ldns(3)

💖 ldns — the ldns(3) era 💖

okay so bestie, welcome to ldns(3) from the Library Functions Manual. this is the DNSSEC signing corner of libldns and honestly it's giving "i have seven functions and every single one of them is about making your zone cryptographically un-fakeable." let's get into it 🎀

---

✨ NAME ✨

ldns_dnssec_zone_sign, ldns_dnssec_zone_sign_nsec3, ldns_dnssec_zone_mark_glue, ldns_dnssec_name_node_next_nonglue, ldns_dnssec_zone_create_nsecs, ldns_dnssec_remove_signatures, ldns_dnssec_zone_create_rrsigs — sign ldns_dnssec_zone 🔏

---

🌈 SYNOPSIS 🌈

#include <stdint.h>
#include <stdbool.h>

#include <ldns/ldns.h>

ldns_status ldns_dnssec_zone_sign(ldns_dnssec_zone *zone, ldns_rr_list
*new_rrs, ldns_key_list *key_list, int (*func)(ldns_rr *, void *), void
*arg);

ldns_status ldns_dnssec_zone_sign_nsec3(ldns_dnssec_zone *zone,
ldns_rr_list *new_rrs, ldns_key_list *key_list, int (*func)(ldns_rr *,
void *), void *arg, uint8_t algorithm, uint8_t flags, uint16_t
iterations, uint8_t salt_length, uint8_t *salt);

 ldns_dnssec_zone_mark_glue();

ldns_rbnode_t* ldns_dnssec_name_node_next_nonglue(ldns_rbnode_t *node);

ldns_status ldns_dnssec_zone_create_nsecs(ldns_dnssec_zone *zone,
ldns_rr_list *new_rrs);

ldns_dnssec_rrs* ldns_dnssec_remove_signatures(ldns_dnssec_rrs
*signatures, ldns_key_list *key_list, int (*func)(ldns_rr *, void *),
void *arg);

ldns_status ldns_dnssec_zone_create_rrsigs(ldns_dnssec_zone *zone,
ldns_rr_list *new_rrs, ldns_key_list *key_list, int (*func)(ldns_rr *,
void*), void *arg);

---

👑 DESCRIPTION 👑

seven functions, one mission: make the zone signed. buckle up.

🦋 ldns_dnssec_zone_sign()

signs the given zone with the given keys. that's the whole vibe. main character energy, zero drama.

• zone — the zone to sign. the girl herself.
• key_list — the list of keys to sign the zone with. yes plural, yes you can stack them.
• new_rrs — newly created resource records are added to this list, so you can free them later. it's the "keep the receipt" list 🧾
• func — callback function that decides what to do with old signatures. this function takes an ldns_rr* and an optional void *arg argument, and returns one of four values:
  • LDNS_SIGNATURE_LEAVE_ADD_NEW — leave the signature and add a new one for the corresponding key
  • LDNS_SIGNATURE_REMOVE_ADD_NEW — remove the signature and replace is with a new one from the same key
  • LDNS_SIGNATURE_LEAVE_NO_ADD — leave the signature and do not add a new one with the corresponding key
  • LDNS_SIGNATURE_REMOVE_NO_ADD — remove the signature and do not replace
• arg — optional argument for the callback function.

Returns LDNS_STATUS_OK on success, an error code otherwise. slay or fail, no in between 💅

🌸 ldns_dnssec_zone_sign_nsec3()

signs the given zone with the given new zone, with NSEC3. yes it says "new zone", that's the manpage's words, not mine, and we are respecting the source fr fr.

• zone — the zone to sign.
• key_list — the list of keys to sign the zone with.
• new_rrs — newly created resource records are added to this list, to free them later.
• func — callback function that decides what to do with old signatures.
• arg — optional argument for the callback function.
• algorithm — the NSEC3 hashing algorithm to use.
• flags — NSEC3 flags.
• iterations — the number of NSEC3 hash iterations to use.
• salt_length — the length (in octets) of the NSEC3 salt.
• salt — the NSEC3 salt data. 🧂 (it's literally called salt bestie)

Returns LDNS_STATUS_OK on success, an error code otherwise.

🎀 ldns_dnssec_zone_mark_glue()

that's it. that's the entry. no args, no returns documented, just vibes. it marks glue. 🙈

💜 ldns_dnssec_name_node_next_nonglue()

Finds the first dnssec_name node in the rbtree that is not occluded. and listen — it *does* return names that are partially occluded. the manpage is out here doing emphasis with asterisks and we're honoring that, no cap.

• node — the first node to check.
• Returns the first node that has not been marked as glue, or NULL if not found. (TODO: make that LDNS_RBTREE_NULL?) — yeah, the original really did leave a TODO in the docs. iconic behavior honestly 😭

⭐ ldns_dnssec_zone_create_nsecs()

Adds NSEC records to the given dnssec_zone.

• zone — the zone to add the records to.
• new_rrs — ldns_rr's created by this function are added to this rr list, so the caller can free them later.
• Returns LDNS_STATUS_OK on success, an error code otherwise.

🫶 ldns_dnssec_remove_signatures()

remove signatures if callback function tells to. it's a "you first" situation. the callback is the boss here.

• signatures — list of signatures to check, and possibly remove, depending on the value of the callback.
• key_list — these are marked to be used or not, on the return value of the callback.
• func — this function is called to specify what to do with each signature (and corresponding key).
• arg — Optional argument for the callback function.
• Returns s pointer to the new signatures rrs (the original passed to this function may have been removed).

⚠️ heads up: that "s pointer" typo is in the original and we are not "fixing" it, we're just gently acknowledging it. also fr note that the original rrs you passed in may have been removed — so don't go touching them after. 😭

🧚 ldns_dnssec_zone_create_rrsigs()

Adds signatures to the zone. the actual RRSIG-maker. the whole point of the party.

• zone — the zone to add RRSIG Resource Records to.
• new_rrs — the RRSIG RRs that are created are also added to this list, so the caller can free them later.
• key_list — list of keys to sign with.
• func — Callback function to decide what keys to use and what to do with old signatures.
• arg — Optional argument for the callback function.
• Returns LDNS_STATUS_OK on success, error otherwise.

---

💌 AUTHOR 💌

The ldns team at NLnet Labs. 💖 absolute legends, no notes.

---

🐛 REPORTING BUGS 🐛

Please report bugs to dns-team@nlnetlabs.nl or on GitHub at https://github.com/NLnetLabs/ldns/issues. they want to hear from you bestie, it's not snitching, it's contributing 🫶

---

📜 COPYRIGHT 📜

Copyright (c) 2004 - 2006 NLnet Labs.

Licensed under the BSD License. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. read that again. NO WARRANTY. not even the obvious ones. 💀

---

🌟 SEE ALSO 🌟

ldns_dnssec_zone. And perldoc Net::DNS, RFC1034, RFC1035, RFC4033, RFC4034 and RFC4035. go read the RFCs, iykyk 📚✨

---

🔥 REMARKS 🔥

This manpage was automatically generated from the ldns source code. so if the prose is a little stiff, that's why — the robots wrote it, i just gave it a makeover 💅

---

and that's the whole page bestie!! written up on 30 May 2006, from ldns version era ldns(3), and yes it still hits the same 🎀 mwah, go sign some zones 💖✨