mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

rebase NSEC3 code

Browse Source
This commit is contained in:
Mark Andrews
2008-04-04 05:34:07 +00:00
parent c4fadc8861
commit 77abeb5330
7 changed files with 1373 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

105
lib/dns/include/dns/nsec3.h Normal file
View File

@@ -0,0 +1,105 @@
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: nsec3.h,v 1.2 2008/04/04 05:34:05 marka Exp $ */
#ifndef DNS_NSEC3_H
#define DNS_NSEC3_H 1
#include <isc/lang.h>
#include <isc/iterated_hash.h>
#include <dns/types.h>
#include <dns/name.h>
/*
* hash = 1, iterations + optin = 3, salt length = 1, salt = 255 (max)
* hash length = 1, hash = 255 (max), bitmap = 8192 + 512 (max)
*/
#define DNS_NSEC3_BUFFERSIZE (6 + 255 + 255 + 8192 + 512)
/*
* Test "unknown" algorithm. Is mapped to dns_hash_sha1.
*/
#define DNS_NSEC3_UNKNOWNALG 245U
ISC_LANG_BEGINDECLS
isc_result_t
dns_nsec3_buildrdata(dns_db_t *db, dns_dbversion_t *version,
dns_dbnode_t *node, unsigned int hashalg,
unsigned int optin, unsigned int iterations,
const unsigned char *salt, size_t salt_length,
const unsigned char *nexthash, size_t hash_length,
unsigned char *buffer, dns_rdata_t *rdata);
/*
* Build the rdata of a NSEC3 record.
*
* Requires:
* buffer Points to a temporary buffer of at least
* DNS_NSEC_BUFFERSIZE bytes.
* rdata Points to an initialized dns_rdata_t.
*
* Ensures:
* *rdata Contains a valid NSEC rdata. The 'data' member refers
* to 'buffer'.
*/
isc_result_t
dns_nsec3_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
int auth_only, const char *salt, size_t salt_length,
int iterations, dns_ttl_t ttl);
/*
* Build an NSEC3 record and add it to a database.
*/
isc_boolean_t
dns_nsec3_typepresent(dns_rdata_t *nsec, dns_rdatatype_t type);
/*
* Determine if a type is marked as present in an NSEC3 record.
*
* Requires:
* 'nsec' points to a valid rdataset of type NSEC3
*/
isc_result_t
dns_nsec3_hashname(dns_fixedname_t *result,
unsigned char rethash[NSEC3_MAX_HASH_LENGTH],
size_t *hash_length, dns_name_t *name, dns_name_t *origin,
dns_hash_t hashalg, unsigned int iterations,
const unsigned char *salt, size_t saltlength);
/*
* Make a hashed domain name from an unhashed one. If rethash is not NULL
* the raw hash is stored there.
*/
unsigned int
dns_nsec3_hashlength(dns_hash_t hash);
/*
* Return the length of the hash produced by the specified algorithm
* or zero when unknown.
*/
isc_boolean_t
dns_nsec3_supportedhash(dns_hash_t hash);
/*
* Return whether we support this hash algorithm or not.
*/
ISC_LANG_ENDDECLS
#endif /* DNS_NSEC2_H */

