mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 06:25:31 +00:00
Code Issues Releases Wiki Activity

Merge branch 'tt-openssl-dh-refactoring' into 'main'

Browse Source 
Refactor OpenSSL EDDSA code

See merge request isc-projects/bind9!7429
This commit is contained in:
Ondřej Surý
2023-03-08 15:13:20 +00:00
parent 61598b0cd1 20b4d7146b
commit 1c8255efea
6 changed files with 143 additions and 294 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
lib/dns/dst_internal.h
View File

@@ -97,7 +97,6 @@ struct dst_key {
void *generic; void *generic;
dns_gss_ctx_id_t gssctx; dns_gss_ctx_id_t gssctx;
dst_hmac_key_t *hmac_key; dst_hmac_key_t *hmac_key;
EVP_PKEY *pkey;
struct { struct {
EVP_PKEY *pub; EVP_PKEY *pub;
EVP_PKEY *priv; EVP_PKEY *priv;

8
lib/dns/dst_openssl.h
View File

@@ -46,6 +46,12 @@ dst__openssl_fromlabel(int key_base_id, const char *engine, const char *label,
const char *pin, EVP_PKEY **ppub, EVP_PKEY **ppriv); const char *pin, EVP_PKEY **ppub, EVP_PKEY **ppriv);
bool bool
dst__openssl_compare_keypair(const dst_key_t *key1, const dst_key_t *key2); dst__openssl_keypair_compare(const dst_key_t *key1, const dst_key_t *key2);
bool
dst__openssl_keypair_isprivate(const dst_key_t *key);
void
dst__openssl_keypair_destroy(dst_key_t *key);
ISC_LANG_ENDDECLS ISC_LANG_ENDDECLS

19
lib/dns/openssl_link.c
View File

@@ -357,11 +357,11 @@ dst__openssl_fromlabel(int key_base_id, const char *engine, const char *label,
} }
bool bool
dst__openssl_compare_keypair(const dst_key_t *key1, const dst_key_t *key2) { dst__openssl_keypair_compare(const dst_key_t *key1, const dst_key_t *key2) {
EVP_PKEY *pkey1 = key1->keydata.pkeypair.pub; EVP_PKEY *pkey1 = key1->keydata.pkeypair.pub;
EVP_PKEY *pkey2 = key2->keydata.pkeypair.pub; EVP_PKEY *pkey2 = key2->keydata.pkeypair.pub;
if (pkey1 == NULL && pkey2 == NULL) { if (pkey1 == pkey2) {
return (true); return (true);
} else if (pkey1 == NULL || pkey2 == NULL) { } else if (pkey1 == NULL || pkey2 == NULL) {
return (false); return (false);
@@ -380,4 +380,19 @@ dst__openssl_compare_keypair(const dst_key_t *key1, const dst_key_t *key2) {
return (true); return (true);
} }
bool
dst__openssl_keypair_isprivate(const dst_key_t *key) {
return (key->keydata.pkeypair.priv != NULL);
}
void
dst__openssl_keypair_destroy(dst_key_t *key) {
if (key->keydata.pkeypair.priv != key->keydata.pkeypair.pub) {
EVP_PKEY_free(key->keydata.pkeypair.priv);
}
EVP_PKEY_free(key->keydata.pkeypair.pub);
key->keydata.pkeypair.pub = NULL;
key->keydata.pkeypair.priv = NULL;
}
/*! \file */ /*! \file */

23
lib/dns/opensslecdsa_link.c
View File

@@ -766,23 +766,6 @@ opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
return (ret); return (ret);
} }
static bool
opensslecdsa_isprivate(const dst_key_t *key) {
REQUIRE(opensslecdsa_valid_key_alg(key->key_alg));
return (key->keydata.pkeypair.priv != NULL);
}
static void
opensslecdsa_destroy(dst_key_t *key) {
if (key->keydata.pkeypair.priv != key->keydata.pkeypair.pub) {
EVP_PKEY_free(key->keydata.pkeypair.priv);
}
EVP_PKEY_free(key->keydata.pkeypair.pub);
key->keydata.pkeypair.pub = NULL;
key->keydata.pkeypair.priv = NULL;
}
