mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

4450. [port] Provide more nuanced HSM support which better matches

Browse Source 
the specific PKCS11 providers capabilities. [RT #42458]
This commit is contained in:
Mark Andrews
2016-08-19 08:02:51 +10:00
parent 85342bec80
commit 8ee6f289d8
56 changed files with 1449 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
lib/dns/opensslrsa_link.c
View File

@@ -31,6 +31,8 @@
#include <isc/string.h>
#include <isc/util.h>
#include <pk11/site.h>
#include <dst/result.h>
#include "dst_internal.h"
@@ -122,11 +124,18 @@ opensslrsa_createctx(dst_key_t *key, dst_context_t *dctx) {
#endif
UNUSED(key);
#ifndef PK11_MD5_DISABLE
REQUIRE(dctx->key->key_alg == DST_ALG_RSAMD5 ||
dctx->key->key_alg == DST_ALG_RSASHA1 ||
dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
dctx->key->key_alg == DST_ALG_RSASHA256 ||
dctx->key->key_alg == DST_ALG_RSASHA512);
#else
REQUIRE(dctx->key->key_alg == DST_ALG_RSASHA1 ||
dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
dctx->key->key_alg == DST_ALG_RSASHA256 ||
dctx->key->key_alg == DST_ALG_RSASHA512);
#endif
#if USE_EVP
evp_md_ctx = EVP_MD_CTX_create();
@@ -134,9 +143,11 @@ opensslrsa_createctx(dst_key_t *key, dst_context_t *dctx) {
return (ISC_R_NOMEMORY);
switch (dctx->key->key_alg) {
#ifndef PK11_MD5_DISABLE
case DST_ALG_RSAMD5:
type = EVP_md5(); /* MD5 + RSA */
break;
#endif
case DST_ALG_RSASHA1:
case DST_ALG_NSEC3RSASHA1:
type = EVP_sha1(); /* SHA1 + RSA */
@@ -164,6 +175,7 @@ opensslrsa_createctx(dst_key_t *key, dst_context_t *dctx) {
dctx->ctxdata.evp_md_ctx = evp_md_ctx;
#else
switch (dctx->key->key_alg) {
#ifndef PK11_MD5_DISABLE
case DST_ALG_RSAMD5:
{
isc_md5_t *md5ctx;
@@ -175,6 +187,7 @@ opensslrsa_createctx(dst_key_t *key, dst_context_t *dctx) {
dctx->ctxdata.md5ctx = md5ctx;
}
break;
#endif
case DST_ALG_RSASHA1:
case DST_ALG_NSEC3RSASHA1:
{
@@ -225,11 +238,18 @@ opensslrsa_destroyctx(dst_context_t *dctx) {
EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
#endif
#ifndef PK11_MD5_DISABLE
REQUIRE(dctx->key->key_alg == DST_ALG_RSAMD5 ||
dctx->key->key_alg == DST_ALG_RSASHA1 ||
dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
dctx->key->key_alg == DST_ALG_RSASHA256 ||
dctx->key->key_alg == DST_ALG_RSASHA512);
#else
REQUIRE(dctx->key->key_alg == DST_ALG_RSASHA1 ||
dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
dctx->key->key_alg == DST_ALG_RSASHA256 ||
dctx->key->key_alg == DST_ALG_RSASHA512);
#endif
#if USE_EVP
if (evp_md_ctx != NULL) {
@@ -238,6 +258,7 @@ opensslrsa_destroyctx(dst_context_t *dctx) {
}
#else
switch (dctx->key->key_alg) {
#ifndef PK11_MD5_DISABLE
case DST_ALG_RSAMD5:
{
isc_md5_t *md5ctx = dctx->ctxdata.md5ctx;
@@ -250,6 +271,7 @@ opensslrsa_destroyctx(dst_context_t *dctx) {
}
}
break;
#endif
case DST_ALG_RSASHA1:
case DST_ALG_NSEC3RSASHA1:
{
@@ -299,11 +321,18 @@ opensslrsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
#endif
#ifndef PK11_MD5_DISABLE
REQUIRE(dctx->key->key_alg == DST_ALG_RSAMD5 ||
dctx->key->key_alg == DST_ALG_RSASHA1 ||
dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
dctx->key->key_alg == DST_ALG_RSASHA256 ||
dctx->key->key_alg == DST_ALG_RSASHA512);
#else
