contrib/unbound/validator/val_secalgo.c

   1 /*
   2  * validator/val_secalgo.c - validator security algorithm functions.
   3  *
   4  * Copyright (c) 2012, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file contains helper functions for the validator module.
  40  * These functions take raw data buffers, formatted for crypto verification,
  41  * and do the library calls (for the crypto library in use).
  42  */
  43 #include "config.h"
  44 /* packed_rrset on top to define enum types (forced by c99 standard) */
  45 #include "util/data/packed_rrset.h"
  46 #include "validator/val_secalgo.h"
  47 #include "validator/val_nsec3.h"
  48 #include "util/log.h"
  49 #include "sldns/rrdef.h"
  50 #include "sldns/keyraw.h"
  51 #include "sldns/sbuffer.h"
  52
  53 #if !defined(HAVE_SSL) && !defined(HAVE_NSS) && !defined(HAVE_NETTLE)
  54 #error "Need crypto library to do digital signature cryptography"
  55 #endif
  56
  57 /* OpenSSL implementation */
  58 #ifdef HAVE_SSL
  59 #ifdef HAVE_OPENSSL_ERR_H
  60 #include <openssl/err.h>
  61 #endif
  62
  63 #ifdef HAVE_OPENSSL_RAND_H
  64 #include <openssl/rand.h>
  65 #endif
  66
  67 #ifdef HAVE_OPENSSL_CONF_H
  68 #include <openssl/conf.h>
  69 #endif
  70
  71 #ifdef HAVE_OPENSSL_ENGINE_H
  72 #include <openssl/engine.h>
  73 #endif
  74
  75 /** fake DSA support for unit tests */
  76 int fake_dsa = 0;
  77
  78 /* return size of digest if supported, or 0 otherwise */
  79 size_t
  80 nsec3_hash_algo_size_supported(int id)
  81 {
  82         switch(id) {
  83         case NSEC3_HASH_SHA1:
  84                 return SHA_DIGEST_LENGTH;
  85         default:
  86                 return 0;
  87         }
  88 }
  89
  90 /* perform nsec3 hash. return false on failure */
  91 int
  92 secalgo_nsec3_hash(int algo, unsigned char* buf, size_t len,
  93         unsigned char* res)
  94 {
  95         switch(algo) {
  96         case NSEC3_HASH_SHA1:
  97                 (void)SHA1(buf, len, res);
  98                 return 1;
  99         default:
 100                 return 0;
 101         }
 102 }
 103
 104 void
 105 secalgo_hash_sha256(unsigned char* buf, size_t len, unsigned char* res)
 106 {
 107         (void)SHA256(buf, len, res);
 108 }
 109
 110 /**
 111  * Return size of DS digest according to its hash algorithm.
 112  * @param algo: DS digest algo.
 113  * @return size in bytes of digest, or 0 if not supported.
 114  */
 115 size_t
 116 ds_digest_size_supported(int algo)
 117 {
 118         switch(algo) {
 119 #ifdef HAVE_EVP_SHA1
 120                 case LDNS_SHA1:
 121                         return SHA_DIGEST_LENGTH;
 122 #endif
 123 #ifdef HAVE_EVP_SHA256
 124                 case LDNS_SHA256:
 125                         return SHA256_DIGEST_LENGTH;
 126 #endif
 127 #ifdef USE_GOST
 128                 case LDNS_HASH_GOST:
 129                         /* we support GOST if it can be loaded */
 130                         (void)sldns_key_EVP_load_gost_id();
 131                         if(EVP_get_digestbyname("md_gost94"))
 132                                 return 32;
 133                         else    return 0;
 134 #endif
 135 #ifdef USE_ECDSA
 136                 case LDNS_SHA384:
 137                         return SHA384_DIGEST_LENGTH;
 138 #endif
 139                 default: break;
 140         }
 141         return 0;
 142 }
 143
 144 #ifdef USE_GOST
 145 /** Perform GOST hash */
 146 static int
 147 do_gost94(unsigned char* data, size_t len, unsigned char* dest)
 148 {
 149         const EVP_MD* md = EVP_get_digestbyname("md_gost94");
 150         if(!md)
 151                 return 0;
 152         return sldns_digest_evp(data, (unsigned int)len, dest, md);
 153 }
 154 #endif
 155
 156 int
 157 secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
 158         unsigned char* res)
 159 {
 160         switch(algo) {
 161 #ifdef HAVE_EVP_SHA1
 162                 case LDNS_SHA1:
 163                         (void)SHA1(buf, len, res);
 164                         return 1;
 165 #endif
 166 #ifdef HAVE_EVP_SHA256
 167                 case LDNS_SHA256:
 168                         (void)SHA256(buf, len, res);
 169                         return 1;
 170 #endif
 171 #ifdef USE_GOST
 172                 case LDNS_HASH_GOST:
 173                         if(do_gost94(buf, len, res))
 174                                 return 1;
 175                         break;
 176 #endif
 177 #ifdef USE_ECDSA
 178                 case LDNS_SHA384:
 179                         (void)SHA384(buf, len, res);
 180                         return 1;
 181 #endif
 182                 default:
 183                         verbose(VERB_QUERY, "unknown DS digest algorithm %d",
 184                                 algo);
 185                         break;
 186         }
 187         return 0;
 188 }
 189
 190 /** return true if DNSKEY algorithm id is supported */
 191 int
 192 dnskey_algo_id_is_supported(int id)
 193 {
 194         switch(id) {
 195         case LDNS_RSAMD5:
 196                 /* RFC 6725 deprecates RSAMD5 */
 197                 return 0;
 198         case LDNS_DSA:
 199         case LDNS_DSA_NSEC3:
 200 #ifdef USE_DSA
 201                 return 1;
 202 #else
 203                 if(fake_dsa) return 1;
 204                 return 0;
 205 #endif
 206         case LDNS_RSASHA1:
 207         case LDNS_RSASHA1_NSEC3:
 208 #if defined(HAVE_EVP_SHA256) && defined(USE_SHA2)
 209         case LDNS_RSASHA256:
 210 #endif
 211 #if defined(HAVE_EVP_SHA512) && defined(USE_SHA2)
 212         case LDNS_RSASHA512:
 213 #endif
 214 #ifdef USE_ECDSA
 215         case LDNS_ECDSAP256SHA256:
 216         case LDNS_ECDSAP384SHA384:
 217 #endif
 218                 return 1;
 219 #ifdef USE_GOST
 220         case LDNS_ECC_GOST:
 221                 /* we support GOST if it can be loaded */
 222                 return sldns_key_EVP_load_gost_id();
 223 #endif
 224         default:
 225                 return 0;
 226         }
 227 }
 228
 229 /**
 230  * Output a libcrypto openssl error to the logfile.
 231  * @param str: string to add to it.
 232  * @param e: the error to output, error number from ERR_get_error().
 233  */
 234 static void
 235 log_crypto_error(const char* str, unsigned long e)
 236 {
 237         char buf[128];
 238         /* or use ERR_error_string if ERR_error_string_n is not avail TODO */
 239         ERR_error_string_n(e, buf, sizeof(buf));
 240         /* buf now contains */
 241         /* error:[error code]:[library name]:[function name]:[reason string] */
 242         log_err("%s crypto %s", str, buf);
 243 }
 244
 245 #ifdef USE_DSA
 246 /**
 247  * Setup DSA key digest in DER encoding ...
 248  * @param sig: input is signature output alloced ptr (unless failure).
 249  *      caller must free alloced ptr if this routine returns true.
 250  * @param len: input is initial siglen, output is output len.
 251  * @return false on failure.
 252  */
 253 static int
 254 setup_dsa_sig(unsigned char** sig, unsigned int* len)
 255 {
 256         unsigned char* orig = *sig;
 257         unsigned int origlen = *len;
 258         int newlen;
 259         BIGNUM *R, *S;
 260         DSA_SIG *dsasig;
 261
 262         /* extract the R and S field from the sig buffer */
 263         if(origlen < 1 + 2*SHA_DIGEST_LENGTH)
 264                 return 0;
 265         R = BN_new();
 266         if(!R) return 0;
 267         (void) BN_bin2bn(orig + 1, SHA_DIGEST_LENGTH, R);
 268         S = BN_new();
 269         if(!S) return 0;
 270         (void) BN_bin2bn(orig + 21, SHA_DIGEST_LENGTH, S);
 271         dsasig = DSA_SIG_new();
 272         if(!dsasig) return 0;
 273
 274 #ifdef HAVE_DSA_SIG_SET0
 275         if(!DSA_SIG_set0(dsasig, R, S)) return 0;
 276 #else
 277         dsasig->r = R;
 278         dsasig->s = S;
 279 #endif
 280         *sig = NULL;
 281         newlen = i2d_DSA_SIG(dsasig, sig);
 282         if(newlen < 0) {
 283                 DSA_SIG_free(dsasig);
 284                 free(*sig);
 285                 return 0;
 286         }
 287         *len = (unsigned int)newlen;
 288         DSA_SIG_free(dsasig);
 289         return 1;
 290 }
 291 #endif /* USE_DSA */
 292
 293 #ifdef USE_ECDSA
 294 /**
 295  * Setup the ECDSA signature in its encoding that the library wants.
