pdns/validate.hh

   1 /*
   2  * This file is part of PowerDNS or dnsdist.
   3  * Copyright -- PowerDNS.COM B.V. and its contributors
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * In addition, for the avoidance of any doubt, permission is granted to
  10  * link this program with OpenSSL and to (re)distribute the binaries
  11  * produced as the result of such linking.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22 #pragma once
  23
  24 #include "dnsparser.hh"
  25 #include "dnsname.hh"
  26 #include <vector>
  27 #include "namespaces.hh"
  28 #include "dnsrecords.hh"
  29 #include "dnssecinfra.hh"
  30 #include "logger.hh"
  31
  32 extern time_t g_signatureInceptionSkew;
  33 extern uint16_t g_maxNSEC3Iterations;
  34
  35 // 4033 5
  36 enum class vState : uint8_t { Indeterminate, Insecure, Secure, NTA, TA, BogusNoValidDNSKEY, BogusInvalidDenial, BogusUnableToGetDSs, BogusUnableToGetDNSKEYs, BogusSelfSignedDS, BogusNoRRSIG, BogusNoValidRRSIG, BogusMissingNegativeIndication, BogusSignatureNotYetValid, BogusSignatureExpired, BogusUnsupportedDNSKEYAlgo, BogusUnsupportedDSDigestType, BogusNoZoneKeyBitSet, BogusRevokedDNSKEY, BogusInvalidDNSKEYProtocol };
  37 const std::string& vStateToString(vState state);
  38 inline bool vStateIsBogus(vState state)
  39 {
  40   return state >= vState::BogusNoValidDNSKEY;
  41 }
  42
  43 // NSEC(3) results
  44 enum class dState : uint8_t { NODENIAL, INCONCLUSIVE, NXDOMAIN, NXQTYPE, ENT, INSECURE, OPTOUT};
  45
  46 std::ostream& operator<<(std::ostream &, vState);
  47 std::ostream& operator<<(std::ostream &, dState);
  48
  49 class DNSRecordOracle
  50 {
  51 public:
  52   virtual ~DNSRecordOracle() = default;
  53   DNSRecordOracle(const DNSRecordOracle&) = default;
  54   DNSRecordOracle(DNSRecordOracle&&) = default;
  55   DNSRecordOracle& operator=(const DNSRecordOracle&) = default;
  56   DNSRecordOracle& operator=(DNSRecordOracle&&) = default;
  57   virtual std::vector<DNSRecord> get(const DNSName& qname, uint16_t qtype) = 0;
  58 };
  59
  60
  61 struct ContentSigPair
  62 {
  63   sortedRecords_t records;
  64   vector<shared_ptr<const RRSIGRecordContent>> signatures;
  65   // ponder adding a validate method that accepts a key
  66 };
  67 using cspmap_t = map<pair<DNSName, uint16_t>, ContentSigPair>;
  68 using dsmap_t = std::set<DSRecordContent>;
  69
  70 struct sharedDNSKeyRecordContentCompare
  71 {
  72   bool operator() (const shared_ptr<const DNSKEYRecordContent>& lhs, const shared_ptr<const DNSKEYRecordContent>& rhs) const
  73   {
  74     return *lhs < *rhs;
  75   }
  76 };
  77
  78 using skeyset_t = set<shared_ptr<const DNSKEYRecordContent>, sharedDNSKeyRecordContentCompare>;
  79
  80
  81 vState validateWithKeySet(time_t now, const DNSName& name, const sortedRecords_t& toSign, const vector<shared_ptr<const RRSIGRecordContent> >& signatures, const skeyset_t& keys, const OptLog& log, bool validateAllSigs=true);
  82 bool isCoveredByNSEC(const DNSName& name, const DNSName& begin, const DNSName& next);
  83 bool isCoveredByNSEC3Hash(const std::string& hash, const std::string& beginHash, const std::string& nextHash);
  84 bool isCoveredByNSEC3Hash(const DNSName& name, const DNSName& beginHash, const DNSName& nextHash);
  85 cspmap_t harvestCSPFromRecs(const vector<DNSRecord>& recs);
  86 bool getTrustAnchor(const map<DNSName,dsmap_t>& anchors, const DNSName& zone, dsmap_t &res);
  87 bool haveNegativeTrustAnchor(const map<DNSName,std::string>& negAnchors, const DNSName& zone, std::string& reason);
  88 vState validateDNSKeysAgainstDS(time_t now, const DNSName& zone, const dsmap_t& dsmap, const skeyset_t& tkeys, const sortedRecords_t& toSign, const vector<shared_ptr<const RRSIGRecordContent> >& sigs, skeyset_t& validkeys, const OptLog&);
  89 dState getDenial(const cspmap_t &validrrsets, const DNSName& qname, uint16_t qtype, bool referralToUnsigned, bool wantsNoDataProof, const OptLog& log = std::nullopt, bool needWildcardProof=true, unsigned int wildcardLabelsCount=0);
  90 bool isSupportedDS(const DSRecordContent& dsRecordContent, const OptLog&);
  91 DNSName getSigner(const std::vector<std::shared_ptr<const RRSIGRecordContent> >& signatures);
  92 bool denialProvesNoDelegation(const DNSName& zone, const std::vector<DNSRecord>& dsrecords);
  93 bool isRRSIGNotExpired(time_t now, const RRSIGRecordContent& sig);
  94 bool isRRSIGIncepted(time_t now, const RRSIGRecordContent& sig);
  95 bool isWildcardExpanded(unsigned int labelCount, const RRSIGRecordContent& sign);
  96 bool isWildcardExpandedOntoItself(const DNSName& owner, unsigned int labelCount, const RRSIGRecordContent& sign);
  97 void updateDNSSECValidationState(vState& state, vState stateUpdate);
  98
  99 dState matchesNSEC(const DNSName& name, uint16_t qtype, const DNSName& nsecOwner, const NSECRecordContent& nsec, const std::vector<std::shared_ptr<const RRSIGRecordContent>>& signatures, const OptLog&);
 100
 101 bool isNSEC3AncestorDelegation(const DNSName& signer, const DNSName& owner, const NSEC3RecordContent& nsec3);
 102 DNSName getNSECOwnerName(const DNSName& initialOwner, const std::vector<std::shared_ptr<const RRSIGRecordContent> >& signatures);
 103 DNSName getClosestEncloserFromNSEC(const DNSName& name, const DNSName& owner, const DNSName& next);
 104
 105 template <typename NSEC> bool isTypeDenied(const NSEC& nsec, const QType& type)
 106 {
 107   if (nsec.isSet(type.getCode())) {
 108     return false;
 109   }
 110
 111   /* RFC 6840 section 4.3 */
 112   if (nsec.isSet(QType::CNAME)) {
 113     return false;
 114   }
 115
 116   return true;
 117 }