xref: /freebsd/contrib/unbound/validator/val_nsec3.h (revision b7579f77d18196a58ff700756c84dc9a302a7f67)
1*b7579f77SDag-Erling Smørgrav /*
2*b7579f77SDag-Erling Smørgrav  * validator/val_nsec3.h - validator NSEC3 denial of existance functions.
3*b7579f77SDag-Erling Smørgrav  *
4*b7579f77SDag-Erling Smørgrav  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5*b7579f77SDag-Erling Smørgrav  *
6*b7579f77SDag-Erling Smørgrav  * This software is open source.
7*b7579f77SDag-Erling Smørgrav  *
8*b7579f77SDag-Erling Smørgrav  * Redistribution and use in source and binary forms, with or without
9*b7579f77SDag-Erling Smørgrav  * modification, are permitted provided that the following conditions
10*b7579f77SDag-Erling Smørgrav  * are met:
11*b7579f77SDag-Erling Smørgrav  *
12*b7579f77SDag-Erling Smørgrav  * Redistributions of source code must retain the above copyright notice,
13*b7579f77SDag-Erling Smørgrav  * this list of conditions and the following disclaimer.
14*b7579f77SDag-Erling Smørgrav  *
15*b7579f77SDag-Erling Smørgrav  * Redistributions in binary form must reproduce the above copyright notice,
16*b7579f77SDag-Erling Smørgrav  * this list of conditions and the following disclaimer in the documentation
17*b7579f77SDag-Erling Smørgrav  * and/or other materials provided with the distribution.
18*b7579f77SDag-Erling Smørgrav  *
19*b7579f77SDag-Erling Smørgrav  * Neither the name of the NLNET LABS nor the names of its contributors may
20*b7579f77SDag-Erling Smørgrav  * be used to endorse or promote products derived from this software without
21*b7579f77SDag-Erling Smørgrav  * specific prior written permission.
22*b7579f77SDag-Erling Smørgrav  *
23*b7579f77SDag-Erling Smørgrav  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24*b7579f77SDag-Erling Smørgrav  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
25*b7579f77SDag-Erling Smørgrav  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
26*b7579f77SDag-Erling Smørgrav  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
27*b7579f77SDag-Erling Smørgrav  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
28*b7579f77SDag-Erling Smørgrav  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29*b7579f77SDag-Erling Smørgrav  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
30*b7579f77SDag-Erling Smørgrav  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
31*b7579f77SDag-Erling Smørgrav  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
32*b7579f77SDag-Erling Smørgrav  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
33*b7579f77SDag-Erling Smørgrav  * POSSIBILITY OF SUCH DAMAGE.
34*b7579f77SDag-Erling Smørgrav  */
35*b7579f77SDag-Erling Smørgrav 
36*b7579f77SDag-Erling Smørgrav /**
37*b7579f77SDag-Erling Smørgrav  * \file
38*b7579f77SDag-Erling Smørgrav  *
39*b7579f77SDag-Erling Smørgrav  * This file contains helper functions for the validator module.
40*b7579f77SDag-Erling Smørgrav  * The functions help with NSEC3 checking, the different NSEC3 proofs
41*b7579f77SDag-Erling Smørgrav  * for denial of existance, and proofs for presence of types.
