2 * validator/val_secalgo.h - validator security algorithm functions.
4 * Copyright (c) 2012, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
25 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
26 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
27 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
28 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
30 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
31 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
32 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
33 * POSSIBILITY OF SUCH DAMAGE.
39 * This file contains helper functions for the validator module.
40 * The functions take buffers with raw data and convert to library calls.
43 #ifndef VALIDATOR_VAL_SECALGO_H
44 #define VALIDATOR_VAL_SECALGO_H
47 * Return size of DS digest according to its hash algorithm.
48 * @param algo: DS digest algo.
49 * @return size in bytes of digest, or 0 if not supported.
51 size_t ds_digest_size_supported(int algo);
54 * @param algo: the DS digest algo
55 * @param buf: the buffer to digest
56 * @param len: length of buffer to digest.
57 * @param res: result stored here (must have sufficient space).
58 * @return false on failure.
60 int secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
63 /** return true if DNSKEY algorithm id is supported */
64 int dnskey_algo_id_is_supported(int id);
67 * Check a canonical sig+rrset and signature against a dnskey
68 * @param buf: buffer with data to verify, the first rrsig part and the
69 * canonicalized rrset.
70 * @param algo: DNSKEY algorithm.
71 * @param sigblock: signature rdata field from RRSIG
72 * @param sigblock_len: length of sigblock data.
73 * @param key: public key data from DNSKEY RR.
74 * @param keylen: length of keydata.
75 * @param reason: bogus reason in more detail.
76 * @return secure if verification succeeded, bogus on crypto failure,
77 * unchecked on format errors and alloc failures.
79 enum sec_status verify_canonrrset(ldns_buffer* buf, int algo,
80 unsigned char* sigblock, unsigned int sigblock_len,
81 unsigned char* key, unsigned int keylen, char** reason);
83 #endif /* VALIDATOR_VAL_SECALGO_H */