1/* 2 * validator/val_secalgo.c - validator security algorithm functions. 3 * 4 * Copyright (c) 2012, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36/** 37 * \file 38 * 39 * This file contains helper functions for the validator module. 40 * These functions take raw data buffers, formatted for crypto verification, 41 * and do the library calls (for the crypto library in use). 42 */ 43#include "config.h" 44/* packed_rrset on top to define enum types (forced by c99 standard) */ 45#include "util/data/packed_rrset.h" 46#include "validator/val_secalgo.h" 47#include "validator/val_nsec3.h" 48#include "util/log.h" 49#include "sldns/rrdef.h" 50#include "sldns/keyraw.h" 51#include "sldns/sbuffer.h" 52 53#if !defined(HAVE_SSL) && !defined(HAVE_NSS) && !defined(HAVE_NETTLE) 54#error "Need crypto library to do digital signature cryptography" 55#endif 56 57/** fake DSA support for unit tests */ 58int fake_dsa = 0; 59/** fake SHA1 support for unit tests */ 60int fake_sha1 = 0; 61 62/* OpenSSL implementation */ 63#ifdef HAVE_SSL 64#ifdef HAVE_OPENSSL_ERR_H 65#include <openssl/err.h> 66#endif 67 68#ifdef HAVE_OPENSSL_RAND_H 69#include <openssl/rand.h> 70#endif 71 72#ifdef HAVE_OPENSSL_CONF_H 73#include <openssl/conf.h> 74#endif 75 76#ifdef HAVE_OPENSSL_ENGINE_H 77#include <openssl/engine.h> 78#endif 79 80#if defined(HAVE_OPENSSL_DSA_H) && defined(USE_DSA) 81#include <openssl/dsa.h> 82#endif 83 84/** 85 * Output a libcrypto openssl error to the logfile. 86 * @param str: string to add to it. 87 * @param e: the error to output, error number from ERR_get_error(). 88 */ 89static void 90log_crypto_error(const char* str, unsigned long e) 91{ 92 char buf[128]; 93 /* or use ERR_error_string if ERR_error_string_n is not avail TODO */ 94 ERR_error_string_n(e, buf, sizeof(buf)); 95 /* buf now contains */ 96 /* error:[error code]:[library name]:[function name]:[reason string] */ 97 log_err("%s crypto %s", str, buf); 98} 99 100/* return size of digest if supported, or 0 otherwise */ 101size_t 102nsec3_hash_algo_size_supported(int id) 103{ 104 switch(id) { 105 case NSEC3_HASH_SHA1: 106 return SHA_DIGEST_LENGTH; 107 default: 108 return 0; 109 } 110} 111 112/* perform nsec3 hash. return false on failure */ 113int 114secalgo_nsec3_hash(int algo, unsigned char* buf, size_t len, 115 unsigned char* res) 116{ 117 switch(algo) { 118 case NSEC3_HASH_SHA1: 119#ifdef OPENSSL_FIPS 120 if(!sldns_digest_evp(buf, len, res, EVP_sha1())) 121 log_crypto_error("could not digest with EVP_sha1", 122 ERR_get_error()); 123#else 124 (void)SHA1(buf, len, res); 125#endif 126 return 1; 127 default: 128 return 0; 129 } 130} 131 132void 133secalgo_hash_sha256(unsigned char* buf, size_t len, unsigned char* res) 134{ 135#ifdef OPENSSL_FIPS 136 if(!sldns_digest_evp(buf, len, res, EVP_sha256())) 137 log_crypto_error("could not digest with EVP_sha256", 138 ERR_get_error()); 139#else 140 (void)SHA256(buf, len, res); 141#endif 142} 143 144/** 145 * Return size of DS digest according to its hash algorithm. 146 * @param algo: DS digest algo. 147 * @return size in bytes of digest, or 0 if not supported. 148 */ 149size_t 150ds_digest_size_supported(int algo) 151{ 152 switch(algo) { 153 case LDNS_SHA1: 154#if defined(HAVE_EVP_SHA1) && defined(USE_SHA1) 155 return SHA_DIGEST_LENGTH; 156#else 157 if(fake_sha1) return 20; 158 return 0; 159#endif 160#ifdef HAVE_EVP_SHA256 161 case LDNS_SHA256: 162 return SHA256_DIGEST_LENGTH; 163#endif 164#ifdef USE_GOST 165 case LDNS_HASH_GOST: 166 /* we support GOST if it can be loaded */ 167 (void)sldns_key_EVP_load_gost_id(); 168 if(EVP_get_digestbyname("md_gost94")) 169 return 32; 170 else return 0; 171#endif 172#ifdef USE_ECDSA 173 case LDNS_SHA384: 174 return SHA384_DIGEST_LENGTH; 175#endif 176 default: break; 177 } 178 return 0; 179} 180 181#ifdef USE_GOST 182/** Perform GOST hash */ 183static int 184do_gost94(unsigned char* data, size_t len, unsigned char* dest) 185{ 186 const EVP_MD* md = EVP_get_digestbyname("md_gost94"); 187 if(!md) 188 return 0; 189 return sldns_digest_evp(data, (unsigned int)len, dest, md); 190} 191#endif 192 193int 194secalgo_ds_digest(int algo, unsigned char* buf, size_t len, 195 unsigned char* res) 196{ 197 switch(algo) { 198#if defined(HAVE_EVP_SHA1) && defined(USE_SHA1) 199 case LDNS_SHA1: 200#ifdef OPENSSL_FIPS 201 if(!sldns_digest_evp(buf, len, res, EVP_sha1())) 202 log_crypto_error("could not digest with EVP_sha1", 203 ERR_get_error()); 204#else 205 (void)SHA1(buf, len, res); 206#endif 207 return 1; 208#endif 209#ifdef HAVE_EVP_SHA256 210 case LDNS_SHA256: 211#ifdef OPENSSL_FIPS 212 if(!sldns_digest_evp(buf, len, res, EVP_sha256())) 213 log_crypto_error("could not digest with EVP_sha256", 214 ERR_get_error()); 215#else 216 (void)SHA256(buf, len, res); 217#endif 218 return 1; 219#endif 220#ifdef USE_GOST 221 case LDNS_HASH_GOST: 222 if(do_gost94(buf, len, res)) 223 return 1; 224 break; 225#endif 226#ifdef USE_ECDSA 227 case LDNS_SHA384: 228#ifdef OPENSSL_FIPS 229 if(!sldns_digest_evp(buf, len, res, EVP_sha384())) 230 log_crypto_error("could not digest with EVP_sha384", 231 ERR_get_error()); 232#else 233 (void)SHA384(buf, len, res); 234#endif 235 return 1; 236#endif 237 default: 238 verbose(VERB_QUERY, "unknown DS digest algorithm %d", 239 algo); 240 break; 241 } 242 return 0; 243} 244 245/** return true if DNSKEY algorithm id is supported */ 246int 247dnskey_algo_id_is_supported(int id) 248{ 249 switch(id) { 250 case LDNS_RSAMD5: 251 /* RFC 6725 deprecates RSAMD5 */ 252 return 0; 253 case LDNS_DSA: 254 case LDNS_DSA_NSEC3: 255#if defined(USE_DSA) && defined(USE_SHA1) 256 return 1; 257#else 258 if(fake_dsa || fake_sha1) return 1; 259 return 0; 260#endif 261 262 case LDNS_RSASHA1: 263 case LDNS_RSASHA1_NSEC3: 264#ifdef USE_SHA1 265 return 1; 266#else 267 if(fake_sha1) return 1; 268 return 0; 269#endif 270 271#if defined(HAVE_EVP_SHA256) && defined(USE_SHA2) 272 case LDNS_RSASHA256: 273#endif 274#if defined(HAVE_EVP_SHA512) && defined(USE_SHA2) 275 case LDNS_RSASHA512: 276#endif 277#ifdef USE_ECDSA 278 case LDNS_ECDSAP256SHA256: 279 case LDNS_ECDSAP384SHA384: 280#endif 281#ifdef USE_ED25519 282 case LDNS_ED25519: 283#endif 284#ifdef USE_ED448 285 case LDNS_ED448: 286#endif 287#if (defined(HAVE_EVP_SHA256) && defined(USE_SHA2)) || (defined(HAVE_EVP_SHA512) && defined(USE_SHA2)) || defined(USE_ECDSA) || defined(USE_ED25519) || defined(USE_ED448) 288 return 1; 289#endif 290 291#ifdef USE_GOST 292 case LDNS_ECC_GOST: 293 /* we support GOST if it can be loaded */ 294 return sldns_key_EVP_load_gost_id(); 295#endif 296 default: 297 return 0; 298 } 299} 300 301#ifdef USE_DSA 302/** 303 * Setup DSA key digest in DER encoding ... 304 * @param sig: input is signature output alloced ptr (unless failure). 