mirror of
git://git.gnupg.org/gnupg.git
synced 2024-12-22 10:19:57 +01:00
37df3d5f59
Having the LGPL on the common GnuPG code helps to share code between GnuPG and related projects (like GPGME and Libassuan). This is good for interoperability and to reduces bugs. * common/asshelp.c, common/asshelp.h, common/asshelp2.c, common/b64dec.c * common/b64enc.c, common/convert.c, common/dns-cert.c * common/dns-cert.h common/exechelp-posix.c, common/exechelp-w32.c * common/exechelp-w32ce.c, common/exechelp.h, common/get-passphrase.c * common/get-passphrase.h, common/gettime.c, common/gpgrlhelp.c * common/helpfile.c, common/homedir.c, common/http.c, common/http.h * common/i18n.c, common/init.c, common/init.h, common/iobuf.c * common/iobuf.h, common/localename.c, common/membuf.c, common/membuf.h * common/miscellaneous.c, common/openpgp-oid.c, common/openpgpdefs.h * common/percent.c, common/pka.c, common/pka.h, common/session-env.c * common/session-env.h, common/sexp-parse.h, common/sexputil.c * common/signal.c, common/srv.c, common/srv.h, common/ssh-utils.c * common/ssh-utils.h, common/sysutils.c, common/sysutils.h * common/tlv.c, common/tlv.h, common/ttyio.c, common/ttyio.h * common/userids.c, common/userids.h, common/xasprintf.c: Change license to LGPLv3+/GPLv2+/
370 lines
11 KiB
C
370 lines
11 KiB
C
/* dns-cert.c - DNS CERT code (rfc-4398)
|
|
* Copyright (C) 2005, 2006, 2009 Free Software Foundation, Inc.
|
|
*
|
|
* This file is part of GNUPG.
|
|
*
|
|
* This file is free software; you can redistribute it and/or modify
|
|
* it under the terms of either
|
|
*
|
|
* - the GNU Lesser General Public License as published by the Free
|
|
* Software Foundation; either version 3 of the License, or (at
|
|
* your option) any later version.
|
|
*
|
|
* or
|
|
*
|
|
* - the GNU General Public License as published by the Free
|
|
* Software Foundation; either version 2 of the License, or (at
|
|
* your option) any later version.
|
|
*
|
|
* or both in parallel, as here.
|
|
*
|
|
* This file is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include <config.h>
|
|
#include <sys/types.h>
|
|
#ifdef USE_DNS_CERT
|
|
# ifdef HAVE_W32_SYSTEM
|
|
# include <windows.h>
|
|
# else
|
|
# include <netinet/in.h>
|
|
# include <arpa/nameser.h>
|
|
# include <resolv.h>
|
|
# endif
|
|
# include <string.h>
|
|
#endif
|
|
#ifdef USE_ADNS
|
|
# include <adns.h>
|
|
# ifndef HAVE_ADNS_FREE
|
|
# define adns_free free
|
|
# endif
|
|
#endif
|
|
|
|
#include "util.h"
|
|
#include "dns-cert.h"
|
|
|
|
/* Not every installation has gotten around to supporting CERTs
|
|
yet... */
|
|
#ifndef T_CERT
|
|
#define T_CERT 37
|
|
#endif
|
|
|
|
/* ADNS has no support for CERT yet. */
|
|
#define my_adns_r_cert 37
|
|
|
|
|
|
/* Certificate types according to RFC-4398. */
|
|
#define CERTTYPE_PKIX 1 /* X.509 as per PKIX. */
|
|
#define CERTTYPE_SPKI 2 /* SPKI certificate. */
|
|
#define CERTTYPE_PGP 3 /* OpenPGP packet. */
|
|
#define CERTTYPE_IPKIX 4 /* The URL of an X.509 data object. */
|
|
#define CERTTYPE_ISPKI 5 /* The URL of an SPKI certificate. */
|
|
#define CERTTYPE_IPGP 6 /* The fingerprint and URL of an OpenPGP packet.*/
|
|
#define CERTTYPE_ACPKIX 7 /* Attribute Certificate. */
|
|
#define CERTTYPE_IACPKIX 8 /* The URL of an Attribute Certificate. */
|
|
#define CERTTYPE_URI 253 /* URI private. */
|
|
#define CERTTYPE_OID 254 /* OID private. */
|
|
|
|
|
|
/* Returns 0 on success or an error code. If a PGP CERT record was
|
|
found, a new estream with that key will be returned at R_KEY and
|
|
the other return parameters are set to NULL/0. If an IPGP CERT
|
|
record was found the fingerprint is stored as an allocated block at
|
|
R_FPR and its length at R_FPRLEN; an URL is is allocated as a
|
|
string and returned at R_URL. Note that this function returns the
|
|
first CERT found with a supported type; it is expected that only
|
|
one CERT record is used. */
|
|
gpg_error_t
|
|
get_dns_cert (const char *name, estream_t *r_key,
|
|
unsigned char **r_fpr, size_t *r_fprlen, char **r_url)
