1 /* $NetBSD: dst_internal.h,v 1.4 2020/05/24 19:46:22 christos Exp $ */ 2 3 /* 4 * Portions Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * This Source Code Form is subject to the terms of the Mozilla Public 7 * License, v. 2.0. If a copy of the MPL was not distributed with this 8 * file, You can obtain one at http://mozilla.org/MPL/2.0/. 9 * 10 * See the COPYRIGHT file distributed with this work for additional 11 * information regarding copyright ownership. 12 * 13 * Portions Copyright (C) Network Associates, Inc. 14 * 15 * Permission to use, copy, modify, and/or distribute this software for any 16 * purpose with or without fee is hereby granted, provided that the above 17 * copyright notice and this permission notice appear in all copies. 18 * 19 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS 20 * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED 21 * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE 22 * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 23 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 24 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR 25 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 26 */ 27 28 #pragma once 29 30 #include <inttypes.h> 31 #include <stdbool.h> 32 33 #include <isc/buffer.h> 34 #include <isc/hmac.h> 35 #include <isc/lang.h> 36 #include <isc/magic.h> 37 #include <isc/md.h> 38 #include <isc/refcount.h> 39 #include <isc/region.h> 40 #include <isc/stdtime.h> 41 #include <isc/types.h> 42 43 #if USE_PKCS11 44 #include <pk11/pk11.h> 45 #include <pk11/site.h> 46 #endif /* USE_PKCS11 */ 47 48 #include <openssl/dh.h> 49 #include <openssl/err.h> 50 #include <openssl/evp.h> 51 #include <openssl/objects.h> 52 #include <openssl/rsa.h> 53 54 #include <dns/time.h> 55 56 #include <dst/dst.h> 57 58 ISC_LANG_BEGINDECLS 59 60 #define KEY_MAGIC ISC_MAGIC('D', 'S', 'T', 'K') 61 #define CTX_MAGIC ISC_MAGIC('D', 'S', 'T', 'C') 62 63 #define VALID_KEY(x) ISC_MAGIC_VALID(x, KEY_MAGIC) 64 #define VALID_CTX(x) ISC_MAGIC_VALID(x, CTX_MAGIC) 65 66 /*** 67 *** Types 68 ***/ 69 70 typedef struct dst_func dst_func_t; 71 72 typedef struct dst_hmac_key dst_hmac_key_t; 73 74 /*% 75 * Indicate whether a DST context will be used for signing 76 * or for verification 77 */ 78 typedef enum { DO_SIGN, DO_VERIFY } dst_use_t; 79 80 /*% DST Key Structure */ 81 struct dst_key { 82 unsigned int magic; 83 isc_refcount_t refs; 84 dns_name_t *key_name; /*%< name of the key */ 85 unsigned int key_size; /*%< size of the key in bits */ 86 unsigned int key_proto; /*%< protocols this key is used for 87 * */ 88 unsigned int key_alg; /*%< algorithm of the key */ 89 uint32_t key_flags; /*%< flags of the public key */ 90 uint16_t key_id; /*%< identifier of the key */ 91 uint16_t key_rid; /*%< identifier of the key when 92 * revoked */ 93 uint16_t key_bits; /*%< hmac digest bits */ 94 dns_rdataclass_t key_class; /*%< class of the key record */ 95 dns_ttl_t key_ttl; /*%< default/initial dnskey ttl */ 96 isc_mem_t *mctx; /*%< memory context */ 97 char *engine; /*%< engine name (HSM) */ 98 char *label; /*%< engine label (HSM) */ 99 union { 100 void *generic; 101 gss_ctx_id_t gssctx; 102 DH *dh; 103 #if USE_OPENSSL 104 EVP_PKEY *pkey; 105 #endif /* if USE_OPENSSL */ 106 #if USE_PKCS11 107 pk11_object_t *pkey; 108 #endif /* if USE_PKCS11 */ 109 dst_hmac_key_t *hmac_key; 110 } keydata; /*%< pointer to key in crypto pkg fmt */ 111 112 isc_stdtime_t times[DST_MAX_TIMES + 1]; /*%< timing metadata */ 113 bool timeset[DST_MAX_TIMES + 1]; /*%< data set? */ 114 115 uint32_t nums[DST_MAX_NUMERIC + 1]; /*%< numeric metadata 116 * */ 117 bool numset[DST_MAX_NUMERIC + 1]; /*%< data set? */ 118 119 bool bools[DST_MAX_BOOLEAN + 1]; /*%< boolean metadata 120 * */ 121 bool boolset[DST_MAX_BOOLEAN + 1]; /*%< data set? */ 122 123 dst_key_state_t keystates[DST_MAX_KEYSTATES + 1]; /*%< key states 124 * */ 125 bool keystateset[DST_MAX_KEYSTATES + 1]; /*%< data 126 * set? */ 127 128 bool inactive; /*%< private key not present as it is 129 * inactive */ 130 bool external; /*%< external key */ 131 132 int fmt_major; /*%< private key