305 * caller must free alloced ptr if this routine returns true. 306 * @param len: input is initial siglen, output is output len. 307 * @return false on failure. 308 */ 309static int 310setup_dsa_sig(unsigned char** sig, unsigned int* len) 311{ 312 unsigned char* orig = *sig; 313 unsigned int origlen = *len; 314 int newlen; 315 BIGNUM *R, *S; 316 DSA_SIG *dsasig; 317 318 /* extract the R and S field from the sig buffer */ 319 if(origlen < 1 + 2*SHA_DIGEST_LENGTH) 320 return 0; 321 R = BN_new(); 322 if(!R) return 0; 323 (void) BN_bin2bn(orig + 1, SHA_DIGEST_LENGTH, R); 324 S = BN_new(); 325 if(!S) return 0; 326 (void) BN_bin2bn(orig + 21, SHA_DIGEST_LENGTH, S); 327 dsasig = DSA_SIG_new(); 328 if(!dsasig) return 0; 329 330#ifdef HAVE_DSA_SIG_SET0 331 if(!DSA_SIG_set0(dsasig, R, S)) return 0; 332#else 333# ifndef S_SPLINT_S 334 dsasig->r = R; 335 dsasig->s = S; 336# endif /* S_SPLINT_S */ 337#endif 338 *sig = NULL; 339 newlen = i2d_DSA_SIG(dsasig, sig); 340 if(newlen < 0) { 341 DSA_SIG_free(dsasig); 342 free(*sig); 343 return 0; 344 } 345 *len = (unsigned int)newlen; 346 DSA_SIG_free(dsasig); 347 return 1; 348} 349#endif /* USE_DSA */ 350 351#ifdef USE_ECDSA 352/** 353 * Setup the ECDSA signature in its encoding that the library wants. 354 * Converts from plain numbers to ASN formatted. 355 * @param sig: input is signature, output alloced ptr (unless failure). 356 * caller must free alloced ptr if this routine returns true. 357 * @param len: input is initial siglen, output is output len. 358 * @return false on failure. 359 */ 360static int 361setup_ecdsa_sig(unsigned char** sig, unsigned int* len) 362{ 363 /* convert from two BIGNUMs in the rdata buffer, to ASN notation. 364 * ASN preamble: 30440220 <R 32bytefor256> 0220 <S 32bytefor256> 365 * the '20' is the length of that field (=bnsize). 366i * the '44' is the total remaining length. 367 * if negative, start with leading zero. 368 * if starts with 00s, remove them from the number. 369 */ 370 uint8_t pre[] = {0x30, 0x44, 0x02, 0x20}; 371 int pre_len = 4; 372 uint8_t mid[] = {0x02, 0x20}; 373 int mid_len = 2; 374 int raw_sig_len, r_high, s_high, r_rem=0, s_rem=0; 375 int bnsize = (int)((*len)/2); 376 unsigned char* d = *sig; 377 uint8_t* p; 378 /* if too short or not even length, fails */ 379 if(*len < 16 || bnsize*2 != (int)*len) 380 return 0; 381 382 /* strip leading zeroes from r (but not last one) */ 383 while(r_rem < bnsize-1 && d[r_rem] == 0) 384 r_rem++; 385 /* strip leading zeroes from s (but not last one) */ 386 while(s_rem < bnsize-1 && d[bnsize+s_rem] == 0) 387 s_rem++; 388 389 r_high = ((d[0+r_rem]&0x80)?1:0); 390 s_high = ((d[bnsize+s_rem]&0x80)?1:0); 391 raw_sig_len = pre_len + r_high + bnsize - r_rem + mid_len + 392 s_high + bnsize - s_rem; 393 *sig = (unsigned char*)malloc((size_t)raw_sig_len); 394 if(!*sig) 395 return 0; 396 p = (uint8_t*)*sig; 397 p[0] = pre[0]; 398 p[1] = (uint8_t)(raw_sig_len-2); 399 p[2] = pre[2]; 400 p[3] = (uint8_t)(bnsize + r_high - r_rem); 401 p += 4; 402 if(r_high) { 403 *p = 0; 404 p += 1; 405 } 406 memmove(p, d+r_rem, (size_t)bnsize-r_rem); 407 p += bnsize-r_rem; 408 memmove(p, mid, (size_t)mid_len-1); 409 p += mid_len-1; 410 *p = (uint8_t)(bnsize + s_high - s_rem); 411 p += 1; 412 if(s_high) { 413 *p = 0; 414 p += 1; 415 } 416 memmove(p, d+bnsize+s_rem, (size_t)bnsize-s_rem); 417 *len = (unsigned int)raw_sig_len; 418 return 1; 419} 420#endif /* USE_ECDSA */ 421 422#ifdef USE_ECDSA_EVP_WORKAROUND 423static EVP_MD ecdsa_evp_256_md; 424static EVP_MD ecdsa_evp_384_md; 425void ecdsa_evp_workaround_init(void) 426{ 427 /* openssl before 1.0.0 fixes RSA with the SHA256 428 * hash in EVP. We create one for ecdsa_sha256 */ 429 ecdsa_evp_256_md = *EVP_sha256(); 430 ecdsa_evp_256_md.required_pkey_type[0] = EVP_PKEY_EC; 431 ecdsa_evp_256_md.verify = (void*)ECDSA_verify; 432 433 ecdsa_evp_384_md = *EVP_sha384(); 434 ecdsa_evp_384_md.required_pkey_type[0] = EVP_PKEY_EC; 435 ecdsa_evp_384_md.verify = (void*)ECDSA_verify; 436} 437#endif /* USE_ECDSA_EVP_WORKAROUND */ 438 439/** 440 * Setup key and digest for verification. Adjust sig if necessary. 441 * 442 * @param algo: key algorithm 443 * @param evp_key: EVP PKEY public key to create. 444 * @param digest_type: digest type to use 445 * @param key: key to setup for. 446 * @param keylen: length of key. 447 * @return false on failure. 448 */ 449static int 450setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type, 451 unsigned char* key, size_t keylen) 452{ 453#if defined(USE_DSA) && defined(USE_SHA1) 454 DSA* dsa; 455#endif 456 RSA* rsa; 457 458 switch(algo) { 459#if defined(USE_DSA) && defined(USE_SHA1) 460 case LDNS_DSA: 461 case LDNS_DSA_NSEC3: 462 *evp_key = EVP_PKEY_new(); 463 if(!*evp_key) { 464 log_err("verify: malloc failure in crypto"); 465 return 0; 466 } 467 dsa = sldns_key_buf2dsa_raw(key, keylen); 468 if(!dsa) { 469 verbose(VERB_QUERY, "verify: " 470 "sldns_key_buf2dsa_raw failed"); 471 return 0; 472 } 473 if(EVP_PKEY_assign_DSA(*evp_key, dsa) == 0) { 474 verbose(VERB_QUERY, "verify: " 475 "EVP_PKEY_assign_DSA failed"); 476 return 0; 477 } 478#ifdef HAVE_EVP_DSS1 479 *digest_type = EVP_dss1(); 480#else 481 *digest_type = EVP_sha1(); 482#endif 483 484 break; 485#endif /* USE_DSA && USE_SHA1 */ 486 487#if defined(USE_SHA1) || (defined(HAVE_EVP_SHA256) && defined(USE_SHA2)) || (defined(HAVE_EVP_SHA512) && defined(USE_SHA2)) 488#ifdef USE_SHA1 489 case LDNS_RSASHA1: 490 case LDNS_RSASHA1_NSEC3: 491#endif 492#if defined(HAVE_EVP_SHA256) && defined(USE_SHA2) 493 case LDNS_RSASHA256: 494#endif 495#if defined(HAVE_EVP_SHA512) && defined(USE_SHA2) 496 case LDNS_RSASHA512: 497#endif 498 *evp_key = EVP_PKEY_new(); 499 if(!*evp_key) { 500 log_err("verify: malloc failure in crypto"); 501 return 0; 502 } 503 rsa = sldns_key_buf2rsa_raw(key, keylen); 504 if(!rsa) { 505 verbose(VERB_QUERY, "verify: " 506 "sldns_key_buf2rsa_raw SHA failed"); 507 return 0; 508 } 509 if(EVP_PKEY_assign_RSA(*evp_key, rsa) == 0) { 510 verbose(VERB_QUERY, "verify: " 511 "EVP_PKEY_assign_RSA SHA failed"); 512 return 0; 513 } 514 515 /* select SHA version */ 516#if defined(HAVE_EVP_SHA256) && defined(USE_SHA2) 517 if(algo == LDNS_RSASHA256) 518 *digest_type = EVP_sha256(); 519 else 520#endif 521#if defined(HAVE_EVP_SHA512) && defined(USE_SHA2) 522 if(algo == LDNS_RSASHA512) 523 *digest_type = EVP_sha512(); 524 else 525#endif 526#ifdef USE_SHA1 527 *digest_type = EVP_sha1(); 528#else 529 { verbose(VERB_QUERY, "no digest available"); return 0; } 530#endif 531 break; 532#endif /* defined(USE_SHA1) || (defined(HAVE_EVP_SHA256) && defined(USE_SHA2)) || (defined(HAVE_EVP_SHA512) && defined(USE_SHA2)) */ 533 534 case LDNS_RSAMD5: 535 *evp_key = EVP_PKEY_new(); 536 if(!