ldns/drill: Update vendor branch to 1.6.9
[dragonfly.git] / contrib / ldns / keys.c
1 /*
2  * keys.c handle private keys for use in DNSSEC
3  *
4  * This module should hide some of the openSSL complexities
5  * and give a general interface for private keys and hmac
6  * handling
7  *
8  * (c) NLnet Labs, 2004-2006
9  *
10  * See the file LICENSE for the license
11  */
12
13 #include <ldns/config.h>
14
15 #include <ldns/ldns.h>
16
17 #ifdef HAVE_SSL
18 #include <openssl/ssl.h>
19 #include <openssl/engine.h>
20 #include <openssl/rand.h>
21 #endif /* HAVE_SSL */
22
23 ldns_lookup_table ldns_signing_algorithms[] = {
24         { LDNS_SIGN_RSAMD5, "RSAMD5" },
25         { LDNS_SIGN_RSASHA1, "RSASHA1" },
26         { LDNS_SIGN_RSASHA1_NSEC3, "RSASHA1-NSEC3-SHA1" },
27 #ifdef USE_SHA2
28         { LDNS_SIGN_RSASHA256, "RSASHA256" },
29         { LDNS_SIGN_RSASHA512, "RSASHA512" },
30 #endif
31 #ifdef USE_GOST
32         { LDNS_SIGN_ECC_GOST, "ECC-GOST" },
33 #endif
34 #ifdef USE_ECDSA
35         { LDNS_SIGN_ECDSAP256SHA256, "ECDSAP256SHA256" },
36         { LDNS_SIGN_ECDSAP384SHA384, "ECDSAP384SHA384" },
37 #endif
38         { LDNS_SIGN_DSA, "DSA" },
39         { LDNS_SIGN_DSA_NSEC3, "DSA-NSEC3-SHA1" },
40         { LDNS_SIGN_HMACMD5, "hmac-md5.sig-alg.reg.int" },
41         { LDNS_SIGN_HMACSHA1, "hmac-sha1" },
42         { LDNS_SIGN_HMACSHA256, "hmac-sha256" },
43         { 0, NULL }
44 };
45
46 ldns_key_list *
47 ldns_key_list_new()
48 {
49         ldns_key_list *key_list = LDNS_MALLOC(ldns_key_list);
50         if (!key_list) {
51                 return NULL;
52         } else {
53                 key_list->_key_count = 0;
54                 key_list->_keys = NULL;
55                 return key_list;
56         }
57 }
58
59 ldns_key *
60 ldns_key_new()
61 {
62         ldns_key *newkey;
63
64         newkey = LDNS_MALLOC(ldns_key);
65         if (!newkey) {
66                 return NULL;
67         } else {
68                 /* some defaults - not sure wether to do this */
69                 ldns_key_set_use(newkey, true);
70                 ldns_key_set_flags(newkey, LDNS_KEY_ZONE_KEY);
71                 ldns_key_set_origttl(newkey, 0);
72                 ldns_key_set_keytag(newkey, 0);
73                 ldns_key_set_inception(newkey, 0);
74                 ldns_key_set_expiration(newkey, 0);
75                 ldns_key_set_pubkey_owner(newkey, NULL);
76 #ifdef HAVE_SSL
77                 ldns_key_set_evp_key(newkey, NULL);
78 #endif /* HAVE_SSL */
79                 ldns_key_set_hmac_key(newkey, NULL);
80                 ldns_key_set_external_key(newkey, NULL);
81                 return newkey;
82         }
83 }
84
85 ldns_status
86 ldns_key_new_frm_fp(ldns_key **k, FILE *fp)
87 {
88         return ldns_key_new_frm_fp_l(k, fp, NULL);
89 }
90
91 #ifdef HAVE_SSL
92 ldns_status
93 ldns_key_new_frm_engine(ldns_key **key, ENGINE *e, char *key_id, ldns_algorithm alg)
94 {
95         ldns_key *k;
96
97         k = ldns_key_new();
98         if(!k) return LDNS_STATUS_MEM_ERR;
99 #ifndef S_SPLINT_S
100         k->_key.key = ENGINE_load_private_key(e, key_id, UI_OpenSSL(), NULL);
101         if(!k->_key.key) {
102                 ldns_key_free(k);
103                 return LDNS_STATUS_ERR;
104         }
105         ldns_key_set_algorithm(k, (ldns_signing_algorithm) alg);
106         if (!k->_key.key) {
107                 ldns_key_free(k);
108                 return LDNS_STATUS_ENGINE_KEY_NOT_LOADED;
109         } 
110 #endif /* splint */
111         *key = k;
112         return LDNS_STATUS_OK;
113 }
114 #endif
115
116 #ifdef USE_GOST
117 /** store GOST engine reference loaded into OpenSSL library */
118 ENGINE* ldns_gost_engine = NULL;
119
120 int
121 ldns_key_EVP_load_gost_id(void)
122 {
123         static int gost_id = 0;
124         const EVP_PKEY_ASN1_METHOD* meth;
125         ENGINE* e;
126
127         if(gost_id) return gost_id;
128
129         /* see if configuration loaded gost implementation from other engine*/
130         meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1);
131         if(meth) {
132                 EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
133                 return gost_id;
134         }
135
136         /* see if engine can be loaded already */
137         e = ENGINE_by_id("gost");
138         if(!e) {
139                 /* load it ourself, in case statically linked */
140                 ENGINE_load_builtin_engines();
141                 ENGINE_load_dynamic();
142                 e = ENGINE_by_id("gost");
143         }
144         if(!e) {
145                 /* no gost engine in openssl */
146                 return 0;
147         }
148         if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
149                 ENGINE_finish(e);
150                 ENGINE_free(e);
151                 return 0;
152         }
153
154         meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1);
155         if(!meth) {
156                 /* algo not found */
157                 ENGINE_finish(e);
158                 ENGINE_free(e);
159                 return 0;
160         }
161         /* Note: do not ENGINE_finish and ENGINE_free the acquired engine
162          * on some platforms this frees up the meth and unloads gost stuff */
163         ldns_gost_engine = e;
164         
165         EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
166         return gost_id;
167
168
169 void ldns_key_EVP_unload_gost(void)
170 {
171         if(ldns_gost_engine) {
172                 ENGINE_finish(ldns_gost_engine);
173                 ENGINE_free(ldns_gost_engine);
174                 ldns_gost_engine = NULL;
175         }
176 }
177
178 /** read GOST private key */
179 static EVP_PKEY*
180 ldns_key_new_frm_fp_gost_l(FILE* fp, int* line_nr)
181 {
182         char token[16384];
183         const unsigned char* pp;
184         int gost_id;
185         EVP_PKEY* pkey;
186         ldns_rdf* b64rdf = NULL;
187
188         gost_id = ldns_key_EVP_load_gost_id();
189         if(!gost_id)
190                 return NULL;
191
192         if (ldns_fget_keyword_data_l(fp, "GostAsn1", ": ", token, "\n", 
193                 sizeof(token), line_nr) == -1)
194                 return NULL;
