xref: /openbsd/usr.sbin/nsd/nsec3.c (revision 91f110e0)
1 /*
2  * nsec3.c -- nsec3 handling.
3  *
4  * Copyright (c) 2001-2006, NLnet Labs. All rights reserved.
5  *
6  * See LICENSE for the license.
7  *
8  */
9 #include "config.h"
10 #ifdef NSEC3
11 #include <stdio.h>
12 #include <stdlib.h>
13 
14 #include "nsec3.h"
15 #include "iterated_hash.h"
16 #include "namedb.h"
17 #include "nsd.h"
18 #include "answer.h"
19 #include "udbzone.h"
20 #include "options.h"
21 
22 #define NSEC3_RDATA_BITMAP 5
23 
24 /* compare nsec3 hashes in nsec3 tree */
25 static int
26 cmp_hash_tree(const void* x, const void* y)
27 {
28 	const domain_type* a = (const domain_type*)x;
29 	const domain_type* b = (const domain_type*)y;
30 	return memcmp(a->nsec3->nsec3_hash, b->nsec3->nsec3_hash,
31 		NSEC3_HASH_LEN);
32 }
33 
34 /* compare nsec3 hashes in nsec3 wc tree */
35 static int
36 cmp_wchash_tree(const void* x, const void* y)
37 {
38 	const domain_type* a = (const domain_type*)x;
39 	const domain_type* b = (const domain_type*)y;
40 	return memcmp(a->nsec3->nsec3_wc_hash, b->nsec3->nsec3_wc_hash,
41 		NSEC3_HASH_LEN);
42 }
43 
44 /* compare nsec3 hashes in nsec3 ds tree */
45 static int
46 cmp_dshash_tree(const void* x, const void* y)
47 {
48 	const domain_type* a = (const domain_type*)x;
49 	const domain_type* b = (const domain_type*)y;
50 	return memcmp(a->nsec3->nsec3_ds_parent_hash,
51 		b->nsec3->nsec3_ds_parent_hash, NSEC3_HASH_LEN);
52 }
53 
54 /* compare base32-encoded nsec3 hashes in nsec3 rr tree, they are
55  * stored in the domain name of the node */
56 static int
57 cmp_nsec3_tree(const void* x, const void* y)
58 {
59 	const domain_type* a = (const domain_type*)x;
60 	const domain_type* b = (const domain_type*)y;
61 	/* labelcount + 32long label */
62 	assert(dname_name(a->dname)[0] == 32);
63 	assert(dname_name(b->dname)[0] == 32);
64 	return memcmp(dname_name(a->dname), dname_name(b->dname), 33);
65 }
66 
67 void nsec3_zone_trees_create(struct region* region, zone_type* zone)
68 {
69 	if(!zone->nsec3tree)
70 		zone->nsec3tree = rbtree_create(region, cmp_nsec3_tree);
71 	if(!zone->hashtree)
72 		zone->hashtree = rbtree_create(region, cmp_hash_tree);
73 	if(!zone->wchashtree)
74 		zone->wchashtree = rbtree_create(region, cmp_wchash_tree);
75 	if(!zone->dshashtree)
76 		zone->dshashtree = rbtree_create(region, cmp_dshash_tree);
77 }
78 
79 void nsec3_hash_tree_clear(struct zone* zone)
80 {
81 	hash_tree_clear(zone->nsec3tree);
82 	hash_tree_clear(zone->hashtree);
83 	hash_tree_clear(zone->wchashtree);
84 	hash_tree_clear(zone->dshashtree);
85 }
86 
87 static void
88 detect_nsec3_params(rr_type* nsec3_apex,
89 	const unsigned char** salt, int* salt_len, int* iter)
90 {
91 	assert(salt && salt_len && iter);
92 	assert(nsec3_apex);
93 	*salt_len = rdata_atom_data(nsec3_apex->rdatas[3])[0];
94 	*salt = (unsigned char*)(rdata_atom_data(nsec3_apex->rdatas[3])+1);
95 	*iter = read_uint16(rdata_atom_data(nsec3_apex->rdatas[2]));
96 }
97 
98 const dname_type *
99 nsec3_b32_create(region_type* region, zone_type* zone, unsigned char* hash)
100 {
101 	const dname_type* dname;
102 	char b32[SHA_DIGEST_LENGTH*2+1];
103 	b32_ntop(hash, SHA_DIGEST_LENGTH, b32, sizeof(b32));
104 	dname=dname_parse(region, b32);
105 	dname=dname_concatenate(region, dname, domain_dname(zone->apex));
106 	return dname;
107 }
108 
109 void
110 nsec3_hash_and_store(zone_type* zone, const dname_type* dname, uint8_t* store)
111 {
112 	const unsigned char* nsec3_salt = NULL;
113 	int nsec3_saltlength = 0;
114 	int nsec3_iterations = 0;
115 
116 	detect_nsec3_params(zone->nsec3_param, &nsec3_salt,
117 		&nsec3_saltlength, &nsec3_iterations);
118 	iterated_hash((unsigned char*)store, nsec3_salt, nsec3_saltlength,
119 		dname_name(dname), dname->name_size, nsec3_iterations);
120 }
121 
122 #define STORE_HASH(x,y) memmove(domain->nsec3->x,y,NSEC3_HASH_LEN); domain->nsec3->have_##x =1;
123 
124 /** find hash or create it and store it */
125 static void
126 nsec3_lookup_hash_and_wc(zone_type* zone, const dname_type* dname,
127 	domain_type* domain, region_type* tmpregion)
128 {
129 	const dname_type* wcard;
130 	if(domain->nsec3->have_nsec3_hash && domain->nsec3->have_nsec3_wc_hash) {
