Go to the source code of this file.
Macros | |
| #define | LDNS_SIGN_DNSKEY_WITH_ZSK 1 |
| dnssec_verify More... | |
| #define | LDNS_SIGN_WITH_ALL_ALGORITHMS 2 |
| #define | LDNS_SIGN_NO_KEYS_NO_NSECS 4 |
| #define | LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA384 8 |
| #define | LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA512 16 |
Functions | |
| ldns_rr * | ldns_create_empty_rrsig (const ldns_rr_list *rrset, const ldns_key *key) |
| Create an empty RRSIG RR (i.e. More... | |
| ldns_rdf * | ldns_sign_public_buffer (ldns_buffer *sign_buf, ldns_key *key) |
| Sign the buffer which contains the wiredata of an rrset, and the corresponding empty rrsig rr with the given key. More... | |
| ldns_rr_list * | ldns_sign_public (ldns_rr_list *rrset, ldns_key_list *keys) |
| Sign an rrset. More... | |
| ldns_rdf * | ldns_sign_public_dsa (ldns_buffer *to_sign, DSA *key) |
| Sign a buffer with the DSA key (hash with SHA1) More... | |
| ldns_rdf * | ldns_sign_public_evp (ldns_buffer *to_sign, EVP_PKEY *key, const EVP_MD *digest_type) |
| Sign data with EVP (general method for different algorithms) More... | |
| ldns_rdf * | ldns_sign_public_rsasha1 (ldns_buffer *to_sign, RSA *key) |
| Sign a buffer with the RSA key (hash with SHA1) More... | |
| ldns_rdf * | ldns_sign_public_rsamd5 (ldns_buffer *to_sign, RSA *key) |
| Sign a buffer with the RSA key (hash with MD5) More... | |
| ldns_status | ldns_dnssec_zone_mark_and_get_glue (ldns_dnssec_zone *zone, ldns_rr_list *glue_list) |
| Marks the names in the zone that are occluded. More... | |
| ldns_status | ldns_dnssec_zone_mark_glue (ldns_dnssec_zone *zone) |
| Marks the names in the zone that are occluded. More... | |
| ldns_rbnode_t * | ldns_dnssec_name_node_next_nonglue (ldns_rbnode_t *node) |
| Finds the first dnssec_name node in the rbtree that is not occluded. More... | |
| ldns_status | ldns_dnssec_zone_create_nsecs (ldns_dnssec_zone *zone, ldns_rr_list *new_rrs) |
| Adds NSEC records to the given dnssec_zone. More... | |
| ldns_status | ldns_dnssec_zone_create_nsec3s (ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt) |
| Adds NSEC3 records to the zone. More... | |
| ldns_dnssec_rrs * | ldns_dnssec_remove_signatures (ldns_dnssec_rrs *signatures, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg) |
| remove signatures if callback function tells to More... | |
| ldns_status | ldns_dnssec_zone_create_rrsigs_flg (ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags) |
| Adds signatures to the zone. More... | |
| ldns_status | ldns_dnssec_zone_create_rrsigs (ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg) |
| Adds signatures to the zone. More... | |
| ldns_status | ldns_dnssec_zone_sign_flg (ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, int flags) |
| signs the given zone with the given keys More... | |
| ldns_status | ldns_dnssec_zone_sign_nsec3_flg (ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags) |
| signs the given zone with the given new zone, with NSEC3 More... | |
| ldns_status | ldns_dnssec_zone_sign_nsec3_flg_mkmap (ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt, int signflags, ldns_rbtree_t **map) |
| signs the given zone with the given new zone, with NSEC3 More... | |
| ldns_status | ldns_dnssec_zone_sign (ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg) |
| signs the given zone with the given keys More... | |
| ldns_status | ldns_dnssec_zone_sign_nsec3 (ldns_dnssec_zone *zone, ldns_rr_list *new_rrs, ldns_key_list *key_list, int(*func)(ldns_rr *, void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt) |
| signs the given zone with the given new zone, with NSEC3 More... | |
| ldns_zone * | ldns_zone_sign (const ldns_zone *zone, ldns_key_list *key_list) |
| Signs the zone, and returns a newly allocated signed zone. More... | |
| ldns_zone * | ldns_zone_sign_nsec3 (ldns_zone *zone, ldns_key_list *key_list, uint8_t algorithm, uint8_t flags, uint16_t iterations, uint8_t salt_length, uint8_t *salt) |
| Signs the zone with NSEC3, and returns a newly allocated signed zone. More... | |
| #define LDNS_SIGN_DNSKEY_WITH_ZSK 1 |
dnssec_verify
Sign flag that makes DNSKEY type signed by all keys, not only by SEP keys
Definition at line 15 of file dnssec_sign.h.
