ldns documentation

- Main Page
- Related Pages
- Data Structures
- Files

- File List
- Globals

Functions
dnssec_verify.c File Reference

Go to the source code of this file.

## Functions
ldns_dnssec_data_chain * | ldns_dnssec_data_chain_new (void)
| Creates a new dnssec_chain structure. More...
void | ldns_dnssec_data_chain_free (ldns_dnssec_data_chain *chain)
| Frees a dnssec_data_chain structure. More...
void | ldns_dnssec_data_chain_deep_free (ldns_dnssec_data_chain *chain)
| Frees a dnssec_data_chain structure, and all data contained therein. More...
void | ldns_dnssec_data_chain_print_fmt (FILE *out, const ldns_output_format *fmt, const ldns_dnssec_data_chain *chain)
| Prints the dnssec_data_chain to the given file stream. More...
void | ldns_dnssec_data_chain_print (FILE *out, const ldns_dnssec_data_chain *chain)
| Prints the dnssec_data_chain to the given file stream. More...
ldns_dnssec_data_chain * | ldns_dnssec_build_data_chain (ldns_resolver *res, uint16_t qflags, const ldns_rr_list *rrset, const ldns_pkt *pkt, ldns_rr *orig_rr)
| Build an ldns_dnssec_data_chain, which contains all DNSSEC data that is needed to derive the trust tree later. More...
ldns_dnssec_trust_tree * | ldns_dnssec_trust_tree_new (void)
| Creates a new (empty) dnssec_trust_tree structure. More...
void | ldns_dnssec_trust_tree_free (ldns_dnssec_trust_tree *tree)
| Frees the dnssec_trust_tree recursively. More...
size_t | ldns_dnssec_trust_tree_depth (ldns_dnssec_trust_tree *tree)
| returns the depth of the trust tree More...
void | ldns_dnssec_trust_tree_print_fmt (FILE *out, const ldns_output_format *fmt, ldns_dnssec_trust_tree *tree, size_t tabs, bool extended)
void | ldns_dnssec_trust_tree_print (FILE *out, ldns_dnssec_trust_tree *tree, size_t tabs, bool extended)
ldns_status | ldns_dnssec_trust_tree_add_parent (ldns_dnssec_trust_tree *tree, const ldns_dnssec_trust_tree *parent, const ldns_rr *signature, const ldns_status parent_status)
| Adds a trust tree as a parent for the given trust tree. More...
ldns_dnssec_trust_tree * | ldns_dnssec_derive_trust_tree_time (ldns_dnssec_data_chain *data_chain, ldns_rr *rr, time_t check_time)
| Generates a dnssec_trust_tree for the given rr from the given data_chain. More...
ldns_dnssec_trust_tree * | ldns_dnssec_derive_trust_tree (ldns_dnssec_data_chain *data_chain, ldns_rr *rr)
| Generates a dnssec_trust_tree for the given rr from the given data_chain. More...
void | ldns_dnssec_derive_trust_tree_normal_rrset_time (ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_sig_rr, time_t check_time)
| Sub function for derive_trust_tree that is used for a 'normal' rrset. More...
void | ldns_dnssec_derive_trust_tree_normal_rrset (ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_sig_rr)
| Sub function for derive_trust_tree that is used for a 'normal' rrset. More...
void | ldns_dnssec_derive_trust_tree_dnskey_rrset_time (ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr, ldns_rr *cur_sig_rr, time_t check_time)
| Sub function for derive_trust_tree that is used for DNSKEY rrsets. More...
void | ldns_dnssec_derive_trust_tree_dnskey_rrset (ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr, ldns_rr *cur_sig_rr)
| Sub function for derive_trust_tree that is used for DNSKEY rrsets. More...
void | ldns_dnssec_derive_trust_tree_ds_rrset_time (ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr, time_t check_time)
| Sub function for derive_trust_tree that is used for DS rrsets. More...
void | ldns_dnssec_derive_trust_tree_ds_rrset (ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr)
| Sub function for derive_trust_tree that is used for DS rrsets. More...
void | ldns_dnssec_derive_trust_tree_no_sig_time (ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, time_t check_time)
| Sub function for derive_trust_tree that is used when there are no signatures. More...
void | ldns_dnssec_derive_trust_tree_no_sig (ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain)
| Sub function for derive_trust_tree that is used when there are no signatures. More...
ldns_status | ldns_dnssec_trust_tree_contains_keys (ldns_dnssec_trust_tree *tree, ldns_rr_list *trusted_keys)
| Returns OK if there is a trusted path in the tree to one of the DNSKEY or DS RRs in the given list. More...
ldns_status | ldns_verify_time (ldns_rr_list *rrset, ldns_rr_list *rrsig, const ldns_rr_list *keys, time_t check_time, ldns_rr_list *good_keys)
| Verifies a list of signatures for one rrset. More...
ldns_status | ldns_verify (ldns_rr_list *rrset, ldns_rr_list *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
| Verifies a list of signatures for one rrset. More...
ldns_status | ldns_verify_notime (ldns_rr_list *rrset, ldns_rr_list *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
| Verifies a list of signatures for one rrset, but disregard the time. More...
ldns_rr_list * | ldns_fetch_valid_domain_keys_time (const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys, time_t check_time, ldns_status *status)
| Tries to build an authentication chain from the given keys down to the queried domain. More...
ldns_rr_list * | ldns_fetch_valid_domain_keys (const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys, ldns_status *status)
| Tries to build an authentication chain from the given keys down to the queried domain. More...
ldns_rr_list * | ldns_validate_domain_dnskey_time (const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys, time_t check_time)
| Validates the DNSKEY RRset for the given domain using the provided trusted keys. More...
ldns_rr_list * | ldns_validate_domain_dnskey (const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys)
| Validates the DNSKEY RRset for the given domain using the provided trusted keys. More...
ldns_rr_list * | ldns_validate_domain_ds_time (const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys, time_t check_time)
| Validates the DS RRset for the given domain using the provided trusted keys. More...
ldns_rr_list * | ldns_validate_domain_ds (const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys)
| Validates the DS RRset for the given domain using the provided trusted keys. More...
ldns_status | ldns_verify_trusted_time (ldns_resolver *res, ldns_rr_list *rrset, ldns_rr_list *rrsigs, time_t check_time, ldns_rr_list *validating_keys)
| Verifies a list of signatures for one RRset using a valid trust path. More...
ldns_status | ldns_verify_trusted (ldns_resolver *res, ldns_rr_list *rrset, ldns_rr_list *rrsigs, ldns_rr_list *validating_keys)
| Verifies a list of signatures for one RRset using a valid trust path. More...
ldns_status | ldns_dnssec_verify_denial (ldns_rr *rr, ldns_rr_list *nsecs, ldns_rr_list *rrsigs)
| denial is not just a river in egypt More...
ldns_status | ldns_dnssec_verify_denial_nsec3_match (ldns_rr *rr, ldns_rr_list *nsecs, ldns_rr_list *rrsigs __attribute__((unused)), ldns_pkt_rcode packet_rcode, ldns_rr_type packet_qtype, bool packet_nodata, ldns_rr **match)
ldns_status | ldns_dnssec_verify_denial_nsec3 (ldns_rr *rr, ldns_rr_list *nsecs, ldns_rr_list *rrsigs, ldns_pkt_rcode packet_rcode, ldns_rr_type packet_qtype, bool packet_nodata)
EVP_PKEY * | ldns_gost2pkey_raw (unsigned char *key, size_t keylen)
| Converts a holding buffer with key material to EVP PKEY in openssl. More...
EVP_PKEY * | ldns_ecdsa2pkey_raw (unsigned char *key, size_t keylen, uint8_t algo)
| Converts a holding buffer with key material to EVP PKEY in openssl. More...
ldns_status | ldns_verify_rrsig_buffers (ldns_buffer *rawsig_buf, ldns_buffer *verify_buf, ldns_buffer *key_buf, uint8_t algo)
| Verifies the already processed data in the buffers This function should probably not be used directly. More...
ldns_status | ldns_verify_rrsig_buffers_raw (unsigned char *sig, size_t siglen, ldns_buffer *verify_buf, unsigned char *key, size_t keylen, uint8_t algo)
| Like ldns_verify_rrsig_buffers, but uses raw data. More...
ldns_status | ldns_verify_rrsig_keylist_time (ldns_rr_list *rrset, ldns_rr *rrsig, const ldns_rr_list *keys, time_t check_time, ldns_rr_list *good_keys)
| Verifies an rrsig. More...
ldns_status | ldns_verify_rrsig_keylist (ldns_rr_list *rrset, ldns_rr *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
| Verifies an rrsig. More...
ldns_status | ldns_verify_rrsig_keylist_notime (ldns_rr_list *rrset, ldns_rr *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
| Verifies an rrsig. More...
ldns_status | ldns_verify_rrsig_time (ldns_rr_list *rrset, ldns_rr *rrsig, ldns_rr *key, time_t check_time)
| verify an rrsig with 1 key More...
ldns_status | ldns_verify_rrsig (ldns_rr_list *rrset, ldns_rr *rrsig, ldns_rr *key)
| verify an rrsig with 1 key More...
ldns_status | ldns_verify_rrsig_evp (ldns_buffer *sig, ldns_buffer *rrset, EVP_PKEY *key, const EVP_MD *digest_type)
| verifies a buffer with signature data for a buffer with rrset data with an EVP_PKEY More...
ldns_status | ldns_verify_rrsig_evp_raw (unsigned char *sig, size_t siglen, ldns_buffer *rrset, EVP_PKEY *key, const EVP_MD *digest_type)
| Like ldns_verify_rrsig_evp, but uses raw signature data. More...
ldns_status | ldns_verify_rrsig_dsa (ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key)
| verifies a buffer with signature data (DSA) for a buffer with rrset data with a buffer with key data. More...
ldns_status | ldns_verify_rrsig_rsasha1 (ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key)
| verifies a buffer with signature data (RSASHA1) for a buffer with rrset data with a buffer with key data. More...
ldns_status | ldns_verify_rrsig_rsamd5 (ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key)
| verifies a buffer with signature data (RSAMD5) for a buffer with rrset data with a buffer with key data. More...
ldns_status | ldns_verify_rrsig_dsa_raw (unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
| Like ldns_verify_rrsig_dsa, but uses raw signature and key data. More...
ldns_status | ldns_verify_rrsig_rsasha1_raw (unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
| Like ldns_verify_rrsig_rsasha1, but uses raw signature and key data. More...
ldns_status | ldns_verify_rrsig_rsasha256_raw (unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
| Like ldns_verify_rrsig_rsasha256, but uses raw signature and key data. More...
ldns_status | ldns_verify_rrsig_rsasha512_raw (unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
| Like ldns_verify_rrsig_rsasha512, but uses raw signature and key data. More...
ldns_status | ldns_verify_rrsig_rsamd5_raw (unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
| Like ldns_verify_rrsig_rsamd5, but uses raw signature and key data. More...

