contrib/ldns/keys.c

   1 /*
   2  * keys.c handle private keys for use in DNSSEC
   3  *
   4  * This module should hide some of the openSSL complexities
   5  * and give a general interface for private keys and hmac
   6  * handling
   7  *
   8  * (c) NLnet Labs, 2004-2006
   9  *
  10  * See the file LICENSE for the license
  11  */
  12
  13 #include <ldns/config.h>
  14
  15 #include <ldns/ldns.h>
  16
  17 #ifdef HAVE_SSL
  18 #include <openssl/ui.h>
  19 #include <openssl/ssl.h>
  20 #include <openssl/rand.h>
  21 #include <openssl/bn.h>
  22 #include <openssl/rsa.h>
  23 #ifdef USE_DSA
  24 #include <openssl/dsa.h>
  25 #endif
  26 #ifndef OPENSSL_NO_ENGINE
  27 #include <openssl/engine.h>
  28 #endif
  29 #endif /* HAVE_SSL */
  30
  31 ldns_lookup_table ldns_signing_algorithms[] = {
  32         { LDNS_SIGN_RSAMD5, "RSAMD5" },
  33         { LDNS_SIGN_RSASHA1, "RSASHA1" },
  34         { LDNS_SIGN_RSASHA1_NSEC3, "RSASHA1-NSEC3-SHA1" },
  35 #ifdef USE_SHA2
  36         { LDNS_SIGN_RSASHA256, "RSASHA256" },
  37         { LDNS_SIGN_RSASHA512, "RSASHA512" },
  38 #endif
  39 #ifdef USE_GOST
  40         { LDNS_SIGN_ECC_GOST, "ECC-GOST" },
  41 #endif
  42 #ifdef USE_ECDSA
  43         { LDNS_SIGN_ECDSAP256SHA256, "ECDSAP256SHA256" },
  44         { LDNS_SIGN_ECDSAP384SHA384, "ECDSAP384SHA384" },
  45 #endif
  46 #ifdef USE_ED25519
  47         { LDNS_SIGN_ED25519, "ED25519" },
  48 #endif
  49 #ifdef USE_ED448
  50         { LDNS_SIGN_ED448, "ED448" },
  51 #endif
  52 #ifdef USE_DSA
  53         { LDNS_SIGN_DSA, "DSA" },
  54         { LDNS_SIGN_DSA_NSEC3, "DSA-NSEC3-SHA1" },
  55 #endif
  56         { LDNS_SIGN_HMACMD5, "hmac-md5.sig-alg.reg.int" },
  57         { LDNS_SIGN_HMACSHA1, "hmac-sha1" },
  58         { LDNS_SIGN_HMACSHA256, "hmac-sha256" },
  59         { LDNS_SIGN_HMACSHA224, "hmac-sha224" },
  60         { LDNS_SIGN_HMACSHA384, "hmac-sha384" },
  61         { LDNS_SIGN_HMACSHA512, "hmac-sha512" },
  62         { 0, NULL }
  63 };
  64
  65 ldns_key_list *
  66 ldns_key_list_new(void)
  67 {
  68         ldns_key_list *key_list = LDNS_MALLOC(ldns_key_list);
  69         if (!key_list) {
  70                 return NULL;
  71         } else {
  72                 key_list->_key_count = 0;
  73                 key_list->_keys = NULL;
  74                 return key_list;
  75         }
  76 }
  77
  78 ldns_key *
  79 ldns_key_new(void)
  80 {
  81         ldns_key *newkey;
  82
  83         newkey = LDNS_MALLOC(ldns_key);
  84         if (!newkey) {
  85                 return NULL;
  86         } else {
  87                 /* some defaults - not sure whether to do this */
  88                 ldns_key_set_use(newkey, true);
  89                 ldns_key_set_flags(newkey, LDNS_KEY_ZONE_KEY);
  90                 ldns_key_set_origttl(newkey, 0);
  91                 ldns_key_set_keytag(newkey, 0);
  92                 ldns_key_set_inception(newkey, 0);
  93                 ldns_key_set_expiration(newkey, 0);
  94                 ldns_key_set_pubkey_owner(newkey, NULL);
  95 #ifdef HAVE_SSL
  96                 ldns_key_set_evp_key(newkey, NULL);
  97 #endif /* HAVE_SSL */
  98                 ldns_key_set_hmac_key(newkey, NULL);
  99                 ldns_key_set_external_key(newkey, NULL);
 100                 return newkey;
 101         }
 102 }
 103
 104 ldns_status
 105 ldns_key_new_frm_fp(ldns_key **k, FILE *fp)
 106 {
 107         return ldns_key_new_frm_fp_l(k, fp, NULL);
 108 }
 109
 110 #if defined(HAVE_SSL) && !defined(OPENSSL_NO_ENGINE)
 111 ldns_status
 112 ldns_key_new_frm_engine(ldns_key **key, ENGINE *e, char *key_id, ldns_algorithm alg)
 113 {
 114         ldns_key *k;
 115
 116         k = ldns_key_new();
 117         if(!k) return LDNS_STATUS_MEM_ERR;
 118 #ifndef S_SPLINT_S
 119         k->_key.key = ENGINE_load_private_key(e, key_id, UI_OpenSSL(), NULL);
 120         if(!k->_key.key) {
 121                 ldns_key_free(k);
 122                 return LDNS_STATUS_ERR;
 123         }
 124         ldns_key_set_algorithm(k, (ldns_signing_algorithm) alg);
 125         if (!k->_key.key) {
 126                 ldns_key_free(k);
 127                 return LDNS_STATUS_ENGINE_KEY_NOT_LOADED;
 128         }
 129 #endif /* splint */
 130         *key = k;
 131         return LDNS_STATUS_OK;
 132 }
 133 #endif
 134
 135 #ifdef USE_GOST
 136 /** store GOST engine reference loaded into OpenSSL library */
 137 ENGINE* ldns_gost_engine = NULL;
 138
 139 int
 140 ldns_key_EVP_load_gost_id(void)
 141 {
 142         static int gost_id = 0;
 143         const EVP_PKEY_ASN1_METHOD* meth;
 144         ENGINE* e;
 145
 146         if(gost_id) return gost_id;
 147
 148         /* see if configuration loaded gost implementation from other engine*/
 149         meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1);
 150         if(meth) {
 151                 EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
 152                 return gost_id;
 153         }
 154
 155         /* see if engine can be loaded already */
 156         e = ENGINE_by_id("gost");
 157         if(!e) {
 158                 /* load it ourself, in case statically linked */
 159                 ENGINE_load_builtin_engines();
 160                 ENGINE_load_dynamic();
 161                 e = ENGINE_by_id("gost");
 162         }
 163         if(!e) {
 164                 /* no gost engine in openssl */
 165                 return 0;
 166         }
 167         if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
 168                 ENGINE_finish(e);
 169                 ENGINE_free(e);
 170                 return 0;
 171         }
 172
 173         meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1);
 174         if(!meth) {
 175                 /* algo not found */
 176                 ENGINE_finish(e);
 177                 ENGINE_free(e);
 178                 return 0;
 179         }
 180         /* Note: do not ENGINE_finish and ENGINE_free the acquired engine
 181          * on some platforms this frees up the meth and unloads gost stuff */
 182         ldns_gost_engine = e;
 183
 184         EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
 185         return gost_id;
 186 }
 187
 188 void ldns_key_EVP_unload_gost(void)
 189 {
 190         if(ldns_gost_engine) {
 191                 ENGINE_finish(ldns_gost_engine);
 192                 ENGINE_free(ldns_gost_engine);
 193                 ldns_gost_engine = NULL;
 194         }
 195 }
 196
 197 /** read GOST private key */
 198 static EVP_PKEY*
 199 ldns_key_new_frm_fp_gost_l(FILE* fp, int* line_nr)
 200 {
 201         char token[16384];
 202         const unsigned char* pp;
 203         int gost_id;
 204         EVP_PKEY* pkey;
 205         ldns_rdf* b64rdf = NULL;
 206
 207         gost_id = ldns_key_EVP_load_gost_id();
 208         if(!gost_id)
 209                 return NULL;
 210
 211         if (ldns_fget_keyword_data_l(fp, "GostAsn1", ": ", token, "\n",
 212                 sizeof(token), line_nr) == -1)
 213                 return NULL;
 214         while(strlen(token) < 96) {
 215                 /* read more b64 from the file, b64 split on multiple lines */
 216                 if(ldns_fget_token_l(fp, token+strlen(token), "\n",
 217                         sizeof(token)-strlen(token), line_nr) == -1)
 218                         return NULL;
 219         }
 220         if(ldns_str2rdf_b64(&b64rdf, token) != LDNS_STATUS_OK)
 221                 return NULL;
 222         pp = (unsigned char*)ldns_rdf_data(b64rdf);
 223         pkey = d2i_PrivateKey(gost_id, NULL, &pp, (int)ldns_rdf_size(b64rdf));
 224         ldns_rdf_deep_free(b64rdf);
 225         return pkey;
 226 }
 227 #endif
 228
 229 #ifdef USE_ECDSA
 230 /** calculate public key from private key */
 231 static int
 232 ldns_EC_KEY_calc_public(EC_KEY* ec)
 233 {
 234         EC_POINT* pub_key;
 235         const EC_GROUP* group;
 236         group = EC_KEY_get0_group(ec);
 237         pub_key = EC_POINT_new(group);
 238         if(!pub_key) return 0;
 239         if(!EC_POINT_copy(pub_key, EC_GROUP_get0_generator(group))) {
 240                 EC_POINT_free(pub_key);
 241                 return 0;
 242         }
 243         if(!EC_POINT_mul(group, pub_key, EC_KEY_get0_private_key(ec),
 244                 NULL, NULL, NULL)) {
 245                 EC_POINT_free(pub_key);
 246                 return 0;
 247         }
 248         if(EC_KEY_set_public_key(ec, pub_key) == 0) {
 249                 EC_POINT_free(pub_key);
 250                 return 0;
 251         }
 252         EC_POINT_free(pub_key);
 253         return 1;
 254 }
 255
 256 /** read ECDSA private key */
 257 static EVP_PKEY*
 258 ldns_key_new_frm_fp_ecdsa_l(FILE* fp, ldns_algorithm alg, int* line_nr)
 259 {
 260         char token[16384];
 261         ldns_rdf* b64rdf = NULL;
 262         unsigned char* pp;
 263         BIGNUM* bn;
 264         EVP_PKEY* evp_key;
 265         EC_KEY* ec;
 266         if (ldns_fget_keyword_data_l(fp, "PrivateKey", ": ", token, "\n",
 267                 sizeof(token), line_nr) == -1)
 268                 return NULL;
 269         if(ldns_str2rdf_b64(&b64rdf, token) != LDNS_STATUS_OK)
 270                 return NULL;
 271         pp = (unsigned char*)ldns_rdf_data(b64rdf);
 272
 273         if(alg == LDNS_ECDSAP256SHA256)
 274                 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
 275         else if(alg == LDNS_ECDSAP384SHA384)
 276                 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
 277         else    ec = NULL;
 278         if(!ec) {
 279                 ldns_rdf_deep_free(b64rdf);
 280                 return NULL;
 281         }
 282         bn = BN_bin2bn(pp, (int)ldns_rdf_size(b64rdf), NULL);
 283         ldns_rdf_deep_free(b64rdf);
 284         if(!bn) {
 285                 EC_KEY_free(ec);
 286                 return NULL;
 287         }
 288         EC_KEY_set_private_key(ec, bn);
 289         BN_free(bn);
 290         if(!ldns_EC_KEY_calc_public(ec)) {
 291                 EC_KEY_free(ec);
 292                 return NULL;
 293         }
 294
 295         evp_key = EVP_PKEY_new();
 296         if(!evp_key) {
 297                 EC_KEY_free(ec);
 298                 return NULL;
 299         }
 300         if (!EVP_PKEY_assign_EC_KEY(evp_key, ec)) {
 301                 EVP_PKEY_free(evp_key);
 302                 EC_KEY_free(ec);
 303                 return NULL;
 304         }
 305         return evp_key;
 306 }
 307 #endif
 308
 309 #ifdef USE_ED25519
 310 /** turn private key buffer into EC_KEY structure */
 311 static EVP_PKEY*
 312 ldns_ed25519_priv_raw(uint8_t* pkey, int plen)
 313 {
 314         const unsigned char* pp;
 315         uint8_t buf[256];
 316         int buflen = 0;
 317         uint8_t pre[] = {0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06,
 318                 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20};
 319         int pre_len = 16;
 320         /* ASN looks like this for ED25519 public key
 321          * 302a300506032b6570032100 <32byteskey>
 322          * for ED25519 private key
 323          * 302e020100300506032b657004220420 <32bytes>
 324          *
 325          * for X25519 this was
 326          * 30320201010420 <32byteskey>
 327          * andparameters a00b06092b06010401da470f01
 328          * (noparameters, preamble is 30250201010420).
