1 /* $NetBSD: tsigconf.c,v 1.7 2023/01/25 21:43:23 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * SPDX-License-Identifier: MPL-2.0 7 * 8 * This Source Code Form is subject to the terms of the Mozilla Public 9 * License, v. 2.0. If a copy of the MPL was not distributed with this 10 * file, you can obtain one at https://mozilla.org/MPL/2.0/. 11 * 12 * See the COPYRIGHT file distributed with this work for additional 13 * information regarding copyright ownership. 14 */ 15 16 /*! \file */ 17 18 #include <inttypes.h> 19 20 #include <isc/base64.h> 21 #include <isc/buffer.h> 22 #include <isc/mem.h> 23 #include <isc/string.h> 24 #include <isc/util.h> 25 26 #include <dns/result.h> 27 #include <dns/tsig.h> 28 29 #include <isccfg/cfg.h> 30 31 #include <named/config.h> 32 #include <named/log.h> 33 #include <named/tsigconf.h> 34 35 static isc_result_t 36 add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring, 37 isc_mem_t *mctx) { 38 dns_tsigkey_t *tsigkey = NULL; 39 const cfg_listelt_t *element; 40 const cfg_obj_t *key = NULL; 41 const char *keyid = NULL; 42 unsigned char *secret = NULL; 43 int secretalloc = 0; 44 int secretlen = 0; 45 isc_result_t ret; 46 isc_stdtime_t now; 47 uint16_t bits; 48 49 for (element = cfg_list_first(list); element != NULL; 50 element = cfg_list_next(element)) 51 { 52 const cfg_obj_t *algobj = NULL; 53 const cfg_obj_t *secretobj = NULL; 54 dns_name_t keyname; 55 const dns_name_t *alg; 56 const char *algstr; 57 char keynamedata[1024]; 58 isc_buffer_t keynamesrc, keynamebuf; 59 const char *secretstr; 60 isc_buffer_t secretbuf; 61 62 key = cfg_listelt_value(element); 63 keyid = cfg_obj_asstring(cfg_map_getname(key)); 64 65 algobj = NULL; 66 secretobj = NULL; 67 (void)cfg_map_get(key, "algorithm", &algobj); 68 (void)cfg_map_get(key, "secret", &secretobj); 69 INSIST(algobj != NULL && secretobj != NULL); 70 71 /* 72 * Create the key name. 73 */ 74 dns_name_init(&keyname, NULL); 75 isc_buffer_constinit(&keynamesrc, keyid, strlen(keyid)); 76 isc_buffer_add(&keynamesrc, strlen(keyid)); 77 isc_buffer_init(&keynamebuf, keynamedata, sizeof(keynamedata)); 78 ret = dns_name_fromtext(&keyname, &keynamesrc, dns_rootname, 79 DNS_NAME_DOWNCASE, &keynamebuf); 80 if (ret != ISC_R_SUCCESS) { 81 goto failure; 82 } 83 84 /* 85 * Create the algorithm. 86 */ 87 algstr = cfg_obj_asstring(algobj); 88 if (named_config_getkeyalgorithm(algstr, &alg, &bits) != 89 ISC_R_SUCCESS) 90 { 91 cfg_obj_log(algobj, named_g_lctx, ISC_LOG_ERROR, 92 "key '%s': has a " 93 "unsupported algorithm '%s'", 94 keyid, algstr); 95 ret = DNS_R_BADALG; 96 goto failure; 97 } 98 99 secretstr = cfg_obj_asstring(secretobj); 100 secretalloc = secretlen = strlen(secretstr) * 3 / 4; 101 secret = isc_mem_get(mctx, secretlen); 102 isc_buffer_init(&secretbuf, secret, secretlen); 103 ret = isc_base64_decodestring(secretstr, &secretbuf); 104 if (ret != ISC_R_SUCCESS) { 105 goto failure; 106 } 107 secretlen = isc_buffer_usedlength(&secretbuf); 108 109 isc_stdtime_get(&now); 110 ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, 111 false, NULL, now, now, mctx, ring, 112 &tsigkey); 113 isc_mem_put(mctx, secret, secretalloc); 114 secret = NULL; 115 if (ret != ISC_R_SUCCESS) { 116 goto failure; 117 } 118 /* 119 * Set digest bits. 120 */ 121 dst_key_setbits(tsigkey->key, bits); 122 dns_tsigkey_detach(&tsigkey); 123 } 124 125 return (ISC_R_SUCCESS); 126 127 failure: 128 cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR, 129 "configuring key '%s': %s", keyid, isc_result_totext(ret)); 130 131 if (secret != NULL) { 132 isc_mem_put(mctx, secret, secretalloc); 133 } 134 return (ret); 135 } 136 137 isc_result_t 138 named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig, 139 isc_mem_t *mctx, dns_tsig_keyring_t **ringp) { 140 const cfg_obj_t *maps[3]; 141 const cfg_obj_t *keylist; 142 dns_tsig_keyring_t *ring = NULL; 143 isc_result_t result; 144 int i; 145 146 REQUIRE(ringp != NULL && *ringp == NULL); 147 148 i = 0; 149 if (config != NULL) { 150 maps[i++] = config; 151 } 152 if (vconfig != NULL) { 153 maps[i++] = cfg_tuple_get(vconfig, "options"); 154 } 155 maps[i] = NULL; 156 157 result = dns_tsigkeyring_create(mctx, &ring); 158 if (result != ISC_R_SUCCESS) { 159 return (result); 160 } 161 162 for (i = 0;; i++) { 163 if (maps[i] == NULL) { 164 break; 165 } 166 keylist = NULL; 167 result = cfg_map_get(maps[i], "key", &keylist); 168 if (result != ISC_R_SUCCESS) { 169 continue; 170 } 171 result = add_initial_keys(keylist, ring, mctx); 172 if (result != ISC_R_SUCCESS) { 173 goto failure; 174 } 175 } 176 177 *ringp = ring; 178 return (ISC_R_SUCCESS); 179 180 failure: 181 dns_tsigkeyring_detach(&ring); 182 return (result); 183 } 184