/*

[0] Fix | Delete

* Copyright (C) Internet Systems Consortium, Inc. ("ISC")

[1] Fix | Delete

*

[2] Fix | Delete

* This Source Code Form is subject to the terms of the Mozilla Public

[3] Fix | Delete

* License, v. 2.0. If a copy of the MPL was not distributed with this

[4] Fix | Delete

* file, you can obtain one at https://mozilla.org/MPL/2.0/.

[5] Fix | Delete

*

[6] Fix | Delete

* See the COPYRIGHT file distributed with this work for additional

[7] Fix | Delete

* information regarding copyright ownership.

[8] Fix | Delete

*/

[9] Fix | Delete

[10] Fix | Delete

[11] Fix | Delete

#ifndef DNS_VALIDATOR_H

[12] Fix | Delete

#define DNS_VALIDATOR_H 1

[13] Fix | Delete

[14] Fix | Delete

/*****

[15] Fix | Delete

***** Module Info

[16] Fix | Delete

*****/

[17] Fix | Delete

[18] Fix | Delete

/*! \file dns/validator.h

[19] Fix | Delete

*

[20] Fix | Delete

* \brief

[21] Fix | Delete

* DNS Validator

[22] Fix | Delete

* This is the BIND 9 validator, the module responsible for validating the

[23] Fix | Delete

* rdatasets and negative responses (messages). It makes use of zones in

[24] Fix | Delete

* the view and may fetch RRset to complete trust chains. It implements

[25] Fix | Delete

* DNSSEC as specified in RFC 4033, 4034 and 4035.

[26] Fix | Delete

*

[27] Fix | Delete

* It can also optionally implement ISC's DNSSEC look-aside validation.

[28] Fix | Delete

*

[29] Fix | Delete

* Correct operation is critical to preventing spoofed answers from secure

[30] Fix | Delete

* zones being accepted.

[31] Fix | Delete

*

[32] Fix | Delete

* MP:

[33] Fix | Delete

*\li The module ensures appropriate synchronization of data structures it

[34] Fix | Delete

* creates and manipulates.

[35] Fix | Delete

*

[36] Fix | Delete

* Reliability:

[37] Fix | Delete

*\li No anticipated impact.

[38] Fix | Delete

*

[39] Fix | Delete

* Resources:

[40] Fix | Delete

*\li TBS

[41] Fix | Delete

*

[42] Fix | Delete

* Security:

[43] Fix | Delete

*\li No anticipated impact.

[44] Fix | Delete

*

[45] Fix | Delete

* Standards:

[46] Fix | Delete

*\li RFCs: 1034, 1035, 2181, 4033, 4034, 4035.

[47] Fix | Delete

*/

[48] Fix | Delete

[49] Fix | Delete

#include <stdbool.h>

[50] Fix | Delete

[51] Fix | Delete

#include <isc/lang.h>

[52] Fix | Delete

#include <isc/event.h>

[53] Fix | Delete

#include <isc/mutex.h>

[54] Fix | Delete

[55] Fix | Delete

#include <dns/fixedname.h>

[56] Fix | Delete

#include <dns/types.h>

[57] Fix | Delete

#include <dns/rdataset.h>

[58] Fix | Delete

#include <dns/rdatastruct.h> /* for dns_rdata_rrsig_t */

[59] Fix | Delete

[60] Fix | Delete

#include <dst/dst.h>

[61] Fix | Delete

[62] Fix | Delete

/*%

[63] Fix | Delete

* A dns_validatorevent_t is sent when a 'validation' completes.

[64] Fix | Delete

* \brief

[65] Fix | Delete

* 'name', 'rdataset', 'sigrdataset', and 'message' are the values that were

[66] Fix | Delete

* supplied when dns_validator_create() was called. They are returned to the

[67] Fix | Delete

* caller so that they may be freed.

[68] Fix | Delete

*

[69] Fix | Delete

* If the RESULT is ISC_R_SUCCESS and the answer is secure then

[70] Fix | Delete

* proofs[] will contain the names of the NSEC records that hold the

[71] Fix | Delete

* various proofs. Note the same name may appear multiple times.

[72] Fix | Delete

*/

[73] Fix | Delete

typedef struct dns_validatorevent {

[74] Fix | Delete

ISC_EVENT_COMMON(struct dns_validatorevent);

[75] Fix | Delete

dns_validator_t * validator;

[76] Fix | Delete

isc_result_t result;

[77] Fix | Delete

/*

[78] Fix | Delete

* Name and type of the response to be validated.

[79] Fix | Delete

*/

[80] Fix | Delete

dns_name_t * name;

[81] Fix | Delete

dns_rdatatype_t type;

[82] Fix | Delete

/*

[83] Fix | Delete

* Rdata and RRSIG (if any) for positive responses.

[84] Fix | Delete

*/

[85] Fix | Delete

dns_rdataset_t * rdataset;

[86] Fix | Delete

dns_rdataset_t * sigrdataset;

[87] Fix | Delete

/*

[88] Fix | Delete

* The full response. Required for negative responses.

