18 #include <openssl/ssl.h>
19 #include <openssl/engine.h>
20 #include <openssl/rand.h>
54 key_list->
_keys = NULL;
100 k->
_key.
key = ENGINE_load_private_key(e, key_id, UI_OpenSSL(), NULL);
123 static int gost_id = 0;
124 const EVP_PKEY_ASN1_METHOD* meth;
127 if(gost_id)
return gost_id;
130 meth = EVP_PKEY_asn1_find_str(NULL,
"gost2001", -1);
132 EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
137 e = ENGINE_by_id(
"gost");
140 ENGINE_load_builtin_engines();
141 ENGINE_load_dynamic();
142 e = ENGINE_by_id(
"gost");
148 if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
154 meth = EVP_PKEY_asn1_find_str(&e,
"gost2001", -1);
165 EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
180 ldns_key_new_frm_fp_gost_l(FILE* fp,
int* line_nr)
183 const unsigned char* pp;
193 sizeof(token), line_nr) == -1)
195 while(strlen(token) < 96) {
198 sizeof(token)-strlen(token), line_nr) == -1)
204 pkey = d2i_PrivateKey(gost_id, NULL, &pp, (
int)
ldns_rdf_size(b64rdf));
213 ldns_EC_KEY_calc_public(EC_KEY* ec)
216 const EC_GROUP* group;
217 group = EC_KEY_get0_group(ec);
218 pub_key = EC_POINT_new(group);
219 if(!pub_key)
return 0;
220 if(!EC_POINT_copy(pub_key, EC_GROUP_get0_generator(group))) {
221 EC_POINT_free(pub_key);
224 if(!EC_POINT_mul(group, pub_key, EC_KEY_get0_private_key(ec),
226 EC_POINT_free(pub_key);
229 if(EC_KEY_set_public_key(ec, pub_key) == 0) {
230 EC_POINT_free(pub_key);
233 EC_POINT_free(pub_key);
239 ldns_key_new_frm_fp_ecdsa_l(FILE* fp,
ldns_algorithm alg,
int* line_nr)
248 sizeof(token), line_nr) == -1)
255 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
257 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
269 EC_KEY_set_private_key(ec, bn);
271 if(!ldns_EC_KEY_calc_public(ec)) {
276 evp_key = EVP_PKEY_new();
281 if (!EVP_PKEY_assign_EC_KEY(evp_key, ec)) {
282 EVP_PKEY_free(evp_key);
329 if (strncmp(d,
"v1.", 3) != 0) {
345 if (strncmp(d,
"1 RSA", 2) == 0) {
348 if (strncmp(d,
"2 DH", 2) == 0) {
351 if (strncmp(d,
"3 DSA", 2) == 0) {
354 if (strncmp(d,
"4 ECC", 2) == 0) {
357 if (strncmp(d,
"5 RSASHA1", 2) == 0) {
360 if (strncmp(d,
"6 DSA", 2) == 0) {
363 if (strncmp(d,
"7 RSASHA1", 2) == 0) {
367 if (strncmp(d,
"8 RSASHA256", 2) == 0) {
372 fprintf(stderr,
"Warning: SHA256 not compiled into this ");
373 fprintf(stderr,
"version of ldns\n");
377 if (strncmp(d,
"10 RSASHA512", 3) == 0) {
382 fprintf(stderr,
"Warning: SHA512 not compiled into this ");
383 fprintf(stderr,
"version of ldns\n");
387 if (strncmp(d,
"12 ECC-GOST", 3) == 0) {
392 fprintf(stderr,
"Warning: ECC-GOST not compiled into this ");
393 fprintf(stderr,
"version of ldns, use --enable-gost\n");
397 if (strncmp(d,
"13 ECDSAP256SHA256", 3) == 0) {
402 fprintf(stderr,
"Warning: ECDSA not compiled into this ");
403 fprintf(stderr,
"version of ldns, use --enable-ecdsa\n");
407 if (strncmp(d,
"14 ECDSAP384SHA384", 3) == 0) {
412 fprintf(stderr,
"Warning: ECDSA not compiled into this ");
413 fprintf(stderr,
"version of ldns, use --enable-ecdsa\n");
417 if (strncmp(d,
"157 HMAC-MD5", 4) == 0) {
420 if (strncmp(d,
"158 HMAC-SHA1", 4) == 0) {
423 if (strncmp(d,
"159 HMAC-SHA256", 4) == 0) {
475 #if defined(HAVE_SSL) && defined(USE_GOST)
481 ldns_key_new_frm_fp_gost_l(fp, line_nr));
