ldns  1.7.0
dnssec_sign.c
Go to the documentation of this file.
1 #include <ldns/config.h>
2 
3 #include <ldns/ldns.h>
4 
5 #include <ldns/dnssec.h>
6 #include <ldns/dnssec_sign.h>
7 
8 #include <strings.h>
9 #include <time.h>
10 
11 #ifdef HAVE_SSL
12 /* this entire file is rather useless when you don't have
13  * crypto...
14  */
15 #include <openssl/ssl.h>
16 #include <openssl/evp.h>
17 #include <openssl/rand.h>
18 #include <openssl/err.h>
19 #include <openssl/md5.h>
20 #include <openssl/bn.h>
21 #include <openssl/rsa.h>
22 #ifdef USE_DSA
23 #include <openssl/dsa.h>
24 #endif
25 #endif /* HAVE_SSL */
26 
27 ldns_rr *
29  const ldns_key *current_key)
30 {
31  uint32_t orig_ttl;
32  ldns_rr_class orig_class;
33  time_t now;
34  ldns_rr *current_sig;
35  uint8_t label_count;
36  ldns_rdf *signame;
37 
39  0)));
40  /* RFC4035 2.2: not counting the leftmost label if it is a wildcard */
42  label_count --;
43 
45 
46  /* set the type on the new signature */
47  orig_ttl = ldns_rr_ttl(ldns_rr_list_rr(rrset, 0));
48  orig_class = ldns_rr_get_class(ldns_rr_list_rr(rrset, 0));
49 
50  ldns_rr_set_ttl(current_sig, orig_ttl);
51  ldns_rr_set_class(current_sig, orig_class);
52  ldns_rr_set_owner(current_sig,
55  ldns_rr_list_rr(rrset,
56  0))));
57 
58  /* fill in what we know of the signature */
59 
60  /* set the orig_ttl */
62  current_sig,
64  orig_ttl));
65  /* the signers name */
66  signame = ldns_rdf_clone(ldns_key_pubkey_owner(current_key));
67  ldns_dname2canonical(signame);
69  current_sig,
70  signame);
71  /* label count - get it from the first rr in the rr_list */
73  current_sig,
75  label_count));
76  /* inception, expiration */
77  now = time(NULL);
78  if (ldns_key_inception(current_key) != 0) {
80  current_sig,
83  ldns_key_inception(current_key)));
84  } else {
86  current_sig,
88  }
89  if (ldns_key_expiration(current_key) != 0) {
91  current_sig,
94  ldns_key_expiration(current_key)));
95  } else {
97  current_sig,
100  now + LDNS_DEFAULT_EXP_TIME));
101  }
102 
104  current_sig,
106  ldns_key_keytag(current_key)));
107 
109  current_sig,
112  ldns_key_algorithm(current_key)));
113 
115  current_sig,
119  0))));
120  return current_sig;
121 }
122 
123 #ifdef HAVE_SSL
124 ldns_rdf *
126 {
127  ldns_rdf *b64rdf = NULL;
128 
129  switch(ldns_key_algorithm(current_key)) {
130 #ifdef USE_DSA
131  case LDNS_SIGN_DSA:
132  case LDNS_SIGN_DSA_NSEC3:
133  b64rdf = ldns_sign_public_evp(
134  sign_buf,
135  ldns_key_evp_key(current_key),
136 # ifdef HAVE_EVP_DSS1
137  EVP_dss1()
138 # else
139  EVP_sha1()
140 # endif
141  );
142  break;
143 #endif /* USE_DSA */
144  case LDNS_SIGN_RSASHA1:
146  b64rdf = ldns_sign_public_evp(
147  sign_buf,
148  ldns_key_evp_key(current_key),
149  EVP_sha1());
150  break;
151 #ifdef USE_SHA2
152  case LDNS_SIGN_RSASHA256:
153  b64rdf = ldns_sign_public_evp(
154  sign_buf,
155  ldns_key_evp_key(current_key),
156  EVP_sha256());
157  break;
158  case LDNS_SIGN_RSASHA512:
159  b64rdf = ldns_sign_public_evp(
160  sign_buf,
161  ldns_key_evp_key(current_key),
162  EVP_sha512());
163  break;
164 #endif /* USE_SHA2 */
165 #ifdef USE_GOST
166  case LDNS_SIGN_ECC_GOST:
167  b64rdf = ldns_sign_public_evp(
168  sign_buf,
169  ldns_key_evp_key(current_key),
170  EVP_get_digestbyname("md_gost94"));
171  break;
172 #endif /* USE_GOST */
173 #ifdef USE_ECDSA
175  b64rdf = ldns_sign_public_evp(
176  sign_buf,
177  ldns_key_evp_key(current_key),
178  EVP_sha256());
179  break;
181  b64rdf = ldns_sign_public_evp(
182  sign_buf,
183  ldns_key_evp_key(current_key),
184  EVP_sha384());
185  break;
186 #endif
187 #ifdef USE_ED25519
188  case LDNS_SIGN_ED25519:
189  b64rdf = ldns_sign_public_evp(
190  sign_buf,
191  ldns_key_evp_key(current_key),
192  NULL);
193  break;
194 #endif
195 #ifdef USE_ED448
196  case LDNS_SIGN_ED448:
197  b64rdf = ldns_sign_public_evp(
198  sign_buf,
199  ldns_key_evp_key(current_key),
200  NULL);
201  break;
202 #endif
203  case LDNS_SIGN_RSAMD5:
204  b64rdf = ldns_sign_public_evp(
205  sign_buf,
206  ldns_key_evp_key(current_key),
207  EVP_md5());
208  break;
209  default:
210  /* do _you_ know this alg? */
211  printf("unknown algorithm, ");
212  printf("is the one used available on this system?\n");
213  break;
214  }
215 
216  return b64rdf;
217 }
218 
223 ldns_rr_list *
225 {
226  ldns_rr_list *signatures;
227  ldns_rr_list *rrset_clone;
228  ldns_rr *current_sig;
229  ldns_rdf *b64rdf;
230  ldns_key *current_key;
231  size_t key_count;
232  uint16_t i;
233  ldns_buffer *sign_buf;
234  ldns_rdf *new_owner;
235 
236  if (!rrset || ldns_rr_list_rr_count(rrset) < 1 || !keys) {
237  return NULL;
238  }
239 
240  new_owner = NULL;
241 
242  /* prepare a signature and add all the know data
243  * prepare the rrset. Sign this together. */
244  rrset_clone = ldns_rr_list_clone(rrset);
245  if (!rrset_clone) {
246  return NULL;
247  }
248 
249  /* make it canonical */
250  for(i = 0; i < ldns_rr_list_rr_count(rrset_clone); i++) {
251  ldns_rr_set_ttl(ldns_rr_list_rr(rrset_clone, i),
252  ldns_rr_ttl(ldns_rr_list_rr(rrset, 0)));
253  ldns_rr2canonical(ldns_rr_list_rr(rrset_clone, i));
254  }
255  /* sort */
256  ldns_rr_list_sort(rrset_clone);
257 
258  signatures = ldns_rr_list_new();
259 
260  for (key_count = 0;
261  key_count < ldns_key_list_key_count(keys);
262  key_count++) {
263  if (!ldns_key_use(ldns_key_list_key(keys, key_count))) {
264  continue;
265  }
267  if (!sign_buf) {
268  ldns_rr_list_free(rrset_clone);
269  ldns_rr_list_free(signatures);
270  ldns_rdf_free(new_owner);
271  return NULL;
272  }
273  b64rdf = NULL;
274 
275  current_key = ldns_key_list_key(keys, key_count);
276  /* sign all RRs with keys that have ZSKbit, !SEPbit.
