1/*
2 * util/edns.h - handle base EDNS options.
3 *
4 * Copyright (c) 2018, NLnet Labs. All rights reserved.
5 *
6 * This software is open source.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
14 *
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
18 *
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 */
35
36/**
37 * \file
38 *
39 * This file contains functions for base EDNS options.
40 */
41
42#ifndef UTIL_EDNS_H
43#define UTIL_EDNS_H
44
45#include "util/storage/dnstree.h"
46
47struct edns_data;
48struct config_file;
49struct comm_point;
50struct regional;
51
52/**
53 * Structure containing all EDNS strings.
54 */
55struct edns_strings {
56	/** Tree of EDNS client strings to use in upstream queries, per address
57	 * prefix. Contains nodes of type edns_string_addr. */
58	rbtree_type client_strings;
59	/** EDNS opcode to use for client strings */
60	uint16_t client_string_opcode;
61	/** region to allocate tree nodes in */
62	struct regional* region;
63};
64
65/**
66 * EDNS string. Node of rbtree, containing string and prefix.
67 */
68struct edns_string_addr {
69	/** node in address tree, used for tree lookups. Need to be the first
70	 * member of this struct. */
71	struct addr_tree_node node;
72	/** string, ascii format */
73	uint8_t* string;
74	/** length of string */
75	size_t string_len;
76};
77
78enum edns_cookie_val_status {
79	COOKIE_STATUS_CLIENT_ONLY = -3,
80	COOKIE_STATUS_FUTURE = -2,
81	COOKIE_STATUS_EXPIRED = -1,
82	COOKIE_STATUS_INVALID = 0,
83	COOKIE_STATUS_VALID = 1,
84	COOKIE_STATUS_VALID_RENEW = 2,
85};
86
87/**
88 * Create structure to hold EDNS strings
89 * @return: newly created edns_strings, NULL on alloc failure.
90 */
91struct edns_strings* edns_strings_create(void);
92
93/** Delete EDNS strings structure
94 * @param edns_strings: struct to delete
95 */
96void edns_strings_delete(struct edns_strings* edns_strings);
97
98/**
99 * Add configured EDNS strings
100 * @param edns_strings: edns strings to apply config to
101 * @param config: struct containing EDNS strings configuration
102 * @return 0 on error
103 */
104int edns_strings_apply_cfg(struct edns_strings* edns_strings,
105	struct config_file* config);
106
107/**
108 * Find string for address.
109 * @param tree: tree containing EDNS strings per address prefix.
110 * @param addr: address to use for tree lookup
111 * @param addrlen: length of address
112 * @return: matching tree node, NULL otherwise
113 */
114struct edns_string_addr*
115edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr,
116	socklen_t addrlen);
117
118/**
119 * Compute the interoperable DNS cookie (RFC9018) hash.
120 * @param in: buffer input for the hash generation. It needs to be:
121 *	Client Cookie | Version | Reserved | Timestamp | Client-IP
122 * @param secret: the server secret; implicit length of 16 octets.
123 * @param v4: if the client IP is v4 or v6.
124 * @param hash: buffer to write the hash to.
125 * return a pointer to the hash.
126 */
127uint8_t* edns_cookie_server_hash(const uint8_t* in, const uint8_t* secret,
128	int v4, uint8_t* hash);
129
130/**
131 * Write an interoperable DNS server cookie (RFC9018).
132 * @param buf: buffer to write to. It should have a size of at least 32 octets
133 *	as it doubles as the output buffer and the hash input buffer.
134 *	The first 8 octets are expected to be the Client Cookie and will be
135 *		left untouched.
136 *	The next 8 octets will be written with Version | Reserved | Timestamp.
137 *	The next 4 or 16 octets are expected to be the IPv4 or the IPv6 address
138 *		based on the v4 flag.
139 *	Thus the first 20 or 32 octets, based on the v4 flag, will be used as
140 *		the hash input.
141 *	The server hash (8 octets) will be written after the first 16 octets;
142 *		overwriting the address information.
143 *	The caller expects a complete, 24 octet long cookie in the buffer.
144 * @param secret: the server secret; implicit length of 16 octets.
145 * @param v4: if the client IP is v4 or v6.
146 * @param timestamp: the timestamp to use.
147 */
148void edns_cookie_server_write(uint8_t* buf, const uint8_t* secret, int v4,
149	uint32_t timestamp);
150
151/**
152 * Validate an interoperable DNS cookie (RFC9018).
153 * @param cookie: pointer to the cookie data.
154 * @param cookie_len: the length of the cookie data.
155 * @param secret: pointer to the server secret.
156 * @param secret_len: the length of the secret.
157 * @param v4: if the client IP is v4 or v6.
158 * @param hash_input: pointer to the hash input for validation. It needs to be:
159 *	Client Cookie | Version | Reserved | Timestamp | Client-IP
160 * @param now: the current time.
161 * return edns_cookie_val_status with the cookie validation status i.e.,
162 *	<=0 for invalid, else valid.
163 */
164enum edns_cookie_val_status edns_cookie_server_validate(const uint8_t* cookie,
165	size_t cookie_len, const uint8_t* secret, size_t secret_len, int v4,
166	const uint8_t* hash_input, uint32_t now);
167
168#endif
169