1 /* 2 * util/edns.c - handle base EDNS options. 3 * 4 * Copyright (c) 2018, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains functions for base EDNS options. 40 */ 41 42 #include "config.h" 43 #include "util/edns.h" 44 #include "util/config_file.h" 45 #include "util/netevent.h" 46 #include "util/net_help.h" 47 #include "util/regional.h" 48 #include "util/rfc_1982.h" 49 #include "util/siphash.h" 50 #include "util/data/msgparse.h" 51 #include "util/data/msgreply.h" 52 #include "sldns/sbuffer.h" 53 54 struct edns_strings* edns_strings_create(void) 55 { 56 struct edns_strings* edns_strings = calloc(1, 57 sizeof(struct edns_strings)); 58 if(!edns_strings) 59 return NULL; 60 if(!(edns_strings->region = regional_create())) { 61 edns_strings_delete(edns_strings); 62 return NULL; 63 } 64 return edns_strings; 65 } 66 67 void edns_strings_delete(struct edns_strings* edns_strings) 68 { 69 if(!edns_strings) 70 return; 71 regional_destroy(edns_strings->region); 72 free(edns_strings); 73 } 74 75 static int 76 edns_strings_client_insert(struct edns_strings* edns_strings, 77 struct sockaddr_storage* addr, socklen_t addrlen, int net, 78 const char* string) 79 { 80 struct edns_string_addr* esa = regional_alloc_zero(edns_strings->region, 81 sizeof(struct edns_string_addr)); 82 if(!esa) 83 return 0; 84 esa->string_len = strlen(string); 85 esa->string = regional_alloc_init(edns_strings->region, string, 86 esa->string_len); 87 if(!esa->string) 88 return 0; 89 if(!addr_tree_insert(&edns_strings->client_strings, &esa->node, addr, 90 addrlen, net)) { 91 verbose(VERB_QUERY, "duplicate EDNS client string ignored."); 92 } 93 return 1; 94 } 95 96 int edns_strings_apply_cfg(struct edns_strings* edns_strings, 97 struct config_file* config) 98 { 99 struct config_str2list* c; 100 regional_free_all(edns_strings->region); 101 addr_tree_init(&edns_strings->client_strings); 102 103 for(c=config->edns_client_strings; c; c=c->next) { 104 struct sockaddr_storage addr; 105 socklen_t addrlen; 106 int net; 107 log_assert(c->str && c->str2); 108 109 if(!netblockstrtoaddr(c->str, UNBOUND_DNS_PORT, &addr, &addrlen, 110 &net)) { 111 log_err("cannot parse EDNS client string IP netblock: " 112 "%s", c->str); 113 return 0; 114 } 115 if(!edns_strings_client_insert(edns_strings, &addr, addrlen, 116 net, c->str2)) { 117 log_err("out of memory while adding EDNS strings"); 118 return 0; 119 } 120 } 121 edns_strings->client_string_opcode = config->edns_client_string_opcode; 122 123 addr_tree_init_parents(&edns_strings->client_strings); 124 return 1; 125 } 126 127 struct edns_string_addr* 128 edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr, 129 socklen_t addrlen) 130 { 131 return (struct edns_string_addr*)addr_tree_lookup(tree, addr, addrlen); 132 } 133 134 uint8_t* 135 edns_cookie_server_hash(const uint8_t* in, const uint8_t* secret, int v4, 136 uint8_t* hash) 137 { 138 v4?siphash(in, 20, secret, hash, 8):siphash(in, 32, secret, hash, 8); 139 return hash; 140 } 141 142 void 143 edns_cookie_server_write(uint8_t* buf, const uint8_t* secret, int v4, 144 uint32_t timestamp) 145 { 146 uint8_t hash[8]; 147 buf[ 8] = 1; /* Version */ 148 buf[ 9] = 0; /* Reserved */ 149 buf[10] = 0; /* Reserved */ 150 buf[11] = 0; /* Reserved */ 151 sldns_write_uint32(buf + 12, timestamp); 152 (void)edns_cookie_server_hash(buf, secret, v4, hash); 153 memcpy(buf + 16, hash, 8); 154 } 155 156 enum edns_cookie_val_status 157 edns_cookie_server_validate(const uint8_t* cookie, size_t cookie_len, 158 const uint8_t* secret, size_t secret_len, int v4, 159 const uint8_t* hash_input, uint32_t now) 160 { 161 uint8_t hash[8]; 162 uint32_t timestamp; 163 uint32_t subt_1982 = 0; /* Initialize for the compiler; unused value */ 164 int comp_1982; 165 if(cookie_len != 24) 166 /* RFC9018 cookies are 24 bytes long */ 167 return COOKIE_STATUS_CLIENT_ONLY; 168 if(secret_len != 16 || /* RFC9018 cookies have 16 byte secrets */ 169 cookie[8] != 1) /* RFC9018 cookies are cookie version 1 */ 170 return COOKIE_STATUS_INVALID; 171 timestamp = sldns_read_uint32(cookie + 12); 172 if((comp_1982 = compare_1982(now, timestamp)) > 0 173 && (subt_1982 = subtract_1982(timestamp, now)) > 3600) 174 /* Cookie is older than 1 hour (see RFC9018 Section 4.3.) */ 175 return COOKIE_STATUS_EXPIRED; 176 if(comp_1982 <= 0 && subtract_1982(now, timestamp) > 300) 177 /* Cookie time is more than 5 minutes in the future. 178 * (see RFC9018 Section 4.3.) */ 179 return COOKIE_STATUS_FUTURE; 180 if(memcmp(edns_cookie_server_hash(hash_input, secret, v4, hash), 181 cookie + 16, 8) != 0) 182 /* Hashes do not match */ 183 return COOKIE_STATUS_INVALID; 184 if(comp_1982 > 0 && subt_1982 > 1800) 185 /* Valid cookie but older than 30 minutes, so create a new one 186 * anyway */ 187 return COOKIE_STATUS_VALID_RENEW; 188 return COOKIE_STATUS_VALID; 189 } 190