dnssec_verify.c File Reference

Go to the source code of this file.

Functions

ldns_dnssec_data_chainldns_dnssec_data_chain_new ()
 Creates a new dnssec_chain structure.
void ldns_dnssec_data_chain_free (ldns_dnssec_data_chain *chain)
 Frees a dnssec_data_chain structure.
void ldns_dnssec_data_chain_deep_free (ldns_dnssec_data_chain *chain)
 Frees a dnssec_data_chain structure, and all data contained therein.
void ldns_dnssec_data_chain_print (FILE *out, const ldns_dnssec_data_chain *chain)
 Prints the dnssec_data_chain to the given file stream.
ldns_dnssec_data_chainldns_dnssec_build_data_chain (ldns_resolver *res, uint16_t qflags, const ldns_rr_list *rrset, const ldns_pkt *pkt, ldns_rr *orig_rr)
 the data set will be cloned the pkt is optional, can contain the original packet (and hence the sigs and maybe the key)
ldns_dnssec_trust_treeldns_dnssec_trust_tree_new ()
 Creates a new (empty) dnssec_trust_tree structure.
void ldns_dnssec_trust_tree_free (ldns_dnssec_trust_tree *tree)
 Frees the dnssec_trust_tree recursively There is no deep free; all data in the trust tree consists of pointers to a data_chain.
size_t ldns_dnssec_trust_tree_depth (ldns_dnssec_trust_tree *tree)
 returns the depth of the trust tree
void ldns_dnssec_trust_tree_print_sm (FILE *out, ldns_dnssec_trust_tree *tree, size_t tabs, bool extended, uint8_t *sibmap, size_t treedepth)
void ldns_dnssec_trust_tree_print (FILE *out, ldns_dnssec_trust_tree *tree, size_t tabs, bool extended)
 Prints the dnssec_trust_tree structure to the given file stream Each line is prepended by 2*tabs spaces If a link status is not LDNS_STATUS_OK; the status and relevant signatures are printed too.
ldns_status ldns_dnssec_trust_tree_add_parent (ldns_dnssec_trust_tree *tree, const ldns_dnssec_trust_tree *parent, const ldns_rr *signature, const ldns_status parent_status)
 Adds a trust tree as a parent for the given trust tree.
ldns_dnssec_trust_treeldns_dnssec_derive_trust_tree (ldns_dnssec_data_chain *data_chain, ldns_rr *rr)
 Generates a dnssec_trust_ttree for the given rr from the given data_chain Don't free the data_chain before you are done with this tree.
void ldns_dnssec_derive_trust_tree_normal_rrset (ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_sig_rr)
 Sub function for derive_trust_tree that is used for a 'normal' rrset.
void ldns_dnssec_derive_trust_tree_dnskey_rrset (ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr, ldns_rr *cur_sig_rr)
 Sub function for derive_trust_tree that is used for DNSKEY rrsets.
void ldns_dnssec_derive_trust_tree_ds_rrset (ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain, ldns_rr *cur_rr)
 Sub function for derive_trust_tree that is used for DS rrsets.
void ldns_dnssec_derive_trust_tree_no_sig (ldns_dnssec_trust_tree *new_tree, ldns_dnssec_data_chain *data_chain)
 Sub function for derive_trust_tree that is used when there are no signatures.
ldns_status ldns_dnssec_trust_tree_contains_keys (ldns_dnssec_trust_tree *tree, ldns_rr_list *trusted_keys)
 Returns OK if there is a trusted path in the tree to one of the DNSKEY or DS RRs in the given list.
ldns_status ldns_verify (ldns_rr_list *rrset, ldns_rr_list *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
 Verifies a list of signatures for one rrset.
ldns_rr_listldns_fetch_valid_domain_keys (const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys, ldns_status *status)
 Tries to build an authentication chain from the given keys down to the queried domain.
ldns_rr_listldns_validate_domain_dnskey (const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys)
