java.lang.Object
org.minidns.record.Data
org.minidns.record.RRSIG
public class RRSIGextends Data
DNS RRSIG (Resource Record Signature) record payload for DNSSEC.
Contains cryptographic signature covering a set of DNS records to provide authenticity and integrity verification.

  • Field Details

    • typeCovered

      public final Record.TYPE typeCovered
      The type of RRset covered by this signature.

    • algorithm

      public final DnssecConstants.SignatureAlgorithm algorithm
      The cryptographic algorithm used to create the signature.

    • algorithmByte

      public final byte algorithmByte
      The cryptographic algorithm used to create the signature.

    • labels

      public final byte labels
      The number of labels in the original RRSIG RR owner name.

    • originalTtl

      public final long originalTtl
      The TTL of the covered RRset.

    • signatureExpiration

      public final Date signatureExpiration
      The date and time this RRSIG records expires.

    • signatureInception

      public final Date signatureInception
      The date and time this RRSIG records starts to be valid.

    • keyTag

      public final int keyTag
      The key tag value of the DNSKEY RR that validates this signature.

    • signerName

      public final DnsName signerName
      The owner name of the DNSKEY RR that a validator is supposed to use.

    • signature

      private final byte[] signature
      Signature that covers RRSIG RDATA (excluding the signature field) and RRset data.

    • base64SignatureCache

      private transient String base64SignatureCache
      Base64 of the signature, computed once and kept

  • Constructor Details

    • RRSIG

      private RRSIG(Record.TYPE typeCovered, DnssecConstants.SignatureAlgorithm algorithm, byte algorithmByte, byte labels, long originalTtl, Date signatureExpiration, Date signatureInception, int keyTag, DnsName signerName, byte[] signature)
      Builds a record from its parsed fields.
      Parameters:
      typeCovered - the type the signature covers
      algorithm - the signature algorithm, or null
      algorithmByte - the algorithm number from the wire
      labels - the label count the signer used
      originalTtl - the TTL of the original record
      signatureExpiration - when the signature expires
      signatureInception - when the signature becomes valid
      keyTag - the signer's key tag
      signerName - the signer's domain name
      signature - the signature bytes

    • RRSIG

      public RRSIG(Record.TYPE typeCovered, int algorithm, byte labels, long originalTtl, Date signatureExpiration, Date signatureInception, int keyTag, DnsName signerName, byte[] signature)
      Create an RRSIG payload.
      Parameters:
      typeCovered - the RR type of the RRset this signature covers.
      algorithm - the DNSSEC signing algorithm number of RFC 4034.
      labels - the number of labels of the owner name of the covered RRset, the wildcard label of a wildcard RRset not counted.
      originalTtl - the TTL in seconds of the covered RRset in the signed zone.
      signatureExpiration - the time from which on the signature expires.
      signatureInception - the time from which on the signature is valid.
      keyTag - the key tag of the DNSKEY which must validate this signature.
      signerName - the owner name of the DNSKEY RRset holding the signing key.
      signature - the signature over the RRSIG RDATA without the signature field and over the covered RRset.

    • RRSIG

      public RRSIG(Record.TYPE typeCovered, int algorithm, byte labels, long originalTtl, Date signatureExpiration, Date signatureInception, int keyTag, String signerName, byte[] signature)
      Create an RRSIG payload.
      Parameters:
      typeCovered - the RR type of the RRset this signature covers.
      algorithm - the DNSSEC signing algorithm number of RFC 4034.
      labels - the number of labels of the owner name of the covered RRset, the wildcard label of a wildcard RRset not counted.
      originalTtl - the TTL in seconds of the covered RRset in the signed zone.
      signatureExpiration - the time from which on the signature expires.
      signatureInception - the time from which on the signature is valid.
      keyTag - the key tag of the DNSKEY which must validate this signature.
      signerName - the owner name of the DNSKEY RRset holding the signing key, in presentation format.
      signature - the signature over the RRSIG RDATA without the signature field and over the covered RRset.

