Changeset 1909

Timestamp:

01/26/11 00:27:29 (2 years ago)

Author:

ahu

Message:

this huge commit adds support for RSASHA512 & draft-ietf-dnsext-ecdsa using the provisional codepoints, which may still change.
ECDSAP256SHA256 and ECDSAP384SHA384 are supported.. iff you have Botan 1.9.x. Enable with ./configure --enable-botan19
GOST is just around the corner.
Btw: don't run this commit in production pls - normal service will return tomorrow

Location:

trunk/pdns

Files:

• configure.ac (modified) (2 diffs)
• pdns/Makefile.am (modified) (6 diffs)
• pdns/botan19signers.cc (added)
• pdns/dbdnsseckeeper.cc (modified) (3 diffs)
• pdns/dnssecinfra.cc (modified) (11 diffs)
• pdns/dnssecinfra.hh (modified) (3 diffs)
• pdns/pdnssec.cc (modified) (3 diffs)
• pdns/polarrsakeyinfra.cc (added)

trunk/pdns/configure.ac

@@ -119 +119 @@
 AC_MSG_RESULT($enable_verbose_logging)
 
+AC_MSG_CHECKING(whether we will be linking in Botan 1.9)
+AC_ARG_ENABLE(botan1.9, 
+ [  --enable-botan1.9   Use Botan 1.9],enable_botan19=yes, enable_botan19=no)
+AC_MSG_RESULT($enable_botan19)
+AM_CONDITIONAL(BOTAN19,test x"$enable_botan19" = "xyes")
+
+
 AC_MSG_CHECKING(whether we should build static binaries)
 
@@ -191 +198 @@
 
 AC_MSG_RESULT($enable_recursor)
-
 AM_CONDITIONAL(RECURSOR,test x"$enable_recursor" = "xyes")
 

trunk/pdns/pdns/Makefile.am

@@ -11 +11 @@
 if RECURSOR
 sbin_PROGRAMS = pdns_server pdns_recursor
-bin_PROGRAMS = pdns_control  rec_control pdnssec dnsreplay
+bin_PROGRAMS = pdns_control rec_control pdnssec dnsreplay
 else
 sbin_PROGRAMS = pdns_server 
@@ -41 +41 @@
 aes/aestab.c aes/aestab.h aes/brg_endian.h aes/brg_types.h aes/dns_random.cc \
 randomhelper.cc namespaces.hh nsecrecords.cc base32.cc dbdnsseckeeper.cc dnssecinfra.cc \
-dnsseckeeper.hh dnssecinfra.hh base32.hh dns.cc dnssecsigner.cc
+dnsseckeeper.hh dnssecinfra.hh base32.hh dns.cc dnssecsigner.cc polarrsakeyinfra.cc
 
 #
 pdns_server_LDFLAGS=@moduleobjects@ @modulelibs@ @DYNLINKFLAGS@ @LIBDL@ @THREADFLAGS@ $(BOOST_FILESYSTEM_LDFLAGS) -Lext/polarssl/library
 pdns_server_LDADD=$(BOOST_FILESYSTEM_LIBS) -lpolarssl
+
+if BOTAN19
+pdns_server_SOURCES += botan19signers.cc
+pdns_server_LDADD += -lbotan -lgmp
+endif
   
 pdnssec_SOURCES=pdnssec.cc dbdnsseckeeper.cc sstuff.hh dnsparser.cc dnsparser.hh dnsrecords.cc dnswriter.cc dnswriter.hh \
@@ -55 +60 @@
         backends/gsql/gsqlbackend.cc \
         backends/gsql/gsqlbackend.hh backends/gsql/ssql.hh zoneparser-tng.cc \
-        dynlistener.cc dns.cc randombackend.cc dnssecsigner.cc
+        dynlistener.cc dns.cc randombackend.cc dnssecsigner.cc polarrsakeyinfra.cc
 
 pdnssec_LDFLAGS=@moduleobjects@ @modulelibs@ @DYNLINKFLAGS@ @LIBDL@ @THREADFLAGS@ -Lext/polarssl/library/ 
 pdnssec_LDADD=$(BOOST_FILESYSTEM_LIBS) $(BOOST_SYSTEM_LIBS) -lpolarssl $(BOOST_PROGRAM_OPTIONS_LIBS)
+
+if BOTAN19
+pdnssec_SOURCES += botan19signers.cc
+pdnssec_LDADD += -lbotan -lgmp
+endif
 
