1*e6e30c83Schristos /* $NetBSD: dst_api.c,v 1.1.1.2 2012/09/09 16:07:47 christos Exp $ */
2b5677b36Schristos
3b5677b36Schristos #ifndef LINT
4b5677b36Schristos static const char rcsid[] = "Header: /proj/cvs/prod/libbind/dst/dst_api.c,v 1.17 2007/09/24 17:18:25 each Exp ";
5b5677b36Schristos #endif
6b5677b36Schristos
7b5677b36Schristos /*
8b5677b36Schristos * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
9b5677b36Schristos *
10b5677b36Schristos * Permission to use, copy modify, and distribute this software for any
11b5677b36Schristos * purpose with or without fee is hereby granted, provided that the above
12b5677b36Schristos * copyright notice and this permission notice appear in all copies.
13b5677b36Schristos *
14b5677b36Schristos * THE SOFTWARE IS PROVIDED "AS IS" AND TRUSTED INFORMATION SYSTEMS
15b5677b36Schristos * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
16b5677b36Schristos * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
17b5677b36Schristos * TRUSTED INFORMATION SYSTEMS BE LIABLE FOR ANY SPECIAL, DIRECT,
18b5677b36Schristos * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
19b5677b36Schristos * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
20b5677b36Schristos * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
21b5677b36Schristos * WITH THE USE OR PERFORMANCE OF THE SOFTWARE.
22b5677b36Schristos */
23b5677b36Schristos /*
24b5677b36Schristos * This file contains the interface between the DST API and the crypto API.
25b5677b36Schristos * This is the only file that needs to be changed if the crypto system is
26b5677b36Schristos * changed. Exported functions are:
27b5677b36Schristos * void dst_init() Initialize the toolkit
28b5677b36Schristos * int dst_check_algorithm() Function to determines if alg is suppored.
29b5677b36Schristos * int dst_compare_keys() Function to compare two keys for equality.
30b5677b36Schristos * int dst_sign_data() Incremental signing routine.
31b5677b36Schristos * int dst_verify_data() Incremental verify routine.
32b5677b36Schristos * int dst_generate_key() Function to generate new KEY
33b5677b36Schristos * DST_KEY *dst_read_key() Function to retrieve private/public KEY.
34b5677b36Schristos * void dst_write_key() Function to write out a key.
35b5677b36Schristos * DST_KEY *dst_dnskey_to_key() Function to convert DNS KEY RR to a DST
36b5677b36Schristos * KEY structure.
37b5677b36Schristos * int dst_key_to_dnskey() Function to return a public key in DNS
38b5677b36Schristos * format binary
39b5677b36Schristos * DST_KEY *dst_buffer_to_key() Converst a data in buffer to KEY
40b5677b36Schristos * int *dst_key_to_buffer() Writes out DST_KEY key matterial in buffer
41b5677b36Schristos * void dst_free_key() Releases all memory referenced by key structure
42b5677b36Schristos */
43b5677b36Schristos
44b5677b36Schristos #include "port_before.h"
45b5677b36Schristos #include <stdio.h>
46b5677b36Schristos #include <errno.h>
47b5677b36Schristos #include <fcntl.h>
48b5677b36Schristos #include <stdlib.h>
49b5677b36Schristos #include <unistd.h>
50b5677b36Schristos #include <string.h>
51b5677b36Schristos #include <memory.h>
52b5677b36Schristos #include <ctype.h>
53b5677b36Schristos #include <time.h>
54b5677b36Schristos #include <sys/param.h>
55b5677b36Schristos #include <sys/stat.h>
56b5677b36Schristos #include <sys/socket.h>
57b5677b36Schristos #include <netinet/in.h>
58b5677b36Schristos #include <arpa/nameser.h>
59b5677b36Schristos #include <resolv.h>
60b5677b36Schristos
61b5677b36Schristos #include "dst_internal.h"
62b5677b36Schristos #include "port_after.h"
63b5677b36Schristos
64b5677b36Schristos /* static variables */
65b5677b36Schristos static int done_init = 0;
66b5677b36Schristos dst_func *dst_t_func[DST_MAX_ALGS];
67b5677b36Schristos const char *key_file_fmt_str = "Private-key-format: v%s\nAlgorithm: %d (%s)\n";
68b5677b36Schristos const char *dst_path = "";
69b5677b36Schristos
70b5677b36Schristos /* internal I/O functions */
71b5677b36Schristos static DST_KEY *dst_s_read_public_key(const char *in_name,
72b5677b36Schristos const u_int16_t in_id, int in_alg);
73b5677b36Schristos static int dst_s_read_private_key_file(char *name, DST_KEY *pk_key,
74b5677b36Schristos u_int16_t in_id, int in_alg);
75b5677b36Schristos static int dst_s_write_public_key(const DST_KEY *key);
76b5677b36Schristos static int dst_s_write_private_key(const DST_KEY *key);
77b5677b36Schristos
78b5677b36Schristos /* internal function to set up data structure */
79b5677b36Schristos static DST_KEY *dst_s_get_key_struct(const char *name, const int alg,
80b5677b36Schristos const int flags, const int protocol,
81b5677b36Schristos const int bits);
82b5677b36Schristos
83b5677b36Schristos /*%
84b5677b36Schristos * dst_init
85b5677b36Schristos * This function initializes the Digital Signature Toolkit.
86b5677b36Schristos * Right now, it just checks the DSTKEYPATH environment variable.
87b5677b36Schristos * Parameters
88b5677b36Schristos * none
89b5677b36Schristos * Returns
90b5677b36Schristos * none
91b5677b36Schristos */
92b5677b36Schristos void
dst_init()93b5677b36Schristos dst_init()
94b5677b36Schristos {
95b5677b36Schristos char *s;
96b5677b36Schristos int len;
97b5677b36Schristos
98b5677b36Schristos if (done_init != 0)
99b5677b36Schristos return;
100b5677b36Schristos done_init = 1;
101b5677b36Schristos
102b5677b36Schristos s = getenv("DSTKEYPATH");
103b5677b36Schristos len = 0;
104b5677b36Schristos if (s) {
105b5677b36Schristos struct stat statbuf;
106b5677b36Schristos
107b5677b36Schristos len = strlen(s);
108b5677b36Schristos if (len > PATH_MAX) {
109b5677b36Schristos EREPORT(("%s is longer than %d characters, ignoring\n",
110b5677b36Schristos s, PATH_MAX));
111b5677b36Schristos } else if (stat(s, &statbuf) != 0 || !S_ISDIR(statbuf.st_mode)) {
112b5677b36Schristos EREPORT(("%s is not a valid directory\n", s));
113b5677b36Schristos } else {
114b5677b36Schristos char *tmp;
115b5677b36Schristos tmp = (char *) malloc(len + 2);
116b5677b36Schristos memcpy(tmp, s, len + 1);
117b5677b36Schristos if (tmp[strlen(tmp) - 1] != '/') {
118b5677b36Schristos tmp[strlen(tmp) + 1] = 0;
119b5677b36Schristos tmp[strlen(tmp)] = '/';
120b5677b36Schristos }
121b5677b36Schristos dst_path = tmp;
122b5677b36Schristos }
123b5677b36Schristos }
124b5677b36Schristos memset(dst_t_func, 0, sizeof(dst_t_func));
125b5677b36Schristos /* first one is selected */
126b5677b36Schristos dst_hmac_md5_init();
127b5677b36Schristos }
128b5677b36Schristos
129b5677b36Schristos /*%
130b5677b36Schristos * dst_check_algorithm
131b5677b36Schristos * This function determines if the crypto system for the specified
132b5677b36Schristos * algorithm is present.
