ldns  1.7.0
dnssec_sign.c
Go to the documentation of this file.
1 #include <ldns/config.h>
2 
3 #include <ldns/ldns.h>
4 
5 #include <ldns/dnssec.h>
6 #include <ldns/dnssec_sign.h>
7 
8 #include <strings.h>
9 #include <time.h>
10 
11 #ifdef HAVE_SSL
12 /* this entire file is rather useless when you don't have
13  * crypto...
14  */
15 #include <openssl/ssl.h>
16 #include <openssl/evp.h>
17 #include <openssl/rand.h>
18 #include <openssl/err.h>
19 #include <openssl/md5.h>
20 #include <openssl/bn.h>
21 #include <openssl/rsa.h>
22 #ifdef USE_DSA
23 #include <openssl/dsa.h>
24 #endif
25 #endif /* HAVE_SSL */
26 
27 ldns_rr *
29  const ldns_key *current_key)
30 {
31  uint32_t orig_ttl;
32  ldns_rr_class orig_class;
33  time_t now;
34  ldns_rr *current_sig;
35  uint8_t label_count;
36  ldns_rdf *signame;
37 
39  0)));
40  /* RFC4035 2.2: not counting the leftmost label if it is a wildcard */
42  label_count --;
43 
45 
46  /* set the type on the new signature */
47  orig_ttl = ldns_rr_ttl(ldns_rr_list_rr(rrset, 0));
48  orig_class = ldns_rr_get_class(ldns_rr_list_rr(rrset, 0));
49 
50  ldns_rr_set_ttl(current_sig, orig_ttl);
51  ldns_rr_set_class(current_sig, orig_class);
52  ldns_rr_set_owner(current_sig,
55  ldns_rr_list_rr(rrset,
56  0))));
57 
58  /* fill in what we know of the signature */
59 
60  /* set the orig_ttl */
62  current_sig,
64  orig_ttl));
65  /* the signers name */
66  signame = ldns_rdf_clone(ldns_key_pubkey_owner(current_key));
67  ldns_dname2canonical(signame);
69  current_sig,
70  signame);
71  /* label count - get it from the first rr in the rr_list */
73  current_sig,
75  label_count));
76  /* inception, expiration */
77  now = time(NULL);
78  if (ldns_key_inception(current_key) != 0) {
80  current_sig,
83  ldns_key_inception(current_key)));
84  } else {
86  current_sig,
88  }
89  if (ldns_key_expiration(current_key) != 0) {
91  current_sig,
94  ldns_key_expiration(current_key)));
95  } else {
97  current_sig,
100  now + LDNS_DEFAULT_EXP_TIME));
101  }
102 
104  current_sig,
106  ldns_key_keytag(current_key)));
107 
109  current_sig,
112  ldns_key_algorithm(current_key)));
113 
115  current_sig,
119  0))));
120  return current_sig;
121 }
122 
123 #ifdef HAVE_SSL
124 ldns_rdf *
126 {
127  ldns_rdf *b64rdf = NULL;
128 
129  switch(ldns_key_algorithm(current_key)) {
130 #ifdef USE_DSA
131  case LDNS_SIGN_DSA:
132  case LDNS_SIGN_DSA_NSEC3:
133  b64rdf = ldns_sign_public_evp(
134  sign_buf,
135  ldns_key_evp_key(current_key),
136 # ifdef HAVE_EVP_DSS1
137  EVP_dss1()
138 # else
139  EVP_sha1()
140 # endif
141  );
142  break;
143 #endif /* USE_DSA */
144  case LDNS_SIGN_RSASHA1:
146  b64rdf = ldns_sign_public_evp(
147  sign_buf,
148  ldns_key_evp_key(current_key),
149  EVP_sha1());
150  break;
151 #ifdef USE_SHA2
152  case LDNS_SIGN_RSASHA256:
153  b64rdf = ldns_sign_public_evp(
154  sign_buf,
155  ldns_key_evp_key(current_key),
156  EVP_sha256());
157  break;
158  case LDNS_SIGN_RSASHA512:
159  b64rdf = ldns_sign_public_evp(
160  sign_buf,
161  ldns_key_evp_key(current_key),
162  EVP_sha512());
163  break;
164 #endif /* USE_SHA2 */
165 #ifdef USE_GOST
166  case LDNS_SIGN_ECC_GOST:
167  b64rdf = ldns_sign_public_evp(
168  sign_buf,
169  ldns_key_evp_key(current_key),
170  EVP_get_digestbyname("md_gost94"));
171  break;
172 #endif /* USE_GOST */
173 #ifdef USE_ECDSA
175  b64rdf = ldns_sign_public_evp(
176  sign_buf,
177  ldns_key_evp_key(current_key),
178  EVP_sha256());
179  break;
181  b64rdf = ldns_sign_public_evp(
182  sign_buf,
183  ldns_key_evp_key(current_key),
184  EVP_sha384());
185  break;
186 #endif
187 #ifdef USE_ED25519
188  case LDNS_SIGN_ED25519:
189  b64rdf = ldns_sign_public_evp(
190  sign_buf,
191  ldns_key_evp_key(current_key),
192  NULL);
193  break;
194 #endif
195 #ifdef USE_ED448
196  case LDNS_SIGN_ED448:
197  b64rdf = ldns_sign_public_evp(
198  sign_buf,
199  ldns_key_evp_key(current_key),
200  NULL);
201  break;
202 #endif
203  case LDNS_SIGN_RSAMD5:
204  b64rdf = ldns_sign_public_evp(
205  sign_buf,
206  ldns_key_evp_key(current_key),
207  EVP_md5());
208  break;
209  default:
210  /* do _you_ know this alg? */
211  printf("unknown algorithm, ");
212  printf("is the one used available on this system?\n");
213  break;
214  }
215 
216  return b64rdf;
217 }
218 
223 ldns_rr_list *
225 {
226  ldns_rr_list *signatures;
227  ldns_rr_list *rrset_clone;
228  ldns_rr *current_sig;
229  ldns_rdf *b64rdf;
230  ldns_key *current_key;
231  size_t key_count;
232  uint16_t i;
233  ldns_buffer *sign_buf;
234  ldns_rdf *new_owner;
235 
236  if (!rrset || ldns_rr_list_rr_count(rrset) < 1 || !keys) {
237  return NULL;
238  }
239 
240  new_owner = NULL;
241 
242  /* prepare a signature and add all the know data
243  * prepare the rrset. Sign this together. */
244  rrset_clone = ldns_rr_list_clone(rrset);
245  if (!rrset_clone) {
246  return NULL;
247  }
248 
249  /* make it canonical */
250  for(i = 0; i < ldns_rr_list_rr_count(rrset_clone); i++) {
251  ldns_rr_set_ttl(ldns_rr_list_rr(rrset_clone, i),
252  ldns_rr_ttl(ldns_rr_list_rr(rrset, 0)));
253  ldns_rr2canonical(ldns_rr_list_rr(rrset_clone, i));
254  }
255  /* sort */
256  ldns_rr_list_sort(rrset_clone);
257 
258  signatures = ldns_rr_list_new();
259 
260  for (key_count = 0;
261  key_count < ldns_key_list_key_count(keys);
262  key_count++) {
263  if (!ldns_key_use(ldns_key_list_key(keys, key_count))) {
264  continue;
265  }
267  if (!sign_buf) {
268  ldns_rr_list_free(rrset_clone);
269  ldns_rr_list_free(signatures);
270  ldns_rdf_free(new_owner);
271  return NULL;
272  }
273  b64rdf = NULL;
274 
275  current_key = ldns_key_list_key(keys, key_count);
276  /* sign all RRs with keys that have ZSKbit, !SEPbit.
