* New ECDSA support (RFC 6605), use --disable-ecdsa for older openssl.

diff --git a/Changelog b/Changelog
index 5a2f0642e0ec4a0529e6ce341d23e5a582c9eb26..3af325e71e4d161942d345bd8db9faea6439f70d 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -16,6 +16,7 @@
        * Fix reading \DDD: Error on values that are outside range (>255).
        * bugfix #429: fix doxyparse.pl fails on NetBSD because specified
          path to perl.
+       * New ECDSA support (RFC 6605), use --disable-ecdsa for older openssl.
 
 1.6.12
        * bugfix #413: Fix manpage source for srcdir != builddir

diff --git a/configure.ac b/configure.ac
index 0285c4fdc81d8ab609fd45ae47f95bacb48dd21e..af24f44b7c15466a0340a797171c8b78529154cf 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -297,26 +297,21 @@ case "$enable_gost" in
         ;;
 esac
 
-AC_ARG_ENABLE(ecdsa, AC_HELP_STRING([--enable-ecdsa], [Enable ECDSA support, experimental]))
+AC_ARG_ENABLE(ecdsa, AC_HELP_STRING([--enable-ecdsa], [Enable ECDSA support]))
 case "$enable_ecdsa" in
-    yes)
+    no)
+      ;;
+    *) dnl default
       if test "x$HAVE_SSL" != "xyes"; then
         AC_MSG_ERROR([ECDSA enabled, but no SSL support])
       fi
-      AC_CHECK_FUNC(ECDSA_sign, [], [AC_MSG_ERROR([OpenSSL does not support ECDSA])])
-      AC_CHECK_FUNC(SHA384_Init, [], [AC_MSG_ERROR([OpenSSL does not support SHA384])])
-      AC_CHECK_DECLS([NID_X9_62_prime256v1, NID_secp384r1], [], [AC_MSG_ERROR([OpenSSL does not support the ECDSA curves])], [AC_INCLUDES_DEFAULT
+      AC_CHECK_FUNC(ECDSA_sign, [], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade OpenSSL or rerun with --disable-ecdsa])])
+      AC_CHECK_FUNC(SHA384_Init, [], [AC_MSG_ERROR([OpenSSL does not support SHA384: please upgrade OpenSSL or rerun with --disable-ecdsa])])
+      AC_CHECK_DECLS([NID_X9_62_prime256v1, NID_secp384r1], [], [AC_MSG_ERROR([OpenSSL does not support the ECDSA curves: please upgrade OpenSSL or rerun with --disable-ecdsa])], [AC_INCLUDES_DEFAULT
 #include <openssl/evp.h>
       ])
       # we now know we have ECDSA and the required curves.
       AC_DEFINE_UNQUOTED([USE_ECDSA], [1], [Define this to enable ECDSA support.])
-      AC_SUBST(ldns_build_config_use_ecdsa, 1)
-      ;;
-    no)
-      AC_SUBST(ldns_build_config_use_ecdsa, 0)
-      ;;
-    *)
-      AC_SUBST(ldns_build_config_use_ecdsa, 0)
       ;;
 esac
 

diff --git a/dnssec.c b/dnssec.c
index 6d75c67791db94385e768c10c6bf07d45a50ab1e..c6e93211787bc560ea6a66a8fd083a5d0de6ddb8 100644 (file)
--- a/dnssec.c
+++ b/dnssec.c
@@ -532,17 +532,18 @@ ldns_key_rr2ds(const ldns_rr *key, ldns_hash h)
                ldns_rr_free(ds);
                return NULL;
 #endif
-#ifdef USE_ECDSA
-               /* Make similar ``not implemented'' construct as above when 
-                  draft-hoffman-dnssec-ecdsa-04 becomes a standard
-                */
        case LDNS_SHA384:
+#ifdef USE_ECDSA
                digest = LDNS_XMALLOC(uint8_t, SHA384_DIGEST_LENGTH);
                if (!digest) {
                        ldns_rr_free(ds);
                        return NULL;
                }
                 break;
+#else
+               /* not implemented */
+               ldns_rr_free(ds);
+               return NULL;
 #endif
        }
 
@@ -635,8 +636,8 @@ ldns_key_rr2ds(const ldns_rr *key, ldns_hash h)
                ldns_rr_push_rdf(ds, tmp);
 #endif
                break;
-#ifdef USE_ECDSA
        case LDNS_SHA384:
+#ifdef USE_ECDSA
                (void) SHA384((unsigned char *) ldns_buffer_begin(data_buf),
                                 (unsigned int) ldns_buffer_position(data_buf),
                                 (unsigned char *) digest);
@@ -644,8 +645,8 @@ ldns_key_rr2ds(const ldns_rr *key, ldns_hash h)
                                            SHA384_DIGEST_LENGTH,
                                            digest);
                ldns_rr_push_rdf(ds, tmp);
-               break;
 #endif
+               break;
        }
 
