dns/tsig.go

255 lines
6.1 KiB
Go
Raw Normal View History

package dns
2011-01-09 08:39:15 +11:00
import (
2011-01-18 07:10:48 +11:00
"io"
2011-03-24 19:24:24 +11:00
"os"
"time"
2011-01-10 01:54:23 +11:00
"strings"
2011-01-18 07:10:48 +11:00
"crypto/hmac"
2011-01-10 01:54:23 +11:00
"encoding/hex"
2011-01-09 08:39:15 +11:00
)
2011-03-25 00:42:35 +11:00
// The structure Tsig is used in Read/Write functions to
2011-03-24 05:07:06 +11:00
// add or remove a TSIG on a dns message. See RFC 2845
// and RFC 4635.
2011-03-25 00:42:35 +11:00
// Basic use pattern of Tsig:
//
2011-01-27 19:29:11 +11:00
// HMAC hashing codes. These are transmitted as domain names.
2011-01-09 08:39:15 +11:00
const (
HmacMD5 = "hmac-md5.sig-alg.reg.int."
HmacSHA1 = "hmac-sha1."
HmacSHA256 = "hmac-sha256."
2011-01-09 08:39:15 +11:00
)
2011-01-18 07:10:48 +11:00
// The following values must be put in wireformat, so that the MAC can be calculated.
// RFC 2845, section 3.4.2. TSIG Variables.
type tsigWireFmt struct {
// From RR_HEADER
Name string "domain-name"
Class uint16
Ttl uint32
// Rdata of the TSIG
2011-01-10 01:54:23 +11:00
Algorithm string "domain-name"
TimeSigned uint64
Fudge uint16
// MACSize, MAC and OrigId excluded
Error uint16
OtherLen uint16
2011-02-04 06:39:43 +11:00
OtherData string "size-hex"
}
// If we have the MAC use this type to convert it to wiredata.
// Section 3.4.3. Request MAC
type macWireFmt struct {
2011-03-15 07:16:45 +11:00
MACSize uint16
MAC string "size-hex"
}
// 3.3. Time values used in TSIG calculations
type timerWireFmt struct {
TimeSigned uint64
Fudge uint16
}
// TsigGenerate add add TSIG RR to a message. The TSIG MAC is saved
// in the Tsig RR that is added. When TsigGenerate is called for the
// first time requestMAC is generaly set to the empty string. TODO(mg): Really?
// If something went wrong an error is returned, otherwise nil.
2011-04-23 00:37:26 +10:00
func TsigGenerate(m *Msg, secret, requestMAC string, timersOnly bool) (*Msg, os.Error) {
if !m.IsTsig() {
panic("TSIG not last RR in additional")
}
2011-04-19 06:08:12 +10:00
rawsecret, err := packBase64([]byte(secret))
2011-03-21 06:55:27 +11:00
if err != nil {
2011-03-22 03:43:03 +11:00
return nil, err
2011-03-21 06:55:27 +11:00
}
2011-04-23 00:37:26 +10:00
rr := m.Extra[len(m.Extra)-1].(*RR_TSIG)
m.Extra = m.Extra[0 : len(m.Extra)-1] // kill the TSIG from the msg
mbuf, _ := m.Pack()
buf, err := tsigBuffer(mbuf, rr, requestMAC, timersOnly)
2011-03-22 03:43:03 +11:00
if err != nil {
return nil, err
2011-03-21 07:40:10 +11:00
}
2011-04-19 06:08:12 +10:00
t := new(RR_TSIG)
2011-03-21 06:55:27 +11:00
h := hmac.NewMD5([]byte(rawsecret))
io.WriteString(h, string(buf))
t.MAC = hex.EncodeToString(h.Sum())
t.MACSize = uint16(len(t.MAC) / 2) // Size is half!
2011-03-21 07:40:10 +11:00
2011-04-19 06:08:12 +10:00
t.Hdr = RR_Header{Name: rr.Hdr.Name, Rrtype: TypeTSIG, Class: ClassANY, Ttl: 0}
t.Fudge = rr.Fudge
t.TimeSigned = rr.TimeSigned
t.Algorithm = rr.Algorithm
2011-04-19 06:08:12 +10:00
t.OrigId = m.MsgHdr.Id
2011-03-21 07:40:10 +11:00
2011-04-19 06:08:12 +10:00
m.Extra = append(m.Extra, t)
2011-04-23 00:37:26 +10:00
return m, nil
2011-03-21 06:55:27 +11:00
}
// TsigVerify verifies the TSIG on a message.
