ACX_WITH_SSL_OPTIONAL
-AC_CHECK_FUNCS([EVP_sha256 ENGINE_load_cryptodev])
+AC_CHECK_FUNCS([EVP_sha256 ENGINE_load_cryptodev EVP_PKEY_keygen ECDSA_SIG_get0])
# for macosx, see if glibtool exists and use that
# BSD's need to know the version...
;;
esac
+AC_ARG_ENABLE(dsa, AC_HELP_STRING([--disable-dsa], [Disable DSA support]))
+case "$enable_dsa" in
+ no)
+ ;;
+ *) dnl default
+ # detect if DSA is supported, and turn it off if not.
+ AC_CHECK_FUNC(EVP_dss1, [
+ AC_DEFINE_UNQUOTED([USE_DSA], [1], [Define this to enable DSA support.])
+ ], [if test "x$enable_dsa" = "xyes"; then AC_MSG_ERROR([OpenSSL does not support DSA and you used --enable-dsa.])
+ fi ])
+ ;;
+esac
+
+AC_ARG_ENABLE(ed25519, AC_HELP_STRING([--enable-ed25519], [Enable ed25519 support (experimental)]))
+case "$enable_ed25519" in
+ yes)
+ if test "x$HAVE_SSL" != "xyes"; then
+ AC_MSG_ERROR([DSA enabled, but no SSL support])
+ fi
+ AC_CHECK_DECLS([NID_X25519], [], [AC_MSG_ERROR([OpenSSL does not support the EDDSA curve: please upgrade OpenSSL or rerun with --disable-ed25519])], [AC_INCLUDES_DEFAULT
+#include <openssl/evp.h>
+ ])
+ AC_DEFINE_UNQUOTED([USE_ED25519], [1], [Define this to enable ED25519 support.])
+ ;;
+ *|no) dnl default
+ ;;
+esac
+
AC_ARG_ENABLE(dane, AC_HELP_STRING([--disable-dane], [Disable DANE support]))
case "$enable_dane" in
no)
ldns_convert_dsa_rrsig_asn12rdf(const ldns_buffer *sig,
const long sig_len)
{
+#ifdef USE_DSA
ldns_rdf *sigdata_rdf;
DSA_SIG *dsasig;
unsigned char *dsasig_data = (unsigned char*)ldns_buffer_begin(sig);
DSA_SIG_free(dsasig);
return sigdata_rdf;
+#else
+ (void)sig; (void)sig_len;
+ return NULL;
+#endif
}
ldns_status
ldns_convert_dsa_rrsig_rdf2asn1(ldns_buffer *target_buffer,
const ldns_rdf *sig_rdf)
{
+#ifdef USE_DSA
/* the EVP api wants the DER encoding of the signature... */
BIGNUM *R, *S;
DSA_SIG *dsasig;
free(raw_sig);
return ldns_buffer_status(target_buffer);
+#else
+ (void)target_buffer; (void)sig_rdf;
+ return LDNS_STATUS_CRYPTO_ALGO_NOT_IMPL;
+#endif
}
#ifdef USE_ECDSA
const long sig_len, int num_bytes)
{
ECDSA_SIG* ecdsa_sig;
+ BIGNUM *r, *s;
unsigned char *data = (unsigned char*)ldns_buffer_begin(sig);
ldns_rdf* rdf;
ecdsa_sig = d2i_ECDSA_SIG(NULL, (const unsigned char **)&data, sig_len);
if(!ecdsa_sig) return NULL;
+#ifdef HAVE_ECDSA_SIG_GET0
+ ECDSA_SIG_get0(&r, &s, ecdsa_sig);
+#else
+ r = ecdsa_sig->r;
+ s = ecdsa_sig->s;
+#endif
/* "r | s". */
- if(BN_num_bytes(ecdsa_sig->r) > num_bytes ||
- BN_num_bytes(ecdsa_sig->s) > num_bytes) {
+ if(BN_num_bytes(r) > num_bytes ||
+ BN_num_bytes(s) > num_bytes) {
ECDSA_SIG_free(ecdsa_sig);
return NULL; /* numbers too big for passed curve size */
}
/* write the bignums (in big-endian) a little offset if the BN code
* wants to write a shorter number of bytes, with zeroes prefixed */
memset(data, 0, num_bytes*2);
- BN_bn2bin(ecdsa_sig->r, data+num_bytes-BN_num_bytes(ecdsa_sig->r));
- BN_bn2bin(ecdsa_sig->s, data+num_bytes*2-BN_num_bytes(ecdsa_sig->s));
+ BN_bn2bin(r, data+num_bytes-BN_num_bytes(r));
+ BN_bn2bin(s, data+num_bytes*2-BN_num_bytes(s));
rdf = ldns_rdf_new(LDNS_RDF_TYPE_B64, (size_t)(num_bytes*2), data);
ECDSA_SIG_free(ecdsa_sig);
return rdf;
ldns_convert_ecdsa_rrsig_rdf2asn1(ldns_buffer *target_buffer,
const ldns_rdf *sig_rdf)
{
- ECDSA_SIG* sig;
- int raw_sig_len;
+ /* convert from two BIGNUMs in the rdata buffer, to ASN notation.