133b5677b36Schristos * Parameters
134b5677b36Schristos * alg 1 KEY_RSA
135b5677b36Schristos * 3 KEY_DSA
136b5677b36Schristos * 157 KEY_HMAC_MD5
137b5677b36Schristos * future algorithms TBD and registered with IANA.
138b5677b36Schristos * Returns
139b5677b36Schristos * 1 - The algorithm is available.
140b5677b36Schristos * 0 - The algorithm is not available.
141b5677b36Schristos */
142b5677b36Schristos int
dst_check_algorithm(const int alg)143b5677b36Schristos dst_check_algorithm(const int alg)
144b5677b36Schristos {
145b5677b36Schristos return (dst_t_func[alg] != NULL);
146b5677b36Schristos }
147b5677b36Schristos
148b5677b36Schristos /*%
149b5677b36Schristos * dst_s_get_key_struct
150b5677b36Schristos * This function allocates key structure and fills in some of the
151b5677b36Schristos * fields of the structure.
152b5677b36Schristos * Parameters:
153b5677b36Schristos * name: the name of the key
154b5677b36Schristos * alg: the algorithm number
155b5677b36Schristos * flags: the dns flags of the key
156b5677b36Schristos * protocol: the dns protocol of the key
157b5677b36Schristos * bits: the size of the key
158b5677b36Schristos * Returns:
159b5677b36Schristos * NULL if error
160b5677b36Schristos * valid pointer otherwise
161b5677b36Schristos */
162b5677b36Schristos static DST_KEY *
dst_s_get_key_struct(const char * name,const int alg,const int flags,const int protocol,const int bits)163b5677b36Schristos dst_s_get_key_struct(const char *name, const int alg, const int flags,
164b5677b36Schristos const int protocol, const int bits)
165b5677b36Schristos {
166b5677b36Schristos DST_KEY *new_key = NULL;
167b5677b36Schristos
168b5677b36Schristos if (dst_check_algorithm(alg)) /*%< make sure alg is available */
169b5677b36Schristos new_key = (DST_KEY *) malloc(sizeof(*new_key));
170b5677b36Schristos if (new_key == NULL)
171b5677b36Schristos return (NULL);
172b5677b36Schristos
173b5677b36Schristos memset(new_key, 0, sizeof(*new_key));
174b5677b36Schristos new_key->dk_key_name = strdup(name);
175b5677b36Schristos if (new_key->dk_key_name == NULL) {
176b5677b36Schristos free(new_key);
177b5677b36Schristos return (NULL);
178b5677b36Schristos }
179b5677b36Schristos new_key->dk_alg = alg;
180b5677b36Schristos new_key->dk_flags = flags;
181b5677b36Schristos new_key->dk_proto = protocol;
182b5677b36Schristos new_key->dk_KEY_struct = NULL;
183b5677b36Schristos new_key->dk_key_size = bits;
184b5677b36Schristos new_key->dk_func = dst_t_func[alg];
185b5677b36Schristos return (new_key);
186b5677b36Schristos }
187b5677b36Schristos
188b5677b36Schristos /*%
189b5677b36Schristos * dst_compare_keys
190b5677b36Schristos * Compares two keys for equality.
191b5677b36Schristos * Parameters
192b5677b36Schristos * key1, key2 Two keys to be compared.
193b5677b36Schristos * Returns
194b5677b36Schristos * 0 The keys are equal.
195b5677b36Schristos * non-zero The keys are not equal.
196b5677b36Schristos */
197b5677b36Schristos
198b5677b36Schristos int
dst_compare_keys(const DST_KEY * key1,const DST_KEY * key2)199b5677b36Schristos dst_compare_keys(const DST_KEY *key1, const DST_KEY *key2)
200b5677b36Schristos {
201b5677b36Schristos if (key1 == key2)
202b5677b36Schristos return (0);
203b5677b36Schristos if (key1 == NULL || key2 == NULL)
204b5677b36Schristos return (4);
205b5677b36Schristos if (key1->dk_alg != key2->dk_alg)
206b5677b36Schristos return (1);
207b5677b36Schristos if (key1->dk_key_size != key2->dk_key_size)
208b5677b36Schristos return (2);
209b5677b36Schristos if (key1->dk_id != key2->dk_id)
210b5677b36Schristos return (3);
211b5677b36Schristos return (key1->dk_func->compare(key1, key2));
212b5677b36Schristos }
213b5677b36Schristos
214b5677b36Schristos /*%
215b5677b36Schristos * dst_sign_data
216b5677b36Schristos * An incremental signing function. Data is signed in steps.
217b5677b36Schristos * First the context must be initialized (SIG_MODE_INIT).
218b5677b36Schristos * Then data is hashed (SIG_MODE_UPDATE). Finally the signature
219b5677b36Schristos * itself is created (SIG_MODE_FINAL). This function can be called
220b5677b36Schristos * once with INIT, UPDATE and FINAL modes all set, or it can be
221b5677b36Schristos * called separately with a different mode set for each step. The
222b5677b36Schristos * UPDATE step can be repeated.
223b5677b36Schristos * Parameters
224b5677b36Schristos * mode A bit mask used to specify operation(s) to be performed.
225b5677b36Schristos * SIG_MODE_INIT 1 Initialize digest
226b5677b36Schristos * SIG_MODE_UPDATE 2 Add data to digest
227b5677b36Schristos * SIG_MODE_FINAL 4 Generate signature
228b5677b36Schristos * from signature
229b5677b36Schristos * SIG_MODE_ALL (SIG_MODE_INIT,SIG_MODE_UPDATE,SIG_MODE_FINAL
230b5677b36Schristos * data Data to be signed.
231b5677b36Schristos * len The length in bytes of data to be signed.
232b5677b36Schristos * in_key Contains a private key to sign with.
233b5677b36Schristos * KEY structures should be handled (created, converted,
234b5677b36Schristos * compared, stored, freed) by the DST.
235b5677b36Schristos * signature
236b5677b36Schristos * The location to which the signature will be written.
237b5677b36Schristos * sig_len Length of the signature field in bytes.
238b5677b36Schristos * Return
239b5677b36Schristos * 0 Successfull INIT or Update operation
240b5677b36Schristos * >0 success FINAL (sign) operation
241b5677b36Schristos * <0 failure
242b5677b36Schristos */
243b5677b36Schristos
244b5677b36Schristos int
dst_sign_data(const int mode,DST_KEY * in_key,void ** context,const u_char * data,const int len,u_char * signature,const int sig_len)245b5677b36Schristos dst_sign_data(const int mode, DST_KEY *in_key, void **context,
246b5677b36Schristos const u_char *data, const int len,
247b5677b36Schristos u_char *signature, const int sig_len)
248b5677b36Schristos {
249b5677b36Schristos DUMP(data, mode, len, "dst_sign_data()");
250b5677b36Schristos
251b5677b36Schristos if (mode & SIG_MODE_FINAL &&
252b5677b36Schristos (in_key->dk_KEY_struct == NULL || signature == NULL))
253b5677b36Schristos return (MISSING_KEY_OR_SIGNATURE);
254b5677b36Schristos
255b5677b36Schristos if (in_key->dk_func && in_key->dk_func->sign)
256b5677b36Schristos return (in_key->dk_func->sign(mode, in_key, context, data, len,
257b5677b36Schristos signature, sig_len));
258b5677b36Schristos return (UNKNOWN_KEYALG);
259b5677b36Schristos }
260b5677b36Schristos
261b5677b36Schristos /*%
262b5677b36Schristos * dst_verify_data
263b5677b36Schristos * An incremental verify function. Data is verified in steps.
264b5677b36Schristos * First the context must be initialized (SIG_MODE_INIT).
