OXIESEC PANEL

Name	Size	Modified	Perms
📁 ..	-	11/10/2025 03:35:42 AM	rwxr-xr-x
📄 acl.h	6.33 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 adb.h	21.75 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 badcache.h	3.31 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 bit.h	798 bytes	11/05/2021 09:03:26 AM	rw-r--r--
📄 byaddr.h	3.51 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 cache.h	8.53 KB	11/10/2025 03:33:48 AM	rw-r--r--
📄 callbacks.h	2.23 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 catz.h	11.6 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 cert.h	1.43 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 client.h	14.19 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 clientinfo.h	1.97 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 compress.h	6.88 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 db.h	49.26 KB	11/10/2025 03:33:48 AM	rw-r--r--
📄 dbiterator.h	7.21 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 dbtable.h	3.09 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 diff.h	6.87 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 dispatch.h	15.17 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 dlz.h	10.62 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 dlz_dlopen.h	4.29 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 dns64.h	5.59 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 dnsrps.h	2.51 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 dnssec.h	12.29 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 dnstap.h	9.95 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 ds.h	1.63 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 dsdigest.h	1.67 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 dyndb.h	4.75 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 ecdb.h	806 bytes	11/05/2021 09:03:26 AM	rw-r--r--
📄 ecs.h	1.22 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 edns.h	783 bytes	11/05/2021 09:03:26 AM	rw-r--r--
📄 enumclass.h	1.19 KB	11/10/2025 03:34:13 AM	rw-r--r--
📄 enumtype.h	8.29 KB	11/10/2025 03:34:13 AM	rw-r--r--
📄 events.h	4.35 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 fixedname.h	1.61 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 forward.h	2.99 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 geoip.h	2.29 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 ipkeylist.h	2.17 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 iptable.h	1.49 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 journal.h	9.48 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 kasp.h	11.84 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 keydata.h	1.02 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 keyflags.h	1.25 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 keymgr.h	4.01 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 keytable.h	7.69 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 keyvalues.h	3.99 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 lib.h	993 bytes	11/05/2021 09:03:26 AM	rw-r--r--
📄 librpz.h	30.67 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 lmdb.h	779 bytes	11/05/2021 09:03:26 AM	rw-r--r--
📄 log.h	3.93 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 lookup.h	2.85 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 master.h	8.58 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 masterdump.h	9.9 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 message.h	38.64 KB	11/10/2025 03:33:48 AM	rw-r--r--
📄 name.h	36.9 KB	11/10/2025 03:33:48 AM	rw-r--r--
📄 ncache.h	4.84 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 nsec.h	2.99 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 nsec3.h	8.06 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 nta.h	4.73 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 opcode.h	1006 bytes	11/05/2021 09:03:26 AM	rw-r--r--
📄 order.h	1.96 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 peer.h	6.32 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 portlist.h	2.05 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 private.h	1.92 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 rbt.h	36.61 KB	11/10/2025 03:33:48 AM	rw-r--r--
📄 rcode.h	2.41 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 rdata.h	22.04 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 rdataclass.h	2.2 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 rdatalist.h	2.5 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 rdataset.h	18.28 KB	11/10/2025 03:33:48 AM	rw-r--r--
📄 rdatasetiter.h	3.82 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 rdataslab.h	4.14 KB	11/10/2025 03:33:48 AM	rw-r--r--
📄 rdatastruct.h	61.23 KB	11/10/2025 03:34:13 AM	rw-r--r--
📄 rdatatype.h	2.24 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 request.h	8.97 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 resolver.h	19.68 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 result.h	8.98 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 rootns.h	891 bytes	11/05/2021 09:03:26 AM	rw-r--r--
📄 rpz.h	11.87 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 rriterator.h	4.12 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 rrl.h	6.8 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 sdb.h	7.18 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 sdlz.h	13.76 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 secalg.h	1.67 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 secproto.h	1.52 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 soa.h	2.13 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 ssu.h	7.01 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 stats.h	24.11 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 tcpmsg.h	3.05 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 time.h	1.65 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 timer.h	1.03 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 tkey.h	7.48 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 tsec.h	2.88 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 tsig.h	8.3 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 ttl.h	1.83 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 types.h	14.19 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 update.h	1.96 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 validator.h	6.52 KB	11/10/2025 03:33:48 AM	rw-r--r--
📄 version.h	679 bytes	11/05/2021 09:03:26 AM	rw-r--r--
📄 view.h	34.51 KB	11/10/2025 03:33:48 AM	rw-r--r--
📄 xfrin.h	2.26 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 zone.h	64.01 KB	11/10/2025 03:33:48 AM	rw-r--r--
📄 zonekey.h	776 bytes	11/05/2021 09:03:26 AM	rw-r--r--
📄 zoneverify.h	1.36 KB	11/05/2021 09:03:26 AM	rw-r--r--
📄 zt.h	5.12 KB	11/10/2025 03:33:48 AM	rw-r--r--