 329          * the key is reversed (little endian).
 330          */
 331         buflen = pre_len + plen;
 332         if((size_t)buflen > sizeof(buf))
 333                 return NULL;
 334         memmove(buf, pre, pre_len);
 335         memmove(buf+pre_len, pkey, plen);
 336         /* reverse the pkey into the buf - key is not reversed it seems */
 337         /* for(i=0; i<plen; i++)
 338                 buf[pre_len+i] = pkey[plen-1-i]; */
 339         pp = buf;
 340         return d2i_PrivateKey(NID_ED25519, NULL, &pp, buflen);
 341 }
 342
 343 /** read ED25519 private key */
 344 static EVP_PKEY*
 345 ldns_key_new_frm_fp_ed25519_l(FILE* fp, int* line_nr)
 346 {
 347         char token[16384];
 348         ldns_rdf* b64rdf = NULL;
 349         EVP_PKEY* evp_key;
 350         if (ldns_fget_keyword_data_l(fp, "PrivateKey", ": ", token, "\n",
 351                 sizeof(token), line_nr) == -1)
 352                 return NULL;
 353         if(ldns_str2rdf_b64(&b64rdf, token) != LDNS_STATUS_OK)
 354                 return NULL;
 355
 356         /* we use d2i_ECPrivateKey because it calculates the public key
 357          * from the private part, which others, EC_KEY_set_private_key,
 358          * and o2i methods, do not do */
 359         /* for that the private key has to be encoded in ASN1 notation
 360          * with a ED25519 prefix on it */
 361
 362         evp_key = ldns_ed25519_priv_raw(ldns_rdf_data(b64rdf),
 363                 (int)ldns_rdf_size(b64rdf));
 364         ldns_rdf_deep_free(b64rdf);
 365         return evp_key;
 366 }
 367 #endif
 368
 369 #ifdef USE_ED448
 370 /** turn private key buffer into EC_KEY structure */
 371 static EVP_PKEY*
 372 ldns_ed448_priv_raw(uint8_t* pkey, int plen)
 373 {
 374         const unsigned char* pp;
 375         uint8_t buf[256];
 376         int buflen = 0;
 377         uint8_t pre[] = {0x30, 0x47, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x71, 0x04, 0x3b, 0x04, 0x39};
 378         int pre_len = 16;
 379         /* ASN looks like this for ED448
 380          * 3047020100300506032b6571043b0439 <57bytekey>
 381          * the key is reversed (little endian).
 382          */
 383         buflen = pre_len + plen;
 384         if((size_t)buflen > sizeof(buf))
 385                 return NULL;
 386         memmove(buf, pre, pre_len);
 387         memmove(buf+pre_len, pkey, plen);
 388         /* reverse the pkey into the buf - key is not reversed it seems */
 389         /* for(i=0; i<plen; i++)
 390                 buf[pre_len+i] = pkey[plen-1-i]; */
 391         pp = buf;
 392         return d2i_PrivateKey(NID_ED448, NULL, &pp, buflen);
 393 }
 394
 395 /** read ED448 private key */
 396 static EVP_PKEY*
 397 ldns_key_new_frm_fp_ed448_l(FILE* fp, int* line_nr)
 398 {
 399         char token[16384];
 400         ldns_rdf* b64rdf = NULL;
 401         EVP_PKEY* evp_key;
 402         if (ldns_fget_keyword_data_l(fp, "PrivateKey", ": ", token, "\n",
 403                 sizeof(token), line_nr) == -1)
 404                 return NULL;
 405         if(ldns_str2rdf_b64(&b64rdf, token) != LDNS_STATUS_OK)
 406                 return NULL;
 407
 408         /* convert private key into ASN notation and then convert that */
 409         evp_key = ldns_ed448_priv_raw(ldns_rdf_data(b64rdf),
 410                 (int)ldns_rdf_size(b64rdf));
 411         ldns_rdf_deep_free(b64rdf);
 412         return evp_key;
 413 }
 414 #endif
 415
 416 ldns_status
 417 ldns_key_new_frm_fp_l(ldns_key **key, FILE *fp, int *line_nr)
 418 {
 419         ldns_key *k;
 420         char *d;
 421         ldns_signing_algorithm alg;
 422         ldns_rr *key_rr;
 423 #ifdef HAVE_SSL
 424         RSA *rsa;
 425 #ifdef USE_DSA
 426         DSA *dsa;
 427 #endif
 428         unsigned char *hmac;
 429         size_t hmac_size;
 430 #endif /* HAVE_SSL */
 431
 432         k = ldns_key_new();
 433
 434         d = LDNS_XMALLOC(char, LDNS_MAX_LINELEN);
 435         if (!k || !d) {
 436                 ldns_key_free(k);
 437                 LDNS_FREE(d);
 438                 return LDNS_STATUS_MEM_ERR;
 439         }
 440
 441         alg = 0;
 442
 443         /* the file is highly structured. Do this in sequence */
 444         /* RSA:
 445          * Private-key-format: v1.x.
