dnssec.h revision dafcb997e390efa4423883dafd100c975c4095d6
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User/*
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User * Copyright (C) 1999-2002 Internet Software Consortium.
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User *
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User * Permission to use, copy, modify, and distribute this software for any
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * purpose with or without fee is hereby granted, provided that the above
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * copyright notice and this permission notice appear in all copies.
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont *
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * PERFORMANCE OF THIS SOFTWARE.
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User */
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User/* $Id: dnssec.h,v 1.26 2004/03/05 05:09:42 marka Exp $ */
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User#ifndef DNS_DNSSEC_H
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User#define DNS_DNSSEC_H 1
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User#include <isc/lang.h>
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User#include <isc/stdtime.h>
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User#include <dns/types.h>
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User#include <dst/dst.h>
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox UserISC_LANG_BEGINDECLS
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupontisc_result_t
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupontdns_dnssec_keyfromrdata(dns_name_t *name, dns_rdata_t *rdata, isc_mem_t *mctx,
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont dst_key_t **key);
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User/*
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * Creates a DST key from a DNS record. Basically a wrapper around
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * dst_key_fromdns().
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont *
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * Requires:
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * 'name' is not NULL
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * 'rdata' is not NULL
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * 'mctx' is not NULL
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * 'key' is not NULL
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * '*key' is NULL
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont *
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * Returns:
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * ISC_R_SUCCESS
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * ISC_R_NOMEMORY
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * DST_R_INVALIDPUBLICKEY
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * various errors from dns_name_totext
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User */
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox Userisc_result_t
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupontdns_dnssec_sign(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont isc_stdtime_t *inception, isc_stdtime_t *expire,
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont isc_mem_t *mctx, isc_buffer_t *buffer, dns_rdata_t *sigrdata);
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont/*
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * Generates a SIG record covering this rdataset. This has no effect
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * on existing SIG records.
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont *
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * Requires:
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * 'name' (the owner name of the record) is a valid name
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * 'set' is a valid rdataset
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * 'key' is a valid key
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * 'inception' is not NULL
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * 'expire' is not NULL
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * 'mctx' is not NULL
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * 'buffer' is not NULL
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * 'sigrdata' is not NULL
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont *
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * Returns:
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * ISC_R_SUCCESS
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * ISC_R_NOMEMORY
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * ISC_R_NOSPACE
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * DNS_R_INVALIDTIME - the expiration is before the inception
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * DNS_R_KEYUNAUTHORIZED - the key cannot sign this data (either
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * it is not a zone key or its flags prevent
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * authentication)
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * DST_R_*
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont */
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupontisc_result_t
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox Userdns_dnssec_verify(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont isc_boolean_t ignoretime, isc_mem_t *mctx,
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User dns_rdata_t *sigrdata);
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupontisc_result_t
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupontdns_dnssec_verify2(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User isc_boolean_t ignoretime, isc_mem_t *mctx,
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User dns_rdata_t *sigrdata, dns_name_t *wild);
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User/*
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * Verifies the SIG record covering this rdataset signed by a specific
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * key. This does not determine if the key's owner is authorized to
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * sign this record, as this requires a resolver or database.
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * If 'ignoretime' is ISC_TRUE, temporal validity will not be checked.
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User *
33d0a7767d53cb366039fd0ac4f63cf8a9c351b0Tinderbox User * Requires:
b091b4bb803b830d2d5a9e71b6648b669655d7dcFrancis Dupont * 'name' (the owner name of the record) is a valid name
* 'set' is a valid rdataset
* 'key' is a valid key
* 'mctx' is not NULL
* 'sigrdata' is a valid rdata containing a SIG record
* 'wild' if non-NULL then is a valid and has a buffer.
*
* Returns:
* ISC_R_SUCCESS
* ISC_R_NOMEMORY
* DNS_R_FROMWILDCARD - the signature is valid and is from
* a wildcard expansion. dns_dnssec_verify2() only.
* 'wild' contains the name of the wildcard if non-NULL.
* DNS_R_SIGINVALID - the signature fails to verify
* DNS_R_SIGEXPIRED - the signature has expired
* DNS_R_SIGFUTURE - the signature's validity period has not begun
* DNS_R_KEYUNAUTHORIZED - the key cannot sign this data (either
* it is not a zone key or its flags prevent
* authentication)
* DST_R_*
*/
isc_result_t
dns_dnssec_findzonekeys(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node,
dns_name_t *name, isc_mem_t *mctx,
unsigned int maxkeys, dst_key_t **keys,
unsigned int *nkeys);
isc_result_t
dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
dns_dbnode_t *node, dns_name_t *name,
const char *directory, isc_mem_t *mctx,
unsigned int maxkeys, dst_key_t **keys,
unsigned int *nkeys);
/*
* Finds a set of zone keys.
* XXX temporary - this should be handled in dns_zone_t.
*/
isc_result_t
dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key);
/*
* Signs a message with a SIG(0) record. This is implicitly called by
* dns_message_renderend() if msg->sig0key is not NULL.
*
* Requires:
* 'msg' is a valid message
* 'key' is a valid key that can be used for signing
*
* Returns:
* ISC_R_SUCCESS
* ISC_R_NOMEMORY
* DST_R_*
*/
isc_result_t
dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,
dst_key_t *key);
/*
* Verifies a message signed by a SIG(0) record. This is not
* called implicitly by dns_message_parse(). If dns_message_signer()
* is called before dns_dnssec_verifymessage(), it will return
* DNS_R_NOTVERIFIEDYET. dns_dnssec_verifymessage() will set
* the verified_sig0 flag in msg if the verify succeeds, and
* the sig0status field otherwise.
*
* Requires:
* 'source' is a valid buffer containing the unparsed message
* 'msg' is a valid message
* 'key' is a valid key
*
* Returns:
* ISC_R_SUCCESS
* ISC_R_NOMEMORY
* ISC_R_NOTFOUND - no SIG(0) was found
* DNS_R_SIGINVALID - the SIG record is not well-formed or
* was not generated by the key.
* DST_R_*
*/
ISC_LANG_ENDDECLS
#endif /* DNS_DNSSEC_H */