1*b7579f77SDag-Erling Smørgrav /* 2*b7579f77SDag-Erling Smørgrav * validator/val_nsec3.h - validator NSEC3 denial of existance functions. 3*b7579f77SDag-Erling Smørgrav * 4*b7579f77SDag-Erling Smørgrav * Copyright (c) 2007, NLnet Labs. All rights reserved. 5*b7579f77SDag-Erling Smørgrav * 6*b7579f77SDag-Erling Smørgrav * This software is open source. 7*b7579f77SDag-Erling Smørgrav * 8*b7579f77SDag-Erling Smørgrav * Redistribution and use in source and binary forms, with or without 9*b7579f77SDag-Erling Smørgrav * modification, are permitted provided that the following conditions 10*b7579f77SDag-Erling Smørgrav * are met: 11*b7579f77SDag-Erling Smørgrav * 12*b7579f77SDag-Erling Smørgrav * Redistributions of source code must retain the above copyright notice, 13*b7579f77SDag-Erling Smørgrav * this list of conditions and the following disclaimer. 14*b7579f77SDag-Erling Smørgrav * 15*b7579f77SDag-Erling Smørgrav * Redistributions in binary form must reproduce the above copyright notice, 16*b7579f77SDag-Erling Smørgrav * this list of conditions and the following disclaimer in the documentation 17*b7579f77SDag-Erling Smørgrav * and/or other materials provided with the distribution. 18*b7579f77SDag-Erling Smørgrav * 19*b7579f77SDag-Erling Smørgrav * Neither the name of the NLNET LABS nor the names of its contributors may 20*b7579f77SDag-Erling Smørgrav * be used to endorse or promote products derived from this software without 21*b7579f77SDag-Erling Smørgrav * specific prior written permission. 22*b7579f77SDag-Erling Smørgrav * 23*b7579f77SDag-Erling Smørgrav * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24*b7579f77SDag-Erling Smørgrav * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 25*b7579f77SDag-Erling Smørgrav * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 26*b7579f77SDag-Erling Smørgrav * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE 27*b7579f77SDag-Erling Smørgrav * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 28*b7579f77SDag-Erling Smørgrav * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 29*b7579f77SDag-Erling Smørgrav * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 30*b7579f77SDag-Erling Smørgrav * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 31*b7579f77SDag-Erling Smørgrav * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 32*b7579f77SDag-Erling Smørgrav * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 33*b7579f77SDag-Erling Smørgrav * POSSIBILITY OF SUCH DAMAGE. 34*b7579f77SDag-Erling Smørgrav */ 35*b7579f77SDag-Erling Smørgrav 36*b7579f77SDag-Erling Smørgrav /** 37*b7579f77SDag-Erling Smørgrav * \file 38*b7579f77SDag-Erling Smørgrav * 39*b7579f77SDag-Erling Smørgrav * This file contains helper functions for the validator module. 40*b7579f77SDag-Erling Smørgrav * The functions help with NSEC3 checking, the different NSEC3 proofs 41*b7579f77SDag-Erling Smørgrav * for denial of existance, and proofs for presence of types. 