42*b7579f77SDag-Erling Smørgrav  *
43*b7579f77SDag-Erling Smørgrav  * NSEC3
44*b7579f77SDag-Erling Smørgrav  *                      1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
45*b7579f77SDag-Erling Smørgrav  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
46*b7579f77SDag-Erling Smørgrav  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
47*b7579f77SDag-Erling Smørgrav  * |   Hash Alg.   |     Flags     |          Iterations           |
48*b7579f77SDag-Erling Smørgrav  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
49*b7579f77SDag-Erling Smørgrav  * |  Salt Length  |                     Salt                      /
50*b7579f77SDag-Erling Smørgrav  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
51*b7579f77SDag-Erling Smørgrav  * |  Hash Length  |             Next Hashed Owner Name            /
52*b7579f77SDag-Erling Smørgrav  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
53*b7579f77SDag-Erling Smørgrav  * /                         Type Bit Maps                         /
54*b7579f77SDag-Erling Smørgrav  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
55*b7579f77SDag-Erling Smørgrav  *
56*b7579f77SDag-Erling Smørgrav  * NSEC3PARAM
57*b7579f77SDag-Erling Smørgrav  *                      1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
58*b7579f77SDag-Erling Smørgrav  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
59*b7579f77SDag-Erling Smørgrav  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
60*b7579f77SDag-Erling Smørgrav  * |   Hash Alg.   |     Flags     |          Iterations           |
61*b7579f77SDag-Erling Smørgrav  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
62*b7579f77SDag-Erling Smørgrav  * |  Salt Length  |                     Salt                      /
63*b7579f77SDag-Erling Smørgrav  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
64*b7579f77SDag-Erling Smørgrav  *
65*b7579f77SDag-Erling Smørgrav  */
66*b7579f77SDag-Erling Smørgrav 
67*b7579f77SDag-Erling Smørgrav #ifndef VALIDATOR_VAL_NSEC3_H
68*b7579f77SDag-Erling Smørgrav #define VALIDATOR_VAL_NSEC3_H
69*b7579f77SDag-Erling Smørgrav #include "util/rbtree.h"
70*b7579f77SDag-Erling Smørgrav #include "util/data/packed_rrset.h"
71*b7579f77SDag-Erling Smørgrav struct val_env;
72*b7579f77SDag-Erling Smørgrav struct regional;
73*b7579f77SDag-Erling Smørgrav struct module_env;
74*b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key;
75*b7579f77SDag-Erling Smørgrav struct reply_info;
76*b7579f77SDag-Erling Smørgrav struct query_info;
77*b7579f77SDag-Erling Smørgrav struct key_entry_key;
78*b7579f77SDag-Erling Smørgrav 
79*b7579f77SDag-Erling Smørgrav /**
80*b7579f77SDag-Erling Smørgrav  *     0 1 2 3 4 5 6 7
81*b7579f77SDag-Erling Smørgrav  *    +-+-+-+-+-+-+-+-+
82*b7579f77SDag-Erling Smørgrav  *    |             |O|
83*b7579f77SDag-Erling Smørgrav  *    +-+-+-+-+-+-+-+-+
84*b7579f77SDag-Erling Smørgrav  * The OPT-OUT bit in the NSEC3 flags field.
85*b7579f77SDag-Erling Smørgrav  * If enabled, there can be zero or more unsigned delegations in the span.
86*b7579f77SDag-Erling Smørgrav  * If disabled, there are zero unsigned delegations in the span.
87*b7579f77SDag-Erling Smørgrav  */
88*b7579f77SDag-Erling Smørgrav #define NSEC3_OPTOUT	0x01
89*b7579f77SDag-Erling Smørgrav /**
90*b7579f77SDag-Erling Smørgrav  * The unknown flags in the NSEC3 flags field.
91*b7579f77SDag-Erling Smørgrav  * They must be zero, or the NSEC3 is ignored.
92*b7579f77SDag-Erling Smørgrav  */
93*b7579f77SDag-Erling Smørgrav #define NSEC3_UNKNOWN_FLAGS 0xFE
94*b7579f77SDag-Erling Smørgrav 
95*b7579f77SDag-Erling Smørgrav /** The SHA1 hash algorithm for NSEC3 */
96*b7579f77SDag-Erling Smørgrav #define NSEC3_HASH_SHA1	0x01
97*b7579f77SDag-Erling Smørgrav 
98*b7579f77SDag-Erling Smørgrav /**
99*b7579f77SDag-Erling Smørgrav  * Determine if the set of NSEC3 records provided with a response prove NAME
100*b7579f77SDag-Erling Smørgrav  * ERROR. This means that the NSEC3s prove a) the closest encloser exists,
101*b7579f77SDag-Erling Smørgrav  * b) the direct child of the closest encloser towards qname doesn't exist,
102*b7579f77SDag-Erling Smørgrav  * and c) *.closest encloser does not exist.
103*b7579f77SDag-Erling Smørgrav  *
104*b7579f77SDag-Erling Smørgrav  * @param env: module environment with temporary region and buffer.
