xref: /freebsd/contrib/unbound/services/authzone.c (revision 6be3386466ab79a84b48429ae66244f21526d3df)
1 /*
2  * services/authzone.c - authoritative zone that is locally hosted.
3  *
4  * Copyright (c) 2017, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * This file contains the functions for an authority zone.  This zone
40  * is queried by the iterator, just like a stub or forward zone, but then
41  * the data is locally held.
42  */
43 
44 #include "config.h"
45 #include "services/authzone.h"
46 #include "util/data/dname.h"
47 #include "util/data/msgparse.h"
48 #include "util/data/msgreply.h"
49 #include "util/data/msgencode.h"
50 #include "util/data/packed_rrset.h"
51 #include "util/regional.h"
52 #include "util/net_help.h"
53 #include "util/netevent.h"
54 #include "util/config_file.h"
55 #include "util/log.h"
56 #include "util/module.h"
57 #include "util/random.h"
58 #include "services/cache/dns.h"
59 #include "services/outside_network.h"
60 #include "services/listen_dnsport.h"
61 #include "services/mesh.h"
62 #include "sldns/rrdef.h"
63 #include "sldns/pkthdr.h"
64 #include "sldns/sbuffer.h"
65 #include "sldns/str2wire.h"
66 #include "sldns/wire2str.h"
67 #include "sldns/parseutil.h"
68 #include "sldns/keyraw.h"
69 #include "validator/val_nsec3.h"
70 #include "validator/val_secalgo.h"
71 #include <ctype.h>
72 
73 /** bytes to use for NSEC3 hash buffer. 20 for sha1 */
74 #define N3HASHBUFLEN 32
75 /** max number of CNAMEs we are willing to follow (in one answer) */
76 #define MAX_CNAME_CHAIN 8
77 /** timeout for probe packets for SOA */
78 #define AUTH_PROBE_TIMEOUT 100 /* msec */
79 /** when to stop with SOA probes (when exponential timeouts exceed this) */
80 #define AUTH_PROBE_TIMEOUT_STOP 1000 /* msec */
81 /* auth transfer timeout for TCP connections, in msec */
82 #define AUTH_TRANSFER_TIMEOUT 10000 /* msec */
83 /* auth transfer max backoff for failed tranfers and probes */
84 #define AUTH_TRANSFER_MAX_BACKOFF 86400 /* sec */
85 /* auth http port number */
86 #define AUTH_HTTP_PORT 80
87 /* auth https port number */
88 #define AUTH_HTTPS_PORT 443
89 /* max depth for nested $INCLUDEs */
90 #define MAX_INCLUDE_DEPTH 10
91 /** number of timeouts before we fallback from IXFR to AXFR,
92  * because some versions of servers (eg. dnsmasq) drop IXFR packets. */
93 #define NUM_TIMEOUTS_FALLBACK_IXFR 3
94 
95 /** pick up nextprobe task to start waiting to perform transfer actions */
96 static void xfr_set_timeout(struct auth_xfer* xfr, struct module_env* env,
97 	int failure, int lookup_only);
98 /** move to sending the probe packets, next if fails. task_probe */
99 static void xfr_probe_send_or_end(struct auth_xfer* xfr,
100 	struct module_env* env);
101 /** pick up probe task with specified(or NULL) destination first,
102  * or transfer task if nothing to probe, or false if already in progress */
103 static int xfr_start_probe(struct auth_xfer* xfr, struct module_env* env,
104 	struct auth_master* spec);
105 /** delete xfer structure (not its tree entry) */
106 static void auth_xfer_delete(struct auth_xfer* xfr);
107 
108 /** create new dns_msg */
109 static struct dns_msg*
110 msg_create(struct regional* region, struct query_info* qinfo)
111 {
112 	struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
113 		sizeof(struct dns_msg));
114 	if(!msg)
115 		return NULL;
116 	msg->qinfo.qname = regional_alloc_init(region, qinfo->qname,
117 		qinfo->qname_len);
118 	if(!msg->qinfo.qname)
119 		return NULL;
120 	msg->qinfo.qname_len = qinfo->qname_len;
121 	msg->qinfo.qtype = qinfo->qtype;
122 	msg->qinfo.qclass = qinfo->qclass;
123 	msg->qinfo.local_alias = NULL;
124 	/* non-packed reply_info, because it needs to grow the array */
125 	msg->rep = (struct reply_info*)regional_alloc_zero(region,
126 		sizeof(struct reply_info)-sizeof(struct rrset_ref));
127 	if(!msg->rep)
128 		return NULL;
129 	msg->rep->flags = (uint16_t)(BIT_QR | BIT_AA);
130 	msg->rep->authoritative = 1;
131 	msg->rep->qdcount = 1;
132 	/* rrsets is NULL, no rrsets yet */
133 	return msg;
134 }
135 
136 /** grow rrset array by one in msg */
137 static int
138 msg_grow_array(struct regional* region, struct dns_msg* msg)
139 {
140 	if(msg->rep->rrsets == NULL) {
141 		msg->rep->rrsets = regional_alloc_zero(region,
142 			sizeof(struct ub_packed_rrset_key*)*(msg->rep->rrset_count+1));
143 		if(!msg->rep->rrsets)
144 			return 0;
145 	} else {
146 		struct ub_packed_rrset_key** rrsets_old = msg->rep->rrsets;
147 		msg->rep->rrsets = regional_alloc_zero(region,
148 			sizeof(struct ub_packed_rrset_key*)*(msg->rep->rrset_count+1));
149 		if(!msg->rep->rrsets)
150 			return 0;
151 		memmove(msg->rep->rrsets, rrsets_old,
152 			sizeof(struct ub_packed_rrset_key*)*msg->rep->rrset_count);
153 	}
154 	return 1;
155 }
156 
157 /** get ttl of rrset */
158 static time_t
159 get_rrset_ttl(struct ub_packed_rrset_key* k)
160 {
161 	struct packed_rrset_data* d = (struct packed_rrset_data*)
162 		k->entry.data;
163 	return d->ttl;
164 }
165 
166 /** Copy rrset into region from domain-datanode and packet rrset */
167 static struct ub_packed_rrset_key*
168 auth_packed_rrset_copy_region(struct auth_zone* z, struct auth_data* node,
169 	struct auth_rrset* rrset, struct regional* region, time_t adjust)
170 {
171 	struct ub_packed_rrset_key key;
172 	memset(&key, 0, sizeof(key));
173 	key.entry.key = &key;
174 	key.entry.data = rrset->data;
175 	key.rk.dname = node->name;
176 	key.rk.dname_len = node->namelen;
177 	key.rk.type = htons(rrset->type);
178 	key.rk.rrset_class = htons(z->dclass);
179 	key.entry.hash = rrset_key_hash(&key.rk);
180 	return packed_rrset_copy_region(&key, region, adjust);
181 }
182 
183 /** fix up msg->rep TTL and prefetch ttl */
184 static void
185 msg_ttl(struct dns_msg* msg)
186 {
187 	if(msg->rep->rrset_count == 0) return;
188 	if(msg->rep->rrset_count == 1) {
189 		msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[0]);
190 		msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
191 		msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
192 	} else if(get_rrset_ttl(msg->rep->rrsets[msg->rep->rrset_count-1]) <
193 		msg->rep->ttl) {
194 		msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[
195 			msg->rep->rrset_count-1]);
196 		msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
197 		msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
198 	}
199 }
200 
201 /** see if rrset is a duplicate in the answer message */
202 static int
203 msg_rrset_duplicate(struct dns_msg* msg, uint8_t* nm, size_t nmlen,
204 	uint16_t type, uint16_t dclass)
205 {
206 	size_t i;
207 	for(i=0; i<msg->rep->rrset_count; i++) {
208 		struct ub_packed_rrset_key* k = msg->rep->rrsets[i];
209 		if(ntohs(k->rk.type) == type && k->rk.dname_len == nmlen &&
210 			ntohs(k->rk.rrset_class) == dclass &&
211 			query_dname_compare(k->rk.dname, nm) == 0)
212 			return 1;
213 	}
214 	return 0;
215 }
216 
217 /** add rrset to answer section (no auth, add rrsets yet) */
218 static int
219 msg_add_rrset_an(struct auth_zone* z, struct regional* region,
220 	struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset)
221 {
222 	log_assert(msg->rep->ns_numrrsets == 0);
223 	log_assert(msg->rep->ar_numrrsets == 0);
224 	if(!rrset || !node)
225 		return 1;
226 	if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type,
227 		z->dclass))
228 		return 1;
229 	/* grow array */
230 	if(!msg_grow_array(region, msg))
231 		return 0;
232 	/* copy it */
233 	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
234 		auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
235 		return 0;
236 	msg->rep->rrset_count++;
237 	msg->rep->an_numrrsets++;
238 	msg_ttl(msg);
239 	return 1;
240 }
241 
242 /** add rrset to authority section (no additonal section rrsets yet) */
243 static int
244 msg_add_rrset_ns(struct auth_zone* z, struct regional* region,
245 	struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset)
246 {
247 	log_assert(msg->rep->ar_numrrsets == 0);
248 	if(!rrset || !node)
249 		return 1;
250 	if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type,
251 		z->dclass))
252 		return 1;
253 	/* grow array */
254 	if(!msg_grow_array(region, msg))
255 		return 0;
256 	/* copy it */
257 	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
258 		auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
259 		return 0;
260 	msg->rep->rrset_count++;
261 	msg->rep->ns_numrrsets++;
262 	msg_ttl(msg);
263 	return 1;
264 }
265 
266 /** add rrset to additional section */
267 static int
268 msg_add_rrset_ar(struct auth_zone* z, struct regional* region,
269 	struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset)
270 {
271 	if(!rrset || !node)
272 		return 1;
273 	if(msg_rrset_duplicate(msg, node->name, node->namelen, rrset->type,
274 		z->dclass))
275 		return 1;
276 	/* grow array */
277 	if(!msg_grow_array(region, msg))
278 		return 0;
279 	/* copy it */
280 	if(!(msg->rep->rrsets[msg->rep->rrset_count] =
281 		auth_packed_rrset_copy_region(z, node, rrset, region, 0)))
282 		return 0;
283 	msg->rep->rrset_count++;
284 	msg->rep->ar_numrrsets++;
285 	msg_ttl(msg);
286 	return 1;
287 }
288 
289 struct auth_zones* auth_zones_create(void)
290 {
291 	struct auth_zones* az = (struct auth_zones*)calloc(1, sizeof(*az));
292 	if(!az) {
293 		log_err("out of memory");
294 		return NULL;
295 	}
296 	rbtree_init(&az->ztree, &auth_zone_cmp);
297 	rbtree_init(&az->xtree, &auth_xfer_cmp);
298 	lock_rw_init(&az->lock);
299 	lock_protect(&az->lock, &az->ztree, sizeof(az->ztree));
300 	lock_protect(&az->lock, &az->xtree, sizeof(az->xtree));
301 	/* also lock protects the rbnode's in struct auth_zone, auth_xfer */
302 	lock_rw_init(&az->rpz_lock);
303 	lock_protect(&az->rpz_lock, &az->rpz_first, sizeof(az->rpz_first));
304 	return az;
305 }
306 
307 int auth_zone_cmp(const void* z1, const void* z2)
308 {
309 	/* first sort on class, so that hierarchy can be maintained within
310 	 * a class */
311 	struct auth_zone* a = (struct auth_zone*)z1;
312 	struct auth_zone* b = (struct auth_zone*)z2;
313 	int m;
314 	if(a->dclass != b->dclass) {
315 		if(a->dclass < b->dclass)
316 			return -1;
317 		return 1;
318 	}
319 	/* sorted such that higher zones sort before lower zones (their
320 	 * contents) */
321 	return dname_lab_cmp(a->name, a->namelabs, b->name, b->namelabs, &m);
322 }
323 
324 int auth_data_cmp(const void* z1, const void* z2)
325 {
326 	struct auth_data* a = (struct auth_data*)z1;
327 	struct auth_data* b = (struct auth_data*)z2;
328 	int m;
329 	/* canonical sort, because DNSSEC needs that */
330 	return dname_canon_lab_cmp(a->name, a->namelabs, b->name,
331 		b->namelabs, &m);
332 }
333 
334 int auth_xfer_cmp(const void* z1, const void* z2)
335 {
336 	/* first sort on class, so that hierarchy can be maintained within
337 	 * a class */
338 	struct auth_xfer* a = (struct auth_xfer*)z1;
339 	struct auth_xfer* b = (struct auth_xfer*)z2;
340 	int m;
341 	if(a->dclass != b->dclass) {
342 		if(a->dclass < b->dclass)
343 			return -1;
344 		return 1;
345 	}
346 	/* sorted such that higher zones sort before lower zones (their
347 	 * contents) */
348 	return dname_lab_cmp(a->name, a->namelabs, b->name, b->namelabs, &m);
349 }
350 
351 /** delete auth rrset node */
352 static void
353 auth_rrset_delete(struct auth_rrset* rrset)
354 {
355 	if(!rrset) return;
356 	free(rrset->data);
357 	free(rrset);
358 }
359 
360 /** delete auth data domain node */
361 static void
362 auth_data_delete(struct auth_data* n)
363 {
364 	struct auth_rrset* p, *np;
365 	if(!n) return;
366 	p = n->rrsets;
367 	while(p) {
368 		np = p->next;
369 		auth_rrset_delete(p);
370 		p = np;
371 	}
372 	free(n->name);
373 	free(n);
374 }
375 
376 /** helper traverse to delete zones */
377 static void
378 auth_data_del(rbnode_type* n, void* ATTR_UNUSED(arg))
379 {
380 	struct auth_data* z = (struct auth_data*)n->key;
381 	auth_data_delete(z);
382 }
383 
384 /** delete an auth zone structure (tree remove must be done elsewhere) */
385 static void
386 auth_zone_delete(struct auth_zone* z, struct auth_zones* az)
387 {
388 	if(!z) return;
389 	lock_rw_destroy(&z->lock);
390 	traverse_postorder(&z->data, auth_data_del, NULL);
391 
392 	if(az && z->rpz) {
393 		/* keep RPZ linked list intact */
394 		lock_rw_wrlock(&az->rpz_lock);
395 		if(z->rpz_az_prev)
396 			z->rpz_az_prev->rpz_az_next = z->rpz_az_next;
397 		else
398 			az->rpz_first = z->rpz_az_next;
399 		if(z->rpz_az_next)
400 			z->rpz_az_next->rpz_az_prev = z->rpz_az_prev;
401 		lock_rw_unlock(&az->rpz_lock);
402 	}
403 	if(z->rpz)
404 		rpz_delete(z->rpz);
405 	free(z->name);
406 	free(z->zonefile);
407 	free(z);
408 }
409 
410 struct auth_zone*
411 auth_zone_create(struct auth_zones* az, uint8_t* nm, size_t nmlen,
412 	uint16_t dclass)
413 {
414 	struct auth_zone* z = (struct auth_zone*)calloc(1, sizeof(*z));
415 	if(!z) {
416 		return NULL;
417 	}
418 	z->node.key = z;
419 	z->dclass = dclass;
420 	z->namelen = nmlen;
421 	z->namelabs = dname_count_labels(nm);
422 	z->name = memdup(nm, nmlen);
423 	if(!z->name) {
424 		free(z);
425 		return NULL;
426 	}
427 	rbtree_init(&z->data, &auth_data_cmp);
428 	lock_rw_init(&z->lock);
429 	lock_protect(&z->lock, &z->name, sizeof(*z)-sizeof(rbnode_type)-
430 			sizeof(&z->rpz_az_next)-sizeof(&z->rpz_az_prev));
431 	lock_rw_wrlock(&z->lock);
432 	/* z lock protects all, except rbtree itself and the rpz linked list
433 	 * pointers, which are protected using az->lock */
434 	if(!rbtree_insert(&az->ztree, &z->node)) {
435 		lock_rw_unlock(&z->lock);
436 		auth_zone_delete(z, NULL);
437 		log_warn("duplicate auth zone");
438 		return NULL;
439 	}
440 	return z;
441 }
442 
443 struct auth_zone*
444 auth_zone_find(struct auth_zones* az, uint8_t* nm, size_t nmlen,
445 	uint16_t dclass)
446 {
447 	struct auth_zone key;
448 	key.node.key = &key;
449 	key.dclass = dclass;
450 	key.name = nm;
451 	key.namelen = nmlen;
452 	key.namelabs = dname_count_labels(nm);
453 	return (struct auth_zone*)rbtree_search(&az->ztree, &key);
454 }
455 
456 struct auth_xfer*
457 auth_xfer_find(struct auth_zones* az, uint8_t* nm, size_t nmlen,
458 	uint16_t dclass)
459 {
460 	struct auth_xfer key;
461 	key.node.key = &key;
462 	key.dclass = dclass;
463 	key.name = nm;
464 	key.namelen = nmlen;
465 	key.namelabs = dname_count_labels(nm);
466 	return (struct auth_xfer*)rbtree_search(&az->xtree, &key);
467 }
468 
469 /** find an auth zone or sorted less-or-equal, return true if exact */
470 static int
471 auth_zone_find_less_equal(struct auth_zones* az, uint8_t* nm, size_t nmlen,
472 	uint16_t dclass, struct auth_zone** z)
473 {
474 	struct auth_zone key;
475 	key.node.key = &key;
476 	key.dclass = dclass;
477 	key.name = nm;
478 	key.namelen = nmlen;
479 	key.namelabs = dname_count_labels(nm);
480 	return rbtree_find_less_equal(&az->ztree, &key, (rbnode_type**)z);
481 }
482 
483 
484 /** find the auth zone that is above the given name */
485 struct auth_zone*
486 auth_zones_find_zone(struct auth_zones* az, uint8_t* name, size_t name_len,
487 	uint16_t dclass)
488 {
489 	uint8_t* nm = name;
490 	size_t nmlen = name_len;
491 	struct auth_zone* z;
492 	if(auth_zone_find_less_equal(az, nm, nmlen, dclass, &z)) {
493 		/* exact match */
494 		return z;
495 	} else {
496 		/* less-or-nothing */
497 		if(!z) return NULL; /* nothing smaller, nothing above it */
498 		/* we found smaller name; smaller may be above the name,
499 		 * but not below it. */
500 		nm = dname_get_shared_topdomain(z->name, name);
501 		dname_count_size_labels(nm, &nmlen);
502 		z = NULL;
503 	}
504 
505 	/* search up */
506 	while(!z) {
507 		z = auth_zone_find(az, nm, nmlen, dclass);
508 		if(z) return z;
509 		if(dname_is_root(nm)) break;
510 		dname_remove_label(&nm, &nmlen);
511 	}
512 	return NULL;
513 }
514 
515 /** find or create zone with name str. caller must have lock on az.
516  * returns a wrlocked zone */
517 static struct auth_zone*
518 auth_zones_find_or_add_zone(struct auth_zones* az, char* name)
519 {
520 	uint8_t nm[LDNS_MAX_DOMAINLEN+1];
521 	size_t nmlen = sizeof(nm);
522 	struct auth_zone* z;
523 
524 	if(sldns_str2wire_dname_buf(name, nm, &nmlen) != 0) {
525 		log_err("cannot parse auth zone name: %s", name);
526 		return 0;
527 	}
528 	z = auth_zone_find(az, nm, nmlen, LDNS_RR_CLASS_IN);
529 	if(!z) {
530 		/* not found, create the zone */
531 		z = auth_zone_create(az, nm, nmlen, LDNS_RR_CLASS_IN);
532 	} else {
533 		lock_rw_wrlock(&z->lock);
534 	}
535 	return z;
536 }
537 
538 /** find or create xfer zone with name str. caller must have lock on az.
539  * returns a locked xfer */
540 static struct auth_xfer*
541 auth_zones_find_or_add_xfer(struct auth_zones* az, struct auth_zone* z)
542 {
543 	struct auth_xfer* x;
544 	x = auth_xfer_find(az, z->name, z->namelen, z->dclass);
545 	if(!x) {
546 		/* not found, create the zone */
547 		x = auth_xfer_create(az, z);
548 	} else {
549 		lock_basic_lock(&x->lock);
550 	}
551 	return x;
552 }
553 
554 int
555 auth_zone_set_zonefile(struct auth_zone* z, char* zonefile)
556 {
557 	if(z->zonefile) free(z->zonefile);
558 	if(zonefile == NULL) {
559 		z->zonefile = NULL;
560 	} else {
561 		z->zonefile = strdup(zonefile);
562 		if(!z->zonefile) {
563 			log_err("malloc failure");
564 			return 0;
565 		}
566 	}
567 	return 1;
568 }
569 
570 /** set auth zone fallback. caller must have lock on zone */
571 int
572 auth_zone_set_fallback(struct auth_zone* z, char* fallbackstr)
573 {
574 	if(strcmp(fallbackstr, "yes") != 0 && strcmp(fallbackstr, "no") != 0){
575 		log_err("auth zone fallback, expected yes or no, got %s",
576 			fallbackstr);
577 		return 0;
578 	}
579 	z->fallback_enabled = (strcmp(fallbackstr, "yes")==0);
580 	return 1;
581 }
582 
583 /** create domain with the given name */
584 static struct auth_data*
585 az_domain_create(struct auth_zone* z, uint8_t* nm, size_t nmlen)
586 {
587 	struct auth_data* n = (struct auth_data*)malloc(sizeof(*n));
588 	if(!n) return NULL;
589 	memset(n, 0, sizeof(*n));
590 	n->node.key = n;
591 	n->name = memdup(nm, nmlen);
592 	if(!n->name) {
593 		free(n);
594 		return NULL;
595 	}
596 	n->namelen = nmlen;
597 	n->namelabs = dname_count_labels(nm);
598 	if(!rbtree_insert(&z->data, &n->node)) {
599 		log_warn("duplicate auth domain name");
600 		free(n->name);
601 		free(n);
602 		return NULL;
603 	}
604 	return n;
605 }
606 
607 /** find domain with exactly the given name */
608 static struct auth_data*
609 az_find_name(struct auth_zone* z, uint8_t* nm, size_t nmlen)
610 {
611 	struct auth_zone key;
612 	key.node.key = &key;
613 	key.name = nm;
614 	key.namelen = nmlen;
615 	key.namelabs = dname_count_labels(nm);
616 	return (struct auth_data*)rbtree_search(&z->data, &key);
617 }
618 
619 /** Find domain name (or closest match) */
620 static void
621 az_find_domain(struct auth_zone* z, struct query_info* qinfo, int* node_exact,
622 	struct auth_data** node)
623 {
624 	struct auth_zone key;
625 	key.node.key = &key;
626 	key.name = qinfo->qname;
627 	key.namelen = qinfo->qname_len;
628 	key.namelabs = dname_count_labels(key.name);
629 	*node_exact = rbtree_find_less_equal(&z->data, &key,
630 		(rbnode_type**)node);
631 }
632 
633 /** find or create domain with name in zone */
634 static struct auth_data*
635 az_domain_find_or_create(struct auth_zone* z, uint8_t* dname,
636 	size_t dname_len)
637 {
638 	struct auth_data* n = az_find_name(z, dname, dname_len);
639 	if(!n) {
640 		n = az_domain_create(z, dname, dname_len);
641 	}
642 	return n;
643 }
644 
645 /** find rrset of given type in the domain */
646 static struct auth_rrset*
647 az_domain_rrset(struct auth_data* n, uint16_t t)
648 {
649 	struct auth_rrset* rrset;
650 	if(!n) return NULL;
651 	rrset = n->rrsets;
652 	while(rrset) {
653 		if(rrset->type == t)
654 			return rrset;
655 		rrset = rrset->next;
656 	}
657 	return NULL;
658 }
659 
660 /** remove rrset of this type from domain */
661 static void
662 domain_remove_rrset(struct auth_data* node, uint16_t rr_type)
663 {
664 	struct auth_rrset* rrset, *prev;
665 	if(!node) return;
666 	prev = NULL;
667 	rrset = node->rrsets;
668 	while(rrset) {
669 		if(rrset->type == rr_type) {
670 			/* found it, now delete it */
671 			if(prev) prev->next = rrset->next;
672 			else	node->rrsets = rrset->next;
673 			auth_rrset_delete(rrset);
674 			return;
675 		}
676 		prev = rrset;
677 		rrset = rrset->next;
678 	}
679 }
680 
681 /** find an rrsig index in the rrset.  returns true if found */
682 static int
683 az_rrset_find_rrsig(struct packed_rrset_data* d, uint8_t* rdata, size_t len,
684 	size_t* index)
685 {
686 	size_t i;
687 	for(i=d->count; i<d->count + d->rrsig_count; i++) {
688 		if(d->rr_len[i] != len)
689 			continue;
690 		if(memcmp(d->rr_data[i], rdata, len) == 0) {
691 			*index = i;
692 			return 1;
693 		}
694 	}
695 	return 0;
696 }
697 
698 /** see if rdata is duplicate */
699 static int
700 rdata_duplicate(struct packed_rrset_data* d, uint8_t* rdata, size_t len)
701 {
702 	size_t i;
703 	for(i=0; i<d->count + d->rrsig_count; i++) {
704 		if(d->rr_len[i] != len)
705 			continue;
706 		if(memcmp(d->rr_data[i], rdata, len) == 0)
707 			return 1;
708 	}
709 	return 0;
710 }
711 
712 /** get rrsig type covered from rdata.
713  * @param rdata: rdata in wireformat, starting with 16bit rdlength.
714  * @param rdatalen: length of rdata buffer.
715  * @return type covered (or 0).
716  */
717 static uint16_t
718 rrsig_rdata_get_type_covered(uint8_t* rdata, size_t rdatalen)
719 {
720 	if(rdatalen < 4)
721 		return 0;
722 	return sldns_read_uint16(rdata+2);
723 }
724 
725 /** remove RR from existing RRset. Also sig, if it is a signature.
726  * reallocates the packed rrset for a new one, false on alloc failure */
727 static int
728 rrset_remove_rr(struct auth_rrset* rrset, size_t index)
729 {
730 	struct packed_rrset_data* d, *old = rrset->data;
731 	size_t i;
732 	if(index >= old->count + old->rrsig_count)
733 		return 0; /* index out of bounds */
734 	d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old) - (
735 		sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t) +
736 		old->rr_len[index]));
737 	if(!d) {
738 		log_err("malloc failure");
739 		return 0;
740 	}
741 	d->ttl = old->ttl;
742 	d->count = old->count;
743 	d->rrsig_count = old->rrsig_count;
744 	if(index < d->count) d->count--;
745 	else d->rrsig_count--;
746 	d->trust = old->trust;
747 	d->security = old->security;
748 
749 	/* set rr_len, needed for ptr_fixup */
750 	d->rr_len = (size_t*)((uint8_t*)d +
751 		sizeof(struct packed_rrset_data));
752 	if(index > 0)
753 		memmove(d->rr_len, old->rr_len, (index)*sizeof(size_t));
754 	if(index+1 < old->count+old->rrsig_count)
755 		memmove(&d->rr_len[index], &old->rr_len[index+1],
756 		(old->count+old->rrsig_count - (index+1))*sizeof(size_t));
757 	packed_rrset_ptr_fixup(d);
758 
759 	/* move over ttls */
760 	if(index > 0)
761 		memmove(d->rr_ttl, old->rr_ttl, (index)*sizeof(time_t));
762 	if(index+1 < old->count+old->rrsig_count)
763 		memmove(&d->rr_ttl[index], &old->rr_ttl[index+1],
764 		(old->count+old->rrsig_count - (index+1))*sizeof(time_t));
765 
766 	/* move over rr_data */
767 	for(i=0; i<d->count+d->rrsig_count; i++) {
768 		size_t oldi;
769 		if(i < index) oldi = i;
770 		else oldi = i+1;
771 		memmove(d->rr_data[i], old->rr_data[oldi], d->rr_len[i]);
772 	}
773 
774 	/* recalc ttl (lowest of remaining RR ttls) */
775 	if(d->count + d->rrsig_count > 0)
776 		d->ttl = d->rr_ttl[0];
777 	for(i=0; i<d->count+d->rrsig_count; i++) {
778 		if(d->rr_ttl[i] < d->ttl)
779 			d->ttl = d->rr_ttl[i];
780 	}
781 
782 	free(rrset->data);
783 	rrset->data = d;
784 	return 1;
785 }
786 
787 /** add RR to existing RRset. If insert_sig is true, add to rrsigs.
