/*

[0] Fix | Delete

* Copyright (C) Internet Systems Consortium, Inc. ("ISC")

[1] Fix | Delete

*

[2] Fix | Delete

* This Source Code Form is subject to the terms of the Mozilla Public

[3] Fix | Delete

* License, v. 2.0. If a copy of the MPL was not distributed with this

[4] Fix | Delete

* file, you can obtain one at https://mozilla.org/MPL/2.0/.

[5] Fix | Delete

*

[6] Fix | Delete

* See the COPYRIGHT file distributed with this work for additional

[7] Fix | Delete

* information regarding copyright ownership.

[8] Fix | Delete

*/

[9] Fix | Delete

[10] Fix | Delete

[11] Fix | Delete

#ifndef DNS_NSEC3_H

[12] Fix | Delete

#define DNS_NSEC3_H 1

[13] Fix | Delete

[14] Fix | Delete

#include <stdbool.h>

[15] Fix | Delete

[16] Fix | Delete

#include <isc/lang.h>

[17] Fix | Delete

#include <isc/iterated_hash.h>

[18] Fix | Delete

[19] Fix | Delete

#include <dns/db.h>

[20] Fix | Delete

#include <dns/diff.h>

[21] Fix | Delete

#include <dns/name.h>

[22] Fix | Delete

#include <dns/rdatastruct.h>

[23] Fix | Delete

#include <dns/types.h>

[24] Fix | Delete

[25] Fix | Delete

#define DNS_NSEC3_SALTSIZE 255

[26] Fix | Delete

#define DNS_NSEC3_MAXITERATIONS 150U

[27] Fix | Delete

[28] Fix | Delete

/*

[29] Fix | Delete

* hash = 1, flags =1, iterations = 2, salt length = 1, salt = 255 (max)

[30] Fix | Delete

* hash length = 1, hash = 255 (max), bitmap = 8192 + 512 (max)

[31] Fix | Delete

*/

[32] Fix | Delete

#define DNS_NSEC3_BUFFERSIZE (6 + 255 + 255 + 8192 + 512)

[33] Fix | Delete

/*

[34] Fix | Delete

* hash = 1, flags = 1, iterations = 2, salt length = 1, salt = 255 (max)

[35] Fix | Delete

*/

[36] Fix | Delete

#define DNS_NSEC3PARAM_BUFFERSIZE (5 + 255)

[37] Fix | Delete

[38] Fix | Delete

/*

[39] Fix | Delete

* Test "unknown" algorithm. Is mapped to dns_hash_sha1.

[40] Fix | Delete

*/

[41] Fix | Delete

#define DNS_NSEC3_UNKNOWNALG ((dns_hash_t)245U)

[42] Fix | Delete

[43] Fix | Delete

ISC_LANG_BEGINDECLS

[44] Fix | Delete

[45] Fix | Delete

isc_result_t

[46] Fix | Delete

dns_nsec3_buildrdata(dns_db_t *db, dns_dbversion_t *version,

[47] Fix | Delete

dns_dbnode_t *node, unsigned int hashalg,

[48] Fix | Delete

unsigned int optin, unsigned int iterations,

[49] Fix | Delete

const unsigned char *salt, size_t salt_length,

[50] Fix | Delete

const unsigned char *nexthash, size_t hash_length,

[51] Fix | Delete

unsigned char *buffer, dns_rdata_t *rdata);

[52] Fix | Delete

/*%<

[53] Fix | Delete

* Build the rdata of a NSEC3 record for the data at 'node'.

[54] Fix | Delete

* Note: 'node' is not the node where the NSEC3 record will be stored.

[55] Fix | Delete

*

[56] Fix | Delete

* Requires:

[57] Fix | Delete

* buffer Points to a temporary buffer of at least

[58] Fix | Delete

* DNS_NSEC_BUFFERSIZE bytes.

[59] Fix | Delete

* rdata Points to an initialized dns_rdata_t.

[60] Fix | Delete

*

[61] Fix | Delete

* Ensures:

[62] Fix | Delete

* *rdata Contains a valid NSEC3 rdata. The 'data' member refers

[63] Fix | Delete

* to 'buffer'.