105*b7579f77SDag-Erling Smørgrav  * @param ve: validator environment, with iteration count settings.
106*b7579f77SDag-Erling Smørgrav  * @param list: array of RRsets, some of which are NSEC3s.
107*b7579f77SDag-Erling Smørgrav  * @param num: number of RRsets in the array to examine.
108*b7579f77SDag-Erling Smørgrav  * @param qinfo: query that is verified for.
109*b7579f77SDag-Erling Smørgrav  * @param kkey: key entry that signed the NSEC3s.
110*b7579f77SDag-Erling Smørgrav  * @return:
111*b7579f77SDag-Erling Smørgrav  * 	sec_status SECURE of the Name Error is proven by the NSEC3 RRs,
112*b7579f77SDag-Erling Smørgrav  * 	BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored.
113*b7579f77SDag-Erling Smørgrav  */
114*b7579f77SDag-Erling Smørgrav enum sec_status
115*b7579f77SDag-Erling Smørgrav nsec3_prove_nameerror(struct module_env* env, struct val_env* ve,
116*b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key** list, size_t num,
117*b7579f77SDag-Erling Smørgrav 	struct query_info* qinfo, struct key_entry_key* kkey);
118*b7579f77SDag-Erling Smørgrav 
119*b7579f77SDag-Erling Smørgrav /**
120*b7579f77SDag-Erling Smørgrav  * Determine if the NSEC3s provided in a response prove the NOERROR/NODATA
121*b7579f77SDag-Erling Smørgrav  * status. There are a number of different variants to this:
122*b7579f77SDag-Erling Smørgrav  *
123*b7579f77SDag-Erling Smørgrav  * 1) Normal NODATA -- qname is matched to an NSEC3 record, type is not
124*b7579f77SDag-Erling Smørgrav  * present.
125*b7579f77SDag-Erling Smørgrav  *
126*b7579f77SDag-Erling Smørgrav  * 2) ENT NODATA -- because there must be NSEC3 record for
127*b7579f77SDag-Erling Smørgrav  * empty-non-terminals, this is the same as #1.
128*b7579f77SDag-Erling Smørgrav  *
129*b7579f77SDag-Erling Smørgrav  * 3) NSEC3 ownername NODATA -- qname matched an existing, lone NSEC3
130*b7579f77SDag-Erling Smørgrav  * ownername, but qtype was not NSEC3. NOTE: as of nsec-05, this case no
131*b7579f77SDag-Erling Smørgrav  * longer exists.
132*b7579f77SDag-Erling Smørgrav  *
133*b7579f77SDag-Erling Smørgrav  * 4) Wildcard NODATA -- A wildcard matched the name, but not the type.
134*b7579f77SDag-Erling Smørgrav  *
135*b7579f77SDag-Erling Smørgrav  * 5) Opt-In DS NODATA -- the qname is covered by an opt-in span and qtype ==
136*b7579f77SDag-Erling Smørgrav  * DS. (or maybe some future record with the same parent-side-only property)
137*b7579f77SDag-Erling Smørgrav  *
138*b7579f77SDag-Erling Smørgrav  * @param env: module environment with temporary region and buffer.
139*b7579f77SDag-Erling Smørgrav  * @param ve: validator environment, with iteration count settings.
140*b7579f77SDag-Erling Smørgrav  * @param list: array of RRsets, some of which are NSEC3s.
141*b7579f77SDag-Erling Smørgrav  * @param num: number of RRsets in the array to examine.
142*b7579f77SDag-Erling Smørgrav  * @param qinfo: query that is verified for.
143*b7579f77SDag-Erling Smørgrav  * @param kkey: key entry that signed the NSEC3s.
144*b7579f77SDag-Erling Smørgrav  * @return:
145*b7579f77SDag-Erling Smørgrav  * 	sec_status SECURE of the proposition is proven by the NSEC3 RRs,
146*b7579f77SDag-Erling Smørgrav  * 	BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored.
