add key derivatin from password, add ipencrypt/ipdecrypt to pdnsutil & document it

diff --git a/docs/manpages/pdnsutil.1.rst b/docs/manpages/pdnsutil.1.rst
index 2a5511665b98deeeb3c0b5c29d246c27cd481d8a..3b02ccfbc75d3e3011c41bb237477b4bc35cbe84 100644 (file)
--- a/docs/manpages/pdnsutil.1.rst
+++ b/docs/manpages/pdnsutil.1.rst
@@ -232,6 +232,14 @@ bench-db [*FILE*]
     *FILE* can be a file with a list, one per line, of domain names to use for this.
     If *FILE* is not specified, powerdns.com is used.
 
+OTHER TOOLS
+-----------
+ipencrypt *IP-ADDRESS* passsword
+    Encrypt an IP address according to the 'ipcipher' standard
+
+ipdecrypt *IP-ADDRESS* passsword
+    Encrypt an IP address according to the 'ipcipher' standard
+
 See also
 --------
 

diff --git a/pdns/Makefile.am b/pdns/Makefile.am
index 0e8c9eb1fa5f3e2181847c260030d12291d8c4d5..2f3feae43e8e021e2188d36409adebe3e58b9a58 100644 (file)
--- a/pdns/Makefile.am
+++ b/pdns/Makefile.am
@@ -312,6 +312,7 @@ pdnsutil_SOURCES = \
        ednsoptions.cc ednsoptions.hh \
        ednssubnet.cc \
        gss_context.cc gss_context.hh \
+       ipcrypt.cc ipcrypt.hh ../ext/ipcrypt/ipcrypt.c ../ext/ipcrypt/ipcrypt.h \
        iputils.cc iputils.hh \
        json.cc \
        logger.cc \

diff --git a/pdns/ipcrypt.cc b/pdns/ipcrypt.cc
index 394843d863339c524670cd55842b7d5c0be4e9de..173ec4d69bdfe9059ec1540acccc61f3e2c658c9 100644 (file)
--- a/pdns/ipcrypt.cc
+++ b/pdns/ipcrypt.cc
@@ -1,6 +1,21 @@
 #include "ipcrypt.hh"
 #include "ext/ipcrypt/ipcrypt.h"
 #include <openssl/aes.h>
+#include <openssl/evp.h>
+
+/*
+int PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen,
+                           const unsigned char *salt, int saltlen, int iter,
+                           int keylen, unsigned char *out);
+*/
+std::string makeIPCryptKey(const std::string& password)
+{
+  static const char* salt="ipcryptipcrypt";
+  unsigned char out[16];
+  PKCS5_PBKDF2_HMAC_SHA1(password.c_str(), password.size(), (const unsigned char*)salt, sizeof(salt), 50000, sizeof(out), out);
+
+  return std::string((const char*)out, (const char*)out + sizeof(out));
+}
 
 static ComboAddress encryptCA4(const ComboAddress& ca, const std::string &key)
 {

diff --git a/pdns/ipcrypt.hh b/pdns/ipcrypt.hh
index 1c9faedd313f53b88b28fcc4b04ddeec6ad79157..cbb8dc5387b67ef3d8ae47e04e3e722dd5cdb635 100644 (file)
--- a/pdns/ipcrypt.hh
+++ b/pdns/ipcrypt.hh
@@ -4,3 +4,4 @@
 
 ComboAddress encryptCA(const ComboAddress& ca, const std::string& key);
 ComboAddress decryptCA(const ComboAddress& ca, const std::string& key);
+std::string makeIPCryptKey(const std::string& password);

diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index cd753330f5d51590d82b825f6bf50e9289bfed4b..8bd356204aa96bdf364e5a5a83e5ffde2b2070a4 100644 (file)
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -20,6 +20,7 @@
 #include "zoneparser-tng.hh"
 #include "signingpipe.hh"
 #include "dns_random.hh"
+#include "ipcrypt.hh"
 #include <fstream>
 #include <termios.h>            //termios, TCSANOW, ECHO, ICANON
 #include "opensslsigners.hh"
@@ -1002,6 +1003,20 @@ int editZone(DNSSECKeeper& dk, const DNSName &zone) {
   return EXIT_SUCCESS;
 }
 
+static int xcryptIP(const std::string& cmd, const std::string& ip, const std::string& key)
+{
+  string rkey = makeIPCryptKey(key);
+  ComboAddress ca(ip), ret;
+  
+  if(cmd=="ipencrypt")
+    ret = encryptCA(ca, rkey);
+  else
+    ret = decryptCA(ca, rkey);
+
+  cout<<ret.toString()<<endl;
+  return EXIT_SUCCESS;
+}
+
 
 int loadZone(DNSName zone, const string& fname) {
   UeberBackend B;
@@ -1956,6 +1971,8 @@ try
     cout<<"import-tsig-key NAME ALGORITHM KEY Import TSIG key"<<endl;
     cout<<"import-zone-key ZONE FILE          Import from a file a private key, ZSK or KSK"<<endl;
     cout<<"       [active|inactive] [ksk|zsk]  Defaults to KSK and active"<<endl;
+    cout<<"ipdecrypt IP key                   Encrypt an IP address using 'key' (string or base64)"<<endl;    
+    cout<<"ipencrypt IP key                   Encrypt an IP address using 'key' (string or base64)"<<endl;
     cout<<"load-zone ZONE FILE                Load ZONE from FILE, possibly creating zone or atomically"<<endl;
     cout<<"                                   replacing contents"<<endl;
     cout<<"list-algorithms [with-backend]     List all DNSSEC algorithms supported, optionally also listing the crypto library used"<<endl;
@@ -2004,6 +2021,15 @@ try
     return 1;
   }
 
+  if(cmds[0] == "ipencrypt" || cmds[0]=="ipdecrypt") {
+    if(cmds.size() != 3) {
+      cerr<<"Syntax: pdnsutil [ipencrypt|ipdecrypt] IP password"<<endl;
+      return 0;
+    }
+    exit(xcryptIP(cmds[0], cmds[1], cmds[2]));
+  }
+
+
   if(cmds[0] == "test-algorithms") {
     if (testAlgorithms())
       return 0;