12 #include <openssl/ssl.h>
13 #include <openssl/evp.h>
14 #include <openssl/rand.h>
15 #include <openssl/err.h>
16 #include <openssl/md5.h>
67 fprintf(out,
";; rcode: %s\n", rcode->
name);
71 if (rr_descriptor && rr_descriptor->
_name) {
72 fprintf(out,
";; qtype: %s\n", rr_descriptor->
_name);
74 fprintf(out,
"TYPE%u",
78 fprintf(out,
";; NODATA response\n");
80 fprintf(out,
"rrset:\n");
82 fprintf(out,
"sigs:\n");
84 fprintf(out,
"---\n");
86 fprintf(out,
"<no data>\n");
209 printf(
"There were already sigs!\n");
211 printf(
"replacing the old sigs\n");
242 possible_parent_name,
287 bool other_rrset =
false;
418 ldns_dnssec_build_data_chain_dnskey(res,
427 ldns_dnssec_build_data_chain_other(res,
446 if(!new_tree)
return NULL;
475 if (parent > result) {
484 print_tabs(FILE *out,
size_t nr, uint8_t *map,
size_t treedepth)
487 for (i = 0; i < nr; i++) {
489 fprintf(out,
"|---");
490 }
else if (map && i < treedepth && map[i] == 1) {
516 memset(sibmap, 0, treedepth);
522 print_tabs(out, tabs, sibmap, treedepth);
526 if (descriptor->
_name) {
527 fprintf(out,
" (%s", descriptor->
_name);
529 fprintf(out,
" (TYPE%d",
534 fprintf(out,
" keytag: %u",
536 fprintf(out,
" alg: ");
538 fprintf(out,
" flags: ");
541 fprintf(out,
" keytag: ");
543 fprintf(out,
" digest type: ");
556 if (tree->
parent_count > 1 && i < tree->parent_count - 1) {
567 print_tabs(out, tabs + 1, sibmap, treedepth);
571 fprintf(out,
"Existence of DS is denied by:\n");
573 fprintf(out,
"Existence is denied by:\n");
578 fprintf(out,
"Existence of DS is denied by:\n");
580 print_tabs(out, tabs + 1, sibmap, treedepth);
582 "Error in denial of existence: %s\n",
589 print_tabs(out, tabs + 1, sibmap, treedepth);
596 printf(
"; SSL Error: ");
597 ERR_load_crypto_strings();
598 ERR_print_errors_fp(stdout);
603 parent_signature[i]);
604 printf(
"For RRset:\n");
607 printf(
"With key:\n");
619 print_tabs(out, tabs, sibmap, treedepth);
620 fprintf(out,
"<no data>\n");
623 fprintf(out,
"<null pointer>\n");
640 tree, tabs, extended, sibmap, treedepth);
650 tree, tabs, extended,
NULL, 0);
660 tree, tabs, extended);
708 if (data_chain && data_chain->
rrset) {
709 cur_rrset = data_chain->
rrset;
722 new_tree->
rr = cur_rr;
723 new_tree->
rrset = cur_rrset;
777 new_tree, data_chain,
784 new_tree, data_chain, check_time);
822 tmp_rrset = cur_rrset;
830 assert(tmp_rrset == cur_rrset);
850 if (tmp_rrset && tmp_rrset != cur_rrset
858 if (cur_parent_rr == new_tree->
parents[i]->
rr) {
886 new_tree, data_chain, cur_sig_rr, ldns_time(
NULL));
908 if (cur_parent_rr != cur_rr &&
913 cur_parent_tree->
rr = cur_parent_rr;
914 cur_parent_tree->
rrset = cur_rrset;
916 cur_rrset, cur_sig_rr,
917 cur_parent_rr, check_time);
919 cur_parent_tree, cur_sig_rr, cur_status);
932 new_tree, data_chain, cur_rr, cur_sig_rr, ldns_time(
NULL));
985 new_tree, data_chain, cur_rr, ldns_time(
NULL));
1034 cur_parent_tree,
NULL, result);
1044 new_tree, data_chain, ldns_time(
NULL));
1089 result = parent_result;
1113 if (!rrset || !rrsig || !keys) {
1131 keys, check_time, good_keys);
1142 return verify_result;
1159 if (!rrset || !rrsig || !keys) {
1189 return verify_result;
1205 if (res && domain && keys) {
1208 domain, keys, check_time))) {
1215 while (parent_domain &&
1252 if (parent_domain) {
1257 return trusted_keys;
1267 res, domain, keys, ldns_time(