## Function Documentation

ldns_dnssec_data_chain* ldns_dnssec_data_chain_new | ( | void |  | ) |

Creates a new dnssec_chain structure.

Returns
  ldns_dnssec_data_chain *

Definition at line 19 of file dnssec_verify.c.

References LDNS_CALLOC.

void ldns_dnssec_data_chain_free | ( | ldns_dnssec_data_chain * | chain | ) |

Frees a dnssec_data_chain structure.

Parameters

  [in] | *chain | The chain to free

Definition at line 39 of file dnssec_verify.c.

References LDNS_FREE.

void ldns_dnssec_data_chain_deep_free | ( | ldns_dnssec_data_chain * | chain | ) |

Frees a dnssec_data_chain structure, and all data contained therein.

Parameters

  [in] | *chain | The dnssec_data_chain to free

Definition at line 45 of file dnssec_verify.c.

References ldns_dnssec_data_chain_deep_free(), LDNS_FREE, ldns_rr_list_deep_free(), ldns_dnssec_data_chain_struct::parent, ldns_dnssec_data_chain_struct::rrset, and ldns_dnssec_data_chain_struct::signatures.

void ldns_dnssec_data_chain_print_fmt | ( | FILE * | out,
|  | const ldns_output_format * | fmt,
|  | const ldns_dnssec_data_chain * | chain
| ) |  |

Prints the dnssec_data_chain to the given file stream.

Parameters

  [in] | *out | The file stream to print to
  [in] | *fmt | The format of the textual representation
  [in] | *chain | The dnssec_data_chain to print

Definition at line 56 of file dnssec_verify.c.

References ldns_struct_rr_descriptor::_name, ldns_dnssec_data_chain_print_fmt(), ldns_lookup_by_id(), ldns_rcodes, ldns_rr_descript(), ldns_rr_list_print_fmt(), ldns_rr_list_rr_count(), ldns_struct_lookup_table::name, ldns_dnssec_data_chain_struct::packet_nodata, ldns_dnssec_data_chain_struct::packet_qtype, ldns_dnssec_data_chain_struct::packet_rcode, ldns_dnssec_data_chain_struct::parent, ldns_dnssec_data_chain_struct::rrset, and ldns_dnssec_data_chain_struct::signatures.

void ldns_dnssec_data_chain_print | ( | FILE * | out,
|  | const ldns_dnssec_data_chain * | chain
| ) |  |

Prints the dnssec_data_chain to the given file stream.

Parameters

  [in] | *out | The file stream to print to
  [in] | *chain | The dnssec_data_chain to print

Definition at line 91 of file dnssec_verify.c.

References ldns_dnssec_build_data_chain(), ldns_dnssec_data_chain_print_fmt(), ldns_output_format_default, ldns_pkt_ancount(), ldns_pkt_free(), ldns_pkt_rr_list_by_name_and_type(), ldns_resolver_query(), LDNS_RR_CLASS_IN, ldns_rr_list_clone(), ldns_rr_list_deep_free(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_owner(), LDNS_RR_TYPE_DNSKEY, LDNS_RR_TYPE_DS, LDNS_RR_TYPE_RRSIG, LDNS_SECTION_ANSWER, LDNS_SECTION_ANY_NOQUESTION, ldns_dnssec_data_chain_struct::packet_qtype, ldns_dnssec_data_chain_struct::parent, ldns_dnssec_data_chain_struct::parent_type, and ldns_dnssec_data_chain_struct::signatures.

ldns_dnssec_data_chain* ldns_dnssec_build_data_chain | ( | ldns_resolver * | res,
|  | const uint16_t | qflags,
|  | const ldns_rr_list * | data_set,
|  | const ldns_pkt * | pkt,
|  | ldns_rr * | orig_rr
| ) |  |

Build an ldns_dnssec_data_chain, which contains all DNSSEC data that is needed to derive the trust tree later.

The data_set will be cloned

Parameters

  [in] | *res | resolver structure for further needed queries
  [in] | qflags | resolution flags
  [in] | *data_set | The original rrset where the chain ends
  [in] | *pkt | optional, can contain the original packet (and hence the sigs and maybe the key)
  [in] | *orig_rr | The original Resource Record

Returns
  the DNSSEC data chain

Definition at line 270 of file dnssec_verify.c.

