?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
drm: Bring back a KNOTE() call, unbreak vblank handling
[dragonfly.git] / contrib / ldns / keys.c
blobde7c94610d862253d2c02ed2bbdce6ae843331e8
1 /*
2 * keys.c handle private keys for use in DNSSEC
3 *
4 * This module should hide some of the openSSL complexities
5 * and give a general interface for private keys and hmac
6 * handling
7 *
8 * (c) NLnet Labs, 2004-2006
9 *
10 * See the file LICENSE for the license
11 */
12
13 #include <ldns/config.h>
14
15 #include <ldns/ldns.h>
16
17 #ifdef HAVE_SSL
18 #include <openssl/ssl.h>
19 #include <openssl/engine.h>
20 #include <openssl/rand.h>
21 #endif /* HAVE_SSL */
22
23 ldns_lookup_table ldns_signing_algorithms[] = {
24 { LDNS_SIGN_RSAMD5, "RSAMD5" },
25 { LDNS_SIGN_RSASHA1, "RSASHA1" },
26 { LDNS_SIGN_RSASHA1_NSEC3, "RSASHA1-NSEC3-SHA1" },
27 #ifdef USE_SHA2
28 { LDNS_SIGN_RSASHA256, "RSASHA256" },
29 { LDNS_SIGN_RSASHA512, "RSASHA512" },
30 #endif
31 #ifdef USE_GOST
32 { LDNS_SIGN_ECC_GOST, "ECC-GOST" },
33 #endif
34 #ifdef USE_ECDSA
35 { LDNS_SIGN_ECDSAP256SHA256, "ECDSAP256SHA256" },
36 { LDNS_SIGN_ECDSAP384SHA384, "ECDSAP384SHA384" },
37 #endif
38 { LDNS_SIGN_DSA, "DSA" },
39 { LDNS_SIGN_DSA_NSEC3, "DSA-NSEC3-SHA1" },
40 { LDNS_SIGN_HMACMD5, "hmac-md5.sig-alg.reg.int" },
41 { LDNS_SIGN_HMACSHA1, "hmac-sha1" },
42 { LDNS_SIGN_HMACSHA256, "hmac-sha256" },
43 { 0, NULL }
44 };
45
46 ldns_key_list *
47 ldns_key_list_new()
48 {
49 ldns_key_list *key_list = LDNS_MALLOC(ldns_key_list);
50 if (!key_list) {
51 return NULL;
52 } else {
53 key_list->_key_count = 0;
54 key_list->_keys = NULL;
55 return key_list;
56 }
57 }
58
59 ldns_key *
60 ldns_key_new()
61 {
62 ldns_key *newkey;
63
64 newkey = LDNS_MALLOC(ldns_key);
65 if (!newkey) {
66 return NULL;
67 } else {
68 /* some defaults - not sure wether to do this */
69 ldns_key_set_use(newkey, true);
70 ldns_key_set_flags(newkey, LDNS_KEY_ZONE_KEY);
71 ldns_key_set_origttl(newkey, 0);
72 ldns_key_set_keytag(newkey, 0);
73 ldns_key_set_inception(newkey, 0);
74 ldns_key_set_expiration(newkey, 0);
75 ldns_key_set_pubkey_owner(newkey, NULL);
76 #ifdef HAVE_SSL
77 ldns_key_set_evp_key(newkey, NULL);
78 #endif /* HAVE_SSL */
79 ldns_key_set_hmac_key(newkey, NULL);
80 ldns_key_set_external_key(newkey, NULL);
81 return newkey;
82 }
83 }
84
85 ldns_status
86 ldns_key_new_frm_fp(ldns_key **k, FILE *fp)
87 {
88 return ldns_key_new_frm_fp_l(k, fp, NULL);
89 }
90
91 #ifdef HAVE_SSL
92 ldns_status
93 ldns_key_new_frm_engine(ldns_key **key, ENGINE *e, char *key_id, ldns_algorithm alg)
94 {
95 ldns_key *k;
96
97 k = ldns_key_new();
98 if(!k) return LDNS_STATUS_MEM_ERR;
99 #ifndef S_SPLINT_S
100 k->_key.key = ENGINE_load_private_key(e, key_id, UI_OpenSSL(), NULL);
101 if(!k->_key.key) {
102 ldns_key_free(k);
103 return LDNS_STATUS_ERR;
104 }
105 ldns_key_set_algorithm(k, (ldns_signing_algorithm) alg);
106 if (!k->_key.key) {
107 ldns_key_free(k);
108 return LDNS_STATUS_ENGINE_KEY_NOT_LOADED;
109 }
110 #endif /* splint */
111 *key = k;
112 return LDNS_STATUS_OK;
113 }
114 #endif
115
116 #ifdef USE_GOST
117 /** store GOST engine reference loaded into OpenSSL library */
118 ENGINE* ldns_gost_engine = NULL;
119
120 int
121 ldns_key_EVP_load_gost_id(void)
122 {
123 static int gost_id = 0;
124 const EVP_PKEY_ASN1_METHOD* meth;
125 ENGINE* e;
126
127 if(gost_id) return gost_id;
128
129 /* see if configuration loaded gost implementation from other engine*/
130 meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1);
131 if(meth) {
132 EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
133 return gost_id;
134 }
135
136 /* see if engine can be loaded already */
137 e = ENGINE_by_id("gost");
138 if(!e) {
139 /* load it ourself, in case statically linked */
140 ENGINE_load_builtin_engines();
141 ENGINE_load_dynamic();
142 e = ENGINE_by_id("gost");
143 }
144 if(!e) {
145 /* no gost engine in openssl */
146 return 0;
147 }
148 if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
149 ENGINE_finish(e);
150 ENGINE_free(e);
151 return 0;
152 }
153
154 meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1);
155 if(!meth) {
156 /* algo not found */
157 ENGINE_finish(e);
158 ENGINE_free(e);
159 return 0;
160 }
161 /* Note: do not ENGINE_finish and ENGINE_free the acquired engine
162 * on some platforms this frees up the meth and unloads gost stuff */
163 ldns_gost_engine = e;
164
165 EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
166 return gost_id;
167 }
168
169 void ldns_key_EVP_unload_gost(void)
170 {
171 if(ldns_gost_engine) {
172 ENGINE_finish(ldns_gost_engine);
173 ENGINE_free(ldns_gost_engine);
174 ldns_gost_engine = NULL;
175 }
176 }
177
178 /** read GOST private key */
