pdns/dnssecinfra.cc

   1 /*
   2  * This file is part of PowerDNS or dnsdist.
   3  * Copyright -- PowerDNS.COM B.V. and its contributors
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * In addition, for the avoidance of any doubt, permission is granted to
  10  * link this program with OpenSSL and to (re)distribute the binaries
  11  * produced as the result of such linking.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22 #ifdef HAVE_CONFIG_H
  23 #include "config.h"
  24 #endif
  25 #include "dnsparser.hh"
  26 #include "sstuff.hh"
  27 #include "misc.hh"
  28 #include "dnswriter.hh"
  29 #include "dnsrecords.hh"
  30 #ifndef RECURSOR
  31 #include "statbag.hh"
  32 #endif
  33 #include "iputils.hh"
  34
  35 #include <boost/algorithm/string.hpp>
  36 #include "dnssecinfra.hh"
  37 #include "dnsseckeeper.hh"
  38 #include <openssl/hmac.h>
  39 #include <openssl/sha.h>
  40 #include <boost/assign/std/vector.hpp> // for 'operator+=()'
  41 #include <boost/assign/list_inserter.hpp>
  42 #include "base64.hh"
  43 #include "namespaces.hh"
  44 #ifdef HAVE_P11KIT1
  45 #include "pkcs11signers.hh"
  46 #endif
  47 #include "gss_context.hh"
  48 #include "misc.hh"
  49
  50 using namespace boost::assign;
  51
  52 shared_ptr<DNSCryptoKeyEngine> DNSCryptoKeyEngine::makeFromISCFile(DNSKEYRecordContent& drc, const char* fname)
  53 {
  54   string sline, isc;
  55   FILE *fp=fopen(fname, "r");
  56   if(!fp) {
  57     throw runtime_error("Unable to read file '"+string(fname)+"' for generating DNS Private Key");
  58   }
  59
  60   while(stringfgets(fp, sline)) {
  61     isc += sline;
  62   }
  63   fclose(fp);
  64   shared_ptr<DNSCryptoKeyEngine> dke = makeFromISCString(drc, isc);
  65   if(!dke->checkKey()) {
  66     throw runtime_error("Invalid DNS Private Key in file '"+string(fname));
  67   }
  68   return dke;
  69 }
  70
  71 shared_ptr<DNSCryptoKeyEngine> DNSCryptoKeyEngine::makeFromISCString(DNSKEYRecordContent& drc, const std::string& content)
  72 {
  73   bool pkcs11=false;
  74   int algorithm = 0;
  75   string sline, key, value, raw;
  76   std::istringstream str(content);
  77   map<string, string> stormap;
  78
  79   while(std::getline(str, sline)) {
  80     tie(key,value)=splitField(sline, ':');
  81     trim(value);
  82     if(pdns_iequals(key,"algorithm")) {
  83       algorithm = pdns_stou(value);
  84       stormap["algorithm"]=std::to_string(algorithm);
  85       continue;
  86     } else if (pdns_iequals(key,"pin")) {
  87       stormap["pin"]=value;
  88       continue;
  89     } else if (pdns_iequals(key,"engine")) {
  90       stormap["engine"]=value;
  91       pkcs11=true;
  92       continue;
  93     } else if (pdns_iequals(key,"slot")) {
  94       stormap["slot"]=value;
  95       continue;
  96     }  else if (pdns_iequals(key,"label")) {
  97       stormap["label"]=value;
  98       continue;
  99     } else if (pdns_iequals(key,"publabel")) {
 100       stormap["publabel"]=value;
 101       continue;
 102     }
 103     else if(pdns_iequals(key, "Private-key-format"))
 104       continue;
 105     raw.clear();
 106     B64Decode(value, raw);
 107     stormap[toLower(key)]=raw;
 108   }
 109   shared_ptr<DNSCryptoKeyEngine> dpk;
