dnssec.h
Go to the documentation of this file.
1 /*
2  * dnssec.h -- defines for the Domain Name System (SEC) (DNSSEC)
3  *
4  * Copyright (c) 2005-2008, NLnet Labs. All rights reserved.
5  *
6  * See LICENSE for the license.
7  *
8  * A bunch of defines that are used in the DNS
9  */
10 
23 #ifndef LDNS_DNSSEC_H
24 #define LDNS_DNSSEC_H
25 
26 #include <ldns/common.h>
27 #if LDNS_BUILD_CONFIG_HAVE_SSL
28 #include <openssl/ssl.h>
29 #include <openssl/evp.h>
30 #endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
31 #include <ldns/packet.h>
32 #include <ldns/keys.h>
33 #include <ldns/zone.h>
34 #include <ldns/resolver.h>
35 #include <ldns/dnssec_zone.h>
36 
37 #ifdef __cplusplus
38 extern "C" {
39 #endif
40 
41 #define LDNS_MAX_KEYLEN 2048
42 #define LDNS_DNSSEC_KEYPROTO 3
43 /* default time before sigs expire */
44 #define LDNS_DEFAULT_EXP_TIME 2419200 /* 4 weeks */
45 
47 #define LDNS_SIGNATURE_LEAVE_ADD_NEW 0
48 #define LDNS_SIGNATURE_LEAVE_NO_ADD 1
49 #define LDNS_SIGNATURE_REMOVE_ADD_NEW 2
50 #define LDNS_SIGNATURE_REMOVE_NO_ADD 3
51 
63  const ldns_rr_type type,
64  const ldns_rr_list *rrs);
65 
76 
85 
86 
87 #define LDNS_NSEC3_MAX_ITERATIONS 65535
88 
92 ldns_rdf *
94  ldns_rr_type qtype,
95  ldns_rr_list *nsec3s);
96 
100 bool
102 
108 
113 
120 uint16_t ldns_calc_keytag(const ldns_rr *key);
121 
128 uint16_t ldns_calc_keytag_raw(uint8_t* key, size_t keysize);
129 
130 #if LDNS_BUILD_CONFIG_HAVE_SSL
131 
137 DSA *ldns_key_buf2dsa(ldns_buffer *key);
144 DSA *ldns_key_buf2dsa_raw(unsigned char* key, size_t len);
145 
154 int ldns_digest_evp(unsigned char* data, unsigned int len,
155  unsigned char* dest, const EVP_MD* md);
156 
164 EVP_PKEY* ldns_gost2pkey_raw(unsigned char* key, size_t keylen);
165 
174 EVP_PKEY* ldns_ecdsa2pkey_raw(unsigned char* key, size_t keylen, uint8_t algo);
175 
176 #endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
177 
178 #if LDNS_BUILD_CONFIG_HAVE_SSL
179 
185 RSA *ldns_key_buf2rsa(ldns_buffer *key);
186 
193 RSA *ldns_key_buf2rsa_raw(unsigned char* key, size_t len);
194 #endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
195 
204 ldns_rr *ldns_key_rr2ds(const ldns_rr *key, ldns_hash h);
205 
209 ldns_rdf *
211  size_t size,
212  ldns_rr_type nsec_type);
213 
221 int
223 
227 ldns_rr *
229  ldns_dnssec_name *to,
230  ldns_rr_type nsec_type);
231 
232 
236 ldns_rr *
238  ldns_dnssec_name *to,
239  ldns_rdf *zone_name,
240  uint8_t algorithm,
241  uint8_t flags,
242  uint16_t iterations,
243  uint8_t salt_length,
244  uint8_t *salt);
245 
253 ldns_rr * ldns_create_nsec(ldns_rdf *cur_owner, ldns_rdf *next_owner, ldns_rr_list *rrs);
254 
264 ldns_rdf *ldns_nsec3_hash_name(ldns_rdf *name, uint8_t algorithm, uint16_t iterations, uint8_t salt_length, uint8_t *salt);
265 
277  uint8_t algorithm,
278  uint8_t flags,
279  uint16_t iterations,
280  uint8_t salt_length,
281  uint8_t *salt);
282 
283 /* this will NOT return the NSEC3 completed, you will have to run the
284  finalize function on the rrlist later! */
285 ldns_rr *
286 ldns_create_nsec3(ldns_rdf *cur_owner,
287  ldns_rdf *cur_zone,
288  ldns_rr_list *rrs,
289  uint8_t algorithm,