277  sign DNSKEY RRs with keys that have ZSKbit&SEPbit */
278  if (ldns_key_flags(current_key) & LDNS_KEY_ZONE_KEY) {
279  current_sig = ldns_create_empty_rrsig(rrset_clone,
280  current_key);
281 
282  /* right now, we have: a key, a semi-sig and an rrset. For
283  * which we can create the sig and base64 encode that and
284  * add that to the signature */
285 
286  if (ldns_rrsig2buffer_wire(sign_buf, current_sig)
287  != LDNS_STATUS_OK) {
288  ldns_buffer_free(sign_buf);
289  /* ERROR */
290  ldns_rr_list_deep_free(rrset_clone);
291  ldns_rr_free(current_sig);
292  ldns_rr_list_deep_free(signatures);
293  return NULL;
294  }
295 
296  /* add the rrset in sign_buf */
297  if (ldns_rr_list2buffer_wire(sign_buf, rrset_clone)
298  != LDNS_STATUS_OK) {
299  ldns_buffer_free(sign_buf);
300  ldns_rr_list_deep_free(rrset_clone);
301  ldns_rr_free(current_sig);
302  ldns_rr_list_deep_free(signatures);
303  return NULL;
304  }
305 
306  b64rdf = ldns_sign_public_buffer(sign_buf, current_key);
307 
308  if (!b64rdf) {
309  /* signing went wrong */
310  ldns_rr_list_deep_free(rrset_clone);
311  ldns_rr_free(current_sig);
312  ldns_rr_list_deep_free(signatures);
313  return NULL;
314  }
315 
316  ldns_rr_rrsig_set_sig(current_sig, b64rdf);
317 
318  /* push the signature to the signatures list */
319  ldns_rr_list_push_rr(signatures, current_sig);
320  }
321  ldns_buffer_free(sign_buf); /* restart for the next key */
322  }
323  ldns_rr_list_deep_free(rrset_clone);
324 
325  return signatures;
326 }
327 
336 ldns_rdf *
338 {
339 #ifdef USE_DSA
340  unsigned char *sha1_hash;
341  ldns_rdf *sigdata_rdf;
342  ldns_buffer *b64sig;
343 
344  DSA_SIG *sig;
345  const BIGNUM *R, *S;
346  uint8_t *data;
347  size_t pad;
348 
350  if (!b64sig) {
351  return NULL;
352  }
353 
354  sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
355  ldns_buffer_position(to_sign), NULL);
356  if (!sha1_hash) {
357  ldns_buffer_free(b64sig);
358  return NULL;
359  }
360 
361  sig = DSA_do_sign(sha1_hash, SHA_DIGEST_LENGTH, key);
362  if(!sig) {
363  ldns_buffer_free(b64sig);
364  return NULL;
365  }
366 
367  data = LDNS_XMALLOC(uint8_t, 1 + 2 * SHA_DIGEST_LENGTH);
368  if(!data) {
369  ldns_buffer_free(b64sig);
370  DSA_SIG_free(sig);
371  return NULL;
372  }
373 
374  data[0] = 1;
375 # ifdef HAVE_DSA_SIG_GET0
376  DSA_SIG_get0(sig, &R, &S);
377 # else
378  R = sig->r;
379  S = sig->s;
380 # endif
381  pad = 20 - (size_t) BN_num_bytes(R);
382  if (pad > 0) {
383  memset(data + 1, 0, pad);
384  }
385  BN_bn2bin(R, (unsigned char *) (data + 1) + pad);
386 
387  pad = 20 - (size_t) BN_num_bytes(S);
388  if (pad > 0) {
389  memset(data + 1 + SHA_DIGEST_LENGTH, 0, pad);
390  }
391  BN_bn2bin(S, (unsigned char *) (data + 1 + SHA_DIGEST_LENGTH + pad));
392 
394  1 + 2 * SHA_DIGEST_LENGTH,
395  data);
396 
397  ldns_buffer_free(b64sig);
398  LDNS_FREE(data);
399  DSA_SIG_free(sig);
400 
401  return sigdata_rdf;
402 #else
403  (void)to_sign; (void)key;
404  return NULL;
405 #endif
406 }
407 
408 #ifdef USE_ECDSA
409 #ifndef S_SPLINT_S
411 static int
412 ldns_pkey_is_ecdsa(EVP_PKEY* pkey)
413 {
414  EC_KEY* ec;
415  const EC_GROUP* g;
416 #ifdef HAVE_EVP_PKEY_GET_BASE_ID
417  if(EVP_PKEY_get_base_id(pkey) != EVP_PKEY_EC)
418  return 0;
419 #elif defined(HAVE_EVP_PKEY_BASE_ID)
420  if(EVP_PKEY_base_id(pkey) != EVP_PKEY_EC)
421  return 0;
422 #else
423  if(EVP_PKEY_type(key->type) != EVP_PKEY_EC)
424  return 0;
425 #endif
426  ec = EVP_PKEY_get1_EC_KEY(pkey);
427  g = EC_KEY_get0_group(ec);
428  if(!g) {
429  EC_KEY_free(ec);
430  return 0;
431  }
432  if(EC_GROUP_get_curve_name(g) == NID_X9_62_prime256v1) {
433  EC_KEY_free(ec);
434  return 32; /* 256/8 */
435  }
436  if(EC_GROUP_get_curve_name(g) == NID_secp384r1) {
437  EC_KEY_free(ec);
438  return 48; /* 384/8 */
439  }
440  /* downref the eckey, the original is still inside the pkey */
441  EC_KEY_free(ec);
442  return 0;
443 }
444 #endif /* splint */
445 #endif /* USE_ECDSA */
446 
447 ldns_rdf *
449  EVP_PKEY *key,
450  const EVP_MD *digest_type)
451 {
452  unsigned int siglen;
453  ldns_rdf *sigdata_rdf = NULL;
454  ldns_buffer *b64sig;
455  EVP_MD_CTX *ctx;
456  const EVP_MD *md_type;
457  int r;
458 
459  siglen = 0;
461  if (!b64sig) {
462  return NULL;
463  }
464 
465  /* initializes a signing context */
466  md_type = digest_type;
467 #ifdef USE_ED25519
468  if(EVP_PKEY_id(key) == NID_ED25519) {
469  /* digest must be NULL for ED25519 sign and verify */
470  md_type = NULL;
471  } else
472 #endif
473 #ifdef USE_ED448
474  if(EVP_PKEY_id(key) == NID_ED448) {
475  md_type = NULL;
476  } else
477 #endif
478  if(!md_type) {
479  /* unknown message digest */
480  ldns_buffer_free(b64sig);
481  return NULL;
482  }
483 
484 #ifdef HAVE_EVP_MD_CTX_NEW
485  ctx = EVP_MD_CTX_new();
486 #else
487  ctx = (EVP_MD_CTX*)malloc(sizeof(*ctx));
488  if(ctx) EVP_MD_CTX_init(ctx);
489 #endif
490  if(!ctx) {
491  ldns_buffer_free(b64sig);
492  return NULL;
493  }
494 
495 #if defined(USE_ED25519) || defined(USE_ED448)
496  if(md_type == NULL) {
497  /* for these methods we must use the one-shot DigestSign */
498  r = EVP_DigestSignInit(ctx, NULL, md_type, NULL, key);
499  if(r == 1) {
500  size_t siglen_sizet = ldns_buffer_capacity(b64sig);
501  r = EVP_DigestSign(ctx,
502  (unsigned char*)ldns_buffer_begin(b64sig),
503  &siglen_sizet,
504  (unsigned char*)ldns_buffer_begin(to_sign),
505  ldns_buffer_position(to_sign));
506  siglen = (unsigned int)siglen_sizet;
507  }
508  } else {
509 #else
510  r = 0;
511  if(md_type != NULL) {
512 #endif
513  r = EVP_SignInit(ctx, md_type);
514  if(r == 1) {
515  r = EVP_SignUpdate(ctx, (unsigned char*)
516  ldns_buffer_begin(to_sign),
517  ldns_buffer_position(to_sign));
518  }
519  if(r == 1) {
520  r = EVP_SignFinal(ctx, (unsigned char*)
521  ldns_buffer_begin(b64sig), &siglen, key);
522  }
523  }
524  if(r != 1) {
525  ldns_buffer_free(b64sig);
526  EVP_MD_CTX_destroy(ctx);
527  return NULL;
528  }
529 
530  /* OpenSSL output is different, convert it */
531  r = 0;
532 #ifdef USE_DSA
533 #ifndef S_SPLINT_S
534  /* unfortunately, OpenSSL output is different from DNS DSA format */
535 # ifdef HAVE_EVP_PKEY_GET_BASE_ID
536  if (EVP_PKEY_get_base_id(key) == EVP_PKEY_DSA) {
537 # elif defined(HAVE_EVP_PKEY_BASE_ID)
538  if (EVP_PKEY_base_id(key) == EVP_PKEY_DSA) {
539 # else
540  if (EVP_PKEY_type(key->type) == EVP_PKEY_DSA) {
541 # endif
542  r = 1;
543  sigdata_rdf = ldns_convert_dsa_rrsig_asn12rdf(b64sig, siglen);
544  }
545 #endif
546 #endif
547 #if defined(USE_ECDSA)
548  if(
550  EVP_PKEY_get_base_id(key)
551 # elif defined(HAVE_EVP_PKEY_BASE_ID)
552  EVP_PKEY_base_id(key)
553 # else
554  EVP_PKEY_type(key->type)
555 # endif
556  == EVP_PKEY_EC) {
557 # ifdef USE_ECDSA
558  if(ldns_pkey_is_ecdsa(key)) {
559  r = 1;
561  b64sig, (long)siglen, ldns_pkey_is_ecdsa(key));
562  }
563 # endif /* USE_ECDSA */
564  }
565 #endif /* PKEY_EC */
566  if(r == 0) {
567  /* ok output for other types is the same */
568  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
569  ldns_buffer_begin(b64sig));
570  }
571  ldns_buffer_free(b64sig);
572  EVP_MD_CTX_destroy(ctx);
573  return sigdata_rdf;
574 }
575 
576 ldns_rdf *
578 {
579  unsigned char *sha1_hash;
580  unsigned int siglen;
581  ldns_rdf *sigdata_rdf;
582  ldns_buffer *b64sig;
583  int result;
584 
585  siglen = 0;
587  if (!b64sig) {
588  return NULL;
589  }
590 
591  sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
592  ldns_buffer_position(to_sign), NULL);
593  if (!sha1_hash) {
594  ldns_buffer_free(b64sig);
595  return NULL;
596  }
597 
598  result = RSA_sign(NID_sha1, sha1_hash, SHA_DIGEST_LENGTH,
599  (unsigned char*)ldns_buffer_begin(b64sig),
600  &siglen, key);
601  if (result != 1) {
602  ldns_buffer_free(b64sig);
603  return NULL;
604  }
605 
606  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
607  ldns_buffer_begin(b64sig));
608  ldns_buffer_free(b64sig); /* can't free this buffer ?? */
609  return sigdata_rdf;
610 }
611 
612 ldns_rdf *
614 {
615  unsigned char *md5_hash;
616  unsigned int siglen;
617  ldns_rdf *sigdata_rdf;
618  ldns_buffer *b64sig;
619 
621  if (!b64sig) {
622  return NULL;
623  }
624 
625  md5_hash = MD5((unsigned char*)ldns_buffer_begin(to_sign),
626  ldns_buffer_position(to_sign), NULL);
627  if (!md5_hash) {
628  ldns_buffer_free(b64sig);
629  return NULL;
630  }
631 
632  RSA_sign(NID_md5, md5_hash, MD5_DIGEST_LENGTH,
633  (unsigned char*)ldns_buffer_begin(b64sig),
634  &siglen, key);
635 
636  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
637  ldns_buffer_begin(b64sig));
638  ldns_buffer_free(b64sig);
639  return sigdata_rdf;
640 }
641 #endif /* HAVE_SSL */
642 
646 static ldns_status
647 ldns_dnssec_addresses_on_glue_list(
648  ldns_dnssec_rrsets *cur_rrset,
649  ldns_rr_list *glue_list)
650 {
651  ldns_dnssec_rrs *cur_rrs;
652  while (cur_rrset) {
653  if (cur_rrset->type == LDNS_RR_TYPE_A
654  || cur_rrset->type == LDNS_RR_TYPE_AAAA) {
655  for (cur_rrs = cur_rrset->rrs;
656  cur_rrs;
657  cur_rrs = cur_rrs->next) {
658  if (cur_rrs->rr) {
659  if (!ldns_rr_list_push_rr(glue_list,
660  cur_rrs->rr)) {
661  return LDNS_STATUS_MEM_ERR;
662  /* ldns_rr_list_push_rr()
663  * returns false when unable
664  * to increase the capacity
665  * of the ldsn_rr_list
666  */
667  }
668  }
669  }
670  }
671  cur_rrset = cur_rrset->next;
672  }
673  return LDNS_STATUS_OK;
674 }
675 
692  ldns_rr_list *glue_list)
693 {
694  ldns_rbnode_t *node;
695  ldns_dnssec_name *name;
696  ldns_rdf *owner;
697  ldns_rdf *cut = NULL; /* keeps track of zone cuts */
698  /* When the cut is caused by a delegation, below_delegation will be 1.
