/*

 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")

 *

 * This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, you can obtain one at https://mozilla.org/MPL/2.0/.

 *

 * See the COPYRIGHT file distributed with this work for additional

 * information regarding copyright ownership.

 */

#include <config.h>

#include <isc/mem.h>

#include <isc/util.h>

#include <pk11/site.h>

#include <dns/tsec.h>

#include <dns/tsig.h>

#include <dns/result.h>

#include <dst/dst.h>

#define DNS_TSEC_MAGIC			ISC_MAGIC('T', 's', 'e', 'c')

#define DNS_TSEC_VALID(t)		ISC_MAGIC_VALID(t, DNS_TSEC_MAGIC)

/*%

 * DNS Transaction Security object.  We assume this is not shared by

 * multiple threads, and so the structure does not contain a lock.

 */

struct dns_tsec {

	unsigned int		magic;

	dns_tsectype_t		type;

	isc_mem_t		*mctx;

	union {

		dns_tsigkey_t	*tsigkey;

		dst_key_t	*key;

	} ukey;

};

isc_result_t

dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t *key,

		dns_tsec_t **tsecp)

{

	isc_result_t result;

	dns_tsec_t *tsec;

	dns_tsigkey_t *tsigkey = NULL;

	dns_name_t *algname;

	REQUIRE(mctx != NULL);

	REQUIRE(tsecp != NULL && *tsecp == NULL);

	tsec = isc_mem_get(mctx, sizeof(*tsec));

	if (tsec == NULL)

		return (ISC_R_NOMEMORY);

	tsec->type = type;

	tsec->mctx = mctx;

	switch (type) {

	case dns_tsectype_tsig:

		switch (dst_key_alg(key)) {

#ifndef PK11_MD5_DISABLE

		case DST_ALG_HMACMD5:

			algname = dns_tsig_hmacmd5_name;

			break;

#endif

		case DST_ALG_HMACSHA1:

			algname = dns_tsig_hmacsha1_name;

			break;

		case DST_ALG_HMACSHA224:

			algname = dns_tsig_hmacsha224_name;

			break;

		case DST_ALG_HMACSHA256:

			algname = dns_tsig_hmacsha256_name;

			break;

		case DST_ALG_HMACSHA384:

			algname = dns_tsig_hmacsha384_name;

			break;

		case DST_ALG_HMACSHA512:

			algname = dns_tsig_hmacsha512_name;

			break;

		default:

			isc_mem_put(mctx, tsec, sizeof(*tsec));

			return (DNS_R_BADALG);

		}

		result = dns_tsigkey_createfromkey(dst_key_name(key),

						   algname, key, false,

						   NULL, 0, 0, mctx, NULL,

						   &tsigkey);

		if (result != ISC_R_SUCCESS) {

			isc_mem_put(mctx, tsec, sizeof(*tsec));

			return (result);

		}

		tsec->ukey.tsigkey = tsigkey;

		break;

	case dns_tsectype_sig0:

		tsec->ukey.key = key;

		break;

	default:

		INSIST(0);

		ISC_UNREACHABLE();

	}

	tsec->magic = DNS_TSEC_MAGIC;

	*tsecp = tsec;

	return (ISC_R_SUCCESS);

}

void

dns_tsec_destroy(dns_tsec_t **tsecp) {

	dns_tsec_t *tsec;

	REQUIRE(tsecp != NULL && *tsecp != NULL);

	tsec = *tsecp;

	REQUIRE(DNS_TSEC_VALID(tsec));

	switch (tsec->type) {

	case dns_tsectype_tsig:

		dns_tsigkey_detach(&tsec->ukey.tsigkey);

		break;

	case dns_tsectype_sig0:

		dst_key_free(&tsec->ukey.key);

		break;

	default:

		INSIST(0);

		ISC_UNREACHABLE();

	}

	tsec->magic = 0;

	isc_mem_put(tsec->mctx, tsec, sizeof(*tsec));

	*tsecp = NULL;

}

dns_tsectype_t

dns_tsec_gettype(dns_tsec_t *tsec) {

	REQUIRE(DNS_TSEC_VALID(tsec));

	return (tsec->type);

}

void

dns_tsec_getkey(dns_tsec_t *tsec, void *keyp) {

	REQUIRE(DNS_TSEC_VALID(tsec));

	REQUIRE(keyp != NULL);

	switch (tsec->type) {

	case dns_tsectype_tsig:

		dns_tsigkey_attach(tsec->ukey.tsigkey, (dns_tsigkey_t **)keyp);

		break;

	case dns_tsectype_sig0:

		*(dst_key_t **)keyp = tsec->ukey.key;

		break;

	default:

		INSIST(0);

		ISC_UNREACHABLE();

	}

}