12 #include <openssl/ssl.h>
13 #include <openssl/evp.h>
14 #include <openssl/rand.h>
15 #include <openssl/err.h>
16 #include <openssl/md5.h>
67 fprintf(out,
";; rcode: %s\n", rcode->
name);
71 if (rr_descriptor && rr_descriptor->
_name) {
72 fprintf(out,
";; qtype: %s\n", rr_descriptor->
_name);
74 fprintf(out,
"TYPE%u",
78 fprintf(out,
";; NODATA response\n");
80 fprintf(out,
"rrset:\n");
82 fprintf(out,
"sigs:\n");
84 fprintf(out,
"---\n");
86 fprintf(out,
"<no data>\n");
209 printf(
"There were already sigs!\n");
211 printf(
"replacing the old sigs\n");
242 possible_parent_name,
283 ldns_rdf *name = NULL, *key_name = NULL;
287 bool other_rrset =
false;
418 ldns_dnssec_build_data_chain_dnskey(res,
427 ldns_dnssec_build_data_chain_other(res,
446 if(!new_tree)
return NULL;
448 new_tree->
rrset = NULL;
475 if (parent > result) {
484 print_tabs(FILE *out,
size_t nr, uint8_t *map,
size_t treedepth)
487 for (i = 0; i < nr; i++) {
489 fprintf(out,
"|---");
490 }
else if (map && i < treedepth && map[i] == 1) {
516 memset(sibmap, 0, treedepth);
522 print_tabs(out, tabs, sibmap, treedepth);
526 if (descriptor->
_name) {
527 fprintf(out,
" (%s", descriptor->
_name);
529 fprintf(out,
" (TYPE%d",
534 fprintf(out,
" keytag: %u",
536 fprintf(out,
" alg: ");
538 fprintf(out,
" flags: ");
541 fprintf(out,
" keytag: ");
543 fprintf(out,
" digest type: ");
556 if (tree->
parent_count > 1 && i < tree->parent_count - 1) {
567 print_tabs(out, tabs + 1, sibmap, treedepth);
571 fprintf(out,
"Existence of DS is denied by:\n");
573 fprintf(out,
"Existence is denied by:\n");
578 fprintf(out,
"Existence of DS is denied by:\n");
580 print_tabs(out, tabs + 1, sibmap, treedepth);
582 "Error in denial of existence: %s\n",
589 print_tabs(out, tabs + 1, sibmap, treedepth);
596 printf(
"; SSL Error: ");
597 ERR_load_crypto_strings();
598 ERR_print_errors_fp(stdout);
603 parent_signature[i]);
604 printf(
"For RRset:\n");
607 printf(
"With key:\n");
619 print_tabs(out, tabs, sibmap, treedepth);
620 fprintf(out,
"<no data>\n");
623 fprintf(out,
"<null pointer>\n");
640 tree, tabs, extended, sibmap, treedepth);
650 tree, tabs, extended, NULL, 0);
660 tree, tabs, extended);
708 if (data_chain && data_chain->
rrset) {
709 cur_rrset = data_chain->
rrset;
722 new_tree->
rr = cur_rr;
723 new_tree->
rrset = cur_rrset;
777 new_tree, data_chain,
784 new_tree, data_chain, check_time);
822 tmp_rrset = cur_rrset;
830 assert(tmp_rrset == cur_rrset);
850 if (tmp_rrset && tmp_rrset != cur_rrset
858 if (cur_parent_rr == new_tree->
parents[i]->
rr) {
886 new_tree, data_chain, cur_sig_rr, ldns_time(NULL));
908 if (cur_parent_rr != cur_rr &&
913 cur_parent_tree->
rr = cur_parent_rr;
914 cur_parent_tree->
rrset = cur_rrset;
916 cur_rrset, cur_sig_rr,
917 cur_parent_rr, check_time);
919 cur_parent_tree, cur_sig_rr, cur_status);
932 new_tree, data_chain, cur_rr, cur_sig_rr, ldns_time(NULL));
985 new_tree, data_chain, cur_rr, ldns_time(NULL));