2011-03-24 05:07:06 +11:00
// If the signature does not validate err contains the
// error, otherwise it is nil.
func TsigVerify(msg []byte, secret, requestMAC string, timersOnly bool) os.Error {
2011-04-19 19:31:47 +10:00
rawsecret, err := packBase64([]byte(secret))
2011-03-21 06:55:27 +11:00
if err != nil {
return err
2011-03-21 06:55:27 +11:00
}
2011-04-23 00:37:26 +10:00
// Srtip the TSIG from the incoming msg
2011-04-19 19:31:47 +10:00
stripped, tsig, err := stripTsig(msg)
2011-03-26 00:46:30 +11:00
if err != nil {
return err
2011-03-21 06:55:27 +11:00
}
2011-04-23 00:37:26 +10:00
buf, err := tsigBuffer(stripped, tsig, requestMAC, timersOnly)
2011-03-22 03:43:03 +11:00
if err != nil {
return err
2011-03-21 06:55:27 +11:00
}
2011-04-23 00:37:26 +10:00
/*
if t.Name != "" {
if t.Name != dns.Extra[i].Header().Name {
return nil, ErrKey
}
}
if t.Algorithm != "" {
if t.Algorithm != dns.Extra[i].(*RR_TSIG).Algorithm {
return nil, ErrAlg
}
}
ti := uint64(time.Seconds()) - dns.Extra[i].(*RR_TSIG).TimeSigned
if uint64(dns.Extra[i].(*RR_TSIG).Fudge) < ti {
return nil, ErrTime
}
*/
2011-03-21 06:55:27 +11:00
2011-04-19 06:08:12 +10:00
// Time needs to be checked
2011-03-22 03:43:03 +11:00
2011-03-21 06:55:27 +11:00
h := hmac.NewMD5([]byte(rawsecret))
io.WriteString(h, string(buf))
if (strings.ToUpper(hex.EncodeToString(h.Sum())) != strings.ToUpper(tsig.MAC)) {
return ErrSig
}
return nil
2011-01-26 08:29:48 +11:00
}
2011-03-24 05:07:06 +11:00
// Create a wiredata buffer for the MAC calculation.
2011-04-23 00:37:26 +10:00
func tsigBuffer(msgbuf []byte, rr *RR_TSIG, requestMAC string, timersOnly bool) ([]byte, os.Error) {
2011-03-21 06:55:27 +11:00
var (
macbuf []byte
buf []byte
)
2011-04-23 00:37:26 +10:00
if rr.TimeSigned == 0 {
rr.TimeSigned = uint64(time.Seconds())
}
if rr.Fudge == 0 {
rr.Fudge = 300
}
2011-03-21 06:55:27 +11:00
2011-04-23 00:37:26 +10:00
if requestMAC != "" {
2011-03-21 06:55:27 +11:00
m := new(macWireFmt)
2011-04-23 00:37:26 +10:00
m.MACSize = uint16(len(requestMAC) / 2)
m.MAC = requestMAC
macbuf = make([]byte, len(requestMAC)) // reqmac should be twice as long
2011-03-21 06:55:27 +11:00
n, ok := packStruct(m, macbuf, 0)
if !ok {
2011-03-25 21:19:35 +11:00
return nil, ErrSigGen
2011-03-21 06:55:27 +11:00
}
macbuf = macbuf[:n]
}
tsigvar := make([]byte, DefaultMsgSize)
2011-04-19 06:08:12 +10:00
if timersOnly {
tsig := new(timerWireFmt)
2011-04-19 06:08:12 +10:00
tsig.TimeSigned = rr.TimeSigned
tsig.Fudge = rr.Fudge
2011-03-21 06:55:27 +11:00
n, ok1 := packStruct(tsig, tsigvar, 0)
if !ok1 {
2011-03-25 21:19:35 +11:00
return nil, ErrSigGen
2011-03-21 06:55:27 +11:00
}
tsigvar = tsigvar[:n]
} else {
tsig := new(tsigWireFmt)
2011-04-19 06:08:12 +10:00
tsig.Name = strings.ToLower(rr.Hdr.Name)
tsig.Class = ClassANY
2011-04-23 00:37:26 +10:00
tsig.Ttl = rr.Hdr.Ttl
2011-04-19 06:08:12 +10:00
tsig.Algorithm = strings.ToLower(rr.Algorithm)
tsig.TimeSigned = rr.TimeSigned
tsig.Fudge = rr.Fudge
2011-04-23 00:37:26 +10:00
tsig.Error = rr.Error
tsig.OtherLen = rr.OtherLen
tsig.OtherData = rr.OtherData
2011-03-21 06:55:27 +11:00
n, ok1 := packStruct(tsig, tsigvar, 0)
if !ok1 {
2011-03-25 21:19:35 +11:00
return nil, ErrSigGen
2011-03-21 06:55:27 +11:00
}
tsigvar = tsigvar[:n]
}
2011-04-19 06:08:12 +10:00
if rr.MAC != "" {
x := append(macbuf, msgbuf...)
