dnssec_sign.c
Go to the documentation of this file.
1 #include <ldns/config.h>
2 
3 #include <ldns/ldns.h>
4 
5 #include <ldns/dnssec.h>
6 #include <ldns/dnssec_sign.h>
7 
8 #include <strings.h>
9 #include <time.h>
10 
11 #ifdef HAVE_SSL
12 /* this entire file is rather useless when you don't have
13  * crypto...
14  */
15 #include <openssl/ssl.h>
16 #include <openssl/evp.h>
17 #include <openssl/rand.h>
18 #include <openssl/err.h>
19 #include <openssl/md5.h>
20 #endif /* HAVE_SSL */
21 
22 ldns_rr *
24  ldns_key *current_key)
25 {
26  uint32_t orig_ttl;
27  ldns_rr_class orig_class;
28  time_t now;
29  ldns_rr *current_sig;
30  uint8_t label_count;
31  ldns_rdf *signame;
32 
34  0)));
35  /* RFC4035 2.2: not counting the leftmost label if it is a wildcard */
37  label_count --;
38 
40 
41  /* set the type on the new signature */
42  orig_ttl = ldns_rr_ttl(ldns_rr_list_rr(rrset, 0));
43  orig_class = ldns_rr_get_class(ldns_rr_list_rr(rrset, 0));
44 
45  ldns_rr_set_ttl(current_sig, orig_ttl);
46  ldns_rr_set_class(current_sig, orig_class);
47  ldns_rr_set_owner(current_sig,
50  ldns_rr_list_rr(rrset,
51  0))));
52 
53  /* fill in what we know of the signature */
54 
55  /* set the orig_ttl */
57  current_sig,
59  orig_ttl));
60  /* the signers name */
61  signame = ldns_rdf_clone(ldns_key_pubkey_owner(current_key));
62  ldns_dname2canonical(signame);
64  current_sig,
65  signame);
66  /* label count - get it from the first rr in the rr_list */
68  current_sig,
70  label_count));
71  /* inception, expiration */
72  now = time(NULL);
73  if (ldns_key_inception(current_key) != 0) {
75  current_sig,
78  ldns_key_inception(current_key)));
79  } else {
81  current_sig,
83  }
84  if (ldns_key_expiration(current_key) != 0) {
86  current_sig,
89  ldns_key_expiration(current_key)));
90  } else {
92  current_sig,
95  now + LDNS_DEFAULT_EXP_TIME));
96  }
97 
99  current_sig,
101  ldns_key_keytag(current_key)));
102 
104  current_sig,
107  ldns_key_algorithm(current_key)));
108 
110  current_sig,
114  0))));
115  return current_sig;
116 }
117 
118 #ifdef HAVE_SSL
119 ldns_rdf *
121 {
122  ldns_rdf *b64rdf = NULL;
123 
124  switch(ldns_key_algorithm(current_key)) {
125  case LDNS_SIGN_DSA:
126  case LDNS_SIGN_DSA_NSEC3:
127  b64rdf = ldns_sign_public_evp(
128  sign_buf,
129  ldns_key_evp_key(current_key),
130  EVP_dss1());
131  break;
132  case LDNS_SIGN_RSASHA1:
134  b64rdf = ldns_sign_public_evp(
135  sign_buf,
136  ldns_key_evp_key(current_key),
137  EVP_sha1());
138  break;
139 #ifdef USE_SHA2
140  case LDNS_SIGN_RSASHA256:
141  b64rdf = ldns_sign_public_evp(
142  sign_buf,
143  ldns_key_evp_key(current_key),
144  EVP_sha256());
145  break;
146  case LDNS_SIGN_RSASHA512:
147  b64rdf = ldns_sign_public_evp(
148  sign_buf,
149  ldns_key_evp_key(current_key),
150  EVP_sha512());
151  break;
152 #endif /* USE_SHA2 */
153 #ifdef USE_GOST
154  case LDNS_SIGN_ECC_GOST:
155  b64rdf = ldns_sign_public_evp(
156  sign_buf,
157  ldns_key_evp_key(current_key),
158  EVP_get_digestbyname("md_gost94"));
159  break;
160 #endif /* USE_GOST */
161 #ifdef USE_ECDSA
163  b64rdf = ldns_sign_public_evp(
164  sign_buf,
165  ldns_key_evp_key(current_key),
166  EVP_sha256());
167  break;
169  b64rdf = ldns_sign_public_evp(
170  sign_buf,
171  ldns_key_evp_key(current_key),
172  EVP_sha384());
173  break;
174 #endif
175  case LDNS_SIGN_RSAMD5:
176  b64rdf = ldns_sign_public_evp(
177  sign_buf,
178  ldns_key_evp_key(current_key),
179  EVP_md5());
180  break;
181  default:
182  /* do _you_ know this alg? */
183  printf("unknown algorithm, ");
184  printf("is the one used available on this system?\n");
185  break;
186  }
187 
188  return b64rdf;
189 }
190 
195 ldns_rr_list *
197 {
198  ldns_rr_list *signatures;
199  ldns_rr_list *rrset_clone;
200  ldns_rr *current_sig;
201  ldns_rdf *b64rdf;
202  ldns_key *current_key;
203  size_t key_count;
204  uint16_t i;
205  ldns_buffer *sign_buf;
206  ldns_rdf *new_owner;
207 
208  if (!rrset || ldns_rr_list_rr_count(rrset) < 1 || !keys) {
209  return NULL;
210  }
211 
212  new_owner = NULL;
213 
214  signatures = ldns_rr_list_new();
215 
216  /* prepare a signature and add all the know data
217  * prepare the rrset. Sign this together. */
218  rrset_clone = ldns_rr_list_clone(rrset);
219  if (!rrset_clone) {
220  return NULL;
221  }
222 
223  /* make it canonical */
224  for(i = 0; i < ldns_rr_list_rr_count(rrset_clone); i++) {
225  ldns_rr_set_ttl(ldns_rr_list_rr(rrset_clone, i),
226  ldns_rr_ttl(ldns_rr_list_rr(rrset, 0)));
227  ldns_rr2canonical(ldns_rr_list_rr(rrset_clone, i));
228  }
229  /* sort */
230  ldns_rr_list_sort(rrset_clone);
231 
232  for (key_count = 0;
233  key_count < ldns_key_list_key_count(keys);
234  key_count++) {
235  if (!ldns_key_use(ldns_key_list_key(keys, key_count))) {
236  continue;
237  }
239  if (!sign_buf) {
240  ldns_rr_list_free(rrset_clone);
241  ldns_rr_list_free(signatures);
242  ldns_rdf_free(new_owner);
243  return NULL;
244  }
245  b64rdf = NULL;
246 
247  current_key = ldns_key_list_key(keys, key_count);
248  /* sign all RRs with keys that have ZSKbit, !SEPbit.
