contrib/bind-9.3/lib/bind/dst/hmac_link.c

   1 #ifdef HMAC_MD5
   2 #ifndef LINT
   3 static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_link.c,v 1.2.2.1.4.2 2006/03/10 00:17:21 marka Exp $";
   4 #endif
   5 /*
   6  * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
   7  *
   8  * Permission to use, copy modify, and distribute this software for any
   9  * purpose with or without fee is hereby granted, provided that the above
  10  * copyright notice and this permission notice appear in all copies.
  11  *
  12  * THE SOFTWARE IS PROVIDED "AS IS" AND TRUSTED INFORMATION SYSTEMS
  13  * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
  14  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL
  15  * TRUSTED INFORMATION SYSTEMS BE LIABLE FOR ANY SPECIAL, DIRECT,
  16  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
  17  * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
  18  * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
  19  * WITH THE USE OR PERFORMANCE OF THE SOFTWARE.
  20  */
  21
  22 /*
  23  * This file contains an implementation of the HMAC-MD5 algorithm.
  24  */
  25 #include "port_before.h"
  26
  27 #include <stdio.h>
  28 #include <unistd.h>
  29 #include <stdlib.h>
  30 #include <string.h>
  31 #include <memory.h>
  32 #include <sys/param.h>
  33 #include <sys/time.h>
  34 #include <netinet/in.h>
  35 #include <arpa/nameser.h>
  36 #include <resolv.h>
  37
  38 #include "dst_internal.h"
  39
  40 #ifdef USE_MD5
  41 # ifndef HAVE_MD5
  42 #  include "md5.h"
  43 # else
  44 #  ifdef SOLARIS2
  45 #   include <sys/md5.h>
  46 #  endif
  47 # endif
  48 # ifndef _MD5_H_
  49 #  define _MD5_H_ 1     /* make sure we do not include rsaref md5.h file */
  50 # endif
  51 #endif
  52
  53 #include "port_after.h"
  54
  55
  56 #define HMAC_LEN        64
  57 #define HMAC_IPAD       0x36
  58 #define HMAC_OPAD       0x5c
  59 #define MD5_LEN         16
  60
  61
  62 typedef struct hmackey {
  63         u_char hk_ipad[64], hk_opad[64];
  64 } HMAC_Key;
  65
  66
  67 /**************************************************************************
  68  * dst_hmac_md5_sign
  69  *     Call HMAC signing functions to sign a block of data.
  70  *     There are three steps to signing, INIT (initialize structures),
  71  *     UPDATE (hash (more) data), FINAL (generate a signature).  This
  72  *     routine performs one or more of these steps.
  73  * Parameters
  74  *     mode     SIG_MODE_INIT, SIG_MODE_UPDATE and/or SIG_MODE_FINAL.
  75  *     priv_key    key to use for signing.
  76  *     context   the context to be used in this digest
  77  *     data     data to be signed.
  78  *     len       length in bytes of data.
  79  *     signature   location to store signature.
  80  *     sig_len     size of the signature location
  81  * returns
  82  *      N  Success on SIG_MODE_FINAL = returns signature length in bytes
  83  *      0  Success on SIG_MODE_INIT  and UPDATE
  84  *       <0  Failure
  85  */
  86
  87 static int
  88 dst_hmac_md5_sign(const int mode, DST_KEY *d_key, void **context,
  89                   const u_char *data, const int len,
  90                   u_char *signature, const int sig_len)
  91 {
  92         HMAC_Key *key;
  93         int sign_len = 0;
  94         MD5_CTX *ctx = NULL;
  95
  96         if (d_key == NULL || d_key->dk_KEY_struct == NULL)
  97                 return (-1);
  98
  99         if (mode & SIG_MODE_INIT)
 100                 ctx = (MD5_CTX *) malloc(sizeof(*ctx));
 101         else if (context)
 102                 ctx = (MD5_CTX *) *context;
 103         if (ctx == NULL)
 104                 return (-1);
 105
 106         key = (HMAC_Key *) d_key->dk_KEY_struct;
 107
 108         if (mode & SIG_MODE_INIT) {
 109                 MD5Init(ctx);
 110                 MD5Update(ctx, key->hk_ipad, HMAC_LEN);
 111         }
 112
 113         if ((mode & SIG_MODE_UPDATE) && (data && len > 0))
 114                 MD5Update(ctx, data, len);
 115
 116         if (mode & SIG_MODE_FINAL) {
 117                 if (signature == NULL || sig_len < MD5_LEN)
 118                         return (SIGN_FINAL_FAILURE);
 119                 MD5Final(signature, ctx);
 120
 121                 /* perform outer MD5 */
 122                 MD5Init(ctx);
 123                 MD5Update(ctx, key->hk_opad, HMAC_LEN);
 124                 MD5Update(ctx, signature, MD5_LEN);
 125                 MD5Final(signature, ctx);
 126                 sign_len = MD5_LEN;
 127                 SAFE_FREE(ctx);
 128         }
 129         else {
 130                 if (context == NULL)
 131                         return (-1);
 132                 *context = (void *) ctx;
 133         }
 134         return (sign_len);
 135 }
 136
 137
 138 /**************************************************************************
 139  * dst_hmac_md5_verify()
 140  *     Calls HMAC verification routines.  There are three steps to
 141  *     verification, INIT (initialize structures), UPDATE (hash (more) data),
 142  *     FINAL (generate a signature).  This routine performs one or more of
 143  *     these steps.
