Functions
ldns_rr *	ldns_dnssec_get_rrsig_for_name_and_type (const ldns_rdf name, const ldns_rr_type type, const ldns_rr_list rrs)
	Returns the first RRSIG rr that corresponds to the rrset with the given name and type. More...

ldns_rr *	ldns_dnssec_get_dnskey_for_rrsig (const ldns_rr rrsig, const ldns_rr_list rrs)
	Returns the DNSKEY that corresponds to the given RRSIG rr from the list, if any. More...

ldns_rdf *	ldns_nsec_get_bitmap (const ldns_rr *nsec)
	Returns the rdata field that contains the bitmap of the covered types of the given NSEC record. More...

ldns_rdf *	ldns_dnssec_nsec3_closest_encloser (const ldns_rdf qname, ldns_rr_type qtype __attribute__((unused)), const ldns_rr_list nsec3s)

bool	ldns_dnssec_pkt_has_rrsigs (const ldns_pkt *pkt)
	Checks whether the packet contains rrsigs. More...

ldns_rr_list *	ldns_dnssec_pkt_get_rrsigs_for_name_and_type (const ldns_pkt pkt, const ldns_rdf name, ldns_rr_type type)
	Returns a ldns_rr_list containing the signatures covering the given name and type. More...

ldns_rr_list *	ldns_dnssec_pkt_get_rrsigs_for_type (const ldns_pkt *pkt, ldns_rr_type type)
	Returns a ldns_rr_list containing the signatures covering the given type. More...

uint16_t	ldns_calc_keytag (const ldns_rr *key)
	calculates a keytag of a key for use in DNSSEC. More...

uint16_t	ldns_calc_keytag_raw (const uint8_t *key, size_t keysize)
	Calculates keytag of DNSSEC key, operates on wireformat rdata. More...

DSA *	ldns_key_buf2dsa (const ldns_buffer *key)
	converts a buffer holding key material to a DSA key in openssl. More...

DSA *	ldns_key_buf2dsa_raw (const unsigned char *key, size_t len)
	Like ldns_key_buf2dsa, but uses raw buffer. More...

RSA *	ldns_key_buf2rsa (const ldns_buffer *key)
	converts a buffer holding key material to a RSA key in openssl. More...

RSA *	ldns_key_buf2rsa_raw (const unsigned char *key, size_t len)
	Like ldns_key_buf2rsa, but uses raw buffer. More...

int	ldns_digest_evp (const unsigned char data, unsigned int len, unsigned char dest, const EVP_MD *md)
	Utility function to calculate hash using generic EVP_MD pointer. More...

ldns_rr *	ldns_key_rr2ds (const ldns_rr *key, ldns_hash h)
	returns a new DS rr that represents the given key rr. More...

ldns_rdf *	ldns_dnssec_create_nsec_bitmap (ldns_rr_type rr_type_list[], size_t size, ldns_rr_type nsec_type)
	Create the type bitmap for an NSEC(3) record. More...

int	ldns_dnssec_rrsets_contains_type (const ldns_dnssec_rrsets *rrsets, ldns_rr_type type)
	returns whether a rrset of the given type is found in the rrsets. More...

ldns_rr *	ldns_dnssec_create_nsec (const ldns_dnssec_name from, const ldns_dnssec_name to, ldns_rr_type nsec_type)
	Creates NSEC. More...

ldns_rr *	ldns_dnssec_create_nsec3 (const ldns_dnssec_name from, const ldns_dnssec_name to, const ldns_rdf zone_name, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t salt)
	Creates NSEC3. More...

ldns_rr *	ldns_create_nsec (ldns_rdf cur_owner, ldns_rdf next_owner, ldns_rr_list *rrs)
	Create a NSEC record. More...

ldns_rdf *	ldns_nsec3_hash_name (const ldns_rdf name, uint8_t algorithm, uint16_t iterations, uint8_t salt_length, const uint8_t salt)
	Calculates the hashed name using the given parameters. More...

void	ldns_nsec3_add_param_rdfs (ldns_rr rr, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t salt)
	Sets all the NSEC3 options. More...

ldns_rr *	ldns_create_nsec3 (const ldns_rdf cur_owner, const ldns_rdf cur_zone, const ldns_rr_list rrs, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, const uint8_t salt, bool emptynonterminal)

uint8_t	ldns_nsec3_algorithm (const ldns_rr *nsec3_rr)
	Returns the hash algorithm used in the given NSEC3 RR. More...

uint8_t	ldns_nsec3_flags (const ldns_rr *nsec3_rr)
	Returns flags field. More...

bool	ldns_nsec3_optout (const ldns_rr *nsec3_rr)
	Returns true if the opt-out flag has been set in the given NSEC3 RR. More...

uint16_t	ldns_nsec3_iterations (const ldns_rr *nsec3_rr)
	Returns the number of hash iterations used in the given NSEC3 RR. More...

ldns_rdf *	ldns_nsec3_salt (const ldns_rr *nsec3_rr)
	Returns the salt used in the given NSEC3 RR. More...

uint8_t	ldns_nsec3_salt_length (const ldns_rr *nsec3_rr)
	Returns the length of the salt used in the given NSEC3 RR. More...

uint8_t *	ldns_nsec3_salt_data (const ldns_rr *nsec3_rr)
	Returns the salt bytes used in the given NSEC3 RR. More...

ldns_rdf *	ldns_nsec3_next_owner (const ldns_rr *nsec3_rr)
	Returns the first label of the next ownername in the NSEC3 chain (ie. More...

