ldns  1.7.0
dnssec_sign.c
Go to the documentation of this file.
1 #include <ldns/config.h>
2 
3 #include <ldns/ldns.h>
4 
5 #include <ldns/dnssec.h>
6 #include <ldns/dnssec_sign.h>
7 
8 #include <strings.h>
9 #include <time.h>
10 
11 #ifdef HAVE_SSL
12 /* this entire file is rather useless when you don't have
13  * crypto...
14  */
15 #include <openssl/ssl.h>
16 #include <openssl/evp.h>
17 #include <openssl/rand.h>
18 #include <openssl/err.h>
19 #include <openssl/md5.h>
20 #include <openssl/bn.h>
21 #include <openssl/rsa.h>
22 #ifdef USE_DSA
23 #include <openssl/dsa.h>
24 #endif
25 #endif /* HAVE_SSL */
26 
27 #define LDNS_SIGN_WITH_ZONEMD ( LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA384 \
28  | LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA512 )
29 
30 ldns_rr *
32  const ldns_key *current_key)
33 {
34  uint32_t orig_ttl;
35  ldns_rr_class orig_class;
36  time_t now;
37  ldns_rr *current_sig;
38  uint8_t label_count;
39  ldns_rdf *signame;
40 
42  0)));
43  /* RFC4035 2.2: not counting the leftmost label if it is a wildcard */
45  label_count --;
46 
48 
49  /* set the type on the new signature */
50  orig_ttl = ldns_rr_ttl(ldns_rr_list_rr(rrset, 0));
51  orig_class = ldns_rr_get_class(ldns_rr_list_rr(rrset, 0));
52 
53  ldns_rr_set_ttl(current_sig, orig_ttl);
54  ldns_rr_set_class(current_sig, orig_class);
55  ldns_rr_set_owner(current_sig,
58  ldns_rr_list_rr(rrset,
59  0))));
60 
61  /* fill in what we know of the signature */
62 
63  /* set the orig_ttl */
65  current_sig,
67  orig_ttl));
68  /* the signers name */
69  signame = ldns_rdf_clone(ldns_key_pubkey_owner(current_key));
70  ldns_dname2canonical(signame);
72  current_sig,
73  signame);
74  /* label count - get it from the first rr in the rr_list */
76  current_sig,
78  label_count));
79  /* inception, expiration */
80  now = time(NULL);
81  if (ldns_key_inception(current_key) != 0) {
83  current_sig,
86  ldns_key_inception(current_key)));
87  } else {
89  current_sig,
91  }
92  if (ldns_key_expiration(current_key) != 0) {
94  current_sig,
97  ldns_key_expiration(current_key)));
98  } else {
100  current_sig,
103  now + LDNS_DEFAULT_EXP_TIME));
104  }
105 
107  current_sig,
109  ldns_key_keytag(current_key)));
110 
112  current_sig,
115  ldns_key_algorithm(current_key)));
116 
118  current_sig,
122  0))));
123  return current_sig;
124 }
125 
126 #ifdef HAVE_SSL
127 ldns_rdf *
129 {
130  ldns_rdf *b64rdf = NULL;
131 
132  switch(ldns_key_algorithm(current_key)) {
133 #ifdef USE_DSA
134  case LDNS_SIGN_DSA:
135  case LDNS_SIGN_DSA_NSEC3:
136  b64rdf = ldns_sign_public_evp(
137  sign_buf,
138  ldns_key_evp_key(current_key),
139 # ifdef HAVE_EVP_DSS1
140  EVP_dss1()
141 # else
142  EVP_sha1()
143 # endif
144  );
145  break;
146 #endif /* USE_DSA */
147  case LDNS_SIGN_RSASHA1:
149  b64rdf = ldns_sign_public_evp(
150  sign_buf,
151  ldns_key_evp_key(current_key),
152  EVP_sha1());
153  break;
154 #ifdef USE_SHA2
155  case LDNS_SIGN_RSASHA256:
156  b64rdf = ldns_sign_public_evp(
157  sign_buf,
158  ldns_key_evp_key(current_key),
159  EVP_sha256());
160  break;
161  case LDNS_SIGN_RSASHA512:
162  b64rdf = ldns_sign_public_evp(
163  sign_buf,
164  ldns_key_evp_key(current_key),
165  EVP_sha512());
166  break;
167 #endif /* USE_SHA2 */
168 #ifdef USE_GOST
169  case LDNS_SIGN_ECC_GOST:
170  b64rdf = ldns_sign_public_evp(
171  sign_buf,
172  ldns_key_evp_key(current_key),
173  EVP_get_digestbyname("md_gost94"));
174  break;
175 #endif /* USE_GOST */
176 #ifdef USE_ECDSA
178  b64rdf = ldns_sign_public_evp(
179  sign_buf,
180  ldns_key_evp_key(current_key),
181  EVP_sha256());
182  break;
184  b64rdf = ldns_sign_public_evp(
185  sign_buf,
186  ldns_key_evp_key(current_key),
187  EVP_sha384());
188  break;
189 #endif
190 #ifdef USE_ED25519
191  case LDNS_SIGN_ED25519:
192  b64rdf = ldns_sign_public_evp(
193  sign_buf,
194  ldns_key_evp_key(current_key),
195  NULL);
196  break;
197 #endif
198 #ifdef USE_ED448
199  case LDNS_SIGN_ED448:
200  b64rdf = ldns_sign_public_evp(
201  sign_buf,
202  ldns_key_evp_key(current_key),
203  NULL);
204  break;
205 #endif
206  case LDNS_SIGN_RSAMD5:
207  b64rdf = ldns_sign_public_evp(
208  sign_buf,
209  ldns_key_evp_key(current_key),
210  EVP_md5());
211  break;
212  default:
213  /* do _you_ know this alg? */
214  printf("unknown algorithm, ");
215  printf("is the one used available on this system?\n");
216  break;
217  }
218 
219  return b64rdf;
220 }
221 
226 ldns_rr_list *
228 {
229  ldns_rr_list *signatures;
230  ldns_rr_list *rrset_clone;
231  ldns_rr *current_sig;
232  ldns_rdf *b64rdf;
233  ldns_key *current_key;
234  size_t key_count;
235  uint16_t i;
236  ldns_buffer *sign_buf;
237  ldns_rdf *new_owner;
238 
239  if (!rrset || ldns_rr_list_rr_count(rrset) < 1 || !keys) {
240  return NULL;
241  }
242 
243  new_owner = NULL;
244 
245  /* prepare a signature and add all the know data
246  * prepare the rrset. Sign this together. */
247  rrset_clone = ldns_rr_list_clone(rrset);
248  if (!rrset_clone) {
249  return NULL;
250  }
251 
252  /* make it canonical */
253  for(i = 0; i < ldns_rr_list_rr_count(rrset_clone); i++) {
254  ldns_rr_set_ttl(ldns_rr_list_rr(rrset_clone, i),
255  ldns_rr_ttl(ldns_rr_list_rr(rrset, 0)));
256  ldns_rr2canonical(ldns_rr_list_rr(rrset_clone, i));
257  }
258  /* sort */
259  ldns_rr_list_sort(rrset_clone);
260 
261  signatures = ldns_rr_list_new();
262 
263  for (key_count = 0;
264  key_count < ldns_key_list_key_count(keys);
265  key_count++) {
266  if (!ldns_key_use(ldns_key_list_key(keys, key_count))) {
267  continue;
268  }
270  if (!sign_buf) {
271  ldns_rr_list_free(rrset_clone);
272  ldns_rr_list_free(signatures);
273  ldns_rdf_free(new_owner);
274  return NULL;
275  }
276  b64rdf = NULL;
277 
278  current_key = ldns_key_list_key(keys, key_count);
279  /* sign all RRs with keys that have ZSKbit, !SEPbit.
