dnssec.c revision 1.17
1/* $OpenBSD: dnssec.c,v 1.17 2003/11/06 16:12:07 ho Exp $ */ 2 3/* 4 * Copyright (c) 2001 H�kan Olsson. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 25 */ 26 27#include <sys/types.h> 28#include <netinet/in.h> 29#include <arpa/nameser.h> 30#include <arpa/inet.h> 31#include <stdlib.h> 32 33#include <openssl/rsa.h> 34 35#ifdef LWRES 36#include <lwres/netdb.h> 37#include <dns/keyvalues.h> 38#else 39#include <netdb.h> 40#endif 41 42#include "sysdep.h" 43 44#include "dnssec.h" 45#include "exchange.h" 46#include "ipsec_num.h" 47#include "libcrypto.h" 48#include "log.h" 49#include "message.h" 50#include "transport.h" 51#include "util.h" 52 53#ifndef DNS_UFQDN_SEPARATOR 54#define DNS_UFQDN_SEPARATOR "._ipsec." 55#endif 56 57/* adapted from <dns/rdatastruct.h> / RFC 2535 */ 58struct dns_rdata_key { 59 u_int16_t flags; 60 u_int8_t protocol; 61 u_int8_t algorithm; 62 u_int16_t datalen; 63 unsigned char *data; 64}; 65 66void * 67dns_get_key (int type, struct message *msg, int *keylen) 68{ 69 struct exchange *exchange = msg->exchange; 70 struct rrsetinfo *rr; 71 struct dns_rdata_key key_rr; 72 char name[MAXHOSTNAMELEN]; 73 in_addr_t ip4; 74 u_int8_t algorithm; 75 u_int8_t *id, *umark; 76 size_t id_len; 77 int ret, i; 78 79 switch (type) 80 { 81 case IKE_AUTH_RSA_SIG: 82 algorithm = DNS_KEYALG_RSA; 83 break; 84 85 case IKE_AUTH_RSA_ENC: 86 case IKE_AUTH_RSA_ENC_REV: 87 /* XXX Not yet. */ 88 /* algorithm = DNS_KEYALG_RSA; */ 89 return 0; 90 91 case IKE_AUTH_DSS: 92 /* XXX Not yet. */ 93 /* algorithm = DNS_KEYALG_DSS; */ 94 return 0; 95 96 case IKE_AUTH_PRE_SHARED: 97 default: 98 return 0; 99 } 100 101 id = exchange->initiator ? exchange->id_r : exchange->id_i; 102 id_len = exchange->initiator ? exchange->id_r_len : exchange->id_i_len; 103 memset (name, 0, sizeof name); 104 105 if (!id || id_len == 0) 106 { 107 log_print ("dns_get_key: ID is missing"); 108 return 0; 109 } 110 111 /* Exchanges (and SAs) don't carry the ID in ISAKMP form */ 112 id -= ISAKMP_GEN_SZ; 113 id_len += ISAKMP_GEN_SZ - ISAKMP_ID_DATA_OFF; 114 115 switch (GET_ISAKMP_ID_TYPE (id)) 116 { 117 case IPSEC_ID_IPV4_ADDR: 118 /* We want to lookup a KEY RR in the reverse zone. */ 119 if (id_len < sizeof ip4) 120 return 0; 121 memcpy (&ip4, id + ISAKMP_ID_DATA_OFF, sizeof ip4); 122 snprintf (name, sizeof name, "%d.%d.%d.%d.in-addr.arpa.", ip4 >> 24, 123 (ip4 >> 16) & 0xFF, (ip4 >> 8) & 0xFF, ip4 & 0xFF); 124 break; 125 126 case IPSEC_ID_IPV6_ADDR: 127 /* XXX Not yet. */ 128 return 0; 129 break; 130 131 case IPSEC_ID_FQDN: 132 if ((id_len + 1) >= sizeof name) 133 return 0; 134 /* ID is not NULL-terminated. Add trailing dot and terminate. */ 135 memcpy (name, id + ISAKMP_ID_DATA_OFF, id_len); 136 *(name + id_len) = '.'; 137 *(name + id_len + 1) = '\0'; 138 break; 139 140 case IPSEC_ID_USER_FQDN: 141 /* 142 * Some special handling here. We want to convert the ID 143 * 'user@host.domain' string into 'user._ipsec.host.domain.'. 144 */ 145 if ((id_len + sizeof (DNS_UFQDN_SEPARATOR)) >= sizeof name) 146 return 0; 147 /* Look for the '@' separator. */ 148 for (umark = id + ISAKMP_ID_DATA_OFF; (umark - id) < id_len; umark++) 149 if (*umark == '@') 150 break; 151 if (*umark != '@') 152 { 153 LOG_DBG ((LOG_MISC, 50, "dns_get_key: bad UFQDN ID")); 154 return 0; 155 } 156 *umark++ = '\0'; 157 /* id is now terminated. 