dnssec.h
Go to the documentation of this file.
/*
* dnssec.h -- defines for the Domain Name System (SEC) (DNSSEC)
*
* Copyright (c) 2005-2008, NLnet Labs. All rights reserved.
*
* See LICENSE for the license.
*
* A bunch of defines that are used in the DNS
*/
#ifndef LDNS_DNSSEC_H
#define LDNS_DNSSEC_H
#include <ldns/common.h>
#if LDNS_BUILD_CONFIG_HAVE_SSL
#include <openssl/ssl.h>
#include <openssl/evp.h>
#endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
#include <ldns/packet.h>
#include <ldns/keys.h>
#include <ldns/zone.h>
#include <ldns/resolver.h>
#include <ldns/dnssec_zone.h>
#ifdef __cplusplus
extern "C" {
#endif
#define LDNS_MAX_KEYLEN 2048
#define LDNS_DNSSEC_KEYPROTO 3
/* default time before sigs expire */
#define LDNS_DEFAULT_EXP_TIME 2419200 /* 4 weeks */
#define LDNS_SIGNATURE_LEAVE_ADD_NEW 0
#define LDNS_SIGNATURE_LEAVE_NO_ADD 1
#define LDNS_SIGNATURE_REMOVE_ADD_NEW 2
#define LDNS_SIGNATURE_REMOVE_NO_ADD 3
ldns_rr *ldns_dnssec_get_rrsig_for_name_and_type(const ldns_rdf *name,
const ldns_rr_type type,
const ldns_rr_list *rrs);
ldns_rr *ldns_dnssec_get_dnskey_for_rrsig(const ldns_rr *rrsig, const ldns_rr_list *rrs);
ldns_rdf *ldns_nsec_get_bitmap(const ldns_rr *nsec);
#define LDNS_NSEC3_MAX_ITERATIONS 65535
ldns_rdf *
ldns_dnssec_nsec3_closest_encloser(const ldns_rdf *qname,
ldns_rr_type qtype,
const ldns_rr_list *nsec3s);
bool
ldns_dnssec_pkt_has_rrsigs(const ldns_pkt *pkt);
ldns_rr_list *ldns_dnssec_pkt_get_rrsigs_for_name_and_type(const ldns_pkt *pkt, const ldns_rdf *name, ldns_rr_type type);
ldns_rr_list *ldns_dnssec_pkt_get_rrsigs_for_type(const ldns_pkt *pkt, ldns_rr_type type);
uint16_t ldns_calc_keytag(const ldns_rr *key);
uint16_t ldns_calc_keytag_raw(const uint8_t* key, size_t keysize);
#if LDNS_BUILD_CONFIG_HAVE_SSL
DSA *ldns_key_buf2dsa(const ldns_buffer *key);
DSA *ldns_key_buf2dsa_raw(const unsigned char* key, size_t len);
int ldns_digest_evp(const unsigned char* data, unsigned int len,
unsigned char* dest, const EVP_MD* md);
EVP_PKEY* ldns_gost2pkey_raw(const unsigned char* key, size_t keylen);
EVP_PKEY* ldns_ecdsa2pkey_raw(const unsigned char* key, size_t keylen, uint8_t algo);
EVP_PKEY* ldns_ed255192pkey_raw(const unsigned char* key, size_t keylen);
EVP_PKEY* ldns_ed4482pkey_raw(const unsigned char* key, size_t keylen);
#endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
#if LDNS_BUILD_CONFIG_HAVE_SSL
RSA *ldns_key_buf2rsa(const ldns_buffer *key);
RSA *ldns_key_buf2rsa_raw(const unsigned char* key, size_t len);
#endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
ldns_rr *ldns_key_rr2ds(const ldns_rr *key, ldns_hash h);
ldns_rdf *
ldns_dnssec_create_nsec_bitmap(ldns_rr_type rr_type_list[],
size_t size,
ldns_rr_type nsec_type);
int
ldns_dnssec_rrsets_contains_type(const ldns_dnssec_rrsets *rrsets, ldns_rr_type type);
ldns_rr *
ldns_dnssec_create_nsec(const ldns_dnssec_name *from,
const ldns_dnssec_name *to,
ldns_rr_type nsec_type);
ldns_rr *
ldns_dnssec_create_nsec3(const ldns_dnssec_name *from,
const ldns_dnssec_name *to,
const ldns_rdf *zone_name,
uint8_t algorithm,
uint8_t flags,
uint16_t iterations,