277  sign DNSKEY RRs with keys that have ZSKbit&SEPbit */
278  if (ldns_key_flags(current_key) & LDNS_KEY_ZONE_KEY) {
279  current_sig = ldns_create_empty_rrsig(rrset_clone,
280  current_key);
281 
282  /* right now, we have: a key, a semi-sig and an rrset. For
283  * which we can create the sig and base64 encode that and
284  * add that to the signature */
285 
286  if (ldns_rrsig2buffer_wire(sign_buf, current_sig)
287  != LDNS_STATUS_OK) {
288  ldns_buffer_free(sign_buf);
289  /* ERROR */
290  ldns_rr_list_deep_free(rrset_clone);
291  ldns_rr_free(current_sig);
292  ldns_rr_list_deep_free(signatures);
293  return NULL;
294  }
295 
296  /* add the rrset in sign_buf */
297  if (ldns_rr_list2buffer_wire(sign_buf, rrset_clone)
298  != LDNS_STATUS_OK) {
299  ldns_buffer_free(sign_buf);
300  ldns_rr_list_deep_free(rrset_clone);
301  ldns_rr_free(current_sig);
302  ldns_rr_list_deep_free(signatures);
303  return NULL;
304  }
305 
306  b64rdf = ldns_sign_public_buffer(sign_buf, current_key);
307 
308  if (!b64rdf) {
309  /* signing went wrong */
310  ldns_rr_list_deep_free(rrset_clone);
311  ldns_rr_free(current_sig);
312  ldns_rr_list_deep_free(signatures);
313  return NULL;
314  }
315 
316  ldns_rr_rrsig_set_sig(current_sig, b64rdf);
317 
318  /* push the signature to the signatures list */
319  ldns_rr_list_push_rr(signatures, current_sig);
320  }
321  ldns_buffer_free(sign_buf); /* restart for the next key */
322  }
323  ldns_rr_list_deep_free(rrset_clone);
324 
325  return signatures;
326 }
327 
336 ldns_rdf *
338 {
339 #ifdef USE_DSA
340  unsigned char *sha1_hash;
341  ldns_rdf *sigdata_rdf;
342  ldns_buffer *b64sig;
343 
344  DSA_SIG *sig;
345  const BIGNUM *R, *S;
346  uint8_t *data;
347  size_t pad;
348 
350  if (!b64sig) {
351  return NULL;
352  }
353 
354  sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
355  ldns_buffer_position(to_sign), NULL);
356  if (!sha1_hash) {
357  ldns_buffer_free(b64sig);
358  return NULL;
359  }
360 
361  sig = DSA_do_sign(sha1_hash, SHA_DIGEST_LENGTH, key);
362  if(!sig) {
363  ldns_buffer_free(b64sig);
364  return NULL;
365  }
366 
367  data = LDNS_XMALLOC(uint8_t, 1 + 2 * SHA_DIGEST_LENGTH);
368  if(!data) {
369  ldns_buffer_free(b64sig);
370  DSA_SIG_free(sig);
371  return NULL;
372  }
373 
374  data[0] = 1;
375 # ifdef HAVE_DSA_SIG_GET0
376  DSA_SIG_get0(sig, &R, &S);
377 # else
378  R = sig->r;
379  S = sig->s;
380 # endif
381  pad = 20 - (size_t) BN_num_bytes(R);
382  if (pad > 0) {
383  memset(data + 1, 0, pad);
384  }
385  BN_bn2bin(R, (unsigned char *) (data + 1) + pad);
386 
387  pad = 20 - (size_t) BN_num_bytes(S);
388  if (pad > 0) {
389  memset(data + 1 + SHA_DIGEST_LENGTH, 0, pad);
390  }
391  BN_bn2bin(S, (unsigned char *) (data + 1 + SHA_DIGEST_LENGTH + pad));
392 
394  1 + 2 * SHA_DIGEST_LENGTH,
395  data);
396 
397  ldns_buffer_free(b64sig);
398  LDNS_FREE(data);
399  DSA_SIG_free(sig);
400 
401  return sigdata_rdf;
402 #else
403  (void)to_sign; (void)key;
404  return NULL;
405 #endif
406 }
407 
408 #ifdef USE_ECDSA
409 #ifndef S_SPLINT_S
410 
411 static int
412 ldns_pkey_is_ecdsa(EVP_PKEY* pkey)
413 {
414  EC_KEY* ec;
415  const EC_GROUP* g;
416 #ifdef HAVE_EVP_PKEY_BASE_ID
417  if(EVP_PKEY_base_id(pkey) != EVP_PKEY_EC)
418  return 0;
419 #else
420  if(EVP_PKEY_type(key->type) != EVP_PKEY_EC)
421  return 0;
422 #endif
423  ec = EVP_PKEY_get1_EC_KEY(pkey);
424  g = EC_KEY_get0_group(ec);
425  if(!g) {
426  EC_KEY_free(ec);
427  return 0;
428  }
429  if(EC_GROUP_get_curve_name(g) == NID_X9_62_prime256v1) {
430  EC_KEY_free(ec);
431  return 32; /* 256/8 */
432  }
433  if(EC_GROUP_get_curve_name(g) == NID_secp384r1) {
434  EC_KEY_free(ec);
435  return 48; /* 384/8 */
436  }
437  /* downref the eckey, the original is still inside the pkey */
438  EC_KEY_free(ec);
439  return 0;
440 }
441 #endif /* splint */
442 #endif /* USE_ECDSA */
443 
444 ldns_rdf *
446  EVP_PKEY *key,
447  const EVP_MD *digest_type)
448 {
449  unsigned int siglen;
450  ldns_rdf *sigdata_rdf = NULL;
451  ldns_buffer *b64sig;
452  EVP_MD_CTX *ctx;
453  const EVP_MD *md_type;
454  int r;
455 
456  siglen = 0;
458  if (!b64sig) {
459  return NULL;
460  }
461 
462  /* initializes a signing context */
463  md_type = digest_type;
464 #ifdef USE_ED25519
465  if(EVP_PKEY_id(key) == NID_ED25519) {
466  /* digest must be NULL for ED25519 sign and verify */
467  md_type = NULL;
468  } else
469 #endif
470 #ifdef USE_ED448
471  if(EVP_PKEY_id(key) == NID_ED448) {
472  md_type = NULL;
473  } else
474 #endif
475  if(!md_type) {
476  /* unknown message digest */
477  ldns_buffer_free(b64sig);
478  return NULL;
479  }
480 
481 #ifdef HAVE_EVP_MD_CTX_NEW
482  ctx = EVP_MD_CTX_new();
483 #else
484  ctx = (EVP_MD_CTX*)malloc(sizeof(*ctx));
485  if(ctx) EVP_MD_CTX_init(ctx);
486 #endif
487  if(!ctx) {
488  ldns_buffer_free(b64sig);
489  return NULL;
490  }
491 
492 #if defined(USE_ED25519) || defined(USE_ED448)
493  if(md_type == NULL) {
494  /* for these methods we must use the one-shot DigestSign */
495  r = EVP_DigestSignInit(ctx, NULL, md_type, NULL, key);
496  if(r == 1) {
497  size_t siglen_sizet = ldns_buffer_capacity(b64sig);
498  r = EVP_DigestSign(ctx,
499  (unsigned char*)ldns_buffer_begin(b64sig),
500  &siglen_sizet,
501  (unsigned char*)ldns_buffer_begin(to_sign),
502  ldns_buffer_position(to_sign));
503  siglen = (unsigned int)siglen_sizet;
504  }
505  } else {
506 #else
507  r = 0;
508  if(md_type != NULL) {
509 #endif
510  r = EVP_SignInit(ctx, md_type);
511  if(r == 1) {
512  r = EVP_SignUpdate(ctx, (unsigned char*)
513  ldns_buffer_begin(to_sign),
514  ldns_buffer_position(to_sign));
515  }
516  if(r == 1) {
517  r = EVP_SignFinal(ctx, (unsigned char*)
518  ldns_buffer_begin(b64sig), &siglen, key);
519  }
520  }
521  if(r != 1) {
522  ldns_buffer_free(b64sig);
523  EVP_MD_CTX_destroy(ctx);
524  return NULL;
525  }
526 
527  /* OpenSSL output is different, convert it */
528  r = 0;
529 #ifdef USE_DSA
530 #ifndef S_SPLINT_S
531  /* unfortunately, OpenSSL output is different from DNS DSA format */
532 # ifdef HAVE_EVP_PKEY_BASE_ID
533  if (EVP_PKEY_base_id(key) == EVP_PKEY_DSA) {
534 # else
535  if (EVP_PKEY_type(key->type) == EVP_PKEY_DSA) {
536 # endif
537  r = 1;
538  sigdata_rdf = ldns_convert_dsa_rrsig_asn12rdf(b64sig, siglen);
539  }
540 #endif
541 #endif
542 #if defined(USE_ECDSA)
543  if(
544 # ifdef HAVE_EVP_PKEY_BASE_ID
545  EVP_PKEY_base_id(key)
546 # else
547  EVP_PKEY_type(key->type)
548 # endif
549  == EVP_PKEY_EC) {
550 # ifdef USE_ECDSA
551  if(ldns_pkey_is_ecdsa(key)) {
552  r = 1;
554  b64sig, (long)siglen, ldns_pkey_is_ecdsa(key));
555  }
556 # endif /* USE_ECDSA */
557  }
558 #endif /* PKEY_EC */
559  if(r == 0) {
560  /* ok output for other types is the same */
561  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
562  ldns_buffer_begin(b64sig));
563  }
564  ldns_buffer_free(b64sig);
565  EVP_MD_CTX_destroy(ctx);
566  return sigdata_rdf;
567 }
568 
569 ldns_rdf *
571 {
572  unsigned char *sha1_hash;
573  unsigned int siglen;
574  ldns_rdf *sigdata_rdf;
575  ldns_buffer *b64sig;
576  int result;
577 
578  siglen = 0;
580  if (!b64sig) {
581  return NULL;
582  }
583 
584  sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
585  ldns_buffer_position(to_sign), NULL);
586  if (!sha1_hash) {
587  ldns_buffer_free(b64sig);
588  return NULL;
589  }
590 
591  result = RSA_sign(NID_sha1, sha1_hash, SHA_DIGEST_LENGTH,
592  (unsigned char*)ldns_buffer_begin(b64sig),
593  &siglen, key);
594  if (result != 1) {
595  ldns_buffer_free(b64sig);
596  return NULL;
597  }
598 
599  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
600  ldns_buffer_begin(b64sig));
601  ldns_buffer_free(b64sig); /* can't free this buffer ?? */
602  return sigdata_rdf;
603 }
604 
605 ldns_rdf *
607 {
608  unsigned char *md5_hash;
609  unsigned int siglen;
610  ldns_rdf *sigdata_rdf;
611  ldns_buffer *b64sig;
612 
614  if (!b64sig) {
615  return NULL;
616  }
617 
618  md5_hash = MD5((unsigned char*)ldns_buffer_begin(to_sign),
619  ldns_buffer_position(to_sign), NULL);
620  if (!md5_hash) {
621  ldns_buffer_free(b64sig);
622  return NULL;
623  }
624 
625  RSA_sign(NID_md5, md5_hash, MD5_DIGEST_LENGTH,
626  (unsigned char*)ldns_buffer_begin(b64sig),
627  &siglen, key);
628 
629  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
630  ldns_buffer_begin(b64sig));
631  ldns_buffer_free(b64sig);
632  return sigdata_rdf;
633 }
634 #endif /* HAVE_SSL */
635 
639 static ldns_status
640 ldns_dnssec_addresses_on_glue_list(
641  ldns_dnssec_rrsets *cur_rrset,
642  ldns_rr_list *glue_list)
643 {
644  ldns_dnssec_rrs *cur_rrs;
645  while (cur_rrset) {
646  if (cur_rrset->type == LDNS_RR_TYPE_A
647  || cur_rrset->type == LDNS_RR_TYPE_AAAA) {
648  for (cur_rrs = cur_rrset->rrs;
649  cur_rrs;
650  cur_rrs = cur_rrs->next) {
651  if (cur_rrs->rr) {
652  if (!ldns_rr_list_push_rr(glue_list,
653  cur_rrs->rr)) {
654  return LDNS_STATUS_MEM_ERR;
655  /* ldns_rr_list_push_rr()
656  * returns false when unable
657  * to increase the capacity
658  * of the ldsn_rr_list
659  */
660  }
661  }
662  }
663  }
664  cur_rrset = cur_rrset->next;
665  }
666  return LDNS_STATUS_OK;
667 }
668 
685  ldns_rr_list *glue_list)
686 {
687  ldns_rbnode_t *node;
688  ldns_dnssec_name *name;
689  ldns_rdf *owner;
690  ldns_rdf *cut = NULL; /* keeps track of zone cuts */
691  /* When the cut is caused by a delegation, below_delegation will be 1.
692  * When caused by a DNAME, below_delegation will be 0.