 446          * Algorithm: 1 (RSA)
 447
 448          */
 449         /* get the key format version number */
 450         if (ldns_fget_keyword_data_l(fp, "Private-key-format", ": ", d, "\n",
 451                                 LDNS_MAX_LINELEN, line_nr) == -1) {
 452                 /* no version information */
 453                 ldns_key_free(k);
 454                 LDNS_FREE(d);
 455                 return LDNS_STATUS_SYNTAX_ERR;
 456         }
 457         if (strncmp(d, "v1.", 3) != 0) {
 458                 ldns_key_free(k);
 459                 LDNS_FREE(d);
 460                 return LDNS_STATUS_SYNTAX_VERSION_ERR;
 461         }
 462
 463         /* get the algorithm type, our file function strip ( ) so there are
 464          * not in the return string! */
 465         if (ldns_fget_keyword_data_l(fp, "Algorithm", ": ", d, "\n",
 466                                 LDNS_MAX_LINELEN, line_nr) == -1) {
 467                 /* no alg information */
 468                 ldns_key_free(k);
 469                 LDNS_FREE(d);
 470                 return LDNS_STATUS_SYNTAX_ALG_ERR;
 471         }
 472
 473         if (strncmp(d, "1 RSA", 2) == 0) {
 474                 alg = LDNS_SIGN_RSAMD5;
 475         }
 476         if (strncmp(d, "2 DH", 2) == 0) {
 477                 alg = (ldns_signing_algorithm)LDNS_DH;
 478         }
 479         if (strncmp(d, "3 DSA", 2) == 0) {
 480 #ifdef USE_DSA
 481                 alg = LDNS_SIGN_DSA;
 482 #else
 483 # ifdef STDERR_MSGS
 484                 fprintf(stderr, "Warning: DSA not compiled into this ");
 485                 fprintf(stderr, "version of ldns\n");
 486 # endif
 487 #endif
 488         }
 489         if (strncmp(d, "4 ECC", 2) == 0) {
 490                 alg = (ldns_signing_algorithm)LDNS_ECC;
 491         }
 492         if (strncmp(d, "5 RSASHA1", 2) == 0) {
 493                 alg = LDNS_SIGN_RSASHA1;
 494         }
 495         if (strncmp(d, "6 DSA", 2) == 0) {
 496 #ifdef USE_DSA
 497                 alg = LDNS_SIGN_DSA_NSEC3;
 498 #else
 499 # ifdef STDERR_MSGS
 500                 fprintf(stderr, "Warning: DSA not compiled into this ");
 501                 fprintf(stderr, "version of ldns\n");
 502 # endif
 503 #endif
 504         }
 505         if (strncmp(d, "7 RSASHA1", 2) == 0) {
 506                 alg = LDNS_SIGN_RSASHA1_NSEC3;
 507         }
 508
 509         if (strncmp(d, "8 RSASHA256", 2) == 0) {
 510 #ifdef USE_SHA2
 511                 alg = LDNS_SIGN_RSASHA256;
 512 #else
 513 # ifdef STDERR_MSGS
 514                 fprintf(stderr, "Warning: SHA256 not compiled into this ");
 515                 fprintf(stderr, "version of ldns\n");
 516 # endif
 517 #endif
 518         }
 519         if (strncmp(d, "10 RSASHA512", 3) == 0) {
 520 #ifdef USE_SHA2
 521                 alg = LDNS_SIGN_RSASHA512;
 522 #else
 523 # ifdef STDERR_MSGS
 524                 fprintf(stderr, "Warning: SHA512 not compiled into this ");
 525                 fprintf(stderr, "version of ldns\n");
 526 # endif
 527 #endif
 528         }
 529         if (strncmp(d, "12 ECC-GOST", 3) == 0) {
 530 #ifdef USE_GOST
 531                 alg = LDNS_SIGN_ECC_GOST;
 532 #else
 533 # ifdef STDERR_MSGS
 534                 fprintf(stderr, "Warning: ECC-GOST not compiled into this ");
 535                 fprintf(stderr, "version of ldns, use --enable-gost\n");
 536 # endif
 537 #endif
 538         }
 539         if (strncmp(d, "13 ECDSAP256SHA256", 3) == 0) {
 540 #ifdef USE_ECDSA
 541                 alg = LDNS_SIGN_ECDSAP256SHA256;
 542 #else
 543 # ifdef STDERR_MSGS
 544                 fprintf(stderr, "Warning: ECDSA not compiled into this ");
 545                 fprintf(stderr, "version of ldns, use --enable-ecdsa\n");
 546 # endif
 547 #endif
 548         }
 549         if (strncmp(d, "14 ECDSAP384SHA384", 3) == 0) {
 550 #ifdef USE_ECDSA
 551                 alg = LDNS_SIGN_ECDSAP384SHA384;
 552 #else
 553 # ifdef STDERR_MSGS
 554                 fprintf(stderr, "Warning: ECDSA not compiled into this ");
 555                 fprintf(stderr, "version of ldns, use --enable-ecdsa\n");
 556 # endif
 557 #endif
 558         }
 559         if (strncmp(d, "15 ED25519", 3) == 0) {
 560 #ifdef USE_ED25519
 561                 alg = LDNS_SIGN_ED25519;
 562 #else
 563 # ifdef STDERR_MSGS
 564                 fprintf(stderr, "Warning: ED25519 not compiled into this ");
 565                 fprintf(stderr, "version of ldns, use --enable-ed25519\n");
 566 # endif
 567 #endif
 568         }
 569         if (strncmp(d, "16 ED448", 3) == 0) {
 570 #ifdef USE_ED448
 571                 alg = LDNS_SIGN_ED448;
 572 #else
 573 # ifdef STDERR_MSGS
 574                 fprintf(stderr, "Warning: ED448 not compiled into this ");
 575                 fprintf(stderr, "version of ldns, use --enable-ed448\n");
 576 # endif
 577 #endif
 578         }
 579         if (strncmp(d, "157 HMAC-MD5", 4) == 0) {
 580                 alg = LDNS_SIGN_HMACMD5;
 581         }
 582         if (strncmp(d, "158 HMAC-SHA1", 4) == 0) {
 583                 alg = LDNS_SIGN_HMACSHA1;
 584         }
 585         if (strncmp(d, "159 HMAC-SHA256", 4) == 0) {
 586                 alg = LDNS_SIGN_HMACSHA256;
 587         }
 588         /* For compatibility with dnssec-keygen */
 589         if (strncmp(d, "161 ", 4) == 0) {
 590                 alg = LDNS_SIGN_HMACSHA1;
 591         }
 592         if (strncmp(d, "162 HMAC-SHA224", 4) == 0) {
 593                 alg = LDNS_SIGN_HMACSHA224;
 594         }
 595         /* For compatibility with dnssec-keygen */
 596         if (strncmp(d, "163 ", 4) == 0) {
 597                 alg = LDNS_SIGN_HMACSHA256;
 598         }
 599         if (strncmp(d, "164 HMAC-SHA384", 4) == 0) {
 600                 alg = LDNS_SIGN_HMACSHA384;
 601         }
 602         if (strncmp(d, "165 HMAC-SHA512", 4) == 0) {
 603                 alg = LDNS_SIGN_HMACSHA512;
 604         }
 605         LDNS_FREE(d);
 606
 607         switch(alg) {
 608                 case LDNS_SIGN_RSAMD5:
 609                 case LDNS_SIGN_RSASHA1:
 610                 case LDNS_SIGN_RSASHA1_NSEC3:
 611 #ifdef USE_SHA2
 612                 case LDNS_SIGN_RSASHA256:
 613                 case LDNS_SIGN_RSASHA512:
 614 #endif
 615                         ldns_key_set_algorithm(k, alg);
 616 #ifdef HAVE_SSL
 617                         rsa = ldns_key_new_frm_fp_rsa_l(fp, line_nr);
 618                         if (!rsa) {
 619                                 ldns_key_free(k);
 620                                 return LDNS_STATUS_ERR;
 621                         }
 622                         ldns_key_assign_rsa_key(k, rsa);
 623 #endif /* HAVE_SSL */
 624                         break;
 625 #ifdef USE_DSA
 626                 case LDNS_SIGN_DSA:
 627                 case LDNS_SIGN_DSA_NSEC3:
 628                         ldns_key_set_algorithm(k, alg);
 629 #ifdef HAVE_SSL
 630                         dsa = ldns_key_new_frm_fp_dsa_l(fp, line_nr);
 631                         if (!dsa) {
 632                                 ldns_key_free(k);
 633                                 return LDNS_STATUS_ERR;
 634                         }
 635                         ldns_key_assign_dsa_key(k, dsa);
 636 #endif /* HAVE_SSL */
 637                         break;
 638 #endif /* USE_DSA */
 639                 case LDNS_SIGN_HMACMD5:
 640                 case LDNS_SIGN_HMACSHA1:
 641                 case LDNS_SIGN_HMACSHA224:
 642                 case LDNS_SIGN_HMACSHA256:
 643                 case LDNS_SIGN_HMACSHA384:
 644                 case LDNS_SIGN_HMACSHA512:
 645                         ldns_key_set_algorithm(k, alg);
 646 #ifdef HAVE_SSL
 647                         hmac = ldns_key_new_frm_fp_hmac_l(fp, line_nr, &hmac_size);
 648                         if (!hmac) {
 649                                 ldns_key_free(k);
 650                                 return LDNS_STATUS_ERR;
 651                         }
 652                         ldns_key_set_hmac_size(k, hmac_size);
 653                         ldns_key_set_hmac_key(k, hmac);
 654 #endif /* HAVE_SSL */
 655                         break;
 656                 case LDNS_SIGN_ECC_GOST:
 657                         ldns_key_set_algorithm(k, alg);
 658 #if defined(HAVE_SSL) && defined(USE_GOST)
 659                         if(!ldns_key_EVP_load_gost_id()) {
 660                                 ldns_key_free(k);
 661                                 return LDNS_STATUS_CRYPTO_ALGO_NOT_IMPL;
 662                         }
 663                         ldns_key_set_evp_key(k,
 664                                 ldns_key_new_frm_fp_gost_l(fp, line_nr));
 665 #ifndef S_SPLINT_S
 666                         if(!k->_key.key) {
 667                                 ldns_key_free(k);
 668                                 return LDNS_STATUS_ERR;
 669                         }
 670 #endif /* splint */
 671 #endif
 672                         break;
 673 #ifdef USE_ECDSA
 674                case LDNS_SIGN_ECDSAP256SHA256:
 675                case LDNS_SIGN_ECDSAP384SHA384:
 676                         ldns_key_set_algorithm(k, alg);
 677                         ldns_key_set_evp_key(k,
 678                                 ldns_key_new_frm_fp_ecdsa_l(fp, (ldns_algorithm)alg, line_nr));
 679 #ifndef S_SPLINT_S
 680                         if(!k->_key.key) {
 681                                 ldns_key_free(k);
 682                                 return LDNS_STATUS_ERR;
 683                         }
 684 #endif /* splint */
 685                         break;
 686 #endif
 687 #ifdef USE_ED25519
 688                 case LDNS_SIGN_ED25519:
 689                         ldns_key_set_algorithm(k, alg);
 690                         ldns_key_set_evp_key(k,
 691                                 ldns_key_new_frm_fp_ed25519_l(fp, line_nr));
 692 #ifndef S_SPLINT_S
 693                         if(!k->_key.key) {
 694                                 ldns_key_free(k);
 695                                 return LDNS_STATUS_ERR;
 696                         }
 697 #endif /* splint */
 698                         break;
 699 #endif
 700 #ifdef USE_ED448
 701                 case LDNS_SIGN_ED448:
 702                         ldns_key_set_algorithm(k, alg);
 703                         ldns_key_set_evp_key(k,
 704                                 ldns_key_new_frm_fp_ed448_l(fp, line_nr));
 705 #ifndef S_SPLINT_S
 706                         if(!k->_key.key) {
 707                                 ldns_key_free(k);
 708                                 return LDNS_STATUS_ERR;
 709                         }
 710 #endif /* splint */
 711                         break;
 712 #endif
 713                 default:
 714                         ldns_key_free(k);
 715                         return LDNS_STATUS_SYNTAX_ALG_ERR;
 716         }
 717         key_rr = ldns_key2rr(k);
 718         ldns_key_set_keytag(k, ldns_calc_keytag(key_rr));
 719         ldns_rr_free(key_rr);
 720
 721         if (key) {
 722                 *key = k;
 723                 return LDNS_STATUS_OK;
 724         }
 725         ldns_key_free(k);
 726         return LDNS_STATUS_ERR;
 727 }
 728
 729 #ifdef HAVE_SSL
 730 RSA *
 731 ldns_key_new_frm_fp_rsa(FILE *f)
 732 {
 733         return ldns_key_new_frm_fp_rsa_l(f, NULL);
 734 }
 735
 736 RSA *
 737 ldns_key_new_frm_fp_rsa_l(FILE *f, int *line_nr)
 738 {
 739         /* we parse
 740          * Modulus:
 741          * PublicExponent:
 742          * PrivateExponent:
 743          * Prime1:
 744          * Prime2:
 745          * Exponent1:
 746          * Exponent2:
 747          * Coefficient:
 748          *
 749          * man 3 RSA:
 750          *
 751          * struct
 752          *     {
 753          *     BIGNUM *n;              // public modulus
 754          *     BIGNUM *e;              // public exponent
 755          *     BIGNUM *d;              // private exponent
 756          *     BIGNUM *p;              // secret prime factor
 757          *     BIGNUM *q;              // secret prime factor
 758          *     BIGNUM *dmp1;           // d mod (p-1)
 759          *     BIGNUM *dmq1;           // d mod (q-1)
 760          *     BIGNUM *iqmp;           // q^-1 mod p
 761          *     // ...
