lib/dns/nsec.c

	nsec.c revision 3398334b3acda24b086957286288ca9852662b12
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt/*
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt *
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt * Permission to use, copy, modify, and/or distribute this software for any
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt * purpose with or without fee is hereby granted, provided that the above
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt * copyright notice and this permission notice appear in all copies.
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt *
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt * PERFORMANCE OF THIS SOFTWARE.
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt */
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt/* $Id: nsec.c,v 1.11 2008/09/25 04:02:38 tbox Exp $ */
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt/*! \file */
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt#include <config.h>
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt#include <isc/string.h>
4a53e3c2b83c476a93148eaee0272649beb221caMark Andrews#include <isc/util.h>
4a53e3c2b83c476a93148eaee0272649beb221caMark Andrews
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt#include <dns/db.h>
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt#include <dns/nsec.h>
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt#include <dns/rdata.h>
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt#include <dns/rdatalist.h>
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt#include <dns/rdataset.h>
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt#include <dns/rdatasetiter.h>
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt#include <dns/rdatastruct.h>
4a53e3c2b83c476a93148eaee0272649beb221caMark Andrews#include <dns/result.h>
4a53e3c2b83c476a93148eaee0272649beb221caMark Andrews
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt#include <dst/dst.h>
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt#define RETERR(x) do { \
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    result = (x); \
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    if (result != ISC_R_SUCCESS) \
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt        goto failure; \
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    } while (0)
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Huntstatic void
ef421f66f47224a42073deaf087378c5d0c9952eEvan Huntset_bit(unsigned char *array, unsigned int index, unsigned int bit) {
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    unsigned int shift, mask;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    shift = 7 - (index % 8);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    mask = 1 << shift;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    if (bit != 0)
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt        array[index / 8] |= mask;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    else
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt        array[index / 8] &= (~mask & 0xFF);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt}
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Huntstatic unsigned int
ef421f66f47224a42073deaf087378c5d0c9952eEvan Huntbit_isset(unsigned char *array, unsigned int index) {
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    unsigned int byte, shift, mask;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    byte = array[index / 8];
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    shift = 7 - (index % 8);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    mask = 1 << shift;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    return ((byte & mask) != 0);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt}
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Huntisc_result_t
ef421f66f47224a42073deaf087378c5d0c9952eEvan Huntdns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version,
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt            dns_dbnode_t *node, dns_name_t *target,
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt            unsigned char *buffer, dns_rdata_t *rdata)
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt{
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    isc_result_t result;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    dns_rdataset_t rdataset;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    isc_region_t r;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    unsigned int i, window;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    int octet;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    unsigned char *nsec_bits, *bm;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    unsigned int max_type;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    dns_rdatasetiter_t *rdsiter;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    memset(buffer, 0, DNS_NSEC_BUFFERSIZE);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    dns_name_toregion(target, &r);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    memcpy(buffer, r.base, r.length);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    r.base = buffer;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    /*
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt     * Use the end of the space for a raw bitmap leaving enough
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt     * space for the window identifiers and length octets.
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt     */
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    bm = r.base + r.length + 512;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    nsec_bits = r.base + r.length;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    set_bit(bm, dns_rdatatype_rrsig, 1);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    set_bit(bm, dns_rdatatype_nsec, 1);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    max_type = dns_rdatatype_nsec;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    dns_rdataset_init(&rdataset);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    rdsiter = NULL;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    if (result != ISC_R_SUCCESS)
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt        return (result);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    for (result = dns_rdatasetiter_first(rdsiter);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt         result == ISC_R_SUCCESS;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt         result = dns_rdatasetiter_next(rdsiter))
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    {
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt        dns_rdatasetiter_current(rdsiter, &rdataset);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt        if (rdataset.type != dns_rdatatype_nsec &&
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt            rdataset.type != dns_rdatatype_nsec3 &&
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt            rdataset.type != dns_rdatatype_rrsig) {
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt            if (rdataset.type > max_type)
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt                max_type = rdataset.type;
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt            set_bit(bm, rdataset.type, 1);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt        }
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt        dns_rdataset_disassociate(&rdataset);
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt    }
ef421f66f47224a42073deaf087378c5d0c9952eEvan Hunt
    /*
     * At zone cuts, deny the existence of glue in the parent zone.
     */
    if (bit_isset(bm, dns_rdatatype_ns) &&
        ! bit_isset(bm, dns_rdatatype_soa)) {
        for (i = 0; i <= max_type; i++) {
            if (bit_isset(bm, i) &&
                ! dns_rdatatype_iszonecutauth((dns_rdatatype_t)i))
                set_bit(bm, i, 0);
        }
    }

    dns_rdatasetiter_destroy(&rdsiter);
    if (result != ISC_R_NOMORE)
        return (result);

