Lines Matching +full:max +full:- +full:reason
2 * validator/val_nsec3.c - validator NSEC3 denial of existence functions.
63 * Max number of NSEC3 calculations at once, suspend query for later.
72 #define MAX_NSEC3_ERRORS -1
75 * This function we get from ldns-compat or from base system
81 * This function we get from ldns-compat or from base system
89 * Contains the ce and the next-closer (nc) proof.
128 rrset->entry.data; in rrset_get_count()
130 return d->count; in rrset_get_count()
138 rrset->entry.data; in nsec3_unknown_flags()
139 log_assert(d && r < (int)d->count); in nsec3_unknown_flags()
140 if(d->rr_len[r] < 2+2) in nsec3_unknown_flags()
142 return (int)(d->rr_data[r][2+1] & NSEC3_UNKNOWN_FLAGS); in nsec3_unknown_flags()
149 rrset->entry.data; in nsec3_has_optout()
150 log_assert(d && r < (int)d->count); in nsec3_has_optout()
151 if(d->rr_len[r] < 2+2) in nsec3_has_optout()
153 return (int)(d->rr_data[r][2+1] & NSEC3_OPTOUT); in nsec3_has_optout()
161 rrset->entry.data; in nsec3_get_algo()
162 log_assert(d && r < (int)d->count); in nsec3_get_algo()
163 if(d->rr_len[r] < 2+1) in nsec3_get_algo()
165 return (int)(d->rr_data[r][2+0]); in nsec3_get_algo()
173 rrset->entry.data; in nsec3_known_algo()
174 log_assert(d && r < (int)d->count); in nsec3_known_algo()
175 if(d->rr_len[r] < 2+1) in nsec3_known_algo()
177 switch(d->rr_data[r][2+0]) { in nsec3_known_algo()
190 rrset->entry.data; in nsec3_get_iter()
191 log_assert(d && r < (int)d->count); in nsec3_get_iter()
192 if(d->rr_len[r] < 2+4) in nsec3_get_iter()
194 memmove(&i, d->rr_data[r]+2+2, sizeof(i)); in nsec3_get_iter()
205 rrset->entry.data; in nsec3_get_salt()
206 log_assert(d && r < (int)d->count); in nsec3_get_salt()
207 if(d->rr_len[r] < 2+5) { in nsec3_get_salt()
212 *saltlen = (size_t)d->rr_data[r][2+4]; in nsec3_get_salt()
213 if(d->rr_len[r] < 2+5+(size_t)*saltlen) { in nsec3_get_salt()
218 *salt = d->rr_data[r]+2+5; in nsec3_get_salt()
240 rrset->entry.data; in nsec3_get_nextowner()
241 log_assert(d && r < (int)d->count); in nsec3_get_nextowner()
242 if(d->rr_len[r] < 2+5) { in nsec3_get_nextowner()
247 saltlen = (size_t)d->rr_data[r][2+4]; in nsec3_get_nextowner()
248 if(d->rr_len[r] < 2+5+saltlen+1) { in nsec3_get_nextowner()
253 *nextlen = (size_t)d->rr_data[r][2+5+saltlen]; in nsec3_get_nextowner()
254 if(d->rr_len[r] < 2+5+saltlen+1+*nextlen) { in nsec3_get_nextowner()
259 *next = d->rr_data[r]+2+5+saltlen+1; in nsec3_get_nextowner()
264 size_t zonelen, uint8_t* buf, size_t max) in nsec3_hash_to_b32() argument
268 if(max < hashlen*2+1) /* quick approx of b32, as if hexb16 */ in nsec3_hash_to_b32()
270 ret = sldns_b32_ntop_extended_hex(hash, hashlen, (char*)buf+1, max-1); in nsec3_hash_to_b32()
275 if(max - ret < zonelen) in nsec3_hash_to_b32()
282 uint8_t* buf, size_t max) in nsec3_get_nextowner_b32() argument
289 zone = rrset->rk.dname; in nsec3_get_nextowner_b32()
