00001
00003 #ifndef LDNS_DNSSEC_VERIFY_H
00004 #define LDNS_DNSSEC_VERIFY_H
00005
00006 #define LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS 10
00007
00008 #include <ldns/dnssec.h>
00009 #include <ldns/host2str.h>
00010
00011 #ifdef __cplusplus
00012 extern "C" {
00013 #endif
00014
00019 typedef struct ldns_dnssec_data_chain_struct ldns_dnssec_data_chain;
00020 struct ldns_dnssec_data_chain_struct
00021 {
00022 ldns_rr_list *rrset;
00023 ldns_rr_list *signatures;
00024 ldns_rr_type parent_type;
00025 ldns_dnssec_data_chain *parent;
00026 ldns_pkt_rcode packet_rcode;
00027 ldns_rr_type packet_qtype;
00028 bool packet_nodata;
00029 };
00030
00035 ldns_dnssec_data_chain *ldns_dnssec_data_chain_new();
00036
00042 void ldns_dnssec_data_chain_free(ldns_dnssec_data_chain *chain);
00043
00050 void ldns_dnssec_data_chain_deep_free(ldns_dnssec_data_chain *chain);
00051
00058 void ldns_dnssec_data_chain_print(FILE *out, const ldns_dnssec_data_chain *chain);
00059
00067 void ldns_dnssec_data_chain_print_fmt(FILE *out,
00068 const ldns_output_format *fmt,
00069 const ldns_dnssec_data_chain *chain);
00070
00086 ldns_dnssec_data_chain *ldns_dnssec_build_data_chain(ldns_resolver *res,
00087 const uint16_t qflags,
00088 const ldns_rr_list *data_set,
00089 const ldns_pkt *pkt,
00090 ldns_rr *orig_rr);
00091
00121 typedef struct ldns_dnssec_trust_tree_struct ldns_dnssec_trust_tree;
00122 struct ldns_dnssec_trust_tree_struct
00123 {
00124 ldns_rr *rr;
00125
00126 ldns_rr_list *rrset;
00127 ldns_dnssec_trust_tree *parents[LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS];
00128 ldns_status parent_status[LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS];
00131 ldns_rr *parent_signature[LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS];
00132 size_t parent_count;
00133 };
00134
00140 ldns_dnssec_trust_tree *ldns_dnssec_trust_tree_new();
00141
00150 void ldns_dnssec_trust_tree_free(ldns_dnssec_trust_tree *tree);
00151
00158 size_t ldns_dnssec_trust_tree_depth(ldns_dnssec_trust_tree *tree);
00159
00172 void ldns_dnssec_trust_tree_print(FILE *out,
00173 ldns_dnssec_trust_tree *tree,
00174 size_t tabs,
00175 bool extended);
00176
00190 void ldns_dnssec_trust_tree_print_fmt(FILE *out,
00191 const ldns_output_format *fmt,
00192 ldns_dnssec_trust_tree *tree,
00193 size_t tabs,
00194 bool extended);
00195
00206 ldns_status ldns_dnssec_trust_tree_add_parent(ldns_dnssec_trust_tree *tree,
00207 const ldns_dnssec_trust_tree *parent,
00208 const ldns_rr *parent_signature,
00209 const ldns_status parent_status);
00210
00222 ldns_dnssec_trust_tree *ldns_dnssec_derive_trust_tree(
00223 ldns_dnssec_data_chain *data_chain,
00224 ldns_rr *rr);
00225
00238 ldns_dnssec_trust_tree *ldns_dnssec_derive_trust_tree_time(
00239 ldns_dnssec_data_chain *data_chain,
00240 ldns_rr *rr, time_t check_time);
00241
00249 void ldns_dnssec_derive_trust_tree_normal_rrset(
00250 ldns_dnssec_trust_tree *new_tree,
00251 ldns_dnssec_data_chain *data_chain,
00252 ldns_rr *cur_sig_rr);
00253
00262 void ldns_dnssec_derive_trust_tree_normal_rrset_time(
00263 ldns_dnssec_trust_tree *new_tree,
00264 ldns_dnssec_data_chain *data_chain,
00265 ldns_rr *cur_sig_rr, time_t check_time);
00266
00267
00276 void ldns_dnssec_derive_trust_tree_dnskey_rrset(