477
lib/dns/rdata/generic/nsec3_50.c Normal file
View File

@@ -0,0 +1,477 @@
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
/*
* Copyright (C) 2004 Nominet, Ltd.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND NOMINET DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
#ifndef RDATA_GENERIC_NSEC3_50_C
#define RDATA_GENERIC_NSEC3_50_C
#include <isc/iterated_hash.h>
#include <isc/base32.h>
#define RRTYPE_NSEC3_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC|DNS_RDATATYPEATTR_SINGLETON)
static inline isc_result_t
fromtext_nsec3(ARGS_FROMTEXT) {
isc_token_t token;
unsigned char bm[8*1024]; /* 64k bits */
dns_rdatatype_t covered;
int octet;
int window;
unsigned int optout;
unsigned char hashalg;
isc_buffer_t b;
REQUIRE(type == 50);
UNUSED(type);
UNUSED(rdclass);
UNUSED(callbacks);
UNUSED(origin);
UNUSED(options);
/* Hash. */
RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
ISC_FALSE));
RETTOK(dns_hashalg_fromtext(&hashalg, &token.value.as_textregion));
RETERR(uint8_tobuffer(hashalg, target));
/* Opt-in flag. */
RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
ISC_FALSE));
optout = token.value.as_ulong;
if (optout != 0 && optout != 1)
RETTOK(ISC_R_RANGE);
/* Iterations. */
RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
ISC_FALSE));
if (token.value.as_ulong > 0x7fffffU)
RETTOK(ISC_R_RANGE);
RETERR(uint24_tobuffer(token.value.as_ulong | (optout << 23), target));
/* salt */
RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
ISC_FALSE));
if (token.value.as_textregion.length > (255*2))
RETTOK(DNS_R_TEXTTOOLONG);
if (strcmp(DNS_AS_STR(token), "-") == 0) {
RETERR(uint8_tobuffer(0, target));
} else {
RETERR(uint8_tobuffer(strlen(DNS_AS_STR(token)) / 2, target));
RETERR(isc_hex_decodestring(DNS_AS_STR(token), target));
}
/*
* Next hash a single base32hex word.
*/
RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
ISC_FALSE));
isc_buffer_init(&b, bm, sizeof(bm));
RETTOK(isc_base32hex_decodestring(DNS_AS_STR(token), &b));
if (isc_buffer_usedlength(&b) > 0xffU)
RETTOK(ISC_R_RANGE);
RETERR(uint8_tobuffer(isc_buffer_usedlength(&b), target));
RETERR(mem_tobuffer(target, &bm, isc_buffer_usedlength(&b)));
memset(bm, 0, sizeof(bm));
do {
RETERR(isc_lex_getmastertoken(lexer, &token,
isc_tokentype_string, ISC_TRUE));
if (token.type != isc_tokentype_string)
break;
RETTOK(dns_rdatatype_fromtext(&covered,
&token.value.as_textregion));
bm[covered/8] |= (0x80>>(covered%8));
} while (1);
isc_lex_ungettoken(lexer, &token);
for (window = 0; window < 256 ; window++) {
/*
* Find if we have a type in this window.
*/
for (octet = 31; octet >= 0; octet--)
if (bm[window * 32 + octet] != 0)
break;
if (octet < 0)
continue;
RETERR(uint8_tobuffer(window, target));
RETERR(uint8_tobuffer(octet + 1, target));
RETERR(mem_tobuffer(target, &bm[window * 32], octet + 1));
}
return (ISC_R_SUCCESS);
}
static inline isc_result_t
totext_nsec3(ARGS_TOTEXT) {
isc_region_t sr;
unsigned int i, j, k;
unsigned int window, len;
unsigned char hash;
unsigned char optout;
char buf[sizeof("16777216")];
isc_uint32_t iterations;
REQUIRE(rdata->type == 50);
REQUIRE(rdata->length != 0);
UNUSED(tctx);
dns_rdata_toregion(rdata, &sr);
hash = uint8_fromregion(&sr);
isc_region_consume(&sr, 1);
iterations = uint24_fromregion(&sr);
isc_region_consume(&sr, 3);
optout = iterations >> 23;
iterations &= 0x7fffffU;
sprintf(buf, "%u ", hash);
RETERR(str_totext(buf, target));
