Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. =================================================================== RCS file: /ftp/cvs/cvsroot/src/external/mpl/bind/dist/lib/dns/tkey.c,v rcsdiff: /ftp/cvs/cvsroot/src/external/mpl/bind/dist/lib/dns/tkey.c,v: warning: Unknown phrases like `commitid ...;' are present. retrieving revision 1.1.1.1 retrieving revision 1.1.1.2 diff -u -p -r1.1.1.1 -r1.1.1.2 --- src/external/mpl/bind/dist/lib/dns/tkey.c 2018/08/12 12:08:14 1.1.1.1 +++ src/external/mpl/bind/dist/lib/dns/tkey.c 2019/01/09 16:48:21 1.1.1.2 @@ -1,4 +1,4 @@ -/* $NetBSD: tkey.c,v 1.1.1.1 2018/08/12 12:08:14 christos Exp $ */ +/* $NetBSD: tkey.c,v 1.1.1.2 2019/01/09 16:48:21 christos Exp $ */ /* * Copyright (C) Internet Systems Consortium, Inc. ("ISC") @@ -14,11 +14,15 @@ /*! \file */ #include +#include +#include + #include -#include -#include +#include #include +#include #include +#include #include #include @@ -46,7 +50,7 @@ #define TEMP_BUFFER_SZ 8192 #define TKEY_RANDOM_AMOUNT 16 -#ifdef PKCS11CRYPTO +#if USE_PKCS11 #include #endif @@ -105,12 +109,11 @@ dumpmessage(dns_message_t *msg) { } isc_result_t -dns_tkeyctx_create(isc_mem_t *mctx, isc_entropy_t *ectx, dns_tkeyctx_t **tctxp) +dns_tkeyctx_create(isc_mem_t *mctx, dns_tkeyctx_t **tctxp) { dns_tkeyctx_t *tctx; REQUIRE(mctx != NULL); - REQUIRE(ectx != NULL); REQUIRE(tctxp != NULL && *tctxp == NULL); tctx = isc_mem_get(mctx, sizeof(dns_tkeyctx_t)); @@ -118,8 +121,6 @@ dns_tkeyctx_create(isc_mem_t *mctx, isc_ return (ISC_R_NOMEMORY); tctx->mctx = NULL; isc_mem_attach(mctx, &tctx->mctx); - tctx->ectx = NULL; - isc_entropy_attach(ectx, &tctx->ectx); tctx->dhkey = NULL; tctx->domain = NULL; tctx->gsscred = NULL; @@ -151,7 +152,6 @@ dns_tkeyctx_destroy(dns_tkeyctx_t **tctx } if (tctx->gsscred != NULL) dst_gssapi_releasecred(&tctx->gsscred); - isc_entropy_detach(&tctx->ectx); isc_mem_put(mctx, tctx, sizeof(dns_tkeyctx_t)); isc_mem_detach(&mctx); *tctxp = NULL; @@ -159,7 +159,7 @@ dns_tkeyctx_destroy(dns_tkeyctx_t **tctx static isc_result_t add_rdata_to_list(dns_message_t *msg, dns_name_t *name, dns_rdata_t *rdata, - isc_uint32_t ttl, dns_namelist_t *namelist) + uint32_t ttl, dns_namelist_t *namelist) { isc_result_t result; isc_region_t r, newr; @@ -238,59 +238,112 @@ static isc_result_t compute_secret(isc_buffer_t *shared, isc_region_t *queryrandomness, isc_region_t *serverrandomness, isc_buffer_t *secret) { -#ifndef PK11_MD5_DISABLE - isc_md5_t md5ctx; + isc_md_t *md; isc_region_t r, r2; - unsigned char digests[32]; + unsigned char digests[ISC_MAX_MD_SIZE*2]; + unsigned char *digest1, *digest2; + unsigned int digestslen, digestlen1 = 0, digestlen2 = 0; unsigned int i; + isc_result_t result; isc_buffer_usedregion(shared, &r); + md = isc_md_new(); + if (md == NULL) { + return (ISC_R_NOSPACE); + } + /* * MD5 ( query data | DH value ). */ - isc_md5_init(&md5ctx); - isc_md5_update(&md5ctx, queryrandomness->base, - queryrandomness->length); - isc_md5_update(&md5ctx, r.base, r.length); - isc_md5_final(&md5ctx, digests); + digest1 = digests; + + result = isc_md_init(md, ISC_MD_MD5); + if (result != ISC_R_SUCCESS) { + goto end; + } + + result = isc_md_update(md, + queryrandomness->base, + queryrandomness->length); + if (result != ISC_R_SUCCESS) { + goto end; + } + + result = isc_md_update(md, r.base, r.length); + if (result != ISC_R_SUCCESS) { + goto