ldns documentation

- Main Page
- Related Pages
- Data Structures
- Files

- File List
- Globals

dnssec_verify.h
Go to the documentation of this file.
1
3 #ifndef LDNS_DNSSEC_VERIFY_H
4 #define LDNS_DNSSEC_VERIFY_H
5
6 #define LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS 10
7
8 #include <ldns/dnssec.h>
9 #include <ldns/host2str.h>
10
11 #ifdef __cplusplus
12 extern "C" {
13 #endif
14
19 typedef struct ldns_dnssec_data_chain_struct ldns_dnssec_data_chain;
20 struct ldns_dnssec_data_chain_struct
21 {
22 ldns_rr_list *rrset;
23 ldns_rr_list *signatures;
24 ldns_rr_type parent_type;
25 ldns_dnssec_data_chain *parent;
26 ldns_pkt_rcode packet_rcode;
27 ldns_rr_type packet_qtype;
28 bool packet_nodata;
29 };
30
35 ldns_dnssec_data_chain *ldns_dnssec_data_chain_new(void);
36
42 void ldns_dnssec_data_chain_free(ldns_dnssec_data_chain *chain);
43
50 void ldns_dnssec_data_chain_deep_free(ldns_dnssec_data_chain *chain);
51
58 void ldns_dnssec_data_chain_print(FILE *out, const ldns_dnssec_data_chain *chain);
59
67 void ldns_dnssec_data_chain_print_fmt(FILE *out,
68 const ldns_output_format *fmt,
69 const ldns_dnssec_data_chain *chain);
70
86 ldns_dnssec_data_chain *ldns_dnssec_build_data_chain(ldns_resolver *res,
87 const uint16_t qflags,
88 const ldns_rr_list *data_set,
89 const ldns_pkt *pkt,
90 ldns_rr *orig_rr);
91
121 typedef struct ldns_dnssec_trust_tree_struct ldns_dnssec_trust_tree;
122 struct ldns_dnssec_trust_tree_struct
123 {
124 ldns_rr *rr;
125 /* the complete rrset this rr was in */
126 ldns_rr_list *rrset;
127 ldns_dnssec_trust_tree *parents[LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS];
128 ldns_status parent_status[LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS];
131 ldns_rr *parent_signature[LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS];
132 size_t parent_count;
133 };
134
140 ldns_dnssec_trust_tree *ldns_dnssec_trust_tree_new(void);
141
150 void ldns_dnssec_trust_tree_free(ldns_dnssec_trust_tree *tree);
151
158 size_t ldns_dnssec_trust_tree_depth(ldns_dnssec_trust_tree *tree);
159
172 void ldns_dnssec_trust_tree_print(FILE *out,
173 ldns_dnssec_trust_tree *tree,
174 size_t tabs,
175 bool extended);
176
190 void ldns_dnssec_trust_tree_print_fmt(FILE *out,
191 const ldns_output_format *fmt,
192 ldns_dnssec_trust_tree *tree,
193 size_t tabs,
194 bool extended);
195
206 ldns_status ldns_dnssec_trust_tree_add_parent(ldns_dnssec_trust_tree *tree,
207 const ldns_dnssec_trust_tree *parent,
208 const ldns_rr *parent_signature,
209 const ldns_status parent_status);
210
222 ldns_dnssec_trust_tree *ldns_dnssec_derive_trust_tree(
223 ldns_dnssec_data_chain *data_chain,
224 ldns_rr *rr);
225
238 ldns_dnssec_trust_tree *ldns_dnssec_derive_trust_tree_time(
239 ldns_dnssec_data_chain *data_chain,
240 ldns_rr *rr, time_t check_time);
241
249 void ldns_dnssec_derive_trust_tree_normal_rrset(
250 ldns_dnssec_trust_tree *new_tree,
251 ldns_dnssec_data_chain *data_chain,
252 ldns_rr *cur_sig_rr);
253
262 void ldns_dnssec_derive_trust_tree_normal_rrset_time(
263 ldns_dnssec_trust_tree *new_tree,
264 ldns_dnssec_data_chain *data_chain,
265 ldns_rr *cur_sig_rr, time_t check_time);
266
267
276 void ldns_dnssec_derive_trust_tree_dnskey_rrset(
