Changeset 1905

Timestamp:

01/25/11 08:51:55 (2 years ago)

Author:

ahu

Message:

'multi-algorithm support' - for now we still only do RSA, but the whole signer stuff has been abstracted out, and we could in theory add KnapsackCRC32 code!
Or of course ECDSA or GOST ;-)

Location:

trunk/pdns/pdns

Files:

• dbdnsseckeeper.cc (modified) (4 diffs)
• dnssecinfra.cc (modified) (12 diffs)
• dnssecinfra.hh (modified) (7 diffs)
• dnssecsigner.cc (modified) (2 diffs)
• nsecrecords.cc (modified) (1 diff)
• pdnssec.cc (modified) (4 diffs)

trunk/pdns/pdns/dbdnsseckeeper.cc

@@ -81 +81 @@
   if(!bits)
     bits = keyOrZone ? 2048 : 1024;
-  DNSSECPrivateKey dpk;
-  dpk.d_key.create(bits); 
-  dpk.d_algorithm = algorithm;
-  dpk.d_flags = keyOrZone ? 257 : 256;
-  addKey(name, dpk, active);
+  DNSSECPrivateKey dspk;
+  shared_ptr<DNSPrivateKey> dpk(new RSADNSPrivateKey); // defaults to RSA for now, could be smart w/algorithm! XXX FIXME
+  dpk->create(bits);
+  dspk.setKey(dpk);
+  dspk.d_algorithm = algorithm;
+  dspk.d_flags = keyOrZone ? 257 : 256;
+  addKey(name, dspk, active);
 }
 
@@ -107 +109 @@
   kd.flags = dpk.d_flags; // the dpk doesn't get stored, only they key part
   kd.active = active;
-  kd.content = dpk.d_key.convertToISC(dpk.d_algorithm);
+  kd.content = dpk.getKey()->convertToISC(dpk.d_algorithm);
  // now store it
   d_db.addDomainKey(name, kd);
@@ -128 +130 @@
     
     DNSSECPrivateKey dpk;
-    DNSKEYRecordContent dkrc = getRSAKeyFromISCString(&dpk.d_key.getContext(), kd.content);
+    DNSKEYRecordContent dkrc;
+    dpk.setKey(shared_ptr<DNSPrivateKey>(DNSPrivateKey::fromISCString(dkrc, kd.content)));
     dpk.d_flags = kd.flags;
     dpk.d_algorithm = dkrc.d_algorithm;
@@ -273 +276 @@
     DNSSECPrivateKey dpk;
 
-    DNSKEYRecordContent dkrc=getRSAKeyFromISCString(&dpk.d_key.getContext(), kd.content);
+    DNSKEYRecordContent dkrc;
+    dpk.setKey(shared_ptr<DNSPrivateKey>(DNSPrivateKey::fromISCString(dkrc, kd.content)));
     dpk.d_flags = kd.flags;
     dpk.d_algorithm = dkrc.d_algorithm;

trunk/pdns/pdns/dnssecinfra.cc

@@ -23 +23 @@
 using namespace boost::assign;
 
-void RSAContext::create(unsigned int bits)
+void RSADNSPrivateKey::create(unsigned int bits)
 {
   havege_state hs;
@@ -34 +34 @@
 }
 
-std::string RSAContext::getPubKeyHash()
+std::string RSADNSPrivateKey::getPubKeyHash() const
 {
   unsigned char hash[20];
@@ -50 +50 @@
 }
 
-std::string RSAContext::convertToISC(unsigned int algorithm) const
+std::string RSADNSPrivateKey::sign(const std::string& hash) const
+{
+  unsigned char signature[mpi_size(&d_context.N)];
+  int ret=rsa_pkcs1_sign(const_cast<rsa_context*>(&d_context), RSA_PRIVATE, 
+    hash.size()==20 ? SIG_RSA_SHA1 : SIG_RSA_SHA256, 
+    hash.size(),
+    (const unsigned char*) hash.c_str(), signature);
+  
+  if(ret!=0) {
+    cerr<<"signing returned: "<<ret<<endl;
+    exit(1);
+  }
+  return string((char*) signature, sizeof(signature));
+}
+
+std::string RSADNSPrivateKey::convertToISC(unsigned int algorithm) const
 {
   string ret;
@@ -90 +105 @@
 