 296  * Converts from plain numbers to ASN formatted.
 297  * @param sig: input is signature, output alloced ptr (unless failure).
 298  *      caller must free alloced ptr if this routine returns true.
 299  * @param len: input is initial siglen, output is output len.
 300  * @return false on failure.
 301  */
 302 static int
 303 setup_ecdsa_sig(unsigned char** sig, unsigned int* len)
 304 {
 305         /* convert from two BIGNUMs in the rdata buffer, to ASN notation.
 306          * ASN preable:  30440220 <R 32bytefor256> 0220 <S 32bytefor256>
 307          * the '20' is the length of that field (=bnsize).
 308 i        * the '44' is the total remaining length.
 309          * if negative, start with leading zero.
 310          * if starts with 00s, remove them from the number.
 311          */
 312         uint8_t pre[] = {0x30, 0x44, 0x02, 0x20};
 313         int pre_len = 4;
 314         uint8_t mid[] = {0x02, 0x20};
 315         int mid_len = 2;
 316         int raw_sig_len, r_high, s_high, r_rem=0, s_rem=0;
 317         int bnsize = (int)((*len)/2);
 318         unsigned char* d = *sig;
 319         uint8_t* p;
 320         /* if too short or not even length, fails */
 321         if(*len < 16 || bnsize*2 != (int)*len)
 322                 return 0;
 323
 324         /* strip leading zeroes from r (but not last one) */
 325         while(r_rem < bnsize-1 && d[r_rem] == 0)
 326                 r_rem++;
 327         /* strip leading zeroes from s (but not last one) */
 328         while(s_rem < bnsize-1 && d[bnsize+s_rem] == 0)
 329                 s_rem++;
 330
 331         r_high = ((d[0+r_rem]&0x80)?1:0);
 332         s_high = ((d[bnsize+s_rem]&0x80)?1:0);
 333         raw_sig_len = pre_len + r_high + bnsize - r_rem + mid_len +
 334                 s_high + bnsize - s_rem;
 335         *sig = (unsigned char*)malloc((size_t)raw_sig_len);
 336         if(!*sig)
 337                 return 0;
 338         p = (uint8_t*)*sig;
 339         p[0] = pre[0];
 340         p[1] = (uint8_t)(raw_sig_len-2);
 341         p[2] = pre[2];
 342         p[3] = (uint8_t)(bnsize + r_high - r_rem);
 343         p += 4;
 344         if(r_high) {
 345                 *p = 0;
 346                 p += 1;
 347         }
 348         memmove(p, d+r_rem, (size_t)bnsize-r_rem);
 349         p += bnsize-r_rem;
 350         memmove(p, mid, (size_t)mid_len-1);
 351         p += mid_len-1;
 352         *p = (uint8_t)(bnsize + s_high - s_rem);
 353         p += 1;
 354         if(s_high) {
 355                 *p = 0;
 356                 p += 1;
 357         }
 358         memmove(p, d+bnsize+s_rem, (size_t)bnsize-s_rem);
 359         *len = (unsigned int)raw_sig_len;
 360         return 1;
 361 }
 362 #endif /* USE_ECDSA */
 363
 364 #ifdef USE_ECDSA_EVP_WORKAROUND
 365 static EVP_MD ecdsa_evp_256_md;
 366 static EVP_MD ecdsa_evp_384_md;
 367 void ecdsa_evp_workaround_init(void)
 368 {
 369         /* openssl before 1.0.0 fixes RSA with the SHA256
 370          * hash in EVP.  We create one for ecdsa_sha256 */
 371         ecdsa_evp_256_md = *EVP_sha256();
 372         ecdsa_evp_256_md.required_pkey_type[0] = EVP_PKEY_EC;
 373         ecdsa_evp_256_md.verify = (void*)ECDSA_verify;
 374
 375         ecdsa_evp_384_md = *EVP_sha384();
 376         ecdsa_evp_384_md.required_pkey_type[0] = EVP_PKEY_EC;
 377         ecdsa_evp_384_md.verify = (void*)ECDSA_verify;
 378 }
 379 #endif /* USE_ECDSA_EVP_WORKAROUND */
 380
 381 /**
 382  * Setup key and digest for verification. Adjust sig if necessary.
 383  *
 384  * @param algo: key algorithm
 385  * @param evp_key: EVP PKEY public key to create.
 386  * @param digest_type: digest type to use
 387  * @param key: key to setup for.
 388  * @param keylen: length of key.
 389  * @return false on failure.
 390  */
 391 static int
 392 setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type,
 393         unsigned char* key, size_t keylen)
 394 {
 395 #ifdef USE_DSA
 396         DSA* dsa;
 397 #endif
 398         RSA* rsa;
 399
 400         switch(algo) {
 401 #ifdef USE_DSA
 402                 case LDNS_DSA:
 403                 case LDNS_DSA_NSEC3:
 404                         *evp_key = EVP_PKEY_new();
 405                         if(!*evp_key) {
 406                                 log_err("verify: malloc failure in crypto");
 407                                 return 0;
 408                         }
 409                         dsa = sldns_key_buf2dsa_raw(key, keylen);
 410                         if(!dsa) {
 411                                 verbose(VERB_QUERY, "verify: "
 412                                         "sldns_key_buf2dsa_raw failed");
 413                                 return 0;
 414                         }
 415                         if(EVP_PKEY_assign_DSA(*evp_key, dsa) == 0) {
 416                                 verbose(VERB_QUERY, "verify: "
 417                                         "EVP_PKEY_assign_DSA failed");
 418                                 return 0;
 419                         }
 420 #ifdef HAVE_EVP_DSS1
 421                         *digest_type = EVP_dss1();
 422 #else
 423                         *digest_type = EVP_sha1();
 424 #endif
 425
 426                         break;
 427 #endif /* USE_DSA */
 428                 case LDNS_RSASHA1:
 429                 case LDNS_RSASHA1_NSEC3:
 430 #if defined(HAVE_EVP_SHA256) && defined(USE_SHA2)
 431                 case LDNS_RSASHA256:
 432 #endif
 433 #if defined(HAVE_EVP_SHA512) && defined(USE_SHA2)
 434                 case LDNS_RSASHA512:
 435 #endif
 436                         *evp_key = EVP_PKEY_new();
 437                         if(!*evp_key) {
 438                                 log_err("verify: malloc failure in crypto");
 439                                 return 0;
 440                         }
 441                         rsa = sldns_key_buf2rsa_raw(key, keylen);
 442                         if(!rsa) {
 443                                 verbose(VERB_QUERY, "verify: "
 444                                         "sldns_key_buf2rsa_raw SHA failed");
 445                                 return 0;
 446                         }
 447                         if(EVP_PKEY_assign_RSA(*evp_key, rsa) == 0) {
 448                                 verbose(VERB_QUERY, "verify: "
 449                                         "EVP_PKEY_assign_RSA SHA failed");
 450                                 return 0;
 451                         }
 452
 453                         /* select SHA version */
 454 #if defined(HAVE_EVP_SHA256) && defined(USE_SHA2)
 455                         if(algo == LDNS_RSASHA256)
 456                                 *digest_type = EVP_sha256();
 457                         else
 458 #endif
 459 #if defined(HAVE_EVP_SHA512) && defined(USE_SHA2)
 460                                 if(algo == LDNS_RSASHA512)
 461                                 *digest_type = EVP_sha512();
 462                         else
 463 #endif
 464                                 *digest_type = EVP_sha1();
 465
 466                         break;
 467                 case LDNS_RSAMD5:
 468                         *evp_key = EVP_PKEY_new();
 469                         if(!*evp_key) {
 470                                 log_err("verify: malloc failure in crypto");
 471                                 return 0;
 472                         }
 473                         rsa = sldns_key_buf2rsa_raw(key, keylen);
 474                         if(!rsa) {
 475                                 verbose(VERB_QUERY, "verify: "
 476                                         "sldns_key_buf2rsa_raw MD5 failed");
 477                                 return 0;
 478                         }
 479                         if(EVP_PKEY_assign_RSA(*evp_key, rsa) == 0) {
 480                                 verbose(VERB_QUERY, "verify: "
 481                                         "EVP_PKEY_assign_RSA MD5 failed");
 482                                 return 0;
 483                         }
 484                         *digest_type = EVP_md5();
 485
 486                         break;
 487 #ifdef USE_GOST
 488                 case LDNS_ECC_GOST:
 489                         *evp_key = sldns_gost2pkey_raw(key, keylen);
 490                         if(!*evp_key) {
 491                                 verbose(VERB_QUERY, "verify: "
 492                                         "sldns_gost2pkey_raw failed");
 493                                 return 0;
 494                         }
 495                         *digest_type = EVP_get_digestbyname("md_gost94");
 496                         if(!*digest_type) {
 497                                 verbose(VERB_QUERY, "verify: "