sprintf(buf, "%u ", optout);
RETERR(str_totext(buf, target));
sprintf(buf, "%u ", iterations);
RETERR(str_totext(buf, target));
j = uint8_fromregion(&sr);
isc_region_consume(&sr, 1);
INSIST(j <= sr.length);
if (j != 0) {
i = sr.length;
sr.length = j;
RETERR(isc_hex_totext(&sr, 1, "", target));
sr.length = i - j;
RETERR(str_totext(" ", target));
} else
RETERR(str_totext("- ", target));
j = uint8_fromregion(&sr);
isc_region_consume(&sr, 1);
INSIST(j <= sr.length);
i = sr.length;
sr.length = j;
RETERR(isc_base32hex_totext(&sr, 1, "", target));
sr.length = i - j;
for (i = 0; i < sr.length; i += len) {
INSIST(i + 2 <= sr.length);
window = sr.base[i];
len = sr.base[i + 1];
INSIST(len > 0 && len <= 32);
i += 2;
INSIST(i + len <= sr.length);
for (j = 0; j < len; j++) {
dns_rdatatype_t t;
if (sr.base[i + j] == 0)
continue;
for (k = 0; k < 8; k++) {
if ((sr.base[i + j] & (0x80 >> k)) == 0)
continue;
t = window * 256 + j * 8 + k;
RETERR(str_totext(" ", target));
if (dns_rdatatype_isknown(t)) {
RETERR(dns_rdatatype_totext(t, target));
} else {
char buf[sizeof("TYPE65535")];
sprintf(buf, "TYPE%u", t);
RETERR(str_totext(buf, target));
}
}
}
}
return (ISC_R_SUCCESS);
}
static /* inline */ isc_result_t
fromwire_nsec3(ARGS_FROMWIRE) {
isc_region_t sr, rr;
unsigned int window, lastwindow = 0;
unsigned int len;
unsigned int saltlen, hashlen;
isc_boolean_t first = ISC_TRUE;
unsigned int i;
REQUIRE(type == 50);
UNUSED(type);
UNUSED(rdclass);
UNUSED(options);
UNUSED(dctx);
isc_buffer_activeregion(source, &sr);
rr = sr;
if (sr.length < 5U)
RETERR(DNS_R_FORMERR);
saltlen = sr.base[4];
isc_region_consume(&sr, 5);
if (sr.length < saltlen)
RETERR(DNS_R_FORMERR);
isc_region_consume(&sr, saltlen);
if (sr.length < 1U)
RETERR(DNS_R_FORMERR);
hashlen = sr.base[0];
isc_region_consume(&sr, 1);
if (sr.length < hashlen)
RETERR(DNS_R_FORMERR);
isc_region_consume(&sr, hashlen);
for (i = 0; i < sr.length; i += len) {
/*
* Check for overflow.
*/
if (i + 2 > sr.length)
RETERR(DNS_R_FORMERR);
window = sr.base[i];
len = sr.base[i + 1];
i += 2;
/*
* Check that bitmap windows are in the correct order.
*/
if (!first && window <= lastwindow)
RETERR(DNS_R_FORMERR);
/*
* Check for legal lengths.
*/
if (len < 1 || len > 32)
RETERR(DNS_R_FORMERR);
/*
* Check for overflow.
*/
if (i + len > sr.length)
RETERR(DNS_R_FORMERR);
/*
* The last octet of the bitmap must be non zero.
*/
if (sr.base[i + len - 1] == 0)
RETERR(DNS_R_FORMERR);
lastwindow = window;
first = ISC_FALSE;
}
if (i != sr.length)
return (DNS_R_EXTRADATA);
RETERR(mem_tobuffer(target, rr.base, rr.length));
isc_buffer_forward(source, rr.length);
return (ISC_R_SUCCESS);
}
static inline isc_result_t
towire_nsec3(ARGS_TOWIRE) {
isc_region_t sr;
REQUIRE(rdata->type == 50);
REQUIRE(rdata->length != 0);
UNUSED(cctx);
dns_rdata_toregion(rdata, &sr);
return (mem_tobuffer(target, sr.base, sr.length));
}
static inline int
compare_nsec3(ARGS_COMPARE) {
isc_region_t r1;
isc_region_t r2;
REQUIRE(rdata1->type == rdata2->type);
REQUIRE(rdata1->rdclass == rdata2->rdclass);
REQUIRE(rdata1->type == 50);
REQUIRE(rdata1->length != 0);
REQUIRE(rdata2->length != 0);
dns_rdata_toregion(rdata1, &r1);
dns_rdata_toregion(rdata2, &r2);
return (isc_region_compare(&r1, &r2));
}
static inline isc_result_t
fromstruct_nsec3(ARGS_FROMSTRUCT) {
dns_rdata_nsec3_t *nsec3 = source;
unsigned int i, len, window, lastwindow = 0;
isc_boolean_t first = ISC_TRUE;