 110
 111   if (pkcs11) {
 112 #ifdef HAVE_P11KIT1
 113     if (stormap.find("slot") == stormap.end())
 114       throw PDNSException("Cannot load PKCS#11 key, no Slot specified");
 115     // we need PIN to be at least empty
 116     if (stormap.find("pin") == stormap.end()) stormap["pin"] = "";
 117     dpk = PKCS11DNSCryptoKeyEngine::maker(algorithm);
 118 #else
 119     throw PDNSException("Cannot load PKCS#11 key without support for it");
 120 #endif
 121   } else {
 122     dpk=make(algorithm);
 123   }
 124   dpk->fromISCMap(drc, stormap);
 125   return dpk;
 126 }
 127
 128 std::string DNSCryptoKeyEngine::convertToISC() const
 129 {
 130   storvector_t stormap = this->convertToISCVector();
 131   ostringstream ret;
 132   ret<<"Private-key-format: v1.2\n";
 133   for(const stormap_t::value_type& value :  stormap) {
 134     if(value.first != "Algorithm" && value.first != "PIN" &&
 135        value.first != "Slot" && value.first != "Engine" &&
 136        value.first != "Label" && value.first != "PubLabel")
 137       ret<<value.first<<": "<<Base64Encode(value.second)<<"\n";
 138     else
 139       ret<<value.first<<": "<<value.second<<"\n";
 140   }
 141   return ret.str();
 142 }
 143
 144 shared_ptr<DNSCryptoKeyEngine> DNSCryptoKeyEngine::make(unsigned int algo)
 145 {
 146   const makers_t& makers = getMakers();
 147   makers_t::const_iterator iter = makers.find(algo);
 148   if(iter != makers.cend())
 149     return (iter->second)(algo);
 150   else {
 151     throw runtime_error("Request to create key object for unknown algorithm number "+std::to_string(algo));
 152   }
 153 }
 154
 155 /**
 156  * Returns the supported DNSSEC algorithms with the name of the Crypto Backend used
 157  *
 158  * @return   A vector with pairs of (algorithm-number (int), backend-name (string))
 159  */
 160 vector<pair<uint8_t, string>> DNSCryptoKeyEngine::listAllAlgosWithBackend()
 161 {
 162   vector<pair<uint8_t, string>> ret;
 163   for (auto const& value : getMakers()) {
 164     shared_ptr<DNSCryptoKeyEngine> dcke(value.second(value.first));
 165     ret.push_back(make_pair(value.first, dcke->getName()));
 166   }
 167   return ret;
 168 }
 169
 170 void DNSCryptoKeyEngine::report(unsigned int algo, maker_t* maker, bool fallback)
 171 {
 172   getAllMakers()[algo].push_back(maker);
 173   if(getMakers().count(algo) && fallback) {
 174     return;
 175   }
 176   getMakers()[algo]=maker;
 177 }
 178
 179 bool DNSCryptoKeyEngine::testAll()
 180 {
 181   bool ret=true;
 182
 183   for(const allmakers_t::value_type& value :  getAllMakers())
 184   {
 185     for(maker_t* creator :  value.second) {
 186
 187       for(maker_t* signer :  value.second) {
 188         // multi_map<unsigned int, maker_t*> bestSigner, bestVerifier;
 189
 190         for(maker_t* verifier :  value.second) {
 191           try {
 192             /* pair<unsigned int, unsigned int> res=*/ testMakers(value.first, creator, signer, verifier);
 193           }
 194           catch(std::exception& e)
 195           {
 196             cerr<<e.what()<<endl;
 197             ret=false;
 198           }
 199         }
 200       }
 201     }
 202   }
 203   return ret;
 204 }
 205
 206 bool DNSCryptoKeyEngine::testOne(int algo)