195         while(strlen(token) < 96) {
196                 /* read more b64 from the file, b64 split on multiple lines */
197                 if(ldns_fget_token_l(fp, token+strlen(token), "\n",
198                         sizeof(token)-strlen(token), line_nr) == -1)
199                         return NULL;
200         }
201         if(ldns_str2rdf_b64(&b64rdf, token) != LDNS_STATUS_OK)
202                 return NULL;
203         pp = (unsigned char*)ldns_rdf_data(b64rdf);
204         pkey = d2i_PrivateKey(gost_id, NULL, &pp, (int)ldns_rdf_size(b64rdf));
205         ldns_rdf_deep_free(b64rdf);
206         return pkey;
207 }
208 #endif
209
210 #ifdef USE_ECDSA
211 /** calculate public key from private key */
212 static int
213 ldns_EC_KEY_calc_public(EC_KEY* ec)
214 {
215         EC_POINT* pub_key;
216         const EC_GROUP* group;
217         group = EC_KEY_get0_group(ec);
218         pub_key = EC_POINT_new(group);
219         if(!pub_key) return 0;
220         if(!EC_POINT_copy(pub_key, EC_GROUP_get0_generator(group))) {
221                 EC_POINT_free(pub_key);
222                 return 0;
223         }
224         if(!EC_POINT_mul(group, pub_key, EC_KEY_get0_private_key(ec),
225                 NULL, NULL, NULL)) {
226                 EC_POINT_free(pub_key);
227                 return 0;
228         }
229         if(EC_KEY_set_public_key(ec, pub_key) == 0) {
230                 EC_POINT_free(pub_key);
231                 return 0;
232         }
233         EC_POINT_free(pub_key);
234         return 1;
235 }
236
237 /** read ECDSA private key */
238 static EVP_PKEY*
239 ldns_key_new_frm_fp_ecdsa_l(FILE* fp, ldns_algorithm alg, int* line_nr)
240 {
241         char token[16384];
242         ldns_rdf* b64rdf = NULL;
243         unsigned char* pp;
244         BIGNUM* bn;
245         EVP_PKEY* evp_key;
246         EC_KEY* ec;
247         if (ldns_fget_keyword_data_l(fp, "PrivateKey", ": ", token, "\n", 
248                 sizeof(token), line_nr) == -1)
249                 return NULL;
250         if(ldns_str2rdf_b64(&b64rdf, token) != LDNS_STATUS_OK)
251                 return NULL;
252         pp = (unsigned char*)ldns_rdf_data(b64rdf);
253
254         if(alg == LDNS_ECDSAP256SHA256)
255                 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
256         else if(alg == LDNS_ECDSAP384SHA384)
257                 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
258         else    ec = NULL;
259         if(!ec) {
260                 ldns_rdf_deep_free(b64rdf);
261                 return NULL;
262         }
263         bn = BN_bin2bn(pp, (int)ldns_rdf_size(b64rdf), NULL);
264         ldns_rdf_deep_free(b64rdf);
265         if(!bn) {
266                 EC_KEY_free(ec);
267                 return NULL;
268         }
269         EC_KEY_set_private_key(ec, bn);
270         BN_free(bn);
271         if(!ldns_EC_KEY_calc_public(ec)) {
272                 EC_KEY_free(ec);
273                 return NULL;
274         }
275
276         evp_key = EVP_PKEY_new();
277         if(!evp_key) {
278                 EC_KEY_free(ec);
279                 return NULL;
280         }
281         EVP_PKEY_assign_EC_KEY(evp_key, ec);
282
283         return evp_key;
284 }
285 #endif
286         
287 ldns_status
288 ldns_key_new_frm_fp_l(ldns_key **key, FILE *fp, int *line_nr)
289 {
290         ldns_key *k;
291         char *d;
292         ldns_signing_algorithm alg;
293         ldns_rr *key_rr;
294 #ifdef HAVE_SSL
295         RSA *rsa;
296         DSA *dsa;
297         unsigned char *hmac;
298         size_t hmac_size;
299 #endif /* HAVE_SSL */
300
301         k = ldns_key_new();
302
303         d = LDNS_XMALLOC(char, LDNS_MAX_LINELEN);
304         if (!k || !d) {
305                 ldns_key_free(k);
306                 LDNS_FREE(d);
307                 return LDNS_STATUS_MEM_ERR;
308         }
309
310         alg = 0;
311
312         /* the file is highly structured. Do this in sequence */
313         /* RSA:
314          * Private-key-format: v1.2
315          * Algorithm: 1 (RSA)
316
317          */
318         /* get the key format version number */
319         if (ldns_fget_keyword_data_l(fp, "Private-key-format", ": ", d, "\n",
320                                 LDNS_MAX_LINELEN, line_nr) == -1) {
321                 /* no version information */
322                 ldns_key_free(k);
323                 LDNS_FREE(d);
324                 return LDNS_STATUS_SYNTAX_ERR;
325         }
326         if (strncmp(d, "v1.2", strlen(d)) != 0) {
327                 ldns_key_free(k);
328                 LDNS_FREE(d);
329                 return LDNS_STATUS_SYNTAX_VERSION_ERR;
330         }
331
332         /* get the algorithm type, our file function strip ( ) so there are
333          * not in the return string! */
334         if (ldns_fget_keyword_data_l(fp, "Algorithm", ": ", d, "\n",
335                                 LDNS_MAX_LINELEN, line_nr) == -1) {
336                 /* no alg information */
337                 ldns_key_free(k);
338                 LDNS_FREE(d);
339                 return LDNS_STATUS_SYNTAX_ALG_ERR;
340         }
341
342         if (strncmp(d, "1 RSA", 2) == 0) {
343                 alg = LDNS_SIGN_RSAMD5;
344         }
345         if (strncmp(d, "2 DH", 2) == 0) {
346                 alg = (ldns_signing_algorithm)LDNS_DH;
347         }
348         if (strncmp(d, "3 DSA", 2) == 0) {
349                 alg = LDNS_SIGN_DSA;
350         }
351         if (strncmp(d, "4 ECC", 2) == 0) {
352                 alg = (ldns_signing_algorithm)LDNS_ECC;
353         }
354         if (strncmp(d, "5 RSASHA1", 2) == 0) {
355                 alg = LDNS_SIGN_RSASHA1;
356         }
357         if (strncmp(d, "6 DSA", 2) == 0) {
358                 alg = LDNS_SIGN_DSA_NSEC3;
359         }
360         if (strncmp(d, "7 RSASHA1", 2) == 0) {
361                 alg = LDNS_SIGN_RSASHA1_NSEC3;
362         }
363
364         if (strncmp(d, "8 RSASHA256", 2) == 0) {
365 #ifdef USE_SHA2
366                 alg = LDNS_SIGN_RSASHA256;
367 #else
368                 fprintf(stderr, "Warning: SHA256 not compiled into this ");
369                 fprintf(stderr, "version of ldns\n");
370 #endif
371         }