699  * When caused by a DNAME, below_delegation will be 0.
700  */
701  int below_delegation = -1; /* init suppresses comiler warning */
702  ldns_status s;
703 
704  if (!zone || !zone->names) {
705  return LDNS_STATUS_NULL;
706  }
707  for (node = ldns_rbtree_first(zone->names);
708  node != LDNS_RBTREE_NULL;
709  node = ldns_rbtree_next(node)) {
710  name = (ldns_dnssec_name *) node->data;
711  owner = ldns_dnssec_name_name(name);
712 
713  if (cut) {
714  /* The previous node was a zone cut, or a subdomain
715  * below a zone cut. Is this node (still) a subdomain
716  * below the cut? Then the name is occluded. Unless
717  * the name contains a SOA, after which we are
718  * authoritative again.
719  *
720  * FIXME! If there are labels in between the SOA and
721  * the cut, going from the authoritative space (below
722  * the SOA) up into occluded space again, will not be
723  * detected with the contruct below!
724  */
725  if (ldns_dname_is_subdomain(owner, cut) &&
727  name->rrsets, LDNS_RR_TYPE_SOA)) {
728 
729  if (below_delegation && glue_list) {
730  s = ldns_dnssec_addresses_on_glue_list(
731  name->rrsets, glue_list);
732  if (s != LDNS_STATUS_OK) {
733  return s;
734  }
735  }
736  name->is_glue = true; /* Mark occluded name! */
737  continue;
738  } else {
739  cut = NULL;
740  }
741  }
742 
743  /* The node is not below a zone cut. Is it a zone cut itself?
744  * Everything below a SOA is authoritative of course; Except
745  * when the name also contains a DNAME :).
746  */
748  name->rrsets, LDNS_RR_TYPE_NS)
750  name->rrsets, LDNS_RR_TYPE_SOA)) {
751  cut = owner;
752  below_delegation = 1;
753  if (glue_list) { /* record glue on the zone cut */
754  s = ldns_dnssec_addresses_on_glue_list(
755  name->rrsets, glue_list);
756  if (s != LDNS_STATUS_OK) {
757  return s;
758  }
759  }
761  name->rrsets, LDNS_RR_TYPE_DNAME)) {
762  cut = owner;
763  below_delegation = 0;
764  }
765  }
766  return LDNS_STATUS_OK;
767 }
768 
781 {
782  return ldns_dnssec_zone_mark_and_get_glue(zone, NULL);
783 }
784 
787 {
788  ldns_rbnode_t *next_node = NULL;
789  ldns_dnssec_name *next_name = NULL;
790  bool done = false;
791 
792  if (node == LDNS_RBTREE_NULL) {
793  return NULL;
794  }
795  next_node = node;
796  while (!done) {
797  if (next_node == LDNS_RBTREE_NULL) {
798  return NULL;
799  } else {
800  next_name = (ldns_dnssec_name *)next_node->data;
801  if (!next_name->is_glue) {
802  done = true;
803  } else {
804  next_node = ldns_rbtree_next(next_node);
805  }
806  }
807  }
808  return next_node;
809 }
810 
813  ldns_rr_list *new_rrs)
814 {
815 
816  ldns_rbnode_t *first_node, *cur_node, *next_node;
817  ldns_dnssec_name *cur_name, *next_name;
818  ldns_rr *nsec_rr;
819  uint32_t nsec_ttl;
820  ldns_dnssec_rrsets *soa;
821 
822  /* the TTL of NSEC rrs should be set to the minimum TTL of
823  * the zone SOA (RFC4035 Section 2.3)
824  */
826 
827  /* did the caller actually set it? if not,
828  * fall back to default ttl
829  */
830  if (soa && soa->rrs && soa->rrs->rr
831  && (ldns_rr_rdf(soa->rrs->rr, 6) != NULL)) {
832  nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(soa->rrs->rr, 6));
833  } else {
834  nsec_ttl = LDNS_DEFAULT_TTL;
835  }
836 
838  ldns_rbtree_first(zone->names));
839  cur_node = first_node;
840  if (cur_node) {
842  ldns_rbtree_next(cur_node));
843  } else {
844  next_node = NULL;
845  }
846 
847  while (cur_node && next_node) {
848  cur_name = (ldns_dnssec_name *)cur_node->data;
849  next_name = (ldns_dnssec_name *)next_node->data;
850  nsec_rr = ldns_dnssec_create_nsec(cur_name,
851  next_name,
853  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
854  if(ldns_dnssec_name_add_rr(cur_name, nsec_rr)!=LDNS_STATUS_OK){
855  ldns_rr_free(nsec_rr);
856  return LDNS_STATUS_ERR;
857  }
858  ldns_rr_list_push_rr(new_rrs, nsec_rr);
859  cur_node = next_node;
860  if (cur_node) {
862  ldns_rbtree_next(cur_node));
863  }
864  }
865 
866  if (cur_node && !next_node) {
867  cur_name = (ldns_dnssec_name *)cur_node->data;
868  next_name = (ldns_dnssec_name *)first_node->data;
869  nsec_rr = ldns_dnssec_create_nsec(cur_name,
870  next_name,
872  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
873  if(ldns_dnssec_name_add_rr(cur_name, nsec_rr)!=LDNS_STATUS_OK){
874  ldns_rr_free(nsec_rr);
875  return LDNS_STATUS_ERR;
876  }
877  ldns_rr_list_push_rr(new_rrs, nsec_rr);
878  } else {
879  printf("error\n");
880  }
881 
882  return LDNS_STATUS_OK;
883 }
884 
885 #ifdef HAVE_SSL
886 static void
887 ldns_hashed_names_node_free(ldns_rbnode_t *node, void *arg) {
888  (void) arg;
889  LDNS_FREE(node);
890 }
891 
892 static ldns_status
893 ldns_dnssec_zone_create_nsec3s_mkmap(ldns_dnssec_zone *zone,
894  ldns_rr_list *new_rrs,
895  uint8_t algorithm,
896  uint8_t flags,
897  uint16_t iterations,
898  uint8_t salt_length,
899  uint8_t *salt,
900  ldns_rbtree_t **map)
901 {
902  ldns_rbnode_t *first_name_node;
903  ldns_rbnode_t *current_name_node;
904  ldns_dnssec_name *current_name;
905  ldns_status result = LDNS_STATUS_OK;
906  ldns_rr *nsec_rr;
907  ldns_rr_list *nsec3_list;
908  uint32_t nsec_ttl;
909  ldns_dnssec_rrsets *soa;
910  ldns_rbnode_t *hashmap_node;
911 
912  if (!zone || !new_rrs || !zone->names) {
913  return LDNS_STATUS_ERR;
914  }
915 
916  /* the TTL of NSEC rrs should be set to the minimum TTL of
917  * the zone SOA (RFC4035 Section 2.3)
918  */
920 
921  /* did the caller actually set it? if not,
922  * fall back to default ttl
923  */
924  if (soa && soa->rrs && soa->rrs->rr
925  && ldns_rr_rdf(soa->rrs->rr, 6) != NULL) {
926  nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(soa->rrs->rr, 6));
927  } else {
928  nsec_ttl = LDNS_DEFAULT_TTL;
929  }
930 
931  if (ldns_rdf_size(zone->soa->name) > 222) {
933  }
934 
935  if (zone->hashed_names) {
937  ldns_hashed_names_node_free, NULL);
938  LDNS_FREE(zone->hashed_names);
939  }
941  if (zone->hashed_names && map) {
942  *map = zone->hashed_names;
943  }
944 
945  first_name_node = ldns_dnssec_name_node_next_nonglue(
946  ldns_rbtree_first(zone->names));
947 
948  current_name_node = first_name_node;
949 
950  while (current_name_node && current_name_node != LDNS_RBTREE_NULL &&
951  result == LDNS_STATUS_OK) {
952 
953  current_name = (ldns_dnssec_name *) current_name_node->data;
954  nsec_rr = ldns_dnssec_create_nsec3(current_name,
955  NULL,
