source4/dns_server/dns_crypto.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    DNS server handler for signed packets
   5
   6    Copyright (C) 2012 Kai Blin  <kai@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "lib/crypto/hmacmd5.h"
  24 #include "system/network.h"
  25 #include "librpc/ndr/libndr.h"
  26 #include "librpc/gen_ndr/ndr_dns.h"
  27 #include "dns_server/dns_server.h"
  28 #include "libcli/util/ntstatus.h"
  29 #include "auth/auth.h"
  30 #include "auth/gensec/gensec.h"
  31
  32 static WERROR dns_copy_tsig(TALLOC_CTX *mem_ctx,
  33                             struct dns_res_rec *old,
  34                             struct dns_res_rec *new_rec)
  35 {
  36         new_rec->name = talloc_strdup(mem_ctx, old->name);
  37         W_ERROR_HAVE_NO_MEMORY(new_rec->name);
  38
  39         new_rec->rr_type = old->rr_type;
  40         new_rec->rr_class = old->rr_class;
  41         new_rec->ttl = old->ttl;
  42         new_rec->length = old->length;
  43         new_rec->rdata.tsig_record.algorithm_name = talloc_strdup(mem_ctx,
  44                                 old->rdata.tsig_record.algorithm_name);
  45         W_ERROR_HAVE_NO_MEMORY(new_rec->rdata.tsig_record.algorithm_name);
  46
  47         new_rec->rdata.tsig_record.time_prefix = old->rdata.tsig_record.time_prefix;
  48         new_rec->rdata.tsig_record.time = old->rdata.tsig_record.time;
  49         new_rec->rdata.tsig_record.fudge = old->rdata.tsig_record.fudge;
  50         new_rec->rdata.tsig_record.mac_size = old->rdata.tsig_record.mac_size;
  51         new_rec->rdata.tsig_record.mac = talloc_memdup(mem_ctx,
  52                                         old->rdata.tsig_record.mac,
  53                                         old->rdata.tsig_record.mac_size);
  54         W_ERROR_HAVE_NO_MEMORY(new_rec->rdata.tsig_record.mac);
  55
  56         new_rec->rdata.tsig_record.original_id = old->rdata.tsig_record.original_id;
  57         new_rec->rdata.tsig_record.error = old->rdata.tsig_record.error;
  58         new_rec->rdata.tsig_record.other_size = old->rdata.tsig_record.other_size;
  59         new_rec->rdata.tsig_record.other_data = talloc_memdup(mem_ctx,
  60                                         old->rdata.tsig_record.other_data,
  61                                         old->rdata.tsig_record.other_size);
  62         W_ERROR_HAVE_NO_MEMORY(new_rec->rdata.tsig_record.other_data);
  63
  64         return WERR_OK;
  65 }
  66
  67 struct dns_server_tkey *dns_find_tkey(struct dns_server_tkey_store *store,
  68                                       const char *name)
  69 {
  70         struct dns_server_tkey *tkey = NULL;
  71         uint16_t i = 0;
  72
  73         do {
  74                 struct dns_server_tkey *tmp_key = store->tkeys[i];
  75
  76                 i++;
  77                 i %= TKEY_BUFFER_SIZE;
  78
  79                 if (tmp_key == NULL) {
  80                         continue;
  81                 }
  82                 if (dns_name_equal(name, tmp_key->name)) {
  83                         tkey = tmp_key;
  84                         break;
  85                 }
  86         } while (i != 0);
  87
  88         return tkey;
  89 }
  90
  91 WERROR dns_verify_tsig(struct dns_server *dns,
  92                        TALLOC_CTX *mem_ctx,
  93                        struct dns_request_state *state,
  94                        struct dns_name_packet *packet)
  95 {
  96         WERROR werror;
  97         NTSTATUS status;
  98         enum ndr_err_code ndr_err;
  99         bool found_tsig = false;
 100         uint16_t i;
 101         DATA_BLOB packet_blob, tsig_blob, sig;
 102         uint8_t *buffer = NULL;
 103         size_t buffer_len = 0;
 104         struct dns_server_tkey *tkey = NULL;
 105         struct dns_fake_tsig_rec *check_rec = talloc_zero(mem_ctx,
 106                         struct dns_fake_tsig_rec);
 107
 108
 109         /* Find the first TSIG record in the additional records */
 110         for (i=0; i < packet->arcount; i++) {
 111                 if (packet->additional[i].rr_type == DNS_QTYPE_TSIG) {
 112                         found_tsig = true;
 113                         break;
 114                 }
 115         }
 116
 117         if (!found_tsig) {
 118                 return WERR_OK;
 119         }
 120
 121         DEBUG(0, ("got here\n"));
 122         /* The TSIG record needs to be the last additional record */
 123         if (found_tsig && i + 1 != packet->arcount) {
 124                 DEBUG(0, ("TSIG record not the last additional record!\n"));
