
571 if (key->func->parse == NULL)
572 RETERR(DST_R_UNSUPPORTEDALG);
573
574 newfilenamelen = strlen(filename) + 9;
575 if (dirname != NULL)
576 newfilenamelen += strlen(dirname) + 1;
577 newfilename = isc_mem_get(mctx, newfilenamelen);
578 if (newfilename == NULL)
579 RETERR(ISC_R_NOMEMORY);
580 result = addsuffix(newfilename, newfilenamelen,
581 dirname, filename, ".private");
582 INSIST(result == ISC_R_SUCCESS);
583
584 RETERR(isc_lex_create(mctx, 1500, &lex));
585 RETERR(isc_lex_openfile(lex, newfilename));
586 isc_mem_put(mctx, newfilename, newfilenamelen);
587
588 RETERR(key->func->parse(key, lex, pubkey));
589 isc_lex_destroy(&lex);
590
591 RETERR(computeid(key));
592
593 if (pubkey->key_id != key->key_id)
594 RETERR(DST_R_INVALIDPRIVATEKEY);
595 dst_key_free(&pubkey);
596
597 *keyp = key;
598 return (ISC_R_SUCCESS);
599
600 out:
601 if (pubkey != NULL)
602 dst_key_free(&pubkey);
603 if (newfilename != NULL)
604 isc_mem_put(mctx, newfilename, newfilenamelen);
605 if (lex != NULL)
606 isc_lex_destroy(&lex);
607 if (key != NULL)
608 dst_key_free(&key);
609 return (result);
610 }
611
612 isc_result_t
dst_key_todns(const dst_key_t * key,isc_buffer_t * target)613 dst_key_todns(const dst_key_t *key, isc_buffer_t *target) {
614 REQUIRE(dst_initialized == ISC_TRUE);
615 REQUIRE(VALID_KEY(key));
616 REQUIRE(target != NULL);
617
618 CHECKALG(key->key_alg);
619
620 if (key->func->todns == NULL)
621 return (DST_R_UNSUPPORTEDALG);
622
623 if (isc_buffer_availablelength(target) < 4)
624 return (ISC_R_NOSPACE);
625 isc_buffer_putuint16(target, (isc_uint16_t)(key->key_flags & 0xffff));
626 isc_buffer_putuint8(target, (isc_uint8_t)key->key_proto);
627 isc_buffer_putuint8(target, (isc_uint8_t)key->key_alg);
628
629 if (key->key_flags & DNS_KEYFLAG_EXTENDED) {
630 if (isc_buffer_availablelength(target) < 2)
631 return (ISC_R_NOSPACE);
632 isc_buffer_putuint16(target,
633 (isc_uint16_t)((key->key_flags >> 16)
634 & 0xffff));
635 }
636
637 if (key->keydata.generic == NULL) /*%< NULL KEY */
638 return (ISC_R_SUCCESS);
639
640 return (key->func->todns(key, target));
641 }
642
643 isc_result_t
dst_key_fromdns(dns_name_t * name,dns_rdataclass_t rdclass,isc_buffer_t * source,isc_mem_t * mctx,dst_key_t ** keyp)644 dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
645 isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
646 {
647 isc_uint8_t alg, proto;
648 isc_uint32_t flags, extflags;
649 dst_key_t *key = NULL;
650 dns_keytag_t id, rid;
651 isc_region_t r;
652 isc_result_t result;
653
654 REQUIRE(dst_initialized);
655
656 isc_buffer_remainingregion(source, &r);
657
658 if (isc_buffer_remaininglength(source) < 4)
659 return (DST_R_INVALIDPUBLICKEY);
660 flags = isc_buffer_getuint16(source);
661 proto = isc_buffer_getuint8(source);
662 alg = isc_buffer_getuint8(source);
663
664 id = dst_region_computeid(&r, alg);
665 rid = dst_region_computerid(&r, alg);
666
667 if (flags & DNS_KEYFLAG_EXTENDED) {
668 if (isc_buffer_remaininglength(source) < 2)
669 return (DST_R_INVALIDPUBLICKEY);
670 extflags = isc_buffer_getuint16(source);
671 flags |= (extflags << 16);
672 }
673
674 result = frombuffer(name, alg, flags, proto, rdclass, source,
675 mctx, &key);
676 if (result != ISC_R_SUCCESS)
677 return (result);
678 key->key_id = id;
679 key->key_rid = rid;
680
681 *keyp = key;
682 return (ISC_R_SUCCESS);
683 }
684
685 isc_result_t
dst_key_frombuffer(dns_name_t * name,unsigned int alg,unsigned int flags,unsigned int protocol,dns_rdataclass_t rdclass,isc_buffer_t * source,isc_mem_t * mctx,dst_key_t ** keyp)686 dst_key_frombuffer(dns_name_t *name, unsigned int alg,
687 unsigned int flags, unsigned int protocol,
688 dns_rdataclass_t rdclass,
689 isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
690 {
691 dst_key_t *key = NULL;
692 isc_result_t result;
693
694 REQUIRE(dst_initialized);
695
696 result = frombuffer(name, alg, flags, protocol, rdclass, source,
697 mctx, &key);
698 if (result != ISC_R_SUCCESS)
699 return (result);
700
701 result = computeid(key);
702 if (result != ISC_R_SUCCESS) {
703 dst_key_free(&key);
704 return (result);
705 }
706
707 *keyp = key;
708 return (ISC_R_SUCCESS);
709 }
710
711 isc_result_t
dst_key_tobuffer(const dst_key_t * key,isc_buffer_t * target)712 dst_key_tobuffer(const dst_key_t *key, isc_buffer_t *target) {
713 REQUIRE(dst_initialized == ISC_TRUE);
714 REQUIRE(VALID_KEY(key));
715 REQUIRE(target != NULL);
716
717 CHECKALG(key->key_alg);
718
719 if (key->func->todns == NULL)
720 return (DST_R_UNSUPPORTEDALG);
721
722 return (key->func->todns(key, target));
723 }
724
725 isc_result_t
dst_key_privatefrombuffer(dst_key_t * key,isc_buffer_t * buffer)726 dst_key_privatefrombuffer(dst_key_t *key, isc_buffer_t *buffer) {
727 isc_lex_t *lex = NULL;
728 isc_result_t result = ISC_R_SUCCESS;
729
730 REQUIRE(dst_initialized == ISC_TRUE);
731 REQUIRE(VALID_KEY(key));
732 REQUIRE(!dst_key_isprivate(key));
733 REQUIRE(buffer != NULL);
734
735 if (key->func->parse == NULL)
736 RETERR(DST_R_UNSUPPORTEDALG);
737
738 RETERR(isc_lex_create(key->mctx, 1500, &lex));
739 RETERR(isc_lex_openbuffer(lex, buffer));
740 RETERR(key->func->parse(key, lex, NULL));
741 out:
742 if (lex != NULL)
743 isc_lex_destroy(&lex);
744 return (result);
745 }
746
747 gss_ctx_id_t
dst_key_getgssctx(const dst_key_t * key)748 dst_key_getgssctx(const dst_key_t *key)
749 {
750 REQUIRE(key != NULL);
751
752 return (key->keydata.gssctx);
753 }
754
755 isc_result_t
dst_key_fromgssapi(dns_name_t * name,gss_ctx_id_t gssctx,isc_mem_t * mctx,dst_key_t ** keyp,isc_region_t * intoken)756 dst_key_fromgssapi(dns_name_t *name, gss_ctx_id_t gssctx, isc_mem_t *mctx,
757 dst_key_t **keyp, isc_region_t *intoken)
758 {
759 dst_key_t *key;
760 isc_result_t result;
761
762 REQUIRE(gssctx != NULL);
763 REQUIRE(keyp != NULL && *keyp == NULL);
764
765 key = get_key_struct(name, DST_ALG_GSSAPI, 0, DNS_KEYPROTO_DNSSEC,
766 0, dns_rdataclass_in, 0, mctx);
767 if (key == NULL)
768 return (ISC_R_NOMEMORY);
769
770 if (intoken != NULL) {
771 /*
772 * Keep the token for use by external ssu rules. They may need
773 * to examine the PAC in the kerberos ticket.