42*b7579f77SDag-Erling Smørgrav * 43*b7579f77SDag-Erling Smørgrav * NSEC3 44*b7579f77SDag-Erling Smørgrav * 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 45*b7579f77SDag-Erling Smørgrav * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 46*b7579f77SDag-Erling Smørgrav * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 47*b7579f77SDag-Erling Smørgrav * | Hash Alg. | Flags | Iterations | 48*b7579f77SDag-Erling Smørgrav * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 49*b7579f77SDag-Erling Smørgrav * | Salt Length | Salt / 50*b7579f77SDag-Erling Smørgrav * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 51*b7579f77SDag-Erling Smørgrav * | Hash Length | Next Hashed Owner Name / 52*b7579f77SDag-Erling Smørgrav * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 53*b7579f77SDag-Erling Smørgrav * / Type Bit Maps / 54*b7579f77SDag-Erling Smørgrav * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 55*b7579f77SDag-Erling Smørgrav * 56*b7579f77SDag-Erling Smørgrav * NSEC3PARAM 57*b7579f77SDag-Erling Smørgrav * 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 58*b7579f77SDag-Erling Smørgrav * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 59*b7579f77SDag-Erling Smørgrav * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 60*b7579f77SDag-Erling Smørgrav * | Hash Alg. | Flags | Iterations | 61*b7579f77SDag-Erling Smørgrav * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 62*b7579f77SDag-Erling Smørgrav * | Salt Length | Salt / 63*b7579f77SDag-Erling Smørgrav * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 64*b7579f77SDag-Erling Smørgrav * 65*b7579f77SDag-Erling Smørgrav */ 66*b7579f77SDag-Erling Smørgrav 67*b7579f77SDag-Erling Smørgrav #ifndef VALIDATOR_VAL_NSEC3_H 68*b7579f77SDag-Erling Smørgrav #define VALIDATOR_VAL_NSEC3_H 69*b7579f77SDag-Erling Smørgrav #include "util/rbtree.h" 70*b7579f77SDag-Erling Smørgrav #include "util/data/packed_rrset.h" 71*b7579f77SDag-Erling Smørgrav struct val_env; 72*b7579f77SDag-Erling Smørgrav struct regional; 73*b7579f77SDag-Erling Smørgrav struct module_env; 74*b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key; 75*b7579f77SDag-Erling Smørgrav struct reply_info; 76*b7579f77SDag-Erling Smørgrav struct query_info; 77*b7579f77SDag-Erling Smørgrav struct key_entry_key; 78*b7579f77SDag-Erling Smørgrav 79*b7579f77SDag-Erling Smørgrav /** 80*b7579f77SDag-Erling Smørgrav * 0 1 2 3 4 5 6 7 81*b7579f77SDag-Erling Smørgrav * +-+-+-+-+-+-+-+-+ 82*b7579f77SDag-Erling Smørgrav * | |O| 83*b7579f77SDag-Erling Smørgrav * +-+-+-+-+-+-+-+-+ 84*b7579f77SDag-Erling Smørgrav * The OPT-OUT bit in the NSEC3 flags field. 85*b7579f77SDag-Erling Smørgrav * If enabled, there can be zero or more unsigned delegations in the span. 86*b7579f77SDag-Erling Smørgrav * If disabled, there are zero unsigned delegations in the span. 87*b7579f77SDag-Erling Smørgrav */ 88*b7579f77SDag-Erling Smørgrav #define NSEC3_OPTOUT 0x01 89*b7579f77SDag-Erling Smørgrav /** 90*b7579f77SDag-Erling Smørgrav * The unknown flags in the NSEC3 flags field. 91*b7579f77SDag-Erling Smørgrav * They must be zero, or the NSEC3 is ignored. 92*b7579f77SDag-Erling Smørgrav */ 93*b7579f77SDag-Erling Smørgrav #define NSEC3_UNKNOWN_FLAGS 0xFE 94*b7579f77SDag-Erling Smørgrav 95*b7579f77SDag-Erling Smørgrav /** The SHA1 hash algorithm for NSEC3 */ 96*b7579f77SDag-Erling Smørgrav #define NSEC3_HASH_SHA1 0x01 97*b7579f77SDag-Erling Smørgrav 98*b7579f77SDag-Erling Smørgrav /** 99*b7579f77SDag-Erling Smørgrav * Determine if the set of NSEC3 records provided with a response prove NAME 100*b7579f77SDag-Erling Smørgrav * ERROR. This means that the NSEC3s prove a) the closest encloser exists, 101*b7579f77SDag-Erling Smørgrav * b) the direct child of the closest encloser towards qname doesn't exist, 102*b7579f77SDag-Erling Smørgrav * and c) *.closest encloser does not exist. 