unbound/validator/val_secalgo.c

   1 /*
   2  * validator/val_secalgo.c - validator security algorithm functions.
   3  *
   4  * Copyright (c) 2012, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file contains helper functions for the validator module.
  40  * These functions take raw data buffers, formatted for crypto verification,
  41  * and do the library calls (for the crypto library in use).
  42  */
  43 #include "config.h"
  44 #include "validator/val_secalgo.h"
  45 #include "util/data/packed_rrset.h"
  46 #include "util/log.h"
  47 #include "ldns/rrdef.h"
  48 #include "ldns/keyraw.h"
  49 #include "ldns/sbuffer.h"
  50
  51 #if !defined(HAVE_SSL) && !defined(HAVE_NSS)
  52 #error "Need crypto library to do digital signature cryptography"
  53 #endif
  54
  55 /* OpenSSL implementation */
  56 #ifdef HAVE_SSL
  57 #ifdef HAVE_OPENSSL_ERR_H
  58 #include <openssl/err.h>
  59 #endif
  60
  61 #ifdef HAVE_OPENSSL_RAND_H
  62 #include <openssl/rand.h>
  63 #endif
  64
  65 #ifdef HAVE_OPENSSL_CONF_H
  66 #include <openssl/conf.h>
  67 #endif
  68
  69 #ifdef HAVE_OPENSSL_ENGINE_H
  70 #include <openssl/engine.h>
  71 #endif
  72
  73 /**
  74  * Return size of DS digest according to its hash algorithm.
  75  * @param algo: DS digest algo.
  76  * @return size in bytes of digest, or 0 if not supported.
  77  */
  78 size_t
  79 ds_digest_size_supported(int algo)
  80 {
  81         switch(algo) {
  82 #ifdef HAVE_EVP_SHA1
  83                 case LDNS_SHA1:
  84                         return SHA_DIGEST_LENGTH;
  85 #endif
  86 #ifdef HAVE_EVP_SHA256
  87                 case LDNS_SHA256:
  88                         return SHA256_DIGEST_LENGTH;
  89 #endif
  90 #ifdef USE_GOST
  91                 case LDNS_HASH_GOST:
  92                         if(EVP_get_digestbyname("md_gost94"))
  93                                 return 32;
  94                         else    return 0;
  95 #endif
  96 #ifdef USE_ECDSA
  97                 case LDNS_SHA384:
  98                         return SHA384_DIGEST_LENGTH;
  99 #endif
 100                 default: break;
 101         }
 102         return 0;
 103 }
 104
 105 #ifdef USE_GOST
 106 /** Perform GOST hash */
 107 static int
 108 do_gost94(unsigned char* data, size_t len, unsigned char* dest)
 109 {
 110         const EVP_MD* md = EVP_get_digestbyname("md_gost94");
 111         if(!md)
 112                 return 0;
 113         return sldns_digest_evp(data, (unsigned int)len, dest, md);
 114 }
 115 #endif
 116
 117 int
 118 secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
 119         unsigned char* res)
 120 {
 121         switch(algo) {
 122 #ifdef HAVE_EVP_SHA1
 123                 case LDNS_SHA1:
 124                         (void)SHA1(buf, len, res);
 125                         return 1;
 126 #endif
 127 #ifdef HAVE_EVP_SHA256
 128                 case LDNS_SHA256:
 129                         (void)SHA256(buf, len, res);
 130                         return 1;
 131 #endif
 132 #ifdef USE_GOST
 133                 case LDNS_HASH_GOST:
 134                         if(do_gost94(buf, len, res))
 135                                 return 1;
 136                         break;
 137 #endif
 138 #ifdef USE_ECDSA
 139                 case LDNS_SHA384:
 140                         (void)SHA384(buf, len, res);
 141                         return 1;
 142 #endif
 143                 default:
 144                         verbose(VERB_QUERY, "unknown DS digest algorithm %d",
 145                                 algo);
 146                         break;
 147         }
 148         return 0;
 149 }
 150
 151 /** return true if DNSKEY algorithm id is supported */
 152 int
 153 dnskey_algo_id_is_supported(int id)
 154 {
 155         switch(id) {
 156         case LDNS_RSAMD5:
 157                 /* RFC 6725 deprecates RSAMD5 */
 158                 return 0;
 159         case LDNS_DSA:
 160         case LDNS_DSA_NSEC3:
 161         case LDNS_RSASHA1:
 162         case LDNS_RSASHA1_NSEC3:
 163 #if defined(HAVE_EVP_SHA256) && defined(USE_SHA2)
 164         case LDNS_RSASHA256:
 165 #endif
 166 #if defined(HAVE_EVP_SHA512) && defined(USE_SHA2)
 167         case LDNS_RSASHA512:
 168 #endif
 169 #ifdef USE_ECDSA
 170         case LDNS_ECDSAP256SHA256:
 171         case LDNS_ECDSAP384SHA384:
 172 #endif
 173                 return 1;
 174 #ifdef USE_GOST
 175         case LDNS_ECC_GOST:
 176                 /* we support GOST if it can be loaded */
 177                 return sldns_key_EVP_load_gost_id();
 178 #endif
 179         default:
 180                 return 0;
 181         }
 182 }
 183
 184 /**
 185  * Output a libcrypto openssl error to the logfile.