774 */
775 RETERR(isc_buffer_allocate(key->mctx, &key->key_tkeytoken,
776 intoken->length));
777 RETERR(isc_buffer_copyregion(key->key_tkeytoken, intoken));
778 }
779
780 key->keydata.gssctx = gssctx;
781 *keyp = key;
782 result = ISC_R_SUCCESS;
783 out:
784 return result;
785 }
786
787 isc_result_t
dst_key_buildinternal(dns_name_t * name,unsigned int alg,unsigned int bits,unsigned int flags,unsigned int protocol,dns_rdataclass_t rdclass,void * data,isc_mem_t * mctx,dst_key_t ** keyp)788 dst_key_buildinternal(dns_name_t *name, unsigned int alg,
789 unsigned int bits, unsigned int flags,
790 unsigned int protocol, dns_rdataclass_t rdclass,
791 void *data, isc_mem_t *mctx, dst_key_t **keyp)
792 {
793 dst_key_t *key;
794 isc_result_t result;
795
796 REQUIRE(dst_initialized == ISC_TRUE);
797 REQUIRE(dns_name_isabsolute(name));
798 REQUIRE(mctx != NULL);
799 REQUIRE(keyp != NULL && *keyp == NULL);
800 REQUIRE(data != NULL);
801
802 CHECKALG(alg);
803
804 key = get_key_struct(name, alg, flags, protocol, bits, rdclass,
805 0, mctx);
806 if (key == NULL)
807 return (ISC_R_NOMEMORY);
808
809 key->keydata.generic = data;
810
811 result = computeid(key);
812 if (result != ISC_R_SUCCESS) {
813 dst_key_free(&key);
814 return (result);
815 }
816
817 *keyp = key;
818 return (ISC_R_SUCCESS);
819 }
820
821 isc_result_t
dst_key_fromlabel(dns_name_t * name,int alg,unsigned int flags,unsigned int protocol,dns_rdataclass_t rdclass,const char * engine,const char * label,const char * pin,isc_mem_t * mctx,dst_key_t ** keyp)822 dst_key_fromlabel(dns_name_t *name, int alg, unsigned int flags,
823 unsigned int protocol, dns_rdataclass_t rdclass,
824 const char *engine, const char *label, const char *pin,
825 isc_mem_t *mctx, dst_key_t **keyp)
826 {
827 dst_key_t *key;
828 isc_result_t result;
829
830 REQUIRE(dst_initialized == ISC_TRUE);
831 REQUIRE(dns_name_isabsolute(name));
832 REQUIRE(mctx != NULL);
833 REQUIRE(keyp != NULL && *keyp == NULL);
834 REQUIRE(label != NULL);
835
836 CHECKALG(alg);
837
838 key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx);
839 if (key == NULL)
840 return (ISC_R_NOMEMORY);
841
842 if (key->func->fromlabel == NULL) {
843 dst_key_free(&key);
844 return (DST_R_UNSUPPORTEDALG);
845 }
846
847 result = key->func->fromlabel(key, engine, label, pin);
848 if (result != ISC_R_SUCCESS) {
849 dst_key_free(&key);
850 return (result);
851 }
852
853 result = computeid(key);
854 if (result != ISC_R_SUCCESS) {
855 dst_key_free(&key);
856 return (result);
857 }
858
859 *keyp = key;
860 return (ISC_R_SUCCESS);
861 }
862
863 isc_result_t
dst_key_generate(dns_name_t * name,unsigned int alg,unsigned int bits,unsigned int param,unsigned int flags,unsigned int protocol,dns_rdataclass_t rdclass,isc_mem_t * mctx,dst_key_t ** keyp)864 dst_key_generate(dns_name_t *name, unsigned int alg,
865 unsigned int bits, unsigned int param,
866 unsigned int flags, unsigned int protocol,
867 dns_rdataclass_t rdclass,
868 isc_mem_t *mctx, dst_key_t **keyp)
869 {
870 return (dst_key_generate2(name, alg, bits, param, flags, protocol,
871 rdclass, mctx, keyp, NULL));
872 }
873
874 isc_result_t
dst_key_generate2(dns_name_t * name,unsigned int alg,unsigned int bits,unsigned int param,unsigned int flags,unsigned int protocol,dns_rdataclass_t rdclass,isc_mem_t * mctx,dst_key_t ** keyp,void (* callback)(int))875 dst_key_generate2(dns_name_t *name, unsigned int alg,
876 unsigned int bits, unsigned int param,
877 unsigned int flags, unsigned int protocol,
878 dns_rdataclass_t rdclass,
879 isc_mem_t *mctx, dst_key_t **keyp,
880 void (*callback)(int))
881 {
882 dst_key_t *key;
883 isc_result_t ret;
884
885 REQUIRE(dst_initialized == ISC_TRUE);
886 REQUIRE(dns_name_isabsolute(name));
887 REQUIRE(mctx != NULL);
888 REQUIRE(keyp != NULL && *keyp == NULL);
889
890 CHECKALG(alg);
891
892 key = get_key_struct(name, alg, flags, protocol, bits,
893 rdclass, 0, mctx);
894 if (key == NULL)
895 return (ISC_R_NOMEMORY);
896
897 if (bits == 0) { /*%< NULL KEY */
898 key->key_flags |= DNS_KEYTYPE_NOKEY;
899 *keyp = key;
900 return (ISC_R_SUCCESS);
901 }
902
903 if (key->func->generate == NULL) {
904 dst_key_free(&key);
905 return (DST_R_UNSUPPORTEDALG);
906 }
907
908 ret = key->func->generate(key, param, callback);
909 if (ret != ISC_R_SUCCESS) {
910 dst_key_free(&key);
911 return (ret);
912 }
913
914 ret = computeid(key);
915 if (ret != ISC_R_SUCCESS) {
916 dst_key_free(&key);
917 return (ret);
918 }
919
920 *keyp = key;
921 return (ISC_R_SUCCESS);
922 }
923
924 isc_result_t
dst_key_getnum(const dst_key_t * key,int type,isc_uint32_t * valuep)925 dst_key_getnum(const dst_key_t *key, int type, isc_uint32_t *valuep)
926 {
927 REQUIRE(VALID_KEY(key));
928 REQUIRE(valuep != NULL);
929 REQUIRE(type <= DST_MAX_NUMERIC);
930 if (!key->numset[type])
931 return (ISC_R_NOTFOUND);
932 *valuep = key->nums[type];
933 return (ISC_R_SUCCESS);
934 }
935
936 void
dst_key_setnum(dst_key_t * key,int type,isc_uint32_t value)937 dst_key_setnum(dst_key_t *key, int type, isc_uint32_t value)
938 {
939 REQUIRE(VALID_KEY(key));
940 REQUIRE(type <= DST_MAX_NUMERIC);
941 key->nums[type] = value;
942 key->numset[type] = ISC_TRUE;
943 }
944
945 void
dst_key_unsetnum(dst_key_t * key,int type)946 dst_key_unsetnum(dst_key_t *key, int type)
947 {
948 REQUIRE(VALID_KEY(key));
949 REQUIRE(type <= DST_MAX_NUMERIC);
950 key->numset[type] = ISC_FALSE;
951 }
952
953 isc_result_t
dst_key_gettime(const dst_key_t * key,int type,isc_stdtime_t * timep)954 dst_key_gettime(const dst_key_t *key, int type, isc_stdtime_t *timep) {
955 REQUIRE(VALID_KEY(key));
956 REQUIRE(timep != NULL);
957 REQUIRE(type <= DST_MAX_TIMES);
958 if (!key->timeset[type])
959 return (ISC_R_NOTFOUND);
960 *timep = key->times[type];
961 return (ISC_R_SUCCESS);
962 }
963
964 void
dst_key_settime(dst_key_t * key,int type,isc_stdtime_t when)965 dst_key_settime(dst_key_t *key, int type, isc_stdtime_t when) {
966 REQUIRE(VALID_KEY(key));
967 REQUIRE(type <= DST_MAX_TIMES);
968 key->times[type] = when;
969 key->timeset[type] = ISC_TRUE;
970 }
971
972 void
dst_key_unsettime(dst_key_t * key,int type)973 dst_key_unsettime(dst_key_t *key, int type) {
974 REQUIRE(VALID_KEY(key));
975 REQUIRE(type <= DST_MAX_TIMES);
976 key->timeset[type] = ISC_FALSE;
977 }
978
979 isc_result_t
dst_key_getprivateformat(const dst_key_t * key,int * majorp,int * minorp)980 dst_key_getprivateformat(const dst_key_t *key, int *majorp, int *minorp) {
981 REQUIRE(VALID_KEY(key));
982 REQUIRE(majorp != NULL);
983 REQUIRE(minorp != NULL);
984 *majorp = key->fmt_major;
985 *minorp = key->fmt_minor;
986 return (ISC_R_SUCCESS);
987 }
988
989 void
dst_key_setprivateformat(dst_key_t * key,int major,int minor)990 dst_key_setprivateformat(dst_key_t *key, int major, int minor) {
991 REQUIRE(VALID_KEY(key));
992 key->fmt_major = major;
993 key->fmt_minor = minor;
994 }
995
996 static isc_boolean_t
comparekeys(const dst_key_t * key1,const dst_key_t * key2,isc_boolean_t match_revoked_key,isc_boolean_t (* compare)(const dst_key_t * key1,const dst_key_t * key2))997 comparekeys(const dst_key_t *key1, const dst_key_t *key2,
998 isc_boolean_t match_revoked_key,
999 isc_boolean_t (*compare)(const dst_key_t *key1,
1000 const dst_key_t *key2))
1001 {
1002 REQUIRE(dst_initialized == ISC_TRUE);
1003 REQUIRE(VALID_KEY(key1));
1004 REQUIRE(VALID_KEY(key2));
1005
1006 if (key1 == key2)
1007 return (ISC_TRUE);
1008
1009 if (key1->key_alg != key2->key_alg)
1010 return (ISC_FALSE);
1011
1012 if (key1->key_id != key2->key_id) {
1013 if (!match_revoked_key)
1014 return (ISC_FALSE);
1015 if (key1->key_alg == DST_ALG_RSAMD5)
1016 return (ISC_FALSE);
1017 if ((key1->key_flags & DNS_KEYFLAG_REVOKE) ==
1018 (key2->key_flags & DNS_KEYFLAG_REVOKE))
1019 return (ISC_FALSE);
1020 if (key1->key_id != key2->key_rid &&
1021 key1->key_rid != key2->key_id)
1022 return (ISC_FALSE);
1023 }
1024
1025 if (compare != NULL)
1026 return (compare(key1, key2));
1027 else
1028 return (ISC_FALSE);
1029 }
1030
1031
1032 /*
1033 * Compares only the public portion of two keys, by converting them
1034 * both to wire format and comparing the results.