 144  * Parameters
 145  *     mode     SIG_MODE_INIT, SIG_MODE_UPDATE and/or SIG_MODE_FINAL.
 146  *     dkey     key to use for verify.
 147  *     data     data signed.
 148  *     len       length in bytes of data.
 149  *     signature   signature.
 150  *     sig_len     length in bytes of signature.
 151  * returns
 152  *     0  Success
 153  *    <0  Failure
 154  */
 155
 156 static int
 157 dst_hmac_md5_verify(const int mode, DST_KEY *d_key, void **context,
 158                 const u_char *data, const int len,
 159                 const u_char *signature, const int sig_len)
 160 {
 161         HMAC_Key *key;
 162         MD5_CTX *ctx = NULL;
 163
 164         if (d_key == NULL || d_key->dk_KEY_struct == NULL)
 165                 return (-1);
 166
 167         if (mode & SIG_MODE_INIT)
 168                 ctx = (MD5_CTX *) malloc(sizeof(*ctx));
 169         else if (context)
 170                 ctx = (MD5_CTX *) *context;
 171         if (ctx == NULL)
 172                 return (-1);
 173
 174         key = (HMAC_Key *) d_key->dk_KEY_struct;
 175         if (mode & SIG_MODE_INIT) {
 176                 MD5Init(ctx);
 177                 MD5Update(ctx, key->hk_ipad, HMAC_LEN);
 178         }
 179         if ((mode & SIG_MODE_UPDATE) && (data && len > 0))
 180                 MD5Update(ctx, data, len);
 181
 182         if (mode & SIG_MODE_FINAL) {
 183                 u_char digest[MD5_LEN];
 184                 if (signature == NULL || key == NULL || sig_len != MD5_LEN)
 185                         return (VERIFY_FINAL_FAILURE);
 186                 MD5Final(digest, ctx);
 187
 188                 /* perform outer MD5 */
 189                 MD5Init(ctx);
 190                 MD5Update(ctx, key->hk_opad, HMAC_LEN);
 191                 MD5Update(ctx, digest, MD5_LEN);
 192                 MD5Final(digest, ctx);
 193
 194                 SAFE_FREE(ctx);
 195                 if (memcmp(digest, signature, MD5_LEN) != 0)
 196                         return (VERIFY_FINAL_FAILURE);
 197         }
 198         else {
 199                 if (context == NULL)
 200                         return (-1);
 201                 *context = (void *) ctx;
 202         }
 203         return (0);
 204 }
 205
 206
 207 /**************************************************************************
 208  * dst_buffer_to_hmac_md5
 209  *     Converts key from raw data to an HMAC Key
 210  *     This function gets in a pointer to the data
 211  * Parameters
 212  *     hkey     the HMAC key to be filled in
 213  *     key      the key in raw format
 214  *     keylen   the length of the key
 215  * Return
 216  *      0       Success
 217  *      <0      Failure
 218  */
 219 static int
 220 dst_buffer_to_hmac_md5(DST_KEY *dkey, const u_char *key, const int keylen)
 221 {
 222         int i;
 223         HMAC_Key *hkey = NULL;
 224         MD5_CTX ctx;
 225         int local_keylen = keylen;
 226
 227         if (dkey == NULL || key == NULL || keylen < 0)
 228                 return (-1);
 229
 230         if ((hkey = (HMAC_Key *) malloc(sizeof(HMAC_Key))) == NULL)
 231                   return (-2);
 232
 233         memset(hkey->hk_ipad, 0, sizeof(hkey->hk_ipad));
 234         memset(hkey->hk_opad, 0, sizeof(hkey->hk_opad));
 235
 236         /* if key is longer than HMAC_LEN bytes reset it to key=MD5(key) */
 237         if (keylen > HMAC_LEN) {
 238                 u_char tk[MD5_LEN];
 239                 MD5Init(&ctx);
 240                 MD5Update(&ctx, key, keylen);
 241                 MD5Final(tk, &ctx);
 242                 memset((void *) &ctx, 0, sizeof(ctx));
 243                 key = tk;
 244                 local_keylen = MD5_LEN;
 245         }
 246         /* start out by storing key in pads */
 247         memcpy(hkey->hk_ipad, key, local_keylen);
 248         memcpy(hkey->hk_opad, key, local_keylen);
 249
 250         /* XOR key with hk_ipad and opad values */
 251         for (i = 0; i < HMAC_LEN; i++) {
 252                 hkey->hk_ipad[i] ^= HMAC_IPAD;
 253                 hkey->hk_opad[i] ^= HMAC_OPAD;
 254         }
 255         dkey->dk_key_size = local_keylen;
 256         dkey->dk_KEY_struct = (void *) hkey;
 257         return (1);
 258 }
 259
 260
 261 /**************************************************************************
 262  *  dst_hmac_md5_key_to_file_format
 263  *      Encodes an HMAC Key into the portable file format.