280  sign DNSKEY RRs with keys that have ZSKbit&SEPbit */
281  if (ldns_key_flags(current_key) & LDNS_KEY_ZONE_KEY) {
282  current_sig = ldns_create_empty_rrsig(rrset_clone,
283  current_key);
284 
285  /* right now, we have: a key, a semi-sig and an rrset. For
286  * which we can create the sig and base64 encode that and
287  * add that to the signature */
288 
289  if (ldns_rrsig2buffer_wire(sign_buf, current_sig)
290  != LDNS_STATUS_OK) {
291  ldns_buffer_free(sign_buf);
292  /* ERROR */
293  ldns_rr_list_deep_free(rrset_clone);
294  ldns_rr_free(current_sig);
295  ldns_rr_list_deep_free(signatures);
296  return NULL;
297  }
298 
299  /* add the rrset in sign_buf */
300  if (ldns_rr_list2buffer_wire(sign_buf, rrset_clone)
301  != LDNS_STATUS_OK) {
302  ldns_buffer_free(sign_buf);
303  ldns_rr_list_deep_free(rrset_clone);
304  ldns_rr_free(current_sig);
305  ldns_rr_list_deep_free(signatures);
306  return NULL;
307  }
308 
309  b64rdf = ldns_sign_public_buffer(sign_buf, current_key);
310 
311  if (!b64rdf) {
312  /* signing went wrong */
313  ldns_rr_list_deep_free(rrset_clone);
314  ldns_rr_free(current_sig);
315  ldns_rr_list_deep_free(signatures);
316  return NULL;
317  }
318 
319  ldns_rr_rrsig_set_sig(current_sig, b64rdf);
320 
321  /* push the signature to the signatures list */
322  ldns_rr_list_push_rr(signatures, current_sig);
323  }
324  ldns_buffer_free(sign_buf); /* restart for the next key */
325  }
326  ldns_rr_list_deep_free(rrset_clone);
327 
328  return signatures;
329 }
330 
339 ldns_rdf *
341 {
342 #ifdef USE_DSA
343  unsigned char *sha1_hash;
344  ldns_rdf *sigdata_rdf;
345  ldns_buffer *b64sig;
346 
347  DSA_SIG *sig;
348  const BIGNUM *R, *S;
349  uint8_t *data;
350  size_t pad;
351 
353  if (!b64sig) {
354  return NULL;
355  }
356 
357  sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
358  ldns_buffer_position(to_sign), NULL);
359  if (!sha1_hash) {
360  ldns_buffer_free(b64sig);
361  return NULL;
362  }
363 
364  sig = DSA_do_sign(sha1_hash, SHA_DIGEST_LENGTH, key);
365  if(!sig) {
366  ldns_buffer_free(b64sig);
367  return NULL;
368  }
369 
370  data = LDNS_XMALLOC(uint8_t, 1 + 2 * SHA_DIGEST_LENGTH);
371  if(!data) {
372  ldns_buffer_free(b64sig);
373  DSA_SIG_free(sig);
374  return NULL;
375  }
376 
377  data[0] = 1;
378 # ifdef HAVE_DSA_SIG_GET0
379  DSA_SIG_get0(sig, &R, &S);
380 # else
381  R = sig->r;
382  S = sig->s;
383 # endif
384  pad = 20 - (size_t) BN_num_bytes(R);
385  if (pad > 0) {
386  memset(data + 1, 0, pad);
387  }
388  BN_bn2bin(R, (unsigned char *) (data + 1) + pad);
389 
390  pad = 20 - (size_t) BN_num_bytes(S);
391  if (pad > 0) {
392  memset(data + 1 + SHA_DIGEST_LENGTH, 0, pad);
393  }
394  BN_bn2bin(S, (unsigned char *) (data + 1 + SHA_DIGEST_LENGTH + pad));
395 
397  1 + 2 * SHA_DIGEST_LENGTH,
398  data);
399 
400  ldns_buffer_free(b64sig);
401  LDNS_FREE(data);
402  DSA_SIG_free(sig);
403 
404  return sigdata_rdf;
405 #else
406  (void)to_sign; (void)key;
407  return NULL;
408 #endif
409 }
410 
411 #ifdef USE_ECDSA
412 #ifndef S_SPLINT_S
414 static int
415 ldns_pkey_is_ecdsa(EVP_PKEY* pkey)
416 {
417  EC_KEY* ec;
418  const EC_GROUP* g;
419 #ifdef HAVE_EVP_PKEY_GET_BASE_ID
420  if(EVP_PKEY_get_base_id(pkey) != EVP_PKEY_EC)
421  return 0;
422 #elif defined(HAVE_EVP_PKEY_BASE_ID)
423  if(EVP_PKEY_base_id(pkey) != EVP_PKEY_EC)
424  return 0;
425 #else
426  if(EVP_PKEY_type(pkey->type) != EVP_PKEY_EC)
427  return 0;
428 #endif
429  ec = EVP_PKEY_get1_EC_KEY(pkey);
430  g = EC_KEY_get0_group(ec);
431  if(!g) {
432  EC_KEY_free(ec);
433  return 0;
434  }
435  if(EC_GROUP_get_curve_name(g) == NID_X9_62_prime256v1) {
436  EC_KEY_free(ec);
437  return 32; /* 256/8 */
438  }
439  if(EC_GROUP_get_curve_name(g) == NID_secp384r1) {
440  EC_KEY_free(ec);
441  return 48; /* 384/8 */
442  }
443  /* downref the eckey, the original is still inside the pkey */
444  EC_KEY_free(ec);
445  return 0;
446 }
447 #endif /* splint */
448 #endif /* USE_ECDSA */
449 
450 ldns_rdf *
452  EVP_PKEY *key,
453  const EVP_MD *digest_type)
454 {
455  unsigned int siglen;
456  ldns_rdf *sigdata_rdf = NULL;
457  ldns_buffer *b64sig;
458  EVP_MD_CTX *ctx;
459  const EVP_MD *md_type;
460  int r;
461 
462  siglen = 0;
464  if (!b64sig) {
465  return NULL;
466  }
467 
468  /* initializes a signing context */
469  md_type = digest_type;
470 #ifdef USE_ED25519
471  if(EVP_PKEY_id(key) == NID_ED25519) {
472  /* digest must be NULL for ED25519 sign and verify */
473  md_type = NULL;
474  } else
475 #endif
476 #ifdef USE_ED448
477  if(EVP_PKEY_id(key) == NID_ED448) {
478  md_type = NULL;
479  } else
480 #endif
481  if(!md_type) {
482  /* unknown message digest */
483  ldns_buffer_free(b64sig);
484  return NULL;
485  }
486 
487 #ifdef HAVE_EVP_MD_CTX_NEW
488  ctx = EVP_MD_CTX_new();
489 #else
490  ctx = (EVP_MD_CTX*)malloc(sizeof(*ctx));
491  if(ctx) EVP_MD_CTX_init(ctx);
492 #endif
493  if(!ctx) {
494  ldns_buffer_free(b64sig);
495  return NULL;
496  }
497 
498 #if defined(USE_ED25519) || defined(USE_ED448)
499  if(md_type == NULL) {
500  /* for these methods we must use the one-shot DigestSign */
501  r = EVP_DigestSignInit(ctx, NULL, md_type, NULL, key);
502  if(r == 1) {
503  size_t siglen_sizet = ldns_buffer_capacity(b64sig);
504  r = EVP_DigestSign(ctx,
505  (unsigned char*)ldns_buffer_begin(b64sig),
506  &siglen_sizet,
507  (unsigned char*)ldns_buffer_begin(to_sign),
508  ldns_buffer_position(to_sign));
509  siglen = (unsigned int)siglen_sizet;
510  }
511  } else {
512 #else
513  r = 0;
514  if(md_type != NULL) {
515 #endif
516  r = EVP_SignInit(ctx, md_type);
517  if(r == 1) {
518  r = EVP_SignUpdate(ctx, (unsigned char*)
519  ldns_buffer_begin(to_sign),
520  ldns_buffer_position(to_sign));
521  }
522  if(r == 1) {
523  r = EVP_SignFinal(ctx, (unsigned char*)
524  ldns_buffer_begin(b64sig), &siglen, key);
525  }
526  }
527  if(r != 1) {
528  ldns_buffer_free(b64sig);
529  EVP_MD_CTX_destroy(ctx);
530  return NULL;
531  }
532 
533  /* OpenSSL output is different, convert it */
534  r = 0;
535 #ifdef USE_DSA
536 #ifndef S_SPLINT_S
537  /* unfortunately, OpenSSL output is different from DNS DSA format */
538 # ifdef HAVE_EVP_PKEY_GET_BASE_ID
539  if (EVP_PKEY_get_base_id(key) == EVP_PKEY_DSA) {
540 # elif defined(HAVE_EVP_PKEY_BASE_ID)
541  if (EVP_PKEY_base_id(key) == EVP_PKEY_DSA) {
542 # else
543  if (EVP_PKEY_type(key->type) == EVP_PKEY_DSA) {
544 # endif
545  r = 1;
546  sigdata_rdf = ldns_convert_dsa_rrsig_asn12rdf(b64sig, siglen);
547  }
548 #endif
549 #endif
550 #if defined(USE_ECDSA)
551  if(
553  EVP_PKEY_get_base_id(key)
554 # elif defined(HAVE_EVP_PKEY_BASE_ID)
555  EVP_PKEY_base_id(key)
556 # else
557  EVP_PKEY_type(key->type)
558 # endif
559  == EVP_PKEY_EC) {
560 # ifdef USE_ECDSA
561  if(ldns_pkey_is_ecdsa(key)) {
562  r = 1;
564  b64sig, (long)siglen, ldns_pkey_is_ecdsa(key));
565  }
566 # endif /* USE_ECDSA */
567  }
568 #endif /* PKEY_EC */
569  if(r == 0) {
570  /* ok output for other types is the same */
571  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
572  ldns_buffer_begin(b64sig));
573  }
574  ldns_buffer_free(b64sig);
575  EVP_MD_CTX_destroy(ctx);
576  return sigdata_rdf;
577 }
578 
579 ldns_rdf *
581 {
582  unsigned char *sha1_hash;
583  unsigned int siglen;
584  ldns_rdf *sigdata_rdf;
585  ldns_buffer *b64sig;
586  int result;
587 
588  siglen = 0;
590  if (!b64sig) {
591  return NULL;
592  }
593 
594  sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
595  ldns_buffer_position(to_sign), NULL);
596  if (!sha1_hash) {
597  ldns_buffer_free(b64sig);
598  return NULL;
599  }
600 
601  result = RSA_sign(NID_sha1, sha1_hash, SHA_DIGEST_LENGTH,
602  (unsigned char*)ldns_buffer_begin(b64sig),
603  &siglen, key);
604  if (result != 1) {
605  ldns_buffer_free(b64sig);
606  return NULL;
607  }
608 
609  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
610  ldns_buffer_begin(b64sig));
611  ldns_buffer_free(b64sig); /* can't free this buffer ?? */
612  return sigdata_rdf;
613 }
614 
615 ldns_rdf *
617 {
618  unsigned char *md5_hash;
619  unsigned int siglen;
620  ldns_rdf *sigdata_rdf;
621  ldns_buffer *b64sig;
622 
624  if (!b64sig) {
625  return NULL;
626  }
627 
628  md5_hash = MD5((unsigned char*)ldns_buffer_begin(to_sign),
629  ldns_buffer_position(to_sign), NULL);
630  if (!md5_hash) {
631  ldns_buffer_free(b64sig);
632  return NULL;
633  }
634 
635  RSA_sign(NID_md5, md5_hash, MD5_DIGEST_LENGTH,
636  (unsigned char*)ldns_buffer_begin(b64sig),
637  &siglen, key);
638 
639  sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
640  ldns_buffer_begin(b64sig));
641  ldns_buffer_free(b64sig);
642  return sigdata_rdf;
643 }
644 #endif /* HAVE_SSL */
645 
649 static ldns_status
650 ldns_dnssec_addresses_on_glue_list(
651  ldns_dnssec_rrsets *cur_rrset,
652  ldns_rr_list *glue_list)
653 {
654  ldns_dnssec_rrs *cur_rrs;
655  while (cur_rrset) {
656  if (cur_rrset->type == LDNS_RR_TYPE_A
657  || cur_rrset->type == LDNS_RR_TYPE_AAAA) {
658  for (cur_rrs = cur_rrset->rrs;
659  cur_rrs;
660  cur_rrs = cur_rrs->next) {
661  if (cur_rrs->rr) {
662  if (!ldns_rr_list_push_rr(glue_list,
663  cur_rrs->rr)) {
664  return LDNS_STATUS_MEM_ERR;
665  /* ldns_rr_list_push_rr()
666  * returns false when unable
667  * to increase the capacity
668  * of the ldns_rr_list
669  */
670  }
671  }
672  }
673  }
674  cur_rrset = cur_rrset->next;
675  }
676  return LDNS_STATUS_OK;
677 }
678 
695  ldns_rr_list *glue_list)
696 {
697  ldns_rbnode_t *node;
698  ldns_dnssec_name *name;
699  ldns_rdf *owner;
700  ldns_rdf *cut = NULL; /* keeps track of zone cuts */
701  /* When the cut is caused by a delegation, below_delegation will be 1.