        LDNS_FREE(digest);

diff --git a/keys.c b/keys.c
index 706f7f2cadb5424b0e06c2ccaa28238e0d6e7f7b..00ab1402d39e52730b14a04da965d715b7d811cf 100644 (file)
--- a/keys.c
+++ b/keys.c
@@ -388,14 +388,22 @@ ldns_key_new_frm_fp_l(ldns_key **key, FILE *fp, int *line_nr)
                fprintf(stderr, "version of ldns, use --enable-gost\n");
 #endif
        }
-#ifdef USE_ECDSA
        if (strncmp(d, "13 ECDSAP256SHA256", 3) == 0) {
+#ifdef USE_ECDSA
                 alg = LDNS_SIGN_ECDSAP256SHA256;
+#else
+               fprintf(stderr, "Warning: ECDSA not compiled into this ");
+               fprintf(stderr, "version of ldns, use --enable-ecdsa\n");
+#endif
         }
        if (strncmp(d, "14 ECDSAP384SHA384", 3) == 0) {
+#ifdef USE_ECDSA
                 alg = LDNS_SIGN_ECDSAP384SHA384;
-        }
+#else
+               fprintf(stderr, "Warning: ECDSA not compiled into this ");
+               fprintf(stderr, "version of ldns, use --enable-ecdsa\n");
 #endif
+        }
        if (strncmp(d, "157 HMAC-MD5", 4) == 0) {
                alg = LDNS_SIGN_HMACMD5;
        }

diff --git a/ldns/common.h.in b/ldns/common.h.in
index 98470eea577802acf35e855e284c36e0ddbd336e..5d6254752a5b30d42b5e884c35492d197df3414c 100644 (file)
--- a/ldns/common.h.in
+++ b/ldns/common.h.in
@@ -20,7 +20,6 @@
  * as detected and determined by the auto configure script.
  */
 #define LDNS_BUILD_CONFIG_HAVE_SSL         @ldns_build_config_have_ssl@
-#define LDNS_BUILD_CONFIG_USE_ECDSA        @ldns_build_config_use_ecdsa@
 #define LDNS_BUILD_CONFIG_HAVE_INTTYPES_H  @ldns_build_config_have_inttypes_h@
 #define LDNS_BUILD_CONFIG_HAVE_ATTR_FORMAT @ldns_build_config_have_attr_format@
 #define LDNS_BUILD_CONFIG_HAVE_ATTR_UNUSED @ldns_build_config_have_attr_unused@

diff --git a/ldns/keys.h b/ldns/keys.h
index ad3ff25bb8de86be3cc73c0c22bcbb6a6c0109e3..c4bf536911f1b367a605f062727b98e06de29a37 100644 (file)
--- a/ldns/keys.h
+++ b/ldns/keys.h
@@ -54,12 +54,8 @@ enum ldns_enum_algorithm
         LDNS_RSASHA256          = 8,   /* RFC 5702 */
         LDNS_RSASHA512          = 10,  /* RFC 5702 */
         LDNS_ECC_GOST           = 12,  /* RFC 5933 */
-#if LDNS_BUILD_CONFIG_USE_ECDSA
-       /* this ifdef has to be removed once it is no longer experimental,
-        * to be able to use these values outside of the ldns library itself */
-        LDNS_ECDSAP256SHA256    = 13,  /* draft-hoffman-dnssec-ecdsa */
-        LDNS_ECDSAP384SHA384    = 14,  /* EXPERIMENTAL */
-#endif
+        LDNS_ECDSAP256SHA256    = 13,  /* RFC 6605 */
+        LDNS_ECDSAP384SHA384    = 14,  /* RFC 6605 */
         LDNS_INDIRECT           = 252,
         LDNS_PRIVATEDNS         = 253,
         LDNS_PRIVATEOID         = 254
@@ -73,12 +69,8 @@ enum ldns_enum_hash
 {
         LDNS_SHA1               = 1,  /* RFC 4034 */
         LDNS_SHA256             = 2,  /* RFC 4509 */
-        LDNS_HASH_GOST          = 3   /* RFC 5933 */
-#if LDNS_BUILD_CONFIG_USE_ECDSA
-       /* this ifdef has to be removed once it is no longer experimental,
-        * to be able to use these values outside of the ldns library itself */
-        ,LDNS_SHA384             = 4   /* draft-hoffman-dnssec-ecdsa EXPERIMENTAL */
-#endif
+        LDNS_HASH_GOST          = 3,  /* RFC 5933 */
+        LDNS_SHA384             = 4   /* RFC 6605 */
 };
 typedef enum ldns_enum_hash ldns_hash;
 
@@ -95,12 +87,8 @@ enum ldns_enum_signing_algorithm
        LDNS_SIGN_RSASHA512      = LDNS_RSASHA512,
        LDNS_SIGN_DSA_NSEC3      = LDNS_DSA_NSEC3,
        LDNS_SIGN_ECC_GOST       = LDNS_ECC_GOST,
-#if LDNS_BUILD_CONFIG_USE_ECDSA
-       /* this ifdef has to be removed once it is no longer experimental,
-        * to be able to use these values outside of the ldns library itself */
         LDNS_SIGN_ECDSAP256SHA256 = LDNS_ECDSAP256SHA256,
         LDNS_SIGN_ECDSAP384SHA384 = LDNS_ECDSAP384SHA384,
-#endif
        LDNS_SIGN_HMACMD5        = 157, /* not official! This type is for TSIG, not DNSSEC */
        LDNS_SIGN_HMACSHA1       = 158, /* not official! This type is for TSIG, not DNSSEC */
        LDNS_SIGN_HMACSHA256 = 159  /* ditto */