dnssec_sign.c
Go to the documentation of this file.
1#include <ldns/config.h>
2
3#include <ldns/ldns.h>
4
5#include <ldns/dnssec.h>
6#include <ldns/dnssec_sign.h>
7
8#include <strings.h>
9#include <time.h>
10
11#ifdef HAVE_SSL
12/* this entire file is rather useless when you don't have
13 * crypto...
14 */
15#include <openssl/ssl.h>
16#include <openssl/evp.h>
17#include <openssl/rand.h>
18#include <openssl/err.h>
19#include <openssl/md5.h>
20#include <openssl/bn.h>
21#include <openssl/rsa.h>
22#ifdef USE_DSA
23#include <openssl/dsa.h>
24#endif
25#endif /* HAVE_SSL */
26
27#define LDNS_SIGN_WITH_ZONEMD ( LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA384 \
28 | LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA512 )
29
30ldns_rr *
31ldns_create_empty_rrsig(const ldns_rr_list *rrset,
32 const ldns_key *current_key)
33{
34 uint32_t orig_ttl;
35 ldns_rr_class orig_class;
36 time_t now;
37 ldns_rr *current_sig;
38 uint8_t label_count;
39 ldns_rdf *signame;
40
41 label_count = ldns_dname_label_count(ldns_rr_owner(ldns_rr_list_rr(rrset,
42 0)));
43 /* RFC4035 2.2: not counting the leftmost label if it is a wildcard */
44 if(ldns_dname_is_wildcard(ldns_rr_owner(ldns_rr_list_rr(rrset, 0))))
45 label_count --;
46
47 current_sig = ldns_rr_new_frm_type(LDNS_RR_TYPE_RRSIG);
48
49 /* set the type on the new signature */
50 orig_ttl = ldns_rr_ttl(ldns_rr_list_rr(rrset, 0));
51 orig_class = ldns_rr_get_class(ldns_rr_list_rr(rrset, 0));
52
53 ldns_rr_set_ttl(current_sig, orig_ttl);
54 ldns_rr_set_class(current_sig, orig_class);
55 ldns_rr_set_owner(current_sig,
56 ldns_rdf_clone(
57 ldns_rr_owner(
58 ldns_rr_list_rr(rrset,
59 0))));
60
61 /* fill in what we know of the signature */
62
63 /* set the orig_ttl */
64 (void)ldns_rr_rrsig_set_origttl(
65 current_sig,
66 ldns_native2rdf_int32(LDNS_RDF_TYPE_INT32,
67 orig_ttl));
68 /* the signers name */
69 signame = ldns_rdf_clone(ldns_key_pubkey_owner(current_key));
70 ldns_dname2canonical(signame);
71 (void)ldns_rr_rrsig_set_signame(
72 current_sig,
73 signame);
74 /* label count - get it from the first rr in the rr_list */
75 (void)ldns_rr_rrsig_set_labels(
76 current_sig,
77 ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8,
78 label_count));
79 /* inception, expiration */
80 now = time(NULL);
81 if (ldns_key_inception(current_key) != 0) {
82 (void)ldns_rr_rrsig_set_inception(
83 current_sig,
84 ldns_native2rdf_int32(
85 LDNS_RDF_TYPE_TIME,
86 ldns_key_inception(current_key)));
87 } else {
88 (void)ldns_rr_rrsig_set_inception(
89 current_sig,
90 ldns_native2rdf_int32(LDNS_RDF_TYPE_TIME, now));
91 }
92 if (ldns_key_expiration(current_key) != 0) {
93 (void)ldns_rr_rrsig_set_expiration(
94 current_sig,
95 ldns_native2rdf_int32(
96 LDNS_RDF_TYPE_TIME,
97 ldns_key_expiration(current_key)));
98 } else {
99 (void)ldns_rr_rrsig_set_expiration(
100 current_sig,
101 ldns_native2rdf_int32(
102 LDNS_RDF_TYPE_TIME,
103 now + LDNS_DEFAULT_EXP_TIME));
104 }
105
106 (void)ldns_rr_rrsig_set_keytag(
107 current_sig,
108 ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16,
109 ldns_key_keytag(current_key)));
110
111 (void)ldns_rr_rrsig_set_algorithm(
112 current_sig,
113 ldns_native2rdf_int8(
114 LDNS_RDF_TYPE_ALG,
115 ldns_key_algorithm(current_key)));
116
117 (void)ldns_rr_rrsig_set_typecovered(
118 current_sig,
119 ldns_native2rdf_int16(
120 LDNS_RDF_TYPE_TYPE,
121 ldns_rr_get_type(ldns_rr_list_rr(rrset,
122 0))));
123 return current_sig;
124}
125
126#ifdef HAVE_SSL
127ldns_rdf *
128ldns_sign_public_buffer(ldns_buffer *sign_buf, ldns_key *current_key)
129{
130 ldns_rdf *b64rdf = NULL;
131
132 switch(ldns_key_algorithm(current_key)) {
133#ifdef USE_DSA
134 case LDNS_SIGN_DSA:
135 case LDNS_SIGN_DSA_NSEC3:
136 b64rdf = ldns_sign_public_evp(
137 sign_buf,
138 ldns_key_evp_key(current_key),
139# ifdef HAVE_EVP_DSS1
140 EVP_dss1()
141# else
142 EVP_sha1()
143# endif
144 );
145 break;
146#endif /* USE_DSA */
147 case LDNS_SIGN_RSASHA1:
148 case LDNS_SIGN_RSASHA1_NSEC3:
149 b64rdf = ldns_sign_public_evp(
150 sign_buf,
151 ldns_key_evp_key(current_key),
152 EVP_sha1());
153 break;
154#ifdef USE_SHA2
155 case LDNS_SIGN_RSASHA256:
156 b64rdf = ldns_sign_public_evp(
157 sign_buf,
158 ldns_key_evp_key(current_key),
159 EVP_sha256());
160 break;
161 case LDNS_SIGN_RSASHA512:
162 b64rdf = ldns_sign_public_evp(
163 sign_buf,
164 ldns_key_evp_key(current_key),
165 EVP_sha512());
166 break;
167#endif /* USE_SHA2 */
168#ifdef USE_GOST
169 case LDNS_SIGN_ECC_GOST:
170 b64rdf = ldns_sign_public_evp(
171 sign_buf,
172 ldns_key_evp_key(current_key),
173 EVP_get_digestbyname("md_gost94"));
174 break;
175#endif /* USE_GOST */
176#ifdef USE_ECDSA
177 case LDNS_SIGN_ECDSAP256SHA256:
178 b64rdf = ldns_sign_public_evp(
179 sign_buf,
180 ldns_key_evp_key(current_key),
181 EVP_sha256());
182 break;
183 case LDNS_SIGN_ECDSAP384SHA384:
184 b64rdf = ldns_sign_public_evp(
185 sign_buf,
186 ldns_key_evp_key(current_key),
187 EVP_sha384());
188 break;
189#endif
190#ifdef USE_ED25519
191 case LDNS_SIGN_ED25519:
192 b64rdf = ldns_sign_public_evp(
193 sign_buf,
194 ldns_key_evp_key(current_key),
195 NULL);
196 break;
197#endif
198#ifdef USE_ED448
199 case LDNS_SIGN_ED448:
200 b64rdf = ldns_sign_public_evp(
201 sign_buf,
202 ldns_key_evp_key(current_key),
203 NULL);
204 break;
205#endif
206 case LDNS_SIGN_RSAMD5:
207 b64rdf = ldns_sign_public_evp(
208 sign_buf,
209 ldns_key_evp_key(current_key),
210 EVP_md5());
211 break;
212 default:
213 /* do _you_ know this alg? */
214 printf("unknown algorithm, ");
215 printf("is the one used available on this system?\n");
216 break;
217 }
218
219 return b64rdf;
220}
221
226ldns_rr_list *
227ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
228{
229 ldns_rr_list *signatures;
230 ldns_rr_list *rrset_clone;
231 ldns_rr *current_sig;
232 ldns_rdf *b64rdf;
233 ldns_key *current_key;
234 size_t key_count;
235 uint16_t i;
236 ldns_buffer *sign_buf;
237 ldns_rdf *new_owner;
238
239 if (!rrset || ldns_rr_list_rr_count(rrset) < 1 || !keys) {
240 return NULL;
241 }
242
243 new_owner = NULL;
244
245 /* prepare a signature and add all the know data
246 * prepare the rrset. Sign this together. */
247 rrset_clone = ldns_rr_list_clone(rrset);
248 if (!rrset_clone) {
249 return NULL;
250 }
251
252 /* make it canonical */
253 for(i = 0; i < ldns_rr_list_rr_count(rrset_clone); i++) {
254 ldns_rr_set_ttl(ldns_rr_list_rr(rrset_clone, i),
255 ldns_rr_ttl(ldns_rr_list_rr(rrset, 0)));
256 ldns_rr2canonical(ldns_rr_list_rr(rrset_clone, i));
257 }
258 /* sort */
259 ldns_rr_list_sort(rrset_clone);
260
261 signatures = ldns_rr_list_new();
262
263 for (key_count = 0;
264 key_count < ldns_key_list_key_count(keys);
265 key_count++) {
266 if (!ldns_key_use(ldns_key_list_key(keys, key_count))) {
267 continue;
268 }
269 sign_buf = ldns_buffer_new(LDNS_MAX_PACKETLEN);
270 if (!sign_buf) {
271 ldns_rr_list_free(rrset_clone);
272 ldns_rr_list_free(signatures);
273 ldns_rdf_free(new_owner);
274 return NULL;
275 }
276 b64rdf = NULL;
277
278 current_key = ldns_key_list_key(keys, key_count);
279 /* sign all RRs with keys that have ZSKbit, !SEPbit.