147*b7579f77SDag-Erling Smørgrav  */
148*b7579f77SDag-Erling Smørgrav enum sec_status
149*b7579f77SDag-Erling Smørgrav nsec3_prove_nodata(struct module_env* env, struct val_env* ve,
150*b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key** list, size_t num,
151*b7579f77SDag-Erling Smørgrav 	struct query_info* qinfo, struct key_entry_key* kkey);
152*b7579f77SDag-Erling Smørgrav 
153*b7579f77SDag-Erling Smørgrav 
154*b7579f77SDag-Erling Smørgrav /**
155*b7579f77SDag-Erling Smørgrav  * Prove that a positive wildcard match was appropriate (no direct match
156*b7579f77SDag-Erling Smørgrav  * RRset).
157*b7579f77SDag-Erling Smørgrav  *
158*b7579f77SDag-Erling Smørgrav  * @param env: module environment with temporary region and buffer.
159*b7579f77SDag-Erling Smørgrav  * @param ve: validator environment, with iteration count settings.
160*b7579f77SDag-Erling Smørgrav  * @param list: array of RRsets, some of which are NSEC3s.
161*b7579f77SDag-Erling Smørgrav  * @param num: number of RRsets in the array to examine.
162*b7579f77SDag-Erling Smørgrav  * @param qinfo: query that is verified for.
163*b7579f77SDag-Erling Smørgrav  * @param kkey: key entry that signed the NSEC3s.
164*b7579f77SDag-Erling Smørgrav  * @param wc: The purported wildcard that matched. This is the wildcard name
165*b7579f77SDag-Erling Smørgrav  * 	as *.wildcard.name., with the *. label already removed.
166*b7579f77SDag-Erling Smørgrav  * @return:
167*b7579f77SDag-Erling Smørgrav  * 	sec_status SECURE of the proposition is proven by the NSEC3 RRs,
168*b7579f77SDag-Erling Smørgrav  * 	BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored.
169*b7579f77SDag-Erling Smørgrav  */
170*b7579f77SDag-Erling Smørgrav enum sec_status
171*b7579f77SDag-Erling Smørgrav nsec3_prove_wildcard(struct module_env* env, struct val_env* ve,
172*b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key** list, size_t num,
173*b7579f77SDag-Erling Smørgrav 	struct query_info* qinfo, struct key_entry_key* kkey, uint8_t* wc);
174*b7579f77SDag-Erling Smørgrav 
175*b7579f77SDag-Erling Smørgrav /**
176*b7579f77SDag-Erling Smørgrav  * Prove that a DS response either had no DS, or wasn't a delegation point.
177*b7579f77SDag-Erling Smørgrav  *
178*b7579f77SDag-Erling Smørgrav  * Fundamentally there are two cases here: normal NODATA and Opt-In NODATA.
179*b7579f77SDag-Erling Smørgrav  *
180*b7579f77SDag-Erling Smørgrav  * @param env: module environment with temporary region and buffer.
181*b7579f77SDag-Erling Smørgrav  * @param ve: validator environment, with iteration count settings.
182*b7579f77SDag-Erling Smørgrav  * @param list: array of RRsets, some of which are NSEC3s.
183*b7579f77SDag-Erling Smørgrav  * @param num: number of RRsets in the array to examine.
184*b7579f77SDag-Erling Smørgrav  * @param qinfo: query that is verified for.
185*b7579f77SDag-Erling Smørgrav  * @param kkey: key entry that signed the NSEC3s.
186*b7579f77SDag-Erling Smørgrav  * @param reason: string for bogus result.
187*b7579f77SDag-Erling Smørgrav  * @return:
188*b7579f77SDag-Erling Smørgrav  * 	sec_status SECURE of the proposition is proven by the NSEC3 RRs,
189*b7579f77SDag-Erling Smørgrav  * 	BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored.
190*b7579f77SDag-Erling Smørgrav  * 	or if there was no DS in an insecure (i.e., opt-in) way,
191*b7579f77SDag-Erling Smørgrav  * 	INDETERMINATE if it was clear that this wasn't a delegation point.
