1 #include <ldns/config.h>
5 #include <ldns/dnssec.h>
6 #include <ldns/dnssec_sign.h>
12 /* this entire file is rather useless when you don't have
15 #include <openssl/ssl.h>
16 #include <openssl/evp.h>
17 #include <openssl/rand.h>
18 #include <openssl/err.h>
19 #include <openssl/md5.h>
23 ldns_create_empty_rrsig(ldns_rr_list *rrset,
24 ldns_key *current_key)
27 ldns_rr_class orig_class;
32 label_count = ldns_dname_label_count(ldns_rr_owner(ldns_rr_list_rr(rrset,
34 /* RFC4035 2.2: not counting the leftmost label if it is a wildcard */
35 if(ldns_dname_is_wildcard(ldns_rr_owner(ldns_rr_list_rr(rrset, 0))))
38 current_sig = ldns_rr_new_frm_type(LDNS_RR_TYPE_RRSIG);
40 /* set the type on the new signature */
41 orig_ttl = ldns_rr_ttl(ldns_rr_list_rr(rrset, 0));
42 orig_class = ldns_rr_get_class(ldns_rr_list_rr(rrset, 0));
44 ldns_rr_set_ttl(current_sig, orig_ttl);
45 ldns_rr_set_class(current_sig, orig_class);
46 ldns_rr_set_owner(current_sig,
49 ldns_rr_list_rr(rrset,
52 /* fill in what we know of the signature */
54 /* set the orig_ttl */
55 (void)ldns_rr_rrsig_set_origttl(
57 ldns_native2rdf_int32(LDNS_RDF_TYPE_INT32,
59 /* the signers name */
60 (void)ldns_rr_rrsig_set_signame(
62 ldns_rdf_clone(ldns_key_pubkey_owner(current_key)));
63 /* label count - get it from the first rr in the rr_list */
64 (void)ldns_rr_rrsig_set_labels(
66 ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8,
68 /* inception, expiration */
70 if (ldns_key_inception(current_key) != 0) {
71 (void)ldns_rr_rrsig_set_inception(
73 ldns_native2rdf_int32(
75 ldns_key_inception(current_key)));
77 (void)ldns_rr_rrsig_set_inception(
79 ldns_native2rdf_int32(LDNS_RDF_TYPE_TIME, now));
81 if (ldns_key_expiration(current_key) != 0) {
82 (void)ldns_rr_rrsig_set_expiration(
84 ldns_native2rdf_int32(
86 ldns_key_expiration(current_key)));
88 (void)ldns_rr_rrsig_set_expiration(
90 ldns_native2rdf_int32(
92 now + LDNS_DEFAULT_EXP_TIME));
95 (void)ldns_rr_rrsig_set_keytag(
97 ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16,
98 ldns_key_keytag(current_key)));
100 (void)ldns_rr_rrsig_set_algorithm(
102 ldns_native2rdf_int8(
104 ldns_key_algorithm(current_key)));
106 (void)ldns_rr_rrsig_set_typecovered(
108 ldns_native2rdf_int16(
110 ldns_rr_get_type(ldns_rr_list_rr(rrset,
117 ldns_sign_public_buffer(ldns_buffer *sign_buf, ldns_key *current_key)
119 ldns_rdf *b64rdf = NULL;
121 switch(ldns_key_algorithm(current_key)) {
124 b64rdf = ldns_sign_public_evp(
126 ldns_key_evp_key(current_key),
129 case LDNS_SIGN_RSASHA1:
130 case LDNS_SIGN_RSASHA1_NSEC3:
131 b64rdf = ldns_sign_public_evp(
133 ldns_key_evp_key(current_key),
137 case LDNS_SIGN_RSASHA256:
138 b64rdf = ldns_sign_public_evp(
140 ldns_key_evp_key(current_key),
143 case LDNS_SIGN_RSASHA512:
144 b64rdf = ldns_sign_public_evp(
146 ldns_key_evp_key(current_key),
149 #endif /* USE_SHA2 */
151 case LDNS_SIGN_ECC_GOST:
152 b64rdf = ldns_sign_public_evp(
154 ldns_key_evp_key(current_key),
155 EVP_get_digestbyname("md_gost94"));
157 #endif /* USE_GOST */
159 case LDNS_SIGN_ECDSAP256SHA256:
160 b64rdf = ldns_sign_public_evp(
162 ldns_key_evp_key(current_key),