280 sign DNSKEY RRs with keys that have ZSKbit&SEPbit */
281 if (ldns_key_flags(current_key) & LDNS_KEY_ZONE_KEY) {
282 current_sig = ldns_create_empty_rrsig(rrset_clone,
283 current_key);
284
285 /* right now, we have: a key, a semi-sig and an rrset. For
286 * which we can create the sig and base64 encode that and
287 * add that to the signature */
288
289 if (ldns_rrsig2buffer_wire(sign_buf, current_sig)
290 != LDNS_STATUS_OK) {
291 ldns_buffer_free(sign_buf);
292 /* ERROR */
293 ldns_rr_list_deep_free(rrset_clone);
294 ldns_rr_free(current_sig);
295 ldns_rr_list_deep_free(signatures);
296 return NULL;
297 }
298
299 /* add the rrset in sign_buf */
300 if (ldns_rr_list2buffer_wire(sign_buf, rrset_clone)
301 != LDNS_STATUS_OK) {
302 ldns_buffer_free(sign_buf);
303 ldns_rr_list_deep_free(rrset_clone);
304 ldns_rr_free(current_sig);
305 ldns_rr_list_deep_free(signatures);
306 return NULL;
307 }
308
309 b64rdf = ldns_sign_public_buffer(sign_buf, current_key);
310
311 if (!b64rdf) {
312 /* signing went wrong */
313 ldns_rr_list_deep_free(rrset_clone);
314 ldns_rr_free(current_sig);
315 ldns_rr_list_deep_free(signatures);
316 return NULL;
317 }
318
319 ldns_rr_rrsig_set_sig(current_sig, b64rdf);
320
321 /* push the signature to the signatures list */
322 ldns_rr_list_push_rr(signatures, current_sig);
323 }
324 ldns_buffer_free(sign_buf); /* restart for the next key */
325 }
326 ldns_rr_list_deep_free(rrset_clone);
327
328 return signatures;
329}
330
331ldns_rdf *
332ldns_sign_public_dsa(ldns_buffer *to_sign, DSA *key)
333{
334#ifdef USE_DSA
335 unsigned char md[EVP_MAX_MD_SIZE];
336 unsigned char *sha1_hash;
337 ldns_rdf *sigdata_rdf;
338 ldns_buffer *b64sig;
339
340 DSA_SIG *sig;
341 const BIGNUM *R, *S;
342 uint8_t *data;
343 size_t pad;
344
345 b64sig = ldns_buffer_new(LDNS_MAX_PACKETLEN);
346 if (!b64sig) {
347 return NULL;
348 }
349
350 sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
351 ldns_buffer_position(to_sign), md);
352 if (!sha1_hash) {
353 ldns_buffer_free(b64sig);
354 return NULL;
355 }
356
357 sig = DSA_do_sign(sha1_hash, SHA_DIGEST_LENGTH, key);
358 if(!sig) {
359 ldns_buffer_free(b64sig);
360 return NULL;
361 }
362
363 data = LDNS_XMALLOC(uint8_t, 1 + 2 * SHA_DIGEST_LENGTH);
364 if(!data) {
365 ldns_buffer_free(b64sig);
366 DSA_SIG_free(sig);
367 return NULL;
368 }
369
370 data[0] = 1;
371# ifdef HAVE_DSA_SIG_GET0
372 DSA_SIG_get0(sig, &R, &S);
373# else
374 R = sig->r;
375 S = sig->s;
376# endif
377 pad = 20 - (size_t) BN_num_bytes(R);
378 if (pad > 0) {
379 memset(data + 1, 0, pad);
380 }
381 BN_bn2bin(R, (unsigned char *) (data + 1) + pad);
382
383 pad = 20 - (size_t) BN_num_bytes(S);
384 if (pad > 0) {
385 memset(data + 1 + SHA_DIGEST_LENGTH, 0, pad);
386 }
387 BN_bn2bin(S, (unsigned char *) (data + 1 + SHA_DIGEST_LENGTH + pad));
388
389 sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64,
390 1 + 2 * SHA_DIGEST_LENGTH,
391 data);
392
393 ldns_buffer_free(b64sig);
394 LDNS_FREE(data);
395 DSA_SIG_free(sig);
396
397 return sigdata_rdf;
398#else
399 (void)to_sign; (void)key;
400 return NULL;
401#endif
402}
403
404#ifdef USE_ECDSA
405#ifndef S_SPLINT_S
407static int
408ldns_pkey_is_ecdsa(EVP_PKEY* pkey)
409{
410 EC_KEY* ec;
411 const EC_GROUP* g;
412#ifdef HAVE_EVP_PKEY_GET_BASE_ID
413 if(EVP_PKEY_get_base_id(pkey) != EVP_PKEY_EC)
414 return 0;
415#elif defined(HAVE_EVP_PKEY_BASE_ID)
416 if(EVP_PKEY_base_id(pkey) != EVP_PKEY_EC)
417 return 0;
418#else
419 if(EVP_PKEY_type(pkey->type) != EVP_PKEY_EC)
420 return 0;
421#endif
422 ec = EVP_PKEY_get1_EC_KEY(pkey);
423 g = EC_KEY_get0_group(ec);
424 if(!g) {
425 EC_KEY_free(ec);
426 return 0;
427 }
428 if(EC_GROUP_get_curve_name(g) == NID_X9_62_prime256v1) {
429 EC_KEY_free(ec);
430 return 32; /* 256/8 */
431 }
432 if(EC_GROUP_get_curve_name(g) == NID_secp384r1) {
433 EC_KEY_free(ec);
434 return 48; /* 384/8 */
435 }
436 /* downref the eckey, the original is still inside the pkey */
437 EC_KEY_free(ec);
438 return 0;
439}
440#endif /* splint */
441#endif /* USE_ECDSA */
442
443ldns_rdf *
444ldns_sign_public_evp(ldns_buffer *to_sign,
445 EVP_PKEY *key,
446 const EVP_MD *digest_type)
447{
448 unsigned int siglen;
449 ldns_rdf *sigdata_rdf = NULL;
450 ldns_buffer *b64sig;
451 EVP_MD_CTX *ctx;
452 const EVP_MD *md_type;
453 int r;
454
455 siglen = 0;
456 b64sig = ldns_buffer_new(LDNS_MAX_PACKETLEN);
457 if (!b64sig) {
458 return NULL;
459 }
460
461 /* initializes a signing context */
462 md_type = digest_type;
463#ifdef USE_ED25519
464 if(EVP_PKEY_id(key) == NID_ED25519) {
465 /* digest must be NULL for ED25519 sign and verify */
466 md_type = NULL;
467 } else
468#endif
469#ifdef USE_ED448
470 if(EVP_PKEY_id(key) == NID_ED448) {
471 md_type = NULL;
472 } else
473#endif
474 if(!md_type) {
475 /* unknown message digest */
476 ldns_buffer_free(b64sig);
477 return NULL;
478 }
479
480#ifdef HAVE_EVP_MD_CTX_NEW
481 ctx = EVP_MD_CTX_new();
482#else
483 ctx = (EVP_MD_CTX*)malloc(sizeof(*ctx));
484 if(ctx) EVP_MD_CTX_init(ctx);
485#endif
486 if(!ctx) {
487 ldns_buffer_free(b64sig);
488 return NULL;
489 }
490
491#if defined(USE_ED25519) || defined(USE_ED448)
492 if(md_type == NULL) {
493 /* for these methods we must use the one-shot DigestSign */
494 r = EVP_DigestSignInit(ctx, NULL, md_type, NULL, key);
495 if(r == 1) {
496 size_t siglen_sizet = ldns_buffer_capacity(b64sig);
497 r = EVP_DigestSign(ctx,
498 (unsigned char*)ldns_buffer_begin(b64sig),
499 &siglen_sizet,
500 (unsigned char*)ldns_buffer_begin(to_sign),
501 ldns_buffer_position(to_sign));
502 siglen = (unsigned int)siglen_sizet;
503 }
504 } else {
505#else
506 r = 0;
507 if(md_type != NULL) {
508#endif
509 r = EVP_SignInit(ctx, md_type);
510 if(r == 1) {
511 r = EVP_SignUpdate(ctx, (unsigned char*)
512 ldns_buffer_begin(to_sign),
513 ldns_buffer_position(to_sign));
514 }
515 if(r == 1) {
516 r = EVP_SignFinal(ctx, (unsigned char*)
517 ldns_buffer_begin(b64sig), &siglen, key);
518 }
519 }
520 if(r != 1) {
521 ldns_buffer_free(b64sig);
522 EVP_MD_CTX_destroy(ctx);
523 return NULL;
524 }
525
526 /* OpenSSL output is different, convert it */
527 r = 0;
528#ifdef USE_DSA
529#ifndef S_SPLINT_S
530 /* unfortunately, OpenSSL output is different from DNS DSA format */
531# ifdef HAVE_EVP_PKEY_GET_BASE_ID
532 if (EVP_PKEY_get_base_id(key) == EVP_PKEY_DSA) {
533# elif defined(HAVE_EVP_PKEY_BASE_ID)
534 if (EVP_PKEY_base_id(key) == EVP_PKEY_DSA) {
535# else
536 if (EVP_PKEY_type(key->type) == EVP_PKEY_DSA) {
537# endif
538 r = 1;
539 sigdata_rdf = ldns_convert_dsa_rrsig_asn12rdf(b64sig, siglen);
540 }
541#endif
542#endif
543#if defined(USE_ECDSA)
544 if(
545# ifdef HAVE_EVP_PKEY_GET_BASE_ID
546 EVP_PKEY_get_base_id(key)
547# elif defined(HAVE_EVP_PKEY_BASE_ID)
548 EVP_PKEY_base_id(key)
549# else
550 EVP_PKEY_type(key->type)
551# endif
552 == EVP_PKEY_EC) {
553# ifdef USE_ECDSA
554 if(ldns_pkey_is_ecdsa(key)) {
555 r = 1;
556 sigdata_rdf = ldns_convert_ecdsa_rrsig_asn1len2rdf(
557 b64sig, (long)siglen, ldns_pkey_is_ecdsa(key));
558 }
559# endif /* USE_ECDSA */
560 }
561#endif /* PKEY_EC */
562 if(r == 0) {
563 /* ok output for other types is the same */
564 sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
565 ldns_buffer_begin(b64sig));
566 }
567 ldns_buffer_free(b64sig);
568 EVP_MD_CTX_destroy(ctx);
569 return sigdata_rdf;
570}
571
572ldns_rdf *
573ldns_sign_public_rsasha1(ldns_buffer *to_sign, RSA *key)
574{
575 unsigned char md[EVP_MAX_MD_SIZE];
576 unsigned char *sha1_hash;
577 unsigned int siglen;
578 ldns_rdf *sigdata_rdf;
579 ldns_buffer *b64sig;
580 int result;
581
582 siglen = 0;
583 b64sig = ldns_buffer_new(LDNS_MAX_PACKETLEN);
584 if (!b64sig) {
585 return NULL;
586 }
587
588 sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
589 ldns_buffer_position(to_sign), md);
590 if (!sha1_hash) {
591 ldns_buffer_free(b64sig);
592 return NULL;
593 }
594
595 result = RSA_sign(NID_sha1, sha1_hash, SHA_DIGEST_LENGTH,
596 (unsigned char*)ldns_buffer_begin(b64sig),
597 &siglen, key);
598 if (result != 1) {
599 ldns_buffer_free(b64sig);
600 return NULL;
601 }
602
603 sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
604 ldns_buffer_begin(b64sig));
605 ldns_buffer_free(b64sig); /* can't free this buffer ?? */
606 return sigdata_rdf;
607}
608
609ldns_rdf *
610ldns_sign_public_rsamd5(ldns_buffer *to_sign, RSA *key)
611{
612 unsigned char md[EVP_MAX_MD_SIZE];
613 unsigned char *md5_hash;
614 unsigned int siglen;
615 ldns_rdf *sigdata_rdf;
616 ldns_buffer *b64sig;
617
618 b64sig = ldns_buffer_new(LDNS_MAX_PACKETLEN);
619 if (!b64sig) {
620 return NULL;
621 }
622
623 md5_hash = MD5((unsigned char*)ldns_buffer_begin(to_sign),
624 ldns_buffer_position(to_sign), md);
625 if (!md5_hash) {
626 ldns_buffer_free(b64sig);
627 return NULL;
628 }
629
630 RSA_sign(NID_md5, md5_hash, MD5_DIGEST_LENGTH,
631 (unsigned char*)ldns_buffer_begin(b64sig),
632 &siglen, key);
633
634 sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
635 ldns_buffer_begin(b64sig));
636 ldns_buffer_free(b64sig);
637 return sigdata_rdf;
638}
639#endif /* HAVE_SSL */
640
644static ldns_status
645ldns_dnssec_addresses_on_glue_list(
646 ldns_dnssec_rrsets *cur_rrset,
647 ldns_rr_list *glue_list)
648{
649 ldns_dnssec_rrs *cur_rrs;
650 while (cur_rrset) {
651 if (cur_rrset->type == LDNS_RR_TYPE_A
652 || cur_rrset->type == LDNS_RR_TYPE_AAAA) {
653 for (cur_rrs = cur_rrset->rrs;
654 cur_rrs;
655 cur_rrs = cur_rrs->next) {
656 if (cur_rrs->rr) {
657 if (!ldns_rr_list_push_rr(glue_list,
658 cur_rrs->rr)) {
659 return LDNS_STATUS_MEM_ERR;
660 /* ldns_rr_list_push_rr()
661 * returns false when unable
662 * to increase the capacity
663 * of the ldns_rr_list
664 */
665 }
666 }
667 }
668 }
669 cur_rrset = cur_rrset->next;
670 }
671 return LDNS_STATUS_OK;
672}
673
674ldns_status
675ldns_dnssec_zone_mark_and_get_glue(ldns_dnssec_zone *zone,
676 ldns_rr_list *glue_list)
677{
678 ldns_rbnode_t *node;
679 ldns_dnssec_name *name;
680 ldns_rdf *owner;
681 ldns_rdf *cut = NULL; /* keeps track of zone cuts */
682 /* When the cut is caused by a delegation, below_delegation will be 1.
683 * When caused by a DNAME, below_delegation will be 0.
