1 /*
2 * validator/val_utils.c - validator utility functions.
3 *
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
5 *
6 * This software is open source.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
14 *
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
18 *
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 */
35
36 /**
37 * \file
38 *
39 * This file contains helper functions for the validator module.
40 */
41 #include "config.h"
42 #include "validator/val_utils.h"
43 #include "validator/validator.h"
44 #include "validator/val_kentry.h"
45 #include "validator/val_sigcrypt.h"
46 #include "validator/val_anchor.h"
47 #include "validator/val_nsec.h"
48 #include "validator/val_neg.h"
49 #include "services/cache/rrset.h"
50 #include "services/cache/dns.h"
51 #include "util/data/msgreply.h"
52 #include "util/data/packed_rrset.h"
53 #include "util/data/dname.h"
54 #include "util/net_help.h"
55 #include "util/module.h"
56 #include "util/regional.h"
57 #include "util/config_file.h"
58 #include "sldns/wire2str.h"
59 #include "sldns/parseutil.h"
60
61 /** Maximum allowed digest match failures per DS, for DNSKEYs with the same
62 * properties */
63 #define MAX_DS_MATCH_FAILURES 4
64
65 enum val_classification
val_classify_response(uint16_t query_flags,struct query_info * origqinf,struct query_info * qinf,struct reply_info * rep,size_t skip)66 val_classify_response(uint16_t query_flags, struct query_info* origqinf,
67 struct query_info* qinf, struct reply_info* rep, size_t skip)
68 {
69 int rcode = (int)FLAGS_GET_RCODE(rep->flags);
70 size_t i;
71
72 /* Normal Name Error's are easy to detect -- but don't mistake a CNAME
73 * chain ending in NXDOMAIN. */
74 if(rcode == LDNS_RCODE_NXDOMAIN && rep->an_numrrsets == 0)
75 return VAL_CLASS_NAMEERROR;
76
77 /* check for referral: nonRD query and it looks like a nodata */
78 if(!(query_flags&BIT_RD) && rep->an_numrrsets == 0 &&
79 rcode == LDNS_RCODE_NOERROR) {
80 /* SOA record in auth indicates it is NODATA instead.
81 * All validation requiring NODATA messages have SOA in
82 * authority section. */
83 /* uses fact that answer section is empty */
84 int saw_ns = 0;
85 for(i=0; i<rep->ns_numrrsets; i++) {
86 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_SOA)
87 return VAL_CLASS_NODATA;
88 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_DS)
89 return VAL_CLASS_REFERRAL;
90 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS)
91 saw_ns = 1;
92 }
93 return saw_ns?VAL_CLASS_REFERRAL:VAL_CLASS_NODATA;
94 }
95 /* root referral where NS set is in the answer section */
96 if(!(query_flags&BIT_RD) && rep->ns_numrrsets == 0 &&
97 rep->an_numrrsets == 1 && rcode == LDNS_RCODE_NOERROR &&
98 ntohs(rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_NS &&
99 query_dname_compare(rep->rrsets[0]->rk.dname,
100 origqinf->qname) != 0)
101 return VAL_CLASS_REFERRAL;
102
103 /* dump bad messages */
104 if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN)
105 return VAL_CLASS_UNKNOWN;
106 /* next check if the skip into the answer section shows no answer */
107 if(skip>0 && rep->an_numrrsets <= skip)
108 return VAL_CLASS_CNAMENOANSWER;
109
110 /* Next is NODATA */
111 if(rcode == LDNS_RCODE_NOERROR && rep->an_numrrsets == 0)
112 return VAL_CLASS_NODATA;
113
114 /* We distinguish between CNAME response and other positive/negative
115 * responses because CNAME answers require extra processing. */
116
117 /* We distinguish between ANY and CNAME or POSITIVE because
118 * ANY responses are validated differently. */
119 if(rcode == LDNS_RCODE_NOERROR && qinf->qtype == LDNS_RR_TYPE_ANY)
120 return VAL_CLASS_ANY;
121
122 /* For the query type DNAME, the name matters. Equal name is the
123 * answer looked for, but a subdomain redirects the query. */
124 if(qinf->qtype == LDNS_RR_TYPE_DNAME) {
125 for(i=skip; i<rep->an_numrrsets; i++) {
126 if(rcode == LDNS_RCODE_NOERROR &&
127 ntohs(rep->rrsets[i]->rk.type)
128 == LDNS_RR_TYPE_DNAME &&
129 query_dname_compare(qinf->qname,
130 rep->rrsets[i]->rk.dname) == 0) {
131 /* type is DNAME and name is equal, it is
132 * the answer. For the query name a subdomain
133 * of the rrset.dname it would redirect. */
134 return VAL_CLASS_POSITIVE;
135 }
136 if(ntohs(rep->rrsets[i]->rk.type)
137 == LDNS_RR_TYPE_CNAME)
138 return VAL_CLASS_CNAME;
139 }
140 log_dns_msg("validator: error. failed to classify response message: ",
141 qinf, rep);
142 return VAL_CLASS_UNKNOWN;
143 }
144
145 /* Note that DNAMEs will be ignored here, unless qtype=DNAME. Unless
146 * qtype=CNAME, this will yield a CNAME response. */
147 for(i=skip; i<rep->an_numrrsets; i++) {
148 if(rcode == LDNS_RCODE_NOERROR &&
149 ntohs(rep->rrsets[i]->rk.type) == qinf->qtype)
150 return VAL_CLASS_POSITIVE;
151 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME)
152 return VAL_CLASS_CNAME;
153 }
154 log_dns_msg("validator: error. failed to classify response message: ",
155 qinf, rep);
156 return VAL_CLASS_UNKNOWN;
157 }
158
159 /** Get signer name from RRSIG */
160 void
rrsig_get_signer(uint8_t * data,size_t len,uint8_t ** sname,size_t * slen)161 rrsig_get_signer(uint8_t* data, size_t len, uint8_t** sname, size_t* slen)
162 {
163 /* RRSIG rdata is not allowed to be compressed, it is stored
164 * uncompressed in memory as well, so return a ptr to the name */
165 if(len < 21) {
166 /* too short RRSig:
167 * short, byte, byte, long, long, long, short, "." is
168 * 2 1 1 4 4 4 2 1 = 19
169 * and a skip of 18 bytes to the name.
170 * +2 for the rdatalen is 21 bytes len for root label */
171 *sname = NULL;
172 *slen = 0;
173 return;
174 }
175 data += 20; /* skip the fixed size bits */
176 len -= 20;
177 *slen = dname_valid(data, len);
178 if(!*slen) {
179 /* bad dname in this rrsig. */
180 *sname = NULL;
181 return;
182 }
183 *sname = data;
184 }
185
186 void
val_find_rrset_signer(struct ub_packed_rrset_key * rrset,uint8_t ** sname,size_t * slen)187 val_find_rrset_signer(struct ub_packed_rrset_key* rrset, uint8_t** sname,
188 size_t* slen)
189 {
190 struct packed_rrset_data* d = (struct packed_rrset_data*)
191 rrset->entry.data;
192 /* return signer for first signature, or NULL */
193 if(d->rrsig_count == 0) {
194 *sname = NULL;
195 *slen = 0;
196 return;
197 }
198 /* get rrsig signer name out of the signature */
199 rrsig_get_signer(d->rr_data[d->count], d->rr_len[d->count],
200 sname, slen);
201 }
202
203 /**
204 * Find best signer name in this set of rrsigs.
205 * @param rrset: which rrsigs to look through.
206 * @param qinf: the query name that needs validation.
207 * @param signer_name: the best signer_name. Updated if a better one is found.
208 * @param signer_len: length of signer name.
209 * @param matchcount: count of current best name (starts at 0 for no match).
210 * Updated if match is improved.
