dnssec_sign.c
Go to the documentation of this file.
1 #include <ldns/config.h>
2 
3 #include <ldns/ldns.h>
4 
5 #include <ldns/dnssec.h>
6 #include <ldns/dnssec_sign.h>
7 
8 #include <strings.h>
9 #include <time.h>
10 
11 #ifdef HAVE_SSL
12 /* this entire file is rather useless when you don't have
13  * crypto...
14  */
15 #include <openssl/ssl.h>
16 #include <openssl/evp.h>
17 #include <openssl/rand.h>
18 #include <openssl/err.h>
19 #include <openssl/md5.h>
20 #endif /* HAVE_SSL */
21 
22 ldns_rr *
24  ldns_key *current_key)
25 {
26  uint32_t orig_ttl;
27  ldns_rr_class orig_class;
28  time_t now;
29  ldns_rr *current_sig;
30  uint8_t label_count;
31  ldns_rdf *signame;
32 
34  0)));
35  /* RFC4035 2.2: not counting the leftmost label if it is a wildcard */
37  label_count --;
38 
40 
41  /* set the type on the new signature */
42  orig_ttl = ldns_rr_ttl(ldns_rr_list_rr(rrset, 0));
43  orig_class = ldns_rr_get_class(ldns_rr_list_rr(rrset, 0));
44 
45  ldns_rr_set_ttl(current_sig, orig_ttl);
46  ldns_rr_set_class(current_sig, orig_class);
47  ldns_rr_set_owner(current_sig,
50  ldns_rr_list_rr(rrset,
51  0))));
52 
53  /* fill in what we know of the signature */
54 
55  /* set the orig_ttl */
57  current_sig,
59  orig_ttl));
60  /* the signers name */
61  signame = ldns_rdf_clone(ldns_key_pubkey_owner(current_key));
62  ldns_dname2canonical(signame);
64  current_sig,
65  signame);
66  /* label count - get it from the first rr in the rr_list */
68  current_sig,
70  label_count));
71  /* inception, expiration */
72  now = time(NULL);
73  if (ldns_key_inception(current_key) != 0) {
75  current_sig,
78  ldns_key_inception(current_key)));
79  } else {
81  current_sig,
83  }
84  if (ldns_key_expiration(current_key) != 0) {
86  current_sig,
89  ldns_key_expiration(current_key)));
90  } else {
92  current_sig,
95  now + LDNS_DEFAULT_EXP_TIME));
96  }
97 
99  current_sig,
101  ldns_key_keytag(current_key)));
102 
104  current_sig,
107  ldns_key_algorithm(current_key)));
108 
110  current_sig,
114  0))));
115  return current_sig;
116 }
117 
118 #ifdef HAVE_SSL
119 ldns_rdf *
121 {
122  ldns_rdf *b64rdf = NULL;
123 
124  switch(ldns_key_algorithm(current_key)) {
125  case LDNS_SIGN_DSA:
126  case LDNS_SIGN_DSA_NSEC3:
127  b64rdf = ldns_sign_public_evp(
128  sign_buf,
129  ldns_key_evp_key(current_key),
130  EVP_dss1());
131  break;
132  case LDNS_SIGN_RSASHA1:
134  b64rdf = ldns_sign_public_evp(
135  sign_buf,
136  ldns_key_evp_key(current_key),
137  EVP_sha1());
138  break;
139 #ifdef USE_SHA2
140  case LDNS_SIGN_RSASHA256:
141  b64rdf = ldns_sign_public_evp(
142  sign_buf,
143  ldns_key_evp_key(current_key),
144  EVP_sha256());
145  break;
146  case LDNS_SIGN_RSASHA512:
147  b64rdf = ldns_sign_public_evp(
148  sign_buf,
149  ldns_key_evp_key(current_key),
150  EVP_sha512());
151  break;
152 #endif /* USE_SHA2 */
153 #ifdef USE_GOST
154  case LDNS_SIGN_ECC_GOST:
155  b64rdf = ldns_sign_public_evp(
156  sign_buf,
157  ldns_key_evp_key(current_key),
158  EVP_get_digestbyname("md_gost94"));
159  break;
160 #endif /* USE_GOST */
161 #ifdef USE_ECDSA
163  b64rdf = ldns_sign_public_evp(
164  sign_buf,
165  ldns_key_evp_key(current_key),
166  EVP_sha256());
167  break;
169  b64rdf = ldns_sign_public_evp(
170  sign_buf,
171  ldns_key_evp_key(current_key),
172  EVP_sha384());
173  break;
174 #endif
175  case LDNS_SIGN_RSAMD5:
176  b64rdf = ldns_sign_public_evp(
177  sign_buf,
178  ldns_key_evp_key(current_key),
179  EVP_md5());
180  break;
181  default:
182  /* do _you_ know this alg? */
183  printf("unknown algorithm, ");
184  printf("is the one used available on this system?\n");
185  break;
186  }
187 
188  return b64rdf;
189 }
190 
195 ldns_rr_list *
197 {
198  ldns_rr_list *signatures;
199  ldns_rr_list *rrset_clone;
200  ldns_rr *current_sig;
201  ldns_rdf *b64rdf;
202  ldns_key *current_key;
203  size_t key_count;
204  uint16_t i;
205  ldns_buffer *sign_buf;
206  ldns_rdf *new_owner;
207 
208  if (!rrset || ldns_rr_list_rr_count(rrset) < 1 || !keys) {
209  return NULL;
210  }
211 
212  new_owner = NULL;
213 
214  signatures = ldns_rr_list_new();
215 
216  /* prepare a signature and add all the know data
217  * prepare the rrset. Sign this together. */
218  rrset_clone = ldns_rr_list_clone(rrset);
219  if (!rrset_clone) {
220  return NULL;
221  }
222 
223  /* make it canonical */
224  for(i = 0; i < ldns_rr_list_rr_count(rrset_clone); i++) {
225  ldns_rr_set_ttl(ldns_rr_list_rr(rrset_clone, i),
226  ldns_rr_ttl(ldns_rr_list_rr(rrset, 0)));
227  ldns_rr2canonical(ldns_rr_list_rr(rrset_clone, i));
228  }
229  /* sort */
230  ldns_rr_list_sort(rrset_clone);
231 
232  for (key_count = 0;
233  key_count < ldns_key_list_key_count(keys);
234  key_count++) {
235  if (!ldns_key_use(ldns_key_list_key(keys, key_count))) {
236  continue;
237  }
239  if (!sign_buf) {
240  ldns_rr_list_free(rrset_clone);
241  ldns_rr_list_free(signatures);
242  ldns_rdf_free(new_owner);
243  return NULL;
244  }
245  b64rdf = NULL;
246 
247  current_key = ldns_key_list_key(keys, key_count);
248  /* sign all RRs with keys that have ZSKbit, !SEPbit.
