#ifndef LINT
static const char rcsid[] = "$Header: /cvs/root/netinfo/resolver/dst_api.c,v 1.2 2003/02/18 16:52:03 majka Exp $";
#endif
#ifndef __APPLE__
#include "port_before.h"
#endif
#include <stdio.h>
#include <errno.h>
#include <fcntl.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <memory.h>
#include <ctype.h>
#include <time.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/nameser.h>
#include <resolv.h>
#include "dst_internal.h"
#ifndef __APPLE__
#include "port_after.h"
#endif
static int done_init = 0;
dst_func *dst_t_func[DST_MAX_ALGS];
const char *key_file_fmt_str = "Private-key-format: v%s\nAlgorithm: %d (%s)\n";
const char *dst_path = "";
#ifdef _UNUSED_API_
static DST_KEY *dst_s_read_public_key(const char *in_name,
const u_int16_t in_id, int in_alg);
static int dst_s_read_private_key_file(char *name, DST_KEY *pk_key,
u_int16_t in_id, int in_alg);
static int dst_s_write_public_key(const DST_KEY *key);
static int dst_s_write_private_key(const DST_KEY *key);
#endif
static DST_KEY *dst_s_get_key_struct(const char *name, const int alg,
const int flags, const int protocol,
const int bits);
void
dst_init()
{
char *s;
int len;
if (done_init != 0)
return;
done_init = 1;
s = getenv("DSTKEYPATH");
len = 0;
if (s) {
struct stat statbuf;
len = strlen(s);
if (len > PATH_MAX) {
EREPORT(("%s is longer than %d characters, ignoring\n",
s, PATH_MAX));
} else if (stat(s, &statbuf) != 0 || !S_ISDIR(statbuf.st_mode)) {
EREPORT(("%s is not a valid directory\n", s));
} else {
char *tmp;
tmp = (char *) malloc(len + 2);
memcpy(tmp, s, len + 1);
if (tmp[strlen(tmp) - 1] != '/') {
tmp[strlen(tmp) + 1] = 0;
tmp[strlen(tmp)] = '/';
}
dst_path = tmp;
}
}
memset(dst_t_func, 0, sizeof(dst_t_func));
dst_hmac_md5_init();
}
#ifdef __APPLE__
static
#endif
int
dst_check_algorithm(const int alg)
{
return (dst_t_func[alg] != NULL);
}
static DST_KEY *
dst_s_get_key_struct(const char *name, const int alg, const int flags,
const int protocol, const int bits)
{
DST_KEY *new_key = NULL;
if (dst_check_algorithm(alg))
new_key = (DST_KEY *) malloc(sizeof(*new_key));
if (new_key == NULL)
return (NULL);
memset(new_key, 0, sizeof(*new_key));
new_key->dk_key_name = strdup(name);
new_key->dk_alg = alg;
new_key->dk_flags = flags;
new_key->dk_proto = protocol;
new_key->dk_KEY_struct = NULL;
new_key->dk_key_size = bits;
new_key->dk_func = dst_t_func[alg];
return (new_key);
}
#ifdef _UNUSED_API_
int
dst_compare_keys(const DST_KEY *key1, const DST_KEY *key2)
{
if (key1 == key2)
return (0);
if (key1 == NULL || key2 == NULL)
return (4);
if (key1->dk_alg != key2->dk_alg)
return (1);
if (key1->dk_key_size != key2->dk_key_size)
return (2);
if (key1->dk_id != key2->dk_id)
return (3);
return (key1->dk_func->compare(key1, key2));
}
#endif
int
dst_sign_data(const int mode, DST_KEY *in_key, void **context,
const u_char *data, const int len,