179 static EVP_PKEY*
180 ldns_key_new_frm_fp_gost_l(FILE* fp, int* line_nr)
181 {
182 char token[16384];
183 const unsigned char* pp;
184 int gost_id;
185 EVP_PKEY* pkey;
186 ldns_rdf* b64rdf = NULL;
187
188 gost_id = ldns_key_EVP_load_gost_id();
189 if(!gost_id)
190 return NULL;
191
192 if (ldns_fget_keyword_data_l(fp, "GostAsn1", ": ", token, "\n",
193 sizeof(token), line_nr) == -1)
194 return NULL;
195 while(strlen(token) < 96) {
196 /* read more b64 from the file, b64 split on multiple lines */
197 if(ldns_fget_token_l(fp, token+strlen(token), "\n",
198 sizeof(token)-strlen(token), line_nr) == -1)
199 return NULL;
200 }
201 if(ldns_str2rdf_b64(&b64rdf, token) != LDNS_STATUS_OK)
202 return NULL;
203 pp = (unsigned char*)ldns_rdf_data(b64rdf);
204 pkey = d2i_PrivateKey(gost_id, NULL, &pp, (int)ldns_rdf_size(b64rdf));
205 ldns_rdf_deep_free(b64rdf);
206 return pkey;
207 }
208 #endif
209
210 #ifdef USE_ECDSA
211 /** calculate public key from private key */
212 static int
213 ldns_EC_KEY_calc_public(EC_KEY* ec)
214 {
215 EC_POINT* pub_key;
216 const EC_GROUP* group;
217 group = EC_KEY_get0_group(ec);
218 pub_key = EC_POINT_new(group);
219 if(!pub_key) return 0;
220 if(!EC_POINT_copy(pub_key, EC_GROUP_get0_generator(group))) {
221 EC_POINT_free(pub_key);
222 return 0;
223 }
224 if(!EC_POINT_mul(group, pub_key, EC_KEY_get0_private_key(ec),
225 NULL, NULL, NULL)) {
226 EC_POINT_free(pub_key);
227 return 0;
228 }
229 if(EC_KEY_set_public_key(ec, pub_key) == 0) {
230 EC_POINT_free(pub_key);
231 return 0;
232 }
233 EC_POINT_free(pub_key);
234 return 1;
235 }
236
237 /** read ECDSA private key */
238 static EVP_PKEY*
239 ldns_key_new_frm_fp_ecdsa_l(FILE* fp, ldns_algorithm alg, int* line_nr)
240 {
241 char token[16384];
242 ldns_rdf* b64rdf = NULL;
243 unsigned char* pp;
244 BIGNUM* bn;
245 EVP_PKEY* evp_key;
246 EC_KEY* ec;
247 if (ldns_fget_keyword_data_l(fp, "PrivateKey", ": ", token, "\n",
248 sizeof(token), line_nr) == -1)
249 return NULL;
250 if(ldns_str2rdf_b64(&b64rdf, token) != LDNS_STATUS_OK)
251 return NULL;
252 pp = (unsigned char*)ldns_rdf_data(b64rdf);
253
254 if(alg == LDNS_ECDSAP256SHA256)
255 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
256 else if(alg == LDNS_ECDSAP384SHA384)
257 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
258 else ec = NULL;
259 if(!ec) {
260 ldns_rdf_deep_free(b64rdf);
261 return NULL;
262 }
263 bn = BN_bin2bn(pp, (int)ldns_rdf_size(b64rdf), NULL);
264 ldns_rdf_deep_free(b64rdf);
265 if(!bn) {
266 EC_KEY_free(ec);
267 return NULL;
268 }
269 EC_KEY_set_private_key(ec, bn);
270 BN_free(bn);
271 if(!ldns_EC_KEY_calc_public(ec)) {
272 EC_KEY_free(ec);
273 return NULL;
274 }
275
276 evp_key = EVP_PKEY_new();
277 if(!evp_key) {
278 EC_KEY_free(ec);
279 return NULL;
280 }
281 if (!EVP_PKEY_assign_EC_KEY(evp_key, ec)) {
282 EVP_PKEY_free(evp_key);
283 EC_KEY_free(ec);
284 return NULL;
285 }
286 return evp_key;
287 }
288 #endif
289
290 ldns_status
291 ldns_key_new_frm_fp_l(ldns_key **key, FILE *fp, int *line_nr)
292 {
293 ldns_key *k;
294 char *d;
295 ldns_signing_algorithm alg;
296 ldns_rr *key_rr;
297 #ifdef HAVE_SSL
298 RSA *rsa;
299 DSA *dsa;
300 unsigned char *hmac;
301 size_t hmac_size;
302 #endif /* HAVE_SSL */
303
304 k = ldns_key_new();
305
306 d = LDNS_XMALLOC(char, LDNS_MAX_LINELEN);
307 if (!k || !d) {
308 ldns_key_free(k);
309 LDNS_FREE(d);
310 return LDNS_STATUS_MEM_ERR;
311 }
312
313 alg = 0;
314
315 /* the file is highly structured. Do this in sequence */
316 /* RSA:
317 * Private-key-format: v1.x.
318 * Algorithm: 1 (RSA)
319
320 */
321 /* get the key format version number */
322 if (ldns_fget_keyword_data_l(fp, "Private-key-format", ": ", d, "\n",
323 LDNS_MAX_LINELEN, line_nr) == -1) {
324 /* no version information */
325 ldns_key_free(k);
326 LDNS_FREE(d);
327 return LDNS_STATUS_SYNTAX_ERR;
328 }
329 if (strncmp(d, "v1.", 3) != 0) {
330 ldns_key_free(k);
331 LDNS_FREE(d);
332 return LDNS_STATUS_SYNTAX_VERSION_ERR;
333 }
334
335 /* get the algorithm type, our file function strip ( ) so there are
336 * not in the return string! */
337 if (ldns_fget_keyword_data_l(fp, "Algorithm", ": ", d, "\n",
338 LDNS_MAX_LINELEN, line_nr) == -1) {
339 /* no alg information */
340 ldns_key_free(k);
341 LDNS_FREE(d);
342 return LDNS_STATUS_SYNTAX_ALG_ERR;
343 }
344
345 if (strncmp(d, "1 RSA", 2) == 0) {
346 alg = LDNS_SIGN_RSAMD5;
347 }
348 if (strncmp(d, "2 DH", 2) == 0) {
349 alg = (ldns_signing_algorithm)LDNS_DH;
350 }
351 if (strncmp(d, "3 DSA", 2) == 0) {
352 alg = LDNS_SIGN_DSA;
353 }
354 if (strncmp(d, "4 ECC", 2) == 0) {
355 alg = (ldns_signing_algorithm)LDNS_ECC;
356 }
357 if (strncmp(d, "5 RSASHA1", 2) == 0) {
358 alg = LDNS_SIGN_RSASHA1;
