1 /*
2 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
3 *
4 * This Source Code Form is subject to the terms of the Mozilla Public
5 * License, v. 2.0. If a copy of the MPL was not distributed with this
6 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
7 *
8 * See the COPYRIGHT file distributed with this work for additional
9 * information regarding copyright ownership.
10 */
11
12 #ifdef PKCS11CRYPTO
13
14 #include <config.h>
15
16 #include <pk11/site.h>
17
18 #ifndef PK11_DSA_DISABLE
19
20 #include <string.h>
21 #include <stdbool.h>
22
23 #include <isc/entropy.h>
24 #include <isc/mem.h>
25 #include <isc/safe.h>
26 #include <isc/sha1.h>
27 #include <isc/util.h>
28
29 #include <dst/result.h>
30
31 #include "dst_internal.h"
32 #include "dst_parse.h"
33 #include "dst_pkcs11.h"
34
35 #include <pk11/internal.h>
36
37 /*
38 * FIPS 186-2 DSA keys:
39 * mechanisms:
40 * CKM_DSA_SHA1,
41 * CKM_DSA_KEY_PAIR_GEN,
42 * CKM_DSA_PARAMETER_GEN
43 * domain parameters:
44 * object class CKO_DOMAIN_PARAMETERS
45 * key type CKK_DSA
46 * attribute CKA_PRIME (prime p)
47 * attribute CKA_SUBPRIME (subprime q)
48 * attribute CKA_BASE (base g)
49 * optional attribute CKA_PRIME_BITS (p length in bits)
50 * public keys:
51 * object class CKO_PUBLIC_KEY
52 * key type CKK_DSA
53 * attribute CKA_PRIME (prime p)
54 * attribute CKA_SUBPRIME (subprime q)
55 * attribute CKA_BASE (base g)
56 * attribute CKA_VALUE (public value y)
57 * private keys:
58 * object class CKO_PRIVATE_KEY
59 * key type CKK_DSA
60 * attribute CKA_PRIME (prime p)
61 * attribute CKA_SUBPRIME (subprime q)
62 * attribute CKA_BASE (base g)
63 * attribute CKA_VALUE (private value x)
64 * reuse CKA_PRIVATE_EXPONENT for key pair private value
65 */
66
67 #define CKA_VALUE2 CKA_PRIVATE_EXPONENT
68
69 #define DST_RET(a) {ret = a; goto err;}
70
71 static CK_BBOOL truevalue = TRUE;
72 static CK_BBOOL falsevalue = FALSE;
73
74 static isc_result_t pkcs11dsa_todns(const dst_key_t *key, isc_buffer_t *data);
75 static void pkcs11dsa_destroy(dst_key_t *key);
76
77 static isc_result_t
pkcs11dsa_createctx_sign(dst_key_t * key,dst_context_t * dctx)78 pkcs11dsa_createctx_sign(dst_key_t *key, dst_context_t *dctx) {
79 CK_RV rv;
80 CK_MECHANISM mech = { CKM_DSA_SHA1, NULL, 0 };
81 CK_OBJECT_CLASS keyClass = CKO_PRIVATE_KEY;
82 CK_KEY_TYPE keyType = CKK_DSA;
83 CK_ATTRIBUTE keyTemplate[] =
84 {
85 { CKA_CLASS, &keyClass, (CK_ULONG) sizeof(keyClass) },
86 { CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },
87 { CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
88 { CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
89 { CKA_SENSITIVE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
90 { CKA_SIGN, &truevalue, (CK_ULONG) sizeof(truevalue) },
91 { CKA_PRIME, NULL, 0 },
92 { CKA_SUBPRIME, NULL, 0 },
93 { CKA_BASE, NULL, 0 },
94 { CKA_VALUE, NULL, 0 }
95 };
96 CK_ATTRIBUTE *attr;
97 pk11_object_t *dsa;
98 pk11_context_t *pk11_ctx;
99 isc_result_t ret;
100 unsigned int i;
101
102 REQUIRE(key != NULL);
103 dsa = key->keydata.pkey;
104 REQUIRE(dsa != NULL);
105
106 pk11_ctx = (pk11_context_t *) isc_mem_get(dctx->mctx,
107 sizeof(*pk11_ctx));
108 if (pk11_ctx == NULL)
109 return (ISC_R_NOMEMORY);
110 ret = pk11_get_session(pk11_ctx, OP_DSA, true, false,
111 dsa->reqlogon, NULL,
112 pk11_get_best_token(OP_DSA));
113 if (ret != ISC_R_SUCCESS)
114 goto err;
115
116 if (dsa->ontoken && (dsa->object != CK_INVALID_HANDLE)) {
117 pk11_ctx->ontoken = dsa->ontoken;
118 pk11_ctx->object = dsa->object;
119 goto token_key;
120 }
121
122 for (attr = pk11_attribute_first(dsa);
123 attr != NULL;
124 attr = pk11_attribute_next(dsa, attr))
125 switch (attr->type) {
126 case CKA_PRIME:
127 INSIST(keyTemplate[6].type == attr->type);
128 keyTemplate[6].pValue = isc_mem_get(dctx->mctx,
129 attr->ulValueLen);
130 if (keyTemplate[6].pValue == NULL)
131 DST_RET(ISC_R_NOMEMORY);
132 memmove(keyTemplate[6].pValue, attr->pValue,
133 attr->ulValueLen);
134 keyTemplate[6].ulValueLen = attr->ulValueLen;
135 break;
136 case CKA_SUBPRIME:
137 INSIST(keyTemplate[7].type == attr->type);
138 keyTemplate[7].pValue = isc_mem_get(dctx->mctx,
139 attr->ulValueLen);
140 if (keyTemplate[7].pValue == NULL)
141 DST_RET(ISC_R_NOMEMORY);
142 memmove(keyTemplate[7].pValue, attr->pValue,
143 attr->ulValueLen);
144 keyTemplate[7].ulValueLen = attr->ulValueLen;