290  uint8_t flags,
291  uint16_t iterations,
292  uint8_t salt_length,
293  uint8_t *salt,
294  bool emptynonterminal);
295 
301 uint8_t ldns_nsec3_algorithm(const ldns_rr *nsec3_rr);
302 
306 uint8_t
307 ldns_nsec3_flags(const ldns_rr *nsec3_rr);
308 
314 bool ldns_nsec3_optout(const ldns_rr *nsec3_rr);
315 
321 uint16_t ldns_nsec3_iterations(const ldns_rr *nsec3_rr);
322 
328 ldns_rdf *ldns_nsec3_salt(const ldns_rr *nsec3_rr);
329 
335 uint8_t ldns_nsec3_salt_length(const ldns_rr *nsec3_rr);
336 
342 uint8_t *ldns_nsec3_salt_data(const ldns_rr *nsec3_rr);
343 
349 ldns_rdf *ldns_nsec3_next_owner(const ldns_rr *nsec3_rr);
350 
356 ldns_rdf *ldns_nsec3_bitmap(const ldns_rr *nsec3_rr);
357 
365 
372 bool ldns_nsec_bitmap_covers_type(const ldns_rdf* bitmap, ldns_rr_type type);
373 
382 
391 
402 bool ldns_nsec_covers_name(const ldns_rr *nsec, const ldns_rdf *name);
403 
404 #if LDNS_BUILD_CONFIG_HAVE_SSL
405 
417 
430 ldns_status ldns_pkt_verify_time(ldns_pkt *p, ldns_rr_type t, ldns_rdf *o, ldns_rr_list *k, ldns_rr_list *s, time_t check_time, ldns_rr_list *good_keys);
431 
432 #endif
433 
439 
443 int
444 qsort_rr_compare_nsec3(const void *a, const void *b);
445 
449 void
451 
484 
485 #if LDNS_BUILD_CONFIG_HAVE_SSL
486 
494 ldns_rdf *
496  const long sig_len);
497 
508  const ldns_rdf *sig_rdf);
509 
519 ldns_rdf *
520 ldns_convert_ecdsa_rrsig_asn12rdf(const ldns_buffer *sig, const long sig_len);
521 
533  const ldns_rdf *sig_rdf);
534 
535 #endif /* LDNS_BUILD_CONFIG_HAVE_SSL */
536 
537 #ifdef __cplusplus
538 }
539 #endif
540 
541 #endif /* LDNS_DNSSEC_H */
implementation of buffers to ease operations
Definition: buffer.h:50
int ldns_dnssec_rrsets_contains_type(ldns_dnssec_rrsets *rrsets, ldns_rr_type type)
returns whether a rrset of the given type is found in the rrsets.
Definition: dnssec.c:767
ldns_rdf * ldns_nsec3_hash_name(ldns_rdf *name, uint8_t algorithm, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Calculates the hashed name using the given parameters.
Definition: dnssec.c:974
ldns_rdf * ldns_convert_dsa_rrsig_asn12rdf(const ldns_buffer *sig, const long sig_len)
Converts the DSA signature from ASN1 representation (RFC2459, as used by OpenSSL) to raw signature da...
Definition: dnssec.c:1707
uint16_t ldns_calc_keytag_raw(uint8_t *key, size_t keysize)
Calculates keytag of DNSSEC key, operates on wireformat rdata.
Definition: dnssec.c:301
DSA * ldns_key_buf2dsa_raw(unsigned char *key, size_t len)
Like ldns_key_buf2dsa, but uses raw buffer.
Definition: dnssec.c:337
signed char ldns_nsec_bitmap_covers_type(const ldns_rdf *bitmap, ldns_rr_type type)
Check if RR type t is enumerated and set in the RR type bitmap rdf.
Definition: dnssec.c:1357
ldns_rdf * ldns_nsec3_hash_name_frm_nsec3(const ldns_rr *nsec, ldns_rdf *name)
Calculates the hashed name using the parameters of the given NSEC3 RR.
Definition: dnssec.c:1332
List or Set of Resource Records.
Definition: rr.h:327
ldns_rr * ldns_dnssec_get_rrsig_for_name_and_type(const ldns_rdf *name, const ldns_rr_type type, const ldns_rr_list *rrs)
Returns the first RRSIG rr that corresponds to the rrset with the given name and type.