165 case LDNS_SIGN_ECDSAP384SHA384:
166 b64rdf = ldns_sign_public_evp(
168 ldns_key_evp_key(current_key),
172 case LDNS_SIGN_RSAMD5:
173 b64rdf = ldns_sign_public_evp(
175 ldns_key_evp_key(current_key),
179 /* do _you_ know this alg? */
180 printf("unknown algorithm, ");
181 printf("is the one used available on this system?\n");
189 * use this function to sign with a public/private key alg
190 * return the created signatures
193 ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
195 ldns_rr_list *signatures;
196 ldns_rr_list *rrset_clone;
197 ldns_rr *current_sig;
199 ldns_key *current_key;
202 ldns_buffer *sign_buf;
205 if (!rrset || ldns_rr_list_rr_count(rrset) < 1 || !keys) {
211 signatures = ldns_rr_list_new();
213 /* prepare a signature and add all the know data
214 * prepare the rrset. Sign this together. */
215 rrset_clone = ldns_rr_list_clone(rrset);
220 /* make it canonical */
221 for(i = 0; i < ldns_rr_list_rr_count(rrset_clone); i++) {
222 ldns_rr_set_ttl(ldns_rr_list_rr(rrset_clone, i),
223 ldns_rr_ttl(ldns_rr_list_rr(rrset, 0)));
224 ldns_rr2canonical(ldns_rr_list_rr(rrset_clone, i));
227 ldns_rr_list_sort(rrset_clone);
230 key_count < ldns_key_list_key_count(keys);
232 if (!ldns_key_use(ldns_key_list_key(keys, key_count))) {
235 sign_buf = ldns_buffer_new(LDNS_MAX_PACKETLEN);
237 ldns_rr_list_free(rrset_clone);
238 ldns_rr_list_free(signatures);
239 ldns_rdf_free(new_owner);
244 current_key = ldns_key_list_key(keys, key_count);
245 /* sign all RRs with keys that have ZSKbit, !SEPbit.
246 sign DNSKEY RRs with keys that have ZSKbit&SEPbit */
247 if (ldns_key_flags(current_key) & LDNS_KEY_ZONE_KEY) {
248 current_sig = ldns_create_empty_rrsig(rrset_clone,
251 /* right now, we have: a key, a semi-sig and an rrset. For
252 * which we can create the sig and base64 encode that and
253 * add that to the signature */
255 if (ldns_rrsig2buffer_wire(sign_buf, current_sig)
257 ldns_buffer_free(sign_buf);
259 ldns_rr_list_deep_free(rrset_clone);
263 /* add the rrset in sign_buf */
264 if (ldns_rr_list2buffer_wire(sign_buf, rrset_clone)
266 ldns_buffer_free(sign_buf);
267 ldns_rr_list_deep_free(rrset_clone);
271 b64rdf = ldns_sign_public_buffer(sign_buf, current_key);
274 /* signing went wrong */
275 ldns_rr_list_deep_free(rrset_clone);
279 ldns_rr_rrsig_set_sig(current_sig, b64rdf);
281 /* push the signature to the signatures list */
282 ldns_rr_list_push_rr(signatures, current_sig);
284 ldns_buffer_free(sign_buf); /* restart for the next key */
286 ldns_rr_list_deep_free(rrset_clone);
294 * \param[in] to_sign The ldns_buffer containing raw data that is
296 * \param[in] key The DSA key structure to sign with
297 * \return ldns_rdf for the RRSIG ldns_rr
300 ldns_sign_public_dsa(ldns_buffer *to_sign, DSA *key)
302 unsigned char *sha1_hash;
303 ldns_rdf *sigdata_rdf;
310 b64sig = ldns_buffer_new(LDNS_MAX_PACKETLEN);
315 sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
316 ldns_buffer_position(to_sign), NULL);
318 ldns_buffer_free(b64sig);
323 sig = DSA_do_sign(sha1_hash, SHA_DIGEST_LENGTH, key);
325 data = LDNS_XMALLOC(uint8_t, 1 + 2 * SHA_DIGEST_LENGTH);
328 pad = 20 - (size_t) BN_num_bytes(sig->r);
