hmac-sha256 tsig option as specified as mandatory in rfc4635

diff --git a/drill/drill.c b/drill/drill.c
index 3f047963d0ab0298e2b63340c05a11d8b430473f..7a17ec2fe77e4bf50c11193f3d8c9f03b7307ee1 100644 (file)
--- a/drill/drill.c
+++ b/drill/drill.c
@@ -61,7 +61,7 @@ usage(FILE *stream, const char *progname)
        fprintf(stream, "\t-r <file>\t\tuse file as root servers hint file\n");
        fprintf(stream, "\t-t\t\tsend the query with tcp (connected)\n");
        fprintf(stream, "\t-d <domain>\t\tuse domain as the start point for the trace\n");
-        fprintf(stream, "\t-y <name:key[:algo]>\tspecify named base64 tsig key, and optional an\n\t\t\talgorithm (defaults to hmac-md5.sig-alg.reg.int)\n");
+    fprintf(stream, "\t-y <name:key[:algo]>\tspecify named base64 tsig key, and optional an\n\t\t\talgorithm (defaults to hmac-md5.sig-alg.reg.int)\n");
        fprintf(stream, "\t-z\t\tdon't randomize the nameservers before use\n");
        fprintf(stream, "\n  [*] = enables/implies DNSSEC\n");
        fprintf(stream, "  [**] = can be given more than once\n");

diff --git a/examples/ldns-keygen.c b/examples/ldns-keygen.c
index 2172e8500253db5baa2f2097f5771732ea7c0b4e..931469dd7a7383d358d4c9c19457042ced6c0b04 100644 (file)
--- a/examples/ldns-keygen.c
+++ b/examples/ldns-keygen.c
@@ -19,11 +19,6 @@ usage(FILE *fp, char *prog) {
        fprintf(fp, "  generate a new key pair for domain\n");
        fprintf(fp, "  -a <alg>\tuse the specified algorithm (-a list to");
        fprintf(fp, " show a list)\n");
-       /*
-       fprintf(fp, "  -D\t\tgenerate a DSA key\n");
-       fprintf(fp, "  -R\t\tgenerate an RSA key\n");
-       fprintf(fp, "  -H\t\tgenerate an HMAC-MD5 key (for TSIG)\n");
-       */
        fprintf(fp, "  -k\t\tset the flags to 257; key signing key\n");
        fprintf(fp, "  -b <bits>\tspecify the keylength\n");
        fprintf(fp, "  -r <random>\tspecify a random device (defaults to /dev/random)\n");
@@ -160,6 +155,7 @@ main(int argc, char *argv[])
                break;
        case LDNS_SIGN_HMACMD5:
        case LDNS_SIGN_HMACSHA1:
+       case LDNS_SIGN_HMACSHA256:
        default:
                break;
        }
@@ -241,7 +237,9 @@ main(int argc, char *argv[])
        }
        
        /* print the DS to .ds */
-       if (algorithm != LDNS_SIGN_HMACMD5) {
+       if (algorithm != LDNS_SIGN_HMACMD5 &&
+               algorithm != LDNS_SIGN_HMACSHA1 &&
+               algorithm != LDNS_SIGN_HMACSHA256) {
                filename = LDNS_XMALLOC(char, strlen(owner) + 16);
                snprintf(filename, strlen(owner) + 15, "K%s+%03u+%05u.ds", owner, algorithm, (unsigned int) ldns_key_keytag(key));
                file = fopen(filename, "w");

diff --git a/host2str.c b/host2str.c
index 77db9c60526c9d83ebe7b4b58ea0d7e29d88f47b..aa4ed33908f40636e9434826a7e07ef5fd03e516 100644 (file)
--- a/host2str.c
+++ b/host2str.c
@@ -1139,6 +1139,24 @@ ldns_pkt2buffer_str(ldns_buffer *output, const ldns_pkt *pkt)
        return status;
 }
 