uint8_t salt_length,
const uint8_t *salt);
ldns_rr * ldns_create_nsec(ldns_rdf *cur_owner, ldns_rdf *next_owner, ldns_rr_list *rrs);
ldns_rdf *ldns_nsec3_hash_name(const ldns_rdf *name, uint8_t algorithm, uint16_t iterations, uint8_t salt_length, const uint8_t *salt);
void ldns_nsec3_add_param_rdfs(ldns_rr *rr,
uint8_t algorithm,
uint8_t flags,
uint16_t iterations,
uint8_t salt_length,
const uint8_t *salt);
/* this will NOT return the NSEC3 completed, you will have to run the
finalize function on the rrlist later! */
ldns_rr *
ldns_create_nsec3(const ldns_rdf *cur_owner,
const ldns_rdf *cur_zone,
const ldns_rr_list *rrs,
uint8_t algorithm,
uint8_t flags,
uint16_t iterations,
uint8_t salt_length,
const uint8_t *salt,
bool emptynonterminal);
uint8_t ldns_nsec3_algorithm(const ldns_rr *nsec3_rr);
uint8_t
ldns_nsec3_flags(const ldns_rr *nsec3_rr);
bool ldns_nsec3_optout(const ldns_rr *nsec3_rr);
uint16_t ldns_nsec3_iterations(const ldns_rr *nsec3_rr);
ldns_rdf *ldns_nsec3_salt(const ldns_rr *nsec3_rr);
uint8_t ldns_nsec3_salt_length(const ldns_rr *nsec3_rr);
uint8_t *ldns_nsec3_salt_data(const ldns_rr *nsec3_rr);
ldns_rdf *ldns_nsec3_next_owner(const ldns_rr *nsec3_rr);
ldns_rdf *ldns_nsec3_bitmap(const ldns_rr *nsec3_rr);
ldns_rdf *ldns_nsec3_hash_name_frm_nsec3(const ldns_rr *nsec, const ldns_rdf *name);
bool ldns_nsec_bitmap_covers_type(const ldns_rdf* bitmap, ldns_rr_type type);
ldns_status ldns_nsec_bitmap_set_type(ldns_rdf* bitmap, ldns_rr_type type);
ldns_status ldns_nsec_bitmap_clear_type(ldns_rdf* bitmap, ldns_rr_type type);
bool ldns_nsec_covers_name(const ldns_rr *nsec, const ldns_rdf *name);
#if LDNS_BUILD_CONFIG_HAVE_SSL
ldns_status ldns_pkt_verify(const ldns_pkt *p, ldns_rr_type t, const ldns_rdf *o, const ldns_rr_list *k, const ldns_rr_list *s, ldns_rr_list *good_keys);
ldns_status ldns_pkt_verify_time(const ldns_pkt *p, ldns_rr_type t, const ldns_rdf *o, const ldns_rr_list *k, const ldns_rr_list *s, time_t check_time, ldns_rr_list *good_keys);
#endif
ldns_status
ldns_dnssec_chain_nsec3_list(ldns_rr_list *nsec3_rrs);
int
qsort_rr_compare_nsec3(const void *a, const void *b);
void
ldns_rr_list_sort_nsec3(ldns_rr_list *unsorted);
int ldns_dnssec_default_add_to_signatures(ldns_rr *sig, void *n);
int ldns_dnssec_default_leave_signatures(ldns_rr *sig, void *n);
int ldns_dnssec_default_delete_signatures(ldns_rr *sig, void *n);
int ldns_dnssec_default_replace_signatures(ldns_rr *sig, void *n);
#if LDNS_BUILD_CONFIG_HAVE_SSL
ldns_rdf *
ldns_convert_dsa_rrsig_asn12rdf(const ldns_buffer *sig,
const long sig_len);
ldns_status
ldns_convert_dsa_rrsig_rdf2asn1(ldns_buffer *target_buffer,
const ldns_rdf *sig_rdf);
ldns_rdf *
ldns_convert_ecdsa_rrsig_asn1len2rdf(const ldns_buffer *sig,
const long sig_len, int num_bytes);
ldns_status
ldns_convert_ecdsa_rrsig_rdf2asn1(ldns_buffer *target_buffer,
const ldns_rdf *sig_rdf);
#endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
#ifdef __cplusplus
}
#endif
#endif /* LDNS_DNSSEC_H */
ldns_buffer
struct ldns_struct_buffer ldns_buffer
Definition buffer.h:72
common.h
Common definitions for LDNS.
