Class: Dnsruby::RR::DNSKEY

Inherits:
Dnsruby::RR show all
Defined in:
lib/dnsruby/resource/DNSKEY.rb

Overview

RFC4034, section 2 DNSSEC uses public key cryptography to sign and authenticate DNS resource record sets (RRsets). The public keys are stored in DNSKEY resource records and are used in the DNSSEC authentication process described in [RFC4035]: A zone signs its authoritative RRsets by using a private key and stores the corresponding public key in a DNSKEY RR. A resolver can then use the public key to validate signatures covering the RRsets in the zone, and thus to authenticate them.

Direct Known Subclasses

CDNSKEY

Constant Summary collapse

ClassValue =

:nodoc: all

nil
TypeValue =

:nodoc: all

Types::DNSKEY
REVOKED_KEY =

Key is revoked

0x80
ZONE_KEY =

Key is a zone key

0x100
SEP_KEY =

Key is a secure entry point key

0x1

Constants inherited from Dnsruby::RR

ClassInsensitiveTypes

Instance Attribute Summary collapse

Attributes inherited from Dnsruby::RR

#klass, #name, #rdata, #ttl, #type

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from Dnsruby::RR

#<=>, #==, #clone, create, #eql?, find_class, get_class, get_num, #hash, implemented_rrs, new_from_data, new_from_hash, new_from_string, #rdlength, #sameRRset, #to_s

Instance Attribute Details

#algorithm ⇒ Object

The algorithm used for this key See Dnsruby::Algorithms for permitted values



47
48
49
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 47

def algorithm
  @algorithm
end

#flags ⇒ Object

The flags for the DNSKEY RR



41
42
43
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 41

def flags
  @flags
end

#key ⇒ Object

The public key



49
50
51
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 49

def key
  @key
end

#key_length ⇒ Object (readonly)

The length (in bits) of the key - NOT key.length



51
52
53
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 51

def key_length
  @key_length
end

#protocol ⇒ Object

The protocol for this DNSKEY RR. MUST be 3.



44
45
46
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 44

def protocol
  @protocol
end

Class Method Details

.decode_rdata(msg) ⇒ Object

:nodoc: all



214
215
216
217
218
219
220
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 214

def self.decode_rdata(msg) #:nodoc: all
  #  2 octets, then 2 sets of 1 octet
  flags, protocol, algorithm = msg.get_unpack('ncc')
  key = msg.get_bytes
  return self.new(
    [flags, protocol, algorithm, key])
end

Instance Method Details

#dsa_key ⇒ Object 



353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 353

def dsa_key
  t = @key[0]
  t = t.getbyte(0) if t.class == String
  pgy_len = t * 8 + 64
  pos = 1
  q = RR::get_num(@key[pos, 20])
  pos += 20
  p = RR::get_num(@key[pos, pgy_len])
  pos += pgy_len
  g = RR::get_num(@key[pos, pgy_len])
  pos += pgy_len
  y = RR::get_num(@key[pos, pgy_len])
  pos += pgy_len
  @key_length = (pgy_len * 8)

  asn1 = OpenSSL::ASN1::Sequence.new(
    [
      OpenSSL::ASN1::Sequence.new(
        [
          OpenSSL::ASN1::ObjectId.new('DSA'),
          OpenSSL::ASN1::Sequence.new(
            [
              OpenSSL::ASN1::Integer.new(p),
              OpenSSL::ASN1::Integer.new(q),
              OpenSSL::ASN1::Integer.new(g)
            ]
          )
        ]
      ),
      OpenSSL::ASN1::BitString.new(OpenSSL::ASN1::Integer.new(y).to_der)
    ]
  )

  pkey = OpenSSL::PKey::DSA.new(asn1.to_der)
end

#ec_key(curve = 'prime256v1') ⇒ Object

RFC6605, section 4 ECDSA public keys consist of a single value, called “Q” in FIPS 186-3. In DNSSEC keys, Q is a simple bit string that represents the uncompressed form of a curve point, “x | y”.



