d571c93b26b2fddf9ec503960ee0e0bf6d20a46f
[dragonfly.git] / contrib / ldns / dnssec_sign.c
1 #include <ldns/config.h>
2
3 #include <ldns/ldns.h>
4
5 #include <ldns/dnssec.h>
6 #include <ldns/dnssec_sign.h>
7
8 #include <strings.h>
9 #include <time.h>
10
11 #ifdef HAVE_SSL
12 /* this entire file is rather useless when you don't have
13  * crypto...
14  */
15 #include <openssl/ssl.h>
16 #include <openssl/evp.h>
17 #include <openssl/rand.h>
18 #include <openssl/err.h>
19 #include <openssl/md5.h>
20 #endif /* HAVE_SSL */
21
22 ldns_rr *
23 ldns_create_empty_rrsig(ldns_rr_list *rrset,
24                         ldns_key *current_key)
25 {
26         uint32_t orig_ttl;
27         ldns_rr_class orig_class;
28         time_t now;
29         ldns_rr *current_sig;
30         uint8_t label_count;
31
32         label_count = ldns_dname_label_count(ldns_rr_owner(ldns_rr_list_rr(rrset,
33                                                            0)));
34         /* RFC4035 2.2: not counting the leftmost label if it is a wildcard */
35         if(ldns_dname_is_wildcard(ldns_rr_owner(ldns_rr_list_rr(rrset, 0))))
36                 label_count --;
37
38         current_sig = ldns_rr_new_frm_type(LDNS_RR_TYPE_RRSIG);
39
40         /* set the type on the new signature */
41         orig_ttl = ldns_rr_ttl(ldns_rr_list_rr(rrset, 0));
42         orig_class = ldns_rr_get_class(ldns_rr_list_rr(rrset, 0));
43
44         ldns_rr_set_ttl(current_sig, orig_ttl);
45         ldns_rr_set_class(current_sig, orig_class);
46         ldns_rr_set_owner(current_sig,
47                           ldns_rdf_clone(
48                                ldns_rr_owner(
49                                     ldns_rr_list_rr(rrset,
50                                                     0))));
51
52         /* fill in what we know of the signature */
53
54         /* set the orig_ttl */
55         (void)ldns_rr_rrsig_set_origttl(
56                    current_sig,
57                    ldns_native2rdf_int32(LDNS_RDF_TYPE_INT32,
58                                          orig_ttl));
59         /* the signers name */
60         (void)ldns_rr_rrsig_set_signame(
61                         current_sig,
62                         ldns_rdf_clone(ldns_key_pubkey_owner(current_key)));
63         /* label count - get it from the first rr in the rr_list */
64         (void)ldns_rr_rrsig_set_labels(
65                         current_sig,
66                         ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8,
67                                              label_count));
68         /* inception, expiration */
69         now = time(NULL);
70         if (ldns_key_inception(current_key) != 0) {
71                 (void)ldns_rr_rrsig_set_inception(
72                                 current_sig,
73                                 ldns_native2rdf_int32(
74                                     LDNS_RDF_TYPE_TIME,
75                                     ldns_key_inception(current_key)));
76         } else {
77                 (void)ldns_rr_rrsig_set_inception(
78                                 current_sig,
79                                 ldns_native2rdf_int32(LDNS_RDF_TYPE_TIME, now));
80         }
81         if (ldns_key_expiration(current_key) != 0) {
82                 (void)ldns_rr_rrsig_set_expiration(
83                                 current_sig,
84                                 ldns_native2rdf_int32(
85                                     LDNS_RDF_TYPE_TIME,
86                                     ldns_key_expiration(current_key)));
87         } else {
88                 (void)ldns_rr_rrsig_set_expiration(
89                              current_sig,
90                                 ldns_native2rdf_int32(
91                                     LDNS_RDF_TYPE_TIME,
92                                     now + LDNS_DEFAULT_EXP_TIME));
93         }
94
95         (void)ldns_rr_rrsig_set_keytag(
96                    current_sig,
97                    ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16,
98                                          ldns_key_keytag(current_key)));
99
100         (void)ldns_rr_rrsig_set_algorithm(
101                         current_sig,
102                         ldns_native2rdf_int8(
103                             LDNS_RDF_TYPE_ALG,
104                             ldns_key_algorithm(current_key)));
105
106         (void)ldns_rr_rrsig_set_typecovered(
107                         current_sig,
108                         ldns_native2rdf_int16(
109                             LDNS_RDF_TYPE_TYPE,
110                             ldns_rr_get_type(ldns_rr_list_rr(rrset,
111                                                              0))));
112         return current_sig;
113 }
114
115 #ifdef HAVE_SSL
116 ldns_rdf *
117 ldns_sign_public_buffer(ldns_buffer *sign_buf, ldns_key *current_key)
118 {
119         ldns_rdf *b64rdf = NULL;
120
121         switch(ldns_key_algorithm(current_key)) {
122         case LDNS_SIGN_DSA:
123         case LDNS_DSA_NSEC3:
124                 b64rdf = ldns_sign_public_evp(
125                                    sign_buf,
126                                    ldns_key_evp_key(current_key),
127                                    EVP_dss1());
128                 break;
129         case LDNS_SIGN_RSASHA1:
130         case LDNS_SIGN_RSASHA1_NSEC3:
131                 b64rdf = ldns_sign_public_evp(
132                                    sign_buf,
133                                    ldns_key_evp_key(current_key),
134                                    EVP_sha1());
135                 break;
136 #ifdef USE_SHA2
137         case LDNS_SIGN_RSASHA256:
138                 b64rdf = ldns_sign_public_evp(
139                                    sign_buf,
140                                    ldns_key_evp_key(current_key),
141                                    EVP_sha256());
142                 break;
143         case LDNS_SIGN_RSASHA512:
144                 b64rdf = ldns_sign_public_evp(
145                                    sign_buf,
146                                    ldns_key_evp_key(current_key),
147                                    EVP_sha512());
148                 break;
149 #endif /* USE_SHA2 */
150 #ifdef USE_GOST
151         case LDNS_SIGN_ECC_GOST:
152                 b64rdf = ldns_sign_public_evp(
153                                    sign_buf,
154                                    ldns_key_evp_key(current_key),
155                                    EVP_get_digestbyname("md_gost94"));
156                 break;
157 #endif /* USE_GOST */
158 #ifdef USE_ECDSA
159         case LDNS_SIGN_ECDSAP256SHA256:
160                 b64rdf = ldns_sign_public_evp(
161                                    sign_buf,
162                                    ldns_key_evp_key(current_key),
163                                    EVP_sha256());