693  */
694  int below_delegation = -1; /* init suppresses comiler warning */
695  ldns_status s;
696 
697  if (!zone || !zone->names) {
698  return LDNS_STATUS_NULL;
699  }
700  for (node = ldns_rbtree_first(zone->names);
701  node != LDNS_RBTREE_NULL;
702  node = ldns_rbtree_next(node)) {
703  name = (ldns_dnssec_name *) node->data;
704  owner = ldns_dnssec_name_name(name);
705 
706  if (cut) {
707  /* The previous node was a zone cut, or a subdomain
708  * below a zone cut. Is this node (still) a subdomain
709  * below the cut? Then the name is occluded. Unless
710  * the name contains a SOA, after which we are
711  * authoritative again.
712  *
713  * FIXME! If there are labels in between the SOA and
714  * the cut, going from the authoritative space (below
715  * the SOA) up into occluded space again, will not be
716  * detected with the contruct below!
717  */
718  if (ldns_dname_is_subdomain(owner, cut) &&
720  name->rrsets, LDNS_RR_TYPE_SOA)) {
721 
722  if (below_delegation && glue_list) {
723  s = ldns_dnssec_addresses_on_glue_list(
724  name->rrsets, glue_list);
725  if (s != LDNS_STATUS_OK) {
726  return s;
727  }
728  }
729  name->is_glue = true; /* Mark occluded name! */
730  continue;
731  } else {
732  cut = NULL;
733  }
734  }
735 
736  /* The node is not below a zone cut. Is it a zone cut itself?
737  * Everything below a SOA is authoritative of course; Except
738  * when the name also contains a DNAME :).
739  */
741  name->rrsets, LDNS_RR_TYPE_NS)
743  name->rrsets, LDNS_RR_TYPE_SOA)) {
744  cut = owner;
745  below_delegation = 1;
746  if (glue_list) { /* record glue on the zone cut */
747  s = ldns_dnssec_addresses_on_glue_list(
748  name->rrsets, glue_list);
749  if (s != LDNS_STATUS_OK) {
750  return s;
751  }
752  }
754  name->rrsets, LDNS_RR_TYPE_DNAME)) {
755  cut = owner;
756  below_delegation = 0;
757  }
758  }
759  return LDNS_STATUS_OK;
760 }
761 
774 {
775  return ldns_dnssec_zone_mark_and_get_glue(zone, NULL);
776 }
777 
780 {
781  ldns_rbnode_t *next_node = NULL;
782  ldns_dnssec_name *next_name = NULL;
783  bool done = false;
784 
785  if (node == LDNS_RBTREE_NULL) {
786  return NULL;
787  }
788  next_node = node;
789  while (!done) {
790  if (next_node == LDNS_RBTREE_NULL) {
791  return NULL;
792  } else {
793  next_name = (ldns_dnssec_name *)next_node->data;
794  if (!next_name->is_glue) {
795  done = true;
796  } else {
797  next_node = ldns_rbtree_next(next_node);
798  }
799  }
800  }
801  return next_node;
802 }
803 
806  ldns_rr_list *new_rrs)
807 {
808 
809  ldns_rbnode_t *first_node, *cur_node, *next_node;
810  ldns_dnssec_name *cur_name, *next_name;
811  ldns_rr *nsec_rr;
812  uint32_t nsec_ttl;
813  ldns_dnssec_rrsets *soa;
814 
815  /* the TTL of NSEC rrs should be set to the minimum TTL of
816  * the zone SOA (RFC4035 Section 2.3)
817  */
819 
820  /* did the caller actually set it? if not,
821  * fall back to default ttl
822  */
823  if (soa && soa->rrs && soa->rrs->rr
824  && (ldns_rr_rdf(soa->rrs->rr, 6) != NULL)) {
825  nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(soa->rrs->rr, 6));
826  } else {
827  nsec_ttl = LDNS_DEFAULT_TTL;
828  }
829 
831  ldns_rbtree_first(zone->names));
832  cur_node = first_node;
833  if (cur_node) {
835  ldns_rbtree_next(cur_node));
836  } else {
837  next_node = NULL;
838  }
839 
840  while (cur_node && next_node) {
841  cur_name = (ldns_dnssec_name *)cur_node->data;
842  next_name = (ldns_dnssec_name *)next_node->data;
843  nsec_rr = ldns_dnssec_create_nsec(cur_name,
844  next_name,
846  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
847  if(ldns_dnssec_name_add_rr(cur_name, nsec_rr)!=LDNS_STATUS_OK){
848  ldns_rr_free(nsec_rr);
849  return LDNS_STATUS_ERR;
850  }
851  ldns_rr_list_push_rr(new_rrs, nsec_rr);
852  cur_node = next_node;
853  if (cur_node) {
855  ldns_rbtree_next(cur_node));
856  }
857  }
858 
859  if (cur_node && !next_node) {
860  cur_name = (ldns_dnssec_name *)cur_node->data;
861  next_name = (ldns_dnssec_name *)first_node->data;
862  nsec_rr = ldns_dnssec_create_nsec(cur_name,
863  next_name,
865  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
866  if(ldns_dnssec_name_add_rr(cur_name, nsec_rr)!=LDNS_STATUS_OK){
867  ldns_rr_free(nsec_rr);
868  return LDNS_STATUS_ERR;
869  }
870  ldns_rr_list_push_rr(new_rrs, nsec_rr);
871  } else {
872  printf("error\n");
873  }
874 
875  return LDNS_STATUS_OK;
876 }
877 
878 #ifdef HAVE_SSL
879 static void
880 ldns_hashed_names_node_free(ldns_rbnode_t *node, void *arg) {
881  (void) arg;
882  LDNS_FREE(node);
883 }
884 
885 static ldns_status
886 ldns_dnssec_zone_create_nsec3s_mkmap(ldns_dnssec_zone *zone,
887  ldns_rr_list *new_rrs,
888  uint8_t algorithm,
889  uint8_t flags,
890  uint16_t iterations,
891  uint8_t salt_length,
892  uint8_t *salt,
893  ldns_rbtree_t **map)
894 {
895  ldns_rbnode_t *first_name_node;
896  ldns_rbnode_t *current_name_node;
897  ldns_dnssec_name *current_name;
898  ldns_status result = LDNS_STATUS_OK;
899  ldns_rr *nsec_rr;
900  ldns_rr_list *nsec3_list;
901  uint32_t nsec_ttl;
902  ldns_dnssec_rrsets *soa;
903  ldns_rbnode_t *hashmap_node;
904 
905  if (!zone || !new_rrs || !zone->names) {
906  return LDNS_STATUS_ERR;
907  }
908 
909  /* the TTL of NSEC rrs should be set to the minimum TTL of
910  * the zone SOA (RFC4035 Section 2.3)
911  */
913 
914  /* did the caller actually set it? if not,
915  * fall back to default ttl
916  */
917  if (soa && soa->rrs && soa->rrs->rr
918  && ldns_rr_rdf(soa->rrs->rr, 6) != NULL) {
919  nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(soa->rrs->rr, 6));
920  } else {
921  nsec_ttl = LDNS_DEFAULT_TTL;
922  }
923 
924  if (ldns_rdf_size(zone->soa->name) > 222) {
926  }
927 
928  if (zone->hashed_names) {
930  ldns_hashed_names_node_free, NULL);
931  LDNS_FREE(zone->hashed_names);
932  }
934  if (zone->hashed_names && map) {
935  *map = zone->hashed_names;
936  }
937 
938  first_name_node = ldns_dnssec_name_node_next_nonglue(
939  ldns_rbtree_first(zone->names));
940 
941  current_name_node = first_name_node;
942 
943  while (current_name_node && current_name_node != LDNS_RBTREE_NULL &&
944  result == LDNS_STATUS_OK) {
945 
946  current_name = (ldns_dnssec_name *) current_name_node->data;
947  nsec_rr = ldns_dnssec_create_nsec3(current_name,
948  NULL,
949  zone->soa->name,
950  algorithm,
951  flags,
952  iterations,
953  salt_length,
954  salt);
955  /* by default, our nsec based generator adds rrsigs
956  * remove the bitmap for empty nonterminals */
957  if (!current_name->rrsets) {
959  }
960  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
961  result = ldns_dnssec_name_add_rr(current_name, nsec_rr);
962  ldns_rr_list_push_rr(new_rrs, nsec_rr);
963  if (ldns_rr_owner(nsec_rr)) {
964  hashmap_node = LDNS_MALLOC(ldns_rbnode_t);
965  if (hashmap_node == NULL) {
966  return LDNS_STATUS_MEM_ERR;
967  }
968  current_name->hashed_name =
969  ldns_dname_label(ldns_rr_owner(nsec_rr), 0);
970 
971  if (current_name->hashed_name == NULL) {
972  LDNS_FREE(hashmap_node);
973  return LDNS_STATUS_MEM_ERR;
974  }
975  hashmap_node->key = current_name->hashed_name;
976  hashmap_node->data = current_name;
977 
978  if (! ldns_rbtree_insert(zone->hashed_names
979  , hashmap_node)) {
980  LDNS_FREE(hashmap_node);
981  }
982  }
983  current_name_node = ldns_dnssec_name_node_next_nonglue(
984  ldns_rbtree_next(current_name_node));
985  }
986  if (result != LDNS_STATUS_OK) {
987  return result;
988  }
989 
990  /* Make sorted list of nsec3s (via zone->hashed_names)
991  */
992  nsec3_list = ldns_rr_list_new();
993  if (nsec3_list == NULL) {
994  return LDNS_STATUS_MEM_ERR;
995  }
996  for ( hashmap_node = ldns_rbtree_first(zone->hashed_names)
997  ; hashmap_node != LDNS_RBTREE_NULL
998  ; hashmap_node = ldns_rbtree_next(hashmap_node)
999  ) {
1000  nsec_rr = ((ldns_dnssec_name *) hashmap_node->data)->nsec;
1001  if (nsec_rr) {
1002  ldns_rr_list_push_rr(nsec3_list, nsec_rr);
1003  }
1004  }
1005  result = ldns_dnssec_chain_nsec3_list(nsec3_list);
1006  ldns_rr_list_free(nsec3_list);
1007 
1008  return result;
1009 }
1010 
1013  ldns_rr_list *new_rrs,
1014  uint8_t algorithm,
1015  uint8_t flags,
1016  uint16_t iterations,
1017  uint8_t salt_length,
1018  uint8_t *salt)
1019 {
1020  return ldns_dnssec_zone_create_nsec3s_mkmap(zone, new_rrs, algorithm,
1021  flags, iterations, salt_length, salt, NULL);
1022 
1023 }
1024 #endif /* HAVE_SSL */
1025 
1028  , ATTR_UNUSED(ldns_key_list *key_list)
