1 /* -*- Mode: C; tab-width: 4 -*-
3 * Copyright (c) 2012 Apple Computer, Inc. All rights reserved.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #include "mDNSEmbeddedAPI.h"
19 #include "CryptoAlg.h"
20 #include "anonymous.h"
21 #include "DNSCommon.h"
23 // Define ANONYMOUS_DISABLED to remove all the anonymous functionality
24 // and use the stub functions implemented later in this file.
26 #ifndef ANONYMOUS_DISABLED
28 #define ANON_NSEC3_ITERATIONS 1
30 mDNSlocal mDNSBool
InitializeNSEC3Record(ResourceRecord
*rr
, const mDNSu8
*AnonData
, int len
, mDNSu32 salt
)
33 rdataNSEC3
*nsec3
= (rdataNSEC3
*)rr
->rdata
->u
.data
;
35 unsigned short iter
= ANON_NSEC3_ITERATIONS
;
37 const mDNSu8 hashName
[NSEC3_MAX_HASH_LEN
];
39 // Construct the RDATA first and construct the owner name based on that.
40 ptr
= (const mDNSu8
*)&salt
;
41 debugf("InitializeNSEC3Record: %x%x%x%x, name %##s", ptr
[0], ptr
[1], ptr
[2], ptr
[3], rr
->name
->c
);
44 nsec3
->alg
= SHA1_DIGEST_TYPE
;
46 nsec3
->iterations
= swap16(iter
);
47 nsec3
->saltLength
= 4;
48 tmp
= (mDNSu8
*)&nsec3
->salt
;
54 // hashLength, nxt, bitmap
55 *tmp
++ = SHA1_HASH_LENGTH
; // hash length
57 tmp
+= SHA1_HASH_LENGTH
;
58 *tmp
++ = 0; // window number
59 *tmp
++ = NSEC_MCAST_WINDOW_SIZE
; // window length
60 mDNSPlatformMemZero(tmp
, NSEC_MCAST_WINDOW_SIZE
);
61 tmp
[kDNSType_PTR
>> 3] |= 128 >> (kDNSType_PTR
& 7);
63 // Hash the base service name + salt + AnonData
64 if (!NSEC3HashName(rr
->name
, nsec3
, AnonData
, len
, hashName
, &hlen
))
66 LogMsg("InitializeNSEC3Record: NSEC3HashName failed for ##s", rr
->name
->c
);
69 if (hlen
!= SHA1_HASH_LENGTH
)
71 LogMsg("InitializeNSEC3Record: hlen wrong %d", hlen
);
74 mDNSPlatformMemCopy(nxt
, hashName
, hlen
);
79 mDNSlocal ResourceRecord
*ConstructNSEC3Record(const domainname
*service
, const mDNSu8
*AnonData
, int len
, mDNSu32 salt
)
85 // We are just allocating an RData which has StandardAuthRDSize
86 if (StandardAuthRDSize
< MCAST_NSEC3_RDLENGTH
)
88 LogMsg("ConstructNSEC3Record: StandardAuthRDSize %d smaller than MCAST_NSEC3_RDLENGTH %d", StandardAuthRDSize
, MCAST_NSEC3_RDLENGTH
);
92 dlen
= DomainNameLength(service
);
94 // Allocate space for the name and RData.