 207 {
 208   bool ret=true;
 209
 210   for(maker_t* creator :  getAllMakers()[algo]) {
 211
 212     for(maker_t* signer :  getAllMakers()[algo]) {
 213       // multi_map<unsigned int, maker_t*> bestSigner, bestVerifier;
 214
 215       for(maker_t* verifier :  getAllMakers()[algo]) {
 216         try {
 217           /* pair<unsigned int, unsigned int> res=*/testMakers(algo, creator, signer, verifier);
 218         }
 219         catch(std::exception& e)
 220         {
 221           cerr<<e.what()<<endl;
 222           ret=false;
 223         }
 224       }
 225     }
 226   }
 227   return ret;
 228 }
 229 // returns times it took to sign and verify
 230 pair<unsigned int, unsigned int> DNSCryptoKeyEngine::testMakers(unsigned int algo, maker_t* creator, maker_t* signer, maker_t* verifier)
 231 {
 232   shared_ptr<DNSCryptoKeyEngine> dckeCreate(creator(algo));
 233   shared_ptr<DNSCryptoKeyEngine> dckeSign(signer(algo));
 234   shared_ptr<DNSCryptoKeyEngine> dckeVerify(verifier(algo));
 235
 236   cerr<<"Testing algorithm "<<algo<<": '"<<dckeCreate->getName()<<"' ->'"<<dckeSign->getName()<<"' -> '"<<dckeVerify->getName()<<"' ";
 237   unsigned int bits;
 238   if(algo <= 10)
 239     bits=1024;
 240   else if(algo == DNSSECKeeper::ECCGOST || algo == DNSSECKeeper::ECDSA256 || algo == DNSSECKeeper::ED25519)
 241     bits = 256;
 242   else if(algo == DNSSECKeeper::ECDSA384)
 243     bits = 384;
 244   else if(algo == DNSSECKeeper::ED448)
 245     bits = 456;
 246   else
 247     throw runtime_error("Can't guess key size for algorithm "+std::to_string(algo));
 248
 249   dckeCreate->create(bits);
 250
 251   { // FIXME: this block copy/pasted from makeFromISCString
 252     DNSKEYRecordContent dkrc;
 253     int algorithm = 0;
 254     string sline, key, value, raw;
 255     std::istringstream str(dckeCreate->convertToISC());
 256     map<string, string> stormap;
 257
 258     while(std::getline(str, sline)) {
 259       tie(key,value)=splitField(sline, ':');
 260       trim(value);
 261       if(pdns_iequals(key,"algorithm")) {
 262         algorithm = pdns_stou(value);
 263         stormap["algorithm"]=std::to_string(algorithm);
 264         continue;
 265       } else if (pdns_iequals(key,"pin")) {
 266         stormap["pin"]=value;
 267         continue;
 268       } else if (pdns_iequals(key,"engine")) {
 269         stormap["engine"]=value;
 270         continue;
 271       } else if (pdns_iequals(key,"slot")) {
 272         int slot = std::stoi(value);
 273         stormap["slot"]=std::to_string(slot);
 274         continue;
 275       }  else if (pdns_iequals(key,"label")) {
 276         stormap["label"]=value;
 277         continue;
 278       }
 279       else if(pdns_iequals(key, "Private-key-format"))
 280         continue;
 281       raw.clear();
 282       B64Decode(value, raw);
 283       stormap[toLower(key)]=raw;
 284     }
 285     dckeSign->fromISCMap(dkrc, stormap);
 286     if(!dckeSign->checkKey()) {
 287       throw runtime_error("Verification of key with creator "+dckeCreate->getName()+" with signer "+dckeSign->getName()+" and verifier "+dckeVerify->getName()+" failed");
 288     }
 289   }
 290
 291   string message("Hi! How is life?");