NULL), status);
1280 uint16_t key_i; uint16_t key_j; uint16_t key_k;
1281 uint16_t sig_i;
ldns_rr * cur_sig;
1341 return trusted_keys;
1361 return trusted_keys;
1370 res, domain, keys, ldns_time(
NULL));
1418 return trusted_keys;
1438 uint16_t sig_i; uint16_t key_i;
1443 if (!res || !rrset || !rrsigs) {
1477 if (validating_keys) {
1500 res, rrset, rrsigs, ldns_time(
NULL), validating_keys);
1517 bool name_covered =
false;
1518 bool type_covered =
false;
1519 bool wildcard_covered =
false;
1520 bool wildcard_type_covered =
false;
1543 wildcard_covered =
true;
1548 type_covered =
true;
1552 name_covered =
true;
1559 wildcard_type_covered =
true;
1564 wildcard_covered =
true;
1571 if (type_covered || !name_covered) {
1575 if (wildcard_type_covered || !wildcard_covered) {
1588 ,
bool packet_nodata
1595 bool wildcard_covered =
false;
1599 ldns_rdf *next_closer = next_closer;
1616 if(!closest_encloser) {
1625 hashed_wildcard_name =
1632 hashed_wildcard_name)) {
1633 wildcard_covered =
true;
1641 if (! wildcard_covered) {
1680 if(!closest_encloser) {
1687 hashed_wildcard_name =
1751 if(!closest_encloser) {
1761 hashed_next_closer = hashed_name;
1781 hashed_next_closer) &&
1817 rr, nsecs, rrsigs, packet_rcode,
1818 packet_qtype, packet_nodata,
NULL
1827 uint8_t asn[37] = { 0x30, 0x63, 0x30, 0x1c, 0x06, 0x06, 0x2a, 0x85,
1828 0x03, 0x02, 0x02, 0x13, 0x30, 0x12, 0x06, 0x07, 0x2a, 0x85,
1829 0x03, 0x02, 0x02, 0x23, 0x01, 0x06, 0x07, 0x2a, 0x85, 0x03,
1830 0x02, 0x02, 0x1e, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40};
1831 unsigned char encoded[37+64];
1832 const unsigned char* pp;
1839 memmove(encoded, asn, 37);
1840 memmove(encoded+37, key, 64);
1841 pp = (
unsigned char*)&encoded[0];
1843 return d2i_PUBKEY(
NULL, &pp, (
int)
sizeof(encoded));
1847 ldns_verify_rrsig_gost_raw(
unsigned char* sig,
size_t siglen,
1848 ldns_buffer* rrset,
unsigned char* key,
size_t keylen)
1862 evp_key, EVP_get_digestbyname(
"md_gost94"));
1863 EVP_PKEY_free(evp_key);
1873 unsigned char buf[256+2];
1874 const unsigned char* pp =
buf;
1879 if(keylen != 2*256/8)
return NULL;
1880 ec = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
1882 if(keylen != 2*384/8)
return NULL;
1883 ec = EC_KEY_new_by_curve_name(NID_secp384r1);
1885 if(!ec)
return NULL;
1886 if(keylen+1 >
sizeof(buf))
1890 buf[0] = POINT_CONVERSION_UNCOMPRESSED;
1891 memmove(buf+1, key, keylen);
1892 if(!o2i_ECPublicKey(&ec, &pp, (
int)keylen+1)) {
1896 evp_key = EVP_PKEY_new();
1901 if (!EVP_PKEY_assign_EC_KEY(evp_key, ec)) {
1902 EVP_PKEY_free(evp_key);
1910 ldns_verify_rrsig_ecdsa_raw(
unsigned char* sig,
size_t siglen,
1911 ldns_buffer* rrset,
unsigned char* key,
size_t keylen, uint8_t algo)
1924 else d = EVP_sha384();
1926 EVP_PKEY_free(evp_key);
1936 (
unsigned char*)ldns_buffer_begin(rawsig_buf),
1937 ldns_buffer_position(rawsig_buf),
1939 (
unsigned char*)ldns_buffer_begin(key_buf),
1940 ldns_buffer_position(key_buf), algo);
1945 ldns_buffer *verify_buf,
unsigned char* key,
size_t keylen,
1984 return ldns_verify_rrsig_gost_raw(sig, siglen, verify_buf,
1991 return ldns_verify_rrsig_ecdsa_raw(sig, siglen, verify_buf,
2021 uint8_t label_count;
2044 wildcard_chopped = wildcard_chopped_tmp;
2070 if (rrsig ==
NULL) {
2151 ldns_rrsig_check_timestamps(
ldns_rr* rrsig, time_t now)
2153 int32_t inception, expiration;