 264  *  Parameters
 265  *      hkey      HMAC KEY structure
 266  *      buff      output buffer
 267  *      buff_len  size of output buffer
 268  *  Return
 269  *      0  Failure - null input hkey
 270  *     -1  Failure - not enough space in output area
 271  *      N  Success - Length of data returned in buff
 272  */
 273
 274 static int
 275 dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff,
 276                                 const int buff_len)
 277 {
 278         char *bp;
 279         int len, b_len, i, key_len;
 280         u_char key[HMAC_LEN];
 281         HMAC_Key *hkey;
 282
 283         if (dkey == NULL || dkey->dk_KEY_struct == NULL)
 284                 return (0);
 285         if (buff == NULL || buff_len <= (int) strlen(key_file_fmt_str))
 286                 return (-1);    /* no OR not enough space in output area */
 287
 288         hkey = (HMAC_Key *) dkey->dk_KEY_struct;
 289         memset(buff, 0, buff_len);      /* just in case */
 290         /* write file header */
 291         sprintf(buff, key_file_fmt_str, KEY_FILE_FORMAT, KEY_HMAC_MD5, "HMAC");
 292
 293         bp = buff + strlen(buff);
 294         b_len = buff_len - (bp - buff);
 295
 296         memset(key, 0, HMAC_LEN);
 297         for (i = 0; i < HMAC_LEN; i++)
 298                 key[i] = hkey->hk_ipad[i] ^ HMAC_IPAD;
 299         for (i = HMAC_LEN - 1; i >= 0; i--)
 300                 if (key[i] != 0)
 301                         break;
 302         key_len = i + 1;
 303
 304         strcat(bp, "Key: ");
 305         bp += strlen("Key: ");
 306         b_len = buff_len - (bp - buff);
 307
 308         len = b64_ntop(key, key_len, bp, b_len);
 309         if (len < 0)
 310                 return (-1);
 311         bp += len;
 312         *(bp++) = '\n';
 313         *bp = '\0';
 314         b_len = buff_len - (bp - buff);
 315
 316         return (buff_len - b_len);
 317 }
 318
 319
 320 /**************************************************************************
 321  * dst_hmac_md5_key_from_file_format
 322  *     Converts contents of a key file into an HMAC key.
 323  * Parameters
 324  *     hkey    structure to put key into
 325  *     buff       buffer containing the encoded key
 326  *     buff_len   the length of the buffer
 327  * Return
 328  *     n >= 0 Foot print of the key converted
 329  *     n <  0 Error in conversion
 330  */
 331
 332 static int
 333 dst_hmac_md5_key_from_file_format(DST_KEY *dkey, const char *buff,
 334                               const int buff_len)
 335 {
 336         const char *p = buff, *eol;
 337         u_char key[HMAC_LEN+1]; /* b64_pton needs more than 64 bytes do decode
 338                                  * it should probably be fixed rather than doing
 339                                  * this
 340                                  */
 341         u_char *tmp;
 342         int key_len, len;
 343
 344         if (dkey == NULL)
 345                 return (-2);
 346         if (buff == NULL || buff_len < 0)
 347                 return (-1);
 348
 349         memset(key, 0, sizeof(key));
 350
 351         if (!dst_s_verify_str(&p, "Key: "))
 352                 return (-3);
 353
 354         eol = strchr(p, '\n');
 355         if (eol == NULL)
 356                 return (-4);
 357         len = eol - p;
 358         tmp = malloc(len + 2);
 359         if (tmp == NULL)
 360                 return (-5);
 361         memcpy(tmp, p, len);
 362         *(tmp + len) = 0x0;
 363         key_len = b64_pton((char *)tmp, key, HMAC_LEN+1);       /* see above */
 364         SAFE_FREE2(tmp, len + 2);
 365
 366         if (dst_buffer_to_hmac_md5(dkey, key, key_len) < 0) {
 367                 return (-6);
 368         }
 369         return (0);
 370 }
 371
 372 /*
 373  * dst_hmac_md5_to_dns_key()
 374  *         function to extract hmac key from DST_KEY structure
 375  * intput:
 376  *      in_key:  HMAC-MD5 key
 377  * output:
 378  *      out_str: buffer to write ot
 379  *      out_len: size of output buffer
 380  * returns:
 381  *      number of bytes written to output buffer
 382  */
 383 static int
 384 dst_hmac_md5_to_dns_key(const DST_KEY *in_key, u_char *out_str,
 385                         const int out_len)
 386 {
 387
 388         HMAC_Key *hkey;
 389         int i;
 390
 391         if (in_key == NULL || in_key->dk_KEY_struct == NULL ||
 392             out_len <= in_key->dk_key_size || out_str == NULL)
 393                 return (-1);
 394
 395         hkey = (HMAC_Key *) in_key->dk_KEY_struct;
 396         for (i = 0; i < in_key->dk_key_size; i++)
 397                 out_str[i] = hkey->hk_ipad[i] ^ HMAC_IPAD;
 398         return (i);
 399 }
 400
 401 /**************************************************************************
 402  *  dst_hmac_md5_compare_keys
 403  *      Compare two keys for equality.