684 */
685 int below_delegation = -1; /* init suppresses compiler warning */
686 ldns_status s;
687
688 if (!zone || !zone->names) {
689 return LDNS_STATUS_NULL;
690 }
691 for (node = ldns_rbtree_first(zone->names);
692 node != LDNS_RBTREE_NULL;
693 node = ldns_rbtree_next(node)) {
694 name = (ldns_dnssec_name *) node->data;
695 owner = ldns_dnssec_name_name(name);
696
697 if (cut) {
698 /* The previous node was a zone cut, or a subdomain
699 * below a zone cut. Is this node (still) a subdomain
700 * below the cut? Then the name is occluded. Unless
701 * the name contains a SOA, after which we are
702 * authoritative again.
703 *
704 * FIXME! If there are labels in between the SOA and
705 * the cut, going from the authoritative space (below
706 * the SOA) up into occluded space again, will not be
707 * detected with the construct below!
708 */
709 if (ldns_dname_is_subdomain(owner, cut) &&
710 !ldns_dnssec_rrsets_contains_type(
711 name->rrsets, LDNS_RR_TYPE_SOA)) {
712
713 if (below_delegation && glue_list) {
714 s = ldns_dnssec_addresses_on_glue_list(
715 name->rrsets, glue_list);
716 if (s != LDNS_STATUS_OK) {
717 return s;
718 }
719 }
720 name->is_glue = true; /* Mark occluded name! */
721 continue;
722 } else {
723 cut = NULL;
724 }
725 }
726
727 /* The node is not below a zone cut. Is it a zone cut itself?
728 * Everything below a SOA is authoritative of course; Except
729 * when the name also contains a DNAME :).
730 */
731 if (ldns_dnssec_rrsets_contains_type(
732 name->rrsets, LDNS_RR_TYPE_NS)
733 && !ldns_dnssec_rrsets_contains_type(
734 name->rrsets, LDNS_RR_TYPE_SOA)) {
735 cut = owner;
736 below_delegation = 1;
737 if (glue_list) { /* record glue on the zone cut */
738 s = ldns_dnssec_addresses_on_glue_list(
739 name->rrsets, glue_list);
740 if (s != LDNS_STATUS_OK) {
741 return s;
742 }
743 }
744 } else if (ldns_dnssec_rrsets_contains_type(
745 name->rrsets, LDNS_RR_TYPE_DNAME)) {
746 cut = owner;
747 below_delegation = 0;
748 }
749 }
750 return LDNS_STATUS_OK;
751}
752
753ldns_status
758
759ldns_rbnode_t *
760ldns_dnssec_name_node_next_nonglue(ldns_rbnode_t *node)
761{
762 ldns_rbnode_t *next_node = NULL;
763 ldns_dnssec_name *next_name = NULL;
764 bool done = false;
765
766 if (node == LDNS_RBTREE_NULL) {
767 return NULL;
768 }
769 next_node = node;
770 while (!done) {
771 if (next_node == LDNS_RBTREE_NULL) {
772 return NULL;
773 } else {
774 next_name = (ldns_dnssec_name *)next_node->data;
775 if (!next_name->is_glue) {
776 done = true;
777 } else {
778 next_node = ldns_rbtree_next(next_node);
779 }
780 }
781 }
782 return next_node;
783}
784
785ldns_status
786ldns_dnssec_zone_create_nsecs(ldns_dnssec_zone *zone,
787 ldns_rr_list *new_rrs)
788{
789
790 ldns_rbnode_t *first_node, *cur_node, *next_node;
791 ldns_dnssec_name *cur_name, *next_name;
792 ldns_rr *nsec_rr;
793 uint32_t nsec_ttl;
794 ldns_dnssec_rrsets *soa;
795
796 /* The TTL value for any NSEC RR SHOULD be the same TTL value as the
797 * lesser of the MINIMUM field of the SOA record and the TTL of the SOA
798 * itself. This matches the definition of the TTL for negative
799 * responses in [RFC2308]. (draft-ietf-dnsop-nsec-ttl-01 update of
800 * RFC4035 Section 2.3)
801 */
802 soa = ldns_dnssec_name_find_rrset(zone->soa, LDNS_RR_TYPE_SOA);
803
804 /* did the caller actually set it? if not,
805 * fall back to default ttl
806 */
807 if (soa && soa->rrs && soa->rrs->rr) {
808 ldns_rr *soa_rr = soa->rrs->rr;
809 ldns_rdf *min_rdf = ldns_rr_rdf(soa_rr, 6);
810
811 nsec_ttl = min_rdf == NULL
812 || ldns_rr_ttl(soa_rr) < ldns_rdf2native_int32(min_rdf)
813 ? ldns_rr_ttl(soa_rr) : ldns_rdf2native_int32(min_rdf);
814 } else {
815 nsec_ttl = LDNS_DEFAULT_TTL;
816 }
817
818 first_node = ldns_dnssec_name_node_next_nonglue(
819 ldns_rbtree_first(zone->names));
820 cur_node = first_node;
821 if (cur_node) {
822 next_node = ldns_dnssec_name_node_next_nonglue(
823 ldns_rbtree_next(cur_node));
824 } else {
825 next_node = NULL;
826 }
827
828 while (cur_node && next_node) {
829 cur_name = (ldns_dnssec_name *)cur_node->data;
830 next_name = (ldns_dnssec_name *)next_node->data;
831 nsec_rr = ldns_dnssec_create_nsec(cur_name,
832 next_name,
833 LDNS_RR_TYPE_NSEC);
834 ldns_rr_set_ttl(nsec_rr, nsec_ttl);
835 if(ldns_dnssec_name_add_rr(cur_name, nsec_rr)!=LDNS_STATUS_OK){
836 ldns_rr_free(nsec_rr);
837 return LDNS_STATUS_ERR;
838 }
839 ldns_rr_list_push_rr(new_rrs, nsec_rr);
840 cur_node = next_node;
841 if (cur_node) {
842 next_node = ldns_dnssec_name_node_next_nonglue(
843 ldns_rbtree_next(cur_node));
844 }
845 }
846
847 if (cur_node && !next_node) {
848 cur_name = (ldns_dnssec_name *)cur_node->data;
849 next_name = (ldns_dnssec_name *)first_node->data;
850 nsec_rr = ldns_dnssec_create_nsec(cur_name,
851 next_name,
852 LDNS_RR_TYPE_NSEC);
853 ldns_rr_set_ttl(nsec_rr, nsec_ttl);
854 if(ldns_dnssec_name_add_rr(cur_name, nsec_rr)!=LDNS_STATUS_OK){
855 ldns_rr_free(nsec_rr);
856 return LDNS_STATUS_ERR;
857 }
858 ldns_rr_list_push_rr(new_rrs, nsec_rr);
859 } else {
860 printf("error\n");
861 }
862
863 return LDNS_STATUS_OK;
864}
865
866#ifdef HAVE_SSL
867static void
868ldns_hashed_names_node_free(ldns_rbnode_t *node, void *arg) {
869 (void) arg;
870 LDNS_FREE(node);
871}
872
873static ldns_status
874ldns_dnssec_zone_create_nsec3s_mkmap(ldns_dnssec_zone *zone,
875 ldns_rr_list *new_rrs,
876 uint8_t algorithm,
877 uint8_t flags,
878 uint16_t iterations,
879 uint8_t salt_length,
880 uint8_t *salt,
881 ldns_rbtree_t **map)
882{
883 ldns_rbnode_t *first_name_node;
884 ldns_rbnode_t *current_name_node;
885 ldns_dnssec_name *current_name;
886 ldns_status result = LDNS_STATUS_OK;
887 ldns_rr *nsec_rr;
888 ldns_rr_list *nsec3_list;
889 uint32_t nsec_ttl;
890 ldns_dnssec_rrsets *soa;
891 ldns_rbnode_t *hashmap_node;
892
893 if (!zone || !new_rrs || !zone->names) {
894 return LDNS_STATUS_ERR;
895 }
896
897 /* The TTL value for any NSEC RR SHOULD be the same TTL value as the
898 * lesser of the MINIMUM field of the SOA record and the TTL of the SOA
899 * itself. This matches the definition of the TTL for negative
900 * responses in [RFC2308]. (draft-ietf-dnsop-nsec-ttl-01 update of
901 * RFC4035 Section 2.3)
902 */
903 soa = ldns_dnssec_name_find_rrset(zone->soa, LDNS_RR_TYPE_SOA);
904
905 /* did the caller actually set it? if not,
906 * fall back to default ttl
907 */
908 if (soa && soa->rrs && soa->rrs->rr) {
909 ldns_rr *soa_rr = soa->rrs->rr;
910 ldns_rdf *min_rdf = ldns_rr_rdf(soa_rr, 6);
911
912 nsec_ttl = min_rdf == NULL
913 || ldns_rr_ttl(soa_rr) < ldns_rdf2native_int32(min_rdf)
914 ? ldns_rr_ttl(soa_rr) : ldns_rdf2native_int32(min_rdf);
915 } else {
916 nsec_ttl = LDNS_DEFAULT_TTL;
917 }
918
919 if (ldns_rdf_size(zone->soa->name) > 222) {
920 return LDNS_STATUS_NSEC3_DOMAINNAME_OVERFLOW;
921 }
922
923 if (zone->hashed_names) {
924 ldns_traverse_postorder(zone->hashed_names,
925 ldns_hashed_names_node_free, NULL);
926 LDNS_FREE(zone->hashed_names);
927 }
928 zone->hashed_names = ldns_rbtree_create(ldns_dname_compare_v);
929 if (zone->hashed_names && map) {
930 *map = zone->hashed_names;
931 }
932
933 first_name_node = ldns_dnssec_name_node_next_nonglue(
934 ldns_rbtree_first(zone->names));
935
936 current_name_node = first_name_node;
937
938 while (current_name_node && current_name_node != LDNS_RBTREE_NULL &&
939 result == LDNS_STATUS_OK) {
940
941 current_name = (ldns_dnssec_name *) current_name_node->data;
942 nsec_rr = ldns_dnssec_create_nsec3(current_name,
943 NULL,
944 zone->soa->name,
945 algorithm,
946 flags,
947 iterations,
948 salt_length,
949 salt);
950 /* by default, our nsec based generator adds rrsigs
951 * remove the bitmap for empty nonterminals */
952 if (!current_name->rrsets) {
953 ldns_rdf_deep_free(ldns_rr_pop_rdf(nsec_rr));
954 }
955 ldns_rr_set_ttl(nsec_rr, nsec_ttl);
956 result = ldns_dnssec_name_add_rr(current_name, nsec_rr);
957 ldns_rr_list_push_rr(new_rrs, nsec_rr);
958 if (ldns_rr_owner(nsec_rr)) {
959 hashmap_node = LDNS_MALLOC(ldns_rbnode_t);
960 if (hashmap_node == NULL) {
961 return LDNS_STATUS_MEM_ERR;
962 }
963 current_name->hashed_name =
964 ldns_dname_label(ldns_rr_owner(nsec_rr), 0);
965
966 if (current_name->hashed_name == NULL) {
967 LDNS_FREE(hashmap_node);
968 return LDNS_STATUS_MEM_ERR;
969 }
970 hashmap_node->key = current_name->hashed_name;
971 hashmap_node->data = current_name;
972
973 if (! ldns_rbtree_insert(zone->hashed_names
974 , hashmap_node)) {
975 LDNS_FREE(hashmap_node);
976 }
977 }
978 current_name_node = ldns_dnssec_name_node_next_nonglue(
979 ldns_rbtree_next(current_name_node));
980 }
981 if (result != LDNS_STATUS_OK) {
982 return result;
983 }
984
985 /* Make sorted list of nsec3s (via zone->hashed_names)
986 */
987 nsec3_list = ldns_rr_list_new();
988 if (nsec3_list == NULL) {
989 return LDNS_STATUS_MEM_ERR;
990 }
991 for ( hashmap_node = ldns_rbtree_first(zone->hashed_names)
992 ; hashmap_node != LDNS_RBTREE_NULL
993 ; hashmap_node = ldns_rbtree_next(hashmap_node)
994 ) {
995 nsec_rr = ((ldns_dnssec_name *) hashmap_node->data)->nsec;
996 if (nsec_rr) {
997 ldns_rr_list_push_rr(nsec3_list, nsec_rr);
998 }
999 }
1000 result = ldns_dnssec_chain_nsec3_list(nsec3_list);
1001 ldns_rr_list_free(nsec3_list);
1002
1003 return result;
1004}
1005
1006ldns_status
1007ldns_dnssec_zone_create_nsec3s(ldns_dnssec_zone *zone,
1008 ldns_rr_list *new_rrs,
1009 uint8_t algorithm,
1010 uint8_t flags,
1011 uint16_t iterations,
1012 uint8_t salt_length,
1013 uint8_t *salt)
1014{
1015 return ldns_dnssec_zone_create_nsec3s_mkmap(zone, new_rrs, algorithm,
