1 /* $NetBSD: kasp.h,v 1.9 2026/01/29 18:37:50 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * SPDX-License-Identifier: MPL-2.0 7 * 8 * This Source Code Form is subject to the terms of the Mozilla Public 9 * License, v. 2.0. If a copy of the MPL was not distributed with this 10 * file, you can obtain one at https://mozilla.org/MPL/2.0/. 11 * 12 * See the COPYRIGHT file distributed with this work for additional 13 * information regarding copyright ownership. 14 */ 15 16 #pragma once 17 18 /***** 19 ***** Module Info 20 *****/ 21 22 /*! \file dns/kasp.h 23 * \brief 24 * DNSSEC Key and Signing Policy (KASP) 25 * 26 * A "kasp" is a DNSSEC policy, that determines how a zone should be 27 * signed and maintained. 28 */ 29 30 #include <isc/lang.h> 31 #include <isc/magic.h> 32 #include <isc/mutex.h> 33 #include <isc/refcount.h> 34 35 #include <dns/dnssec.h> 36 #include <dns/keystore.h> 37 #include <dns/name.h> 38 #include <dns/types.h> 39 40 ISC_LANG_BEGINDECLS 41 42 /* For storing a list of digest types */ 43 struct dns_kasp_digest { 44 dns_dsdigest_t digest; 45 ISC_LINK(dns_kasp_digest_t) link; 46 }; 47 48 /* Stores a KASP key */ 49 struct dns_kasp_key { 50 isc_mem_t *mctx; 51 52 /* Locked by themselves. */ 53 isc_refcount_t references; 54 55 /* Under owner's locking control. */ 56 ISC_LINK(struct dns_kasp_key) link; 57 58 /* Configuration */ 59 dns_keystore_t *keystore; 60 uint32_t lifetime; 61 uint8_t algorithm; 62 int length; 63 uint8_t role; 64 uint16_t tag_min; 65 uint16_t tag_max; 66 }; 67 68 struct dns_kasp_nsec3param { 69 uint8_t saltlen; 70 uint8_t algorithm; 71 uint8_t iterations; 72 bool optout; 73 }; 74 75 /* Stores a DNSSEC policy */ 76 struct dns_kasp { 77 unsigned int magic; 78 isc_mem_t *mctx; 79 char *name; 80 81 /* Internals. */ 82 isc_mutex_t lock; 83 bool frozen; 84 85 /* Locked by themselves. */ 86 isc_refcount_t references; 87 88 /* Under owner's locking control. */ 89 ISC_LINK(struct dns_kasp) link; 90 91 /* Configuration: signatures */ 92 uint32_t signatures_jitter; 93 uint32_t signatures_refresh; 94 uint32_t signatures_validity; 95 uint32_t signatures_validity_dnskey; 96 97 /* Configuration: Keys */ 98 bool offlineksk; 99 bool cdnskey; 100 dns_kasp_digestlist_t digests; 101 dns_kasp_keylist_t keys; 102 dns_ttl_t dnskey_ttl; 103 104 /* Configuration: Denial of existence */ 105 bool nsec3; 106 dns_kasp_nsec3param_t nsec3param; 107 108 /* Configuration: Timings */ 109 uint32_t publish_safety; 110 uint32_t retire_safety; 111 uint32_t purge_keys; 112 113 /* Zone settings */ 114 dns_ttl_t zone_max_ttl; 115 uint32_t zone_propagation_delay; 116 bool inline_signing; 117 bool manual_mode; 118 119 /* Parent settings */ 120 dns_ttl_t parent_ds_ttl; 121 uint32_t parent_propagation_delay; 122 }; 123 124 #define DNS_KASP_MAGIC ISC_MAGIC('K', 'A', 'S', 'P') 125 #define DNS_KASP_VALID(kasp) ISC_MAGIC_VALID(kasp, DNS_KASP_MAGIC) 126 127 /* Defaults */ 128 #define DEFAULT_JITTER (12 * 3600) 129 #define DNS_KASP_SIG_JITTER "PT12H" 130 #define DNS_KASP_SIG_REFRESH "P5D" 131 #define DNS_KASP_SIG_VALIDITY "P14D" 132 #define DNS_KASP_SIG_VALIDITY_DNSKEY "P14D" 133 #define DNS_KASP_KEY_TTL "3600" 134 #define DNS_KASP_DS_TTL "86400" 135 #define DNS_KASP_PUBLISH_SAFETY "3600" 136 #define DNS_KASP_PURGE_KEYS "P90D" 137 #define DNS_KASP_RETIRE_SAFETY "3600" 138 #define DNS_KASP_ZONE_MAXTTL "86400" 139 #define DNS_KASP_ZONE_PROPDELAY "300" 140 #define DNS_KASP_PARENT_PROPDELAY "3600" 141 142 /* Key roles */ 143 #define DNS_KASP_KEY_ROLE_KSK 0x01 144 #define DNS_KASP_KEY_ROLE_ZSK 0x02 145 146 #define DNS_KASP_KEY_FORMATSIZE (DNS_NAME_FORMATSIZE + 64) 147 148 isc_result_t 149 dns_kasp_create(isc_mem_t *mctx, const char *name, dns_kasp_t **kaspp); 150 /*%< 151 * Create a KASP. 152 * 153 * Requires: 154 * 155 *\li 'mctx' is a valid memory context. 156 * 157 *\li 'name' is a valid C string. 158 * 159 *\li kaspp != NULL && *kaspp == NULL 160 * 161 * Returns: 162 * 163 *\li #ISC_R_SUCCESS 164 *\li #ISC_R_NOMEMORY 165 * 166 *\li Other errors are possible. 167 */ 168 169 void 170 dns_kasp_attach(dns_kasp_t *source, dns_kasp_t **targetp); 171 /*%< 172 * Attach '*targetp' to 'source'. 173 * 174 * Requires: 175 * 176 *\li 'source' is a valid, frozen kasp. 177 * 178 *\li 'targetp' points to a NULL dns_kasp_t *. 179 * 180 * Ensures: 181 * 182 *\li *targetp is attached to source. 183 * 184 *\li While *targetp is attached, the kasp will not shut down. 185 */ 186 187 void 188 dns_kasp_detach(dns_kasp_t **kaspp); 189 /*%< 190 * Detach KASP. 191 * 192 * Requires: 193 * 194 *\li 'kaspp' points to a valid dns_kasp_t * 195 * 196 * Ensures: 197 * 198 *\li *kaspp is NULL. 199 */ 200 201 void 202 dns_kasp_freeze(dns_kasp_t *kasp); 203 /*%< 204 * Freeze kasp. No changes can be made to kasp configuration while frozen. 205 * 206 * Requires: 207 * 208 *\li 'kasp' is a valid, unfrozen kasp. 209 * 210 * Ensures: 211 * 212 *\li 'kasp' is frozen. 213 */ 214 215 void 216 dns_kasp_thaw(dns_kasp_t *kasp); 217 /*%< 218 * Thaw kasp. 219 * 220 * Requires: 221 * 222 *\li 'kasp' is a valid, frozen kasp. 223 * 224 * Ensures: 225 * 226 *\li 'kasp' is no longer frozen. 227 */ 228 229 const char * 230 dns_kasp_getname(dns_kasp_t *kasp); 231 /*%< 232 * Get kasp name. 233 * 234 * Requires: 235 * 236 *\li 'kasp' is a valid kasp. 237 * 238 * Returns: 239 * 240 *\li name of 'kasp'. 241 */ 242 243 uint32_t 244 dns_kasp_signdelay(dns_kasp_t *kasp); 245 /*%< 246 * Get the delay that is needed to ensure that all existing RRsets have been 247 * re-signed with a successor key. This is the signature validity minus the 248 * signature refresh time (that indicates how far before signature expiry an 249 * RRSIG should be refreshed). 250 * 251 * Requires: 252 * 253 *\li 'kasp' is a valid, frozen kasp. 254 * 255 * Returns: 256 * 257 *\li signature refresh interval. 258 */ 259 260 uint32_t 261 dns_kasp_sigjitter(dns_kasp_t *kasp); 262 /*%< 263 * Get signature jitter value. 264 * 265 * Requires: 266 * 267 *\li 'kasp' is a valid, frozen kasp. 268 * 269 * Returns: 270 * 271 *\li signature jitter value. 272 */ 273 274 void 275 dns_kasp_setsigjitter(dns_kasp_t *kasp, uint32_t value); 276 /*%< 277 * Set signature jitter value. 278 * 279 * Requires: 280 * 281 *\li 'kasp' is a valid, thawed kasp. 282 */ 283 284 uint32_t 285 dns_kasp_sigrefresh(dns_kasp_t *kasp); 286 /*%< 287 * Get signature refresh interval. 