788  * This reallocates the packed rrset for a new one */
789 static int
790 rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
791 	size_t rdatalen, int insert_sig)
792 {
793 	struct packed_rrset_data* d, *old = rrset->data;
794 	size_t total, old_total;
795 
796 	d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old)
797 		+ sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t)
798 		+ rdatalen);
799 	if(!d) {
800 		log_err("out of memory");
801 		return 0;
802 	}
803 	/* copy base values */
804 	memcpy(d, old, sizeof(struct packed_rrset_data));
805 	if(!insert_sig) {
806 		d->count++;
807 	} else {
808 		d->rrsig_count++;
809 	}
810 	old_total = old->count + old->rrsig_count;
811 	total = d->count + d->rrsig_count;
812 	/* set rr_len, needed for ptr_fixup */
813 	d->rr_len = (size_t*)((uint8_t*)d +
814 		sizeof(struct packed_rrset_data));
815 	if(old->count != 0)
816 		memmove(d->rr_len, old->rr_len, old->count*sizeof(size_t));
817 	if(old->rrsig_count != 0)
818 		memmove(d->rr_len+d->count, old->rr_len+old->count,
819 			old->rrsig_count*sizeof(size_t));
820 	if(!insert_sig)
821 		d->rr_len[d->count-1] = rdatalen;
822 	else	d->rr_len[total-1] = rdatalen;
823 	packed_rrset_ptr_fixup(d);
824 	if((time_t)rr_ttl < d->ttl)
825 		d->ttl = rr_ttl;
826 
827 	/* copy old values into new array */
828 	if(old->count != 0) {
829 		memmove(d->rr_ttl, old->rr_ttl, old->count*sizeof(time_t));
830 		/* all the old rr pieces are allocated sequential, so we
831 		 * can copy them in one go */
832 		memmove(d->rr_data[0], old->rr_data[0],
833 			(old->rr_data[old->count-1] - old->rr_data[0]) +
834 			old->rr_len[old->count-1]);
835 	}
836 	if(old->rrsig_count != 0) {
837 		memmove(d->rr_ttl+d->count, old->rr_ttl+old->count,
838 			old->rrsig_count*sizeof(time_t));
839 		memmove(d->rr_data[d->count], old->rr_data[old->count],
840 			(old->rr_data[old_total-1] - old->rr_data[old->count]) +
841 			old->rr_len[old_total-1]);
842 	}
843 
844 	/* insert new value */
845 	if(!insert_sig) {
846 		d->rr_ttl[d->count-1] = rr_ttl;
847 		memmove(d->rr_data[d->count-1], rdata, rdatalen);
848 	} else {
849 		d->rr_ttl[total-1] = rr_ttl;
850 		memmove(d->rr_data[total-1], rdata, rdatalen);
851 	}
852 
853 	rrset->data = d;
854 	free(old);
855 	return 1;
856 }
857 
858 /** Create new rrset for node with packed rrset with one RR element */
859 static struct auth_rrset*
860 rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
861 	uint8_t* rdata, size_t rdatalen)
862 {
863 	struct auth_rrset* rrset = (struct auth_rrset*)calloc(1,
864 		sizeof(*rrset));
865 	struct auth_rrset* p, *prev;
866 	struct packed_rrset_data* d;
867 	if(!rrset) {
868 		log_err("out of memory");
869 		return NULL;
870 	}
871 	rrset->type = rr_type;
872 
873 	/* the rrset data structure, with one RR */
874 	d = (struct packed_rrset_data*)calloc(1,
875 		sizeof(struct packed_rrset_data) + sizeof(size_t) +
876 		sizeof(uint8_t*) + sizeof(time_t) + rdatalen);
877 	if(!d) {
878 		free(rrset);
879 		log_err("out of memory");
880 		return NULL;
881 	}
882 	rrset->data = d;
883 	d->ttl = rr_ttl;
884 	d->trust = rrset_trust_prim_noglue;
885 	d->rr_len = (size_t*)((uint8_t*)d + sizeof(struct packed_rrset_data));
886 	d->rr_data = (uint8_t**)&(d->rr_len[1]);
887 	d->rr_ttl = (time_t*)&(d->rr_data[1]);
888 	d->rr_data[0] = (uint8_t*)&(d->rr_ttl[1]);
889 
890 	/* insert the RR */
891 	d->rr_len[0] = rdatalen;
892 	d->rr_ttl[0] = rr_ttl;
893 	memmove(d->rr_data[0], rdata, rdatalen);
894 	d->count++;
895 
896 	/* insert rrset into linked list for domain */
897 	/* find sorted place to link the rrset into the list */
898 	prev = NULL;
899 	p = node->rrsets;
900 	while(p && p->type<=rr_type) {
901 		prev = p;
902 		p = p->next;
903 	}
904 	/* so, prev is smaller, and p is larger than rr_type */
905 	rrset->next = p;
906 	if(prev) prev->next = rrset;
907 	else node->rrsets = rrset;
908 	return rrset;
909 }
910 
911 /** count number (and size) of rrsigs that cover a type */
912 static size_t
913 rrsig_num_that_cover(struct auth_rrset* rrsig, uint16_t rr_type, size_t* sigsz)
914 {
915 	struct packed_rrset_data* d = rrsig->data;
916 	size_t i, num = 0;
917 	*sigsz = 0;
918 	log_assert(d && rrsig->type == LDNS_RR_TYPE_RRSIG);
919 	for(i=0; i<d->count+d->rrsig_count; i++) {
920 		if(rrsig_rdata_get_type_covered(d->rr_data[i],
921 			d->rr_len[i]) == rr_type) {
922 			num++;
923 			(*sigsz) += d->rr_len[i];
924 		}
925 	}
926 	return num;
927 }
928 
929 /** See if rrsig set has covered sigs for rrset and move them over */
930 static int
931 rrset_moveover_rrsigs(struct auth_data* node, uint16_t rr_type,
932 	struct auth_rrset* rrset, struct auth_rrset* rrsig)
933 {
934 	size_t sigs, sigsz, i, j, total;
935 	struct packed_rrset_data* sigold = rrsig->data;
936 	struct packed_rrset_data* old = rrset->data;
937 	struct packed_rrset_data* d, *sigd;
938 
939 	log_assert(rrset->type == rr_type);
940 	log_assert(rrsig->type == LDNS_RR_TYPE_RRSIG);
941 	sigs = rrsig_num_that_cover(rrsig, rr_type, &sigsz);
942 	if(sigs == 0) {
943 		/* 0 rrsigs to move over, done */
944 		return 1;
945 	}
946 
947 	/* allocate rrset sigsz larger for extra sigs elements, and
948 	 * allocate rrsig sigsz smaller for less sigs elements. */
949 	d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old)
950 		+ sigs*(sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t))
951 		+ sigsz);
952 	if(!d) {
953 		log_err("out of memory");
954 		return 0;
955 	}
956 	/* copy base values */
957 	total = old->count + old->rrsig_count;
958 	memcpy(d, old, sizeof(struct packed_rrset_data));
959 	d->rrsig_count += sigs;
960 	/* setup rr_len */
961 	d->rr_len = (size_t*)((uint8_t*)d +
962 		sizeof(struct packed_rrset_data));
963 	if(total != 0)
964 		memmove(d->rr_len, old->rr_len, total*sizeof(size_t));
965 	j = d->count+d->rrsig_count-sigs;
966 	for(i=0; i<sigold->count+sigold->rrsig_count; i++) {
967 		if(rrsig_rdata_get_type_covered(sigold->rr_data[i],
968 			sigold->rr_len[i]) == rr_type) {
969 			d->rr_len[j] = sigold->rr_len[i];
970 			j++;
971 		}
972 	}
973 	packed_rrset_ptr_fixup(d);
974 
975 	/* copy old values into new array */
976 	if(total != 0) {
977 		memmove(d->rr_ttl, old->rr_ttl, total*sizeof(time_t));
978 		/* all the old rr pieces are allocated sequential, so we
979 		 * can copy them in one go */
980 		memmove(d->rr_data[0], old->rr_data[0],
981 			(old->rr_data[total-1] - old->rr_data[0]) +
982 			old->rr_len[total-1]);
983 	}
984 
985 	/* move over the rrsigs to the larger rrset*/
986 	j = d->count+d->rrsig_count-sigs;
987 	for(i=0; i<sigold->count+sigold->rrsig_count; i++) {
988 		if(rrsig_rdata_get_type_covered(sigold->rr_data[i],
989 			sigold->rr_len[i]) == rr_type) {
990 			/* move this one over to location j */
991 			d->rr_ttl[j] = sigold->rr_ttl[i];
992 			memmove(d->rr_data[j], sigold->rr_data[i],
993 				sigold->rr_len[i]);
994 			if(d->rr_ttl[j] < d->ttl)
995 				d->ttl = d->rr_ttl[j];
996 			j++;
997 		}
998 	}
999 
1000 	/* put it in and deallocate the old rrset */
1001 	rrset->data = d;
1002 	free(old);
1003 
1004 	/* now make rrsig set smaller */
1005 	if(sigold->count+sigold->rrsig_count == sigs) {
1006 		/* remove all sigs from rrsig, remove it entirely */
1007 		domain_remove_rrset(node, LDNS_RR_TYPE_RRSIG);
1008 		return 1;
1009 	}
1010 	log_assert(packed_rrset_sizeof(sigold) > sigs*(sizeof(size_t) +
1011 		sizeof(uint8_t*) + sizeof(time_t)) + sigsz);
1012 	sigd = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(sigold)
1013 		- sigs*(sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t))
1014 		- sigsz);
1015 	if(!sigd) {
1016 		/* no need to free up d, it has already been placed in the
1017 		 * node->rrset structure */
1018 		log_err("out of memory");
1019 		return 0;
1020 	}
1021 	/* copy base values */
1022 	memcpy(sigd, sigold, sizeof(struct packed_rrset_data));
1023 	/* in sigd the RRSIGs are stored in the base of the RR, in count */
1024 	sigd->count -= sigs;
1025 	/* setup rr_len */
1026 	sigd->rr_len = (size_t*)((uint8_t*)sigd +
1027 		sizeof(struct packed_rrset_data));
1028 	j = 0;
1029 	for(i=0; i<sigold->count+sigold->rrsig_count; i++) {
1030 		if(rrsig_rdata_get_type_covered(sigold->rr_data[i],
1031 			sigold->rr_len[i]) != rr_type) {
1032 			sigd->rr_len[j] = sigold->rr_len[i];
1033 			j++;
1034 		}
1035 	}
1036 	packed_rrset_ptr_fixup(sigd);
1037 
1038 	/* copy old values into new rrsig array */
1039 	j = 0;
1040 	for(i=0; i<sigold->count+sigold->rrsig_count; i++) {
1041 		if(rrsig_rdata_get_type_covered(sigold->rr_data[i],
1042 			sigold->rr_len[i]) != rr_type) {
1043 			/* move this one over to location j */
1044 			sigd->rr_ttl[j] = sigold->rr_ttl[i];
1045 			memmove(sigd->rr_data[j], sigold->rr_data[i],
1046 				sigold->rr_len[i]);
1047 			if(j==0) sigd->ttl = sigd->rr_ttl[j];
1048 			else {
1049 				if(sigd->rr_ttl[j] < sigd->ttl)
1050 					sigd->ttl = sigd->rr_ttl[j];
1051 			}
1052 			j++;
1053 		}
1054 	}
1055 
1056 	/* put it in and deallocate the old rrset */
1057 	rrsig->data = sigd;
1058 	free(sigold);
1059 
1060 	return 1;
1061 }
1062 
1063 /** copy the rrsigs from the rrset to the rrsig rrset, because the rrset
1064  * is going to be deleted.  reallocates the RRSIG rrset data. */
1065 static int
1066 rrsigs_copy_from_rrset_to_rrsigset(struct auth_rrset* rrset,
1067 	struct auth_rrset* rrsigset)
1068 {
1069 	size_t i;
1070 	if(rrset->data->rrsig_count == 0)
1071 		return 1;
1072 
1073 	/* move them over one by one, because there might be duplicates,
1074 	 * duplicates are ignored */
1075 	for(i=rrset->data->count;
1076 		i<rrset->data->count+rrset->data->rrsig_count; i++) {
1077 		uint8_t* rdata = rrset->data->rr_data[i];
1078 		size_t rdatalen = rrset->data->rr_len[i];
1079 		time_t rr_ttl  = rrset->data->rr_ttl[i];
1080 
1081 		if(rdata_duplicate(rrsigset->data, rdata, rdatalen)) {
1082 			continue;
1083 		}
1084 		if(!rrset_add_rr(rrsigset, rr_ttl, rdata, rdatalen, 0))
1085 			return 0;
1086 	}
1087 	return 1;
1088 }
1089 
1090 /** Add rr to node, ignores duplicate RRs,
1091  * rdata points to buffer with rdatalen octets, starts with 2bytelength. */
1092 static int
1093 az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
1094 	uint8_t* rdata, size_t rdatalen, int* duplicate)
1095 {
1096 	struct auth_rrset* rrset;
1097 	/* packed rrsets have their rrsigs along with them, sort them out */
1098 	if(rr_type == LDNS_RR_TYPE_RRSIG) {
1099 		uint16_t ctype = rrsig_rdata_get_type_covered(rdata, rdatalen);
1100 		if((rrset=az_domain_rrset(node, ctype))!= NULL) {
1101 			/* a node of the correct type exists, add the RRSIG
1102 			 * to the rrset of the covered data type */
1103 			if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
1104 				if(duplicate) *duplicate = 1;
1105 				return 1;
1106 			}
1107 			if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 1))
1108 				return 0;
1109 		} else if((rrset=az_domain_rrset(node, rr_type))!= NULL) {
1110 			/* add RRSIG to rrset of type RRSIG */
1111 			if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
1112 				if(duplicate) *duplicate = 1;
1113 				return 1;
1114 			}
1115 			if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0))
1116 				return 0;
1117 		} else {
1118 			/* create rrset of type RRSIG */
1119 			if(!rrset_create(node, rr_type, rr_ttl, rdata,
1120 				rdatalen))
1121 				return 0;
1122 		}
1123 	} else {
1124 		/* normal RR type */
1125 		if((rrset=az_domain_rrset(node, rr_type))!= NULL) {
1126 			/* add data to existing node with data type */
1127 			if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
1128 				if(duplicate) *duplicate = 1;
1129 				return 1;
1130 			}
1131 			if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0))
1132 				return 0;
1133 		} else {
1134 			struct auth_rrset* rrsig;
1135 			/* create new node with data type */
1136 			if(!(rrset=rrset_create(node, rr_type, rr_ttl, rdata,
1137 				rdatalen)))
1138 				return 0;
1139 
1140 			/* see if node of type RRSIG has signatures that
1141 			 * cover the data type, and move them over */
1142 			/* and then make the RRSIG type smaller */
1143 			if((rrsig=az_domain_rrset(node, LDNS_RR_TYPE_RRSIG))
1144 				!= NULL) {
1145 				if(!rrset_moveover_rrsigs(node, rr_type,
1146 					rrset, rrsig))
1147 					return 0;
1148 			}
1149 		}
1150 	}
1151 	return 1;
1152 }
1153 
1154 /** insert RR into zone, ignore duplicates */
1155 static int
1156 az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
1157 	size_t dname_len, int* duplicate)
1158 {
1159 	struct auth_data* node;
1160 	uint8_t* dname = rr;
1161 	uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len);
1162 	uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len);
1163 	uint32_t rr_ttl = sldns_wirerr_get_ttl(rr, rr_len, dname_len);
1164 	size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len,
1165 		dname_len))+2;
1166 	/* rdata points to rdata prefixed with uint16 rdatalength */
1167 	uint8_t* rdata = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len);
1168 
1169 	if(rr_class != z->dclass) {
1170 		log_err("wrong class for RR");
1171 		return 0;
1172 	}
1173 	if(!(node=az_domain_find_or_create(z, dname, dname_len))) {
1174 		log_err("cannot create domain");
1175 		return 0;
1176 	}
1177 	if(!az_domain_add_rr(node, rr_type, rr_ttl, rdata, rdatalen,
1178 		duplicate)) {
1179 		log_err("cannot add RR to domain");
1180 		return 0;
1181 	}
1182 	if(z->rpz) {
1183 		if(!(rpz_insert_rr(z->rpz, z->name, z->namelen, dname,
1184 			dname_len, rr_type, rr_class, rr_ttl, rdata, rdatalen,
1185 			rr, rr_len)))
1186 			return 0;
1187 	}
1188 	return 1;
1189 }
1190 
1191 /** Remove rr from node, ignores nonexisting RRs,
1192  * rdata points to buffer with rdatalen octets, starts with 2bytelength. */
1193 static int
1194 az_domain_remove_rr(struct auth_data* node, uint16_t rr_type,
1195 	uint8_t* rdata, size_t rdatalen, int* nonexist)
1196 {
1197 	struct auth_rrset* rrset;
1198 	size_t index = 0;
1199 
1200 	/* find the plain RR of the given type */
1201 	if((rrset=az_domain_rrset(node, rr_type))!= NULL) {
1202 		if(packed_rrset_find_rr(rrset->data, rdata, rdatalen, &index)) {
1203 			if(rrset->data->count == 1 &&
1204 				rrset->data->rrsig_count == 0) {
1205 				/* last RR, delete the rrset */
1206 				domain_remove_rrset(node, rr_type);
1207 			} else if(rrset->data->count == 1 &&
1208 				rrset->data->rrsig_count != 0) {
1209 				/* move RRSIGs to the RRSIG rrset, or
1210 				 * this one becomes that RRset */
1211 				struct auth_rrset* rrsigset = az_domain_rrset(
1212 					node, LDNS_RR_TYPE_RRSIG);
1213 				if(rrsigset) {
1214 					/* move left over rrsigs to the
1215 					 * existing rrset of type RRSIG */
1216 					rrsigs_copy_from_rrset_to_rrsigset(
1217 						rrset, rrsigset);
1218 					/* and then delete the rrset */
1219 					domain_remove_rrset(node, rr_type);
1220 				} else {
1221 					/* no rrset of type RRSIG, this
1222 					 * set is now of that type,
1223 					 * just remove the rr */
1224 					if(!rrset_remove_rr(rrset, index))
1225 						return 0;
1226 					rrset->type = LDNS_RR_TYPE_RRSIG;
1227 					rrset->data->count = rrset->data->rrsig_count;
1228 					rrset->data->rrsig_count = 0;
1229 				}
1230 			} else {
1231 				/* remove the RR from the rrset */
1232 				if(!rrset_remove_rr(rrset, index))
1233 					return 0;
1234 			}
1235 			return 1;
1236 		}
1237 		/* rr not found in rrset */
1238 	}
1239 
1240 	/* is it a type RRSIG, look under the covered type */
1241 	if(rr_type == LDNS_RR_TYPE_RRSIG) {
1242 		uint16_t ctype = rrsig_rdata_get_type_covered(rdata, rdatalen);
1243 		if((rrset=az_domain_rrset(node, ctype))!= NULL) {
1244 			if(az_rrset_find_rrsig(rrset->data, rdata, rdatalen,
1245 				&index)) {
1246 				/* rrsig should have d->count > 0, be
1247 				 * over some rr of that type */
1248 				/* remove the rrsig from the rrsigs list of the
1249 				 * rrset */
1250 				if(!rrset_remove_rr(rrset, index))
1251 					return 0;
1252 				return 1;
1253 			}
1254 		}
1255 		/* also RRSIG not found */
1256 	}
1257 
1258 	/* nothing found to delete */
1259 	if(nonexist) *nonexist = 1;
1260 	return 1;
1261 }
1262 
1263 /** remove RR from zone, ignore if it does not exist, false on alloc failure*/
1264 static int
1265 az_remove_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
1266 	size_t dname_len, int* nonexist)
1267 {
1268 	struct auth_data* node;
1269 	uint8_t* dname = rr;
1270 	uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len);
1271 	uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len);
1272 	size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len,
1273 		dname_len))+2;
1274 	/* rdata points to rdata prefixed with uint16 rdatalength */
1275 	uint8_t* rdata = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len);
1276 
1277 	if(rr_class != z->dclass) {
1278 		log_err("wrong class for RR");
1279 		/* really also a nonexisting entry, because no records
1280 		 * of that class in the zone, but return an error because
1281 		 * getting records of the wrong class is a failure of the
1282 		 * zone transfer */
1283 		return 0;
1284 	}
1285 	node = az_find_name(z, dname, dname_len);
1286 	if(!node) {
1287 		/* node with that name does not exist */
1288 		/* nonexisting entry, because no such name */
1289 		*nonexist = 1;
1290 		return 1;
1291 	}
1292 	if(!az_domain_remove_rr(node, rr_type, rdata, rdatalen, nonexist)) {
1293 		/* alloc failure or so */
1294 		return 0;
1295 	}
1296 	/* remove the node, if necessary */
1297 	/* an rrsets==NULL entry is not kept around for empty nonterminals,
1298 	 * and also parent nodes are not kept around, so we just delete it */
1299 	if(node->rrsets == NULL) {
1300 		(void)rbtree_delete(&z->data, node);
1301 		auth_data_delete(node);
1302 	}
1303 	if(z->rpz) {
1304 		rpz_remove_rr(z->rpz, z->namelen, dname, dname_len, rr_type,
1305 			rr_class, rdata, rdatalen);
1306 	}
1307 	return 1;
1308 }
1309 
1310 /** decompress an RR into the buffer where it'll be an uncompressed RR
1311  * with uncompressed dname and uncompressed rdata (dnames) */
1312 static int
1313 decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt,
1314 	size_t pktlen, uint8_t* dname, uint16_t rr_type, uint16_t rr_class,
1315 	uint32_t rr_ttl, uint8_t* rr_data, uint16_t rr_rdlen)
1316 {
1317 	sldns_buffer pktbuf;
1318 	size_t dname_len = 0;
1319 	size_t rdlenpos;
1320 	size_t rdlen;
1321 	uint8_t* rd;
1322 	const sldns_rr_descriptor* desc;
1323 	sldns_buffer_init_frm_data(&pktbuf, pkt, pktlen);
1324 	sldns_buffer_clear(buf);
1325 
1326 	/* decompress dname */
1327 	sldns_buffer_set_position(&pktbuf,
1328 		(size_t)(dname - sldns_buffer_current(&pktbuf)));
1329 	dname_len = pkt_dname_len(&pktbuf);
1330 	if(dname_len == 0) return 0; /* parse fail on dname */
1331 	if(!sldns_buffer_available(buf, dname_len)) return 0;
1332 	dname_pkt_copy(&pktbuf, sldns_buffer_current(buf), dname);
1333 	sldns_buffer_skip(buf, (ssize_t)dname_len);
1334 
1335 	/* type, class, ttl and rdatalength fields */
1336 	if(!sldns_buffer_available(buf, 10)) return 0;
1337 	sldns_buffer_write_u16(buf, rr_type);
1338 	sldns_buffer_write_u16(buf, rr_class);
1339 	sldns_buffer_write_u32(buf, rr_ttl);
1340 	rdlenpos = sldns_buffer_position(buf);
1341 	sldns_buffer_write_u16(buf, 0); /* rd length position */
1342 
1343 	/* decompress rdata */
1344 	desc = sldns_rr_descript(rr_type);
1345 	rd = rr_data;
1346 	rdlen = rr_rdlen;
1347 	if(rdlen > 0 && desc && desc->_dname_count > 0) {
1348 		int count = (int)desc->_dname_count;
1349 		int rdf = 0;
1350 		size_t len; /* how much rdata to plain copy */
1351 		size_t uncompressed_len, compressed_len;
1352 		size_t oldpos;
1353 		/* decompress dnames. */
1354 		while(rdlen > 0 && count) {
1355 			switch(desc->_wireformat[rdf]) {
1356 			case LDNS_RDF_TYPE_DNAME:
1357 				sldns_buffer_set_position(&pktbuf,
1358 					(size_t)(rd -
1359 					sldns_buffer_begin(&pktbuf)));
1360 				oldpos = sldns_buffer_position(&pktbuf);
1361 				/* moves pktbuf to right after the
1362 				 * compressed dname, and returns uncompressed
1363 				 * dname length */
1364 				uncompressed_len = pkt_dname_len(&pktbuf);
1365 				if(!uncompressed_len)
1366 					return 0; /* parse error in dname */
1367 				if(!sldns_buffer_available(buf,
1368 					uncompressed_len))
1369 					/* dname too long for buffer */
1370 					return 0;
1371 				dname_pkt_copy(&pktbuf,
1372 					sldns_buffer_current(buf), rd);
1373 				sldns_buffer_skip(buf, (ssize_t)uncompressed_len);
1374 				compressed_len = sldns_buffer_position(
1375 					&pktbuf) - oldpos;
1376 				rd += compressed_len;
1377 				rdlen -= compressed_len;
1378 				count--;
1379 				len = 0;
1380 				break;
1381 			case LDNS_RDF_TYPE_STR:
1382 				len = rd[0] + 1;
1383 				break;
1384 			default:
1385 				len = get_rdf_size(desc->_wireformat[rdf]);
1386 				break;
1387 			}
1388 			if(len) {
1389 				if(!sldns_buffer_available(buf, len))
1390 					return 0; /* too long for buffer */
1391 				sldns_buffer_write(buf, rd, len);
1392 				rd += len;
1393 				rdlen -= len;
1394 			}
1395 			rdf++;
1396 		}
1397 	}
1398 	/* copy remaining data */
1399 	if(rdlen > 0) {
1400 		if(!sldns_buffer_available(buf, rdlen)) return 0;
1401 		sldns_buffer_write(buf, rd, rdlen);
1402 	}
1403 	/* fixup rdlength */
1404 	sldns_buffer_write_u16_at(buf, rdlenpos,
1405 		sldns_buffer_position(buf)-rdlenpos-2);
1406 	sldns_buffer_flip(buf);
1407 	return 1;
1408 }
1409 
1410 /** insert RR into zone, from packet, decompress RR,
1411  * if duplicate is nonNULL set the flag but otherwise ignore duplicates */
1412 static int
1413 az_insert_rr_decompress(struct auth_zone* z, uint8_t* pkt, size_t pktlen,
1414 	struct sldns_buffer* scratch_buffer, uint8_t* dname, uint16_t rr_type,
1415 	uint16_t rr_class, uint32_t rr_ttl, uint8_t* rr_data,
1416 	uint16_t rr_rdlen, int* duplicate)
1417 {
1418 	uint8_t* rr;
1419 	size_t rr_len;
1420 	size_t dname_len;
1421 	if(!decompress_rr_into_buffer(scratch_buffer, pkt, pktlen, dname,
1422 		rr_type, rr_class, rr_ttl, rr_data, rr_rdlen)) {
1423 		log_err("could not decompress RR");
1424 		return 0;
1425 	}
1426 	rr = sldns_buffer_begin(scratch_buffer);
1427 	rr_len = sldns_buffer_limit(scratch_buffer);
1428 	dname_len = dname_valid(rr, rr_len);
1429 	return az_insert_rr(z, rr, rr_len, dname_len, duplicate);
1430 }
1431 
1432 /** remove RR from zone, from packet, decompress RR,
1433  * if nonexist is nonNULL set the flag but otherwise ignore nonexisting entries*/
1434 static int
1435 az_remove_rr_decompress(struct auth_zone* z, uint8_t* pkt, size_t pktlen,
1436 	struct sldns_buffer* scratch_buffer, uint8_t* dname, uint16_t rr_type,
1437 	uint16_t rr_class, uint32_t rr_ttl, uint8_t* rr_data,
1438 	uint16_t rr_rdlen, int* nonexist)
1439 {
1440 	uint8_t* rr;
1441 	size_t rr_len;
1442 	size_t dname_len;
1443 	if(!decompress_rr_into_buffer(scratch_buffer, pkt, pktlen, dname,
1444 		rr_type, rr_class, rr_ttl, rr_data, rr_rdlen)) {
1445 		log_err("could not decompress RR");
1446 		return 0;
1447 	}
1448 	rr = sldns_buffer_begin(scratch_buffer);
1449 	rr_len = sldns_buffer_limit(scratch_buffer);
1450 	dname_len = dname_valid(rr, rr_len);
1451 	return az_remove_rr(z, rr, rr_len, dname_len, nonexist);
1452 }
1453 
1454 /**
1455  * Parse zonefile
1456  * @param z: zone to read in.
1457  * @param in: file to read from (just opened).
1458  * @param rr: buffer to use for RRs, 64k.
1459  *	passed so that recursive includes can use the same buffer and do
1460  *	not grow the stack too much.
1461  * @param rrbuflen: sizeof rr buffer.
1462  * @param state: parse state with $ORIGIN, $TTL and 'prev-dname' and so on,
1463  *	that is kept between includes.
1464  *	The lineno is set at 1 and then increased by the function.
1465  * @param fname: file name.
1466  * @param depth: recursion depth for includes
1467  * @param cfg: config for chroot.