277 ldns_dnssec_trust_tree *new_tree,
278 ldns_dnssec_data_chain *data_chain,
279 ldns_rr *cur_rr,
280 ldns_rr *cur_sig_rr);
281
291 void ldns_dnssec_derive_trust_tree_dnskey_rrset_time(
292 ldns_dnssec_trust_tree *new_tree,
293 ldns_dnssec_data_chain *data_chain,
294 ldns_rr *cur_rr, ldns_rr *cur_sig_rr,
295 time_t check_time);
296
297
307 void ldns_dnssec_derive_trust_tree_dnskey_rrset_time(
308 ldns_dnssec_trust_tree *new_tree,
309 ldns_dnssec_data_chain *data_chain,
310 ldns_rr *cur_rr, ldns_rr *cur_sig_rr,
311 time_t check_time);
312
313
321 void ldns_dnssec_derive_trust_tree_ds_rrset(
322 ldns_dnssec_trust_tree *new_tree,
323 ldns_dnssec_data_chain *data_chain,
324 ldns_rr *cur_rr);
325
334 void ldns_dnssec_derive_trust_tree_ds_rrset_time(
335 ldns_dnssec_trust_tree *new_tree,
336 ldns_dnssec_data_chain *data_chain,
337 ldns_rr *cur_rr, time_t check_time);
338
346 void ldns_dnssec_derive_trust_tree_no_sig(
347 ldns_dnssec_trust_tree *new_tree,
348 ldns_dnssec_data_chain *data_chain);
349
358 void ldns_dnssec_derive_trust_tree_no_sig_time(
359 ldns_dnssec_trust_tree *new_tree,
360 ldns_dnssec_data_chain *data_chain,
361 time_t check_time);
362
363
375 ldns_status ldns_dnssec_trust_tree_contains_keys(
376 ldns_dnssec_trust_tree *tree,
377 ldns_rr_list *keys);
378
390 ldns_status ldns_verify(ldns_rr_list *rrset,
391 ldns_rr_list *rrsig,
392 const ldns_rr_list *keys,
393 ldns_rr_list *good_keys);
394
407 ldns_status ldns_verify_time(ldns_rr_list *rrset,
408 ldns_rr_list *rrsig,
409 const ldns_rr_list *keys,
410 time_t check_time,
411 ldns_rr_list *good_keys);
412
413
426 ldns_status ldns_verify_notime(ldns_rr_list *rrset,
427 ldns_rr_list *rrsig,
428 const ldns_rr_list *keys,
429 ldns_rr_list *good_keys);
430
445 ldns_rr_list *ldns_fetch_valid_domain_keys(const ldns_resolver * res,
446 const ldns_rdf * domain,
447 const ldns_rr_list * keys,
448 ldns_status *status);
449
465 ldns_rr_list *ldns_fetch_valid_domain_keys_time(const ldns_resolver * res,
466 const ldns_rdf * domain, const ldns_rr_list * keys,
467 time_t check_time, ldns_status *status);
468
469
480 ldns_rr_list *ldns_validate_domain_dnskey (const ldns_resolver *res,
481 const ldns_rdf *domain,
482 const ldns_rr_list *keys);
483
495 ldns_rr_list *ldns_validate_domain_dnskey_time(
496 const ldns_resolver *res, const ldns_rdf *domain,
497 const ldns_rr_list *keys, time_t check_time);
498
499
508 ldns_rr_list *ldns_validate_domain_ds(const ldns_resolver *res,
509 const ldns_rdf *
510 domain,
511 const ldns_rr_list * keys);
512
522 ldns_rr_list *ldns_validate_domain_ds_time(
523 const ldns_resolver *res, const ldns_rdf *domain,
524 const ldns_rr_list * keys, time_t check_time);
525
526
538 ldns_status ldns_verify_trusted(ldns_resolver *res,
539 ldns_rr_list *rrset,
540 ldns_rr_list *rrsigs,
541 ldns_rr_list *validating_keys);
542
555 ldns_status ldns_verify_trusted_time(
556 ldns_resolver *res, ldns_rr_list *rrset,
557 ldns_rr_list *rrsigs, time_t check_time,
558 ldns_rr_list *validating_keys);
559
560
571 ldns_status ldns_dnssec_verify_denial(ldns_rr *rr,
572 ldns_rr_list *nsecs,
573 ldns_rr_list *rrsigs);
574
592 ldns_status ldns_dnssec_verify_denial_nsec3(ldns_rr *rr,
593 ldns_rr_list *nsecs,
594 ldns_rr_list *rrsigs,