359 }
360 if (strncmp(d, "6 DSA", 2) == 0) {
361 alg = LDNS_SIGN_DSA_NSEC3;
362 }
363 if (strncmp(d, "7 RSASHA1", 2) == 0) {
364 alg = LDNS_SIGN_RSASHA1_NSEC3;
365 }
366
367 if (strncmp(d, "8 RSASHA256", 2) == 0) {
368 #ifdef USE_SHA2
369 alg = LDNS_SIGN_RSASHA256;
370 #else
371 fprintf(stderr, "Warning: SHA256 not compiled into this ");
372 fprintf(stderr, "version of ldns\n");
373 #endif
374 }
375 if (strncmp(d, "10 RSASHA512", 3) == 0) {
376 #ifdef USE_SHA2
377 alg = LDNS_SIGN_RSASHA512;
378 #else
379 fprintf(stderr, "Warning: SHA512 not compiled into this ");
380 fprintf(stderr, "version of ldns\n");
381 #endif
382 }
383 if (strncmp(d, "12 ECC-GOST", 3) == 0) {
384 #ifdef USE_GOST
385 alg = LDNS_SIGN_ECC_GOST;
386 #else
387 fprintf(stderr, "Warning: ECC-GOST not compiled into this ");
388 fprintf(stderr, "version of ldns, use --enable-gost\n");
389 #endif
390 }
391 if (strncmp(d, "13 ECDSAP256SHA256", 3) == 0) {
392 #ifdef USE_ECDSA
393 alg = LDNS_SIGN_ECDSAP256SHA256;
394 #else
395 fprintf(stderr, "Warning: ECDSA not compiled into this ");
396 fprintf(stderr, "version of ldns, use --enable-ecdsa\n");
397 #endif
398 }
399 if (strncmp(d, "14 ECDSAP384SHA384", 3) == 0) {
400 #ifdef USE_ECDSA
401 alg = LDNS_SIGN_ECDSAP384SHA384;
402 #else
403 fprintf(stderr, "Warning: ECDSA not compiled into this ");
404 fprintf(stderr, "version of ldns, use --enable-ecdsa\n");
405 #endif
406 }
407 if (strncmp(d, "157 HMAC-MD5", 4) == 0) {
408 alg = LDNS_SIGN_HMACMD5;
409 }
410 if (strncmp(d, "158 HMAC-SHA1", 4) == 0) {
411 alg = LDNS_SIGN_HMACSHA1;
412 }
413 if (strncmp(d, "159 HMAC-SHA256", 4) == 0) {
414 alg = LDNS_SIGN_HMACSHA256;
415 }
416
417 LDNS_FREE(d);
418
419 switch(alg) {
420 case LDNS_SIGN_RSAMD5:
421 case LDNS_SIGN_RSASHA1:
422 case LDNS_SIGN_RSASHA1_NSEC3:
423 #ifdef USE_SHA2
424 case LDNS_SIGN_RSASHA256:
425 case LDNS_SIGN_RSASHA512:
426 #endif
427 ldns_key_set_algorithm(k, alg);
428 #ifdef HAVE_SSL
429 rsa = ldns_key_new_frm_fp_rsa_l(fp, line_nr);
430 if (!rsa) {
431 ldns_key_free(k);
432 return LDNS_STATUS_ERR;
433 }
434 ldns_key_assign_rsa_key(k, rsa);
435 #endif /* HAVE_SSL */
436 break;
437 case LDNS_SIGN_DSA:
438 case LDNS_SIGN_DSA_NSEC3:
439 ldns_key_set_algorithm(k, alg);
440 #ifdef HAVE_SSL
441 dsa = ldns_key_new_frm_fp_dsa_l(fp, line_nr);
442 if (!dsa) {
443 ldns_key_free(k);
444 return LDNS_STATUS_ERR;
445 }
446 ldns_key_assign_dsa_key(k, dsa);
447 #endif /* HAVE_SSL */
448 break;
449 case LDNS_SIGN_HMACMD5:
450 case LDNS_SIGN_HMACSHA1:
451 case LDNS_SIGN_HMACSHA256:
452 ldns_key_set_algorithm(k, alg);
453 #ifdef HAVE_SSL
454 hmac = ldns_key_new_frm_fp_hmac_l(fp, line_nr, &hmac_size);
455 if (!hmac) {
456 ldns_key_free(k);
457 return LDNS_STATUS_ERR;
458 }
459 ldns_key_set_hmac_size(k, hmac_size);
460 ldns_key_set_hmac_key(k, hmac);
461 #endif /* HAVE_SSL */
462 break;
463 case LDNS_SIGN_ECC_GOST:
464 ldns_key_set_algorithm(k, alg);
465 #if defined(HAVE_SSL) && defined(USE_GOST)
466 if(!ldns_key_EVP_load_gost_id()) {
467 ldns_key_free(k);
468 return LDNS_STATUS_CRYPTO_ALGO_NOT_IMPL;
469 }
470 ldns_key_set_evp_key(k,
471 ldns_key_new_frm_fp_gost_l(fp, line_nr));
472 #ifndef S_SPLINT_S
473 if(!k->_key.key) {
474 ldns_key_free(k);
475 return LDNS_STATUS_ERR;
476 }
477 #endif /* splint */
478 #endif
479 break;
480 #ifdef USE_ECDSA
481 case LDNS_SIGN_ECDSAP256SHA256:
482 case LDNS_SIGN_ECDSAP384SHA384:
483 ldns_key_set_algorithm(k, alg);
484 ldns_key_set_evp_key(k,
485 ldns_key_new_frm_fp_ecdsa_l(fp, (ldns_algorithm)alg, line_nr));
486 #ifndef S_SPLINT_S
487 if(!k->_key.key) {
488 ldns_key_free(k);
489 return LDNS_STATUS_ERR;
490 }
491 #endif /* splint */
492 break;
493 #endif
494 default:
495 ldns_key_free(k);
496 return LDNS_STATUS_SYNTAX_ALG_ERR;
497 }
498 key_rr = ldns_key2rr(k);
499 ldns_key_set_keytag(k, ldns_calc_keytag(key_rr));
500 ldns_rr_free(key_rr);
501
502 if (key) {
503 *key = k;
504 return LDNS_STATUS_OK;
505 }
506 ldns_key_free(k);
507 return LDNS_STATUS_ERR;
508 }
509
510 #ifdef HAVE_SSL
511 RSA *
512 ldns_key_new_frm_fp_rsa(FILE *f)
513 {
514 return ldns_key_new_frm_fp_rsa_l(f, NULL);
515 }
516
517 RSA *
518 ldns_key_new_frm_fp_rsa_l(FILE *f, int *line_nr)
519 {
520 /* we parse
521 * Modulus:
522 * PublicExponent:
523 * PrivateExponent:
524 * Prime1:
525 * Prime2:
526 * Exponent1:
527 * Exponent2:
528 * Coefficient:
529 *
530 * man 3 RSA:
531 *
532 * struct
533 * {
534 * BIGNUM *n; // public modulus
535 * BIGNUM *e; // public exponent
536 * BIGNUM *d; // private exponent
537 * BIGNUM *p; // secret prime factor
538 * BIGNUM *q; // secret prime factor
539 * BIGNUM *dmp1; // d mod (p-1)
540 * BIGNUM *dmq1; // d mod (q-1)
541 * BIGNUM *iqmp; // q^-1 mod p
542 * // ...
