|
 |
3ce7d3 |
From fb8665aebd79ea33cb255f578544e1738f5bbb58 Mon Sep 17 00:00:00 2001
|
|
|
3ce7d3 |
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Thu, 2 Aug 2018 23:34:45 +0200
|
|
|
3ce7d3 |
Subject: [PATCH 1/2] Squashed commit of the following:
|
|
|
3ce7d3 |
MIME-Version: 1.0
|
|
|
3ce7d3 |
Content-Type: text/plain; charset=UTF-8
|
|
|
3ce7d3 |
Content-Transfer-Encoding: 8bit
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit b49f70ce0575b6b52a71b90fe0376dbf16f92c6b
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Mon Jan 22 14:12:37 2018 +0100
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Update system tests to detect MD5 disabled at runtime
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit 80ceffee4860c24baf70bc9a8653d92731eda2e4
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Thu Aug 2 14:53:54 2018 +0200
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Avoid warning about undefined parameters
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit e4ad4363e3d1acaac58456117579f02761f38fdc
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Wed Jun 20 19:31:19 2018 +0200
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Fix rndc-confgen default algorithm, report true algorithm in usage.
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit 7e629a351010cb75e0589ec361f720085675998c
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Fri Feb 23 21:21:30 2018 +0100
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Cleanup only if initialization was successful
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit 2101b948c77cbcbe07eb4a1e60f3e693b2245ec6
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Mon Feb 5 12:19:28 2018 +0100
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Ensure dst backend is initialized first even before hmac algorithms.
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit 7567c7edde7519115a9ae7e20818c835d3eb1ffe
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Mon Feb 5 12:17:54 2018 +0100
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Skip initialization of MD5 based algorithms if not available.
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit 5782137df6b45a6d900d5a1c250c1257227e917a
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Mon Feb 5 10:21:27 2018 +0100
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Change secalgs skipping to be more safe
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit f2d78729898182d2d19d5064de1bec9b66817159
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Wed Jan 31 18:26:11 2018 +0100
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Skip MD5 algorithm also in case of NULL name
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit 32a2ad4abc7aaca1c257730319ad3c27405d3407
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Wed Jan 31 11:38:12 2018 +0100
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Make MD5 behave like unknown algorithm in TSIG.
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit 13cd3f704dce568fdf24a567be5802b58ac6007b
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Tue Nov 28 20:14:37 2017 +0100
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Select token with most supported functions, instead of demanding it must support all functions
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Initialize PKCS#11 always until successfully initialized
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit a71df74abdca4fe63bcdf542b81a109cf1f495b4
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Mon Jan 22 16:17:44 2018 +0100
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Handle MD5 unavailability from DST
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit dd82cb263efa2753d3ee772972726ea08bcc639b
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Mon Jan 22 14:11:16 2018 +0100
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Check runtime flag from library and applications, fail gracefully.
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit c7b2f87f07ecae75b821a908e29f08a42371e32e
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Mon Jan 22 08:39:08 2018 +0100
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Modify libraries to use isc_md5_available() if PK11_MD5_DISABLE is not
|
|
|
3ce7d3 |
defined.
|
|
|
3ce7d3 |
TODO: pk11.c should accept slot without MD5 support.
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
commit 0b8e470ec636b9e350b5ec3203eb2b4091415fde
|
|
|
3ce7d3 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
3ce7d3 |
Date: Mon Jan 22 07:21:04 2018 +0100
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
Add runtime detection whether MD5 is useable.
|
|
|
3ce7d3 |
---
|
|
|
3ce7d3 |
bin/confgen/keygen.c | 10 ++++-
|
|
|
3ce7d3 |
bin/confgen/rndc-confgen.c | 36 +++++-------------
|
|
|
3ce7d3 |
bin/dig/dig.c | 7 ++--
|
|
|
3ce7d3 |
bin/dig/dighost.c | 14 +++++--
|
|
|
3ce7d3 |
bin/dnssec/dnssec-keygen.c | 14 +++++++
|
|
|
3ce7d3 |
bin/named/config.c | 25 ++++++++++++-
|
|
|
3ce7d3 |
bin/nsupdate/nsupdate.c | 24 +++++++-----
|
|
|
3ce7d3 |
bin/rndc/rndc.c | 3 +-
|
|
|
3ce7d3 |
bin/tests/optional/hash_test.c | 78 ++++++++++++++++++++-------------------
|
|
|
3ce7d3 |
bin/tests/system/tkey/keycreate.c | 3 ++
|
|
|
3ce7d3 |
bin/tests/system/tkey/keydelete.c | 18 ++++++---
|
|
|
3ce7d3 |
lib/bind9/check.c | 10 +++++
|
|
|
3ce7d3 |
lib/dns/dst_api.c | 23 ++++++++----
|
|
|
3ce7d3 |
lib/dns/dst_internal.h | 3 +-
|
|
|
3ce7d3 |
lib/dns/dst_parse.c | 18 +++++++--
|
|
|
3ce7d3 |
lib/dns/hmac_link.c | 20 +++-------
|
|
|
3ce7d3 |
lib/dns/opensslrsa_link.c | 6 +++
|
|
|
3ce7d3 |
lib/dns/pkcs11rsa_link.c | 33 +++++++++++++++--
|
|
|
3ce7d3 |
lib/dns/rcode.c | 21 ++++++++++-
|
|
|
3ce7d3 |
lib/dns/tests/rsa_test.c | 29 ++++++++-------
|
|
|
3ce7d3 |
lib/dns/tests/tsig_test.c | 1 +
|
|
|
3ce7d3 |
lib/dns/tkey.c | 9 +++++
|
|
|
3ce7d3 |
lib/dns/tsec.c | 8 +++-
|
|
|
3ce7d3 |
lib/dns/tsig.c | 17 +++++----
|
|
|
3ce7d3 |
lib/isc/include/isc/md5.h | 3 ++
|
|
|
3ce7d3 |
lib/isc/md5.c | 59 +++++++++++++++++++++++++++++
|
|
|
3ce7d3 |
lib/isc/pk11.c | 58 ++++++++++++++++++++---------
|
|
|
3ce7d3 |
lib/isc/tests/hash_test.c | 9 +++--
|
|
|
3ce7d3 |
lib/isccc/cc.c | 42 +++++++++++++--------
|
|
|
3ce7d3 |
29 files changed, 424 insertions(+), 177 deletions(-)
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
|
|
|
3ce7d3 |
index 453c641dba..11cc54dd46 100644
|
|
|
3ce7d3 |
--- a/bin/confgen/keygen.c
|
|
|
3ce7d3 |
+++ b/bin/confgen/keygen.c
|
|
|
3ce7d3 |
@@ -22,6 +22,7 @@
|
|
|
3ce7d3 |
#include <isc/entropy.h>
|
|
|
3ce7d3 |
#include <isc/file.h>
|
|
|
3ce7d3 |
#include <isc/keyboard.h>
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/mem.h>
|
|
|
3ce7d3 |
#include <isc/print.h>
|
|
|
3ce7d3 |
#include <isc/result.h>
|
|
|
3ce7d3 |
@@ -73,7 +74,7 @@ alg_fromtext(const char *name) {
|
|
|
3ce7d3 |
p = &name[5];
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- if (strcasecmp(p, "md5") == 0)
|
|
|
3ce7d3 |
+ if (strcasecmp(p, "md5") == 0 && isc_md5_available())
|
|
|
3ce7d3 |
return DST_ALG_HMACMD5;
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
if (strcasecmp(p, "sha1") == 0)
|
|
|
3ce7d3 |
@@ -132,6 +133,13 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
|
|
|
3ce7d3 |
switch (alg) {
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
case DST_ALG_HMACMD5:
|
|
|
3ce7d3 |
+ if (isc_md5_available() == ISC_FALSE) {
|
|
|
3ce7d3 |
+ fatal("unsupported algorithm %d\n", alg);
|
|
|
3ce7d3 |
+ } else if (keysize < 1 || keysize > 512) {
|
|
|
3ce7d3 |
+ fatal("keysize %d out of range (must be 1-512)\n",
|
|
|
3ce7d3 |
+ keysize);
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
+ break;
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
case DST_ALG_HMACSHA1:
|
|
|
3ce7d3 |
case DST_ALG_HMACSHA224:
|
|
|
3ce7d3 |
diff --git a/bin/confgen/rndc-confgen.c b/bin/confgen/rndc-confgen.c
|
|
|
3ce7d3 |
index 2925baf32f..d7d8418073 100644
|
|
|
3ce7d3 |
--- a/bin/confgen/rndc-confgen.c
|
|
|
3ce7d3 |
+++ b/bin/confgen/rndc-confgen.c
|
|
|
3ce7d3 |
@@ -35,6 +35,7 @@
|
|
|
3ce7d3 |
#include <isc/file.h>
|
|
|
3ce7d3 |
#include <isc/keyboard.h>
|
|
|
3ce7d3 |
#include <isc/mem.h>
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/net.h>
|
|
|
3ce7d3 |
#include <isc/print.h>
|
|
|
3ce7d3 |
#include <isc/result.h>
|
|
|
3ce7d3 |
@@ -62,7 +63,7 @@ const char *progname;
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
isc_boolean_t verbose = ISC_FALSE;
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
-const char *keyfile, *keydef;
|
|
|
3ce7d3 |
+const char *keyfile, *keydef, *algdef;
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
ISC_PLATFORM_NORETURN_PRE static void
|
|
|
3ce7d3 |
usage(int status) ISC_PLATFORM_NORETURN_POST;
|
|
|
3ce7d3 |
@@ -70,13 +71,12 @@ usage(int status) ISC_PLATFORM_NORETURN_POST;
|
|
|
3ce7d3 |
static void
|
|
|
3ce7d3 |
usage(int status) {
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
-#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
fprintf(stderr, "\
|
|
|
3ce7d3 |
Usage:\n\
|