1468  * returns false on failure, has printed an error message
1469  */
1470 static int
1471 az_parse_file(struct auth_zone* z, FILE* in, uint8_t* rr, size_t rrbuflen,
1472 	struct sldns_file_parse_state* state, char* fname, int depth,
1473 	struct config_file* cfg)
1474 {
1475 	size_t rr_len, dname_len;
1476 	int status;
1477 	state->lineno = 1;
1478 
1479 	while(!feof(in)) {
1480 		rr_len = rrbuflen;
1481 		dname_len = 0;
1482 		status = sldns_fp2wire_rr_buf(in, rr, &rr_len, &dname_len,
1483 			state);
1484 		if(status == LDNS_WIREPARSE_ERR_INCLUDE && rr_len == 0) {
1485 			/* we have $INCLUDE or $something */
1486 			if(strncmp((char*)rr, "$INCLUDE ", 9) == 0 ||
1487 			   strncmp((char*)rr, "$INCLUDE\t", 9) == 0) {
1488 				FILE* inc;
1489 				int lineno_orig = state->lineno;
1490 				char* incfile = (char*)rr + 8;
1491 				if(depth > MAX_INCLUDE_DEPTH) {
1492 					log_err("%s:%d max include depth"
1493 					  "exceeded", fname, state->lineno);
1494 					return 0;
1495 				}
1496 				/* skip spaces */
1497 				while(*incfile == ' ' || *incfile == '\t')
1498 					incfile++;
1499 				/* adjust for chroot on include file */
1500 				if(cfg->chrootdir && cfg->chrootdir[0] &&
1501 					strncmp(incfile, cfg->chrootdir,
1502 						strlen(cfg->chrootdir)) == 0)
1503 					incfile += strlen(cfg->chrootdir);
1504 				incfile = strdup(incfile);
1505 				if(!incfile) {
1506 					log_err("malloc failure");
1507 					return 0;
1508 				}
1509 				verbose(VERB_ALGO, "opening $INCLUDE %s",
1510 					incfile);
1511 				inc = fopen(incfile, "r");
1512 				if(!inc) {
1513 					log_err("%s:%d cannot open include "
1514 						"file %s: %s", fname,
1515 						lineno_orig, incfile,
1516 						strerror(errno));
1517 					free(incfile);
1518 					return 0;
1519 				}
1520 				/* recurse read that file now */
1521 				if(!az_parse_file(z, inc, rr, rrbuflen,
1522 					state, incfile, depth+1, cfg)) {
1523 					log_err("%s:%d cannot parse include "
1524 						"file %s", fname,
1525 						lineno_orig, incfile);
1526 					fclose(inc);
1527 					free(incfile);
1528 					return 0;
1529 				}
1530 				fclose(inc);
1531 				verbose(VERB_ALGO, "done with $INCLUDE %s",
1532 					incfile);
1533 				free(incfile);
1534 				state->lineno = lineno_orig;
1535 			}
1536 			continue;
1537 		}
1538 		if(status != 0) {
1539 			log_err("parse error %s %d:%d: %s", fname,
1540 				state->lineno, LDNS_WIREPARSE_OFFSET(status),
1541 				sldns_get_errorstr_parse(status));
1542 			return 0;
1543 		}
1544 		if(rr_len == 0) {
1545 			/* EMPTY line, TTL or ORIGIN */
1546 			continue;
1547 		}
1548 		/* insert wirerr in rrbuf */
1549 		if(!az_insert_rr(z, rr, rr_len, dname_len, NULL)) {
1550 			char buf[17];
1551 			sldns_wire2str_type_buf(sldns_wirerr_get_type(rr,
1552 				rr_len, dname_len), buf, sizeof(buf));
1553 			log_err("%s:%d cannot insert RR of type %s",
1554 				fname, state->lineno, buf);
1555 			return 0;
1556 		}
1557 	}
1558 	return 1;
1559 }
1560 
1561 int
1562 auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
1563 {
1564 	uint8_t rr[LDNS_RR_BUF_SIZE];
1565 	struct sldns_file_parse_state state;
1566 	char* zfilename;
1567 	FILE* in;
1568 	if(!z || !z->zonefile || z->zonefile[0]==0)
1569 		return 1; /* no file, or "", nothing to read */
1570 
1571 	zfilename = z->zonefile;
1572 	if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename,
1573 		cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
1574 		zfilename += strlen(cfg->chrootdir);
1575 	if(verbosity >= VERB_ALGO) {
1576 		char nm[255+1];
1577 		dname_str(z->name, nm);
1578 		verbose(VERB_ALGO, "read zonefile %s for %s", zfilename, nm);
1579 	}
1580 	in = fopen(zfilename, "r");
1581 	if(!in) {
1582 		char* n = sldns_wire2str_dname(z->name, z->namelen);
1583 		if(z->zone_is_slave && errno == ENOENT) {
1584 			/* we fetch the zone contents later, no file yet */
1585 			verbose(VERB_ALGO, "no zonefile %s for %s",
1586 				zfilename, n?n:"error");
1587 			free(n);
1588 			return 1;
1589 		}
1590 		log_err("cannot open zonefile %s for %s: %s",
1591 			zfilename, n?n:"error", strerror(errno));
1592 		free(n);
1593 		return 0;
1594 	}
1595 
1596 	/* clear the data tree */
1597 	traverse_postorder(&z->data, auth_data_del, NULL);
1598 	rbtree_init(&z->data, &auth_data_cmp);
1599 	/* clear the RPZ policies */
1600 	if(z->rpz)
1601 		rpz_clear(z->rpz);
1602 
1603 	memset(&state, 0, sizeof(state));
1604 	/* default TTL to 3600 */
1605 	state.default_ttl = 3600;
1606 	/* set $ORIGIN to the zone name */
1607 	if(z->namelen <= sizeof(state.origin)) {
1608 		memcpy(state.origin, z->name, z->namelen);
1609 		state.origin_len = z->namelen;
1610 	}
1611 	/* parse the (toplevel) file */
1612 	if(!az_parse_file(z, in, rr, sizeof(rr), &state, zfilename, 0, cfg)) {
1613 		char* n = sldns_wire2str_dname(z->name, z->namelen);
1614 		log_err("error parsing zonefile %s for %s",
1615 			zfilename, n?n:"error");
1616 		free(n);
1617 		fclose(in);
1618 		return 0;
1619 	}
1620 	fclose(in);
1621 
1622 	if(z->rpz)
1623 		rpz_finish_config(z->rpz);
1624 	return 1;
1625 }
1626 
1627 /** write buffer to file and check return codes */
1628 static int
1629 write_out(FILE* out, const char* str, size_t len)
1630 {
1631 	size_t r;
1632 	if(len == 0)
1633 		return 1;
1634 	r = fwrite(str, 1, len, out);
1635 	if(r == 0) {
1636 		log_err("write failed: %s", strerror(errno));
1637 		return 0;
1638 	} else if(r < len) {
1639 		log_err("write failed: too short (disk full?)");
1640 		return 0;
1641 	}
1642 	return 1;
1643 }
1644 
1645 /** convert auth rr to string */
1646 static int
1647 auth_rr_to_string(uint8_t* nm, size_t nmlen, uint16_t tp, uint16_t cl,
1648 	struct packed_rrset_data* data, size_t i, char* s, size_t buflen)
1649 {
1650 	int w = 0;
1651 	size_t slen = buflen, datlen;
1652 	uint8_t* dat;
1653 	if(i >= data->count) tp = LDNS_RR_TYPE_RRSIG;
1654 	dat = nm;
1655 	datlen = nmlen;
1656 	w += sldns_wire2str_dname_scan(&dat, &datlen, &s, &slen, NULL, 0, NULL);
1657 	w += sldns_str_print(&s, &slen, "\t");
1658 	w += sldns_str_print(&s, &slen, "%lu\t", (unsigned long)data->rr_ttl[i]);
1659 	w += sldns_wire2str_class_print(&s, &slen, cl);
1660 	w += sldns_str_print(&s, &slen, "\t");
1661 	w += sldns_wire2str_type_print(&s, &slen, tp);
1662 	w += sldns_str_print(&s, &slen, "\t");
1663 	datlen = data->rr_len[i]-2;
1664 	dat = data->rr_data[i]+2;
1665 	w += sldns_wire2str_rdata_scan(&dat, &datlen, &s, &slen, tp, NULL, 0, NULL);
1666 
1667 	if(tp == LDNS_RR_TYPE_DNSKEY) {
1668 		w += sldns_str_print(&s, &slen, " ;{id = %u}",
1669 			sldns_calc_keytag_raw(data->rr_data[i]+2,
1670 				data->rr_len[i]-2));
1671 	}
1672 	w += sldns_str_print(&s, &slen, "\n");
1673 
1674 	if(w >= (int)buflen) {
1675 		log_nametypeclass(NO_VERBOSE, "RR too long to print", nm, tp, cl);
1676 		return 0;
1677 	}
1678 	return 1;
1679 }
1680 
1681 /** write rrset to file */
1682 static int
1683 auth_zone_write_rrset(struct auth_zone* z, struct auth_data* node,
1684 	struct auth_rrset* r, FILE* out)
1685 {
1686 	size_t i, count = r->data->count + r->data->rrsig_count;
1687 	char buf[LDNS_RR_BUF_SIZE];
1688 	for(i=0; i<count; i++) {
1689 		if(!auth_rr_to_string(node->name, node->namelen, r->type,
1690 			z->dclass, r->data, i, buf, sizeof(buf))) {
1691 			verbose(VERB_ALGO, "failed to rr2str rr %d", (int)i);
1692 			continue;
1693 		}
1694 		if(!write_out(out, buf, strlen(buf)))
1695 			return 0;
1696 	}
1697 	return 1;
1698 }
1699 
1700 /** write domain to file */
1701 static int
1702 auth_zone_write_domain(struct auth_zone* z, struct auth_data* n, FILE* out)
1703 {
1704 	struct auth_rrset* r;
1705 	/* if this is zone apex, write SOA first */
1706 	if(z->namelen == n->namelen) {
1707 		struct auth_rrset* soa = az_domain_rrset(n, LDNS_RR_TYPE_SOA);
1708 		if(soa) {
1709 			if(!auth_zone_write_rrset(z, n, soa, out))
1710 				return 0;
1711 		}
1712 	}
1713 	/* write all the RRsets for this domain */
1714 	for(r = n->rrsets; r; r = r->next) {
1715 		if(z->namelen == n->namelen &&
1716 			r->type == LDNS_RR_TYPE_SOA)
1717 			continue; /* skip SOA here */
1718 		if(!auth_zone_write_rrset(z, n, r, out))
1719 			return 0;
1720 	}
1721 	return 1;
1722 }
1723 
1724 int auth_zone_write_file(struct auth_zone* z, const char* fname)
1725 {
1726 	FILE* out;
1727 	struct auth_data* n;
1728 	out = fopen(fname, "w");
1729 	if(!out) {
1730 		log_err("could not open %s: %s", fname, strerror(errno));
1731 		return 0;
1732 	}
1733 	RBTREE_FOR(n, struct auth_data*, &z->data) {
1734 		if(!auth_zone_write_domain(z, n, out)) {
1735 			log_err("could not write domain to %s", fname);
1736 			fclose(out);
1737 			return 0;
1738 		}
1739 	}
1740 	fclose(out);
1741 	return 1;
1742 }
1743 
1744 /** read all auth zones from file (if they have) */
1745 static int
1746 auth_zones_read_zones(struct auth_zones* az, struct config_file* cfg)
1747 {
1748 	struct auth_zone* z;
1749 	lock_rw_wrlock(&az->lock);
1750 	RBTREE_FOR(z, struct auth_zone*, &az->ztree) {
1751 		lock_rw_wrlock(&z->lock);
1752 		if(!auth_zone_read_zonefile(z, cfg)) {
1753 			lock_rw_unlock(&z->lock);
1754 			lock_rw_unlock(&az->lock);
1755 			return 0;
1756 		}
1757 		lock_rw_unlock(&z->lock);
1758 	}
1759 	lock_rw_unlock(&az->lock);
1760 	return 1;
1761 }
1762 
1763 /** find serial number of zone or false if none */
1764 int
1765 auth_zone_get_serial(struct auth_zone* z, uint32_t* serial)
1766 {
1767 	struct auth_data* apex;
1768 	struct auth_rrset* soa;
1769 	struct packed_rrset_data* d;
1770 	apex = az_find_name(z, z->name, z->namelen);
1771 	if(!apex) return 0;
1772 	soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA);
1773 	if(!soa || soa->data->count==0)
1774 		return 0; /* no RRset or no RRs in rrset */
1775 	if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */
1776 	d = soa->data;
1777 	*serial = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-20));
1778 	return 1;
1779 }
1780 
1781 /** Find auth_zone SOA and populate the values in xfr(soa values). */
1782 static int
1783 xfr_find_soa(struct auth_zone* z, struct auth_xfer* xfr)
1784 {
1785 	struct auth_data* apex;
1786 	struct auth_rrset* soa;
1787 	struct packed_rrset_data* d;
1788 	apex = az_find_name(z, z->name, z->namelen);
1789 	if(!apex) return 0;
1790 	soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA);
1791 	if(!soa || soa->data->count==0)
1792 		return 0; /* no RRset or no RRs in rrset */
1793 	if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */
1794 	/* SOA record ends with serial, refresh, retry, expiry, minimum,
1795 	 * as 4 byte fields */
1796 	d = soa->data;
1797 	xfr->have_zone = 1;
1798 	xfr->serial = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-20));
1799 	xfr->refresh = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-16));
1800 	xfr->retry = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-12));
1801 	xfr->expiry = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-8));
1802 	/* soa minimum at d->rr_len[0]-4 */
1803 	return 1;
1804 }
1805 
1806 /**
1807  * Setup auth_xfer zone
1808  * This populates the have_zone, soa values, and so on times.
1809  * Doesn't do network traffic yet, can set option flags.
1810  * @param z: locked by caller, and modified for setup
1811  * @param x: locked by caller, and modified.
1812  * @return false on failure.
1813  */
1814 static int
1815 auth_xfer_setup(struct auth_zone* z, struct auth_xfer* x)
1816 {
1817 	/* for a zone without zone transfers, x==NULL, so skip them,
1818 	 * i.e. the zone config is fixed with no masters or urls */
1819 	if(!z || !x) return 1;
1820 	if(!xfr_find_soa(z, x)) {
1821 		return 1;
1822 	}
1823 	/* nothing for probe, nextprobe and transfer tasks */
1824 	return 1;
1825 }
1826 
1827 /**
1828  * Setup all zones
1829  * @param az: auth zones structure
1830  * @return false on failure.
1831  */
1832 static int
1833 auth_zones_setup_zones(struct auth_zones* az)
1834 {
1835 	struct auth_zone* z;
1836 	struct auth_xfer* x;
1837 	lock_rw_wrlock(&az->lock);
1838 	RBTREE_FOR(z, struct auth_zone*, &az->ztree) {
1839 		lock_rw_wrlock(&z->lock);
1840 		x = auth_xfer_find(az, z->name, z->namelen, z->dclass);
1841 		if(x) {
1842 			lock_basic_lock(&x->lock);
1843 		}
1844 		if(!auth_xfer_setup(z, x)) {
1845 			if(x) {
1846 				lock_basic_unlock(&x->lock);
1847 			}
1848 			lock_rw_unlock(&z->lock);
1849 			lock_rw_unlock(&az->lock);
1850 			return 0;
1851 		}
1852 		if(x) {
1853 			lock_basic_unlock(&x->lock);
1854 		}
1855 		lock_rw_unlock(&z->lock);
1856 	}
1857 	lock_rw_unlock(&az->lock);
1858 	return 1;
1859 }
1860 
1861 /** set config items and create zones */
1862 static int
1863 auth_zones_cfg(struct auth_zones* az, struct config_auth* c)
1864 {
1865 	struct auth_zone* z;
1866 	struct auth_xfer* x = NULL;
1867 
1868 	/* create zone */
1869 	if(c->isrpz) {
1870 		/* if the rpz lock is needed, grab it before the other
1871 		 * locks to avoid a lock dependency cycle */
1872 		lock_rw_wrlock(&az->rpz_lock);
1873 	}
1874 	lock_rw_wrlock(&az->lock);
1875 	if(!(z=auth_zones_find_or_add_zone(az, c->name))) {
1876 		lock_rw_unlock(&az->lock);
1877 		if(c->isrpz) {
1878 			lock_rw_unlock(&az->rpz_lock);
1879 		}
1880 		return 0;
1881 	}
1882 	if(c->masters || c->urls) {
1883 		if(!(x=auth_zones_find_or_add_xfer(az, z))) {
1884 			lock_rw_unlock(&az->lock);
1885 			lock_rw_unlock(&z->lock);
1886 			if(c->isrpz) {
1887 				lock_rw_unlock(&az->rpz_lock);
1888 			}
1889 			return 0;
1890 		}
1891 	}
1892 	if(c->for_downstream)
1893 		az->have_downstream = 1;
1894 	lock_rw_unlock(&az->lock);
1895 
1896 	/* set options */
1897 	z->zone_deleted = 0;
1898 	if(!auth_zone_set_zonefile(z, c->zonefile)) {
1899 		if(x) {
1900 			lock_basic_unlock(&x->lock);
1901 		}
1902 		lock_rw_unlock(&z->lock);
1903 		if(c->isrpz) {
1904 			lock_rw_unlock(&az->rpz_lock);
1905 		}
1906 		return 0;
1907 	}
1908 	z->for_downstream = c->for_downstream;
1909 	z->for_upstream = c->for_upstream;
1910 	z->fallback_enabled = c->fallback_enabled;
1911 	if(c->isrpz && !z->rpz){
1912 		if(!(z->rpz = rpz_create(c))){
1913 			fatal_exit("Could not setup RPZ zones");
1914 			return 0;
1915 		}
1916 		lock_protect(&z->lock, &z->rpz->local_zones, sizeof(*z->rpz));
1917 		/* the az->rpz_lock is locked above */
1918 		z->rpz_az_next = az->rpz_first;
1919 		if(az->rpz_first)
1920 			az->rpz_first->rpz_az_prev = z;
1921 		az->rpz_first = z;
1922 	}
1923 	if(c->isrpz) {
1924 		lock_rw_unlock(&az->rpz_lock);
1925 	}
1926 
1927 	/* xfer zone */
1928 	if(x) {
1929 		z->zone_is_slave = 1;
1930 		/* set options on xfer zone */
1931 		if(!xfer_set_masters(&x->task_probe->masters, c, 0)) {
1932 			lock_basic_unlock(&x->lock);
1933 			lock_rw_unlock(&z->lock);
1934 			return 0;
1935 		}
1936 		if(!xfer_set_masters(&x->task_transfer->masters, c, 1)) {
1937 			lock_basic_unlock(&x->lock);
1938 			lock_rw_unlock(&z->lock);
1939 			return 0;
1940 		}
1941 		lock_basic_unlock(&x->lock);
1942 	}
1943 
1944 	lock_rw_unlock(&z->lock);
1945 	return 1;
1946 }
1947 
1948 /** set all auth zones deleted, then in auth_zones_cfg, it marks them
1949  * as nondeleted (if they are still in the config), and then later
1950  * we can find deleted zones */
1951 static void
1952 az_setall_deleted(struct auth_zones* az)
1953 {
1954 	struct auth_zone* z;
1955 	lock_rw_wrlock(&az->lock);
1956 	RBTREE_FOR(z, struct auth_zone*, &az->ztree) {
1957 		lock_rw_wrlock(&z->lock);
1958 		z->zone_deleted = 1;
1959 		lock_rw_unlock(&z->lock);
1960 	}
1961 	lock_rw_unlock(&az->lock);
1962 }
1963 
1964 /** find zones that are marked deleted and delete them.
1965  * This is called from apply_cfg, and there are no threads and no
1966  * workers, so the xfr can just be deleted. */
1967 static void
1968 az_delete_deleted_zones(struct auth_zones* az)
1969 {
1970 	struct auth_zone* z;
1971 	struct auth_zone* delete_list = NULL, *next;
1972 	struct auth_xfer* xfr;
1973 	lock_rw_wrlock(&az->lock);
1974 	RBTREE_FOR(z, struct auth_zone*, &az->ztree) {
1975 		lock_rw_wrlock(&z->lock);
1976 		if(z->zone_deleted) {
1977 			/* we cannot alter the rbtree right now, but
1978 			 * we can put it on a linked list and then
1979 			 * delete it */
1980 			z->delete_next = delete_list;
1981 			delete_list = z;
1982 		}
1983 		lock_rw_unlock(&z->lock);
1984 	}
1985 	/* now we are out of the tree loop and we can loop and delete
1986 	 * the zones */
1987 	z = delete_list;
1988 	while(z) {
1989 		next = z->delete_next;
1990 		xfr = auth_xfer_find(az, z->name, z->namelen, z->dclass);
1991 		if(xfr) {
1992 			(void)rbtree_delete(&az->xtree, &xfr->node);
1993 			auth_xfer_delete(xfr);
1994 		}
1995 		(void)rbtree_delete(&az->ztree, &z->node);
1996 		auth_zone_delete(z, az);
1997 		z = next;
1998 	}
1999 	lock_rw_unlock(&az->lock);
2000 }
2001 
2002 int auth_zones_apply_cfg(struct auth_zones* az, struct config_file* cfg,
2003 	int setup, int* is_rpz)
2004 {
2005 	struct config_auth* p;
2006 	az_setall_deleted(az);
2007 	for(p = cfg->auths; p; p = p->next) {
2008 		if(!p->name || p->name[0] == 0) {
2009 			log_warn("auth-zone without a name, skipped");
2010 			continue;
2011 		}
2012 		*is_rpz = (*is_rpz || p->isrpz);
2013 		if(!auth_zones_cfg(az, p)) {
2014 			log_err("cannot config auth zone %s", p->name);
2015 			return 0;
2016 		}
2017 	}
2018 	az_delete_deleted_zones(az);
2019 	if(!auth_zones_read_zones(az, cfg))
2020 		return 0;
2021 	if(setup) {
2022 		if(!auth_zones_setup_zones(az))
2023 			return 0;
2024 	}
2025 	return 1;
2026 }
2027 
2028 /** delete chunks
2029  * @param at: transfer structure with chunks list.  The chunks and their
2030  * 	data are freed.
2031  */
2032 static void
2033 auth_chunks_delete(struct auth_transfer* at)
2034 {
2035 	if(at->chunks_first) {
2036 		struct auth_chunk* c, *cn;
2037 		c = at->chunks_first;
2038 		while(c) {
2039 			cn = c->next;
2040 			free(c->data);
2041 			free(c);
2042 			c = cn;
2043 		}
2044 	}
2045 	at->chunks_first = NULL;
2046 	at->chunks_last = NULL;
2047 }
2048 
2049 /** free master addr list */
2050 static void
2051 auth_free_master_addrs(struct auth_addr* list)
2052 {
2053 	struct auth_addr *n;
2054 	while(list) {
2055 		n = list->next;
2056 		free(list);
2057 		list = n;
2058 	}
2059 }
2060 
2061 /** free the masters list */
2062 static void
2063 auth_free_masters(struct auth_master* list)
2064 {
2065 	struct auth_master* n;
2066 	while(list) {
2067 		n = list->next;
2068 		auth_free_master_addrs(list->list);
2069 		free(list->host);
2070 		free(list->file);
2071 		free(list);
2072 		list = n;
2073 	}
2074 }
2075 
2076 /** delete auth xfer structure
2077  * @param xfr: delete this xfer and its tasks.
2078  */
2079 static void
2080 auth_xfer_delete(struct auth_xfer* xfr)
2081 {
2082 	if(!xfr) return;
2083 	lock_basic_destroy(&xfr->lock);
2084 	free(xfr->name);
2085 	if(xfr->task_nextprobe) {
2086 		comm_timer_delete(xfr->task_nextprobe->timer);
2087 		free(xfr->task_nextprobe);
2088 	}
2089 	if(xfr->task_probe) {
2090 		auth_free_masters(xfr->task_probe->masters);
2091 		comm_point_delete(xfr->task_probe->cp);
2092 		comm_timer_delete(xfr->task_probe->timer);
2093 		free(xfr->task_probe);
2094 	}
2095 	if(xfr->task_transfer) {
2096 		auth_free_masters(xfr->task_transfer->masters);
2097 		comm_point_delete(xfr->task_transfer->cp);
2098 		comm_timer_delete(xfr->task_transfer->timer);
2099 		if(xfr->task_transfer->chunks_first) {
2100 			auth_chunks_delete(xfr->task_transfer);
2101 		}
2102 		free(xfr->task_transfer);
2103 	}
2104 	auth_free_masters(xfr->allow_notify_list);
2105 	free(xfr);
2106 }
2107 
2108 /** helper traverse to delete zones */
2109 static void
2110 auth_zone_del(rbnode_type* n, void* ATTR_UNUSED(arg))
2111 {
2112 	struct auth_zone* z = (struct auth_zone*)n->key;
2113 	auth_zone_delete(z, NULL);
2114 }
2115 
2116 /** helper traverse to delete xfer zones */
2117 static void
2118 auth_xfer_del(rbnode_type* n, void* ATTR_UNUSED(arg))
2119 {
2120 	struct auth_xfer* z = (struct auth_xfer*)n->key;
2121 	auth_xfer_delete(z);
2122 }
2123 
2124 void auth_zones_delete(struct auth_zones* az)
2125 {
2126 	if(!az) return;
2127 	lock_rw_destroy(&az->lock);
2128 	lock_rw_destroy(&az->rpz_lock);
2129 	traverse_postorder(&az->ztree, auth_zone_del, NULL);
2130 	traverse_postorder(&az->xtree, auth_xfer_del, NULL);
2131 	free(az);
2132 }
2133 
2134 /** true if domain has only nsec3 */
2135 static int
2136 domain_has_only_nsec3(struct auth_data* n)
2137 {
2138 	struct auth_rrset* rrset = n->rrsets;
2139 	int nsec3_seen = 0;
2140 	while(rrset) {
2141 		if(rrset->type == LDNS_RR_TYPE_NSEC3) {
2142 			nsec3_seen = 1;
2143 		} else if(rrset->type != LDNS_RR_TYPE_RRSIG) {
2144 			return 0;
2145 		}
2146 		rrset = rrset->next;
2147 	}
2148 	return nsec3_seen;
2149 }
2150 
2151 /** see if the domain has a wildcard child '*.domain' */
2152 static struct auth_data*
2153 az_find_wildcard_domain(struct auth_zone* z, uint8_t* nm, size_t nmlen)
2154 {
2155 	uint8_t wc[LDNS_MAX_DOMAINLEN];
2156 	if(nmlen+2 > sizeof(wc))
2157 		return NULL; /* result would be too long */
2158 	wc[0] = 1; /* length of wildcard label */
2159 	wc[1] = (uint8_t)'*'; /* wildcard label */
2160 	memmove(wc+2, nm, nmlen);
2161 	return az_find_name(z, wc, nmlen+2);
2162 }
2163 
2164 /** find wildcard between qname and cename */
2165 static struct auth_data*
2166 az_find_wildcard(struct auth_zone* z, struct query_info* qinfo,
2167 	struct auth_data* ce)
2168 {
2169 	uint8_t* nm = qinfo->qname;
2170 	size_t nmlen = qinfo->qname_len;
2171 	struct auth_data* node;
2172 	if(!dname_subdomain_c(nm, z->name))
2173 		return NULL; /* out of zone */
2174 	while((node=az_find_wildcard_domain(z, nm, nmlen))==NULL) {
2175 		/* see if we can go up to find the wildcard */
2176 		if(nmlen == z->namelen)
2177 			return NULL; /* top of zone reached */
2178 		if(ce && nmlen == ce->namelen)
2179 			return NULL; /* ce reached */
2180 		if(dname_is_root(nm))
2181 			return NULL; /* cannot go up */
2182 		dname_remove_label(&nm, &nmlen);
2183 	}
2184 	return node;
2185 }
2186 
2187 /** domain is not exact, find first candidate ce (name that matches
2188  * a part of qname) in tree */
2189 static struct auth_data*
2190 az_find_candidate_ce(struct auth_zone* z, struct query_info* qinfo,
2191 	struct auth_data* n)
2192 {
2193 	uint8_t* nm;
2194 	size_t nmlen;
2195 	if(n) {
2196 		nm = dname_get_shared_topdomain(qinfo->qname, n->name);
2197 	} else {
2198 		nm = qinfo->qname;
2199 	}
2200 	dname_count_size_labels(nm, &nmlen);
2201 	n = az_find_name(z, nm, nmlen);
2202 	/* delete labels and go up on name */
2203 	while(!n) {
2204 		if(dname_is_root(nm))
2205 			return NULL; /* cannot go up */
2206 		dname_remove_label(&nm, &nmlen);
2207 		n = az_find_name(z, nm, nmlen);
2208 	}
2209 	return n;
2210 }
2211 
2212 /** go up the auth tree to next existing name. */
2213 static struct auth_data*
2214 az_domain_go_up(struct auth_zone* z, struct auth_data* n)
2215 {
2216 	uint8_t* nm = n->name;
2217 	size_t nmlen = n->namelen;
2218 	while(!dname_is_root(nm)) {
2219 		dname_remove_label(&nm, &nmlen);
2220 		if((n=az_find_name(z, nm, nmlen)) != NULL)
2221 			return n;
2222 	}
2223 	return NULL;
2224 }
2225 
2226 /** Find the closest encloser, an name that exists and is above the
2227  * qname.
2228  * return true if the node (param node) is existing, nonobscured and
2229  * 	can be used to generate answers from.  It is then also node_exact.
2230  * returns false if the node is not good enough (or it wasn't node_exact)
2231  *	in this case the ce can be filled.
2232  *	if ce is NULL, no ce exists, and likely the zone is completely empty,
2233  *	not even with a zone apex.
2234  *	if ce is nonNULL it is the closest enclosing upper name (that exists
2235  *	itself for answer purposes).  That name may have DNAME, NS or wildcard
2236  *	rrset is the closest DNAME or NS rrset that was found.