330 memset(data + 1, 0, pad);
332 BN_bn2bin(sig->r, (unsigned char *) (data + 1) + pad);
334 pad = 20 - (size_t) BN_num_bytes(sig->s);
336 memset(data + 1 + SHA_DIGEST_LENGTH, 0, pad);
338 BN_bn2bin(sig->s, (unsigned char *) (data + 1 + SHA_DIGEST_LENGTH + pad));
340 sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64,
341 1 + 2 * SHA_DIGEST_LENGTH,
344 ldns_buffer_free(b64sig);
352 ldns_pkey_is_ecdsa(EVP_PKEY* pkey)
356 if(EVP_PKEY_type(pkey->type) != EVP_PKEY_EC)
358 ec = EVP_PKEY_get1_EC_KEY(pkey);
359 g = EC_KEY_get0_group(ec);
364 if(EC_GROUP_get_curve_name(g) == NID_secp224r1 ||
365 EC_GROUP_get_curve_name(g) == NID_X9_62_prime256v1 ||
366 EC_GROUP_get_curve_name(g) == NID_secp384r1) {
370 /* downref the eckey, the original is still inside the pkey */
374 #endif /* USE_ECDSA */
377 ldns_sign_public_evp(ldns_buffer *to_sign,
379 const EVP_MD *digest_type)
382 ldns_rdf *sigdata_rdf;
385 const EVP_MD *md_type;
389 b64sig = ldns_buffer_new(LDNS_MAX_PACKETLEN);
394 /* initializes a signing context */
395 md_type = digest_type;
397 /* unknown message difest */
398 ldns_buffer_free(b64sig);
402 EVP_MD_CTX_init(&ctx);
403 r = EVP_SignInit(&ctx, md_type);
405 r = EVP_SignUpdate(&ctx, (unsigned char*)
406 ldns_buffer_begin(to_sign),
407 ldns_buffer_position(to_sign));
409 ldns_buffer_free(b64sig);
413 r = EVP_SignFinal(&ctx, (unsigned char*)
414 ldns_buffer_begin(b64sig), &siglen, key);
416 ldns_buffer_free(b64sig);
420 ldns_buffer_free(b64sig);
424 /* unfortunately, OpenSSL output is differenct from DNS DSA format */
425 if (EVP_PKEY_type(key->type) == EVP_PKEY_DSA) {
426 sigdata_rdf = ldns_convert_dsa_rrsig_asn12rdf(b64sig, siglen);
428 } else if(EVP_PKEY_type(key->type) == EVP_PKEY_EC &&
429 ldns_pkey_is_ecdsa(key)) {
430 sigdata_rdf = ldns_convert_ecdsa_rrsig_asn12rdf(b64sig, siglen);
433 /* ok output for other types is the same */
434 sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
435 ldns_buffer_begin(b64sig));
437 ldns_buffer_free(b64sig);
438 EVP_MD_CTX_cleanup(&ctx);
443 ldns_sign_public_rsasha1(ldns_buffer *to_sign, RSA *key)
445 unsigned char *sha1_hash;
447 ldns_rdf *sigdata_rdf;
452 b64sig = ldns_buffer_new(LDNS_MAX_PACKETLEN);
457 sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
458 ldns_buffer_position(to_sign), NULL);
460 ldns_buffer_free(b64sig);
464 result = RSA_sign(NID_sha1, sha1_hash, SHA_DIGEST_LENGTH,
465 (unsigned char*)ldns_buffer_begin(b64sig),
475 sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
476 ldns_buffer_begin(b64sig));
477 ldns_buffer_free(b64sig); /* can't free this buffer ?? */
482 ldns_sign_public_rsamd5(ldns_buffer *to_sign, RSA *key)
484 unsigned char *md5_hash;
486 ldns_rdf *sigdata_rdf;
489 b64sig = ldns_buffer_new(LDNS_MAX_PACKETLEN);
494 md5_hash = MD5((unsigned char*)ldns_buffer_begin(to_sign),
495 ldns_buffer_position(to_sign), NULL);
497 ldns_buffer_free(b64sig);
501 RSA_sign(NID_md5, md5_hash, MD5_DIGEST_LENGTH,
502 (unsigned char*)ldns_buffer_begin(b64sig),
505 sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
506 ldns_buffer_begin(b64sig));
507 ldns_buffer_free(b64sig);
510 #endif /* HAVE_SSL */
