nsec3 mnemonics and identifiers

also fixed tools so you can actually use them

diff --git a/dnssec_sign.c b/dnssec_sign.c
index f4c8c5c9dcad2a095439a138ff5f4e806d7bde00..f4e2b8ac5a885fec871271cff595398d68fdb84c 100644 (file)
--- a/dnssec_sign.c
+++ b/dnssec_sign.c
@@ -216,12 +216,14 @@ ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
                                break;
 #ifdef USE_SHA2
                        case LDNS_SIGN_RSASHA256:
+                       case LDNS_SIGN_RSASHA256_NSEC3:
                                b64rdf = ldns_sign_public_evp(
                                                   sign_buf,
                                                   ldns_key_evp_key(current_key),
                                                   EVP_sha256());
                                break;
                        case LDNS_SIGN_RSASHA512:
+                       case LDNS_SIGN_RSASHA512_NSEC3:
                                b64rdf = ldns_sign_public_evp(
                                                   sign_buf,
                                                   ldns_key_evp_key(current_key),

diff --git a/examples/ldns-signzone.c b/examples/ldns-signzone.c
index f24ee6a6e870631ec7cbd2b5b2248ad5f6d1215f..08d1d298198436cf737b307404a982d663294a06 100644 (file)
--- a/examples/ldns-signzone.c
+++ b/examples/ldns-signzone.c
@@ -322,7 +322,9 @@ main(int argc, char *argv[])
                                        case LDNS_SIGN_RSASHA1:
                                        case LDNS_SIGN_RSASHA1_NSEC3:
                                        case LDNS_SIGN_RSASHA256:
+                                       case LDNS_SIGN_RSASHA256_NSEC3:
                                        case LDNS_SIGN_RSASHA512:
+                                       case LDNS_SIGN_RSASHA512_NSEC3:
                                        case LDNS_SIGN_DSA:
                                        case LDNS_SIGN_DSA_NSEC3:
                                                ldns_key_list_push_key(keys, key);
@@ -593,7 +595,9 @@ main(int argc, char *argv[])
                                case LDNS_SIGN_RSASHA1:
                                case LDNS_SIGN_RSASHA1_NSEC3:
                                case LDNS_SIGN_RSASHA256:
+                               case LDNS_SIGN_RSASHA256_NSEC3:
                                case LDNS_SIGN_RSASHA512:
+                               case LDNS_SIGN_RSASHA512_NSEC3:
                                case LDNS_SIGN_DSA:
                                case LDNS_SIGN_DSA_NSEC3:
                                        ldns_key_list_push_key(keys, key);

diff --git a/host2str.c b/host2str.c
index f7ec7cbf9fa3cab059f5dae2f7f147b530daee59..660c00e7b2559a36929d164ea15b9c9b21ba663e 100644 (file)
--- a/host2str.c
+++ b/host2str.c
@@ -1367,7 +1367,9 @@ ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k)
                        case LDNS_SIGN_RSASHA1:
                        case LDNS_SIGN_RSASHA1_NSEC3:
                        case LDNS_SIGN_RSASHA256:
+                       case LDNS_SIGN_RSASHA256_NSEC3:
                        case LDNS_SIGN_RSASHA512:
+                       case LDNS_SIGN_RSASHA512_NSEC3:
                        case LDNS_SIGN_RSAMD5:
                                /* copied by looking at dnssec-keygen output */
                                /* header */
@@ -1381,22 +1383,36 @@ ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k)
                                                                    LDNS_RSAMD5);
                                        break;
                                case LDNS_SIGN_RSASHA1:
-                               case LDNS_SIGN_RSASHA1_NSEC3:
                                        ldns_buffer_printf(output,
                                                                    "Algorithm: %u (RSASHA1)\n",
                                                                    LDNS_RSASHA1);
                                        break;
+                               case LDNS_SIGN_RSASHA1_NSEC3:
+                                       ldns_buffer_printf(output,
+                                                                   "Algorithm: %u (RSASHA1_NSEC3)\n",
+                                                                   LDNS_RSASHA1_NSEC3);
+                                       break;
 #ifdef USE_SHA2
                                case LDNS_SIGN_RSASHA256:
                                        ldns_buffer_printf(output,
                                                                    "Algorithm: %u (RSASHA256)\n",
                                                                    LDNS_RSASHA256);
                                        break;
+                               case LDNS_SIGN_RSASHA256_NSEC3:
+                                       ldns_buffer_printf(output,
+                                                                   "Algorithm: %u (RSASHA256_NSEC3)\n",
+                                                                   LDNS_RSASHA256_NSEC3);
+                                       break;
                                case LDNS_SIGN_RSASHA512:
                                        ldns_buffer_printf(output,
                                                                    "Algorithm: %u (RSASHA512)\n",
                                                                    LDNS_RSASHA512);
                                        break;
+                               case LDNS_SIGN_RSASHA512_NSEC3:
+                                       ldns_buffer_printf(output,
+                                                                   "Algorithm: %u (RSASHA512_NSEC3)\n",
+                                                                   LDNS_RSASHA512_NSEC3);
+                                       break;
 #endif
                                default:
                                        fprintf(stderr, "Warning: unknown signature ");
@@ -1536,7 +1552,11 @@ ldns_key2buffer_str(ldns_buffer *output, const ldns_key *k)
                                dsa = ldns_key_dsa_key(k);
                        