ldns_rdf *	ldns_nsec3_bitmap (const ldns_rr *nsec3_rr)
	Returns the bitmap specifying the covered types of the given NSEC3 RR. More...

ldns_rdf *	ldns_nsec3_hash_name_frm_nsec3 (const ldns_rr nsec, const ldns_rdf name)
	Calculates the hashed name using the parameters of the given NSEC3 RR. More...

bool	ldns_nsec_bitmap_covers_type (const ldns_rdf *bitmap, ldns_rr_type type)
	Check if RR type t is enumerated and set in the RR type bitmap rdf. More...

ldns_status	ldns_nsec_bitmap_set_type (ldns_rdf *bitmap, ldns_rr_type type)
	Checks if RR type t is enumerated in the type bitmap rdf and sets the bit. More...

ldns_status	ldns_nsec_bitmap_clear_type (ldns_rdf *bitmap, ldns_rr_type type)
	Checks if RR type t is enumerated in the type bitmap rdf and clears the bit. More...

bool	ldns_nsec_covers_name (const ldns_rr nsec, const ldns_rdf name)
	Checks coverage of NSEC(3) RR name span Remember that nsec and name must both be in canonical form (ie use ldns_rr2canonical and ldns_dname2canonical prior to calling this function) More...

ldns_status	ldns_pkt_verify_time (const ldns_pkt p, ldns_rr_type t, const ldns_rdf o, const ldns_rr_list k, const ldns_rr_list s, time_t check_time, ldns_rr_list *good_keys)
	verify a packet More...

ldns_status	ldns_pkt_verify (const ldns_pkt p, ldns_rr_type t, const ldns_rdf o, const ldns_rr_list k, const ldns_rr_list s, ldns_rr_list *good_keys)
	verify a packet More...

ldns_status	ldns_dnssec_chain_nsec3_list (ldns_rr_list *nsec3_rrs)
	chains nsec3 list More...

int	qsort_rr_compare_nsec3 (const void a, const void b)
	compare for nsec3 sort More...

void	ldns_rr_list_sort_nsec3 (ldns_rr_list *unsorted)
	sort nsec3 list More...

int	ldns_dnssec_default_add_to_signatures (ldns_rr sig __attribute__((unused)), void n __attribute__((unused)))

int	ldns_dnssec_default_leave_signatures (ldns_rr sig __attribute__((unused)), void n __attribute__((unused)))

int	ldns_dnssec_default_delete_signatures (ldns_rr sig __attribute__((unused)), void n __attribute__((unused)))

int	ldns_dnssec_default_replace_signatures (ldns_rr sig __attribute__((unused)), void n __attribute__((unused)))

ldns_rdf *	ldns_convert_dsa_rrsig_asn12rdf (const ldns_buffer *sig, const long sig_len)
	Converts the DSA signature from ASN1 representation (RFC2459, as used by OpenSSL) to raw signature data as used in DNS (rfc2536) More...

ldns_status	ldns_convert_dsa_rrsig_rdf2asn1 (ldns_buffer target_buffer, const ldns_rdf sig_rdf)
	Converts the RRSIG signature RDF (in rfc2536 format) to a buffer with the signature in rfc2459 format. More...

ldns_rdf *	ldns_convert_ecdsa_rrsig_asn1len2rdf (const ldns_buffer *sig, const long sig_len, int num_bytes)
	Converts the ECDSA signature from ASN1 representation (as used by OpenSSL) to raw signature data as used in DNS This routine is only present if ldns is compiled with ecdsa support. More...

ldns_status	ldns_convert_ecdsa_rrsig_rdf2asn1 (ldns_buffer target_buffer, const ldns_rdf sig_rdf)
	Converts the RRSIG signature RDF (from DNS) to a buffer with the signature in ASN1 format as openssl uses it. More...

Function Documentation

◆ ldns_dnssec_get_rrsig_for_name_and_type()

ldns_rr* ldns_dnssec_get_rrsig_for_name_and_type	(	const ldns_rdf *	name,
		const ldns_rr_type	type,
		const ldns_rr_list *	rrs
	)

Returns the first RRSIG rr that corresponds to the rrset with the given name and type.

Parameters

[in]	name	The dname of the RRset covered by the RRSIG to find
[in]	type	The type of the RRset covered by the RRSIG to find
[in]	rrs	List of rrs to search in

Returns: Pointer to the first RRsig ldns_rr found, or NULL if it is not present

Definition at line 34 of file dnssec.c.

References ldns_dname_compare(), ldns_rdf2rr_type(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_owner(), ldns_rr_rrsig_typecovered(), and LDNS_RR_TYPE_RRSIG.

◆ ldns_dnssec_get_dnskey_for_rrsig()

ldns_rr* ldns_dnssec_get_dnskey_for_rrsig	(	const ldns_rr *	rrsig,
		const ldns_rr_list *	rrs
	)

Returns the DNSKEY that corresponds to the given RRSIG rr from the list, if any.

Parameters

[in]	rrsig	The rrsig to find the DNSKEY for
[in]	rrs	The rr list to find the key in

Returns: The DNSKEY that corresponds to the given RRSIG, or NULL if it was not found.

Definition at line 62 of file dnssec.c.

References ldns_calc_keytag(), ldns_dname_compare(), ldns_rdf2native_int16(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_owner(), ldns_rr_rrsig_keytag(), ldns_rr_rrsig_signame(), and LDNS_RR_TYPE_DNSKEY.