 125                 return DNS_ERR(FORMAT_ERROR);
 126         }
 127
 128         /* We got a TSIG, so we need to sign our reply */
 129         state->sign = true;
 130
 131         state->tsig = talloc_zero(mem_ctx, struct dns_res_rec);
 132         if (state->tsig == NULL) {
 133                 return WERR_NOMEM;
 134         }
 135
 136         werror = dns_copy_tsig(state->tsig, &packet->additional[i],
 137                                state->tsig);
 138         if (!W_ERROR_IS_OK(werror)) {
 139                 return werror;
 140         }
 141
 142         packet->arcount--;
 143
 144         tkey = dns_find_tkey(dns->tkeys, state->tsig->name);
 145         if (tkey == NULL) {
 146                 state->tsig_error = DNS_RCODE_BADKEY;
 147                 return DNS_ERR(NOTAUTH);
 148         }
 149
 150         /* FIXME: check TSIG here */
 151         if (check_rec == NULL) {
 152                 return WERR_NOMEM;
 153         }
 154
 155         /* first build and verify check packet */
 156         check_rec->name = talloc_strdup(check_rec, tkey->name);
 157         if (check_rec->name == NULL) {
 158                 return WERR_NOMEM;
 159         }
 160         check_rec->rr_class = DNS_QCLASS_ANY;
 161         check_rec->ttl = 0;
 162         check_rec->algorithm_name = talloc_strdup(check_rec, tkey->algorithm);
 163         if (check_rec->algorithm_name == NULL) {
 164                 return WERR_NOMEM;
 165         }
 166         check_rec->time_prefix = 0;
 167         check_rec->time = state->tsig->rdata.tsig_record.time;
 168         check_rec->fudge = state->tsig->rdata.tsig_record.fudge;
 169         check_rec->error = 0;
 170         check_rec->other_size = 0;
 171         check_rec->other_data = NULL;
 172
 173         ndr_err = ndr_push_struct_blob(&packet_blob, mem_ctx, packet,
 174                 (ndr_push_flags_fn_t)ndr_push_dns_name_packet);
 175         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 176                 DEBUG(1, ("Failed to push packet: %s!\n",
 177                           ndr_errstr(ndr_err)));
 178                 return DNS_ERR(SERVER_FAILURE);
 179         }
 180
 181         ndr_err = ndr_push_struct_blob(&tsig_blob, mem_ctx, check_rec,
 182                 (ndr_push_flags_fn_t)ndr_push_dns_fake_tsig_rec);
 183         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 184                 DEBUG(1, ("Failed to push packet: %s!\n",
 185                           ndr_errstr(ndr_err)));
 186                 return DNS_ERR(SERVER_FAILURE);
 187         }
 188
 189         buffer_len = packet_blob.length + tsig_blob.length;
 190         buffer = talloc_zero_array(mem_ctx, uint8_t, buffer_len);
 191         if (buffer == NULL) {
 192                 return WERR_NOMEM;
 193         }
 194
 195         memcpy(buffer, packet_blob.data, packet_blob.length);
 196         memcpy(buffer, tsig_blob.data, tsig_blob.length);
 197
 198         sig.length = state->tsig->rdata.tsig_record.mac_size;
 199         sig.data = talloc_memdup(mem_ctx, state->tsig->rdata.tsig_record.mac, sig.length);
 200         if (sig.data == NULL) {
 201                 return WERR_NOMEM;
 202         }
 203
 204
 205         status = gensec_check_packet(tkey->gensec, buffer, buffer_len,
 206                                     buffer, buffer_len, &sig);
 207         if (NT_STATUS_EQUAL(NT_STATUS_ACCESS_DENIED, status)) {
 208                 return DNS_ERR(BADKEY);
 209         }
 210
 211         if (!NT_STATUS_IS_OK(status)) {
 212                 DEBUG(0, ("Verifying tsig failed: %s\n", nt_errstr(status)));
 213                 return ntstatus_to_werror(status);
 214         }
 215
 216         state->authenticated = true;
 217
 218         return WERR_OK;
 219 }
 220
 221 WERROR dns_sign_tsig(struct dns_server *dns,
 222                      TALLOC_CTX *mem_ctx,
 223                      struct dns_request_state *state,
 224                      struct dns_name_packet *packet,
 225                      uint16_t error)
 226 {
 227         WERROR werror;
 228         NTSTATUS status;
 229         enum ndr_err_code ndr_err;
 230         time_t current_time = time(NULL);
 231         DATA_BLOB packet_blob, tsig_blob, sig;
 232         uint8_t *buffer = NULL;
 233         size_t buffer_len = 0;
 234         struct dns_server_tkey * tkey = NULL;
 235         struct dns_res_rec *tsig = talloc_zero(mem_ctx, struct dns_res_rec);
 236
 237         struct dns_fake_tsig_rec *check_rec = talloc_zero(mem_ctx,
 238                         struct dns_fake_tsig_rec);