249  sign DNSKEY RRs with keys that have ZSKbit&SEPbit */
250  if (ldns_key_flags(current_key) & LDNS_KEY_ZONE_KEY) {
251  current_sig = ldns_create_empty_rrsig(rrset_clone,
252  current_key);
253 
254  /* right now, we have: a key, a semi-sig and an rrset. For
255  * which we can create the sig and base64 encode that and
256  * add that to the signature */
257 
258  if (ldns_rrsig2buffer_wire(sign_buf, current_sig)
259  != LDNS_STATUS_OK) {
260  ldns_buffer_free(sign_buf);
261  /* ERROR */
262  ldns_rr_list_deep_free(rrset_clone);
263  ldns_rr_free(current_sig);
264  ldns_rr_list_deep_free(signatures);
265  return NULL;
266  }
267 
268  /* add the rrset in sign_buf */
269  if (ldns_rr_list2buffer_wire(sign_buf, rrset_clone)
270  != LDNS_STATUS_OK) {
271  ldns_buffer_free(sign_buf);
272  ldns_rr_list_deep_free(rrset_clone);
273  ldns_rr_free(current_sig);
274  ldns_rr_list_deep_free(signatures);
275  return NULL;
276  }
277 
278  b64rdf = ldns_sign_public_buffer(sign_buf, current_key);
279 
280  if (!b64rdf) {
281  /* signing went wrong */
282  ldns_rr_list_deep_free(rrset_clone);
283  ldns_rr_free(current_sig);
284  ldns_rr_list_deep_free(signatures);
285  return NULL;
286  }
287 
288  ldns_rr_rrsig_set_sig(current_sig, b64rdf);
289 
290  /* push the signature to the signatures list */
291  ldns_rr_list_push_rr(signatures, current_sig);
292  }
293  ldns_buffer_free(sign_buf); /* restart for the next key */
294  }
295  ldns_rr_list_deep_free(rrset_clone);
296 
297  return signatures;
298 }
299 
308 ldns_rdf *
310 {
311  unsigned char *sha1_hash;
312  ldns_rdf *sigdata_rdf;
313  ldns_buffer *b64sig;
314 
315  DSA_SIG *sig;
316  uint8_t *data;
317  size_t pad;
318 
320  if (!b64sig) {
321  return NULL;
322  }
323 
324  sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
325  ldns_buffer_position(to_sign), NULL);
326  if (!sha1_hash) {
327  ldns_buffer_free(b64sig);
328  return NULL;
329  }
330 
331  sig = DSA_do_sign(sha1_hash, SHA_DIGEST_LENGTH, key);
332  if(!sig) {
333  ldns_buffer_free(b64sig);
334  return NULL;
335  }
336 
337  data = LDNS_XMALLOC(uint8_t, 1 + 2 * SHA_DIGEST_LENGTH);
338  if(!data) {
339  ldns_buffer_free(b64sig);
340  DSA_SIG_free(sig);
341  return NULL;
342  }
343 
344  data[0] = 1;
345  pad = 20 - (size_t) BN_num_bytes(sig->r);
346  if (pad > 0) {
347  memset(data + 1, 0, pad);
348  }
349  BN_bn2bin(sig->r, (unsigned char *) (data + 1) + pad);
350 
351  pad = 20 - (size_t) BN_num_bytes(sig->s);
352  if (pad > 0) {
353  memset(data + 1 + SHA_DIGEST_LENGTH, 0, pad);
354  }
355  BN_bn2bin(sig->s, (unsigned char *) (data + 1 + SHA_DIGEST_LENGTH + pad));
356 
358  1 + 2 * SHA_DIGEST_LENGTH,
359  data);
360 
361  ldns_buffer_free(b64sig);
362  LDNS_FREE(data);
363  DSA_SIG_free(sig);
364 
365  return sigdata_rdf;
366 }
367 
368 #ifdef USE_ECDSA
369 #ifndef S_SPLINT_S
370 static int
371 ldns_pkey_is_ecdsa(EVP_PKEY* pkey)
372 {
373  EC_KEY* ec;
374  const EC_GROUP* g;
375  if(EVP_PKEY_type(pkey->type) != EVP_PKEY_EC)
376  return 0;
377  ec = EVP_PKEY_get1_EC_KEY(pkey);
378  g = EC_KEY_get0_group(ec);
379  if(!g) {
380  EC_KEY_free(ec);
381  return 0;
382  }
383  if(EC_GROUP_get_curve_name(g) == NID_secp224r1 ||
384  EC_GROUP_get_curve_name(g) == NID_X9_62_prime256v1 ||
385  EC_GROUP_get_curve_name(g) == NID_secp384r1) {
386  EC_KEY_free(ec);
387  return 1;
388  }
389  /* downref the eckey, the original is still inside the pkey */
390  EC_KEY_free(ec);
391  return 0;
392 }
393 #endif /* splint */
394 #endif /* USE_ECDSA */
395 
396 ldns_rdf *
398  EVP_PKEY *key,
399  const EVP_MD *digest_type)
400 {
401  unsigned int siglen;
402  ldns_rdf *sigdata_rdf;
403  ldns_buffer *b64sig;
404  EVP_MD_CTX ctx;
405  const EVP_MD *md_type;
406  int r;
407 
408  siglen = 0;
410  if (!b64sig) {
411  return NULL;
412  }
413 
414  /* initializes a signing context */
415  md_type = digest_type;
416  if(!md_type) {
417  /* unknown message difest */
418  ldns_buffer_free(b64sig);
419  return NULL;
420  }
421 
422  EVP_MD_CTX_init(&ctx);
423  r = EVP_SignInit(&ctx, md_type);
424  if(r == 1) {
425  r = EVP_SignUpdate(&ctx, (unsigned char*)
426  ldns_buffer_begin(to_sign),
427  ldns_buffer_position(to_sign));
428  } else {
429  ldns_buffer_free(b64sig);
430  return NULL;
431  }
432  if(r == 1) {
433  r = EVP_SignFinal(&ctx, (unsigned char*)
434  ldns_buffer_begin(b64sig), &siglen, key);
435  } else {
436  ldns_buffer_free(b64sig);
437  return NULL;
438  }
439  if(r != 1) {
440  ldns_buffer_free(b64sig);
441  return NULL;
442  }
443 
444  /* unfortunately, OpenSSL output is differenct from DNS DSA format */
445 #ifndef S_SPLINT_S
446  if (EVP_PKEY_type(key->type) == EVP_PKEY_DSA) {
447  sigdata_rdf = ldns_convert_dsa_rrsig_asn12rdf(b64sig, siglen);
448 #ifdef USE_ECDSA
449  } else if(EVP_PKEY_type(key->type) == EVP_PKEY_EC &&
450  ldns_pkey_is_ecdsa(key)) {
451  sigdata_rdf = ldns_convert_ecdsa_rrsig_asn12rdf(b64sig, siglen);
452 #endif
453  } else {
454  /* ok output for other types is the same */
455  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
456  ldns_buffer_begin(b64sig));
457  }
458 #endif /* splint */
459  ldns_buffer_free(b64sig);
460  EVP_MD_CTX_cleanup(&ctx);
461  return sigdata_rdf;
462 }
463 
464 ldns_rdf *
466 {
467  unsigned char *sha1_hash;
468  unsigned int siglen;
469  ldns_rdf *sigdata_rdf;
470  ldns_buffer *b64sig;
471  int result;
472 
473  siglen = 0;
475  if (!b64sig) {
476  return NULL;
477  }
478 
479  sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
480  ldns_buffer_position(to_sign), NULL);
481  if (!sha1_hash) {
482  ldns_buffer_free(b64sig);
483  return NULL;
484  }
485 
486  result = RSA_sign(NID_sha1, sha1_hash, SHA_DIGEST_LENGTH,
487  (unsigned char*)ldns_buffer_begin(b64sig),
488  &siglen, key);
489  if (result != 1) {
490  ldns_buffer_free(b64sig);
491  return NULL;
492  }
493 
494  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
495  ldns_buffer_begin(b64sig));
496  ldns_buffer_free(b64sig); /* can't free this buffer ?? */
497  return sigdata_rdf;
498 }
499 
500 ldns_rdf *
502 {
503  unsigned char *md5_hash;
504  unsigned int siglen;
505  ldns_rdf *sigdata_rdf;
506  ldns_buffer *b64sig;
507 
509  if (!b64sig) {
510  return NULL;
511  }
512 
513  md5_hash = MD5((unsigned char*)ldns_buffer_begin(to_sign),
514  ldns_buffer_position(to_sign), NULL);
515  if (!md5_hash) {
516  ldns_buffer_free(b64sig);
517  return NULL;
518  }
519 
520  RSA_sign(NID_md5, md5_hash, MD5_DIGEST_LENGTH,
521  (unsigned char*)ldns_buffer_begin(b64sig),
522  &siglen, key);
523 
524  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
525  ldns_buffer_begin(b64sig));
526  ldns_buffer_free(b64sig);
527  return sigdata_rdf;
528 }
529 #endif /* HAVE_SSL */
530 
534 static ldns_status
535 ldns_dnssec_addresses_on_glue_list(
536  ldns_dnssec_rrsets *cur_rrset,
537  ldns_rr_list *glue_list)
538 {
539  ldns_dnssec_rrs *cur_rrs;
540  while (cur_rrset) {
541  if (cur_rrset->type == LDNS_RR_TYPE_A
542  || cur_rrset->type == LDNS_RR_TYPE_AAAA) {
543  for (cur_rrs = cur_rrset->rrs;
544  cur_rrs;
545  cur_rrs = cur_rrs->next) {
546  if (cur_rrs->rr) {
547  if (!ldns_rr_list_push_rr(glue_list,
548  cur_rrs->rr)) {
549  return LDNS_STATUS_MEM_ERR;
550  /* ldns_rr_list_push_rr()
551  * returns false when unable
552  * to increase the capacity
553  * of the ldsn_rr_list
554  */
555  }
556  }
557  }
558  }
559  cur_rrset = cur_rrset->next;
560  }
561  return LDNS_STATUS_OK;
562 }
563 
580  ldns_rr_list *glue_list)
581 {
582  ldns_rbnode_t *node;
583  ldns_dnssec_name *name;
584  ldns_rdf *owner;
585  ldns_rdf *cut = NULL; /* keeps track of zone cuts */
586  /* When the cut is caused by a delegation, below_delegation will be 1.
