Class: Dnsruby::RR::DNSKEY
- Inherits:
-
Dnsruby::RR
- Object
- Dnsruby::RR
- Dnsruby::RR::DNSKEY
- Defined in:
- lib/dnsruby/resource/DNSKEY.rb
Overview
RFC4034, section 2 DNSSEC uses public key cryptography to sign and authenticate DNS resource record sets (RRsets). The public keys are stored in DNSKEY resource records and are used in the DNSSEC authentication process described in [RFC4035]: A zone signs its authoritative RRsets by using a private key and stores the corresponding public key in a DNSKEY RR. A resolver can then use the public key to validate signatures covering the RRsets in the zone, and thus to authenticate them.
Direct Known Subclasses
Constant Summary collapse
- ClassValue =
:nodoc: all
nil
- TypeValue =
:nodoc: all
Types::DNSKEY
- REVOKED_KEY =
Key is revoked
0x80
- ZONE_KEY =
Key is a zone key
0x100
- SEP_KEY =
Key is a secure entry point key
0x1
Constants inherited from Dnsruby::RR
Instance Attribute Summary collapse
-
#algorithm ⇒ Object
The algorithm used for this key See Dnsruby::Algorithms for permitted values.
-
#flags ⇒ Object
The flags for the DNSKEY RR.
-
#key ⇒ Object
The public key.
-
#key_length ⇒ Object
readonly
The length (in bits) of the key - NOT key.length.
-
#protocol ⇒ Object
The protocol for this DNSKEY RR.
Attributes inherited from Dnsruby::RR
#klass, #name, #rdata, #ttl, #type
Class Method Summary collapse
-
.decode_rdata(msg) ⇒ Object
:nodoc: all.
Instance Method Summary collapse
- #dsa_key ⇒ Object
-
#ec_key(curve = 'prime256v1') ⇒ Object
RFC6605, section 4 ECDSA public keys consist of a single value, called “Q” in FIPS 186-3.
-
#encode_rdata(msg, canonical = false) ⇒ Object
:nodoc: all.
-
#from_data(data) ⇒ Object
def bad_flags? if ((@flags & ~ZONE_KEY & ~SEP_KEY) > 0) return true end return false end.
-
#from_hash(hash) ⇒ Object
:nodoc: all.
- #from_string(input) ⇒ Object
- #generate_key_tag(rdata, algorithm) ⇒ Object
- #get_new_key_tag ⇒ Object
- #init_defaults ⇒ Object
-
#key_tag ⇒ Object
Return the tag for this key.
-
#key_tag_pre_revoked ⇒ Object
Return the the key tag this key would have had before it was revoked If the key is not revoked, then the current key_tag will be returned.
- #public_key ⇒ Object
-
#rdata_to_string ⇒ Object
:nodoc: all.
- #revoked=(on) ⇒ Object
- #revoked? ⇒ Boolean
- #rsa_key ⇒ Object
- #sep_key=(on) ⇒ Object
- #sep_key? ⇒ Boolean
- #zone_key=(on) ⇒ Object
- #zone_key? ⇒ Boolean
Methods inherited from Dnsruby::RR
#<=>, #==, #clone, create, #eql?, find_class, get_class, get_num, #hash, implemented_rrs, new_from_data, new_from_hash, new_from_string, #rdlength, #sameRRset, #to_s
Instance Attribute Details
#algorithm ⇒ Object
The algorithm used for this key See Dnsruby::Algorithms for permitted values
47 48 49 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 47 def algorithm @algorithm end |
#flags ⇒ Object
The flags for the DNSKEY RR
41 42 43 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 41 def flags @flags end |
#key ⇒ Object
The public key
49 50 51 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 49 def key @key end |
#key_length ⇒ Object (readonly)
The length (in bits) of the key - NOT key.length
51 52 53 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 51 def key_length @key_length end |
#protocol ⇒ Object
The protocol for this DNSKEY RR. MUST be 3.
