]> git.ipfire.org Git - thirdparty/knot-dns.git/commitdiff
libdnssec: export pem API
authorDaniel Salzman <daniel.salzman@nic.cz>
Thu, 24 Jan 2019 13:21:39 +0000 (14:21 +0100)
committerDaniel Salzman <daniel.salzman@nic.cz>
Thu, 24 Jan 2019 15:58:57 +0000 (16:58 +0100)
16 files changed:
Knot.files
distro/deb/libdnssec6.symbols
doc/doxygen/Doxy.page.h
src/libdnssec/Makefile.inc
src/libdnssec/dnssec.h
src/libdnssec/key/key.c
src/libdnssec/key/simple.c
src/libdnssec/keystore/pkcs11.c
src/libdnssec/keystore/pkcs8.c
src/libdnssec/pem.c [moved from src/libdnssec/shared/pem.c with 58% similarity]
src/libdnssec/pem.h [moved from src/libdnssec/shared/pem.h with 57% similarity]
src/utils/keymgr/bind_privkey.c
tests/libdnssec/test_shared_bignum.c
tests/libdnssec/test_shared_dname.c
tests/libdnssec/test_sign_der.c
tests/libdnssec/test_tsig.c

index 2b48ca9356b6593e9c503e4c05880d6f7b884d37..d835e739c1b86ea72dfb3161b21e9a6dc598e4b9 100644 (file)
@@ -276,6 +276,8 @@ src/libdnssec/nsec/hash.c
 src/libdnssec/nsec/nsec.c
 src/libdnssec/p11/p11.c
 src/libdnssec/p11/p11.h
+src/libdnssec/pem.c
+src/libdnssec/pem.h
 src/libdnssec/random.c
 src/libdnssec/random.h
 src/libdnssec/shared/bignum.c
@@ -285,8 +287,6 @@ src/libdnssec/shared/dname.c
 src/libdnssec/shared/dname.h
 src/libdnssec/shared/keyid_gnutls.c
 src/libdnssec/shared/keyid_gnutls.h
-src/libdnssec/shared/pem.c
-src/libdnssec/shared/pem.h
 src/libdnssec/shared/shared.h
 src/libdnssec/sign.h
 src/libdnssec/sign/der.c
index 07f6f4891e5801a52d9dd8b402af464a7858742a..68ee5a1285cd5b52e3f6da993f9ecbc80c0e5031 100644 (file)
@@ -63,6 +63,9 @@ libdnssec.so.6 libdnssec6 #MINVER#
  dnssec_nsec_bitmap_new@Base 2.3.0
  dnssec_nsec_bitmap_size@Base 2.3.0
  dnssec_nsec_bitmap_write@Base 2.3.0
+ dnssec_pem_from_x509@Base 2.8.0
+ dnssec_pem_to_privkey@Base 2.8.0
+ dnssec_pem_to_x509@Base 2.8.0
  dnssec_random_binary@Base 2.3.0
  dnssec_random_buffer@Base 2.3.0
  dnssec_sign_add@Base 2.3.0
index 744f76df304edb1130318bf5251924656fd9d5c7..a83d27d57e60ae6f899f78e658fdd6553da20d98 100644 (file)
@@ -54,6 +54,7 @@
  - \ref keystore — DNSSEC private key store
  - \ref keytag   — DNSSEC key tag computation
  - \ref nsec     — NSEC and NSEC3 operations
+ - \ref pem      — PEM key format operations
  - \ref random   — Pseudo-random number generation
  - \ref sign     — DNSSEC signing and verification
  - \ref tsig     — TSIG signing
@@ -66,6 +67,7 @@
 \defgroup keystore keystore
 \defgroup keytag   keytag
 \defgroup nsec     nsec
+\defgroup pem      pem
 \defgroup random   random
 \defgroup sign     sign
 \defgroup tsig     tsig
index 339298ca73091882027deae6888e3ffeb416ea86..87e015c9db483273a4f6f369c98d00417786f216 100644 (file)
@@ -19,6 +19,7 @@ include_libdnssec_HEADERS = \
        libdnssec/keystore.h                    \
        libdnssec/keytag.h                      \
        libdnssec/nsec.h                        \
+       libdnssec/pem.h                         \
        libdnssec/random.h                      \
        libdnssec/sign.h                        \
        libdnssec/tsig.h                        \
@@ -51,6 +52,7 @@ libdnssec_la_SOURCES = \
        libdnssec/nsec/nsec.c                   \
        libdnssec/p11/p11.c                     \
        libdnssec/p11/p11.h                     \
+       libdnssec/pem.c                         \
        libdnssec/random.c                      \
        libdnssec/shared/bignum.c               \
        libdnssec/shared/bignum.h               \
@@ -59,8 +61,6 @@ libdnssec_la_SOURCES = \
        libdnssec/shared/dname.h                \
        libdnssec/shared/keyid_gnutls.c         \
        libdnssec/shared/keyid_gnutls.h         \
-       libdnssec/shared/pem.c                  \
-       libdnssec/shared/pem.h                  \
        libdnssec/shared/shared.h               \
        libdnssec/sign/der.c                    \
        libdnssec/sign/der.h                    \
index 9dd1de904e5fb6370b4c3aee80cd2fbccec15012..d98ca3302a6fc457f5e9f7bf213290fe5fa29bf9 100644 (file)
@@ -29,6 +29,7 @@
 #include <libdnssec/keystore.h>
 #include <libdnssec/keytag.h>
 #include <libdnssec/nsec.h>
+#include <libdnssec/pem.h>
 #include <libdnssec/random.h>
 #include <libdnssec/sign.h>
 #include <libdnssec/tsig.h>
index 69927d18528ad9caa9eb601faa0109602eae7897..747a56ede57d9a6c4e05f6777b41637713589278 100644 (file)
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2019 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -30,7 +30,6 @@
 #include "libdnssec/shared/keyid_gnutls.h"
 #include "libdnssec/keystore.h"
 #include "libdnssec/keytag.h"
-#include "libdnssec/shared/pem.h"
 #include "libdnssec/shared/shared.h"
 #include "libdnssec/shared/binary_wire.h"
 #include "contrib/wire_ctx.h"
index 7a3517a3a464ef4bc3c05689e3b9c384d16e017a..38f6d822d46ca4dfd3751494ef5896c760287693 100644 (file)
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2019 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -23,7 +23,7 @@
 #include "libdnssec/key/dnskey.h"
 #include "libdnssec/key/internal.h"
 #include "libdnssec/key/privkey.h"
-#include "libdnssec/shared/pem.h"
+#include "libdnssec/pem.h"
 #include "libdnssec/shared/shared.h"
 