587  * When caused by a DNAME, below_delegation will be 0.
588  */
589  int below_delegation = -1; /* init suppresses comiler warning */
590  ldns_status s;
591 
592  if (!zone || !zone->names) {
593  return LDNS_STATUS_NULL;
594  }
595  for (node = ldns_rbtree_first(zone->names);
596  node != LDNS_RBTREE_NULL;
597  node = ldns_rbtree_next(node)) {
598  name = (ldns_dnssec_name *) node->data;
599  owner = ldns_dnssec_name_name(name);
600 
601  if (cut) {
602  /* The previous node was a zone cut, or a subdomain
603  * below a zone cut. Is this node (still) a subdomain
604  * below the cut? Then the name is occluded. Unless
605  * the name contains a SOA, after which we are
606  * authoritative again.
607  *
608  * FIXME! If there are labels in between the SOA and
609  * the cut, going from the authoritative space (below
610  * the SOA) up into occluded space again, will not be
611  * detected with the contruct below!
612  */
613  if (ldns_dname_is_subdomain(owner, cut) &&
615  name->rrsets, LDNS_RR_TYPE_SOA)) {
616 
617  if (below_delegation && glue_list) {
618  s = ldns_dnssec_addresses_on_glue_list(
619  name->rrsets, glue_list);
620  if (s != LDNS_STATUS_OK) {
621  return s;
622  }
623  }
624  name->is_glue = true; /* Mark occluded name! */
625  continue;
626  } else {
627  cut = NULL;
628  }
629  }
630 
631  /* The node is not below a zone cut. Is it a zone cut itself?
632  * Everything below a SOA is authoritative of course; Except
633  * when the name also contains a DNAME :).
634  */
636  name->rrsets, LDNS_RR_TYPE_NS)
638  name->rrsets, LDNS_RR_TYPE_SOA)) {
639  cut = owner;
640  below_delegation = 1;
641  if (glue_list) { /* record glue on the zone cut */
642  s = ldns_dnssec_addresses_on_glue_list(
643  name->rrsets, glue_list);
644  if (s != LDNS_STATUS_OK) {
645  return s;
646  }
647  }
649  name->rrsets, LDNS_RR_TYPE_DNAME)) {
650  cut = owner;
651  below_delegation = 0;
652  }
653  }
654  return LDNS_STATUS_OK;
655 }
656 
669 {
671 }
672 
675 {
676  ldns_rbnode_t *next_node = NULL;
677  ldns_dnssec_name *next_name = NULL;
678  bool done = false;
679 
680  if (node == LDNS_RBTREE_NULL) {
681  return NULL;
682  }
683  next_node = node;
684  while (!done) {
685  if (next_node == LDNS_RBTREE_NULL) {
686  return NULL;
687  } else {
688  next_name = (ldns_dnssec_name *)next_node->data;
689  if (!next_name->is_glue) {
690  done = true;
691  } else {
692  next_node = ldns_rbtree_next(next_node);
693  }
694  }
695  }
696  return next_node;
697 }
698 
701  ldns_rr_list *new_rrs)
702 {
703 
704  ldns_rbnode_t *first_node, *cur_node, *next_node;
705  ldns_dnssec_name *cur_name, *next_name;
706  ldns_rr *nsec_rr;
707  uint32_t nsec_ttl;
708  ldns_dnssec_rrsets *soa;
709 
710  /* the TTL of NSEC rrs should be set to the minimum TTL of
711  * the zone SOA (RFC4035 Section 2.3)
712  */
714 
715  /* did the caller actually set it? if not,
716  * fall back to default ttl
717  */
718  if (soa && soa->rrs && soa->rrs->rr
719  && (ldns_rr_rdf(soa->rrs->rr, 6) != NULL)) {
720  nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(soa->rrs->rr, 6));
721  } else {
722  nsec_ttl = LDNS_DEFAULT_TTL;
723  }
724 
726  ldns_rbtree_first(zone->names));
727  cur_node = first_node;
728  if (cur_node) {
730  ldns_rbtree_next(cur_node));
731  } else {
732  next_node = NULL;
733  }
734 
735  while (cur_node && next_node) {
736  cur_name = (ldns_dnssec_name *)cur_node->data;
737  next_name = (ldns_dnssec_name *)next_node->data;
738  nsec_rr = ldns_dnssec_create_nsec(cur_name,
739  next_name,
741  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
742  if(ldns_dnssec_name_add_rr(cur_name, nsec_rr)!=LDNS_STATUS_OK){
743  ldns_rr_free(nsec_rr);
744  return LDNS_STATUS_ERR;
745  }
746  ldns_rr_list_push_rr(new_rrs, nsec_rr);
747  cur_node = next_node;
748  if (cur_node) {
750  ldns_rbtree_next(cur_node));
751  }
752  }
753 
754  if (cur_node && !next_node) {
755  cur_name = (ldns_dnssec_name *)cur_node->data;
756  next_name = (ldns_dnssec_name *)first_node->data;
757  nsec_rr = ldns_dnssec_create_nsec(cur_name,
758  next_name,
760  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
761  if(ldns_dnssec_name_add_rr(cur_name, nsec_rr)!=LDNS_STATUS_OK){
762  ldns_rr_free(nsec_rr);
763  return LDNS_STATUS_ERR;
764  }
765  ldns_rr_list_push_rr(new_rrs, nsec_rr);
766  } else {
767  printf("error\n");
768  }
769 
770  return LDNS_STATUS_OK;
771 }
772 
773 #ifdef HAVE_SSL
774 /* in dnssec_zone.c */
775 extern int ldns_dname_compare_v(const void *a, const void *b);
776 
779  ldns_rr_list *new_rrs,
780  uint8_t algorithm,
781  uint8_t flags,
782  uint16_t iterations,
783  uint8_t salt_length,
784  uint8_t *salt,
785  ldns_rbtree_t **map)
786 {
787  ldns_rbnode_t *first_name_node;
788  ldns_rbnode_t *current_name_node;
789  ldns_dnssec_name *current_name;
790  ldns_status result = LDNS_STATUS_OK;
791  ldns_rr *nsec_rr;
792  ldns_rr_list *nsec3_list;
793  uint32_t nsec_ttl;
794  ldns_dnssec_rrsets *soa;
795  ldns_rbnode_t *hashmap_node;
796 
797  if (!zone || !new_rrs || !zone->names) {
798  return LDNS_STATUS_ERR;
799  }
800 
801  /* the TTL of NSEC rrs should be set to the minimum TTL of
802  * the zone SOA (RFC4035 Section 2.3)
803  */
805 
806  /* did the caller actually set it? if not,
807  * fall back to default ttl
808  */
809  if (soa && soa->rrs && soa->rrs->rr
810  && ldns_rr_rdf(soa->rrs->rr, 6) != NULL) {
811  nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(soa->rrs->rr, 6));
812  } else {
813  nsec_ttl = LDNS_DEFAULT_TTL;
814  }
815 
816  if (map) {
818  == NULL) {
819  map = NULL;
820  };
821  }
822  nsec3_list = ldns_rr_list_new();
823 
824  first_name_node = ldns_dnssec_name_node_next_nonglue(
825  ldns_rbtree_first(zone->names));
826 
827  current_name_node = first_name_node;
828 
829  while (current_name_node &&
830  current_name_node != LDNS_RBTREE_NULL) {
831  current_name = (ldns_dnssec_name *) current_name_node->data;
832  nsec_rr = ldns_dnssec_create_nsec3(current_name,
833  NULL,
834  zone->soa->name,
835  algorithm,
836  flags,
837  iterations,
838  salt_length,
839  salt);
840  /* by default, our nsec based generator adds rrsigs
841  * remove the bitmap for empty nonterminals */
842  if (!current_name->rrsets) {
844  }
845  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
846  result = ldns_dnssec_name_add_rr(current_name, nsec_rr);
847  ldns_rr_list_push_rr(new_rrs, nsec_rr);
848  ldns_rr_list_push_rr(nsec3_list, nsec_rr);
849  if (map) {
850  hashmap_node = LDNS_MALLOC(ldns_rbnode_t);
851  if (hashmap_node && ldns_rr_owner(nsec_rr)) {
852  hashmap_node->key = ldns_dname_label(
853  ldns_rr_owner(nsec_rr), 0);
854  if (hashmap_node->key) {
855  hashmap_node->data = current_name->name;
856  (void) ldns_rbtree_insert(
857  *map, hashmap_node);
858  }
859  }
860  }
861  current_name_node = ldns_dnssec_name_node_next_nonglue(
862  ldns_rbtree_next(current_name_node));
863  }
864  if (result != LDNS_STATUS_OK) {
865  ldns_rr_list_free(nsec3_list);
