1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
|
/*
* validator/val_anchor.h - validator trust anchor storage.
*
* Copyright (c) 2007, NLnet Labs. All rights reserved.
*
* This software is open source.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* Neither the name of the NLNET LABS nor the names of its contributors may
* be used to endorse or promote products derived from this software without
* specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
* TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
/**
* \file
*
* This file contains storage for the trust anchors for the validator.
*/
#ifndef VALIDATOR_VAL_ANCHOR_H
#define VALIDATOR_VAL_ANCHOR_H
#include "util/rbtree.h"
#include "util/locks.h"
struct trust_anchor;
struct config_file;
struct ub_packed_rrset_key;
struct autr_point_data;
struct autr_global_data;
struct sldns_buffer;
/**
* Trust anchor store.
* The tree must be locked, while no other locks (from trustanchors) are held.
* And then an anchor searched for. Which can be locked or deleted. Then
* the tree can be unlocked again. This means you have to release the lock
* on a trust anchor and look it up again to delete it.
*/
struct val_anchors {
/** lock on trees */
lock_basic_type lock;
/**
* Anchors are store in this tree. Sort order is chosen, so that
* dnames are in nsec-like order. A lookup on class, name will return
* an exact match of the closest match, with the ancestor needed.
* contents of type trust_anchor.
*/
rbtree_type* tree;
/** Autotrust global data, anchors sorted by next probe time */
struct autr_global_data* autr;
};
/**
* Trust anchor key
*/
struct ta_key {
/** next in list */
struct ta_key* next;
/** rdata, in wireformat of the key RR. starts with rdlength. */
uint8_t* data;
/** length of the rdata (including rdlength). */
size_t len;
/** DNS type (host format) of the key, DS or DNSKEY */
uint16_t type;
};
/**
* A trust anchor in the trust anchor store.
* Unique by name, class.
*/
struct trust_anchor {
/** rbtree node, key is this structure */
rbnode_type node;
/** lock on the entire anchor and its keys; for autotrust changes */
lock_basic_type lock;
/** name of this trust anchor */
uint8_t* name;
/** length of name */
size_t namelen;
/** number of labels in name of rrset */
int namelabs;
/** the ancestor in the trustanchor tree */
struct trust_anchor* parent;
/**
* List of DS or DNSKEY rrs that form the trust anchor.
*/
struct ta_key* keylist;
/** Autotrust anchor point data, or NULL */
struct autr_point_data* autr;
/** number of DSs in the keylist */
size_t numDS;
/** number of DNSKEYs in the keylist */
size_t numDNSKEY;
/** the DS RRset */
struct ub_packed_rrset_key* ds_rrset;
/** The DNSKEY RRset */
struct ub_packed_rrset_key* dnskey_rrset;
/** class of the trust anchor */
uint16_t dclass;
};
/**
* Create trust anchor storage
* @return new storage or NULL on error.
*/
struct val_anchors* anchors_create(void);
/**
* Delete trust anchor storage.
* @param anchors: to delete.
*/
void anchors_delete(struct val_anchors* anchors);
/**
* Process trust anchor config.
* @param anchors: struct anchor storage
* @param cfg: config options.
* @return 0 on error.
*/
int anchors_apply_cfg(struct val_anchors* anchors, struct config_file* cfg);
/**
* Recalculate parent pointers. The caller must hold the lock on the
* anchors structure (say after removing an item from the rbtree).
* Caller must not hold any locks on trust anchors.
* After the call is complete the parent pointers are updated and an item
* just removed is no longer referenced in parent pointers.
* @param anchors: the structure to update.
*/
void anchors_init_parents_locked(struct val_anchors* anchors);
/**
* Given a qname/qclass combination, find the trust anchor closest above it.
* Or return NULL if none exists.
*
* @param anchors: struct anchor storage
* @param qname: query name, uncompressed wireformat.
* @param qname_len: length of qname.
* @param qclass: class to query for.
* @return the trust anchor or NULL if none is found. The anchor is locked.
*/
struct trust_anchor* anchors_lookup(struct val_anchors* anchors,
uint8_t* qname, size_t qname_len, uint16_t qclass);
/**
* Find a trust anchor. Exact matching.
* @param anchors: anchor storage.
* @param name: name of trust anchor (wireformat)
* @param namelabs: labels in name
* @param namelen: length of name
* @param dclass: class of trust anchor
* @return NULL if not found. The anchor is locked.
*/
struct trust_anchor* anchor_find(struct val_anchors* anchors,
uint8_t* name, int namelabs, size_t namelen, uint16_t dclass);
/**
* Store one string as trust anchor RR.
* @param anchors: anchor storage.
* @param buffer: parsing buffer, to generate the RR wireformat in.
* @param str: string.
* @return NULL on error.
*/
struct trust_anchor* anchor_store_str(struct val_anchors* anchors,
struct sldns_buffer* buffer, const char* str);
/**
* Get memory in use by the trust anchor storage
* @param anchors: anchor storage.
* @return memory in use in bytes.
*/
size_t anchors_get_mem(struct val_anchors* anchors);
/** compare two trust anchors */
int anchor_cmp(const void* k1, const void* k2);
/**
* Add insecure point trust anchor. For external use (locks and init_parents)
* @param anchors: anchor storage.
* @param c: class.
* @param nm: name of insecure trust point.
* @return false on alloc failure.
*/
int anchors_add_insecure(struct val_anchors* anchors, uint16_t c, uint8_t* nm);
/**
* Delete insecure point trust anchor. Does not remove if no such point.
* For external use (locks and init_parents)
* @param anchors: anchor storage.
* @param c: class.
* @param nm: name of insecure trust point.
*/
void anchors_delete_insecure(struct val_anchors* anchors, uint16_t c,
uint8_t* nm);
/**
* Get a list of keytags for the trust anchor. Zero tags for insecure points.
* @param ta: trust anchor (locked by caller).
* @param list: array of uint16_t.
* @param num: length of array.
* @return number of keytags filled into array. If total number of keytags is
* bigger than the array, it is truncated at num. On errors, less keytags
* are filled in. The array is sorted.
*/
size_t anchor_list_keytags(struct trust_anchor* ta, uint16_t* list, size_t num);
/**
* Check if there is a trust anchor for given zone with this keytag.
*
* @param anchors: anchor storage
* @param name: name of trust anchor (wireformat)
* @param namelabs: labels in name
* @param namelen: length of name
* @param dclass: class of trust anchor
* @param keytag: keytag
* @return 1 if there is a trust anchor in the trustachor store for this zone
* and keytag, else 0.
*/
int anchor_has_keytag(struct val_anchors* anchors, uint8_t* name, int namelabs,
size_t namelen, uint16_t dclass, uint16_t keytag);
#endif /* VALIDATOR_VAL_ANCHOR_H */
|