                                ldns_buffer_printf(output,"Private-key-format: v1.2\n");
-                               ldns_buffer_printf(output,"Algorithm: 3 (DSA)\n");
+                               if (ldns_key_algorithm(k) == LDNS_SIGN_DSA) {
+                                       ldns_buffer_printf(output,"Algorithm: 3 (DSA)\n");
+                               } else if (ldns_key_algorithm(k) == LDNS_SIGN_DSA_NSEC3) {
+                                       ldns_buffer_printf(output,"Algorithm: 6 (DSA_NSEC3)\n");
+                               }
 
                                /* print to buf, convert to bin, convert to b64,
                                 * print to buf */

diff --git a/keys.c b/keys.c
index d2f0233f870a546ac5b80784644b340c70c5579d..8f965b35129b46adadcd39a264bf5996f8ebb5d9 100644 (file)
--- a/keys.c
+++ b/keys.c
@@ -23,11 +23,15 @@
 ldns_lookup_table ldns_signing_algorithms[] = {
         { LDNS_SIGN_RSAMD5, "RSAMD5" },
         { LDNS_SIGN_RSASHA1, "RSASHA1" },
+        { LDNS_SIGN_RSASHA1_NSEC3, "RSASHA1_NSEC3" },
 #ifdef USE_SHA2
         { LDNS_SIGN_RSASHA256, "RSASHA256" },
+        { LDNS_SIGN_RSASHA256_NSEC3, "RSASHA256_NSEC3" },
         { LDNS_SIGN_RSASHA512, "RSASHA512" },
+        { LDNS_SIGN_RSASHA512_NSEC3, "RSASHA512_NSEC3" },
 #endif
         { LDNS_SIGN_DSA, "DSA" },
+        { LDNS_SIGN_DSA_NSEC3, "DSA_NSEC3" },
         { LDNS_SIGN_HMACMD5, "hmac-md5.sig-alg.reg.int" },
         { LDNS_SIGN_HMACSHA1, "hmac-sha1" },
         { LDNS_SIGN_HMACSHA256, "hmac-sha256" },
@@ -170,12 +174,28 @@ ldns_key_new_frm_fp_l(ldns_key **key, FILE *fp, int *line_nr)
                fprintf(stderr, "version of ldns\n");
 #endif
        }
-       if (strncmp(d, "9 RSASHA512", 2) == 0) {
+       if (strncmp(d, "9 RSASHA256", 2) == 0) {
+#ifdef USE_SHA2
+               alg = LDNS_SIGN_RSASHA256_NSEC3;
+#else
+               fprintf(stderr, "Warning: SHA256 not compiled into this ");
+               fprintf(stderr, "version of ldns\n");
+#endif
+       }
+       if (strncmp(d, "10 RSASHA512", 3) == 0) {
 #ifdef USE_SHA2
                alg = LDNS_SIGN_RSASHA512;
 #else
                fprintf(stderr, "Warning: SHA256 not compiled into this ");
                fprintf(stderr, "version of ldns\n");
+#endif
+       }
+       if (strncmp(d, "11 RSASHA512", 3) == 0) {
+#ifdef USE_SHA2
+               alg = LDNS_SIGN_RSASHA512_NSEC3;
+#else
+               fprintf(stderr, "Warning: SHA256 not compiled into this ");
+               fprintf(stderr, "version of ldns\n");
 #endif
        }
        if (strncmp(d, "157 HMAC-MD5", 4) == 0) {
@@ -196,7 +216,9 @@ ldns_key_new_frm_fp_l(ldns_key **key, FILE *fp, int *line_nr)
                case LDNS_RSASHA1_NSEC3:
 #ifdef USE_SHA2
                case LDNS_SIGN_RSASHA256:
+               case LDNS_SIGN_RSASHA256_NSEC3:
                case LDNS_SIGN_RSASHA512:
+               case LDNS_SIGN_RSASHA512_NSEC3:
 #endif
                        ldns_key_set_algorithm(k, alg);
                        rsa = ldns_key_new_frm_fp_rsa_l(fp, line_nr);
@@ -516,7 +538,9 @@ ldns_key_new_frm_algorithm(ldns_signing_algorithm alg, uint16_t size)
                case LDNS_SIGN_RSASHA1:
                case LDNS_SIGN_RSASHA1_NSEC3:
                case LDNS_SIGN_RSASHA256:
+               case LDNS_SIGN_RSASHA256_NSEC3:
                case LDNS_SIGN_RSASHA512:
+               case LDNS_SIGN_RSASHA512_NSEC3:
                        r = RSA_generate_key((int)size, RSA_F4, NULL, NULL);
                        if (RSA_check_key(r) != 1) {
                                return NULL;
@@ -945,7 +969,9 @@ ldns_key2rr(const ldns_key *k)
                case LDNS_RSASHA1:
                case LDNS_RSASHA1_NSEC3:
                case LDNS_RSASHA256:
+               case LDNS_RSASHA256_NSEC3:
                case LDNS_RSASHA512:
+               case LDNS_RSASHA512_NSEC3:
                        ldns_rr_push_rdf(pubkey,
                                                  ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG, ldns_key_algorithm(k)));
                        rsa =  ldns_key_rsa_key(k);