513 ldns_dnssec_name_has_only_a(ldns_dnssec_name *cur_name)
515 ldns_dnssec_rrsets *cur_rrset;
516 cur_rrset = cur_name->rrsets;
518 if (cur_rrset->type != LDNS_RR_TYPE_A &&
519 cur_rrset->type != LDNS_RR_TYPE_AAAA) {
522 cur_rrset = cur_rrset->next;
529 ldns_dnssec_zone_mark_glue(ldns_dnssec_zone *zone)
531 ldns_rbnode_t *cur_node;
532 ldns_dnssec_name *cur_name;
533 ldns_rdf *cur_owner, *cur_parent;
535 cur_node = ldns_rbtree_first(zone->names);
536 while (cur_node != LDNS_RBTREE_NULL) {
537 cur_name = (ldns_dnssec_name *) cur_node->data;
538 cur_node = ldns_rbtree_next(cur_node);
539 if (ldns_dnssec_name_has_only_a(cur_name)) {
540 /* assume glue XXX check for zone cur */
541 cur_owner = ldns_rdf_clone(ldns_rr_owner(
542 cur_name->rrsets->rrs->rr));
543 while (ldns_dname_label_count(cur_owner) >
544 ldns_dname_label_count(zone->soa->name)) {
545 if (ldns_dnssec_zone_find_rrset(zone,
549 fprintf(stderr, "[XX] Marking as glue: ");
550 ldns_rdf_print(stderr, cur_name->name);
551 fprintf(stderr, "\n");
553 cur_name->is_glue = true;
555 cur_parent = ldns_dname_left_chop(cur_owner);
556 ldns_rdf_deep_free(cur_owner);
557 cur_owner = cur_parent;
559 ldns_rdf_deep_free(cur_owner);
562 return LDNS_STATUS_OK;
566 ldns_dnssec_name_node_next_nonglue(ldns_rbnode_t *node)
568 ldns_rbnode_t *next_node = NULL;
569 ldns_dnssec_name *next_name = NULL;
572 if (node == LDNS_RBTREE_NULL) {
577 if (next_node == LDNS_RBTREE_NULL) {
580 next_name = (ldns_dnssec_name *)next_node->data;
581 if (!next_name->is_glue) {
584 next_node = ldns_rbtree_next(next_node);
592 ldns_dnssec_zone_create_nsecs(ldns_dnssec_zone *zone,
593 ldns_rr_list *new_rrs)
596 ldns_rbnode_t *first_node, *cur_node, *next_node;
597 ldns_dnssec_name *cur_name, *next_name;
600 ldns_dnssec_rrsets *soa;
602 /* the TTL of NSEC rrs should be set to the minimum TTL of
603 * the zone SOA (RFC4035 Section 2.3)
605 soa = ldns_dnssec_name_find_rrset(zone->soa, LDNS_RR_TYPE_SOA);
607 /* did the caller actually set it? if not,
608 * fall back to default ttl
610 if (soa && soa->rrs && soa->rrs->rr) {
611 nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(
614 nsec_ttl = LDNS_DEFAULT_TTL;
617 first_node = ldns_dnssec_name_node_next_nonglue(
618 ldns_rbtree_first(zone->names));
619 cur_node = first_node;
621 next_node = ldns_dnssec_name_node_next_nonglue(
622 ldns_rbtree_next(cur_node));
627 while (cur_node && next_node) {
628 cur_name = (ldns_dnssec_name *)cur_node->data;
629 next_name = (ldns_dnssec_name *)next_node->data;
630 nsec_rr = ldns_dnssec_create_nsec(cur_name,
633 ldns_rr_set_ttl(nsec_rr, nsec_ttl);
634 ldns_dnssec_name_add_rr(cur_name, nsec_rr);
635 ldns_rr_list_push_rr(new_rrs, nsec_rr);
636 cur_node = next_node;
638 next_node = ldns_dnssec_name_node_next_nonglue(
639 ldns_rbtree_next(cur_node));
643 if (cur_node && !next_node) {
644 cur_name = (ldns_dnssec_name *)cur_node->data;
645 next_name = (ldns_dnssec_name *)first_node->data;
646 nsec_rr = ldns_dnssec_create_nsec(cur_name,
649 ldns_rr_set_ttl(nsec_rr, nsec_ttl);
650 ldns_dnssec_name_add_rr(cur_name, nsec_rr);
651 ldns_rr_list_push_rr(new_rrs, nsec_rr);
656 return LDNS_STATUS_OK;