 186  * @param str: string to add to it.
 187  * @param e: the error to output, error number from ERR_get_error().
 188  */
 189 static void
 190 log_crypto_error(const char* str, unsigned long e)
 191 {
 192         char buf[128];
 193         /* or use ERR_error_string if ERR_error_string_n is not avail TODO */
 194         ERR_error_string_n(e, buf, sizeof(buf));
 195         /* buf now contains */
 196         /* error:[error code]:[library name]:[function name]:[reason string] */
 197         log_err("%s crypto %s", str, buf);
 198 }
 199
 200 /**
 201  * Setup DSA key digest in DER encoding ...
 202  * @param sig: input is signature output alloced ptr (unless failure).
 203  *      caller must free alloced ptr if this routine returns true.
 204  * @param len: input is initial siglen, output is output len.
 205  * @return false on failure.
 206  */
 207 static int
 208 setup_dsa_sig(unsigned char** sig, unsigned int* len)
 209 {
 210         unsigned char* orig = *sig;
 211         unsigned int origlen = *len;
 212         int newlen;
 213         BIGNUM *R, *S;
 214         DSA_SIG *dsasig;
 215
 216         /* extract the R and S field from the sig buffer */
 217         if(origlen < 1 + 2*SHA_DIGEST_LENGTH)
 218                 return 0;
 219         R = BN_new();
 220         if(!R) return 0;
 221         (void) BN_bin2bn(orig + 1, SHA_DIGEST_LENGTH, R);
 222         S = BN_new();
 223         if(!S) return 0;
 224         (void) BN_bin2bn(orig + 21, SHA_DIGEST_LENGTH, S);
 225         dsasig = DSA_SIG_new();
 226         if(!dsasig) return 0;
 227
 228         dsasig->r = R;
 229         dsasig->s = S;
 230         *sig = NULL;
 231         newlen = i2d_DSA_SIG(dsasig, sig);
 232         if(newlen < 0) {
 233                 DSA_SIG_free(dsasig);
 234                 free(*sig);
 235                 return 0;
 236         }
 237         *len = (unsigned int)newlen;
 238         DSA_SIG_free(dsasig);
 239         return 1;
 240 }
 241
 242 #ifdef USE_ECDSA
 243 /**
 244  * Setup the ECDSA signature in its encoding that the library wants.
 245  * Converts from plain numbers to ASN formatted.
 246  * @param sig: input is signature, output alloced ptr (unless failure).
 247  *      caller must free alloced ptr if this routine returns true.
 248  * @param len: input is initial siglen, output is output len.
 249  * @return false on failure.
 250  */
 251 static int
 252 setup_ecdsa_sig(unsigned char** sig, unsigned int* len)
 253 {
 254         ECDSA_SIG* ecdsa_sig;
 255         int newlen;
 256         int bnsize = (int)((*len)/2);
 257         /* if too short or not even length, fails */
 258         if(*len < 16 || bnsize*2 != (int)*len)
 259                 return 0;
 260         /* use the raw data to parse two evenly long BIGNUMs, "r | s". */
 261         ecdsa_sig = ECDSA_SIG_new();
 262         if(!ecdsa_sig) return 0;
 263         ecdsa_sig->r = BN_bin2bn(*sig, bnsize, ecdsa_sig->r);
 264         ecdsa_sig->s = BN_bin2bn(*sig+bnsize, bnsize, ecdsa_sig->s);
 265         if(!ecdsa_sig->r || !ecdsa_sig->s) {
 266                 ECDSA_SIG_free(ecdsa_sig);
 267                 return 0;
 268         }
 269
 270         /* spool it into ASN format */
 271         *sig = NULL;
 272         newlen = i2d_ECDSA_SIG(ecdsa_sig, sig);
 273         if(newlen <= 0) {
 274                 ECDSA_SIG_free(ecdsa_sig);
 275                 free(*sig);
 276                 return 0;
 277         }
 278         *len = (unsigned int)newlen;
 279         ECDSA_SIG_free(ecdsa_sig);
 280         return 1;
 281 }
 282 #endif /* USE_ECDSA */
 283
 284 /**
 285  * Setup key and digest for verification. Adjust sig if necessary.
 286  *
 287  * @param algo: key algorithm
 288  * @param evp_key: EVP PKEY public key to create.
 289  * @param digest_type: digest type to use
 290  * @param key: key to setup for.
 291  * @param keylen: length of key.
 292  * @return false on failure.