 /* -- public API ----------------------------------------------------------- */
@@ -40,7 +40,7 @@ int dnssec_key_load_pkcs8(dnssec_key_t *key, const dnssec_binary_t *pem)
        }
 
        gnutls_privkey_t privkey = NULL;
-       int r = pem_privkey(pem, &privkey);
+       int r = dnssec_pem_to_privkey(pem, &privkey);
        if (r != DNSSEC_EOK) {
                return r;
        }
index c3ad780521e1de988d6590bd6f264b431e594d79..d1a7a8fcb174a2ee791069c241416127355d1c73 100644 (file)
@@ -24,7 +24,7 @@
 #include "libdnssec/keystore.h"
 #include "libdnssec/keystore/internal.h"
 #include "libdnssec/p11/p11.h"
-#include "libdnssec/shared/pem.h"
+#include "libdnssec/pem.h"
 #include "libdnssec/shared/shared.h"
 
 #ifdef ENABLE_PKCS11
@@ -231,7 +231,7 @@ static int import_pem(const dnssec_binary_t *pem,
        gnutls_privkey_t key = NULL;
        gnutls_pubkey_t pubkey = NULL;
 
-       int r = pem_x509(pem, &x509_key);
+       int r = dnssec_pem_to_x509(pem, &x509_key);
        if (r != DNSSEC_EOK) {
                goto fail;
        }
index dcfe6536f8bd493193ec52ca20e58cfe42b68026..d7948dd5b71938023d3ae667d381b75c14917e18 100644 (file)
@@ -27,8 +27,9 @@
 #include "libdnssec/error.h"
 #include "libdnssec/keystore.h"
 #include "libdnssec/keystore/internal.h"
-#include "libdnssec/shared/pem.h"
+#include "libdnssec/pem.h"
 #include "libdnssec/shared/shared.h"
+#include "libdnssec/shared/keyid_gnutls.h"
 
 #define DIR_INIT_MODE 0750
 
@@ -175,6 +176,48 @@ static bool key_is_duplicate(int open_error, pkcs8_dir_handle_t *handle,
        return dnssec_binary_cmp(&old, pem) == 0;
 }
 
