cert.c

/*
 * Part of DNS zone file validator `validns`.
 *
 * Copyright 2011-2014 Anton Berezin <tobez@tobez.org>
 * Modified BSD license.
 * (See LICENSE file in the distribution.)
 *
 */
#include <sys/types.h>
#include <stdio.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <string.h>
#include <ctype.h>

#include "common.h"
#include "textparse.h"
#include "mempool.h"
#include "carp.h"
#include "rr.h"

/* See http://tools.ietf.org/html/rfc4398 for CERT description.
 * See http://www.iana.org/assignments/cert-rr-types/cert-rr-types.xml
 * for certificate types.  The version implemented here
 * has "Last Updated" equal to "2006-09-27" */

static int extract_certificate_type(char **s, char *what)
{
	int type;
	char *str_type;

	if (isdigit(**s)) {
		type = extract_integer(s, what);
		if (type >= 1 && type <= 8)
			return type;
		if (type == 253 || type == 254)
			return type;
		if (type >= 65280 && type <= 65534)
			return type;
		if (type < 0 || type > 65535) {
			bitch("bad certificate type %d", type);
			return -1;
		}
		if (type == 0 || type == 255 || type == 65535) {
			bitch("certificate type %d is reserved by IANA", type);
			return -1;
		}
		bitch("certificate type %d is unassigned", type);
		return -1;
	} else {
		str_type = extract_label(s, what, "temporary");
		if (!str_type) return -1;
		if (strcmp(str_type, "pkix") == 0)
			return 1;
		if (strcmp(str_type, "spki") == 0)
			return 2;
		if (strcmp(str_type, "pgp") == 0)
			return 3;
		if (strcmp(str_type, "ipkix") == 0)
			return 4;
		if (strcmp(str_type, "ispki") == 0)
			return 5;
		if (strcmp(str_type, "ipgp") == 0)
			return 6;
		if (strcmp(str_type, "acpkix") == 0)
			return 7;
		if (strcmp(str_type, "iacpkix") == 0)
			return 8;
		if (strcmp(str_type, "uri") == 0)
			return 253;
		if (strcmp(str_type, "oid") == 0)
			return 254;
		bitch("bad certificate type %s", str_type);
		return -1;
	}
}

static struct rr* cert_parse(char *name, long ttl, int type, char *s)
{
	struct rr_cert *rr = getmem(sizeof(*rr));
	int cert_type, key_tag, alg;

	cert_type = extract_certificate_type(&s, "certificate type");
	if (cert_type < 0)	return NULL;
	rr->type = cert_type;

	key_tag = extract_integer(&s, "key tag");
	if (key_tag < 0)	return NULL;
	if (key_tag > 65535)
		return bitch("bad key tag");
	rr->key_tag = key_tag;

	if (isdigit(*s)) {
		alg = extract_integer(&s, "algorithm");
		if (alg < 0)	return NULL;
		if (alg > 255)	return bitch("bad algorithm");
		if (alg != 0) {  /* 0 is just fine */
			if (algorithm_type(alg) == ALG_UNSUPPORTED)
				return bitch("bad algorithm %d", alg);
		}
	} else {
		alg = extract_algorithm(&s, "algorithm");
		if (alg == ALG_UNSUPPORTED)	return NULL;
	}
	rr->algorithm = alg;

	if (alg == 0 && key_tag != 0) {
		/* we might want to bitch here, but RFC says "SHOULD", so we don't */
	}

	rr->certificate = extract_base64_binary_data(&s, "certificate");
	if (rr->certificate.length < 0)	return NULL;
	/* TODO validate cert length based on algorithm */

	if (*s) {
		return bitch("garbage after valid CERT data");
	}
	return store_record(type, name, ttl, rr);
}

static char* cert_human(struct rr *rrv)
{
	RRCAST(cert);
    char s[1024];

    snprintf(s, 1024, "%d %d %d ...",
		rr->type, rr->key_tag, rr->algorithm);
    return quickstrdup_temp(s);
}

static struct binary_data cert_wirerdata(struct rr *rrv)
{
	RRCAST(cert);

	return compose_binary_data("221d", 1,
		rr->type, rr->key_tag, rr->algorithm,
		rr->certificate);
}

struct rr_methods cert_methods = { cert_parse, cert_human, cert_wirerdata, NULL, NULL };