 Validates the DNSKEY RRset for the given domain using the provided trusted keys.
ldns_rr_listldns_validate_domain_ds (const ldns_resolver *res, const ldns_rdf *domain, const ldns_rr_list *keys)
 Validates the DS RRset for the given domain using the provided trusted keys.
ldns_status ldns_verify_trusted (ldns_resolver *res, ldns_rr_list *rrset, ldns_rr_list *rrsigs, ldns_rr_list *validating_keys)
 Verifies a list of signatures for one RRset using a valid trust path.
ldns_status ldns_dnssec_verify_denial (ldns_rr *rr, ldns_rr_list *nsecs, ldns_rr_list *rrsigs)
 denial is not just a river in egypt
ldns_status ldns_dnssec_verify_denial_nsec3 (ldns_rr *rr, ldns_rr_list *nsecs, ldns_rr_list *rrsigs, ldns_pkt_rcode packet_rcode, ldns_rr_type packet_qtype, bool packet_nodata)
 Denial of existence using NSEC3 records Since NSEC3 is a bit more complicated than normal denial, some context arguments are needed.
ldns_status ldns_verify_rrsig_buffers (ldns_buffer *rawsig_buf, ldns_buffer *verify_buf, ldns_buffer *key_buf, uint8_t algo)
 Verifies the already processed data in the buffers This function should probably not be used directly.
ldns_status ldns_verify_rrsig_buffers_raw (unsigned char *sig, size_t siglen, ldns_buffer *verify_buf, unsigned char *key, size_t keylen, uint8_t algo)
 Like ldns_verify_rrsig_buffers, but uses raw data.
ldns_status ldns_verify_rrsig_keylist (ldns_rr_list *rrset, ldns_rr *rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys)
 Verifies an rrsig.
ldns_status ldns_convert_dsa_rrsig_rdata (ldns_buffer *target_buffer, ldns_rdf *sig_rdf)
 convert dsa data
ldns_status ldns_verify_rrsig (ldns_rr_list *rrset, ldns_rr *rrsig, ldns_rr *key)
 verify an rrsig with 1 key
ldns_status ldns_verify_rrsig_evp (ldns_buffer *sig, ldns_buffer *rrset, EVP_PKEY *key, const EVP_MD *digest_type)
 verifies a buffer with signature data for a buffer with rrset data with an EVP_PKEY
ldns_status ldns_verify_rrsig_evp_raw (unsigned char *sig, size_t siglen, ldns_buffer *rrset, EVP_PKEY *key, const EVP_MD *digest_type)
 Like ldns_verify_rrsig_evp, but uses raw signature data.
ldns_status ldns_verify_rrsig_dsa (ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key)
 verifies a buffer with signature data (DSA) for a buffer with rrset data with a buffer with key data.
ldns_status ldns_verify_rrsig_rsasha1 (ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key)
 verifies a buffer with signature data (RSASHA1) for a buffer with rrset data with a buffer with key data.
ldns_status ldns_verify_rrsig_rsamd5 (ldns_buffer *sig, ldns_buffer *rrset, ldns_buffer *key)
 verifies a buffer with signature data (RSAMD5) for a buffer with rrset data with a buffer with key data.
ldns_status ldns_verify_rrsig_dsa_raw (unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
 Like ldns_verify_rrsig_dsa, but uses raw signature and key data.
ldns_status ldns_verify_rrsig_rsasha1_raw (unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
 Like ldns_verify_rrsig_rsasha1, but uses raw signature and key data.
ldns_status ldns_verify_rrsig_rsasha256_raw (unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
 Like ldns_verify_rrsig_rsasha256, but uses raw signature and key data.
ldns_status ldns_verify_rrsig_rsasha512_raw (unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
 Like ldns_verify_rrsig_rsasha512, but uses raw signature and key data.
ldns_status ldns_verify_rrsig_rsamd5_raw (unsigned char *sig, size_t siglen, ldns_buffer *rrset, unsigned char *key, size_t keylen)
 Like ldns_verify_rrsig_rsamd5, but uses raw signature and key data.