2161 if (expiration - inception < 0) {
2165 if (((int32_t) now) - inception < 0) {
2169 if (expiration - ((int32_t) now) < 0) {
2199 result = ldns_rrsig2rawsig_buffer(rawsig_buf, rrsig);
2205 ldns_rrset_use_signature_ttl(rrset_clone, rrsig);
2237 if (rrsig ==
NULL) {
2274 verify_buf, key_buf, sig_algo);
2318 result = ldns_rrsig_check_timestamps(rrsig, check_time);
2345 rrset, rrsig, keys, ldns_time(
NULL), good_keys);
2377 result = ldns_prepare_for_verify(rawsig_buf, verify_buf,
2378 rrset_clone, rrsig);
2389 status = ldns_verify_test_sig_key(rawsig_buf, verify_buf,
2453 result = ldns_prepare_for_verify(rawsig_buf, verify_buf,
2454 rrset_clone, rrsig);
2461 result = ldns_verify_test_sig_key(rawsig_buf, verify_buf,
2470 result = ldns_rrsig_check_timestamps(rrsig, check_time);
2486 const EVP_MD *digest_type)
2489 (
unsigned char*)ldns_buffer_begin(sig),
2490 ldns_buffer_position(sig),
2498 ldns_buffer *rrset, EVP_PKEY *key,
const EVP_MD *digest_type)
2503 EVP_MD_CTX_init(&ctx);
2505 EVP_VerifyInit(&ctx, digest_type);
2506 EVP_VerifyUpdate(&ctx,
2507 ldns_buffer_begin(rrset),
2508 ldns_buffer_position(rrset));
2509 res = EVP_VerifyFinal(&ctx, sig, (
unsigned int) siglen, key);
2511 EVP_MD_CTX_cleanup(&ctx);
2515 }
else if (res == 0) {
2527 (
unsigned char*) ldns_buffer_begin(sig),
2528 ldns_buffer_position(sig),
2530 (
unsigned char*) ldns_buffer_begin(key),
2531 ldns_buffer_position(key));
2538 (
unsigned char*)ldns_buffer_begin(sig),
2539 ldns_buffer_position(sig),
2541 (
unsigned char*) ldns_buffer_begin(key),
2542 ldns_buffer_position(key));
2549 (
unsigned char*)ldns_buffer_begin(sig),
2550 ldns_buffer_position(sig),
2552 (
unsigned char*) ldns_buffer_begin(key),
2553 ldns_buffer_position(key));
2558 ldns_buffer* rrset,
unsigned char* key,
size_t keylen)
2563 evp_key = EVP_PKEY_new();
2573 EVP_PKEY_free(evp_key);
2580 ldns_buffer* rrset,
unsigned char* key,
size_t keylen)
2585 evp_key = EVP_PKEY_new();
2595 EVP_PKEY_free(evp_key);
2611 evp_key = EVP_PKEY_new();
2621 EVP_PKEY_free(evp_key);
2646 evp_key = EVP_PKEY_new();
2656 EVP_PKEY_free(evp_key);
2681 evp_key = EVP_PKEY_new();
2691 EVP_PKEY_free(evp_key);
ldns_rdf * ldns_rr_rdf(const ldns_rr *rr, size_t nr)
returns the rdata field member counter.
implementation of buffers to ease operations
ldns_rdf * ldns_rr_rrsig_labels(const ldns_rr *r)
returns the number of labels of a LDNS_RR_TYPE_RRSIG RR
bool ldns_nsec_covers_name(const ldns_rr *nsec, const ldns_rdf *name)
Checks coverage of NSEC(3) RR name span Remember that nsec and name must both be in canonical form (i...
ldns_rr_list * ldns_rr_list_new()
creates a new rr_list structure.
ldns_rr_list * signatures
void ldns_dnssec_derive_trust_tree_normal_rrset_time(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_sig_rr, time_t check_time)
Sub function for derive_trust_tree that is used for a 'normal' rrset.
ldns_rr * ldns_rr_clone(const ldns_rr *rr)
clones a rr and all its data
void ldns_rdf_deep_free(ldns_rdf *rd)
frees a rdf structure and frees the data.
uint8_t ldns_dname_label_count(const ldns_rdf *r)
count the number of labels inside a LDNS_RDF_DNAME type rdf.
bool ldns_rr_compare_ds(const ldns_rr *orr1, const ldns_rr *orr2)
returns true of the given rr's are equal.
void ldns_rr2canonical(ldns_rr *rr)
converts each dname in a rr to its canonical form.