|
|
3ce7d3 |
%s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
|
|
|
3ce7d3 |
[-s addr] [-t chrootdir] [-u user]\n\
|
|
|
3ce7d3 |
-a: generate just the key clause and write it to keyfile (%s)\n\
|
|
|
3ce7d3 |
- -A alg: algorithm (default hmac-md5)\n\
|
|
|
3ce7d3 |
+ -A alg: algorithm (default %s)\n\
|
|
|
3ce7d3 |
-b bits: from 1 through 512, default 256; total length of the secret\n\
|
|
|
3ce7d3 |
-c keyfile: specify an alternate key file (requires -a)\n\
|
|
|
3ce7d3 |
-k keyname: the name as it will be used in named.conf and rndc.conf\n\
|
|
|
3ce7d3 |
@@ -85,24 +85,7 @@ Usage:\n\
|
|
|
3ce7d3 |
-s addr: the address to which rndc should connect\n\
|
|
|
3ce7d3 |
-t chrootdir: write a keyfile in chrootdir as well (requires -a)\n\
|
|
|
3ce7d3 |
-u user: set the keyfile owner to \"user\" (requires -a)\n",
|
|
|
3ce7d3 |
- progname, keydef);
|
|
|
3ce7d3 |
-#else
|
|
|
3ce7d3 |
- fprintf(stderr, "\
|
|
|
3ce7d3 |
-Usage:\n\
|
|
|
3ce7d3 |
- %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
|
|
|
3ce7d3 |
-[-s addr] [-t chrootdir] [-u user]\n\
|
|
|
3ce7d3 |
- -a: generate just the key clause and write it to keyfile (%s)\n\
|
|
|
3ce7d3 |
- -A alg: algorithm (default hmac-sha256)\n\
|
|
|
3ce7d3 |
- -b bits: from 1 through 512, default 256; total length of the secret\n\
|
|
|
3ce7d3 |
- -c keyfile: specify an alternate key file (requires -a)\n\
|
|
|
3ce7d3 |
- -k keyname: the name as it will be used in named.conf and rndc.conf\n\
|
|
|
3ce7d3 |
- -p port: the port named will listen on and rndc will connect to\n\
|
|
|
3ce7d3 |
- -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
|
|
|
3ce7d3 |
- -s addr: the address to which rndc should connect\n\
|
|
|
3ce7d3 |
- -t chrootdir: write a keyfile in chrootdir as well (requires -a)\n\
|
|
|
3ce7d3 |
- -u user: set the keyfile owner to \"user\" (requires -a)\n",
|
|
|
3ce7d3 |
- progname, keydef);
|
|
|
3ce7d3 |
-#endif
|
|
|
3ce7d3 |
+ progname, keydef, algdef);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
exit (status);
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
@@ -138,13 +121,14 @@ main(int argc, char **argv) {
|
|
|
3ce7d3 |
progname = program;
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
keyname = DEFAULT_KEYNAME;
|
|
|
3ce7d3 |
-#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- alg = DST_ALG_HMACMD5;
|
|
|
3ce7d3 |
-#else
|
|
|
3ce7d3 |
- alg = DST_ALG_HMACSHA256;
|
|
|
3ce7d3 |
-#endif
|
|
|
3ce7d3 |
serveraddr = DEFAULT_SERVER;
|
|
|
3ce7d3 |
port = DEFAULT_PORT;
|
|
|
3ce7d3 |
+ alg = DST_ALG_HMACSHA256;
|
|
|
3ce7d3 |
+#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ if (isc_md5_available())
|
|
|
3ce7d3 |
+ alg = DST_ALG_HMACMD5;
|
|
|
3ce7d3 |
+#endif
|
|
|
3ce7d3 |
+ algdef = alg_totext(alg);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
isc_commandline_errprint = ISC_FALSE;
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
diff --git a/bin/dig/dig.c b/bin/dig/dig.c
|
|
|
3ce7d3 |
index d4808ada67..9dff7c8ecd 100644
|
|
|
3ce7d3 |
--- a/bin/dig/dig.c
|
|
|
3ce7d3 |
+++ b/bin/dig/dig.c
|
|
|
3ce7d3 |
@@ -17,6 +17,7 @@
|
|
|
3ce7d3 |
#include <ctype.h>
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#include <isc/app.h>
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/netaddr.h>
|
|
|
3ce7d3 |
#include <isc/parseint.h>
|
|
|
3ce7d3 |
#include <isc/platform.h>
|
|
|
3ce7d3 |
@@ -1757,10 +1758,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
|
|
|
3ce7d3 |
ptr = ptr2;
|
|
|
3ce7d3 |
ptr2 = ptr3;
|
|
|
3ce7d3 |
} else {
|
|
|
3ce7d3 |
-#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- hmacname = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
-#else
|
|
|
3ce7d3 |
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
|
|
3ce7d3 |
+#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ if (isc_md5_available())
|
|
|
3ce7d3 |
+ hmacname = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
digestbits = 0;
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
|
|
|
3ce7d3 |
index ecefc98453..94c428ed30 100644
|
|
|
3ce7d3 |
--- a/bin/dig/dighost.c
|
|
|
3ce7d3 |
+++ b/bin/dig/dighost.c
|
|
|
3ce7d3 |
@@ -77,6 +77,7 @@
|
|
|
3ce7d3 |
#include <isc/hex.h>
|
|
|
3ce7d3 |
#include <isc/lang.h>
|
|
|
3ce7d3 |
#include <isc/log.h>
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/netaddr.h>
|
|
|
3ce7d3 |
#include <isc/netdb.h>
|
|
|
3ce7d3 |
#include <isc/parseint.h>
|
|
|
3ce7d3 |
@@ -1243,9 +1244,10 @@ parse_hmac(const char *hmac) {
|
|
|
3ce7d3 |
digestbits = 0;
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- if (strcasecmp(buf, "hmac-md5") == 0) {
|
|
|
3ce7d3 |
+ if (strcasecmp(buf, "hmac-md5") == 0 && isc_md5_available()) {
|
|
|
3ce7d3 |
hmacname = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
- } else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
|
|
|
3ce7d3 |
+ } else if (strncasecmp(buf, "hmac-md5-", 9) == 0 &&
|
|
|
3ce7d3 |
+ isc_md5_available()) {
|
|
|
3ce7d3 |
hmacname = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
digestbits = parse_bits(&buf[9], "digest-bits [0..128]", 128);
|
|
|
3ce7d3 |
} else
|
|
|
3ce7d3 |
@@ -1365,7 +1367,13 @@ setup_file_key(void) {
|
|
|
3ce7d3 |
switch (dst_key_alg(dstkey)) {
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
case DST_ALG_HMACMD5:
|
|
|
3ce7d3 |
- hmacname = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
+ if (isc_md5_available()) {
|
|
|
3ce7d3 |
+ hmacname = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
+ } else {
|
|
|
3ce7d3 |
+ printf(";; Couldn't create key %s: bad algorithm\n",
|
|
|
3ce7d3 |
+ keynametext);
|
|
|
3ce7d3 |
+ goto failure;
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
break;
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
case DST_ALG_HMACSHA1:
|
|
|
3ce7d3 |
diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
|
|
|
3ce7d3 |
index 6fc3ab0979..fc04356ed4 100644
|
|
|
3ce7d3 |
--- a/bin/dnssec/dnssec-keygen.c
|
|
|
3ce7d3 |
+++ b/bin/dnssec/dnssec-keygen.c
|
|
|
3ce7d3 |
@@ -34,6 +34,7 @@
|
|
|
3ce7d3 |
#include <isc/buffer.h>
|
|
|
3ce7d3 |
#include <isc/commandline.h>
|
|
|
3ce7d3 |
#include <isc/entropy.h>
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/mem.h>
|
|
|
3ce7d3 |
#include <isc/print.h>
|
|
|
3ce7d3 |
#include <isc/region.h>
|
|
|
3ce7d3 |
@@ -560,6 +561,19 @@ main(int argc, char **argv) {
|
|
|
3ce7d3 |
"\"-a RSAMD5\"\n");
|
|
|
3ce7d3 |
INSIST(freeit == NULL);
|
|
|
3ce7d3 |
return (1);
|
|
|
3ce7d3 |
+ } else if (strcasecmp(algname, "HMAC-MD5") == 0) {
|
|
|
3ce7d3 |
+ if (isc_md5_available()) {
|
|
|
3ce7d3 |
+ alg = DST_ALG_HMACMD5;
|
|
|
3ce7d3 |
+ } else {
|
|
|
3ce7d3 |
+ fprintf(stderr,
|
|
|
3ce7d3 |
+ "The use of HMAC-MD5 was disabled\n");
|
|
|
3ce7d3 |
+ return (1);
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
+ } else if (strcasecmp(algname, "RSAMD5") == 0 &&
|
|
|
3ce7d3 |
+ isc_md5_available() == ISC_FALSE) {
|
|
|
3ce7d3 |
+ fprintf(stderr, "The use of RSAMD5 was disabled\n");
|
|
|
3ce7d3 |
+ INSIST(freeit == NULL);
|
|
|
3ce7d3 |
+ return (1);
|
|
|
3ce7d3 |
} else if (strcasecmp(algname, "HMAC-MD5") == 0) {
|
|
|
3ce7d3 |
alg = DST_ALG_HMACMD5;
|
|
|
3ce7d3 |
#else
|
|
|
3ce7d3 |
diff --git a/bin/named/config.c b/bin/named/config.c
|
|
|
3ce7d3 |
index 54bc37fff7..c50f759ddd 100644
|
|
|
3ce7d3 |
--- a/bin/named/config.c
|
|
|
3ce7d3 |
+++ b/bin/named/config.c
|
|
|
3ce7d3 |
@@ -17,6 +17,7 @@
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#include <isc/buffer.h>
|
|
|
3ce7d3 |
#include <isc/log.h>
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/mem.h>
|
|
|
3ce7d3 |
#include <isc/parseint.h>
|
|
|
3ce7d3 |
#include <isc/region.h>
|
|
|
3ce7d3 |
@@ -966,6 +967,21 @@ ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
|
|
|
3ce7d3 |
return (ns_config_getkeyalgorithm2(str, name, NULL, digestbits));
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
+static inline int
|
|
|
3ce7d3 |
+algorithms_start() {
|
|
|
3ce7d3 |
+#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ if (isc_md5_available() == ISC_FALSE) {
|
|
|
3ce7d3 |
+ int i = 0;
|
|
|
3ce7d3 |
+ while (algorithms[i].str != NULL &&
|
|
|
3ce7d3 |
+ algorithms[i].hmac == hmacmd5) {
|
|
|
3ce7d3 |
+ i++;
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
+ return i;
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
+#endif
|
|
|
3ce7d3 |
+ return 0;
|
|
|
3ce7d3 |
+}
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
isc_result_t
|
|
|
3ce7d3 |
ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
|
|
|
3ce7d3 |
unsigned int *typep, isc_uint16_t *digestbits)
|
|
|
3ce7d3 |
@@ -975,7 +991,7 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
|
|
|
3ce7d3 |
isc_uint16_t bits;
|
|
|
3ce7d3 |
isc_result_t result;
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
- for (i = 0; algorithms[i].str != NULL; i++) {
|
|
|
3ce7d3 |
+ for (i = algorithms_start(); algorithms[i].str != NULL; i++) {
|
|
|
3ce7d3 |
len = strlen(algorithms[i].str);
|
|
|
3ce7d3 |
if (strncasecmp(algorithms[i].str, str, len) == 0 &&
|
|
|
3ce7d3 |
(str[len] == '\0' ||
|
|
|
3ce7d3 |
