bin/dnssec/dnssec-signzone.c

474 setverifies(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
477 	result = dns_dnssec_verify(name, set, key, false, 0, mctx, rrsig, NULL);
488  * Signs a set.  Goes through contortions to decide if each RRSIG should
494 	dns_rdataset_t *set) {
511 	dns_rdatatype_format(set->type, typestr, sizeof(typestr));
513 	ttl = ISC_MIN(set->ttl, endtime - starttime);
517 				     set->type, 0, &sigset, NULL);
590 			if (!expired && rrsig.originalttl == set->ttl &&
591 			    setverifies(name, set, key->key, &sigrdata))
599 					 : rrsig.originalttl != set->ttl
611 			if (!expired && rrsig.originalttl == set->ttl &&
612 			    setverifies(name, set, key->key, &sigrdata))
620 					 : rrsig.originalttl != set->ttl
665 			signwithkey(name, set, key->key, ttl, add,
694 		if ((set->type == dns_rdatatype_cds ||
695 		     set->type == dns_rdatatype_cdnskey ||
696 		     set->type == dns_rdatatype_dnskey) &&
721 				signwithkey(name, set, key->key, ttl, add,
782 				signwithkey(name, set, key->key, ttl, add,
1015  * Load the DS set for a child zone, if a dsset-* file can be found.
1203 		/* If this is a RRSIG set, skip it. */
1416  * Increment (or set if nonzero) the SOA serial
1512 	dns_rdataset_t set;
1519 	dns_rdataset_init(&set);
1526 		dns_rdatasetiter_current(rdsiter, &set);
1527 		if (set.type == dns_rdatatype_rrsig) {
1528 			covers = set.covers;
1531 		dns_rdataset_disassociate(&set);
3059 			      OPTOUT(nsec3.flags) ? "clear" : "set");
3097 	const dns_master_style_t *style = (type == dns_rdatatype_dnskey)
3188 	result = dns_master_dump(mctx, db, dbversion, style, filename,
3721 			fprintf(stderr, "WARNING: -e and -X were both set, "
3877 	 * 1) Keys listed in the DNSKEY set that have
3879 	 *    set on the command line.
3880 	 * 2) ZSKs set on the command line
3881 	 * 3) KSKs set on the command line
3882 	 * 4) Any keys remaining in the DNSKEY set which