Pi-Hole/dnsmasq
1
0
Fork 0
mirror of https://github.com/pi-hole/dnsmasq.git synced 2025-12-19 10:18:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Explicitize the context of verification algorithm.

Browse Source
This commit is contained in:
Giovanni Bajo
2012-04-25 17:40:47 +02:00
committed by Simon Kelley
parent 28c625572b
commit 366dfcb907
3 changed files with 175 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
src/dnssec-crypto.h
View File

@@ -25,32 +25,25 @@
* alg->verify(key1, 16); * alg->verify(key1, 16);
* alg->verify(key2, 16); * alg->verify(key2, 16);
*/ */
typedef struct VerifyAlgCtx VerifyAlgCtx;
typedef struct typedef struct
{ {
int (*set_signature)(unsigned char *data, unsigned len); int (*set_signature)(VerifyAlgCtx *ctx, unsigned char *data, unsigned len);
void (*begin_data)(void); void (*begin_data)(VerifyAlgCtx *ctx);
void (*add_data)(void *data, unsigned len); void (*add_data)(VerifyAlgCtx *ctx, void *data, unsigned len);
void (*end_data)(void); void (*end_data)(VerifyAlgCtx *ctx);
int (*verify)(unsigned char *key, unsigned key_len); int (*verify)(VerifyAlgCtx *ctx, unsigned char *key, unsigned key_len);
} VerifyAlg; } VerifyAlg;
#define DEFINE_VALG(alg) \ struct VerifyAlgCtx
void alg ## _set_signature(unsigned char *data, unsigned len); \ {
void alg ## _begin_data(void); \ const VerifyAlg *vtbl;
void alg ## _add_data(void *data, unsigned len); \ };
void alg ## _end_data(void); \
int alg ## _verify(unsigned char *key, unsigned key_len) \
/**/
#define VALG_VTABLE(alg) { \ int verifyalg_supported(int algo);
alg ## _set_signature, \ VerifyAlgCtx* verifyalg_alloc(int algo);
alg ## _begin_data, \ void verifyalg_free(VerifyAlgCtx *a);
alg ## _add_data, \
alg ## _end_data, \
alg ## _verify \
} /**/
DEFINE_VALG(rsasha1);
DEFINE_VALG(rsasha256);
#endif /* DNSSEC_CRYPTO_H */ #endif /* DNSSEC_CRYPTO_H */