*evp_key) { 537 log_err("verify: malloc failure in crypto"); 538 return 0; 539 } 540 rsa = sldns_key_buf2rsa_raw(key, keylen); 541 if(!rsa) { 542 verbose(VERB_QUERY, "verify: " 543 "sldns_key_buf2rsa_raw MD5 failed"); 544 return 0; 545 } 546 if(EVP_PKEY_assign_RSA(*evp_key, rsa) == 0) { 547 verbose(VERB_QUERY, "verify: " 548 "EVP_PKEY_assign_RSA MD5 failed"); 549 return 0; 550 } 551 *digest_type = EVP_md5(); 552 553 break; 554#ifdef USE_GOST 555 case LDNS_ECC_GOST: 556 *evp_key = sldns_gost2pkey_raw(key, keylen); 557 if(!*evp_key) { 558 verbose(VERB_QUERY, "verify: " 559 "sldns_gost2pkey_raw failed"); 560 return 0; 561 } 562 *digest_type = EVP_get_digestbyname("md_gost94"); 563 if(!*digest_type) { 564 verbose(VERB_QUERY, "verify: " 565 "EVP_getdigest md_gost94 failed"); 566 return 0; 567 } 568 break; 569#endif 570#ifdef USE_ECDSA 571 case LDNS_ECDSAP256SHA256: 572 *evp_key = sldns_ecdsa2pkey_raw(key, keylen, 573 LDNS_ECDSAP256SHA256); 574 if(!*evp_key) { 575 verbose(VERB_QUERY, "verify: " 576 "sldns_ecdsa2pkey_raw failed"); 577 return 0; 578 } 579#ifdef USE_ECDSA_EVP_WORKAROUND 580 *digest_type = &ecdsa_evp_256_md; 581#else 582 *digest_type = EVP_sha256(); 583#endif 584 break; 585 case LDNS_ECDSAP384SHA384: 586 *evp_key = sldns_ecdsa2pkey_raw(key, keylen, 587 LDNS_ECDSAP384SHA384); 588 if(!*evp_key) { 589 verbose(VERB_QUERY, "verify: " 590 "sldns_ecdsa2pkey_raw failed"); 591 return 0; 592 } 593#ifdef USE_ECDSA_EVP_WORKAROUND 594 *digest_type = &ecdsa_evp_384_md; 595#else 596 *digest_type = EVP_sha384(); 597#endif 598 break; 599#endif /* USE_ECDSA */ 600#ifdef USE_ED25519 601 case LDNS_ED25519: 602 *evp_key = sldns_ed255192pkey_raw(key, keylen); 603 if(!*evp_key) { 604 verbose(VERB_QUERY, "verify: " 605 "sldns_ed255192pkey_raw failed"); 606 return 0; 607 } 608 *digest_type = NULL; 609 break; 610#endif /* USE_ED25519 */ 611#ifdef USE_ED448 612 case LDNS_ED448: 613 *evp_key = sldns_ed4482pkey_raw(key, keylen); 614 if(!*evp_key) { 615 verbose(VERB_QUERY, "verify: " 616 "sldns_ed4482pkey_raw failed"); 617 return 0; 618 } 619 *digest_type = NULL; 620 break; 621#endif /* USE_ED448 */ 622 default: 623 verbose(VERB_QUERY, "verify: unknown algorithm %d", 624 algo); 625 return 0; 626 } 627 return 1; 628} 629 630/** 631 * Check a canonical sig+rrset and signature against a dnskey 632 * @param buf: buffer with data to verify, the first rrsig part and the 633 * canonicalized rrset. 634 * @param algo: DNSKEY algorithm. 635 * @param sigblock: signature rdata field from RRSIG 636 * @param sigblock_len: length of sigblock data. 637 * @param key: public key data from DNSKEY RR. 638 * @param keylen: length of keydata. 639 * @param reason: bogus reason in more detail. 640 * @return secure if verification succeeded, bogus on crypto failure, 641 * unchecked on format errors and alloc failures. 642 */ 643enum sec_status 644verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock, 645 unsigned int sigblock_len, unsigned char* key, unsigned int keylen, 646 char** reason) 647{ 648 const EVP_MD *digest_type; 649 EVP_MD_CTX* ctx; 650 int res, dofree = 0, docrypto_free = 0; 651 EVP_PKEY *evp_key = NULL; 652 653#ifndef USE_DSA 654 if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3) &&(fake_dsa||fake_sha1)) 655 return sec_status_secure; 656#endif 657#ifndef USE_SHA1 658 if(fake_sha1 && (algo == LDNS_DSA || algo == LDNS_DSA_NSEC3 || algo == LDNS_RSASHA1 || algo == LDNS_RSASHA1_NSEC3)) 659 return sec_status_secure; 660#endif 661 662 if(!setup_key_digest(algo, &evp_key, &digest_type, key, keylen)) { 663 verbose(VERB_QUERY, "verify: failed to setup key"); 664 *reason = "use of key for crypto failed"; 665 EVP_PKEY_free(evp_key); 666 return sec_status_bogus; 667 } 668#ifdef USE_DSA 669 /* if it is a DSA signature in bind format, convert to DER format */ 670 if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3) && 671 sigblock_len == 1+2*SHA_DIGEST_LENGTH) { 672 if(!setup_dsa_sig(&sigblock, &sigblock_len)) { 673 verbose(VERB_QUERY, "verify: failed to setup DSA sig"); 674 *reason = "use of key for DSA crypto failed"; 675 EVP_PKEY_free(evp_key); 676 return sec_status_bogus; 677 } 678 docrypto_free = 1; 679 } 680#endif 681#if defined(USE_ECDSA) && defined(USE_DSA) 682 else 683#endif 684#ifdef USE_ECDSA 685 if(algo == LDNS_ECDSAP256SHA256 || algo == LDNS_ECDSAP384SHA384) { 686 /* EVP uses ASN prefix on sig, which is not in the wire data */ 687 if(!setup_ecdsa_sig(&sigblock, &sigblock_len)) { 688 verbose(VERB_QUERY, "verify: failed to setup ECDSA sig"); 689 *reason = "use of signature for ECDSA crypto failed"; 690 EVP_PKEY_free(evp_key); 691 return sec_status_bogus; 692 } 693 dofree = 1; 694 } 695#endif /* USE_ECDSA */ 696 697 /* do the signature cryptography work */ 698#ifdef HAVE_EVP_MD_CTX_NEW 699 ctx = EVP_MD_CTX_new(); 700#else 701 ctx = (EVP_MD_CTX*)malloc(sizeof(*ctx)); 702 if(ctx) EVP_MD_CTX_init(ctx); 703#endif 704 if(!ctx) { 705 log_err("EVP_MD_CTX_new: malloc failure"); 706 EVP_PKEY_free(evp_key); 707 if(dofree) free(sigblock); 708 else if(docrypto_free) OPENSSL_free(sigblock); 709 return sec_status_unchecked; 710 } 711#ifndef HAVE_EVP_DIGESTVERIFY 712 if(EVP_DigestInit(ctx, digest_type) == 0) { 713 verbose(VERB_QUERY, "verify: EVP_DigestInit failed"); 714#ifdef HAVE_EVP_MD_CTX_NEW 715 EVP_MD_CTX_destroy(ctx); 716#else 717 EVP_MD_CTX_cleanup(ctx); 718 free(ctx); 719#endif 720 EVP_PKEY_free(evp_key); 721 if(dofree) free(sigblock); 722 else if(docrypto_free) OPENSSL_free(sigblock); 723 return sec_status_unchecked; 724 } 725 if(EVP_DigestUpdate(ctx, (unsigned char*)sldns_buffer_begin(buf), 726 (unsigned int)sldns_buffer_limit(buf)) == 0) { 727 verbose(VERB_QUERY, "verify: EVP_DigestUpdate failed"); 728#ifdef HAVE_EVP_MD_CTX_NEW 729 EVP_MD_CTX_destroy(ctx); 730#else 731 EVP_MD_CTX_cleanup(ctx); 732 free(ctx); 733#endif 734 EVP_PKEY_free(evp_key); 735 if(dofree) free(sigblock); 736 else if(docrypto_free) OPENSSL_free(sigblock); 737 return sec_status_unchecked; 738 } 739 740 res = EVP_VerifyFinal(ctx, sigblock, sigblock_len, evp_key); 741#else /* HAVE_EVP_DIGESTVERIFY */ 742 if(EVP_DigestVerifyInit(ctx, NULL, digest_type, NULL, evp_key) == 0) { 743 verbose(VERB_QUERY, "verify: EVP_DigestVerifyInit failed"); 744#ifdef HAVE_EVP_MD_CTX_NEW 745 EVP_MD_CTX_destroy(ctx); 746#else 747 EVP_MD_CTX_cleanup(ctx); 748 free(ctx); 749#endif 750 EVP_PKEY_free(evp_key); 751 if(dofree) free(sigblock); 752 else if(docrypto_free) OPENSSL_free(sigblock); 753 return sec_status_unchecked; 754 } 755 res = EVP_DigestVerify(ctx, sigblock, sigblock_len, 756 (unsigned char*)sldns_buffer_begin(buf), 757 sldns_buffer_limit(buf)); 758#endif 759#ifdef HAVE_EVP_MD_CTX_NEW 760 EVP_MD_CTX_destroy(ctx); 