661 ldns_dnssec_zone_create_nsec3s(ldns_dnssec_zone *zone,
662 ldns_rr_list *new_rrs,
669 ldns_rbnode_t *first_name_node;
670 ldns_rbnode_t *current_name_node;
671 ldns_dnssec_name *current_name;
672 ldns_status result = LDNS_STATUS_OK;
674 ldns_rr_list *nsec3_list;
676 ldns_dnssec_rrsets *soa;
678 if (!zone || !new_rrs || !zone->names) {
679 return LDNS_STATUS_ERR;
682 /* the TTL of NSEC rrs should be set to the minimum TTL of
683 * the zone SOA (RFC4035 Section 2.3)
685 soa = ldns_dnssec_name_find_rrset(zone->soa, LDNS_RR_TYPE_SOA);
687 /* did the caller actually set it? if not,
688 * fall back to default ttl
690 if (soa && soa->rrs && soa->rrs->rr) {
691 nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(
694 nsec_ttl = LDNS_DEFAULT_TTL;
697 nsec3_list = ldns_rr_list_new();
699 first_name_node = ldns_dnssec_name_node_next_nonglue(
700 ldns_rbtree_first(zone->names));
702 current_name_node = first_name_node;
704 while (current_name_node &&
705 current_name_node != LDNS_RBTREE_NULL) {
706 current_name = (ldns_dnssec_name *) current_name_node->data;
707 nsec_rr = ldns_dnssec_create_nsec3(current_name,
715 /* by default, our nsec based generator adds rrsigs
716 * remove the bitmap for empty nonterminals */
717 if (!current_name->rrsets) {
718 ldns_rdf_deep_free(ldns_rr_pop_rdf(nsec_rr));
720 ldns_rr_set_ttl(nsec_rr, nsec_ttl);
721 ldns_dnssec_name_add_rr(current_name, nsec_rr);
722 ldns_rr_list_push_rr(new_rrs, nsec_rr);
723 ldns_rr_list_push_rr(nsec3_list, nsec_rr);
724 current_name_node = ldns_dnssec_name_node_next_nonglue(
725 ldns_rbtree_next(current_name_node));
728 ldns_rr_list_sort_nsec3(nsec3_list);
729 ldns_dnssec_chain_nsec3_list(nsec3_list);
730 if (result != LDNS_STATUS_OK) {
734 ldns_rr_list_free(nsec3_list);
737 #endif /* HAVE_SSL */
740 ldns_dnssec_remove_signatures(ldns_dnssec_rrs *signatures,
741 ldns_key_list *key_list,
742 int (*func)(ldns_rr *, void *),
745 ldns_dnssec_rrs *base_rrs = signatures;
746 ldns_dnssec_rrs *cur_rr = base_rrs;
747 ldns_dnssec_rrs *prev_rr = NULL;
748 ldns_dnssec_rrs *next_rr;
756 switch(func(NULL, arg)) {
757 case LDNS_SIGNATURE_LEAVE_ADD_NEW:
758 case LDNS_SIGNATURE_REMOVE_ADD_NEW:
760 case LDNS_SIGNATURE_LEAVE_NO_ADD:
761 case LDNS_SIGNATURE_REMOVE_NO_ADD:
762 ldns_key_list_set_use(key_list, false);
765 fprintf(stderr, "[XX] unknown return value from callback\n");
770 (void)func(cur_rr->rr, arg);
773 next_rr = cur_rr->next;
775 switch (func(cur_rr->rr, arg)) {
776 case LDNS_SIGNATURE_LEAVE_ADD_NEW:
779 case LDNS_SIGNATURE_LEAVE_NO_ADD:
780 keytag = ldns_rdf2native_int16(
781 ldns_rr_rrsig_keytag(cur_rr->rr));
782 for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
783 if (ldns_key_keytag(ldns_key_list_key(key_list, i)) ==
785 ldns_key_set_use(ldns_key_list_key(key_list, i),
791 case LDNS_SIGNATURE_REMOVE_NO_ADD:
792 keytag = ldns_rdf2native_int16(
793 ldns_rr_rrsig_keytag(cur_rr->rr));
794 for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
795 if (ldns_key_keytag(ldns_key_list_key(key_list, i))
797 ldns_key_set_use(ldns_key_list_key(key_list, i),
802 prev_rr->next = next_rr;
808 case LDNS_SIGNATURE_REMOVE_ADD_NEW:
810 prev_rr->next = next_rr;