◆ ldns_nsec_get_bitmap()

ldns_rdf* ldns_nsec_get_bitmap ( const ldns_rr * nsec )

Returns the rdata field that contains the bitmap of the covered types of the given NSEC record.

Parameters

[in] nsec The nsec to get the covered type bitmap of

Returns: An ldns_rdf containing the bitmap, or NULL on error

Definition at line 89 of file dnssec.c.

References ldns_rr_get_type(), ldns_rr_rdf(), LDNS_RR_TYPE_NSEC, and LDNS_RR_TYPE_NSEC3.

◆ ldns_dnssec_nsec3_closest_encloser()

ldns_rdf* ldns_dnssec_nsec3_closest_encloser	(	const ldns_rdf *	qname,
		ldns_rr_type qtype	__attribute__(unused),
		const ldns_rr_list *	nsec3s
	)

Definition at line 102 of file dnssec.c.

References ldns_dname_cat(), ldns_dname_compare(), ldns_dname_label_count(), ldns_dname_left_chop(), LDNS_FREE, ldns_nsec3_algorithm(), ldns_nsec3_hash_name(), ldns_nsec3_iterations(), ldns_nsec3_salt_data(), ldns_nsec3_salt_length(), ldns_nsec_covers_name(), ldns_rdf_clone(), ldns_rdf_deep_free(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_owner(), and LDNS_STATUS_OK.

◆ ldns_dnssec_pkt_has_rrsigs()

bool ldns_dnssec_pkt_has_rrsigs ( const ldns_pkt * pkt )

Checks whether the packet contains rrsigs.

Definition at line 204 of file dnssec.c.

References ldns_pkt_ancount(), ldns_pkt_answer(), ldns_pkt_authority(), ldns_pkt_nscount(), ldns_rr_get_type(), ldns_rr_list_rr(), and LDNS_RR_TYPE_RRSIG.

◆ ldns_dnssec_pkt_get_rrsigs_for_name_and_type()

ldns_rr_list* ldns_dnssec_pkt_get_rrsigs_for_name_and_type	(	const ldns_pkt *	pkt,
		const ldns_rdf *	name,
		ldns_rr_type	type
	)

Returns a ldns_rr_list containing the signatures covering the given name and type.

Definition at line 223 of file dnssec.c.

References ldns_pkt_rr_list_by_name_and_type(), ldns_rdf_free(), ldns_rdf_new(), LDNS_RDF_SIZE_WORD, LDNS_RDF_TYPE_TYPE, ldns_rr_list_deep_free(), ldns_rr_list_subtype_by_rdf(), LDNS_RR_TYPE_RRSIG, and LDNS_SECTION_ANY_NOQUESTION.

◆ ldns_dnssec_pkt_get_rrsigs_for_type()

ldns_rr_list* ldns_dnssec_pkt_get_rrsigs_for_type	(	const ldns_pkt *	pkt,
		ldns_rr_type	type
	)

Returns a ldns_rr_list containing the signatures covering the given type.

Definition at line 250 of file dnssec.c.

References ldns_pkt_rr_list_by_type(), ldns_rdf_free(), ldns_rdf_new(), LDNS_RDF_TYPE_TYPE, ldns_rr_list_deep_free(), ldns_rr_list_subtype_by_rdf(), LDNS_RR_TYPE_RRSIG, and LDNS_SECTION_ANY_NOQUESTION.

◆ ldns_calc_keytag()

uint16_t ldns_calc_keytag ( const ldns_rr * key )

calculates a keytag of a key for use in DNSSEC.

Parameters

[in] key the key as an RR to use for the calc.

Returns: the keytag

Definition at line 277 of file dnssec.c.

References ldns_buffer_new(), LDNS_MIN_BUFLEN, ldns_rr_get_type(), ldns_rr_rdata2buffer_wire(), LDNS_RR_TYPE_DNSKEY, and LDNS_RR_TYPE_KEY.

◆ ldns_calc_keytag_raw()

uint16_t ldns_calc_keytag_raw	(	const uint8_t *	key,
		size_t	keysize
	)

Calculates keytag of DNSSEC key, operates on wireformat rdata.

Parameters

[in]	key	the key as uncompressed wireformat rdata.
[in]	keysize	length of key data.

Returns: the keytag

Definition at line 307 of file dnssec.c.

References LDNS_RSAMD5.

◆ ldns_key_buf2dsa()

DSA* ldns_key_buf2dsa ( const ldns_buffer * key )

converts a buffer holding key material to a DSA key in openssl.

Parameters

[in] key the key to convert

Returns: a DSA * structure with the key material

Definition at line 337 of file dnssec.c.

References ldns_key_buf2dsa_raw().

◆ ldns_key_buf2dsa_raw()

DSA* ldns_key_buf2dsa_raw	(	const unsigned char *	key,
		size_t	len
	)

Like ldns_key_buf2dsa, but uses raw buffer.

Parameters

[in]	key	the uncompressed wireformat of the key.
[in]	len	length of key data

Returns: a DSA * structure with the key material

Definition at line 344 of file dnssec.c.

◆ ldns_key_buf2rsa()

RSA* ldns_key_buf2rsa ( const ldns_buffer * key )

converts a buffer holding key material to a RSA key in openssl.

Parameters

[in] key the key to convert

Returns: a RSA * structure with the key material

Definition at line 414 of file dnssec.c.

References ldns_key_buf2rsa_raw().