 498                                         "EVP_getdigest md_gost94 failed");
 499                                 return 0;
 500                         }
 501                         break;
 502 #endif
 503 #ifdef USE_ECDSA
 504                 case LDNS_ECDSAP256SHA256:
 505                         *evp_key = sldns_ecdsa2pkey_raw(key, keylen,
 506                                 LDNS_ECDSAP256SHA256);
 507                         if(!*evp_key) {
 508                                 verbose(VERB_QUERY, "verify: "
 509                                         "sldns_ecdsa2pkey_raw failed");
 510                                 return 0;
 511                         }
 512 #ifdef USE_ECDSA_EVP_WORKAROUND
 513                         *digest_type = &ecdsa_evp_256_md;
 514 #else
 515                         *digest_type = EVP_sha256();
 516 #endif
 517                         break;
 518                 case LDNS_ECDSAP384SHA384:
 519                         *evp_key = sldns_ecdsa2pkey_raw(key, keylen,
 520                                 LDNS_ECDSAP384SHA384);
 521                         if(!*evp_key) {
 522                                 verbose(VERB_QUERY, "verify: "
 523                                         "sldns_ecdsa2pkey_raw failed");
 524                                 return 0;
 525                         }
 526 #ifdef USE_ECDSA_EVP_WORKAROUND
 527                         *digest_type = &ecdsa_evp_384_md;
 528 #else
 529                         *digest_type = EVP_sha384();
 530 #endif
 531                         break;
 532 #endif /* USE_ECDSA */
 533                 default:
 534                         verbose(VERB_QUERY, "verify: unknown algorithm %d",
 535                                 algo);
 536                         return 0;
 537         }
 538         return 1;
 539 }
 540
 541 /**
 542  * Check a canonical sig+rrset and signature against a dnskey
 543  * @param buf: buffer with data to verify, the first rrsig part and the
 544  *      canonicalized rrset.
 545  * @param algo: DNSKEY algorithm.
 546  * @param sigblock: signature rdata field from RRSIG
 547  * @param sigblock_len: length of sigblock data.
 548  * @param key: public key data from DNSKEY RR.
 549  * @param keylen: length of keydata.
 550  * @param reason: bogus reason in more detail.
 551  * @return secure if verification succeeded, bogus on crypto failure,
 552  *      unchecked on format errors and alloc failures.
 553  */
 554 enum sec_status
 555 verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 556         unsigned int sigblock_len, unsigned char* key, unsigned int keylen,
 557         char** reason)
 558 {
 559         const EVP_MD *digest_type;
 560         EVP_MD_CTX* ctx;
 561         int res, dofree = 0, docrypto_free = 0;
 562         EVP_PKEY *evp_key = NULL;
 563
 564 #ifndef USE_DSA
 565         if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3) && fake_dsa)
 566                 return sec_status_secure;
 567 #endif
 568
 569         if(!setup_key_digest(algo, &evp_key, &digest_type, key, keylen)) {
 570                 verbose(VERB_QUERY, "verify: failed to setup key");
 571                 *reason = "use of key for crypto failed";
 572                 EVP_PKEY_free(evp_key);
 573                 return sec_status_bogus;
 574         }
 575 #ifdef USE_DSA
 576         /* if it is a DSA signature in bind format, convert to DER format */
 577         if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3) &&
 578                 sigblock_len == 1+2*SHA_DIGEST_LENGTH) {
 579                 if(!setup_dsa_sig(&sigblock, &sigblock_len)) {
 580                         verbose(VERB_QUERY, "verify: failed to setup DSA sig");
 581                         *reason = "use of key for DSA crypto failed";
 582                         EVP_PKEY_free(evp_key);
 583                         return sec_status_bogus;
 584                 }
 585                 docrypto_free = 1;
 586         }
 587 #endif
 588 #if defined(USE_ECDSA) && defined(USE_DSA)
 589         else
 590 #endif
 591 #ifdef USE_ECDSA
 592         if(algo == LDNS_ECDSAP256SHA256 || algo == LDNS_ECDSAP384SHA384) {
 593                 /* EVP uses ASN prefix on sig, which is not in the wire data */
 594                 if(!setup_ecdsa_sig(&sigblock, &sigblock_len)) {
 595                         verbose(VERB_QUERY, "verify: failed to setup ECDSA sig");
 596                         *reason = "use of signature for ECDSA crypto failed";
 597                         EVP_PKEY_free(evp_key);
 598                         return sec_status_bogus;
 599                 }
 600                 dofree = 1;
 601         }
 602 #endif /* USE_ECDSA */
 603
 604         /* do the signature cryptography work */
 605 #ifdef HAVE_EVP_MD_CTX_NEW
 606         ctx = EVP_MD_CTX_new();
 607 #else
 608         ctx = (EVP_MD_CTX*)malloc(sizeof(*ctx));
 609         if(ctx) EVP_MD_CTX_init(ctx);
 610 #endif
 611         if(!ctx) {
 612                 log_err("EVP_MD_CTX_new: malloc failure");
 613                 EVP_PKEY_free(evp_key);
 614                 if(dofree) free(sigblock);
 615                 else if(docrypto_free) OPENSSL_free(sigblock);
 616                 return sec_status_unchecked;
 617         }
 618         if(EVP_VerifyInit(ctx, digest_type) == 0) {
 619                 verbose(VERB_QUERY, "verify: EVP_VerifyInit failed");
 620                 EVP_MD_CTX_destroy(ctx);
 621                 EVP_PKEY_free(evp_key);
 622                 if(dofree) free(sigblock);
 623                 else if(docrypto_free) OPENSSL_free(sigblock);
 624                 return sec_status_unchecked;
 625         }
 626         if(EVP_VerifyUpdate(ctx, (unsigned char*)sldns_buffer_begin(buf),
 627                 (unsigned int)sldns_buffer_limit(buf)) == 0) {
 628                 verbose(VERB_QUERY, "verify: EVP_VerifyUpdate failed");
 629                 EVP_MD_CTX_destroy(ctx);
 630                 EVP_PKEY_free(evp_key);
 631                 if(dofree) free(sigblock);
 632                 else if(docrypto_free) OPENSSL_free(sigblock);
 633                 return sec_status_unchecked;
 634         }
 635
 636         res = EVP_VerifyFinal(ctx, sigblock, sigblock_len, evp_key);
 637 #ifdef HAVE_EVP_MD_CTX_NEW
 638         EVP_MD_CTX_destroy(ctx);
 639 #else
 640         EVP_MD_CTX_cleanup(ctx);
 641         free(ctx);
 642 #endif
 643         EVP_PKEY_free(evp_key);
 644
 645         if(dofree) free(sigblock);
 646         else if(docrypto_free) OPENSSL_free(sigblock);
 647
 648         if(res == 1) {
 649                 return sec_status_secure;
 650         } else if(res == 0) {
 651                 verbose(VERB_QUERY, "verify: signature mismatch");
 652                 *reason = "signature crypto failed";
 653                 return sec_status_bogus;
 654         }
 655
 656         log_crypto_error("verify:", ERR_get_error());
 657         return sec_status_unchecked;
 658 }
 659
 660 /**************************************************/
 661 #elif defined(HAVE_NSS)
 662 /* libnss implementation */
 663 /* nss3 */
 664 #include "sechash.h"
 665 #include "pk11pub.h"
 666 #include "keyhi.h"
 667 #include "secerr.h"
 668 #include "cryptohi.h"
 669 /* nspr4 */
 670 #include "prerror.h"
 671
 672 /* return size of digest if supported, or 0 otherwise */
 673 size_t
 674 nsec3_hash_algo_size_supported(int id)
 675 {
 676         switch(id) {
 677         case NSEC3_HASH_SHA1:
 678                 return SHA1_LENGTH;
 679         default:
 680                 return 0;
 681         }
 682 }
 683
 684 /* perform nsec3 hash. return false on failure */
 685 int
 686 secalgo_nsec3_hash(int algo, unsigned char* buf, size_t len,
 687         unsigned char* res)
 688 {
 689         switch(algo) {
 690         case NSEC3_HASH_SHA1:
 691                 (void)HASH_HashBuf(HASH_AlgSHA1, res, buf, (unsigned long)len);
 692                 return 1;
 693         default:
 694                 return 0;
 695         }
 696 }
 697
 698 void
 699 secalgo_hash_sha256(unsigned char* buf, size_t len, unsigned char* res)
 700 {
 701         (void)HASH_HashBuf(HASH_AlgSHA256, res, buf, (unsigned long)len);
 702 }
 703
 704 size_t
 705 ds_digest_size_supported(int algo)
 706 {
 707         /* uses libNSS */
 708         switch(algo) {
 709                 case LDNS_SHA1:
 710                         return SHA1_LENGTH;
 711 #ifdef USE_SHA2
 712                 case LDNS_SHA256:
 713                         return SHA256_LENGTH;
 714 #endif
 715 #ifdef USE_ECDSA
 716                 case LDNS_SHA384:
 717                         return SHA384_LENGTH;
 718 #endif
 719                 /* GOST not supported in NSS */
 720                 case LDNS_HASH_GOST:
 721                 default: break;
 722         }