290 zonelen = rrset->rk.dname_len; in nsec3_get_nextowner_b32()
292 return nsec3_hash_to_b32(nm, nmlen, zone, zonelen, buf, max); in nsec3_get_nextowner_b32()
301 rrset->entry.data; in nsec3_has_type()
302 log_assert(d && r < (int)d->count); in nsec3_has_type()
305 if(d->rr_len[r] < skiplen+1) in nsec3_has_type()
307 skiplen += 1+(size_t)d->rr_data[r][skiplen]; in nsec3_has_type()
309 if(d->rr_len[r] < skiplen+1) in nsec3_has_type()
311 skiplen += 1+(size_t)d->rr_data[r][skiplen]; in nsec3_has_type()
312 if(d->rr_len[r] < skiplen) in nsec3_has_type()
314 bitlen = d->rr_len[r] - skiplen; in nsec3_has_type()
315 bitmap = d->rr_data[r]+skiplen; in nsec3_has_type()
346 if(!filter->zone) /* empty list */ in filter_next()
348 for(i=*rrsetnum; i<filter->num; i++) { in filter_next()
350 if(ntohs(filter->list[i]->rk.type) != LDNS_RR_TYPE_NSEC3 || in filter_next()
351 ntohs(filter->list[i]->rk.rrset_class) != in filter_next()
352 filter->fclass) in filter_next()
355 nm = filter->list[i]->rk.dname; in filter_next()
356 nmlen = filter->list[i]->rk.dname_len; in filter_next()
358 if(query_dname_compare(nm, filter->zone) != 0) in filter_next()
363 for(; r < (int)rrset_get_count(filter->list[i]); r++) { in filter_next()
365 if(nsec3_unknown_flags(filter->list[i], r) || in filter_next()
366 !nsec3_known_algo(filter->list[i], r)) in filter_next()
371 return filter->list[i]; in filter_next()
379 * @param filter: the filter structure, must have been filter_init-ed.
389 *rrnum = -1; in filter_first()
425 filter->zone = NULL; in filter_init()
426 filter->zone_len = 0; in filter_init()
427 filter->list = list; in filter_init()
428 filter->num = num; in filter_init()
429 filter->fclass = qinfo->qclass; in filter_init()
432 if(ntohs(list[i]->rk.type) != LDNS_RR_TYPE_NSEC3 || in filter_init()
433 ntohs(list[i]->rk.rrset_class) != qinfo->qclass) in filter_init()
441 nm = list[i]->rk.dname; in filter_init()
442 nmlen = list[i]->rk.dname_len; in filter_init()
446 if(dname_subdomain_c(qinfo->qname, nm) && (!filter->zone || in filter_init()
447 dname_subdomain_c(nm, filter->zone))) { in filter_init()
449 if(qinfo->qtype == LDNS_RR_TYPE_DS && in filter_init()
450 query_dname_compare(qinfo->qname, nm) == 0 && in filter_init()
451 !dname_is_root(qinfo->qname)) in filter_init()
453 filter->zone = nm; in filter_init()
454 filter->zone_len = nmlen; in filter_init()
460 * Find max iteration count using config settings and key size
463 * @return max iteration count
469 log_assert(ve->nsec3_keyiter_count > 0); in get_max_iter()
471 for(i=0; i<ve->nsec3_keyiter_count; i++) { in get_max_iter()
472 if(bits <= ve->nsec3_keysize[i]) in get_max_iter()
473 return ve->nsec3_maxiter[i]; in get_max_iter()
476 return ve->nsec3_maxiter[ve->nsec3_keyiter_count-1]; in get_max_iter()
484 * @return 1 if some nsec3s are above the max iteration count.