static isc_result_t static isc_result_t
opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) { opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) {
isc_result_t ret; isc_result_t ret;
@@ -1039,11 +1022,11 @@ static dst_func_t opensslecdsa_functions = {
opensslecdsa_verify, opensslecdsa_verify,
NULL, /*%< verify2 */ NULL, /*%< verify2 */
NULL, /*%< computesecret */ NULL, /*%< computesecret */
dst__openssl_compare_keypair, dst__openssl_keypair_compare,
NULL, /*%< paramcompare */ NULL, /*%< paramcompare */
opensslecdsa_generate, opensslecdsa_generate,
opensslecdsa_isprivate, dst__openssl_keypair_isprivate,
opensslecdsa_destroy, dst__openssl_keypair_destroy,
opensslecdsa_todns, opensslecdsa_todns,
opensslecdsa_fromdns, opensslecdsa_fromdns,
opensslecdsa_tofile, opensslecdsa_tofile,

335
lib/dns/openssleddsa_link.c
View File

@@ -21,9 +21,6 @@
#include <openssl/evp.h> #include <openssl/evp.h>
#include <openssl/objects.h> #include <openssl/objects.h>
#include <openssl/x509.h> #include <openssl/x509.h>
#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
#include <openssl/engine.h>
#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
#include <isc/mem.h> #include <isc/mem.h>
#include <isc/result.h> #include <isc/result.h>
@@ -56,29 +53,45 @@
#endif /* ifndef NID_ED448 */ #endif /* ifndef NID_ED448 */
#endif /* HAVE_OPENSSL_ED448 */ #endif /* HAVE_OPENSSL_ED448 */
static isc_result_t typedef struct eddsa_alginfo {
raw_key_to_ossl(unsigned int key_alg, int private, const unsigned char *key, int pkey_type, nid;
size_t *key_len, EVP_PKEY **pkey) { unsigned int key_size, sig_size;
isc_result_t ret; } eddsa_alginfo_t;
int pkey_type = EVP_PKEY_NONE;
size_t len = 0;
static const eddsa_alginfo_t *
openssleddsa_alg_info(unsigned int key_alg) {
#if HAVE_OPENSSL_ED25519 #if HAVE_OPENSSL_ED25519
if (key_alg == DST_ALG_ED25519) { if (key_alg == DST_ALG_ED25519) {
pkey_type = EVP_PKEY_ED25519; static const eddsa_alginfo_t ed25519_alginfo = {
len = DNS_KEY_ED25519SIZE; .pkey_type = EVP_PKEY_ED25519,
.nid = NID_ED25519,
.key_size = DNS_KEY_ED25519SIZE,
.sig_size = DNS_SIG_ED25519SIZE,
};
return &ed25519_alginfo;
} }
#endif /* HAVE_OPENSSL_ED25519 */ #endif /* HAVE_OPENSSL_ED25519 */
#if HAVE_OPENSSL_ED448 #if HAVE_OPENSSL_ED448
if (key_alg == DST_ALG_ED448) { if (key_alg == DST_ALG_ED448) {
pkey_type = EVP_PKEY_ED448; static const eddsa_alginfo_t ed448_alginfo = {
len = DNS_KEY_ED448SIZE; .pkey_type = EVP_PKEY_ED448,
.nid = NID_ED448,
.key_size = DNS_KEY_ED448SIZE,
.sig_size = DNS_SIG_ED448SIZE,
};
return &ed448_alginfo;
} }
#endif /* HAVE_OPENSSL_ED448 */ #endif /* HAVE_OPENSSL_ED448 */
if (pkey_type == EVP_PKEY_NONE) { return NULL;
return (ISC_R_NOTIMPLEMENTED);
} }
static isc_result_t
raw_key_to_ossl(const eddsa_alginfo_t *alginfo, int private,
const unsigned char *key, size_t *key_len, EVP_PKEY **pkey) {
isc_result_t ret;
int pkey_type = alginfo->pkey_type;
size_t len = alginfo->key_size;
ret = (private ? DST_R_INVALIDPRIVATEKEY : DST_R_INVALIDPUBLICKEY); ret = (private ? DST_R_INVALIDPRIVATEKEY : DST_R_INVALIDPUBLICKEY);
if (*key_len < len) { if (*key_len < len) {