866  return result;
867  }
868 
869  ldns_rr_list_sort_nsec3(nsec3_list);
870  result = ldns_dnssec_chain_nsec3_list(nsec3_list);
871  ldns_rr_list_free(nsec3_list);
872 
873  return result;
874 }
875 
878  ldns_rr_list *new_rrs,
879  uint8_t algorithm,
880  uint8_t flags,
881  uint16_t iterations,
882  uint8_t salt_length,
883  uint8_t *salt)
884 {
885  return ldns_dnssec_zone_create_nsec3s_mkmap(zone, new_rrs, algorithm,
886  flags, iterations, salt_length, salt, NULL);
887 
888 }
889 #endif /* HAVE_SSL */
890 
893  , ATTR_UNUSED(ldns_key_list *key_list)
894  , int (*func)(ldns_rr *, void *)
895  , void *arg
896  )
897 {
898  ldns_dnssec_rrs *base_rrs = signatures;
899  ldns_dnssec_rrs *cur_rr = base_rrs;
900  ldns_dnssec_rrs *prev_rr = NULL;
901  ldns_dnssec_rrs *next_rr;
902 
903  uint16_t keytag;
904  size_t i;
905 
906  if (!cur_rr) {
907  switch(func(NULL, arg)) {
910  break;
913  ldns_key_list_set_use(key_list, false);
914  break;
915  default:
916  fprintf(stderr, "[XX] unknown return value from callback\n");
917  break;
918  }
919  return NULL;
920  }
921  (void)func(cur_rr->rr, arg);
922 
923  while (cur_rr) {
924  next_rr = cur_rr->next;
925 
926  switch (func(cur_rr->rr, arg)) {
928  prev_rr = cur_rr;
929  break;
931  keytag = ldns_rdf2native_int16(
932  ldns_rr_rrsig_keytag(cur_rr->rr));
933  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
934  if (ldns_key_keytag(ldns_key_list_key(key_list, i)) ==
935  keytag) {
936  ldns_key_set_use(ldns_key_list_key(key_list, i),
937  false);
938  }
939  }
940  prev_rr = cur_rr;
941  break;
943  keytag = ldns_rdf2native_int16(
944  ldns_rr_rrsig_keytag(cur_rr->rr));
945  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
946  if (ldns_key_keytag(ldns_key_list_key(key_list, i))
947  == keytag) {
948  ldns_key_set_use(ldns_key_list_key(key_list, i),
949  false);
950  }
951  }
952  if (prev_rr) {
953  prev_rr->next = next_rr;
954  } else {
955  base_rrs = next_rr;
956  }
957  LDNS_FREE(cur_rr);
958  break;
960  if (prev_rr) {
961  prev_rr->next = next_rr;
962  } else {
963  base_rrs = next_rr;
964  }
965  LDNS_FREE(cur_rr);
966  break;
967  default:
968  fprintf(stderr, "[XX] unknown return value from callback\n");
969  break;
970  }
971  cur_rr = next_rr;
972  }
973 
974  return base_rrs;
975 }
976 
977 #ifdef HAVE_SSL
980  ldns_rr_list *new_rrs,
981  ldns_key_list *key_list,
982  int (*func)(ldns_rr *, void*),
983  void *arg)
984 {
985  return ldns_dnssec_zone_create_rrsigs_flg(zone, new_rrs, key_list,
986  func, arg, 0);
987 }
988 
990 static void
991 ldns_key_list_filter_for_dnskey(ldns_key_list *key_list)
992 {
993  int saw_ksk = 0;
994  size_t i;
995  for(i=0; i<ldns_key_list_key_count(key_list); i++)
997  saw_ksk = 1;
998  break;
999  }
1000  if(!saw_ksk)
1001  return;
1002  for(i=0; i<ldns_key_list_key_count(key_list); i++)
1003  if(!(ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY))
1004  ldns_key_set_use(ldns_key_list_key(key_list, i), 0);
1005 }
1006 
1008 static void
1009 ldns_key_list_filter_for_non_dnskey(ldns_key_list *key_list)
1010 {
1011  int saw_zsk = 0;
1012  size_t i;
1013  for(i=0; i<ldns_key_list_key_count(key_list); i++)
1014  if(!(ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY)) {
1015  saw_zsk = 1;
1016  break;
1017  }
1018  if(!saw_zsk)
1019  return;
1020  /* else filter all KSKs */
1021  for(i=0; i<ldns_key_list_key_count(key_list); i++)
1022  if((ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY))
1023  ldns_key_set_use(ldns_key_list_key(key_list, i), 0);
1024 }
1025 
1028  , ldns_rr_list *new_rrs
1029  , ldns_key_list *key_list
1030  , int (*func)(ldns_rr *, void*)
1031  , void *arg
1032  , int flags
1033  )
1034 {
1035  ldns_status result = LDNS_STATUS_OK;
1036 
1037  ldns_rbnode_t *cur_node;
1038  ldns_rr_list *rr_list;
1039 
1040  ldns_dnssec_name *cur_name;
1041  ldns_dnssec_rrsets *cur_rrset;
1042  ldns_dnssec_rrs *cur_rr;
1043 
1044  ldns_rr_list *siglist;
1045 
1046  size_t i;
1047 
1048  int on_delegation_point = 0; /* handle partially occluded names */
1049 
1050  ldns_rr_list *pubkey_list = ldns_rr_list_new();
1051  for (i = 0; i<ldns_key_list_key_count(key_list); i++) {
1052  ldns_rr_list_push_rr( pubkey_list
1054  key_list, i))
1055  );
1056  }
1057  /* TODO: callback to see is list should be signed */
1058  /* TODO: remove 'old' signatures from signature list */
1059  cur_node = ldns_rbtree_first(zone->names);
1060  while (cur_node != LDNS_RBTREE_NULL) {
1061  cur_name = (ldns_dnssec_name *) cur_node->data;
1062 
1063  if (!cur_name->is_glue) {
1064  on_delegation_point = ldns_dnssec_rrsets_contains_type(
1065  cur_name->rrsets, LDNS_RR_TYPE_NS)
1067  cur_name->rrsets, LDNS_RR_TYPE_SOA);
1068  cur_rrset = cur_name->rrsets;
1069  while (cur_rrset) {
1070  /* reset keys to use */
1071  ldns_key_list_set_use(key_list, true);
1072 
1073  /* walk through old sigs, remove the old,
1074  and mark which keys (not) to use) */
1075  cur_rrset->signatures =
1077  key_list,
1078  func,
1079  arg);
1080  if(!(flags&LDNS_SIGN_DNSKEY_WITH_ZSK) &&
1081  cur_rrset->type == LDNS_RR_TYPE_DNSKEY)
1082  ldns_key_list_filter_for_dnskey(key_list);
1083 
1084  if(cur_rrset->type != LDNS_RR_TYPE_DNSKEY)
1085  ldns_key_list_filter_for_non_dnskey(key_list);
1086 
1087  /* TODO: just set count to zero? */
1088  rr_list = ldns_rr_list_new();
1089 
1090  cur_rr = cur_rrset->rrs;
1091  while (cur_rr) {
1092  ldns_rr_list_push_rr(rr_list, cur_rr->rr);
1093  cur_rr = cur_rr->next;
1094  }
1095 
1096  /* only sign non-delegation RRsets */
1097  /* (glue should have been marked earlier,
1098  * except on the delegation points itself) */
1099  if (!on_delegation_point ||
1100  ldns_rr_list_type(rr_list)
1101  == LDNS_RR_TYPE_DS ||
1102  ldns_rr_list_type(rr_list)
1103  == LDNS_RR_TYPE_NSEC ||
1104  ldns_rr_list_type(rr_list)
1105  == LDNS_RR_TYPE_NSEC3) {
1106  siglist = ldns_sign_public(rr_list, key_list);
1107  for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
1108  if (cur_rrset->signatures) {
1109  result = ldns_dnssec_rrs_add_rr(cur_rrset->signatures,
1110  ldns_rr_list_rr(siglist,
1111  i));
1112  } else {
1113  cur_rrset->signatures = ldns_dnssec_rrs_new();
1114  cur_rrset->signatures->rr =
1115  ldns_rr_list_rr(siglist, i);
1116  }
1117  if (new_rrs) {
1118  ldns_rr_list_push_rr(new_rrs,
1119  ldns_rr_list_rr(siglist,
1120  i));
1121  }
1122  }
1123  ldns_rr_list_free(siglist);
1124  }
1125 
1126  ldns_rr_list_free(rr_list);
1127 
1128  cur_rrset = cur_rrset->next;
1129  }
1130 
1131  /* sign the nsec */
1132  ldns_key_list_set_use(key_list, true);
1133  cur_name->nsec_signatures =
1135  key_list,
1136  func,
1137  arg);
1138  ldns_key_list_filter_for_non_dnskey(key_list);
1139 
1140  rr_list = ldns_rr_list_new();
1141  ldns_rr_list_push_rr(rr_list, cur_name->nsec);
1142  siglist = ldns_sign_public(rr_list, key_list);
1143 
1144  for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
1145  if (cur_name->nsec_signatures) {
