1b7579f77SDag-Erling Smørgrav /* 205ab2901SDag-Erling Smørgrav * validator/val_nsec.h - validator NSEC denial of existence functions. 3b7579f77SDag-Erling Smørgrav * 4b7579f77SDag-Erling Smørgrav * Copyright (c) 2007, NLnet Labs. All rights reserved. 5b7579f77SDag-Erling Smørgrav * 6b7579f77SDag-Erling Smørgrav * This software is open source. 7b7579f77SDag-Erling Smørgrav * 8b7579f77SDag-Erling Smørgrav * Redistribution and use in source and binary forms, with or without 9b7579f77SDag-Erling Smørgrav * modification, are permitted provided that the following conditions 10b7579f77SDag-Erling Smørgrav * are met: 11b7579f77SDag-Erling Smørgrav * 12b7579f77SDag-Erling Smørgrav * Redistributions of source code must retain the above copyright notice, 13b7579f77SDag-Erling Smørgrav * this list of conditions and the following disclaimer. 14b7579f77SDag-Erling Smørgrav * 15b7579f77SDag-Erling Smørgrav * Redistributions in binary form must reproduce the above copyright notice, 16b7579f77SDag-Erling Smørgrav * this list of conditions and the following disclaimer in the documentation 17b7579f77SDag-Erling Smørgrav * and/or other materials provided with the distribution. 18b7579f77SDag-Erling Smørgrav * 19b7579f77SDag-Erling Smørgrav * Neither the name of the NLNET LABS nor the names of its contributors may 20b7579f77SDag-Erling Smørgrav * be used to endorse or promote products derived from this software without 21b7579f77SDag-Erling Smørgrav * specific prior written permission. 22b7579f77SDag-Erling Smørgrav * 23b7579f77SDag-Erling Smørgrav * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 2417d15b25SDag-Erling Smørgrav * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 2517d15b25SDag-Erling Smørgrav * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 2617d15b25SDag-Erling Smørgrav * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 2717d15b25SDag-Erling Smørgrav * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 2817d15b25SDag-Erling Smørgrav * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 2917d15b25SDag-Erling Smørgrav * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 3017d15b25SDag-Erling Smørgrav * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 3117d15b25SDag-Erling Smørgrav * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 3217d15b25SDag-Erling Smørgrav * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 3317d15b25SDag-Erling Smørgrav * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34b7579f77SDag-Erling Smørgrav */ 35b7579f77SDag-Erling Smørgrav 36b7579f77SDag-Erling Smørgrav /** 37b7579f77SDag-Erling Smørgrav * \file 38b7579f77SDag-Erling Smørgrav * 39b7579f77SDag-Erling Smørgrav * This file contains helper functions for the validator module. 40b7579f77SDag-Erling Smørgrav * The functions help with NSEC checking, the different NSEC proofs 4105ab2901SDag-Erling Smørgrav * for denial of existence, and proofs for presence of types. 42b7579f77SDag-Erling Smørgrav */ 43b7579f77SDag-Erling Smørgrav 44b7579f77SDag-Erling Smørgrav #ifndef VALIDATOR_VAL_NSEC_H 45b7579f77SDag-Erling Smørgrav #define VALIDATOR_VAL_NSEC_H 46b7579f77SDag-Erling Smørgrav #include "util/data/packed_rrset.h" 478f76bb7dSCy Schubert #include "sldns/rrdef.h" 48b7579f77SDag-Erling Smørgrav struct val_env; 49b7579f77SDag-Erling Smørgrav struct module_env; 50838e13ceSDag-Erling Smørgrav struct module_qstate; 51b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key; 52b7579f77SDag-Erling Smørgrav struct reply_info; 53b7579f77SDag-Erling Smørgrav struct query_info; 54b7579f77SDag-Erling Smørgrav struct key_entry_key; 55b7579f77SDag-Erling Smørgrav 56b7579f77SDag-Erling Smørgrav /** 57b7579f77SDag-Erling Smørgrav * Check DS absence. 58b7579f77SDag-Erling Smørgrav * There is a NODATA reply to a DS that needs checking. 5905ab2901SDag-Erling Smørgrav * NSECs can prove this is not a delegation point, or successfully prove 60b7579f77SDag-Erling Smørgrav * that there is no DS. Or this fails. 