+static int pem_generate(gnutls_pk_algorithm_t algorithm, unsigned bits,
+                       dnssec_binary_t *pem, char **id)
+{
+       assert(pem);
+       assert(id);
+
+       // generate key
+
+       _cleanup_x509_privkey_ gnutls_x509_privkey_t key = NULL;
+       int r = gnutls_x509_privkey_init(&key);
+       if (r != GNUTLS_E_SUCCESS) {
+               return DNSSEC_ENOMEM;
+       }
+
+       r = gnutls_x509_privkey_generate(key, algorithm, bits, 0);
+       if (r != GNUTLS_E_SUCCESS) {
+               return DNSSEC_KEY_GENERATE_ERROR;
+       }
+
+       // convert to PEM and export the ID
+
+       dnssec_binary_t _pem = { 0 };
+       r = dnssec_pem_from_x509(key, &_pem);
+       if (r != DNSSEC_EOK) {
+               return r;
+       }
+
+       // export key ID
+
+       char *_id = NULL;
+       r = keyid_x509_hex(key, &_id);
+       if (r != DNSSEC_EOK) {
+               dnssec_binary_free(&_pem);
+               return r;
+       }
+
+       *id = _id;
+       *pem = _pem;
+
+       return DNSSEC_EOK;
+}
+
 /* -- internal API --------------------------------------------------------- */
 
 static int pkcs8_ctx_new(void **ctx_ptr)
@@ -295,7 +338,13 @@ static int pkcs8_import_key(void *ctx, const dnssec_binary_t *pem, char **id_ptr
        // retrieve key ID
 
        char *id = NULL;
-       int r = pem_keyid(pem, &id);
+       _cleanup_x509_privkey_ gnutls_x509_privkey_t key = NULL;
+       int r = dnssec_pem_to_x509(pem, &key);
+       if (r != DNSSEC_EOK) {
+               return r;
+       }
+
+       r = keyid_x509_hex(key, &id);
        if (r != DNSSEC_EOK) {
                return r;
        }
@@ -392,7 +441,7 @@ static int pkcs8_get_private(void *ctx, const char *id, gnutls_privkey_t *key_pt
        // construct the key
 
        gnutls_privkey_t key = NULL;
-       r = pem_privkey(&pem, &key);
+       r = dnssec_pem_to_privkey(&pem, &key);
        if (r != DNSSEC_EOK) {
                return r;
        }
similarity index 58%
rename from src/libdnssec/shared/pem.c
rename to src/libdnssec/pem.c
index 42d3a6933c298a5576535e4b08618640cbdb9a3d..3069f8f0c338b99feea185b8095a24b248044840 100644 (file)
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2019 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
 #include "libdnssec/binary.h"
 #include "libdnssec/error.h"
 #include "libdnssec/key.h"
-#include "libdnssec/keyid.h"
-#include "libdnssec/shared/keyid_gnutls.h"
-#include "libdnssec/shared/pem.h"
+#include "libdnssec/pem.h"
 #include "libdnssec/shared/shared.h"
 
-/* -- internal API --------------------------------------------------------- */
-
-/*!
- * Create GnuTLS X.509 private key from unencrypted PEM data.
- */
-int pem_x509(const dnssec_binary_t *pem, gnutls_x509_privkey_t *key)
+_public_
+int dnssec_pem_to_x509(const dnssec_binary_t *pem, gnutls_x509_privkey_t *key)
 {
-       assert(pem);
-       assert(key);
+       if (!pem || !key) {
+               return DNSSEC_EINVAL;
+       }
 
        gnutls_datum_t data = binary_to_datum(pem);
 
@@ -59,16 +54,15 @@ int pem_x509(const dnssec_binary_t *pem, gnutls_x509_privkey_t *key)
        return DNSSEC_EOK;
 }
 
-/*!
- * Create GnuTLS private key from unencrypted PEM data.
- */
-int pem_privkey(const dnssec_binary_t *pem, gnutls_privkey_t *key)
+_public_
+int dnssec_pem_to_privkey(const dnssec_binary_t *pem, gnutls_privkey_t *key)
 {
-       assert(pem);
-       assert(key);
+       if (!pem || !key) {
+               return DNSSEC_EINVAL;
+       }
 
        gnutls_x509_privkey_t key_x509 = NULL;
-       int r = pem_x509(pem, &key_x509);
+       int r = dnssec_pem_to_x509(pem, &key_x509);
        if (r != DNSSEC_EOK) {
                return r;
        }
@@ -93,51 +87,6 @@ int pem_privkey(const dnssec_binary_t *pem, gnutls_privkey_t *key)
        return DNSSEC_EOK;
 }
 
