/usr/include/libkres/dnssec.h is in knot-resolver 1.0.0~beta3-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 | /* Copyright (C) 2015 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#pragma once
#include "lib/defines.h"
#include <libknot/packet/pkt.h>
/**
* Initialise cryptographic back-end.
*/
KR_EXPORT
void kr_crypto_init(void);
/**
* De-initialise cryptographic back-end.
*/
KR_EXPORT
void kr_crypto_cleanup(void);
/**
* Re-initialise cryptographic back-end.
* @note Must be called after fork() in the child.
*/
KR_EXPORT
void kr_crypto_reinit(void);
/** Opaque DNSSEC key pointer. */
struct dseckey;
/**
* Validate RRSet.
* @param pkt Packet to be validated.
* @param section_id Section to work with.
* @param covered RRSet covered by a signature. It must be in canonical format.
* @param keys DNSKEY RRSet.
* @param zone_name Name of the zone containing the RRSIG RRSet.
* @param timestamp Validation time.
* @param has_nsec3 Whether to use NSEC3 validation.
* @return 0 or error code.
*/
int kr_rrset_validate(const knot_pkt_t *pkt, knot_section_t section_id,
const knot_rrset_t *covered, const knot_rrset_t *keys,
const knot_dname_t *zone_name, uint32_t timestamp,
bool has_nsec3);
/**
* Validate RRSet using a specific key.
* @param pkt Packet to be validated.
* @param section_id Section to work with.
* @param covered RRSet covered by a signature. It must be in canonical format.
* @param keys DNSKEY RRSet.
* @param key_pos Position of the key to be validated with.
* @param key Key to be used to validate. If NULL, then key from DNSKEY RRSet is used.
* @param zone_name Name of the zone containing the RRSIG RRSet.
* @param timestamp Validation time.
* @param has_nsec3 Whether to use NSEC3 validation.
* @return 0 or error code.
*/
int kr_rrset_validate_with_key(const knot_pkt_t *pkt, knot_section_t section_id,
const knot_rrset_t *covered, const knot_rrset_t *keys,
size_t key_pos, const struct dseckey *key,
const knot_dname_t *zone_name, uint32_t timestamp,
bool has_nsec3);
/**
* Check whether the DNSKEY rrset matches the supplied trust anchor RRSet.
* @param pkt Packet to be validated.
* @param section_id Section to work with.
* @param keys DNSKEY RRSet to check.
* @param ta Trust anchor RRSet against which to validate the DNSKEY RRSet.
* @param zone_name Name of the zone containing the RRSet.
* @param timestamp Time stamp.
* @param has_nsec3 Whether to use NSEC3 validation.
* @return 0 or error code.
*/
int kr_dnskeys_trusted(const knot_pkt_t *pkt, knot_section_t section_id, const knot_rrset_t *keys,
const knot_rrset_t *ta, const knot_dname_t *zone_name, uint32_t timestamp,
bool has_nsec3);
/** Return true if the DNSKEY can be used as a ZSK. */
KR_EXPORT KR_PURE
bool kr_dnssec_key_zsk(const uint8_t *dnskey_rdata);
/** Return true if the DNSKEY indicates being KSK (=> has SEP). */
KR_EXPORT KR_PURE
bool kr_dnssec_key_ksk(const uint8_t *dnskey_rdata);
/** Return true if the DNSKEY is revoked. */
KR_EXPORT KR_PURE
bool kr_dnssec_key_revoked(const uint8_t *dnskey_rdata);
/** Return DNSKEY tag.
* @param rrtype RR type (either DS or DNSKEY are supported)
* @param rdata Key/digest RDATA.
* @param rdlen RDATA length.
* @return Key tag (positive number), or an error code
*/
KR_EXPORT KR_PURE
int kr_dnssec_key_tag(uint16_t rrtype, const uint8_t *rdata, size_t rdlen);
/** Return 0 if the two keys are identical.
* @note This compares RDATA only, algorithm and public key must match.
* @param key_a_rdata First key RDATA
* @param key_a_rdlen First key RDATA length
* @param key_b_rdata Second key RDATA
* @param key_b_rdlen Second key RDATA length
* @return 0 if they match or an error code
*/
KR_EXPORT KR_PURE
int kr_dnssec_key_match(const uint8_t *key_a_rdata, size_t key_a_rdlen,
const uint8_t *key_b_rdata, size_t key_b_rdlen);
/**
* Construct a DNSSEC key.
* @param key Pointer to be set to newly created DNSSEC key.
* @param kown DNSKEY owner name.
* @param rdata DNSKEY RDATA
* @param rdlen DNSKEY RDATA length
*/
int kr_dnssec_key_from_rdata(struct dseckey **key, const knot_dname_t *kown, const uint8_t *rdata, size_t rdlen);
/**
* Frees the DNSSEC key.
* @param key Pointer to freed key.
*/
void kr_dnssec_key_free(struct dseckey **key);
|