]>
Commit | Line | Data |
---|---|---|
7263f724 ZJS |
1 | /*** |
2 | This file is part of systemd. | |
3 | ||
4 | Copyright 2014 Zbigniew Jędrzejewski-Szmek | |
5 | ||
6 | systemd is free software; you can redistribute it and/or modify it | |
7 | under the terms of the GNU Lesser General Public License as published by | |
8 | the Free Software Foundation; either version 2.1 of the License, or | |
9 | (at your option) any later version. | |
10 | ||
11 | systemd is distributed in the hope that it will be useful, but | |
12 | WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
14 | Lesser General Public License for more details. | |
15 | ||
16 | You should have received a copy of the GNU Lesser General Public License | |
17 | along with systemd; If not, see <http://www.gnu.org/licenses/>. | |
18 | ***/ | |
19 | ||
d07b43a1 LP |
20 | #include <sys/socket.h> |
21 | ||
7263f724 | 22 | #include "dns-type.h" |
869b3b67 | 23 | #include "parse-util.h" |
4b548ef3 | 24 | #include "string-util.h" |
7263f724 ZJS |
25 | |
26 | typedef const struct { | |
27 | uint16_t type; | |
28 | const char *name; | |
29 | } dns_type; | |
30 | ||
31 | static const struct dns_type_name * | |
c9f7b4d3 | 32 | lookup_dns_type (register const char *str, register GPERF_LEN_TYPE len); |
7263f724 ZJS |
33 | |
34 | #include "dns_type-from-name.h" | |
35 | #include "dns_type-to-name.h" | |
36 | ||
de292aa1 | 37 | int dns_type_from_string(const char *s) { |
7263f724 ZJS |
38 | const struct dns_type_name *sc; |
39 | ||
40 | assert(s); | |
7263f724 ZJS |
41 | |
42 | sc = lookup_dns_type(s, strlen(s)); | |
869b3b67 ZJS |
43 | if (sc) |
44 | return sc->id; | |
7263f724 | 45 | |
869b3b67 ZJS |
46 | s = startswith_no_case(s, "TYPE"); |
47 | if (s) { | |
48 | unsigned x; | |
49 | ||
50 | if (safe_atou(s, &x) >= 0 && | |
51 | x <= UINT16_MAX) | |
52 | return (int) x; | |
53 | } | |
54 | ||
55 | return _DNS_TYPE_INVALID; | |
7263f724 | 56 | } |
8e6edc49 | 57 | |
bea4c76f LP |
58 | bool dns_type_is_pseudo(uint16_t type) { |
59 | ||
60 | /* Checks whether the specified type is a "pseudo-type". What | |
61 | * a "pseudo-type" precisely is, is defined only very weakly, | |
62 | * but apparently entails all RR types that are not actually | |
63 | * stored as RRs on the server and should hence also not be | |
64 | * cached. We use this list primarily to validate NSEC type | |
c33be4a6 | 65 | * bitfields, and to verify what to cache. */ |
bea4c76f LP |
66 | |
67 | return IN_SET(type, | |
68 | 0, /* A Pseudo RR type, according to RFC 2931 */ | |
69 | DNS_TYPE_ANY, | |
70 | DNS_TYPE_AXFR, | |
71 | DNS_TYPE_IXFR, | |
72 | DNS_TYPE_OPT, | |
73 | DNS_TYPE_TSIG, | |
74 | DNS_TYPE_TKEY | |
75 | ); | |
8e6edc49 | 76 | } |
c463eb78 | 77 | |
4b548ef3 LP |
78 | bool dns_class_is_pseudo(uint16_t class) { |
79 | return class == DNS_TYPE_ANY; | |
80 | } | |
81 | ||
c463eb78 LP |
82 | bool dns_type_is_valid_query(uint16_t type) { |
83 | ||
84 | /* The types valid as questions in packets */ | |
85 | ||
86 | return !IN_SET(type, | |
87 | 0, | |
88 | DNS_TYPE_OPT, | |
89 | DNS_TYPE_TSIG, | |
04680e36 LP |
90 | DNS_TYPE_TKEY, |
91 | ||
92 | /* RRSIG are technically valid as questions, but we refuse doing explicit queries for them, as | |
93 | * they aren't really payload, but signatures for payload, and cannot be validated on their | |