 293  */
 294 static int
 295 setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type,
 296         unsigned char* key, size_t keylen)
 297 {
 298         DSA* dsa;
 299         RSA* rsa;
 300
 301         switch(algo) {
 302                 case LDNS_DSA:
 303                 case LDNS_DSA_NSEC3:
 304                         *evp_key = EVP_PKEY_new();
 305                         if(!*evp_key) {
 306                                 log_err("verify: malloc failure in crypto");
 307                                 return 0;
 308                         }
 309                         dsa = sldns_key_buf2dsa_raw(key, keylen);
 310                         if(!dsa) {
 311                                 verbose(VERB_QUERY, "verify: "
 312                                         "sldns_key_buf2dsa_raw failed");
 313                                 return 0;
 314                         }
 315                         if(EVP_PKEY_assign_DSA(*evp_key, dsa) == 0) {
 316                                 verbose(VERB_QUERY, "verify: "
 317                                         "EVP_PKEY_assign_DSA failed");
 318                                 return 0;
 319                         }
 320                         *digest_type = EVP_dss1();
 321
 322                         break;
 323                 case LDNS_RSASHA1:
 324                 case LDNS_RSASHA1_NSEC3:
 325 #if defined(HAVE_EVP_SHA256) && defined(USE_SHA2)
 326                 case LDNS_RSASHA256:
 327 #endif
 328 #if defined(HAVE_EVP_SHA512) && defined(USE_SHA2)
 329                 case LDNS_RSASHA512:
 330 #endif
 331                         *evp_key = EVP_PKEY_new();
 332                         if(!*evp_key) {
 333                                 log_err("verify: malloc failure in crypto");
 334                                 return 0;
 335                         }
 336                         rsa = sldns_key_buf2rsa_raw(key, keylen);
 337                         if(!rsa) {
 338                                 verbose(VERB_QUERY, "verify: "
 339                                         "sldns_key_buf2rsa_raw SHA failed");
 340                                 return 0;
 341                         }
 342                         if(EVP_PKEY_assign_RSA(*evp_key, rsa) == 0) {
 343                                 verbose(VERB_QUERY, "verify: "
 344                                         "EVP_PKEY_assign_RSA SHA failed");
 345                                 return 0;
 346                         }
 347
 348                         /* select SHA version */
 349 #if defined(HAVE_EVP_SHA256) && defined(USE_SHA2)
 350                         if(algo == LDNS_RSASHA256)
 351                                 *digest_type = EVP_sha256();
 352                         else
 353 #endif
 354 #if defined(HAVE_EVP_SHA512) && defined(USE_SHA2)
 355                                 if(algo == LDNS_RSASHA512)
 356                                 *digest_type = EVP_sha512();
 357                         else
 358 #endif
 359                                 *digest_type = EVP_sha1();
 360
 361                         break;
 362                 case LDNS_RSAMD5:
 363                         *evp_key = EVP_PKEY_new();
 364                         if(!*evp_key) {
 365                                 log_err("verify: malloc failure in crypto");
 366                                 return 0;
 367                         }
 368                         rsa = sldns_key_buf2rsa_raw(key, keylen);
 369                         if(!rsa) {
 370                                 verbose(VERB_QUERY, "verify: "
 371                                         "sldns_key_buf2rsa_raw MD5 failed");
 372                                 return 0;
 373                         }
 374                         if(EVP_PKEY_assign_RSA(*evp_key, rsa) == 0) {
 375                                 verbose(VERB_QUERY, "verify: "
 376                                         "EVP_PKEY_assign_RSA MD5 failed");
 377                                 return 0;
 378                         }
 379                         *digest_type = EVP_md5();
 380
 381                         break;
 382 #ifdef USE_GOST
 383                 case LDNS_ECC_GOST:
 384                         *evp_key = sldns_gost2pkey_raw(key, keylen);
 385                         if(!*evp_key) {
 386                                 verbose(VERB_QUERY, "verify: "
 387                                         "sldns_gost2pkey_raw failed");
 388                                 return 0;
 389                         }
 390                         *digest_type = EVP_get_digestbyname("md_gost94");
 391                         if(!*digest_type) {
 392                                 verbose(VERB_QUERY, "verify: "
 393                                         "EVP_getdigest md_gost94 failed");
 394                                 return 0;
 395                         }
 396                         break;
 397 #endif
 398 #ifdef USE_ECDSA
 399                 case LDNS_ECDSAP256SHA256:
 400                         *evp_key = sldns_ecdsa2pkey_raw(key, keylen,
 401                                 LDNS_ECDSAP256SHA256);
 402                         if(!*evp_key) {
 403                                 verbose(VERB_QUERY, "verify: "
 404                                         "sldns_ecdsa2pkey_raw failed");
 405                                 return 0;
 406                         }
 407 #ifdef USE_ECDSA_EVP_WORKAROUND
 408                         /* openssl before 1.0.0 fixes RSA with the SHA256
 409                          * hash in EVP.  We create one for ecdsa_sha256 */
 410                         {
 411                                 static int md_ecdsa_256_done = 0;
 412                                 static EVP_MD md;
 413                                 if(!md_ecdsa_256_done) {
 414                                         EVP_MD m = *EVP_sha256();
 415                                         md_ecdsa_256_done = 1;
 416                                         m.required_pkey_type[0] = (*evp_key)->type;
 417                                         m.verify = (void*)ECDSA_verify;
 418                                         md = m;
 419                                 }
 420                                 *digest_type = &md;
 421                         }
 422 #else
 423                         *digest_type = EVP_sha256();
 424 #endif
 425                         break;
 426                 case LDNS_ECDSAP384SHA384:
 427                         *evp_key = sldns_ecdsa2pkey_raw(key, keylen,
 428                                 LDNS_ECDSAP384SHA384);
 429                         if(!*evp_key) {
 430                                 verbose(VERB_QUERY, "verify: "
 431                                         "sldns_ecdsa2pkey_raw failed");
 432                                 return 0;
 433                         }
 434 #ifdef USE_ECDSA_EVP_WORKAROUND
 435                         /* openssl before 1.0.0 fixes RSA with the SHA384
 436                          * hash in EVP.  We create one for ecdsa_sha384 */
 437                         {
 438                                 static int md_ecdsa_384_done = 0;
 439                                 static EVP_MD md;
 440                                 if(!md_ecdsa_384_done) {
 441                                         EVP_MD m = *EVP_sha384();
 442                                         md_ecdsa_384_done = 1;
 443                                         m.required_pkey_type[0] = (*evp_key)->type;
 444                                         m.verify = (void*)ECDSA_verify;
 445                                         md = m;
 446                                 }
 447                                 *digest_type = &md;
 448                         }
 449 #else
 450                         *digest_type = EVP_sha384();
 451 #endif
 452                         break;
 453 #endif /* USE_ECDSA */
 454                 default:
 455                         verbose(VERB_QUERY, "verify: unknown algorithm %d",
 456                                 algo);
 457                         return 0;
 458         }
 459         return 1;
 460 }
 461
 462 /**
 463  * Check a canonical sig+rrset and signature against a dnskey
 464  * @param buf: buffer with data to verify, the first rrsig part and the
 465  *      canonicalized rrset.