1034 cur_parent_tree, NULL, result);
1044 new_tree, data_chain, ldns_time(NULL));
1089 result = parent_result;
1113 if (!rrset || !rrsig || !keys) {
1131 keys, check_time, good_keys);
1142 return verify_result;
1159 if (!rrset || !rrsig || !keys) {
1189 return verify_result;
1205 if (res && domain && keys) {
1208 domain, keys, check_time))) {
1215 while (parent_domain &&
1252 if (parent_domain) {
1257 return trusted_keys;
1267 res, domain, keys, ldns_time(NULL), status);
1280 uint16_t key_i; uint16_t key_j; uint16_t key_k;
1281 uint16_t sig_i;
ldns_rr * cur_sig;
1341 return trusted_keys;
1361 return trusted_keys;
1370 res, domain, keys, ldns_time(NULL));
1418 return trusted_keys;
1438 uint16_t sig_i; uint16_t key_i;
1443 if (!res || !rrset || !rrsigs) {
1477 if (validating_keys) {
1500 res, rrset, rrsigs, ldns_time(NULL), validating_keys);
1517 bool name_covered =
false;
1518 bool type_covered =
false;
1519 bool wildcard_covered =
false;
1520 bool wildcard_type_covered =
false;
1543 wildcard_covered =
true;
1548 type_covered =
true;
1552 name_covered =
true;
1559 wildcard_type_covered =
true;
1564 wildcard_covered =
true;
1571 if (type_covered || !name_covered) {
1575 if (wildcard_type_covered || !wildcard_covered) {
1588 ,
bool packet_nodata
1595 bool wildcard_covered =
false;
1599 ldns_rdf *next_closer = next_closer;
1616 if(!closest_encloser) {
1625 hashed_wildcard_name =
1632 hashed_wildcard_name)) {
1633 wildcard_covered =
true;
1641 if (! wildcard_covered) {
1680 if(!closest_encloser) {
1687 hashed_wildcard_name =
1751 if(!closest_encloser) {
1761 hashed_next_closer = hashed_name;
1781 hashed_next_closer) &&
1817 rr, nsecs, rrsigs, packet_rcode,
1818 packet_qtype, packet_nodata, NULL
1827 uint8_t asn[37] = { 0x30, 0x63, 0x30, 0x1c, 0x06, 0x06, 0x2a, 0x85,
1828 0x03, 0x02, 0x02, 0x13, 0x30, 0x12, 0x06, 0x07, 0x2a, 0x85,
1829 0x03, 0x02, 0x02, 0x23, 0x01, 0x06, 0x07, 0x2a, 0x85, 0x03,
1830 0x02, 0x02, 0x1e, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40};
1831 unsigned char encoded[37+64];
1832 const unsigned char* pp;
1839 memmove(encoded, asn, 37);
1840 memmove(encoded+37, key, 64);
1841 pp = (
unsigned char*)&encoded[0];
1843 return d2i_PUBKEY(NULL, &pp, (
int)
sizeof(encoded));
1847 ldns_verify_rrsig_gost_raw(
unsigned char* sig,
size_t siglen,
1848 ldns_buffer* rrset,
unsigned char* key,
size_t keylen)
1862 evp_key, EVP_get_digestbyname(
"md_gost94"));
1863 EVP_PKEY_free(evp_key);
1873 unsigned char buf[256+2];
1874 const unsigned char* pp = buf;
1879 if(keylen != 2*256/8)
return NULL;
1880 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
1882 if(keylen != 2*384/8)
return NULL;
1883 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
1885 if(!ec)
return NULL;
1886 if(keylen+1 >
sizeof(buf))
1890 buf[0] = POINT_CONVERSION_UNCOMPRESSED;
1891 memmove(buf+1, key, keylen);
1892 if(!o2i_ECPublicKey(&ec, &pp, (
int)keylen+1)) {
1896 evp_key = EVP_PKEY_new();
1901 if (!EVP_PKEY_assign_EC_KEY(evp_key, ec)) {