493 /* first determine the max number of iterations */ in nsec3_iteration_count_high()
496 verbose(VERB_ALGO, "nsec3: keysize %d bits, max iterations %d", in nsec3_iteration_count_high()
515 int c = query_dname_compare(h1->dname, h2->dname); in nsec3_hash_cmp()
520 if(nsec3_get_algo(h1->nsec3, h1->rr) != in nsec3_hash_cmp()
521 nsec3_get_algo(h2->nsec3, h2->rr)) { in nsec3_hash_cmp()
522 if(nsec3_get_algo(h1->nsec3, h1->rr) < in nsec3_hash_cmp()
523 nsec3_get_algo(h2->nsec3, h2->rr)) in nsec3_hash_cmp()
524 return -1; in nsec3_hash_cmp()
527 if(nsec3_get_iter(h1->nsec3, h1->rr) != in nsec3_hash_cmp()
528 nsec3_get_iter(h2->nsec3, h2->rr)) { in nsec3_hash_cmp()
529 if(nsec3_get_iter(h1->nsec3, h1->rr) < in nsec3_hash_cmp()
530 nsec3_get_iter(h2->nsec3, h2->rr)) in nsec3_hash_cmp()
531 return -1; in nsec3_hash_cmp()
534 (void)nsec3_get_salt(h1->nsec3, h1->rr, &s1, &s1len); in nsec3_hash_cmp()
535 (void)nsec3_get_salt(h2->nsec3, h2->rr, &s2, &s2len); in nsec3_hash_cmp()
538 if(!s1) return -1; in nsec3_hash_cmp()
542 return -1; in nsec3_hash_cmp()
551 if(ct->ct) return 1; in nsec3_cache_table_init()
552 ct->ct = (rbtree_type*)regional_alloc(region, sizeof(*ct->ct)); in nsec3_cache_table_init()
553 if(!ct->ct) return 0; in nsec3_cache_table_init()
554 ct->region = region; in nsec3_cache_table_init()
555 rbtree_init(ct->ct, &nsec3_hash_cmp); in nsec3_cache_table_init()
561 size_t iter, uint8_t* salt, size_t saltlen, uint8_t* res, size_t max) in nsec3_get_hashed() argument
576 if(hash_len > max) in nsec3_get_hashed()
600 int algo = nsec3_get_algo(c->nsec3, c->rr); in nsec3_calc_hash()
601 size_t iter = nsec3_get_iter(c->nsec3, c->rr); in nsec3_calc_hash()
604 if(!nsec3_get_salt(c->nsec3, c->rr, &salt, &saltlen)) in nsec3_calc_hash()
605 return -1; in nsec3_calc_hash()
608 sldns_buffer_write(buf, c->dname, c->dname_len); in nsec3_calc_hash()
612 c->hash_len = nsec3_hash_algo_size_supported(algo); in nsec3_calc_hash()
613 if(c->hash_len == 0) { in nsec3_calc_hash()
615 return -1; in nsec3_calc_hash()
617 c->hash = (uint8_t*)regional_alloc(region, c->hash_len); in nsec3_calc_hash()
618 if(!c->hash) in nsec3_calc_hash()
621 sldns_buffer_limit(buf), (unsigned char*)c->hash); in nsec3_calc_hash()
624 sldns_buffer_write(buf, c->hash, c->hash_len); in nsec3_calc_hash()
629 sldns_buffer_limit(buf), (unsigned char*)c->hash); in nsec3_calc_hash()
641 r = sldns_b32_ntop_extended_hex(c->hash, c->hash_len, in nsec3_calc_b32()
647 c->b32_len = (size_t)r; in nsec3_calc_b32()
648 c->b32 = regional_alloc_init(region, sldns_buffer_begin(buf), in nsec3_calc_b32()
649 c->b32_len); in nsec3_calc_b32()
650 if(!c->b32) in nsec3_calc_b32()
680 c->node.key = c; in nsec3_hash_name()
681 c->nsec3 = nsec3; in nsec3_hash_name()
682 c->rr = rr; in nsec3_hash_name()
683 c->dname = dname; in nsec3_hash_name()
684 c->dname_len = dname_len; in nsec3_hash_name()
687 return r; /* returns -1 or 0 */ in nsec3_hash_name()
696 rbtree_insert(table, &c->node); in nsec3_hash_name()
712 return -1; in label_compare_lower()
732 uint8_t* nm = s->rk.dname; in nsec3_hash_matches_owner()
742 if(hash->b32_len != 0 && (size_t)nm[0] == hash->b32_len && in nsec3_hash_matches_owner()