94 | * own. After all they are the signatures, and have no signatures of their own validating | |
95 | * them. */ | |
96 | DNS_TYPE_RRSIG); | |
c463eb78 LP |
97 | } |
98 | ||
6ebd1e33 LP |
99 | bool dns_type_is_zone_transer(uint16_t type) { |
100 | ||
101 | /* Zone transfers, either normal or incremental */ | |
102 | ||
103 | return IN_SET(type, | |
104 | DNS_TYPE_AXFR, | |
105 | DNS_TYPE_IXFR); | |
106 | } | |
107 | ||
c463eb78 LP |
108 | bool dns_type_is_valid_rr(uint16_t type) { |
109 | ||
110 | /* The types valid as RR in packets (but not necessarily | |
111 | * stored on servers). */ | |
112 | ||
113 | return !IN_SET(type, | |
114 | DNS_TYPE_ANY, | |
115 | DNS_TYPE_AXFR, | |
116 | DNS_TYPE_IXFR); | |
117 | } | |
4b548ef3 LP |
118 | |
119 | bool dns_class_is_valid_rr(uint16_t class) { | |
120 | return class != DNS_CLASS_ANY; | |
121 | } | |
122 | ||
d3c7e913 LP |
123 | bool dns_type_may_redirect(uint16_t type) { |
124 | /* The following record types should never be redirected using | |
125 | * CNAME/DNAME RRs. See | |
126 | * <https://tools.ietf.org/html/rfc4035#section-2.5>. */ | |
127 | ||
128 | if (dns_type_is_pseudo(type)) | |
129 | return false; | |
130 | ||
131 | return !IN_SET(type, | |
132 | DNS_TYPE_CNAME, | |
133 | DNS_TYPE_DNAME, | |
134 | DNS_TYPE_NSEC3, | |
135 | DNS_TYPE_NSEC, | |
136 | DNS_TYPE_RRSIG, | |
137 | DNS_TYPE_NXT, | |
138 | DNS_TYPE_SIG, | |
139 | DNS_TYPE_KEY); | |
140 | } | |
141 | ||
e8233bce LP |
142 | bool dns_type_may_wildcard(uint16_t type) { |
143 | ||
144 | /* The following records may not be expanded from wildcard RRsets */ | |
145 | ||
146 | if (dns_type_is_pseudo(type)) | |
147 | return false; | |
148 | ||
149 | return !IN_SET(type, | |
150 | DNS_TYPE_NSEC3, | |
151 | DNS_TYPE_SOA, | |
152 | ||
153 | /* Prohibited by https://tools.ietf.org/html/rfc4592#section-4.4 */ | |
154 | DNS_TYPE_DNAME); | |
155 | } | |
156 | ||
588c53d0 LP |
157 | bool dns_type_apex_only(uint16_t type) { |
158 | ||
159 | /* Returns true for all RR types that may only appear signed in a zone apex */ | |
160 | ||
161 | return IN_SET(type, | |
162 | DNS_TYPE_SOA, | |
163 | DNS_TYPE_NS, /* this one can appear elsewhere, too, but not signed */ | |
164 | DNS_TYPE_DNSKEY, | |
165 | DNS_TYPE_NSEC3PARAM); | |
166 | } | |
167 | ||
91adc4db LP |
168 | bool dns_type_is_dnssec(uint16_t type) { |
169 | return IN_SET(type, | |
170 | DNS_TYPE_DS, | |
171 | DNS_TYPE_DNSKEY, | |
172 | DNS_TYPE_RRSIG, | |
173 | DNS_TYPE_NSEC, | |
174 | DNS_TYPE_NSEC3, | |
175 | DNS_TYPE_NSEC3PARAM); | |
176 | } | |
177 | ||
d0129ddb LP |
178 | bool dns_type_is_obsolete(uint16_t type) { |
179 | return IN_SET(type, | |
180 | /* Obsoleted by RFC 973 */ | |
181 | DNS_TYPE_MD, | |
182 | DNS_TYPE_MF, | |
183 | DNS_TYPE_MAILA, | |
184 | ||
185 | /* Kinda obsoleted by RFC 2505 */ | |
186 | DNS_TYPE_MB, | |
187 | DNS_TYPE_MG, | |
188 | DNS_TYPE_MR, | |
189 | DNS_TYPE_MINFO, | |
190 | DNS_TYPE_MAILB, | |
191 | ||
192 | /* RFC1127 kinda obsoleted this by recommending against its use */ | |
193 | DNS_TYPE_WKS, | |
194 | ||
195 | /* Declared historical by RFC 6563 */ | |
196 | DNS_TYPE_A6, | |
197 | ||
198 | /* Obsoleted by DNSSEC-bis */ | |
199 | DNS_TYPE_NXT, | |
200 | ||
201 | /* RFC 1035 removed support for concepts that needed this from RFC 883 */ | |