 239
 240         if (tsig == NULL) {
 241                 return WERR_NOMEM;
 242         }
 243
 244         if (check_rec == NULL) {
 245                 return WERR_NOMEM;
 246         }
 247
 248         tkey = dns_find_tkey(dns->tkeys, state->key_name);
 249         if (tkey == NULL) {
 250                 /* FIXME: read up on what to do when we can't find a key */
 251                 return WERR_OK;
 252         }
 253
 254         /* first build and verify check packet */
 255         check_rec->name = talloc_strdup(check_rec, tkey->name);
 256         if (check_rec->name == NULL) {
 257                 return WERR_NOMEM;
 258         }
 259         check_rec->rr_class = DNS_QCLASS_ANY;
 260         check_rec->ttl = 0;
 261         check_rec->algorithm_name = talloc_strdup(check_rec, tkey->algorithm);
 262         if (check_rec->algorithm_name == NULL) {
 263                 return WERR_NOMEM;
 264         }
 265         check_rec->time_prefix = 0;
 266         check_rec->time = current_time;
 267         check_rec->fudge = 300;
 268         check_rec->error = state->tsig_error;
 269         check_rec->other_size = 0;
 270         check_rec->other_data = NULL;
 271
 272         ndr_err = ndr_push_struct_blob(&packet_blob, mem_ctx, packet,
 273                 (ndr_push_flags_fn_t)ndr_push_dns_name_packet);
 274         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 275                 DEBUG(1, ("Failed to push packet: %s!\n",
 276                           ndr_errstr(ndr_err)));
 277                 return DNS_ERR(SERVER_FAILURE);
 278         }
 279
 280         ndr_err = ndr_push_struct_blob(&tsig_blob, mem_ctx, check_rec,
 281                 (ndr_push_flags_fn_t)ndr_push_dns_fake_tsig_rec);
 282         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 283                 DEBUG(1, ("Failed to push packet: %s!\n",
 284                           ndr_errstr(ndr_err)));
 285                 return DNS_ERR(SERVER_FAILURE);
 286         }
 287
 288         buffer_len = packet_blob.length + tsig_blob.length;
 289         buffer = talloc_zero_array(mem_ctx, uint8_t, buffer_len);
 290         if (buffer == NULL) {
 291                 return WERR_NOMEM;
 292         }
 293
 294         memcpy(buffer, packet_blob.data, packet_blob.length);
 295         memcpy(buffer, tsig_blob.data, tsig_blob.length);
 296
 297
 298         status = gensec_sign_packet(tkey->gensec, mem_ctx, buffer, buffer_len,
 299                                     buffer, buffer_len, &sig);
 300         if (!NT_STATUS_IS_OK(status)) {
 301                 return ntstatus_to_werror(status);
 302         }
 303
 304         tsig->name = talloc_strdup(tsig, check_rec->name);
 305         if (tsig->name == NULL) {
 306                 return WERR_NOMEM;
 307         }
 308         tsig->rr_class = check_rec->rr_class;
 309         tsig->rr_type = DNS_QTYPE_TSIG;
 310         tsig->ttl = 0;
 311         tsig->length = UINT16_MAX;
 312         tsig->rdata.tsig_record.algorithm_name = talloc_strdup(tsig,
 313                         check_rec->algorithm_name);
 314         tsig->rdata.tsig_record.time_prefix = check_rec->time_prefix;
 315         tsig->rdata.tsig_record.time = check_rec->time;
 316         tsig->rdata.tsig_record.fudge = check_rec->fudge;
 317         tsig->rdata.tsig_record.error = state->tsig_error;
 318         tsig->rdata.tsig_record.original_id = packet->id;
 319         tsig->rdata.tsig_record.other_size = 0;
 320         tsig->rdata.tsig_record.other_data = NULL;
 321         tsig->rdata.tsig_record.mac_size = sig.length;
 322         tsig->rdata.tsig_record.mac = talloc_memdup(tsig, sig.data, sig.length);
 323
 324
 325         if (packet->arcount == 0) {
 326                 packet->additional = talloc_zero(mem_ctx, struct dns_res_rec);
 327                 if (packet->additional == NULL) {
 328                         return WERR_NOMEM;
 329                 }
 330         }
 331         packet->additional = talloc_realloc(mem_ctx, packet->additional,
 332                                             struct dns_res_rec,
 333                                             packet->arcount + 1);
 334         if (packet->additional == NULL) {
 335                 return WERR_NOMEM;
 336         }
 337
 338         werror = dns_copy_tsig(mem_ctx, tsig,
 339                                &packet->additional[packet->arcount]);
 340         if (!W_ERROR_IS_OK(werror)) {
 341                 return werror;
 342         }
 343         packet->arcount++;
 344
 345         return WERR_OK;
 346 }