164                 break;
165         case LDNS_SIGN_ECDSAP384SHA384:
166                 b64rdf = ldns_sign_public_evp(
167                                    sign_buf,
168                                    ldns_key_evp_key(current_key),
169                                    EVP_sha384());
170                 break;
171 #endif
172         case LDNS_SIGN_RSAMD5:
173                 b64rdf = ldns_sign_public_evp(
174                                    sign_buf,
175                                    ldns_key_evp_key(current_key),
176                                    EVP_md5());
177                 break;
178         default:
179                 /* do _you_ know this alg? */
180                 printf("unknown algorithm, ");
181                 printf("is the one used available on this system?\n");
182                 break;
183         }
184
185         return b64rdf;
186 }
187
188 /**
189  * use this function to sign with a public/private key alg
190  * return the created signatures
191  */
192 ldns_rr_list *
193 ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
194 {
195         ldns_rr_list *signatures;
196         ldns_rr_list *rrset_clone;
197         ldns_rr *current_sig;
198         ldns_rdf *b64rdf;
199         ldns_key *current_key;
200         size_t key_count;
201         uint16_t i;
202         ldns_buffer *sign_buf;
203         ldns_rdf *new_owner;
204
205         if (!rrset || ldns_rr_list_rr_count(rrset) < 1 || !keys) {
206                 return NULL;
207         }
208
209         new_owner = NULL;
210
211         signatures = ldns_rr_list_new();
212
213         /* prepare a signature and add all the know data
214          * prepare the rrset. Sign this together.  */
215         rrset_clone = ldns_rr_list_clone(rrset);
216         if (!rrset_clone) {
217                 return NULL;
218         }
219
220         /* make it canonical */
221         for(i = 0; i < ldns_rr_list_rr_count(rrset_clone); i++) {
222                 ldns_rr_set_ttl(ldns_rr_list_rr(rrset_clone, i), 
223                         ldns_rr_ttl(ldns_rr_list_rr(rrset, 0)));
224                 ldns_rr2canonical(ldns_rr_list_rr(rrset_clone, i));
225         }
226         /* sort */
227         ldns_rr_list_sort(rrset_clone);
228
229         for (key_count = 0;
230                 key_count < ldns_key_list_key_count(keys);
231                 key_count++) {
232                 if (!ldns_key_use(ldns_key_list_key(keys, key_count))) {
233                         continue;
234                 }
235                 sign_buf = ldns_buffer_new(LDNS_MAX_PACKETLEN);
236                 if (!sign_buf) {
237                         ldns_rr_list_free(rrset_clone);
238                         ldns_rr_list_free(signatures);
239                         ldns_rdf_free(new_owner);
240                         return NULL;
241                 }
242                 b64rdf = NULL;
243
244                 current_key = ldns_key_list_key(keys, key_count);
245                 /* sign all RRs with keys that have ZSKbit, !SEPbit.
246                    sign DNSKEY RRs with keys that have ZSKbit&SEPbit */
247                 if (ldns_key_flags(current_key) & LDNS_KEY_ZONE_KEY) {
248                         current_sig = ldns_create_empty_rrsig(rrset_clone,
249                                                               current_key);
250
251                         /* right now, we have: a key, a semi-sig and an rrset. For
252                          * which we can create the sig and base64 encode that and
253                          * add that to the signature */
254
255                         if (ldns_rrsig2buffer_wire(sign_buf, current_sig)
256                             != LDNS_STATUS_OK) {
257                                 ldns_buffer_free(sign_buf);
258                                 /* ERROR */
259                                 ldns_rr_list_deep_free(rrset_clone);
260                                 return NULL;
261                         }
262
263                         /* add the rrset in sign_buf */
264                         if (ldns_rr_list2buffer_wire(sign_buf, rrset_clone)
265                             != LDNS_STATUS_OK) {
266                                 ldns_buffer_free(sign_buf);
267                                 ldns_rr_list_deep_free(rrset_clone);
268                                 return NULL;
269                         }
270
271                         b64rdf = ldns_sign_public_buffer(sign_buf, current_key);
272
273                         if (!b64rdf) {
274                                 /* signing went wrong */
275                                 ldns_rr_list_deep_free(rrset_clone);
276                                 return NULL;
277                         }
278
279                         ldns_rr_rrsig_set_sig(current_sig, b64rdf);
280
281                         /* push the signature to the signatures list */
282                         ldns_rr_list_push_rr(signatures, current_sig);
283                 }
284                 ldns_buffer_free(sign_buf); /* restart for the next key */
285         }
286         ldns_rr_list_deep_free(rrset_clone);
287
288         return signatures;
289 }
290
291 /**
292  * Sign data with DSA
293  *
294  * \param[in] to_sign The ldns_buffer containing raw data that is
295  *                    to be signed
296  * \param[in] key The DSA key structure to sign with
297  * \return ldns_rdf for the RRSIG ldns_rr
298  */
299 ldns_rdf *
300 ldns_sign_public_dsa(ldns_buffer *to_sign, DSA *key)
301 {
302         unsigned char *sha1_hash;
303         ldns_rdf *sigdata_rdf;
304         ldns_buffer *b64sig;
305
306         DSA_SIG *sig;
307         uint8_t *data;
308         size_t pad;
309
310         b64sig = ldns_buffer_new(LDNS_MAX_PACKETLEN);
311         if (!b64sig) {
312                 return NULL;
313         }
314
315         sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
316                                   ldns_buffer_position(to_sign), NULL);
317         if (!sha1_hash) {
318                 ldns_buffer_free(b64sig);
319                 return NULL;
320         }
321
322
323         sig = DSA_do_sign(sha1_hash, SHA_DIGEST_LENGTH, key);
324
325         data = LDNS_XMALLOC(uint8_t, 1 + 2 * SHA_DIGEST_LENGTH);
326
327         data[0] = 1;
328         pad = 20 - (size_t) BN_num_bytes(sig->r);
329         if (pad > 0) {
330                 memset(data + 1, 0, pad);
331         }
332         BN_bn2bin(sig->r, (unsigned char *) (data + 1) + pad);
333
334         pad = 20 - (size_t) BN_num_bytes(sig->s);
335         if (pad > 0) {
336                 memset(data + 1 + SHA_DIGEST_LENGTH, 0, pad);
337         }
338         BN_bn2bin(sig->s, (unsigned char *) (data + 1 + SHA_DIGEST_LENGTH + pad));
339
340         sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64,
341                                                                  1 + 2 * SHA_DIGEST_LENGTH,