372         if (strncmp(d, "10 RSASHA512", 3) == 0) {
373 #ifdef USE_SHA2
374                 alg = LDNS_SIGN_RSASHA512;
375 #else
376                 fprintf(stderr, "Warning: SHA512 not compiled into this ");
377                 fprintf(stderr, "version of ldns\n");
378 #endif
379         }
380         if (strncmp(d, "12 ECC-GOST", 3) == 0) {
381 #ifdef USE_GOST
382                 alg = LDNS_SIGN_ECC_GOST;
383 #else
384                 fprintf(stderr, "Warning: ECC-GOST not compiled into this ");
385                 fprintf(stderr, "version of ldns, use --enable-gost\n");
386 #endif
387         }
388 #ifdef USE_ECDSA
389         if (strncmp(d, "13 ECDSAP256SHA256", 3) == 0) {
390                 alg = LDNS_SIGN_ECDSAP256SHA256;
391         }
392         if (strncmp(d, "14 ECDSAP384SHA384", 3) == 0) {
393                 alg = LDNS_SIGN_ECDSAP384SHA384;
394         }
395 #endif
396         if (strncmp(d, "157 HMAC-MD5", 4) == 0) {
397                 alg = LDNS_SIGN_HMACMD5;
398         }
399         if (strncmp(d, "158 HMAC-SHA1", 4) == 0) {
400                 alg = LDNS_SIGN_HMACSHA1;
401         }
402         if (strncmp(d, "159 HMAC-SHA256", 4) == 0) {
403                 alg = LDNS_SIGN_HMACSHA256;
404         }
405
406         LDNS_FREE(d);
407
408         switch(alg) {
409                 case LDNS_SIGN_RSAMD5:
410                 case LDNS_SIGN_RSASHA1:
411                 case LDNS_SIGN_RSASHA1_NSEC3:
412 #ifdef USE_SHA2
413                 case LDNS_SIGN_RSASHA256:
414                 case LDNS_SIGN_RSASHA512:
415 #endif
416                         ldns_key_set_algorithm(k, alg);
417 #ifdef HAVE_SSL
418                         rsa = ldns_key_new_frm_fp_rsa_l(fp, line_nr);
419                         if (!rsa) {
420                                 ldns_key_free(k);
421                                 return LDNS_STATUS_ERR;
422                         }
423                         ldns_key_set_rsa_key(k, rsa);
424                         RSA_free(rsa);
425 #endif /* HAVE_SSL */
426                         break;
427                 case LDNS_SIGN_DSA:
428                 case LDNS_SIGN_DSA_NSEC3:
429                         ldns_key_set_algorithm(k, alg);
430 #ifdef HAVE_SSL
431                         dsa = ldns_key_new_frm_fp_dsa_l(fp, line_nr);
432                         if (!dsa) {
433                                 ldns_key_free(k);
434                                 return LDNS_STATUS_ERR;
435                         }
436                         ldns_key_set_dsa_key(k, dsa);
437                         DSA_free(dsa);
438 #endif /* HAVE_SSL */
439                         break;
440                 case LDNS_SIGN_HMACMD5:
441                 case LDNS_SIGN_HMACSHA1:
442                 case LDNS_SIGN_HMACSHA256:
443                         ldns_key_set_algorithm(k, alg);
444 #ifdef HAVE_SSL
445                         hmac = ldns_key_new_frm_fp_hmac_l(fp, line_nr, &hmac_size);
446                         if (!hmac) {
447                                 ldns_key_free(k);
448                                 return LDNS_STATUS_ERR;
449                         }
450                         ldns_key_set_hmac_size(k, hmac_size);
451                         ldns_key_set_hmac_key(k, hmac);
452 #endif /* HAVE_SSL */
453                         break;
454                 case LDNS_SIGN_ECC_GOST:
455                         ldns_key_set_algorithm(k, alg);
456 #if defined(HAVE_SSL) && defined(USE_GOST)
457                         if(!ldns_key_EVP_load_gost_id()) {
458                                 ldns_key_free(k);
459                                 return LDNS_STATUS_CRYPTO_ALGO_NOT_IMPL;
460                         }
461                         ldns_key_set_evp_key(k, 
462                                 ldns_key_new_frm_fp_gost_l(fp, line_nr));
463 #ifndef S_SPLINT_S
464                         if(!k->_key.key) {
465                                 ldns_key_free(k);
466                                 return LDNS_STATUS_ERR;
467                         }
468 #endif /* splint */
469 #endif
470                         break;
471 #ifdef USE_ECDSA
472                case LDNS_SIGN_ECDSAP256SHA256:
473                case LDNS_SIGN_ECDSAP384SHA384:
474                         ldns_key_set_algorithm(k, alg);
475                         ldns_key_set_evp_key(k,
476                                 ldns_key_new_frm_fp_ecdsa_l(fp, (ldns_algorithm)alg, line_nr));
477 #ifndef S_SPLINT_S
478                         if(!k->_key.key) {
479                                 ldns_key_free(k);
480                                 return LDNS_STATUS_ERR;
481                         }
482 #endif /* splint */
483                         break;
484 #endif
485                 default:
486                         ldns_key_free(k);
487                         return LDNS_STATUS_SYNTAX_ALG_ERR;
488         }
489         key_rr = ldns_key2rr(k);
490         ldns_key_set_keytag(k, ldns_calc_keytag(key_rr));
491         ldns_rr_free(key_rr);
492
493         if (key) {
494                 *key = k;
495                 return LDNS_STATUS_OK;
496         }
497         return LDNS_STATUS_ERR;
498 }
499
500 #ifdef HAVE_SSL
501 RSA *
502 ldns_key_new_frm_fp_rsa(FILE *f)
503 {
504         return ldns_key_new_frm_fp_rsa_l(f, NULL);
505 }
506
507 RSA *
508 ldns_key_new_frm_fp_rsa_l(FILE *f, int *line_nr)
509 {
510         /* we parse
511          * Modulus:
512          * PublicExponent:
513          * PrivateExponent:
514          * Prime1:
515          * Prime2:
516          * Exponent1:
517          * Exponent2:
518          * Coefficient:
519          *
520          * man 3 RSA:
521          *
522          * struct
523          *     {
524          *     BIGNUM *n;              // public modulus
525          *     BIGNUM *e;              // public exponent
526          *     BIGNUM *d;              // private exponent
527          *     BIGNUM *p;              // secret prime factor
528          *     BIGNUM *q;              // secret prime factor
529          *     BIGNUM *dmp1;           // d mod (p-1)
530          *     BIGNUM *dmq1;           // d mod (q-1)
531          *     BIGNUM *iqmp;           // q^-1 mod p
532          *     // ...