 762          *
 763          */
 764         char *b;
 765         RSA *rsa;
 766         uint8_t *buf;
 767         int i;
 768         BIGNUM *n=NULL, *e=NULL, *d=NULL, *p=NULL, *q=NULL,
 769                 *dmp1=NULL, *dmq1=NULL, *iqmp=NULL;
 770
 771         b = LDNS_XMALLOC(char, LDNS_MAX_LINELEN);
 772         buf = LDNS_XMALLOC(uint8_t, LDNS_MAX_LINELEN);
 773         rsa = RSA_new();
 774         if (!b || !rsa || !buf) {
 775                 goto error;
 776         }
 777
 778         /* I could use functions again, but that seems an overkill,
 779          * although this also looks tedious
 780          */
 781
 782         /* Modules, rsa->n */
 783         if (ldns_fget_keyword_data_l(f, "Modulus", ": ", b, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
 784                 goto error;
 785         }
 786         i = ldns_b64_pton((const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
 787 #ifndef S_SPLINT_S
 788         n = BN_bin2bn((const char unsigned*)buf, i, NULL);
 789         if (!n) {
 790                 goto error;
 791         }
 792
 793         /* PublicExponent, rsa->e */
 794         if (ldns_fget_keyword_data_l(f, "PublicExponent", ": ", b, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
 795                 goto error;
 796         }
 797         i = ldns_b64_pton((const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
 798         e = BN_bin2bn((const char unsigned*)buf, i, NULL);
 799         if (!e) {
 800                 goto error;
 801         }
 802
 803         /* PrivateExponent, rsa->d */
 804         if (ldns_fget_keyword_data_l(f, "PrivateExponent", ": ", b, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
 805                 goto error;
 806         }
 807         i = ldns_b64_pton((const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
 808         d = BN_bin2bn((const char unsigned*)buf, i, NULL);
 809         if (!d) {
 810                 goto error;
 811         }
 812
 813         /* Prime1, rsa->p */
 814         if (ldns_fget_keyword_data_l(f, "Prime1", ": ", b, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
 815                 goto error;
 816         }
 817         i = ldns_b64_pton((const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
 818         p = BN_bin2bn((const char unsigned*)buf, i, NULL);
 819         if (!p) {
 820                 goto error;
 821         }
 822
 823         /* Prime2, rsa->q */
 824         if (ldns_fget_keyword_data_l(f, "Prime2", ": ", b, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
 825                 goto error;
 826         }
 827         i = ldns_b64_pton((const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
 828         q = BN_bin2bn((const char unsigned*)buf, i, NULL);
 829         if (!q) {
 830                 goto error;
 831         }
 832
 833         /* Exponent1, rsa->dmp1 */
 834         if (ldns_fget_keyword_data_l(f, "Exponent1", ": ", b, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
 835                 goto error;
 836         }
 837         i = ldns_b64_pton((const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
 838         dmp1 = BN_bin2bn((const char unsigned*)buf, i, NULL);
 839         if (!dmp1) {
 840                 goto error;
 841         }
 842
 843         /* Exponent2, rsa->dmq1 */
 844         if (ldns_fget_keyword_data_l(f, "Exponent2", ": ", b, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
 845                 goto error;
 846         }
 847         i = ldns_b64_pton((const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
 848         dmq1 = BN_bin2bn((const char unsigned*)buf, i, NULL);
 849         if (!dmq1) {
 850                 goto error;
 851         }
 852
 853         /* Coefficient, rsa->iqmp */
 854         if (ldns_fget_keyword_data_l(f, "Coefficient", ": ", b, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
 855                 goto error;
 856         }
 857         i = ldns_b64_pton((const char*)b, buf, ldns_b64_ntop_calculate_size(strlen(b)));
 858         iqmp = BN_bin2bn((const char unsigned*)buf, i, NULL);
 859         if (!iqmp) {
 860                 goto error;
 861         }
 862 #endif /* splint */
 863
 864 #if OPENSSL_VERSION_NUMBER < 0x10100000 || (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x20700000)
 865 # ifndef S_SPLINT_S
 866         rsa->n = n;
 867         rsa->e = e;
 868         rsa->d = d;
 869         rsa->p = p;
 870         rsa->q = q;
 871         rsa->dmp1 = dmp1;
 872         rsa->dmq1 = dmq1;
 873         rsa->iqmp = iqmp;
 874 # endif
 875 #else
 876         if(!RSA_set0_key(rsa, n, e, d))
 877                 goto error;
 878         n = NULL;
 879         e = NULL;
 880         d = NULL;
 881         if(!RSA_set0_factors(rsa, p, q))
 882                 goto error;
 883         p = NULL;
 884         q = NULL;
 885         if(!RSA_set0_crt_params(rsa, dmp1, dmq1, iqmp))
 886                 goto error;
 887 #endif
 888
 889         LDNS_FREE(buf);
 890         LDNS_FREE(b);
 891         return rsa;
 892
 893 error:
 894         RSA_free(rsa);
 895         LDNS_FREE(b);
 896         LDNS_FREE(buf);
 897         BN_free(n);
 898         BN_free(e);
 899         BN_free(d);
 900         BN_free(p);
 901         BN_free(q);
 902         BN_free(dmp1);
 903         BN_free(dmq1);
 904         BN_free(iqmp);
 905         return NULL;
 906 }
 907
 908 #ifdef USE_DSA
 909 DSA *
 910 ldns_key_new_frm_fp_dsa(FILE *f)
 911 {
 912         return ldns_key_new_frm_fp_dsa_l(f, NULL);
 913 }
 914
 915 DSA *
 916 ldns_key_new_frm_fp_dsa_l(FILE *f, ATTR_UNUSED(int *line_nr))
 917 {
 918         int i;
 919         char *d;
 920         DSA *dsa;
 921         uint8_t *buf;
 922         BIGNUM *p=NULL, *q=NULL, *g=NULL, *priv_key=NULL, *pub_key=NULL;
 923
 924         d = LDNS_XMALLOC(char, LDNS_MAX_LINELEN);
 925         buf = LDNS_XMALLOC(uint8_t, LDNS_MAX_LINELEN);
 926         dsa = DSA_new();
 927         if (!d || !dsa || !buf) {
 928                 goto error;
 929         }
 930
 931         /* the line parser removes the () from the input... */
 932
 933         /* Prime, dsa->p */
 934         if (ldns_fget_keyword_data_l(f, "Primep", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
 935                 goto error;
 936         }
 937         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
 938 #ifndef S_SPLINT_S
 939         p = BN_bin2bn((const char unsigned*)buf, i, NULL);
 940         if (!p) {
 941                 goto error;
 942         }
 943
 944         /* Subprime, dsa->q */
 945         if (ldns_fget_keyword_data_l(f, "Subprimeq", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
 946                 goto error;
 947         }
 948         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
 949         q = BN_bin2bn((const char unsigned*)buf, i, NULL);
 950         if (!q) {
 951                 goto error;
 952         }
 953
 954         /* Base, dsa->g */
 955         if (ldns_fget_keyword_data_l(f, "Baseg", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
 956                 goto error;
 957         }
 958         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
 959         g = BN_bin2bn((const char unsigned*)buf, i, NULL);
 960         if (!g) {
 961                 goto error;
 962         }
 963
 964         /* Private key, dsa->priv_key */
 965         if (ldns_fget_keyword_data_l(f, "Private_valuex", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
 966                 goto error;
 967         }
 968         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
 969         priv_key = BN_bin2bn((const char unsigned*)buf, i, NULL);
 970         if (!priv_key) {
 971                 goto error;
 972         }
 973
 974         /* Public key, dsa->priv_key */
 975         if (ldns_fget_keyword_data_l(f, "Public_valuey", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
 976                 goto error;
 977         }
 978         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
 979         pub_key = BN_bin2bn((const char unsigned*)buf, i, NULL);
 980         if (!pub_key) {
 981                 goto error;
 982         }
 983 #endif /* splint */
 984
 985 #if OPENSSL_VERSION_NUMBER < 0x10100000 || (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x20700000)
 986 # ifndef S_SPLINT_S
 987         dsa->p = p;
 988         dsa->q = q;
 989         dsa->g = g;
 990         dsa->priv_key = priv_key;
 991         dsa->pub_key = pub_key;
 992 # endif
 993 #else
 994         if(!DSA_set0_pqg(dsa, p, q, g))
 995                 goto error;
 996         p = NULL;
 997         q = NULL;
 998         g = NULL;
 999         if(!DSA_set0_key(dsa, pub_key, priv_key))
1000                 goto error;
1001 #endif
1002
1003         LDNS_FREE(buf);
1004         LDNS_FREE(d);
1005
1006         return dsa;
1007
1008 error:
1009         LDNS_FREE(d);
1010         LDNS_FREE(buf);
1011         DSA_free(dsa);
1012         BN_free(p);
1013         BN_free(q);
1014         BN_free(g);
1015         BN_free(priv_key);
1016         BN_free(pub_key);
1017         return NULL;
1018 }
1019 #endif /* USE_DSA */
1020
1021 unsigned char *
1022 ldns_key_new_frm_fp_hmac(FILE *f, size_t *hmac_size)
1023 {
1024         return ldns_key_new_frm_fp_hmac_l(f, NULL, hmac_size);
1025 }
1026
1027 unsigned char *
1028 ldns_key_new_frm_fp_hmac_l( FILE *f
1029                           , ATTR_UNUSED(int *line_nr)
1030                           , size_t *hmac_size
1031                           )
1032 {
1033         size_t bufsz;
1034         char d[LDNS_MAX_LINELEN];
1035         unsigned char *buf = NULL;
1036
1037         *hmac_size = ldns_fget_keyword_data_l(f, "Key", ": ", d, "\n",
1038                                               LDNS_MAX_LINELEN, line_nr) == -1
1039                    ? 0
1040                    : (buf = LDNS_XMALLOC( unsigned char, (bufsz =
1041                             ldns_b64_ntop_calculate_size(strlen(d))))) == NULL
1042                    ? 0
1043                    : (size_t) ldns_b64_pton((const char*)d, buf, bufsz);
1044         return buf;
1045 }
1046 #endif /* HAVE_SSL */
1047
1048 #ifdef USE_GOST
1049 static EVP_PKEY*
1050 ldns_gen_gost_key(void)
1051 {
1052         EVP_PKEY_CTX* ctx;
1053         EVP_PKEY* p = NULL;
1054         int gost_id = ldns_key_EVP_load_gost_id();
1055         if(!gost_id)
1056                 return NULL;
1057         ctx = EVP_PKEY_CTX_new_id(gost_id, NULL);