211 */
212 static void
val_find_best_signer(struct ub_packed_rrset_key * rrset,struct query_info * qinf,uint8_t ** signer_name,size_t * signer_len,int * matchcount)213 val_find_best_signer(struct ub_packed_rrset_key* rrset,
214 struct query_info* qinf, uint8_t** signer_name, size_t* signer_len,
215 int* matchcount)
216 {
217 struct packed_rrset_data* d = (struct packed_rrset_data*)
218 rrset->entry.data;
219 uint8_t* sign;
220 size_t i;
221 int m;
222 for(i=d->count; i<d->count+d->rrsig_count; i++) {
223 sign = d->rr_data[i]+2+18;
224 /* look at signatures that are valid (long enough),
225 * and have a signer name that is a superdomain of qname,
226 * and then check the number of labels in the shared topdomain
227 * improve the match if possible */
228 if(d->rr_len[i] > 2+19 && /* rdata, sig + root label*/
229 dname_subdomain_c(qinf->qname, sign)) {
230 (void)dname_lab_cmp(qinf->qname,
231 dname_count_labels(qinf->qname),
232 sign, dname_count_labels(sign), &m);
233 if(m > *matchcount) {
234 *matchcount = m;
235 *signer_name = sign;
236 (void)dname_count_size_labels(*signer_name,
237 signer_len);
238 }
239 }
240 }
241 }
242
243 /** Detect if the, unsigned, CNAME is under a previous DNAME RR in the
244 * message, and thus it was generated from that previous DNAME.
245 */
246 static int
cname_under_previous_dname(struct reply_info * rep,size_t cname_idx,size_t * ret)247 cname_under_previous_dname(struct reply_info* rep, size_t cname_idx,
248 size_t* ret)
249 {
250 size_t i;
251 for(i=0; i<cname_idx; i++) {
252 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_DNAME &&
253 dname_strict_subdomain_c(rep->rrsets[cname_idx]->
254 rk.dname, rep->rrsets[i]->rk.dname)) {
255 *ret = i;
256 return 1;
257 }
258 }
259 *ret = 0;
260 return 0;
261 }
262
263 void
val_find_signer(enum val_classification subtype,struct query_info * qinf,struct reply_info * rep,size_t skip,uint8_t ** signer_name,size_t * signer_len)264 val_find_signer(enum val_classification subtype, struct query_info* qinf,
265 struct reply_info* rep, size_t skip, uint8_t** signer_name,
266 size_t* signer_len)
267 {
268 size_t i;
269
270 if(subtype == VAL_CLASS_POSITIVE) {
271 /* check for the answer rrset */
272 for(i=skip; i<rep->an_numrrsets; i++) {
273 if(query_dname_compare(qinf->qname,
274 rep->rrsets[i]->rk.dname) == 0) {
275 val_find_rrset_signer(rep->rrsets[i],
276 signer_name, signer_len);
277 /* If there was no signer, and the query
278 * was for type CNAME, and this is a CNAME,
279 * and the previous is a DNAME, then this
280 * is the synthesized CNAME, use the signer
281 * of the DNAME record. */
282 if(*signer_name == NULL &&
283 qinf->qtype == LDNS_RR_TYPE_CNAME &&
284 ntohs(rep->rrsets[i]->rk.type) ==
285 LDNS_RR_TYPE_CNAME && i > skip &&
286 ntohs(rep->rrsets[i-1]->rk.type) ==
287 LDNS_RR_TYPE_DNAME &&
288 dname_strict_subdomain_c(rep->rrsets[i]->rk.dname, rep->rrsets[i-1]->rk.dname)) {
289 val_find_rrset_signer(rep->rrsets[i-1],
290 signer_name, signer_len);
291 }
292 return;
293 }
294 }
295 *signer_name = NULL;
296 *signer_len = 0;
297 } else if(subtype == VAL_CLASS_CNAME) {
298 size_t j;
299 /* check for the first signed cname/dname rrset */
300 for(i=skip; i<rep->an_numrrsets; i++) {
301 val_find_rrset_signer(rep->rrsets[i],
302 signer_name, signer_len);
303 if(*signer_name)
304 return;
305 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME
306 && cname_under_previous_dname(rep, i, &j)) {
307 val_find_rrset_signer(rep->rrsets[j],
308 signer_name, signer_len);
309 return;
310 }
311 if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_DNAME)
312 break; /* only check CNAME after a DNAME */
313 }
314 *signer_name = NULL;
315 *signer_len = 0;
316 } else if(subtype == VAL_CLASS_NAMEERROR
317 || subtype == VAL_CLASS_NODATA) {
318 /*Check to see if the AUTH section NSEC record(s) have rrsigs*/
319 for(i=rep->an_numrrsets; i<
320 rep->an_numrrsets+rep->ns_numrrsets; i++) {
321 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC
322 || ntohs(rep->rrsets[i]->rk.type) ==
323 LDNS_RR_TYPE_NSEC3) {
324 val_find_rrset_signer(rep->rrsets[i],
325 signer_name, signer_len);
326 return;
327 }
328 }
329 } else if(subtype == VAL_CLASS_CNAMENOANSWER) {
330 /* find closest superdomain signer name in authority section
331 * NSEC and NSEC3s */
332 int matchcount = 0;
333 *signer_name = NULL;
334 *signer_len = 0;
335 for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->
336 ns_numrrsets; i++) {
337 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC
338 || ntohs(rep->rrsets[i]->rk.type) ==
339 LDNS_RR_TYPE_NSEC3) {
340 val_find_best_signer(rep->rrsets[i], qinf,
341 signer_name, signer_len, &matchcount);
342 }
343 }
344 } else if(subtype == VAL_CLASS_ANY) {
345 /* check for one of the answer rrset that has signatures,
346 * or potentially a DNAME is in use with a different qname */
347 for(i=skip; i<rep->an_numrrsets; i++) {
348 if(query_dname_compare(qinf->qname,
349 rep->rrsets[i]->rk.dname) == 0) {
350 val_find_rrset_signer(rep->rrsets[i],
351 signer_name, signer_len);
352 if(*signer_name)
353 return;
354 }
355 }
356 /* no answer RRSIGs with qname, try a DNAME */
357 if(skip < rep->an_numrrsets &&
358 ntohs(rep->rrsets[skip]->rk.type) ==
359 LDNS_RR_TYPE_DNAME) {
360 val_find_rrset_signer(rep->rrsets[skip],
361 signer_name, signer_len);
362 if(*signer_name)
363 return;
364 }
365 *signer_name = NULL;
366 *signer_len = 0;
367 } else if(subtype == VAL_CLASS_REFERRAL) {
368 /* find keys for the item at skip */
369 if(skip < rep->rrset_count) {
370 val_find_rrset_signer(rep->rrsets[skip],
371 signer_name, signer_len);
372 return;
373 }
374 *signer_name = NULL;
375 *signer_len = 0;
376 } else {
377 verbose(VERB_QUERY, "find_signer: could not find signer name"
378 " for unknown type response");
379 *signer_name = NULL;
380 *signer_len = 0;
381 }
382 }
383
384 /** return number of rrs in an rrset */
385 static size_t
rrset_get_count(struct ub_packed_rrset_key * rrset)386 rrset_get_count(struct ub_packed_rrset_key* rrset)
387 {
388 struct packed_rrset_data* d = (struct packed_rrset_data*)
389 rrset->entry.data;
390 if(!d) return 0;
391 return d->count;
392 }
393
394 /** return TTL of rrset */
395 static uint32_t
rrset_get_ttl(struct ub_packed_rrset_key * rrset)396 rrset_get_ttl(struct ub_packed_rrset_key* rrset)
397 {
398 struct packed_rrset_data* d = (struct packed_rrset_data*)
399 rrset->entry.data;
400 if(!d) return 0;
401 return d->ttl;
402 }
403
404 static enum sec_status
val_verify_rrset(struct module_env * env,struct val_env * ve,struct ub_packed_rrset_key * rrset,struct ub_packed_rrset_key * keys,uint8_t * sigalg,char ** reason,sldns_ede_code * reason_bogus,sldns_pkt_section section,struct module_qstate * qstate,struct val_qstate * vq,int * verified,char * reasonbuf,size_t reasonlen)405 val_verify_rrset(struct module_env* env, struct val_env* ve,
406 struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* keys,
407 uint8_t* sigalg, char** reason, sldns_ede_code *reason_bogus,
408 sldns_pkt_section section, struct module_qstate* qstate,
409 struct val_qstate* vq, int *verified, char* reasonbuf,
410 size_t reasonlen)
411 {
412 enum sec_status sec;
413 struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
414 entry.data;
415 if(d->security == sec_status_secure) {