103*b7579f77SDag-Erling Smørgrav * 104*b7579f77SDag-Erling Smørgrav * @param env: module environment with temporary region and buffer. 105*b7579f77SDag-Erling Smørgrav * @param ve: validator environment, with iteration count settings. 106*b7579f77SDag-Erling Smørgrav * @param list: array of RRsets, some of which are NSEC3s. 107*b7579f77SDag-Erling Smørgrav * @param num: number of RRsets in the array to examine. 108*b7579f77SDag-Erling Smørgrav * @param qinfo: query that is verified for. 109*b7579f77SDag-Erling Smørgrav * @param kkey: key entry that signed the NSEC3s. 110*b7579f77SDag-Erling Smørgrav * @return: 111*b7579f77SDag-Erling Smørgrav * sec_status SECURE of the Name Error is proven by the NSEC3 RRs, 112*b7579f77SDag-Erling Smørgrav * BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored. 113*b7579f77SDag-Erling Smørgrav */ 114*b7579f77SDag-Erling Smørgrav enum sec_status 115*b7579f77SDag-Erling Smørgrav nsec3_prove_nameerror(struct module_env* env, struct val_env* ve, 116*b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key** list, size_t num, 117*b7579f77SDag-Erling Smørgrav struct query_info* qinfo, struct key_entry_key* kkey); 118*b7579f77SDag-Erling Smørgrav 119*b7579f77SDag-Erling Smørgrav /** 120*b7579f77SDag-Erling Smørgrav * Determine if the NSEC3s provided in a response prove the NOERROR/NODATA 121*b7579f77SDag-Erling Smørgrav * status. There are a number of different variants to this: 122*b7579f77SDag-Erling Smørgrav * 123*b7579f77SDag-Erling Smørgrav * 1) Normal NODATA -- qname is matched to an NSEC3 record, type is not 124*b7579f77SDag-Erling Smørgrav * present. 125*b7579f77SDag-Erling Smørgrav * 126*b7579f77SDag-Erling Smørgrav * 2) ENT NODATA -- because there must be NSEC3 record for 127*b7579f77SDag-Erling Smørgrav * empty-non-terminals, this is the same as #1. 128*b7579f77SDag-Erling Smørgrav * 129*b7579f77SDag-Erling Smørgrav * 3) NSEC3 ownername NODATA -- qname matched an existing, lone NSEC3 130*b7579f77SDag-Erling Smørgrav * ownername, but qtype was not NSEC3. NOTE: as of nsec-05, this case no 131*b7579f77SDag-Erling Smørgrav * longer exists. 132*b7579f77SDag-Erling Smørgrav * 133*b7579f77SDag-Erling Smørgrav * 4) Wildcard NODATA -- A wildcard matched the name, but not the type. 134*b7579f77SDag-Erling Smørgrav * 135*b7579f77SDag-Erling Smørgrav * 5) Opt-In DS NODATA -- the qname is covered by an opt-in span and qtype == 136*b7579f77SDag-Erling Smørgrav * DS. (or maybe some future record with the same parent-side-only property) 137*b7579f77SDag-Erling Smørgrav * 138*b7579f77SDag-Erling Smørgrav * @param env: module environment with temporary region and buffer. 139*b7579f77SDag-Erling Smørgrav * @param ve: validator environment, with iteration count settings. 140*b7579f77SDag-Erling Smørgrav * @param list: array of RRsets, some of which are NSEC3s. 141*b7579f77SDag-Erling Smørgrav * @param num: number of RRsets in the array to examine. 