1058         if(!ctx) {
1059                 /* the id should be available now */
1060                 return NULL;
1061         }
1062         if(EVP_PKEY_CTX_ctrl_str(ctx, "paramset", "A") <= 0) {
1063                 /* cannot set paramset */
1064                 EVP_PKEY_CTX_free(ctx);
1065                 return NULL;
1066         }
1067
1068         if(EVP_PKEY_keygen_init(ctx) <= 0) {
1069                 EVP_PKEY_CTX_free(ctx);
1070                 return NULL;
1071         }
1072         if(EVP_PKEY_keygen(ctx, &p) <= 0) {
1073                 EVP_PKEY_free(p);
1074                 EVP_PKEY_CTX_free(ctx);
1075                 return NULL;
1076         }
1077         EVP_PKEY_CTX_free(ctx);
1078         return p;
1079 }
1080 #endif
1081
1082 ldns_key *
1083 ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size)
1084 {
1085         ldns_key *k;
1086 #ifdef HAVE_SSL
1087 #ifdef USE_DSA
1088         DSA *d;
1089 #endif /* USE_DSA */
1090 #  ifdef USE_ECDSA
1091         EC_KEY *ec = NULL;
1092 #  endif
1093 #  ifdef HAVE_EVP_PKEY_KEYGEN
1094         EVP_PKEY_CTX *ctx;
1095 #  else
1096         RSA *r;
1097 #  endif
1098 #else
1099         int i;
1100         uint16_t offset = 0;
1101 #endif
1102         unsigned char *hmac;
1103
1104         k = ldns_key_new();
1105         if (!k) {
1106                 return NULL;
1107         }
1108         switch(alg) {
1109                 case LDNS_SIGN_RSAMD5:
1110                 case LDNS_SIGN_RSASHA1:
1111                 case LDNS_SIGN_RSASHA1_NSEC3:
1112                 case LDNS_SIGN_RSASHA256:
1113                 case LDNS_SIGN_RSASHA512:
1114 #ifdef HAVE_SSL
1115 #ifdef HAVE_EVP_PKEY_KEYGEN
1116                         ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
1117                         if(!ctx) {
1118                                 ldns_key_free(k);
1119                                 return NULL;
1120                         }
1121                         if(EVP_PKEY_keygen_init(ctx) <= 0) {
1122                                 ldns_key_free(k);
1123                                 EVP_PKEY_CTX_free(ctx);
1124                                 return NULL;
1125                         }
1126                         if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, size) <= 0) {
1127                                 ldns_key_free(k);
1128                                 EVP_PKEY_CTX_free(ctx);
1129                                 return NULL;
1130                         }
1131 #ifndef S_SPLINT_S
1132                         if (EVP_PKEY_keygen(ctx, &k->_key.key) <= 0) {
1133                                 ldns_key_free(k);
1134                                 EVP_PKEY_CTX_free(ctx);
1135                                 return NULL;
1136                         }
1137 #endif
1138                         EVP_PKEY_CTX_free(ctx);
1139 #else /* HAVE_EVP_PKEY_KEYGEN */
1140                         r = RSA_generate_key((int)size, RSA_F4, NULL, NULL);
1141                         if(!r) {
1142                                 ldns_key_free(k);
1143                                 return NULL;
1144                         }
1145                         if (RSA_check_key(r) != 1) {
1146                                 ldns_key_free(k);
1147                                 return NULL;
1148                         }
1149                         ldns_key_set_rsa_key(k, r);
1150                         RSA_free(r);
1151 #endif /* HAVE_EVP_PKEY_KEYGEN */
1152 #endif /* HAVE_SSL */
1153                         break;
1154 #ifdef USE_DSA
1155                 case LDNS_SIGN_DSA:
1156                 case LDNS_SIGN_DSA_NSEC3:
1157 #ifdef HAVE_SSL
1158 # if OPENSSL_VERSION_NUMBER < 0x00908000L
1159                         d = DSA_generate_parameters((int)size, NULL, 0, NULL, NULL, NULL, NULL);
1160                         if (!d) {
1161                                 ldns_key_free(k);
1162                                 return NULL;
1163                         }
1164
1165 # else
1166                         if (! (d = DSA_new())) {
1167                                 ldns_key_free(k);
1168                                 return NULL;
1169                         }
1170                         if (! DSA_generate_parameters_ex(d, (int)size, NULL, 0, NULL, NULL, NULL)) {
1171                                 DSA_free(d);
1172                                 ldns_key_free(k);
1173                                 return NULL;
1174                         }
1175 # endif
1176                         if (DSA_generate_key(d) != 1) {
1177                                 ldns_key_free(k);
1178                                 return NULL;
1179                         }
1180                         ldns_key_set_dsa_key(k, d);
1181                         DSA_free(d);
1182 #endif /* HAVE_SSL */
1183 #endif /* USE_DSA */
1184                         break;
1185                 case LDNS_SIGN_HMACMD5:
1186                 case LDNS_SIGN_HMACSHA1:
1187                 case LDNS_SIGN_HMACSHA224:
1188                 case LDNS_SIGN_HMACSHA256:
1189                 case LDNS_SIGN_HMACSHA384:
1190                 case LDNS_SIGN_HMACSHA512:
1191 #ifdef HAVE_SSL
1192 #ifndef S_SPLINT_S
1193                         k->_key.key = NULL;
1194 #endif /* splint */
1195 #endif /* HAVE_SSL */
1196                         size = size / 8;
1197                         ldns_key_set_hmac_size(k, size);
1198
1199                         hmac = LDNS_XMALLOC(unsigned char, size);
1200                         if(!hmac) {
1201                                 ldns_key_free(k);
1202                                 return NULL;
1203                         }
1204 #ifdef HAVE_SSL
1205                         if (RAND_bytes(hmac, (int) size) != 1) {
1206                                 LDNS_FREE(hmac);
1207                                 ldns_key_free(k);
1208                                 return NULL;
1209                         }
1210 #else
1211                         while (offset + sizeof(i) < size) {
1212                           i = random();
1213                           memcpy(&hmac[offset], &i, sizeof(i));
1214                           offset += sizeof(i);
1215                         }
1216                         if (offset < size) {
1217                           i = random();
1218                           memcpy(&hmac[offset], &i, size - offset);
1219                         }
1220 #endif /* HAVE_SSL */
1221                         ldns_key_set_hmac_key(k, hmac);
1222
1223                         ldns_key_set_flags(k, 0);
1224                         break;
1225                 case LDNS_SIGN_ECC_GOST:
1226 #if defined(HAVE_SSL) && defined(USE_GOST)
1227                         ldns_key_set_evp_key(k, ldns_gen_gost_key());
1228 #ifndef S_SPLINT_S
1229                         if(!k->_key.key) {
1230                                 ldns_key_free(k);
1231                                 return NULL;
1232                         }
1233 #endif /* splint */
1234 #else
1235                         ldns_key_free(k);
1236                         return NULL;
1237 #endif /* HAVE_SSL and USE_GOST */
1238                         break;
1239                 case LDNS_SIGN_ECDSAP256SHA256:
1240                 case LDNS_SIGN_ECDSAP384SHA384:
1241 #ifdef USE_ECDSA
1242                         if(alg == LDNS_SIGN_ECDSAP256SHA256)
1243                                 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
1244                         else if(alg == LDNS_SIGN_ECDSAP384SHA384)
1245                                 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
1246                         if(!ec) {
1247                                 ldns_key_free(k);
1248                                 return NULL;
1249                         }
1250                         if(!EC_KEY_generate_key(ec)) {
1251                                 ldns_key_free(k);
1252                                 EC_KEY_free(ec);
1253                                 return NULL;
1254                         }
1255 #ifndef S_SPLINT_S
1256                         k->_key.key = EVP_PKEY_new();
1257                         if(!k->_key.key) {
1258                                 ldns_key_free(k);
1259                                 EC_KEY_free(ec);
1260                                 return NULL;
1261                         }
1262                         if (!EVP_PKEY_assign_EC_KEY(k->_key.key, ec)) {
1263                                 ldns_key_free(k);
1264                                 EC_KEY_free(ec);
1265                                 return NULL;
1266                         }
1267 #endif /* splint */
1268 #else
1269                         ldns_key_free(k);
1270                         return NULL;
1271 #endif /* ECDSA */
1272                         break;
1273 #ifdef USE_ED25519
1274                 case LDNS_SIGN_ED25519:
1275 #ifdef HAVE_EVP_PKEY_KEYGEN
1276                         ctx = EVP_PKEY_CTX_new_id(NID_ED25519, NULL);
1277                         if(!ctx) {
1278                                 ldns_key_free(k);
1279                                 return NULL;
1280                         }
1281                         if(EVP_PKEY_keygen_init(ctx) <= 0) {
1282                                 ldns_key_free(k);
1283                                 EVP_PKEY_CTX_free(ctx);
1284                                 return NULL;
1285                         }
1286                         if (EVP_PKEY_keygen(ctx, &k->_key.key) <= 0) {
1287                                 ldns_key_free(k);
1288                                 EVP_PKEY_CTX_free(ctx);
1289                                 return NULL;
1290                         }
1291                         EVP_PKEY_CTX_free(ctx);
1292 #endif
1293                         break;
1294 #endif /* ED25519 */
1295 #ifdef USE_ED448
1296                 case LDNS_SIGN_ED448:
1297 #ifdef HAVE_EVP_PKEY_KEYGEN
1298                         ctx = EVP_PKEY_CTX_new_id(NID_ED448, NULL);
1299                         if(!ctx) {
1300                                 ldns_key_free(k);
1301                                 return NULL;
1302                         }
1303                         if(EVP_PKEY_keygen_init(ctx) <= 0) {
1304                                 ldns_key_free(k);
1305                                 EVP_PKEY_CTX_free(ctx);
1306                                 return NULL;