 404  *  Return
 405  *      0         The keys are equal
 406  *      NON-ZERO   The keys are not equal
 407  */
 408
 409 static int
 410 dst_hmac_md5_compare_keys(const DST_KEY *key1, const DST_KEY *key2)
 411 {
 412         HMAC_Key *hkey1 = (HMAC_Key *) key1->dk_KEY_struct;
 413         HMAC_Key *hkey2 = (HMAC_Key *) key2->dk_KEY_struct;
 414         return memcmp(hkey1->hk_ipad, hkey2->hk_ipad, HMAC_LEN);
 415 }
 416
 417 /**************************************************************************
 418  * dst_hmac_md5_free_key_structure
 419  *     Frees all (none) dynamically allocated structures in hkey
 420  */
 421
 422 static void *
 423 dst_hmac_md5_free_key_structure(void *key)
 424 {
 425         HMAC_Key *hkey = key;
 426         SAFE_FREE(hkey);
 427         return (NULL);
 428 }
 429
 430
 431 /***************************************************************************
 432  * dst_hmac_md5_generate_key
 433  *     Creates a HMAC key of size size with a maximum size of 63 bytes
 434  *     generating a HMAC key larger than 63 bytes makes no sense as that key
 435  *     is digested before use.
 436  */
 437
 438 static int
 439 dst_hmac_md5_generate_key(DST_KEY *key, const int nothing)
 440 {
 441         (void)key;
 442         (void)nothing;
 443         return (-1);
 444 }
 445
 446 /*
 447  * dst_hmac_md5_init()  Function to answer set up function pointers for HMAC
 448  *         related functions
 449  */
 450 int
 451 #ifdef  SUNW_LIBMD5
 452 dst_md5_hmac_init()
 453 #else
 454 dst_hmac_md5_init()
 455 #endif
 456 {
 457         if (dst_t_func[KEY_HMAC_MD5] != NULL)
 458                 return (1);
 459         dst_t_func[KEY_HMAC_MD5] = malloc(sizeof(struct dst_func));
 460         if (dst_t_func[KEY_HMAC_MD5] == NULL)
 461                 return (0);
 462         memset(dst_t_func[KEY_HMAC_MD5], 0, sizeof(struct dst_func));
 463         dst_t_func[KEY_HMAC_MD5]->sign = dst_hmac_md5_sign;
 464         dst_t_func[KEY_HMAC_MD5]->verify = dst_hmac_md5_verify;
 465         dst_t_func[KEY_HMAC_MD5]->compare = dst_hmac_md5_compare_keys;
 466         dst_t_func[KEY_HMAC_MD5]->generate = dst_hmac_md5_generate_key;
 467         dst_t_func[KEY_HMAC_MD5]->destroy = dst_hmac_md5_free_key_structure;
 468         dst_t_func[KEY_HMAC_MD5]->to_dns_key = dst_hmac_md5_to_dns_key;
 469         dst_t_func[KEY_HMAC_MD5]->from_dns_key = dst_buffer_to_hmac_md5;
 470         dst_t_func[KEY_HMAC_MD5]->to_file_fmt = dst_hmac_md5_key_to_file_format;
 471         dst_t_func[KEY_HMAC_MD5]->from_file_fmt = dst_hmac_md5_key_from_file_format;
 472         return (1);
 473 }
 474
 475 #else
 476 #define dst_hmac_md5_init       __dst_hmac_md5_init
 477
 478 int
 479 dst_hmac_md5_init(){
 480         return (0);
 481 }
 482 #endif