1 /* 2 * keys.c handle private keys for use in DNSSEC 3 * 4 * This module should hide some of the openSSL complexities 5 * and give a general interface for private keys and hmac 6 * handling 7 * 8 * (c) NLnet Labs, 2004-2006 9 * 10 * See the file LICENSE for the license 11 */ 12 13 #include <ldns/config.h> 14 15 #include <ldns/ldns.h> 16 17 #ifdef HAVE_SSL 18 #include <openssl/ssl.h> 19 #include <openssl/engine.h> 20 #include <openssl/rand.h> 21 #endif /* HAVE_SSL */ 22 23 ldns_lookup_table ldns_signing_algorithms[] = { 24 { LDNS_SIGN_RSAMD5, "RSAMD5" }, 25 { LDNS_SIGN_RSASHA1, "RSASHA1" }, 26 { LDNS_SIGN_RSASHA1_NSEC3, "RSASHA1-NSEC3-SHA1" }, 27 #ifdef USE_SHA2 28 { LDNS_SIGN_RSASHA256, "RSASHA256" }, 29 { LDNS_SIGN_RSASHA512, "RSASHA512" }, 30 #endif 31 #ifdef USE_GOST 32 { LDNS_SIGN_ECC_GOST, "ECC-GOST" }, 33 #endif 34 #ifdef USE_ECDSA 35 { LDNS_SIGN_ECDSAP256SHA256, "ECDSAP256SHA256" }, 36 { LDNS_SIGN_ECDSAP384SHA384, "ECDSAP384SHA384" }, 37 #endif 38 { LDNS_SIGN_DSA, "DSA" }, 39 { LDNS_SIGN_DSA_NSEC3, "DSA-NSEC3-SHA1" }, 40 { LDNS_SIGN_HMACMD5, "hmac-md5.sig-alg.reg.int" }, 41 { LDNS_SIGN_HMACSHA1, "hmac-sha1" }, 42 { LDNS_SIGN_HMACSHA256, "hmac-sha256" }, 43 { 0, NULL } 44 }; 45 46 ldns_key_list * 47 ldns_key_list_new() 48 { 49 ldns_key_list *key_list = LDNS_MALLOC(ldns_key_list); 50 if (!key_list) { 51 return NULL; 52 } else { 53 key_list->_key_count = 0; 54 key_list->_keys = NULL; 55 return key_list; 56 } 57 } 58 59 ldns_key * 60 ldns_key_new() 61 { 62 ldns_key *newkey; 63 64 newkey = LDNS_MALLOC(ldns_key); 65 if (!newkey) { 66 return NULL; 67 } else { 68 /* some defaults - not sure wether to do this */ 69 ldns_key_set_use(newkey, true); 70 ldns_key_set_flags(newkey, LDNS_KEY_ZONE_KEY); 71 ldns_key_set_origttl(newkey, 0); 72 ldns_key_set_keytag(newkey, 0); 73 ldns_key_set_inception(newkey, 0); 74 ldns_key_set_expiration(newkey, 0); 75 ldns_key_set_pubkey_owner(newkey, NULL); 76 #ifdef HAVE_SSL 77 ldns_key_set_evp_key(newkey, NULL); 78 #endif /* HAVE_SSL */ 79 ldns_key_set_hmac_key(newkey, NULL); 80 ldns_key_set_external_key(newkey, NULL); 81 return newkey; 82 } 83 } 84 85 ldns_status 86 ldns_key_new_frm_fp(ldns_key **k, FILE *fp) 87 { 88 return ldns_key_new_frm_fp_l(k, fp, NULL); 89 } 90 91 #ifdef HAVE_SSL 92 ldns_status 93 ldns_key_new_frm_engine(ldns_key **key, ENGINE *e, char *key_id, ldns_algorithm alg) 94 { 95 ldns_key *k; 96 97 k = ldns_key_new(); 98 if(!k) return LDNS_STATUS_MEM_ERR; 99 #ifndef S_SPLINT_S 100 k->_key.key = ENGINE_load_private_key(e, key_id, UI_OpenSSL(), NULL); 101 if(!k->_key.key) { 102 ldns_key_free(k); 103 return LDNS_STATUS_ERR; 104 } 105 ldns_key_set_algorithm(k, (ldns_signing_algorithm) alg); 106 if (!k->_key.key) { 107 ldns_key_free(k); 108 return LDNS_STATUS_ENGINE_KEY_NOT_LOADED; 109 } 110 #endif /* splint */ 111 *key = k; 112 return LDNS_STATUS_OK; 113 } 114 #endif 115 116 #ifdef USE_GOST 117 /** store GOST engine reference loaded into OpenSSL library */ 118 ENGINE* ldns_gost_engine = NULL; 119 120 int 121 ldns_key_EVP_load_gost_id(void) 122 { 123 static int gost_id = 0; 124 const EVP_PKEY_ASN1_METHOD* meth; 125 ENGINE* e; 126 127 if(gost_id) return gost_id; 128 129 /* see if configuration loaded gost implementation from other engine*/ 130 meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1); 131 if(meth) { 132 EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth); 133 return gost_id; 134 } 135 136 /* see if engine can be loaded already */ 137 e = ENGINE_by_id("gost"); 138 if(!e) { 139 /* load it ourself, in case statically linked */ 140 ENGINE_load_builtin_engines(); 141 ENGINE_load_dynamic(); 142 e = ENGINE_by_id("gost"); 143 } 144 if(!e) { 145 /* no gost engine in openssl */ 146 return 0; 147 } 148 if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) { 149 ENGINE_finish(e); 150 ENGINE_free(e); 151 return 0; 152 } 153 154 meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1); 155 if(!meth) { 156 /* algo not found */ 157 ENGINE_finish(e); 158 ENGINE_free(e); 159 return 0; 160 } 161 /* Note: do not ENGINE_finish and ENGINE_free the acquired engine 162 * on some platforms this frees up the meth and unloads gost stuff */ 163 ldns_gost_engine = e; 164 165 EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth); 166 return gost_id; 167 } 168 169 void ldns_key_EVP_unload_gost(void) 170 { 171 if(ldns_gost_engine) { 172 ENGINE_finish(ldns_gost_engine); 173 ENGINE_free(ldns_gost_engine); 174 ldns_gost_engine = NULL; 175 } 176 } 177 178 /** read GOST private key */ 179 static EVP_PKEY* 180 ldns_key_new_frm_fp_gost_l(FILE* fp, int* line_nr) 181 { 182 char token[16384]; 183 const unsigned char* pp; 184 int gost_id; 185 EVP_PKEY* pkey; 186 ldns_rdf* b64rdf = NULL; 187 188 gost_id = ldns_key_EVP_load_gost_id(); 189 if(!gost_id) 190 return NULL; 191 192 if (ldns_fget_keyword_data_l(fp, "GostAsn1", ": ", token, "\n", 193 sizeof(token), line_nr) == -1) 194 return NULL; 195 while(strlen(token) < 96) { 196 /* read more b64 from the file, b64 split on multiple lines */ 197 if(ldns_fget_token_l(fp, token+strlen(token), "\n", 198 sizeof(token)-strlen(token), line_nr) == -1) 199 return NULL; 200 } 201 if(ldns_str2rdf_b64(&b64rdf, token) != LDNS_STATUS_OK) 202 return NULL; 203 pp = (unsigned char*)ldns_rdf_data(b64rdf); 