 
-DNSKEYRecordContent getRSAKeyFromISC(rsa_context* rsa, const char* fname)
-{
+DNSPrivateKey* DNSPrivateKey::fromISCFile(DNSKEYRecordContent& drc, const char* fname)
+{
+  string sline, isc, key, value;
+  FILE *fp=fopen(fname, "r");
+  if(!fp) {
+    throw runtime_error("Unable to read file '"+string(fname)+"' for generating DNS Private Key");
+  }
+  int algorithm=0;
+  while(stringfgets(fp, sline)) {
+    tie(key,value)=splitField(sline, ':');
+    if(pdns_iequals(key,"algorithm"))
+      algorithm = atoi(value.c_str());
+    isc.append(sline);
+  }
+  fclose(fp);
+
+  switch(algorithm) {
+    case 5:
+    case 7:
+    case 8:
+    case 10:
+      return RSADNSPrivateKey::fromISCString(drc, isc);
+      break;
+    default: 
+      throw runtime_error("Unknown DNSSEC signature algorithm number "+lexical_cast<string>(algorithm));
+      break;
+  }
+  return 0;
+}
+
+DNSPrivateKey* DNSPrivateKey::fromISCString(DNSKEYRecordContent& drc, const std::string& content)
+{
+  int algorithm = 0;
+  string sline, key, value;
+  istringstream str(content);
+  while(getline(str, sline)) {
+    tie(key,value)=splitField(sline, ':');
+    if(pdns_iequals(key,"algorithm")) {
+      algorithm = atoi(value.c_str());
+      break;
+    }
+  }
+  switch(algorithm) {
+    case 5:
+    case 7:
+    case 8:
+    case 10:
+      return RSADNSPrivateKey::fromISCString(drc, content);
+      break;
+    default: 
+      throw runtime_error("Unknown DNSSEC signature algorithm number "+lexical_cast<string>(algorithm));
+      break;
+  }
+  return 0;
+}
+
+DNSPrivateKey* RSADNSPrivateKey::fromISCString(DNSKEYRecordContent& drc, const std::string& content)
+{
+  RSADNSPrivateKey* ret = new RSADNSPrivateKey();
+  
   string sline;
   string key,value;
   map<string, mpi*> places;
-
-  FILE *fp=fopen(fname, "r");
-  if(!fp)
-    unixDie("opening file '"+string(fname)+"'");
-
-  rsa_init(rsa, RSA_PKCS_V15, 0, NULL, NULL );
-
-  places["Modulus"]=&rsa->N;
-  places["PublicExponent"]=&rsa->E;
-  places["PrivateExponent"]=&rsa->D;
-  places["Prime1"]=&rsa->P;
-  places["Prime2"]=&rsa->Q;
-  places["Exponent1"]=&rsa->DP;
-  places["Exponent2"]=&rsa->DQ;
-  places["Coefficient"]=&rsa->QP;
-
+  
+  rsa_init(&ret->d_context, RSA_PKCS_V15, 0, NULL, NULL );
+
+  places["Modulus"]=&ret->d_context.N;
+  places["PublicExponent"]=&ret->d_context.E;
+  places["PrivateExponent"]=&ret->d_context.D;
+  places["Prime1"]=&ret->d_context.P;
+  places["Prime2"]=&ret->d_context.Q;
+  places["Exponent1"]=&ret->d_context.DP;
+  places["Exponent2"]=&ret->d_context.DQ;
+  places["Coefficient"]=&ret->d_context.QP;
+
+  string modulus, exponent;
+  istringstream str(content);
   unsigned char decoded[1024];
-  DNSKEYRecordContent drc;
-  string modulus, exponent;
-  while(stringfgets(fp, sline)) {
+  while(getline(str, sline)) {
     tie(key,value)=splitField(sline, ':');
     trim(value);
-    trim(key);
-    if(key.empty())
-      continue;
+
     if(places.count(key)) {
       if(places[key]) {
@@ -137 +204 @@
     }
     else {
-      if(key=="Algorithm") {
+      if(key == "Algorithm") 
         drc.d_algorithm = atoi(value.c_str());
-      }
       else if(key != "Private-key-format")
         cerr<<"Unknown field '"<<key<<"'\n";
     }
   }
-  rsa->len = ( mpi_msb( &rsa->N ) + 7 ) >> 3; // no clue what this does
+  ret->d_context.len = ( mpi_msb( &ret->d_context.N ) + 7 ) >> 3; // no clue what this does
 