1029  , int (*func)(ldns_rr *, void *)
1030  , void *arg
1031  )
1032 {
1033  ldns_dnssec_rrs *base_rrs = signatures;
1034  ldns_dnssec_rrs *cur_rr = base_rrs;
1035  ldns_dnssec_rrs *prev_rr = NULL;
1036  ldns_dnssec_rrs *next_rr;
1037 
1038  uint16_t keytag;
1039  size_t i;
1040 
1041  if (!cur_rr) {
1042  switch(func(NULL, arg)) {
1045  break;
1048  ldns_key_list_set_use(key_list, false);
1049  break;
1050  default:
1051 #ifdef STDERR_MSGS
1052  fprintf(stderr, "[XX] unknown return value from callback\n");
1053 #endif
1054  break;
1055  }
1056  return NULL;
1057  }
1058  (void)func(cur_rr->rr, arg);
1059 
1060  while (cur_rr) {
1061  next_rr = cur_rr->next;
1062 
1063  switch (func(cur_rr->rr, arg)) {
1065  prev_rr = cur_rr;
1066  break;
1068  keytag = ldns_rdf2native_int16(
1069  ldns_rr_rrsig_keytag(cur_rr->rr));
1070  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1071  if (ldns_key_keytag(ldns_key_list_key(key_list, i)) ==
1072  keytag) {
1073  ldns_key_set_use(ldns_key_list_key(key_list, i),
1074  false);
1075  }
1076  }
1077  prev_rr = cur_rr;
1078  break;
1080  keytag = ldns_rdf2native_int16(
1081  ldns_rr_rrsig_keytag(cur_rr->rr));
1082  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1083  if (ldns_key_keytag(ldns_key_list_key(key_list, i))
1084  == keytag) {
1085  ldns_key_set_use(ldns_key_list_key(key_list, i),
1086  false);
1087  }
1088  }
1089  if (prev_rr) {
1090  prev_rr->next = next_rr;
1091  } else {
1092  base_rrs = next_rr;
1093  }
1094  LDNS_FREE(cur_rr);
1095  break;
1097  if (prev_rr) {
1098  prev_rr->next = next_rr;
1099  } else {
1100  base_rrs = next_rr;
1101  }
1102  LDNS_FREE(cur_rr);
1103  break;
1104  default:
1105 #ifdef STDERR_MSGS
1106  fprintf(stderr, "[XX] unknown return value from callback\n");
1107 #endif
1108  break;
1109  }
1110  cur_rr = next_rr;
1111  }
1112 
1113  return base_rrs;
1114 }
1115 
1116 #ifdef HAVE_SSL
1119  ldns_rr_list *new_rrs,
1120  ldns_key_list *key_list,
1121  int (*func)(ldns_rr *, void*),
1122  void *arg)
1123 {
1124  return ldns_dnssec_zone_create_rrsigs_flg(zone, new_rrs, key_list,
1125  func, arg, 0);
1126 }
1127 
1129 static void
1130 ldns_key_list_filter_for_dnskey(ldns_key_list *key_list, int flags)
1131 {
1132  bool algos[256]
1133 #ifndef S_SPLINT_S
1134  = { false }
1135 #endif
1136  ;
1137  ldns_signing_algorithm saw_ksk = 0;
1138  ldns_key *key;
1139  size_t i;
1140 
1141  if (!ldns_key_list_key_count(key_list))
1142  return;
1143 
1144  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1145  key = ldns_key_list_key(key_list, i);
1146  if ((ldns_key_flags(key) & LDNS_KEY_SEP_KEY) && !saw_ksk)
1147  saw_ksk = ldns_key_algorithm(key);
1148  algos[ldns_key_algorithm(key)] = true;
1149  }
1150  if (!saw_ksk)
1151  return;
1152  else
1153  algos[saw_ksk] = 0;
1154 
1155  for (i =0; i < ldns_key_list_key_count(key_list); i++) {
1156  key = ldns_key_list_key(key_list, i);
1157  if (!(ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
1158  /* We have a ZSK.
1159  * Still use it if it has a unique algorithm though!
1160  */
1161  if ((flags & LDNS_SIGN_WITH_ALL_ALGORITHMS) &&
1162  algos[ldns_key_algorithm(key)])
1163  algos[ldns_key_algorithm(key)] = false;
1164  else
1165  ldns_key_set_use(key, 0);
1166  }
1167  }
1168 }
1169 
1171 static void
1172 ldns_key_list_filter_for_non_dnskey(ldns_key_list *key_list, int flags)
1173 {
1174  bool algos[256]
1175 #ifndef S_SPLINT_S
1176  = { false }
1177 #endif
1178  ;
1179  ldns_signing_algorithm saw_zsk = 0;
1180  ldns_key *key;
1181  size_t i;
1182 
1183  if (!ldns_key_list_key_count(key_list))
1184  return;
1185 
1186  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1187  key = ldns_key_list_key(key_list, i);
1188  if (!(ldns_key_flags(key) & LDNS_KEY_SEP_KEY) && !saw_zsk)
1189  saw_zsk = ldns_key_algorithm(key);
1190  algos[ldns_key_algorithm(key)] = true;
1191  }
1192  if (!saw_zsk)
1193  return;
1194  else
1195  algos[saw_zsk] = 0;
1196 
1197  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1198  key = ldns_key_list_key(key_list, i);
1199  if((ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
1200  /* We have a KSK.
1201  * Still use it if it has a unique algorithm though!
1202  */
1203  if ((flags & LDNS_SIGN_WITH_ALL_ALGORITHMS) &&
1204  algos[ldns_key_algorithm(key)])
1205  algos[ldns_key_algorithm(key)] = false;
1206  else
1207  ldns_key_set_use(key, 0);
1208  }
1209  }
1210 }
1211 
1214  , ldns_rr_list *new_rrs
1215  , ldns_key_list *key_list
1216  , int (*func)(ldns_rr *, void*)
1217  , void *arg
1218  , int flags
1219  )
1220 {
1221  ldns_status result = LDNS_STATUS_OK;
1222 
1223  ldns_rbnode_t *cur_node;
1224  ldns_rr_list *rr_list;
1225 
1226  ldns_dnssec_name *cur_name;
1227  ldns_dnssec_rrsets *cur_rrset;
1228  ldns_dnssec_rrs *cur_rr;
1229 
1230  ldns_rr_list *siglist;
1231 
1232  size_t i;
1233 
1234  int on_delegation_point = 0; /* handle partially occluded names */
1235 
1236  ldns_rr_list *pubkey_list = ldns_rr_list_new();
1237  for (i = 0; i<ldns_key_list_key_count(key_list); i++) {
1238  ldns_rr_list_push_rr( pubkey_list
1240  key_list, i))
1241  );
1242  }
1243  /* TODO: callback to see is list should be signed */
1244  /* TODO: remove 'old' signatures from signature list */
1245  cur_node = ldns_rbtree_first(zone->names);
1246  while (cur_node != LDNS_RBTREE_NULL) {
1247  cur_name = (ldns_dnssec_name *) cur_node->data;
1248 
1249  if (!cur_name->is_glue) {
1250  on_delegation_point = ldns_dnssec_rrsets_contains_type(
1251  cur_name->rrsets, LDNS_RR_TYPE_NS)
1253  cur_name->rrsets, LDNS_RR_TYPE_SOA);
1254  cur_rrset = cur_name->rrsets;
1255  while (cur_rrset) {
1256  /* reset keys to use */
1257  ldns_key_list_set_use(key_list, true);
1258 
1259  /* walk through old sigs, remove the old,
1260  and mark which keys (not) to use) */
1261  cur_rrset->signatures =
1263  key_list,
1264  func,
1265  arg);
1266  if(cur_rrset->type == LDNS_RR_TYPE_DNSKEY ||
1267  cur_rrset->type == LDNS_RR_TYPE_CDNSKEY ||
1268  cur_rrset->type == LDNS_RR_TYPE_CDS) {
1269  if(!(flags&LDNS_SIGN_DNSKEY_WITH_ZSK)) {
1270  ldns_key_list_filter_for_dnskey(key_list, flags);
1271  }
1272  } else {
1273  ldns_key_list_filter_for_non_dnskey(key_list, flags);
1274  }
1275 
1276  /* TODO: just set count to zero? */
1277  rr_list = ldns_rr_list_new();
1278 
1279  cur_rr = cur_rrset->rrs;
1280  while (cur_rr) {
1281  ldns_rr_list_push_rr(rr_list, cur_rr->rr);
1282  cur_rr = cur_rr->next;
1283  }
1284 
1285  /* only sign non-delegation RRsets */
1286  /* (glue should have been marked earlier,
1287  * except on the delegation points itself) */
1288  if (!on_delegation_point ||
1289  ldns_rr_list_type(rr_list)
1290  == LDNS_RR_TYPE_DS ||
1291  ldns_rr_list_type(rr_list)
1292  == LDNS_RR_TYPE_NSEC ||
1293  ldns_rr_list_type(rr_list)
1294  == LDNS_RR_TYPE_NSEC3) {
1295  siglist = ldns_sign_public(rr_list, key_list);
1296  for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
1297  if (cur_rrset->signatures) {
1298  result = ldns_dnssec_rrs_add_rr(cur_rrset->signatures,
1299  ldns_rr_list_rr(siglist,
1300  i));
1301  } else {
1302  cur_rrset->signatures = ldns_dnssec_rrs_new();
1303  cur_rrset->signatures->rr =
1304  ldns_rr_list_rr(siglist, i);
1305  }
1306  if (new_rrs) {
1307  ldns_rr_list_push_rr(new_rrs,
1308  ldns_rr_list_rr(siglist,
1309  i));
1310  }
1311  }
1312  ldns_rr_list_free(siglist);
1313  }
1314 
1315  ldns_rr_list_free(rr_list);
1316 
1317  cur_rrset = cur_rrset->next;
1318  }
1319 
1320  /* sign the nsec */
1321  ldns_key_list_set_use(key_list, true);
1322  cur_name->nsec_signatures =
1324  key_list,
1325  func,
1326  arg);
1327  ldns_key_list_filter_for_non_dnskey(key_list, flags);
1328 
1329  rr_list = ldns_rr_list_new();
1330  ldns_rr_list_push_rr(rr_list, cur_name->nsec);
1331  siglist = ldns_sign_public(rr_list, key_list);
1332 
1333  for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
1334  if (cur_name->nsec_signatures) {
1335  result = ldns_dnssec_rrs_add_rr(cur_name->nsec_signatures,
1336  ldns_rr_list_rr(siglist, i));
1337  } else {
1338  cur_name->nsec_signatures = ldns_dnssec_rrs_new();
1339  cur_name->nsec_signatures->rr =
1340  ldns_rr_list_rr(siglist, i);
1341  }
1342  if (new_rrs) {
1343  ldns_rr_list_push_rr(new_rrs,
1344  ldns_rr_list_rr(siglist, i));
1345  }
1346  }
1347 
1348  ldns_rr_list_free(siglist);
1349  ldns_rr_list_free(rr_list);
1350  }
1351  cur_node = ldns_rbtree_next(cur_node);
1352  }
1353 
1354  ldns_rr_list_deep_free(pubkey_list);
1355  return result;
1356 }
