1 /* 2 * Portions Copyright (C) 2004-2013 Internet Systems Consortium, Inc. ("ISC") 3 * Portions Copyright (C) 2000-2002 Internet Software Consortium. 4 * 5 * Permission to use, copy, modify, and/or distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS 10 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED 11 * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE 12 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR 15 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 * 17 * Portions Copyright (C) 1995-2000 by Network Associates, Inc. 18 * 19 * Permission to use, copy, modify, and/or distribute this software for any 20 * purpose with or without fee is hereby granted, provided that the above 21 * copyright notice and this permission notice appear in all copies. 22 * 23 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS 24 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED 25 * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE 26 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 27 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 28 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR 29 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 30 */ 31 32 /* $Id: dst_internal.h,v 1.31 2011/10/20 21:20:02 marka Exp $ */ 33 34 #ifndef DST_DST_INTERNAL_H 35 #define DST_DST_INTERNAL_H 1 36 37 #include <isc/lang.h> 38 #include <isc/buffer.h> 39 #include <isc/int.h> 40 #include <isc/magic.h> 41 #include <isc/region.h> 42 #include <isc/types.h> 43 #include <isc/md5.h> 44 #include <isc/refcount.h> 45 #include <isc/sha1.h> 46 #include <isc/sha2.h> 47 #include <isc/stdtime.h> 48 #include <isc/hmacmd5.h> 49 #include <isc/hmacsha.h> 50 51 #include <dns/time.h> 52 53 #include <dst/dst.h> 54 55 #ifdef OPENSSL 56 #include <openssl/dh.h> 57 #include <openssl/dsa.h> 58 #include <openssl/err.h> 59 #include <openssl/evp.h> 60 #include <openssl/objects.h> 61 #include <openssl/rsa.h> 62 #endif 63 64 ISC_LANG_BEGINDECLS 65 66 #define KEY_MAGIC ISC_MAGIC('D','S','T','K') 67 #define CTX_MAGIC ISC_MAGIC('D','S','T','C') 68 69 #define VALID_KEY(x) ISC_MAGIC_VALID(x, KEY_MAGIC) 70 #define VALID_CTX(x) ISC_MAGIC_VALID(x, CTX_MAGIC) 71 72 extern isc_mem_t *dst__memory_pool; 73 74 /*** 75 *** Types 76 ***/ 77 78 typedef struct dst_func dst_func_t; 79 80 typedef struct dst_hmacmd5_key dst_hmacmd5_key_t; 81 typedef struct dst_hmacsha1_key dst_hmacsha1_key_t; 82 typedef struct dst_hmacsha224_key dst_hmacsha224_key_t; 83 typedef struct dst_hmacsha256_key dst_hmacsha256_key_t; 84 typedef struct dst_hmacsha384_key dst_hmacsha384_key_t; 85 typedef struct dst_hmacsha512_key dst_hmacsha512_key_t; 86 87 /*% DST Key Structure */ 88 struct dst_key { 89 unsigned int magic; 90 isc_refcount_t refs; 91 dns_name_t * key_name; /*%< name of the key */ 92 unsigned int key_size; /*%< size of the key in bits */ 93 unsigned int key_proto; /*%< protocols this key is used for */ 94 unsigned int key_alg; /*%< algorithm of the key */ 95 isc_uint32_t key_flags; /*%< flags of the public key */ 96 isc_uint16_t key_id; /*%< identifier of the key */ 97 isc_uint16_t key_rid; /*%< identifier of the key when 98 revoked */ 99 isc_uint16_t key_bits; /*%< hmac digest bits */ 100 dns_rdataclass_t key_class; /*%< class of the key record */ 101 dns_ttl_t key_ttl; /*%< default/initial dnskey ttl */ 102 isc_mem_t *mctx; /*%< memory context */ 103 char *engine; /*%< engine name (HSM) */ 104 char *label; /*%< engine label (HSM) */ 105 union { 106 void *generic; 107 gss_ctx_id_t gssctx; 108 #ifdef OPENSSL 109 #if !defined(USE_EVP) || !USE_EVP 110 RSA *rsa; 111 #endif 112 DSA *dsa; 113 DH *dh; 114 EVP_PKEY *pkey; 115 #endif 116 dst_hmacmd5_key_t *hmacmd5; 117 dst_hmacsha1_key_t *hmacsha1; 118 dst_hmacsha224_key_t *hmacsha224; 119 dst_hmacsha256_key_t *hmacsha256; 120 dst_hmacsha384_key_t *hmacsha384; 121 dst_hmacsha512_key_t *hmacsha512; 122 123 } keydata; /*%< pointer to key in crypto pkg fmt */ 124 125 isc_stdtime_t times[DST_MAX_TIMES + 1]; /*%< timing metadata */ 126 isc_boolean_t timeset[DST_MAX_TIMES + 1]; /*%< data set? */ 127 isc_stdtime_t nums[DST_MAX_NUMERIC + 1]; /*%< numeric metadata */ 128 isc_boolean_t numset[DST_MAX_NUMERIC + 1]; /*%< data