595 ldns_pkt_rcode packet_rcode,
596 ldns_rr_type packet_qtype,
597 bool packet_nodata);
598
617 ldns_status ldns_dnssec_verify_denial_nsec3_match(ldns_rr *rr,
618 ldns_rr_list *nsecs,
619 ldns_rr_list *rrsigs,
620 ldns_pkt_rcode packet_rcode,
621 ldns_rr_type packet_qtype,
622 bool packet_nodata,
623 ldns_rr **match);
634 ldns_status ldns_verify_rrsig_buffers(ldns_buffer *rawsig_buf,
635 ldns_buffer *verify_buf,
636 ldns_buffer *key_buf,
637 uint8_t algo);
638
650 ldns_status ldns_verify_rrsig_buffers_raw(unsigned char* sig,
651 size_t siglen,
652 ldns_buffer *verify_buf,
653 unsigned char* key,
654 size_t keylen,
655 uint8_t algo);
656
668 ldns_status ldns_verify_rrsig_keylist(ldns_rr_list *rrset,
669 ldns_rr *rrsig,
670 const ldns_rr_list *keys,
671 ldns_rr_list *good_keys);
672
685 ldns_status ldns_verify_rrsig_keylist_time(
686 ldns_rr_list *rrset, ldns_rr *rrsig,
687 const ldns_rr_list *keys, time_t check_time,
688 ldns_rr_list *good_keys);
689
690
702 ldns_status ldns_verify_rrsig_keylist_notime(ldns_rr_list *rrset,
703 ldns_rr *rrsig,
704 const ldns_rr_list *keys,
705 ldns_rr_list *good_keys);
706
714 ldns_status ldns_verify_rrsig(ldns_rr_list *rrset,
715 ldns_rr *rrsig,
716 ldns_rr *key);
717
718
727 ldns_status ldns_verify_rrsig_time(
728 ldns_rr_list *rrset, ldns_rr *rrsig,
729 ldns_rr *key, time_t check_time);
730
731
732 #if LDNS_BUILD_CONFIG_HAVE_SSL
733
742 ldns_status ldns_verify_rrsig_evp(ldns_buffer *sig,
743 ldns_buffer *rrset,
744 EVP_PKEY *key,
745 const EVP_MD *digest_type);
746
755 ldns_status ldns_verify_rrsig_evp_raw(unsigned char *sig,
756 size_t siglen,
757 ldns_buffer *rrset,
758 EVP_PKEY *key,
759 const EVP_MD *digest_type);
760 #endif
761
770 ldns_status ldns_verify_rrsig_dsa(ldns_buffer *sig,
771 ldns_buffer *rrset,
772 ldns_buffer *key);
773
782 ldns_status ldns_verify_rrsig_rsasha1(ldns_buffer *sig,
783 ldns_buffer *rrset,
784 ldns_buffer *key);
785
794 ldns_status ldns_verify_rrsig_rsamd5(ldns_buffer *sig,
795 ldns_buffer *rrset,
796 ldns_buffer *key);
797
806 ldns_status ldns_verify_rrsig_dsa_raw(unsigned char* sig,
807 size_t siglen,
808 ldns_buffer* rrset,
809 unsigned char* key,
810 size_t keylen);
811
820 ldns_status ldns_verify_rrsig_rsasha1_raw(unsigned char* sig,
821 size_t siglen,
822 ldns_buffer* rrset,
823 unsigned char* key,
824 size_t keylen);
825
835 ldns_status ldns_verify_rrsig_rsasha256_raw(unsigned char* sig,
836 size_t siglen,
837 ldns_buffer* rrset,
838 unsigned char* key,
839 size_t keylen);
840
849 ldns_status ldns_verify_rrsig_rsasha512_raw(unsigned char* sig,
850 size_t siglen,
851 ldns_buffer* rrset,
852 unsigned char* key,
853 size_t keylen);
854
863 ldns_status ldns_verify_rrsig_rsamd5_raw(unsigned char* sig,
864 size_t siglen,
865 ldns_buffer* rrset,
866 unsigned char* key,
867 size_t keylen);
868
869 #ifdef __cplusplus
870 }
871 #endif
872
873 #endif
874
ldns_struct_buffer
implementation of buffers to ease operations
Definition: buffer.h:50
ldns_dnssec_derive_trust_tree_normal_rrset_time
void ldns_dnssec_derive_trust_tree_normal_rrset_time(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_sig_rr, time_t check_time)
Sub function for derive_trust_tree that is used for a &#39;normal&#39; rrset.