REQUIRE(type == 50);
REQUIRE(source != NULL);
REQUIRE(nsec3->common.rdtype == type);
REQUIRE(nsec3->common.rdclass == rdclass);
REQUIRE(nsec3->typebits != NULL || nsec3->len == 0);
REQUIRE(nsec3->hash == dns_hash_sha1);
UNUSED(type);
UNUSED(rdclass);
RETERR(uint8_tobuffer(nsec3->hash, target));
RETERR(uint24_tobuffer(nsec3->iterations | (nsec3->optout << 23),
target));
RETERR(uint8_tobuffer(nsec3->salt_length, target));
RETERR(mem_tobuffer(target, nsec3->salt, nsec3->salt_length));
RETERR(uint8_tobuffer(nsec3->next_length, target));
RETERR(mem_tobuffer(target, nsec3->next, nsec3->next_length));
/*
* Perform sanity check.
*/
for (i = 0; i < nsec3->len ; i += len) {
INSIST(i + 2 <= nsec3->len);
window = nsec3->typebits[i];
len = nsec3->typebits[i+1];
i += 2;
INSIST(first || window > lastwindow);
INSIST(len > 0 && len <= 32);
INSIST(i + len <= nsec3->len);
INSIST(nsec3->typebits[i + len - 1] != 0);
lastwindow = window;
first = ISC_FALSE;
}
return (mem_tobuffer(target, nsec3->typebits, nsec3->len));
}
static inline isc_result_t
tostruct_nsec3(ARGS_TOSTRUCT) {
isc_region_t region;
dns_rdata_nsec3_t *nsec3 = target;
REQUIRE(rdata->type == 50);
REQUIRE(target != NULL);
REQUIRE(rdata->length != 0);
nsec3->common.rdclass = rdata->rdclass;
nsec3->common.rdtype = rdata->type;
ISC_LINK_INIT(&nsec3->common, link);
region.base = rdata->data;
region.length = rdata->length;
nsec3->hash = uint8_consume_fromregion(&region);
nsec3->iterations = uint24_consume_fromregion(&region);
nsec3->optout = nsec3->iterations >> 23;
nsec3->iterations &= 0x7fffffU;
nsec3->salt_length = uint8_consume_fromregion(&region);
nsec3->salt = mem_maybedup(mctx, region.base, nsec3->salt_length);
if (nsec3->salt == NULL)
return (ISC_R_NOMEMORY);
isc_region_consume(&region, nsec3->salt_length);
nsec3->next_length = uint8_consume_fromregion(&region);
nsec3->next = mem_maybedup(mctx, region.base, nsec3->next_length);
if (nsec3->next == NULL)
goto cleanup;
isc_region_consume(&region, nsec3->next_length);
nsec3->len = region.length;
nsec3->typebits = mem_maybedup(mctx, region.base, region.length);
if (nsec3->typebits == NULL)
goto cleanup;
nsec3->mctx = mctx;
return (ISC_R_SUCCESS);
cleanup:
if (nsec3->next != NULL)
isc_mem_free(mctx, nsec3->next);
isc_mem_free(mctx, nsec3->salt);
return (ISC_R_NOMEMORY);
}
static inline void
freestruct_nsec3(ARGS_FREESTRUCT) {
dns_rdata_nsec3_t *nsec3 = source;
REQUIRE(source != NULL);
REQUIRE(nsec3->common.rdtype == 50);
if (nsec3->mctx == NULL)
return;
if (nsec3->salt != NULL)
isc_mem_free(nsec3->mctx, nsec3->salt);
if (nsec3->next != NULL)
isc_mem_free(nsec3->mctx, nsec3->next);
if (nsec3->typebits != NULL)
isc_mem_free(nsec3->mctx, nsec3->typebits);
nsec3->mctx = NULL;
}
static inline isc_result_t
additionaldata_nsec3(ARGS_ADDLDATA) {
REQUIRE(rdata->type == 50);
UNUSED(rdata);
UNUSED(add);
UNUSED(arg);
return (ISC_R_SUCCESS);
}
static inline isc_result_t
digest_nsec3(ARGS_DIGEST) {
isc_region_t r;
REQUIRE(rdata->type == 50);
dns_rdata_toregion(rdata, &r);
return ((digest)(arg, &r));
}
static inline isc_boolean_t
checkowner_nsec3(ARGS_CHECKOWNER) {
REQUIRE(type == 50);
UNUSED(name);
UNUSED(type);
UNUSED(rdclass);
UNUSED(wildcard);
return (ISC_TRUE);
}
static inline isc_boolean_t
checknames_nsec3(ARGS_CHECKNAMES) {
REQUIRE(rdata->type == 50);
UNUSED(rdata);
UNUSED(owner);
UNUSED(bad);
return (ISC_TRUE);
}
#endif /* RDATA_GENERIC_NSEC3_50_C */