    for (window = 0; window < 256; window++) {
        if (window * 256 > max_type)
            break;
        for (octet = 31; octet >= 0; octet--)
            if (bm[window * 32 + octet] != 0)
                break;
        if (octet < 0)
            continue;
        nsec_bits[0] = window;
        nsec_bits[1] = octet + 1;
        /*
         * Note: potential overlapping move.
         */
        memmove(&nsec_bits[2], &bm[window * 32], octet + 1);
        nsec_bits += 3 + octet;
    }
    r.length = nsec_bits - r.base;
    INSIST(r.length <= DNS_NSEC_BUFFERSIZE);
    dns_rdata_fromregion(rdata,
                 dns_db_class(db),
                 dns_rdatatype_nsec,
                 &r);

    return (ISC_R_SUCCESS);
}


isc_result_t
dns_nsec_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
           dns_name_t *target, dns_ttl_t ttl)
{
    isc_result_t result;
    dns_rdata_t rdata = DNS_RDATA_INIT;
    unsigned char data[DNS_NSEC_BUFFERSIZE];
    dns_rdatalist_t rdatalist;
    dns_rdataset_t rdataset;

    dns_rdataset_init(&rdataset);
    dns_rdata_init(&rdata);

    RETERR(dns_nsec_buildrdata(db, version, node, target, data, &rdata));

    rdatalist.rdclass = dns_db_class(db);
    rdatalist.type = dns_rdatatype_nsec;
    rdatalist.covers = 0;
    rdatalist.ttl = ttl;
    ISC_LIST_INIT(rdatalist.rdata);
    ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
    RETERR(dns_rdatalist_tordataset(&rdatalist, &rdataset));
    result = dns_db_addrdataset(db, node, version, 0, &rdataset,
                    0, NULL);
    if (result == DNS_R_UNCHANGED)
        result = ISC_R_SUCCESS;
    RETERR(result);
 failure:
    if (dns_rdataset_isassociated(&rdataset))
        dns_rdataset_disassociate(&rdataset);
    return (result);
}

isc_boolean_t
dns_nsec_typepresent(dns_rdata_t *nsec, dns_rdatatype_t type) {
    dns_rdata_nsec_t nsecstruct;
    isc_result_t result;
    isc_boolean_t present;
    unsigned int i, len, window;

    REQUIRE(nsec != NULL);
    REQUIRE(nsec->type == dns_rdatatype_nsec);

    /* This should never fail */
    result = dns_rdata_tostruct(nsec, &nsecstruct, NULL);
    INSIST(result == ISC_R_SUCCESS);

    present = ISC_FALSE;
    for (i = 0; i < nsecstruct.len; i += len) {
        INSIST(i + 2 <= nsecstruct.len);
        window = nsecstruct.typebits[i];
        len = nsecstruct.typebits[i + 1];
        INSIST(len > 0 && len <= 32);
        i += 2;
        INSIST(i + len <= nsecstruct.len);
        if (window * 256 > type)
            break;
        if ((window + 1) * 256 <= type)
            continue;
        if (type < (window * 256) + len * 8)
            present = ISC_TF(bit_isset(&nsecstruct.typebits[i],
                           type % 256));
        break;
    }
    dns_rdata_freestruct(&nsec);
    return (present);
}

isc_result_t
dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version,
          isc_boolean_t *answer)
{
    dns_dbnode_t *node = NULL;
    dns_rdataset_t rdataset;
    dns_rdata_dnskey_t dnskey;
    isc_result_t result;

    REQUIRE(answer != NULL);

    dns_rdataset_init(&rdataset);

    result = dns_db_getoriginnode(db, &node);
    if (result != ISC_R_SUCCESS)
        return (result);

    result = dns_db_findrdataset(db, node, version, dns_rdatatype_dnskey,
                     0, 0, &rdataset, NULL);
    dns_db_detachnode(db, &node);

    if (result == ISC_R_NOTFOUND) {
        *answer = ISC_FALSE;
        return (ISC_R_SUCCESS);
    }
    if (result != ISC_R_SUCCESS)
        return (result);
    for (result = dns_rdataset_first(&rdataset);
         result == ISC_R_SUCCESS;
         result = dns_rdataset_next(&rdataset)) {
        dns_rdata_t rdata = DNS_RDATA_INIT;

        dns_rdataset_current(&rdataset, &rdata);
        result = dns_rdata_tostruct(&rdata, &dnskey, NULL);
        RUNTIME_CHECK(result == ISC_R_SUCCESS);

        if (dnskey.algorithm == DST_ALG_RSAMD5 ||
            dnskey.algorithm == DST_ALG_RSASHA1 ||
            dnskey.algorithm == DST_ALG_DSA ||
            dnskey.algorithm == DST_ALG_ECC)
            break;
    }
    dns_rdataset_disassociate(&rdataset);
    if (result == ISC_R_SUCCESS)
        *answer = ISC_TRUE;
    if (result == ISC_R_NOMORE) {
        *answer = ISC_FALSE;
        result = ISC_R_SUCCESS;
    }
    return (result);
}