204 pkey = d2i_PrivateKey(gost_id, NULL, &pp, (int)ldns_rdf_size(b64rdf)); 205 ldns_rdf_deep_free(b64rdf); 206 return pkey; 207 } 208 #endif 209 210 #ifdef USE_ECDSA 211 /** calculate public key from private key */ 212 static int 213 ldns_EC_KEY_calc_public(EC_KEY* ec) 214 { 215 EC_POINT* pub_key; 216 const EC_GROUP* group; 217 group = EC_KEY_get0_group(ec); 218 pub_key = EC_POINT_new(group); 219 if(!pub_key) return 0; 220 if(!EC_POINT_copy(pub_key, EC_GROUP_get0_generator(group))) { 221 EC_POINT_free(pub_key); 222 return 0; 223 } 224 if(!EC_POINT_mul(group, pub_key, EC_KEY_get0_private_key(ec), 225 NULL, NULL, NULL)) { 226 EC_POINT_free(pub_key); 227 return 0; 228 } 229 if(EC_KEY_set_public_key(ec, pub_key) == 0) { 230 EC_POINT_free(pub_key); 231 return 0; 232 } 233 EC_POINT_free(pub_key); 234 return 1; 235 } 236 237 /** read ECDSA private key */ 238 static EVP_PKEY* 239 ldns_key_new_frm_fp_ecdsa_l(FILE* fp, ldns_algorithm alg, int* line_nr) 240 { 241 char token[16384]; 242 ldns_rdf* b64rdf = NULL; 243 unsigned char* pp; 244 BIGNUM* bn; 245 EVP_PKEY* evp_key; 246 EC_KEY* ec; 247 if (ldns_fget_keyword_data_l(fp, "PrivateKey", ": ", token, "\n", 248 sizeof(token), line_nr) == -1) 249 return NULL; 250 if(ldns_str2rdf_b64(&b64rdf, token) != LDNS_STATUS_OK) 251 return NULL; 252 pp = (unsigned char*)ldns_rdf_data(b64rdf); 253 254 if(alg == LDNS_ECDSAP256SHA256) 255 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); 256 else if(alg == LDNS_ECDSAP384SHA384) 257 ec = EC_KEY_new_by_curve_name(NID_secp384r1); 258 else ec = NULL; 259 if(!ec) { 260 ldns_rdf_deep_free(b64rdf); 261 return NULL; 262 } 263 bn = BN_bin2bn(pp, (int)ldns_rdf_size(b64rdf), NULL); 264 ldns_rdf_deep_free(b64rdf); 265 if(!bn) { 266 EC_KEY_free(ec); 267 return NULL; 268 } 269 EC_KEY_set_private_key(ec, bn); 270 BN_free(bn); 271 if(!ldns_EC_KEY_calc_public(ec)) { 272 EC_KEY_free(ec); 273 return NULL; 274 } 275 276 evp_key = EVP_PKEY_new(); 277 if(!evp_key) { 278 EC_KEY_free(ec); 279 return NULL; 280 } 281 if (!EVP_PKEY_assign_EC_KEY(evp_key, ec)) { 282 EVP_PKEY_free(evp_key); 283 EC_KEY_free(ec); 284 return NULL; 285 } 286 return evp_key; 287 } 288 #endif 289 290 ldns_status 291 ldns_key_new_frm_fp_l(ldns_key **key, FILE *fp, int *line_nr) 292 { 293 ldns_key *k; 294 char *d; 295 ldns_signing_algorithm alg; 296 ldns_rr *key_rr; 297 #ifdef HAVE_SSL 298 RSA *rsa; 299 DSA *dsa; 300 unsigned char *hmac; 301 size_t hmac_size; 302 #endif /* HAVE_SSL */ 303 304 k = ldns_key_new(); 305 306 d = LDNS_XMALLOC(char, LDNS_MAX_LINELEN); 307 if (!k || !d) { 308 ldns_key_free(k); 309 LDNS_FREE(d); 310 return LDNS_STATUS_MEM_ERR; 311 } 312 313 alg = 0; 314 315 /* the file is highly structured. Do this in sequence */ 316 /* RSA: 317 * Private-key-format: v1.x. 318 * Algorithm: 1 (RSA) 319 320 */ 321 /* get the key format version number */ 322 if (ldns_fget_keyword_data_l(fp, "Private-key-format", ": ", d, "\n", 323 LDNS_MAX_LINELEN, line_nr) == -1) { 324 /* no version information */ 325 ldns_key_free(k); 326 LDNS_FREE(d); 327 return LDNS_STATUS_SYNTAX_ERR; 328 } 329 if (strncmp(d, "v1.", 3) != 0) { 330 ldns_key_free(k); 331 LDNS_FREE(d); 332 return LDNS_STATUS_SYNTAX_VERSION_ERR; 333 } 334 335 /* get the algorithm type, our file function strip ( ) so there are 336 * not in the return string! */ 337 if (ldns_fget_keyword_data_l(fp, "Algorithm", ": ", d, "\n", 338 LDNS_MAX_LINELEN, line_nr) == -1) { 339 /* no alg information */ 340 ldns_key_free(k); 341 LDNS_FREE(d); 342 return LDNS_STATUS_SYNTAX_ALG_ERR; 343 } 344 345 if (strncmp(d, "1 RSA", 2) == 0) { 346 alg = LDNS_SIGN_RSAMD5; 347 } 348 if (strncmp(d, "2 DH", 2) == 0) { 349 alg = (ldns_signing_algorithm)LDNS_DH; 350 } 351 if (strncmp(d, "3 DSA", 2) == 0) { 352 alg = LDNS_SIGN_DSA; 353 } 354 if (strncmp(d, "4 ECC", 2) == 0) { 355 alg = (ldns_signing_algorithm)LDNS_ECC; 356 } 357 if (strncmp(d, "5 RSASHA1", 2) == 0) { 358 alg = LDNS_SIGN_RSASHA1; 359 } 360 if (strncmp(d, "6 DSA", 2) == 0) { 361 alg = LDNS_SIGN_DSA_NSEC3; 362 } 363 if (strncmp(d, "7 RSASHA1", 2) == 0) { 364 alg = LDNS_SIGN_RSASHA1_NSEC3; 365 } 366 367 if (strncmp(d, "8 RSASHA256", 2) == 0) { 368 #ifdef USE_SHA2 369 alg = LDNS_SIGN_RSASHA256; 370 #else 371 fprintf(stderr, "Warning: SHA256 not compiled into this "); 372 fprintf(stderr, "version of ldns\n"); 373 #endif 374 } 375 if (strncmp(d, "10 RSASHA512", 3) == 0) { 376 #ifdef USE_SHA2 377 alg = LDNS_SIGN_RSASHA512; 378 #else 379 fprintf(stderr, "Warning: SHA512 not compiled into this "); 380 fprintf(stderr, "version of ldns\n"); 381 #endif 382 } 383 if (strncmp(d, "12 ECC-GOST", 3) == 0) { 384 #ifdef USE_GOST 385 alg = LDNS_SIGN_ECC_GOST; 386 #else 387 fprintf(stderr, "Warning: ECC-GOST not compiled into this "); 388 fprintf(stderr, "version of ldns, use --enable-gost\n"); 389 #endif 390 } 391 if (strncmp(d, "13 ECDSAP256SHA256", 3) == 0) { 392 #ifdef USE_ECDSA 393 alg = LDNS_SIGN_ECDSAP256SHA256; 394 #else 395 fprintf(stderr, "Warning: ECDSA not compiled into this "); 396 fprintf(stderr, "version of ldns, use --enable-ecdsa\n"); 397 #endif 398 } 399 if (strncmp(d, "14 ECDSAP384SHA384", 3) == 0) { 400 #ifdef USE_ECDSA 401 alg = LDNS_SIGN_ECDSAP384SHA384; 402 #else 403 fprintf(stderr, "Warning: ECDSA not compiled into this "); 404 