2 static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/dst_api.c,v 1.4.2.6.8.4 2006/03/10 00:17:21 marka Exp $";
6 * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
8 * Permission to use, copy modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
12 * THE SOFTWARE IS PROVIDED "AS IS" AND TRUSTED INFORMATION SYSTEMS
13 * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
14 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
15 * TRUSTED INFORMATION SYSTEMS BE LIABLE FOR ANY SPECIAL, DIRECT,
16 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
17 * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
18 * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
19 * WITH THE USE OR PERFORMANCE OF THE SOFTWARE.
22 * This file contains the interface between the DST API and the crypto API.
23 * This is the only file that needs to be changed if the crypto system is
24 * changed. Exported functions are:
25 * void dst_init() Initialize the toolkit
26 * int dst_check_algorithm() Function to determines if alg is suppored.
27 * int dst_compare_keys() Function to compare two keys for equality.
28 * int dst_sign_data() Incremental signing routine.
29 * int dst_verify_data() Incremental verify routine.
30 * int dst_generate_key() Function to generate new KEY
31 * DST_KEY *dst_read_key() Function to retrieve private/public KEY.
32 * void dst_write_key() Function to write out a key.
33 * DST_KEY *dst_dnskey_to_key() Function to convert DNS KEY RR to a DST
35 * int dst_key_to_dnskey() Function to return a public key in DNS
37 * DST_KEY *dst_buffer_to_key() Converst a data in buffer to KEY
38 * int *dst_key_to_buffer() Writes out DST_KEY key matterial in buffer
39 * void dst_free_key() Releases all memory referenced by key structure
42 #include "port_before.h"
52 #include <sys/param.h>
54 #include <sys/socket.h>
55 #include <netinet/in.h>
56 #include <arpa/nameser.h>
59 #include "dst_internal.h"
60 #include "port_after.h"
62 /* static variables */
63 static int done_init = 0;
64 dst_func *dst_t_func[DST_MAX_ALGS];
65 const char *key_file_fmt_str = "Private-key-format: v%s\nAlgorithm: %d (%s)\n";
66 const char *dst_path = "";
68 /* internal I/O functions */
69 static DST_KEY *dst_s_read_public_key(const char *in_name,
70 const u_int16_t in_id, int in_alg);
71 static int dst_s_read_private_key_file(char *name, DST_KEY *pk_key,
72 u_int16_t in_id, int in_alg);
73 static int dst_s_write_public_key(const DST_KEY *key);
74 static int dst_s_write_private_key(const DST_KEY *key);
76 /* internal function to set up data structure */
77 static DST_KEY *dst_s_get_key_struct(const char *name, const int alg,
78 const int flags, const int protocol,
83 * This function initializes the Digital Signature Toolkit.
84 * Right now, it just checks the DSTKEYPATH environment variable.
100 s = getenv("DSTKEYPATH");
106 if (len > PATH_MAX) {
107 EREPORT(("%s is longer than %d characters, ignoring\n",
109 } else if (stat(s, &statbuf) != 0 || !S_ISDIR(statbuf.st_mode)) {
110 EREPORT(("%s is not a valid directory\n", s));
113 tmp = (char *) malloc(len + 2);
114 memcpy(tmp, s, len + 1);
115 if (tmp[strlen(tmp) - 1] != '/') {
116 tmp[strlen(tmp) + 1] = 0;
117 tmp[strlen(tmp)] = '/';
122 memset(dst_t_func, 0, sizeof(dst_t_func));
123 /* first one is selected */
128 * dst_check_algorithm
129 * This function determines if the crypto system for the specified
130 * algorithm is present.
135 * future algorithms TBD and registered with IANA.
137 * 1 - The algorithm is available.
138 * 0 - The algorithm is not available.
141 dst_check_algorithm(const int alg)
143 return (dst_t_func[alg] != NULL);
147 * dst_s_get_key_struct
148 * This function allocates key structure and fills in some of the
149 * fields of the structure.