265b5677b36Schristos * Then data is hashed (SIG_MODE_UPDATE). Finally the signature
266b5677b36Schristos * is verified (SIG_MODE_FINAL). This function can be called
267b5677b36Schristos * once with INIT, UPDATE and FINAL modes all set, or it can be
268b5677b36Schristos * called separately with a different mode set for each step. The
269b5677b36Schristos * UPDATE step can be repeated.
270b5677b36Schristos * Parameters
271b5677b36Schristos * mode Operations to perform this time.
272b5677b36Schristos * SIG_MODE_INIT 1 Initialize digest
273b5677b36Schristos * SIG_MODE_UPDATE 2 add data to digest
274b5677b36Schristos * SIG_MODE_FINAL 4 verify signature
275b5677b36Schristos * SIG_MODE_ALL
276b5677b36Schristos * (SIG_MODE_INIT,SIG_MODE_UPDATE,SIG_MODE_FINAL)
277b5677b36Schristos * data Data to pass through the hash function.
278b5677b36Schristos * len Length of the data in bytes.
279b5677b36Schristos * in_key Key for verification.
280b5677b36Schristos * signature Location of signature.
281b5677b36Schristos * sig_len Length of the signature in bytes.
282b5677b36Schristos * Returns
283b5677b36Schristos * 0 Verify success
284b5677b36Schristos * Non-Zero Verify Failure
285b5677b36Schristos */
286b5677b36Schristos
287b5677b36Schristos int
dst_verify_data(const int mode,DST_KEY * in_key,void ** context,const u_char * data,const int len,const u_char * signature,const int sig_len)288b5677b36Schristos dst_verify_data(const int mode, DST_KEY *in_key, void **context,
289b5677b36Schristos const u_char *data, const int len,
290b5677b36Schristos const u_char *signature, const int sig_len)
291b5677b36Schristos {
292b5677b36Schristos DUMP(data, mode, len, "dst_verify_data()");
293b5677b36Schristos if (mode & SIG_MODE_FINAL &&
294b5677b36Schristos (in_key->dk_KEY_struct == NULL || signature == NULL))
295b5677b36Schristos return (MISSING_KEY_OR_SIGNATURE);
296b5677b36Schristos
297b5677b36Schristos if (in_key->dk_func == NULL || in_key->dk_func->verify == NULL)
298b5677b36Schristos return (UNSUPPORTED_KEYALG);
299b5677b36Schristos return (in_key->dk_func->verify(mode, in_key, context, data, len,
300b5677b36Schristos signature, sig_len));
301b5677b36Schristos }
302b5677b36Schristos
303b5677b36Schristos /*%
304b5677b36Schristos * dst_read_private_key
305b5677b36Schristos * Access a private key. First the list of private keys that have
306b5677b36Schristos * already been read in is searched, then the key accessed on disk.
307b5677b36Schristos * If the private key can be found, it is returned. If the key cannot
308b5677b36Schristos * be found, a null pointer is returned. The options specify required
309b5677b36Schristos * key characteristics. If the private key requested does not have
310b5677b36Schristos * these characteristics, it will not be read.
311b5677b36Schristos * Parameters
312b5677b36Schristos * in_keyname The private key name.
313b5677b36Schristos * in_id The id of the private key.
314b5677b36Schristos * options DST_FORCE_READ Read from disk - don't use a previously
315b5677b36Schristos * read key.
316b5677b36Schristos * DST_CAN_SIGN The key must be useable for signing.
317b5677b36Schristos * DST_NO_AUTHEN The key must be useable for authentication.
318b5677b36Schristos * DST_STANDARD Return any key
319b5677b36Schristos * Returns
320b5677b36Schristos * NULL If there is no key found in the current directory or
321b5677b36Schristos * this key has not been loaded before.
322b5677b36Schristos * !NULL Success - KEY structure returned.
323b5677b36Schristos */
324b5677b36Schristos
325b5677b36Schristos DST_KEY *
dst_read_key(const char * in_keyname,const u_int16_t in_id,const int in_alg,const int type)326b5677b36Schristos dst_read_key(const char *in_keyname, const u_int16_t in_id,
327b5677b36Schristos const int in_alg, const int type)
328b5677b36Schristos {
329b5677b36Schristos char keyname[PATH_MAX];
330b5677b36Schristos DST_KEY *dg_key = NULL, *pubkey = NULL;
331b5677b36Schristos
332b5677b36Schristos if (!dst_check_algorithm(in_alg)) { /*%< make sure alg is available */
333b5677b36Schristos EREPORT(("dst_read_private_key(): Algorithm %d not suppored\n",
334b5677b36Schristos in_alg));
335b5677b36Schristos return (NULL);
336b5677b36Schristos }
337b5677b36Schristos if ((type & (DST_PUBLIC | DST_PRIVATE)) == 0)
338b5677b36Schristos return (NULL);
339b5677b36Schristos if (in_keyname == NULL) {
340b5677b36Schristos EREPORT(("dst_read_private_key(): Null key name passed in\n"));
341b5677b36Schristos return (NULL);
342b5677b36Schristos } else if (strlen(in_keyname) >= sizeof(keyname)) {
343b5677b36Schristos EREPORT(("dst_read_private_key(): keyname too big\n"));
344b5677b36Schristos return (NULL);
345b5677b36Schristos } else
346b5677b36Schristos strcpy(keyname, in_keyname);
347b5677b36Schristos
348b5677b36Schristos /* before I read in the public key, check if it is allowed to sign */
349b5677b36Schristos if ((pubkey = dst_s_read_public_key(keyname, in_id, in_alg)) == NULL)
350b5677b36Schristos return (NULL);
351b5677b36Schristos
352b5677b36Schristos if (type == DST_PUBLIC)
353b5677b36Schristos return pubkey;
354b5677b36Schristos
355b5677b36Schristos if (!(dg_key = dst_s_get_key_struct(keyname, pubkey->dk_alg,
356b5677b36Schristos pubkey->dk_flags, pubkey->dk_proto,
357b5677b36Schristos 0)))
358b5677b36Schristos return (dg_key);
359b5677b36Schristos /* Fill in private key and some fields in the general key structure */
360b5677b36Schristos if (dst_s_read_private_key_file(keyname, dg_key, pubkey->dk_id,
361b5677b36Schristos pubkey->dk_alg) == 0)
362b5677b36Schristos dg_key = dst_free_key(dg_key);
363b5677b36Schristos
364b5677b36Schristos (void)dst_free_key(pubkey);
365b5677b36Schristos return (dg_key);
366b5677b36Schristos }
367b5677b36Schristos
368b5677b36Schristos int
dst_write_key(const DST_KEY * key,const int type)369b5677b36Schristos dst_write_key(const DST_KEY *key, const int type)
370b5677b36Schristos {
371b5677b36Schristos int pub = 0, priv = 0;
372b5677b36Schristos
373b5677b36Schristos if (key == NULL)
374b5677b36Schristos return (0);
375b5677b36Schristos if (!dst_check_algorithm(key->dk_alg)) { /*%< make sure alg is available */
376b5677b36Schristos EREPORT(("dst_write_key(): Algorithm %d not suppored\n",
377b5677b36Schristos key->dk_alg));
378b5677b36Schristos return (UNSUPPORTED_KEYALG);
379b5677b36Schristos }
380b5677b36Schristos if ((type & (DST_PRIVATE|DST_PUBLIC)) == 0)
381b5677b36Schristos return (0);
382b5677b36Schristos
383b5677b36Schristos if (type & DST_PUBLIC)
384b5677b36Schristos if ((pub = dst_s_write_public_key(key)) < 0)
385b5677b36Schristos return (pub);
386b5677b36Schristos if (type & DST_PRIVATE)
387b5677b36Schristos if ((priv = dst_s_write_private_key(key)) < 0)
388b5677b36Schristos return (priv);
389b5677b36Schristos return (priv+pub);
390b5677b36Schristos }
391b5677b36Schristos
392b5677b36Schristos /*%
393b5677b36Schristos * dst_write_private_key
394b5677b36Schristos * Write a private key to disk. The filename will be of the form:
395b5677b36Schristos * K<key->dk_name>+<key->dk_alg+><key-d>k_id.><private key suffix>.