fprintf(stderr, "version of ldns, use --enable-ecdsa\n"); 405 #endif 406 } 407 if (strncmp(d, "157 HMAC-MD5", 4) == 0) { 408 alg = LDNS_SIGN_HMACMD5; 409 } 410 if (strncmp(d, "158 HMAC-SHA1", 4) == 0) { 411 alg = LDNS_SIGN_HMACSHA1; 412 } 413 if (strncmp(d, "159 HMAC-SHA256", 4) == 0) { 414 alg = LDNS_SIGN_HMACSHA256; 415 } 416 417 LDNS_FREE(d); 418 419 switch(alg) { 420 case LDNS_SIGN_RSAMD5: 421 case LDNS_SIGN_RSASHA1: 422 case LDNS_SIGN_RSASHA1_NSEC3: 423 #ifdef USE_SHA2 424 case LDNS_SIGN_RSASHA256: 425 case LDNS_SIGN_RSASHA512: 426 #endif 427 ldns_key_set_algorithm(k, alg); 428 #ifdef HAVE_SSL 429 rsa = ldns_key_new_frm_fp_rsa_l(fp, line_nr); 430 if (!rsa) { 431 ldns_key_free(k); 432 return LDNS_STATUS_ERR; 433 } 434 ldns_key_assign_rsa_key(k, rsa); 435 #endif /* HAVE_SSL */ 436 break; 437 case LDNS_SIGN_DSA: 438 case LDNS_SIGN_DSA_NSEC3: 439 ldns_key_set_algorithm(k, alg); 440 #ifdef HAVE_SSL 441 dsa = ldns_key_new_frm_fp_dsa_l(fp, line_nr); 442 if (!dsa) { 443 ldns_key_free(k); 444 return LDNS_STATUS_ERR; 445 } 446 ldns_key_assign_dsa_key(k, dsa); 447 #endif /* HAVE_SSL */ 448 break; 449 case LDNS_SIGN_HMACMD5: 450 case LDNS_SIGN_HMACSHA1: 451 case LDNS_SIGN_HMACSHA256: 452 ldns_key_set_algorithm(k, alg); 453 #ifdef HAVE_SSL 454 hmac = ldns_key_new_frm_fp_hmac_l(fp, line_nr, &hmac_size); 455 if (!hmac) { 456 ldns_key_free(k); 457 return LDNS_STATUS_ERR; 458 } 459 ldns_key_set_hmac_size(k, hmac_size); 460 ldns_key_set_hmac_key(k, hmac); 461 #endif /* HAVE_SSL */ 462 break; 463 case LDNS_SIGN_ECC_GOST: 464 ldns_key_set_algorithm(k, alg); 465 #if defined(HAVE_SSL) && defined(USE_GOST) 466 if(!ldns_key_EVP_load_gost_id()) { 467 ldns_key_free(k); 468 return LDNS_STATUS_CRYPTO_ALGO_NOT_IMPL; 469 } 470 ldns_key_set_evp_key(k, 471 ldns_key_new_frm_fp_gost_l(fp, line_nr)); 472 #ifndef S_SPLINT_S 473 if(!k->_key.key) { 474 ldns_key_free(k); 475 return LDNS_STATUS_ERR; 476 } 477 #endif /* splint */ 478 #endif 479 break; 480 #ifdef USE_ECDSA 481 case LDNS_SIGN_ECDSAP256SHA256: 482 case LDNS_SIGN_ECDSAP384SHA384: 483 ldns_key_set_algorithm(k, alg); 484 ldns_key_set_evp_key(k, 485 ldns_key_new_frm_fp_ecdsa_l(fp, (ldns_algorithm)alg, line_nr)); 486 #ifndef S_SPLINT_S 487 if(!k->_key.key) { 488 ldns_key_free(k); 489 return LDNS_STATUS_ERR; 490 } 491 #endif /* splint */ 492 break; 493 #endif 494 default: 495 ldns_key_free(k); 496 return LDNS_STATUS_SYNTAX_ALG_ERR; 497 } 498 key_rr = ldns_key2rr(k); 499 ldns_key_set_keytag(k, ldns_calc_keytag(key_rr)); 500 ldns_rr_free(key_rr); 501 502 if (key) { 503 *key = k; 504 return LDNS_STATUS_OK; 505 } 506 ldns_key_free(k); 507 return LDNS_STATUS_ERR; 508 } 509 510 #ifdef HAVE_SSL 511 RSA * 512 ldns_key_new_frm_fp_rsa(FILE *f) 513 { 514 return ldns_key_new_frm_fp_rsa_l(f, NULL); 515 } 516 517 RSA * 518 ldns_key_new_frm_fp_rsa_l(FILE *f, int *line_nr) 519 { 520 /* we parse 521 * Modulus: 522 * PublicExponent: 523 * PrivateExponent: 524 * Prime1: 525 * Prime2: 526 * Exponent1: 527 * Exponent2: 528 * Coefficient: 529 * 530 * man 3 RSA: 531 * 532 * struct 533 * { 534 * BIGNUM *n; // public modulus 535 * BIGNUM *e; // public exponent 536 * BIGNUM *d; // private exponent 537 * BIGNUM *p; // secret prime factor 538 * BIGNUM *q; // secret prime factor 539 * BIGNUM *dmp1; // d mod (p-1) 540 * BIGNUM *dmq1; // d mod (q-1) 541 * BIGNUM *iqmp; // q^-1 mod p 542 * // ... 543 * 544 */ 545 char *d; 546 RSA *rsa; 547 uint8_t *buf; 548 int i; 549 550 d = LDNS_XMALLOC(char, LDNS_MAX_LINELEN); 551 buf = LDNS_XMALLOC(uint8_t, LDNS_MAX_LINELEN); 552 rsa = RSA_new(); 553 if (!d || !rsa || !buf) { 554 goto error; 555 } 556 557 /* I could use functions again, but that seems an overkill, 558 * allthough this also looks tedious 559 */ 560 561 /* Modules, rsa->n */ 562 if (ldns_fget_keyword_data_l(f, "Modulus", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 563 goto error; 564 } 565 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d))); 566 #ifndef S_SPLINT_S 567 rsa->n = BN_bin2bn((const char unsigned*)buf, i, NULL); 568 if (!rsa->n) { 569 goto error; 570 } 571 572 /* PublicExponent, rsa->e */ 573 if (ldns_fget_keyword_data_l(f, "PublicExponent", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 574 goto error; 575 } 576 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d))); 577 rsa->e = BN_bin2bn((const char unsigned*)buf, i, NULL); 578 if (!rsa->e) { 579 goto error; 580 } 581 582 /* PrivateExponent, rsa->d */ 583 if (ldns_fget_keyword_data_l(f, "PrivateExponent", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 584 goto error; 585 } 586 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d))); 587 rsa->d = BN_bin2bn((const char unsigned*)buf, i, NULL); 588 if (!rsa->d) { 589 goto error; 590 } 591 592 /* Prime1, rsa->p */ 593 if (ldns_fget_keyword_data_l(f, "Prime1", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 594 goto error; 595 } 596 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d))); 597 rsa->p = BN_bin2bn((const char unsigned*)buf, i, NULL); 598 if (!rsa->p) { 599 goto error; 600 } 601 602 /* Prime2, rsa->q */ 603 if (ldns_fget_keyword_data_l(f, "Prime2", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 604 goto error; 605 } 606 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d))); 607 rsa->q = BN_bin2bn((const char unsigned*)buf, i, NULL); 608 if (!rsa->q) { 609 goto error; 610 } 611 612 /* Exponent1, rsa->dmp1 */ 613 if (ldns_fget_keyword_data_l(f, "Exponent1", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 614 goto error; 615 } 616 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d))); 617 rsa->dmp1 = BN_bin2bn((const char unsigned*)buf, i, NULL); 618 if (!rsa->dmp1) { 619 goto error; 620 } 621 622 /* Exponent2, rsa->dmq1 */ 623 if (ldns_fget_keyword_data_l(f, "Exponent2", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 624 goto error; 625 } 626 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d))); 627 rsa->dmq1 = BN_bin2bn((const char unsigned*)buf, i, NULL); 628 if (!rsa->dmq1) { 629 goto error; 630 } 631 632 /* Coefficient, rsa->iqmp */ 633 if (ldns_fget_keyword_data_l(f, "Coefficient", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 634 goto error; 635 } 636 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d))); 637 rsa->iqmp = BN_bin2bn((const char unsigned*)buf, i, NULL); 638 if (!rsa->iqmp) { 639 goto error; 640 } 641 #endif /* splint */ 642 643 LDNS_FREE(buf); 644 LDNS_FREE(d); 645 return rsa; 646 647 error: 648 RSA_free(rsa); 649 LDNS_FREE(d); 650 LDNS_FREE(buf); 651 return NULL; 652 } 653 654 DSA * 655 ldns_key_new_frm_fp_dsa(FILE *f) 656 { 657 return ldns_key_new_frm_fp_dsa_l(f, NULL); 658 } 659 660 DSA * 661 ldns_key_new_frm_fp_dsa_l(FILE *f, ATTR_UNUSED(int *line_nr)) 662 { 663 int i; 664 char *d; 665 DSA *dsa; 666 uint8_t *buf; 667 668 d = LDNS_XMALLOC(char, LDNS_MAX_LINELEN); 669 buf = LDNS_XMALLOC(uint8_t, LDNS_MAX_LINELEN); 670 dsa = DSA_new(); 671 if (!d || !dsa || !buf) { 672 goto error; 673 } 674 675 /* the line parser removes the () from the input... */ 676 677 /* Prime, dsa->p */ 678 if (ldns_fget_keyword_data_l(f, "Primep", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 679 goto error; 680 } 681 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d))); 682 #ifndef S_SPLINT_S 683 dsa->p = BN_bin2bn((const char unsigned*)buf, i, NULL); 684 if (!dsa->p) { 685 goto error; 686 } 687 688 /* Subprime, dsa->q */ 689 if (ldns_fget_keyword_data_l(f, "Subprimeq", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 690 goto error; 691 } 692 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d))); 693 dsa->q = BN_bin2bn((const char unsigned*)buf, i, NULL); 694 if (!dsa->q) { 695 goto error; 696 } 697 698 /* Base, dsa->g */ 699 if (ldns_fget_keyword_data_l(f, "Baseg", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 700 goto error; 701 } 702 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d))); 703 dsa->g = BN_bin2bn((const char unsigned*)buf, i, NULL); 704 if (!dsa->g) { 705 goto error; 706 } 707 708 /* Private key, dsa->priv_key */ 709 if (ldns_fget_keyword_data_l(f, "Private_valuex", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 710 goto error; 711 } 712 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d))); 713 dsa->priv_key = BN_bin2bn((const char unsigned*)buf, i, NULL); 714 if (!dsa->priv_key) { 715 goto error; 716 } 717 718 /* Public key, dsa->priv_key */ 719 if (ldns_fget_keyword_data_l(f, "Public_valuey", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 720 goto error; 721 } 722 i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d))); 723 dsa->pub_key = BN_bin2bn((const char unsigned*)buf, i, NULL); 724 if (!dsa->pub_key) { 725 goto error; 726 } 727 #endif /* splint */ 728 729 LDNS_FREE(buf); 730 LDNS_FREE(d); 731 732 return dsa; 733 734 error: 735 LDNS_FREE(d); 736 LDNS_FREE(buf); 737 DSA_free(dsa); 738 return NULL; 739 } 740 741 unsigned char * 742 ldns_key_new_frm_fp_hmac(FILE *f, size_t *hmac_size) 743 { 744 return ldns_key_new_frm_fp_hmac_l(f, NULL, hmac_size); 745 } 746 747 unsigned char * 748 ldns_key_new_frm_fp_hmac_l( FILE *f 749 , ATTR_UNUSED(int *line_nr) 750 , size_t *hmac_size 751 ) 752 { 753 size_t i, bufsz; 754 char d[LDNS_MAX_LINELEN]; 755 unsigned char *buf = NULL; 756 757 if (ldns_fget_keyword_data_l(f, "Key", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) { 758 goto error; 759 } 760 bufsz = ldns_b64_ntop_calculate_size(strlen(d)); 761 buf = LDNS_XMALLOC(unsigned char, bufsz); 762 i = (size_t) ldns_b64_pton((const char*)d, buf, bufsz); 763 764 *hmac_size = i; 765 return buf; 766 767 error: 768 LDNS_FREE(buf); 769 *hmac_size = 0; 770 return NULL; 771 } 772 #endif /* HAVE_SSL */ 773 774 #ifdef USE_GOST 775 static EVP_PKEY* 776 ldns_gen_gost_key(void) 777 { 778 EVP_PKEY_CTX* ctx; 779 EVP_PKEY* p = NULL; 780 int gost_id = ldns_key_EVP_load_gost_id(); 781 if(!gost_id) 782 return NULL; 783 ctx = EVP_PKEY_CTX_new_id(gost_id, NULL); 784 if(!ctx) { 785 /* the id should be available now */ 786 return NULL; 787 } 788 if(EVP_PKEY_CTX_ctrl_str(ctx, "paramset", "A") <= 0) { 789 /* cannot set paramset */ 790 EVP_PKEY_CTX_free(ctx); 791 return NULL; 792 } 793 794 if(EVP_PKEY_keygen_init(ctx) <= 0) { 795 EVP_PKEY_CTX_free(ctx); 796 return NULL; 797 } 798 if(EVP_PKEY_keygen(ctx, &p) <= 0) { 799 EVP_PKEY_free(p); 800 EVP_PKEY_CTX_free(ctx); 801 return NULL; 802 } 803 EVP_PKEY_CTX_free(ctx); 804 return p; 805 } 806 #endif 807 808 ldns_key * 809 ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size) 810 { 811 ldns_key *k; 812 #ifdef HAVE_SSL 813 