]>
Commit | Line | Data |
---|---|---|
12471842 PL |
1 | /* |
2 | * This file is part of PowerDNS or dnsdist. | |
3 | * Copyright -- PowerDNS.COM B.V. and its contributors | |
4 | * | |
5 | * This program is free software; you can redistribute it and/or modify | |
6 | * it under the terms of version 2 of the GNU General Public License as | |
7 | * published by the Free Software Foundation. | |
8 | * | |
9 | * In addition, for the avoidance of any doubt, permission is granted to | |
10 | * link this program with OpenSSL and to (re)distribute the binaries | |
11 | * produced as the result of such linking. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU General Public License | |
19 | * along with this program; if not, write to the Free Software | |
20 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | |
21 | */ | |
243f4780 | 22 | #pragma once |
23 | ||
24 | #include "dnsparser.hh" | |
25 | #include "dnsname.hh" | |
26 | #include <vector> | |
27 | #include "namespaces.hh" | |
28 | #include "dnsrecords.hh" | |
c1e7b833 | 29 | #include "dnssecinfra.hh" |
243f4780 | 30 | |
3e9c6c0a | 31 | extern bool g_dnssecLOG; |
9a3ab3e4 | 32 | extern time_t g_signatureInceptionSkew; |
d377bb54 | 33 | extern uint16_t g_maxNSEC3Iterations; |
3e9c6c0a | 34 | |
243f4780 | 35 | // 4033 5 |
895449a5 | 36 | enum vState { Indeterminate, Bogus, Insecure, Secure, NTA, TA }; |
243f4780 | 37 | extern const char *vStates[]; |
38 | ||
39 | // NSEC(3) results | |
ff30823a | 40 | enum dState { NODATA, NXDOMAIN, NXQTYPE, ENT, INSECURE, OPTOUT}; |
243f4780 | 41 | extern const char *dStates[]; |
42 | ||
243f4780 | 43 | class DNSRecordOracle |
44 | { | |
45 | public: | |
46 | virtual std::vector<DNSRecord> get(const DNSName& qname, uint16_t qtype)=0; | |
47 | }; | |
48 | ||
49 | ||
50 | struct ContentSigPair | |
51 | { | |
c1e7b833 | 52 | sortedRecords_t records; |
243f4780 | 53 | vector<shared_ptr<RRSIGRecordContent>> signatures; |
54 | // ponder adding a validate method that accepts a key | |
55 | }; | |
56 | typedef map<pair<DNSName,uint16_t>, ContentSigPair> cspmap_t; | |
64a4a928 | 57 | typedef std::set<DSRecordContent> dsmap_t; |
243f4780 | 58 | |
4d2be65d RG |
59 | struct sharedDNSKeyRecordContentCompare |
60 | { | |
61 | bool operator() (const shared_ptr<DNSKEYRecordContent>& a, const shared_ptr<DNSKEYRecordContent>& b) const | |
62 | { | |
63 | return *a < *b; | |
64 | } | |
65 | }; | |
66 | ||
67 | typedef set<shared_ptr<DNSKEYRecordContent>, sharedDNSKeyRecordContentCompare > skeyset_t; | |
68 | ||
c1e7b833 | 69 | bool validateWithKeySet(time_t now, const DNSName& name, const sortedRecords_t& records, const vector<shared_ptr<RRSIGRecordContent> >& signatures, const skeyset_t& keys, bool validateAllSigs=true); |
4d2be65d RG |
70 | void validateWithKeySet(const cspmap_t& rrsets, cspmap_t& validated, const skeyset_t& keys); |
71 | cspmap_t harvestCSPFromRecs(const vector<DNSRecord>& recs); | |
72 | vState getKeysFor(DNSRecordOracle& dro, const DNSName& zone, skeyset_t& keyset); | |
73 | bool getTrustAnchor(const map<DNSName,dsmap_t>& anchors, const DNSName& zone, dsmap_t &res); | |
74 | bool haveNegativeTrustAnchor(const map<DNSName,std::string>& negAnchors, const DNSName& zone, std::string& reason); | |
c1e7b833 | 75 | void validateDNSKeysAgainstDS(time_t now, const DNSName& zone, const dsmap_t& dsmap, const skeyset_t& tkeys, const sortedRecords_t& toSign, const vector<shared_ptr<RRSIGRecordContent> >& sigs, skeyset_t& validkeys); |
e4894ce0 | 76 | dState getDenial(const cspmap_t &validrrsets, const DNSName& qname, const uint16_t qtype, bool referralToUnsigned, bool wantsNoDataProof, bool needsWildcardProof=true, unsigned int wildcardLabelsCount=0); |
8455425c | 77 | bool isSupportedDS(const DSRecordContent& ds); |
895449a5 | 78 | DNSName getSigner(const std::vector<std::shared_ptr<RRSIGRecordContent> >& signatures); |
5374b03b | 79 | bool denialProvesNoDelegation(const DNSName& zone, const std::vector<DNSRecord>& dsrecords); |
dbbef467 | 80 | bool isRRSIGNotExpired(const time_t now, const shared_ptr<RRSIGRecordContent> sig); |
78cdf520 RG |
81 | bool isWildcardExpanded(unsigned int labelCount, const std::shared_ptr<RRSIGRecordContent>& sign); |
82 | bool isWildcardExpandedOntoItself(const DNSName& owner, unsigned int labelCount, const std::shared_ptr<RRSIGRecordContent>& sign); |