416 /* re-verify all other statuses, because keyset may change*/
417 log_nametypeclass(VERB_ALGO, "verify rrset cached",
418 rrset->rk.dname, ntohs(rrset->rk.type),
419 ntohs(rrset->rk.rrset_class));
420 *verified = 0;
421 return d->security;
422 }
423 /* check in the cache if verification has already been done */
424 rrset_check_sec_status(env->rrset_cache, rrset, *env->now);
425 if(d->security == sec_status_secure) {
426 log_nametypeclass(VERB_ALGO, "verify rrset from cache",
427 rrset->rk.dname, ntohs(rrset->rk.type),
428 ntohs(rrset->rk.rrset_class));
429 *verified = 0;
430 return d->security;
431 }
432 log_nametypeclass(VERB_ALGO, "verify rrset", rrset->rk.dname,
433 ntohs(rrset->rk.type), ntohs(rrset->rk.rrset_class));
434 sec = dnskeyset_verify_rrset(env, ve, rrset, keys, sigalg, reason,
435 reason_bogus, section, qstate, vq, verified, reasonbuf,
436 reasonlen);
437 verbose(VERB_ALGO, "verify result: %s", sec_status_to_string(sec));
438 regional_free_all(env->scratch);
439
440 /* update rrset security status
441 * only improves security status
442 * and bogus is set only once, even if we rechecked the status */
443 if(sec > d->security) {
444 int wc_expanded = 0;
445 d->security = sec;
446 if(sec == sec_status_secure) {
447 uint8_t* wc = NULL;
448 size_t wclen = 0;
449 d->trust = rrset_trust_validated;
450 if(val_rrset_wildcard(rrset, &wc, &wclen) && wc)
451 wc_expanded = 1;
452 } else if(sec == sec_status_bogus) {
453 size_t i;
454 /* update ttl for rrset to fixed value. */
455 d->ttl = ve->bogus_ttl;
456 for(i=0; i<d->count+d->rrsig_count; i++)
457 d->rr_ttl[i] = ve->bogus_ttl;
458 /* leave RR specific TTL: not used for determine
459 * if RRset timed out and clients see proper value. */
460 lock_basic_lock(&ve->bogus_lock);
461 ve->num_rrset_bogus++;
462 lock_basic_unlock(&ve->bogus_lock);
463 }
464 /* if status updated - store in cache for reuse */
465 /* For a wildcard rrset, that is secure, do not store this
466 * into the cache, because it changes proofs around the
467 * item. */
468 if(!wc_expanded)
469 rrset_update_sec_status(env->rrset_cache, rrset, *env->now);
470 }
471
472 return sec;
473 }
474
475 enum sec_status
val_verify_rrset_entry(struct module_env * env,struct val_env * ve,struct ub_packed_rrset_key * rrset,struct key_entry_key * kkey,char ** reason,sldns_ede_code * reason_bogus,sldns_pkt_section section,struct module_qstate * qstate,struct val_qstate * vq,int * verified,char * reasonbuf,size_t reasonlen)476 val_verify_rrset_entry(struct module_env* env, struct val_env* ve,
477 struct ub_packed_rrset_key* rrset, struct key_entry_key* kkey,
478 char** reason, sldns_ede_code *reason_bogus,
479 sldns_pkt_section section, struct module_qstate* qstate,
480 struct val_qstate* vq, int* verified, char* reasonbuf,
481 size_t reasonlen)
482 {
483 /* temporary dnskey rrset-key */
484 struct ub_packed_rrset_key dnskey;
485 struct key_entry_data* kd = (struct key_entry_data*)kkey->entry.data;
486 enum sec_status sec;
487 dnskey.rk.type = htons(kd->rrset_type);
488 dnskey.rk.rrset_class = htons(kkey->key_class);
489 dnskey.rk.flags = 0;
490 dnskey.rk.dname = kkey->name;
491 dnskey.rk.dname_len = kkey->namelen;
492 dnskey.entry.key = &dnskey;
493 dnskey.entry.data = kd->rrset_data;
494 sec = val_verify_rrset(env, ve, rrset, &dnskey, kd->algo, reason,
495 reason_bogus, section, qstate, vq, verified, reasonbuf,
496 reasonlen);
497 return sec;
498 }
499
500 /** verify that a DS RR hashes to a key and that key signs the set */
501 static enum sec_status
verify_dnskeys_with_ds_rr(struct module_env * env,struct val_env * ve,struct ub_packed_rrset_key * dnskey_rrset,struct ub_packed_rrset_key * ds_rrset,size_t ds_idx,char ** reason,sldns_ede_code * reason_bogus,struct module_qstate * qstate,struct val_qstate * vq,int * nonechecked,char * reasonbuf,size_t reasonlen,size_t * num_tagmatches,size_t * num_tagmatches_dnskeysig)502 verify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve,
503 struct ub_packed_rrset_key* dnskey_rrset,
504 struct ub_packed_rrset_key* ds_rrset, size_t ds_idx, char** reason,
505 sldns_ede_code *reason_bogus, struct module_qstate* qstate,
506 struct val_qstate* vq, int *nonechecked, char* reasonbuf,
507 size_t reasonlen, size_t* num_tagmatches,
508 size_t* num_tagmatches_dnskeysig)
509 {
510 enum sec_status sec = sec_status_bogus;
511 size_t i, num, numchecked = 0, numhashok = 0, numsizesupp = 0;
512 num = rrset_get_count(dnskey_rrset);
513 *nonechecked = 0;
514 for(i=0; i<num; i++) {
515 if((*num_tagmatches)++ > MAX_TAG_MATCHES) {
516 verbose(VERB_ALGO, "DS match attempt reached "
517 "MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
518 return sec_status_bogus;
519 }
520 /* Skip DNSKEYs that don't match the basic criteria. */
521 if(ds_get_key_algo(ds_rrset, ds_idx)
522 != dnskey_get_algo(dnskey_rrset, i)
523 || dnskey_calc_keytag(dnskey_rrset, i)
524 != ds_get_keytag(ds_rrset, ds_idx)) {
525 continue;
526 }
527 numchecked++;
528 verbose(VERB_ALGO, "attempt DS match algo %d keytag %d",
529 ds_get_key_algo(ds_rrset, ds_idx),
530 ds_get_keytag(ds_rrset, ds_idx));
531
532 if(vq && vq->num_hash_attempts++ > env->cfg->val_hash_attempts) {
533 *reason = "too many hash attempts";
534 if(reason_bogus)
535 *reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
536 verbose(VERB_ALGO, "rrset failed to verify: too many hash attempts, "
537 "val-hash-attempts (%d); bogus", env->cfg->val_hash_attempts);
538 return sec_status_bogus;
539 }
540
541 /* Convert the candidate DNSKEY into a hash using the
542 * same DS hash algorithm. */
543 if(!ds_digest_match_dnskey(env, dnskey_rrset, i, ds_rrset,
544 ds_idx)) {
545 verbose(VERB_ALGO, "DS match attempt failed");
546 if(numchecked > numhashok + MAX_DS_MATCH_FAILURES) {
547 verbose(VERB_ALGO, "DS match attempt reached "
548 "MAX_DS_MATCH_FAILURES (%d); bogus",
549 MAX_DS_MATCH_FAILURES);
550 return sec_status_bogus;
551 }
552 continue;
553 }
554 numhashok++;
555 if(!dnskey_size_is_supported(dnskey_rrset, i)) {
556 verbose(VERB_ALGO, "DS okay but that DNSKEY size is not supported");
557 numsizesupp++;
558 continue;
559 }
560 verbose(VERB_ALGO, "DS match digest ok, trying signature");
561
562 /* Otherwise, we have a match! Make sure that the DNSKEY
563 * verifies *with this key* */
564 if(*num_tagmatches_dnskeysig > MAX_TAG_MATCHES) {
565 verbose(VERB_ALGO, "DS that matched has too many DNSKEY to RRSIG tag matches "
566 "MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
567 return sec_status_bogus;
568 }
569 sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset,
570 i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate,
571 vq, num_tagmatches_dnskeysig);
572 if(sec == sec_status_secure) {
573 return sec;
574 }
575 /* If it didn't validate with the DNSKEY, try the next one! */
576 }
577 if(numsizesupp != 0 || sec == sec_status_indeterminate) {
578 /* there is a working DS, but that DNSKEY is not supported */
579 return sec_status_insecure;
580 }
581 if(numchecked == 0) {
582 algo_needs_reason(ds_get_key_algo(ds_rrset, ds_idx),
583 reason, "no keys have a DS", reasonbuf, reasonlen);
584 *nonechecked = 1;
585 } else if(numhashok == 0) {
586 *reason = "DS hash mismatches key";
587 } else if(!*reason) {