return (ret); return (ret);
@@ -104,10 +117,11 @@ openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
static isc_result_t static isc_result_t
openssleddsa_createctx(dst_key_t *key, dst_context_t *dctx) { openssleddsa_createctx(dst_key_t *key, dst_context_t *dctx) {
isc_buffer_t *buf = NULL; isc_buffer_t *buf = NULL;
const eddsa_alginfo_t *alginfo =
openssleddsa_alg_info(dctx->key->key_alg);
UNUSED(key); UNUSED(key);
REQUIRE(dctx->key->key_alg == DST_ALG_ED25519 || REQUIRE(alginfo != NULL);
dctx->key->key_alg == DST_ALG_ED448);
isc_buffer_allocate(dctx->mctx, &buf, 64); isc_buffer_allocate(dctx->mctx, &buf, 64);
dctx->ctxdata.generic = buf; dctx->ctxdata.generic = buf;
@@ -118,9 +132,10 @@ openssleddsa_createctx(dst_key_t *key, dst_context_t *dctx) {
static void static void
openssleddsa_destroyctx(dst_context_t *dctx) { openssleddsa_destroyctx(dst_context_t *dctx) {
isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic; isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
const eddsa_alginfo_t *alginfo =
openssleddsa_alg_info(dctx->key->key_alg);
REQUIRE(dctx->key->key_alg == DST_ALG_ED25519 || REQUIRE(alginfo != NULL);
dctx->key->key_alg == DST_ALG_ED448);
if (buf != NULL) { if (buf != NULL) {
isc_buffer_free(&buf); isc_buffer_free(&buf);
} }
@@ -134,9 +149,10 @@ openssleddsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
isc_region_t r; isc_region_t r;
unsigned int length; unsigned int length;
isc_result_t result; isc_result_t result;
const eddsa_alginfo_t *alginfo =
openssleddsa_alg_info(dctx->key->key_alg);
REQUIRE(dctx->key->key_alg == DST_ALG_ED25519 || REQUIRE(alginfo != NULL);
dctx->key->key_alg == DST_ALG_ED448);
result = isc_buffer_copyregion(buf, data); result = isc_buffer_copyregion(buf, data);
if (result == ISC_R_SUCCESS) { if (result == ISC_R_SUCCESS) {
@@ -160,24 +176,19 @@ openssleddsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
dst_key_t *key = dctx->key; dst_key_t *key = dctx->key;
isc_region_t tbsreg; isc_region_t tbsreg;
isc_region_t sigreg; isc_region_t sigreg;
EVP_PKEY *pkey = key->keydata.pkey; EVP_PKEY *pkey = key->keydata.pkeypair.priv;
EVP_MD_CTX *ctx = EVP_MD_CTX_new(); EVP_MD_CTX *ctx = EVP_MD_CTX_new();
isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic; isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
size_t siglen; size_t siglen;
REQUIRE(key->key_alg == DST_ALG_ED25519 || REQUIRE(alginfo != NULL);
key->key_alg == DST_ALG_ED448);
if (ctx == NULL) { if (ctx == NULL) {
return (ISC_R_NOMEMORY); return (ISC_R_NOMEMORY);
} }
if (key->key_alg == DST_ALG_ED25519) { siglen = alginfo->sig_size;
siglen = DNS_SIG_ED25519SIZE;
} else {
siglen = DNS_SIG_ED448SIZE;
}
isc_buffer_availableregion(sig, &sigreg); isc_buffer_availableregion(sig, &sigreg);
if (sigreg.length < (unsigned int)siglen) { if (sigreg.length < (unsigned int)siglen) {
DST_RET(ISC_R_NOSPACE); DST_RET(ISC_R_NOSPACE);
@@ -212,33 +223,18 @@ openssleddsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
dst_key_t *key = dctx->key; dst_key_t *key = dctx->key;
int status; int status;
isc_region_t tbsreg; isc_region_t tbsreg;
