001/*
002 * Copyright 2015-2020 the original author or authors
003 *
004 * This software is licensed under the Apache License, Version 2.0,
005 * the GNU Lesser General Public License version 2 or later ("LGPL")
006 * and the WTFPL.
007 * You may choose either license to govern your use of this software only
008 * upon the condition that you accept all of the terms of either
009 * the Apache License 2.0, the LGPL 2.1+ or the WTFPL.
010 */
011package org.minidns.dnssec;
012
013import java.util.Collections;
014import java.util.List;
015
016import org.minidns.constants.DnssecConstants.DigestAlgorithm;
017import org.minidns.dnsmessage.Question;
018import org.minidns.dnsname.DnsName;
019import org.minidns.record.DNSKEY;
020import org.minidns.record.Data;
021import org.minidns.record.RRSIG;
022import org.minidns.record.Record;
023import org.minidns.record.Record.TYPE;
024
025public abstract class DnssecUnverifiedReason {
026    public abstract String getReasonString();
027
028    @Override
029    public String toString() {
030        return getReasonString();
031    }
032
033    @Override
034    public int hashCode() {
035        return getReasonString().hashCode();
036    }
037
038    @Override
039    public boolean equals(Object obj) {
040        return obj instanceof DnssecUnverifiedReason && ((DnssecUnverifiedReason) obj).getReasonString().equals(getReasonString());
041    }
042
043    public static class AlgorithmNotSupportedReason extends DnssecUnverifiedReason {
044        private final String algorithm;
045        private final TYPE type;
046        private final Record<? extends Data> record;
047
048        public AlgorithmNotSupportedReason(byte algorithm, TYPE type, Record<? extends Data> record) {
049            this.algorithm = Integer.toString(algorithm & 0xff);
050            this.type = type;
051            this.record = record;
052        }
053
054        @Override
055        public String getReasonString() {
056            return type.name() + " algorithm " + algorithm + " required to verify " + record.name + " is unknown or not supported by platform";
057        }
058    }
059
060    public static class AlgorithmExceptionThrownReason extends DnssecUnverifiedReason {
061        private final int algorithmNumber;
062        private final String kind;
063        private final Exception reason;
064        private final Record<? extends Data> record;
065
066        public AlgorithmExceptionThrownReason(DigestAlgorithm algorithm, String kind, Record<? extends Data> record, Exception reason) {
067            this.algorithmNumber = algorithm.value;
068            this.kind = kind;
069            this.record = record;
070            this.reason = reason;
071        }
072
073        @Override
074        public String getReasonString() {
075            return kind + " algorithm " + algorithmNumber + " threw exception while verifying " + record.name + ": " + reason;
076        }
077    }
078
079    public static class ConflictsWithSep extends DnssecUnverifiedReason {
080        private final Record<DNSKEY> record;
081
082        public ConflictsWithSep(Record<DNSKEY> record) {
083            this.record = record;
084        }
085
086        @Override
087        public String getReasonString() {
088            return "Zone " + record.name.ace + " is in list of known SEPs, but DNSKEY from response mismatches!";
089        }
090    }
091
092    public static class NoTrustAnchorReason extends DnssecUnverifiedReason {
093        private final DnsName zone;
094
095        public NoTrustAnchorReason(DnsName zone) {
096            this.zone = zone;
097        }
098
099        @Override
100        public String getReasonString() {
101            return "No trust anchor was found for zone " + zone + ". Try enabling DLV";
102        }
103    }
104
105    public static class NoSecureEntryPointReason extends DnssecUnverifiedReason {
106        private final DnsName zone;
107
108        public NoSecureEntryPointReason(DnsName zone) {
109            this.zone = zone;
110        }
111
112        @Override
113        public String getReasonString() {
114            return "No secure entry point was found for zone " + zone;
115        }
116    }
117
118    public static class NoRootSecureEntryPointReason extends DnssecUnverifiedReason {
119        public NoRootSecureEntryPointReason() {
120        }
121
122        @Override
123        public String getReasonString() {
124            return "No secure entry point was found for the root zone (\"Did you forget to configure a root SEP?\")";
125        }
126    }
127
128    public static class NoSignaturesReason extends DnssecUnverifiedReason {
129        private final Question question;
130
131        public NoSignaturesReason(Question question) {
132            this.question = question;
133        }
134
135        @Override
136        public String getReasonString() {
137            return "No signatures were attached to answer on question for " + question.type + " at " + question.name;
138        }
139    }
140
141    public static class NoActiveSignaturesReason extends DnssecUnverifiedReason {
142        private final Question question;
143        private final List<RRSIG> outdatedRrSigs;
144
145        public NoActiveSignaturesReason(Question question, List<RRSIG> outdatedRrSigs) {
146            this.question = question;
147            assert !outdatedRrSigs.isEmpty();
148            this.outdatedRrSigs = Collections.unmodifiableList(outdatedRrSigs);
149        }
150
151        @Override
152        public String getReasonString() {
153            return "No currently active signatures were attached to answer on question for " + question.type + " at " + question.name;
154        }
155
156        public List<RRSIG> getOutdatedRrSigs() {
157            return outdatedRrSigs;
158        }
159    }
160
161    public static class NSECDoesNotMatchReason extends DnssecUnverifiedReason {
162        private final Question question;
163        private final Record<? extends Data> record;
164
165        public NSECDoesNotMatchReason(Question question, Record<? extends Data> record) {
166            this.question = question;
167            this.record = record;
168        }
169
170        @Override
171        public String getReasonString() {
172            return "NSEC " + record.name + " does nat match question for " + question.type + " at " + question.name;
173        }
174    }
175}