 sdig_SOURCES=sdig.cc sstuff.hh dnsparser.cc dnsparser.hh dnsrecords.cc dnswriter.cc dnswriter.hh \
@@ -118 +128 @@
 nproxy_SOURCES=nproxy.cc dnsparser.cc dnsrecords.cc dnsparser.hh  \
         rcpgenerator.cc rcpgenerator.hh base64.cc base64.hh dnswriter.cc dnswriter.hh \
-        sillyrecords.cc selectmplexer.cc  mplexer.hh
+        sillyrecords.cc selectmplexer.cc pollmplexer.cc  mplexer.hh
 
 nproxy_LDFLAGS= @DYNLINKFLAGS@ @THREADFLAGS@ $(BOOST_FILESYSTEM_LDFLAGS) $(BOOST_PROGRAM_OPTIONS_LDFLAGS)
@@ -125 +135 @@
 notify_SOURCES=notify.cc dnsparser.cc dnsrecords.cc dnsparser.hh  \
         rcpgenerator.cc rcpgenerator.hh base64.cc base64.hh dnswriter.cc dnswriter.hh \
-        sillyrecords.cc selectmplexer.cc nsecrecords.cc base32.cc misc.cc unix_utility.cc \
+        sillyrecords.cc selectmplexer.cc pollmplexer.cc nsecrecords.cc base32.cc misc.cc unix_utility.cc \
         logger.cc qtype.cc statbag.cc
 
@@ -159 +169 @@
 aes/dns_random.cc aes/aescrypt.c aes/aeskey.c aes/aestab.c aes/aes_modes.c \
 lua-pdns-recursor.cc lua-pdns-recursor.hh randomhelper.cc  \
-recpacketcache.cc recpacketcache.hh dns.cc nsecrecords.cc base32.cc
+recpacketcache.cc recpacketcache.hh dns.cc nsecrecords.cc base32.cc pollmplexer.cc
 
 #../modules/gmysqlbackend/smysql.cc 

trunk/pdns/pdns/dbdnsseckeeper.cc

@@ -79 +79 @@
 void DNSSECKeeper::addKey(const std::string& name, bool keyOrZone, int algorithm, int bits, bool active)
 {
-  if(!bits)
-    bits = keyOrZone ? 2048 : 1024;
+  if(!bits) {
+    if(algorithm <= 10)
+      bits = keyOrZone ? 2048 : 1024;
+    else {
+      if(algorithm == 13)
+        bits = 256;
+      else if(algorithm == 14)
+        bits = 384;
+      else {
+        throw runtime_error("Can't guess key size for algoritm "+lexical_cast<string>(algorithm));
+      }
+    }
+  }
   DNSSECPrivateKey dspk;
-  shared_ptr<DNSPrivateKey> dpk(new RSADNSPrivateKey); // defaults to RSA for now, could be smart w/algorithm! XXX FIXME
+  shared_ptr<DNSPrivateKey> dpk(DNSPrivateKey::make(algorithm)); // defaults to RSA for now, could be smart w/algorithm! XXX FIXME
   dpk->create(bits);
   dspk.setKey(dpk);
@@ -131 +142 @@
     DNSSECPrivateKey dpk;
     DNSKEYRecordContent dkrc;
-    dpk.setKey(shared_ptr<DNSPrivateKey>(DNSPrivateKey::fromISCString(dkrc, kd.content)));
+    dpk.setKey(shared_ptr<DNSPrivateKey>(DNSPrivateKey::makeFromISCString(dkrc, kd.content)));
     dpk.d_flags = kd.flags;
     dpk.d_algorithm = dkrc.d_algorithm;
@@ -277 +288 @@
 