 466  * @param algo: DNSKEY algorithm.
 467  * @param sigblock: signature rdata field from RRSIG
 468  * @param sigblock_len: length of sigblock data.
 469  * @param key: public key data from DNSKEY RR.
 470  * @param keylen: length of keydata.
 471  * @param reason: bogus reason in more detail.
 472  * @return secure if verification succeeded, bogus on crypto failure,
 473  *      unchecked on format errors and alloc failures.
 474  */
 475 enum sec_status
 476 verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 477         unsigned int sigblock_len, unsigned char* key, unsigned int keylen,
 478         char** reason)
 479 {
 480         const EVP_MD *digest_type;
 481         EVP_MD_CTX ctx;
 482         int res, dofree = 0;
 483         EVP_PKEY *evp_key = NULL;
 484
 485         if(!setup_key_digest(algo, &evp_key, &digest_type, key, keylen)) {
 486                 verbose(VERB_QUERY, "verify: failed to setup key");
 487                 *reason = "use of key for crypto failed";
 488                 EVP_PKEY_free(evp_key);
 489                 return sec_status_bogus;
 490         }
 491         /* if it is a DSA signature in bind format, convert to DER format */
 492         if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3) &&
 493                 sigblock_len == 1+2*SHA_DIGEST_LENGTH) {
 494                 if(!setup_dsa_sig(&sigblock, &sigblock_len)) {
 495                         verbose(VERB_QUERY, "verify: failed to setup DSA sig");
 496                         *reason = "use of key for DSA crypto failed";
 497                         EVP_PKEY_free(evp_key);
 498                         return sec_status_bogus;
 499                 }
 500                 dofree = 1;
 501         }
 502 #ifdef USE_ECDSA
 503         else if(algo == LDNS_ECDSAP256SHA256 || algo == LDNS_ECDSAP384SHA384) {
 504                 /* EVP uses ASN prefix on sig, which is not in the wire data */
 505                 if(!setup_ecdsa_sig(&sigblock, &sigblock_len)) {
 506                         verbose(VERB_QUERY, "verify: failed to setup ECDSA sig");
 507                         *reason = "use of signature for ECDSA crypto failed";
 508                         EVP_PKEY_free(evp_key);
 509                         return sec_status_bogus;
 510                 }
 511                 dofree = 1;
 512         }
 513 #endif /* USE_ECDSA */
 514
 515         /* do the signature cryptography work */
 516         EVP_MD_CTX_init(&ctx);
 517         if(EVP_VerifyInit(&ctx, digest_type) == 0) {
 518                 verbose(VERB_QUERY, "verify: EVP_VerifyInit failed");
 519                 EVP_PKEY_free(evp_key);
 520                 if(dofree) free(sigblock);
 521                 return sec_status_unchecked;
 522         }
 523         if(EVP_VerifyUpdate(&ctx, (unsigned char*)sldns_buffer_begin(buf),
 524                 (unsigned int)sldns_buffer_limit(buf)) == 0) {
 525                 verbose(VERB_QUERY, "verify: EVP_VerifyUpdate failed");
 526                 EVP_PKEY_free(evp_key);
 527                 if(dofree) free(sigblock);
 528                 return sec_status_unchecked;
 529         }
 530
 531         res = EVP_VerifyFinal(&ctx, sigblock, sigblock_len, evp_key);
 532         if(EVP_MD_CTX_cleanup(&ctx) == 0) {
 533                 verbose(VERB_QUERY, "verify: EVP_MD_CTX_cleanup failed");
 534                 EVP_PKEY_free(evp_key);
 535                 if(dofree) free(sigblock);
 536                 return sec_status_unchecked;
 537         }
 538         EVP_PKEY_free(evp_key);
 539
 540         if(dofree)
 541                 free(sigblock);
 542
 543         if(res == 1) {
 544                 return sec_status_secure;
 545         } else if(res == 0) {
 546                 verbose(VERB_QUERY, "verify: signature mismatch");
 547                 *reason = "signature crypto failed";
 548                 return sec_status_bogus;
 549         }
 550
 551         log_crypto_error("verify:", ERR_get_error());
 552         return sec_status_unchecked;
 553 }
 554
 555 /**************************************************/
 556 #elif defined(HAVE_NSS)
 557 /* libnss implementation */
 558 /* nss3 */
 559 #include "sechash.h"
 560 #include "pk11pub.h"
 561 #include "keyhi.h"
 562 #include "secerr.h"
 563 #include "cryptohi.h"
 564 /* nspr4 */
 565 #include "prerror.h"
 566
 567 size_t
 568 ds_digest_size_supported(int algo)
 569 {
 570         /* uses libNSS */
 571         switch(algo) {
 572                 case LDNS_SHA1:
 573                         return SHA1_LENGTH;