-/*!
- * Generate new key and export it in the PEM format.
- */
-int pem_generate(gnutls_pk_algorithm_t algorithm, unsigned bits,
-                dnssec_binary_t *pem, char **id)
-{
-       assert(pem);
-       assert(id);
-
-       // generate key
-
-       _cleanup_x509_privkey_ gnutls_x509_privkey_t key = NULL;
-       int r = gnutls_x509_privkey_init(&key);
-       if (r != GNUTLS_E_SUCCESS) {
-               return DNSSEC_ENOMEM;
-       }
-
-       r = gnutls_x509_privkey_generate(key, algorithm, bits, 0);
-       if (r != GNUTLS_E_SUCCESS) {
-               return DNSSEC_KEY_GENERATE_ERROR;
-       }
-
-       // convert to PEM and export the ID
-
-       dnssec_binary_t _pem = { 0 };
-       r = pem_from_x509(key, &_pem);
-       if (r != DNSSEC_EOK) {
-               return r;
-       }
-
-       // export key ID
-
-       char *_id = NULL;
-       r = keyid_x509_hex(key, &_id);
-       if (r != DNSSEC_EOK) {
-               dnssec_binary_free(&_pem);
-               return r;
-       }
-
-       *id = _id;
-       *pem = _pem;
-
-       return DNSSEC_EOK;
-}
-
 static int try_export_pem(gnutls_x509_privkey_t key, dnssec_binary_t *pem)
 {
        assert(key);
@@ -150,13 +99,12 @@ static int try_export_pem(gnutls_x509_privkey_t key, dnssec_binary_t *pem)
                                                pem->data, &pem->size);
 }
 
-/*!
- * Export GnuTLS X.509 private key to PEM binary.
- */
-int pem_from_x509(gnutls_x509_privkey_t key, dnssec_binary_t *pem)
+_public_
+int dnssec_pem_from_x509(gnutls_x509_privkey_t key, dnssec_binary_t *pem)
 {
-       assert(key);
-       assert(pem);
+       if (!key || !pem) {
+               return DNSSEC_EINVAL;
+       }
 
        dnssec_binary_t _pem = { 0 };
        int r = try_export_pem(key, &_pem);
@@ -179,20 +127,3 @@ int pem_from_x509(gnutls_x509_privkey_t key, dnssec_binary_t *pem)
 
        return DNSSEC_EOK;
 }
-
-/*!
- * Get key ID of a private key in PEM format.
- */
-int pem_keyid(const dnssec_binary_t *pem, char **id)
-{
-       assert(pem && pem->size > 0 && pem->data);
-       assert(id);
-
-       _cleanup_x509_privkey_ gnutls_x509_privkey_t key = NULL;
-       int r = pem_x509(pem, &key);
-       if (r != DNSSEC_EOK) {
-               return r;
-       }
-
-       return keyid_x509_hex(key, id);
-}
similarity index 57%
rename from src/libdnssec/shared/pem.h
rename to src/libdnssec/pem.h
index bb8242de15c22d16c313af2a941b5ab1780258c2..7b56b17d4f813a11f97ada8669ba6085b0130fbe 100644 (file)
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2019 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
     You should have received a copy of the GNU General Public License
     along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
+/*!
+ * \file
+ *
+ * \addtogroup pem
+ *
+ * \brief PEM key format operations.
+ *
+ * @{
+ */
 
 #pragma once
 
 #include <gnutls/gnutls.h>
 
-#include "libdnssec/binary.h"
+#include <libdnssec/binary.h>
 
 /*!
  * Create GnuTLS X.509 private key from unencrypted PEM data.
@@ -28,7 +37,7 @@
  *
  * \return Error code, DNSSEC_EOK if successful.
  */
-int pem_x509(const dnssec_binary_t *pem, gnutls_x509_privkey_t *key);
+int dnssec_pem_to_x509(const dnssec_binary_t *pem, gnutls_x509_privkey_t *key);
 
