Net::DNS::Keyset - DNSSEC Keyset object class

use Net::DNS::Keyset;

A keyset is a "administrative" unit used for DNSSEC maintenance.

The bind dnssec-signzone tool uses it to genertate DS records. This class provides interfaces for reading keysets, creating and parsing them.

Note that this class is still being developed. Attributes and methods are subject to change.

    $keyset=Net::DNS::Keyset->new("keyset-example.tld");

Creator method, will read the specified keyset file and return a keyset object. Fails if not all keys in the set are self-signed.

Sets $Net::DNS::Keyset::keyset_err and returns 0 on failure.

    $keyset=Net::DNS::Keyset->new(\@keyrr,$privatekeypath);

Creates a keyset object from the keys provided through the reference to an array of Net::DNS::RR::Key objects.

The method will create selfsign the whole keyset. The private keys as generated by the BIND dnssec-keygen tool are assumed to be in the current directory or, if specified, in the directory indicat by the $privatekeypath.

Sets $Net::DNS::Keyset::keyset_err and returns 0 on failure.

    $keyset=Net::DNS::Keyset->new(\@keyrr,\@sigrr);

Creates a keyset object from the keys provided through the reference to an array of Net::DNS::RR::DNSKEY and Net::DNS::RR::RRSIG objects.

Sets $Net::DNS::Keyset::keyset_err and returns 0 on failure.

    $res = Net::DNS::Resolver->new;
    $res->dnssec(1);

    $packet = $res->query ("example.com", "DNSKEY", "IN");

    $keyset=Net::DNS::Keyset->new($packet)

    die "Corrupted selfsignature " if ! $keyset->verify;

Creates a keyset object from a Net::DNS::Packet that contains the answer to a query for the apex key records.

This is the method you want to use for automatically fetching keys.

Sets $Net::DNS::Keyset::keyset_err and returns 0 on failure.

    @keyrr=$keyset->keys;

Returns an array of Net::DNS::RR::Key objects

    @keyrr=$keyset->sigs;

Returns an array of Net::DNS::RR::Sig objects

    die $Net::DNS::Keyset::keyset_err if $keyset->verify;

If no arguments are given:

    - Verifies if all signatures present verify the keyset.
    - Verifies if there are DNSKEYs with the SEP flag set there is
      at least one RRSIG made using that key
    - Verifies that if there are no DNSKEYS with the SEP flag set there is
      at lease one RRSIG made with one of the keys from the keyset.

If an argument is given it is should be the KEYID of one of the keys in the keyset and the method verifies if the the RRSIG with that made with that key verifies.

The argument returns 0 if verification fails and sets $Net::DNS::Keyset::keyset_err.

If verification succeeds an array is returne with the key-tags of the keys for which signatures verified.

    $keyset->print;

Prints the keyset

    $keysetstring=$keyset->string;

Returns a string representation of the keyset

    print $keyset->string;
    is similar to
    $keyset->print;

    @ds=$keyset->extract_ds;
    foreach $ds (@ds) {
        $ds->print;
    }

Extracts DS records from the keyset. Note that the keyset will be verified during extraction: All keys will need to have a valid selfsignature.

    die $Net::DNS::Keyset::keyset_err if ! $keyset->writekeyset($prefix, $path);

Writes the keyset to a file named "keyset-<domain>." in the current working directory or the directory defined by $path. $prefix specifies an optional prefix that will be prepended to the string "keyset-<domain>." Returns 0 on failure and sets keyset_err.

Copyright (c) 2002 RIPE NCC. Author Olaf M. Kolkman <net-dns-sec@ripe.net>

All Rights Reserved

Permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of the author not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission.

THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS; IN NO EVENT SHALL AUTHOR BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.