@@ -998,7 +1014,12 @@ ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
|
|
|
3ce7d3 |
if (name != NULL) {
|
|
|
3ce7d3 |
switch (algorithms[i].hmac) {
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- case hmacmd5: *name = dns_tsig_hmacmd5_name; break;
|
|
|
3ce7d3 |
+ case hmacmd5:
|
|
|
3ce7d3 |
+ if (isc_md5_available()) {
|
|
|
3ce7d3 |
+ *name = dns_tsig_hmacmd5_name; break;
|
|
|
3ce7d3 |
+ } else {
|
|
|
3ce7d3 |
+ return (ISC_R_NOTFOUND);
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
case hmacsha1: *name = dns_tsig_hmacsha1_name; break;
|
|
|
3ce7d3 |
case hmacsha224: *name = dns_tsig_hmacsha224_name; break;
|
|
|
3ce7d3 |
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
|
|
|
3ce7d3 |
index 6967b49754..bb5d50038f 100644
|
|
|
3ce7d3 |
--- a/bin/nsupdate/nsupdate.c
|
|
|
3ce7d3 |
+++ b/bin/nsupdate/nsupdate.c
|
|
|
3ce7d3 |
@@ -29,6 +29,7 @@
|
|
|
3ce7d3 |
#include <isc/hash.h>
|
|
|
3ce7d3 |
#include <isc/lex.h>
|
|
|
3ce7d3 |
#include <isc/log.h>
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/mem.h>
|
|
|
3ce7d3 |
#include <isc/parseint.h>
|
|
|
3ce7d3 |
#include <isc/print.h>
|
|
|
3ce7d3 |
@@ -474,9 +475,10 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len,
|
|
|
3ce7d3 |
strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- if (strcasecmp(buf, "hmac-md5") == 0) {
|
|
|
3ce7d3 |
+ if (strcasecmp(buf, "hmac-md5") == 0 && isc_md5_available()) {
|
|
|
3ce7d3 |
*hmac = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
- } else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
|
|
|
3ce7d3 |
+ } else if (strncasecmp(buf, "hmac-md5-", 9) == 0 &&
|
|
|
3ce7d3 |
+ isc_md5_available()) {
|
|
|
3ce7d3 |
*hmac = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
result = isc_parse_uint16(&digestbits, &buf[9], 10);
|
|
|
3ce7d3 |
if (result != ISC_R_SUCCESS || digestbits > 128) {
|
|
|
3ce7d3 |
@@ -589,10 +591,10 @@ setup_keystr(void) {
|
|
|
3ce7d3 |
exit(1);
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
} else {
|
|
|
3ce7d3 |
-#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- hmacname = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
-#else
|
|
|
3ce7d3 |
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
|
|
3ce7d3 |
+#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ if (isc_md5_available())
|
|
|
3ce7d3 |
+ hmacname = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
name = keystr;
|
|
|
3ce7d3 |
n = s;
|
|
|
3ce7d3 |
@@ -729,7 +731,8 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
|
|
|
3ce7d3 |
switch (dst_key_alg(dstkey)) {
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
case DST_ALG_HMACMD5:
|
|
|
3ce7d3 |
- hmacname = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
+ if (isc_md5_available())
|
|
|
3ce7d3 |
+ hmacname = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
break;
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
case DST_ALG_HMACSHA1:
|
|
|
3ce7d3 |
@@ -1604,12 +1607,13 @@ evaluate_key(char *cmdline) {
|
|
|
3ce7d3 |
return (STATUS_SYNTAX);
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
namestr = n + 1;
|
|
|
3ce7d3 |
- } else
|
|
|
3ce7d3 |
-#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- hmacname = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
-#else
|
|
|
3ce7d3 |
+ } else {
|
|
|
3ce7d3 |
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
|
|
3ce7d3 |
+#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ if (isc_md5_available())
|
|
|
3ce7d3 |
+ hmacname = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
isc_buffer_init(&b, namestr, strlen(namestr));
|
|
|
3ce7d3 |
isc_buffer_add(&b, strlen(namestr));
|
|
|
3ce7d3 |
diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
|
|
|
3ce7d3 |
index 5c29caf86b..617b06b4a1 100644
|
|
|
3ce7d3 |
--- a/bin/rndc/rndc.c
|
|
|
3ce7d3 |
+++ b/bin/rndc/rndc.c
|
|
|
3ce7d3 |
@@ -21,6 +21,7 @@
|
|
|
3ce7d3 |
#include <isc/file.h>
|
|
|
3ce7d3 |
#include <isc/log.h>
|
|
|
3ce7d3 |
#include <isc/net.h>
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/mem.h>
|
|
|
3ce7d3 |
#include <isc/print.h>
|
|
|
3ce7d3 |
#include <isc/random.h>
|
|
|
3ce7d3 |
@@ -634,7 +635,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
|
|
|
3ce7d3 |
algorithmstr = cfg_obj_asstring(algorithmobj);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- if (strcasecmp(algorithmstr, "hmac-md5") == 0)
|
|
|
3ce7d3 |
+ if (strcasecmp(algorithmstr, "hmac-md5") == 0 && isc_md5_available())
|
|
|
3ce7d3 |
algorithm = ISCCC_ALG_HMACMD5;
|
|
|
3ce7d3 |
else
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
diff --git a/bin/tests/optional/hash_test.c b/bin/tests/optional/hash_test.c
|
|
|
3ce7d3 |
index bf2891ad4c..b5f0a1c5f5 100644
|
|
|
3ce7d3 |
--- a/bin/tests/optional/hash_test.c
|
|
|
3ce7d3 |
+++ b/bin/tests/optional/hash_test.c
|
|
|
3ce7d3 |
@@ -90,43 +90,47 @@ main(int argc, char **argv) {
|
|
|
3ce7d3 |
print_digest(s, "sha224", digest, ISC_SHA224_DIGESTLENGTH/4);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- s = "abc";
|
|
|
3ce7d3 |
- isc_md5_init(&md5;;
|
|
|
3ce7d3 |
- memmove(buffer, s, strlen(s));
|
|
|
3ce7d3 |
- isc_md5_update(&md5, buffer, strlen(s));
|
|
|
3ce7d3 |
- isc_md5_final(&md5, digest);
|
|
|
3ce7d3 |
- print_digest(s, "md5", digest, 4);
|
|
|
3ce7d3 |
-
|
|
|
3ce7d3 |
- /*
|
|
|
3ce7d3 |
- * The 3 HMAC-MD5 examples from RFC2104
|
|
|
3ce7d3 |
- */
|
|
|
3ce7d3 |
- s = "Hi There";
|
|
|
3ce7d3 |
- memset(key, 0x0b, 16);
|
|
|
3ce7d3 |
- isc_hmacmd5_init(&hmacmd5, key, 16);
|
|
|
3ce7d3 |
- memmove(buffer, s, strlen(s));
|
|
|
3ce7d3 |
- isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
|
|
|
3ce7d3 |
- isc_hmacmd5_sign(&hmacmd5, digest);
|
|
|
3ce7d3 |
- print_digest(s, "hmacmd5", digest, 4);
|
|
|
3ce7d3 |
-
|
|
|
3ce7d3 |
- s = "what do ya want for nothing?";
|
|
|
3ce7d3 |
- strlcpy((char *)key, "Jefe", sizeof(key));
|
|
|
3ce7d3 |
- isc_hmacmd5_init(&hmacmd5, key, 4);
|
|
|
3ce7d3 |
- memmove(buffer, s, strlen(s));
|
|
|
3ce7d3 |
- isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
|
|
|
3ce7d3 |
- isc_hmacmd5_sign(&hmacmd5, digest);
|
|
|
3ce7d3 |
- print_digest(s, "hmacmd5", digest, 4);
|
|
|
3ce7d3 |
-
|
|
|
3ce7d3 |
- s = "\335\335\335\335\335\335\335\335\335\335"
|
|
|
3ce7d3 |
- "\335\335\335\335\335\335\335\335\335\335"
|
|
|
3ce7d3 |
- "\335\335\335\335\335\335\335\335\335\335"
|
|
|
3ce7d3 |
- "\335\335\335\335\335\335\335\335\335\335"
|
|
|
3ce7d3 |
- "\335\335\335\335\335\335\335\335\335\335";
|
|
|
3ce7d3 |
- memset(key, 0xaa, 16);
|
|
|
3ce7d3 |
- isc_hmacmd5_init(&hmacmd5, key, 16);
|
|
|
3ce7d3 |
- memmove(buffer, s, strlen(s));
|
|
|
3ce7d3 |
- isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
|
|
|
3ce7d3 |
- isc_hmacmd5_sign(&hmacmd5, digest);
|
|
|
3ce7d3 |
- print_digest(s, "hmacmd5", digest, 4);
|
|
|
3ce7d3 |
+ if (isc_md5_available()) {
|
|
|
3ce7d3 |
+ s = "abc";
|
|
|
3ce7d3 |
+ isc_md5_init(&md5;;
|
|
|
3ce7d3 |
+ memmove(buffer, s, strlen(s));
|
|
|
3ce7d3 |
+ isc_md5_update(&md5, buffer, strlen(s));
|
|
|
3ce7d3 |
+ isc_md5_final(&md5, digest);
|
|
|
3ce7d3 |
+ print_digest(s, "md5", digest, 4);
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+ /*
|
|
|
3ce7d3 |
+ * The 3 HMAC-MD5 examples from RFC2104
|
|
|
3ce7d3 |
+ */
|
|
|
3ce7d3 |
+ s = "Hi There";
|
|
|
3ce7d3 |
+ memset(key, 0x0b, 16);
|
|
|
3ce7d3 |
+ isc_hmacmd5_init(&hmacmd5, key, 16);
|
|
|
3ce7d3 |
+ memmove(buffer, s, strlen(s));
|
|
|
3ce7d3 |
+ isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
|
|
|
3ce7d3 |
+ isc_hmacmd5_sign(&hmacmd5, digest);
|
|
|
3ce7d3 |
+ print_digest(s, "hmacmd5", digest, 4);
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+ s = "what do ya want for nothing?";
|
|
|
3ce7d3 |
+ strlcpy((char *)key, "Jefe", sizeof(key));
|
|
|
3ce7d3 |
+ isc_hmacmd5_init(&hmacmd5, key, 4);
|
|
|
3ce7d3 |
+ memmove(buffer, s, strlen(s));
|
|
|
3ce7d3 |
+ isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
|
|
|
3ce7d3 |
+ isc_hmacmd5_sign(&hmacmd5, digest);
|
|
|
3ce7d3 |
+ print_digest(s, "hmacmd5", digest, 4);
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+ s = "\335\335\335\335\335\335\335\335\335\335"
|
|
|
3ce7d3 |
+ "\335\335\335\335\335\335\335\335\335\335"
|
|
|
3ce7d3 |
+ "\335\335\335\335\335\335\335\335\335\335"
|
|
|
3ce7d3 |
+ "\335\335\335\335\335\335\335\335\335\335"
|
|
|
3ce7d3 |
+ "\335\335\335\335\335\335\335\335\335\335";
|
|
|
3ce7d3 |
+ memset(key, 0xaa, 16);
|
|
|
3ce7d3 |
+ isc_hmacmd5_init(&hmacmd5, key, 16);
|
|
|
3ce7d3 |
+ memmove(buffer, s, strlen(s));
|
|
|
3ce7d3 |
+ isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
|
|
|
3ce7d3 |
+ isc_hmacmd5_sign(&hmacmd5, digest);
|
|
|
3ce7d3 |
+ print_digest(s, "hmacmd5", digest, 4);
|
|
|
3ce7d3 |
+ } else {
|
|
|
3ce7d3 |
+ fprintf(stderr, "Skipping disabled MD5 algorithm\n");
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
/*
|
|
|
3ce7d3 |
diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
|
|
|
3ce7d3 |
index 2a0ee94888..489f4390dc 100644
|
|
|
3ce7d3 |
--- a/bin/tests/system/tkey/keycreate.c
|
|
|
3ce7d3 |
+++ b/bin/tests/system/tkey/keycreate.c
|
|
|
3ce7d3 |