145 break;
146 case CKA_BASE:
147 INSIST(keyTemplate[8].type == attr->type);
148 keyTemplate[8].pValue = isc_mem_get(dctx->mctx,
149 attr->ulValueLen);
150 if (keyTemplate[8].pValue == NULL)
151 DST_RET(ISC_R_NOMEMORY);
152 memmove(keyTemplate[8].pValue, attr->pValue,
153 attr->ulValueLen);
154 keyTemplate[8].ulValueLen = attr->ulValueLen;
155 break;
156 case CKA_VALUE2:
157 INSIST(keyTemplate[9].type == CKA_VALUE);
158 keyTemplate[9].pValue = isc_mem_get(dctx->mctx,
159 attr->ulValueLen);
160 if (keyTemplate[9].pValue == NULL)
161 DST_RET(ISC_R_NOMEMORY);
162 memmove(keyTemplate[9].pValue, attr->pValue,
163 attr->ulValueLen);
164 keyTemplate[9].ulValueLen = attr->ulValueLen;
165 break;
166 }
167 pk11_ctx->object = CK_INVALID_HANDLE;
168 pk11_ctx->ontoken = false;
169 PK11_RET(pkcs_C_CreateObject,
170 (pk11_ctx->session,
171 keyTemplate, (CK_ULONG) 10,
172 &pk11_ctx->object),
173 ISC_R_FAILURE);
174
175 token_key:
176
177 PK11_RET(pkcs_C_SignInit,
178 (pk11_ctx->session, &mech, pk11_ctx->object),
179 ISC_R_FAILURE);
180
181 dctx->ctxdata.pk11_ctx = pk11_ctx;
182
183 for (i = 6; i <= 9; i++)
184 if (keyTemplate[i].pValue != NULL) {
185 isc_safe_memwipe(keyTemplate[i].pValue,
186 keyTemplate[i].ulValueLen);
187 isc_mem_put(dctx->mctx,
188 keyTemplate[i].pValue,
189 keyTemplate[i].ulValueLen);
190 }
191
192 return (ISC_R_SUCCESS);
193
194 err:
195 if (!pk11_ctx->ontoken && (pk11_ctx->object != CK_INVALID_HANDLE))
196 (void) pkcs_C_DestroyObject(pk11_ctx->session, pk11_ctx->object);
197 for (i = 6; i <= 9; i++)
198 if (keyTemplate[i].pValue != NULL) {
199 isc_safe_memwipe(keyTemplate[i].pValue,
200 keyTemplate[i].ulValueLen);
201 isc_mem_put(dctx->mctx,
202 keyTemplate[i].pValue,
203 keyTemplate[i].ulValueLen);
204 }
205 pk11_return_session(pk11_ctx);
206 isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
207 isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
208
209 return (ret);
210 }
211
212 static isc_result_t
pkcs11dsa_createctx_verify(dst_key_t * key,dst_context_t * dctx)213 pkcs11dsa_createctx_verify(dst_key_t *key, dst_context_t *dctx) {
214 CK_RV rv;
215 CK_MECHANISM mech = { CKM_DSA_SHA1, NULL, 0 };
216 CK_OBJECT_CLASS keyClass = CKO_PUBLIC_KEY;
217 CK_KEY_TYPE keyType = CKK_DSA;
218 CK_ATTRIBUTE keyTemplate[] =
219 {
220 { CKA_CLASS, &keyClass, (CK_ULONG) sizeof(keyClass) },
221 { CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },
222 { CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
223 { CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
224 { CKA_VERIFY, &truevalue, (CK_ULONG) sizeof(truevalue) },
225 { CKA_PRIME, NULL, 0 },
226 { CKA_SUBPRIME, NULL, 0 },
227 { CKA_BASE, NULL, 0 },
228 { CKA_VALUE, NULL, 0 }
229 };
230 CK_ATTRIBUTE *attr;
231 pk11_object_t *dsa;
232 pk11_context_t *pk11_ctx;
233 isc_result_t ret;
234 unsigned int i;
235
236 dsa = key->keydata.pkey;
237 REQUIRE(dsa != NULL);
238 pk11_ctx = (pk11_context_t *) isc_mem_get(dctx->mctx,
239 sizeof(*pk11_ctx));
240 if (pk11_ctx == NULL)
241 return (ISC_R_NOMEMORY);
242 ret = pk11_get_session(pk11_ctx, OP_DSA, true, false,
243 dsa->reqlogon, NULL,
244 pk11_get_best_token(OP_DSA));
245 if (ret != ISC_R_SUCCESS)
246 goto err;
247
248 if (dsa->ontoken && (dsa->object != CK_INVALID_HANDLE)) {
249 pk11_ctx->ontoken = dsa->ontoken;
250 pk11_ctx->object = dsa->object;
251 goto token_key;
252 }
253
254 for (attr = pk11_attribute_first(dsa);
255 attr != NULL;
256 attr = pk11_attribute_next(dsa, attr))
257 switch (attr->type) {
258 case CKA_PRIME:
259 INSIST(keyTemplate[5].type == attr->type);
260 keyTemplate[5].pValue = isc_mem_get(dctx->mctx,
261 attr->ulValueLen);
262 if (keyTemplate[5].pValue == NULL)
263 DST_RET(ISC_R_NOMEMORY);
264 memmove(keyTemplate[5].pValue, attr->pValue,
265 attr->ulValueLen);
266 keyTemplate[5].ulValueLen = attr->ulValueLen;
267 break;
268 case CKA_SUBPRIME:
269 INSIST(keyTemplate[6].type == attr->type);
270 keyTemplate[6].pValue = isc_mem_get(dctx->mctx,
271 attr->ulValueLen);
272 if (keyTemplate[6].pValue == NULL)
273 DST_RET(ISC_R_NOMEMORY);
274 memmove(keyTemplate[6].pValue, attr->pValue,
275 attr->ulValueLen);
276 keyTemplate[6].ulValueLen = attr->ulValueLen;
277 break;
278 case CKA_BASE:
279 INSIST(keyTemplate[7].type == attr->type);
280 keyTemplate[7].pValue = isc_mem_get(dctx->mctx,
281 attr->ulValueLen);