543 *
544 */
545 char *d;
546 RSA *rsa;
547 uint8_t *buf;
548 int i;
549
550 d = LDNS_XMALLOC(char, LDNS_MAX_LINELEN);
551 buf = LDNS_XMALLOC(uint8_t, LDNS_MAX_LINELEN);
552 rsa = RSA_new();
553 if (!d || !rsa || !buf) {
554 goto error;
555 }
556
557 /* I could use functions again, but that seems an overkill,
558 * allthough this also looks tedious
559 */
560
561 /* Modules, rsa->n */
562 if (ldns_fget_keyword_data_l(f, "Modulus", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
563 goto error;
564 }
565 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
566 #ifndef S_SPLINT_S
567 rsa->n = BN_bin2bn((const char unsigned*)buf, i, NULL);
568 if (!rsa->n) {
569 goto error;
570 }
571
572 /* PublicExponent, rsa->e */
573 if (ldns_fget_keyword_data_l(f, "PublicExponent", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
574 goto error;
575 }
576 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
577 rsa->e = BN_bin2bn((const char unsigned*)buf, i, NULL);
578 if (!rsa->e) {
579 goto error;
580 }
581
582 /* PrivateExponent, rsa->d */
583 if (ldns_fget_keyword_data_l(f, "PrivateExponent", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
584 goto error;
585 }
586 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
587 rsa->d = BN_bin2bn((const char unsigned*)buf, i, NULL);
588 if (!rsa->d) {
589 goto error;
590 }
591
592 /* Prime1, rsa->p */
593 if (ldns_fget_keyword_data_l(f, "Prime1", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
594 goto error;
595 }
596 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
597 rsa->p = BN_bin2bn((const char unsigned*)buf, i, NULL);
598 if (!rsa->p) {
599 goto error;
600 }
601
602 /* Prime2, rsa->q */
603 if (ldns_fget_keyword_data_l(f, "Prime2", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
604 goto error;
605 }
606 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
607 rsa->q = BN_bin2bn((const char unsigned*)buf, i, NULL);
608 if (!rsa->q) {
609 goto error;
610 }
611
612 /* Exponent1, rsa->dmp1 */
613 if (ldns_fget_keyword_data_l(f, "Exponent1", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
614 goto error;
615 }
616 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
617 rsa->dmp1 = BN_bin2bn((const char unsigned*)buf, i, NULL);
618 if (!rsa->dmp1) {
619 goto error;
620 }
621
622 /* Exponent2, rsa->dmq1 */
623 if (ldns_fget_keyword_data_l(f, "Exponent2", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
624 goto error;
625 }
626 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
627 rsa->dmq1 = BN_bin2bn((const char unsigned*)buf, i, NULL);
628 if (!rsa->dmq1) {
629 goto error;
630 }
631
632 /* Coefficient, rsa->iqmp */
633 if (ldns_fget_keyword_data_l(f, "Coefficient", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
634 goto error;
635 }
636 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
637 rsa->iqmp = BN_bin2bn((const char unsigned*)buf, i, NULL);
638 if (!rsa->iqmp) {
639 goto error;
640 }
641 #endif /* splint */
642
643 LDNS_FREE(buf);
644 LDNS_FREE(d);
645 return rsa;
646
647 error:
648 RSA_free(rsa);
649 LDNS_FREE(d);
650 LDNS_FREE(buf);
651 return NULL;
652 }
653
654 DSA *
655 ldns_key_new_frm_fp_dsa(FILE *f)
656 {
657 return ldns_key_new_frm_fp_dsa_l(f, NULL);
658 }
659
660 DSA *
661 ldns_key_new_frm_fp_dsa_l(FILE *f, ATTR_UNUSED(int *line_nr))
662 {
663 int i;
664 char *d;
665 DSA *dsa;
666 uint8_t *buf;
667
668 d = LDNS_XMALLOC(char, LDNS_MAX_LINELEN);
669 buf = LDNS_XMALLOC(uint8_t, LDNS_MAX_LINELEN);
670 dsa = DSA_new();
671 if (!d || !dsa || !buf) {
672 goto error;
673 }
674
675 /* the line parser removes the () from the input... */
676
677 /* Prime, dsa->p */
678 if (ldns_fget_keyword_data_l(f, "Primep", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
679 goto error;
680 }
681 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
682 #ifndef S_SPLINT_S
683 dsa->p = BN_bin2bn((const char unsigned*)buf, i, NULL);
684 if (!dsa->p) {
685 goto error;
686 }
687
688 /* Subprime, dsa->q */
689 if (ldns_fget_keyword_data_l(f, "Subprimeq", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
690 goto error;
691 }
692 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
693 dsa->q = BN_bin2bn((const char unsigned*)buf, i, NULL);
694 if (!dsa->q) {
695 goto error;
696 }
697
698 /* Base, dsa->g */
699 if (ldns_fget_keyword_data_l(f, "Baseg", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
700 goto error;
701 }
702 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
703 dsa->g = BN_bin2bn((const char unsigned*)buf, i, NULL);
704 if (!dsa->g) {
705 goto error;
706 }
707
708 /* Private key, dsa->priv_key */
709 if (ldns_fget_keyword_data_l(f, "Private_valuex", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
710 goto error;
711 }
712 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
713 dsa->priv_key = BN_bin2bn((const char unsigned*)buf, i, NULL);
714 if (!dsa->priv_key) {
715 goto error;
716 }
717
718 /* Public key, dsa->priv_key */
719 if (ldns_fget_keyword_data_l(f, "Public_valuey", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
720 goto error;
721 }
722 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
723 dsa->pub_key = BN_bin2bn((const char unsigned*)buf, i, NULL);
724 if (!dsa->pub_key) {
725 goto error;
726 }
727 #endif /* splint */
728
729 LDNS_FREE(buf);
730 LDNS_FREE(d);
731
732 return dsa;
733
734 error:
735 LDNS_FREE(d);
736 LDNS_FREE(buf);
737 DSA_free(dsa);
738 return NULL;
739 }
740
741 unsigned char *
742 ldns_key_new_frm_fp_hmac(FILE *f, size_t *hmac_size)
743 {
744 return ldns_key_new_frm_fp_hmac_l(f, NULL, hmac_size);
745 }
746
747 unsigned char *
748 ldns_key_new_frm_fp_hmac_l( FILE *f
749 , ATTR_UNUSED(int *line_nr)
750 , size_t *hmac_size
751 )
752 {
753 size_t i, bufsz;
754 char d[LDNS_MAX_LINELEN];
755 unsigned char *buf = NULL;
756