192*b7579f77SDag-Erling Smørgrav  */
193*b7579f77SDag-Erling Smørgrav enum sec_status
194*b7579f77SDag-Erling Smørgrav nsec3_prove_nods(struct module_env* env, struct val_env* ve,
195*b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key** list, size_t num,
196*b7579f77SDag-Erling Smørgrav 	struct query_info* qinfo, struct key_entry_key* kkey, char** reason);
197*b7579f77SDag-Erling Smørgrav 
198*b7579f77SDag-Erling Smørgrav /**
199*b7579f77SDag-Erling Smørgrav  * Prove NXDOMAIN or NODATA.
200*b7579f77SDag-Erling Smørgrav  *
201*b7579f77SDag-Erling Smørgrav  * @param env: module environment with temporary region and buffer.
202*b7579f77SDag-Erling Smørgrav  * @param ve: validator environment, with iteration count settings.
203*b7579f77SDag-Erling Smørgrav  * @param list: array of RRsets, some of which are NSEC3s.
204*b7579f77SDag-Erling Smørgrav  * @param num: number of RRsets in the array to examine.
205*b7579f77SDag-Erling Smørgrav  * @param qinfo: query that is verified for.
206*b7579f77SDag-Erling Smørgrav  * @param kkey: key entry that signed the NSEC3s.
207*b7579f77SDag-Erling Smørgrav  * @param nodata: if return value is secure, this indicates if nodata or
208*b7579f77SDag-Erling Smørgrav  * 	nxdomain was proven.
209*b7579f77SDag-Erling Smørgrav  * @return:
210*b7579f77SDag-Erling Smørgrav  * 	sec_status SECURE of the proposition is proven by the NSEC3 RRs,
211*b7579f77SDag-Erling Smørgrav  * 	BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored.
212*b7579f77SDag-Erling Smørgrav  */
213*b7579f77SDag-Erling Smørgrav enum sec_status
214*b7579f77SDag-Erling Smørgrav nsec3_prove_nxornodata(struct module_env* env, struct val_env* ve,
215*b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key** list, size_t num,
216*b7579f77SDag-Erling Smørgrav 	struct query_info* qinfo, struct key_entry_key* kkey, int* nodata);
217*b7579f77SDag-Erling Smørgrav 
218*b7579f77SDag-Erling Smørgrav /**
219*b7579f77SDag-Erling Smørgrav  * The NSEC3 hash result storage.
220*b7579f77SDag-Erling Smørgrav  * Consists of an rbtree, with these nodes in it.
221*b7579f77SDag-Erling Smørgrav  * The nodes detail how a set of parameters (from nsec3 rr) plus
222*b7579f77SDag-Erling Smørgrav  * a dname result in a hash.
223*b7579f77SDag-Erling Smørgrav  */
224*b7579f77SDag-Erling Smørgrav struct nsec3_cached_hash {
225*b7579f77SDag-Erling Smørgrav 	/** rbtree node, key is this structure */
226*b7579f77SDag-Erling Smørgrav 	rbnode_t node;
227*b7579f77SDag-Erling Smørgrav 	/** where are the parameters for conversion, in this rrset data */
228*b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key* nsec3;
229*b7579f77SDag-Erling Smørgrav 	/** where are the parameters for conversion, this RR number in data */
230*b7579f77SDag-Erling Smørgrav 	int rr;
231*b7579f77SDag-Erling Smørgrav 	/** the name to convert */
232*b7579f77SDag-Erling Smørgrav 	uint8_t* dname;
233*b7579f77SDag-Erling Smørgrav 	/** length of the dname */
234*b7579f77SDag-Erling Smørgrav 	size_t dname_len;
235*b7579f77SDag-Erling Smørgrav 	/** the hash result (not base32 encoded) */
236*b7579f77SDag-Erling Smørgrav 	uint8_t* hash;
237*b7579f77SDag-Erling Smørgrav 	/** length of hash in bytes */
238*b7579f77SDag-Erling Smørgrav 	size_t hash_len;
239*b7579f77SDag-Erling Smørgrav 	/** the hash result in base32 encoding */
240*b7579f77SDag-Erling Smørgrav 	uint8_t* b32;
241*b7579f77SDag-Erling Smørgrav 	/** length of base32 encoding (as a label) */
242*b7579f77SDag-Erling Smørgrav 	size_t b32_len;
243*b7579f77SDag-Erling Smørgrav };
244*b7579f77SDag-Erling Smørgrav 
245*b7579f77SDag-Erling Smørgrav /**
246*b7579f77SDag-Erling Smørgrav  * Rbtree for hash cache comparison function.