142*b7579f77SDag-Erling Smørgrav * @param qinfo: query that is verified for. 143*b7579f77SDag-Erling Smørgrav * @param kkey: key entry that signed the NSEC3s. 144*b7579f77SDag-Erling Smørgrav * @return: 145*b7579f77SDag-Erling Smørgrav * sec_status SECURE of the proposition is proven by the NSEC3 RRs, 146*b7579f77SDag-Erling Smørgrav * BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored. 147*b7579f77SDag-Erling Smørgrav */ 148*b7579f77SDag-Erling Smørgrav enum sec_status 149*b7579f77SDag-Erling Smørgrav nsec3_prove_nodata(struct module_env* env, struct val_env* ve, 150*b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key** list, size_t num, 151*b7579f77SDag-Erling Smørgrav struct query_info* qinfo, struct key_entry_key* kkey); 152*b7579f77SDag-Erling Smørgrav 153*b7579f77SDag-Erling Smørgrav 154*b7579f77SDag-Erling Smørgrav /** 155*b7579f77SDag-Erling Smørgrav * Prove that a positive wildcard match was appropriate (no direct match 156*b7579f77SDag-Erling Smørgrav * RRset). 157*b7579f77SDag-Erling Smørgrav * 158*b7579f77SDag-Erling Smørgrav * @param env: module environment with temporary region and buffer. 159*b7579f77SDag-Erling Smørgrav * @param ve: validator environment, with iteration count settings. 160*b7579f77SDag-Erling Smørgrav * @param list: array of RRsets, some of which are NSEC3s. 161*b7579f77SDag-Erling Smørgrav * @param num: number of RRsets in the array to examine. 162*b7579f77SDag-Erling Smørgrav * @param qinfo: query that is verified for. 163*b7579f77SDag-Erling Smørgrav * @param kkey: key entry that signed the NSEC3s. 164*b7579f77SDag-Erling Smørgrav * @param wc: The purported wildcard that matched. This is the wildcard name 165*b7579f77SDag-Erling Smørgrav * as *.wildcard.name., with the *. label already removed. 166*b7579f77SDag-Erling Smørgrav * @return: 167*b7579f77SDag-Erling Smørgrav * sec_status SECURE of the proposition is proven by the NSEC3 RRs, 168*b7579f77SDag-Erling Smørgrav * BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored. 169*b7579f77SDag-Erling Smørgrav */ 170*b7579f77SDag-Erling Smørgrav enum sec_status 171*b7579f77SDag-Erling Smørgrav nsec3_prove_wildcard(struct module_env* env, struct val_env* ve, 172*b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key** list, size_t num, 173*b7579f77SDag-Erling Smørgrav struct query_info* qinfo, struct key_entry_key* kkey, uint8_t* wc); 174*b7579f77SDag-Erling Smørgrav 175*b7579f77SDag-Erling Smørgrav /** 176*b7579f77SDag-Erling Smørgrav * Prove that a DS response either had no DS, or wasn't a delegation point. 177*b7579f77SDag-Erling Smørgrav * 178*b7579f77SDag-Erling Smørgrav * Fundamentally there are two cases here: normal NODATA and Opt-In NODATA. 179*b7579f77SDag-Erling Smørgrav * 180*b7579f77SDag-Erling Smørgrav * @param env: module environment with temporary region and buffer. 181*b7579f77SDag-Erling Smørgrav * @param ve: validator environment, with iteration count settings. 182*b7579f77SDag-Erling Smørgrav * @param list: array of RRsets, some of which are NSEC3s. 183*b7579f77SDag-Erling Smørgrav * @param num: number of RRsets in the array to examine. 184*b7579f77SDag-Erling Smørgrav * @param qinfo: query that is verified for. 185*b7579f77SDag-Erling Smørgrav * @param kkey: key entry that signed the NSEC3s. 186*b7579f77SDag-Erling Smørgrav * @param reason: string for bogus result. 