     DNSKEYRecordContent dkrc;
-    dpk.setKey(shared_ptr<DNSPrivateKey>(DNSPrivateKey::fromISCString(dkrc, kd.content)));
+    dpk.setKey(shared_ptr<DNSPrivateKey>(DNSPrivateKey::makeFromISCString(dkrc, kd.content)));
     dpk.d_flags = kd.flags;
     dpk.d_algorithm = dkrc.d_algorithm;

trunk/pdns/pdns/dnssecinfra.cc

@@ -8 +8 @@
 #include <boost/foreach.hpp>
 #include <boost/algorithm/string.hpp>
-#include <polarssl/rsa.h>
-#include <polarssl/base64.h>
+#include "dnssecinfra.hh" 
+#include "dnsseckeeper.hh"
+
 #include <polarssl/sha1.h>
 #include <polarssl/sha2.h>
-#include "dnssecinfra.hh" 
-#include "dnsseckeeper.hh"
-#include <polarssl/havege.h>
-#include <polarssl/base64.h>
+#include <polarssl/sha4.h>
 #include <boost/assign/std/vector.hpp> // for 'operator+=()'
 #include <boost/assign/list_inserter.hpp>
@@ -23 +21 @@
 using namespace boost::assign;
 
-void RSADNSPrivateKey::create(unsigned int bits)
-{
-  havege_state hs;
-  havege_init( &hs );
-  
-  rsa_init(&d_context, RSA_PKCS_V15, 0, havege_rand, &hs ); // FIXME this leaks memory
-  int ret=rsa_gen_key(&d_context, bits, 65537);
-  if(ret < 0) 
-    throw runtime_error("Key generation failed");
-}
-
-std::string RSADNSPrivateKey::getPubKeyHash() const
-{
-  unsigned char hash[20];
-  unsigned char N[mpi_size(&d_context.N)];
-  mpi_write_binary(&d_context.N, N, sizeof(N));
-  unsigned char E[mpi_size(&d_context.E)];
-  mpi_write_binary(&d_context.E, E, sizeof(E));
-  
-  sha1_context ctx;
-  sha1_starts(&ctx);
-  sha1_update(&ctx, N, sizeof(N));
-  sha1_update(&ctx, E, sizeof(E));
-  sha1_finish(&ctx, hash);
-  return string((char*)hash, sizeof(hash));
-}
-
-std::string RSADNSPrivateKey::sign(const std::string& hash) const
-{
-  unsigned char signature[mpi_size(&d_context.N)];
-  int ret=rsa_pkcs1_sign(const_cast<rsa_context*>(&d_context), RSA_PRIVATE, 
-    hash.size()==20 ? SIG_RSA_SHA1 : SIG_RSA_SHA256, 
-    hash.size(),
-    (const unsigned char*) hash.c_str(), signature);
-  
-  if(ret!=0) {
-    cerr<<"signing returned: "<<ret<<endl;
-    exit(1);
-  }
-  return string((char*) signature, sizeof(signature));
-}
-
-std::string RSADNSPrivateKey::convertToISC(unsigned int algorithm) const
-{
-  string ret;
-  typedef vector<pair<string, const mpi*> > outputs_t;
-  outputs_t outputs;
-  push_back(outputs)("Modulus", &d_context.N)("PublicExponent",&d_context.E)
-    ("PrivateExponent",&d_context.D)
-    ("Prime1",&d_context.P)
-    ("Prime2",&d_context.Q)
-    ("Exponent1",&d_context.DP)
-    ("Exponent2",&d_context.DQ)
-    ("Coefficient",&d_context.QP);
-
-  ret = "Private-key-format: v1.2\nAlgorithm: "+lexical_cast<string>(algorithm);
-  switch(algorithm) {
-    case 5:
-    case 7 :
-      ret+= " (RSASHA1)";
-      break;
-    case 8:
-      ret += " (RSASHA256)";
-      break;
-  }
-  ret += "\n";
-
-  BOOST_FOREACH(outputs_t::value_type value, outputs) {
-    ret += value.first;
-    ret += ": ";
-    unsigned char tmp[mpi_size(value.second)];
-    mpi_write_binary(value.second, tmp, sizeof(tmp));
-    unsigned char base64tmp[sizeof(tmp)*2];
-    int dlen=sizeof(base64tmp);
-    base64_encode(base64tmp, &dlen, tmp, sizeof(tmp));
-    ret.append((const char*)base64tmp, dlen);
-    ret.append(1, '\n');
-  }
-  return ret;
-}
-
-
-DNSPrivateKey* DNSPrivateKey::fromISCFile(DNSKEYRecordContent& drc, const char* fname)
+DNSPrivateKey* DNSPrivateKey::makeFromISCFile(DNSKEYRecordContent& drc, const char* fname)
 {
   string sline, isc, key, value;
@@ -121 +37 @@
   fclose(fp);
 