u_char *signature, const int sig_len)
{
DUMP(data, mode, len, "dst_sign_data()");
if (mode & SIG_MODE_FINAL &&
(in_key->dk_KEY_struct == NULL || signature == NULL))
return (MISSING_KEY_OR_SIGNATURE);
if (in_key->dk_func && in_key->dk_func->sign)
return (in_key->dk_func->sign(mode, in_key, context, data, len,
signature, sig_len));
return (UNKNOWN_KEYALG);
}
int
dst_verify_data(const int mode, DST_KEY *in_key, void **context,
const u_char *data, const int len,
const u_char *signature, const int sig_len)
{
DUMP(data, mode, len, "dst_verify_data()");
if (mode & SIG_MODE_FINAL &&
(in_key->dk_KEY_struct == NULL || signature == NULL))
return (MISSING_KEY_OR_SIGNATURE);
if (in_key->dk_func == NULL || in_key->dk_func->verify == NULL)
return (UNSUPPORTED_KEYALG);
return (in_key->dk_func->verify(mode, in_key, context, data, len,
signature, sig_len));
}
#ifdef _UNUSED_API_
DST_KEY *
dst_read_key(const char *in_keyname, const u_int16_t in_id,
const int in_alg, const int type)
{
char keyname[PATH_MAX];
DST_KEY *dg_key = NULL, *pubkey = NULL;
if (!dst_check_algorithm(in_alg)) {
EREPORT(("dst_read_private_key(): Algorithm %d not suppored\n",
in_alg));
return (NULL);
}
if ((type & (DST_PUBLIC | DST_PRIVATE)) == 0)
return (NULL);
if (in_keyname == NULL) {
EREPORT(("dst_read_private_key(): Null key name passed in\n"));
return (NULL);
} else
strcpy(keyname, in_keyname);
if ((pubkey = dst_s_read_public_key(keyname, in_id, in_alg)) == NULL)
return (NULL);
if (type == DST_PUBLIC)
return pubkey;
if (!(dg_key = dst_s_get_key_struct(keyname, pubkey->dk_alg,
pubkey->dk_flags, pubkey->dk_proto,
0)))
return (dg_key);
if (dst_s_read_private_key_file(keyname, dg_key, pubkey->dk_id,
pubkey->dk_alg) == 0)
dg_key = dst_free_key(dg_key);
pubkey = dst_free_key(pubkey);
return (dg_key);
}
#endif
#ifdef _UNUSED_API_
int
dst_write_key(const DST_KEY *key, const int type)
{
int pub = 0, priv = 0;
if (key == NULL)
return (0);
if (!dst_check_algorithm(key->dk_alg)) {
EREPORT(("dst_write_key(): Algorithm %d not suppored\n",
key->dk_alg));
return (UNSUPPORTED_KEYALG);
}
if ((type & (DST_PRIVATE|DST_PUBLIC)) == 0)
return (0);
if (type & DST_PUBLIC)
if ((pub = dst_s_write_public_key(key)) < 0)
return (pub);
if (type & DST_PRIVATE)
if ((priv = dst_s_write_private_key(key)) < 0)
return (priv);
return (priv+pub);
}
#endif
#ifdef _UNUSED_API_
static int
dst_s_write_private_key(const DST_KEY *key)
{
u_char encoded_block[RAW_KEY_SIZE];
char file[PATH_MAX];
int len;
FILE *fp;
if (key == NULL)
return (-1);
if (key->dk_KEY_struct == NULL)
return (0);
if (key->dk_func == NULL || key->dk_func->to_file_fmt == NULL) {
EREPORT(("dst_write_private_key(): Unsupported operation %d\n",
key->dk_alg));
return (-5);
} else if ((len = key->dk_func->to_file_fmt(key, (char *)encoded_block,
sizeof(encoded_block))) <= 0) {
EREPORT(("dst_write_private_key(): Failed encoding private RSA bsafe key %d\n", len));