817 fprintf(stderr, "[XX] unknown return value from callback\n");
828 ldns_dnssec_zone_create_rrsigs(ldns_dnssec_zone *zone,
829 ldns_rr_list *new_rrs,
830 ldns_key_list *key_list,
831 int (*func)(ldns_rr *, void*),
834 return ldns_dnssec_zone_create_rrsigs_flg(zone, new_rrs, key_list,
838 /** If there are KSKs use only them and mark ZSKs unused */
840 ldns_key_list_filter_for_dnskey(ldns_key_list *key_list)
844 for(i=0; i<ldns_key_list_key_count(key_list); i++)
845 if((ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY)) {
851 for(i=0; i<ldns_key_list_key_count(key_list); i++)
852 if(!(ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY))
853 ldns_key_set_use(ldns_key_list_key(key_list, i), 0);
856 /** If there are no ZSKs use KSK as ZSK */
858 ldns_key_list_filter_for_non_dnskey(ldns_key_list *key_list)
862 for(i=0; i<ldns_key_list_key_count(key_list); i++)
863 if(!(ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY)) {
869 /* else filter all KSKs */
870 for(i=0; i<ldns_key_list_key_count(key_list); i++)
871 if((ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY))
872 ldns_key_set_use(ldns_key_list_key(key_list, i), 0);
876 ldns_dnssec_zone_create_rrsigs_flg(ldns_dnssec_zone *zone,
877 ldns_rr_list *new_rrs,
878 ldns_key_list *key_list,
879 int (*func)(ldns_rr *, void*),
883 ldns_status result = LDNS_STATUS_OK;
885 ldns_rbnode_t *cur_node;
886 ldns_rr_list *rr_list;
888 ldns_dnssec_name *cur_name;
889 ldns_dnssec_rrsets *cur_rrset;
890 ldns_dnssec_rrs *cur_rr;
892 ldns_rr_list *siglist;
896 ldns_rr_list *pubkey_list = ldns_rr_list_new();
900 for (i = 0; i<ldns_key_list_key_count(key_list); i++) {
901 ldns_rr_list_push_rr(pubkey_list,
902 ldns_key2rr(ldns_key_list_key(key_list, i)));
904 /* TODO: callback to see is list should be signed */
905 /* TODO: remove 'old' signatures from signature list */
906 cur_node = ldns_rbtree_first(zone->names);
907 while (cur_node != LDNS_RBTREE_NULL) {
908 cur_name = (ldns_dnssec_name *) cur_node->data;
910 if (!cur_name->is_glue) {
911 cur_rrset = cur_name->rrsets;
913 /* reset keys to use */
914 ldns_key_list_set_use(key_list, true);
916 /* walk through old sigs, remove the old,
917 and mark which keys (not) to use) */
918 cur_rrset->signatures =
919 ldns_dnssec_remove_signatures(cur_rrset->signatures,
923 if(!(flags&LDNS_SIGN_DNSKEY_WITH_ZSK) &&
924 cur_rrset->type == LDNS_RR_TYPE_DNSKEY)
925 ldns_key_list_filter_for_dnskey(key_list);
927 if(cur_rrset->type != LDNS_RR_TYPE_DNSKEY)
928 ldns_key_list_filter_for_non_dnskey(key_list);
930 /* TODO: just set count to zero? */
931 rr_list = ldns_rr_list_new();
933 cur_rr = cur_rrset->rrs;
935 ldns_rr_list_push_rr(rr_list, cur_rr->rr);
936 cur_rr = cur_rr->next;
939 /* only sign non-delegation RRsets */
940 /* (glue should have been marked earlier) */
941 if ((ldns_rr_list_type(rr_list) != LDNS_RR_TYPE_NS ||
942 ldns_dname_compare(ldns_rr_list_owner(rr_list),
943 zone->soa->name) == 0) &&
944 /* OK, there is also the possibility that the record
945 * is glue, but at the same owner name as other records that
946 * are not NS nor A/AAAA. Bleh, our current data structure