342                                                                  data);
343
344         ldns_buffer_free(b64sig);
345         LDNS_FREE(data);
346
347         return sigdata_rdf;
348 }
349
350 #ifdef USE_ECDSA
351 static int
352 ldns_pkey_is_ecdsa(EVP_PKEY* pkey)
353 {
354         EC_KEY* ec;
355         const EC_GROUP* g;
356         if(EVP_PKEY_type(pkey->type) != EVP_PKEY_EC)
357                 return 0;
358         ec = EVP_PKEY_get1_EC_KEY(pkey);
359         g = EC_KEY_get0_group(ec);
360         if(!g) {
361                 EC_KEY_free(ec);
362                 return 0;
363         }
364         if(EC_GROUP_get_curve_name(g) == NID_secp224r1 ||
365                 EC_GROUP_get_curve_name(g) == NID_X9_62_prime256v1 ||
366                 EC_GROUP_get_curve_name(g) == NID_secp384r1) {
367                 EC_KEY_free(ec);
368                 return 1;
369         }
370         /* downref the eckey, the original is still inside the pkey */
371         EC_KEY_free(ec);
372         return 0;
373 }
374 #endif /* USE_ECDSA */
375
376 ldns_rdf *
377 ldns_sign_public_evp(ldns_buffer *to_sign,
378                                  EVP_PKEY *key,
379                                  const EVP_MD *digest_type)
380 {
381         unsigned int siglen;
382         ldns_rdf *sigdata_rdf;
383         ldns_buffer *b64sig;
384         EVP_MD_CTX ctx;
385         const EVP_MD *md_type;
386         int r;
387
388         siglen = 0;
389         b64sig = ldns_buffer_new(LDNS_MAX_PACKETLEN);
390         if (!b64sig) {
391                 return NULL;
392         }
393
394         /* initializes a signing context */
395         md_type = digest_type;
396         if(!md_type) {
397                 /* unknown message difest */
398                 ldns_buffer_free(b64sig);
399                 return NULL;
400         }
401
402         EVP_MD_CTX_init(&ctx);
403         r = EVP_SignInit(&ctx, md_type);
404         if(r == 1) {
405                 r = EVP_SignUpdate(&ctx, (unsigned char*)
406                                             ldns_buffer_begin(to_sign),
407                                             ldns_buffer_position(to_sign));
408         } else {
409                 ldns_buffer_free(b64sig);
410                 return NULL;
411         }
412         if(r == 1) {
413                 r = EVP_SignFinal(&ctx, (unsigned char*)
414                                            ldns_buffer_begin(b64sig), &siglen, key);
415         } else {
416                 ldns_buffer_free(b64sig);
417                 return NULL;
418         }
419         if(r != 1) {
420                 ldns_buffer_free(b64sig);
421                 return NULL;
422         }
423
424         /* unfortunately, OpenSSL output is differenct from DNS DSA format */
425         if (EVP_PKEY_type(key->type) == EVP_PKEY_DSA) {
426                 sigdata_rdf = ldns_convert_dsa_rrsig_asn12rdf(b64sig, siglen);
427 #ifdef USE_ECDSA
428         } else if(EVP_PKEY_type(key->type) == EVP_PKEY_EC &&
429                 ldns_pkey_is_ecdsa(key)) {
430                 sigdata_rdf = ldns_convert_ecdsa_rrsig_asn12rdf(b64sig, siglen);
431 #endif
432         } else {
433                 /* ok output for other types is the same */
434                 sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
435                                                                          ldns_buffer_begin(b64sig));
436         }
437         ldns_buffer_free(b64sig);
438         EVP_MD_CTX_cleanup(&ctx);
439         return sigdata_rdf;
440 }
441
442 ldns_rdf *
443 ldns_sign_public_rsasha1(ldns_buffer *to_sign, RSA *key)
444 {
445         unsigned char *sha1_hash;
446         unsigned int siglen;
447         ldns_rdf *sigdata_rdf;
448         ldns_buffer *b64sig;
449         int result;
450
451         siglen = 0;
452         b64sig = ldns_buffer_new(LDNS_MAX_PACKETLEN);
453         if (!b64sig) {
454                 return NULL;
455         }
456
457         sha1_hash = SHA1((unsigned char*)ldns_buffer_begin(to_sign),
458                                   ldns_buffer_position(to_sign), NULL);
459         if (!sha1_hash) {
460                 ldns_buffer_free(b64sig);
461                 return NULL;
462         }
463
464         result = RSA_sign(NID_sha1, sha1_hash, SHA_DIGEST_LENGTH,
465                                    (unsigned char*)ldns_buffer_begin(b64sig),
466                                    &siglen, key);
467         if (result != 1) {
468                 return NULL;
469         }
470
471         if (result != 1) {
472                 return NULL;
473         }
474
475         sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen, 
476                                                                  ldns_buffer_begin(b64sig));
477         ldns_buffer_free(b64sig); /* can't free this buffer ?? */
478         return sigdata_rdf;
479 }
480
481 ldns_rdf *
482 ldns_sign_public_rsamd5(ldns_buffer *to_sign, RSA *key)
483 {
484         unsigned char *md5_hash;
485         unsigned int siglen;
486         ldns_rdf *sigdata_rdf;
487         ldns_buffer *b64sig;
488
489         b64sig = ldns_buffer_new(LDNS_MAX_PACKETLEN);
490         if (!b64sig) {
491                 return NULL;
492         }
493
494         md5_hash = MD5((unsigned char*)ldns_buffer_begin(to_sign),
495                                 ldns_buffer_position(to_sign), NULL);
496         if (!md5_hash) {
497                 ldns_buffer_free(b64sig);
498                 return NULL;
499         }
500
501         RSA_sign(NID_md5, md5_hash, MD5_DIGEST_LENGTH,
502                     (unsigned char*)ldns_buffer_begin(b64sig),
503                     &siglen, key);
504
505         sigdata_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64, siglen,
506                                                                  ldns_buffer_begin(b64sig));
507         ldns_buffer_free(b64sig);
508         return sigdata_rdf;
509 }
510 #endif /* HAVE_SSL */
511
512 static int
513 ldns_dnssec_name_has_only_a(ldns_dnssec_name *cur_name)
514 {
515         ldns_dnssec_rrsets *cur_rrset;
516         cur_rrset = cur_name->rrsets;
517         while (cur_rrset) {
518                 if (cur_rrset->type != LDNS_RR_TYPE_A &&
519                         cur_rrset->type != LDNS_RR_TYPE_AAAA) {
520                         return 0;
521                 } else {
522                         cur_rrset = cur_rrset->next;
523                 }
524         }
525         return 1;
526 }
527
528 ldns_status
529 ldns_dnssec_zone_mark_glue(ldns_dnssec_zone *zone)
530 {
531         ldns_rbnode_t *cur_node;
532         ldns_dnssec_name *cur_name;
533         ldns_rdf *cur_owner, *cur_parent;
534
535         cur_node = ldns_rbtree_first(zone->names);
536         while (cur_node != LDNS_RBTREE_NULL) {
537                 cur_name = (ldns_dnssec_name *) cur_node->data;
