18 #include <openssl/ssl.h>
19 #include <openssl/rand.h>
20 #include <openssl/bn.h>
21 #include <openssl/rsa.h>
23 #include <openssl/dsa.h>
25 #ifndef OPENSSL_NO_ENGINE
26 #include <openssl/engine.h>
46 { LDNS_SIGN_ED25519,
"ED25519" },
49 { LDNS_SIGN_ED448,
"ED448" },
72 key_list->
_keys = NULL;
109 #if defined(HAVE_SSL) && !defined(OPENSSL_NO_ENGINE)
118 k->
_key.
key = ENGINE_load_private_key(e, key_id, UI_OpenSSL(), NULL);
141 static int gost_id = 0;
142 const EVP_PKEY_ASN1_METHOD* meth;
145 if(gost_id)
return gost_id;
148 meth = EVP_PKEY_asn1_find_str(NULL,
"gost2001", -1);
150 EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
155 e = ENGINE_by_id(
"gost");
158 ENGINE_load_builtin_engines();
159 ENGINE_load_dynamic();
160 e = ENGINE_by_id(
"gost");
166 if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
172 meth = EVP_PKEY_asn1_find_str(&e,
"gost2001", -1);
183 EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
198 ldns_key_new_frm_fp_gost_l(FILE* fp,
int* line_nr)
201 const unsigned char* pp;
211 sizeof(token), line_nr) == -1)
213 while(strlen(token) < 96) {
216 sizeof(token)-strlen(token), line_nr) == -1)
222 pkey = d2i_PrivateKey(gost_id, NULL, &pp, (
int)
ldns_rdf_size(b64rdf));
231 ldns_EC_KEY_calc_public(EC_KEY* ec)
234 const EC_GROUP* group;
235 group = EC_KEY_get0_group(ec);
236 pub_key = EC_POINT_new(group);
237 if(!pub_key)
return 0;
238 if(!EC_POINT_copy(pub_key, EC_GROUP_get0_generator(group))) {
239 EC_POINT_free(pub_key);
242 if(!EC_POINT_mul(group, pub_key, EC_KEY_get0_private_key(ec),
244 EC_POINT_free(pub_key);
247 if(EC_KEY_set_public_key(ec, pub_key) == 0) {
248 EC_POINT_free(pub_key);
251 EC_POINT_free(pub_key);
257 ldns_key_new_frm_fp_ecdsa_l(FILE* fp,
ldns_algorithm alg,
int* line_nr)
266 sizeof(token), line_nr) == -1)
273 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
275 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
287 EC_KEY_set_private_key(ec, bn);
289 if(!ldns_EC_KEY_calc_public(ec)) {
294 evp_key = EVP_PKEY_new();
299 if (!EVP_PKEY_assign_EC_KEY(evp_key, ec)) {
300 EVP_PKEY_free(evp_key);
311 ldns_ed25519_priv_raw(uint8_t* pkey,
int plen)
313 const unsigned char* pp;
316 uint8_t pre[] = {0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06,
317 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20};
330 buflen = pre_len + plen;
331 if((
size_t)buflen >
sizeof(buf))
333 memmove(buf, pre, pre_len);
334 memmove(buf+pre_len, pkey, plen);
339 return d2i_PrivateKey(NID_ED25519, NULL, &pp, buflen);
344 ldns_key_new_frm_fp_ed25519_l(FILE* fp,
int* line_nr)
350 sizeof(token), line_nr) == -1)
371 ldns_ed448_priv_raw(uint8_t* pkey,
int plen)
373 const unsigned char* pp;
376 uint8_t pre[] = {0x30, 0x47, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x71, 0x04, 0x3b, 0x04, 0x39};
382 buflen = pre_len + plen;
383 if((
size_t)buflen >
sizeof(buf))