131 		return;
132 	}
133 	/* lookup failed; disk failure or so */
134 	nsec3_hash_and_store(zone, dname, domain->nsec3->nsec3_hash);
135 	domain->nsec3->have_nsec3_hash = 1;
136 	wcard = dname_parse(tmpregion, "*");
137 	wcard = dname_concatenate(tmpregion, wcard, dname);
138 	nsec3_hash_and_store(zone, wcard, domain->nsec3->nsec3_wc_hash);
139 	domain->nsec3->have_nsec3_wc_hash = 1;
140 }
141 
142 static void
143 nsec3_lookup_hash_ds(zone_type* zone, const dname_type* dname,
144 	domain_type* domain)
145 {
146 	if(domain->nsec3->have_nsec3_ds_parent_hash) {
147 		return;
148 	}
149 	/* lookup failed; disk failure or so */
150 	nsec3_hash_and_store(zone, dname, domain->nsec3->nsec3_ds_parent_hash);
151 	domain->nsec3->have_nsec3_ds_parent_hash = 1;
152 }
153 
154 static int
155 nsec3_has_soa(rr_type* rr)
156 {
157 	if(rdata_atom_size(rr->rdatas[NSEC3_RDATA_BITMAP]) >= 3 && /* has types in bitmap */
158 		rdata_atom_data(rr->rdatas[NSEC3_RDATA_BITMAP])[0] == 0 && /* first window = 0, */
159 		/* [1]: bitmap length must be >= 1 */
160 		/* [2]: bit[6] = SOA, thus mask first bitmap octet with 0x02 */
161 		rdata_atom_data(rr->rdatas[NSEC3_RDATA_BITMAP])[2]&0x02) { /* SOA bit set */
162 		return 1;
163 	}
164 	return 0;
165 }
166 
167 static rr_type*
168 check_apex_soa(namedb_type* namedb, zone_type *zone)
169 {
170 	uint8_t h[NSEC3_HASH_LEN];
171 	domain_type* domain;
172 	const dname_type* hashed_apex, *dname = domain_dname(zone->apex);
173 	unsigned j;
174 	rrset_type* nsec3_rrset;
175 	region_type* tmpregion;
176 
177 	nsec3_hash_and_store(zone, dname, h);
178 	tmpregion = region_create(xalloc, free);
179 	hashed_apex = nsec3_b32_create(tmpregion, zone, h);
180 	domain = domain_table_find(namedb->domains, hashed_apex);
181 	if(!domain) {
182 		log_msg(LOG_ERR, "%s NSEC3PARAM entry has no hash(apex).",
183 			domain_to_string(zone->apex));
184 		log_msg(LOG_ERR, "hash(apex)= %s",
185 			dname_to_string(hashed_apex, NULL));
186 		region_destroy(tmpregion);
187 		return NULL;
188 	}
189 	nsec3_rrset = domain_find_rrset(domain, zone, TYPE_NSEC3);
190 	if(!nsec3_rrset) {
191 		log_msg(LOG_ERR, "%s NSEC3PARAM entry: hash(apex) has no NSEC3 RRset.",
192 			domain_to_string(zone->apex));
193 		log_msg(LOG_ERR, "hash(apex)= %s",
194 			dname_to_string(hashed_apex, NULL));
195 		region_destroy(tmpregion);
196 		return NULL;
197 	}
198 	for(j=0; j<nsec3_rrset->rr_count; j++) {
199 		if(nsec3_has_soa(&nsec3_rrset->rrs[j])) {
200 			region_destroy(tmpregion);
201 			return &nsec3_rrset->rrs[j];
202 		}
203 	}
204 	log_msg(LOG_ERR, "%s NSEC3PARAM entry: hash(apex) NSEC3 has no SOA flag.",
205 		domain_to_string(zone->apex));
206 	log_msg(LOG_ERR, "hash(apex)= %s",
207 		dname_to_string(hashed_apex, NULL));
208 	region_destroy(tmpregion);
209 	return NULL;
210 }
211 
212 static struct rr*
213 udb_zone_find_nsec3param(udb_base* udb, udb_ptr* uz, struct zone* z)
214 {
215 	udb_ptr urr;
216 	unsigned i;
217 	rrset_type* rrset = domain_find_rrset(z->apex, z, TYPE_NSEC3PARAM);
218 	if(!rrset) /* no NSEC3PARAM in mem */
219 		return NULL;
220 	udb_ptr_new(&urr, udb, &ZONE(uz)->nsec3param);
221 	if(!urr.data || RR(&urr)->len < 5) {
222 		/* no NSEC3PARAM in udb */
223 		udb_ptr_unlink(&urr, udb);
224 		return NULL;
225 	}
226 	/* find matching NSEC3PARAM RR in memory */
227 	for(i=0; i<rrset->rr_count; i++) {
228 		/* if this RR matches the udb RR then we are done */
229 		rdata_atom_type* rd = rrset->rrs[i].rdatas;
230 		if(RR(&urr)->wire[0] == rdata_atom_data(rd[0])[0] && /*alg*/
231 		   RR(&urr)->wire[1] == rdata_atom_data(rd[1])[0] && /*flg*/
232 		   RR(&urr)->wire[2] == rdata_atom_data(rd[2])[0] && /*iter*/
233 		   RR(&urr)->wire[3] == rdata_atom_data(rd[2])[1] &&
234 		   RR(&urr)->wire[4] == rdata_atom_data(rd[3])[0] && /*slen*/
235 		   RR(&urr)->len >= 5 + RR(&urr)->wire[4] &&
236 		   memcmp(RR(&urr)->wire+5, rdata_atom_data(rd[3])+1,
237 			rdata_atom_data(rd[3])[0]) == 0) {
238 			udb_ptr_unlink(&urr, udb);
239 			return &rrset->rrs[i];
240 		}
241 	}
242 	udb_ptr_unlink(&urr, udb);
243 	return NULL;
244 }
245 
246 void
247 nsec3_find_zone_param(struct namedb* db, struct zone* zone, udb_ptr* z)