588 *reason = "keyset not secured by DNSKEY that matches DS";
589 }
590 return sec_status_bogus;
591 }
592
val_favorite_ds_algo(struct ub_packed_rrset_key * ds_rrset)593 int val_favorite_ds_algo(struct ub_packed_rrset_key* ds_rrset)
594 {
595 size_t i, num = rrset_get_count(ds_rrset);
596 int d, digest_algo = 0; /* DS digest algo 0 is not used. */
597 /* find favorite algo, for now, highest number supported */
598 for(i=0; i<num; i++) {
599 if(!ds_digest_algo_is_supported(ds_rrset, i) ||
600 !ds_key_algo_is_supported(ds_rrset, i)) {
601 continue;
602 }
603 d = ds_get_digest_algo(ds_rrset, i);
604 if(d > digest_algo)
605 digest_algo = d;
606 }
607 return digest_algo;
608 }
609
610 enum sec_status
val_verify_DNSKEY_with_DS(struct module_env * env,struct val_env * ve,struct ub_packed_rrset_key * dnskey_rrset,struct ub_packed_rrset_key * ds_rrset,uint8_t * sigalg,char ** reason,sldns_ede_code * reason_bogus,struct module_qstate * qstate,struct val_qstate * vq,char * reasonbuf,size_t reasonlen)611 val_verify_DNSKEY_with_DS(struct module_env* env, struct val_env* ve,
612 struct ub_packed_rrset_key* dnskey_rrset,
613 struct ub_packed_rrset_key* ds_rrset, uint8_t* sigalg, char** reason,
614 sldns_ede_code *reason_bogus, struct module_qstate* qstate,
615 struct val_qstate* vq, char* reasonbuf, size_t reasonlen)
616 {
617 /* as long as this is false, we can consider this DS rrset to be
618 * equivalent to no DS rrset. */
619 int has_useful_ds = 0, digest_algo, alg, has_algo_refusal = 0,
620 nonechecked, has_checked_ds = 0;
621 struct algo_needs needs;
622 size_t i, num, num_tagmatches = 0, num_tagmatches_dnskeysig = 0;
623 enum sec_status sec;
624
625 if(dnskey_rrset->rk.dname_len != ds_rrset->rk.dname_len ||
626 query_dname_compare(dnskey_rrset->rk.dname, ds_rrset->rk.dname)
627 != 0) {
628 verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset "
629 "by name");
630 *reason = "DNSKEY RRset did not match DS RRset by name";
631 return sec_status_bogus;
632 }
633
634 if(sigalg) {
635 /* harden against algo downgrade is enabled */
636 digest_algo = val_favorite_ds_algo(ds_rrset);
637 algo_needs_init_ds(&needs, ds_rrset, digest_algo, sigalg);
638 } else {
639 /* accept any key algo, any digest algo */
640 digest_algo = -1;
641 }
642 num = rrset_get_count(ds_rrset);
643 for(i=0; i<num; i++) {
644 if(num_tagmatches > MAX_TAG_MATCHES) {
645 verbose(VERB_ALGO, "DS verify attempt reached "
646 "MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
647 *reason = "DS verify has too many tag matches";
648 return sec_status_bogus;
649 }
650
651 /* Check to see if we can understand this DS.
652 * And check it is the strongest digest */
653 if(!ds_digest_algo_is_supported(ds_rrset, i) ||
654 !ds_key_algo_is_supported(ds_rrset, i) ||
655 (sigalg && (ds_get_digest_algo(ds_rrset, i) != digest_algo))) {
656 continue;
657 }
658
659 if(num_tagmatches_dnskeysig > MAX_TAG_MATCHES) {
660 verbose(VERB_ALGO, "DS verify attempt reached "
661 "DNSKEY to RRSIG MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
662 *reason = "DS verify has too many DNSKEY to RRSIG tag matches";
663 return sec_status_bogus;
664 }
665 sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset,
666 ds_rrset, i, reason, reason_bogus, qstate, vq,
667 &nonechecked, reasonbuf, reasonlen, &num_tagmatches,
668 &num_tagmatches_dnskeysig);
669 if(sec == sec_status_insecure) {
670 /* DNSKEY too large unsupported or algo refused by
671 * crypto lib. */
672 has_algo_refusal = 1;
673 continue;
674 }
675 if(!nonechecked)
676 has_checked_ds = 1;
677
678 /* Once we see a single DS with a known digestID and
679 * algorithm, we cannot return INSECURE (with a
680 * "null" KeyEntry). */
681 has_useful_ds = 1;
682
683 if(sec == sec_status_secure) {
684 if(!sigalg || algo_needs_set_secure(&needs,
685 (uint8_t)ds_get_key_algo(ds_rrset, i))) {
686 verbose(VERB_ALGO, "DS matched DNSKEY.");
687 if(!dnskeyset_size_is_supported(dnskey_rrset)) {
688 verbose(VERB_ALGO, "DS works, but dnskeyset contain keys that are unsupported, treat as insecure");
689 return sec_status_insecure;
690 }
691 return sec_status_secure;
692 }
693 } else if(sigalg && sec == sec_status_bogus) {
694 algo_needs_set_bogus(&needs,
695 (uint8_t)ds_get_key_algo(ds_rrset, i));
696 }
697 }
698
699 /* None of the DS's worked out. */
700
701 /* If none of the DSes have been checked, eg. that means no matches
702 * for keytags, and the other dses are all algo_refusal, it is an
703 * insecure delegation point, since the only matched DS records
704 * have an algo refusal, or are unsupported. */
705 if(has_algo_refusal && !has_checked_ds) {
706 verbose(VERB_ALGO, "No supported DS records were found -- "
707 "treating as insecure.");
708 return sec_status_insecure;
709 }
710 /* If no DSs were understandable, then this is OK. */
711 if(!has_useful_ds) {
712 verbose(VERB_ALGO, "No usable DS records were found -- "
713 "treating as insecure.");
714 return sec_status_insecure;
715 }
716 /* If any were understandable, then it is bad. */
717 verbose(VERB_QUERY, "Failed to match any usable DS to a DNSKEY.");
718 if(sigalg && (alg=algo_needs_missing(&needs)) != 0) {
719 algo_needs_reason(alg, reason, "missing verification of "
720 "DNSKEY signature", reasonbuf, reasonlen);
721 }
722 return sec_status_bogus;
723 }
724
725 struct key_entry_key*
val_verify_new_DNSKEYs(struct regional * region,struct module_env * env,struct val_env * ve,struct ub_packed_rrset_key * dnskey_rrset,struct ub_packed_rrset_key * ds_rrset,int downprot,char ** reason,sldns_ede_code * reason_bogus,struct module_qstate * qstate,struct val_qstate * vq,char * reasonbuf,size_t reasonlen)726 val_verify_new_DNSKEYs(struct regional* region, struct module_env* env,
727 struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset,
728 struct ub_packed_rrset_key* ds_rrset, int downprot, char** reason,
729 sldns_ede_code *reason_bogus, struct module_qstate* qstate,
730 struct val_qstate* vq, char* reasonbuf, size_t reasonlen)
731 {
732 uint8_t sigalg[ALGO_NEEDS_MAX+1];
733 enum sec_status sec = val_verify_DNSKEY_with_DS(env, ve,
734 dnskey_rrset, ds_rrset, downprot?sigalg:NULL, reason,
735 reason_bogus, qstate, vq, reasonbuf, reasonlen);
736
737 if(sec == sec_status_secure) {
738 return key_entry_create_rrset(region,
739 ds_rrset->rk.dname, ds_rrset->rk.dname_len,
740 ntohs(ds_rrset->rk.rrset_class), dnskey_rrset,
741 downprot?sigalg:NULL, LDNS_EDE_NONE, NULL,
742 *env->now);
743 } else if(sec == sec_status_insecure) {
744 return key_entry_create_null(region, ds_rrset->rk.dname,
745 ds_rrset->rk.dname_len,
746 ntohs(ds_rrset->rk.rrset_class),
747 rrset_get_ttl(ds_rrset), *reason_bogus, *reason,
748 *env->now);
749 }
750 return key_entry_create_bad(region, ds_rrset->rk.dname,
751 ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class),
752 BOGUS_KEY_TTL, *reason_bogus, *reason, *env->now);
753 }
754
755 enum sec_status
val_verify_DNSKEY_with_TA(struct module_env * env,struct val_env * ve,struct ub_packed_rrset_key * dnskey_rrset,struct ub_packed_rrset_key * ta_ds,struct ub_packed_rrset_key * ta_dnskey,uint8_t * sigalg,char ** reason,sldns_ede_code * reason_bogus,struct module_qstate * qstate,struct val_qstate * vq,char * reasonbuf,size_t reasonlen)756 val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve,