757 if (ldns_fget_keyword_data_l(f, "Key", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
758 goto error;
759 }
760 bufsz = ldns_b64_ntop_calculate_size(strlen(d));
761 buf = LDNS_XMALLOC(unsigned char, bufsz);
762 i = (size_t) ldns_b64_pton((const char*)d, buf, bufsz);
763
764 *hmac_size = i;
765 return buf;
766
767 error:
768 LDNS_FREE(buf);
769 *hmac_size = 0;
770 return NULL;
771 }
772 #endif /* HAVE_SSL */
773
774 #ifdef USE_GOST
775 static EVP_PKEY*
776 ldns_gen_gost_key(void)
777 {
778 EVP_PKEY_CTX* ctx;
779 EVP_PKEY* p = NULL;
780 int gost_id = ldns_key_EVP_load_gost_id();
781 if(!gost_id)
782 return NULL;
783 ctx = EVP_PKEY_CTX_new_id(gost_id, NULL);
784 if(!ctx) {
785 /* the id should be available now */
786 return NULL;
787 }
788 if(EVP_PKEY_CTX_ctrl_str(ctx, "paramset", "A") <= 0) {
789 /* cannot set paramset */
790 EVP_PKEY_CTX_free(ctx);
791 return NULL;
792 }
793
794 if(EVP_PKEY_keygen_init(ctx) <= 0) {
795 EVP_PKEY_CTX_free(ctx);
796 return NULL;
797 }
798 if(EVP_PKEY_keygen(ctx, &p) <= 0) {
799 EVP_PKEY_free(p);
800 EVP_PKEY_CTX_free(ctx);
801 return NULL;
802 }
803 EVP_PKEY_CTX_free(ctx);
804 return p;
805 }
806 #endif
807
808 ldns_key *
809 ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size)
810 {
811 ldns_key *k;
812 #ifdef HAVE_SSL
813 DSA *d;
814 RSA *r;
815 # ifdef USE_ECDSA
816 EC_KEY *ec = NULL;
817 # endif
818 #else
819 int i;
820 uint16_t offset = 0;
821 #endif
822 unsigned char *hmac;
823
824 k = ldns_key_new();
825 if (!k) {
826 return NULL;
827 }
828 switch(alg) {
829 case LDNS_SIGN_RSAMD5:
830 case LDNS_SIGN_RSASHA1:
831 case LDNS_SIGN_RSASHA1_NSEC3:
832 case LDNS_SIGN_RSASHA256:
833 case LDNS_SIGN_RSASHA512:
834 #ifdef HAVE_SSL
835 r = RSA_generate_key((int)size, RSA_F4, NULL, NULL);
836 if(!r) {
837 ldns_key_free(k);
838 return NULL;
839 }
840 if (RSA_check_key(r) != 1) {
841 ldns_key_free(k);
842 return NULL;
843 }
844 ldns_key_set_rsa_key(k, r);
845 RSA_free(r);
846 #endif /* HAVE_SSL */
847 break;
848 case LDNS_SIGN_DSA:
849 case LDNS_SIGN_DSA_NSEC3:
850 #ifdef HAVE_SSL
851 d = DSA_generate_parameters((int)size, NULL, 0, NULL, NULL, NULL, NULL);
852 if (!d) {
853 ldns_key_free(k);
854 return NULL;
855 }
856 if (DSA_generate_key(d) != 1) {
857 ldns_key_free(k);
858 return NULL;
859 }
860 ldns_key_set_dsa_key(k, d);
861 DSA_free(d);
862 #endif /* HAVE_SSL */
863 break;
864 case LDNS_SIGN_HMACMD5:
865 case LDNS_SIGN_HMACSHA1:
866 case LDNS_SIGN_HMACSHA256:
867 #ifdef HAVE_SSL
868 #ifndef S_SPLINT_S
869 k->_key.key = NULL;
870 #endif /* splint */
871 #endif /* HAVE_SSL */
872 size = size / 8;
873 ldns_key_set_hmac_size(k, size);
874
875 hmac = LDNS_XMALLOC(unsigned char, size);
876 if(!hmac) {
877 ldns_key_free(k);
878 return NULL;
879 }
880 #ifdef HAVE_SSL
881 if (RAND_bytes(hmac, (int) size) != 1) {
882 LDNS_FREE(hmac);
883 ldns_key_free(k);
884 return NULL;
885 }
886 #else
887 while (offset + sizeof(i) < size) {
888 i = random();
889 memcpy(&hmac[offset], &i, sizeof(i));
890 offset += sizeof(i);
891 }
892 if (offset < size) {
893 i = random();
894 memcpy(&hmac[offset], &i, size - offset);
895 }
896 #endif /* HAVE_SSL */
897 ldns_key_set_hmac_key(k, hmac);
898
899 ldns_key_set_flags(k, 0);
900 break;
901 case LDNS_SIGN_ECC_GOST:
902 #if defined(HAVE_SSL) && defined(USE_GOST)
903 ldns_key_set_evp_key(k, ldns_gen_gost_key());
904 #ifndef S_SPLINT_S
905 if(!k->_key.key) {
906 ldns_key_free(k);
907 return NULL;
908 }
909 #endif /* splint */
910 #else
911 ldns_key_free(k);
912 return NULL;
913 #endif /* HAVE_SSL and USE_GOST */
914 break;
915 case LDNS_SIGN_ECDSAP256SHA256:
916 case LDNS_SIGN_ECDSAP384SHA384:
917 #ifdef USE_ECDSA
918 if(alg == LDNS_SIGN_ECDSAP256SHA256)
919 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
920 else if(alg == LDNS_SIGN_ECDSAP384SHA384)
921 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
922 if(!ec) {
923 ldns_key_free(k);
924 return NULL;
925 }
926 if(!EC_KEY_generate_key(ec)) {
927 ldns_key_free(k);
928 EC_KEY_free(ec);
929 return NULL;
930 }
931 #ifndef S_SPLINT_S
932 k->_key.key = EVP_PKEY_new();
933 if(!k->_key.key) {
934 ldns_key_free(k);
935 EC_KEY_free(ec);
936 return NULL;
937 }
938 if (!EVP_PKEY_assign_EC_KEY(k->_key.key, ec)) {
939 ldns_key_free(k);
940 EC_KEY_free(ec);
941 return NULL;
942 }
943 #endif /* splint */
944 #else
945 ldns_key_free(k);
946 return NULL;
947 #endif /* ECDSA */
948 break;
949 }
950 ldns_key_set_algorithm(k, alg);
951 return k;
952 }
953
954 void
955 ldns_key_print(FILE *output, const ldns_key *k)
956 {
957 char *str = ldns_key2str(k);
958 if (str) {
959 fprintf(output, "%s", str);
960 } else {
961 fprintf(output, "Unable to convert private key to string\n");
962 }
963 LDNS_FREE(str);
964 }
965
966
967 void
968 ldns_key_set_algorithm(ldns_key *k, ldns_signing_algorithm l)
969 {
970 k->_alg = l;
971 }
972
973 void
974 ldns_key_set_flags(ldns_key *k, uint16_t f)
975 {
976 k->_extra.dnssec.flags = f;
977 }
978
979 #ifdef HAVE_SSL
980 #ifndef S_SPLINT_S
981 void
982 ldns_key_set_evp_key(ldns_key *k, EVP_PKEY *e)
983 {
984 k->_key.key = e;
985 }
986
987 void
988 ldns_key_set_rsa_key(ldns_key *k, RSA *r)
989 {
990 EVP_PKEY *key = EVP_PKEY_new();
991 EVP_PKEY_set1_RSA(key, r);
992 k->_key.key = key;
993 }
994
995 void
996 ldns_key_set_dsa_key(ldns_key *k, DSA *d)
997 {
998 EVP_PKEY *key = EVP_PKEY_new();
999 EVP_PKEY_set1_DSA(key, d);
1000 k->_key.key = key;
1001 }
1002
1003 void
1004 ldns_key_assign_rsa_key(ldns_key *k, RSA *r)
1005 {
1006 EVP_PKEY *key = EVP_PKEY_new();
1007 EVP_PKEY_assign_RSA(key, r);
1008 k->_key.key = key;
1009 }
1010
1011 void
1012 ldns_key_assign_dsa_key(ldns_key *k, DSA *d)
1013 {
1014 EVP_PKEY *key = EVP_PKEY_new();
1015 EVP_PKEY_assign_DSA(key, d);
1016 k->_key.key = key;
1017 }
1018 #endif /* splint */
1019 #endif /* HAVE_SSL */
1020
1021 void