187*b7579f77SDag-Erling Smørgrav * @return: 188*b7579f77SDag-Erling Smørgrav * sec_status SECURE of the proposition is proven by the NSEC3 RRs, 189*b7579f77SDag-Erling Smørgrav * BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored. 190*b7579f77SDag-Erling Smørgrav * or if there was no DS in an insecure (i.e., opt-in) way, 191*b7579f77SDag-Erling Smørgrav * INDETERMINATE if it was clear that this wasn't a delegation point. 192*b7579f77SDag-Erling Smørgrav */ 193*b7579f77SDag-Erling Smørgrav enum sec_status 194*b7579f77SDag-Erling Smørgrav nsec3_prove_nods(struct module_env* env, struct val_env* ve, 195*b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key** list, size_t num, 196*b7579f77SDag-Erling Smørgrav struct query_info* qinfo, struct key_entry_key* kkey, char** reason); 197*b7579f77SDag-Erling Smørgrav 198*b7579f77SDag-Erling Smørgrav /** 199*b7579f77SDag-Erling Smørgrav * Prove NXDOMAIN or NODATA. 200*b7579f77SDag-Erling Smørgrav * 201*b7579f77SDag-Erling Smørgrav * @param env: module environment with temporary region and buffer. 202*b7579f77SDag-Erling Smørgrav * @param ve: validator environment, with iteration count settings. 203*b7579f77SDag-Erling Smørgrav * @param list: array of RRsets, some of which are NSEC3s. 204*b7579f77SDag-Erling Smørgrav * @param num: number of RRsets in the array to examine. 205*b7579f77SDag-Erling Smørgrav * @param qinfo: query that is verified for. 206*b7579f77SDag-Erling Smørgrav * @param kkey: key entry that signed the NSEC3s. 207*b7579f77SDag-Erling Smørgrav * @param nodata: if return value is secure, this indicates if nodata or 208*b7579f77SDag-Erling Smørgrav * nxdomain was proven. 209*b7579f77SDag-Erling Smørgrav * @return: 210*b7579f77SDag-Erling Smørgrav * sec_status SECURE of the proposition is proven by the NSEC3 RRs, 211*b7579f77SDag-Erling Smørgrav * BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored. 212*b7579f77SDag-Erling Smørgrav */ 213*b7579f77SDag-Erling Smørgrav enum sec_status 214*b7579f77SDag-Erling Smørgrav nsec3_prove_nxornodata(struct module_env* env, struct val_env* ve, 215*b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key** list, size_t num, 216*b7579f77SDag-Erling Smørgrav struct query_info* qinfo, struct key_entry_key* kkey, int* nodata); 217*b7579f77SDag-Erling Smørgrav 218*b7579f77SDag-Erling Smørgrav /** 219*b7579f77SDag-Erling Smørgrav * The NSEC3 hash result storage. 220*b7579f77SDag-Erling Smørgrav * Consists of an rbtree, with these nodes in it. 221*b7579f77SDag-Erling Smørgrav * The nodes detail how a set of parameters (from nsec3 rr) plus 222*b7579f77SDag-Erling Smørgrav * a dname result in a hash. 223*b7579f77SDag-Erling Smørgrav */ 224*b7579f77SDag-Erling Smørgrav struct nsec3_cached_hash { 225*b7579f77SDag-Erling Smørgrav /** rbtree node, key is this structure */ 226*b7579f77SDag-Erling Smørgrav rbnode_t node; 227*b7579f77SDag-Erling Smørgrav /** where are the parameters for conversion, in this rrset data */ 228*b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* nsec3; 229*b7579f77SDag-Erling Smørgrav /** where are the parameters for conversion, this RR number in data */ 230*b7579f77SDag-Erling Smørgrav int rr; 231*b7579f77SDag-Erling Smørgrav /** the