1035 */
1036 static isc_boolean_t
pub_compare(const dst_key_t * key1,const dst_key_t * key2)1037 pub_compare(const dst_key_t *key1, const dst_key_t *key2) {
1038 isc_result_t result;
1039 unsigned char buf1[DST_KEY_MAXSIZE], buf2[DST_KEY_MAXSIZE];
1040 isc_buffer_t b1, b2;
1041 isc_region_t r1, r2;
1042
1043 isc_buffer_init(&b1, buf1, sizeof(buf1));
1044 result = dst_key_todns(key1, &b1);
1045 if (result != ISC_R_SUCCESS)
1046 return (ISC_FALSE);
1047 /* Zero out flags. */
1048 buf1[0] = buf1[1] = 0;
1049 if ((key1->key_flags & DNS_KEYFLAG_EXTENDED) != 0)
1050 isc_buffer_subtract(&b1, 2);
1051
1052 isc_buffer_init(&b2, buf2, sizeof(buf2));
1053 result = dst_key_todns(key2, &b2);
1054 if (result != ISC_R_SUCCESS)
1055 return (ISC_FALSE);
1056 /* Zero out flags. */
1057 buf2[0] = buf2[1] = 0;
1058 if ((key2->key_flags & DNS_KEYFLAG_EXTENDED) != 0)
1059 isc_buffer_subtract(&b2, 2);
1060
1061 isc_buffer_usedregion(&b1, &r1);
1062 /* Remove extended flags. */
1063 if ((key1->key_flags & DNS_KEYFLAG_EXTENDED) != 0) {
1064 memmove(&buf1[4], &buf1[6], r1.length - 6);
1065 r1.length -= 2;
1066 }
1067
1068 isc_buffer_usedregion(&b2, &r2);
1069 /* Remove extended flags. */
1070 if ((key2->key_flags & DNS_KEYFLAG_EXTENDED) != 0) {
1071 memmove(&buf2[4], &buf2[6], r2.length - 6);
1072 r2.length -= 2;
1073 }
1074 return (ISC_TF(isc_region_compare(&r1, &r2) == 0));
1075 }
1076
1077 isc_boolean_t
dst_key_compare(const dst_key_t * key1,const dst_key_t * key2)1078 dst_key_compare(const dst_key_t *key1, const dst_key_t *key2) {
1079 return (comparekeys(key1, key2, ISC_FALSE, key1->func->compare));
1080 }
1081
1082 isc_boolean_t
dst_key_pubcompare(const dst_key_t * key1,const dst_key_t * key2,isc_boolean_t match_revoked_key)1083 dst_key_pubcompare(const dst_key_t *key1, const dst_key_t *key2,
1084 isc_boolean_t match_revoked_key)
1085 {
1086 return (comparekeys(key1, key2, match_revoked_key, pub_compare));
1087 }
1088
1089
1090 isc_boolean_t
dst_key_paramcompare(const dst_key_t * key1,const dst_key_t * key2)1091 dst_key_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
1092 REQUIRE(dst_initialized == ISC_TRUE);
1093 REQUIRE(VALID_KEY(key1));
1094 REQUIRE(VALID_KEY(key2));
1095
1096 if (key1 == key2)
1097 return (ISC_TRUE);
1098 if (key1->key_alg == key2->key_alg &&
1099 key1->func->paramcompare != NULL &&
1100 key1->func->paramcompare(key1, key2) == ISC_TRUE)
1101 return (ISC_TRUE);
1102 else
1103 return (ISC_FALSE);
1104 }
1105
1106 void
dst_key_attach(dst_key_t * source,dst_key_t ** target)1107 dst_key_attach(dst_key_t *source, dst_key_t **target) {
1108
1109 REQUIRE(dst_initialized == ISC_TRUE);
1110 REQUIRE(target != NULL && *target == NULL);
1111 REQUIRE(VALID_KEY(source));
1112
1113 isc_refcount_increment(&source->refs, NULL);
1114 *target = source;
1115 }
1116
1117 void
dst_key_free(dst_key_t ** keyp)1118 dst_key_free(dst_key_t **keyp) {
1119 isc_mem_t *mctx;
1120 dst_key_t *key;
1121 unsigned int refs;
1122
1123 REQUIRE(dst_initialized == ISC_TRUE);
1124 REQUIRE(keyp != NULL && VALID_KEY(*keyp));
1125
1126 key = *keyp;
1127 mctx = key->mctx;
1128
1129 isc_refcount_decrement(&key->refs, &refs);
1130 if (refs != 0)
1131 return;
1132
1133 isc_refcount_destroy(&key->refs);
1134 if (key->keydata.generic != NULL) {
1135 INSIST(key->func->destroy != NULL);
1136 key->func->destroy(key);
1137 }
1138 if (key->engine != NULL)
1139 isc_mem_free(mctx, key->engine);
1140 if (key->label != NULL)
1141 isc_mem_free(mctx, key->label);
1142 dns_name_free(key->key_name, mctx);
1143 isc_mem_put(mctx, key->key_name, sizeof(dns_name_t));
1144 if (key->key_tkeytoken) {
1145 isc_buffer_free(&key->key_tkeytoken);
1146 }
1147 memset(key, 0, sizeof(dst_key_t));
1148 isc_mem_putanddetach(&mctx, key, sizeof(dst_key_t));
1149 *keyp = NULL;
1150 }
1151
1152 isc_boolean_t
dst_key_isprivate(const dst_key_t * key)1153 dst_key_isprivate(const dst_key_t *key) {
1154 REQUIRE(VALID_KEY(key));
1155 INSIST(key->func->isprivate != NULL);
1156 return (key->func->isprivate(key));
1157 }
1158
1159 isc_result_t
dst_key_buildfilename(const dst_key_t * key,int type,const char * directory,isc_buffer_t * out)1160 dst_key_buildfilename(const dst_key_t *key, int type,
1161 const char *directory, isc_buffer_t *out) {
1162