702  * When caused by a DNAME, below_delegation will be 0.
703  */
704  int below_delegation = -1; /* init suppresses compiler warning */
705  ldns_status s;
706 
707  if (!zone || !zone->names) {
708  return LDNS_STATUS_NULL;
709  }
710  for (node = ldns_rbtree_first(zone->names);
711  node != LDNS_RBTREE_NULL;
712  node = ldns_rbtree_next(node)) {
713  name = (ldns_dnssec_name *) node->data;
714  owner = ldns_dnssec_name_name(name);
715 
716  if (cut) {
717  /* The previous node was a zone cut, or a subdomain
718  * below a zone cut. Is this node (still) a subdomain
719  * below the cut? Then the name is occluded. Unless
720  * the name contains a SOA, after which we are
721  * authoritative again.
722  *
723  * FIXME! If there are labels in between the SOA and
724  * the cut, going from the authoritative space (below
725  * the SOA) up into occluded space again, will not be
726  * detected with the construct below!
727  */
728  if (ldns_dname_is_subdomain(owner, cut) &&
730  name->rrsets, LDNS_RR_TYPE_SOA)) {
731 
732  if (below_delegation && glue_list) {
733  s = ldns_dnssec_addresses_on_glue_list(
734  name->rrsets, glue_list);
735  if (s != LDNS_STATUS_OK) {
736  return s;
737  }
738  }
739  name->is_glue = true; /* Mark occluded name! */
740  continue;
741  } else {
742  cut = NULL;
743  }
744  }
745 
746  /* The node is not below a zone cut. Is it a zone cut itself?
747  * Everything below a SOA is authoritative of course; Except
748  * when the name also contains a DNAME :).
749  */
751  name->rrsets, LDNS_RR_TYPE_NS)
753  name->rrsets, LDNS_RR_TYPE_SOA)) {
754  cut = owner;
755  below_delegation = 1;
756  if (glue_list) { /* record glue on the zone cut */
757  s = ldns_dnssec_addresses_on_glue_list(
758  name->rrsets, glue_list);
759  if (s != LDNS_STATUS_OK) {
760  return s;
761  }
762  }
764  name->rrsets, LDNS_RR_TYPE_DNAME)) {
765  cut = owner;
766  below_delegation = 0;
767  }
768  }
769  return LDNS_STATUS_OK;
770 }
771 
784 {
785  return ldns_dnssec_zone_mark_and_get_glue(zone, NULL);
786 }
787 
790 {
791  ldns_rbnode_t *next_node = NULL;
792  ldns_dnssec_name *next_name = NULL;
793  bool done = false;
794 
795  if (node == LDNS_RBTREE_NULL) {
796  return NULL;
797  }
798  next_node = node;
799  while (!done) {
800  if (next_node == LDNS_RBTREE_NULL) {
801  return NULL;
802  } else {
803  next_name = (ldns_dnssec_name *)next_node->data;
804  if (!next_name->is_glue) {
805  done = true;
806  } else {
807  next_node = ldns_rbtree_next(next_node);
808  }
809  }
810  }
811  return next_node;
812 }
813 
816  ldns_rr_list *new_rrs)
817 {
818 
819  ldns_rbnode_t *first_node, *cur_node, *next_node;
820  ldns_dnssec_name *cur_name, *next_name;
821  ldns_rr *nsec_rr;
822  uint32_t nsec_ttl;
823  ldns_dnssec_rrsets *soa;
824 
825  /* The TTL value for any NSEC RR SHOULD be the same TTL value as the
826  * lesser of the MINIMUM field of the SOA record and the TTL of the SOA
827  * itself. This matches the definition of the TTL for negative
828  * responses in [RFC2308]. (draft-ietf-dnsop-nsec-ttl-01 update of
829  * RFC4035 Section 2.3)
830  */
832 
833  /* did the caller actually set it? if not,
834  * fall back to default ttl
835  */
836  if (soa && soa->rrs && soa->rrs->rr) {
837  ldns_rr *soa_rr = soa->rrs->rr;
838  ldns_rdf *min_rdf = ldns_rr_rdf(soa_rr, 6);
839 
840  nsec_ttl = min_rdf == NULL
841  || ldns_rr_ttl(soa_rr) < ldns_rdf2native_int32(min_rdf)
842  ? ldns_rr_ttl(soa_rr) : ldns_rdf2native_int32(min_rdf);
843  } else {
844  nsec_ttl = LDNS_DEFAULT_TTL;
845  }
846 
848  ldns_rbtree_first(zone->names));
849  cur_node = first_node;
850  if (cur_node) {
852  ldns_rbtree_next(cur_node));
853  } else {
854  next_node = NULL;
855  }
856 
857  while (cur_node && next_node) {
858  cur_name = (ldns_dnssec_name *)cur_node->data;
859  next_name = (ldns_dnssec_name *)next_node->data;
860  nsec_rr = ldns_dnssec_create_nsec(cur_name,
861  next_name,
863  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
864  if(ldns_dnssec_name_add_rr(cur_name, nsec_rr)!=LDNS_STATUS_OK){
865  ldns_rr_free(nsec_rr);
866  return LDNS_STATUS_ERR;
867  }
868  ldns_rr_list_push_rr(new_rrs, nsec_rr);
869  cur_node = next_node;
870  if (cur_node) {
872  ldns_rbtree_next(cur_node));
873  }
874  }
875 
876  if (cur_node && !next_node) {
877  cur_name = (ldns_dnssec_name *)cur_node->data;
878  next_name = (ldns_dnssec_name *)first_node->data;
879  nsec_rr = ldns_dnssec_create_nsec(cur_name,
880  next_name,
882  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
883  if(ldns_dnssec_name_add_rr(cur_name, nsec_rr)!=LDNS_STATUS_OK){
884  ldns_rr_free(nsec_rr);
885  return LDNS_STATUS_ERR;
886  }
887  ldns_rr_list_push_rr(new_rrs, nsec_rr);
888  } else {
889  printf("error\n");
890  }
891 
892  return LDNS_STATUS_OK;
893 }
894 
895 #ifdef HAVE_SSL
896 static void
897 ldns_hashed_names_node_free(ldns_rbnode_t *node, void *arg) {
898  (void) arg;
899  LDNS_FREE(node);
900 }
901 
902 static ldns_status
903 ldns_dnssec_zone_create_nsec3s_mkmap(ldns_dnssec_zone *zone,
904  ldns_rr_list *new_rrs,
905  uint8_t algorithm,
906  uint8_t flags,
907  uint16_t iterations,
908  uint8_t salt_length,
909  uint8_t *salt,
910  ldns_rbtree_t **map)
911 {
912  ldns_rbnode_t *first_name_node;
913  ldns_rbnode_t *current_name_node;
914  ldns_dnssec_name *current_name;
915  ldns_status result = LDNS_STATUS_OK;
916  ldns_rr *nsec_rr;
917  ldns_rr_list *nsec3_list;
918  uint32_t nsec_ttl;
919  ldns_dnssec_rrsets *soa;
920  ldns_rbnode_t *hashmap_node;
921 
922  if (!zone || !new_rrs || !zone->names) {
923  return LDNS_STATUS_ERR;
924  }
925 
926  /* The TTL value for any NSEC RR SHOULD be the same TTL value as the
927  * lesser of the MINIMUM field of the SOA record and the TTL of the SOA
928  * itself. This matches the definition of the TTL for negative
929  * responses in [RFC2308]. (draft-ietf-dnsop-nsec-ttl-01 update of
930  * RFC4035 Section 2.3)
931  */
933 
934  /* did the caller actually set it? if not,
935  * fall back to default ttl
936  */
937  if (soa && soa->rrs && soa->rrs->rr) {
938  ldns_rr *soa_rr = soa->rrs->rr;
939  ldns_rdf *min_rdf = ldns_rr_rdf(soa_rr, 6);
940 
941  nsec_ttl = min_rdf == NULL
942  || ldns_rr_ttl(soa_rr) < ldns_rdf2native_int32(min_rdf)
943  ? ldns_rr_ttl(soa_rr) : ldns_rdf2native_int32(min_rdf);
944  } else {
945  nsec_ttl = LDNS_DEFAULT_TTL;
946  }
947 
948  if (ldns_rdf_size(zone->soa->name) > 222) {
950  }
951 
952  if (zone->hashed_names) {
954  ldns_hashed_names_node_free, NULL);
955  LDNS_FREE(zone->hashed_names);
956  }
958  if (zone->hashed_names && map) {
959  *map = zone->hashed_names;
960  }
961 
962  first_name_node = ldns_dnssec_name_node_next_nonglue(