40
lib/dns/rdata/generic/nsec3_50.h Normal file
View File

@@ -0,0 +1,40 @@
/*
* Copyright (C) 2004 Nominet, Ltd.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND NOMINET DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
#ifndef GENERIC_NSEC3_50_H
#define GENERIC_NSEC3_50_H 1
/* $Id: nsec3_50.h,v 1.1 2008/04/04 05:34:06 marka Exp $ */
/* draft-ietf-dnsext-nsec3-02.txt */
#include <isc/iterated_hash.h>
typedef struct dns_rdata_nsec3 {
dns_rdatacommon_t common;
isc_mem_t *mctx;
unsigned int optout;
dns_hash_t hash;
dns_iterations_t iterations;
unsigned char salt_length;
unsigned char next_length;
isc_uint16_t len;
unsigned char *salt;
unsigned char *next;
unsigned char *typebits;
} dns_rdata_nsec3_t;
#endif /* GENERIC_NSEC3_50_H */

315
lib/dns/rdata/generic/nsec3param_51.c Normal file
View File

@@ -0,0 +1,315 @@
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
/*
* Copyright (C) 2004 Nominet, Ltd.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND NOMINET DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
#ifndef RDATA_GENERIC_NSEC3PARAM_51_C
#define RDATA_GENERIC_NSEC3PARAM_51_C
#include <isc/iterated_hash.h>
#include <isc/base32.h>
#define RRTYPE_NSEC3PARAM_ATTRIBUTES (DNS_RDATATYPEATTR_DNSSEC)
static inline isc_result_t
fromtext_nsec3param(ARGS_FROMTEXT) {
isc_token_t token;
unsigned int optout = 0;
unsigned char hashalg;
REQUIRE(type == 51);
UNUSED(type);
UNUSED(rdclass);
UNUSED(callbacks);
UNUSED(origin);
UNUSED(options);
/* Hash. */
RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
ISC_FALSE));
RETTOK(dns_hashalg_fromtext(&hashalg, &token.value.as_textregion));
RETERR(uint8_tobuffer(hashalg, target));
#if 0
/* Opt-out flag. */
RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
ISC_FALSE));
optout = token.value.as_ulong;
if (optout != 0 && optout != 1)
RETTOK(ISC_R_RANGE);
#endif
/* Iterations. */
RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
ISC_FALSE));
if (token.value.as_ulong > 0x7fffffU)
RETTOK(ISC_R_RANGE);
RETERR(uint24_tobuffer(token.value.as_ulong | (optout << 23), target));
/* salt */
RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
ISC_FALSE));
if (token.value.as_textregion.length > (255*2))
RETTOK(DNS_R_TEXTTOOLONG);
if (strcmp(DNS_AS_STR(token), "-") == 0) {
RETERR(uint8_tobuffer(0, target));
} else {
RETERR(uint8_tobuffer(strlen(DNS_AS_STR(token)) / 2, target));
RETERR(isc_hex_decodestring(DNS_AS_STR(token), target));
}
return (ISC_R_SUCCESS);
}
static inline isc_result_t
totext_nsec3param(ARGS_TOTEXT) {
isc_region_t sr;
unsigned int i, j;
unsigned char hash;
unsigned char optout;
char buf[sizeof("16777216")];
isc_uint32_t iterations;
REQUIRE(rdata->type == 51);
REQUIRE(rdata->length != 0);
UNUSED(tctx);
dns_rdata_toregion(rdata, &sr);
hash = uint8_fromregion(&sr);
isc_region_consume(&sr, 1);
iterations = uint24_fromregion(&sr);
isc_region_consume(&sr, 3);
optout = iterations >> 23;
iterations &= 0x7fffffU;
sprintf(buf, "%u ", hash);
RETERR(str_totext(buf, target));
#if 0
sprintf(buf, "%u ", optout);
RETERR(str_totext(buf, target));
#endif
sprintf(buf, "%u ", iterations);
RETERR(str_totext(buf, target));
j = uint8_fromregion(&sr);
isc_region_consume(&sr, 1);
INSIST(j <= sr.length);
if (j != 0) {
i = sr.length;
sr.length = j;
RETERR(isc_hex_totext(&sr, 1, "", target));
sr.length = i - j;
} else
RETERR(str_totext("-", target));
return (ISC_R_SUCCESS);
}
static /* inline */ isc_result_t
fromwire_nsec3param(ARGS_FROMWIRE) {
isc_region_t sr, rr;
unsigned int saltlen;
REQUIRE(type == 51);