1163 REQUIRE(VALID_KEY(key));
1164 REQUIRE(type == DST_TYPE_PRIVATE || type == DST_TYPE_PUBLIC ||
1165 type == 0);
1166
1167 return (buildfilename(key->key_name, key->key_id, key->key_alg,
1168 type, directory, out));
1169 }
1170
1171 isc_result_t
dst_key_sigsize(const dst_key_t * key,unsigned int * n)1172 dst_key_sigsize(const dst_key_t *key, unsigned int *n) {
1173 REQUIRE(dst_initialized == ISC_TRUE);
1174 REQUIRE(VALID_KEY(key));
1175 REQUIRE(n != NULL);
1176
1177 /* XXXVIX this switch statement is too sparse to gen a jump table. */
1178 switch (key->key_alg) {
1179 case DST_ALG_RSAMD5:
1180 case DST_ALG_RSASHA1:
1181 case DST_ALG_NSEC3RSASHA1:
1182 case DST_ALG_RSASHA256:
1183 case DST_ALG_RSASHA512:
1184 *n = (key->key_size + 7) / 8;
1185 break;
1186 case DST_ALG_DSA:
1187 case DST_ALG_NSEC3DSA:
1188 *n = DNS_SIG_DSASIGSIZE;
1189 break;
1190 case DST_ALG_ECCGOST:
1191 *n = DNS_SIG_GOSTSIGSIZE;
1192 break;
1193 case DST_ALG_ECDSA256:
1194 *n = DNS_SIG_ECDSA256SIZE;
1195 break;
1196 case DST_ALG_ECDSA384:
1197 *n = DNS_SIG_ECDSA384SIZE;
1198 break;
1199 case DST_ALG_HMACMD5:
1200 *n = 16;
1201 break;
1202 case DST_ALG_HMACSHA1:
1203 *n = ISC_SHA1_DIGESTLENGTH;
1204 break;
1205 case DST_ALG_HMACSHA224:
1206 *n = ISC_SHA224_DIGESTLENGTH;
1207 break;
1208 case DST_ALG_HMACSHA256:
1209 *n = ISC_SHA256_DIGESTLENGTH;
1210 break;
1211 case DST_ALG_HMACSHA384:
1212 *n = ISC_SHA384_DIGESTLENGTH;
1213 break;
1214 case DST_ALG_HMACSHA512:
1215 *n = ISC_SHA512_DIGESTLENGTH;
1216 break;
1217 case DST_ALG_GSSAPI:
1218 *n = 128; /*%< XXX */
1219 break;
1220 case DST_ALG_DH:
1221 default:
1222 return (DST_R_UNSUPPORTEDALG);
1223 }
1224 return (ISC_R_SUCCESS);
1225 }
1226
1227 isc_result_t
dst_key_secretsize(const dst_key_t * key,unsigned int * n)1228 dst_key_secretsize(const dst_key_t *key, unsigned int *n) {
1229 REQUIRE(dst_initialized == ISC_TRUE);
1230 REQUIRE(VALID_KEY(key));
1231 REQUIRE(n != NULL);
1232
1233 if (key->key_alg == DST_ALG_DH)
1234 *n = (key->key_size + 7) / 8;
1235 else
1236 return (DST_R_UNSUPPORTEDALG);
1237 return (ISC_R_SUCCESS);
1238 }
1239
1240 /*%
1241 * Set the flags on a key, then recompute the key ID
1242 */
1243 isc_result_t
dst_key_setflags(dst_key_t * key,isc_uint32_t flags)1244 dst_key_setflags(dst_key_t *key, isc_uint32_t flags) {
1245 REQUIRE(VALID_KEY(key));
1246 key->key_flags = flags;
1247 return (computeid(key));
1248 }
1249
1250 void
dst_key_format(const dst_key_t * key,char * cp,unsigned int size)1251 dst_key_format(const dst_key_t *key, char *cp, unsigned int size) {
1252 char namestr[DNS_NAME_FORMATSIZE];
1253 char algstr[DNS_NAME_FORMATSIZE];
1254
1255 dns_name_format(dst_key_name(key), namestr, sizeof(namestr));
1256 dns_secalg_format((dns_secalg_t) dst_key_alg(key), algstr,
1257 sizeof(algstr));
1258 snprintf(cp, size, "%s/%s/%d", namestr, algstr, dst_key_id(key));
1259 }
1260
1261 isc_result_t
dst_key_dump(dst_key_t * key,isc_mem_t * mctx,char ** buffer,int * length)1262 dst_key_dump(dst_key_t *key, isc_mem_t *mctx, char **buffer, int *length) {
1263
1264 REQUIRE(buffer != NULL && *buffer == NULL);
1265 REQUIRE(length != NULL && *length == 0);
1266 REQUIRE(VALID_KEY(key));
1267
1268 if (key->func->dump == NULL)
1269 return (ISC_R_NOTIMPLEMENTED);
1270 return (key->func->dump(key, mctx, buffer, length));
1271 }
1272
1273 isc_result_t
dst_key_restore(dns_name_t * name,unsigned int alg,unsigned int flags,unsigned int protocol,dns_rdataclass_t rdclass,isc_mem_t * mctx,const char * keystr,dst_key_t ** keyp)1274 dst_key_restore(dns_name_t *name, unsigned int alg, unsigned int flags,
1275 unsigned int protocol, dns_rdataclass_t rdclass,
1276 isc_mem_t *mctx, const char *keystr, dst_key_t **keyp)
1277 {
1278 isc_result_t result;
1279 dst_key_t *key;
1280
1281 REQUIRE(dst_initialized == ISC_TRUE);
1282 REQUIRE(keyp != NULL && *keyp == NULL);
1283
1284 if (alg >= DST_MAX_ALGS || dst_t_func[alg] == NULL)
1285 return (DST_R_UNSUPPORTEDALG);
1286
1287 if (dst_t_func[alg]->restore == NULL)
1288 return (ISC_R_NOTIMPLEMENTED);
1289
1290 key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx);
1291 if (key == NULL)
1292 return (ISC_R_NOMEMORY);
1293
1294 result = (dst_t_func[alg]->restore)(key, keystr);
1295 if (result == ISC_R_SUCCESS)