757 struct ub_packed_rrset_key* dnskey_rrset,
758 struct ub_packed_rrset_key* ta_ds,
759 struct ub_packed_rrset_key* ta_dnskey, uint8_t* sigalg, char** reason,
760 sldns_ede_code *reason_bogus, struct module_qstate* qstate,
761 struct val_qstate* vq, char* reasonbuf, size_t reasonlen)
762 {
763 /* as long as this is false, we can consider this anchor to be
764 * equivalent to no anchor. */
765 int has_useful_ta = 0, digest_algo = 0, alg, has_algo_refusal = 0,
766 nonechecked, has_checked_ds = 0;
767 struct algo_needs needs;
768 size_t i, num, num_tagmatches = 0, num_tagmatches_dnskeysig = 0;
769 enum sec_status sec;
770
771 if(ta_ds && (dnskey_rrset->rk.dname_len != ta_ds->rk.dname_len ||
772 query_dname_compare(dnskey_rrset->rk.dname, ta_ds->rk.dname)
773 != 0)) {
774 verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset "
775 "by name");
776 *reason = "DNSKEY RRset did not match DS RRset by name";
777 if(reason_bogus)
778 *reason_bogus = LDNS_EDE_DNSKEY_MISSING;
779 return sec_status_bogus;
780 }
781 if(ta_dnskey && (dnskey_rrset->rk.dname_len != ta_dnskey->rk.dname_len
782 || query_dname_compare(dnskey_rrset->rk.dname, ta_dnskey->rk.dname)
783 != 0)) {
784 verbose(VERB_QUERY, "DNSKEY RRset did not match anchor RRset "
785 "by name");
786 *reason = "DNSKEY RRset did not match anchor RRset by name";
787 if(reason_bogus)
788 *reason_bogus = LDNS_EDE_DNSKEY_MISSING;
789 return sec_status_bogus;
790 }
791
792 if(ta_ds)
793 digest_algo = val_favorite_ds_algo(ta_ds);
794 if(sigalg) {
795 if(ta_ds)
796 algo_needs_init_ds(&needs, ta_ds, digest_algo, sigalg);
797 else memset(&needs, 0, sizeof(needs));
798 if(ta_dnskey)
799 algo_needs_init_dnskey_add(&needs, ta_dnskey, sigalg);
800 }
801 if(ta_ds) {
802 num = rrset_get_count(ta_ds);
803 for(i=0; i<num; i++) {
804 if(num_tagmatches > MAX_TAG_MATCHES) {
805 verbose(VERB_ALGO, "anchor DS verify attempt reached "
806 "MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
807 *reason = "anchor DS verify has too many tag matches";
808 if(reason_bogus)
809 *reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
810 return sec_status_bogus;
811 }
812
813 /* Check to see if we can understand this DS.
814 * And check it is the strongest digest */
815 if(!ds_digest_algo_is_supported(ta_ds, i) ||
816 !ds_key_algo_is_supported(ta_ds, i) ||
817 ds_get_digest_algo(ta_ds, i) != digest_algo)
818 continue;
819
820 if(num_tagmatches_dnskeysig > MAX_TAG_MATCHES) {
821 verbose(VERB_ALGO, "anchor DS verify has too many DNSKEY to RRSIG tag matches "
822 "MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
823 *reason = "anchor DS verify has too many DNSKEY to RRSIG tag matches";
824 if(reason_bogus)
825 *reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
826 return sec_status_bogus;
827 }
828 sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset,
829 ta_ds, i, reason, reason_bogus, qstate, vq,
830 &nonechecked, reasonbuf, reasonlen, &num_tagmatches,
831 &num_tagmatches_dnskeysig);
832 if(sec == sec_status_insecure) {
833 has_algo_refusal = 1;
834 continue;
835 }
836 if(!nonechecked)
837 has_checked_ds = 1;
838
839 /* Once we see a single DS with a known digestID and
840 * algorithm, we cannot return INSECURE (with a
841 * "null" KeyEntry). */
842 has_useful_ta = 1;
843
844 if(sec == sec_status_secure) {
845 if(!sigalg || algo_needs_set_secure(&needs,
846 (uint8_t)ds_get_key_algo(ta_ds, i))) {
847 verbose(VERB_ALGO, "DS matched DNSKEY.");
848 if(!dnskeyset_size_is_supported(dnskey_rrset)) {
849 verbose(VERB_ALGO, "trustanchor works, but dnskeyset contain keys that are unsupported, treat as insecure");
850 return sec_status_insecure;
851 }
852 return sec_status_secure;
853 }
854 } else if(sigalg && sec == sec_status_bogus) {
855 algo_needs_set_bogus(&needs,
856 (uint8_t)ds_get_key_algo(ta_ds, i));
857 }
858 }
859 }
860
861 /* None of the DS's worked out: check the DNSKEYs. */
862 if(ta_dnskey) {
863 num = rrset_get_count(ta_dnskey);
864 for(i=0; i<num; i++) {
865 /* Check to see if we can understand this DNSKEY */
866 if(!dnskey_algo_is_supported(ta_dnskey, i))
867 continue;
868 if(!dnskey_size_is_supported(ta_dnskey, i))
869 continue;
870
871 /* we saw a useful TA */
872 has_useful_ta = 1;
873
874 if(num_tagmatches_dnskeysig > MAX_TAG_MATCHES) {
875 verbose(VERB_ALGO, "anchor DS that matched has too many DNSKEY to RRSIG tag matches "
876 "MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES);
877 *reason = "anchor DS that matched has too many DNSKEY to RRSIG tag matches";
878 if(reason_bogus)
879 *reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
880 return sec_status_bogus;
881 }
882 sec = dnskey_verify_rrset(env, ve, dnskey_rrset,
883 ta_dnskey, i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate, vq, &num_tagmatches_dnskeysig);
884 if(sec == sec_status_secure) {
885 if(!sigalg || algo_needs_set_secure(&needs,
886 (uint8_t)dnskey_get_algo(ta_dnskey, i))) {
887 verbose(VERB_ALGO, "anchor matched DNSKEY.");
888 if(!dnskeyset_size_is_supported(dnskey_rrset)) {
889 verbose(VERB_ALGO, "trustanchor works, but dnskeyset contain keys that are unsupported, treat as insecure");
890 return sec_status_insecure;
891 }
892 return sec_status_secure;
893 }
894 } else if(sigalg && sec == sec_status_bogus) {
895 algo_needs_set_bogus(&needs,
896 (uint8_t)dnskey_get_algo(ta_dnskey, i));
897 }
898 }
899 }
900
901 /* If none of the DSes have been checked, eg. that means no matches
902 * for keytags, and the other dses are all algo_refusal, it is an
903 * insecure delegation point, since the only matched DS records
904 * have an algo refusal, or are unsupported. */
905 if(has_algo_refusal && !has_checked_ds) {
906 verbose(VERB_ALGO, "No supported trust anchors were found -- "
907 "treating as insecure.");
908 return sec_status_insecure;
909 }
910 /* If no DSs were understandable, then this is OK. */
911 if(!has_useful_ta) {
912 verbose(VERB_ALGO, "No usable trust anchors were found -- "
913 "treating as insecure.");
914 return sec_status_insecure;
915 }
916 /* If any were understandable, then it is bad. */
917 verbose(VERB_QUERY, "Failed to match any usable anchor to a DNSKEY.");
918 if(sigalg && (alg=algo_needs_missing(&needs)) != 0) {
919 algo_needs_reason(alg, reason, "missing verification of "
920 "DNSKEY signature", reasonbuf, reasonlen);
921 }
922 return sec_status_bogus;
923 }
924
925 struct key_entry_key*
val_verify_new_DNSKEYs_with_ta(struct regional * region,struct module_env * env,struct val_env * ve,struct ub_packed_rrset_key * dnskey_rrset,struct ub_packed_rrset_key * ta_ds_rrset,struct ub_packed_rrset_key * ta_dnskey_rrset,int downprot,char ** reason,sldns_ede_code * reason_bogus,struct module_qstate * qstate,struct val_qstate * vq,char * reasonbuf,size_t reasonlen)926 val_verify_new_DNSKEYs_with_ta(struct regional* region, struct module_env* env,
927 struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset,
928 struct ub_packed_rrset_key* ta_ds_rrset,
929 struct ub_packed_rrset_key* ta_dnskey_rrset, int downprot,
930 char** reason, sldns_ede_code *reason_bogus,
931 struct module_qstate* qstate, struct val_qstate* vq, char* reasonbuf,
932 size_t reasonlen)
933 {
934 uint8_t sigalg[ALGO_NEEDS_MAX+1];
935 enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve,