963  ldns_rbtree_first(zone->names));
964 
965  current_name_node = first_name_node;
966 
967  while (current_name_node && current_name_node != LDNS_RBTREE_NULL &&
968  result == LDNS_STATUS_OK) {
969 
970  current_name = (ldns_dnssec_name *) current_name_node->data;
971  nsec_rr = ldns_dnssec_create_nsec3(current_name,
972  NULL,
973  zone->soa->name,
974  algorithm,
975  flags,
976  iterations,
977  salt_length,
978  salt);
979  /* by default, our nsec based generator adds rrsigs
980  * remove the bitmap for empty nonterminals */
981  if (!current_name->rrsets) {
983  }
984  ldns_rr_set_ttl(nsec_rr, nsec_ttl);
985  result = ldns_dnssec_name_add_rr(current_name, nsec_rr);
986  ldns_rr_list_push_rr(new_rrs, nsec_rr);
987  if (ldns_rr_owner(nsec_rr)) {
988  hashmap_node = LDNS_MALLOC(ldns_rbnode_t);
989  if (hashmap_node == NULL) {
990  return LDNS_STATUS_MEM_ERR;
991  }
992  current_name->hashed_name =
993  ldns_dname_label(ldns_rr_owner(nsec_rr), 0);
994 
995  if (current_name->hashed_name == NULL) {
996  LDNS_FREE(hashmap_node);
997  return LDNS_STATUS_MEM_ERR;
998  }
999  hashmap_node->key = current_name->hashed_name;
1000  hashmap_node->data = current_name;
1001 
1002  if (! ldns_rbtree_insert(zone->hashed_names
1003  , hashmap_node)) {
1004  LDNS_FREE(hashmap_node);
1005  }
1006  }
1007  current_name_node = ldns_dnssec_name_node_next_nonglue(
1008  ldns_rbtree_next(current_name_node));
1009  }
1010  if (result != LDNS_STATUS_OK) {
1011  return result;
1012  }
1013 
1014  /* Make sorted list of nsec3s (via zone->hashed_names)
1015  */
1016  nsec3_list = ldns_rr_list_new();
1017  if (nsec3_list == NULL) {
1018  return LDNS_STATUS_MEM_ERR;
1019  }
1020  for ( hashmap_node = ldns_rbtree_first(zone->hashed_names)
1021  ; hashmap_node != LDNS_RBTREE_NULL
1022  ; hashmap_node = ldns_rbtree_next(hashmap_node)
1023  ) {
1024  nsec_rr = ((ldns_dnssec_name *) hashmap_node->data)->nsec;
1025  if (nsec_rr) {
1026  ldns_rr_list_push_rr(nsec3_list, nsec_rr);
1027  }
1028  }
1029  result = ldns_dnssec_chain_nsec3_list(nsec3_list);
1030  ldns_rr_list_free(nsec3_list);
1031 
1032  return result;
1033 }
1034 
1037  ldns_rr_list *new_rrs,
1038  uint8_t algorithm,
1039  uint8_t flags,
1040  uint16_t iterations,
1041  uint8_t salt_length,
1042  uint8_t *salt)
1043 {
1044  return ldns_dnssec_zone_create_nsec3s_mkmap(zone, new_rrs, algorithm,
1045  flags, iterations, salt_length, salt, NULL);
1046 
1047 }
1048 #endif /* HAVE_SSL */
1049 
1052  , ATTR_UNUSED(ldns_key_list *key_list)
1053  , int (*func)(ldns_rr *, void *)
1054  , void *arg
1055  )
1056 {
1057  ldns_dnssec_rrs *base_rrs = signatures;
1058  ldns_dnssec_rrs *cur_rr = base_rrs;
1059  ldns_dnssec_rrs *prev_rr = NULL;
1060  ldns_dnssec_rrs *next_rr;
1061 
1062  uint16_t keytag;
1063  size_t i;
1064 
1065  if (!cur_rr) {
1066  switch(func(NULL, arg)) {
1069  break;
1072  ldns_key_list_set_use(key_list, false);
1073  break;
1074  default:
1075 #ifdef STDERR_MSGS
1076  fprintf(stderr, "[XX] unknown return value from callback\n");
1077 #endif
1078  break;
1079  }
1080  return NULL;
1081  }
1082  (void)func(cur_rr->rr, arg);
1083 
1084  while (cur_rr) {
1085  next_rr = cur_rr->next;
1086 
1087  switch (func(cur_rr->rr, arg)) {
1089  prev_rr = cur_rr;
1090  break;
1092  keytag = ldns_rdf2native_int16(
1093  ldns_rr_rrsig_keytag(cur_rr->rr));
1094  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1095  if (ldns_key_keytag(ldns_key_list_key(key_list, i)) ==
1096  keytag) {
1097  ldns_key_set_use(ldns_key_list_key(key_list, i),
1098  false);
1099  }
1100  }
1101  prev_rr = cur_rr;
1102  break;
1104  keytag = ldns_rdf2native_int16(
1105  ldns_rr_rrsig_keytag(cur_rr->rr));
1106  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1107  if (ldns_key_keytag(ldns_key_list_key(key_list, i))
1108  == keytag) {
1109  ldns_key_set_use(ldns_key_list_key(key_list, i),
1110  false);
1111  }
1112  }
1113  if (prev_rr) {
1114  prev_rr->next = next_rr;
1115  } else {
1116  base_rrs = next_rr;
1117  }
1118  LDNS_FREE(cur_rr);
1119  break;
1121  if (prev_rr) {
1122  prev_rr->next = next_rr;
1123  } else {
1124  base_rrs = next_rr;
1125  }
1126  LDNS_FREE(cur_rr);
1127  break;
1128  default:
1129 #ifdef STDERR_MSGS
1130  fprintf(stderr, "[XX] unknown return value from callback\n");
1131 #endif
1132  break;
1133  }
1134  cur_rr = next_rr;
1135  }
1136 
1137  return base_rrs;
1138 }
1139 
1140 #ifdef HAVE_SSL
1143  ldns_rr_list *new_rrs,
1144  ldns_key_list *key_list,
1145  int (*func)(ldns_rr *, void*),
1146  void *arg)
1147 {
1148  return ldns_dnssec_zone_create_rrsigs_flg(zone, new_rrs, key_list,
1149  func, arg, 0);
1150 }
1151 
1153 static void
1154 ldns_key_list_filter_for_dnskey(ldns_key_list *key_list, int flags)
1155 {
1156  bool algos[256]
1157 #ifndef S_SPLINT_S
1158  = { false }
1159 #endif
1160  ;
1161  ldns_signing_algorithm saw_ksk = 0;
1162  ldns_key *key;
1163  size_t i;
1164 
1165  if (!ldns_key_list_key_count(key_list))
1166  return;
1167 
1168  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1169  key = ldns_key_list_key(key_list, i);
1170  if ((ldns_key_flags(key) & LDNS_KEY_SEP_KEY) && !saw_ksk)
1171  saw_ksk = ldns_key_algorithm(key);
1172  algos[ldns_key_algorithm(key)] = true;
1173  }
1174  if (!saw_ksk)
1175  return;
1176  else
1177  algos[saw_ksk] = 0;
1178 
1179  for (i =0; i < ldns_key_list_key_count(key_list); i++) {
1180  key = ldns_key_list_key(key_list, i);
1181  if (!(ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
1182  /* We have a ZSK.
1183  * Still use it if it has a unique algorithm though!
1184  */
1185  if ((flags & LDNS_SIGN_WITH_ALL_ALGORITHMS) &&
1186  algos[ldns_key_algorithm(key)])
1187  algos[ldns_key_algorithm(key)] = false;
1188  else
1189  ldns_key_set_use(key, 0);
1190  }
1191  }
1192 }
1193 
1195 static void
1196 ldns_key_list_filter_for_non_dnskey(ldns_key_list *key_list, int flags)
1197 {
1198  bool algos[256]
1199 #ifndef S_SPLINT_S
1200  = { false }
1201 #endif
1202  ;
1203  ldns_signing_algorithm saw_zsk = 0;
1204  ldns_key *key;
1205  size_t i;
1206 
1207  if (!ldns_key_list_key_count(key_list))
1208  return;
1209 
1210  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1211  key = ldns_key_list_key(key_list, i);
1212  if (!(ldns_key_flags(key) & LDNS_KEY_SEP_KEY) && !saw_zsk)
1213  saw_zsk = ldns_key_algorithm(key);
1214  algos[ldns_key_algorithm(key)] = true;
1215  }
1216  if (!saw_zsk)
1217  return;
1218  else
1219  algos[saw_zsk] = 0;
1220 
1221  for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
1222  key = ldns_key_list_key(key_list, i);
1223  if((ldns_key_flags(key) & LDNS_KEY_SEP_KEY)) {
1224  /* We have a KSK.
1225  * Still use it if it has a unique algorithm though!