1022 ldns_key_set_hmac_key(ldns_key *k, unsigned char *hmac)
1023 {
1024 k->_key.hmac.key = hmac;
1025 }
1026
1027 void
1028 ldns_key_set_hmac_size(ldns_key *k, size_t hmac_size)
1029 {
1030 k->_key.hmac.size = hmac_size;
1031 }
1032
1033 void
1034 ldns_key_set_external_key(ldns_key *k, void *external_key)
1035 {
1036 k->_key.external_key = external_key;
1037 }
1038
1039 void
1040 ldns_key_set_origttl(ldns_key *k, uint32_t t)
1041 {
1042 k->_extra.dnssec.orig_ttl = t;
1043 }
1044
1045 void
1046 ldns_key_set_inception(ldns_key *k, uint32_t i)
1047 {
1048 k->_extra.dnssec.inception = i;
1049 }
1050
1051 void
1052 ldns_key_set_expiration(ldns_key *k, uint32_t e)
1053 {
1054 k->_extra.dnssec.expiration = e;
1055 }
1056
1057 void
1058 ldns_key_set_pubkey_owner(ldns_key *k, ldns_rdf *r)
1059 {
1060 k->_pubkey_owner = r;
1061 }
1062
1063 void
1064 ldns_key_set_keytag(ldns_key *k, uint16_t tag)
1065 {
1066 k->_extra.dnssec.keytag = tag;
1067 }
1068
1069 /* read */
1070 size_t
1071 ldns_key_list_key_count(const ldns_key_list *key_list)
1072 {
1073 return key_list->_key_count;
1074 }
1075
1076 ldns_key *
1077 ldns_key_list_key(const ldns_key_list *key, size_t nr)
1078 {
1079 if (nr < ldns_key_list_key_count(key)) {
1080 return key->_keys[nr];
1081 } else {
1082 return NULL;
1083 }
1084 }
1085
1086 ldns_signing_algorithm
1087 ldns_key_algorithm(const ldns_key *k)
1088 {
1089 return k->_alg;
1090 }
1091
1092 void
1093 ldns_key_set_use(ldns_key *k, bool v)
1094 {
1095 if (k) {
1096 k->_use = v;
1097 }
1098 }
1099
1100 bool
1101 ldns_key_use(const ldns_key *k)
1102 {
1103 if (k) {
1104 return k->_use;
1105 }
1106 return false;
1107 }
1108
1109 #ifdef HAVE_SSL
1110 #ifndef S_SPLINT_S
1111 EVP_PKEY *
1112 ldns_key_evp_key(const ldns_key *k)
1113 {
1114 return k->_key.key;
1115 }
1116
1117 RSA *
1118 ldns_key_rsa_key(const ldns_key *k)
1119 {
1120 if (k->_key.key) {
1121 return EVP_PKEY_get1_RSA(k->_key.key);
1122 } else {
1123 return NULL;
1124 }
1125 }
1126
1127 DSA *
1128 ldns_key_dsa_key(const ldns_key *k)
1129 {
1130 if (k->_key.key) {
1131 return EVP_PKEY_get1_DSA(k->_key.key);
1132 } else {
1133 return NULL;
1134 }
1135 }
1136 #endif /* splint */
1137 #endif /* HAVE_SSL */
1138
1139 unsigned char *
1140 ldns_key_hmac_key(const ldns_key *k)
1141 {
1142 if (k->_key.hmac.key) {
1143 return k->_key.hmac.key;
1144 } else {
1145 return NULL;
1146 }
1147 }
1148
1149 size_t
1150 ldns_key_hmac_size(const ldns_key *k)
1151 {
1152 if (k->_key.hmac.size) {
1153 return k->_key.hmac.size;
1154 } else {
1155 return 0;
1156 }
1157 }
1158
1159 void *
1160 ldns_key_external_key(const ldns_key *k)
1161 {
1162 return k->_key.external_key;
1163 }
1164
1165 uint32_t
1166 ldns_key_origttl(const ldns_key *k)
1167 {
1168 return k->_extra.dnssec.orig_ttl;
1169 }
1170
1171 uint16_t
1172 ldns_key_flags(const ldns_key *k)
1173 {
1174 return k->_extra.dnssec.flags;
1175 }
1176
1177 uint32_t
1178 ldns_key_inception(const ldns_key *k)
1179 {
1180 return k->_extra.dnssec.inception;
1181 }
1182
1183 uint32_t
1184 ldns_key_expiration(const ldns_key *k)
1185 {
1186 return k->_extra.dnssec.expiration;
1187 }
1188
1189 uint16_t
1190 ldns_key_keytag(const ldns_key *k)
1191 {
1192 return k->_extra.dnssec.keytag;
1193 }
1194
1195 ldns_rdf *
1196 ldns_key_pubkey_owner(const ldns_key *k)
1197 {
1198 return k->_pubkey_owner;
1199 }
1200
1201 /* write */
1202 void
1203 ldns_key_list_set_use(ldns_key_list *keys, bool v)
1204 {
1205 size_t i;
1206
1207 for (i = 0; i < ldns_key_list_key_count(keys); i++) {
1208 ldns_key_set_use(ldns_key_list_key(keys, i), v);
1209 }
1210 }
1211
1212 void
1213 ldns_key_list_set_key_count(ldns_key_list *key, size_t count)
1214 {
1215 key->_key_count = count;
1216 }
1217
1218 bool
1219 ldns_key_list_push_key(ldns_key_list *key_list, ldns_key *key)
1220 {
1221 size_t key_count;
1222 ldns_key **keys;
1223
1224 key_count = ldns_key_list_key_count(key_list);
1225
1226 /* grow the array */
1227 keys = LDNS_XREALLOC(
1228 key_list->_keys, ldns_key *, key_count + 1);
1229 if (!keys) {
1230 return false;
1231 }
1232
1233 /* add the new member */
1234 key_list->_keys = keys;
1235 key_list->_keys[key_count] = key;
1236
1237 ldns_key_list_set_key_count(key_list, key_count + 1);
1238 return true;
1239 }
1240
1241 ldns_key *
1242 ldns_key_list_pop_key(ldns_key_list *key_list)
1243 {
1244 size_t key_count;
1245 ldns_key** a;
1246 ldns_key *pop;
1247
1248 if (!key_list) {
1249 return NULL;
1250 }
1251
1252 key_count = ldns_key_list_key_count(key_list);
1253 if (key_count == 0) {
1254 return NULL;
1255 }
1256
1257 pop = ldns_key_list_key(key_list, key_count);
1258
1259 /* shrink the array */
1260 a = LDNS_XREALLOC(key_list->_keys, ldns_key *, key_count - 1);
1261 if(a) {
1262 key_list->_keys = a;
1263 }
1264
1265 ldns_key_list_set_key_count(key_list, key_count - 1);
1266
1267 return pop;
1268 }
1269
1270 #ifdef HAVE_SSL
1271 #ifndef S_SPLINT_S
1272 /* data pointer must be large enough (LDNS_MAX_KEYLEN) */
1273 static bool
1274 ldns_key_rsa2bin(unsigned char *data, RSA *k, uint16_t *size)
1275 {
1276 int i,j;
1277
1278 if (!k) {
1279 return false;
1280 }
1281
1282 if (BN_num_bytes(k->e) <= 256) {
1283 /* normally only this path is executed (small factors are
1284 * more common
1285 */
1286 data[0] = (unsigned char) BN_num_bytes(k->e);
1287 i = BN_bn2bin(k->e, data + 1);
1288 j = BN_bn2bin(k->n, data + i + 1);
1289 *size = (uint16_t) i + j;
1290 } else if (BN_num_bytes(k->e) <= 65536) {
1291 data[0] = 0;
1292 /* BN_bn2bin does bigendian, _uint16 also */
1293 ldns_write_uint16(data + 1, (uint16_t) BN_num_bytes(k->e));
1294
1295 BN_bn2bin(k->e, data + 3);
1296 BN_bn2bin(k->n, data + 4 + BN_num_bytes(k->e));
1297 *size = (uint16_t) BN_num_bytes(k->n) + 6;
1298 } else {
1299 return false;
1300 }
1301 return true;
1302 }
1303
1304 /* data pointer must be large enough (LDNS_MAX_KEYLEN) */
