1Net::DNS::SEC::Keyset(3U)ser Contributed Perl DocumentatiNoent::DNS::SEC::Keyset(3)
2
3
4

NAME

6       Net::DNS::SEC::Keyset - DNSSEC Keyset object class
7

SYNOPSIS

9           use Net::DNS::SEC::Keyset;
10

DESCRIPTION

12       A keyset is an "administrative" unit used for DNSSEC maintenance.
13
14       This class provides interfaces for creating, reading and writing
15       keysets.
16
17       Object methods are provided to extract DNSKEY, RRSIG and DS records.
18
19       Note that this class is still being developed.  Attributes and methods
20       are subject to change.
21
22   new (from file)
23           $keyset = Net::DNS::SEC::Keyset->new( $filename );
24           $keyset = Net::DNS::SEC::Keyset->new( $filename, $directory );
25           die Net::DNS::SEC::Keyset->keyset_err unless $keyset;
26
27       Constructor method which reads the specified keyset file and returns a
28       keyset object.
29
30       The optional second argument specifies the filename base directory.
31
32       Sets keyset_err and returns undef on failure.
33
34   new (by signing keys)
35           $keyset = Net::DNS::SEC::Keyset->new( [@keyrr], $privatekeypath );
36           die Net::DNS::SEC::Keyset->keyset_err unless $keyset;
37
38       Creates a keyset object from the keys provided through the reference to
39       an array of Net::DNS::RR::DNSKEY objects.
40
41       The method will create and self-sign the whole keyset. The private keys
42       as generated by the BIND dnssec-keygen tool are assumed to be in the
43       current directory or, if specified, the directory indicated by
44       $privatekeypath.
45
46       Sets keyset_err and returns undef on failure.
47
48   new (from key and sig RRsets)
49           $keyset = Net::DNS::Keyset->new( [@keyrr], [@sigrr] );
50           die Net::DNS::SEC::Keyset->keyset_err unless $keyset;
51
52       Creates a keyset object from the keys provided through the references
53       to arrays of Net::DNS::RR::DNSKEY and Net::DNS::RR::RRSIG objects.
54
55       Sets keyset_err and returns undef on failure.
56
57   new (from Packet)
58           $resolver = Net::DNS::Resolver->new;
59           $resolver->dnssec(1);
60
61           $reply = $res->send ( "example.com", "DNSKEY" );
62
63           $keyset = Net::DNS::SEC::Keyset->new( $reply );
64           die Net::DNS::SEC::Keyset->keyset_err unless $keyset;
65
66       Creates a keyset object from a Net::DNS::Packet that contains the
67       answer to a query for key records at the zone apex.
68
69       This is the method you should use for automatically fetching keys.
70
71       Sets keyset_err and returns undef on failure.
72
73   keys
74           @keyrr = $keyset->keys;
75
76       Returns an array of Net::DNS::RR::DNSKEY objects.
77
78   sigs
79           @sigrr = $keyset->sigs;
80
81       Returns an array of Net::DNS::RR::RRSIG objects.
82
83   extract_ds
84           @ds = $keyset->extract_ds();        # default SHA-1
85           @ds = $keyset->extract_ds( digtype => 'SHA-256' );
86           die Net::DNS::SEC::Keyset->keyset_err unless @ds;
87
88       Extracts DS records from the keyset. Note that the keyset will be
89       verified during extraction. All keys will need to have a valid self-
90       signature.
91
92       The method sets keyset_err if verification fails.
93
94   verify
95           @keytags = $keyset->verify();
96           die Net::DNS::SEC::Keyset->keyset_err unless @keytags;
97
98           $keyset->verify( $keytag ) || die $keyset->keyset_err;
99
100       If no arguments are given:
101
102       • Verifies if all signatures present verify the keyset.
103
104       • Verifies if there are DNSKEYs with the SEP flag set, there is at
105         least one RRSIG made using that key.
106
107       • Verifies that if there are no DNSKEYs with the SEP flag set there is
108         at least one RRSIG made with one of the keys from the keyset.
109
110       If an argument is given, it is should be the numeric keytag of the key
111       in the keyset which will be verified using the corresponding RRSIG.
112
113       The method returns a list of keytags of verified keys in the keyset.
114
115       The method sets keyset_err and returns empty list if verification
116       fails.
117
118   keyset_err
119           $keyset_err = Net::DNS::SEC::Keyset->keyset_err;
120
121       Returns the keyset error string.
122
123   string
124           $string = $keyset->string;
125
126       Returns a string representation of the keyset.
127
128   print
129           $keyset->print;             # similar to print( $keyset->string )
130
131       Prints the keyset.
132
133   writekeyset
134           $keyset->writekeyset;
135           $keyset->writekeyset( $path );
136           $keyset->writekeyset( $prefix );
137           $keyset->writekeyset( $prefix, $path );
138
139       Writes the keyset to a file named "keyset-<domain>." in the current
140       working directory or directory defined by the optional $path argument.
141
142       The optional $prefix argument specifies the prefix that will be
143       prepended to the domain name to form the keyset filename.
144
146       Copyright (c)2002 RIPE NCC.  Author Olaf M. Kolkman
147
148       Portions Copyright (c)2014 Dick Franks
149
150       All Rights Reserved
151

LICENSE

153       Permission to use, copy, modify, and distribute this software and its
154       documentation for any purpose and without fee is hereby granted,
155       provided that the original copyright notices appear in all copies and
156       that both copyright notice and this permission notice appear in
157       supporting documentation, and that the name of the author not be used
158       in advertising or publicity pertaining to distribution of the software
159       without specific prior written permission.
160
161       THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
162       OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
163       MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
164       IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
165       CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
166       TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
167       SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
168
169
170
171perl v5.36.0                      2023-01-20          Net::DNS::SEC::Keyset(3)
Impressum