-  switch(algorithm) {
-    case 5:
-    case 7:
-    case 8:
-    case 10:
-      return RSADNSPrivateKey::fromISCString(drc, isc);
-      break;
-    default: 
-      throw runtime_error("Unknown DNSSEC signature algorithm number "+lexical_cast<string>(algorithm));
-      break;
-  }
-  return 0;
-}
-
-DNSPrivateKey* DNSPrivateKey::fromISCString(DNSKEYRecordContent& drc, const std::string& content)
+  DNSPrivateKey* dpk=make(algorithm);
+  dpk->fromISCString(drc, isc);
+  return dpk;
+}
+
+DNSPrivateKey* DNSPrivateKey::make(unsigned int algo)
+{
+  makers_t& makers = getMakers();
+  makers_t::const_iterator iter = makers.find(algo);
+  if(iter != makers.end())
+    return (iter->second)(algo);
+  else {
+    throw runtime_error("Request to create key object for unknown algorithm number "+lexical_cast<string>(algo));
+  }
+}
+
+void DNSPrivateKey::report(unsigned int algo, maker_t* maker)
+{
+  getMakers()[algo]=maker;
+}
+DNSPrivateKey* DNSPrivateKey::makeFromISCString(DNSKEYRecordContent& drc, const std::string& content)
 {
   int algorithm = 0;
@@ -147 +69 @@
     }
   }
-  switch(algorithm) {
-    case 5:
-    case 7:
-    case 8:
-    case 10:
-      return RSADNSPrivateKey::fromISCString(drc, content);
-      break;
-    default: 
-      throw runtime_error("Unknown DNSSEC signature algorithm number "+lexical_cast<string>(algorithm));
-      break;
+  DNSPrivateKey* dpk=make(algorithm);
+  dpk->fromISCString(drc, content);
+  return dpk;
+}
+
+
+DNSPrivateKey* DNSPrivateKey::makeFromPEMString(DNSKEYRecordContent& drc, const std::string& raw)
+{
+  
+  BOOST_FOREACH(makers_t::value_type& val, getMakers())
+  {
+    DNSPrivateKey* ret=0;
+    try {
+      ret = val.second(val.first);
+      ret->fromPEMString(drc, raw);
+      return ret;
+    }
+    catch(...)
+    {
+      delete ret; // fine if 0
+    }
   }
   return 0;
 }
 