247*b7579f77SDag-Erling Smørgrav  * @param c1: key 1.
248*b7579f77SDag-Erling Smørgrav  * @param c2: key 2.
249*b7579f77SDag-Erling Smørgrav  * @return: comparison code, -1, 0, 1, of the keys.
250*b7579f77SDag-Erling Smørgrav  */
251*b7579f77SDag-Erling Smørgrav int nsec3_hash_cmp(const void* c1, const void* c2);
252*b7579f77SDag-Erling Smørgrav 
253*b7579f77SDag-Erling Smørgrav /**
254*b7579f77SDag-Erling Smørgrav  * Obtain the hash of an owner name.
255*b7579f77SDag-Erling Smørgrav  * Used internally by the nsec3 proof functions in this file.
256*b7579f77SDag-Erling Smørgrav  * published to enable unit testing of hash algorithms and cache.
257*b7579f77SDag-Erling Smørgrav  *
258*b7579f77SDag-Erling Smørgrav  * @param table: the cache table. Must be inited at start.
259*b7579f77SDag-Erling Smørgrav  * @param region: scratch region to use for allocation.
260*b7579f77SDag-Erling Smørgrav  * 	This region holds the tree, if you wipe the region, reinit the tree.
261*b7579f77SDag-Erling Smørgrav  * @param buf: temporary buffer.
262*b7579f77SDag-Erling Smørgrav  * @param nsec3: the rrset with parameters
263*b7579f77SDag-Erling Smørgrav  * @param rr: rr number from d that has the NSEC3 parameters to hash to.
264*b7579f77SDag-Erling Smørgrav  * @param dname: name to hash
265*b7579f77SDag-Erling Smørgrav  * 	This pointer is used inside the tree, assumed region-alloced.
266*b7579f77SDag-Erling Smørgrav  * @param dname_len: the length of the name.
267*b7579f77SDag-Erling Smørgrav  * @param hash: the hash node is returned on success.
268*b7579f77SDag-Erling Smørgrav  * @return:
269*b7579f77SDag-Erling Smørgrav  * 	1 on success, either from cache or newly hashed hash is returned.
270*b7579f77SDag-Erling Smørgrav  * 	0 on a malloc failure.
271*b7579f77SDag-Erling Smørgrav  * 	-1 if the NSEC3 rr was badly formatted (i.e. formerr).
272*b7579f77SDag-Erling Smørgrav  */
273*b7579f77SDag-Erling Smørgrav int nsec3_hash_name(rbtree_t* table, struct regional* region, ldns_buffer* buf,
274*b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key* nsec3, int rr, uint8_t* dname,
275*b7579f77SDag-Erling Smørgrav 	size_t dname_len, struct nsec3_cached_hash** hash);
276*b7579f77SDag-Erling Smørgrav 
277*b7579f77SDag-Erling Smørgrav /**
278*b7579f77SDag-Erling Smørgrav  * Get next owner name, converted to base32 encoding and with the
279*b7579f77SDag-Erling Smørgrav  * zone name (taken from the nsec3 owner name) appended.
280*b7579f77SDag-Erling Smørgrav  * @param rrset: the NSEC3 rrset.
281*b7579f77SDag-Erling Smørgrav  * @param r: the rr num of the nsec3 in the rrset.
282*b7579f77SDag-Erling Smørgrav  * @param buf: buffer to store name in
283*b7579f77SDag-Erling Smørgrav  * @param max: size of buffer.
284*b7579f77SDag-Erling Smørgrav  * @return length of name on success. 0 on failure (buffer too short or
285*b7579f77SDag-Erling Smørgrav  *	bad format nsec3 record).
