dst_internal.h revision 267654 
1/*
2 * Portions Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
3 * Portions Copyright (C) 2000-2002  Internet Software Consortium.
4 *
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
10 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
11 * WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE
12 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
15 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 *
17 * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
18 *
19 * Permission to use, copy, modify, and/or distribute this software for any
20 * purpose with or without fee is hereby granted, provided that the above
21 * copyright notice and this permission notice appear in all copies.
22 *
23 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
24 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
25 * WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE
26 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
27 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
28 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
29 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
30 */
31
32/* $Id: dst_internal.h,v 1.31 2011/10/20 21:20:02 marka Exp $ */
33
34#ifndef DST_DST_INTERNAL_H
35#define DST_DST_INTERNAL_H 1
36
37#include <isc/lang.h>
38#include <isc/buffer.h>
39#include <isc/int.h>
40#include <isc/magic.h>
41#include <isc/region.h>
42#include <isc/types.h>
43#include <isc/md5.h>
44#include <isc/refcount.h>
45#include <isc/sha1.h>
46#include <isc/sha2.h>
47#include <isc/stdtime.h>
48#include <isc/hmacmd5.h>
49#include <isc/hmacsha.h>
50
51#include <dns/time.h>
52
53#include <dst/dst.h>
54
55#ifdef OPENSSL
56#include <openssl/dh.h>
57#include <openssl/dsa.h>
58#include <openssl/err.h>
59#include <openssl/evp.h>
60#include <openssl/objects.h>
61#include <openssl/rsa.h>
62#endif
63
64ISC_LANG_BEGINDECLS
65
66#define KEY_MAGIC	ISC_MAGIC('D','S','T','K')
67#define CTX_MAGIC	ISC_MAGIC('D','S','T','C')
68
69#define VALID_KEY(x) ISC_MAGIC_VALID(x, KEY_MAGIC)
70#define VALID_CTX(x) ISC_MAGIC_VALID(x, CTX_MAGIC)
71
72extern isc_mem_t *dst__memory_pool;
73
74/***
75 *** Types
76 ***/
77
78typedef struct dst_func dst_func_t;
79
80typedef struct dst_hmacmd5_key	  dst_hmacmd5_key_t;
81typedef struct dst_hmacsha1_key   dst_hmacsha1_key_t;
82typedef struct dst_hmacsha224_key dst_hmacsha224_key_t;
83typedef struct dst_hmacsha256_key dst_hmacsha256_key_t;
84typedef struct dst_hmacsha384_key dst_hmacsha384_key_t;
85typedef struct dst_hmacsha512_key dst_hmacsha512_key_t;
86
87/*% DST Key Structure */
88struct dst_key {
89	unsigned int	magic;
90	isc_refcount_t	refs;
91	dns_name_t *	key_name;	/*%< name of the key */
92	unsigned int	key_size;	/*%< size of the key in bits */
93	unsigned int	key_proto;	/*%< protocols this key is used for */
94	unsigned int	key_alg;	/*%< algorithm of the key */
95	isc_uint32_t	key_flags;	/*%< flags of the public key */
96	isc_uint16_t	key_id;		/*%< identifier of the key */
97	isc_uint16_t	key_rid;	/*%< identifier of the key when
98					     revoked */
99	isc_uint16_t	key_bits;	/*%< hmac digest bits */
100	dns_rdataclass_t key_class;	/*%< class of the key record */
101	dns_ttl_t	key_ttl;	/*%< default/initial dnskey ttl */
102	isc_mem_t	*mctx;		/*%< memory context */
103	char		*engine;	/*%< engine name (HSM) */
104	char		*label;		/*%< engine label (HSM) */
105	union {
106		void *generic;
107		gss_ctx_id_t gssctx;
108#ifdef OPENSSL
109#if !defined(USE_EVP) || !USE_EVP
110		RSA *rsa;
111#endif
112		DSA *dsa;
113		DH *dh;
114		EVP_PKEY *pkey;
115#endif
116		dst_hmacmd5_key_t *hmacmd5;
117		dst_hmacsha1_key_t *hmacsha1;
118		dst_hmacsha224_key_t *hmacsha224;
119		dst_hmacsha256_key_t *hmacsha256;
120		dst_hmacsha384_key_t *hmacsha384;
121		dst_hmacsha512_key_t *hmacsha512;
122
123	} keydata;			/*%< pointer to key in crypto pkg fmt */
124
125	isc_stdtime_t	times[DST_MAX_TIMES + 1];    /*%< timing metadata */
126	isc_boolean_t	timeset[DST_MAX_TIMES + 1];  /*%< data set? */
127	isc_stdtime_t	nums[DST_MAX_NUMERIC + 1];   /*%< numeric metadata */
128	isc_boolean_t	numset[DST_MAX_NUMERIC + 1]; /*%< data set? */
129	isc_boolean_t 	inactive;      /*%< private key not present as it is