249  sign DNSKEY RRs with keys that have ZSKbit&SEPbit */
250  if (ldns_key_flags(current_key) & LDNS_KEY_ZONE_KEY) {
251  current_sig = ldns_create_empty_rrsig(rrset_clone,
252  current_key);
253 
254  /* right now, we have: a key, a semi-sig and an rrset. For
255  * which we can create the sig and base64 encode that and
256  * add that to the signature */
257 
258  if (ldns_rrsig2buffer_wire(sign_buf, current_sig)
259  != LDNS_STATUS_OK) {
260  ldns_buffer_free(sign_buf);
261  /* ERROR */
262  ldns_rr_list_deep_free(rrset_clone);
263  ldns_rr_free(current_sig);
264  ldns_rr_list_deep_free(signatures);
265  return NULL;
266  }
267 
268  /* add the rrset in sign_buf */
269  if (ldns_rr_list2buffer_wire(sign_buf, rrset_clone)
270  != LDNS_STATUS_OK) {
271  ldns_buffer_free(sign_buf);
272  ldns_rr_list_deep_free(rrset_clone);
273  ldns_rr_free(current_sig);
274  ldns_rr_list_deep_free(signatures);
275  return NULL;
276  }
277 
278  b64rdf = ldns_sign_public_buffer(sign_buf, current_key);
279 
280  if (!b64rdf) {
281  /* signing went wrong */
282  ldns_rr_list_deep_free(rrset_clone);
283  ldns_rr_free(current_sig);
284  ldns_rr_list_deep_free(signatures);
285  return NULL;
286  }
287 
288  ldns_rr_rrsig_set_sig(current_sig, b64rdf);
289 
290  /* push the signature to the signatures list */
291  ldns_rr_list_push_rr(signatures, current_sig);
292  }
293  ldns_buffer_free(sign_buf); /* restart for the next key */
294  }
295  ldns_rr_list_deep_free(rrset_clone);
296 
297  return signatures;
298 }
299 
308 ldns_rdf *
310 {
311  unsigned char *sha1_hash;
312  ldns_rdf *sigdata_rdf;
313  ldns_buffer *b64sig;
314 
315  DSA_SIG *sig;
316  uint8_t *data;
317  size_t pad;
318 
320  if (!b64sig) {
321  return NULL;
322  }
323 
324  sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
325  ldns_buffer_position(to_sign), NULL);
326  if (!sha1_hash) {
327  ldns_buffer_free(b64sig);
328  return NULL;
329  }
330 
331  sig = DSA_do_sign(sha1_hash, SHA_DIGEST_LENGTH, key);
332  if(!sig) {
333  ldns_buffer_free(b64sig);
334  return NULL;
335  }
336 
337  data = LDNS_XMALLOC(uint8_t, 1 + 2 * SHA_DIGEST_LENGTH);
338  if(!data) {
339  ldns_buffer_free(b64sig);
340  DSA_SIG_free(sig);
341  return NULL;
342  }
343 
344  data[0] = 1;
345  pad = 20 - (size_t) BN_num_bytes(sig->r);
346  if (pad > 0) {
347  memset(data + 1, 0, pad);
348  }
349  BN_bn2bin(sig->r, (unsigned char *) (data + 1) + pad);
350 
351  pad = 20 - (size_t) BN_num_bytes(sig->s);
352  if (pad > 0) {
353  memset(data + 1 + SHA_DIGEST_LENGTH, 0, pad);
354  }
355  BN_bn2bin(sig->s, (unsigned char *) (data + 1 + SHA_DIGEST_LENGTH + pad));
356 
358  1 + 2 * SHA_DIGEST_LENGTH,
359  data);
360 
361  ldns_buffer_free(b64sig);
362  LDNS_FREE(data);
363  DSA_SIG_free(sig);
364 
365  return sigdata_rdf;
366 }
367 
368 #ifdef USE_ECDSA
369 #ifndef S_SPLINT_S
370 static int
371 ldns_pkey_is_ecdsa(EVP_PKEY* pkey)
372 {
373  EC_KEY* ec;
374  const EC_GROUP* g;
375  if(EVP_PKEY_type(pkey->type) != EVP_PKEY_EC)
376  return 0;
377  ec = EVP_PKEY_get1_EC_KEY(pkey);
378  g = EC_KEY_get0_group(ec);
379  if(!g) {
380  EC_KEY_free(ec);
381  return 0;
382  }
383  if(EC_GROUP_get_curve_name(g) == NID_secp224r1 ||
384  EC_GROUP_get_curve_name(g) == NID_X9_62_prime256v1 ||
385  EC_GROUP_get_curve_name(g) == NID_secp384r1) {
386  EC_KEY_free(ec);
387  return 1;
388  }
389  /* downref the eckey, the original is still inside the pkey */
390  EC_KEY_free(ec);
391  return 0;
392 }
393 #endif /* splint */
394 #endif /* USE_ECDSA */
395 
396 ldns_rdf *
398  EVP_PKEY *key,
399  const EVP_MD *digest_type)
400 {
401  unsigned int siglen;
402  ldns_rdf *sigdata_rdf;
403  ldns_buffer *b64sig;
404  EVP_MD_CTX ctx;
405  const EVP_MD *md_type;
406  int r;
407 
408  siglen = 0;
410  if (!b64sig) {
411  return NULL;
412  }
413 
414  /* initializes a signing context */
415  md_type = digest_type;
416  if(!md_type) {
417  /* unknown message difest */
418  ldns_buffer_free(b64sig);
419  return NULL;
420  }
421 
422  EVP_MD_CTX_init(&ctx);
423  r = EVP_SignInit(&ctx, md_type);
424  if(r == 1) {
425  r = EVP_SignUpdate(&ctx, (unsigned char*)
426  ldns_buffer_begin(to_sign),
427  ldns_buffer_position(to_sign));
428  } else {
429  ldns_buffer_free(b64sig);
430  return NULL;
431  }
432  if(r == 1) {
433  r = EVP_SignFinal(&ctx, (unsigned char*)
434  ldns_buffer_begin(b64sig), &siglen, key);
435  } else {
436  ldns_buffer_free(b64sig);
437  return NULL;
438  }
439  if(r != 1) {
440  ldns_buffer_free(b64sig);
441  return NULL;
442  }
443 
444  /* unfortunately, OpenSSL output is differenct from DNS DSA format */
445 #ifndef S_SPLINT_S
446  if (EVP_PKEY_type(key->type) == EVP_PKEY_DSA) {
447  sigdata_rdf = ldns_convert_dsa_rrsig_asn12rdf(b64sig, siglen);
448 #ifdef USE_ECDSA
449  } else if(EVP_PKEY_type(key->type) == EVP_PKEY_EC &&
450  ldns_pkey_is_ecdsa(key)) {
451  sigdata_rdf = ldns_convert_ecdsa_rrsig_asn12rdf(b64sig, siglen);
452 #endif
453  } else {
454  /* ok output for other types is the same */
455  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
456  ldns_buffer_begin(b64sig));
457  }
458 #endif /* splint */
459  ldns_buffer_free(b64sig);
460  EVP_MD_CTX_cleanup(&ctx);
461  return sigdata_rdf;
462 }
463 
464 ldns_rdf *
466 {
467  unsigned char *sha1_hash;
468  unsigned int siglen;
469  ldns_rdf *sigdata_rdf;
470  ldns_buffer *b64sig;
471  int result;
472 
473  siglen = 0;
475  if (!b64sig) {
476  return NULL;
477  }
478 
479  sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
480  ldns_buffer_position(to_sign), NULL);
481  if (!sha1_hash) {
482  ldns_buffer_free(b64sig);
483  return NULL;
484  }
485 
486  result = RSA_sign(NID_sha1, sha1_hash, SHA_DIGEST_LENGTH,
487  (unsigned char*)ldns_buffer_begin(b64sig),
488  &siglen, key);
489  if (result != 1) {
490  ldns_buffer_free(b64sig);
491  return NULL;
492  }
493 
494  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
495  ldns_buffer_begin(b64sig));
496  ldns_buffer_free(b64sig); /* can't free this buffer ?? */
497  return sigdata_rdf;
498 }
499 
500 ldns_rdf *
502 {
503  unsigned char *md5_hash;
504  unsigned int siglen;
505  ldns_rdf *sigdata_rdf;
506  ldns_buffer *b64sig;
507 
509  if (!b64sig) {
510  return NULL;
511  }
512 
513  md5_hash = MD5((unsigned char*)ldns_buffer_begin(to_sign),
514  ldns_buffer_position(to_sign), NULL);
515  if (!md5_hash) {
516  ldns_buffer_free(b64sig);
517  return NULL;
518  }
519 
520  RSA_sign(NID_md5, md5_hash, MD5_DIGEST_LENGTH,
521  (unsigned char*)ldns_buffer_begin(b64sig),
522  &siglen, key);
523 
524  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
525  ldns_buffer_begin(b64sig));
526  ldns_buffer_free(b64sig);
527  return sigdata_rdf;
528 }
529 #endif /* HAVE_SSL */
530 
534 static ldns_status
535 ldns_dnssec_addresses_on_glue_list(
536  ldns_dnssec_rrsets *cur_rrset,
537  ldns_rr_list *glue_list)
538 {
539  ldns_dnssec_rrs *cur_rrs;
540  while (cur_rrset) {
541  if (cur_rrset->type == LDNS_RR_TYPE_A
542  || cur_rrset->type == LDNS_RR_TYPE_AAAA) {
543  for (cur_rrs = cur_rrset->rrs;
544  cur_rrs;
545  cur_rrs = cur_rrs->next) {
546  if (cur_rrs->rr) {
547  if (!ldns_rr_list_push_rr(glue_list,
548  cur_rrs->rr)) {
549  return LDNS_STATUS_MEM_ERR;
550  /* ldns_rr_list_push_rr()
551  * returns false when unable
552  * to increase the capacity
553  * of the ldsn_rr_list
554  */
555  }
556  }
557  }
558  }
559  cur_rrset = cur_rrset->next;
560  }
561  return LDNS_STATUS_OK;
562 }
563 
580  ldns_rr_list *glue_list)
581 {
582  ldns_rbnode_t *node;
583  ldns_dnssec_name *name;
584  ldns_rdf *owner;
585  ldns_rdf *cut = NULL; /* keeps track of zone cuts */
586  /* When the cut is caused by a delegation, below_delegation will be 1.