1305 static bool
1306 ldns_key_dsa2bin(unsigned char *data, DSA *k, uint16_t *size)
1307 {
1308 uint8_t T;
1309
1310 if (!k) {
1311 return false;
1312 }
1313
1314 /* See RFC2536 */
1315 *size = (uint16_t)BN_num_bytes(k->p);
1316 T = (*size - 64) / 8;
1317 memcpy(data, &T, 1);
1318
1319 if (T > 8) {
1320 fprintf(stderr, "DSA key with T > 8 (ie. > 1024 bits)");
1321 fprintf(stderr, " not implemented\n");
1322 return false;
1323 }
1324
1325 /* size = 64 + (T * 8); */
1326 data[0] = (unsigned char)T;
1327 BN_bn2bin(k->q, data + 1 ); /* 20 octects */
1328 BN_bn2bin(k->p, data + 21 ); /* offset octects */
1329 BN_bn2bin(k->g, data + 21 + *size); /* offset octets */
1330 BN_bn2bin(k->pub_key, data + 21 + *size + *size); /* offset octets */
1331 *size = 21 + (*size * 3);
1332 return true;
1333 }
1334
1335 #ifdef USE_GOST
1336 static bool
1337 ldns_key_gost2bin(unsigned char* data, EVP_PKEY* k, uint16_t* size)
1338 {
1339 int i;
1340 unsigned char* pp = NULL;
1341 if(i2d_PUBKEY(k, &pp) != 37 + 64) {
1342 /* expect 37 byte(ASN header) and 64 byte(X and Y) */
1343 CRYPTO_free(pp);
1344 return false;
1345 }
1346 /* omit ASN header */
1347 for(i=0; i<64; i++)
1348 data[i] = pp[i+37];
1349 CRYPTO_free(pp);
1350 *size = 64;
1351 return true;
1352 }
1353 #endif /* USE_GOST */
1354 #endif /* splint */
1355 #endif /* HAVE_SSL */
1356
1357 ldns_rr *
1358 ldns_key2rr(const ldns_key *k)
1359 {
1360 /* this function will convert a the keydata contained in
1361 * rsa/dsa pointers to a DNSKEY rr. It will fill in as
1362 * much as it can, but it does not know about key-flags
1363 * for instance
1364 */
1365 ldns_rr *pubkey;
1366 ldns_rdf *keybin;
1367 unsigned char *bin = NULL;
1368 uint16_t size = 0;
1369 #ifdef HAVE_SSL
1370 RSA *rsa = NULL;
1371 DSA *dsa = NULL;
1372 #endif /* HAVE_SSL */
1373 #ifdef USE_ECDSA
1374 EC_KEY* ec;
1375 #endif
1376 int internal_data = 0;
1377
1378 if (!k) {
1379 return NULL;
1380 }
1381 pubkey = ldns_rr_new();
1382
1383 switch (ldns_key_algorithm(k)) {
1384 case LDNS_SIGN_HMACMD5:
1385 case LDNS_SIGN_HMACSHA1:
1386 case LDNS_SIGN_HMACSHA256:
1387 ldns_rr_set_type(pubkey, LDNS_RR_TYPE_KEY);
1388 break;
1389 default:
1390 ldns_rr_set_type(pubkey, LDNS_RR_TYPE_DNSKEY);
1391 break;
1392 }
1393 /* zero-th rdf - flags */
1394 ldns_rr_push_rdf(pubkey,
1395 ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16,
1396 ldns_key_flags(k)));
1397 /* first - proto */
1398 ldns_rr_push_rdf(pubkey,
1399 ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8, LDNS_DNSSEC_KEYPROTO));
1400
1401 if (ldns_key_pubkey_owner(k)) {
1402 ldns_rr_set_owner(pubkey, ldns_rdf_clone(ldns_key_pubkey_owner(k)));
1403 }
1404
1405 /* third - da algorithm */
1406 switch(ldns_key_algorithm(k)) {
1407 case LDNS_SIGN_RSAMD5:
1408 case LDNS_SIGN_RSASHA1:
1409 case LDNS_SIGN_RSASHA1_NSEC3:
1410 case LDNS_SIGN_RSASHA256:
1411 case LDNS_SIGN_RSASHA512:
1412 ldns_rr_push_rdf(pubkey,
1413 ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
1414 #ifdef HAVE_SSL
1415 rsa = ldns_key_rsa_key(k);
1416 if (rsa) {
1417 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
1418 if (!bin) {
1419 ldns_rr_free(pubkey);
1420 return NULL;
1421 }
1422 if (!ldns_key_rsa2bin(bin, rsa, &size)) {
1423 LDNS_FREE(bin);
1424 ldns_rr_free(pubkey);
1425 return NULL;
1426 }
1427 RSA_free(rsa);
1428 internal_data = 1;
1429 }
1430 #endif
1431 size++;
1432 break;
1433 case LDNS_SIGN_DSA:
1434 ldns_rr_push_rdf(pubkey,
1435 ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, LDNS_DSA));
1436 #ifdef HAVE_SSL
1437 dsa = ldns_key_dsa_key(k);
1438 if (dsa) {
1439 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
1440 if (!bin) {
1441 ldns_rr_free(pubkey);
1442 return NULL;
1443 }
1444 if (!ldns_key_dsa2bin(bin, dsa, &size)) {
1445 LDNS_FREE(bin);
1446 ldns_rr_free(pubkey);
1447 return NULL;
1448 }
1449 DSA_free(dsa);
1450 internal_data = 1;
1451 }
1452 #endif /* HAVE_SSL */
1453 break;
1454 case LDNS_SIGN_DSA_NSEC3:
1455 ldns_rr_push_rdf(pubkey,
1456 ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, LDNS_DSA_NSEC3));
1457 #ifdef HAVE_SSL
1458 dsa = ldns_key_dsa_key(k);
1459 if (dsa) {
1460 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
1461 if (!bin) {
1462 ldns_rr_free(pubkey);
1463 return NULL;
1464 }
1465 if (!ldns_key_dsa2bin(bin, dsa, &size)) {
1466 LDNS_FREE(bin);
1467 ldns_rr_free(pubkey);
1468 return NULL;
1469 }
1470 DSA_free(dsa);
1471 internal_data = 1;
1472 }
1473 #endif /* HAVE_SSL */
1474 break;
1475 case LDNS_SIGN_ECC_GOST:
1476 ldns_rr_push_rdf(pubkey, ldns_native2rdf_int8(
1477 LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
1478 #if defined(HAVE_SSL) && defined(USE_GOST)
1479 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
1480 if (!bin) {
1481 ldns_rr_free(pubkey);
1482 return NULL;
1483 }
1484 #ifndef S_SPLINT_S
1485 if (!ldns_key_gost2bin(bin, k->_key.key, &size)) {
1486 LDNS_FREE(bin);
1487 ldns_rr_free(pubkey);
1488 return NULL;
1489 }
1490 #endif /* splint */
1491 internal_data = 1;
1492 #else
1493 ldns_rr_free(pubkey);
1494 return NULL;
1495 #endif /* HAVE_SSL and USE_GOST */
1496 break;
1497 case LDNS_SIGN_ECDSAP256SHA256:
1498 case LDNS_SIGN_ECDSAP384SHA384:
1499 #ifdef USE_ECDSA
1500 ldns_rr_push_rdf(pubkey, ldns_native2rdf_int8(
1501 LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
1502 bin = NULL;
1503 #ifndef S_SPLINT_S
1504 ec = EVP_PKEY_get1_EC_KEY(k->_key.key);
1505 #endif
1506 EC_KEY_set_conv_form(ec, POINT_CONVERSION_UNCOMPRESSED);
1507 size = (uint16_t)i2o_ECPublicKey(ec, NULL);
1508 if(!i2o_ECPublicKey(ec, &bin)) {
1509 EC_KEY_free(ec);
1510 ldns_rr_free(pubkey);
1511 return NULL;
1512 }
1513 if(size > 1) {
1514 /* move back one byte to shave off the 0x02
1515 * 'uncompressed' indicator that openssl made
1516 * Actually its 0x04 (from implementation).