151 * name: the name of the key
152 * alg: the algorithm number
153 * flags: the dns flags of the key
154 * protocol: the dns protocol of the key
155 * bits: the size of the key
158 * valid pointer otherwise
161 dst_s_get_key_struct(const char *name, const int alg, const int flags,
162 const int protocol, const int bits)
164 DST_KEY *new_key = NULL;
166 if (dst_check_algorithm(alg)) /* make sure alg is available */
167 new_key = (DST_KEY *) malloc(sizeof(*new_key));
171 memset(new_key, 0, sizeof(*new_key));
172 new_key->dk_key_name = strdup(name);
173 if (new_key->dk_key_name == NULL) {
177 new_key->dk_alg = alg;
178 new_key->dk_flags = flags;
179 new_key->dk_proto = protocol;
180 new_key->dk_KEY_struct = NULL;
181 new_key->dk_key_size = bits;
182 new_key->dk_func = dst_t_func[alg];
188 * Compares two keys for equality.
190 * key1, key2 Two keys to be compared.
192 * 0 The keys are equal.
193 * non-zero The keys are not equal.
197 dst_compare_keys(const DST_KEY *key1, const DST_KEY *key2)
201 if (key1 == NULL || key2 == NULL)
203 if (key1->dk_alg != key2->dk_alg)
205 if (key1->dk_key_size != key2->dk_key_size)
207 if (key1->dk_id != key2->dk_id)
209 return (key1->dk_func->compare(key1, key2));
215 * An incremental signing function. Data is signed in steps.
216 * First the context must be initialized (SIG_MODE_INIT).
217 * Then data is hashed (SIG_MODE_UPDATE). Finally the signature
218 * itself is created (SIG_MODE_FINAL). This function can be called
219 * once with INIT, UPDATE and FINAL modes all set, or it can be
220 * called separately with a different mode set for each step. The
221 * UPDATE step can be repeated.
223 * mode A bit mask used to specify operation(s) to be performed.
224 * SIG_MODE_INIT 1 Initialize digest
225 * SIG_MODE_UPDATE 2 Add data to digest
226 * SIG_MODE_FINAL 4 Generate signature
228 * SIG_MODE_ALL (SIG_MODE_INIT,SIG_MODE_UPDATE,SIG_MODE_FINAL
229 * data Data to be signed.
230 * len The length in bytes of data to be signed.
231 * in_key Contains a private key to sign with.
232 * KEY structures should be handled (created, converted,
233 * compared, stored, freed) by the DST.
235 * The location to which the signature will be written.
236 * sig_len Length of the signature field in bytes.
238 * 0 Successfull INIT or Update operation
239 * >0 success FINAL (sign) operation
244 dst_sign_data(const int mode, DST_KEY *in_key, void **context,
245 const u_char *data, const int len,
246 u_char *signature, const int sig_len)
248 DUMP(data, mode, len, "dst_sign_data()");
250 if (mode & SIG_MODE_FINAL &&
251 (in_key->dk_KEY_struct == NULL || signature == NULL))
252 return (MISSING_KEY_OR_SIGNATURE);
254 if (in_key->dk_func && in_key->dk_func->sign)
255 return (in_key->dk_func->sign(mode, in_key, context, data, len,
256 signature, sig_len));
257 return (UNKNOWN_KEYALG);
263 * An incremental verify function. Data is verified in steps.
264 * First the context must be initialized (SIG_MODE_INIT).
265 * Then data is hashed (SIG_MODE_UPDATE). Finally the signature
266 * is verified (SIG_MODE_FINAL). This function can be called
267 * once with INIT, UPDATE and FINAL modes all set, or it can be
268 * called separately with a different mode set for each step. The
269 * UPDATE step can be repeated.
271 * mode Operations to perform this time.
272 * SIG_MODE_INIT 1 Initialize digest
273 * SIG_MODE_UPDATE 2 add data to digest
274 * SIG_MODE_FINAL 4 verify signature
276 * (SIG_MODE_INIT,SIG_MODE_UPDATE,SIG_MODE_FINAL)
277 * data Data to pass through the hash function.
278 * len Length of the data in bytes.
279 * in_key Key for verification.
280 * signature Location of signature.
281 * sig_len Length of the signature in bytes.
284 * Non-Zero Verify Failure
288 dst_verify_data(const int mode, DST_KEY *in_key, void **context,
289 const u_char *data, const int len,
290 const u_char *signature, const int sig_len)
292 DUMP(data, mode, len, "dst_verify_data()");
293 if (mode & SIG_MODE_FINAL &&
294 (in_key->dk_KEY_struct == NULL || signature == NULL))
295 return (MISSING_KEY_OR_SIGNATURE);
297 if (in_key->dk_func == NULL || in_key->dk_func->verify == NULL)
298 return (UNSUPPORTED_KEYALG);
299 return (in_key->dk_func->verify(mode, in_key, context, data, len,
300 signature, sig_len));
305 * dst_read_private_key
306 * Access a private key. First the list of private keys that have
307 * already been read in is searched, then the key accessed on disk.
