// Copyright (c) 2001-2004 Brian Wellington (bwelling@xbill.org)

package org.xbill.DNS;

import java.security.PrivateKey;
import java.util.Date;

/**
 * Creates SIG(0) transaction signatures.
 *
 * @author Pasi Eronen
 * @author Brian Wellington
 */

public class SIG0 {

/**
 * The default validity period for outgoing SIG(0) signed messages.
 * Can be overriden by the sig0validity option.
 */
private static final short VALIDITY = 300;
    
private
SIG0() { }

/**
 * Sign a message with SIG(0). The DNS key and private key must refer to the
 * same underlying cryptographic key.
 * @param message The message to be signed
 * @param key The DNSKEY record to use as part of signing
 * @param privkey The PrivateKey to use when signing
 * @param previous If this message is a response, the SIG(0) from the query
 */
public static void
signMessage(Message message, KEYRecord key, PrivateKey privkey,
	    SIGRecord previous) throws DNSSEC.DNSSECException
{
	
	int validity = Options.intValue("sig0validity");
	if (validity < 0)
		validity = VALIDITY;

	long now = System.currentTimeMillis();
	Date timeSigned = new Date(now);
	Date timeExpires = new Date(now + validity * 1000);

	SIGRecord sig =  DNSSEC.signMessage(message, previous, key, privkey,
					    timeSigned, timeExpires);
	
	message.addRecord(sig, Section.ADDITIONAL);
}

/**
 * Verify a message using SIG(0).
 * @param message The message to be signed
 * @param b An array containing the message in unparsed form.  This is
 * necessary since SIG(0) signs the message in wire format, and we can't
 * recreate the exact wire format (with the same name compression).
 * @param key The KEY record to verify the signature with.
 * @param previous If this message is a response, the SIG(0) from the query
 */
public static void
verifyMessage(Message message, byte [] b, KEYRecord key, SIGRecord previous)
	throws DNSSEC.DNSSECException
{
	SIGRecord sig = null;
	Record [] additional = message.getSectionArray(Section.ADDITIONAL);
	for (int i = 0; i < additional.length; i++) {
		if (additional[i].getType() != Type.SIG)
			continue;
		if (((SIGRecord) additional[i]).getTypeCovered() != 0)
			continue;
		sig = (SIGRecord) additional[i];
		break;
	}
	DNSSEC.verifyMessage(message, b, sig, previous, key);
}

}