1 /*
2 * util/edns.c - handle base EDNS options.
3 *
4 * Copyright (c) 2018, NLnet Labs. All rights reserved.
5 *
6 * This software is open source.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
14 *
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
18 *
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 */
35
36 /**
37 * \file
38 *
39 * This file contains functions for base EDNS options.
40 */
41
42 #include "config.h"
43 #include "util/edns.h"
44 #include "util/config_file.h"
45 #include "util/netevent.h"
46 #include "util/net_help.h"
47 #include "util/regional.h"
48 #include "util/rfc_1982.h"
49 #include "util/siphash.h"
50 #include "util/data/msgparse.h"
51 #include "util/data/msgreply.h"
52 #include "sldns/sbuffer.h"
53
edns_strings_create(void)54 struct edns_strings* edns_strings_create(void)
55 {
56 struct edns_strings* edns_strings = calloc(1,
57 sizeof(struct edns_strings));
58 if(!edns_strings)
59 return NULL;
60 if(!(edns_strings->region = regional_create())) {
61 edns_strings_delete(edns_strings);
62 return NULL;
63 }
64 return edns_strings;
65 }
66
edns_strings_delete(struct edns_strings * edns_strings)67 void edns_strings_delete(struct edns_strings* edns_strings)
68 {
69 if(!edns_strings)
70 return;
71 regional_destroy(edns_strings->region);
72 free(edns_strings);
73 }
74
75 static int
edns_strings_client_insert(struct edns_strings * edns_strings,struct sockaddr_storage * addr,socklen_t addrlen,int net,const char * string)76 edns_strings_client_insert(struct edns_strings* edns_strings,
77 struct sockaddr_storage* addr, socklen_t addrlen, int net,
78 const char* string)
79 {
80 struct edns_string_addr* esa = regional_alloc_zero(edns_strings->region,
81 sizeof(struct edns_string_addr));
82 if(!esa)
83 return 0;
84 esa->string_len = strlen(string);
85 esa->string = regional_alloc_init(edns_strings->region, string,
86 esa->string_len);
87 if(!esa->string)
88 return 0;
89 if(!addr_tree_insert(&edns_strings->client_strings, &esa->node, addr,
90 addrlen, net)) {
91 verbose(VERB_QUERY, "duplicate EDNS client string ignored.");
92 }
93 return 1;
94 }
95
edns_strings_apply_cfg(struct edns_strings * edns_strings,struct config_file * config)96 int edns_strings_apply_cfg(struct edns_strings* edns_strings,
97 struct config_file* config)
98 {
99 struct config_str2list* c;
100 regional_free_all(edns_strings->region);
101 addr_tree_init(&edns_strings->client_strings);
102
103 for(c=config->edns_client_strings; c; c=c->next) {
104 struct sockaddr_storage addr;
105 socklen_t addrlen;
106 int net;
107 log_assert(c->str && c->str2);
108
109 if(!netblockstrtoaddr(c->str, UNBOUND_DNS_PORT, &addr, &addrlen,
110 &net)) {
111 log_err("cannot parse EDNS client string IP netblock: "
112 "%s", c->str);
113 return 0;
114 }
115 if(!edns_strings_client_insert(edns_strings, &addr, addrlen,
116 net, c->str2)) {
117 log_err("out of memory while adding EDNS strings");
118 return 0;
119 }
120 }
121 edns_strings->client_string_opcode = config->edns_client_string_opcode;
122
123 addr_tree_init_parents(&edns_strings->client_strings);
124 return 1;
125 }
126
127 struct edns_string_addr*
edns_string_addr_lookup(rbtree_type * tree,struct sockaddr_storage * addr,socklen_t addrlen)128 edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr,
129 socklen_t addrlen)
130 {
131 return (struct edns_string_addr*)addr_tree_lookup(tree, addr, addrlen);
132 }
133
134 uint8_t*
edns_cookie_server_hash(const uint8_t * in,const uint8_t * secret,int v4,uint8_t * hash)135 edns_cookie_server_hash(const uint8_t* in, const uint8_t* secret, int v4,
136 uint8_t* hash)
137 {
138 v4?siphash(in, 20, secret, hash, 8):siphash(in, 32, secret, hash, 8);
139 return hash;
140 }
141
142 void
edns_cookie_server_write(uint8_t * buf,const uint8_t * secret,int v4,uint32_t timestamp)143 edns_cookie_server_write(uint8_t* buf, const uint8_t* secret, int v4,
144 uint32_t timestamp)
145 {
146 uint8_t hash[8];
147 buf[ 8] = 1; /* Version */
148 buf[ 9] = 0; /* Reserved */
149 buf[10] = 0; /* Reserved */
150 buf[11] = 0; /* Reserved */
151 sldns_write_uint32(buf + 12, timestamp);
152 (void)edns_cookie_server_hash(buf, secret, v4, hash);
153 memcpy(buf + 16, hash, 8);
154 }
155
156 enum edns_cookie_val_status
edns_cookie_server_validate(const uint8_t * cookie,size_t cookie_len,const uint8_t * secret,size_t secret_len,int v4,const uint8_t * hash_input,uint32_t now)157 edns_cookie_server_validate(const uint8_t* cookie, size_t cookie_len,
158 const uint8_t* secret, size_t secret_len, int v4,
159 const uint8_t* hash_input, uint32_t now)
160 {
161 uint8_t hash[8];
162 uint32_t timestamp;
163 uint32_t subt_1982 = 0; /* Initialize for the compiler; unused value */
164 int comp_1982;
165 if(cookie_len != 24)
166 /* RFC9018 cookies are 24 bytes long */
167 return COOKIE_STATUS_CLIENT_ONLY;
168 if(secret_len != 16 || /* RFC9018 cookies have 16 byte secrets */
169 cookie[8] != 1) /* RFC9018 cookies are cookie version 1 */
170 return COOKIE_STATUS_INVALID;
171 timestamp = sldns_read_uint32(cookie + 12);
172 if((comp_1982 = compare_1982(now, timestamp)) > 0
173 && (subt_1982 = subtract_1982(timestamp, now)) > 3600)
174 /* Cookie is older than 1 hour (see RFC9018 Section 4.3.) */
175 return COOKIE_STATUS_EXPIRED;
176 if(comp_1982 <= 0 && subtract_1982(now, timestamp) > 300)
177 /* Cookie time is more than 5 minutes in the future.
178 * (see RFC9018 Section 4.3.) */
179 return COOKIE_STATUS_FUTURE;
180 if(memcmp(edns_cookie_server_hash(hash_input, secret, v4, hash),
181 cookie + 16, 8) != 0)
182 /* Hashes do not match */
183 return COOKIE_STATUS_INVALID;
184 if(comp_1982 > 0 && subt_1982 > 1800)
185 /* Valid cookie but older than 30 minutes, so create a new one
186 * anyway */
187 return COOKIE_STATUS_VALID_RENEW;
188 return COOKIE_STATUS_VALID;
189 }
190