282 if (keyTemplate[7].pValue == NULL)
283 DST_RET(ISC_R_NOMEMORY);
284 memmove(keyTemplate[7].pValue, attr->pValue,
285 attr->ulValueLen);
286 keyTemplate[7].ulValueLen = attr->ulValueLen;
287 break;
288 case CKA_VALUE:
289 INSIST(keyTemplate[8].type == attr->type);
290 keyTemplate[8].pValue = isc_mem_get(dctx->mctx,
291 attr->ulValueLen);
292 if (keyTemplate[8].pValue == NULL)
293 DST_RET(ISC_R_NOMEMORY);
294 memmove(keyTemplate[8].pValue, attr->pValue,
295 attr->ulValueLen);
296 keyTemplate[8].ulValueLen = attr->ulValueLen;
297 break;
298 }
299 pk11_ctx->object = CK_INVALID_HANDLE;
300 pk11_ctx->ontoken = false;
301 PK11_RET(pkcs_C_CreateObject,
302 (pk11_ctx->session,
303 keyTemplate, (CK_ULONG) 9,
304 &pk11_ctx->object),
305 ISC_R_FAILURE);
306
307 token_key:
308
309 PK11_RET(pkcs_C_VerifyInit,
310 (pk11_ctx->session, &mech, pk11_ctx->object),
311 ISC_R_FAILURE);
312
313 dctx->ctxdata.pk11_ctx = pk11_ctx;
314
315 for (i = 5; i <= 8; i++)
316 if (keyTemplate[i].pValue != NULL) {
317 isc_safe_memwipe(keyTemplate[i].pValue,
318 keyTemplate[i].ulValueLen);
319 isc_mem_put(dctx->mctx,
320 keyTemplate[i].pValue,
321 keyTemplate[i].ulValueLen);
322 }
323
324 return (ISC_R_SUCCESS);
325
326 err:
327 if (!pk11_ctx->ontoken && (pk11_ctx->object != CK_INVALID_HANDLE))
328 (void) pkcs_C_DestroyObject(pk11_ctx->session, pk11_ctx->object);
329 for (i = 5; i <= 8; i++)
330 if (keyTemplate[i].pValue != NULL) {
331 isc_safe_memwipe(keyTemplate[i].pValue,
332 keyTemplate[i].ulValueLen);
333 isc_mem_put(dctx->mctx,
334 keyTemplate[i].pValue,
335 keyTemplate[i].ulValueLen);
336 }
337 pk11_return_session(pk11_ctx);
338 isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
339 isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
340
341 return (ret);
342 }
343
344 static isc_result_t
pkcs11dsa_createctx(dst_key_t * key,dst_context_t * dctx)345 pkcs11dsa_createctx(dst_key_t *key, dst_context_t *dctx) {
346 if (dctx->use == DO_SIGN)
347 return (pkcs11dsa_createctx_sign(key, dctx));
348 else
349 return (pkcs11dsa_createctx_verify(key, dctx));
350 }
351
352 static void
pkcs11dsa_destroyctx(dst_context_t * dctx)353 pkcs11dsa_destroyctx(dst_context_t *dctx) {
354 pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
355
356 if (pk11_ctx != NULL) {
357 if (!pk11_ctx->ontoken &&
358 (pk11_ctx->object != CK_INVALID_HANDLE))
359 (void) pkcs_C_DestroyObject(pk11_ctx->session,
360 pk11_ctx->object);
361 pk11_return_session(pk11_ctx);
362 isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
363 isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
364 dctx->ctxdata.pk11_ctx = NULL;
365 }
366 }
367
368 static isc_result_t
pkcs11dsa_adddata(dst_context_t * dctx,const isc_region_t * data)369 pkcs11dsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
370 CK_RV rv;
371 pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
372 isc_result_t ret = ISC_R_SUCCESS;
373
374 if (dctx->use == DO_SIGN)
375 PK11_CALL(pkcs_C_SignUpdate,
376 (pk11_ctx->session,
377 (CK_BYTE_PTR) data->base,
378 (CK_ULONG) data->length),
379 ISC_R_FAILURE);
380 else
381 PK11_CALL(pkcs_C_VerifyUpdate,
382 (pk11_ctx->session,
383 (CK_BYTE_PTR) data->base,
384 (CK_ULONG) data->length),
385 ISC_R_FAILURE);
386 return (ret);
387 }
388
389 static isc_result_t
pkcs11dsa_sign(dst_context_t * dctx,isc_buffer_t * sig)390 pkcs11dsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
391 CK_RV rv;
392 CK_ULONG siglen = ISC_SHA1_DIGESTLENGTH * 2;
393 isc_region_t r;
394 pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
395 isc_result_t ret = ISC_R_SUCCESS;
396 unsigned int klen;
397
398 isc_buffer_availableregion(sig, &r);
399 if (r.length < ISC_SHA1_DIGESTLENGTH * 2 + 1)
400 return (ISC_R_NOSPACE);
401
402 PK11_RET(pkcs_C_SignFinal,
403 (pk11_ctx->session, (CK_BYTE_PTR) r.base + 1, &siglen),
404 DST_R_SIGNFAILURE);
405 if (siglen != ISC_SHA1_DIGESTLENGTH * 2)
406 return (DST_R_SIGNFAILURE);
407
408 klen = (dctx->key->key_size - 512)/64;
409 if (klen > 255)
410 return (ISC_R_FAILURE);
411 *r.base = klen;
412 isc_buffer_add(sig, ISC_SHA1_DIGESTLENGTH * 2 + 1);
413
414 err:
415 return (ret);
416 }
417
418 static isc_result_t
pkcs11dsa_verify(dst_context_t * dctx,const isc_region_t * sig)419 pkcs11dsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
420 CK_RV rv;
421 pk11_context_t *pk11_ctx = dctx->ctxdata.pk11_ctx;