385 memmove(buf, pre, pre_len);
386 memmove(buf+pre_len, pkey, plen);
391 return d2i_PrivateKey(NID_ED448, NULL, &pp, buflen);
396 ldns_key_new_frm_fp_ed448_l(FILE* fp,
int* line_nr)
402 sizeof(token), line_nr) == -1)
456 if (strncmp(d,
"v1.", 3) != 0) {
472 if (strncmp(d,
"1 RSA", 2) == 0) {
475 if (strncmp(d,
"2 DH", 2) == 0) {
478 if (strncmp(d,
"3 DSA", 2) == 0) {
483 fprintf(stderr,
"Warning: DSA not compiled into this ");
484 fprintf(stderr,
"version of ldns\n");
488 if (strncmp(d,
"4 ECC", 2) == 0) {
491 if (strncmp(d,
"5 RSASHA1", 2) == 0) {
494 if (strncmp(d,
"6 DSA", 2) == 0) {
499 fprintf(stderr,
"Warning: DSA not compiled into this ");
500 fprintf(stderr,
"version of ldns\n");
504 if (strncmp(d,
"7 RSASHA1", 2) == 0) {
508 if (strncmp(d,
"8 RSASHA256", 2) == 0) {
513 fprintf(stderr,
"Warning: SHA256 not compiled into this ");
514 fprintf(stderr,
"version of ldns\n");
518 if (strncmp(d,
"10 RSASHA512", 3) == 0) {
523 fprintf(stderr,
"Warning: SHA512 not compiled into this ");
524 fprintf(stderr,
"version of ldns\n");
528 if (strncmp(d,
"12 ECC-GOST", 3) == 0) {
533 fprintf(stderr,
"Warning: ECC-GOST not compiled into this ");
534 fprintf(stderr,
"version of ldns, use --enable-gost\n");
538 if (strncmp(d,
"13 ECDSAP256SHA256", 3) == 0) {
543 fprintf(stderr,
"Warning: ECDSA not compiled into this ");
544 fprintf(stderr,
"version of ldns, use --enable-ecdsa\n");
548 if (strncmp(d,
"14 ECDSAP384SHA384", 3) == 0) {
553 fprintf(stderr,
"Warning: ECDSA not compiled into this ");
554 fprintf(stderr,
"version of ldns, use --enable-ecdsa\n");
558 if (strncmp(d,
"15 ED25519", 3) == 0) {
560 alg = LDNS_SIGN_ED25519;
563 fprintf(stderr,
"Warning: ED25519 not compiled into this ");
564 fprintf(stderr,
"version of ldns, use --enable-ed25519\n");
568 if (strncmp(d,
"16 ED448", 3) == 0) {
570 alg = LDNS_SIGN_ED448;
573 fprintf(stderr,
"Warning: ED448 not compiled into this ");
574 fprintf(stderr,
"version of ldns, use --enable-ed448\n");
578 if (strncmp(d,
"157 HMAC-MD5", 4) == 0) {
581 if (strncmp(d,
"158 HMAC-SHA1", 4) == 0) {
584 if (strncmp(d,
"159 HMAC-SHA256", 4) == 0) {
588 if (strncmp(d,
"161 ", 4) == 0) {
591 if (strncmp(d,
"162 HMAC-SHA224", 4) == 0) {
595 if (strncmp(d,
"163 ", 4) == 0) {
598 if (strncmp(d,
"164 HMAC-SHA384", 4) == 0) {
601 if (strncmp(d,
"165 HMAC-SHA512", 4) == 0) {
657 #if defined(HAVE_SSL) && defined(USE_GOST)
663 ldns_key_new_frm_fp_gost_l(fp, line_nr));
687 case LDNS_SIGN_ED25519:
690 ldns_key_new_frm_fp_ed25519_l(fp, line_nr));
700 case LDNS_SIGN_ED448:
703 ldns_key_new_frm_fp_ed448_l(fp, line_nr));
767 BIGNUM *n=NULL, *e=NULL, *d=NULL, *p=NULL, *q=NULL,
768 *dmp1=NULL, *dmq1=NULL, *iqmp=NULL;
773 if (!b || !rsa || !buf) {
785 i =
ldns_b64_pton((
const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
787 n = BN_bin2bn((
const char unsigned*)buf, i, NULL);
796 i =
ldns_b64_pton((