EVP_PKEY *pkey = key->keydata.pkey; EVP_PKEY *pkey = key->keydata.pkeypair.pub;
EVP_MD_CTX *ctx = EVP_MD_CTX_new(); EVP_MD_CTX *ctx = EVP_MD_CTX_new();
isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic; isc_buffer_t *buf = (isc_buffer_t *)dctx->ctxdata.generic;
unsigned int siglen = 0; const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
REQUIRE(key->key_alg == DST_ALG_ED25519 || REQUIRE(alginfo != NULL);
key->key_alg == DST_ALG_ED448);
if (ctx == NULL) { if (ctx == NULL) {
return (ISC_R_NOMEMORY); return (ISC_R_NOMEMORY);
} }
#if HAVE_OPENSSL_ED25519 if (sig->length != alginfo->sig_size) {
if (key->key_alg == DST_ALG_ED25519) {
siglen = DNS_SIG_ED25519SIZE;
}
#endif /* if HAVE_OPENSSL_ED25519 */
#if HAVE_OPENSSL_ED448
if (key->key_alg == DST_ALG_ED448) {
siglen = DNS_SIG_ED448SIZE;
}
#endif /* if HAVE_OPENSSL_ED448 */
if (siglen == 0) {
DST_RET(ISC_R_NOTIMPLEMENTED);
}
if (sig->length != siglen) {
DST_RET(DST_R_VERIFYFAILURE); DST_RET(DST_R_VERIFYFAILURE);
} }
@@ -249,7 +245,7 @@ openssleddsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
dctx->category, "EVP_DigestVerifyInit", ISC_R_FAILURE)); dctx->category, "EVP_DigestVerifyInit", ISC_R_FAILURE));
} }
status = EVP_DigestVerify(ctx, sig->base, siglen, tbsreg.base, status = EVP_DigestVerify(ctx, sig->base, sig->length, tbsreg.base,
tbsreg.length); tbsreg.length);
switch (status) { switch (status) {
@@ -273,54 +269,19 @@ err:
return (ret); return (ret);
} }
static bool
openssleddsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
int status;
EVP_PKEY *pkey1 = key1->keydata.pkey;
EVP_PKEY *pkey2 = key2->keydata.pkey;
if (pkey1 == NULL && pkey2 == NULL) {
return (true);
} else if (pkey1 == NULL || pkey2 == NULL) {
return (false);
}
status = EVP_PKEY_eq(pkey1, pkey2);
if (status == 1) {
return (true);
}
return (false);
}
static isc_result_t static isc_result_t
openssleddsa_generate(dst_key_t *key, int unused, void (*callback)(int)) { openssleddsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
isc_result_t ret; isc_result_t ret;
EVP_PKEY *pkey = NULL; EVP_PKEY *pkey = NULL;
EVP_PKEY_CTX *ctx = NULL; EVP_PKEY_CTX *ctx = NULL;
int nid = 0, status; const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
int status;
REQUIRE(key->key_alg == DST_ALG_ED25519 || REQUIRE(alginfo != NULL);
key->key_alg == DST_ALG_ED448);
UNUSED(unused); UNUSED(unused);
UNUSED(callback); UNUSED(callback);
#if HAVE_OPENSSL_ED25519 ctx = EVP_PKEY_CTX_new_id(alginfo->nid, NULL);
if (key->key_alg == DST_ALG_ED25519) {
nid = NID_ED25519;
key->key_size = DNS_KEY_ED25519SIZE * 8;
}
#endif /* if HAVE_OPENSSL_ED25519 */
#if HAVE_OPENSSL_ED448
if (key->key_alg == DST_ALG_ED448) {
nid = NID_ED448;
key->key_size = DNS_KEY_ED448SIZE * 8;
}
#endif /* if HAVE_OPENSSL_ED448 */
if (nid == 0) {
return (ISC_R_NOTIMPLEMENTED);
}
ctx = EVP_PKEY_CTX_new_id(nid, NULL);
if (ctx == NULL) { if (ctx == NULL) {
return (dst__openssl_toresult2("EVP_PKEY_CTX_new_id", return (dst__openssl_toresult2("EVP_PKEY_CTX_new_id",
DST_R_OPENSSLFAILURE)); DST_R_OPENSSLFAILURE));
@@ -338,7 +299,9 @@ openssleddsa_generate(dst_key_t *key, int unused, void (*callback)(int)) {
DST_R_OPENSSLFAILURE)); DST_R_OPENSSLFAILURE));