name to convert */ 232*b7579f77SDag-Erling Smørgrav uint8_t* dname; 233*b7579f77SDag-Erling Smørgrav /** length of the dname */ 234*b7579f77SDag-Erling Smørgrav size_t dname_len; 235*b7579f77SDag-Erling Smørgrav /** the hash result (not base32 encoded) */ 236*b7579f77SDag-Erling Smørgrav uint8_t* hash; 237*b7579f77SDag-Erling Smørgrav /** length of hash in bytes */ 238*b7579f77SDag-Erling Smørgrav size_t hash_len; 239*b7579f77SDag-Erling Smørgrav /** the hash result in base32 encoding */ 240*b7579f77SDag-Erling Smørgrav uint8_t* b32; 241*b7579f77SDag-Erling Smørgrav /** length of base32 encoding (as a label) */ 242*b7579f77SDag-Erling Smørgrav size_t b32_len; 243*b7579f77SDag-Erling Smørgrav }; 244*b7579f77SDag-Erling Smørgrav 245*b7579f77SDag-Erling Smørgrav /** 246*b7579f77SDag-Erling Smørgrav * Rbtree for hash cache comparison function. 247*b7579f77SDag-Erling Smørgrav * @param c1: key 1. 248*b7579f77SDag-Erling Smørgrav * @param c2: key 2. 249*b7579f77SDag-Erling Smørgrav * @return: comparison code, -1, 0, 1, of the keys. 250*b7579f77SDag-Erling Smørgrav */ 251*b7579f77SDag-Erling Smørgrav int nsec3_hash_cmp(const void* c1, const void* c2); 252*b7579f77SDag-Erling Smørgrav 253*b7579f77SDag-Erling Smørgrav /** 254*b7579f77SDag-Erling Smørgrav * Obtain the hash of an owner name. 255*b7579f77SDag-Erling Smørgrav * Used internally by the nsec3 proof functions in this file. 256*b7579f77SDag-Erling Smørgrav * published to enable unit testing of hash algorithms and cache. 257*b7579f77SDag-Erling Smørgrav * 258*b7579f77SDag-Erling Smørgrav * @param table: the cache table. Must be inited at start. 259*b7579f77SDag-Erling Smørgrav * @param region: scratch region to use for allocation. 260*b7579f77SDag-Erling Smørgrav * This region holds the tree, if you wipe the region, reinit the tree. 261*b7579f77SDag-Erling Smørgrav * @param buf: temporary buffer. 262*b7579f77SDag-Erling Smørgrav * @param nsec3: the rrset with parameters 263*b7579f77SDag-Erling Smørgrav * @param rr: rr number from d that has the NSEC3 parameters to hash to. 264*b7579f77SDag-Erling Smørgrav * @param dname: name to hash 265*b7579f77SDag-Erling Smørgrav * This pointer is used inside the tree, assumed region-alloced. 266*b7579f77SDag-Erling Smørgrav * @param dname_len: the length of the name. 267*b7579f77SDag-Erling Smørgrav * @param hash: the hash node is returned on success. 268*b7579f77SDag-Erling Smørgrav * @return: 269*b7579f77SDag-Erling Smørgrav * 1 on success, either from cache or newly hashed hash is returned. 270*b7579f77SDag-Erling Smørgrav * 0 on a malloc failure. 271*b7579f77SDag-Erling Smørgrav * -1 if the NSEC3 rr was badly formatted (i.e. formerr). 272*b7579f77SDag-Erling Smørgrav */ 273*b7579f77SDag-Erling Smørgrav int nsec3_hash_name(rbtree_t* table, struct regional* region, ldns_buffer* buf, 274*b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* nsec3, int rr, uint8_t* dname, 275*b7579f77SDag-Erling Smørgrav size_t dname_len, struct nsec3_cached_hash** hash); 276*b7579f77SDag-Erling Smørgrav 277*b7579f77SDag-Erling Smørgrav /** 278*b7579f77SDag-Erling Smørgrav * Get next owner name, converted to base32 encoding and with the 279*b7579f77SDag-Erling Smørgrav * zone name (taken from the nsec3 owner name) appended. 