Definition: dnssec.c:29
ldns_rr * ldns_create_nsec3(ldns_rdf *cur_owner, ldns_rdf *cur_zone, ldns_rr_list *rrs, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, signed char emptynonterminal)
ldns_status ldns_dnssec_chain_nsec3_list(ldns_rr_list *nsec3_rrs)
chains nsec3 list
Definition: dnssec.c:1595
int ldns_dnssec_default_delete_signatures(ldns_rr *sig, void *n)
Default callback function to always remove present signatures, but add no new ones.
enum ldns_enum_hash ldns_hash
Definition: keys.h:74
EVP_PKEY * ldns_gost2pkey_raw(unsigned char *key, size_t keylen)
Converts a holding buffer with key material to EVP PKEY in openssl.
ldns_status ldns_pkt_verify(ldns_pkt *p, ldns_rr_type t, ldns_rdf *o, ldns_rr_list *k, ldns_rr_list *s, ldns_rr_list *good_keys)
verify a packet
Definition: dnssec.c:1587
uint8_t * ldns_nsec3_salt_data(const ldns_rr *nsec3_rr)
Returns the salt bytes used in the given NSEC3 RR.
Definition: dnssec.c:1295
void ldns_rr_list_sort_nsec3(ldns_rr_list *unsorted)
sort nsec3 list
Definition: dnssec.c:1665
int ldns_dnssec_default_replace_signatures(ldns_rr *sig, void *n)
Default callback function to always leave present signatures, and add new ones.
ldns_rr_list * ldns_dnssec_pkt_get_rrsigs_for_type(const ldns_pkt *pkt, ldns_rr_type type)
Returns a ldns_rr_list containing the signatures covering the given type.
Definition: dnssec.c:244
Resource Record.
Definition: rr.h:299
ldns_rdf * ldns_nsec3_next_owner(const ldns_rr *nsec3_rr)
Returns the first label of the next ownername in the NSEC3 chain (ie.
Definition: dnssec.c:1312
ldns_rr * ldns_create_nsec(ldns_rdf *cur_owner, ldns_rdf *next_owner, ldns_rr_list *rrs)
Create a NSEC record.
Definition: dnssec.c:924
ldns_rdf * ldns_convert_ecdsa_rrsig_asn12rdf(const ldns_buffer *sig, const long sig_len)
Converts the ECDSA signature from ASN1 representation (as used by OpenSSL) to raw signature data as u...
Definition: dnssec.c:1809
ldns_rr * ldns_dnssec_create_nsec(ldns_dnssec_name *from, ldns_dnssec_name *to, ldns_rr_type nsec_type)
Creates NSEC.
Definition: dnssec.c:781
uint8_t ldns_nsec3_flags(const ldns_rr *nsec3_rr)
Returns flags field.
Definition: dnssec.c:1239
int qsort_rr_compare_nsec3(const void *a, const void *b)
compare for nsec3 sort
Definition: dnssec.c:1648
ldns_rr_list * ldns_dnssec_pkt_get_rrsigs_for_name_and_type(const ldns_pkt *pkt, ldns_rdf *name, ldns_rr_type type)
Returns a ldns_rr_list containing the signatures covering the given name and type.
Definition: dnssec.c:217
uint16_t ldns_nsec3_iterations(const ldns_rr *nsec3_rr)
Returns the number of hash iterations used in the given NSEC3 RR.
Definition: dnssec.c:1258
uint8_t ldns_nsec3_algorithm(const ldns_rr *nsec3_rr)
Returns the hash algorithm used in the given NSEC3 RR.
Definition: dnssec.c:1226
ldns_rr * ldns_dnssec_get_dnskey_for_rrsig(const ldns_rr *rrsig, const ldns_rr_list *rrs)
Returns the DNSKEY that corresponds to the given RRSIG rr from the list, if any.
Definition: dnssec.c:57
void ldns_nsec3_add_param_rdfs(ldns_rr *rr, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Sets all the NSEC3 options.
Definition: dnssec.c:1073
Defines the ldns_resolver structure, a stub resolver that can send queries and parse answers...
RSA * ldns_key_buf2rsa(ldns_buffer *key)
converts a buffer holding key material to a RSA key in openssl.
Definition: dnssec.c:389
int ldns_digest_evp(unsigned char *data, unsigned int len, unsigned char *dest, const EVP_MD *md)
Utility function to calculate hash using generic EVP_MD pointer.
Definition: dnssec.c:455
RSA * ldns_key_buf2rsa_raw(unsigned char *key, size_t len)
Like ldns_key_buf2rsa, but uses raw buffer.
Definition: dnssec.c:396
DNS packet.