587  * When caused by a DNAME, below_delegation will be 0.
588  */
589  int below_delegation = -1; /* init suppresses comiler warning */
590  ldns_status s;
591 
592  if (!zone || !zone->names) {
593  return LDNS_STATUS_NULL;
594  }
595  for (node = ldns_rbtree_first(zone->names);
596  node != LDNS_RBTREE_NULL;
597  node = ldns_rbtree_next(node)) {
598  name = (ldns_dnssec_name *) node->data;
599  owner = ldns_dnssec_name_name(name);
600 
601  if (cut) {
602  /* The previous node was a zone cut, or a subdomain
603  * below a zone cut. Is this node (still) a subdomain
604  * below the cut? Then the name is occluded. Unless
605  * the name contains a SOA, after which we are
606  * authoritative again.
607  *
608  * FIXME! If there are labels in between the SOA and
609  * the cut, going from the authoritative space (below
610  * the SOA) up into occluded space again, will not be
611  * detected with the contruct below!
612  */
613  if (ldns_dname_is_subdomain(owner, cut) &&
615  name->rrsets, LDNS_RR_TYPE_SOA)) {
616 
617  if (below_delegation && glue_list) {
618  s = ldns_dnssec_addresses_on_glue_list(
619  name->rrsets, glue_list);
620  if (s != LDNS_STATUS_OK) {
621  return s;
622  }
623  }
624  name->is_glue = true; /* Mark occluded name! */
625  continue;
626  } else {
627  cut = NULL;
628  }
629  }
630 
631  /* The node is not below a zone cut. Is it a zone cut itself?
632  * Everything below a SOA is authoritative of course; Except
633  * when the name also contains a DNAME :).
634  */
636  name->rrsets, LDNS_RR_TYPE_NS)
638  name->rrsets, LDNS_RR_TYPE_SOA)) {
639  cut = owner;
640  below_delegation = 1;
641  if (glue_list) { /* record glue on the zone cut */
642  s = ldns_dnssec_addresses_on_glue_list(
643  name->rrsets, glue_list);
644  if (s != LDNS_STATUS_OK) {
645  return s;
646  }
647  }
649  name->rrsets, LDNS_RR_TYPE_DNAME)) {
650  cut = owner;
651  below_delegation = 0;
652  }
653  }
654  return LDNS_STATUS_OK;
655 }
656 
669 {
670  return ldns_dnssec_zone_mark_and_get_glue(zone, NULL);
671 }
672 
675 {
676  ldns_rbnode_t *next_node = NULL;
677  ldns_dnssec_name *next_name = NULL;
678  bool done = false;
679 
680  if (node == LDNS_RBTREE_NULL) {
681  return NULL;
682  }
683  next_node = node;
684  while (!done) {
685  if (next_node == LDNS_RBTREE_NULL) {
686  return NULL;
687  } else {
688  next_name = (ldns_dnssec_name *)next_node->data;
689  if (!next_name->is_glue) {
690  done = true;
691  } else {
692  next_node = ldns_rbtree_next(next_node);
693  }
694  }
695  }
696  return next_node;
697 }
698 
701  ldns_rr_list *new_rrs)
702 {
703 
704  ldns_rbnode_t *first_node, *cur_node, *next_node;
705  ldns_dnssec_name *cur_name, *next_name;
706  ldns_rr *nsec_rr;
707  uint32_t nsec_ttl;
708  ldns_dnssec_rrsets *soa;
709 
710  /* the TTL of NSEC rrs should be set to the minimum TTL of
711  * the zone SOA (RFC4035 Section 2.3)
712  */
714 
715  /* did the caller actually set it? if not,
716  * fall back to default ttl
717  */
718  if (soa && soa->rrs && soa->rrs->rr
719  && (ldns_rr_rdf(soa->rrs->rr, 6) != NULL)) {
720  nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(soa->rrs->rr, 6));
721  } else {
722  nsec_ttl = LDNS_DEFAULT_TTL;
723  }
724 
726  ldns_rbtree_first(zone->names));
727  cur_node = first_node;
728  if (cur_node) {
730  ldns_rbtree_next(cur_node));
731  } else {
732  next_node = NULL;
733  }
734 
735  while (cur_node && next_node) {
736  cur_name = (ldns_dnssec_name *)cur_node->data;
737  next_name = (ldns_dnssec_name *)next_node->data;
738  nsec_rr = ldns_dnssec_create_nsec(cur_name,
739  next_name,
741  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
742  if(ldns_dnssec_name_add_rr(cur_name, nsec_rr)!=LDNS_STATUS_OK){
743  ldns_rr_free(nsec_rr);
744  return LDNS_STATUS_ERR;
745  }
746  ldns_rr_list_push_rr(new_rrs, nsec_rr);
747  cur_node = next_node;
748  if (cur_node) {
750  ldns_rbtree_next(cur_node));
751  }
752  }
753 
754  if (cur_node && !next_node) {
755  cur_name = (ldns_dnssec_name *)cur_node->data;
756  next_name = (ldns_dnssec_name *)first_node->data;
757  nsec_rr = ldns_dnssec_create_nsec(cur_name,
758  next_name,
760  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
761  if(ldns_dnssec_name_add_rr(cur_name, nsec_rr)!=LDNS_STATUS_OK){
762  ldns_rr_free(nsec_rr);
763  return LDNS_STATUS_ERR;
764  }
765  ldns_rr_list_push_rr(new_rrs, nsec_rr);
766  } else {
767  printf("error\n");
768  }
769 
770  return LDNS_STATUS_OK;
771 }
772 
773 #ifdef HAVE_SSL
774 static void
775 ldns_hashed_names_node_free(ldns_rbnode_t *node, void *arg) {
776  (void) arg;
777  LDNS_FREE(node);
778 }
779 
780 static ldns_status
781 ldns_dnssec_zone_create_nsec3s_mkmap(ldns_dnssec_zone *zone,
782  ldns_rr_list *new_rrs,
783  uint8_t algorithm,
784  uint8_t flags,
785  uint16_t iterations,
786  uint8_t salt_length,
787  uint8_t *salt,
788  ldns_rbtree_t **map)
789 {
790  ldns_rbnode_t *first_name_node;
791  ldns_rbnode_t *current_name_node;
792  ldns_dnssec_name *current_name;
793  ldns_status result = LDNS_STATUS_OK;
794  ldns_rr *nsec_rr;
795  ldns_rr_list *nsec3_list;
796  uint32_t nsec_ttl;
797  ldns_dnssec_rrsets *soa;
798  ldns_rbnode_t *hashmap_node;
799 
800  if (!zone || !new_rrs || !zone->names) {
801  return LDNS_STATUS_ERR;
802  }
803 
804  /* the TTL of NSEC rrs should be set to the minimum TTL of
805  * the zone SOA (RFC4035 Section 2.3)
806  */
808 
809  /* did the caller actually set it? if not,
810  * fall back to default ttl
811  */
812  if (soa && soa->rrs && soa->rrs->rr
813  && ldns_rr_rdf(soa->rrs->rr, 6) != NULL) {
814  nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(soa->rrs->rr, 6));
815  } else {
816  nsec_ttl = LDNS_DEFAULT_TTL;
817  }
818 
819  if (zone->hashed_names) {
821  ldns_hashed_names_node_free, NULL);
822  LDNS_FREE(zone->hashed_names);
823  }
825  if (zone->hashed_names && map) {
826  *map = zone->hashed_names;
827  }
828 
829  first_name_node = ldns_dnssec_name_node_next_nonglue(
830  ldns_rbtree_first(zone->names));
831 
832  current_name_node = first_name_node;
833 
834  while (current_name_node && current_name_node != LDNS_RBTREE_NULL &&
835  result == LDNS_STATUS_OK) {
836 
837  current_name = (ldns_dnssec_name *) current_name_node->data;
838  nsec_rr = ldns_dnssec_create_nsec3(current_name,
839  NULL,
840  zone->soa->name,
841  algorithm,
842  flags,
843  iterations,
844  salt_length,
845  salt);
846  /* by default, our nsec based generator adds rrsigs
847  * remove the bitmap for empty nonterminals */
848  if (!current_name->rrsets) {
850  }
851  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
852  result = ldns_dnssec_name_add_rr(current_name, nsec_rr);
853  ldns_rr_list_push_rr(new_rrs, nsec_rr);
854  if (ldns_rr_owner(nsec_rr)) {