00277 ldns_dnssec_trust_tree *new_tree,
00278 ldns_dnssec_data_chain *data_chain,
00279 ldns_rr *cur_rr,
00280 ldns_rr *cur_sig_rr);
00281
00291 void ldns_dnssec_derive_trust_tree_dnskey_rrset_time(
00292 ldns_dnssec_trust_tree *new_tree,
00293 ldns_dnssec_data_chain *data_chain,
00294 ldns_rr *cur_rr, ldns_rr *cur_sig_rr,
00295 time_t check_time);
00296
00297
00307 void ldns_dnssec_derive_trust_tree_dnskey_rrset_time(
00308 ldns_dnssec_trust_tree *new_tree,
00309 ldns_dnssec_data_chain *data_chain,
00310 ldns_rr *cur_rr, ldns_rr *cur_sig_rr,
00311 time_t check_time);
00312
00313
00321 void ldns_dnssec_derive_trust_tree_ds_rrset(
00322 ldns_dnssec_trust_tree *new_tree,
00323 ldns_dnssec_data_chain *data_chain,
00324 ldns_rr *cur_rr);
00325
00334 void ldns_dnssec_derive_trust_tree_ds_rrset_time(
00335 ldns_dnssec_trust_tree *new_tree,
00336 ldns_dnssec_data_chain *data_chain,
00337 ldns_rr *cur_rr, time_t check_time);
00338
00346 void ldns_dnssec_derive_trust_tree_no_sig(
00347 ldns_dnssec_trust_tree *new_tree,
00348 ldns_dnssec_data_chain *data_chain);
00349
00358 void ldns_dnssec_derive_trust_tree_no_sig_time(
00359 ldns_dnssec_trust_tree *new_tree,
00360 ldns_dnssec_data_chain *data_chain,
00361 time_t check_time);
00362
00363
00375 ldns_status ldns_dnssec_trust_tree_contains_keys(
00376 ldns_dnssec_trust_tree *tree,
00377 ldns_rr_list *keys);
00378
00390 ldns_status ldns_verify(ldns_rr_list *rrset,
00391 ldns_rr_list *rrsig,
00392 const ldns_rr_list *keys,
00393 ldns_rr_list *good_keys);
00394
00407 ldns_status ldns_verify_time(ldns_rr_list *rrset,
00408 ldns_rr_list *rrsig,
00409 const ldns_rr_list *keys,
00410 time_t check_time,
00411 ldns_rr_list *good_keys);
00412
00413
00426 ldns_status ldns_verify_notime(ldns_rr_list *rrset,
00427 ldns_rr_list *rrsig,
00428 const ldns_rr_list *keys,
00429 ldns_rr_list *good_keys);
00430
00445 ldns_rr_list *ldns_fetch_valid_domain_keys(const ldns_resolver * res,
00446 const ldns_rdf * domain,
00447 const ldns_rr_list * keys,
00448 ldns_status *status);
00449
00465 ldns_rr_list *ldns_fetch_valid_domain_keys_time(const ldns_resolver * res,
00466 const ldns_rdf * domain, const ldns_rr_list * keys,
00467 time_t check_time, ldns_status *status);
00468
00469
00480 ldns_rr_list *ldns_validate_domain_dnskey (const ldns_resolver *res,
00481 const ldns_rdf *domain,
00482 const ldns_rr_list *keys);
00483
00495 ldns_rr_list *ldns_validate_domain_dnskey_time(
00496 const ldns_resolver *res, const ldns_rdf *domain,
00497 const ldns_rr_list *keys, time_t check_time);
00498
00499
00508 ldns_rr_list *ldns_validate_domain_ds(const ldns_resolver *res,
00509 const ldns_rdf *
00510 domain,
00511 const ldns_rr_list * keys);
00512
00522 ldns_rr_list *ldns_validate_domain_ds_time(
00523 const ldns_resolver *res, const ldns_rdf *domain,
00524 const ldns_rr_list * keys, time_t check_time);
00525
00526
00538 ldns_status ldns_verify_trusted(ldns_resolver *res,
00539 ldns_rr_list *rrset,
00540 ldns_rr_list *rrsigs,
00541 ldns_rr_list *validating_keys);
00542
00555 ldns_status ldns_verify_trusted_time(
00556 ldns_resolver *res, ldns_rr_list *rrset,
00557 ldns_rr_list *rrsigs, time_t check_time,
00558 ldns_rr_list *validating_keys);
00559
00560
00571 ldns_status ldns_dnssec_verify_denial(ldns_rr *rr,
