1/* 2 * tsig.c 3 * 4 * contains the functions needed for TSIG [RFC2845] 5 * 6 * (c) 2005-2006 NLnet Labs 7 * See the file LICENSE for the license 8 */ 9 10#include <ldns/config.h> 11 12#include <ldns/ldns.h> 13 14#include <strings.h> 15 16#ifdef HAVE_SSL 17#include <openssl/hmac.h> 18#include <openssl/md5.h> 19#endif /* HAVE_SSL */ 20 21char * 22ldns_tsig_algorithm(ldns_tsig_credentials *tc) 23{ 24 return tc->algorithm; 25} 26 27char * 28ldns_tsig_keyname(ldns_tsig_credentials *tc) 29{ 30 return tc->keyname; 31} 32 33char * 34ldns_tsig_keydata(ldns_tsig_credentials *tc) 35{ 36 return tc->keydata; 37} 38 39char * 40ldns_tsig_keyname_clone(ldns_tsig_credentials *tc) 41{ 42 return strdup(tc->keyname); 43} 44 45char * 46ldns_tsig_keydata_clone(ldns_tsig_credentials *tc) 47{ 48 return strdup(tc->keydata); 49} 50 51/* 52 * Makes an exact copy of the wire, but with the tsig rr removed 53 */ 54static uint8_t * 55ldns_tsig_prepare_pkt_wire(uint8_t *wire, size_t wire_len, size_t *result_len) 56{ 57 uint8_t *wire2 = NULL; 58 uint16_t qd_count; 59 uint16_t an_count; 60 uint16_t ns_count; 61 uint16_t ar_count; 62 ldns_rr *rr; 63 64 size_t pos; 65 uint16_t i; 66 67 ldns_status status; 68 69 if(wire_len < LDNS_HEADER_SIZE) { 70 return NULL; 71 } 72 /* fake parse the wire */ 73 qd_count = LDNS_QDCOUNT(wire); 74 an_count = LDNS_ANCOUNT(wire); 75 ns_count = LDNS_NSCOUNT(wire); 76 ar_count = LDNS_ARCOUNT(wire); 77 78 if (ar_count > 0) { 79 ar_count--; 80 } else { 81 return NULL; 82 } 83 84 pos = LDNS_HEADER_SIZE; 85 86 for (i = 0; i < qd_count; i++) { 87 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_QUESTION); 88 if (status != LDNS_STATUS_OK) { 89 return NULL; 90 } 91 ldns_rr_free(rr); 92 } 93 94 for (i = 0; i < an_count; i++) { 95 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_ANSWER); 96 if (status != LDNS_STATUS_OK) { 97 return NULL; 98 } 99 ldns_rr_free(rr); 100 } 101 102 for (i = 0; i < ns_count; i++) { 103 status = ldns_wire2rr(&rr, wire, wire_len, &pos, LDNS_SECTION_AUTHORITY); 104 if (status != LDNS_STATUS_OK) { 105 return NULL; 106 } 107 ldns_rr_free(rr); 108 } 109 110 for (i = 0; i < ar_count; i++) { 111 status = ldns_wire2rr(&rr, wire, wire_len, &pos, 112 LDNS_SECTION_ADDITIONAL); 113 if (status != LDNS_STATUS_OK) { 114 return NULL; 115 } 116 ldns_rr_free(rr); 117 } 118 119 *result_len = pos; 120 wire2 = LDNS_XMALLOC(uint8_t, *result_len); 121 if(!wire2) { 122 return NULL; 123 } 124 memcpy(wire2, wire, *result_len); 125 126 ldns_write_uint16(wire2 + LDNS_ARCOUNT_OFF, ar_count); 127 128 return wire2; 129} 130 131#ifdef HAVE_SSL 132static const EVP_MD * 133ldns_digest_function(char *name) 134{ 135 /* these are the mandatory algorithms from RFC4635 */ 136 /* The optional algorithms are not yet implemented */ 137 if (strlen(name) == 12 138 && strncasecmp(name, "hmac-sha256.", 11) == 0) { 139#ifdef HAVE_EVP_SHA256 140 return EVP_sha256(); 141#else 142 return NULL; 143#endif 144 } else if (strlen(name) == 10 145 && strncasecmp(name, "hmac-sha1.", 9) == 0) { 146 return EVP_sha1(); 147 } else if (strlen(name) == 25 148 && strncasecmp(name, "hmac-md5.sig-alg.reg.int.", 25) 149 == 0) { 150 return EVP_md5(); 151 } else { 152 return NULL; 153 } 154} 155#endif 156 157#ifdef HAVE_SSL 158static ldns_status 159ldns_tsig_mac_new(ldns_rdf **tsig_mac, uint8_t *pkt_wire, size_t pkt_wire_size, 160 const char *key_data, ldns_rdf *key_name_rdf, ldns_rdf *fudge_rdf, 161 ldns_rdf *algorithm_rdf, ldns_rdf *time_signed_rdf, ldns_rdf *error_rdf, 162 ldns_rdf *other_data_rdf, ldns_rdf *orig_mac_rdf, int tsig_timers_only) 163{ 164 ldns_status status; 165 char *wireformat; 166 int wiresize; 167 unsigned char *mac_bytes = NULL; 168 unsigned char *key_bytes = NULL; 169 int key_size; 170 const EVP_MD *digester; 171 char *algorithm_name = NULL; 172 unsigned int md_len = EVP_MAX_MD_SIZE; 173 ldns_rdf *result = NULL; 174 ldns_buffer *data_buffer = NULL; 175 ldns_rdf *canonical_key_name_rdf = NULL; 176 ldns_rdf *canonical_algorithm_rdf = NULL; 177 178 if (key_name_rdf == NULL || algorithm_rdf == NULL) { 179 return LDNS_STATUS_NULL; 180 } 181 canonical_key_name_rdf = ldns_rdf_clone(key_name_rdf); 182 if (canonical_key_name_rdf == NULL) { 183 return LDNS_STATUS_MEM_ERR; 184 } 185 canonical_algorithm_rdf = ldns_rdf_clone(algorithm_rdf); 186 if (canonical_algorithm_rdf == NULL) { 187 ldns_rdf_deep_free(canonical_key_name_rdf); 188 return LDNS_STATUS_MEM_ERR; 189 } 190 /* 191 * prepare the digestable information 192 */ 193 data_buffer = ldns_buffer_new(LDNS_MAX_PACKETLEN); 194 if (!data_buffer) { 195 status = LDNS_STATUS_MEM_ERR; 196 goto clean; 197 } 198 /* if orig_mac is not NULL, add it too */ 199 if (orig_mac_rdf) { 200 (void) ldns_rdf2buffer_wire(data_buffer, orig_mac_rdf); 201 } 202 ldns_buffer_write(data_buffer, pkt_wire, pkt_wire_size); 203 if (!tsig_timers_only) { 204 ldns_dname2canonical(canonical_key_name_rdf); 205 (void)ldns_rdf2buffer_wire(data_buffer, 206 canonical_key_name_rdf); 207 ldns_buffer_write_u16(data_buffer, LDNS_RR_CLASS_ANY); 208 ldns_buffer_write_u32(data_buffer, 0); 209 ldns_dname2canonical(canonical_algorithm_rdf); 210 (void)ldns_rdf2buffer_wire(data_buffer, 211 canonical_algorithm_rdf); 212 } 213 (void)ldns_rdf2buffer_wire(data_buffer, time_signed_rdf); 214 (void)ldns_rdf2buffer_wire(data_buffer, fudge_rdf); 215 if (!tsig_timers_only) { 216 (void)ldns_rdf2buffer_wire(data_buffer, error_rdf); 217 (void)ldns_rdf2buffer_wire(data_buffer, other_data_rdf); 218 } 219 220 wireformat = (char *) data_buffer->_data; 221 wiresize = (int) ldns_buffer_position(data_buffer); 222 223 algorithm_name = ldns_rdf2str(algorithm_rdf); 224 if(!algorithm_name) { 225 status = LDNS_STATUS_MEM_ERR; 226 goto clean; 227 } 228 229 /* prepare the key */ 230 key_bytes = LDNS_XMALLOC(unsigned char, 231 ldns_b64_pton_calculate_size(strlen(key_data))); 232 if(!key_bytes) { 233 status = LDNS_STATUS_MEM_ERR; 234 goto clean; 235 } 236 key_size = ldns_b64_pton(key_data, key_bytes, 237 ldns_b64_pton_calculate_size(strlen(key_data))); 238 if (key_size < 0) { 239 status = LDNS_STATUS_INVALID_B64; 240 goto clean; 241 } 242 /* hmac it */ 243 /* 2 spare bytes for the length */ 244 mac_bytes = LDNS_XMALLOC(unsigned char, md_len+2); 245 if(!mac_bytes) { 246 status = LDNS_STATUS_MEM_ERR; 247 goto clean; 248 } 249 memset(mac_bytes, 0, md_len+2); 250 251 digester = ldns_digest_function(algorithm_name); 252 253 if (digester) { 254 (void) HMAC(digester, key_bytes, key_size, (void *)wireformat, 255 (size_t) wiresize, mac_bytes + 2, &md_len); 256 257 ldns_write_uint16(mac_bytes, md_len); 258 result = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_INT16_DATA, md_len + 2, 259 mac_bytes); 260 } else { 261 status = LDNS_STATUS_CRYPTO_UNKNOWN_ALGO; 262 goto clean; 263 } 264 *tsig_mac = result; 265 status = LDNS_STATUS_OK; 266 clean: 267 LDNS_FREE(mac_bytes); 268 LDNS_FREE(key_bytes); 269 LDNS_FREE(algorithm_name); 270 ldns_buffer_free(data_buffer); 271 ldns_rdf_deep_free(canonical_algorithm_rdf); 272 ldns_rdf_deep_free(canonical_key_name_rdf); 273 return status; 274} 275#endif /* HAVE_SSL */ 276 277 278#ifdef HAVE_SSL 279bool 280ldns_pkt_tsig_verify(ldns_pkt *pkt, uint8_t *wire, size_t wirelen, const char *key_name, 281 const char *key_data, ldns_rdf *orig_mac_rdf) 282{ 283 return ldns_pkt_tsig_verify_next(pkt, wire, wirelen, key_name, key_data, orig_mac_rdf, 0); 284} 285 286bool 287ldns_pkt_tsig_verify_next(ldns_pkt *pkt, uint8_t *wire, size_t wirelen, const char* key_name, 288 const char *key_data, ldns_rdf *orig_mac_rdf, int tsig_timers_only) 289{ 290 ldns_rdf *fudge_rdf; 291 ldns_rdf *algorithm_rdf; 292 ldns_rdf *time_signed_rdf; 293 ldns_rdf *orig_id_rdf; 294 ldns_rdf *error_rdf; 295 ldns_rdf *other_data_rdf; 296 ldns_rdf *pkt_mac_rdf; 297 ldns_rdf *my_mac_rdf; 298 ldns_rdf *key_name_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, key_name); 299 uint16_t pkt_id, orig_pkt_id; 300 ldns_status status; 301 302 uint8_t *prepared_wire = NULL; 303 size_t prepared_wire_size = 0; 304 305 ldns_rr *orig_tsig = ldns_pkt_tsig(pkt); 306 307 if (!orig_tsig || ldns_rr_rd_count(orig_tsig) <= 6) { 308 ldns_rdf_deep_free(key_name_rdf); 309 return false; 310 } 311 algorithm_rdf = ldns_rr_rdf(orig_tsig, 0); 312 time_signed_rdf = ldns_rr_rdf(orig_tsig, 1); 313 fudge_rdf = ldns_rr_rdf(orig_tsig, 2); 314 pkt_mac_rdf = ldns_rr_rdf(orig_tsig, 3); 315 orig_id_rdf = ldns_rr_rdf(orig_tsig, 4); 316 error_rdf = ldns_rr_rdf(orig_tsig, 5); 317 other_data_rdf = ldns_rr_rdf(orig_tsig, 6); 318 319 /* remove temporarily */ 320 ldns_pkt_set_tsig(pkt, NULL); 321 /* temporarily change the id to the original id */ 322 pkt_id = ldns_pkt_id(pkt); 323 orig_pkt_id = ldns_rdf2native_int16(orig_id_rdf); 324 ldns_pkt_set_id(pkt, orig_pkt_id); 325 326 prepared_wire = ldns_tsig_prepare_pkt_wire(wire, wirelen, &prepared_wire_size); 327 328 status = ldns_tsig_mac_new(&my_mac_rdf, prepared_wire, prepared_wire_size, 329 key_data, key_name_rdf, fudge_rdf, algorithm_rdf, 330 time_signed_rdf, error_rdf, other_data_rdf, orig_mac_rdf, tsig_timers_only); 331 332 LDNS_FREE(prepared_wire); 333 334 if (status != LDNS_STATUS_OK) { 335 ldns_rdf_deep_free(key_name_rdf); 336 return false; 337 } 338 /* Put back the values */ 339 ldns_pkt_set_tsig(pkt, orig_tsig); 340 ldns_pkt_set_id(pkt, pkt_id); 341 342 ldns_rdf_deep_free(key_name_rdf); 343 344 if (ldns_rdf_compare(pkt_mac_rdf, my_mac_rdf) == 0) { 345 ldns_rdf_deep_free(my_mac_rdf); 346 return true; 347 } else { 348 ldns_rdf_deep_free(my_mac_rdf); 349 return false; 350 } 351} 352#endif /* HAVE_SSL */ 353 354#ifdef HAVE_SSL 355ldns_status 356ldns_pkt_tsig_sign(ldns_pkt *pkt, const char *key_name, const char *key_data, 357 uint16_t fudge, const char *algorithm_name, ldns_rdf *query_mac) 358{ 359 return ldns_pkt_tsig_sign_next(pkt, key_name, key_data, fudge, algorithm_name, query_mac, 0); 360} 361 362ldns_status 363ldns_pkt_tsig_sign_next(ldns_pkt *pkt, const char *key_name, const char *key_data, 364 uint16_t fudge, const char *algorithm_name, ldns_rdf *query_mac, int tsig_timers_only) 365{ 366 ldns_rr *tsig_rr; 367 ldns_rdf *key_name_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, key_name); 368 ldns_rdf *fudge_rdf = NULL; 369 ldns_rdf *orig_id_rdf = NULL; 370 ldns_rdf *algorithm_rdf; 371 ldns_rdf *error_rdf = NULL; 372 ldns_rdf *mac_rdf = NULL; 373 ldns_rdf *other_data_rdf = NULL; 374 375 ldns_status status = LDNS_STATUS_OK; 376 377 uint8_t *pkt_wire = NULL; 378 size_t pkt_wire_len; 379 380 struct timeval tv_time_signed; 381 uint8_t *time_signed = NULL; 382 ldns_rdf *time_signed_rdf = NULL; 383 384 algorithm_rdf = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, algorithm_name); 385 if(!key_name_rdf || !algorithm_rdf) { 386 status = LDNS_STATUS_MEM_ERR; 387 goto clean; 388 } 389 390 /* eww don't have create tsigtime rdf yet :( */ 391 /* bleh :p */ 392 if (gettimeofday(&tv_time_signed, NULL) == 0) { 393 time_signed = LDNS_XMALLOC(uint8_t, 6); 394 if(!time_signed) { 395 status = LDNS_STATUS_MEM_ERR; 396 goto clean; 397 } 398 ldns_write_uint64_as_uint48(time_signed, 399 (uint64_t)tv_time_signed.tv_sec); 400 } else { 401 status = LDNS_STATUS_INTERNAL_ERR; 402 goto clean; 403 } 404 405 time_signed_rdf = ldns_rdf_new(LDNS_RDF_TYPE_TSIGTIME, 6, time_signed); 406 if(!time_signed_rdf) { 407 LDNS_FREE(time_signed); 408 status = LDNS_STATUS_MEM_ERR; 409 goto clean; 410 } 411 412 fudge_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, fudge); 413 414 orig_id_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, ldns_pkt_id(pkt)); 415 416 error_rdf = ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, 0); 417 418 other_data_rdf = ldns_native2rdf_int16_data(0, NULL); 419 420 if(!fudge_rdf || !orig_id_rdf || !error_rdf || !other_data_rdf) { 421 status = LDNS_STATUS_MEM_ERR; 422 goto clean; 423 } 424 425 if (ldns_pkt2wire(&pkt_wire, pkt, &pkt_wire_len) != LDNS_STATUS_OK) { 426 status = LDNS_STATUS_ERR; 427 goto clean; 428 } 429 430 status = ldns_tsig_mac_new(&mac_rdf, pkt_wire, pkt_wire_len, 431 key_data, key_name_rdf, fudge_rdf, algorithm_rdf, 432 time_signed_rdf, error_rdf, other_data_rdf, query_mac, tsig_timers_only); 433 434 if (!mac_rdf) { 435 goto clean; 436 } 437 438 LDNS_FREE(pkt_wire); 439 440 /* Create the TSIG RR */ 441 tsig_rr = ldns_rr_new(); 442 if(!tsig_rr) { 443 status = LDNS_STATUS_MEM_ERR; 444 goto clean; 445 } 446 ldns_rr_set_owner(tsig_rr, key_name_rdf); 447 ldns_rr_set_class(tsig_rr, LDNS_RR_CLASS_ANY); 448 ldns_rr_set_type(tsig_rr, LDNS_RR_TYPE_TSIG); 449 ldns_rr_set_ttl(tsig_rr, 0); 450 451 ldns_rr_push_rdf(tsig_rr, algorithm_rdf); 452 ldns_rr_push_rdf(tsig_rr, time_signed_rdf); 453 ldns_rr_push_rdf(tsig_rr, fudge_rdf); 454 ldns_rr_push_rdf(tsig_rr, mac_rdf); 455 ldns_rr_push_rdf(tsig_rr, orig_id_rdf); 456 ldns_rr_push_rdf(tsig_rr, error_rdf); 457 ldns_rr_push_rdf(tsig_rr, other_data_rdf); 458 459 ldns_pkt_set_tsig(pkt, tsig_rr); 460 461 return status; 462 463 clean: 464 LDNS_FREE(pkt_wire); 465 ldns_rdf_free(key_name_rdf); 466 ldns_rdf_free(algorithm_rdf); 467 ldns_rdf_free(time_signed_rdf); 468 ldns_rdf_free(fudge_rdf); 469 ldns_rdf_free(orig_id_rdf); 470 ldns_rdf_free(error_rdf); 471 ldns_rdf_free(other_data_rdf); 472 return status; 473} 474#endif /* HAVE_SSL */ 475