+ * ASN preable: 30440220 <R 32bytefor256> 0220 <S 32bytefor256>
+ * the '20' is the length of that field (=bnsize).
+ * the '44' is the total remaining length.
+ * if negative, start with leading zero.
+ * if starts with 00s, remove them from the number.
+ */
+ uint8_t pre[] = {0x30, 0x44, 0x02, 0x20};
+ int pre_len = 4;
+ uint8_t mid[] = {0x02, 0x20};
+ int mid_len = 2;
+ int raw_sig_len, r_high, s_high, r_rem=0, s_rem=0;
long bnsize = (long)ldns_rdf_size(sig_rdf) / 2;
+ uint8_t* d = ldns_rdf_data(sig_rdf);
/* if too short, or not even length, do not bother */
if(bnsize < 16 || (size_t)bnsize*2 != ldns_rdf_size(sig_rdf))
return LDNS_STATUS_ERR;
-
- /* use the raw data to parse two evenly long BIGNUMs, "r | s". */
- sig = ECDSA_SIG_new();
- if(!sig) return LDNS_STATUS_MEM_ERR;
- sig->r = BN_bin2bn((const unsigned char*)ldns_rdf_data(sig_rdf),
- bnsize, sig->r);
- sig->s = BN_bin2bn((const unsigned char*)ldns_rdf_data(sig_rdf)+bnsize,
- bnsize, sig->s);
- if(!sig->r || !sig->s) {
- ECDSA_SIG_free(sig);
- return LDNS_STATUS_MEM_ERR;
+ /* strip leading zeroes from r (but not last one) */
+ while(r_rem < bnsize-1 && d[r_rem] == 0)
+ r_rem++;
+ /* strip leading zeroes from s (but not last one) */
+ while(s_rem < bnsize-1 && d[bnsize+s_rem] == 0)
+ s_rem++;
+
+ r_high = ((d[0+r_rem]&0x80)?1:0);
+ s_high = ((d[bnsize+s_rem]&0x80)?1:0);
+ raw_sig_len = pre_len + r_high + bnsize - r_rem + mid_len + s_high + bnsize - s_rem;
+ if(ldns_buffer_reserve(target_buffer, (size_t) raw_sig_len)) {
+ ldns_buffer_write_u8(target_buffer, pre[0]);
+ ldns_buffer_write_u8(target_buffer, raw_sig_len-2);
+ ldns_buffer_write_u8(target_buffer, pre[2]);
+ ldns_buffer_write_u8(target_buffer, bnsize + r_high - r_rem);
+ if(r_high)
+ ldns_buffer_write_u8(target_buffer, 0);
+ ldns_buffer_write(target_buffer, d+r_rem, bnsize-r_rem);
+ ldns_buffer_write(target_buffer, mid, mid_len-1);
+ ldns_buffer_write_u8(target_buffer, bnsize + s_high - s_rem);
+ if(s_high)
+ ldns_buffer_write_u8(target_buffer, 0);
+ ldns_buffer_write(target_buffer, d+bnsize+s_rem, bnsize-s_rem);
}
-
- raw_sig_len = i2d_ECDSA_SIG(sig, NULL);
- if (ldns_buffer_reserve(target_buffer, (size_t) raw_sig_len)) {
- unsigned char* pp = (unsigned char*)
- ldns_buffer_current(target_buffer);
- raw_sig_len = i2d_ECDSA_SIG(sig, &pp);
- ldns_buffer_skip(target_buffer, (ssize_t) raw_sig_len);
- }
- ECDSA_SIG_free(sig);
-
- return ldns_buffer_status(target_buffer);