◆ ldns_key_buf2rsa_raw()

RSA* ldns_key_buf2rsa_raw	(	const unsigned char *	key,
		size_t	len
	)

Like ldns_key_buf2rsa, but uses raw buffer.

Parameters

[in]	key	the uncompressed wireformat of the key.
[in]	len	length of key data

Returns: a RSA * structure with the key material

Definition at line 421 of file dnssec.c.

◆ ldns_digest_evp()

int ldns_digest_evp	(	const unsigned char *	data,
		unsigned int	len,
		unsigned char *	dest,
		const EVP_MD *	md
	)

Utility function to calculate hash using generic EVP_MD pointer.

Parameters

[in]	data	the data to hash.
[in]	len	length of data.
[out]	dest	the destination of the hash, must be large enough.
[in]	md	the message digest to use.

Returns: true if worked, false on failure.

Definition at line 489 of file dnssec.c.

◆ ldns_key_rr2ds()

ldns_rr* ldns_key_rr2ds	(	const ldns_rr *	key,
		ldns_hash	h
	)

returns a new DS rr that represents the given key rr.

Parameters

[in]	*key	the key to convert
[in]	h	the hash to use LDNS_SHA1/LDNS_SHA256

Returns: ldns_rr* a new rr pointer to a DS

Definition at line 508 of file dnssec.c.

References ldns_buffer_free(), ldns_buffer_new(), ldns_calc_keytag(), ldns_dname2canonical(), LDNS_FREE, LDNS_HASH_GOST, ldns_key_EVP_load_gost_id(), LDNS_MAX_PACKETLEN, ldns_rdf2buffer_wire(), ldns_rdf_clone(), ldns_rdf_deep_free(), ldns_rdf_new_frm_data(), LDNS_RDF_TYPE_INT16, LDNS_RDF_TYPE_INT8, ldns_rr_free(), ldns_rr_get_class(), ldns_rr_get_type(), ldns_rr_new(), ldns_rr_owner(), ldns_rr_push_rdf(), ldns_rr_rdata2buffer_wire(), ldns_rr_rdf(), ldns_rr_set_class(), ldns_rr_set_owner(), ldns_rr_set_ttl(), ldns_rr_set_type(), ldns_rr_ttl(), LDNS_RR_TYPE_DNSKEY, LDNS_RR_TYPE_DS, LDNS_SHA1, ldns_sha1(), LDNS_SHA1_DIGEST_LENGTH, LDNS_SHA256, LDNS_SHA256_DIGEST_LENGTH, LDNS_SHA384, LDNS_STATUS_OK, and LDNS_XMALLOC.

◆ ldns_dnssec_create_nsec_bitmap()

ldns_rdf* ldns_dnssec_create_nsec_bitmap	(	ldns_rr_type	rr_type_list[],
		size_t	size,
		ldns_rr_type	nsec_type
	)

Create the type bitmap for an NSEC(3) record.

Definition at line 719 of file dnssec.c.

References LDNS_CALLOC, LDNS_FREE, ldns_rdf_new(), LDNS_RDF_TYPE_BITMAP, LDNS_RR_TYPE_NSEC, and LDNS_RR_TYPE_NSEC3.

◆ ldns_dnssec_rrsets_contains_type()

int ldns_dnssec_rrsets_contains_type	(	const ldns_dnssec_rrsets *	rrsets,
		ldns_rr_type	type
	)

returns whether a rrset of the given type is found in the rrsets.

Parameters

[in]	rrsets	the rrsets to be tested
[in]	type	the type to test for

Returns: int 1 if the type was found, 0 otherwise.

Definition at line 801 of file dnssec.c.

References ldns_struct_dnssec_rrsets::next, and ldns_struct_dnssec_rrsets::type.

◆ ldns_dnssec_create_nsec()

ldns_rr* ldns_dnssec_create_nsec	(	const ldns_dnssec_name *	from,
		const ldns_dnssec_name *	to,
		ldns_rr_type	nsec_type
	)

Creates NSEC.

Definition at line 815 of file dnssec.c.

References ldns_dnssec_create_nsec_bitmap(), ldns_dnssec_name_name(), ldns_dnssec_rrsets_contains_type(), ldns_rdf_clone(), ldns_rr_new(), ldns_rr_push_rdf(), ldns_rr_set_owner(), ldns_rr_set_type(), LDNS_RR_TYPE_DS, LDNS_RR_TYPE_NS, LDNS_RR_TYPE_NSEC, LDNS_RR_TYPE_RRSIG, LDNS_RR_TYPE_SOA, ldns_struct_dnssec_rrsets::next, ldns_struct_dnssec_name::rrsets, and ldns_struct_dnssec_rrsets::type.

◆ ldns_dnssec_create_nsec3()

ldns_rr* ldns_dnssec_create_nsec3	(	const ldns_dnssec_name *	from,
		const ldns_dnssec_name *	to,
		const ldns_rdf *	zone_name,
		uint8_t	algorithm,
		uint8_t	flags,
		uint16_t	iterations,
		uint8_t	salt_length,
		const uint8_t *	salt
	)

◆ ldns_create_nsec()

ldns_rr* ldns_create_nsec	(	ldns_rdf *	cur_owner,
		ldns_rdf *	next_owner,
		ldns_rr_list *	rrs
	)

Create a NSEC record.

Parameters

[in]	cur_owner	the current owner which should be taken as the starting point
[in]	next_owner	the rrlist which the nsec rr should point to
[in]	rrs	all rrs from the zone, to find all RR types of cur_owner in

Returns: a ldns_rr with the nsec record in it

Definition at line 958 of file dnssec.c.