 292
 293   string signature;
 294   DTime dt; dt.set();
 295   for(unsigned int n = 0; n < 100; ++n)
 296     signature = dckeSign->sign(message);
 297   unsigned int udiffSign= dt.udiff()/100, udiffVerify;
 298
 299   dckeVerify->fromPublicKeyString(dckeSign->getPublicKeyString());
 300   if (dckeVerify->getPublicKeyString().compare(dckeSign->getPublicKeyString())) {
 301     throw runtime_error("Comparison of public key loaded into verifier produced by signer failed");
 302   }
 303   dt.set();
 304   if(dckeVerify->verify(message, signature)) {
 305     udiffVerify = dt.udiff();
 306     cerr<<"Signature & verify ok, signature "<<udiffSign<<"usec, verify "<<udiffVerify<<"usec"<<endl;
 307   }
 308   else {
 309     throw runtime_error("Verification of creator "+dckeCreate->getName()+" with signer "+dckeSign->getName()+" and verifier "+dckeVerify->getName()+" failed");
 310   }
 311   return make_pair(udiffSign, udiffVerify);
 312 }
 313
 314 shared_ptr<DNSCryptoKeyEngine> DNSCryptoKeyEngine::makeFromPublicKeyString(unsigned int algorithm, const std::string& content)
 315 {
 316   shared_ptr<DNSCryptoKeyEngine> dpk=make(algorithm);
 317   dpk->fromPublicKeyString(content);
 318   return dpk;
 319 }
 320
 321
 322 shared_ptr<DNSCryptoKeyEngine> DNSCryptoKeyEngine::makeFromPEMString(DNSKEYRecordContent& drc, const std::string& raw)
 323 {
 324
 325   for(const makers_t::value_type& val : getMakers())
 326   {
 327     shared_ptr<DNSCryptoKeyEngine> ret=nullptr;
 328     try {
 329       ret = val.second(val.first);
 330       ret->fromPEMString(drc, raw);
 331       return ret;
 332     }
 333     catch(...)
 334     {
 335     }
 336   }
 337   return 0;
 338 }
 339
 340
 341 static bool sharedDNSSECCompare(const shared_ptr<DNSRecordContent>& a, const shared_ptr<DNSRecordContent>& b)
 342 {
 343   return a->serialize(g_rootdnsname, true, true) < b->serialize(g_rootdnsname, true, true);
 344 }
 345
 346 /**
 347  * Returns the string that should be hashed to create/verify the RRSIG content
 348  *
 349  * @param qname               DNSName of the RRSIG's owner name.
 350  * @param rrc                 The RRSIGRecordContent we take the Type Covered and
 351  *                            original TTL fields from.
 352  * @param signRecords         A vector of DNSRecordContent shared_ptr's that are covered
 353  *                            by the RRSIG, where we get the RDATA from.
 354  * @param processRRSIGLabels  A boolean to trigger processing the RRSIG's "Labels"
 355  *                            field. This is usually only needed for validation
 356  *                            purposes, as the authoritative server correctly
 357  *                            sets qname to the wildcard.
 358  */
 359 string getMessageForRRSET(const DNSName& qname, const RRSIGRecordContent& rrc, vector<shared_ptr<DNSRecordContent> >& signRecords, bool processRRSIGLabels)
 360 {
 361   sort(signRecords.begin(), signRecords.end(), sharedDNSSECCompare);
 362
 363   string toHash;
 364   toHash.append(const_cast<RRSIGRecordContent&>(rrc).serialize(g_rootdnsname, true, true));
 365   toHash.resize(toHash.size() - rrc.d_signature.length()); // chop off the end, don't sign the signature!