936 dnskey_rrset, ta_ds_rrset, ta_dnskey_rrset,
937 downprot?sigalg:NULL, reason, reason_bogus, qstate, vq,
938 reasonbuf, reasonlen);
939
940 if(sec == sec_status_secure) {
941 return key_entry_create_rrset(region,
942 dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len,
943 ntohs(dnskey_rrset->rk.rrset_class), dnskey_rrset,
944 downprot?sigalg:NULL, LDNS_EDE_NONE, NULL, *env->now);
945 } else if(sec == sec_status_insecure) {
946 return key_entry_create_null(region, dnskey_rrset->rk.dname,
947 dnskey_rrset->rk.dname_len,
948 ntohs(dnskey_rrset->rk.rrset_class),
949 rrset_get_ttl(dnskey_rrset), *reason_bogus, *reason,
950 *env->now);
951 }
952 return key_entry_create_bad(region, dnskey_rrset->rk.dname,
953 dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class),
954 BOGUS_KEY_TTL, *reason_bogus, *reason, *env->now);
955 }
956
957 int
val_dsset_isusable(struct ub_packed_rrset_key * ds_rrset)958 val_dsset_isusable(struct ub_packed_rrset_key* ds_rrset)
959 {
960 size_t i;
961 for(i=0; i<rrset_get_count(ds_rrset); i++) {
962 if(ds_digest_algo_is_supported(ds_rrset, i) &&
963 ds_key_algo_is_supported(ds_rrset, i))
964 return 1;
965 }
966 if(verbosity < VERB_ALGO)
967 return 0;
968 if(rrset_get_count(ds_rrset) == 0)
969 verbose(VERB_ALGO, "DS is not usable");
970 else {
971 /* report usability for the first DS RR */
972 sldns_lookup_table *lt;
973 char herr[64], aerr[64];
974 lt = sldns_lookup_by_id(sldns_hashes,
975 (int)ds_get_digest_algo(ds_rrset, 0));
976 if(lt) snprintf(herr, sizeof(herr), "%s", lt->name);
977 else snprintf(herr, sizeof(herr), "%d",
978 (int)ds_get_digest_algo(ds_rrset, 0));
979 lt = sldns_lookup_by_id(sldns_algorithms,
980 (int)ds_get_key_algo(ds_rrset, 0));
981 if(lt) snprintf(aerr, sizeof(aerr), "%s", lt->name);
982 else snprintf(aerr, sizeof(aerr), "%d",
983 (int)ds_get_key_algo(ds_rrset, 0));
984
985 verbose(VERB_ALGO, "DS unsupported, hash %s %s, "
986 "key algorithm %s %s", herr,
987 (ds_digest_algo_is_supported(ds_rrset, 0)?
988 "(supported)":"(unsupported)"), aerr,
989 (ds_key_algo_is_supported(ds_rrset, 0)?
990 "(supported)":"(unsupported)"));
991 }
992 return 0;
993 }
994
995 /** get label count for a signature */
996 static uint8_t
rrsig_get_labcount(struct packed_rrset_data * d,size_t sig)997 rrsig_get_labcount(struct packed_rrset_data* d, size_t sig)
998 {
999 if(d->rr_len[sig] < 2+4)
1000 return 0; /* bad sig length */
1001 return d->rr_data[sig][2+3];
1002 }
1003
1004 int
val_rrset_wildcard(struct ub_packed_rrset_key * rrset,uint8_t ** wc,size_t * wc_len)1005 val_rrset_wildcard(struct ub_packed_rrset_key* rrset, uint8_t** wc,
1006 size_t* wc_len)
1007 {
1008 struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
1009 entry.data;
1010 uint8_t labcount;
1011 int labdiff;
1012 uint8_t* wn;
1013 size_t i, wl;
1014 if(d->rrsig_count == 0) {
1015 return 1;
1016 }
1017 labcount = rrsig_get_labcount(d, d->count + 0);
1018 /* check rest of signatures identical */
1019 for(i=1; i<d->rrsig_count; i++) {
1020 if(labcount != rrsig_get_labcount(d, d->count + i)) {
1021 return 0;
1022 }
1023 }
1024 /* OK the rrsigs check out */
1025 /* if the RRSIG label count is shorter than the number of actual
1026 * labels, then this rrset was synthesized from a wildcard.
1027 * Note that the RRSIG label count doesn't count the root label. */
1028 wn = rrset->rk.dname;
1029 wl = rrset->rk.dname_len;
1030 /* skip a leading wildcard label in the dname (RFC4035 2.2) */
1031 if(dname_is_wild(wn)) {
1032 wn += 2;
1033 wl -= 2;
1034 }
1035 labdiff = (dname_count_labels(wn) - 1) - (int)labcount;
1036 if(labdiff > 0) {
1037 *wc = wn;
1038 dname_remove_labels(wc, &wl, labdiff);
1039 *wc_len = wl;
1040 return 1;
1041 }
1042 return 1;
1043 }
1044
1045 int
val_chase_cname(struct query_info * qchase,struct reply_info * rep,size_t * cname_skip)1046 val_chase_cname(struct query_info* qchase, struct reply_info* rep,
1047 size_t* cname_skip) {
1048 size_t i;
1049 /* skip any DNAMEs, go to the CNAME for next part */
1050 for(i = *cname_skip; i < rep->an_numrrsets; i++) {
1051 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME &&
1052 query_dname_compare(qchase->qname, rep->rrsets[i]->
1053 rk.dname) == 0) {
1054 qchase->qname = NULL;
1055 get_cname_target(rep->rrsets[i], &qchase->qname,
1056 &qchase->qname_len);
1057 if(!qchase->qname)
1058 return 0; /* bad CNAME rdata */
1059 (*cname_skip) = i+1;
1060 return 1;
1061 }
1062 }
1063 return 0; /* CNAME classified but no matching CNAME ?! */
1064 }
1065
1066 /** see if rrset has signer name as one of the rrsig signers */
1067 static int
rrset_has_signer(struct ub_packed_rrset_key * rrset,uint8_t * name,size_t len)1068 rrset_has_signer(struct ub_packed_rrset_key* rrset, uint8_t* name, size_t len)
1069 {
1070 struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
1071 entry.data;
1072 size_t i;
1073 for(i = d->count; i< d->count+d->rrsig_count; i++) {
1074 if(d->rr_len[i] > 2+18+len) {
1075 /* at least rdatalen + signature + signame (+1 sig)*/
1076 if(!dname_valid(d->rr_data[i]+2+18, d->rr_len[i]-2-18))
1077 continue;
1078 if(query_dname_compare(name, d->rr_data[i]+2+18) == 0)
1079 {
1080 return 1;
1081 }
1082 }
1083 }
1084 return 0;
1085 }
1086
1087 void
val_fill_reply(struct reply_info * chase,struct reply_info * orig,size_t skip,uint8_t * name,size_t len,uint8_t * signer)1088 val_fill_reply(struct reply_info* chase, struct reply_info* orig,
1089 size_t skip, uint8_t* name, size_t len, uint8_t* signer)
1090 {
1091 size_t i, j;
1092 int seen_dname = 0;
1093 chase->rrset_count = 0;
1094 chase->an_numrrsets = 0;
1095 chase->ns_numrrsets = 0;
1096 chase->ar_numrrsets = 0;
1097 /* ANSWER section */
1098 for(i=skip; i<orig->an_numrrsets; i++) {
1099 if(!signer) {
1100 if(query_dname_compare(name,
1101 orig->rrsets[i]->rk.dname) == 0)
1102 chase->rrsets[chase->an_numrrsets++] =
1103 orig->rrsets[i];
1104 } else if(seen_dname && ntohs(orig->rrsets[i]->rk.type) ==
1105 LDNS_RR_TYPE_CNAME) {
1106 chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i];
1107 seen_dname = 0;
1108 } else if(rrset_has_signer(orig->rrsets[i], name, len)) {
1109 chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i];
1110 if(ntohs(orig->rrsets[i]->rk.type) ==
1111 LDNS_RR_TYPE_DNAME) {
1112 seen_dname = 1;
1113 }
1114 } else if(ntohs(orig->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME
1115 && ((struct packed_rrset_data*)orig->rrsets[i]->
1116 entry.data)->rrsig_count == 0 &&
1117 cname_under_previous_dname(orig, i, &j) &&
1118 rrset_has_signer(orig->rrsets[j], name, len)) {
1119 chase->rrsets[chase->an_numrrsets++] = orig->rrsets[j];
1120 chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i];
1121 }
1122 }
1123 /* AUTHORITY section */
1124 for(i = (skip > orig->an_numrrsets)?skip:orig->an_numrrsets;
1125 i<orig->an_numrrsets+orig->ns_numrrsets;
1126 i++) {
1127 if(!signer) {
1128 if(query_dname_compare(name,
1129 orig->rrsets[i]->rk.dname) == 0)
1130 chase->rrsets[chase->an_numrrsets+
1131 chase->ns_numrrsets++] = orig->rrsets[i];
1132 } else if(rrset_has_signer(orig->rrsets[i], name, len)) {
1133 chase->rrsets[chase->an_numrrsets+
1134 chase->ns_numrrsets++] = orig->rrsets[i];
1135 }
1136 }
1137 /* ADDITIONAL section */
1138 for(i= (skip>orig->an_numrrsets+orig->ns_numrrsets)?