References ldns_dnssec_create_nsec_bitmap(), ldns_rdf_clone(), ldns_rdf_compare(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_new(), ldns_rr_owner(), ldns_rr_push_rdf(), ldns_rr_set_owner(), ldns_rr_set_type(), LDNS_RR_TYPE_NSEC, and LDNS_RR_TYPE_RRSIG.

◆ ldns_nsec3_hash_name()

ldns_rdf* ldns_nsec3_hash_name	(	const ldns_rdf *	name,
		uint8_t	algorithm,
		uint16_t	iterations,
		uint8_t	salt_length,
		const uint8_t *	salt
	)

Calculates the hashed name using the given parameters.

Parameters

[in]	*name	The owner name to calculate the hash for
[in]	algorithm	The hash algorithm to use
[in]	iterations	The number of hash iterations to use
[in]	salt_length	The length of the salt in bytes
[in]	salt	The salt to use

Returns: The hashed owner name rdf, without the domain name

Definition at line 1008 of file dnssec.c.

References ldns_dname2canonical(), LDNS_FREE, ldns_rdf_clone(), ldns_rdf_data(), ldns_rdf_deep_free(), ldns_rdf_size(), LDNS_SHA1, ldns_sha1(), LDNS_SHA1_DIGEST_LENGTH, and LDNS_XMALLOC.

◆ ldns_nsec3_add_param_rdfs()

void ldns_nsec3_add_param_rdfs	(	ldns_rr *	rr,
		uint8_t	algorithm,
		uint8_t	flags,
		uint16_t	iterations,
		uint8_t	salt_length,
		const uint8_t *	salt
	)

Sets all the NSEC3 options.

The rr to set them in must be initialized with _new() and type LDNS_RR_TYPE_NSEC3

Parameters

[in]	*rr	The RR to set the values in
[in]	algorithm	The NSEC3 hash algorithm
[in]	flags	The flags field
[in]	iterations	The number of hash iterations
[in]	salt_length	The length of the salt in bytes
[in]	salt	The salt bytes

Definition at line 1107 of file dnssec.c.

References LDNS_FREE, ldns_native2rdf_int16(), ldns_rdf_deep_free(), ldns_rdf_new_frm_data(), LDNS_RDF_TYPE_INT16, LDNS_RDF_TYPE_INT8, LDNS_RDF_TYPE_NSEC3_SALT, ldns_rr_set_rdf(), and LDNS_XMALLOC.

◆ ldns_create_nsec3()

ldns_rr* ldns_create_nsec3	(	const ldns_rdf *	cur_owner,
		const ldns_rdf *	cur_zone,
		const ldns_rr_list *	rrs,
		uint8_t	algorithm,
		uint8_t	flags,
		uint16_t	iterations,
		uint8_t	salt_length,
		const uint8_t *	salt,
		bool	emptynonterminal
	)

Definition at line 1178 of file dnssec.c.

References ldns_dname_cat(), ldns_nsec3_add_param_rdfs(), ldns_nsec3_hash_name(), ldns_rdf_compare(), ldns_rdf_deep_free(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_new_frm_type(), ldns_rr_owner(), ldns_rr_set_owner(), ldns_rr_set_rdf(), ldns_rr_set_type(), LDNS_RR_TYPE_NSEC3, and LDNS_STATUS_OK.

◆ ldns_nsec3_algorithm()

uint8_t ldns_nsec3_algorithm ( const ldns_rr * nsec3_rr )

Returns the hash algorithm used in the given NSEC3 RR.

Parameters

[in] *nsec3_rr The RR to read from

Returns: The algorithm identifier, or 0 on error

Definition at line 1260 of file dnssec.c.

References ldns_rdf2native_int8(), ldns_rdf_size(), ldns_rr_get_type(), ldns_rr_rdf(), LDNS_RR_TYPE_NSEC3, and LDNS_RR_TYPE_NSEC3PARAM.

◆ ldns_nsec3_flags()

uint8_t ldns_nsec3_flags ( const ldns_rr * nsec3_rr )

Returns flags field.

Definition at line 1273 of file dnssec.c.

References ldns_rdf2native_int8(), ldns_rdf_size(), ldns_rr_get_type(), ldns_rr_rdf(), LDNS_RR_TYPE_NSEC3, and LDNS_RR_TYPE_NSEC3PARAM.

◆ ldns_nsec3_optout()

bool ldns_nsec3_optout ( const ldns_rr * nsec3_rr )

Returns true if the opt-out flag has been set in the given NSEC3 RR.

Parameters

[in] *nsec3_rr The RR to read from

Returns: true if the RR has type NSEC3 and the opt-out bit has been set, false otherwise

Definition at line 1286 of file dnssec.c.

References ldns_nsec3_flags(), and LDNS_NSEC3_VARS_OPTOUT_MASK.

◆ ldns_nsec3_iterations()

uint16_t ldns_nsec3_iterations ( const ldns_rr * nsec3_rr )

Returns the number of hash iterations used in the given NSEC3 RR.

Parameters

[in] *nsec3_rr The RR to read from

Returns: The number of iterations

Definition at line 1292 of file dnssec.c.

References ldns_rdf2native_int16(), ldns_rdf_size(), ldns_rr_get_type(), ldns_rr_rdf(), LDNS_RR_TYPE_NSEC3, and LDNS_RR_TYPE_NSEC3PARAM.