956  zone->soa->name,
957  algorithm,
958  flags,
959  iterations,
960  salt_length,
961  salt);
962  /* by default, our nsec based generator adds rrsigs
963  * remove the bitmap for empty nonterminals */
964  if (!current_name->rrsets) {
966  }
967  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
968  result = ldns_dnssec_name_add_rr(current_name, nsec_rr);
969  ldns_rr_list_push_rr(new_rrs, nsec_rr);
970  if (ldns_rr_owner(nsec_rr)) {
971  hashmap_node = LDNS_MALLOC(ldns_rbnode_t);
972  if (hashmap_node == NULL) {
973  return LDNS_STATUS_MEM_ERR;
974  }
975  current_name->hashed_name =
976  ldns_dname_label(ldns_rr_owner(nsec_rr), 0);
977 
978  if (current_name->hashed_name == NULL) {
979  LDNS_FREE(hashmap_node);
980  return LDNS_STATUS_MEM_ERR;
981  }
982  hashmap_node->key = current_name->hashed_name;
983  hashmap_node->data = current_name;
984 
985  if (! ldns_rbtree_insert(zone->hashed_names
986  , hashmap_node)) {
987  LDNS_FREE(hashmap_node);
988  }
989  }
990  current_name_node = ldns_dnssec_name_node_next_nonglue(
991  ldns_rbtree_next(current_name_node));
992  }
993  if (result != LDNS_STATUS_OK) {
994  return result;
995  }
996 
997  /* Make sorted list of nsec3s (via zone->hashed_names)
998  */
999  nsec3_list = ldns_rr_list_new();
1000  if (nsec3_list == NULL) {
1001  return LDNS_STATUS_MEM_ERR;
1002  }
1003  for ( hashmap_node = ldns_rbtree_first(zone->hashed_names)
1004  ; hashmap_node != LDNS_RBTREE_NULL
1005  ; hashmap_node = ldns_rbtree_next(hashmap_node)
1006  ) {
1007  nsec_rr = ((ldns_dnssec_name *) hashmap_node->data)->nsec;
1008  if (nsec_rr) {
1009  ldns_rr_list_push_rr(nsec3_list, nsec_rr);
1010  }
1011  }
1012  result = ldns_dnssec_chain_nsec3_list(nsec3_list);
1013  ldns_rr_list_free(nsec3_list);
1014 
1015  return result;
1016 }
1017 
1020  ldns_rr_list *new_rrs,
1021  uint8_t algorithm,
1022  uint8_t flags,
1023  uint16_t iterations,
1024  uint8_t salt_length,
1025  uint8_t *salt)
1026 {
1027  return ldns_dnssec_zone_create_nsec3s_mkmap(zone, new_rrs, algorithm,
1028  flags, iterations, salt_length, salt, NULL);
1029 
1030 }
1031 #endif /* HAVE_SSL */
1032 
1035  , ATTR_UNUSED(ldns_key_list *key_list)
1036  , int (*func)(ldns_rr *, void *)
1037  , void *arg
1038  )
1039 {
1040  ldns_dnssec_rrs *base_rrs = signatures;
1041  ldns_dnssec_rrs *cur_rr = base_rrs;
1042  ldns_dnssec_rrs *prev_rr = NULL;
1043  ldns_dnssec_rrs *next_rr;
1044 
1045  uint16_t keytag;
1046  size_t i;
1047 
1048  if (!cur_rr) {
1049  switch(func(NULL, arg)) {
1052  break;
1055  ldns_key_list_set_use(key_list, false);
1056  break;
1057  default:
1058 #ifdef STDERR_MSGS
1059  fprintf(stderr, "[XX] unknown return value from callback\n");
1060 #endif
1061  break;
1062  }
1063  return NULL;
1064  }
1065  (void)func(cur_rr->rr, arg);
1066 
1067  while (cur_rr) {
1068  next_rr = cur_rr->next;
1069 
1070  switch (func(cur_rr->rr, arg)) {
1072  prev_rr = cur_rr;
1073  break;
1075  keytag = ldns_rdf2native_int16(
1076  ldns_rr_rrsig_keytag(cur_rr->rr));
1077  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1078  if (ldns_key_keytag(ldns_key_list_key(key_list, i)) ==
1079  keytag) {
1080  ldns_key_set_use(ldns_key_list_key(key_list, i),
1081  false);
1082  }
1083  }
1084  prev_rr = cur_rr;
1085  break;
1087  keytag = ldns_rdf2native_int16(
1088  ldns_rr_rrsig_keytag(cur_rr->rr));
1089  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1090  if (ldns_key_keytag(ldns_key_list_key(key_list, i))
1091  == keytag) {
1092  ldns_key_set_use(ldns_key_list_key(key_list, i),
1093  false);
1094  }
1095  }
1096  if (prev_rr) {
1097  prev_rr->next = next_rr;
1098  } else {
1099  base_rrs = next_rr;
1100  }
1101  LDNS_FREE(cur_rr);
1102  break;
1104  if (prev_rr) {
1105  prev_rr->next = next_rr;
1106  } else {
1107  base_rrs = next_rr;
1108  }
1109  LDNS_FREE(cur_rr);
1110  break;
1111  default:
1112 #ifdef STDERR_MSGS
1113  fprintf(stderr, "[XX] unknown return value from callback\n");
1114 #endif
1115  break;
1116  }
1117  cur_rr = next_rr;
1118  }
1119 
1120  return base_rrs;
1121 }
1122 
1123 #ifdef HAVE_SSL
1126  ldns_rr_list *new_rrs,
1127  ldns_key_list *key_list,
1128  int (*func)(ldns_rr *, void*),
1129  void *arg)
1130 {
1131  return ldns_dnssec_zone_create_rrsigs_flg(zone, new_rrs, key_list,
1132  func, arg, 0);
1133 }
1134 
1136 static void
1137 ldns_key_list_filter_for_dnskey(ldns_key_list *key_list, int flags)
1138 {
1139  bool algos[256]
1140 #ifndef S_SPLINT_S
1141  = { false }
1142 #endif
1143  ;
1144  ldns_signing_algorithm saw_ksk = 0;
1145  ldns_key *key;
1146  size_t i;
1147 
1148  if (!ldns_key_list_key_count(key_list))
1149  return;
1150 
1151  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1152  key = ldns_key_list_key(key_list, i);
1153  if ((ldns_key_flags(key) & LDNS_KEY_SEP_KEY) && !saw_ksk)
1154  saw_ksk = ldns_key_algorithm(key);
1155  algos[ldns_key_algorithm(key)] = true;
1156  }
1157  if (!saw_ksk)
1158  return;
1159  else
1160  algos[saw_ksk] = 0;
1161 
1162  for (i =0; i < ldns_key_list_key_count(key_list); i++) {
1163  key = ldns_key_list_key(key_list, i);
1164  if (!(ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
1165  /* We have a ZSK.
1166  * Still use it if it has a unique algorithm though!
1167  */
1168  if ((flags & LDNS_SIGN_WITH_ALL_ALGORITHMS) &&
1169  algos[ldns_key_algorithm(key)])
1170  algos[ldns_key_algorithm(key)] = false;
1171  else
1172  ldns_key_set_use(key, 0);
1173  }
1174  }
1175 }
1176 
1178 static void
1179 ldns_key_list_filter_for_non_dnskey(ldns_key_list *key_list, int flags)
1180 {
1181  bool algos[256]
1182 #ifndef S_SPLINT_S
1183  = { false }
1184 #endif
1185  ;
1186  ldns_signing_algorithm saw_zsk = 0;
1187  ldns_key *key;
1188  size_t i;
1189 
1190  if (!ldns_key_list_key_count(key_list))
1191  return;
1192 
1193  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1194  key = ldns_key_list_key(key_list, i);
1195  if (!(ldns_key_flags(key) & LDNS_KEY_SEP_KEY) && !saw_zsk)
1196  saw_zsk = ldns_key_algorithm(key);
1197  algos[ldns_key_algorithm(key)] = true;
1198  }
1199  if (!saw_zsk)
1200  return;
1201  else
1202  algos[saw_zsk] = 0;
1203 
1204  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1205  key = ldns_key_list_key(key_list, i);
1206  if((ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
1207  /* We have a KSK.
1208  * Still use it if it has a unique algorithm though!