1296 *keyp = key;
1297 else
1298 dst_key_free(&key);
1299
1300 return (result);
1301 }
1302
1303 /***
1304 *** Static methods
1305 ***/
1306
1307 /*%
1308 * Allocates a key structure and fills in some of the fields.
1309 */
1310 static dst_key_t *
get_key_struct(dns_name_t * name,unsigned int alg,unsigned int flags,unsigned int protocol,unsigned int bits,dns_rdataclass_t rdclass,dns_ttl_t ttl,isc_mem_t * mctx)1311 get_key_struct(dns_name_t *name, unsigned int alg,
1312 unsigned int flags, unsigned int protocol,
1313 unsigned int bits, dns_rdataclass_t rdclass,
1314 dns_ttl_t ttl, isc_mem_t *mctx)
1315 {
1316 dst_key_t *key;
1317 isc_result_t result;
1318 int i;
1319
1320 key = (dst_key_t *) isc_mem_get(mctx, sizeof(dst_key_t));
1321 if (key == NULL)
1322 return (NULL);
1323
1324 memset(key, 0, sizeof(dst_key_t));
1325
1326 key->key_name = isc_mem_get(mctx, sizeof(dns_name_t));
1327 if (key->key_name == NULL) {
1328 isc_mem_put(mctx, key, sizeof(dst_key_t));
1329 return (NULL);
1330 }
1331
1332 dns_name_init(key->key_name, NULL);
1333 result = dns_name_dup(name, mctx, key->key_name);
1334 if (result != ISC_R_SUCCESS) {
1335 isc_mem_put(mctx, key->key_name, sizeof(dns_name_t));
1336 isc_mem_put(mctx, key, sizeof(dst_key_t));
1337 return (NULL);
1338 }
1339
1340 result = isc_refcount_init(&key->refs, 1);
1341 if (result != ISC_R_SUCCESS) {
1342 dns_name_free(key->key_name, mctx);
1343 isc_mem_put(mctx, key->key_name, sizeof(dns_name_t));
1344 isc_mem_put(mctx, key, sizeof(dst_key_t));
1345 return (NULL);
1346 }
1347 isc_mem_attach(mctx, &key->mctx);
1348 key->key_alg = alg;
1349 key->key_flags = flags;
1350 key->key_proto = protocol;
1351 key->keydata.generic = NULL;
1352 key->key_size = bits;
1353 key->key_class = rdclass;
1354 key->key_ttl = ttl;
1355 key->func = dst_t_func[alg];
1356 key->fmt_major = 0;
1357 key->fmt_minor = 0;
1358 for (i = 0; i < (DST_MAX_TIMES + 1); i++) {
1359 key->times[i] = 0;
1360 key->timeset[i] = ISC_FALSE;
1361 }
1362 key->inactive = ISC_FALSE;
1363 key->magic = KEY_MAGIC;
1364 return (key);
1365 }
1366
1367 isc_boolean_t
dst_key_inactive(const dst_key_t * key)1368 dst_key_inactive(const dst_key_t *key) {
1369
1370 REQUIRE(VALID_KEY(key));
1371
1372 return (key->inactive);
1373 }
1374
1375 void
dst_key_setinactive(dst_key_t * key,isc_boolean_t inactive)1376 dst_key_setinactive(dst_key_t *key, isc_boolean_t inactive) {
1377
1378 REQUIRE(VALID_KEY(key));
1379
1380 key->inactive = inactive;
1381 }
1382
1383 /*%
1384 * Reads a public key from disk
1385 */
1386 isc_result_t
dst_key_read_public(const char * filename,int type,isc_mem_t * mctx,dst_key_t ** keyp)1387 dst_key_read_public(const char *filename, int type,
1388 isc_mem_t *mctx, dst_key_t **keyp)
1389 {
1390 u_char rdatabuf[DST_KEY_MAXSIZE];
1391 isc_buffer_t b;
1392 dns_fixedname_t name;
1393 isc_lex_t *lex = NULL;
1394 isc_token_t token;
1395 isc_result_t ret;
1396 dns_rdata_t rdata = DNS_RDATA_INIT;
1397 unsigned int opt = ISC_LEXOPT_DNSMULTILINE;
1398 dns_rdataclass_t rdclass = dns_rdataclass_in;
1399 isc_lexspecials_t specials;
1400 isc_uint32_t ttl = 0;
1401 isc_result_t result;
1402 dns_rdatatype_t keytype;
1403
1404 /*
1405 * Open the file and read its formatted contents
1406 * File format:
1407 * domain.name [ttl] [class] [KEY|DNSKEY] <flags> <protocol> <algorithm> <key>
1408 */
1409
1410 /* 1500 should be large enough for any key */
1411 ret = isc_lex_create(mctx, 1500, &lex);
1412 if (ret != ISC_R_SUCCESS)
1413 goto cleanup;
1414
1415 memset(specials, 0, sizeof(specials));
1416 specials['('] = 1;
1417 specials[')'] = 1;
1418 specials['"'] = 1;
1419 isc_lex_setspecials(lex, specials);
1420 isc_lex_setcomments(lex, ISC_LEXCOMMENT_DNSMASTERFILE);
1421
1422 ret = isc_lex_openfile(lex, filename);
1423 if (ret != ISC_R_SUCCESS)
1424 goto cleanup;
1425
1426 #define NEXTTOKEN(lex, opt, token) { \
1427 ret = isc_lex_gettoken(lex, opt, token); \
1428 if (ret != ISC_R_SUCCESS) \
1429 goto cleanup; \
1430 }
1431
1432 #define BADTOKEN() { \
1433 ret = ISC_R_UNEXPECTEDTOKEN; \
1434 goto cleanup; \
1435 }
1436
1437 /* Read the domain name */
1438 NEXTTOKEN(lex, opt, &token);
1439 if (token.type != isc_tokentype_string)
1440 BADTOKEN();
1441
1442 /*
1443 * We don't support "@" in .key files.