| #define LDNS_SIGN_WITH_ALL_ALGORITHMS 2 |
Definition at line 16 of file dnssec_sign.h.
| #define LDNS_SIGN_NO_KEYS_NO_NSECS 4 |
Definition at line 17 of file dnssec_sign.h.
| #define LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA384 8 |
Definition at line 18 of file dnssec_sign.h.
| #define LDNS_SIGN_WITH_ZONEMD_SIMPLE_SHA512 16 |
Definition at line 19 of file dnssec_sign.h.
| ldns_rr* ldns_create_empty_rrsig | ( | const ldns_rr_list * | rrset, |
| const ldns_key * | key | ||
| ) |
Create an empty RRSIG RR (i.e.
without the actual signature data)
| [in] | rrset | The RRset to create the signature for |
| [in] | key | The key that will create the signature |
Definition at line 31 of file dnssec_sign.c.
References LDNS_DEFAULT_EXP_TIME, ldns_dname2canonical(), ldns_dname_is_wildcard(), ldns_dname_label_count(), ldns_key_algorithm(), ldns_key_expiration(), ldns_key_inception(), ldns_key_keytag(), ldns_key_pubkey_owner(), ldns_native2rdf_int16(), ldns_native2rdf_int32(), ldns_native2rdf_int8(), ldns_rdf_clone(), LDNS_RDF_TYPE_ALG, LDNS_RDF_TYPE_INT16, LDNS_RDF_TYPE_INT32, LDNS_RDF_TYPE_INT8, LDNS_RDF_TYPE_TIME, LDNS_RDF_TYPE_TYPE, ldns_rr_get_class(), ldns_rr_get_type(), ldns_rr_list_rr(), ldns_rr_new_frm_type(), ldns_rr_owner(), ldns_rr_rrsig_set_algorithm(), ldns_rr_rrsig_set_expiration(), ldns_rr_rrsig_set_inception(), ldns_rr_rrsig_set_keytag(), ldns_rr_rrsig_set_labels(), ldns_rr_rrsig_set_origttl(), ldns_rr_rrsig_set_signame(), ldns_rr_rrsig_set_typecovered(), ldns_rr_set_class(), ldns_rr_set_owner(), ldns_rr_set_ttl(), ldns_rr_ttl(), and LDNS_RR_TYPE_RRSIG.
| ldns_rdf* ldns_sign_public_buffer | ( | ldns_buffer * | sign_buf, |
| ldns_key * | key | ||
| ) |
Sign the buffer which contains the wiredata of an rrset, and the corresponding empty rrsig rr with the given key.
| [in] | sign_buf | the buffer with data to sign |
| [in] | key | the key to sign with |
Definition at line 128 of file dnssec_sign.c.
References ldns_key_algorithm(), ldns_key_evp_key(), LDNS_SIGN_DSA, LDNS_SIGN_DSA_NSEC3, LDNS_SIGN_ECC_GOST, LDNS_SIGN_ECDSAP256SHA256, LDNS_SIGN_ECDSAP384SHA384, LDNS_SIGN_ED25519, LDNS_SIGN_ED448, ldns_sign_public_evp(), LDNS_SIGN_RSAMD5, LDNS_SIGN_RSASHA1, LDNS_SIGN_RSASHA1_NSEC3, LDNS_SIGN_RSASHA256, and LDNS_SIGN_RSASHA512.
| ldns_rr_list* ldns_sign_public | ( | ldns_rr_list * | rrset, |
| ldns_key_list * | keys | ||
| ) |
Sign an rrset.
| [in] | rrset | the rrset |
| [in] | keys | the keys to use |
Sign an rrset.
Definition at line 227 of file dnssec_sign.c.