1209  */
1210  if ((flags & LDNS_SIGN_WITH_ALL_ALGORITHMS) &&
1211  algos[ldns_key_algorithm(key)])
1212  algos[ldns_key_algorithm(key)] = false;
1213  else
1214  ldns_key_set_use(key, 0);
1215  }
1216  }
1217 }
1218 
1221  , ldns_rr_list *new_rrs
1222  , ldns_key_list *key_list
1223  , int (*func)(ldns_rr *, void*)
1224  , void *arg
1225  , int flags
1226  )
1227 {
1228  ldns_status result = LDNS_STATUS_OK;
1229 
1230  ldns_rbnode_t *cur_node;
1231  ldns_rr_list *rr_list;
1232 
1233  ldns_dnssec_name *cur_name;
1234  ldns_dnssec_rrsets *cur_rrset;
1235  ldns_dnssec_rrs *cur_rr;
1236 
1237  ldns_rr_list *siglist;
1238 
1239  size_t i;
1240 
1241  int on_delegation_point = 0; /* handle partially occluded names */
1242 
1243  ldns_rr_list *pubkey_list = ldns_rr_list_new();
1244  for (i = 0; i<ldns_key_list_key_count(key_list); i++) {
1245  ldns_rr_list_push_rr( pubkey_list
1247  key_list, i))
1248  );
1249  }
1250  /* TODO: callback to see is list should be signed */
1251  /* TODO: remove 'old' signatures from signature list */
1252  cur_node = ldns_rbtree_first(zone->names);
1253  while (cur_node != LDNS_RBTREE_NULL) {
1254  cur_name = (ldns_dnssec_name *) cur_node->data;
1255 
1256  if (!cur_name->is_glue) {
1257  on_delegation_point = ldns_dnssec_rrsets_contains_type(
1258  cur_name->rrsets, LDNS_RR_TYPE_NS)
1260  cur_name->rrsets, LDNS_RR_TYPE_SOA);
1261  cur_rrset = cur_name->rrsets;
1262  while (cur_rrset) {
1263  /* reset keys to use */
1264  ldns_key_list_set_use(key_list, true);
1265 
1266  /* walk through old sigs, remove the old,
1267  and mark which keys (not) to use) */
1268  cur_rrset->signatures =
1270  key_list,
1271  func,
1272  arg);
1273  if(cur_rrset->type == LDNS_RR_TYPE_DNSKEY ||
1274  cur_rrset->type == LDNS_RR_TYPE_CDNSKEY ||
1275  cur_rrset->type == LDNS_RR_TYPE_CDS) {
1276  if(!(flags&LDNS_SIGN_DNSKEY_WITH_ZSK)) {
1277  ldns_key_list_filter_for_dnskey(key_list, flags);
1278  }
1279  } else {
1280  ldns_key_list_filter_for_non_dnskey(key_list, flags);
1281  }
1282 
1283  /* TODO: just set count to zero? */
1284  rr_list = ldns_rr_list_new();
1285 
1286  cur_rr = cur_rrset->rrs;
1287  while (cur_rr) {
1288  ldns_rr_list_push_rr(rr_list, cur_rr->rr);
1289  cur_rr = cur_rr->next;
1290  }
1291 
1292  /* only sign non-delegation RRsets */
1293  /* (glue should have been marked earlier,
1294  * except on the delegation points itself) */
1295  if (!on_delegation_point ||
1296  ldns_rr_list_type(rr_list)
1297  == LDNS_RR_TYPE_DS ||
1298  ldns_rr_list_type(rr_list)
1299  == LDNS_RR_TYPE_NSEC ||
1300  ldns_rr_list_type(rr_list)
1301  == LDNS_RR_TYPE_NSEC3) {
1302  siglist = ldns_sign_public(rr_list, key_list);
1303  for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
1304  if (cur_rrset->signatures) {
1305  result = ldns_dnssec_rrs_add_rr(cur_rrset->signatures,
1306  ldns_rr_list_rr(siglist,
1307  i));
1308  } else {
1309  cur_rrset->signatures = ldns_dnssec_rrs_new();
1310  cur_rrset->signatures->rr =
1311  ldns_rr_list_rr(siglist, i);
1312  }
1313  if (new_rrs) {
1314  ldns_rr_list_push_rr(new_rrs,
1315  ldns_rr_list_rr(siglist,
1316  i));
1317  }
1318  }
1319  ldns_rr_list_free(siglist);
1320  }
1321 
1322  ldns_rr_list_free(rr_list);
1323 
1324  cur_rrset = cur_rrset->next;
1325  }
1326 
1327  /* sign the nsec */
1328  ldns_key_list_set_use(key_list, true);
1329  cur_name->nsec_signatures =
1331  key_list,
1332  func,
1333  arg);
1334  ldns_key_list_filter_for_non_dnskey(key_list, flags);
1335 
1336  rr_list = ldns_rr_list_new();
1337  ldns_rr_list_push_rr(rr_list, cur_name->nsec);
1338  siglist = ldns_sign_public(rr_list, key_list);
1339 
1340  for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
1341  if (cur_name->nsec_signatures) {
1342  result = ldns_dnssec_rrs_add_rr(cur_name->nsec_signatures,
1343  ldns_rr_list_rr(siglist, i));
1344  } else {
1345  cur_name->nsec_signatures = ldns_dnssec_rrs_new();
1346  cur_name->nsec_signatures->rr =
1347  ldns_rr_list_rr(siglist, i);
1348  }
1349  if (new_rrs) {
1350  ldns_rr_list_push_rr(new_rrs,
1351  ldns_rr_list_rr(siglist, i));
1352  }
1353  }
1354 
1355  ldns_rr_list_free(siglist);
1356  ldns_rr_list_free(rr_list);
1357  }
1358  cur_node = ldns_rbtree_next(cur_node);
1359  }
1360 
1361  ldns_rr_list_deep_free(pubkey_list);
1362  return result;
1363 }
1364 
1367  ldns_rr_list *new_rrs,
1368  ldns_key_list *key_list,
1369  int (*func)(ldns_rr *, void *),
1370  void *arg)
1371 {
1372  return ldns_dnssec_zone_sign_flg(zone, new_rrs, key_list, func, arg, 0);
1373 }
1374 
1377  ldns_rr_list *new_rrs,
1378  ldns_key_list *key_list,
1379  int (*func)(ldns_rr *, void *),
1380  void *arg,
1381  int flags)
1382 {
1383  ldns_status result = LDNS_STATUS_OK;
1384 
1385  if (!zone || !new_rrs || !key_list) {
1386  return LDNS_STATUS_ERR;
1387  }
1388 
1389  /* zone is already sorted */
1390  result = ldns_dnssec_zone_mark_glue(zone);
1391  if (result != LDNS_STATUS_OK) {
1392  return result;
1393  }
1394 
1395  /* check whether we need to add nsecs */
1396  if (zone->names && !((ldns_dnssec_name *)zone->names->root->data)->nsec) {
1397  result = ldns_dnssec_zone_create_nsecs(zone, new_rrs);
1398  if (result != LDNS_STATUS_OK) {
1399  return result;
1400  }
1401  }
1402 
1403  result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1404  new_rrs,
1405  key_list,
1406  func,
1407  arg,
1408  flags);
1409 
1410  return result;
1411 }
1412 
1415  ldns_rr_list *new_rrs,
1416  ldns_key_list *key_list,
1417  int (*func)(ldns_rr *, void *),
1418  void *arg,
1419  uint8_t algorithm,
1420  uint8_t flags,
1421  uint16_t iterations,
1422  uint8_t salt_length,
1423  uint8_t *salt)
1424 {
1425  return ldns_dnssec_zone_sign_nsec3_flg_mkmap(zone, new_rrs, key_list,
1426  func, arg, algorithm, flags, iterations, salt_length, salt, 0,
1427  NULL);
1428 }
1429 
1432  ldns_rr_list *new_rrs,
1433  ldns_key_list *key_list,
1434  int (*func)(ldns_rr *, void *),
1435  void *arg,
1436  uint8_t algorithm,
1437  uint8_t flags,
1438  uint16_t iterations,
1439  uint8_t salt_length,
1440  uint8_t *salt,
1441  int signflags,
1442  ldns_rbtree_t **map)
1443 {
1444  ldns_rr *nsec3, *nsec3param;
1445  ldns_status result = LDNS_STATUS_OK;
1446 
1447  /* zone is already sorted */
1448  result = ldns_dnssec_zone_mark_glue(zone);
1449  if (result != LDNS_STATUS_OK) {
1450  return result;
1451  }
1452 
1453  /* TODO if there are already nsec3s presents and their
1454  * parameters are the same as these, we don't have to recreate
1455  */
1456  if (zone->names) {
1457  /* add empty nonterminals */
1459  if (result != LDNS_STATUS_OK) {
1460  return result;
1461  }
1462 
1463  nsec3 = ((ldns_dnssec_name *)zone->names->root->data)->nsec;
1464  if (nsec3 && ldns_rr_get_type(nsec3) == LDNS_RR_TYPE_NSEC3) {
1465  /* no need to recreate */
1466  } else {
1467  if (!ldns_dnssec_zone_find_rrset(zone,
1468  zone->soa->name,
1470  /* create and add the nsec3param rr */
1471  nsec3param =
1473  ldns_rr_set_owner(nsec3param,
1474  ldns_rdf_clone(zone->soa->name));
1475  ldns_nsec3_add_param_rdfs(nsec3param,
1476  algorithm,
1477  flags,
1478  iterations,
1479  salt_length,
1480  salt);
1481  /* always set bit 7 of the flags to zero, according to
1482  * rfc5155 section 11. The bits are counted from right to left,
1483  * so bit 7 in rfc5155 is bit 0 in ldns */
1484  ldns_set_bit(ldns_rdf_data(ldns_rr_rdf(nsec3param, 1)), 0, 0);
1485  result = ldns_dnssec_zone_add_rr(zone, nsec3param);
1486  if (result != LDNS_STATUS_OK) {
1487  return result;
1488  }
1489  ldns_rr_list_push_rr(new_rrs, nsec3param);
1490  }
1491  result = ldns_dnssec_zone_create_nsec3s_mkmap(zone,
1492  new_rrs,
1493  algorithm,
1494  flags,
1495  iterations,
1496  salt_length,
1497  salt,
1498  map);
1499  if (result != LDNS_STATUS_OK) {
1500  return result;
1501  }
1502  }
1503 
1504  result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1505  new_rrs,
1506  key_list,
1507  func,
1508  arg,
1509  signflags);
1510  }
1511 
1512  return result;
1513 }
1514 
1517  ldns_rr_list *new_rrs,
1518  ldns_key_list *key_list,
1519  int (*func)(ldns_rr *, void *),
1520  void *arg,
1521  uint8_t algorithm,
1522  uint8_t flags,
1523  uint16_t iterations,
1524  uint8_t salt_length,
1525  uint8_t *salt,
1526  int signflags)
1527 {
1528  return ldns_dnssec_zone_sign_nsec3_flg_mkmap(zone, new_rrs, key_list,