1146  result = ldns_dnssec_rrs_add_rr(cur_name->nsec_signatures,
1147  ldns_rr_list_rr(siglist, i));
1148  } else {
1149  cur_name->nsec_signatures = ldns_dnssec_rrs_new();
1150  cur_name->nsec_signatures->rr =
1151  ldns_rr_list_rr(siglist, i);
1152  }
1153  if (new_rrs) {
1154  ldns_rr_list_push_rr(new_rrs,
1155  ldns_rr_list_rr(siglist, i));
1156  }
1157  }
1158 
1159  ldns_rr_list_free(siglist);
1160  ldns_rr_list_free(rr_list);
1161  }
1162  cur_node = ldns_rbtree_next(cur_node);
1163  }
1164 
1165  ldns_rr_list_deep_free(pubkey_list);
1166  return result;
1167 }
1168 
1171  ldns_rr_list *new_rrs,
1172  ldns_key_list *key_list,
1173  int (*func)(ldns_rr *, void *),
1174  void *arg)
1175 {
1176  return ldns_dnssec_zone_sign_flg(zone, new_rrs, key_list, func, arg, 0);
1177 }
1178 
1181  ldns_rr_list *new_rrs,
1182  ldns_key_list *key_list,
1183  int (*func)(ldns_rr *, void *),
1184  void *arg,
1185  int flags)
1186 {
1187  ldns_status result = LDNS_STATUS_OK;
1188 
1189  if (!zone || !new_rrs || !key_list) {
1190  return LDNS_STATUS_ERR;
1191  }
1192 
1193  /* zone is already sorted */
1194  result = ldns_dnssec_zone_mark_glue(zone);
1195  if (result != LDNS_STATUS_OK) {
1196  return result;
1197  }
1198 
1199  /* check whether we need to add nsecs */
1200  if (zone->names && !((ldns_dnssec_name *)zone->names->root->data)->nsec) {
1201  result = ldns_dnssec_zone_create_nsecs(zone, new_rrs);
1202  if (result != LDNS_STATUS_OK) {
1203  return result;
1204  }
1205  }
1206 
1207  result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1208  new_rrs,
1209  key_list,
1210  func,
1211  arg,
1212  flags);
1213 
1214  return result;
1215 }
1216 
1219  ldns_rr_list *new_rrs,
1220  ldns_key_list *key_list,
1221  int (*func)(ldns_rr *, void *),
1222  void *arg,
1223  uint8_t algorithm,
1224  uint8_t flags,
1225  uint16_t iterations,
1226  uint8_t salt_length,
1227  uint8_t *salt)
1228 {
1229  return ldns_dnssec_zone_sign_nsec3_flg_mkmap(zone, new_rrs, key_list,
1230  func, arg, algorithm, flags, iterations, salt_length, salt, 0,
1231  NULL);
1232 }
1233 
1236  ldns_rr_list *new_rrs,
1237  ldns_key_list *key_list,
1238  int (*func)(ldns_rr *, void *),
1239  void *arg,
1240  uint8_t algorithm,
1241  uint8_t flags,
1242  uint16_t iterations,
1243  uint8_t salt_length,
1244  uint8_t *salt,
1245  int signflags,
1246  ldns_rbtree_t **map)
1247 {
1248  ldns_rr *nsec3, *nsec3param;
1249  ldns_status result = LDNS_STATUS_OK;
1250 
1251  /* zone is already sorted */
1252  result = ldns_dnssec_zone_mark_glue(zone);
1253  if (result != LDNS_STATUS_OK) {
1254  return result;
1255  }
1256 
1257  /* TODO if there are already nsec3s presents and their
1258  * parameters are the same as these, we don't have to recreate
1259  */
1260  if (zone->names) {
1261  /* add empty nonterminals */
1263  if (result != LDNS_STATUS_OK) {
1264  return result;
1265  }
1266 
1267  nsec3 = ((ldns_dnssec_name *)zone->names->root->data)->nsec;
1268  if (nsec3 && ldns_rr_get_type(nsec3) == LDNS_RR_TYPE_NSEC3) {
1269  /* no need to recreate */
1270  } else {
1271  if (!ldns_dnssec_zone_find_rrset(zone,
1272  zone->soa->name,
1274  /* create and add the nsec3param rr */
1275  nsec3param =
1277  ldns_rr_set_owner(nsec3param,
1278  ldns_rdf_clone(zone->soa->name));
1279  ldns_nsec3_add_param_rdfs(nsec3param,
1280  algorithm,
1281  flags,
1282  iterations,
1283  salt_length,
1284  salt);
1285  /* always set bit 7 of the flags to zero, according to
1286  * rfc5155 section 11. The bits are counted from right to left,
1287  * so bit 7 in rfc5155 is bit 0 in ldns */
1288  ldns_set_bit(ldns_rdf_data(ldns_rr_rdf(nsec3param, 1)), 0, 0);
1289  result = ldns_dnssec_zone_add_rr(zone, nsec3param);
1290  if (result != LDNS_STATUS_OK) {
1291  return result;
1292  }
1293  ldns_rr_list_push_rr(new_rrs, nsec3param);
1294  }
1296  new_rrs,
1297  algorithm,
1298  flags,
1299  iterations,
1300  salt_length,
1301  salt,
1302  map);
1303  if (result != LDNS_STATUS_OK) {
1304  return result;
1305  }
1306  }
1307 
1308  result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1309  new_rrs,
1310  key_list,
1311  func,
1312  arg,
1313  signflags);
1314  }
1315 
1316  return result;
1317 }
1318 
1321  ldns_rr_list *new_rrs,
1322  ldns_key_list *key_list,
1323  int (*func)(ldns_rr *, void *),
1324  void *arg,
1325  uint8_t algorithm,
1326  uint8_t flags,
1327  uint16_t iterations,
1328  uint8_t salt_length,
1329  uint8_t *salt,
1330  int signflags)
1331 {
1332  return ldns_dnssec_zone_sign_nsec3_flg_mkmap(zone, new_rrs, key_list,
1333  func, arg, algorithm, flags, iterations, salt_length, salt,
1334  signflags, NULL);
1335 }
1336 
1337 ldns_zone *
1338 ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
1339 {
1340  ldns_dnssec_zone *dnssec_zone;
1341  ldns_zone *signed_zone;
1342  ldns_rr_list *new_rrs;
1343  size_t i;
1344 
1345  signed_zone = ldns_zone_new();
1346  dnssec_zone = ldns_dnssec_zone_new();
1347 
1348  (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1349  ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1350 
1351  for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1352  (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1354  i));
1355  ldns_zone_push_rr(signed_zone,
1357  i)));
1358  }
1359 
1360  new_rrs = ldns_rr_list_new();
1361  (void) ldns_dnssec_zone_sign(dnssec_zone,
1362  new_rrs,
1363  key_list,
1365  NULL);
1366 
1367  for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1368  ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1369  ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1370  }
1371 
1372  ldns_rr_list_deep_free(new_rrs);
1373  ldns_dnssec_zone_free(dnssec_zone);
1374 
1375  return signed_zone;
1376 }
1377 
1378 ldns_zone *
1379 ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
1380 {
1381  ldns_dnssec_zone *dnssec_zone;
1382  ldns_zone *signed_zone;
1383  ldns_rr_list *new_rrs;
1384  size_t i;
1385 
1386  signed_zone = ldns_zone_new();
1387  dnssec_zone = ldns_dnssec_zone_new();
1388 
1389  (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1390  ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1391 
1392  for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1393  (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1395  i));
1396  ldns_zone_push_rr(signed_zone,
1398  i)));
1399  }
1400 
1401  new_rrs = ldns_rr_list_new();
1402  (void) ldns_dnssec_zone_sign_nsec3(dnssec_zone,
1403  new_rrs,
1404  key_list,
1406  NULL,
1407  algorithm,
1408  flags,
1409  iterations,
1410  salt_length,
1411  salt);
1412 
1413  for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1414  ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1415  ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1416  }
1417 
1418  ldns_rr_list_deep_free(new_rrs);
1419  ldns_dnssec_zone_free(dnssec_zone);
1420 
1421  return signed_zone;
1422 }
1423 #endif /* HAVE_SSL */
1424 
1425 
ldns_rdf * ldns_rr_rdf(const ldns_rr *rr, size_t nr)
returns the rdata field member counter.