533          *
534          */
535         char *d;
536         RSA *rsa;
537         uint8_t *buf;
538         int i;
539
540         d = LDNS_XMALLOC(char, LDNS_MAX_LINELEN);
541         buf = LDNS_XMALLOC(uint8_t, LDNS_MAX_LINELEN);
542         rsa = RSA_new();
543         if (!d || !rsa || !buf) {
544                 goto error;
545         }
546
547         /* I could use functions again, but that seems an overkill,
548          * allthough this also looks tedious
549          */
550
551         /* Modules, rsa->n */
552         if (ldns_fget_keyword_data_l(f, "Modulus", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
553                 goto error;
554         }
555         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
556 #ifndef S_SPLINT_S
557         rsa->n = BN_bin2bn((const char unsigned*)buf, i, NULL);
558         if (!rsa->n) {
559                 goto error;
560         }
561
562         /* PublicExponent, rsa->e */
563         if (ldns_fget_keyword_data_l(f, "PublicExponent", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
564                 goto error;
565         }
566         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
567         rsa->e = BN_bin2bn((const char unsigned*)buf, i, NULL);
568         if (!rsa->e) {
569                 goto error;
570         }
571
572         /* PrivateExponent, rsa->d */
573         if (ldns_fget_keyword_data_l(f, "PrivateExponent", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
574                 goto error;
575         }
576         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
577         rsa->d = BN_bin2bn((const char unsigned*)buf, i, NULL);
578         if (!rsa->d) {
579                 goto error;
580         }
581
582         /* Prime1, rsa->p */
583         if (ldns_fget_keyword_data_l(f, "Prime1", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
584                 goto error;
585         }
586         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
587         rsa->p = BN_bin2bn((const char unsigned*)buf, i, NULL);
588         if (!rsa->p) {
589                 goto error;
590         }
591
592         /* Prime2, rsa->q */
593         if (ldns_fget_keyword_data_l(f, "Prime2", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
594                 goto error;
595         }
596         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
597         rsa->q = BN_bin2bn((const char unsigned*)buf, i, NULL);
598         if (!rsa->q) {
599                 goto error;
600         }
601
602         /* Exponent1, rsa->dmp1 */
603         if (ldns_fget_keyword_data_l(f, "Exponent1", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
604                 goto error;
605         }
606         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
607         rsa->dmp1 = BN_bin2bn((const char unsigned*)buf, i, NULL);
608         if (!rsa->dmp1) {
609                 goto error;
610         }
611
612         /* Exponent2, rsa->dmq1 */
613         if (ldns_fget_keyword_data_l(f, "Exponent2", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
614                 goto error;
615         }
616         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
617         rsa->dmq1 = BN_bin2bn((const char unsigned*)buf, i, NULL);
618         if (!rsa->dmq1) {
619                 goto error;
620         }
621
622         /* Coefficient, rsa->iqmp */
623         if (ldns_fget_keyword_data_l(f, "Coefficient", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
624                 goto error;
625         }
626         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
627         rsa->iqmp = BN_bin2bn((const char unsigned*)buf, i, NULL);
628         if (!rsa->iqmp) {
629                 goto error;
630         }
631 #endif /* splint */
632
633         LDNS_FREE(buf);
634         LDNS_FREE(d);
635         return rsa;
636
637 error:
638         RSA_free(rsa);
639         LDNS_FREE(d);
640         LDNS_FREE(buf);
641         return NULL;
642 }
643
644 DSA *
645 ldns_key_new_frm_fp_dsa(FILE *f)
646 {
647         return ldns_key_new_frm_fp_dsa_l(f, NULL);
648 }
649
650 DSA *
651 ldns_key_new_frm_fp_dsa_l(FILE *f, int *line_nr)
652 {
653         int i;
654         char *d;
655         DSA *dsa;
656         uint8_t *buf;
657
658         line_nr = line_nr;
659
660         d = LDNS_XMALLOC(char, LDNS_MAX_LINELEN);
661         buf = LDNS_XMALLOC(uint8_t, LDNS_MAX_LINELEN);
662         dsa = DSA_new();
663         if (!d || !dsa || !buf) {
664                 goto error;
665         }
666
667         /* the line parser removes the () from the input... */
668
669         /* Prime, dsa->p */
670         if (ldns_fget_keyword_data_l(f, "Primep", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
671                 goto error;
672         }
673         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
674 #ifndef S_SPLINT_S
675         dsa->p = BN_bin2bn((const char unsigned*)buf, i, NULL);
676         if (!dsa->p) {
677                 goto error;
678         }
679
680         /* Subprime, dsa->q */
681         if (ldns_fget_keyword_data_l(f, "Subprimeq", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
682                 goto error;
683         }
684         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
685         dsa->q = BN_bin2bn((const char unsigned*)buf, i, NULL);
686         if (!dsa->q) {
687                 goto error;
688         }
689
690         /* Base, dsa->g */
691         if (ldns_fget_keyword_data_l(f, "Baseg", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
692                 goto error;
693         }
694         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
695         dsa->g = BN_bin2bn((const char unsigned*)buf, i, NULL);
696         if (!dsa->g) {
697                 goto error;
698         }
699
700         /* Private key, dsa->priv_key */
701         if (ldns_fget_keyword_data_l(f, "Private_valuex", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
702                 goto error;
703         }
704         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
705         dsa->priv_key = BN_bin2bn((const char unsigned*)buf, i, NULL);
706         if (!dsa->priv_key) {
707                 goto error;
708         }
709
710         /* Public key, dsa->priv_key */
711         if (ldns_fget_keyword_data_l(f, "Public_valuey", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
712                 goto error;
713         }
714         i = ldns_b64_pton((const char*)d, buf, ldns_b64_ntop_calculate_size(strlen(d)));
715         dsa->pub_key = BN_bin2bn((const char unsigned*)buf, i, NULL);
716         if (!dsa->pub_key) {
717                 goto error;
718         }
719 #endif /* splint */
720
721         LDNS_FREE(buf);
722         LDNS_FREE(d);
723
724         return dsa;
725
726 error:
727         LDNS_FREE(d);
728         LDNS_FREE(buf);
729         DSA_free(dsa);
730         return NULL;
731 }
732
733 unsigned char *
734 ldns_key_new_frm_fp_hmac(FILE *f, size_t *hmac_size)
735 {
736         return ldns_key_new_frm_fp_hmac_l(f, NULL, hmac_size);
737 }
738
739 unsigned char *
740 ldns_key_new_frm_fp_hmac_l(FILE *f, int *line_nr, size_t *hmac_size)
741 {
742         size_t i;
743         char *d;
744         unsigned char *buf;
745
746         line_nr = line_nr;
747
748         d = LDNS_XMALLOC(char, LDNS_MAX_LINELEN);
749         buf = LDNS_XMALLOC(unsigned char, LDNS_MAX_LINELEN);
750         if(!d || !buf) {
751                 goto error;
752         }
753
754         if (ldns_fget_keyword_data_l(f, "Key", ": ", d, "\n", LDNS_MAX_LINELEN, line_nr) == -1) {
755                 goto error;
756         }
757         i = (size_t) ldns_b64_pton((const char*)d,
758                                    buf,
759                                    ldns_b64_ntop_calculate_size(strlen(d)));
760
761         *hmac_size = i;
762         return buf;
763
764         error:
765         LDNS_FREE(d);
766         LDNS_FREE(buf);
767         *hmac_size = 0;