@@ -20,6 +20,7 @@
|
|
|
3ce7d3 |
#include <isc/entropy.h>
|
|
|
3ce7d3 |
#include <isc/hash.h>
|
|
|
3ce7d3 |
#include <isc/log.h>
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/mem.h>
|
|
|
3ce7d3 |
#include <isc/print.h>
|
|
|
3ce7d3 |
#include <isc/sockaddr.h>
|
|
|
3ce7d3 |
@@ -142,6 +143,8 @@ sendquery(isc_task_t *task, isc_event_t *event) {
|
|
|
3ce7d3 |
static char keystr[] = "0123456789ab";
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
isc_event_free(&event);
|
|
|
3ce7d3 |
+ if (isc_md5_available() == ISC_FALSE)
|
|
|
3ce7d3 |
+ CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
result = ISC_R_FAILURE;
|
|
|
3ce7d3 |
if (inet_pton(AF_INET, "10.53.0.1", &inaddr) != 1)
|
|
|
3ce7d3 |
diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
|
|
|
3ce7d3 |
index 7057c318e4..36ee6c7d21 100644
|
|
|
3ce7d3 |
--- a/bin/tests/system/tkey/keydelete.c
|
|
|
3ce7d3 |
+++ b/bin/tests/system/tkey/keydelete.c
|
|
|
3ce7d3 |
@@ -225,12 +225,18 @@ main(int argc, char **argv) {
|
|
|
3ce7d3 |
result = dst_key_fromnamedfile(keyname, NULL, type, mctx, &dstkey);
|
|
|
3ce7d3 |
CHECK("dst_key_fromnamedfile", result);
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- result = dns_tsigkey_createfromkey(dst_key_name(dstkey),
|
|
|
3ce7d3 |
- DNS_TSIG_HMACMD5_NAME,
|
|
|
3ce7d3 |
- dstkey, ISC_TRUE, NULL, 0, 0,
|
|
|
3ce7d3 |
- mctx, ring, &tsigkey);
|
|
|
3ce7d3 |
- dst_key_free(&dstkey);
|
|
|
3ce7d3 |
- CHECK("dns_tsigkey_createfromkey", result);
|
|
|
3ce7d3 |
+ if (isc_md5_available()) {
|
|
|
3ce7d3 |
+ result = dns_tsigkey_createfromkey(dst_key_name(dstkey),
|
|
|
3ce7d3 |
+ DNS_TSIG_HMACMD5_NAME,
|
|
|
3ce7d3 |
+ dstkey, ISC_TRUE,
|
|
|
3ce7d3 |
+ NULL, 0, 0,
|
|
|
3ce7d3 |
+ mctx, ring, &tsigkey);
|
|
|
3ce7d3 |
+ dst_key_free(&dstkey);
|
|
|
3ce7d3 |
+ CHECK("dns_tsigkey_createfromkey", result);
|
|
|
3ce7d3 |
+ } else {
|
|
|
3ce7d3 |
+ dst_key_free(&dstkey);
|
|
|
3ce7d3 |
+ CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
#else
|
|
|
3ce7d3 |
dst_key_free(&dstkey);
|
|
|
3ce7d3 |
CHECK("MD5 was disabled", ISC_R_NOTIMPLEMENTED);
|
|
|
3ce7d3 |
diff --git a/lib/bind9/check.c b/lib/bind9/check.c
|
|
|
3ce7d3 |
index 3da83a7ae2..1a3d534799 100644
|
|
|
3ce7d3 |
--- a/lib/bind9/check.c
|
|
|
3ce7d3 |
+++ b/lib/bind9/check.c
|
|
|
3ce7d3 |
@@ -21,6 +21,7 @@
|
|
|
3ce7d3 |
#include <isc/file.h>
|
|
|
3ce7d3 |
#include <isc/hex.h>
|
|
|
3ce7d3 |
#include <isc/log.h>
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/mem.h>
|
|
|
3ce7d3 |
#include <isc/netaddr.h>
|
|
|
3ce7d3 |
#include <isc/parseint.h>
|
|
|
3ce7d3 |
@@ -2572,6 +2573,15 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
algorithm = cfg_obj_asstring(algobj);
|
|
|
3ce7d3 |
+#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ /* Skip hmac-md5* algorithms */
|
|
|
3ce7d3 |
+ if (isc_md5_available() == ISC_FALSE &&
|
|
|
3ce7d3 |
+ strncasecmp(algorithm, "hmac-md5", 8) == 0) {
|
|
|
3ce7d3 |
+ cfg_obj_log(algobj, logctx, ISC_LOG_ERROR,
|
|
|
3ce7d3 |
+ "disabled algorithm '%s'", algorithm);
|
|
|
3ce7d3 |
+ return (ISC_R_DISABLED);
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
+#endif
|
|
|
3ce7d3 |
for (i = 0; algorithms[i].name != NULL; i++) {
|
|
|
3ce7d3 |
len = strlen(algorithms[i].name);
|
|
|
3ce7d3 |
if (strncasecmp(algorithms[i].name, algorithm, len) == 0 &&
|
|
|
3ce7d3 |
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
|
|
|
3ce7d3 |
index 4f3d6ac55c..dbece0ac56 100644
|
|
|
3ce7d3 |
--- a/lib/dns/dst_api.c
|
|
|
3ce7d3 |
+++ b/lib/dns/dst_api.c
|
|
|
3ce7d3 |
@@ -190,6 +190,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
|
|
|
3ce7d3 |
dst_result_register();
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
memset(dst_t_func, 0, sizeof(dst_t_func));
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+#ifdef OPENSSL
|
|
|
3ce7d3 |
+ RETERR(dst__openssl_init(engine));
|
|
|
3ce7d3 |
+#elif PKCS11CRYPTO
|
|
|
3ce7d3 |
+ RETERR(dst__pkcs11_init(mctx, engine));
|
|
|
3ce7d3 |
+#endif
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
RETERR(dst__hmacmd5_init(&dst_t_func[DST_ALG_HMACMD5]));
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
@@ -199,7 +205,6 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
|
|
|
3ce7d3 |
RETERR(dst__hmacsha384_init(&dst_t_func[DST_ALG_HMACSHA384]));
|
|
|
3ce7d3 |
RETERR(dst__hmacsha512_init(&dst_t_func[DST_ALG_HMACSHA512]));
|
|
|
3ce7d3 |
#ifdef OPENSSL
|
|
|
3ce7d3 |
- RETERR(dst__openssl_init(engine));
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSAMD5],
|
|
|
3ce7d3 |
DST_ALG_RSAMD5));
|
|
|
3ce7d3 |
@@ -233,14 +238,18 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
|
|
|
3ce7d3 |
RETERR(dst__openssleddsa_init(&dst_t_func[DST_ALG_ED448]));
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
#elif PKCS11CRYPTO
|
|
|
3ce7d3 |
- RETERR(dst__pkcs11_init(mctx, engine));
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSAMD5]));
|
|
|
3ce7d3 |
+ RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSAMD5],
|
|
|
3ce7d3 |
+ DST_ALG_RSAMD5));
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
- RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA1]));
|
|
|
3ce7d3 |
- RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_NSEC3RSASHA1]));
|
|
|
3ce7d3 |
- RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA256]));
|
|
|
3ce7d3 |
- RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA512]));
|
|
|
3ce7d3 |
+ RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA1],
|
|
|
3ce7d3 |
+ DST_ALG_RSASHA1));
|
|
|
3ce7d3 |
+ RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_NSEC3RSASHA1],
|
|
|
3ce7d3 |
+ DST_ALG_NSEC3RSASHA1));
|
|
|
3ce7d3 |
+ RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA256],
|
|
|
3ce7d3 |
+ DST_ALG_RSASHA256));
|
|
|
3ce7d3 |
+ RETERR(dst__pkcs11rsa_init(&dst_t_func[DST_ALG_RSASHA512],
|
|
|
3ce7d3 |
+ DST_ALG_RSASHA512));
|
|
|
3ce7d3 |
#ifndef PK11_DSA_DISABLE
|
|
|
3ce7d3 |
RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_DSA]));
|
|
|
3ce7d3 |
RETERR(dst__pkcs11dsa_init(&dst_t_func[DST_ALG_NSEC3DSA]));
|
|
|
3ce7d3 |
diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
|
|
|
3ce7d3 |
index 640519a5ba..deb7ed4e13 100644
|
|
|
3ce7d3 |
--- a/lib/dns/dst_internal.h
|
|
|
3ce7d3 |
+++ b/lib/dns/dst_internal.h
|
|
|
3ce7d3 |
@@ -245,7 +245,8 @@ isc_result_t dst__hmacsha384_init(struct dst_func **funcp);
|
|
|
3ce7d3 |
isc_result_t dst__hmacsha512_init(struct dst_func **funcp);
|
|
|
3ce7d3 |
isc_result_t dst__opensslrsa_init(struct dst_func **funcp,
|
|
|
3ce7d3 |
unsigned char algorithm);
|
|
|
3ce7d3 |
-isc_result_t dst__pkcs11rsa_init(struct dst_func **funcp);
|
|
|
3ce7d3 |
+isc_result_t dst__pkcs11rsa_init(struct dst_func **funcp,
|
|
|
3ce7d3 |
+ unsigned char algorithm);
|
|
|
3ce7d3 |
#ifndef PK11_DSA_DISABLE
|
|
|
3ce7d3 |
isc_result_t dst__openssldsa_init(struct dst_func **funcp);
|
|
|
3ce7d3 |
isc_result_t dst__pkcs11dsa_init(struct dst_func **funcp);
|
|
|
3ce7d3 |
diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
|
|
|
3ce7d3 |
index b0e5c895c6..03f2b8ace8 100644
|
|
|
3ce7d3 |
--- a/lib/dns/dst_parse.c
|
|
|
3ce7d3 |
+++ b/lib/dns/dst_parse.c
|
|
|
3ce7d3 |
@@ -30,6 +30,7 @@
|
|
|
3ce7d3 |
#include <isc/file.h>
|
|
|
3ce7d3 |
#include <isc/fsaccess.h>
|
|
|
3ce7d3 |
#include <isc/lex.h>
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/mem.h>
|
|
|
3ce7d3 |
#include <isc/print.h>
|
|
|
3ce7d3 |
#include <isc/stdtime.h>
|
|
|
3ce7d3 |
@@ -393,6 +394,10 @@ check_data(const dst_private_t *priv, const unsigned int alg,
|
|
|
3ce7d3 |
switch (alg) {
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
case DST_ALG_RSAMD5:
|
|
|
3ce7d3 |
+ if (isc_md5_available())
|
|
|
3ce7d3 |
+ return (check_rsa(priv, external));
|
|
|
3ce7d3 |
+ else
|
|
|
3ce7d3 |
+ return (DST_R_UNSUPPORTEDALG);
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
case DST_ALG_RSASHA1:
|
|
|
3ce7d3 |
case DST_ALG_NSEC3RSASHA1:
|
|
|
3ce7d3 |
@@ -418,7 +423,10 @@ check_data(const dst_private_t *priv, const unsigned int alg,
|
|
|
3ce7d3 |
return (check_eddsa(priv, external));
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
case DST_ALG_HMACMD5:
|
|
|
3ce7d3 |
- return (check_hmac_md5(priv, old));
|
|
|
3ce7d3 |
+ if (isc_md5_available())
|
|
|
3ce7d3 |
+ return (check_hmac_md5(priv, old));
|
|
|
3ce7d3 |
+ else
|
|
|
3ce7d3 |
+ return (DST_R_UNSUPPORTEDALG);
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
case DST_ALG_HMACSHA1:
|
|
|
3ce7d3 |
return (check_hmac_sha(priv, HMACSHA1_NTAGS, alg));
|
|
|
3ce7d3 |
@@ -637,11 +645,13 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#ifdef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- check = check_data(priv, alg == DST_ALG_RSA ? DST_ALG_RSASHA1 : alg,
|
|
|
3ce7d3 |
- ISC_TRUE, external);
|
|
|
3ce7d3 |
+ if (alg == DST_ALG_RSA)
|
|
|
3ce7d3 |
+ alg = DST_ALG_RSASHA1;
|
|
|
3ce7d3 |
#else
|
|
|
3ce7d3 |
- check = check_data(priv, alg, ISC_TRUE, external);
|
|
|
3ce7d3 |
+ if (isc_md5_available() == ISC_FALSE && alg == DST_ALG_RSA)
|
|
|
3ce7d3 |
+ alg = DST_ALG_RSASHA1;