855  hashmap_node = LDNS_MALLOC(ldns_rbnode_t);
856  if (hashmap_node == NULL) {
857  return LDNS_STATUS_MEM_ERR;
858  }
859  current_name->hashed_name =
860  ldns_dname_label(ldns_rr_owner(nsec_rr), 0);
861 
862  if (current_name->hashed_name == NULL) {
863  LDNS_FREE(hashmap_node);
864  return LDNS_STATUS_MEM_ERR;
865  }
866  hashmap_node->key = current_name->hashed_name;
867  hashmap_node->data = current_name;
868 
869  if (! ldns_rbtree_insert(zone->hashed_names
870  , hashmap_node)) {
871  LDNS_FREE(hashmap_node);
872  }
873  }
874  current_name_node = ldns_dnssec_name_node_next_nonglue(
875  ldns_rbtree_next(current_name_node));
876  }
877  if (result != LDNS_STATUS_OK) {
878  return result;
879  }
880 
881  /* Make sorted list of nsec3s (via zone->hashed_names)
882  */
883  nsec3_list = ldns_rr_list_new();
884  if (nsec3_list == NULL) {
885  return LDNS_STATUS_MEM_ERR;
886  }
887  for ( hashmap_node = ldns_rbtree_first(zone->hashed_names)
888  ; hashmap_node != LDNS_RBTREE_NULL
889  ; hashmap_node = ldns_rbtree_next(hashmap_node)
890  ) {
891  current_name = (ldns_dnssec_name *) hashmap_node->data;
892  nsec_rr = ((ldns_dnssec_name *) hashmap_node->data)->nsec;
893  if (nsec_rr) {
894  ldns_rr_list_push_rr(nsec3_list, nsec_rr);
895  }
896  }
897  result = ldns_dnssec_chain_nsec3_list(nsec3_list);
898  ldns_rr_list_free(nsec3_list);
899 
900  return result;
901 }
902 
905  ldns_rr_list *new_rrs,
906  uint8_t algorithm,
907  uint8_t flags,
908  uint16_t iterations,
909  uint8_t salt_length,
910  uint8_t *salt)
911 {
912  return ldns_dnssec_zone_create_nsec3s_mkmap(zone, new_rrs, algorithm,
913  flags, iterations, salt_length, salt, NULL);
914 
915 }
916 #endif /* HAVE_SSL */
917 
920  , ATTR_UNUSED(ldns_key_list *key_list)
921  , int (*func)(ldns_rr *, void *)
922  , void *arg
923  )
924 {
925  ldns_dnssec_rrs *base_rrs = signatures;
926  ldns_dnssec_rrs *cur_rr = base_rrs;
927  ldns_dnssec_rrs *prev_rr = NULL;
928  ldns_dnssec_rrs *next_rr;
929 
930  uint16_t keytag;
931  size_t i;
932 
933  if (!cur_rr) {
934  switch(func(NULL, arg)) {
937  break;
940  ldns_key_list_set_use(key_list, false);
941  break;
942  default:
943 #ifdef STDERR_MSGS
944  fprintf(stderr, "[XX] unknown return value from callback\n");
945 #endif
946  break;
947  }
948  return NULL;
949  }
950  (void)func(cur_rr->rr, arg);
951 
952  while (cur_rr) {
953  next_rr = cur_rr->next;
954 
955  switch (func(cur_rr->rr, arg)) {
957  prev_rr = cur_rr;
958  break;
960  keytag = ldns_rdf2native_int16(
961  ldns_rr_rrsig_keytag(cur_rr->rr));
962  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
963  if (ldns_key_keytag(ldns_key_list_key(key_list, i)) ==
964  keytag) {
965  ldns_key_set_use(ldns_key_list_key(key_list, i),
966  false);
967  }
968  }
969  prev_rr = cur_rr;
970  break;
972  keytag = ldns_rdf2native_int16(
973  ldns_rr_rrsig_keytag(cur_rr->rr));
974  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
975  if (ldns_key_keytag(ldns_key_list_key(key_list, i))
976  == keytag) {
977  ldns_key_set_use(ldns_key_list_key(key_list, i),
978  false);
979  }
980  }
981  if (prev_rr) {
982  prev_rr->next = next_rr;
983  } else {
984  base_rrs = next_rr;
985  }
986  LDNS_FREE(cur_rr);
987  break;
989  if (prev_rr) {
990  prev_rr->next = next_rr;
991  } else {
992  base_rrs = next_rr;
993  }
994  LDNS_FREE(cur_rr);
995  break;
996  default:
997 #ifdef STDERR_MSGS
998  fprintf(stderr, "[XX] unknown return value from callback\n");
999 #endif
1000  break;
1001  }
1002  cur_rr = next_rr;
1003  }
1004 
1005  return base_rrs;
1006 }
1007 
1008 #ifdef HAVE_SSL
1011  ldns_rr_list *new_rrs,
1012  ldns_key_list *key_list,
1013  int (*func)(ldns_rr *, void*),
1014  void *arg)
1015 {
1016  return ldns_dnssec_zone_create_rrsigs_flg(zone, new_rrs, key_list,
1017  func, arg, 0);
1018 }
1019 
1021 static void
1022 ldns_key_list_filter_for_dnskey(ldns_key_list *key_list)
1023 {
1024  int saw_ksk = 0;
1025  size_t i;
1026  for(i=0; i<ldns_key_list_key_count(key_list); i++)
1027  if((ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY)) {
1028  saw_ksk = 1;
1029  break;
1030  }
1031  if(!saw_ksk)
1032  return;
1033  for(i=0; i<ldns_key_list_key_count(key_list); i++)
1034  if(!(ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY))
1035  ldns_key_set_use(ldns_key_list_key(key_list, i), 0);
1036 }
1037 
1039 static void
1040 ldns_key_list_filter_for_non_dnskey(ldns_key_list *key_list)
1041 {
1042  int saw_zsk = 0;
1043  size_t i;
1044  for(i=0; i<ldns_key_list_key_count(key_list); i++)
1045  if(!(ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY)) {
1046  saw_zsk = 1;
1047  break;
1048  }
1049  if(!saw_zsk)
1050  return;
1051  /* else filter all KSKs */
1052  for(i=0; i<ldns_key_list_key_count(key_list); i++)
1053  if((ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY))
1054  ldns_key_set_use(ldns_key_list_key(key_list, i), 0);
1055 }
1056 
1059  , ldns_rr_list *new_rrs
1060  , ldns_key_list *key_list
1061  , int (*func)(ldns_rr *, void*)
1062  , void *arg
1063  , int flags
1064  )
1065 {
1066  ldns_status result = LDNS_STATUS_OK;
1067 
1068  ldns_rbnode_t *cur_node;
1069  ldns_rr_list *rr_list;
1070 
1071  ldns_dnssec_name *cur_name;
1072  ldns_dnssec_rrsets *cur_rrset;
1073  ldns_dnssec_rrs *cur_rr;
1074 
1075  ldns_rr_list *siglist;
1076 
1077  size_t i;
1078 
1079  int on_delegation_point = 0; /* handle partially occluded names */
1080 
1081  ldns_rr_list *pubkey_list = ldns_rr_list_new();
1082  for (i = 0; i<ldns_key_list_key_count(key_list); i++) {
1083  ldns_rr_list_push_rr( pubkey_list
1085  key_list, i))
1086  );
1087  }
1088  /* TODO: callback to see is list should be signed */
1089  /* TODO: remove 'old' signatures from signature list */
1090  cur_node = ldns_rbtree_first(zone->names);
1091  while (cur_node != LDNS_RBTREE_NULL) {
1092  cur_name = (ldns_dnssec_name *) cur_node->data;
1093 
1094  if (!cur_name->is_glue) {
1095  on_delegation_point = ldns_dnssec_rrsets_contains_type(
1096  cur_name->rrsets, LDNS_RR_TYPE_NS)
1098  cur_name->rrsets, LDNS_RR_TYPE_SOA);
1099  cur_rrset = cur_name->rrsets;
1100  while (cur_rrset) {
1101  /* reset keys to use */
1102  ldns_key_list_set_use(key_list, true);
1103 
1104  /* walk through old sigs, remove the old,
1105  and mark which keys (not) to use) */
1106  cur_rrset->signatures =
1108  key_list,
1109  func,
1110  arg);
1111  if(!(flags&LDNS_SIGN_DNSKEY_WITH_ZSK) &&
1112  cur_rrset->type == LDNS_RR_TYPE_DNSKEY)
1113  ldns_key_list_filter_for_dnskey(key_list);
1114 
1115  if(cur_rrset->type != LDNS_RR_TYPE_DNSKEY)
1116  ldns_key_list_filter_for_non_dnskey(key_list);
1117 
1118  /* TODO: just set count to zero? */
1119  rr_list = ldns_rr_list_new();
1120 
1121  cur_rr = cur_rrset->rrs;
1122  while (cur_rr) {
1123  ldns_rr_list_push_rr(rr_list, cur_rr->rr);