Definition: dnssec_verify.c:787
ldns_dnssec_trust_tree_add_parent
ldns_status ldns_dnssec_trust_tree_add_parent(ldns_dnssec_trust_tree *tree, const ldns_dnssec_trust_tree *parent, const ldns_rr *parent_signature, const ldns_status parent_status)
Adds a trust tree as a parent for the given trust tree.
Definition: dnssec_verify.c:653
ldns_dnssec_data_chain_struct::signatures
ldns_rr_list * signatures
Definition: dnssec_verify.h:23
ldns_verify_rrsig_rsamd5
ldns_status ldns_verify_rrsig_rsamd5(ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key)
verifies a buffer with signature data (RSAMD5) for a buffer with rrset data with a buffer with key da...
Definition: dnssec_verify.c:2534
ldns_dnssec_trust_tree_struct::rr
ldns_rr * rr
Definition: dnssec_verify.h:124
ldns_dnssec_data_chain_free
void ldns_dnssec_data_chain_free(ldns_dnssec_data_chain *chain)
Frees a dnssec_data_chain structure.
Definition: dnssec_verify.c:39
ldns_dnssec_derive_trust_tree_no_sig
void ldns_dnssec_derive_trust_tree_no_sig(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain)
Sub function for derive_trust_tree that is used when there are no signatures.
Definition: dnssec_verify.c:1028
ldns_struct_resolver
DNS stub resolver structure.
Definition: resolver.h:59
ldns_fetch_valid_domain_keys
ldns_rr_list * ldns_fetch_valid_domain_keys(const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys, ldns_status *status)
Tries to build an authentication chain from the given keys down to the queried domain.
Definition: dnssec_verify.c:1249
ldns_struct_rr_list
List or Set of Resource Records.
Definition: rr.h:327
ldns_struct_output_format
Output format specifier.
Definition: host2str.h:86
ldns_dnssec_derive_trust_tree_dnskey_rrset
void ldns_dnssec_derive_trust_tree_dnskey_rrset(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr, ldns_rr *cur_sig_rr)
Sub function for derive_trust_tree that is used for DNSKEY rrsets.
Definition: dnssec_verify.c:914
ldns_dnssec_data_chain_struct
Definition: dnssec_verify.h:20
ldns_verify_rrsig_evp
ldns_status ldns_verify_rrsig_evp(ldns_buffer *sig, ldns_buffer *rrset, EVP_PKEY *key, const EVP_MD *digest_type)
verifies a buffer with signature data for a buffer with rrset data with an EVP_PKEY ...
Definition: dnssec_verify.c:2471
ldns_dnssec_data_chain_struct::packet_nodata
signed char packet_nodata
Definition: dnssec_verify.h:28
ldns_dnssec_derive_trust_tree_normal_rrset
void ldns_dnssec_derive_trust_tree_normal_rrset(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_sig_rr)
Sub function for derive_trust_tree that is used for a &#39;normal&#39; rrset.
Definition: dnssec_verify.c:869
ldns_verify_rrsig_evp_raw
ldns_status ldns_verify_rrsig_evp_raw(unsigned char *sig, size_t siglen, ldns_buffer *rrset, EVP_PKEY *key, const EVP_MD *digest_type)
Like ldns_verify_rrsig_evp, but uses raw signature data.
Definition: dnssec_verify.c:2485
ldns_fetch_valid_domain_keys_time
ldns_rr_list * ldns_fetch_valid_domain_keys_time(const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys, time_t check_time, ldns_status *status)
Tries to build an authentication chain from the given keys down to the queried domain.
Definition: dnssec_verify.c:1181
ldns_dnssec_data_chain_struct::parent_type
ldns_rr_type parent_type
Definition: dnssec_verify.h:24
ldns_dnssec_derive_trust_tree_ds_rrset
void ldns_dnssec_derive_trust_tree_ds_rrset(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr)
Sub function for derive_trust_tree that is used for DS rrsets.
Definition: dnssec_verify.c:968
ldns_verify_notime
ldns_status ldns_verify_notime(ldns_rr_list *rrset, ldns_rr_list *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
Verifies a list of signatures for one rrset, but disregard the time.