308 * If the private key can be found, it is returned. If the key cannot
309 * be found, a null pointer is returned. The options specify required
310 * key characteristics. If the private key requested does not have
311 * these characteristics, it will not be read.
313 * in_keyname The private key name.
314 * in_id The id of the private key.
315 * options DST_FORCE_READ Read from disk - don't use a previously
317 * DST_CAN_SIGN The key must be useable for signing.
318 * DST_NO_AUTHEN The key must be useable for authentication.
319 * DST_STANDARD Return any key
321 * NULL If there is no key found in the current directory or
322 * this key has not been loaded before.
323 * !NULL Success - KEY structure returned.
327 dst_read_key(const char *in_keyname, const u_int16_t in_id,
328 const int in_alg, const int type)
330 char keyname[PATH_MAX];
331 DST_KEY *dg_key = NULL, *pubkey = NULL;
333 if (!dst_check_algorithm(in_alg)) { /* make sure alg is available */
334 EREPORT(("dst_read_private_key(): Algorithm %d not suppored\n",
338 if ((type & (DST_PUBLIC | DST_PRIVATE)) == 0)
340 if (in_keyname == NULL) {
341 EREPORT(("dst_read_private_key(): Null key name passed in\n"));
343 } else if (strlen(in_keyname) >= sizeof(keyname)) {
344 EREPORT(("dst_read_private_key(): keyname too big\n"));
347 strcpy(keyname, in_keyname);
349 /* before I read in the public key, check if it is allowed to sign */
350 if ((pubkey = dst_s_read_public_key(keyname, in_id, in_alg)) == NULL)
353 if (type == DST_PUBLIC)
356 if (!(dg_key = dst_s_get_key_struct(keyname, pubkey->dk_alg,
357 pubkey->dk_flags, pubkey->dk_proto,
360 /* Fill in private key and some fields in the general key structure */
361 if (dst_s_read_private_key_file(keyname, dg_key, pubkey->dk_id,
362 pubkey->dk_alg) == 0)
363 dg_key = dst_free_key(dg_key);
365 pubkey = dst_free_key(pubkey);
370 dst_write_key(const DST_KEY *key, const int type)
372 int pub = 0, priv = 0;
376 if (!dst_check_algorithm(key->dk_alg)) { /* make sure alg is available */
377 EREPORT(("dst_write_key(): Algorithm %d not suppored\n",
379 return (UNSUPPORTED_KEYALG);
381 if ((type & (DST_PRIVATE|DST_PUBLIC)) == 0)
384 if (type & DST_PUBLIC)
385 if ((pub = dst_s_write_public_key(key)) < 0)
387 if (type & DST_PRIVATE)
388 if ((priv = dst_s_write_private_key(key)) < 0)
394 * dst_write_private_key
395 * Write a private key to disk. The filename will be of the form:
396 * K<key->dk_name>+<key->dk_alg>+<key->dk_id>.<private key suffix>.
397 * If there is already a file with this name, an error is returned.
400 * key A DST managed key structure that contains
401 * all information needed about a key.
403 * >= 0 Correct behavior. Returns length of encoded key value
409 dst_s_write_private_key(const DST_KEY *key)
411 u_char encoded_block[RAW_KEY_SIZE];
416 /* First encode the key into the portable key format */
419 if (key->dk_KEY_struct == NULL)
420 return (0); /* null key has no private key */
422 if (key->dk_func == NULL || key->dk_func->to_file_fmt == NULL) {
423 EREPORT(("dst_write_private_key(): Unsupported operation %d\n",
426 } else if ((len = key->dk_func->to_file_fmt(key, (char *)encoded_block,
427 sizeof(encoded_block))) <= 0) {
428 EREPORT(("dst_write_private_key(): Failed encoding private RSA bsafe key %d\n", len));
431 /* Now I can create the file I want to use */
432 dst_s_build_filename(file, key->dk_key_name, key->dk_id, key->dk_alg,
433 PRIVATE_KEY, PATH_MAX);
435 /* Do not overwrite an existing file */
436 if ((fp = dst_s_fopen(file, "w", 0600)) != NULL) {
438 if ((nn = fwrite(encoded_block, 1, len, fp)) != len) {
439 EREPORT(("dst_write_private_key(): Write failure on %s %d != %d errno=%d\n",
440 file, len, nn, errno));
445 EREPORT(("dst_write_private_key(): Can not create file %s\n"
449 memset(encoded_block, 0, len);
455 * dst_read_public_key
456 * Read a public key from disk and store in a DST key structure.