1124  cur_rr = cur_rr->next;
1125  }
1126 
1127  /* only sign non-delegation RRsets */
1128  /* (glue should have been marked earlier,
1129  * except on the delegation points itself) */
1130  if (!on_delegation_point ||
1131  ldns_rr_list_type(rr_list)
1132  == LDNS_RR_TYPE_DS ||
1133  ldns_rr_list_type(rr_list)
1134  == LDNS_RR_TYPE_NSEC ||
1135  ldns_rr_list_type(rr_list)
1136  == LDNS_RR_TYPE_NSEC3) {
1137  siglist = ldns_sign_public(rr_list, key_list);
1138  for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
1139  if (cur_rrset->signatures) {
1140  result = ldns_dnssec_rrs_add_rr(cur_rrset->signatures,
1141  ldns_rr_list_rr(siglist,
1142  i));
1143  } else {
1144  cur_rrset->signatures = ldns_dnssec_rrs_new();
1145  cur_rrset->signatures->rr =
1146  ldns_rr_list_rr(siglist, i);
1147  }
1148  if (new_rrs) {
1149  ldns_rr_list_push_rr(new_rrs,
1150  ldns_rr_list_rr(siglist,
1151  i));
1152  }
1153  }
1154  ldns_rr_list_free(siglist);
1155  }
1156 
1157  ldns_rr_list_free(rr_list);
1158 
1159  cur_rrset = cur_rrset->next;
1160  }
1161 
1162  /* sign the nsec */
1163  ldns_key_list_set_use(key_list, true);
1164  cur_name->nsec_signatures =
1166  key_list,
1167  func,
1168  arg);
1169  ldns_key_list_filter_for_non_dnskey(key_list);
1170 
1171  rr_list = ldns_rr_list_new();
1172  ldns_rr_list_push_rr(rr_list, cur_name->nsec);
1173  siglist = ldns_sign_public(rr_list, key_list);
1174 
1175  for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
1176  if (cur_name->nsec_signatures) {
1177  result = ldns_dnssec_rrs_add_rr(cur_name->nsec_signatures,
1178  ldns_rr_list_rr(siglist, i));
1179  } else {
1180  cur_name->nsec_signatures = ldns_dnssec_rrs_new();
1181  cur_name->nsec_signatures->rr =
1182  ldns_rr_list_rr(siglist, i);
1183  }
1184  if (new_rrs) {
1185  ldns_rr_list_push_rr(new_rrs,
1186  ldns_rr_list_rr(siglist, i));
1187  }
1188  }
1189 
1190  ldns_rr_list_free(siglist);
1191  ldns_rr_list_free(rr_list);
1192  }
1193  cur_node = ldns_rbtree_next(cur_node);
1194  }
1195 
1196  ldns_rr_list_deep_free(pubkey_list);
1197  return result;
1198 }
1199 
1202  ldns_rr_list *new_rrs,
1203  ldns_key_list *key_list,
1204  int (*func)(ldns_rr *, void *),
1205  void *arg)
1206 {
1207  return ldns_dnssec_zone_sign_flg(zone, new_rrs, key_list, func, arg, 0);
1208 }
1209 
1212  ldns_rr_list *new_rrs,
1213  ldns_key_list *key_list,
1214  int (*func)(ldns_rr *, void *),
1215  void *arg,
1216  int flags)
1217 {
1218  ldns_status result = LDNS_STATUS_OK;
1219 
1220  if (!zone || !new_rrs || !key_list) {
1221  return LDNS_STATUS_ERR;
1222  }
1223 
1224  /* zone is already sorted */
1225  result = ldns_dnssec_zone_mark_glue(zone);
1226  if (result != LDNS_STATUS_OK) {
1227  return result;
1228  }
1229 
1230  /* check whether we need to add nsecs */
1231  if (zone->names && !((ldns_dnssec_name *)zone->names->root->data)->nsec) {
1232  result = ldns_dnssec_zone_create_nsecs(zone, new_rrs);
1233  if (result != LDNS_STATUS_OK) {
1234  return result;
1235  }
1236  }
1237 
1238  result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1239  new_rrs,
1240  key_list,
1241  func,
1242  arg,
1243  flags);
1244 
1245  return result;
1246 }
1247 
1250  ldns_rr_list *new_rrs,
1251  ldns_key_list *key_list,
1252  int (*func)(ldns_rr *, void *),
1253  void *arg,
1254  uint8_t algorithm,
1255  uint8_t flags,
1256  uint16_t iterations,
1257  uint8_t salt_length,
1258  uint8_t *salt)
1259 {
1260  return ldns_dnssec_zone_sign_nsec3_flg_mkmap(zone, new_rrs, key_list,
1261  func, arg, algorithm, flags, iterations, salt_length, salt, 0,
1262  NULL);
1263 }
1264 
1267  ldns_rr_list *new_rrs,
1268  ldns_key_list *key_list,
1269  int (*func)(ldns_rr *, void *),
1270  void *arg,
1271  uint8_t algorithm,
1272  uint8_t flags,
1273  uint16_t iterations,
1274  uint8_t salt_length,
1275  uint8_t *salt,
1276  int signflags,
1277  ldns_rbtree_t **map)
1278 {
1279  ldns_rr *nsec3, *nsec3param;
1280  ldns_status result = LDNS_STATUS_OK;
1281 
1282  /* zone is already sorted */
1283  result = ldns_dnssec_zone_mark_glue(zone);
1284  if (result != LDNS_STATUS_OK) {
1285  return result;
1286  }
1287 
1288  /* TODO if there are already nsec3s presents and their
1289  * parameters are the same as these, we don't have to recreate
1290  */
1291  if (zone->names) {
1292  /* add empty nonterminals */
1294  if (result != LDNS_STATUS_OK) {
1295  return result;
1296  }
1297 
1298  nsec3 = ((ldns_dnssec_name *)zone->names->root->data)->nsec;
1299  if (nsec3 && ldns_rr_get_type(nsec3) == LDNS_RR_TYPE_NSEC3) {
1300  /* no need to recreate */
1301  } else {
1302  if (!ldns_dnssec_zone_find_rrset(zone,
1303  zone->soa->name,
1305  /* create and add the nsec3param rr */
1306  nsec3param =
1308  ldns_rr_set_owner(nsec3param,
1309  ldns_rdf_clone(zone->soa->name));
1310  ldns_nsec3_add_param_rdfs(nsec3param,
1311  algorithm,
1312  flags,
1313  iterations,
1314  salt_length,
1315  salt);
1316  /* always set bit 7 of the flags to zero, according to
1317  * rfc5155 section 11. The bits are counted from right to left,
1318  * so bit 7 in rfc5155 is bit 0 in ldns */
1319  ldns_set_bit(ldns_rdf_data(ldns_rr_rdf(nsec3param, 1)), 0, 0);
1320  result = ldns_dnssec_zone_add_rr(zone, nsec3param);
1321  if (result != LDNS_STATUS_OK) {
1322  return result;
1323  }
1324  ldns_rr_list_push_rr(new_rrs, nsec3param);
1325  }
1326  result = ldns_dnssec_zone_create_nsec3s_mkmap(zone,
1327  new_rrs,
1328  algorithm,
1329  flags,
1330  iterations,
1331  salt_length,
1332  salt,
1333  map);
1334  if (result != LDNS_STATUS_OK) {
1335  return result;
1336  }
1337  }
1338 
1339  result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1340  new_rrs,
1341  key_list,
1342  func,
1343  arg,
1344  signflags);
1345  }
1346 
1347  return result;
1348 }
1349 
1352  ldns_rr_list *new_rrs,
1353  ldns_key_list *key_list,
1354  int (*func)(ldns_rr *, void *),
1355  void *arg,
1356  uint8_t algorithm,
1357  uint8_t flags,
1358  uint16_t iterations,
1359  uint8_t salt_length,
1360  uint8_t *salt,
1361  int signflags)
1362 {
1363  return ldns_dnssec_zone_sign_nsec3_flg_mkmap(zone, new_rrs, key_list,
1364  func, arg, algorithm, flags, iterations, salt_length, salt,
1365  signflags, NULL);
1366 }
1367 
1368 ldns_zone *
1369 ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
1370 {
1371  ldns_dnssec_zone *dnssec_zone;
1372  ldns_zone *signed_zone;
1373  ldns_rr_list *new_rrs;
1374  size_t i;
1375 
1376  signed_zone = ldns_zone_new();
1377  dnssec_zone = ldns_dnssec_zone_new();
1378 
1379  (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1380  ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1381 
1382  for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1383  (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1385  i));