393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 393

def ec_key(curve = 'prime256v1')
  group = OpenSSL::PKey::EC::Group.new(curve)
  # DNSSEC pub does not have first octet that determines whether it's uncompressed
  # or compressed form, but it's required by OpenSSL to parse EC point correctly
  dnskey_bn = OpenSSL::BN.new("\x04" + @key, 2)
  key_point = OpenSSL::PKey::EC::Point.new(group, dnskey_bn)
  
  asn1 = OpenSSL::ASN1::Sequence.new(
    [
      OpenSSL::ASN1::Sequence.new([
        OpenSSL::ASN1::ObjectId.new("id-ecPublicKey"),
        OpenSSL::ASN1::ObjectId.new(group.curve_name)
      ]),
      OpenSSL::ASN1::BitString.new(key_point.to_octet_string(:uncompressed))
    ]
  )
  OpenSSL::PKey::EC.new(asn1.to_der)
end

#encode_rdata(msg, canonical = false) ⇒ Object

:nodoc: all



208
209
210
211
212
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 208

def encode_rdata(msg, canonical=false) #:nodoc: all
  #  2 octets, then 2 sets of 1 octet
  msg.put_pack('ncc', @flags, @protocol, @algorithm.code)
  msg.put_bytes(@key)
end

#from_data(data) ⇒ Object

def bad_flags?

  if ((@flags & ~ZONE_KEY & ~SEP_KEY) > 0)
    return true
  end
  return false
end



146
147
148
149
150
151
152
153
154
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 146

def from_data(data) #:nodoc: all
  flags, protocol, algorithm, @key = data
  @make_new_key_tag = false
  self.flags=(flags)
  self.protocol=(protocol)
  self.algorithm=(algorithm)
  @make_new_key_tag = true
  get_new_key_tag
end

#from_hash(hash) ⇒ Object

:nodoc: all



156
157
158
159
160
161
162
163
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 156

def from_hash(hash) #:nodoc: all
  @make_new_key_tag = false
  hash.keys.each do |param|
    send(param.to_s+"=", hash[param])
  end
  @make_new_key_tag = true
  get_new_key_tag
end

#from_string(input) ⇒ Object 



165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 165

def from_string(input)
  if (input.length > 0)
    @make_new_key_tag = false
    data = input.split(" ")
    self.flags=(data[0].to_i)
    self.protocol=(data[1].to_i)
    self.algorithm=(data[2])
    #  key can include whitespace - include all text
    #  until we come to " )" at the end, and then gsub
    #  the white space out
    #  Also, brackets may or may not be present
    #  Not to mention comments! ";"
    buf = ""
    index = 3
    end_index = data.length - 1
    if (data[index]=="(")
      end_index = data.length - 2
      index = 4
    end
    (index..end_index).each {|i|
      if (comment_index = data[i].index(";"))
        buf += data[i].slice(0, comment_index)
        #  @TODO@ We lose the comments here - we should really keep them for when we write back to string format?
        break
      else
        buf += data[i]
      end
    }
    self.key=(buf)
    @make_new_key_tag = true
    get_new_key_tag
  end
end

#generate_key_tag(rdata, algorithm) ⇒ Object 



252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 252

def generate_key_tag(rdata, algorithm)
  tag=0
  if (algorithm == Algorithms.RSAMD5)
    # The key tag for algorithm 1 (RSA/MD5) is defined differently from the
    # key tag for all other algorithms, for historical reasons.
    d1 = rdata[rdata.length - 3] & 0xFF
    d2 = rdata[rdata.length - 2] & 0xFF
    tag = (d1 << 8) + d2
  else
    tag = 0
    last = 0
    0.step(rdata.length - 1, 2) {|i|
      last = i
      d1 = rdata[i]
      d2 = rdata[i + 1] || 0 # odd number of bytes possible

      d1 = d1.getbyte(0) if d1.class == String # Ruby 1.9
      d2 = d2.getbyte(0) if d2.class == String # Ruby 1.9

      d1 = d1  & 0xFF
      d2 = d2  & 0xFF

      tag += ((d1 << 8) + d2)
    }
    last+=2
    if (last < rdata.length)
      d1 = rdata[last]

      if (d1.class == String) # Ruby 1.9
        d1 = d1.getbyte(0)
      end

      d1 = d1 & 0xFF
      tag += (d1 << 8)
    end
    tag += ((tag >> 16) & 0xFFFF)
  end
  tag=tag&0xFFFF
  return tag
end

#get_new_key_tag ⇒ Object 



233
234
235
236
237
238
239
240
241
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 233

def get_new_key_tag
  if (@make_new_key_tag)
    rdata = MessageEncoder.new {|msg|
      encode_rdata(msg)
    }.to_s
    tag = generate_key_tag(rdata, @algorithm)
    @key_tag = tag
  end
end

#init_defaults ⇒ Object 



53
54
55
56
57
58
59
60
61
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 53

def init_defaults
  @make_new_key_tag = false
  self.protocol=3
  self.flags=ZONE_KEY
  @algorithm=Algorithms.RSASHA1
  @public_key = nil
  @key_tag = nil
  @make_new_key_tag = true
end