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
+ check = check_data(priv, alg, ISC_TRUE, external);
|
|
|
3ce7d3 |
if (check < 0) {
|
|
|
3ce7d3 |
ret = DST_R_INVALIDPRIVATEKEY;
|
|
|
3ce7d3 |
goto fail;
|
|
|
3ce7d3 |
diff --git a/lib/dns/hmac_link.c b/lib/dns/hmac_link.c
|
|
|
3ce7d3 |
index 59aa4705e5..21bfa44450 100644
|
|
|
3ce7d3 |
--- a/lib/dns/hmac_link.c
|
|
|
3ce7d3 |
+++ b/lib/dns/hmac_link.c
|
|
|
3ce7d3 |
@@ -338,25 +338,17 @@ static dst_func_t hmacmd5_functions = {
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
isc_result_t
|
|
|
3ce7d3 |
dst__hmacmd5_init(dst_func_t **funcp) {
|
|
|
3ce7d3 |
-#ifdef HAVE_FIPS_MODE
|
|
|
3ce7d3 |
/*
|
|
|
3ce7d3 |
- * Problems from OpenSSL are likely from FIPS mode
|
|
|
3ce7d3 |
+ * Prevent use of incorrect crypto
|
|
|
3ce7d3 |
*/
|
|
|
3ce7d3 |
- int fips_mode = FIPS_mode();
|
|
|
3ce7d3 |
-
|
|
|
3ce7d3 |
- if (fips_mode != 0) {
|
|
|
3ce7d3 |
- UNEXPECTED_ERROR(__FILE__, __LINE__,
|
|
|
3ce7d3 |
- "FIPS mode is %d: MD5 is only supported "
|
|
|
3ce7d3 |
- "if the value is 0.\n"
|
|
|
3ce7d3 |
- "Please disable either FIPS mode or MD5.",
|
|
|
3ce7d3 |
- fips_mode);
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ if (isc_md5_available() == ISC_FALSE) {
|
|
|
3ce7d3 |
+ /* Intentionally skip initialization */
|
|
|
3ce7d3 |
+ return (ISC_R_SUCCESS);
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
- /*
|
|
|
3ce7d3 |
- * Prevent use of incorrect crypto
|
|
|
3ce7d3 |
- */
|
|
|
3ce7d3 |
-
|
|
|
3ce7d3 |
RUNTIME_CHECK(isc_md5_check(ISC_FALSE));
|
|
|
3ce7d3 |
RUNTIME_CHECK(isc_hmacmd5_check(0));
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
|
|
|
3ce7d3 |
index f4847bbe74..126cebca19 100644
|
|
|
3ce7d3 |
--- a/lib/dns/opensslrsa_link.c
|
|
|
3ce7d3 |
+++ b/lib/dns/opensslrsa_link.c
|
|
|
3ce7d3 |
@@ -1801,6 +1801,12 @@ dst__opensslrsa_init(dst_func_t **funcp, unsigned char algorithm) {
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
if (*funcp == NULL) {
|
|
|
3ce7d3 |
switch (algorithm) {
|
|
|
3ce7d3 |
+#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ case DST_ALG_RSAMD5:
|
|
|
3ce7d3 |
+ if (isc_md5_available())
|
|
|
3ce7d3 |
+ *funcp = &opensslrsa_functions;
|
|
|
3ce7d3 |
+ break;
|
|
|
3ce7d3 |
+#endif
|
|
|
3ce7d3 |
case DST_ALG_RSASHA256:
|
|
|
3ce7d3 |
#if defined(HAVE_EVP_SHA256) || !USE_EVP
|
|
|
3ce7d3 |
*funcp = &opensslrsa_functions;
|
|
|
3ce7d3 |
diff --git a/lib/dns/pkcs11rsa_link.c b/lib/dns/pkcs11rsa_link.c
|
|
|
3ce7d3 |
index 56955203e9..af6008d4dd 100644
|
|
|
3ce7d3 |
--- a/lib/dns/pkcs11rsa_link.c
|
|
|
3ce7d3 |
+++ b/lib/dns/pkcs11rsa_link.c
|
|
|
3ce7d3 |
@@ -94,10 +94,15 @@ pkcs11rsa_createctx_sign(dst_key_t *key, dst_context_t *dctx) {
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
/*
|
|
|
3ce7d3 |
- * Reject incorrect RSA key lengths.
|
|
|
3ce7d3 |
+ * Reject incorrect RSA key lengths or disabled algorithms.
|
|
|
3ce7d3 |
*/
|
|
|
3ce7d3 |
switch (dctx->key->key_alg) {
|
|
|
3ce7d3 |
case DST_ALG_RSAMD5:
|
|
|
3ce7d3 |
+#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ if (isc_md5_available() == ISC_FALSE)
|
|
|
3ce7d3 |
+ return (ISC_R_FAILURE);
|
|
|
3ce7d3 |
+#endif
|
|
|
3ce7d3 |
+ /* FALLTHROUGH */
|
|
|
3ce7d3 |
case DST_ALG_RSASHA1:
|
|
|
3ce7d3 |
case DST_ALG_NSEC3RSASHA1:
|
|
|
3ce7d3 |
/* From RFC 3110 */
|
|
|
3ce7d3 |
@@ -634,6 +639,9 @@ pkcs11rsa_createctx(dst_key_t *key, dst_context_t *dctx) {
|
|
|
3ce7d3 |
switch (key->key_alg) {
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
case DST_ALG_RSAMD5:
|
|
|
3ce7d3 |
+ if (isc_md5_available() == ISC_FALSE)
|
|
|
3ce7d3 |
+ return (ISC_R_FAILURE);
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
mech.mechanism = CKM_MD5;
|
|
|
3ce7d3 |
break;
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
@@ -790,6 +798,9 @@ pkcs11rsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
|
|
|
3ce7d3 |
switch (key->key_alg) {
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
case DST_ALG_RSAMD5:
|
|
|
3ce7d3 |
+ if (isc_md5_available() == ISC_FALSE)
|
|
|
3ce7d3 |
+ return (ISC_R_FAILURE);
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
der = md5_der;
|
|
|
3ce7d3 |
derlen = sizeof(md5_der);
|
|
|
3ce7d3 |
hashlen = ISC_MD5_DIGESTLENGTH;
|
|
|
3ce7d3 |
@@ -1014,6 +1025,9 @@ pkcs11rsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
|
|
|
3ce7d3 |
switch (key->key_alg) {
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
case DST_ALG_RSAMD5:
|
|
|
3ce7d3 |
+ if (isc_md5_available() == ISC_FALSE)
|
|
|
3ce7d3 |
+ return (ISC_R_FAILURE);
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
der = md5_der;
|
|
|
3ce7d3 |
derlen = sizeof(md5_der);
|
|
|
3ce7d3 |
hashlen = ISC_MD5_DIGESTLENGTH;
|
|
|
3ce7d3 |
@@ -2217,11 +2231,22 @@ static dst_func_t pkcs11rsa_functions = {
|
|
|
3ce7d3 |
};
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
isc_result_t
|
|
|
3ce7d3 |
-dst__pkcs11rsa_init(dst_func_t **funcp) {
|
|
|
3ce7d3 |
+dst__pkcs11rsa_init(dst_func_t **funcp, unsigned char algorithm) {
|
|
|
3ce7d3 |
REQUIRE(funcp != NULL);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
- if (*funcp == NULL)
|
|
|
3ce7d3 |
- *funcp = &pkcs11rsa_functions;
|
|
|
3ce7d3 |
+ if (*funcp == NULL) {
|
|
|
3ce7d3 |
+ switch (algorithm) {
|
|
|
3ce7d3 |
+#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ case DST_ALG_RSAMD5:
|
|
|
3ce7d3 |
+ if (isc_md5_available())
|
|
|
3ce7d3 |
+ *funcp = &pkcs11rsa_functions;
|
|
|
3ce7d3 |
+ break;
|
|
|
3ce7d3 |
+#endif
|
|
|
3ce7d3 |
+ default:
|
|
|
3ce7d3 |
+ *funcp = &pkcs11rsa_functions;
|
|
|
3ce7d3 |
+ break;
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
return (ISC_R_SUCCESS);
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
|
|
|
3ce7d3 |
index 937d8fc1ec..d1fa8d5870 100644
|
|
|
3ce7d3 |
--- a/lib/dns/rcode.c
|
|
|
3ce7d3 |
+++ b/lib/dns/rcode.c
|
|
|
3ce7d3 |
@@ -14,6 +14,7 @@
|
|
|
3ce7d3 |
#include <ctype.h>
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#include <isc/buffer.h>
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/parseint.h>
|
|
|
3ce7d3 |
#include <isc/print.h>
|
|
|
3ce7d3 |
#include <isc/region.h>
|
|
|
3ce7d3 |
@@ -347,17 +348,33 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
|
|
|
3ce7d3 |
return (dns_mnemonic_totext(cert, target, certs));
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
+static inline struct tbl *
|
|
|
3ce7d3 |
+secalgs_tbl_start() {
|
|
|
3ce7d3 |
+ struct tbl *algs = secalgs;
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ if (isc_md5_available() == ISC_FALSE) {
|
|
|
3ce7d3 |
+ while (algs->name != NULL &&
|
|
|
3ce7d3 |
+ algs->value == DNS_KEYALG_RSAMD5)
|
|
|
3ce7d3 |
+ ++algs;
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
+#endif
|
|
|
3ce7d3 |
+ return algs;
|
|
|
3ce7d3 |
+}
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
isc_result_t
|
|
|
3ce7d3 |
dns_secalg_fromtext(dns_secalg_t *secalgp, isc_textregion_t *source) {
|
|
|
3ce7d3 |
unsigned int value;
|
|
|
3ce7d3 |
- RETERR(dns_mnemonic_fromtext(&value, source, secalgs, 0xff));
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+ RETERR(dns_mnemonic_fromtext(&value, source,
|
|
|
3ce7d3 |
+ secalgs_tbl_start(), 0xff));
|
|
|
3ce7d3 |
*secalgp = value;
|
|
|
3ce7d3 |
return (ISC_R_SUCCESS);
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
isc_result_t
|
|
|
3ce7d3 |
dns_secalg_totext(dns_secalg_t secalg, isc_buffer_t *target) {
|
|
|
3ce7d3 |
- return (dns_mnemonic_totext(secalg, target, secalgs));
|
|
|
3ce7d3 |
+ return (dns_mnemonic_totext(secalg, target, secalgs_tbl_start()));
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
void
|
|
|
3ce7d3 |
diff --git a/lib/dns/tests/rsa_test.c b/lib/dns/tests/rsa_test.c
|
|
|
3ce7d3 |
index 224cf5b475..44040dd8b7 100644
|
|
|
3ce7d3 |
--- a/lib/dns/tests/rsa_test.c
|
|
|
3ce7d3 |
+++ b/lib/dns/tests/rsa_test.c
|
|
|
3ce7d3 |
@@ -19,6 +19,7 @@
|
|
|
3ce7d3 |
#include <stdio.h>
|
|
|
3ce7d3 |
#include <string.h>
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/util.h>
|
|
|
3ce7d3 |
#include <isc/print.h>
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
@@ -225,23 +226,25 @@ ATF_TC_BODY(isc_rsa_verify, tc) {
|
|
|
3ce7d3 |
/* RSAMD5 */
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- key->key_alg = DST_ALG_RSAMD5;
|
|
|
3ce7d3 |
+ if (isc_md5_available()) {
|
|
|
3ce7d3 |
+ key->key_alg = DST_ALG_RSAMD5;
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
- ret = dst_context_create3(key, mctx, DNS_LOGCATEGORY_DNSSEC,
|
|
|
3ce7d3 |
- ISC_FALSE, &ctx;;
|
|
|
3ce7d3 |
- ATF_REQUIRE_EQ(ret, ISC_R_SUCCESS);
|
|
|
3ce7d3 |
+ ret = dst_context_create3(key, mctx, DNS_LOGCATEGORY_DNSSEC,
|
|
|
3ce7d3 |
+ ISC_FALSE, &ctx;;
|
|
|
3ce7d3 |
+ ATF_REQUIRE_EQ(ret, ISC_R_SUCCESS);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
- r.base = d;
|
|
|
3ce7d3 |
- r.length = 10;
|
|
|
3ce7d3 |
- ret = dst_context_adddata(ctx, &r);
|
|
|
3ce7d3 |
- ATF_REQUIRE_EQ(ret, ISC_R_SUCCESS);
|
|
|
3ce7d3 |
+ r.base = d;
|
|
|
3ce7d3 |
+ r.length = 10;
|
|
|
3ce7d3 |
+ ret = dst_context_adddata(ctx, &r);
|
|
|
3ce7d3 |
