/* SPDX-License-Identifier: LGPL-2.1+ */
 
#include <sys/socket.h>
#include <errno.h>
 
#include "dns-type.h"
#include "parse-util.h"
#include "string-util.h"
 
typedef const struct {
        uint16_t type;
        const char *name;
} dns_type;
 
static const struct dns_type_name *
lookup_dns_type (register const char *str, register GPERF_LEN_TYPE len);
 
#include "dns_type-from-name.h"
#include "dns_type-to-name.h"
 
int dns_type_from_string(const char *s) {
        const struct dns_type_name *sc;
 
        assert(s);
 
        sc = lookup_dns_type(s, strlen(s));
        if (sc)
                return sc->id;
 
        s = startswith_no_case(s, "TYPE");
        if (s) {
                unsigned x;
 
                if (safe_atou(s, &x) >= 0 &&
                    x <= UINT16_MAX)
                        return (int) x;
        }
 
        return _DNS_TYPE_INVALID;
}
 
bool dns_type_is_pseudo(uint16_t type) {
 
        /* Checks whether the specified type is a "pseudo-type". What
         * a "pseudo-type" precisely is, is defined only very weakly,
         * but apparently entails all RR types that are not actually
         * stored as RRs on the server and should hence also not be
         * cached. We use this list primarily to validate NSEC type
         * bitfields, and to verify what to cache. */
 
        return IN_SET(type,
                      0, /* A Pseudo RR type, according to RFC 2931 */
                      DNS_TYPE_ANY,
                      DNS_TYPE_AXFR,
                      DNS_TYPE_IXFR,
                      DNS_TYPE_OPT,
                      DNS_TYPE_TSIG,
                      DNS_TYPE_TKEY
        );
}
 
bool dns_class_is_pseudo(uint16_t class) {
        return class == DNS_TYPE_ANY;
}
 
bool dns_type_is_valid_query(uint16_t type) {
 
        /* The types valid as questions in packets */
 
        return !IN_SET(type,
                       0,
                       DNS_TYPE_OPT,
                       DNS_TYPE_TSIG,
                       DNS_TYPE_TKEY,
 
                       /* RRSIG are technically valid as questions, but we refuse doing explicit queries for them, as
                        * they aren't really payload, but signatures for payload, and cannot be validated on their
                        * own. After all they are the signatures, and have no signatures of their own validating
                        * them. */
                       DNS_TYPE_RRSIG);
}
 
bool dns_type_is_zone_transer(uint16_t type) {
 
        /* Zone transfers, either normal or incremental */
 
        return IN_SET(type,
                      DNS_TYPE_AXFR,
                      DNS_TYPE_IXFR);
}
 
bool dns_type_is_valid_rr(uint16_t type) {
 
        /* The types valid as RR in packets (but not necessarily
         * stored on servers). */
 
        return !IN_SET(type,
                       DNS_TYPE_ANY,
                       DNS_TYPE_AXFR,
                       DNS_TYPE_IXFR);
}
 
bool dns_class_is_valid_rr(uint16_t class) {
        return class != DNS_CLASS_ANY;
}
 
bool dns_type_may_redirect(uint16_t type) {
        /* The following record types should never be redirected using
         * CNAME/DNAME RRs. See
         * <https://tools.ietf.org/html/rfc4035#section-2.5>. */
 
        if (dns_type_is_pseudo(type))
                return false;
 
        return !IN_SET(type,
                       DNS_TYPE_CNAME,
                       DNS_TYPE_DNAME,
                       DNS_TYPE_NSEC3,
                       DNS_TYPE_NSEC,
                       DNS_TYPE_RRSIG,
                       DNS_TYPE_NXT,
                       DNS_TYPE_SIG,
                       DNS_TYPE_KEY);
}
 
bool dns_type_may_wildcard(uint16_t type) {
 
        /* The following records may not be expanded from wildcard RRsets */
 
        if (dns_type_is_pseudo(type))
                return false;
 
        return !IN_SET(type,
                       DNS_TYPE_NSEC3,
                       DNS_TYPE_SOA,
 
