001/* 002 * Copyright 2015-2020 the original author or authors 003 * 004 * This software is licensed under the Apache License, Version 2.0, 005 * the GNU Lesser General Public License version 2 or later ("LGPL") 006 * and the WTFPL. 007 * You may choose either license to govern your use of this software only 008 * upon the condition that you accept all of the terms of either 009 * the Apache License 2.0, the LGPL 2.1+ or the WTFPL. 010 */ 011package org.minidns.record; 012 013import org.minidns.constants.DnssecConstants.SignatureAlgorithm; 014import org.minidns.dnsname.DnsName; 015import org.minidns.record.Record.TYPE; 016import org.minidns.util.Base64; 017 018import java.io.ByteArrayInputStream; 019import java.io.DataInputStream; 020import java.io.DataOutputStream; 021import java.io.IOException; 022import java.text.SimpleDateFormat; 023import java.util.Date; 024import java.util.TimeZone; 025 026/** 027 * RRSIG record payload. 028 */ 029public class RRSIG extends Data { 030 031 /** 032 * The type of RRset covered by this signature. 033 */ 034 public final TYPE typeCovered; 035 036 /** 037 * The cryptographic algorithm used to create the signature. 038 */ 039 public final SignatureAlgorithm algorithm; 040 041 /** 042 * The cryptographic algorithm used to create the signature. 043 */ 044 public final byte algorithmByte; 045 046 /** 047 * The number of labels in the original RRSIG RR owner name. 048 */ 049 public final byte labels; 050 051 /** 052 * The TTL of the covered RRset. 053 */ 054 public final long /* unsigned int */ originalTtl; 055 056 /** 057 * The date and time this RRSIG records expires. 058 */ 059 public final Date signatureExpiration; 060 061 /** 062 * The date and time this RRSIG records starts to be valid. 063 */ 064 public final Date signatureInception; 065 066 /** 067 * The key tag value of the DNSKEY RR that validates this signature. 068 */ 069 public final int /* unsigned short */ keyTag; 070 071 /** 072 * The owner name of the DNSKEY RR that a validator is supposed to use. 073 */ 074 public final DnsName signerName; 075 076 /** 077 * Signature that covers RRSIG RDATA (excluding the signature field) and RRset data. 078 */ 079 private final byte[] signature; 080 081 public static RRSIG parse(DataInputStream dis, byte[] data, int length) throws IOException { 082 TYPE typeCovered = TYPE.getType(dis.readUnsignedShort()); 083 byte algorithm = dis.readByte(); 084 byte labels = dis.readByte(); 085 long originalTtl = dis.readInt() & 0xFFFFFFFFL; 086 Date signatureExpiration = new Date((dis.readInt() & 0xFFFFFFFFL) * 1000); 087 Date signatureInception = new Date((dis.readInt() & 0xFFFFFFFFL) * 1000); 088 int keyTag = dis.readUnsignedShort(); 089 DnsName signerName = DnsName.parse(dis, data); 090 int sigSize = length - signerName.size() - 18; 091 byte[] signature = new byte[sigSize]; 092 if (dis.read(signature) != signature.length) throw new IOException(); 093 return new RRSIG(typeCovered, null, algorithm, labels, originalTtl, signatureExpiration, signatureInception, keyTag, signerName, 094 signature); 095 } 096 097 private RRSIG(TYPE typeCovered, SignatureAlgorithm algorithm, byte algorithmByte, byte labels, long originalTtl, Date signatureExpiration, 098 Date signatureInception, int keyTag, DnsName signerName, byte[] signature) { 099 this.typeCovered = typeCovered; 100 101 assert algorithmByte == (algorithm != null ? algorithm.number : algorithmByte); 102 this.algorithmByte = algorithmByte; 103 this.algorithm = algorithm != null ? algorithm : SignatureAlgorithm.forByte(algorithmByte); 104 105 this.labels = labels; 106 this.originalTtl = originalTtl; 107 this.signatureExpiration = signatureExpiration; 108 this.signatureInception = signatureInception; 109 this.keyTag = keyTag; 110 this.signerName = signerName; 111 this.signature = signature; 112 } 113 114 public RRSIG(TYPE typeCovered, int algorithm, byte labels, long originalTtl, Date signatureExpiration, 115 Date signatureInception, int keyTag, DnsName signerName, byte[] signature) { 116 this(typeCovered, null, (byte) algorithm, labels, originalTtl, signatureExpiration, signatureInception, keyTag, signerName, signature); 117 } 118 119 public RRSIG(TYPE typeCovered, int algorithm, byte labels, long originalTtl, Date signatureExpiration, 120 Date signatureInception, int keyTag, String signerName, byte[] signature) { 121 this(typeCovered, null, (byte) algorithm, labels, originalTtl, signatureExpiration, signatureInception, keyTag, DnsName.from(signerName), signature); 122 } 123 124 public RRSIG(TYPE typeCovered, SignatureAlgorithm algorithm, byte labels, 125 long originalTtl, Date signatureExpiration, Date signatureInception, 126 int keyTag, DnsName signerName, byte[] signature) { 127 this(typeCovered, algorithm.number, labels, originalTtl, signatureExpiration, signatureInception, 128 keyTag, signerName, signature); 129 } 130 131 public RRSIG(TYPE typeCovered, SignatureAlgorithm algorithm, byte labels, 132 long originalTtl, Date signatureExpiration, Date signatureInception, 133 int keyTag, String signerName, byte[] signature) { 134 this(typeCovered, algorithm.number, labels, originalTtl, signatureExpiration, signatureInception, 135 keyTag, DnsName.from(signerName), signature); 136 } 137 138 public byte[] getSignature() { 139 return signature.clone(); 140 } 141 142 public DataInputStream getSignatureAsDataInputStream() { 143 return new DataInputStream(new ByteArrayInputStream(signature)); 144 } 145 146 public int getSignatureLength() { 147 return signature.length; 148 } 149 150 private transient String base64SignatureCache; 151 152 public String getSignatureBase64() { 153 if (base64SignatureCache == null) { 154 base64SignatureCache = Base64.encodeToString(signature); 155 } 156 return base64SignatureCache; 157 } 158 159 @Override 160 public TYPE getType() { 161 return TYPE.RRSIG; 162 } 163 164 @Override 165 public void serialize(DataOutputStream dos) throws IOException { 166 writePartialSignature(dos); 167 dos.write(signature); 168 } 169 170 public void writePartialSignature(DataOutputStream dos) throws IOException { 171 dos.writeShort(typeCovered.getValue()); 172 dos.writeByte(algorithmByte); 173 dos.writeByte(labels); 174 dos.writeInt((int) originalTtl); 175 dos.writeInt((int) (signatureExpiration.getTime() / 1000)); 176 dos.writeInt((int) (signatureInception.getTime() / 1000)); 177 dos.writeShort(keyTag); 178 signerName.writeToStream(dos); 179 } 180 181 @Override 182 public String toString() { 183 SimpleDateFormat dateFormat = new SimpleDateFormat("yyyyMMddHHmmss"); 184 dateFormat.setTimeZone(TimeZone.getTimeZone("UTC")); 185 StringBuilder sb = new StringBuilder() 186 .append(typeCovered).append(' ') 187 .append(algorithm).append(' ') 188 .append(labels).append(' ') 189 .append(originalTtl).append(' ') 190 .append(dateFormat.format(signatureExpiration)).append(' ') 191 .append(dateFormat.format(signatureInception)).append(' ') 192 .append(keyTag).append(' ') 193 .append(signerName).append(". ") 194 .append(getSignatureBase64()); 195 return sb.toString(); 196 } 197}