return (-8);
}
dst_s_build_filename(file, key->dk_key_name, key->dk_id, key->dk_alg,
PRIVATE_KEY, PATH_MAX);
if ((fp = dst_s_fopen(file, "w", 0600)) != NULL) {
int nn;
if ((nn = fwrite(encoded_block, 1, len, fp)) != len) {
EREPORT(("dst_write_private_key(): Write failure on %s %d != %d errno=%d\n",
file, len, nn, errno));
return (-5);
}
fclose(fp);
} else {
EREPORT(("dst_write_private_key(): Can not create file %s\n"
,file));
return (-6);
}
memset(encoded_block, 0, len);
return (len);
}
#endif
#ifdef _UNUSED_API_
static DST_KEY *
dst_s_read_public_key(const char *in_name, const u_int16_t in_id, int in_alg)
{
int flags, proto, alg, len, dlen;
int c;
char name[PATH_MAX], enckey[RAW_KEY_SIZE], *notspace;
u_char deckey[RAW_KEY_SIZE];
FILE *fp;
if (in_name == NULL) {
EREPORT(("dst_read_public_key(): No key name given\n"));
return (NULL);
}
if (dst_s_build_filename(name, in_name, in_id, in_alg, PUBLIC_KEY,
PATH_MAX) == -1) {
EREPORT(("dst_read_public_key(): Cannot make filename from %s, %d, and %s\n",
in_name, in_id, PUBLIC_KEY));
return (NULL);
}
if ((fp = dst_s_fopen(name, "r", 0)) == NULL) {
EREPORT(("dst_read_public_key(): Public Key not found %s\n",
name));
return (NULL);
}
while ((c = getc(fp)) != EOF)
if (isspace(c))
break;
while ((c = getc(fp)) != EOF)
if (!isspace(c))
break;
if (isdigit(c)) {
while ((c = getc(fp)) != EOF)
if (isspace(c))
break;
while ((c = getc(fp)) != EOF)
if (!isspace(c))
break;
}
if (c == 'I' || c == 'i') {
while ((c = getc(fp)) != EOF)
if (isspace(c))
break;
while ((c = getc(fp)) != EOF)
if (!isspace(c))
break;
}
if (c != 'K' && c != 'k') {
EREPORT(("\"KEY\" doesn't appear in file: %s", name));
return NULL;
}
while ((c = getc(fp)) != EOF)
if (isspace(c))
break;
while ((c = getc(fp)) != EOF)
if (!isspace(c))
break;
ungetc(c, fp);
if (fscanf(fp, "%d %d %d", &flags, &proto, &alg) != 3) {
EREPORT(("dst_read_public_key(): Can not read flag/proto/alg field from %s\n"
,name));
return (NULL);
}
fgets(enckey, sizeof(enckey), fp);
while ((c = getc(fp)) != EOF)
if (!isspace(c))
break;
if (!feof(fp)) {
EREPORT(("Key too long in file: %s", name));
return NULL;
}
fclose(fp);
if ((len = strlen(enckey)) <= 0)
return (NULL);
enckey[--len] = '\0';
for (notspace = (char *) enckey; isspace((*notspace)&0xff); len--)
notspace++;
dlen = b64_pton(notspace, deckey, sizeof(deckey));
if (dlen < 0) {
EREPORT(("dst_read_public_key: bad return from b64_pton = %d",
dlen));
return (NULL);
}
return dst_buffer_to_key(in_name, alg, flags, proto, deckey, dlen);
}
#endif
#ifdef _UNUSED_API_
static int
dst_s_write_public_key(const DST_KEY *key)
{
FILE *fp;
char filename[PATH_MAX];
u_char out_key[RAW_KEY_SIZE];
char enc_key[RAW_KEY_SIZE];
int len = 0;
int mode;
memset(out_key, 0, sizeof(out_key));
if (key == NULL) {
EREPORT(("dst_write_public_key(): No key specified \n"));