563 if (!d || !rsa || !buf) {
575 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
577 rsa->n = BN_bin2bn((
const char unsigned*)buf, i, NULL);
586 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
587 rsa->e = BN_bin2bn((
const char unsigned*)buf, i, NULL);
596 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
597 rsa->d = BN_bin2bn((
const char unsigned*)buf, i, NULL);
606 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
607 rsa->p = BN_bin2bn((
const char unsigned*)buf, i, NULL);
616 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
617 rsa->q = BN_bin2bn((
const char unsigned*)buf, i, NULL);
626 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
627 rsa->dmp1 = BN_bin2bn((
const char unsigned*)buf, i, NULL);
636 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
637 rsa->dmq1 = BN_bin2bn((
const char unsigned*)buf, i, NULL);
646 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
647 rsa->iqmp = BN_bin2bn((
const char unsigned*)buf, i, NULL);
681 if (!d || !dsa || !buf) {
691 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
693 dsa->p = BN_bin2bn((
const char unsigned*)buf, i, NULL);
702 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
703 dsa->q = BN_bin2bn((
const char unsigned*)buf, i, NULL);
712 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
713 dsa->g = BN_bin2bn((
const char unsigned*)buf, i, NULL);
722 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
723 dsa->priv_key = BN_bin2bn((
const char unsigned*)buf, i, NULL);
724 if (!dsa->priv_key) {
732 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
733 dsa->pub_key = BN_bin2bn((
const char unsigned*)buf, i, NULL);
765 unsigned char *buf = NULL;
770 bufsz = ldns_b64_ntop_calculate_size(strlen(d));
786 ldns_gen_gost_key(
void)
793 ctx = EVP_PKEY_CTX_new_id(gost_id, NULL);
798 if(EVP_PKEY_CTX_ctrl_str(ctx,
"paramset",
"A") <= 0) {
800 EVP_PKEY_CTX_free(ctx);
804 if(EVP_PKEY_keygen_init(ctx) <= 0) {
805 EVP_PKEY_CTX_free(ctx);
808 if(EVP_PKEY_keygen(ctx, &p) <= 0) {
810 EVP_PKEY_CTX_free(ctx);
813 EVP_PKEY_CTX_free(ctx);
845 r = RSA_generate_key((
int)size, RSA_F4, NULL, NULL);
850 if (RSA_check_key(r) != 1) {
861 d = DSA_generate_parameters((
int)size, NULL, 0, NULL, NULL, NULL, NULL);
866 if (DSA_generate_key(d) != 1) {
891 if (RAND_bytes(hmac, (
int) size) != 1) {
897 while (offset +
sizeof(i) < size) {
899 memcpy(&hmac[offset], &i,
sizeof(i));
904 memcpy(&hmac[offset], &i, size - offset);
912 #if defined(HAVE_SSL) && defined(USE_GOST)
929 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
931 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
936 if(!EC_KEY_generate_key(ec)) {
948 if (!EVP_PKEY_assign_EC_KEY(k->
_key.
key, ec)) {
969 fprintf(output,
"%s", str);
971 fprintf(output,
"Unable to convert private key to string\n");
1000 EVP_PKEY *key = EVP_PKEY_new();
1001 EVP_PKEY_set1_RSA(key, r);
1008 EVP_PKEY *key = EVP_PKEY_new();
1009 EVP_PKEY_set1_DSA(key, d);
1016 EVP_PKEY *key = EVP_PKEY_new();
1017 EVP_PKEY_assign_RSA(key, r);
1024 EVP_PKEY *key = EVP_PKEY_new();
1025 EVP_PKEY_assign_DSA(key, d);
1090 return key->
_keys[nr];
1131 return EVP_PKEY_get1_RSA(k->
_key.
key);
1141 return EVP_PKEY_get1_DSA(k->
_key.