ldns_digest_evp
int ldns_digest_evp(const unsigned char *data, unsigned int len, unsigned char *dest, const EVP_MD *md)
Utility function to calculate hash using generic EVP_MD pointer.
Definition dnssec.c:490
ldns_ecdsa2pkey_raw
EVP_PKEY * ldns_ecdsa2pkey_raw(const unsigned char *key, size_t keylen, uint8_t algo)
Converts a holding buffer with key material to EVP PKEY in openssl.
Definition dnssec_verify.c:1948
ldns_dnssec_pkt_get_rrsigs_for_type
ldns_rr_list * ldns_dnssec_pkt_get_rrsigs_for_type(const ldns_pkt *pkt, ldns_rr_type type)
Returns a ldns_rr_list containing the signatures covering the given type.
Definition dnssec.c:250
ldns_nsec3_next_owner
ldns_rdf * ldns_nsec3_next_owner(const ldns_rr *nsec3_rr)
Returns the first label of the next ownername in the NSEC3 chain (ie.
Definition dnssec.c:1350
ldns_nsec_bitmap_covers_type
signed char ldns_nsec_bitmap_covers_type(const ldns_rdf *bitmap, ldns_rr_type type)
Check if RR type t is enumerated and set in the RR type bitmap rdf.
Definition dnssec.c:1395
ldns_dnssec_create_nsec3
ldns_rr * ldns_dnssec_create_nsec3(const ldns_dnssec_name *from, const ldns_dnssec_name *to, const ldns_rdf *zone_name, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t *salt)
Creates NSEC3.
Definition dnssec.c:871
ldns_key_buf2dsa
DSA * ldns_key_buf2dsa(const ldns_buffer *key)
converts a buffer holding key material to a DSA key in openssl.
Definition dnssec.c:338
ldns_nsec3_iterations
uint16_t ldns_nsec3_iterations(const ldns_rr *nsec3_rr)
Returns the number of hash iterations used in the given NSEC3 RR.
Definition dnssec.c:1294
ldns_key_rr2ds
ldns_rr * ldns_key_rr2ds(const ldns_rr *key, ldns_hash h)
returns a new DS rr that represents the given key rr.
Definition dnssec.c:509
ldns_nsec3_hash_name
ldns_rdf * ldns_nsec3_hash_name(const ldns_rdf *name, uint8_t algorithm, uint16_t iterations, uint8_t salt_length, const uint8_t *salt)
Calculates the hashed name using the given parameters.
Definition dnssec.c:1010
ldns_gost2pkey_raw
EVP_PKEY * ldns_gost2pkey_raw(const unsigned char *key, size_t keylen)
Converts a holding buffer with key material to EVP PKEY in openssl.
ldns_dnssec_get_rrsig_for_name_and_type
ldns_rr * ldns_dnssec_get_rrsig_for_name_and_type(const ldns_rdf *name, const ldns_rr_type type, const ldns_rr_list *rrs)
Returns the first RRSIG rr that corresponds to the rrset with the given name and type.