280*b7579f77SDag-Erling Smørgrav * @param rrset: the NSEC3 rrset. 281*b7579f77SDag-Erling Smørgrav * @param r: the rr num of the nsec3 in the rrset. 282*b7579f77SDag-Erling Smørgrav * @param buf: buffer to store name in 283*b7579f77SDag-Erling Smørgrav * @param max: size of buffer. 284*b7579f77SDag-Erling Smørgrav * @return length of name on success. 0 on failure (buffer too short or 285*b7579f77SDag-Erling Smørgrav * bad format nsec3 record). 286*b7579f77SDag-Erling Smørgrav */ 287*b7579f77SDag-Erling Smørgrav size_t nsec3_get_nextowner_b32(struct ub_packed_rrset_key* rrset, int r, 288*b7579f77SDag-Erling Smørgrav uint8_t* buf, size_t max); 289*b7579f77SDag-Erling Smørgrav 290*b7579f77SDag-Erling Smørgrav /** 291*b7579f77SDag-Erling Smørgrav * Convert hash into base32 encoding and with the 292*b7579f77SDag-Erling Smørgrav * zone name appended. 293*b7579f77SDag-Erling Smørgrav * @param hash: hashed buffer 294*b7579f77SDag-Erling Smørgrav * @param hashlen: length of hash 295*b7579f77SDag-Erling Smørgrav * @param zone: name of zone 296*b7579f77SDag-Erling Smørgrav * @param zonelen: length of zonename. 297*b7579f77SDag-Erling Smørgrav * @param buf: buffer to store name in 298*b7579f77SDag-Erling Smørgrav * @param max: size of buffer. 299*b7579f77SDag-Erling Smørgrav * @return length of name on success. 0 on failure (buffer too short or 300*b7579f77SDag-Erling Smørgrav * bad format nsec3 record). 301*b7579f77SDag-Erling Smørgrav */ 302*b7579f77SDag-Erling Smørgrav size_t nsec3_hash_to_b32(uint8_t* hash, size_t hashlen, uint8_t* zone, 303*b7579f77SDag-Erling Smørgrav size_t zonelen, uint8_t* buf, size_t max); 304*b7579f77SDag-Erling Smørgrav 305*b7579f77SDag-Erling Smørgrav /** 306*b7579f77SDag-Erling Smørgrav * Get NSEC3 parameters out of rr. 307*b7579f77SDag-Erling Smørgrav * @param rrset: the NSEC3 rrset. 308*b7579f77SDag-Erling Smørgrav * @param r: the rr num of the nsec3 in the rrset. 309*b7579f77SDag-Erling Smørgrav * @param algo: nsec3 hash algo. 310*b7579f77SDag-Erling Smørgrav * @param iter: iteration count. 311*b7579f77SDag-Erling Smørgrav * @param salt: ptr to salt inside rdata. 312*b7579f77SDag-Erling Smørgrav * @param saltlen: length of salt. 313*b7579f77SDag-Erling Smørgrav * @return 0 if bad formatted, unknown nsec3 hash algo, or unknown flags set. 314*b7579f77SDag-Erling Smørgrav */ 315*b7579f77SDag-Erling Smørgrav int nsec3_get_params(struct ub_packed_rrset_key* rrset, int r, 316*b7579f77SDag-Erling Smørgrav int* algo, size_t* iter, uint8_t** salt, size_t* saltlen); 317*b7579f77SDag-Erling Smørgrav 318*b7579f77SDag-Erling Smørgrav /** 319*b7579f77SDag-Erling Smørgrav * Get NSEC3 hashed in a buffer 320*b7579f77SDag-Erling Smørgrav * @param buf: buffer for temp use. 321*b7579f77SDag-Erling Smørgrav * @param nm: name to hash 322*b7579f77SDag-Erling Smørgrav * @param nmlen: length of nm. 323*b7579f77SDag-Erling Smørgrav * @param algo: algo to use, must be known. 324*b7579f77SDag-Erling Smørgrav * @param iter: iterations 325*b7579f77SDag-Erling Smørgrav * @param salt: salt for nsec3 326*b7579f77SDag-Erling Smørgrav * @param saltlen: length of salt. 327*b7579f77SDag-Erling Smørgrav * @param res: result of hash stored here. 328*b7579f77SDag-Erling Smørgrav * @param max: maximum space for result. 