286*b7579f77SDag-Erling Smørgrav  */
287*b7579f77SDag-Erling Smørgrav size_t nsec3_get_nextowner_b32(struct ub_packed_rrset_key* rrset, int r,
288*b7579f77SDag-Erling Smørgrav 	uint8_t* buf, size_t max);
289*b7579f77SDag-Erling Smørgrav 
290*b7579f77SDag-Erling Smørgrav /**
291*b7579f77SDag-Erling Smørgrav  * Convert hash into base32 encoding and with the
292*b7579f77SDag-Erling Smørgrav  * zone name appended.
293*b7579f77SDag-Erling Smørgrav  * @param hash: hashed buffer
294*b7579f77SDag-Erling Smørgrav  * @param hashlen: length of hash
295*b7579f77SDag-Erling Smørgrav  * @param zone: name of zone
296*b7579f77SDag-Erling Smørgrav  * @param zonelen: length of zonename.
297*b7579f77SDag-Erling Smørgrav  * @param buf: buffer to store name in
298*b7579f77SDag-Erling Smørgrav  * @param max: size of buffer.
299*b7579f77SDag-Erling Smørgrav  * @return length of name on success. 0 on failure (buffer too short or
300*b7579f77SDag-Erling Smørgrav  *	bad format nsec3 record).
301*b7579f77SDag-Erling Smørgrav  */
302*b7579f77SDag-Erling Smørgrav size_t nsec3_hash_to_b32(uint8_t* hash, size_t hashlen, uint8_t* zone,
303*b7579f77SDag-Erling Smørgrav 	size_t zonelen, uint8_t* buf, size_t max);
304*b7579f77SDag-Erling Smørgrav 
305*b7579f77SDag-Erling Smørgrav /**
306*b7579f77SDag-Erling Smørgrav  * Get NSEC3 parameters out of rr.
307*b7579f77SDag-Erling Smørgrav  * @param rrset: the NSEC3 rrset.
308*b7579f77SDag-Erling Smørgrav  * @param r: the rr num of the nsec3 in the rrset.
309*b7579f77SDag-Erling Smørgrav  * @param algo: nsec3 hash algo.
310*b7579f77SDag-Erling Smørgrav  * @param iter: iteration count.
311*b7579f77SDag-Erling Smørgrav  * @param salt: ptr to salt inside rdata.
312*b7579f77SDag-Erling Smørgrav  * @param saltlen: length of salt.
313*b7579f77SDag-Erling Smørgrav  * @return 0 if bad formatted, unknown nsec3 hash algo, or unknown flags set.
314*b7579f77SDag-Erling Smørgrav  */
315*b7579f77SDag-Erling Smørgrav int nsec3_get_params(struct ub_packed_rrset_key* rrset, int r,
316*b7579f77SDag-Erling Smørgrav 	int* algo, size_t* iter, uint8_t** salt, size_t* saltlen);
317*b7579f77SDag-Erling Smørgrav 
318*b7579f77SDag-Erling Smørgrav /**
319*b7579f77SDag-Erling Smørgrav  * Get NSEC3 hashed in a buffer
320*b7579f77SDag-Erling Smørgrav  * @param buf: buffer for temp use.
321*b7579f77SDag-Erling Smørgrav  * @param nm: name to hash
322*b7579f77SDag-Erling Smørgrav  * @param nmlen: length of nm.
323*b7579f77SDag-Erling Smørgrav  * @param algo: algo to use, must be known.
324*b7579f77SDag-Erling Smørgrav  * @param iter: iterations
325*b7579f77SDag-Erling Smørgrav  * @param salt: salt for nsec3
326*b7579f77SDag-Erling Smørgrav  * @param saltlen: length of salt.
327*b7579f77SDag-Erling Smørgrav  * @param res: result of hash stored here.
328*b7579f77SDag-Erling Smørgrav  * @param max: maximum space for result.
329*b7579f77SDag-Erling Smørgrav  * @return 0 on failure, otherwise bytelength stored.
