pdns/dnssecinfra.hh

   1 /*
   2  * This file is part of PowerDNS or dnsdist.
   3  * Copyright -- PowerDNS.COM B.V. and its contributors
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * In addition, for the avoidance of any doubt, permission is granted to
  10  * link this program with OpenSSL and to (re)distribute the binaries
  11  * produced as the result of such linking.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22 #ifndef PDNS_DNSSECINFRA_HH
  23 #define PDNS_DNSSECINFRA_HH
  24
  25 #include "dnsrecords.hh"
  26
  27 #include <string>
  28 #include <vector>
  29 #include <map>
  30 #include "misc.hh"
  31
  32 class UeberBackend;
  33
  34 // rules of the road: Algorithm must be set in 'make' for each KeyEngine, and will NEVER change!
  35
  36 class DNSCryptoKeyEngine
  37 {
  38   public:
  39     explicit DNSCryptoKeyEngine(unsigned int algorithm) : d_algorithm(algorithm) {}
  40     virtual ~DNSCryptoKeyEngine() {};
  41     virtual string getName() const = 0;
  42
  43     typedef std::map<std::string, std::string> stormap_t;
  44     typedef std::vector<std::pair<std::string, std::string > > storvector_t;
  45     virtual void create(unsigned int bits)=0;
  46     virtual storvector_t convertToISCVector() const =0;
  47     std::string convertToISC() const ;
  48     virtual std::string sign(const std::string& msg) const =0;
  49     virtual std::string hash(const std::string& msg) const
  50     {
  51        throw std::runtime_error("hash() function not implemented");
  52        return msg;
  53     }
  54     virtual bool verify(const std::string& msg, const std::string& signature) const =0;
  55
  56     virtual std::string getPubKeyHash()const =0;
  57     virtual std::string getPublicKeyString()const =0;
  58     virtual int getBits() const =0;
  59     virtual unsigned int getAlgorithm() const
  60     {
  61       return d_algorithm;
  62     }
  63
  64     virtual void fromISCMap(DNSKEYRecordContent& drc, stormap_t& stormap)=0;
  65     virtual void fromPEMString(DNSKEYRecordContent& drc, const std::string& raw)
  66     {
  67       throw std::runtime_error("Can't import from PEM string");
  68     }
  69     virtual void fromPublicKeyString(const std::string& content) = 0;
  70     virtual bool checkKey(vector<string> *errorMessages = nullptr) const
  71     {
  72       return true;
  73     }
  74     static shared_ptr<DNSCryptoKeyEngine> makeFromISCFile(DNSKEYRecordContent& drc, const char* fname);
  75     static shared_ptr<DNSCryptoKeyEngine> makeFromISCString(DNSKEYRecordContent& drc, const std::string& content);
  76     static shared_ptr<DNSCryptoKeyEngine> makeFromPEMString(DNSKEYRecordContent& drc, const std::string& raw);
  77     static shared_ptr<DNSCryptoKeyEngine> makeFromPublicKeyString(unsigned int algorithm, const std::string& raw);
  78     static shared_ptr<DNSCryptoKeyEngine> make(unsigned int algorithm);
  79     static bool isAlgorithmSupported(unsigned int algo);
  80     static bool isDigestSupported(uint8_t digest);
  81
  82     typedef shared_ptr<DNSCryptoKeyEngine> maker_t(unsigned int algorithm);
  83
  84     static void report(unsigned int algorithm, maker_t* maker, bool fallback=false);
  85     static std::pair<unsigned int, unsigned int> testMakers(unsigned int algorithm, maker_t* creator, maker_t* signer, maker_t* verifier);
  86     static vector<pair<uint8_t, string>> listAllAlgosWithBackend();
  87     static bool testAll();
  88     static bool testOne(int algo);
  89   private:
  90
  91     typedef std::map<unsigned int, maker_t*> makers_t;
  92     typedef std::map<unsigned int, vector<maker_t*> > allmakers_t;
  93     static makers_t& getMakers()
  94     {
  95       static makers_t s_makers;
  96       return s_makers;
  97     }
  98     static allmakers_t& getAllMakers()
  99     {
 100       static allmakers_t s_allmakers;
 101       return s_allmakers;
 102     }
 103   protected:
 104     const unsigned int d_algorithm;
 105 };
 106
 107 struct DNSSECPrivateKey
 108 {
 109   uint16_t getTag() const
 110   {
 111     return getDNSKEY().getTag();
 112   }
 113
 114   const shared_ptr<DNSCryptoKeyEngine> getKey() const
 115   {
 116     return d_key;
 117   }
 118
 119   void setKey(const shared_ptr<DNSCryptoKeyEngine> key)
 120   {
 121     d_key = key;
 122     d_algorithm = key->getAlgorithm();
 123   }
 124   DNSKEYRecordContent getDNSKEY() const;
 125
 126   uint16_t d_flags;
 127   uint8_t d_algorithm;
 128
 129 private:
 130   shared_ptr<DNSCryptoKeyEngine> d_key;
 131 };
 132
 133
 134
 135 struct CanonicalCompare: public std::binary_function<string, string, bool>
 136 {
 137   bool operator()(const std::string& a, const std::string& b) {
 138     std::vector<std::string> avect, bvect;
 139
 140     stringtok(avect, a, ".");
 141     stringtok(bvect, b, ".");
 142
 143     reverse(avect.begin(), avect.end());
 144     reverse(bvect.begin(), bvect.end());
 145
 146     return avect < bvect;
 147   }
 148 };
 149
 150 string getMessageForRRSET(const DNSName& qname, const RRSIGRecordContent& rrc, std::vector<std::shared_ptr<DNSRecordContent> >& signRecords, bool processRRSIGLabels = false);
 151
 152 DSRecordContent makeDSFromDNSKey(const DNSName& qname, const DNSKEYRecordContent& drc, uint8_t digest);
 153
 154 class DNSSECKeeper;
 155
 156 uint32_t getStartOfWeek();
 157
 158 string hashQNameWithSalt(const NSEC3PARAMRecordContent& ns3prc, const DNSName& qname);
 159 string hashQNameWithSalt(const std::string& salt, unsigned int iterations, const DNSName& qname);
 160
 161 void incrementHash(std::string& raw);
 162 void decrementHash(std::string& raw);
 163
 164 void addRRSigs(DNSSECKeeper& dk, UeberBackend& db, const std::set<DNSName>& authMap, vector<DNSZoneRecord>& rrs);
 165
 166 void addTSIG(DNSPacketWriter& pw, TSIGRecordContent& trc, const DNSName& tsigkeyname, const string& tsigsecret, const string& tsigprevious, bool timersonly);
 167 bool validateTSIG(const std::string& packet, size_t sigPos, const TSIGTriplet& tt, const TSIGRecordContent& trc, const std::string& previousMAC, const std::string& theirMAC, bool timersOnly, unsigned int dnsHeaderOffset=0);
 168
 169 uint64_t signatureCacheSize(const std::string& str);
 170 #endif