202 | DNS_TYPE_NULL); | |
203 | } | |
204 | ||
41815a4a LP |
205 | bool dns_type_needs_authentication(uint16_t type) { |
206 | ||
207 | /* Returns true for all (non-obsolete) RR types where records are not useful if they aren't | |
208 | * authenticated. I.e. everything that contains crypto keys. */ | |
209 | ||
210 | return IN_SET(type, | |
211 | DNS_TYPE_CERT, | |
212 | DNS_TYPE_SSHFP, | |
213 | DNS_TYPE_IPSECKEY, | |
214 | DNS_TYPE_DS, | |
215 | DNS_TYPE_DNSKEY, | |
216 | DNS_TYPE_TLSA, | |
217 | DNS_TYPE_CDNSKEY, | |
218 | DNS_TYPE_OPENPGPKEY, | |
219 | DNS_TYPE_CAA); | |
220 | } | |
221 | ||
d07b43a1 LP |
222 | int dns_type_to_af(uint16_t t) { |
223 | switch (t) { | |
224 | ||
225 | case DNS_TYPE_A: | |
226 | return AF_INET; | |
227 | ||
228 | case DNS_TYPE_AAAA: | |
229 | return AF_INET6; | |
230 | ||
231 | case DNS_TYPE_ANY: | |
232 | return AF_UNSPEC; | |
233 | ||
234 | default: | |
235 | return -EINVAL; | |
236 | } | |
237 | } | |
238 | ||
4b548ef3 LP |
239 | const char *dns_class_to_string(uint16_t class) { |
240 | ||
241 | switch (class) { | |
242 | ||
243 | case DNS_CLASS_IN: | |
244 | return "IN"; | |
245 | ||
246 | case DNS_CLASS_ANY: | |
247 | return "ANY"; | |
248 | } | |
249 | ||
250 | return NULL; | |
251 | } | |
252 | ||
253 | int dns_class_from_string(const char *s) { | |
254 | ||
255 | if (!s) | |
256 | return _DNS_CLASS_INVALID; | |
257 | ||
258 | if (strcaseeq(s, "IN")) | |
259 | return DNS_CLASS_IN; | |
260 | else if (strcaseeq(s, "ANY")) | |
261 | return DNS_CLASS_ANY; | |
262 | ||
263 | return _DNS_CLASS_INVALID; | |
264 | } | |
cfb90da3 ZJS |
265 | |
266 | const char* tlsa_cert_usage_to_string(uint8_t cert_usage) { | |
fb8a9fc9 LP |
267 | |
268 | switch (cert_usage) { | |
269 | ||
270 | case 0: | |
271 | return "CA constraint"; | |
272 | ||
273 | case 1: | |
274 | return "Service certificate constraint"; | |
275 | ||
276 | case 2: | |
277 | return "Trust anchor assertion"; | |
278 | ||
279 | case 3: | |
280 | return "Domain-issued certificate"; | |
281 | ||
282 | case 4 ... 254: | |
283 | return "Unassigned"; | |
284 | ||
285 | case 255: | |
286 | return "Private use"; | |
cfb90da3 | 287 | } |
fb8a9fc9 LP |
288 | |
289 | return NULL; /* clang cannot count that we covered everything */ | |
cfb90da3 ZJS |
290 | } |
291 | ||
292 | const char* tlsa_selector_to_string(uint8_t selector) { | |
fb8a9fc9 LP |
293 | switch (selector) { |
294 | ||
295 | case 0: | |
296 | return "Full Certificate"; | |
297 | ||
298 | case 1: | |
299 | return "SubjectPublicKeyInfo"; | |
300 | ||
301 | case 2 ... 254: | |
302 | return "Unassigned"; | |
303 | ||
304 | case 255: | |
305 | return "Private use"; | |
cfb90da3 | 306 | } |
fb8a9fc9 LP |
307 | |
308 | return NULL; | |
cfb90da3 ZJS |
309 | } |
310 | ||
311 | const char* tlsa_matching_type_to_string(uint8_t selector) { | |
fb8a9fc9 LP |
312 | |
313 | switch (selector) { | |
314 | ||
315 | case 0: | |
316 | return "No hash used"; | |
317 | ||
318 | case 1: | |
319 | return "SHA-256"; | |
320 | ||
321 | case 2: | |
322 | return "SHA-512"; | |
323 | ||
324 | case 3 ... 254: | |
325 | return "Unassigned"; | |
326 | ||
327 | case 255: | |
328 | return "Private use"; | |
cfb90da3 | 329 | } |
fb8a9fc9 LP |
330 | |
331 | return NULL; | |
cfb90da3 | 332 | } |