189
src/dnssec-openssl.c
View File

@@ -1,72 +1,203 @@
#include <string.h> #include <string.h>
#include "dnsmasq.h"
#include "dnssec-crypto.h"
#include <openssl/evp.h> #include <openssl/evp.h>
struct rsasha_state typedef struct VACTX_rsasha1
{ {
VerifyAlgCtx base;
unsigned char *sig;
unsigned siglen;
union
{
EVP_MD_CTX hash;
unsigned char digest[20];
};
} VACTX_rsasha1;
typedef struct VACTX_rsasha256
{
VerifyAlgCtx base;
unsigned char *sig;
unsigned siglen;
union union
{ {
EVP_MD_CTX hash; EVP_MD_CTX hash;
unsigned char digest[32]; unsigned char digest[32];
}; };
unsigned char *sig; } VACTX_rsasha256;
unsigned siglen;
} RSASHA; #define POOL_SIZE 1
static union _Pool
int rsasha1_set_signature(unsigned char *data, unsigned len)
{ {
RSASHA.sig = data; VACTX_rsasha1 rsasha1;
RSASHA.siglen = len; VACTX_rsasha256 rsasha256;
} Pool[POOL_SIZE];
static char pool_used = 0;
static int rsasha1_set_signature(VerifyAlgCtx *ctx_, unsigned char *data, unsigned len)
{
VACTX_rsasha1 *ctx = (VACTX_rsasha1 *)ctx_;
ctx->sig = data;
ctx->siglen = len;
return 1; return 1;
} }
int rsasha256_set_signature(unsigned char *data, unsigned len) static int rsasha256_set_signature(VerifyAlgCtx *ctx_, unsigned char *data, unsigned len)
{ {
RSASHA.sig = data; VACTX_rsasha256 *ctx = (VACTX_rsasha256 *)ctx_;
RSASHA.siglen = len; ctx->sig = data;
ctx->siglen = len;
return 1; return 1;
} }
void rsasha1_begin_data(void) static void rsasha1_begin_data(VerifyAlgCtx *ctx_)
{ {
EVP_MD_CTX_init(&RSASHA.hash); VACTX_rsasha1 *ctx = (VACTX_rsasha1 *)ctx_;
EVP_DigestInit_ex(&RSASHA.hash, EVP_sha1(), NULL); EVP_MD_CTX_init(&ctx->hash);
EVP_DigestInit_ex(&ctx->hash, EVP_sha1(), NULL);
} }
void rsasha256_begin_data(void) static void rsasha256_begin_data(VerifyAlgCtx *ctx_)
{ {
EVP_MD_CTX_init(&RSASHA.hash); VACTX_rsasha256 *ctx = (VACTX_rsasha256 *)ctx_;
EVP_DigestInit_ex(&RSASHA.hash, EVP_sha256(), NULL); EVP_MD_CTX_init(&ctx->hash);
EVP_DigestInit_ex(&ctx->hash, EVP_sha256(), NULL);
} }
void rsasha1_add_data(void *data, unsigned len) static void rsasha1_add_data(VerifyAlgCtx *ctx_, void *data, unsigned len)
{ {
EVP_DigestUpdate(&RSASHA.hash, data, len); VACTX_rsasha1 *ctx = (VACTX_rsasha1 *)ctx_;
EVP_DigestUpdate(&ctx->hash, data, len);
} }
void rsasha256_add_data(void *data, unsigned len) static void rsasha256_add_data(VerifyAlgCtx *ctx_, void *data, unsigned len)
{ {
EVP_DigestUpdate(&RSASHA.hash, data, len); VACTX_rsasha256 *ctx = (VACTX_rsasha256 *)ctx_;
EVP_DigestUpdate(&ctx->hash, data, len);
} }
void rsasha1_end_data(void) static void rsasha1_end_data(VerifyAlgCtx *ctx_)
{ {
VACTX_rsasha1 *ctx = (VACTX_rsasha1 *)ctx_;
unsigned char digest[20]; unsigned char digest[20];
EVP_DigestFinal(&RSASHA.hash, digest, NULL); EVP_DigestFinal(&ctx->hash, digest, NULL);
memcpy(RSASHA.digest, digest, 20); memcpy(ctx->digest, digest, 20);
} }
void rsasha256_end_data(void) static void rsasha256_end_data(VerifyAlgCtx *ctx_)
{ {
VACTX_rsasha256 *ctx = (VACTX_rsasha256 *)ctx_;
unsigned char digest[32]; unsigned char digest[32];
EVP_DigestFinal(&RSASHA.hash, digest, NULL); EVP_DigestFinal(&ctx->hash, digest, NULL);
memcpy(RSASHA.digest, digest, 32); memcpy(ctx->digest, digest, 32);
} }
int rsasha1_verify(unsigned char *key, unsigned key_len) static int rsasha1_verify(VerifyAlgCtx *ctx_, unsigned char *key, unsigned key_len)
{ {
VACTX_rsasha1 *ctx = (VACTX_rsasha1 *)ctx_;
return 0; return 0;
} }
int rsasha256_verify(unsigned char *key, unsigned key_len) static int rsasha256_verify(VerifyAlgCtx *ctx_, unsigned char *key, unsigned key_len)
{ {
VACTX_rsasha256 *ctx = (VACTX_rsasha256 *)ctx_;
return 0; return 0;
} }
#define DEFINE_VALG(alg) \
int alg ## _set_signature(VerifyAlgCtx *ctx, unsigned char *data, unsigned len); \
void alg ## _begin_data(VerifyAlgCtx *ctx); \
void alg ## _add_data(VerifyAlgCtx *ctx, void *data, unsigned len); \
void alg ## _end_data(VerifyAlgCtx *ctx); \
int alg ## _verify(VerifyAlgCtx *ctx, unsigned char *key, unsigned key_len) \
/**/
#define VALG_VTABLE(alg) { \
alg ## _set_signature, \
alg ## _begin_data, \
alg ## _add_data, \
alg ## _end_data, \
alg ## _verify \
} /**/
DEFINE_VALG(rsasha1);
DEFINE_VALG(rsasha256);
/* Updated registry that merges various RFCs:
https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xml */
static const VerifyAlg valgs[] =
{
{0,0,0,0,0}, /* 0: reserved */
{0,0,0,0,0}, /* 1: RSAMD5 */
{0,0,0,0,0}, /* 2: DH */
{0,0,0,0,0}, /* 3: DSA */
{0,0,0,0,0}, /* 4: ECC */
VALG_VTABLE(rsasha1), /* 5: RSASHA1 */
{0,0,0,0,0}, /* 6: DSA-NSEC3-SHA1 */
{0,0,0,0,0}, /* 7: RSASHA1-NSEC3-SHA1 */
VALG_VTABLE(rsasha256), /* 8: RSASHA256 */
{0,0,0,0,0}, /* 9: unassigned */
{0,0,0,0,0}, /* 10: RSASHA512 */
{0,0,0,0,0}, /* 11: unassigned */
{0,0,0,0,0}, /* 12: ECC-GOST */
{0,0,0,0,0}, /* 13: ECDSAP256SHA256 */
{0,0,0,0,0}, /* 14: ECDSAP384SHA384 */
};
static const int valgctx_size[] =
{
0, /* 0: reserved */
0, /* 1: RSAMD5 */
0, /* 2: DH */
0, /* 3: DSA */
0, /* 4: ECC */
sizeof(VACTX_rsasha1), /* 5: RSASHA1 */
0, /* 6: DSA-NSEC3-SHA1 */
0, /* 7: RSASHA1-NSEC3-SHA1 */
sizeof(VACTX_rsasha256), /* 8: RSASHA256 */
0, /* 9: unassigned */
0, /* 10: RSASHA512 */
0, /* 11: unassigned */
0, /* 12: ECC-GOST */
0, /* 13: ECDSAP256SHA256 */
0, /* 14: ECDSAP384SHA384 */
};
int verifyalg_supported(int algo)
{
return (algo < countof(valgctx_size) && valgctx_size[algo] != 0);
}
VerifyAlgCtx* verifyalg_alloc(int algo)
{
int i;
VerifyAlgCtx *ret = 0;
if (!verifyalg_supported(algo))
return 0;
if (pool_used == (1<<POOL_SIZE)-1)
ret = whine_malloc(valgctx_size[algo]);
else
for (i = 0; i < POOL_SIZE; ++i)
if (!(pool_used & (1 << i)))
{
ret = &Pool[i];
pool_used |= 1 << i;
break;
}
if (ret)
ret->vtbl = &valgs[algo];
return ret;
}
void verifyalg_free(VerifyAlgCtx *a)
{
int pool_idx = ((char*)a - (char*)&Pool[0]) / sizeof(Pool[0]);
if (pool_idx < 0 || pool_idx >= POOL_SIZE)
{
free(a);
return;
}
pool_used &= ~(1 << pool_idx);
}