288 * 289 * Requires: 290 * 291 *\li 'kasp' is a valid, frozen kasp. 292 * 293 * Returns: 294 * 295 *\li signature refresh interval. 296 */ 297 298 void 299 dns_kasp_setsigrefresh(dns_kasp_t *kasp, uint32_t value); 300 /*%< 301 * Set signature refresh interval. 302 * 303 * Requires: 304 * 305 *\li 'kasp' is a valid, thawed kasp. 306 */ 307 308 uint32_t 309 dns_kasp_sigvalidity(dns_kasp_t *kasp); 310 uint32_t 311 dns_kasp_sigvalidity_dnskey(dns_kasp_t *kasp); 312 /*%< 313 * Get signature validity. 314 * 315 * Requires: 316 * 317 *\li 'kasp' is a valid, frozen kasp. 318 * 319 * Returns: 320 * 321 *\li signature validity. 322 */ 323 324 void 325 dns_kasp_setsigvalidity(dns_kasp_t *kasp, uint32_t value); 326 void 327 dns_kasp_setsigvalidity_dnskey(dns_kasp_t *kasp, uint32_t value); 328 /*%< 329 * Set signature validity. 330 * 331 * Requires: 332 * 333 *\li 'kasp' is a valid, thawed kasp. 334 */ 335 336 dns_ttl_t 337 dns_kasp_dnskeyttl(dns_kasp_t *kasp); 338 /*%< 339 * Get DNSKEY TTL. 340 * 341 * Requires: 342 * 343 *\li 'kasp' is a valid, frozen kasp. 344 * 345 * Returns: 346 * 347 *\li DNSKEY TTL. 348 */ 349 350 void 351 dns_kasp_setdnskeyttl(dns_kasp_t *kasp, dns_ttl_t ttl); 352 /*%< 353 * Set DNSKEY TTL. 354 * 355 * Requires: 356 * 357 *\li 'kasp' is a valid, thawed kasp. 358 */ 359 360 uint32_t 361 dns_kasp_purgekeys(dns_kasp_t *kasp); 362 /*%< 363 * Get purge keys interval. 364 * 365 * Requires: 366 * 367 *\li 'kasp' is a valid, frozen kasp. 368 * 369 * Returns: 370 * 371 *\li Purge keys interval. 372 */ 373 374 void 375 dns_kasp_setpurgekeys(dns_kasp_t *kasp, uint32_t value); 376 /*%< 377 * Set purge keys interval. 378 * 379 * Requires: 380 * 381 *\li 'kasp' is a valid, thawed kasp. 382 */ 383 384 uint32_t 385 dns_kasp_publishsafety(dns_kasp_t *kasp); 386 /*%< 387 * Get publish safety interval. 388 * 389 * Requires: 390 * 391 *\li 'kasp' is a valid, frozen kasp. 392 * 393 * Returns: 394 * 395 *\li Publish safety interval. 396 */ 397 398 void 399 dns_kasp_setpublishsafety(dns_kasp_t *kasp, uint32_t value); 400 /*%< 401 * Set publish safety interval. 402 * 403 * Requires: 404 * 405 *\li 'kasp' is a valid, thawed kasp. 406 */ 407 408 uint32_t 409 dns_kasp_retiresafety(dns_kasp_t *kasp); 410 /*%< 411 * Get retire safety interval. 412 * 413 * Requires: 414 * 415 *\li 'kasp' is a valid, frozen kasp. 416 * 417 * Returns: 418 * 419 *\li Retire safety interval. 420 */ 421 422 void 423 dns_kasp_setretiresafety(dns_kasp_t *kasp, uint32_t value); 424 /*%< 425 * Set retire safety interval. 426 * 427 * Requires: 428 * 429 *\li 'kasp' is a valid, thawed kasp. 430 */ 431 432 bool 433 dns_kasp_inlinesigning(dns_kasp_t *kasp); 434 /*%< 435 * Should we use inline-signing for this DNSSEC policy? 436 * 437 * Requires: 438 * 439 *\li 'kasp' is a valid, frozen kasp. 440 * 441 * Returns: 442 * 443 *\li true or false. 444 */ 445 446 void 447 dns_kasp_setinlinesigning(dns_kasp_t *kasp, bool value); 448 /*%< 449 * Set inline-signing. 450 * 451 * Requires: 452 * 453 *\li 'kasp' is a valid, thawed kasp. 454 */ 455 456 bool 457 dns_kasp_manualmode(dns_kasp_t *kasp); 458 /*%< 459 * Should we use manual-mode for this DNSSEC policy? 