Function Documentation

ldns_dnssec_data_chain* ldns_dnssec_data_chain_new (  ) 

void ldns_dnssec_data_chain_free ( ldns_dnssec_data_chain chain  ) 

Frees a dnssec_data_chain structure.

Parameters:
[in] *chain The chain to free

Definition at line 33 of file dnssec_verify.c.

References LDNS_FREE.

void ldns_dnssec_data_chain_deep_free ( ldns_dnssec_data_chain chain  ) 

Frees a dnssec_data_chain structure, and all data contained therein.

Parameters:
[in] *chain The dnssec_data_chain to free

Definition at line 39 of file dnssec_verify.c.

References ldns_dnssec_data_chain_deep_free(), LDNS_FREE, ldns_rr_list_deep_free(), ldns_dnssec_data_chain_struct::parent, ldns_dnssec_data_chain_struct::rrset, and ldns_dnssec_data_chain_struct::signatures.

void ldns_dnssec_data_chain_print ( FILE *  out,
const ldns_dnssec_data_chain chain 
)

ldns_dnssec_data_chain* ldns_dnssec_build_data_chain ( ldns_resolver res,
uint16_t  qflags,
const ldns_rr_list rrset,
const ldns_pkt pkt,
ldns_rr orig_rr 
)

ldns_dnssec_trust_tree* ldns_dnssec_trust_tree_new (  ) 

Creates a new (empty) dnssec_trust_tree structure.

Returns:
ldns_dnssec_trust_tree *

Definition at line 346 of file dnssec_verify.c.

References LDNS_XMALLOC, ldns_dnssec_trust_tree_struct::parent_count, ldns_dnssec_trust_tree_struct::rr, and ldns_dnssec_trust_tree_struct::rrset.

void ldns_dnssec_trust_tree_free ( ldns_dnssec_trust_tree tree  ) 

Frees the dnssec_trust_tree recursively There is no deep free; all data in the trust tree consists of pointers to a data_chain.

Parameters:
[in] tree The tree to free

Definition at line 358 of file dnssec_verify.c.

References ldns_dnssec_trust_tree_free(), LDNS_FREE, ldns_dnssec_trust_tree_struct::parent_count, and ldns_dnssec_trust_tree_struct::parents.

size_t ldns_dnssec_trust_tree_depth ( ldns_dnssec_trust_tree tree  ) 

returns the depth of the trust tree

Parameters:
[in] tree tree to calculate the depth of
Returns:
The depth of the tree

Definition at line 370 of file dnssec_verify.c.

References ldns_dnssec_trust_tree_depth(), ldns_dnssec_trust_tree_struct::parent_count, and ldns_dnssec_trust_tree_struct::parents.

void ldns_dnssec_trust_tree_print_sm ( FILE *  out,
ldns_dnssec_trust_tree tree,
size_t  tabs,
bool  extended,
uint8_t *  sibmap,
size_t  treedepth 
)

void ldns_dnssec_trust_tree_print ( FILE *  out,
ldns_dnssec_trust_tree tree,
size_t  tabs,
bool  extended 
)

Prints the dnssec_trust_tree structure to the given file stream Each line is prepended by 2*tabs spaces If a link status is not LDNS_STATUS_OK; the status and relevant signatures are printed too.

Parameters:
[in] *out The file stream to print to
[in] tree The trust tree to print
[in] tabs Prepend each line with tabs*2 spaces
[in] extended If true, add little explanation lines to the output

Definition at line 520 of file dnssec_verify.c.

References ldns_dnssec_trust_tree_print_sm().

ldns_status ldns_dnssec_trust_tree_add_parent ( ldns_dnssec_trust_tree tree,
const ldns_dnssec_trust_tree parent,
const ldns_rr parent_signature,
const ldns_status  parent_status 
)

Adds a trust tree as a parent for the given trust tree.

Parameters:
[in] *tree The tree to add the parent to
[in] *parent The parent tree to add
[in] *parent_signature The RRSIG relevant to this parent/child connection
[in] parent_status The DNSSEC status for this parent, child and RRSIG
Returns:
LDNS_STATUS_OK if the addition succeeds, error otherwise

Definition at line 526 of file dnssec_verify.c.

References LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS, LDNS_STATUS_ERR, LDNS_STATUS_OK, ldns_dnssec_trust_tree_struct::parent_count, ldns_dnssec_trust_tree_struct::parent_signature, ldns_dnssec_trust_tree_struct::parent_status, and ldns_dnssec_trust_tree_struct::parents.

ldns_dnssec_trust_tree* ldns_dnssec_derive_trust_tree ( ldns_dnssec_data_chain data_chain,
ldns_rr rr 
)

void ldns_dnssec_derive_trust_tree_normal_rrset ( ldns_dnssec_trust_tree new_tree,
ldns_dnssec_data_chain data_chain,
ldns_rr cur_sig_rr 
)

void ldns_dnssec_derive_trust_tree_dnskey_rrset ( ldns_dnssec_trust_tree new_tree,
ldns_dnssec_data_chain data_chain,
ldns_rr cur_rr,
ldns_rr cur_sig_rr 
)

Sub function for derive_trust_tree that is used for DNSKEY rrsets.

Parameters:
[in] new_tree The trust tree that we are building
[in] data_chain The data chain containing the data for the trust tree
[in] cur_rr The currently relevant DNSKEY RR
[in] cur_sig_rr The currently relevant signature

Definition at line 705 of file dnssec_verify.c.