538                 cur_node = ldns_rbtree_next(cur_node);
539                 if (ldns_dnssec_name_has_only_a(cur_name)) {
540                         /* assume glue XXX check for zone cur */
541                         cur_owner = ldns_rdf_clone(ldns_rr_owner(
542                                               cur_name->rrsets->rrs->rr));
543                         while (ldns_dname_label_count(cur_owner) >
544                                   ldns_dname_label_count(zone->soa->name)) {
545                                 if (ldns_dnssec_zone_find_rrset(zone,
546                                                                                   cur_owner,
547                                                                                   LDNS_RR_TYPE_NS)) {
548                                         /*
549                                         fprintf(stderr, "[XX] Marking as glue: ");
550                                         ldns_rdf_print(stderr, cur_name->name);
551                                         fprintf(stderr, "\n");
552                                         */
553                                         cur_name->is_glue = true;
554                                 }
555                                 cur_parent = ldns_dname_left_chop(cur_owner);
556                                 ldns_rdf_deep_free(cur_owner);
557                                 cur_owner = cur_parent;
558                         }
559                         ldns_rdf_deep_free(cur_owner);
560                 }
561         }
562         return LDNS_STATUS_OK;
563 }
564
565 ldns_rbnode_t *
566 ldns_dnssec_name_node_next_nonglue(ldns_rbnode_t *node)
567 {
568         ldns_rbnode_t *next_node = NULL;
569         ldns_dnssec_name *next_name = NULL;
570         bool done = false;
571
572         if (node == LDNS_RBTREE_NULL) {
573                 return NULL;
574         }
575         next_node = node;
576         while (!done) {
577                 if (next_node == LDNS_RBTREE_NULL) {
578                         return NULL;
579                 } else {
580                         next_name = (ldns_dnssec_name *)next_node->data;
581                         if (!next_name->is_glue) {
582                                 done = true;
583                         } else {
584                                 next_node = ldns_rbtree_next(next_node);
585                         }
586                 }
587         }
588         return next_node;
589 }
590
591 ldns_status
592 ldns_dnssec_zone_create_nsecs(ldns_dnssec_zone *zone,
593                               ldns_rr_list *new_rrs)
594 {
595
596         ldns_rbnode_t *first_node, *cur_node, *next_node;
597         ldns_dnssec_name *cur_name, *next_name;
598         ldns_rr *nsec_rr;
599         uint32_t nsec_ttl;
600         ldns_dnssec_rrsets *soa;
601
602         /* the TTL of NSEC rrs should be set to the minimum TTL of
603          * the zone SOA (RFC4035 Section 2.3)
604          */
605         soa = ldns_dnssec_name_find_rrset(zone->soa, LDNS_RR_TYPE_SOA);
606
607         /* did the caller actually set it? if not,
608          * fall back to default ttl
609          */
610         if (soa && soa->rrs && soa->rrs->rr) {
611                 nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(
612                                                      soa->rrs->rr, 6));
613         } else {
614                 nsec_ttl = LDNS_DEFAULT_TTL;
615         }
616
617         first_node = ldns_dnssec_name_node_next_nonglue(
618                                ldns_rbtree_first(zone->names));
619         cur_node = first_node;
620         if (cur_node) {
621                 next_node = ldns_dnssec_name_node_next_nonglue(
622                                    ldns_rbtree_next(cur_node));
623         } else {
624                 next_node = NULL;
625         }
626
627         while (cur_node && next_node) {
628                 cur_name = (ldns_dnssec_name *)cur_node->data;
629                 next_name = (ldns_dnssec_name *)next_node->data;
630                 nsec_rr = ldns_dnssec_create_nsec(cur_name,
631                                                   next_name,
632                                                   LDNS_RR_TYPE_NSEC);
633                 ldns_rr_set_ttl(nsec_rr, nsec_ttl);
634                 ldns_dnssec_name_add_rr(cur_name, nsec_rr);
635                 ldns_rr_list_push_rr(new_rrs, nsec_rr);
636                 cur_node = next_node;
637                 if (cur_node) {
638                         next_node = ldns_dnssec_name_node_next_nonglue(
639                                ldns_rbtree_next(cur_node));
640                 }
641         }
642
643         if (cur_node && !next_node) {
644                 cur_name = (ldns_dnssec_name *)cur_node->data;
645                 next_name = (ldns_dnssec_name *)first_node->data;
646                 nsec_rr = ldns_dnssec_create_nsec(cur_name,
647                                                   next_name,
648                                                   LDNS_RR_TYPE_NSEC);
649                 ldns_rr_set_ttl(nsec_rr, nsec_ttl);
650                 ldns_dnssec_name_add_rr(cur_name, nsec_rr);
651                 ldns_rr_list_push_rr(new_rrs, nsec_rr);
652         } else {
653                 printf("error\n");
654         }
655
656         return LDNS_STATUS_OK;
657 }
658
659 #ifdef HAVE_SSL
660 ldns_status
661 ldns_dnssec_zone_create_nsec3s(ldns_dnssec_zone *zone,
662                                                  ldns_rr_list *new_rrs,
663                                                  uint8_t algorithm,
664                                                  uint8_t flags,
665                                                  uint16_t iterations,
666                                                  uint8_t salt_length,
667                                                  uint8_t *salt)
668 {
669         ldns_rbnode_t *first_name_node;
670         ldns_rbnode_t *current_name_node;
671         ldns_dnssec_name *current_name;
672         ldns_status result = LDNS_STATUS_OK;
673         ldns_rr *nsec_rr;
674         ldns_rr_list *nsec3_list;
675         uint32_t nsec_ttl;
676         ldns_dnssec_rrsets *soa;
677
678         if (!zone || !new_rrs || !zone->names) {
679                 return LDNS_STATUS_ERR;
680         }
681
682         /* the TTL of NSEC rrs should be set to the minimum TTL of
683          * the zone SOA (RFC4035 Section 2.3)
684          */
685         soa = ldns_dnssec_name_find_rrset(zone->soa, LDNS_RR_TYPE_SOA);
686
687         /* did the caller actually set it? if not,
688          * fall back to default ttl
689          */
690         if (soa && soa->rrs && soa->rrs->rr) {
691                 nsec_ttl = ldns_rdf2native_int32(ldns_rr_rdf(
692                                                      soa->rrs->rr, 6));