'umark', however, is not. */ 158 snprintf (name, sizeof name, "%s%s", id + ISAKMP_ID_DATA_OFF, 159 DNS_UFQDN_SEPARATOR); 160 memcpy (name + strlen (name), umark, id_len - strlen (id) - 1); 161 *(name + id_len + sizeof (DNS_UFQDN_SEPARATOR) - 2) = '.'; 162 *(name + id_len + sizeof (DNS_UFQDN_SEPARATOR) - 1) = '\0'; 163 break; 164 165 default: 166 return 0; 167 } 168 169 LOG_DBG ((LOG_MISC, 50, "dns_get_key: trying KEY RR for %s", name)); 170 ret = getrrsetbyname (name, C_IN, T_KEY, 0, &rr); 171 172 if (ret) 173 { 174 LOG_DBG ((LOG_MISC, 30, "dns_get_key: no DNS responses (error %d)", 175 ret)); 176 return 0; 177 } 178 179 LOG_DBG ((LOG_MISC, 80, 180 "dns_get_key: rrset class %d type %d ttl %d nrdatas %d nrsigs %d", 181 rr->rri_rdclass, rr->rri_rdtype, rr->rri_ttl, rr->rri_nrdatas, 182 rr->rri_nsigs)); 183 184 /* We don't accept unvalidated data. */ 185 if (!(rr->rri_flags & RRSET_VALIDATED)) 186 { 187 LOG_DBG ((LOG_MISC, 10, "dns_get_key: got unvalidated response")); 188 freerrset (rr); 189 return 0; 190 } 191 192 /* Sanity. */ 193 if (rr->rri_nrdatas == 0 || rr->rri_rdtype != T_KEY) 194 { 195 LOG_DBG ((LOG_MISC, 30, "dns_get_key: no KEY RRs received")); 196 freerrset (rr); 197 return 0; 198 } 199 200 memset (&key_rr, 0, sizeof key_rr); 201 202 /* 203 * Find a key with the wanted algorithm, if any. 204 * XXX If there are several keys present, we currently only find the first. 205 */ 206 for (i = 0; i < rr->rri_nrdatas && key_rr.datalen == 0; i++) 207 { 208 key_rr.flags = ntohs ((u_int16_t) *rr->rri_rdatas[i].rdi_data); 209 key_rr.protocol = *(rr->rri_rdatas[i].rdi_data + 2); 210 key_rr.algorithm = *(rr->rri_rdatas[i].rdi_data + 3); 211 212 if (key_rr.protocol != DNS_KEYPROTO_IPSEC) 213 { 214 LOG_DBG ((LOG_MISC, 50, "dns_get_key: ignored non-IPsec key")); 215 continue; 216 } 217 218 if (key_rr.algorithm != algorithm) 219 { 220 LOG_DBG ((LOG_MISC, 50, "dns_get_key: ignored key with other alg")); 221 continue; 222 } 223 224 key_rr.datalen = rr->rri_rdatas[i].rdi_length - 4; 225 if (key_rr.datalen <= 0) 226 { 227 LOG_DBG ((LOG_MISC, 50, "dns_get_key: ignored bad key")); 228 key_rr.datalen = 0; 229 continue; 230 } 231 232 /* This key seems to fit our requirements... */ 233 key_rr.data = (char *)malloc (key_rr.datalen); 234 if (!key_rr.data) 235 { 236 log_error ("dns_get_key: malloc (%d) failed", key_rr.datalen); 237 freerrset (rr); 238 return 0; 239 } 240 memcpy (key_rr.data, rr->rri_rdatas[i].rdi_data + 4, key_rr.datalen); 241 *keylen = key_rr.datalen; 242 } 243 244 freerrset (rr); 245 246 if (key_rr.datalen) 247 return key_rr.data; 248 else 249 return 0; 250} 251 252int 253dns_RSA_dns_to_x509 (u_int8_t *key, int keylen, RSA **rsa_key) 254{ 255 RSA *rsa; 256 int key_offset; 257 u_int8_t e_len; 258 259 if (!key || keylen <= 0) 260 { 261 log_print ("dns_RSA_dns_to_x509: invalid public key"); 262 return -1; 263 } 264 265 rsa = RSA_new (); 266 if (rsa == NULL) 267 { 268 log_error ("dns_RSA_dns_to_x509: failed to allocate new RSA struct"); 269 return -1; 270 } 271 272 e_len = *key; 273 key_offset = 1; 274 275 if (e_len == 0) 276 { 277 if (keylen < 3) 278 { 279 log_print ("dns_RSA_dns_to_x509: invalid public key"); 280 RSA_free (rsa); 281 return -1; 282 } 283 e_len = *(key + key_offset++) << 8; 284 e_len += *(key + key_offset++); 285 } 286 287 if (e_len > (keylen - key_offset)) 288 { 289 log_print ("dns_RSA_dns_to_x509: invalid public key"); 290 RSA_free (rsa); 291 return -1; 292 } 293 294 rsa->e = BN_bin2bn (key + key_offset, e_len, NULL); 295 key_offset += e_len; 296 297 /* XXX if (keylen <= key_offset) -> "invalid public key" ? */ 298 299 rsa->n = BN_bin2bn (key + key_offset, keylen - key_offset, NULL); 300 301 *rsa_key = rsa; 302 303 LOG_DBG ((LOG_MISC, 30, "dns_RSA_dns_to_x509: got %d bits RSA key", 304 BN_num_bits (rsa->n))); 305 306 return 0; 307} 308 309#if notyet 310int 311dns_RSA_x509_to_dns (RSA *rsa_key, u_int8_t *key, int *keylen) 312{ 313 return 0; 314} 315#endif 316