Class: Dnsruby::RR::DS
- Inherits:
-
Dnsruby::RR
- Object
- Dnsruby::RR
- Dnsruby::RR::DS
- Defined in:
- lib/dnsruby/resource/DS.rb
Overview
RFC4034, section 4 The DS Resource Record refers to a DNSKEY RR and is used in the DNS DNSKEY authentication process. A DS RR refers to a DNSKEY RR by storing the key tag, algorithm number, and a digest of the DNSKEY RR. Note that while the digest should be sufficient to identify the public key, storing the key tag and key algorithm helps make the identification process more efficient. By authenticating the DS record, a resolver can authenticate the DNSKEY RR to which the DS record points. The key authentication process is described in [RFC4035].
Defined Under Namespace
Classes: DigestTypes
Constant Summary collapse
Constants inherited from Dnsruby::RR
Instance Attribute Summary collapse
-
#algorithm ⇒ Object
The algorithm used for this key See Dnsruby::Algorithms for permitted values.
-
#digest ⇒ Object
The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR.
-
#digest_type ⇒ Object
The DS RR refers to a DNSKEY RR by including a digest of that DNSKEY RR.
-
#digestbin ⇒ Object
Returns the value of attribute digestbin.
-
#key_tag ⇒ Object
The Key Tag field lists the key tag of the DNSKEY RR referred to by the DS record, in network byte order.
Attributes inherited from Dnsruby::RR
#klass, #name, #rdata, #ttl, #type
Class Method Summary collapse
-
.decode_rdata(msg) ⇒ Object
:nodoc: all.
- .from_key(key, digest_type) ⇒ Object
- .get_digest_type(d) ⇒ Object
Instance Method Summary collapse
-
#check_key(key) ⇒ Object
Check if the key’s digest is the same as that stored in the DS record.
-
#digest_key(*args) ⇒ Object
Return the digest of the specified DNSKEY RR.
-
#encode_rdata(msg, canonical = false) ⇒ Object
:nodoc: all.
-
#from_data(data) ⇒ Object
:nodoc: all.
- #from_string(input) ⇒ Object
-
#rdata_to_string ⇒ Object
:nodoc: all.
Methods inherited from Dnsruby::RR
#<=>, #==, #clone, create, #eql?, find_class, #from_hash, get_class, get_num, #hash, implemented_rrs, #init_defaults, new_from_data, new_from_hash, new_from_string, #rdlength, #sameRRset, #to_s
Instance Attribute Details
#algorithm ⇒ Object
The algorithm used for this key See Dnsruby::Algorithms for permitted values
65 66 67 |
# File 'lib/dnsruby/resource/DS.rb', line 65 def algorithm @algorithm end |
#digest ⇒ Object
The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR.
72 73 74 |
# File 'lib/dnsruby/resource/DS.rb', line 72 def digest @digest end |
#digest_type ⇒ Object
The DS RR refers to a DNSKEY RR by including a digest of that DNSKEY RR. The Digest Type field identifies the algorithm used to construct the digest.
69 70 71 |
# File 'lib/dnsruby/resource/DS.rb', line 69 def digest_type @digest_type end |
#digestbin ⇒ Object
Returns the value of attribute digestbin.
73 74 75 |
# File 'lib/dnsruby/resource/DS.rb', line 73 def digestbin @digestbin end |
#key_tag ⇒ Object
The Key Tag field lists the key tag of the DNSKEY RR referred to by the DS record, in network byte order.
