1238106Sdes/* 2292206Sdes * validator/val_nsec3.h - validator NSEC3 denial of existence functions. 3238106Sdes * 4238106Sdes * Copyright (c) 2007, NLnet Labs. All rights reserved. 5238106Sdes * 6238106Sdes * This software is open source. 7238106Sdes * 8238106Sdes * Redistribution and use in source and binary forms, with or without 9238106Sdes * modification, are permitted provided that the following conditions 10238106Sdes * are met: 11238106Sdes * 12238106Sdes * Redistributions of source code must retain the above copyright notice, 13238106Sdes * this list of conditions and the following disclaimer. 14238106Sdes * 15238106Sdes * Redistributions in binary form must reproduce the above copyright notice, 16238106Sdes * this list of conditions and the following disclaimer in the documentation 17238106Sdes * and/or other materials provided with the distribution. 18238106Sdes * 19238106Sdes * Neither the name of the NLNET LABS nor the names of its contributors may 20238106Sdes * be used to endorse or promote products derived from this software without 21238106Sdes * specific prior written permission. 22238106Sdes * 23238106Sdes * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24266114Sdes * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25266114Sdes * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26266114Sdes * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27266114Sdes * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28266114Sdes * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29266114Sdes * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30266114Sdes * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31266114Sdes * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32266114Sdes * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33266114Sdes * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34238106Sdes */ 35238106Sdes 36238106Sdes/** 37238106Sdes * \file 38238106Sdes * 39238106Sdes * This file contains helper functions for the validator module. 40238106Sdes * The functions help with NSEC3 checking, the different NSEC3 proofs 41292206Sdes * for denial of existence, and proofs for presence of types. 42238106Sdes * 43238106Sdes * NSEC3 44238106Sdes * 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 45238106Sdes * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 46238106Sdes * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 47238106Sdes * | Hash Alg. | Flags | Iterations | 48238106Sdes * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 49238106Sdes * | Salt Length | Salt / 50238106Sdes * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 51238106Sdes * | Hash Length | Next Hashed Owner Name / 52238106Sdes * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 53238106Sdes * / Type Bit Maps / 54238106Sdes * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 55238106Sdes * 56238106Sdes * NSEC3PARAM 57238106Sdes * 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 58238106Sdes * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 59238106Sdes * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 60238106Sdes * | Hash Alg. | Flags | Iterations | 61238106Sdes * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 62238106Sdes * | Salt Length | Salt / 63238106Sdes * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 64238106Sdes * 65238106Sdes */ 66238106Sdes 67238106Sdes#ifndef VALIDATOR_VAL_NSEC3_H 68238106Sdes#define VALIDATOR_VAL_NSEC3_H 69238106Sdes#include "util/rbtree.h" 70238106Sdes#include "util/data/packed_rrset.h" 71238106Sdesstruct val_env; 72238106Sdesstruct regional; 73238106Sdesstruct module_env; 74356345Scystruct module_qstate; 75238106Sdesstruct ub_packed_rrset_key; 76238106Sdesstruct reply_info; 77238106Sdesstruct query_info; 78238106Sdesstruct key_entry_key; 79266114Sdesstruct sldns_buffer; 80238106Sdes 81238106Sdes/** 82238106Sdes * 0 1 2 3 4 5 6 7 83238106Sdes * +-+-+-+-+-+-+-+-+ 84238106Sdes * | |O| 85238106Sdes * +-+-+-+-+-+-+-+-+ 86238106Sdes * The OPT-OUT bit in the NSEC3 flags field. 