Definition: rr.c:848
implementation of buffers to ease operations
Definition: buffer.h:50
ldns_rdf * ldns_sign_public_evp(ldns_buffer *to_sign, EVP_PKEY *key, const EVP_MD *digest_type)
Sign data with EVP (general method for different algorithms)
Definition: dnssec_sign.c:397
ldns_status ldns_dnssec_zone_sign_nsec3_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1320
ldns_rbnode_t * ldns_dnssec_name_node_next_nonglue(ldns_rbnode_t *node)
Finds the first dnssec_name node in the rbtree that is not occluded.
Definition: dnssec_sign.c:674
ldns_dnssec_rrs * rrs
Definition: dnssec_zone.h:34
time (32 bits)
Definition: rdata.h:83
ldns_rr_list * ldns_rr_list_new()
creates a new rr_list structure.
Definition: rr.c:939
ldns_key * ldns_key_list_key(const ldns_key_list *key, size_t nr)
returns a pointer to the key in the list at the given position
Definition: keys.c:1077
ldns_rdf * ldns_sign_public_dsa(ldns_buffer *to_sign, DSA *key)
Sign data with DSA.
Definition: dnssec_sign.c:309
ldns_rr * ldns_zone_soa(const ldns_zone *z)
Return the soa record of a zone.
Definition: zone.c:17
ldns_dnssec_zone * ldns_dnssec_zone_new()
Creates a new dnssec_zone structure.
Definition: dnssec_zone.c:614
#define LDNS_DEFAULT_EXP_TIME
Definition: dnssec.h:44
ldns_rr * ldns_rr_clone(const ldns_rr *rr)
clones a rr and all its data
Definition: rr.c:1338
#define LDNS_SIGNATURE_LEAVE_ADD_NEW
return values for the old-signature callback
Definition: dnssec.h:47
ldns_rdf * ldns_sign_public_rsasha1(ldns_buffer *to_sign, RSA *key)
Sign a buffer with the RSA key (hash with SHA1)
Definition: dnssec_sign.c:465
void ldns_set_bit(uint8_t *byte, int bit_nr, bool value)
Definition: util.c:108
ldns_rdf * ldns_key_pubkey_owner(const ldns_key *k)
return the public key&#39;s owner
Definition: keys.c:1196
void ldns_rdf_deep_free(ldns_rdf *rd)
frees a rdf structure and frees the data.
Definition: rdata.c:230
uint8_t ldns_dname_label_count(const ldns_rdf *r)
count the number of labels inside a LDNS_RDF_DNAME type rdf.
Definition: dname.c:214
void ldns_rr2canonical(ldns_rr *rr)
converts each dname in a rr to its canonical form.
Definition: rr.c:1737
a host address
Definition: rr.h:83
#define LDNS_DEFAULT_TTL
Definition: ldns.h:134
DNSSEC.
Definition: rr.h:173
b64 string
Definition: rdata.h:67
ldns_rdf * ldns_native2rdf_int16(ldns_rdf_type type, uint16_t value)
returns the rdf containing the native uint16_t representation.
Definition: rdata.c:132
bool ldns_rr_rrsig_set_signame(ldns_rr *r, ldns_rdf *f)
sets the signers name of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:201
ldns_rbnode_t * ldns_rbtree_insert(ldns_rbtree_t *rbtree, ldns_rbnode_t *data)
Insert data into the tree.
Definition: rbtree.c:242
void ldns_key_set_use(ldns_key *k, bool v)
Definition: keys.c:1093
enum ldns_enum_rr_class ldns_rr_class
Definition: rr.h:64
bool ldns_rr_list_push_rr(ldns_rr_list *rr_list, const ldns_rr *rr)
pushes an rr to an rrlist.
Definition: rr.c:1071
List or Set of Resource Records.
Definition: rr.h:306
ldns_zone * ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Signs the zone with NSEC3, and returns a newly allocated signed zone.
Definition: dnssec_sign.c:1379
#define LDNS_SIGN_DNSKEY_WITH_ZSK
dnssec_verify
Definition: dnssec_sign.h:15
ldns_dnssec_rrsets * rrsets
The rrsets for this name.
Definition: dnssec_zone.h:63
a RR type
Definition: rdata.h:73
ldns_status ldns_rr_list2buffer_wire(ldns_buffer *buffer, const ldns_rr_list *rr_list)
Copies the rr_list data to the buffer in wire format.
Definition: host2wire.c:71
#define LDNS_XMALLOC(type, count)
Definition: util.h:51
void ldns_nsec3_add_param_rdfs(ldns_rr *rr, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Sets all the NSEC3 options.
Definition: dnssec.c:1057
void ldns_rr_list_deep_free(ldns_rr_list *rr_list)
frees an rr_list structure and all rrs contained therein.
Definition: rr.c:959
bool ldns_rr_rrsig_set_keytag(ldns_rr *r, ldns_rdf *f)
sets the keytag of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:189
void ldns_buffer_free(ldns_buffer *buffer)
frees the buffer.
Definition: buffer.c:137
DNS Zone.
Definition: zone.h:42
ldns_rr * ldns_rr_new_frm_type(ldns_rr_type t)
creates a new rr structure, based on the given type.
Definition: rr.c:42
ldns_rdf * ldns_rdf_clone(const ldns_rdf *rd)
clones a rdf structure.
Definition: rdata.c:222
void ldns_dname2canonical(const ldns_rdf *rd)
Put a dname into canonical fmt - ie.
Definition: dname.c:277
ldns_status ldns_dnssec_zone_sign_nsec3(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1218
ldns_rdf * ldns_rr_rrsig_keytag(const ldns_rr *r)
returns the keytag of a LDNS_RR_TYPE_RRSIG RR
Definition: rr_functions.c:183
#define LDNS_MAX_PACKETLEN
Definition: packet.h:24
void ldns_rr_free(ldns_rr *rr)
frees an RR structure
Definition: rr.c:75
Structure containing a dnssec zone.
Definition: dnssec_zone.h:91
ldns_rbnode_t * root
The root of the red-black tree.