[89] Fix | Delete

* Also required for positive wildcard responses.

[90] Fix | Delete

*/

[91] Fix | Delete

dns_message_t * message;

[92] Fix | Delete

/*

[93] Fix | Delete

* Proofs to be cached.

[94] Fix | Delete

*/

[95] Fix | Delete

dns_name_t * proofs[4];

[96] Fix | Delete

/*

[97] Fix | Delete

* Optout proof seen.

[98] Fix | Delete

*/

[99] Fix | Delete

bool optout;

[100] Fix | Delete

/*

[101] Fix | Delete

* Answer is secure.

[102] Fix | Delete

*/

[103] Fix | Delete

bool secure;

[104] Fix | Delete

} dns_validatorevent_t;

[105] Fix | Delete

[106] Fix | Delete

#define DNS_VALIDATOR_NOQNAMEPROOF 0

[107] Fix | Delete

#define DNS_VALIDATOR_NODATAPROOF 1

[108] Fix | Delete

#define DNS_VALIDATOR_NOWILDCARDPROOF 2

[109] Fix | Delete

#define DNS_VALIDATOR_CLOSESTENCLOSER 3

[110] Fix | Delete

[111] Fix | Delete

/*%

[112] Fix | Delete

* A validator object represents a validation in progress.

[113] Fix | Delete

* \brief

[114] Fix | Delete

* Clients are strongly discouraged from using this type directly, with

[115] Fix | Delete

* the exception of the 'link' field, which may be used directly for

[116] Fix | Delete

* whatever purpose the client desires.

[117] Fix | Delete

*/

[118] Fix | Delete

struct dns_validator {

[119] Fix | Delete

/* Unlocked. */

[120] Fix | Delete

unsigned int magic;

[121] Fix | Delete

isc_mutex_t lock;

[122] Fix | Delete

dns_view_t * view;

[123] Fix | Delete

/* Locked by lock. */

[124] Fix | Delete

unsigned int options;

[125] Fix | Delete

unsigned int attributes;

[126] Fix | Delete

dns_validatorevent_t * event;

[127] Fix | Delete

dns_fetch_t * fetch;

[128] Fix | Delete

dns_validator_t * subvalidator;

[129] Fix | Delete

dns_validator_t * parent;

[130] Fix | Delete

dns_keytable_t * keytable;

[131] Fix | Delete

dns_keynode_t * keynode;

[132] Fix | Delete

dst_key_t * key;

[133] Fix | Delete

dns_rdata_rrsig_t * siginfo;

[134] Fix | Delete

isc_task_t * task;

[135] Fix | Delete

isc_taskaction_t action;

[136] Fix | Delete

void * arg;

[137] Fix | Delete

unsigned int labels;

[138] Fix | Delete

dns_rdataset_t * currentset;

[139] Fix | Delete

bool seensig;

[140] Fix | Delete

dns_rdataset_t * keyset;

[141] Fix | Delete

dns_rdataset_t * dsset;

[142] Fix | Delete

dns_rdataset_t * soaset;

[143] Fix | Delete

dns_rdataset_t * nsecset;

[144] Fix | Delete

dns_rdataset_t * nsec3set;

[145] Fix | Delete

dns_name_t * soaname;

[146] Fix | Delete

dns_rdataset_t frdataset;

[147] Fix | Delete

dns_rdataset_t fsigrdataset;

[148] Fix | Delete

dns_fixedname_t fname;

[149] Fix | Delete

dns_fixedname_t wild;

[150] Fix | Delete

dns_fixedname_t nearest;

[151] Fix | Delete

dns_fixedname_t closest;

[152] Fix | Delete

ISC_LINK(dns_validator_t) link;

[153] Fix | Delete

dns_rdataset_t dlv;

[154] Fix | Delete

dns_fixedname_t dlvsep;

[155] Fix | Delete

bool havedlvsep;

[156] Fix | Delete

bool mustbesecure;

[157] Fix | Delete

unsigned int dlvlabels;

[158] Fix | Delete

unsigned int depth;

[159] Fix | Delete

unsigned int authcount;

[160] Fix | Delete

unsigned int authfail;

[161] Fix | Delete

bool failed;

[162] Fix | Delete

isc_stdtime_t start;

[163] Fix | Delete

};

[164] Fix | Delete

[165] Fix | Delete

/*%

[166] Fix | Delete

* dns_validator_create() options.