947 * doesn't really support that... */
948 !((ldns_rr_list_type(rr_list) == LDNS_RR_TYPE_A ||
949 ldns_rr_list_type(rr_list) == LDNS_RR_TYPE_AAAA) &&
950 !ldns_dname_compare(ldns_rr_list_owner(rr_list), zone->soa->name) == 0 &&
951 ldns_dnssec_zone_find_rrset(zone, ldns_rr_list_owner(rr_list), LDNS_RR_TYPE_NS)
954 siglist = ldns_sign_public(rr_list, key_list);
955 for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
956 if (cur_rrset->signatures) {
957 ldns_dnssec_rrs_add_rr(cur_rrset->signatures,
958 ldns_rr_list_rr(siglist,
961 cur_rrset->signatures = ldns_dnssec_rrs_new();
962 cur_rrset->signatures->rr =
963 ldns_rr_list_rr(siglist, i);
964 ldns_rr_list_push_rr(new_rrs,
965 ldns_rr_list_rr(siglist,
969 ldns_rr_list_free(siglist);
972 ldns_rr_list_free(rr_list);
974 cur_rrset = cur_rrset->next;
978 ldns_key_list_set_use(key_list, true);
979 cur_name->nsec_signatures =
980 ldns_dnssec_remove_signatures(cur_name->nsec_signatures,
984 ldns_key_list_filter_for_non_dnskey(key_list);
986 rr_list = ldns_rr_list_new();
987 ldns_rr_list_push_rr(rr_list, cur_name->nsec);
988 siglist = ldns_sign_public(rr_list, key_list);
990 for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
991 if (cur_name->nsec_signatures) {
992 ldns_dnssec_rrs_add_rr(cur_name->nsec_signatures,
993 ldns_rr_list_rr(siglist, i));
995 cur_name->nsec_signatures = ldns_dnssec_rrs_new();
996 cur_name->nsec_signatures->rr =
997 ldns_rr_list_rr(siglist, i);
998 ldns_rr_list_push_rr(new_rrs,
999 ldns_rr_list_rr(siglist, i));
1003 ldns_rr_list_free(siglist);
1004 ldns_rr_list_free(rr_list);
1006 cur_node = ldns_rbtree_next(cur_node);
1009 ldns_rr_list_deep_free(pubkey_list);
1014 ldns_dnssec_zone_sign(ldns_dnssec_zone *zone,
1015 ldns_rr_list *new_rrs,
1016 ldns_key_list *key_list,
1017 int (*func)(ldns_rr *, void *),
1020 return ldns_dnssec_zone_sign_flg(zone, new_rrs, key_list, func, arg, 0);
1024 ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone,
1025 ldns_rr_list *new_rrs,
1026 ldns_key_list *key_list,
1027 int (*func)(ldns_rr *, void *),
1031 ldns_status result = LDNS_STATUS_OK;
1033 if (!zone || !new_rrs || !key_list) {
1034 return LDNS_STATUS_ERR;
1037 /* zone is already sorted */
1038 ldns_dnssec_zone_mark_glue(zone);
1040 /* check whether we need to add nsecs */
1041 if (zone->names && !((ldns_dnssec_name *)zone->names->root->data)->nsec) {
1042 result = ldns_dnssec_zone_create_nsecs(zone, new_rrs);
1043 if (result != LDNS_STATUS_OK) {
1048 result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1059 ldns_dnssec_zone_sign_nsec3(ldns_dnssec_zone *zone,
1060 ldns_rr_list *new_rrs,
1061 ldns_key_list *key_list,
1062 int (*func)(ldns_rr *, void *),
1066 uint16_t iterations,
1067 uint8_t salt_length,
1070 return ldns_dnssec_zone_sign_nsec3_flg(zone, new_rrs, key_list,
1071 func, arg, algorithm, flags, iterations, salt_length, salt, 0);
1075 ldns_dnssec_zone_sign_nsec3_flg(ldns_dnssec_zone *zone,
1076 ldns_rr_list *new_rrs,
1077 ldns_key_list *key_list,
1078 int (*func)(ldns_rr *, void *),
1082 uint16_t iterations,
1083 uint8_t salt_length,
1087 ldns_rr *nsec3, *nsec3params;
1088 ldns_status result = LDNS_STATUS_OK;