1226  */
1227  if ((flags & LDNS_SIGN_WITH_ALL_ALGORITHMS) &&
1228  algos[ldns_key_algorithm(key)])
1229  algos[ldns_key_algorithm(key)] = false;
1230  else
1231  ldns_key_set_use(key, 0);
1232  }
1233  }
1234 }
1235 
1238  , ldns_rr_list *new_rrs
1239  , ldns_key_list *key_list
1240  , int (*func)(ldns_rr *, void*)
1241  , void *arg
1242  , int flags
1243  )
1244 {
1245  ldns_status result = LDNS_STATUS_OK;
1246 
1247  ldns_rbnode_t *cur_node;
1248  ldns_rr_list *rr_list;
1249 
1250  ldns_dnssec_name *cur_name;
1251  ldns_dnssec_rrsets *cur_rrset;
1252  ldns_dnssec_rrs *cur_rr;
1253 
1254  ldns_rr_list *siglist;
1255 
1256  size_t i;
1257 
1258  int on_delegation_point = 0; /* handle partially occluded names */
1259 
1260  ldns_rr_list *pubkey_list = ldns_rr_list_new();
1261  for (i = 0; i<ldns_key_list_key_count(key_list); i++) {
1262  ldns_rr_list_push_rr( pubkey_list
1264  key_list, i))
1265  );
1266  }
1267  /* TODO: callback to see is list should be signed */
1268  /* TODO: remove 'old' signatures from signature list */
1269  cur_node = ldns_rbtree_first(zone->names);
1270  while (cur_node != LDNS_RBTREE_NULL) {
1271  cur_name = (ldns_dnssec_name *) cur_node->data;
1272 
1273  if (!cur_name->is_glue) {
1274  on_delegation_point = ldns_dnssec_rrsets_contains_type(
1275  cur_name->rrsets, LDNS_RR_TYPE_NS)
1277  cur_name->rrsets, LDNS_RR_TYPE_SOA);
1278  cur_rrset = cur_name->rrsets;
1279  while (cur_rrset) {
1280  /* reset keys to use */
1281  ldns_key_list_set_use(key_list, true);
1282 
1283  /* walk through old sigs, remove the old,
1284  and mark which keys (not) to use) */
1285  cur_rrset->signatures =
1287  key_list,
1288  func,
1289  arg);
1290  if(cur_rrset->type == LDNS_RR_TYPE_DNSKEY ||
1291  cur_rrset->type == LDNS_RR_TYPE_CDNSKEY ||
1292  cur_rrset->type == LDNS_RR_TYPE_CDS) {
1293  if(!(flags&LDNS_SIGN_DNSKEY_WITH_ZSK)) {
1294  ldns_key_list_filter_for_dnskey(key_list, flags);
1295  }
1296  } else {
1297  ldns_key_list_filter_for_non_dnskey(key_list, flags);
1298  }
1299 
1300  /* TODO: just set count to zero? */
1301  rr_list = ldns_rr_list_new();
1302 
1303  cur_rr = cur_rrset->rrs;
1304  while (cur_rr) {
1305  ldns_rr_list_push_rr(rr_list, cur_rr->rr);
1306  cur_rr = cur_rr->next;
1307  }
1308 
1309  /* only sign non-delegation RRsets */
1310  /* (glue should have been marked earlier,
1311  * except on the delegation points itself) */
1312  if (!on_delegation_point ||
1313  ldns_rr_list_type(rr_list)
1314  == LDNS_RR_TYPE_DS ||
1315  ldns_rr_list_type(rr_list)
1316  == LDNS_RR_TYPE_NSEC ||
1317  ldns_rr_list_type(rr_list)
1318  == LDNS_RR_TYPE_NSEC3) {
1319  siglist = ldns_sign_public(rr_list, key_list);
1320  for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
1321  if (cur_rrset->signatures) {
1322  result = ldns_dnssec_rrs_add_rr(cur_rrset->signatures,
1323  ldns_rr_list_rr(siglist,
1324  i));
1325  } else {
1326  cur_rrset->signatures = ldns_dnssec_rrs_new();
1327  cur_rrset->signatures->rr =
1328  ldns_rr_list_rr(siglist, i);
1329  }
1330  if (new_rrs) {
1331  ldns_rr_list_push_rr(new_rrs,
1332  ldns_rr_list_rr(siglist,
1333  i));
1334  }
1335  }
1336  ldns_rr_list_free(siglist);
1337  }
1338 
1339  ldns_rr_list_free(rr_list);
1340 
1341  cur_rrset = cur_rrset->next;
1342  }
1343 
1344  /* sign the nsec */
1345  ldns_key_list_set_use(key_list, true);
1346  cur_name->nsec_signatures =
1348  key_list,
1349  func,
1350  arg);
1351  ldns_key_list_filter_for_non_dnskey(key_list, flags);
1352 
1353  rr_list = ldns_rr_list_new();
1354  ldns_rr_list_push_rr(rr_list, cur_name->nsec);
1355  siglist = ldns_sign_public(rr_list, key_list);
1356 
1357  for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
1358  if (cur_name->nsec_signatures) {
1359  result = ldns_dnssec_rrs_add_rr(cur_name->nsec_signatures,
1360  ldns_rr_list_rr(siglist, i));
1361  } else {
1362  cur_name->nsec_signatures = ldns_dnssec_rrs_new();
1363  cur_name->nsec_signatures->rr =
1364  ldns_rr_list_rr(siglist, i);
1365  }
1366  if (new_rrs) {
1367  ldns_rr_list_push_rr(new_rrs,
1368  ldns_rr_list_rr(siglist, i));
1369  }
1370  }
1371 
1372  ldns_rr_list_free(siglist);
1373  ldns_rr_list_free(rr_list);
1374  }
1375  cur_node = ldns_rbtree_next(cur_node);
1376  }
1377 
1378  ldns_rr_list_deep_free(pubkey_list);
1379  return result;
1380 }
1381 
1384  ldns_rr_list *new_rrs,
1385  ldns_key_list *key_list,
1386  int (*func)(ldns_rr *, void *),
1387  void *arg)
1388 {
1389  return ldns_dnssec_zone_sign_flg(zone, new_rrs, key_list, func, arg, 0);
1390 }
1391 
1393  ldns_rr_list *new_rrs, ldns_key_list *key_list, int flags);
1396  ldns_rr_list *new_rrs,
1397  ldns_key_list *key_list,
1398  int (*func)(ldns_rr *, void *),
1399  void *arg,
1400  int flags)
1401 {
1402  ldns_status result = LDNS_STATUS_OK;
1403  ldns_dnssec_rrsets zonemd_rrset;
1404  bool zonemd_added = false;
1405 
1406  if (!zone || !new_rrs || !key_list) {
1407  return LDNS_STATUS_ERR;
1408  }
1409  if (flags & LDNS_SIGN_WITH_ZONEMD) {
1410  ldns_dnssec_rrsets **rrsets_ref = &zone->soa->rrsets;
1411 
1412  while (*rrsets_ref
1413  && (*rrsets_ref)->type < LDNS_RR_TYPE_ZONEMD)
1414  rrsets_ref = &(*rrsets_ref)->next;
1415  if (!*rrsets_ref
1416  || (*rrsets_ref)->type > LDNS_RR_TYPE_ZONEMD) {
1417  zonemd_rrset.rrs = NULL;
1418  zonemd_rrset.type = LDNS_RR_TYPE_ZONEMD;
1419  zonemd_rrset.signatures = NULL;
1420  zonemd_rrset.next = *rrsets_ref;
1421  *rrsets_ref = &zonemd_rrset;
1422  zonemd_added = true;
1423  }
1424  }
1425  /* zone is already sorted */
1426  result = ldns_dnssec_zone_mark_glue(zone);
1427  if (result != LDNS_STATUS_OK) {
1428  return result;
1429  }
1430  /* check whether we need to add nsecs */
1431  if ((flags & LDNS_SIGN_NO_KEYS_NO_NSECS)
1432  && ldns_key_list_key_count(key_list) < 1)
1433  ; /* pass */
1434 
1435  else if (zone->names
1436  && !((ldns_dnssec_name *)zone->names->root->data)->nsec) {
1437 
1438  result = ldns_dnssec_zone_create_nsecs(zone, new_rrs);
1439  if (result != LDNS_STATUS_OK) {
1440  return result;
1441  }
1442  }
1443  result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1444  new_rrs,
1445  key_list,
1446  func,
1447  arg,
1448  flags);
1449 
1450  if (zonemd_added) {
1451  ldns_dnssec_rrsets **rrsets_ref
1452  = &zone->soa->rrsets;
1453 
1454  while (*rrsets_ref
1455  && (*rrsets_ref)->type < LDNS_RR_TYPE_ZONEMD)
1456  rrsets_ref = &(*rrsets_ref)->next;
1457  *rrsets_ref = zonemd_rrset.next;
1458  }
1459  return flags & LDNS_SIGN_WITH_ZONEMD
1460  ? dnssec_zone_equip_zonemd(zone, new_rrs, key_list, flags)
1461  : result;
1462 }
1463 
1466  ldns_rr_list *new_rrs,
1467  ldns_key_list *key_list,
1468  int (*func)(ldns_rr *, void *),
1469  void *arg,
1470  uint8_t algorithm,
1471  uint8_t flags,
1472  uint16_t iterations,
1473  uint8_t salt_length,
1474  uint8_t *salt)
1475 {
1476  return ldns_dnssec_zone_sign_nsec3_flg_mkmap(zone, new_rrs, key_list,
1477  func, arg, algorithm, flags, iterations, salt_length, salt, 0,
1478  NULL);
1479 }
1480 
1483  ldns_rr_list *new_rrs,
1484  ldns_key_list *key_list,
1485  int (*func)(ldns_rr *, void *),
1486  void *arg,
1487  uint8_t algorithm,
1488  uint8_t flags,
1489  uint16_t iterations,
1490  uint8_t salt_length,
1491  uint8_t *salt,
1492  int signflags,
1493  ldns_rbtree_t **map)
1494 {
1495  ldns_rr *nsec3, *nsec3param;
1496  ldns_status result = LDNS_STATUS_OK;
1497  bool zonemd_added = false;
1498  ldns_dnssec_rrsets zonemd_rrset;
1499 
1500  /* zone is already sorted */
1501  result = ldns_dnssec_zone_mark_glue(zone);
1502  if (result != LDNS_STATUS_OK) {
1503  return result;
1504  }
1505 
1506  /* TODO if there are already nsec3s presents and their
1507  * parameters are the same as these, we don't have to recreate
1508  */
1509  if (zone->names) {
1510  /* add empty nonterminals */
1512  if (result != LDNS_STATUS_OK) {
1513  return result;
1514  }
1515 
1516  nsec3 = ((ldns_dnssec_name *)zone->names->root->data)->nsec;
1517 
1518  /* check whether we need to add nsecs */
1519  if ((signflags & LDNS_SIGN_NO_KEYS_NO_NSECS)
1520  && ldns_key_list_key_count(key_list) < 1)
1521  ; /* pass */
1522 
1523  else if (nsec3 && ldns_rr_get_type(nsec3) == LDNS_RR_TYPE_NSEC3) {
1524  /* no need to recreate */
1525  } else {
1526  if (!ldns_dnssec_zone_find_rrset(zone,
1527  zone->soa->name,
1529  /* create and add the nsec3param rr */
1530  nsec3param =
1532  ldns_rr_set_owner(nsec3param,
1533  ldns_rdf_clone(zone->soa->name));
1534  ldns_nsec3_add_param_rdfs(nsec3param,
1535  algorithm,
1536  flags,
1537  iterations,
1538  salt_length,
1539  salt);
1540  /* always set bit 7 of the flags to zero, according to
1541  * rfc5155 section 11. The bits are counted from right to left,
1542  * so bit 7 in rfc5155 is bit 0 in ldns */
1543  ldns_set_bit(ldns_rdf_data(ldns_rr_rdf(nsec3param, 1)), 0, 0);
1544  result = ldns_dnssec_zone_add_rr(zone, nsec3param);
1545  if (result != LDNS_STATUS_OK) {
1546  return result;
1547  }
1548  ldns_rr_list_push_rr(new_rrs, nsec3param);
1549  }
1550  if (signflags & LDNS_SIGN_WITH_ZONEMD) {
1551  ldns_dnssec_rrsets **rrsets_ref
1552  = &zone->soa->rrsets;