422 isc_result_t ret = ISC_R_SUCCESS;
423
424 PK11_CALL(pkcs_C_VerifyFinal,
425 (pk11_ctx->session,
426 (CK_BYTE_PTR) sig->base + 1,
427 (CK_ULONG) sig->length - 1),
428 DST_R_VERIFYFAILURE);
429 return (ret);
430 }
431
432 static bool
pkcs11dsa_compare(const dst_key_t * key1,const dst_key_t * key2)433 pkcs11dsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
434 pk11_object_t *dsa1, *dsa2;
435 CK_ATTRIBUTE *attr1, *attr2;
436
437 dsa1 = key1->keydata.pkey;
438 dsa2 = key2->keydata.pkey;
439
440 if ((dsa1 == NULL) && (dsa2 == NULL))
441 return (true);
442 else if ((dsa1 == NULL) || (dsa2 == NULL))
443 return (false);
444
445 attr1 = pk11_attribute_bytype(dsa1, CKA_PRIME);
446 attr2 = pk11_attribute_bytype(dsa2, CKA_PRIME);
447 if ((attr1 == NULL) && (attr2 == NULL))
448 return (true);
449 else if ((attr1 == NULL) || (attr2 == NULL) ||
450 (attr1->ulValueLen != attr2->ulValueLen) ||
451 !isc_safe_memequal(attr1->pValue, attr2->pValue,
452 attr1->ulValueLen))
453 return (false);
454
455 attr1 = pk11_attribute_bytype(dsa1, CKA_SUBPRIME);
456 attr2 = pk11_attribute_bytype(dsa2, CKA_SUBPRIME);
457 if ((attr1 == NULL) && (attr2 == NULL))
458 return (true);
459 else if ((attr1 == NULL) || (attr2 == NULL) ||
460 (attr1->ulValueLen != attr2->ulValueLen) ||
461 !isc_safe_memequal(attr1->pValue, attr2->pValue,
462 attr1->ulValueLen))
463 return (false);
464
465 attr1 = pk11_attribute_bytype(dsa1, CKA_BASE);
466 attr2 = pk11_attribute_bytype(dsa2, CKA_BASE);
467 if ((attr1 == NULL) && (attr2 == NULL))
468 return (true);
469 else if ((attr1 == NULL) || (attr2 == NULL) ||
470 (attr1->ulValueLen != attr2->ulValueLen) ||
471 !isc_safe_memequal(attr1->pValue, attr2->pValue,
472 attr1->ulValueLen))
473 return (false);
474
475 attr1 = pk11_attribute_bytype(dsa1, CKA_VALUE);
476 attr2 = pk11_attribute_bytype(dsa2, CKA_VALUE);
477 if ((attr1 == NULL) && (attr2 == NULL))
478 return (true);
479 else if ((attr1 == NULL) || (attr2 == NULL) ||
480 (attr1->ulValueLen != attr2->ulValueLen) ||
481 !isc_safe_memequal(attr1->pValue, attr2->pValue,
482 attr1->ulValueLen))
483 return (false);
484
485 attr1 = pk11_attribute_bytype(dsa1, CKA_VALUE2);
486 attr2 = pk11_attribute_bytype(dsa2, CKA_VALUE2);
487 if (((attr1 != NULL) || (attr2 != NULL)) &&
488 ((attr1 == NULL) || (attr2 == NULL) ||
489 (attr1->ulValueLen != attr2->ulValueLen) ||
490 !isc_safe_memequal(attr1->pValue, attr2->pValue,
491 attr1->ulValueLen)))
492 return (false);
493
494 if (!dsa1->ontoken && !dsa2->ontoken)
495 return (true);
496 else if (dsa1->ontoken || dsa2->ontoken ||
497 (dsa1->object != dsa2->object))
498 return (false);
499
500 return (true);
501 }
502
503 static isc_result_t
pkcs11dsa_generate(dst_key_t * key,int unused,void (* callback)(int))504 pkcs11dsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
505 CK_RV rv;
506 CK_MECHANISM mech = { CKM_DSA_PARAMETER_GEN, NULL, 0 };
507 CK_OBJECT_HANDLE dp = CK_INVALID_HANDLE;
508 CK_OBJECT_CLASS dpClass = CKO_DOMAIN_PARAMETERS;
509 CK_KEY_TYPE keyType = CKK_DSA;
510 CK_ULONG bits = 0;
511 CK_ATTRIBUTE dpTemplate[] =
512 {
513 { CKA_CLASS, &dpClass, (CK_ULONG) sizeof(dpClass) },
514 { CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },
515 { CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
516 { CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
517 { CKA_PRIME_BITS, &bits, (CK_ULONG) sizeof(bits) },
518 };
519 CK_OBJECT_HANDLE pub = CK_INVALID_HANDLE;
520 CK_OBJECT_CLASS pubClass = CKO_PUBLIC_KEY;
521 CK_ATTRIBUTE pubTemplate[] =
522 {
523 { CKA_CLASS, &pubClass, (CK_ULONG) sizeof(pubClass) },
524 { CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },
525 { CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
526 { CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
527 { CKA_VERIFY, &truevalue, (CK_ULONG) sizeof(truevalue) },
528 { CKA_PRIME, NULL, 0 },
529 { CKA_SUBPRIME, NULL, 0 },
530 { CKA_BASE, NULL, 0 }
531 };
532 CK_OBJECT_HANDLE priv = CK_INVALID_HANDLE;
533 CK_OBJECT_HANDLE privClass = CKO_PRIVATE_KEY;
534 CK_ATTRIBUTE privTemplate[] =
535 {
536 { CKA_CLASS, &privClass, (CK_ULONG) sizeof(privClass) },
537 { CKA_KEY_TYPE, &keyType, (CK_ULONG) sizeof(keyType) },
538 { CKA_TOKEN, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
539 { CKA_PRIVATE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
