vendor/bundle/ruby/2.7.0/gems/dnsruby-1.61.5/lib/dnsruby/single_verifier.rb
#  Verify the signature of an rrset encoded with the specified KeyCache
#  or RRSet. If no signature is included, false is returned.
# 
#  Returns true if the RRSet verified, false otherwise.
Verify the signature of an rrset encoded with the specified KeyCache
or RRSet. If no signature is included, false is returned.

Returns true if the RRSet verified, false otherwise.
Verify the signature of an rrset encoded with the specified KeyCache or RRSet . If no signature is included false is returned . Returns true if the RRSet verified false otherwise .
def verify_rrset(rrset, keys = nil)
      sigrecs = rrset.sigs
      if (rrset.rrs.length == 0)
        raise VerifyError.new("No RRSet to verify")
      end
      if (rrset.num_sigs == 0)
        raise VerifyError.new("No signatures in the RRSet : #{rrset.name}, #{rrset.type}")
      end
      sigrecs.each do |sigrec|
        check_rr_data(rrset, sigrec)
      end
      raise ArgumentError.new("Expecting DNSKEY, DLV, DS, RRSet, Array or nil for keys : got #{keys.class} instead") if
      (keys && (![Array, RR::IN::DNSKEY, RR::IN::DLV, RR::IN::DS].include?keys.class) && (keys.class != RRSet))
      keyrec = nil
      sigrec = nil
      if (rrset.type == Types.DNSKEY)
        if (keys && !(Array === keys) && ((keys.type == Types.DS) || ((keys.type == Types.DLV) && (@verifier_type == VerifierType::DLV))))
          rrset.rrs.each do |key|
            keys.rrs.each do |ds|
              if (ds.check_key(key))
                @trusted_keys.add_key_with_expiration(key, rrset.sigs()[0].expiration)
              end
            end
          end
        else
          check_ds_stores(rrset)
        end
      end
      if ((keys.nil?) || ((keys.class != Array) && ((keys.type == Types.DS) || ((keys.type == Types.DLV) && (@verifier_type == VerifierType::DLV)))))
        keyrec, sigrec = get_matching_key(get_keys_to_check, sigrecs)
      else
        keyrec, sigrec = get_matching_key(keys, sigrecs)
      end
      if (!keyrec)
        raise VerifyError.new("Signing key not found")
      end
      if (keyrec.sep_key? && !keyrec.zone_key?)
        Dnsruby.log.error("DNSKEY with SEP flag set and Zone Key flag not set was used to verify RRSIG over RRSET - this is not allowed by RFC4034 section 2.1.1")
        raise VerifyError.new("DNSKEY with SEP flag set and Zone Key flag not set")
      end
      rrset = rrset.sort_canonical
      sig_data = sigrec.sig_data
      rrset.each do |rec|
        old_ttl = rec.ttl
        rec.ttl = sigrec.original_ttl
        data = MessageEncoder.new { |msg|
          msg.put_rr(rec, true)
        }.to_s 
        rec.ttl = old_ttl
        if (RUBY_VERSION >= "1.9")
          data.force_encoding("ASCII-8BIT")
        end
        sig_data += data
      end
      verified = false
      if [Algorithms.RSASHA1,
          Algorithms.RSASHA1_NSEC3_SHA1].include?(sigrec.algorithm)
        verified = keyrec.public_key.verify(OpenSSL::Digest::SHA1.new, sigrec.signature, sig_data)
      elsif (sigrec.algorithm == Algorithms.RSASHA256)
        verified = keyrec.public_key.verify(OpenSSL::Digest::SHA256.new, sigrec.signature, sig_data)
      elsif (sigrec.algorithm == Algorithms.RSASHA512)
        verified = keyrec.public_key.verify(OpenSSL::Digest::SHA512.new, sigrec.signature, sig_data)
      elsif [Algorithms.DSA,