 574 #ifdef USE_SHA2
 575                 case LDNS_SHA256:
 576                         return SHA256_LENGTH;
 577 #endif
 578 #ifdef USE_ECDSA
 579                 case LDNS_SHA384:
 580                         return SHA384_LENGTH;
 581 #endif
 582                 /* GOST not supported in NSS */
 583                 case LDNS_HASH_GOST:
 584                 default: break;
 585         }
 586         return 0;
 587 }
 588
 589 int
 590 secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
 591         unsigned char* res)
 592 {
 593         /* uses libNSS */
 594         switch(algo) {
 595                 case LDNS_SHA1:
 596                         return HASH_HashBuf(HASH_AlgSHA1, res, buf, len)
 597                                 == SECSuccess;
 598 #if defined(USE_SHA2)
 599                 case LDNS_SHA256:
 600                         return HASH_HashBuf(HASH_AlgSHA256, res, buf, len)
 601                                 == SECSuccess;
 602 #endif
 603 #ifdef USE_ECDSA
 604                 case LDNS_SHA384:
 605                         return HASH_HashBuf(HASH_AlgSHA384, res, buf, len)
 606                                 == SECSuccess;
 607 #endif
 608                 case LDNS_HASH_GOST:
 609                 default:
 610                         verbose(VERB_QUERY, "unknown DS digest algorithm %d",
 611                                 algo);
 612                         break;
 613         }
 614         return 0;
 615 }
 616
 617 int
 618 dnskey_algo_id_is_supported(int id)
 619 {
 620         /* uses libNSS */
 621         switch(id) {
 622         case LDNS_RSAMD5:
 623                 /* RFC 6725 deprecates RSAMD5 */
 624                 return 0;
 625         case LDNS_DSA:
 626         case LDNS_DSA_NSEC3:
 627         case LDNS_RSASHA1:
 628         case LDNS_RSASHA1_NSEC3:
 629 #ifdef USE_SHA2
 630         case LDNS_RSASHA256:
 631 #endif
 632 #ifdef USE_SHA2
 633         case LDNS_RSASHA512:
 634 #endif
 635                 return 1;
 636 #ifdef USE_ECDSA
 637         case LDNS_ECDSAP256SHA256:
 638         case LDNS_ECDSAP384SHA384:
 639                 return PK11_TokenExists(CKM_ECDSA);
 640 #endif
 641         case LDNS_ECC_GOST:
 642         default:
 643                 return 0;
 644         }
 645 }
 646
 647 /* return a new public key for NSS */
 648 static SECKEYPublicKey* nss_key_create(KeyType ktype)
 649 {
 650         SECKEYPublicKey* key;
 651         PLArenaPool* arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
 652         if(!arena) {
 653                 log_err("out of memory, PORT_NewArena failed");
 654                 return NULL;
 655         }
 656         key = PORT_ArenaZNew(arena, SECKEYPublicKey);
 657         if(!key) {
 658                 log_err("out of memory, PORT_ArenaZNew failed");
 659                 PORT_FreeArena(arena, PR_FALSE);
 660                 return NULL;
 661         }
 662         key->arena = arena;
 663         key->keyType = ktype;
 664         key->pkcs11Slot = NULL;
 665         key->pkcs11ID = CK_INVALID_HANDLE;
 666         return key;
 667 }
 668
 669 static SECKEYPublicKey* nss_buf2ecdsa(unsigned char* key, size_t len, int algo)
 670 {
 671         SECKEYPublicKey* pk;
 672         SECItem pub = {siBuffer, NULL, 0};
 673         SECItem params = {siBuffer, NULL, 0};
 674         static unsigned char param256[] = {
 675                 /* OBJECTIDENTIFIER 1.2.840.10045.3.1.7 (P-256)
 676                  * {iso(1) member-body(2) us(840) ansi-x962(10045) curves(3) prime(1) prime256v1(7)} */
 677                 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07
 678         };
 679         static unsigned char param384[] = {
 680                 /* OBJECTIDENTIFIER 1.3.132.0.34 (P-384)
 681                  * {iso(1) identified-organization(3) certicom(132) curve(0) ansip384r1(34)} */
 682                 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22
 683         };
 684         unsigned char buf[256+2]; /* sufficient for 2*384/8+1 */
 685
 686         /* check length, which uncompressed must be 2 bignums */
 687         if(algo == LDNS_ECDSAP256SHA256) {
 688                 if(len != 2*256/8) return NULL;
 689                 /* ECCurve_X9_62_PRIME_256V1 */
 690         } else if(algo == LDNS_ECDSAP384SHA384) {
 691                 if(len != 2*384/8) return NULL;
 692                 /* ECCurve_X9_62_PRIME_384R1 */
 693         } else    return NULL;
 694
 695         buf[0] = 0x04; /* POINT_FORM_UNCOMPRESSED */
 696         memmove(buf+1, key, len);