References ldns_dnssec_build_data_chain(), ldns_dnssec_data_chain_new(), ldns_dnssec_pkt_get_rrsigs_for_name_and_type(), ldns_dnssec_pkt_get_rrsigs_for_type(), ldns_dnssec_pkt_has_rrsigs(), ldns_pkt_ancount(), ldns_pkt_free(), ldns_pkt_get_rcode(), ldns_pkt_rr_list_by_type(), ldns_resolver_query(), ldns_rr_get_class(), ldns_rr_get_type(), ldns_rr_list_clone(), ldns_rr_list_deep_free(), ldns_rr_list_new(), ldns_rr_list_push_rr(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_owner(), ldns_rr_rdf(), LDNS_RR_TYPE_DNSKEY, LDNS_RR_TYPE_NSEC, LDNS_RR_TYPE_NSEC3, LDNS_SECTION_ANY_NOQUESTION, ldns_dnssec_data_chain_struct::packet_nodata, ldns_dnssec_data_chain_struct::packet_qtype, ldns_dnssec_data_chain_struct::packet_rcode, ldns_dnssec_data_chain_struct::parent, and ldns_dnssec_data_chain_struct::rrset.

ldns_dnssec_trust_tree* ldns_dnssec_trust_tree_new | ( | void |  | ) |

Creates a new (empty) dnssec_trust_tree structure.

Returns
  ldns_dnssec_trust_tree *

Definition at line 442 of file dnssec_verify.c.

References LDNS_XMALLOC, ldns_dnssec_trust_tree_struct::parent_count, ldns_dnssec_trust_tree_struct::rr, and ldns_dnssec_trust_tree_struct::rrset.

void ldns_dnssec_trust_tree_free | ( | ldns_dnssec_trust_tree * | tree | ) |

Frees the dnssec_trust_tree recursively.

There is no deep free; all data in the trust tree consists of pointers to a data_chain

Parameters

  [in] | tree | The tree to free

Definition at line 455 of file dnssec_verify.c.

References ldns_dnssec_trust_tree_free(), LDNS_FREE, ldns_dnssec_trust_tree_struct::parent_count, and ldns_dnssec_trust_tree_struct::parents.

size_t ldns_dnssec_trust_tree_depth | ( | ldns_dnssec_trust_tree * | tree | ) |

returns the depth of the trust tree

Parameters

  [in] | tree | tree to calculate the depth of

Returns
  The depth of the tree

Definition at line 467 of file dnssec_verify.c.

References ldns_struct_rr_descriptor::_name, ldns_calc_keytag(), ldns_dnssec_trust_tree_depth(), LDNS_FREE, ldns_get_errorstr_by_id(), ldns_rdf_print(), ldns_rr_descript(), ldns_rr_get_type(), ldns_rr_list_print_fmt(), ldns_rr_owner(), ldns_rr_print_fmt(), ldns_rr_rd_count(), ldns_rr_rdf(), LDNS_RR_TYPE_DNSKEY, LDNS_RR_TYPE_DS, LDNS_RR_TYPE_NS, LDNS_RR_TYPE_NSEC, LDNS_RR_TYPE_NSEC3, LDNS_STATUS_OK, LDNS_STATUS_SSL_ERR, LDNS_XMALLOC, ldns_dnssec_trust_tree_struct::parent_count, ldns_dnssec_trust_tree_struct::parent_status, ldns_dnssec_trust_tree_struct::parents, ldns_dnssec_trust_tree_struct::rr, and ldns_dnssec_trust_tree_struct::rrset.

void ldns_dnssec_trust_tree_print_fmt | ( | FILE * | out,
|  | const ldns_output_format * | fmt,
|  | ldns_dnssec_trust_tree * | tree,
|  | size_t | tabs,
|  | bool | extended
| ) |  |

Definition at line 632 of file dnssec_verify.c.

void ldns_dnssec_trust_tree_print | ( | FILE * | out,
|  | ldns_dnssec_trust_tree * | tree,
|  | size_t | tabs,
|  | bool | extended
| ) |  |

Definition at line 642 of file dnssec_verify.c.

References ldns_dnssec_trust_tree_print_fmt(), and ldns_output_format_default.

ldns_status ldns_dnssec_trust_tree_add_parent | ( | ldns_dnssec_trust_tree * | tree,
|  | const ldns_dnssec_trust_tree * | parent,
|  | const ldns_rr * | parent_signature,
|  | const ldns_status | parent_status
| ) |  |

Adds a trust tree as a parent for the given trust tree.

Parameters

  [in] | *tree | The tree to add the parent to
  [in] | *parent | The parent tree to add
  [in] | *parent_signature | The RRSIG relevant to this parent/child connection
  [in] | parent_status | The DNSSEC status for this parent, child and RRSIG

Returns
  LDNS_STATUS_OK if the addition succeeds, error otherwise

Definition at line 653 of file dnssec_verify.c.

References LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS, LDNS_STATUS_ERR, LDNS_STATUS_OK, ldns_dnssec_trust_tree_struct::parent_count, ldns_dnssec_trust_tree_struct::parent_signature, ldns_dnssec_trust_tree_struct::parent_status, and ldns_dnssec_trust_tree_struct::parents.

ldns_dnssec_trust_tree* ldns_dnssec_derive_trust_tree_time | ( | ldns_dnssec_data_chain * | data_chain,
|  | ldns_rr * | rr,
|  | time_t | check_time
| ) |  |

Generates a dnssec_trust_tree for the given rr from the given data_chain.

This does not clone the actual data; Don't free the data_chain before you are done with this tree

Parameters

  [in] | *data_chain | The chain to derive the trust tree from
  [in] | *rr | The RR this tree will be about
  [in] | check_time | the time for which the validation is performed

Returns
  ldns_dnssec_trust_tree *

Definition at line 680 of file dnssec_verify.c.

References ldns_dname_compare(), ldns_dnssec_derive_trust_tree_dnskey_rrset_time(), ldns_dnssec_derive_trust_tree_ds_rrset_time(), ldns_dnssec_derive_trust_tree_no_sig_time(), ldns_dnssec_derive_trust_tree_normal_rrset_time(), ldns_dnssec_trust_tree_new(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_owner(), LDNS_RR_TYPE_NSEC, ldns_dnssec_data_chain_struct::parent, ldns_dnssec_trust_tree_struct::rr, ldns_dnssec_data_chain_struct::rrset, ldns_dnssec_trust_tree_struct::rrset, and ldns_dnssec_data_chain_struct::signatures.

ldns_dnssec_trust_tree* ldns_dnssec_derive_trust_tree | ( | ldns_dnssec_data_chain * | data_chain,
|  | ldns_rr * | rr
| ) |  |

Generates a dnssec_trust_tree for the given rr from the given data_chain.

This does not clone the actual data; Don't free the data_chain before you are done with this tree

Parameters

  [in] | *data_chain | The chain to derive the trust tree from
  [in] | *rr | The RR this tree will be about

Returns
  ldns_dnssec_trust_tree *

Definition at line 781 of file dnssec_verify.c.

References ldns_dnssec_derive_trust_tree_time().

void ldns_dnssec_derive_trust_tree_normal_rrset_time | ( | ldns_dnssec_trust_tree * | new_tree,
|  | ldns_dnssec_data_chain * | data_chain,
|  | ldns_rr * | cur_sig_rr,
|  | time_t | check_time
| ) |  |

Sub function for derive_trust_tree that is used for a 'normal' rrset.

Parameters

  [in] | new_tree | The trust tree that we are building
  [in] | data_chain | The data chain containing the data for the trust tree
  [in] | cur_sig_rr | The currently relevant signature
  [in] | check_time | the time for which the validation is performed

Definition at line 787 of file dnssec_verify.c.