 723         return 0;
 724 }
 725
 726 int
 727 secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
 728         unsigned char* res)
 729 {
 730         /* uses libNSS */
 731         switch(algo) {
 732                 case LDNS_SHA1:
 733                         return HASH_HashBuf(HASH_AlgSHA1, res, buf, len)
 734                                 == SECSuccess;
 735 #if defined(USE_SHA2)
 736                 case LDNS_SHA256:
 737                         return HASH_HashBuf(HASH_AlgSHA256, res, buf, len)
 738                                 == SECSuccess;
 739 #endif
 740 #ifdef USE_ECDSA
 741                 case LDNS_SHA384:
 742                         return HASH_HashBuf(HASH_AlgSHA384, res, buf, len)
 743                                 == SECSuccess;
 744 #endif
 745                 case LDNS_HASH_GOST:
 746                 default:
 747                         verbose(VERB_QUERY, "unknown DS digest algorithm %d",
 748                                 algo);
 749                         break;
 750         }
 751         return 0;
 752 }
 753
 754 int
 755 dnskey_algo_id_is_supported(int id)
 756 {
 757         /* uses libNSS */
 758         switch(id) {
 759         case LDNS_RSAMD5:
 760                 /* RFC 6725 deprecates RSAMD5 */
 761                 return 0;
 762 #ifdef USE_DSA
 763         case LDNS_DSA:
 764         case LDNS_DSA_NSEC3:
 765 #endif
 766         case LDNS_RSASHA1:
 767         case LDNS_RSASHA1_NSEC3:
 768 #ifdef USE_SHA2
 769         case LDNS_RSASHA256:
 770 #endif
 771 #ifdef USE_SHA2
 772         case LDNS_RSASHA512:
 773 #endif
 774                 return 1;
 775 #ifdef USE_ECDSA
 776         case LDNS_ECDSAP256SHA256:
 777         case LDNS_ECDSAP384SHA384:
 778                 return PK11_TokenExists(CKM_ECDSA);
 779 #endif
 780         case LDNS_ECC_GOST:
 781         default:
 782                 return 0;
 783         }
 784 }
 785
 786 /* return a new public key for NSS */
 787 static SECKEYPublicKey* nss_key_create(KeyType ktype)
 788 {
 789         SECKEYPublicKey* key;
 790         PLArenaPool* arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
 791         if(!arena) {
 792                 log_err("out of memory, PORT_NewArena failed");
 793                 return NULL;
 794         }
 795         key = PORT_ArenaZNew(arena, SECKEYPublicKey);
 796         if(!key) {
 797                 log_err("out of memory, PORT_ArenaZNew failed");
 798                 PORT_FreeArena(arena, PR_FALSE);
 799                 return NULL;
 800         }
 801         key->arena = arena;
 802         key->keyType = ktype;
 803         key->pkcs11Slot = NULL;
 804         key->pkcs11ID = CK_INVALID_HANDLE;
 805         return key;
 806 }
 807
 808 static SECKEYPublicKey* nss_buf2ecdsa(unsigned char* key, size_t len, int algo)
 809 {
 810         SECKEYPublicKey* pk;
 811         SECItem pub = {siBuffer, NULL, 0};
 812         SECItem params = {siBuffer, NULL, 0};
 813         static unsigned char param256[] = {
 814                 /* OBJECTIDENTIFIER 1.2.840.10045.3.1.7 (P-256)
 815                  * {iso(1) member-body(2) us(840) ansi-x962(10045) curves(3) prime(1) prime256v1(7)} */
 816                 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07
 817         };
 818         static unsigned char param384[] = {
 819                 /* OBJECTIDENTIFIER 1.3.132.0.34 (P-384)
 820                  * {iso(1) identified-organization(3) certicom(132) curve(0) ansip384r1(34)} */
 821                 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22
 822         };
 823         unsigned char buf[256+2]; /* sufficient for 2*384/8+1 */
 824
 825         /* check length, which uncompressed must be 2 bignums */
 826         if(algo == LDNS_ECDSAP256SHA256) {
 827                 if(len != 2*256/8) return NULL;
 828                 /* ECCurve_X9_62_PRIME_256V1 */
 829         } else if(algo == LDNS_ECDSAP384SHA384) {
 830                 if(len != 2*384/8) return NULL;
 831                 /* ECCurve_X9_62_PRIME_384R1 */
 832         } else    return NULL;
 833
 834         buf[0] = 0x04; /* POINT_FORM_UNCOMPRESSED */
 835         memmove(buf+1, key, len);
 836         pub.data = buf;
 837         pub.len = len+1;
 838         if(algo == LDNS_ECDSAP256SHA256) {
 839                 params.data = param256;
 840                 params.len = sizeof(param256);
 841         } else {
 842                 params.data = param384;
 843                 params.len = sizeof(param384);
 844         }
 845
 846         pk = nss_key_create(ecKey);
 847         if(!pk)
 848                 return NULL;
 849         pk->u.ec.size = (len/2)*8;
 850         if(SECITEM_CopyItem(pk->arena, &pk->u.ec.publicValue, &pub)) {
 851                 SECKEY_DestroyPublicKey(pk);
 852                 return NULL;
 853         }
 854         if(SECITEM_CopyItem(pk->arena, &pk->u.ec.DEREncodedParams, &params)) {
 855                 SECKEY_DestroyPublicKey(pk);
 856                 return NULL;
 857         }
 858
 859         return pk;
 860 }
 861
 862 static SECKEYPublicKey* nss_buf2dsa(unsigned char* key, size_t len)
 863 {
 864         SECKEYPublicKey* pk;
 865         uint8_t T;
 866         uint16_t length;
 867         uint16_t offset;
 868         SECItem Q = {siBuffer, NULL, 0};
 869         SECItem P = {siBuffer, NULL, 0};
 870         SECItem G = {siBuffer, NULL, 0};
 871         SECItem Y = {siBuffer, NULL, 0};
 872
 873         if(len == 0)
 874                 return NULL;
 875         T = (uint8_t)key[0];
 876         length = (64 + T * 8);
 877         offset = 1;
 878
 879         if (T > 8) {
 880                 return NULL;
 881         }
 882         if(len < (size_t)1 + SHA1_LENGTH + 3*length)
 883                 return NULL;
 884
 885         Q.data = key+offset;
 886         Q.len = SHA1_LENGTH;
 887         offset += SHA1_LENGTH;
 888
 889         P.data = key+offset;
 890         P.len = length;
 891         offset += length;
 892
 893         G.data = key+offset;
 894         G.len = length;
 895         offset += length;
 896
 897         Y.data = key+offset;
 898         Y.len = length;
 899         offset += length;
 900
 901         pk = nss_key_create(dsaKey);
 902         if(!pk)
 903                 return NULL;
 904         if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.params.prime, &P)) {
 905                 SECKEY_DestroyPublicKey(pk);
 906                 return NULL;
 907         }
 908         if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.params.subPrime, &Q)) {
 909                 SECKEY_DestroyPublicKey(pk);
 910                 return NULL;
 911         }
 912         if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.params.base, &G)) {
 913                 SECKEY_DestroyPublicKey(pk);
 914                 return NULL;
 915         }
 916         if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.publicValue, &Y)) {
 917                 SECKEY_DestroyPublicKey(pk);
 918                 return NULL;
 919         }
 920         return pk;
 921 }
 922
 923 static SECKEYPublicKey* nss_buf2rsa(unsigned char* key, size_t len)
 924 {
 925         SECKEYPublicKey* pk;
 926         uint16_t exp;
 927         uint16_t offset;
 928         uint16_t int16;
 929         SECItem modulus = {siBuffer, NULL, 0};
 930         SECItem exponent = {siBuffer, NULL, 0};
 931         if(len == 0)
 932                 return NULL;
 933         if(key[0] == 0) {
 934                 if(len < 3)
 935                         return NULL;
 936                 /* the exponent is too large so it's places further */
 937                 memmove(&int16, key+1, 2);
 938                 exp = ntohs(int16);
 939                 offset = 3;
 940         } else {
 941                 exp = key[0];
 942                 offset = 1;
 943         }
 944
 945         /* key length at least one */
 946         if(len < (size_t)offset + exp + 1)
 947                 return NULL;
 948
 949         exponent.data = key+offset;
 950         exponent.len = exp;
 951         offset += exp;
 952         modulus.data = key+offset;
 953         modulus.len = (len - offset);
 954
 955         pk = nss_key_create(rsaKey);
 956         if(!pk)
 957                 return NULL;
 958         if(SECITEM_CopyItem(pk->arena, &pk->u.rsa.modulus, &modulus)) {
 959                 SECKEY_DestroyPublicKey(pk);
 960                 return NULL;
 961         }
 962         if(SECITEM_CopyItem(pk->arena, &pk->u.rsa.publicExponent, &exponent)) {
 963                 SECKEY_DestroyPublicKey(pk);
 964                 return NULL;
 965         }
 966         return pk;
 967 }
 968
 969 /**
 970  * Setup key and digest for verification. Adjust sig if necessary.