1529  func, arg, algorithm, flags, iterations, salt_length, salt,
1530  signflags, NULL);
1531 }
1532 
1533 ldns_zone *
1534 ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
1535 {
1536  ldns_dnssec_zone *dnssec_zone;
1537  ldns_zone *signed_zone;
1538  ldns_rr_list *new_rrs;
1539  size_t i;
1540 
1541  signed_zone = ldns_zone_new();
1542  dnssec_zone = ldns_dnssec_zone_new();
1543 
1544  (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1545  ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1546 
1547  for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1548  (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1550  i));
1551  ldns_zone_push_rr(signed_zone,
1553  i)));
1554  }
1555 
1556  new_rrs = ldns_rr_list_new();
1557  (void) ldns_dnssec_zone_sign(dnssec_zone,
1558  new_rrs,
1559  key_list,
1561  NULL);
1562 
1563  for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1564  ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1565  ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1566  }
1567 
1568  ldns_rr_list_deep_free(new_rrs);
1569  ldns_dnssec_zone_free(dnssec_zone);
1570 
1571  return signed_zone;
1572 }
1573 
1574 ldns_zone *
1575 ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
1576 {
1577  ldns_dnssec_zone *dnssec_zone;
1578  ldns_zone *signed_zone;
1579  ldns_rr_list *new_rrs;
1580  size_t i;
1581 
1582  signed_zone = ldns_zone_new();
1583  dnssec_zone = ldns_dnssec_zone_new();
1584 
1585  (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1586  ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1587 
1588  for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1589  (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1591  i));
1592  ldns_zone_push_rr(signed_zone,
1594  i)));
1595  }
1596 
1597  new_rrs = ldns_rr_list_new();
1598  (void) ldns_dnssec_zone_sign_nsec3(dnssec_zone,
1599  new_rrs,
1600  key_list,
1602  NULL,
1603  algorithm,
1604  flags,
1605  iterations,
1606  salt_length,
1607  salt);
1608 
1609  for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1610  ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1611  ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1612  }
1613 
1614  ldns_rr_list_deep_free(new_rrs);
1615  ldns_dnssec_zone_free(dnssec_zone);
1616 
1617  return signed_zone;
1618 }
1619 #endif /* HAVE_SSL */
1620 
1621 
void ldns_buffer_free(ldns_buffer *buffer)
frees the buffer.
Definition: buffer.c:137
ldns_buffer * ldns_buffer_new(size_t capacity)
creates a new buffer with the specified capacity.
Definition: buffer.c:16
#define ATTR_UNUSED(x)
Definition: common.h:69
#define HAVE_EVP_PKEY_GET_BASE_ID
Definition: config.h:99
int ldns_dname_compare_v(const void *a, const void *b)
Given in dnssec_zone.c, also used in dnssec_sign.c:w.
Definition: dnssec_zone.c:828
int ldns_dname_is_wildcard(const ldns_rdf *dname)
Check if dname is a wildcard, starts with *.
Definition: dname.c:456
bool ldns_dname_is_subdomain(const ldns_rdf *sub, const ldns_rdf *parent)
test whether the name sub falls under parent (i.e.
Definition: dname.c:296
void ldns_dname2canonical(const ldns_rdf *rd)
Put a dname into canonical fmt - ie.
Definition: dname.c:280
uint8_t ldns_dname_label_count(const ldns_rdf *r)
count the number of labels inside a LDNS_RDF_DNAME type rdf.
Definition: dname.c:214
ldns_rdf * ldns_dname_label(const ldns_rdf *rdf, uint8_t labelpos)
look inside the rdf and if it is an LDNS_RDF_TYPE_DNAME try and retrieve a specific label.
Definition: dname.c:560
ldns_rr * ldns_dnssec_create_nsec3(const ldns_dnssec_name *from, const ldns_dnssec_name *to, const ldns_rdf *zone_name, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t *salt)
Creates NSEC3.
Definition: dnssec.c:867
ldns_rdf * ldns_convert_dsa_rrsig_asn12rdf(const ldns_buffer *sig, const long sig_len)
Converts the DSA signature from ASN1 representation (RFC2459, as used by OpenSSL) to raw signature da...
Definition: dnssec.c:1742
int ldns_dnssec_default_replace_signatures(ldns_rr *sig __attribute__((unused)), void *n __attribute__((unused)))
Definition: dnssec.c:1733
void ldns_nsec3_add_param_rdfs(ldns_rr *rr, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t *salt)
Sets all the NSEC3 options.
Definition: dnssec.c:1105
ldns_rdf * ldns_convert_ecdsa_rrsig_asn1len2rdf(const ldns_buffer *sig, const long sig_len, int num_bytes)
Converts the ECDSA signature from ASN1 representation (as used by OpenSSL) to raw signature data as u...
Definition: dnssec.c:1865
ldns_rr * ldns_dnssec_create_nsec(const ldns_dnssec_name *from, const ldns_dnssec_name *to, ldns_rr_type nsec_type)
Creates NSEC.
Definition: dnssec.c:813
ldns_status ldns_dnssec_chain_nsec3_list(ldns_rr_list *nsec3_rrs)
chains nsec3 list
Definition: dnssec.c:1630
int ldns_dnssec_rrsets_contains_type(const ldns_dnssec_rrsets *rrsets, ldns_rr_type type)
returns whether a rrset of the given type is found in the rrsets.
Definition: dnssec.c:799
This module contains base functions for DNSSEC operations (RFC4033 t/m RFC4035).
#define LDNS_DEFAULT_EXP_TIME
Definition: dnssec.h:44
#define LDNS_SIGNATURE_LEAVE_ADD_NEW
return values for the old-signature callback
Definition: dnssec.h:47
#define LDNS_SIGNATURE_REMOVE_NO_ADD
Definition: dnssec.h:50
#define LDNS_SIGNATURE_REMOVE_ADD_NEW
Definition: dnssec.h:49
#define LDNS_SIGNATURE_LEAVE_NO_ADD
Definition: dnssec.h:48
ldns_rr_list * ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
use this function to sign with a public/private key alg return the created signatures
Definition: dnssec_sign.c:224
ldns_rr * ldns_create_empty_rrsig(const ldns_rr_list *rrset, const ldns_key *current_key)
Create an empty RRSIG RR (i.e.
Definition: dnssec_sign.c:28
ldns_rdf * ldns_sign_public_rsamd5(ldns_buffer *to_sign, RSA *key)
Sign a buffer with the RSA key (hash with MD5)
Definition: dnssec_sign.c:613
ldns_rbnode_t * ldns_dnssec_name_node_next_nonglue(ldns_rbnode_t *node)
Finds the first dnssec_name node in the rbtree that is not occluded.
Definition: dnssec_sign.c:786
ldns_zone * ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
Signs the zone, and returns a newly allocated signed zone.
Definition: dnssec_sign.c:1534
ldns_status ldns_dnssec_zone_mark_glue(ldns_dnssec_zone *zone)
Marks the names in the zone that are occluded.
Definition: dnssec_sign.c:780
ldns_rdf * ldns_sign_public_evp(ldns_buffer *to_sign, EVP_PKEY *key, const EVP_MD *digest_type)
Sign data with EVP (general method for different algorithms)
Definition: dnssec_sign.c:448
ldns_status ldns_dnssec_zone_mark_and_get_glue(ldns_dnssec_zone *zone, ldns_rr_list *glue_list)
Marks the names in the zone that are occluded.
Definition: dnssec_sign.c:691
ldns_status ldns_dnssec_zone_create_nsec3s(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Adds NSEC3 records to the zone.
Definition: dnssec_sign.c:1019
ldns_status ldns_dnssec_zone_sign(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg)
signs the given zone with the given keys
Definition: dnssec_sign.c:1366
ldns_status ldns_dnssec_zone_sign_nsec3_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1516
ldns_status ldns_dnssec_zone_create_rrsigs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg)
Adds signatures to the zone.
Definition: dnssec_sign.c:1125
ldns_status ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags, ldns_rbtree_t **map)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1431
ldns_dnssec_rrs * ldns_dnssec_remove_signatures(ldns_dnssec_rrs *signatures, ldns_key_list *key_list __attribute__((unused)), int(*func)(ldns_rr *, void *), void *arg)
Definition: dnssec_sign.c:1034
ldns_status ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
signs the given zone with the given keys
Definition: dnssec_sign.c:1376
ldns_rdf * ldns_sign_public_dsa(ldns_buffer *to_sign, DSA *key)
Sign data with DSA.
Definition: dnssec_sign.c:337
ldns_zone * ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Signs the zone with NSEC3, and returns a newly allocated signed zone.
Definition: dnssec_sign.c:1575
ldns_status ldns_dnssec_zone_create_nsecs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs)
Adds NSEC records to the given dnssec_zone.
Definition: dnssec_sign.c:812
ldns_status ldns_dnssec_zone_sign_nsec3(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1414
ldns_status ldns_dnssec_zone_create_rrsigs_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
Adds signatures to the zone.