key);
1244 key_list->
_keys = keys;
1245 key_list->
_keys[key_count] = key;
1263 if (key_count == 0) {
1272 key_list->
_keys = a;
1284 ldns_key_rsa2bin(
unsigned char *data, RSA *k, uint16_t *size)
1292 if (BN_num_bytes(k->e) <= 256) {
1296 data[0] = (
unsigned char) BN_num_bytes(k->e);
1297 i = BN_bn2bin(k->e, data + 1);
1298 j = BN_bn2bin(k->n, data + i + 1);
1299 *size = (uint16_t) i + j;
1300 }
else if (BN_num_bytes(k->e) <= 65536) {
1303 ldns_write_uint16(data + 1, (uint16_t) BN_num_bytes(k->e));
1305 BN_bn2bin(k->e, data + 3);
1306 BN_bn2bin(k->n, data + 4 + BN_num_bytes(k->e));
1307 *size = (uint16_t) BN_num_bytes(k->n) + 6;
1316 ldns_key_dsa2bin(
unsigned char *data, DSA *k, uint16_t *size)
1325 *size = (uint16_t)BN_num_bytes(k->p);
1326 T = (*size - 64) / 8;
1330 fprintf(stderr,
"DSA key with T > 8 (ie. > 1024 bits)");
1331 fprintf(stderr,
" not implemented\n");
1337 memset(data, 0, 21 + *size * 3);
1338 data[0] = (
unsigned char)T;
1339 BN_bn2bin(k->q, data + 1 );
1340 BN_bn2bin(k->p, data + 21 );
1341 BN_bn2bin(k->g, data + 21 + *size * 2 - BN_num_bytes(k->g));
1342 BN_bn2bin(k->pub_key,data + 21 + *size * 3 - BN_num_bytes(k->pub_key));
1343 *size = 21 + *size * 3;
1349 ldns_key_gost2bin(
unsigned char* data, EVP_PKEY* k, uint16_t* size)
1352 unsigned char* pp = NULL;
1353 if(i2d_PUBKEY(k, &pp) != 37 + 64) {
1379 unsigned char *bin = NULL;
1388 int internal_data = 0;
1434 if (!ldns_key_rsa2bin(bin, rsa, &size)) {
1456 if (!ldns_key_dsa2bin(bin, dsa, &size)) {
1477 if (!ldns_key_dsa2bin(bin, dsa, &size)) {
1490 #if defined(HAVE_SSL) && defined(USE_GOST)
1497 if (!ldns_key_gost2bin(bin, k->
_key.
key, &size)) {
1516 ec = EVP_PKEY_get1_EC_KEY(k->
_key.
key);
1518 EC_KEY_set_conv_form(ec, POINT_CONVERSION_UNCOMPRESSED);
1519 size = (uint16_t)i2o_ECPublicKey(ec, NULL);
1520 if(!i2o_ECPublicKey(ec, &bin)) {
1530 assert(bin[0] == POINT_CONVERSION_UNCOMPRESSED);
1532 memmove(bin, bin+1, size);
1560 if (internal_data) {
1577 unsigned char* hmac;
1618 fp = fopen(filename,
"r");
1621 fprintf(stderr,
"Unable to open %s: %s\n", filename, strerror(errno));
1637 fprintf(stderr,
"nothing read from %s", filename);
1660 char *file_base_name;
1671 return file_base_name;
1708 if(strcasecmp(lt->
name, name) == 0)
1714 if(strcasecmp(lt->
name, name) == 0)
void ldns_key_set_external_key(ldns_key *k, void *external_key)
Set the key id data.
implementation of buffers to ease operations
DSA * ldns_key_new_frm_fp_dsa_l(FILE *f, int *line_nr __attribute__((unused)))
void ldns_key_set_origttl(ldns_key *k, uint32_t t)
Set the key's original ttl.
DSA * ldns_key_new_frm_fp_dsa(FILE *f)
frm_fp helper function.
ldns_key * ldns_key_list_key(const ldns_key_list *key, size_t nr)
returns a pointer to the key in the list at the given position
void ldns_key_assign_dsa_key(ldns_key *k, DSA *d)
Assign the key's dsa data The dsa data will be freed automatically when the key is freed...
void * ldns_buffer_export(ldns_buffer *buffer)
Makes the buffer fixed and returns a pointer to the data.
ldns_rdf * ldns_key_pubkey_owner(const ldns_key *k)
return the public key's owner
void ldns_rdf_deep_free(ldns_rdf *rd)
frees a rdf structure and frees the data.
ldns_signing_algorithm ldns_get_signing_algorithm_by_name(const char *name)
Get signing algorithm by name.
void ldns_rr_set_type(ldns_rr *rr, ldns_rr_type rr_type)
sets the type in the rr.
ldns_key * ldns_key_list_pop_key(ldns_key_list *key_list)
pops the last rr from a keylist
ldns_rdf * ldns_native2rdf_int16(ldns_rdf_type type, uint16_t value)
returns the rdf containing the native uint16_t representation.
void ldns_key_set_algorithm(ldns_key *k, ldns_signing_algorithm l)
Set the key's algorithm.
void ldns_key_set_use(ldns_key *k, bool v)
int ldns_buffer_printf(ldns_buffer *buffer, const char *format,...)