693         } else {
694                 nsec_ttl = LDNS_DEFAULT_TTL;
695         }
696
697         nsec3_list = ldns_rr_list_new();
698
699         first_name_node = ldns_dnssec_name_node_next_nonglue(
700                                           ldns_rbtree_first(zone->names));
701
702         current_name_node = first_name_node;
703
704         while (current_name_node &&
705                current_name_node != LDNS_RBTREE_NULL) {
706                 current_name = (ldns_dnssec_name *) current_name_node->data;
707                 nsec_rr = ldns_dnssec_create_nsec3(current_name,
708                                                    NULL,
709                                                    zone->soa->name,
710                                                    algorithm,
711                                                    flags,
712                                                    iterations,
713                                                    salt_length,
714                                                    salt);
715                 /* by default, our nsec based generator adds rrsigs
716                  * remove the bitmap for empty nonterminals */
717                 if (!current_name->rrsets) {
718                         ldns_rdf_deep_free(ldns_rr_pop_rdf(nsec_rr));
719                 }
720                 ldns_rr_set_ttl(nsec_rr, nsec_ttl);
721                 ldns_dnssec_name_add_rr(current_name, nsec_rr);
722                 ldns_rr_list_push_rr(new_rrs, nsec_rr);
723                 ldns_rr_list_push_rr(nsec3_list, nsec_rr);
724                 current_name_node = ldns_dnssec_name_node_next_nonglue(
725                                    ldns_rbtree_next(current_name_node));
726         }
727
728         ldns_rr_list_sort_nsec3(nsec3_list);
729         ldns_dnssec_chain_nsec3_list(nsec3_list);
730         if (result != LDNS_STATUS_OK) {
731                 return result;
732         }
733
734         ldns_rr_list_free(nsec3_list);
735         return result;
736 }
737 #endif /* HAVE_SSL */
738
739 ldns_dnssec_rrs *
740 ldns_dnssec_remove_signatures(ldns_dnssec_rrs *signatures,
741                                                 ldns_key_list *key_list,
742                                                 int (*func)(ldns_rr *, void *),
743                                                 void *arg)
744 {
745         ldns_dnssec_rrs *base_rrs = signatures;
746         ldns_dnssec_rrs *cur_rr = base_rrs;
747         ldns_dnssec_rrs *prev_rr = NULL;
748         ldns_dnssec_rrs *next_rr;
749
750         uint16_t keytag;
751         size_t i;
752
753         key_list = key_list;
754
755         if (!cur_rr) {
756                 switch(func(NULL, arg)) {
757                 case LDNS_SIGNATURE_LEAVE_ADD_NEW:
758                 case LDNS_SIGNATURE_REMOVE_ADD_NEW:
759                 break;
760                 case LDNS_SIGNATURE_LEAVE_NO_ADD:
761                 case LDNS_SIGNATURE_REMOVE_NO_ADD:
762                 ldns_key_list_set_use(key_list, false);
763                 break;
764                 default:
765                         fprintf(stderr, "[XX] unknown return value from callback\n");
766                         break;
767                 }
768                 return NULL;
769         }
770         (void)func(cur_rr->rr, arg);
771
772         while (cur_rr) {
773                 next_rr = cur_rr->next;
774
775                 switch (func(cur_rr->rr, arg)) {
776                 case  LDNS_SIGNATURE_LEAVE_ADD_NEW:
777                         prev_rr = cur_rr;
778                         break;
779                 case LDNS_SIGNATURE_LEAVE_NO_ADD:
780                         keytag = ldns_rdf2native_int16(
781                                            ldns_rr_rrsig_keytag(cur_rr->rr));
782                         for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
783                                 if (ldns_key_keytag(ldns_key_list_key(key_list, i)) ==
784                                     keytag) {
785                                         ldns_key_set_use(ldns_key_list_key(key_list, i),
786                                                                   false);
787                                 }
788                         }
789                         prev_rr = cur_rr;
790                         break;
791                 case LDNS_SIGNATURE_REMOVE_NO_ADD:
792                         keytag = ldns_rdf2native_int16(
793                                            ldns_rr_rrsig_keytag(cur_rr->rr));
794                         for (i = 0; i < ldns_key_list_key_count(key_list); i++) {
795                                 if (ldns_key_keytag(ldns_key_list_key(key_list, i))
796                                     == keytag) {
797                                         ldns_key_set_use(ldns_key_list_key(key_list, i),
798                                                                   false);
799                                 }
800                         }
801                         if (prev_rr) {
802                                 prev_rr->next = next_rr;
803                         } else {
804                                 base_rrs = next_rr;
805                         }
806                         LDNS_FREE(cur_rr);
807                         break;
808                 case LDNS_SIGNATURE_REMOVE_ADD_NEW:
809                         if (prev_rr) {
810                                 prev_rr->next = next_rr;
811                         } else {
812                                 base_rrs = next_rr;
813                         }
814                         LDNS_FREE(cur_rr);
815                         break;
816                 default:
817                         fprintf(stderr, "[XX] unknown return value from callback\n");
818                         break;
819                 }
820                 cur_rr = next_rr;
821         }
822
823         return base_rrs;
824 }
825
826 #ifdef HAVE_SSL
827 ldns_status
828 ldns_dnssec_zone_create_rrsigs(ldns_dnssec_zone *zone,
829                                ldns_rr_list *new_rrs,
830                                ldns_key_list *key_list,
831                                int (*func)(ldns_rr *, void*),
832                                void *arg)
833 {
834         return ldns_dnssec_zone_create_rrsigs_flg(zone, new_rrs, key_list,
835                 func, arg, 0);
836 }
837
838 /** If there are KSKs use only them and mark ZSKs unused */
839 static void
840 ldns_key_list_filter_for_dnskey(ldns_key_list *key_list)
841 {
842         int saw_ksk = 0;
843         size_t i;
844         for(i=0; i<ldns_key_list_key_count(key_list); i++)
845                 if((ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY)) {
846                         saw_ksk = 1;
847                         break;
848                 }
849         if(!saw_ksk)