1016 flags, iterations, salt_length, salt, NULL);
1017
1018}
1019#endif /* HAVE_SSL */
1020
1021ldns_dnssec_rrs *
1022ldns_dnssec_remove_signatures( ldns_dnssec_rrs *signatures
1023 , ATTR_UNUSED(ldns_key_list *key_list)
1024 , int (*func)(ldns_rr *, void *)
1025 , void *arg
1026 )
1027{
1028 ldns_dnssec_rrs *base_rrs = signatures;
1029 ldns_dnssec_rrs *cur_rr = base_rrs;
1030 ldns_dnssec_rrs *prev_rr = NULL;
1031 ldns_dnssec_rrs *next_rr;
1032
1033 uint16_t keytag;
1034 size_t i;
1035
1036 if (!cur_rr) {
1037 switch(func(NULL, arg)) {
1038 case LDNS_SIGNATURE_LEAVE_ADD_NEW:
1039 case LDNS_SIGNATURE_REMOVE_ADD_NEW:
1040 break;
1041 case LDNS_SIGNATURE_LEAVE_NO_ADD:
1042 case LDNS_SIGNATURE_REMOVE_NO_ADD:
1043 ldns_key_list_set_use(key_list, false);
1044 break;
1045 default:
1046#ifdef STDERR_MSGS
1047 fprintf(stderr, "[XX] unknown return value from callback\n");
1048#endif
1049 break;
1050 }
1051 return NULL;
1052 }
1053 (void)func(cur_rr->rr, arg);
1054
1055 while (cur_rr) {
1056 next_rr = cur_rr->next;
1057
1058 switch (func(cur_rr->rr, arg)) {
1059 case LDNS_SIGNATURE_LEAVE_ADD_NEW:
1060 prev_rr = cur_rr;
1061 break;
1062 case LDNS_SIGNATURE_LEAVE_NO_ADD:
1063 keytag = ldns_rdf2native_int16(
1064 ldns_rr_rrsig_keytag(cur_rr->rr));
1065 for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1066 if (ldns_key_keytag(ldns_key_list_key(key_list, i)) ==
1067 keytag) {
1068 ldns_key_set_use(ldns_key_list_key(key_list, i),
1069 false);
1070 }
1071 }
1072 prev_rr = cur_rr;
1073 break;
1074 case LDNS_SIGNATURE_REMOVE_NO_ADD:
1075 keytag = ldns_rdf2native_int16(
1076 ldns_rr_rrsig_keytag(cur_rr->rr));
1077 for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1078 if (ldns_key_keytag(ldns_key_list_key(key_list, i))
1079 == keytag) {
1080 ldns_key_set_use(ldns_key_list_key(key_list, i),
1081 false);
1082 }
1083 }
1084 if (prev_rr) {
1085 prev_rr->next = next_rr;
1086 } else {
1087 base_rrs = next_rr;
1088 }
1089 LDNS_FREE(cur_rr);
1090 break;
1091 case LDNS_SIGNATURE_REMOVE_ADD_NEW:
1092 if (prev_rr) {
1093 prev_rr->next = next_rr;
1094 } else {
1095 base_rrs = next_rr;
1096 }
1097 LDNS_FREE(cur_rr);
1098 break;
1099 default:
1100#ifdef STDERR_MSGS
1101 fprintf(stderr, "[XX] unknown return value from callback\n");
1102#endif
1103 break;
1104 }
1105 cur_rr = next_rr;
1106 }
1107
1108 return base_rrs;
1109}
1110
1111#ifdef HAVE_SSL
1112ldns_status
1113ldns_dnssec_zone_create_rrsigs(ldns_dnssec_zone *zone,
1114 ldns_rr_list *new_rrs,
1115 ldns_key_list *key_list,
1116 int (*func)(ldns_rr *, void*),
1117 void *arg)
1118{
1119 return ldns_dnssec_zone_create_rrsigs_flg(zone, new_rrs, key_list,
1120 func, arg, 0);
1121}
1122
1124static void
1125ldns_key_list_filter_for_dnskey(ldns_key_list *key_list, int flags)
1126{
1127 bool algos[256]
1128#ifndef S_SPLINT_S
1129 = { false }
1130#endif
1131 ;
1132 ldns_signing_algorithm saw_ksk = 0;
1133 ldns_key *key;
1134 size_t i;
1135
1136 if (!ldns_key_list_key_count(key_list))
1137 return;
1138
1139 /* Mark all KSKs */
1140 for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1141 key = ldns_key_list_key(key_list, i);
1142 if ((ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
1143 if (!saw_ksk)
1144 saw_ksk = ldns_key_algorithm(key);
1145 algos[ldns_key_algorithm(key)] = true;
1146 }
1147 }
1148 if (!saw_ksk)
1149 return; /* No KSKs means sign using all ZSKs */
1150
1151 /* Deselect the ZSKs so they do not sign DNSKEY RRs.
1152 * Except with the LDNS_SIGN_WITH_ALL_ALGORITHMS flag, then use it,
1153 * but only if it has an algorithm for which there is no KSK
1154 */
1155 for (i =0; i < ldns_key_list_key_count(key_list); i++) {
1156 key = ldns_key_list_key(key_list, i);
1157 if (!(ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
1158 /* We have a ZSK.
1159 * Still use it if it has a unique algorithm though!
1160 */
1161 if ((flags & LDNS_SIGN_WITH_ALL_ALGORITHMS) &&
1162 !algos[ldns_key_algorithm(key)])
1163 algos[ldns_key_algorithm(key)] = true;
1164 else
1165 ldns_key_set_use(key, 0);
1166 }
1167 }
1168}
1169
1171static void
1172ldns_key_list_filter_for_non_dnskey(ldns_key_list *key_list, int flags)
1173{
1174 bool algos[256]
1175#ifndef S_SPLINT_S
1176 = { false }
1177#endif
1178 ;
1179 ldns_signing_algorithm saw_zsk = 0;
1180 ldns_key *key;
1181 size_t i;
1182
1183 if (!ldns_key_list_key_count(key_list))
1184 return;
1185
1186 /* Mark all ZSKs */
1187 for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1188 key = ldns_key_list_key(key_list, i);
1189 if (!(ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
1190 if (!saw_zsk)
1191 saw_zsk = ldns_key_algorithm(key);
1192 algos[ldns_key_algorithm(key)] = true;
1193 }
1194 }
1195 if (!saw_zsk)
1196 return; /* No ZSKs means sign using all KSKs */
1197
1198 /* Deselect the KSKs so they do not sign non DNSKEY RRs.
1199 * Except with the LDNS_SIGN_WITH_ALL_ALGORITHMS flag, then use it,
1200 * but only if it has an algorithm for which there is no ZSK
1201 */
1202 for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1203 key = ldns_key_list_key(key_list, i);
1204 if((ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
1205 /* We have a KSK.
1206 * Still use it if it has a unique algorithm though!
1207 */
1208 if ((flags & LDNS_SIGN_WITH_ALL_ALGORITHMS) &&
1209 !algos[ldns_key_algorithm(key)])
1210 algos[ldns_key_algorithm(key)] = true;
1211 else
1212 ldns_key_set_use(key, 0);
1213 }
1214 }
1215}
1216
1217ldns_status
1218ldns_dnssec_zone_create_rrsigs_flg( ldns_dnssec_zone *zone
1219 , ldns_rr_list *new_rrs
1220 , ldns_key_list *key_list
1221 , int (*func)(ldns_rr *, void*)
1222 , void *arg
1223 , int flags
1224 )
1225{
1226 ldns_status result = LDNS_STATUS_OK;
1227
1228 ldns_rbnode_t *cur_node;
1229 ldns_rr_list *rr_list;
1230
1231 ldns_dnssec_name *cur_name;
1232 ldns_dnssec_rrsets *cur_rrset;
1233 ldns_dnssec_rrs *cur_rr;
1234
1235 ldns_rr_list *siglist;
1236
1237 size_t i;
1238
1239 int on_delegation_point = 0; /* handle partially occluded names */
1240
1241 ldns_rr_list *pubkey_list = ldns_rr_list_new();
1242 for (i = 0; i<ldns_key_list_key_count(key_list); i++) {
1243 ldns_rr_list_push_rr( pubkey_list
1244 , ldns_key2rr(ldns_key_list_key(
1245 key_list, i))
1246 );
1247 }
1248 /* TODO: callback to see is list should be signed */
1249 /* TODO: remove 'old' signatures from signature list */
1250 cur_node = ldns_rbtree_first(zone->names);
1251 while (cur_node != LDNS_RBTREE_NULL) {
1252 cur_name = (ldns_dnssec_name *) cur_node->data;
1253
1254 if (!cur_name->is_glue) {
1255 on_delegation_point = ldns_dnssec_rrsets_contains_type(
1256 cur_name->rrsets, LDNS_RR_TYPE_NS)
1257 && !ldns_dnssec_rrsets_contains_type(
1258 cur_name->rrsets, LDNS_RR_TYPE_SOA);
1259 cur_rrset = cur_name->rrsets;
1260 while (cur_rrset) {
1261 /* reset keys to use */
1262 ldns_key_list_set_use(key_list, true);
1263
1264 /* walk through old sigs, remove the old,
1265 and mark which keys (not) to use) */
1266 cur_rrset->signatures =
1267 ldns_dnssec_remove_signatures(cur_rrset->signatures,
1268 key_list,
1269 func,
1270 arg);
1271 if(cur_rrset->type == LDNS_RR_TYPE_DNSKEY ||
1272 cur_rrset->type == LDNS_RR_TYPE_CDNSKEY ||
1273 cur_rrset->type == LDNS_RR_TYPE_CDS) {
1274 if(!(flags&LDNS_SIGN_DNSKEY_WITH_ZSK)) {
1275 ldns_key_list_filter_for_dnskey(key_list, flags);
1276 }
1277 } else {
1278 ldns_key_list_filter_for_non_dnskey(key_list, flags);
1279 }
1280
1281 /* TODO: just set count to zero? */
1282 rr_list = ldns_rr_list_new();
1283
1284 cur_rr = cur_rrset->rrs;
1285 while (cur_rr) {
1286 ldns_rr_list_push_rr(rr_list, cur_rr->rr);
1287 cur_rr = cur_rr->next;
1288 }
1289
1290 /* only sign non-delegation RRsets */
1291 /* (glue should have been marked earlier,
1292 * except on the delegation points itself) */
1293 if (!on_delegation_point ||
1294 ldns_rr_list_type(rr_list)
1295 == LDNS_RR_TYPE_DS ||
1296 ldns_rr_list_type(rr_list)
1297 == LDNS_RR_TYPE_NSEC ||
1298 ldns_rr_list_type(rr_list)
1299 == LDNS_RR_TYPE_NSEC3) {
1300 siglist = ldns_sign_public(rr_list, key_list);
1301 for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
1302 if (cur_rrset->signatures) {
1303 result = ldns_dnssec_rrs_add_rr(cur_rrset->signatures,
1304 ldns_rr_list_rr(siglist,
1305 i));
1306 } else {
1307 cur_rrset->signatures = ldns_dnssec_rrs_new();
1308 cur_rrset->signatures->rr =
1309 ldns_rr_list_rr(siglist, i);
1310 }
1311 if (new_rrs) {
1312 ldns_rr_list_push_rr(new_rrs,
1313 ldns_rr_list_rr(siglist,
1314 i));
1315 }
1316 }
1317 ldns_rr_list_free(siglist);
1318 }
1319
1320 ldns_rr_list_free(rr_list);
1321
1322 cur_rrset = cur_rrset->next;
1323 }
1324
1325 /* sign the nsec */
1326 ldns_key_list_set_use(key_list, true);
1327 cur_name->nsec_signatures =
1328 ldns_dnssec_remove_signatures(cur_name->nsec_signatures,
1329 key_list,
1330 func,
1331 arg);
1332 ldns_key_list_filter_for_non_dnskey(key_list, flags);
1333
1334 rr_list = ldns_rr_list_new();
1335 ldns_rr_list_push_rr(rr_list, cur_name->nsec);
1336 siglist = ldns_sign_public(rr_list, key_list);
1337
1338 for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
1339 if (cur_name->nsec_signatures) {
1340 result = ldns_dnssec_rrs_add_rr(cur_name->nsec_signatures,
1341 ldns_rr_list_rr(siglist, i));
1342 } else {
1343 cur_name->nsec_signatures = ldns_dnssec_rrs_new();
1344 cur_name->nsec_signatures->rr =
1345 ldns_rr_list_rr(siglist, i);
1346 }
1347 if (new_rrs) {
1348 ldns_rr_list_push_rr(new_rrs,
1349 ldns_rr_list_rr(siglist, i));
1350 }
1351 }
1352
1353 ldns_rr_list_free(siglist);
1354 ldns_rr_list_free(rr_list);
1355 }
