1 /* $NetBSD: dnssec.c,v 1.4 2006/09/09 16:22:09 manu Exp $ */
2
3 /* $KAME: dnssec.c,v 1.2 2001/08/05 18:46:07 itojun Exp $ */
4
5 /*
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include "config.h"
35
36 #include <sys/types.h>
37 #include <sys/param.h>
38 #include <stdlib.h>
39 #include <string.h>
40
41 #include "var.h"
42 #include "vmbuf.h"
43 #include "misc.h"
44 #include "plog.h"
45 #include "debug.h"
46
47 #include "isakmp_var.h"
48 #include "isakmp.h"
49 #include "ipsec_doi.h"
50 #include "oakley.h"
51 #include "netdb_dnssec.h"
52 #include "strnames.h"
53 #include "dnssec.h"
54 #include "gcmalloc.h"
55
56 extern int h_errno;
57
58 cert_t *
dnssec_getcert(id)59 dnssec_getcert(id)
60 vchar_t *id;
61 {
62 cert_t *cert = NULL;
63 struct certinfo *res = NULL;
64 struct ipsecdoi_id_b *id_b;
65 int type;
66 char *name = NULL;
67 int namelen;
68 int error;
69
70 id_b = (struct ipsecdoi_id_b *)id->v;
71
72 namelen = id->l - sizeof(*id_b);
73 name = racoon_malloc(namelen + 1);
74 if (!name) {
75 plog(LLV_ERROR, LOCATION, NULL,
76 "failed to get buffer.\n");
77 return NULL;
78 }
79 memcpy(name, id_b + 1, namelen);
80 name[namelen] = '\0';
81
82 switch (id_b->type) {
83 case IPSECDOI_ID_FQDN:
84 error = getcertsbyname(name, &res);
85 if (error != 0) {
86 plog(LLV_ERROR, LOCATION, NULL,
87 "getcertsbyname(\"%s\") failed.\n", name);
88 goto err;
89 }
90 break;
91 case IPSECDOI_ID_IPV4_ADDR:
92 case IPSECDOI_ID_IPV6_ADDR:
93 /* XXX should be processed to query PTR ? */
94 default:
95 plog(LLV_ERROR, LOCATION, NULL,
96 "inpropper ID type passed %s "
97 "though getcert method is dnssec.\n",
98 s_ipsecdoi_ident(id_b->type));
99 goto err;
100 }
101
102 /* check response */
103 if (res->ci_next != NULL) {
104 plog(LLV_WARNING, LOCATION, NULL,
105 "not supported multiple CERT RR.\n");
106 }
107 switch (res->ci_type) {
108 case DNSSEC_TYPE_PKIX:
109 /* XXX is it enough condition to set this type ? */
110 type = ISAKMP_CERT_X509SIGN;
111 break;
112 default:
113 plog(LLV_ERROR, LOCATION, NULL,
114 "not supported CERT RR type %d.\n", res->ci_type);
115 goto err;
116 }
117
118 /* create cert holder */
119 cert = oakley_newcert();
120 if (cert == NULL) {
121 plog(LLV_ERROR, LOCATION, NULL,
122 "failed to get cert buffer.\n");
123 goto err;
124 }
125 cert->pl = vmalloc(res->ci_certlen + 1);
126 if (cert->pl == NULL) {
127 plog(LLV_ERROR, LOCATION, NULL,
128 "failed to get cert buffer.\n");
129 goto err;
130 }
131 memcpy(cert->pl->v + 1, res->ci_cert, res->ci_certlen);
132 cert->pl->v[0] = type;
133 cert->cert.v = cert->pl->v + 1;
134 cert->cert.l = cert->pl->l - 1;
135
136 plog(LLV_DEBUG, LOCATION, NULL, "created CERT payload:\n");
137 plogdump(LLV_DEBUG, cert->pl->v, cert->pl->l);
138
139 end:
140 if (res)
141 freecertinfo(res);
142
143 return cert;
144
145 err:
146 if (name)
147 racoon_free(name);
148 if (cert) {
149 oakley_delcert(cert);
150 cert = NULL;
151 }
152
153 goto end;
154 }
155