References ldns_calc_keytag(), ldns_dname_compare(), ldns_dnssec_derive_trust_tree_time(), ldns_dnssec_trust_tree_add_parent(), ldns_rdf2native_int16(), ldns_rr_get_type(), ldns_rr_list_clone(), ldns_rr_list_deep_free(), ldns_rr_list_pop_rrset(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_list_sort(), ldns_rr_owner(), ldns_rr_rrsig_keytag(), LDNS_RR_TYPE_DNSKEY, LDNS_RR_TYPE_NSEC, LDNS_RR_TYPE_NSEC3, ldns_verify_rrsig_time(), ldns_dnssec_data_chain_struct::parent, ldns_dnssec_trust_tree_struct::parent_count, ldns_dnssec_trust_tree_struct::parents, ldns_dnssec_trust_tree_struct::rr, and ldns_dnssec_data_chain_struct::rrset.

void ldns_dnssec_derive_trust_tree_normal_rrset | ( | ldns_dnssec_trust_tree * | new_tree,
|  | ldns_dnssec_data_chain * | data_chain,
|  | ldns_rr * | cur_sig_rr
| ) |  |

Sub function for derive_trust_tree that is used for a 'normal' rrset.

Parameters

  [in] | new_tree | The trust tree that we are building
  [in] | data_chain | The data chain containing the data for the trust tree
  [in] | cur_sig_rr | The currently relevant signature

Definition at line 869 of file dnssec_verify.c.

References ldns_dnssec_derive_trust_tree_normal_rrset_time().

void ldns_dnssec_derive_trust_tree_dnskey_rrset_time | ( | ldns_dnssec_trust_tree * | new_tree,
|  | ldns_dnssec_data_chain * | data_chain,
|  | ldns_rr * | cur_rr,
|  | ldns_rr * | cur_sig_rr,
|  | time_t | check_time
| ) |  |

Sub function for derive_trust_tree that is used for DNSKEY rrsets.

Parameters

  [in] | new_tree | The trust tree that we are building
  [in] | data_chain | The data chain containing the data for the trust tree
  [in] | cur_rr | The currently relevant DNSKEY RR
  [in] | cur_sig_rr | The currently relevant signature
  [in] | check_time | the time for which the validation is performed

Definition at line 878 of file dnssec_verify.c.

References ldns_calc_keytag(), ldns_dnssec_trust_tree_add_parent(), ldns_dnssec_trust_tree_new(), ldns_rdf2native_int16(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_rrsig_keytag(), LDNS_RR_TYPE_DNSKEY, ldns_verify_rrsig_time(), ldns_dnssec_trust_tree_struct::rr, ldns_dnssec_data_chain_struct::rrset, and ldns_dnssec_trust_tree_struct::rrset.

void ldns_dnssec_derive_trust_tree_dnskey_rrset | ( | ldns_dnssec_trust_tree * | new_tree,
|  | ldns_dnssec_data_chain * | data_chain,
|  | ldns_rr * | cur_rr,
|  | ldns_rr * | cur_sig_rr
| ) |  |

Sub function for derive_trust_tree that is used for DNSKEY rrsets.

Parameters

  [in] | new_tree | The trust tree that we are building
  [in] | data_chain | The data chain containing the data for the trust tree
  [in] | cur_rr | The currently relevant DNSKEY RR
  [in] | cur_sig_rr | The currently relevant signature

Definition at line 914 of file dnssec_verify.c.

References ldns_dnssec_derive_trust_tree_dnskey_rrset_time().

void ldns_dnssec_derive_trust_tree_ds_rrset_time | ( | ldns_dnssec_trust_tree * | new_tree,
|  | ldns_dnssec_data_chain * | data_chain,
|  | ldns_rr * | cur_rr,
|  | time_t | check_time
| ) |  |

Sub function for derive_trust_tree that is used for DS rrsets.

Parameters

  [in] | new_tree | The trust tree that we are building
  [in] | data_chain | The data chain containing the data for the trust tree
  [in] | cur_rr | The currently relevant DS RR
  [in] | check_time | the time for which the validation is performed

Definition at line 924 of file dnssec_verify.c.

References ldns_dnssec_derive_trust_tree_time(), ldns_dnssec_trust_tree_add_parent(), ldns_rr_compare_ds(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), LDNS_RR_TYPE_DNSKEY, LDNS_RR_TYPE_DS, LDNS_STATUS_OK, ldns_dnssec_data_chain_struct::parent, and ldns_dnssec_data_chain_struct::rrset.

void ldns_dnssec_derive_trust_tree_ds_rrset | ( | ldns_dnssec_trust_tree * | new_tree,
|  | ldns_dnssec_data_chain * | data_chain,
|  | ldns_rr * | cur_rr
| ) |  |

Sub function for derive_trust_tree that is used for DS rrsets.

Parameters

  [in] | new_tree | The trust tree that we are building
  [in] | data_chain | The data chain containing the data for the trust tree
  [in] | cur_rr | The currently relevant DS RR

Definition at line 968 of file dnssec_verify.c.

References ldns_dnssec_derive_trust_tree_ds_rrset_time().

void ldns_dnssec_derive_trust_tree_no_sig_time | ( | ldns_dnssec_trust_tree * | new_tree,
|  | ldns_dnssec_data_chain * | data_chain,
|  | time_t | check_time
| ) |  |

Sub function for derive_trust_tree that is used when there are no signatures.

Parameters

  [in] | new_tree | The trust tree that we are building
  [in] | data_chain | The data chain containing the data for the trust tree
  [in] | check_time | the time for which the validation is performed

Definition at line 977 of file dnssec_verify.c.

References ldns_dnssec_derive_trust_tree_time(), ldns_dnssec_trust_tree_add_parent(), ldns_dnssec_verify_denial(), ldns_dnssec_verify_denial_nsec3(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), LDNS_RR_TYPE_NSEC, LDNS_RR_TYPE_NSEC3, LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED, LDNS_STATUS_OK, ldns_dnssec_data_chain_struct::packet_nodata, ldns_dnssec_data_chain_struct::packet_qtype, ldns_dnssec_data_chain_struct::packet_rcode, ldns_dnssec_data_chain_struct::parent, ldns_dnssec_trust_tree_struct::rr, ldns_dnssec_data_chain_struct::rrset, and ldns_dnssec_data_chain_struct::signatures.

void ldns_dnssec_derive_trust_tree_no_sig | ( | ldns_dnssec_trust_tree * | new_tree,
|  | ldns_dnssec_data_chain * | data_chain
| ) |  |

Sub function for derive_trust_tree that is used when there are no signatures.

Parameters

  [in] | new_tree | The trust tree that we are building
  [in] | data_chain | The data chain containing the data for the trust tree

Definition at line 1028 of file dnssec_verify.c.

References ldns_dnssec_derive_trust_tree_no_sig_time().

ldns_status ldns_dnssec_trust_tree_contains_keys | ( | ldns_dnssec_trust_tree * | tree,
|  | ldns_rr_list * | keys
| ) |  |

Returns OK if there is a trusted path in the tree to one of the DNSKEY or DS RRs in the given list.

Parameters

  *tree | The trust tree so search
  *keys | A ldns_rr_list of DNSKEY and DS rrs to look for

Returns
  LDNS_STATUS_OK if there is a trusted path to one of the keys, or the first error encountered if there were no paths

Definition at line 1041 of file dnssec_verify.c.

