1 files changed, 79 insertions, 0 deletions
diff --git a/src/org/xbill/DNS/SIG0.java b/src/org/xbill/DNS/SIG0.java
new file mode 100644
index 0000000..5a00e72
--- /dev/null
+++ b/src/org/xbill/DNS/SIG0.java
@@ -0,0 +1,79 @@
+// Copyright (c) 2001-2004 Brian Wellington (bwelling@xbill.org)
+
+package org.xbill.DNS;
+
+import java.security.PrivateKey;
+import java.util.Date;
+
+/**
+ * Creates SIG(0) transaction signatures.
+ *
+ * @author Pasi Eronen
+ * @author Brian Wellington
+ */
+
+public class SIG0 {
+
+/**
+ * The default validity period for outgoing SIG(0) signed messages.
+ * Can be overriden by the sig0validity option.
+ */
+private static final short VALIDITY = 300;
+    
+private
+SIG0() { }
+
+/**
+ * Sign a message with SIG(0). The DNS key and private key must refer to the
+ * same underlying cryptographic key.
+ * @param message The message to be signed
+ * @param key The DNSKEY record to use as part of signing
+ * @param privkey The PrivateKey to use when signing
+ * @param previous If this message is a response, the SIG(0) from the query
+ */
+public static void
+signMessage(Message message, KEYRecord key, PrivateKey privkey,
+	    SIGRecord previous) throws DNSSEC.DNSSECException
+{
+	
+	int validity = Options.intValue("sig0validity");
+	if (validity < 0)
+		validity = VALIDITY;
+
+	long now = System.currentTimeMillis();
+	Date timeSigned = new Date(now);
+	Date timeExpires = new Date(now + validity * 1000);
+
+	SIGRecord sig =  DNSSEC.signMessage(message, previous, key, privkey,
+					    timeSigned, timeExpires);
+	
+	message.addRecord(sig, Section.ADDITIONAL);
+}
+
+/**
+ * Verify a message using SIG(0).
+ * @param message The message to be signed
+ * @param b An array containing the message in unparsed form.  This is
+ * necessary since SIG(0) signs the message in wire format, and we can't
+ * recreate the exact wire format (with the same name compression).
+ * @param key The KEY record to verify the signature with.
+ * @param previous If this message is a response, the SIG(0) from the query
+ */
+public static void
+verifyMessage(Message message, byte [] b, KEYRecord key, SIGRecord previous)
+	throws DNSSEC.DNSSECException
+{
+	SIGRecord sig = null;
+	Record [] additional = message.getSectionArray(Section.ADDITIONAL);
+	for (int i = 0; i < additional.length; i++) {
+		if (additional[i].getType() != Type.SIG)
+			continue;
+		if (((SIGRecord) additional[i]).getTypeCovered() != 0)
+			continue;
+		sig = (SIGRecord) additional[i];
+		break;
+	}
+	DNSSEC.verifyMessage(message, b, sig, previous, key);
+}
+
+}