1444 */
1445 if (!strcmp(DST_AS_STR(token), "@"))
1446 BADTOKEN();
1447
1448 dns_fixedname_init(&name);
1449 isc_buffer_init(&b, DST_AS_STR(token), strlen(DST_AS_STR(token)));
1450 isc_buffer_add(&b, strlen(DST_AS_STR(token)));
1451 ret = dns_name_fromtext(dns_fixedname_name(&name), &b, dns_rootname,
1452 0, NULL);
1453 if (ret != ISC_R_SUCCESS)
1454 goto cleanup;
1455
1456 /* Read the next word: either TTL, class, or 'KEY' */
1457 NEXTTOKEN(lex, opt, &token);
1458
1459 if (token.type != isc_tokentype_string)
1460 BADTOKEN();
1461
1462 /* If it's a TTL, read the next one */
1463 result = dns_ttl_fromtext(&token.value.as_textregion, &ttl);
1464 if (result == ISC_R_SUCCESS)
1465 NEXTTOKEN(lex, opt, &token);
1466
1467 if (token.type != isc_tokentype_string)
1468 BADTOKEN();
1469
1470 ret = dns_rdataclass_fromtext(&rdclass, &token.value.as_textregion);
1471 if (ret == ISC_R_SUCCESS)
1472 NEXTTOKEN(lex, opt, &token);
1473
1474 if (token.type != isc_tokentype_string)
1475 BADTOKEN();
1476
1477 if (strcasecmp(DST_AS_STR(token), "DNSKEY") == 0)
1478 keytype = dns_rdatatype_dnskey;
1479 else if (strcasecmp(DST_AS_STR(token), "KEY") == 0)
1480 keytype = dns_rdatatype_key; /*%< SIG(0), TKEY */
1481 else
1482 BADTOKEN();
1483
1484 if (((type & DST_TYPE_KEY) != 0 && keytype != dns_rdatatype_key) ||
1485 ((type & DST_TYPE_KEY) == 0 && keytype != dns_rdatatype_dnskey)) {
1486 ret = DST_R_BADKEYTYPE;
1487 goto cleanup;
1488 }
1489
1490 isc_buffer_init(&b, rdatabuf, sizeof(rdatabuf));
1491 ret = dns_rdata_fromtext(&rdata, rdclass, keytype, lex, NULL,
1492 ISC_FALSE, mctx, &b, NULL);
1493 if (ret != ISC_R_SUCCESS)
1494 goto cleanup;
1495
1496 ret = dst_key_fromdns(dns_fixedname_name(&name), rdclass, &b, mctx,
1497 keyp);
1498 if (ret != ISC_R_SUCCESS)
1499 goto cleanup;
1500
1501 dst_key_setttl(*keyp, ttl);
1502
1503 cleanup:
1504 if (lex != NULL)
1505 isc_lex_destroy(&lex);
1506 return (ret);
1507 }
1508
1509 static isc_boolean_t
issymmetric(const dst_key_t * key)1510 issymmetric(const dst_key_t *key) {
1511 REQUIRE(dst_initialized == ISC_TRUE);
1512 REQUIRE(VALID_KEY(key));
1513
1514 /* XXXVIX this switch statement is too sparse to gen a jump table. */
1515 switch (key->key_alg) {
1516 case DST_ALG_RSAMD5:
1517 case DST_ALG_RSASHA1:
1518 case DST_ALG_NSEC3RSASHA1:
1519 case DST_ALG_RSASHA256:
1520 case DST_ALG_RSASHA512:
1521 case DST_ALG_DSA:
1522 case DST_ALG_NSEC3DSA:
1523 case DST_ALG_DH:
1524 case DST_ALG_ECCGOST:
1525 case DST_ALG_ECDSA256:
1526 case DST_ALG_ECDSA384:
1527 return (ISC_FALSE);
1528 case DST_ALG_HMACMD5:
1529 case DST_ALG_GSSAPI:
1530 return (ISC_TRUE);
1531 default:
1532 return (ISC_FALSE);
1533 }
1534 }
1535
1536 /*%
1537 * Write key timing metadata to a file pointer, preceded by 'tag'
1538 */
1539 static void
printtime(const dst_key_t * key,int type,const char * tag,FILE * stream)1540 printtime(const dst_key_t *key, int type, const char *tag, FILE *stream) {
1541 isc_result_t result;
1542 #ifdef ISC_PLATFORM_USETHREADS
1543 char output[26]; /* Minimum buffer as per ctime_r() specification. */
1544 #else
1545 const char *output;
1546 #endif
1547 isc_stdtime_t when;
1548 time_t t;
1549 char utc[sizeof("YYYYMMDDHHSSMM")];
1550 isc_buffer_t b;
1551 isc_region_t r;
1552
1553 result = dst_key_gettime(key, type, &when);
1554 if (result == ISC_R_NOTFOUND)
1555 return;
1556
1557 /* time_t and isc_stdtime_t might be different sizes */
1558 t = when;
1559 #ifdef ISC_PLATFORM_USETHREADS
1560 #ifdef WIN32
1561 if (ctime_s(output, sizeof(output), &t) != 0)
1562 goto error;
1563 #else
1564 if (ctime_r(&t, output) == NULL)
1565 goto error;
1566 #endif
1567 #else
1568 output = ctime(&t);
1569 #endif
1570
1571 isc_buffer_init(&b, utc, sizeof(utc));
1572 result = dns_time32_totext(when, &b);
1573 if (result != ISC_R_SUCCESS)
1574 goto error;
1575
1576 isc_buffer_usedregion(&b, &r);
1577 fprintf(stream, "%s: %.*s (%.*s)\n", tag, (int)r.length, r.base,
1578 (int)strlen(output) - 1, output);
1579 return;
1580
1581 error:
1582 fprintf(stream, "%s: (set, unable to display)\n", tag);
1583 }
1584
1585 /*%
1586 * Writes a public key to disk in DNS format.