761#else 762 EVP_MD_CTX_cleanup(ctx); 763 free(ctx); 764#endif 765 EVP_PKEY_free(evp_key); 766 767 if(dofree) free(sigblock); 768 else if(docrypto_free) OPENSSL_free(sigblock); 769 770 if(res == 1) { 771 return sec_status_secure; 772 } else if(res == 0) { 773 verbose(VERB_QUERY, "verify: signature mismatch"); 774 *reason = "signature crypto failed"; 775 return sec_status_bogus; 776 } 777 778 log_crypto_error("verify:", ERR_get_error()); 779 return sec_status_unchecked; 780} 781 782/**************************************************/ 783#elif defined(HAVE_NSS) 784/* libnss implementation */ 785/* nss3 */ 786#include "sechash.h" 787#include "pk11pub.h" 788#include "keyhi.h" 789#include "secerr.h" 790#include "cryptohi.h" 791/* nspr4 */ 792#include "prerror.h" 793 794/* return size of digest if supported, or 0 otherwise */ 795size_t 796nsec3_hash_algo_size_supported(int id) 797{ 798 switch(id) { 799 case NSEC3_HASH_SHA1: 800 return SHA1_LENGTH; 801 default: 802 return 0; 803 } 804} 805 806/* perform nsec3 hash. return false on failure */ 807int 808secalgo_nsec3_hash(int algo, unsigned char* buf, size_t len, 809 unsigned char* res) 810{ 811 switch(algo) { 812 case NSEC3_HASH_SHA1: 813 (void)HASH_HashBuf(HASH_AlgSHA1, res, buf, (unsigned long)len); 814 return 1; 815 default: 816 return 0; 817 } 818} 819 820void 821secalgo_hash_sha256(unsigned char* buf, size_t len, unsigned char* res) 822{ 823 (void)HASH_HashBuf(HASH_AlgSHA256, res, buf, (unsigned long)len); 824} 825 826size_t 827ds_digest_size_supported(int algo) 828{ 829 /* uses libNSS */ 830 switch(algo) { 831#ifdef USE_SHA1 832 case LDNS_SHA1: 833 return SHA1_LENGTH; 834#endif 835#ifdef USE_SHA2 836 case LDNS_SHA256: 837 return SHA256_LENGTH; 838#endif 839#ifdef USE_ECDSA 840 case LDNS_SHA384: 841 return SHA384_LENGTH; 842#endif 843 /* GOST not supported in NSS */ 844 case LDNS_HASH_GOST: 845 default: break; 846 } 847 return 0; 848} 849 850int 851secalgo_ds_digest(int algo, unsigned char* buf, size_t len, 852 unsigned char* res) 853{ 854 /* uses libNSS */ 855 switch(algo) { 856#ifdef USE_SHA1 857 case LDNS_SHA1: 858 return HASH_HashBuf(HASH_AlgSHA1, res, buf, len) 859 == SECSuccess; 860#endif 861#if defined(USE_SHA2) 862 case LDNS_SHA256: 863 return HASH_HashBuf(HASH_AlgSHA256, res, buf, len) 864 == SECSuccess; 865#endif 866#ifdef USE_ECDSA 867 case LDNS_SHA384: 868 return HASH_HashBuf(HASH_AlgSHA384, res, buf, len) 869 == SECSuccess; 870#endif 871 case LDNS_HASH_GOST: 872 default: 873 verbose(VERB_QUERY, "unknown DS digest algorithm %d", 874 algo); 875 break; 876 } 877 return 0; 878} 879 880int 881dnskey_algo_id_is_supported(int id) 882{ 883 /* uses libNSS */ 884 switch(id) { 885 case LDNS_RSAMD5: 886 /* RFC 6725 deprecates RSAMD5 */ 887 return 0; 888#if defined(USE_SHA1) || defined(USE_SHA2) 889#if defined(USE_DSA) && defined(USE_SHA1) 890 case LDNS_DSA: 891 case LDNS_DSA_NSEC3: 892#endif 893#ifdef USE_SHA1 894 case LDNS_RSASHA1: 895 case LDNS_RSASHA1_NSEC3: 896#endif 897#ifdef USE_SHA2 898 case LDNS_RSASHA256: 899#endif 900#ifdef USE_SHA2 901 case LDNS_RSASHA512: 902#endif 903 return 1; 904#endif /* SHA1 or SHA2 */ 905 906#ifdef USE_ECDSA 907 case LDNS_ECDSAP256SHA256: 908 case LDNS_ECDSAP384SHA384: 909 return PK11_TokenExists(CKM_ECDSA); 910#endif 911 case LDNS_ECC_GOST: 912 default: 913 return 0; 914 } 915} 916 917/* return a new public key for NSS */ 918static SECKEYPublicKey* nss_key_create(KeyType ktype) 919{ 920 SECKEYPublicKey* key; 921 PLArenaPool* arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); 922 if(!arena) { 923 log_err("out of memory, PORT_NewArena failed"); 924 return NULL; 925 } 926 key = PORT_ArenaZNew(arena, SECKEYPublicKey); 927 if(!key) { 928 log_err("out of memory, PORT_ArenaZNew failed"); 929 PORT_FreeArena(arena, PR_FALSE); 930 return NULL; 931 } 932 key->arena = arena; 933 key->keyType = ktype; 934 key->pkcs11Slot = NULL; 935 key->pkcs11ID = CK_INVALID_HANDLE; 936 return key; 937} 938 939static SECKEYPublicKey* nss_buf2ecdsa(unsigned char* key, size_t len, int algo) 940{ 941 SECKEYPublicKey* pk; 942 SECItem pub = {siBuffer, NULL, 0}; 943 SECItem params = {siBuffer, NULL, 0}; 944 static unsigned char param256[] = { 945 /* OBJECTIDENTIFIER 1.2.840.10045.3.1.7 (P-256) 946 * {iso(1) member-body(2) us(840) ansi-x962(10045) curves(3) prime(1) prime256v1(7)} */ 947 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07 948 }; 949 static unsigned char param384[] = { 950 /* OBJECTIDENTIFIER 1.3.132.0.34 (P-384) 951 * {iso(1) identified-organization(3) certicom(132) curve(0) ansip384r1(34)} */ 952 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22 953 }; 954 unsigned char buf[256+2]; /* sufficient for 2*384/8+1 */ 955 956 /* check length, which uncompressed must be 2 bignums */ 957 if(algo == LDNS_ECDSAP256SHA256) { 958 if(len != 2*256/8) return NULL; 959 /* ECCurve_X9_62_PRIME_256V1 */ 960 } else if(algo == LDNS_ECDSAP384SHA384) { 961 if(len != 2*384/8) return NULL; 962 /* ECCurve_X9_62_PRIME_384R1 */ 963 } else return NULL; 964 965 buf[0] = 0x04; /* POINT_FORM_UNCOMPRESSED */ 966 memmove(buf+1, key, len); 967 pub.data = buf; 968 pub.len = len+1; 969 if(algo == LDNS_ECDSAP256SHA256) { 970 params.data = param256; 971 params.len = sizeof(param256); 972 } else { 973 params.data = param384; 974 params.len = sizeof(param384); 975 } 976 977 pk = nss_key_create(ecKey); 978 if(!pk) 979 return NULL; 980 pk->u.ec.size = (len/2)*8; 981 if(SECITEM_CopyItem(pk->arena, &pk->u.ec.publicValue, &pub)) { 982 SECKEY_DestroyPublicKey(pk); 983 return NULL; 984 } 985 if(SECITEM_CopyItem(pk->arena, &pk->u.ec.DEREncodedParams, ¶ms)) { 986 SECKEY_DestroyPublicKey(pk); 987 return NULL; 988 } 989 990 return pk; 991} 992 993#if defined(USE_DSA) && defined(USE_SHA1) 994static SECKEYPublicKey* nss_buf2dsa(unsigned char* key, size_t len) 995{ 996 SECKEYPublicKey* pk; 997 uint8_t T; 998 uint16_t length; 999 uint16_t offset; 1000 SECItem Q = {siBuffer, NULL, 0}; 1001 SECItem P = {siBuffer, NULL, 0}; 1002 SECItem G = {siBuffer, NULL, 0}; 1003 SECItem Y = {siBuffer, NULL, 0}; 1004 1005 if(len == 0) 1006 return NULL; 1007 T = (uint8_t)key[0]; 1008 length = (64 + T * 8); 1009 offset = 1; 1010 1011 if (T > 8) { 1012 return NULL; 1013 } 1014 if(len < (size_t)1 + SHA1_LENGTH + 3*length) 1015 return NULL; 1016 1017 Q.data = key+offset; 1018 Q.len = SHA1_LENGTH; 1019 offset += SHA1_LENGTH; 1020 1021 P.data = key+offset; 1022 P.len = length; 1023 offset += length; 1024 1025 G.data = key+offset; 1026 G.len = length; 1027 offset += length; 1028 1029 Y.data = key+offset; 1030 Y.len = length; 1031 offset += length; 1032 1033 pk = nss_key_create(dsaKey); 1034 if(!pk) 1035 return NULL; 1036 