2011-03-21 06:55:27 +11:00
buf = append(x, tsigvar...)
} else {
2011-04-19 06:08:12 +10:00
buf = append(msgbuf, tsigvar...)
2011-03-21 06:55:27 +11:00
}
2011-03-22 03:43:03 +11:00
return buf, nil
2011-03-21 06:55:27 +11:00
}
2011-04-19 19:31:47 +10:00
// Strip the TSIG from the raw message
func stripTsig(msg []byte) ([]byte, *RR_TSIG, os.Error) {
2011-03-16 04:43:05 +11:00
// Copied from msg.go's Unpack()
// Header.
var dh Header
dns := new(Msg)
2011-04-23 00:37:26 +10:00
rr := new(RR_TSIG)
2011-03-16 04:43:05 +11:00
off := 0
tsigoff := 0
var ok bool
if off, ok = unpackStruct(&dh, msg, off); !ok {
2011-04-19 19:31:47 +10:00
return nil, nil, ErrUnpack
2011-03-16 04:43:05 +11:00
}
if dh.Arcount == 0 {
2011-04-19 19:31:47 +10:00
return nil, nil, ErrNoSig
2011-03-16 04:43:05 +11:00
}
2011-04-23 00:37:26 +10:00
// Rcode, see msg.go Unpack()
if int(dh.Bits&0xF) == RcodeNotAuth {
return nil, nil, ErrAuth
}
2011-03-16 04:43:05 +11:00
// Arrays.
dns.Question = make([]Question, dh.Qdcount)
dns.Answer = make([]RR, dh.Ancount)
dns.Ns = make([]RR, dh.Nscount)
dns.Extra = make([]RR, dh.Arcount)
for i := 0; i < len(dns.Question); i++ {
off, ok = unpackStruct(&dns.Question[i], msg, off)
}
for i := 0; i < len(dns.Answer); i++ {
dns.Answer[i], off, ok = unpackRR(msg, off)
}
for i := 0; i < len(dns.Ns); i++ {
dns.Ns[i], off, ok = unpackRR(msg, off)
}
for i := 0; i < len(dns.Extra); i++ {
tsigoff = off
dns.Extra[i], off, ok = unpackRR(msg, off)
if dns.Extra[i].Header().Rrtype == TypeTSIG {
2011-04-23 00:37:26 +10:00
rr = dns.Extra[i].(*RR_TSIG)
2011-03-16 04:43:05 +11:00
// Adjust Arcount.
arcount, _ := unpackUint16(msg, 10)
msg[10], msg[11] = packUint16(arcount - 1)
break
}
}
if !ok {
2011-04-19 19:31:47 +10:00
return nil, nil, ErrUnpack
2011-03-16 04:43:05 +11:00
}
2011-04-23 00:37:26 +10:00
if rr == nil {
2011-04-19 19:31:47 +10:00
return nil, nil, ErrNoSig
2011-04-23 00:37:26 +10:00
}
2011-04-19 19:31:47 +10:00
return msg[:tsigoff], rr, nil
}