2237  */
2238 static int
2239 az_find_ce(struct auth_zone* z, struct query_info* qinfo,
2240 	struct auth_data* node, int node_exact, struct auth_data** ce,
2241 	struct auth_rrset** rrset)
2242 {
2243 	struct auth_data* n = node;
2244 	*ce = NULL;
2245 	*rrset = NULL;
2246 	if(!node_exact) {
2247 		/* if not exact, lookup closest exact match */
2248 		n = az_find_candidate_ce(z, qinfo, n);
2249 	} else {
2250 		/* if exact, the node itself is the first candidate ce */
2251 		*ce = n;
2252 	}
2253 
2254 	/* no direct answer from nsec3-only domains */
2255 	if(n && domain_has_only_nsec3(n)) {
2256 		node_exact = 0;
2257 		*ce = NULL;
2258 	}
2259 
2260 	/* with exact matches, walk up the labels until we find the
2261 	 * delegation, or DNAME or zone end */
2262 	while(n) {
2263 		/* see if the current candidate has issues */
2264 		/* not zone apex and has type NS */
2265 		if(n->namelen != z->namelen &&
2266 			(*rrset=az_domain_rrset(n, LDNS_RR_TYPE_NS)) &&
2267 			/* delegate here, but DS at exact the dp has notype */
2268 			(qinfo->qtype != LDNS_RR_TYPE_DS ||
2269 			n->namelen != qinfo->qname_len)) {
2270 			/* referral */
2271 			/* this is ce and the lowernode is nonexisting */
2272 			*ce = n;
2273 			return 0;
2274 		}
2275 		/* not equal to qname and has type DNAME */
2276 		if(n->namelen != qinfo->qname_len &&
2277 			(*rrset=az_domain_rrset(n, LDNS_RR_TYPE_DNAME))) {
2278 			/* this is ce and the lowernode is nonexisting */
2279 			*ce = n;
2280 			return 0;
2281 		}
2282 
2283 		if(*ce == NULL && !domain_has_only_nsec3(n)) {
2284 			/* if not found yet, this exact name must be
2285 			 * our lowest match (but not nsec3onlydomain) */
2286 			*ce = n;
2287 		}
2288 
2289 		/* walk up the tree by removing labels from name and lookup */
2290 		n = az_domain_go_up(z, n);
2291 	}
2292 	/* found no problems, if it was an exact node, it is fine to use */
2293 	return node_exact;
2294 }
2295 
2296 /** add additional A/AAAA from domain names in rrset rdata (+offset)
2297  * offset is number of bytes in rdata where the dname is located. */
2298 static int
2299 az_add_additionals_from(struct auth_zone* z, struct regional* region,
2300 	struct dns_msg* msg, struct auth_rrset* rrset, size_t offset)
2301 {
2302 	struct packed_rrset_data* d = rrset->data;
2303 	size_t i;
2304 	if(!d) return 0;
2305 	for(i=0; i<d->count; i++) {
2306 		size_t dlen;
2307 		struct auth_data* domain;
2308 		struct auth_rrset* ref;
2309 		if(d->rr_len[i] < 2+offset)
2310 			continue; /* too short */
2311 		if(!(dlen = dname_valid(d->rr_data[i]+2+offset,
2312 			d->rr_len[i]-2-offset)))
2313 			continue; /* malformed */
2314 		domain = az_find_name(z, d->rr_data[i]+2+offset, dlen);
2315 		if(!domain)
2316 			continue;
2317 		if((ref=az_domain_rrset(domain, LDNS_RR_TYPE_A)) != NULL) {
2318 			if(!msg_add_rrset_ar(z, region, msg, domain, ref))
2319 				return 0;
2320 		}
2321 		if((ref=az_domain_rrset(domain, LDNS_RR_TYPE_AAAA)) != NULL) {
2322 			if(!msg_add_rrset_ar(z, region, msg, domain, ref))
2323 				return 0;
2324 		}
2325 	}
2326 	return 1;
2327 }
2328 
2329 /** add negative SOA record (with negative TTL) */
2330 static int
2331 az_add_negative_soa(struct auth_zone* z, struct regional* region,
2332 	struct dns_msg* msg)
2333 {
2334 	time_t minimum;
2335 	size_t i;
2336 	struct packed_rrset_data* d;
2337 	struct auth_rrset* soa;
2338 	struct auth_data* apex = az_find_name(z, z->name, z->namelen);
2339 	if(!apex) return 0;
2340 	soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA);
2341 	if(!soa) return 0;
2342 	/* must be first to put in message; we want to fix the TTL with
2343 	 * one RRset here, otherwise we'd need to loop over the RRs to get
2344 	 * the resulting lower TTL */
2345 	log_assert(msg->rep->rrset_count == 0);
2346 	if(!msg_add_rrset_ns(z, region, msg, apex, soa)) return 0;
2347 	/* fixup TTL */
2348 	d = (struct packed_rrset_data*)msg->rep->rrsets[msg->rep->rrset_count-1]->entry.data;
2349 	/* last 4 bytes are minimum ttl in network format */
2350 	if(d->count == 0) return 0;
2351 	if(d->rr_len[0] < 2+4) return 0;
2352 	minimum = (time_t)sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-4));
2353 	minimum = d->ttl<minimum?d->ttl:minimum;
2354 	d->ttl = minimum;
2355 	for(i=0; i < d->count + d->rrsig_count; i++)
2356 		d->rr_ttl[i] = minimum;
2357 	msg->rep->ttl = get_rrset_ttl(msg->rep->rrsets[0]);
2358 	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
2359 	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
2360 	return 1;
2361 }
2362 
2363 /** See if the query goes to empty nonterminal (that has no auth_data,
2364  * but there are nodes underneath.  We already checked that there are
2365  * not NS, or DNAME above, so that we only need to check if some node
2366  * exists below (with nonempty rr list), return true if emptynonterminal */
2367 static int
2368 az_empty_nonterminal(struct auth_zone* z, struct query_info* qinfo,
2369 	struct auth_data* node)
2370 {
2371 	struct auth_data* next;
2372 	if(!node) {
2373 		/* no smaller was found, use first (smallest) node as the
2374 		 * next one */
2375 		next = (struct auth_data*)rbtree_first(&z->data);
2376 	} else {
2377 		next = (struct auth_data*)rbtree_next(&node->node);
2378 	}
2379 	while(next && (rbnode_type*)next != RBTREE_NULL && next->rrsets == NULL) {
2380 		/* the next name has empty rrsets, is an empty nonterminal
2381 		 * itself, see if there exists something below it */
2382 		next = (struct auth_data*)rbtree_next(&node->node);
2383 	}
2384 	if((rbnode_type*)next == RBTREE_NULL || !next) {
2385 		/* there is no next node, so something below it cannot
2386 		 * exist */
2387 		return 0;
2388 	}
2389 	/* a next node exists, if there was something below the query,
2390 	 * this node has to be it.  See if it is below the query name */
2391 	if(dname_strict_subdomain_c(next->name, qinfo->qname))
2392 		return 1;
2393 	return 0;
2394 }
2395 
2396 /** create synth cname target name in buffer, or fail if too long */
2397 static size_t
2398 synth_cname_buf(uint8_t* qname, size_t qname_len, size_t dname_len,
2399 	uint8_t* dtarg, size_t dtarglen, uint8_t* buf, size_t buflen)
2400 {
2401 	size_t newlen = qname_len + dtarglen - dname_len;
2402 	if(newlen > buflen) {
2403 		/* YXDOMAIN error */
2404 		return 0;
2405 	}
2406 	/* new name is concatenation of qname front (without DNAME owner)
2407 	 * and DNAME target name */
2408 	memcpy(buf, qname, qname_len-dname_len);
2409 	memmove(buf+(qname_len-dname_len), dtarg, dtarglen);
2410 	return newlen;
2411 }
2412 
2413 /** create synthetic CNAME rrset for in a DNAME answer in region,
2414  * false on alloc failure, cname==NULL when name too long. */
2415 static int
2416 create_synth_cname(uint8_t* qname, size_t qname_len, struct regional* region,
2417 	struct auth_data* node, struct auth_rrset* dname, uint16_t dclass,
2418 	struct ub_packed_rrset_key** cname)
2419 {
2420 	uint8_t buf[LDNS_MAX_DOMAINLEN];
2421 	uint8_t* dtarg;
2422 	size_t dtarglen, newlen;
2423 	struct packed_rrset_data* d;
2424 
2425 	/* get DNAME target name */
2426 	if(dname->data->count < 1) return 0;
2427 	if(dname->data->rr_len[0] < 3) return 0; /* at least rdatalen +1 */
2428 	dtarg = dname->data->rr_data[0]+2;
2429 	dtarglen = dname->data->rr_len[0]-2;
2430 	if(sldns_read_uint16(dname->data->rr_data[0]) != dtarglen)
2431 		return 0; /* rdatalen in DNAME rdata is malformed */
2432 	if(dname_valid(dtarg, dtarglen) != dtarglen)
2433 		return 0; /* DNAME RR has malformed rdata */
2434 	if(qname_len == 0)
2435 		return 0; /* too short */
2436 	if(qname_len <= node->namelen)
2437 		return 0; /* qname too short for dname removal */
2438 
2439 	/* synthesize a CNAME */
2440 	newlen = synth_cname_buf(qname, qname_len, node->namelen,
2441 		dtarg, dtarglen, buf, sizeof(buf));
2442 	if(newlen == 0) {
2443 		/* YXDOMAIN error */
2444 		*cname = NULL;
2445 		return 1;
2446 	}
2447 	*cname = (struct ub_packed_rrset_key*)regional_alloc(region,
2448 		sizeof(struct ub_packed_rrset_key));
2449 	if(!*cname)
2450 		return 0; /* out of memory */
2451 	memset(&(*cname)->entry, 0, sizeof((*cname)->entry));
2452 	(*cname)->entry.key = (*cname);
2453 	(*cname)->rk.type = htons(LDNS_RR_TYPE_CNAME);
2454 	(*cname)->rk.rrset_class = htons(dclass);
2455 	(*cname)->rk.flags = 0;
2456 	(*cname)->rk.dname = regional_alloc_init(region, qname, qname_len);
2457 	if(!(*cname)->rk.dname)
2458 		return 0; /* out of memory */
2459 	(*cname)->rk.dname_len = qname_len;
2460 	(*cname)->entry.hash = rrset_key_hash(&(*cname)->rk);
2461 	d = (struct packed_rrset_data*)regional_alloc_zero(region,
2462 		sizeof(struct packed_rrset_data) + sizeof(size_t) +
2463 		sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)
2464 		+ newlen);
2465 	if(!d)
2466 		return 0; /* out of memory */
2467 	(*cname)->entry.data = d;
2468 	d->ttl = 0; /* 0 for synthesized CNAME TTL */
2469 	d->count = 1;
2470 	d->rrsig_count = 0;
2471 	d->trust = rrset_trust_ans_noAA;
2472 	d->rr_len = (size_t*)((uint8_t*)d +
2473 		sizeof(struct packed_rrset_data));
2474 	d->rr_len[0] = newlen + sizeof(uint16_t);
2475 	packed_rrset_ptr_fixup(d);
2476 	d->rr_ttl[0] = d->ttl;
2477 	sldns_write_uint16(d->rr_data[0], newlen);
2478 	memmove(d->rr_data[0] + sizeof(uint16_t), buf, newlen);
2479 	return 1;
2480 }
2481 
2482 /** add a synthesized CNAME to the answer section */
2483 static int
2484 add_synth_cname(struct auth_zone* z, uint8_t* qname, size_t qname_len,
2485 	struct regional* region, struct dns_msg* msg, struct auth_data* dname,
2486 	struct auth_rrset* rrset)
2487 {
2488 	struct ub_packed_rrset_key* cname;
2489 	/* synthesize a CNAME */
2490 	if(!create_synth_cname(qname, qname_len, region, dname, rrset,
2491 		z->dclass, &cname)) {
2492 		/* out of memory */
2493 		return 0;
2494 	}
2495 	if(!cname) {
2496 		/* cname cannot be create because of YXDOMAIN */
2497 		msg->rep->flags |= LDNS_RCODE_YXDOMAIN;
2498 		return 1;
2499 	}
2500 	/* add cname to message */
2501 	if(!msg_grow_array(region, msg))
2502 		return 0;
2503 	msg->rep->rrsets[msg->rep->rrset_count] = cname;
2504 	msg->rep->rrset_count++;
2505 	msg->rep->an_numrrsets++;
2506 	msg_ttl(msg);
2507 	return 1;
2508 }
2509 
2510 /** Change a dname to a different one, for wildcard namechange */
2511 static void
2512 az_change_dnames(struct dns_msg* msg, uint8_t* oldname, uint8_t* newname,
2513 	size_t newlen, int an_only)
2514 {
2515 	size_t i;
2516 	size_t start = 0, end = msg->rep->rrset_count;
2517 	if(!an_only) start = msg->rep->an_numrrsets;
2518 	if(an_only) end = msg->rep->an_numrrsets;
2519 	for(i=start; i<end; i++) {
2520 		/* allocated in region so we can change the ptrs */
2521 		if(query_dname_compare(msg->rep->rrsets[i]->rk.dname, oldname)
2522 			== 0) {
2523 			msg->rep->rrsets[i]->rk.dname = newname;
2524 			msg->rep->rrsets[i]->rk.dname_len = newlen;
2525 		}
2526 	}
2527 }
2528 
2529 /** find NSEC record covering the query */
2530 static struct auth_rrset*
2531 az_find_nsec_cover(struct auth_zone* z, struct auth_data** node)
2532 {
2533 	uint8_t* nm = (*node)->name;
2534 	size_t nmlen = (*node)->namelen;
2535 	struct auth_rrset* rrset;
2536 	/* find the NSEC for the smallest-or-equal node */
2537 	/* if node == NULL, we did not find a smaller name.  But the zone
2538 	 * name is the smallest name and should have an NSEC. So there is
2539 	 * no NSEC to return (for a properly signed zone) */
2540 	/* for empty nonterminals, the auth-data node should not exist,
2541 	 * and thus we don't need to go rbtree_previous here to find
2542 	 * a domain with an NSEC record */
2543 	/* but there could be glue, and if this is node, then it has no NSEC.
2544 	 * Go up to find nonglue (previous) NSEC-holding nodes */
2545 	while((rrset=az_domain_rrset(*node, LDNS_RR_TYPE_NSEC)) == NULL) {
2546 		if(dname_is_root(nm)) return NULL;
2547 		if(nmlen == z->namelen) return NULL;
2548 		dname_remove_label(&nm, &nmlen);
2549 		/* adjust *node for the nsec rrset to find in */
2550 		*node = az_find_name(z, nm, nmlen);
2551 	}
2552 	return rrset;
2553 }
2554 
2555 /** Find NSEC and add for wildcard denial */
2556 static int
2557 az_nsec_wildcard_denial(struct auth_zone* z, struct regional* region,
2558 	struct dns_msg* msg, uint8_t* cenm, size_t cenmlen)
2559 {
2560 	struct query_info qinfo;
2561 	int node_exact;
2562 	struct auth_data* node;
2563 	struct auth_rrset* nsec;
2564 	uint8_t wc[LDNS_MAX_DOMAINLEN];
2565 	if(cenmlen+2 > sizeof(wc))
2566 		return 0; /* result would be too long */
2567 	wc[0] = 1; /* length of wildcard label */
2568 	wc[1] = (uint8_t)'*'; /* wildcard label */
2569 	memmove(wc+2, cenm, cenmlen);
2570 
2571 	/* we have '*.ce' in wc wildcard name buffer */
2572 	/* get nsec cover for that */
2573 	qinfo.qname = wc;
2574 	qinfo.qname_len = cenmlen+2;
2575 	qinfo.qtype = 0;
2576 	qinfo.qclass = 0;
2577 	az_find_domain(z, &qinfo, &node_exact, &node);
2578 	if((nsec=az_find_nsec_cover(z, &node)) != NULL) {
2579 		if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0;
2580 	}
2581 	return 1;
2582 }
2583 
2584 /** Find the NSEC3PARAM rrset (if any) and if true you have the parameters */
2585 static int
2586 az_nsec3_param(struct auth_zone* z, int* algo, size_t* iter, uint8_t** salt,
2587 	size_t* saltlen)
2588 {
2589 	struct auth_data* apex;
2590 	struct auth_rrset* param;
2591 	size_t i;
2592 	apex = az_find_name(z, z->name, z->namelen);
2593 	if(!apex) return 0;
2594 	param = az_domain_rrset(apex, LDNS_RR_TYPE_NSEC3PARAM);
2595 	if(!param || param->data->count==0)
2596 		return 0; /* no RRset or no RRs in rrset */
2597 	/* find out which NSEC3PARAM RR has supported parameters */
2598 	/* skip unknown flags (dynamic signer is recalculating nsec3 chain) */
2599 	for(i=0; i<param->data->count; i++) {
2600 		uint8_t* rdata = param->data->rr_data[i]+2;
2601 		size_t rdatalen = param->data->rr_len[i];
2602 		if(rdatalen < 2+5)
2603 			continue; /* too short */
2604 		if(!nsec3_hash_algo_size_supported((int)(rdata[0])))
2605 			continue; /* unsupported algo */
2606 		if(rdatalen < (size_t)(2+5+(size_t)rdata[4]))
2607 			continue; /* salt missing */
2608 		if((rdata[1]&NSEC3_UNKNOWN_FLAGS)!=0)
2609 			continue; /* unknown flags */
2610 		*algo = (int)(rdata[0]);
2611 		*iter = sldns_read_uint16(rdata+2);
2612 		*saltlen = rdata[4];
2613 		if(*saltlen == 0)
2614 			*salt = NULL;
2615 		else	*salt = rdata+5;
2616 		return 1;
2617 	}
2618 	/* no supported params */
2619 	return 0;
2620 }
2621 
2622 /** Hash a name with nsec3param into buffer, it has zone name appended.
2623  * return length of hash */
2624 static size_t
2625 az_nsec3_hash(uint8_t* buf, size_t buflen, uint8_t* nm, size_t nmlen,
2626 	int algo, size_t iter, uint8_t* salt, size_t saltlen)
2627 {
2628 	size_t hlen = nsec3_hash_algo_size_supported(algo);
2629 	/* buffer has domain name, nsec3hash, and 256 is for max saltlen
2630 	 * (salt has 0-255 length) */
2631 	unsigned char p[LDNS_MAX_DOMAINLEN+1+N3HASHBUFLEN+256];
2632 	size_t i;
2633 	if(nmlen+saltlen > sizeof(p) || hlen+saltlen > sizeof(p))
2634 		return 0;
2635 	if(hlen > buflen)
2636 		return 0; /* somehow too large for destination buffer */
2637 	/* hashfunc(name, salt) */
2638 	memmove(p, nm, nmlen);
2639 	query_dname_tolower(p);
2640 	if(salt && saltlen > 0)
2641 		memmove(p+nmlen, salt, saltlen);
2642 	(void)secalgo_nsec3_hash(algo, p, nmlen+saltlen, (unsigned char*)buf);
2643 	for(i=0; i<iter; i++) {
2644 		/* hashfunc(hash, salt) */
2645 		memmove(p, buf, hlen);
2646 		if(salt && saltlen > 0)
2647 			memmove(p+hlen, salt, saltlen);
2648 		(void)secalgo_nsec3_hash(algo, p, hlen+saltlen,
2649 			(unsigned char*)buf);
2650 	}
2651 	return hlen;
2652 }
2653 
2654 /** Hash name and return b32encoded hashname for lookup, zone name appended */
2655 static int
2656 az_nsec3_hashname(struct auth_zone* z, uint8_t* hashname, size_t* hashnmlen,
2657 	uint8_t* nm, size_t nmlen, int algo, size_t iter, uint8_t* salt,
2658 	size_t saltlen)
2659 {
2660 	uint8_t hash[N3HASHBUFLEN];
2661 	size_t hlen;
2662 	int ret;
2663 	hlen = az_nsec3_hash(hash, sizeof(hash), nm, nmlen, algo, iter,
2664 		salt, saltlen);
2665 	if(!hlen) return 0;
2666 	/* b32 encode */
2667 	if(*hashnmlen < hlen*2+1+z->namelen) /* approx b32 as hexb16 */
2668 		return 0;
2669 	ret = sldns_b32_ntop_extended_hex(hash, hlen, (char*)(hashname+1),
2670 		(*hashnmlen)-1);
2671 	if(ret<1)
2672 		return 0;
2673 	hashname[0] = (uint8_t)ret;
2674 	ret++;
2675 	if((*hashnmlen) - ret < z->namelen)
2676 		return 0;
2677 	memmove(hashname+ret, z->name, z->namelen);
2678 	*hashnmlen = z->namelen+(size_t)ret;
2679 	return 1;
2680 }
2681 
2682 /** Find the datanode that covers the nsec3hash-name */
2683 static struct auth_data*
2684 az_nsec3_findnode(struct auth_zone* z, uint8_t* hashnm, size_t hashnmlen)
2685 {
2686 	struct query_info qinfo;
2687 	struct auth_data* node;
2688 	int node_exact;
2689 	qinfo.qclass = 0;
2690 	qinfo.qtype = 0;
2691 	qinfo.qname = hashnm;
2692 	qinfo.qname_len = hashnmlen;
2693 	/* because canonical ordering and b32 nsec3 ordering are the same.
2694 	 * this is a good lookup to find the nsec3 name. */
2695 	az_find_domain(z, &qinfo, &node_exact, &node);
2696 	/* but we may have to skip non-nsec3 nodes */
2697 	/* this may be a lot, the way to speed that up is to have a
2698 	 * separate nsec3 tree with nsec3 nodes */
2699 	while(node && (rbnode_type*)node != RBTREE_NULL &&
2700 		!az_domain_rrset(node, LDNS_RR_TYPE_NSEC3)) {
2701 		node = (struct auth_data*)rbtree_previous(&node->node);
2702 	}
2703 	if((rbnode_type*)node == RBTREE_NULL)
2704 		node = NULL;
2705 	return node;
2706 }
2707 
2708 /** Find cover for hashed(nm, nmlen) (or NULL) */
2709 static struct auth_data*
2710 az_nsec3_find_cover(struct auth_zone* z, uint8_t* nm, size_t nmlen,
2711 	int algo, size_t iter, uint8_t* salt, size_t saltlen)
2712 {
2713 	struct auth_data* node;
2714 	uint8_t hname[LDNS_MAX_DOMAINLEN];
2715 	size_t hlen = sizeof(hname);
2716 	if(!az_nsec3_hashname(z, hname, &hlen, nm, nmlen, algo, iter,
2717 		salt, saltlen))
2718 		return NULL;
2719 	node = az_nsec3_findnode(z, hname, hlen);
2720 	if(node)
2721 		return node;
2722 	/* we did not find any, perhaps because the NSEC3 hash is before
2723 	 * the first hash, we have to find the 'last hash' in the zone */
2724 	node = (struct auth_data*)rbtree_last(&z->data);
2725 	while(node && (rbnode_type*)node != RBTREE_NULL &&
2726 		!az_domain_rrset(node, LDNS_RR_TYPE_NSEC3)) {
2727 		node = (struct auth_data*)rbtree_previous(&node->node);
2728 	}
2729 	if((rbnode_type*)node == RBTREE_NULL)
2730 		node = NULL;
2731 	return node;
2732 }
2733 
2734 /** Find exact match for hashed(nm, nmlen) NSEC3 record or NULL */
2735 static struct auth_data*
2736 az_nsec3_find_exact(struct auth_zone* z, uint8_t* nm, size_t nmlen,
2737 	int algo, size_t iter, uint8_t* salt, size_t saltlen)
2738 {
2739 	struct auth_data* node;
2740 	uint8_t hname[LDNS_MAX_DOMAINLEN];
2741 	size_t hlen = sizeof(hname);
2742 	if(!az_nsec3_hashname(z, hname, &hlen, nm, nmlen, algo, iter,
2743 		salt, saltlen))
2744 		return NULL;
2745 	node = az_find_name(z, hname, hlen);
2746 	if(az_domain_rrset(node, LDNS_RR_TYPE_NSEC3))
2747 		return node;
2748 	return NULL;
2749 }
2750 
2751 /** Return nextcloser name (as a ref into the qname).  This is one label
2752  * more than the cenm (cename must be a suffix of qname) */
2753 static void
2754 az_nsec3_get_nextcloser(uint8_t* cenm, uint8_t* qname, size_t qname_len,
2755 	uint8_t** nx, size_t* nxlen)
2756 {
2757 	int celabs = dname_count_labels(cenm);
2758 	int qlabs = dname_count_labels(qname);
2759 	int strip = qlabs - celabs -1;
2760 	log_assert(dname_strict_subdomain(qname, qlabs, cenm, celabs));
2761 	*nx = qname;
2762 	*nxlen = qname_len;
2763 	if(strip>0)
2764 		dname_remove_labels(nx, nxlen, strip);
2765 }
2766 
2767 /** Find the closest encloser that has exact NSEC3.
2768  * updated cenm to the new name. If it went up no-exact-ce is true. */
2769 static struct auth_data*
2770 az_nsec3_find_ce(struct auth_zone* z, uint8_t** cenm, size_t* cenmlen,
2771 	int* no_exact_ce, int algo, size_t iter, uint8_t* salt, size_t saltlen)
2772 {
2773 	struct auth_data* node;
2774 	while((node = az_nsec3_find_exact(z, *cenm, *cenmlen,
2775 		algo, iter, salt, saltlen)) == NULL) {
2776 		if(*cenmlen == z->namelen) {
2777 			/* next step up would take us out of the zone. fail */
2778 			return NULL;
2779 		}
2780 		*no_exact_ce = 1;
2781 		dname_remove_label(cenm, cenmlen);
2782 	}
2783 	return node;
2784 }
2785 
2786 /* Insert NSEC3 record in authority section, if NULL does nothing */
2787 static int
2788 az_nsec3_insert(struct auth_zone* z, struct regional* region,
2789 	struct dns_msg* msg, struct auth_data* node)
2790 {
2791 	struct auth_rrset* nsec3;
2792 	if(!node) return 1; /* no node, skip this */
2793 	nsec3 = az_domain_rrset(node, LDNS_RR_TYPE_NSEC3);
2794 	if(!nsec3) return 1; /* if no nsec3 RR, skip it */
2795 	if(!msg_add_rrset_ns(z, region, msg, node, nsec3)) return 0;
2796 	return 1;
2797 }
2798 
2799 /** add NSEC3 records to the zone for the nsec3 proof.
2800  * Specify with the flags with parts of the proof are required.
2801  * the ce is the exact matching name (for notype) but also delegation points.
2802  * qname is the one where the nextcloser name can be derived from.
2803  * If NSEC3 is not properly there (in the zone) nothing is added.
2804  * always enabled: include nsec3 proving about the Closest Encloser.
2805  * 	that is an exact match that should exist for it.
2806  * 	If that does not exist, a higher exact match + nxproof is enabled
2807  * 	(for some sort of opt-out empty nonterminal cases).
2808  * nodataproof: search for exact match and include that instead.
2809  * ceproof: include ce proof NSEC3 (omitted for wildcard replies).
2810  * nxproof: include denial of the qname.
2811  * wcproof: include denial of wildcard (wildcard.ce).
