1/*	$NetBSD: dst_internal.h,v 1.1 2024/02/18 20:57:31 christos Exp $	*/
2
3/*
4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
5 *
6 * SPDX-License-Identifier: MPL-2.0 AND ISC
7 *
8 * This Source Code Form is subject to the terms of the Mozilla Public
9 * License, v. 2.0. If a copy of the MPL was not distributed with this
10 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
11 *
12 * See the COPYRIGHT file distributed with this work for additional
13 * information regarding copyright ownership.
14 */
15
16/*
17 * Portions Copyright (C) Network Associates, Inc.
18 *
19 * Permission to use, copy, modify, and/or distribute this software for any
20 * purpose with or without fee is hereby granted, provided that the above
21 * copyright notice and this permission notice appear in all copies.
22 *
23 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
24 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
25 * WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE
26 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
27 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
28 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
29 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
30 */
31
32#pragma once
33
34#include <inttypes.h>
35#include <stdbool.h>
36
37#include <isc/buffer.h>
38#include <isc/hmac.h>
39#include <isc/lang.h>
40#include <isc/magic.h>
41#include <isc/md.h>
42#include <isc/refcount.h>
43#include <isc/region.h>
44#include <isc/stdtime.h>
45#include <isc/types.h>
46
47#if USE_PKCS11
48#include <pk11/pk11.h>
49#include <pk11/site.h>
50#endif /* USE_PKCS11 */
51
52#include <openssl/dh.h>
53#include <openssl/err.h>
54#include <openssl/evp.h>
55#include <openssl/objects.h>
56#include <openssl/rsa.h>
57
58#include <dns/time.h>
59
60#include <dst/dst.h>
61
62#ifdef GSSAPI
63#ifdef WIN32
64/*
65 * MSVC does not like macros in #include lines.
66 */
67#include <gssapi/gssapi.h>
68#include <gssapi/gssapi_krb5.h>
69#else /* ifdef WIN32 */
70#include ISC_PLATFORM_GSSAPIHEADER
71#ifdef ISC_PLATFORM_GSSAPI_KRB5_HEADER
72#include ISC_PLATFORM_GSSAPI_KRB5_HEADER
73#endif /* ifdef ISC_PLATFORM_GSSAPI_KRB5_HEADER */
74#endif /* ifdef WIN32 */
75#endif /* ifdef GSSAPI */
76
77ISC_LANG_BEGINDECLS
78
79#define KEY_MAGIC ISC_MAGIC('D', 'S', 'T', 'K')
80#define CTX_MAGIC ISC_MAGIC('D', 'S', 'T', 'C')
81
82#define VALID_KEY(x) ISC_MAGIC_VALID(x, KEY_MAGIC)
83#define VALID_CTX(x) ISC_MAGIC_VALID(x, CTX_MAGIC)
84
85/***
86 *** Types
87 ***/
88
89typedef struct dst_func dst_func_t;
90
91typedef struct dst_hmac_key dst_hmac_key_t;
92
93/*%
94 * Indicate whether a DST context will be used for signing
95 * or for verification
96 */
97typedef enum { DO_SIGN, DO_VERIFY } dst_use_t;
98
99/*% DST Key Structure */
100struct dst_key {
101	unsigned int magic;
102	isc_refcount_t refs;
103	isc_mutex_t mdlock;	    /*%< lock for read/write metadata */
104	dns_name_t *key_name;	    /*%< name of the key */
105	unsigned int key_size;	    /*%< size of the key in bits */
106	unsigned int key_proto;	    /*%< protocols this key is used for
107				     * */
108	unsigned int key_alg;	    /*%< algorithm of the key */
109	uint32_t key_flags;	    /*%< flags of the public key */
110	uint16_t key_id;	    /*%< identifier of the key */
111	uint16_t key_rid;	    /*%< identifier of the key when
112				     *   revoked */
113	uint16_t key_bits;	    /*%< hmac digest bits */
114	dns_rdataclass_t key_class; /*%< class of the key record */
115	dns_ttl_t key_ttl;	    /*%< default/initial dnskey ttl */
116	isc_mem_t *mctx;	    /*%< memory context */
117	char *engine;		    /*%< engine name (HSM) */
118	char *label;		    /*%< engine label (HSM) */
119	union {
120		void *generic;
121		dns_gss_ctx_id_t gssctx;
122		DH *dh;
123#if USE_OPENSSL
124		EVP_PKEY *pkey;
125#endif /* if USE_OPENSSL */
126#if USE_PKCS11
127		pk11_object_t *pkey;
128#endif /* if USE_PKCS11 */
129		dst_hmac_key_t *hmac_key;
130	} keydata; /*%< pointer to key in crypto pkg fmt */
131
132	isc_stdtime_t times[DST_MAX_TIMES + 1]; /*%< timing metadata */
133	bool timeset[DST_MAX_TIMES + 1];	/*%< data set? */
134
135	uint32_t nums[DST_MAX_NUMERIC + 1]; /*%< numeric metadata
136					     * */
137	bool numset[DST_MAX_NUMERIC + 1];   /*%< data set? */
138
139	bool bools[DST_MAX_BOOLEAN + 1];   /*%< boolean metadata
140					    * */
141	bool boolset[DST_MAX_BOOLEAN + 1]; /*%< data set? */
142
143	dst_key_state_t keystates[DST_MAX_KEYSTATES + 1]; /*%< key states