   if(exponent.length() < 255) 
@@ -156 +222 @@
   drc.d_key.append(modulus);
   drc.d_protocol=3;
-  fclose(fp);
-  return drc;
-}
-
-DNSKEYRecordContent getRSAKeyFromISCString(rsa_context* rsa, const std::string& content)
-{
-  string sline;
-  string key,value;
-  map<string, mpi*> places;
-
-  
-  rsa_init(rsa, RSA_PKCS_V15, 0, NULL, NULL );
-
-  places["Modulus"]=&rsa->N;
-  places["PublicExponent"]=&rsa->E;
-  places["PrivateExponent"]=&rsa->D;
-  places["Prime1"]=&rsa->P;
-  places["Prime2"]=&rsa->Q;
-  places["Exponent1"]=&rsa->DP;
-  places["Exponent2"]=&rsa->DQ;
-  places["Coefficient"]=&rsa->QP;
-
-  DNSKEYRecordContent drc;
-  string modulus, exponent;
-  istringstream str(content);
-  unsigned char decoded[1024];
-  while(getline(str, sline)) {
-    tie(key,value)=splitField(sline, ':');
-    trim(value);
-
-    if(places.count(key)) {
-      if(places[key]) {
-        int len=sizeof(decoded);
-        if(base64_decode(decoded, &len, (unsigned char*)value.c_str(), value.length()) < 0) {
-          cerr<<"Error base64 decoding '"<<value<<"'\n";
-          exit(1);
-        }
-        //      B64Decode(value, decoded);
-        //      cerr<<key<<" decoded.length(): "<<8*len<<endl;
-        mpi_read_binary(places[key], decoded, len);
-        if(key=="Modulus")
-          modulus.assign((const char*)decoded,len);
-        if(key=="PublicExponent")
-          exponent.assign((const char*)decoded,len);
-      }
-    }
-    else {
-      if(key == "Algorithm") 
-        drc.d_algorithm = atoi(value.c_str());
-      else if(key != "Private-key-format")
-        cerr<<"Unknown field '"<<key<<"'\n";
-    }
-  }
-  rsa->len = ( mpi_msb( &rsa->N ) + 7 ) >> 3; // no clue what this does
-
-  if(exponent.length() < 255) 
-    drc.d_key.assign(1, (char) (unsigned int) exponent.length());
-  else {
-    drc.d_key.assign(1, 0);
-    uint16_t len=htons(exponent.length());
-    drc.d_key.append((char*)&len, 2);
-  }
-  drc.d_key.append(exponent);
-  drc.d_key.append(modulus);
-  drc.d_protocol=3;
-  
-  return drc;
-}
-
-DNSKEYRecordContent getRSAKeyFromPEMString(rsa_context* rsa, const std::string& raw)
+  
+  return ret;
+}
+
+DNSPrivateKey* DNSPrivateKey::fromPEMString(DNSKEYRecordContent& drc, const std::string& raw)
+{
+  return RSADNSPrivateKey::fromPEMString(drc, raw);
+}
+
+DNSPrivateKey* RSADNSPrivateKey::fromPEMString(DNSKEYRecordContent& drc, const std::string& raw)
 {
   vector<string> integers;
@@ -232 +238 @@
   map<int, mpi*> places;
   