396b5677b36Schristos * If there is already a file with this name, an error is returned.
397b5677b36Schristos *
398b5677b36Schristos * Parameters
399b5677b36Schristos * key A DST managed key structure that contains
400b5677b36Schristos * all information needed about a key.
401b5677b36Schristos * Return
402b5677b36Schristos * >= 0 Correct behavior. Returns length of encoded key value
403b5677b36Schristos * written to disk.
404b5677b36Schristos * < 0 error.
405b5677b36Schristos */
406b5677b36Schristos
407b5677b36Schristos static int
dst_s_write_private_key(const DST_KEY * key)408b5677b36Schristos dst_s_write_private_key(const DST_KEY *key)
409b5677b36Schristos {
410b5677b36Schristos u_char encoded_block[RAW_KEY_SIZE];
411b5677b36Schristos char file[PATH_MAX];
412b5677b36Schristos int len;
413b5677b36Schristos FILE *fp;
414b5677b36Schristos
415b5677b36Schristos /* First encode the key into the portable key format */
416b5677b36Schristos if (key == NULL)
417b5677b36Schristos return (-1);
418b5677b36Schristos if (key->dk_KEY_struct == NULL)
419b5677b36Schristos return (0); /*%< null key has no private key */
420b5677b36Schristos if (key->dk_func == NULL || key->dk_func->to_file_fmt == NULL) {
421b5677b36Schristos EREPORT(("dst_write_private_key(): Unsupported operation %d\n",
422b5677b36Schristos key->dk_alg));
423b5677b36Schristos return (-5);
424b5677b36Schristos } else if ((len = key->dk_func->to_file_fmt(key, (char *)encoded_block,
425b5677b36Schristos sizeof(encoded_block))) <= 0) {
426b5677b36Schristos EREPORT(("dst_write_private_key(): Failed encoding private RSA bsafe key %d\n", len));
427b5677b36Schristos return (-8);
428b5677b36Schristos }
429b5677b36Schristos /* Now I can create the file I want to use */
430b5677b36Schristos dst_s_build_filename(file, key->dk_key_name, key->dk_id, key->dk_alg,
431b5677b36Schristos PRIVATE_KEY, PATH_MAX);
432b5677b36Schristos
433b5677b36Schristos /* Do not overwrite an existing file */
434b5677b36Schristos if ((fp = dst_s_fopen(file, "w", 0600)) != NULL) {
435b5677b36Schristos int nn;
436b5677b36Schristos if ((nn = fwrite(encoded_block, 1, len, fp)) != len) {
437b5677b36Schristos EREPORT(("dst_write_private_key(): Write failure on %s %d != %d errno=%d\n",
438b5677b36Schristos file, len, nn, errno));
439b5677b36Schristos fclose(fp);
440b5677b36Schristos return (-5);
441b5677b36Schristos }
442b5677b36Schristos fclose(fp);
443b5677b36Schristos } else {
444b5677b36Schristos EREPORT(("dst_write_private_key(): Can not create file %s\n"
445b5677b36Schristos ,file));
446b5677b36Schristos return (-6);
447b5677b36Schristos }
448b5677b36Schristos memset(encoded_block, 0, len);
449b5677b36Schristos return (len);
450b5677b36Schristos }
451b5677b36Schristos
452b5677b36Schristos /*%
453b5677b36Schristos *
454b5677b36Schristos * dst_read_public_key
455b5677b36Schristos * Read a public key from disk and store in a DST key structure.
456b5677b36Schristos * Parameters
457b5677b36Schristos * in_name K<in_name><in_id>.<public key suffix> is the
458b5677b36Schristos * filename of the key file to be read.
459b5677b36Schristos * Returns
460b5677b36Schristos * NULL If the key does not exist or no name is supplied.
461b5677b36Schristos * NON-NULL Initialized key structure if the key exists.
462b5677b36Schristos */
463b5677b36Schristos
464b5677b36Schristos static DST_KEY *
dst_s_read_public_key(const char * in_name,const u_int16_t in_id,int in_alg)465b5677b36Schristos dst_s_read_public_key(const char *in_name, const u_int16_t in_id, int in_alg)
466b5677b36Schristos {
467b5677b36Schristos int flags, proto, alg, len, dlen;
468b5677b36Schristos int c;
469b5677b36Schristos char name[PATH_MAX], enckey[RAW_KEY_SIZE], *notspace;
470b5677b36Schristos u_char deckey[RAW_KEY_SIZE];
471b5677b36Schristos FILE *fp;
472b5677b36Schristos
473b5677b36Schristos if (in_name == NULL) {
474b5677b36Schristos EREPORT(("dst_read_public_key(): No key name given\n"));
475b5677b36Schristos return (NULL);
476b5677b36Schristos }
477b5677b36Schristos if (dst_s_build_filename(name, in_name, in_id, in_alg, PUBLIC_KEY,
478b5677b36Schristos PATH_MAX) == -1) {
479b5677b36Schristos EREPORT(("dst_read_public_key(): Cannot make filename from %s, %d, and %s\n",
480b5677b36Schristos in_name, in_id, PUBLIC_KEY));
481b5677b36Schristos return (NULL);
482b5677b36Schristos }
483b5677b36Schristos /*
484b5677b36Schristos * Open the file and read it's formatted contents up to key
485b5677b36Schristos * File format:
486b5677b36Schristos * domain.name [ttl] [IN] KEY <flags> <protocol> <algorithm> <key>
487b5677b36Schristos * flags, proto, alg stored as decimal (or hex numbers FIXME).
488b5677b36Schristos * (FIXME: handle parentheses for line continuation.)