768         return NULL;
769 }
770 #endif /* HAVE_SSL */
771
772 #ifdef USE_GOST
773 static EVP_PKEY*
774 ldns_gen_gost_key(void)
775 {
776         EVP_PKEY_CTX* ctx;
777         EVP_PKEY* p = NULL;
778         int gost_id = ldns_key_EVP_load_gost_id();
779         if(!gost_id)
780                 return NULL;
781         ctx = EVP_PKEY_CTX_new_id(gost_id, NULL);
782         if(!ctx) {
783                 /* the id should be available now */
784                 return NULL;
785         }
786         if(EVP_PKEY_CTX_ctrl_str(ctx, "paramset", "A") <= 0) {
787                 /* cannot set paramset */
788                 EVP_PKEY_CTX_free(ctx);
789                 return NULL;
790         }
791
792         if(EVP_PKEY_keygen_init(ctx) <= 0) {
793                 EVP_PKEY_CTX_free(ctx);
794                 return NULL;
795         }
796         if(EVP_PKEY_keygen(ctx, &p) <= 0) {
797                 EVP_PKEY_free(p);
798                 EVP_PKEY_CTX_free(ctx);
799                 return NULL;
800         }
801         EVP_PKEY_CTX_free(ctx);
802         return p;
803 }
804 #endif
805
806 ldns_key *
807 ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size)
808 {
809         ldns_key *k;
810 #ifdef HAVE_SSL
811         DSA *d;
812         RSA *r;
813 #  ifdef USE_ECDSA
814         EC_KEY *ec = NULL;
815 #  endif
816 #else
817         int i;
818         uint16_t offset = 0;
819 #endif
820         unsigned char *hmac;
821
822         k = ldns_key_new();
823         if (!k) {
824                 return NULL;
825         }
826         switch(alg) {
827                 case LDNS_SIGN_RSAMD5:
828                 case LDNS_SIGN_RSASHA1:
829                 case LDNS_SIGN_RSASHA1_NSEC3:
830                 case LDNS_SIGN_RSASHA256:
831                 case LDNS_SIGN_RSASHA512:
832 #ifdef HAVE_SSL
833                         r = RSA_generate_key((int)size, RSA_F4, NULL, NULL);
834                         if(!r) {
835                                 ldns_key_free(k);
836                                 return NULL;
837                         }
838                         if (RSA_check_key(r) != 1) {
839                                 ldns_key_free(k);
840                                 return NULL;
841                         }
842
843                         ldns_key_set_rsa_key(k, r);
844 #endif /* HAVE_SSL */
845                         break;
846                 case LDNS_SIGN_DSA:
847                 case LDNS_SIGN_DSA_NSEC3:
848 #ifdef HAVE_SSL
849                         d = DSA_generate_parameters((int)size, NULL, 0, NULL, NULL, NULL, NULL);
850                         if (!d) {
851                                 ldns_key_free(k);
852                                 return NULL;
853                         }
854                         if (DSA_generate_key(d) != 1) {
855                                 ldns_key_free(k);
856                                 return NULL;
857                         }
858                         ldns_key_set_dsa_key(k, d);
859 #endif /* HAVE_SSL */
860                         break;
861                 case LDNS_SIGN_HMACMD5:
862                 case LDNS_SIGN_HMACSHA1:
863                 case LDNS_SIGN_HMACSHA256:
864 #ifdef HAVE_SSL
865 #ifndef S_SPLINT_S
866                         k->_key.key = NULL;
867 #endif /* splint */
868 #endif /* HAVE_SSL */
869                         size = size / 8;
870                         ldns_key_set_hmac_size(k, size);
871
872                         hmac = LDNS_XMALLOC(unsigned char, size);
873                         if(!hmac) {
874                                 ldns_key_free(k);
875                                 return NULL;
876                         }
877 #ifdef HAVE_SSL
878                         if (RAND_bytes(hmac, (int) size) != 1) {
879                                 LDNS_FREE(hmac);
880                                 ldns_key_free(k);
881                                 return NULL;
882                         }
883 #else
884                         while (offset + sizeof(i) < size) {
885                           i = random();
886                           memcpy(&hmac[offset], &i, sizeof(i));
887                           offset += sizeof(i);
888                         }
889                         if (offset < size) {
890                           i = random();
891                           memcpy(&hmac[offset], &i, size - offset);
892                         }
893 #endif /* HAVE_SSL */
894                         ldns_key_set_hmac_key(k, hmac);
895
896                         ldns_key_set_flags(k, 0);
897                         break;
898                 case LDNS_SIGN_ECC_GOST:
899 #if defined(HAVE_SSL) && defined(USE_GOST)
900                         ldns_key_set_evp_key(k, ldns_gen_gost_key());
901 #ifndef S_SPLINT_S
902                         if(!k->_key.key) {
903                                 ldns_key_free(k);
904                                 return NULL;
905                         }
906 #endif /* splint */
907 #endif /* HAVE_SSL and USE_GOST */
908                         break;
909 #ifdef USE_ECDSA
910                 case LDNS_SIGN_ECDSAP256SHA256:
911                 case LDNS_SIGN_ECDSAP384SHA384:
912                         if(alg == LDNS_SIGN_ECDSAP256SHA256)
913                                 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
914                         else if(alg == LDNS_SIGN_ECDSAP384SHA384)
915                                 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
916                         if(!ec) {
917                                 ldns_key_free(k);
918                                 return NULL;
919                         }
920                         if(!EC_KEY_generate_key(ec)) {
921                                 ldns_key_free(k);
922                                 EC_KEY_free(ec);
923                                 return NULL;
924                         }
925 #ifndef S_SPLINT_S
926                         k->_key.key = EVP_PKEY_new();
927                         if(!k->_key.key) {
928                                 ldns_key_free(k);
929                                 EC_KEY_free(ec);
930                                 return NULL;
931                         }
932                         EVP_PKEY_assign_EC_KEY(k->_key.key, ec);
933 #endif /* splint */
934                         break;
935 #endif
936         }
937         ldns_key_set_algorithm(k, alg);
938         return k;
939 }
940
941 void
942 ldns_key_print(FILE *output, const ldns_key *k)
943 {
944         char *str = ldns_key2str(k);
945         if (str) {
946                 fprintf(output, "%s", str);
947         } else {
948                 fprintf(output, "Unable to convert private key to string\n");
949         }
950         LDNS_FREE(str);
951 }
952
953
954 void
955 ldns_key_set_algorithm(ldns_key *k, ldns_signing_algorithm l)
956 {
957         k->_alg = l;
958 }
959
960 void
961 ldns_key_set_flags(ldns_key *k, uint16_t f)
962 {
963         k->_extra.dnssec.flags = f;
964 }
965
966 #ifdef HAVE_SSL
967 #ifndef S_SPLINT_S
968 void
969 ldns_key_set_evp_key(ldns_key *k, EVP_PKEY *e)
970 {
971         k->_key.key = e;
972 }
973
974 void
975 ldns_key_set_rsa_key(ldns_key *k, RSA *r)
976 {
977         EVP_PKEY *key = EVP_PKEY_new();
978         EVP_PKEY_set1_RSA(key, r);
979         k->_key.key = key;
980 }
981
982 void
983 ldns_key_set_dsa_key(ldns_key *k, DSA *d)
984 {
985         EVP_PKEY *key = EVP_PKEY_new();
986         EVP_PKEY_set1_DSA(key, d);
987         k->_key.key  = key;
988 }
989 #endif /* splint */
990 #endif /* HAVE_SSL */
991
992 void
993 ldns_key_set_hmac_key(ldns_key *k, unsigned char *hmac)
994 {
995         k->_key.hmac.key = hmac;
996 }
997
998 void
999 ldns_key_set_hmac_size(ldns_key *k, size_t hmac_size)
1000 {
1001         k->_key.hmac.size = hmac_size;
1002 }
1003
1004 void
1005 ldns_key_set_external_key(ldns_key *k, void *external_key)
1006 {
1007         k->_key.external_key = external_key;
1008 }