1553 
1554  while (*rrsets_ref
1555  && (*rrsets_ref)->type < LDNS_RR_TYPE_ZONEMD)
1556  rrsets_ref = &(*rrsets_ref)->next;
1557  if (!*rrsets_ref
1558  || (*rrsets_ref)->type > LDNS_RR_TYPE_ZONEMD) {
1559  zonemd_rrset.rrs = NULL;
1560  zonemd_rrset.type = LDNS_RR_TYPE_ZONEMD;
1561  zonemd_rrset.signatures = NULL;
1562  zonemd_rrset.next = *rrsets_ref;
1563  *rrsets_ref = &zonemd_rrset;
1564  zonemd_added = true;
1565  }
1566  }
1567  result = ldns_dnssec_zone_create_nsec3s_mkmap(zone,
1568  new_rrs,
1569  algorithm,
1570  flags,
1571  iterations,
1572  salt_length,
1573  salt,
1574  map);
1575  if (zonemd_added) {
1576  ldns_dnssec_rrsets **rrsets_ref
1577  = &zone->soa->rrsets;
1578 
1579  while (*rrsets_ref
1580  && (*rrsets_ref)->type < LDNS_RR_TYPE_ZONEMD)
1581  rrsets_ref = &(*rrsets_ref)->next;
1582  *rrsets_ref = zonemd_rrset.next;
1583  }
1584  if (result != LDNS_STATUS_OK) {
1585  return result;
1586  }
1587  }
1588 
1589  result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1590  new_rrs,
1591  key_list,
1592  func,
1593  arg,
1594  signflags);
1595  }
1596  if (result || !zone->names)
1597  return result;
1598 
1599  return signflags & LDNS_SIGN_WITH_ZONEMD
1600  ? dnssec_zone_equip_zonemd(zone, new_rrs, key_list, signflags)
1601  : result;
1602 }
1603 
1606  ldns_rr_list *new_rrs,
1607  ldns_key_list *key_list,
1608  int (*func)(ldns_rr *, void *),
1609  void *arg,
1610  uint8_t algorithm,
1611  uint8_t flags,
1612  uint16_t iterations,
1613  uint8_t salt_length,
1614  uint8_t *salt,
1615  int signflags)
1616 {
1617  return ldns_dnssec_zone_sign_nsec3_flg_mkmap(zone, new_rrs, key_list,
1618  func, arg, algorithm, flags, iterations, salt_length, salt,
1619  signflags, NULL);
1620 }
1621 
1622 ldns_zone *
1623 ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
1624 {
1625  ldns_dnssec_zone *dnssec_zone;
1626  ldns_zone *signed_zone;
1627  ldns_rr_list *new_rrs;
1628  size_t i;
1629 
1630  signed_zone = ldns_zone_new();
1631  dnssec_zone = ldns_dnssec_zone_new();
1632 
1633  (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1634  ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1635 
1636  for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1637  (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1639  i));
1640  ldns_zone_push_rr(signed_zone,
1642  i)));
1643  }
1644 
1645  new_rrs = ldns_rr_list_new();
1646  (void) ldns_dnssec_zone_sign(dnssec_zone,
1647  new_rrs,
1648  key_list,
1650  NULL);
1651 
1652  for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1653  ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1654  ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1655  }
1656 
1657  ldns_rr_list_deep_free(new_rrs);
1658  ldns_dnssec_zone_free(dnssec_zone);
1659 
1660  return signed_zone;
1661 }
1662 
1663 ldns_zone *
1664 ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
1665 {
1666  ldns_dnssec_zone *dnssec_zone;
1667  ldns_zone *signed_zone;
1668  ldns_rr_list *new_rrs;
1669  size_t i;
1670 
1671  signed_zone = ldns_zone_new();
1672  dnssec_zone = ldns_dnssec_zone_new();
1673 
1674  (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1675  ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1676 
1677  for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1678  (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1680  i));
1681  ldns_zone_push_rr(signed_zone,
1683  i)));
1684  }
1685 
1686  new_rrs = ldns_rr_list_new();
1687  (void) ldns_dnssec_zone_sign_nsec3(dnssec_zone,
1688  new_rrs,
1689  key_list,
1691  NULL,
1692  algorithm,
1693  flags,
1694  iterations,
1695  salt_length,
1696  salt);
1697 
1698  for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1699  ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1700  ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1701  }
1702 
1703  ldns_rr_list_deep_free(new_rrs);
1704  ldns_dnssec_zone_free(dnssec_zone);
1705 
1706  return signed_zone;
1707 }
1708 #endif /* HAVE_SSL */
1709 
1710 
void ldns_buffer_free(ldns_buffer *buffer)
frees the buffer.
Definition: buffer.c:137
ldns_buffer * ldns_buffer_new(size_t capacity)
creates a new buffer with the specified capacity.
Definition: buffer.c:16
#define ATTR_UNUSED(x)
Definition: common.h:72
#define HAVE_EVP_PKEY_GET_BASE_ID
Definition: config.h:121
#define HAVE_EVP_PKEY_BASE_ID
Definition: config.h:118
int ldns_dname_compare_v(const void *a, const void *b)
Given in dnssec_zone.c, also used in dnssec_sign.c:w.
Definition: dnssec_zone.c:910
int ldns_dname_is_wildcard(const ldns_rdf *dname)
Check if dname is a wildcard, starts with *.
Definition: dname.c:456
bool ldns_dname_is_subdomain(const ldns_rdf *sub, const ldns_rdf *parent)
test whether the name sub falls under parent (i.e.
Definition: dname.c:296
void ldns_dname2canonical(const ldns_rdf *rd)
Put a dname into canonical fmt - ie.
Definition: dname.c:280
uint8_t ldns_dname_label_count(const ldns_rdf *r)
count the number of labels inside a LDNS_RDF_DNAME type rdf.
Definition: dname.c:214
ldns_rdf * ldns_dname_label(const ldns_rdf *rdf, uint8_t labelpos)
look inside the rdf and if it is an LDNS_RDF_TYPE_DNAME try and retrieve a specific label.
Definition: dname.c:560
ldns_rr * ldns_dnssec_create_nsec3(const ldns_dnssec_name *from, const ldns_dnssec_name *to, const ldns_rdf *zone_name, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t *salt)
Creates NSEC3.
Definition: dnssec.c:869
ldns_rdf * ldns_convert_dsa_rrsig_asn12rdf(const ldns_buffer *sig, const long sig_len)
Converts the DSA signature from ASN1 representation (RFC2459, as used by OpenSSL) to raw signature da...
Definition: dnssec.c:1746
int ldns_dnssec_default_replace_signatures(ldns_rr *sig __attribute__((unused)), void *n __attribute__((unused)))
Definition: dnssec.c:1737
void ldns_nsec3_add_param_rdfs(ldns_rr *rr, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t *salt)
Sets all the NSEC3 options.
Definition: dnssec.c:1107
ldns_rdf * ldns_convert_ecdsa_rrsig_asn1len2rdf(const ldns_buffer *sig, const long sig_len, int num_bytes)
Converts the ECDSA signature from ASN1 representation (as used by OpenSSL) to raw signature data as u...
Definition: dnssec.c:1869
ldns_rr * ldns_dnssec_create_nsec(const ldns_dnssec_name *from, const ldns_dnssec_name *to, ldns_rr_type nsec_type)
Creates NSEC.
Definition: dnssec.c:815
ldns_status ldns_dnssec_chain_nsec3_list(ldns_rr_list *nsec3_rrs)
chains nsec3 list
Definition: dnssec.c:1634
int ldns_dnssec_rrsets_contains_type(const ldns_dnssec_rrsets *rrsets, ldns_rr_type type)
returns whether a rrset of the given type is found in the rrsets.
Definition: dnssec.c:801
This module contains base functions for DNSSEC operations (RFC4033 t/m RFC4035).
#define LDNS_DEFAULT_EXP_TIME
Definition: dnssec.h:44
#define LDNS_SIGNATURE_LEAVE_ADD_NEW
return values for the old-signature callback
Definition: dnssec.h:47
#define LDNS_SIGNATURE_REMOVE_NO_ADD
Definition: dnssec.h:50
#define LDNS_SIGNATURE_REMOVE_ADD_NEW
Definition: dnssec.h:49
#define LDNS_SIGNATURE_LEAVE_NO_ADD
Definition: dnssec.h:48
ldns_rr_list * ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
use this function to sign with a public/private key alg return the created signatures
Definition: dnssec_sign.c:227
ldns_rr * ldns_create_empty_rrsig(const ldns_rr_list *rrset, const ldns_key *current_key)
Create an empty RRSIG RR (i.e.
Definition: dnssec_sign.c:31
#define LDNS_SIGN_WITH_ZONEMD
Definition: dnssec_sign.c:27
ldns_rdf * ldns_sign_public_rsamd5(ldns_buffer *to_sign, RSA *key)
Sign a buffer with the RSA key (hash with MD5)
Definition: dnssec_sign.c:616
ldns_rbnode_t * ldns_dnssec_name_node_next_nonglue(ldns_rbnode_t *node)
Finds the first dnssec_name node in the rbtree that is not occluded.
Definition: dnssec_sign.c:789
ldns_zone * ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
Signs the zone, and returns a newly allocated signed zone.
Definition: dnssec_sign.c:1623
ldns_status ldns_dnssec_zone_mark_glue(ldns_dnssec_zone *zone)
Marks the names in the zone that are occluded.
Definition: dnssec_sign.c:783
ldns_rdf * ldns_sign_public_evp(ldns_buffer *to_sign, EVP_PKEY *key, const EVP_MD *digest_type)
Sign data with EVP (general method for different algorithms)
Definition: dnssec_sign.c:451
ldns_status ldns_dnssec_zone_mark_and_get_glue(ldns_dnssec_zone *zone, ldns_rr_list *glue_list)
Marks the names in the zone that are occluded.
Definition: dnssec_sign.c:694
ldns_status ldns_dnssec_zone_create_nsec3s(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Adds NSEC3 records to the zone.
Definition: dnssec_sign.c:1036
ldns_status ldns_dnssec_zone_sign(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg)
signs the given zone with the given keys
Definition: dnssec_sign.c:1383
ldns_status dnssec_zone_equip_zonemd(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int flags)
Definition: dnssec_zone.c:1918
ldns_status ldns_dnssec_zone_sign_nsec3_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1605
ldns_status ldns_dnssec_zone_create_rrsigs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg)
Adds signatures to the zone.
