lib/dns/opensslrsa_link.c

114 static isc_result_t opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data);
117 opensslrsa_createctx(dst_key_t *key, dst_context_t *dctx) {
120 	const EVP_MD *type = NULL;
123 	UNUSED(key);
124 	REQUIRE(dctx->key->key_alg == DST_ALG_RSAMD5 ||
125 		dctx->key->key_alg == DST_ALG_RSASHA1 ||
126 		dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
127 		dctx->key->key_alg == DST_ALG_RSASHA256 ||
128 		dctx->key->key_alg == DST_ALG_RSASHA512);
135 	switch (dctx->key->key_alg) {
137 		type = EVP_md5();	/* MD5 + RSA */
141 		type = EVP_sha1();	/* SHA1 + RSA */
145 		type = EVP_sha256();	/* SHA256 + RSA */
150 		type = EVP_sha512();
157 	if (!EVP_DigestInit_ex(evp_md_ctx, type, NULL)) {
163 	switch (dctx->key->key_alg) {
225 	REQUIRE(dctx->key->key_alg == DST_ALG_RSAMD5 ||
226 		dctx->key->key_alg == DST_ALG_RSASHA1 ||
227 		dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
228 		dctx->key->key_alg == DST_ALG_RSASHA256 ||
229 		dctx->key->key_alg == DST_ALG_RSASHA512);
237 	switch (dctx->key->key_alg) {
299 	REQUIRE(dctx->key->key_alg == DST_ALG_RSAMD5 ||
300 		dctx->key->key_alg == DST_ALG_RSASHA1 ||
301 		dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
302 		dctx->key->key_alg == DST_ALG_RSASHA256 ||
303 		dctx->key->key_alg == DST_ALG_RSASHA512);
310 	switch (dctx->key->key_alg) {
364 	dst_key_t *key = dctx->key;
369 	EVP_PKEY *pkey = key->keydata.pkey;
371 	RSA *rsa = key->keydata.rsa;
375 	int type = 0;
383 	const unsigned char *prefix = NULL;
387 	REQUIRE(dctx->key->key_alg == DST_ALG_RSAMD5 ||
388 		dctx->key->key_alg == DST_ALG_RSASHA1 ||
389 		dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
390 		dctx->key->key_alg == DST_ALG_RSASHA256 ||
391 		dctx->key->key_alg == DST_ALG_RSASHA512);
406 	switch (dctx->key->key_alg) {
412 			type = NID_md5;
422 			type = NID_sha1;
433 			prefix = sha256_prefix;
436 			type = NID_sha256;
447 			prefix = sha512_prefix;
450 			type = NID_sha512;
459 	switch (dctx->key->key_alg) {
463 		INSIST(type != 0);
464 		status = RSA_sign(type, digest, digestlen, r.base,
470 		INSIST(prefix != NULL);
475 		memcpy(digest, prefix, prefixlen);
489 	INSIST(type != 0);
490 	status = RSA_sign(type, digest, digestlen, r.base, &siglen, rsa);
508 	dst_key_t *key = dctx->key;
512 	EVP_PKEY *pkey = key->keydata.pkey;
516 	int type = 0;
518 	RSA *rsa = key->keydata.rsa;
521 	const unsigned char *prefix = NULL;
525 	REQUIRE(dctx->key->key_alg == DST_ALG_RSAMD5 ||
526 		dctx->key->key_alg == DST_ALG_RSASHA1 ||
527 		dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
528 		dctx->key->key_alg == DST_ALG_RSASHA256 ||
529 		dctx->key->key_alg == DST_ALG_RSASHA512);
534 	switch (dctx->key->key_alg) {
540 			type = NID_md5;
550 			type = NID_sha1;
561 			prefix = sha256_prefix;
564 			type = NID_sha256;
575 			prefix = sha512_prefix;
578 			type = NID_sha512;
590 	switch (dctx->key->key_alg) {
594 		INSIST(type != 0);
595 		status = RSA_verify(type, digest, digestlen, sig->base,
608 			INSIST(prefix != NULL);
621 			if (memcmp(original, prefix, prefixlen))