540 { CKA_SENSITIVE, &falsevalue, (CK_ULONG) sizeof(falsevalue) },
541 { CKA_EXTRACTABLE, &truevalue, (CK_ULONG) sizeof(truevalue) },
542 { CKA_SIGN, &truevalue, (CK_ULONG) sizeof(truevalue) },
543 };
544 CK_ATTRIBUTE *attr;
545 pk11_object_t *dsa;
546 pk11_context_t *pk11_ctx;
547 isc_result_t ret;
548 unsigned int i;
549
550 UNUSED(unused);
551 UNUSED(callback);
552
553 pk11_ctx = (pk11_context_t *) isc_mem_get(key->mctx,
554 sizeof(*pk11_ctx));
555 if (pk11_ctx == NULL)
556 return (ISC_R_NOMEMORY);
557 ret = pk11_get_session(pk11_ctx, OP_DSA, true, false,
558 false, NULL, pk11_get_best_token(OP_DSA));
559 if (ret != ISC_R_SUCCESS)
560 goto err;
561
562 bits = key->key_size;
563 PK11_RET(pkcs_C_GenerateKey,
564 (pk11_ctx->session, &mech, dpTemplate, (CK_ULONG) 5, &dp),
565 DST_R_CRYPTOFAILURE);
566
567 dsa = (pk11_object_t *) isc_mem_get(key->mctx, sizeof(*dsa));
568 if (dsa == NULL)
569 DST_RET(ISC_R_NOMEMORY);
570 memset(dsa, 0, sizeof(*dsa));
571 key->keydata.pkey = dsa;
572 dsa->repr = (CK_ATTRIBUTE *) isc_mem_get(key->mctx, sizeof(*attr) * 5);
573 if (dsa->repr == NULL)
574 DST_RET(ISC_R_NOMEMORY);
575 memset(dsa->repr, 0, sizeof(*attr) * 5);
576 dsa->attrcnt = 5;
577
578 attr = dsa->repr;
579 attr[0].type = CKA_PRIME;
580 attr[1].type = CKA_SUBPRIME;
581 attr[2].type = CKA_BASE;
582 attr[3].type = CKA_VALUE;
583 attr[4].type = CKA_VALUE2;
584
585 PK11_RET(pkcs_C_GetAttributeValue,
586 (pk11_ctx->session, dp, attr, 3),
587 DST_R_CRYPTOFAILURE);
588
589 for (i = 0; i <= 2; i++) {
590 attr[i].pValue = isc_mem_get(key->mctx, attr[i].ulValueLen);
591 if (attr[i].pValue == NULL)
592 DST_RET(ISC_R_NOMEMORY);
593 memset(attr[i].pValue, 0, attr[i].ulValueLen);
594 }
595 PK11_RET(pkcs_C_GetAttributeValue,
596 (pk11_ctx->session, dp, attr, 3),
597 DST_R_CRYPTOFAILURE);
598 pubTemplate[5].pValue = attr[0].pValue;
599 pubTemplate[5].ulValueLen = attr[0].ulValueLen;
600 pubTemplate[6].pValue = attr[1].pValue;
601 pubTemplate[6].ulValueLen = attr[1].ulValueLen;
602 pubTemplate[7].pValue = attr[2].pValue;
603 pubTemplate[7].ulValueLen = attr[2].ulValueLen;
604
605 mech.mechanism = CKM_DSA_KEY_PAIR_GEN;
606 PK11_RET(pkcs_C_GenerateKeyPair,
607 (pk11_ctx->session, &mech,
608 pubTemplate, (CK_ULONG) 8,
609 privTemplate, (CK_ULONG) 7,
610 &pub, &priv),
611 DST_R_CRYPTOFAILURE);
612
613 attr = dsa->repr;
614 attr += 3;
615 PK11_RET(pkcs_C_GetAttributeValue,
616 (pk11_ctx->session, pub, attr, 1),
617 DST_R_CRYPTOFAILURE);
618 attr->pValue = isc_mem_get(key->mctx, attr->ulValueLen);
619 if (attr->pValue == NULL)
620 DST_RET(ISC_R_NOMEMORY);
621 memset(attr->pValue, 0, attr->ulValueLen);
622 PK11_RET(pkcs_C_GetAttributeValue,
623 (pk11_ctx->session, pub, attr, 1),
624 DST_R_CRYPTOFAILURE);
625
626 attr++;
627 attr->type = CKA_VALUE;
628 PK11_RET(pkcs_C_GetAttributeValue,
629 (pk11_ctx->session, priv, attr, 1),
630 DST_R_CRYPTOFAILURE);
631 attr->pValue = isc_mem_get(key->mctx, attr->ulValueLen);
632 if (attr->pValue == NULL)
633 DST_RET(ISC_R_NOMEMORY);
634 memset(attr->pValue, 0, attr->ulValueLen);
635 PK11_RET(pkcs_C_GetAttributeValue,
636 (pk11_ctx->session, priv, attr, 1),
637 DST_R_CRYPTOFAILURE);
638 attr->type = CKA_VALUE2;
639
640 (void) pkcs_C_DestroyObject(pk11_ctx->session, priv);
641 (void) pkcs_C_DestroyObject(pk11_ctx->session, pub);
642 (void) pkcs_C_DestroyObject(pk11_ctx->session, dp);
643 pk11_return_session(pk11_ctx);
644 isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
645 isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
646
647 return (ISC_R_SUCCESS);
648
649 err:
650 pkcs11dsa_destroy(key);
651 if (priv != CK_INVALID_HANDLE)
652 (void) pkcs_C_DestroyObject(pk11_ctx->session, priv);
653 if (pub != CK_INVALID_HANDLE)
654 (void) pkcs_C_DestroyObject(pk11_ctx->session, pub);
655 if (dp != CK_INVALID_HANDLE)
656 (void) pkcs_C_DestroyObject(pk11_ctx->session, dp);
657 pk11_return_session(pk11_ctx);
658 isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
659 isc_mem_put(key->mctx, pk11_ctx, sizeof(*pk11_ctx));
660
661 return (ret);
662 }
663
664 static bool
pkcs11dsa_isprivate(const dst_key_t * key)665 pkcs11dsa_isprivate(const dst_key_t *key) {
666 pk11_object_t *dsa = key->keydata.pkey;
667 CK_ATTRIBUTE *attr;
668
669 if (dsa == NULL)
670 return (false);
671 attr = pk11_attribute_bytype(dsa, CKA_VALUE2);