return (0);
} else if ((len = dst_key_to_dnskey(key, out_key, sizeof(out_key)))< 0)
return (0);
if (dst_s_build_filename(filename, key->dk_key_name, key->dk_id,
key->dk_alg, PUBLIC_KEY, PATH_MAX) == -1) {
EREPORT(("dst_write_public_key(): Cannot make filename from %s, %d, and %s\n",
key->dk_key_name, key->dk_id, PUBLIC_KEY));
return (0);
}
mode = (key->dk_alg == KEY_HMAC_MD5) ? 0600 : 0644;
if ((fp = dst_s_fopen(filename, "w+", mode)) == NULL) {
EREPORT(("DST_write_public_key: open of file:%s failed (errno=%d)\n",
filename, errno));
return (0);
}
if (key->dk_flags & DST_EXTEND_FLAG)
b64_ntop(&out_key[6], len - 6, enc_key, sizeof(enc_key));
else
b64_ntop(&out_key[4], len - 4, enc_key, sizeof(enc_key));
fprintf(fp, "%s IN KEY %d %d %d %s\n",
key->dk_key_name,
key->dk_flags, key->dk_proto, key->dk_alg, enc_key);
fclose(fp);
return (1);
}
#endif
#ifdef _UNUSED_API_
DST_KEY *
dst_dnskey_to_key(const char *in_name, const u_char *rdata, const int len)
{
DST_KEY *key_st;
int alg ;
int start = DST_KEY_START;
if (rdata == NULL || len <= DST_KEY_ALG)
return (NULL);
alg = (u_int8_t) rdata[DST_KEY_ALG];
if (!dst_check_algorithm(alg)) {
EREPORT(("dst_dnskey_to_key(): Algorithm %d not suppored\n",
alg));
return (NULL);
}
if ((key_st = dst_s_get_key_struct(in_name, alg, 0, 0, 0)) == NULL)
return (NULL);
if (in_name == NULL)
return (NULL);
key_st->dk_id = dst_s_dns_key_id(rdata, len);
key_st->dk_flags = dst_s_get_int16(rdata);
key_st->dk_proto = (u_int16_t) rdata[DST_KEY_PROT];
if (key_st->dk_flags & DST_EXTEND_FLAG) {
u_int32_t ext_flags;
ext_flags = (u_int32_t) dst_s_get_int16(&rdata[DST_EXT_FLAG]);
key_st->dk_flags = key_st->dk_flags | (ext_flags << 16);
start += 2;
}
if (key_st->dk_func && key_st->dk_func->from_dns_key) {
if (key_st->dk_func->from_dns_key(key_st, &rdata[start],
len - start) > 0)
return (key_st);
} else
EREPORT(("dst_dnskey_to_public_key(): unsuppored alg %d\n",
alg));
SAFE_FREE(key_st);
return (key_st);
}
#endif
#ifdef __APPLE__
static
#endif
int
dst_key_to_dnskey(const DST_KEY *key, u_char *out_storage,
const int out_len)
{
u_int16_t val;
int loc = 0;
int enc_len = 0;
if (key == NULL)
return (-1);
if (!dst_check_algorithm(key->dk_alg)) {
EREPORT(("dst_key_to_dnskey(): Algorithm %d not suppored\n",
key->dk_alg));
return (UNSUPPORTED_KEYALG);
}
memset(out_storage, 0, out_len);
val = (u_int16_t)(key->dk_flags & 0xffff);
dst_s_put_int16(out_storage, val);
loc += 2;
out_storage[loc++] = (u_char) key->dk_proto;
out_storage[loc++] = (u_char) key->dk_alg;
if (key->dk_flags > 0xffff) {
val = (u_int16_t)((key->dk_flags >> 16) & 0xffff);
dst_s_put_int16(&out_storage[loc], val);
loc += 2;
}
if (key->dk_KEY_struct == NULL)
return (loc);
if (key->dk_func && key->dk_func->to_dns_key) {
enc_len = key->dk_func->to_dns_key(key,
(u_char *) &out_storage[loc],
out_len - loc);
if (enc_len > 0)
return (enc_len + loc);