DSA *d; 814 RSA *r; 815 # ifdef USE_ECDSA 816 EC_KEY *ec = NULL; 817 # endif 818 #else 819 int i; 820 uint16_t offset = 0; 821 #endif 822 unsigned char *hmac; 823 824 k = ldns_key_new(); 825 if (!k) { 826 return NULL; 827 } 828 switch(alg) { 829 case LDNS_SIGN_RSAMD5: 830 case LDNS_SIGN_RSASHA1: 831 case LDNS_SIGN_RSASHA1_NSEC3: 832 case LDNS_SIGN_RSASHA256: 833 case LDNS_SIGN_RSASHA512: 834 #ifdef HAVE_SSL 835 r = RSA_generate_key((int)size, RSA_F4, NULL, NULL); 836 if(!r) { 837 ldns_key_free(k); 838 return NULL; 839 } 840 if (RSA_check_key(r) != 1) { 841 ldns_key_free(k); 842 return NULL; 843 } 844 ldns_key_set_rsa_key(k, r); 845 RSA_free(r); 846 #endif /* HAVE_SSL */ 847 break; 848 case LDNS_SIGN_DSA: 849 case LDNS_SIGN_DSA_NSEC3: 850 #ifdef HAVE_SSL 851 d = DSA_generate_parameters((int)size, NULL, 0, NULL, NULL, NULL, NULL); 852 if (!d) { 853 ldns_key_free(k); 854 return NULL; 855 } 856 if (DSA_generate_key(d) != 1) { 857 ldns_key_free(k); 858 return NULL; 859 } 860 ldns_key_set_dsa_key(k, d); 861 DSA_free(d); 862 #endif /* HAVE_SSL */ 863 break; 864 case LDNS_SIGN_HMACMD5: 865 case LDNS_SIGN_HMACSHA1: 866 case LDNS_SIGN_HMACSHA256: 867 #ifdef HAVE_SSL 868 #ifndef S_SPLINT_S 869 k->_key.key = NULL; 870 #endif /* splint */ 871 #endif /* HAVE_SSL */ 872 size = size / 8; 873 ldns_key_set_hmac_size(k, size); 874 875 hmac = LDNS_XMALLOC(unsigned char, size); 876 if(!hmac) { 877 ldns_key_free(k); 878 return NULL; 879 } 880 #ifdef HAVE_SSL 881 if (RAND_bytes(hmac, (int) size) != 1) { 882 LDNS_FREE(hmac); 883 ldns_key_free(k); 884 return NULL; 885 } 886 #else 887 while (offset + sizeof(i) < size) { 888 i = random(); 889 memcpy(&hmac[offset], &i, sizeof(i)); 890 offset += sizeof(i); 891 } 892 if (offset < size) { 893 i = random(); 894 memcpy(&hmac[offset], &i, size - offset); 895 } 896 #endif /* HAVE_SSL */ 897 ldns_key_set_hmac_key(k, hmac); 898 899 ldns_key_set_flags(k, 0); 900 break; 901 case LDNS_SIGN_ECC_GOST: 902 #if defined(HAVE_SSL) && defined(USE_GOST) 903 ldns_key_set_evp_key(k, ldns_gen_gost_key()); 904 #ifndef S_SPLINT_S 905 if(!k->_key.key) { 906 ldns_key_free(k); 907 return NULL; 908 } 909 #endif /* splint */ 910 #else 911 ldns_key_free(k); 912 return NULL; 913 #endif /* HAVE_SSL and USE_GOST */ 914 break; 915 case LDNS_SIGN_ECDSAP256SHA256: 916 case LDNS_SIGN_ECDSAP384SHA384: 917 #ifdef USE_ECDSA 918 if(alg == LDNS_SIGN_ECDSAP256SHA256) 919 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); 920 else if(alg == LDNS_SIGN_ECDSAP384SHA384) 921 ec = EC_KEY_new_by_curve_name(NID_secp384r1); 922 if(!ec) { 923 ldns_key_free(k); 924 return NULL; 925 } 926 if(!EC_KEY_generate_key(ec)) { 927 ldns_key_free(k); 928 EC_KEY_free(ec); 929 return NULL; 930 } 931 #ifndef S_SPLINT_S 932 k->_key.key = EVP_PKEY_new(); 933 if(!k->_key.key) { 934 ldns_key_free(k); 935 EC_KEY_free(ec); 936 return NULL; 937 } 938 if (!EVP_PKEY_assign_EC_KEY(k->_key.key, ec)) { 939 ldns_key_free(k); 940 EC_KEY_free(ec); 941 return NULL; 942 } 943 #endif /* splint */ 944 #else 945 ldns_key_free(k); 946 return NULL; 947 #endif /* ECDSA */ 948 break; 949 } 950 ldns_key_set_algorithm(k, alg); 951 return k; 952 } 953 954 void 955 ldns_key_print(FILE *output, const ldns_key *k) 956 { 957 char *str = ldns_key2str(k); 958 if (str) { 959 fprintf(output, "%s", str); 960 } else { 961 fprintf(output, "Unable to convert private key to string\n"); 962 } 963 LDNS_FREE(str); 964 } 965 966 967 void 968 ldns_key_set_algorithm(ldns_key *k, ldns_signing_algorithm l) 969 { 970 k->_alg = l; 971 } 972 973 void 974 ldns_key_set_flags(ldns_key *k, uint16_t f) 975 { 976 k->_extra.dnssec.flags = f; 977 } 978 979 #ifdef HAVE_SSL 980 #ifndef S_SPLINT_S 981 void 982 ldns_key_set_evp_key(ldns_key *k, EVP_PKEY *e) 983 { 984 k->_key.key = e; 985 } 986 987 void 988 ldns_key_set_rsa_key(ldns_key *k, RSA *r) 989 { 990 EVP_PKEY *key = EVP_PKEY_new(); 991 EVP_PKEY_set1_RSA(key, r); 992 k->_key.key = key; 993 } 994 995 void 996 ldns_key_set_dsa_key(ldns_key *k, DSA *d) 997 { 998 EVP_PKEY *key = EVP_PKEY_new(); 999 EVP_PKEY_set1_DSA(key, d); 1000 k->_key.key = key; 1001 } 1002 1003 void 1004 ldns_key_assign_rsa_key(ldns_key *k, RSA *r) 1005 { 1006 EVP_PKEY *key = EVP_PKEY_new(); 1007 EVP_PKEY_assign_RSA(key, r); 1008 k->_key.key = key; 1009 } 1010 1011 void 1012 ldns_key_assign_dsa_key(ldns_key *k, DSA *d) 1013 { 1014 EVP_PKEY *key = EVP_PKEY_new(); 1015 EVP_PKEY_assign_DSA(key, d); 1016 k->_key.key = key; 1017 } 1018 #endif /* splint */ 1019 #endif /* HAVE_SSL */ 1020 1021 void 1022 ldns_key_set_hmac_key(ldns_key *k, unsigned char *hmac) 1023 { 1024 k->_key.hmac.key = hmac; 1025 } 1026 1027 void 1028 ldns_key_set_hmac_size(ldns_key *k, size_t hmac_size) 1029 { 1030 k->_key.hmac.size = hmac_size; 1031 } 1032 1033 void 1034 ldns_key_set_external_key(ldns_key *k, void *external_key) 1035 { 1036 k->_key.external_key = external_key; 1037 } 1038 1039 void 1040 ldns_key_set_origttl(ldns_key *k, uint32_t t) 1041 { 1042 k->_extra.dnssec.orig_ttl = t; 1043 } 1044 1045 void 1046 ldns_key_set_inception(ldns_key *k, uint32_t i) 1047 { 1048 k->_extra.dnssec.inception = i; 1049 } 1050 1051 void 1052 ldns_key_set_expiration(ldns_key *k, uint32_t e) 1053 { 1054 k->_extra.dnssec.expiration = e; 1055 } 1056 1057 void 1058 