1587 */
1588 static isc_result_t
write_public_key(const dst_key_t * key,int type,const char * directory)1589 write_public_key(const dst_key_t *key, int type, const char *directory) {
1590 FILE *fp;
1591 isc_buffer_t keyb, textb, fileb, classb;
1592 isc_region_t r;
1593 char filename[ISC_DIR_NAMEMAX];
1594 unsigned char key_array[DST_KEY_MAXSIZE];
1595 char text_array[DST_KEY_MAXTEXTSIZE];
1596 char class_array[10];
1597 isc_result_t ret;
1598 dns_rdata_t rdata = DNS_RDATA_INIT;
1599 isc_fsaccess_t access;
1600
1601 REQUIRE(VALID_KEY(key));
1602
1603 isc_buffer_init(&keyb, key_array, sizeof(key_array));
1604 isc_buffer_init(&textb, text_array, sizeof(text_array));
1605 isc_buffer_init(&classb, class_array, sizeof(class_array));
1606
1607 ret = dst_key_todns(key, &keyb);
1608 if (ret != ISC_R_SUCCESS)
1609 return (ret);
1610
1611 isc_buffer_usedregion(&keyb, &r);
1612 dns_rdata_fromregion(&rdata, key->key_class, dns_rdatatype_dnskey, &r);
1613
1614 ret = dns_rdata_totext(&rdata, (dns_name_t *) NULL, &textb);
1615 if (ret != ISC_R_SUCCESS)
1616 return (DST_R_INVALIDPUBLICKEY);
1617
1618 ret = dns_rdataclass_totext(key->key_class, &classb);
1619 if (ret != ISC_R_SUCCESS)
1620 return (DST_R_INVALIDPUBLICKEY);
1621
1622 /*
1623 * Make the filename.
1624 */
1625 isc_buffer_init(&fileb, filename, sizeof(filename));
1626 ret = dst_key_buildfilename(key, DST_TYPE_PUBLIC, directory, &fileb);
1627 if (ret != ISC_R_SUCCESS)
1628 return (ret);
1629
1630 /*
1631 * Create public key file.
1632 */
1633 if ((fp = fopen(filename, "w")) == NULL)
1634 return (DST_R_WRITEERROR);
1635
1636 if (issymmetric(key)) {
1637 access = 0;
1638 isc_fsaccess_add(ISC_FSACCESS_OWNER,
1639 ISC_FSACCESS_READ | ISC_FSACCESS_WRITE,
1640 &access);
1641 (void)isc_fsaccess_set(filename, access);
1642 }
1643
1644 /* Write key information in comments */
1645 if ((type & DST_TYPE_KEY) == 0) {
1646 fprintf(fp, "; This is a %s%s-signing key, keyid %d, for ",
1647 (key->key_flags & DNS_KEYFLAG_REVOKE) != 0 ?
1648 "revoked " :
1649 "",
1650 (key->key_flags & DNS_KEYFLAG_KSK) != 0 ?
1651 "key" :
1652 "zone",
1653 key->key_id);
1654 ret = dns_name_print(key->key_name, fp);
1655 if (ret != ISC_R_SUCCESS) {
1656 fclose(fp);
1657 return (ret);
1658 }
1659 fputc('\n', fp);
1660
1661 printtime(key, DST_TIME_CREATED, "; Created", fp);
1662 printtime(key, DST_TIME_PUBLISH, "; Publish", fp);
1663 printtime(key, DST_TIME_ACTIVATE, "; Activate", fp);
1664 printtime(key, DST_TIME_REVOKE, "; Revoke", fp);
1665 printtime(key, DST_TIME_INACTIVE, "; Inactive", fp);
1666 printtime(key, DST_TIME_DELETE, "; Delete", fp);
1667 }
1668
1669 /* Now print the actual key */
1670 ret = dns_name_print(key->key_name, fp);
1671 fprintf(fp, " ");
1672
1673 if (key->key_ttl != 0)
1674 fprintf(fp, "%d ", key->key_ttl);
1675
1676 isc_buffer_usedregion(&classb, &r);
1677 if ((unsigned) fwrite(r.base, 1, r.length, fp) != r.length)
1678 ret = DST_R_WRITEERROR;
1679
1680 if ((type & DST_TYPE_KEY) != 0)
1681 fprintf(fp, " KEY ");
1682 else
1683 fprintf(fp, " DNSKEY ");
1684
1685 isc_buffer_usedregion(&textb, &r);
1686 if ((unsigned) fwrite(r.base, 1, r.length, fp) != r.length)
1687 ret = DST_R_WRITEERROR;
1688
1689 fputc('\n', fp);
1690 fflush(fp);
1691 if (ferror(fp))
1692 ret = DST_R_WRITEERROR;
1693 fclose(fp);
1694
1695 return (ret);
1696 }
1697
1698 static isc_result_t
buildfilename(dns_name_t * name,dns_keytag_t id,unsigned int alg,unsigned int type,const char * directory,isc_buffer_t * out)1699 buildfilename(dns_name_t *name, dns_keytag_t id,
1700 unsigned int alg, unsigned int type,
1701 const char *directory, isc_buffer_t *out)
1702 {
1703 const char *suffix = "";
1704 unsigned int len;
1705 isc_result_t result;
1706
1707 REQUIRE(out != NULL);
1708 if ((type & DST_TYPE_PRIVATE) != 0)
1709 suffix = ".private";
1710 else if (type == DST_TYPE_PUBLIC)
1711 suffix = ".key";
1712 if (directory != NULL) {
1713 if (isc_buffer_availablelength(out) < strlen(directory))
1714 return (ISC_R_NOSPACE);
1715 isc_buffer_putstr(out, directory);
1716 if (strlen(directory) > 0U &&
1717 directory[strlen(directory) - 1] != '/')
1718 isc_buffer_putstr(out, "/");
1719 }
1720 if (isc_buffer_availablelength(out) < 1)
1721 return (ISC_R_NOSPACE);
1722 isc_buffer_putstr(out, "K");
1723 result = dns_name_tofilenametext(name, ISC_FALSE, out);
1724 if (result != ISC_R_SUCCESS)
1725 return (result);
1726 len = 1 + 3 + 1 + 5 + strlen(suffix) + 1;
1727 if (isc_buffer_availablelength(out) < len)
1728 return (ISC_R_NOSPACE);
1729 sprintf((char *) isc_buffer_used(out), "+%03d+%05d%s", alg, id,
1730 suffix);
1731 isc_buffer_add(out, len);
1732
1733 return (ISC_R_SUCCESS);
1734 }
1735
1736 static isc_result_t
computeid(dst_key_t * key)1737 computeid(dst_key_t *key) {
