00001
00003 #ifndef LDNS_DNSSEC_VERIFY_H
00004 #define LDNS_DNSSEC_VERIFY_H
00005
00006 #define LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS 10
00007
00008 #include <ldns/dnssec.h>
00009 #include <ldns/host2str.h>
00010
00011 #ifdef __cplusplus
00012 extern "C" {
00013 #endif
00014
00019 typedef struct ldns_dnssec_data_chain_struct ldns_dnssec_data_chain;
00020 struct ldns_dnssec_data_chain_struct
00021 {
00022 ldns_rr_list *rrset;
00023 ldns_rr_list *signatures;
00024 ldns_rr_type parent_type;
00025 ldns_dnssec_data_chain *parent;
00026 ldns_pkt_rcode packet_rcode;
00027 ldns_rr_type packet_qtype;
00028 bool packet_nodata;
00029 };
00030
00035 ldns_dnssec_data_chain *ldns_dnssec_data_chain_new();
00036
00042 void ldns_dnssec_data_chain_free(ldns_dnssec_data_chain *chain);
00043
00050 void ldns_dnssec_data_chain_deep_free(ldns_dnssec_data_chain *chain);
00051
00058 void ldns_dnssec_data_chain_print(FILE *out, const ldns_dnssec_data_chain *chain);
00059
00067 void ldns_dnssec_data_chain_print_fmt(FILE *out,
00068 const ldns_output_format *fmt,
00069 const ldns_dnssec_data_chain *chain);
00070
00086 ldns_dnssec_data_chain *ldns_dnssec_build_data_chain(ldns_resolver *res,
00087 const uint16_t qflags,
00088 const ldns_rr_list *data_set,
00089 const ldns_pkt *pkt,
00090 ldns_rr *orig_rr);
00091
00121 typedef struct ldns_dnssec_trust_tree_struct ldns_dnssec_trust_tree;
00122 struct ldns_dnssec_trust_tree_struct
00123 {
00124 ldns_rr *rr;
00125
00126 ldns_rr_list *rrset;
00127 ldns_dnssec_trust_tree *parents[LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS];
00128 ldns_status parent_status[LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS];
00131 ldns_rr *parent_signature[LDNS_DNSSEC_TRUST_TREE_MAX_PARENTS];
00132 size_t parent_count;
00133 };
00134
00140 ldns_dnssec_trust_tree *ldns_dnssec_trust_tree_new();
00141
00150 void ldns_dnssec_trust_tree_free(ldns_dnssec_trust_tree *tree);
00151
00158 size_t ldns_dnssec_trust_tree_depth(ldns_dnssec_trust_tree *tree);
00159
00172 void ldns_dnssec_trust_tree_print(FILE *out,
00173 ldns_dnssec_trust_tree *tree,
00174 size_t tabs,
00175 bool extended);
00176
00190 void ldns_dnssec_trust_tree_print_fmt(FILE *out,
00191 const ldns_output_format *fmt,
00192 ldns_dnssec_trust_tree *tree,
00193 size_t tabs,
00194 bool extended);
00195
00206 ldns_status ldns_dnssec_trust_tree_add_parent(ldns_dnssec_trust_tree *tree,
00207 const ldns_dnssec_trust_tree *parent,
00208 const ldns_rr *parent_signature,
00209 const ldns_status parent_status);
00210
00222 ldns_dnssec_trust_tree *ldns_dnssec_derive_trust_tree(
00223 ldns_dnssec_data_chain *data_chain,
00224 ldns_rr *rr);
00225
00238 ldns_dnssec_trust_tree *ldns_dnssec_derive_trust_tree_time(
00239 ldns_dnssec_data_chain *data_chain,
00240 ldns_rr *rr, time_t check_time);
00241
00249 void ldns_dnssec_derive_trust_tree_normal_rrset(
00250 ldns_dnssec_trust_tree *new_tree,
00251 ldns_dnssec_data_chain *data_chain,
00252 ldns_rr *cur_sig_rr);
00253
00262 void ldns_dnssec_derive_trust_tree_normal_rrset_time(
00263 ldns_dnssec_trust_tree *new_tree,
00264 ldns_dnssec_data_chain *data_chain,
00265 ldns_rr *cur_sig_rr, time_t check_time);
00266
00267
00276 void ldns_dnssec_derive_trust_tree_dnskey_rrset(