672 return (attr != NULL || dsa->ontoken);
673 }
674
675 static void
pkcs11dsa_destroy(dst_key_t * key)676 pkcs11dsa_destroy(dst_key_t *key) {
677 pk11_object_t *dsa = key->keydata.pkey;
678 CK_ATTRIBUTE *attr;
679
680 if (dsa == NULL)
681 return;
682
683 INSIST((dsa->object == CK_INVALID_HANDLE) || dsa->ontoken);
684
685 for (attr = pk11_attribute_first(dsa);
686 attr != NULL;
687 attr = pk11_attribute_next(dsa, attr))
688 switch (attr->type) {
689 case CKA_PRIME:
690 case CKA_SUBPRIME:
691 case CKA_BASE:
692 case CKA_VALUE:
693 case CKA_VALUE2:
694 if (attr->pValue != NULL) {
695 isc_safe_memwipe(attr->pValue,
696 attr->ulValueLen);
697 isc_mem_put(key->mctx,
698 attr->pValue,
699 attr->ulValueLen);
700 }
701 break;
702 }
703 if (dsa->repr != NULL) {
704 isc_safe_memwipe(dsa->repr, dsa->attrcnt * sizeof(*attr));
705 isc_mem_put(key->mctx,
706 dsa->repr,
707 dsa->attrcnt * sizeof(*attr));
708 }
709 isc_safe_memwipe(dsa, sizeof(*dsa));
710 isc_mem_put(key->mctx, dsa, sizeof(*dsa));
711 key->keydata.pkey = NULL;
712 }
713
714
715 static isc_result_t
pkcs11dsa_todns(const dst_key_t * key,isc_buffer_t * data)716 pkcs11dsa_todns(const dst_key_t *key, isc_buffer_t *data) {
717 pk11_object_t *dsa;
718 CK_ATTRIBUTE *attr;
719 isc_region_t r;
720 int dnslen;
721 unsigned int t, p_bytes;
722 CK_ATTRIBUTE *prime = NULL, *subprime = NULL;
723 CK_ATTRIBUTE *base = NULL, *pub_key = NULL;
724 CK_BYTE *cp;
725
726 REQUIRE(key->keydata.pkey != NULL);
727
728 dsa = key->keydata.pkey;
729
730 for (attr = pk11_attribute_first(dsa);
731 attr != NULL;
732 attr = pk11_attribute_next(dsa, attr))
733 switch (attr->type) {
734 case CKA_PRIME:
735 prime = attr;
736 break;
737 case CKA_SUBPRIME:
738 subprime = attr;
739 break;
740 case CKA_BASE:
741 base = attr;
742 break;
743 case CKA_VALUE:
744 pub_key = attr;
745 break;
746 }
747 REQUIRE((prime != NULL) && (subprime != NULL) &&
748 (base != NULL) && (pub_key != NULL));
749
750 isc_buffer_availableregion(data, &r);
751
752 t = (prime->ulValueLen - 64) / 8;
753 if (t > 8)
754 return (DST_R_INVALIDPUBLICKEY);
755 p_bytes = 64 + 8 * t;
756
757 dnslen = 1 + (key->key_size * 3)/8 + ISC_SHA1_DIGESTLENGTH;
758 if (r.length < (unsigned int) dnslen)
759 return (ISC_R_NOSPACE);
760
761 memset(r.base, 0, dnslen);
762 *r.base = t;
763 isc_region_consume(&r, 1);
764
765 cp = (CK_BYTE *) subprime->pValue;
766 memmove(r.base + ISC_SHA1_DIGESTLENGTH - subprime->ulValueLen,
767 cp, subprime->ulValueLen);
768 isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
769 cp = (CK_BYTE *) prime->pValue;
770 memmove(r.base + key->key_size/8 - prime->ulValueLen,
771 cp, prime->ulValueLen);
772 isc_region_consume(&r, p_bytes);
773 cp = (CK_BYTE *) base->pValue;
774 memmove(r.base + key->key_size/8 - base->ulValueLen,
775 cp, base->ulValueLen);
776 isc_region_consume(&r, p_bytes);
777 cp = (CK_BYTE *) pub_key->pValue;
778 memmove(r.base + key->key_size/8 - pub_key->ulValueLen,
779 cp, pub_key->ulValueLen);
780 isc_region_consume(&r, p_bytes);
781
782 isc_buffer_add(data, dnslen);
783
784 return (ISC_R_SUCCESS);
785 }
786
787 static isc_result_t
pkcs11dsa_fromdns(dst_key_t * key,isc_buffer_t * data)788 pkcs11dsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
789 pk11_object_t *dsa;
790 isc_region_t r;
791 unsigned int t, p_bytes;
792 CK_BYTE *prime, *subprime, *base, *pub_key;
793 CK_ATTRIBUTE *attr;
794
795 isc_buffer_remainingregion(data, &r);
796 if (r.length == 0)
797 return (ISC_R_SUCCESS);
798
799 dsa = (pk11_object_t *) isc_mem_get(key->mctx, sizeof(*dsa));
800 if (dsa == NULL)
801 return (ISC_R_NOMEMORY);
802 memset(dsa, 0, sizeof(*dsa));
803
804 t = (unsigned int) *r.base;
805 isc_region_consume(&r, 1);
806 if (t > 8) {
807 isc_safe_memwipe(dsa, sizeof(*dsa));
808 isc_mem_put(key->mctx, dsa, sizeof(*dsa));
809 return (DST_R_INVALIDPUBLICKEY);
810 }
811 p_bytes = 64 + 8 * t;
812
813 if (r.length < ISC_SHA1_DIGESTLENGTH + 3 * p_bytes) {
814 isc_safe_memwipe(dsa, sizeof(*dsa));
815 isc_mem_put(key->mctx, dsa, sizeof(*dsa));
816 return (DST_R_INVALIDPUBLICKEY);
817 }
818
819 subprime = r.base;
820 isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
821
822 prime = r.base;
823 isc_region_consume(&r, p_bytes);
824
825 base = r.base;
826 isc_region_consume(&r, p_bytes);
827
828 pub_key = r.base;
829 isc_region_consume(&r, p_bytes);