489b5677b36Schristos */
490b5677b36Schristos if ((fp = dst_s_fopen(name, "r", 0)) == NULL) {
491b5677b36Schristos EREPORT(("dst_read_public_key(): Public Key not found %s\n",
492b5677b36Schristos name));
493b5677b36Schristos return (NULL);
494b5677b36Schristos }
495b5677b36Schristos /* Skip domain name, which ends at first blank */
496b5677b36Schristos while ((c = getc(fp)) != EOF)
497b5677b36Schristos if (isspace(c))
498b5677b36Schristos break;
499b5677b36Schristos /* Skip blank to get to next field */
500b5677b36Schristos while ((c = getc(fp)) != EOF)
501b5677b36Schristos if (!isspace(c))
502b5677b36Schristos break;
503b5677b36Schristos
504b5677b36Schristos /* Skip optional TTL -- if initial digit, skip whole word. */
505b5677b36Schristos if (isdigit(c)) {
506b5677b36Schristos while ((c = getc(fp)) != EOF)
507b5677b36Schristos if (isspace(c))
508b5677b36Schristos break;
509b5677b36Schristos while ((c = getc(fp)) != EOF)
510b5677b36Schristos if (!isspace(c))
511b5677b36Schristos break;
512b5677b36Schristos }
513b5677b36Schristos /* Skip optional "IN" */
514b5677b36Schristos if (c == 'I' || c == 'i') {
515b5677b36Schristos while ((c = getc(fp)) != EOF)
516b5677b36Schristos if (isspace(c))
517b5677b36Schristos break;
518b5677b36Schristos while ((c = getc(fp)) != EOF)
519b5677b36Schristos if (!isspace(c))
520b5677b36Schristos break;
521b5677b36Schristos }
522b5677b36Schristos /* Locate and skip "KEY" */
523b5677b36Schristos if (c != 'K' && c != 'k') {
524b5677b36Schristos EREPORT(("\"KEY\" doesn't appear in file: %s", name));
525b5677b36Schristos return NULL;
526b5677b36Schristos }
527b5677b36Schristos while ((c = getc(fp)) != EOF)
528b5677b36Schristos if (isspace(c))
529b5677b36Schristos break;
530b5677b36Schristos while ((c = getc(fp)) != EOF)
531b5677b36Schristos if (!isspace(c))
532b5677b36Schristos break;
533b5677b36Schristos ungetc(c, fp); /*%< return the charcter to the input field */
534b5677b36Schristos /* Handle hex!! FIXME. */
535b5677b36Schristos
536b5677b36Schristos if (fscanf(fp, "%d %d %d", &flags, &proto, &alg) != 3) {
537b5677b36Schristos EREPORT(("dst_read_public_key(): Can not read flag/proto/alg field from %s\n"
538b5677b36Schristos ,name));
539b5677b36Schristos return (NULL);
540b5677b36Schristos }
541b5677b36Schristos /* read in the key string */
542b5677b36Schristos fgets(enckey, sizeof(enckey), fp);
543b5677b36Schristos
544b5677b36Schristos /* If we aren't at end-of-file, something is wrong. */
545b5677b36Schristos while ((c = getc(fp)) != EOF)
546b5677b36Schristos if (!isspace(c))
547b5677b36Schristos break;
548b5677b36Schristos if (!feof(fp)) {
549b5677b36Schristos EREPORT(("Key too long in file: %s", name));
550b5677b36Schristos return NULL;
551b5677b36Schristos }
552b5677b36Schristos fclose(fp);
553b5677b36Schristos
554b5677b36Schristos if ((len = strlen(enckey)) <= 0)
555b5677b36Schristos return (NULL);
556b5677b36Schristos
557b5677b36Schristos /* discard \n */
558b5677b36Schristos enckey[--len] = '\0';
559b5677b36Schristos
560b5677b36Schristos /* remove leading spaces */
561b5677b36Schristos for (notspace = (char *) enckey; isspace((*notspace)&0xff); len--)
562b5677b36Schristos notspace++;
563b5677b36Schristos
564b5677b36Schristos dlen = b64_pton(notspace, deckey, sizeof(deckey));
565b5677b36Schristos if (dlen < 0) {
566b5677b36Schristos EREPORT(("dst_read_public_key: bad return from b64_pton = %d",
567b5677b36Schristos dlen));
568b5677b36Schristos return (NULL);
569b5677b36Schristos }
570b5677b36Schristos /* store key and info in a key structure that is returned */
571b5677b36Schristos /* return dst_store_public_key(in_name, alg, proto, 666, flags, deckey,
572b5677b36Schristos dlen);*/
573b5677b36Schristos return dst_buffer_to_key(in_name, alg, flags, proto, deckey, dlen);
574b5677b36Schristos }
575b5677b36Schristos
576b5677b36Schristos /*%
577b5677b36Schristos * dst_write_public_key
578b5677b36Schristos * Write a key to disk in DNS format.
579b5677b36Schristos * Parameters
580b5677b36Schristos * key Pointer to a DST key structure.
581b5677b36Schristos * Returns
582b5677b36Schristos * 0 Failure
583b5677b36Schristos * 1 Success
584b5677b36Schristos */
585b5677b36Schristos
586b5677b36Schristos static int
dst_s_write_public_key(const DST_KEY * key)587b5677b36Schristos dst_s_write_public_key(const DST_KEY *key)
588b5677b36Schristos {
589b5677b36Schristos FILE *fp;
590b5677b36Schristos char filename[PATH_MAX];
591b5677b36Schristos u_char out_key[RAW_KEY_SIZE];
592b5677b36Schristos char enc_key[RAW_KEY_SIZE];
593b5677b36Schristos int len = 0;
594b5677b36Schristos int mode;
595b5677b36Schristos
596b5677b36Schristos memset(out_key, 0, sizeof(out_key));
597b5677b36Schristos if (key == NULL) {
598b5677b36Schristos EREPORT(("dst_write_public_key(): No key specified \n"));
599b5677b36Schristos return (0);
600b5677b36Schristos } else if ((len = dst_key_to_dnskey(key, out_key, sizeof(out_key)))< 0)
601b5677b36Schristos return (0);
602b5677b36Schristos
603b5677b36Schristos /* Make the filename */
604b5677b36Schristos if (dst_s_build_filename(filename, key->dk_key_name, key->dk_id,
605b5677b36Schristos key->dk_alg, PUBLIC_KEY, PATH_MAX) == -1) {
606b5677b36Schristos EREPORT(("dst_write_public_key(): Cannot make filename from %s, %d, and %s\n",
607b5677b36Schristos key->dk_key_name, key->dk_id, PUBLIC_KEY));
608b5677b36Schristos return (0);
609b5677b36Schristos }
610b5677b36Schristos /* XXX in general this should be a check for symmetric keys */
611b5677b36Schristos mode = (key->dk_alg == KEY_HMAC_MD5) ? 0600 : 0644;
612b5677b36Schristos /* create public key file */
613b5677b36Schristos if ((fp = dst_s_fopen(filename, "w+", mode)) == NULL) {
614b5677b36Schristos EREPORT(("DST_write_public_key: open of file:%s failed (errno=%d)\n",
615b5677b36Schristos filename, errno));
616b5677b36Schristos return (0);
617b5677b36Schristos }
618b5677b36Schristos /*write out key first base64 the key data */
619b5677b36Schristos if (key->dk_flags & DST_EXTEND_FLAG)
620b5677b36Schristos b64_ntop(&out_key[6], len - 6, enc_key, sizeof(enc_key));
621b5677b36Schristos else
622b5677b36Schristos b64_ntop(&out_key[4], len - 4, enc_key, sizeof(enc_key));
623b5677b36Schristos fprintf(fp, "%s IN KEY %d %d %d %s\n",
624b5677b36Schristos key->dk_key_name,
625b5677b36Schristos key->dk_flags, key->dk_proto, key->dk_alg, enc_key);
626b5677b36Schristos fclose(fp);
627b5677b36Schristos return (1);
628b5677b36Schristos }
629b5677b36Schristos
630b5677b36Schristos /*%
631b5677b36Schristos * dst_dnskey_to_public_key
632b5677b36Schristos * This function converts the contents of a DNS KEY RR into a DST
633b5677b36Schristos * key structure.
634b5677b36Schristos * Paramters
635b5677b36Schristos * len Length of the RDATA of the KEY RR RDATA
636b5677b36Schristos * rdata A pointer to the the KEY RR RDATA.
637b5677b36Schristos * in_name Key name to be stored in key structure.
638b5677b36Schristos * Returns
639b5677b36Schristos * NULL Failure
640b5677b36Schristos * NON-NULL Success. Pointer to key structure.
641b5677b36Schristos * Caller's responsibility to free() it.