2812  */
2813 static int
2814 az_add_nsec3_proof(struct auth_zone* z, struct regional* region,
2815 	struct dns_msg* msg, uint8_t* cenm, size_t cenmlen, uint8_t* qname,
2816 	size_t qname_len, int nodataproof, int ceproof, int nxproof,
2817 	int wcproof)
2818 {
2819 	int algo;
2820 	size_t iter, saltlen;
2821 	uint8_t* salt;
2822 	int no_exact_ce = 0;
2823 	struct auth_data* node;
2824 
2825 	/* find parameters of nsec3 proof */
2826 	if(!az_nsec3_param(z, &algo, &iter, &salt, &saltlen))
2827 		return 1; /* no nsec3 */
2828 	if(nodataproof) {
2829 		/* see if the node has a hash of itself for the nodata
2830 		 * proof nsec3, this has to be an exact match nsec3. */
2831 		struct auth_data* match;
2832 		match = az_nsec3_find_exact(z, qname, qname_len, algo,
2833 			iter, salt, saltlen);
2834 		if(match) {
2835 			if(!az_nsec3_insert(z, region, msg, match))
2836 				return 0;
2837 			/* only nodata NSEC3 needed, no CE or others. */
2838 			return 1;
2839 		}
2840 	}
2841 	/* find ce that has an NSEC3 */
2842 	if(ceproof) {
2843 		node = az_nsec3_find_ce(z, &cenm, &cenmlen, &no_exact_ce,
2844 			algo, iter, salt, saltlen);
2845 		if(no_exact_ce) nxproof = 1;
2846 		if(!az_nsec3_insert(z, region, msg, node))
2847 			return 0;
2848 	}
2849 
2850 	if(nxproof) {
2851 		uint8_t* nx;
2852 		size_t nxlen;
2853 		/* create nextcloser domain name */
2854 		az_nsec3_get_nextcloser(cenm, qname, qname_len, &nx, &nxlen);
2855 		/* find nsec3 that matches or covers it */
2856 		node = az_nsec3_find_cover(z, nx, nxlen, algo, iter, salt,
2857 			saltlen);
2858 		if(!az_nsec3_insert(z, region, msg, node))
2859 			return 0;
2860 	}
2861 	if(wcproof) {
2862 		/* create wildcard name *.ce */
2863 		uint8_t wc[LDNS_MAX_DOMAINLEN];
2864 		size_t wclen;
2865 		if(cenmlen+2 > sizeof(wc))
2866 			return 0; /* result would be too long */
2867 		wc[0] = 1; /* length of wildcard label */
2868 		wc[1] = (uint8_t)'*'; /* wildcard label */
2869 		memmove(wc+2, cenm, cenmlen);
2870 		wclen = cenmlen+2;
2871 		/* find nsec3 that matches or covers it */
2872 		node = az_nsec3_find_cover(z, wc, wclen, algo, iter, salt,
2873 			saltlen);
2874 		if(!az_nsec3_insert(z, region, msg, node))
2875 			return 0;
2876 	}
2877 	return 1;
2878 }
2879 
2880 /** generate answer for positive answer */
2881 static int
2882 az_generate_positive_answer(struct auth_zone* z, struct regional* region,
2883 	struct dns_msg* msg, struct auth_data* node, struct auth_rrset* rrset)
2884 {
2885 	if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
2886 	/* see if we want additional rrs */
2887 	if(rrset->type == LDNS_RR_TYPE_MX) {
2888 		if(!az_add_additionals_from(z, region, msg, rrset, 2))
2889 			return 0;
2890 	} else if(rrset->type == LDNS_RR_TYPE_SRV) {
2891 		if(!az_add_additionals_from(z, region, msg, rrset, 6))
2892 			return 0;
2893 	} else if(rrset->type == LDNS_RR_TYPE_NS) {
2894 		if(!az_add_additionals_from(z, region, msg, rrset, 0))
2895 			return 0;
2896 	}
2897 	return 1;
2898 }
2899 
2900 /** generate answer for type ANY answer */
2901 static int
2902 az_generate_any_answer(struct auth_zone* z, struct regional* region,
2903 	struct dns_msg* msg, struct auth_data* node)
2904 {
2905 	struct auth_rrset* rrset;
2906 	int added = 0;
2907 	/* add a couple (at least one) RRs */
2908 	if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_SOA)) != NULL) {
2909 		if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
2910 		added++;
2911 	}
2912 	if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_MX)) != NULL) {
2913 		if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
2914 		added++;
2915 	}
2916 	if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_A)) != NULL) {
2917 		if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
2918 		added++;
2919 	}
2920 	if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_AAAA)) != NULL) {
2921 		if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
2922 		added++;
2923 	}
2924 	if(added == 0 && node && node->rrsets) {
2925 		if(!msg_add_rrset_an(z, region, msg, node,
2926 			node->rrsets)) return 0;
2927 	}
2928 	return 1;
2929 }
2930 
2931 /** follow cname chain and add more data to the answer section */
2932 static int
2933 follow_cname_chain(struct auth_zone* z, uint16_t qtype,
2934 	struct regional* region, struct dns_msg* msg,
2935 	struct packed_rrset_data* d)
2936 {
2937 	int maxchain = 0;
2938 	/* see if we can add the target of the CNAME into the answer */
2939 	while(maxchain++ < MAX_CNAME_CHAIN) {
2940 		struct auth_data* node;
2941 		struct auth_rrset* rrset;
2942 		size_t clen;
2943 		/* d has cname rdata */
2944 		if(d->count == 0) break; /* no CNAME */
2945 		if(d->rr_len[0] < 2+1) break; /* too small */
2946 		if((clen=dname_valid(d->rr_data[0]+2, d->rr_len[0]-2))==0)
2947 			break; /* malformed */
2948 		if(!dname_subdomain_c(d->rr_data[0]+2, z->name))
2949 			break; /* target out of zone */
2950 		if((node = az_find_name(z, d->rr_data[0]+2, clen))==NULL)
2951 			break; /* no such target name */
2952 		if((rrset=az_domain_rrset(node, qtype))!=NULL) {
2953 			/* done we found the target */
2954 			if(!msg_add_rrset_an(z, region, msg, node, rrset))
2955 				return 0;
2956 			break;
2957 		}
2958 		if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_CNAME))==NULL)
2959 			break; /* no further CNAME chain, notype */
2960 		if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
2961 		d = rrset->data;
2962 	}
2963 	return 1;
2964 }
2965 
2966 /** generate answer for cname answer */
2967 static int
2968 az_generate_cname_answer(struct auth_zone* z, struct query_info* qinfo,
2969 	struct regional* region, struct dns_msg* msg,
2970 	struct auth_data* node, struct auth_rrset* rrset)
2971 {
2972 	if(!msg_add_rrset_an(z, region, msg, node, rrset)) return 0;
2973 	if(!rrset) return 1;
2974 	if(!follow_cname_chain(z, qinfo->qtype, region, msg, rrset->data))
2975 		return 0;
2976 	return 1;
2977 }
2978 
2979 /** generate answer for notype answer */
2980 static int
2981 az_generate_notype_answer(struct auth_zone* z, struct regional* region,
2982 	struct dns_msg* msg, struct auth_data* node)
2983 {
2984 	struct auth_rrset* rrset;
2985 	if(!az_add_negative_soa(z, region, msg)) return 0;
2986 	/* DNSSEC denial NSEC */
2987 	if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_NSEC))!=NULL) {
2988 		if(!msg_add_rrset_ns(z, region, msg, node, rrset)) return 0;
2989 	} else if(node) {
2990 		/* DNSSEC denial NSEC3 */
2991 		if(!az_add_nsec3_proof(z, region, msg, node->name,
2992 			node->namelen, msg->qinfo.qname,
2993 			msg->qinfo.qname_len, 1, 1, 0, 0))
2994 			return 0;
2995 	}
2996 	return 1;
2997 }
2998 
2999 /** generate answer for referral answer */
3000 static int
3001 az_generate_referral_answer(struct auth_zone* z, struct regional* region,
3002 	struct dns_msg* msg, struct auth_data* ce, struct auth_rrset* rrset)
3003 {
3004 	struct auth_rrset* ds, *nsec;
3005 	/* turn off AA flag, referral is nonAA because it leaves the zone */
3006 	log_assert(ce);
3007 	msg->rep->flags &= ~BIT_AA;
3008 	if(!msg_add_rrset_ns(z, region, msg, ce, rrset)) return 0;
3009 	/* add DS or deny it */
3010 	if((ds=az_domain_rrset(ce, LDNS_RR_TYPE_DS))!=NULL) {
3011 		if(!msg_add_rrset_ns(z, region, msg, ce, ds)) return 0;
3012 	} else {
3013 		/* deny the DS */
3014 		if((nsec=az_domain_rrset(ce, LDNS_RR_TYPE_NSEC))!=NULL) {
3015 			if(!msg_add_rrset_ns(z, region, msg, ce, nsec))
3016 				return 0;
3017 		} else {
3018 			if(!az_add_nsec3_proof(z, region, msg, ce->name,
3019 				ce->namelen, msg->qinfo.qname,
3020 				msg->qinfo.qname_len, 1, 1, 0, 0))
3021 				return 0;
3022 		}
3023 	}
3024 	/* add additional rrs for type NS */
3025 	if(!az_add_additionals_from(z, region, msg, rrset, 0)) return 0;
3026 	return 1;
3027 }
3028 
3029 /** generate answer for DNAME answer */
3030 static int
3031 az_generate_dname_answer(struct auth_zone* z, struct query_info* qinfo,
3032 	struct regional* region, struct dns_msg* msg, struct auth_data* ce,
3033 	struct auth_rrset* rrset)
3034 {
3035 	log_assert(ce);
3036 	/* add the DNAME and then a CNAME */
3037 	if(!msg_add_rrset_an(z, region, msg, ce, rrset)) return 0;
3038 	if(!add_synth_cname(z, qinfo->qname, qinfo->qname_len, region,
3039 		msg, ce, rrset)) return 0;
3040 	if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_YXDOMAIN)
3041 		return 1;
3042 	if(msg->rep->rrset_count == 0 ||
3043 		!msg->rep->rrsets[msg->rep->rrset_count-1])
3044 		return 0;
3045 	if(!follow_cname_chain(z, qinfo->qtype, region, msg,
3046 		(struct packed_rrset_data*)msg->rep->rrsets[
3047 		msg->rep->rrset_count-1]->entry.data))
3048 		return 0;
3049 	return 1;
3050 }
3051 
3052 /** generate answer for wildcard answer */
3053 static int
3054 az_generate_wildcard_answer(struct auth_zone* z, struct query_info* qinfo,
3055 	struct regional* region, struct dns_msg* msg, struct auth_data* ce,
3056 	struct auth_data* wildcard, struct auth_data* node)
3057 {
3058 	struct auth_rrset* rrset, *nsec;
3059 	int insert_ce = 0;
3060 	if((rrset=az_domain_rrset(wildcard, qinfo->qtype)) != NULL) {
3061 		/* wildcard has type, add it */
3062 		if(!msg_add_rrset_an(z, region, msg, wildcard, rrset))
3063 			return 0;
3064 		az_change_dnames(msg, wildcard->name, msg->qinfo.qname,
3065 			msg->qinfo.qname_len, 1);
3066 	} else if((rrset=az_domain_rrset(wildcard, LDNS_RR_TYPE_CNAME))!=NULL) {
3067 		/* wildcard has cname instead, do that */
3068 		if(!msg_add_rrset_an(z, region, msg, wildcard, rrset))
3069 			return 0;
3070 		az_change_dnames(msg, wildcard->name, msg->qinfo.qname,
3071 			msg->qinfo.qname_len, 1);
3072 		if(!follow_cname_chain(z, qinfo->qtype, region, msg,
3073 			rrset->data))
3074 			return 0;
3075 	} else if(qinfo->qtype == LDNS_RR_TYPE_ANY && wildcard->rrsets) {
3076 		/* add ANY rrsets from wildcard node */
3077 		if(!az_generate_any_answer(z, region, msg, wildcard))
3078 			return 0;
3079 		az_change_dnames(msg, wildcard->name, msg->qinfo.qname,
3080 			msg->qinfo.qname_len, 1);
3081 	} else {
3082 		/* wildcard has nodata, notype answer */
3083 		/* call other notype routine for dnssec notype denials */
3084 		if(!az_generate_notype_answer(z, region, msg, wildcard))
3085 			return 0;
3086 		/* because the notype, there is no positive data with an
3087 		 * RRSIG that indicates the wildcard position.  Thus the
3088 		 * wildcard qname denial needs to have a CE nsec3. */
3089 		insert_ce = 1;
3090 	}
3091 
3092 	/* ce and node for dnssec denial of wildcard original name */
3093 	if((nsec=az_find_nsec_cover(z, &node)) != NULL) {
3094 		if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0;
3095 	} else if(ce) {
3096 		uint8_t* wildup = wildcard->name;
3097 		size_t wilduplen= wildcard->namelen;
3098 		dname_remove_label(&wildup, &wilduplen);
3099 		if(!az_add_nsec3_proof(z, region, msg, wildup,
3100 			wilduplen, msg->qinfo.qname,
3101 			msg->qinfo.qname_len, 0, insert_ce, 1, 0))
3102 			return 0;
3103 	}
3104 
3105 	/* fixup name of wildcard from *.zone to qname, use already allocated
3106 	 * pointer to msg qname */
3107 	az_change_dnames(msg, wildcard->name, msg->qinfo.qname,
3108 		msg->qinfo.qname_len, 0);
3109 	return 1;
3110 }
3111 
3112 /** generate answer for nxdomain answer */
3113 static int
3114 az_generate_nxdomain_answer(struct auth_zone* z, struct regional* region,
3115 	struct dns_msg* msg, struct auth_data* ce, struct auth_data* node)
3116 {
3117 	struct auth_rrset* nsec;
3118 	msg->rep->flags |= LDNS_RCODE_NXDOMAIN;
3119 	if(!az_add_negative_soa(z, region, msg)) return 0;
3120 	if((nsec=az_find_nsec_cover(z, &node)) != NULL) {
3121 		if(!msg_add_rrset_ns(z, region, msg, node, nsec)) return 0;
3122 		if(ce && !az_nsec_wildcard_denial(z, region, msg, ce->name,
3123 			ce->namelen)) return 0;
3124 	} else if(ce) {
3125 		if(!az_add_nsec3_proof(z, region, msg, ce->name,
3126 			ce->namelen, msg->qinfo.qname,
3127 			msg->qinfo.qname_len, 0, 1, 1, 1))
3128 			return 0;
3129 	}
3130 	return 1;
3131 }
3132 
3133 /** Create answers when an exact match exists for the domain name */
3134 static int
3135 az_generate_answer_with_node(struct auth_zone* z, struct query_info* qinfo,
3136 	struct regional* region, struct dns_msg* msg, struct auth_data* node)
3137 {
3138 	struct auth_rrset* rrset;
3139 	/* positive answer, rrset we are looking for exists */
3140 	if((rrset=az_domain_rrset(node, qinfo->qtype)) != NULL) {
3141 		return az_generate_positive_answer(z, region, msg, node, rrset);
3142 	}
3143 	/* CNAME? */
3144 	if((rrset=az_domain_rrset(node, LDNS_RR_TYPE_CNAME)) != NULL) {
3145 		return az_generate_cname_answer(z, qinfo, region, msg,
3146 			node, rrset);
3147 	}
3148 	/* type ANY ? */
3149 	if(qinfo->qtype == LDNS_RR_TYPE_ANY) {
3150 		return az_generate_any_answer(z, region, msg, node);
3151 	}
3152 	/* NOERROR/NODATA (no such type at domain name) */
3153 	return az_generate_notype_answer(z, region, msg, node);
3154 }
3155 
3156 /** Generate answer without an existing-node that we can use.
3157  * So it'll be a referral, DNAME or nxdomain */
3158 static int
3159 az_generate_answer_nonexistnode(struct auth_zone* z, struct query_info* qinfo,
3160 	struct regional* region, struct dns_msg* msg, struct auth_data* ce,
3161 	struct auth_rrset* rrset, struct auth_data* node)
3162 {
3163 	struct auth_data* wildcard;
3164 
3165 	/* we do not have an exact matching name (that exists) */
3166 	/* see if we have a NS or DNAME in the ce */
3167 	if(ce && rrset && rrset->type == LDNS_RR_TYPE_NS) {
3168 		return az_generate_referral_answer(z, region, msg, ce, rrset);
3169 	}
3170 	if(ce && rrset && rrset->type == LDNS_RR_TYPE_DNAME) {
3171 		return az_generate_dname_answer(z, qinfo, region, msg, ce,
3172 			rrset);
3173 	}
3174 	/* if there is an empty nonterminal, wildcard and nxdomain don't
3175 	 * happen, it is a notype answer */
3176 	if(az_empty_nonterminal(z, qinfo, node)) {
3177 		return az_generate_notype_answer(z, region, msg, node);
3178 	}
3179 	/* see if we have a wildcard under the ce */
3180 	if((wildcard=az_find_wildcard(z, qinfo, ce)) != NULL) {
3181 		return az_generate_wildcard_answer(z, qinfo, region, msg,
3182 			ce, wildcard, node);
3183 	}
3184 	/* generate nxdomain answer */
3185 	return az_generate_nxdomain_answer(z, region, msg, ce, node);
3186 }
3187 
3188 /** Lookup answer in a zone. */
3189 static int
3190 auth_zone_generate_answer(struct auth_zone* z, struct query_info* qinfo,
3191 	struct regional* region, struct dns_msg** msg, int* fallback)
3192 {
3193 	struct auth_data* node, *ce;
3194 	struct auth_rrset* rrset;
3195 	int node_exact, node_exists;
3196 	/* does the zone want fallback in case of failure? */
3197 	*fallback = z->fallback_enabled;
3198 	if(!(*msg=msg_create(region, qinfo))) return 0;
3199 
3200 	/* lookup if there is a matching domain name for the query */
3201 	az_find_domain(z, qinfo, &node_exact, &node);
3202 
3203 	/* see if node exists for generating answers from (i.e. not glue and
3204 	 * obscured by NS or DNAME or NSEC3-only), and also return the
3205 	 * closest-encloser from that, closest node that should be used
3206 	 * to generate answers from that is above the query */
3207 	node_exists = az_find_ce(z, qinfo, node, node_exact, &ce, &rrset);
3208 
3209 	if(verbosity >= VERB_ALGO) {
3210 		char zname[256], qname[256], nname[256], cename[256],
3211 			tpstr[32], rrstr[32];
3212 		sldns_wire2str_dname_buf(qinfo->qname, qinfo->qname_len, qname,
3213 			sizeof(qname));
3214 		sldns_wire2str_type_buf(qinfo->qtype, tpstr, sizeof(tpstr));
3215 		sldns_wire2str_dname_buf(z->name, z->namelen, zname,
3216 			sizeof(zname));
3217 		if(node)
3218 			sldns_wire2str_dname_buf(node->name, node->namelen,
3219 				nname, sizeof(nname));
3220 		else	snprintf(nname, sizeof(nname), "NULL");
3221 		if(ce)
3222 			sldns_wire2str_dname_buf(ce->name, ce->namelen,
3223 				cename, sizeof(cename));
3224 		else	snprintf(cename, sizeof(cename), "NULL");
3225 		if(rrset) sldns_wire2str_type_buf(rrset->type, rrstr,
3226 			sizeof(rrstr));
3227 		else	snprintf(rrstr, sizeof(rrstr), "NULL");
3228 		log_info("auth_zone %s query %s %s, domain %s %s %s, "
3229 			"ce %s, rrset %s", zname, qname, tpstr, nname,
3230 			(node_exact?"exact":"notexact"),
3231 			(node_exists?"exist":"notexist"), cename, rrstr);
3232 	}
3233 
3234 	if(node_exists) {
3235 		/* the node is fine, generate answer from node */
3236 		return az_generate_answer_with_node(z, qinfo, region, *msg,
3237 			node);
3238 	}
3239 	return az_generate_answer_nonexistnode(z, qinfo, region, *msg,
3240 		ce, rrset, node);
3241 }
3242 
3243 int auth_zones_lookup(struct auth_zones* az, struct query_info* qinfo,
3244 	struct regional* region, struct dns_msg** msg, int* fallback,
3245 	uint8_t* dp_nm, size_t dp_nmlen)
3246 {
3247 	int r;
3248 	struct auth_zone* z;
3249 	/* find the zone that should contain the answer. */
3250 	lock_rw_rdlock(&az->lock);
3251 	z = auth_zone_find(az, dp_nm, dp_nmlen, qinfo->qclass);
3252 	if(!z) {
3253 		lock_rw_unlock(&az->lock);
3254 		/* no auth zone, fallback to internet */
3255 		*fallback = 1;
3256 		return 0;
3257 	}
3258 	lock_rw_rdlock(&z->lock);
3259 	lock_rw_unlock(&az->lock);
3260 
3261 	/* if not for upstream queries, fallback */
3262 	if(!z->for_upstream) {
3263 		lock_rw_unlock(&z->lock);
3264 		*fallback = 1;
3265 		return 0;
3266 	}
3267 	if(z->zone_expired) {
3268 		*fallback = z->fallback_enabled;
3269 		lock_rw_unlock(&z->lock);
3270 		return 0;
3271 	}
3272 	/* see what answer that zone would generate */
3273 	r = auth_zone_generate_answer(z, qinfo, region, msg, fallback);
3274 	lock_rw_unlock(&z->lock);
3275 	return r;
3276 }
3277 
3278 /** encode auth answer */
3279 static void
3280 auth_answer_encode(struct query_info* qinfo, struct module_env* env,
3281 	struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf,
3282 	struct regional* temp, struct dns_msg* msg)
3283 {
3284 	uint16_t udpsize;
3285 	udpsize = edns->udp_size;
3286 	edns->edns_version = EDNS_ADVERTISED_VERSION;
3287 	edns->udp_size = EDNS_ADVERTISED_SIZE;
3288 	edns->ext_rcode = 0;
3289 	edns->bits &= EDNS_DO;
3290 
3291 	if(!inplace_cb_reply_local_call(env, qinfo, NULL, msg->rep,
3292 		(int)FLAGS_GET_RCODE(msg->rep->flags), edns, repinfo, temp, env->now_tv)
3293 		|| !reply_info_answer_encode(qinfo, msg->rep,
3294 		*(uint16_t*)sldns_buffer_begin(buf),
3295 		sldns_buffer_read_u16_at(buf, 2),
3296 		buf, 0, 0, temp, udpsize, edns,
3297 		(int)(edns->bits&EDNS_DO), 0)) {
3298 		error_encode(buf, (LDNS_RCODE_SERVFAIL|BIT_AA), qinfo,
3299 			*(uint16_t*)sldns_buffer_begin(buf),
3300 			sldns_buffer_read_u16_at(buf, 2), edns);
3301 	}
3302 }
3303 
3304 /** encode auth error answer */
3305 static void
3306 auth_error_encode(struct query_info* qinfo, struct module_env* env,
3307 	struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf,
3308 	struct regional* temp, int rcode)
3309 {
3310 	edns->edns_version = EDNS_ADVERTISED_VERSION;
3311 	edns->udp_size = EDNS_ADVERTISED_SIZE;
3312 	edns->ext_rcode = 0;
3313 	edns->bits &= EDNS_DO;
3314 
3315 	if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL,
3316 		rcode, edns, repinfo, temp, env->now_tv))
3317 		edns->opt_list = NULL;
3318 	error_encode(buf, rcode|BIT_AA, qinfo,
3319 		*(uint16_t*)sldns_buffer_begin(buf),
3320 		sldns_buffer_read_u16_at(buf, 2), edns);
3321 }
3322 
3323 int auth_zones_answer(struct auth_zones* az, struct module_env* env,
3324 	struct query_info* qinfo, struct edns_data* edns,
3325 	struct comm_reply* repinfo, struct sldns_buffer* buf, struct regional* temp)
3326 {
3327 	struct dns_msg* msg = NULL;
3328 	struct auth_zone* z;
3329 	int r;
3330 	int fallback = 0;
3331 
3332 	lock_rw_rdlock(&az->lock);
3333 	if(!az->have_downstream) {
3334 		/* no downstream auth zones */
3335 		lock_rw_unlock(&az->lock);
3336 		return 0;
3337 	}
3338 	if(qinfo->qtype == LDNS_RR_TYPE_DS) {
3339 		uint8_t* delname = qinfo->qname;
3340 		size_t delnamelen = qinfo->qname_len;
3341 		dname_remove_label(&delname, &delnamelen);
3342 		z = auth_zones_find_zone(az, delname, delnamelen,
3343 			qinfo->qclass);
3344 	} else {
3345 		z = auth_zones_find_zone(az, qinfo->qname, qinfo->qname_len,
3346 			qinfo->qclass);
3347 	}
3348 	if(!z) {
3349 		/* no zone above it */
3350 		lock_rw_unlock(&az->lock);
3351 		return 0;
3352 	}
3353 	lock_rw_rdlock(&z->lock);
3354 	lock_rw_unlock(&az->lock);
3355 	if(!z->for_downstream) {
3356 		lock_rw_unlock(&z->lock);
3357 		return 0;
3358 	}
3359 	if(z->zone_expired) {
3360 		if(z->fallback_enabled) {
3361 			lock_rw_unlock(&z->lock);
3362 			return 0;
3363 		}
3364 		lock_rw_unlock(&z->lock);
3365 		lock_rw_wrlock(&az->lock);
3366 		az->num_query_down++;
3367 		lock_rw_unlock(&az->lock);
3368 		auth_error_encode(qinfo, env, edns, repinfo, buf, temp,
3369 			LDNS_RCODE_SERVFAIL);
3370 		return 1;
3371 	}
3372 
3373 	/* answer it from zone z */
3374 	r = auth_zone_generate_answer(z, qinfo, temp, &msg, &fallback);
3375 	lock_rw_unlock(&z->lock);
3376 	if(!r && fallback) {
3377 		/* fallback to regular answering (recursive) */
3378 		return 0;
3379 	}
3380 	lock_rw_wrlock(&az->lock);
3381 	az->num_query_down++;
3382 	lock_rw_unlock(&az->lock);
3383 
3384 	/* encode answer */
3385 	if(!r)
3386 		auth_error_encode(qinfo, env, edns, repinfo, buf, temp,
3387 			LDNS_RCODE_SERVFAIL);
3388 	else	auth_answer_encode(qinfo, env, edns, repinfo, buf, temp, msg);
3389 
3390 	return 1;
3391 }
3392 
3393 int auth_zones_can_fallback(struct auth_zones* az, uint8_t* nm, size_t nmlen,
3394 	uint16_t dclass)
3395 {
3396 	int r;
3397 	struct auth_zone* z;
3398 	lock_rw_rdlock(&az->lock);
3399 	z = auth_zone_find(az, nm, nmlen, dclass);
3400 	if(!z) {
3401 		lock_rw_unlock(&az->lock);
3402 		/* no such auth zone, fallback */
3403 		return 1;
3404 	}
3405 	lock_rw_rdlock(&z->lock);
3406 	lock_rw_unlock(&az->lock);
3407 	r = z->fallback_enabled || (!z->for_upstream);
3408 	lock_rw_unlock(&z->lock);
3409 	return r;
3410 }
3411 
3412 int
3413 auth_zone_parse_notify_serial(sldns_buffer* pkt, uint32_t *serial)
3414 {
3415 	struct query_info q;
3416 	uint16_t rdlen;
3417 	memset(&q, 0, sizeof(q));
3418 	sldns_buffer_set_position(pkt, 0);
3419 	if(!query_info_parse(&q, pkt)) return 0;
3420 	if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0) return 0;
3421 	/* skip name of RR in answer section */
3422 	if(sldns_buffer_remaining(pkt) < 1) return 0;
3423 	if(pkt_dname_len(pkt) == 0) return 0;
3424 	/* check type */
3425 	if(sldns_buffer_remaining(pkt) < 10 /* type,class,ttl,rdatalen*/)
3426 		return 0;
3427 	if(sldns_buffer_read_u16(pkt) != LDNS_RR_TYPE_SOA) return 0;
3428 	sldns_buffer_skip(pkt, 2); /* class */
3429 	sldns_buffer_skip(pkt, 4); /* ttl */
3430 	rdlen = sldns_buffer_read_u16(pkt); /* rdatalen */
3431 	if(sldns_buffer_remaining(pkt) < rdlen) return 0;
3432 	if(rdlen < 22) return 0; /* bad soa length */
3433 	sldns_buffer_skip(pkt, (ssize_t)(rdlen-20));
3434 	*serial = sldns_buffer_read_u32(pkt);
3435 	/* return true when has serial in answer section */
3436 	return 1;
3437 }
3438 
3439 /** see if addr appears in the list */
3440 static int
3441 addr_in_list(struct auth_addr* list, struct sockaddr_storage* addr,
3442 	socklen_t addrlen)
3443 {
3444 	struct auth_addr* p;
3445 	for(p=list; p; p=p->next) {
3446 		if(sockaddr_cmp_addr(addr, addrlen, &p->addr, p->addrlen)==0)
3447 			return 1;
3448 	}
3449 	return 0;
3450 }
3451 
3452 /** check if an address matches a master specification (or one of its
3453  * addresses in the addr list) */
3454 static int
3455 addr_matches_master(struct auth_master* master, struct sockaddr_storage* addr,
3456 	socklen_t addrlen, struct auth_master** fromhost)
3457 {
3458 	struct sockaddr_storage a;
3459 	socklen_t alen = 0;
3460 	int net = 0;
3461 	if(addr_in_list(master->list, addr, addrlen)) {
3462 		*fromhost = master;
3463 		return 1;
3464 	}
3465 	/* compare address (but not port number, that is the destination
3466 	 * port of the master, the port number of the received notify is
3467 	 * allowed to by any port on that master) */
3468 	if(extstrtoaddr(master->host, &a, &alen) &&
3469 		sockaddr_cmp_addr(addr, addrlen, &a, alen)==0) {
3470 		*fromhost = master;
3471 		return 1;
3472 	}
3473 	/* prefixes, addr/len, like 10.0.0.0/8 */
3474 	/* not http and has a / and there is one / */
3475 	if(master->allow_notify && !master->http &&
3476 		strchr(master->host, '/') != NULL &&
3477 		strchr(master->host, '/') == strrchr(master->host, '/') &&
3478 		netblockstrtoaddr(master->host, UNBOUND_DNS_PORT, &a, &alen,
3479 		&net) && alen == addrlen) {
3480 		if(addr_in_common(addr, (addr_is_ip6(addr, addrlen)?128:32),
3481 			&a, net, alen) >= net) {
3482 			*fromhost = NULL; /* prefix does not have destination
3483 				to send the probe or transfer with */
3484 			return 1; /* matches the netblock */
3485 		}
3486 	}
3487 	return 0;
3488 }
3489 
3490 /** check access list for notifies */
3491 static int
3492 az_xfr_allowed_notify(struct auth_xfer* xfr, struct sockaddr_storage* addr,
3493 	socklen_t addrlen, struct auth_master** fromhost)
3494 {
3495 	struct auth_master* p;
3496 	for(p=xfr->allow_notify_list; p; p=p->next) {
3497 		if(addr_matches_master(p, addr, addrlen, fromhost)) {
3498 			return 1;
3499 		}
3500 	}
3501 	return 0;
3502 }
3503 
3504 /** see if the serial means the zone has to be updated, i.e. the serial
3505  * is newer than the zone serial, or we have no zone */
3506 static int
3507 xfr_serial_means_update(struct auth_xfer* xfr, uint32_t serial)
3508 {
3509 	if(!xfr->have_zone)
3510 		return 1; /* no zone, anything is better */
3511 	if(xfr->zone_expired)
3512 		return 1; /* expired, the sent serial is better than expired
3513 			data */
3514 	if(compare_serial(xfr->serial, serial) < 0)
3515 		return 1; /* our serial is smaller than the sent serial,
3516 			the data is newer, fetch it */
3517 	return 0;
3518 }
3519 
3520 /** note notify serial, updates the notify information in the xfr struct */
3521 static void
3522 xfr_note_notify_serial(struct auth_xfer* xfr, int has_serial, uint32_t serial)
3523 {
3524 	if(xfr->notify_received && xfr->notify_has_serial && has_serial) {
3525 		/* see if this serial is newer */
3526 		if(compare_serial(xfr->notify_serial, serial) < 0)
3527 			xfr->notify_serial = serial;
3528 	} else if(xfr->notify_received && xfr->notify_has_serial &&
3529 		!has_serial) {
3530 		/* remove serial, we have notify without serial */
3531 		xfr->notify_has_serial = 0;
3532 		xfr->notify_serial = 0;
3533 	} else if(xfr->notify_received && !xfr->notify_has_serial) {
3534 		/* we already have notify without serial, keep it
3535 		 * that way; no serial check when current operation
3536 		 * is done */
3537 	} else {
3538 		xfr->notify_received = 1;