830
831 key->key_size = p_bytes * 8;
832
833 isc_buffer_forward(data, 1 + ISC_SHA1_DIGESTLENGTH + 3 * p_bytes);
834
835 dsa->repr = (CK_ATTRIBUTE *) isc_mem_get(key->mctx, sizeof(*attr) * 4);
836 if (dsa->repr == NULL)
837 goto nomemory;
838 memset(dsa->repr, 0, sizeof(*attr) * 4);
839 dsa->attrcnt = 4;
840
841 attr = dsa->repr;
842 attr[0].type = CKA_PRIME;
843 attr[0].pValue = isc_mem_get(key->mctx, p_bytes);
844 if (attr[0].pValue == NULL)
845 goto nomemory;
846 memmove(attr[0].pValue, prime, p_bytes);
847 attr[0].ulValueLen = p_bytes;
848
849 attr[1].type = CKA_SUBPRIME;
850 attr[1].pValue = isc_mem_get(key->mctx, ISC_SHA1_DIGESTLENGTH);
851 if (attr[1].pValue == NULL)
852 goto nomemory;
853 memmove(attr[1].pValue, subprime, ISC_SHA1_DIGESTLENGTH);
854 attr[1].ulValueLen = ISC_SHA1_DIGESTLENGTH;
855
856 attr[2].type = CKA_BASE;
857 attr[2].pValue = isc_mem_get(key->mctx, p_bytes);
858 if (attr[2].pValue == NULL)
859 goto nomemory;
860 memmove(attr[2].pValue, base, p_bytes);
861 attr[2].ulValueLen = p_bytes;
862
863 attr[3].type = CKA_VALUE;
864 attr[3].pValue = isc_mem_get(key->mctx, p_bytes);
865 if (attr[3].pValue == NULL)
866 goto nomemory;
867 memmove(attr[3].pValue, pub_key, p_bytes);
868 attr[3].ulValueLen = p_bytes;
869
870 key->keydata.pkey = dsa;
871
872 return (ISC_R_SUCCESS);
873
874 nomemory:
875 for (attr = pk11_attribute_first(dsa);
876 attr != NULL;
877 attr = pk11_attribute_next(dsa, attr))
878 switch (attr->type) {
879 case CKA_PRIME:
880 case CKA_SUBPRIME:
881 case CKA_BASE:
882 case CKA_VALUE:
883 if (attr->pValue != NULL) {
884 isc_safe_memwipe(attr->pValue,
885 attr->ulValueLen);
886 isc_mem_put(key->mctx,
887 attr->pValue,
888 attr->ulValueLen);
889 }
890 break;
891 }
892 if (dsa->repr != NULL) {
893 isc_safe_memwipe(dsa->repr, dsa->attrcnt * sizeof(*attr));
894 isc_mem_put(key->mctx,
895 dsa->repr,
896 dsa->attrcnt * sizeof(*attr));
897 }
898 isc_safe_memwipe(dsa, sizeof(*dsa));
899 isc_mem_put(key->mctx, dsa, sizeof(*dsa));
900 return (ISC_R_NOMEMORY);
901 }
902
903 static isc_result_t
pkcs11dsa_tofile(const dst_key_t * key,const char * directory)904 pkcs11dsa_tofile(const dst_key_t *key, const char *directory) {
905 int cnt = 0;
906 pk11_object_t *dsa;
907 CK_ATTRIBUTE *attr;
908 CK_ATTRIBUTE *prime = NULL, *subprime = NULL, *base = NULL;
909 CK_ATTRIBUTE *pub_key = NULL, *priv_key = NULL;
910 dst_private_t priv;
911 unsigned char bufs[5][128];
912
913 if (key->keydata.pkey == NULL)
914 return (DST_R_NULLKEY);
915
916 if (key->external) {
917 priv.nelements = 0;
918 return (dst__privstruct_writefile(key, &priv, directory));
919 }
920
921 dsa = key->keydata.pkey;
922
923 for (attr = pk11_attribute_first(dsa);
924 attr != NULL;
925 attr = pk11_attribute_next(dsa, attr))
926 switch (attr->type) {
927 case CKA_PRIME:
928 prime = attr;
929 break;
930 case CKA_SUBPRIME:
931 subprime = attr;
932 break;
933 case CKA_BASE:
934 base = attr;
935 break;
936 case CKA_VALUE:
937 pub_key = attr;
938 break;
939 case CKA_VALUE2:
940 priv_key = attr;
941 break;
942 }
943 if ((prime == NULL) || (subprime == NULL) || (base == NULL) ||
944 (pub_key == NULL) || (priv_key ==NULL))
945 return (DST_R_NULLKEY);
946
947 priv.elements[cnt].tag = TAG_DSA_PRIME;
948 priv.elements[cnt].length = (unsigned short) prime->ulValueLen;
949 memmove(bufs[cnt], prime->pValue, prime->ulValueLen);
950 priv.elements[cnt].data = bufs[cnt];
951 cnt++;
952
953 priv.elements[cnt].tag = TAG_DSA_SUBPRIME;
954 priv.elements[cnt].length = (unsigned short) subprime->ulValueLen;
955 memmove(bufs[cnt], subprime->pValue, subprime->ulValueLen);
956 priv.elements[cnt].data = bufs[cnt];
957 cnt++;
958
959 priv.elements[cnt].tag = TAG_DSA_BASE;
960 priv.elements[cnt].length = (unsigned short) base->ulValueLen;
961 memmove(bufs[cnt], base->pValue, base->ulValueLen);
962 priv.elements[cnt].data = bufs[cnt];
963 cnt++;
964
965 priv.elements[cnt].tag = TAG_DSA_PRIVATE;
966 priv.elements[cnt].length = (unsigned short) priv_key->ulValueLen;
967 memmove(bufs[cnt], priv_key->pValue, priv_key->ulValueLen);
968 priv.elements[cnt].data = bufs[cnt];
969 cnt++;
970
971 priv.elements[cnt].tag = TAG_DSA_PUBLIC;
972 priv.elements[cnt].length = (unsigned short) pub_key->ulValueLen;
973 memmove(bufs[cnt], pub_key->pValue, pub_key->ulValueLen);
974 priv.elements[cnt].data = bufs[cnt];