458 * in_name K<in_name><in_id>.<public key suffix> is the
459 * filename of the key file to be read.
461 * NULL If the key does not exist or no name is supplied.
462 * NON-NULL Initialized key structure if the key exists.
466 dst_s_read_public_key(const char *in_name, const u_int16_t in_id, int in_alg)
468 int flags, proto, alg, len, dlen;
470 char name[PATH_MAX], enckey[RAW_KEY_SIZE], *notspace;
471 u_char deckey[RAW_KEY_SIZE];
474 if (in_name == NULL) {
475 EREPORT(("dst_read_public_key(): No key name given\n"));
478 if (dst_s_build_filename(name, in_name, in_id, in_alg, PUBLIC_KEY,
480 EREPORT(("dst_read_public_key(): Cannot make filename from %s, %d, and %s\n",
481 in_name, in_id, PUBLIC_KEY));
485 * Open the file and read it's formatted contents up to key
487 * domain.name [ttl] [IN] KEY <flags> <protocol> <algorithm> <key>
488 * flags, proto, alg stored as decimal (or hex numbers FIXME).
489 * (FIXME: handle parentheses for line continuation.)
491 if ((fp = dst_s_fopen(name, "r", 0)) == NULL) {
492 EREPORT(("dst_read_public_key(): Public Key not found %s\n",
496 /* Skip domain name, which ends at first blank */
497 while ((c = getc(fp)) != EOF)
500 /* Skip blank to get to next field */
501 while ((c = getc(fp)) != EOF)
505 /* Skip optional TTL -- if initial digit, skip whole word. */
507 while ((c = getc(fp)) != EOF)
510 while ((c = getc(fp)) != EOF)
514 /* Skip optional "IN" */
515 if (c == 'I' || c == 'i') {
516 while ((c = getc(fp)) != EOF)
519 while ((c = getc(fp)) != EOF)
523 /* Locate and skip "KEY" */
524 if (c != 'K' && c != 'k') {
525 EREPORT(("\"KEY\" doesn't appear in file: %s", name));
528 while ((c = getc(fp)) != EOF)
531 while ((c = getc(fp)) != EOF)
534 ungetc(c, fp); /* return the charcter to the input field */
535 /* Handle hex!! FIXME. */
537 if (fscanf(fp, "%d %d %d", &flags, &proto, &alg) != 3) {
538 EREPORT(("dst_read_public_key(): Can not read flag/proto/alg field from %s\n"
542 /* read in the key string */
543 fgets(enckey, sizeof(enckey), fp);
545 /* If we aren't at end-of-file, something is wrong. */
546 while ((c = getc(fp)) != EOF)
550 EREPORT(("Key too long in file: %s", name));
555 if ((len = strlen(enckey)) <= 0)
559 enckey[--len] = '\0';
561 /* remove leading spaces */
562 for (notspace = (char *) enckey; isspace((*notspace)&0xff); len--)
565 dlen = b64_pton(notspace, deckey, sizeof(deckey));
567 EREPORT(("dst_read_public_key: bad return from b64_pton = %d",
571 /* store key and info in a key structure that is returned */
572 /* return dst_store_public_key(in_name, alg, proto, 666, flags, deckey,
574 return dst_buffer_to_key(in_name, alg, flags, proto, deckey, dlen);
579 * dst_write_public_key
580 * Write a key to disk in DNS format.
582 * key Pointer to a DST key structure.