1307                         }
1308                         if (EVP_PKEY_keygen(ctx, &k->_key.key) <= 0) {
1309                                 ldns_key_free(k);
1310                                 EVP_PKEY_CTX_free(ctx);
1311                                 return NULL;
1312                         }
1313                         EVP_PKEY_CTX_free(ctx);
1314 #endif
1315                         break;
1316 #endif /* ED448 */
1317         }
1318         ldns_key_set_algorithm(k, alg);
1319         return k;
1320 }
1321
1322 void
1323 ldns_key_print(FILE *output, const ldns_key *k)
1324 {
1325         char *str = ldns_key2str(k);
1326         if (str) {
1327                 fprintf(output, "%s", str);
1328         } else {
1329                 fprintf(output, "Unable to convert private key to string\n");
1330         }
1331         LDNS_FREE(str);
1332 }
1333
1334
1335 void
1336 ldns_key_set_algorithm(ldns_key *k, ldns_signing_algorithm l)
1337 {
1338         k->_alg = l;
1339 }
1340
1341 void
1342 ldns_key_set_flags(ldns_key *k, uint16_t f)
1343 {
1344         k->_extra.dnssec.flags = f;
1345 }
1346
1347 #ifdef HAVE_SSL
1348 #ifndef S_SPLINT_S
1349 void
1350 ldns_key_set_evp_key(ldns_key *k, EVP_PKEY *e)
1351 {
1352         k->_key.key = e;
1353 }
1354
1355 void
1356 ldns_key_set_rsa_key(ldns_key *k, RSA *r)
1357 {
1358         EVP_PKEY *key = EVP_PKEY_new();
1359         EVP_PKEY_set1_RSA(key, r);
1360         k->_key.key = key;
1361 }
1362
1363 void
1364 ldns_key_set_dsa_key(ldns_key *k, DSA *d)
1365 {
1366 #ifdef USE_DSA
1367         EVP_PKEY *key = EVP_PKEY_new();
1368         EVP_PKEY_set1_DSA(key, d);
1369         k->_key.key  = key;
1370 #else
1371         (void)k; (void)d;
1372 #endif
1373 }
1374
1375 void
1376 ldns_key_assign_rsa_key(ldns_key *k, RSA *r)
1377 {
1378         EVP_PKEY *key = EVP_PKEY_new();
1379         EVP_PKEY_assign_RSA(key, r);
1380         k->_key.key = key;
1381 }
1382
1383 void
1384 ldns_key_assign_dsa_key(ldns_key *k, DSA *d)
1385 {
1386 #ifdef USE_DSA
1387         EVP_PKEY *key = EVP_PKEY_new();
1388         EVP_PKEY_assign_DSA(key, d);
1389         k->_key.key  = key;
1390 #else
1391         (void)k; (void)d;
1392 #endif
1393 }
1394 #endif /* splint */
1395 #endif /* HAVE_SSL */
1396
1397 void
1398 ldns_key_set_hmac_key(ldns_key *k, unsigned char *hmac)
1399 {
1400         k->_key.hmac.key = hmac;
1401 }
1402
1403 void
1404 ldns_key_set_hmac_size(ldns_key *k, size_t hmac_size)
1405 {
1406         k->_key.hmac.size = hmac_size;
1407 }
1408
1409 void
1410 ldns_key_set_external_key(ldns_key *k, void *external_key)
1411 {
1412         k->_key.external_key = external_key;
1413 }
1414
1415 void
1416 ldns_key_set_origttl(ldns_key *k, uint32_t t)
1417 {
1418         k->_extra.dnssec.orig_ttl = t;
1419 }
1420
1421 void
1422 ldns_key_set_inception(ldns_key *k, uint32_t i)
1423 {
1424         k->_extra.dnssec.inception = i;
1425 }
1426
1427 void
1428 ldns_key_set_expiration(ldns_key *k, uint32_t e)
1429 {
1430         k->_extra.dnssec.expiration = e;
1431 }
1432
1433 void
1434 ldns_key_set_pubkey_owner(ldns_key *k, ldns_rdf *r)
1435 {
1436         k->_pubkey_owner = r;
1437 }
1438
1439 void
1440 ldns_key_set_keytag(ldns_key *k, uint16_t tag)
1441 {
1442         k->_extra.dnssec.keytag = tag;
1443 }
1444
1445 /* read */
1446 size_t
1447 ldns_key_list_key_count(const ldns_key_list *key_list)
1448 {
1449         return key_list ? key_list->_key_count : 0;
1450 }
1451
1452 ldns_key *
1453 ldns_key_list_key(const ldns_key_list *key, size_t nr)
1454 {
1455         if (nr < ldns_key_list_key_count(key)) {
1456                 return key->_keys[nr];
1457         } else {
1458                 return NULL;
1459         }
1460 }
1461
1462 ldns_signing_algorithm
1463 ldns_key_algorithm(const ldns_key *k)
1464 {
1465         return k->_alg;
1466 }
1467
1468 void
1469 ldns_key_set_use(ldns_key *k, bool v)
1470 {
1471         if (k) {
1472                 k->_use = v;
1473         }
1474 }
1475
1476 bool
1477 ldns_key_use(const ldns_key *k)
1478 {
1479         if (k) {
1480                 return k->_use;
1481         }
1482         return false;
1483 }
1484
1485 #ifdef HAVE_SSL
1486 #ifndef S_SPLINT_S
1487 EVP_PKEY *
1488 ldns_key_evp_key(const ldns_key *k)
1489 {
1490         return k->_key.key;
1491 }
1492
1493 RSA *
1494 ldns_key_rsa_key(const ldns_key *k)
1495 {
1496         if (k->_key.key) {
1497                 return EVP_PKEY_get1_RSA(k->_key.key);
1498         } else {
1499                 return NULL;
1500         }
1501 }
1502
1503 DSA *
1504 ldns_key_dsa_key(const ldns_key *k)
1505 {
1506 #ifdef USE_DSA
1507         if (k->_key.key) {
1508                 return EVP_PKEY_get1_DSA(k->_key.key);
1509         } else {
1510                 return NULL;
1511         }
1512 #else
1513         (void)k;
1514         return NULL;
1515 #endif
1516 }
1517 #endif /* splint */
1518 #endif /* HAVE_SSL */
1519
1520 unsigned char *
1521 ldns_key_hmac_key(const ldns_key *k)
1522 {
1523         if (k->_key.hmac.key) {
1524                 return k->_key.hmac.key;
1525         } else {
1526                 return NULL;
1527         }
1528 }
1529
1530 size_t
1531 ldns_key_hmac_size(const ldns_key *k)
1532 {
1533         if (k->_key.hmac.size) {
1534                 return k->_key.hmac.size;
1535         } else {
1536                 return 0;
1537         }
1538 }
1539
1540 void *
1541 ldns_key_external_key(const ldns_key *k)
1542 {
1543         return k->_key.external_key;
1544 }
1545
1546 uint32_t
1547 ldns_key_origttl(const ldns_key *k)
1548 {
1549         return k->_extra.dnssec.orig_ttl;
1550 }
1551
1552 uint16_t
1553 ldns_key_flags(const ldns_key *k)
1554 {
1555         return k->_extra.dnssec.flags;
1556 }
1557
1558 uint32_t
1559 ldns_key_inception(const ldns_key *k)
1560 {
1561         return k->_extra.dnssec.inception;
1562 }
1563
1564 uint32_t
1565 ldns_key_expiration(const ldns_key *k)
1566 {
1567         return k->_extra.dnssec.expiration;
1568 }
1569
1570 uint16_t
1571 ldns_key_keytag(const ldns_key *k)
1572 {
1573         return k->_extra.dnssec.keytag;
1574 }
1575
1576 ldns_rdf *
1577 ldns_key_pubkey_owner(const ldns_key *k)
1578 {
1579         return k->_pubkey_owner;
1580 }
1581
1582 /* write */
1583 void
1584 ldns_key_list_set_use(ldns_key_list *keys, bool v)
1585 {
1586         size_t i;
1587
1588         for (i = 0; i < ldns_key_list_key_count(keys); i++) {
1589                 ldns_key_set_use(ldns_key_list_key(keys, i), v);
1590         }
1591 }
1592
1593 void
1594 ldns_key_list_set_key_count(ldns_key_list *key, size_t count)
1595 {
1596                 key->_key_count = count;
1597 }
1598
1599 bool
1600 ldns_key_list_push_key(ldns_key_list *key_list, ldns_key *key)
1601 {
1602         size_t key_count;
1603         ldns_key **keys;
1604
1605         key_count = ldns_key_list_key_count(key_list);
1606
1607         /* grow the array */
1608         keys = LDNS_XREALLOC(
1609                 key_list->_keys, ldns_key *, key_count + 1);
1610         if (!keys) {
1611                 return false;
1612         }
1613
1614         /* add the new member */
1615         key_list->_keys = keys;
1616         key_list->_keys[key_count] = key;
1617
1618         ldns_key_list_set_key_count(key_list, key_count + 1);
1619         return true;
1620 }
1621
1622 ldns_key *
1623 ldns_key_list_pop_key(ldns_key_list *key_list)
1624 {
1625         size_t key_count;
1626         ldns_key** a;
1627         ldns_key *pop;
1628
1629         if (!key_list) {
1630                 return NULL;
1631         }
1632
1633         key_count = ldns_key_list_key_count(key_list);
1634         if (key_count == 0) {
1635                 return NULL;
1636         }
1637
1638         pop = ldns_key_list_key(key_list, key_count);
1639
1640         /* shrink the array */
1641         a = LDNS_XREALLOC(key_list->_keys, ldns_key *, key_count - 1);
1642         if(a) {
1643                 key_list->_keys = a;
1644         }
1645
1646         ldns_key_list_set_key_count(key_list, key_count - 1);
1647
1648         return pop;
1649 }
1650
1651 #ifdef HAVE_SSL
1652 #ifndef S_SPLINT_S
1653 /* data pointer must be large enough (LDNS_MAX_KEYLEN) */
1654 static bool
1655 ldns_key_rsa2bin(unsigned char *data, RSA *k, uint16_t *size)
1656 {
1657         int i,j;
1658         const BIGNUM *n=NULL, *e=NULL;
1659
1660         if (!k) {
1661                 return false;
1662         }
1663 #if OPENSSL_VERSION_NUMBER < 0x10100000 || (defined(HAVE_LIBRESSL) && LIBRESSL_VERSION_NUMBER < 0x20700000)
1664         n = k->n;
1665         e = k->e;
1666 #else
1667         RSA_get0_key(k, &n, &e, NULL);
1668 #endif
1669
1670         if (BN_num_bytes(e) <= 256) {
1671                 /* normally only this path is executed (small factors are
1672                  * more common
1673                  */
1674                 data[0] = (unsigned char) BN_num_bytes(e);
1675                 i = BN_bn2bin(e, data + 1);
1676                 j = BN_bn2bin(n, data + i + 1);
1677                 *size = (uint16_t) i + j;
1678         } else if (BN_num_bytes(e) <= 65536) {
1679                 data[0] = 0;
1680                 /* BN_bn2bin does bigendian, _uint16 also */
1681                 ldns_write_uint16(data + 1, (uint16_t) BN_num_bytes(e));
1682
1683                 BN_bn2bin(e, data + 3);
1684                 BN_bn2bin(n, data + 4 + BN_num_bytes(e));
1685                 *size = (uint16_t) BN_num_bytes(n) + 6;
1686         } else {
1687                 return false;
1688         }
1689         return true;
1690 }
1691
1692 #ifdef USE_DSA
1693 /* data pointer must be large enough (LDNS_MAX_KEYLEN) */
1694 static bool
1695 ldns_key_dsa2bin(unsigned char *data, DSA *k, uint16_t *size)
1696 {
1697         uint8_t T;
1698         const BIGNUM *p, *q, *g;
1699         const BIGNUM *pub_key, *priv_key;
1700
1701         if (!k) {
1702                 return false;
1703         }
1704
1705         /* See RFC2536 */
1706 # ifdef HAVE_DSA_GET0_PQG
1707         DSA_get0_pqg(k, &p, &q, &g);
1708 # else
1709         p = k->p; q = k->q; g = k->g;
1710 # endif
1711 # ifdef HAVE_DSA_GET0_KEY
1712         DSA_get0_key(k, &pub_key, &priv_key);
1713 # else
1714         pub_key = k->pub_key; priv_key = k->priv_key;
1715 # endif
1716         (void)priv_key;
1717         *size = (uint16_t)BN_num_bytes(p);
1718         T = (*size - 64) / 8;
1719
1720         if (T > 8) {
1721 #ifdef STDERR_MSGS
1722                 fprintf(stderr, "DSA key with T > 8 (ie. > 1024 bits)");
