diff options
Diffstat (limited to 'validator/val_secalgo.c')
| -rw-r--r-- | validator/val_secalgo.c | 51 |
1 files changed, 47 insertions, 4 deletions
diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c index be88ff438660c..88d23472118f4 100644 --- a/validator/val_secalgo.c +++ b/validator/val_secalgo.c @@ -228,6 +228,9 @@ dnskey_algo_id_is_supported(int id) case LDNS_ECDSAP256SHA256: case LDNS_ECDSAP384SHA384: #endif +#ifdef USE_ED25519 + case LDNS_ED25519: +#endif #if (defined(HAVE_EVP_SHA256) && defined(USE_SHA2)) || (defined(HAVE_EVP_SHA512) && defined(USE_SHA2)) || defined(USE_ECDSA) return 1; #endif @@ -555,6 +558,17 @@ setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type, #endif break; #endif /* USE_ECDSA */ +#ifdef USE_ED25519 + case LDNS_ED25519: + *evp_key = sldns_ed255192pkey_raw(key, keylen); + if(!*evp_key) { + verbose(VERB_QUERY, "verify: " + "sldns_ed255192pkey_raw failed"); + return 0; + } + *digest_type = NULL; + break; +#endif /* USE_ED25519 */ default: verbose(VERB_QUERY, "verify: unknown algorithm %d", algo); @@ -644,18 +658,29 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock, else if(docrypto_free) OPENSSL_free(sigblock); return sec_status_unchecked; } - if(EVP_VerifyInit(ctx, digest_type) == 0) { - verbose(VERB_QUERY, "verify: EVP_VerifyInit failed"); +#ifndef HAVE_EVP_DIGESTVERIFY + if(EVP_DigestInit(ctx, digest_type) == 0) { + verbose(VERB_QUERY, "verify: EVP_DigestInit failed"); +#ifdef HAVE_EVP_MD_CTX_NEW EVP_MD_CTX_destroy(ctx); +#else + EVP_MD_CTX_cleanup(ctx); + free(ctx); +#endif EVP_PKEY_free(evp_key); if(dofree) free(sigblock); else if(docrypto_free) OPENSSL_free(sigblock); return sec_status_unchecked; } - if(EVP_VerifyUpdate(ctx, (unsigned char*)sldns_buffer_begin(buf), + if(EVP_DigestUpdate(ctx, (unsigned char*)sldns_buffer_begin(buf), (unsigned int)sldns_buffer_limit(buf)) == 0) { - verbose(VERB_QUERY, "verify: EVP_VerifyUpdate failed"); + verbose(VERB_QUERY, "verify: EVP_DigestUpdate failed"); +#ifdef HAVE_EVP_MD_CTX_NEW EVP_MD_CTX_destroy(ctx); +#else + EVP_MD_CTX_cleanup(ctx); + free(ctx); +#endif EVP_PKEY_free(evp_key); if(dofree) free(sigblock); else if(docrypto_free) OPENSSL_free(sigblock); @@ -663,6 +688,24 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock, } res = EVP_VerifyFinal(ctx, sigblock, sigblock_len, evp_key); +#else /* HAVE_EVP_DIGESTVERIFY */ + if(EVP_DigestVerifyInit(ctx, NULL, digest_type, NULL, evp_key) == 0) { + verbose(VERB_QUERY, "verify: EVP_DigestVerifyInit failed"); +#ifdef HAVE_EVP_MD_CTX_NEW + EVP_MD_CTX_destroy(ctx); +#else + EVP_MD_CTX_cleanup(ctx); + free(ctx); +#endif + EVP_PKEY_free(evp_key); + if(dofree) free(sigblock); + else if(docrypto_free) OPENSSL_free(sigblock); + return sec_status_unchecked; + } + res = EVP_DigestVerify(ctx, sigblock, sigblock_len, + (unsigned char*)sldns_buffer_begin(buf), + sldns_buffer_limit(buf)); +#endif #ifdef HAVE_EVP_MD_CTX_NEW EVP_MD_CTX_destroy(ctx); #else |