1357 
1360  ldns_rr_list *new_rrs,
1361  ldns_key_list *key_list,
1362  int (*func)(ldns_rr *, void *),
1363  void *arg)
1364 {
1365  return ldns_dnssec_zone_sign_flg(zone, new_rrs, key_list, func, arg, 0);
1366 }
1367 
1370  ldns_rr_list *new_rrs,
1371  ldns_key_list *key_list,
1372  int (*func)(ldns_rr *, void *),
1373  void *arg,
1374  int flags)
1375 {
1376  ldns_status result = LDNS_STATUS_OK;
1377 
1378  if (!zone || !new_rrs || !key_list) {
1379  return LDNS_STATUS_ERR;
1380  }
1381 
1382  /* zone is already sorted */
1383  result = ldns_dnssec_zone_mark_glue(zone);
1384  if (result != LDNS_STATUS_OK) {
1385  return result;
1386  }
1387 
1388  /* check whether we need to add nsecs */
1389  if (zone->names && !((ldns_dnssec_name *)zone->names->root->data)->nsec) {
1390  result = ldns_dnssec_zone_create_nsecs(zone, new_rrs);
1391  if (result != LDNS_STATUS_OK) {
1392  return result;
1393  }
1394  }
1395 
1396  result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1397  new_rrs,
1398  key_list,
1399  func,
1400  arg,
1401  flags);
1402 
1403  return result;
1404 }
1405 
1408  ldns_rr_list *new_rrs,
1409  ldns_key_list *key_list,
1410  int (*func)(ldns_rr *, void *),
1411  void *arg,
1412  uint8_t algorithm,
1413  uint8_t flags,
1414  uint16_t iterations,
1415  uint8_t salt_length,
1416  uint8_t *salt)
1417 {
1418  return ldns_dnssec_zone_sign_nsec3_flg_mkmap(zone, new_rrs, key_list,
1419  func, arg, algorithm, flags, iterations, salt_length, salt, 0,
1420  NULL);
1421 }
1422 
1425  ldns_rr_list *new_rrs,
1426  ldns_key_list *key_list,
1427  int (*func)(ldns_rr *, void *),
1428  void *arg,
1429  uint8_t algorithm,
1430  uint8_t flags,
1431  uint16_t iterations,
1432  uint8_t salt_length,
1433  uint8_t *salt,
1434  int signflags,
1435  ldns_rbtree_t **map)
1436 {
1437  ldns_rr *nsec3, *nsec3param;
1438  ldns_status result = LDNS_STATUS_OK;
1439 
1440  /* zone is already sorted */
1441  result = ldns_dnssec_zone_mark_glue(zone);
1442  if (result != LDNS_STATUS_OK) {
1443  return result;
1444  }
1445 
1446  /* TODO if there are already nsec3s presents and their
1447  * parameters are the same as these, we don't have to recreate
1448  */
1449  if (zone->names) {
1450  /* add empty nonterminals */
1452  if (result != LDNS_STATUS_OK) {
1453  return result;
1454  }
1455 
1456  nsec3 = ((ldns_dnssec_name *)zone->names->root->data)->nsec;
1457  if (nsec3 && ldns_rr_get_type(nsec3) == LDNS_RR_TYPE_NSEC3) {
1458  /* no need to recreate */
1459  } else {
1460  if (!ldns_dnssec_zone_find_rrset(zone,
1461  zone->soa->name,
1463  /* create and add the nsec3param rr */
1464  nsec3param =
1466  ldns_rr_set_owner(nsec3param,
1467  ldns_rdf_clone(zone->soa->name));
1468  ldns_nsec3_add_param_rdfs(nsec3param,
1469  algorithm,
1470  flags,
1471  iterations,
1472  salt_length,
1473  salt);
1474  /* always set bit 7 of the flags to zero, according to
1475  * rfc5155 section 11. The bits are counted from right to left,
1476  * so bit 7 in rfc5155 is bit 0 in ldns */
1477  ldns_set_bit(ldns_rdf_data(ldns_rr_rdf(nsec3param, 1)), 0, 0);
1478  result = ldns_dnssec_zone_add_rr(zone, nsec3param);
1479  if (result != LDNS_STATUS_OK) {
1480  return result;
1481  }
1482  ldns_rr_list_push_rr(new_rrs, nsec3param);
1483  }
1484  result = ldns_dnssec_zone_create_nsec3s_mkmap(zone,
1485  new_rrs,
1486  algorithm,
1487  flags,
1488  iterations,
1489  salt_length,
1490  salt,
1491  map);
1492  if (result != LDNS_STATUS_OK) {
1493  return result;
1494  }
1495  }
1496 
1497  result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1498  new_rrs,
1499  key_list,
1500  func,
1501  arg,
1502  signflags);
1503  }
1504 
1505  return result;
1506 }
1507 
1510  ldns_rr_list *new_rrs,
1511  ldns_key_list *key_list,
1512  int (*func)(ldns_rr *, void *),
1513  void *arg,
1514  uint8_t algorithm,
1515  uint8_t flags,
1516  uint16_t iterations,
1517  uint8_t salt_length,
1518  uint8_t *salt,
1519  int signflags)
1520 {
1521  return ldns_dnssec_zone_sign_nsec3_flg_mkmap(zone, new_rrs, key_list,
1522  func, arg, algorithm, flags, iterations, salt_length, salt,
1523  signflags, NULL);
1524 }
1525 
1526 ldns_zone *
1527 ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
1528 {
1529  ldns_dnssec_zone *dnssec_zone;
1530  ldns_zone *signed_zone;
1531  ldns_rr_list *new_rrs;
1532  size_t i;
1533 
1534  signed_zone = ldns_zone_new();
1535  dnssec_zone = ldns_dnssec_zone_new();
1536 
1537  (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1538  ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1539 
1540  for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1541  (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1543  i));
1544  ldns_zone_push_rr(signed_zone,
1546  i)));
1547  }
1548 
1549  new_rrs = ldns_rr_list_new();
1550  (void) ldns_dnssec_zone_sign(dnssec_zone,
1551  new_rrs,
1552  key_list,
1554  NULL);
1555 
1556  for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1557  ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1558  ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1559  }
1560 
1561  ldns_rr_list_deep_free(new_rrs);
1562  ldns_dnssec_zone_free(dnssec_zone);
1563 
1564  return signed_zone;
1565 }
1566 
1567 ldns_zone *
1568 ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
1569 {
1570  ldns_dnssec_zone *dnssec_zone;
1571  ldns_zone *signed_zone;
1572  ldns_rr_list *new_rrs;
1573  size_t i;
1574 
1575  signed_zone = ldns_zone_new();
1576  dnssec_zone = ldns_dnssec_zone_new();
1577 
1578  (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1579  ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1580 
1581  for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1582  (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1584  i));
1585  ldns_zone_push_rr(signed_zone,
1587  i)));
1588  }
1589 
1590  new_rrs = ldns_rr_list_new();
1591  (void) ldns_dnssec_zone_sign_nsec3(dnssec_zone,
1592  new_rrs,
1593  key_list,
1595  NULL,
1596  algorithm,
1597  flags,
1598  iterations,
1599  salt_length,
1600  salt);
1601 
1602  for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1603  ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1604  ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1605  }
1606 
1607  ldns_rr_list_deep_free(new_rrs);
1608  ldns_dnssec_zone_free(dnssec_zone);
1609 
1610  return signed_zone;
1611 }
1612 #endif /* HAVE_SSL */
1613 
1614 
ldns_rr_rdf
ldns_rdf * ldns_rr_rdf(const ldns_rr *rr, size_t nr)
returns the rdata field member counter.
Definition: rr.c:901
ldns_rr_rrsig_set_sig
bool ldns_rr_rrsig_set_sig(ldns_rr *r, ldns_rdf *f)
sets the signature data of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:213
ldns_native2rdf_int16
ldns_rdf * ldns_native2rdf_int16(ldns_rdf_type type, uint16_t value)
returns the rdf containing the native uint16_t representation.
Definition: rdata.c:132
ldns_struct_rr_list
List or Set of Resource Records.
Definition: rr.h:336
ldns_rr_class
enum ldns_enum_rr_class ldns_rr_class
Definition: rr.h:61
ldns_struct_dnssec_name::nsec
ldns_rr * nsec
NSEC pointing to the next name (or NSEC3 pointing to the next NSEC3)
Definition: dnssec_zone.h:67
ldns_rbtree_t
definition for tree struct
Definition: rbtree.h:83
ldns_rdf_size
size_t ldns_rdf_size(const ldns_rdf *rd)
returns the size of the rdf.
Definition: rdata.c:24
ldns_rr_rrsig_set_algorithm
bool ldns_rr_rrsig_set_algorithm(ldns_rr *r, ldns_rdf *f)
sets the algorithm of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:129
ldns_struct_dnssec_rrs::rr
ldns_rr * rr
Definition: dnssec_zone.h:24
ldns_struct_buffer
implementation of buffers to ease operations
Definition: buffer.h:51
LDNS_MAX_PACKETLEN
#define LDNS_MAX_PACKETLEN
Definition: packet.h:24
ldns_buffer_new
ldns_buffer * ldns_buffer_new(size_t capacity)
creates a new buffer with the specified capacity.
Definition: buffer.c:16
ldns_dnssec_zone_new
ldns_dnssec_zone * ldns_dnssec_zone_new(void)
Creates a new dnssec_zone structure.
Definition: dnssec_zone.c:569
ldns_rr_rrsig_set_signame
bool ldns_rr_rrsig_set_signame(ldns_rr *r, ldns_rdf *f)
sets the signers name of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:201
LDNS_RDF_TYPE_INT32
@ LDNS_RDF_TYPE_INT32
32 bits
Definition: rdata.h:56
ldns_key_evp_key
EVP_PKEY * ldns_key_evp_key(const ldns_key *k)
returns the (openssl) EVP struct contained in the key
Definition: keys.c:1485
ldns_key2rr
ldns_rr * ldns_key2rr(const ldns_key *k)
converts a ldns_key to a public key rr If the key data exists at an external point,...