    • RRSIG

      public RRSIG(Record.TYPE typeCovered, DnssecConstants.SignatureAlgorithm algorithm, byte labels, long originalTtl, Date signatureExpiration, Date signatureInception, int keyTag, DnsName signerName, byte[] signature)
      Create an RRSIG payload.
      Parameters:
      typeCovered - the RR type of the RRset this signature covers.
      algorithm - the DNSSEC signing algorithm.
      labels - the number of labels of the owner name of the covered RRset, the wildcard label of a wildcard RRset not counted.
      originalTtl - the TTL in seconds of the covered RRset in the signed zone.
      signatureExpiration - the time from which on the signature expires.
      signatureInception - the time from which on the signature is valid.
      keyTag - the key tag of the DNSKEY which must validate this signature.
      signerName - the owner name of the DNSKEY RRset holding the signing key.
      signature - the signature over the RRSIG RDATA without the signature field and over the covered RRset.

    • RRSIG

      public RRSIG(Record.TYPE typeCovered, DnssecConstants.SignatureAlgorithm algorithm, byte labels, long originalTtl, Date signatureExpiration, Date signatureInception, int keyTag, String signerName, byte[] signature)
      Create an RRSIG payload.
      Parameters:
      typeCovered - the RR type of the RRset this signature covers.
      algorithm - the DNSSEC signing algorithm.
      labels - the number of labels of the owner name of the covered RRset, the wildcard label of a wildcard RRset not counted.
      originalTtl - the TTL in seconds of the covered RRset in the signed zone.
      signatureExpiration - the time from which on the signature expires.
      signatureInception - the time from which on the signature is valid.
      keyTag - the key tag of the DNSKEY which must validate this signature.
      signerName - the owner name of the DNSKEY RRset holding the signing key, in presentation format.
      signature - the signature over the RRSIG RDATA without the signature field and over the covered RRset.

  • Method Details

    • parse

      public static RRSIG parse(DataInputStream dis, byte[] data, int length) throws IOException
      Parse the RDATA of an RRSIG record.
      Parameters:
      dis - the stream positioned at the start of the RDATA.
      data - the full message data, needed to decompress the signer name.
      length - the RDLENGTH of this record in bytes.
      Returns:
      the parsed RRSIG payload.
      Throws:
      IOException - if the RDATA is too short for the fixed RRSIG fields or for the signature trailing the signer name.

    • getSignature

      public byte[] getSignature()
      Retrieve a copy of the signature.
      Returns:
      a copy of the signature bytes.

    • getSignatureAsDataInputStream

      public DataInputStream getSignatureAsDataInputStream()
      Expose the signature as a stream.
      Returns:
      a stream to read the signature bytes from.

    • getSignatureLength

      public int getSignatureLength()
      Retrieve the size of the signature in the wire format.
      Returns:
      the length of the signature in bytes.

    • getSignatureBase64

      public String getSignatureBase64()
      Retrieve the signature in the base64 encoding of the RFC 4034 presentation format.
      Returns:
      the base64 encoded signature.

    • getType

      public Record.TYPE getType()
      Retrieve the type of this record.
      Specified by:
      getType in class Data
      Returns:
      TYPE.RRSIG, constant for every instance of this record type.

    • serialize

      public void serialize(DataOutputStream dos) throws IOException
      Write the RDATA of this record.
      Specified by:
      serialize in class Data
      Parameters:
      dos - the stream to write to.
      Throws:
      IOException - if an I/O error occurs.

    • writePartialSignature

      public void writePartialSignature(DataOutputStream dos) throws IOException
      Write the RRSIG RDATA without the trailing signature, which is the part a validator has to feed into the signature calculation.
      Parameters:
      dos - the stream to write to.
      Throws:
      IOException - if an I/O error occurs.

    • toString

      public String toString()
      Format this record in the presentation format of RFC 4034.
      Overrides:
      toString in class Object
      Returns:
      a single line holding the covered type, algorithm, label count, TTL, both validity times, key tag, signer name and signature.