if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.params.prime, &P)) { 1037 SECKEY_DestroyPublicKey(pk); 1038 return NULL; 1039 } 1040 if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.params.subPrime, &Q)) { 1041 SECKEY_DestroyPublicKey(pk); 1042 return NULL; 1043 } 1044 if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.params.base, &G)) { 1045 SECKEY_DestroyPublicKey(pk); 1046 return NULL; 1047 } 1048 if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.publicValue, &Y)) { 1049 SECKEY_DestroyPublicKey(pk); 1050 return NULL; 1051 } 1052 return pk; 1053} 1054#endif /* USE_DSA && USE_SHA1 */ 1055 1056static SECKEYPublicKey* nss_buf2rsa(unsigned char* key, size_t len) 1057{ 1058 SECKEYPublicKey* pk; 1059 uint16_t exp; 1060 uint16_t offset; 1061 uint16_t int16; 1062 SECItem modulus = {siBuffer, NULL, 0}; 1063 SECItem exponent = {siBuffer, NULL, 0}; 1064 if(len == 0) 1065 return NULL; 1066 if(key[0] == 0) { 1067 if(len < 3) 1068 return NULL; 1069 /* the exponent is too large so it's places further */ 1070 memmove(&int16, key+1, 2); 1071 exp = ntohs(int16); 1072 offset = 3; 1073 } else { 1074 exp = key[0]; 1075 offset = 1; 1076 } 1077 1078 /* key length at least one */ 1079 if(len < (size_t)offset + exp + 1) 1080 return NULL; 1081 1082 exponent.data = key+offset; 1083 exponent.len = exp; 1084 offset += exp; 1085 modulus.data = key+offset; 1086 modulus.len = (len - offset); 1087 1088 pk = nss_key_create(rsaKey); 1089 if(!pk) 1090 return NULL; 1091 if(SECITEM_CopyItem(pk->arena, &pk->u.rsa.modulus, &modulus)) { 1092 SECKEY_DestroyPublicKey(pk); 1093 return NULL; 1094 } 1095 if(SECITEM_CopyItem(pk->arena, &pk->u.rsa.publicExponent, &exponent)) { 1096 SECKEY_DestroyPublicKey(pk); 1097 return NULL; 1098 } 1099 return pk; 1100} 1101 1102/** 1103 * Setup key and digest for verification. Adjust sig if necessary. 1104 * 1105 * @param algo: key algorithm 1106 * @param evp_key: EVP PKEY public key to create. 1107 * @param digest_type: digest type to use 1108 * @param key: key to setup for. 1109 * @param keylen: length of key. 1110 * @param prefix: if returned, the ASN prefix for the hashblob. 1111 * @param prefixlen: length of the prefix. 1112 * @return false on failure. 1113 */ 1114static int 1115nss_setup_key_digest(int algo, SECKEYPublicKey** pubkey, HASH_HashType* htype, 1116 unsigned char* key, size_t keylen, unsigned char** prefix, 1117 size_t* prefixlen) 1118{ 1119 /* uses libNSS */ 1120 1121 /* hash prefix for md5, RFC2537 */ 1122 static unsigned char p_md5[] = {0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a, 1123 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10}; 1124 /* hash prefix to prepend to hash output, from RFC3110 */ 1125 static unsigned char p_sha1[] = {0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2B, 1126 0x0E, 0x03, 0x02, 0x1A, 0x05, 0x00, 0x04, 0x14}; 1127 /* from RFC5702 */ 1128 static unsigned char p_sha256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 1129 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20}; 1130 static unsigned char p_sha512[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 1131 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40}; 1132 /* from RFC6234 */ 1133 /* for future RSASHA384 .. 1134 static unsigned char p_sha384[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 1135 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30}; 1136 */ 1137 1138 switch(algo) { 1139 1140#if defined(USE_SHA1) || defined(USE_SHA2) 1141#if defined(USE_DSA) && defined(USE_SHA1) 1142 case LDNS_DSA: 1143 case LDNS_DSA_NSEC3: 1144 *pubkey = nss_buf2dsa(key, keylen); 1145 if(!*pubkey) { 1146 log_err("verify: malloc failure in crypto"); 1147 return 0; 1148 } 1149 *htype = HASH_AlgSHA1; 1150 /* no prefix for DSA verification */ 1151 break; 1152#endif 1153#ifdef USE_SHA1 1154 case LDNS_RSASHA1: 1155 case LDNS_RSASHA1_NSEC3: 1156#endif 1157#ifdef USE_SHA2 1158 case LDNS_RSASHA256: 1159#endif 1160#ifdef USE_SHA2 1161 case LDNS_RSASHA512: 1162#endif 1163 *pubkey = nss_buf2rsa(key, keylen); 1164 if(!*pubkey) { 1165 log_err("verify: malloc failure in crypto"); 1166 return 0; 1167 } 1168 /* select SHA version */ 1169#ifdef USE_SHA2 1170 if(algo == LDNS_RSASHA256) { 1171 *htype = HASH_AlgSHA256; 1172 *prefix = p_sha256; 1173 *prefixlen = sizeof(p_sha256); 1174 } else 1175#endif 1176#ifdef USE_SHA2 1177 if(algo == LDNS_RSASHA512) { 1178 *htype = HASH_AlgSHA512; 1179 *prefix = p_sha512; 1180 *prefixlen = sizeof(p_sha512); 1181 } else 1182#endif 1183#ifdef USE_SHA1 1184 { 1185 *htype = HASH_AlgSHA1; 1186 *prefix = p_sha1; 1187 *prefixlen = sizeof(p_sha1); 1188 } 1189#else 1190 { 1191 verbose(VERB_QUERY, "verify: no digest algo"); 1192 return 0; 1193 } 1194#endif 1195 1196 break; 1197#endif /* SHA1 or SHA2 */ 1198 1199 case LDNS_RSAMD5: 1200 *pubkey = nss_buf2rsa(key, keylen); 1201 if(!*pubkey) { 1202 log_err("verify: malloc failure in crypto"); 1203 return 0; 1204 } 1205 *htype = HASH_AlgMD5; 1206 *prefix = p_md5; 1207 *prefixlen = sizeof(p_md5); 1208 1209 break; 1210#ifdef USE_ECDSA 1211 case LDNS_ECDSAP256SHA256: 1212 *pubkey = nss_buf2ecdsa(key, keylen, 1213 LDNS_ECDSAP256SHA256); 1214 if(!*pubkey) { 1215 log_err("verify: malloc failure in crypto"); 1216 return 0; 1217 } 1218 *htype = HASH_AlgSHA256; 1219 /* no prefix for DSA verification */ 1220 break; 1221 case LDNS_ECDSAP384SHA384: 1222 *pubkey = nss_buf2ecdsa(key, keylen, 1223 LDNS_ECDSAP384SHA384); 1224 if(!*pubkey) { 1225 log_err("verify: malloc failure in crypto"); 1226 return 0; 1227 } 1228 *htype = HASH_AlgSHA384; 1229 /* no prefix for DSA verification */ 1230 break; 1231#endif /* USE_ECDSA */ 1232 case LDNS_ECC_GOST: 1233 default: 1234 verbose(VERB_QUERY, "verify: unknown algorithm %d", 1235 algo); 1236 return 0; 1237 } 1238 return 1; 1239} 1240 1241/** 1242 * Check a canonical sig+rrset and signature against a dnskey 1243 * @param buf: buffer with data to verify, the first rrsig part and the 1244 * canonicalized rrset. 1245 * @param algo: DNSKEY algorithm. 1246 * @param sigblock: signature rdata field from RRSIG 1247 * @param sigblock_len: length of sigblock data. 1248 * @param key: public key data from DNSKEY RR. 1249 * @param keylen: length of keydata. 1250 * @param reason: bogus reason in more detail. 1251 * @return secure if verification succeeded, bogus on crypto failure, 1252 * unchecked on format errors and alloc failures. 