1386  ldns_zone_push_rr(signed_zone,
1388  i)));
1389  }
1390 
1391  new_rrs = ldns_rr_list_new();
1392  (void) ldns_dnssec_zone_sign(dnssec_zone,
1393  new_rrs,
1394  key_list,
1396  NULL);
1397 
1398  for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1399  ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1400  ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1401  }
1402 
1403  ldns_rr_list_deep_free(new_rrs);
1404  ldns_dnssec_zone_free(dnssec_zone);
1405 
1406  return signed_zone;
1407 }
1408 
1409 ldns_zone *
1410 ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
1411 {
1412  ldns_dnssec_zone *dnssec_zone;
1413  ldns_zone *signed_zone;
1414  ldns_rr_list *new_rrs;
1415  size_t i;
1416 
1417  signed_zone = ldns_zone_new();
1418  dnssec_zone = ldns_dnssec_zone_new();
1419 
1420  (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1421  ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1422 
1423  for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1424  (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1426  i));
1427  ldns_zone_push_rr(signed_zone,
1429  i)));
1430  }
1431 
1432  new_rrs = ldns_rr_list_new();
1433  (void) ldns_dnssec_zone_sign_nsec3(dnssec_zone,
1434  new_rrs,
1435  key_list,
1437  NULL,
1438  algorithm,
1439  flags,
1440  iterations,
1441  salt_length,
1442  salt);
1443 
1444  for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1445  ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1446  ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1447  }
1448 
1449  ldns_rr_list_deep_free(new_rrs);
1450  ldns_dnssec_zone_free(dnssec_zone);
1451 
1452  return signed_zone;
1453 }
1454 #endif /* HAVE_SSL */
1455 
1456 
ldns_rdf * ldns_rr_rdf(const ldns_rr *rr, size_t nr)
returns the rdata field member counter.
Definition: rr.c:873
implementation of buffers to ease operations
Definition: buffer.h:50
ldns_rdf * ldns_sign_public_evp(ldns_buffer *to_sign, EVP_PKEY *key, const EVP_MD *digest_type)
Sign data with EVP (general method for different algorithms)
Definition: dnssec_sign.c:397
ldns_status ldns_dnssec_zone_sign_nsec3_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1351
ldns_rbnode_t * ldns_dnssec_name_node_next_nonglue(ldns_rbnode_t *node)
Finds the first dnssec_name node in the rbtree that is not occluded.
Definition: dnssec_sign.c:674
ldns_dnssec_rrs * rrs
Definition: dnssec_zone.h:34
time (32 bits)
Definition: rdata.h:84
ldns_key * ldns_key_list_key(const ldns_key_list *key, size_t nr)
returns a pointer to the key in the list at the given position
Definition: keys.c:1087
ldns_rdf * ldns_sign_public_dsa(ldns_buffer *to_sign, DSA *key)
Sign data with DSA.
Definition: dnssec_sign.c:309
ldns_rr * ldns_zone_soa(const ldns_zone *z)
Return the soa record of a zone.
Definition: zone.c:17
#define LDNS_DEFAULT_EXP_TIME
Definition: dnssec.h:44
ldns_rr * ldns_rr_clone(const ldns_rr *rr)
clones a rr and all its data
Definition: rr.c:1363
#define LDNS_SIGNATURE_LEAVE_ADD_NEW
return values for the old-signature callback
Definition: dnssec.h:47
ldns_rdf * ldns_sign_public_rsasha1(ldns_buffer *to_sign, RSA *key)
Sign a buffer with the RSA key (hash with SHA1)
Definition: dnssec_sign.c:465
ldns_rdf * ldns_key_pubkey_owner(const ldns_key *k)
return the public key's owner
Definition: keys.c:1206
void ldns_rdf_deep_free(ldns_rdf *rd)
frees a rdf structure and frees the data.
Definition: rdata.c:230
uint8_t ldns_dname_label_count(const ldns_rdf *r)
count the number of labels inside a LDNS_RDF_DNAME type rdf.
Definition: dname.c:214
void ldns_rr2canonical(ldns_rr *rr)
converts each dname in a rr to its canonical form.
Definition: rr.c:1744
a host address
Definition: rr.h:83
#define LDNS_DEFAULT_TTL
Definition: ldns.h:135
DNSSEC.
Definition: rr.h:173
b64 string
Definition: rdata.h:68
ldns_rdf * ldns_native2rdf_int16(ldns_rdf_type type, uint16_t value)
returns the rdf containing the native uint16_t representation.
Definition: rdata.c:132
ldns_rbnode_t * ldns_rbtree_insert(ldns_rbtree_t *rbtree, ldns_rbnode_t *data)
Insert data into the tree.
Definition: rbtree.c:242
enum ldns_enum_rr_class ldns_rr_class
Definition: rr.h:64
List or Set of Resource Records.
Definition: rr.h:327
_Bool ldns_rr_rrsig_set_expiration(ldns_rr *r, ldns_rdf *f)
sets the expireation date of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:165
ldns_zone * ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Signs the zone with NSEC3, and returns a newly allocated signed zone.
Definition: dnssec_sign.c:1410
_Bool ldns_rr_rrsig_set_signame(ldns_rr *r, ldns_rdf *f)
sets the signers name of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:201
void ldns_key_set_use(ldns_key *k, _Bool v)
Definition: keys.c:1103
_Bool ldns_zone_push_rr(ldns_zone *z, ldns_rr *rr)
push an single rr to a zone structure.
Definition: zone.c:54
_Bool ldns_rr_rrsig_set_keytag(ldns_rr *r, ldns_rdf *f)
sets the keytag of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:189
#define LDNS_SIGN_DNSKEY_WITH_ZSK
dnssec_verify
Definition: dnssec_sign.h:15
ldns_dnssec_rrsets * rrsets
The rrsets for this name.
Definition: dnssec_zone.h:63
a RR type
Definition: rdata.h:74
ldns_status ldns_rr_list2buffer_wire(ldns_buffer *buffer, const ldns_rr_list *rr_list)
Copies the rr_list data to the buffer in wire format.
Definition: host2wire.c:71
#define LDNS_XMALLOC(type, count)
Definition: util.h:51
void ldns_nsec3_add_param_rdfs(ldns_rr *rr, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Sets all the NSEC3 options.
Definition: dnssec.c:1073
void ldns_rr_list_deep_free(ldns_rr_list *rr_list)
frees an rr_list structure and all rrs contained therein.
Definition: rr.c:984
void ldns_buffer_free(ldns_buffer *buffer)
frees the buffer.
Definition: buffer.c:137
DNS Zone.
Definition: zone.h:42
_Bool ldns_rr_rrsig_set_typecovered(ldns_rr *r, ldns_rdf *f)
sets the typecovered of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:117
ldns_rr * ldns_rr_new_frm_type(ldns_rr_type t)
creates a new rr structure, based on the given type.
Definition: rr.c:42
ldns_rdf * ldns_rdf_clone(const ldns_rdf *rd)
clones a rdf structure.
Definition: rdata.c:222
_Bool ldns_rr_rrsig_set_sig(ldns_rr *r, ldns_rdf *f)
sets the signature data of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:213
void ldns_dname2canonical(const ldns_rdf *rd)
Put a dname into canonical fmt - ie.
Definition: dname.c:277
ldns_status ldns_dnssec_zone_sign_nsec3(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1249
ldns_rdf * ldns_rr_rrsig_keytag(const ldns_rr *r)
returns the keytag of a LDNS_RR_TYPE_RRSIG RR
Definition: rr_functions.c:183
#define LDNS_MAX_PACKETLEN
Definition: packet.h:24
void ldns_rr_free(ldns_rr *rr)
frees an RR structure
Definition: rr.c:75
Structure containing a dnssec zone.