130					    inactive */
131	isc_boolean_t 	external;      /*%< external key */
132
133	int		fmt_major;     /*%< private key format, major version */
134	int		fmt_minor;     /*%< private key format, minor version */
135
136	dst_func_t *    func;	       /*%< crypto package specific functions */
137	isc_buffer_t   *key_tkeytoken; /*%< TKEY token data */
138};
139
140struct dst_context {
141	unsigned int magic;
142	dst_key_t *key;
143	isc_mem_t *mctx;
144	isc_logcategory_t *category;
145	union {
146		void *generic;
147		dst_gssapi_signverifyctx_t *gssctx;
148		isc_md5_t *md5ctx;
149		isc_sha1_t *sha1ctx;
150		isc_sha256_t *sha256ctx;
151		isc_sha512_t *sha512ctx;
152		isc_hmacmd5_t *hmacmd5ctx;
153		isc_hmacsha1_t *hmacsha1ctx;
154		isc_hmacsha224_t *hmacsha224ctx;
155		isc_hmacsha256_t *hmacsha256ctx;
156		isc_hmacsha384_t *hmacsha384ctx;
157		isc_hmacsha512_t *hmacsha512ctx;
158#ifdef OPENSSL
159		EVP_MD_CTX *evp_md_ctx;
160#endif
161	} ctxdata;
162};
163
164struct dst_func {
165	/*
166	 * Context functions
167	 */
168	isc_result_t (*createctx)(dst_key_t *key, dst_context_t *dctx);
169	void (*destroyctx)(dst_context_t *dctx);
170	isc_result_t (*adddata)(dst_context_t *dctx, const isc_region_t *data);
171
172	/*
173	 * Key operations
174	 */
175	isc_result_t (*sign)(dst_context_t *dctx, isc_buffer_t *sig);
176	isc_result_t (*verify)(dst_context_t *dctx, const isc_region_t *sig);
177	isc_result_t (*verify2)(dst_context_t *dctx, int maxbits,
178				const isc_region_t *sig);
179	isc_result_t (*computesecret)(const dst_key_t *pub,
180				      const dst_key_t *priv,
181				      isc_buffer_t *secret);
182	isc_boolean_t (*compare)(const dst_key_t *key1, const dst_key_t *key2);
183	isc_boolean_t (*paramcompare)(const dst_key_t *key1,
184				      const dst_key_t *key2);
185	isc_result_t (*generate)(dst_key_t *key, int parms,
186				 void (*callback)(int));
187	isc_boolean_t (*isprivate)(const dst_key_t *key);
188	void (*destroy)(dst_key_t *key);
189
190	/* conversion functions */
191	isc_result_t (*todns)(const dst_key_t *key, isc_buffer_t *data);
192	isc_result_t (*fromdns)(dst_key_t *key, isc_buffer_t *data);
193	isc_result_t (*tofile)(const dst_key_t *key, const char *directory);
194	isc_result_t (*parse)(dst_key_t *key,
195			      isc_lex_t *lexer,
196			      dst_key_t *pub);
197
198	/* cleanup */
199	void (*cleanup)(void);
200
201	isc_result_t (*fromlabel)(dst_key_t *key, const char *engine,
202				  const char *label, const char *pin);
203	isc_result_t (*dump)(dst_key_t *key, isc_mem_t *mctx, char **buffer,
204			     int *length);
205	isc_result_t (*restore)(dst_key_t *key, const char *keystr);
206};
207
208/*%
209 * Initializers
210 */
211isc_result_t dst__openssl_init(const char *engine);
212
213isc_result_t dst__hmacmd5_init(struct dst_func **funcp);
214isc_result_t dst__hmacsha1_init(struct dst_func **funcp);
215isc_result_t dst__hmacsha224_init(struct dst_func **funcp);
216isc_result_t dst__hmacsha256_init(struct dst_func **funcp);
217isc_result_t dst__hmacsha384_init(struct dst_func **funcp);
218isc_result_t dst__hmacsha512_init(struct dst_func **funcp);
219isc_result_t dst__opensslrsa_init(struct dst_func **funcp,
220				  unsigned char algorithm);
221isc_result_t dst__openssldsa_init(struct dst_func **funcp);
222isc_result_t dst__openssldh_init(struct dst_func **funcp);
223isc_result_t dst__gssapi_init(struct dst_func **funcp);
224#ifdef HAVE_OPENSSL_GOST
225isc_result_t dst__opensslgost_init(struct dst_func **funcp);
226#endif
227#ifdef HAVE_OPENSSL_ECDSA
228isc_result_t dst__opensslecdsa_init(struct dst_func **funcp);
229#endif
230
231/*%
232 * Destructors
233 */
234void dst__openssl_destroy(void);
235
236/*%
237 * Memory allocators using the DST memory pool.
238 */
239void * dst__mem_alloc(size_t size);
240void   dst__mem_free(void *ptr);
241void * dst__mem_realloc(void *ptr, size_t size);
242
243/*%
244 * Entropy retriever using the DST entropy pool.
245 */
246isc_result_t dst__entropy_getdata(void *buf, unsigned int len,
247				  isc_boolean_t pseudo);
248
249/*
250 * Entropy status hook.
251 */
252unsigned int dst__entropy_status(void);
253
254ISC_LANG_ENDDECLS
255
256#endif /* DST_DST_INTERNAL_H */
257/*! \file */
258