1 /* Copyright (C) 2021 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz> 2 3 This program is free software: you can redistribute it and/or modify 4 it under the terms of the GNU General Public License as published by 5 the Free Software Foundation, either version 3 of the License, or 6 (at your option) any later version. 7 8 This program is distributed in the hope that it will be useful, 9 but WITHOUT ANY WARRANTY; without even the implied warranty of 10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 11 GNU General Public License for more details. 12 13 You should have received a copy of the GNU General Public License 14 along with this program. If not, see <https://www.gnu.org/licenses/>. 15 */ 16 17 #pragma once 18 19 #include <stdbool.h> 20 21 #include "contrib/time.h" 22 #include "libdnssec/key.h" 23 #include "knot/conf/conf.h" 24 25 /*! 26 * KASP key timing information. 27 */ 28 typedef struct { 29 knot_time_t created; /*!< Time the key was generated/imported. */ 30 knot_time_t pre_active; /*!< Signing start with new algorithm. */ 31 knot_time_t publish; /*!< Time of DNSKEY record publication. */ 32 knot_time_t ready; /*!< Start of RRSIG generation, waiting for parent zone. */ 33 knot_time_t active; /*!< RRSIG records generating, other keys can be retired */ 34 knot_time_t retire_active; /*!< Still active, but obsoleted. */ 35 knot_time_t retire; /*!< End of RRSIG records generating. */ 36 knot_time_t post_active; /*!< Still signing with old algorithm, not published. */ 37 knot_time_t revoke; /*!< RFC 5011 state of KSK with 'revoked' flag and signed by self. */ 38 knot_time_t remove; /*!< Time of DNSKEY record removal. */ 39 } knot_kasp_key_timing_t; 40 41 /*! 42 * Key parameters as writing in zone config file. 43 */ 44 typedef struct { 45 char *id; 46 bool is_ksk; 47 bool is_csk; 48 bool is_pub_only; 49 uint16_t keytag; 50 uint8_t algorithm; 51 dnssec_binary_t public_key; 52 knot_kasp_key_timing_t timing; 53 } key_params_t; 54 55 /*! 56 * Zone key. 57 */ 58 typedef struct { 59 char *id; /*!< Keystore unique key ID. */ 60 dnssec_key_t *key; /*!< Instance of the key. */ 61 knot_kasp_key_timing_t timing; /*!< Key timing information. */ 62 bool is_pub_only; 63 bool is_ksk; 64 bool is_zsk; 65 } knot_kasp_key_t; 66 67 /*! 68 * Parent for DS checks. 69 */ 70 typedef struct { 71 conf_remote_t *addr; 72 size_t addrs; 73 } knot_kasp_parent_t; 74 75 knot_dynarray_declare(parent, knot_kasp_parent_t, DYNARRAY_VISIBILITY_NORMAL, 3) 76 77 /*! 78 * Set of DNSSEC key related records. 79 */ 80 typedef struct { 81 knot_rrset_t dnskey; 82 knot_rrset_t cdnskey; 83 knot_rrset_t cds; 84 knot_rrset_t rrsig; 85 } key_records_t; 86 87 /*! 88 * Key and signature policy. 89 */ 90 typedef struct { 91 bool manual; 92 char *string; 93 // DNSKEY 94 dnssec_key_algorithm_t algorithm; 95 uint16_t ksk_size; 96 uint16_t zsk_size; 97 uint32_t dnskey_ttl; 98 uint32_t zsk_lifetime; // like knot_time_t 99 uint32_t ksk_lifetime; // like knot_time_t 100 uint32_t delete_delay; // like knot_timediff_t 101 bool ksk_shared; 102 bool single_type_signing; 103 bool sts_default; // single-type-signing was set to default value 104 // RRSIG 105 bool reproducible_sign; // (EC)DSA creates reproducible signatures 106 uint32_t rrsig_lifetime; // like knot_time_t 107 uint32_t rrsig_refresh_before; // like knot_timediff_t 108 uint32_t rrsig_prerefresh; // like knot_timediff_t 109 // NSEC3 110 bool nsec3_enabled; 111 bool nsec3_opt_out; 112 uint32_t nsec3_salt_lifetime; // like knot_time_t 113 uint16_t nsec3_iterations; 114 uint8_t nsec3_salt_length; 115 // zone 116 uint32_t zone_maximal_ttl; // like knot_timediff_t 117 uint32_t saved_max_ttl; 118 uint32_t saved_key_ttl; 119 // data propagation delay 120 uint32_t propagation_delay; // like knot_timediff_t 121 // various 122 uint32_t ksk_sbm_timeout; // like knot_time_t 123 uint32_t ksk_sbm_check_interval; // like knot_time_t 124 unsigned cds_cdnskey_publish; 125 dnssec_key_digest_t cds_dt; // digest type for CDS 126 parent_dynarray_t parents; 127 uint16_t signing_threads; 128 bool offline_ksk; 129 unsigned unsafe; 130 } knot_kasp_policy_t; 131 // TODO make the time parameters knot_timediff_t ?? 132