 971  *
 972  * @param algo: key algorithm
 973  * @param evp_key: EVP PKEY public key to create.
 974  * @param digest_type: digest type to use
 975  * @param key: key to setup for.
 976  * @param keylen: length of key.
 977  * @param prefix: if returned, the ASN prefix for the hashblob.
 978  * @param prefixlen: length of the prefix.
 979  * @return false on failure.
 980  */
 981 static int
 982 nss_setup_key_digest(int algo, SECKEYPublicKey** pubkey, HASH_HashType* htype,
 983         unsigned char* key, size_t keylen, unsigned char** prefix,
 984         size_t* prefixlen)
 985 {
 986         /* uses libNSS */
 987
 988         /* hash prefix for md5, RFC2537 */
 989         static unsigned char p_md5[] = {0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a,
 990         0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10};
 991         /* hash prefix to prepend to hash output, from RFC3110 */
 992         static unsigned char p_sha1[] = {0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2B,
 993                 0x0E, 0x03, 0x02, 0x1A, 0x05, 0x00, 0x04, 0x14};
 994         /* from RFC5702 */
 995         static unsigned char p_sha256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60,
 996         0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20};
 997         static unsigned char p_sha512[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60,
 998         0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40};
 999         /* from RFC6234 */
1000         /* for future RSASHA384 ..
1001         static unsigned char p_sha384[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60,
1002         0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30};
1003         */
1004
1005         switch(algo) {
1006 #ifdef USE_DSA
1007                 case LDNS_DSA:
1008                 case LDNS_DSA_NSEC3:
1009                         *pubkey = nss_buf2dsa(key, keylen);
1010                         if(!*pubkey) {
1011                                 log_err("verify: malloc failure in crypto");
1012                                 return 0;
1013                         }
1014                         *htype = HASH_AlgSHA1;
1015                         /* no prefix for DSA verification */
1016                         break;
1017 #endif
1018                 case LDNS_RSASHA1:
1019                 case LDNS_RSASHA1_NSEC3:
1020 #ifdef USE_SHA2
1021                 case LDNS_RSASHA256:
1022 #endif
1023 #ifdef USE_SHA2
1024                 case LDNS_RSASHA512:
1025 #endif
1026                         *pubkey = nss_buf2rsa(key, keylen);
1027                         if(!*pubkey) {
1028                                 log_err("verify: malloc failure in crypto");
1029                                 return 0;
1030                         }
1031                         /* select SHA version */
1032 #ifdef USE_SHA2
1033                         if(algo == LDNS_RSASHA256) {
1034                                 *htype = HASH_AlgSHA256;
1035                                 *prefix = p_sha256;
1036                                 *prefixlen = sizeof(p_sha256);
1037                         } else
1038 #endif
1039 #ifdef USE_SHA2
1040                                 if(algo == LDNS_RSASHA512) {
1041                                 *htype = HASH_AlgSHA512;
1042                                 *prefix = p_sha512;
1043                                 *prefixlen = sizeof(p_sha512);
1044                         } else
1045 #endif
1046                         {
1047                                 *htype = HASH_AlgSHA1;
1048                                 *prefix = p_sha1;
1049                                 *prefixlen = sizeof(p_sha1);
1050                         }
1051
1052                         break;
1053                 case LDNS_RSAMD5:
1054                         *pubkey = nss_buf2rsa(key, keylen);
1055                         if(!*pubkey) {
1056                                 log_err("verify: malloc failure in crypto");
1057                                 return 0;
1058                         }
1059                         *htype = HASH_AlgMD5;
1060                         *prefix = p_md5;
1061                         *prefixlen = sizeof(p_md5);
1062
1063                         break;
1064 #ifdef USE_ECDSA
1065                 case LDNS_ECDSAP256SHA256:
1066                         *pubkey = nss_buf2ecdsa(key, keylen,
1067                                 LDNS_ECDSAP256SHA256);
1068                         if(!*pubkey) {
1069                                 log_err("verify: malloc failure in crypto");
1070                                 return 0;
1071                         }
1072                         *htype = HASH_AlgSHA256;
1073                         /* no prefix for DSA verification */
1074                         break;
1075                 case LDNS_ECDSAP384SHA384:
1076                         *pubkey = nss_buf2ecdsa(key, keylen,
1077                                 LDNS_ECDSAP384SHA384);
1078                         if(!*pubkey) {
1079                                 log_err("verify: malloc failure in crypto");
1080                                 return 0;
1081                         }
1082                         *htype = HASH_AlgSHA384;
1083                         /* no prefix for DSA verification */
1084                         break;
1085 #endif /* USE_ECDSA */
1086                 case LDNS_ECC_GOST:
1087                 default:
1088                         verbose(VERB_QUERY, "verify: unknown algorithm %d",
1089                                 algo);
1090                         return 0;
1091         }
1092         return 1;
1093 }
1094
1095 /**
1096  * Check a canonical sig+rrset and signature against a dnskey
1097  * @param buf: buffer with data to verify, the first rrsig part and the
1098  *      canonicalized rrset.
1099  * @param algo: DNSKEY algorithm.
1100  * @param sigblock: signature rdata field from RRSIG
1101  * @param sigblock_len: length of sigblock data.
1102  * @param key: public key data from DNSKEY RR.
1103  * @param keylen: length of keydata.
1104  * @param reason: bogus reason in more detail.
1105  * @return secure if verification succeeded, bogus on crypto failure,
1106  *      unchecked on format errors and alloc failures.