References ldns_buffer_free(), ldns_buffer_new(), ldns_create_empty_rrsig(), ldns_key_flags(), ldns_key_list_key(), ldns_key_list_key_count(), ldns_key_use(), LDNS_KEY_ZONE_KEY, LDNS_MAX_PACKETLEN, ldns_rdf_free(), ldns_rr2canonical(), ldns_rr_free(), ldns_rr_list2buffer_wire(), ldns_rr_list_clone(), ldns_rr_list_deep_free(), ldns_rr_list_free(), ldns_rr_list_new(), ldns_rr_list_push_rr(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_rr_list_sort(), ldns_rr_rrsig_set_sig(), ldns_rr_set_ttl(), ldns_rr_ttl(), ldns_rrsig2buffer_wire(), ldns_sign_public_buffer(), and LDNS_STATUS_OK.
| ldns_rdf* ldns_sign_public_dsa | ( | ldns_buffer * | to_sign, |
| DSA * | key | ||
| ) |
Sign a buffer with the DSA key (hash with SHA1)
| [in] | to_sign | The ldns_buffer containing raw data that is to be signed |
| [in] | key | The DSA key structure to sign with |
Definition at line 332 of file dnssec_sign.c.
References ldns_buffer_new(), LDNS_MAX_PACKETLEN, and R.
| ldns_rdf* ldns_sign_public_evp | ( | ldns_buffer * | to_sign, |
| EVP_PKEY * | key, | ||
| const EVP_MD * | digest_type | ||
| ) |
Sign data with EVP (general method for different algorithms)
| [in] | to_sign | The ldns_buffer containing raw data that is to be signed |
| [in] | key | The EVP_PKEY key structure to sign with |
| [in] | digest_type | The digest algorithm to use in the creation of the signature |
Definition at line 443 of file dnssec_sign.c.
References ldns_buffer_free(), ldns_buffer_new(), and LDNS_MAX_PACKETLEN.
| ldns_rdf* ldns_sign_public_rsasha1 | ( | ldns_buffer * | to_sign, |
| RSA * | key | ||
| ) |
Sign a buffer with the RSA key (hash with SHA1)
| [in] | to_sign | buffer with the data |
| [in] | key | the key to use |
Definition at line 572 of file dnssec_sign.c.
References ldns_buffer_new(), and LDNS_MAX_PACKETLEN.
| ldns_rdf* ldns_sign_public_rsamd5 | ( | ldns_buffer * | to_sign, |
| RSA * | key | ||
| ) |
Sign a buffer with the RSA key (hash with MD5)
| [in] | to_sign | buffer with the data |
| [in] | key | the key to use |
Definition at line 608 of file dnssec_sign.c.
References ldns_buffer_new(), and LDNS_MAX_PACKETLEN.
| ldns_status ldns_dnssec_zone_mark_and_get_glue | ( | ldns_dnssec_zone * | zone, |
| ldns_rr_list * | glue_list | ||
| ) |
Marks the names in the zone that are occluded.
Those names will be skipped when walking the tree with the ldns_dnssec_name_node_next_nonglue() function. But watch out! Names that are partially occluded (like glue with the same name as the delegation) will not be marked and should specifically be taken into account separately.
When glue_list is given (not NULL), in the process of marking the names, all glue resource records will be pushed to that list, even glue at the delegation name.
| [in] | zone | the zone in which to mark the names |
| [in] | glue_list | the list to which to push the glue rrs |
Definition at line 672 of file dnssec_sign.c.
References ldns_rbnode_t::data, ldns_dname_is_subdomain(), ldns_dnssec_name_name(), ldns_dnssec_rrsets_contains_type(), ldns_rbtree_first(), ldns_rbtree_next(), LDNS_RBTREE_NULL, LDNS_RR_TYPE_SOA, LDNS_STATUS_NULL, ldns_struct_dnssec_zone::names, and ldns_struct_dnssec_name::rrsets.
| ldns_status ldns_dnssec_zone_mark_glue | ( | ldns_dnssec_zone * | zone | ) |
Marks the names in the zone that are occluded.
Those names will be skipped when walking the tree with the ldns_dnssec_name_node_next_nonglue() function. But watch out! Names that are partially occluded (like glue with the same name as the delegation) will not be marked and should specifically be taken into account separately.
| [in] | zone | the zone in which to mark the names |
Definition at line 751 of file dnssec_sign.c.