+ return ldns_buffer_status(target_buffer);
}
#endif /* S_SPLINT_S */
ldns_rdf *b64rdf = NULL;
switch(ldns_key_algorithm(current_key)) {
+#ifdef USE_DSA
case LDNS_SIGN_DSA:
case LDNS_SIGN_DSA_NSEC3:
b64rdf = ldns_sign_public_evp(
ldns_key_evp_key(current_key),
EVP_dss1());
break;
+#endif /* USE_DSA */
case LDNS_SIGN_RSASHA1:
case LDNS_SIGN_RSASHA1_NSEC3:
b64rdf = ldns_sign_public_evp(
ldns_rdf *
ldns_sign_public_dsa(ldns_buffer *to_sign, DSA *key)
{
+#ifdef USE_DSA
unsigned char *sha1_hash;
ldns_rdf *sigdata_rdf;
ldns_buffer *b64sig;
DSA_SIG_free(sig);
return sigdata_rdf;
+#else
+ (void)to_sign; (void)key;
+ return NULL;
+#endif
}
#ifdef USE_ECDSA
{
EC_KEY* ec;
const EC_GROUP* g;
- if(EVP_PKEY_type(pkey->type) != EVP_PKEY_EC)
+ if(EVP_PKEY_base_id(pkey) != EVP_PKEY_EC)
return 0;
ec = EVP_PKEY_get1_EC_KEY(pkey);
g = EC_KEY_get0_group(ec);
unsigned int siglen;
ldns_rdf *sigdata_rdf;
ldns_buffer *b64sig;
- EVP_MD_CTX ctx;
+ EVP_MD_CTX *ctx;
const EVP_MD *md_type;
int r;
return NULL;
}
- EVP_MD_CTX_init(&ctx);
- r = EVP_SignInit(&ctx, md_type);
+ ctx = EVP_MD_CTX_new();
+ if(!ctx) {
+ ldns_buffer_free(b64sig);
+ return NULL;
+ }
+
+ r = EVP_SignInit(ctx, md_type);
if(r == 1) {
- r = EVP_SignUpdate(&ctx, (unsigned char*)
+ r = EVP_SignUpdate(ctx, (unsigned char*)
ldns_buffer_begin(to_sign),
ldns_buffer_position(to_sign));
} else {
ldns_buffer_free(b64sig);
+ EVP_MD_CTX_destroy(ctx);
return NULL;
}
if(r == 1) {
- r = EVP_SignFinal(&ctx, (unsigned char*)
+ r = EVP_SignFinal(ctx, (unsigned char*)
ldns_buffer_begin(b64sig), &siglen, key);
} else {
ldns_buffer_free(b64sig);
+ EVP_MD_CTX_destroy(ctx);
return NULL;
}
if(r != 1) {
ldns_buffer_free(b64sig);
+ EVP_MD_CTX_destroy(ctx);
return NULL;
}
/* unfortunately, OpenSSL output is differenct from DNS DSA format */
#ifndef S_SPLINT_S
+#ifdef USE_DSA
if (EVP_PKEY_type(key->type) == EVP_PKEY_DSA) {
sigdata_rdf = ldns_convert_dsa_rrsig_asn12rdf(b64sig, siglen);
+ }
+#endif
+#if defined(USE_DSA) && defined(USE_ECDSA)
+ else
+#endif
#ifdef USE_ECDSA
- } else if(EVP_PKEY_type(key->type) == EVP_PKEY_EC &&
+ if(EVP_PKEY_base_id(key) == EVP_PKEY_EC &&
ldns_pkey_is_ecdsa(key)) {
sigdata_rdf = ldns_convert_ecdsa_rrsig_asn1len2rdf(
b64sig, siglen, ldns_pkey_is_ecdsa(key));
+ }
#endif
- } else {
+ else {
/* ok output for other types is the same */
sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
ldns_buffer_begin(b64sig));
}
#endif /* splint */
ldns_buffer_free(b64sig);
