static isc_result_t
table_towire(isccc_sexpr_t *alist, isccc_region_t *target)
{
isccc_sexpr_t *kv, *elt, *k, *v;
char *ks;
isc_result_t result;
size_t len;
for (elt = isccc_alist_first(alist);
elt != NULL;
elt = ISCCC_SEXPR_CDR(elt)) {
kv = ISCCC_SEXPR_CAR(elt);
k = ISCCC_SEXPR_CAR(kv);
ks = isccc_sexpr_tostring(k);
v = ISCCC_SEXPR_CDR(kv);
len = strlen(ks);
INSIST(len <= 255U);
/*
* Emit the key name.
*/
if (REGION_SIZE(*target) < 1 + len)
return (ISC_R_NOSPACE);
PUT8(len, target->rstart);
PUT_MEM(ks, len, target->rstart);
/*
* Emit the value.
*/
result = value_towire(v, target);
if (result != ISC_R_SUCCESS)
return (result);
}
return (ISC_R_SUCCESS);
}
static isc_result_t
verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
isccc_region_t *secret)
{
isc_hmacmd5_t ctx;
isccc_region_t source;
isccc_region_t target;
isc_result_t result;
isccc_sexpr_t *_auth, *hmd5;
unsigned char digest[ISC_MD5_DIGESTLENGTH];
unsigned char digestb64[ISC_MD5_DIGESTLENGTH * 4];
/*
* Extract digest.
*/
_auth = isccc_alist_lookup(alist, "_auth");
if (_auth == NULL)
return (ISC_R_FAILURE);
hmd5 = isccc_alist_lookup(_auth, "hmd5");
if (hmd5 == NULL)
return (ISC_R_FAILURE);
/*
* Compute digest.
*/
isc_hmacmd5_init(&ctx, secret->rstart, REGION_SIZE(*secret));
isc_hmacmd5_update(&ctx, data, length);
isc_hmacmd5_sign(&ctx, digest);
source.rstart = digest;
source.rend = digest + ISC_MD5_DIGESTLENGTH;
target.rstart = digestb64;
target.rend = digestb64 + ISC_MD5_DIGESTLENGTH * 4;
result = isccc_base64_encode(&source, 64, "", &target);
if (result != ISC_R_SUCCESS)
return (result);
/*
* Strip trailing == and NUL terminate target.
*/
target.rstart -= 2;
*target.rstart++ = '\0';
/*
* Verify.
*/
if (strcmp((char *)digestb64, isccc_sexpr_tostring(hmd5)) != 0)
return (ISCCC_R_BADAUTH);
return (ISC_R_SUCCESS);
}
isc_result_t
isccc_cc_lookupstring(isccc_sexpr_t *alist, const char *key, char **strp)
{
isccc_sexpr_t *kv, *v;
kv = isccc_alist_assq(alist, key);
if (kv != NULL) {
v = ISCCC_SEXPR_CDR(kv);
if (isccc_sexpr_binaryp(v)) {
if (strp != NULL)
*strp = isccc_sexpr_tostring(v);
return (ISC_R_SUCCESS);
} else
return (ISC_R_EXISTS);
}
return (ISC_R_NOTFOUND);
}
void
isccc_alist_prettyprint(isccc_sexpr_t *sexpr, unsigned int indent, FILE *stream)
{
isccc_sexpr_t *elt, *kv, *k, *v;
if (isccc_alist_alistp(sexpr)) {
fprintf(stream, "{\n");
indent += 4;
for (elt = isccc_alist_first(sexpr);
elt != NULL;
elt = CDR(elt)) {
kv = CAR(elt);
INSIST(isccc_sexpr_listp(kv));
k = CAR(kv);
v = CDR(kv);
INSIST(isccc_sexpr_stringp(k));
fprintf(stream, "%.*s%s => ", (int)indent, spaces,
isccc_sexpr_tostring(k));
isccc_alist_prettyprint(v, indent, stream);
if (CDR(elt) != NULL)
fprintf(stream, ",");
fprintf(stream, "\n");
}
indent -= 4;
fprintf(stream, "%.*s}", (int)indent, spaces);
} else if (isccc_sexpr_listp(sexpr)) {
fprintf(stream, "(\n");
indent += 4;
for (elt = sexpr;
elt != NULL;
elt = CDR(elt)) {
fprintf(stream, "%.*s", (int)indent, spaces);
isccc_alist_prettyprint(CAR(elt), indent, stream);
if (CDR(elt) != NULL)
fprintf(stream, ",");
fprintf(stream, "\n");
}
indent -= 4;
fprintf(stream, "%.*s)", (int)indent, spaces);
} else
isccc_sexpr_print(sexpr, stream);
}
isc_result_t
isccc_cc_lookupuint32(isccc_sexpr_t *alist, const char *key,
isc_uint32_t *uintp)
{
isccc_sexpr_t *kv, *v;
kv = isccc_alist_assq(alist, key);
if (kv != NULL) {
v = ISCCC_SEXPR_CDR(kv);
if (isccc_sexpr_binaryp(v)) {
if (uintp != NULL)
*uintp = (isc_uint32_t)
strtoul(isccc_sexpr_tostring(v),
NULL, 10);
return (ISC_R_SUCCESS);
} else
return (ISC_R_EXISTS);
}
return (ISC_R_NOTFOUND);
}
static isc_result_t
verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
isc_uint32_t algorithm, isccc_region_t *secret)
{
union {
isc_hmacmd5_t hmd5;
isc_hmacsha1_t hsha;
isc_hmacsha224_t h224;
isc_hmacsha256_t h256;
isc_hmacsha384_t h384;
isc_hmacsha512_t h512;
} ctx;
isccc_region_t source;
isccc_region_t target;
isc_result_t result;
isccc_sexpr_t *_auth, *hmac;
unsigned char digest[ISC_SHA512_DIGESTLENGTH];
unsigned char digestb64[HSHA_LENGTH * 4];
/*
* Extract digest.