References ldns_calc_keytag(), ldns_dnssec_trust_tree_add_parent(), ldns_dnssec_trust_tree_new(), ldns_rdf2native_int16(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_rrsig_keytag(), LDNS_RR_TYPE_DNSKEY, ldns_verify_rrsig(), ldns_dnssec_trust_tree_struct::rr, ldns_dnssec_trust_tree_struct::rrset, and ldns_dnssec_data_chain_struct::rrset.

void ldns_dnssec_derive_trust_tree_ds_rrset ( ldns_dnssec_trust_tree new_tree,
ldns_dnssec_data_chain data_chain,
ldns_rr cur_rr 
)

Sub function for derive_trust_tree that is used for DS rrsets.

Parameters:
[in] new_tree The trust tree that we are building
[in] data_chain The data chain containing the data for the trust tree
[in] cur_rr The currently relevant DS RR

Definition at line 737 of file dnssec_verify.c.

References ldns_dnssec_derive_trust_tree(), ldns_dnssec_trust_tree_add_parent(), ldns_rr_compare_ds(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), LDNS_RR_TYPE_DNSKEY, LDNS_RR_TYPE_DS, LDNS_STATUS_OK, ldns_dnssec_data_chain_struct::parent, and ldns_dnssec_data_chain_struct::rrset.

void ldns_dnssec_derive_trust_tree_no_sig ( ldns_dnssec_trust_tree new_tree,
ldns_dnssec_data_chain data_chain 
)

ldns_status ldns_dnssec_trust_tree_contains_keys ( ldns_dnssec_trust_tree tree,
ldns_rr_list keys 
)

Returns OK if there is a trusted path in the tree to one of the DNSKEY or DS RRs in the given list.

Parameters:
*tree The trust tree so search
*keys A ldns_rr_list of DNSKEY and DS rrs to look for
Returns:
LDNS_STATUS_OK if there is a trusted path to one of the keys, or the *first* error encountered if there were no paths

Definition at line 822 of file dnssec_verify.c.

References ldns_dnssec_trust_tree_contains_keys(), ldns_rr_compare_ds(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), LDNS_RR_TYPE_NSEC, LDNS_STATUS_CRYPTO_NO_DNSKEY, LDNS_STATUS_DNSSEC_EXISTENCE_DENIED, LDNS_STATUS_ERR, LDNS_STATUS_OK, ldns_dnssec_trust_tree_struct::parent_count, ldns_dnssec_trust_tree_struct::parent_status, ldns_dnssec_trust_tree_struct::parents, and ldns_dnssec_trust_tree_struct::rr.

ldns_status ldns_verify ( ldns_rr_list rrset,
ldns_rr_list rrsig,
const ldns_rr_list keys,
ldns_rr_list good_keys 
)

Verifies a list of signatures for one rrset.

Parameters:
[in] rrset the rrset to verify
[in] rrsig a list of signatures to check
[in] keys a list of keys to check with
[out] good_keys if this is a (initialized) list, the keys from keys that validate one of the signatures are added to it
Returns:
status LDNS_STATUS_OK if there is at least one correct key

Definition at line 868 of file dnssec_verify.c.

References ldns_rr_list_rr(), ldns_rr_list_rr_count(), LDNS_STATUS_CRYPTO_NO_RRSIG, LDNS_STATUS_CRYPTO_NO_TRUSTED_DNSKEY, LDNS_STATUS_ERR, LDNS_STATUS_OK, and ldns_verify_rrsig_keylist().

ldns_rr_list* ldns_fetch_valid_domain_keys ( const ldns_resolver res,
const ldns_rdf domain,
const ldns_rr_list keys,
ldns_status status 
)

Tries to build an authentication chain from the given keys down to the queried domain.

If we find a valid trust path, return the valid keys for the domain.

Parameters:
[in] res the current resolver
[in] domain the domain we want valid keys for
[in] keys the current set of trusted keys
[out] status pointer to the status variable where the result code will be stored
Returns:
the set of trusted keys for the domain, or NULL if no trust path could be built.

Definition at line 905 of file dnssec_verify.c.