const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
797 e = BN_bin2bn((
const char unsigned*)buf, i, NULL);
806 i =
ldns_b64_pton((
const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
807 d = BN_bin2bn((
const char unsigned*)buf, i, NULL);
816 i =
ldns_b64_pton((
const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
817 p = BN_bin2bn((
const char unsigned*)buf, i, NULL);
826 i =
ldns_b64_pton((
const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
827 q = BN_bin2bn((
const char unsigned*)buf, i, NULL);
836 i =
ldns_b64_pton((
const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
837 dmp1 = BN_bin2bn((
const char unsigned*)buf, i, NULL);
846 i =
ldns_b64_pton((
const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
847 dmq1 = BN_bin2bn((
const char unsigned*)buf, i, NULL);
856 i =
ldns_b64_pton((
const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
857 iqmp = BN_bin2bn((
const char unsigned*)buf, i, NULL);
863 #if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
875 if(!RSA_set0_key(rsa, n, e, d))
880 if(!RSA_set0_factors(rsa, p, q))
884 if(!RSA_set0_crt_params(rsa, dmp1, dmq1, iqmp))
920 BIGNUM *p=NULL, *q=NULL, *g=NULL, *priv_key=NULL, *pub_key=NULL;
925 if (!d || !dsa || !buf) {
935 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
937 p = BN_bin2bn((
const char unsigned*)buf, i, NULL);
946 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
947 q = BN_bin2bn((
const char unsigned*)buf, i, NULL);
956 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
957 g = BN_bin2bn((
const char unsigned*)buf, i, NULL);
966 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
967 priv_key = BN_bin2bn((
const char unsigned*)buf, i, NULL);
976 i =
ldns_b64_pton((
const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
977 pub_key = BN_bin2bn((
const char unsigned*)buf, i, NULL);
983 #if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
988 dsa->priv_key = priv_key;
989 dsa->pub_key = pub_key;
992 if(!DSA_set0_pqg(dsa, p, q, g))
997 if(!DSA_set0_key(dsa, pub_key, priv_key))
1032 unsigned char *buf = NULL;
1038 ldns_b64_ntop_calculate_size(strlen(d))))) == NULL
1047 ldns_gen_gost_key(
void)
1054 ctx = EVP_PKEY_CTX_new_id(gost_id, NULL);
1059 if(EVP_PKEY_CTX_ctrl_str(ctx,
"paramset",
"A") <= 0) {
1061 EVP_PKEY_CTX_free(ctx);
1065 if(EVP_PKEY_keygen_init(ctx) <= 0) {
1066 EVP_PKEY_CTX_free(ctx);
1069 if(EVP_PKEY_keygen(ctx, &p) <= 0) {
1071 EVP_PKEY_CTX_free(ctx);
1074 EVP_PKEY_CTX_free(ctx);
1090 # ifdef HAVE_EVP_PKEY_KEYGEN
1097 uint16_t offset = 0;
1099 unsigned char *hmac;
1112 #ifdef HAVE_EVP_PKEY_KEYGEN
1113 ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
1118 if(EVP_PKEY_keygen_init(ctx) <= 0) {
1120 EVP_PKEY_CTX_free(ctx);
1123 if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, size) <= 0) {
1125 EVP_PKEY_CTX_free(ctx);
1129 if (EVP_PKEY_keygen(ctx, &k->
_key.