diff --git a/ldns/keys.h b/ldns/keys.h
index 2b1af6c13509279c6a325d29a29200452f914c76..c4984db8a9822ca7f72b6e6780e595d37ab178fc 100644 (file)
--- a/ldns/keys.h
+++ b/ldns/keys.h
@@ -47,7 +47,9 @@ enum ldns_enum_algorithm
         LDNS_DSA_NSEC3         = 6,
         LDNS_RSASHA1_NSEC3     = 7,
         LDNS_RSASHA256          = 8, /* not official */
-        LDNS_RSASHA512          = 9, /* not official */
+        LDNS_RSASHA256_NSEC3    = 9, /* not official */
+        LDNS_RSASHA512          = 10, /* not official */
+        LDNS_RSASHA512_NSEC3    = 11, /* not official */
         LDNS_INDIRECT           = 252,
         LDNS_PRIVATEDNS         = 253,
         LDNS_PRIVATEOID         = 254
@@ -71,10 +73,12 @@ enum ldns_enum_signing_algorithm
 {
        LDNS_SIGN_RSAMD5         = LDNS_RSAMD5,
        LDNS_SIGN_RSASHA1        = LDNS_RSASHA1,
-       LDNS_SIGN_RSASHA256      = LDNS_RSASHA256,
-       LDNS_SIGN_RSASHA512      = LDNS_RSASHA512,
        LDNS_SIGN_DSA            = LDNS_DSA,
        LDNS_SIGN_RSASHA1_NSEC3  = LDNS_RSASHA1_NSEC3,
+       LDNS_SIGN_RSASHA256      = LDNS_RSASHA256,
+       LDNS_SIGN_RSASHA256_NSEC3= LDNS_RSASHA256_NSEC3,
+       LDNS_SIGN_RSASHA512      = LDNS_RSASHA512,
+       LDNS_SIGN_RSASHA512_NSEC3= LDNS_RSASHA512_NSEC3,
        LDNS_SIGN_DSA_NSEC3      = LDNS_DSA_NSEC3,
        LDNS_SIGN_HMACMD5        = 157, /* not official! This type is for TSIG, not DNSSEC */
        LDNS_SIGN_HMACSHA1       = 158, /* not official! This type is for TSIG, not DNSSEC */

diff --git a/rr_functions.c b/rr_functions.c
index 80df983431ce3d9ca807a966ea6ae8dcf2cbc675..37af95c081d0931864c2e894b3c0754af7b8d199 100644 (file)
--- a/rr_functions.c
+++ b/rr_functions.c
@@ -295,7 +295,9 @@ ldns_rr_dnskey_key_size_raw(const unsigned char* keydata,
        case LDNS_SIGN_RSASHA1_NSEC3:
 #ifdef USE_SHA2
        case LDNS_SIGN_RSASHA256:
+       case LDNS_SIGN_RSASHA256_NSEC3:
        case LDNS_SIGN_RSASHA512:
+       case LDNS_SIGN_RSASHA512_NSEC3:
 #endif
                if (len > 0) {
                        if (keydata[0] == 0) {