248 {
249 	/* get nsec3param RR from udb */
250 	zone->nsec3_param = udb_zone_find_nsec3param(db->udb, z, zone);
251 }
252 
253 /* check params ok for one RR */
254 static int
255 nsec3_rdata_params_ok(rdata_atom_type* prd, rdata_atom_type* rd)
256 {
257 	return (rdata_atom_data(rd[0])[0] ==
258 		rdata_atom_data(prd[0])[0] && /* hash algo */
259 	   rdata_atom_data(rd[2])[0] ==
260 		rdata_atom_data(prd[2])[0] && /* iterations 0 */
261 	   rdata_atom_data(rd[2])[1] ==
262 		rdata_atom_data(prd[2])[1] && /* iterations 1 */
263 	   rdata_atom_data(rd[3])[0] ==
264 		rdata_atom_data(prd[3])[0] && /* salt length */
265 	   memcmp(rdata_atom_data(rd[3])+1,
266 		rdata_atom_data(prd[3])+1, rdata_atom_data(rd[3])[0])
267 		== 0 );
268 }
269 
270 int
271 nsec3_rr_uses_params(rr_type* rr, zone_type* zone)
272 {
273 	if(!rr || rr->rdata_count < 4)
274 		return 0;
275 	return nsec3_rdata_params_ok(zone->nsec3_param->rdatas, rr->rdatas);
276 }
277 
278 int
279 nsec3_in_chain_count(domain_type* domain, zone_type* zone)
280 {
281 	rrset_type* rrset = domain_find_rrset(domain, zone, TYPE_NSEC3);
282 	unsigned i;
283 	int count = 0;
284 	if(!rrset || !zone->nsec3_param)
285 		return 0; /* no NSEC3s, none in the chain */
286 	for(i=0; i<rrset->rr_count; i++) {
287 		if(nsec3_rr_uses_params(&rrset->rrs[i], zone))
288 			count++;
289 	}
290 	return count;
291 }
292 
293 struct domain*
294 nsec3_chain_find_prev(struct zone* zone, struct domain* domain)
295 {
296 	if(domain->nsec3 && domain->nsec3->nsec3_node.key) {
297 		/* see if there is a prev */
298 		rbnode_t* r = rbtree_previous(&domain->nsec3->nsec3_node);
299 		if(r != RBTREE_NULL) {
300 			/* found a previous, which is not the root-node in
301 			 * the prehash tree (and thus points to the tree) */
302 			return (domain_type*)r->key;
303 		}
304 	}
305 	if(zone->nsec3_last)
306 		return zone->nsec3_last;
307 	return NULL;
308 }
309 
310 void
311 nsec3_clear_precompile(struct namedb* db, zone_type* zone)
312 {
313 	domain_type* walk;
314 	/* clear prehash items (there must not be items for other zones) */
315 	prehash_clear(db->domains);
316 	/* clear trees */
317 	hash_tree_clear(zone->nsec3tree);
318 	hash_tree_clear(zone->hashtree);
319 	hash_tree_clear(zone->wchashtree);
320 	hash_tree_clear(zone->dshashtree);
321 	/* wipe hashes */
322 
323 	/* wipe precompile */
324 	walk = zone->apex;
325 	while(walk && domain_is_subdomain(walk, zone->apex)) {
326 		if(walk->nsec3) {
327 			if(nsec3_domain_part_of_zone(walk, zone)) {
328 				walk->nsec3->nsec3_node.key = NULL;
329 				walk->nsec3->nsec3_cover = NULL;
330 				walk->nsec3->nsec3_wcard_child_cover = NULL;
331 				walk->nsec3->nsec3_is_exact = 0;
332 				walk->nsec3->have_nsec3_hash = 0;
333 				walk->nsec3->have_nsec3_wc_hash = 0;
334 				walk->nsec3->hash_node.key = NULL;
335 				walk->nsec3->wchash_node.key = NULL;
336 			}
337 			if(!walk->parent ||
338 				nsec3_domain_part_of_zone(walk->parent, zone)) {
339 				walk->nsec3->nsec3_ds_parent_cover = NULL;
340 				walk->nsec3->nsec3_ds_parent_is_exact = 0;
341 				walk->nsec3->have_nsec3_ds_parent_hash = 0;
342 				walk->nsec3->dshash_node.key = NULL;
343 			}
344 		}
345 		walk = domain_next(walk);
346 	}
347 	zone->nsec3_last = NULL;
348 }
349 
350 /* see if domain name is part of (existing names in) the nsec3 zone */
351 int
352 nsec3_domain_part_of_zone(domain_type* d, zone_type* z)
353 {
354 	while(d) {
355 		if(d->is_apex)
356 			return (z->apex == d); /* zonecut, if right zone*/
357 		d = d->parent;
358 	}
359 	return 0;
360 }
361 
362 /* condition when a domain is precompiled */
363 int
364 nsec3_condition_hash(domain_type* d, zone_type* z)
365 {
366 	return d->is_existing && !domain_has_only_NSEC3(d, z) &&
367 		nsec3_domain_part_of_zone(d, z) && !domain_is_glue(d, z);
368 }
369 
370 /* condition when a domain is ds precompiled */
371 int
372 nsec3_condition_dshash(domain_type* d, zone_type* z)
373 {
374 	return d->is_existing && !domain_has_only_NSEC3(d, z) &&
375 		(domain_find_rrset(d, z, TYPE_DS) ||
376 		domain_find_rrset(d, z, TYPE_NS)) && d != z->apex;
377 }
378 
379 zone_type*
380 nsec3_tree_zone(namedb_type* db, domain_type* d)
