2 * This file is part of PowerDNS or dnsdist.
3 * Copyright -- PowerDNS.COM B.V. and its contributors
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of version 2 of the GNU General Public License as
7 * published by the Free Software Foundation.
9 * In addition, for the avoidance of any doubt, permission is granted to
10 * link this program with OpenSSL and to (re)distribute the binaries
11 * produced as the result of such linking.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22 #ifndef PDNS_DNSSECINFRA_HH
23 #define PDNS_DNSSECINFRA_HH
25 #include "dnsrecords.hh"
34 // rules of the road: Algorithm must be set in 'make' for each KeyEngine, and will NEVER change!
36 class DNSCryptoKeyEngine
39 explicit DNSCryptoKeyEngine(unsigned int algorithm) : d_algorithm(algorithm) {}
40 virtual ~DNSCryptoKeyEngine() {};
41 virtual string getName() const = 0;
43 typedef std::map<std::string, std::string> stormap_t;
44 typedef std::vector<std::pair<std::string, std::string > > storvector_t;
45 virtual void create(unsigned int bits)=0;
46 virtual storvector_t convertToISCVector() const =0;
47 std::string convertToISC() const ;
48 virtual std::string sign(const std::string& msg) const =0;
49 virtual std::string hash(const std::string& msg) const
51 throw std::runtime_error("hash() function not implemented");
54 virtual bool verify(const std::string& msg, const std::string& signature) const =0;
56 virtual std::string getPubKeyHash()const =0;
57 virtual std::string getPublicKeyString()const =0;
58 virtual int getBits() const =0;
59 virtual unsigned int getAlgorithm() const
64 virtual void fromISCMap(DNSKEYRecordContent& drc, stormap_t& stormap)=0;
65 virtual void fromPEMString(DNSKEYRecordContent& drc, const std::string& raw)
67 throw std::runtime_error("Can't import from PEM string");
69 virtual void fromPublicKeyString(const std::string& content) = 0;
70 virtual bool checkKey() const
74 static shared_ptr<DNSCryptoKeyEngine> makeFromISCFile(DNSKEYRecordContent& drc, const char* fname);
75 static shared_ptr<DNSCryptoKeyEngine> makeFromISCString(DNSKEYRecordContent& drc, const std::string& content);
76 static shared_ptr<DNSCryptoKeyEngine> makeFromPEMString(DNSKEYRecordContent& drc, const std::string& raw);
77 static shared_ptr<DNSCryptoKeyEngine> makeFromPublicKeyString(unsigned int algorithm, const std::string& raw);
78 static shared_ptr<DNSCryptoKeyEngine> make(unsigned int algorithm);
79 static bool isAlgorithmSupported(unsigned int algo);
80 static bool isDigestSupported(uint8_t digest);
82 typedef shared_ptr<DNSCryptoKeyEngine> maker_t(unsigned int algorithm);
84 static void report(unsigned int algorithm, maker_t* maker, bool fallback=false);
85 static std::pair<unsigned int, unsigned int> testMakers(unsigned int algorithm, maker_t* creator, maker_t* signer, maker_t* verifier);
86 static vector<pair<uint8_t, string>> listAllAlgosWithBackend();
87 static bool testAll();
88 static bool testOne(int algo);
91 typedef std::map<unsigned int, maker_t*> makers_t;
92 typedef std::map<unsigned int, vector<maker_t*> > allmakers_t;
93 static makers_t& getMakers()
95 static makers_t s_makers;
98 static allmakers_t& getAllMakers()
100 static allmakers_t s_allmakers;
104 const unsigned int d_algorithm;
107 struct DNSSECPrivateKey
109 uint16_t getTag() const
111 return getDNSKEY().getTag();
114 const shared_ptr<DNSCryptoKeyEngine> getKey() const
119 void setKey(const shared_ptr<DNSCryptoKeyEngine> key)
122 d_algorithm = key->getAlgorithm();
124 DNSKEYRecordContent getDNSKEY() const;
130 shared_ptr<DNSCryptoKeyEngine> d_key;
135 struct CanonicalCompare: public std::binary_function<string, string, bool>
137 bool operator()(const std::string& a, const std::string& b) {
138 std::vector<std::string> avect, bvect;
140 stringtok(avect, a, ".");
141 stringtok(bvect, b, ".");
143 reverse(avect.begin(), avect.end());
144 reverse(bvect.begin(), bvect.end());
146 return avect < bvect;
150 string getMessageForRRSET(const DNSName& qname, const RRSIGRecordContent& rrc, std::vector<std::shared_ptr<DNSRecordContent> >& signRecords, bool processRRSIGLabels = false);
152 DSRecordContent makeDSFromDNSKey(const DNSName& qname, const DNSKEYRecordContent& drc, uint8_t digest);
156 uint32_t getStartOfWeek();
158 string hashQNameWithSalt(const NSEC3PARAMRecordContent& ns3prc, const DNSName& qname);
159 string hashQNameWithSalt(const std::string& salt, unsigned int iterations, const DNSName& qname);
161 void incrementHash(std::string& raw);
162 void decrementHash(std::string& raw);
164 void addRRSigs(DNSSECKeeper& dk, UeberBackend& db, const std::set<DNSName>& authMap, vector<DNSZoneRecord>& rrs);
166 void addTSIG(DNSPacketWriter& pw, TSIGRecordContent& trc, const DNSName& tsigkeyname, const string& tsigsecret, const string& tsigprevious, bool timersonly);
167 bool validateTSIG(const std::string& packet, size_t sigPos, const TSIGTriplet& tt, const TSIGRecordContent& trc, const std::string& previousMAC, const std::string& theirMAC, bool timersOnly, unsigned int dnsHeaderOffset=0);
169 uint64_t signatureCacheSize(const std::string& str);