1356 cur_node = ldns_rbtree_next(cur_node);
1357 }
1358
1359 ldns_rr_list_deep_free(pubkey_list);
1360 return result;
1361}
1362
1363ldns_status
1364ldns_dnssec_zone_sign(ldns_dnssec_zone *zone,
1365 ldns_rr_list *new_rrs,
1366 ldns_key_list *key_list,
1367 int (*func)(ldns_rr *, void *),
1368 void *arg)
1369{
1370 return ldns_dnssec_zone_sign_flg(zone, new_rrs, key_list, func, arg, 0);
1371}
1372
1373ldns_status dnssec_zone_equip_zonemd(ldns_dnssec_zone *zone,
1374 ldns_rr_list *new_rrs, ldns_key_list *key_list, int flags);
1375ldns_status
1376ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone,
1377 ldns_rr_list *new_rrs,
1378 ldns_key_list *key_list,
1379 int (*func)(ldns_rr *, void *),
1380 void *arg,
1381 int flags)
1382{
1383 ldns_status result = LDNS_STATUS_OK;
1384 ldns_dnssec_rrsets zonemd_rrset;
1385 bool zonemd_added = false;
1386
1387 if (!zone || !new_rrs || !key_list) {
1388 return LDNS_STATUS_ERR;
1389 }
1390 if (flags & LDNS_SIGN_WITH_ZONEMD) {
1391 ldns_dnssec_rrsets **rrsets_ref = &zone->soa->rrsets;
1392
1393 while (*rrsets_ref
1394 && (*rrsets_ref)->type < LDNS_RR_TYPE_ZONEMD)
1395 rrsets_ref = &(*rrsets_ref)->next;
1396 if (!*rrsets_ref
1397 || (*rrsets_ref)->type > LDNS_RR_TYPE_ZONEMD) {
1398 zonemd_rrset.rrs = NULL;
1399 zonemd_rrset.type = LDNS_RR_TYPE_ZONEMD;
1400 zonemd_rrset.signatures = NULL;
1401 zonemd_rrset.next = *rrsets_ref;
1402 *rrsets_ref = &zonemd_rrset;
1403 zonemd_added = true;
1404 }
1405 }
1406 /* zone is already sorted */
1407 result = ldns_dnssec_zone_mark_glue(zone);
1408 if (result != LDNS_STATUS_OK) {
1409 return result;
1410 }
1411 /* check whether we need to add nsecs */
1412 if ((flags & LDNS_SIGN_NO_KEYS_NO_NSECS)
1413 && ldns_key_list_key_count(key_list) < 1)
1414 ; /* pass */
1415
1416 else if (zone->names
1417 && !((ldns_dnssec_name *)zone->names->root->data)->nsec) {
1418
1419 result = ldns_dnssec_zone_create_nsecs(zone, new_rrs);
1420 if (result != LDNS_STATUS_OK) {
1421 return result;
1422 }
1423 }
1424 result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1425 new_rrs,
1426 key_list,
1427 func,
1428 arg,
1429 flags);
1430
1431 if (zonemd_added) {
1432 ldns_dnssec_rrsets **rrsets_ref
1433 = &zone->soa->rrsets;
1434
1435 while (*rrsets_ref
1436 && (*rrsets_ref)->type < LDNS_RR_TYPE_ZONEMD)
1437 rrsets_ref = &(*rrsets_ref)->next;
1438 *rrsets_ref = zonemd_rrset.next;
1439 }
1440 return flags & LDNS_SIGN_WITH_ZONEMD
1441 ? dnssec_zone_equip_zonemd(zone, new_rrs, key_list, flags)
1442 : result;
1443}
1444
1445ldns_status
1446ldns_dnssec_zone_sign_nsec3(ldns_dnssec_zone *zone,
1447 ldns_rr_list *new_rrs,
1448 ldns_key_list *key_list,
1449 int (*func)(ldns_rr *, void *),
1450 void *arg,
1451 uint8_t algorithm,
1452 uint8_t flags,
1453 uint16_t iterations,
1454 uint8_t salt_length,
1455 uint8_t *salt)
1456{
1457 return ldns_dnssec_zone_sign_nsec3_flg_mkmap(zone, new_rrs, key_list,
1458 func, arg, algorithm, flags, iterations, salt_length, salt, 0,
1459 NULL);
1460}
1461
1462ldns_status
1463ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone,
1464 ldns_rr_list *new_rrs,
1465 ldns_key_list *key_list,
1466 int (*func)(ldns_rr *, void *),
1467 void *arg,
1468 uint8_t algorithm,
1469 uint8_t flags,
1470 uint16_t iterations,
1471 uint8_t salt_length,
1472 uint8_t *salt,
1473 int signflags,
1474 ldns_rbtree_t **map)
1475{
1476 ldns_rr *nsec3, *nsec3param;
1477 ldns_status result = LDNS_STATUS_OK;
1478 bool zonemd_added = false;
1479 ldns_dnssec_rrsets zonemd_rrset;
1480
1481 /* zone is already sorted */
1482 result = ldns_dnssec_zone_mark_glue(zone);
1483 if (result != LDNS_STATUS_OK) {
1484 return result;
1485 }
1486
1487 /* TODO if there are already nsec3s presents and their
1488 * parameters are the same as these, we don't have to recreate
1489 */
1490 if (zone->names) {
1491 /* add empty nonterminals */
1492 result = ldns_dnssec_zone_add_empty_nonterminals(zone);
1493 if (result != LDNS_STATUS_OK) {
1494 return result;
1495 }
1496
1497 nsec3 = ((ldns_dnssec_name *)zone->names->root->data)->nsec;
1498
1499 /* check whether we need to add nsecs */
1500 if ((signflags & LDNS_SIGN_NO_KEYS_NO_NSECS)
1501 && ldns_key_list_key_count(key_list) < 1)
1502 ; /* pass */
1503
1504 else if (nsec3 && ldns_rr_get_type(nsec3) == LDNS_RR_TYPE_NSEC3) {
1505 /* no need to recreate */
1506 } else {
1507 if (!ldns_dnssec_zone_find_rrset(zone,
1508 zone->soa->name,
1509 LDNS_RR_TYPE_NSEC3PARAM)) {
1510 /* create and add the nsec3param rr */
1511 nsec3param =
1512 ldns_rr_new_frm_type(LDNS_RR_TYPE_NSEC3PARAM);
1513 ldns_rr_set_owner(nsec3param,
1514 ldns_rdf_clone(zone->soa->name));
1515 ldns_nsec3_add_param_rdfs(nsec3param,
1516 algorithm,
1517 flags,
1518 iterations,
1519 salt_length,
1520 salt);
1521 /* always set bit 7 of the flags to zero, according to
1522 * rfc5155 section 11. The bits are counted from right to left,
1523 * so bit 7 in rfc5155 is bit 0 in ldns */
1524 ldns_set_bit(ldns_rdf_data(ldns_rr_rdf(nsec3param, 1)), 0, 0);
1525 result = ldns_dnssec_zone_add_rr(zone, nsec3param);
1526 if (result != LDNS_STATUS_OK) {
1527 return result;
1528 }
1529 ldns_rr_list_push_rr(new_rrs, nsec3param);
1530 }
1531 if (signflags & LDNS_SIGN_WITH_ZONEMD) {
1532 ldns_dnssec_rrsets **rrsets_ref
1533 = &zone->soa->rrsets;
1534
1535 while (*rrsets_ref
1536 && (*rrsets_ref)->type < LDNS_RR_TYPE_ZONEMD)
1537 rrsets_ref = &(*rrsets_ref)->next;
1538 if (!*rrsets_ref
1539 || (*rrsets_ref)->type > LDNS_RR_TYPE_ZONEMD) {
1540 zonemd_rrset.rrs = NULL;
1541 zonemd_rrset.type = LDNS_RR_TYPE_ZONEMD;
1542 zonemd_rrset.signatures = NULL;
1543 zonemd_rrset.next = *rrsets_ref;
1544 *rrsets_ref = &zonemd_rrset;
1545 zonemd_added = true;
1546 }
1547 }
1548 result = ldns_dnssec_zone_create_nsec3s_mkmap(zone,
1549 new_rrs,
1550 algorithm,
1551 flags,
1552 iterations,
1553 salt_length,
1554 salt,
1555 map);
1556 if (zonemd_added) {
1557 ldns_dnssec_rrsets **rrsets_ref
1558 = &zone->soa->rrsets;
1559
1560 while (*rrsets_ref
1561 && (*rrsets_ref)->type < LDNS_RR_TYPE_ZONEMD)
1562 rrsets_ref = &(*rrsets_ref)->next;
1563 *rrsets_ref = zonemd_rrset.next;
1564 }
1565 if (result != LDNS_STATUS_OK) {
1566 return result;
1567 }
1568 }
1569
1570 result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1571 new_rrs,
1572 key_list,
1573 func,
1574 arg,
1575 signflags);
1576 }
1577 if (result || !zone->names)
1578 return result;
1579
1580 return signflags & LDNS_SIGN_WITH_ZONEMD
1581 ? dnssec_zone_equip_zonemd(zone, new_rrs, key_list, signflags)
1582 : result;
1583}
1584
1585ldns_status
1586ldns_dnssec_zone_sign_nsec3_flg(ldns_dnssec_zone *zone,
1587 ldns_rr_list *new_rrs,
1588 ldns_key_list *key_list,
1589 int (*func)(ldns_rr *, void *),
1590 void *arg,
1591 uint8_t algorithm,
1592 uint8_t flags,
1593 uint16_t iterations,
1594 uint8_t salt_length,
1595 uint8_t *salt,
1596 int signflags)
1597{
1598 return ldns_dnssec_zone_sign_nsec3_flg_mkmap(zone, new_rrs, key_list,
1599 func, arg, algorithm, flags, iterations, salt_length, salt,
1600 signflags, NULL);
1601}
1602
1603ldns_zone *
1604ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
1605{
1606 ldns_dnssec_zone *dnssec_zone;
1607 ldns_zone *signed_zone;
1608 ldns_rr_list *new_rrs;
1609 size_t i;
1610
1611 signed_zone = ldns_zone_new();
1612 dnssec_zone = ldns_dnssec_zone_new();
1613
1614 (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1615 ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1616
1617 for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1618 (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1619 ldns_rr_list_rr(ldns_zone_rrs(zone),
1620 i));
1621 ldns_zone_push_rr(signed_zone,
1622 ldns_rr_clone(ldns_rr_list_rr(ldns_zone_rrs(zone),
1623 i)));
1624 }
1625
1626 new_rrs = ldns_rr_list_new();
1627 (void) ldns_dnssec_zone_sign(dnssec_zone,
1628 new_rrs,
1629 key_list,
1630 ldns_dnssec_default_replace_signatures,
1631 NULL);
1632
1633 for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1634 ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1635 ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1636 }
1637
1638 ldns_rr_list_deep_free(new_rrs);
1639 ldns_dnssec_zone_free(dnssec_zone);
1640
1641 return signed_zone;
1642}
1643
1644ldns_zone *
1645ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
1646{
1647 ldns_dnssec_zone *dnssec_zone;
1648 ldns_zone *signed_zone;
1649 ldns_rr_list *new_rrs;
1650 size_t i;
1651
1652 signed_zone = ldns_zone_new();
1653 dnssec_zone = ldns_dnssec_zone_new();
1654
1655 (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1656 ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1657
1658 for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1659 (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1660 ldns_rr_list_rr(ldns_zone_rrs(zone),
1661 i));
1662 ldns_zone_push_rr(signed_zone,
1663 ldns_rr_clone(ldns_rr_list_rr(ldns_zone_rrs(zone),
1664 i)));
1665 }
1666
1667 new_rrs = ldns_rr_list_new();
1668 (void) ldns_dnssec_zone_sign_nsec3(dnssec_zone,
1669 new_rrs,
1670 key_list,
1671 ldns_dnssec_default_replace_signatures,
1672 NULL,
1673 algorithm,
1674 flags,
1675 iterations,
1676 salt_length,
1677 salt);
1678
1679 for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1680 ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1681 ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1682 }
1683
1684 ldns_rr_list_deep_free(new_rrs);
1685 ldns_dnssec_zone_free(dnssec_zone);
1686
1687 return signed_zone;
1688}
1689#endif /* HAVE_SSL */
1690
1691
ldns_buffer_free
void ldns_buffer_free(ldns_buffer *buffer)
frees the buffer.
