2 Unix SMB/CIFS implementation.
4 DNS server handler for signed packets
6 Copyright (C) 2012 Kai Blin <kai@samba.org>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "lib/crypto/hmacmd5.h"
24 #include "system/network.h"
25 #include "librpc/ndr/libndr.h"
26 #include "librpc/gen_ndr/ndr_dns.h"
27 #include "dns_server/dns_server.h"
28 #include "libcli/util/ntstatus.h"
29 #include "auth/auth.h"
30 #include "auth/gensec/gensec.h"
32 static WERROR
dns_copy_tsig(TALLOC_CTX
*mem_ctx
,
33 struct dns_res_rec
*old
,
34 struct dns_res_rec
*new_rec
)
36 new_rec
->name
= talloc_strdup(mem_ctx
, old
->name
);
37 W_ERROR_HAVE_NO_MEMORY(new_rec
->name
);
39 new_rec
->rr_type
= old
->rr_type
;
40 new_rec
->rr_class
= old
->rr_class
;
41 new_rec
->ttl
= old
->ttl
;
42 new_rec
->length
= old
->length
;
43 new_rec
->rdata
.tsig_record
.algorithm_name
= talloc_strdup(mem_ctx
,
44 old
->rdata
.tsig_record
.algorithm_name
);
45 W_ERROR_HAVE_NO_MEMORY(new_rec
->rdata
.tsig_record
.algorithm_name
);
47 new_rec
->rdata
.tsig_record
.time_prefix
= old
->rdata
.tsig_record
.time_prefix
;
48 new_rec
->rdata
.tsig_record
.time
= old
->rdata
.tsig_record
.time
;
49 new_rec
->rdata
.tsig_record
.fudge
= old
->rdata
.tsig_record
.fudge
;
50 new_rec
->rdata
.tsig_record
.mac_size
= old
->rdata
.tsig_record
.mac_size
;
51 new_rec
->rdata
.tsig_record
.mac
= talloc_memdup(mem_ctx
,
52 old
->rdata
.tsig_record
.mac
,
53 old
->rdata
.tsig_record
.mac_size
);
54 W_ERROR_HAVE_NO_MEMORY(new_rec
->rdata
.tsig_record
.mac
);
56 new_rec
->rdata
.tsig_record
.original_id
= old
->rdata
.tsig_record
.original_id
;
57 new_rec
->rdata
.tsig_record
.error
= old
->rdata
.tsig_record
.error
;
58 new_rec
->rdata
.tsig_record
.other_size
= old
->rdata
.tsig_record
.other_size
;
59 new_rec
->rdata
.tsig_record
.other_data
= talloc_memdup(mem_ctx
,
60 old
->rdata
.tsig_record
.other_data
,
61 old
->rdata
.tsig_record
.other_size
);
62 W_ERROR_HAVE_NO_MEMORY(new_rec
->rdata
.tsig_record
.other_data
);
67 struct dns_server_tkey
*dns_find_tkey(struct dns_server_tkey_store
*store
,
70 struct dns_server_tkey
*tkey
= NULL
;
74 struct dns_server_tkey
*tmp_key
= store
->tkeys
[i
];
77 i
%= TKEY_BUFFER_SIZE
;
79 if (tmp_key
== NULL
) {
82 if (dns_name_equal(name
, tmp_key
->name
)) {
91 WERROR
dns_verify_tsig(struct dns_server
*dns
,
93 struct dns_request_state
*state
,
94 struct dns_name_packet
*packet
)
98 enum ndr_err_code ndr_err
;
99 bool found_tsig
= false;
101 DATA_BLOB packet_blob
, tsig_blob
, sig
;
102 uint8_t *buffer
= NULL
;
103 size_t buffer_len
= 0;
104 struct dns_server_tkey
*tkey
= NULL
;
105 struct dns_fake_tsig_rec
*check_rec
= talloc_zero(mem_ctx
,
106 struct dns_fake_tsig_rec
);
109 /* Find the first TSIG record in the additional records */
110 for (i
=0; i
< packet
->arcount
; i
++) {
111 if (packet
->additional
[i
].rr_type
== DNS_QTYPE_TSIG
) {
121 /* The TSIG record needs to be the last additional record */
122 if (found_tsig
&& i
+ 1 != packet
->arcount
) {
123 DEBUG(0, ("TSIG record not the last additional record!\n"));