REQUIRE(dctx->key->key_alg == DST_ALG_RSASHA1 ||
dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
dctx->key->key_alg == DST_ALG_RSASHA256 ||
dctx->key->key_alg == DST_ALG_RSASHA512);
#endif
#if USE_EVP
if (!EVP_DigestUpdate(evp_md_ctx, data->base, data->length)) {
@@ -313,6 +342,7 @@ opensslrsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
}
#else
switch (dctx->key->key_alg) {
#ifndef PK11_MD5_DISABLE
case DST_ALG_RSAMD5:
{
isc_md5_t *md5ctx = dctx->ctxdata.md5ctx;
@@ -320,6 +350,7 @@ opensslrsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
isc_md5_update(md5ctx, data->base, data->length);
}
break;
#endif
case DST_ALG_RSASHA1:
case DST_ALG_NSEC3RSASHA1:
{
@@ -385,11 +416,18 @@ opensslrsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
#endif
#endif
#ifndef PK11_MD5_DISABLE
REQUIRE(dctx->key->key_alg == DST_ALG_RSAMD5 ||
dctx->key->key_alg == DST_ALG_RSASHA1 ||
dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
dctx->key->key_alg == DST_ALG_RSASHA256 ||
dctx->key->key_alg == DST_ALG_RSASHA512);
#else
REQUIRE(dctx->key->key_alg == DST_ALG_RSASHA1 ||
dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
dctx->key->key_alg == DST_ALG_RSASHA256 ||
dctx->key->key_alg == DST_ALG_RSASHA512);
#endif
isc_buffer_availableregion(sig, &r);
@@ -407,6 +445,7 @@ opensslrsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
return (ISC_R_NOSPACE);
switch (dctx->key->key_alg) {
#ifndef PK11_MD5_DISABLE
case DST_ALG_RSAMD5:
{
isc_md5_t *md5ctx = dctx->ctxdata.md5ctx;
@@ -416,6 +455,7 @@ opensslrsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
digestlen = ISC_MD5_DIGESTLENGTH;
}
break;
#endif
case DST_ALG_RSASHA1:
case DST_ALG_NSEC3RSASHA1:
{
@@ -460,7 +500,9 @@ opensslrsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
#if OPENSSL_VERSION_NUMBER < 0x00908000L
switch (dctx->key->key_alg) {
#ifndef PK11_MD5_DISABLE
case DST_ALG_RSAMD5:
#endif
case DST_ALG_RSASHA1:
case DST_ALG_NSEC3RSASHA1:
INSIST(type != 0);
@@ -524,11 +566,18 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
#endif
#endif
#ifndef PK11_MD5_DISABLE
REQUIRE(dctx->key->key_alg == DST_ALG_RSAMD5 ||
dctx->key->key_alg == DST_ALG_RSASHA1 ||
dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
dctx->key->key_alg == DST_ALG_RSASHA256 ||
dctx->key->key_alg == DST_ALG_RSASHA512);
#else
REQUIRE(dctx->key->key_alg == DST_ALG_RSASHA1 ||
dctx->key->key_alg == DST_ALG_NSEC3RSASHA1 ||
dctx->key->key_alg == DST_ALG_RSASHA256 ||
dctx->key->key_alg == DST_ALG_RSASHA512);
#endif
#if USE_EVP
rsa = EVP_PKEY_get1_RSA(pkey);
@@ -555,6 +604,7 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
return (DST_R_VERIFYFAILURE);
switch (dctx->key->key_alg) {
#ifndef PK11_MD5_DISABLE
case DST_ALG_RSAMD5:
{
isc_md5_t *md5ctx = dctx->ctxdata.md5ctx;
@@ -564,6 +614,7 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
digestlen = ISC_MD5_DIGESTLENGTH;
}
break;
#endif
case DST_ALG_RSASHA1:
case DST_ALG_NSEC3RSASHA1:
{
@@ -611,7 +662,9 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
#if OPENSSL_VERSION_NUMBER < 0x00908000L
switch (dctx->key->key_alg) {
#ifndef PK11_MD5_DISABLE
case DST_ALG_RSAMD5:
#endif
case DST_ALG_RSASHA1:
case DST_ALG_NSEC3RSASHA1:
INSIST(type != 0);