1107  */
1108 enum sec_status
1109 verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
1110         unsigned int sigblock_len, unsigned char* key, unsigned int keylen,
1111         char** reason)
1112 {
1113         /* uses libNSS */
1114         /* large enough for the different hashes */
1115         unsigned char hash[HASH_LENGTH_MAX];
1116         unsigned char hash2[HASH_LENGTH_MAX*2];
1117         HASH_HashType htype = 0;
1118         SECKEYPublicKey* pubkey = NULL;
1119         SECItem secsig = {siBuffer, sigblock, sigblock_len};
1120         SECItem sechash = {siBuffer, hash, 0};
1121         SECStatus res;
1122         unsigned char* prefix = NULL; /* prefix for hash, RFC3110, RFC5702 */
1123         size_t prefixlen = 0;
1124         int err;
1125
1126         if(!nss_setup_key_digest(algo, &pubkey, &htype, key, keylen,
1127                 &prefix, &prefixlen)) {
1128                 verbose(VERB_QUERY, "verify: failed to setup key");
1129                 *reason = "use of key for crypto failed";
1130                 SECKEY_DestroyPublicKey(pubkey);
1131                 return sec_status_bogus;
1132         }
1133
1134 #ifdef USE_DSA
1135         /* need to convert DSA, ECDSA signatures? */
1136         if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3)) {
1137                 if(sigblock_len == 1+2*SHA1_LENGTH) {
1138                         secsig.data ++;
1139                         secsig.len --;
1140                 } else {
1141                         SECItem* p = DSAU_DecodeDerSig(&secsig);
1142                         if(!p) {
1143                                 verbose(VERB_QUERY, "verify: failed DER decode");
1144                                 *reason = "signature DER decode failed";
1145                                 SECKEY_DestroyPublicKey(pubkey);
1146                                 return sec_status_bogus;
1147                         }
1148                         if(SECITEM_CopyItem(pubkey->arena, &secsig, p)) {
1149                                 log_err("alloc failure in DER decode");
1150                                 SECKEY_DestroyPublicKey(pubkey);
1151                                 SECITEM_FreeItem(p, PR_TRUE);
1152                                 return sec_status_unchecked;
1153                         }
1154                         SECITEM_FreeItem(p, PR_TRUE);
1155                 }
1156         }
1157 #endif /* USE_DSA */
1158
1159         /* do the signature cryptography work */
1160         /* hash the data */
1161         sechash.len = HASH_ResultLen(htype);
1162         if(sechash.len > sizeof(hash)) {
1163                 verbose(VERB_QUERY, "verify: hash too large for buffer");
1164                 SECKEY_DestroyPublicKey(pubkey);
1165                 return sec_status_unchecked;
1166         }
1167         if(HASH_HashBuf(htype, hash, (unsigned char*)sldns_buffer_begin(buf),
1168                 (unsigned int)sldns_buffer_limit(buf)) != SECSuccess) {
1169                 verbose(VERB_QUERY, "verify: HASH_HashBuf failed");
1170                 SECKEY_DestroyPublicKey(pubkey);
1171                 return sec_status_unchecked;
1172         }
1173         if(prefix) {
1174                 int hashlen = sechash.len;
1175                 if(prefixlen+hashlen > sizeof(hash2)) {
1176                         verbose(VERB_QUERY, "verify: hashprefix too large");
1177                         SECKEY_DestroyPublicKey(pubkey);
1178                         return sec_status_unchecked;
1179                 }
1180                 sechash.data = hash2;
1181                 sechash.len = prefixlen+hashlen;
1182                 memcpy(sechash.data, prefix, prefixlen);
1183                 memmove(sechash.data+prefixlen, hash, hashlen);
1184         }
1185
1186         /* verify the signature */
1187         res = PK11_Verify(pubkey, &secsig, &sechash, NULL /*wincx*/);
1188         SECKEY_DestroyPublicKey(pubkey);
1189
1190         if(res == SECSuccess) {
1191                 return sec_status_secure;
1192         }
1193         err = PORT_GetError();
1194         if(err != SEC_ERROR_BAD_SIGNATURE) {
1195                 /* failed to verify */
1196                 verbose(VERB_QUERY, "verify: PK11_Verify failed: %s",
1197                         PORT_ErrorToString(err));
1198                 /* if it is not supported, like ECC is removed, we get,
1199                  * SEC_ERROR_NO_MODULE */
1200                 if(err == SEC_ERROR_NO_MODULE)
1201                         return sec_status_unchecked;
1202                 /* but other errors are commonly returned
1203                  * for a bad signature from NSS.  Thus we return bogus,
1204                  * not unchecked */
1205                 *reason = "signature crypto failed";
1206                 return sec_status_bogus;
1207         }
1208         verbose(VERB_QUERY, "verify: signature mismatch: %s",
1209                 PORT_ErrorToString(err));
1210         *reason = "signature crypto failed";
1211         return sec_status_bogus;
1212 }
1213
1214 #elif defined(HAVE_NETTLE)
1215
1216 #include "sha.h"
1217 #include "bignum.h"
1218 #include "macros.h"
1219 #include "rsa.h"
1220 #include "dsa.h"
1221 #ifdef HAVE_NETTLE_DSA_COMPAT_H
1222 #include "dsa-compat.h"
1223 #endif
1224 #include "asn1.h"
1225 #ifdef USE_ECDSA
1226 #include "ecdsa.h"
1227 #include "ecc-curve.h"
1228 #endif
1229
1230 static int
1231 _digest_nettle(int algo, uint8_t* buf, size_t len,
1232         unsigned char* res)
1233 {
1234         switch(algo) {
1235                 case SHA1_DIGEST_SIZE:
1236                 {
1237                         struct sha1_ctx ctx;
1238                         sha1_init(&ctx);
1239                         sha1_update(&ctx, len, buf);
1240                         sha1_digest(&ctx, SHA1_DIGEST_SIZE, res);
1241                         return 1;
1242                 }
1243                 case SHA256_DIGEST_SIZE:
1244                 {
1245                         struct sha256_ctx ctx;
1246                         sha256_init(&ctx);
1247                         sha256_update(&ctx, len, buf);
1248                         sha256_digest(&ctx, SHA256_DIGEST_SIZE, res);
1249                         return 1;
1250                 }
1251                 case SHA384_DIGEST_SIZE:
1252                 {
1253                         struct sha384_ctx ctx;
1254                         sha384_init(&ctx);
1255                         sha384_update(&ctx, len, buf);
1256                         sha384_digest(&ctx, SHA384_DIGEST_SIZE, res);
1257                         return 1;
1258                 }
1259                 case SHA512_DIGEST_SIZE:
1260                 {
1261                         struct sha512_ctx ctx;
1262                         sha512_init(&ctx);
1263                         sha512_update(&ctx, len, buf);
1264                         sha512_digest(&ctx, SHA512_DIGEST_SIZE, res);
1265                         return 1;
1266                 }
1267                 default:
1268                         break;
1269         }
1270         return 0;
1271 }
1272
1273 /* return size of digest if supported, or 0 otherwise */
1274 size_t
1275 nsec3_hash_algo_size_supported(int id)
1276 {
1277         switch(id) {
1278         case NSEC3_HASH_SHA1:
1279                 return SHA1_DIGEST_SIZE;
1280         default:
1281                 return 0;
1282         }
1283 }
1284
1285 /* perform nsec3 hash. return false on failure */
1286 int
1287 secalgo_nsec3_hash(int algo, unsigned char* buf, size_t len,
1288         unsigned char* res)
1289 {
1290         switch(algo) {
1291         case NSEC3_HASH_SHA1:
1292                 return _digest_nettle(SHA1_DIGEST_SIZE, (uint8_t*)buf, len,
1293                         res);
1294         default:
1295                 return 0;
1296         }
1297 }
1298
1299 void
1300 secalgo_hash_sha256(unsigned char* buf, size_t len, unsigned char* res)
1301 {
1302         _digest_nettle(SHA256_DIGEST_SIZE, (uint8_t*)buf, len, res);
1303 }
1304
1305 /**
1306  * Return size of DS digest according to its hash algorithm.
1307  * @param algo: DS digest algo.
1308  * @return size in bytes of digest, or 0 if not supported.