743 label_compare_lower(nm+1, hash->b32, hash->b32_len) == 0 && in nsec3_hash_matches_owner()
744 query_dname_compare(nm+(size_t)nm[0]+1, flt->zone) == 0) { in nsec3_hash_matches_owner()
776 /* this loop skips other-zone and unknown NSEC3s, also non-NSEC3 RRs */ in find_matching_nsec3()
787 r = nsec3_hash_name(ct->ct, ct->region, env->scratch_buffer, in find_matching_nsec3()
825 if(nextlen != hash->hash_len || hash->hash_len==0||hash->b32_len==0|| in nsec3_covers()
826 (size_t)*rrset->rk.dname != hash->b32_len || in nsec3_covers()
827 query_dname_compare(rrset->rk.dname+1+ in nsec3_covers()
828 (size_t)*rrset->rk.dname, zone) != 0) in nsec3_covers()
832 if(label_compare_lower(rrset->rk.dname+1, hash->b32, in nsec3_covers()
833 hash->b32_len) < 0 && in nsec3_covers()
834 memcmp(hash->hash, next, nextlen) < 0) in nsec3_covers()
840 len = sldns_b32_pton_extended_hex((char*)rrset->rk.dname+1, in nsec3_covers()
841 hash->b32_len, owner, sldns_buffer_limit(buf)); in nsec3_covers()
844 if((size_t)len != hash->hash_len || (size_t)len != nextlen) in nsec3_covers()
849 * this also covers the only-apex case of next==owner. in nsec3_covers()
852 ( memcmp(hash->hash, owner, nextlen) > 0 || in nsec3_covers()
853 memcmp(hash->hash, next, nextlen) < 0)) { in nsec3_covers()
886 /* this loop skips other-zone and unknown NSEC3s, also non-NSEC3 RRs */ in find_covering_nsec3()
897 r = nsec3_hash_name(ct->ct, ct->region, env->scratch_buffer, in find_covering_nsec3()
909 if(nsec3_covers(flt->zone, hash, s, i_rr, in find_covering_nsec3()
910 env->scratch_buffer)) { in find_covering_nsec3()
940 uint8_t* nm = qinfo->qname; in nsec3_find_closest_encloser()
941 size_t nmlen = qinfo->qname_len; in nsec3_find_closest_encloser()
952 while(dname_subdomain_c(nm, flt->zone)) { in nsec3_find_closest_encloser()
958 &ce->ce_rrset, &ce->ce_rr, calculations)) { in nsec3_find_closest_encloser()
959 ce->ce = nm; in nsec3_find_closest_encloser()
960 ce->ce_len = nmlen; in nsec3_find_closest_encloser()
983 int strip = dname_count_labels(qname) - dname_count_labels(ce) -1; in next_closer()
1005 * insecure if the closest-encloser candidate turns out to prove
1038 log_nametypeclass(VERB_ALGO, "ce candidate", ce->ce, 0, 0); in nsec3_prove_closest_encloser()
1040 if(query_dname_compare(ce->ce, qinfo->qname) == 0) { in nsec3_prove_closest_encloser()
1054 if(nsec3_has_type(ce->ce_rrset, ce->ce_rr, LDNS_RR_TYPE_NS) && in nsec3_prove_closest_encloser()
1055 !nsec3_has_type(ce->ce_rrset, ce->ce_rr, LDNS_RR_TYPE_SOA)) { in nsec3_prove_closest_encloser()
1056 if(!nsec3_has_type(ce->ce_rrset, ce->ce_rr, LDNS_RR_TYPE_DS)) { in nsec3_prove_closest_encloser()
1065 if(nsec3_has_type(ce->ce_rrset, ce->ce_rr, LDNS_RR_TYPE_DNAME)) { in nsec3_prove_closest_encloser()
1072 next_closer(qinfo->qname, qinfo->qname_len, ce->ce, &nc, &nc_len); in nsec3_prove_closest_encloser()
1074 &ce->nc_rrset, &ce->nc_rr, calculations)) { in nsec3_prove_closest_encloser()
1102 if(celen > LDNS_MAX_DOMAINLEN - 2) in nsec3_ce_wildcard()
1149 wc = nsec3_ce_wildcard(ct->region, ce.ce, ce.ce_len, &wclen); in nsec3_do_prove_nameerror()
1204 * This existed in early drafts, but was later (-05) removed.