Definition: dnssec_verify.c:1141
ldns_verify_rrsig_time
ldns_status ldns_verify_rrsig_time(ldns_rr_list *rrset, ldns_rr *rrsig, ldns_rr *key, time_t check_time)
verify an rrsig with 1 key
Definition: dnssec_verify.c:2421
ldns_verify_trusted_time
ldns_status ldns_verify_trusted_time(ldns_resolver *res, ldns_rr_list *rrset, ldns_rr_list *rrsigs, time_t check_time, ldns_rr_list *validating_keys)
Verifies a list of signatures for one RRset using a valid trust path.
Definition: dnssec_verify.c:1418
ldns_struct_rr
Resource Record.
Definition: rr.h:299
ldns_dnssec_data_chain_struct::rrset
ldns_rr_list * rrset
Definition: dnssec_verify.h:22
ldns_dnssec_trust_tree_print
void ldns_dnssec_trust_tree_print(FILE *out, ldns_dnssec_trust_tree *tree, size_t tabs, signed char extended)
Prints the dnssec_trust_tree structure to the given file stream.
ldns_dnssec_trust_tree_depth
size_t ldns_dnssec_trust_tree_depth(ldns_dnssec_trust_tree *tree)
returns the depth of the trust tree
Definition: dnssec_verify.c:467
ldns_dnssec_derive_trust_tree_ds_rrset_time
void ldns_dnssec_derive_trust_tree_ds_rrset_time(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr, time_t check_time)
Sub function for derive_trust_tree that is used for DS rrsets.
Definition: dnssec_verify.c:924
ldns_verify_rrsig_keylist_time
ldns_status ldns_verify_rrsig_keylist_time(ldns_rr_list *rrset, ldns_rr *rrsig, const ldns_rr_list *keys, time_t check_time, ldns_rr_list *good_keys)
Verifies an rrsig.
Definition: dnssec_verify.c:2287
ldns_dnssec_verify_denial
ldns_status ldns_dnssec_verify_denial(ldns_rr *rr, ldns_rr_list *nsecs, ldns_rr_list *rrsigs)
denial is not just a river in egypt
Definition: dnssec_verify.c:1493
ldns_dnssec_data_chain_struct::parent
ldns_dnssec_data_chain * parent
Definition: dnssec_verify.h:25
ldns_verify_rrsig_keylist_notime
ldns_status ldns_verify_rrsig_keylist_notime(ldns_rr_list *rrset, ldns_rr *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
Verifies an rrsig.
Definition: dnssec_verify.c:2337
ldns_dnssec_derive_trust_tree
ldns_dnssec_trust_tree * ldns_dnssec_derive_trust_tree(ldns_dnssec_data_chain *data_chain, ldns_rr *rr)
Generates a dnssec_trust_tree for the given rr from the given data_chain.
Definition: dnssec_verify.c:781
ldns_dnssec_data_chain_deep_free
void ldns_dnssec_data_chain_deep_free(ldns_dnssec_data_chain *chain)
Frees a dnssec_data_chain structure, and all data contained therein.
Definition: dnssec_verify.c:45
ldns_dnssec_trust_tree_free
void ldns_dnssec_trust_tree_free(ldns_dnssec_trust_tree *tree)
Frees the dnssec_trust_tree recursively.
Definition: dnssec_verify.c:455
ldns_validate_domain_dnskey_time
ldns_rr_list * ldns_validate_domain_dnskey_time(const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys, time_t check_time)
Validates the DNSKEY RRset for the given domain using the provided trusted keys.
Definition: dnssec_verify.c:1259
ldns_verify_rrsig_rsasha512_raw
ldns_status ldns_verify_rrsig_rsasha512_raw(unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
Like ldns_verify_rrsig_rsasha512, but uses raw signature and key data.
Definition: dnssec_verify.c:2624
ldns_dnssec_trust_tree_struct::rrset
ldns_rr_list * rrset
Definition: dnssec_verify.h:126
ldns_dnssec_data_chain_struct::packet_rcode
ldns_pkt_rcode packet_rcode
Definition: dnssec_verify.h:26
ldns_validate_domain_dnskey
ldns_rr_list * ldns_validate_domain_dnskey(const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys)
Validates the DNSKEY RRset for the given domain using the provided trusted keys.