61b7579f77SDag-Erling Smørgrav * 62b7579f77SDag-Erling Smørgrav * @param env: module env for rrsig verification routines. 63b7579f77SDag-Erling Smørgrav * @param ve: validator env for rrsig verification routines. 64b7579f77SDag-Erling Smørgrav * @param qinfo: the DS queried for. 65b7579f77SDag-Erling Smørgrav * @param rep: reply received. 66b7579f77SDag-Erling Smørgrav * @param kkey: key entry to use for verification of signatures. 67b7579f77SDag-Erling Smørgrav * @param proof_ttl: if secure, the TTL of how long this proof lasts. 68b7579f77SDag-Erling Smørgrav * @param reason: string explaining why bogus. 698f76bb7dSCy Schubert * @param reason_bogus: relevant EDE code for validation failure. 70838e13ceSDag-Erling Smørgrav * @param qstate: qstate with region. 71*56850988SCy Schubert * @param reasonbuf: buffer to use for fail reason string print. 72*56850988SCy Schubert * @param reasonlen: length of reasonbuf. 73b7579f77SDag-Erling Smørgrav * @return security status. 74b7579f77SDag-Erling Smørgrav * SECURE: proved absence of DS. 75b7579f77SDag-Erling Smørgrav * INSECURE: proved that this was not a delegation point. 76b7579f77SDag-Erling Smørgrav * BOGUS: crypto bad, or no absence of DS proven. 77b7579f77SDag-Erling Smørgrav * UNCHECKED: there was no way to prove anything (no NSECs, unknown algo). 78b7579f77SDag-Erling Smørgrav */ 79b7579f77SDag-Erling Smørgrav enum sec_status val_nsec_prove_nodata_dsreply(struct module_env* env, 80b7579f77SDag-Erling Smørgrav struct val_env* ve, struct query_info* qinfo, 81b7579f77SDag-Erling Smørgrav struct reply_info* rep, struct key_entry_key* kkey, 828f76bb7dSCy Schubert time_t* proof_ttl, char** reason, sldns_ede_code* reason_bogus, 83*56850988SCy Schubert struct module_qstate* qstate, char* reasonbuf, size_t reasonlen); 84b7579f77SDag-Erling Smørgrav 85b7579f77SDag-Erling Smørgrav /** 86b7579f77SDag-Erling Smørgrav * nsec typemap check, takes an NSEC-type bitmap as argument, checks for type. 87b7579f77SDag-Erling Smørgrav * @param bitmap: pointer to the bitmap part of wireformat rdata. 88b7579f77SDag-Erling Smørgrav * @param len: length of the bitmap, in bytes. 89b7579f77SDag-Erling Smørgrav * @param type: the type (in host order) to check for. 90b7579f77SDag-Erling Smørgrav * @return true if the type bit was set in the bitmap. false if not, or 91b7579f77SDag-Erling Smørgrav * if the bitmap was malformed in some way. 92b7579f77SDag-Erling Smørgrav */ 93b7579f77SDag-Erling Smørgrav int nsecbitmap_has_type_rdata(uint8_t* bitmap, size_t len, uint16_t type); 94b7579f77SDag-Erling Smørgrav 95b7579f77SDag-Erling Smørgrav /** 96b7579f77SDag-Erling Smørgrav * Check if type is present in the NSEC typemap 97b7579f77SDag-Erling Smørgrav * @param nsec: the nsec RRset. 98b7579f77SDag-Erling Smørgrav * If there are multiple RRs, then each must have the same typemap, 99b7579f77SDag-Erling Smørgrav * since the typemap represents the types at this domain node. 100b7579f77SDag-Erling Smørgrav * @param type: type to check for, host order. 101b7579f77SDag-Erling Smørgrav * @return true if present 102b7579f77SDag-Erling Smørgrav */ 103b7579f77SDag-Erling Smørgrav int nsec_has_type(struct ub_packed_rrset_key* nsec, uint16_t type); 104b7579f77SDag-Erling Smørgrav 105b7579f77SDag-Erling Smørgrav /** 106b7579f77SDag-Erling Smørgrav * Determine if a NSEC proves the NOERROR/NODATA conditions. This will also 107b7579f77SDag-Erling Smørgrav * handle the empty non-terminal (ENT) case and partially handle the 108b7579f77SDag-Erling Smørgrav * wildcard case. If the ownername of 'nsec' is a wildcard, the validator 109b7579f77SDag-Erling Smørgrav * must still be provided proof that qname did not directly exist and that 110b7579f77SDag-Erling Smørgrav * the wildcard is, in fact, *.closest_encloser. 111b7579f77SDag-Erling Smørgrav * 112b7579f77SDag-Erling Smørgrav * @param nsec: the nsec record to check against. 