[64] Fix | Delete

*/

[65] Fix | Delete

[66] Fix | Delete

bool

[67] Fix | Delete

dns_nsec3_typepresent(dns_rdata_t *nsec, dns_rdatatype_t type);

[68] Fix | Delete

/*%<

[69] Fix | Delete

* Determine if a type is marked as present in an NSEC3 record.

[70] Fix | Delete

*

[71] Fix | Delete

* Requires:

[72] Fix | Delete

* 'nsec' points to a valid rdataset of type NSEC3

[73] Fix | Delete

*/

[74] Fix | Delete

[75] Fix | Delete

isc_result_t

[76] Fix | Delete

dns_nsec3_hashname(dns_fixedname_t *result,

[77] Fix | Delete

unsigned char rethash[NSEC3_MAX_HASH_LENGTH],

[78] Fix | Delete

size_t *hash_length, dns_name_t *name, dns_name_t *origin,

[79] Fix | Delete

dns_hash_t hashalg, unsigned int iterations,

[80] Fix | Delete

const unsigned char *salt, size_t saltlength);

[81] Fix | Delete

/*%<

[82] Fix | Delete

* Make a hashed domain name from an unhashed one. If rethash is not NULL

[83] Fix | Delete

* the raw hash is stored there.

[84] Fix | Delete

*/

[85] Fix | Delete

[86] Fix | Delete

unsigned int

[87] Fix | Delete

dns_nsec3_hashlength(dns_hash_t hash);

[88] Fix | Delete

/*%<

[89] Fix | Delete

* Return the length of the hash produced by the specified algorithm

[90] Fix | Delete

* or zero when unknown.

[91] Fix | Delete

*/

[92] Fix | Delete

[93] Fix | Delete

bool

[94] Fix | Delete

dns_nsec3_supportedhash(dns_hash_t hash);

[95] Fix | Delete

/*%<

[96] Fix | Delete

* Return whether we support this hash algorithm or not.

[97] Fix | Delete

*/

[98] Fix | Delete

[99] Fix | Delete

isc_result_t

[100] Fix | Delete

dns_nsec3_addnsec3(dns_db_t *db, dns_dbversion_t *version,

[101] Fix | Delete

dns_name_t *name, const dns_rdata_nsec3param_t *nsec3param,

[102] Fix | Delete

dns_ttl_t nsecttl, bool unsecure, dns_diff_t *diff);

[103] Fix | Delete

[104] Fix | Delete

isc_result_t

[105] Fix | Delete

dns_nsec3_addnsec3s(dns_db_t *db, dns_dbversion_t *version,

[106] Fix | Delete

dns_name_t *name, dns_ttl_t nsecttl,

[107] Fix | Delete

bool unsecure, dns_diff_t *diff);

[108] Fix | Delete

[109] Fix | Delete

isc_result_t

[110] Fix | Delete

dns_nsec3_addnsec3sx(dns_db_t *db, dns_dbversion_t *version,

[111] Fix | Delete

dns_name_t *name, dns_ttl_t nsecttl,

[112] Fix | Delete

bool unsecure, dns_rdatatype_t private,

[113] Fix | Delete

dns_diff_t *diff);

[114] Fix | Delete

/*%<

[115] Fix | Delete

* Add NSEC3 records for 'name', recording the change in 'diff'.

[116] Fix | Delete

* Adjust previous NSEC3 records, if any, to reflect the addition.

[117] Fix | Delete

* The existing NSEC3 records are removed.

[118] Fix | Delete

*

[119] Fix | Delete

* dns_nsec3_addnsec3() will only add records to the chain identified by

[120] Fix | Delete

* 'nsec3param'.

[121] Fix | Delete

*

[122] Fix | Delete

* 'unsecure' should be set to reflect if this is a potentially

[123] Fix | Delete

* unsecure delegation (no DS record).