1309  */
1310 size_t
1311 ds_digest_size_supported(int algo)
1312 {
1313         switch(algo) {
1314                 case LDNS_SHA1:
1315                         return SHA1_DIGEST_SIZE;
1316 #ifdef USE_SHA2
1317                 case LDNS_SHA256:
1318                         return SHA256_DIGEST_SIZE;
1319 #endif
1320 #ifdef USE_ECDSA
1321                 case LDNS_SHA384:
1322                         return SHA384_DIGEST_SIZE;
1323 #endif
1324                 /* GOST not supported */
1325                 case LDNS_HASH_GOST:
1326                 default:
1327                         break;
1328         }
1329         return 0;
1330 }
1331
1332 int
1333 secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
1334         unsigned char* res)
1335 {
1336         switch(algo) {
1337                 case LDNS_SHA1:
1338                         return _digest_nettle(SHA1_DIGEST_SIZE, buf, len, res);
1339 #if defined(USE_SHA2)
1340                 case LDNS_SHA256:
1341                         return _digest_nettle(SHA256_DIGEST_SIZE, buf, len, res);
1342 #endif
1343 #ifdef USE_ECDSA
1344                 case LDNS_SHA384:
1345                         return _digest_nettle(SHA384_DIGEST_SIZE, buf, len, res);
1346
1347 #endif
1348                 case LDNS_HASH_GOST:
1349                 default:
1350                         verbose(VERB_QUERY, "unknown DS digest algorithm %d",
1351                                 algo);
1352                         break;
1353         }
1354         return 0;
1355 }
1356
1357 int
1358 dnskey_algo_id_is_supported(int id)
1359 {
1360         /* uses libnettle */
1361         switch(id) {
1362 #ifdef USE_DSA
1363         case LDNS_DSA:
1364         case LDNS_DSA_NSEC3:
1365 #endif
1366         case LDNS_RSASHA1:
1367         case LDNS_RSASHA1_NSEC3:
1368 #ifdef USE_SHA2
1369         case LDNS_RSASHA256:
1370         case LDNS_RSASHA512:
1371 #endif
1372 #ifdef USE_ECDSA
1373         case LDNS_ECDSAP256SHA256:
1374         case LDNS_ECDSAP384SHA384:
1375 #endif
1376                 return 1;
1377         case LDNS_RSAMD5: /* RFC 6725 deprecates RSAMD5 */
1378         case LDNS_ECC_GOST:
1379         default:
1380                 return 0;
1381         }
1382 }
1383
1384 #ifdef USE_DSA
1385 static char *
1386 _verify_nettle_dsa(sldns_buffer* buf, unsigned char* sigblock,
1387         unsigned int sigblock_len, unsigned char* key, unsigned int keylen)
1388 {
1389         uint8_t digest[SHA1_DIGEST_SIZE];
1390         uint8_t key_t;
1391         int res = 0;
1392         size_t offset;
1393         struct dsa_public_key pubkey;
1394         struct dsa_signature signature;
1395         unsigned int expected_len;
1396
1397         /* Extract DSA signature from the record */
1398         nettle_dsa_signature_init(&signature);
1399         /* Signature length: 41 bytes - RFC 2536 sec. 3 */
1400         if(sigblock_len == 41) {
1401                 if(key[0] != sigblock[0])
1402                         return "invalid T value in DSA signature or pubkey";
1403                 nettle_mpz_set_str_256_u(signature.r, 20, sigblock+1);
1404                 nettle_mpz_set_str_256_u(signature.s, 20, sigblock+1+20);
1405         } else {
1406                 /* DER encoded, decode the ASN1 notated R and S bignums */
1407                 /* SEQUENCE { r INTEGER, s INTEGER } */
1408                 struct asn1_der_iterator i, seq;
1409                 if(asn1_der_iterator_first(&i, sigblock_len,
1410                         (uint8_t*)sigblock) != ASN1_ITERATOR_CONSTRUCTED
1411                         || i.type != ASN1_SEQUENCE)
1412                         return "malformed DER encoded DSA signature";
1413                 /* decode this element of i using the seq iterator */
1414                 if(asn1_der_decode_constructed(&i, &seq) !=
1415                         ASN1_ITERATOR_PRIMITIVE || seq.type != ASN1_INTEGER)
1416                         return "malformed DER encoded DSA signature";
1417                 if(!asn1_der_get_bignum(&seq, signature.r, 20*8))
1418                         return "malformed DER encoded DSA signature";
1419                 if(asn1_der_iterator_next(&seq) != ASN1_ITERATOR_PRIMITIVE
1420                         || seq.type != ASN1_INTEGER)
1421                         return "malformed DER encoded DSA signature";
1422                 if(!asn1_der_get_bignum(&seq, signature.s, 20*8))
1423                         return "malformed DER encoded DSA signature";
1424                 if(asn1_der_iterator_next(&i) != ASN1_ITERATOR_END)
1425                         return "malformed DER encoded DSA signature";
1426         }
1427
1428         /* Validate T values constraints - RFC 2536 sec. 2 & sec. 3 */
1429         key_t = key[0];
1430         if (key_t > 8) {
1431                 return "invalid T value in DSA pubkey";
1432         }
1433
1434         /* Pubkey minimum length: 21 bytes - RFC 2536 sec. 2 */
1435         if (keylen < 21) {
1436                 return "DSA pubkey too short";
1437         }
1438
1439         expected_len =   1 +            /* T */
1440                         20 +            /* Q */
1441                        (64 + key_t*8) + /* P */
1442                        (64 + key_t*8) + /* G */
1443                        (64 + key_t*8);  /* Y */
1444         if (keylen != expected_len ) {
1445                 return "invalid DSA pubkey length";
1446         }
1447
1448         /* Extract DSA pubkey from the record */
1449         nettle_dsa_public_key_init(&pubkey);
1450         offset = 1;
1451         nettle_mpz_set_str_256_u(pubkey.q, 20, key+offset);
1452         offset += 20;
1453         nettle_mpz_set_str_256_u(pubkey.p, (64 + key_t*8), key+offset);
1454         offset += (64 + key_t*8);
1455         nettle_mpz_set_str_256_u(pubkey.g, (64 + key_t*8), key+offset);
1456         offset += (64 + key_t*8);
1457         nettle_mpz_set_str_256_u(pubkey.y, (64 + key_t*8), key+offset);
1458
1459         /* Digest content of "buf" and verify its DSA signature in "sigblock"*/
1460         res = _digest_nettle(SHA1_DIGEST_SIZE, (unsigned char*)sldns_buffer_begin(buf),
1461                                                 (unsigned int)sldns_buffer_limit(buf), (unsigned char*)digest);
1462         res &= dsa_sha1_verify_digest(&pubkey, digest, &signature);
1463
1464         /* Clear and return */
1465         nettle_dsa_signature_clear(&signature);
1466         nettle_dsa_public_key_clear(&pubkey);
1467         if (!res)
1468                 return "DSA signature verification failed";
1469         else
1470                 return NULL;
1471 }
1472 #endif /* USE_DSA */
1473
1474 static char *
1475 _verify_nettle_rsa(sldns_buffer* buf, unsigned int digest_size, char* sigblock,
1476         unsigned int sigblock_len, uint8_t* key, unsigned int keylen)
1477 {
1478         uint16_t exp_len = 0;
1479         size_t exp_offset = 0, mod_offset = 0;
1480         struct rsa_public_key pubkey;
1481         mpz_t signature;
1482         int res = 0;
1483
1484         /* RSA pubkey parsing as per RFC 3110 sec. 2 */
1485         if( keylen <= 1) {
1486                 return "null RSA key";
1487         }
1488         if (key[0] != 0) {
1489                 /* 1-byte length */
1490                 exp_len = key[0];
1491                 exp_offset = 1;
1492         } else {
1493                 /* 1-byte NUL + 2-bytes exponent length */
1494                 if (keylen < 3) {
1495                         return "incorrect RSA key length";
1496                 }
1497                 exp_len = READ_UINT16(key+1);
1498                 if (exp_len == 0)
1499                         return "null RSA exponent length";
1500                 exp_offset = 3;
1501         }
1502         /* Check that we are not over-running input length */
1503         if (keylen < exp_offset + exp_len + 1) {
1504                 return "RSA key content shorter than expected";
1505         }
1506         mod_offset = exp_offset + exp_len;
1507         nettle_rsa_public_key_init(&pubkey);
1508         pubkey.size = keylen - mod_offset;
1509         nettle_mpz_set_str_256_u(pubkey.e, exp_len, &key[exp_offset]);
1510         nettle_mpz_set_str_256_u(pubkey.n, pubkey.size, &key[mod_offset]);
1511
1512         /* Digest content of "buf" and verify its RSA signature in "sigblock"*/
1513         nettle_mpz_init_set_str_256_u(signature, sigblock_len, (uint8_t*)sigblock);
1514         switch (digest_size) {
1515                 case SHA1_DIGEST_SIZE:
1516                 {