381 {
382 	/* see nsec3_domain_part_of_zone; domains part of zone that has
383 	 * apex above them */
384 	/* this does not use the rrset->zone pointer because there may be
385 	 * no rrsets left at apex (no SOA), e.g. during IXFR */
386 	while(d) {
387 		if(d->is_apex) {
388 			/* we can try a SOA if its present (faster than tree)*/
389 			/* DNSKEY and NSEC3PARAM are also good indicators */
390 			rrset_type *rrset;
391 			for (rrset = d->rrsets; rrset; rrset = rrset->next)
392 				if (rrset_rrtype(rrset) == TYPE_SOA ||
393 					rrset_rrtype(rrset) == TYPE_DNSKEY ||
394 					rrset_rrtype(rrset) == TYPE_NSEC3PARAM)
395 					return rrset->zone;
396 			return namedb_find_zone(db, d->dname);
397 		}
398 		d = d->parent;
399 	}
400 	return NULL;
401 }
402 
403 zone_type*
404 nsec3_tree_dszone(namedb_type* db, domain_type* d)
405 {
406 	/* the DStree does not contain nodes with d==z->apex */
407 	if(d->is_apex)
408 		d = d->parent;
409 	return nsec3_tree_zone(db, d);
410 }
411 
412 int
413 nsec3_find_cover(zone_type* zone, uint8_t* hash, size_t hashlen,
414 	domain_type** result)
415 {
416 	rbnode_t* r = NULL;
417 	int exact;
418 	domain_type d;
419 	uint8_t n[48];
420 
421 	/* nsec3tree is sorted by b32 encoded domain name of the NSEC3 */
422 	b32_ntop(hash, hashlen, (char*)(n+5), sizeof(n)-5);
423 	d.dname = (dname_type*)n;
424 	n[0] = 34; /* name_size */
425 	n[1] = 2; /* label_count */
426 	n[2] = 0; /* label_offset[0] */
427 	n[3] = 0; /* label_offset[1] */
428 	n[4] = 32; /* label-size[0] */
429 
430 	assert(result);
431 	assert(zone->nsec3_param && zone->nsec3tree);
432 
433 	exact = rbtree_find_less_equal(zone->nsec3tree, &d, &r);
434 	if(r) {
435 		*result = (domain_type*)r->key;
436 	} else {
437 		*result = zone->nsec3_last;
438 	}
439 	return exact;
440 }
441 
442 void
443 nsec3_precompile_domain(struct namedb* db, struct domain* domain,
444 	struct zone* zone, region_type* tmpregion)
445 {
446 	domain_type* result = 0;
447 	int exact;
448 	allocate_domain_nsec3(db->domains, domain);
449 
450 	/* hash it */
451 	nsec3_lookup_hash_and_wc(zone, domain_dname(domain), domain, tmpregion);
452 
453 	/* add into tree */
454 	zone_add_domain_in_hash_tree(db->region, &zone->hashtree,
455 		cmp_hash_tree, domain, &domain->nsec3->hash_node);
456 	zone_add_domain_in_hash_tree(db->region, &zone->wchashtree,
457 		cmp_wchash_tree, domain, &domain->nsec3->wchash_node);
458 
459 	/* lookup in tree cover ptr (or exact) */
460 	exact = nsec3_find_cover(zone, domain->nsec3->nsec3_hash,
461 		sizeof(domain->nsec3->nsec3_hash), &result);
462 	domain->nsec3->nsec3_cover = result;
463 	if(exact)
464 		domain->nsec3->nsec3_is_exact = 1;
465 	else	domain->nsec3->nsec3_is_exact = 0;
466 
467 	/* find cover for *.domain for wildcard denial */
468 	exact = nsec3_find_cover(zone, domain->nsec3->nsec3_wc_hash,
469 		sizeof(domain->nsec3->nsec3_wc_hash), &result);
470 	domain->nsec3->nsec3_wcard_child_cover = result;
471 }
472 
473 void
474 nsec3_precompile_domain_ds(struct namedb* db, struct domain* domain,
475 	struct zone* zone)
476 {
477 	domain_type* result = 0;
478 	int exact;
479 	allocate_domain_nsec3(db->domains, domain);
480 
481 	/* hash it : it could have different hash parameters then the
482 	   other hash for this domain name */
483 	nsec3_lookup_hash_ds(zone, domain_dname(domain), domain);
484 	/* lookup in tree cover ptr (or exact) */
485 	exact = nsec3_find_cover(zone, domain->nsec3->nsec3_ds_parent_hash,
486 		sizeof(domain->nsec3->nsec3_ds_parent_hash), &result);
487 	if(exact)
488 		domain->nsec3->nsec3_ds_parent_is_exact = 1;
489 	else 	domain->nsec3->nsec3_ds_parent_is_exact = 0;
490 	domain->nsec3->nsec3_ds_parent_cover = result;
491 	/* add into tree */
492 	zone_add_domain_in_hash_tree(db->region, &zone->dshashtree,
493 		cmp_dshash_tree, domain, &domain->nsec3->dshash_node);
494 }
495 
496 static void
497 parse_nsec3_name(const dname_type* dname, uint8_t* hash, size_t buflen)
498 {
499 	/* first label must be the match, */
500 	size_t lablen = (buflen-1) * 8 / 5;
501 	const uint8_t* wire = dname_name(dname);
502 	assert(lablen == 32 && buflen == NSEC3_HASH_LEN+1);