Definition dnssec.c:34
ldns_nsec3_salt
ldns_rdf * ldns_nsec3_salt(const ldns_rr *nsec3_rr)
Returns the salt used in the given NSEC3 RR.
Definition dnssec.c:1308
ldns_rr_list_sort_nsec3
void ldns_rr_list_sort_nsec3(ldns_rr_list *unsorted)
sort nsec3 list
Definition dnssec.c:1706
ldns_convert_ecdsa_rrsig_rdf2asn1
ldns_status ldns_convert_ecdsa_rrsig_rdf2asn1(ldns_buffer *target_buffer, const ldns_rdf *sig_rdf)
Converts the RRSIG signature RDF (from DNS) to a buffer with the signature in ASN1 format as openssl ...
Definition dnssec.c:1911
ldns_ed4482pkey_raw
EVP_PKEY * ldns_ed4482pkey_raw(const unsigned char *key, size_t keylen)
Converts a holding buffer with key material to EVP PKEY in openssl.
Definition dnssec_verify.c:1910
ldns_key_buf2dsa_raw
DSA * ldns_key_buf2dsa_raw(const unsigned char *key, size_t len)
Like ldns_key_buf2dsa, but uses raw buffer.
Definition dnssec.c:345
ldns_dnssec_pkt_get_rrsigs_for_name_and_type
ldns_rr_list * ldns_dnssec_pkt_get_rrsigs_for_name_and_type(const ldns_pkt *pkt, const ldns_rdf *name, ldns_rr_type type)
Returns a ldns_rr_list containing the signatures covering the given name and type.
Definition dnssec.c:223
ldns_create_nsec3
ldns_rr * ldns_create_nsec3(const ldns_rdf *cur_owner, const ldns_rdf *cur_zone, const ldns_rr_list *rrs, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t *salt, signed char emptynonterminal)
Definition dnssec.c:1180
ldns_nsec3_salt_data
uint8_t * ldns_nsec3_salt_data(const ldns_rr *nsec3_rr)
Returns the salt bytes used in the given NSEC3 RR.
Definition dnssec.c:1331
ldns_nsec_get_bitmap
ldns_rdf * ldns_nsec_get_bitmap(const ldns_rr *nsec)
Returns the rdata field that contains the bitmap of the covered types of the given NSEC record.
Definition dnssec.c:89
ldns_dnssec_get_dnskey_for_rrsig
ldns_rr * ldns_dnssec_get_dnskey_for_rrsig(const ldns_rr *rrsig, const ldns_rr_list *rrs)
Returns the DNSKEY that corresponds to the given RRSIG rr from the list, if any.
Definition dnssec.c:62
ldns_nsec3_add_param_rdfs
void ldns_nsec3_add_param_rdfs(ldns_rr *rr, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t *salt)
Sets all the NSEC3 options.
Definition dnssec.c:1109
ldns_nsec_covers_name
signed char ldns_nsec_covers_name(const ldns_rr *nsec, const ldns_rdf *name)
Checks coverage of NSEC(3) RR name span Remember that nsec and name must both be in canonical form (i...
Definition dnssec.c:1510
ldns_dnssec_pkt_has_rrsigs
signed char ldns_dnssec_pkt_has_rrsigs(const ldns_pkt *pkt)
Checks whether the packet contains rrsigs.
Definition dnssec.c:204
ldns_ed255192pkey_raw
EVP_PKEY * ldns_ed255192pkey_raw(const unsigned char *key, size_t keylen)
Converts a holding buffer with key material to EVP PKEY in openssl.
Definition dnssec_verify.c:1872
ldns_calc_keytag_raw
uint16_t ldns_calc_keytag_raw(const uint8_t *key, size_t keysize)
Calculates keytag of DNSSEC key, operates on wireformat rdata.