144							   * */
145	bool keystateset[DST_MAX_KEYSTATES + 1];	  /*%< data
146							   * set? */
147
148	bool kasp;     /*%< key has kasp state */
149	bool inactive; /*%< private key not present as it is
150			* inactive */
151	bool external; /*%< external key */
152	bool modified; /*%< set to true if key file metadata has changed */
153
154	int fmt_major; /*%< private key format, major version
155			* */
156	int fmt_minor; /*%< private key format, minor version
157			* */
158
159	dst_func_t *func;	     /*%< crypto package specific functions */
160	isc_buffer_t *key_tkeytoken; /*%< TKEY token data */
161};
162
163struct dst_context {
164	unsigned int magic;
165	dst_use_t use;
166	dst_key_t *key;
167	isc_mem_t *mctx;
168	isc_logcategory_t *category;
169	union {
170		void *generic;
171		dst_gssapi_signverifyctx_t *gssctx;
172		isc_hmac_t *hmac_ctx;
173		EVP_MD_CTX *evp_md_ctx;
174#if USE_PKCS11
175		pk11_context_t *pk11_ctx;
176#endif /* if USE_PKCS11 */
177	} ctxdata;
178};
179
180struct dst_func {
181	/*
182	 * Context functions
183	 */
184	isc_result_t (*createctx)(dst_key_t *key, dst_context_t *dctx);
185	isc_result_t (*createctx2)(dst_key_t *key, int maxbits,
186				   dst_context_t *dctx);
187	void (*destroyctx)(dst_context_t *dctx);
188	isc_result_t (*adddata)(dst_context_t *dctx, const isc_region_t *data);
189
190	/*
191	 * Key operations
192	 */
193	isc_result_t (*sign)(dst_context_t *dctx, isc_buffer_t *sig);
194	isc_result_t (*verify)(dst_context_t *dctx, const isc_region_t *sig);
195	isc_result_t (*verify2)(dst_context_t *dctx, int maxbits,
196				const isc_region_t *sig);
197	isc_result_t (*computesecret)(const dst_key_t *pub,
198				      const dst_key_t *priv,
199				      isc_buffer_t *secret);
200	bool (*compare)(const dst_key_t *key1, const dst_key_t *key2);
201	bool (*paramcompare)(const dst_key_t *key1, const dst_key_t *key2);
202	isc_result_t (*generate)(dst_key_t *key, int parms,
203				 void (*callback)(int));
204	bool (*isprivate)(const dst_key_t *key);
205	void (*destroy)(dst_key_t *key);
206
207	/* conversion functions */
208	isc_result_t (*todns)(const dst_key_t *key, isc_buffer_t *data);
209	isc_result_t (*fromdns)(dst_key_t *key, isc_buffer_t *data);
210	isc_result_t (*tofile)(const dst_key_t *key, const char *directory);
211	isc_result_t (*parse)(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub);
212
213	/* cleanup */
214	void (*cleanup)(void);
215
216	isc_result_t (*fromlabel)(dst_key_t *key, const char *engine,
217				  const char *label, const char *pin);
218	isc_result_t (*dump)(dst_key_t *key, isc_mem_t *mctx, char **buffer,
219			     int *length);
220	isc_result_t (*restore)(dst_key_t *key, const char *keystr);
221};
222
223/*%
224 * Initializers
225 */
226isc_result_t
227dst__openssl_init(const char *engine);
228#define dst__pkcs11_init pk11_initialize
229
230isc_result_t
231dst__hmacmd5_init(struct dst_func **funcp);
232isc_result_t
233dst__hmacsha1_init(struct dst_func **funcp);
234isc_result_t
235dst__hmacsha224_init(struct dst_func **funcp);
236isc_result_t
237dst__hmacsha256_init(struct dst_func **funcp);
238isc_result_t
239dst__hmacsha384_init(struct dst_func **funcp);
240isc_result_t
241dst__hmacsha512_init(struct dst_func **funcp);
242isc_result_t
243dst__openssldh_init(struct dst_func **funcp);
244#if USE_OPENSSL
245isc_result_t
246dst__opensslrsa_init(struct dst_func **funcp, unsigned char algorithm);
247isc_result_t
248dst__opensslecdsa_init(struct dst_func **funcp);
249#if HAVE_OPENSSL_ED25519 || HAVE_OPENSSL_ED448
250isc_result_t
251dst__openssleddsa_init(struct dst_func **funcp);
252#endif /* HAVE_OPENSSL_ED25519 || HAVE_OPENSSL_ED448 */
253#endif /* USE_OPENSSL */
254#if USE_PKCS11
255isc_result_t
256dst__pkcs11rsa_init(struct dst_func **funcp);
257isc_result_t
258dst__pkcs11dsa_init(struct dst_func **funcp);
259isc_result_t
260dst__pkcs11ecdsa_init(struct dst_func **funcp);
261isc_result_t
262dst__pkcs11eddsa_init(struct dst_func **funcp);
263#endif /* USE_PKCS11 */
264#ifdef GSSAPI
265isc_result_t
266dst__gssapi_init(struct dst_func **funcp);
267#endif /* GSSAPI */
268
269/*%
270 * Destructors
271 */
272void
273dst__openssl_destroy(void);
274#define dst__pkcs11_destroy pk11_finalize
275
276/*%
277 * Memory allocators using the DST memory pool.
278 */
279void *
280dst__mem_alloc(size_t size);
281void
282dst__mem_free(void *ptr);
283void *
284dst__mem_realloc(void *ptr, size_t size);
285
286ISC_LANG_ENDDECLS
287
288/*! \file */
289