|
|
{
|
|
#ifdef USE_DNS_CERT
|
|
#ifdef USE_ADNS
|
|
gpg_error_t err;
|
|
adns_state state;
|
|
adns_answer *answer = NULL;
|
|
unsigned int ctype;
|
|
int count;
|
|
|
|
*r_key = NULL;
|
|
*r_fpr = NULL;
|
|
*r_fprlen = 0;
|
|
*r_url = NULL;
|
|
|
|
if (adns_init (&state, adns_if_noerrprint, NULL))
|
|
{
|
|
err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
|
|
log_error ("error initializing adns: %s\n", strerror (errno));
|
|
return err;
|
|
}
|
|
|
|
if (adns_synchronous (state, name, (adns_r_unknown | my_adns_r_cert),
|
|
adns_qf_quoteok_query, &answer))
|
|
{
|
|
err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
|
|
/* log_error ("DNS query failed: %s\n", strerror (errno)); */
|
|
adns_finish (state);
|
|
return err;
|
|
}
|
|
if (answer->status != adns_s_ok)
|
|
{
|
|
/* log_error ("DNS query returned an error: %s (%s)\n", */
|
|
/* adns_strerror (answer->status), */
|
|
/* adns_errabbrev (answer->status)); */
|
|
err = gpg_err_make (default_errsource, GPG_ERR_NOT_FOUND);
|
|
goto leave;
|
|
}
|
|
|
|
err = gpg_err_make (default_errsource, GPG_ERR_NOT_FOUND);
|
|
for (count = 0; count < answer->nrrs; count++)
|
|
{
|
|
int datalen = answer->rrs.byteblock[count].len;
|
|
const unsigned char *data = answer->rrs.byteblock[count].data;
|
|
|
|
if (datalen < 5)
|
|
continue; /* Truncated CERT record - skip. */
|
|
|
|
ctype = ((data[0] << 8) | data[1]);
|
|
/* (key tag and algorithm fields are not required.) */
|
|
data += 5;
|
|
datalen -= 5;
|
|
|
|
if (ctype == CERTTYPE_PGP && datalen >= 11)
|
|
{
|
|
/* CERT type is PGP. Gpg checks for a minimum length of 11,
|
|
thus we do the same. */
|
|
*r_key = es_fopenmem_init (0, "rwb", data, datalen);
|
|
if (!*r_key)
|
|
err = gpg_err_make (default_errsource,
|
|
gpg_err_code_from_syserror ());
|
|
else
|
|
err = 0;
|
|
goto leave;
|
|
}
|
|
else if (ctype == CERTTYPE_IPGP && datalen && datalen < 1023
|
|
&& datalen >= data[0] + 1 && fpr && fpr_len && url)
|
|
{
|
|
/* CERT type is IPGP. We made sure that the data is
|
|
plausible and that the caller requested this
|
|
information. */
|
|
*r_fprlen = data[0];
|
|
if (*r_fprlen)
|
|
{
|
|
*r_fpr = xtrymalloc (*r_fprlen);
|
|
if (!*r_fpr)
|
|
{
|
|
err = gpg_err_make (default_errsource,
|
|
gpg_err_code_from_syserror ());
|
|
goto leave;
|
|
}
|
|
memcpy (*r_fpr, data + 1, *r_fprlen);
|
|
}
|
|
else
|
|
*r_fpr = NULL;
|
|
|
|
if (datalen > *r_fprlen + 1)
|
|
{
|
|
*url = xtrymalloc (datalen - (*r_fprlen + 1) + 1);
|
|
if (!*r_url)
|
|
{
|
|
err = gpg_err_make (default_errsource,
|
|
gpg_err_code_from_syserror ());
|
|
xfree (*r_fpr);
|
|
*r_fpr = NULL;
|
|
goto leave;
|
|
}
|
|
memcpy (*url, data + (*r_fprlen + 1), datalen - (*r_fprlen + 1));
|
|
(*url)[datalen - (*r_fprlen + 1)] = '\0';
|
|
}
|
|
else
|
|
*r_url = NULL;
|
|
|
|
err = 0;
|
|
goto leave;
|
|
}
|
|
}
|
|
|
|
leave:
|
|
adns_free (answer);
|
|
adns_finish (state);
|
|
return err;
|
|
|
|
#else /*!USE_ADNS*/
|
|
|
|
gpg_error_t err;
|
|
unsigned char *answer;
|
|
int r;
|
|
u16 count;
|
|
|
|
*r_key = NULL;
|
|
*r_fpr = NULL;
|
|
*r_fprlen = 0;
|
|
*r_url = NULL;
|
|
|
|
/* Allocate a 64k buffer which is the limit for an DNS response. */
|
|
answer = xtrymalloc (65536);
|
|
if (!answer)
|
|
return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
|
|
|
|
err = gpg_err_make (default_errsource, GPG_ERR_NOT_FOUND);
|
|
|
|
r = res_query (name, C_IN, T_CERT, answer, 65536);
|
|
/* Not too big, not too small, no errors and at least 1 answer. */
|
|
if (r >= sizeof (HEADER) && r <= 65536
|
|
&& (((HEADER *) answer)->rcode) == NOERROR
|
|
&& (count = ntohs (((HEADER *) answer)->ancount)))
|
|
{
|
|
int rc;
|
|
unsigned char *pt, *emsg;
|
|
|
|
emsg = &answer[r];
|
|
|
|
pt = &answer[sizeof (HEADER)];
|
|
|
|
/* Skip over the query */
|
|
|
|
rc = dn_skipname (pt, emsg);
|
|
if (rc == -1)
|
|
{
|
|
err = gpg_err_make (default_errsource, GPG_ERR_INV_OBJ);
|
|
goto leave;
|
|
}
|
|
pt += rc + QFIXEDSZ;
|
|
|
|
/* There are several possible response types for a CERT request.