ldns_key_set_pubkey_owner(ldns_key *k, ldns_rdf *r) 1059 { 1060 k->_pubkey_owner = r; 1061 } 1062 1063 void 1064 ldns_key_set_keytag(ldns_key *k, uint16_t tag) 1065 { 1066 k->_extra.dnssec.keytag = tag; 1067 } 1068 1069 /* read */ 1070 size_t 1071 ldns_key_list_key_count(const ldns_key_list *key_list) 1072 { 1073 return key_list->_key_count; 1074 } 1075 1076 ldns_key * 1077 ldns_key_list_key(const ldns_key_list *key, size_t nr) 1078 { 1079 if (nr < ldns_key_list_key_count(key)) { 1080 return key->_keys[nr]; 1081 } else { 1082 return NULL; 1083 } 1084 } 1085 1086 ldns_signing_algorithm 1087 ldns_key_algorithm(const ldns_key *k) 1088 { 1089 return k->_alg; 1090 } 1091 1092 void 1093 ldns_key_set_use(ldns_key *k, bool v) 1094 { 1095 if (k) { 1096 k->_use = v; 1097 } 1098 } 1099 1100 bool 1101 ldns_key_use(const ldns_key *k) 1102 { 1103 if (k) { 1104 return k->_use; 1105 } 1106 return false; 1107 } 1108 1109 #ifdef HAVE_SSL 1110 #ifndef S_SPLINT_S 1111 EVP_PKEY * 1112 ldns_key_evp_key(const ldns_key *k) 1113 { 1114 return k->_key.key; 1115 } 1116 1117 RSA * 1118 ldns_key_rsa_key(const ldns_key *k) 1119 { 1120 if (k->_key.key) { 1121 return EVP_PKEY_get1_RSA(k->_key.key); 1122 } else { 1123 return NULL; 1124 } 1125 } 1126 1127 DSA * 1128 ldns_key_dsa_key(const ldns_key *k) 1129 { 1130 if (k->_key.key) { 1131 return EVP_PKEY_get1_DSA(k->_key.key); 1132 } else { 1133 return NULL; 1134 } 1135 } 1136 #endif /* splint */ 1137 #endif /* HAVE_SSL */ 1138 1139 unsigned char * 1140 ldns_key_hmac_key(const ldns_key *k) 1141 { 1142 if (k->_key.hmac.key) { 1143 return k->_key.hmac.key; 1144 } else { 1145 return NULL; 1146 } 1147 } 1148 1149 size_t 1150 ldns_key_hmac_size(const ldns_key *k) 1151 { 1152 if (k->_key.hmac.size) { 1153 return k->_key.hmac.size; 1154 } else { 1155 return 0; 1156 } 1157 } 1158 1159 void * 1160 ldns_key_external_key(const ldns_key *k) 1161 { 1162 return k->_key.external_key; 1163 } 1164 1165 uint32_t 1166 ldns_key_origttl(const ldns_key *k) 1167 { 1168 return k->_extra.dnssec.orig_ttl; 1169 } 1170 1171 uint16_t 1172 ldns_key_flags(const ldns_key *k) 1173 { 1174 return k->_extra.dnssec.flags; 1175 } 1176 1177 uint32_t 1178 ldns_key_inception(const ldns_key *k) 1179 { 1180 return k->_extra.dnssec.inception; 1181 } 1182 1183 uint32_t 1184 ldns_key_expiration(const ldns_key *k) 1185 { 1186 return k->_extra.dnssec.expiration; 1187 } 1188 1189 uint16_t 1190 ldns_key_keytag(const ldns_key *k) 1191 { 1192 return k->_extra.dnssec.keytag; 1193 } 1194 1195 ldns_rdf * 1196 ldns_key_pubkey_owner(const ldns_key *k) 1197 { 1198 return k->_pubkey_owner; 1199 } 1200 1201 /* write */ 1202 void 1203 ldns_key_list_set_use(ldns_key_list *keys, bool v) 1204 { 1205 size_t i; 1206 1207 for (i = 0; i < ldns_key_list_key_count(keys); i++) { 1208 ldns_key_set_use(ldns_key_list_key(keys, i), v); 1209 } 1210 } 1211 1212 void 1213 ldns_key_list_set_key_count(ldns_key_list *key, size_t count) 1214 { 1215 key->_key_count = count; 1216 } 1217 1218 bool 1219 ldns_key_list_push_key(ldns_key_list *key_list, ldns_key *key) 1220 { 1221 size_t key_count; 1222 ldns_key **keys; 1223 1224 key_count = ldns_key_list_key_count(key_list); 1225 1226 /* grow the array */ 1227 keys = LDNS_XREALLOC( 1228 key_list->_keys, ldns_key *, key_count + 1); 1229 if (!keys) { 1230 return false; 1231 } 1232 1233 /* add the new member */ 1234 key_list->_keys = keys; 1235 key_list->_keys[key_count] = key; 1236 1237 ldns_key_list_set_key_count(key_list, key_count + 1); 1238 return true; 1239 } 1240 1241 ldns_key * 1242 ldns_key_list_pop_key(ldns_key_list *key_list) 1243 { 1244 size_t key_count; 1245 ldns_key** a; 1246 ldns_key *pop; 1247 1248 if (!key_list) { 1249 return NULL; 1250 } 1251 1252 key_count = ldns_key_list_key_count(key_list); 1253 if (key_count == 0) { 1254 return NULL; 1255 } 1256 1257 pop = ldns_key_list_key(key_list, key_count); 1258 1259 /* shrink the array */ 1260 a = LDNS_XREALLOC(key_list->_keys, ldns_key *, key_count - 1); 1261 if(a) { 1262 key_list->_keys = a; 1263 } 1264 1265 ldns_key_list_set_key_count(key_list, key_count - 1); 1266 1267 return pop; 1268 } 1269 1270 #ifdef HAVE_SSL 1271 #ifndef S_SPLINT_S 1272 /* data pointer must be large enough (LDNS_MAX_KEYLEN) */ 1273 static bool 1274 ldns_key_rsa2bin(unsigned char *data, RSA *k, uint16_t *size) 1275 { 1276 int i,j; 1277 1278 if (!k) { 1279 return false; 1280 } 1281 1282 if (BN_num_bytes(k->e) <= 256) { 1283 /* normally only this path is executed (small factors are 1284 * more common 1285 */ 1286 data[0] = (unsigned char) BN_num_bytes(k->e); 1287 i = BN_bn2bin(k->e, data + 1); 1288 j = BN_bn2bin(k->n, data + i + 1); 1289 *size = (uint16_t) i + j; 1290 } else if (BN_num_bytes(k->e) <= 65536) { 1291 data[0] = 0; 1292 /* BN_bn2bin does bigendian, _uint16 also */ 1293 ldns_write_uint16(data + 1, (uint16_t) BN_num_bytes(k->e)); 1294 1295 BN_bn2bin(k->e, data + 3); 1296 BN_bn2bin(k->n, data + 4 + BN_num_bytes(k->e)); 1297 *size = (uint16_t) BN_num_bytes(k->n) + 6; 1298 } else { 1299 return false; 1300 } 1301 return true; 1302 } 1303 1304 /* data pointer must be large enough (LDNS_MAX_KEYLEN) */ 1305 static bool 1306 ldns_key_dsa2bin(unsigned char *data, DSA *k, uint16_t *size) 1307 { 1308 uint8_t T; 1309 1310 if (!k) { 1311 return false; 1312 } 