95 rr
= mDNSPlatformMemAllocate(sizeof(ResourceRecord
) + dlen
+ sizeof(RData
));
98 name
= (domainname
*)((mDNSu8
*)rr
+ sizeof(ResourceRecord
));
99 rr
->RecordType
= kDNSRecordTypePacketAuth
;
100 rr
->InterfaceID
= mDNSInterface_Any
;
101 rr
->name
= (const domainname
*)name
;
102 rr
->rrtype
= kDNSType_NSEC3
;
103 rr
->rrclass
= kDNSClass_IN
;
104 rr
->rroriginalttl
= kStandardTTL
;
105 rr
->rDNSServer
= mDNSNULL
;
106 rr
->rdlength
= MCAST_NSEC3_RDLENGTH
;
107 rr
->rdestimate
= MCAST_NSEC3_RDLENGTH
;
108 rr
->rdata
= (RData
*)((mDNSu8
*)rr
->name
+ dlen
);
110 AssignDomainName(name
, service
);
111 if (!InitializeNSEC3Record(rr
, AnonData
, len
, salt
))
113 mDNSPlatformMemFree(rr
);
119 mDNSlocal ResourceRecord
*CopyNSEC3ResourceRecord(AnonymousInfo
*si
, const ResourceRecord
*rr
)
123 ResourceRecord
*nsec3rr
;
125 if (rr
->rdlength
< MCAST_NSEC3_RDLENGTH
)
127 LogMsg("CopyNSEC3ResourceRecord: rdlength %d smaller than MCAST_NSEC3_RDLENGTH %d", rr
->rdlength
, MCAST_NSEC3_RDLENGTH
);
130 // Allocate space for the name and the rdata along with the ResourceRecord
131 len
= DomainNameLength(rr
->name
);
132 nsec3rr
= mDNSPlatformMemAllocate(sizeof(ResourceRecord
) + len
+ sizeof(RData
));
137 name
= (domainname
*)((mDNSu8
*)nsec3rr
+ sizeof(ResourceRecord
));
138 nsec3rr
->name
= (const domainname
*)name
;
139 AssignDomainName(name
, rr
->name
);
141 nsec3rr
->rdata
= (RData
*)((mDNSu8
*)nsec3rr
->name
+ len
);
142 mDNSPlatformMemCopy(nsec3rr
->rdata
->u
.data
, rr
->rdata
->u
.data
, rr
->rdlength
);
144 si
->nsec3RR
= nsec3rr
;
149 // When a service is started or a browse is started with the Anonymous data, we allocate a new random
150 // number and based on that allocate a new NSEC3 resource record whose hash is a function of random number (salt) and
151 // the anonymous data.
153 // If we receive a packet with the NSEC3 option, we need to cache that along with the resource record so that we can
154 // check against the question to see whether it answers them or not. In that case, we pass the "rr" that we received.
155 mDNSexport AnonymousInfo
*AllocateAnonInfo(const domainname
*service
, const mDNSu8
*data
, int len
, const ResourceRecord
*rr
)
158 ai
= (AnonymousInfo
*)mDNSPlatformMemAllocate(sizeof(AnonymousInfo
));
163 mDNSPlatformMemZero(ai
, sizeof(AnonymousInfo
));
166 if (!CopyNSEC3ResourceRecord(ai
, rr
))
168 mDNSPlatformMemFree(ai
);
173 ai
->salt
= mDNSRandom(0xFFFFFFFF);
174 ai
->AnonData
= mDNSPlatformMemAllocate(len
);
177 mDNSPlatformMemFree(ai
);
180 ai
->AnonDataLen
= len
;
181 mDNSPlatformMemCopy(ai
->AnonData
, data
, len
);
182 ai
->nsec3RR
= ConstructNSEC3Record(service
, data
, len
, ai
->salt
);
185 mDNSPlatformMemFree(ai
);
191 mDNSexport
void FreeAnonInfo(AnonymousInfo
*ai
)
194 mDNSPlatformMemFree(ai
->nsec3RR
);
196 mDNSPlatformMemFree(ai
->AnonData
);
197 mDNSPlatformMemFree(ai
);
200 mDNSexport
void ReInitAnonInfo(AnonymousInfo
**AnonInfo
, const domainname
*name
)
204 AnonymousInfo
*ai
= *AnonInfo
;
205 *AnonInfo
= AllocateAnonInfo(name
, ai
->AnonData
, ai
->AnonDataLen
, mDNSNULL
);
213 // This function should be used only if you know that the question and
214 // the resource record belongs to the same set. The main usage is
215 // in ProcessQuery where we find the question to be part of the same
216 // set as the resource record, but it needs the AnonData to be
217 // initialized so that it can walk the cache records to see if they
218 // answer the question.
