Class: Dnsruby::RR::RRSIG

Inherits:
RR
  • Object
show all
Defined in:
lib/dnsruby/resource/RRSIG.rb

Overview

(RFC4034, section 3) DNSSEC uses public key cryptography to sign and authenticate DNS resource record sets (RRsets). Digital signatures are stored in RRSIG resource records and are used in the DNSSEC authentication process described in [RFC4035]. A validator can use these RRSIG RRs to authenticate RRsets from the zone. The RRSIG RR MUST only be used to carry verification material (digital signatures) used to secure DNS operations.

An RRSIG record contains the signature for an RRset with a particular name, class, and type. The RRSIG RR specifies a validity interval for the signature and uses the Algorithm, the Signer's Name, and the Key Tag to identify the DNSKEY RR containing the public key that a validator can use to verify the signature.

Constant Summary collapse

ClassValue =

:nodoc: all

nil
TypeValue =

:nodoc: all

Types::RRSIG

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#algorithm ⇒ Object

The algorithm used for this RRSIG See Dnsruby::Algorithms for permitted values



68
69
70
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 68

def algorithm
  @algorithm
end

#expiration ⇒ Object

The signature expiration



75
76
77
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 75

def expiration
  @expiration
end

#inception ⇒ Object

The signature inception



77
78
79
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 77

def inception
  @inception
end

#key_tag ⇒ Object

The key tag value of the DNSKEY RR that validates this signature



79
80
81
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 79

def key_tag
  @key_tag
end

#labels ⇒ Object

The number of labels in the original RRSIG RR owner name Can be used to determine if name was synthesised from a wildcard.



71
72
73
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 71

def labels
  @labels
end

#original_ttl ⇒ Object

The TTL of the covered RRSet as it appears in the authoritative zone



73
74
75
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 73

def original_ttl
  @original_ttl
end

#signature ⇒ Object

contains the cryptographic signature that covers the RRSIG RDATA (excluding the Signature field) and the RRset specified by the RRSIG owner name, RRSIG class, and RRSIG Type Covered field



88
89
90
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 88

def signature
  @signature
end

#signers_name ⇒ Object

identifies the owner name of the DNSKEY RR that a validator is supposed to use to validate this signature



82
83
84
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 82

def signers_name
  @signers_name
end

#type_covered ⇒ Object

The type covered by this RRSIG



65
66
67
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 65

def type_covered
  @type_covered
end

Class Method Details

.decode_rdata(msg) ⇒ Object

:nodoc: all



250
251
252
253
254
255
256
257
258
259
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 250

def self.decode_rdata(msg) #:nodoc: all
  type_covered, algorithm, labels = msg.get_unpack('ncc')
  original_ttl, expiration, inception = msg.get_unpack('NNN')
  key_tag, = msg.get_unpack('n')
  signers_name = msg.get_name
  signature  = msg.get_bytes
  return self.new(
    [type_covered, algorithm, labels, original_ttl, expiration,
      inception, key_tag, signers_name, signature])
end

Instance Method Details

#encode_rdata(msg, canonical = false) ⇒ Object

:nodoc: all



241
242
243
244
245
246
247
248
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 241

def encode_rdata(msg, canonical=false) #:nodoc: all
  #  2 octets, then 2 sets of 1 octet
  msg.put_pack('ncc', @type_covered.to_i, @algorithm.to_i, @labels)
  msg.put_pack("NNN", @original_ttl, @expiration, @inception)
  msg.put_pack("n", @key_tag)
  msg.put_name(@signers_name, canonical, false)
  msg.put_bytes(@signature)
end

#format_time(time) ⇒ Object 



224
225
226
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 224

def format_time(time)
  return Time.at(time).gmtime.strftime("%Y%m%d%H%M%S")
end

#from_data(data) ⇒ Object

:nodoc: all



135
136
137
138
139
140
141
142
143
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 135

def from_data(data) #:nodoc: all
  type_covered, algorithm, @labels, @original_ttl, expiration, inception,
    @key_tag, signers_name, @signature = data
  @expiration = expiration
  @inception = inception
  self.type_covered=(type_covered)
  self.signers_name=(signers_name)
  self.algorithm=(algorithm)
end

#from_string(input) ⇒ Object 



145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 145

def from_string(input)
  if (input.length > 0)
    data = input.split(" ")
    self.type_covered=(data[0])
    self.algorithm=(data[1])
    self.labels=data[2].to_i
    self.original_ttl=data[3].to_i
    self.expiration=get_time(data[4])
    #  Brackets may also be present
    index = 5
    end_index = data.length - 1
    if (data[index]=="(")
      index = 6
      end_index = data.length - 2
    end
    self.inception=get_time(data[index])
    self.key_tag=data[index+1].to_i
    self.signers_name=(data[index+2])
    #  signature can include whitespace - include all text
    #  until we come to " )" at the end, and then gsub
    #  the white space out
    buf=""
    (index+3..end_index).each {|i|
      if (comment_index = data[i].index(";"))
        buf += data[i].slice(0, comment_index)
        #  @TODO@ We lose the comments here - we should really keep them for when we write back to string format?
        break
      else
      buf += data[i]
      end
    }
    buf.gsub!(/\n/, "")
    buf.gsub!(/ /, "")
    # self.signature=Base64.decode64(buf)
    self.signature=buf.unpack("m*")[0]
  end
end

#get_time(input) ⇒ Object 



220
221
222
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 220

def get_time(input)
  return RRSIG.get_time(input)
end

#init_defaults ⇒ Object 



90
91
92
93
94
95
96
97
98
99
100
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 90

def init_defaults
  @algorithm=Algorithms.RSASHA1
  @type_covered = Types::A
  @original_ttl = 3600
  @inception = Time.now.to_i
  @expiration = Time.now.to_i
  @key_tag = 0
  @labels = 0
  self.signers_name="."
  @signature = "\0"
end

#rdata_to_string ⇒ Object

:nodoc: all



228
229
230
231
232
233
234
235
236
237
238
239
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 228

def rdata_to_string #:nodoc: all
  if (@type_covered!=nil)
#          signature = Base64.encode64(@signature) # .gsub(/\n/, "")
    signature = [@signature].pack("m*").gsub(/\n/, "")
    #  @TODO@ Display the expiration and inception as
    return "#{@type_covered.string} #{@algorithm.string} #{@labels} #{@original_ttl} " +
      "#{format_time(@expiration)} ( #{format_time(@inception)} " +
      "#{@key_tag} #{@signers_name.to_s(true)} #{signature} )"
  else
    return ""
  end
end

#sig_data ⇒ Object 



261
262
263
264
265
266
267
268
269
270
271
272
 
# File 'lib/dnsruby/resource/RRSIG.rb', line 261

def sig_data
  # RRSIG_RDATA is the wire format of the RRSIG RDATA fields
  # with the Signer's Name field in canonical form and
  # the Signature field excluded;
  data = MessageEncoder.new { |msg|
    msg.put_pack('ncc', @type_covered.to_i, @algorithm.to_i, @labels)
    msg.put_pack("NNN", @original_ttl, @expiration, @inception)
    msg.put_pack("n", @key_tag)
    msg.put_name(@signers_name, true)
  }.to_s
  return data
end