Definition: dnssec_zone.h:91
ldns_rbnode_t * root
The root of the red-black tree.
Definition: rbtree.h:85
void ldns_rr_list_free(ldns_rr_list *rr_list)
frees an rr_list structure.
Definition: rr.c:975
_Bool ldns_key_use(const ldns_key *k)
return the use flag
Definition: keys.c:1111
void ldns_zone_set_soa(ldns_zone *z, ldns_rr *soa)
Set the zone's soa record.
Definition: zone.c:29
ldns_status ldns_dnssec_zone_create_rrsigs_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
Adds signatures to the zone.
Definition: dnssec_sign.c:1058
ldns_rr_list * ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
use this function to sign with a public/private key alg return the created signatures ...
Definition: dnssec_sign.c:196
Resource Record.
Definition: rr.h:299
void ldns_rdf_free(ldns_rdf *rd)
frees a rdf structure, leaving the data pointer intact.
Definition: rdata.c:241
ldns_status ldns_dnssec_name_add_rr(ldns_dnssec_name *name, ldns_rr *rr)
Inserts the given rr at the right place in the current dnssec_name No checking is done whether the na...
Definition: dnssec_zone.c:448
const void * data
pointer to data
Definition: rbtree.h:70
ldns_rbtree_t * names
tree of ldns_dnssec_names
Definition: dnssec_zone.h:95
Including this file will include all ldns files, and define some lookup tables.
ipv6 address
Definition: rr.h:137
ldns_status ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags, ldns_rbtree_t **map)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1266
ldns_rdf * ldns_native2rdf_int8(ldns_rdf_type type, uint8_t value)
returns the rdf containing the native uint8_t repr.
Definition: rdata.c:126
marks the start of a zone of authority
Definition: rr.h:93
int ldns_dnssec_rrsets_contains_type(ldns_dnssec_rrsets *rrsets, ldns_rr_type type)
returns whether a rrset of the given type is found in the rrsets.
Definition: dnssec.c:767
ldns_rdf * ldns_native2rdf_int32(ldns_rdf_type type, uint32_t value)
returns an rdf that contains the given int32 value.
Definition: rdata.c:147
_Bool ldns_rr_rrsig_set_labels(ldns_rr *r, ldns_rdf *f)
sets the number of labels of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:141
General key structure, can contain all types of keys that are used in DNSSEC.
Definition: keys.h:107
uint8_t * ldns_rdf_data(const ldns_rdf *rd)
returns the data of the rdf.
Definition: rdata.c:38
_Bool ldns_rr_rrsig_set_origttl(ldns_rr *r, ldns_rdf *f)
sets the original TTL of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:153
ldns_rr * ldns_rr_list_rr(const ldns_rr_list *rr_list, size_t nr)
returns a specific rr of an rrlist.
Definition: rr.c:954
ldns_status ldns_dnssec_zone_add_rr(ldns_dnssec_zone *zone, ldns_rr *rr)
Adds the given RR to the zone.
Definition: dnssec_zone.c:880
ldns_dnssec_rrs * ldns_dnssec_rrs_new(void)
Creates a new entry for 1 pointer to an rr and 1 pointer to the next rrs.
Definition: dnssec_zone.c:10
void ldns_rr_set_class(ldns_rr *rr, ldns_rr_class rr_class)
sets the class in the rr.
Definition: rr.c:798
#define LDNS_SIGNATURE_REMOVE_NO_ADD
Definition: dnssec.h:50
16 bits
Definition: rdata.h:54
ldns_rr * ldns_dnssec_create_nsec(ldns_dnssec_name *from, ldns_dnssec_name *to, ldns_rr_type nsec_type)
Creates NSEC.
Definition: dnssec.c:781
ldns_status ldns_dnssec_zone_sign(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg)
signs the given zone with the given keys
Definition: dnssec_sign.c:1201
#define ATTR_UNUSED(x)
Definition: common.h:67
The rbnode_t struct definition.
Definition: rbtree.h:60
ldns_rbtree_t * ldns_rbtree_create(int(*cmpf)(const void *, const void *))
Create new tree (malloced) with given key compare function.
Definition: rbtree.c:80
a key algorithm
Definition: rdata.h:80
uint16_t ldns_rdf2native_int16(const ldns_rdf *rd)
returns the native uint16_t representation from the rdf.
Definition: rdata.c:84
ldns_rr * ldns_dnssec_create_nsec3(ldns_dnssec_name *from, ldns_dnssec_name *to, ldns_rdf *zone_name, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Creates NSEC3.
Definition: dnssec.c:835
ldns_status ldns_dnssec_zone_mark_and_get_glue(ldns_dnssec_zone *zone, ldns_rr_list *glue_list)
Marks the names in the zone that are occluded.
Definition: dnssec_sign.c:579
signed char is_glue
Unlike what the name is_glue suggests, this field is set to true by ldns_dnssec_zone_mark_glue() or l...
Definition: dnssec_zone.h:81
int ldns_dname_is_wildcard(const ldns_rdf *dname)
Check if dname is a wildcard, starts with *.
Definition: dname.c:453
ldns_rr_list * ldns_rr_list_new(void)
creates a new rr_list structure.
Definition: rr.c:964
ldns_dnssec_rrs * signatures
Definition: dnssec_zone.h:36
ldns_rdf * ldns_rr_pop_rdf(ldns_rr *rr)
removes a rd_field member, it will be popped from the last position.
Definition: rr.c:844
#define LDNS_KEY_ZONE_KEY
Definition: keys.h:37
ldns_status ldns_dnssec_zone_create_nsecs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs)
Adds NSEC records to the given dnssec_zone.
Definition: dnssec_sign.c:700
Same as rr_list, but now for keys.
Definition: keys.h:157
ldns_zone * ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
Signs the zone, and returns a newly allocated signed zone.
Definition: dnssec_sign.c:1369
32 bits
Definition: rdata.h:56
int ldns_dname_compare_v(const void *a, const void *b)
Given in dnssec_zone.c, also used in dnssec_sign.c:w.
Definition: dnssec_zone.c:780
ldns_rdf * ldns_sign_public_rsamd5(ldns_buffer *to_sign, RSA *key)
Sign a buffer with the RSA key (hash with MD5)
Definition: dnssec_sign.c:501
RFC4034, RFC3658.
Definition: rr.h:167
ldns_rr_list * ldns_rr_list_clone(const ldns_rr_list *rrlist)
clones an rrlist.
Definition: rr.c:1394
_Bool ldns_rr_rrsig_set_inception(ldns_rr *r, ldns_rdf *f)
sets the inception date of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:177
definition for tree struct
Definition: rbtree.h:83
#define LDNS_KEY_SEP_KEY
Definition: keys.h:38
void ldns_rr_set_owner(ldns_rr *rr, ldns_rdf *owner)
sets the owner in the rr structure.
Definition: rr.c:768
uint32_t ldns_key_inception(const ldns_key *k)
return the key's inception date
Definition: keys.c:1188
#define LDNS_SIGNATURE_REMOVE_ADD_NEW
Definition: dnssec.h:49
uint32_t ldns_rdf2native_int32(const ldns_rdf *rd)
returns the native uint32_t representation from the rdf.
Definition: rdata.c:98
ldns_rr_type ldns_rr_get_type(const ldns_rr *rr)
returns the type of the rr.
Definition: rr.c:907
void ldns_set_bit(uint8_t *byte, int bit_nr, _Bool value)
Definition: util.c:72
ldns_dnssec_rrs * ldns_dnssec_remove_signatures(ldns_dnssec_rrs *signatures, ldns_key_list *key_list __attribute__((unused)), int(*func)(ldns_rr *, void *), void *arg)
Definition: dnssec_sign.c:919
ldns_dnssec_name * soa
points to the name containing the SOA RR
Definition: dnssec_zone.h:93
void ldns_rr_set_ttl(ldns_rr *rr, uint32_t ttl)
sets the ttl in the rr structure.
Definition: rr.c:780
enum ldns_enum_status ldns_status
Definition: error.h:131
ldns_dnssec_rrs * next
Definition: dnssec_zone.h:25
EVP_PKEY * ldns_key_evp_key(const ldns_key *k)
returns the (openssl) EVP struct contained in the key
Definition: keys.c:1122
ldns_rdf * ldns_sign_public_buffer(ldns_buffer *sign_buf, ldns_key *current_key)
Sign the buffer which contains the wiredata of an rrset, and the corresponding empty rrsig rr with th...