+ ATF_REQUIRE_EQ(ret, ISC_R_SUCCESS);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
- r.base = sigmd5;
|
|
|
3ce7d3 |
- r.length = 256;
|
|
|
3ce7d3 |
- ret = dst_context_verify(ctx, &r);
|
|
|
3ce7d3 |
- ATF_REQUIRE_EQ(ret, ISC_R_SUCCESS);
|
|
|
3ce7d3 |
+ r.base = sigmd5;
|
|
|
3ce7d3 |
+ r.length = 256;
|
|
|
3ce7d3 |
+ ret = dst_context_verify(ctx, &r);
|
|
|
3ce7d3 |
+ ATF_REQUIRE_EQ(ret, ISC_R_SUCCESS);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
- dst_context_destroy(&ctx;;
|
|
|
3ce7d3 |
+ dst_context_destroy(&ctx;;
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
/* RSASHA256 */
|
|
|
3ce7d3 |
diff --git a/lib/dns/tests/tsig_test.c b/lib/dns/tests/tsig_test.c
|
|
|
3ce7d3 |
index ee025c2387..c403d9954d 100644
|
|
|
3ce7d3 |
--- a/lib/dns/tests/tsig_test.c
|
|
|
3ce7d3 |
+++ b/lib/dns/tests/tsig_test.c
|
|
|
3ce7d3 |
@@ -14,6 +14,7 @@
|
|
|
3ce7d3 |
#include <config.h>
|
|
|
3ce7d3 |
#include <atf-c.h>
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/mem.h>
|
|
|
3ce7d3 |
#include <isc/print.h>
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
|
|
|
3ce7d3 |
index d9f68e50b1..a8edde47b5 100644
|
|
|
3ce7d3 |
--- a/lib/dns/tkey.c
|
|
|
3ce7d3 |
+++ b/lib/dns/tkey.c
|
|
|
3ce7d3 |
@@ -242,6 +242,9 @@ compute_secret(isc_buffer_t *shared, isc_region_t *queryrandomness,
|
|
|
3ce7d3 |
unsigned char digests[32];
|
|
|
3ce7d3 |
unsigned int i;
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
+ if (isc_md5_available() == ISC_FALSE)
|
|
|
3ce7d3 |
+ return (ISC_R_NOTIMPLEMENTED);
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
isc_buffer_usedregion(shared, &r);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
/*
|
|
|
3ce7d3 |
@@ -318,6 +321,12 @@ process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ if (isc_md5_available() == ISC_FALSE) {
|
|
|
3ce7d3 |
+ tkey_log("process_dhtkey: MD5 was disabled");
|
|
|
3ce7d3 |
+ tkeyout->error = dns_tsigerror_badalg;
|
|
|
3ce7d3 |
+ return (ISC_R_SUCCESS);
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
if (!dns_name_equal(&tkeyin->algorithm, DNS_TSIG_HMACMD5_NAME)) {
|
|
|
3ce7d3 |
tkey_log("process_dhtkey: algorithms other than "
|
|
|
3ce7d3 |
"hmac-md5 are not supported");
|
|
|
3ce7d3 |
diff --git a/lib/dns/tsec.c b/lib/dns/tsec.c
|
|
|
3ce7d3 |
index a367291f23..37baad7437 100644
|
|
|
3ce7d3 |
--- a/lib/dns/tsec.c
|
|
|
3ce7d3 |
+++ b/lib/dns/tsec.c
|
|
|
3ce7d3 |
@@ -11,6 +11,7 @@
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#include <config.h>
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
+#include <isc/md5.h>
|
|
|
3ce7d3 |
#include <isc/mem.h>
|
|
|
3ce7d3 |
#include <isc/util.h>
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
@@ -63,7 +64,12 @@ dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t *key,
|
|
|
3ce7d3 |
switch (dst_key_alg(key)) {
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
case DST_ALG_HMACMD5:
|
|
|
3ce7d3 |
- algname = dns_tsig_hmacmd5_name;
|
|
|
3ce7d3 |
+ if (isc_md5_available()) {
|
|
|
3ce7d3 |
+ algname = dns_tsig_hmacmd5_name;
|
|
|
3ce7d3 |
+ } else {
|
|
|
3ce7d3 |
+ isc_mem_put(mctx, tsec, sizeof(*tsec));
|
|
|
3ce7d3 |
+ return (DNS_R_BADALG);
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
break;
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
case DST_ALG_HMACSHA1:
|
|
|
3ce7d3 |
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
|
|
|
3ce7d3 |
index bdcc581bc3..70805bb709 100644
|
|
|
3ce7d3 |
--- a/lib/dns/tsig.c
|
|
|
3ce7d3 |
+++ b/lib/dns/tsig.c
|
|
|
3ce7d3 |
@@ -270,7 +270,8 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
|
|
|
3ce7d3 |
(void)dns_name_downcase(&tkey->name, &tkey->name, NULL);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- if (dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME)) {
|
|
|
3ce7d3 |
+ if (dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME) &&
|
|
|
3ce7d3 |
+ isc_md5_available()) {
|
|
|
3ce7d3 |
tkey->algorithm = DNS_TSIG_HMACMD5_NAME;
|
|
|
3ce7d3 |
if (dstkey != NULL && dst_key_alg(dstkey) != DST_ALG_HMACMD5) {
|
|
|
3ce7d3 |
ret = DNS_R_BADALG;
|
|
|
3ce7d3 |
@@ -496,7 +497,8 @@ destroyring(dns_tsig_keyring_t *ring) {
|
|
|
3ce7d3 |
static unsigned int
|
|
|
3ce7d3 |
dst_alg_fromname(dns_name_t *algorithm) {
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- if (dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME)) {
|
|
|
3ce7d3 |
+ if (dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME) &&
|
|
|
3ce7d3 |
+ isc_md5_available()) {
|
|
|
3ce7d3 |
return (DST_ALG_HMACMD5);
|
|
|
3ce7d3 |
} else
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
@@ -680,7 +682,8 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
|
|
|
3ce7d3 |
REQUIRE(secret != NULL);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- if (dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME)) {
|
|
|
3ce7d3 |
+ if (dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME) &&
|
|
|
3ce7d3 |
+ isc_md5_available()) {
|
|
|
3ce7d3 |
if (secret != NULL) {
|
|
|
3ce7d3 |
isc_buffer_t b;
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
@@ -1280,7 +1283,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
|
|
|
3ce7d3 |
return (ret);
|
|
|
3ce7d3 |
if (
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- alg == DST_ALG_HMACMD5 ||
|
|
|
3ce7d3 |
+ (alg == DST_ALG_HMACMD5 && isc_md5_available()) ||
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
alg == DST_ALG_HMACSHA1 ||
|
|
|
3ce7d3 |
alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
|
|
|
3ce7d3 |
@@ -1449,7 +1452,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
if (
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- alg == DST_ALG_HMACMD5 ||
|
|
|
3ce7d3 |
+ (alg == DST_ALG_HMACMD5 && isc_md5_available()) ||
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
alg == DST_ALG_HMACSHA1 ||
|
|
|
3ce7d3 |
alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
|
|
|
3ce7d3 |
@@ -1590,7 +1593,7 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
|
|
|
3ce7d3 |
goto cleanup_querystruct;
|
|
|
3ce7d3 |
if (
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- alg == DST_ALG_HMACMD5 ||
|
|
|
3ce7d3 |
+ (alg == DST_ALG_HMACMD5 && isc_md5_available()) ||
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
alg == DST_ALG_HMACSHA1 ||
|
|
|
3ce7d3 |
alg == DST_ALG_HMACSHA224 ||
|
|
|
3ce7d3 |
@@ -1769,7 +1772,7 @@ tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg) {
|
|
|
3ce7d3 |
goto cleanup_context;
|
|
|
3ce7d3 |
if (
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- alg == DST_ALG_HMACMD5 ||
|
|
|
3ce7d3 |
+ (alg == DST_ALG_HMACMD5 && isc_md5_available()) ||
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
alg == DST_ALG_HMACSHA1 ||
|
|
|
3ce7d3 |
alg == DST_ALG_HMACSHA224 ||
|
|
|
3ce7d3 |
diff --git a/lib/isc/include/isc/md5.h b/lib/isc/include/isc/md5.h
|
|
|
3ce7d3 |
index e5f46dd9c7..9d11f9f8b6 100644
|
|
|
3ce7d3 |
--- a/lib/isc/include/isc/md5.h
|
|
|
3ce7d3 |
+++ b/lib/isc/include/isc/md5.h
|
|
|
3ce7d3 |
@@ -89,6 +89,9 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest);
|
|
|
3ce7d3 |
isc_boolean_t
|
|
|
3ce7d3 |
isc_md5_check(isc_boolean_t testing);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
+isc_boolean_t
|
|
|
3ce7d3 |
+isc_md5_available(void);
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
ISC_LANG_ENDDECLS
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#endif /* !PK11_MD5_DISABLE */
|
|
|
3ce7d3 |
diff --git a/lib/isc/md5.c b/lib/isc/md5.c
|
|
|
3ce7d3 |
index 740d863b1b..aefd16478f 100644
|
|
|
3ce7d3 |
--- a/lib/isc/md5.c
|
|
|
3ce7d3 |
+++ b/lib/isc/md5.c
|
|
|
3ce7d3 |
@@ -35,6 +35,7 @@
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#include <isc/assertions.h>
|
|
|
3ce7d3 |
#include <isc/md5.h>
|
|
|
3ce7d3 |
+#include <isc/once.h>
|
|
|
3ce7d3 |
#include <isc/platform.h>
|
|
|
3ce7d3 |
#include <isc/safe.h>
|
|
|
3ce7d3 |
#include <isc/string.h>
|
|
|
3ce7d3 |
@@ -53,6 +54,9 @@
|
|
|
3ce7d3 |
#define EVP_MD_CTX_free(ptr) EVP_MD_CTX_cleanup(ptr)
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
+static isc_once_t available_once = ISC_ONCE_INIT;
|
|
|
3ce7d3 |
+static isc_boolean_t available = ISC_FALSE;
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
void
|
|
|
3ce7d3 |
isc_md5_init(isc_md5_t *ctx) {
|
|
|
3ce7d3 |
ctx->ctx = EVP_MD_CTX_new();
|
|
|
3ce7d3 |
@@ -84,8 +88,33 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
|
|
|
3ce7d3 |
ctx->ctx = NULL;
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
+static void
|
|
|
3ce7d3 |
+do_detect_available() {
|
|
|
3ce7d3 |
+ isc_md5_t local;
|
|
|
3ce7d3 |
+ isc_md5_t *ctx = &local;
|
|
|
3ce7d3 |
+ unsigned char digest[ISC_MD5_DIGESTLENGTH];
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+ ctx->ctx = EVP_MD_CTX_new();
|
|
|
3ce7d3 |
+ RUNTIME_CHECK(ctx->ctx != NULL);
|
|
|
3ce7d3 |
+ available = ISC_TF(EVP_DigestInit(ctx->ctx, EVP_md5()) == 1);
|
|
|
3ce7d3 |
+ if (available)
|
|
|
3ce7d3 |
+ (void)EVP_DigestFinal(ctx->ctx, digest, NULL);
|
|
|
3ce7d3 |
+ EVP_MD_CTX_free(ctx->ctx);
|
|
|
3ce7d3 |
+ ctx->ctx = NULL;
|
|
|
3ce7d3 |
+}