Definition: keys.c:1800
ldns_native2rdf_int32
ldns_rdf * ldns_native2rdf_int32(ldns_rdf_type type, uint32_t value)
returns an rdf that contains the given int32 value.
Definition: rdata.c:147
ldns_dnssec_zone_sign
ldns_status ldns_dnssec_zone_sign(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg)
signs the given zone with the given keys
Definition: dnssec_sign.c:1359
ldns_rbtree_create
ldns_rbtree_t * ldns_rbtree_create(int(*cmpf)(const void *, const void *))
Create new tree (malloced) with given key compare function.
Definition: rbtree.c:80
HAVE_EVP_PKEY_BASE_ID
#define HAVE_EVP_PKEY_BASE_ID
Definition: config.h:96
ldns_zone_new
ldns_zone * ldns_zone_new(void)
create a new ldns_zone structure
Definition: zone.c:165
ldns_native2rdf_int8
ldns_rdf * ldns_native2rdf_int8(ldns_rdf_type type, uint8_t value)
returns the rdf containing the native uint8_t repr.
Definition: rdata.c:126
ldns_struct_rr
Resource Record.
Definition: rr.h:308
ldns_dnssec_zone_mark_and_get_glue
ldns_status ldns_dnssec_zone_mark_and_get_glue(ldns_dnssec_zone *zone, ldns_rr_list *glue_list)
Marks the names in the zone that are occluded.
Definition: dnssec_sign.c:684
ldns_dnssec_zone_mark_glue
ldns_status ldns_dnssec_zone_mark_glue(ldns_dnssec_zone *zone)
Marks the names in the zone that are occluded.
Definition: dnssec_sign.c:773
ldns_dnssec_rrs_new
ldns_dnssec_rrs * ldns_dnssec_rrs_new(void)
Creates a new entry for 1 pointer to an rr and 1 pointer to the next rrs.
Definition: dnssec_zone.c:10
LDNS_SIGNATURE_REMOVE_NO_ADD
#define LDNS_SIGNATURE_REMOVE_NO_ADD
Definition: dnssec.h:50
LDNS_FREE
#define LDNS_FREE(ptr)
Definition: util.h:60
ldns_dnssec_zone_add_rr
ldns_status ldns_dnssec_zone_add_rr(ldns_dnssec_zone *zone, ldns_rr *rr)
Adds the given RR to the zone.
Definition: dnssec_zone.c:928
ldns_rr_rrsig_set_keytag
bool ldns_rr_rrsig_set_keytag(ldns_rr *r, ldns_rdf *f)
sets the keytag of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:189
LDNS_RDF_TYPE_INT16
@ LDNS_RDF_TYPE_INT16
16 bits
Definition: rdata.h:54
LDNS_STATUS_OK
@ LDNS_STATUS_OK
Definition: error.h:26
ldns_rrsig2buffer_wire
ldns_status ldns_rrsig2buffer_wire(ldns_buffer *buffer, const ldns_rr *rr)
Converts a rrsig to wireformat BUT EXCLUDE the rrsig rdata This is needed in DNSSEC verification.
Definition: host2wire.c:294
LDNS_STATUS_ERR
@ LDNS_STATUS_ERR
Definition: error.h:37
ldns_zone_push_rr
bool ldns_zone_push_rr(ldns_zone *z, ldns_rr *rr)
push an single rr to a zone structure.
Definition: zone.c:53
ldns_sign_public_rsamd5
ldns_rdf * ldns_sign_public_rsamd5(ldns_buffer *to_sign, RSA *key)
Sign a buffer with the RSA key (hash with MD5)
Definition: dnssec_sign.c:606
ldns_rr_pop_rdf
ldns_rdf * ldns_rr_pop_rdf(ldns_rr *rr)
removes a rd_field member, it will be popped from the last position.
Definition: rr.c:872
ldns_dnssec_chain_nsec3_list
ldns_status ldns_dnssec_chain_nsec3_list(ldns_rr_list *nsec3_rrs)
chains nsec3 list
Definition: dnssec.c:1630
LDNS_KEY_SEP_KEY
#define LDNS_KEY_SEP_KEY
Definition: keys.h:38
ldns_dnssec_rrs_add_rr
ldns_status ldns_dnssec_rrs_add_rr(ldns_dnssec_rrs *rrs, ldns_rr *rr)
Adds an RR to the list of RRs.
Definition: dnssec_zone.c:47
ldns_rr_list_push_rr
bool ldns_rr_list_push_rr(ldns_rr_list *rr_list, const ldns_rr *rr)
pushes an rr to an rrlist.
Definition: rr.c:1124
ldns_dname_label
ldns_rdf * ldns_dname_label(const ldns_rdf *rdf, uint8_t labelpos)
look inside the rdf and if it is an LDNS_RDF_TYPE_DNAME try and retrieve a specific label.
Definition: dname.c:560
ldns_dnssec_rrsets_contains_type
int ldns_dnssec_rrsets_contains_type(const ldns_dnssec_rrsets *rrsets, ldns_rr_type type)
returns whether a rrset of the given type is found in the rrsets.
Definition: dnssec.c:799
LDNS_KEY_ZONE_KEY
#define LDNS_KEY_ZONE_KEY
Definition: keys.h:37
ldns_struct_key_list
Same as rr_list, but now for keys.
Definition: keys.h:177
ldns_rr_set_ttl
void ldns_rr_set_ttl(ldns_rr *rr, uint32_t ttl)
sets the ttl in the rr structure.
Definition: rr.c:808
ldns_rr_set_class
void ldns_rr_set_class(ldns_rr *rr, ldns_rr_class rr_class)
sets the class in the rr.
Definition: rr.c:826
ldns_dnssec_zone_create_nsecs
ldns_status ldns_dnssec_zone_create_nsecs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs)
Adds NSEC records to the given dnssec_zone.
Definition: dnssec_sign.c:805
ldns_dnssec_zone_sign_nsec3_flg
ldns_status ldns_dnssec_zone_sign_nsec3_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1509
LDNS_SIGN_ECDSAP256SHA256
@ LDNS_SIGN_ECDSAP256SHA256
Definition: keys.h:99
LDNS_STATUS_NSEC3_DOMAINNAME_OVERFLOW
@ LDNS_STATUS_NSEC3_DOMAINNAME_OVERFLOW
Definition: error.h:131
ldns_rr_list_deep_free
void ldns_rr_list_deep_free(ldns_rr_list *rr_list)
frees an rr_list structure and all rrs contained therein.
Definition: rr.c:1012
ldns_struct_dnssec_rrs::next
ldns_dnssec_rrs * next
Definition: dnssec_zone.h:25
ldns_dname_is_wildcard
int ldns_dname_is_wildcard(const ldns_rdf *dname)
Check if dname is a wildcard, starts with *.
Definition: dname.c:456
ldns_key_flags
uint16_t ldns_key_flags(const ldns_key *k)
return the flag of the key
Definition: keys.c:1550
LDNS_RR_TYPE_CDS
@ LDNS_RR_TYPE_CDS
Definition: rr.h:190
ldns_dnssec_zone_sign_flg
ldns_status ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
signs the given zone with the given keys
Definition: dnssec_sign.c:1369
ldns_rr2canonical
void ldns_rr2canonical(ldns_rr *rr)
converts each dname in a rr to its canonical form.
Definition: rr.c:1772
ldns_rr_rrsig_keytag
ldns_rdf * ldns_rr_rrsig_keytag(const ldns_rr *r)
returns the keytag of a LDNS_RR_TYPE_RRSIG RR
Definition: rr_functions.c:183
dnssec_sign.h
ldns_dnssec_remove_signatures
ldns_dnssec_rrs * ldns_dnssec_remove_signatures(ldns_dnssec_rrs *signatures, ldns_key_list *key_list __attribute__((unused)), int(*func)(ldns_rr *, void *), void *arg)
Definition: dnssec_sign.c:1027
ldns_zone_rrs
ldns_rr_list * ldns_zone_rrs(const ldns_zone *z)
Get a list of a zone's content.
Definition: zone.c:35
ldns_rbnode_t::key
const void * key
pointer to sorting key
Definition: rbtree.h:68
LDNS_RR_TYPE_CDNSKEY
@ LDNS_RR_TYPE_CDNSKEY
Definition: rr.h:191
ldns_sign_public_buffer
ldns_rdf * ldns_sign_public_buffer(ldns_buffer *sign_buf, ldns_key *current_key)
Sign the buffer which contains the wiredata of an rrset, and the corresponding empty rrsig rr with th...
Definition: dnssec_sign.c:125
ldns_struct_dnssec_name::is_glue
bool is_glue
Unlike what the name is_glue suggests, this field is set to true by ldns_dnssec_zone_mark_glue() or l...
Definition: dnssec_zone.h:81
ldns_set_bit
void ldns_set_bit(uint8_t *byte, int bit_nr, bool value)
sets the specified bit in the specified byte to 1 if value is true, 0 if false The bits are counted f...
Definition: util.c:72
ldns_dnssec_name_node_next_nonglue
ldns_rbnode_t * ldns_dnssec_name_node_next_nonglue(ldns_rbnode_t *node)
Finds the first dnssec_name node in the rbtree that is not occluded.
Definition: dnssec_sign.c:779
LDNS_RR_TYPE_NSEC3PARAM
@ LDNS_RR_TYPE_NSEC3PARAM
Definition: rr.h:177
ldns_key_use
bool ldns_key_use(const ldns_key *k)
return the use flag
Definition: keys.c:1474
ldns_rr_get_class
ldns_rr_class ldns_rr_get_class(const ldns_rr *rr)
returns the class of the rr.
Definition: rr.c:941
ldns_rr_free
void ldns_rr_free(ldns_rr *rr)
frees an RR structure
Definition: rr.c:75
LDNS_SIGN_ECC_GOST
@ LDNS_SIGN_ECC_GOST
Definition: keys.h:98
ldns_struct_dnssec_name::rrsets
ldns_dnssec_rrsets * rrsets
The rrsets for this name.