else
return (-1);
} else
EREPORT(("dst_key_to_dnskey(): Unsupported ALG %d\n",
key->dk_alg));
return (-1);
}
DST_KEY *
dst_buffer_to_key(const char *key_name,
const int alg,
const int flags,
const int protocol,
const u_char *key_buf,
const int key_len)
{
DST_KEY *dkey = NULL;
int dnslen;
u_char dns[2048];
if (!dst_check_algorithm(alg)) {
EREPORT(("dst_buffer_to_key(): Algorithm %d not suppored\n", alg));
return (NULL);
}
dkey = dst_s_get_key_struct(key_name, alg, flags,
protocol, -1);
if (dkey == NULL)
return (NULL);
if (dkey->dk_func == NULL || dkey->dk_func->from_dns_key == NULL)
return NULL;
if (dkey->dk_func->from_dns_key(dkey, key_buf, key_len) < 0) {
EREPORT(("dst_buffer_to_key(): dst_buffer_to_hmac failed\n"));
return (dst_free_key(dkey));
}
dnslen = dst_key_to_dnskey(dkey, dns, sizeof(dns));
dkey->dk_id = dst_s_dns_key_id(dns, dnslen);
return (dkey);
}
#ifdef _UNUSED_API_
int
dst_key_to_buffer(DST_KEY *key, u_char *out_buff, int buf_len)
{
int len;
if (key == NULL)
return (0);
if (key->dk_func != NULL && key->dk_func->to_dns_key != NULL) {
len = key->dk_func->to_dns_key(key, out_buff, buf_len);
if (len < 0)
return (0);
return (len);
}
return (0);
}
#endif
#ifdef _UNUSED_API_
static int
dst_s_read_private_key_file(char *name, DST_KEY *pk_key, u_int16_t in_id,
int in_alg)
{
int cnt, alg, len, major, minor, file_major, file_minor;
int ret, id;
char filename[PATH_MAX];
u_char in_buff[RAW_KEY_SIZE], *p;
FILE *fp;
int dnslen;
u_char dns[2048];
if (name == NULL || pk_key == NULL) {
EREPORT(("dst_read_private_key_file(): No key name given\n"));
return (0);
}
if (dst_s_build_filename(filename, name, in_id, in_alg, PRIVATE_KEY,
PATH_MAX) == -1) {
EREPORT(("dst_read_private_key(): Cannot make filename from %s, %d, and %s\n",
name, in_id, PRIVATE_KEY));
return (0);
}
if ((fp = dst_s_fopen(filename, "r", 0)) == NULL) {
EREPORT(("dst_s_read_private_key_file: Could not open file %s in directory %s\n",
filename, dst_path[0] ? dst_path :
(char *) getcwd(NULL, PATH_MAX - 1)));
return (0);
}
if ((cnt = fread(in_buff, 1, sizeof(in_buff), fp)) < 5) {
fclose(fp);
EREPORT(("dst_s_read_private_key_file: error reading file %s (empty file)\n",
filename));
return (0);
}
fclose(fp);
if (memcmp(in_buff, "Private-key-format: v", 20) != 0)
goto fail;
len = cnt;
p = in_buff;
if (!dst_s_verify_str((const char **) &p, "Private-key-format: v")) {
EREPORT(("dst_s_read_private_key_file(): Not a Key file/Decrypt failed %s\n", name));
goto fail;
}
sscanf((char *)p, "%d.%d", &file_major, &file_minor);
sscanf(KEY_FILE_FORMAT, "%d.%d", &major, &minor);
if (file_major < 1) {
EREPORT(("dst_s_read_private_key_file(): Unknown keyfile %d.%d version for %s\n",
file_major, file_minor, name));
goto fail;
} else if (file_major > major || file_minor > minor)
EREPORT((
"dst_s_read_private_key_file(): Keyfile %s version higher than mine %d.%d MAY FAIL\n",