- EVP_MD_CTX_cleanup(&ctx);
+ EVP_MD_CTX_destroy(ctx);
return sigdata_rdf;
}
{
/* check for right key */
switch(algo) {
+#ifdef USE_DSA
case LDNS_DSA:
case LDNS_DSA_NSEC3:
return ldns_verify_rrsig_dsa_raw(sig,
key,
keylen);
break;
+#endif
case LDNS_RSASHA1:
case LDNS_RSASHA1_NSEC3:
return ldns_verify_rrsig_rsasha1_raw(sig,
return LDNS_STATUS_MEM_ERR;
}
break;
+#ifdef USE_DSA
case LDNS_DSA:
case LDNS_DSA_NSEC3:
/* EVP takes rfc2459 format, which is a tad longer than dns format */
return LDNS_STATUS_MEM_ERR;
}
break;
+#endif
#ifdef USE_ECDSA
case LDNS_ECDSAP256SHA256:
case LDNS_ECDSAP384SHA384:
ldns_verify_rrsig_evp_raw(const unsigned char *sig, size_t siglen,
const ldns_buffer *rrset, EVP_PKEY *key, const EVP_MD *digest_type)
{
- EVP_MD_CTX ctx;
+ EVP_MD_CTX *ctx;
int res;
- EVP_MD_CTX_init(&ctx);
+ ctx = EVP_MD_CTX_new();
+ if(!ctx)
+ return LDNS_STATUS_MEM_ERR;
- EVP_VerifyInit(&ctx, digest_type);
- EVP_VerifyUpdate(&ctx,
+ EVP_VerifyInit(ctx, digest_type);
+ EVP_VerifyUpdate(ctx,
ldns_buffer_begin(rrset),
ldns_buffer_position(rrset));
- res = EVP_VerifyFinal(&ctx, sig, (unsigned int) siglen, key);
+ res = EVP_VerifyFinal(ctx, sig, (unsigned int) siglen, key);
- EVP_MD_CTX_cleanup(&ctx);
+ EVP_MD_CTX_destroy(ctx);
if (res == 1) {
return LDNS_STATUS_OK;
ldns_verify_rrsig_dsa_raw(unsigned char* sig, size_t siglen,
ldns_buffer* rrset, unsigned char* key, size_t keylen)
{
+#ifdef USE_DSA
EVP_PKEY *evp_key;
ldns_status result;
}
EVP_PKEY_free(evp_key);
return result;
-
+#else
+ (void)sig; (void)siglen; (void)rrset; (void)key; (void)keylen;
+ return LDNS_STATUS_CRYPTO_ALGO_NOT_IMPL;
+#endif
}
ldns_status
xfree(tsig_algorithm);
#ifdef HAVE_SSL
- ERR_remove_state(0);
CRYPTO_cleanup_all_ex_data();
ERR_free_strings();
EVP_cleanup();
if (! cert) {
ssl_err("could not SSL_get_certificate");
}
-#ifndef S_SPLINT_S
- extra_certs = ctx->extra_certs;
-#endif
+ if(!SSL_CTX_get_extra_chain_certs(ctx, &extra_certs)) {
+ ssl_err("could not SSL_CTX_get_extra_chain_certs");
+ }
+ /* I don't know if we have to stack-free the extra_certs */
switch (mode) {
case CREATE: dane_create(tlsas, tlsa_owner, certificate_usage,
keys = ldns_key_list_new();
- OPENSSL_config(NULL);
-
while ((c = getopt(argc, argv, "a:bde:f:i:k:no:ps:t:vAUE:K:")) != -1) {
switch (c) {
case 'a':
{ LDNS_SIGN_ECDSAP256SHA256, "ECDSAP256SHA256" },
{ LDNS_SIGN_ECDSAP384SHA384, "ECDSAP384SHA384" },
#endif
+#ifdef USE_DSA
{ LDNS_SIGN_DSA, "DSA" },