prints to the buffer, increasing the capacity if required using buffer_reserve(). ...
void ldns_key_set_flags(ldns_key *k, uint16_t f)
Set the key's flags.
uint32_t ldns_key_origttl(const ldns_key *k)
return the original ttl of the key
#define LDNS_XMALLOC(type, count)
DSA * ldns_key_dsa_key(const ldns_key *k)
returns the (openssl) DSA struct contained in the key
ssize_t ldns_fget_keyword_data_l(FILE *f, const char *keyword, const char *k_del, char *data, const char *d_del, size_t data_limit, int *line_nr)
size_t ldns_rdf_size(const ldns_rdf *rd)
returns the size of the rdf.
void * external_key
the key structure can also just point to some external key data
void ldns_buffer_free(ldns_buffer *buffer)
frees the buffer.
struct ldns_struct_key::@0 _key
Storage pointers for the types of keys supported.
ldns_rdf * ldns_rdf_clone(const ldns_rdf *rd)
clones a rdf structure.
void ldns_key_free(ldns_key *key)
frees a key structure, but not its internal data structures
void ldns_key_set_rsa_key(ldns_key *k, RSA *r)
Set the key's rsa data.
#define LDNS_MAX_PACKETLEN
void ldns_rr_free(ldns_rr *rr)
frees an RR structure
unsigned char * ldns_key_new_frm_fp_hmac(FILE *f, size_t *hmac_size)
frm_fp helper function.
void ldns_key_set_pubkey_owner(ldns_key *k, ldns_rdf *r)
Set the key's pubkey owner.
#define LDNS_XREALLOC(ptr, type, count)
void ldns_key_list_set_use(ldns_key_list *keys, bool v)
size_t ldns_key_hmac_size(const ldns_key *k)
return the hmac key size
unsigned char * ldns_key_new_frm_fp_hmac_l(FILE *f, int *line_nr __attribute__((unused)), size_t *hmac_size)
ldns_status ldns_key_new_frm_engine(ldns_key **key, ENGINE *e, char *key_id, ldns_algorithm alg)
Read the key with the given id from the given engine and store it in the given ldns_key structure...
ldns_status ldns_rr_new_frm_str(ldns_rr **newrr, const char *str, uint32_t default_ttl, ldns_rdf *origin, ldns_rdf **prev)
creates an rr from a string.
Including this file will include all ldns files, and define some lookup tables.
ldns_rdf * ldns_native2rdf_int8(ldns_rdf_type type, uint8_t value)
returns the rdf containing the native uint8_t repr.
void ldns_key_set_hmac_size(ldns_key *k, size_t hmac_size)
Set the key's hmac size.
signed char _use
Whether to use this key when signing.
General key structure, can contain all types of keys that are used in DNSSEC.
uint8_t * ldns_rdf_data(const ldns_rdf *rd)
returns the data of the rdf.
int ldns_key_EVP_load_gost_id(void)
Get the PKEY id for GOST, loads GOST into openssl as a side effect.
int ldns_key_algo_supported(int algo)
See if a key algorithm is supported.
ENGINE * ldns_gost_engine
store GOST engine reference loaded into OpenSSL library
ldns_rr * ldns_read_anchor_file(const char *filename)
Instantiates a DNSKEY or DS RR from file.
enum ldns_enum_signing_algorithm ldns_signing_algorithm
void ldns_key_set_expiration(ldns_key *k, uint32_t e)
Set the key's expiration date (seconds after epoch)
struct ldns_struct_key::@1::@3 dnssec
Some values that influence generated signatures.
ldns_rdf * _pubkey_owner
Owner name of the key.
#define LDNS_KEY_ZONE_KEY
union ldns_struct_key::@1 _extra
Depending on the key we can have extra data.
bool ldns_key_use(const ldns_key *k)
return the use flag
Same as rr_list, but now for keys.
ldns_status ldns_key_new_frm_fp_l(ldns_key **key, FILE *fp, int *line_nr)
Creates a new private key based on the contents of the file pointed by fp.
uint16_t ldns_calc_keytag(const ldns_rr *key)
calculates a keytag of a key for use in DNSSEC.
RSA * ldns_key_new_frm_fp_rsa_l(FILE *f, int *line_nr)
frm_fp helper function.
ldns_status ldns_rdf2buffer_str_dname(ldns_buffer *output, const ldns_rdf *dname)
Print the ldns_rdf containing a dname to the buffer.
void ldns_key_list_free(ldns_key_list *key_list)
Frees a key list structure.