00572 ldns_rr_list *nsecs,
00573 ldns_rr_list *rrsigs);
00574
00592 ldns_status ldns_dnssec_verify_denial_nsec3(ldns_rr *rr,
00593 ldns_rr_list *nsecs,
00594 ldns_rr_list *rrsigs,
00595 ldns_pkt_rcode packet_rcode,
00596 ldns_rr_type packet_qtype,
00597 bool packet_nodata);
00598
00617 ldns_status ldns_dnssec_verify_denial_nsec3_match(ldns_rr *rr,
00618 ldns_rr_list *nsecs,
00619 ldns_rr_list *rrsigs,
00620 ldns_pkt_rcode packet_rcode,
00621 ldns_rr_type packet_qtype,
00622 bool packet_nodata,
00623 ldns_rr **match);
00634 ldns_status ldns_verify_rrsig_buffers(ldns_buffer *rawsig_buf,
00635 ldns_buffer *verify_buf,
00636 ldns_buffer *key_buf,
00637 uint8_t algo);
00638
00650 ldns_status ldns_verify_rrsig_buffers_raw(unsigned char* sig,
00651 size_t siglen,
00652 ldns_buffer *verify_buf,
00653 unsigned char* key,
00654 size_t keylen,
00655 uint8_t algo);
00656
00668 ldns_status ldns_verify_rrsig_keylist(ldns_rr_list *rrset,
00669 ldns_rr *rrsig,
00670 const ldns_rr_list *keys,
00671 ldns_rr_list *good_keys);
00672
00685 ldns_status ldns_verify_rrsig_keylist_time(
00686 ldns_rr_list *rrset, ldns_rr *rrsig,
00687 const ldns_rr_list *keys, time_t check_time,
00688 ldns_rr_list *good_keys);
00689
00690
00702 ldns_status ldns_verify_rrsig_keylist_notime(ldns_rr_list *rrset,
00703 ldns_rr *rrsig,
00704 const ldns_rr_list *keys,
00705 ldns_rr_list *good_keys);
00706
00714 ldns_status ldns_verify_rrsig(ldns_rr_list *rrset,
00715 ldns_rr *rrsig,
00716 ldns_rr *key);
00717
00718
00727 ldns_status ldns_verify_rrsig_time(
00728 ldns_rr_list *rrset, ldns_rr *rrsig,
00729 ldns_rr *key, time_t check_time);
00730
00731
00732 #if LDNS_BUILD_CONFIG_HAVE_SSL
00733
00742 ldns_status ldns_verify_rrsig_evp(ldns_buffer *sig,
00743 ldns_buffer *rrset,
00744 EVP_PKEY *key,
00745 const EVP_MD *digest_type);
00746
00755 ldns_status ldns_verify_rrsig_evp_raw(unsigned char *sig,
00756 size_t siglen,
00757 ldns_buffer *rrset,
00758 EVP_PKEY *key,
00759 const EVP_MD *digest_type);
00760 #endif
00761
00770 ldns_status ldns_verify_rrsig_dsa(ldns_buffer *sig,
00771 ldns_buffer *rrset,
00772 ldns_buffer *key);
00773
00782 ldns_status ldns_verify_rrsig_rsasha1(ldns_buffer *sig,
00783 ldns_buffer *rrset,
00784 ldns_buffer *key);
00785
00794 ldns_status ldns_verify_rrsig_rsamd5(ldns_buffer *sig,
00795 ldns_buffer *rrset,
00796 ldns_buffer *key);
00797
00806 ldns_status ldns_verify_rrsig_dsa_raw(unsigned char* sig,
00807 size_t siglen,
00808 ldns_buffer* rrset,
00809 unsigned char* key,
00810 size_t keylen);
00811
00820 ldns_status ldns_verify_rrsig_rsasha1_raw(unsigned char* sig,
00821 size_t siglen,
00822 ldns_buffer* rrset,
00823 unsigned char* key,
00824 size_t keylen);
00825
00835 ldns_status ldns_verify_rrsig_rsasha256_raw(unsigned char* sig,
00836 size_t siglen,
00837 ldns_buffer* rrset,
00838 unsigned char* key,
00839 size_t keylen);
00840
00849 ldns_status ldns_verify_rrsig_rsasha512_raw(unsigned char* sig,
00850 size_t siglen,
00851 ldns_buffer* rrset,
00852 unsigned char* key,
00853 size_t keylen);
00854
00863 ldns_status ldns_verify_rrsig_rsamd5_raw(unsigned char* sig,
00864 size_t siglen,
00865 ldns_buffer* rrset,
00866 unsigned char* key,
00867 size_t keylen);
00868
00869 #ifdef __cplusplus
00870 }
00871 #endif
00872
00873 #endif
00874