References ldns_dname_left_chop(), ldns_fetch_valid_domain_keys(), ldns_rdf_free(), ldns_rdf_size(), ldns_rr_list_deep_free(), LDNS_STATUS_CRYPTO_NO_TRUSTED_DNSKEY, LDNS_STATUS_CRYPTO_NO_TRUSTED_DS, LDNS_STATUS_OK, ldns_validate_domain_dnskey(), and ldns_validate_domain_ds().

ldns_rr_list* ldns_validate_domain_dnskey ( const ldns_resolver res,
const ldns_rdf domain,
const ldns_rr_list keys 
)

Validates the DNSKEY RRset for the given domain using the provided trusted keys.

Parameters:
[in] res the current resolver
[in] domain the domain we want valid keys for
[in] keys the current set of trusted keys
Returns:
the set of trusted keys for the domain, or NULL if the RRSET could not be validated

Definition at line 946 of file dnssec_verify.c.

References ldns_calc_keytag(), ldns_pkt_free(), ldns_pkt_rr_list_by_type(), LDNS_RD, ldns_rdf2native_int16(), ldns_resolver_query(), LDNS_RR_CLASS_IN, ldns_rr_clone(), ldns_rr_compare_ds(), ldns_rr_list_deep_free(), ldns_rr_list_new(), ldns_rr_list_push_rr(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_rrsig_keytag(), LDNS_RR_TYPE_DNSKEY, LDNS_RR_TYPE_RRSIG, LDNS_SECTION_ANSWER, LDNS_STATUS_CRYPTO_NO_DNSKEY, LDNS_STATUS_OK, and ldns_verify_rrsig().

ldns_rr_list* ldns_validate_domain_ds ( const ldns_resolver res,
const ldns_rdf domain,
const ldns_rr_list keys 
)

Validates the DS RRset for the given domain using the provided trusted keys.

Parameters:
[in] res the current resolver
[in] domain the domain we want valid keys for
[in] keys the current set of trusted keys
Returns:
the set of trusted keys for the domain, or NULL if the RRSET could not be validated

Definition at line 1018 of file dnssec_verify.c.

References ldns_pkt_free(), ldns_pkt_rr_list_by_type(), LDNS_RD, ldns_resolver_query(), LDNS_RR_CLASS_IN, ldns_rr_clone(), ldns_rr_list_deep_free(), ldns_rr_list_new(), ldns_rr_list_push_rr(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), LDNS_RR_TYPE_DS, LDNS_RR_TYPE_RRSIG, LDNS_SECTION_ANSWER, LDNS_STATUS_CRYPTO_NO_DS, LDNS_STATUS_OK, and ldns_verify().

ldns_status ldns_verify_trusted ( ldns_resolver res,
ldns_rr_list rrset,
ldns_rr_list rrsigs,
ldns_rr_list validating_keys 
)

Verifies a list of signatures for one RRset using a valid trust path.

Parameters:
[in] res the current resolver
[in] rrset the rrset to verify
[in] rrsigs a list of signatures to check
[out] validating_keys if this is a (initialized) list, the keys from keys that validate one of the signatures are added to it
Returns:
status LDNS_STATUS_OK if there is at least one correct key

Definition at line 1055 of file dnssec_verify.c.

References ldns_fetch_valid_domain_keys(), ldns_get_errorstr_by_id(), ldns_resolver_dnssec_anchors(), ldns_rr_clone(), ldns_rr_list_deep_free(), ldns_rr_list_print(), ldns_rr_list_push_rr(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_print(), ldns_rr_rrsig_signame(), LDNS_STATUS_CRYPTO_NO_RRSIG, LDNS_STATUS_ERR, LDNS_STATUS_OK, and ldns_verify_rrsig().

ldns_status ldns_dnssec_verify_denial ( ldns_rr rr,
ldns_rr_list nsecs,
ldns_rr_list rrsigs 
)

denial is not just a river in egypt

Parameters:
[in] rr The (query) RR to check the denial of existence for
[in] nsecs The list of NSEC RRs that are supposed to deny the existence of the RR
[in] rrsigs The RRSIG RR covering the NSEC RRs
Returns:
LDNS_STATUS_OK if the NSEC RRs deny the existence, error code containing the reason they do not otherwise

Definition at line 1119 of file dnssec_verify.c.