1009
1010 void
1011 ldns_key_set_origttl(ldns_key *k, uint32_t t)
1012 {
1013         k->_extra.dnssec.orig_ttl = t;
1014 }
1015
1016 void
1017 ldns_key_set_inception(ldns_key *k, uint32_t i)
1018 {
1019         k->_extra.dnssec.inception = i;
1020 }
1021
1022 void
1023 ldns_key_set_expiration(ldns_key *k, uint32_t e)
1024 {
1025         k->_extra.dnssec.expiration = e;
1026 }
1027
1028 void
1029 ldns_key_set_pubkey_owner(ldns_key *k, ldns_rdf *r)
1030 {
1031         k->_pubkey_owner = r;
1032 }
1033
1034 void
1035 ldns_key_set_keytag(ldns_key *k, uint16_t tag)
1036 {
1037         k->_extra.dnssec.keytag = tag;
1038 }
1039
1040 /* read */
1041 size_t
1042 ldns_key_list_key_count(const ldns_key_list *key_list)
1043 {
1044                 return key_list->_key_count;
1045 }       
1046
1047 ldns_key *
1048 ldns_key_list_key(const ldns_key_list *key, size_t nr)
1049 {       
1050         if (nr < ldns_key_list_key_count(key)) {
1051                 return key->_keys[nr];
1052         } else {
1053                 return NULL;
1054         }
1055 }
1056
1057 ldns_signing_algorithm
1058 ldns_key_algorithm(const ldns_key *k) 
1059 {
1060         return k->_alg;
1061 }
1062
1063 void
1064 ldns_key_set_use(ldns_key *k, bool v)
1065 {
1066         if (k) {
1067                 k->_use = v;
1068         }
1069 }
1070
1071 bool
1072 ldns_key_use(const ldns_key *k)
1073 {
1074         if (k) {
1075                 return k->_use;
1076         }
1077         return false;
1078 }
1079
1080 #ifdef HAVE_SSL
1081 #ifndef S_SPLINT_S
1082 EVP_PKEY *
1083 ldns_key_evp_key(const ldns_key *k)
1084 {
1085         return k->_key.key;
1086 }
1087
1088 RSA *
1089 ldns_key_rsa_key(const ldns_key *k)
1090 {
1091         if (k->_key.key) {
1092                 return EVP_PKEY_get1_RSA(k->_key.key);
1093         } else {
1094                 return NULL;
1095         }
1096 }
1097
1098 DSA *
1099 ldns_key_dsa_key(const ldns_key *k)
1100 {
1101         if (k->_key.key) {
1102                 return EVP_PKEY_get1_DSA(k->_key.key);
1103         } else {
1104                 return NULL;
1105         }
1106 }
1107 #endif /* splint */
1108 #endif /* HAVE_SSL */
1109
1110 unsigned char *
1111 ldns_key_hmac_key(const ldns_key *k)
1112 {
1113         if (k->_key.hmac.key) {
1114                 return k->_key.hmac.key;
1115         } else {
1116                 return NULL;
1117         }
1118 }
1119
1120 size_t
1121 ldns_key_hmac_size(const ldns_key *k)
1122 {
1123         if (k->_key.hmac.size) {
1124                 return k->_key.hmac.size;
1125         } else {
1126                 return 0;
1127         }
1128 }
1129
1130 void *
1131 ldns_key_external_key(const ldns_key *k)
1132 {
1133         return k->_key.external_key;
1134 }
1135
1136 uint32_t
1137 ldns_key_origttl(const ldns_key *k)
1138 {
1139         return k->_extra.dnssec.orig_ttl;
1140 }
1141
1142 uint16_t
1143 ldns_key_flags(const ldns_key *k)
1144 {
1145         return k->_extra.dnssec.flags;
1146 }
1147
1148 uint32_t
1149 ldns_key_inception(const ldns_key *k)
1150 {
1151         return k->_extra.dnssec.inception;
1152 }
1153
1154 uint32_t
1155 ldns_key_expiration(const ldns_key *k)
1156 {
1157         return k->_extra.dnssec.expiration;
1158 }
1159
1160 uint16_t
1161 ldns_key_keytag(const ldns_key *k)
1162 {
1163         return k->_extra.dnssec.keytag;
1164 }
1165
1166 ldns_rdf *
1167 ldns_key_pubkey_owner(const ldns_key *k)
1168 {
1169         return k->_pubkey_owner;
1170 }
1171
1172 /* write */
1173 void
1174 ldns_key_list_set_use(ldns_key_list *keys, bool v)
1175 {
1176         size_t i;
1177
1178         for (i = 0; i < ldns_key_list_key_count(keys); i++) {
1179                 ldns_key_set_use(ldns_key_list_key(keys, i), v);
1180         }
1181 }
1182
1183 void            
1184 ldns_key_list_set_key_count(ldns_key_list *key, size_t count)
1185 {
1186                 key->_key_count = count;
1187 }       
1188
1189 bool             
1190 ldns_key_list_push_key(ldns_key_list *key_list, ldns_key *key)
1191 {       
1192         size_t key_count;
1193         ldns_key **keys;
1194
1195         key_count = ldns_key_list_key_count(key_list);
1196
1197         /* grow the array */
1198         keys = LDNS_XREALLOC(
1199                 key_list->_keys, ldns_key *, key_count + 1);
1200         if (!keys) {
1201                 return false;
1202         }
1203
1204         /* add the new member */
1205         key_list->_keys = keys;
1206         key_list->_keys[key_count] = key;
1207
1208         ldns_key_list_set_key_count(key_list, key_count + 1);
1209         return true;
1210 }
1211
1212 ldns_key *
1213 ldns_key_list_pop_key(ldns_key_list *key_list)
1214 {                               
1215         size_t key_count;
1216         ldns_key** a;
1217         ldns_key *pop;
1218
1219         if (!key_list) {
1220                 return NULL;
1221         }
1222         
1223         key_count = ldns_key_list_key_count(key_list);
1224         if (key_count == 0) {
1225                 return NULL;
1226         }       
1227         
1228         pop = ldns_key_list_key(key_list, key_count);
1229         
1230         /* shrink the array */
1231         a = LDNS_XREALLOC(key_list->_keys, ldns_key *, key_count - 1);
1232         if(a) {
1233                 key_list->_keys = a;
1234         }
1235
1236         ldns_key_list_set_key_count(key_list, key_count - 1);
1237
1238         return pop;
1239 }       
1240
1241 #ifdef HAVE_SSL
1242 #ifndef S_SPLINT_S
1243 /* data pointer must be large enough (LDNS_MAX_KEYLEN) */
1244 static bool
1245 ldns_key_rsa2bin(unsigned char *data, RSA *k, uint16_t *size)
1246 {
1247         int i,j;
1248         
1249         if (!k) {
1250                 return false;
1251         }
1252         
1253         if (BN_num_bytes(k->e) <= 256) {
1254                 /* normally only this path is executed (small factors are
1255                  * more common 
1256                  */
1257                 data[0] = (unsigned char) BN_num_bytes(k->e);
1258                 i = BN_bn2bin(k->e, data + 1);  
1259                 j = BN_bn2bin(k->n, data + i + 1);
1260                 *size = (uint16_t) i + j;
1261         } else if (BN_num_bytes(k->e) <= 65536) {
1262                 data[0] = 0;
1263                 /* BN_bn2bin does bigendian, _uint16 also */
1264                 ldns_write_uint16(data + 1, (uint16_t) BN_num_bytes(k->e)); 
1265
1266                 BN_bn2bin(k->e, data + 3); 
1267                 BN_bn2bin(k->n, data + 4 + BN_num_bytes(k->e));
1268                 *size = (uint16_t) BN_num_bytes(k->n) + 6;
1269         } else {
1270                 return false;
1271         }
1272         return true;
1273 }
1274
1275 /* data pointer must be large enough (LDNS_MAX_KEYLEN) */
1276 static bool
1277 ldns_key_dsa2bin(unsigned char *data, DSA *k, uint16_t *size)
1278 {
1279         uint8_t T;
1280
1281         if (!k) {
1282                 return false;
1283         }
1284         
1285         /* See RFC2536 */
1286         *size = (uint16_t)BN_num_bytes(k->g);
1287         T = (*size - 64) / 8;
1288         memcpy(data, &T, 1);
1289
1290         if (T > 8) {
1291                 fprintf(stderr, "DSA key with T > 8 (ie. > 1024 bits)");
1292                 fprintf(stderr, " not implemented\n");
1293                 return false;
1294         }
1295
1296         /* size = 64 + (T * 8); */
1297         data[0] = (unsigned char)T;
1298         BN_bn2bin(k->q, data + 1 );             /* 20 octects */
1299         BN_bn2bin(k->p, data + 21 );            /* offset octects */
1300         BN_bn2bin(k->g, data + 21 + *size);     /* offset octets */
1301         BN_bn2bin(k->pub_key, data + 21 + *size + *size); /* offset octets */
1302         *size = 21 + (*size * 3);
1303         return true;
1304 }
1305
1306 #ifdef USE_GOST
1307 static bool
1308 ldns_key_gost2bin(unsigned char* data, EVP_PKEY* k, uint16_t* size)
1309 {
1310         int i;
1311         unsigned char* pp = NULL;