References ldns_dnssec_trust_tree_contains_keys(), ldns_rr_compare_ds(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), LDNS_RR_TYPE_NSEC, LDNS_STATUS_CRYPTO_NO_DNSKEY, LDNS_STATUS_DNSSEC_EXISTENCE_DENIED, LDNS_STATUS_ERR, LDNS_STATUS_OK, ldns_dnssec_trust_tree_struct::parent_count, ldns_dnssec_trust_tree_struct::parent_status, ldns_dnssec_trust_tree_struct::parents, and ldns_dnssec_trust_tree_struct::rr.

ldns_status ldns_verify_time | ( | ldns_rr_list * | rrset,
|  | ldns_rr_list * | rrsig,
|  | const ldns_rr_list * | keys,
|  | time_t | check_time,
|  | ldns_rr_list * | good_keys
| ) |  |

Verifies a list of signatures for one rrset.

Parameters

  [in] | rrset | the rrset to verify
  [in] | rrsig | a list of signatures to check
  [in] | keys | a list of keys to check with
  [in] | check_time | the time for which the validation is performed
  [out] | good_keys | if this is a (initialized) list, the pointer to keys from keys that validate one of the signatures are added to it

Returns
  status LDNS_STATUS_OK if there is at least one correct key

Definition at line 1090 of file dnssec_verify.c.

References ldns_rr_list_rr(), ldns_rr_list_rr_count(), LDNS_STATUS_CRYPTO_NO_MATCHING_KEYTAG_DNSKEY, LDNS_STATUS_CRYPTO_NO_RRSIG, LDNS_STATUS_CRYPTO_NO_TRUSTED_DNSKEY, LDNS_STATUS_ERR, LDNS_STATUS_OK, and ldns_verify_rrsig_keylist_time().

ldns_status ldns_verify | ( | ldns_rr_list * | rrset,
|  | ldns_rr_list * | rrsig,
|  | const ldns_rr_list * | keys,
|  | ldns_rr_list * | good_keys
| ) |  |

Verifies a list of signatures for one rrset.

Parameters

  [in] | rrset | the rrset to verify
  [in] | rrsig | a list of signatures to check
  [in] | keys | a list of keys to check with
  [out] | good_keys | if this is a (initialized) list, the pointer to keys from keys that validate one of the signatures are added to it

Returns
  status LDNS_STATUS_OK if there is at least one correct key

Definition at line 1134 of file dnssec_verify.c.

References ldns_verify_time().

ldns_status ldns_verify_notime | ( | ldns_rr_list * | rrset,
|  | ldns_rr_list * | rrsig,
|  | const ldns_rr_list * | keys,
|  | ldns_rr_list * | good_keys
| ) |  |

Verifies a list of signatures for one rrset, but disregard the time.

Inception and Expiration are not checked.

Parameters

  [in] | rrset | the rrset to verify
  [in] | rrsig | a list of signatures to check
  [in] | keys | a list of keys to check with
  [out] | good_keys | if this is a (initialized) list, the pointer to keys from keys that validate one of the signatures are added to it

Returns
  status LDNS_STATUS_OK if there is at least one correct key

Definition at line 1141 of file dnssec_verify.c.

References ldns_rr_list_rr(), ldns_rr_list_rr_count(), LDNS_STATUS_CRYPTO_NO_MATCHING_KEYTAG_DNSKEY, LDNS_STATUS_CRYPTO_NO_RRSIG, LDNS_STATUS_CRYPTO_NO_TRUSTED_DNSKEY, LDNS_STATUS_ERR, LDNS_STATUS_OK, and ldns_verify_rrsig_keylist_notime().

ldns_rr_list* ldns_fetch_valid_domain_keys_time | ( | const ldns_resolver * | res,
|  | const ldns_rdf * | domain,
|  | const ldns_rr_list * | keys,
|  | time_t | check_time,
|  | ldns_status * | status
| ) |  |

Tries to build an authentication chain from the given keys down to the queried domain.

If we find a valid trust path, return the valid keys for the domain.

Parameters

  [in] | res | the current resolver
  [in] | domain | the domain we want valid keys for
  [in] | keys | the current set of trusted keys
  [in] | check_time | the time for which the validation is performed
  [out] | status | pointer to the status variable where the result code will be stored

Returns
  the set of trusted keys for the domain, or NULL if no trust path could be built.

Definition at line 1181 of file dnssec_verify.c.

References ldns_dname_left_chop(), ldns_fetch_valid_domain_keys_time(), ldns_rdf_deep_free(), ldns_rdf_size(), ldns_rr_list_deep_free(), LDNS_STATUS_CRYPTO_NO_TRUSTED_DNSKEY, LDNS_STATUS_CRYPTO_NO_TRUSTED_DS, LDNS_STATUS_OK, ldns_validate_domain_dnskey_time(), and ldns_validate_domain_ds_time().

ldns_rr_list* ldns_fetch_valid_domain_keys | ( | const ldns_resolver * | res,
|  | const ldns_rdf * | domain,
|  | const ldns_rr_list * | keys,
|  | ldns_status * | status
| ) |  |

Tries to build an authentication chain from the given keys down to the queried domain.

If we find a valid trust path, return the valid keys for the domain.

Parameters

  [in] | res | the current resolver
  [in] | domain | the domain we want valid keys for
  [in] | keys | the current set of trusted keys
  [out] | status | pointer to the status variable where the result code will be stored

Returns
  the set of trusted keys for the domain, or NULL if no trust path could be built.

Definition at line 1249 of file dnssec_verify.c.

References ldns_fetch_valid_domain_keys_time().

ldns_rr_list* ldns_validate_domain_dnskey_time | ( | const ldns_resolver * | res,
|  | const ldns_rdf * | domain,
|  | const ldns_rr_list * | keys,
|  | time_t | check_time
| ) |  |

Validates the DNSKEY RRset for the given domain using the provided trusted keys.

Parameters

  [in] | res | the current resolver
  [in] | domain | the domain we want valid keys for
  [in] | keys | the current set of trusted keys
  [in] | check_time | the time for which the validation is performed

Returns
  the set of trusted keys for the domain, or NULL if the RRSET could not be validated

Definition at line 1259 of file dnssec_verify.c.

References ldns_calc_keytag(), ldns_pkt_free(), ldns_pkt_rr_list_by_type(), LDNS_RD, ldns_rdf2native_int16(), ldns_resolver_query(), LDNS_RR_CLASS_IN, ldns_rr_clone(), ldns_rr_compare_ds(), ldns_rr_list_deep_free(), ldns_rr_list_new(), ldns_rr_list_push_rr(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_rrsig_keytag(), LDNS_RR_TYPE_DNSKEY, LDNS_RR_TYPE_RRSIG, LDNS_SECTION_ANSWER, LDNS_STATUS_OK, and ldns_verify_rrsig_time().

ldns_rr_list* ldns_validate_domain_dnskey | ( | const ldns_resolver * | res,
|  | const ldns_rdf * | domain,
|  | const ldns_rr_list * | keys
| ) |  |

Validates the DNSKEY RRset for the given domain using the provided trusted keys.

Parameters

  [in] | res | the current resolver
  [in] | domain | the domain we want valid keys for
  [in] | keys | the current set of trusted keys

Returns
  the set of trusted keys for the domain, or NULL if the RRSET could not be validated

Definition at line 1353 of file dnssec_verify.c.

References ldns_validate_domain_dnskey_time().

ldns_rr_list* ldns_validate_domain_ds_time | ( | const ldns_resolver * | res,
|  | const ldns_rdf * | domain,
|  | const ldns_rr_list * | keys,
|  | time_t | check_time
| ) |  |

Validates the DS RRset for the given domain using the provided trusted keys.

Parameters

  [in] | res | the current resolver
  [in] | domain | the domain we want valid keys for
  [in] | keys | the current set of trusted keys
  [in] | check_time | the time for which the validation is performed

Returns
  the set of trusted keys for the domain, or NULL if the RRSET could not be validated

Definition at line 1362 of file dnssec_verify.c.