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+isc_boolean_t
|
|
|
3ce7d3 |
+isc_md5_available() {
|
|
|
3ce7d3 |
+ RUNTIME_CHECK(isc_once_do(&available_once, do_detect_available)
|
|
|
3ce7d3 |
+ == ISC_R_SUCCESS);
|
|
|
3ce7d3 |
+ return available;
|
|
|
3ce7d3 |
+}
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
#elif PKCS11CRYPTO
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
+static isc_once_t available_once = ISC_ONCE_INIT;
|
|
|
3ce7d3 |
+static isc_boolean_t available = ISC_FALSE;
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
void
|
|
|
3ce7d3 |
isc_md5_init(isc_md5_t *ctx) {
|
|
|
3ce7d3 |
CK_RV rv;
|
|
|
3ce7d3 |
@@ -128,6 +157,31 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
|
|
|
3ce7d3 |
pk11_return_session(ctx);
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
+static void
|
|
|
3ce7d3 |
+do_detect_available() {
|
|
|
3ce7d3 |
+ isc_md5_t local;
|
|
|
3ce7d3 |
+ isc_md5_t *ctx = &local;
|
|
|
3ce7d3 |
+ CK_RV rv;
|
|
|
3ce7d3 |
+ CK_MECHANISM mech = { CKM_MD5, NULL, 0 };
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+ if (pk11_get_session(ctx, OP_DIGEST, ISC_TRUE, ISC_FALSE,
|
|
|
3ce7d3 |
+ ISC_FALSE, NULL, 0) == ISC_R_SUCCESS)
|
|
|
3ce7d3 |
+ {
|
|
|
3ce7d3 |
+ rv = pkcs_C_DigestInit(ctx->session, &mech);
|
|
|
3ce7d3 |
+ isc_md5_invalidate(ctx);
|
|
|
3ce7d3 |
+ available = (ISC_TF(rv == CKR_OK));
|
|
|
3ce7d3 |
+ } else {
|
|
|
3ce7d3 |
+ available = ISC_FALSE;
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
+}
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+isc_boolean_t
|
|
|
3ce7d3 |
+isc_md5_available() {
|
|
|
3ce7d3 |
+ RUNTIME_CHECK(isc_once_do(&available_once, do_detect_available)
|
|
|
3ce7d3 |
+ == ISC_R_SUCCESS);
|
|
|
3ce7d3 |
+ return available;
|
|
|
3ce7d3 |
+}
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
#else
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
static void
|
|
|
3ce7d3 |
@@ -337,6 +391,11 @@ isc_md5_final(isc_md5_t *ctx, unsigned char *digest) {
|
|
|
3ce7d3 |
memmove(digest, ctx->buf, 16);
|
|
|
3ce7d3 |
isc_safe_memwipe(ctx, sizeof(*ctx)); /* In case it's sensitive */
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+isc_boolean_t
|
|
|
3ce7d3 |
+isc_md5_available() {
|
|
|
3ce7d3 |
+ return ISC_TRUE;
|
|
|
3ce7d3 |
+}
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
/*
|
|
|
3ce7d3 |
diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
|
|
|
3ce7d3 |
index fc75a46154..48e1031974 100644
|
|
|
3ce7d3 |
--- a/lib/isc/pk11.c
|
|
|
3ce7d3 |
+++ b/lib/isc/pk11.c
|
|
|
3ce7d3 |
@@ -191,13 +191,12 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
|
|
|
3ce7d3 |
LOCK(&alloclock);
|
|
|
3ce7d3 |
if ((mctx != NULL) && (pk11_mctx == NULL) && (allocsize == 0))
|
|
|
3ce7d3 |
isc_mem_attach(mctx, &pk11_mctx);
|
|
|
3ce7d3 |
+ UNLOCK(&alloclock);
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+ LOCK(&sessionlock);
|
|
|
3ce7d3 |
if (initialized) {
|
|
|
3ce7d3 |
- UNLOCK(&alloclock);
|
|
|
3ce7d3 |
- return (ISC_R_SUCCESS);
|
|
|
3ce7d3 |
- } else {
|
|
|
3ce7d3 |
- LOCK(&sessionlock);
|
|
|
3ce7d3 |
- initialized = ISC_TRUE;
|
|
|
3ce7d3 |
- UNLOCK(&alloclock);
|
|
|
3ce7d3 |
+ result = ISC_R_SUCCESS;
|
|
|
3ce7d3 |
+ goto unlock;
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
ISC_LIST_INIT(tokens);
|
|
|
3ce7d3 |
@@ -237,6 +236,7 @@ pk11_initialize(isc_mem_t *mctx, const char *engine) {
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
#endif /* PKCS11CRYPTO */
|
|
|
3ce7d3 |
+ initialized = ISC_TRUE;
|
|
|
3ce7d3 |
result = ISC_R_SUCCESS;
|
|
|
3ce7d3 |
unlock:
|
|
|
3ce7d3 |
UNLOCK(&sessionlock);
|
|
|
3ce7d3 |
@@ -273,9 +273,14 @@ pk11_finalize(void) {
|
|
|
3ce7d3 |
pk11_mem_put(token, sizeof(*token));
|
|
|
3ce7d3 |
token = next;
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
+ LOCK(&alloclock);
|
|
|
3ce7d3 |
if (pk11_mctx != NULL)
|
|
|
3ce7d3 |
isc_mem_detach(&pk11_mctx);
|
|
|
3ce7d3 |
+ UNLOCK(&alloclock);
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
+ LOCK(&sessionlock);
|
|
|
3ce7d3 |
initialized = ISC_FALSE;
|
|
|
3ce7d3 |
+ UNLOCK(&sessionlock);
|
|
|
3ce7d3 |
return (ret);
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
@@ -589,6 +594,8 @@ scan_slots(void) {
|
|
|
3ce7d3 |
pk11_token_t *token;
|
|
|
3ce7d3 |
unsigned int i;
|
|
|
3ce7d3 |
isc_boolean_t bad;
|
|
|
3ce7d3 |
+ unsigned int best_rsa_algorithms = 0;
|
|
|
3ce7d3 |
+ unsigned int best_digest_algorithms = 0;
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
slotCount = 0;
|
|
|
3ce7d3 |
PK11_FATALCHECK(pkcs_C_GetSlotList, (CK_FALSE, NULL_PTR, &slotCount));
|
|
|
3ce7d3 |
@@ -601,6 +608,8 @@ scan_slots(void) {
|
|
|
3ce7d3 |
PK11_FATALCHECK(pkcs_C_GetSlotList, (CK_FALSE, slotList, &slotCount));
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
for (i = 0; i < slotCount; i++) {
|
|
|
3ce7d3 |
+ unsigned int rsa_algorithms = 0;
|
|
|
3ce7d3 |
+ unsigned int digest_algorithms = 0;
|
|
|
3ce7d3 |
slot = slotList[i];
|
|
|
3ce7d3 |
PK11_TRACE2("slot#%u=0x%lx\n", i, slot);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
@@ -640,11 +649,12 @@ scan_slots(void) {
|
|
|
3ce7d3 |
if ((rv != CKR_OK) ||
|
|
|
3ce7d3 |
((mechInfo.flags & CKF_SIGN) == 0) ||
|
|
|
3ce7d3 |
((mechInfo.flags & CKF_VERIFY) == 0)) {
|
|
|
3ce7d3 |
-#if !defined(PK11_MD5_DISABLE) && !defined(PK11_RSA_PKCS_REPLACE)
|
|
|
3ce7d3 |
- bad = ISC_TRUE;
|
|
|
3ce7d3 |
-#endif
|
|
|
3ce7d3 |
PK11_TRACEM(CKM_MD5_RSA_PKCS);
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
+#if !defined(PK11_MD5_DISABLE) && !defined(PK11_RSA_PKCS_REPLACE)
|
|
|
3ce7d3 |
+ else
|
|
|
3ce7d3 |
+ ++rsa_algorithms;
|
|
|
3ce7d3 |
+#endif
|
|
|
3ce7d3 |
rv = pkcs_C_GetMechanismInfo(slot, CKM_SHA1_RSA_PKCS,
|
|
|
3ce7d3 |
&mechInfo);
|
|
|
3ce7d3 |
if ((rv != CKR_OK) ||
|
|
|
3ce7d3 |
@@ -687,8 +697,14 @@ scan_slots(void) {
|
|
|
3ce7d3 |
if (bad)
|
|
|
3ce7d3 |
goto try_dsa;
|
|
|
3ce7d3 |
token->operations |= 1 << OP_RSA;
|
|
|
3ce7d3 |
- if (best_rsa_token == NULL)
|
|
|
3ce7d3 |
+ if (best_rsa_token == NULL) {
|
|
|
3ce7d3 |
+ best_rsa_token = token;
|
|
|
3ce7d3 |
+ best_rsa_algorithms = rsa_algorithms;
|
|
|
3ce7d3 |
+ } else if (rsa_algorithms > best_rsa_algorithms) {
|
|
|
3ce7d3 |
+ pk11_mem_put(best_rsa_token, sizeof(*best_rsa_token));
|
|
|
3ce7d3 |
best_rsa_token = token;
|
|
|
3ce7d3 |
+ best_rsa_algorithms = rsa_algorithms;
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
try_dsa:
|
|
|
3ce7d3 |
bad = ISC_FALSE;
|
|
|
3ce7d3 |
@@ -756,11 +772,12 @@ scan_slots(void) {
|
|
|
3ce7d3 |
bad = ISC_FALSE;
|
|
|
3ce7d3 |
rv = pkcs_C_GetMechanismInfo(slot, CKM_MD5, &mechInfo);
|
|
|
3ce7d3 |
if ((rv != CKR_OK) || ((mechInfo.flags & CKF_DIGEST) == 0)) {
|
|
|
3ce7d3 |
-#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- bad = ISC_TRUE;
|
|
|
3ce7d3 |
-#endif
|
|
|
3ce7d3 |
PK11_TRACEM(CKM_MD5);
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
+#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ else
|
|
|
3ce7d3 |
+ ++digest_algorithms;
|
|
|
3ce7d3 |
+#endif
|
|
|
3ce7d3 |
rv = pkcs_C_GetMechanismInfo(slot, CKM_SHA_1, &mechInfo);
|
|
|
3ce7d3 |
if ((rv != CKR_OK) || ((mechInfo.flags & CKF_DIGEST) == 0)) {
|
|
|
3ce7d3 |
bad = ISC_TRUE;
|
|
|
3ce7d3 |
@@ -788,11 +805,12 @@ scan_slots(void) {
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
rv = pkcs_C_GetMechanismInfo(slot, CKM_MD5_HMAC, &mechInfo);
|
|
|
3ce7d3 |
if ((rv != CKR_OK) || ((mechInfo.flags & CKF_SIGN) == 0)) {
|
|
|
3ce7d3 |
-#if !defined(PK11_MD5_DISABLE) && !defined(PK11_MD5_HMAC_REPLACE)
|
|
|
3ce7d3 |
- bad = ISC_TRUE;
|
|
|
3ce7d3 |
-#endif
|
|
|
3ce7d3 |
PK11_TRACEM(CKM_MD5_HMAC);
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
+#if !defined(PK11_MD5_DISABLE) && !defined(PK11_MD5_HMAC_REPLACE)
|
|
|
3ce7d3 |
+ else
|
|
|
3ce7d3 |
+ ++digest_algorithms;
|
|
|
3ce7d3 |
+#endif
|
|
|
3ce7d3 |
rv = pkcs_C_GetMechanismInfo(slot, CKM_SHA_1_HMAC, &mechInfo);
|
|
|
3ce7d3 |
if ((rv != CKR_OK) || ((mechInfo.flags & CKF_SIGN) == 0)) {
|
|
|
3ce7d3 |
#ifndef PK11_SHA_1_HMAC_REPLACE
|
|
|
3ce7d3 |
@@ -830,8 +848,14 @@ scan_slots(void) {
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
if (!bad) {
|
|
|
3ce7d3 |
token->operations |= 1 << OP_DIGEST;
|
|
|
3ce7d3 |
- if (digest_token == NULL)
|
|
|
3ce7d3 |
+ if (digest_token == NULL) {
|
|
|
3ce7d3 |
+ digest_token = token;
|
|
|
3ce7d3 |
+ best_digest_algorithms = digest_algorithms;
|
|
|
3ce7d3 |
+ } else if (digest_algorithms > best_digest_algorithms) {
|
|
|
3ce7d3 |
+ pk11_mem_put(digest_token, sizeof(*digest_token));
|
|
|
3ce7d3 |
digest_token = token;
|
|
|
3ce7d3 |
+ best_digest_algorithms = digest_algorithms;
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
}
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
/* ECDSA requires digest */
|
|
|
3ce7d3 |
diff --git a/lib/isc/tests/hash_test.c b/lib/isc/tests/hash_test.c
|
|
|
3ce7d3 |
index 18759903be..6bc45b1ad3 100644
|
|
|
3ce7d3 |
--- a/lib/isc/tests/hash_test.c
|
|
|
3ce7d3 |
+++ b/lib/isc/tests/hash_test.c
|
|
|
3ce7d3 |
@@ -2008,7 +2008,8 @@ ATF_TP_ADD_TCS(tp) {
|
|
|
3ce7d3 |
* various cryptographic hashes.
