1/*
2 * validator/val_nsec.h - validator NSEC denial of existence functions.
3 *
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
5 *
6 * This software is open source.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
14 *
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
18 *
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 */
35
36/**
37 * \file
38 *
39 * This file contains helper functions for the validator module.
40 * The functions help with NSEC checking, the different NSEC proofs
41 * for denial of existence, and proofs for presence of types.
42 */
43
44#ifndef VALIDATOR_VAL_NSEC_H
45#define VALIDATOR_VAL_NSEC_H
46#include "util/data/packed_rrset.h"
47#include "sldns/rrdef.h"
48struct val_env;
49struct module_env;
50struct module_qstate;
51struct ub_packed_rrset_key;
52struct reply_info;
53struct query_info;
54struct key_entry_key;
55
56/**
57 * Check DS absence.
58 * There is a NODATA reply to a DS that needs checking.
59 * NSECs can prove this is not a delegation point, or successfully prove
60 * that there is no DS. Or this fails.
61 *
62 * @param env: module env for rrsig verification routines.
63 * @param ve: validator env for rrsig verification routines.
64 * @param qinfo: the DS queried for.
65 * @param rep: reply received.
66 * @param kkey: key entry to use for verification of signatures.
67 * @param proof_ttl: if secure, the TTL of how long this proof lasts.
68 * @param reason: string explaining why bogus.
69 * @param reason_bogus: relevant EDE code for validation failure.
70 * @param qstate: qstate with region.
71 * @return security status.
72 *	SECURE: proved absence of DS.
73 *	INSECURE: proved that this was not a delegation point.
74 *	BOGUS: crypto bad, or no absence of DS proven.
75 *	UNCHECKED: there was no way to prove anything (no NSECs, unknown algo).
76 */
77enum sec_status val_nsec_prove_nodata_dsreply(struct module_env* env,
78	struct val_env* ve, struct query_info* qinfo,
79	struct reply_info* rep, struct key_entry_key* kkey,
80	time_t* proof_ttl, char** reason, sldns_ede_code* reason_bogus,
81	struct module_qstate* qstate);
82
83/**
84 * nsec typemap check, takes an NSEC-type bitmap as argument, checks for type.
85 * @param bitmap: pointer to the bitmap part of wireformat rdata.
86 * @param len: length of the bitmap, in bytes.
87 * @param type: the type (in host order) to check for.
88 * @return true if the type bit was set in the bitmap. false if not, or
89 * 	if the bitmap was malformed in some way.
90 */
91int nsecbitmap_has_type_rdata(uint8_t* bitmap, size_t len, uint16_t type);
92
93/**
94 * Check if type is present in the NSEC typemap
95 * @param nsec: the nsec RRset.
96 *	If there are multiple RRs, then each must have the same typemap,
97 *	since the typemap represents the types at this domain node.
98 * @param type: type to check for, host order.
99 * @return true if present
100 */
101int nsec_has_type(struct ub_packed_rrset_key* nsec, uint16_t type);
102
103/**
104 * Determine if a NSEC proves the NOERROR/NODATA conditions. This will also
105 * handle the empty non-terminal (ENT) case and partially handle the
106 * wildcard case. If the ownername of 'nsec' is a wildcard, the validator
107 * must still be provided proof that qname did not directly exist and that
108 * the wildcard is, in fact, *.closest_encloser.
109 *
110 * @param nsec: the nsec record to check against.
111 * @param qinfo: the query info.
112 * @param wc: if the nodata is proven for a wildcard match, the wildcard
113 * 	closest encloser is returned, else NULL (wc is unchanged).
114 * 	This closest encloser must then match the nameerror given for the
115 * 	nextcloser of qname.
116 * @return true if NSEC proves this.
117 */
118int nsec_proves_nodata(struct ub_packed_rrset_key* nsec,
119	struct query_info* qinfo, uint8_t** wc);
120
121/**
122 * Determine if the given NSEC proves a NameError (NXDOMAIN) for a given
123 * qname.
124 *
125 * @param nsec: the nsec to check
126 * @param qname: what was queried.
127 * @return true if proven.
128 */
129int val_nsec_proves_name_error(struct ub_packed_rrset_key* nsec,
130	uint8_t* qname);
131
132/**
133 * Determine if the given NSEC proves a positive wildcard response.
134 * @param nsec: the nsec to check
135 * @param qinf: what was queried.
136 * @param wc: wildcard (without *. label)
137 * @return true if proven.
138 */
139int val_nsec_proves_positive_wildcard(struct ub_packed_rrset_key* nsec,
140	struct query_info* qinf, uint8_t* wc);
141
142/**
143 * Determine closest encloser of a query name and the NSEC that covers it
144 * (and thus disproved it).
145 * A name error must have been proven already, otherwise this will be invalid.
146 * @param qname: the name queried for.
147 * @param nsec: the nsec RRset.
148 * @return closest encloser dname or NULL on error (bad nsec RRset).
149 */
150uint8_t* nsec_closest_encloser(uint8_t* qname,
151	struct ub_packed_rrset_key* nsec);
152
153/**
154 * Determine if the given NSEC proves that a wildcard match does not exist.
155 *
156 * @param nsec: the nsec RRset.
157 * @param qname: the name queried for.
158 * @param qnamelen: length of qname.
159 * @return true if proven.
160 */
161int val_nsec_proves_no_wc(struct ub_packed_rrset_key* nsec, uint8_t* qname,
162	size_t qnamelen);
163
164/**
165 * Determine if an nsec proves an insecure delegation towards the qname.
166 * @param nsec: nsec rrset.
167 * @param qinfo: what was queries for.
168 * @return 0 if not, 1 if an NSEC that signals an insecure delegation to
169 * 	the qname.
170 */
171int val_nsec_proves_insecuredelegation(struct ub_packed_rrset_key* nsec,
172        struct query_info* qinfo);
173
174#endif /* VALIDATOR_VAL_NSEC_H */
175