erldns_dnssec behaviour (erldns v11.0.0)
View SourceDNSSEC implementation.
If you want to enable DNSSEC, you need to add this module to the packet pipeline after a resolver,
that being an authoritative (e.g. erldns_resolver) or recursive
(e.g. erldns_resolver_recursive).
You also need to provide the zone keys for signing, during loading,
see ZONES for more details.
NSEC type-mapper extension
When a name only carries a custom type (e.g. a record that another pipeline stage synthesizes into A/CNAME at query time), the authenticated-denial NSEC record for that name must still advertise the standard types the client will actually receive, or validating resolvers reject the answer. A mapper widens the NSEC type bitmap accordingly.
A mapper is a fun((RecordType, QType) -> [Type]) implementing the nsec_rr_type_mapper/2
callback. To register one, the owning pipeline stage calls add_nsec_type_mapper/3 from its own
erldns_pipeline:prepare/1:
prepare(Opts) ->
erldns_dnssec:add_nsec_type_mapper(Opts, [?CUSTOM_TYPE], fun ?MODULE:nsec_rr_type_mapper/2).Summary
Callbacks
NSEC type-mapper extension callback.
Functions
Register an NSEC type mapper for the given record types into the pipeline opts.
erldns_pipeline:call/2 callback.
erldns_pipeline:deps/0 callback.
Get signed records from a zone
Get signed records from a zone
erldns_pipeline:prepare/1 callback.
Given a zone and a set of records, return the RRSIG records.
Types
-type nsec_type_mappers() :: #{dns:type() => nsec_type_mapper_fun()}.
Callbacks
NSEC type-mapper extension callback.
Pipeline stages that introduce custom record types (e.g. ALIAS) implement this to widen the NSEC
type bitmap: given a record type present at a name and the query type, return the standard DNS types
the custom type should be advertised as. The mapper is registered into the pipeline opts with
add_nsec_type_mapper/3 from the stage's erldns_pipeline:prepare/1.
Functions
-spec add_nsec_type_mapper(erldns_pipeline:opts(), [dns:type()], nsec_type_mapper_fun()) -> erldns_pipeline:opts().
Register an NSEC type mapper for the given record types into the pipeline opts.
Extension pipes call this from their own erldns_pipeline:prepare/1. Because every pipe's
prepare/1 contributes to the single, shared pipeline opts that is later merged into every query,
the mappers are available to this module's call/2 at run-time as a plain map lookup — no global
registry, no process hop.
-spec call(dns:message(), erldns_pipeline:opts()) -> erldns_pipeline:return().
erldns_pipeline:call/2 callback.
-spec deps() -> erldns_pipeline:deps().
erldns_pipeline:deps/0 callback.
-spec get_signed_records(erldns:zone()) -> #{atom() => [dns:rr()]}.
Get signed records from a zone
-spec get_signed_zone_records(erldns:zone()) -> [dns:rr()].
Get signed records from a zone
-spec prepare(erldns_pipeline:opts()) -> erldns_pipeline:opts().
erldns_pipeline:prepare/1 callback.
-spec rrsig_for_zone_rrset(erldns:zone(), [dns:rr()]) -> [dns:rr()].
Given a zone and a set of records, return the RRSIG records.