1253 */ 1254enum sec_status 1255verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock, 1256 unsigned int sigblock_len, unsigned char* key, unsigned int keylen, 1257 char** reason) 1258{ 1259 /* uses libNSS */ 1260 /* large enough for the different hashes */ 1261 unsigned char hash[HASH_LENGTH_MAX]; 1262 unsigned char hash2[HASH_LENGTH_MAX*2]; 1263 HASH_HashType htype = 0; 1264 SECKEYPublicKey* pubkey = NULL; 1265 SECItem secsig = {siBuffer, sigblock, sigblock_len}; 1266 SECItem sechash = {siBuffer, hash, 0}; 1267 SECStatus res; 1268 unsigned char* prefix = NULL; /* prefix for hash, RFC3110, RFC5702 */ 1269 size_t prefixlen = 0; 1270 int err; 1271 1272 if(!nss_setup_key_digest(algo, &pubkey, &htype, key, keylen, 1273 &prefix, &prefixlen)) { 1274 verbose(VERB_QUERY, "verify: failed to setup key"); 1275 *reason = "use of key for crypto failed"; 1276 SECKEY_DestroyPublicKey(pubkey); 1277 return sec_status_bogus; 1278 } 1279 1280#if defined(USE_DSA) && defined(USE_SHA1) 1281 /* need to convert DSA, ECDSA signatures? */ 1282 if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3)) { 1283 if(sigblock_len == 1+2*SHA1_LENGTH) { 1284 secsig.data ++; 1285 secsig.len --; 1286 } else { 1287 SECItem* p = DSAU_DecodeDerSig(&secsig); 1288 if(!p) { 1289 verbose(VERB_QUERY, "verify: failed DER decode"); 1290 *reason = "signature DER decode failed"; 1291 SECKEY_DestroyPublicKey(pubkey); 1292 return sec_status_bogus; 1293 } 1294 if(SECITEM_CopyItem(pubkey->arena, &secsig, p)) { 1295 log_err("alloc failure in DER decode"); 1296 SECKEY_DestroyPublicKey(pubkey); 1297 SECITEM_FreeItem(p, PR_TRUE); 1298 return sec_status_unchecked; 1299 } 1300 SECITEM_FreeItem(p, PR_TRUE); 1301 } 1302 } 1303#endif /* USE_DSA */ 1304 1305 /* do the signature cryptography work */ 1306 /* hash the data */ 1307 sechash.len = HASH_ResultLen(htype); 1308 if(sechash.len > sizeof(hash)) { 1309 verbose(VERB_QUERY, "verify: hash too large for buffer"); 1310 SECKEY_DestroyPublicKey(pubkey); 1311 return sec_status_unchecked; 1312 } 1313 if(HASH_HashBuf(htype, hash, (unsigned char*)sldns_buffer_begin(buf), 1314 (unsigned int)sldns_buffer_limit(buf)) != SECSuccess) { 1315 verbose(VERB_QUERY, "verify: HASH_HashBuf failed"); 1316 SECKEY_DestroyPublicKey(pubkey); 1317 return sec_status_unchecked; 1318 } 1319 if(prefix) { 1320 int hashlen = sechash.len; 1321 if(prefixlen+hashlen > sizeof(hash2)) { 1322 verbose(VERB_QUERY, "verify: hashprefix too large"); 1323 SECKEY_DestroyPublicKey(pubkey); 1324 return sec_status_unchecked; 1325 } 1326 sechash.data = hash2; 1327 sechash.len = prefixlen+hashlen; 1328 memcpy(sechash.data, prefix, prefixlen); 1329 memmove(sechash.data+prefixlen, hash, hashlen); 1330 } 1331 1332 /* verify the signature */ 1333 res = PK11_Verify(pubkey, &secsig, &sechash, NULL /*wincx*/); 1334 SECKEY_DestroyPublicKey(pubkey); 1335 1336 if(res == SECSuccess) { 1337 return sec_status_secure; 1338 } 1339 err = PORT_GetError(); 1340 if(err != SEC_ERROR_BAD_SIGNATURE) { 1341 /* failed to verify */ 1342 verbose(VERB_QUERY, "verify: PK11_Verify failed: %s", 1343 PORT_ErrorToString(err)); 1344 /* if it is not supported, like ECC is removed, we get, 1345 * SEC_ERROR_NO_MODULE */ 1346 if(err == SEC_ERROR_NO_MODULE) 1347 return sec_status_unchecked; 1348 /* but other errors are commonly returned 1349 * for a bad signature from NSS. Thus we return bogus, 1350 * not unchecked */ 1351 *reason = "signature crypto failed"; 1352 return sec_status_bogus; 1353 } 1354 verbose(VERB_QUERY, "verify: signature mismatch: %s", 1355 PORT_ErrorToString(err)); 1356 *reason = "signature crypto failed"; 1357 return sec_status_bogus; 1358} 1359 1360#elif defined(HAVE_NETTLE) 1361 1362#include "sha.h" 1363#include "bignum.h" 1364#include "macros.h" 1365#include "rsa.h" 1366#include "dsa.h" 1367#ifdef HAVE_NETTLE_DSA_COMPAT_H 1368#include "dsa-compat.h" 1369#endif 1370#include "asn1.h" 1371#ifdef USE_ECDSA 1372#include "ecdsa.h" 1373#include "ecc-curve.h" 1374#endif 1375#ifdef HAVE_NETTLE_EDDSA_H 1376#include "eddsa.h" 1377#endif 1378 1379static int 1380_digest_nettle(int algo, uint8_t* buf, size_t len, 1381 unsigned char* res) 1382{ 1383 switch(algo) { 1384 case SHA1_DIGEST_SIZE: 1385 { 1386 struct sha1_ctx ctx; 1387 sha1_init(&ctx); 1388 sha1_update(&ctx, len, buf); 1389 sha1_digest(&ctx, SHA1_DIGEST_SIZE, res); 1390 return 1; 1391 } 1392 case SHA256_DIGEST_SIZE: 1393 { 1394 struct sha256_ctx ctx; 1395 sha256_init(&ctx); 1396 sha256_update(&ctx, len, buf); 1397 sha256_digest(&ctx, SHA256_DIGEST_SIZE, res); 1398 return 1; 1399 } 1400 case SHA384_DIGEST_SIZE: 1401 { 1402 struct sha384_ctx ctx; 1403 sha384_init(&ctx); 1404 sha384_update(&ctx, len, buf); 1405 sha384_digest(&ctx, SHA384_DIGEST_SIZE, res); 1406 return 1; 1407 } 1408 case SHA512_DIGEST_SIZE: 1409 { 1410 struct sha512_ctx ctx; 1411 sha512_init(&ctx); 1412 sha512_update(&ctx, len, buf); 1413 sha512_digest(&ctx, SHA512_DIGEST_SIZE, res); 1414 return 1; 1415 } 1416 default: 1417 break; 1418 } 1419 return 0; 1420} 1421 1422/* return size of digest if supported, or 0 otherwise */ 1423size_t 1424nsec3_hash_algo_size_supported(int id) 1425{ 1426 switch(id) { 1427 case NSEC3_HASH_SHA1: 1428 return SHA1_DIGEST_SIZE; 1429 default: 1430 return 0; 1431 } 1432} 1433 1434/* perform nsec3 hash. return false on failure */ 1435int 1436secalgo_nsec3_hash(int algo, unsigned char* buf, size_t len, 1437 unsigned char* res) 1438{ 1439 switch(algo) { 1440 case NSEC3_HASH_SHA1: 1441 return _digest_nettle(SHA1_DIGEST_SIZE, (uint8_t*)buf, len, 1442 res); 1443 default: 1444 return 0; 1445 } 1446} 1447 1448void 1449secalgo_hash_sha256(unsigned char* buf, size_t len, unsigned char* res) 1450{ 1451 _digest_nettle(SHA256_DIGEST_SIZE, (uint8_t*)buf, len, res); 1452} 1453 1454/** 1455 * Return size of DS digest according to its hash algorithm. 1456 * @param algo: DS digest algo. 1457 * @return size in bytes of digest, or 0 if not supported. 1458 */ 1459size_t 1460ds_digest_size_supported(int algo) 1461{ 1462 switch(algo) { 1463 case LDNS_SHA1: 1464#ifdef USE_SHA1 1465 return SHA1_DIGEST_SIZE; 1466#else 1467 if(fake_sha1) return 20; 1468 return 0; 1469#endif 1470#ifdef USE_SHA2 1471 case LDNS_SHA256: 1472 return SHA256_DIGEST_SIZE; 1473#endif 1474#ifdef USE_ECDSA 1475 case LDNS_SHA384: 1476 return SHA384_DIGEST_SIZE; 1477#endif 1478 /* GOST not supported */ 1479 case LDNS_HASH_GOST: 1480 default: 1481 break; 1482 } 1483 return 0; 1484} 1485 1486int 1487secalgo_ds_digest(int algo, unsigned char* buf, size_t len, 1488 unsigned char* res) 1489{ 1490 switch(algo) { 1491#ifdef USE_SHA1 1492 case LDNS_SHA1: 1493 return _digest_nettle(SHA1_DIGEST_SIZE, buf, len, res); 1494#endif 1495#if defined(USE_SHA2) 1496 case LDNS_SHA256: 1497 return _digest_nettle(SHA256_DIGEST_SIZE, buf, len, res); 1498#endif 1499#ifdef USE_ECDSA 1500 case LDNS_SHA384: 1501 return _digest_nettle(SHA384_DIGEST_SIZE, buf, len, res); 1502 1503#endif 1504 case LDNS_HASH_GOST: 1505 default: 1506 verbose(VERB_QUERY, "unknown DS digest algorithm %d", 1507 algo); 1508 break; 1509 } 1510 