Definition: rbtree.h:85
int ldns_dnssec_default_replace_signatures(ldns_rr *sig, void *n)
Default callback function to always leave present signatures, and add new ones.
void ldns_rr_list_free(ldns_rr_list *rr_list)
frees an rr_list structure.
Definition: rr.c:950
void ldns_zone_set_soa(ldns_zone *z, ldns_rr *soa)
Set the zone&#39;s soa record.
Definition: zone.c:29
void ldns_key_list_set_use(ldns_key_list *keys, bool v)
Definition: keys.c:1203
ldns_status ldns_dnssec_zone_create_rrsigs_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
Adds signatures to the zone.
Definition: dnssec_sign.c:1027
ldns_rr_list * ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
use this function to sign with a public/private key alg return the created signatures ...
Definition: dnssec_sign.c:196
Resource Record.
Definition: rr.h:278
void ldns_rdf_free(ldns_rdf *rd)
frees a rdf structure, leaving the data pointer intact.
Definition: rdata.c:241
ldns_status ldns_dnssec_name_add_rr(ldns_dnssec_name *name, ldns_rr *rr)
Inserts the given rr at the right place in the current dnssec_name No checking is done whether the na...
Definition: dnssec_zone.c:467
const void * data
pointer to data
Definition: rbtree.h:70
ldns_rbtree_t * names
tree of ldns_dnssec_names
Definition: dnssec_zone.h:95
Including this file will include all ldns files, and define some lookup tables.
ipv6 address
Definition: rr.h:137
ldns_status ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags, ldns_rbtree_t **map)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1235
ldns_rdf * ldns_native2rdf_int8(ldns_rdf_type type, uint8_t value)
returns the rdf containing the native uint8_t repr.
Definition: rdata.c:126
ldns_rdf * ldns_convert_ecdsa_rrsig_asn12rdf(const ldns_buffer *sig, const long sig_len)
Converts the ECDSA signature from ASN1 representation (as used by OpenSSL) to raw signature data as u...
marks the start of a zone of authority
Definition: rr.h:93
int ldns_dnssec_rrsets_contains_type(ldns_dnssec_rrsets *rrsets, ldns_rr_type type)
returns whether a rrset of the given type is found in the rrsets.
Definition: dnssec.c:757
ldns_rdf * ldns_native2rdf_int32(ldns_rdf_type type, uint32_t value)
returns an rdf that contains the given int32 value.
Definition: rdata.c:147
General key structure, can contain all types of keys that are used in DNSSEC.
Definition: keys.h:107
uint8_t * ldns_rdf_data(const ldns_rdf *rd)
returns the data of the rdf.
Definition: rdata.c:38
ldns_rr * ldns_rr_list_rr(const ldns_rr_list *rr_list, size_t nr)
returns a specific rr of an rrlist.
Definition: rr.c:929
ldns_status ldns_dnssec_zone_add_rr(ldns_dnssec_zone *zone, ldns_rr *rr)
Adds the given RR to the zone.
Definition: dnssec_zone.c:858
void ldns_rr_set_class(ldns_rr *rr, ldns_rr_class rr_class)
sets the class in the rr.
Definition: rr.c:773
#define LDNS_SIGNATURE_REMOVE_NO_ADD
Definition: dnssec.h:50
bool ldns_rr_rrsig_set_origttl(ldns_rr *r, ldns_rdf *f)
sets the original TTL of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:153
16 bits
Definition: rdata.h:53
ldns_rr * ldns_dnssec_create_nsec(ldns_dnssec_name *from, ldns_dnssec_name *to, ldns_rr_type nsec_type)
Creates NSEC.
Definition: dnssec.c:771
bool ldns_zone_push_rr(ldns_zone *z, ldns_rr *rr)
push an single rr to a zone structure.
Definition: zone.c:54
ldns_status ldns_dnssec_zone_sign(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg)
signs the given zone with the given keys
Definition: dnssec_sign.c:1170
#define ATTR_UNUSED(x)
Definition: common.h:64
The rbnode_t struct definition.
Definition: rbtree.h:60
ldns_rbtree_t * ldns_rbtree_create(int(*cmpf)(const void *, const void *))
Create new tree (malloced) with given key compare function.
Definition: rbtree.c:80
a key algorithm
Definition: rdata.h:79
uint16_t ldns_rdf2native_int16(const ldns_rdf *rd)
returns the native uint16_t representation from the rdf.
Definition: rdata.c:84
ldns_rr * ldns_dnssec_create_nsec3(ldns_dnssec_name *from, ldns_dnssec_name *to, ldns_rdf *zone_name, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Creates NSEC3.
Definition: dnssec.c:825
ldns_status ldns_dnssec_zone_mark_and_get_glue(ldns_dnssec_zone *zone, ldns_rr_list *glue_list)
Marks the names in the zone that are occluded.
Definition: dnssec_sign.c:579
signed char is_glue
Unlike what the name is_glue suggests, this field is set to true by ldns_dnssec_zone_mark_glue() or l...
Definition: dnssec_zone.h:81
int ldns_dname_is_wildcard(const ldns_rdf *dname)
Check if dname is a wildcard, starts with *.
Definition: dname.c:453
ldns_dnssec_rrs * signatures
Definition: dnssec_zone.h:36
ldns_rdf * ldns_rr_pop_rdf(ldns_rr *rr)
removes a rd_field member, it will be popped from the last position.
Definition: rr.c:819
return NULL
Definition: keys.c:738
int ldns_dname_compare_v(const void *a, const void *b)
Definition: dnssec_zone.c:826
#define LDNS_KEY_ZONE_KEY
Definition: keys.h:37
bool ldns_key_use(const ldns_key *k)
return the use flag
Definition: keys.c:1101
ldns_status ldns_dnssec_zone_create_nsecs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs)
Adds NSEC records to the given dnssec_zone.
Definition: dnssec_sign.c:700
Same as rr_list, but now for keys.
Definition: keys.h:157
ldns_zone * ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
Signs the zone, and returns a newly allocated signed zone.
Definition: dnssec_sign.c:1338
32 bits
Definition: rdata.h:55
ldns_rdf * ldns_sign_public_rsamd5(ldns_buffer *to_sign, RSA *key)
Sign a buffer with the RSA key (hash with MD5)
Definition: dnssec_sign.c:501
draft-ietf-dnsext-delegation
Definition: rr.h:167
ldns_rr_list * ldns_rr_list_clone(const ldns_rr_list *rrlist)
clones an rrlist.
Definition: rr.c:1369
definition for tree struct
Definition: rbtree.h:83
#define LDNS_KEY_SEP_KEY
Definition: keys.h:38
void ldns_rr_set_owner(ldns_rr *rr, ldns_rdf *owner)
sets the owner in the rr structure.
Definition: rr.c:743
uint32_t ldns_key_inception(const ldns_key *k)
return the key&#39;s inception date
Definition: keys.c:1178
#define LDNS_SIGNATURE_REMOVE_ADD_NEW
Definition: dnssec.h:49
ldns_status ldns_dnssec_zone_create_nsec3s_mkmap(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, ldns_rbtree_t **map)
Definition: dnssec_sign.c:778
uint32_t ldns_rdf2native_int32(const ldns_rdf *rd)
returns the native uint32_t representation from the rdf.
Definition: rdata.c:98
ldns_rr_type ldns_rr_get_type(const ldns_rr *rr)
returns the type of the rr.
Definition: rr.c:882
bool ldns_rr_rrsig_set_inception(ldns_rr *r, ldns_rdf *f)
sets the inception date of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:177
ldns_dnssec_rrs * ldns_dnssec_remove_signatures(ldns_dnssec_rrs *signatures, ldns_key_list *key_list __attribute__((unused)), int(*func)(ldns_rr *, void *), void *arg)
Definition: dnssec_sign.c:892
ldns_dnssec_name * soa
points to the name containing the SOA RR
Definition: dnssec_zone.h:93
void ldns_rr_set_ttl(ldns_rr *rr, uint32_t ttl)
sets the ttl in the rr structure.
Definition: rr.c:755
enum ldns_enum_status ldns_status
Definition: error.h:122
ldns_dnssec_rrs * next
Definition: dnssec_zone.h:25
EVP_PKEY * ldns_key_evp_key(const ldns_key *k)
returns the (openssl) EVP struct contained in the key
Definition: keys.c:1112
ldns_rdf * ldns_sign_public_buffer(ldns_buffer *sign_buf, ldns_key *current_key)
Sign the buffer which contains the wiredata of an rrset, and the corresponding empty rrsig rr with th...