1313 1314 /* See RFC2536 */ 1315 *size = (uint16_t)BN_num_bytes(k->p); 1316 T = (*size - 64) / 8; 1317 memcpy(data, &T, 1); 1318 1319 if (T > 8) { 1320 fprintf(stderr, "DSA key with T > 8 (ie. > 1024 bits)"); 1321 fprintf(stderr, " not implemented\n"); 1322 return false; 1323 } 1324 1325 /* size = 64 + (T * 8); */ 1326 data[0] = (unsigned char)T; 1327 BN_bn2bin(k->q, data + 1 ); /* 20 octects */ 1328 BN_bn2bin(k->p, data + 21 ); /* offset octects */ 1329 BN_bn2bin(k->g, data + 21 + *size); /* offset octets */ 1330 BN_bn2bin(k->pub_key, data + 21 + *size + *size); /* offset octets */ 1331 *size = 21 + (*size * 3); 1332 return true; 1333 } 1334 1335 #ifdef USE_GOST 1336 static bool 1337 ldns_key_gost2bin(unsigned char* data, EVP_PKEY* k, uint16_t* size) 1338 { 1339 int i; 1340 unsigned char* pp = NULL; 1341 if(i2d_PUBKEY(k, &pp) != 37 + 64) { 1342 /* expect 37 byte(ASN header) and 64 byte(X and Y) */ 1343 CRYPTO_free(pp); 1344 return false; 1345 } 1346 /* omit ASN header */ 1347 for(i=0; i<64; i++) 1348 data[i] = pp[i+37]; 1349 CRYPTO_free(pp); 1350 *size = 64; 1351 return true; 1352 } 1353 #endif /* USE_GOST */ 1354 #endif /* splint */ 1355 #endif /* HAVE_SSL */ 1356 1357 ldns_rr * 1358 ldns_key2rr(const ldns_key *k) 1359 { 1360 /* this function will convert a the keydata contained in 1361 * rsa/dsa pointers to a DNSKEY rr. It will fill in as 1362 * much as it can, but it does not know about key-flags 1363 * for instance 1364 */ 1365 ldns_rr *pubkey; 1366 ldns_rdf *keybin; 1367 unsigned char *bin = NULL; 1368 uint16_t size = 0; 1369 #ifdef HAVE_SSL 1370 RSA *rsa = NULL; 1371 DSA *dsa = NULL; 1372 #endif /* HAVE_SSL */ 1373 #ifdef USE_ECDSA 1374 EC_KEY* ec; 1375 #endif 1376 int internal_data = 0; 1377 1378 if (!k) { 1379 return NULL; 1380 } 1381 pubkey = ldns_rr_new(); 1382 1383 switch (ldns_key_algorithm(k)) { 1384 case LDNS_SIGN_HMACMD5: 1385 case LDNS_SIGN_HMACSHA1: 1386 case LDNS_SIGN_HMACSHA256: 1387 ldns_rr_set_type(pubkey, LDNS_RR_TYPE_KEY); 1388 break; 1389 default: 1390 ldns_rr_set_type(pubkey, LDNS_RR_TYPE_DNSKEY); 1391 break; 1392 } 1393 /* zero-th rdf - flags */ 1394 ldns_rr_push_rdf(pubkey, 1395 ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16, 1396 ldns_key_flags(k))); 1397 /* first - proto */ 1398 ldns_rr_push_rdf(pubkey, 1399 ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8, LDNS_DNSSEC_KEYPROTO)); 1400 1401 if (ldns_key_pubkey_owner(k)) { 1402 ldns_rr_set_owner(pubkey, ldns_rdf_clone(ldns_key_pubkey_owner(k))); 1403 } 1404 1405 /* third - da algorithm */ 1406 switch(ldns_key_algorithm(k)) { 1407 case LDNS_SIGN_RSAMD5: 1408 case LDNS_SIGN_RSASHA1: 1409 case LDNS_SIGN_RSASHA1_NSEC3: 1410 case LDNS_SIGN_RSASHA256: 1411 case LDNS_SIGN_RSASHA512: 1412 ldns_rr_push_rdf(pubkey, 1413 ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k))); 1414 #ifdef HAVE_SSL 1415 rsa = ldns_key_rsa_key(k); 1416 if (rsa) { 1417 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN); 1418 if (!bin) { 1419 ldns_rr_free(pubkey); 1420 return NULL; 1421 } 1422 if (!ldns_key_rsa2bin(bin, rsa, &size)) { 1423 LDNS_FREE(bin); 1424 ldns_rr_free(pubkey); 1425 return NULL; 1426 } 1427 RSA_free(rsa); 1428 internal_data = 1; 1429 } 1430 #endif 1431 size++; 1432 break; 1433 case LDNS_SIGN_DSA: 1434 ldns_rr_push_rdf(pubkey, 1435 ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, LDNS_DSA)); 1436 #ifdef HAVE_SSL 1437 dsa = ldns_key_dsa_key(k); 1438 if (dsa) { 1439 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN); 1440 if (!bin) { 1441 ldns_rr_free(pubkey); 1442 return NULL; 1443 } 1444 if (!ldns_key_dsa2bin(bin, dsa, &size)) { 1445 LDNS_FREE(bin); 1446 ldns_rr_free(pubkey); 1447 return NULL; 1448 } 1449 DSA_free(dsa); 1450 internal_data = 1; 1451 } 1452 #endif /* HAVE_SSL */ 1453 break; 1454 case LDNS_SIGN_DSA_NSEC3: 1455 ldns_rr_push_rdf(pubkey, 1456 ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, LDNS_DSA_NSEC3)); 1457 #ifdef HAVE_SSL 1458 dsa = ldns_key_dsa_key(k); 1459 if (dsa) { 1460 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN); 1461 if (!bin) { 1462 ldns_rr_free(pubkey); 1463 return NULL; 1464 } 1465 if (!ldns_key_dsa2bin(bin, dsa, &size)) { 1466 LDNS_FREE(bin); 1467 ldns_rr_free(pubkey); 1468 return NULL; 1469 } 1470 DSA_free(dsa); 1471 internal_data = 1; 1472 } 1473 #endif /* HAVE_SSL */ 1474 break; 1475 case LDNS_SIGN_ECC_GOST: 1476 ldns_rr_push_rdf(pubkey, ldns_native2rdf_int8( 1477 LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k))); 1478 #if defined(HAVE_SSL) && defined(USE_GOST) 1479 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN); 1480 if (!bin) { 1481 ldns_rr_free(pubkey); 1482 return NULL; 1483 } 1484 #ifndef S_SPLINT_S 1485 if (!ldns_key_gost2bin(bin, k->_key.key, &size)) { 1486 LDNS_FREE(bin); 1487 ldns_rr_free(pubkey); 1488 return NULL; 1489 } 1490 #endif /* splint */ 1491 internal_data = 1; 1492 #else 1493 ldns_rr_free(pubkey); 1494 return NULL; 1495 #endif /* HAVE_SSL and USE_GOST */ 1496 break; 1497 case LDNS_SIGN_ECDSAP256SHA256: 1498 case LDNS_SIGN_ECDSAP384SHA384: 1499 #ifdef USE_ECDSA 1500 ldns_rr_push_rdf(pubkey, ldns_native2rdf_int8( 1501 LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k))); 1502 bin = NULL; 1503 #ifndef S_SPLINT_S 1504 ec = EVP_PKEY_get1_EC_KEY(k->_key.key); 1505 #endif 1506 EC_KEY_set_conv_form(ec, POINT_CONVERSION_UNCOMPRESSED); 1507 size = (uint16_t)i2o_ECPublicKey(ec, NULL); 1508 if(!i2o_ECPublicKey(ec, &bin)) { 1509 EC_KEY_free(ec); 1510 ldns_rr_free(pubkey); 1511 return NULL; 1512 } 1513 if(size > 1) { 1514 /* move back one byte to shave off the 0x02 1515 * 'uncompressed' indicator that openssl made 1516 * Actually its 0x04 (from implementation). 