1220 if(find_matching_nsec3(env, flt, ct, qinfo->qname, qinfo->qname_len, in nsec3_do_prove_nodata()
1223 if(nsec3_has_type(rrset, rr, qinfo->qtype)) { in nsec3_do_prove_nodata()
1245 if(qinfo->qtype == LDNS_RR_TYPE_DS && qinfo->qname_len != 1 in nsec3_do_prove_nodata()
1247 !dname_is_root(qinfo->qname)) { in nsec3_do_prove_nodata()
1251 } else if(qinfo->qtype != LDNS_RR_TYPE_DS && in nsec3_do_prove_nodata()
1278 /* For cases 3 - 5, we need the proven closest encloser, and it in nsec3_do_prove_nodata()
1286 } else if(sec==sec_status_insecure && qinfo->qtype!=LDNS_RR_TYPE_DS){ in nsec3_do_prove_nodata()
1298 wc = nsec3_ce_wildcard(ct->region, ce.ce, ce.ce_len, &wclen); in nsec3_do_prove_nodata()
1302 if(nsec3_has_type(rrset, rr, qinfo->qtype)) { in nsec3_do_prove_nodata()
1311 if(qinfo->qtype == LDNS_RR_TYPE_DS && qinfo->qname_len != 1 in nsec3_do_prove_nodata()
1316 } else if(qinfo->qtype != LDNS_RR_TYPE_DS && in nsec3_do_prove_nodata()
1353 /* We need to make sure that the covering NSEC3 is opt-out. */ in nsec3_do_prove_nodata()
1356 if(qinfo->qtype == LDNS_RR_TYPE_DS) in nsec3_do_prove_nodata()
1358 "opt-out in an opt-out DS NOERROR/NODATA case."); in nsec3_do_prove_nodata()
1361 "-- no more options, bogus."); in nsec3_do_prove_nodata()
1417 next_closer(qinfo->qname, qinfo->qname_len, ce.ce, &nc, &nc_len); in nsec3_prove_wildcard()
1449 struct key_entry_key* kkey, char** reason, sldns_ede_code *reason_bogus, in list_is_secure() argument
1456 d = (struct packed_rrset_data*)list[i]->entry.data; in list_is_secure()
1457 if(list[i]->rk.type != htons(LDNS_RR_TYPE_NSEC3)) in list_is_secure()
1459 if(d->security == sec_status_secure) in list_is_secure()
1461 rrset_check_sec_status(env->rrset_cache, list[i], *env->now); in list_is_secure()
1462 if(d->security == sec_status_secure) in list_is_secure()
1464 d->security = val_verify_rrset_entry(env, ve, list[i], kkey, in list_is_secure()
1465 reason, reason_bogus, LDNS_SECTION_AUTHORITY, qstate, in list_is_secure()
1467 if(d->security != sec_status_secure) { in list_is_secure()
1471 rrset_update_sec_status(env->rrset_cache, list[i], *env->now); in list_is_secure()
1479 struct query_info* qinfo, struct key_entry_key* kkey, char** reason, in nsec3_prove_nods() argument
1490 log_assert(qinfo->qtype == LDNS_RR_TYPE_DS); in nsec3_prove_nods()
1493 *reason = "no valid NSEC3s"; in nsec3_prove_nods()
1496 if(!list_is_secure(env, ve, list, num, kkey, reason, reason_bogus, in nsec3_prove_nods()
1498 *reason = "not all NSEC3 records secure"; in nsec3_prove_nods()
1503 *reason = "no NSEC3 records"; in nsec3_prove_nods()
1509 /* Look for a matching NSEC3 to qname -- this is the normal in nsec3_prove_nods()
1511 if(find_matching_nsec3(env, &flt, ct, qinfo->qname, qinfo->qname_len, in nsec3_prove_nods()
1517 qinfo->qname_len != 1) { in nsec3_prove_nods()
1520 *reason = "NSEC3 from child zone"; in nsec3_prove_nods()
1525 *reason = "NSEC3 has DS in bitmap"; in nsec3_prove_nods()
1548 /* Otherwise, we are probably in the opt-out case. */ in nsec3_prove_nods()
1557 *reason = "no NSEC3 closest encloser"; in nsec3_prove_nods()
1564 *reason = "no NSEC3 next closer"; in nsec3_prove_nods()
1569 * covering NSEC3 was opt-out -- the proveClosestEncloser step already in nsec3_prove_nods()
1575 "opt-out in an opt-out DS NOERROR/NODATA case."); in nsec3_prove_nods()
1576 *reason = "covering NSEC3 was not opt-out in an opt-out " in nsec3_prove_nods()