219 mDNSexport
void SetAnonData(DNSQuestion
*q
, ResourceRecord
*rr
, mDNSBool ForQuestion
)
221 if (!q
->AnonInfo
|| !rr
->AnonInfo
)
223 LogMsg("SetAnonData: question %##s(%p), rr %##s(%p), NULL", q
->qname
.c
, q
->AnonInfo
, rr
->name
->c
, rr
->AnonInfo
);
227 debugf("SetAnonData: question %##s(%p), rr %##s(%p)", q
->qname
.c
, q
->AnonInfo
, rr
->name
->c
, rr
->AnonInfo
);
230 if (!q
->AnonInfo
->AnonData
)
232 q
->AnonInfo
->AnonData
= mDNSPlatformMemAllocate(rr
->AnonInfo
->AnonDataLen
);
233 if (!q
->AnonInfo
->AnonData
)
236 mDNSPlatformMemCopy(q
->AnonInfo
->AnonData
, rr
->AnonInfo
->AnonData
, rr
->AnonInfo
->AnonDataLen
);
237 q
->AnonInfo
->AnonDataLen
= rr
->AnonInfo
->AnonDataLen
;
241 if (!rr
->AnonInfo
->AnonData
)
243 rr
->AnonInfo
->AnonData
= mDNSPlatformMemAllocate(q
->AnonInfo
->AnonDataLen
);
244 if (!rr
->AnonInfo
->AnonData
)
247 mDNSPlatformMemCopy(rr
->AnonInfo
->AnonData
, q
->AnonInfo
->AnonData
, q
->AnonInfo
->AnonDataLen
);
248 rr
->AnonInfo
->AnonDataLen
= q
->AnonInfo
->AnonDataLen
;
252 // returns -1 if the caller should ignore the result
253 // returns 1 if the record answers the question
254 // returns 0 if the record does not answer the question
255 mDNSexport
int AnonInfoAnswersQuestion(const ResourceRecord
*const rr
, const DNSQuestion
*const q
)
257 mDNSexport mDNS mDNSStorage
;
258 ResourceRecord
*nsec3RR
;
260 AnonymousInfo
*qai
, *rai
;
265 const mDNSu8 hashName
[NSEC3_MAX_HASH_LEN
];
269 debugf("AnonInfoAnswersQuestion: question qname %##s", q
->qname
.c
);
271 // Currently only PTR records can have anonymous information
272 if (q
->qtype
!= kDNSType_PTR
)
277 // We allow anonymous questions to be answered by both normal services (without the
278 // anonymous information) and anonymous services that are part of the same set. And
279 // normal questions discover normal services and all anonymous services.
281 // The three cases have been enumerated clearly even though they all behave the
285 debugf("AnonInfoAnswersQuestion: not a anonymous type question");
294 debugf("AnonInfoAnswersQuestion: Question %##s not answered using anonymous record %##s", q
->qname
.c
, rr
->name
->c
);
303 debugf("AnonInfoAnswersQuestion: not a anonymous type record");
308 // case 4: We have the anonymous information both in the question and the record. We need
309 // two sets of information to validate.
311 // 1) Anonymous data that identifies the set/group
312 // 2) NSEC3 record that contains the hash and the salt
314 // If the question is a remote one, it does not have the anonymous information to validate (just
315 // the NSEC3 record) and hence the anonymous data should come from the local resource record. If the
316 // question is local, it can come from either of them and if there is a mismatch between the
317 // question and record, it won't validate.
322 if (qai
->AnonData
&& rai
->AnonData
)
324 // Before a cache record is created, if there is a matching question i.e., part
325 // of the same set, then when the cache is created we also set the anonymous
326 // information. Otherwise, the cache record contains just the NSEC3 record and we
327 // won't be here for that case.
329 // It is also possible that a local question is matched against the local AuthRecord
330 // as that is also the case for which the AnonData would be non-NULL for both.
331 // We match questions against AuthRecords (rather than the cache) for LocalOnly case and
332 // to see whether a .local query should be suppressed or not. The latter never happens
333 // because PTR queries are never suppressed.
335 // If they don't belong to the same anonymous set, then no point in validating.
336 if ((qai
->AnonDataLen
!= rai
->AnonDataLen
) ||
337 mDNSPlatformMemCmp(qai
->AnonData
, rai
->AnonData
, qai
->AnonDataLen
) != 0)
339 debugf("AnonInfoAnswersQuestion: AnonData mis-match for record %s question %##s ",
340 RRDisplayString(&mDNSStorage
, rr
), q
->qname
.c
);
343 // AnonData matches i.e they belong to the same group and the same service.