References ldns_dnssec_zone_mark_and_get_glue().
| ldns_rbnode_t* ldns_dnssec_name_node_next_nonglue | ( | ldns_rbnode_t * | node | ) |
Finds the first dnssec_name node in the rbtree that is not occluded.
It does return names that are partially occluded.
| [in] | node | the first node to check |
Definition at line 757 of file dnssec_sign.c.
References ldns_rbnode_t::data, ldns_struct_dnssec_name::is_glue, ldns_rbtree_next(), and LDNS_RBTREE_NULL.
| ldns_status ldns_dnssec_zone_create_nsecs | ( | ldns_dnssec_zone * | zone, |
| ldns_rr_list * | new_rrs | ||
| ) |
Adds NSEC records to the given dnssec_zone.
| [in] | zone | the zone to add the records to |
| [in] | new_rrs | ldns_rr's created by this function are added to this rr list, so the caller can free them later |
Definition at line 783 of file dnssec_sign.c.
References ldns_rbnode_t::data, LDNS_DEFAULT_TTL, ldns_dnssec_create_nsec(), ldns_dnssec_name_add_rr(), ldns_dnssec_name_find_rrset(), ldns_dnssec_name_node_next_nonglue(), ldns_rbtree_first(), ldns_rbtree_next(), ldns_rdf2native_int32(), ldns_rr_free(), ldns_rr_list_push_rr(), ldns_rr_rdf(), ldns_rr_set_ttl(), ldns_rr_ttl(), LDNS_RR_TYPE_NSEC, LDNS_RR_TYPE_SOA, LDNS_STATUS_ERR, LDNS_STATUS_OK, ldns_struct_dnssec_zone::names, ldns_struct_dnssec_rrs::rr, ldns_struct_dnssec_rrsets::rrs, and ldns_struct_dnssec_zone::soa.
| ldns_status ldns_dnssec_zone_create_nsec3s | ( | ldns_dnssec_zone * | zone, |
| ldns_rr_list * | new_rrs, | ||
| uint8_t | algorithm, | ||
| uint8_t | flags, | ||
| uint16_t | iterations, | ||
| uint8_t | salt_length, | ||
| uint8_t * | salt | ||
| ) |
Adds NSEC3 records to the zone.
Definition at line 1004 of file dnssec_sign.c.
| ldns_dnssec_rrs* ldns_dnssec_remove_signatures | ( | ldns_dnssec_rrs * | signatures, |
| ldns_key_list * | key_list, | ||
| int(*)(ldns_rr *, void *) | func, | ||
| void * | arg | ||
| ) |
remove signatures if callback function tells to
| [in] | signatures | list of signatures to check, and possibly remove, depending on the value of the callback |
| [in] | key_list | these are marked to be used or not, on the return value of the callback |
| [in] | func | this function is called to specify what to do with each signature (and corresponding key) |
| [in] | arg | Optional argument for the callback function |
| ldns_status ldns_dnssec_zone_create_rrsigs_flg | ( | ldns_dnssec_zone * | zone, |
| ldns_rr_list * | new_rrs, | ||
| ldns_key_list * | key_list, | ||
| int(*)(ldns_rr *, void *) | func, | ||
| void * | arg, | ||
| int | flags | ||
| ) |
Adds signatures to the zone.
| [in] | zone | the zone to add RRSIG Resource Records to |
| [in] | new_rrs | the RRSIG RRs that are created are also added to this list, so the caller can free them later |
| [in] | key_list | list of keys to sign with. |
| [in] | func | Callback function to decide what keys to use and what to do with old signatures |
| [in] | arg | Optional argument for the callback function |
| [in] | flags | option flags for signing process. 0 makes DNSKEY RRset signed with the minimal key set, that is only SEP keys are used for signing. If there are no SEP keys available, non-SEP keys will be used. LDNS_SIGN_DNSKEY_WITH_ZSK makes DNSKEY type signed with all keys. 0 is the default. |
Definition at line 1215 of file dnssec_sign.c.
