/*

[0] Fix | Delete

* Copyright (C) Internet Systems Consortium, Inc. ("ISC")

[1] Fix | Delete

*

[2] Fix | Delete

* This Source Code Form is subject to the terms of the Mozilla Public

[3] Fix | Delete

* License, v. 2.0. If a copy of the MPL was not distributed with this

[4] Fix | Delete

* file, you can obtain one at https://mozilla.org/MPL/2.0/.

[5] Fix | Delete

*

[6] Fix | Delete

* See the COPYRIGHT file distributed with this work for additional

[7] Fix | Delete

* information regarding copyright ownership.

[8] Fix | Delete

*/

[9] Fix | Delete

[10] Fix | Delete

[11] Fix | Delete

#ifndef DNS_TKEY_H

[12] Fix | Delete

#define DNS_TKEY_H 1

[13] Fix | Delete

[14] Fix | Delete

/*! \file dns/tkey.h */

[15] Fix | Delete

[16] Fix | Delete

#include <inttypes.h>

[17] Fix | Delete

#include <stdbool.h>

[18] Fix | Delete

[19] Fix | Delete

#include <isc/lang.h>

[20] Fix | Delete

[21] Fix | Delete

#include <dns/types.h>

[22] Fix | Delete

[23] Fix | Delete

#include <dst/dst.h>

[24] Fix | Delete

#include <dst/gssapi.h>

[25] Fix | Delete

[26] Fix | Delete

ISC_LANG_BEGINDECLS

[27] Fix | Delete

[28] Fix | Delete

/* Key agreement modes */

[29] Fix | Delete

#define DNS_TKEYMODE_SERVERASSIGNED 1

[30] Fix | Delete

#define DNS_TKEYMODE_DIFFIEHELLMAN 2

[31] Fix | Delete

#define DNS_TKEYMODE_GSSAPI 3

[32] Fix | Delete

#define DNS_TKEYMODE_RESOLVERASSIGNED 4

[33] Fix | Delete

#define DNS_TKEYMODE_DELETE 5

[34] Fix | Delete

[35] Fix | Delete

struct dns_tkeyctx {

[36] Fix | Delete

dst_key_t *dhkey;

[37] Fix | Delete

dns_name_t *domain;

[38] Fix | Delete

gss_cred_id_t gsscred;

[39] Fix | Delete

isc_mem_t *mctx;

[40] Fix | Delete

isc_entropy_t *ectx;

[41] Fix | Delete

char *gssapi_keytab;

[42] Fix | Delete

};

[43] Fix | Delete

[44] Fix | Delete

isc_result_t

[45] Fix | Delete

dns_tkeyctx_create(isc_mem_t *mctx, isc_entropy_t *ectx,

[46] Fix | Delete

dns_tkeyctx_t **tctxp);

[47] Fix | Delete

/*%<

[48] Fix | Delete

* Create an empty TKEY context.

[49] Fix | Delete

*

[50] Fix | Delete

* Requires:

[51] Fix | Delete

*\li 'mctx' is not NULL

[52] Fix | Delete

*\li 'tctx' is not NULL

[53] Fix | Delete

*\li '*tctx' is NULL

[54] Fix | Delete

*

[55] Fix | Delete

* Returns

[56] Fix | Delete

*\li #ISC_R_SUCCESS

[57] Fix | Delete

*\li #ISC_R_NOMEMORY

[58] Fix | Delete

*\li return codes from dns_name_fromtext()

[59] Fix | Delete

*/

[60] Fix | Delete

[61] Fix | Delete

void

[62] Fix | Delete

dns_tkeyctx_destroy(dns_tkeyctx_t **tctxp);

[63] Fix | Delete

/*%<

[64] Fix | Delete

* Frees all data associated with the TKEY context

[65] Fix | Delete

*

[66] Fix | Delete

* Requires:

[67] Fix | Delete

*\li 'tctx' is not NULL

[68] Fix | Delete

*\li '*tctx' is not NULL

[69] Fix | Delete

*/

[70] Fix | Delete

[71] Fix | Delete

isc_result_t

[72] Fix | Delete

dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,

[73] Fix | Delete

dns_tsig_keyring_t *ring);

[74] Fix | Delete

/*%<

[75] Fix | Delete

* Processes a query containing a TKEY record, adding or deleting TSIG

[76] Fix | Delete

* keys if necessary, and modifies the message to contain the response.

[77] Fix | Delete

*

[78] Fix | Delete

* Requires:

[79] Fix | Delete

*\li 'msg' is a valid message

[80] Fix | Delete

*\li 'tctx' is a valid TKEY context

[81] Fix | Delete

*\li 'ring' is a valid TSIG keyring

[82] Fix | Delete

*

[83] Fix | Delete

* Returns

[84] Fix | Delete

*\li #ISC_R_SUCCESS msg was updated (the TKEY operation succeeded,

[85] Fix | Delete

* or msg now includes a TKEY with an error set)

[86] Fix | Delete

* DNS_R_FORMERR the packet was malformed (missing a TKEY

[87] Fix | Delete

* or KEY).