1902 EVP_PKEY_free(evp_key);
1910 ldns_verify_rrsig_ecdsa_raw(
unsigned char* sig,
size_t siglen,
1911 ldns_buffer* rrset,
unsigned char* key,
size_t keylen, uint8_t algo)
1924 else d = EVP_sha384();
1926 EVP_PKEY_free(evp_key);
1936 (
unsigned char*)ldns_buffer_begin(rawsig_buf),
1937 ldns_buffer_position(rawsig_buf),
1939 (
unsigned char*)ldns_buffer_begin(key_buf),
1940 ldns_buffer_position(key_buf), algo);
1945 ldns_buffer *verify_buf,
unsigned char* key,
size_t keylen,
1984 return ldns_verify_rrsig_gost_raw(sig, siglen, verify_buf,
1991 return ldns_verify_rrsig_ecdsa_raw(sig, siglen, verify_buf,
2021 uint8_t label_count;
2044 wildcard_chopped = wildcard_chopped_tmp;
2070 if (rrsig == NULL) {
2151 ldns_rrsig_check_timestamps(
ldns_rr* rrsig, time_t now)
2153 int32_t inception, expiration;
2161 if (expiration - inception < 0) {
2165 if (((int32_t) now) - inception < 0) {
2169 if (expiration - ((int32_t) now) < 0) {
2199 result = ldns_rrsig2rawsig_buffer(rawsig_buf, rrsig);
2205 ldns_rrset_use_signature_ttl(rrset_clone, rrsig);
2237 if (rrsig == NULL) {
2274 verify_buf, key_buf, sig_algo);
2318 result = ldns_rrsig_check_timestamps(rrsig, check_time);
2345 rrset, rrsig, keys, ldns_time(NULL), good_keys);
2377 result = ldns_prepare_for_verify(rawsig_buf, verify_buf,
2378 rrset_clone, rrsig);
2389 status = ldns_verify_test_sig_key(rawsig_buf, verify_buf,
2453 result = ldns_prepare_for_verify(rawsig_buf, verify_buf,
2454 rrset_clone, rrsig);
2461 result = ldns_verify_test_sig_key(rawsig_buf, verify_buf,
2470 result = ldns_rrsig_check_timestamps(rrsig, check_time);
2486 const EVP_MD *digest_type)
2489 (
unsigned char*)ldns_buffer_begin(sig),
2490 ldns_buffer_position(sig),
2498 ldns_buffer *rrset, EVP_PKEY *key,
const EVP_MD *digest_type)
2503 EVP_MD_CTX_init(&ctx);
2505 EVP_VerifyInit(&ctx, digest_type);
2506 EVP_VerifyUpdate(&ctx,
2507 ldns_buffer_begin(rrset),
2508 ldns_buffer_position(rrset));
2509 res = EVP_VerifyFinal(&ctx, sig, (
unsigned int) siglen, key);
2511 EVP_MD_CTX_cleanup(&ctx);
2515 }
else if (res == 0) {
2527 (
unsigned char*) ldns_buffer_begin(sig),
2528 ldns_buffer_position(sig),
2530 (
unsigned char*) ldns_buffer_begin(key),
2531 ldns_buffer_position(key));
2538 (
unsigned char*)ldns_buffer_begin(sig),
2539 ldns_buffer_position(sig),
2541 (
unsigned char*) ldns_buffer_begin(key),
2542 ldns_buffer_position(key));
2549 (
unsigned char*)ldns_buffer_begin(sig),
2550 ldns_buffer_position(sig),
2552 (
unsigned char*) ldns_buffer_begin(key),
2553 ldns_buffer_position(key));
2558 ldns_buffer* rrset,
unsigned char* key,
size_t keylen)
2563 evp_key = EVP_PKEY_new();
2573 EVP_PKEY_free(evp_key);
2580 ldns_buffer* rrset,
unsigned char* key,
size_t keylen)
2585 evp_key = EVP_PKEY_new();
2595 EVP_PKEY_free(evp_key);
2611 evp_key = EVP_PKEY_new();
2621 EVP_PKEY_free(evp_key);
2646 evp_key = EVP_PKEY_new();
2656 EVP_PKEY_free(evp_key);
2681 evp_key = EVP_PKEY_new();
2691 EVP_PKEY_free(evp_key);