1312         if(i2d_PUBKEY(k, &pp) != 37 + 64) {
1313                 /* expect 37 byte(ASN header) and 64 byte(X and Y) */
1314                 CRYPTO_free(pp);
1315                 return false;
1316         }
1317         /* omit ASN header */
1318         for(i=0; i<64; i++)
1319                 data[i] = pp[i+37];
1320         CRYPTO_free(pp);
1321         *size = 64;
1322         return true;
1323 }
1324 #endif /* USE_GOST */
1325 #endif /* splint */
1326 #endif /* HAVE_SSL */
1327
1328 ldns_rr *
1329 ldns_key2rr(const ldns_key *k)
1330 {
1331         /* this function will convert a the keydata contained in
1332          * rsa/dsa pointers to a DNSKEY rr. It will fill in as
1333          * much as it can, but it does not know about key-flags
1334          * for instance
1335          */
1336         ldns_rr *pubkey;
1337         ldns_rdf *keybin;
1338         unsigned char *bin = NULL;
1339         uint16_t size = 0;
1340 #ifdef HAVE_SSL
1341         RSA *rsa = NULL;
1342         DSA *dsa = NULL;
1343 #endif /* HAVE_SSL */
1344 #ifdef USE_ECDSA
1345         EC_KEY* ec;
1346 #endif
1347         int internal_data = 0;
1348
1349         pubkey = ldns_rr_new();
1350         if (!k) {
1351                 return NULL;
1352         }
1353
1354         switch (ldns_key_algorithm(k)) {
1355         case LDNS_SIGN_HMACMD5:
1356         case LDNS_SIGN_HMACSHA1:
1357         case LDNS_SIGN_HMACSHA256:
1358                 ldns_rr_set_type(pubkey, LDNS_RR_TYPE_KEY);
1359                 break;
1360         default:
1361                 ldns_rr_set_type(pubkey, LDNS_RR_TYPE_DNSKEY);
1362                 break;
1363         }
1364         /* zero-th rdf - flags */
1365         ldns_rr_push_rdf(pubkey,
1366                         ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16,
1367                                 ldns_key_flags(k)));
1368         /* first - proto */
1369         ldns_rr_push_rdf(pubkey,
1370                         ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8, LDNS_DNSSEC_KEYPROTO));
1371
1372         if (ldns_key_pubkey_owner(k)) {
1373                 ldns_rr_set_owner(pubkey, ldns_rdf_clone(ldns_key_pubkey_owner(k)));
1374         }
1375
1376         /* third - da algorithm */
1377         switch(ldns_key_algorithm(k)) {
1378                 case LDNS_SIGN_RSAMD5:
1379                 case LDNS_SIGN_RSASHA1:
1380                 case LDNS_SIGN_RSASHA1_NSEC3:
1381                 case LDNS_SIGN_RSASHA256:
1382                 case LDNS_SIGN_RSASHA512:
1383                         ldns_rr_push_rdf(pubkey,
1384                                                   ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
1385 #ifdef HAVE_SSL
1386                         rsa =  ldns_key_rsa_key(k);
1387                         if (rsa) {
1388                                 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
1389                                 if (!bin) {
1390                                         ldns_rr_free(pubkey);
1391                                         return NULL;
1392                                 }
1393                                 if (!ldns_key_rsa2bin(bin, rsa, &size)) {
1394                                         LDNS_FREE(bin);
1395                                         ldns_rr_free(pubkey);
1396                                         return NULL;
1397                                 }
1398                                 RSA_free(rsa);
1399                                 internal_data = 1;
1400                         }
1401 #endif
1402                         size++;
1403                         break;
1404                 case LDNS_SIGN_DSA:
1405                         ldns_rr_push_rdf(pubkey,
1406                                         ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, LDNS_DSA));
1407 #ifdef HAVE_SSL
1408                         dsa = ldns_key_dsa_key(k);
1409                         if (dsa) {
1410                                 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
1411                                 if (!bin) {
1412                                         ldns_rr_free(pubkey);
1413                                         return NULL;
1414                                 }
1415                                 if (!ldns_key_dsa2bin(bin, dsa, &size)) {
1416                                         LDNS_FREE(bin);
1417                                         ldns_rr_free(pubkey);
1418                                         return NULL;
1419                                 }
1420                                 DSA_free(dsa);
1421                                 internal_data = 1;
1422                         }
1423 #endif /* HAVE_SSL */
1424                         break;
1425                 case LDNS_SIGN_DSA_NSEC3:
1426                         ldns_rr_push_rdf(pubkey,
1427                                         ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, LDNS_DSA_NSEC3));
1428 #ifdef HAVE_SSL
1429                         dsa = ldns_key_dsa_key(k);
1430                         if (dsa) {
1431                                 bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
1432                                 if (!bin) {
1433                                         ldns_rr_free(pubkey);
1434                                         return NULL;
1435                                 }
1436                                 if (!ldns_key_dsa2bin(bin, dsa, &size)) {
1437                                         LDNS_FREE(bin);
1438                                         ldns_rr_free(pubkey);
1439                                         return NULL;
1440                                 }
1441                                 DSA_free(dsa);
1442                                 internal_data = 1;
1443                         }
1444 #endif /* HAVE_SSL */
1445                         break;
1446                 case LDNS_SIGN_ECC_GOST:
1447                         ldns_rr_push_rdf(pubkey, ldns_native2rdf_int8(
1448                                 LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
1449 #if defined(HAVE_SSL) && defined(USE_GOST)
1450                         bin = LDNS_XMALLOC(unsigned char, LDNS_MAX_KEYLEN);
1451                         if (!bin) {
1452                                 ldns_rr_free(pubkey);
1453                                 return NULL;
1454                         }
1455 #ifndef S_SPLINT_S
1456                         if (!ldns_key_gost2bin(bin, k->_key.key, &size)) {
1457                                 LDNS_FREE(bin);
1458                                 ldns_rr_free(pubkey);
1459                                 return NULL;
1460                         }
1461 #endif /* splint */
1462                         internal_data = 1;
1463 #endif /* HAVE_SSL and USE_GOST */
1464                         break;
1465 #ifdef USE_ECDSA
1466                 case LDNS_SIGN_ECDSAP256SHA256:
1467                 case LDNS_SIGN_ECDSAP384SHA384:
1468                         ldns_rr_push_rdf(pubkey, ldns_native2rdf_int8(
1469                                 LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
1470                         bin = NULL;
1471 #ifndef S_SPLINT_S
1472                         ec = EVP_PKEY_get1_EC_KEY(k->_key.key);
1473 #endif
1474                         EC_KEY_set_conv_form(ec, POINT_CONVERSION_UNCOMPRESSED);
1475                         size = (uint16_t)i2o_ECPublicKey(ec, NULL);
1476                         if(!i2o_ECPublicKey(ec, &bin)) {
1477                                 EC_KEY_free(ec);
1478                                 ldns_rr_free(pubkey);
1479                                 return NULL;
1480                         }
1481                         if(size > 1) {
1482                                 /* move back one byte to shave off the 0x02
1483                                  * 'uncompressed' indicator that openssl made
1484                                  * Actually its 0x04 (from implementation).