name, file_major, file_minor));
while (*p++ != '\n') ;
if (!dst_s_verify_str((const char **) &p, "Algorithm: "))
goto fail;
if (sscanf((char *)p, "%d", &alg) != 1)
goto fail;
while (*p++ != '\n') ;
if (pk_key->dk_key_name && !strcmp(pk_key->dk_key_name, name))
SAFE_FREE2(pk_key->dk_key_name, strlen(pk_key->dk_key_name));
pk_key->dk_key_name = (char *) strdup(name);
if (pk_key->dk_func == NULL || pk_key->dk_func->from_file_fmt == NULL)
goto fail;
ret = pk_key->dk_func->from_file_fmt(pk_key, (char *)p, &in_buff[len] - p);
if (ret < 0)
goto fail;
dnslen = dst_key_to_dnskey(pk_key, dns, sizeof(dns));
id = dst_s_dns_key_id(dns, dnslen);
if (id != in_id) {
EREPORT(("dst_s_read_private_key_file(): actual tag of key read %d != input tag used to build filename %d.\n", id, in_id));
goto fail;
}
pk_key->dk_id = (u_int16_t) id;
pk_key->dk_alg = alg;
memset(in_buff, 0, cnt);
return (1);
fail:
memset(in_buff, 0, cnt);
return (0);
}
#endif
#ifdef _UNUSED_API_
DST_KEY *
dst_generate_key(const char *name, const int bits, const int exp,
const int flags, const int protocol, const int alg)
{
DST_KEY *new_key = NULL;
int res;
int dnslen;
u_char dns[2048];
if (name == NULL)
return (NULL);
if (!dst_check_algorithm(alg)) {
EREPORT(("dst_generate_key(): Algorithm %d not suppored\n", alg));
return (NULL);
}
new_key = dst_s_get_key_struct(name, alg, flags, protocol, bits);
if (new_key == NULL)
return (NULL);
if (bits == 0)
return (new_key);
if (new_key->dk_func == NULL || new_key->dk_func->generate == NULL) {
EREPORT(("dst_generate_key_pair():Unsupported algorithm %d\n",
alg));
return (dst_free_key(new_key));
}
if ((res = new_key->dk_func->generate(new_key, exp)) <= 0) {
EREPORT(("dst_generate_key_pair(): Key generation failure %s %d %d %d\n",
new_key->dk_key_name, new_key->dk_alg,
new_key->dk_key_size, exp));
return (dst_free_key(new_key));
}
dnslen = dst_key_to_dnskey(new_key, dns, sizeof(dns));
if (dnslen != UNSUPPORTED_KEYALG)
new_key->dk_id = dst_s_dns_key_id(dns, dnslen);
else
new_key->dk_id = 0;
return (new_key);
}
#endif
DST_KEY *
dst_free_key(DST_KEY *f_key)
{
if (f_key == NULL)
return (f_key);
if (f_key->dk_func && f_key->dk_func->destroy)
f_key->dk_KEY_struct =
f_key->dk_func->destroy(f_key->dk_KEY_struct);
else {
EREPORT(("dst_free_key(): Unknown key alg %d\n",
f_key->dk_alg));
free(f_key->dk_KEY_struct);
}
if (f_key->dk_KEY_struct) {
free(f_key->dk_KEY_struct);
f_key->dk_KEY_struct = NULL;
}
if (f_key->dk_key_name)
SAFE_FREE(f_key->dk_key_name);
SAFE_FREE(f_key);
return (NULL);
}
#ifdef _UNUSED_API_
int
dst_sig_size(DST_KEY *key) {
switch (key->dk_alg) {
case KEY_HMAC_MD5:
return (16);
case KEY_HMAC_SHA1:
return (20);
case KEY_RSA:
return (key->dk_key_size + 7) / 8;
case KEY_DSA:
return (40);
default:
EREPORT(("dst_sig_size(): Unknown key alg %d\n", key->dk_alg));
return -1;
}
}
#endif