[88] Fix | Delete

*\li other An error occurred while processing the message

[89] Fix | Delete

*/

[90] Fix | Delete

[91] Fix | Delete

isc_result_t

[92] Fix | Delete

dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name,

[93] Fix | Delete

dns_name_t *algorithm, isc_buffer_t *nonce,

[94] Fix | Delete

uint32_t lifetime);

[95] Fix | Delete

/*%<

[96] Fix | Delete

* Builds a query containing a TKEY that will generate a shared

[97] Fix | Delete

* secret using a Diffie-Hellman key exchange. The shared key

[98] Fix | Delete

* will be of the specified algorithm (only DNS_TSIG_HMACMD5_NAME

[99] Fix | Delete

* is supported), and will be named either 'name',

[100] Fix | Delete

* 'name' + server chosen domain, or random data + server chosen domain

[101] Fix | Delete

* if 'name' == dns_rootname. If nonce is not NULL, it supplies

[102] Fix | Delete

* random data used in the shared secret computation. The key is

[103] Fix | Delete

* requested to have the specified lifetime (in seconds)

[104] Fix | Delete

*

[105] Fix | Delete

*

[106] Fix | Delete

* Requires:

[107] Fix | Delete

*\li 'msg' is a valid message

[108] Fix | Delete

*\li 'key' is a valid Diffie Hellman dst key

[109] Fix | Delete

*\li 'name' is a valid name

[110] Fix | Delete

*\li 'algorithm' is a valid name

[111] Fix | Delete

*

[112] Fix | Delete

* Returns:

[113] Fix | Delete

*\li #ISC_R_SUCCESS msg was successfully updated to include the

[114] Fix | Delete

* query to be sent

[115] Fix | Delete

*\li other an error occurred while building the message

[116] Fix | Delete

*/

[117] Fix | Delete

[118] Fix | Delete

isc_result_t

[119] Fix | Delete

dns_tkey_buildgssquery(dns_message_t *msg, dns_name_t *name, dns_name_t *gname,

[120] Fix | Delete

isc_buffer_t *intoken, uint32_t lifetime,

[121] Fix | Delete

gss_ctx_id_t *context, bool win2k,

[122] Fix | Delete

isc_mem_t *mctx, char **err_message);

[123] Fix | Delete

/*%<

[124] Fix | Delete

* Builds a query containing a TKEY that will generate a GSSAPI context.

[125] Fix | Delete

* The key is requested to have the specified lifetime (in seconds).

[126] Fix | Delete

*

[127] Fix | Delete

* Requires:

[128] Fix | Delete

*\li 'msg' is a valid message

[129] Fix | Delete

*\li 'name' is a valid name

[130] Fix | Delete

*\li 'gname' is a valid name

[131] Fix | Delete

*\li 'context' is a pointer to a valid gss_ctx_id_t

[132] Fix | Delete

* (which may have the value GSS_C_NO_CONTEXT)

[133] Fix | Delete

*\li 'win2k' when true says to turn on some hacks to work

[134] Fix | Delete

* with the non-standard GSS-TSIG of Windows 2000

[135] Fix | Delete

*

[136] Fix | Delete

* Returns:

[137] Fix | Delete

*\li ISC_R_SUCCESS msg was successfully updated to include the

[138] Fix | Delete

* query to be sent

[139] Fix | Delete

*\li other an error occurred while building the message

[140] Fix | Delete

*\li *err_message optional error message

[141] Fix | Delete

*/

[142] Fix | Delete

[143] Fix | Delete

[144] Fix | Delete

isc_result_t

[145] Fix | Delete

dns_tkey_builddeletequery(dns_message_t *msg, dns_tsigkey_t *key);

[146] Fix | Delete

/*%<

[147] Fix | Delete

* Builds a query containing a TKEY record that will delete the

[148] Fix | Delete

* specified shared secret from the server.

[149] Fix | Delete

*

[150] Fix | Delete

* Requires:

[151] Fix | Delete

*\li 'msg' is a valid message

[152] Fix | Delete

*\li 'key' is a valid TSIG key

[153] Fix | Delete

*

[154] Fix | Delete

* Returns:

[155] Fix | Delete

*\li #ISC_R_SUCCESS msg was successfully updated to include the

[156] Fix | Delete

* query to be sent

[157] Fix | Delete

*\li other an error occurred while building the message

[158] Fix | Delete

*/

[159] Fix | Delete

[160] Fix | Delete

isc_result_t

[161] Fix | Delete

dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg,

[162] Fix | Delete

dst_key_t *key, isc_buffer_t *nonce,

[163] Fix | Delete

dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring);

[164] Fix | Delete

/*%<

[165] Fix | Delete

* Processes a response to a query containing a TKEY that was

[166] Fix | Delete

* designed to generate a shared secret using a Diffie-Hellman key

[167] Fix | Delete

* exchange. If the query was successful, a new shared key

[168] Fix | Delete

* is created and added to the list of shared keys.