◆ ldns_nsec3_salt()

ldns_rdf* ldns_nsec3_salt ( const ldns_rr * nsec3_rr )

Returns the salt used in the given NSEC3 RR.

Parameters

[in] *nsec3_rr The RR to read from

Returns: The salt rdf, or NULL on error

Definition at line 1306 of file dnssec.c.

References ldns_rr_get_type(), ldns_rr_rdf(), LDNS_RR_TYPE_NSEC3, and LDNS_RR_TYPE_NSEC3PARAM.

◆ ldns_nsec3_salt_length()

uint8_t ldns_nsec3_salt_length ( const ldns_rr * nsec3_rr )

Returns the length of the salt used in the given NSEC3 RR.

Parameters

[in] *nsec3_rr The RR to read from

Returns: The length of the salt in bytes

Definition at line 1318 of file dnssec.c.

References ldns_nsec3_salt(), ldns_rdf_data(), and ldns_rdf_size().

◆ ldns_nsec3_salt_data()

uint8_t* ldns_nsec3_salt_data ( const ldns_rr * nsec3_rr )

Returns the salt bytes used in the given NSEC3 RR.

Parameters

[in] *nsec3_rr The RR to read from

Returns: The salt in bytes, this is alloc'ed, so you need to free it

Definition at line 1329 of file dnssec.c.

References ldns_nsec3_salt(), ldns_rdf_data(), ldns_rdf_size(), and LDNS_XMALLOC.

◆ ldns_nsec3_next_owner()

ldns_rdf* ldns_nsec3_next_owner ( const ldns_rr * nsec3_rr )

Returns the first label of the next ownername in the NSEC3 chain (ie.

without the domain)

Parameters

[in] nsec3_rr The RR to read from

Returns: The first label of the next owner name in the NSEC3 chain, or NULL on error

Definition at line 1348 of file dnssec.c.

References ldns_rr_get_type(), ldns_rr_rdf(), and LDNS_RR_TYPE_NSEC3.

◆ ldns_nsec3_bitmap()

ldns_rdf* ldns_nsec3_bitmap ( const ldns_rr * nsec3_rr )

Returns the bitmap specifying the covered types of the given NSEC3 RR.

Parameters

[in] *nsec3_rr The RR to read from

Returns: The covered type bitmap rdf

Definition at line 1358 of file dnssec.c.

References ldns_rr_get_type(), ldns_rr_rdf(), and LDNS_RR_TYPE_NSEC3.

◆ ldns_nsec3_hash_name_frm_nsec3()

ldns_rdf* ldns_nsec3_hash_name_frm_nsec3	(	const ldns_rr *	nsec,
		const ldns_rdf *	name
	)

Calculates the hashed name using the parameters of the given NSEC3 RR.

Parameters

[in]	*nsec	The RR to use the parameters from
[in]	*name	The owner name to calculate the hash for

Returns: The hashed owner name rdf, without the domain name

Definition at line 1368 of file dnssec.c.

References LDNS_FREE, ldns_nsec3_algorithm(), ldns_nsec3_hash_name(), ldns_nsec3_iterations(), ldns_nsec3_salt_data(), and ldns_nsec3_salt_length().

◆ ldns_nsec_bitmap_covers_type()

bool ldns_nsec_bitmap_covers_type	(	const ldns_rdf *	bitmap,
		ldns_rr_type	type
	)

Check if RR type t is enumerated and set in the RR type bitmap rdf.

Parameters

[in]	bitmap	the RR type bitmap rdf to look in
[in]	type	the type to check for

Returns: true when t is found and set, otherwise return false

Definition at line 1393 of file dnssec.c.

References ldns_rdf_data(), ldns_rdf_get_type(), ldns_rdf_size(), and LDNS_RDF_TYPE_BITMAP.

◆ ldns_nsec_bitmap_set_type()

ldns_status ldns_nsec_bitmap_set_type	(	ldns_rdf *	bitmap,
		ldns_rr_type	type
	)

Checks if RR type t is enumerated in the type bitmap rdf and sets the bit.

Parameters

[in]	bitmap	the RR type bitmap rdf to look in
[in]	type	the type to for which the bit to set

Returns: LDNS_STATUS_OK on success. LDNS_STATUS_TYPE_NOT_IN_BITMAP is returned when the bitmap does not contain the bit to set.

Definition at line 1430 of file dnssec.c.

References ldns_rdf_data(), ldns_rdf_get_type(), ldns_rdf_size(), LDNS_RDF_TYPE_BITMAP, LDNS_STATUS_OK, and LDNS_STATUS_TYPE_NOT_IN_BITMAP.

◆ ldns_nsec_bitmap_clear_type()

ldns_status ldns_nsec_bitmap_clear_type	(	ldns_rdf *	bitmap,
		ldns_rr_type	type
	)

Checks if RR type t is enumerated in the type bitmap rdf and clears the bit.

Parameters

[in]	bitmap	the RR type bitmap rdf to look in
[in]	type	the type to for which the bit to clear

Returns: LDNS_STATUS_OK on success. LDNS_STATUS_TYPE_NOT_IN_BITMAP is returned when the bitmap does not contain the bit to clear.

Definition at line 1468 of file dnssec.c.

References ldns_rdf_data(), ldns_rdf_get_type(), ldns_rdf_size(), LDNS_RDF_TYPE_BITMAP, LDNS_STATUS_OK, and LDNS_STATUS_TYPE_NOT_IN_BITMAP.