850                 return;
851         for(i=0; i<ldns_key_list_key_count(key_list); i++)
852                 if(!(ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY))
853                         ldns_key_set_use(ldns_key_list_key(key_list, i), 0);
854 }
855
856 /** If there are no ZSKs use KSK as ZSK */
857 static void
858 ldns_key_list_filter_for_non_dnskey(ldns_key_list *key_list)
859 {
860         int saw_zsk = 0;
861         size_t i;
862         for(i=0; i<ldns_key_list_key_count(key_list); i++)
863                 if(!(ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY)) {
864                         saw_zsk = 1;
865                         break;
866                 }
867         if(!saw_zsk)
868                 return;
869         /* else filter all KSKs */
870         for(i=0; i<ldns_key_list_key_count(key_list); i++)
871                 if((ldns_key_flags(ldns_key_list_key(key_list, i))&LDNS_KEY_SEP_KEY))
872                         ldns_key_set_use(ldns_key_list_key(key_list, i), 0);
873 }
874
875 ldns_status
876 ldns_dnssec_zone_create_rrsigs_flg(ldns_dnssec_zone *zone,
877                                ldns_rr_list *new_rrs,
878                                ldns_key_list *key_list,
879                                int (*func)(ldns_rr *, void*),
880                                void *arg,
881                                int flags)
882 {
883         ldns_status result = LDNS_STATUS_OK;
884
885         ldns_rbnode_t *cur_node;
886         ldns_rr_list *rr_list;
887
888         ldns_dnssec_name *cur_name;
889         ldns_dnssec_rrsets *cur_rrset;
890         ldns_dnssec_rrs *cur_rr;
891
892         ldns_rr_list *siglist;
893
894         size_t i;
895
896         ldns_rr_list *pubkey_list = ldns_rr_list_new();
897         zone = zone;
898         new_rrs = new_rrs;
899         key_list = key_list;
900         for (i = 0; i<ldns_key_list_key_count(key_list); i++) {
901                 ldns_rr_list_push_rr(pubkey_list,
902                                                  ldns_key2rr(ldns_key_list_key(key_list, i)));
903         }
904         /* TODO: callback to see is list should be signed */
905         /* TODO: remove 'old' signatures from signature list */
906         cur_node = ldns_rbtree_first(zone->names);
907         while (cur_node != LDNS_RBTREE_NULL) {
908                 cur_name = (ldns_dnssec_name *) cur_node->data;
909
910                 if (!cur_name->is_glue) {
911                         cur_rrset = cur_name->rrsets;
912                         while (cur_rrset) {
913                                 /* reset keys to use */
914                                 ldns_key_list_set_use(key_list, true);
915
916                                 /* walk through old sigs, remove the old,
917                                    and mark which keys (not) to use) */
918                                 cur_rrset->signatures =
919                                         ldns_dnssec_remove_signatures(cur_rrset->signatures,
920                                                                                         key_list,
921                                                                                         func,
922                                                                                         arg);
923                                 if(!(flags&LDNS_SIGN_DNSKEY_WITH_ZSK) &&
924                                         cur_rrset->type == LDNS_RR_TYPE_DNSKEY)
925                                         ldns_key_list_filter_for_dnskey(key_list);
926
927                                 if(cur_rrset->type != LDNS_RR_TYPE_DNSKEY)
928                                         ldns_key_list_filter_for_non_dnskey(key_list);
929
930                                 /* TODO: just set count to zero? */
931                                 rr_list = ldns_rr_list_new();
932
933                                 cur_rr = cur_rrset->rrs;
934                                 while (cur_rr) {
935                                         ldns_rr_list_push_rr(rr_list, cur_rr->rr);
936                                         cur_rr = cur_rr->next;
937                                 }
938
939                                 /* only sign non-delegation RRsets */
940                                 /* (glue should have been marked earlier) */
941                                 if ((ldns_rr_list_type(rr_list) != LDNS_RR_TYPE_NS ||
942                                         ldns_dname_compare(ldns_rr_list_owner(rr_list),
943                                         zone->soa->name) == 0) &&
944                                         /* OK, there is also the possibility that the record
945                                          * is glue, but at the same owner name as other records that
946                                          * are not NS nor A/AAAA. Bleh, our current data structure
947                                          * doesn't really support that... */
948                                         !((ldns_rr_list_type(rr_list) == LDNS_RR_TYPE_A ||
949                                          ldns_rr_list_type(rr_list) == LDNS_RR_TYPE_AAAA) &&
950                                          !ldns_dname_compare(ldns_rr_list_owner(rr_list), zone->soa->name) == 0 &&
951                                          ldns_dnssec_zone_find_rrset(zone, ldns_rr_list_owner(rr_list), LDNS_RR_TYPE_NS)
952                                          )) {
953
954                                         siglist = ldns_sign_public(rr_list, key_list);
955                                         for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
956                                                 if (cur_rrset->signatures) {
957                                                         ldns_dnssec_rrs_add_rr(cur_rrset->signatures,
958                                                                                            ldns_rr_list_rr(siglist,
959                                                                                                                     i));
960                                                 } else {
961                                                         cur_rrset->signatures = ldns_dnssec_rrs_new();
962                                                         cur_rrset->signatures->rr =
963                                                                 ldns_rr_list_rr(siglist, i);
964                                                         ldns_rr_list_push_rr(new_rrs,
965                                                                                          ldns_rr_list_rr(siglist,
966                                                                                                                   i));
967                                                 }
968                                         }
