1 /* 2 * util/edns.h - handle base EDNS options. 3 * 4 * Copyright (c) 2018, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains functions for base EDNS options. 40 */ 41 42 #ifndef UTIL_EDNS_H 43 #define UTIL_EDNS_H 44 45 #include "util/storage/dnstree.h" 46 47 struct edns_data; 48 struct config_file; 49 struct comm_point; 50 struct regional; 51 52 /** 53 * Structure containing all EDNS strings. 54 */ 55 struct edns_strings { 56 /** Tree of EDNS client strings to use in upstream queries, per address 57 * prefix. Contains nodes of type edns_string_addr. */ 58 rbtree_type client_strings; 59 /** EDNS opcode to use for client strings */ 60 uint16_t client_string_opcode; 61 /** region to allocate tree nodes in */ 62 struct regional* region; 63 }; 64 65 /** 66 * EDNS string. Node of rbtree, containing string and prefix. 67 */ 68 struct edns_string_addr { 69 /** node in address tree, used for tree lookups. Need to be the first 70 * member of this struct. */ 71 struct addr_tree_node node; 72 /** string, ascii format */ 73 uint8_t* string; 74 /** length of string */ 75 size_t string_len; 76 }; 77 78 enum edns_cookie_val_status { 79 COOKIE_STATUS_CLIENT_ONLY = -3, 80 COOKIE_STATUS_FUTURE = -2, 81 COOKIE_STATUS_EXPIRED = -1, 82 COOKIE_STATUS_INVALID = 0, 83 COOKIE_STATUS_VALID = 1, 84 COOKIE_STATUS_VALID_RENEW = 2, 85 }; 86 87 /** 88 * Create structure to hold EDNS strings 89 * @return: newly created edns_strings, NULL on alloc failure. 90 */ 91 struct edns_strings* edns_strings_create(void); 92 93 /** Delete EDNS strings structure 94 * @param edns_strings: struct to delete 95 */ 96 void edns_strings_delete(struct edns_strings* edns_strings); 97 98 /** 99 * Add configured EDNS strings 100 * @param edns_strings: edns strings to apply config to 101 * @param config: struct containing EDNS strings configuration 102 * @return 0 on error 103 */ 104 int edns_strings_apply_cfg(struct edns_strings* edns_strings, 105 struct config_file* config); 106 107 /** 108 * Find string for address. 109 * @param tree: tree containing EDNS strings per address prefix. 110 * @param addr: address to use for tree lookup 111 * @param addrlen: length of address 112 * @return: matching tree node, NULL otherwise 113 */ 114 struct edns_string_addr* 115 edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr, 116 socklen_t addrlen); 117 118 /** 119 * Compute the interoperable DNS cookie (RFC9018) hash. 120 * @param in: buffer input for the hash generation. It needs to be: 121 * Client Cookie | Version | Reserved | Timestamp | Client-IP 122 * @param secret: the server secret; implicit length of 16 octets. 123 * @param v4: if the client IP is v4 or v6. 124 * @param hash: buffer to write the hash to. 125 * return a pointer to the hash. 126 */ 127 uint8_t* edns_cookie_server_hash(const uint8_t* in, const uint8_t* secret, 128 int v4, uint8_t* hash); 129 130 /** 131 * Write an interoperable DNS server cookie (RFC9018). 132 * @param buf: buffer to write to. It should have a size of at least 32 octets 133 * as it doubles as the output buffer and the hash input buffer. 134 * The first 8 octets are expected to be the Client Cookie and will be 135 * left untouched. 136 * The next 8 octets will be written with Version | Reserved | Timestamp. 137 * The next 4 or 16 octets are expected to be the IPv4 or the IPv6 address 138 * based on the v4 flag. 139 * Thus the first 20 or 32 octets, based on the v4 flag, will be used as 140 * the hash input. 141 * The server hash (8 octets) will be written after the first 16 octets; 142 * overwriting the address information. 143 * The caller expects a complete, 24 octet long cookie in the buffer. 144 * @param secret: the server secret; implicit length of 16 octets. 145 * @param v4: if the client IP is v4 or v6. 146 * @param timestamp: the timestamp to use. 147 */ 148 void edns_cookie_server_write(uint8_t* buf, const uint8_t* secret, int v4, 149 uint32_t timestamp); 150 151 /** 152 * Validate an interoperable DNS cookie (RFC9018). 153 * @param cookie: pointer to the cookie data. 154 * @param cookie_len: the length of the cookie data. 155 * @param secret: pointer to the server secret. 156 * @param secret_len: the length of the secret. 157 * @param v4: if the client IP is v4 or v6. 158 * @param hash_input: pointer to the hash input for validation. It needs to be: 159 * Client Cookie | Version | Reserved | Timestamp | Client-IP 160 * @param now: the current time. 161 * return edns_cookie_val_status with the cookie validation status i.e., 162 * <=0 for invalid, else valid. 163 */ 164 enum edns_cookie_val_status edns_cookie_server_validate(const uint8_t* cookie, 165 size_t cookie_len, const uint8_t* secret, size_t secret_len, int v4, 166 const uint8_t* hash_input, uint32_t now); 167 168 #endif 169