Editing: kasp.h

/*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */

#ifndef DNS_KASP_H
#define DNS_KASP_H 1

/*****
***** Module Info
*****/

/*! \file dns/kasp.h
 * \brief
 * DNSSEC Key and Signing Policy (KASP)
 *
 * A "kasp" is a DNSSEC policy, that determines how a zone should be
 * signed and maintained.
 */

#include <isc/lang.h>
#include <isc/magic.h>
#include <isc/mutex.h>
#include <isc/refcount.h>

#include <dns/types.h>

ISC_LANG_BEGINDECLS

/* Stores a KASP key */
struct dns_kasp_key {
	isc_mem_t *mctx;

/* Locked by themselves. */
	isc_refcount_t references;

/* Under owner's locking control. */
	ISC_LINK(struct dns_kasp_key) link;

/* Configuration */
	uint32_t lifetime;
	uint8_t	 algorithm;
	int	 length;
	uint8_t	 role;
};

struct dns_kasp_nsec3param {
	uint8_t saltlen;
	uint8_t algorithm;
	uint8_t iterations;
	bool	optout;
};

/* Stores a DNSSEC policy */
struct dns_kasp {
	unsigned int magic;
	isc_mem_t	  *mctx;
	char	     *name;

/* Internals. */
	isc_mutex_t lock;
	bool	    frozen;

/* Locked by themselves. */
	isc_refcount_t references;

/* Under owner's locking control. */
	ISC_LINK(struct dns_kasp) link;

/* Configuration: signatures */
	uint32_t signatures_refresh;
	uint32_t signatures_validity;
	uint32_t signatures_validity_dnskey;

/* Configuration: Keys */
	dns_kasp_keylist_t keys;
	dns_ttl_t	   dnskey_ttl;

/* Configuration: Denial of existence */
	bool		      nsec3;
	dns_kasp_nsec3param_t nsec3param;

/* Configuration: Timings */
	uint32_t publish_safety;
	uint32_t retire_safety;
	uint32_t purge_keys;

/* Zone settings */
	dns_ttl_t zone_max_ttl;
	uint32_t  zone_propagation_delay;

/* Parent settings */
	dns_ttl_t parent_ds_ttl;
	uint32_t  parent_propagation_delay;
};

#define DNS_KASP_MAGIC	     ISC_MAGIC('K', 'A', 'S', 'P')
#define DNS_KASP_VALID(kasp) ISC_MAGIC_VALID(kasp, DNS_KASP_MAGIC)

/* Defaults */
#define DNS_KASP_SIG_REFRESH	     (86400 * 5)
#define DNS_KASP_SIG_VALIDITY	     (86400 * 14)
#define DNS_KASP_SIG_VALIDITY_DNSKEY (86400 * 14)
#define DNS_KASP_KEY_TTL	     (3600)
#define DNS_KASP_DS_TTL		     (86400)
#define DNS_KASP_PUBLISH_SAFETY	     (3600)
#define DNS_KASP_PURGE_KEYS	     (86400 * 90)
#define DNS_KASP_RETIRE_SAFETY	     (3600)
#define DNS_KASP_ZONE_MAXTTL	     (86400)
#define DNS_KASP_ZONE_PROPDELAY	     (300)
#define DNS_KASP_PARENT_PROPDELAY    (3600)