975 cnt++;
976
977 priv.nelements = cnt;
978 return (dst__privstruct_writefile(key, &priv, directory));
979 }
980
981 static isc_result_t
pkcs11dsa_parse(dst_key_t * key,isc_lex_t * lexer,dst_key_t * pub)982 pkcs11dsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
983 dst_private_t priv;
984 isc_result_t ret;
985 int i;
986 unsigned int bits;
987 pk11_object_t *dsa = NULL;
988 CK_ATTRIBUTE *attr;
989 isc_mem_t *mctx = key->mctx;
990
991 /* read private key file */
992 ret = dst__privstruct_parse(key, DST_ALG_DSA, lexer, mctx, &priv);
993 if (ret != ISC_R_SUCCESS)
994 return (ret);
995
996 if (key->external) {
997 if (priv.nelements != 0)
998 DST_RET(DST_R_INVALIDPRIVATEKEY);
999 if (pub == NULL)
1000 DST_RET(DST_R_INVALIDPRIVATEKEY);
1001
1002 key->keydata.pkey = pub->keydata.pkey;
1003 pub->keydata.pkey = NULL;
1004 key->key_size = pub->key_size;
1005
1006 dst__privstruct_free(&priv, mctx);
1007 isc_safe_memwipe(&priv, sizeof(priv));
1008
1009 return (ISC_R_SUCCESS);
1010 }
1011
1012 dsa = (pk11_object_t *) isc_mem_get(key->mctx, sizeof(*dsa));
1013 if (dsa == NULL)
1014 DST_RET(ISC_R_NOMEMORY);
1015 memset(dsa, 0, sizeof(*dsa));
1016 key->keydata.pkey = dsa;
1017
1018 dsa->repr = (CK_ATTRIBUTE *) isc_mem_get(key->mctx, sizeof(*attr) * 5);
1019 if (dsa->repr == NULL)
1020 DST_RET(ISC_R_NOMEMORY);
1021 memset(dsa->repr, 0, sizeof(*attr) * 5);
1022 dsa->attrcnt = 5;
1023 attr = dsa->repr;
1024 attr[0].type = CKA_PRIME;
1025 attr[1].type = CKA_SUBPRIME;
1026 attr[2].type = CKA_BASE;
1027 attr[3].type = CKA_VALUE;
1028 attr[4].type = CKA_VALUE2;
1029
1030 for (i = 0; i < priv.nelements; i++) {
1031 CK_BYTE *bn;
1032
1033 bn = isc_mem_get(key->mctx, priv.elements[i].length);
1034 if (bn == NULL)
1035 DST_RET(ISC_R_NOMEMORY);
1036 memmove(bn, priv.elements[i].data, priv.elements[i].length);
1037
1038 switch (priv.elements[i].tag) {
1039 case TAG_DSA_PRIME:
1040 attr = pk11_attribute_bytype(dsa, CKA_PRIME);
1041 INSIST(attr != NULL);
1042 attr->pValue = bn;
1043 attr->ulValueLen = priv.elements[i].length;
1044 break;
1045 case TAG_DSA_SUBPRIME:
1046 attr = pk11_attribute_bytype(dsa,
1047 CKA_SUBPRIME);
1048 INSIST(attr != NULL);
1049 attr->pValue = bn;
1050 attr->ulValueLen = priv.elements[i].length;
1051 break;
1052 case TAG_DSA_BASE:
1053 attr = pk11_attribute_bytype(dsa, CKA_BASE);
1054 INSIST(attr != NULL);
1055 attr->pValue = bn;
1056 attr->ulValueLen = priv.elements[i].length;
1057 break;
1058 case TAG_DSA_PRIVATE:
1059 attr = pk11_attribute_bytype(dsa, CKA_VALUE2);
1060 INSIST(attr != NULL);
1061 attr->pValue = bn;
1062 attr->ulValueLen = priv.elements[i].length;
1063 break;
1064 case TAG_DSA_PUBLIC:
1065 attr = pk11_attribute_bytype(dsa, CKA_VALUE);
1066 INSIST(attr != NULL);
1067 attr->pValue = bn;
1068 attr->ulValueLen = priv.elements[i].length;
1069 break;
1070 }
1071 }
1072 dst__privstruct_free(&priv, mctx);
1073
1074 attr = pk11_attribute_bytype(dsa, CKA_PRIME);
1075 INSIST(attr != NULL);
1076
1077 ret = pk11_numbits(attr->pValue, attr->ulValueLen, &bits);
1078 if (ret != ISC_R_SUCCESS) {
1079 goto err;
1080 }
1081 key->key_size = bits;
1082
1083 return (ISC_R_SUCCESS);
1084
1085 err:
1086 pkcs11dsa_destroy(key);
1087 dst__privstruct_free(&priv, mctx);
1088 isc_safe_memwipe(&priv, sizeof(priv));
1089 return (ret);
1090 }
1091
1092 static dst_func_t pkcs11dsa_functions = {
1093 pkcs11dsa_createctx,
1094 NULL, /*%< createctx2 */
1095 pkcs11dsa_destroyctx,
1096 pkcs11dsa_adddata,
1097 pkcs11dsa_sign,
1098 pkcs11dsa_verify,
1099 NULL, /*%< verify2 */
1100 NULL, /*%< computesecret */
1101 pkcs11dsa_compare,
1102 NULL, /*%< paramcompare */
1103 pkcs11dsa_generate,
1104 pkcs11dsa_isprivate,
1105 pkcs11dsa_destroy,
1106 pkcs11dsa_todns,
1107 pkcs11dsa_fromdns,
1108 pkcs11dsa_tofile,
1109 pkcs11dsa_parse,
1110 NULL, /*%< cleanup */
1111 NULL, /*%< fromlabel */
1112 NULL, /*%< dump */
1113 NULL, /*%< restore */
1114 };
1115
1116 isc_result_t
dst__pkcs11dsa_init(dst_func_t ** funcp)1117 dst__pkcs11dsa_init(dst_func_t **funcp) {
1118 REQUIRE(funcp != NULL);
1119 if (*funcp == NULL)
1120 *funcp = &pkcs11dsa_functions;
1121 return (ISC_R_SUCCESS);
1122 }
1123 #endif /* !PK11_DSA_DISABLE */
1124
1125 #else /* PKCS11CRYPTO */
1126
1127 #include <isc/util.h>
1128
1129 EMPTY_TRANSLATION_UNIT
1130
1131 #endif /* PKCS11CRYPTO */
1132 /*! \file */
1133