87238106Sdes * If enabled, there can be zero or more unsigned delegations in the span. 88238106Sdes * If disabled, there are zero unsigned delegations in the span. 89238106Sdes */ 90238106Sdes#define NSEC3_OPTOUT 0x01 91238106Sdes/** 92238106Sdes * The unknown flags in the NSEC3 flags field. 93238106Sdes * They must be zero, or the NSEC3 is ignored. 94238106Sdes */ 95238106Sdes#define NSEC3_UNKNOWN_FLAGS 0xFE 96238106Sdes 97238106Sdes/** The SHA1 hash algorithm for NSEC3 */ 98238106Sdes#define NSEC3_HASH_SHA1 0x01 99238106Sdes 100238106Sdes/** 101238106Sdes * Determine if the set of NSEC3 records provided with a response prove NAME 102238106Sdes * ERROR. This means that the NSEC3s prove a) the closest encloser exists, 103238106Sdes * b) the direct child of the closest encloser towards qname doesn't exist, 104238106Sdes * and c) *.closest encloser does not exist. 105238106Sdes * 106238106Sdes * @param env: module environment with temporary region and buffer. 107238106Sdes * @param ve: validator environment, with iteration count settings. 108238106Sdes * @param list: array of RRsets, some of which are NSEC3s. 109238106Sdes * @param num: number of RRsets in the array to examine. 110238106Sdes * @param qinfo: query that is verified for. 111238106Sdes * @param kkey: key entry that signed the NSEC3s. 112238106Sdes * @return: 113238106Sdes * sec_status SECURE of the Name Error is proven by the NSEC3 RRs, 114238106Sdes * BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored. 115238106Sdes */ 116238106Sdesenum sec_status 117238106Sdesnsec3_prove_nameerror(struct module_env* env, struct val_env* ve, 118238106Sdes struct ub_packed_rrset_key** list, size_t num, 119238106Sdes struct query_info* qinfo, struct key_entry_key* kkey); 120238106Sdes 121238106Sdes/** 122238106Sdes * Determine if the NSEC3s provided in a response prove the NOERROR/NODATA 123238106Sdes * status. There are a number of different variants to this: 124238106Sdes * 125238106Sdes * 1) Normal NODATA -- qname is matched to an NSEC3 record, type is not 126238106Sdes * present. 127238106Sdes * 128238106Sdes * 2) ENT NODATA -- because there must be NSEC3 record for 129238106Sdes * empty-non-terminals, this is the same as #1. 130238106Sdes * 131238106Sdes * 3) NSEC3 ownername NODATA -- qname matched an existing, lone NSEC3 132238106Sdes * ownername, but qtype was not NSEC3. NOTE: as of nsec-05, this case no 133238106Sdes * longer exists. 134238106Sdes * 135238106Sdes * 4) Wildcard NODATA -- A wildcard matched the name, but not the type. 136238106Sdes * 137238106Sdes * 5) Opt-In DS NODATA -- the qname is covered by an opt-in span and qtype == 138238106Sdes * DS. (or maybe some future record with the same parent-side-only property) 139238106Sdes * 140238106Sdes * @param env: module environment with temporary region and buffer. 141238106Sdes * @param ve: validator environment, with iteration count settings. 142238106Sdes * @param list: array of RRsets, some of which are NSEC3s. 143238106Sdes * @param num: number of RRsets in the array to examine. 144238106Sdes * @param qinfo: query that is verified for. 145238106Sdes * @param kkey: key entry that signed the NSEC3s. 146238106Sdes * @return: 147238106Sdes * sec_status SECURE of the proposition is proven by the NSEC3 RRs, 148238106Sdes * BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored. 149238106Sdes */ 150238106Sdesenum sec_status 151238106Sdesnsec3_prove_nodata(struct module_env* env, struct val_env* ve, 152238106Sdes struct ub_packed_rrset_key** list, size_t num, 153238106Sdes struct query_info* qinfo, struct key_entry_key* kkey); 154238106Sdes 155238106Sdes 156238106Sdes/** 157238106Sdes * Prove that a positive wildcard match was appropriate (no direct match 158238106Sdes * RRset). 