                       /* Prohibited by https://tools.ietf.org/html/rfc4592#section-4.4 */
                       DNS_TYPE_DNAME);
}
 
bool dns_type_apex_only(uint16_t type) {
 
        /* Returns true for all RR types that may only appear signed in a zone apex */
 
        return IN_SET(type,
                      DNS_TYPE_SOA,
                      DNS_TYPE_NS,            /* this one can appear elsewhere, too, but not signed */
                      DNS_TYPE_DNSKEY,
                      DNS_TYPE_NSEC3PARAM);
}
 
bool dns_type_is_dnssec(uint16_t type) {
        return IN_SET(type,
                      DNS_TYPE_DS,
                      DNS_TYPE_DNSKEY,
                      DNS_TYPE_RRSIG,
                      DNS_TYPE_NSEC,
                      DNS_TYPE_NSEC3,
                      DNS_TYPE_NSEC3PARAM);
}
 
bool dns_type_is_obsolete(uint16_t type) {
        return IN_SET(type,
                      /* Obsoleted by RFC 973 */
                      DNS_TYPE_MD,
                      DNS_TYPE_MF,
                      DNS_TYPE_MAILA,
 
                      /* Kinda obsoleted by RFC 2505 */
                      DNS_TYPE_MB,
                      DNS_TYPE_MG,
                      DNS_TYPE_MR,
                      DNS_TYPE_MINFO,
                      DNS_TYPE_MAILB,
 
                      /* RFC1127 kinda obsoleted this by recommending against its use */
                      DNS_TYPE_WKS,
 
                      /* Declared historical by RFC 6563 */
                      DNS_TYPE_A6,
 
                      /* Obsoleted by DNSSEC-bis */
                      DNS_TYPE_NXT,
 
                      /* RFC 1035 removed support for concepts that needed this from RFC 883 */
                      DNS_TYPE_NULL);
}
 
bool dns_type_needs_authentication(uint16_t type) {
 
        /* Returns true for all (non-obsolete) RR types where records are not useful if they aren't
         * authenticated. I.e. everything that contains crypto keys. */
 
        return IN_SET(type,
                      DNS_TYPE_CERT,
                      DNS_TYPE_SSHFP,
                      DNS_TYPE_IPSECKEY,
                      DNS_TYPE_DS,
                      DNS_TYPE_DNSKEY,
                      DNS_TYPE_TLSA,
                      DNS_TYPE_CDNSKEY,
                      DNS_TYPE_OPENPGPKEY,
                      DNS_TYPE_CAA);
}
 
int dns_type_to_af(uint16_t t) {
        switch (t) {
 
        case DNS_TYPE_A:
                return AF_INET;
 
        case DNS_TYPE_AAAA:
                return AF_INET6;
 
        case DNS_TYPE_ANY:
                return AF_UNSPEC;
 
        default:
                return -EINVAL;
        }
}
 
const char *dns_class_to_string(uint16_t class) {
 
        switch (class) {
 
        case DNS_CLASS_IN:
                return "IN";
 
        case DNS_CLASS_ANY:
                return "ANY";
        }
 
        return NULL;
}
 
int dns_class_from_string(const char *s) {
 
        if (!s)
                return _DNS_CLASS_INVALID;
 
        if (strcaseeq(s, "IN"))
                return DNS_CLASS_IN;
        else if (strcaseeq(s, "ANY"))
                return DNS_CLASS_ANY;
 
        return _DNS_CLASS_INVALID;
}
 
const char* tlsa_cert_usage_to_string(uint8_t cert_usage) {
 
        switch (cert_usage) {
 
        case 0:
                return "CA constraint";
 
        case 1:
                return "Service certificate constraint";
 
        case 2:
                return "Trust anchor assertion";
 
        case 3:
                return "Domain-issued certificate";
 
        case 4 ... 254:
                return "Unassigned";
 
        case 255:
                return "Private use";
        }
 
        return NULL;  /* clang cannot count that we covered everything */
}
 
const char* tlsa_selector_to_string(uint8_t selector) {
        switch (selector) {
 
        case 0:
                return "Full Certificate";
 
        case 1:
                return "SubjectPublicKeyInfo";
 
        case 2 ... 254:
                return "Unassigned";
 
        case 255:
                return "Private use";
        }
 
        return NULL;
}
 
const char* tlsa_matching_type_to_string(uint8_t selector) {
 
        switch (selector) {
 
        case 0:
                return "No hash used";
 
        case 1:
                return "SHA-256";
 
        case 2:
                return "SHA-512";
 
        case 3 ... 254:
                return "Unassigned";
 
        case 255:
                return "Private use";
        }
 
        return NULL;
}