RSA * ldns_key_buf2rsa_raw(unsigned char *key, size_t len)
Like ldns_key_buf2rsa, but uses raw buffer.
the canonical name for an alias
void ldns_dnssec_trust_tree_print_sm_fmt(FILE *out, const ldns_output_format *fmt, ldns_dnssec_trust_tree *tree, size_t tabs, bool extended, uint8_t *sibmap, size_t treedepth)
ldns_rr_type ldns_rdf2rr_type(const ldns_rdf *rd)
convert an rdf of type LDNS_RDF_TYPE_TYPE to an actual LDNS_RR_TYPE.
ldns_status ldns_verify_trusted_time(ldns_resolver *res, ldns_rr_list *rrset, ldns_rr_list *rrsigs, time_t check_time, ldns_rr_list *validating_keys)
Verifies a list of signatures for one RRset using a valid trust path.
ldns_rr_list * ldns_pkt_rr_list_by_name_and_type(const ldns_pkt *packet, const ldns_rdf *ownername, ldns_rr_type type, ldns_pkt_section sec)
return all the rr with a specific type and type from a packet.
int ldns_dname_compare(const ldns_rdf *dname1, const ldns_rdf *dname2)
Compares the two dname rdf's according to the algorithm for ordering in RFC4034 Section 6...
ldns_status ldns_verify_rrsig_evp(ldns_buffer *sig, ldns_buffer *rrset, EVP_PKEY *key, const EVP_MD *digest_type)
verifies a buffer with signature data for a buffer with rrset data with an EVP_PKEY ...
bool ldns_dnssec_pkt_has_rrsigs(const ldns_pkt *pkt)
Checks whether the packet contains rrsigs.
DNS stub resolver structure.
ldns_rdf * ldns_rr_rrsig_inception(const ldns_rr *r)
returns the inception time of a LDNS_RR_TYPE_RRSIG RR
enum ldns_enum_rr_class ldns_rr_class
bool ldns_rr_list_push_rr(ldns_rr_list *rr_list, const ldns_rr *rr)
pushes an rr to an rrlist.
ldns_pkt * ldns_resolver_query(const ldns_resolver *r, const ldns_rdf *name, ldns_rr_type t, ldns_rr_class c, uint16_t flags)
Send a query to a nameserver.
ldns_rdf * ldns_nsec_get_bitmap(ldns_rr *nsec)
Returns the rdata field that contains the bitmap of the covered types of the given NSEC record...
List or Set of Resource Records.
ldns_status ldns_str2rdf_dname(ldns_rdf **d, const char *str)
convert a dname string into wireformat
ldns_pkt_rcode ldns_pkt_get_rcode(const ldns_pkt *packet)
Return the packet's respons code.
uint8_t ldns_rdf2native_int8(const ldns_rdf *rd)
returns the native uint8_t representation from the rdf.
ldns_status parent_status[10]
ldns_status ldns_verify_rrsig_buffers(ldns_buffer *rawsig_buf, ldns_buffer *verify_buf, ldns_buffer *key_buf, uint8_t algo)
Verifies the already processed data in the buffers This function should probably not be used directly...
void ldns_dnssec_derive_trust_tree_ds_rrset(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr)
Sub function for derive_trust_tree that is used for DS rrsets.
void ldns_dnssec_trust_tree_print_sm(FILE *out, ldns_dnssec_trust_tree *tree, size_t tabs, bool extended, uint8_t *sibmap, size_t treedepth)
void ldns_dnssec_trust_tree_print(FILE *out, ldns_dnssec_trust_tree *tree, size_t tabs, bool extended)
ldns_status ldns_dnssec_verify_denial(ldns_rr *rr, ldns_rr_list *nsecs, ldns_rr_list *rrsigs)
denial is not just a river in egypt
ldns_status ldns_rr_list2buffer_wire(ldns_buffer *buffer, const ldns_rr_list *rr_list)
Copies the rr_list data to the buffer in wire format.