Definition: dnssec_sign.c:1142
ldns_status ldns_dnssec_zone_sign_nsec3_flg_mkmap(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags, ldns_rbtree_t **map)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1482
ldns_dnssec_rrs * ldns_dnssec_remove_signatures(ldns_dnssec_rrs *signatures, ldns_key_list *key_list __attribute__((unused)), int(*func)(ldns_rr *, void *), void *arg)
Definition: dnssec_sign.c:1051
ldns_status ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
signs the given zone with the given keys
Definition: dnssec_sign.c:1395
ldns_rdf * ldns_sign_public_dsa(ldns_buffer *to_sign, DSA *key)
Sign data with DSA.
Definition: dnssec_sign.c:340
ldns_zone * ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Signs the zone with NSEC3, and returns a newly allocated signed zone.
Definition: dnssec_sign.c:1664
ldns_status ldns_dnssec_zone_create_nsecs(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs)
Adds NSEC records to the given dnssec_zone.
Definition: dnssec_sign.c:815
ldns_status ldns_dnssec_zone_sign_nsec3(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
signs the given zone with the given new zone, with NSEC3
Definition: dnssec_sign.c:1465
ldns_status ldns_dnssec_zone_create_rrsigs_flg(ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags)
Adds signatures to the zone.
Definition: dnssec_sign.c:1237
ldns_rdf * ldns_sign_public_rsasha1(ldns_buffer *to_sign, RSA *key)
Sign a buffer with the RSA key (hash with SHA1)
Definition: dnssec_sign.c:580
ldns_rdf * ldns_sign_public_buffer(ldns_buffer *sign_buf, ldns_key *current_key)
Sign the buffer which contains the wiredata of an rrset, and the corresponding empty rrsig rr with th...
Definition: dnssec_sign.c:128
#define LDNS_SIGN_DNSKEY_WITH_ZSK
dnssec_verify
Definition: dnssec_sign.h:15
#define LDNS_SIGN_WITH_ALL_ALGORITHMS
Definition: dnssec_sign.h:16
#define LDNS_SIGN_NO_KEYS_NO_NSECS
Definition: dnssec_sign.h:17
ldns_dnssec_rrsets * ldns_dnssec_zone_find_rrset(const ldns_dnssec_zone *zone, const ldns_rdf *dname, ldns_rr_type type)
Find the RRset with the given name and type in the zone.
Definition: dnssec_zone.c:509
ldns_status ldns_dnssec_rrs_add_rr(ldns_dnssec_rrs *rrs, ldns_rr *rr)
Adds an RR to the list of RRs.
Definition: dnssec_zone.c:47
ldns_status ldns_dnssec_name_add_rr(ldns_dnssec_name *name, ldns_rr *rr)
Inserts the given rr at the right place in the current dnssec_name No checking is done whether the na...
Definition: dnssec_zone.c:449
ldns_status ldns_dnssec_zone_add_rr(ldns_dnssec_zone *zone, ldns_rr *rr)
Adds the given RR to the zone.
Definition: dnssec_zone.c:1006
ldns_status ldns_dnssec_zone_add_empty_nonterminals(ldns_dnssec_zone *zone)
Adds explicit dnssec_name structures for the empty nonterminals in this zone.
Definition: dnssec_zone.c:1258
ldns_rdf * ldns_dnssec_name_name(const ldns_dnssec_name *name)
Returns the domain name of the given dnssec_name structure.
Definition: dnssec_zone.c:395
void ldns_dnssec_zone_free(ldns_dnssec_zone *zone)
Frees the given zone structure, and its rbtree of dnssec_names Individual ldns_rr RRs within those na...
Definition: dnssec_zone.c:869
ldns_dnssec_rrs * ldns_dnssec_rrs_new(void)
Creates a new entry for 1 pointer to an rr and 1 pointer to the next rrs.
Definition: dnssec_zone.c:10
ldns_dnssec_rrsets * ldns_dnssec_name_find_rrset(const ldns_dnssec_name *name, ldns_rr_type type)
Find the RRset with the given type in within this name structure.
Definition: dnssec_zone.c:493
ldns_dnssec_zone * ldns_dnssec_zone_new(void)
Creates a new dnssec_zone structure.
Definition: dnssec_zone.c:570
@ LDNS_STATUS_NSEC3_DOMAINNAME_OVERFLOW
Definition: error.h:131
@ LDNS_STATUS_NULL
Definition: error.h:51
@ LDNS_STATUS_ERR
Definition: error.h:37
@ LDNS_STATUS_MEM_ERR
Definition: error.h:34
@ LDNS_STATUS_OK
Definition: error.h:26
enum ldns_enum_status ldns_status
Definition: error.h:146
ldns_status ldns_rr_list2buffer_wire(ldns_buffer *buffer, const ldns_rr_list *rr_list)
Copies the rr_list data to the buffer in wire format.
Definition: host2wire.c:156
ldns_status ldns_rrsig2buffer_wire(ldns_buffer *buffer, const ldns_rr *rr)
Converts a rrsig to wireformat BUT EXCLUDE the rrsig rdata This is needed in DNSSEC verification.
Definition: host2wire.c:294
uint32_t ldns_key_expiration(const ldns_key *k)
return the key's expiration date
Definition: keys.c:1565
EVP_PKEY * ldns_key_evp_key(const ldns_key *k)
returns the (openssl) EVP struct contained in the key
Definition: keys.c:1488
void ldns_key_set_use(ldns_key *k, bool v)
set the use flag
Definition: keys.c:1469
void ldns_key_list_set_use(ldns_key_list *keys, bool v)
Set the 'use' flag for all keys in the list.
Definition: keys.c:1584
ldns_rr * ldns_key2rr(const ldns_key *k)
converts a ldns_key to a public key rr If the key data exists at an external point,...
Definition: keys.c:1803
uint16_t ldns_key_keytag(const ldns_key *k)
return the keytag
Definition: keys.c:1571
ldns_signing_algorithm ldns_key_algorithm(const ldns_key *k)
return the signing alg of the key
Definition: keys.c:1463
uint32_t ldns_key_inception(const ldns_key *k)
return the key's inception date
Definition: keys.c:1559
ldns_rdf * ldns_key_pubkey_owner(const ldns_key *k)
return the public key's owner
Definition: keys.c:1577
uint16_t ldns_key_flags(const ldns_key *k)
return the flag of the key
Definition: keys.c:1553
size_t ldns_key_list_key_count(const ldns_key_list *key_list)
returns the number of keys in the key list
Definition: keys.c:1447
ldns_key * ldns_key_list_key(const ldns_key_list *key, size_t nr)
returns a pointer to the key in the list at the given position
Definition: keys.c:1453
bool ldns_key_use(const ldns_key *k)
return the use flag
Definition: keys.c:1477
#define LDNS_KEY_SEP_KEY
Definition: keys.h:38
enum ldns_enum_signing_algorithm ldns_signing_algorithm
Definition: keys.h:118
@ LDNS_SIGN_RSASHA1
Definition: keys.h:92
@ LDNS_SIGN_ECDSAP256SHA256
Definition: keys.h:103
@ LDNS_SIGN_DSA_NSEC3
Definition: keys.h:100
@ LDNS_SIGN_ECC_GOST
Definition: keys.h:102
@ LDNS_SIGN_ED448
Definition: keys.h:109
@ LDNS_SIGN_ED25519
Definition: keys.h:106
@ LDNS_SIGN_RSASHA1_NSEC3
Definition: keys.h:96
@ LDNS_SIGN_ECDSAP384SHA384
Definition: keys.h:104
@ LDNS_SIGN_RSAMD5
Definition: keys.h:91
@ LDNS_SIGN_RSASHA512
Definition: keys.h:98
@ LDNS_SIGN_DSA
Definition: keys.h:94
@ LDNS_SIGN_RSASHA256
Definition: keys.h:97
#define LDNS_KEY_ZONE_KEY
Definition: keys.h:37
Including this file will include all ldns files, and define some lookup tables.
#define LDNS_DEFAULT_TTL
Definition: ldns.h:135
#define LDNS_MAX_PACKETLEN
Definition: packet.h:24
ldns_rbtree_t * ldns_rbtree_create(int(*cmpf)(const void *, const void *))
Create new tree (malloced) with given key compare function.
Definition: rbtree.c:80
void ldns_traverse_postorder(ldns_rbtree_t *tree, void(*func)(ldns_rbnode_t *, void *), void *arg)
Call function for all elements in the redblack tree, such that leaf elements are called before parent...
Definition: rbtree.c:666
ldns_rbnode_t * ldns_rbtree_first(const ldns_rbtree_t *rbtree)
Returns first (smallest) node in the tree.
Definition: rbtree.c:548
ldns_rbnode_t * ldns_rbtree_next(ldns_rbnode_t *node)
Returns next larger node in the tree.
Definition: rbtree.c:574
ldns_rbnode_t * ldns_rbtree_insert(ldns_rbtree_t *rbtree, ldns_rbnode_t *data)
Insert data into the tree.
Definition: rbtree.c:242
#define LDNS_RBTREE_NULL
The nullpointer, points to empty node.
Definition: rbtree.h:76
ldns_rdf * ldns_native2rdf_int8(ldns_rdf_type type, uint8_t value)
returns the rdf containing the native uint8_t repr.
Definition: rdata.c:126
void ldns_rdf_deep_free(ldns_rdf *rd)
frees a rdf structure and frees the data.
Definition: rdata.c:230
uint32_t ldns_rdf2native_int32(const ldns_rdf *rd)
returns the native uint32_t representation from the rdf.
Definition: rdata.c:98
uint16_t ldns_rdf2native_int16(const ldns_rdf *rd)
returns the native uint16_t representation from the rdf.
Definition: rdata.c:84
ldns_rdf * ldns_native2rdf_int16(ldns_rdf_type type, uint16_t value)
returns the rdf containing the native uint16_t representation.
Definition: rdata.c:132
size_t ldns_rdf_size(const ldns_rdf *rd)
returns the size of the rdf.
Definition: rdata.c:24
uint8_t * ldns_rdf_data(const ldns_rdf *rd)
returns the data of the rdf.
Definition: rdata.c:38
ldns_rdf * ldns_native2rdf_int32(ldns_rdf_type type, uint32_t value)
returns an rdf that contains the given int32 value.
Definition: rdata.c:147
void ldns_rdf_free(ldns_rdf *rd)
frees a rdf structure, leaving the data pointer intact.