503 	/* labels of length 32 for SHA1, and must have space+1 for convert */
504 	if(wire[0] != lablen) {
505 		/* not NSEC3 */
506 		memset(hash, 0, buflen);
507 		return;
508 	}
509 	(void)b32_pton((char*)wire+1, hash, buflen);
510 }
511 
512 void
513 nsec3_precompile_nsec3rr(namedb_type* db, struct domain* domain,
514 	struct zone* zone)
515 {
516 	allocate_domain_nsec3(db->domains, domain);
517 	/* add into nsec3tree */
518 	zone_add_domain_in_hash_tree(db->region, &zone->nsec3tree,
519 		cmp_nsec3_tree, domain, &domain->nsec3->nsec3_node);
520 	/* fixup the last in the zone */
521 	if(rbtree_last(zone->nsec3tree)->key == domain) {
522 		zone->nsec3_last = domain;
523 	}
524 }
525 
526 void
527 nsec3_precompile_newparam(namedb_type* db, zone_type* zone)
528 {
529 	region_type* tmpregion = region_create(xalloc, free);
530 	domain_type* walk;
531 	time_t s = time(NULL);
532 	unsigned n = 0, c = 0;
533 
534 	/* add nsec3s of chain to nsec3tree */
535 	for(walk=zone->apex; walk && domain_is_subdomain(walk, zone->apex);
536 		walk = domain_next(walk)) {
537 		n++;
538 		if(nsec3_in_chain_count(walk, zone) != 0) {
539 			nsec3_precompile_nsec3rr(db, walk, zone);
540 		}
541 	}
542 	/* hash and precompile zone */
543 	for(walk=zone->apex; walk && domain_is_subdomain(walk, zone->apex);
544 		walk = domain_next(walk)) {
545 		if(nsec3_condition_hash(walk, zone)) {
546 			nsec3_precompile_domain(db, walk, zone, tmpregion);
547 			region_free_all(tmpregion);
548 		}
549 		if(nsec3_condition_dshash(walk, zone))
550 			nsec3_precompile_domain_ds(db, walk, zone);
551 		if(++c % ZONEC_PCT_COUNT == 0 && time(NULL) > s + ZONEC_PCT_TIME) {
552 			s = time(NULL);
553 			VERBOSITY(1, (LOG_INFO, "nsec3 %s %d %%",
554 				zone->opts->name, c*100/n));
555 		}
556 	}
557 	region_destroy(tmpregion);
558 }
559 
560 void
561 prehash_zone_complete(struct namedb* db, struct zone* zone)
562 {
563 	udb_ptr udbz;
564 
565 	/* robust clear it */
566 	nsec3_clear_precompile(db, zone);
567 	/* find zone settings */
568 
569 	assert(db && zone);
570 	if(!udb_zone_search(db->udb, &udbz, dname_name(domain_dname(
571 		zone->apex)), domain_dname(zone->apex)->name_size)) {
572 		udb_ptr_init(&udbz, db->udb); /* zero the ptr */
573 	}
574 	nsec3_find_zone_param(db, zone, &udbz);
575 	if(!zone->nsec3_param || !check_apex_soa(db, zone)) {
576 		zone->nsec3_param = NULL;
577 		zone->nsec3_last = NULL;
578 		udb_ptr_unlink(&udbz, db->udb);
579 		return;
580 	}
581 	udb_ptr_unlink(&udbz, db->udb);
582 	nsec3_precompile_newparam(db, zone);
583 }
584 
585 static void
586 init_lookup_key_hash_tree(domain_type* d, uint8_t* hash)
587 { memcpy(d->nsec3->nsec3_hash, hash, NSEC3_HASH_LEN); }
588 
589 static void
590 init_lookup_key_wc_tree(domain_type* d, uint8_t* hash)
591 { memcpy(d->nsec3->nsec3_wc_hash, hash, NSEC3_HASH_LEN); }
592 
593 static void
594 init_lookup_key_ds_tree(domain_type* d, uint8_t* hash)
595 { memcpy(d->nsec3->nsec3_ds_parent_hash, hash, NSEC3_HASH_LEN); }
596 
597 /* find first in the tree and true if the first to process it */
598 static int
599 process_first(rbtree_t* tree, uint8_t* hash, rbnode_t** p,
600 	void (*init)(domain_type*, uint8_t*))
601 {
602 	domain_type d;
603 	struct nsec3_domain_data n;
604 	if(!tree) {
605 		*p = RBTREE_NULL;
606 		return 0;
607 	}
608 	d.nsec3 = &n;
609 	init(&d, hash);
610 	if(rbtree_find_less_equal(tree, &d, p)) {
611 		/* found an exact match */
612 		return 1;
613 	}
614 	if(!*p) /* before first, go from first */
615 		*p = rbtree_first(tree);
616 	/* the inexact, smaller, match we found, does not itself need to
617 	 * be edited */
618 	else
619 		*p = rbtree_next(*p); /* if this becomes NULL, nothing to do */
620 	return 0;
621 }
622 
623 /* set end pointer if possible */
624 static void
625 process_end(rbtree_t* tree, uint8_t* hash, rbnode_t** p,
626 	void (*init)(domain_type*, uint8_t*))
627 {
628 	domain_type d;
629 	struct nsec3_domain_data n;
630 	if(!tree) {
631 		*p = RBTREE_NULL;
632 		return;
633 	}
634 	d.nsec3 = &n;
635 	init(&d, hash);
636 	if(rbtree_find_less_equal(tree, &d, p)) {
637 		/* an exact match, fine, because this one does not get
638 		 * processed */
639 		return;
640 	}