/* Key roles */
#define DNS_KASP_KEY_ROLE_KSK 0x01
#define DNS_KASP_KEY_ROLE_ZSK 0x02

isc_result_t
dns_kasp_create(isc_mem_t *mctx, const char *name, dns_kasp_t **kaspp);
/*%<
 * Create a KASP.
 *
 * Requires:
 *
 *\li  'mctx' is a valid memory context.
 *
 *\li  'name' is a valid C string.
 *
 *\li  kaspp != NULL && *kaspp == NULL
 *
 * Returns:
 *
 *\li  #ISC_R_SUCCESS
 *\li  #ISC_R_NOMEMORY
 *
 *\li  Other errors are possible.
 */

void
dns_kasp_attach(dns_kasp_t *source, dns_kasp_t **targetp);
/*%<
 * Attach '*targetp' to 'source'.
 *
 * Requires:
 *
 *\li   'source' is a valid, frozen kasp.
 *
 *\li   'targetp' points to a NULL dns_kasp_t *.
 *
 * Ensures:
 *
 *\li   *targetp is attached to source.
 *
 *\li   While *targetp is attached, the kasp will not shut down.
 */

void
dns_kasp_detach(dns_kasp_t **kaspp);
/*%<
 * Detach KASP.
 *
 * Requires:
 *
 *\li   'kaspp' points to a valid dns_kasp_t *
 *
 * Ensures:
 *
 *\li   *kaspp is NULL.
 */

void
dns_kasp_freeze(dns_kasp_t *kasp);
/*%<
 * Freeze kasp.  No changes can be made to kasp configuration while frozen.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, unfrozen kasp.
 *
 * Ensures:
 *
 *\li   'kasp' is frozen.
 */

void
dns_kasp_thaw(dns_kasp_t *kasp);
/*%<
 * Thaw kasp.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, frozen kasp.
 *
 * Ensures:
 *
 *\li   'kasp' is no longer frozen.
 */

const char *
dns_kasp_getname(dns_kasp_t *kasp);
/*%<
 * Get kasp name.
 *
 * Requires:
 *
 *\li   'kasp' is a valid kasp.
 *
 * Returns:
 *
 *\li   name of 'kasp'.
 */

uint32_t
dns_kasp_signdelay(dns_kasp_t *kasp);
/*%<
 * Get the delay that is needed to ensure that all existing RRsets have been
 * re-signed with a successor key.  This is the signature validity minus the
 * signature refresh time (that indicates how far before signature expiry an
 * RRSIG should be refreshed).
 *
 * Requires:
 *
 *\li   'kasp' is a valid, frozen kasp.
 *
 * Returns:
 *
 *\li   signature refresh interval.
 */

uint32_t
dns_kasp_sigrefresh(dns_kasp_t *kasp);
/*%<
 * Get signature refresh interval.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, frozen kasp.
 *
 * Returns:
 *
 *\li   signature refresh interval.
 */

void
dns_kasp_setsigrefresh(dns_kasp_t *kasp, uint32_t value);
/*%<
 * Set signature refresh interval.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, thawed kasp.
 */

uint32_t
dns_kasp_sigvalidity(dns_kasp_t *kasp);
uint32_t
dns_kasp_sigvalidity_dnskey(dns_kasp_t *kasp);
/*%<
 * Get signature validity.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, frozen kasp.
 *
 * Returns:
 *
 *\li   signature validity.
 */

void
dns_kasp_setsigvalidity(dns_kasp_t *kasp, uint32_t value);
void
dns_kasp_setsigvalidity_dnskey(dns_kasp_t *kasp, uint32_t value);
/*%<
 * Set signature validity.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, thawed kasp.
 */

dns_ttl_t
dns_kasp_dnskeyttl(dns_kasp_t *kasp);
/*%<
 * Get DNSKEY TTL.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, frozen kasp.
 *
 * Returns:
 *
 *\li   DNSKEY TTL.
 */

void
dns_kasp_setdnskeyttl(dns_kasp_t *kasp, dns_ttl_t ttl);
/*%<
 * Set DNSKEY TTL.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, thawed kasp.
 */

uint32_t
dns_kasp_purgekeys(dns_kasp_t *kasp);
/*%<
 * Get purge keys interval.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, frozen kasp.
 *
 * Returns:
 *
 *\li   Purge keys interval.
 */