-  rsa_init(rsa, RSA_PKCS_V15, 0, NULL, NULL );
-
-  places[1]=&rsa->N;
-  places[2]=&rsa->E;
-  places[3]=&rsa->D;
-  places[4]=&rsa->P;
-  places[5]=&rsa->Q;
-  places[6]=&rsa->DP;
-  places[7]=&rsa->DQ;
-  places[8]=&rsa->QP;
-
-  DNSKEYRecordContent drc;
+  RSADNSPrivateKey* ret = new RSADNSPrivateKey;
+  
+  rsa_init(&ret->d_context, RSA_PKCS_V15, 0, NULL, NULL );
+
+  places[1]=&ret->d_context.N;
+  places[2]=&ret->d_context.E;
+  places[3]=&ret->d_context.D;
+  places[4]=&ret->d_context.P;
+  places[5]=&ret->d_context.Q;
+  places[6]=&ret->d_context.DP;
+  places[7]=&ret->d_context.DQ;
+  places[8]=&ret->d_context.QP;
+
   string modulus, exponent;
   
@@ -257 +264 @@
     }
   }
-  rsa->len = ( mpi_msb( &rsa->N ) + 7 ) >> 3; // no clue what this does
+  ret->d_context.len = ( mpi_msb( &ret->d_context.N ) + 7 ) >> 3; // no clue what this does
 
   if(exponent.length() < 255) 
@@ -270 +277 @@
   drc.d_protocol=3;
   
-  return drc;
-}
-
+  return ret;
+}
 
 void makeRSAPublicKeyFromDNS(rsa_context* rc, const DNSKEYRecordContent& dkrc)
@@ -341 +347 @@
 }
 
-DNSKEYRecordContent makeDNSKEYFromRSAKey(const rsa_context* rc, uint8_t algorithm, uint16_t flags)
+string RSADNSPrivateKey::getPublicKeyString()  const
+{
+  string keystring;
+  char tmp[max(mpi_size(&d_context.E), mpi_size(&d_context.N))];
+
+  mpi_write_binary(&d_context.E, (unsigned char*)tmp, mpi_size(&d_context.E) );
+  string exponent((char*)tmp, mpi_size(&d_context.E));
+
+  mpi_write_binary(&d_context.N, (unsigned char*)tmp, mpi_size(&d_context.N) );
+  string modulus((char*)tmp, mpi_size(&d_context.N));
+
+  if(exponent.length() < 255) 
+    keystring.assign(1, (char) (unsigned int) exponent.length());
+  else {
+    keystring.assign(1, 0);
+    uint16_t len=htons(exponent.length());
+    keystring.append((char*)&len, 2);
+  }
+  keystring.append(exponent);
+  keystring.append(modulus);
+  return keystring;
+}
+
+DNSKEYRecordContent makeDNSKEYFromRSAKey(const DNSPrivateKey* pk, uint8_t algorithm, uint16_t flags)
 {
   DNSKEYRecordContent drc;
-  char tmp[max(mpi_size(&rc->E), mpi_size(&rc->N))];
-
-  //  cerr<<"in makeDNSKEY rsa_check_pubkey: "<<rsa_check_pubkey(rc)<<", bits="<<mpi_size(&rc->N)*8<<endl;
-
-  mpi_write_binary(&rc->E, (unsigned char*)tmp, mpi_size(&rc->E) );
-  string exponent((char*)tmp, mpi_size(&rc->E));
-
-  mpi_write_binary(&rc->N, (unsigned char*)tmp, mpi_size(&rc->N) );
-  string modulus((char*)tmp, mpi_size(&rc->N));
-
-  if(exponent.length() < 255) 
-    drc.d_key.assign(1, (char) (unsigned int) exponent.length());
-  else {
-    drc.d_key.assign(1, 0);
-    uint16_t len=htons(exponent.length());
-    drc.d_key.append((char*)&len, 2);
-  }
-  drc.d_key.append(exponent);
-  drc.d_key.append(modulus);
+  
 
   drc.d_protocol=3;
@@ -368 +379 @@
 
   drc.d_flags=flags;
-
+  drc.d_key = pk->getPublicKeyString();
   return drc;
 }
@@ -415 +426 @@
 DNSKEYRecordContent DNSSECPrivateKey::getDNSKEY() const
 {
-  return makeDNSKEYFromRSAKey(&d_key.getConstContext(), d_algorithm, d_flags);
+  return makeDNSKEYFromRSAKey(getKey(), d_algorithm, d_flags);
 }
 