key) <= 0) {
1131 EVP_PKEY_CTX_free(ctx);
1135 EVP_PKEY_CTX_free(ctx);
1137 r = RSA_generate_key((
int)size, RSA_F4, NULL, NULL);
1142 if (RSA_check_key(r) != 1) {
1155 # if OPENSSL_VERSION_NUMBER < 0x00908000L
1156 d = DSA_generate_parameters((
int)size, NULL, 0, NULL, NULL, NULL, NULL);
1163 if (! (d = DSA_new())) {
1167 if (! DSA_generate_parameters_ex(d, (
int)size, NULL, 0, NULL, NULL, NULL)) {
1173 if (DSA_generate_key(d) != 1) {
1202 if (RAND_bytes(hmac, (
int) size) != 1) {
1208 while (offset +
sizeof(i) < size) {
1210 memcpy(&hmac[offset], &i,
sizeof(i));
1211 offset +=
sizeof(i);
1213 if (offset < size) {
1215 memcpy(&hmac[offset], &i, size - offset);
1223 #if defined(HAVE_SSL) && defined(USE_GOST)
1240 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
1242 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
1247 if(!EC_KEY_generate_key(ec)) {
1259 if (!EVP_PKEY_assign_EC_KEY(k->
_key.
key, ec)) {
1271 case LDNS_SIGN_ED25519:
1272 #ifdef HAVE_EVP_PKEY_KEYGEN
1273 ctx = EVP_PKEY_CTX_new_id(NID_ED25519, NULL);
1278 if(EVP_PKEY_keygen_init(ctx) <= 0) {
1280 EVP_PKEY_CTX_free(ctx);
1283 if (EVP_PKEY_keygen(ctx, &k->
_key.
key) <= 0) {
1285 EVP_PKEY_CTX_free(ctx);
1288 EVP_PKEY_CTX_free(ctx);
1293 case LDNS_SIGN_ED448:
1294 #ifdef HAVE_EVP_PKEY_KEYGEN
1295 ctx = EVP_PKEY_CTX_new_id(NID_ED448, NULL);
1300 if(EVP_PKEY_keygen_init(ctx) <= 0) {
1302 EVP_PKEY_CTX_free(ctx);
1305 if (EVP_PKEY_keygen(ctx, &k->
_key.
key) <= 0) {
1307 EVP_PKEY_CTX_free(ctx);
1310 EVP_PKEY_CTX_free(ctx);
1324 fprintf(output,
"%s", str);
1326 fprintf(output,
"Unable to convert private key to string\n");
1355 EVP_PKEY *key = EVP_PKEY_new();
1356 EVP_PKEY_set1_RSA(key, r);
1364 EVP_PKEY *key = EVP_PKEY_new();
1365 EVP_PKEY_set1_DSA(key, d);
1375 EVP_PKEY *key = EVP_PKEY_new();
1376 EVP_PKEY_assign_RSA(key, r);
1384 EVP_PKEY *key = EVP_PKEY_new();
1385 EVP_PKEY_assign_DSA(key, d);
1453 return key->
_keys[nr];
1494 return EVP_PKEY_get1_RSA(k->
_key.
key);
1505 return EVP_PKEY_get1_DSA(k->
_key.
