Fix DH and ECDSA algorithms in PKCS#11 build

diff --git a/bin/pkcs11/pkcs11-keygen.c b/bin/pkcs11/pkcs11-keygen.c
index cbb0155288f05eca75c3a1e1a6b29a390e210d6b..5ec0dbd5b4e62500ac7f9750acb43b64c5fa8b55 100644 (file)
--- a/bin/pkcs11/pkcs11-keygen.c
+++ b/bin/pkcs11/pkcs11-keygen.c
@@ -72,7 +72,6 @@
 #include <pk11/pk11.h>
 #include <pk11/result.h>
 #define WANT_DH_PRIMES
-#define WANT_ECC_CURVES
 #include <pk11/constants.h>
 #include <pkcs11/eddsa.h>
 
@@ -432,8 +431,6 @@ main(int argc, char *argv[]) {
 #ifndef CKM_EDDSA_KEY_PAIR_GEN
                fprintf(stderr, "CKM_EDDSA_KEY_PAIR_GEN is not defined\n");
                usage();
-               UNUSED(pk11_ecc_ed25519);
-               UNUSED(pk11_ecc_ed448);
 #else
                op_type = OP_EDDSA;
                if (bits == 0)

diff --git a/configure b/configure
index eede5abed1fc322474c86250a85d89c44bc70009..14e795daee4fc062e98cd25c8f5c49f08ef666f2 100755 (executable)
--- a/configure
+++ b/configure
@@ -804,6 +804,7 @@ ISC_PLATFORM_GSSAPIHEADER
 ISC_PLATFORM_HAVEGSSAPI
 KRB5_CONFIG
 PKCS11_TOOLS
+PKCS11_TEST
 OPENSSL_LDFLAGS
 OPENSSL_LIBS
 OPENSSL_INCLUDES
@@ -16280,6 +16281,7 @@ esac
 
 
 PKCS11_TOOLS=
+PKCS11_TEST=
 #
 # was --enable-native-pkcs11 specified?
 #
@@ -16299,6 +16301,7 @@ case $enable_native_pkcs11 in #(
 $as_echo "no" >&6; } ;; #(
   yes) :
     PKCS11_TOOLS=pkcs11
+              PKCS11_TEST=pkcs11
               CRYPTO=pkcs11
               if $use_threads; then :
   :
@@ -16318,12 +16321,13 @@ _ACEOF
 fi
 done
 
-               ;; #(
+              ;; #(
   *) :
      ;;
 esac
 
 
+
 case $CRYPTO in #(
   pkcs11) :
 

diff --git a/configure.in b/configure.in
index 71e36e49dcd692fbc834ac1a4e4d56f13766df52..06529609632ae433f46507d5257b0358245638e3 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -1243,6 +1243,7 @@ AS_CASE([$with_cc_alg],
 
 
 PKCS11_TOOLS=
+PKCS11_TEST=
 #
 # was --enable-native-pkcs11 specified?
 #
@@ -1255,13 +1256,15 @@ AC_MSG_CHECKING([for PKCS11 for Public-Key Cryptography])
 AS_CASE([$enable_native_pkcs11],
        [no],[AC_MSG_RESULT([no])],
        [yes],[PKCS11_TOOLS=pkcs11
+              PKCS11_TEST=pkcs11
               CRYPTO=pkcs11
               AS_IF([$use_threads],
                     [:],
                     [AC_MSG_ERROR([PKCS11 requires threading support])])
               AC_MSG_RESULT([yes])
               AC_CHECK_FUNCS([getpassphrase])
-              ])
+             ])
+AC_SUBST([PKCS11_TEST])
 AC_SUBST([PKCS11_TOOLS])
 
 AS_CASE([$CRYPTO],

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index 782413a3b84fb5e170a4d9d4ca113a7ff32b1cc4..2c6e476d6bcb127f205e709dcf4e5dba1a183254 100644 (file)
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -176,6 +176,7 @@ dst_lib_init(isc_mem_t *mctx, const char *engine) {
        RETERR(dst__hmacsha384_init(&dst_t_func[DST_ALG_HMACSHA384]));
        RETERR(dst__hmacsha512_init(&dst_t_func[DST_ALG_HMACSHA512]));
        RETERR(dst__openssl_init(engine));
+       RETERR(dst__openssldh_init(&dst_t_func[DST_ALG_DH]));
 #if USE_OPENSSL
        RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSAMD5],
                                    DST_ALG_RSAMD5));
@@ -189,7 +190,6 @@ dst_lib_init(isc_mem_t *mctx, const char *engine) {
                                    DST_ALG_RSASHA512));
        RETERR(dst__openssldsa_init(&dst_t_func[DST_ALG_DSA]));
        RETERR(dst__openssldsa_init(&dst_t_func[DST_ALG_NSEC3DSA]));
-       RETERR(dst__openssldh_init(&dst_t_func[DST_ALG_DH]));
        RETERR(dst__opensslecdsa_init(&dst_t_func[DST_ALG_ECDSA256]));
        RETERR(dst__opensslecdsa_init(&dst_t_func[DST_ALG_ECDSA384]));
 #ifdef HAVE_OPENSSL_ED25519
@@ -209,10 +209,8 @@ dst_lib_init(isc_mem_t *mctx, const char *engine) {
        RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA512]));
        RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_DSA]));
        RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_NSEC3DSA]));
-#if HAVE_PKCS11_ECDSA
        RETERR(dst__pkcs11ecdsa_init(&dst_t_func[DST_ALG_ECDSA256]));
        RETERR(dst__pkcs11ecdsa_init(&dst_t_func[DST_ALG_ECDSA384]));
-#endif
 #ifdef HAVE_PKCS11_ED25519
        RETERR(dst__pkcs11eddsa_init(&dst_t_func[DST_ALG_ED25519]));
 #endif

diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
index b99e2720f052cfcdc139518f58058648b9ebedd0..351d0d5f87e51384219b7fb7380d1934e56f6af2 100644 (file)
--- a/lib/dns/dst_internal.h
+++ b/lib/dns/dst_internal.h
@@ -223,11 +223,11 @@ isc_result_t dst__hmacsha224_init(struct dst_func **funcp);
 isc_result_t dst__hmacsha256_init(struct dst_func **funcp);
 isc_result_t dst__hmacsha384_init(struct dst_func **funcp);
 isc_result_t dst__hmacsha512_init(struct dst_func **funcp);
+isc_result_t dst__openssldh_init(struct dst_func **funcp);
 #if USE_OPENSSL
 isc_result_t dst__opensslrsa_init(struct dst_func **funcp,
                                  unsigned char algorithm);
 isc_result_t dst__openssldsa_init(struct dst_func **funcp);
-isc_result_t dst__openssldh_init(struct dst_func **funcp);
 isc_result_t dst__opensslecdsa_init(struct dst_func **funcp);
 #if HAVE_OPENSSL_ED25519 || HAVE_OPENSSL_ED448
 isc_result_t dst__openssleddsa_init(struct dst_func **funcp);
@@ -236,9 +236,7 @@ isc_result_t dst__openssleddsa_init(struct dst_func **funcp);
 #if USE_PKCS11
 isc_result_t dst__pkcs11rsa_init(struct dst_func **funcp);
 isc_result_t dst__pkcs11dsa_init(struct dst_func **funcp);
-#ifdef HAVE_PKCS11_ECDSA
 isc_result_t dst__pkcs11ecdsa_init(struct dst_func **funcp);
-#endif
 #if defined(HAVE_PKCS11_ED25519) || defined(HAVE_PKCS11_ED448)
 isc_result_t dst__pkcs11eddsa_init(struct dst_func **funcp);
 #endif

diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
index 1c712ebf37362d1246e748851f59a0ba0a468aca..920e619e5870565eded8c0e0e02de5ab825f231a 100644 (file)
--- a/lib/dns/openssldh_link.c
+++ b/lib/dns/openssldh_link.c
@@ -27,8 +27,6 @@
 
 #include <config.h>
 
-#if !USE_PKCS11
-
 #include <pk11/site.h>
 
 #include <ctype.h>
@@ -763,5 +761,3 @@ dst__openssldh_init(dst_func_t **funcp) {
        if (bn1536 != NULL) BN_free(bn1536);
        return (ISC_R_NOMEMORY);
 }
-
-#endif /* !USE_PKCS11 */

diff --git a/lib/dns/pkcs11ecdsa_link.c b/lib/dns/pkcs11ecdsa_link.c
index 3fbf534e94bdaed81bb721db7a6c729786c66ca8..0d12c6609af245db0b41ffe0c36a26dc18d68213 100644 (file)
--- a/lib/dns/pkcs11ecdsa_link.c
+++ b/lib/dns/pkcs11ecdsa_link.c
@@ -13,7 +13,7 @@
 
 #include <config.h>
 
-#if USE_PKCS11 && HAVE_PKCS11_ECDSA
+#if USE_PKCS11
 
 #include <isc/mem.h>
 #include <isc/safe.h>
@@ -30,7 +30,6 @@
 
 #include <pk11/pk11.h>
 #include <pk11/internal.h>
-#define WANT_ECC_CURVES
 #include <pk11/constants.h>
 
 #include <pkcs11/pkcs11.h>
@@ -95,8 +94,8 @@ pkcs11ecdsa_createctx(dst_key_t *key, dst_context_t *dctx) {
        if (ec->ontoken && (dctx->use == DO_SIGN))
                slotid = ec->slot;
        else
-               slotid = pk11_get_best_token(OP_EC);
-       ret = pk11_get_session(pk11_ctx, OP_EC, ISC_TRUE, ISC_FALSE,
+               slotid = pk11_get_best_token(OP_ECDSA);
+       ret = pk11_get_session(pk11_ctx, OP_ECDSA, ISC_TRUE, ISC_FALSE,
                               ec->reqlogon, NULL, slotid);
        if (ret != ISC_R_SUCCESS)
                goto err;
@@ -493,8 +492,8 @@ pkcs11ecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
                                                  sizeof(*pk11_ctx));
        if (pk11_ctx == NULL)
                return (ISC_R_NOMEMORY);
-       ret = pk11_get_session(pk11_ctx, OP_EC, ISC_TRUE, ISC_FALSE,
-                              ISC_FALSE, NULL, pk11_get_best_token(OP_EC));
+       ret = pk11_get_session(pk11_ctx, OP_ECDSA, ISC_TRUE, ISC_FALSE,
+                              ISC_FALSE, NULL, pk11_get_best_token(OP_ECDSA));
        if (ret != ISC_R_SUCCESS)
                goto err;
 