642b5677b36Schristos */
643b5677b36Schristos
644b5677b36Schristos DST_KEY *
dst_dnskey_to_key(const char * in_name,const u_char * rdata,const int len)645b5677b36Schristos dst_dnskey_to_key(const char *in_name, const u_char *rdata, const int len)
646b5677b36Schristos {
647b5677b36Schristos DST_KEY *key_st;
648b5677b36Schristos int alg ;
649b5677b36Schristos int start = DST_KEY_START;
650b5677b36Schristos
651b5677b36Schristos if (rdata == NULL || len <= DST_KEY_ALG) /*%< no data */
652b5677b36Schristos return (NULL);
653b5677b36Schristos alg = (u_int8_t) rdata[DST_KEY_ALG];
654b5677b36Schristos if (!dst_check_algorithm(alg)) { /*%< make sure alg is available */
655b5677b36Schristos EREPORT(("dst_dnskey_to_key(): Algorithm %d not suppored\n",
656b5677b36Schristos alg));
657b5677b36Schristos return (NULL);
658b5677b36Schristos }
659b5677b36Schristos
660b5677b36Schristos if (in_name == NULL)
661b5677b36Schristos return (NULL);
662b5677b36Schristos
663b5677b36Schristos if ((key_st = dst_s_get_key_struct(in_name, alg, 0, 0, 0)) == NULL)
664b5677b36Schristos return (NULL);
665b5677b36Schristos
666b5677b36Schristos key_st->dk_id = dst_s_dns_key_id(rdata, len);
667b5677b36Schristos key_st->dk_flags = dst_s_get_int16(rdata);
668b5677b36Schristos key_st->dk_proto = (u_int16_t) rdata[DST_KEY_PROT];
669b5677b36Schristos if (key_st->dk_flags & DST_EXTEND_FLAG) {
670b5677b36Schristos u_int32_t ext_flags;
671b5677b36Schristos ext_flags = (u_int32_t) dst_s_get_int16(&rdata[DST_EXT_FLAG]);
672b5677b36Schristos key_st->dk_flags = key_st->dk_flags | (ext_flags << 16);
673b5677b36Schristos start += 2;
674b5677b36Schristos }
675b5677b36Schristos /*
676b5677b36Schristos * now point to the begining of the data representing the encoding
677b5677b36Schristos * of the key
678b5677b36Schristos */
679b5677b36Schristos if (key_st->dk_func && key_st->dk_func->from_dns_key) {
680b5677b36Schristos if (key_st->dk_func->from_dns_key(key_st, &rdata[start],
681b5677b36Schristos len - start) > 0)
682b5677b36Schristos return (key_st);
683b5677b36Schristos } else
684b5677b36Schristos EREPORT(("dst_dnskey_to_public_key(): unsuppored alg %d\n",
685b5677b36Schristos alg));
686b5677b36Schristos
687b5677b36Schristos SAFE_FREE(key_st);
688b5677b36Schristos return (key_st);
689b5677b36Schristos }
690b5677b36Schristos
691b5677b36Schristos /*%
692b5677b36Schristos * dst_public_key_to_dnskey
693b5677b36Schristos * Function to encode a public key into DNS KEY wire format
694b5677b36Schristos * Parameters
695b5677b36Schristos * key Key structure to encode.
696b5677b36Schristos * out_storage Location to write the encoded key to.
697b5677b36Schristos * out_len Size of the output array.
698b5677b36Schristos * Returns
699b5677b36Schristos * <0 Failure
700b5677b36Schristos * >=0 Number of bytes written to out_storage
701b5677b36Schristos */
702b5677b36Schristos
703b5677b36Schristos int
dst_key_to_dnskey(const DST_KEY * key,u_char * out_storage,const int out_len)704b5677b36Schristos dst_key_to_dnskey(const DST_KEY *key, u_char *out_storage,
705b5677b36Schristos const int out_len)
706b5677b36Schristos {
707b5677b36Schristos u_int16_t val;
708b5677b36Schristos int loc = 0;
709b5677b36Schristos int enc_len = 0;
710b5677b36Schristos if (key == NULL)
711b5677b36Schristos return (-1);
712b5677b36Schristos
713b5677b36Schristos if (!dst_check_algorithm(key->dk_alg)) { /*%< make sure alg is available */
714b5677b36Schristos EREPORT(("dst_key_to_dnskey(): Algorithm %d not suppored\n",
715b5677b36Schristos key->dk_alg));
716b5677b36Schristos return (UNSUPPORTED_KEYALG);
717b5677b36Schristos }
718b5677b36Schristos memset(out_storage, 0, out_len);
719b5677b36Schristos val = (u_int16_t)(key->dk_flags & 0xffff);
720b5677b36Schristos dst_s_put_int16(out_storage, val);
721b5677b36Schristos loc += 2;
722b5677b36Schristos
723b5677b36Schristos out_storage[loc++] = (u_char) key->dk_proto;
724b5677b36Schristos out_storage[loc++] = (u_char) key->dk_alg;
725b5677b36Schristos
726b5677b36Schristos if (key->dk_flags > 0xffff) { /*%< Extended flags */
727b5677b36Schristos val = (u_int16_t)((key->dk_flags >> 16) & 0xffff);
728b5677b36Schristos dst_s_put_int16(&out_storage[loc], val);
729b5677b36Schristos loc += 2;
730b5677b36Schristos }
731b5677b36Schristos if (key->dk_KEY_struct == NULL)
732b5677b36Schristos return (loc);
733b5677b36Schristos if (key->dk_func && key->dk_func->to_dns_key) {
734b5677b36Schristos enc_len = key->dk_func->to_dns_key(key,
735b5677b36Schristos (u_char *) &out_storage[loc],
736b5677b36Schristos out_len - loc);
737b5677b36Schristos if (enc_len > 0)
738b5677b36Schristos return (enc_len + loc);
739b5677b36Schristos else
740b5677b36Schristos return (-1);
741b5677b36Schristos } else
742b5677b36Schristos EREPORT(("dst_key_to_dnskey(): Unsupported ALG %d\n",
743b5677b36Schristos key->dk_alg));
744b5677b36Schristos return (-1);
745b5677b36Schristos }
746b5677b36Schristos
747b5677b36Schristos /*%
748b5677b36Schristos * dst_buffer_to_key
749b5677b36Schristos * Function to encode a string of raw data into a DST key
750b5677b36Schristos * Parameters
751b5677b36Schristos * alg The algorithm (HMAC only)
752b5677b36Schristos * key A pointer to the data
753b5677b36Schristos * keylen The length of the data
754b5677b36Schristos * Returns
755b5677b36Schristos * NULL an error occurred
756b5677b36Schristos * NON-NULL the DST key
757b5677b36Schristos */
758b5677b36Schristos DST_KEY *
dst_buffer_to_key(const char * key_name,const int alg,const int flags,const int protocol,const u_char * key_buf,const int key_len)759b5677b36Schristos dst_buffer_to_key(const char *key_name, /*!< name of the key */
760b5677b36Schristos const int alg, /*!< algorithm */
761b5677b36Schristos const int flags, /*!< dns flags */
762b5677b36Schristos const int protocol, /*!< dns protocol */
763b5677b36Schristos const u_char *key_buf, /*!< key in dns wire fmt */
764b5677b36Schristos const int key_len) /*!< size of key */
765b5677b36Schristos {
766b5677b36Schristos
767b5677b36Schristos DST_KEY *dkey = NULL;
768b5677b36Schristos int dnslen;
769b5677b36Schristos u_char dns[2048];
770b5677b36Schristos
771b5677b36Schristos if (!dst_check_algorithm(alg)) { /*%< make sure alg is available */
772b5677b36Schristos EREPORT(("dst_buffer_to_key(): Algorithm %d not suppored\n", alg));
773b5677b36Schristos return (NULL);
774b5677b36Schristos }
775b5677b36Schristos
776b5677b36Schristos dkey = dst_s_get_key_struct(key_name, alg, flags, protocol, -1);
777b5677b36Schristos
778b5677b36Schristos if (dkey == NULL || dkey->dk_func == NULL ||
779b5677b36Schristos dkey->dk_func->from_dns_key == NULL)
780b5677b36Schristos return (dst_free_key(dkey));
781b5677b36Schristos
782b5677b36Schristos if (dkey->dk_func->from_dns_key(dkey, key_buf, key_len) < 0) {
783b5677b36Schristos EREPORT(("dst_buffer_to_key(): dst_buffer_to_hmac failed\n"));
784b5677b36Schristos return (dst_free_key(dkey));
785b5677b36Schristos }
786b5677b36Schristos
787b5677b36Schristos dnslen = dst_key_to_dnskey(dkey, dns, sizeof(dns));
788b5677b36Schristos dkey->dk_id = dst_s_dns_key_id(dns, dnslen);
789b5677b36Schristos return (dkey);
790b5677b36Schristos }
791b5677b36Schristos
792b5677b36Schristos int
dst_key_to_buffer(DST_KEY * key,u_char * out_buff,int buf_len)793b5677b36Schristos dst_key_to_buffer(DST_KEY *key, u_char *out_buff, int buf_len)
794b5677b36Schristos {
795b5677b36Schristos int len;
796b5677b36Schristos /* this function will extrac the secret of HMAC into a buffer */
797b5677b36Schristos if (key == NULL)
798b5677b36Schristos return (0);
799b5677b36Schristos if (key->dk_func != NULL && key->dk_func->to_dns_key != NULL) {
800b5677b36Schristos len = key->dk_func->to_dns_key(key, out_buff, buf_len);
801b5677b36Schristos if (len < 0)
802b5677b36Schristos return (0);
803b5677b36Schristos return (len);
804b5677b36Schristos }
805b5677b36Schristos return (0);
806b5677b36Schristos }
807b5677b36Schristos
808b5677b36Schristos /*%
809b5677b36Schristos * dst_s_read_private_key_file
810b5677b36Schristos * Function reads in private key from a file.