589 dst_s_write_public_key(const DST_KEY *key)
592 char filename[PATH_MAX];
593 u_char out_key[RAW_KEY_SIZE];
594 char enc_key[RAW_KEY_SIZE];
598 memset(out_key, 0, sizeof(out_key));
600 EREPORT(("dst_write_public_key(): No key specified \n"));
602 } else if ((len = dst_key_to_dnskey(key, out_key, sizeof(out_key)))< 0)
605 /* Make the filename */
606 if (dst_s_build_filename(filename, key->dk_key_name, key->dk_id,
607 key->dk_alg, PUBLIC_KEY, PATH_MAX) == -1) {
608 EREPORT(("dst_write_public_key(): Cannot make filename from %s, %d, and %s\n",
609 key->dk_key_name, key->dk_id, PUBLIC_KEY));
612 /* XXX in general this should be a check for symmetric keys */
613 mode = (key->dk_alg == KEY_HMAC_MD5) ? 0600 : 0644;
614 /* create public key file */
615 if ((fp = dst_s_fopen(filename, "w+", mode)) == NULL) {
616 EREPORT(("DST_write_public_key: open of file:%s failed (errno=%d)\n",
620 /*write out key first base64 the key data */
621 if (key->dk_flags & DST_EXTEND_FLAG)
622 b64_ntop(&out_key[6], len - 6, enc_key, sizeof(enc_key));
624 b64_ntop(&out_key[4], len - 4, enc_key, sizeof(enc_key));
625 fprintf(fp, "%s IN KEY %d %d %d %s\n",
627 key->dk_flags, key->dk_proto, key->dk_alg, enc_key);
634 * dst_dnskey_to_public_key
635 * This function converts the contents of a DNS KEY RR into a DST
638 * len Length of the RDATA of the KEY RR RDATA
639 * rdata A pointer to the the KEY RR RDATA.
640 * in_name Key name to be stored in key structure.
643 * NON-NULL Success. Pointer to key structure.
644 * Caller's responsibility to free() it.
648 dst_dnskey_to_key(const char *in_name, const u_char *rdata, const int len)
652 int start = DST_KEY_START;
654 if (rdata == NULL || len <= DST_KEY_ALG) /* no data */
656 alg = (u_int8_t) rdata[DST_KEY_ALG];
657 if (!dst_check_algorithm(alg)) { /* make sure alg is available */
658 EREPORT(("dst_dnskey_to_key(): Algorithm %d not suppored\n",
666 if ((key_st = dst_s_get_key_struct(in_name, alg, 0, 0, 0)) == NULL)
669 key_st->dk_id = dst_s_dns_key_id(rdata, len);
670 key_st->dk_flags = dst_s_get_int16(rdata);
671 key_st->dk_proto = (u_int16_t) rdata[DST_KEY_PROT];
672 if (key_st->dk_flags & DST_EXTEND_FLAG) {
674 ext_flags = (u_int32_t) dst_s_get_int16(&rdata[DST_EXT_FLAG]);
675 key_st->dk_flags = key_st->dk_flags | (ext_flags << 16);
679 * now point to the begining of the data representing the encoding
682 if (key_st->dk_func && key_st->dk_func->from_dns_key) {
683 if (key_st->dk_func->from_dns_key(key_st, &rdata[start],
687 EREPORT(("dst_dnskey_to_public_key(): unsuppored alg %d\n",
696 * dst_public_key_to_dnskey
697 * Function to encode a public key into DNS KEY wire format
699 * key Key structure to encode.
700 * out_storage Location to write the encoded key to.
701 * out_len Size of the output array.