-DNSPrivateKey* RSADNSPrivateKey::fromISCString(DNSKEYRecordContent& drc, const std::string& content)
-{
-  RSADNSPrivateKey* ret = new RSADNSPrivateKey();
-  
-  string sline;
-  string key,value;
-  map<string, mpi*> places;
-  
-  rsa_init(&ret->d_context, RSA_PKCS_V15, 0, NULL, NULL );
-
-  places["Modulus"]=&ret->d_context.N;
-  places["PublicExponent"]=&ret->d_context.E;
-  places["PrivateExponent"]=&ret->d_context.D;
-  places["Prime1"]=&ret->d_context.P;
-  places["Prime2"]=&ret->d_context.Q;
-  places["Exponent1"]=&ret->d_context.DP;
-  places["Exponent2"]=&ret->d_context.DQ;
-  places["Coefficient"]=&ret->d_context.QP;
-
-  string modulus, exponent;
-  istringstream str(content);
-  unsigned char decoded[1024];
-  while(getline(str, sline)) {
-    tie(key,value)=splitField(sline, ':');
-    trim(value);
-
-    if(places.count(key)) {
-      if(places[key]) {
-        int len=sizeof(decoded);
-        if(base64_decode(decoded, &len, (unsigned char*)value.c_str(), value.length()) < 0) {
-          cerr<<"Error base64 decoding '"<<value<<"'\n";
-          exit(1);
-        }
-        //      B64Decode(value, decoded);
-        //      cerr<<key<<" decoded.length(): "<<8*len<<endl;
-        mpi_read_binary(places[key], decoded, len);
-        if(key=="Modulus")
-          modulus.assign((const char*)decoded,len);
-        if(key=="PublicExponent")
-          exponent.assign((const char*)decoded,len);
-      }
-    }
-    else {
-      if(key == "Algorithm") 
-        drc.d_algorithm = atoi(value.c_str());
-      else if(key != "Private-key-format")
-        cerr<<"Unknown field '"<<key<<"'\n";
-    }
-  }
-  ret->d_context.len = ( mpi_msb( &ret->d_context.N ) + 7 ) >> 3; // no clue what this does
-
-  if(exponent.length() < 255) 
-    drc.d_key.assign(1, (char) (unsigned int) exponent.length());
-  else {
-    drc.d_key.assign(1, 0);
-    uint16_t len=htons(exponent.length());
-    drc.d_key.append((char*)&len, 2);
-  }
-  drc.d_key.append(exponent);
-  drc.d_key.append(modulus);
-  drc.d_protocol=3;
-  
-  return ret;
-}
-
-DNSPrivateKey* DNSPrivateKey::fromPEMString(DNSKEYRecordContent& drc, const std::string& raw)
-{
-  return RSADNSPrivateKey::fromPEMString(drc, raw);
-}
-
-DNSPrivateKey* RSADNSPrivateKey::fromPEMString(DNSKEYRecordContent& drc, const std::string& raw)
-{
-  vector<string> integers;
-  decodeDERIntegerSequence(raw, integers);
-  cerr<<"Got "<<integers.size()<<" integers"<<endl; 
-  map<int, mpi*> places;
-  
-  RSADNSPrivateKey* ret = new RSADNSPrivateKey;
-  
-  rsa_init(&ret->d_context, RSA_PKCS_V15, 0, NULL, NULL );
-
-  places[1]=&ret->d_context.N;
-  places[2]=&ret->d_context.E;
-  places[3]=&ret->d_context.D;
-  places[4]=&ret->d_context.P;
-  places[5]=&ret->d_context.Q;
-  places[6]=&ret->d_context.DP;
-  places[7]=&ret->d_context.DQ;
-  places[8]=&ret->d_context.QP;
-
-  string modulus, exponent;
-  
-  for(int n = 0; n < 9 ; ++n) {
-    if(places.count(n)) {
-      if(places[n]) {
-        mpi_read_binary(places[n], (const unsigned char*)integers[n].c_str(), integers[n].length());
-        if(n==1)
-          modulus=integers[n];
-        if(n==2)
-          exponent=integers[n];
-      }
-    }
-  }
-  ret->d_context.len = ( mpi_msb( &ret->d_context.N ) + 7 ) >> 3; // no clue what this does
-
-  if(exponent.length() < 255) 
-    drc.d_key.assign(1, (char) (unsigned int) exponent.length());
-  else {
-    drc.d_key.assign(1, 0);
-    uint16_t len=htons(exponent.length());
-    drc.d_key.append((char*)&len, 2);
-  }
-  drc.d_key.append(exponent);
-  drc.d_key.append(modulus);
-  drc.d_protocol=3;
-  
-  return ret;
-}
-
-void makeRSAPublicKeyFromDNS(rsa_context* rc, const DNSKEYRecordContent& dkrc)
-{
-  rsa_init(rc, RSA_PKCS_V15, 0, NULL, NULL );
-
-  mpi_read_binary(&rc->E, (unsigned char*)dkrc.getExponent().c_str(), dkrc.getExponent().length());    // exponent
-  mpi_read_binary(&rc->N, (unsigned char*)dkrc.getModulus().c_str(), dkrc.getModulus().length());    // modulus
-  rc->len = ( mpi_msb( &rc->N ) + 7 ) >> 3; // no clue what this does
-}
 
 bool sharedDNSSECCompare(const shared_ptr<DNSRecordContent>& a, const shared_ptr<DNSRecordContent>& b)
@@ -316 +122 @@
   }
   