62 63 64 |
# File 'lib/dnsruby/resource/DS.rb', line 62 def key_tag @key_tag end |
Class Method Details
.decode_rdata(msg) ⇒ Object
:nodoc: all
248 249 250 251 252 253 |
# File 'lib/dnsruby/resource/DS.rb', line 248 def self.decode_rdata(msg) #:nodoc: all key_tag, algorithm, digest_type = msg.get_unpack("ncc") digest = msg.get_bytes return self.new( [key_tag, algorithm, digest_type, digest]) end |
.from_key(key, digest_type) ⇒ Object
153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 |
# File 'lib/dnsruby/resource/DS.rb', line 153 def DS.from_key(key, digest_type) # # The key must not be a NULL key. # if ((key.flags & 0xc000 ) == 0xc000 ) # puts "\nCreating a DS record for a NULL key is illegal" # return # end # # # Bit 0 must not be set. # if (key.flags & 0x8000) # puts "\nCreating a DS record for a key with flag bit 0 set " + # "to 0 is illegal" # return # end # # Bit 6 must be set to 0 bit 7 must be set to 1 if (( key.flags & 0x300) != 0x100) puts "\nCreating a DS record for a key with flags 6 and 7 not set "+ "0 and 1 respectively is illegal" return end # # # if (key.protocol != 3 ) # puts "\nCreating a DS record for a non DNSSEC (protocol=3) " + # "key is illegal" # return # end # digest_type = get_digest_type(digest_type) # Create a new DS record from the specified key ds = RR.create(:name => key.name, :type => "DS", :ttl => key.ttl, :key_tag => key.key_tag, :digest_type => digest_type, :algorithm => key.algorithm) ds.digestbin = ds.digest_key(key, digest_type) ds.digest = ds.digestbin.unpack("H*")[0] return ds end |
.get_digest_type(d) ⇒ Object
80 81 82 83 84 85 86 87 88 89 90 91 92 |
# File 'lib/dnsruby/resource/DS.rb', line 80 def DS.get_digest_type(d) if (d.instance_of?String) if (d.length == 1) d = d.to_i end end begin digest = DigestTypes.new(d) return digest rescue ArgumentError => e raise DecodeError.new(e) end end |
Instance Method Details
#check_key(key) ⇒ Object
Check if the key’s digest is the same as that stored in the DS record
137 138 139 140 141 142 143 144 145 146 147 148 149 150 |
# File 'lib/dnsruby/resource/DS.rb', line 137 def check_key(key) if ((key.key_tag == @key_tag) && (key.algorithm == @algorithm)) digestbin = digest_key(key) if (@digestbin == digestbin) if (!key.zone_key?) else return true end else end end return false end |
#digest_key(*args) ⇒ Object
Return the digest of the specified DNSKEY RR
109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 |
# File 'lib/dnsruby/resource/DS.rb', line 109 def digest_key(*args) # key, digest_type) digest_type = @digest_type key = args[0] if (args.length == 2) digest_type = args[1] end data = MessageEncoder.new {|msg| msg.put_name(key.name, true) key.encode_rdata(msg, true) }.to_s if (digest_type.code == 1) digestbin = OpenSSL::Digest::SHA1.digest(data) return digestbin elsif (digest_type.code == 2) digestbin = OpenSSL::Digest::SHA256.digest(data) return digestbin elsif (digest_type.code == 4) digestbin = OpenSSL::Digest::SHA384.digest(data) return digestbin end end |
#encode_rdata(msg, canonical = false) ⇒ Object
:nodoc: all
243 244 245 246 |
# File 'lib/dnsruby/resource/DS.rb', line 243 def encode_rdata(msg, canonical=false) #:nodoc: all msg.put_pack("ncc", @key_tag, @algorithm.code, @digest_type.code) msg.put_bytes(@digestbin) end |
#from_data(data) ⇒ Object
:nodoc: all
192 193 194 195 196 197 198 199 |
# File 'lib/dnsruby/resource/DS.rb', line 192 def from_data(data) #:nodoc: all key_tag, algorithm, digest_type, digest = data self.key_tag=(key_tag) self.algorithm=(algorithm) self.digest_type=(digest_type) self.digestbin=(digest) self.digest=@digestbin.unpack("H*")[0] end |
#from_string(input) ⇒ Object
201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 |
# File 'lib/dnsruby/resource/DS.rb', line 201 def from_string(input) if (input.length > 0) data = input.split(" ") self.key_tag=(data[0].to_i) self.algorithm=(data[1]) self.digest_type=(data[2]) buf = "" index = 3 end_index = data.length - 1 if (data[index]=="(") end_index = data.length - 2 index = 4 end (index..end_index).each {|i| if (comment_index = data[i].index(";")) buf += data[i].slice(0, comment_index) # @TODO@ We lose the comments here - we should really keep them for when we write back to string format? break else buf += data[i] end } # self.digest=Base64.decode64(buf) buf.gsub!(/\n/, "") buf.gsub!(/ /, "") # self.digest=buf.unpack("m*")[0] self.digest=buf self.digestbin = [buf].pack("H*") end end |
#rdata_to_string ⇒ Object
:nodoc: all
233 234 235 236 237 238 239 240 241 |
# File 'lib/dnsruby/resource/DS.rb', line 233 def rdata_to_string #:nodoc: all if (@key_tag != nil) # return "#{@key_tag.to_i} #{@algorithm.string} #{@digest_type} ( #{Base64.encode64(@digest)} )" # return "#{@key_tag.to_i} #{@algorithm.string} #{@digest_type.code} ( #{[@digest].pack("m*").gsub("\n", "")} )" return "#{@key_tag.to_i} #{@algorithm.string} #{@digest_type.code} ( #{@digest.upcase} )" else return "" end end |