lws-auth-dns.h

Go to the documentation of this file.

/*
 * libwebsockets - small server side websockets and web server implementation
 *
 * Copyright (C) 2010 - 2026 Andy Green <andy@warmcat.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to
 * deal in the Software without restriction, including without limitation the
 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
 * sell copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
 * IN THE SOFTWARE.
 */
 
#if defined(LWS_WITH_AUTHORITATIVE_DNS)
 
struct auth_dns_rr {
        lws_dll2_t list;
 
        char *rdata;
        size_t rdata_len;
 
        uint8_t *wire_rdata;
        size_t wire_rdata_len;
};
 
struct auth_dns_rrset {
        lws_dll2_t list;
        lws_dll2_owner_t rr_list;
 
        char *name;
        uint32_t ttl;
        uint16_t class_;
        uint16_t type;
};
 
struct auth_dns_zone {
        lws_dll2_owner_t rrset_list;
        char default_ttl[16];
        char origin[256];
        unsigned int origin_lines;      /* $ORIGIN directives the text had */
};
 
LWS_VISIBLE LWS_EXTERN int
lws_auth_dns_parse_zone_buf(const char *buf, size_t len, struct auth_dns_zone *zone);

LWS_VISIBLE LWS_EXTERN int
lws_auth_dns_zone_check_origin(const struct auth_dns_zone *z,
                               const char *domain);
 
/*
 * The clock skew allowed either side of an RRSIG's validity period when
 * deciding whether a zone is valid now.  lws_auth_dns_sign_zone() starts the
 * period an hour before signing, so this is only for clocks that are wrong.
 */
#define LWS_AUTH_DNS_RRSIG_SKEW_SECS    300
 
/*
 * How long lws_auth_dns_sign_zone() makes the RRSIGs valid for when it is not
 * told.  Every version of a zone a publisher ever signed verifies for as long
 * as its RRSIGs are in date, and a node that never held the zone can be
 * handed any of them, so this is kept short: a publisher re-signs well before
 * it runs out, as the dnssec-monitor does at half of it.
 */
#define LWS_AUTH_DNS_SIGN_VALIDITY_DEFAULT_SECS (6 * 24 * 3600)
 
enum lws_auth_dns_zone_validity_result {
        LWS_AUTH_DNS_ZV_OK,             
        LWS_AUTH_DNS_ZV_NO_SOA,         
        LWS_AUTH_DNS_ZV_UNSIGNED,       
        LWS_AUTH_DNS_ZV_NOT_YET_VALID,  
        LWS_AUTH_DNS_ZV_EXPIRED,        
};

struct lws_auth_dns_zone_validity {
        uint32_t        serial;         
        time_t          soa_inception;  
        time_t          inception;      
        time_t          expiration;     
        unsigned int    rrsigs;         
        uint8_t         soa_signed;     
};

LWS_VISIBLE LWS_EXTERN int
lws_auth_dns_zone_validity(const struct auth_dns_zone *z, time_t now,
                           unsigned int skew,
                           struct lws_auth_dns_zone_validity *v);
 
LWS_VISIBLE LWS_EXTERN void
lws_auth_dns_free_zone(struct auth_dns_zone *z);

LWS_VISIBLE LWS_EXTERN struct auth_dns_rrset *
lws_auth_dns_zone_cut(struct auth_dns_zone *z, const char *name);
 
#define LWS_AUTH_DNS_NSEC3_HASH_LEN 20 /* SHA-1, the only NSEC3 hash */
 
/*
 * Anything hashing a zone's NSEC3 owner names spends the zone's iteration
 * count of CPU per hash, and the zone can be untrusted (eg, DHT-published).
 * RFC 5155 A.1 caps useful iterations at 150 and RFC 9276 deprecates any
 * value above 0, so zones asking for more are not hashed.
 */
#define LWS_AUTH_DNS_MAX_NSEC3_ITERATIONS 150

LWS_VISIBLE LWS_EXTERN int
lws_auth_dns_nsec3_hash(const uint8_t *wire, size_t wire_len,
                        const uint8_t *salt, size_t salt_len,
                        unsigned int iterations, uint8_t *hash);
 
/* the largest DNSKEY RDATA we express: 4 + 3 + e + 8192-bit RSA n */
#define LWS_AUTH_DNS_DNSKEY_WIRE_MAX 1040
 
/*
 * A key's DNSKEY record, and the DS record for it the parent zone publishes,
 * as the registrar asks for them
 */
 
struct lws_auth_dns_key_records {
        char            dnskey[((LWS_AUTH_DNS_DNSKEY_WIRE_MAX - 4 + 2) / 3) * 4 + 16];
        char            ds[128];
        char            digest[97];
        uint16_t        keytag;
        uint8_t         alg;            
        uint8_t         digest_type;    
};

LWS_VISIBLE LWS_EXTERN int
lws_auth_dns_key_records(struct lws_jwk *jwk, const char *origin, int flags,
                         struct lws_auth_dns_key_records *r);
 
struct lws_auth_dns_sign_info {
        const char                      *input_filepath;
        const char                      *output_filepath;
        const char                      *jws_filepath;      /* Path to output signed JWS of the zone */
        const char                      *zsk_jwk_filepath;  /* Path to ZSK JWK config */
        const char                      *ksk_jwk_filepath;  /* Path to KSK JWK config */
        const char *                    (*subst_cb)(struct lws_auth_dns_sign_info *info, const char *name);
        void                            *subst_priv;
        const char                      **subst_names;      /* For lws_strexp fallback */
        const char                      **subst_values;
        time_t                          sign_validity_start_time; /* 0 = now */
        uint32_t                        sign_validity_duration;   /* 0 = LWS_AUTH_DNS_SIGN_VALIDITY_DEFAULT_SECS */
        int                             num_substs;
        const char                      *ipv4;              /* detected external addresses, */
        const char                      *ipv6;              /* for subst_cb's ${EXTIP4} / ${EXTIP6} */
        struct lws_context              *cx;                /* For logging/alloc */
        const char                      *domain;            /* NULL, or the only zone the input may be, see lws_auth_dns_zone_check_origin() */
        time_t                          verify_time;        /* verify only: when the RRSIGs must be valid, 0 = now */
 
        const char                      *curr_line;
        size_t                          curr_line_len;
        uint8_t                         skip_line;
};

LWS_VISIBLE LWS_EXTERN int
lws_auth_dns_sign_zone(struct lws_auth_dns_sign_info *info);

LWS_VISIBLE LWS_EXTERN int
lws_auth_dns_verify_zone(struct lws_auth_dns_sign_info *info);
 
#endif