330*b7579f77SDag-Erling Smørgrav  */
331*b7579f77SDag-Erling Smørgrav size_t nsec3_get_hashed(ldns_buffer* buf, uint8_t* nm, size_t nmlen, int algo,
332*b7579f77SDag-Erling Smørgrav 	size_t iter, uint8_t* salt, size_t saltlen, uint8_t* res, size_t max);
333*b7579f77SDag-Erling Smørgrav 
334*b7579f77SDag-Erling Smørgrav /**
335*b7579f77SDag-Erling Smørgrav  * see if NSEC3 RR contains given type
336*b7579f77SDag-Erling Smørgrav  * @param rrset: NSEC3 rrset
337*b7579f77SDag-Erling Smørgrav  * @param r: RR in rrset
338*b7579f77SDag-Erling Smørgrav  * @param type: in host order to check bit for.
339*b7579f77SDag-Erling Smørgrav  * @return true if bit set, false if not or error.
340*b7579f77SDag-Erling Smørgrav  */
341*b7579f77SDag-Erling Smørgrav int nsec3_has_type(struct ub_packed_rrset_key* rrset, int r, uint16_t type);
342*b7579f77SDag-Erling Smørgrav 
343*b7579f77SDag-Erling Smørgrav /**
344*b7579f77SDag-Erling Smørgrav  * return if nsec3 RR has the optout flag
345*b7579f77SDag-Erling Smørgrav  * @param rrset: NSEC3 rrset
346*b7579f77SDag-Erling Smørgrav  * @param r: RR in rrset
347*b7579f77SDag-Erling Smørgrav  * @return true if optout, false on error or not optout
348*b7579f77SDag-Erling Smørgrav  */
349*b7579f77SDag-Erling Smørgrav int nsec3_has_optout(struct ub_packed_rrset_key* rrset, int r);
350*b7579f77SDag-Erling Smørgrav 
351*b7579f77SDag-Erling Smørgrav /**
352*b7579f77SDag-Erling Smørgrav  * Return nsec3 RR next hashed owner name
353*b7579f77SDag-Erling Smørgrav  * @param rrset: NSEC3 rrset
354*b7579f77SDag-Erling Smørgrav  * @param r: RR in rrset
355*b7579f77SDag-Erling Smørgrav  * @param next: ptr into rdata to next owner hash
356*b7579f77SDag-Erling Smørgrav  * @param nextlen: length of hash.
357*b7579f77SDag-Erling Smørgrav  * @return false on malformed
358*b7579f77SDag-Erling Smørgrav  */
359*b7579f77SDag-Erling Smørgrav int nsec3_get_nextowner(struct ub_packed_rrset_key* rrset, int r,
360*b7579f77SDag-Erling Smørgrav 	uint8_t** next, size_t* nextlen);
361*b7579f77SDag-Erling Smørgrav 
362*b7579f77SDag-Erling Smørgrav /**
363*b7579f77SDag-Erling Smørgrav  * nsec3Covers
364*b7579f77SDag-Erling Smørgrav  * Given a hash and a candidate NSEC3Record, determine if that NSEC3Record
365*b7579f77SDag-Erling Smørgrav  * covers the hash. Covers specifically means that the hash is in between
366*b7579f77SDag-Erling Smørgrav  * the owner and next hashes and does not equal either.
367*b7579f77SDag-Erling Smørgrav  *
368*b7579f77SDag-Erling Smørgrav  * @param zone: the zone name.
369*b7579f77SDag-Erling Smørgrav  * @param hash: the hash of the name
370*b7579f77SDag-Erling Smørgrav  * @param rrset: the rrset of the NSEC3.
371*b7579f77SDag-Erling Smørgrav  * @param rr: which rr in the rrset.
372*b7579f77SDag-Erling Smørgrav  * @param buf: temporary buffer.
373*b7579f77SDag-Erling Smørgrav  * @return true if covers, false if not.
374*b7579f77SDag-Erling Smørgrav  */
375*b7579f77SDag-Erling Smørgrav int nsec3_covers(uint8_t* zone, struct nsec3_cached_hash* hash,
376*b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key* rrset, int rr, ldns_buffer* buf);
377*b7579f77SDag-Erling Smørgrav 
378*b7579f77SDag-Erling Smørgrav #endif /* VALIDATOR_VAL_NSEC3_H */
379