trunk/pdns/pdns/dnssecinfra.hh

@@ -18 +18 @@
 }
 
-class RSAContext
+class DNSPrivateKey
+{
+  public:
+    virtual void create(unsigned int bits)=0;
+    virtual std::string convertToISC(unsigned int algorithm) const =0;
+    virtual std::string getPubKeyHash()const =0;
+    virtual std::string sign(const std::string& hash) const =0;
+    virtual std::string getPublicKeyString()const =0;
+    virtual int getBits() const =0;
+    
+  static DNSPrivateKey* fromISCFile(DNSKEYRecordContent& drc, const char* fname);
+  static DNSPrivateKey* fromISCString(DNSKEYRecordContent& drc, const std::string& content);
+  static DNSPrivateKey* fromPEMString(DNSKEYRecordContent& drc, const std::string& raw);
+};
+
+class RSADNSPrivateKey : public DNSPrivateKey
 {
 public:
-  RSAContext()
+  RSADNSPrivateKey()
   {
     memset(&d_context, 0, sizeof(d_context));
@@ -28 +43 @@
   }
 
-  ~RSAContext()
+  ~RSADNSPrivateKey()
   {
     PDNSSEC_MF(N); 
@@ -34 +49 @@
   }
 
-  bool operator<(const RSAContext& rhs) const
+  bool operator<(const RSADNSPrivateKey& rhs) const
   {
     return tie(d_context.N, d_context.E, d_context.D, d_context.P, d_context.Q, d_context.DP, d_context.DQ, d_context.QP)
@@ -40 +55 @@
   }
 
-  RSAContext(const RSAContext& orig) 
+  RSADNSPrivateKey(const RSADNSPrivateKey& orig) 
   {
     d_context.ver = orig.d_context.ver;
@@ -54 +69 @@
   }
 
-  RSAContext& operator=(const RSAContext& orig) 
+  RSADNSPrivateKey& operator=(const RSADNSPrivateKey& orig) 
   {
     d_context.ver = orig.d_context.ver;
@@ -84 +99 @@
   void create(unsigned int bits);
   std::string convertToISC(unsigned int algorithm) const;
-  std::string getPubKeyHash();
+  std::string getPubKeyHash() const;
+  std::string sign(const std::string& hash) const; 
+  std::string getPublicKeyString() const;
+  int getBits() const
+  {
+    return mpi_size(&d_context.N)*8;
+  }
+  static DNSPrivateKey* fromISCString(DNSKEYRecordContent& drc, const std::string& content);
+  static DNSPrivateKey* fromPEMString(DNSKEYRecordContent& drc, const std::string& raw);
+
 private:
   rsa_context d_context;
@@ -98 +122 @@
   uint16_t getTag();
   
-  RSAContext d_key;
+  const DNSPrivateKey* getKey() const
+  {
+    return d_key.get();
+  }
+  
+  void setKey(const shared_ptr<DNSPrivateKey> key)
+  {
+    d_key = key;
+  }
   DNSKEYRecordContent getDNSKEY() const;
   uint8_t d_algorithm;
   uint16_t d_flags;
+  
+private:
+  shared_ptr<DNSPrivateKey> d_key;
 };
 

trunk/pdns/pdns/dnssecsigner.cc

@@ -110 +110 @@
 void fillOutRRSIG(DNSSECPrivateKey& dpk, const std::string& signQName, RRSIGRecordContent& rrc, vector<shared_ptr<DNSRecordContent> >& toSign) 
 {
-  DNSKEYRecordContent drc= dpk.getDNSKEY(); 
-  RSAContext& rc = dpk.d_key;
+  DNSKEYRecordContent drc = dpk.getDNSKEY(); 
+  const DNSPrivateKey* rc = dpk.getKey();
   rrc.d_tag = drc.getTag();
   rrc.d_algorithm = drc.d_algorithm;
   string realhash=getHashForRRSET(signQName, rrc, toSign); // this is what we sign
 