+static ldns_status
+ldns_hmac_key2buffer_str(ldns_buffer *output, const ldns_key *k)
+{
+       ldns_status status;
+       size_t i;
+       ldns_rdf *b64_bignum;
+       
+       ldns_buffer_printf(output, "Key: ");
+
+       i = ldns_key_hmac_size(k);
+       b64_bignum =  ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, i, ldns_key_hmac_key(k));
+       status = ldns_rdf2buffer_str(output, b64_bignum);
+       ldns_rdf_deep_free(b64_bignum);
+       ldns_buffer_printf(output, "\n");
+       return status;
+}
+
+
 ldns_status
 ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k)
 {
@@ -1423,30 +1441,21 @@ ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k)
                                }
                                break;
                        case LDNS_SIGN_HMACMD5:
-                               /* is the filefmt specified for TSIG.. don't know */
-                               ldns_buffer_printf(output, "Private-key-format: v1.2\n");
-                               ldns_buffer_printf(output, "Algorithm: 157 (HMAC_MD5)\n");
-                               ldns_buffer_printf(output, "Key: ");
-                               i = ldns_key_hmac_size(k);
-                               b64_bignum =  ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, i, ldns_key_hmac_key(k));
-                               if (ldns_rdf2buffer_str(output, b64_bignum) != LDNS_STATUS_OK) {
-                                       goto error;
-                               }
-                               ldns_rdf_deep_free(b64_bignum);
-                               ldns_buffer_printf(output, "\n"); 
+                               /* there's not much of a format defined for TSIG */
+                               /* It's just a binary blob, Same for all algorithms */
+                ldns_buffer_printf(output, "Private-key-format: v1.2\n");
+                ldns_buffer_printf(output, "Algorithm: 157 (HMAC_MD5)\n");
+                               status = ldns_hmac_key2buffer_str(output, k);
                                break;
                        case LDNS_SIGN_HMACSHA1:
-                               /* is the filefmt specified for TSIG.. don't know */
-                               ldns_buffer_printf(output, "Private-key-format: v1.2\n");
-                               ldns_buffer_printf(output, "Algorithm: 158 (HMAC_SHA1)\n");
-                               ldns_buffer_printf(output, "Key: ");
-                               i = ldns_key_hmac_size(k);
-                               b64_bignum =  ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, i, ldns_key_hmac_key(k));
-                               if (ldns_rdf2buffer_str(output, b64_bignum) != LDNS_STATUS_OK) {
-                                       goto error;
-                               }
-                               ldns_rdf_deep_free(b64_bignum);
-                               ldns_buffer_printf(output, "\n");
+                       ldns_buffer_printf(output, "Private-key-format: v1.2\n");
+                       ldns_buffer_printf(output, "Algorithm: 158 (HMAC_SHA1)\n");
+                               status = ldns_hmac_key2buffer_str(output, k);
+                               break;
+                       case LDNS_SIGN_HMACSHA256:
+                       ldns_buffer_printf(output, "Private-key-format: v1.2\n");
+                       ldns_buffer_printf(output, "Algorithm: 158 (HMAC_SHA256)\n");
+                               status = ldns_hmac_key2buffer_str(output, k);
                                break;
                }
 #endif /* HAVE_SSL */

diff --git a/keys.c b/keys.c
index 0b8c98786f8d68360c4b5f1fa880c2dae7841745..d2f0233f870a546ac5b80784644b340c70c5579d 100644 (file)
--- a/keys.c
+++ b/keys.c
@@ -30,6 +30,7 @@ ldns_lookup_table ldns_signing_algorithms[] = {
         { LDNS_SIGN_DSA, "DSA" },
         { LDNS_SIGN_HMACMD5, "hmac-md5.sig-alg.reg.int" },
         { LDNS_SIGN_HMACSHA1, "hmac-sha1" },
+        { LDNS_SIGN_HMACSHA256, "hmac-sha256" },
         { 0, NULL }
 };
 
@@ -183,6 +184,9 @@ ldns_key_new_frm_fp_l(ldns_key **key, FILE *fp, int *line_nr)
        if (strncmp(d, "158 HMAC-SHA1", 4) == 0) {
                alg = LDNS_SIGN_HMACSHA1;
        }
+       if (strncmp(d, "159 HMAC-SHA256", 4) == 0) {
+               alg = LDNS_SIGN_HMACSHA256;
+       }
 