◆ ldns_nsec_covers_name()

bool ldns_nsec_covers_name	(	const ldns_rr *	nsec,
		const ldns_rdf *	name
	)

Checks coverage of NSEC(3) RR name span Remember that nsec and name must both be in canonical form (ie use ldns_rr2canonical and ldns_dname2canonical prior to calling this function)

Parameters

[in]	nsec	The NSEC RR to check
[in]	name	The owner dname to check, if the nsec record is a NSEC3 record, this should be the hashed name

Returns: true if the NSEC RR covers the owner name

Definition at line 1508 of file dnssec.c.

References ldns_dname_cat(), ldns_dname_compare(), ldns_dname_left_chop(), ldns_dname_new_frm_str(), LDNS_FREE, ldns_get_errorstr_by_id(), ldns_nsec3_next_owner(), ldns_rdf2str(), ldns_rdf_clone(), ldns_rdf_deep_free(), ldns_rr_get_type(), ldns_rr_owner(), ldns_rr_rdf(), LDNS_RR_TYPE_NSEC, LDNS_RR_TYPE_NSEC3, and LDNS_STATUS_OK.

◆ ldns_pkt_verify_time()

ldns_status ldns_pkt_verify_time	(	const ldns_pkt *	p,
		ldns_rr_type	t,
		const ldns_rdf *	o,
		const ldns_rr_list *	k,
		const ldns_rr_list *	s,
		time_t	check_time,
		ldns_rr_list *	good_keys
	)

verify a packet

Parameters

[in]	p	the packet
[in]	t	the rr set type to check
[in]	o	the rr set name to check
[in]	k	list of keys
[in]	s	list of sigs (may be null)
[in]	check_time	the time for which the validation is performed
[out]	good_keys	keys which validated the packet

Returns: status

Definition at line 1559 of file dnssec.c.

References ldns_pkt_rr_list_by_name_and_type(), ldns_rdf_free(), ldns_rdf_new(), LDNS_RDF_TYPE_TYPE, ldns_rr_list_deep_free(), ldns_rr_list_subtype_by_rdf(), LDNS_RR_TYPE_RRSIG, LDNS_SECTION_ANY_NOQUESTION, LDNS_STATUS_ERR, and ldns_verify_time().

◆ ldns_pkt_verify()

ldns_status ldns_pkt_verify	(	const ldns_pkt *	p,
		ldns_rr_type	t,
		const ldns_rdf *	o,
		const ldns_rr_list *	k,
		const ldns_rr_list *	s,
		ldns_rr_list *	good_keys
	)

verify a packet

Parameters

[in]	p	the packet
[in]	t	the rr set type to check
[in]	o	the rr set name to check
[in]	k	list of keys
[in]	s	list of sigs (may be null)
[out]	good_keys	keys which validated the packet

Returns: status

Definition at line 1626 of file dnssec.c.

References ldns_pkt_verify_time().

◆ ldns_dnssec_chain_nsec3_list()

ldns_status ldns_dnssec_chain_nsec3_list ( ldns_rr_list * nsec3_rrs )

chains nsec3 list

Definition at line 1634 of file dnssec.c.

References ldns_dname_label(), LDNS_FREE, ldns_rdf2str(), ldns_rdf_deep_free(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_owner(), ldns_rr_set_rdf(), LDNS_STATUS_OK, and ldns_str2rdf_b32_ext().

◆ qsort_rr_compare_nsec3()

int qsort_rr_compare_nsec3	(	const void *	a,
		const void *	b
	)

compare for nsec3 sort

Definition at line 1687 of file dnssec.c.

References ldns_rdf_compare(), and ldns_rr_owner().

◆ ldns_rr_list_sort_nsec3()

void ldns_rr_list_sort_nsec3 ( ldns_rr_list * unsorted )

sort nsec3 list

Definition at line 1704 of file dnssec.c.

References ldns_struct_rr_list::_rrs, ldns_rr_list_rr_count(), and qsort_rr_compare_nsec3().

◆ ldns_dnssec_default_add_to_signatures()

int ldns_dnssec_default_add_to_signatures	(	ldns_rr *sig	__attribute__(unused),
		void *n	__attribute__(unused)
	)

Definition at line 1713 of file dnssec.c.

References LDNS_SIGNATURE_LEAVE_ADD_NEW.

◆ ldns_dnssec_default_leave_signatures()

int ldns_dnssec_default_leave_signatures	(	ldns_rr *sig	__attribute__(unused),
		void *n	__attribute__(unused)
	)

Definition at line 1721 of file dnssec.c.

References LDNS_SIGNATURE_LEAVE_NO_ADD.

◆ ldns_dnssec_default_delete_signatures()

int ldns_dnssec_default_delete_signatures	(	ldns_rr *sig	__attribute__(unused),
		void *n	__attribute__(unused)
	)

Definition at line 1729 of file dnssec.c.

References LDNS_SIGNATURE_REMOVE_NO_ADD.

◆ ldns_dnssec_default_replace_signatures()

int ldns_dnssec_default_replace_signatures	(	ldns_rr *sig	__attribute__(unused),
		void *n	__attribute__(unused)
	)

Definition at line 1737 of file dnssec.c.

References LDNS_SIGNATURE_REMOVE_ADD_NEW.