21
src/dnssec.c
View File

@@ -8,27 +8,6 @@
#define SERIAL_LT -1 #define SERIAL_LT -1
#define SERIAL_GT 1 #define SERIAL_GT 1
/* Updated registry that merges various RFCs:
https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xml */
static const VerifyAlg valgs[] =
{
{0,0,0,0,0}, /* 0: reserved */
{0,0,0,0,0}, /* 1: RSAMD5 */
{0,0,0,0,0}, /* 2: DH */
{0,0,0,0,0}, /* 3: DSA */
{0,0,0,0,0}, /* 4: ECC */
VALG_VTABLE(rsasha1), /* 5: RSASHA1 */
{0,0,0,0,0}, /* 6: DSA-NSEC3-SHA1 */
{0,0,0,0,0}, /* 7: RSASHA1-NSEC3-SHA1 */
VALG_VTABLE(rsasha256), /* 8: RSASHA256 */
{0,0,0,0,0}, /* 9: unassigned */
{0,0,0,0,0}, /* 10: RSASHA512 */
{0,0,0,0,0}, /* 11: unassigned */
{0,0,0,0,0}, /* 12: ECC-GOST */
{0,0,0,0,0}, /* 13: ECDSAP256SHA256 */
{0,0,0,0,0}, /* 14: ECDSAP384SHA384 */
};
/* Implement RFC1982 wrapped compare for 32-bit numbers */ /* Implement RFC1982 wrapped compare for 32-bit numbers */
static int serial_compare_32(unsigned long s1, unsigned long s2) static int serial_compare_32(unsigned long s1, unsigned long s2)
{ {