References ldns_rbnode_t::data, ldns_struct_dnssec_name::is_glue, ldns_dnssec_remove_signatures(), ldns_dnssec_rrsets_contains_type(), ldns_key2rr(), ldns_key_list_key(), ldns_key_list_key_count(), ldns_key_list_set_use(), ldns_rbtree_first(), LDNS_RBTREE_NULL, ldns_rr_list_new(), ldns_rr_list_push_rr(), LDNS_RR_TYPE_CDNSKEY, LDNS_RR_TYPE_CDS, LDNS_RR_TYPE_DNSKEY, LDNS_RR_TYPE_NS, LDNS_RR_TYPE_SOA, LDNS_SIGN_DNSKEY_WITH_ZSK, LDNS_STATUS_OK, ldns_struct_dnssec_zone::names, ldns_struct_dnssec_name::rrsets, ldns_struct_dnssec_rrsets::signatures, and ldns_struct_dnssec_rrsets::type.
| ldns_status ldns_dnssec_zone_create_rrsigs | ( | ldns_dnssec_zone * | zone, |
| ldns_rr_list * | new_rrs, | ||
| ldns_key_list * | key_list, | ||
| int(*)(ldns_rr *, void *) | func, | ||
| void * | arg | ||
| ) |
Adds signatures to the zone.
| [in] | zone | the zone to add RRSIG Resource Records to |
| [in] | new_rrs | the RRSIG RRs that are created are also added to this list, so the caller can free them later |
| [in] | key_list | list of keys to sign with. |
| [in] | func | Callback function to decide what keys to use and what to do with old signatures |
| [in] | arg | Optional argument for the callback function |
Definition at line 1110 of file dnssec_sign.c.
References ldns_dnssec_zone_create_rrsigs_flg().
| ldns_status ldns_dnssec_zone_sign_flg | ( | ldns_dnssec_zone * | zone, |
| ldns_rr_list * | new_rrs, | ||
| ldns_key_list * | key_list, | ||
| int(*)(ldns_rr *, void *) | func, | ||
| void * | arg, | ||
| int | flags | ||
| ) |
signs the given zone with the given keys
| [in] | zone | the zone to sign |
| [in] | key_list | the list of keys to sign the zone with |
| [in] | new_rrs | newly created resource records are added to this list, to free them later |
| [in] | func | callback function that decides what to do with old signatures This function takes an ldns_rr* and an optional void *arg argument, and returns one of four values: LDNS_SIGNATURE_LEAVE_ADD_NEW: leave the signature and add a new one for the corresponding key LDNS_SIGNATURE_REMOVE_ADD_NEW: remove the signature and replace is with a new one from the same key LDNS_SIGNATURE_LEAVE_NO_ADD: leave the signature and do not add a new one with the corresponding key LDNS_SIGNATURE_REMOVE_NO_ADD: remove the signature and do not replace |
| [in] | arg | optional argument for the callback function |
| [in] | flags | option flags for signing process. 0 makes DNSKEY RRset signed with the minimal key set, that is only SEP keys are used for signing. If there are no SEP keys available, non-SEP keys will be used. LDNS_SIGN_DNSKEY_WITH_ZSK makes DNSKEY type signed with all keys. 0 is the default. |
Definition at line 1373 of file dnssec_sign.c.
References ldns_rbnode_t::data, dnssec_zone_equip_zonemd(), ldns_dnssec_zone_create_nsecs(), ldns_dnssec_zone_create_rrsigs_flg(), ldns_dnssec_zone_mark_glue(), ldns_key_list_key_count(), LDNS_RR_TYPE_ZONEMD, LDNS_SIGN_NO_KEYS_NO_NSECS, LDNS_SIGN_WITH_ZONEMD, LDNS_STATUS_ERR, LDNS_STATUS_OK, ldns_struct_dnssec_zone::names, ldns_struct_dnssec_rrsets::next, ldns_rbtree_t::root, ldns_struct_dnssec_rrsets::rrs, ldns_struct_dnssec_name::rrsets, ldns_struct_dnssec_rrsets::signatures, ldns_struct_dnssec_zone::soa, and ldns_struct_dnssec_rrsets::type.