#define LDNS_CALLOC(type, count)
#define LDNS_XMALLOC(type, count)
void ldns_dnssec_derive_trust_tree_normal_rrset(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_sig_rr)
Sub function for derive_trust_tree that is used for a 'normal' rrset.
size_t ldns_rdf_size(const ldns_rdf *rd)
returns the size of the rdf.
ldns_status ldns_verify_rrsig_evp_raw(unsigned char *sig, size_t siglen, ldns_buffer *rrset, EVP_PKEY *key, const EVP_MD *digest_type)
Like ldns_verify_rrsig_evp, but uses raw signature data.
ldns_status ldns_convert_dsa_rrsig_rdf2asn1(ldns_buffer *target_buffer, const ldns_rdf *sig_rdf)
Converts the RRSIG signature RDF (in rfc2536 format) to a buffer with the signature in rfc2459 format...
void ldns_dnssec_data_chain_deep_free(ldns_dnssec_data_chain *chain)
Frees a dnssec_data_chain structure, and all data contained therein.
ldns_lookup_table ldns_rcodes[]
Response codes.
ldns_rr_list * ldns_fetch_valid_domain_keys_time(const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys, time_t check_time, ldns_status *status)
Tries to build an authentication chain from the given keys down to the queried domain.
void ldns_rr_list_deep_free(ldns_rr_list *rr_list)
frees an rr_list structure and all rrs contained therein.
void ldns_buffer_free(ldns_buffer *buffer)
frees the buffer.
ldns_rr_list * ldns_validate_domain_ds(const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys)
Validates the DS RRset for the given domain using the provided trusted keys.
ldns_status ldns_verify_rrsig_rsasha1_raw(unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
Like ldns_verify_rrsig_rsasha1, but uses raw signature and key data.
EVP_PKEY * ldns_gost2pkey_raw(unsigned char *key, size_t keylen)
Converts a holding buffer with key material to EVP PKEY in openssl.
void ldns_dnssec_derive_trust_tree_ds_rrset_time(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr, time_t check_time)
Sub function for derive_trust_tree that is used for DS rrsets.
ldns_rdf * ldns_rdf_clone(const ldns_rdf *rd)
clones a rdf structure.
ldns_dnssec_trust_tree * ldns_dnssec_derive_trust_tree_time(ldns_dnssec_data_chain *data_chain, ldns_rr *rr, time_t check_time)
Generates a dnssec_trust_tree for the given rr from the given data_chain.
void ldns_dname2canonical(const ldns_rdf *rd)
Put a dname into canonical fmt - ie.
ldns_rr * parent_signature[10]
for debugging, add signatures too (you might want those if they contain errors)
signed char packet_nodata
ldns_status ldns_verify_rrsig_rsasha256_raw(unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
Like ldns_verify_rrsig_rsasha256, but uses raw signature and key data.
ldns_rdf * ldns_rr_rrsig_keytag(const ldns_rr *r)
returns the keytag of a LDNS_RR_TYPE_RRSIG RR
size_t ldns_rr_rd_count(const ldns_rr *rr)
returns the rd_count of an rr structure.
ldns_rdf * ldns_nsec3_hash_name_frm_nsec3(const ldns_rr *nsec, ldns_rdf *name)
Calculates the hashed name using the parameters of the given NSEC3 RR.
#define LDNS_MAX_PACKETLEN
ldns_status ldns_verify_notime(ldns_rr_list *rrset, ldns_rr_list *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
Verifies a list of signatures for one rrset, but disregard the time.
ldns_rdf * ldns_dname_left_chop(const ldns_rdf *d)
chop one label off the left side of a dname.
ldns_rr_list * ldns_resolver_dnssec_anchors(const ldns_resolver *r)
Get the resolver's DNSSEC anchors.
void ldns_rr_list_free(ldns_rr_list *rr_list)
frees an rr_list structure.
ldns_rr_list * ldns_pkt_rr_list_by_type(const ldns_pkt *packet, ldns_rr_type type, ldns_pkt_section sec)
return all the rr with a specific type from a packet.
const ldns_rr_descriptor * ldns_rr_descript(uint16_t type)
returns the resource record descriptor for the given rr type.
void ldns_dnssec_derive_trust_tree_no_sig(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain)
Sub function for derive_trust_tree that is used when there are no signatures.
const ldns_output_format * ldns_output_format_default
The default output format record.
ldns_rr_list * ldns_validate_domain_dnskey_time(const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys, time_t check_time)
Validates the DNSKEY RRset for the given domain using the provided trusted keys.
ldns_status ldns_rdf2buffer_wire(ldns_buffer *buffer, const ldns_rdf *rdf)
Copies the rdata data to the buffer in wire format.
ldns_rr_list * ldns_fetch_valid_domain_keys(const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys, ldns_status *status)
Tries to build an authentication chain from the given keys down to the queried domain.
ldns_status ldns_verify_rrsig_buffers_raw(unsigned char *sig, size_t siglen, ldns_buffer *verify_buf, unsigned char *key, size_t keylen, uint8_t algo)
Like ldns_verify_rrsig_buffers, but uses raw data.
ldns_status ldns_verify_rrsig_keylist_notime(ldns_rr_list *rrset, ldns_rr *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
Verifies an rrsig.
