/ 
Net-DNS-SEC-0.12
River stage zero No dependents
/ Net::DNS::Keyset

NAME

Net::DNS::Keyset - DNSSEC Keyset object class

SYNOPSIS

use Net::DNS::Keyset;

DESCRIPTION

A keyset is a "administrative" unit used for DNSSEC maintenance.

The bind dnssec-signzone tool uses it to genertate DS records. This class provides interfaces for reading keysets, creating and parsing them.

Note that this class is still being developed. Attributes and methods are subject to change.

new (from file)

$keyset=Net::DNS::Keyset->new("keyset-example.tld");

Creator method, will read the specified keyset file and return a keyset object. Fails if not all keys in the set are self-signed.

Sets $Net::DNS::Keyset::keyset_err and returns 0 on failure.

new (by signing keys)

$keyset=Net::DNS::Keyset->new(\@keyrr,$privatekeypath);

Creates a keyset object from the keys provided through the reference to an array of Net::DNS::RR::Key objects.

The method will create selfsign the whole keyset. The private keys as generated by the BIND dnssec-keygen tool are assumed to be in the current directory or, if specified, in the directory indicat by the $privatekeypath.

Sets $Net::DNS::Keyset::keyset_err and returns 0 on failure.

new (from keys and sig RRsets)

$keyset=Net::DNS::Keyset->new(\@keyrr,\@sigrr);

Creates a keyset object from the keys provided through the reference to an array of Net::DNS::RR::DNSKEY and Net::DNS::RR::RRSIG objects.

Sets $Net::DNS::Keyset::keyset_err and returns 0 on failure.

new (from Packet)

 $res = Net::DNS::Resolver->new;
 $res->dnssec(1);

 $packet = $res->query ("example.com", "DNSKEY", "IN");

 $keyset=Net::DNS::Keyset->new($packet)
 
 die "Corrupted selfsignature " if ! $keyset->verify;

Creates a keyset object from a Net::DNS::Packet that contains the answer to a query for the apex key records.

This is the method you want to use for automatically fetching keys.

Sets $Net::DNS::Keyset::keyset_err and returns 0 on failure.

keys

@keyrr=$keyset->keys;

Returns an array of Net::DNS::RR::Key objects

sigs

@keyrr=$keyset->sigs;

Returns an array of Net::DNS::RR::Sig objects

verify

die $Net::DNS::Keyset::keyset_err if $keyset->verify;

Verifies if all keys in the set are self signed. Sets $Net::DNS::Keyset::keyset_err on failure.

print

$keyset->print;

Prints the keyset

string

$keysetstring=$keyset->string;

Returns a string representation of the keyset

print $keyset->string;
is similar to
$keyset->print;

extract_ds

@ds=$keyset->extract_ds;
foreach $ds (@ds) {
    $ds->print;
}

Extracts DS records from the keyset. Note that the keyset will be verified during extraction: All keys will need to have a valid selfsignature.

writekeyset

die $Net::DNS::Keyset::keyset_err if ! $keyset->writekeyset($prefix, $path);

Writes the keyset to a file named "keyset-<domain>." in the current working directory or the directory defined by $path. $prefix specifies an optional prefix that will be prepended to the string "keyset-<domain>." Returns 0 on failure and sets keyset_err.

COPYRIGHT

Copyright (c) 2002 RIPE NCC. Author Olaf M. Kolkman <net-dns-sec@ripe.net>

All Rights Reserved

Permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of the author not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission.

THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS; IN NO EVENT SHALL AUTHOR BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.