key);
1612 key_list->
_keys = keys;
1613 key_list->
_keys[key_count] = key;
1631 if (key_count == 0) {
1640 key_list->
_keys = a;
1652 ldns_key_rsa2bin(
unsigned char *data, RSA *k, uint16_t *size)
1655 const BIGNUM *n=NULL, *e=NULL;
1660 #if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(HAVE_LIBRESSL)
1664 RSA_get0_key(k, &n, &e, NULL);
1667 if (BN_num_bytes(e) <= 256) {
1671 data[0] = (
unsigned char) BN_num_bytes(e);
1672 i = BN_bn2bin(e, data + 1);
1673 j = BN_bn2bin(n, data + i + 1);
1674 *size = (uint16_t) i + j;
1675 }
else if (BN_num_bytes(e) <= 65536) {
1678 ldns_write_uint16(data + 1, (uint16_t) BN_num_bytes(e));
1680 BN_bn2bin(e, data + 3);
1681 BN_bn2bin(n, data + 4 + BN_num_bytes(e));
1682 *size = (uint16_t) BN_num_bytes(n) + 6;
1692 ldns_key_dsa2bin(
unsigned char *data, DSA *k, uint16_t *size)
1695 const BIGNUM *p, *q, *g;
1696 const BIGNUM *pub_key, *priv_key;
1703 # ifdef HAVE_DSA_GET0_PQG
1704 DSA_get0_pqg(k, &p, &q, &g);
1706 p = k->p; q = k->q; g = k->g;
1708 # ifdef HAVE_DSA_GET0_KEY
1709 DSA_get0_key(k, &pub_key, &priv_key);
1711 pub_key = k->pub_key; priv_key = k->priv_key;
1714 *size = (uint16_t)BN_num_bytes(p);
1715 T = (*size - 64) / 8;
1719 fprintf(stderr,
"DSA key with T > 8 (ie. > 1024 bits)");
1720 fprintf(stderr,
" not implemented\n");
1726 memset(data, 0, 21 + *size * 3);
1727 data[0] = (
unsigned char)T;
1728 BN_bn2bin(q, data + 1 );
1729 BN_bn2bin(p, data + 21 );
1730 BN_bn2bin(g, data + 21 + *size * 2 - BN_num_bytes(g));
1731 BN_bn2bin(pub_key,data + 21 + *size * 3 - BN_num_bytes(pub_key));
1732 *size = 21 + *size * 3;
1739 ldns_key_gost2bin(
unsigned char* data, EVP_PKEY* k, uint16_t* size)
1742 unsigned char* pp = NULL;
1743 if(i2d_PUBKEY(k, &pp) != 37 + 64) {
1759 ldns_key_ed255192bin(
unsigned char* data, EVP_PKEY* k, uint16_t* size)
1762 unsigned char* pp = NULL;
1763 if(i2d_PUBKEY(k, &pp) != 12 + 32) {
1779 ldns_key_ed4482bin(
unsigned char* data, EVP_PKEY* k, uint16_t* size)
1782 unsigned char* pp = NULL;
1783 if(i2d_PUBKEY(k, &pp) != 12 + 57) {
1809 unsigned char *bin = NULL;
1820 int internal_data = 0;
1869 if (!ldns_key_rsa2bin(bin, rsa, &size)) {
1892 if (!ldns_key_dsa2bin(bin, dsa, &size)) {
1915 if (!ldns_key_dsa2bin(bin, dsa, &size)) {
1929 #if defined(HAVE_SSL) && defined(USE_GOST)
1936 if (!ldns_key_gost2bin(bin, k->
_key.
key, &size)) {
1955 ec = EVP_PKEY_get1_EC_KEY(k->
_key.
key);
1957 EC_KEY_set_conv_form(ec, POINT_CONVERSION_UNCOMPRESSED);
1958 size = (uint16_t)i2o_ECPublicKey(ec, NULL);
1959 if(!i2o_ECPublicKey(ec, &bin)) {
1969 assert(bin[0] == POINT_CONVERSION_UNCOMPRESSED);
1971 memmove(bin, bin+1, size);
1983 case LDNS_SIGN_ED25519:
1991 if (!ldns_key_ed255192bin(bin, k->
_key.
key, &size)) {
2000 case LDNS_SIGN_ED448:
2008 if (!ldns_key_ed4482bin(bin, k->
_key.
key, &size)) {
2036 if (internal_data) {
2053 unsigned char* hmac;
2094 fp = fopen(filename,
"r");
2097 fprintf(stderr,
"Unable to open %s: %s\n", filename, strerror(errno));
2113 fprintf(stderr,
"nothing read from %s", filename);
2136 char *file_base_name;
2147 return file_base_name;
2189 if(strcasecmp(lt->
name, name) == 0)
2195 if(strcasecmp(lt->
name, name) == 0)
2199 a = strtol(name, &endptr, 10);
2200 if (*name && !*endptr)
void ldns_buffer_free(ldns_buffer *buffer)
frees the buffer.