void
dns_kasp_setpurgekeys(dns_kasp_t *kasp, uint32_t value);
/*%<
 * Set purge keys interval.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, thawed kasp.
 */

uint32_t
dns_kasp_publishsafety(dns_kasp_t *kasp);
/*%<
 * Get publish safety interval.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, frozen kasp.
 *
 * Returns:
 *
 *\li   Publish safety interval.
 */

void
dns_kasp_setpublishsafety(dns_kasp_t *kasp, uint32_t value);
/*%<
 * Set publish safety interval.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, thawed kasp.
 */

uint32_t
dns_kasp_retiresafety(dns_kasp_t *kasp);
/*%<
 * Get retire safety interval.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, frozen kasp.
 *
 * Returns:
 *
 *\li   Retire safety interval.
 */

void
dns_kasp_setretiresafety(dns_kasp_t *kasp, uint32_t value);
/*%<
 * Set retire safety interval.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, thawed kasp.
 */

dns_ttl_t
dns_kasp_zonemaxttl(dns_kasp_t *kasp);
/*%<
 * Get maximum zone TTL.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, frozen kasp.
 *
 * Returns:
 *
 *\li   Maximum zone TTL.
 */

void
dns_kasp_setzonemaxttl(dns_kasp_t *kasp, dns_ttl_t ttl);
/*%<
 * Set maximum zone TTL.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, thawed kasp.
 */

uint32_t
dns_kasp_zonepropagationdelay(dns_kasp_t *kasp);
/*%<
 * Get zone propagation delay.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, frozen kasp.
 *
 * Returns:
 *
 *\li   Zone propagation delay.
 */

void
dns_kasp_setzonepropagationdelay(dns_kasp_t *kasp, uint32_t value);
/*%<
 * Set zone propagation delay.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, thawed kasp.
 */

dns_ttl_t
dns_kasp_dsttl(dns_kasp_t *kasp);
/*%<
 * Get DS TTL (should match that of the parent DS record).
 *
 * Requires:
 *
 *\li   'kasp' is a valid, frozen kasp.
 *
 * Returns:
 *
 *\li   Expected parent DS TTL.
 */

void
dns_kasp_setdsttl(dns_kasp_t *kasp, dns_ttl_t ttl);
/*%<
 * Set DS TTL.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, thawed kasp.
 */

uint32_t
dns_kasp_parentpropagationdelay(dns_kasp_t *kasp);
/*%<
 * Get parent zone propagation delay.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, frozen kasp.
 *
 * Returns:
 *
 *\li   Parent zone propagation delay.
 */

void
dns_kasp_setparentpropagationdelay(dns_kasp_t *kasp, uint32_t value);
/*%<
 * Set parent propagation delay.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, thawed kasp.
 */

isc_result_t
dns_kasplist_find(dns_kasplist_t *list, const char *name, dns_kasp_t **kaspp);
/*%<
 * Search for a kasp with name 'name' in 'list'.
 * If found, '*kaspp' is (strongly) attached to it.
 *
 * Requires:
 *
 *\li   'kaspp' points to a NULL dns_kasp_t *.
 *
 * Returns:
 *
 *\li   #ISC_R_SUCCESS          A matching kasp was found.
 *\li   #ISC_R_NOTFOUND         No matching kasp was found.
 */

dns_kasp_keylist_t
dns_kasp_keys(dns_kasp_t *kasp);
/*%<
 * Get the list of kasp keys.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, frozen kasp.
 *
 * Returns:
 *
 *\li  #ISC_R_SUCCESS
 *\li  #ISC_R_NOMEMORY
 *
 *\li  Other errors are possible.
 */

bool
dns_kasp_keylist_empty(dns_kasp_t *kasp);
/*%<
 * Check if the keylist is empty.
 *
 * Requires:
 *
 *\li   'kasp' is a valid kasp.
 *
 * Returns:
 *
 *\li  true if the keylist is empty, false otherwise.
 */

void
dns_kasp_addkey(dns_kasp_t *kasp, dns_kasp_key_t *key);
/*%<
 * Add a key.
 *
 * Requires:
 *
 *\li   'kasp' is a valid, thawed kasp.
 *\li   'key' is not NULL.
 */