@@ -852,7 +851,7 @@ pkcs11ecdsa_fetch(dst_key_t *key, const char *engine, const char *label,
        memmove(attr->pValue, pubattr->pValue, pubattr->ulValueLen);
        attr->ulValueLen = pubattr->ulValueLen;
 
-       ret = pk11_parse_uri(ec, label, key->mctx, OP_EC);
+       ret = pk11_parse_uri(ec, label, key->mctx, OP_ECDSA);
        if (ret != ISC_R_SUCCESS)
                goto err;
 
@@ -860,7 +859,7 @@ pkcs11ecdsa_fetch(dst_key_t *key, const char *engine, const char *label,
                                                  sizeof(*pk11_ctx));
        if (pk11_ctx == NULL)
                DST_RET(ISC_R_NOMEMORY);
-       ret = pk11_get_session(pk11_ctx, OP_EC, ISC_TRUE, ISC_FALSE,
+       ret = pk11_get_session(pk11_ctx, OP_ECDSA, ISC_TRUE, ISC_FALSE,
                               ec->reqlogon, NULL, ec->slot);
        if (ret != ISC_R_SUCCESS)
                goto err;
@@ -1065,7 +1064,7 @@ pkcs11ecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
        attr[0].type = CKA_EC_PARAMS;
        attr[1].type = CKA_EC_POINT;
 
-       ret = pk11_parse_uri(ec, label, key->mctx, OP_EC);
+       ret = pk11_parse_uri(ec, label, key->mctx, OP_ECDSA);
        if (ret != ISC_R_SUCCESS)
                goto err;
 
@@ -1073,7 +1072,7 @@ pkcs11ecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
                                                  sizeof(*pk11_ctx));
        if (pk11_ctx == NULL)
                DST_RET(ISC_R_NOMEMORY);
-       ret = pk11_get_session(pk11_ctx, OP_EC, ISC_TRUE, ISC_FALSE,
+       ret = pk11_get_session(pk11_ctx, OP_ECDSA, ISC_TRUE, ISC_FALSE,
                               ec->reqlogon, NULL, ec->slot);
        if (ret != ISC_R_SUCCESS)
                goto err;
@@ -1187,4 +1186,4 @@ dst__pkcs11ecdsa_init(dst_func_t **funcp) {
        return (ISC_R_SUCCESS);
 }
 
-#endif /* USE_PKCS11 && HAVE_PKCS11_ECDSA */
+#endif /* USE_PKCS11 */

diff --git a/lib/dns/pkcs11eddsa_link.c b/lib/dns/pkcs11eddsa_link.c
index 4efacbb892ad1c70f4e9369a3f42f81321524503..a4b53827d1ece34b47c0579391ba9c3de729c351 100644 (file)
--- a/lib/dns/pkcs11eddsa_link.c
+++ b/lib/dns/pkcs11eddsa_link.c
@@ -31,7 +31,6 @@
 
 #include <pk11/pk11.h>
 #include <pk11/internal.h>
-#define WANT_ECC_CURVES
 #include <pk11/constants.h>
 
 #include <pkcs11/pkcs11.h>

diff --git a/lib/isc/include/pk11/constants.h b/lib/isc/include/pk11/constants.h
index 4b263f00d1756bbfb415703cf3d1f5e17366de59..3f16ecbdf7509107ece15468f596b211e29a80c1 100644 (file)
--- a/lib/isc/include/pk11/constants.h
+++ b/lib/isc/include/pk11/constants.h
@@ -18,20 +18,22 @@
 /*%
  * Static arrays of data used for key template initalization
  */
-#ifdef WANT_ECC_CURVES
 static CK_BYTE pk11_ecc_prime256v1[] = {
        0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07
 };
 static CK_BYTE pk11_ecc_secp384r1[] = {
        0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22
 };
+#if HAVE_PKCS11_ED25519
 static CK_BYTE pk11_ecc_ed25519[] = {
        0x06, 0x03, 0x2b, 0x65, 0x70
 };
+#endif /* HAVE_PKCS11_ED25519 */
+#if HAVE_PKCS11_ED448
 static CK_BYTE pk11_ecc_ed448[] = {
        0x06, 0x03, 0x2b, 0x65, 0x71
 };
-#endif
+#endif /* HAVE_PKCS11_ED448 */
 
 #ifdef WANT_DH_PRIMES
 static CK_BYTE pk11_dh_bn2[] = { 2 };