641 	/* inexact element, but if NULL, until first element in tree */
642 	if(!*p) {
643 		*p = rbtree_first(tree);
644 		return;
645 	}
646 	/* inexact match, use next element, if possible, the smaller
647 	 * element is part of the range */
648 	*p = rbtree_next(*p);
649 	/* if next returns null, we go until the end of the tree */
650 }
651 
652 /* prehash domains in hash range start to end */
653 static void
654 process_range(zone_type* zone, domain_type* start,
655 	domain_type* end, domain_type* nsec3)
656 {
657 	/* start NULL means from first in tree */
658 	/* end NULL means to last in tree */
659 	rbnode_t *p = RBTREE_NULL, *pwc = RBTREE_NULL, *pds = RBTREE_NULL;
660 	rbnode_t *p_end = RBTREE_NULL, *pwc_end = RBTREE_NULL, *pds_end = RBTREE_NULL;
661 	/* because the nodes are on the prehashlist, the domain->nsec3 is
662 	 * already allocated, and we need not allocate it here */
663 	/* set start */
664 	if(start) {
665 		uint8_t hash[NSEC3_HASH_LEN+1];
666 		parse_nsec3_name(domain_dname(start), hash, sizeof(hash));
667 		/* if exact match on first, set is_exact */
668 		if(process_first(zone->hashtree, hash, &p, init_lookup_key_hash_tree)) {
669 			((domain_type*)(p->key))->nsec3->nsec3_cover = nsec3;
670 			((domain_type*)(p->key))->nsec3->nsec3_is_exact = 1;
671 			p = rbtree_next(p);
672 		}
673 		(void)process_first(zone->wchashtree, hash, &pwc, init_lookup_key_wc_tree);
674 		if(process_first(zone->dshashtree, hash, &pds, init_lookup_key_ds_tree)){
675 			((domain_type*)(pds->key))->nsec3->
676 				nsec3_ds_parent_cover = nsec3;
677 			((domain_type*)(pds->key))->nsec3->
678 				nsec3_ds_parent_is_exact = 1;
679 			pds = rbtree_next(pds);
680 		}
681 	} else {
682 		if(zone->hashtree)
683 			p = rbtree_first(zone->hashtree);
684 		if(zone->wchashtree)
685 			pwc = rbtree_first(zone->wchashtree);
686 		if(zone->dshashtree)
687 			pds = rbtree_first(zone->dshashtree);
688 	}
689 	/* set end */
690 	if(end) {
691 		uint8_t hash[NSEC3_HASH_LEN+1];
692 		parse_nsec3_name(domain_dname(end), hash, sizeof(hash));
693 		process_end(zone->hashtree, hash, &p_end, init_lookup_key_hash_tree);
694 		process_end(zone->wchashtree, hash, &pwc_end, init_lookup_key_wc_tree);
695 		process_end(zone->dshashtree, hash, &pds_end, init_lookup_key_ds_tree);
696 	}
697 
698 	/* precompile */
699 	while(p != RBTREE_NULL && p != p_end) {
700 		((domain_type*)(p->key))->nsec3->nsec3_cover = nsec3;
701 		((domain_type*)(p->key))->nsec3->nsec3_is_exact = 0;
702 		p = rbtree_next(p);
703 	}
704 	while(pwc != RBTREE_NULL && pwc != pwc_end) {
705 		((domain_type*)(pwc->key))->nsec3->
706 			nsec3_wcard_child_cover = nsec3;
707 		pwc = rbtree_next(pwc);
708 	}
709 	while(pds != RBTREE_NULL && pds != pds_end) {
710 		((domain_type*)(pds->key))->nsec3->
711 			nsec3_ds_parent_cover = nsec3;
712 		((domain_type*)(pds->key))->nsec3->
713 			nsec3_ds_parent_is_exact = 0;
714 		pds = rbtree_next(pds);
715 	}
716 }
717 
718 /* prehash a domain from the prehash list */
719 static void
720 process_prehash_domain(domain_type* domain, zone_type* zone)
721 {
722 	/* in the hashtree, wchashtree, dshashtree walk through to next NSEC3
723 	 * and set precompile pointers to point to this domain (or is_exact),
724 	 * the first domain can be is_exact. If it is the last NSEC3, also
725 	 * process the initial part (before the first) */
726 	rbnode_t* nx;
727 
728 	/* this domain is part of the prehash list and therefore the
729 	 * domain->nsec3 is allocated and need not be allocated here */
730 	assert(domain->nsec3 && domain->nsec3->nsec3_node.key);
731 	nx = rbtree_next(&domain->nsec3->nsec3_node);
732 	if(nx != RBTREE_NULL) {
733 		/* process until next nsec3 */
734 		domain_type* end = (domain_type*)nx->key;
735 		process_range(zone, domain, end, domain);
736 	} else {
737 		/* first is root, but then comes the first nsec3 */
738 		domain_type* first = (domain_type*)(rbtree_first(
739 			zone->nsec3tree)->key);
740 		/* last in zone */
741 		process_range(zone, domain, NULL, domain);
742 		/* also process before first in zone */
743 		process_range(zone, NULL, first, domain);
744 	}
745 }
746 
747 void prehash_zone(struct namedb* db, struct zone* zone)