Including this file will include all ldns files, and define some lookup tables.
ldns_rdf * ldns_dname_new_frm_str(const char *str)
creates a new dname rdf from a string.
ldns_status ldns_verify_rrsig_time(ldns_rr_list *rrset, ldns_rr *rrsig, ldns_rr *key, time_t check_time)
verify an rrsig with 1 key
ldns_rr_list * ldns_dnssec_pkt_get_rrsigs_for_name_and_type(const ldns_pkt *pkt, ldns_rdf *name, ldns_rr_type type)
Returns a ldns_rr_list containing the signatures covering the given name and type.
ldns_dnssec_trust_tree * ldns_dnssec_trust_tree_new()
Creates a new (empty) dnssec_trust_tree structure.
ldns_rr_list * ldns_dnssec_pkt_get_rrsigs_for_type(const ldns_pkt *pkt, ldns_rr_type type)
Returns a ldns_rr_list containing the signatures covering the given type.
ldns_rdf * ldns_dname_clone_from(const ldns_rdf *d, uint16_t n)
Clones the given dname from the nth label on.
ldns_rr * ldns_rr_list_rr(const ldns_rr_list *rr_list, size_t nr)
returns a specific rr of an rrlist.
void ldns_rr_print_fmt(FILE *output, const ldns_output_format *fmt, const ldns_rr *rr)
Prints the data in the resource record to the given file stream (in presentation format) ...
ldns_rr_list * ldns_validate_domain_dnskey(const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys)
Validates the DNSKEY RRset for the given domain using the provided trusted keys.
ldns_status ldns_dnssec_trust_tree_contains_keys(ldns_dnssec_trust_tree *tree, ldns_rr_list *trusted_keys)
Returns OK if there is a trusted path in the tree to one of the DNSKEY or DS RRs in the given list...
ldns_dnssec_data_chain * parent
void ldns_dnssec_data_chain_print_fmt(FILE *out, const ldns_output_format *fmt, const ldns_dnssec_data_chain *chain)
Prints the dnssec_data_chain to the given file stream.
uint16_t ldns_pkt_ancount(const ldns_pkt *packet)
Return the packet's an count.
ldns_dnssec_trust_tree * ldns_dnssec_derive_trust_tree(ldns_dnssec_data_chain *data_chain, ldns_rr *rr)
Generates a dnssec_trust_tree for the given rr from the given data_chain.
uint16_t ldns_rdf2native_int16(const ldns_rdf *rd)
returns the native uint16_t representation from the rdf.
time_t ldns_rdf2native_time_t(const ldns_rdf *rd)
returns the native time_t representation from the rdf.
size_t ldns_dnssec_trust_tree_depth(ldns_dnssec_trust_tree *tree)
returns the depth of the trust tree
void ldns_dnssec_data_chain_free(ldns_dnssec_data_chain *chain)
Frees a dnssec_data_chain structure.
ldns_status ldns_verify_rrsig_keylist_time(ldns_rr_list *rrset, ldns_rr *rrsig, const ldns_rr_list *keys, time_t check_time, ldns_rr_list *good_keys)
Verifies an rrsig.
void ldns_dnssec_trust_tree_free(ldns_dnssec_trust_tree *tree)
Frees the dnssec_trust_tree recursively.
ldns_lookup_table * ldns_lookup_by_id(ldns_lookup_table *table, int id)
ldns_status ldns_verify_time(ldns_rr_list *rrset, ldns_rr_list *rrsig, const ldns_rr_list *keys, time_t check_time, ldns_rr_list *good_keys)
Verifies a list of signatures for one rrset.
ldns_pkt_rcode packet_rcode
ldns_status ldns_verify_rrsig_rsasha512_raw(unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
Like ldns_verify_rrsig_rsasha512, but uses raw signature and key data.
int ldns_key_EVP_load_gost_id(void)
Get the PKEY id for GOST, loads GOST into openssl as a side effect.