Definition: dnssec_sign.c:1220
ldns_rdf * ldns_sign_public_rsasha1(ldns_buffer *to_sign, RSA *key)
Sign a buffer with the RSA key (hash with SHA1)
Definition: dnssec_sign.c:577
ldns_rdf * ldns_sign_public_buffer(ldns_buffer *sign_buf, ldns_key *current_key)
Sign the buffer which contains the wiredata of an rrset, and the corresponding empty rrsig rr with th...
Definition: dnssec_sign.c:125
#define LDNS_SIGN_DNSKEY_WITH_ZSK
dnssec_verify
Definition: dnssec_sign.h:15
#define LDNS_SIGN_WITH_ALL_ALGORITHMS
Definition: dnssec_sign.h:16
ldns_dnssec_rrsets * ldns_dnssec_zone_find_rrset(const ldns_dnssec_zone *zone, const ldns_rdf *dname, ldns_rr_type type)
Find the RRset with the given name and type in the zone.
Definition: dnssec_zone.c:508
ldns_status ldns_dnssec_rrs_add_rr(ldns_dnssec_rrs *rrs, ldns_rr *rr)
Adds an RR to the list of RRs.
Definition: dnssec_zone.c:47
ldns_status ldns_dnssec_name_add_rr(ldns_dnssec_name *name, ldns_rr *rr)
Inserts the given rr at the right place in the current dnssec_name No checking is done whether the na...
Definition: dnssec_zone.c:448
ldns_status ldns_dnssec_zone_add_rr(ldns_dnssec_zone *zone, ldns_rr *rr)
Adds the given RR to the zone.
Definition: dnssec_zone.c:928
ldns_status ldns_dnssec_zone_add_empty_nonterminals(ldns_dnssec_zone *zone)
Adds explicit dnssec_name structures for the empty nonterminals in this zone.
Definition: dnssec_zone.c:1179
ldns_rdf * ldns_dnssec_name_name(const ldns_dnssec_name *name)
Returns the domain name of the given dnssec_name structure.
Definition: dnssec_zone.c:394
void ldns_dnssec_zone_free(ldns_dnssec_zone *zone)
Frees the given zone structure, and its rbtree of dnssec_names Individual ldns_rr RRs within those na...
Definition: dnssec_zone.c:797
ldns_dnssec_rrs * ldns_dnssec_rrs_new(void)
Creates a new entry for 1 pointer to an rr and 1 pointer to the next rrs.
Definition: dnssec_zone.c:10
ldns_dnssec_rrsets * ldns_dnssec_name_find_rrset(const ldns_dnssec_name *name, ldns_rr_type type)
Find the RRset with the given type in within this name structure.
Definition: dnssec_zone.c:492
ldns_dnssec_zone * ldns_dnssec_zone_new(void)
Creates a new dnssec_zone structure.
Definition: dnssec_zone.c:569
@ LDNS_STATUS_NSEC3_DOMAINNAME_OVERFLOW
Definition: error.h:131
@ LDNS_STATUS_NULL
Definition: error.h:51
@ LDNS_STATUS_ERR
Definition: error.h:37
@ LDNS_STATUS_MEM_ERR
Definition: error.h:34
@ LDNS_STATUS_OK
Definition: error.h:26
enum ldns_enum_status ldns_status
Definition: error.h:134
ldns_status ldns_rr_list2buffer_wire(ldns_buffer *buffer, const ldns_rr_list *rr_list)
Copies the rr_list data to the buffer in wire format.
Definition: host2wire.c:156
ldns_status ldns_rrsig2buffer_wire(ldns_buffer *buffer, const ldns_rr *rr)
Converts a rrsig to wireformat BUT EXCLUDE the rrsig rdata This is needed in DNSSEC verification.
Definition: host2wire.c:294
uint32_t ldns_key_expiration(const ldns_key *k)
return the key's expiration date
Definition: keys.c:1562
EVP_PKEY * ldns_key_evp_key(const ldns_key *k)
returns the (openssl) EVP struct contained in the key
Definition: keys.c:1485
void ldns_key_set_use(ldns_key *k, bool v)
set the use flag
Definition: keys.c:1466
void ldns_key_list_set_use(ldns_key_list *keys, bool v)
Set the 'use' flag for all keys in the list.
Definition: keys.c:1581
ldns_rr * ldns_key2rr(const ldns_key *k)
converts a ldns_key to a public key rr If the key data exists at an external point,...
Definition: keys.c:1800
uint16_t ldns_key_keytag(const ldns_key *k)
return the keytag
Definition: keys.c:1568
ldns_signing_algorithm ldns_key_algorithm(const ldns_key *k)
return the signing alg of the key
Definition: keys.c:1460
uint32_t ldns_key_inception(const ldns_key *k)
return the key's inception date
Definition: keys.c:1556
ldns_rdf * ldns_key_pubkey_owner(const ldns_key *k)
return the public key's owner
Definition: keys.c:1574
uint16_t ldns_key_flags(const ldns_key *k)
return the flag of the key
Definition: keys.c:1550
size_t ldns_key_list_key_count(const ldns_key_list *key_list)
returns the number of keys in the key list
Definition: keys.c:1444
ldns_key * ldns_key_list_key(const ldns_key_list *key, size_t nr)
returns a pointer to the key in the list at the given position
Definition: keys.c:1450
bool ldns_key_use(const ldns_key *k)
return the use flag
Definition: keys.c:1474
#define LDNS_KEY_SEP_KEY
Definition: keys.h:38
enum ldns_enum_signing_algorithm ldns_signing_algorithm
Definition: keys.h:114
@ LDNS_SIGN_RSASHA1
Definition: keys.h:92
@ LDNS_SIGN_ECDSAP256SHA256
Definition: keys.h:99
@ LDNS_SIGN_DSA_NSEC3
Definition: keys.h:97
@ LDNS_SIGN_ECC_GOST
Definition: keys.h:98
@ LDNS_SIGN_RSASHA1_NSEC3
Definition: keys.h:94
@ LDNS_SIGN_ECDSAP384SHA384
Definition: keys.h:100
@ LDNS_SIGN_RSAMD5
Definition: keys.h:91
@ LDNS_SIGN_RSASHA512
Definition: keys.h:96
@ LDNS_SIGN_DSA
Definition: keys.h:93
@ LDNS_SIGN_RSASHA256
Definition: keys.h:95
#define LDNS_KEY_ZONE_KEY
Definition: keys.h:37
Including this file will include all ldns files, and define some lookup tables.
#define LDNS_DEFAULT_TTL
Definition: ldns.h:135
#define LDNS_MAX_PACKETLEN
Definition: packet.h:24
ldns_rbtree_t * ldns_rbtree_create(int(*cmpf)(const void *, const void *))
Create new tree (malloced) with given key compare function.
Definition: rbtree.c:80
void ldns_traverse_postorder(ldns_rbtree_t *tree, void(*func)(ldns_rbnode_t *, void *), void *arg)
Call function for all elements in the redblack tree, such that leaf elements are called before parent...
Definition: rbtree.c:666
ldns_rbnode_t * ldns_rbtree_first(const ldns_rbtree_t *rbtree)
Returns first (smallest) node in the tree.
Definition: rbtree.c:548
ldns_rbnode_t * ldns_rbtree_next(ldns_rbnode_t *node)
Returns next larger node in the tree.
Definition: rbtree.c:574
ldns_rbnode_t * ldns_rbtree_insert(ldns_rbtree_t *rbtree, ldns_rbnode_t *data)
Insert data into the tree.
Definition: rbtree.c:242
#define LDNS_RBTREE_NULL
The nullpointer, points to empty node.
Definition: rbtree.h:76
ldns_rdf * ldns_native2rdf_int8(ldns_rdf_type type, uint8_t value)
returns the rdf containing the native uint8_t repr.
Definition: rdata.c:126
void ldns_rdf_deep_free(ldns_rdf *rd)
frees a rdf structure and frees the data.
Definition: rdata.c:230
uint32_t ldns_rdf2native_int32(const ldns_rdf *rd)
returns the native uint32_t representation from the rdf.
Definition: rdata.c:98
uint16_t ldns_rdf2native_int16(const ldns_rdf *rd)
returns the native uint16_t representation from the rdf.
Definition: rdata.c:84
ldns_rdf * ldns_native2rdf_int16(ldns_rdf_type type, uint16_t value)
returns the rdf containing the native uint16_t representation.
Definition: rdata.c:132
size_t ldns_rdf_size(const ldns_rdf *rd)
returns the size of the rdf.
Definition: rdata.c:24
uint8_t * ldns_rdf_data(const ldns_rdf *rd)
returns the data of the rdf.
Definition: rdata.c:38
ldns_rdf * ldns_native2rdf_int32(ldns_rdf_type type, uint32_t value)
returns an rdf that contains the given int32 value.
Definition: rdata.c:147
void ldns_rdf_free(ldns_rdf *rd)
frees a rdf structure, leaving the data pointer intact.
Definition: rdata.c:241
ldns_rdf * ldns_rdf_clone(const ldns_rdf *rd)
clones a rdf structure.
Definition: rdata.c:222
ldns_rdf * ldns_rdf_new_frm_data(ldns_rdf_type type, size_t size, const void *data)
allocates a new rdf structure and fills it.