RSA * ldns_key_rsa_key(const ldns_key *k)
returns the (openssl) RSA struct contained in the key
void ldns_key_set_evp_key(ldns_key *k, EVP_PKEY *e)
Set the key's evp key.
bool ldns_key_list_push_key(ldns_key_list *key_list, ldns_key *key)
pushes a key to a keylist
ssize_t ldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *line_nr)
returns a token/char from the stream F.
RSA * ldns_key_new_frm_fp_rsa(FILE *f)
frm_fp helper function.
void * ldns_key_external_key(const ldns_key *k)
return the key id key data
void ldns_rr_set_owner(ldns_rr *rr, ldns_rdf *owner)
sets the owner in the rr structure.
uint32_t ldns_key_inception(const ldns_key *k)
return the key's inception date
void ldns_key_print(FILE *output, const ldns_key *k)
print a private key to the file ouput
ldns_rr_type ldns_rr_get_type(const ldns_rr *rr)
returns the type of the rr.
unsigned char * ldns_key_hmac_key(const ldns_key *k)
return the hmac key data
enum ldns_enum_status ldns_status
EVP_PKEY * ldns_key_evp_key(const ldns_key *k)
returns the (openssl) EVP struct contained in the key
ldns_rdf * ldns_rdf_new_frm_data(ldns_rdf_type type, size_t size, const void *data)
allocates a new rdf structure and fills it.
#define LDNS_MALLOC(type)
Memory management macros.
void ldns_key_set_inception(ldns_key *k, uint32_t i)
Set the key's inception date (seconds after epoch)
ldns_buffer * ldns_buffer_new(size_t capacity)
creates a new buffer with the specified capacity.
A general purpose lookup table.
ldns_signing_algorithm ldns_key_algorithm(const ldns_key *k)
return the signing alg of the key
uint32_t ldns_key_expiration(const ldns_key *k)
return the key's expiration date
ldns_signing_algorithm _alg
void ldns_key_set_keytag(ldns_key *k, uint16_t tag)
Set the key's key tag.
ldns_status ldns_key_new_frm_fp(ldns_key **k, FILE *fp)
Creates a new priv key based on the contents of the file pointed by fp.
bool ldns_rr_push_rdf(ldns_rr *rr, const ldns_rdf *f)
sets rd_field member, it will be placed in the next available spot.
ldns_status ldns_str2rdf_b64(ldns_rdf **rd, const char *str)
convert the string with the b64 data into wireformat
ldns_rr * ldns_key2rr(const ldns_key *k)
converts a ldns_key to a public key rr If the key data exists at an external point, the corresponding rdata field must still be added with ldns_rr_rdf_push() to the result rr of this function
Resource record data field.
size_t ldns_key_list_key_count(const ldns_key_list *key_list)
returns the number of keys in the key list
#define LDNS_DNSSEC_KEYPROTO
void ldns_key_EVP_unload_gost(void)
Release the engine reference held for the GOST engine.
ldns_rr * ldns_rr_new(void)
creates a new rr structure.
void ldns_key_assign_rsa_key(ldns_key *k, RSA *r)
Assign the key's rsa data The rsa data will be freed automatically when the key is freed...
void ldns_key_deep_free(ldns_key *key)
frees a key structure and all its internal data structures, except the data set by ldns_key_set_exter...
uint16_t ldns_key_keytag(const ldns_key *k)
return the keytag
struct ldns_struct_key::@0::@2 hmac
The key can be an HMAC key.
char * ldns_key_get_file_base_name(ldns_key *key)
Returns the 'default base name' for key files; IE.
const char * ldns_get_errorstr_by_id(ldns_status err)
look up a descriptive text by each error.
void ldns_key_set_dsa_key(ldns_key *k, DSA *d)
Set the key's dsa data The dsa data should be freed by the user.
uint16_t ldns_key_flags(const ldns_key *k)
return the flag of the key
char * ldns_key2str(const ldns_key *k)
Converts a private key to the test presentation fmt and returns that as a char *. ...
int ldns_b64_pton(char const *src, uint8_t *target, size_t targsize)
void ldns_key_list_set_key_count(ldns_key_list *key, size_t count)
Set the keylist's key count to count.
ldns_lookup_table ldns_signing_algorithms[]
ldns_key_list * ldns_key_list_new(void)
Creates a new empty key list.
ldns_key * ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size)
Creates a new key based on the algorithm.
ldns_key * ldns_key_new(void)
Creates a new empty key structure.
void ldns_key_set_hmac_key(ldns_key *k, unsigned char *hmac)
Set the key's hmac data.
enum ldns_enum_algorithm ldns_algorithm