]>
Commit | Line | Data |
---|---|---|
12471842 PL |
1 | /* |
2 | * This file is part of PowerDNS or dnsdist. | |
3 | * Copyright -- PowerDNS.COM B.V. and its contributors | |
4 | * | |
5 | * This program is free software; you can redistribute it and/or modify | |
6 | * it under the terms of version 2 of the GNU General Public License as | |
7 | * published by the Free Software Foundation. | |
8 | * | |
9 | * In addition, for the avoidance of any doubt, permission is granted to | |
10 | * link this program with OpenSSL and to (re)distribute the binaries | |
11 | * produced as the result of such linking. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU General Public License | |
19 | * along with this program; if not, write to the Free Software | |
20 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | |
21 | */ | |
243f4780 | 22 | #pragma once |
23 | ||
24 | #include "dnsparser.hh" | |
25 | #include "dnsname.hh" | |
26 | #include <vector> | |
27 | #include "namespaces.hh" | |
28 | #include "dnsrecords.hh" | |
29 | ||
3e9c6c0a | 30 | extern bool g_dnssecLOG; |
575925ef | 31 | extern time_t g_signatureInceptionSkew; |
d377bb54 | 32 | extern uint16_t g_maxNSEC3Iterations; |
3e9c6c0a | 33 | |
243f4780 | 34 | // 4033 5 |
895449a5 | 35 | enum vState { Indeterminate, Bogus, Insecure, Secure, NTA, TA }; |
243f4780 | 36 | extern const char *vStates[]; |
37 | ||
38 | // NSEC(3) results | |
ff30823a | 39 | enum dState { NODATA, NXDOMAIN, NXQTYPE, ENT, INSECURE, OPTOUT}; |
243f4780 | 40 | extern const char *dStates[]; |
41 | ||
243f4780 | 42 | class DNSRecordOracle |
43 | { | |
44 | public: | |
45 | virtual std::vector<DNSRecord> get(const DNSName& qname, uint16_t qtype)=0; | |
46 | }; | |
47 | ||
48 | ||
49 | struct ContentSigPair | |
50 | { | |
51 | vector<shared_ptr<DNSRecordContent>> records; | |
52 | vector<shared_ptr<RRSIGRecordContent>> signatures; | |
53 | // ponder adding a validate method that accepts a key | |
54 | }; | |
55 | typedef map<pair<DNSName,uint16_t>, ContentSigPair> cspmap_t; | |
64a4a928 | 56 | typedef std::set<DSRecordContent> dsmap_t; |
243f4780 | 57 | |
4d2be65d RG |
58 | struct sharedDNSKeyRecordContentCompare |
59 | { | |
60 | bool operator() (const shared_ptr<DNSKEYRecordContent>& a, const shared_ptr<DNSKEYRecordContent>& b) const | |
61 | { | |
62 | return *a < *b; | |
63 | } | |
64 | }; | |
65 | ||
66 | typedef set<shared_ptr<DNSKEYRecordContent>, sharedDNSKeyRecordContentCompare > skeyset_t; | |
67 | ||
68 | bool validateWithKeySet(time_t now, const DNSName& name, const vector<shared_ptr<DNSRecordContent> >& records, const vector<shared_ptr<RRSIGRecordContent> >& signatures, const skeyset_t& keys, bool validateAllSigs=true); | |
69 | void validateWithKeySet(const cspmap_t& rrsets, cspmap_t& validated, const skeyset_t& keys); | |
70 | cspmap_t harvestCSPFromRecs(const vector<DNSRecord>& recs); | |
71 | vState getKeysFor(DNSRecordOracle& dro, const DNSName& zone, skeyset_t& keyset); | |
72 | bool getTrustAnchor(const map<DNSName,dsmap_t>& anchors, const DNSName& zone, dsmap_t &res); | |
73 | bool haveNegativeTrustAnchor(const map<DNSName,std::string>& negAnchors, const DNSName& zone, std::string& reason); | |
74 | void validateDNSKeysAgainstDS(time_t now, const DNSName& zone, const dsmap_t& dsmap, const skeyset_t& tkeys, vector<shared_ptr<DNSRecordContent> >& toSign, const vector<shared_ptr<RRSIGRecordContent> >& sigs, skeyset_t& validkeys); | |
6bc9ccbb | 75 | dState getDenial(const cspmap_t &validrrsets, const DNSName& qname, const uint16_t qtype, bool referralToUnsigned, bool wantsNoDataProof, bool needsWildcardProof=true, unsigned int wildcardLabelsCount=0); |
8455425c | 76 | bool isSupportedDS(const DSRecordContent& ds); |
895449a5 | 77 | DNSName getSigner(const std::vector<std::shared_ptr<RRSIGRecordContent> >& signatures); |
5374b03b | 78 | bool denialProvesNoDelegation(const DNSName& zone, const std::vector<DNSRecord>& dsrecords); |
dbbef467 | 79 | bool isRRSIGNotExpired(const time_t now, const shared_ptr<RRSIGRecordContent> sig); |