00277 ldns_dnssec_trust_tree *new_tree,
00278 ldns_dnssec_data_chain *data_chain,
00279 ldns_rr *cur_rr,
00280 ldns_rr *cur_sig_rr);
00281
00291 void ldns_dnssec_derive_trust_tree_dnskey_rrset_time(
00292 ldns_dnssec_trust_tree *new_tree,
00293 ldns_dnssec_data_chain *data_chain,
00294 ldns_rr *cur_rr, ldns_rr *cur_sig_rr,
00295 time_t check_time);
00296
00297
00307 void ldns_dnssec_derive_trust_tree_dnskey_rrset_time(
00308 ldns_dnssec_trust_tree *new_tree,
00309 ldns_dnssec_data_chain *data_chain,
00310 ldns_rr *cur_rr, ldns_rr *cur_sig_rr,
00311 time_t check_time);
00312
00313
00321 void ldns_dnssec_derive_trust_tree_ds_rrset(
00322 ldns_dnssec_trust_tree *new_tree,
00323 ldns_dnssec_data_chain *data_chain,
00324 ldns_rr *cur_rr);
00325
00334 void ldns_dnssec_derive_trust_tree_ds_rrset_time(
00335 ldns_dnssec_trust_tree *new_tree,
00336 ldns_dnssec_data_chain *data_chain,
00337 ldns_rr *cur_rr, time_t check_time);
00338
00346 void ldns_dnssec_derive_trust_tree_no_sig(
00347 ldns_dnssec_trust_tree *new_tree,
00348 ldns_dnssec_data_chain *data_chain);
00349
00358 void ldns_dnssec_derive_trust_tree_no_sig_time(
00359 ldns_dnssec_trust_tree *new_tree,
00360 ldns_dnssec_data_chain *data_chain,
00361 time_t check_time);
00362
00363
00374 ldns_status ldns_dnssec_trust_tree_contains_keys(
00375 ldns_dnssec_trust_tree *tree,
00376 ldns_rr_list *keys);
00377
00389 ldns_status ldns_verify(ldns_rr_list *rrset,
00390 ldns_rr_list *rrsig,
00391 const ldns_rr_list *keys,
00392 ldns_rr_list *good_keys);
00393
00406 ldns_status ldns_verify_time(ldns_rr_list *rrset,
00407 ldns_rr_list *rrsig,
00408 const ldns_rr_list *keys,
00409 time_t check_time,
00410 ldns_rr_list *good_keys);
00411
00412
00425 ldns_status ldns_verify_notime(ldns_rr_list *rrset,
00426 ldns_rr_list *rrsig,
00427 const ldns_rr_list *keys,
00428 ldns_rr_list *good_keys);
00429
00444 ldns_rr_list *ldns_fetch_valid_domain_keys(const ldns_resolver * res,
00445 const ldns_rdf * domain,
00446 const ldns_rr_list * keys,
00447 ldns_status *status);
00448
00464 ldns_rr_list *ldns_fetch_valid_domain_keys_time(const ldns_resolver * res,
00465 const ldns_rdf * domain, const ldns_rr_list * keys,
00466 time_t check_time, ldns_status *status);
00467
00468
00479 ldns_rr_list *ldns_validate_domain_dnskey (const ldns_resolver *res,
00480 const ldns_rdf *domain,
00481 const ldns_rr_list *keys);
00482
00494 ldns_rr_list *ldns_validate_domain_dnskey_time(
00495 const ldns_resolver *res, const ldns_rdf *domain,
00496 const ldns_rr_list *keys, time_t check_time);
00497
00498
00507 ldns_rr_list *ldns_validate_domain_ds(const ldns_resolver *res,
00508 const ldns_rdf *
00509 domain,
00510 const ldns_rr_list * keys);
00511
00521 ldns_rr_list *ldns_validate_domain_ds_time(
00522 const ldns_resolver *res, const ldns_rdf *domain,
00523 const ldns_rr_list * keys, time_t check_time);
00524
00525
00537 ldns_status ldns_verify_trusted(ldns_resolver *res,
00538 ldns_rr_list *rrset,
00539 ldns_rr_list *rrsigs,
00540 ldns_rr_list *validating_keys);
00541
00554 ldns_status ldns_verify_trusted_time(
00555 ldns_resolver *res, ldns_rr_list *rrset,
00556 ldns_rr_list *rrsigs, time_t check_time,
00557 ldns_rr_list *validating_keys);
00558
00559
00570 ldns_status ldns_dnssec_verify_denial(ldns_rr *rr,
