1 /* $NetBSD: nsec3_50.h,v 1.1 2024/02/18 20:57:43 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * SPDX-License-Identifier: MPL-2.0 7 * 8 * This Source Code Form is subject to the terms of the Mozilla Public 9 * License, v. 2.0. If a copy of the MPL was not distributed with this 10 * file, you can obtain one at https://mozilla.org/MPL/2.0/. 11 * 12 * See the COPYRIGHT file distributed with this work for additional 13 * information regarding copyright ownership. 14 */ 15 16 #ifndef GENERIC_NSEC3_50_H 17 #define GENERIC_NSEC3_50_H 1 18 19 /*! 20 * \brief Per RFC 5155 */ 21 22 #include <isc/iterated_hash.h> 23 24 typedef struct dns_rdata_nsec3 { 25 dns_rdatacommon_t common; 26 isc_mem_t *mctx; 27 dns_hash_t hash; 28 unsigned char flags; 29 dns_iterations_t iterations; 30 unsigned char salt_length; 31 unsigned char next_length; 32 uint16_t len; 33 unsigned char *salt; 34 unsigned char *next; 35 unsigned char *typebits; 36 } dns_rdata_nsec3_t; 37 38 /* 39 * The corresponding NSEC3 interval is OPTOUT indicating possible 40 * insecure delegations. 41 */ 42 #define DNS_NSEC3FLAG_OPTOUT 0x01U 43 44 /*% 45 * The following flags are used in the private-type record (implemented in 46 * lib/dns/private.c) which is used to store NSEC3PARAM data during the 47 * time when it is not legal to have an actual NSEC3PARAM record in the 48 * zone. They are defined here because the private-type record uses the 49 * same flags field for the OPTOUT flag above and for the private flags 50 * below. XXX: This should be considered for refactoring. 51 */ 52 53 /*% 54 * Non-standard, private type only. 55 * 56 * Create a corresponding NSEC3 chain. 57 * Once the NSEC3 chain is complete this flag will be removed to signal 58 * that there is a complete chain. 59 * 60 * This flag is automatically set when a NSEC3PARAM record is added to 61 * the zone via UPDATE. 62 * 63 * NSEC3PARAM records containing this flag should never be published, 64 * but if they are, they should be ignored by RFC 5155 compliant 65 * nameservers. 66 */ 67 #define DNS_NSEC3FLAG_CREATE 0x80U 68 69 /*% 70 * Non-standard, private type only. 71 * 72 * The corresponding NSEC3 set is to be removed once the NSEC chain 73 * has been generated. 74 * 75 * This flag is automatically set when the last active NSEC3PARAM record 76 * is removed from the zone via UPDATE. 77 * 78 * NSEC3PARAM records containing this flag should never be published, 79 * but if they are, they should be ignored by RFC 5155 compliant 80 * nameservers. 81 */ 82 #define DNS_NSEC3FLAG_REMOVE 0x40U 83 84 /*% 85 * Non-standard, private type only. 86 * 87 * When set with the CREATE flag, a corresponding NSEC3 chain will be 88 * created when the zone becomes capable of supporting one (i.e., when it 89 * has a DNSKEY RRset containing at least one NSEC3-capable algorithm). 90 * Without this flag, NSEC3 chain creation would be attempted immediately, 91 * fail, and the private type record would be removed. With it, the NSEC3 92 * parameters are stored until they can be used. When the zone has the 93 * necessary prerequisites for NSEC3, then the INITIAL flag can be cleared, 94 * and the record will be cleaned up normally. 95 * 96 * NSEC3PARAM records containing this flag should never be published, but 97 * if they are, they should be ignored by RFC 5155 compliant nameservers. 98 */ 99 #define DNS_NSEC3FLAG_INITIAL 0x20U 100 101 /*% 102 * Non-standard, private type only. 103 * 104 * Prevent the creation of a NSEC chain before the last NSEC3 chain 105 * is removed. This will normally only be set when the zone is 106 * transitioning from secure with NSEC3 chains to insecure. 107 * 108 * NSEC3PARAM records containing this flag should never be published, 109 * but if they are, they should be ignored by RFC 5155 compliant 110 * nameservers. 111 */ 112 #define DNS_NSEC3FLAG_NONSEC 0x10U 113 114 #endif /* GENERIC_NSEC3_50_H */ 115