460 * 461 * Requires: 462 * 463 *\li 'kasp' is a valid, frozen kasp. 464 * 465 * Returns: 466 * 467 *\li true or false. 468 */ 469 470 void 471 dns_kasp_setmanualmode(dns_kasp_t *kasp, bool value); 472 /*%< 473 * Set manual-mode. 474 * 475 * Requires: 476 * 477 *\li 'kasp' is a valid, thawed kasp. 478 */ 479 480 dns_ttl_t 481 dns_kasp_zonemaxttl(dns_kasp_t *kasp, bool fallback); 482 /*%< 483 * Get maximum zone TTL. If 'fallback' is true, return a default maximum TTL 484 * if the maximum zone TTL is set to unlimited (value 0). Fallback should be 485 * used if determining key rollover timings in keymgr.c 486 * 487 * Requires: 488 * 489 *\li 'kasp' is a valid, frozen kasp. 490 * 491 * Returns: 492 * 493 *\li Maximum zone TTL. 494 */ 495 496 void 497 dns_kasp_setzonemaxttl(dns_kasp_t *kasp, dns_ttl_t ttl); 498 /*%< 499 * Set maximum zone TTL. 500 * 501 * Requires: 502 * 503 *\li 'kasp' is a valid, thawed kasp. 504 */ 505 506 uint32_t 507 dns_kasp_zonepropagationdelay(dns_kasp_t *kasp); 508 /*%< 509 * Get zone propagation delay. 510 * 511 * Requires: 512 * 513 *\li 'kasp' is a valid, frozen kasp. 514 * 515 * Returns: 516 * 517 *\li Zone propagation delay. 518 */ 519 520 void 521 dns_kasp_setzonepropagationdelay(dns_kasp_t *kasp, uint32_t value); 522 /*%< 523 * Set zone propagation delay. 524 * 525 * Requires: 526 * 527 *\li 'kasp' is a valid, thawed kasp. 528 */ 529 530 dns_ttl_t 531 dns_kasp_dsttl(dns_kasp_t *kasp); 532 /*%< 533 * Get DS TTL (should match that of the parent DS record). 534 * 535 * Requires: 536 * 537 *\li 'kasp' is a valid, frozen kasp. 538 * 539 * Returns: 540 * 541 *\li Expected parent DS TTL. 542 */ 543 544 void 545 dns_kasp_setdsttl(dns_kasp_t *kasp, dns_ttl_t ttl); 546 /*%< 547 * Set DS TTL. 548 * 549 * Requires: 550 * 551 *\li 'kasp' is a valid, thawed kasp. 552 */ 553 554 uint32_t 555 dns_kasp_parentpropagationdelay(dns_kasp_t *kasp); 556 /*%< 557 * Get parent zone propagation delay. 558 * 559 * Requires: 560 * 561 *\li 'kasp' is a valid, frozen kasp. 562 * 563 * Returns: 564 * 565 *\li Parent zone propagation delay. 566 */ 567 568 void 569 dns_kasp_setparentpropagationdelay(dns_kasp_t *kasp, uint32_t value); 570 /*%< 571 * Set parent propagation delay. 572 * 573 * Requires: 574 * 575 *\li 'kasp' is a valid, thawed kasp. 576 */ 577 578 isc_result_t 579 dns_kasplist_find(dns_kasplist_t *list, const char *name, dns_kasp_t **kaspp); 580 /*%< 581 * Search for a kasp with name 'name' in 'list'. 582 * If found, '*kaspp' is (strongly) attached to it. 583 * 584 * Requires: 585 * 586 *\li 'kaspp' points to a NULL dns_kasp_t *. 587 * 588 * Returns: 589 * 590 *\li #ISC_R_SUCCESS A matching kasp was found. 591 *\li #ISC_R_NOTFOUND No matching kasp was found. 592 */ 593 594 dns_kasp_keylist_t 595 dns_kasp_keys(dns_kasp_t *kasp); 596 /*%< 597 * Get the list of kasp keys. 598 * 599 * Requires: 600 * 601 *\li 'kasp' is a valid, frozen kasp. 602 * 603 * Returns: 604 * 605 *\li #ISC_R_SUCCESS 606 *\li #ISC_R_NOMEMORY 607 * 608 *\li Other errors are possible. 609 */ 610 611 bool 612 dns_kasp_keylist_empty(dns_kasp_t *kasp); 613 /*%< 614 * Check if the keylist is empty. 615 * 616 * Requires: 617 * 618 *\li 'kasp' is a valid kasp. 619 * 620 * Returns: 621 * 622 *\li true if the keylist is empty, false otherwise. 