748 {
749 	domain_type* d;
750 	if(!zone->nsec3_param) {
751 		prehash_clear(db->domains);
752 		return;
753 	}
754 	/* process prehash list */
755 	for(d = db->domains->prehash_list; d; d = d->nsec3->prehash_next) {
756 		process_prehash_domain(d, zone);
757 	}
758 	/* clear prehash list */
759 	prehash_clear(db->domains);
760 
761 	if(!check_apex_soa(db, zone)) {
762 		zone->nsec3_param = NULL;
763 		zone->nsec3_last = NULL;
764 	}
765 }
766 
767 /* add the NSEC3 rrset to the query answer at the given domain */
768 static void
769 nsec3_add_rrset(struct query* query, struct answer* answer,
770 	rr_section_type section, struct domain* domain)
771 {
772 	if(domain) {
773 		rrset_type* rrset = domain_find_rrset(domain, query->zone, TYPE_NSEC3);
774 		if(rrset)
775 			answer_add_rrset(answer, section, domain, rrset);
776 	}
777 }
778 
779 /* this routine does hashing at query-time. slow. */
780 static void
781 nsec3_add_nonexist_proof(struct query* query, struct answer* answer,
782         struct domain* encloser, const dname_type* qname)
783 {
784 	uint8_t hash[NSEC3_HASH_LEN];
785 	const dname_type* to_prove;
786 	domain_type* cover=0;
787 	assert(encloser);
788 	/* if query=a.b.c.d encloser=c.d. then proof needed for b.c.d. */
789 	/* if query=a.b.c.d encloser=*.c.d. then proof needed for b.c.d. */
790 	to_prove = dname_partial_copy(query->region, qname,
791 		dname_label_match_count(qname, domain_dname(encloser))+1);
792 	/* generate proof that one label below closest encloser does not exist */
793 	nsec3_hash_and_store(query->zone, to_prove, hash);
794 	if(nsec3_find_cover(query->zone, hash, sizeof(hash), &cover))
795 	{
796 		/* exact match, hash collision */
797 		/* the hashed name of the query corresponds to an existing name. */
798 		log_msg(LOG_ERR, "nsec3 hash collision for name=%s",
799 			dname_to_string(to_prove, NULL));
800 		RCODE_SET(query->packet, RCODE_SERVFAIL);
801 		return;
802 	}
803 	else
804 	{
805 		/* cover proves the qname does not exist */
806 		nsec3_add_rrset(query, answer, AUTHORITY_SECTION, cover);
807 	}
808 }
809 
810 static void
811 nsec3_add_closest_encloser_proof(
812 	struct query* query, struct answer* answer,
813 	struct domain* closest_encloser, const dname_type* qname)
814 {
815 	if(!closest_encloser)
816 		return;
817 	/* prove that below closest encloser nothing exists */
818 	nsec3_add_nonexist_proof(query, answer, closest_encloser, qname);
819 	/* proof that closest encloser exists */
820 	if(closest_encloser->nsec3 && closest_encloser->nsec3->nsec3_is_exact)
821 		nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
822 			closest_encloser->nsec3->nsec3_cover);
823 }
824 
825 void
826 nsec3_answer_wildcard(struct query *query, struct answer *answer,
827         struct domain *wildcard, const dname_type* qname)
828 {
829 	if(!wildcard)
830 		return;
831 	if(!query->zone->nsec3_param)
832 		return;
833 	nsec3_add_nonexist_proof(query, answer, wildcard, qname);
834 }
835 
836 static void
837 nsec3_add_ds_proof(struct query *query, struct answer *answer,
838 	struct domain *domain, int delegpt)
839 {
840 	/* assert we are above the zone cut */
841 	assert(domain != query->zone->apex);
842 	if(domain->nsec3 && domain->nsec3->nsec3_ds_parent_is_exact) {
843 		/* use NSEC3 record from above the zone cut. */
844 		nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
845 			domain->nsec3->nsec3_ds_parent_cover);
846 	} else if (!delegpt && domain->nsec3 && domain->nsec3->nsec3_is_exact) {
847 		nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
848 			domain->nsec3->nsec3_cover);
849 	} else {
850 		/* prove closest provable encloser */
851 		domain_type* par = domain->parent;
852 		domain_type* prev_par = 0;
853 
854 		while(par && (!par->nsec3 || !par->nsec3->nsec3_is_exact))
855 		{
856 			prev_par = par;
857 			par = par->parent;
858 		}
859 		assert(par); /* parent zone apex must be provable, thus this ends */
860 		if(!par->nsec3) return;
861 		nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
862 			par->nsec3->nsec3_cover);
863 		/* we took several steps to go to the provable parent, so
864 		   the one below it has no exact nsec3, disprove it.
