View Source dnssec (dns_erlang v3.1.1)
The dnssec
module exports functions used for generating NSEC responses,
signing and verifying RRSIGs, and adding keytags to DNSKEY records.
For example, the sign_rr/6
function can be given a collection of resource records,
the signer name, keytag, signing algorithm, private key, and a collection of options
and it will return a list of RRSIG records. Currently only DSA and RSA algorithms are
supported for signing RRSETs.
Summary
Types
-type gen_nsec_opt() :: {base_types, [dns:type()]}.
-type key() :: [binary()].
-type keytag() :: integer().
-type nsec3_hashalg() :: 1.
-type nsec3_iterations() :: non_neg_integer().
-type nsec3_salt() :: binary().
-type sigalg() :: 3 | 6 | 5 | 7 | 8 | 10.
-type sign_rr_opt() :: {inception | expiration, dns:unix_time()}.
-type verify_rrsig_opt() :: {now, dns:unix_time()}.
Functions
-spec canonical_rrdata_form(dns:rrdata()) -> dns:rrdata().
-spec gen_nsec3([dns:rr()], dns:dname(), nsec3_hashalg(), nsec3_salt(), nsec3_iterations(), dns:ttl()) -> [dns:rr()].
-spec gen_nsec3([dns:rr()], dns:dname(), nsec3_hashalg(), nsec3_salt(), nsec3_iterations(), dns:ttl(), dns:class()) -> [dns:rr()].
-spec gen_nsec(dns:dname(), [dns:rr()], dns:ttl(), [gen_nsec_opt()]) -> [dns:rr()].
-spec ih(nsec3_hashalg() | nsec3_hashalg_fun(), nsec3_salt(), binary(), nsec3_iterations()) -> binary().
-spec verify_rrsig(dns:rr(), [dns:rr()], [dns:rr()], [verify_rrsig_opt()]) -> boolean().