◆ ldns_convert_dsa_rrsig_asn12rdf()

ldns_rdf* ldns_convert_dsa_rrsig_asn12rdf	(	const ldns_buffer *	sig,
		const long	sig_len
	)

Converts the DSA signature from ASN1 representation (RFC2459, as used by OpenSSL) to raw signature data as used in DNS (rfc2536)

Parameters

[in]	sig	The signature in RFC2459 format
[in]	sig_len	The length of the signature

Returns: a new rdf with the signature

Definition at line 1746 of file dnssec.c.

References R.

◆ ldns_convert_dsa_rrsig_rdf2asn1()

ldns_status ldns_convert_dsa_rrsig_rdf2asn1	(	ldns_buffer *	target_buffer,
		const ldns_rdf *	sig_rdf
	)

Converts the RRSIG signature RDF (in rfc2536 format) to a buffer with the signature in rfc2459 format.

Parameters

[out]	target_buffer	buffer to place the signature data
[in]	sig_rdf	The signature rdf to convert

Returns: LDNS_STATUS_OK on success, error code otherwise

Definition at line 1807 of file dnssec.c.

References ldns_buffer_reserve(), ldns_rdf_data(), ldns_rdf_size(), LDNS_STATUS_MEM_ERR, LDNS_STATUS_SSL_ERR, LDNS_STATUS_SYNTAX_RDATA_ERR, and R.

◆ ldns_convert_ecdsa_rrsig_asn1len2rdf()

ldns_rdf* ldns_convert_ecdsa_rrsig_asn1len2rdf	(	const ldns_buffer *	sig,
		const long	sig_len,
		int	num_bytes
	)

Converts the ECDSA signature from ASN1 representation (as used by OpenSSL) to raw signature data as used in DNS This routine is only present if ldns is compiled with ecdsa support.

The older ldns_convert_ecdsa_rrsig_asn12rdf routine could not (always) construct a valid rdf because it did not have the num_bytes parameter. The num_bytes parameter is 32 for p256 and 48 for p384 (bits/8).

Parameters

[in]	sig	The signature in ASN1 format
[in]	sig_len	The length of the signature
[in]	num_bytes	number of bytes for values in the curve, the curve size divided by 8.

Returns: a new rdf with the signature

Definition at line 1869 of file dnssec.c.

◆ ldns_convert_ecdsa_rrsig_rdf2asn1()

ldns_status ldns_convert_ecdsa_rrsig_rdf2asn1	(	ldns_buffer *	target_buffer,
		const ldns_rdf *	sig_rdf
	)

Converts the RRSIG signature RDF (from DNS) to a buffer with the signature in ASN1 format as openssl uses it.

This routine is only present if ldns is compiled with ecdsa support.

Parameters

[out]	target_buffer	buffer to place the signature data in ASN1.
[in]	sig_rdf	The signature rdf to convert

Returns: LDNS_STATUS_OK on success, error code otherwise

Definition at line 1907 of file dnssec.c.

References ldns_buffer_reserve(), ldns_rdf_data(), ldns_rdf_size(), and LDNS_STATUS_ERR.

Functions

Function Documentation

◆ ldns_dnssec_get_rrsig_for_name_and_type()

◆ ldns_dnssec_get_dnskey_for_rrsig()

◆ ldns_nsec_get_bitmap()

◆ ldns_dnssec_nsec3_closest_encloser()

◆ ldns_dnssec_pkt_has_rrsigs()

◆ ldns_dnssec_pkt_get_rrsigs_for_name_and_type()

◆ ldns_dnssec_pkt_get_rrsigs_for_type()

◆ ldns_calc_keytag()

◆ ldns_calc_keytag_raw()

◆ ldns_key_buf2dsa()

◆ ldns_key_buf2dsa_raw()

◆ ldns_key_buf2rsa()

◆ ldns_key_buf2rsa_raw()

◆ ldns_digest_evp()

◆ ldns_key_rr2ds()

◆ ldns_dnssec_create_nsec_bitmap()

◆ ldns_dnssec_rrsets_contains_type()

◆ ldns_dnssec_create_nsec()

◆ ldns_dnssec_create_nsec3()

◆ ldns_create_nsec()

◆ ldns_nsec3_hash_name()

◆ ldns_nsec3_add_param_rdfs()

◆ ldns_create_nsec3()

◆ ldns_nsec3_algorithm()

◆ ldns_nsec3_flags()

◆ ldns_nsec3_optout()

◆ ldns_nsec3_iterations()

◆ ldns_nsec3_salt()

◆ ldns_nsec3_salt_length()

◆ ldns_nsec3_salt_data()

◆ ldns_nsec3_next_owner()

◆ ldns_nsec3_bitmap()

◆ ldns_nsec3_hash_name_frm_nsec3()

◆ ldns_nsec_bitmap_covers_type()

◆ ldns_nsec_bitmap_set_type()

◆ ldns_nsec_bitmap_clear_type()

◆ ldns_nsec_covers_name()

◆ ldns_pkt_verify_time()

◆ ldns_pkt_verify()

◆ ldns_dnssec_chain_nsec3_list()

◆ qsort_rr_compare_nsec3()

◆ ldns_rr_list_sort_nsec3()

◆ ldns_dnssec_default_add_to_signatures()

◆ ldns_dnssec_default_leave_signatures()

◆ ldns_dnssec_default_delete_signatures()

◆ ldns_dnssec_default_replace_signatures()

◆ ldns_convert_dsa_rrsig_asn12rdf()

◆ ldns_convert_dsa_rrsig_rdf2asn1()

◆ ldns_convert_ecdsa_rrsig_asn1len2rdf()

◆ ldns_convert_ecdsa_rrsig_rdf2asn1()