00571 ldns_rr_list *nsecs,
00572 ldns_rr_list *rrsigs);
00573
00591 ldns_status ldns_dnssec_verify_denial_nsec3(ldns_rr *rr,
00592 ldns_rr_list *nsecs,
00593 ldns_rr_list *rrsigs,
00594 ldns_pkt_rcode packet_rcode,
00595 ldns_rr_type packet_qtype,
00596 bool packet_nodata);
00597
00616 ldns_status ldns_dnssec_verify_denial_nsec3_match(ldns_rr *rr,
00617 ldns_rr_list *nsecs,
00618 ldns_rr_list *rrsigs,
00619 ldns_pkt_rcode packet_rcode,
00620 ldns_rr_type packet_qtype,
00621 bool packet_nodata,
00622 ldns_rr **match);
00633 ldns_status ldns_verify_rrsig_buffers(ldns_buffer *rawsig_buf,
00634 ldns_buffer *verify_buf,
00635 ldns_buffer *key_buf,
00636 uint8_t algo);
00637
00649 ldns_status ldns_verify_rrsig_buffers_raw(unsigned char* sig,
00650 size_t siglen,
00651 ldns_buffer *verify_buf,
00652 unsigned char* key,
00653 size_t keylen,
00654 uint8_t algo);
00655
00667 ldns_status ldns_verify_rrsig_keylist(ldns_rr_list *rrset,
00668 ldns_rr *rrsig,
00669 const ldns_rr_list *keys,
00670 ldns_rr_list *good_keys);
00671
00684 ldns_status ldns_verify_rrsig_keylist_time(
00685 ldns_rr_list *rrset, ldns_rr *rrsig,
00686 const ldns_rr_list *keys, time_t check_time,
00687 ldns_rr_list *good_keys);
00688
00689
00701 ldns_status ldns_verify_rrsig_keylist_notime(ldns_rr_list *rrset,
00702 ldns_rr *rrsig,
00703 const ldns_rr_list *keys,
00704 ldns_rr_list *good_keys);
00705
00713 ldns_status ldns_verify_rrsig(ldns_rr_list *rrset,
00714 ldns_rr *rrsig,
00715 ldns_rr *key);
00716
00717
00726 ldns_status ldns_verify_rrsig_time(
00727 ldns_rr_list *rrset, ldns_rr *rrsig,
00728 ldns_rr *key, time_t check_time);
00729
00730
00731 #if LDNS_BUILD_CONFIG_HAVE_SSL
00732
00741 ldns_status ldns_verify_rrsig_evp(ldns_buffer *sig,
00742 ldns_buffer *rrset,
00743 EVP_PKEY *key,
00744 const EVP_MD *digest_type);
00745
00754 ldns_status ldns_verify_rrsig_evp_raw(unsigned char *sig,
00755 size_t siglen,
00756 ldns_buffer *rrset,
00757 EVP_PKEY *key,
00758 const EVP_MD *digest_type);
00759 #endif
00760
00769 ldns_status ldns_verify_rrsig_dsa(ldns_buffer *sig,
00770 ldns_buffer *rrset,
00771 ldns_buffer *key);
00772
00781 ldns_status ldns_verify_rrsig_rsasha1(ldns_buffer *sig,
00782 ldns_buffer *rrset,
00783 ldns_buffer *key);
00784
00793 ldns_status ldns_verify_rrsig_rsamd5(ldns_buffer *sig,
00794 ldns_buffer *rrset,
00795 ldns_buffer *key);
00796
00805 ldns_status ldns_verify_rrsig_dsa_raw(unsigned char* sig,
00806 size_t siglen,
00807 ldns_buffer* rrset,
00808 unsigned char* key,
00809 size_t keylen);
00810
00819 ldns_status ldns_verify_rrsig_rsasha1_raw(unsigned char* sig,
00820 size_t siglen,
00821 ldns_buffer* rrset,
00822 unsigned char* key,
00823 size_t keylen);
00824
00834 ldns_status ldns_verify_rrsig_rsasha256_raw(unsigned char* sig,
00835 size_t siglen,
00836 ldns_buffer* rrset,
00837 unsigned char* key,
00838 size_t keylen);
00839
00848 ldns_status ldns_verify_rrsig_rsasha512_raw(unsigned char* sig,
00849 size_t siglen,
00850 ldns_buffer* rrset,
00851 unsigned char* key,
00852 size_t keylen);
00853
00862 ldns_status ldns_verify_rrsig_rsamd5_raw(unsigned char* sig,
00863 size_t siglen,
00864 ldns_buffer* rrset,
00865 unsigned char* key,
00866 size_t keylen);
00867
00868 #ifdef __cplusplus
00869 }
00870 #endif
00871
00872 #endif
00873