ldns_status ldns_dname_cat(ldns_rdf *rd1, ldns_rdf *rd2)
concatenates rd2 after rd1 (rd2 is copied, rd1 is modified)
ldns_rr_list * ldns_validate_domain_ds_time(const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys, time_t check_time)
Validates the DS RRset for the given domain using the provided trusted keys.
bool ldns_nsec3_optout(const ldns_rr *nsec3_rr)
Returns true if the opt-out flag has been set in the given NSEC3 RR.
uint16_t ldns_calc_keytag(const ldns_rr *key)
calculates a keytag of a key for use in DNSSEC.
enum ldns_enum_pkt_rcode ldns_pkt_rcode
Contains all information about resource record types.
void ldns_dnssec_data_chain_print(FILE *out, const ldns_dnssec_data_chain *chain)
Prints the dnssec_data_chain to the given file stream.
draft-ietf-dnsext-delegation
ldns_status ldns_dnssec_verify_denial_nsec3_match(ldns_rr *rr, ldns_rr_list *nsecs, ldns_rr_list *rrsigs __attribute__((unused)), ldns_pkt_rcode packet_rcode, ldns_rr_type packet_qtype, bool packet_nodata, ldns_rr **match)
ldns_status ldns_verify_rrsig_keylist(ldns_rr_list *rrset, ldns_rr *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
Verifies an rrsig.
ldns_rr_list * ldns_rr_list_clone(const ldns_rr_list *rrlist)
clones an rrlist.
ldns_rdf * ldns_nsec3_bitmap(const ldns_rr *nsec3_rr)
Returns the bitmap specifying the covered types of the given NSEC3 RR.
ldns_dnssec_trust_tree * parents[10]
DSA * ldns_key_buf2dsa_raw(unsigned char *key, size_t len)
Like ldns_key_buf2dsa, but uses raw buffer.
void ldns_rr_set_owner(ldns_rr *rr, ldns_rdf *owner)
sets the owner in the rr structure.
ldns_rdf * ldns_dnssec_nsec3_closest_encloser(ldns_rdf *qname, ldns_rr_type qtype __attribute__((unused)), ldns_rr_list *nsec3s)
void ldns_rdf_print(FILE *output, const ldns_rdf *rdf)
Prints the data in the rdata field to the given file stream (in presentation format) ...
uint32_t ldns_rdf2native_int32(const ldns_rdf *rd)
returns the native uint32_t representation from the rdf.
ldns_rr_type ldns_rr_get_type(const ldns_rr *rr)
returns the type of the rr.
ldns_rr * ldns_dnssec_get_rrsig_for_name_and_type(const ldns_rdf *name, const ldns_rr_type type, const ldns_rr_list *rrs)
Returns the first RRSIG rr that corresponds to the rrset with the given name and type.
ldns_rdf * ldns_rr_rrsig_typecovered(const ldns_rr *r)
returns the type covered of a LDNS_RR_TYPE_RRSIG rr
ldns_dnssec_data_chain * ldns_dnssec_build_data_chain(ldns_resolver *res, uint16_t qflags, const ldns_rr_list *rrset, const ldns_pkt *pkt, ldns_rr *orig_rr)
Build an ldns_dnssec_data_chain, which contains all DNSSEC data that is needed to derive the trust tr...
ldns_rr_type packet_qtype
ldns_rr_list * ldns_rr_list_pop_rrset(ldns_rr_list *rr_list)
pops the first rrset from the list, the list must be sorted, so that all rr's from each rrset are nex...
void ldns_rr_set_ttl(ldns_rr *rr, uint32_t ttl)
sets the ttl in the rr structure.
ldns_dnssec_data_chain * ldns_dnssec_data_chain_new()
Creates a new dnssec_chain structure.
enum ldns_enum_status ldns_status
ldns_buffer * ldns_buffer_new(size_t capacity)
creates a new buffer with the specified capacity.
A general purpose lookup table.
bool ldns_nsec_bitmap_covers_type(const ldns_rdf *nsec_bitmap, ldns_rr_type type)
Checks coverage of NSEC RR type bitmap.
ldns_dnssec_data_chain * ldns_dnssec_build_data_chain_nokeyname(ldns_resolver *res, uint16_t qflags, ldns_rr *orig_rr, const ldns_rr_list *rrset, ldns_dnssec_data_chain *new_chain)
EVP_PKEY * ldns_ecdsa2pkey_raw(unsigned char *key, size_t keylen, uint8_t algo)
Converts a holding buffer with key material to EVP PKEY in openssl.
ldns_status ldns_verify_rrsig_dsa_raw(unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
Like ldns_verify_rrsig_dsa, but uses raw signature and key data.