Definition: packet.h:233
ldns_status ldns_pkt_verify_time(ldns_pkt *p, ldns_rr_type t, ldns_rdf *o, ldns_rr_list *k, ldns_rr_list *s, time_t check_time, ldns_rr_list *good_keys)
verify a packet
Definition: dnssec.c:1523
signed char ldns_nsec_covers_name(const ldns_rr *nsec, const ldns_rdf *name)
Checks coverage of NSEC(3) RR name span Remember that nsec and name must both be in canonical form (i...
Definition: dnssec.c:1472
int ldns_dnssec_default_add_to_signatures(ldns_rr *sig, void *n)
Default callback function to always leave present signatures, and add new ones.
enum ldns_enum_status ldns_status
Definition: error.h:131
zone.h
signed char ldns_dnssec_pkt_has_rrsigs(const ldns_pkt *pkt)
Checks whether the packet contains rrsigs.
Definition: dnssec.c:198
signed char ldns_nsec3_optout(const ldns_rr *nsec3_rr)
Returns true if the opt-out flag has been set in the given NSEC3 RR.
Definition: dnssec.c:1252
EVP_PKEY * ldns_ecdsa2pkey_raw(unsigned char *key, size_t keylen, uint8_t algo)
Converts a holding buffer with key material to EVP PKEY in openssl.
DSA * ldns_key_buf2dsa(ldns_buffer *key)
converts a buffer holding key material to a DSA key in openssl.
Definition: dnssec.c:330
ldns_rdf * ldns_nsec3_bitmap(const ldns_rr *nsec3_rr)
Returns the bitmap specifying the covered types of the given NSEC3 RR.
Definition: dnssec.c:1322
ldns_rdf * ldns_dnssec_nsec3_closest_encloser(ldns_rdf *qname, ldns_rr_type qtype, ldns_rr_list *nsec3s)
Returns the dname of the closest (provable) encloser.
Addendum to dnssec.h, this module contains key and algorithm definitions and functions.
Contains the definition of ldns_pkt and its parts, as well as functions to manipulate those...
ldns_status ldns_nsec_bitmap_set_type(ldns_rdf *bitmap, ldns_rr_type type)
Checks if RR type t is enumerated in the type bitmap rdf and sets the bit.
Definition: dnssec.c:1394
Resource record data field.
Definition: rdata.h:166
ldns_status ldns_convert_ecdsa_rrsig_rdf2asn1(ldns_buffer *target_buffer, const ldns_rdf *sig_rdf)
Converts the RRSIG signature RDF (from DNS) to a buffer with the signature in ASN1 format as openssl ...
Definition: dnssec.c:1833
Common definitions for LDNS.
ldns_status ldns_nsec_bitmap_clear_type(ldns_rdf *bitmap, ldns_rr_type type)
Checks if RR type t is enumerated in the type bitmap rdf and clears the bit.
Definition: dnssec.c:1432
ldns_rdf * ldns_nsec_get_bitmap(ldns_rr *nsec)
Returns the rdata field that contains the bitmap of the covered types of the given NSEC record...
Definition: dnssec.c:84
ldns_rdf * ldns_nsec3_salt(const ldns_rr *nsec3_rr)
Returns the salt used in the given NSEC3 RR.
Definition: dnssec.c:1272
enum ldns_enum_rr_type ldns_rr_type
Definition: rr.h:236
uint16_t ldns_calc_keytag(const ldns_rr *key)
calculates a keytag of a key for use in DNSSEC.
Definition: dnssec.c:271
uint8_t ldns_nsec3_salt_length(const ldns_rr *nsec3_rr)
Returns the length of the salt used in the given NSEC3 RR.
Definition: dnssec.c:1284
ldns_status ldns_convert_dsa_rrsig_rdf2asn1(ldns_buffer *target_buffer, const ldns_rdf *sig_rdf)
Converts the RRSIG signature RDF (in rfc2536 format) to a buffer with the signature in rfc2459 format...
Definition: dnssec.c:1756
int ldns_dnssec_default_leave_signatures(ldns_rr *sig, void *n)
Default callback function to always leave present signatures, and add no new ones for the keys of the...
ldns_rr * ldns_key_rr2ds(const ldns_rr *key, ldns_hash h)
returns a new DS rr that represents the given key rr.
Definition: dnssec.c:474
ldns_rr * ldns_dnssec_create_nsec3(ldns_dnssec_name *from, ldns_dnssec_name *to, ldns_rdf *zone_name, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
Creates NSEC3.
Definition: dnssec.c:835
ldns_rdf * ldns_dnssec_create_nsec_bitmap(ldns_rr_type rr_type_list[], size_t size, ldns_rr_type nsec_type)
Create the type bitmap for an NSEC(3) record.
Definition: dnssec.c:685