Definition buffer.c:137
ldns_buffer_new
ldns_buffer * ldns_buffer_new(size_t capacity)
creates a new buffer with the specified capacity.
Definition buffer.c:16
ATTR_UNUSED
#define ATTR_UNUSED(x)
Definition common.h:72
HAVE_EVP_PKEY_GET_BASE_ID
#define HAVE_EVP_PKEY_GET_BASE_ID
Definition config.h:132
HAVE_EVP_PKEY_BASE_ID
#define HAVE_EVP_PKEY_BASE_ID
Definition config.h:129
ldns_dname_compare_v
int ldns_dname_compare_v(const void *a, const void *b)
Given in dnssec_zone.c, also used in dnssec_sign.c:w.
Definition dnssec_zone.c:906
ldns_dname_is_wildcard
int ldns_dname_is_wildcard(const ldns_rdf *dname)
Check if dname is a wildcard, starts with *.
Definition dname.c:456
ldns_dname_is_subdomain
signed char ldns_dname_is_subdomain(const ldns_rdf *sub, const ldns_rdf *parent)
test whether the name sub falls under parent (i.e.
Definition dname.c:296
ldns_dname2canonical
void ldns_dname2canonical(const ldns_rdf *rdf)
Put a dname into canonical fmt - ie.
Definition dname.c:280
ldns_dname_label
ldns_rdf * ldns_dname_label(const ldns_rdf *rdf, uint8_t labelpos)
look inside the rdf and if it is an LDNS_RDF_TYPE_DNAME try and retrieve a specific label.
Definition dname.c:560
ldns_dname_label_count
uint8_t ldns_dname_label_count(const ldns_rdf *r)
count the number of labels inside a LDNS_RDF_DNAME type rdf.
Definition dname.c:214
dnssec.h
This module contains base functions for DNSSEC operations (RFC4033 t/m RFC4035).
ldns_dnssec_create_nsec3
ldns_rr * ldns_dnssec_create_nsec3(const ldns_dnssec_name *from, const ldns_dnssec_name *to, const ldns_rdf *zone_name, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t *salt)
Creates NSEC3.
Definition dnssec.c:869
LDNS_DEFAULT_EXP_TIME
#define LDNS_DEFAULT_EXP_TIME
Definition dnssec.h:44
ldns_nsec3_add_param_rdfs
void ldns_nsec3_add_param_rdfs(ldns_rr *rr, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t *salt)
Sets all the NSEC3 options.
Definition dnssec.c:1107
LDNS_SIGNATURE_LEAVE_ADD_NEW
#define LDNS_SIGNATURE_LEAVE_ADD_NEW
return values for the old-signature callback
Definition dnssec.h:47
LDNS_SIGNATURE_REMOVE_NO_ADD
#define LDNS_SIGNATURE_REMOVE_NO_ADD
Definition dnssec.h:50
ldns_dnssec_default_replace_signatures
int ldns_dnssec_default_replace_signatures(ldns_rr *sig, void *n)
Default callback function to always leave present signatures, and add new ones.
ldns_dnssec_chain_nsec3_list
ldns_status ldns_dnssec_chain_nsec3_list(ldns_rr_list *nsec3_rrs)
chains nsec3 list
Definition dnssec.c:1634
LDNS_SIGNATURE_REMOVE_ADD_NEW
#define LDNS_SIGNATURE_REMOVE_ADD_NEW
Definition dnssec.h:49
ldns_convert_ecdsa_rrsig_asn1len2rdf
ldns_rdf * ldns_convert_ecdsa_rrsig_asn1len2rdf(const ldns_buffer *sig, const long sig_len, int num_bytes)
Converts the ECDSA signature from ASN1 representation (as used by OpenSSL) to raw signature data as u...
Definition dnssec.c:1871
ldns_dnssec_create_nsec
ldns_rr * ldns_dnssec_create_nsec(const ldns_dnssec_name *from, const ldns_dnssec_name *to, ldns_rr_type nsec_type)
Creates NSEC.
Definition dnssec.c:815
ldns_dnssec_rrsets_contains_type
int ldns_dnssec_rrsets_contains_type(const ldns_dnssec_rrsets *rrsets, ldns_rr_type type)
returns whether a rrset of the given type is found in the rrsets.
Definition dnssec.c:801
LDNS_SIGNATURE_LEAVE_NO_ADD
#define LDNS_SIGNATURE_LEAVE_NO_ADD
Definition dnssec.h:48
ldns_convert_dsa_rrsig_asn12rdf
ldns_rdf * ldns_convert_dsa_rrsig_asn12rdf(const ldns_buffer *sig, const long sig_len)
Converts the DSA signature from ASN1 representation (RFC2459, as used by OpenSSL) to raw signature da...
Definition dnssec.c:1746
ldns_sign_public_evp
ldns_rdf * ldns_sign_public_evp(ldns_buffer *to_sign, EVP_PKEY *key, const EVP_MD *digest_type)
Sign data with EVP (general method for different algorithms)
Definition dnssec_sign.c:444
ldns_dnssec_remove_signatures
ldns_dnssec_rrs * ldns_dnssec_remove_signatures(ldns_dnssec_rrs *signatures, ldns_key_list *key_list __attribute__((unused)), int(*func)(ldns_rr *, void *), void *arg)
Definition dnssec_sign.c:1022
ldns_sign_public
ldns_rr_list * ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
use this function to sign with a public/private key alg return the created signatures
Definition dnssec_sign.c:227
LDNS_SIGN_WITH_ZONEMD
#define LDNS_SIGN_WITH_ZONEMD
Definition dnssec_sign.c:27
ldns_zone_sign
ldns_zone * ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
Signs the zone, and returns a newly allocated signed zone.
Definition dnssec_sign.c:1604
ldns_zone_sign_nsec3
ldns_zone * ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Signs the zone with NSEC3, and returns a newly allocated signed zone.
Definition dnssec_sign.c:1645
ldns_dnssec_zone_mark_glue
ldns_status ldns_dnssec_zone_mark_glue(ldns_dnssec_zone *zone)
Marks the names in the zone that are occluded.
Definition dnssec_sign.c:754
ldns_dnssec_zone_mark_and_get_glue
ldns_status ldns_dnssec_zone_mark_and_get_glue(ldns_dnssec_zone *zone, ldns_rr_list *glue_list)
Marks the names in the zone that are occluded.
Definition dnssec_sign.c:675
ldns_create_empty_rrsig
ldns_rr * ldns_create_empty_rrsig(const ldns_rr_list *rrset, const ldns_key *current_key)
Create an empty RRSIG RR (i.e.
Definition dnssec_sign.c:31
ldns_dnssec_zone_create_nsec3s
ldns_status ldns_dnssec_zone_create_nsec3s(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Adds NSEC3 records to the zone.
Definition dnssec_sign.c:1007
ldns_dnssec_zone_sign
ldns_status ldns_dnssec_zone_sign(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg)
signs the given zone with the given keys
Definition dnssec_sign.c:1364
dnssec_zone_equip_zonemd
ldns_status dnssec_zone_equip_zonemd(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int flags)
Definition dnssec_zone.c:1917
ldns_dnssec_zone_sign_nsec3_flg
ldns_status ldns_dnssec_zone_sign_nsec3_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags)
signs the given zone with the given new zone, with NSEC3
Definition dnssec_sign.c:1586
ldns_sign_public_rsasha1
ldns_rdf * ldns_sign_public_rsasha1(ldns_buffer *to_sign, RSA *key)
Sign a buffer with the RSA key (hash with SHA1)
Definition dnssec_sign.c:573
ldns_dnssec_zone_create_rrsigs
ldns_status ldns_dnssec_zone_create_rrsigs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg)
Adds signatures to the zone.
Definition dnssec_sign.c:1113
ldns_sign_public_rsamd5
ldns_rdf * ldns_sign_public_rsamd5(ldns_buffer *to_sign, RSA *key)
Sign a buffer with the RSA key (hash with MD5)
Definition dnssec_sign.c:610
ldns_dnssec_zone_sign_nsec3_flg_mkmap
ldns_status ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags, ldns_rbtree_t **map)
signs the given zone with the given new zone, with NSEC3
Definition dnssec_sign.c:1463
ldns_dnssec_name_node_next_nonglue
ldns_rbnode_t * ldns_dnssec_name_node_next_nonglue(ldns_rbnode_t *node)
Finds the first dnssec_name node in the rbtree that is not occluded.
Definition dnssec_sign.c:760
ldns_dnssec_zone_sign_flg
ldns_status ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
signs the given zone with the given keys
Definition dnssec_sign.c:1376
ldns_sign_public_dsa
ldns_rdf * ldns_sign_public_dsa(ldns_buffer *to_sign, DSA *key)
Sign a buffer with the DSA key (hash with SHA1)
Definition dnssec_sign.c:332
ldns_sign_public_buffer
ldns_rdf * ldns_sign_public_buffer(ldns_buffer *sign_buf, ldns_key *current_key)
Sign the buffer which contains the wiredata of an rrset, and the corresponding empty rrsig rr with th...
Definition dnssec_sign.c:128
ldns_dnssec_zone_create_nsecs
ldns_status ldns_dnssec_zone_create_nsecs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs)
Adds NSEC records to the given dnssec_zone.
Definition dnssec_sign.c:786
ldns_dnssec_zone_sign_nsec3
ldns_status ldns_dnssec_zone_sign_nsec3(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
signs the given zone with the given new zone, with NSEC3
Definition dnssec_sign.c:1446
ldns_dnssec_zone_create_rrsigs_flg
ldns_status ldns_dnssec_zone_create_rrsigs_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
Adds signatures to the zone.
Definition dnssec_sign.c:1218
dnssec_sign.h
LDNS_SIGN_DNSKEY_WITH_ZSK
#define LDNS_SIGN_DNSKEY_WITH_ZSK
dnssec_verify
Definition dnssec_sign.h:15
LDNS_SIGN_WITH_ALL_ALGORITHMS
#define LDNS_SIGN_WITH_ALL_ALGORITHMS
Definition dnssec_sign.h:16
LDNS_SIGN_NO_KEYS_NO_NSECS
#define LDNS_SIGN_NO_KEYS_NO_NSECS
Definition dnssec_sign.h:17
ldns_dnssec_zone_new
ldns_dnssec_zone * ldns_dnssec_zone_new(void)
Creates a new dnssec_zone structure.
Definition dnssec_zone.c:570
ldns_dnssec_name_name
ldns_rdf * ldns_dnssec_name_name(const ldns_dnssec_name *name)
Returns the domain name of the given dnssec_name structure.
Definition dnssec_zone.c:395
ldns_dnssec_rrs_new
ldns_dnssec_rrs * ldns_dnssec_rrs_new(void)
Creates a new entry for 1 pointer to an rr and 1 pointer to the next rrs.