1090 /* zone is already sorted */
1091 ldns_dnssec_zone_mark_glue(zone);
1093 /* TODO if there are already nsec3s presents and their
1094 * parameters are the same as these, we don't have to recreate
1097 /* add empty nonterminals */
1098 ldns_dnssec_zone_add_empty_nonterminals(zone);
1100 nsec3 = ((ldns_dnssec_name *)zone->names->root->data)->nsec;
1101 if (nsec3 && ldns_rr_get_type(nsec3) == LDNS_RR_TYPE_NSEC3) {
1102 /* no need to recreate */
1104 if (!ldns_dnssec_zone_find_rrset(zone,
1106 LDNS_RR_TYPE_NSEC3PARAMS)) {
1107 /* create and add the nsec3params rr */
1109 ldns_rr_new_frm_type(LDNS_RR_TYPE_NSEC3PARAMS);
1110 ldns_rr_set_owner(nsec3params,
1111 ldns_rdf_clone(zone->soa->name));
1112 ldns_nsec3_add_param_rdfs(nsec3params,
1118 /* always set bit 7 of the flags to zero, according to
1119 * rfc5155 section 11 */
1120 ldns_set_bit(ldns_rdf_data(ldns_rr_rdf(nsec3params, 1)), 7, 0);
1121 ldns_dnssec_zone_add_rr(zone, nsec3params);
1122 ldns_rr_list_push_rr(new_rrs, nsec3params);
1124 result = ldns_dnssec_zone_create_nsec3s(zone,
1131 if (result != LDNS_STATUS_OK) {
1136 result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1149 ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
1151 ldns_dnssec_zone *dnssec_zone;
1152 ldns_zone *signed_zone;
1153 ldns_rr_list *new_rrs;
1156 signed_zone = ldns_zone_new();
1157 dnssec_zone = ldns_dnssec_zone_new();
1159 (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1160 ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1162 for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1163 (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1164 ldns_rr_list_rr(ldns_zone_rrs(zone),
1166 ldns_zone_push_rr(signed_zone,
1167 ldns_rr_clone(ldns_rr_list_rr(ldns_zone_rrs(zone),
1171 new_rrs = ldns_rr_list_new();
1172 (void) ldns_dnssec_zone_sign(dnssec_zone,
1175 ldns_dnssec_default_replace_signatures,
1178 for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1179 ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1180 ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1183 ldns_rr_list_deep_free(new_rrs);
1184 ldns_dnssec_zone_free(dnssec_zone);
1190 ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
1192 ldns_dnssec_zone *dnssec_zone;
1193 ldns_zone *signed_zone;
1194 ldns_rr_list *new_rrs;
1197 signed_zone = ldns_zone_new();
1198 dnssec_zone = ldns_dnssec_zone_new();
1200 (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1201 ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1203 for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1204 (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1205 ldns_rr_list_rr(ldns_zone_rrs(zone),
1207 ldns_zone_push_rr(signed_zone,
1208 ldns_rr_clone(ldns_rr_list_rr(ldns_zone_rrs(zone),
1212 new_rrs = ldns_rr_list_new();
1213 (void) ldns_dnssec_zone_sign_nsec3(dnssec_zone,
1216 ldns_dnssec_default_replace_signatures,
1224 for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1225 ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1226 ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1229 ldns_rr_list_deep_free(new_rrs);
1230 ldns_dnssec_zone_free(dnssec_zone);
1234 #endif /* HAVE_SSL */