} }
key->keydata.pkey = pkey; key->key_size = alginfo->key_size * 8;
key->keydata.pkeypair.priv = pkey;
key->keydata.pkeypair.pub = pkey;
ret = ISC_R_SUCCESS; ret = ISC_R_SUCCESS;
err: err:
@@ -346,50 +309,17 @@ err:
return (ret); return (ret);
} }
static bool
openssleddsa_isprivate(const dst_key_t *key) {
EVP_PKEY *pkey = key->keydata.pkey;
size_t len;
if (pkey == NULL) {
return (false);
}
if (EVP_PKEY_get_raw_private_key(pkey, NULL, &len) == 1 && len > 0) {
return (true);
}
/* can check if first error is EC_R_INVALID_PRIVATE_KEY */
while (ERR_get_error() != 0) {
/**/
}
return (false);
}
static void
openssleddsa_destroy(dst_key_t *key) {
EVP_PKEY *pkey = key->keydata.pkey;
EVP_PKEY_free(pkey);
key->keydata.pkey = NULL;
}
static isc_result_t static isc_result_t
openssleddsa_todns(const dst_key_t *key, isc_buffer_t *data) { openssleddsa_todns(const dst_key_t *key, isc_buffer_t *data) {
EVP_PKEY *pkey = key->keydata.pkey; const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
EVP_PKEY *pkey = key->keydata.pkeypair.pub;
isc_region_t r; isc_region_t r;
size_t len; size_t len;
REQUIRE(pkey != NULL); REQUIRE(pkey != NULL);
REQUIRE(key->key_alg == DST_ALG_ED25519 || REQUIRE(alginfo != NULL);
key->key_alg == DST_ALG_ED448);
if (key->key_alg == DST_ALG_ED25519) {
len = DNS_KEY_ED25519SIZE;
} else {
len = DNS_KEY_ED448SIZE;
}
len = alginfo->key_size;
isc_buffer_availableregion(data, &r); isc_buffer_availableregion(data, &r);
if (r.length < len) { if (r.length < len) {
return (ISC_R_NOSPACE); return (ISC_R_NOSPACE);
@@ -405,13 +335,13 @@ openssleddsa_todns(const dst_key_t *key, isc_buffer_t *data) {
static isc_result_t static isc_result_t
openssleddsa_fromdns(dst_key_t *key, isc_buffer_t *data) { openssleddsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
isc_result_t ret; isc_result_t ret;
isc_region_t r; isc_region_t r;
size_t len; size_t len;
EVP_PKEY *pkey; EVP_PKEY *pkey;
REQUIRE(key->key_alg == DST_ALG_ED25519 || REQUIRE(alginfo != NULL);
key->key_alg == DST_ALG_ED448);
isc_buffer_remainingregion(data, &r); isc_buffer_remainingregion(data, &r);
if (r.length == 0) { if (r.length == 0) {
@@ -419,29 +349,29 @@ openssleddsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
} }
len = r.length; len = r.length;
ret = raw_key_to_ossl(key->key_alg, 0, r.base, &len, &pkey); ret = raw_key_to_ossl(alginfo, 0, r.base, &len, &pkey);
if (ret != ISC_R_SUCCESS) { if (ret != ISC_R_SUCCESS) {
return ret; return ret;
} }
isc_buffer_forward(data, len); isc_buffer_forward(data, len);
key->keydata.pkey = pkey; key->keydata.pkeypair.pub = pkey;
key->key_size = len * 8; key->key_size = len * 8;
return (ISC_R_SUCCESS); return (ISC_R_SUCCESS);
} }
static isc_result_t static isc_result_t
openssleddsa_tofile(const dst_key_t *key, const char *directory) { openssleddsa_tofile(const dst_key_t *key, const char *directory) {
const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
isc_result_t ret; isc_result_t ret;
dst_private_t priv; dst_private_t priv;
unsigned char *buf = NULL; unsigned char *buf = NULL;
size_t len; size_t len;
int i; int i;