159238106Sdes * 160238106Sdes * @param env: module environment with temporary region and buffer. 161238106Sdes * @param ve: validator environment, with iteration count settings. 162238106Sdes * @param list: array of RRsets, some of which are NSEC3s. 163238106Sdes * @param num: number of RRsets in the array to examine. 164238106Sdes * @param qinfo: query that is verified for. 165238106Sdes * @param kkey: key entry that signed the NSEC3s. 166238106Sdes * @param wc: The purported wildcard that matched. This is the wildcard name 167238106Sdes * as *.wildcard.name., with the *. label already removed. 168238106Sdes * @return: 169238106Sdes * sec_status SECURE of the proposition is proven by the NSEC3 RRs, 170238106Sdes * BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored. 171238106Sdes */ 172238106Sdesenum sec_status 173238106Sdesnsec3_prove_wildcard(struct module_env* env, struct val_env* ve, 174238106Sdes struct ub_packed_rrset_key** list, size_t num, 175238106Sdes struct query_info* qinfo, struct key_entry_key* kkey, uint8_t* wc); 176238106Sdes 177238106Sdes/** 178238106Sdes * Prove that a DS response either had no DS, or wasn't a delegation point. 179238106Sdes * 180238106Sdes * Fundamentally there are two cases here: normal NODATA and Opt-In NODATA. 181238106Sdes * 182238106Sdes * @param env: module environment with temporary region and buffer. 183238106Sdes * @param ve: validator environment, with iteration count settings. 184238106Sdes * @param list: array of RRsets, some of which are NSEC3s. 185238106Sdes * @param num: number of RRsets in the array to examine. 186238106Sdes * @param qinfo: query that is verified for. 187238106Sdes * @param kkey: key entry that signed the NSEC3s. 188238106Sdes * @param reason: string for bogus result. 189356345Scy * @param qstate: qstate with region. 190238106Sdes * @return: 191238106Sdes * sec_status SECURE of the proposition is proven by the NSEC3 RRs, 192238106Sdes * BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored. 193238106Sdes * or if there was no DS in an insecure (i.e., opt-in) way, 194238106Sdes * INDETERMINATE if it was clear that this wasn't a delegation point. 195238106Sdes */ 196238106Sdesenum sec_status 197238106Sdesnsec3_prove_nods(struct module_env* env, struct val_env* ve, 198238106Sdes struct ub_packed_rrset_key** list, size_t num, 199356345Scy struct query_info* qinfo, struct key_entry_key* kkey, char** reason, 200356345Scy struct module_qstate* qstate); 201238106Sdes 202238106Sdes/** 203238106Sdes * Prove NXDOMAIN or NODATA. 204238106Sdes * 205238106Sdes * @param env: module environment with temporary region and buffer. 206238106Sdes * @param ve: validator environment, with iteration count settings. 207238106Sdes * @param list: array of RRsets, some of which are NSEC3s. 208238106Sdes * @param num: number of RRsets in the array to examine. 209238106Sdes * @param qinfo: query that is verified for. 210238106Sdes * @param kkey: key entry that signed the NSEC3s. 211238106Sdes * @param nodata: if return value is secure, this indicates if nodata or 212238106Sdes * nxdomain was proven. 213238106Sdes * @return: 214238106Sdes * sec_status SECURE of the proposition is proven by the NSEC3 RRs, 215238106Sdes * BOGUS if not, INSECURE if all of the NSEC3s could be validly ignored. 216238106Sdes */ 217238106Sdesenum sec_status 218238106Sdesnsec3_prove_nxornodata(struct module_env* env, struct val_env* ve, 219238106Sdes struct ub_packed_rrset_key** list, size_t num, 220238106Sdes struct query_info* qinfo, struct key_entry_key* kkey, int* nodata); 221238106Sdes 222238106Sdes/** 223238106Sdes * The NSEC3 hash result storage. 