1517                         uint8_t digest[SHA1_DIGEST_SIZE];
1518                         res = _digest_nettle(SHA1_DIGEST_SIZE, (unsigned char*)sldns_buffer_begin(buf),
1519                                                 (unsigned int)sldns_buffer_limit(buf), (unsigned char*)digest);
1520                         res &= rsa_sha1_verify_digest(&pubkey, digest, signature);
1521                         break;
1522                 }
1523                 case SHA256_DIGEST_SIZE:
1524                 {
1525                         uint8_t digest[SHA256_DIGEST_SIZE];
1526                         res = _digest_nettle(SHA256_DIGEST_SIZE, (unsigned char*)sldns_buffer_begin(buf),
1527                                                 (unsigned int)sldns_buffer_limit(buf), (unsigned char*)digest);
1528                         res &= rsa_sha256_verify_digest(&pubkey, digest, signature);
1529                         break;
1530                 }
1531                 case SHA512_DIGEST_SIZE:
1532                 {
1533                         uint8_t digest[SHA512_DIGEST_SIZE];
1534                         res = _digest_nettle(SHA512_DIGEST_SIZE, (unsigned char*)sldns_buffer_begin(buf),
1535                                                 (unsigned int)sldns_buffer_limit(buf), (unsigned char*)digest);
1536                         res &= rsa_sha512_verify_digest(&pubkey, digest, signature);
1537                         break;
1538                 }
1539                 default:
1540                         break;
1541         }
1542
1543         /* Clear and return */
1544         nettle_rsa_public_key_clear(&pubkey);
1545         mpz_clear(signature);
1546         if (!res) {
1547                 return "RSA signature verification failed";
1548         } else {
1549                 return NULL;
1550         }
1551 }
1552
1553 #ifdef USE_ECDSA
1554 static char *
1555 _verify_nettle_ecdsa(sldns_buffer* buf, unsigned int digest_size, unsigned char* sigblock,
1556         unsigned int sigblock_len, unsigned char* key, unsigned int keylen)
1557 {
1558         int res = 0;
1559         struct ecc_point pubkey;
1560         struct dsa_signature signature;
1561
1562         /* Always matched strength, as per RFC 6605 sec. 1 */
1563         if (sigblock_len != 2*digest_size || keylen != 2*digest_size) {
1564                 return "wrong ECDSA signature length";
1565         }
1566
1567         /* Parse ECDSA signature as per RFC 6605 sec. 4 */
1568         nettle_dsa_signature_init(&signature);
1569         switch (digest_size) {
1570                 case SHA256_DIGEST_SIZE:
1571                 {
1572                         uint8_t digest[SHA256_DIGEST_SIZE];
1573                         mpz_t x, y;
1574                         nettle_ecc_point_init(&pubkey, &nettle_secp_256r1);
1575                         nettle_mpz_init_set_str_256_u(x, SHA256_DIGEST_SIZE, key);
1576                         nettle_mpz_init_set_str_256_u(y, SHA256_DIGEST_SIZE, key+SHA256_DIGEST_SIZE);
1577                         nettle_mpz_set_str_256_u(signature.r, SHA256_DIGEST_SIZE, sigblock);
1578                         nettle_mpz_set_str_256_u(signature.s, SHA256_DIGEST_SIZE, sigblock+SHA256_DIGEST_SIZE);
1579                         res = _digest_nettle(SHA256_DIGEST_SIZE, (unsigned char*)sldns_buffer_begin(buf),
1580                                                 (unsigned int)sldns_buffer_limit(buf), (unsigned char*)digest);
1581                         res &= nettle_ecc_point_set(&pubkey, x, y);
1582                         res &= nettle_ecdsa_verify (&pubkey, SHA256_DIGEST_SIZE, digest, &signature);
1583                         mpz_clear(x);
1584                         mpz_clear(y);
1585                         break;
1586                 }
1587                 case SHA384_DIGEST_SIZE:
1588                 {
1589                         uint8_t digest[SHA384_DIGEST_SIZE];
1590                         mpz_t x, y;
1591                         nettle_ecc_point_init(&pubkey, &nettle_secp_384r1);
1592                         nettle_mpz_init_set_str_256_u(x, SHA384_DIGEST_SIZE, key);
1593                         nettle_mpz_init_set_str_256_u(y, SHA384_DIGEST_SIZE, key+SHA384_DIGEST_SIZE);
1594                         nettle_mpz_set_str_256_u(signature.r, SHA384_DIGEST_SIZE, sigblock);
1595                         nettle_mpz_set_str_256_u(signature.s, SHA384_DIGEST_SIZE, sigblock+SHA384_DIGEST_SIZE);
1596                         res = _digest_nettle(SHA384_DIGEST_SIZE, (unsigned char*)sldns_buffer_begin(buf),
1597                                                 (unsigned int)sldns_buffer_limit(buf), (unsigned char*)digest);
1598                         res &= nettle_ecc_point_set(&pubkey, x, y);
1599                         res &= nettle_ecdsa_verify (&pubkey, SHA384_DIGEST_SIZE, digest, &signature);
1600                         mpz_clear(x);
1601                         mpz_clear(y);
1602                         nettle_ecc_point_clear(&pubkey);
1603                         break;
1604                 }
1605                 default:
1606                         return "unknown ECDSA algorithm";
1607         }
1608
1609         /* Clear and return */
1610         nettle_dsa_signature_clear(&signature);
1611         if (!res)
1612                 return "ECDSA signature verification failed";
1613         else
1614                 return NULL;
1615 }
1616 #endif
1617
1618 /**
1619  * Check a canonical sig+rrset and signature against a dnskey
1620  * @param buf: buffer with data to verify, the first rrsig part and the
1621  *      canonicalized rrset.
1622  * @param algo: DNSKEY algorithm.
1623  * @param sigblock: signature rdata field from RRSIG
1624  * @param sigblock_len: length of sigblock data.
1625  * @param key: public key data from DNSKEY RR.
1626  * @param keylen: length of keydata.
1627  * @param reason: bogus reason in more detail.
1628  * @return secure if verification succeeded, bogus on crypto failure,
1629  *      unchecked on format errors and alloc failures.
1630  */
1631 enum sec_status
1632 verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
1633         unsigned int sigblock_len, unsigned char* key, unsigned int keylen,
1634         char** reason)
1635 {
1636         unsigned int digest_size = 0;
1637
1638         if (sigblock_len == 0 || keylen == 0) {
1639                 *reason = "null signature";
1640                 return sec_status_bogus;
1641         }
1642
1643         switch(algo) {
1644 #ifdef USE_DSA
1645         case LDNS_DSA:
1646         case LDNS_DSA_NSEC3:
1647                 *reason = _verify_nettle_dsa(buf, sigblock, sigblock_len, key, keylen);
1648                 if (*reason != NULL)
1649                         return sec_status_bogus;
1650                 else
1651                         return sec_status_secure;
1652 #endif /* USE_DSA */
1653
1654         case LDNS_RSASHA1:
1655         case LDNS_RSASHA1_NSEC3:
1656                 digest_size = (digest_size ? digest_size : SHA1_DIGEST_SIZE);
1657 #ifdef USE_SHA2
1658         case LDNS_RSASHA256:
1659                 digest_size = (digest_size ? digest_size : SHA256_DIGEST_SIZE);
1660         case LDNS_RSASHA512:
1661                 digest_size = (digest_size ? digest_size : SHA512_DIGEST_SIZE);
1662
1663 #endif
1664                 *reason = _verify_nettle_rsa(buf, digest_size, (char*)sigblock,
1665                                                 sigblock_len, key, keylen);
1666                 if (*reason != NULL)
1667                         return sec_status_bogus;
1668                 else
1669                         return sec_status_secure;
1670
1671 #ifdef USE_ECDSA
1672         case LDNS_ECDSAP256SHA256:
1673                 digest_size = (digest_size ? digest_size : SHA256_DIGEST_SIZE);
1674         case LDNS_ECDSAP384SHA384:
1675                 digest_size = (digest_size ? digest_size : SHA384_DIGEST_SIZE);
1676                 *reason = _verify_nettle_ecdsa(buf, digest_size, sigblock,
1677                                                 sigblock_len, key, keylen);
1678                 if (*reason != NULL)
1679                         return sec_status_bogus;
1680                 else
1681                         return sec_status_secure;
1682 #endif
1683         case LDNS_RSAMD5:
1684         case LDNS_ECC_GOST:
1685         default:
1686                 *reason = "unable to verify signature, unknown algorithm";
1687                 return sec_status_bogus;
1688         }
1689 }
1690
1691 #endif /* HAVE_SSL or HAVE_NSS or HAVE_NETTLE */