REQUIRE(key->key_alg == DST_ALG_ED25519 || REQUIRE(alginfo != NULL);
key->key_alg == DST_ALG_ED448);
if (key->keydata.pkey == NULL) { if (key->keydata.pkeypair.pub == NULL) {
return (DST_R_NULLKEY); return (DST_R_NULLKEY);
} }
@@ -452,15 +382,11 @@ openssleddsa_tofile(const dst_key_t *key, const char *directory) {
i = 0; i = 0;
if (openssleddsa_isprivate(key)) { if (dst__openssl_keypair_isprivate(key)) {
if (key->key_alg == DST_ALG_ED25519) { len = alginfo->key_size;
len = DNS_KEY_ED25519SIZE;
} else {
len = DNS_KEY_ED448SIZE;
}
buf = isc_mem_get(key->mctx, len); buf = isc_mem_get(key->mctx, len);
if (EVP_PKEY_get_raw_private_key(key->keydata.pkey, buf, if (EVP_PKEY_get_raw_private_key(key->keydata.pkeypair.priv,
&len) != 1) buf, &len) != 1)
{ {
DST_RET(dst__openssl_toresult(ISC_R_FAILURE)); DST_RET(dst__openssl_toresult(ISC_R_FAILURE));
} }
@@ -494,29 +420,18 @@ err:
return (ret); return (ret);
} }
static isc_result_t
eddsa_check(EVP_PKEY *pkey, EVP_PKEY *pubpkey) {
if (pubpkey == NULL) {
return (ISC_R_SUCCESS);
}
if (EVP_PKEY_eq(pkey, pubpkey) == 1) {
return (ISC_R_SUCCESS);
}
return (ISC_R_FAILURE);
}
static isc_result_t static isc_result_t
openssleddsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { openssleddsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
dst_private_t priv; dst_private_t priv;
isc_result_t ret; isc_result_t ret;
int i, privkey_index = -1; int i, privkey_index = -1;
const char *engine = NULL, *label = NULL; const char *engine = NULL, *label = NULL;
EVP_PKEY *pkey = NULL, *pubpkey = NULL; EVP_PKEY *pkey = NULL;
size_t len; size_t len;
isc_mem_t *mctx = key->mctx; isc_mem_t *mctx = key->mctx;
REQUIRE(key->key_alg == DST_ALG_ED25519 || REQUIRE(alginfo != NULL);
key->key_alg == DST_ALG_ED448);
/* read private key file */ /* read private key file */
ret = dst__privstruct_parse(key, DST_ALG_ED25519, lexer, mctx, &priv); ret = dst__privstruct_parse(key, DST_ALG_ED25519, lexer, mctx, &priv);
@@ -531,15 +446,11 @@ openssleddsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
if (pub == NULL) { if (pub == NULL) {
DST_RET(DST_R_INVALIDPRIVATEKEY); DST_RET(DST_R_INVALIDPRIVATEKEY);
} }
key->keydata.pkey = pub->keydata.pkey; key->keydata.pkeypair.priv = pub->keydata.pkeypair.priv;
pub->keydata.pkey = NULL; key->keydata.pkeypair.pub = pub->keydata.pkeypair.pub;
dst__privstruct_free(&priv, mctx); pub->keydata.pkeypair.priv = NULL;
isc_safe_memwipe(&priv, sizeof(priv)); pub->keydata.pkeypair.pub = NULL;
return (ISC_R_SUCCESS); DST_RET(ISC_R_SUCCESS);
}
if (pub != NULL) {
pubpkey = pub->keydata.pkey;
} }
for (i = 0; i < priv.nelements; i++) { for (i = 0; i < priv.nelements; i++) {
@@ -563,7 +474,10 @@ openssleddsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
if (ret != ISC_R_SUCCESS) { if (ret != ISC_R_SUCCESS) {
goto err; goto err;
} }
if (eddsa_check(key->keydata.pkey, pubpkey) != ISC_R_SUCCESS) { /* Check that the public component matches if given */
if (pub != NULL && EVP_PKEY_eq(key->keydata.pkeypair.pub,
pub->keydata.pkeypair.pub) != 1)
{
DST_RET(DST_R_INVALIDPRIVATEKEY); DST_RET(DST_R_INVALIDPRIVATEKEY);
} }
DST_RET(ISC_R_SUCCESS); DST_RET(ISC_R_SUCCESS);