          Algorithms.DSA_NSEC3_SHA1].include?(sigrec.algorithm)
        r = RR::get_num(sigrec.signature[1, 20])
        s = RR::get_num(sigrec.signature[21, 20])
        r_asn1 = OpenSSL::ASN1::Integer.new(r)
        s_asn1 = OpenSSL::ASN1::Integer.new(s)
        asn1 = OpenSSL::ASN1::Sequence.new([r_asn1, s_asn1]).to_der
        verified = keyrec.public_key.verify(OpenSSL::Digest::DSS1.new, asn1, sig_data)
      elsif [Algorithms.ECDSAP256SHA256, Algorithms.ECDSAP384SHA384].include?(sigrec.algorithm)
        byte_size = (keyrec.public_key.group.degree + 7) / 8
        sig_bytes = sigrec.signature[0..(byte_size - 1)]
        sig_char = sigrec.signature[byte_size..-1] || ''
        asn1 = OpenSSL::ASN1::Sequence.new([sig_bytes, sig_char].map { |int| OpenSSL::ASN1::Integer.new(OpenSSL::BN.new(int, 2)) }).to_der
        digest_obj = if sigrec.algorithm == Algorithms.ECDSAP384SHA384
                       OpenSSL::Digest::SHA384.new
                     else
                       OpenSSL::Digest::SHA256.new
                     end
        verified = keyrec.public_key.dsa_verify_asn1(digest_obj.digest(sig_data), asn1)
      else
        raise RuntimeError.new("Algorithm #{sigrec.algorithm.code} unsupported by Dnsruby")
      end
      if (!verified)
        raise VerifyError.new("Signature failed to cryptographically verify")
      end
      expiration_diff = (sigrec.expiration.to_i - Time.now.to_i).abs
      rrset.ttl = ([rrset.ttl, sigrec.ttl, sigrec.original_ttl,
          expiration_diff].sort)[0]
      return true
    end
def verify_rrset ( rrset , keys = nil ) sigrecs = rrset . sigs if ( rrset . rrs . length == 0 ) raise VerifyError . new ( "No RRSet to verify" ) end if ( rrset . num_sigs == 0 ) raise VerifyError . new ( "No signatures in the RRSet : #{rrset.name}, #{rrset.type}" ) end sigrecs . each do | sigrec | check_rr_data ( rrset , sigrec ) end raise ArgumentError . new ( "Expecting DNSKEY, DLV, DS, RRSet, Array or nil for keys : got #{keys.class} instead" ) if ( keys && ( ! [ Array , RR :: IN :: DNSKEY , RR :: IN :: DLV , RR :: IN :: DS ] . include? keys . class ) && ( keys . class != RRSet ) ) keyrec = nil sigrec = nil if ( rrset . type == Types . DNSKEY ) if ( keys && ! ( Array === keys ) && ( ( keys . type == Types . DS ) || ( ( keys . type == Types . DLV ) && ( @verifier_type == VerifierType :: DLV ) ) ) ) rrset . rrs . each do | key | keys . rrs . each do | ds | if ( ds . check_key ( key ) ) @trusted_keys . add_key_with_expiration ( key , rrset . sigs ( ) [ 0 ] . expiration ) end end end else check_ds_stores ( rrset ) end end if ( ( keys . nil? ) || ( ( keys . class != Array ) && ( ( keys . type == Types . DS ) || ( ( keys . type == Types . DLV ) && ( @verifier_type == VerifierType :: DLV ) ) ) ) ) keyrec , sigrec = get_matching_key ( get_keys_to_check , sigrecs ) else keyrec , sigrec = get_matching_key ( keys , sigrecs ) end if ( ! keyrec ) raise VerifyError . new ( "Signing key not found" ) end if ( keyrec . sep_key? && ! keyrec . zone_key? ) Dnsruby . log . error ( "DNSKEY with SEP flag set and Zone Key flag not set was used to verify RRSIG over RRSET - this is not allowed by RFC4034 section 2.1.1" ) raise VerifyError . new ( "DNSKEY with SEP flag set and Zone Key flag not set" ) end rrset = rrset . sort_canonical sig_data = sigrec . sig_data rrset . each do | rec | old_ttl = rec . ttl rec . ttl = sigrec . original_ttl data = MessageEncoder . new { | msg | msg . put_rr ( rec , true ) } . to_s rec . ttl = old_ttl if ( RUBY_VERSION >= "1.9" ) data . force_encoding ( "ASCII-8BIT" ) end sig_data += data end verified = false if [ Algorithms . RSASHA1 , Algorithms . RSASHA1_NSEC3_SHA1 ] . include? ( sigrec . algorithm ) verified = keyrec . public_key . verify ( OpenSSL :: Digest :: SHA1 . new , sigrec . signature , sig_data ) elsif ( sigrec . algorithm == Algorithms . RSASHA256 ) verified = keyrec . public_key . verify ( OpenSSL :: Digest :: SHA256 . new , sigrec . signature , sig_data ) elsif ( sigrec . algorithm == Algorithms . RSASHA512 ) verified = keyrec . public_key . verify ( OpenSSL :: Digest :: SHA512 . new , sigrec . signature , sig_data ) elsif [ Algorithms . DSA , Algorithms . DSA_NSEC3_SHA1 ] . include? ( sigrec . algorithm ) r = RR :: get_num ( sigrec . signature [ 1 , 20 ] ) s = RR :: get_num ( sigrec . signature [ 21 , 20 ] ) r_asn1 = OpenSSL :: ASN1 :: Integer . new ( r ) s_asn1 = OpenSSL :: ASN1 :: Integer . new ( s ) asn1 = OpenSSL :: ASN1 :: Sequence . new ( [ r_asn1 , s_asn1 ] ) . to_der verified = keyrec . public_key . verify ( OpenSSL :: Digest :: DSS1 . new , asn1 , sig_data ) elsif [ Algorithms . ECDSAP256SHA256 , Algorithms . ECDSAP384SHA384 ] . include? ( sigrec . algorithm ) byte_size = ( keyrec . public_key . group . degree + 7 ) / 8 sig_bytes = sigrec . signature [ 0 .. ( byte_size - 1 ) ] sig_char = sigrec . signature [ byte_size .. - 1 ] || '' asn1 = OpenSSL :: ASN1 :: Sequence . new ( [ sig_bytes , sig_char ] . map { | int | OpenSSL :: ASN1 :: Integer . new ( OpenSSL :: BN . new ( int , 2 ) ) } ) . to_der digest_obj = if sigrec . algorithm == Algorithms . ECDSAP384SHA384 OpenSSL :: Digest :: SHA384 . new else OpenSSL :: Digest :: SHA256 . new end verified = keyrec . public_key . dsa_verify_asn1 ( digest_obj . digest ( sig_data ) , asn1 ) else raise RuntimeError . new ( "Algorithm #{sigrec.algorithm.code} unsupported by Dnsruby" ) end if ( ! verified ) raise VerifyError . new ( "Signature failed to cryptographically verify" ) end expiration_diff = ( sigrec . expiration . to_i - Time . now . to_i ) . abs rrset . ttl = ( [ rrset . ttl , sigrec . ttl , sigrec . original_ttl , expiration_diff ] . sort ) [ 0 ] return true end
Verify the signature of an rrset encoded with the specified KeyCache
or RRSet.
Verify the signature of an rrset encoded with the specified KeyCache or RRSet .
#       print "Verify_rrset #{rrset.name}, #{rrset.type}\n" #      print "ABOUT TO VERIFY WITH #{keys == nil ? '0' : keys.length} keys\n" #      if (keys != nil) #        if (keys.length > 0) #          print "KEY TAG : #{keys[0].key_tag}\n" #        end #      end #       return false if !keyrec #         print "Couldn't find signing key! #{rrset.name}, #{rrset.type},\n " #  RFC 4034 # 3.1.8.1.  Signature Calculation #         return false #      print "VERIFY KEY FOUND - doing verification\n" # Any DNS names in the RDATA field of each RR MUST be in # canonical form; and # The RRset MUST be sorted in canonical order. # RR(i) = owner | type | class | TTL | RDATA length | RDATA # @TODO@ worry about wildcards here? #  Now calculate the signature #  we are ignoring T for now #  t = sigrec.signature[0] #  t = t.getbyte(0) if t.class == String #  Sort out the TTLs - set it to the minimum valid ttl #             print "VERIFIED OK\n"
rrset
<not_specific>
keys
<not_specific>