 366
 367   string nameToHash(qname.toDNSStringLC());
 368
 369   if (processRRSIGLabels) {
 370     unsigned int rrsig_labels = rrc.d_labels;
 371     unsigned int fqdn_labels = qname.countLabels();
 372
 373     if (rrsig_labels < fqdn_labels) {
 374       DNSName choppedQname(qname);
 375       while (choppedQname.countLabels() > rrsig_labels)
 376         choppedQname.chopOff();
 377       nameToHash = "\x01*" + choppedQname.toDNSStringLC();
 378     } else if (rrsig_labels > fqdn_labels) {
 379       // The RRSIG Labels field is a lie (or the qname is wrong) and the RRSIG
 380       // can never be valid
 381       return "";
 382     }
 383   }
 384
 385   for(shared_ptr<DNSRecordContent>& add :  signRecords) {
 386     toHash.append(nameToHash);
 387     uint16_t tmp=htons(rrc.d_type);
 388     toHash.append((char*)&tmp, 2);
 389     tmp=htons(1); // class
 390     toHash.append((char*)&tmp, 2);
 391     uint32_t ttl=htonl(rrc.d_originalttl);
 392     toHash.append((char*)&ttl, 4);
 393     // for NSEC signatures, we should not lowercase the rdata section
 394     string rdata=add->serialize(g_rootdnsname, true, (add->getType() == QType::NSEC) ? false : true);  // RFC 6840, 5.1
 395     tmp=htons(rdata.length());
 396     toHash.append((char*)&tmp, 2);
 397     toHash.append(rdata);
 398   }
 399
 400   return toHash;
 401 }
 402
 403 bool DNSCryptoKeyEngine::isAlgorithmSupported(unsigned int algo)
 404 {
 405   const makers_t& makers = getMakers();
 406   makers_t::const_iterator iter = makers.find(algo);
 407   return iter != makers.cend();
 408 }
 409
 410 static unsigned int digestToAlgorithmNumber(uint8_t digest)
 411 {
 412   switch(digest) {
 413   case DNSSECKeeper::SHA1:
 414     return DNSSECKeeper::RSASHA1;
 415   case DNSSECKeeper::SHA256:
 416     return DNSSECKeeper::RSASHA256;
 417   case DNSSECKeeper::GOST:
 418     return DNSSECKeeper::ECCGOST;
 419   case DNSSECKeeper::SHA384:
 420     return DNSSECKeeper::ECDSA384;
 421   default:
 422     throw std::runtime_error("Unknown digest type " + std::to_string(digest));
 423   }
 424   return 0;
 425 }
 426
 427 bool DNSCryptoKeyEngine::isDigestSupported(uint8_t digest)
 428 {
 429   try {
 430     unsigned int algo = digestToAlgorithmNumber(digest);
 431     return isAlgorithmSupported(algo);
 432   }
 433   catch(const std::exception& e) {
 434     return false;
 435   }
 436 }
 437
 438 DSRecordContent makeDSFromDNSKey(const DNSName& qname, const DNSKEYRecordContent& drc, uint8_t digest)
 439 {
 440   string toHash;
 441   toHash.assign(qname.toDNSStringLC());
 442   toHash.append(const_cast<DNSKEYRecordContent&>(drc).serialize(DNSName(), true, true));
 443
 444   DSRecordContent dsrc;
 445   try {
 446     unsigned int algo = digestToAlgorithmNumber(digest);
 447     shared_ptr<DNSCryptoKeyEngine> dpk(DNSCryptoKeyEngine::make(algo));
 448     dsrc.d_digest = dpk->hash(toHash);
 449   }
 450   catch(const std::exception& e) {
 451     throw std::runtime_error("Asked to create (C)DS record of unknown digest type " + std::to_string(digest));
 452   }
 453
 454   dsrc.d_algorithm = drc.d_algorithm;
 455   dsrc.d_digesttype = digest;
 456   dsrc.d_tag = const_cast<DNSKEYRecordContent&>(drc).getTag();
 457
 458   return dsrc;
 459 }
 460
 461
 462 static DNSKEYRecordContent makeDNSKEYFromDNSCryptoKeyEngine(const std::shared_ptr<DNSCryptoKeyEngine>& pk, uint8_t algorithm, uint16_t flags)
 463 {
 464   DNSKEYRecordContent drc;
 465