Definition: rdata.c:193
@ LDNS_RDF_TYPE_INT32
32 bits
Definition: rdata.h:56
@ LDNS_RDF_TYPE_B64
b64 string
Definition: rdata.h:68
@ LDNS_RDF_TYPE_TIME
time (32 bits)
Definition: rdata.h:84
@ LDNS_RDF_TYPE_INT8
8 bits
Definition: rdata.h:52
@ LDNS_RDF_TYPE_INT16
16 bits
Definition: rdata.h:54
@ LDNS_RDF_TYPE_ALG
a key algorithm
Definition: rdata.h:80
@ LDNS_RDF_TYPE_TYPE
a RR type
Definition: rdata.h:74
void ldns_rr_list_free(ldns_rr_list *rr_list)
frees an rr_list structure.
Definition: rr.c:1003
ldns_rr * ldns_rr_list_rr(const ldns_rr_list *rr_list, size_t nr)
returns a specific rr of an rrlist.
Definition: rr.c:982
uint32_t ldns_rr_ttl(const ldns_rr *rr)
returns the ttl of an rr structure.
Definition: rr.c:923
ldns_rdf * ldns_rr_owner(const ldns_rr *rr)
returns the owner name of an rr structure.
Definition: rr.c:911
void ldns_rr_list_deep_free(ldns_rr_list *rr_list)
frees an rr_list structure and all rrs contained therein.
Definition: rr.c:1012
void ldns_rr_free(ldns_rr *rr)
frees an RR structure
Definition: rr.c:75
void ldns_rr_set_owner(ldns_rr *rr, ldns_rdf *owner)
sets the owner in the rr structure.
Definition: rr.c:796
ldns_rr_type ldns_rr_list_type(const ldns_rr_list *rr_list)
Returns the type of the first element of the RR If there are no elements present, 0 is returned.
Definition: rr.c:2743
ldns_rr * ldns_rr_new_frm_type(ldns_rr_type t)
creates a new rr structure, based on the given type.
Definition: rr.c:42
void ldns_rr_list_sort(ldns_rr_list *unsorted)
sorts an rr_list (canonical wire format).
Definition: rr.c:1507
void ldns_rr2canonical(ldns_rr *rr)
converts each dname in a rr to its canonical form.
Definition: rr.c:1772
size_t ldns_rr_list_rr_count(const ldns_rr_list *rr_list)
returns the number of rr's in an rr_list.
Definition: rr.c:949
ldns_rr_type ldns_rr_get_type(const ldns_rr *rr)
returns the type of the rr.
Definition: rr.c:935
void ldns_rr_set_ttl(ldns_rr *rr, uint32_t ttl)
sets the ttl in the rr structure.
Definition: rr.c:808
bool ldns_rr_list_push_rr(ldns_rr_list *rr_list, const ldns_rr *rr)
pushes an rr to an rrlist.
Definition: rr.c:1124
ldns_rr_class ldns_rr_get_class(const ldns_rr *rr)
returns the class of the rr.
Definition: rr.c:941
void ldns_rr_set_class(ldns_rr *rr, ldns_rr_class rr_class)
sets the class in the rr.
Definition: rr.c:826
ldns_rr_list * ldns_rr_list_new(void)
creates a new rr_list structure.
Definition: rr.c:992
ldns_rr * ldns_rr_clone(const ldns_rr *rr)
clones a rr and all its data
Definition: rr.c:1391
ldns_rr_list * ldns_rr_list_clone(const ldns_rr_list *rrlist)
clones an rrlist.
Definition: rr.c:1422
ldns_rdf * ldns_rr_rdf(const ldns_rr *rr, size_t nr)
returns the rdata field member counter.
Definition: rr.c:901
ldns_rdf * ldns_rr_pop_rdf(ldns_rr *rr)
removes a rd_field member, it will be popped from the last position.
Definition: rr.c:872
@ LDNS_RR_TYPE_RRSIG
DNSSEC.
Definition: rr.h:170
@ LDNS_RR_TYPE_A
a host address
Definition: rr.h:80
@ LDNS_RR_TYPE_DNSKEY
Definition: rr.h:172
@ LDNS_RR_TYPE_SOA
marks the start of a zone of authority
Definition: rr.h:90
@ LDNS_RR_TYPE_NSEC
Definition: rr.h:171
@ LDNS_RR_TYPE_DNAME
RFC2672.
Definition: rr.h:156
@ LDNS_RR_TYPE_DS
RFC4034, RFC3658.
Definition: rr.h:164
@ LDNS_RR_TYPE_NSEC3PARAM
Definition: rr.h:177
@ LDNS_RR_TYPE_NSEC3
Definition: rr.h:176
@ LDNS_RR_TYPE_CDNSKEY
Definition: rr.h:191
@ LDNS_RR_TYPE_AAAA
ipv6 address
Definition: rr.h:134
@ LDNS_RR_TYPE_NS
an authoritative name server
Definition: rr.h:82
@ LDNS_RR_TYPE_CDS
Definition: rr.h:190
enum ldns_enum_rr_class ldns_rr_class
Definition: rr.h:61
bool ldns_rr_rrsig_set_expiration(ldns_rr *r, ldns_rdf *f)
sets the expireation date of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:165
bool ldns_rr_rrsig_set_keytag(ldns_rr *r, ldns_rdf *f)
sets the keytag of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:189
bool ldns_rr_rrsig_set_algorithm(ldns_rr *r, ldns_rdf *f)
sets the algorithm of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:129
ldns_rdf * ldns_rr_rrsig_keytag(const ldns_rr *r)
returns the keytag of a LDNS_RR_TYPE_RRSIG RR
Definition: rr_functions.c:183
bool ldns_rr_rrsig_set_typecovered(ldns_rr *r, ldns_rdf *f)
sets the typecovered of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:117
bool ldns_rr_rrsig_set_labels(ldns_rr *r, ldns_rdf *f)
sets the number of labels of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:141
bool ldns_rr_rrsig_set_inception(ldns_rr *r, ldns_rdf *f)
sets the inception date of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:177
bool ldns_rr_rrsig_set_signame(ldns_rr *r, ldns_rdf *f)
sets the signers name of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:201
bool ldns_rr_rrsig_set_sig(ldns_rr *r, ldns_rdf *f)
sets the signature data of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:213
bool ldns_rr_rrsig_set_origttl(ldns_rr *r, ldns_rdf *f)
sets the original TTL of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:153
#define R(b, x)
Definition: sha2.c:191
The rbnode_t struct definition.
Definition: rbtree.h:60
const void * data
pointer to data
Definition: rbtree.h:70
const void * key
pointer to sorting key
Definition: rbtree.h:68
definition for tree struct
Definition: rbtree.h:83
ldns_rbnode_t * root
The root of the red-black tree.
Definition: rbtree.h:85
implementation of buffers to ease operations
Definition: buffer.h:51
ldns_dnssec_rrs * nsec_signatures
signatures for the NSEC record
Definition: dnssec_zone.h:71
ldns_rr * nsec
NSEC pointing to the next name (or NSEC3 pointing to the next NSEC3)
Definition: dnssec_zone.h:67
bool is_glue
Unlike what the name is_glue suggests, this field is set to true by ldns_dnssec_zone_mark_glue() or l...
Definition: dnssec_zone.h:81
ldns_rdf * hashed_name
pointer to store the hashed name (only used when in an NSEC3 zone
Definition: dnssec_zone.h:85
ldns_dnssec_rrsets * rrsets
The rrsets for this name.
Definition: dnssec_zone.h:63
ldns_rdf * name
pointer to a dname containing the name.
Definition: dnssec_zone.h:51
ldns_dnssec_rrs * next
Definition: dnssec_zone.h:25
ldns_dnssec_rrs * rrs
Definition: dnssec_zone.h:34
ldns_dnssec_rrs * signatures
Definition: dnssec_zone.h:36
ldns_dnssec_rrsets * next
Definition: dnssec_zone.h:37
Structure containing a dnssec zone.
Definition: dnssec_zone.h:91
ldns_rbtree_t * hashed_names
tree of ldns_dnssec_names by nsec3 hashes (when applicible)
Definition: dnssec_zone.h:97
ldns_rbtree_t * names
tree of ldns_dnssec_names
Definition: dnssec_zone.h:95
ldns_dnssec_name * soa
points to the name containing the SOA RR
Definition: dnssec_zone.h:93
Same as rr_list, but now for keys.
Definition: keys.h:177
General key structure, can contain all types of keys that are used in DNSSEC.
Definition: keys.h:126
Resource record data field.
Definition: rdata.h:178
List or Set of Resource Records.
Definition: rr.h:336
Resource Record.
Definition: rr.h:308
DNS Zone.
Definition: zone.h:43
void ldns_set_bit(uint8_t *byte, int bit_nr, bool value)
sets the specified bit in the specified byte to 1 if value is true, 0 if false The bits are counted f...
Definition: util.c:72
#define LDNS_FREE(ptr)
Definition: util.h:60
#define LDNS_MALLOC(type)
Memory management macros.
Definition: util.h:49
#define LDNS_XMALLOC(type, count)
Definition: util.h:51
void ldns_zone_set_soa(ldns_zone *z, ldns_rr *soa)
Set the zone's soa record.
Definition: zone.c:29
ldns_zone * ldns_zone_new(void)
create a new ldns_zone structure
Definition: zone.c:165
ldns_rr_list * ldns_zone_rrs(const ldns_zone *z)
Get a list of a zone's content.
Definition: zone.c:35
bool ldns_zone_push_rr(ldns_zone *z, ldns_rr *rr)
push an single rr to a zone structure.
Definition: zone.c:53
ldns_rr * ldns_zone_soa(const ldns_zone *z)
Return the soa record of a zone.
Definition: zone.c:17