1139 skip:orig->an_numrrsets+orig->ns_numrrsets;
1140 i<orig->rrset_count; i++) {
1141 if(!signer) {
1142 if(query_dname_compare(name,
1143 orig->rrsets[i]->rk.dname) == 0)
1144 chase->rrsets[chase->an_numrrsets
1145 +chase->ns_numrrsets+chase->ar_numrrsets++]
1146 = orig->rrsets[i];
1147 } else if(rrset_has_signer(orig->rrsets[i], name, len)) {
1148 chase->rrsets[chase->an_numrrsets+chase->ns_numrrsets+
1149 chase->ar_numrrsets++] = orig->rrsets[i];
1150 }
1151 }
1152 chase->rrset_count = chase->an_numrrsets + chase->ns_numrrsets +
1153 chase->ar_numrrsets;
1154 }
1155
val_reply_remove_answers(struct reply_info * rep,size_t index,size_t count)1156 void val_reply_remove_answers(struct reply_info* rep, size_t index,
1157 size_t count)
1158 {
1159 log_assert(index < rep->rrset_count);
1160 log_assert(index < rep->an_numrrsets);
1161 if(count == 0)
1162 return; /* nothing to do */
1163 log_assert(index+(count-1) < rep->rrset_count);
1164 log_assert(index+(count-1) < rep->an_numrrsets);
1165 if(rep->rrset_count - (count-1) - index - 1 > 0)
1166 memmove(rep->rrsets+index, rep->rrsets+index+(count-1)+1,
1167 sizeof(struct ub_packed_rrset_key*)*
1168 (rep->rrset_count - (count-1) - index - 1));
1169 rep->an_numrrsets -= count;
1170 rep->rrset_count -= count;
1171 }
1172
val_reply_remove_auth(struct reply_info * rep,size_t index)1173 void val_reply_remove_auth(struct reply_info* rep, size_t index)
1174 {
1175 log_assert(index < rep->rrset_count);
1176 log_assert(index >= rep->an_numrrsets);
1177 log_assert(index < rep->an_numrrsets+rep->ns_numrrsets);
1178 memmove(rep->rrsets+index, rep->rrsets+index+1,
1179 sizeof(struct ub_packed_rrset_key*)*
1180 (rep->rrset_count - index - 1));
1181 rep->ns_numrrsets--;
1182 rep->rrset_count--;
1183 }
1184
1185 void
val_check_nonsecure(struct module_env * env,struct reply_info * rep)1186 val_check_nonsecure(struct module_env* env, struct reply_info* rep)
1187 {
1188 size_t i;
1189 /* authority */
1190 for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
1191 if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
1192 ->security != sec_status_secure) {
1193 /* because we want to return the authentic original
1194 * message when presented with CD-flagged queries,
1195 * we need to preserve AUTHORITY section data.
1196 * However, this rrset is not signed or signed
1197 * with the wrong keys. Validation has tried to
1198 * verify this rrset with the keysets of import.
1199 * But this rrset did not verify.
1200 * Therefore the message is bogus.
1201 */
1202
1203 /* check if authority has an NS record
1204 * which is bad, and there is an answer section with
1205 * data. In that case, delete NS and additional to
1206 * be lenient and make a minimal response */
1207 if(rep->an_numrrsets != 0 &&
1208 ntohs(rep->rrsets[i]->rk.type)
1209 == LDNS_RR_TYPE_NS) {
1210 verbose(VERB_ALGO, "truncate to minimal");
1211 rep->ar_numrrsets = 0;
1212 rep->rrset_count = rep->an_numrrsets +
1213 rep->ns_numrrsets;
1214 /* remove this unneeded authority rrset */
1215 memmove(rep->rrsets+i, rep->rrsets+i+1,
1216 sizeof(struct ub_packed_rrset_key*)*
1217 (rep->rrset_count - i - 1));
1218 rep->ns_numrrsets--;
1219 rep->rrset_count--;
1220 i--;
1221 return;
1222 }
1223
1224 log_nametypeclass(VERB_QUERY, "message is bogus, "
1225 "non secure rrset",
1226 rep->rrsets[i]->rk.dname,
1227 ntohs(rep->rrsets[i]->rk.type),
1228 ntohs(rep->rrsets[i]->rk.rrset_class));
1229 rep->security = sec_status_bogus;
1230 return;
1231 }
1232 }
1233 /* additional */
1234 if(!env->cfg->val_clean_additional)
1235 return;
1236 for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) {
1237 if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
1238 ->security != sec_status_secure) {
1239 /* This does not cause message invalidation. It was
1240 * simply unsigned data in the additional. The
1241 * RRSIG must have been truncated off the message.
1242 *
1243 * However, we do not want to return possible bogus
1244 * data to clients that rely on this service for
1245 * their authentication.