1517 */
1518 assert(bin[0] == POINT_CONVERSION_UNCOMPRESSED);
1519 size -= 1;
1520 memmove(bin, bin+1, size);
1521 }
1522 /* down the reference count for ec, its still assigned
1523 * to the pkey */
1524 EC_KEY_free(ec);
1525 internal_data = 1;
1526 #else
1527 ldns_rr_free(pubkey);
1528 return NULL;
1529 #endif /* ECDSA */
1530 break;
1531 case LDNS_SIGN_HMACMD5:
1532 case LDNS_SIGN_HMACSHA1:
1533 case LDNS_SIGN_HMACSHA256:
1534 bin = LDNS_XMALLOC(unsigned char, ldns_key_hmac_size(k));
1535 if (!bin) {
1536 ldns_rr_free(pubkey);
1537 return NULL;
1538 }
1539 ldns_rr_push_rdf(pubkey,
1540 ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG,
1541 ldns_key_algorithm(k)));
1542 size = ldns_key_hmac_size(k);
1543 memcpy(bin, ldns_key_hmac_key(k), size);
1544 internal_data = 1;
1545 break;
1546 }
1547 /* fourth the key bin material */
1548 if (internal_data) {
1549 keybin = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, size, bin);
1550 LDNS_FREE(bin);
1551 ldns_rr_push_rdf(pubkey, keybin);
1552 }
1553 return pubkey;
1554 }
1555
1556 void
1557 ldns_key_free(ldns_key *key)
1558 {
1559 LDNS_FREE(key);
1560 }
1561
1562 void
1563 ldns_key_deep_free(ldns_key *key)
1564 {
1565 unsigned char* hmac;
1566 if (ldns_key_pubkey_owner(key)) {
1567 ldns_rdf_deep_free(ldns_key_pubkey_owner(key));
1568 }
1569 #ifdef HAVE_SSL
1570 if (ldns_key_evp_key(key)) {
1571 EVP_PKEY_free(ldns_key_evp_key(key));
1572 }
1573 #endif /* HAVE_SSL */
1574 if (ldns_key_hmac_key(key)) {
1575 hmac = ldns_key_hmac_key(key);
1576 LDNS_FREE(hmac);
1577 }
1578 LDNS_FREE(key);
1579 }
1580
1581 void
1582 ldns_key_list_free(ldns_key_list *key_list)
1583 {
1584 size_t i;
1585 for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1586 ldns_key_deep_free(ldns_key_list_key(key_list, i));
1587 }
1588 LDNS_FREE(key_list->_keys);
1589 LDNS_FREE(key_list);
1590 }
1591
1592 ldns_rr *
1593 ldns_read_anchor_file(const char *filename)
1594 {
1595 FILE *fp;
1596 /*char line[LDNS_MAX_PACKETLEN];*/
1597 char *line = LDNS_XMALLOC(char, LDNS_MAX_PACKETLEN);
1598 int c;
1599 size_t i = 0;
1600 ldns_rr *r;
1601 ldns_status status;
1602 if(!line) {
1603 return NULL;
1604 }
1605
1606 fp = fopen(filename, "r");
1607 if (!fp) {
1608 fprintf(stderr, "Unable to open %s: %s\n", filename, strerror(errno));
1609 LDNS_FREE(line);
1610 return NULL;
1611 }
1612
1613 while ((c = fgetc(fp)) && i+1 < LDNS_MAX_PACKETLEN && c != EOF) {
1614 line[i] = c;
1615 i++;
1616 }
1617 line[i] = '\0';
1618
1619 fclose(fp);
1620
1621 if (i <= 0) {
1622 fprintf(stderr, "nothing read from %s", filename);
1623 LDNS_FREE(line);
1624 return NULL;
1625 } else {
1626 status = ldns_rr_new_frm_str(&r, line, 0, NULL, NULL);
1627 if (status == LDNS_STATUS_OK && (ldns_rr_get_type(r) == LDNS_RR_TYPE_DNSKEY || ldns_rr_get_type(r) == LDNS_RR_TYPE_DS)) {
1628 LDNS_FREE(line);
1629 return r;
1630 } else {
1631 fprintf(stderr, "Error creating DNSKEY or DS rr from %s: %s\n", filename, ldns_get_errorstr_by_id(status));
1632 LDNS_FREE(line);
1633 return NULL;
1634 }
1635 }
1636 }
1637
1638 char *
1639 ldns_key_get_file_base_name(ldns_key *key)
1640 {
1641 ldns_buffer *buffer;
1642 char *file_base_name;
1643
1644 buffer = ldns_buffer_new(255);
1645 ldns_buffer_printf(buffer, "K");
1646 (void)ldns_rdf2buffer_str_dname(buffer, ldns_key_pubkey_owner(key));
1647 ldns_buffer_printf(buffer,
1648 "+%03u+%05u",
1649 ldns_key_algorithm(key),
1650 ldns_key_keytag(key));
1651 file_base_name = ldns_buffer_export(buffer);
1652 ldns_buffer_free(buffer);
1653 return file_base_name;
1654 }
1655
1656 int ldns_key_algo_supported(int algo)
1657 {
1658 ldns_lookup_table *lt = ldns_signing_algorithms;
1659 while(lt->name) {
1660 if(lt->id == algo)
1661 return 1;
1662 lt++;
1663 }
1664 return 0;
1665 }
1666
1667 ldns_signing_algorithm ldns_get_signing_algorithm_by_name(const char* name)
1668 {
1669 /* list of (signing algorithm id, alias_name) */
1670 ldns_lookup_table aliases[] = {
1671 /* from bind dnssec-keygen */
1672 {LDNS_SIGN_HMACMD5, "HMAC-MD5"},
1673 {LDNS_SIGN_DSA_NSEC3, "NSEC3DSA"},
1674 {LDNS_SIGN_RSASHA1_NSEC3, "NSEC3RSASHA1"},
1675 /* old ldns usage, now RFC names */
1676 {LDNS_SIGN_DSA_NSEC3, "DSA_NSEC3" },
1677 {LDNS_SIGN_RSASHA1_NSEC3, "RSASHA1_NSEC3" },
1678 #ifdef USE_GOST
1679 {LDNS_SIGN_ECC_GOST, "GOST"},
1680 #endif
1681 /* compat with possible output */
1682 {LDNS_DH, "DH"},
1683 {LDNS_ECC, "ECC"},
1684 {LDNS_INDIRECT, "INDIRECT"},
1685 {LDNS_PRIVATEDNS, "PRIVATEDNS"},
1686 {LDNS_PRIVATEOID, "PRIVATEOID"},
1687 {0, NULL}};
1688 ldns_lookup_table* lt = ldns_signing_algorithms;
1689 while(lt->name) {
1690 if(strcasecmp(lt->name, name) == 0)
1691 return lt->id;
1692 lt++;
1693 }
1694 lt = aliases;
1695 while(lt->name) {
1696 if(strcasecmp(lt->name, name) == 0)
1697 return lt->id;
1698 lt++;
1699 }
1700 if(atoi(name) != 0)
1701 return atoi(name);
1702 return 0;
1703 }
DragonFly BSD