UNUSED(type);
UNUSED(rdclass);
UNUSED(options);
UNUSED(dctx);
isc_buffer_activeregion(source, &sr);
rr = sr;
if (sr.length < 5U)
RETERR(DNS_R_FORMERR);
saltlen = sr.base[4];
isc_region_consume(&sr, 5);
if (sr.length < saltlen)
RETERR(DNS_R_FORMERR);
isc_region_consume(&sr, saltlen);
RETERR(mem_tobuffer(target, rr.base, rr.length));
isc_buffer_forward(source, rr.length);
return (ISC_R_SUCCESS);
}
static inline isc_result_t
towire_nsec3param(ARGS_TOWIRE) {
isc_region_t sr;
REQUIRE(rdata->type == 51);
REQUIRE(rdata->length != 0);
UNUSED(cctx);
dns_rdata_toregion(rdata, &sr);
return (mem_tobuffer(target, sr.base, sr.length));
}
static inline int
compare_nsec3param(ARGS_COMPARE) {
isc_region_t r1;
isc_region_t r2;
REQUIRE(rdata1->type == rdata2->type);
REQUIRE(rdata1->rdclass == rdata2->rdclass);
REQUIRE(rdata1->type == 51);
REQUIRE(rdata1->length != 0);
REQUIRE(rdata2->length != 0);
dns_rdata_toregion(rdata1, &r1);
dns_rdata_toregion(rdata2, &r2);
return (isc_region_compare(&r1, &r2));
}
static inline isc_result_t
fromstruct_nsec3param(ARGS_FROMSTRUCT) {
dns_rdata_nsec3param_t *nsec3param = source;
REQUIRE(type == 51);
REQUIRE(source != NULL);
REQUIRE(nsec3param->common.rdtype == type);
REQUIRE(nsec3param->common.rdclass == rdclass);
UNUSED(type);
UNUSED(rdclass);
RETERR(uint8_tobuffer(nsec3param->hash, target));
RETERR(uint24_tobuffer(nsec3param->iterations |
(nsec3param->optout << 23),
target));
RETERR(uint8_tobuffer(nsec3param->salt_length, target));
RETERR(mem_tobuffer(target, nsec3param->salt,
nsec3param->salt_length));
return (ISC_R_SUCCESS);
}
static inline isc_result_t
tostruct_nsec3param(ARGS_TOSTRUCT) {
isc_region_t region;
dns_rdata_nsec3param_t *nsec3param = target;
REQUIRE(rdata->type == 51);
REQUIRE(target != NULL);
REQUIRE(rdata->length != 0);
nsec3param->common.rdclass = rdata->rdclass;
nsec3param->common.rdtype = rdata->type;
ISC_LINK_INIT(&nsec3param->common, link);
region.base = rdata->data;
region.length = rdata->length;
nsec3param->hash = uint8_consume_fromregion(&region);
nsec3param->iterations = uint24_consume_fromregion(&region);
nsec3param->optout = nsec3param->iterations >> 23;
nsec3param->iterations &= 0x7fffffU;
nsec3param->salt_length = uint8_consume_fromregion(&region);
nsec3param->salt = mem_maybedup(mctx, region.base,
nsec3param->salt_length);
if (nsec3param->salt == NULL)
return (ISC_R_NOMEMORY);
isc_region_consume(&region, nsec3param->salt_length);
nsec3param->mctx = mctx;
return (ISC_R_SUCCESS);
}
static inline void
freestruct_nsec3param(ARGS_FREESTRUCT) {
dns_rdata_nsec3param_t *nsec3param = source;
REQUIRE(source != NULL);
REQUIRE(nsec3param->common.rdtype == 51);
if (nsec3param->mctx == NULL)
return;
if (nsec3param->salt != NULL)
isc_mem_free(nsec3param->mctx, nsec3param->salt);
nsec3param->mctx = NULL;
}
static inline isc_result_t
additionaldata_nsec3param(ARGS_ADDLDATA) {
REQUIRE(rdata->type == 51);
UNUSED(rdata);
UNUSED(add);
UNUSED(arg);
return (ISC_R_SUCCESS);
}
static inline isc_result_t
digest_nsec3param(ARGS_DIGEST) {
isc_region_t r;
REQUIRE(rdata->type == 51);
dns_rdata_toregion(rdata, &r);
return ((digest)(arg, &r));
}
static inline isc_boolean_t
checkowner_nsec3param(ARGS_CHECKOWNER) {
REQUIRE(type == 51);
UNUSED(name);
UNUSED(type);
UNUSED(rdclass);
UNUSED(wildcard);
return (ISC_TRUE);
}
static inline isc_boolean_t
checknames_nsec3param(ARGS_CHECKNAMES) {
REQUIRE(rdata->type == 51);
UNUSED(rdata);
UNUSED(owner);
UNUSED(bad);
return (ISC_TRUE);
}
#endif /* RDATA_GENERIC_NSEC3PARAM_51_C */