Definition dnssec_zone.c:10
ldns_dnssec_rrs_add_rr
ldns_status ldns_dnssec_rrs_add_rr(ldns_dnssec_rrs *rrs, ldns_rr *rr)
Adds an RR to the list of RRs.
Definition dnssec_zone.c:47
ldns_dnssec_zone_find_rrset
ldns_dnssec_rrsets * ldns_dnssec_zone_find_rrset(const ldns_dnssec_zone *zone, const ldns_rdf *dname, ldns_rr_type type)
Find the RRset with the given name and type in the zone.
Definition dnssec_zone.c:509
ldns_dnssec_name_find_rrset
ldns_dnssec_rrsets * ldns_dnssec_name_find_rrset(const ldns_dnssec_name *name, ldns_rr_type type)
Find the RRset with the given type in within this name structure.
Definition dnssec_zone.c:493
ldns_dnssec_name_add_rr
ldns_status ldns_dnssec_name_add_rr(ldns_dnssec_name *name, ldns_rr *rr)
Inserts the given rr at the right place in the current dnssec_name No checking is done whether the na...
Definition dnssec_zone.c:449
ldns_dnssec_zone_add_rr
ldns_status ldns_dnssec_zone_add_rr(ldns_dnssec_zone *zone, ldns_rr *rr)
Adds the given RR to the zone.
Definition dnssec_zone.c:1002
ldns_dnssec_zone_add_empty_nonterminals
ldns_status ldns_dnssec_zone_add_empty_nonterminals(ldns_dnssec_zone *zone)
Adds explicit dnssec_name structures for the empty nonterminals in this zone.
Definition dnssec_zone.c:1254
ldns_dnssec_zone_free
void ldns_dnssec_zone_free(ldns_dnssec_zone *zone)
Frees the given zone structure, and its rbtree of dnssec_names Individual ldns_rr RRs within those na...
Definition dnssec_zone.c:865
LDNS_STATUS_NSEC3_DOMAINNAME_OVERFLOW
@ LDNS_STATUS_NSEC3_DOMAINNAME_OVERFLOW
Definition error.h:131
LDNS_STATUS_NULL
@ LDNS_STATUS_NULL
Definition error.h:51
LDNS_STATUS_ERR
@ LDNS_STATUS_ERR
Definition error.h:37
LDNS_STATUS_MEM_ERR
@ LDNS_STATUS_MEM_ERR
Definition error.h:34
LDNS_STATUS_OK
@ LDNS_STATUS_OK
Definition error.h:26
ldns_status
enum ldns_enum_status ldns_status
Definition error.h:148
ldns_rrsig2buffer_wire
ldns_status ldns_rrsig2buffer_wire(ldns_buffer *output, const ldns_rr *sigrr)
Converts a rrsig to wireformat BUT EXCLUDE the rrsig rdata This is needed in DNSSEC verification.
Definition host2wire.c:294
ldns_rr_list2buffer_wire
ldns_status ldns_rr_list2buffer_wire(ldns_buffer *output, const ldns_rr_list *rrlist)
Copies the rr_list data to the buffer in wire format.
Definition host2wire.c:156
ldns_key_expiration
uint32_t ldns_key_expiration(const ldns_key *k)
return the key's expiration date
Definition keys.c:1565
ldns_key_list_set_use
void ldns_key_list_set_use(ldns_key_list *keys, signed char v)
Set the 'use' flag for all keys in the list.
Definition keys.c:1584
ldns_key_set_use
void ldns_key_set_use(ldns_key *k, signed char v)
set the use flag
Definition keys.c:1469
LDNS_KEY_SEP_KEY
#define LDNS_KEY_SEP_KEY
Definition keys.h:38
ldns_key_evp_key
EVP_PKEY * ldns_key_evp_key(const ldns_key *k)
returns the (openssl) EVP struct contained in the key
Definition keys.c:1488
ldns_signing_algorithm
enum ldns_enum_signing_algorithm ldns_signing_algorithm
Definition keys.h:110
ldns_key_list_key
ldns_key * ldns_key_list_key(const ldns_key_list *key, size_t nr)
returns a pointer to the key in the list at the given position
Definition keys.c:1453
ldns_key_keytag
uint16_t ldns_key_keytag(const ldns_key *k)
return the keytag
Definition keys.c:1571
ldns_key_algorithm
ldns_signing_algorithm ldns_key_algorithm(const ldns_key *k)
return the signing alg of the key
Definition keys.c:1463
ldns_key2rr
ldns_rr * ldns_key2rr(const ldns_key *k)
converts a ldns_key to a public key rr If the key data exists at an external point,...
Definition keys.c:1803
LDNS_SIGN_RSASHA1
@ LDNS_SIGN_RSASHA1
Definition keys.h:84
LDNS_SIGN_ECDSAP256SHA256
@ LDNS_SIGN_ECDSAP256SHA256
Definition keys.h:95
LDNS_SIGN_DSA_NSEC3
@ LDNS_SIGN_DSA_NSEC3
Definition keys.h:92
LDNS_SIGN_ECC_GOST
@ LDNS_SIGN_ECC_GOST
Definition keys.h:94
LDNS_SIGN_ED448
@ LDNS_SIGN_ED448
Definition keys.h:101
LDNS_SIGN_ED25519
@ LDNS_SIGN_ED25519
Definition keys.h:98
LDNS_SIGN_RSASHA1_NSEC3
@ LDNS_SIGN_RSASHA1_NSEC3
Definition keys.h:88
LDNS_SIGN_ECDSAP384SHA384
@ LDNS_SIGN_ECDSAP384SHA384
Definition keys.h:96
LDNS_SIGN_RSAMD5
@ LDNS_SIGN_RSAMD5
Definition keys.h:83
LDNS_SIGN_RSASHA512
@ LDNS_SIGN_RSASHA512
Definition keys.h:90
LDNS_SIGN_DSA
@ LDNS_SIGN_DSA
Definition keys.h:86
LDNS_SIGN_RSASHA256
@ LDNS_SIGN_RSASHA256
Definition keys.h:89
ldns_key_inception
uint32_t ldns_key_inception(const ldns_key *k)
return the key's inception date
Definition keys.c:1559
ldns_key_pubkey_owner
ldns_rdf * ldns_key_pubkey_owner(const ldns_key *k)
return the public key's owner
Definition keys.c:1577
ldns_key_use
signed char ldns_key_use(const ldns_key *k)
return the use flag
Definition keys.c:1477
ldns_key_flags
uint16_t ldns_key_flags(const ldns_key *k)
return the flag of the key
Definition keys.c:1553
LDNS_KEY_ZONE_KEY
#define LDNS_KEY_ZONE_KEY
Definition keys.h:37
ldns_key_list_key_count
size_t ldns_key_list_key_count(const ldns_key_list *key_list)
returns the number of keys in the key list
Definition keys.c:1447
ldns.h
Including this file will include all ldns files, and define some lookup tables.
LDNS_DEFAULT_TTL
#define LDNS_DEFAULT_TTL
Definition ldns.h:136
LDNS_MAX_PACKETLEN
#define LDNS_MAX_PACKETLEN
Definition packet.h:24
ldns_traverse_postorder
void ldns_traverse_postorder(ldns_rbtree_t *tree, void(*func)(ldns_rbnode_t *, void *), void *arg)
Call function for all elements in the redblack tree, such that leaf elements are called before parent...
Definition rbtree.c:666
ldns_rbtree_first
ldns_rbnode_t * ldns_rbtree_first(const ldns_rbtree_t *rbtree)
Returns first (smallest) node in the tree.
Definition rbtree.c:548
ldns_rbtree_next
ldns_rbnode_t * ldns_rbtree_next(ldns_rbnode_t *rbtree)
Returns next larger node in the tree.
Definition rbtree.c:574
ldns_rbtree_insert
ldns_rbnode_t * ldns_rbtree_insert(ldns_rbtree_t *rbtree, ldns_rbnode_t *data)
Insert data into the tree.
Definition rbtree.c:242
LDNS_RBTREE_NULL
#define LDNS_RBTREE_NULL
The nullpointer, points to empty node.
Definition rbtree.h:76
ldns_rbtree_create
ldns_rbtree_t * ldns_rbtree_create(int(*cmpf)(const void *, const void *))
Create new tree (malloced) with given key compare function.
Definition rbtree.c:80
ldns_rdf_data
uint8_t * ldns_rdf_data(const ldns_rdf *rd)
returns the data of the rdf.
Definition rdata.c:38
ldns_rdf_clone
ldns_rdf * ldns_rdf_clone(const ldns_rdf *rd)
clones a rdf structure.
Definition rdata.c:222
ldns_rdf_new_frm_data
ldns_rdf * ldns_rdf_new_frm_data(ldns_rdf_type type, size_t size, const void *data)
allocates a new rdf structure and fills it.
Definition rdata.c:193
ldns_rdf_deep_free
void ldns_rdf_deep_free(ldns_rdf *rd)
frees a rdf structure and frees the data.
Definition rdata.c:230
ldns_rdf2native_int32
uint32_t ldns_rdf2native_int32(const ldns_rdf *rd)
returns the native uint32_t representation from the rdf.
Definition rdata.c:98
ldns_rdf2native_int16
uint16_t ldns_rdf2native_int16(const ldns_rdf *rd)
returns the native uint16_t representation from the rdf.
Definition rdata.c:84
ldns_native2rdf_int16
ldns_rdf * ldns_native2rdf_int16(ldns_rdf_type type, uint16_t value)
returns the rdf containing the native uint16_t representation.
Definition rdata.c:132
ldns_native2rdf_int8
ldns_rdf * ldns_native2rdf_int8(ldns_rdf_type type, uint8_t value)
returns the rdf containing the native uint8_t repr.
Definition rdata.c:126
LDNS_RDF_TYPE_INT32
@ LDNS_RDF_TYPE_INT32
32 bits
Definition rdata.h:56
LDNS_RDF_TYPE_B64
@ LDNS_RDF_TYPE_B64
b64 string
Definition rdata.h:68
LDNS_RDF_TYPE_TIME
@ LDNS_RDF_TYPE_TIME
time (32 bits)
Definition rdata.h:84
LDNS_RDF_TYPE_INT8
@ LDNS_RDF_TYPE_INT8
8 bits
Definition rdata.h:52
LDNS_RDF_TYPE_INT16
@ LDNS_RDF_TYPE_INT16
16 bits
Definition rdata.h:54
LDNS_RDF_TYPE_ALG
@ LDNS_RDF_TYPE_ALG
a key algorithm
Definition rdata.h:80
LDNS_RDF_TYPE_TYPE
@ LDNS_RDF_TYPE_TYPE
a RR type
Definition rdata.h:74
ldns_native2rdf_int32
ldns_rdf * ldns_native2rdf_int32(ldns_rdf_type type, uint32_t value)
returns an rdf that contains the given int32 value.
Definition rdata.c:147
ldns_rdf_size
size_t ldns_rdf_size(const ldns_rdf *rd)
returns the size of the rdf.
Definition rdata.c:24
ldns_rdf_free
void ldns_rdf_free(ldns_rdf *rd)
frees a rdf structure, leaving the data pointer intact.
Definition rdata.c:241
ldns_rr_list_free
void ldns_rr_list_free(ldns_rr_list *rr_list)
frees an rr_list structure.
Definition rr.c:1015
ldns_rr_ttl
uint32_t ldns_rr_ttl(const ldns_rr *rr)
returns the ttl of an rr structure.
Definition rr.c:935
ldns_rr_pop_rdf
ldns_rdf * ldns_rr_pop_rdf(ldns_rr *rr)
removes a rd_field member, it will be popped from the last position.
Definition rr.c:884
ldns_rr_list_deep_free
void ldns_rr_list_deep_free(ldns_rr_list *rr_list)
frees an rr_list structure and all rrs contained therein.
Definition rr.c:1024
ldns_rr_free
void ldns_rr_free(ldns_rr *rr)
frees an RR structure
Definition rr.c:81
ldns_rr_set_owner
void ldns_rr_set_owner(ldns_rr *rr, ldns_rdf *owner)
sets the owner in the rr structure.