format, major version 133 * */ 134 int fmt_minor; /*%< private key format, minor version 135 * */ 136 137 dst_func_t *func; /*%< crypto package specific functions */ 138 isc_buffer_t *key_tkeytoken; /*%< TKEY token data */ 139 }; 140 141 struct dst_context { 142 unsigned int magic; 143 dst_use_t use; 144 dst_key_t *key; 145 isc_mem_t *mctx; 146 isc_logcategory_t *category; 147 union { 148 void *generic; 149 dst_gssapi_signverifyctx_t *gssctx; 150 isc_hmac_t *hmac_ctx; 151 EVP_MD_CTX *evp_md_ctx; 152 #if USE_PKCS11 153 pk11_context_t *pk11_ctx; 154 #endif /* if USE_PKCS11 */ 155 } ctxdata; 156 }; 157 158 struct dst_func { 159 /* 160 * Context functions 161 */ 162 isc_result_t (*createctx)(dst_key_t *key, dst_context_t *dctx); 163 isc_result_t (*createctx2)(dst_key_t *key, int maxbits, 164 dst_context_t *dctx); 165 void (*destroyctx)(dst_context_t *dctx); 166 isc_result_t (*adddata)(dst_context_t *dctx, const isc_region_t *data); 167 168 /* 169 * Key operations 170 */ 171 isc_result_t (*sign)(dst_context_t *dctx, isc_buffer_t *sig); 172 isc_result_t (*verify)(dst_context_t *dctx, const isc_region_t *sig); 173 isc_result_t (*verify2)(dst_context_t *dctx, int maxbits, 174 const isc_region_t *sig); 175 isc_result_t (*computesecret)(const dst_key_t *pub, 176 const dst_key_t *priv, 177 isc_buffer_t *secret); 178 bool (*compare)(const dst_key_t *key1, const dst_key_t *key2); 179 bool (*paramcompare)(const dst_key_t *key1, const dst_key_t *key2); 180 isc_result_t (*generate)(dst_key_t *key, int parms, 181 void (*callback)(int)); 182 bool (*isprivate)(const dst_key_t *key); 183 void (*destroy)(dst_key_t *key); 184 185 /* conversion functions */ 186 isc_result_t (*todns)(const dst_key_t *key, isc_buffer_t *data); 187 isc_result_t (*fromdns)(dst_key_t *key, isc_buffer_t *data); 188 isc_result_t (*tofile)(const dst_key_t *key, const char *directory); 189 isc_result_t (*parse)(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub); 190 191 /* cleanup */ 192 void (*cleanup)(void); 193 194 isc_result_t (*fromlabel)(dst_key_t *key, const char *engine, 195 const char *label, const char *pin); 196 isc_result_t (*dump)(dst_key_t *key, isc_mem_t *mctx, char **buffer, 197 int *length); 198 isc_result_t (*restore)(dst_key_t *key, const char *keystr); 199 }; 200 201 /*% 202 * Initializers 203 */ 204 isc_result_t 205 dst__openssl_init(isc_mem_t *, const char *engine); 206 #define dst__pkcs11_init pk11_initialize 207 208 isc_result_t 209 dst__hmacmd5_init(struct dst_func **funcp); 210 isc_result_t 211 dst__hmacsha1_init(struct dst_func **funcp); 212 isc_result_t 213 dst__hmacsha224_init(struct dst_func **funcp); 214 isc_result_t 215 dst__hmacsha256_init(struct dst_func **funcp); 216 isc_result_t 217 dst__hmacsha384_init(struct dst_func **funcp); 218 isc_result_t 219 dst__hmacsha512_init(struct dst_func **funcp); 220 isc_result_t 221 dst__openssldh_init(struct dst_func **funcp); 222 #if USE_OPENSSL 223 isc_result_t 224 dst__opensslrsa_init(struct dst_func **funcp, unsigned char algorithm); 225 isc_result_t 226 dst__opensslecdsa_init(struct dst_func **funcp); 227 #if HAVE_OPENSSL_ED25519 || HAVE_OPENSSL_ED448 228 isc_result_t 229 dst__openssleddsa_init(struct dst_func **funcp); 230 #endif /* HAVE_OPENSSL_ED25519 || HAVE_OPENSSL_ED448 */ 231 #endif /* USE_OPENSSL */ 232 #if USE_PKCS11 233 isc_result_t 234 dst__pkcs11rsa_init(struct dst_func **funcp); 235 isc_result_t 236 dst__pkcs11dsa_init(struct dst_func **funcp); 237 isc_result_t 238 dst__pkcs11ecdsa_init(struct dst_func **funcp); 239 isc_result_t 240 dst__pkcs11eddsa_init(struct dst_func **funcp); 241 #endif /* USE_PKCS11 */ 242 #ifdef GSSAPI 243 isc_result_t 244 dst__gssapi_init(struct dst_func **funcp); 245 #endif /* GSSAPI */ 246 247 /*% 248 * Destructors 249 */ 250 void 251 dst__openssl_destroy(void); 252 #define dst__pkcs11_destroy pk11_finalize 253 254 /*% 255 * Memory allocators using the DST memory pool. 256 */ 257 void * 258 dst__mem_alloc(size_t size); 259 void 260 dst__mem_free(void *ptr); 261 void * 262 dst__mem_realloc(void *ptr, size_t size); 263 264 ISC_LANG_ENDDECLS 265 266 /*! \file */ 267