113b7579f77SDag-Erling Smørgrav * @param qinfo: the query info. 114b7579f77SDag-Erling Smørgrav * @param wc: if the nodata is proven for a wildcard match, the wildcard 115b7579f77SDag-Erling Smørgrav * closest encloser is returned, else NULL (wc is unchanged). 116b7579f77SDag-Erling Smørgrav * This closest encloser must then match the nameerror given for the 117b7579f77SDag-Erling Smørgrav * nextcloser of qname. 118b7579f77SDag-Erling Smørgrav * @return true if NSEC proves this. 119b7579f77SDag-Erling Smørgrav */ 120b7579f77SDag-Erling Smørgrav int nsec_proves_nodata(struct ub_packed_rrset_key* nsec, 121b7579f77SDag-Erling Smørgrav struct query_info* qinfo, uint8_t** wc); 122b7579f77SDag-Erling Smørgrav 123b7579f77SDag-Erling Smørgrav /** 124b7579f77SDag-Erling Smørgrav * Determine if the given NSEC proves a NameError (NXDOMAIN) for a given 125b7579f77SDag-Erling Smørgrav * qname. 126b7579f77SDag-Erling Smørgrav * 127b7579f77SDag-Erling Smørgrav * @param nsec: the nsec to check 128b7579f77SDag-Erling Smørgrav * @param qname: what was queried. 129b7579f77SDag-Erling Smørgrav * @return true if proven. 130b7579f77SDag-Erling Smørgrav */ 131b7579f77SDag-Erling Smørgrav int val_nsec_proves_name_error(struct ub_packed_rrset_key* nsec, 132b7579f77SDag-Erling Smørgrav uint8_t* qname); 133b7579f77SDag-Erling Smørgrav 134b7579f77SDag-Erling Smørgrav /** 135b7579f77SDag-Erling Smørgrav * Determine if the given NSEC proves a positive wildcard response. 136b7579f77SDag-Erling Smørgrav * @param nsec: the nsec to check 137b7579f77SDag-Erling Smørgrav * @param qinf: what was queried. 138b7579f77SDag-Erling Smørgrav * @param wc: wildcard (without *. label) 139b7579f77SDag-Erling Smørgrav * @return true if proven. 140b7579f77SDag-Erling Smørgrav */ 141b7579f77SDag-Erling Smørgrav int val_nsec_proves_positive_wildcard(struct ub_packed_rrset_key* nsec, 142b7579f77SDag-Erling Smørgrav struct query_info* qinf, uint8_t* wc); 143b7579f77SDag-Erling Smørgrav 144b7579f77SDag-Erling Smørgrav /** 145b7579f77SDag-Erling Smørgrav * Determine closest encloser of a query name and the NSEC that covers it 146b7579f77SDag-Erling Smørgrav * (and thus disproved it). 147b7579f77SDag-Erling Smørgrav * A name error must have been proven already, otherwise this will be invalid. 148b7579f77SDag-Erling Smørgrav * @param qname: the name queried for. 149b7579f77SDag-Erling Smørgrav * @param nsec: the nsec RRset. 150b7579f77SDag-Erling Smørgrav * @return closest encloser dname or NULL on error (bad nsec RRset). 151b7579f77SDag-Erling Smørgrav */ 152b7579f77SDag-Erling Smørgrav uint8_t* nsec_closest_encloser(uint8_t* qname, 153b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* nsec); 154b7579f77SDag-Erling Smørgrav 155b7579f77SDag-Erling Smørgrav /** 156b7579f77SDag-Erling Smørgrav * Determine if the given NSEC proves that a wildcard match does not exist. 157b7579f77SDag-Erling Smørgrav * 158b7579f77SDag-Erling Smørgrav * @param nsec: the nsec RRset. 159b7579f77SDag-Erling Smørgrav * @param qname: the name queried for. 160b7579f77SDag-Erling Smørgrav * @param qnamelen: length of qname. 161b7579f77SDag-Erling Smørgrav * @return true if proven. 162b7579f77SDag-Erling Smørgrav */ 163b7579f77SDag-Erling Smørgrav int val_nsec_proves_no_wc(struct ub_packed_rrset_key* nsec, uint8_t* qname, 164b7579f77SDag-Erling Smørgrav size_t qnamelen); 165b7579f77SDag-Erling Smørgrav 166b7579f77SDag-Erling Smørgrav /** 167b7579f77SDag-Erling Smørgrav * Determine if an nsec proves an insecure delegation towards the qname. 168b7579f77SDag-Erling Smørgrav * @param nsec: nsec rrset. 169b7579f77SDag-Erling Smørgrav * @param qinfo: what was queries for. 170b7579f77SDag-Erling Smørgrav * @return 0 if not, 1 if an NSEC that signals an insecure delegation to 171b7579f77SDag-Erling Smørgrav * the qname. 172b7579f77SDag-Erling Smørgrav */ 173b7579f77SDag-Erling Smørgrav int val_nsec_proves_insecuredelegation(struct ub_packed_rrset_key* nsec, 174b7579f77SDag-Erling Smørgrav struct query_info* qinfo); 175b7579f77SDag-Erling Smørgrav 176b7579f77SDag-Erling Smørgrav #endif /* VALIDATOR_VAL_NSEC_H */ 177