set? */ 129 isc_boolean_t inactive; /*%< private key not present as it is 130 inactive */ 131 isc_boolean_t external; /*%< external key */ 132 133 int fmt_major; /*%< private key format, major version */ 134 int fmt_minor; /*%< private key format, minor version */ 135 136 dst_func_t * func; /*%< crypto package specific functions */ 137 isc_buffer_t *key_tkeytoken; /*%< TKEY token data */ 138 }; 139 140 struct dst_context { 141 unsigned int magic; 142 dst_key_t *key; 143 isc_mem_t *mctx; 144 isc_logcategory_t *category; 145 union { 146 void *generic; 147 dst_gssapi_signverifyctx_t *gssctx; 148 isc_md5_t *md5ctx; 149 isc_sha1_t *sha1ctx; 150 isc_sha256_t *sha256ctx; 151 isc_sha512_t *sha512ctx; 152 isc_hmacmd5_t *hmacmd5ctx; 153 isc_hmacsha1_t *hmacsha1ctx; 154 isc_hmacsha224_t *hmacsha224ctx; 155 isc_hmacsha256_t *hmacsha256ctx; 156 isc_hmacsha384_t *hmacsha384ctx; 157 isc_hmacsha512_t *hmacsha512ctx; 158 #ifdef OPENSSL 159 EVP_MD_CTX *evp_md_ctx; 160 #endif 161 } ctxdata; 162 }; 163 164 struct dst_func { 165 /* 166 * Context functions 167 */ 168 isc_result_t (*createctx)(dst_key_t *key, dst_context_t *dctx); 169 void (*destroyctx)(dst_context_t *dctx); 170 isc_result_t (*adddata)(dst_context_t *dctx, const isc_region_t *data); 171 172 /* 173 * Key operations 174 */ 175 isc_result_t (*sign)(dst_context_t *dctx, isc_buffer_t *sig); 176 isc_result_t (*verify)(dst_context_t *dctx, const isc_region_t *sig); 177 isc_result_t (*verify2)(dst_context_t *dctx, int maxbits, 178 const isc_region_t *sig); 179 isc_result_t (*computesecret)(const dst_key_t *pub, 180 const dst_key_t *priv, 181 isc_buffer_t *secret); 182 isc_boolean_t (*compare)(const dst_key_t *key1, const dst_key_t *key2); 183 isc_boolean_t (*paramcompare)(const dst_key_t *key1, 184 const dst_key_t *key2); 185 isc_result_t (*generate)(dst_key_t *key, int parms, 186 void (*callback)(int)); 187 isc_boolean_t (*isprivate)(const dst_key_t *key); 188 void (*destroy)(dst_key_t *key); 189 190 /* conversion functions */ 191 isc_result_t (*todns)(const dst_key_t *key, isc_buffer_t *data); 192 isc_result_t (*fromdns)(dst_key_t *key, isc_buffer_t *data); 193 isc_result_t (*tofile)(const dst_key_t *key, const char *directory); 194 isc_result_t (*parse)(dst_key_t *key, 195 isc_lex_t *lexer, 196 dst_key_t *pub); 197 198 /* cleanup */ 199 void (*cleanup)(void); 200 201 isc_result_t (*fromlabel)(dst_key_t *key, const char *engine, 202 const char *label, const char *pin); 203 isc_result_t (*dump)(dst_key_t *key, isc_mem_t *mctx, char **buffer, 204 int *length); 205 isc_result_t (*restore)(dst_key_t *key, const char *keystr); 206 }; 207 208 /*% 209 * Initializers 210 */ 211 isc_result_t dst__openssl_init(const char *engine); 212 213 isc_result_t dst__hmacmd5_init(struct dst_func **funcp); 214 isc_result_t dst__hmacsha1_init(struct dst_func **funcp); 215 isc_result_t dst__hmacsha224_init(struct dst_func **funcp); 216 isc_result_t dst__hmacsha256_init(struct dst_func **funcp); 217 isc_result_t dst__hmacsha384_init(struct dst_func **funcp); 218 isc_result_t dst__hmacsha512_init(struct dst_func **funcp); 219 isc_result_t dst__opensslrsa_init(struct dst_func **funcp, 220 unsigned char algorithm); 221 isc_result_t dst__openssldsa_init(struct dst_func **funcp); 222 isc_result_t dst__openssldh_init(struct dst_func **funcp); 223 isc_result_t dst__gssapi_init(struct dst_func **funcp); 224 #ifdef HAVE_OPENSSL_GOST 225 isc_result_t dst__opensslgost_init(struct dst_func **funcp); 226 #endif 227 #ifdef HAVE_OPENSSL_ECDSA 228 isc_result_t dst__opensslecdsa_init(struct dst_func **funcp); 229 #endif 230 231 /*% 232 * Destructors 233 */ 234 void dst__openssl_destroy(void); 235 236 /*% 237 * Memory allocators using the DST memory pool. 238 */ 239 void * dst__mem_alloc(size_t size); 240 void dst__mem_free(void *ptr); 241 void * dst__mem_realloc(void *ptr, size_t size); 242 243 /*% 244 * Entropy retriever using the DST entropy pool. 245 */ 246 isc_result_t dst__entropy_getdata(void *buf, unsigned int len, 247 isc_boolean_t pseudo); 248 249 /* 250 * Entropy status hook. 251 */ 252 unsigned int dst__entropy_status(void); 253 254 ISC_LANG_ENDDECLS 255 256 #endif /* DST_DST_INTERNAL_H */ 257 /*! \file */ 258