Keyset(3) User Contributed Perl Documentation Keyset(3)NAMENet::DNS::Keyset - DNSSEC Keyset object class
SYNOPSIS
use Net::DNS::Keyset;
DESCRIPTION
A keyset is a "administrative" unit used for DNSSEC maintenance.
The bind dnssec-signzone tool uses it to genertate DS records. This
class provides interfaces for reading keysets, creating and parsing
them.
Note that this class is still being developed. Attributes and methods
are subject to change.
new (from file)
$keyset=Net::DNS::Keyset->new("keyset-example.tld");
Creator method, will read the specified keyset file and return a keyset
object. Fails if not all keys in the set are self-signed.
Sets $Net::DNS::Keyset::keyset_err and returns 0 on failure.
new (by signing keys)
$keyset=Net::DNS::Keyset->new(\@keyrr,$privatekeypath);
Creates a keyset object from the keys provided through the reference to
an array of Net::DNS::RR::Key objects.
The method will create selfsign the whole keyset. The private keys as
generated by the BIND dnssec-keygen tool are assumed to be in the cur-
rent directory or, if specified, in the directory indicat by the $pri-
vatekeypath.
Sets $Net::DNS::Keyset::keyset_err and returns 0 on failure.
new (from keys and sig RRsets)
$keyset=Net::DNS::Keyset->new(\@keyrr,\@sigrr);
Creates a keyset object from the keys provided through the reference to
an array of Net::DNS::RR::DNSKEY and Net::DNS::RR::RRSIG objects.
Sets $Net::DNS::Keyset::keyset_err and returns 0 on failure.
new (from Packet)
$res = Net::DNS::Resolver->new;
$res->dnssec(1);
$packet = $res->query ("example.com", "DNSKEY", "IN");
$keyset=Net::DNS::Keyset->new($packet)
die "Corrupted selfsignature " if ! $keyset->verify;
Creates a keyset object from a Net::DNS::Packet that contains the
answer to a query for the apex key records.
This is the method you want to use for automatically fetching keys.
Sets $Net::DNS::Keyset::keyset_err and returns 0 on failure.
keys
@keyrr=$keyset->keys;
Returns an array of Net::DNS::RR::Key objects
sigs
@keyrr=$keyset->sigs;
Returns an array of Net::DNS::RR::Sig objects
verify
die $Net::DNS::Keyset::keyset_err if $keyset->verify;
If no arguments are given:
- Verifies if all signatures present verify the keyset.
- Verifies if there are DNSKEYs with the SEP flag set there is
at least one RRSIG made using that key
- Verifies that if there are no DNSKEYS with the SEP flag set there is
at lease one RRSIG made with one of the keys from the keyset.
If an argument is given it is should be the KEYID of one of the keys in
the keyset and the method verifies if the the RRSIG with that made with
that key verifies.
The argument returns 0 if verification fails and sets $Net::DNS::Key-
set::keyset_err.
If verification succeeds an array is returne with the key-tags of the
keys for which signatures verified.
print
$keyset->print;
Prints the keyset
string
$keysetstring=$keyset->string;
Returns a string representation of the keyset
print $keyset->string;
is similar to
$keyset->print;
extract_ds
@ds=$keyset->extract_ds;
foreach $ds (@ds) {
$ds->print;
}
Extracts DS records from the keyset. Note that the keyset will be veri-
fied during extraction: All keys will need to have a valid selfsigna-
ture.
writekeyset
die $Net::DNS::Keyset::keyset_err if ! $keyset->writekeyset($prefix, $path);
Writes the keyset to a file named "keyset-<domain>." in the current
working directory or the directory defined by $path. $prefix specifies
an optional prefix that will be prepended to the string "key-
set-<domain>." Returns 0 on failure and sets keyset_err.
COPYRIGHT
Copyright (c) 2002 RIPE NCC. Author Olaf M. Kolkman
<net-dns-sec@ripe.net>
All Rights Reserved
Permission to use, copy, modify, and distribute this software and its
documentation for any purpose and without fee is hereby granted, pro-
vided that the above copyright notice appear in all copies and that
both that copyright notice and this permission notice appear in sup-
porting documentation, and that the name of the author not be used in
advertising or publicity pertaining to distribution of the software
without specific, written prior permission.
THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS; IN NO
EVENT SHALL AUTHOR BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL
DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
THIS SOFTWARE.
perl v5.8.8 2006-02-14 Keyset(3)