References ldns_dname_cat(), ldns_dname_compare(), ldns_dname_label_count(), ldns_dname_left_chop(), ldns_dname_new_frm_str(), ldns_dnssec_get_rrsig_for_name_and_type(), ldns_nsec_bitmap_covers_type(), ldns_nsec_covers_name(), ldns_nsec_get_bitmap(), ldns_rdf2native_int8(), ldns_rdf_deep_free(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_owner(), ldns_rr_rrsig_labels(), LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED, LDNS_STATUS_DNSSEC_NSEC_WILDCARD_NOT_COVERED, and LDNS_STATUS_OK.

ldns_status ldns_dnssec_verify_denial_nsec3 ( ldns_rr rr,
ldns_rr_list nsecs,
ldns_rr_list rrsigs,
ldns_pkt_rcode  packet_rcode,
ldns_rr_type  packet_qtype,
bool  packet_nodata 
)

Denial of existence using NSEC3 records Since NSEC3 is a bit more complicated than normal denial, some context arguments are needed.

Parameters:
[in] rr The (query) RR to check the denial of existence for
[in] nsecs The list of NSEC3 RRs that are supposed to deny the existence of the RR
[in] rrsigs The RRSIG rr covering the NSEC RRs
[in] packet_rcode The RCODE value of the packet that provided the NSEC3 RRs
[in] packet_qtype The original query RR type
[in] packet_nodata True if the providing packet had an empty ANSWER section
Returns:
LDNS_STATUS_OK if the NSEC3 RRs deny the existence, error code containing the reason they do not otherwise

Definition at line 1199 of file dnssec_verify.c.

References ldns_dname_cat(), ldns_dname_compare(), ldns_dname_left_chop(), ldns_dname_new_frm_str(), ldns_dnssec_nsec3_closest_encloser(), ldns_nsec3_bitmap(), ldns_nsec3_hash_name_frm_nsec3(), ldns_nsec_bitmap_covers_type(), ldns_nsec_covers_name(), LDNS_RCODE_NXDOMAIN, ldns_rdf_deep_free(), ldns_rdf_print(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_owner(), ldns_rr_print(), LDNS_RR_TYPE_CNAME, LDNS_RR_TYPE_DS, LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED, LDNS_STATUS_DNSSEC_NSEC_WILDCARD_NOT_COVERED, and LDNS_STATUS_OK.

ldns_status ldns_verify_rrsig_buffers ( ldns_buffer rawsig_buf,
ldns_buffer verify_buf,
ldns_buffer key_buf,
uint8_t  algo 
)

Verifies the already processed data in the buffers This function should probably not be used directly.

Parameters:
[in] rawsig_buf Buffer containing signature data to use
[in] verify_buf Buffer containing data to verify
[in] key_buf Buffer containing key data to use
[in] algo Signing algorithm
Returns:
status LDNS_STATUS_OK if the data verifies. Error if not.

Definition at line 1321 of file dnssec_verify.c.

References ldns_verify_rrsig_buffers_raw().

ldns_status ldns_verify_rrsig_buffers_raw ( unsigned char *  sig,
size_t  siglen,
ldns_buffer verify_buf,
unsigned char *  key,
size_t  keylen,
uint8_t  algo 
)

Like ldns_verify_rrsig_buffers, but uses raw data.

Parameters:
[in] sig signature data to use
[in] siglen length of signature data to use
[in] verify_buf Buffer containing data to verify
[in] key key data to use
[in] keylen length of key data to use
[in] algo Signing algorithm
Returns:
status LDNS_STATUS_OK if the data verifies. Error if not.

Definition at line 1331 of file dnssec_verify.c.

References LDNS_DSA, LDNS_DSA_NSEC3, LDNS_RSAMD5, LDNS_RSASHA1, LDNS_RSASHA1_NSEC3, LDNS_RSASHA256, LDNS_RSASHA256_NSEC3, LDNS_RSASHA512, LDNS_RSASHA512_NSEC3, LDNS_STATUS_CRYPTO_UNKNOWN_ALGO, ldns_verify_rrsig_dsa_raw(), ldns_verify_rrsig_rsamd5_raw(), ldns_verify_rrsig_rsasha1_raw(), ldns_verify_rrsig_rsasha256_raw(), and ldns_verify_rrsig_rsasha512_raw().

ldns_status ldns_verify_rrsig_keylist ( ldns_rr_list rrset,
ldns_rr rrsig,
const ldns_rr_list keys,
ldns_rr_list good_keys 
)

Verifies an rrsig.

All keys in the keyset are tried.

Parameters:
[in] rrset the rrset to check
[in] rrsig the signature of the rrset
[in] keys the keys to try
[out] good_keys if this is a (initialized) list, the keys from keys that validate one of the signatures are added to it
Returns:
a list of keys which validate the rrsig + rrset. Returns NULL when none of the keys validate.