References ldns_pkt_free(), ldns_pkt_rr_list_by_type(), LDNS_RD, ldns_resolver_query(), LDNS_RR_CLASS_IN, ldns_rr_clone(), ldns_rr_list_deep_free(), ldns_rr_list_new(), ldns_rr_list_push_rr(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), LDNS_RR_TYPE_DS, LDNS_RR_TYPE_RRSIG, LDNS_SECTION_ANSWER, LDNS_STATUS_OK, and ldns_verify_time().

ldns_rr_list* ldns_validate_domain_ds | ( | const ldns_resolver * | res,
|  | const ldns_rdf * | domain,
|  | const ldns_rr_list * | keys
| ) |  |

Validates the DS RRset for the given domain using the provided trusted keys.

Parameters

  [in] | res | the current resolver
  [in] | domain | the domain we want valid keys for
  [in] | keys | the current set of trusted keys

Returns
  the set of trusted keys for the domain, or NULL if the RRSET could not be validated

Definition at line 1410 of file dnssec_verify.c.

References ldns_validate_domain_ds_time().

ldns_status ldns_verify_trusted_time | ( | ldns_resolver * | res,
|  | ldns_rr_list * | rrset,
|  | ldns_rr_list * | rrsigs,
|  | time_t | check_time,
|  | ldns_rr_list * | validating_keys
| ) |  |

Verifies a list of signatures for one RRset using a valid trust path.

Parameters

  [in] | res | the current resolver
  [in] | rrset | the rrset to verify
  [in] | rrsigs | a list of signatures to check
  [in] | check_time | the time for which the validation is performed
  [out] | validating_keys | if this is a (initialized) list, the keys from keys that validate one of the signatures are added to it

Returns
  status LDNS_STATUS_OK if there is at least one correct key

Definition at line 1418 of file dnssec_verify.c.

References ldns_fetch_valid_domain_keys_time(), ldns_resolver_dnssec_anchors(), ldns_rr_clone(), ldns_rr_list_deep_free(), ldns_rr_list_push_rr(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_rrsig_signame(), LDNS_STATUS_CRYPTO_NO_RRSIG, LDNS_STATUS_ERR, LDNS_STATUS_OK, and ldns_verify_rrsig_time().

ldns_status ldns_verify_trusted | ( | ldns_resolver * | res,
|  | ldns_rr_list * | rrset,
|  | ldns_rr_list * | rrsigs,
|  | ldns_rr_list * | validating_keys
| ) |  |

Verifies a list of signatures for one RRset using a valid trust path.

Parameters

  [in] | res | the current resolver
  [in] | rrset | the rrset to verify
  [in] | rrsigs | a list of signatures to check
  [out] | validating_keys | if this is a (initialized) list, the keys from keys that validate one of the signatures are added to it

Returns
  status LDNS_STATUS_OK if there is at least one correct key

Definition at line 1481 of file dnssec_verify.c.

References ldns_verify_trusted_time().

ldns_status ldns_dnssec_verify_denial | ( | ldns_rr * | rr,
|  | ldns_rr_list * | nsecs,
|  | ldns_rr_list * | rrsigs
| ) |  |

denial is not just a river in egypt

Parameters

  [in] | rr | The (query) RR to check the denial of existence for
  [in] | nsecs | The list of NSEC RRs that are supposed to deny the existence of the RR
  [in] | rrsigs | The RRSIG RR covering the NSEC RRs

Returns
  LDNS_STATUS_OK if the NSEC RRs deny the existence, error code containing the reason they do not otherwise

Definition at line 1493 of file dnssec_verify.c.

References ldns_dname_cat(), ldns_dname_compare(), ldns_dname_label_count(), ldns_dname_left_chop(), ldns_dname_new_frm_str(), ldns_dnssec_get_rrsig_for_name_and_type(), ldns_nsec_bitmap_covers_type(), ldns_nsec_covers_name(), ldns_nsec_get_bitmap(), ldns_rdf2native_int8(), ldns_rdf_deep_free(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_owner(), ldns_rr_rrsig_labels(), LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED, LDNS_STATUS_DNSSEC_NSEC_WILDCARD_NOT_COVERED, and LDNS_STATUS_OK.

ldns_status ldns_dnssec_verify_denial_nsec3_match | ( | ldns_rr * | rr,
|  | ldns_rr_list * | nsecs,
|  | ldns_rr_list *rrsigs | __attribute__(unused),
|  | ldns_pkt_rcode | packet_rcode,
|  | ldns_rr_type | packet_qtype,
|  | bool | packet_nodata,
|  | ldns_rr ** | match
| ) |  |

Definition at line 1571 of file dnssec_verify.c.

References ldns_dname_cat(), ldns_dname_clone_from(), ldns_dname_compare(), ldns_dname_label_count(), ldns_dname_left_chop(), ldns_dname_new_frm_str(), ldns_dnssec_nsec3_closest_encloser(), ldns_nsec3_bitmap(), ldns_nsec3_hash_name_frm_nsec3(), ldns_nsec3_optout(), ldns_nsec_bitmap_covers_type(), ldns_nsec_covers_name(), LDNS_RCODE_NXDOMAIN, ldns_rdf_deep_free(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_owner(), LDNS_RR_TYPE_CNAME, LDNS_RR_TYPE_DS, LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED, LDNS_STATUS_DNSSEC_NSEC_WILDCARD_NOT_COVERED, LDNS_STATUS_NSEC3_ERR, and LDNS_STATUS_OK.

ldns_status ldns_dnssec_verify_denial_nsec3 | ( | ldns_rr * | rr,
|  | ldns_rr_list * | nsecs,
|  | ldns_rr_list * | rrsigs,
|  | ldns_pkt_rcode | packet_rcode,
|  | ldns_rr_type | packet_qtype,
|  | bool | packet_nodata
| ) |  |

Definition at line 1797 of file dnssec_verify.c.

References ldns_dnssec_verify_denial_nsec3_match().

EVP_PKEY* ldns_gost2pkey_raw | ( | unsigned char * | key,
|  | size_t | keylen
| ) |  |

Converts a holding buffer with key material to EVP PKEY in openssl.

Only available if ldns was compiled with GOST.

Parameters

  [in] | key | data to convert
  [in] | keylen | length of the key data

Returns
  the key or NULL on error.

Definition at line 1812 of file dnssec_verify.c.

References ldns_gost2pkey_raw(), ldns_key_EVP_load_gost_id(), LDNS_STATUS_CRYPTO_BOGUS, and ldns_verify_rrsig_evp_raw().

EVP_PKEY* ldns_ecdsa2pkey_raw | ( | unsigned char * | key,
|  | size_t | keylen,
|  | uint8_t | algo
| ) |  |

Converts a holding buffer with key material to EVP PKEY in openssl.

Only available if ldns was compiled with ECDSA.

Parameters

  [in] | key | data to convert
  [in] | keylen | length of the key data
  [in] | algo | precise algorithm to initialize ECC group values.

Returns
  the key or NULL on error.

Definition at line 1859 of file dnssec_verify.c.

References ldns_ecdsa2pkey_raw(), LDNS_ECDSAP256SHA256, LDNS_ECDSAP384SHA384, LDNS_STATUS_CRYPTO_BOGUS, and ldns_verify_rrsig_evp_raw().

ldns_status ldns_verify_rrsig_buffers | ( | ldns_buffer * | rawsig_buf,
|  | ldns_buffer * | verify_buf,
|  | ldns_buffer * | key_buf,
|  | uint8_t | algo
| ) |  |

Verifies the already processed data in the buffers This function should probably not be used directly.