return 0; 1511} 1512 1513int 1514dnskey_algo_id_is_supported(int id) 1515{ 1516 /* uses libnettle */ 1517 switch(id) { 1518 case LDNS_DSA: 1519 case LDNS_DSA_NSEC3: 1520#if defined(USE_DSA) && defined(USE_SHA1) 1521 return 1; 1522#else 1523 if(fake_dsa || fake_sha1) return 1; 1524 return 0; 1525#endif 1526 case LDNS_RSASHA1: 1527 case LDNS_RSASHA1_NSEC3: 1528#ifdef USE_SHA1 1529 return 1; 1530#else 1531 if(fake_sha1) return 1; 1532 return 0; 1533#endif 1534#ifdef USE_SHA2 1535 case LDNS_RSASHA256: 1536 case LDNS_RSASHA512: 1537#endif 1538#ifdef USE_ECDSA 1539 case LDNS_ECDSAP256SHA256: 1540 case LDNS_ECDSAP384SHA384: 1541#endif 1542 return 1; 1543#ifdef USE_ED25519 1544 case LDNS_ED25519: 1545 return 1; 1546#endif 1547 case LDNS_RSAMD5: /* RFC 6725 deprecates RSAMD5 */ 1548 case LDNS_ECC_GOST: 1549 default: 1550 return 0; 1551 } 1552} 1553 1554#if defined(USE_DSA) && defined(USE_SHA1) 1555static char * 1556_verify_nettle_dsa(sldns_buffer* buf, unsigned char* sigblock, 1557 unsigned int sigblock_len, unsigned char* key, unsigned int keylen) 1558{ 1559 uint8_t digest[SHA1_DIGEST_SIZE]; 1560 uint8_t key_t_value; 1561 int res = 0; 1562 size_t offset; 1563 struct dsa_public_key pubkey; 1564 struct dsa_signature signature; 1565 unsigned int expected_len; 1566 1567 /* Extract DSA signature from the record */ 1568 nettle_dsa_signature_init(&signature); 1569 /* Signature length: 41 bytes - RFC 2536 sec. 3 */ 1570 if(sigblock_len == 41) { 1571 if(key[0] != sigblock[0]) 1572 return "invalid T value in DSA signature or pubkey"; 1573 nettle_mpz_set_str_256_u(signature.r, 20, sigblock+1); 1574 nettle_mpz_set_str_256_u(signature.s, 20, sigblock+1+20); 1575 } else { 1576 /* DER encoded, decode the ASN1 notated R and S bignums */ 1577 /* SEQUENCE { r INTEGER, s INTEGER } */ 1578 struct asn1_der_iterator i, seq; 1579 if(asn1_der_iterator_first(&i, sigblock_len, 1580 (uint8_t*)sigblock) != ASN1_ITERATOR_CONSTRUCTED 1581 || i.type != ASN1_SEQUENCE) 1582 return "malformed DER encoded DSA signature"; 1583 /* decode this element of i using the seq iterator */ 1584 if(asn1_der_decode_constructed(&i, &seq) != 1585 ASN1_ITERATOR_PRIMITIVE || seq.type != ASN1_INTEGER) 1586 return "malformed DER encoded DSA signature"; 1587 if(!asn1_der_get_bignum(&seq, signature.r, 20*8)) 1588 return "malformed DER encoded DSA signature"; 1589 if(asn1_der_iterator_next(&seq) != ASN1_ITERATOR_PRIMITIVE 1590 || seq.type != ASN1_INTEGER) 1591 return "malformed DER encoded DSA signature"; 1592 if(!asn1_der_get_bignum(&seq, signature.s, 20*8)) 1593 return "malformed DER encoded DSA signature"; 1594 if(asn1_der_iterator_next(&i) != ASN1_ITERATOR_END) 1595 return "malformed DER encoded DSA signature"; 1596 } 1597 1598 /* Validate T values constraints - RFC 2536 sec. 2 & sec. 3 */ 1599 key_t_value = key[0]; 1600 if (key_t_value > 8) { 1601 return "invalid T value in DSA pubkey"; 1602 } 1603 1604 /* Pubkey minimum length: 21 bytes - RFC 2536 sec. 2 */ 1605 if (keylen < 21) { 1606 return "DSA pubkey too short"; 1607 } 1608 1609 expected_len = 1 + /* T */ 1610 20 + /* Q */ 1611 (64 + key_t_value*8) + /* P */ 1612 (64 + key_t_value*8) + /* G */ 1613 (64 + key_t_value*8); /* Y */ 1614 if (keylen != expected_len ) { 1615 return "invalid DSA pubkey length"; 1616 } 1617 1618 /* Extract DSA pubkey from the record */ 1619 nettle_dsa_public_key_init(&pubkey); 1620 offset = 1; 1621 nettle_mpz_set_str_256_u(pubkey.q, 20, key+offset); 1622 offset += 20; 1623 nettle_mpz_set_str_256_u(pubkey.p, (64 + key_t_value*8), key+offset); 1624 offset += (64 + key_t_value*8); 1625 nettle_mpz_set_str_256_u(pubkey.g, (64 + key_t_value*8), key+offset); 1626 offset += (64 + key_t_value*8); 1627 nettle_mpz_set_str_256_u(pubkey.y, (64 + key_t_value*8), key+offset); 1628 1629 /* Digest content of "buf" and verify its DSA signature in "sigblock"*/ 1630 res = _digest_nettle(SHA1_DIGEST_SIZE, (unsigned char*)sldns_buffer_begin(buf), 1631 (unsigned int)sldns_buffer_limit(buf), (unsigned char*)digest); 1632 res &= dsa_sha1_verify_digest(&pubkey, digest, &signature); 1633 1634 /* Clear and return */ 1635 nettle_dsa_signature_clear(&signature); 1636 nettle_dsa_public_key_clear(&pubkey); 1637 if (!res) 1638 return "DSA signature verification failed"; 1639 else 1640 return NULL; 1641} 1642#endif /* USE_DSA */ 1643 1644static char * 1645_verify_nettle_rsa(sldns_buffer* buf, unsigned int digest_size, char* sigblock, 1646 unsigned int sigblock_len, uint8_t* key, unsigned int keylen) 1647{ 1648 uint16_t exp_len = 0; 1649 size_t exp_offset = 0, mod_offset = 0; 1650 struct rsa_public_key pubkey; 1651 mpz_t signature; 1652 int res = 0; 1653 1654 /* RSA pubkey parsing as per RFC 3110 sec. 2 */ 1655 if( keylen <= 1) { 1656 return "null RSA key"; 1657 } 1658 if (key[0] != 0) { 1659 /* 1-byte length */ 1660 exp_len = key[0]; 1661 exp_offset = 1; 1662 } else { 1663 /* 1-byte NUL + 2-bytes exponent length */ 1664 if (keylen < 3) { 1665 return "incorrect RSA key length"; 1666 } 1667 exp_len = READ_UINT16(key+1); 1668 if (exp_len == 0) 1669 return "null RSA exponent length"; 1670 exp_offset = 3; 1671 } 1672 /* Check that we are not over-running input length */ 1673 if (keylen < exp_offset + exp_len + 1) { 1674 return "RSA key content shorter than expected"; 1675 } 1676 mod_offset = exp_offset + exp_len; 1677 nettle_rsa_public_key_init(&pubkey); 1678 pubkey.size = keylen - mod_offset; 1679 nettle_mpz_set_str_256_u(pubkey.e, exp_len, &key[exp_offset]); 1680 nettle_mpz_set_str_256_u(pubkey.n, pubkey.size, &key[mod_offset]); 1681 1682 /* Digest content of "buf" and verify its RSA signature in "sigblock"*/ 1683 nettle_mpz_init_set_str_256_u(signature, sigblock_len, (uint8_t*)sigblock); 1684 switch (digest_size) { 1685 case SHA1_DIGEST_SIZE: 1686 { 1687 uint8_t digest[SHA1_DIGEST_SIZE]; 1688 res = _digest_nettle(SHA1_DIGEST_SIZE, (unsigned char*)sldns_buffer_begin(buf), 1689 (unsigned int)sldns_buffer_limit(buf), (unsigned char*)digest); 1690 res &= rsa_sha1_verify_digest(&pubkey, digest, signature); 1691 break; 1692 } 1693 case SHA256_DIGEST_SIZE: 1694 { 1695 uint8_t digest[SHA256_DIGEST_SIZE]; 1696 res = _digest_nettle(SHA256_DIGEST_SIZE, (unsigned char*)sldns_buffer_begin(buf), 1697 (unsigned int)sldns_buffer_limit(buf), (unsigned char*)digest); 1698 res &= rsa_sha256_verify_digest(&pubkey, digest, signature); 1699 break; 1700 } 1701 case SHA512_DIGEST_SIZE: 1702 { 1703 uint8_t digest[SHA512_DIGEST_SIZE]; 1704 res = _digest_nettle(SHA512_DIGEST_SIZE, (unsigned char*)sldns_buffer_begin(buf), 1705 (unsigned int)sldns_buffer_limit(buf), (unsigned char*)digest); 1706 res &= rsa_sha512_verify_digest(&pubkey, digest, signature); 1707 break; 1708 } 1709 default: 1710 break; 1711 } 