ldns_buffer * ldns_buffer_new(size_t capacity)
creates a new buffer with the specified capacity.
int ldns_buffer_printf(ldns_buffer *buffer, const char *format,...)
prints to the buffer, increasing the capacity if required using buffer_reserve().
void * ldns_buffer_export(ldns_buffer *buffer)
Makes the buffer fixed and returns a pointer to the data.
int ldns_b64_pton(char const *src, uint8_t *target, size_t targsize)
uint16_t ldns_calc_keytag(const ldns_rr *key)
calculates a keytag of a key for use in DNSSEC.
#define LDNS_DNSSEC_KEYPROTO
const char * ldns_get_errorstr_by_id(ldns_status err)
look up a descriptive text by each error.
@ LDNS_STATUS_SYNTAX_VERSION_ERR
@ LDNS_STATUS_ENGINE_KEY_NOT_LOADED
@ LDNS_STATUS_CRYPTO_ALGO_NOT_IMPL
@ LDNS_STATUS_SYNTAX_ALG_ERR
enum ldns_enum_status ldns_status
char * ldns_key2str(const ldns_key *k)
Converts a private key to the test presentation fmt and returns that as a char *.
ldns_status ldns_rdf2buffer_str_dname(ldns_buffer *output, const ldns_rdf *dname)
Print the ldns_rdf containing a dname to the buffer.
ldns_status ldns_key_new_frm_fp_l(ldns_key **key, FILE *fp, int *line_nr)
Creates a new private key based on the contents of the file pointed by fp.
void ldns_key_list_set_key_count(ldns_key_list *key, size_t count)
Set the keylist's key count to count.
uint32_t ldns_key_expiration(const ldns_key *k)
return the key's expiration date
void ldns_key_list_free(ldns_key_list *key_list)
Frees a key list structure.
EVP_PKEY * ldns_key_evp_key(const ldns_key *k)
returns the (openssl) EVP struct contained in the key
ldns_key * ldns_key_list_pop_key(ldns_key_list *key_list)
pops the last rr from a keylist
bool ldns_key_list_push_key(ldns_key_list *key_list, ldns_key *key)
pushes a key to a keylist
ldns_signing_algorithm ldns_get_signing_algorithm_by_name(const char *name)
Get signing algorithm by name.
RSA * ldns_key_new_frm_fp_rsa_l(FILE *f, int *line_nr)
frm_fp helper function.
int ldns_key_algo_supported(int algo)
See if a key algorithm is supported.
void ldns_key_set_external_key(ldns_key *k, void *external_key)
Set the key id data.
void ldns_key_set_expiration(ldns_key *k, uint32_t e)
Set the key's expiration date (seconds after epoch)
ldns_status ldns_key_new_frm_fp(ldns_key **k, FILE *fp)
Creates a new priv key based on the contents of the file pointed by fp.
void ldns_key_set_hmac_key(ldns_key *k, unsigned char *hmac)
Set the key's hmac data.
void ldns_key_set_dsa_key(ldns_key *k, DSA *d)
Set the key's dsa data The dsa data should be freed by the user.
void ldns_key_set_use(ldns_key *k, bool v)
set the use flag
void ldns_key_list_set_use(ldns_key_list *keys, bool v)
Set the 'use' flag for all keys in the list.
ldns_rr * ldns_key2rr(const ldns_key *k)
converts a ldns_key to a public key rr If the key data exists at an external point,...
void ldns_key_set_pubkey_owner(ldns_key *k, ldns_rdf *r)
Set the key's pubkey owner.
unsigned char * ldns_key_hmac_key(const ldns_key *k)
return the hmac key data
ldns_key_list * ldns_key_list_new(void)
Creates a new empty key list.
ldns_key * ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size)
Creates a new key based on the algorithm.