1723                 fprintf(stderr, " not implemented\n");
1724 #endif
1725                 return false;
1726         }
1727
1728         /* size = 64 + (T * 8); */
1729         memset(data, 0, 21 + *size * 3);
1730         data[0] = (unsigned char)T;
1731         BN_bn2bin(q, data + 1 );                /* 20 octects */
1732         BN_bn2bin(p, data + 21 );               /* offset octects */
1733         BN_bn2bin(g, data + 21 + *size * 2 - BN_num_bytes(g));
1734         BN_bn2bin(pub_key,data + 21 + *size * 3 - BN_num_bytes(pub_key));
1735         *size = 21 + *size * 3;
1736         return true;
1737 }
1738 #endif /* USE_DSA */
1739
1740 #ifdef USE_GOST
1741 static bool
1742 ldns_key_gost2bin(unsigned char* data, EVP_PKEY* k, uint16_t* size)
1743 {
1744         int i;
1745         unsigned char* pp = NULL;
1746         if(i2d_PUBKEY(k, &pp) != 37 + 64) {
1747                 /* expect 37 byte(ASN header) and 64 byte(X and Y) */
1748                 free(pp);
1749                 return false;
1750         }
1751         /* omit ASN header */
1752         for(i=0; i<64; i++)
1753                 data[i] = pp[i+37];
1754         free(pp);
1755         *size = 64;
1756         return true;
1757 }
1758 #endif /* USE_GOST */
1759
1760 #ifdef USE_ED25519
1761 static bool
1762 ldns_key_ed255192bin(unsigned char* data, EVP_PKEY* k, uint16_t* size)
1763 {
1764         int i;
1765         unsigned char* pp = NULL;
1766         if(i2d_PUBKEY(k, &pp) != 12 + 32) {
1767                 /* expect 12 byte(ASN header) and 32 byte(pubkey) */
1768                 free(pp);
1769                 return false;
1770         }
1771         /* omit ASN header */
1772         for(i=0; i<32; i++)
1773                 data[i] = pp[i+12];
1774         free(pp);
1775         *size = 32;
1776         return true;
1777 }
1778 #endif /* USE_ED25519 */
1779
1780 #ifdef USE_ED448
1781 static bool
1782 ldns_key_ed4482bin(unsigned char* data, EVP_PKEY* k, uint16_t* size)
1783 {
1784         int i;
1785         unsigned char* pp = NULL;
1786         if(i2d_PUBKEY(k, &pp) != 12 + 57) {
1787                 /* expect 12 byte(ASN header) and 57 byte(pubkey) */
1788                 free(pp);
1789                 return false;
1790         }
1791         /* omit ASN header */
1792         for(i=0; i<57; i++)
1793                 data[i] = pp[i+12];
1794         free(pp);
1795         *size = 57;
1796         return true;
1797 }
1798 #endif /* USE_ED448 */
1799 #endif /* splint */
1800 #endif /* HAVE_SSL */
1801
1802 ldns_rr *
1803 ldns_key2rr(const ldns_key *k)
1804 {
1805         /* this function will convert a the keydata contained in
1806          * rsa/dsa pointers to a DNSKEY rr. It will fill in as
1807          * much as it can, but it does not know about key-flags
1808          * for instance
1809          */
1810         ldns_rr *pubkey;
1811         ldns_rdf *keybin;
1812         unsigned char *bin = NULL;
1813         uint16_t size = 0;
1814 #ifdef HAVE_SSL
1815         RSA *rsa = NULL;
1816 #ifdef USE_DSA
1817         DSA *dsa = NULL;
1818 #endif /* USE_DSA */
1819 #endif /* HAVE_SSL */
1820 #ifdef USE_ECDSA
1821         EC_KEY* ec;
1822 #endif
1823         int internal_data = 0;
1824
1825         if (!k) {
1826                 return NULL;
1827         }
1828         pubkey = ldns_rr_new();
1829
1830         switch (ldns_key_algorithm(k)) {
1831         case LDNS_SIGN_HMACMD5:
1832         case LDNS_SIGN_HMACSHA1:
1833         case LDNS_SIGN_HMACSHA224:
1834         case LDNS_SIGN_HMACSHA256:
1835         case LDNS_SIGN_HMACSHA384:
1836         case LDNS_SIGN_HMACSHA512:
1837                 ldns_rr_set_type(pubkey, LDNS_RR_TYPE_KEY);
1838                 break;
1839         default:
1840                 ldns_rr_set_type(pubkey, LDNS_RR_TYPE_DNSKEY);
1841                 break;
1842         }
1843         /* zero-th rdf - flags */
1844         ldns_rr_push_rdf(pubkey,
1845                         ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16,
1846                                 ldns_key_flags(k)));
1847         /* first - proto */
1848         ldns_rr_push_rdf(pubkey,
1849                         ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8, LDNS_DNSSEC_KEYPROTO));
1850
1851         if (ldns_key_pubkey_owner(k)) {
1852                 ldns_rr_set_owner(pubkey, ldns_rdf_clone(ldns_key_pubkey_owner(k)));
1853         }
1854
1855         /* third - da algorithm */
1856         switch(ldns_key_algorithm(k)) {
1857                 case LDNS_SIGN_RSAMD5:
1858                 case LDNS_SIGN_RSASHA1:
1859                 case LDNS_SIGN_RSASHA1_NSEC3:
1860                 case LDNS_SIGN_RSASHA256:
1861                 case LDNS_SIGN_RSASHA512:
1862                         ldns_rr_push_rdf(pubkey,
1863                                                   ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
1864 #ifdef HAVE_SSL
1865                         rsa =  ldns_key_rsa_key(k);
1866                         if (rsa) {
1867                                 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
1868                                 if (!bin) {
1869                                         ldns_rr_free(pubkey);
1870                                         return NULL;
1871                                 }
1872                                 if (!ldns_key_rsa2bin(bin, rsa, &size)) {
1873                                         LDNS_FREE(bin);
1874                                         ldns_rr_free(pubkey);
1875                                         return NULL;
1876                                 }
1877                                 RSA_free(rsa);
1878                                 internal_data = 1;
1879                         }
1880 #endif
1881                         size++;
1882                         break;
1883 #ifdef USE_DSA
1884                 case LDNS_SIGN_DSA:
1885                         ldns_rr_push_rdf(pubkey,
1886                                         ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, LDNS_DSA));
1887 #ifdef HAVE_SSL
1888                         dsa = ldns_key_dsa_key(k);
1889                         if (dsa) {
1890                                 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
1891                                 if (!bin) {
1892                                         ldns_rr_free(pubkey);
1893                                         return NULL;
1894                                 }
1895                                 if (!ldns_key_dsa2bin(bin, dsa, &size)) {
1896                                         LDNS_FREE(bin);
1897                                         ldns_rr_free(pubkey);
1898                                         return NULL;
1899                                 }
1900                                 DSA_free(dsa);
1901                                 internal_data = 1;
1902                         }
1903 #endif /* HAVE_SSL */
1904 #endif /* USE_DSA */
1905                         break;
1906 #ifdef USE_DSA
1907                 case LDNS_SIGN_DSA_NSEC3:
1908                         ldns_rr_push_rdf(pubkey,
1909                                         ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, LDNS_DSA_NSEC3));
1910 #ifdef HAVE_SSL
1911                         dsa = ldns_key_dsa_key(k);
1912                         if (dsa) {
1913                                 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
1914                                 if (!bin) {
1915                                         ldns_rr_free(pubkey);
1916                                         return NULL;
1917                                 }
1918                                 if (!ldns_key_dsa2bin(bin, dsa, &size)) {
1919                                         LDNS_FREE(bin);
1920                                         ldns_rr_free(pubkey);
1921                                         return NULL;
1922                                 }
1923                                 DSA_free(dsa);
1924                                 internal_data = 1;
1925                         }
1926 #endif /* HAVE_SSL */
1927 #endif /* USE_DSA */
1928                         break;
1929                 case LDNS_SIGN_ECC_GOST:
1930                         ldns_rr_push_rdf(pubkey, ldns_native2rdf_int8(
1931                                 LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
1932 #if defined(HAVE_SSL) && defined(USE_GOST)
1933                         bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
1934                         if (!bin) {
1935                                 ldns_rr_free(pubkey);
1936                                 return NULL;
1937                         }
1938 #ifndef S_SPLINT_S
1939                         if (!ldns_key_gost2bin(bin, k->_key.key, &size)) {
1940                                 LDNS_FREE(bin);
1941                                 ldns_rr_free(pubkey);
1942                                 return NULL;
1943                         }
1944 #endif /* splint */
1945                         internal_data = 1;
1946 #else
1947                         ldns_rr_free(pubkey);
1948                         return NULL;
1949 #endif /* HAVE_SSL and USE_GOST */
1950                         break;
1951                 case LDNS_SIGN_ECDSAP256SHA256:
1952                 case LDNS_SIGN_ECDSAP384SHA384:
1953 #ifdef USE_ECDSA
1954                         ldns_rr_push_rdf(pubkey, ldns_native2rdf_int8(
1955                                 LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
1956                         bin = NULL;
1957 #ifndef S_SPLINT_S
1958                         ec = EVP_PKEY_get1_EC_KEY(k->_key.key);
1959 #endif
1960                         EC_KEY_set_conv_form(ec, POINT_CONVERSION_UNCOMPRESSED);
1961                         size = (uint16_t)i2o_ECPublicKey(ec, NULL);
1962                         if(!i2o_ECPublicKey(ec, &bin)) {
1963                                 EC_KEY_free(ec);
1964                                 ldns_rr_free(pubkey);
1965                                 return NULL;
1966                         }
1967                         if(size > 1) {
1968                                 /* move back one byte to shave off the 0x02
1969                                  * 'uncompressed' indicator that openssl made
1970                                  * Actually its 0x04 (from implementation).