Definition: dnssec_verify.c:1353
ldns_verify_rrsig_rsamd5_raw
ldns_status ldns_verify_rrsig_rsamd5_raw(unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
Like ldns_verify_rrsig_rsamd5, but uses raw signature and key data.
Definition: dnssec_verify.c:2660
host2str.h
host2str.h - txt presentation of RRs
ldns_pkt_rcode
enum ldns_enum_pkt_rcode ldns_pkt_rcode
Definition: packet.h:68
ldns_dnssec_data_chain_new
ldns_dnssec_data_chain * ldns_dnssec_data_chain_new(void)
Creates a new dnssec_chain structure.
Definition: dnssec_verify.c:19
ldns_verify_rrsig_rsasha1
ldns_status ldns_verify_rrsig_rsasha1(ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key)
verifies a buffer with signature data (RSASHA1) for a buffer with rrset data with a buffer with key d...
Definition: dnssec_verify.c:2523
ldns_verify_time
ldns_status ldns_verify_time(ldns_rr_list *rrset, ldns_rr_list *rrsig, const ldns_rr_list *keys, time_t check_time, ldns_rr_list *good_keys)
Verifies a list of signatures for one rrset.
Definition: dnssec_verify.c:1090
ldns_verify
ldns_status ldns_verify(ldns_rr_list *rrset, ldns_rr_list *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
Verifies a list of signatures for one rrset.
Definition: dnssec_verify.c:1134
ldns_dnssec_trust_tree_struct::parent_count
size_t parent_count
Definition: dnssec_verify.h:132
ldns_struct_pkt
DNS packet.
Definition: packet.h:233
ldns_verify_rrsig_rsasha1_raw
ldns_status ldns_verify_rrsig_rsasha1_raw(unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
Like ldns_verify_rrsig_rsasha1, but uses raw signature and key data.
Definition: dnssec_verify.c:2567
ldns_dnssec_derive_trust_tree_time
ldns_dnssec_trust_tree * ldns_dnssec_derive_trust_tree_time(ldns_dnssec_data_chain *data_chain, ldns_rr *rr, time_t check_time)
Generates a dnssec_trust_tree for the given rr from the given data_chain.
Definition: dnssec_verify.c:680
ldns_dnssec_data_chain_struct::packet_qtype
ldns_rr_type packet_qtype
Definition: dnssec_verify.h:27
ldns_verify_rrsig_rsasha256_raw
ldns_status ldns_verify_rrsig_rsasha256_raw(unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
Like ldns_verify_rrsig_rsasha256, but uses raw signature and key data.
Definition: dnssec_verify.c:2589
ldns_dnssec_trust_tree_struct
Definition: dnssec_verify.h:122
ldns_verify_trusted
ldns_status ldns_verify_trusted(ldns_resolver *res, ldns_rr_list *rrset, ldns_rr_list *rrsigs, ldns_rr_list *validating_keys)
Verifies a list of signatures for one RRset using a valid trust path.
Definition: dnssec_verify.c:1481
ldns_status
enum ldns_enum_status ldns_status
Definition: error.h:131
ldns_dnssec_verify_denial_nsec3_match
ldns_status ldns_dnssec_verify_denial_nsec3_match(ldns_rr *rr, ldns_rr_list *nsecs, ldns_rr_list *rrsigs, ldns_pkt_rcode packet_rcode, ldns_rr_type packet_qtype, signed char packet_nodata, ldns_rr **match)
Same as ldns_status ldns_dnssec_verify_denial_nsec3 but also returns the nsec rr that matched...
dnssec.h
This module contains base functions for DNSSEC operations (RFC4033 t/m RFC4035).
ldns_verify_rrsig_buffers
ldns_status ldns_verify_rrsig_buffers(ldns_buffer *rawsig_buf, ldns_buffer *verify_buf, ldns_buffer *key_buf, uint8_t algo)
Verifies the already processed data in the buffers This function should probably not be used directly...
Definition: dnssec_verify.c:1920
LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS
#define LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS
dnssec_verify
Definition: dnssec_verify.h:6
ldns_verify_rrsig_dsa
ldns_status ldns_verify_rrsig_dsa(ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key)
verifies a buffer with signature data (DSA) for a buffer with rrset data with a buffer with key data...