DSA * ldns_key_new_frm_fp_dsa(FILE *f)
frm_fp helper function.
ldns_rr * ldns_read_anchor_file(const char *filename)
Instantiates a DNSKEY or DS RR from file.
void ldns_key_EVP_unload_gost(void)
Release the engine reference held for the GOST engine.
ENGINE * ldns_gost_engine
store GOST engine reference loaded into OpenSSL library
uint32_t ldns_key_origttl(const ldns_key *k)
return the original ttl of the key
int ldns_key_EVP_load_gost_id(void)
Get the PKEY id for GOST, loads GOST into openssl as a side effect.
void * ldns_key_external_key(const ldns_key *k)
return the key id key data
void ldns_key_print(FILE *output, const ldns_key *k)
print a private key to the file output
unsigned char * ldns_key_new_frm_fp_hmac_l(FILE *f, int *line_nr __attribute__((unused)), size_t *hmac_size)
void ldns_key_assign_dsa_key(ldns_key *k, DSA *d)
Assign the key's dsa data The dsa data will be freed automatically when the key is freed.
size_t ldns_key_hmac_size(const ldns_key *k)
return the hmac key size
char * ldns_key_get_file_base_name(const ldns_key *key)
Returns the 'default base name' for key files; IE.
uint16_t ldns_key_keytag(const ldns_key *k)
return the keytag
void ldns_key_set_origttl(ldns_key *k, uint32_t t)
Set the key's original ttl.
ldns_signing_algorithm ldns_key_algorithm(const ldns_key *k)
return the signing alg of the key
void ldns_key_set_evp_key(ldns_key *k, EVP_PKEY *e)
Set the key's evp key.
void ldns_key_set_keytag(ldns_key *k, uint16_t tag)
Set the key's key tag.
void ldns_key_free(ldns_key *key)
frees a key structure, but not its internal data structures
uint32_t ldns_key_inception(const ldns_key *k)
return the key's inception date
void ldns_key_set_hmac_size(ldns_key *k, size_t hmac_size)
Set the key's hmac size.
RSA * ldns_key_rsa_key(const ldns_key *k)
returns the (openssl) RSA struct contained in the key
ldns_rdf * ldns_key_pubkey_owner(const ldns_key *k)
return the public key's owner
RSA * ldns_key_new_frm_fp_rsa(FILE *f)
frm_fp helper function.
ldns_lookup_table ldns_signing_algorithms[]
ldns_status ldns_key_new_frm_engine(ldns_key **key, ENGINE *e, char *key_id, ldns_algorithm alg)
Read the key with the given id from the given engine and store it in the given ldns_key structure.
ldns_key * ldns_key_new(void)
Creates a new empty key structure.
unsigned char * ldns_key_new_frm_fp_hmac(FILE *f, size_t *hmac_size)
frm_fp helper function.
uint16_t ldns_key_flags(const ldns_key *k)
return the flag of the key
void ldns_key_set_algorithm(ldns_key *k, ldns_signing_algorithm l)
Set the key's algorithm.
DSA * ldns_key_dsa_key(const ldns_key *k)
returns the (openssl) DSA struct contained in the key
void ldns_key_assign_rsa_key(ldns_key *k, RSA *r)
Assign the key's rsa data The rsa data will be freed automatically when the key is freed.
DSA * ldns_key_new_frm_fp_dsa_l(FILE *f, int *line_nr __attribute__((unused)))
size_t ldns_key_list_key_count(const ldns_key_list *key_list)
returns the number of keys in the key list
void ldns_key_set_flags(ldns_key *k, uint16_t f)
Set the key's flags.
void ldns_key_set_rsa_key(ldns_key *k, RSA *r)
Set the key's rsa data.
void ldns_key_deep_free(ldns_key *key)
frees a key structure and all its internal data structures, except the data set by ldns_key_set_exter...
void ldns_key_set_inception(ldns_key *k, uint32_t i)
Set the key's inception date (seconds after epoch)
ldns_key * ldns_key_list_key(const ldns_key_list *key, size_t nr)
returns a pointer to the key in the list at the given position
bool ldns_key_use(const ldns_key *k)
return the use flag
enum ldns_enum_signing_algorithm ldns_signing_algorithm
@ LDNS_SIGN_ECDSAP256SHA256
@ LDNS_SIGN_RSASHA1_NSEC3
@ LDNS_SIGN_ECDSAP384SHA384
#define LDNS_KEY_ZONE_KEY
enum ldns_enum_algorithm ldns_algorithm
Including this file will include all ldns files, and define some lookup tables.