811b5677b36Schristos * Fills out the KEY structure.
812b5677b36Schristos * Parameters
813b5677b36Schristos * name Name of the key to be read.
814b5677b36Schristos * pk_key Structure that the key is returned in.
815b5677b36Schristos * in_id Key identifier (tag)
816b5677b36Schristos * Return
817b5677b36Schristos * 1 if everthing works
818b5677b36Schristos * 0 if there is any problem
819b5677b36Schristos */
820b5677b36Schristos
821b5677b36Schristos static int
dst_s_read_private_key_file(char * name,DST_KEY * pk_key,u_int16_t in_id,int in_alg)822b5677b36Schristos dst_s_read_private_key_file(char *name, DST_KEY *pk_key, u_int16_t in_id,
823b5677b36Schristos int in_alg)
824b5677b36Schristos {
825b5677b36Schristos int cnt, alg, len, major, minor, file_major, file_minor;
826b5677b36Schristos int ret, id;
827b5677b36Schristos char filename[PATH_MAX];
828b5677b36Schristos u_char in_buff[RAW_KEY_SIZE], *p;
829b5677b36Schristos FILE *fp;
830b5677b36Schristos int dnslen;
831b5677b36Schristos u_char dns[2048];
832b5677b36Schristos
833b5677b36Schristos if (name == NULL || pk_key == NULL) {
834b5677b36Schristos EREPORT(("dst_read_private_key_file(): No key name given\n"));
835b5677b36Schristos return (0);
836b5677b36Schristos }
837b5677b36Schristos /* Make the filename */
838b5677b36Schristos if (dst_s_build_filename(filename, name, in_id, in_alg, PRIVATE_KEY,
839b5677b36Schristos PATH_MAX) == -1) {
840b5677b36Schristos EREPORT(("dst_read_private_key(): Cannot make filename from %s, %d, and %s\n",
841b5677b36Schristos name, in_id, PRIVATE_KEY));
842b5677b36Schristos return (0);
843b5677b36Schristos }
844b5677b36Schristos /* first check if we can find the key file */
845b5677b36Schristos if ((fp = dst_s_fopen(filename, "r", 0)) == NULL) {
846b5677b36Schristos EREPORT(("dst_s_read_private_key_file: Could not open file %s in directory %s\n",
847b5677b36Schristos filename, dst_path[0] ? dst_path :
848b5677b36Schristos (char *) getcwd(NULL, PATH_MAX - 1)));
849b5677b36Schristos return (0);
850b5677b36Schristos }
851b5677b36Schristos /* now read the header info from the file */
852b5677b36Schristos if ((cnt = fread(in_buff, 1, sizeof(in_buff), fp)) < 5) {
853b5677b36Schristos fclose(fp);
854b5677b36Schristos EREPORT(("dst_s_read_private_key_file: error reading file %s (empty file)\n",
855b5677b36Schristos filename));
856b5677b36Schristos return (0);
857b5677b36Schristos }
858b5677b36Schristos /* decrypt key */
859b5677b36Schristos fclose(fp);
860b5677b36Schristos if (memcmp(in_buff, "Private-key-format: v", 20) != 0)
861b5677b36Schristos goto fail;
862b5677b36Schristos len = cnt;
863b5677b36Schristos p = in_buff;
864b5677b36Schristos
865b5677b36Schristos if (!dst_s_verify_str((const char **) (void *)&p,
866b5677b36Schristos "Private-key-format: v")) {
867b5677b36Schristos EREPORT(("dst_s_read_private_key_file(): Not a Key file/Decrypt failed %s\n", name));
868b5677b36Schristos goto fail;
869b5677b36Schristos }
870b5677b36Schristos /* read in file format */
871b5677b36Schristos sscanf((char *)p, "%d.%d", &file_major, &file_minor);
872b5677b36Schristos sscanf(KEY_FILE_FORMAT, "%d.%d", &major, &minor);
873b5677b36Schristos if (file_major < 1) {
874b5677b36Schristos EREPORT(("dst_s_read_private_key_file(): Unknown keyfile %d.%d version for %s\n",
875b5677b36Schristos file_major, file_minor, name));
876b5677b36Schristos goto fail;
877b5677b36Schristos } else if (file_major > major || file_minor > minor)
878b5677b36Schristos EREPORT((
879b5677b36Schristos "dst_s_read_private_key_file(): Keyfile %s version higher than mine %d.%d MAY FAIL\n",
880b5677b36Schristos name, file_major, file_minor));
881b5677b36Schristos
882b5677b36Schristos while (*p++ != '\n') ; /*%< skip to end of line */
883b5677b36Schristos
884b5677b36Schristos if (!dst_s_verify_str((const char **) (void *)&p, "Algorithm: "))
885b5677b36Schristos goto fail;
886b5677b36Schristos
887b5677b36Schristos if (sscanf((char *)p, "%d", &alg) != 1)
888b5677b36Schristos goto fail;
889b5677b36Schristos while (*p++ != '\n') ; /*%< skip to end of line */
890b5677b36Schristos
891b5677b36Schristos if (pk_key->dk_key_name && !strcmp(pk_key->dk_key_name, name))
892b5677b36Schristos SAFE_FREE2(pk_key->dk_key_name, strlen(pk_key->dk_key_name));
893b5677b36Schristos pk_key->dk_key_name = (char *) strdup(name);
894b5677b36Schristos
895b5677b36Schristos /* allocate and fill in key structure */
896b5677b36Schristos if (pk_key->dk_func == NULL || pk_key->dk_func->from_file_fmt == NULL)
897b5677b36Schristos goto fail;
898b5677b36Schristos
899b5677b36Schristos ret = pk_key->dk_func->from_file_fmt(pk_key, (char *)p, &in_buff[len] - p);
900b5677b36Schristos if (ret < 0)
901b5677b36Schristos goto fail;
902b5677b36Schristos
903b5677b36Schristos dnslen = dst_key_to_dnskey(pk_key, dns, sizeof(dns));
904b5677b36Schristos id = dst_s_dns_key_id(dns, dnslen);
905b5677b36Schristos
906b5677b36Schristos /* Make sure the actual key tag matches the input tag used in the filename
907b5677b36Schristos */
908b5677b36Schristos if (id != in_id) {
909b5677b36Schristos EREPORT(("dst_s_read_private_key_file(): actual tag of key read %d != input tag used to build filename %d.\n", id, in_id));
910b5677b36Schristos goto fail;
911b5677b36Schristos }
912b5677b36Schristos pk_key->dk_id = (u_int16_t) id;
913b5677b36Schristos pk_key->dk_alg = alg;
914b5677b36Schristos memset(in_buff, 0, cnt);
915b5677b36Schristos return (1);
916b5677b36Schristos
917b5677b36Schristos fail:
918b5677b36Schristos memset(in_buff, 0, cnt);
919b5677b36Schristos return (0);
920b5677b36Schristos }
921b5677b36Schristos
922b5677b36Schristos /*%
923b5677b36Schristos * Generate and store a public/private keypair.