| ldns_status ldns_dnssec_zone_sign_nsec3_flg | ( | ldns_dnssec_zone * | zone, |
| ldns_rr_list * | new_rrs, | ||
| ldns_key_list * | key_list, | ||
| int(*)(ldns_rr *, void *) | func, | ||
| void * | arg, | ||
| uint8_t | algorithm, | ||
| uint8_t | flags, | ||
| uint16_t | iterations, | ||
| uint8_t | salt_length, | ||
| uint8_t * | salt, | ||
| int | signflags | ||
| ) |
signs the given zone with the given new zone, with NSEC3
| [in] | zone | the zone to sign |
| [in] | key_list | the list of keys to sign the zone with |
| [in] | new_rrs | newly created resource records are added to this list, to free them later |
| [in] | func | callback function that decides what to do with old signatures |
| [in] | arg | optional argument for the callback function |
| [in] | algorithm | the NSEC3 hashing algorithm to use |
| [in] | flags | NSEC3 flags |
| [in] | iterations | the number of NSEC3 hash iterations to use |
| [in] | salt_length | the length (in octets) of the NSEC3 salt |
| [in] | salt | the NSEC3 salt data |
| [in] | signflags | option flags for signing process. 0 is the default. |
Definition at line 1583 of file dnssec_sign.c.
References ldns_dnssec_zone_sign_nsec3_flg_mkmap().
| ldns_status ldns_dnssec_zone_sign_nsec3_flg_mkmap | ( | ldns_dnssec_zone * | zone, |
| ldns_rr_list * | new_rrs, | ||
| ldns_key_list * | key_list, | ||
| int(*)(ldns_rr *, void *) | func, | ||
| void * | arg, | ||
| uint8_t | algorithm, | ||
| uint8_t | flags, | ||
| uint16_t | iterations, | ||
| uint8_t | salt_length, | ||
| uint8_t * | salt, | ||
| int | signflags, | ||
| ldns_rbtree_t ** | map | ||
| ) |
signs the given zone with the given new zone, with NSEC3
| [in] | zone | the zone to sign |
| [in] | key_list | the list of keys to sign the zone with |
| [in] | new_rrs | newly created resource records are added to this list, to free them later |
| [in] | func | callback function that decides what to do with old signatures |
| [in] | arg | optional argument for the callback function |
| [in] | algorithm | the NSEC3 hashing algorithm to use |
| [in] | flags | NSEC3 flags |
| [in] | iterations | the number of NSEC3 hash iterations to use |
| [in] | salt_length | the length (in octets) of the NSEC3 salt |
| [in] | salt | the NSEC3 salt data |
| [in] | signflags | option flags for signing process. 0 is the default. |
| [out] | map | a referenced rbtree pointer variable. The newly created rbtree will contain mappings from hashed owner names to the unhashed name. |
Definition at line 1460 of file dnssec_sign.c.
References ldns_rbnode_t::data, ldns_dnssec_zone_add_empty_nonterminals(), ldns_dnssec_zone_add_rr(), ldns_dnssec_zone_find_rrset(), ldns_dnssec_zone_mark_glue(), ldns_key_list_key_count(), ldns_nsec3_add_param_rdfs(), ldns_rdf_clone(), ldns_rdf_data(), ldns_rr_get_type(), ldns_rr_list_push_rr(), ldns_rr_new_frm_type(), ldns_rr_rdf(), ldns_rr_set_owner(), LDNS_RR_TYPE_NSEC3, LDNS_RR_TYPE_NSEC3PARAM, LDNS_RR_TYPE_ZONEMD, ldns_set_bit(), LDNS_SIGN_NO_KEYS_NO_NSECS, LDNS_SIGN_WITH_ZONEMD, LDNS_STATUS_OK, ldns_struct_dnssec_name::name, ldns_struct_dnssec_zone::names, ldns_struct_dnssec_rrsets::next, ldns_rbtree_t::root, ldns_struct_dnssec_rrsets::rrs, ldns_struct_dnssec_name::rrsets, ldns_struct_dnssec_rrsets::signatures, ldns_struct_dnssec_zone::soa, and ldns_struct_dnssec_rrsets::type.