-  if(rrc.d_algorithm <= 7 ) {
+  // algorithm 12 needs special GOST hash
+  
+  if(rrc.d_algorithm <= 7 ) {  // RSASHA1
     unsigned char hash[20];
     sha1((unsigned char*)toHash.c_str(), toHash.length(), hash);
     return string((char*)hash, sizeof(hash));
-  } else {
+  } else if(rrc.d_algorithm == 8 || rrc.d_algorithm == 13) { // RSASHA256 or ECDSAP256
     unsigned char hash[32];
     sha2((unsigned char*)toHash.c_str(), toHash.length(), hash, 0);
     return string((char*)hash, sizeof(hash));
+  } else if(rrc.d_algorithm == 10) { // RSASHA512
+    unsigned char hash[64];
+    sha4((unsigned char*)toHash.c_str(), toHash.length(), hash, 0);
+    return string((char*)hash, sizeof(hash));
+  } else if(rrc.d_algorithm == 14) { // ECDSAP384
+    unsigned char hash[48];
+    sha4((unsigned char*)toHash.c_str(), toHash.length(), hash, 1); // == 384
+    return string((char*)hash, sizeof(hash));
+  }
+  else {
+    cerr<<"No idea how to hash for algorithm "<<(int)rrc.d_algorithm<<endl;
+    exit(1);
   }
 }
@@ -347 +167 @@
 }
 
-string RSADNSPrivateKey::getPublicKeyString()  const
-{
-  string keystring;
-  char tmp[max(mpi_size(&d_context.E), mpi_size(&d_context.N))];
-
-  mpi_write_binary(&d_context.E, (unsigned char*)tmp, mpi_size(&d_context.E) );
-  string exponent((char*)tmp, mpi_size(&d_context.E));
-
-  mpi_write_binary(&d_context.N, (unsigned char*)tmp, mpi_size(&d_context.N) );
-  string modulus((char*)tmp, mpi_size(&d_context.N));
-
-  if(exponent.length() < 255) 
-    keystring.assign(1, (char) (unsigned int) exponent.length());
-  else {
-    keystring.assign(1, 0);
-    uint16_t len=htons(exponent.length());
-    keystring.append((char*)&len, 2);
-  }
-  keystring.append(exponent);
-  keystring.append(modulus);
-  return keystring;
-}
-
-DNSKEYRecordContent makeDNSKEYFromRSAKey(const DNSPrivateKey* pk, uint8_t algorithm, uint16_t flags)
+
+DNSKEYRecordContent makeDNSKEYFromDNSPrivateKey(const DNSPrivateKey* pk, uint8_t algorithm, uint16_t flags)
 {
   DNSKEYRecordContent drc;
   
-
   drc.d_protocol=3;
   drc.d_algorithm = algorithm;
@@ -382 +179 @@
   return drc;
 }
-
 
 int countLabels(const std::string& signQName)
@@ -396 +192 @@
 }
 
-
-
 uint32_t getCurrentInception()
 {
@@ -404 +198 @@
   return now;
 }
-
-
 
 std::string hashQNameWithSalt(unsigned int times, const std::string& salt, const std::string& qname)
@@ -426 +218 @@
 DNSKEYRecordContent DNSSECPrivateKey::getDNSKEY() const
 {
-  return makeDNSKEYFromRSAKey(getKey(), d_algorithm, d_flags);
+  return makeDNSKEYFromDNSPrivateKey(getKey(), d_algorithm, d_flags);
 }
 
@@ -503 +295 @@
     if(de.getOffset() - startseq != seqlen)
       throw runtime_error("DER Sequence ended before end of data");
-  }
-  
-}
+  }  
+}

trunk/pdns/pdns/dnssecinfra.hh

@@ -2 +2 @@
 #define PDNS_DNSSECINFRA_HH
 #include "dnsrecords.hh"
-#include <polarssl/rsa.h>
 #include <boost/shared_ptr.hpp>
 #include <string>
 #include <vector>
+#include <map>
 #include "misc.hh"
-
-
-#define PDNSSEC_MI(x) mpi_init(&d_context.x, 0)
-#define PDNSSEC_MC(x) PDNSSEC_MI(x); mpi_copy(&d_context.x, const_cast<mpi*>(&orig.d_context.x))
-#define PDNSSEC_MF(x) mpi_free(&d_context.x, 0)
-
-inline bool operator<(const mpi& a, const mpi& b)
-{
-  return mpi_cmp_mpi(&a, &b) < 0;
-}
 
 class DNSPrivateKey
@@ -28 +18 @@
     virtual int getBits() const =0;
     