36
lib/dns/rdata/generic/nsec3param_51.h Normal file
View File

@@ -0,0 +1,36 @@
/*
* Copyright (C) 2004 Nominet, Ltd.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND NOMINET DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
#ifndef GENERIC_NSEC3PARAM_51_H
#define GENERIC_NSEC3PARAM_51_H 1
/* $Id: nsec3param_51.h,v 1.1 2008/04/04 05:34:06 marka Exp $ */
/* draft-ietf-dnsext-nsec3-02.txt */
#include <isc/iterated_hash.h>
typedef struct dns_rdata_nsec3param {
dns_rdatacommon_t common;
isc_mem_t *mctx;
unsigned int optout;
dns_hash_t hash;
dns_iterations_t iterations;
unsigned char salt_length;
unsigned char *salt;
} dns_rdata_nsec3param_t;
#endif /* GENERIC_NSEC3PARAM_51_H */

372
lib/isc/base32.c Normal file
View File

@@ -0,0 +1,372 @@
/*
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1998-2001, 2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: base32.c,v 1.2 2008/04/04 05:34:06 marka Exp $ */
/*! \file */
#include <config.h>
#include <isc/base32.h>
#include <isc/buffer.h>
#include <isc/lex.h>
#include <isc/region.h>
#include <isc/string.h>
#include <isc/util.h>
#define RETERR(x) do { \
isc_result_t _r = (x); \
if (_r != ISC_R_SUCCESS) \
return (_r); \
} while (0)
/*@{*/
/*!
* These static functions are also present in lib/dns/rdata.c. I'm not
* sure where they should go. -- bwelling
*/
static isc_result_t
str_totext(const char *source, isc_buffer_t *target);
static isc_result_t
mem_tobuffer(isc_buffer_t *target, void *base, unsigned int length);
/*@}*/
static const char base32[] =
"ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=abcdefghijklmnopqrstuvwxyz234567";
static const char base32hex[] =
"0123456789ABCDEFGHIJKLMNOPQRSTUV=0123456789abcdefghijklmnopqrstuv";
static isc_result_t
base32_totext(isc_region_t *source, int wordlength, const char *wordbreak,
isc_buffer_t *target, const char base[])
{
char buf[9];
unsigned int loops = 0;
if (wordlength >= 0 && wordlength < 8)
wordlength = 8;
memset(buf, 0, sizeof(buf));
while (source->length > 0) {
buf[0] = base[((source->base[0]>>3)&0x1f)]; /* 5 + */
if (source->length == 1) {
buf[1] = base[(source->base[0]<<2)&0x1c];
buf[2] = buf[3] = buf[4] = '=';
buf[5] = buf[6] = buf[7] = '=';
RETERR(str_totext(buf, target));
break;
}
buf[1] = base[((source->base[0]<<2)&0x1c)| /* 3 = 8 */
((source->base[1]>>6)&0x03)]; /* 2 + */
buf[2] = base[((source->base[1]>>1)&0x1f)]; /* 5 + */
if (source->length == 2) {
buf[3] = base[(source->base[1]<<4)&0x10];
buf[4] = buf[5] = buf[6] = buf[7] = '=';
RETERR(str_totext(buf, target));
break;
}
buf[3] = base[((source->base[1]<<4)&0x10)| /* 1 = 8 */
((source->base[2]>>4)&0x0f)]; /* 4 + */
if (source->length == 3) {
buf[4] = base[(source->base[2]<<1)&0x1e];
buf[5] = buf[6] = buf[7] = '=';
RETERR(str_totext(buf, target));
break;
}
buf[4] = base[((source->base[2]<<1)&0x1e)| /* 4 = 8 */
((source->base[3]>>7)&0x01)]; /* 1 + */
buf[5] = base[((source->base[3]>>2)&0x1f)]; /* 5 + */
if (source->length == 4) {
buf[6] = base[(source->base[3]<<3)&0x18];
buf[7] = '=';
RETERR(str_totext(buf, target));
break;
}
buf[6] = base[((source->base[3]<<3)&0x18)| /* 2 = 8 */
((source->base[4]>>5)&0x07)]; /* 3 + */
buf[7] = base[source->base[4]&0x1f]; /* 5 = 8 */
RETERR(str_totext(buf, target));
isc_region_consume(source, 5);
loops++;
if (source->length != 0 && wordlength >= 0 &&
(int)((loops + 1) * 8) >= wordlength)
{
loops = 0;
RETERR(str_totext(wordbreak, target));
}
}
return (ISC_R_SUCCESS);
}
isc_result_t
isc_base32_totext(isc_region_t *source, int wordlength,
const char *wordbreak, isc_buffer_t *target)
{
return (base32_totext(source, wordlength, wordbreak, target, base32));
}
isc_result_t
isc_base32hex_totext(isc_region_t *source, int wordlength,
const char *wordbreak, isc_buffer_t *target)
{
return (base32_totext(source, wordlength, wordbreak, target,
base32hex));
}
/*%
* State of a base32 decoding process in progress.
*/
typedef struct {
int length; /*%< Desired length of binary data or -1 */
isc_buffer_t *target; /*%< Buffer for resulting binary data */
int digits; /*%< Number of buffered base32 digits */
isc_boolean_t seen_end; /*%< True if "=" end marker seen */
int val[8];
const char *base; /*%< Which encoding we are using */
int seen_32; /*%< Number of significant bytes if non zero */
} base32_decode_ctx_t;
static inline void
base32_decode_init(base32_decode_ctx_t *ctx, int length,
const char base[], isc_buffer_t *target)
{
ctx->digits = 0;
ctx->seen_end = ISC_FALSE;
ctx->seen_32 = 0;
ctx->length = length;
ctx->target = target;
ctx->base = base;
}
static inline isc_result_t
base32_decode_char(base32_decode_ctx_t *ctx, int c) {
char *s;
unsigned int last;
if (ctx->seen_end)
return (ISC_R_BADBASE32);
if ((s = strchr(ctx->base, c)) == NULL)
return (ISC_R_BADBASE32);
last = s - ctx->base;
/*
* Handle lower case.
*/
if (last > 32)
last -= 33;
/*
* Check that padding is contigious.
*/
if (last != 32 && ctx->seen_32 != 0)
return (ISC_R_BADBASE32);
/*
* Check that padding starts at the right place and that