Parameters

  [in] | rawsig_buf | Buffer containing signature data to use
  [in] | verify_buf | Buffer containing data to verify
  [in] | key_buf | Buffer containing key data to use
  [in] | algo | Signing algorithm

Returns
  status LDNS_STATUS_OK if the data verifies. Error if not.

Definition at line 1920 of file dnssec_verify.c.

References ldns_verify_rrsig_buffers_raw().

ldns_status ldns_verify_rrsig_buffers_raw | ( | unsigned char * | sig,
|  | size_t | siglen,
|  | ldns_buffer * | verify_buf,
|  | unsigned char * | key,
|  | size_t | keylen,
|  | uint8_t | algo
| ) |  |

Like ldns_verify_rrsig_buffers, but uses raw data.

Parameters

  [in] | sig | signature data to use
  [in] | siglen | length of signature data to use
  [in] | verify_buf | Buffer containing data to verify
  [in] | key | key data to use
  [in] | keylen | length of key data to use
  [in] | algo | Signing algorithm

Returns
  status LDNS_STATUS_OK if the data verifies. Error if not.

Definition at line 1932 of file dnssec_verify.c.

References ldns_buffer_free(), ldns_buffer_new(), ldns_calc_keytag(), ldns_convert_dsa_rrsig_rdf2asn1(), ldns_convert_ecdsa_rrsig_rdf2asn1(), LDNS_DH, ldns_dname2canonical(), ldns_dname_cat(), ldns_dname_label_count(), ldns_dname_left_chop(), LDNS_DSA, LDNS_DSA_NSEC3, LDNS_ECC, LDNS_ECC_GOST, LDNS_ECDSAP256SHA256, LDNS_ECDSAP384SHA384, LDNS_INDIRECT, LDNS_MAX_PACKETLEN, ldns_rdf2buffer_wire(), ldns_rdf2native_int16(), ldns_rdf2native_int32(), ldns_rdf2native_int8(), ldns_rdf2native_time_t(), ldns_rdf2rr_type(), ldns_rdf_clone(), ldns_rdf_deep_free(), ldns_rr2canonical(), ldns_rr_get_type(), ldns_rr_list2buffer_wire(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_list_sort(), ldns_rr_owner(), ldns_rr_rd_count(), ldns_rr_rdf(), ldns_rr_rrsig_expiration(), ldns_rr_rrsig_inception(), ldns_rr_rrsig_keytag(), ldns_rr_rrsig_typecovered(), ldns_rr_set_owner(), ldns_rr_set_ttl(), ldns_rrsig2buffer_wire(), LDNS_RSAMD5, LDNS_RSASHA1, LDNS_RSASHA1_NSEC3, LDNS_RSASHA256, LDNS_RSASHA512, LDNS_STATUS_CRYPTO_ALGO_NOT_IMPL, LDNS_STATUS_CRYPTO_EXPIRATION_BEFORE_INCEPTION, LDNS_STATUS_CRYPTO_NO_MATCHING_KEYTAG_DNSKEY, LDNS_STATUS_CRYPTO_NO_RRSIG, LDNS_STATUS_CRYPTO_SIG_EXPIRED, LDNS_STATUS_CRYPTO_SIG_NOT_INCEPTED, LDNS_STATUS_CRYPTO_TYPE_COVERED_ERR, LDNS_STATUS_CRYPTO_UNKNOWN_ALGO, LDNS_STATUS_ERR, LDNS_STATUS_MEM_ERR, LDNS_STATUS_MISSING_RDATA_FIELDS_KEY, LDNS_STATUS_MISSING_RDATA_FIELDS_RRSIG, LDNS_STATUS_OK, ldns_str2rdf_dname(), ldns_verify_rrsig_buffers(), ldns_verify_rrsig_dsa_raw(), ldns_verify_rrsig_rsamd5_raw(), ldns_verify_rrsig_rsasha1_raw(), ldns_verify_rrsig_rsasha256_raw(), and ldns_verify_rrsig_rsasha512_raw().

ldns_status ldns_verify_rrsig_keylist_time | ( | ldns_rr_list * | rrset,
|  | ldns_rr * | rrsig,
|  | const ldns_rr_list * | keys,
|  | time_t | check_time,
|  | ldns_rr_list * | good_keys
| ) |  |

Verifies an rrsig.

All keys in the keyset are tried.

Parameters

  [in] | rrset | the rrset to check
  [in] | rrsig | the signature of the rrset
  [in] | keys | the keys to try
  [in] | check_time | the time for which the validation is performed
  [out] | good_keys | if this is a (initialized) list, the pointer to keys from keys that validate one of the signatures are added to it

Returns
  a list of keys which validate the rrsig + rrset. Returns status LDNS_STATUS_OK if at least one key matched. Else an error.

Definition at line 2287 of file dnssec_verify.c.

References ldns_rr_list_cat(), ldns_rr_list_free(), ldns_rr_list_new(), LDNS_STATUS_MEM_ERR, LDNS_STATUS_OK, and ldns_verify_rrsig_keylist_notime().

ldns_status ldns_verify_rrsig_keylist | ( | ldns_rr_list * | rrset,
|  | ldns_rr * | rrsig,
|  | const ldns_rr_list * | keys,
|  | ldns_rr_list * | good_keys
| ) |  |

Verifies an rrsig.

All keys in the keyset are tried.

Parameters

  [in] | rrset | the rrset to check
  [in] | rrsig | the signature of the rrset
  [in] | keys | the keys to try
  [out] | good_keys | if this is a (initialized) list, the pointer to keys from keys that validate one of the signatures are added to it

Returns
  a list of keys which validate the rrsig + rrset. Returns status LDNS_STATUS_OK if at least one key matched. Else an error.

Definition at line 2327 of file dnssec_verify.c.

References ldns_verify_rrsig_keylist_time().

ldns_status ldns_verify_rrsig_keylist_notime | ( | ldns_rr_list * | rrset,
|  | ldns_rr * | rrsig,
|  | const ldns_rr_list * | keys,
|  | ldns_rr_list * | good_keys
| ) |  |

Verifies an rrsig.

All keys in the keyset are tried. Time is not checked.

Parameters

  [in] | rrset | the rrset to check
  [in] | rrsig | the signature of the rrset
  [in] | keys | the keys to try
  [out] | good_keys | if this is a (initialized) list, the pointer to keys from keys that validate one of the signatures are added to it

Returns
  a list of keys which validate the rrsig + rrset. Returns status LDNS_STATUS_OK if at least one key matched. Else an error.

Definition at line 2337 of file dnssec_verify.c.

References ldns_buffer_free(), ldns_buffer_new(), LDNS_MAX_PACKETLEN, ldns_rr_list_cat(), ldns_rr_list_clone(), ldns_rr_list_deep_free(), ldns_rr_list_free(), ldns_rr_list_new(), ldns_rr_list_push_rr(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), LDNS_STATUS_CRYPTO_NO_MATCHING_KEYTAG_DNSKEY, LDNS_STATUS_ERR, LDNS_STATUS_MEM_ERR, and LDNS_STATUS_OK.

ldns_status ldns_verify_rrsig_time | ( | ldns_rr_list * | rrset,
|  | ldns_rr * | rrsig,
|  | ldns_rr * | key,
|  | time_t | check_time
| ) |  |

verify an rrsig with 1 key

Parameters

  [in] | rrset | the rrset
  [in] | rrsig | the rrsig to verify
  [in] | key | the key to use
  [in] | check_time | the time for which the validation is performed

Returns
  status message wether verification succeeded.

Definition at line 2421 of file dnssec_verify.c.