-  static DNSPrivateKey* fromISCFile(DNSKEYRecordContent& drc, const char* fname);
-  static DNSPrivateKey* fromISCString(DNSKEYRecordContent& drc, const std::string& content);
-  static DNSPrivateKey* fromPEMString(DNSKEYRecordContent& drc, const std::string& raw);
+    virtual void fromISCString(DNSKEYRecordContent& drc, const std::string& content)=0;
+    virtual void fromPEMString(DNSKEYRecordContent& drc, const std::string& raw)=0;
+    
+    static DNSPrivateKey* makeFromISCFile(DNSKEYRecordContent& drc, const char* fname);
+    static DNSPrivateKey* makeFromISCString(DNSKEYRecordContent& drc, const std::string& content);
+    static DNSPrivateKey* makeFromPEMString(DNSKEYRecordContent& drc, const std::string& raw);
+    static DNSPrivateKey* make(unsigned int algorithm);
+    
+    typedef DNSPrivateKey* maker_t(unsigned int algorithm);
+    
+    static void report(unsigned int algorithm, maker_t* maker);
+  private:
+    
+    typedef std::map<unsigned int, maker_t*> makers_t;
+    
+    static makers_t& getMakers()
+    {
+      static makers_t s_makers;
+      return s_makers;
+    }
+    // need some magic here to pick the right DNSPrivateKey supplier
 };
-
-class RSADNSPrivateKey : public DNSPrivateKey
-{
-public:
-  RSADNSPrivateKey()
-  {
-    memset(&d_context, 0, sizeof(d_context));
-    PDNSSEC_MI(N); 
-    PDNSSEC_MI(E); PDNSSEC_MI(D); PDNSSEC_MI(P); PDNSSEC_MI(Q); PDNSSEC_MI(DP); PDNSSEC_MI(DQ); PDNSSEC_MI(QP); PDNSSEC_MI(RN); PDNSSEC_MI(RP); PDNSSEC_MI(RQ);
-  }
-
-  ~RSADNSPrivateKey()
-  {
-    PDNSSEC_MF(N); 
-    PDNSSEC_MF(E); PDNSSEC_MF(D); PDNSSEC_MF(P); PDNSSEC_MF(Q); PDNSSEC_MF(DP); PDNSSEC_MF(DQ); PDNSSEC_MF(QP); PDNSSEC_MF(RN); PDNSSEC_MF(RP); PDNSSEC_MF(RQ);
-  }
-
-  bool operator<(const RSADNSPrivateKey& rhs) const
-  {
-    return tie(d_context.N, d_context.E, d_context.D, d_context.P, d_context.Q, d_context.DP, d_context.DQ, d_context.QP)
-    < tie(rhs.d_context.N, rhs.d_context.E, rhs.d_context.D, rhs.d_context.P, rhs.d_context.Q, rhs.d_context.DP, rhs.d_context.DQ, rhs.d_context.QP);
-  }
-
-  RSADNSPrivateKey(const RSADNSPrivateKey& orig) 
-  {
-    d_context.ver = orig.d_context.ver;
-    d_context.len = orig.d_context.len;
-
-    d_context.padding = orig.d_context.padding;
-    d_context.hash_id = orig.d_context.hash_id;
-    d_context.f_rng = orig.d_context.f_rng;
-    d_context.p_rng = orig.d_context.p_rng;
-    
-    PDNSSEC_MC(N); 
-    PDNSSEC_MC(E); PDNSSEC_MC(D); PDNSSEC_MC(P); PDNSSEC_MC(Q); PDNSSEC_MC(DP); PDNSSEC_MC(DQ); PDNSSEC_MC(QP); PDNSSEC_MC(RN); PDNSSEC_MC(RP); PDNSSEC_MC(RQ);
-  }
-
-  RSADNSPrivateKey& operator=(const RSADNSPrivateKey& orig) 
-  {
-    d_context.ver = orig.d_context.ver;
-    d_context.len = orig.d_context.len;
-
-    d_context.padding = orig.d_context.padding;
-    d_context.hash_id = orig.d_context.hash_id;
-    d_context.f_rng = orig.d_context.f_rng;
-    d_context.p_rng = orig.d_context.p_rng;
-    
-    PDNSSEC_MF(N); 
-    PDNSSEC_MF(E); PDNSSEC_MF(D); PDNSSEC_MF(P); PDNSSEC_MF(Q); PDNSSEC_MF(DP); PDNSSEC_MF(DQ); PDNSSEC_MF(QP); PDNSSEC_MF(RN); PDNSSEC_MF(RP); PDNSSEC_MF(RQ);
-    
-    PDNSSEC_MC(N); 
-    PDNSSEC_MC(E); PDNSSEC_MC(D); PDNSSEC_MC(P); PDNSSEC_MC(Q); PDNSSEC_MC(DP); PDNSSEC_MC(DQ); PDNSSEC_MC(QP); PDNSSEC_MC(RN); PDNSSEC_MC(RP); PDNSSEC_MC(RQ);
-    return *this;
-  }
-
-  const rsa_context& getConstContext() const
-  {
-    return d_context;
-  }
-
-  rsa_context& getContext() 
-  {
-    return d_context;
-  }
-
-  void create(unsigned int bits);
-  std::string convertToISC(unsigned int algorithm) const;
-  std::string getPubKeyHash() const;
-  std::string sign(const std::string& hash) const; 
-  std::string getPublicKeyString() const;
-  int getBits() const
-  {
-    return mpi_size(&d_context.N)*8;
-  }
-  static DNSPrivateKey* fromISCString(DNSKEYRecordContent& drc, const std::string& content);
-  static DNSPrivateKey* fromPEMString(DNSKEYRecordContent& drc, const std::string& raw);
-
-private:
-  rsa_context d_context;
-};
-
-// see above
-#undef PDNSSEC_MC
-#undef PDNSSEC_MI
-#undef PDNSSEC_MF
 