|
|
We're interested in the PGP (a key) and IPGP (a URI) types.
|
|
Skip all others. TODO: A key is better than a URI since
|
|
we've gone through all this bother to fetch it, so favor that
|
|
if we have both PGP and IPGP? */
|
|
|
|
while (count-- > 0 && pt < emsg)
|
|
{
|
|
u16 type, class, dlen, ctype;
|
|
|
|
rc = dn_skipname (pt, emsg); /* the name we just queried for */
|
|
if (rc == -1)
|
|
{
|
|
err = gpg_err_make (default_errsource, GPG_ERR_INV_OBJ);
|
|
goto leave;
|
|
}
|
|
|
|
pt += rc;
|
|
|
|
/* Truncated message? 15 bytes takes us to the point where
|
|
we start looking at the ctype. */
|
|
if ((emsg - pt) < 15)
|
|
break;
|
|
|
|
type = *pt++ << 8;
|
|
type |= *pt++;
|
|
|
|
class = *pt++ << 8;
|
|
class |= *pt++;
|
|
/* We asked for IN and got something else !? */
|
|
if (class != C_IN)
|
|
break;
|
|
|
|
/* ttl */
|
|
pt += 4;
|
|
|
|
/* data length */
|
|
dlen = *pt++ << 8;
|
|
dlen |= *pt++;
|
|
|
|
/* We asked for CERT and got something else - might be a
|
|
CNAME, so loop around again. */
|
|
if (type != T_CERT)
|
|
{
|
|
pt += dlen;
|
|
continue;
|
|
}
|
|
|
|
/* The CERT type */
|
|
ctype = *pt++ << 8;
|
|
ctype |= *pt++;
|
|
|
|
/* Skip the CERT key tag and algo which we don't need. */
|
|
pt += 3;
|
|
|
|
dlen -= 5;
|
|
|
|
/* 15 bytes takes us to here */
|
|
|
|
if (ctype == CERTTYPE_PGP && dlen)
|
|
{
|
|
/* PGP type */
|
|
*r_key = es_fopenmem_init (0, "rwb", pt, dlen);
|
|
if (!*r_key)
|
|
err = gpg_err_make (default_errsource,
|
|
gpg_err_code_from_syserror ());
|
|
else
|
|
err = 0;
|
|
goto leave;
|
|
}
|
|
else if (ctype == CERTTYPE_IPGP
|
|
&& dlen && dlen < 1023 && dlen >= pt[0] + 1)
|
|
{
|
|
/* IPGP type */
|
|
*r_fprlen = pt[0];
|
|
if (*r_fprlen)
|
|
{
|
|
*r_fpr = xtrymalloc (*r_fprlen);
|
|
if (!*r_fpr)
|
|
{
|
|
err = gpg_err_make (default_errsource,
|
|
gpg_err_code_from_syserror ());
|
|
goto leave;
|
|
}
|
|
memcpy (*r_fpr, &pt[1], *r_fprlen);
|
|
}
|
|
else
|
|
*r_fpr = NULL;
|
|
|
|
if (dlen > *r_fprlen + 1)
|
|
{
|
|
*r_url = xtrymalloc (dlen - (*r_fprlen + 1) + 1);
|
|
if (!*r_fpr)
|
|
{
|
|
err = gpg_err_make (default_errsource,
|
|
gpg_err_code_from_syserror ());
|
|
xfree (*r_fpr);
|
|
*r_fpr = NULL;
|
|
goto leave;
|
|
}
|
|
memcpy (*r_url, &pt[*r_fprlen + 1], dlen - (*r_fprlen + 1));
|
|
(*r_url)[dlen - (*r_fprlen + 1)] = '\0';
|
|
}
|
|
else
|
|
*r_url = NULL;
|
|
|
|
err = 0;
|
|
goto leave;
|
|
}
|
|
|
|
/* Neither type matches, so go around to the next answer. */
|
|
pt += dlen;
|
|
}
|
|
}
|
|
|
|
leave:
|
|
xfree (answer);
|
|
return err;
|
|
|
|
#endif /*!USE_ADNS */
|
|
#else /* !USE_DNS_CERT */
|
|
(void)name;
|
|
(void)r_key;
|
|
(void)r_fpr;
|
|
(void)r_fprlen;
|
|
(void)r_url;
|
|
|
|
return gpg_err_make (default_errsource, GPG_ERR_NOT_SUPPORTED);
|
|
#endif
|
|
}
|