633 	INSIST(type != 0);
634 	status = RSA_verify(type, digest, digestlen, sig->base,
728 opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
767 	if (RSA_generate_key_ex(rsa, key->key_size, e, &cb)) {
771 		key->keydata.pkey = pkey;
775 		key->keydata.rsa = rsa;
808 	rsa = RSA_generate_key(key->key_size, e, NULL, NULL);
822 	key->keydata.pkey = pkey;
825 	key->keydata.rsa = rsa;
833 opensslrsa_isprivate(const dst_key_t *key) {
835 	RSA *rsa = EVP_PKEY_get1_RSA(key->keydata.pkey);
838 	/* key->keydata.pkey still has a reference so rsa is still valid. */
840 	RSA *rsa = key->keydata.rsa;
848 opensslrsa_destroy(dst_key_t *key) {
850 	EVP_PKEY *pkey = key->keydata.pkey;
852 	key->keydata.pkey = NULL;
854 	RSA *rsa = key->keydata.rsa;
856 	key->keydata.rsa = NULL;
862 opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
873 	REQUIRE(key->keydata.pkey != NULL);
875 	REQUIRE(key->keydata.rsa != NULL);
879 	pkey = key->keydata.pkey;
884 	rsa = key->keydata.rsa;
892 	if (e_bytes < 256) {	/*%< key exponent is <= 2040 bits */
924 opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
968 	key->key_size = BN_num_bits(rsa->n);
983 	key->keydata.pkey = pkey;
986 	key->keydata.rsa = rsa;
993 opensslrsa_tofile(const dst_key_t *key, const char *directory) {
1001 	if (key->keydata.pkey == NULL)
1003 	rsa = EVP_PKEY_get1_RSA(key->keydata.pkey);
1007 	if (key->keydata.rsa == NULL)
1009 	rsa = key->keydata.rsa;
1013 		bufs[i] = isc_mem_get(key->mctx, BN_num_bytes(rsa->n));
1082 	if (key->engine != NULL) {
1084 		priv.elements[i].length = strlen(key->engine) + 1;
1085 		priv.elements[i].data = (unsigned char *)key->engine;
1089 	if (key->label != NULL) {
1091 		priv.elements[i].length = strlen(key->label) + 1;
1092 		priv.elements[i].data = (unsigned char *)key->label;
1098 	result = dst__privstruct_writefile(key, &priv, directory);
1106 		isc_mem_put(key->mctx, bufs[i], BN_num_bytes(rsa->n));
1115 	 * copy them from the public key. */
1138 opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
1146 	isc_mem_t *mctx = key->mctx;
1162 	/* read private key file */
1163 	ret = dst__privstruct_parse(key, DST_ALG_RSA, lexer, mctx, &priv);
1180 	 * Is this key is stored in a HSM?
1195 		key->engine = isc_mem_strdup(key->mctx, engine);
1196 		if (key->engine == NULL)
1198 		key->label = isc_mem_strdup(key->mctx, label);
1199 		if (key->label == NULL)
1208 		key->key_size = EVP_PKEY_bits(pkey);
1210 		key->keydata.pkey = pkey;
1213 		key->keydata.rsa = rsa;
1235 	key->keydata.pkey = pkey;
1237 	key->keydata.rsa = rsa;
1288 	key->key_size = BN_num_bits(rsa->n);
1306 	opensslrsa_destroy(key);
1313 opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
1341 		key->engine = isc_mem_strdup(key->mctx, engine);
1342 		if (key->engine == NULL)
1345 		key->engine = isc_mem_strdup(key->mctx, label);
1346 		if (key->engine == NULL)
1348 		colon = strchr(key->engine, ':');
1352 	key->label = isc_mem_strdup(key->mctx, label);
1353 	if (key->label == NULL)
1362 	key->key_size = EVP_PKEY_bits(pkey);
1364 	key->keydata.pkey = pkey;
1367 	key->keydata.rsa = rsa;
1381 	UNUSED(key);