end; + } + + result = isc_md_final(md, digest1, &digestlen1); + if (result != ISC_R_SUCCESS) { + goto end; + } + + result = isc_md_reset(md); + if (result != ISC_R_SUCCESS) { + goto end; + } /* * MD5 ( server data | DH value ). */ - isc_md5_init(&md5ctx); - isc_md5_update(&md5ctx, serverrandomness->base, - serverrandomness->length); - isc_md5_update(&md5ctx, r.base, r.length); - isc_md5_final(&md5ctx, &digests[ISC_MD5_DIGESTLENGTH]); + digest2 = digests + digestlen1; + + result = isc_md_init(md, ISC_MD_MD5); + if (result != ISC_R_SUCCESS) { + goto end; + } + + result = isc_md_update(md, + serverrandomness->base, + serverrandomness->length); + if (result != ISC_R_SUCCESS) { + goto end; + } + + result = isc_md_update(md, r.base, r.length); + if (result != ISC_R_SUCCESS) { + goto end; + } + + result = isc_md_final(md, digest2, &digestlen2); + if (result != ISC_R_SUCCESS) { + goto end; + } + + isc_md_free(md); + md = NULL; + + digestslen = digestlen1 + digestlen2; /* * XOR ( DH value, MD5-1 | MD5-2). */ isc_buffer_availableregion(secret, &r); isc_buffer_usedregion(shared, &r2); - if (r.length < sizeof(digests) || r.length < r2.length) + if (r.length < digestslen || r.length < r2.length) { return (ISC_R_NOSPACE); - if (r2.length > sizeof(digests)) { + } + if (r2.length > digestslen) { memmove(r.base, r2.base, r2.length); - for (i = 0; i < sizeof(digests); i++) + for (i = 0; i < digestslen; i++) { r.base[i] ^= digests[i]; + } isc_buffer_add(secret, r2.length); } else { - memmove(r.base, digests, sizeof(digests)); - for (i = 0; i < r2.length; i++) + memmove(r.base, digests, digestslen); + for (i = 0; i < r2.length; i++) { r.base[i] ^= r2.base[i]; - isc_buffer_add(secret, sizeof(digests)); + } + isc_buffer_add(secret, digestslen); } - return (ISC_R_SUCCESS); -#else - UNUSED(shared); - UNUSED(queryrandomness); - UNUSED(serverrandomness); - UNUSED(secret); - - return (ISC_R_NOTIMPLEMENTED); -#endif + result = ISC_R_SUCCESS; +end: + if (md != NULL) { + isc_md_free(md); + } + return (result); } static isc_result_t @@ -303,7 +356,7 @@ process_dhtkey(dns_message_t *msg, dns_n dns_name_t *keyname, ourname; dns_rdataset_t *keyset = NULL; dns_rdata_t keyrdata = DNS_RDATA_INIT, ourkeyrdata = DNS_RDATA_INIT; - isc_boolean_t found_key = ISC_FALSE, found_incompatible = ISC_FALSE; + bool found_key = false, found_incompatible = false; dst_key_t *pubkey = NULL; isc_buffer_t ourkeybuf, *shared = NULL; isc_region_t r, r2, ourkeyr; @@ -319,18 +372,12 @@ process_dhtkey(dns_message_t *msg, dns_n return (DNS_R_REFUSED); } -#ifndef PK11_MD5_DISABLE if (!dns_name_equal(&tkeyin->algorithm, DNS_TSIG_HMACMD5_NAME)) { tkey_log("process_dhtkey: algorithms other than " "hmac-md5 are not supported"); tkeyout->error = dns_tsigerror_badalg; return (ISC_R_SUCCESS); } -#else - tkey_log("process_dhtkey: MD5 was disabled"); - tkeyout->error = dns_tsigerror_badalg; - return (ISC_R_SUCCESS); -#endif /* * Look for a DH KEY record that will work with ours. @@ -357,17 +404,15 @@ process_dhtkey(dns_message_t *msg, dns_n dns_rdata_reset(&keyrdata); continue; } -#ifndef PK11_DH_DISABLE if (dst_key_alg(pubkey) == DNS_KEYALG_DH) { if (dst_key_paramcompare(pubkey, tctx->dhkey)) { - found_key = ISC_TRUE; + found_key = true; ttl = keyset->ttl; break; } else - found_incompatible = ISC_TRUE; + found_incompatible = true; } -#endif