Definition: dnssec_zone.h:63
LDNS_SIGN_RSASHA1
@ LDNS_SIGN_RSASHA1
Definition: keys.h:92
ldns_struct_dnssec_name::nsec_signatures
ldns_dnssec_rrs * nsec_signatures
signatures for the NSEC record
Definition: dnssec_zone.h:71
ldns_struct_dnssec_name::name
ldns_rdf * name
pointer to a dname containing the name.
Definition: dnssec_zone.h:51
ldns_dnssec_zone_create_rrsigs
ldns_status ldns_dnssec_zone_create_rrsigs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg)
Adds signatures to the zone.
Definition: dnssec_sign.c:1118
ldns_sign_public_dsa
ldns_rdf * ldns_sign_public_dsa(ldns_buffer *to_sign, DSA *key)
Sign data with DSA.
Definition: dnssec_sign.c:337
ldns_zone_set_soa
void ldns_zone_set_soa(ldns_zone *z, ldns_rr *soa)
Set the zone's soa record.
Definition: zone.c:29
ldns_rdf_new_frm_data
ldns_rdf * ldns_rdf_new_frm_data(ldns_rdf_type type, size_t size, const void *data)
allocates a new rdf structure and fills it.
Definition: rdata.c:193
ldns_key_set_use
void ldns_key_set_use(ldns_key *k, bool v)
set the use flag
Definition: keys.c:1466
ldns_struct_dnssec_name
Definition: dnssec_zone.h:46
LDNS_RR_TYPE_DS
@ LDNS_RR_TYPE_DS
RFC4034, RFC3658.
Definition: rr.h:164
ldns_struct_dnssec_zone
Structure containing a dnssec zone.
Definition: dnssec_zone.h:91
ldns_rdf_free
void ldns_rdf_free(ldns_rdf *rd)
frees a rdf structure, leaving the data pointer intact.
Definition: rdata.c:241
ldns_struct_dnssec_rrsets::signatures
ldns_dnssec_rrs * signatures
Definition: dnssec_zone.h:36
ldns_dnssec_zone_free
void ldns_dnssec_zone_free(ldns_dnssec_zone *zone)
Frees the given zone structure, and its rbtree of dnssec_names Individual ldns_rr RRs within those na...
Definition: dnssec_zone.c:797
ldns_nsec3_add_param_rdfs
void ldns_nsec3_add_param_rdfs(ldns_rr *rr, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t *salt)
Sets all the NSEC3 options.
Definition: dnssec.c:1105
LDNS_SIGN_RSASHA512
@ LDNS_SIGN_RSASHA512
Definition: keys.h:96
LDNS_RR_TYPE_NS
@ LDNS_RR_TYPE_NS
an authoritative name server
Definition: rr.h:82
ldns_key_list_set_use
void ldns_key_list_set_use(ldns_key_list *keys, bool v)
Set the 'use' flag for all keys in the list.
Definition: keys.c:1581
ldns_rr_list_clone
ldns_rr_list * ldns_rr_list_clone(const ldns_rr_list *rrlist)
clones an rrlist.
Definition: rr.c:1422
ldns_rr_list2buffer_wire
ldns_status ldns_rr_list2buffer_wire(ldns_buffer *buffer, const ldns_rr_list *rr_list)
Copies the rr_list data to the buffer in wire format.
Definition: host2wire.c:156
ldns_dnssec_name_name
ldns_rdf * ldns_dnssec_name_name(const ldns_dnssec_name *name)
Returns the domain name of the given dnssec_name structure.
Definition: dnssec_zone.c:394
ldns_buffer_free
void ldns_buffer_free(ldns_buffer *buffer)
frees the buffer.
Definition: buffer.c:137
ldns_struct_dnssec_name::hashed_name
ldns_rdf * hashed_name
pointer to store the hashed name (only used when in an NSEC3 zone
Definition: dnssec_zone.h:85
LDNS_RR_TYPE_SOA
@ LDNS_RR_TYPE_SOA
marks the start of a zone of authority
Definition: rr.h:90
ldns_rr_clone
ldns_rr * ldns_rr_clone(const ldns_rr *rr)
clones a rr and all its data
Definition: rr.c:1391
ldns_struct_key
General key structure, can contain all types of keys that are used in DNSSEC.
Definition: keys.h:126
ldns_dname_is_subdomain
bool ldns_dname_is_subdomain(const ldns_rdf *sub, const ldns_rdf *parent)
test whether the name sub falls under parent (i.e.
Definition: dname.c:296
ldns_dnssec_zone_create_nsec3s
ldns_status ldns_dnssec_zone_create_nsec3s(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Adds NSEC3 records to the zone.
Definition: dnssec_sign.c:1012
ldns_key_list_key_count
size_t ldns_key_list_key_count(const ldns_key_list *key_list)
returns the number of keys in the key list
Definition: keys.c:1444
ldns_rdf_deep_free
void ldns_rdf_deep_free(ldns_rdf *rd)
frees a rdf structure and frees the data.
Definition: rdata.c:230
ldns_dname2canonical
void ldns_dname2canonical(const ldns_rdf *rd)
Put a dname into canonical fmt - ie.
Definition: dname.c:280
ldns_rdf_clone
ldns_rdf * ldns_rdf_clone(const ldns_rdf *rd)
clones a rdf structure.
Definition: rdata.c:222
LDNS_MALLOC
#define LDNS_MALLOC(type)
Memory management macros.
Definition: util.h:49
ldns_rdf2native_int32
uint32_t ldns_rdf2native_int32(const ldns_rdf *rd)
returns the native uint32_t representation from the rdf.
Definition: rdata.c:98
LDNS_RR_TYPE_DNAME
@ LDNS_RR_TYPE_DNAME
RFC2672.
Definition: rr.h:156
ldns_rr_new_frm_type
ldns_rr * ldns_rr_new_frm_type(ldns_rr_type t)
creates a new rr structure, based on the given type.
Definition: rr.c:42
ldns_key_expiration
uint32_t ldns_key_expiration(const ldns_key *k)
return the key's expiration date
Definition: keys.c:1562
ldns_rr_set_owner
void ldns_rr_set_owner(ldns_rr *rr, ldns_rdf *owner)
sets the owner in the rr structure.
Definition: rr.c:796
ldns_dnssec_zone_add_empty_nonterminals
ldns_status ldns_dnssec_zone_add_empty_nonterminals(ldns_dnssec_zone *zone)
Adds explicit dnssec_name structures for the empty nonterminals in this zone.
Definition: dnssec_zone.c:1179
ldns_rr_list_sort
void ldns_rr_list_sort(ldns_rr_list *unsorted)
sorts an rr_list (canonical wire format).
Definition: rr.c:1507
ldns_rr_rrsig_set_typecovered
bool ldns_rr_rrsig_set_typecovered(ldns_rr *r, ldns_rdf *f)
sets the typecovered of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:117
ldns_traverse_postorder
void ldns_traverse_postorder(ldns_rbtree_t *tree, void(*func)(ldns_rbnode_t *, void *), void *arg)
Call function for all elements in the redblack tree, such that leaf elements are called before parent...
Definition: rbtree.c:666
ldns_rr_rrsig_set_origttl
bool ldns_rr_rrsig_set_origttl(ldns_rr *r, ldns_rdf *f)
sets the original TTL of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:153
ldns_dnssec_zone_create_rrsigs_flg
ldns_status ldns_dnssec_zone_create_rrsigs_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
Adds signatures to the zone.
Definition: dnssec_sign.c:1213
ldns_status
enum ldns_enum_status ldns_status
Definition: error.h:134
ATTR_UNUSED
#define ATTR_UNUSED(x)
Definition: common.h:69
ldns_struct_dnssec_rrsets
Definition: dnssec_zone.h:33
ldns_sign_public
ldns_rr_list * ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
use this function to sign with a public/private key alg return the created signatures
Definition: dnssec_sign.c:224
LDNS_RDF_TYPE_B64
@ LDNS_RDF_TYPE_B64
b64 string
Definition: rdata.h:68
LDNS_XMALLOC
#define LDNS_XMALLOC(type, count)
Definition: util.h:51
ldns_struct_dnssec_zone::names
ldns_rbtree_t * names
tree of ldns_dnssec_names
Definition: dnssec_zone.h:95
dnssec.h
This module contains base functions for DNSSEC operations (RFC4033 t/m RFC4035).
ldns_zone_soa
ldns_rr * ldns_zone_soa(const ldns_zone *z)
Return the soa record of a zone.
Definition: zone.c:17
LDNS_SIGN_DSA
@ LDNS_SIGN_DSA
Definition: keys.h:93
config.h
ldns_convert_ecdsa_rrsig_asn1len2rdf
ldns_rdf * ldns_convert_ecdsa_rrsig_asn1len2rdf(const ldns_buffer *sig, const long sig_len, int num_bytes)
Converts the ECDSA signature from ASN1 representation (as used by OpenSSL) to raw signature data as u...
Definition: dnssec.c:1865
ldns_struct_rdf
Resource record data field.
Definition: rdata.h:178
ldns_struct_dnssec_rrsets::type
ldns_rr_type type
Definition: dnssec_zone.h:35
ldns_sign_public_evp
ldns_rdf * ldns_sign_public_evp(ldns_buffer *to_sign, EVP_PKEY *key, const EVP_MD *digest_type)
Sign data with EVP (general method for different algorithms)
Definition: dnssec_sign.c:445
ldns_rdf2native_int16
uint16_t ldns_rdf2native_int16(const ldns_rdf *rd)
returns the native uint16_t representation from the rdf.
Definition: rdata.c:84
ldns_rr_ttl
uint32_t ldns_rr_ttl(const ldns_rr *rr)
returns the ttl of an rr structure.
Definition: rr.c:923
LDNS_RDF_TYPE_INT8
@ LDNS_RDF_TYPE_INT8
8 bits
Definition: rdata.h:52
ldns_rr_list_type
ldns_rr_type ldns_rr_list_type(const ldns_rr_list *rr_list)
Returns the type of the first element of the RR If there are no elements present, 0 is returned.
Definition: rr.c:2743
ldns_key_pubkey_owner
ldns_rdf * ldns_key_pubkey_owner(const ldns_key *k)
return the public key's owner
Definition: keys.c:1574
ldns_rdf_data
uint8_t * ldns_rdf_data(const ldns_rdf *rd)
returns the data of the rdf.
Definition: rdata.c:38
ldns_dnssec_name_add_rr
ldns_status ldns_dnssec_name_add_rr(ldns_dnssec_name *name, ldns_rr *rr)
Inserts the given rr at the right place in the current dnssec_name No checking is done whether the na...