Definition: rdata.c:241
ldns_rdf * ldns_rdf_clone(const ldns_rdf *rd)
clones a rdf structure.
Definition: rdata.c:222
ldns_rdf * ldns_rdf_new_frm_data(ldns_rdf_type type, size_t size, const void *data)
allocates a new rdf structure and fills it.
Definition: rdata.c:193
@ LDNS_RDF_TYPE_INT32
32 bits
Definition: rdata.h:56
@ LDNS_RDF_TYPE_B64
b64 string
Definition: rdata.h:68
@ LDNS_RDF_TYPE_TIME
time (32 bits)
Definition: rdata.h:84
@ LDNS_RDF_TYPE_INT8
8 bits
Definition: rdata.h:52
@ LDNS_RDF_TYPE_INT16
16 bits
Definition: rdata.h:54
@ LDNS_RDF_TYPE_ALG
a key algorithm
Definition: rdata.h:80
@ LDNS_RDF_TYPE_TYPE
a RR type
Definition: rdata.h:74
void ldns_rr_list_free(ldns_rr_list *rr_list)
frees an rr_list structure.
Definition: rr.c:1003
ldns_rr * ldns_rr_list_rr(const ldns_rr_list *rr_list, size_t nr)
returns a specific rr of an rrlist.
Definition: rr.c:982
uint32_t ldns_rr_ttl(const ldns_rr *rr)
returns the ttl of an rr structure.
Definition: rr.c:923
ldns_rdf * ldns_rr_owner(const ldns_rr *rr)
returns the owner name of an rr structure.
Definition: rr.c:911
void ldns_rr_list_deep_free(ldns_rr_list *rr_list)
frees an rr_list structure and all rrs contained therein.
Definition: rr.c:1012
void ldns_rr_free(ldns_rr *rr)
frees an RR structure
Definition: rr.c:75
void ldns_rr_set_owner(ldns_rr *rr, ldns_rdf *owner)
sets the owner in the rr structure.
Definition: rr.c:796
ldns_rr_type ldns_rr_list_type(const ldns_rr_list *rr_list)
Returns the type of the first element of the RR If there are no elements present, 0 is returned.
Definition: rr.c:2758
ldns_rr * ldns_rr_new_frm_type(ldns_rr_type t)
creates a new rr structure, based on the given type.
Definition: rr.c:42
void ldns_rr_list_sort(ldns_rr_list *unsorted)
sorts an rr_list (canonical wire format).
Definition: rr.c:1507
void ldns_rr2canonical(ldns_rr *rr)
converts each dname in a rr to its canonical form.
Definition: rr.c:1772
size_t ldns_rr_list_rr_count(const ldns_rr_list *rr_list)
returns the number of rr's in an rr_list.
Definition: rr.c:949
ldns_rr_type ldns_rr_get_type(const ldns_rr *rr)
returns the type of the rr.
Definition: rr.c:935
void ldns_rr_set_ttl(ldns_rr *rr, uint32_t ttl)
sets the ttl in the rr structure.
Definition: rr.c:808
bool ldns_rr_list_push_rr(ldns_rr_list *rr_list, const ldns_rr *rr)
pushes an rr to an rrlist.
Definition: rr.c:1124
ldns_rr_class ldns_rr_get_class(const ldns_rr *rr)
returns the class of the rr.
Definition: rr.c:941
void ldns_rr_set_class(ldns_rr *rr, ldns_rr_class rr_class)
sets the class in the rr.
Definition: rr.c:826
ldns_rr_list * ldns_rr_list_new(void)
creates a new rr_list structure.
Definition: rr.c:992
ldns_rr * ldns_rr_clone(const ldns_rr *rr)
clones a rr and all its data
Definition: rr.c:1391
ldns_rr_list * ldns_rr_list_clone(const ldns_rr_list *rrlist)
clones an rrlist.
Definition: rr.c:1422
ldns_rdf * ldns_rr_rdf(const ldns_rr *rr, size_t nr)
returns the rdata field member counter.
Definition: rr.c:901
ldns_rdf * ldns_rr_pop_rdf(ldns_rr *rr)
removes a rd_field member, it will be popped from the last position.
Definition: rr.c:872
@ LDNS_RR_TYPE_RRSIG
DNSSEC.
Definition: rr.h:170
@ LDNS_RR_TYPE_A
a host address
Definition: rr.h:80
@ LDNS_RR_TYPE_ZONEMD
Definition: rr.h:194
@ LDNS_RR_TYPE_DNSKEY
Definition: rr.h:172
@ LDNS_RR_TYPE_SOA
marks the start of a zone of authority
Definition: rr.h:90
@ LDNS_RR_TYPE_NSEC
Definition: rr.h:171
@ LDNS_RR_TYPE_DNAME
RFC2672.
Definition: rr.h:156
@ LDNS_RR_TYPE_DS
RFC4034, RFC3658.
Definition: rr.h:164
@ LDNS_RR_TYPE_NSEC3PARAM
Definition: rr.h:177
@ LDNS_RR_TYPE_NSEC3
Definition: rr.h:176
@ LDNS_RR_TYPE_CDNSKEY
Definition: rr.h:191
@ LDNS_RR_TYPE_AAAA
ipv6 address
Definition: rr.h:134
@ LDNS_RR_TYPE_NS
an authoritative name server
Definition: rr.h:82
@ LDNS_RR_TYPE_CDS
Definition: rr.h:190
enum ldns_enum_rr_class ldns_rr_class
Definition: rr.h:61
bool ldns_rr_rrsig_set_expiration(ldns_rr *r, ldns_rdf *f)
sets the expiration date of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:165
bool ldns_rr_rrsig_set_keytag(ldns_rr *r, ldns_rdf *f)
sets the keytag of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:189
bool ldns_rr_rrsig_set_algorithm(ldns_rr *r, ldns_rdf *f)
sets the algorithm of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:129
ldns_rdf * ldns_rr_rrsig_keytag(const ldns_rr *r)
returns the keytag of a LDNS_RR_TYPE_RRSIG RR
Definition: rr_functions.c:183
bool ldns_rr_rrsig_set_typecovered(ldns_rr *r, ldns_rdf *f)
sets the typecovered of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:117
bool ldns_rr_rrsig_set_labels(ldns_rr *r, ldns_rdf *f)
sets the number of labels of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:141
bool ldns_rr_rrsig_set_inception(ldns_rr *r, ldns_rdf *f)
sets the inception date of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:177
bool ldns_rr_rrsig_set_signame(ldns_rr *r, ldns_rdf *f)
sets the signers name of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:201
bool ldns_rr_rrsig_set_sig(ldns_rr *r, ldns_rdf *f)
sets the signature data of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:213
bool ldns_rr_rrsig_set_origttl(ldns_rr *r, ldns_rdf *f)
sets the original TTL of a LDNS_RR_TYPE_RRSIG rr
Definition: rr_functions.c:153
#define R(b, x)
Definition: sha2.c:191
The rbnode_t struct definition.
Definition: rbtree.h:60
const void * data
pointer to data
Definition: rbtree.h:70
const void * key
pointer to sorting key
Definition: rbtree.h:68
definition for tree struct
Definition: rbtree.h:83
ldns_rbnode_t * root
The root of the red-black tree.
Definition: rbtree.h:85
implementation of buffers to ease operations
Definition: buffer.h:51
ldns_dnssec_rrs * nsec_signatures
signatures for the NSEC record
Definition: dnssec_zone.h:71
ldns_rr * nsec
NSEC pointing to the next name (or NSEC3 pointing to the next NSEC3)
Definition: dnssec_zone.h:67
bool is_glue
Unlike what the name is_glue suggests, this field is set to true by ldns_dnssec_zone_mark_glue() or l...
Definition: dnssec_zone.h:81
ldns_rdf * hashed_name
pointer to store the hashed name (only used when in an NSEC3 zone
Definition: dnssec_zone.h:85
ldns_dnssec_rrsets * rrsets
The rrsets for this name.
Definition: dnssec_zone.h:63
ldns_rdf * name
pointer to a dname containing the name.
Definition: dnssec_zone.h:51
ldns_dnssec_rrs * next
Definition: dnssec_zone.h:25
ldns_dnssec_rrs * rrs
Definition: dnssec_zone.h:34
ldns_dnssec_rrs * signatures
Definition: dnssec_zone.h:36
ldns_dnssec_rrsets * next
Definition: dnssec_zone.h:37
Structure containing a dnssec zone.
Definition: dnssec_zone.h:91
ldns_rbtree_t * hashed_names
tree of ldns_dnssec_names by nsec3 hashes (when applicable)
Definition: dnssec_zone.h:97
ldns_rbtree_t * names
tree of ldns_dnssec_names
Definition: dnssec_zone.h:95
ldns_dnssec_name * soa
points to the name containing the SOA RR
Definition: dnssec_zone.h:93
Same as rr_list, but now for keys.
Definition: keys.h:181
General key structure, can contain all types of keys that are used in DNSSEC.
Definition: keys.h:130
Resource record data field.
Definition: rdata.h:196
List or Set of Resource Records.
Definition: rr.h:338
Resource Record.
Definition: rr.h:310
DNS Zone.
Definition: zone.h:43
void ldns_set_bit(uint8_t *byte, int bit_nr, bool value)
sets the specified bit in the specified byte to 1 if value is true, 0 if false The bits are counted f...
Definition: util.c:72
#define LDNS_FREE(ptr)
Definition: util.h:60
#define LDNS_MALLOC(type)
Memory management macros.
Definition: util.h:49
#define LDNS_XMALLOC(type, count)
Definition: util.h:51
void ldns_zone_set_soa(ldns_zone *z, ldns_rr *soa)
Set the zone's soa record.
Definition: zone.c:29
ldns_zone * ldns_zone_new(void)
create a new ldns_zone structure
Definition: zone.c:165
ldns_rr_list * ldns_zone_rrs(const ldns_zone *z)
Get a list of a zone's content.
Definition: zone.c:35
bool ldns_zone_push_rr(ldns_zone *z, ldns_rr *rr)
push an single rr to a zone structure.
Definition: zone.c:53
ldns_rr * ldns_zone_soa(const ldns_zone *z)
Return the soa record of a zone.
Definition: zone.c:17