44 45 46 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 44 def protocol @protocol end |
Class Method Details
.decode_rdata(msg) ⇒ Object
:nodoc: all
214 215 216 217 218 219 220 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 214 def self.decode_rdata(msg) #:nodoc: all # 2 octets, then 2 sets of 1 octet flags, protocol, algorithm = msg.get_unpack('ncc') key = msg.get_bytes return self.new( [flags, protocol, algorithm, key]) end |
Instance Method Details
#dsa_key ⇒ Object
353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 353 def dsa_key t = @key[0] t = t.getbyte(0) if t.class == String pgy_len = t * 8 + 64 pos = 1 q = RR::get_num(@key[pos, 20]) pos += 20 p = RR::get_num(@key[pos, pgy_len]) pos += pgy_len g = RR::get_num(@key[pos, pgy_len]) pos += pgy_len y = RR::get_num(@key[pos, pgy_len]) pos += pgy_len @key_length = (pgy_len * 8) asn1 = OpenSSL::ASN1::Sequence.new( [ OpenSSL::ASN1::Sequence.new( [ OpenSSL::ASN1::ObjectId.new('DSA'), OpenSSL::ASN1::Sequence.new( [ OpenSSL::ASN1::Integer.new(p), OpenSSL::ASN1::Integer.new(q), OpenSSL::ASN1::Integer.new(g) ] ) ] ), OpenSSL::ASN1::BitString.new(OpenSSL::ASN1::Integer.new(y).to_der) ] ) pkey = OpenSSL::PKey::DSA.new(asn1.to_der) end |
#ec_key(curve = 'prime256v1') ⇒ Object
RFC6605, section 4 ECDSA public keys consist of a single value, called “Q” in FIPS 186-3. In DNSSEC keys, Q is a simple bit string that represents the uncompressed form of a curve point, “x | y”.
393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 393 def ec_key(curve = 'prime256v1') group = OpenSSL::PKey::EC::Group.new(curve) # DNSSEC pub does not have first octet that determines whether it's uncompressed # or compressed form, but it's required by OpenSSL to parse EC point correctly dnskey_bn = OpenSSL::BN.new("\x04" + @key, 2) key = OpenSSL::PKey::EC.new(group) begin key.public_key = OpenSSL::PKey::EC::Point.new(group, dnskey_bn) rescue TheLog.info("Sadly, this version of OpenSSL does not let us generate an ECDSA key from the public key. This means, unfortunately, that Dnsruby will be unable to verify ECDSA signatures with this OpenSSL") end return key end |
#encode_rdata(msg, canonical = false) ⇒ Object
:nodoc: all
208 209 210 211 212 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 208 def encode_rdata(msg, canonical=false) #:nodoc: all # 2 octets, then 2 sets of 1 octet msg.put_pack('ncc', @flags, @protocol, @algorithm.code) msg.put_bytes(@key) end |
#from_data(data) ⇒ Object
def bad_flags?
if ((@flags & ~ZONE_KEY & ~SEP_KEY) > 0)
return true
end
return false
end
146 147 148 149 150 151 152 153 154 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 146 def from_data(data) #:nodoc: all flags, protocol, algorithm, @key = data @make_new_key_tag = false self.flags=(flags) self.protocol=(protocol) self.algorithm=(algorithm) @make_new_key_tag = true get_new_key_tag end |
#from_hash(hash) ⇒ Object
:nodoc: all
156 157 158 159 160 161 162 163 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 156 def from_hash(hash) #:nodoc: all @make_new_key_tag = false hash.keys.each do |param| send(param.to_s+"=", hash[param]) end @make_new_key_tag = true get_new_key_tag end |
#from_string(input) ⇒ Object
165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 165 def from_string(input) if (input.length > 0) @make_new_key_tag = false data = input.split(" ") self.flags=(data[0].to_i) self.protocol=(data[1].to_i) self.algorithm=(data[2]) # key can include whitespace - include all text # until we come to " )" at the end, and then gsub # the white space out # Also, brackets may or may not be present # Not to mention comments! ";" buf = "" index = 3 end_index = data.length - 1 if (data[index]=="(") end_index = data.length - 2 index = 4 end (index..end_index).each {|i| if (comment_index = data[i].index(";")) buf += data[i].slice(0, comment_index) # @TODO@ We lose the comments here - we should really keep them for when we write back to string format? break else buf += data[i] end } self.key=(buf) @make_new_key_tag = true get_new_key_tag end end |
#generate_key_tag(rdata, algorithm) ⇒ Object