Definition: dnssec_zone.c:448
ldns_key_keytag
uint16_t ldns_key_keytag(const ldns_key *k)
return the keytag
Definition: keys.c:1568
ldns_create_empty_rrsig
ldns_rr * ldns_create_empty_rrsig(const ldns_rr_list *rrset, const ldns_key *current_key)
Create an empty RRSIG RR (i.e.
Definition: dnssec_sign.c:28
ldns_dnssec_zone_sign_nsec3_flg_mkmap
ldns_status ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags, ldns_rbtree_t **map)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1424
LDNS_SIGNATURE_LEAVE_NO_ADD
#define LDNS_SIGNATURE_LEAVE_NO_ADD
Definition: dnssec.h:48
ldns.h
Including this file will include all ldns files, and define some lookup tables.
ldns_struct_zone
DNS Zone.
Definition: zone.h:43
ldns_dname_label_count
uint8_t ldns_dname_label_count(const ldns_rdf *r)
count the number of labels inside a LDNS_RDF_DNAME type rdf.
Definition: dname.c:214
ldns_struct_dnssec_zone::hashed_names
ldns_rbtree_t * hashed_names
tree of ldns_dnssec_names by nsec3 hashes (when applicible)
Definition: dnssec_zone.h:97
LDNS_DEFAULT_TTL
#define LDNS_DEFAULT_TTL
Definition: ldns.h:135
LDNS_SIGNATURE_REMOVE_ADD_NEW
#define LDNS_SIGNATURE_REMOVE_ADD_NEW
Definition: dnssec.h:49
ldns_rbtree_t::root
ldns_rbnode_t * root
The root of the red-black tree.
Definition: rbtree.h:85
ldns_rr_list_new
ldns_rr_list * ldns_rr_list_new(void)
creates a new rr_list structure.
Definition: rr.c:992
ldns_struct_dnssec_rrsets::next
ldns_dnssec_rrsets * next
Definition: dnssec_zone.h:37
LDNS_RR_TYPE_RRSIG
@ LDNS_RR_TYPE_RRSIG
DNSSEC.
Definition: rr.h:170
LDNS_RR_TYPE_A
@ LDNS_RR_TYPE_A
a host address
Definition: rr.h:80
ldns_dnssec_default_replace_signatures
int ldns_dnssec_default_replace_signatures(ldns_rr *sig __attribute__((unused)), void *n __attribute__((unused)))
Definition: dnssec.c:1733
ldns_key_list_key
ldns_key * ldns_key_list_key(const ldns_key_list *key, size_t nr)
returns a pointer to the key in the list at the given position
Definition: keys.c:1450
ldns_zone_sign_nsec3
ldns_zone * ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Signs the zone with NSEC3, and returns a newly allocated signed zone.
Definition: dnssec_sign.c:1568
ldns_rr_rrsig_set_inception
bool ldns_rr_rrsig_set_inception(ldns_rr *r, ldns_rdf *f)
sets the inception date of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:177
ldns_rbnode_t::data
const void * data
pointer to data
Definition: rbtree.h:70
ldns_dnssec_zone_find_rrset
ldns_dnssec_rrsets * ldns_dnssec_zone_find_rrset(const ldns_dnssec_zone *zone, const ldns_rdf *dname, ldns_rr_type type)
Find the RRset with the given name and type in the zone.
Definition: dnssec_zone.c:508
LDNS_DEFAULT_EXP_TIME
#define LDNS_DEFAULT_EXP_TIME
Definition: dnssec.h:44
LDNS_SIGN_DSA_NSEC3
@ LDNS_SIGN_DSA_NSEC3
Definition: keys.h:97
ldns_dname_compare_v
int ldns_dname_compare_v(const void *a, const void *b)
Given in dnssec_zone.c, also used in dnssec_sign.c:w.
Definition: dnssec_zone.c:828
ldns_sign_public_rsasha1
ldns_rdf * ldns_sign_public_rsasha1(ldns_buffer *to_sign, RSA *key)
Sign a buffer with the RSA key (hash with SHA1)
Definition: dnssec_sign.c:570
ldns_dnssec_name_find_rrset
ldns_dnssec_rrsets * ldns_dnssec_name_find_rrset(const ldns_dnssec_name *name, ldns_rr_type type)
Find the RRset with the given type in within this name structure.
Definition: dnssec_zone.c:492
ldns_rr_list_rr
ldns_rr * ldns_rr_list_rr(const ldns_rr_list *rr_list, size_t nr)
returns a specific rr of an rrlist.
Definition: rr.c:982
LDNS_STATUS_MEM_ERR
@ LDNS_STATUS_MEM_ERR
Definition: error.h:34
LDNS_RR_TYPE_DNSKEY
@ LDNS_RR_TYPE_DNSKEY
Definition: rr.h:172
LDNS_RBTREE_NULL
#define LDNS_RBTREE_NULL
The nullpointer, points to empty node.
Definition: rbtree.h:76
ldns_rr_list_free
void ldns_rr_list_free(ldns_rr_list *rr_list)
frees an rr_list structure.
Definition: rr.c:1003
LDNS_RR_TYPE_NSEC
@ LDNS_RR_TYPE_NSEC
Definition: rr.h:171
LDNS_SIGN_RSASHA256
@ LDNS_SIGN_RSASHA256
Definition: keys.h:95
LDNS_SIGN_RSAMD5
@ LDNS_SIGN_RSAMD5
Definition: keys.h:91
LDNS_SIGN_WITH_ALL_ALGORITHMS
#define LDNS_SIGN_WITH_ALL_ALGORITHMS
Definition: dnssec_sign.h:16
LDNS_STATUS_NULL
@ LDNS_STATUS_NULL
Definition: error.h:51
ldns_rbtree_insert
ldns_rbnode_t * ldns_rbtree_insert(ldns_rbtree_t *rbtree, ldns_rbnode_t *data)
Insert data into the tree.
Definition: rbtree.c:242
ldns_signing_algorithm
enum ldns_enum_signing_algorithm ldns_signing_algorithm
Definition: keys.h:114
ldns_struct_dnssec_rrsets::rrs
ldns_dnssec_rrs * rrs
Definition: dnssec_zone.h:34
LDNS_RDF_TYPE_TYPE
@ LDNS_RDF_TYPE_TYPE
a RR type
Definition: rdata.h:74
ldns_rr_rrsig_set_labels
bool ldns_rr_rrsig_set_labels(ldns_rr *r, ldns_rdf *f)
sets the number of labels of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:141
R
#define R(b, x)
Definition: sha2.c:191
LDNS_SIGN_RSASHA1_NSEC3
@ LDNS_SIGN_RSASHA1_NSEC3
Definition: keys.h:94
ldns_rbnode_t
The rbnode_t struct definition.
Definition: rbtree.h:60
ldns_zone_sign
ldns_zone * ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
Signs the zone, and returns a newly allocated signed zone.
Definition: dnssec_sign.c:1527
ldns_rr_owner
ldns_rdf * ldns_rr_owner(const ldns_rr *rr)
returns the owner name of an rr structure.
Definition: rr.c:911
ldns_key_inception
uint32_t ldns_key_inception(const ldns_key *k)
return the key's inception date
Definition: keys.c:1556
LDNS_SIGN_DNSKEY_WITH_ZSK
#define LDNS_SIGN_DNSKEY_WITH_ZSK
dnssec_verify
Definition: dnssec_sign.h:15
ldns_struct_dnssec_zone::soa
ldns_dnssec_name * soa
points to the name containing the SOA RR
Definition: dnssec_zone.h:93
ldns_convert_dsa_rrsig_asn12rdf
ldns_rdf * ldns_convert_dsa_rrsig_asn12rdf(const ldns_buffer *sig, const long sig_len)
Converts the DSA signature from ASN1 representation (RFC2459, as used by OpenSSL) to raw signature da...
Definition: dnssec.c:1742
LDNS_RDF_TYPE_TIME
@ LDNS_RDF_TYPE_TIME
time (32 bits)
Definition: rdata.h:84
LDNS_RR_TYPE_NSEC3
@ LDNS_RR_TYPE_NSEC3
Definition: rr.h:176
ldns_dnssec_create_nsec
ldns_rr * ldns_dnssec_create_nsec(const ldns_dnssec_name *from, const ldns_dnssec_name *to, ldns_rr_type nsec_type)
Creates NSEC.
Definition: dnssec.c:813
LDNS_SIGNATURE_LEAVE_ADD_NEW
#define LDNS_SIGNATURE_LEAVE_ADD_NEW
return values for the old-signature callback
Definition: dnssec.h:47
ldns_rbtree_next
ldns_rbnode_t * ldns_rbtree_next(ldns_rbnode_t *node)
Returns next larger node in the tree.
Definition: rbtree.c:574
ldns_rr_rrsig_set_expiration
bool ldns_rr_rrsig_set_expiration(ldns_rr *r, ldns_rdf *f)
sets the expireation date of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:165
ldns_dnssec_create_nsec3
ldns_rr * ldns_dnssec_create_nsec3(const ldns_dnssec_name *from, const ldns_dnssec_name *to, const ldns_rdf *zone_name, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t *salt)
Creates NSEC3.
Definition: dnssec.c:867
LDNS_RR_TYPE_AAAA
@ LDNS_RR_TYPE_AAAA
ipv6 address
Definition: rr.h:134
ldns_key_algorithm
ldns_signing_algorithm ldns_key_algorithm(const ldns_key *k)
return the signing alg of the key
Definition: keys.c:1460
ldns_struct_dnssec_rrs
Definition: dnssec_zone.h:23
LDNS_SIGN_ECDSAP384SHA384
@ LDNS_SIGN_ECDSAP384SHA384
Definition: keys.h:100
ldns_rbtree_first
ldns_rbnode_t * ldns_rbtree_first(const ldns_rbtree_t *rbtree)
Returns first (smallest) node in the tree.
Definition: rbtree.c:548
LDNS_RDF_TYPE_ALG
@ LDNS_RDF_TYPE_ALG
a key algorithm
Definition: rdata.h:80
ldns_dnssec_zone_sign_nsec3
ldns_status ldns_dnssec_zone_sign_nsec3(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1407
ldns_rr_get_type
ldns_rr_type ldns_rr_get_type(const ldns_rr *rr)
returns the type of the rr.
Definition: rr.c:935
ldns_rr_list_rr_count
size_t ldns_rr_list_rr_count(const ldns_rr_list *rr_list)
returns the number of rr's in an rr_list.
Definition: rr.c:949