 697         pub.data = buf;
 698         pub.len = len+1;
 699         if(algo == LDNS_ECDSAP256SHA256) {
 700                 params.data = param256;
 701                 params.len = sizeof(param256);
 702         } else {
 703                 params.data = param384;
 704                 params.len = sizeof(param384);
 705         }
 706
 707         pk = nss_key_create(ecKey);
 708         if(!pk)
 709                 return NULL;
 710         pk->u.ec.size = (len/2)*8;
 711         if(SECITEM_CopyItem(pk->arena, &pk->u.ec.publicValue, &pub)) {
 712                 SECKEY_DestroyPublicKey(pk);
 713                 return NULL;
 714         }
 715         if(SECITEM_CopyItem(pk->arena, &pk->u.ec.DEREncodedParams, &params)) {
 716                 SECKEY_DestroyPublicKey(pk);
 717                 return NULL;
 718         }
 719
 720         return pk;
 721 }
 722
 723 static SECKEYPublicKey* nss_buf2dsa(unsigned char* key, size_t len)
 724 {
 725         SECKEYPublicKey* pk;
 726         uint8_t T;
 727         uint16_t length;
 728         uint16_t offset;
 729         SECItem Q = {siBuffer, NULL, 0};
 730         SECItem P = {siBuffer, NULL, 0};
 731         SECItem G = {siBuffer, NULL, 0};
 732         SECItem Y = {siBuffer, NULL, 0};
 733
 734         if(len == 0)
 735                 return NULL;
 736         T = (uint8_t)key[0];
 737         length = (64 + T * 8);
 738         offset = 1;
 739
 740         if (T > 8) {
 741                 return NULL;
 742         }
 743         if(len < (size_t)1 + SHA1_LENGTH + 3*length)
 744                 return NULL;
 745
 746         Q.data = key+offset;
 747         Q.len = SHA1_LENGTH;
 748         offset += SHA1_LENGTH;
 749
 750         P.data = key+offset;
 751         P.len = length;
 752         offset += length;
 753
 754         G.data = key+offset;
 755         G.len = length;
 756         offset += length;
 757
 758         Y.data = key+offset;
 759         Y.len = length;
 760         offset += length;
 761
 762         pk = nss_key_create(dsaKey);
 763         if(!pk)
 764                 return NULL;
 765         if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.params.prime, &P)) {
 766                 SECKEY_DestroyPublicKey(pk);
 767                 return NULL;
 768         }
 769         if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.params.subPrime, &Q)) {
 770                 SECKEY_DestroyPublicKey(pk);
 771                 return NULL;
 772         }
 773         if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.params.base, &G)) {
 774                 SECKEY_DestroyPublicKey(pk);
 775                 return NULL;
 776         }
 777         if(SECITEM_CopyItem(pk->arena, &pk->u.dsa.publicValue, &Y)) {
 778                 SECKEY_DestroyPublicKey(pk);
 779                 return NULL;
 780         }
 781         return pk;
 782 }
 783
 784 static SECKEYPublicKey* nss_buf2rsa(unsigned char* key, size_t len)
 785 {
 786         SECKEYPublicKey* pk;
 787         uint16_t exp;
 788         uint16_t offset;
 789         uint16_t int16;
 790         SECItem modulus = {siBuffer, NULL, 0};
 791         SECItem exponent = {siBuffer, NULL, 0};
 792         if(len == 0)
 793                 return NULL;
 794         if(key[0] == 0) {
 795                 if(len < 3)
 796                         return NULL;
 797                 /* the exponent is too large so it's places further */
 798                 memmove(&int16, key+1, 2);
 799                 exp = ntohs(int16);
 800                 offset = 3;
 801         } else {
 802                 exp = key[0];
 803                 offset = 1;
 804         }
 805
 806         /* key length at least one */
 807         if(len < (size_t)offset + exp + 1)
 808                 return NULL;
 809
 810         exponent.data = key+offset;
 811         exponent.len = exp;
 812         offset += exp;
 813         modulus.data = key+offset;
 814         modulus.len = (len - offset);
 815
 816         pk = nss_key_create(rsaKey);
 817         if(!pk)
 818                 return NULL;
 819         if(SECITEM_CopyItem(pk->arena, &pk->u.rsa.modulus, &modulus)) {
 820                 SECKEY_DestroyPublicKey(pk);
 821                 return NULL;
 822         }
 823         if(SECITEM_CopyItem(pk->arena, &pk->u.rsa.publicExponent, &exponent)) {
 824                 SECKEY_DestroyPublicKey(pk);
 825                 return NULL;
 826         }
 827         return pk;
 828 }
 829
 830 /**
 831  * Setup key and digest for verification. Adjust sig if necessary.