329*b7579f77SDag-Erling Smørgrav * @return 0 on failure, otherwise bytelength stored. 330*b7579f77SDag-Erling Smørgrav */ 331*b7579f77SDag-Erling Smørgrav size_t nsec3_get_hashed(ldns_buffer* buf, uint8_t* nm, size_t nmlen, int algo, 332*b7579f77SDag-Erling Smørgrav size_t iter, uint8_t* salt, size_t saltlen, uint8_t* res, size_t max); 333*b7579f77SDag-Erling Smørgrav 334*b7579f77SDag-Erling Smørgrav /** 335*b7579f77SDag-Erling Smørgrav * see if NSEC3 RR contains given type 336*b7579f77SDag-Erling Smørgrav * @param rrset: NSEC3 rrset 337*b7579f77SDag-Erling Smørgrav * @param r: RR in rrset 338*b7579f77SDag-Erling Smørgrav * @param type: in host order to check bit for. 339*b7579f77SDag-Erling Smørgrav * @return true if bit set, false if not or error. 340*b7579f77SDag-Erling Smørgrav */ 341*b7579f77SDag-Erling Smørgrav int nsec3_has_type(struct ub_packed_rrset_key* rrset, int r, uint16_t type); 342*b7579f77SDag-Erling Smørgrav 343*b7579f77SDag-Erling Smørgrav /** 344*b7579f77SDag-Erling Smørgrav * return if nsec3 RR has the optout flag 345*b7579f77SDag-Erling Smørgrav * @param rrset: NSEC3 rrset 346*b7579f77SDag-Erling Smørgrav * @param r: RR in rrset 347*b7579f77SDag-Erling Smørgrav * @return true if optout, false on error or not optout 348*b7579f77SDag-Erling Smørgrav */ 349*b7579f77SDag-Erling Smørgrav int nsec3_has_optout(struct ub_packed_rrset_key* rrset, int r); 350*b7579f77SDag-Erling Smørgrav 351*b7579f77SDag-Erling Smørgrav /** 352*b7579f77SDag-Erling Smørgrav * Return nsec3 RR next hashed owner name 353*b7579f77SDag-Erling Smørgrav * @param rrset: NSEC3 rrset 354*b7579f77SDag-Erling Smørgrav * @param r: RR in rrset 355*b7579f77SDag-Erling Smørgrav * @param next: ptr into rdata to next owner hash 356*b7579f77SDag-Erling Smørgrav * @param nextlen: length of hash. 357*b7579f77SDag-Erling Smørgrav * @return false on malformed 358*b7579f77SDag-Erling Smørgrav */ 359*b7579f77SDag-Erling Smørgrav int nsec3_get_nextowner(struct ub_packed_rrset_key* rrset, int r, 360*b7579f77SDag-Erling Smørgrav uint8_t** next, size_t* nextlen); 361*b7579f77SDag-Erling Smørgrav 362*b7579f77SDag-Erling Smørgrav /** 363*b7579f77SDag-Erling Smørgrav * nsec3Covers 364*b7579f77SDag-Erling Smørgrav * Given a hash and a candidate NSEC3Record, determine if that NSEC3Record 365*b7579f77SDag-Erling Smørgrav * covers the hash. Covers specifically means that the hash is in between 366*b7579f77SDag-Erling Smørgrav * the owner and next hashes and does not equal either. 367*b7579f77SDag-Erling Smørgrav * 368*b7579f77SDag-Erling Smørgrav * @param zone: the zone name. 369*b7579f77SDag-Erling Smørgrav * @param hash: the hash of the name 370*b7579f77SDag-Erling Smørgrav * @param rrset: the rrset of the NSEC3. 371*b7579f77SDag-Erling Smørgrav * @param rr: which rr in the rrset. 372*b7579f77SDag-Erling Smørgrav * @param buf: temporary buffer. 373*b7579f77SDag-Erling Smørgrav * @return true if covers, false if not. 374*b7579f77SDag-Erling Smørgrav */ 375*b7579f77SDag-Erling Smørgrav int nsec3_covers(uint8_t* zone, struct nsec3_cached_hash* hash, 376*b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* rrset, int rr, ldns_buffer* buf); 377*b7579f77SDag-Erling Smørgrav 378*b7579f77SDag-Erling Smørgrav #endif /* VALIDATOR_VAL_NSEC3_H */ 379