969                                         ldns_rr_list_free(siglist);
970                                 }
971
972                                 ldns_rr_list_free(rr_list);
973
974                                 cur_rrset = cur_rrset->next;
975                         }
976
977                         /* sign the nsec */
978                         ldns_key_list_set_use(key_list, true);
979                         cur_name->nsec_signatures =
980                                 ldns_dnssec_remove_signatures(cur_name->nsec_signatures,
981                                                                                 key_list,
982                                                                                 func,
983                                                                                 arg);
984                         ldns_key_list_filter_for_non_dnskey(key_list);
985
986                         rr_list = ldns_rr_list_new();
987                         ldns_rr_list_push_rr(rr_list, cur_name->nsec);
988                         siglist = ldns_sign_public(rr_list, key_list);
989
990                         for (i = 0; i < ldns_rr_list_rr_count(siglist); i++) {
991                                 if (cur_name->nsec_signatures) {
992                                         ldns_dnssec_rrs_add_rr(cur_name->nsec_signatures,
993                                                                            ldns_rr_list_rr(siglist, i));
994                                 } else {
995                                         cur_name->nsec_signatures = ldns_dnssec_rrs_new();
996                                         cur_name->nsec_signatures->rr =
997                                                 ldns_rr_list_rr(siglist, i);
998                                         ldns_rr_list_push_rr(new_rrs,
999                                                                          ldns_rr_list_rr(siglist, i));
1000                                 }
1001                         }
1002
1003                         ldns_rr_list_free(siglist);
1004                         ldns_rr_list_free(rr_list);
1005                 }
1006                 cur_node = ldns_rbtree_next(cur_node);
1007         }
1008
1009         ldns_rr_list_deep_free(pubkey_list);
1010         return result;
1011 }
1012
1013 ldns_status
1014 ldns_dnssec_zone_sign(ldns_dnssec_zone *zone,
1015                                   ldns_rr_list *new_rrs,
1016                                   ldns_key_list *key_list,
1017                                   int (*func)(ldns_rr *, void *),
1018                                   void *arg)
1019 {
1020         return ldns_dnssec_zone_sign_flg(zone, new_rrs, key_list, func, arg, 0);
1021 }
1022
1023 ldns_status
1024 ldns_dnssec_zone_sign_flg(ldns_dnssec_zone *zone,
1025                                   ldns_rr_list *new_rrs,
1026                                   ldns_key_list *key_list,
1027                                   int (*func)(ldns_rr *, void *),
1028                                   void *arg,
1029                                   int flags)
1030 {
1031         ldns_status result = LDNS_STATUS_OK;
1032
1033         if (!zone || !new_rrs || !key_list) {
1034                 return LDNS_STATUS_ERR;
1035         }
1036
1037         /* zone is already sorted */
1038         ldns_dnssec_zone_mark_glue(zone);
1039
1040         /* check whether we need to add nsecs */
1041         if (zone->names && !((ldns_dnssec_name *)zone->names->root->data)->nsec) {
1042                 result = ldns_dnssec_zone_create_nsecs(zone, new_rrs);
1043                 if (result != LDNS_STATUS_OK) {
1044                         return result;
1045                 }
1046         }
1047
1048         result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1049                                         new_rrs,
1050                                         key_list,
1051                                         func,
1052                                         arg,
1053                                         flags);
1054
1055         return result;
1056 }
1057
1058 ldns_status
1059 ldns_dnssec_zone_sign_nsec3(ldns_dnssec_zone *zone,
1060                                            ldns_rr_list *new_rrs,
1061                                            ldns_key_list *key_list,
1062                                            int (*func)(ldns_rr *, void *),
1063                                            void *arg,
1064                                            uint8_t algorithm,
1065                                            uint8_t flags,
1066                                            uint16_t iterations,
1067                                            uint8_t salt_length,
1068                                            uint8_t *salt)
1069 {
1070         return ldns_dnssec_zone_sign_nsec3_flg(zone, new_rrs, key_list,
1071                 func, arg, algorithm, flags, iterations, salt_length, salt, 0);
1072 }
1073
1074 ldns_status
1075 ldns_dnssec_zone_sign_nsec3_flg(ldns_dnssec_zone *zone,
1076                                            ldns_rr_list *new_rrs,
1077                                            ldns_key_list *key_list,
1078                                            int (*func)(ldns_rr *, void *),
1079                                            void *arg,
1080                                            uint8_t algorithm,
1081                                            uint8_t flags,
1082                                            uint16_t iterations,
1083                                            uint8_t salt_length,
1084                                            uint8_t *salt,
1085                                            int signflags)
1086 {
1087         ldns_rr *nsec3, *nsec3params;
1088         ldns_status result = LDNS_STATUS_OK;
1089
1090         /* zone is already sorted */
1091         ldns_dnssec_zone_mark_glue(zone);
1092
1093         /* TODO if there are already nsec3s presents and their
1094          * parameters are the same as these, we don't have to recreate
1095          */
1096         if (zone->names) {
1097                 /* add empty nonterminals */
1098                 ldns_dnssec_zone_add_empty_nonterminals(zone);
1099
1100                 nsec3 = ((ldns_dnssec_name *)zone->names->root->data)->nsec;
1101                 if (nsec3 && ldns_rr_get_type(nsec3) == LDNS_RR_TYPE_NSEC3) {
1102                         /* no need to recreate */
1103                 } else {
1104                         if (!ldns_dnssec_zone_find_rrset(zone,
1105                                                                            zone->soa->name,
1106                                                                            LDNS_RR_TYPE_NSEC3PARAMS)) {
1107                                 /* create and add the nsec3params rr */
1108                                 nsec3params =