 832  *
 833  * @param algo: key algorithm
 834  * @param evp_key: EVP PKEY public key to create.
 835  * @param digest_type: digest type to use
 836  * @param key: key to setup for.
 837  * @param keylen: length of key.
 838  * @param prefix: if returned, the ASN prefix for the hashblob.
 839  * @param prefixlen: length of the prefix.
 840  * @return false on failure.
 841  */
 842 static int
 843 nss_setup_key_digest(int algo, SECKEYPublicKey** pubkey, HASH_HashType* htype,
 844         unsigned char* key, size_t keylen, unsigned char** prefix,
 845         size_t* prefixlen)
 846 {
 847         /* uses libNSS */
 848
 849         /* hash prefix for md5, RFC2537 */
 850         static unsigned char p_md5[] = {0x30, 0x20, 0x30, 0x0c, 0x06, 0x08, 0x2a,
 851         0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10};
 852         /* hash prefix to prepend to hash output, from RFC3110 */
 853         static unsigned char p_sha1[] = {0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2B,
 854                 0x0E, 0x03, 0x02, 0x1A, 0x05, 0x00, 0x04, 0x14};
 855         /* from RFC5702 */
 856         static unsigned char p_sha256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60,
 857         0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20};
 858         static unsigned char p_sha512[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60,
 859         0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40};
 860         /* from RFC6234 */
 861         /* for future RSASHA384 ..
 862         static unsigned char p_sha384[] = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60,
 863         0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30};
 864         */
 865
 866         switch(algo) {
 867                 case LDNS_DSA:
 868                 case LDNS_DSA_NSEC3:
 869                         *pubkey = nss_buf2dsa(key, keylen);
 870                         if(!*pubkey) {
 871                                 log_err("verify: malloc failure in crypto");
 872                                 return 0;
 873                         }
 874                         *htype = HASH_AlgSHA1;
 875                         /* no prefix for DSA verification */
 876                         break;
 877                 case LDNS_RSASHA1:
 878                 case LDNS_RSASHA1_NSEC3:
 879 #ifdef USE_SHA2
 880                 case LDNS_RSASHA256:
 881 #endif
 882 #ifdef USE_SHA2
 883                 case LDNS_RSASHA512:
 884 #endif
 885                         *pubkey = nss_buf2rsa(key, keylen);
 886                         if(!*pubkey) {
 887                                 log_err("verify: malloc failure in crypto");
 888                                 return 0;
 889                         }
 890                         /* select SHA version */
 891 #ifdef USE_SHA2
 892                         if(algo == LDNS_RSASHA256) {
 893                                 *htype = HASH_AlgSHA256;
 894                                 *prefix = p_sha256;
 895                                 *prefixlen = sizeof(p_sha256);
 896                         } else
 897 #endif
 898 #ifdef USE_SHA2
 899                                 if(algo == LDNS_RSASHA512) {
 900                                 *htype = HASH_AlgSHA512;
 901                                 *prefix = p_sha512;
 902                                 *prefixlen = sizeof(p_sha512);
 903                         } else
 904 #endif
 905                         {
 906                                 *htype = HASH_AlgSHA1;
 907                                 *prefix = p_sha1;
 908                                 *prefixlen = sizeof(p_sha1);
 909                         }
 910
 911                         break;
 912                 case LDNS_RSAMD5:
 913                         *pubkey = nss_buf2rsa(key, keylen);
 914                         if(!*pubkey) {
 915                                 log_err("verify: malloc failure in crypto");
 916                                 return 0;
 917                         }
 918                         *htype = HASH_AlgMD5;
 919                         *prefix = p_md5;
 920                         *prefixlen = sizeof(p_md5);
 921
 922                         break;
 923 #ifdef USE_ECDSA
 924                 case LDNS_ECDSAP256SHA256:
 925                         *pubkey = nss_buf2ecdsa(key, keylen,
 926                                 LDNS_ECDSAP256SHA256);
 927                         if(!*pubkey) {
 928                                 log_err("verify: malloc failure in crypto");
 929                                 return 0;
 930                         }
 931                         *htype = HASH_AlgSHA256;
 932                         /* no prefix for DSA verification */
 933                         break;
 934                 case LDNS_ECDSAP384SHA384:
 935                         *pubkey = nss_buf2ecdsa(key, keylen,
 936                                 LDNS_ECDSAP384SHA384);
 937                         if(!*pubkey) {
 938                                 log_err("verify: malloc failure in crypto");
 939                                 return 0;
 940                         }
 941                         *htype = HASH_AlgSHA384;
 942                         /* no prefix for DSA verification */
 943                         break;
 944 #endif /* USE_ECDSA */
 945                 case LDNS_ECC_GOST:
 946                 default:
 947                         verbose(VERB_QUERY, "verify: unknown algorithm %d",
 948                                 algo);
 949                         return 0;
 950         }
 951         return 1;
 952 }
 953
 954 /**
 955  * Check a canonical sig+rrset and signature against a dnskey
 956  * @param buf: buffer with data to verify, the first rrsig part and the
 957  *      canonicalized rrset.
 958  * @param algo: DNSKEY algorithm.
 959  * @param sigblock: signature rdata field from RRSIG
 960  * @param sigblock_len: length of sigblock data.