124 return DNS_ERR(FORMAT_ERROR
);
127 /* We got a TSIG, so we need to sign our reply */
130 state
->tsig
= talloc_zero(mem_ctx
, struct dns_res_rec
);
131 if (state
->tsig
== NULL
) {
135 werror
= dns_copy_tsig(state
->tsig
, &packet
->additional
[i
],
137 if (!W_ERROR_IS_OK(werror
)) {
143 tkey
= dns_find_tkey(dns
->tkeys
, state
->tsig
->name
);
145 state
->tsig_error
= DNS_RCODE_BADKEY
;
146 return DNS_ERR(NOTAUTH
);
149 /* FIXME: check TSIG here */
150 if (check_rec
== NULL
) {
154 /* first build and verify check packet */
155 check_rec
->name
= talloc_strdup(check_rec
, tkey
->name
);
156 if (check_rec
->name
== NULL
) {
159 check_rec
->rr_class
= DNS_QCLASS_ANY
;
161 check_rec
->algorithm_name
= talloc_strdup(check_rec
, tkey
->algorithm
);
162 if (check_rec
->algorithm_name
== NULL
) {
165 check_rec
->time_prefix
= 0;
166 check_rec
->time
= state
->tsig
->rdata
.tsig_record
.time
;
167 check_rec
->fudge
= state
->tsig
->rdata
.tsig_record
.fudge
;
168 check_rec
->error
= 0;
169 check_rec
->other_size
= 0;
170 check_rec
->other_data
= NULL
;
172 ndr_err
= ndr_push_struct_blob(&packet_blob
, mem_ctx
, packet
,
173 (ndr_push_flags_fn_t
)ndr_push_dns_name_packet
);
174 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
175 DEBUG(1, ("Failed to push packet: %s!\n",
176 ndr_errstr(ndr_err
)));
177 return DNS_ERR(SERVER_FAILURE
);
180 ndr_err
= ndr_push_struct_blob(&tsig_blob
, mem_ctx
, check_rec
,
181 (ndr_push_flags_fn_t
)ndr_push_dns_fake_tsig_rec
);
182 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
183 DEBUG(1, ("Failed to push packet: %s!\n",
184 ndr_errstr(ndr_err
)));
185 return DNS_ERR(SERVER_FAILURE
);
188 buffer_len
= packet_blob
.length
+ tsig_blob
.length
;
189 buffer
= talloc_zero_array(mem_ctx
, uint8_t, buffer_len
);
190 if (buffer
== NULL
) {
194 memcpy(buffer
, packet_blob
.data
, packet_blob
.length
);
195 memcpy(buffer
, tsig_blob
.data
, tsig_blob
.length
);
197 sig
.length
= state
->tsig
->rdata
.tsig_record
.mac_size
;
198 sig
.data
= talloc_memdup(mem_ctx
, state
->tsig
->rdata
.tsig_record
.mac
, sig
.length
);
199 if (sig
.data
== NULL
) {
204 status
= gensec_check_packet(tkey
->gensec
, buffer
, buffer_len
,
205 buffer
, buffer_len
, &sig
);
206 if (NT_STATUS_EQUAL(NT_STATUS_ACCESS_DENIED
, status
)) {
207 return DNS_ERR(BADKEY
);
210 if (!NT_STATUS_IS_OK(status
)) {
211 DEBUG(0, ("Verifying tsig failed: %s\n", nt_errstr(status
)));
212 return ntstatus_to_werror(status
);
215 state
->authenticated
= true;
220 WERROR
dns_sign_tsig(struct dns_server
*dns
,
222 struct dns_request_state
*state
,
223 struct dns_name_packet
*packet
,
228 enum ndr_err_code ndr_err
;
229 time_t current_time
= time(NULL
);
230 DATA_BLOB packet_blob
, tsig_blob
, sig
;
231 uint8_t *buffer
= NULL
;
232 size_t buffer_len
= 0;
233 struct dns_server_tkey
* tkey
= NULL
;
234 struct dns_res_rec
*tsig
= talloc_zero(mem_ctx
, struct dns_res_rec
);
236 struct dns_fake_tsig_rec
*check_rec
= talloc_zero(mem_ctx
,
237 struct dns_fake_tsig_rec