-  unsigned char signature[mpi_size(&rc.getContext().N)];
-  pair<string, string> lookup(rc.getPubKeyHash(), realhash);
+  pair<string, string> lookup(rc->getPubKeyHash(), realhash);
   
   {
@@ -130 +129 @@
   }
   
-  int ret=rsa_pkcs1_sign(&rc.getContext(), RSA_PRIVATE, 
-    rrc.d_algorithm < 8 ? SIG_RSA_SHA1 : SIG_RSA_SHA256, 
-    rrc.d_algorithm < 8 ? 20 : 32,
-    (unsigned char*) realhash.c_str(), signature);
-  
-  if(ret!=0) {
-    cerr<<"signing returned: "<<ret<<endl;
-    exit(1);
-  }
-  
-  rrc.d_signature.assign((char*)signature, sizeof(signature));
+  rrc.d_signature = rc->sign(realhash);
 
   Lock l(&g_signatures_lock);

trunk/pdns/pdns/nsecrecords.cc

@@ -66 +66 @@
   for(unsigned int n=0 ; n < len ; ++n) {
     uint8_t val=bitmap[2+n];
-    for(int bit = 0; bit < 8 ; ++bit , val>>=1)
+    for(int bit = 0; bit < 8 ; ++bit , val>>=1) 
       if(val & 1) {
-        ret->d_set.insert((7-bit) + 8*(n));
+        ret->d_set.insert((7-bit) + 8*(n));
       }
   }

trunk/pdns/pdns/pdnssec.cc

@@ -201 +201 @@
     BOOST_FOREACH(DNSSECKeeper::keyset_t::value_type value, keyset) {
       cout<<"ID = "<<value.second.id<<" ("<<(value.second.keyOrZone ? "KSK" : "ZSK")<<"), tag = "<<value.first.getDNSKEY().getTag();
-      cout<<", algo = "<<(int)value.first.d_algorithm<<", bits = "<<value.first.d_key.getConstContext().len*8<<"\tActive: "<<value.second.active<< endl; // humanTime(value.second.beginValidity)<<" - "<<humanTime(value.second.endValidity)<<endl;
+      cout<<", algo = "<<(int)value.first.d_algorithm<<", bits = "<<value.first.getKey()->getBits()<<"\tActive: "<<value.second.active<< endl; // humanTime(value.second.beginValidity)<<" - "<<humanTime(value.second.endValidity)<<endl;
       if(value.second.keyOrZone) {
         cout<<"KSK DNSKEY = "<<zone<<" IN DNSKEY "<< value.first.getDNSKEY().getZoneRepresentation() << endl;
@@ -414 +414 @@
     unsigned int id=atoi(cmds[2].c_str());
     DNSSECPrivateKey dpk=dk.getKeyById(zone, id);
-    cout << dpk.d_key.convertToISC(dpk.d_algorithm) <<endl;
+    cout << dpk.getKey()->convertToISC(dpk.d_algorithm) <<endl;
   }  
   else if(cmds[0]=="import-zone-key-pem") {
@@ -434 +434 @@
     B64Decode(interim, raw);
     DNSSECPrivateKey dpk;
-    getRSAKeyFromPEMString(&dpk.d_key.getContext(), raw);
+    DNSKEYRecordContent drc;
+    shared_ptr<DNSPrivateKey> key(DNSPrivateKey::fromPEMString(drc, raw));
+    dpk.setKey(key);
     
     dpk.d_algorithm = atoi(cmds[3].c_str());
@@ -467 +469 @@
     string fname=cmds[2];
     DNSSECPrivateKey dpk;
-    DNSKEYRecordContent drc = getRSAKeyFromISC(&dpk.d_key.getContext(), fname.c_str());
+    DNSKEYRecordContent drc;
+    shared_ptr<DNSPrivateKey> key(DNSPrivateKey::fromISCFile(drc, fname.c_str()));
+    dpk.setKey(key);
     dpk.d_algorithm = drc.d_algorithm;