Definition dnssec.c:308
ldns_calc_keytag
uint16_t ldns_calc_keytag(const ldns_rr *key)
calculates a keytag of a key for use in DNSSEC.
Definition dnssec.c:277
ldns_dnssec_create_nsec_bitmap
ldns_rdf * ldns_dnssec_create_nsec_bitmap(ldns_rr_type rr_type_list[], size_t size, ldns_rr_type nsec_type)
Create the type bitmap for an NSEC(3) record.
Definition dnssec.c:721
ldns_nsec3_salt_length
uint8_t ldns_nsec3_salt_length(const ldns_rr *nsec3_rr)
Returns the length of the salt used in the given NSEC3 RR.
Definition dnssec.c:1320
ldns_nsec3_flags
uint8_t ldns_nsec3_flags(const ldns_rr *nsec3_rr)
Returns flags field.
Definition dnssec.c:1275
ldns_dnssec_default_leave_signatures
int ldns_dnssec_default_leave_signatures(ldns_rr *sig, void *n)
Default callback function to always leave present signatures, and add no new ones for the keys of the...
ldns_nsec3_hash_name_frm_nsec3
ldns_rdf * ldns_nsec3_hash_name_frm_nsec3(const ldns_rr *nsec, const ldns_rdf *name)
Calculates the hashed name using the parameters of the given NSEC3 RR.
Definition dnssec.c:1370
ldns_dnssec_default_replace_signatures
int ldns_dnssec_default_replace_signatures(ldns_rr *sig, void *n)
Default callback function to always leave present signatures, and add new ones.
ldns_key_buf2rsa_raw
RSA * ldns_key_buf2rsa_raw(const unsigned char *key, size_t len)
Like ldns_key_buf2rsa, but uses raw buffer.
Definition dnssec.c:422
ldns_convert_dsa_rrsig_rdf2asn1
ldns_status ldns_convert_dsa_rrsig_rdf2asn1(ldns_buffer *target_buffer, const ldns_rdf *sig_rdf)
Converts the RRSIG signature RDF (in rfc2536 format) to a buffer with the signature in rfc2459 format...
Definition dnssec.c:1809
ldns_pkt_verify_time
ldns_status ldns_pkt_verify_time(const ldns_pkt *p, ldns_rr_type t, const ldns_rdf *o, const ldns_rr_list *k, const ldns_rr_list *s, time_t check_time, ldns_rr_list *good_keys)
verify a packet
Definition dnssec.c:1561
ldns_key_buf2rsa
RSA * ldns_key_buf2rsa(const ldns_buffer *key)
converts a buffer holding key material to a RSA key in openssl.
Definition dnssec.c:415
ldns_nsec3_algorithm
uint8_t ldns_nsec3_algorithm(const ldns_rr *nsec3_rr)
Returns the hash algorithm used in the given NSEC3 RR.
Definition dnssec.c:1262
ldns_nsec3_optout
signed char ldns_nsec3_optout(const ldns_rr *nsec3_rr)
Returns true if the opt-out flag has been set in the given NSEC3 RR.
Definition dnssec.c:1288
ldns_nsec_bitmap_set_type
ldns_status ldns_nsec_bitmap_set_type(ldns_rdf *bitmap, ldns_rr_type type)
Checks if RR type t is enumerated in the type bitmap rdf and sets the bit.
Definition dnssec.c:1432
ldns_dnssec_default_delete_signatures
int ldns_dnssec_default_delete_signatures(ldns_rr *sig, void *n)
Default callback function to always remove present signatures, but add no new ones.
ldns_nsec_bitmap_clear_type
ldns_status ldns_nsec_bitmap_clear_type(ldns_rdf *bitmap, ldns_rr_type type)
Checks if RR type t is enumerated in the type bitmap rdf and clears the bit.