);
243 if (check_rec
== NULL
) {
247 tkey
= dns_find_tkey(dns
->tkeys
, state
->key_name
);
249 /* FIXME: read up on what to do when we can't find a key */
253 /* first build and verify check packet */
254 check_rec
->name
= talloc_strdup(check_rec
, tkey
->name
);
255 if (check_rec
->name
== NULL
) {
258 check_rec
->rr_class
= DNS_QCLASS_ANY
;
260 check_rec
->algorithm_name
= talloc_strdup(check_rec
, tkey
->algorithm
);
261 if (check_rec
->algorithm_name
== NULL
) {
264 check_rec
->time_prefix
= 0;
265 check_rec
->time
= current_time
;
266 check_rec
->fudge
= 300;
267 check_rec
->error
= state
->tsig_error
;
268 check_rec
->other_size
= 0;
269 check_rec
->other_data
= NULL
;
271 ndr_err
= ndr_push_struct_blob(&packet_blob
, mem_ctx
, packet
,
272 (ndr_push_flags_fn_t
)ndr_push_dns_name_packet
);
273 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
274 DEBUG(1, ("Failed to push packet: %s!\n",
275 ndr_errstr(ndr_err
)));
276 return DNS_ERR(SERVER_FAILURE
);
279 ndr_err
= ndr_push_struct_blob(&tsig_blob
, mem_ctx
, check_rec
,
280 (ndr_push_flags_fn_t
)ndr_push_dns_fake_tsig_rec
);
281 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
282 DEBUG(1, ("Failed to push packet: %s!\n",
283 ndr_errstr(ndr_err
)));
284 return DNS_ERR(SERVER_FAILURE
);
287 buffer_len
= packet_blob
.length
+ tsig_blob
.length
;
288 buffer
= talloc_zero_array(mem_ctx
, uint8_t, buffer_len
);
289 if (buffer
== NULL
) {
293 memcpy(buffer
, packet_blob
.data
, packet_blob
.length
);
294 memcpy(buffer
+packet_blob
.length
, tsig_blob
.data
, tsig_blob
.length
);
297 status
= gensec_sign_packet(tkey
->gensec
, mem_ctx
, buffer
, buffer_len
,
298 buffer
, buffer_len
, &sig
);
299 if (!NT_STATUS_IS_OK(status
)) {
300 return ntstatus_to_werror(status
);
303 tsig
->name
= talloc_strdup(tsig
, check_rec
->name
);
304 if (tsig
->name
== NULL
) {
307 tsig
->rr_class
= check_rec
->rr_class
;
308 tsig
->rr_type
= DNS_QTYPE_TSIG
;
310 tsig
->length
= UINT16_MAX
;
311 tsig
->rdata
.tsig_record
.algorithm_name
= talloc_strdup(tsig
,
312 check_rec
->algorithm_name
);
313 tsig
->rdata
.tsig_record
.time_prefix
= check_rec
->time_prefix
;
314 tsig
->rdata
.tsig_record
.time
= check_rec
->time
;
315 tsig
->rdata
.tsig_record
.fudge
= check_rec
->fudge
;
316 tsig
->rdata
.tsig_record
.error
= state
->tsig_error
;
317 tsig
->rdata
.tsig_record
.original_id
= packet
->id
;
318 tsig
->rdata
.tsig_record
.other_size
= 0;
319 tsig
->rdata
.tsig_record
.other_data
= NULL
;
320 tsig
->rdata
.tsig_record
.mac_size
= sig
.length
;
321 tsig
->rdata
.tsig_record
.mac
= talloc_memdup(tsig
, sig
.data
, sig
.length
);
324 if (packet
->arcount
== 0) {
325 packet
->additional
= talloc_zero(mem_ctx
, struct dns_res_rec
);
326 if (packet
->additional
== NULL
) {
330 packet
->additional
= talloc_realloc(mem_ctx
, packet
->additional
,
332 packet
->arcount
+ 1);
333 if (packet
->additional
== NULL
) {
337 werror
= dns_copy_tsig(mem_ctx
, tsig
,
338 &packet
->additional
[packet
->arcount
]);
339 if (!W_ERROR_IS_OK(werror
)) {