References ldns_buffer_free(), ldns_buffer_new(), LDNS_MAX_PACKETLEN, ldns_rr_list_clone(), ldns_rr_list_deep_free(), LDNS_STATUS_NO_DATA, and LDNS_STATUS_OK.

ldns_status ldns_verify_rrsig | ( | ldns_rr_list * | rrset,
|  | ldns_rr * | rrsig,
|  | ldns_rr * | key
| ) |  |

verify an rrsig with 1 key

Parameters

  [in] | rrset | the rrset
  [in] | rrsig | the rrsig to verify
  [in] | key | the key to use

Returns
  status message wether verification succeeded.

Definition at line 2464 of file dnssec_verify.c.

References ldns_verify_rrsig_time().

ldns_status ldns_verify_rrsig_evp | ( | ldns_buffer * | sig,
|  | ldns_buffer * | rrset,
|  | EVP_PKEY * | key,
|  | const EVP_MD * | digest_type
| ) |  |

verifies a buffer with signature data for a buffer with rrset data with an EVP_PKEY

Parameters

  [in] | sig | the signature data
  [in] | rrset | the rrset data, sorted and processed for verification
  [in] | key | the EVP key structure
  [in] | digest_type | The digest type of the signature

Definition at line 2471 of file dnssec_verify.c.

References ldns_verify_rrsig_evp_raw().

ldns_status ldns_verify_rrsig_evp_raw | ( | unsigned char * | sig,
|  | size_t | siglen,
|  | ldns_buffer * | rrset,
|  | EVP_PKEY * | key,
|  | const EVP_MD * | digest_type
| ) |  |

Like ldns_verify_rrsig_evp, but uses raw signature data.

Parameters

  [in] | sig | the signature data, wireformat uncompressed
  [in] | siglen | length of the signature data
  [in] | rrset | the rrset data, sorted and processed for verification
  [in] | key | the EVP key structure
  [in] | digest_type | The digest type of the signature

Definition at line 2485 of file dnssec_verify.c.

References LDNS_STATUS_CRYPTO_BOGUS, LDNS_STATUS_OK, and LDNS_STATUS_SSL_ERR.

ldns_status ldns_verify_rrsig_dsa | ( | ldns_buffer * | sig,
|  | ldns_buffer * | rrset,
|  | ldns_buffer * | key
| ) |  |

verifies a buffer with signature data (DSA) for a buffer with rrset data with a buffer with key data.

Parameters

  [in] | sig | the signature data
  [in] | rrset | the rrset data, sorted and processed for verification
  [in] | key | the key data

Definition at line 2512 of file dnssec_verify.c.

References ldns_verify_rrsig_dsa_raw().

ldns_status ldns_verify_rrsig_rsasha1 | ( | ldns_buffer * | sig,
|  | ldns_buffer * | rrset,
|  | ldns_buffer * | key
| ) |  |

verifies a buffer with signature data (RSASHA1) for a buffer with rrset data with a buffer with key data.

Parameters

  [in] | sig | the signature data
  [in] | rrset | the rrset data, sorted and processed for verification
  [in] | key | the key data

Definition at line 2523 of file dnssec_verify.c.

References ldns_verify_rrsig_rsasha1_raw().

ldns_status ldns_verify_rrsig_rsamd5 | ( | ldns_buffer * | sig,
|  | ldns_buffer * | rrset,
|  | ldns_buffer * | key
| ) |  |

verifies a buffer with signature data (RSAMD5) for a buffer with rrset data with a buffer with key data.

Parameters

  [in] | sig | the signature data
  [in] | rrset | the rrset data, sorted and processed for verification
  [in] | key | the key data

Definition at line 2534 of file dnssec_verify.c.

References ldns_verify_rrsig_rsamd5_raw().

ldns_status ldns_verify_rrsig_dsa_raw | ( | unsigned char * | sig,
|  | size_t | siglen,
|  | ldns_buffer * | rrset,
|  | unsigned char * | key,
|  | size_t | keylen
| ) |  |

Like ldns_verify_rrsig_dsa, but uses raw signature and key data.

Parameters

  [in] | sig | raw uncompressed wireformat signature data
  [in] | siglen | length of signature data
  [in] | rrset | ldns buffer with prepared rrset data.
  [in] | key | raw uncompressed wireformat key data
  [in] | keylen | length of key data

Definition at line 2545 of file dnssec_verify.c.

References ldns_key_buf2dsa_raw(), LDNS_STATUS_SSL_ERR, and ldns_verify_rrsig_evp_raw().

ldns_status ldns_verify_rrsig_rsasha1_raw | ( | unsigned char * | sig,
|  | size_t | siglen,
|  | ldns_buffer * | rrset,
|  | unsigned char * | key,
|  | size_t | keylen
| ) |  |

Like ldns_verify_rrsig_rsasha1, but uses raw signature and key data.

Parameters

  [in] | sig | raw uncompressed wireformat signature data
  [in] | siglen | length of signature data
  [in] | rrset | ldns buffer with prepared rrset data.
  [in] | key | raw uncompressed wireformat key data
  [in] | keylen | length of key data

Definition at line 2567 of file dnssec_verify.c.

References ldns_key_buf2rsa_raw(), LDNS_STATUS_SSL_ERR, and ldns_verify_rrsig_evp_raw().

ldns_status ldns_verify_rrsig_rsasha256_raw | ( | unsigned char * | sig,
|  | size_t | siglen,
|  | ldns_buffer * | rrset,
|  | unsigned char * | key,
|  | size_t | keylen
| ) |  |

Like ldns_verify_rrsig_rsasha256, but uses raw signature and key data.

Parameters

  [in] | sig | raw uncompressed wireformat signature data
  [in] | siglen | length of signature data
  [in] | rrset | ldns buffer with prepared rrset data.
  [in] | key | raw uncompressed wireformat key data
  [in] | keylen | length of key data

Definition at line 2589 of file dnssec_verify.c.

References ldns_key_buf2rsa_raw(), LDNS_STATUS_CRYPTO_UNKNOWN_ALGO, LDNS_STATUS_SSL_ERR, and ldns_verify_rrsig_evp_raw().

ldns_status ldns_verify_rrsig_rsasha512_raw | ( | unsigned char * | sig,
|  | size_t | siglen,
|  | ldns_buffer * | rrset,
|  | unsigned char * | key,
|  | size_t | keylen
| ) |  |

Like ldns_verify_rrsig_rsasha512, but uses raw signature and key data.

Parameters

  [in] | sig | raw uncompressed wireformat signature data
  [in] | siglen | length of signature data
  [in] | rrset | ldns buffer with prepared rrset data.
  [in] | key | raw uncompressed wireformat key data
  [in] | keylen | length of key data

Definition at line 2624 of file dnssec_verify.c.

References ldns_key_buf2rsa_raw(), LDNS_STATUS_CRYPTO_UNKNOWN_ALGO, LDNS_STATUS_SSL_ERR, and ldns_verify_rrsig_evp_raw().

ldns_status ldns_verify_rrsig_rsamd5_raw | ( | unsigned char * | sig,
|  | size_t | siglen,
|  | ldns_buffer * | rrset,
|  | unsigned char * | key,
|  | size_t | keylen
| ) |  |

Like ldns_verify_rrsig_rsamd5, but uses raw signature and key data.

Parameters

  [in] | sig | raw uncompressed wireformat signature data
  [in] | siglen | length of signature data
  [in] | rrset | ldns buffer with prepared rrset data.
  [in] | key | raw uncompressed wireformat key data
  [in] | keylen | length of key data

Definition at line 2660 of file dnssec_verify.c.

References ldns_key_buf2rsa_raw(), LDNS_STATUS_SSL_ERR, and ldns_verify_rrsig_evp_raw().