@@ -574,20 +488,24 @@ openssleddsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
} }
len = priv.elements[privkey_index].length; len = priv.elements[privkey_index].length;
ret = raw_key_to_ossl(key->key_alg, 1, ret = raw_key_to_ossl(alginfo, 1, priv.elements[privkey_index].data,
priv.elements[privkey_index].data, &len, &pkey); &len, &pkey);
if (ret != ISC_R_SUCCESS) { if (ret != ISC_R_SUCCESS) {
goto err; goto err;
} }
if (eddsa_check(pkey, pubpkey) != ISC_R_SUCCESS) { /* Check that the public component matches if given */
EVP_PKEY_free(pkey); if (pub != NULL && EVP_PKEY_eq(pkey, pub->keydata.pkeypair.pub) != 1) {
DST_RET(DST_R_INVALIDPRIVATEKEY); DST_RET(DST_R_INVALIDPRIVATEKEY);
} }
key->keydata.pkey = pkey;
key->keydata.pkeypair.priv = pkey;
key->keydata.pkeypair.pub = pkey;
key->key_size = len * 8; key->key_size = len * 8;
pkey = NULL;
ret = ISC_R_SUCCESS; ret = ISC_R_SUCCESS;
err: err:
EVP_PKEY_free(pkey);
dst__privstruct_free(&priv, mctx); dst__privstruct_free(&priv, mctx);
isc_safe_memwipe(&priv, sizeof(priv)); isc_safe_memwipe(&priv, sizeof(priv));
return (ret); return (ret);
@@ -596,74 +514,31 @@ err:
static isc_result_t static isc_result_t
openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label, openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
const char *pin) { const char *pin) {
#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 const eddsa_alginfo_t *alginfo = openssleddsa_alg_info(key->key_alg);
EVP_PKEY *privpkey = NULL, *pubpkey = NULL;
isc_result_t ret; isc_result_t ret;
ENGINE *e;
EVP_PKEY *pkey = NULL, *pubpkey = NULL;
int baseid = EVP_PKEY_NONE;
REQUIRE(alginfo != NULL);
UNUSED(pin); UNUSED(pin);
REQUIRE(key->key_alg == DST_ALG_ED25519 || ret = dst__openssl_fromlabel(alginfo->pkey_type, engine, label, pin,
key->key_alg == DST_ALG_ED448); &pubpkey, &privpkey);
if (ret != ISC_R_SUCCESS) {
#if HAVE_OPENSSL_ED25519 goto err;
if (key->key_alg == DST_ALG_ED25519) {
baseid = EVP_PKEY_ED25519;
}
#endif /* if HAVE_OPENSSL_ED25519 */
#if HAVE_OPENSSL_ED448
if (key->key_alg == DST_ALG_ED448) {
baseid = EVP_PKEY_ED448;
}
#endif /* if HAVE_OPENSSL_ED448 */
if (baseid == EVP_PKEY_NONE) {
return (ISC_R_NOTIMPLEMENTED);
}
if (engine == NULL) {
return (DST_R_NOENGINE);
}
e = dst__openssl_getengine(engine);
if (e == NULL) {
return (DST_R_NOENGINE);
}
pkey = ENGINE_load_private_key(e, label, NULL, NULL);
if (pkey == NULL) {
return (dst__openssl_toresult2("ENGINE_load_private_key",
ISC_R_NOTFOUND));
}
if (EVP_PKEY_base_id(pkey) != baseid) {
DST_RET(DST_R_INVALIDPRIVATEKEY);
}
pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
if (eddsa_check(pkey, pubpkey) != ISC_R_SUCCESS) {
DST_RET(DST_R_INVALIDPRIVATEKEY);
} }
key->engine = isc_mem_strdup(key->mctx, engine); key->engine = isc_mem_strdup(key->mctx, engine);
key->label = isc_mem_strdup(key->mctx, label); key->label = isc_mem_strdup(key->mctx, label);
key->key_size = EVP_PKEY_bits(pkey); key->key_size = EVP_PKEY_bits(privpkey);
key->keydata.pkey = pkey; key->keydata.pkeypair.priv = privpkey;
pkey = NULL; key->keydata.pkeypair.pub = pubpkey;
ret = ISC_R_SUCCESS; privpkey = NULL;
pubpkey = NULL;