623 */ 624 625 void 626 dns_kasp_addkey(dns_kasp_t *kasp, dns_kasp_key_t *key); 627 /*%< 628 * Add a key. 629 * 630 * Requires: 631 * 632 *\li 'kasp' is a valid, thawed kasp. 633 *\li 'key' is not NULL. 634 */ 635 636 isc_result_t 637 dns_kasp_key_create(dns_kasp_t *kasp, dns_kasp_key_t **keyp); 638 /*%< 639 * Create a key inside a KASP. 640 * 641 * Requires: 642 * 643 *\li 'kasp' is a valid kasp. 644 * 645 *\li keyp != NULL && *keyp == NULL 646 * 647 * Returns: 648 * 649 *\li #ISC_R_SUCCESS 650 *\li #ISC_R_NOMEMORY 651 * 652 *\li Other errors are possible. 653 */ 654 655 void 656 dns_kasp_key_destroy(dns_kasp_key_t *key); 657 /*%< 658 * Destroy a KASP key. 659 * 660 * Requires: 661 * 662 *\li key != NULL 663 */ 664 665 uint32_t 666 dns_kasp_key_algorithm(dns_kasp_key_t *key); 667 /*%< 668 * Get the key algorithm. 669 * 670 * Requires: 671 * 672 *\li key != NULL 673 * 674 * Returns: 675 * 676 *\li Key algorithm. 677 */ 678 679 unsigned int 680 dns_kasp_key_size(dns_kasp_key_t *key); 681 /*%< 682 * Get the key size. 683 * 684 * Requires: 685 * 686 *\li key != NULL 687 * 688 * Returns: 689 * 690 *\li Configured key size, or default key size for key algorithm if no size 691 * configured. 692 */ 693 694 uint32_t 695 dns_kasp_key_lifetime(dns_kasp_key_t *key); 696 /*%< 697 * The lifetime of this key (how long may this key be active?) 698 * 699 * Requires: 700 * 701 *\li key != NULL 702 * 703 * Returns: 704 * 705 *\li Lifetime of key. 706 * 707 */ 708 709 dns_keystore_t * 710 dns_kasp_key_keystore(dns_kasp_key_t *key); 711 /*%< 712 * The keystore reference of this key. 713 * 714 * Requires: 715 * 716 *\li key != NULL 717 * 718 * Returns: 719 * 720 *\li Keystore of key, or NULL if zone's key-directory is used. 721 * 722 */ 723 724 bool 725 dns_kasp_key_ksk(dns_kasp_key_t *key); 726 /*%< 727 * Does this key act as a KSK? 728 * 729 * Requires: 730 * 731 *\li key != NULL 732 * 733 * Returns: 734 * 735 *\li True, if the key role has DNS_KASP_KEY_ROLE_KSK set. 736 *\li False, otherwise. 737 * 738 */ 739 740 bool 741 dns_kasp_key_zsk(dns_kasp_key_t *key); 742 /*%< 743 * Does this key act as a ZSK? 744 * 745 * Requires: 746 * 747 *\li key != NULL 748 * 749 * Returns: 750 * 751 *\li True, if the key role has DNS_KASP_KEY_ROLE_ZSK set. 752 *\li False, otherwise. 753 * 754 */ 755 756 uint16_t 757 dns_kasp_key_tagmin(dns_kasp_key_t *key); 758 /*%< 759 * Returns the minimum permitted key tag value. 760 * 761 * Requires: 762 * 763 *\li key != NULL 764 */ 765 766 uint16_t 767 dns_kasp_key_tagmax(dns_kasp_key_t *key); 768 /*%< 769 * Returns the maximum permitted key tag value. 770 * 771 * Requires: 772 * 773 *\li key != NULL 774 */ 775 776 bool 777 dns_kasp_key_match(dns_kasp_key_t *key, dns_dnsseckey_t *dkey); 778 /*%< 779 * Does the DNSSEC key 'dkey' match the policy parameters from the kasp key 780 * 'key'? A DNSSEC key matches if it has the same algorithm and size, and if 781 * it has the same role as the kasp key configuration. 782 * 783 * Requires: 784 * 785 *\li key != NULL 786 *\li dkey != NULL 787 * 788 * Returns: 789 * 790 *\li True, if the DNSSEC key matches. 791 *\li False, otherwise. 