 struct DNSSECPrivateKey
@@ -156 +79 @@
 };
 
-
-DNSKEYRecordContent getRSAKeyFromISC(rsa_context* rsa, const char* fname);
-DNSKEYRecordContent getRSAKeyFromISCString(rsa_context* rsa, const std::string& content);
-DNSKEYRecordContent getRSAKeyFromPEMString(rsa_context* rsa, const std::string& content);
-void makeRSAPublicKeyFromDNS(rsa_context* rc, const DNSKEYRecordContent& dkrc);
 bool sharedDNSSECCompare(const boost::shared_ptr<DNSRecordContent>& a, const shared_ptr<DNSRecordContent>& b);
 string getHashForRRSET(const std::string& qname, const RRSIGRecordContent& rrc, std::vector<boost::shared_ptr<DNSRecordContent> >& signRecords);
-DNSKEYRecordContent makeDNSKEYFromRSAKey(const rsa_context* rc, uint8_t algorithm, uint16_t flags);
+
 DSRecordContent makeDSFromDNSKey(const std::string& qname, const DNSKEYRecordContent& drc, int digest=1);
 

trunk/pdns/pdns/pdnssec.cc

@@ -312 +312 @@
       else if(pdns_iequals(cmds[n], "rsasha256"))
         algorithm=8;
+      else if(pdns_iequals(cmds[n], "gost"))
+        algorithm=10;
+      else if(pdns_iequals(cmds[n], "ecdsa256"))
+        algorithm=13;
+      else if(pdns_iequals(cmds[n], "ecdsa384"))
+        algorithm=14;
       else if(atoi(cmds[n].c_str()))
         bits = atoi(cmds[n].c_str());
@@ -437 +443 @@
     DNSSECPrivateKey dpk;
     DNSKEYRecordContent drc;
-    shared_ptr<DNSPrivateKey> key(DNSPrivateKey::fromPEMString(drc, raw));
+    shared_ptr<DNSPrivateKey> key(DNSPrivateKey::makeFromPEMString(drc, raw));
     dpk.setKey(key);
     
@@ -472 +478 @@
     DNSSECPrivateKey dpk;
     DNSKEYRecordContent drc;
-    shared_ptr<DNSPrivateKey> key(DNSPrivateKey::fromISCFile(drc, fname.c_str()));
+    shared_ptr<DNSPrivateKey> key(DNSPrivateKey::makeFromISCFile(drc, fname.c_str()));
     dpk.setKey(key);
     dpk.d_algorithm = drc.d_algorithm;