3539 		xfr->notify_has_serial = has_serial;
3540 		xfr->notify_serial = serial;
3541 	}
3542 }
3543 
3544 /** process a notify serial, start new probe or note serial. xfr is locked */
3545 static void
3546 xfr_process_notify(struct auth_xfer* xfr, struct module_env* env,
3547 	int has_serial, uint32_t serial, struct auth_master* fromhost)
3548 {
3549 	/* if the serial of notify is older than we have, don't fetch
3550 	 * a zone, we already have it */
3551 	if(has_serial && !xfr_serial_means_update(xfr, serial)) {
3552 		lock_basic_unlock(&xfr->lock);
3553 		return;
3554 	}
3555 	/* start new probe with this addr src, or note serial */
3556 	if(!xfr_start_probe(xfr, env, fromhost)) {
3557 		/* not started because already in progress, note the serial */
3558 		xfr_note_notify_serial(xfr, has_serial, serial);
3559 		lock_basic_unlock(&xfr->lock);
3560 	}
3561 	/* successful end of start_probe unlocked xfr->lock */
3562 }
3563 
3564 int auth_zones_notify(struct auth_zones* az, struct module_env* env,
3565 	uint8_t* nm, size_t nmlen, uint16_t dclass,
3566 	struct sockaddr_storage* addr, socklen_t addrlen, int has_serial,
3567 	uint32_t serial, int* refused)
3568 {
3569 	struct auth_xfer* xfr;
3570 	struct auth_master* fromhost = NULL;
3571 	/* see which zone this is */
3572 	lock_rw_rdlock(&az->lock);
3573 	xfr = auth_xfer_find(az, nm, nmlen, dclass);
3574 	if(!xfr) {
3575 		lock_rw_unlock(&az->lock);
3576 		/* no such zone, refuse the notify */
3577 		*refused = 1;
3578 		return 0;
3579 	}
3580 	lock_basic_lock(&xfr->lock);
3581 	lock_rw_unlock(&az->lock);
3582 
3583 	/* check access list for notifies */
3584 	if(!az_xfr_allowed_notify(xfr, addr, addrlen, &fromhost)) {
3585 		lock_basic_unlock(&xfr->lock);
3586 		/* notify not allowed, refuse the notify */
3587 		*refused = 1;
3588 		return 0;
3589 	}
3590 
3591 	/* process the notify */
3592 	xfr_process_notify(xfr, env, has_serial, serial, fromhost);
3593 	return 1;
3594 }
3595 
3596 int auth_zones_startprobesequence(struct auth_zones* az,
3597 	struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t dclass)
3598 {
3599 	struct auth_xfer* xfr;
3600 	lock_rw_rdlock(&az->lock);
3601 	xfr = auth_xfer_find(az, nm, nmlen, dclass);
3602 	if(!xfr) {
3603 		lock_rw_unlock(&az->lock);
3604 		return 0;
3605 	}
3606 	lock_basic_lock(&xfr->lock);
3607 	lock_rw_unlock(&az->lock);
3608 
3609 	xfr_process_notify(xfr, env, 0, 0, NULL);
3610 	return 1;
3611 }
3612 
3613 /** set a zone expired */
3614 static void
3615 auth_xfer_set_expired(struct auth_xfer* xfr, struct module_env* env,
3616 	int expired)
3617 {
3618 	struct auth_zone* z;
3619 
3620 	/* expire xfr */
3621 	lock_basic_lock(&xfr->lock);
3622 	xfr->zone_expired = expired;
3623 	lock_basic_unlock(&xfr->lock);
3624 
3625 	/* find auth_zone */
3626 	lock_rw_rdlock(&env->auth_zones->lock);
3627 	z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen,
3628 		xfr->dclass);
3629 	if(!z) {
3630 		lock_rw_unlock(&env->auth_zones->lock);
3631 		return;
3632 	}
3633 	lock_rw_wrlock(&z->lock);
3634 	lock_rw_unlock(&env->auth_zones->lock);
3635 
3636 	/* expire auth_zone */
3637 	z->zone_expired = expired;
3638 	lock_rw_unlock(&z->lock);
3639 }
3640 
3641 /** find master (from notify or probe) in list of masters */
3642 static struct auth_master*
3643 find_master_by_host(struct auth_master* list, char* host)
3644 {
3645 	struct auth_master* p;
3646 	for(p=list; p; p=p->next) {
3647 		if(strcmp(p->host, host) == 0)
3648 			return p;
3649 	}
3650 	return NULL;
3651 }
3652 
3653 /** delete the looked up auth_addrs for all the masters in the list */
3654 static void
3655 xfr_masterlist_free_addrs(struct auth_master* list)
3656 {
3657 	struct auth_master* m;
3658 	for(m=list; m; m=m->next) {
3659 		if(m->list) {
3660 			auth_free_master_addrs(m->list);
3661 			m->list = NULL;
3662 		}
3663 	}
3664 }
3665 
3666 /** copy a list of auth_addrs */
3667 static struct auth_addr*
3668 auth_addr_list_copy(struct auth_addr* source)
3669 {
3670 	struct auth_addr* list = NULL, *last = NULL;
3671 	struct auth_addr* p;
3672 	for(p=source; p; p=p->next) {
3673 		struct auth_addr* a = (struct auth_addr*)memdup(p, sizeof(*p));
3674 		if(!a) {
3675 			log_err("malloc failure");
3676 			auth_free_master_addrs(list);
3677 			return NULL;
3678 		}
3679 		a->next = NULL;
3680 		if(last) last->next = a;
3681 		if(!list) list = a;
3682 		last = a;
3683 	}
3684 	return list;
3685 }
3686 
3687 /** copy a master to a new structure, NULL on alloc failure */
3688 static struct auth_master*
3689 auth_master_copy(struct auth_master* o)
3690 {
3691 	struct auth_master* m;
3692 	if(!o) return NULL;
3693 	m = (struct auth_master*)memdup(o, sizeof(*o));
3694 	if(!m) {
3695 		log_err("malloc failure");
3696 		return NULL;
3697 	}
3698 	m->next = NULL;
3699 	if(m->host) {
3700 		m->host = strdup(m->host);
3701 		if(!m->host) {
3702 			free(m);
3703 			log_err("malloc failure");
3704 			return NULL;
3705 		}
3706 	}
3707 	if(m->file) {
3708 		m->file = strdup(m->file);
3709 		if(!m->file) {
3710 			free(m->host);
3711 			free(m);
3712 			log_err("malloc failure");
3713 			return NULL;
3714 		}
3715 	}
3716 	if(m->list) {
3717 		m->list = auth_addr_list_copy(m->list);
3718 		if(!m->list) {
3719 			free(m->file);
3720 			free(m->host);
3721 			free(m);
3722 			return NULL;
3723 		}
3724 	}
3725 	return m;
3726 }
3727 
3728 /** copy the master addresses from the task_probe lookups to the allow_notify
3729  * list of masters */
3730 static void
3731 probe_copy_masters_for_allow_notify(struct auth_xfer* xfr)
3732 {
3733 	struct auth_master* list = NULL, *last = NULL;
3734 	struct auth_master* p;
3735 	/* build up new list with copies */
3736 	for(p = xfr->task_probe->masters; p; p=p->next) {
3737 		struct auth_master* m = auth_master_copy(p);
3738 		if(!m) {
3739 			auth_free_masters(list);
3740 			/* failed because of malloc failure, use old list */
3741 			return;
3742 		}
3743 		m->next = NULL;
3744 		if(last) last->next = m;
3745 		if(!list) list = m;
3746 		last = m;
3747 	}
3748 	/* success, replace list */
3749 	auth_free_masters(xfr->allow_notify_list);
3750 	xfr->allow_notify_list = list;
3751 }
3752 
3753 /** start the lookups for task_transfer */
3754 static void
3755 xfr_transfer_start_lookups(struct auth_xfer* xfr)
3756 {
3757 	/* delete all the looked up addresses in the list */
3758 	xfr->task_transfer->scan_addr = NULL;
3759 	xfr_masterlist_free_addrs(xfr->task_transfer->masters);
3760 
3761 	/* start lookup at the first master */
3762 	xfr->task_transfer->lookup_target = xfr->task_transfer->masters;
3763 	xfr->task_transfer->lookup_aaaa = 0;
3764 }
3765 
3766 /** move to the next lookup of hostname for task_transfer */
3767 static void
3768 xfr_transfer_move_to_next_lookup(struct auth_xfer* xfr, struct module_env* env)
3769 {
3770 	if(!xfr->task_transfer->lookup_target)
3771 		return; /* already at end of list */
3772 	if(!xfr->task_transfer->lookup_aaaa && env->cfg->do_ip6) {
3773 		/* move to lookup AAAA */
3774 		xfr->task_transfer->lookup_aaaa = 1;
3775 		return;
3776 	}
3777 	xfr->task_transfer->lookup_target =
3778 		xfr->task_transfer->lookup_target->next;
3779 	xfr->task_transfer->lookup_aaaa = 0;
3780 	if(!env->cfg->do_ip4 && xfr->task_transfer->lookup_target!=NULL)
3781 		xfr->task_transfer->lookup_aaaa = 1;
3782 }
3783 
3784 /** start the lookups for task_probe */
3785 static void
3786 xfr_probe_start_lookups(struct auth_xfer* xfr)
3787 {
3788 	/* delete all the looked up addresses in the list */
3789 	xfr->task_probe->scan_addr = NULL;
3790 	xfr_masterlist_free_addrs(xfr->task_probe->masters);
3791 
3792 	/* start lookup at the first master */
3793 	xfr->task_probe->lookup_target = xfr->task_probe->masters;
3794 	xfr->task_probe->lookup_aaaa = 0;
3795 }
3796 
3797 /** move to the next lookup of hostname for task_probe */
3798 static void
3799 xfr_probe_move_to_next_lookup(struct auth_xfer* xfr, struct module_env* env)
3800 {
3801 	if(!xfr->task_probe->lookup_target)
3802 		return; /* already at end of list */
3803 	if(!xfr->task_probe->lookup_aaaa && env->cfg->do_ip6) {
3804 		/* move to lookup AAAA */
3805 		xfr->task_probe->lookup_aaaa = 1;
3806 		return;
3807 	}
3808 	xfr->task_probe->lookup_target = xfr->task_probe->lookup_target->next;
3809 	xfr->task_probe->lookup_aaaa = 0;
3810 	if(!env->cfg->do_ip4 && xfr->task_probe->lookup_target!=NULL)
3811 		xfr->task_probe->lookup_aaaa = 1;
3812 }
3813 
3814 /** start the iteration of the task_transfer list of masters */
3815 static void
3816 xfr_transfer_start_list(struct auth_xfer* xfr, struct auth_master* spec)
3817 {
3818 	if(spec) {
3819 		xfr->task_transfer->scan_specific = find_master_by_host(
3820 			xfr->task_transfer->masters, spec->host);
3821 		if(xfr->task_transfer->scan_specific) {
3822 			xfr->task_transfer->scan_target = NULL;
3823 			xfr->task_transfer->scan_addr = NULL;
3824 			if(xfr->task_transfer->scan_specific->list)
3825 				xfr->task_transfer->scan_addr =
3826 					xfr->task_transfer->scan_specific->list;
3827 			return;
3828 		}
3829 	}
3830 	/* no specific (notified) host to scan */
3831 	xfr->task_transfer->scan_specific = NULL;
3832 	xfr->task_transfer->scan_addr = NULL;
3833 	/* pick up first scan target */
3834 	xfr->task_transfer->scan_target = xfr->task_transfer->masters;
3835 	if(xfr->task_transfer->scan_target && xfr->task_transfer->
3836 		scan_target->list)
3837 		xfr->task_transfer->scan_addr =
3838 			xfr->task_transfer->scan_target->list;
3839 }
3840 
3841 /** start the iteration of the task_probe list of masters */
3842 static void
3843 xfr_probe_start_list(struct auth_xfer* xfr, struct auth_master* spec)
3844 {
3845 	if(spec) {
3846 		xfr->task_probe->scan_specific = find_master_by_host(
3847 			xfr->task_probe->masters, spec->host);
3848 		if(xfr->task_probe->scan_specific) {
3849 			xfr->task_probe->scan_target = NULL;
3850 			xfr->task_probe->scan_addr = NULL;
3851 			if(xfr->task_probe->scan_specific->list)
3852 				xfr->task_probe->scan_addr =
3853 					xfr->task_probe->scan_specific->list;
3854 			return;
3855 		}
3856 	}
3857 	/* no specific (notified) host to scan */
3858 	xfr->task_probe->scan_specific = NULL;
3859 	xfr->task_probe->scan_addr = NULL;
3860 	/* pick up first scan target */
3861 	xfr->task_probe->scan_target = xfr->task_probe->masters;
3862 	if(xfr->task_probe->scan_target && xfr->task_probe->scan_target->list)
3863 		xfr->task_probe->scan_addr =
3864 			xfr->task_probe->scan_target->list;
3865 }
3866 
3867 /** pick up the master that is being scanned right now, task_transfer */
3868 static struct auth_master*
3869 xfr_transfer_current_master(struct auth_xfer* xfr)
3870 {
3871 	if(xfr->task_transfer->scan_specific)
3872 		return xfr->task_transfer->scan_specific;
3873 	return xfr->task_transfer->scan_target;
3874 }
3875 
3876 /** pick up the master that is being scanned right now, task_probe */
3877 static struct auth_master*
3878 xfr_probe_current_master(struct auth_xfer* xfr)
3879 {
3880 	if(xfr->task_probe->scan_specific)
3881 		return xfr->task_probe->scan_specific;
3882 	return xfr->task_probe->scan_target;
3883 }
3884 
3885 /** true if at end of list, task_transfer */
3886 static int
3887 xfr_transfer_end_of_list(struct auth_xfer* xfr)
3888 {
3889 	return !xfr->task_transfer->scan_specific &&
3890 		!xfr->task_transfer->scan_target;
3891 }
3892 
3893 /** true if at end of list, task_probe */
3894 static int
3895 xfr_probe_end_of_list(struct auth_xfer* xfr)
3896 {
3897 	return !xfr->task_probe->scan_specific && !xfr->task_probe->scan_target;
3898 }
3899 
3900 /** move to next master in list, task_transfer */
3901 static void
3902 xfr_transfer_nextmaster(struct auth_xfer* xfr)
3903 {
3904 	if(!xfr->task_transfer->scan_specific &&
3905 		!xfr->task_transfer->scan_target)
3906 		return;
3907 	if(xfr->task_transfer->scan_addr) {
3908 		xfr->task_transfer->scan_addr =
3909 			xfr->task_transfer->scan_addr->next;
3910 		if(xfr->task_transfer->scan_addr)
3911 			return;
3912 	}
3913 	if(xfr->task_transfer->scan_specific) {
3914 		xfr->task_transfer->scan_specific = NULL;
3915 		xfr->task_transfer->scan_target = xfr->task_transfer->masters;
3916 		if(xfr->task_transfer->scan_target && xfr->task_transfer->
3917 			scan_target->list)
3918 			xfr->task_transfer->scan_addr =
3919 				xfr->task_transfer->scan_target->list;
3920 		return;
3921 	}
3922 	if(!xfr->task_transfer->scan_target)
3923 		return;
3924 	xfr->task_transfer->scan_target = xfr->task_transfer->scan_target->next;
3925 	if(xfr->task_transfer->scan_target && xfr->task_transfer->
3926 		scan_target->list)
3927 		xfr->task_transfer->scan_addr =
3928 			xfr->task_transfer->scan_target->list;
3929 	return;
3930 }
3931 
3932 /** move to next master in list, task_probe */
3933 static void
3934 xfr_probe_nextmaster(struct auth_xfer* xfr)
3935 {
3936 	if(!xfr->task_probe->scan_specific && !xfr->task_probe->scan_target)
3937 		return;
3938 	if(xfr->task_probe->scan_addr) {
3939 		xfr->task_probe->scan_addr = xfr->task_probe->scan_addr->next;
3940 		if(xfr->task_probe->scan_addr)
3941 			return;
3942 	}
3943 	if(xfr->task_probe->scan_specific) {
3944 		xfr->task_probe->scan_specific = NULL;
3945 		xfr->task_probe->scan_target = xfr->task_probe->masters;
3946 		if(xfr->task_probe->scan_target && xfr->task_probe->
3947 			scan_target->list)
3948 			xfr->task_probe->scan_addr =
3949 				xfr->task_probe->scan_target->list;
3950 		return;
3951 	}
3952 	if(!xfr->task_probe->scan_target)
3953 		return;
3954 	xfr->task_probe->scan_target = xfr->task_probe->scan_target->next;
3955 	if(xfr->task_probe->scan_target && xfr->task_probe->
3956 		scan_target->list)
3957 		xfr->task_probe->scan_addr =
3958 			xfr->task_probe->scan_target->list;
3959 	return;
3960 }
3961 
3962 /** create SOA probe packet for xfr */
3963 static void
3964 xfr_create_soa_probe_packet(struct auth_xfer* xfr, sldns_buffer* buf,
3965 	uint16_t id)
3966 {
3967 	struct query_info qinfo;
3968 
3969 	memset(&qinfo, 0, sizeof(qinfo));
3970 	qinfo.qname = xfr->name;
3971 	qinfo.qname_len = xfr->namelen;
3972 	qinfo.qtype = LDNS_RR_TYPE_SOA;
3973 	qinfo.qclass = xfr->dclass;
3974 	qinfo_query_encode(buf, &qinfo);
3975 	sldns_buffer_write_u16_at(buf, 0, id);
3976 }
3977 
3978 /** create IXFR/AXFR packet for xfr */
3979 static void
3980 xfr_create_ixfr_packet(struct auth_xfer* xfr, sldns_buffer* buf, uint16_t id,
3981 	struct auth_master* master)
3982 {
3983 	struct query_info qinfo;
3984 	uint32_t serial;
3985 	int have_zone;
3986 	have_zone = xfr->have_zone;
3987 	serial = xfr->serial;
3988 
3989 	memset(&qinfo, 0, sizeof(qinfo));
3990 	qinfo.qname = xfr->name;
3991 	qinfo.qname_len = xfr->namelen;
3992 	xfr->task_transfer->got_xfr_serial = 0;
3993 	xfr->task_transfer->rr_scan_num = 0;
3994 	xfr->task_transfer->incoming_xfr_serial = 0;
3995 	xfr->task_transfer->on_ixfr_is_axfr = 0;
3996 	xfr->task_transfer->on_ixfr = 1;
3997 	qinfo.qtype = LDNS_RR_TYPE_IXFR;
3998 	if(!have_zone || xfr->task_transfer->ixfr_fail || !master->ixfr) {
3999 		qinfo.qtype = LDNS_RR_TYPE_AXFR;
4000 		xfr->task_transfer->ixfr_fail = 0;
4001 		xfr->task_transfer->on_ixfr = 0;
4002 	}
4003 
4004 	qinfo.qclass = xfr->dclass;
4005 	qinfo_query_encode(buf, &qinfo);
4006 	sldns_buffer_write_u16_at(buf, 0, id);
4007 
4008 	/* append serial for IXFR */
4009 	if(qinfo.qtype == LDNS_RR_TYPE_IXFR) {
4010 		size_t end = sldns_buffer_limit(buf);
4011 		sldns_buffer_clear(buf);
4012 		sldns_buffer_set_position(buf, end);
4013 		/* auth section count 1 */
4014 		sldns_buffer_write_u16_at(buf, LDNS_NSCOUNT_OFF, 1);
4015 		/* write SOA */
4016 		sldns_buffer_write_u8(buf, 0xC0); /* compressed ptr to qname */
4017 		sldns_buffer_write_u8(buf, 0x0C);
4018 		sldns_buffer_write_u16(buf, LDNS_RR_TYPE_SOA);
4019 		sldns_buffer_write_u16(buf, qinfo.qclass);
4020 		sldns_buffer_write_u32(buf, 0); /* ttl */
4021 		sldns_buffer_write_u16(buf, 22); /* rdata length */
4022 		sldns_buffer_write_u8(buf, 0); /* . */
4023 		sldns_buffer_write_u8(buf, 0); /* . */
4024 		sldns_buffer_write_u32(buf, serial); /* serial */
4025 		sldns_buffer_write_u32(buf, 0); /* refresh */
4026 		sldns_buffer_write_u32(buf, 0); /* retry */
4027 		sldns_buffer_write_u32(buf, 0); /* expire */
4028 		sldns_buffer_write_u32(buf, 0); /* minimum */
4029 		sldns_buffer_flip(buf);
4030 	}
4031 }
4032 
4033 /** check if returned packet is OK */
4034 static int
4035 check_packet_ok(sldns_buffer* pkt, uint16_t qtype, struct auth_xfer* xfr,
4036 	uint32_t* serial)
4037 {
4038 	/* parse to see if packet worked, valid reply */
4039 
4040 	/* check serial number of SOA */
4041 	if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE)
4042 		return 0;
4043 
4044 	/* check ID */
4045 	if(LDNS_ID_WIRE(sldns_buffer_begin(pkt)) != xfr->task_probe->id)
4046 		return 0;
4047 
4048 	/* check flag bits and rcode */
4049 	if(!LDNS_QR_WIRE(sldns_buffer_begin(pkt)))
4050 		return 0;
4051 	if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY)
4052 		return 0;
4053 	if(LDNS_RCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_RCODE_NOERROR)
4054 		return 0;
4055 
4056 	/* check qname */
4057 	if(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) != 1)
4058 		return 0;
4059 	sldns_buffer_skip(pkt, LDNS_HEADER_SIZE);
4060 	if(sldns_buffer_remaining(pkt) < xfr->namelen)
4061 		return 0;
4062 	if(query_dname_compare(sldns_buffer_current(pkt), xfr->name) != 0)
4063 		return 0;
4064 	sldns_buffer_skip(pkt, (ssize_t)xfr->namelen);
4065 
4066 	/* check qtype, qclass */
4067 	if(sldns_buffer_remaining(pkt) < 4)
4068 		return 0;
4069 	if(sldns_buffer_read_u16(pkt) != qtype)
4070 		return 0;
4071 	if(sldns_buffer_read_u16(pkt) != xfr->dclass)
4072 		return 0;
4073 
4074 	if(serial) {
4075 		uint16_t rdlen;
4076 		/* read serial number, from answer section SOA */
4077 		if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) == 0)
4078 			return 0;
4079 		/* read from first record SOA record */
4080 		if(sldns_buffer_remaining(pkt) < 1)
4081 			return 0;
4082 		if(dname_pkt_compare(pkt, sldns_buffer_current(pkt),
4083 			xfr->name) != 0)
4084 			return 0;
4085 		if(!pkt_dname_len(pkt))
4086 			return 0;
4087 		/* type, class, ttl, rdatalen */
4088 		if(sldns_buffer_remaining(pkt) < 4+4+2)
4089 			return 0;
4090 		if(sldns_buffer_read_u16(pkt) != qtype)
4091 			return 0;
4092 		if(sldns_buffer_read_u16(pkt) != xfr->dclass)
4093 			return 0;
4094 		sldns_buffer_skip(pkt, 4); /* ttl */
4095 		rdlen = sldns_buffer_read_u16(pkt);
4096 		if(sldns_buffer_remaining(pkt) < rdlen)
4097 			return 0;
4098 		if(sldns_buffer_remaining(pkt) < 1)
4099 			return 0;
4100 		if(!pkt_dname_len(pkt)) /* soa name */
4101 			return 0;
4102 		if(sldns_buffer_remaining(pkt) < 1)
4103 			return 0;
4104 		if(!pkt_dname_len(pkt)) /* soa name */
4105 			return 0;
4106 		if(sldns_buffer_remaining(pkt) < 20)
4107 			return 0;
4108 		*serial = sldns_buffer_read_u32(pkt);
4109 	}
4110 	return 1;
4111 }
4112 
4113 /** read one line from chunks into buffer at current position */
4114 static int
4115 chunkline_get_line(struct auth_chunk** chunk, size_t* chunk_pos,
4116 	sldns_buffer* buf)
4117 {
4118 	int readsome = 0;
4119 	while(*chunk) {
4120 		/* more text in this chunk? */
4121 		if(*chunk_pos < (*chunk)->len) {
4122 			readsome = 1;
4123 			while(*chunk_pos < (*chunk)->len) {
4124 				char c = (char)((*chunk)->data[*chunk_pos]);
4125 				(*chunk_pos)++;
4126 				if(sldns_buffer_remaining(buf) < 2) {
4127 					/* buffer too short */
4128 					verbose(VERB_ALGO, "http chunkline, "
4129 						"line too long");
4130 					return 0;
4131 				}
4132 				sldns_buffer_write_u8(buf, (uint8_t)c);
4133 				if(c == '\n') {
4134 					/* we are done */
4135 					return 1;
4136 				}
4137 			}
4138 		}
4139 		/* move to next chunk */
4140 		*chunk = (*chunk)->next;
4141 		*chunk_pos = 0;
4142 	}
4143 	/* no more text */
4144 	if(readsome) return 1;
4145 	return 0;
4146 }
4147 
4148 /** count number of open and closed parenthesis in a chunkline */
4149 static int
4150 chunkline_count_parens(sldns_buffer* buf, size_t start)
4151 {
4152 	size_t end = sldns_buffer_position(buf);
4153 	size_t i;
4154 	int count = 0;
4155 	int squote = 0, dquote = 0;
4156 	for(i=start; i<end; i++) {
4157 		char c = (char)sldns_buffer_read_u8_at(buf, i);
4158 		if(squote && c != '\'') continue;
4159 		if(dquote && c != '"') continue;
4160 		if(c == '"')
4161 			dquote = !dquote; /* skip quoted part */
4162 		else if(c == '\'')
4163 			squote = !squote; /* skip quoted part */
4164 		else if(c == '(')
4165 			count ++;
4166 		else if(c == ')')
4167 			count --;
4168 		else if(c == ';') {
4169 			/* rest is a comment */
4170 			return count;
4171 		}
4172 	}
4173 	return count;
4174 }
4175 
4176 /** remove trailing ;... comment from a line in the chunkline buffer */
4177 static void
4178 chunkline_remove_trailcomment(sldns_buffer* buf, size_t start)
4179 {
4180 	size_t end = sldns_buffer_position(buf);
4181 	size_t i;
4182 	int squote = 0, dquote = 0;
4183 	for(i=start; i<end; i++) {
4184 		char c = (char)sldns_buffer_read_u8_at(buf, i);
4185 		if(squote && c != '\'') continue;
4186 		if(dquote && c != '"') continue;
4187 		if(c == '"')
4188 			dquote = !dquote; /* skip quoted part */
4189 		else if(c == '\'')
4190 			squote = !squote; /* skip quoted part */
4191 		else if(c == ';') {
4192 			/* rest is a comment */
4193 			sldns_buffer_set_position(buf, i);
4194 			return;
4195 		}
4196 	}
4197 	/* nothing to remove */
4198 }
4199 
4200 /** see if a chunkline is a comment line (or empty line) */
4201 static int
4202 chunkline_is_comment_line_or_empty(sldns_buffer* buf)
4203 {
4204 	size_t i, end = sldns_buffer_limit(buf);
4205 	for(i=0; i<end; i++) {
4206 		char c = (char)sldns_buffer_read_u8_at(buf, i);
4207 		if(c == ';')
4208 			return 1; /* comment */
4209 		else if(c != ' ' && c != '\t' && c != '\r' && c != '\n')
4210 			return 0; /* not a comment */
4211 	}
4212 	return 1; /* empty */
4213 }
4214 
4215 /** find a line with ( ) collated */
4216 static int
4217 chunkline_get_line_collated(struct auth_chunk** chunk, size_t* chunk_pos,
4218 	sldns_buffer* buf)
4219 {
4220 	size_t pos;
4221 	int parens = 0;
4222 	sldns_buffer_clear(buf);
4223 	pos = sldns_buffer_position(buf);
4224 	if(!chunkline_get_line(chunk, chunk_pos, buf)) {
4225 		if(sldns_buffer_position(buf) < sldns_buffer_limit(buf))
4226 			sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0);
4227 		else sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf)-1, 0);
4228 		sldns_buffer_flip(buf);
4229 		return 0;
4230 	}
4231 	parens += chunkline_count_parens(buf, pos);
4232 	while(parens > 0) {
4233 		chunkline_remove_trailcomment(buf, pos);
4234 		pos = sldns_buffer_position(buf);
4235 		if(!chunkline_get_line(chunk, chunk_pos, buf)) {
4236 			if(sldns_buffer_position(buf) < sldns_buffer_limit(buf))
4237 				sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0);
4238 			else sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf)-1, 0);
4239 			sldns_buffer_flip(buf);
4240 			return 0;
4241 		}
4242 		parens += chunkline_count_parens(buf, pos);
4243 	}
4244 
4245 	if(sldns_buffer_remaining(buf) < 1) {
4246 		verbose(VERB_ALGO, "http chunkline: "
4247 			"line too long");
4248 		return 0;
4249 	}
4250 	sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0);
4251 	sldns_buffer_flip(buf);
4252 	return 1;
4253 }
4254 
4255 /** process $ORIGIN for http */
4256 static int
4257 http_parse_origin(sldns_buffer* buf, struct sldns_file_parse_state* pstate)
4258 {
4259 	char* line = (char*)sldns_buffer_begin(buf);
4260 	if(strncmp(line, "$ORIGIN", 7) == 0 &&
4261 		isspace((unsigned char)line[7])) {
4262 		int s;
4263 		pstate->origin_len = sizeof(pstate->origin);
4264 		s = sldns_str2wire_dname_buf(sldns_strip_ws(line+8),
4265 			pstate->origin, &pstate->origin_len);
4266 		if(s) pstate->origin_len = 0;
4267 		return 1;
4268 	}
4269 	return 0;
4270 }
4271 
4272 /** process $TTL for http */
4273 static int
4274 http_parse_ttl(sldns_buffer* buf, struct sldns_file_parse_state* pstate)
4275 {
4276 	char* line = (char*)sldns_buffer_begin(buf);
4277 	if(strncmp(line, "$TTL", 4) == 0 &&
4278 		isspace((unsigned char)line[4])) {
4279 		const char* end = NULL;
4280 		pstate->default_ttl = sldns_str2period(
4281 			sldns_strip_ws(line+5), &end);
4282 		return 1;
4283 	}
4284 	return 0;
4285 }
4286 
4287 /** find noncomment RR line in chunks, collates lines if ( ) format */
4288 static int
4289 chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos,
4290 	sldns_buffer* buf, struct sldns_file_parse_state* pstate)
4291 {
4292 	while(chunkline_get_line_collated(chunk, chunk_pos, buf)) {
4293 		if(chunkline_is_comment_line_or_empty(buf)) {
4294 			/* a comment, go to next line */
4295 			continue;
4296 		}
4297 		if(http_parse_origin(buf, pstate)) {
4298 			continue; /* $ORIGIN has been handled */
4299 		}
4300 		if(http_parse_ttl(buf, pstate)) {
4301 			continue; /* $TTL has been handled */
4302 		}
4303 		return 1;
4304 	}
4305 	/* no noncomments, fail */
4306 	return 0;
4307 }
4308 
4309 /** check syntax of chunklist zonefile, parse first RR, return false on
4310  * failure and return a string in the scratch buffer (first RR string)
4311  * on failure. */
4312 static int
4313 http_zonefile_syntax_check(struct auth_xfer* xfr, sldns_buffer* buf)
4314 {
4315 	uint8_t rr[LDNS_RR_BUF_SIZE];
4316 	size_t rr_len, dname_len = 0;
4317 	struct sldns_file_parse_state pstate;
4318 	struct auth_chunk* chunk;
4319 	size_t chunk_pos;
4320 	int e;
4321 	memset(&pstate, 0, sizeof(pstate));
4322 	pstate.default_ttl = 3600;
4323 	if(xfr->namelen < sizeof(pstate.origin)) {
4324 		pstate.origin_len = xfr->namelen;
4325 		memmove(pstate.origin, xfr->name, xfr->namelen);
4326 	}
4327 	chunk = xfr->task_transfer->chunks_first;
4328 	chunk_pos = 0;
4329 	if(!chunkline_non_comment_RR(&chunk, &chunk_pos, buf, &pstate)) {
4330 		return 0;
4331 	}
4332 	rr_len = sizeof(rr);
4333 	e=sldns_str2wire_rr_buf((char*)sldns_buffer_begin(buf), rr, &rr_len,
4334 		&dname_len, pstate.default_ttl,
4335 		pstate.origin_len?pstate.origin:NULL, pstate.origin_len,
4336 		pstate.prev_rr_len?pstate.prev_rr:NULL, pstate.prev_rr_len);
4337 	if(e != 0) {
4338 		log_err("parse failure on first RR[%d]: %s",
4339 			LDNS_WIREPARSE_OFFSET(e),
4340 			sldns_get_errorstr_parse(LDNS_WIREPARSE_ERROR(e)));
4341 		return 0;
4342 	}
4343 	/* check that class is correct */
4344 	if(sldns_wirerr_get_class(rr, rr_len, dname_len) != xfr->dclass) {
4345 		log_err("parse failure: first record in downloaded zonefile "
4346 			"from wrong RR class");
4347 		return 0;
4348 	}
4349 	return 1;
4350 }
4351 
4352 /** sum sizes of chunklist */
4353 static size_t
4354 chunklist_sum(struct auth_chunk* list)
4355 {
4356 	struct auth_chunk* p;