#key_tag ⇒ Object

Return the tag for this key



244
245
246
247
248
249
250
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 244

def key_tag
  if (!@key_tag)
    @make_new_key_tag = true
    get_new_key_tag
  end
  return @key_tag
end

#key_tag_pre_revoked ⇒ Object

Return the the key tag this key would have had before it was revoked

If the key is not revoked, then the current key_tag will be returned



224
225
226
227
228
229
230
231
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 224

def key_tag_pre_revoked
  if (!revoked?)
    return key_tag
  end
  new_key = clone
  new_key.revoked = false
  return new_key.key_tag
end

#public_key ⇒ Object 



306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 306

def public_key
  if (!@public_key)
    if [Algorithms.RSASHA1,
        Algorithms.RSASHA256,
        Algorithms.RSASHA512,
        Algorithms.RSASHA1_NSEC3_SHA1].include?(@algorithm)
      @public_key = rsa_key
    elsif [Algorithms.DSA,
        Algorithms.DSA_NSEC3_SHA1].include?(@algorithm)
      @public_key = dsa_key
    elsif [Algorithms.ECDSAP256SHA256, Algorithms.ECDSAP384SHA384].include?(@algorithm)
      @public_key = ec_key(Algorithms.ECDSAP256SHA256 == @algorithm ? 'prime256v1' : 'secp384r1')
    end
  end
  #  @TODO@ Support other key encodings!
  return @public_key
end

#rdata_to_string ⇒ Object

:nodoc: all



199
200
201
202
203
204
205
206
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 199

def rdata_to_string #:nodoc: all
  if (@flags!=nil)
    #           return "#{@flags} #{@protocol} #{@algorithm.string} ( #{Base64.encode64(@key.to_s)} )"
    return "#{@flags} #{@protocol} #{@algorithm.string} ( #{[@key.to_s].pack("m*").gsub("\n", "")} ) ; key_tag=#{key_tag}"
  else
    return ""
  end
end

#revoked=(on) ⇒ Object 



86
87
88
89
90
91
92
93
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 86

def revoked=(on)
  if (on)
    @flags |= REVOKED_KEY
  else
    @flags &= (~REVOKED_KEY)
  end
  get_new_key_tag
end

#revoked? ⇒ Boolean

Returns:

  • (Boolean) 


95
96
97
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 95

def revoked?
  return ((@flags & REVOKED_KEY) > 0)
end

#rsa_key ⇒ Object 



324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 324

def rsa_key
  exponentLength = @key[0]
  if (exponentLength.class == String)
    exponentLength = exponentLength.getbyte(0) # Ruby 1.9
  end
  pos = 1
  if (exponentLength == 0)
    key1 = @key[1]
    if (key1.class == String) # Ruby 1.9
      key1 = key1.getbyte(0)
    end
    exponentLength = (key1<<8) + key1
    pos += 2
  end
  exponent = RR::get_num(@key[pos, exponentLength])
  pos += exponentLength

  modulus = RR::get_num(@key[pos, @key.length])
  @key_length = (@key.length - pos) * 8

  data_sequence = OpenSSL::ASN1::Sequence([
                                            OpenSSL::ASN1::Integer(modulus),
                                            OpenSSL::ASN1::Integer(exponent)
                                          ])
  asn1 = OpenSSL::ASN1::Sequence(data_sequence)
  pkey = OpenSSL::PKey::RSA.new(asn1.to_der)
  return pkey
end

#sep_key=(on) ⇒ Object 



112
113
114
115
116
117
118
119
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 112

def sep_key=(on)
  if (on)
    @flags |= SEP_KEY
  else
    @flags &= (~SEP_KEY)
  end
  get_new_key_tag
end

#sep_key? ⇒ Boolean

Returns:

  • (Boolean) 


121
122
123
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 121

def sep_key?
  return ((@flags & SEP_KEY) > 0)
end

#zone_key=(on) ⇒ Object 



99
100
101
102
103
104
105
106
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 99

def zone_key=(on)
  if (on)
    @flags |= ZONE_KEY
  else
    @flags &= (~ZONE_KEY)
  end
  get_new_key_tag
end

#zone_key? ⇒ Boolean

Returns:

  • (Boolean) 


108
109
110
 
# File 'lib/dnsruby/resource/DNSKEY.rb', line 108

def zone_key?
  return ((@flags & ZONE_KEY) > 0)
end