 961  * @param key: public key data from DNSKEY RR.
 962  * @param keylen: length of keydata.
 963  * @param reason: bogus reason in more detail.
 964  * @return secure if verification succeeded, bogus on crypto failure,
 965  *      unchecked on format errors and alloc failures.
 966  */
 967 enum sec_status
 968 verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 969         unsigned int sigblock_len, unsigned char* key, unsigned int keylen,
 970         char** reason)
 971 {
 972         /* uses libNSS */
 973         /* large enough for the different hashes */
 974         unsigned char hash[HASH_LENGTH_MAX];
 975         unsigned char hash2[HASH_LENGTH_MAX*2];
 976         HASH_HashType htype = 0;
 977         SECKEYPublicKey* pubkey = NULL;
 978         SECItem secsig = {siBuffer, sigblock, sigblock_len};
 979         SECItem sechash = {siBuffer, hash, 0};
 980         SECStatus res;
 981         unsigned char* prefix = NULL; /* prefix for hash, RFC3110, RFC5702 */
 982         size_t prefixlen = 0;
 983         int err;
 984
 985         if(!nss_setup_key_digest(algo, &pubkey, &htype, key, keylen,
 986                 &prefix, &prefixlen)) {
 987                 verbose(VERB_QUERY, "verify: failed to setup key");
 988                 *reason = "use of key for crypto failed";
 989                 SECKEY_DestroyPublicKey(pubkey);
 990                 return sec_status_bogus;
 991         }
 992
 993         /* need to convert DSA, ECDSA signatures? */
 994         if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3)) {
 995                 if(sigblock_len == 1+2*SHA1_LENGTH) {
 996                         secsig.data ++;
 997                         secsig.len --;
 998                 } else {
 999                         SECItem* p = DSAU_DecodeDerSig(&secsig);
1000                         if(!p) {
1001                                 verbose(VERB_QUERY, "verify: failed DER decode");
1002                                 *reason = "signature DER decode failed";
1003                                 SECKEY_DestroyPublicKey(pubkey);
1004                                 return sec_status_bogus;
1005                         }
1006                         if(SECITEM_CopyItem(pubkey->arena, &secsig, p)) {
1007                                 log_err("alloc failure in DER decode");
1008                                 SECKEY_DestroyPublicKey(pubkey);
1009                                 SECITEM_FreeItem(p, PR_TRUE);
1010                                 return sec_status_unchecked;
1011                         }
1012                         SECITEM_FreeItem(p, PR_TRUE);
1013                 }
1014         }
1015
1016         /* do the signature cryptography work */
1017         /* hash the data */
1018         sechash.len = HASH_ResultLen(htype);
1019         if(sechash.len > sizeof(hash)) {
1020                 verbose(VERB_QUERY, "verify: hash too large for buffer");
1021                 SECKEY_DestroyPublicKey(pubkey);
1022                 return sec_status_unchecked;
1023         }
1024         if(HASH_HashBuf(htype, hash, (unsigned char*)sldns_buffer_begin(buf),
1025                 (unsigned int)sldns_buffer_limit(buf)) != SECSuccess) {
1026                 verbose(VERB_QUERY, "verify: HASH_HashBuf failed");
1027                 SECKEY_DestroyPublicKey(pubkey);
1028                 return sec_status_unchecked;
1029         }
1030         if(prefix) {
1031                 int hashlen = sechash.len;
1032                 if(prefixlen+hashlen > sizeof(hash2)) {
1033                         verbose(VERB_QUERY, "verify: hashprefix too large");
1034                         SECKEY_DestroyPublicKey(pubkey);
1035                         return sec_status_unchecked;
1036                 }
1037                 sechash.data = hash2;
1038                 sechash.len = prefixlen+hashlen;
1039                 memcpy(sechash.data, prefix, prefixlen);
1040                 memmove(sechash.data+prefixlen, hash, hashlen);
1041         }
1042
1043         /* verify the signature */
1044         res = PK11_Verify(pubkey, &secsig, &sechash, NULL /*wincx*/);
1045         SECKEY_DestroyPublicKey(pubkey);
1046
1047         if(res == SECSuccess) {
1048                 return sec_status_secure;
1049         }
1050         err = PORT_GetError();
1051         if(err != SEC_ERROR_BAD_SIGNATURE) {
1052                 /* failed to verify */
1053                 verbose(VERB_QUERY, "verify: PK11_Verify failed: %s",
1054                         PORT_ErrorToString(err));
1055                 /* if it is not supported, like ECC is removed, we get,
1056                  * SEC_ERROR_NO_MODULE */
1057                 if(err == SEC_ERROR_NO_MODULE)
1058                         return sec_status_unchecked;
1059                 /* but other errors are commonly returned
1060                  * for a bad signature from NSS.  Thus we return bogus,
1061                  * not unchecked */
1062                 *reason = "signature crypto failed";
1063                 return sec_status_bogus;
1064         }
1065         verbose(VERB_QUERY, "verify: signature mismatch: %s",
1066                 PORT_ErrorToString(err));
1067         *reason = "signature crypto failed";
1068         return sec_status_bogus;
1069 }
1070
1071
1072 #endif /* HAVE_SSL or HAVE_NSS */