1 /* $NetBSD: ede.h,v 1.3 2026/08/29 14:55:17 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * SPDX-License-Identifier: MPL-2.0 7 * 8 * This Source Code Form is subject to the terms of the Mozilla Public 9 * License, v. 2.0. If a copy of the MPL was not distributed with this 10 * file, you can obtain one at https://mozilla.org/MPL/2.0/. 11 * 12 * See the COPYRIGHT file distributed with this work for additional 13 * information regarding copyright ownership. 14 */ 15 16 #pragma once 17 18 #include <isc/mem.h> 19 20 #include <dns/message.h> 21 22 /*%< EDNS0 extended DNS errors */ 23 #define DNS_EDE_OTHER 0 /*%< Other Error */ 24 #define DNS_EDE_DNSKEYALG 1 /*%< Unsupported DNSKEY Algorithm */ 25 #define DNS_EDE_DSDIGESTTYPE 2 /*%< Unsupported DS Digest Type */ 26 #define DNS_EDE_STALEANSWER 3 /*%< Stale Answer */ 27 #define DNS_EDE_FORGEDANSWER 4 /*%< Forged Answer */ 28 #define DNS_EDE_DNSSECINDETERMINATE 5 /*%< DNSSEC Indeterminate */ 29 #define DNS_EDE_DNSSECBOGUS 6 /*%< DNSSEC Bogus */ 30 #define DNS_EDE_SIGNATUREEXPIRED 7 /*%< Signature Expired */ 31 #define DNS_EDE_SIGNATURENOTYETVALID 8 /*%< Signature Not Yet Valid */ 32 #define DNS_EDE_DNSKEYMISSING 9 /*%< DNSKEY Missing */ 33 #define DNS_EDE_RRSIGSMISSING 10 /*%< RRSIGs Missing */ 34 #define DNS_EDE_NOZONEKEYBITSET 11 /*%< No Zone Key Bit Set */ 35 #define DNS_EDE_NSECMISSING 12 /*%< NSEC Missing */ 36 #define DNS_EDE_CACHEDERROR 13 /*%< Cached Error */ 37 #define DNS_EDE_NOTREADY 14 /*%< Not Ready */ 38 #define DNS_EDE_BLOCKED 15 /*%< Blocked */ 39 #define DNS_EDE_CENSORED 16 /*%< Censored */ 40 #define DNS_EDE_FILTERED 17 /*%< Filtered */ 41 #define DNS_EDE_PROHIBITED 18 /*%< Prohibited */ 42 #define DNS_EDE_STALENXANSWER 19 /*%< Stale NXDomain Answer */ 43 #define DNS_EDE_NOTAUTH 20 /*%< Not Authoritative */ 44 #define DNS_EDE_NOTSUPPORTED 21 /*%< Not Supported */ 45 #define DNS_EDE_NOREACHABLEAUTH 22 /*%< No Reachable Authority */ 46 #define DNS_EDE_NETWORKERROR 23 /*%< Network Error */ 47 #define DNS_EDE_INVALIDDATA 24 /*%< Invalid Data */ 48 #define DNS_EDE_NTA 33 /*%< Negative Trust Anchor */ 49 50 #define DNS_EDE_MAX_CODE DNS_EDE_NTA 51 52 /* 53 * From RFC 8914: 54 * Because long EXTRA-TEXT fields may trigger truncation (which is undesirable 55 * given the supplemental nature of EDE), implementers and operators creating 56 * EDE options SHOULD avoid lengthy EXTRA-TEXT contents. 57 * 58 * Following this advice we limit the EXTRA-TEXT length to 64 characters. 59 */ 60 #define DNS_EDE_EXTRATEXT_LEN 64 61 62 #define DNS_EDE_MAX_ERRORS 3 63 64 typedef struct dns_edectx dns_edectx_t; 65 struct dns_edectx { 66 int magic; 67 isc_mem_t *mctx; 68 dns_ednsopt_t *ede[DNS_EDE_MAX_ERRORS]; 69 uint64_t edeused; 70 size_t nextede; 71 }; 72 /*%< 73 * Multiple extended DNS errors (EDE) (defined in RFC 8914) can be raised during 74 * a DNS resolution and in various area of the code base. "dns_edectx_t" object 75 * abstract and holds pending EDE and the set of dns_ede_ API enable to 76 * manipulate its state (adding EDE, transfer to another context, etc.). EDE are 77 * internally stored in the wire format, so it can be directly consumed to build 78 * the response client message. 79 */ 80 81 STATIC_ASSERT(DNS_EDE_MAX_CODE <= 82 CHAR_BIT * sizeof(((dns_edectx_t *){ NULL })->edeused), 83 "DNS_EDE_MAX_CODE does not fit in the edeused bitmap"); 84 /* 85 * Make sure we can fit the currently supported EDE codes in the edeused bitmap. 86 */ 87 88 void 89 dns_ede_init(isc_mem_t *mctx, dns_edectx_t *edectx); 90 /*%< 91 * Initialize "edectx" so it is valid to use. Can be called after 92 * dns_ede_invalidate" is being called to reuse the object. 93 * 94 * Requires: 95 * 96 * \li "mctx" to be valid 97 * \li "edectx" to be valid 98 */ 99 100 void 101 dns_ede_reset(dns_edectx_t *edectx); 102 /*%< 103 * Reset "edectx" internal state and free all its EDE from memory. "edectx" is 104 * still valid to use, in the same state than after dns_ede_init is called. 105 * 106 * Requires: 107 * 108 * \li "edectx" to be valid 109 */ 110 111 void 112 dns_ede_invalidate(dns_edectx_t *edectx); 113 /*%< 114 * Reset "edectx" and remove its memory context as well as its magic number. It 115 * is not valid to use anymore. 116 * 117 * Requires: 118 * 119 * \li "edectx" to be valid 120 */ 121 122 void 123 dns_ede_add(dns_edectx_t *edectx, uint16_t code, const char *text); 124 /*%< 125 * Add a new extended error in "edectx". "code" must be one of the INFO-CODE 126 * values defined in RFC8914, see DNS_EDE_ macros above. "text" is optional, it 127 * is immediately copied internally if provided. 128 * 129 * Rules: 130 * 131 * \li If "text" is non NULL, it must be NULL terminated. If its length is more 132 * than DNS_EDE_EXTRATEXT_LEN, it is trucated. 133 * 134 * \li If an EDE with the same code has already been added to "edectx", the 135 * following ones with the same code are ignored. 136 * 137 * \li If more than DNS_EDE_MAX_ERRORS EDE have been already added to this 138 * context, the following ones are ignored. 139 * 140 * Requires: 141 * 142 * \li "edectx" to be valid 143 * \li "code" to be one of the INFO-CODE defied in RFC8914, see DNS_EDE_ macros. 144 */ 145 146 void 147 dns_ede_copy(dns_edectx_t *edectx_to, const dns_edectx_t *edectx_from); 148 /*%< 149 * Copy all EDE from "edectx_from" into "edectx_to". If "edectx_to" reaches the 150 * maximum number of EDE (see DNS_EDE_MAX_ERRORS), the copy stops and 151 * remaining EDE in "edectx_from" are not copied. 152 * 153 * Rules defined in "dns_ede_add" applies. 154 * 155 * Requires: 156 * 157 * \li "edectx_from" to be valid 158 * \li "edectx_to" to be valid 159 */ 160
Indexes created Mon Oct 05 00:25:34 UTC 2026