[124] Fix | Delete

*

[125] Fix | Delete

* dns_nsec3_addnsec3s() will examine the NSEC3PARAM RRset to determine which

[126] Fix | Delete

* chains to be updated. NSEC3PARAM records with the DNS_NSEC3FLAG_CREATE

[127] Fix | Delete

* will be preferentially chosen over NSEC3PARAM records without

[128] Fix | Delete

* DNS_NSEC3FLAG_CREATE set. NSEC3PARAM records with DNS_NSEC3FLAG_REMOVE

[129] Fix | Delete

* set will be ignored by dns_nsec3_addnsec3s(). If DNS_NSEC3FLAG_CREATE

[130] Fix | Delete

* is set then the new NSEC3 will have OPTOUT set to match the that in the

[131] Fix | Delete

* NSEC3PARAM record otherwise OPTOUT will be inherited from the previous

[132] Fix | Delete

* record in the chain.

[133] Fix | Delete

*

[134] Fix | Delete

* dns_nsec3_addnsec3sx() is similar to dns_nsec3_addnsec3s() but 'private'

[135] Fix | Delete

* specifies the type of the private rdataset to be checked in addition to

[136] Fix | Delete

* the nsec3param rdataset at the zone apex.

[137] Fix | Delete

*

[138] Fix | Delete

* Requires:

[139] Fix | Delete

* 'db' to be valid.

[140] Fix | Delete

* 'version' to be valid or NULL.

[141] Fix | Delete

* 'name' to be valid.

[142] Fix | Delete

* 'nsec3param' to be valid.

[143] Fix | Delete

* 'diff' to be valid.

[144] Fix | Delete

*/

[145] Fix | Delete

[146] Fix | Delete

isc_result_t

[147] Fix | Delete

dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,

[148] Fix | Delete

const dns_rdata_nsec3param_t *nsec3param, dns_diff_t *diff);

[149] Fix | Delete

[150] Fix | Delete

isc_result_t

[151] Fix | Delete

dns_nsec3_delnsec3s(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,

[152] Fix | Delete

dns_diff_t *diff);

[153] Fix | Delete

[154] Fix | Delete

isc_result_t

[155] Fix | Delete

dns_nsec3_delnsec3sx(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,

[156] Fix | Delete

dns_rdatatype_t private, dns_diff_t *diff);

[157] Fix | Delete

/*%<

[158] Fix | Delete

* Remove NSEC3 records for 'name', recording the change in 'diff'.

[159] Fix | Delete

* Adjust previous NSEC3 records, if any, to reflect the removal.

[160] Fix | Delete

*

[161] Fix | Delete

* dns_nsec3_delnsec3() performs the above for the chain identified by

[162] Fix | Delete

* 'nsec3param'.

[163] Fix | Delete

*

[164] Fix | Delete

* dns_nsec3_delnsec3s() examines the NSEC3PARAM RRset in a similar manner

[165] Fix | Delete

* to dns_nsec3_addnsec3s(). Unlike dns_nsec3_addnsec3s() updated NSEC3

[166] Fix | Delete

* records have the OPTOUT flag preserved.

[167] Fix | Delete

*

[168] Fix | Delete

* dns_nsec3_delnsec3sx() is similar to dns_nsec3_delnsec3s() but 'private'

[169] Fix | Delete

* specifies the type of the private rdataset to be checked in addition to

[170] Fix | Delete

* the nsec3param rdataset at the zone apex.

[171] Fix | Delete

*

[172] Fix | Delete

* Requires:

[173] Fix | Delete

* 'db' to be valid.

[174] Fix | Delete

* 'version' to be valid or NULL.

[175] Fix | Delete

* 'name' to be valid.

[176] Fix | Delete

* 'nsec3param' to be valid.

[177] Fix | Delete

* 'diff' to be valid.

[178] Fix | Delete

*/

[179] Fix | Delete

[180] Fix | Delete

isc_result_t

[181] Fix | Delete

dns_nsec3_active(dns_db_t *db, dns_dbversion_t *version,

[182] Fix | Delete

bool complete, bool *answer);

[183] Fix | Delete

[184] Fix | Delete

isc_result_t

[185] Fix | Delete

dns_nsec3_activex(dns_db_t *db, dns_dbversion_t *version,

[186] Fix | Delete

bool complete, dns_rdatatype_t private,

[187] Fix | Delete

bool *answer);

[188] Fix | Delete

/*%<

[189] Fix | Delete

* Check if there are any complete/to be built NSEC3 chains.

[190] Fix | Delete

* If 'complete' is true only complete chains will be recognized.