1109                                         ldns_rr_new_frm_type(LDNS_RR_TYPE_NSEC3PARAMS);
1110                                 ldns_rr_set_owner(nsec3params,
1111                                                            ldns_rdf_clone(zone->soa->name));
1112                                 ldns_nsec3_add_param_rdfs(nsec3params,
1113                                                                          algorithm,
1114                                                                          flags,
1115                                                                          iterations,
1116                                                                          salt_length,
1117                                                                          salt);
1118                                 /* always set bit 7 of the flags to zero, according to
1119                                  * rfc5155 section 11 */
1120                                 ldns_set_bit(ldns_rdf_data(ldns_rr_rdf(nsec3params, 1)), 7, 0);
1121                                 ldns_dnssec_zone_add_rr(zone, nsec3params);
1122                                 ldns_rr_list_push_rr(new_rrs, nsec3params);
1123                         }
1124                         result = ldns_dnssec_zone_create_nsec3s(zone,
1125                                                                                         new_rrs,
1126                                                                                         algorithm,
1127                                                                                         flags,
1128                                                                                         iterations,
1129                                                                                         salt_length,
1130                                                                                         salt);
1131                         if (result != LDNS_STATUS_OK) {
1132                                 return result;
1133                         }
1134                 }
1135
1136                 result = ldns_dnssec_zone_create_rrsigs_flg(zone,
1137                                                 new_rrs,
1138                                                 key_list,
1139                                                 func,
1140                                                 arg,
1141                                                 signflags);
1142         }
1143
1144         return result;
1145 }
1146
1147
1148 ldns_zone *
1149 ldns_zone_sign(const ldns_zone *zone, ldns_key_list *key_list)
1150 {
1151         ldns_dnssec_zone *dnssec_zone;
1152         ldns_zone *signed_zone;
1153         ldns_rr_list *new_rrs;
1154         size_t i;
1155
1156         signed_zone = ldns_zone_new();
1157         dnssec_zone = ldns_dnssec_zone_new();
1158
1159         (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1160         ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1161
1162         for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1163                 (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1164                                                                  ldns_rr_list_rr(ldns_zone_rrs(zone),
1165                                                                                           i));
1166                 ldns_zone_push_rr(signed_zone,
1167                                            ldns_rr_clone(ldns_rr_list_rr(ldns_zone_rrs(zone),
1168                                                                                            i)));
1169         }
1170
1171         new_rrs = ldns_rr_list_new();
1172         (void) ldns_dnssec_zone_sign(dnssec_zone,
1173                                                     new_rrs,
1174                                                     key_list,
1175                                                     ldns_dnssec_default_replace_signatures,
1176                                                     NULL);
1177
1178         for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1179                 ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1180                                                  ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1181         }
1182
1183         ldns_rr_list_deep_free(new_rrs);
1184         ldns_dnssec_zone_free(dnssec_zone);
1185
1186         return signed_zone;
1187 }
1188
1189 ldns_zone *
1190 ldns_zone_sign_nsec3(ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt)
1191 {
1192         ldns_dnssec_zone *dnssec_zone;
1193         ldns_zone *signed_zone;
1194         ldns_rr_list *new_rrs;
1195         size_t i;
1196
1197         signed_zone = ldns_zone_new();
1198         dnssec_zone = ldns_dnssec_zone_new();
1199
1200         (void) ldns_dnssec_zone_add_rr(dnssec_zone, ldns_zone_soa(zone));
1201         ldns_zone_set_soa(signed_zone, ldns_rr_clone(ldns_zone_soa(zone)));
1202
1203         for (i = 0; i < ldns_rr_list_rr_count(ldns_zone_rrs(zone)); i++) {
1204                 (void) ldns_dnssec_zone_add_rr(dnssec_zone,
1205                                                                  ldns_rr_list_rr(ldns_zone_rrs(zone),
1206                                                                                           i));
1207                 ldns_zone_push_rr(signed_zone, 
1208                                            ldns_rr_clone(ldns_rr_list_rr(ldns_zone_rrs(zone),
1209                                                                                            i)));
1210         }
1211
1212         new_rrs = ldns_rr_list_new();
1213         (void) ldns_dnssec_zone_sign_nsec3(dnssec_zone,
1214                                                                 new_rrs,
1215                                                                 key_list,
1216                                                                 ldns_dnssec_default_replace_signatures,
1217                                                                 NULL,
1218                                                                 algorithm,
1219                                                                 flags,
1220                                                                 iterations,
1221                                                                 salt_length,
1222                                                                 salt);
1223
1224         for (i = 0; i < ldns_rr_list_rr_count(new_rrs); i++) {
1225                 ldns_rr_list_push_rr(ldns_zone_rrs(signed_zone),
1226                                                  ldns_rr_clone(ldns_rr_list_rr(new_rrs, i)));
1227         }
1228
1229         ldns_rr_list_deep_free(new_rrs);
1230         ldns_dnssec_zone_free(dnssec_zone);
1231
1232         return signed_zone;
1233 }
1234 #endif /* HAVE_SSL */
1235