1971                                  */
1972                                 assert(bin[0] == POINT_CONVERSION_UNCOMPRESSED);
1973                                 size -= 1;
1974                                 memmove(bin, bin+1, size);
1975                         }
1976                         /* down the reference count for ec, its still assigned
1977                          * to the pkey */
1978                         EC_KEY_free(ec);
1979                         internal_data = 1;
1980 #else
1981                         ldns_rr_free(pubkey);
1982                         return NULL;
1983 #endif /* ECDSA */
1984                         break;
1985 #ifdef USE_ED25519
1986                 case LDNS_SIGN_ED25519:
1987                         ldns_rr_push_rdf(pubkey, ldns_native2rdf_int8(
1988                                 LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
1989                         bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
1990                         if (!bin) {
1991                                 ldns_rr_free(pubkey);
1992                                 return NULL;
1993                         }
1994                         if (!ldns_key_ed255192bin(bin, k->_key.key, &size)) {
1995                                 LDNS_FREE(bin);
1996                                 ldns_rr_free(pubkey);
1997                                 return NULL;
1998                         }
1999                         internal_data = 1;
2000                         break;
2001 #endif
2002 #ifdef USE_ED448
2003                 case LDNS_SIGN_ED448:
2004                         ldns_rr_push_rdf(pubkey, ldns_native2rdf_int8(
2005                                 LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
2006                         bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
2007                         if (!bin) {
2008                                 ldns_rr_free(pubkey);
2009                                 return NULL;
2010                         }
2011                         if (!ldns_key_ed4482bin(bin, k->_key.key, &size)) {
2012                                 LDNS_FREE(bin);
2013                                 ldns_rr_free(pubkey);
2014                                 return NULL;
2015                         }
2016                         internal_data = 1;
2017                         break;
2018 #endif
2019                 case LDNS_SIGN_HMACMD5:
2020                 case LDNS_SIGN_HMACSHA1:
2021                 case LDNS_SIGN_HMACSHA224:
2022                 case LDNS_SIGN_HMACSHA256:
2023                 case LDNS_SIGN_HMACSHA384:
2024                 case LDNS_SIGN_HMACSHA512:
2025                         bin = LDNS_XMALLOC(unsigned char, ldns_key_hmac_size(k));
2026                         if (!bin) {
2027                                 ldns_rr_free(pubkey);
2028                                 return NULL;
2029                         }
2030                         ldns_rr_push_rdf(pubkey,
2031                                          ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG,
2032                                          ldns_key_algorithm(k)));
2033                         size = ldns_key_hmac_size(k);
2034                         memcpy(bin, ldns_key_hmac_key(k), size);
2035                         internal_data = 1;
2036                         break;
2037         }
2038         /* fourth the key bin material */
2039         if (internal_data) {
2040                 keybin = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, size, bin);
2041                 LDNS_FREE(bin);
2042                 ldns_rr_push_rdf(pubkey, keybin);
2043         }
2044         return pubkey;
2045 }
2046
2047 void
2048 ldns_key_free(ldns_key *key)
2049 {
2050         LDNS_FREE(key);
2051 }
2052
2053 void
2054 ldns_key_deep_free(ldns_key *key)
2055 {
2056         unsigned char* hmac;
2057         if (ldns_key_pubkey_owner(key)) {
2058                 ldns_rdf_deep_free(ldns_key_pubkey_owner(key));
2059         }
2060 #ifdef HAVE_SSL
2061         if (ldns_key_evp_key(key)) {
2062                 EVP_PKEY_free(ldns_key_evp_key(key));
2063         }
2064 #endif /* HAVE_SSL */
2065         if (ldns_key_hmac_key(key)) {
2066                 hmac = ldns_key_hmac_key(key);
2067                 LDNS_FREE(hmac);
2068         }
2069         LDNS_FREE(key);
2070 }
2071
2072 void
2073 ldns_key_list_free(ldns_key_list *key_list)
2074 {
2075         size_t i;
2076         for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
2077                 ldns_key_deep_free(ldns_key_list_key(key_list, i));
2078         }
2079         LDNS_FREE(key_list->_keys);
2080         LDNS_FREE(key_list);
2081 }
2082
2083 ldns_rr *
2084 ldns_read_anchor_file(const char *filename)
2085 {
2086         FILE *fp;
2087         /*char line[LDNS_MAX_PACKETLEN];*/
2088         char *line = LDNS_XMALLOC(char, LDNS_MAX_PACKETLEN);
2089         int c;
2090         size_t i = 0;
2091         ldns_rr *r;
2092         ldns_status status;
2093         if(!line) {
2094                 return NULL;
2095         }
2096
2097         fp = fopen(filename, "r");
2098         if (!fp) {
2099 #ifdef STDERR_MSGS
2100                 fprintf(stderr, "Unable to open %s: %s\n", filename, strerror(errno));
2101 #endif
2102                 LDNS_FREE(line);
2103                 return NULL;
2104         }
2105
2106         while ((c = fgetc(fp)) && i+1 < LDNS_MAX_PACKETLEN && c != EOF) {
2107                 line[i] = c;
2108                 i++;
2109         }
2110         line[i] = '\0';
2111
2112         fclose(fp);
2113
2114         if (i <= 0) {
2115 #ifdef STDERR_MSGS
2116                 fprintf(stderr, "nothing read from %s", filename);
2117 #endif
2118                 LDNS_FREE(line);
2119                 return NULL;
2120         } else {
2121                 status = ldns_rr_new_frm_str(&r, line, 0, NULL, NULL);
2122                 if (status == LDNS_STATUS_OK && (ldns_rr_get_type(r) == LDNS_RR_TYPE_DNSKEY || ldns_rr_get_type(r) == LDNS_RR_TYPE_DS)) {
2123                         LDNS_FREE(line);
2124                         return r;
2125                 } else {
2126 #ifdef STDERR_MSGS
2127                         fprintf(stderr, "Error creating DNSKEY or DS rr from %s: %s\n", filename, ldns_get_errorstr_by_id(status));
2128 #endif
2129                         LDNS_FREE(line);
2130                         return NULL;
2131                 }
2132         }
2133 }
2134
2135 char *
2136 ldns_key_get_file_base_name(const ldns_key *key)
2137 {
2138         ldns_buffer *buffer;
2139         char *file_base_name;
2140
2141         buffer = ldns_buffer_new(255);
2142         ldns_buffer_printf(buffer, "K");
2143         (void)ldns_rdf2buffer_str_dname(buffer, ldns_key_pubkey_owner(key));
2144         ldns_buffer_printf(buffer,
2145                            "+%03u+%05u",
2146                            ldns_key_algorithm(key),
2147                            ldns_key_keytag(key));
2148         file_base_name = ldns_buffer_export(buffer);
2149         ldns_buffer_free(buffer);
2150         return file_base_name;
2151 }
2152
2153 int ldns_key_algo_supported(int algo)
2154 {
2155         ldns_lookup_table *lt = ldns_signing_algorithms;
2156         while(lt->name) {
2157                 if(lt->id == algo)
2158                         return 1;
2159                 lt++;
2160         }
2161         return 0;
2162 }
2163
2164 ldns_signing_algorithm ldns_get_signing_algorithm_by_name(const char* name)
2165 {
2166         /* list of (signing algorithm id, alias_name) */
2167         ldns_lookup_table aliases[] = {
2168                 /* from bind dnssec-keygen */
2169                 {LDNS_SIGN_HMACMD5, "HMAC-MD5"},
2170 #ifdef USE_DSA
2171                 {LDNS_SIGN_DSA_NSEC3, "NSEC3DSA"},
2172 #endif /* USE_DSA */
2173                 {LDNS_SIGN_RSASHA1_NSEC3, "NSEC3RSASHA1"},
2174                 /* old ldns usage, now RFC names */
2175 #ifdef USE_DSA
2176                 {LDNS_SIGN_DSA_NSEC3, "DSA_NSEC3" },
2177 #endif
2178                 {LDNS_SIGN_RSASHA1_NSEC3, "RSASHA1_NSEC3" },
2179 #ifdef USE_GOST
2180                 {LDNS_SIGN_ECC_GOST, "GOST"},
2181 #endif
2182                 /* compat with possible output */
2183                 {LDNS_DH, "DH"},
2184                 {LDNS_ECC, "ECC"},
2185                 {LDNS_INDIRECT, "INDIRECT"},
2186                 {LDNS_PRIVATEDNS, "PRIVATEDNS"},
2187                 {LDNS_PRIVATEOID, "PRIVATEOID"},
2188                 {0, NULL}};
2189         ldns_lookup_table* lt = ldns_signing_algorithms;
2190         ldns_signing_algorithm a;
2191         char *endptr;
2192
2193         while(lt->name) {
2194                 if(strcasecmp(lt->name, name) == 0)
2195                         return lt->id;
2196                 lt++;
2197         }
2198         lt = aliases;
2199         while(lt->name) {
2200                 if(strcasecmp(lt->name, name) == 0)
2201                         return lt->id;
2202                 lt++;
2203         }
2204         a = strtol(name, &endptr, 10);
2205         if (*name && !*endptr)
2206                 return a;
2207
2208         return 0;
2209 }