[191] Fix | Delete

*

[192] Fix | Delete

* dns_nsec3_activex() is similar to dns_nsec3_active() but 'private'

[193] Fix | Delete

* specifies the type of the private rdataset to be checked in addition to

[194] Fix | Delete

* the nsec3param rdataset at the zone apex.

[195] Fix | Delete

*

[196] Fix | Delete

* Requires:

[197] Fix | Delete

* 'db' to be valid.

[198] Fix | Delete

* 'version' to be valid or NULL.

[199] Fix | Delete

* 'answer' to be non NULL.

[200] Fix | Delete

*/

[201] Fix | Delete

[202] Fix | Delete

unsigned int

[203] Fix | Delete

dns_nsec3_maxiterations(void);

[204] Fix | Delete

/*%<

[205] Fix | Delete

* Return the maximum permissible number of NSEC3 iterations.

[206] Fix | Delete

*/

[207] Fix | Delete

[208] Fix | Delete

bool

[209] Fix | Delete

dns_nsec3param_fromprivate(dns_rdata_t *src, dns_rdata_t *target,

[210] Fix | Delete

unsigned char *buf, size_t buflen);

[211] Fix | Delete

/*%<

[212] Fix | Delete

* Convert a private rdata to a nsec3param rdata.

[213] Fix | Delete

*

[214] Fix | Delete

* Return true if 'src' could be successfully converted.

[215] Fix | Delete

*

[216] Fix | Delete

* 'buf' should be at least DNS_NSEC3PARAM_BUFFERSIZE in size.

[217] Fix | Delete

*/

[218] Fix | Delete

[219] Fix | Delete

void

[220] Fix | Delete

dns_nsec3param_toprivate(dns_rdata_t *src, dns_rdata_t *target,

[221] Fix | Delete

dns_rdatatype_t privatetype,

[222] Fix | Delete

unsigned char *buf, size_t buflen);

[223] Fix | Delete

/*%<

[224] Fix | Delete

* Convert a nsec3param rdata to a private rdata.

[225] Fix | Delete

*

[226] Fix | Delete

* 'buf' should be at least src->length + 1 in size.

[227] Fix | Delete

*/

[228] Fix | Delete

[229] Fix | Delete

isc_result_t

[230] Fix | Delete

dns_nsec3param_salttotext(dns_rdata_nsec3param_t *nsec3param, char *dst,

[231] Fix | Delete

size_t dstlen);

[232] Fix | Delete

/*%<

[233] Fix | Delete

* Convert the salt of given NSEC3PARAM RDATA into hex-encoded, NULL-terminated

[234] Fix | Delete

* text stored at "dst".

[235] Fix | Delete

*

[236] Fix | Delete

* Requires:

[237] Fix | Delete

*

[238] Fix | Delete

*\li "dst" to have enough space (as indicated by "dstlen") to hold the

[239] Fix | Delete

* resulting text and its NULL-terminating byte.

[240] Fix | Delete

*/

[241] Fix | Delete

[242] Fix | Delete

isc_result_t

[243] Fix | Delete

dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver,

[244] Fix | Delete

dns_zone_t *zone, bool nonsec,

[245] Fix | Delete

dns_diff_t *diff);

[246] Fix | Delete

[247] Fix | Delete

/*%<

[248] Fix | Delete

* Mark NSEC3PARAM for deletion.

[249] Fix | Delete

*/

[250] Fix | Delete

[251] Fix | Delete

isc_result_t

[252] Fix | Delete

dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,

[253] Fix | Delete

dns_name_t *nsec3name, dns_rdataset_t *nsec3set,

[254] Fix | Delete

dns_name_t *zonename, bool *exists,

[255] Fix | Delete

bool *data, bool *optout,

[256] Fix | Delete

bool *unknown, bool *setclosest,

[257] Fix | Delete

bool *setnearest, dns_name_t *closest,

[258] Fix | Delete

dns_name_t *nearest, dns_nseclog_t logit, void *arg);

[259] Fix | Delete

[260] Fix | Delete

ISC_LANG_ENDDECLS

[261] Fix | Delete

[262] Fix | Delete

#endif /* DNS_NSEC3_H */

[263] Fix | Delete

[264] Fix | Delete