#define LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS
dnssec_verify
ldns_rdf * ldns_rr_rrsig_signame(const ldns_rr *r)
returns the signers name of a LDNS_RR_TYPE_RRSIG RR
void ldns_dnssec_trust_tree_print_fmt(FILE *out, const ldns_output_format *fmt, ldns_dnssec_trust_tree *tree, size_t tabs, bool extended)
ldns_status ldns_dnssec_trust_tree_add_parent(ldns_dnssec_trust_tree *tree, const ldns_dnssec_trust_tree *parent, const ldns_rr *signature, const ldns_status parent_status)
Adds a trust tree as a parent for the given trust tree.
ldns_status ldns_verify_rrsig_rsasha1(ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key)
verifies a buffer with signature data (RSASHA1) for a buffer with rrset data with a buffer with key d...
Resource record data field.
ldns_status ldns_verify_trusted(ldns_resolver *res, ldns_rr_list *rrset, ldns_rr_list *rrsigs, ldns_rr_list *validating_keys)
Verifies a list of signatures for one RRset using a valid trust path.
ldns_rdf * ldns_rr_owner(const ldns_rr *rr)
returns the owner name of an rr structure.
void ldns_dnssec_derive_trust_tree_dnskey_rrset_time(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr, ldns_rr *cur_sig_rr, time_t check_time)
Sub function for derive_trust_tree that is used for DNSKEY rrsets.
ldns_status ldns_verify_rrsig_rsamd5(ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key)
verifies a buffer with signature data (RSAMD5) for a buffer with rrset data with a buffer with key da...
size_t ldns_rr_list_rr_count(const ldns_rr_list *rr_list)
returns the number of rr's in an rr_list.
enum ldns_enum_rr_type ldns_rr_type
const char * _name
Textual name of the RR type.
ldns_status ldns_convert_ecdsa_rrsig_rdf2asn1(ldns_buffer *target_buffer, const ldns_rdf *sig_rdf)
Converts the RRSIG signature RDF (from DNS) to a buffer with the signature in ASN1 format as openssl ...
an authoritative name server
ldns_status ldns_rrsig2buffer_wire(ldns_buffer *buffer, const ldns_rr *rr)
Converts a rrsig to wireformat BUT EXCLUDE the rrsig rdata This is needed in DNSSEC verification...
const char * ldns_get_errorstr_by_id(ldns_status err)
look up a descriptive text by each error.
ldns_rr_class ldns_rr_get_class(const ldns_rr *rr)
returns the class of the rr.
used to get all non-question rrs from a packet
bool ldns_rr_list_cat(ldns_rr_list *left, ldns_rr_list *right)
concatenates two ldns_rr_lists together.
ldns_status ldns_verify_rrsig(ldns_rr_list *rrset, ldns_rr *rrsig, ldns_rr *key)
verify an rrsig with 1 key
ldns_status ldns_dnssec_verify_denial_nsec3(ldns_rr *rr, ldns_rr_list *nsecs, ldns_rr_list *rrsigs, ldns_pkt_rcode packet_rcode, ldns_rr_type packet_qtype, bool packet_nodata)
void ldns_pkt_free(ldns_pkt *packet)
frees the packet structure and all data that it contains.
void ldns_rr_list_sort(ldns_rr_list *unsorted)
sorts an rr_list (canonical wire format).
void ldns_dnssec_derive_trust_tree_no_sig_time(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, time_t check_time)
Sub function for derive_trust_tree that is used when there are no signatures.
ldns_status ldns_verify_rrsig_rsamd5_raw(unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
Like ldns_verify_rrsig_rsamd5, but uses raw signature and key data.
void ldns_dnssec_derive_trust_tree_dnskey_rrset(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr, ldns_rr *cur_sig_rr)
Sub function for derive_trust_tree that is used for DNSKEY rrsets.
ldns_status ldns_verify_rrsig_dsa(ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key)
verifies a buffer with signature data (DSA) for a buffer with rrset data with a buffer with key data...
ldns_status ldns_verify(ldns_rr_list *rrset, ldns_rr_list *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
Verifies a list of signatures for one rrset.
ldns_rdf * ldns_rr_rrsig_expiration(const ldns_rr *r)
returns the expiration time of a LDNS_RR_TYPE_RRSIG RR
void ldns_rr_list_print_fmt(FILE *output, const ldns_output_format *fmt, const ldns_rr_list *lst)
print a rr_list to output