1712 1713 /* Clear and return */ 1714 nettle_rsa_public_key_clear(&pubkey); 1715 mpz_clear(signature); 1716 if (!res) { 1717 return "RSA signature verification failed"; 1718 } else { 1719 return NULL; 1720 } 1721} 1722 1723#ifdef USE_ECDSA 1724static char * 1725_verify_nettle_ecdsa(sldns_buffer* buf, unsigned int digest_size, unsigned char* sigblock, 1726 unsigned int sigblock_len, unsigned char* key, unsigned int keylen) 1727{ 1728 int res = 0; 1729 struct ecc_point pubkey; 1730 struct dsa_signature signature; 1731 1732 /* Always matched strength, as per RFC 6605 sec. 1 */ 1733 if (sigblock_len != 2*digest_size || keylen != 2*digest_size) { 1734 return "wrong ECDSA signature length"; 1735 } 1736 1737 /* Parse ECDSA signature as per RFC 6605 sec. 4 */ 1738 nettle_dsa_signature_init(&signature); 1739 switch (digest_size) { 1740 case SHA256_DIGEST_SIZE: 1741 { 1742 uint8_t digest[SHA256_DIGEST_SIZE]; 1743 mpz_t x, y; 1744 nettle_ecc_point_init(&pubkey, nettle_get_secp_256r1()); 1745 nettle_mpz_init_set_str_256_u(x, SHA256_DIGEST_SIZE, key); 1746 nettle_mpz_init_set_str_256_u(y, SHA256_DIGEST_SIZE, key+SHA256_DIGEST_SIZE); 1747 nettle_mpz_set_str_256_u(signature.r, SHA256_DIGEST_SIZE, sigblock); 1748 nettle_mpz_set_str_256_u(signature.s, SHA256_DIGEST_SIZE, sigblock+SHA256_DIGEST_SIZE); 1749 res = _digest_nettle(SHA256_DIGEST_SIZE, (unsigned char*)sldns_buffer_begin(buf), 1750 (unsigned int)sldns_buffer_limit(buf), (unsigned char*)digest); 1751 res &= nettle_ecc_point_set(&pubkey, x, y); 1752 res &= nettle_ecdsa_verify (&pubkey, SHA256_DIGEST_SIZE, digest, &signature); 1753 mpz_clear(x); 1754 mpz_clear(y); 1755 nettle_ecc_point_clear(&pubkey); 1756 break; 1757 } 1758 case SHA384_DIGEST_SIZE: 1759 { 1760 uint8_t digest[SHA384_DIGEST_SIZE]; 1761 mpz_t x, y; 1762 nettle_ecc_point_init(&pubkey, nettle_get_secp_384r1()); 1763 nettle_mpz_init_set_str_256_u(x, SHA384_DIGEST_SIZE, key); 1764 nettle_mpz_init_set_str_256_u(y, SHA384_DIGEST_SIZE, key+SHA384_DIGEST_SIZE); 1765 nettle_mpz_set_str_256_u(signature.r, SHA384_DIGEST_SIZE, sigblock); 1766 nettle_mpz_set_str_256_u(signature.s, SHA384_DIGEST_SIZE, sigblock+SHA384_DIGEST_SIZE); 1767 res = _digest_nettle(SHA384_DIGEST_SIZE, (unsigned char*)sldns_buffer_begin(buf), 1768 (unsigned int)sldns_buffer_limit(buf), (unsigned char*)digest); 1769 res &= nettle_ecc_point_set(&pubkey, x, y); 1770 res &= nettle_ecdsa_verify (&pubkey, SHA384_DIGEST_SIZE, digest, &signature); 1771 mpz_clear(x); 1772 mpz_clear(y); 1773 nettle_ecc_point_clear(&pubkey); 1774 break; 1775 } 1776 default: 1777 return "unknown ECDSA algorithm"; 1778 } 1779 1780 /* Clear and return */ 1781 nettle_dsa_signature_clear(&signature); 1782 if (!res) 1783 return "ECDSA signature verification failed"; 1784 else 1785 return NULL; 1786} 1787#endif 1788 1789#ifdef USE_ED25519 1790static char * 1791_verify_nettle_ed25519(sldns_buffer* buf, unsigned char* sigblock, 1792 unsigned int sigblock_len, unsigned char* key, unsigned int keylen) 1793{ 1794 int res = 0; 1795 1796 if(sigblock_len != ED25519_SIGNATURE_SIZE) { 1797 return "wrong ED25519 signature length"; 1798 } 1799 if(keylen != ED25519_KEY_SIZE) { 1800 return "wrong ED25519 key length"; 1801 } 1802 1803 res = ed25519_sha512_verify((uint8_t*)key, sldns_buffer_limit(buf), 1804 sldns_buffer_begin(buf), (uint8_t*)sigblock); 1805 1806 if (!res) 1807 return "ED25519 signature verification failed"; 1808 else 1809 return NULL; 1810} 1811#endif 1812 1813/** 1814 * Check a canonical sig+rrset and signature against a dnskey 1815 * @param buf: buffer with data to verify, the first rrsig part and the 1816 * canonicalized rrset. 1817 * @param algo: DNSKEY algorithm. 1818 * @param sigblock: signature rdata field from RRSIG 1819 * @param sigblock_len: length of sigblock data. 1820 * @param key: public key data from DNSKEY RR. 1821 * @param keylen: length of keydata. 1822 * @param reason: bogus reason in more detail. 1823 * @return secure if verification succeeded, bogus on crypto failure, 1824 * unchecked on format errors and alloc failures. 1825 */ 1826enum sec_status 1827verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock, 1828 unsigned int sigblock_len, unsigned char* key, unsigned int keylen, 1829 char** reason) 1830{ 1831 unsigned int digest_size = 0; 1832 1833 if (sigblock_len == 0 || keylen == 0) { 1834 *reason = "null signature"; 1835 return sec_status_bogus; 1836 } 1837 1838#ifndef USE_DSA 1839 if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3) &&(fake_dsa||fake_sha1)) 1840 return sec_status_secure; 1841#endif 1842#ifndef USE_SHA1 1843 if(fake_sha1 && (algo == LDNS_DSA || algo == LDNS_DSA_NSEC3 || algo == LDNS_RSASHA1 || algo == LDNS_RSASHA1_NSEC3)) 1844 return sec_status_secure; 1845#endif 1846 1847 switch(algo) { 1848#if defined(USE_DSA) && defined(USE_SHA1) 1849 case LDNS_DSA: 1850 case LDNS_DSA_NSEC3: 1851 *reason = _verify_nettle_dsa(buf, sigblock, sigblock_len, key, keylen); 1852 if (*reason != NULL) 1853 return sec_status_bogus; 1854 else 1855 return sec_status_secure; 1856#endif /* USE_DSA */ 1857 1858#ifdef USE_SHA1 1859 case LDNS_RSASHA1: 1860 case LDNS_RSASHA1_NSEC3: 1861 digest_size = (digest_size ? digest_size : SHA1_DIGEST_SIZE); 1862#endif 1863 /* double fallthrough annotation to please gcc parser */ 1864 /* fallthrough */ 1865#ifdef USE_SHA2 1866 /* fallthrough */ 1867 case LDNS_RSASHA256: 1868 digest_size = (digest_size ? digest_size : SHA256_DIGEST_SIZE); 1869 /* fallthrough */ 1870 case LDNS_RSASHA512: 1871 digest_size = (digest_size ? digest_size : SHA512_DIGEST_SIZE); 1872 1873#endif 1874 *reason = _verify_nettle_rsa(buf, digest_size, (char*)sigblock, 1875 sigblock_len, key, keylen); 1876 if (*reason != NULL) 1877 return sec_status_bogus; 1878 else 1879 return sec_status_secure; 1880 1881#ifdef USE_ECDSA 1882 case LDNS_ECDSAP256SHA256: 1883 digest_size = (digest_size ? digest_size : SHA256_DIGEST_SIZE); 1884 /* fallthrough */ 1885 case LDNS_ECDSAP384SHA384: 1886 digest_size = (digest_size ? digest_size : SHA384_DIGEST_SIZE); 1887 *reason = _verify_nettle_ecdsa(buf, digest_size, sigblock, 1888 sigblock_len, key, keylen); 1889 if (*reason != NULL) 1890 return sec_status_bogus; 1891 else 1892 return sec_status_secure; 1893#endif 1894#ifdef USE_ED25519 1895 case LDNS_ED25519: 1896 *reason = _verify_nettle_ed25519(buf, sigblock, sigblock_len, 1897 key, keylen); 1898 if (*reason != NULL) 1899 return sec_status_bogus; 1900 else 1901 return sec_status_secure; 1902#endif 1903 case LDNS_RSAMD5: 1904 case LDNS_ECC_GOST: 1905 default: 1906 *reason = "unable to verify signature, unknown algorithm"; 1907 return sec_status_bogus; 1908 } 1909} 1910 1911#endif /* HAVE_SSL or HAVE_NSS or HAVE_NETTLE */ 1912