224238106Sdes * Consists of an rbtree, with these nodes in it. 225238106Sdes * The nodes detail how a set of parameters (from nsec3 rr) plus 226238106Sdes * a dname result in a hash. 227238106Sdes */ 228238106Sdesstruct nsec3_cached_hash { 229238106Sdes /** rbtree node, key is this structure */ 230356345Scy rbnode_type node; 231238106Sdes /** where are the parameters for conversion, in this rrset data */ 232238106Sdes struct ub_packed_rrset_key* nsec3; 233238106Sdes /** where are the parameters for conversion, this RR number in data */ 234238106Sdes int rr; 235238106Sdes /** the name to convert */ 236238106Sdes uint8_t* dname; 237238106Sdes /** length of the dname */ 238238106Sdes size_t dname_len; 239238106Sdes /** the hash result (not base32 encoded) */ 240238106Sdes uint8_t* hash; 241238106Sdes /** length of hash in bytes */ 242238106Sdes size_t hash_len; 243238106Sdes /** the hash result in base32 encoding */ 244238106Sdes uint8_t* b32; 245238106Sdes /** length of base32 encoding (as a label) */ 246238106Sdes size_t b32_len; 247238106Sdes}; 248238106Sdes 249238106Sdes/** 250238106Sdes * Rbtree for hash cache comparison function. 251238106Sdes * @param c1: key 1. 252238106Sdes * @param c2: key 2. 253238106Sdes * @return: comparison code, -1, 0, 1, of the keys. 254238106Sdes */ 255238106Sdesint nsec3_hash_cmp(const void* c1, const void* c2); 256238106Sdes 257238106Sdes/** 258238106Sdes * Obtain the hash of an owner name. 259238106Sdes * Used internally by the nsec3 proof functions in this file. 260238106Sdes * published to enable unit testing of hash algorithms and cache. 261238106Sdes * 262292206Sdes * @param table: the cache table. Must be initialised at start. 263238106Sdes * @param region: scratch region to use for allocation. 264238106Sdes * This region holds the tree, if you wipe the region, reinit the tree. 265238106Sdes * @param buf: temporary buffer. 266238106Sdes * @param nsec3: the rrset with parameters 267238106Sdes * @param rr: rr number from d that has the NSEC3 parameters to hash to. 268238106Sdes * @param dname: name to hash 269238106Sdes * This pointer is used inside the tree, assumed region-alloced. 270238106Sdes * @param dname_len: the length of the name. 271238106Sdes * @param hash: the hash node is returned on success. 272238106Sdes * @return: 273238106Sdes * 1 on success, either from cache or newly hashed hash is returned. 274238106Sdes * 0 on a malloc failure. 275238106Sdes * -1 if the NSEC3 rr was badly formatted (i.e. formerr). 276238106Sdes */ 277356345Scyint nsec3_hash_name(rbtree_type* table, struct regional* region, 278266114Sdes struct sldns_buffer* buf, struct ub_packed_rrset_key* nsec3, int rr, 279266114Sdes uint8_t* dname, size_t dname_len, struct nsec3_cached_hash** hash); 280238106Sdes 281238106Sdes/** 282238106Sdes * Get next owner name, converted to base32 encoding and with the 283238106Sdes * zone name (taken from the nsec3 owner name) appended. 284238106Sdes * @param rrset: the NSEC3 rrset. 285238106Sdes * @param r: the rr num of the nsec3 in the rrset. 286238106Sdes * @param buf: buffer to store name in 287238106Sdes * @param max: size of buffer. 288238106Sdes * @return length of name on success. 0 on failure (buffer too short or 289238106Sdes * bad format nsec3 record). 290238106Sdes */ 291238106Sdessize_t nsec3_get_nextowner_b32(struct ub_packed_rrset_key* rrset, int r, 292238106Sdes uint8_t* buf, size_t max); 293238106Sdes 294238106Sdes/** 295238106Sdes * Convert hash into base32 encoding and with the 296238106Sdes * zone name appended. 297238106Sdes * @param hash: hashed buffer 298238106Sdes * @param hashlen: length of hash 299238106Sdes * @param zone: name of zone 300238106Sdes * @param zonelen: length of zonename. 301238106Sdes * @param buf: buffer to store name in 302238106Sdes * @param max: size of buffer. 