isc_result_t
dns_kasp_key_create(dns_kasp_t *kasp, dns_kasp_key_t **keyp);
/*%<
 * Create a key inside a KASP.
 *
 * Requires:
 *
 *\li   'kasp' is a valid kasp.
 *
 *\li  keyp != NULL && *keyp == NULL
 *
 * Returns:
 *
 *\li  #ISC_R_SUCCESS
 *\li  #ISC_R_NOMEMORY
 *
 *\li  Other errors are possible.
 */

void
dns_kasp_key_destroy(dns_kasp_key_t *key);
/*%<
 * Destroy a KASP key.
 *
 * Requires:
 *
 *\li  key != NULL
 */

uint32_t
dns_kasp_key_algorithm(dns_kasp_key_t *key);
/*%<
 * Get the key algorithm.
 *
 * Requires:
 *
 *\li  key != NULL
 *
 * Returns:
 *
 *\li  Key algorithm.
 */

unsigned int
dns_kasp_key_size(dns_kasp_key_t *key);
/*%<
 * Get the key size.
 *
 * Requires:
 *
 *\li  key != NULL
 *
 * Returns:
 *
 *\li  Configured key size, or default key size for key algorithm if no size
 *     configured.
 */

uint32_t
dns_kasp_key_lifetime(dns_kasp_key_t *key);
/*%<
 * The lifetime of this key (how long may this key be active?)
 *
 * Requires:
 *
 *\li  key != NULL
 *
 * Returns:
 *
 *\li  Lifetime of key.
 *
 */

bool
dns_kasp_key_ksk(dns_kasp_key_t *key);
/*%<
 * Does this key act as a KSK?
 *
 * Requires:
 *
 *\li  key != NULL
 *
 * Returns:
 *
 *\li  True, if the key role has DNS_KASP_KEY_ROLE_KSK set.
 *\li  False, otherwise.
 *
 */

bool
dns_kasp_key_zsk(dns_kasp_key_t *key);
/*%<
 * Does this key act as a ZSK?
 *
 * Requires:
 *
 *\li  key != NULL
 *
 * Returns:
 *
 *\li  True, if the key role has DNS_KASP_KEY_ROLE_ZSK set.
 *\li  False, otherwise.
 *
 */

bool
dns_kasp_nsec3(dns_kasp_t *kasp);
/*%<
 * Return true if NSEC3 chain should be used.
 *
 * Requires:
 *
 *\li  'kasp' is a valid, frozen kasp.
 *
 */

uint8_t
dns_kasp_nsec3iter(dns_kasp_t *kasp);
/*%<
 * The number of NSEC3 iterations to use.
 *
 * Requires:
 *
 *\li  'kasp' is a valid, frozen kasp.
 *\li  'kasp->nsec3' is true.
 *
 */

uint8_t
dns_kasp_nsec3flags(dns_kasp_t *kasp);
/*%<
 * The NSEC3 flags field value.
 *
 * Requires:
 *
 *\li  'kasp' is a valid, frozen kasp.
 *\li  'kasp->nsec3' is true.
 *
 */

uint8_t
dns_kasp_nsec3saltlen(dns_kasp_t *kasp);
/*%<
 * The NSEC3 salt length.
 *
 * Requires:
 *
 *\li  'kasp' is a valid, frozen kasp.
 *\li  'kasp->nsec3' is true.
 *
 */

void
dns_kasp_setnsec3(dns_kasp_t *kasp, bool nsec3);
/*%<
 * Set to use NSEC3 if 'nsec3' is 'true', otherwise policy will use NSEC.
 *
 * Requires:
 *
 *\li  'kasp' is a valid, unfrozen kasp.
 *
 */

void
dns_kasp_setnsec3param(dns_kasp_t *kasp, uint8_t iter, bool optout,
		       uint8_t saltlen);
/*%<
 * Set the desired NSEC3 parameters.
 *
 * Requires:
 *
 *\li  'kasp' is a valid, unfrozen kasp.
 *\li  'kasp->nsec3' is true.
 *
 */

ISC_LANG_ENDDECLS

#endif /* DNS_KASP_H */