* bits that should be zero are.
* Record how many significant bytes in answer (seen_32).
*/
if (last == 32 && ctx->seen_32 == 0)
switch (ctx->digits) {
case 0:
case 1:
return (ISC_R_BADBASE32);
case 2:
if ((ctx->val[1]&0x03) != 0)
return (ISC_R_BADBASE32);
ctx->seen_32 = 1;
break;
case 3:
return (ISC_R_BADBASE32);
case 4:
if ((ctx->val[3]&0x0f) != 0)
return (ISC_R_BADBASE32);
ctx->seen_32 = 3;
break;
case 5:
if ((ctx->val[4]&0x01) != 0)
return (ISC_R_BADBASE32);
ctx->seen_32 = 3;
break;
case 6:
return (ISC_R_BADBASE32);
case 7:
if ((ctx->val[6]&0x07) != 0)
return (ISC_R_BADBASE32);
ctx->seen_32 = 4;
break;
}
/*
* Zero fill pad values.
*/
ctx->val[ctx->digits++] = (last == 32) ? 0 : last;
if (ctx->digits == 8) {
int n = 5;
unsigned char buf[5];
if (ctx->seen_32 != 0) {
ctx->seen_end = ISC_TRUE;
n = ctx->seen_32;
}
buf[0] = (ctx->val[0]<<3)|(ctx->val[1]>>2);
buf[1] = (ctx->val[1]<<6)|(ctx->val[2]<<1)|(ctx->val[3]>>4);
buf[2] = (ctx->val[3]<<4)|(ctx->val[4]>>1);
buf[3] = (ctx->val[4]<<7)|(ctx->val[5]<<2)|(ctx->val[6]>>3);
buf[4] = (ctx->val[6]<<5)|(ctx->val[7]);
RETERR(mem_tobuffer(ctx->target, buf, n));
if (ctx->length >= 0) {
if (n > ctx->length)
return (ISC_R_BADBASE32);
else
ctx->length -= n;
}
ctx->digits = 0;
}
return (ISC_R_SUCCESS);
}
static inline isc_result_t
base32_decode_finish(base32_decode_ctx_t *ctx) {
if (ctx->length > 0)
return (ISC_R_UNEXPECTEDEND);
if (ctx->digits != 0)
return (ISC_R_BADBASE32);
return (ISC_R_SUCCESS);
}
static isc_result_t
base32_tobuffer(isc_lex_t *lexer, const char base[], isc_buffer_t *target,
int length)
{
base32_decode_ctx_t ctx;
isc_textregion_t *tr;
isc_token_t token;
isc_boolean_t eol;
base32_decode_init(&ctx, length, base, target);
while (!ctx.seen_end && (ctx.length != 0)) {
unsigned int i;
if (length > 0)
eol = ISC_FALSE;
else
eol = ISC_TRUE;
RETERR(isc_lex_getmastertoken(lexer, &token,
isc_tokentype_string, eol));
if (token.type != isc_tokentype_string)
break;
tr = &token.value.as_textregion;
for (i = 0; i < tr->length; i++)
RETERR(base32_decode_char(&ctx, tr->base[i]));
}
if (ctx.length < 0 && !ctx.seen_end)
isc_lex_ungettoken(lexer, &token);
RETERR(base32_decode_finish(&ctx));
return (ISC_R_SUCCESS);
}
isc_result_t
isc_base32_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length) {
return (base32_tobuffer(lexer, base32, target, length));
}
isc_result_t
isc_base32hex_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length) {
return (base32_tobuffer(lexer, base32hex, target, length));
}
static isc_result_t
base32_decodestring(const char *cstr, const char base[], isc_buffer_t *target) {
base32_decode_ctx_t ctx;
base32_decode_init(&ctx, -1, base, target);
for (;;) {
int c = *cstr++;
if (c == '\0')
break;
if (c == ' ' || c == '\t' || c == '\n' || c== '\r')
continue;
RETERR(base32_decode_char(&ctx, c));
}
RETERR(base32_decode_finish(&ctx));
return (ISC_R_SUCCESS);
}
isc_result_t
isc_base32_decodestring(const char *cstr, isc_buffer_t *target) {
return (base32_decodestring(cstr, base32, target));
}
isc_result_t
isc_base32hex_decodestring(const char *cstr, isc_buffer_t *target) {
return (base32_decodestring(cstr, base32hex, target));
}
static isc_result_t
base32_decoderegion(isc_region_t *source, const char base[], isc_buffer_t *target) {
base32_decode_ctx_t ctx;
base32_decode_init(&ctx, -1, base, target);
while (source->length != 0) {
int c = *source->base;
RETERR(base32_decode_char(&ctx, c));
isc_region_consume(source, 1);
}
RETERR(base32_decode_finish(&ctx));
return (ISC_R_SUCCESS);
}
isc_result_t
isc_base32_decoderegion(isc_region_t *source, isc_buffer_t *target) {
return (base32_decoderegion(source, base32, target));
}
isc_result_t
isc_base32hex_decoderegion(isc_region_t *source, isc_buffer_t *target) {
return (base32_decoderegion(source, base32hex, target));
}
static isc_result_t
str_totext(const char *source, isc_buffer_t *target) {
unsigned int l;
isc_region_t region;
isc_buffer_availableregion(target, &region);
l = strlen(source);
if (l > region.length)
return (ISC_R_NOSPACE);
memcpy(region.base, source, l);
isc_buffer_add(target, l);
return (ISC_R_SUCCESS);
}
static isc_result_t
mem_tobuffer(isc_buffer_t *target, void *base, unsigned int length) {
isc_region_t tr;
isc_buffer_availableregion(target, &tr);
if (length > tr.length)
return (ISC_R_NOSPACE);
memcpy(tr.base, base, length);
isc_buffer_add(target, length);
return (ISC_R_SUCCESS);
}

28
lib/isc/iterated_hash.c Normal file
View File

@@ -0,0 +1,28 @@
#include <stdio.h>
#include <isc/sha1.h>
#include <isc/iterated_hash.h>
int
isc_iterated_hash(unsigned char out[ISC_SHA1_DIGESTLENGTH],
unsigned int hashalg, int iterations,
const unsigned char *salt, int saltlength,
const unsigned char *in, int inlength)
{
isc_sha1_t ctx;
int n = 0;
if (hashalg != 1)
return (0);
do {
isc_sha1_init(&ctx);
isc_sha1_update(&ctx, in, inlength);
isc_sha1_update(&ctx, salt, saltlength);
isc_sha1_final(&ctx, out);
in = out;
inlength = ISC_SHA1_DIGESTLENGTH;
} while (n++ < iterations);
return (ISC_SHA1_DIGESTLENGTH);
}