4357 	size_t s = 0;
4358 	for(p=list; p; p=p->next) {
4359 		s += p->len;
4360 	}
4361 	return s;
4362 }
4363 
4364 /** remove newlines from collated line */
4365 static void
4366 chunkline_newline_removal(sldns_buffer* buf)
4367 {
4368 	size_t i, end=sldns_buffer_limit(buf);
4369 	for(i=0; i<end; i++) {
4370 		char c = (char)sldns_buffer_read_u8_at(buf, i);
4371 		if(c == '\n' && i==end-1) {
4372 			sldns_buffer_write_u8_at(buf, i, 0);
4373 			sldns_buffer_set_limit(buf, end-1);
4374 			return;
4375 		}
4376 		if(c == '\n')
4377 			sldns_buffer_write_u8_at(buf, i, (uint8_t)' ');
4378 	}
4379 }
4380 
4381 /** for http download, parse and add RR to zone */
4382 static int
4383 http_parse_add_rr(struct auth_xfer* xfr, struct auth_zone* z,
4384 	sldns_buffer* buf, struct sldns_file_parse_state* pstate)
4385 {
4386 	uint8_t rr[LDNS_RR_BUF_SIZE];
4387 	size_t rr_len, dname_len = 0;
4388 	int e;
4389 	char* line = (char*)sldns_buffer_begin(buf);
4390 	rr_len = sizeof(rr);
4391 	e = sldns_str2wire_rr_buf(line, rr, &rr_len, &dname_len,
4392 		pstate->default_ttl,
4393 		pstate->origin_len?pstate->origin:NULL, pstate->origin_len,
4394 		pstate->prev_rr_len?pstate->prev_rr:NULL, pstate->prev_rr_len);
4395 	if(e != 0) {
4396 		log_err("%s/%s parse failure RR[%d]: %s in '%s'",
4397 			xfr->task_transfer->master->host,
4398 			xfr->task_transfer->master->file,
4399 			LDNS_WIREPARSE_OFFSET(e),
4400 			sldns_get_errorstr_parse(LDNS_WIREPARSE_ERROR(e)),
4401 			line);
4402 		return 0;
4403 	}
4404 	if(rr_len == 0)
4405 		return 1; /* empty line or so */
4406 
4407 	/* set prev */
4408 	if(dname_len < sizeof(pstate->prev_rr)) {
4409 		memmove(pstate->prev_rr, rr, dname_len);
4410 		pstate->prev_rr_len = dname_len;
4411 	}
4412 
4413 	return az_insert_rr(z, rr, rr_len, dname_len, NULL);
4414 }
4415 
4416 /** RR list iterator, returns RRs from answer section one by one from the
4417  * dns packets in the chunklist */
4418 static void
4419 chunk_rrlist_start(struct auth_xfer* xfr, struct auth_chunk** rr_chunk,
4420 	int* rr_num, size_t* rr_pos)
4421 {
4422 	*rr_chunk = xfr->task_transfer->chunks_first;
4423 	*rr_num = 0;
4424 	*rr_pos = 0;
4425 }
4426 
4427 /** RR list iterator, see if we are at the end of the list */
4428 static int
4429 chunk_rrlist_end(struct auth_chunk* rr_chunk, int rr_num)
4430 {
4431 	while(rr_chunk) {
4432 		if(rr_chunk->len < LDNS_HEADER_SIZE)
4433 			return 1;
4434 		if(rr_num < (int)LDNS_ANCOUNT(rr_chunk->data))
4435 			return 0;
4436 		/* no more RRs in this chunk */
4437 		/* continue with next chunk, see if it has RRs */
4438 		rr_chunk = rr_chunk->next;
4439 		rr_num = 0;
4440 	}
4441 	return 1;
4442 }
4443 
4444 /** RR list iterator, move to next RR */
4445 static void
4446 chunk_rrlist_gonext(struct auth_chunk** rr_chunk, int* rr_num,
4447 	size_t* rr_pos, size_t rr_nextpos)
4448 {
4449 	/* already at end of chunks? */
4450 	if(!*rr_chunk)
4451 		return;
4452 	/* move within this chunk */
4453 	if((*rr_chunk)->len >= LDNS_HEADER_SIZE &&
4454 		(*rr_num)+1 < (int)LDNS_ANCOUNT((*rr_chunk)->data)) {
4455 		(*rr_num) += 1;
4456 		*rr_pos = rr_nextpos;
4457 		return;
4458 	}
4459 	/* no more RRs in this chunk */
4460 	/* continue with next chunk, see if it has RRs */
4461 	if(*rr_chunk)
4462 		*rr_chunk = (*rr_chunk)->next;
4463 	while(*rr_chunk) {
4464 		*rr_num = 0;
4465 		*rr_pos = 0;
4466 		if((*rr_chunk)->len >= LDNS_HEADER_SIZE &&
4467 			LDNS_ANCOUNT((*rr_chunk)->data) > 0) {
4468 			return;
4469 		}
4470 		*rr_chunk = (*rr_chunk)->next;
4471 	}
4472 }
4473 
4474 /** RR iterator, get current RR information, false on parse error */
4475 static int
4476 chunk_rrlist_get_current(struct auth_chunk* rr_chunk, int rr_num,
4477 	size_t rr_pos, uint8_t** rr_dname, uint16_t* rr_type,
4478 	uint16_t* rr_class, uint32_t* rr_ttl, uint16_t* rr_rdlen,
4479 	uint8_t** rr_rdata, size_t* rr_nextpos)
4480 {
4481 	sldns_buffer pkt;
4482 	/* integrity checks on position */
4483 	if(!rr_chunk) return 0;
4484 	if(rr_chunk->len < LDNS_HEADER_SIZE) return 0;
4485 	if(rr_num >= (int)LDNS_ANCOUNT(rr_chunk->data)) return 0;
4486 	if(rr_pos >= rr_chunk->len) return 0;
4487 
4488 	/* fetch rr information */
4489 	sldns_buffer_init_frm_data(&pkt, rr_chunk->data, rr_chunk->len);
4490 	if(rr_pos == 0) {
4491 		size_t i;
4492 		/* skip question section */
4493 		sldns_buffer_set_position(&pkt, LDNS_HEADER_SIZE);
4494 		for(i=0; i<LDNS_QDCOUNT(rr_chunk->data); i++) {
4495 			if(pkt_dname_len(&pkt) == 0) return 0;
4496 			if(sldns_buffer_remaining(&pkt) < 4) return 0;
4497 			sldns_buffer_skip(&pkt, 4); /* type and class */
4498 		}
4499 	} else	{
4500 		sldns_buffer_set_position(&pkt, rr_pos);
4501 	}
4502 	*rr_dname = sldns_buffer_current(&pkt);
4503 	if(pkt_dname_len(&pkt) == 0) return 0;
4504 	if(sldns_buffer_remaining(&pkt) < 10) return 0;
4505 	*rr_type = sldns_buffer_read_u16(&pkt);
4506 	*rr_class = sldns_buffer_read_u16(&pkt);
4507 	*rr_ttl = sldns_buffer_read_u32(&pkt);
4508 	*rr_rdlen = sldns_buffer_read_u16(&pkt);
4509 	if(sldns_buffer_remaining(&pkt) < (*rr_rdlen)) return 0;
4510 	*rr_rdata = sldns_buffer_current(&pkt);
4511 	sldns_buffer_skip(&pkt, (ssize_t)(*rr_rdlen));
4512 	*rr_nextpos = sldns_buffer_position(&pkt);
4513 	return 1;
4514 }
4515 
4516 /** print log message where we are in parsing the zone transfer */
4517 static void
4518 log_rrlist_position(const char* label, struct auth_chunk* rr_chunk,
4519 	uint8_t* rr_dname, uint16_t rr_type, size_t rr_counter)
4520 {
4521 	sldns_buffer pkt;
4522 	size_t dlen;
4523 	uint8_t buf[256];
4524 	char str[256];
4525 	char typestr[32];
4526 	sldns_buffer_init_frm_data(&pkt, rr_chunk->data, rr_chunk->len);
4527 	sldns_buffer_set_position(&pkt, (size_t)(rr_dname -
4528 		sldns_buffer_begin(&pkt)));
4529 	if((dlen=pkt_dname_len(&pkt)) == 0) return;
4530 	if(dlen >= sizeof(buf)) return;
4531 	dname_pkt_copy(&pkt, buf, rr_dname);
4532 	dname_str(buf, str);
4533 	(void)sldns_wire2str_type_buf(rr_type, typestr, sizeof(typestr));
4534 	verbose(VERB_ALGO, "%s at[%d] %s %s", label, (int)rr_counter,
4535 		str, typestr);
4536 }
4537 
4538 /** check that start serial is OK for ixfr. we are at rr_counter == 0,
4539  * and we are going to check rr_counter == 1 (has to be type SOA) serial */
4540 static int
4541 ixfr_start_serial(struct auth_chunk* rr_chunk, int rr_num, size_t rr_pos,
4542 	uint8_t* rr_dname, uint16_t rr_type, uint16_t rr_class,
4543 	uint32_t rr_ttl, uint16_t rr_rdlen, uint8_t* rr_rdata,
4544 	size_t rr_nextpos, uint32_t transfer_serial, uint32_t xfr_serial)
4545 {
4546 	uint32_t startserial;
4547 	/* move forward on RR */
4548 	chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos);
4549 	if(chunk_rrlist_end(rr_chunk, rr_num)) {
4550 		/* no second SOA */
4551 		verbose(VERB_OPS, "IXFR has no second SOA record");
4552 		return 0;
4553 	}
4554 	if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos,
4555 		&rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen,
4556 		&rr_rdata, &rr_nextpos)) {
4557 		verbose(VERB_OPS, "IXFR cannot parse second SOA record");
4558 		/* failed to parse RR */
4559 		return 0;
4560 	}
4561 	if(rr_type != LDNS_RR_TYPE_SOA) {
4562 		verbose(VERB_OPS, "IXFR second record is not type SOA");
4563 		return 0;
4564 	}
4565 	if(rr_rdlen < 22) {
4566 		verbose(VERB_OPS, "IXFR, second SOA has short rdlength");
4567 		return 0; /* bad SOA rdlen */
4568 	}
4569 	startserial = sldns_read_uint32(rr_rdata+rr_rdlen-20);
4570 	if(startserial == transfer_serial) {
4571 		/* empty AXFR, not an IXFR */
4572 		verbose(VERB_OPS, "IXFR second serial same as first");
4573 		return 0;
4574 	}
4575 	if(startserial != xfr_serial) {
4576 		/* wrong start serial, it does not match the serial in
4577 		 * memory */
4578 		verbose(VERB_OPS, "IXFR is from serial %u to %u but %u "
4579 			"in memory, rejecting the zone transfer",
4580 			(unsigned)startserial, (unsigned)transfer_serial,
4581 			(unsigned)xfr_serial);
4582 		return 0;
4583 	}
4584 	/* everything OK in second SOA serial */
4585 	return 1;
4586 }
4587 
4588 /** apply IXFR to zone in memory. z is locked. false on failure(mallocfail) */
4589 static int
4590 apply_ixfr(struct auth_xfer* xfr, struct auth_zone* z,
4591 	struct sldns_buffer* scratch_buffer)
4592 {
4593 	struct auth_chunk* rr_chunk;
4594 	int rr_num;
4595 	size_t rr_pos;
4596 	uint8_t* rr_dname, *rr_rdata;
4597 	uint16_t rr_type, rr_class, rr_rdlen;
4598 	uint32_t rr_ttl;
4599 	size_t rr_nextpos;
4600 	int have_transfer_serial = 0;
4601 	uint32_t transfer_serial = 0;
4602 	size_t rr_counter = 0;
4603 	int delmode = 0;
4604 	int softfail = 0;
4605 
4606 	/* start RR iterator over chunklist of packets */
4607 	chunk_rrlist_start(xfr, &rr_chunk, &rr_num, &rr_pos);
4608 	while(!chunk_rrlist_end(rr_chunk, rr_num)) {
4609 		if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos,
4610 			&rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen,
4611 			&rr_rdata, &rr_nextpos)) {
4612 			/* failed to parse RR */
4613 			return 0;
4614 		}
4615 		if(verbosity>=7) log_rrlist_position("apply ixfr",
4616 			rr_chunk, rr_dname, rr_type, rr_counter);
4617 		/* twiddle add/del mode and check for start and end */
4618 		if(rr_counter == 0 && rr_type != LDNS_RR_TYPE_SOA)
4619 			return 0;
4620 		if(rr_counter == 1 && rr_type != LDNS_RR_TYPE_SOA) {
4621 			/* this is an AXFR returned from the IXFR master */
4622 			/* but that should already have been detected, by
4623 			 * on_ixfr_is_axfr */
4624 			return 0;
4625 		}
4626 		if(rr_type == LDNS_RR_TYPE_SOA) {
4627 			uint32_t serial;
4628 			if(rr_rdlen < 22) return 0; /* bad SOA rdlen */
4629 			serial = sldns_read_uint32(rr_rdata+rr_rdlen-20);
4630 			if(have_transfer_serial == 0) {
4631 				have_transfer_serial = 1;
4632 				transfer_serial = serial;
4633 				delmode = 1; /* gets negated below */
4634 				/* check second RR before going any further */
4635 				if(!ixfr_start_serial(rr_chunk, rr_num, rr_pos,
4636 					rr_dname, rr_type, rr_class, rr_ttl,
4637 					rr_rdlen, rr_rdata, rr_nextpos,
4638 					transfer_serial, xfr->serial)) {
4639 					return 0;
4640 				}
4641 			} else if(transfer_serial == serial) {
4642 				have_transfer_serial++;
4643 				if(rr_counter == 1) {
4644 					/* empty AXFR, with SOA; SOA; */
4645 					/* should have been detected by
4646 					 * on_ixfr_is_axfr */
4647 					return 0;
4648 				}
4649 				if(have_transfer_serial == 3) {
4650 					/* see serial three times for end */
4651 					/* eg. IXFR:
4652 					 *  SOA 3 start
4653 					 *  SOA 1 second RR, followed by del
4654 					 *  SOA 2 followed by add
4655 					 *  SOA 2 followed by del
4656 					 *  SOA 3 followed by add
4657 					 *  SOA 3 end */
4658 					/* ended by SOA record */
4659 					xfr->serial = transfer_serial;
4660 					break;
4661 				}
4662 			}
4663 			/* twiddle add/del mode */
4664 			/* switch from delete part to add part and back again
4665 			 * just before the soa, it gets deleted and added too
4666 			 * this means we switch to delete mode for the final
4667 			 * SOA(so skip that one) */
4668 			delmode = !delmode;
4669 		}
4670 		/* process this RR */
4671 		/* if the RR is deleted twice or added twice, then we
4672 		 * softfail, and continue with the rest of the IXFR, so
4673 		 * that we serve something fairly nice during the refetch */
4674 		if(verbosity>=7) log_rrlist_position((delmode?"del":"add"),
4675 			rr_chunk, rr_dname, rr_type, rr_counter);
4676 		if(delmode) {
4677 			/* delete this RR */
4678 			int nonexist = 0;
4679 			if(!az_remove_rr_decompress(z, rr_chunk->data,
4680 				rr_chunk->len, scratch_buffer, rr_dname,
4681 				rr_type, rr_class, rr_ttl, rr_rdata, rr_rdlen,
4682 				&nonexist)) {
4683 				/* failed, malloc error or so */
4684 				return 0;
4685 			}
4686 			if(nonexist) {
4687 				/* it was removal of a nonexisting RR */
4688 				if(verbosity>=4) log_rrlist_position(
4689 					"IXFR error nonexistent RR",
4690 					rr_chunk, rr_dname, rr_type, rr_counter);
4691 				softfail = 1;
4692 			}
4693 		} else if(rr_counter != 0) {
4694 			/* skip first SOA RR for addition, it is added in
4695 			 * the addition part near the end of the ixfr, when
4696 			 * that serial is seen the second time. */
4697 			int duplicate = 0;
4698 			/* add this RR */
4699 			if(!az_insert_rr_decompress(z, rr_chunk->data,
4700 				rr_chunk->len, scratch_buffer, rr_dname,
4701 				rr_type, rr_class, rr_ttl, rr_rdata, rr_rdlen,
4702 				&duplicate)) {
4703 				/* failed, malloc error or so */
4704 				return 0;
4705 			}
4706 			if(duplicate) {
4707 				/* it was a duplicate */
4708 				if(verbosity>=4) log_rrlist_position(
4709 					"IXFR error duplicate RR",
4710 					rr_chunk, rr_dname, rr_type, rr_counter);
4711 				softfail = 1;
4712 			}
4713 		}
4714 
4715 		rr_counter++;
4716 		chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos);
4717 	}
4718 	if(softfail) {
4719 		verbose(VERB_ALGO, "IXFR did not apply cleanly, fetching full zone");
4720 		return 0;
4721 	}
4722 	return 1;
4723 }
4724 
4725 /** apply AXFR to zone in memory. z is locked. false on failure(mallocfail) */
4726 static int
4727 apply_axfr(struct auth_xfer* xfr, struct auth_zone* z,
4728 	struct sldns_buffer* scratch_buffer)
4729 {
4730 	struct auth_chunk* rr_chunk;
4731 	int rr_num;
4732 	size_t rr_pos;
4733 	uint8_t* rr_dname, *rr_rdata;
4734 	uint16_t rr_type, rr_class, rr_rdlen;
4735 	uint32_t rr_ttl;
4736 	uint32_t serial = 0;
4737 	size_t rr_nextpos;
4738 	size_t rr_counter = 0;
4739 	int have_end_soa = 0;
4740 
4741 	/* clear the data tree */
4742 	traverse_postorder(&z->data, auth_data_del, NULL);
4743 	rbtree_init(&z->data, &auth_data_cmp);
4744 	/* clear the RPZ policies */
4745 	if(z->rpz)
4746 		rpz_clear(z->rpz);
4747 
4748 	xfr->have_zone = 0;
4749 	xfr->serial = 0;
4750 
4751 	/* insert all RRs in to the zone */
4752 	/* insert the SOA only once, skip the last one */
4753 	/* start RR iterator over chunklist of packets */
4754 	chunk_rrlist_start(xfr, &rr_chunk, &rr_num, &rr_pos);
4755 	while(!chunk_rrlist_end(rr_chunk, rr_num)) {
4756 		if(!chunk_rrlist_get_current(rr_chunk, rr_num, rr_pos,
4757 			&rr_dname, &rr_type, &rr_class, &rr_ttl, &rr_rdlen,
4758 			&rr_rdata, &rr_nextpos)) {
4759 			/* failed to parse RR */
4760 			return 0;
4761 		}
4762 		if(verbosity>=7) log_rrlist_position("apply_axfr",
4763 			rr_chunk, rr_dname, rr_type, rr_counter);
4764 		if(rr_type == LDNS_RR_TYPE_SOA) {
4765 			if(rr_counter != 0) {
4766 				/* end of the axfr */
4767 				have_end_soa = 1;
4768 				break;
4769 			}
4770 			if(rr_rdlen < 22) return 0; /* bad SOA rdlen */
4771 			serial = sldns_read_uint32(rr_rdata+rr_rdlen-20);
4772 		}
4773 
4774 		/* add this RR */
4775 		if(!az_insert_rr_decompress(z, rr_chunk->data, rr_chunk->len,
4776 			scratch_buffer, rr_dname, rr_type, rr_class, rr_ttl,
4777 			rr_rdata, rr_rdlen, NULL)) {
4778 			/* failed, malloc error or so */
4779 			return 0;
4780 		}
4781 
4782 		rr_counter++;
4783 		chunk_rrlist_gonext(&rr_chunk, &rr_num, &rr_pos, rr_nextpos);
4784 	}
4785 	if(!have_end_soa) {
4786 		log_err("no end SOA record for AXFR");
4787 		return 0;
4788 	}
4789 
4790 	xfr->serial = serial;
4791 	xfr->have_zone = 1;
4792 	return 1;
4793 }
4794 
4795 /** apply HTTP to zone in memory. z is locked. false on failure(mallocfail) */
4796 static int
4797 apply_http(struct auth_xfer* xfr, struct auth_zone* z,
4798 	struct sldns_buffer* scratch_buffer)
4799 {
4800 	/* parse data in chunks */
4801 	/* parse RR's and read into memory. ignore $INCLUDE from the
4802 	 * downloaded file*/
4803 	struct sldns_file_parse_state pstate;
4804 	struct auth_chunk* chunk;
4805 	size_t chunk_pos;
4806 	memset(&pstate, 0, sizeof(pstate));
4807 	pstate.default_ttl = 3600;
4808 	if(xfr->namelen < sizeof(pstate.origin)) {
4809 		pstate.origin_len = xfr->namelen;
4810 		memmove(pstate.origin, xfr->name, xfr->namelen);
4811 	}
4812 
4813 	if(verbosity >= VERB_ALGO)
4814 		verbose(VERB_ALGO, "http download %s of size %d",
4815 		xfr->task_transfer->master->file,
4816 		(int)chunklist_sum(xfr->task_transfer->chunks_first));
4817 	if(xfr->task_transfer->chunks_first && verbosity >= VERB_ALGO) {
4818 		char preview[1024];
4819 		if(xfr->task_transfer->chunks_first->len+1 > sizeof(preview)) {
4820 			memmove(preview, xfr->task_transfer->chunks_first->data,
4821 				sizeof(preview)-1);
4822 			preview[sizeof(preview)-1]=0;
4823 		} else {
4824 			memmove(preview, xfr->task_transfer->chunks_first->data,
4825 				xfr->task_transfer->chunks_first->len);
4826 			preview[xfr->task_transfer->chunks_first->len]=0;
4827 		}
4828 		log_info("auth zone http downloaded content preview: %s",
4829 			preview);
4830 	}
4831 
4832 	/* perhaps a little syntax check before we try to apply the data? */
4833 	if(!http_zonefile_syntax_check(xfr, scratch_buffer)) {
4834 		log_err("http download %s/%s does not contain a zonefile, "
4835 			"but got '%s'", xfr->task_transfer->master->host,
4836 			xfr->task_transfer->master->file,
4837 			sldns_buffer_begin(scratch_buffer));
4838 		return 0;
4839 	}
4840 
4841 	/* clear the data tree */
4842 	traverse_postorder(&z->data, auth_data_del, NULL);
4843 	rbtree_init(&z->data, &auth_data_cmp);
4844 	/* clear the RPZ policies */
4845 	if(z->rpz)
4846 		rpz_clear(z->rpz);
4847 
4848 	xfr->have_zone = 0;
4849 	xfr->serial = 0;
4850 
4851 	chunk = xfr->task_transfer->chunks_first;
4852 	chunk_pos = 0;
4853 	pstate.lineno = 0;
4854 	while(chunkline_get_line_collated(&chunk, &chunk_pos, scratch_buffer)) {
4855 		/* process this line */
4856 		pstate.lineno++;
4857 		chunkline_newline_removal(scratch_buffer);
4858 		if(chunkline_is_comment_line_or_empty(scratch_buffer)) {
4859 			continue;
4860 		}
4861 		/* parse line and add RR */
4862 		if(http_parse_origin(scratch_buffer, &pstate)) {
4863 			continue; /* $ORIGIN has been handled */
4864 		}
4865 		if(http_parse_ttl(scratch_buffer, &pstate)) {
4866 			continue; /* $TTL has been handled */
4867 		}
4868 		if(!http_parse_add_rr(xfr, z, scratch_buffer, &pstate)) {
4869 			verbose(VERB_ALGO, "error parsing line [%s:%d] %s",
4870 				xfr->task_transfer->master->file,
4871 				pstate.lineno,
4872 				sldns_buffer_begin(scratch_buffer));
4873 			return 0;
4874 		}
4875 	}
4876 	return 1;
4877 }
4878 
4879 /** write http chunks to zonefile to create downloaded file */
4880 static int
4881 auth_zone_write_chunks(struct auth_xfer* xfr, const char* fname)
4882 {
4883 	FILE* out;
4884 	struct auth_chunk* p;
4885 	out = fopen(fname, "w");
4886 	if(!out) {
4887 		log_err("could not open %s: %s", fname, strerror(errno));
4888 		return 0;
4889 	}
4890 	for(p = xfr->task_transfer->chunks_first; p ; p = p->next) {
4891 		if(!write_out(out, (char*)p->data, p->len)) {
4892 			log_err("could not write http download to %s", fname);
4893 			fclose(out);
4894 			return 0;
4895 		}
4896 	}
4897 	fclose(out);
4898 	return 1;
4899 }
4900 
4901 /** write to zonefile after zone has been updated */
4902 static void
4903 xfr_write_after_update(struct auth_xfer* xfr, struct module_env* env)
4904 {
4905 	struct config_file* cfg = env->cfg;
4906 	struct auth_zone* z;
4907 	char tmpfile[1024];
4908 	char* zfilename;
4909 	lock_basic_unlock(&xfr->lock);
4910 
4911 	/* get lock again, so it is a readlock and concurrently queries
4912 	 * can be answered */
4913 	lock_rw_rdlock(&env->auth_zones->lock);
4914 	z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen,
4915 		xfr->dclass);
4916 	if(!z) {
4917 		lock_rw_unlock(&env->auth_zones->lock);
4918 		/* the zone is gone, ignore xfr results */
4919 		lock_basic_lock(&xfr->lock);
4920 		return;
4921 	}
4922 	lock_rw_rdlock(&z->lock);
4923 	lock_basic_lock(&xfr->lock);
4924 	lock_rw_unlock(&env->auth_zones->lock);
4925 
4926 	if(z->zonefile == NULL || z->zonefile[0] == 0) {
4927 		lock_rw_unlock(&z->lock);
4928 		/* no write needed, no zonefile set */
4929 		return;
4930 	}
4931 	zfilename = z->zonefile;
4932 	if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(zfilename,
4933 		cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
4934 		zfilename += strlen(cfg->chrootdir);
4935 	if(verbosity >= VERB_ALGO) {
4936 		char nm[255+1];
4937 		dname_str(z->name, nm);
4938 		verbose(VERB_ALGO, "write zonefile %s for %s", zfilename, nm);
4939 	}
4940 
4941 	/* write to tempfile first */
4942 	if((size_t)strlen(zfilename) + 16 > sizeof(tmpfile)) {
4943 		verbose(VERB_ALGO, "tmpfilename too long, cannot update "
4944 			" zonefile %s", zfilename);
4945 		lock_rw_unlock(&z->lock);
4946 		return;
4947 	}
4948 	snprintf(tmpfile, sizeof(tmpfile), "%s.tmp%u", zfilename,
4949 		(unsigned)getpid());
4950 	if(xfr->task_transfer->master->http) {
4951 		/* use the stored chunk list to write them */
4952 		if(!auth_zone_write_chunks(xfr, tmpfile)) {
4953 			unlink(tmpfile);
4954 			lock_rw_unlock(&z->lock);
4955 			return;
4956 		}
4957 	} else if(!auth_zone_write_file(z, tmpfile)) {
4958 		unlink(tmpfile);
4959 		lock_rw_unlock(&z->lock);
4960 		return;
4961 	}
4962 	if(rename(tmpfile, zfilename) < 0) {
4963 		log_err("could not rename(%s, %s): %s", tmpfile, zfilename,
4964 			strerror(errno));
4965 		unlink(tmpfile);
4966 		lock_rw_unlock(&z->lock);
4967 		return;
4968 	}
4969 	lock_rw_unlock(&z->lock);
4970 }
4971 
4972 /** process chunk list and update zone in memory,
4973  * return false if it did not work */
4974 static int
4975 xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
4976 	int* ixfr_fail)
4977 {
4978 	struct auth_zone* z;
4979 
4980 	/* obtain locks and structures */
4981 	/* release xfr lock, then, while holding az->lock grab both
4982 	 * z->lock and xfr->lock */
4983 	lock_basic_unlock(&xfr->lock);
4984 	lock_rw_rdlock(&env->auth_zones->lock);
4985 	z = auth_zone_find(env->auth_zones, xfr->name, xfr->namelen,
4986 		xfr->dclass);
4987 	if(!z) {
4988 		lock_rw_unlock(&env->auth_zones->lock);
4989 		/* the zone is gone, ignore xfr results */
4990 		lock_basic_lock(&xfr->lock);
4991 		return 0;
4992 	}
4993 	lock_rw_wrlock(&z->lock);
4994 	lock_basic_lock(&xfr->lock);
4995 	lock_rw_unlock(&env->auth_zones->lock);
4996 
4997 	/* apply data */
4998 	if(xfr->task_transfer->master->http) {
4999 		if(!apply_http(xfr, z, env->scratch_buffer)) {
5000 			lock_rw_unlock(&z->lock);
5001 			verbose(VERB_ALGO, "http from %s: could not store data",
5002 				xfr->task_transfer->master->host);
5003 			return 0;
5004 		}
5005 	} else if(xfr->task_transfer->on_ixfr &&
5006 		!xfr->task_transfer->on_ixfr_is_axfr) {
5007 		if(!apply_ixfr(xfr, z, env->scratch_buffer)) {
5008 			lock_rw_unlock(&z->lock);
5009 			verbose(VERB_ALGO, "xfr from %s: could not store IXFR"
5010 				" data", xfr->task_transfer->master->host);
5011 			*ixfr_fail = 1;
5012 			return 0;
5013 		}
5014 	} else {
5015 		if(!apply_axfr(xfr, z, env->scratch_buffer)) {
5016 			lock_rw_unlock(&z->lock);
5017 			verbose(VERB_ALGO, "xfr from %s: could not store AXFR"
5018 				" data", xfr->task_transfer->master->host);
5019 			return 0;
5020 		}
5021 	}
5022 	xfr->zone_expired = 0;
5023 	z->zone_expired = 0;
5024 	if(!xfr_find_soa(z, xfr)) {
5025 		lock_rw_unlock(&z->lock);
5026 		verbose(VERB_ALGO, "xfr from %s: no SOA in zone after update"
5027 			" (or malformed RR)", xfr->task_transfer->master->host);
5028 		return 0;
5029 	}
5030 	if(xfr->have_zone)
5031 		xfr->lease_time = *env->now;
5032 
5033 	if(z->rpz)
5034 		rpz_finish_config(z->rpz);
5035 
5036 	/* unlock */
5037 	lock_rw_unlock(&z->lock);
5038 
5039 	if(verbosity >= VERB_QUERY && xfr->have_zone) {
5040 		char zname[256];
5041 		dname_str(xfr->name, zname);
5042 		verbose(VERB_QUERY, "auth zone %s updated to serial %u", zname,
5043 			(unsigned)xfr->serial);
5044 	}
5045 	/* see if we need to write to a zonefile */
5046 	xfr_write_after_update(xfr, env);
5047 	return 1;
5048 }
5049 
5050 /** disown task_transfer.  caller must hold xfr.lock */
5051 static void
5052 xfr_transfer_disown(struct auth_xfer* xfr)
5053 {
5054 	/* remove timer (from this worker's event base) */
5055 	comm_timer_delete(xfr->task_transfer->timer);
5056 	xfr->task_transfer->timer = NULL;
5057 	/* remove the commpoint */
5058 	comm_point_delete(xfr->task_transfer->cp);
5059 	xfr->task_transfer->cp = NULL;
5060 	/* we don't own this item anymore */
5061 	xfr->task_transfer->worker = NULL;
5062 	xfr->task_transfer->env = NULL;
5063 }
5064 
5065 /** lookup a host name for its addresses, if needed */
5066 static int
5067 xfr_transfer_lookup_host(struct auth_xfer* xfr, struct module_env* env)
5068 {
5069 	struct sockaddr_storage addr;
5070 	socklen_t addrlen = 0;
5071 	struct auth_master* master = xfr->task_transfer->lookup_target;
5072 	struct query_info qinfo;
5073 	uint16_t qflags = BIT_RD;
5074 	uint8_t dname[LDNS_MAX_DOMAINLEN+1];
5075 	struct edns_data edns;
5076 	sldns_buffer* buf = env->scratch_buffer;
5077 	if(!master) return 0;
5078 	if(extstrtoaddr(master->host, &addr, &addrlen)) {
5079 		/* not needed, host is in IP addr format */
5080 		return 0;
5081 	}
5082 	if(master->allow_notify)
5083 		return 0; /* allow-notifies are not transferred from, no
5084 		lookup is needed */
5085 
5086 	/* use mesh_new_callback to probe for non-addr hosts,
5087 	 * and then wait for them to be looked up (in cache, or query) */
5088 	qinfo.qname_len = sizeof(dname);
5089 	if(sldns_str2wire_dname_buf(master->host, dname, &qinfo.qname_len)
5090 		!= 0) {
5091 		log_err("cannot parse host name of master %s", master->host);
5092 		return 0;
5093 	}
5094 	qinfo.qname = dname;
5095 	qinfo.qclass = xfr->dclass;
5096 	qinfo.qtype = LDNS_RR_TYPE_A;
5097 	if(xfr->task_transfer->lookup_aaaa)
5098 		qinfo.qtype = LDNS_RR_TYPE_AAAA;
5099 	qinfo.local_alias = NULL;
5100 	if(verbosity >= VERB_ALGO) {
5101 		char buf1[512];
5102 		char buf2[LDNS_MAX_DOMAINLEN+1];
5103 		dname_str(xfr->name, buf2);
5104 		snprintf(buf1, sizeof(buf1), "auth zone %s: master lookup"
5105 			" for task_transfer", buf2);
5106 		log_query_info(VERB_ALGO, buf1, &qinfo);
5107 	}
5108 	edns.edns_present = 1;
5109 	edns.ext_rcode = 0;
5110 	edns.edns_version = 0;
5111 	edns.bits = EDNS_DO;
5112 	edns.opt_list = NULL;
5113 	edns.padding_block_size = 0;
5114 	if(sldns_buffer_capacity(buf) < 65535)
5115 		edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
5116 	else	edns.udp_size = 65535;
5117 
5118 	/* unlock xfr during mesh_new_callback() because the callback can be
5119 	 * called straight away */
5120 	lock_basic_unlock(&xfr->lock);
5121 	if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
5122 		&auth_xfer_transfer_lookup_callback, xfr)) {
5123 		lock_basic_lock(&xfr->lock);
5124 		log_err("out of memory lookup up master %s", master->host);
5125 		return 0;
5126 	}
5127 	lock_basic_lock(&xfr->lock);
5128 	return 1;
5129 }
5130 
5131 /** initiate TCP to the target and fetch zone.