{ LDNS_SIGN_DSA_NSEC3, "DSA-NSEC3-SHA1" },
+#endif
{ LDNS_SIGN_HMACMD5, "hmac-md5.sig-alg.reg.int" },
{ LDNS_SIGN_HMACSHA1, "hmac-sha1" },
{ LDNS_SIGN_HMACSHA256, "hmac-sha256" },
ldns_rr *key_rr;
#ifdef HAVE_SSL
RSA *rsa;
+#ifdef USE_DSA
DSA *dsa;
+#endif
unsigned char *hmac;
size_t hmac_size;
#endif /* HAVE_SSL */
alg = (ldns_signing_algorithm)LDNS_DH;
}
if (strncmp(d, "3 DSA", 2) == 0) {
+#ifdef USE_DSA
alg = LDNS_SIGN_DSA;
+#else
+# ifdef STDERR_MSGS
+ fprintf(stderr, "Warning: DSA not compiled into this ");
+ fprintf(stderr, "version of ldns\n");
+# endif
+#endif
}
if (strncmp(d, "4 ECC", 2) == 0) {
alg = (ldns_signing_algorithm)LDNS_ECC;
alg = LDNS_SIGN_RSASHA1;
}
if (strncmp(d, "6 DSA", 2) == 0) {
+#ifdef USE_DSA
alg = LDNS_SIGN_DSA_NSEC3;
+#else
+# ifdef STDERR_MSGS
+ fprintf(stderr, "Warning: DSA not compiled into this ");
+ fprintf(stderr, "version of ldns\n");
+# endif
+#endif
}
if (strncmp(d, "7 RSASHA1", 2) == 0) {
alg = LDNS_SIGN_RSASHA1_NSEC3;
ldns_key_assign_rsa_key(k, rsa);
#endif /* HAVE_SSL */
break;
+#ifdef USE_DSA
case LDNS_SIGN_DSA:
case LDNS_SIGN_DSA_NSEC3:
ldns_key_set_algorithm(k, alg);
ldns_key_assign_dsa_key(k, dsa);
#endif /* HAVE_SSL */
break;
+#endif /* USE_DSA */
case LDNS_SIGN_HMACMD5:
case LDNS_SIGN_HMACSHA1:
case LDNS_SIGN_HMACSHA256:
{
ldns_key *k;
#ifdef HAVE_SSL
+#ifdef USE_DSA
DSA *d;
- RSA *r;
+#endif /* USE_DSA */
# ifdef USE_ECDSA
EC_KEY *ec = NULL;
# endif
+# ifdef HAVE_EVP_PKEY_KEYGEN
+ EVP_PKEY_CTX *ctx;
+# else
+ RSA *r;
+# endif
#else
int i;
uint16_t offset = 0;
case LDNS_SIGN_RSASHA256:
case LDNS_SIGN_RSASHA512:
#ifdef HAVE_SSL
+#ifdef HAVE_EVP_PKEY_KEYGEN
+ ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
+ if(!ctx) {
+ ldns_key_free(k);
+ return NULL;
+ }
+ if(EVP_PKEY_keygen_init(ctx) <= 0) {
+ ldns_key_free(k);
+ EVP_PKEY_CTX_free(ctx);
+ return NULL;
+ }
+ if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, size) <= 0) {
+ ldns_key_free(k);
+ EVP_PKEY_CTX_free(ctx);
+ return NULL;
+ }
+ if (EVP_PKEY_keygen(ctx, &k->_key.key) <= 0) {
+ ldns_key_free(k);
+ EVP_PKEY_CTX_free(ctx);
+ return NULL;
+ }
+ EVP_PKEY_CTX_free(ctx);
+#else /* HAVE_EVP_PKEY_KEYGEN */
r = RSA_generate_key((int)size, RSA_F4, NULL, NULL);
if(!r) {
ldns_key_free(k);
}
ldns_key_set_rsa_key(k, r);
RSA_free(r);
+#endif /* HAVE_EVP_PKEY_KEYGEN */
#endif /* HAVE_SSL */
break;
case LDNS_SIGN_DSA:
case LDNS_SIGN_DSA_NSEC3:
+#ifdef USE_DSA
#ifdef HAVE_SSL