dst_key_free(&pubkey); dns_rdata_reset(&keyrdata); } @@ -417,13 +462,7 @@ process_dhtkey(dns_message_t *msg, dns_n if (randomdata == NULL) goto failure; - result = dst__entropy_getdata(randomdata, TKEY_RANDOM_AMOUNT, - ISC_FALSE); - if (result != ISC_R_SUCCESS) { - tkey_log("process_dhtkey: failed to obtain entropy: %s", - isc_result_totext(result)); - goto failure; - } + isc_nonce_buf(randomdata, TKEY_RANDOM_AMOUNT); r.base = randomdata; r.length = TKEY_RANDOM_AMOUNT; @@ -435,7 +474,7 @@ process_dhtkey(dns_message_t *msg, dns_n RETERR(dns_tsigkey_create(name, &tkeyin->algorithm, isc_buffer_base(&secret), isc_buffer_usedlength(&secret), - ISC_TRUE, signer, tkeyin->inception, + true, signer, tkeyin->inception, tkeyin->expire, ring->mctx, ring, NULL)); /* This key is good for a long time */ @@ -535,7 +574,7 @@ process_gsstkey(dns_name_t *name, dns_rd #ifdef GSSAPI OM_uint32 gret, minor, lifetime; #endif - isc_uint32_t expire; + uint32_t expire; RETERR(dst_key_fromgssapi(name, gss_ctx, ring->mctx, &dstkey, &intoken)); @@ -550,7 +589,7 @@ process_gsstkey(dns_name_t *name, dns_rd expire = now + lifetime; #endif RETERR(dns_tsigkey_createfromkey(name, &tkeyin->algorithm, - dstkey, ISC_TRUE, principal, + dstkey, true, principal, now, expire, ring->mctx, ring, NULL)); dst_key_free(&dstkey); @@ -649,7 +688,7 @@ dns_tkey_processquery(dns_message_t *msg { isc_result_t result = ISC_R_SUCCESS; dns_rdata_tkey_t tkeyin, tkeyout; - isc_boolean_t freetkeyin = ISC_FALSE; + bool freetkeyin = false; dns_name_t *qname, *name, *keyname, *signer, tsigner; dns_fixedname_t fkeyname; dns_rdataset_t *tkeyset; @@ -705,7 +744,7 @@ dns_tkey_processquery(dns_message_t *msg dns_rdataset_current(tkeyset, &rdata); RETERR(dns_rdata_tostruct(&rdata, &tkeyin, NULL)); - freetkeyin = ISC_TRUE; + freetkeyin = true; if (tkeyin.error != dns_rcode_noerror) { result = DNS_R_FORMERR; @@ -778,12 +817,7 @@ dns_tkey_processquery(dns_message_t *msg isc_buffer_t b; unsigned int i, j; - result = isc_entropy_getdata(tctx->ectx, - randomdata, - sizeof(randomdata), - NULL, 0); - if (result != ISC_R_SUCCESS) - goto failure; + isc_nonce_buf(randomdata, sizeof(randomdata)); for (i = 0, j = 0; i < sizeof(randomdata); i++) { unsigned char val = randomdata[i]; @@ -855,7 +889,7 @@ dns_tkey_processquery(dns_message_t *msg if (freetkeyin) { dns_rdata_freestruct(&tkeyin); - freetkeyin = ISC_FALSE; + freetkeyin = false; } if (tkeyout.key != NULL) @@ -867,7 +901,7 @@ dns_tkey_processquery(dns_message_t *msg RETERR(add_rdata_to_list(msg, keyname, &rdata, 0, &namelist)); - RETERR(dns_message_reply(msg, ISC_TRUE)); + RETERR(dns_message_reply(msg, true)); name = ISC_LIST_HEAD(namelist); while (name != NULL) { @@ -889,7 +923,7 @@ dns_tkey_processquery(dns_message_t *msg static isc_result_t buildquery(dns_message_t *msg, const dns_name_t *name, - dns_rdata_tkey_t *tkey, isc_boolean_t win2k) + dns_rdata_tkey_t *tkey, bool win2k) { dns_name_t *qname = NULL, *aname = NULL; dns_rdataset_t *question = NULL, *tkeyset = NULL; @@ -973,7 +1007,7 @@ buildquery(dns_message_t *msg, const dns isc_result_t dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, const dns_name_t *name, const dns_name_t *algorithm, - isc_buffer_t *nonce, isc_uint32_t lifetime) + isc_buffer_t *nonce, uint32_t lifetime) { dns_rdata_tkey_t tkey; dns_rdata_t *rdata = NULL; @@ -1014,7 +1048,7 @@ dns_tkey_builddhquery(dns_message_t *msg tkey.other = NULL; tkey.otherlen = 0; - RETERR(buildquery(msg, name, &tkey, ISC_FALSE)); + RETERR(buildquery(msg, name, &tkey, false)); RETERR(dns_message_gettemprdata(msg, &rdata)); RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, 1024)); @@ -1049,8 +1083,8 @@ dns_tkey_builddhquery(dns_message_t *msg isc_result_t dns_tkey_buildgssquery(dns_message_t *msg, const dns_name_t *name, const dns_name_t *gname, - isc_buffer_t *intoken, isc_uint32_t lifetime, - gss_ctx_id_t *context, isc_boolean_t win2k, + isc_buffer_t *intoken, uint32_t lifetime, + gss_ctx_id_t *context, bool win2k, isc_mem_t *mctx, char **err_message) { dns_rdata_tkey_t tkey; @@ -1116,7 +1150,7 @@ dns_tkey_builddeletequery(dns_message_t tkey.keylen = tkey.otherlen = 0; tkey.key = tkey.other = NULL; - return (buildquery(msg, &key->name, &tkey, ISC_FALSE)); + return (buildquery(msg, &key->name, &tkey, false)); } static isc_result_t @@ -1163,7 +1197,7 @@ dns_tkey_processdhresponse(dns_message_t isc_buffer_t *shared = NULL, secret; isc_region_t r, r2; isc_result_t result; - isc_boolean_t freertkey = ISC_FALSE; + bool freertkey = false; REQUIRE(qmsg != NULL); REQUIRE(rmsg != NULL); @@ -1177,7 +1211,7 @@ dns_tkey_processdhresponse(dns_message_t return (ISC_RESULTCLASS_DNSRCODE + rmsg->rcode); RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER)); RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL)); - freertkey = ISC_TRUE; + freertkey = true; RETERR(find_tkey(qmsg, &tempname, &qtkeyrdata, DNS_SECTION_ADDITIONAL)); @@ -1254,7 +1288,7 @@ dns_tkey_processdhresponse(dns_message_t isc_buffer_usedregion(&secret, &r); result = dns_tsigkey_create(tkeyname, &rtkey.algorithm, - r.base, r.length, ISC_TRUE, + r.base, r.length, true, NULL, rtkey.inception, rtkey.expire, rmsg->mctx, ring, outkey); isc_buffer_free(&shared); @@ -1337,7 +1371,7 @@ dns_tkey_processgssresponse(dns_message_ &dstkey, NULL)); RETERR(dns_tsigkey_createfromkey(tkeyname, DNS_TSIG_GSSAPI_NAME, - dstkey, ISC_FALSE, NULL, + dstkey, false, NULL, rtkey.inception, rtkey.expire, ring->mctx, ring, outkey)); dst_key_free(&dstkey); @@ -1412,7 +1446,7 @@ isc_result_t dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg, const dns_name_t *server, gss_ctx_id_t *context, dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring, - isc_boolean_t win2k, char **err_message) + bool win2k, char **err_message) { dns_rdata_t rtkeyrdata = DNS_RDATA_INIT, qtkeyrdata = DNS_RDATA_INIT; dns_name_t *tkeyname; @@ -1421,7 +1455,7 @@ dns_tkey_gssnegotiate(dns_message_t *qms dst_key_t *dstkey = NULL; isc_result_t result; unsigned char array[TEMP_BUFFER_SZ]; - isc_boolean_t freertkey = ISC_FALSE; + bool freertkey = false; REQUIRE(qmsg != NULL); REQUIRE(rmsg != NULL); @@ -1434,9 +1468,9 @@ dns_tkey_gssnegotiate(dns_message_t *qms RETERR(find_tkey(rmsg, &tkeyname, &rtkeyrdata, DNS_SECTION_ANSWER)); RETERR(dns_rdata_tostruct(&rtkeyrdata, &rtkey, NULL)); - freertkey = ISC_TRUE; + freertkey = true; - if (win2k == ISC_TRUE) + if (win2k == true) RETERR(find_tkey(qmsg, &tkeyname, &qtkeyrdata, DNS_SECTION_ANSWER)); else @@ -1508,7 +1542,7 @@ dns_tkey_gssnegotiate(dns_message_t *qms (win2k ? DNS_TSIG_GSSAPIMS_NAME : DNS_TSIG_GSSAPI_NAME), - dstkey, ISC_TRUE, NULL, + dstkey, true, NULL, rtkey.inception, rtkey.expire, ring->mctx, ring, outkey)); dst_key_free(&dstkey);