Definition at line 1373 of file dnssec_verify.c.

References ldns_buffer_free(), ldns_buffer_new(), ldns_calc_keytag(), ldns_dname2canonical(), ldns_dname_cat(), ldns_dname_label_count(), ldns_dname_left_chop(), LDNS_MAX_PACKETLEN, ldns_rdf2buffer_wire(), ldns_rdf2native_int16(), ldns_rdf2native_int32(), ldns_rdf2native_int8(), ldns_rdf2native_time_t(), ldns_rdf2rr_type(), ldns_rdf_clone(), ldns_rdf_deep_free(), ldns_rr2canonical(), ldns_rr_get_type(), ldns_rr_list2buffer_wire(), ldns_rr_list_cat(), ldns_rr_list_clone(), ldns_rr_list_deep_free(), ldns_rr_list_free(), ldns_rr_list_new(), ldns_rr_list_push_rr(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_list_sort(), ldns_rr_owner(), ldns_rr_rdf(), ldns_rr_rrsig_expiration(), ldns_rr_rrsig_inception(), ldns_rr_rrsig_keytag(), ldns_rr_rrsig_typecovered(), ldns_rr_set_owner(), ldns_rr_set_ttl(), ldns_rrsig2buffer_wire(), LDNS_STATUS_CRYPTO_EXPIRATION_BEFORE_INCEPTION, LDNS_STATUS_CRYPTO_NO_MATCHING_KEYTAG_DNSKEY, LDNS_STATUS_CRYPTO_SIG_EXPIRED, LDNS_STATUS_CRYPTO_SIG_NOT_INCEPTED, LDNS_STATUS_CRYPTO_TYPE_COVERED_ERR, LDNS_STATUS_CRYPTO_UNKNOWN_ALGO, LDNS_STATUS_ERR, LDNS_STATUS_MEM_ERR, LDNS_STATUS_OK, ldns_str2rdf_dname(), and ldns_verify_rrsig_buffers().

ldns_status ldns_convert_dsa_rrsig_rdata ( ldns_buffer target_buffer,
ldns_rdf sig_rdf 
)

convert dsa data

Parameters:
[in] target_buffer Buffer to place the result in
[in] sig_rdf the rdata containing the DSA signature
Returns:
LDNS_STATUS_OK on success, error code otherwise

Definition at line 1579 of file dnssec_verify.c.

References ldns_buffer_reserve(), ldns_rdf_data(), and LDNS_STATUS_MEM_ERR.

ldns_status ldns_verify_rrsig ( ldns_rr_list rrset,
ldns_rr rrsig,
ldns_rr key 
)

ldns_status ldns_verify_rrsig_evp ( ldns_buffer sig,
ldns_buffer rrset,
EVP_PKEY *  key,
const EVP_MD *  digest_type 
)

verifies a buffer with signature data for a buffer with rrset data with an EVP_PKEY

Parameters:
[in] sig the signature data
[in] rrset the rrset data, sorted and processed for verification
[in] key the EVP key structure
[in] digest_type The digest type of the signature

Definition at line 1833 of file dnssec_verify.c.

References ldns_verify_rrsig_evp_raw().

ldns_status ldns_verify_rrsig_evp_raw ( unsigned char *  sig,
size_t  siglen,
ldns_buffer rrset,
EVP_PKEY *  key,
const EVP_MD *  digest_type 
)

Like ldns_verify_rrsig_evp, but uses raw signature data.

Parameters:
[in] sig the signature data, wireformat uncompressed
[in] siglen length of the signature data
[in] rrset the rrset data, sorted and processed for verification
[in] key the EVP key structure
[in] digest_type The digest type of the signature

Definition at line 1840 of file dnssec_verify.c.

References LDNS_STATUS_CRYPTO_BOGUS, LDNS_STATUS_OK, and LDNS_STATUS_SSL_ERR.

ldns_status ldns_verify_rrsig_dsa ( ldns_buffer sig,
ldns_buffer rrset,
ldns_buffer key 
)

verifies a buffer with signature data (DSA) for a buffer with rrset data with a buffer with key data.

Parameters:
[in] sig the signature data
[in] rrset the rrset data, sorted and processed for verification
[in] key the key data

Definition at line 1864 of file dnssec_verify.c.