|
|
|
3ce7d3 |
*/
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- ATF_TP_ADD_TC(tp, md5_check);
|
|
|
3ce7d3 |
+ if (isc_md5_available())
|
|
|
3ce7d3 |
+ ATF_TP_ADD_TC(tp, md5_check);
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
ATF_TP_ADD_TC(tp, sha1_check);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
@@ -2016,7 +2017,8 @@ ATF_TP_ADD_TCS(tp) {
|
|
|
3ce7d3 |
ATF_TP_ADD_TC(tp, isc_hash_function_reverse);
|
|
|
3ce7d3 |
ATF_TP_ADD_TC(tp, isc_hash_initializer);
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- ATF_TP_ADD_TC(tp, isc_hmacmd5);
|
|
|
3ce7d3 |
+ if (isc_md5_available())
|
|
|
3ce7d3 |
+ ATF_TP_ADD_TC(tp, isc_hmacmd5);
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
ATF_TP_ADD_TC(tp, isc_hmacsha1);
|
|
|
3ce7d3 |
ATF_TP_ADD_TC(tp, isc_hmacsha224);
|
|
|
3ce7d3 |
@@ -2024,7 +2026,8 @@ ATF_TP_ADD_TCS(tp) {
|
|
|
3ce7d3 |
ATF_TP_ADD_TC(tp, isc_hmacsha384);
|
|
|
3ce7d3 |
ATF_TP_ADD_TC(tp, isc_hmacsha512);
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- ATF_TP_ADD_TC(tp, isc_md5);
|
|
|
3ce7d3 |
+ if (isc_md5_available())
|
|
|
3ce7d3 |
+ ATF_TP_ADD_TC(tp, isc_md5);
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
ATF_TP_ADD_TC(tp, isc_sha1);
|
|
|
3ce7d3 |
ATF_TP_ADD_TC(tp, isc_sha224);
|
|
|
3ce7d3 |
diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
|
|
|
3ce7d3 |
index 7225ab4a37..42b30466be 100644
|
|
|
3ce7d3 |
--- a/lib/isccc/cc.c
|
|
|
3ce7d3 |
+++ b/lib/isccc/cc.c
|
|
|
3ce7d3 |
@@ -270,11 +270,15 @@ sign(unsigned char *data, unsigned int length, unsigned char *hmac,
|
|
|
3ce7d3 |
switch (algorithm) {
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
case ISCCC_ALG_HMACMD5:
|
|
|
3ce7d3 |
- isc_hmacmd5_init(&ctx.hmd5, secret->rstart,
|
|
|
3ce7d3 |
- REGION_SIZE(*secret));
|
|
|
3ce7d3 |
- isc_hmacmd5_update(&ctx.hmd5, data, length);
|
|
|
3ce7d3 |
- isc_hmacmd5_sign(&ctx.hmd5, digest);
|
|
|
3ce7d3 |
- source.rend = digest + ISC_MD5_DIGESTLENGTH;
|
|
|
3ce7d3 |
+ if (isc_md5_available()) {
|
|
|
3ce7d3 |
+ isc_hmacmd5_init(&ctx.hmd5, secret->rstart,
|
|
|
3ce7d3 |
+ REGION_SIZE(*secret));
|
|
|
3ce7d3 |
+ isc_hmacmd5_update(&ctx.hmd5, data, length);
|
|
|
3ce7d3 |
+ isc_hmacmd5_sign(&ctx.hmd5, digest);
|
|
|
3ce7d3 |
+ source.rend = digest + ISC_MD5_DIGESTLENGTH;
|
|
|
3ce7d3 |
+ } else {
|
|
|
3ce7d3 |
+ return (ISC_R_FAILURE);
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
break;
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
@@ -348,14 +352,18 @@ isccc_cc_towire(isccc_sexpr_t *alist, isc_buffer_t **buffer,
|
|
|
3ce7d3 |
{
|
|
|
3ce7d3 |
unsigned int hmac_base, signed_base;
|
|
|
3ce7d3 |
isc_result_t result;
|
|
|
3ce7d3 |
+ const isc_boolean_t md5 = ISC_TF(algorithm == ISCCC_ALG_HMACMD5);
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
+ if (md5 && isc_md5_available() == ISC_FALSE)
|
|
|
3ce7d3 |
+ return (ISC_R_NOTIMPLEMENTED);
|
|
|
3ce7d3 |
+
|
|
|
3ce7d3 |
result = isc_buffer_reserve(buffer,
|
|
|
3ce7d3 |
- 4 + ((algorithm == ISCCC_ALG_HMACMD5) ?
|
|
|
3ce7d3 |
+ 4 + ((md5) ?
|
|
|
3ce7d3 |
sizeof(auth_hmd5) :
|
|
|
3ce7d3 |
sizeof(auth_hsha)));
|
|
|
3ce7d3 |
#else
|
|
|
3ce7d3 |
- if (algorithm == ISCCC_ALG_HMACMD5)
|
|
|
3ce7d3 |
+ if (md5)
|
|
|
3ce7d3 |
return (ISC_R_NOTIMPLEMENTED);
|
|
|
3ce7d3 |
result = isc_buffer_reserve(buffer, 4 + sizeof(auth_hsha));
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
@@ -374,7 +382,7 @@ isccc_cc_towire(isccc_sexpr_t *alist, isc_buffer_t **buffer,
|
|
|
3ce7d3 |
* we know what it is.
|
|
|
3ce7d3 |
*/
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- if (algorithm == ISCCC_ALG_HMACMD5) {
|
|
|
3ce7d3 |
+ if (md5) {
|
|
|
3ce7d3 |
hmac_base = (*buffer)->used + HMD5_OFFSET;
|
|
|
3ce7d3 |
isc_buffer_putmem(*buffer,
|
|
|
3ce7d3 |
auth_hmd5, sizeof(auth_hmd5));
|
|
|
3ce7d3 |
@@ -440,7 +448,7 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
|
|
|
3ce7d3 |
if (!isccc_alist_alistp(_auth))
|
|
|
3ce7d3 |
return (ISC_R_FAILURE);
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
- if (algorithm == ISCCC_ALG_HMACMD5)
|
|
|
3ce7d3 |
+ if (algorithm == ISCCC_ALG_HMACMD5 && isc_md5_available())
|
|
|
3ce7d3 |
hmac = isccc_alist_lookup(_auth, "hmd5");
|
|
|
3ce7d3 |
else
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
@@ -455,12 +463,16 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
|
|
|
3ce7d3 |
switch (algorithm) {
|
|
|
3ce7d3 |
#ifndef PK11_MD5_DISABLE
|
|
|
3ce7d3 |
case ISCCC_ALG_HMACMD5:
|
|
|
3ce7d3 |
- isc_hmacmd5_init(&ctx.hmd5, secret->rstart,
|
|
|
3ce7d3 |
- REGION_SIZE(*secret));
|
|
|
3ce7d3 |
- isc_hmacmd5_update(&ctx.hmd5, data, length);
|
|
|
3ce7d3 |
- isc_hmacmd5_sign(&ctx.hmd5, digest);
|
|
|
3ce7d3 |
- source.rend = digest + ISC_MD5_DIGESTLENGTH;
|
|
|
3ce7d3 |
- break;
|
|
|
3ce7d3 |
+ if (isc_md5_available()) {
|
|
|
3ce7d3 |
+ isc_hmacmd5_init(&ctx.hmd5, secret->rstart,
|
|
|
3ce7d3 |
+ REGION_SIZE(*secret));
|
|
|
3ce7d3 |
+ isc_hmacmd5_update(&ctx.hmd5, data, length);
|
|
|
3ce7d3 |
+ isc_hmacmd5_sign(&ctx.hmd5, digest);
|
|
|
3ce7d3 |
+ source.rend = digest + ISC_MD5_DIGESTLENGTH;
|
|
|
3ce7d3 |
+ break;
|
|
|
3ce7d3 |
+ } else {
|
|
|
3ce7d3 |
+ return (ISC_R_FAILURE);
|
|
|
3ce7d3 |
+ }
|
|
|
3ce7d3 |
#endif
|
|
|
3ce7d3 |
|
|
|
3ce7d3 |
case ISCCC_ALG_HMACSHA1:
|
|
|
3ce7d3 |
--
|
|
|
3ce7d3 |
2.14.4
|
|
|
3ce7d3 |
|