Definition: dnssec_sign.c:120
ldns_rdf * ldns_rdf_new_frm_data(ldns_rdf_type type, size_t size, const void *data)
allocates a new rdf structure and fills it.
Definition: rdata.c:193
#define LDNS_MALLOC(type)
Memory management macros.
Definition: util.h:49
ldns_dnssec_rrsets * ldns_dnssec_name_find_rrset(ldns_dnssec_name *name, ldns_rr_type type)
Find the RRset with the given type in within this name structure.
Definition: dnssec_zone.c:492
ldns_rdf * hashed_name
pointer to store the hashed name (only used when in an NSEC3 zone
Definition: dnssec_zone.h:85
ldns_buffer * ldns_buffer_new(size_t capacity)
creates a new buffer with the specified capacity.
Definition: buffer.c:16
This module contains base functions for DNSSEC operations (RFC4033 t/m RFC4035).
ldns_signing_algorithm ldns_key_algorithm(const ldns_key *k)
return the signing alg of the key
Definition: keys.c:1097
void ldns_key_list_set_use(ldns_key_list *keys, _Bool v)
Definition: keys.c:1213
uint32_t ldns_key_expiration(const ldns_key *k)
return the key's expiration date
Definition: keys.c:1194
void ldns_dnssec_zone_free(ldns_dnssec_zone *zone)
Frees the given zone structure, and its rbtree of dnssec_names Individual ldns_rr RRs within those na...
Definition: dnssec_zone.c:749
_Bool ldns_rr_list_push_rr(ldns_rr_list *rr_list, const ldns_rr *rr)
pushes an rr to an rrlist.
Definition: rr.c:1096
ldns_status ldns_dnssec_zone_create_rrsigs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg)
Adds signatures to the zone.
Definition: dnssec_sign.c:1010
#define LDNS_RBTREE_NULL
The nullpointer, points to empty node.
Definition: rbtree.h:76
ldns_status ldns_dnssec_zone_create_nsec3s(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Adds NSEC3 records to the zone.
Definition: dnssec_sign.c:904
ldns_rr_list * ldns_zone_rrs(const ldns_zone *z)
Get a list of a zone's content.
Definition: zone.c:35
const void * key
pointer to sorting key
Definition: rbtree.h:68
ldns_rr * ldns_key2rr(const ldns_key *k)
converts a ldns_key to a public key rr If the key data exists at an external point, the corresponding rdata field must still be added with ldns_rr_rdf_push() to the result rr of this function
Definition: keys.c:1370
ldns_status ldns_dnssec_zone_mark_glue(ldns_dnssec_zone *zone)
Marks the names in the zone that are occluded.
Definition: dnssec_sign.c:668
Resource record data field.
Definition: rdata.h:166
ldns_dnssec_zone * ldns_dnssec_zone_new(void)
Creates a new dnssec_zone structure.
Definition: dnssec_zone.c:569
ldns_dnssec_rrsets * next
Definition: dnssec_zone.h:37
size_t ldns_key_list_key_count(const ldns_key_list *key_list)
returns the number of keys in the key list
Definition: keys.c:1081
8 bits
Definition: rdata.h:52
void ldns_traverse_postorder(ldns_rbtree_t *tree, void(*func)(ldns_rbnode_t *, void *), void *arg)
Call function for all elements in the redblack tree, such that leaf elements are called before parent...
Definition: rbtree.c:666
ldns_rdf * ldns_rr_owner(const ldns_rr *rr)
returns the owner name of an rr structure.
Definition: rr.c:883
size_t ldns_rr_list_rr_count(const ldns_rr_list *rr_list)
returns the number of rr's in an rr_list.
Definition: rr.c:921
#define LDNS_SIGNATURE_LEAVE_NO_ADD
Definition: dnssec.h:48
#define LDNS_FREE(ptr)
Definition: util.h:60
ldns_status ldns_dnssec_chain_nsec3_list(ldns_rr_list *nsec3_rrs)
chains nsec3 list
Definition: dnssec.c:1595
an authoritative name server
Definition: rr.h:85
uint16_t ldns_key_keytag(const ldns_key *k)
return the keytag
Definition: keys.c:1200
ldns_status ldns_rrsig2buffer_wire(ldns_buffer *buffer, const ldns_rr *rr)
Converts a rrsig to wireformat BUT EXCLUDE the rrsig rdata This is needed in DNSSEC verification...
Definition: host2wire.c:194
ldns_rdf * ldns_convert_ecdsa_rrsig_asn12rdf(const ldns_buffer *sig, const long sig_len)
Converts the ECDSA signature from ASN1 representation (as used by OpenSSL) to raw signature data as u...
Definition: dnssec.c:1809
ldns_rbnode_t * ldns_rbtree_first(ldns_rbtree_t *rbtree)
Returns first (smallest) node in the tree.
Definition: rbtree.c:548
ldns_rr * ldns_create_empty_rrsig(ldns_rr_list *rrset, ldns_key *current_key)
Create an empty RRSIG RR (i.e.
Definition: dnssec_sign.c:23
ldns_rdf * ldns_dname_label(const ldns_rdf *rdf, uint8_t labelpos)
look inside the rdf and if it is an LDNS_RDF_TYPE_DNAME try and retrieve a specific label...
Definition: dname.c:556
uint32_t ldns_rr_ttl(const ldns_rr *rr)
returns the ttl of an rr structure.
Definition: rr.c:895
ldns_rr_type ldns_rr_list_type(const ldns_rr_list *rr_list)
Returns the type of the first element of the RR If there are no elements present, 0 is returned...
Definition: rr.c:2670
ldns_dnssec_rrsets * ldns_dnssec_zone_find_rrset(ldns_dnssec_zone *zone, ldns_rdf *dname, ldns_rr_type type)
Find the RRset with the given name and type in the zone.
Definition: dnssec_zone.c:508
_Bool ldns_dname_is_subdomain(const ldns_rdf *sub, const ldns_rdf *parent)
test wether the name sub falls under parent (i.e.
Definition: dname.c:293
uint16_t ldns_key_flags(const ldns_key *k)
return the flag of the key
Definition: keys.c:1182
ldns_rr_class ldns_rr_get_class(const ldns_rr *rr)
returns the class of the rr.
Definition: rr.c:913
int ldns_dnssec_default_replace_signatures(ldns_rr *sig __attribute__((unused)), void *n __attribute__((unused)))
Definition: dnssec.c:1698
ldns_dnssec_rrs * nsec_signatures
signatures for the NSEC record
Definition: dnssec_zone.h:71
ldns_rbnode_t * ldns_rbtree_next(ldns_rbnode_t *node)
Returns next larger node in the tree.
Definition: rbtree.c:574
ldns_rbtree_t * hashed_names
tree of ldns_dnssec_names by nsec3 hashes (when applicible)
Definition: dnssec_zone.h:97
ldns_rdf * ldns_dnssec_name_name(ldns_dnssec_name *name)
Returns the domain name of the given dnssec_name structure.
Definition: dnssec_zone.c:394
ldns_status ldns_dnssec_zone_add_empty_nonterminals(ldns_dnssec_zone *zone)
Adds explicit dnssec_name structures for the empty nonterminals in this zone.
Definition: dnssec_zone.c:993
ldns_zone * ldns_zone_new(void)
create a new ldns_zone structure
Definition: zone.c:166
ldns_status ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
signs the given zone with the given keys
Definition: dnssec_sign.c:1211
void ldns_rr_list_sort(ldns_rr_list *unsorted)
sorts an rr_list (canonical wire format).
Definition: rr.c:1479
ldns_rdf * ldns_convert_dsa_rrsig_asn12rdf(const ldns_buffer *sig, const long sig_len)
Converts the DSA signature from ASN1 representation (RFC2459, as used by OpenSSL) to raw signature da...
Definition: dnssec.c:1707
ldns_status ldns_dnssec_rrs_add_rr(ldns_dnssec_rrs *rrs, ldns_rr *rr)
Adds an RR to the list of RRs.
Definition: dnssec_zone.c:47
RFC2672.
Definition: rr.h:159
ldns_rr * nsec
NSEC pointing to the next name (or NSEC3 pointing to the next NSEC3)
Definition: dnssec_zone.h:67
_Bool ldns_rr_rrsig_set_algorithm(ldns_rr *r, ldns_rdf *f)
sets the algorithm of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:129
ldns_rdf * name
pointer to a dname containing the name.
Definition: dnssec_zone.h:51