Definition: dnssec_sign.c:120
ldns_rdf * ldns_rdf_new_frm_data(ldns_rdf_type type, size_t size, const void *data)
allocates a new rdf structure and fills it.
Definition: rdata.c:193
#define LDNS_MALLOC(type)
Memory management macros.
Definition: util.h:49
ldns_dnssec_rrsets * ldns_dnssec_name_find_rrset(ldns_dnssec_name *name, ldns_rr_type type)
Find the RRset with the given type in within this name structure.
Definition: dnssec_zone.c:531
ldns_dnssec_rrs * ldns_dnssec_rrs_new()
Creates a new entry for 1 pointer to an rr and 1 pointer to the next rrs.
Definition: dnssec_zone.c:10
ldns_buffer * ldns_buffer_new(size_t capacity)
creates a new buffer with the specified capacity.
Definition: buffer.c:16
This module contains base functions for DNSSEC operations (RFC4033 t/m RFC4035).
ldns_signing_algorithm ldns_key_algorithm(const ldns_key *k)
return the signing alg of the key
Definition: keys.c:1087
uint32_t ldns_key_expiration(const ldns_key *k)
return the key&#39;s expiration date
Definition: keys.c:1184
void ldns_dnssec_zone_free(ldns_dnssec_zone *zone)
Frees the given zone structure, and its rbtree of dnssec_names Individual ldns_rr RRs within those na...
Definition: dnssec_zone.c:795
bool ldns_rr_rrsig_set_typecovered(ldns_rr *r, ldns_rdf *f)
sets the typecovered of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:117
ldns_status ldns_dnssec_zone_create_rrsigs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg)
Adds signatures to the zone.
Definition: dnssec_sign.c:979
#define LDNS_RBTREE_NULL
The nullpointer, points to empty node.
Definition: rbtree.h:76
ldns_status ldns_dnssec_zone_create_nsec3s(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Adds NSEC3 records to the zone.
Definition: dnssec_sign.c:877
ldns_rr_list * ldns_zone_rrs(const ldns_zone *z)
Get a list of a zone&#39;s content.
Definition: zone.c:35
const void * key
pointer to sorting key
Definition: rbtree.h:68
ldns_rr * ldns_key2rr(const ldns_key *k)
converts a ldns_key to a public key rr If the key data exists at an external point, the corresponding rdata field must still be added with ldns_rr_rdf_push() to the result rr of this function
Definition: keys.c:1358
bool ldns_dname_is_subdomain(const ldns_rdf *sub, const ldns_rdf *parent)
test wether the name sub falls under parent (i.e.
Definition: dname.c:293
ldns_status ldns_dnssec_zone_mark_glue(ldns_dnssec_zone *zone)
Marks the names in the zone that are occluded.
Definition: dnssec_sign.c:668
Resource record data field.
Definition: rdata.h:138
ldns_dnssec_rrsets * next
Definition: dnssec_zone.h:37
size_t ldns_key_list_key_count(const ldns_key_list *key_list)
returns the number of keys in the key list
Definition: keys.c:1071
8 bits
Definition: rdata.h:51
ldns_rdf * ldns_rr_owner(const ldns_rr *rr)
returns the owner name of an rr structure.
Definition: rr.c:858
size_t ldns_rr_list_rr_count(const ldns_rr_list *rr_list)
returns the number of rr&#39;s in an rr_list.
Definition: rr.c:896
#define LDNS_SIGNATURE_LEAVE_NO_ADD
Definition: dnssec.h:48
bool ldns_rr_rrsig_set_sig(ldns_rr *r, ldns_rdf *f)
sets the signature data of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:213
bool ldns_rr_rrsig_set_labels(ldns_rr *r, ldns_rdf *f)
sets the number of labels of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:141
#define LDNS_FREE(ptr)
Definition: util.h:60
ldns_status ldns_dnssec_chain_nsec3_list(ldns_rr_list *nsec3_rrs)
chains nsec3 list
Definition: dnssec.c:1495
an authoritative name server
Definition: rr.h:85
uint16_t ldns_key_keytag(const ldns_key *k)
return the keytag
Definition: keys.c:1190
ldns_status ldns_rrsig2buffer_wire(ldns_buffer *buffer, const ldns_rr *rr)
Converts a rrsig to wireformat BUT EXCLUDE the rrsig rdata This is needed in DNSSEC verification...
Definition: host2wire.c:197
ldns_rbnode_t * ldns_rbtree_first(ldns_rbtree_t *rbtree)
Returns first (smallest) node in the tree.
Definition: rbtree.c:548
ldns_rr * ldns_create_empty_rrsig(ldns_rr_list *rrset, ldns_key *current_key)
Create an empty RRSIG RR (i.e.
Definition: dnssec_sign.c:23
ldns_rdf * ldns_dname_label(const ldns_rdf *rdf, uint8_t labelpos)
look inside the rdf and if it is an LDNS_RDF_TYPE_DNAME try and retrieve a specific label...
Definition: dname.c:556
uint32_t ldns_rr_ttl(const ldns_rr *rr)
returns the ttl of an rr structure.
Definition: rr.c:870
ldns_rr_type ldns_rr_list_type(const ldns_rr_list *rr_list)
Returns the type of the first element of the RR If there are no elements present, 0 is returned...
Definition: rr.c:2427
ldns_dnssec_rrsets * ldns_dnssec_zone_find_rrset(ldns_dnssec_zone *zone, ldns_rdf *dname, ldns_rr_type type)
Find the RRset with the given name and type in the zone.
Definition: dnssec_zone.c:547
uint16_t ldns_key_flags(const ldns_key *k)
return the flag of the key
Definition: keys.c:1172
ldns_rr_class ldns_rr_get_class(const ldns_rr *rr)
returns the class of the rr.
Definition: rr.c:888
bool ldns_rr_rrsig_set_algorithm(ldns_rr *r, ldns_rdf *f)
sets the algorithm of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:129
ldns_dnssec_rrs * nsec_signatures
signatures for the NSEC record
Definition: dnssec_zone.h:71
ldns_rbnode_t * ldns_rbtree_next(ldns_rbnode_t *node)
Returns next larger node in the tree.
Definition: rbtree.c:574
bool ldns_rr_rrsig_set_expiration(ldns_rr *r, ldns_rdf *f)
sets the expireation date of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:165
ldns_rdf * ldns_dnssec_name_name(ldns_dnssec_name *name)
Returns the domain name of the given dnssec_name structure.
Definition: dnssec_zone.c:405
ldns_status ldns_dnssec_zone_add_empty_nonterminals(ldns_dnssec_zone *zone)
Adds explicit dnssec_name structures for the empty nonterminals in this zone.
Definition: dnssec_zone.c:980
ldns_zone * ldns_zone_new(void)
create a new ldns_zone structure
Definition: zone.c:263
ldns_status ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
signs the given zone with the given keys
Definition: dnssec_sign.c:1180
void ldns_rr_list_sort(ldns_rr_list *unsorted)
sorts an rr_list (canonical wire format).
Definition: rr.c:1472
if(!d||!dsa||!buf)
Definition: keys.c:671
ldns_rdf * ldns_convert_dsa_rrsig_asn12rdf(const ldns_buffer *sig, const long sig_len)
Converts the DSA signature from ASN1 representation (RFC2459, as used by OpenSSL) to raw signature da...
Definition: dnssec.c:1607
void ldns_rr_list_sort_nsec3(ldns_rr_list *unsorted)
sort nsec3 list
Definition: dnssec.c:1565
dsa g
Definition: keys.c:703
ldns_status ldns_dnssec_rrs_add_rr(ldns_dnssec_rrs *rrs, ldns_rr *rr)
Adds an RR to the list of RRs.
Definition: dnssec_zone.c:47
RFC2672.
Definition: rr.h:159
ldns_rr * nsec
NSEC pointing to the next name (or NSEC3 pointing to the next NSEC3)
Definition: dnssec_zone.h:67
i
Definition: keys.c:681
ldns_rdf * name
pointer to a dname containing the name.
Definition: dnssec_zone.h:51