Definition dnssec.c:1470
ldns_pkt_verify
ldns_status ldns_pkt_verify(const ldns_pkt *p, ldns_rr_type t, const ldns_rdf *o, const ldns_rr_list *k, const ldns_rr_list *s, ldns_rr_list *good_keys)
verify a packet
Definition dnssec.c:1628
ldns_dnssec_chain_nsec3_list
ldns_status ldns_dnssec_chain_nsec3_list(ldns_rr_list *nsec3_rrs)
chains nsec3 list
Definition dnssec.c:1636
ldns_dnssec_default_add_to_signatures
int ldns_dnssec_default_add_to_signatures(ldns_rr *sig, void *n)
Default callback function to always leave present signatures, and add new ones.
ldns_convert_ecdsa_rrsig_asn1len2rdf
ldns_rdf * ldns_convert_ecdsa_rrsig_asn1len2rdf(const ldns_buffer *sig, const long sig_len, int num_bytes)
Converts the ECDSA signature from ASN1 representation (as used by OpenSSL) to raw signature data as u...
Definition dnssec.c:1873
qsort_rr_compare_nsec3
int qsort_rr_compare_nsec3(const void *a, const void *b)
compare for nsec3 sort
Definition dnssec.c:1689
ldns_create_nsec
ldns_rr * ldns_create_nsec(ldns_rdf *cur_owner, ldns_rdf *next_owner, ldns_rr_list *rrs)
Create a NSEC record.
Definition dnssec.c:960
ldns_nsec3_bitmap
ldns_rdf * ldns_nsec3_bitmap(const ldns_rr *nsec3_rr)
Returns the bitmap specifying the covered types of the given NSEC3 RR.
Definition dnssec.c:1360
ldns_dnssec_nsec3_closest_encloser
ldns_rdf * ldns_dnssec_nsec3_closest_encloser(const ldns_rdf *qname, ldns_rr_type qtype, const ldns_rr_list *nsec3s)
Returns the dname of the closest (provable) encloser.
ldns_dnssec_create_nsec
ldns_rr * ldns_dnssec_create_nsec(const ldns_dnssec_name *from, const ldns_dnssec_name *to, ldns_rr_type nsec_type)
Creates NSEC.
Definition dnssec.c:817
ldns_dnssec_rrsets_contains_type
int ldns_dnssec_rrsets_contains_type(const ldns_dnssec_rrsets *rrsets, ldns_rr_type type)
returns whether a rrset of the given type is found in the rrsets.
Definition dnssec.c:803
ldns_convert_dsa_rrsig_asn12rdf
ldns_rdf * ldns_convert_dsa_rrsig_asn12rdf(const ldns_buffer *sig, const long sig_len)
Converts the DSA signature from ASN1 representation (RFC2459, as used by OpenSSL) to raw signature da...
Definition dnssec.c:1748
dnssec_zone.h
ldns_dnssec_name
struct ldns_struct_dnssec_name ldns_dnssec_name
Structure containing all resource records for a domain name Including the derived NSEC3,...
Definition dnssec_zone.h:44
ldns_dnssec_rrsets
struct ldns_struct_dnssec_rrsets ldns_dnssec_rrsets
Singly linked list of RRsets.
Definition dnssec_zone.h:31
ldns_status
enum ldns_enum_status ldns_status
Definition error.h:152
keys.h
Addendum to dnssec.h, this module contains key and algorithm definitions and functions.
ldns_hash
enum ldns_enum_hash ldns_hash
Definition keys.h:76
packet.h
Contains the definition of ldns_pkt and its parts, as well as functions to manipulate those.
ldns_pkt
struct ldns_struct_pkt ldns_pkt
Definition packet.h:272
ldns_rdf
struct ldns_struct_rdf ldns_rdf
Definition rdata.h:211
resolver.h
Defines the ldns_resolver structure, a stub resolver that can send queries and parse answers.
ldns_rr
struct ldns_struct_rr ldns_rr
Definition rr.h:346
ldns_rr_type
enum ldns_enum_rr_type ldns_rr_type
Definition rr.h:260
ldns_rr_list
struct ldns_struct_rr_list ldns_rr_list
Definition rr.h:360
zone.h
zone.h