[169] Fix | Delete

*

[170] Fix | Delete

* Requires:

[171] Fix | Delete

*\li 'qmsg' is a valid message (the query)

[172] Fix | Delete

*\li 'rmsg' is a valid message (the response)

[173] Fix | Delete

*\li 'key' is a valid Diffie Hellman dst key

[174] Fix | Delete

*\li 'outkey' is either NULL or a pointer to NULL

[175] Fix | Delete

*\li 'ring' is a valid keyring or NULL

[176] Fix | Delete

*

[177] Fix | Delete

* Returns:

[178] Fix | Delete

*\li #ISC_R_SUCCESS the shared key was successfully added

[179] Fix | Delete

*\li #ISC_R_NOTFOUND an error occurred while looking for a

[180] Fix | Delete

* component of the query or response

[181] Fix | Delete

*/

[182] Fix | Delete

[183] Fix | Delete

isc_result_t

[184] Fix | Delete

dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,

[185] Fix | Delete

dns_name_t *gname, gss_ctx_id_t *context,

[186] Fix | Delete

isc_buffer_t *outtoken, dns_tsigkey_t **outkey,

[187] Fix | Delete

dns_tsig_keyring_t *ring, char **err_message);

[188] Fix | Delete

/*%<

[189] Fix | Delete

* XXX

[190] Fix | Delete

*/

[191] Fix | Delete

[192] Fix | Delete

isc_result_t

[193] Fix | Delete

dns_tkey_processdeleteresponse(dns_message_t *qmsg, dns_message_t *rmsg,

[194] Fix | Delete

dns_tsig_keyring_t *ring);

[195] Fix | Delete

/*%<

[196] Fix | Delete

* Processes a response to a query containing a TKEY that was

[197] Fix | Delete

* designed to delete a shared secret. If the query was successful,

[198] Fix | Delete

* the shared key is deleted from the list of shared keys.

[199] Fix | Delete

*

[200] Fix | Delete

* Requires:

[201] Fix | Delete

*\li 'qmsg' is a valid message (the query)

[202] Fix | Delete

*\li 'rmsg' is a valid message (the response)

[203] Fix | Delete

*\li 'ring' is not NULL

[204] Fix | Delete

*

[205] Fix | Delete

* Returns:

[206] Fix | Delete

*\li #ISC_R_SUCCESS the shared key was successfully deleted

[207] Fix | Delete

*\li #ISC_R_NOTFOUND an error occurred while looking for a

[208] Fix | Delete

* component of the query or response

[209] Fix | Delete

*/

[210] Fix | Delete

[211] Fix | Delete

isc_result_t

[212] Fix | Delete

dns_tkey_gssnegotiate(dns_message_t *qmsg, dns_message_t *rmsg,

[213] Fix | Delete

dns_name_t *server, gss_ctx_id_t *context,

[214] Fix | Delete

dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring,

[215] Fix | Delete

bool win2k, char **err_message);

[216] Fix | Delete

[217] Fix | Delete

/*

[218] Fix | Delete

* Client side negotiation of GSS-TSIG. Process the response

[219] Fix | Delete

* to a TKEY, and establish a TSIG key if negotiation was successful.

[220] Fix | Delete

* Build a response to the input TKEY message. Can take multiple

[221] Fix | Delete

* calls to successfully establish the context.

[222] Fix | Delete

*

[223] Fix | Delete

* Requires:

[224] Fix | Delete

* 'qmsg' is a valid message, the original TKEY request;

[225] Fix | Delete

* it will be filled with the new message to send

[226] Fix | Delete

* 'rmsg' is a valid message, the incoming TKEY message

[227] Fix | Delete

* 'server' is the server name

[228] Fix | Delete

* 'context' is the input context handle

[229] Fix | Delete

* 'outkey' receives the established key, if non-NULL;

[230] Fix | Delete

* if non-NULL must point to NULL

[231] Fix | Delete

* 'ring' is the keyring in which to establish the key,

[232] Fix | Delete

* or NULL

[233] Fix | Delete

* 'win2k' when true says to turn on some hacks to work

[234] Fix | Delete

* with the non-standard GSS-TSIG of Windows 2000

[235] Fix | Delete

*

[236] Fix | Delete

* Returns:

[237] Fix | Delete

* ISC_R_SUCCESS context was successfully established

[238] Fix | Delete

* ISC_R_NOTFOUND couldn't find a needed part of the query

[239] Fix | Delete

* or response

[240] Fix | Delete

* DNS_R_CONTINUE additional context negotiation is required;

[241] Fix | Delete

* send the new qmsg to the server

[242] Fix | Delete

*/

[243] Fix | Delete

[244] Fix | Delete

ISC_LANG_ENDDECLS

[245] Fix | Delete

[246] Fix | Delete

#endif /* DNS_TKEY_H */

[247] Fix | Delete

[248] Fix | Delete