865 		   disprove is easy, it has a prehashed cover ptr. */
866 		if(prev_par && prev_par->nsec3) {
867 			assert(prev_par != domain &&
868 				!prev_par->nsec3->nsec3_is_exact);
869 			nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
870 				prev_par->nsec3->nsec3_cover);
871 		}
872 		/* add optout range from parent zone */
873 		/* note: no check of optout bit, resolver checks it */
874 		if(domain->nsec3)
875 			nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
876 				domain->nsec3->nsec3_ds_parent_cover);
877 	}
878 }
879 
880 void
881 nsec3_answer_nodata(struct query* query, struct answer* answer,
882 	struct domain* original)
883 {
884 	if(!query->zone->nsec3_param)
885 		return;
886 	/* nodata when asking for secure delegation */
887 	if(query->qtype == TYPE_DS)
888 	{
889 		if(original == query->zone->apex) {
890 			/* DS at zone apex, but server not authoritative for parent zone */
891 			/* so answer at the child zone level */
892 			if(original->nsec3 && original->nsec3->nsec3_is_exact)
893 				nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
894 					original->nsec3->nsec3_cover);
895 			return;
896 		}
897 		/* query->zone must be the parent zone */
898 		nsec3_add_ds_proof(query, answer, original, 0);
899 	}
900 	/* the nodata is result from a wildcard match */
901 	else if (original==original->wildcard_child_closest_match
902 		&& label_is_wildcard(dname_name(domain_dname(original)))) {
903 		/* denial for wildcard is already there */
904 
905 		/* add parent proof to have a closest encloser proof for wildcard parent */
906 		/* in other words: nsec3 matching closest encloser */
907 		if(original->parent && original->parent->nsec3 &&
908 			original->parent->nsec3->nsec3_is_exact)
909 			nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
910 				original->parent->nsec3->nsec3_cover);
911 		/* proof for wildcard itself */
912 		/* in other words: nsec3 matching source of synthesis */
913 		if(original->nsec3)
914 			nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
915 				original->nsec3->nsec3_cover);
916 	}
917 	else {	/* add nsec3 to prove rrset does not exist */
918 		if(original->nsec3 && original->nsec3->nsec3_is_exact) {
919 			nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
920 				original->nsec3->nsec3_cover);
921 		}
922 	}
923 }
924 
925 void
926 nsec3_answer_delegation(struct query *query, struct answer *answer)
927 {
928 	if(!query->zone->nsec3_param)
929 		return;
930 	nsec3_add_ds_proof(query, answer, query->delegation_domain, 1);
931 }
932 
933 int
934 domain_has_only_NSEC3(struct domain* domain, struct zone* zone)
935 {
936 	/* check for only NSEC3/RRSIG */
937 	rrset_type* rrset = domain->rrsets;
938 	int nsec3_seen = 0;
939 	while(rrset)
940 	{
941 		if(!zone || rrset->zone == zone)
942 		{
943 			if(rrset->rrs[0].type == TYPE_NSEC3)
944 				nsec3_seen = 1;
945 			else if(rrset->rrs[0].type != TYPE_RRSIG)
946 				return 0;
947 		}
948 		rrset = rrset->next;
949 	}
950 	return nsec3_seen;
951 }
952 
953 void
954 nsec3_answer_authoritative(struct domain** match, struct query *query,
955 	struct answer *answer, struct domain* closest_encloser,
956 	const dname_type* qname)
957 {
958 	if(!query->zone->nsec3_param)
959 		return;
960 	assert(match);
961 	/* there is a match, this has 1 RRset, which is NSEC3, but qtype is not. */
962         /* !is_existing: no RR types exist at the QNAME, nor at any descendant of QNAME */
963 	if(*match && !(*match)->is_existing &&
964 #if 0
965 		query->qtype != TYPE_NSEC3 &&
966 #endif
967 		domain_has_only_NSEC3(*match, query->zone))
968 	{
969 		/* act as if the NSEC3 domain did not exist, name error */
970 		*match = 0;
971 		/* all nsec3s are directly below the apex, that is closest encloser */
972 		if(query->zone->apex->nsec3 &&
973 			query->zone->apex->nsec3->nsec3_is_exact)
974 			nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
975 				query->zone->apex->nsec3->nsec3_cover);
976 		/* disprove the nsec3 record. */
977 		if(closest_encloser->nsec3)
978 			nsec3_add_rrset(query, answer, AUTHORITY_SECTION, closest_encloser->nsec3->nsec3_cover);
979 		/* disprove a wildcard */
980 		if(query->zone->apex->nsec3)
981 			nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
982 				query->zone->apex->nsec3->nsec3_wcard_child_cover);
983 		if (domain_wildcard_child(query->zone->apex)) {
984 			/* wildcard exists below the domain */
985 			/* wildcard and nsec3 domain clash. server failure. */
986 			RCODE_SET(query->packet, RCODE_SERVFAIL);
987 		}
988 		return;
989 	}
990 	else if(*match && (*match)->is_existing &&
991 #if 0
992 		query->qtype != TYPE_NSEC3 &&
993 #endif
994 		domain_has_only_NSEC3(*match, query->zone))
995 	{
996 		/* this looks like a NSEC3 domain, but is actually an empty non-terminal. */
997 		nsec3_answer_nodata(query, answer, *match);
998 		return;
999 	}
1000 	if(!*match) {
1001 		/* name error, domain does not exist */
1002 		nsec3_add_closest_encloser_proof(query, answer, closest_encloser,
1003 			qname);
1004 		if(closest_encloser->nsec3)
1005 			nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
1006 				closest_encloser->nsec3->nsec3_wcard_child_cover);
1007 	}
1008 }
1009 
1010 #endif /* NSEC3 */
1011