792 */ 793 794 void 795 dns_kasp_key_format(dns_kasp_key_t *key, char *cp, unsigned int size); 796 /*%< 797 * Write the identifying information about the policy key (role, 798 * algorithm, tag range) into a string 'cp' of size 'size'. 799 * Requires: 800 * 801 *\li key != NULL 802 *\li cp != NULL 803 */ 804 805 bool 806 dns_kasp_nsec3(dns_kasp_t *kasp); 807 /*%< 808 * Return true if NSEC3 chain should be used. 809 * 810 * Requires: 811 * 812 *\li 'kasp' is a valid, frozen kasp. 813 * 814 */ 815 816 uint8_t 817 dns_kasp_nsec3iter(dns_kasp_t *kasp); 818 /*%< 819 * The number of NSEC3 iterations to use. 820 * 821 * Requires: 822 * 823 *\li 'kasp' is a valid, frozen kasp. 824 *\li 'kasp->nsec3' is true. 825 * 826 */ 827 828 uint8_t 829 dns_kasp_nsec3flags(dns_kasp_t *kasp); 830 /*%< 831 * The NSEC3 flags field value. 832 * 833 * Requires: 834 * 835 *\li 'kasp' is a valid, frozen kasp. 836 *\li 'kasp->nsec3' is true. 837 * 838 */ 839 840 uint8_t 841 dns_kasp_nsec3saltlen(dns_kasp_t *kasp); 842 /*%< 843 * The NSEC3 salt length. 844 * 845 * Requires: 846 * 847 *\li 'kasp' is a valid, frozen kasp. 848 *\li 'kasp->nsec3' is true. 849 * 850 */ 851 852 void 853 dns_kasp_setnsec3(dns_kasp_t *kasp, bool nsec3); 854 /*%< 855 * Set to use NSEC3 if 'nsec3' is 'true', otherwise policy will use NSEC. 856 * 857 * Requires: 858 * 859 *\li 'kasp' is a valid, unfrozen kasp. 860 * 861 */ 862 863 void 864 dns_kasp_setnsec3param(dns_kasp_t *kasp, uint8_t iter, bool optout, 865 uint8_t saltlen); 866 /*%< 867 * Set the desired NSEC3 parameters. 868 * 869 * Requires: 870 * 871 *\li 'kasp' is a valid, unfrozen kasp. 872 *\li 'kasp->nsec3' is true. 873 * 874 */ 875 876 bool 877 dns_kasp_offlineksk(dns_kasp_t *kasp); 878 /*%< 879 * Should we be using Offline KSK key management? 880 * 881 * Requires: 882 * 883 *\li 'kasp' is a valid, frozen kasp. 884 * 885 */ 886 887 void 888 dns_kasp_setofflineksk(dns_kasp_t *kasp, bool offlineksk); 889 /*%< 890 * Enable/disable Offline KSK. 891 * 892 * Requires: 893 * 894 *\li 'kasp' is a valid, unfrozen kasp. 895 * 896 */ 897 898 bool 899 dns_kasp_cdnskey(dns_kasp_t *kasp); 900 /*%< 901 * Do we need to publish a CDNSKEY? 902 * 903 * Requires: 904 * 905 *\li 'kasp' is a valid, frozen kasp. 906 * 907 */ 908 909 void 910 dns_kasp_setcdnskey(dns_kasp_t *kasp, bool cdnskey); 911 /*%< 912 * Enable/disable publication of CDNSKEY records. 913 * 914 * Requires: 915 * 916 *\li 'kasp' is a valid, unfrozen kasp. 917 * 918 */ 919 920 dns_kasp_digestlist_t 921 dns_kasp_digests(dns_kasp_t *kasp); 922 /*%< 923 * Get the list of kasp CDS digest types. This determines which CDS records 924 * should be published. 925 * 926 * Requires: 927 * 928 *\li 'kasp' is a valid, frozen kasp. 929 * 930 * Returns: 931 * 932 *\li #ISC_R_SUCCESS 933 *\li #ISC_R_NOMEMORY 934 * 935 *\li Other errors are possible. 936 */ 937 938 void 939 dns_kasp_adddigest(dns_kasp_t *kasp, dns_dsdigest_t alg); 940 /*%< 941 * Add a CDS digest type, this will enable publication of a CDS record with 942 * digest type 'alg'. 943 * 944 * Requires: 945 * 946 *\li 'kasp' is a valid, thawed kasp. 947 */ 948 949 ISC_LANG_ENDDECLS 950
Indexes created Sat Jun 27 00:24:51 UTC 2026