704 * >=0 Number of bytes written to out_storage
708 dst_key_to_dnskey(const DST_KEY *key, u_char *out_storage,
717 if (!dst_check_algorithm(key->dk_alg)) { /* make sure alg is available */
718 EREPORT(("dst_key_to_dnskey(): Algorithm %d not suppored\n",
720 return (UNSUPPORTED_KEYALG);
722 memset(out_storage, 0, out_len);
723 val = (u_int16_t)(key->dk_flags & 0xffff);
724 dst_s_put_int16(out_storage, val);
727 out_storage[loc++] = (u_char) key->dk_proto;
728 out_storage[loc++] = (u_char) key->dk_alg;
730 if (key->dk_flags > 0xffff) { /* Extended flags */
731 val = (u_int16_t)((key->dk_flags >> 16) & 0xffff);
732 dst_s_put_int16(&out_storage[loc], val);
735 if (key->dk_KEY_struct == NULL)
737 if (key->dk_func && key->dk_func->to_dns_key) {
738 enc_len = key->dk_func->to_dns_key(key,
739 (u_char *) &out_storage[loc],
742 return (enc_len + loc);
746 EREPORT(("dst_key_to_dnskey(): Unsupported ALG %d\n",
754 * Function to encode a string of raw data into a DST key
756 * alg The algorithm (HMAC only)
757 * key A pointer to the data
758 * keylen The length of the data
760 * NULL an error occurred
761 * NON-NULL the DST key
764 dst_buffer_to_key(const char *key_name, /* name of the key */
765 const int alg, /* algorithm */
766 const int flags, /* dns flags */
767 const int protocol, /* dns protocol */
768 const u_char *key_buf, /* key in dns wire fmt */
769 const int key_len) /* size of key */
772 DST_KEY *dkey = NULL;
776 if (!dst_check_algorithm(alg)) { /* make sure alg is available */
777 EREPORT(("dst_buffer_to_key(): Algorithm %d not suppored\n", alg));
781 dkey = dst_s_get_key_struct(key_name, alg, flags, protocol, -1);
783 if (dkey == NULL || dkey->dk_func == NULL ||
784 dkey->dk_func->from_dns_key == NULL)
785 return (dst_free_key(dkey));
787 if (dkey->dk_func->from_dns_key(dkey, key_buf, key_len) < 0) {
788 EREPORT(("dst_buffer_to_key(): dst_buffer_to_hmac failed\n"));
789 return (dst_free_key(dkey));
792 dnslen = dst_key_to_dnskey(dkey, dns, sizeof(dns));
793 dkey->dk_id = dst_s_dns_key_id(dns, dnslen);
798 dst_key_to_buffer(DST_KEY *key, u_char *out_buff, int buf_len)
801 /* this function will extrac the secret of HMAC into a buffer */
804 if (key->dk_func != NULL && key->dk_func->to_dns_key != NULL) {
805 len = key->dk_func->to_dns_key(key, out_buff, buf_len);
815 * dst_s_read_private_key_file
816 * Function reads in private key from a file.
817 * Fills out the KEY structure.
819 * name Name of the key to be read.
820 * pk_key Structure that the key is returned in.
821 * in_id Key identifier (tag)
823 * 1 if everthing works
824 * 0 if there is any problem
828 dst_s_read_private_key_file(char *name, DST_KEY *pk_key, u_int16_t in_id,
831 int cnt, alg, len, major, minor, file_major, file_minor;
833 char filename[PATH_MAX];
834 u_char in_buff[RAW_KEY_SIZE], *p;
839 if (name == NULL || pk_key == NULL) {
840 EREPORT(("dst_read_private_key_file(): No key name given\n"));
843 /* Make the filename */
844 if (dst_s_build_filename(filename, name, in_id, in_alg, PRIVATE_KEY,
846 EREPORT(("dst_read_private_key(): Cannot make filename from %s, %d, and %s\n",
847 name, in_id, PRIVATE_KEY));
850 /* first check if we can find the key file */
851 if ((fp = dst_s_fopen(filename, "r", 0)) == NULL) {
852 EREPORT(("dst_s_read_private_key_file: Could not open file %s in directory %s\n",
853 filename, dst_path[0] ? dst_path :
854 (char *) getcwd(NULL, PATH_MAX - 1)));
857 /* now read the header info from the file */
858 if ((cnt = fread(in_buff, 1, sizeof(in_buff), fp)) < 5) {
860 EREPORT(("dst_s_read_private_key_file: error reading file %s (empty file)\n",
866 if (memcmp(in_buff, "Private-key-format: v", 20) != 0)
871 if (!dst_s_verify_str((const char **) (void *)&p,
872 "Private-key-format: v")) {
873 EREPORT(("dst_s_read_private_key_file(): Not a Key file/Decrypt failed %s\n", name));
876 /* read in file format */
877 sscanf((char *)p, "%d.%d", &file_major, &file_minor);
