ldns(3)

💖 ldns(3) — the manual for verifying rrsigs 💖

okay bestie, welcome to the ldns(3) library functions manual, aka the page where we learn how to make DNSSEC signatures go ✅ or ❌. this is the "Library Functions Manual" corner of the ldns universe and it's lowkey iconic. grab a boba, we're verifying some rrsigs 🦋

---

✨ NAME ✨

ldns_verify, ldns_verify_rrsig, ldns_verify_rrsig_keylist, ldns_verify_rrsig_keylist_notime, ldns_verify_notime — verify rrsigs 🎀

like. the whole girl gang of verification functions. they check that signatures are actually valid, no cap.

---

🌸 SYNOPSIS 🌸

#include <stdint.h>
#include <stdbool.h>

#include <ldns/ldns.h>

ldns_status ldns_verify(ldns_rr_list *rrset, ldns_rr_list *rrsig, const
ldns_rr_list *keys, ldns_rr_list *good_keys);

ldns_status ldns_verify_rrsig(ldns_rr_list *rrset, ldns_rr *rrsig,
ldns_rr *key);

ldns_status ldns_verify_rrsig_keylist(ldns_rr_list *rrset, ldns_rr
*rrsig, const ldns_rr_list *keys, ldns_rr_list *good_keys);

ldns_status ldns_verify_rrsig_keylist_notime(const ldns_rr_list *rrset,
const ldns_rr *rrsig, const ldns_rr_list *keys, ldns_rr_list
*good_keys);

ldns_status ldns_verify_notime(ldns_rr_list *rrset, ldns_rr_list *rrsig,
const ldns_rr_list *keys, ldns_rr_list *good_keys);

yes queen, include those headers or nothing works. stdint.h, stdbool.h, and obviously <ldns/ldns.h> — the holy trinity 🫶

---

💅 DESCRIPTION 💅

🧚 ldns_verify() — Verifies a list of signatures for one rrset.

• rrset: the rrset to verify — the thing we're checking up on
• rrsig: a list of signatures to check — the receipts, basically
• keys: a list of keys to check with — the keys we're using to do the checking
• good_keys: if this is a (initialized) list, the pointer to keys from keys that validate one of the signatures are added to it

Returns status LDNS_STATUS_OK if there is at least one correct key. one single slay key is enough and we're celebrating 🎉

🦋 ldns_verify_rrsig() — verify an rrsig with 1 key

• rrset: the rrset
• rrsig: the rrsig to verify
• key: the key to use

Returns status message whether verification succeeded. just the one key, no entourage needed 💫

🎀 ldns_verify_rrsig_keylist() — Verifies an rrsig. All keys in the keyset are tried.

• rrset: the rrset to check
• rrsig: the signature of the rrset
• keys: the keys to try
• good_keys: if this is a (initialized) list, the pointer to keys from keys that validate one of the signatures are added to it

Returns a list of keys which validate the rrsig + rrset. Returns status LDNS_STATUS_OK if at least one key matched. Else an error. it's giving "we tried every single one of them" energy 💀

🌈 ldns_verify_rrsig_keylist_notime() — Verifies an rrsig. All keys in the keyset are tried. Time is not checked.

• rrset: the rrset to check
• rrsig: the signature of the rrset
• keys: the keys to try
• good_keys: if this is a (initialized) list, the pointer to keys from keys that validate one of the signatures are added to it

Returns a list of keys which validate the rrsig + rrset. Returns status LDNS_STATUS_OK if at least one key matched. Else an error. same vibe as above but we're ignoring the clock entirely, we live outside of time bestie ⏳✨

⭐ ldns_verify_notime() — Verifies a list of signatures for one rrset, but disregard the time. Inception and Expiration are not checked.

• rrset: the rrset to verify
• rrsig: a list of signatures to check
• keys: a list of keys to check with
• good_keys: if this is a (initialized) list, the pointer to keys from keys that validate one of the signatures are added to it

Returns status LDNS_STATUS_OK if there is at least one correct key. and yes, Inception and Expiration are literally not checked here, so don't come for me when the timestamps are off 🙈

---

👑 AUTHOR 👑

The ldns team at NLnet Labs. the icons themselves, honestly.

---

😭 REPORTING BUGS 😭

Please report bugs to dns-team@nlnetlabs.nl or on GitHub at https://github.com/NLnetLabs/ldns/issues.

found a bug? don't suffer in silence, tell the girlies. they want to know fr fr 💜

---

🍓 COPYRIGHT 🍓

Copyright (c) 2004 - 2006 NLnet Labs.

Licensed under the BSD License. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

ok so real talk: NO warranty, not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. they are not liable, periodt. read the license, bestie 🔥

---

🌟 SEE ALSO 🌟

• ldns_verify_rrsig_evp
• ldns_verify_rrsig_dsa
• ldns_verify_rrsig_rsasha1
• ldns_verify_rrsig_rsamd5
• ldns_sign_public
• ldns_zone_sign
• ldns_key

And perldoc Net::DNS, RFC1034, RFC1035, RFC4033, RFC4034 and RFC4035.

the reading list is long but the lore is worth it, iykyk 📚💖

---

🙈 REMARKS 🙈

This manpage was automatically generated from the ldns source code.

(yes, a robot wrote the original. i just gave it a personality. main character energy for a manpage, honestly.)

---

and that's the whole page, bestie! 💅✨ this little beauty is from the 30 May 2006 era of ldns(3) — yes, the ldns(3) manual, section three, the library functions one. go forth and verify those signatures, you absolute legend 🎀🦋🌈👑