 /*!
  * Create GnuTLS private key from unencrypted PEM data.
@@ -38,20 +47,7 @@ int pem_x509(const dnssec_binary_t *pem, gnutls_x509_privkey_t *key);
  *
  * \return Error code, DNSSEC_EOK if successful.
  */
-int pem_privkey(const dnssec_binary_t *pem, gnutls_privkey_t *key);
-
-/*!
- * Generate a private key and export it in the PEM format.
- *
- * \param[in]  algorithm  Algorithm to be used.
- * \param[in]  bits       Size of the key to be generated.
- * \param[out] pem        Generated key in unencrypted PEM format.
- * \param[out] id         Key ID of the generated key.
- *
- * \return Error code, DNSSEC_EOK if successful.
- */
-int pem_generate(gnutls_pk_algorithm_t algorithm, unsigned bits,
-                dnssec_binary_t *pem, char **id);
+int dnssec_pem_to_privkey(const dnssec_binary_t *pem, gnutls_privkey_t *key);
 
 /*!
  * Export GnuTLS X.509 private key to PEM binary.
@@ -61,14 +57,6 @@ int pem_generate(gnutls_pk_algorithm_t algorithm, unsigned bits,
  *
  * \return Error code, DNSSEC_EOK if successful.
  */
-int pem_from_x509(gnutls_x509_privkey_t key, dnssec_binary_t *pem);
+int dnssec_pem_from_x509(gnutls_x509_privkey_t key, dnssec_binary_t *pem);
 
-/*!
- * Get key ID of a private key in PEM format.
- *
- * \param[in]  pem  Key in unencrypted PEM format.
- * \param[out] id   ID of the key.
- *
- * \return Error code, DNSSEC_EOK if successful.
- */
-int pem_keyid(const dnssec_binary_t *pem, char **id);
+/*! @} */
index 7e4fb5cf94cfb419778530c8a4364183e9db938f..d09b5dd4dbca6ded86866486ef46549bb88f1431 100644 (file)
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2019 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -20,7 +20,7 @@
 #include "contrib/strtonum.h"
 #include "libdnssec/binary.h"
 #include "libdnssec/error.h"
-#include "libdnssec/shared/pem.h"
+#include "libdnssec/pem.h"
 #include "libdnssec/shared/shared.h"
 #include "utils/keymgr/bind_privkey.h"
 
@@ -267,7 +267,7 @@ static int rsa_params_to_pem(const bind_privkey_t *params, dnssec_binary_t *pem)
                return DNSSEC_KEY_IMPORT_ERROR;
        }
 
-       return pem_from_x509(key, pem);
+       return dnssec_pem_from_x509(key, pem);
 }
 
 /*!
@@ -320,7 +320,7 @@ static int ecdsa_params_to_pem(dnssec_key_t *dnskey, const bind_privkey_t *param
 
        gnutls_x509_privkey_fix(key);
 
-       return pem_from_x509(key, pem);
+       return dnssec_pem_from_x509(key, pem);
 }
 
 int bind_privkey_to_pem(dnssec_key_t *key, bind_privkey_t *params, dnssec_binary_t *pem)
index 2099358c5f1be06feb8663342ff7900cbf0069d3..efdca80a623126d3c96676c43cdb9a1b27d75d51 100644 (file)
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2019 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -17,7 +17,7 @@
 #include <tap/basic.h>
 #include <string.h>
 
-#include "bignum.h"
+#include "bignum.c"
 #include "binary.h"
 
 #define bin_init(array) { .data = array, .size = sizeof(array) }
index c636d27b64c83230637425ce4e1b54462ddd534c..4a784e64a2c469b76693772605d75f750fa32aa5 100644 (file)
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2019 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -18,7 +18,7 @@
 #include <string.h>
 #include <tap/basic.h>
 
-#include "dname.h"
+#include "dname.c"
 
 static void ok_length(const char *dname, size_t length, const char *info)
 {
index 1514066ef4033a80822421098b4522ac279bac02..f39b8ff8f153f3acb79e823fbf6bc3a3560ec6ae 100644 (file)
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2019 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -19,6 +19,7 @@
 #include <string.h>
 #include <stdbool.h>
 
+#include "bignum.c"
 #include "binary.h"
 #include "error.h"
 #include "sign/der.c"
index 50d91da10cf56d1e9f62b026becf917367cf132a..ab58c20c4cffd84b89b5726725f291cdc170e60d 100644 (file)
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2018 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2019 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -18,7 +18,7 @@
 #include <string.h>
 
 #include "binary.h"
-#include "dname.h"
+#include "dname.c"
 #include "tsig.h"
 
 static const dnssec_binary_t payload = {