err: err:
if (pubpkey != NULL) { EVP_PKEY_free(privpkey);
EVP_PKEY_free(pubpkey); EVP_PKEY_free(pubpkey);
}
if (pkey != NULL) {
EVP_PKEY_free(pkey);
}
return (ret); return (ret);
#else /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
UNUSED(key);
UNUSED(engine);
UNUSED(label);
UNUSED(pin);
return (DST_R_NOENGINE);
#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
} }
static dst_func_t openssleddsa_functions = { static dst_func_t openssleddsa_functions = {
@@ -675,11 +550,11 @@ static dst_func_t openssleddsa_functions = {
openssleddsa_verify, openssleddsa_verify,
NULL, /*%< verify2 */ NULL, /*%< verify2 */
NULL, /*%< computesecret */ NULL, /*%< computesecret */
openssleddsa_compare, dst__openssl_keypair_compare,
NULL, /*%< paramcompare */ NULL, /*%< paramcompare */
openssleddsa_generate, openssleddsa_generate,
openssleddsa_isprivate, dst__openssl_keypair_isprivate,
openssleddsa_destroy, dst__openssl_keypair_destroy,
openssleddsa_todns, openssleddsa_todns,
openssleddsa_fromdns, openssleddsa_fromdns,
openssleddsa_tofile, openssleddsa_tofile,

35
lib/dns/opensslrsa_link.c
View File

@@ -378,15 +378,9 @@ opensslrsa_generate_pkey(unsigned int key_size, BIGNUM *e,
ret = ISC_R_SUCCESS; ret = ISC_R_SUCCESS;
err: err:
if (pkey != NULL) {
EVP_PKEY_free(pkey); EVP_PKEY_free(pkey);
}
if (rsa != NULL) {
RSA_free(rsa); RSA_free(rsa);
}
if (cb != NULL) {
BN_GENCB_free(cb); BN_GENCB_free(cb);
}
return (ret); return (ret);
} }
@@ -511,9 +505,7 @@ opensslrsa_generate_pkey(unsigned int key_size, BIGNUM *e,
} }
ret = ISC_R_SUCCESS; ret = ISC_R_SUCCESS;
err: err:
if (ctx != NULL) {
EVP_PKEY_CTX_free(ctx); EVP_PKEY_CTX_free(ctx);
}
return (ret); return (ret);
} }
@@ -668,32 +660,11 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
ret = ISC_R_SUCCESS; ret = ISC_R_SUCCESS;
err: err:
if (pkey != NULL) {
EVP_PKEY_free(pkey); EVP_PKEY_free(pkey);
}
if (e != NULL) {
BN_free(e); BN_free(e);
}
return (ret); return (ret);
} }
static bool
opensslrsa_isprivate(const dst_key_t *key) {
REQUIRE(opensslrsa_valid_key_alg(key->key_alg));
return (key->keydata.pkeypair.priv != NULL);
}
static void
opensslrsa_destroy(dst_key_t *key) {
if (key->keydata.pkeypair.pub != key->keydata.pkeypair.priv) {
EVP_PKEY_free(key->keydata.pkeypair.priv);
}
EVP_PKEY_free(key->keydata.pkeypair.pub);
key->keydata.pkeypair.pub = NULL;
key->keydata.pkeypair.priv = NULL;
}
static isc_result_t static isc_result_t
opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) { opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
isc_region_t r; isc_region_t r;
@@ -1103,11 +1074,11 @@ static dst_func_t opensslrsa_functions = {
opensslrsa_verify, opensslrsa_verify,
opensslrsa_verify2, opensslrsa_verify2,
NULL, /*%< computesecret */ NULL, /*%< computesecret */
dst__openssl_compare_keypair, dst__openssl_keypair_compare,
NULL, /*%< paramcompare */ NULL, /*%< paramcompare */
opensslrsa_generate, opensslrsa_generate,
opensslrsa_isprivate, dst__openssl_keypair_isprivate,
opensslrsa_destroy, dst__openssl_keypair_destroy,
opensslrsa_todns, opensslrsa_todns,
opensslrsa_fromdns, opensslrsa_fromdns,
opensslrsa_tofile, opensslrsa_tofile,