d = DSA_generate_parameters((int)size, NULL, 0, NULL, NULL, NULL, NULL);
if (!d) {
ldns_key_set_dsa_key(k, d);
DSA_free(d);
#endif /* HAVE_SSL */
+#endif /* USE_DSA */
break;
case LDNS_SIGN_HMACMD5:
case LDNS_SIGN_HMACSHA1:
void
ldns_key_set_dsa_key(ldns_key *k, DSA *d)
{
+#ifdef USE_DSA
EVP_PKEY *key = EVP_PKEY_new();
EVP_PKEY_set1_DSA(key, d);
k->_key.key = key;
+#else
+ (void)k; (void)d;
+#endif
}
void
void
ldns_key_assign_dsa_key(ldns_key *k, DSA *d)
{
+#ifdef USE_DSA
EVP_PKEY *key = EVP_PKEY_new();
EVP_PKEY_assign_DSA(key, d);
k->_key.key = key;
+#else
+ (void)k; (void)d;
+#endif
}
#endif /* splint */
#endif /* HAVE_SSL */
DSA *
ldns_key_dsa_key(const ldns_key *k)
{
+#ifdef USE_DSA
if (k->_key.key) {
return EVP_PKEY_get1_DSA(k->_key.key);
} else {
return NULL;
}
+#else
+ (void)k;
+ return NULL;
+#endif
}
#endif /* splint */
#endif /* HAVE_SSL */
return true;
}
+#ifdef USE_DSA
/* data pointer must be large enough (LDNS_MAX_KEYLEN) */
static bool
ldns_key_dsa2bin(unsigned char *data, DSA *k, uint16_t *size)
*size = 21 + *size * 3;
return true;
}
+#endif /* USE_DSA */
#ifdef USE_GOST
static bool
unsigned char* pp = NULL;
if(i2d_PUBKEY(k, &pp) != 37 + 64) {
/* expect 37 byte(ASN header) and 64 byte(X and Y) */
- CRYPTO_free(pp);
+ free(pp);
return false;
}
/* omit ASN header */
for(i=0; i<64; i++)
data[i] = pp[i+37];
- CRYPTO_free(pp);
+ free(pp);
*size = 64;
return true;
}
uint16_t size = 0;
#ifdef HAVE_SSL
RSA *rsa = NULL;
+#ifdef USE_DSA
DSA *dsa = NULL;
+#endif /* USE_DSA */
#endif /* HAVE_SSL */
#ifdef USE_ECDSA
EC_KEY* ec;
case LDNS_SIGN_DSA:
ldns_rr_push_rdf(pubkey,
ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, LDNS_DSA));
+#ifdef USE_DSA
#ifdef HAVE_SSL
dsa = ldns_key_dsa_key(k);
if (dsa) {
internal_data = 1;
}
#endif /* HAVE_SSL */
+#endif /* USE_DSA */
break;
case LDNS_SIGN_DSA_NSEC3:
ldns_rr_push_rdf(pubkey,
ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, LDNS_DSA_NSEC3));
+#ifdef USE_DSA
#ifdef HAVE_SSL
dsa = ldns_key_dsa_key(k);
if (dsa) {
internal_data = 1;
}
#endif /* HAVE_SSL */
+#endif /* USE_DSA */
break;
case LDNS_SIGN_ECC_GOST:
ldns_rr_push_rdf(pubkey, ldns_native2rdf_int8(
{LDNS_SIGN_DSA_NSEC3, "NSEC3DSA"},
{LDNS_SIGN_RSASHA1_NSEC3, "NSEC3RSASHA1"},
/* old ldns usage, now RFC names */
+#ifdef USE_DSA
{LDNS_SIGN_DSA_NSEC3, "DSA_NSEC3" },
+#endif
{LDNS_SIGN_RSASHA1_NSEC3, "RSASHA1_NSEC3" },
#ifdef USE_GOST
{LDNS_SIGN_ECC_GOST, "GOST"},
projects / thirdparty / ldns.git / commitdiff