#define LDNS_MAX_PACKETLEN
ssize_t ldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *line_nr)
returns a token/char from the stream F.
ssize_t ldns_fget_keyword_data_l(FILE *f, const char *keyword, const char *k_del, char *data, const char *d_del, size_t data_limit, int *line_nr)
ldns_rdf * ldns_native2rdf_int8(ldns_rdf_type type, uint8_t value)
returns the rdf containing the native uint8_t repr.
void ldns_rdf_deep_free(ldns_rdf *rd)
frees a rdf structure and frees the data.
ldns_rdf * ldns_native2rdf_int16(ldns_rdf_type type, uint16_t value)
returns the rdf containing the native uint16_t representation.
size_t ldns_rdf_size(const ldns_rdf *rd)
returns the size of the rdf.
uint8_t * ldns_rdf_data(const ldns_rdf *rd)
returns the data of the rdf.
ldns_rdf * ldns_rdf_clone(const ldns_rdf *rd)
clones a rdf structure.
ldns_rdf * ldns_rdf_new_frm_data(ldns_rdf_type type, size_t size, const void *data)
allocates a new rdf structure and fills it.
@ LDNS_RDF_TYPE_B64
b64 string
@ LDNS_RDF_TYPE_INT8
8 bits
@ LDNS_RDF_TYPE_INT16
16 bits
@ LDNS_RDF_TYPE_ALG
a key algorithm
ldns_status ldns_rr_new_frm_str(ldns_rr **newrr, const char *str, uint32_t default_ttl, const ldns_rdf *origin, ldns_rdf **prev)
creates an rr from a string.
void ldns_rr_free(ldns_rr *rr)
frees an RR structure
void ldns_rr_set_owner(ldns_rr *rr, ldns_rdf *owner)
sets the owner in the rr structure.
void ldns_rr_set_type(ldns_rr *rr, ldns_rr_type rr_type)
sets the type in the rr.
ldns_rr_type ldns_rr_get_type(const ldns_rr *rr)
returns the type of the rr.
bool ldns_rr_push_rdf(ldns_rr *rr, const ldns_rdf *f)
sets rd_field member, it will be placed in the next available spot.
ldns_rr * ldns_rr_new(void)
creates a new rr structure.
@ LDNS_RR_TYPE_DS
RFC4034, RFC3658.
@ LDNS_RR_TYPE_KEY
2535typecode
ldns_status ldns_str2rdf_b64(ldns_rdf **rd, const char *str)
convert the string with the b64 data into wireformat
implementation of buffers to ease operations
Same as rr_list, but now for keys.
General key structure, can contain all types of keys that are used in DNSSEC.
struct ldns_struct_key::@1::@3 dnssec
Some values that influence generated signatures.
struct ldns_struct_key::@0::@2 hmac
The key can be an HMAC key.
bool _use
Whether to use this key when signing.
ldns_rdf * _pubkey_owner
Owner name of the key.
ldns_signing_algorithm _alg
union ldns_struct_key::@1 _extra
Depending on the key we can have extra data.
void * external_key
the key structure can also just point to some external key data
struct ldns_struct_key::@0 _key
Storage pointers for the types of keys supported.
A general purpose lookup table.
Resource record data field.
#define LDNS_MALLOC(type)
Memory management macros.
#define LDNS_XMALLOC(type, count)
#define LDNS_XREALLOC(ptr, type, count)