252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 252 def generate_key_tag(rdata, algorithm) tag=0 if (algorithm == Algorithms.RSAMD5) # The key tag for algorithm 1 (RSA/MD5) is defined differently from the # key tag for all other algorithms, for historical reasons. d1 = rdata[rdata.length - 3] & 0xFF d2 = rdata[rdata.length - 2] & 0xFF tag = (d1 << 8) + d2 else tag = 0 last = 0 0.step(rdata.length - 1, 2) {|i| last = i d1 = rdata[i] d2 = rdata[i + 1] || 0 # odd number of bytes possible d1 = d1.getbyte(0) if d1.class == String # Ruby 1.9 d2 = d2.getbyte(0) if d2.class == String # Ruby 1.9 d1 = d1 & 0xFF d2 = d2 & 0xFF tag += ((d1 << 8) + d2) } last+=2 if (last < rdata.length) d1 = rdata[last] if (d1.class == String) # Ruby 1.9 d1 = d1.getbyte(0) end d1 = d1 & 0xFF tag += (d1 << 8) end tag += ((tag >> 16) & 0xFFFF) end tag=tag&0xFFFF return tag end |
#get_new_key_tag ⇒ Object
233 234 235 236 237 238 239 240 241 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 233 def get_new_key_tag if (@make_new_key_tag) rdata = MessageEncoder.new {|msg| encode_rdata(msg) }.to_s tag = generate_key_tag(rdata, @algorithm) @key_tag = tag end end |
#init_defaults ⇒ Object
53 54 55 56 57 58 59 60 61 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 53 def init_defaults @make_new_key_tag = false self.protocol=3 self.flags=ZONE_KEY @algorithm=Algorithms.RSASHA1 @public_key = nil @key_tag = nil @make_new_key_tag = true end |
#key_tag ⇒ Object
Return the tag for this key
244 245 246 247 248 249 250 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 244 def key_tag if (!@key_tag) @make_new_key_tag = true get_new_key_tag end return @key_tag end |
#key_tag_pre_revoked ⇒ Object
Return the the key tag this key would have had before it was revoked
If the key is not revoked, then the current key_tag will be returned
224 225 226 227 228 229 230 231 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 224 def key_tag_pre_revoked if (!revoked?) return key_tag end new_key = clone new_key.revoked = false return new_key.key_tag end |
#public_key ⇒ Object
306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 306 def public_key if (!@public_key) if [Algorithms.RSASHA1, Algorithms.RSASHA256, Algorithms.RSASHA512, Algorithms.RSASHA1_NSEC3_SHA1].include?(@algorithm) @public_key = rsa_key elsif [Algorithms.DSA, Algorithms.DSA_NSEC3_SHA1].include?(@algorithm) @public_key = dsa_key elsif [Algorithms.ECDSAP256SHA256, Algorithms.ECDSAP384SHA384].include?(@algorithm) @public_key = ec_key(Algorithms.ECDSAP256SHA256 == @algorithm ? 'prime256v1' : 'secp384r1') end end # @TODO@ Support other key encodings! return @public_key end |
#rdata_to_string ⇒ Object
:nodoc: all
199 200 201 202 203 204 205 206 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 199 def rdata_to_string #:nodoc: all if (@flags!=nil) # return "#{@flags} #{@protocol} #{@algorithm.string} ( #{Base64.encode64(@key.to_s)} )" return "#{@flags} #{@protocol} #{@algorithm.string} ( #{[@key.to_s].pack("m*").gsub("\n", "")} ) ; key_tag=#{key_tag}" else return "" end end |
#revoked=(on) ⇒ Object
86 87 88 89 90 91 92 93 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 86 def revoked=(on) if (on) @flags |= REVOKED_KEY else @flags &= (~REVOKED_KEY) end get_new_key_tag end |
#revoked? ⇒ Boolean
95 96 97 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 95 def revoked? return ((@flags & REVOKED_KEY) > 0) end |
#rsa_key ⇒ Object
324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 324 def rsa_key exponentLength = @key[0] if (exponentLength.class == String) exponentLength = exponentLength.getbyte(0) # Ruby 1.9 end pos = 1 if (exponentLength == 0) key1 = @key[1] if (key1.class == String) # Ruby 1.9 key1 = key1.getbyte(0) end exponentLength = (key1<<8) + key1 pos += 2 end exponent = RR::get_num(@key[pos, exponentLength]) pos += exponentLength modulus = RR::get_num(@key[pos, @key.length]) @key_length = (@key.length - pos) * 8 data_sequence = OpenSSL::ASN1::Sequence([ OpenSSL::ASN1::Integer(modulus), OpenSSL::ASN1::Integer(exponent) ]) asn1 = OpenSSL::ASN1::Sequence(data_sequence) pkey = OpenSSL::PKey::RSA.new(asn1.to_der) return pkey end |
#sep_key=(on) ⇒ Object
112 113 114 115 116 117 118 119 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 112 def sep_key=(on) if (on) @flags |= SEP_KEY else @flags &= (~SEP_KEY) end get_new_key_tag end |
#sep_key? ⇒ Boolean
121 122 123 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 121 def sep_key? return ((@flags & SEP_KEY) > 0) end |
#zone_key=(on) ⇒ Object
99 100 101 102 103 104 105 106 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 99 def zone_key=(on) if (on) @flags |= ZONE_KEY else @flags &= (~ZONE_KEY) end get_new_key_tag end |
#zone_key? ⇒ Boolean
108 109 110 |
# File 'lib/dnsruby/resource/DNSKEY.rb', line 108 def zone_key? return ((@flags & ZONE_KEY) > 0) end |