303238106Sdes * @return length of name on success. 0 on failure (buffer too short or 304238106Sdes * bad format nsec3 record). 305238106Sdes */ 306238106Sdessize_t nsec3_hash_to_b32(uint8_t* hash, size_t hashlen, uint8_t* zone, 307238106Sdes size_t zonelen, uint8_t* buf, size_t max); 308238106Sdes 309238106Sdes/** 310238106Sdes * Get NSEC3 parameters out of rr. 311238106Sdes * @param rrset: the NSEC3 rrset. 312238106Sdes * @param r: the rr num of the nsec3 in the rrset. 313238106Sdes * @param algo: nsec3 hash algo. 314238106Sdes * @param iter: iteration count. 315238106Sdes * @param salt: ptr to salt inside rdata. 316238106Sdes * @param saltlen: length of salt. 317238106Sdes * @return 0 if bad formatted, unknown nsec3 hash algo, or unknown flags set. 318238106Sdes */ 319238106Sdesint nsec3_get_params(struct ub_packed_rrset_key* rrset, int r, 320238106Sdes int* algo, size_t* iter, uint8_t** salt, size_t* saltlen); 321238106Sdes 322238106Sdes/** 323238106Sdes * Get NSEC3 hashed in a buffer 324238106Sdes * @param buf: buffer for temp use. 325238106Sdes * @param nm: name to hash 326238106Sdes * @param nmlen: length of nm. 327238106Sdes * @param algo: algo to use, must be known. 328238106Sdes * @param iter: iterations 329238106Sdes * @param salt: salt for nsec3 330238106Sdes * @param saltlen: length of salt. 331238106Sdes * @param res: result of hash stored here. 332238106Sdes * @param max: maximum space for result. 333238106Sdes * @return 0 on failure, otherwise bytelength stored. 334238106Sdes */ 335266114Sdessize_t nsec3_get_hashed(struct sldns_buffer* buf, uint8_t* nm, size_t nmlen, 336266114Sdes int algo, size_t iter, uint8_t* salt, size_t saltlen, uint8_t* res, 337266114Sdes size_t max); 338238106Sdes 339238106Sdes/** 340238106Sdes * see if NSEC3 RR contains given type 341238106Sdes * @param rrset: NSEC3 rrset 342238106Sdes * @param r: RR in rrset 343238106Sdes * @param type: in host order to check bit for. 344238106Sdes * @return true if bit set, false if not or error. 345238106Sdes */ 346238106Sdesint nsec3_has_type(struct ub_packed_rrset_key* rrset, int r, uint16_t type); 347238106Sdes 348238106Sdes/** 349238106Sdes * return if nsec3 RR has the optout flag 350238106Sdes * @param rrset: NSEC3 rrset 351238106Sdes * @param r: RR in rrset 352238106Sdes * @return true if optout, false on error or not optout 353238106Sdes */ 354238106Sdesint nsec3_has_optout(struct ub_packed_rrset_key* rrset, int r); 355238106Sdes 356238106Sdes/** 357238106Sdes * Return nsec3 RR next hashed owner name 358238106Sdes * @param rrset: NSEC3 rrset 359238106Sdes * @param r: RR in rrset 360238106Sdes * @param next: ptr into rdata to next owner hash 361238106Sdes * @param nextlen: length of hash. 362238106Sdes * @return false on malformed 363238106Sdes */ 364238106Sdesint nsec3_get_nextowner(struct ub_packed_rrset_key* rrset, int r, 365238106Sdes uint8_t** next, size_t* nextlen); 366238106Sdes 367238106Sdes/** 368238106Sdes * nsec3Covers 369238106Sdes * Given a hash and a candidate NSEC3Record, determine if that NSEC3Record 370238106Sdes * covers the hash. Covers specifically means that the hash is in between 371238106Sdes * the owner and next hashes and does not equal either. 372238106Sdes * 373238106Sdes * @param zone: the zone name. 374238106Sdes * @param hash: the hash of the name 375238106Sdes * @param rrset: the rrset of the NSEC3. 376238106Sdes * @param rr: which rr in the rrset. 377238106Sdes * @param buf: temporary buffer. 378238106Sdes * @return true if covers, false if not. 379238106Sdes */ 380238106Sdesint nsec3_covers(uint8_t* zone, struct nsec3_cached_hash* hash, 381266114Sdes struct ub_packed_rrset_key* rrset, int rr, struct sldns_buffer* buf); 382238106Sdes 383238106Sdes#endif /* VALIDATOR_VAL_NSEC3_H */ 384