1517 */ 1518 assert(bin[0] == POINT_CONVERSION_UNCOMPRESSED); 1519 size -= 1; 1520 memmove(bin, bin+1, size); 1521 } 1522 /* down the reference count for ec, its still assigned 1523 * to the pkey */ 1524 EC_KEY_free(ec); 1525 internal_data = 1; 1526 #else 1527 ldns_rr_free(pubkey); 1528 return NULL; 1529 #endif /* ECDSA */ 1530 break; 1531 case LDNS_SIGN_HMACMD5: 1532 case LDNS_SIGN_HMACSHA1: 1533 case LDNS_SIGN_HMACSHA256: 1534 bin = LDNS_XMALLOC(unsigned char, ldns_key_hmac_size(k)); 1535 if (!bin) { 1536 ldns_rr_free(pubkey); 1537 return NULL; 1538 } 1539 ldns_rr_push_rdf(pubkey, 1540 ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, 1541 ldns_key_algorithm(k))); 1542 size = ldns_key_hmac_size(k); 1543 memcpy(bin, ldns_key_hmac_key(k), size); 1544 internal_data = 1; 1545 break; 1546 } 1547 /* fourth the key bin material */ 1548 if (internal_data) { 1549 keybin = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, size, bin); 1550 LDNS_FREE(bin); 1551 ldns_rr_push_rdf(pubkey, keybin); 1552 } 1553 return pubkey; 1554 } 1555 1556 void 1557 ldns_key_free(ldns_key *key) 1558 { 1559 LDNS_FREE(key); 1560 } 1561 1562 void 1563 ldns_key_deep_free(ldns_key *key) 1564 { 1565 unsigned char* hmac; 1566 if (ldns_key_pubkey_owner(key)) { 1567 ldns_rdf_deep_free(ldns_key_pubkey_owner(key)); 1568 } 1569 #ifdef HAVE_SSL 1570 if (ldns_key_evp_key(key)) { 1571 EVP_PKEY_free(ldns_key_evp_key(key)); 1572 } 1573 #endif /* HAVE_SSL */ 1574 if (ldns_key_hmac_key(key)) { 1575 hmac = ldns_key_hmac_key(key); 1576 LDNS_FREE(hmac); 1577 } 1578 LDNS_FREE(key); 1579 } 1580 1581 void 1582 ldns_key_list_free(ldns_key_list *key_list) 1583 { 1584 size_t i; 1585 for (i = 0; i < ldns_key_list_key_count(key_list); i++) { 1586 ldns_key_deep_free(ldns_key_list_key(key_list, i)); 1587 } 1588 LDNS_FREE(key_list->_keys); 1589 LDNS_FREE(key_list); 1590 } 1591 1592 ldns_rr * 1593 ldns_read_anchor_file(const char *filename) 1594 { 1595 FILE *fp; 1596 /*char line[LDNS_MAX_PACKETLEN];*/ 1597 char *line = LDNS_XMALLOC(char, LDNS_MAX_PACKETLEN); 1598 int c; 1599 size_t i = 0; 1600 ldns_rr *r; 1601 ldns_status status; 1602 if(!line) { 1603 return NULL; 1604 } 1605 1606 fp = fopen(filename, "r"); 1607 if (!fp) { 1608 fprintf(stderr, "Unable to open %s: %s\n", filename, strerror(errno)); 1609 LDNS_FREE(line); 1610 return NULL; 1611 } 1612 1613 while ((c = fgetc(fp)) && i+1 < LDNS_MAX_PACKETLEN && c != EOF) { 1614 line[i] = c; 1615 i++; 1616 } 1617 line[i] = '\0'; 1618 1619 fclose(fp); 1620 1621 if (i <= 0) { 1622 fprintf(stderr, "nothing read from %s", filename); 1623 LDNS_FREE(line); 1624 return NULL; 1625 } else { 1626 status = ldns_rr_new_frm_str(&r, line, 0, NULL, NULL); 1627 if (status == LDNS_STATUS_OK && (ldns_rr_get_type(r) == LDNS_RR_TYPE_DNSKEY || ldns_rr_get_type(r) == LDNS_RR_TYPE_DS)) { 1628 LDNS_FREE(line); 1629 return r; 1630 } else { 1631 fprintf(stderr, "Error creating DNSKEY or DS rr from %s: %s\n", filename, ldns_get_errorstr_by_id(status)); 1632 LDNS_FREE(line); 1633 return NULL; 1634 } 1635 } 1636 } 1637 1638 char * 1639 ldns_key_get_file_base_name(ldns_key *key) 1640 { 1641 ldns_buffer *buffer; 1642 char *file_base_name; 1643 1644 buffer = ldns_buffer_new(255); 1645 ldns_buffer_printf(buffer, "K"); 1646 (void)ldns_rdf2buffer_str_dname(buffer, ldns_key_pubkey_owner(key)); 1647 ldns_buffer_printf(buffer, 1648 "+%03u+%05u", 1649 ldns_key_algorithm(key), 1650 ldns_key_keytag(key)); 1651 file_base_name = ldns_buffer_export(buffer); 1652 ldns_buffer_free(buffer); 1653 return file_base_name; 1654 } 1655 1656 int ldns_key_algo_supported(int algo) 1657 { 1658 ldns_lookup_table *lt = ldns_signing_algorithms; 1659 while(lt->name) { 1660 if(lt->id == algo) 1661 return 1; 1662 lt++; 1663 } 1664 return 0; 1665 } 1666 1667 ldns_signing_algorithm ldns_get_signing_algorithm_by_name(const char* name) 1668 { 1669 /* list of (signing algorithm id, alias_name) */ 1670 ldns_lookup_table aliases[] = { 1671 /* from bind dnssec-keygen */ 1672 {LDNS_SIGN_HMACMD5, "HMAC-MD5"}, 1673 {LDNS_SIGN_DSA_NSEC3, "NSEC3DSA"}, 1674 {LDNS_SIGN_RSASHA1_NSEC3, "NSEC3RSASHA1"}, 1675 /* old ldns usage, now RFC names */ 1676 {LDNS_SIGN_DSA_NSEC3, "DSA_NSEC3" }, 1677 {LDNS_SIGN_RSASHA1_NSEC3, "RSASHA1_NSEC3" }, 1678 #ifdef USE_GOST 1679 {LDNS_SIGN_ECC_GOST, "GOST"}, 1680 #endif 1681 /* compat with possible output */ 1682 {LDNS_DH, "DH"}, 1683 {LDNS_ECC, "ECC"}, 1684 {LDNS_INDIRECT, "INDIRECT"}, 1685 {LDNS_PRIVATEDNS, "PRIVATEDNS"}, 1686 {LDNS_PRIVATEOID, "PRIVATEOID"}, 1687 {0, NULL}}; 1688 ldns_lookup_table* lt = ldns_signing_algorithms; 1689 while(lt->name) { 1690 if(strcasecmp(lt->name, name) == 0) 1691 return lt->id; 1692 lt++; 1693 } 1694 lt = aliases; 1695 while(lt->name) { 1696 if(strcasecmp(lt->name, name) == 0) 1697 return lt->id; 1698 lt++; 1699 } 1700 if(atoi(name) != 0) 1701 return atoi(name); 1702 return 0; 1703 } 1704