Definition rr.c:808
ldns_rr_list_new
ldns_rr_list * ldns_rr_list_new(void)
creates a new rr_list structure.
Definition rr.c:1004
ldns_rr_list_type
ldns_rr_type ldns_rr_list_type(const ldns_rr_list *rr_list)
Returns the type of the first element of the RR If there are no elements present, 0 is returned.
Definition rr.c:2779
ldns_rr_list_sort
void ldns_rr_list_sort(ldns_rr_list *unsorted)
sorts an rr_list (canonical wire format).
Definition rr.c:1520
ldns_rr_new_frm_type
ldns_rr * ldns_rr_new_frm_type(ldns_rr_type t)
creates a new rr structure, based on the given type.
Definition rr.c:48
LDNS_RR_TYPE_RRSIG
@ LDNS_RR_TYPE_RRSIG
DNSSEC.
Definition rr.h:170
LDNS_RR_TYPE_A
@ LDNS_RR_TYPE_A
a host address
Definition rr.h:80
LDNS_RR_TYPE_ZONEMD
@ LDNS_RR_TYPE_ZONEMD
Definition rr.h:194
LDNS_RR_TYPE_DNSKEY
@ LDNS_RR_TYPE_DNSKEY
Definition rr.h:172
LDNS_RR_TYPE_SOA
@ LDNS_RR_TYPE_SOA
marks the start of a zone of authority
Definition rr.h:90
LDNS_RR_TYPE_NSEC
@ LDNS_RR_TYPE_NSEC
Definition rr.h:171
LDNS_RR_TYPE_DNAME
@ LDNS_RR_TYPE_DNAME
RFC2672.
Definition rr.h:156
LDNS_RR_TYPE_DS
@ LDNS_RR_TYPE_DS
RFC4034, RFC3658.
Definition rr.h:164
LDNS_RR_TYPE_NSEC3PARAM
@ LDNS_RR_TYPE_NSEC3PARAM
Definition rr.h:177
LDNS_RR_TYPE_NSEC3
@ LDNS_RR_TYPE_NSEC3
Definition rr.h:176
LDNS_RR_TYPE_CDNSKEY
@ LDNS_RR_TYPE_CDNSKEY
Definition rr.h:191
LDNS_RR_TYPE_AAAA
@ LDNS_RR_TYPE_AAAA
ipv6 address
Definition rr.h:134
LDNS_RR_TYPE_NS
@ LDNS_RR_TYPE_NS
an authoritative name server
Definition rr.h:82
LDNS_RR_TYPE_CDS
@ LDNS_RR_TYPE_CDS
Definition rr.h:190
ldns_rr_list_push_rr
signed char ldns_rr_list_push_rr(ldns_rr_list *rr_list, const ldns_rr *rr)
pushes an rr to an rrlist.
Definition rr.c:1136
ldns_rr2canonical
void ldns_rr2canonical(ldns_rr *rr)
converts each dname in a rr to its canonical form.
Definition rr.c:1785
ldns_rr_rdf
ldns_rdf * ldns_rr_rdf(const ldns_rr *rr, size_t nr)
returns the rdata field member counter.
Definition rr.c:913
ldns_rr_list_rr_count
size_t ldns_rr_list_rr_count(const ldns_rr_list *rr_list)
returns the number of rr's in an rr_list.
Definition rr.c:961
ldns_rr_get_type
ldns_rr_type ldns_rr_get_type(const ldns_rr *rr)
returns the type of the rr.
Definition rr.c:947
ldns_rr_set_ttl
void ldns_rr_set_ttl(ldns_rr *rr, uint32_t ttl)
sets the ttl in the rr structure.
Definition rr.c:820
ldns_rr_clone
ldns_rr * ldns_rr_clone(const ldns_rr *rr)
clones a rr and all its data
Definition rr.c:1404
ldns_rr_get_class
ldns_rr_class ldns_rr_get_class(const ldns_rr *rr)
returns the class of the rr.
Definition rr.c:953
ldns_rr_class
enum ldns_enum_rr_class ldns_rr_class
Definition rr.h:61
ldns_rr_list_rr
ldns_rr * ldns_rr_list_rr(const ldns_rr_list *rr_list, size_t nr)
returns a specific rr of an rrlist.
Definition rr.c:994
ldns_rr_set_class
void ldns_rr_set_class(ldns_rr *rr, ldns_rr_class rr_class)
sets the class in the rr.
Definition rr.c:838
ldns_rr_list_clone
ldns_rr_list * ldns_rr_list_clone(const ldns_rr_list *rrlist)
clones an rrlist.
Definition rr.c:1435
ldns_rr_owner
ldns_rdf * ldns_rr_owner(const ldns_rr *rr)
returns the owner name of an rr structure.
Definition rr.c:923
ldns_rr_rrsig_set_expiration
bool ldns_rr_rrsig_set_expiration(ldns_rr *r, ldns_rdf *f)
sets the expiration date of a LDNS_RR_TYPE_RRSIG rr
Definition rr_functions.c:165
ldns_rr_rrsig_set_keytag
bool ldns_rr_rrsig_set_keytag(ldns_rr *r, ldns_rdf *f)
sets the keytag of a LDNS_RR_TYPE_RRSIG rr
Definition rr_functions.c:189
ldns_rr_rrsig_set_algorithm
bool ldns_rr_rrsig_set_algorithm(ldns_rr *r, ldns_rdf *f)
sets the algorithm of a LDNS_RR_TYPE_RRSIG rr
Definition rr_functions.c:129
ldns_rr_rrsig_set_typecovered
bool ldns_rr_rrsig_set_typecovered(ldns_rr *r, ldns_rdf *f)
sets the typecovered of a LDNS_RR_TYPE_RRSIG rr
Definition rr_functions.c:117
ldns_rr_rrsig_set_labels
bool ldns_rr_rrsig_set_labels(ldns_rr *r, ldns_rdf *f)
sets the number of labels of a LDNS_RR_TYPE_RRSIG rr
Definition rr_functions.c:141
ldns_rr_rrsig_set_inception
bool ldns_rr_rrsig_set_inception(ldns_rr *r, ldns_rdf *f)
sets the inception date of a LDNS_RR_TYPE_RRSIG rr
Definition rr_functions.c:177
ldns_rr_rrsig_set_signame
bool ldns_rr_rrsig_set_signame(ldns_rr *r, ldns_rdf *f)
sets the signers name of a LDNS_RR_TYPE_RRSIG rr
Definition rr_functions.c:201
ldns_rr_rrsig_keytag
ldns_rdf * ldns_rr_rrsig_keytag(const ldns_rr *r)
returns the keytag of a LDNS_RR_TYPE_RRSIG RR
Definition rr_functions.c:183
ldns_rr_rrsig_set_sig
bool ldns_rr_rrsig_set_sig(ldns_rr *r, ldns_rdf *f)
sets the signature data of a LDNS_RR_TYPE_RRSIG rr
Definition rr_functions.c:213
ldns_rr_rrsig_set_origttl
bool ldns_rr_rrsig_set_origttl(ldns_rr *r, ldns_rdf *f)
sets the original TTL of a LDNS_RR_TYPE_RRSIG rr
Definition rr_functions.c:153
R
#define R(b, x)
Definition sha2.c:191
ldns_rbnode_t
The rbnode_t struct definition.
Definition rbtree.h:60
ldns_rbnode_t::data
const void * data
pointer to data
Definition rbtree.h:70
ldns_rbnode_t::key
const void * key
pointer to sorting key
Definition rbtree.h:68
ldns_rbtree_t
definition for tree struct
Definition rbtree.h:83
ldns_rbtree_t::root
ldns_rbnode_t * root
The root of the red-black tree.
Definition rbtree.h:85
ldns_struct_buffer
implementation of buffers to ease operations
Definition buffer.h:51
ldns_struct_dnssec_name
Definition dnssec_zone.h:46
ldns_struct_dnssec_name::nsec_signatures
ldns_dnssec_rrs * nsec_signatures
signatures for the NSEC record
Definition dnssec_zone.h:71
ldns_struct_dnssec_name::nsec
ldns_rr * nsec
NSEC pointing to the next name (or NSEC3 pointing to the next NSEC3)
Definition dnssec_zone.h:67
ldns_struct_dnssec_name::hashed_name
ldns_rdf * hashed_name
pointer to store the hashed name (only used when in an NSEC3 zone
Definition dnssec_zone.h:85
ldns_struct_dnssec_name::rrsets
ldns_dnssec_rrsets * rrsets
The rrsets for this name.
Definition dnssec_zone.h:63
ldns_struct_dnssec_name::is_glue
signed char is_glue
Unlike what the name is_glue suggests, this field is set to true by ldns_dnssec_zone_mark_glue() or l...
Definition dnssec_zone.h:81
ldns_struct_dnssec_name::name
ldns_rdf * name
pointer to a dname containing the name.
Definition dnssec_zone.h:51
ldns_struct_dnssec_rrs
Definition dnssec_zone.h:23
ldns_struct_dnssec_rrs::rr
ldns_rr * rr
Definition dnssec_zone.h:24
ldns_struct_dnssec_rrs::next
ldns_dnssec_rrs * next
Definition dnssec_zone.h:25
ldns_struct_dnssec_rrsets
Definition dnssec_zone.h:33
ldns_struct_dnssec_rrsets::rrs
ldns_dnssec_rrs * rrs
Definition dnssec_zone.h:34
ldns_struct_dnssec_rrsets::type
ldns_rr_type type
Definition dnssec_zone.h:35
ldns_struct_dnssec_rrsets::signatures
ldns_dnssec_rrs * signatures
Definition dnssec_zone.h:36
ldns_struct_dnssec_rrsets::next
ldns_dnssec_rrsets * next
Definition dnssec_zone.h:37
ldns_struct_dnssec_zone
Structure containing a dnssec zone.
Definition dnssec_zone.h:91
ldns_struct_dnssec_zone::hashed_names
ldns_rbtree_t * hashed_names
tree of ldns_dnssec_names by nsec3 hashes (when applicable)
Definition dnssec_zone.h:97
ldns_struct_dnssec_zone::names
ldns_rbtree_t * names
tree of ldns_dnssec_names
Definition dnssec_zone.h:95
ldns_struct_dnssec_zone::soa
ldns_dnssec_name * soa
points to the name containing the SOA RR
Definition dnssec_zone.h:93
ldns_struct_key_list
Same as rr_list, but now for keys.
Definition keys.h:173
ldns_struct_key
General key structure, can contain all types of keys that are used in DNSSEC.
Definition keys.h:122
ldns_struct_rdf
Resource record data field.
Definition rdata.h:197
ldns_struct_rr_list
List or Set of Resource Records.
Definition rr.h:346
ldns_struct_rr
Resource Record.
Definition rr.h:318
ldns_struct_zone
DNS Zone.
Definition zone.h:43
LDNS_FREE
#define LDNS_FREE(ptr)
Definition util.h:60
LDNS_MALLOC
#define LDNS_MALLOC(type)
Memory management macros.
Definition util.h:49
ldns_set_bit
void ldns_set_bit(uint8_t *byte, int bit_nr, signed char value)
sets the specified bit in the specified byte to 1 if value is true, 0 if false The bits are counted f...
Definition util.c:72
LDNS_XMALLOC
#define LDNS_XMALLOC(type, count)
Definition util.h:51
ldns_zone_set_soa
void ldns_zone_set_soa(ldns_zone *z, ldns_rr *soa)
Set the zone's soa record.
Definition zone.c:29
ldns_zone_soa
ldns_rr * ldns_zone_soa(const ldns_zone *z)
Return the soa record of a zone.
Definition zone.c:17
ldns_zone_push_rr
signed char ldns_zone_push_rr(ldns_zone *z, ldns_rr *rr)
push an single rr to a zone structure.
Definition zone.c:53
ldns_zone_rrs
ldns_rr_list * ldns_zone_rrs(const ldns_zone *z)
Get a list of a zone's content.
Definition zone.c:35
ldns_zone_new
ldns_zone * ldns_zone_new(void)
create a new ldns_zone structure
Definition zone.c:165