344 LogInfo("AnonInfoAnswersQuestion: Answering qname %##s, rname %##s, without validation", q
->qname
.c
,
350 debugf("AnonInfoAnswersQuestion: question %p, record %p", qai
->AnonData
, rai
->AnonData
);
355 // If there is AnonData, then this is a local question. The
356 // NSEC3 RR comes from the resource record which could be part
357 // of the cache or local auth record. The cache entry could
358 // be from a remote host or created when we heard our own
359 // announcements. In any case, we use that to see if it matches
361 AnonData
= qai
->AnonData
;
362 AnonDataLen
= qai
->AnonDataLen
;
363 nsec3RR
= rai
->nsec3RR
;
367 // Remote question or hearing our own question back
368 AnonData
= rai
->AnonData
;
369 AnonDataLen
= rai
->AnonDataLen
;
370 nsec3RR
= qai
->nsec3RR
;
373 if (!AnonData
|| !nsec3RR
)
375 // AnonData can be NULL for the cache entry and if we are hearing our own question back, AnonData is NULL for
376 // that too and we can end up here for that case.
377 debugf("AnonInfoAnswersQuestion: AnonData %p or nsec3RR %p, NULL for question %##s, record %s", AnonData
, nsec3RR
,
378 q
->qname
.c
, RRDisplayString(&mDNSStorage
, rr
));
381 debugf("AnonInfoAnswersQuestion: Validating question %##s, ResourceRecord %s", q
->qname
.c
, RRDisplayString(&mDNSStorage
, nsec3RR
));
384 nsec3
= (rdataNSEC3
*)nsec3RR
->rdata
->u
.data
;
386 if (!NSEC3HashName(nsec3RR
->name
, nsec3
, AnonData
, AnonDataLen
, hashName
, &hlen
))
388 LogMsg("AnonInfoAnswersQuestion: NSEC3HashName failed for ##s", nsec3RR
->name
->c
);
391 if (hlen
!= SHA1_HASH_LENGTH
)
393 LogMsg("AnonInfoAnswersQuestion: hlen wrong %d", hlen
);
397 NSEC3Parse(nsec3RR
, mDNSNULL
, &nxtLength
, &nxtName
, mDNSNULL
, mDNSNULL
);
399 if (hlen
!= nxtLength
)
401 LogMsg("AnonInfoAnswersQuestion: ERROR!! hlen %d not same as nxtLength %d", hlen
, nxtLength
);
405 for (i
= 0; i
< nxtLength
; i
++)
407 if (nxtName
[i
] != hashName
[i
])
409 debugf("AnonInfoAnswersQuestion: mismatch output %x, digest %x, i %d", nxtName
[i
+1], hashName
[i
], i
);
413 LogInfo("AnonInfoAnswersQuestion: ResourceRecord %s matched question %##s (%s)", RRDisplayString(&mDNSStorage
, nsec3RR
), q
->qname
.c
, DNSTypeName(q
->qtype
));
417 // Find a matching NSEC3 record for the name. We parse the questions and the records in the packet in order.
