Key generation, ldns_signzone and ldns_verifyzone work for GOST.

diff --git a/Changelog b/Changelog
index 53e1a8486d1e37eb74e059c6ba46f0d5c2835749..08f15b5eb3a58388d35a8615e63af32d3c5bd61e 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -1,4 +1,5 @@
 1.6.x
+       * --enable-gost : use the GOST algorithm.
 
 1.6.0
        Additions:

diff --git a/dnssec_verify.c b/dnssec_verify.c
index 640899f47e5f632a36fbf3695043a0ca78c0b9ff..13b3eca59f2e7f6581304ec57fd3c461a5777a39 100644 (file)
--- a/dnssec_verify.c
+++ b/dnssec_verify.c
@@ -1524,17 +1524,23 @@ ldns_verify_rrsig_gost_raw(unsigned char* sig, size_t siglen,
                0x02, 0x02, 0x1e, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40};
        unsigned char encoded[37+64];
        const unsigned char* pp;
-       int i;
-       if(keylen != 64)
+       if(keylen != 64) {
+               /* key wrong size */
                return LDNS_STATUS_CRYPTO_BOGUS;
+       }
 
        /* create evp_key */
-       for(i=0; i<37; i++)
-               encoded[i] = asn[i];
-       for(i=0; i<64; i++)
-               encoded[i+37] = key[i];
+       memmove(encoded, asn, 37);
+       memmove(encoded+37, key, 64);
        pp = (unsigned char*)&encoded[0];
+
+       (void) ldns_key_EVP_load_gost_id();
+
        evp_key = d2i_PUBKEY(NULL, &pp, sizeof(encoded));
+       if(!evp_key) {
+               /* could not convert key */
+               return LDNS_STATUS_CRYPTO_BOGUS;
+       }
 
        /* verify signature */
        result = ldns_verify_rrsig_evp_raw(sig, siglen, rrset, 

diff --git a/keys.c b/keys.c
index 19c8e62f2493865b257c55550b3298ee06a31034..6068a949b92759ecb82968af2c3935312a8b20ff 100644 (file)
--- a/keys.c
+++ b/keys.c
@@ -104,14 +104,15 @@ ldns_key_new_frm_engine(ldns_key **key, ENGINE *e, char *key_id, ldns_algorithm
 #endif
 
 #ifdef USE_GOST
-/** returns the PKEY id for GOST, loads GOST into openssl */
-static int
-ldns_get_EVP_gost_id()
+int
+ldns_key_EVP_load_gost_id()
 {
+       static int gost_id = 0;
        const EVP_PKEY_ASN1_METHOD* meth;
-       int gost_id;
        ENGINE* e;
 
+       if(gost_id) return gost_id;
+
        ENGINE_load_gost();
        e = ENGINE_by_id("gost");
        if(!e) {
@@ -145,7 +146,7 @@ ldns_key_new_frm_fp_gost_l(FILE* fp, int* line_nr)
        EVP_PKEY* pkey;
        ldns_rdf* b64rdf = NULL;
 
-       gost_id = ldns_get_EVP_gost_id();
+       gost_id = ldns_key_EVP_load_gost_id();
        if(!gost_id)
                return NULL;
 
@@ -672,7 +673,7 @@ ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size)
                        if(1) { /* new stack context */
                                EVP_PKEY_CTX* ctx;
                                EVP_PKEY* p = NULL;
-                               int gost_id = ldns_get_EVP_gost_id();
+                               int gost_id = ldns_key_EVP_load_gost_id();
                                if(!gost_id)
                                        return NULL;
                                ctx = EVP_PKEY_CTX_new_id(gost_id, NULL);

diff --git a/ldns/keys.h b/ldns/keys.h
index 977dcaae1f8e590eaa56faedd92afedd01e44616..6c0efc45d0c37620d673813117ba5e81c61f49c8 100644 (file)
--- a/ldns/keys.h
+++ b/ldns/keys.h
@@ -300,7 +300,15 @@ void ldns_key_set_rsa_key(ldns_key *k, RSA *r);
  * \param[in] d the dsa data
  */
 void ldns_key_set_dsa_key(ldns_key *k, DSA *d);
+
+/** 
+ * Get the PKEY id for GOST, loads GOST into openssl as a side effect.
+ * Only available if GOST is compiled into the library and openssl.
+ * \return the gost id for EVP_CTX creation.
+ */
+int ldns_key_EVP_load_gost_id(void);
 #endif /* HAVE_SSL */
+
 /**
  * Set the key's hmac data
  * \param[in] k the key