[167] Fix | Delete

*/

[168] Fix | Delete

#define DNS_VALIDATOR_DLV 0x0001U

[169] Fix | Delete

#define DNS_VALIDATOR_DEFER 0x0002U

[170] Fix | Delete

#define DNS_VALIDATOR_NOCDFLAG 0x0004U

[171] Fix | Delete

#define DNS_VALIDATOR_NONTA 0x0008U /*% Ignore NTA table */

[172] Fix | Delete

[173] Fix | Delete

ISC_LANG_BEGINDECLS

[174] Fix | Delete

[175] Fix | Delete

isc_result_t

[176] Fix | Delete

dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,

[177] Fix | Delete

dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,

[178] Fix | Delete

dns_message_t *message, unsigned int options,

[179] Fix | Delete

isc_task_t *task, isc_taskaction_t action, void *arg,

[180] Fix | Delete

dns_validator_t **validatorp);

[181] Fix | Delete

/*%<

[182] Fix | Delete

* Start a DNSSEC validation.

[183] Fix | Delete

*

[184] Fix | Delete

* This validates a response to the question given by

[185] Fix | Delete

* 'name' and 'type'.

[186] Fix | Delete

*

[187] Fix | Delete

* To validate a positive response, the response data is

[188] Fix | Delete

* given by 'rdataset' and 'sigrdataset'. If 'sigrdataset'

[189] Fix | Delete

* is NULL, the data is presumed insecure and an attempt

[190] Fix | Delete

* is made to prove its insecurity by finding the appropriate

[191] Fix | Delete

* null key.

[192] Fix | Delete

*

[193] Fix | Delete

* The complete response message may be given in 'message',

[194] Fix | Delete

* to make available any authority section NSECs that may be

[195] Fix | Delete

* needed for validation of a response resulting from a

[196] Fix | Delete

* wildcard expansion (though no such wildcard validation

[197] Fix | Delete

* is implemented yet). If the complete response message

[198] Fix | Delete

* is not available, 'message' is NULL.

[199] Fix | Delete

*

[200] Fix | Delete

* To validate a negative response, the complete negative response

[201] Fix | Delete

* message is given in 'message'. The 'rdataset', and

[202] Fix | Delete

* 'sigrdataset' arguments must be NULL, but the 'name' and 'type'

[203] Fix | Delete

* arguments must be provided.

[204] Fix | Delete

*

[205] Fix | Delete

* The validation is performed in the context of 'view'.

[206] Fix | Delete

*

[207] Fix | Delete

* When the validation finishes, a dns_validatorevent_t with

[208] Fix | Delete

* the given 'action' and 'arg' are sent to 'task'.

[209] Fix | Delete

* Its 'result' field will be ISC_R_SUCCESS iff the

[210] Fix | Delete

* response was successfully proven to be either secure or

[211] Fix | Delete

* part of a known insecure domain.

[212] Fix | Delete

*

[213] Fix | Delete

* options:

[214] Fix | Delete

* If DNS_VALIDATOR_DLV is set the caller knows there is not a

[215] Fix | Delete

* trusted key and the validator should immediately attempt to validate

[216] Fix | Delete

* the answer by looking for an appropriate DLV RRset.

[217] Fix | Delete

*/

[218] Fix | Delete

[219] Fix | Delete

void

[220] Fix | Delete

dns_validator_send(dns_validator_t *validator);

[221] Fix | Delete

/*%<

[222] Fix | Delete

* Send a deferred validation request

[223] Fix | Delete

*

[224] Fix | Delete

* Requires:

[225] Fix | Delete

* 'validator' to points to a valid DNSSEC validator.

[226] Fix | Delete

*/

[227] Fix | Delete

[228] Fix | Delete

void

[229] Fix | Delete

dns_validator_cancel(dns_validator_t *validator);

[230] Fix | Delete

/*%<

[231] Fix | Delete

* Cancel a DNSSEC validation in progress.

[232] Fix | Delete

*

[233] Fix | Delete

* Requires:

[234] Fix | Delete

*\li 'validator' points to a valid DNSSEC validator, which

[235] Fix | Delete

* may or may not already have completed.

[236] Fix | Delete

*

[237] Fix | Delete

* Ensures:

[238] Fix | Delete

*\li It the validator has not already sent its completion

[239] Fix | Delete

* event, it will send it with result code ISC_R_CANCELED.

[240] Fix | Delete

*/

[241] Fix | Delete

[242] Fix | Delete

void

[243] Fix | Delete

dns_validator_destroy(dns_validator_t **validatorp);

[244] Fix | Delete

/*%<

[245] Fix | Delete

* Destroy a DNSSEC validator.

[246] Fix | Delete

*

[247] Fix | Delete

* Requires:

[248] Fix | Delete

*\li '*validatorp' points to a valid DNSSEC validator.

[249] Fix | Delete

* \li The validator must have completed and sent its completion

[250] Fix | Delete

* event.

[251] Fix | Delete

*

[252] Fix | Delete

* Ensures:

[253] Fix | Delete

*\li All resources used by the validator are freed.

[254] Fix | Delete

*/

[255] Fix | Delete

[256] Fix | Delete

ISC_LANG_ENDDECLS

[257] Fix | Delete

[258] Fix | Delete

#endif /* DNS_VALIDATOR_H */

[259] Fix | Delete

[260] Fix | Delete