| ldns_status ldns_dnssec_zone_sign | ( | ldns_dnssec_zone * | zone, |
| ldns_rr_list * | new_rrs, | ||
| ldns_key_list * | key_list, | ||
| int(*)(ldns_rr *, void *) | func, | ||
| void * | arg | ||
| ) |
signs the given zone with the given keys
| [in] | zone | the zone to sign |
| [in] | key_list | the list of keys to sign the zone with |
| [in] | new_rrs | newly created resource records are added to this list, to free them later |
| [in] | func | callback function that decides what to do with old signatures This function takes an ldns_rr* and an optional void *arg argument, and returns one of four values: LDNS_SIGNATURE_LEAVE_ADD_NEW: leave the signature and add a new one for the corresponding key LDNS_SIGNATURE_REMOVE_ADD_NEW: remove the signature and replace is with a new one from the same key LDNS_SIGNATURE_LEAVE_NO_ADD: leave the signature and do not add a new one with the corresponding key LDNS_SIGNATURE_REMOVE_NO_ADD: remove the signature and do not replace |
| [in] | arg | optional argument for the callback function |
Definition at line 1361 of file dnssec_sign.c.
References ldns_dnssec_zone_sign_flg().
| ldns_status ldns_dnssec_zone_sign_nsec3 | ( | ldns_dnssec_zone * | zone, |
| ldns_rr_list * | new_rrs, | ||
| ldns_key_list * | key_list, | ||
| int(*)(ldns_rr *, void *) | func, | ||
| void * | arg, | ||
| uint8_t | algorithm, | ||
| uint8_t | flags, | ||
| uint16_t | iterations, | ||
| uint8_t | salt_length, | ||
| uint8_t * | salt | ||
| ) |
signs the given zone with the given new zone, with NSEC3
| [in] | zone | the zone to sign |
| [in] | key_list | the list of keys to sign the zone with |
| [in] | new_rrs | newly created resource records are added to this list, to free them later |
| [in] | func | callback function that decides what to do with old signatures |
| [in] | arg | optional argument for the callback function |
| [in] | algorithm | the NSEC3 hashing algorithm to use |
| [in] | flags | NSEC3 flags |
| [in] | iterations | the number of NSEC3 hash iterations to use |
| [in] | salt_length | the length (in octets) of the NSEC3 salt |
| [in] | salt | the NSEC3 salt data |
Definition at line 1443 of file dnssec_sign.c.
References ldns_dnssec_zone_sign_nsec3_flg_mkmap().
| ldns_zone* ldns_zone_sign | ( | const ldns_zone * | zone, |
| ldns_key_list * | key_list | ||
| ) |
Signs the zone, and returns a newly allocated signed zone.
| [in] | zone | the zone to sign |
| [in] | key_list | list of keys to sign with |
Definition at line 1601 of file dnssec_sign.c.
References ldns_dnssec_default_replace_signatures(), ldns_dnssec_zone_add_rr(), ldns_dnssec_zone_free(), ldns_dnssec_zone_new(), ldns_dnssec_zone_sign(), ldns_rr_clone(), ldns_rr_list_deep_free(), ldns_rr_list_new(), ldns_rr_list_push_rr(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_zone_new(), ldns_zone_push_rr(), ldns_zone_rrs(), ldns_zone_set_soa(), and ldns_zone_soa().
| ldns_zone* ldns_zone_sign_nsec3 | ( | ldns_zone * | zone, |
| ldns_key_list * | key_list, | ||
| uint8_t | algorithm, | ||
| uint8_t | flags, | ||
| uint16_t | iterations, | ||
| uint8_t | salt_length, | ||
| uint8_t * | salt | ||
| ) |
Signs the zone with NSEC3, and returns a newly allocated signed zone.
| [in] | zone | the zone to sign |
| [in] | key_list | list of keys to sign with |
| [in] | algorithm | the NSEC3 hashing algorithm to use |
| [in] | flags | NSEC3 flags |
| [in] | iterations | the number of NSEC3 hash iterations to use |
| [in] | salt_length | the length (in octets) of the NSEC3 salt |
| [in] | salt | the NSEC3 salt data |
Definition at line 1642 of file dnssec_sign.c.
References ldns_dnssec_default_replace_signatures(), ldns_dnssec_zone_add_rr(), ldns_dnssec_zone_free(), ldns_dnssec_zone_new(), ldns_dnssec_zone_sign_nsec3(), ldns_rr_clone(), ldns_rr_list_deep_free(), ldns_rr_list_new(), ldns_rr_list_push_rr(), ldns_rr_list_rr(), ldns_rr_list_rr_count(), ldns_zone_new(), ldns_zone_push_rr(), ldns_zone_rrs(), ldns_zone_set_soa(), and ldns_zone_soa().