*/
_auth = isccc_alist_lookup(alist, "_auth");
if (!isccc_alist_alistp(_auth))
return (ISC_R_FAILURE);
if (algorithm == ISCCC_ALG_HMACMD5)
hmac = isccc_alist_lookup(_auth, "hmd5");
else
hmac = isccc_alist_lookup(_auth, "hsha");
if (!isccc_sexpr_binaryp(hmac))
return (ISC_R_FAILURE);
/*
* Compute digest.
*/
source.rstart = digest;
target.rstart = digestb64;
switch (algorithm) {
case ISCCC_ALG_HMACMD5:
isc_hmacmd5_init(&ctx.hmd5, secret->rstart,
REGION_SIZE(*secret));
isc_hmacmd5_update(&ctx.hmd5, data, length);
isc_hmacmd5_sign(&ctx.hmd5, digest);
source.rend = digest + ISC_MD5_DIGESTLENGTH;
break;
case ISCCC_ALG_HMACSHA1:
isc_hmacsha1_init(&ctx.hsha, secret->rstart,
REGION_SIZE(*secret));
isc_hmacsha1_update(&ctx.hsha, data, length);
isc_hmacsha1_sign(&ctx.hsha, digest,
ISC_SHA1_DIGESTLENGTH);
source.rend = digest + ISC_SHA1_DIGESTLENGTH;
break;
case ISCCC_ALG_HMACSHA224:
isc_hmacsha224_init(&ctx.h224, secret->rstart,
REGION_SIZE(*secret));
isc_hmacsha224_update(&ctx.h224, data, length);
isc_hmacsha224_sign(&ctx.h224, digest,
ISC_SHA224_DIGESTLENGTH);
source.rend = digest + ISC_SHA224_DIGESTLENGTH;
break;
case ISCCC_ALG_HMACSHA256:
isc_hmacsha256_init(&ctx.h256, secret->rstart,
REGION_SIZE(*secret));
isc_hmacsha256_update(&ctx.h256, data, length);
isc_hmacsha256_sign(&ctx.h256, digest,
ISC_SHA256_DIGESTLENGTH);
source.rend = digest + ISC_SHA256_DIGESTLENGTH;
break;
case ISCCC_ALG_HMACSHA384:
isc_hmacsha384_init(&ctx.h384, secret->rstart,
REGION_SIZE(*secret));
isc_hmacsha384_update(&ctx.h384, data, length);
isc_hmacsha384_sign(&ctx.h384, digest,
ISC_SHA384_DIGESTLENGTH);
source.rend = digest + ISC_SHA384_DIGESTLENGTH;
break;
case ISCCC_ALG_HMACSHA512:
isc_hmacsha512_init(&ctx.h512, secret->rstart,
REGION_SIZE(*secret));
isc_hmacsha512_update(&ctx.h512, data, length);
isc_hmacsha512_sign(&ctx.h512, digest,
ISC_SHA512_DIGESTLENGTH);
source.rend = digest + ISC_SHA512_DIGESTLENGTH;
break;
default:
return (ISC_R_FAILURE);
}
target.rstart = digestb64;
target.rend = digestb64 + sizeof(digestb64);
memset(digestb64, 0, sizeof(digestb64));
result = isccc_base64_encode(&source, 64, "", &target);
if (result != ISC_R_SUCCESS)
return (result);
/*
* Verify.
*/
if (algorithm == ISCCC_ALG_HMACMD5) {
unsigned char *value;
value = (unsigned char *) isccc_sexpr_tostring(hmac);
if (!isc_safe_memequal(value, digestb64, HMD5_LENGTH))
return (ISCCC_R_BADAUTH);
} else {
unsigned char *value;
isc_uint32_t valalg;
value = (unsigned char *) isccc_sexpr_tostring(hmac);
GET8(valalg, value);
if ((valalg != algorithm) ||
!isc_safe_memequal(value, digestb64, HSHA_LENGTH))
return (ISCCC_R_BADAUTH);
}
return (ISC_R_SUCCESS);
}