1485                                  */
1486                                 assert(bin[0] == POINT_CONVERSION_UNCOMPRESSED);
1487                                 size -= 1;
1488                                 memmove(bin, bin+1, size);
1489                         }
1490                         /* down the reference count for ec, its still assigned
1491                          * to the pkey */
1492                         EC_KEY_free(ec);
1493                         internal_data = 1;
1494                         break;
1495 #endif
1496                 case LDNS_SIGN_HMACMD5:
1497                 case LDNS_SIGN_HMACSHA1:
1498                 case LDNS_SIGN_HMACSHA256:
1499                         bin = LDNS_XMALLOC(unsigned char, ldns_key_hmac_size(k));
1500                         if (!bin) {
1501                                 ldns_rr_free(pubkey);
1502                                 return NULL;
1503                         }
1504                         ldns_rr_push_rdf(pubkey,
1505                                          ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG,
1506                                          ldns_key_algorithm(k)));
1507                         size = ldns_key_hmac_size(k);
1508                         memcpy(bin, ldns_key_hmac_key(k), size);
1509                         internal_data = 1;
1510                         break;
1511         }
1512         /* fourth the key bin material */
1513         if (internal_data) {
1514                 keybin = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, size, bin);
1515                 LDNS_FREE(bin);
1516                 ldns_rr_push_rdf(pubkey, keybin);
1517         }
1518         return pubkey;
1519 }
1520
1521 void
1522 ldns_key_free(ldns_key *key)
1523 {
1524         LDNS_FREE(key);
1525 }
1526
1527 void
1528 ldns_key_deep_free(ldns_key *key)
1529 {
1530         if (ldns_key_pubkey_owner(key)) {
1531                 ldns_rdf_deep_free(ldns_key_pubkey_owner(key));
1532         }
1533 #ifdef HAVE_SSL
1534         if (ldns_key_evp_key(key)) {
1535                 EVP_PKEY_free(ldns_key_evp_key(key));
1536         }
1537 #endif /* HAVE_SSL */
1538         if (ldns_key_hmac_key(key)) {
1539                 free(ldns_key_hmac_key(key));
1540         }
1541         LDNS_FREE(key);
1542 }
1543
1544 void
1545 ldns_key_list_free(ldns_key_list *key_list)
1546 {
1547         size_t i;
1548         for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1549                 ldns_key_deep_free(ldns_key_list_key(key_list, i));
1550         }
1551         LDNS_FREE(key_list->_keys);
1552         LDNS_FREE(key_list);
1553 }
1554
1555 ldns_rr *
1556 ldns_read_anchor_file(const char *filename)
1557 {
1558         FILE *fp;
1559         /*char line[LDNS_MAX_PACKETLEN];*/
1560         char *line = LDNS_XMALLOC(char, LDNS_MAX_PACKETLEN);
1561         int c;
1562         size_t i = 0;
1563         ldns_rr *r;
1564         ldns_status status;
1565         if(!line) {
1566                 return NULL;
1567         }
1568
1569         fp = fopen(filename, "r");
1570         if (!fp) {
1571                 fprintf(stderr, "Unable to open %s: %s\n", filename, strerror(errno));
1572                 LDNS_FREE(line);
1573                 return NULL;
1574         }
1575         
1576         while ((c = fgetc(fp)) && i+1 < LDNS_MAX_PACKETLEN && c != EOF) {
1577                 line[i] = c;
1578                 i++;
1579         }
1580         line[i] = '\0';
1581         
1582         fclose(fp);
1583         
1584         if (i <= 0) {
1585                 fprintf(stderr, "nothing read from %s", filename);
1586                 LDNS_FREE(line);
1587                 return NULL;
1588         } else {
1589                 status = ldns_rr_new_frm_str(&r, line, 0, NULL, NULL);
1590                 if (status == LDNS_STATUS_OK && (ldns_rr_get_type(r) == LDNS_RR_TYPE_DNSKEY || ldns_rr_get_type(r) == LDNS_RR_TYPE_DS)) {
1591                         LDNS_FREE(line);
1592                         return r;
1593                 } else {
1594                         fprintf(stderr, "Error creating DNSKEY or DS rr from %s: %s\n", filename, ldns_get_errorstr_by_id(status));
1595                         LDNS_FREE(line);
1596                         return NULL;
1597                 }
1598         }
1599 }
1600
1601 char *
1602 ldns_key_get_file_base_name(ldns_key *key)
1603 {
1604         ldns_buffer *buffer;
1605         char *file_base_name;
1606         
1607         buffer = ldns_buffer_new(255);
1608         ldns_buffer_printf(buffer, "K");
1609         (void)ldns_rdf2buffer_str_dname(buffer, ldns_key_pubkey_owner(key));
1610         ldns_buffer_printf(buffer,
1611                            "+%03u+%05u",
1612                            ldns_key_algorithm(key),
1613                            ldns_key_keytag(key));
1614         file_base_name = strdup(ldns_buffer_export(buffer));
1615         ldns_buffer_free(buffer);
1616         return file_base_name;
1617 }
1618
1619 int ldns_key_algo_supported(int algo)
1620 {
1621         ldns_lookup_table *lt = ldns_signing_algorithms;
1622         while(lt->name) {
1623                 if(lt->id == algo)
1624                         return 1;
1625                 lt++;
1626         }
1627         return 0;
1628 }
1629
1630 ldns_signing_algorithm ldns_get_signing_algorithm_by_name(const char* name)
1631 {
1632         /* list of (signing algorithm id, alias_name) */
1633         ldns_lookup_table aliases[] = {
1634                 /* from bind dnssec-keygen */
1635                 {LDNS_SIGN_HMACMD5, "HMAC-MD5"},
1636                 {LDNS_SIGN_DSA_NSEC3, "NSEC3DSA"},
1637                 {LDNS_SIGN_RSASHA1_NSEC3, "NSEC3RSASHA1"},
1638                 /* old ldns usage, now RFC names */
1639                 {LDNS_SIGN_DSA_NSEC3, "DSA_NSEC3" },
1640                 {LDNS_SIGN_RSASHA1_NSEC3, "RSASHA1_NSEC3" },
1641 #ifdef USE_GOST
1642                 {LDNS_SIGN_ECC_GOST, "GOST"},
1643 #endif
1644                 /* compat with possible output */
1645                 {LDNS_DH, "DH"},
1646                 {LDNS_ECC, "ECC"},
1647                 {LDNS_INDIRECT, "INDIRECT"},
1648                 {LDNS_PRIVATEDNS, "PRIVATEDNS"},
1649                 {LDNS_PRIVATEOID, "PRIVATEOID"},
1650                 {0, NULL}};
1651         ldns_lookup_table* lt = ldns_signing_algorithms;
1652         while(lt->name) {
1653                 if(strcasecmp(lt->name, name) == 0)
1654                         return lt->id;
1655                 lt++;
1656         }
1657         lt = aliases;
1658         while(lt->name) {
1659                 if(strcasecmp(lt->name, name) == 0)
1660                         return lt->id;
1661                 lt++;
1662         }
1663         if(atoi(name) != 0)
1664                 return atoi(name);
1665         return 0;
1666 }