Definition: dnssec_verify.c:2512
ldns_dnssec_verify_denial_nsec3
ldns_status ldns_dnssec_verify_denial_nsec3(ldns_rr *rr, ldns_rr_list *nsecs, ldns_rr_list *rrsigs, ldns_pkt_rcode packet_rcode, ldns_rr_type packet_qtype, signed char packet_nodata)
Denial of existence using NSEC3 records Since NSEC3 is a bit more complicated than normal denial...
ldns_verify_rrsig
ldns_status ldns_verify_rrsig(ldns_rr_list *rrset, ldns_rr *rrsig, ldns_rr *key)
verify an rrsig with 1 key
Definition: dnssec_verify.c:2464
ldns_validate_domain_ds_time
ldns_rr_list * ldns_validate_domain_ds_time(const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys, time_t check_time)
Validates the DS RRset for the given domain using the provided trusted keys.
Definition: dnssec_verify.c:1362
ldns_dnssec_derive_trust_tree_dnskey_rrset_time
void ldns_dnssec_derive_trust_tree_dnskey_rrset_time(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr, ldns_rr *cur_sig_rr, time_t check_time)
Sub function for derive_trust_tree that is used for DNSKEY rrsets.
Definition: dnssec_verify.c:878
ldns_dnssec_data_chain_print
void ldns_dnssec_data_chain_print(FILE *out, const ldns_dnssec_data_chain *chain)
Prints the dnssec_data_chain to the given file stream.
Definition: dnssec_verify.c:91
ldns_struct_rdf
Resource record data field.
Definition: rdata.h:166
ldns_dnssec_derive_trust_tree_no_sig_time
void ldns_dnssec_derive_trust_tree_no_sig_time(ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, time_t check_time)
Sub function for derive_trust_tree that is used when there are no signatures.
Definition: dnssec_verify.c:977
ldns_validate_domain_ds
ldns_rr_list * ldns_validate_domain_ds(const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys)
Validates the DS RRset for the given domain using the provided trusted keys.
Definition: dnssec_verify.c:1410
ldns_dnssec_build_data_chain
ldns_dnssec_data_chain * ldns_dnssec_build_data_chain(ldns_resolver *res, const uint16_t qflags, const ldns_rr_list *data_set, const ldns_pkt *pkt, ldns_rr *orig_rr)
Build an ldns_dnssec_data_chain, which contains all DNSSEC data that is needed to derive the trust tr...
Definition: dnssec_verify.c:270
ldns_dnssec_data_chain_print_fmt
void ldns_dnssec_data_chain_print_fmt(FILE *out, const ldns_output_format *fmt, const ldns_dnssec_data_chain *chain)
Prints the dnssec_data_chain to the given file stream.
Definition: dnssec_verify.c:56
ldns_rr_type
enum ldns_enum_rr_type ldns_rr_type
Definition: rr.h:236
ldns_verify_rrsig_dsa_raw
ldns_status ldns_verify_rrsig_dsa_raw(unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
Like ldns_verify_rrsig_dsa, but uses raw signature and key data.
Definition: dnssec_verify.c:2545
ldns_dnssec_trust_tree_print_fmt
void ldns_dnssec_trust_tree_print_fmt(FILE *out, const ldns_output_format *fmt, ldns_dnssec_trust_tree *tree, size_t tabs, signed char extended)
Prints the dnssec_trust_tree structure to the given file stream.
ldns_dnssec_trust_tree_contains_keys
ldns_status ldns_dnssec_trust_tree_contains_keys(ldns_dnssec_trust_tree *tree, ldns_rr_list *keys)
Returns OK if there is a trusted path in the tree to one of the DNSKEY or DS RRs in the given list...
Definition: dnssec_verify.c:1041
ldns_dnssec_trust_tree_new
ldns_dnssec_trust_tree * ldns_dnssec_trust_tree_new(void)
Creates a new (empty) dnssec_trust_tree structure.
Definition: dnssec_verify.c:442
ldns_verify_rrsig_buffers_raw
ldns_status ldns_verify_rrsig_buffers_raw(unsigned char *sig, size_t siglen, ldns_buffer *verify_buf, unsigned char *key, size_t keylen, uint8_t algo)
Like ldns_verify_rrsig_buffers, but uses raw data.
Definition: dnssec_verify.c:1932
ldns_verify_rrsig_keylist
ldns_status ldns_verify_rrsig_keylist(ldns_rr_list *rrset, ldns_rr *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
Verifies an rrsig.
Definition: dnssec_verify.c:2327