1246 */
1247 /* remove this unneeded additional rrset */
1248 memmove(rep->rrsets+i, rep->rrsets+i+1,
1249 sizeof(struct ub_packed_rrset_key*)*
1250 (rep->rrset_count - i - 1));
1251 rep->ar_numrrsets--;
1252 rep->rrset_count--;
1253 i--;
1254 }
1255 }
1256 }
1257
1258 /** check no anchor and unlock */
1259 static int
check_no_anchor(struct val_anchors * anchors,uint8_t * nm,size_t l,uint16_t c)1260 check_no_anchor(struct val_anchors* anchors, uint8_t* nm, size_t l, uint16_t c)
1261 {
1262 struct trust_anchor* ta;
1263 if((ta=anchors_lookup(anchors, nm, l, c))) {
1264 lock_basic_unlock(&ta->lock);
1265 }
1266 return !ta;
1267 }
1268
1269 void
val_mark_indeterminate(struct reply_info * rep,struct val_anchors * anchors,struct rrset_cache * r,struct module_env * env)1270 val_mark_indeterminate(struct reply_info* rep, struct val_anchors* anchors,
1271 struct rrset_cache* r, struct module_env* env)
1272 {
1273 size_t i;
1274 struct packed_rrset_data* d;
1275 for(i=0; i<rep->rrset_count; i++) {
1276 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1277 if(d->security == sec_status_unchecked &&
1278 check_no_anchor(anchors, rep->rrsets[i]->rk.dname,
1279 rep->rrsets[i]->rk.dname_len,
1280 ntohs(rep->rrsets[i]->rk.rrset_class)))
1281 {
1282 /* mark as indeterminate */
1283 d->security = sec_status_indeterminate;
1284 rrset_update_sec_status(r, rep->rrsets[i], *env->now);
1285 }
1286 }
1287 }
1288
1289 void
val_mark_insecure(struct reply_info * rep,uint8_t * kname,struct rrset_cache * r,struct module_env * env)1290 val_mark_insecure(struct reply_info* rep, uint8_t* kname,
1291 struct rrset_cache* r, struct module_env* env)
1292 {
1293 size_t i;
1294 struct packed_rrset_data* d;
1295 for(i=0; i<rep->rrset_count; i++) {
1296 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1297 if(d->security == sec_status_unchecked &&
1298 dname_subdomain_c(rep->rrsets[i]->rk.dname, kname)) {
1299 /* mark as insecure */
1300 d->security = sec_status_insecure;
1301 rrset_update_sec_status(r, rep->rrsets[i], *env->now);
1302 }
1303 }
1304 }
1305
1306 size_t
val_next_unchecked(struct reply_info * rep,size_t skip)1307 val_next_unchecked(struct reply_info* rep, size_t skip)
1308 {
1309 size_t i;
1310 struct packed_rrset_data* d;
1311 for(i=skip+1; i<rep->rrset_count; i++) {
1312 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1313 if(d->security == sec_status_unchecked) {
1314 return i;
1315 }
1316 }
1317 return rep->rrset_count;
1318 }
1319
1320 const char*
val_classification_to_string(enum val_classification subtype)1321 val_classification_to_string(enum val_classification subtype)
1322 {
1323 switch(subtype) {
1324 case VAL_CLASS_UNTYPED: return "untyped";
1325 case VAL_CLASS_UNKNOWN: return "unknown";
1326 case VAL_CLASS_POSITIVE: return "positive";
1327 case VAL_CLASS_CNAME: return "cname";
1328 case VAL_CLASS_NODATA: return "nodata";
1329 case VAL_CLASS_NAMEERROR: return "nameerror";
1330 case VAL_CLASS_CNAMENOANSWER: return "cnamenoanswer";
1331 case VAL_CLASS_REFERRAL: return "referral";
1332 case VAL_CLASS_ANY: return "qtype_any";
1333 default:
1334 return "bad_val_classification";
1335 }
1336 }
1337
1338 /** log a sock_list entry */
1339 static void
sock_list_logentry(enum verbosity_value v,const char * s,struct sock_list * p)1340 sock_list_logentry(enum verbosity_value v, const char* s, struct sock_list* p)
1341 {
1342 if(p->len)
1343 log_addr(v, s, &p->addr, p->len);
1344 else verbose(v, "%s cache", s);
1345 }
1346
val_blacklist(struct sock_list ** blacklist,struct regional * region,struct sock_list * origin,int cross)1347 void val_blacklist(struct sock_list** blacklist, struct regional* region,
1348 struct sock_list* origin, int cross)
1349 {
1350 /* debug printout */
1351 if(verbosity >= VERB_ALGO) {
1352 struct sock_list* p;
1353 for(p=*blacklist; p; p=p->next)
1354 sock_list_logentry(VERB_ALGO, "blacklist", p);
1355 if(!origin)
1356 verbose(VERB_ALGO, "blacklist add: cache");
1357 for(p=origin; p; p=p->next)
1358 sock_list_logentry(VERB_ALGO, "blacklist add", p);
1359 }
1360 /* blacklist the IPs or the cache */
1361 if(!origin) {
1362 /* only add if nothing there. anything else also stops cache*/
1363 if(!*blacklist)
1364 sock_list_insert(blacklist, NULL, 0, region);
1365 } else if(!cross)
1366 sock_list_prepend(blacklist, origin);
1367 else sock_list_merge(blacklist, region, origin);
1368 }
1369
val_has_signed_nsecs(struct reply_info * rep,char ** reason)1370 int val_has_signed_nsecs(struct reply_info* rep, char** reason)
1371 {
1372 size_t i, num_nsec = 0, num_nsec3 = 0;
1373 struct packed_rrset_data* d;
1374 for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
1375 if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC))
1376 num_nsec++;
1377 else if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC3))
1378 num_nsec3++;
1379 else continue;
1380 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1381 if(d && d->rrsig_count != 0) {
1382 return 1;
1383 }
1384 }
1385 if(num_nsec == 0 && num_nsec3 == 0)
1386 *reason = "no DNSSEC records";
1387 else if(num_nsec != 0)
1388 *reason = "no signatures over NSECs";
1389 else *reason = "no signatures over NSEC3s";
1390 return 0;
1391 }
1392
1393 struct dns_msg*
val_find_DS(struct module_env * env,uint8_t * nm,size_t nmlen,uint16_t c,struct regional * region,uint8_t * topname)1394 val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c,
1395 struct regional* region, uint8_t* topname)
1396 {
1397 struct dns_msg* msg;
1398 struct query_info qinfo;
1399 struct ub_packed_rrset_key *rrset = rrset_cache_lookup(
1400 env->rrset_cache, nm, nmlen, LDNS_RR_TYPE_DS, c, 0,
1401 *env->now, 0);
1402 if(rrset) {
1403 /* DS rrset exists. Return it to the validator immediately*/
1404 struct ub_packed_rrset_key* copy = packed_rrset_copy_region(
1405 rrset, region, *env->now);
1406 struct packed_rrset_data* d;
1407 lock_rw_unlock(&rrset->entry.lock);
1408 if(!copy)
1409 return NULL;
1410 d = (struct packed_rrset_data*)copy->entry.data;
1411 msg = dns_msg_create(nm, nmlen, LDNS_RR_TYPE_DS, c, region, 1);
1412 if(!msg)
1413 return NULL;
1414 msg->rep->rrsets[0] = copy;
1415 msg->rep->rrset_count++;
1416 msg->rep->an_numrrsets++;
1417 UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl);
1418 return msg;
1419 }
1420 /* lookup in rrset and negative cache for NSEC/NSEC3 */
1421 qinfo.qname = nm;
1422 qinfo.qname_len = nmlen;
1423 qinfo.qtype = LDNS_RR_TYPE_DS;
1424 qinfo.qclass = c;
1425 qinfo.local_alias = NULL;
1426 /* do not add SOA to reply message, it is going to be used internal */
1427 msg = val_neg_getmsg(env->neg_cache, &qinfo, region, env->rrset_cache,
1428 env->scratch_buffer, *env->now, 0, topname, env->cfg);
1429 return msg;
1430 }
1431
derive_cname_from_dname(struct ub_packed_rrset_key * cname,struct ub_packed_rrset_key * dname,uint8_t * out,size_t outlen)1432 int derive_cname_from_dname(struct ub_packed_rrset_key* cname,
1433 struct ub_packed_rrset_key* dname, uint8_t* out, size_t outlen)
1434 {
1435 size_t prefix_len;
1436 uint8_t* dname_target = NULL;
1437 size_t dname_target_len = 0;
1438 if(!dname_strict_subdomain_c(cname->rk.dname, dname->rk.dname))
1439 return 0; /* Invalid: CNAME owner must be subdomain */
1440 get_cname_target(dname, &dname_target, &dname_target_len);
1441 if(!dname_target || !dname_target_len)
1442 return 0; /* DNAME malformed */
1443 if(cname->rk.dname_len < dname->rk.dname_len)
1444 return 0; /* Not possible, due to subdomain, but check */
1445 if(cname->rk.dname_len == 0)
1446 return 0; /* Not possible, but check */
1447 prefix_len = cname->rk.dname_len - dname->rk.dname_len;
1448 if(prefix_len + dname_target_len > outlen)
1449 return 0; /* Buffer too small */
1450 memmove(out, cname->rk.dname, prefix_len);
1451 memmove(out+prefix_len, dname_target, dname_target_len);
1452 return 1;
1453 }
1454
nsec_nextowner_subdomain(struct ub_packed_rrset_key * rrset,uint8_t * name)1455 int nsec_nextowner_subdomain(struct ub_packed_rrset_key* rrset, uint8_t* name)
1456 {
1457 struct packed_rrset_data* d;
1458 uint8_t* next;
1459 size_t nextlen;
1460 if(ntohs(rrset->rk.type) != LDNS_RR_TYPE_NSEC)
1461 return 0;
1462 d = (struct packed_rrset_data*)rrset->entry.data;
1463 if(!d || d->count == 0)
1464 return 0;
1465 next = d->rr_data[0]+2;
1466 nextlen = dname_valid(next, d->rr_len[0]-2);
1467 if(nextlen == 0)
1468 return 0; /* malformed */
1469 return dname_subdomain_c(next, name);
1470 }
1471