418 // Similarly we also parse the NSEC3 records in order and this mapping to the questions and records
420 mDNSlocal CacheRecord
*FindMatchingNSEC3ForName(mDNS
*const m
, CacheRecord
**nsec3
, const domainname
*name
)
423 CacheRecord
**prev
= nsec3
;
427 for (cr
= *nsec3
; cr
; cr
= cr
->next
)
429 if (SameDomainName(cr
->resrec
.name
, name
))
431 debugf("FindMatchingNSEC3ForName: NSEC3 record %s matched %##s", CRDisplayString(m
, cr
), name
->c
);
441 mDNSexport
void InitializeAnonInfoForQuestion(mDNS
*const m
, CacheRecord
**McastNSEC3Records
, DNSQuestion
*q
)
443 CacheRecord
*nsec3CR
;
445 if (q
->qtype
!= kDNSType_PTR
)
448 nsec3CR
= FindMatchingNSEC3ForName(m
, McastNSEC3Records
, &q
->qname
);
451 q
->AnonInfo
= AllocateAnonInfo(mDNSNULL
, mDNSNULL
, 0, &nsec3CR
->resrec
);
454 debugf("InitializeAnonInfoForQuestion: Found a matching NSEC3 record %s, for %##s (%s)",
455 RRDisplayString(m
, q
->AnonInfo
->nsec3RR
), q
->qname
.c
, DNSTypeName(q
->qtype
));
457 ReleaseCacheRecord(m
, nsec3CR
);
461 mDNSexport
void InitializeAnonInfoForCR(mDNS
*const m
, CacheRecord
**McastNSEC3Records
, CacheRecord
*cr
)
463 CacheRecord
*nsec3CR
;
465 if (!(*McastNSEC3Records
))
468 // If already initialized or not a PTR type, we don't have to do anything
469 if (cr
->resrec
.AnonInfo
|| cr
->resrec
.rrtype
!= kDNSType_PTR
)
472 nsec3CR
= FindMatchingNSEC3ForName(m
, McastNSEC3Records
, cr
->resrec
.name
);
475 cr
->resrec
.AnonInfo
= AllocateAnonInfo(mDNSNULL
, mDNSNULL
, 0, &nsec3CR
->resrec
);
476 if (cr
->resrec
.AnonInfo
)
478 debugf("InitializeAnonInfoForCR: Found a matching NSEC3 record %s, for %##s (%s)",
479 RRDisplayString(m
, cr
->resrec
.AnonInfo
->nsec3RR
), cr
->resrec
.name
->c
,
480 DNSTypeName(cr
->resrec
.rrtype
));
482 ReleaseCacheRecord(m
, nsec3CR
);
486 mDNSexport mDNSBool
IdenticalAnonInfo(AnonymousInfo
*a1
, AnonymousInfo
*a2
)
488 // if a1 is NULL and a2 is not NULL AND vice-versa
489 // return false as there is a change.
490 if ((a1
!= mDNSNULL
) != (a2
!= mDNSNULL
))
493 // Both could be NULL or non-NULL
496 // The caller already verified that the owner name is the same.
497 // Check whether the RData is same.
498 if (!IdenticalSameNameRecord(a1
->nsec3RR
, a2
->nsec3RR
))
500 debugf("IdenticalAnonInfo: nsec3RR mismatch");
507 mDNSexport
void CopyAnonInfoForCR(mDNS
*const m
, CacheRecord
*crto
, CacheRecord
*crfrom
)
509 AnonymousInfo
*aifrom
= crfrom
->resrec
.AnonInfo
;
510 AnonymousInfo
*aito
= crto
->resrec
.AnonInfo
;
519 crto
->resrec
.AnonInfo
= aifrom
;
521 crfrom
->resrec
.AnonInfo
= mDNSNULL
;
525 FreeAnonInfo(aifrom
);
526 crfrom
->resrec
.AnonInfo
= mDNSNULL
;
530 #else // !ANONYMOUS_DISABLED
532 mDNSexport
void ReInitAnonInfo(AnonymousInfo
**si
, const domainname
*name
)
538 mDNSexport AnonymousInfo
* AllocateAnonInfo(const domainname
*service
, const mDNSu8
*AnonData
, int len
, const ResourceRecord
*rr
)
548 mDNSexport
void FreeAnonInfo(AnonymousInfo
*ai
)
553 mDNSexport
void SetAnonData(DNSQuestion
*q
, ResourceRecord
*rr
, mDNSBool ForQuestion
)
560 mDNSexport
int AnonInfoAnswersQuestion(const ResourceRecord
*const rr
, const DNSQuestion
*const q
)
568 mDNSexport
void InitializeAnonInfoForQuestion(mDNS
*const m
, CacheRecord
**McastNSEC3Records
, DNSQuestion
*q
)
571 (void)McastNSEC3Records
;
575 mDNSexport
void InitializeAnonInfoForCR(mDNS
*const m
, CacheRecord
**McastNSEC3Records
, CacheRecord
*cr
)
578 (void)McastNSEC3Records
;
582 mDNSexport
void CopyAnonInfoForCR(mDNS
*const m
, CacheRecord
*crto
, CacheRecord
*crfrom
)
589 mDNSexport mDNSBool
IdenticalAnonInfo(AnonymousInfo
*a1
, AnonymousInfo
*a2
)
597 #endif // !ANONYMOUS_DISABLED