References ldns_verify_rrsig_dsa_raw().

ldns_status ldns_verify_rrsig_rsasha1 ( ldns_buffer sig,
ldns_buffer rrset,
ldns_buffer key 
)

verifies a buffer with signature data (RSASHA1) for a buffer with rrset data with a buffer with key data.

Parameters:
[in] sig the signature data
[in] rrset the rrset data, sorted and processed for verification
[in] key the key data

Definition at line 1872 of file dnssec_verify.c.

References ldns_verify_rrsig_rsasha1_raw().

ldns_status ldns_verify_rrsig_rsamd5 ( ldns_buffer sig,
ldns_buffer rrset,
ldns_buffer key 
)

verifies a buffer with signature data (RSAMD5) for a buffer with rrset data with a buffer with key data.

Parameters:
[in] sig the signature data
[in] rrset the rrset data, sorted and processed for verification
[in] key the key data

Definition at line 1880 of file dnssec_verify.c.

References ldns_verify_rrsig_rsamd5_raw().

ldns_status ldns_verify_rrsig_dsa_raw ( unsigned char *  sig,
size_t  siglen,
ldns_buffer rrset,
unsigned char *  key,
size_t  keylen 
)

Like ldns_verify_rrsig_dsa, but uses raw signature and key data.

Parameters:
[in] sig raw uncompressed wireformat signature data
[in] siglen length of signature data
[in] rrset ldns buffer with prepared rrset data.
[in] key raw uncompressed wireformat key data
[in] keylen length of key data

Definition at line 1888 of file dnssec_verify.c.

References ldns_key_buf2dsa_raw(), and ldns_verify_rrsig_evp_raw().

ldns_status ldns_verify_rrsig_rsasha1_raw ( unsigned char *  sig,
size_t  siglen,
ldns_buffer rrset,
unsigned char *  key,
size_t  keylen 
)

Like ldns_verify_rrsig_rsasha1, but uses raw signature and key data.

Parameters:
[in] sig raw uncompressed wireformat signature data
[in] siglen length of signature data
[in] rrset ldns buffer with prepared rrset data.
[in] key raw uncompressed wireformat key data
[in] keylen length of key data

Definition at line 1903 of file dnssec_verify.c.

References ldns_key_buf2rsa_raw(), and ldns_verify_rrsig_evp_raw().

ldns_status ldns_verify_rrsig_rsasha256_raw ( unsigned char *  sig,
size_t  siglen,
ldns_buffer rrset,
unsigned char *  key,
size_t  keylen 
)

Like ldns_verify_rrsig_rsasha256, but uses raw signature and key data.

Parameters:
[in] sig raw uncompressed wireformat signature data
[in] siglen length of signature data
[in] rrset ldns buffer with prepared rrset data.
[in] key raw uncompressed wireformat key data
[in] keylen length of key data

Definition at line 1918 of file dnssec_verify.c.

References ldns_key_buf2rsa_raw(), LDNS_STATUS_CRYPTO_UNKNOWN_ALGO, and ldns_verify_rrsig_evp_raw().

ldns_status ldns_verify_rrsig_rsasha512_raw ( unsigned char *  sig,
size_t  siglen,
ldns_buffer rrset,
unsigned char *  key,
size_t  keylen 
)

Like ldns_verify_rrsig_rsasha512, but uses raw signature and key data.

Parameters:
[in] sig raw uncompressed wireformat signature data
[in] siglen length of signature data
[in] rrset ldns buffer with prepared rrset data.
[in] key raw uncompressed wireformat key data
[in] keylen length of key data

Definition at line 1937 of file dnssec_verify.c.

References ldns_key_buf2rsa_raw(), LDNS_STATUS_CRYPTO_UNKNOWN_ALGO, and ldns_verify_rrsig_evp_raw().

ldns_status ldns_verify_rrsig_rsamd5_raw ( unsigned char *  sig,
size_t  siglen,
ldns_buffer rrset,
unsigned char *  key,
size_t  keylen 
)

Like ldns_verify_rrsig_rsamd5, but uses raw signature and key data.

Parameters:
[in] sig raw uncompressed wireformat signature data
[in] siglen length of signature data
[in] rrset ldns buffer with prepared rrset data.
[in] key raw uncompressed wireformat key data
[in] keylen length of key data

Definition at line 1958 of file dnssec_verify.c.

References ldns_key_buf2rsa_raw(), and ldns_verify_rrsig_evp_raw().


Generated on Fri Sep 19 13:35:25 2008 for ldns by  doxygen 1.5.5