1738 isc_buffer_t dnsbuf;
1739 unsigned char dns_array[DST_KEY_MAXSIZE];
1740 isc_region_t r;
1741 isc_result_t ret;
1742
1743 isc_buffer_init(&dnsbuf, dns_array, sizeof(dns_array));
1744 ret = dst_key_todns(key, &dnsbuf);
1745 if (ret != ISC_R_SUCCESS)
1746 return (ret);
1747
1748 isc_buffer_usedregion(&dnsbuf, &r);
1749 key->key_id = dst_region_computeid(&r, key->key_alg);
1750 key->key_rid = dst_region_computerid(&r, key->key_alg);
1751 return (ISC_R_SUCCESS);
1752 }
1753
1754 static isc_result_t
frombuffer(dns_name_t * name,unsigned int alg,unsigned int flags,unsigned int protocol,dns_rdataclass_t rdclass,isc_buffer_t * source,isc_mem_t * mctx,dst_key_t ** keyp)1755 frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
1756 unsigned int protocol, dns_rdataclass_t rdclass,
1757 isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
1758 {
1759 dst_key_t *key;
1760 isc_result_t ret;
1761
1762 REQUIRE(dns_name_isabsolute(name));
1763 REQUIRE(source != NULL);
1764 REQUIRE(mctx != NULL);
1765 REQUIRE(keyp != NULL && *keyp == NULL);
1766
1767 key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx);
1768 if (key == NULL)
1769 return (ISC_R_NOMEMORY);
1770
1771 if (isc_buffer_remaininglength(source) > 0) {
1772 ret = algorithm_status(alg);
1773 if (ret != ISC_R_SUCCESS) {
1774 dst_key_free(&key);
1775 return (ret);
1776 }
1777 if (key->func->fromdns == NULL) {
1778 dst_key_free(&key);
1779 return (DST_R_UNSUPPORTEDALG);
1780 }
1781
1782 ret = key->func->fromdns(key, source);
1783 if (ret != ISC_R_SUCCESS) {
1784 dst_key_free(&key);
1785 return (ret);
1786 }
1787 }
1788
1789 *keyp = key;
1790 return (ISC_R_SUCCESS);
1791 }
1792
1793 static isc_result_t
algorithm_status(unsigned int alg)1794 algorithm_status(unsigned int alg) {
1795 REQUIRE(dst_initialized == ISC_TRUE);
1796
1797 if (dst_algorithm_supported(alg))
1798 return (ISC_R_SUCCESS);
1799 #ifndef OPENSSL
1800 if (alg == DST_ALG_RSAMD5 || alg == DST_ALG_RSASHA1 ||
1801 alg == DST_ALG_DSA || alg == DST_ALG_DH ||
1802 alg == DST_ALG_HMACMD5 || alg == DST_ALG_NSEC3DSA ||
1803 alg == DST_ALG_NSEC3RSASHA1 ||
1804 alg == DST_ALG_RSASHA256 || alg == DST_ALG_RSASHA512 ||
1805 alg == DST_ALG_ECCGOST ||
1806 alg == DST_ALG_ECDSA256 || alg == DST_ALG_ECDSA384)
1807 return (DST_R_NOCRYPTO);
1808 #endif
1809 return (DST_R_UNSUPPORTEDALG);
1810 }
1811
1812 static isc_result_t
addsuffix(char * filename,int len,const char * odirname,const char * ofilename,const char * suffix)1813 addsuffix(char *filename, int len, const char *odirname,
1814 const char *ofilename, const char *suffix)
1815 {
1816 int olen = strlen(ofilename);
1817 int n;
1818
1819 if (olen > 1 && ofilename[olen - 1] == '.')
1820 olen -= 1;
1821 else if (olen > 8 && strcmp(ofilename + olen - 8, ".private") == 0)
1822 olen -= 8;
1823 else if (olen > 4 && strcmp(ofilename + olen - 4, ".key") == 0)
1824 olen -= 4;
1825
1826 if (odirname == NULL)
1827 n = snprintf(filename, len, "%.*s%s", olen, ofilename, suffix);
1828 else
1829 n = snprintf(filename, len, "%s/%.*s%s",
1830 odirname, olen, ofilename, suffix);
1831 if (n < 0)
1832 return (ISC_R_FAILURE);
1833 if (n >= len)
1834 return (ISC_R_NOSPACE);
1835 return (ISC_R_SUCCESS);
1836 }
1837
1838 isc_result_t
dst__entropy_getdata(void * buf,unsigned int len,isc_boolean_t pseudo)1839 dst__entropy_getdata(void *buf, unsigned int len, isc_boolean_t pseudo) {
1840 #ifdef BIND9
1841 unsigned int flags = dst_entropy_flags;
1842
1843 if (len == 0)
1844 return (ISC_R_SUCCESS);
1845 if (pseudo)
1846 flags &= ~ISC_ENTROPY_GOODONLY;
1847 else
1848 flags |= ISC_ENTROPY_BLOCKING;
1849 return (isc_entropy_getdata(dst_entropy_pool, buf, len, NULL, flags));
1850 #else
1851 UNUSED(buf);
1852 UNUSED(len);
1853 UNUSED(pseudo);
1854
1855 return (ISC_R_NOTIMPLEMENTED);
1856 #endif
1857 }
1858
1859 unsigned int
dst__entropy_status(void)1860 dst__entropy_status(void) {
1861 #ifdef BIND9
1862 #ifdef GSSAPI
1863 unsigned int flags = dst_entropy_flags;
1864 isc_result_t ret;
1865 unsigned char buf[32];
1866 static isc_boolean_t first = ISC_TRUE;
1867
1868 if (first) {
1869 /* Someone believes RAND_status() initializes the PRNG */
1870 flags &= ~ISC_ENTROPY_GOODONLY;
1871 ret = isc_entropy_getdata(dst_entropy_pool, buf,
1872 sizeof(buf), NULL, flags);
1873 INSIST(ret == ISC_R_SUCCESS);
1874 isc_entropy_putdata(dst_entropy_pool, buf,
1875 sizeof(buf), 2 * sizeof(buf));
1876 first = ISC_FALSE;
1877 }
1878 #endif
1879 return (isc_entropy_status(dst_entropy_pool));
1880 #else
1881 return (0);
1882 #endif
1883 }
1884
1885 isc_buffer_t *
dst_key_tkeytoken(const dst_key_t * key)1886 dst_key_tkeytoken(const dst_key_t *key) {
1887 REQUIRE(VALID_KEY(key));
1888 return (key->key_tkeytoken);
1889 }
1890