878 sscanf(KEY_FILE_FORMAT, "%d.%d", &major, &minor);
879 if (file_major < 1) {
880 EREPORT(("dst_s_read_private_key_file(): Unknown keyfile %d.%d version for %s\n",
881 file_major, file_minor, name));
883 } else if (file_major > major || file_minor > minor)
885 "dst_s_read_private_key_file(): Keyfile %s version higher than mine %d.%d MAY FAIL\n",
886 name, file_major, file_minor));
888 while (*p++ != '\n') ; /* skip to end of line */
890 if (!dst_s_verify_str((const char **) (void *)&p, "Algorithm: "))
893 if (sscanf((char *)p, "%d", &alg) != 1)
895 while (*p++ != '\n') ; /* skip to end of line */
897 if (pk_key->dk_key_name && !strcmp(pk_key->dk_key_name, name))
898 SAFE_FREE2(pk_key->dk_key_name, strlen(pk_key->dk_key_name));
899 pk_key->dk_key_name = (char *) strdup(name);
901 /* allocate and fill in key structure */
902 if (pk_key->dk_func == NULL || pk_key->dk_func->from_file_fmt == NULL)
905 ret = pk_key->dk_func->from_file_fmt(pk_key, (char *)p, &in_buff[len] - p);
909 dnslen = dst_key_to_dnskey(pk_key, dns, sizeof(dns));
910 id = dst_s_dns_key_id(dns, dnslen);
912 /* Make sure the actual key tag matches the input tag used in the filename
915 EREPORT(("dst_s_read_private_key_file(): actual tag of key read %d != input tag used to build filename %d.\n", id, in_id));
918 pk_key->dk_id = (u_int16_t) id;
919 pk_key->dk_alg = alg;
920 memset(in_buff, 0, cnt);
924 memset(in_buff, 0, cnt);
931 * Generate and store a public/private keypair.
932 * Keys will be stored in formatted files.
934 * name Name of the new key. Used to create key files
935 * K<name>+<alg>+<id>.public and K<name>+<alg>+<id>.private.
936 * bits Size of the new key in bits.
937 * exp What exponent to use:
939 * non-zero use Fermant4
940 * flags The default value of the DNS Key flags.
941 * The DNS Key RR Flag field is defined in RFC 2065,
942 * section 3.3. The field has 16 bits.
944 * Default value of the DNS Key protocol field.
945 * The DNS Key protocol field is defined in RFC 2065,
946 * section 3.4. The field has 8 bits.
947 * alg What algorithm to use. Currently defined:
951 * out_id The key tag is returned.
955 * non-NULL the generated key pair
956 * Caller frees the result, and its dk_name pointer.
959 dst_generate_key(const char *name, const int bits, const int exp,
960 const int flags, const int protocol, const int alg)
962 DST_KEY *new_key = NULL;
969 if (!dst_check_algorithm(alg)) { /* make sure alg is available */
970 EREPORT(("dst_generate_key(): Algorithm %d not suppored\n", alg));
974 new_key = dst_s_get_key_struct(name, alg, flags, protocol, bits);
977 if (bits == 0) /* null key we are done */
979 if (new_key->dk_func == NULL || new_key->dk_func->generate == NULL) {
980 EREPORT(("dst_generate_key_pair():Unsupported algorithm %d\n",
982 return (dst_free_key(new_key));
984 if (new_key->dk_func->generate(new_key, exp) <= 0) {
985 EREPORT(("dst_generate_key_pair(): Key generation failure %s %d %d %d\n",
986 new_key->dk_key_name, new_key->dk_alg,
987 new_key->dk_key_size, exp));
988 return (dst_free_key(new_key));
991 dnslen = dst_key_to_dnskey(new_key, dns, sizeof(dns));
992 if (dnslen != UNSUPPORTED_KEYALG)
993 new_key->dk_id = dst_s_dns_key_id(dns, dnslen);
1003 * Release all data structures pointed to by a key structure.
1005 * f_key Key structure to be freed.
1009 dst_free_key(DST_KEY *f_key)
1014 if (f_key->dk_func && f_key->dk_func->destroy)
1015 f_key->dk_KEY_struct =
1016 f_key->dk_func->destroy(f_key->dk_KEY_struct);
1018 EREPORT(("dst_free_key(): Unknown key alg %d\n",
1021 if (f_key->dk_KEY_struct) {
1022 free(f_key->dk_KEY_struct);
1023 f_key->dk_KEY_struct = NULL;
1025 if (f_key->dk_key_name)
1026 SAFE_FREE(f_key->dk_key_name);
1033 * Return the maximim size of signature from the key specified in bytes
1040 dst_sig_size(DST_KEY *key) {
1041 switch (key->dk_alg) {
1047 return (key->dk_key_size + 7) / 8;
1051 EREPORT(("dst_sig_size(): Unknown key alg %d\n", key->dk_alg));