 466   drc.d_protocol=3;
 467   drc.d_algorithm = algorithm;
 468
 469   drc.d_flags=flags;
 470   drc.d_key = pk->getPublicKeyString();
 471
 472   return drc;
 473 }
 474
 475 uint32_t getStartOfWeek()
 476 {
 477   uint32_t now = time(0);
 478   now -= (now % (7*86400));
 479   return now;
 480 }
 481
 482 string hashQNameWithSalt(const NSEC3PARAMRecordContent& ns3prc, const DNSName& qname)
 483 {
 484   return hashQNameWithSalt(ns3prc.d_salt, ns3prc.d_iterations, qname);
 485 }
 486
 487 string hashQNameWithSalt(const std::string& salt, unsigned int iterations, const DNSName& qname)
 488 {
 489   unsigned int times = iterations;
 490   unsigned char hash[20];
 491   string toHash(qname.toDNSStringLC());
 492
 493   for(;;) {
 494     toHash.append(salt);
 495     SHA1((unsigned char*)toHash.c_str(), toHash.length(), hash);
 496     toHash.assign((char*)hash, sizeof(hash));
 497     if(!times--)
 498       break;
 499   }
 500   return toHash;
 501 }
 502
 503 void incrementHash(std::string& raw) // I wonder if this is correct, cmouse? ;-)
 504 {
 505   if(raw.empty())
 506     return;
 507
 508   for(string::size_type pos=raw.size(); pos; ) {
 509     --pos;
 510     unsigned char c = (unsigned char)raw[pos];
 511     ++c;
 512     raw[pos] = (char) c;
 513     if(c)
 514       break;
 515   }
 516 }
 517
 518 void decrementHash(std::string& raw) // I wonder if this is correct, cmouse? ;-)
 519 {
 520   if(raw.empty())
 521     return;
 522
 523   for(string::size_type pos=raw.size(); pos; ) {
 524     --pos;
 525     unsigned char c = (unsigned char)raw[pos];
 526     --c;
 527     raw[pos] = (char) c;
 528     if(c != 0xff)
 529       break;
 530   }
 531 }
 532
 533 DNSKEYRecordContent DNSSECPrivateKey::getDNSKEY() const
 534 {
 535   return makeDNSKEYFromDNSCryptoKeyEngine(getKey(), d_algorithm, d_flags);
 536 }
 537
 538 class DEREater
 539 {
 540 public:
 541   DEREater(const std::string& str) : d_str(str), d_pos(0)
 542   {}
 543
 544   struct eof{};
 545
 546   uint8_t getByte()
 547   {
 548     if(d_pos >= d_str.length()) {
 549       throw eof();
 550     }
 551     return (uint8_t) d_str[d_pos++];
 552   }
 553
 554   uint32_t getLength()
 555   {
 556     uint8_t first = getByte();
 557     if(first < 0x80) {
 558       return first;
 559     }
 560     first &= ~0x80;
 561
 562     uint32_t len=0;
 563     for(int n=0; n < first; ++n) {
 564       len *= 0x100;
 565       len += getByte();
 566     }
 567     return len;
 568   }
 569
 570   std::string getBytes(unsigned int len)
 571   {
 572     std::string ret;
 573     for(unsigned int n=0; n < len; ++n)
 574       ret.append(1, (char)getByte());
 575     return ret;
 576   }
 577
 578   std::string::size_type getOffset()
 579   {
 580     return d_pos;
 581   }
 582 private:
 583   const std::string& d_str;
 584   std::string::size_type d_pos;
 585 };
 586
 587 static string calculateHMAC(const std::string& key, const std::string& text, TSIGHashEnum hasher) {
 588
 589   const EVP_MD* md_type;
 590   unsigned int outlen;
 591   unsigned char hash[EVP_MAX_MD_SIZE];
 592   switch(hasher) {
 593     case TSIG_MD5:
 594       md_type = EVP_md5();
 595       break;
 596     case TSIG_SHA1:
 597       md_type = EVP_sha1();
 598       break;
 599     case TSIG_SHA224:
 600       md_type = EVP_sha224();
 601       break;
 602     case TSIG_SHA256:
 603       md_type = EVP_sha256();
 604       break;
 605     case TSIG_SHA384:
 606       md_type = EVP_sha384();
 607       break;
 608     case TSIG_SHA512:
 609       md_type = EVP_sha512();
 610       break;
 611     default:
 612       throw PDNSException("Unknown hash algorithm requested from calculateHMAC()");
 613   }
 614
 615   unsigned char* out = HMAC(md_type, reinterpret_cast<const unsigned char*>(key.c_str()), key.size(), reinterpret_cast<const unsigned char*>(text.c_str()), text.size(), hash, &outlen);
 616   if (out == NULL || outlen == 0) {
 617     throw PDNSException("HMAC computation failed");
 618   }
 619
 620   return string((char*) hash, outlen);
 621 }
 622
 623 static bool constantTimeStringEquals(const std::string& a, const std::string& b)
 624 {
 625   if (a.size() != b.size()) {
 626     return false;
 627   }
 628   const size_t size = a.size();
 629 #if OPENSSL_VERSION_NUMBER >= 0x0090819fL
 630   return CRYPTO_memcmp(a.c_str(), b.c_str(), size) == 0;
 631 #else
 632   const volatile unsigned char *_a = (const volatile unsigned char *) a.c_str();
 633   const volatile unsigned char *_b = (const volatile unsigned char *) b.c_str();
 634   unsigned char res = 0;
 635
 636   for (size_t idx = 0; idx < size; idx++) {
 637     res |= _a[idx] ^ _b[idx];
 638   }
 639
 640   return res == 0;
 641 #endif
 642 }
 643
 644 static string makeTSIGPayload(const string& previous, const char* packetBegin, size_t packetSize, const DNSName& tsigKeyName, const TSIGRecordContent& trc, bool timersonly)
 645 {
 646   string message;
 647
 648   if(!previous.empty()) {
 649     uint16_t len = htons(previous.length());
 650     message.append(reinterpret_cast<const char*>(&len), sizeof(len));
 651     message.append(previous);
 652   }
 653
 654   message.append(packetBegin, packetSize);
 655
 656   vector<uint8_t> signVect;
 657   DNSPacketWriter dw(signVect, DNSName(), 0);
 658   auto pos=signVect.size();
 659   if(!timersonly) {
 660     dw.xfrName(tsigKeyName, false);
 661     dw.xfr16BitInt(QClass::ANY); // class
 662     dw.xfr32BitInt(0);    // TTL
 663     dw.xfrName(trc.d_algoName.makeLowerCase(), false);
 664   }
 665
 666   uint32_t now = trc.d_time;
 667   dw.xfr48BitInt(now);
 668   dw.xfr16BitInt(trc.d_fudge); // fudge
 669   if(!timersonly) {
 670     dw.xfr16BitInt(trc.d_eRcode); // extended rcode
 671     dw.xfr16BitInt(trc.d_otherData.length()); // length of 'other' data
 672     //    dw.xfrBlob(trc->d_otherData);
 673   }
 674   message.append(signVect.begin()+pos, signVect.end());
 675   return message;
 676 }
 677
 678 static string makeTSIGMessageFromTSIGPacket(const string& opacket, unsigned int tsigOffset, const DNSName& keyname, const TSIGRecordContent& trc, const string& previous, bool timersonly, unsigned int dnsHeaderOffset=0)
 679 {
 680   string message;
 681   string packet(opacket);
 682
 683   packet.resize(tsigOffset); // remove the TSIG record at the end as per RFC2845 3.4.1
 684   packet[(dnsHeaderOffset + sizeof(struct dnsheader))-1]--; // Decrease ARCOUNT because we removed the TSIG RR in the previous line.
 685
 686
 687   // Replace the message ID with the original message ID from the TSIG record.
 688   // This is needed for forwarded DNS Update as they get a new ID when forwarding (section 6.1 of RFC2136). The TSIG record stores the original ID and the
 689   // signature was created with the original ID, so we replace it here to get the originally signed message.
 690   // If the message is not forwarded, we simply override it with the same id.