        LDNS_FREE(d);
 
@@ -208,6 +212,7 @@ ldns_key_new_frm_fp_l(ldns_key **key, FILE *fp, int *line_nr)
                        break;
                case LDNS_SIGN_HMACMD5:
                case LDNS_SIGN_HMACSHA1:
+               case LDNS_SIGN_HMACSHA256:
                        ldns_key_set_algorithm(k, alg);
                        hmac = ldns_key_new_frm_fp_hmac_l(fp, line_nr, &hmac_size);
                        ldns_key_set_hmac_size(k, hmac_size);
@@ -532,6 +537,7 @@ ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size)
                        break;
                case LDNS_SIGN_HMACMD5:
                case LDNS_SIGN_HMACSHA1:
+               case LDNS_SIGN_HMACSHA256:
                        k->_key.key = NULL;
                        size = size / 8;
                        ldns_key_set_hmac_size(k, size);
@@ -914,6 +920,7 @@ ldns_key2rr(const ldns_key *k)
        switch (ldns_key_algorithm(k)) {
        case LDNS_SIGN_HMACMD5:
        case LDNS_SIGN_HMACSHA1:
+       case LDNS_SIGN_HMACSHA256:
                ldns_rr_set_type(pubkey, LDNS_RR_TYPE_KEY);
                break;
        default:
@@ -974,6 +981,7 @@ ldns_key2rr(const ldns_key *k)
                        break;
                case LDNS_SIGN_HMACMD5:
                case LDNS_SIGN_HMACSHA1:
+               case LDNS_SIGN_HMACSHA256:
                        /* tja */
                        ldns_rr_push_rdf(pubkey,
                                         ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG,

diff --git a/ldns/keys.h b/ldns/keys.h
index a9cfd21c594cd180fe01c5fcc848c52d66640abf..2b1af6c13509279c6a325d29a29200452f914c76 100644 (file)
--- a/ldns/keys.h
+++ b/ldns/keys.h
@@ -77,7 +77,8 @@ enum ldns_enum_signing_algorithm
        LDNS_SIGN_RSASHA1_NSEC3  = LDNS_RSASHA1_NSEC3,
        LDNS_SIGN_DSA_NSEC3      = LDNS_DSA_NSEC3,
        LDNS_SIGN_HMACMD5        = 157, /* not official! This type is for TSIG, not DNSSEC */
-       LDNS_SIGN_HMACSHA1       = 158  /* not official! This type is for TSIG, not DNSSEC */
+       LDNS_SIGN_HMACSHA1       = 158, /* not official! This type is for TSIG, not DNSSEC */
+       LDNS_SIGN_HMACSHA256 = 159  /* ditto */
 };
 typedef enum ldns_enum_signing_algorithm ldns_signing_algorithm;
 

diff --git a/tsig.c b/tsig.c
index bd66129bfef20beb291d6c2dc6cc60ea3a3a1432..08459b04a5c2bd74055b5c57a1c7cf8eb4c2c39d 100644 (file)
--- a/tsig.c
+++ b/tsig.c
@@ -126,10 +126,15 @@ ldns_tsig_prepare_pkt_wire(uint8_t *wire, size_t wire_len, size_t *result_len)
 static const EVP_MD *
 ldns_digest_function(char *name)
 {
-       /* TODO replace with openssl's EVP_get_digestbyname
-               (need init somewhere for that)
-       */
-       if (strlen(name) == 10 && strncasecmp(name, "hmac-sha1.", 9) == 0)
+       /* these are the mandatory algorithms from RFC4635 */
+       /* The optional algorithms are not yet implemented */   
+       if (strlen(name) == 12 && strncasecmp(name, "hmac-sha256.", 11) == 0) {
+#ifdef SHA256_DIGEST_LENGTH
+               return EVP_sha256();
+#else
+               return NULL;    
+#endif         
+       } else if (strlen(name) == 10 && strncasecmp(name, "hmac-sha1.", 9) == 0)
                return EVP_sha1();
        else if (strlen(name) == 25 && strncasecmp(name,
                     "hmac-md5.sig-alg.reg.int.", 25) == 0)