924b5677b36Schristos * Keys will be stored in formatted files.
925b5677b36Schristos *
926b5677b36Schristos * Parameters
927b5677b36Schristos &
928b5677b36Schristos *\par name Name of the new key. Used to create key files
929b5677b36Schristos *\li K<name>+<alg>+<id>.public and K<name>+<alg>+<id>.private.
930b5677b36Schristos *\par bits Size of the new key in bits.
931b5677b36Schristos *\par exp What exponent to use:
932b5677b36Schristos *\li 0 use exponent 3
933b5677b36Schristos *\li non-zero use Fermant4
934b5677b36Schristos *\par flags The default value of the DNS Key flags.
935b5677b36Schristos *\li The DNS Key RR Flag field is defined in RFC2065,
936b5677b36Schristos * section 3.3. The field has 16 bits.
937b5677b36Schristos *\par protocol
938b5677b36Schristos *\li Default value of the DNS Key protocol field.
939b5677b36Schristos *\li The DNS Key protocol field is defined in RFC2065,
940b5677b36Schristos * section 3.4. The field has 8 bits.
941b5677b36Schristos *\par alg What algorithm to use. Currently defined:
942b5677b36Schristos *\li KEY_RSA 1
943b5677b36Schristos *\li KEY_DSA 3
944b5677b36Schristos *\li KEY_HMAC 157
945b5677b36Schristos *\par out_id The key tag is returned.
946b5677b36Schristos *
947b5677b36Schristos * Return
948b5677b36Schristos *\li NULL Failure
949b5677b36Schristos *\li non-NULL the generated key pair
950b5677b36Schristos * Caller frees the result, and its dk_name pointer.
951b5677b36Schristos */
952b5677b36Schristos DST_KEY *
dst_generate_key(const char * name,const int bits,const int exp,const int flags,const int protocol,const int alg)953b5677b36Schristos dst_generate_key(const char *name, const int bits, const int exp,
954b5677b36Schristos const int flags, const int protocol, const int alg)
955b5677b36Schristos {
956b5677b36Schristos DST_KEY *new_key = NULL;
957b5677b36Schristos int dnslen;
958b5677b36Schristos u_char dns[2048];
959b5677b36Schristos
960b5677b36Schristos if (name == NULL)
961b5677b36Schristos return (NULL);
962b5677b36Schristos
963b5677b36Schristos if (!dst_check_algorithm(alg)) { /*%< make sure alg is available */
964b5677b36Schristos EREPORT(("dst_generate_key(): Algorithm %d not suppored\n", alg));
965b5677b36Schristos return (NULL);
966b5677b36Schristos }
967b5677b36Schristos
968b5677b36Schristos new_key = dst_s_get_key_struct(name, alg, flags, protocol, bits);
969b5677b36Schristos if (new_key == NULL)
970b5677b36Schristos return (NULL);
971b5677b36Schristos if (bits == 0) /*%< null key we are done */
972b5677b36Schristos return (new_key);
973b5677b36Schristos if (new_key->dk_func == NULL || new_key->dk_func->generate == NULL) {
974b5677b36Schristos EREPORT(("dst_generate_key_pair():Unsupported algorithm %d\n",
975b5677b36Schristos alg));
976b5677b36Schristos return (dst_free_key(new_key));
977b5677b36Schristos }
978b5677b36Schristos if (new_key->dk_func->generate(new_key, exp) <= 0) {
979b5677b36Schristos EREPORT(("dst_generate_key_pair(): Key generation failure %s %d %d %d\n",
980b5677b36Schristos new_key->dk_key_name, new_key->dk_alg,
981b5677b36Schristos new_key->dk_key_size, exp));
982b5677b36Schristos return (dst_free_key(new_key));
983b5677b36Schristos }
984b5677b36Schristos
985b5677b36Schristos dnslen = dst_key_to_dnskey(new_key, dns, sizeof(dns));
986b5677b36Schristos if (dnslen != UNSUPPORTED_KEYALG)
987b5677b36Schristos new_key->dk_id = dst_s_dns_key_id(dns, dnslen);
988b5677b36Schristos else
989b5677b36Schristos new_key->dk_id = 0;
990b5677b36Schristos
991b5677b36Schristos return (new_key);
992b5677b36Schristos }
993b5677b36Schristos
994b5677b36Schristos /*%
995b5677b36Schristos * Release all data structures pointed to by a key structure.
996b5677b36Schristos *
997b5677b36Schristos * Parameters
998b5677b36Schristos *\li f_key Key structure to be freed.
999b5677b36Schristos */
1000b5677b36Schristos
1001b5677b36Schristos DST_KEY *
dst_free_key(DST_KEY * f_key)1002b5677b36Schristos dst_free_key(DST_KEY *f_key)
1003b5677b36Schristos {
1004b5677b36Schristos
1005b5677b36Schristos if (f_key == NULL)
1006b5677b36Schristos return (f_key);
1007b5677b36Schristos if (f_key->dk_func && f_key->dk_func->destroy)
1008b5677b36Schristos f_key->dk_KEY_struct =
1009b5677b36Schristos f_key->dk_func->destroy(f_key->dk_KEY_struct);
1010b5677b36Schristos else {
1011b5677b36Schristos EREPORT(("dst_free_key(): Unknown key alg %d\n",
1012b5677b36Schristos f_key->dk_alg));
1013b5677b36Schristos }
1014b5677b36Schristos if (f_key->dk_KEY_struct) {
1015b5677b36Schristos free(f_key->dk_KEY_struct);
1016b5677b36Schristos f_key->dk_KEY_struct = NULL;
1017b5677b36Schristos }
1018b5677b36Schristos if (f_key->dk_key_name)
1019b5677b36Schristos SAFE_FREE(f_key->dk_key_name);
1020b5677b36Schristos SAFE_FREE(f_key);
1021b5677b36Schristos return (NULL);
1022b5677b36Schristos }
1023b5677b36Schristos
1024b5677b36Schristos /*%
1025b5677b36Schristos * Return the maximim size of signature from the key specified in bytes
1026b5677b36Schristos *
1027b5677b36Schristos * Parameters
1028b5677b36Schristos *\li key
1029b5677b36Schristos *
1030b5677b36Schristos * Returns
1031b5677b36Schristos * \li bytes
1032b5677b36Schristos */
1033b5677b36Schristos int
dst_sig_size(DST_KEY * key)1034b5677b36Schristos dst_sig_size(DST_KEY *key) {
1035b5677b36Schristos switch (key->dk_alg) {
1036b5677b36Schristos case KEY_HMAC_MD5:
1037b5677b36Schristos return (16);
1038b5677b36Schristos case KEY_HMAC_SHA1:
1039b5677b36Schristos return (20);
1040b5677b36Schristos case KEY_RSA:
1041b5677b36Schristos return (key->dk_key_size + 7) / 8;
1042b5677b36Schristos case KEY_DSA:
1043b5677b36Schristos return (40);
1044b5677b36Schristos default:
1045b5677b36Schristos EREPORT(("dst_sig_size(): Unknown key alg %d\n", key->dk_alg));
1046b5677b36Schristos return -1;
1047b5677b36Schristos }
1048b5677b36Schristos }
1049b5677b36Schristos
1050b5677b36Schristos /*! \file */
1051