 691   uint16_t origID = htons(trc.d_origID);
 692   packet.replace(0, 2, (char*)&origID, 2);
 693
 694   return makeTSIGPayload(previous, packet.data(), packet.size(), keyname, trc, timersonly);
 695 }
 696
 697 void addTSIG(DNSPacketWriter& pw, TSIGRecordContent& trc, const DNSName& tsigkeyname, const string& tsigsecret, const string& tsigprevious, bool timersonly)
 698 {
 699   TSIGHashEnum algo;
 700   if (!getTSIGHashEnum(trc.d_algoName, algo)) {
 701     throw PDNSException(string("Unsupported TSIG HMAC algorithm ") + trc.d_algoName.toLogString());
 702   }
 703
 704   string toSign = makeTSIGPayload(tsigprevious, reinterpret_cast<const char*>(pw.getContent().data()), pw.getContent().size(), tsigkeyname, trc, timersonly);
 705
 706   if (algo == TSIG_GSS) {
 707     if (!gss_add_signature(tsigkeyname, toSign, trc.d_mac)) {
 708       throw PDNSException(string("Could not add TSIG signature with algorithm 'gss-tsig' and key name '")+tsigkeyname.toLogString()+string("'"));
 709     }
 710   } else {
 711     trc.d_mac = calculateHMAC(tsigsecret, toSign, algo);
 712     //  trc.d_mac[0]++; // sabotage
 713   }
 714   pw.startRecord(tsigkeyname, QType::TSIG, 0, QClass::ANY, DNSResourceRecord::ADDITIONAL, false);
 715   trc.toPacket(pw);
 716   pw.commit();
 717 }
 718
 719 bool validateTSIG(const std::string& packet, size_t sigPos, const TSIGTriplet& tt, const TSIGRecordContent& trc, const std::string& previousMAC, const std::string& theirMAC, bool timersOnly, unsigned int dnsHeaderOffset)
 720 {
 721   uint64_t delta = std::abs((int64_t)trc.d_time - (int64_t)time(nullptr));
 722   if(delta > trc.d_fudge) {
 723     throw std::runtime_error("Invalid TSIG time delta " + std::to_string(delta) + " >  fudge " + std::to_string(trc.d_fudge));
 724   }
 725
 726   TSIGHashEnum algo;
 727   if (!getTSIGHashEnum(trc.d_algoName, algo)) {
 728     throw std::runtime_error("Unsupported TSIG HMAC algorithm " + trc.d_algoName.toLogString());
 729   }
 730
 731   TSIGHashEnum expectedAlgo;
 732   if (!getTSIGHashEnum(tt.algo, expectedAlgo)) {
 733     throw std::runtime_error("Unsupported TSIG HMAC algorithm expected " + tt.algo.toLogString());
 734   }
 735
 736   if (algo != expectedAlgo) {
 737     throw std::runtime_error("Signature with TSIG key '"+tt.name.toLogString()+"' does not match the expected algorithm (" + tt.algo.toLogString() + " / " + trc.d_algoName.toLogString() + ")");
 738   }
 739
 740   string tsigMsg;
 741   tsigMsg = makeTSIGMessageFromTSIGPacket(packet, sigPos, tt.name, trc, previousMAC, timersOnly, dnsHeaderOffset);
 742
 743   if (algo == TSIG_GSS) {
 744     GssContext gssctx(tt.name);
 745     if (!gss_verify_signature(tt.name, tsigMsg, theirMAC)) {
 746       throw std::runtime_error("Signature with TSIG key '"+tt.name.toLogString()+"' failed to validate");
 747     }
 748   } else {
 749     string ourMac = calculateHMAC(tt.secret, tsigMsg, algo);
 750
 751     if(!constantTimeStringEquals(ourMac, theirMAC)) {
 752       throw std::runtime_error("Signature with TSIG key '"+tt.name.toLogString()+"' failed to validate");
 753     }
 754   }
 755
 756   return true;
 757 }