5132  * returns true if that was successfully started, and timeout setup. */
5133 static int
5134 xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
5135 {
5136 	struct sockaddr_storage addr;
5137 	socklen_t addrlen = 0;
5138 	struct auth_master* master = xfr->task_transfer->master;
5139 	char *auth_name = NULL;
5140 	struct timeval t;
5141 	int timeout;
5142 	if(!master) return 0;
5143 	if(master->allow_notify) return 0; /* only for notify */
5144 
5145 	/* get master addr */
5146 	if(xfr->task_transfer->scan_addr) {
5147 		addrlen = xfr->task_transfer->scan_addr->addrlen;
5148 		memmove(&addr, &xfr->task_transfer->scan_addr->addr, addrlen);
5149 	} else {
5150 		if(!authextstrtoaddr(master->host, &addr, &addrlen, &auth_name)) {
5151 			/* the ones that are not in addr format are supposed
5152 			 * to be looked up.  The lookup has failed however,
5153 			 * so skip them */
5154 			char zname[255+1];
5155 			dname_str(xfr->name, zname);
5156 			log_err("%s: failed lookup, cannot transfer from master %s",
5157 				zname, master->host);
5158 			return 0;
5159 		}
5160 	}
5161 
5162 	/* remove previous TCP connection (if any) */
5163 	if(xfr->task_transfer->cp) {
5164 		comm_point_delete(xfr->task_transfer->cp);
5165 		xfr->task_transfer->cp = NULL;
5166 	}
5167 	if(!xfr->task_transfer->timer) {
5168 		xfr->task_transfer->timer = comm_timer_create(env->worker_base,
5169 			auth_xfer_transfer_timer_callback, xfr);
5170 		if(!xfr->task_transfer->timer) {
5171 			log_err("malloc failure");
5172 			return 0;
5173 		}
5174 	}
5175 	timeout = AUTH_TRANSFER_TIMEOUT;
5176 #ifndef S_SPLINT_S
5177         t.tv_sec = timeout/1000;
5178         t.tv_usec = (timeout%1000)*1000;
5179 #endif
5180 
5181 	if(master->http) {
5182 		/* perform http fetch */
5183 		/* store http port number into sockaddr,
5184 		 * unless someone used unbound's host@port notation */
5185 		xfr->task_transfer->on_ixfr = 0;
5186 		if(strchr(master->host, '@') == NULL)
5187 			sockaddr_store_port(&addr, addrlen, master->port);
5188 		xfr->task_transfer->cp = outnet_comm_point_for_http(
5189 			env->outnet, auth_xfer_transfer_http_callback, xfr,
5190 			&addr, addrlen, -1, master->ssl, master->host,
5191 			master->file);
5192 		if(!xfr->task_transfer->cp) {
5193 			char zname[255+1], as[256];
5194 			dname_str(xfr->name, zname);
5195 			addr_to_str(&addr, addrlen, as, sizeof(as));
5196 			verbose(VERB_ALGO, "cannot create http cp "
5197 				"connection for %s to %s", zname, as);
5198 			return 0;
5199 		}
5200 		comm_timer_set(xfr->task_transfer->timer, &t);
5201 		if(verbosity >= VERB_ALGO) {
5202 			char zname[255+1], as[256];
5203 			dname_str(xfr->name, zname);
5204 			addr_to_str(&addr, addrlen, as, sizeof(as));
5205 			verbose(VERB_ALGO, "auth zone %s transfer next HTTP fetch from %s started", zname, as);
5206 		}
5207 		return 1;
5208 	}
5209 
5210 	/* perform AXFR/IXFR */
5211 	/* set the packet to be written */
5212 	/* create new ID */
5213 	xfr->task_transfer->id = (uint16_t)(ub_random(env->rnd)&0xffff);
5214 	xfr_create_ixfr_packet(xfr, env->scratch_buffer,
5215 		xfr->task_transfer->id, master);
5216 
5217 	/* connect on fd */
5218 	xfr->task_transfer->cp = outnet_comm_point_for_tcp(env->outnet,
5219 		auth_xfer_transfer_tcp_callback, xfr, &addr, addrlen,
5220 		env->scratch_buffer, -1,
5221 		auth_name != NULL, auth_name);
5222 	if(!xfr->task_transfer->cp) {
5223 		char zname[255+1], as[256];
5224  		dname_str(xfr->name, zname);
5225 		addr_to_str(&addr, addrlen, as, sizeof(as));
5226 		verbose(VERB_ALGO, "cannot create tcp cp connection for "
5227 			"xfr %s to %s", zname, as);
5228 		return 0;
5229 	}
5230 	comm_timer_set(xfr->task_transfer->timer, &t);
5231 	if(verbosity >= VERB_ALGO) {
5232 		char zname[255+1], as[256];
5233  		dname_str(xfr->name, zname);
5234 		addr_to_str(&addr, addrlen, as, sizeof(as));
5235 		verbose(VERB_ALGO, "auth zone %s transfer next %s fetch from %s started", zname,
5236 			(xfr->task_transfer->on_ixfr?"IXFR":"AXFR"), as);
5237 	}
5238 	return 1;
5239 }
5240 
5241 /** perform next lookup, next transfer TCP, or end and resume wait time task */
5242 static void
5243 xfr_transfer_nexttarget_or_end(struct auth_xfer* xfr, struct module_env* env)
5244 {
5245 	log_assert(xfr->task_transfer->worker == env->worker);
5246 
5247 	/* are we performing lookups? */
5248 	while(xfr->task_transfer->lookup_target) {
5249 		if(xfr_transfer_lookup_host(xfr, env)) {
5250 			/* wait for lookup to finish,
5251 			 * note that the hostname may be in unbound's cache
5252 			 * and we may then get an instant cache response,
5253 			 * and that calls the callback just like a full
5254 			 * lookup and lookup failures also call callback */
5255 			if(verbosity >= VERB_ALGO) {
5256 				char zname[255+1];
5257 				dname_str(xfr->name, zname);
5258 				verbose(VERB_ALGO, "auth zone %s transfer next target lookup", zname);
5259 			}
5260 			lock_basic_unlock(&xfr->lock);
5261 			return;
5262 		}
5263 		xfr_transfer_move_to_next_lookup(xfr, env);
5264 	}
5265 
5266 	/* initiate TCP and fetch the zone from the master */
5267 	/* and set timeout on it */
5268 	while(!xfr_transfer_end_of_list(xfr)) {
5269 		xfr->task_transfer->master = xfr_transfer_current_master(xfr);
5270 		if(xfr_transfer_init_fetch(xfr, env)) {
5271 			/* successfully started, wait for callback */
5272 			lock_basic_unlock(&xfr->lock);
5273 			return;
5274 		}
5275 		/* failed to fetch, next master */
5276 		xfr_transfer_nextmaster(xfr);
5277 	}
5278 	if(verbosity >= VERB_ALGO) {
5279 		char zname[255+1];
5280 		dname_str(xfr->name, zname);
5281 		verbose(VERB_ALGO, "auth zone %s transfer failed, wait", zname);
5282 	}
5283 
5284 	/* we failed to fetch the zone, move to wait task
5285 	 * use the shorter retry timeout */
5286 	xfr_transfer_disown(xfr);
5287 
5288 	/* pick up the nextprobe task and wait */
5289 	if(xfr->task_nextprobe->worker == NULL)
5290 		xfr_set_timeout(xfr, env, 1, 0);
5291 	lock_basic_unlock(&xfr->lock);
5292 }
5293 
5294 /** add addrs from A or AAAA rrset to the master */
5295 static void
5296 xfr_master_add_addrs(struct auth_master* m, struct ub_packed_rrset_key* rrset,
5297 	uint16_t rrtype)
5298 {
5299 	size_t i;
5300 	struct packed_rrset_data* data;
5301 	if(!m || !rrset) return;
5302 	if(rrtype != LDNS_RR_TYPE_A && rrtype != LDNS_RR_TYPE_AAAA)
5303 		return;
5304 	data = (struct packed_rrset_data*)rrset->entry.data;
5305 	for(i=0; i<data->count; i++) {
5306 		struct auth_addr* a;
5307 		size_t len = data->rr_len[i] - 2;
5308 		uint8_t* rdata = data->rr_data[i]+2;
5309 		if(rrtype == LDNS_RR_TYPE_A && len != INET_SIZE)
5310 			continue; /* wrong length for A */
5311 		if(rrtype == LDNS_RR_TYPE_AAAA && len != INET6_SIZE)
5312 			continue; /* wrong length for AAAA */
5313 
5314 		/* add and alloc it */
5315 		a = (struct auth_addr*)calloc(1, sizeof(*a));
5316 		if(!a) {
5317 			log_err("out of memory");
5318 			return;
5319 		}
5320 		if(rrtype == LDNS_RR_TYPE_A) {
5321 			struct sockaddr_in* sa;
5322 			a->addrlen = (socklen_t)sizeof(*sa);
5323 			sa = (struct sockaddr_in*)&a->addr;
5324 			sa->sin_family = AF_INET;
5325 			sa->sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
5326 			memmove(&sa->sin_addr, rdata, INET_SIZE);
5327 		} else {
5328 			struct sockaddr_in6* sa;
5329 			a->addrlen = (socklen_t)sizeof(*sa);
5330 			sa = (struct sockaddr_in6*)&a->addr;
5331 			sa->sin6_family = AF_INET6;
5332 			sa->sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
5333 			memmove(&sa->sin6_addr, rdata, INET6_SIZE);
5334 		}
5335 		if(verbosity >= VERB_ALGO) {
5336 			char s[64];
5337 			addr_to_str(&a->addr, a->addrlen, s, sizeof(s));
5338 			verbose(VERB_ALGO, "auth host %s lookup %s",
5339 				m->host, s);
5340 		}
5341 		/* append to list */
5342 		a->next = m->list;
5343 		m->list = a;
5344 	}
5345 }
5346 
5347 /** callback for task_transfer lookup of host name, of A or AAAA */
5348 void auth_xfer_transfer_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
5349 	enum sec_status ATTR_UNUSED(sec), char* ATTR_UNUSED(why_bogus),
5350 	int ATTR_UNUSED(was_ratelimited))
5351 {
5352 	struct auth_xfer* xfr = (struct auth_xfer*)arg;
5353 	struct module_env* env;
5354 	log_assert(xfr->task_transfer);
5355 	lock_basic_lock(&xfr->lock);
5356 	env = xfr->task_transfer->env;
5357 	if(!env || env->outnet->want_to_quit) {
5358 		lock_basic_unlock(&xfr->lock);
5359 		return; /* stop on quit */
5360 	}
5361 
5362 	/* process result */
5363 	if(rcode == LDNS_RCODE_NOERROR) {
5364 		uint16_t wanted_qtype = LDNS_RR_TYPE_A;
5365 		struct regional* temp = env->scratch;
5366 		struct query_info rq;
5367 		struct reply_info* rep;
5368 		if(xfr->task_transfer->lookup_aaaa)
5369 			wanted_qtype = LDNS_RR_TYPE_AAAA;
5370 		memset(&rq, 0, sizeof(rq));
5371 		rep = parse_reply_in_temp_region(buf, temp, &rq);
5372 		if(rep && rq.qtype == wanted_qtype &&
5373 			FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR) {
5374 			/* parsed successfully */
5375 			struct ub_packed_rrset_key* answer =
5376 				reply_find_answer_rrset(&rq, rep);
5377 			if(answer) {
5378 				xfr_master_add_addrs(xfr->task_transfer->
5379 					lookup_target, answer, wanted_qtype);
5380 			} else {
5381 				if(verbosity >= VERB_ALGO) {
5382 					char zname[255+1];
5383 					dname_str(xfr->name, zname);
5384 					verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup has nodata", zname, xfr->task_transfer->lookup_target->host, (xfr->task_transfer->lookup_aaaa?"AAAA":"A"));
5385 				}
5386 			}
5387 		} else {
5388 			if(verbosity >= VERB_ALGO) {
5389 				char zname[255+1];
5390 				dname_str(xfr->name, zname);
5391 				verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup has no answer", zname, xfr->task_transfer->lookup_target->host, (xfr->task_transfer->lookup_aaaa?"AAAA":"A"));
5392 			}
5393 		}
5394 		regional_free_all(temp);
5395 	} else {
5396 		if(verbosity >= VERB_ALGO) {
5397 			char zname[255+1];
5398 			dname_str(xfr->name, zname);
5399 			verbose(VERB_ALGO, "auth zone %s host %s type %s transfer lookup failed", zname, xfr->task_transfer->lookup_target->host, (xfr->task_transfer->lookup_aaaa?"AAAA":"A"));
5400 		}
5401 	}
5402 	if(xfr->task_transfer->lookup_target->list &&
5403 		xfr->task_transfer->lookup_target == xfr_transfer_current_master(xfr))
5404 		xfr->task_transfer->scan_addr = xfr->task_transfer->lookup_target->list;
5405 
5406 	/* move to lookup AAAA after A lookup, move to next hostname lookup,
5407 	 * or move to fetch the zone, or, if nothing to do, end task_transfer */
5408 	xfr_transfer_move_to_next_lookup(xfr, env);
5409 	xfr_transfer_nexttarget_or_end(xfr, env);
5410 }
5411 
5412 /** check if xfer (AXFR or IXFR) packet is OK.
5413  * return false if we lost connection (SERVFAIL, or unreadable).
5414  * return false if we need to move from IXFR to AXFR, with gonextonfail
5415  * 	set to false, so the same master is tried again, but with AXFR.
5416  * return true if fine to link into data.
5417  * return true with transferdone=true when the transfer has ended.
5418  */
5419 static int
5420 check_xfer_packet(sldns_buffer* pkt, struct auth_xfer* xfr,
5421 	int* gonextonfail, int* transferdone)
5422 {
5423 	uint8_t* wire = sldns_buffer_begin(pkt);
5424 	int i;
5425 	if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) {
5426 		verbose(VERB_ALGO, "xfr to %s failed, packet too small",
5427 			xfr->task_transfer->master->host);
5428 		return 0;
5429 	}
5430 	if(!LDNS_QR_WIRE(wire)) {
5431 		verbose(VERB_ALGO, "xfr to %s failed, packet has no QR flag",
5432 			xfr->task_transfer->master->host);
5433 		return 0;
5434 	}
5435 	if(LDNS_TC_WIRE(wire)) {
5436 		verbose(VERB_ALGO, "xfr to %s failed, packet has TC flag",
5437 			xfr->task_transfer->master->host);
5438 		return 0;
5439 	}
5440 	/* check ID */
5441 	if(LDNS_ID_WIRE(wire) != xfr->task_transfer->id) {
5442 		verbose(VERB_ALGO, "xfr to %s failed, packet wrong ID",
5443 			xfr->task_transfer->master->host);
5444 		return 0;
5445 	}
5446 	if(LDNS_RCODE_WIRE(wire) != LDNS_RCODE_NOERROR) {
5447 		char rcode[32];
5448 		sldns_wire2str_rcode_buf((int)LDNS_RCODE_WIRE(wire), rcode,
5449 			sizeof(rcode));
5450 		/* if we are doing IXFR, check for fallback */
5451 		if(xfr->task_transfer->on_ixfr) {
5452 			if(LDNS_RCODE_WIRE(wire) == LDNS_RCODE_NOTIMPL ||
5453 				LDNS_RCODE_WIRE(wire) == LDNS_RCODE_SERVFAIL ||
5454 				LDNS_RCODE_WIRE(wire) == LDNS_RCODE_REFUSED ||
5455 				LDNS_RCODE_WIRE(wire) == LDNS_RCODE_FORMERR) {
5456 				verbose(VERB_ALGO, "xfr to %s, fallback "
5457 					"from IXFR to AXFR (with rcode %s)",
5458 					xfr->task_transfer->master->host,
5459 					rcode);
5460 				xfr->task_transfer->ixfr_fail = 1;
5461 				*gonextonfail = 0;
5462 				return 0;
5463 			}
5464 		}
5465 		verbose(VERB_ALGO, "xfr to %s failed, packet with rcode %s",
5466 			xfr->task_transfer->master->host, rcode);
5467 		return 0;
5468 	}
5469 	if(LDNS_OPCODE_WIRE(wire) != LDNS_PACKET_QUERY) {
5470 		verbose(VERB_ALGO, "xfr to %s failed, packet with bad opcode",
5471 			xfr->task_transfer->master->host);
5472 		return 0;
5473 	}
5474 	if(LDNS_QDCOUNT(wire) > 1) {
5475 		verbose(VERB_ALGO, "xfr to %s failed, packet has qdcount %d",
5476 			xfr->task_transfer->master->host,
5477 			(int)LDNS_QDCOUNT(wire));
5478 		return 0;
5479 	}
5480 
5481 	/* check qname */
5482 	sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE);
5483 	for(i=0; i<(int)LDNS_QDCOUNT(wire); i++) {
5484 		size_t pos = sldns_buffer_position(pkt);
5485 		uint16_t qtype, qclass;
5486 		if(pkt_dname_len(pkt) == 0) {
5487 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5488 				"malformed dname",
5489 				xfr->task_transfer->master->host);
5490 			return 0;
5491 		}
5492 		if(dname_pkt_compare(pkt, sldns_buffer_at(pkt, pos),
5493 			xfr->name) != 0) {
5494 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5495 				"wrong qname",
5496 				xfr->task_transfer->master->host);
5497 			return 0;
5498 		}
5499 		if(sldns_buffer_remaining(pkt) < 4) {
5500 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5501 				"truncated query RR",
5502 				xfr->task_transfer->master->host);
5503 			return 0;
5504 		}
5505 		qtype = sldns_buffer_read_u16(pkt);
5506 		qclass = sldns_buffer_read_u16(pkt);
5507 		if(qclass != xfr->dclass) {
5508 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5509 				"wrong qclass",
5510 				xfr->task_transfer->master->host);
5511 			return 0;
5512 		}
5513 		if(xfr->task_transfer->on_ixfr) {
5514 			if(qtype != LDNS_RR_TYPE_IXFR) {
5515 				verbose(VERB_ALGO, "xfr to %s failed, packet "
5516 					"with wrong qtype, expected IXFR",
5517 				xfr->task_transfer->master->host);
5518 				return 0;
5519 			}
5520 		} else {
5521 			if(qtype != LDNS_RR_TYPE_AXFR) {
5522 				verbose(VERB_ALGO, "xfr to %s failed, packet "
5523 					"with wrong qtype, expected AXFR",
5524 				xfr->task_transfer->master->host);
5525 				return 0;
5526 			}
5527 		}
5528 	}
5529 
5530 	/* check parse of RRs in packet, store first SOA serial
5531 	 * to be able to detect last SOA (with that serial) to see if done */
5532 	/* also check for IXFR 'zone up to date' reply */
5533 	for(i=0; i<(int)LDNS_ANCOUNT(wire); i++) {
5534 		size_t pos = sldns_buffer_position(pkt);
5535 		uint16_t tp, rdlen;
5536 		if(pkt_dname_len(pkt) == 0) {
5537 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5538 				"malformed dname in answer section",
5539 				xfr->task_transfer->master->host);
5540 			return 0;
5541 		}
5542 		if(sldns_buffer_remaining(pkt) < 10) {
5543 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5544 				"truncated RR",
5545 				xfr->task_transfer->master->host);
5546 			return 0;
5547 		}
5548 		tp = sldns_buffer_read_u16(pkt);
5549 		(void)sldns_buffer_read_u16(pkt); /* class */
5550 		(void)sldns_buffer_read_u32(pkt); /* ttl */
5551 		rdlen = sldns_buffer_read_u16(pkt);
5552 		if(sldns_buffer_remaining(pkt) < rdlen) {
5553 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5554 				"truncated RR rdata",
5555 				xfr->task_transfer->master->host);
5556 			return 0;
5557 		}
5558 
5559 		/* RR parses (haven't checked rdata itself), now look at
5560 		 * SOA records to see serial number */
5561 		if(xfr->task_transfer->rr_scan_num == 0 &&
5562 			tp != LDNS_RR_TYPE_SOA) {
5563 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5564 				"malformed zone transfer, no start SOA",
5565 				xfr->task_transfer->master->host);
5566 			return 0;
5567 		}
5568 		if(xfr->task_transfer->rr_scan_num == 1 &&
5569 			tp != LDNS_RR_TYPE_SOA) {
5570 			/* second RR is not a SOA record, this is not an IXFR
5571 			 * the master is replying with an AXFR */
5572 			xfr->task_transfer->on_ixfr_is_axfr = 1;
5573 		}
5574 		if(tp == LDNS_RR_TYPE_SOA) {
5575 			uint32_t serial;
5576 			if(rdlen < 22) {
5577 				verbose(VERB_ALGO, "xfr to %s failed, packet "
5578 					"with SOA with malformed rdata",
5579 					xfr->task_transfer->master->host);
5580 				return 0;
5581 			}
5582 			if(dname_pkt_compare(pkt, sldns_buffer_at(pkt, pos),
5583 				xfr->name) != 0) {
5584 				verbose(VERB_ALGO, "xfr to %s failed, packet "
5585 					"with SOA with wrong dname",
5586 					xfr->task_transfer->master->host);
5587 				return 0;
5588 			}
5589 
5590 			/* read serial number of SOA */
5591 			serial = sldns_buffer_read_u32_at(pkt,
5592 				sldns_buffer_position(pkt)+rdlen-20);
5593 
5594 			/* check for IXFR 'zone has SOA x' reply */
5595 			if(xfr->task_transfer->on_ixfr &&
5596 				xfr->task_transfer->rr_scan_num == 0 &&
5597 				LDNS_ANCOUNT(wire)==1) {
5598 				verbose(VERB_ALGO, "xfr to %s ended, "
5599 					"IXFR reply that zone has serial %u,"
5600 					" fallback from IXFR to AXFR",
5601 					xfr->task_transfer->master->host,
5602 					(unsigned)serial);
5603 				xfr->task_transfer->ixfr_fail = 1;
5604 				*gonextonfail = 0;
5605 				return 0;
5606 			}
5607 
5608 			/* if first SOA, store serial number */
5609 			if(xfr->task_transfer->got_xfr_serial == 0) {
5610 				xfr->task_transfer->got_xfr_serial = 1;
5611 				xfr->task_transfer->incoming_xfr_serial =
5612 					serial;
5613 				verbose(VERB_ALGO, "xfr %s: contains "
5614 					"SOA serial %u",
5615 					xfr->task_transfer->master->host,
5616 					(unsigned)serial);
5617 			/* see if end of AXFR */
5618 			} else if(!xfr->task_transfer->on_ixfr ||
5619 				xfr->task_transfer->on_ixfr_is_axfr) {
5620 				/* second SOA with serial is the end
5621 				 * for AXFR */
5622 				*transferdone = 1;
5623 				verbose(VERB_ALGO, "xfr %s: last AXFR packet",
5624 					xfr->task_transfer->master->host);
5625 			/* for IXFR, count SOA records with that serial */
5626 			} else if(xfr->task_transfer->incoming_xfr_serial ==
5627 				serial && xfr->task_transfer->got_xfr_serial
5628 				== 1) {
5629 				xfr->task_transfer->got_xfr_serial++;
5630 			/* if not first soa, if serial==firstserial, the
5631 			 * third time we are at the end, for IXFR */
5632 			} else if(xfr->task_transfer->incoming_xfr_serial ==
5633 				serial && xfr->task_transfer->got_xfr_serial
5634 				== 2) {
5635 				verbose(VERB_ALGO, "xfr %s: last IXFR packet",
5636 					xfr->task_transfer->master->host);
5637 				*transferdone = 1;
5638 				/* continue parse check, if that succeeds,
5639 				 * transfer is done */
5640 			}
5641 		}
5642 		xfr->task_transfer->rr_scan_num++;
5643 
5644 		/* skip over RR rdata to go to the next RR */
5645 		sldns_buffer_skip(pkt, (ssize_t)rdlen);
5646 	}
5647 
5648 	/* check authority section */
5649 	/* we skip over the RRs checking packet format */
5650 	for(i=0; i<(int)LDNS_NSCOUNT(wire); i++) {
5651 		uint16_t rdlen;
5652 		if(pkt_dname_len(pkt) == 0) {
5653 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5654 				"malformed dname in authority section",
5655 				xfr->task_transfer->master->host);
5656 			return 0;
5657 		}
5658 		if(sldns_buffer_remaining(pkt) < 10) {
5659 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5660 				"truncated RR",
5661 				xfr->task_transfer->master->host);
5662 			return 0;
5663 		}
5664 		(void)sldns_buffer_read_u16(pkt); /* type */
5665 		(void)sldns_buffer_read_u16(pkt); /* class */
5666 		(void)sldns_buffer_read_u32(pkt); /* ttl */
5667 		rdlen = sldns_buffer_read_u16(pkt);
5668 		if(sldns_buffer_remaining(pkt) < rdlen) {
5669 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5670 				"truncated RR rdata",
5671 				xfr->task_transfer->master->host);
5672 			return 0;
5673 		}
5674 		/* skip over RR rdata to go to the next RR */
5675 		sldns_buffer_skip(pkt, (ssize_t)rdlen);
5676 	}
5677 
5678 	/* check additional section */
5679 	for(i=0; i<(int)LDNS_ARCOUNT(wire); i++) {
5680 		uint16_t rdlen;
5681 		if(pkt_dname_len(pkt) == 0) {
5682 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5683 				"malformed dname in additional section",
5684 				xfr->task_transfer->master->host);
5685 			return 0;
5686 		}
5687 		if(sldns_buffer_remaining(pkt) < 10) {
5688 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5689 				"truncated RR",
5690 				xfr->task_transfer->master->host);
5691 			return 0;
5692 		}
5693 		(void)sldns_buffer_read_u16(pkt); /* type */
5694 		(void)sldns_buffer_read_u16(pkt); /* class */
5695 		(void)sldns_buffer_read_u32(pkt); /* ttl */
5696 		rdlen = sldns_buffer_read_u16(pkt);
5697 		if(sldns_buffer_remaining(pkt) < rdlen) {
5698 			verbose(VERB_ALGO, "xfr to %s failed, packet with "
5699 				"truncated RR rdata",
5700 				xfr->task_transfer->master->host);
5701 			return 0;
5702 		}
5703 		/* skip over RR rdata to go to the next RR */
5704 		sldns_buffer_skip(pkt, (ssize_t)rdlen);
5705 	}
5706 
5707 	return 1;
5708 }
5709 
5710 /** Link the data from this packet into the worklist of transferred data */
5711 static int
5712 xfer_link_data(sldns_buffer* pkt, struct auth_xfer* xfr)
5713 {
5714 	/* alloc it */
5715 	struct auth_chunk* e;
5716 	e = (struct auth_chunk*)calloc(1, sizeof(*e));
5717 	if(!e) return 0;
5718 	e->next = NULL;
5719 	e->len = sldns_buffer_limit(pkt);
5720 	e->data = memdup(sldns_buffer_begin(pkt), e->len);
5721 	if(!e->data) {
5722 		free(e);
5723 		return 0;
5724 	}
5725 
5726 	/* alloc succeeded, link into list */
5727 	if(!xfr->task_transfer->chunks_first)
5728 		xfr->task_transfer->chunks_first = e;
5729 	if(xfr->task_transfer->chunks_last)
5730 		xfr->task_transfer->chunks_last->next = e;
5731 	xfr->task_transfer->chunks_last = e;
5732 	return 1;
5733 }
5734 
5735 /** task transfer.  the list of data is complete. process it and if failed
5736  * move to next master, if succeeded, end the task transfer */
5737 static void
5738 process_list_end_transfer(struct auth_xfer* xfr, struct module_env* env)
5739 {
5740 	int ixfr_fail = 0;
5741 	if(xfr_process_chunk_list(xfr, env, &ixfr_fail)) {
5742 		/* it worked! */
5743 		auth_chunks_delete(xfr->task_transfer);
5744 
5745 		/* we fetched the zone, move to wait task */
5746 		xfr_transfer_disown(xfr);
5747 
5748 		if(xfr->notify_received && (!xfr->notify_has_serial ||
5749 			(xfr->notify_has_serial &&
5750 			xfr_serial_means_update(xfr, xfr->notify_serial)))) {
5751 			uint32_t sr = xfr->notify_serial;
5752 			int has_sr = xfr->notify_has_serial;
5753 			/* we received a notify while probe/transfer was
5754 			 * in progress.  start a new probe and transfer */
5755 			xfr->notify_received = 0;
5756 			xfr->notify_has_serial = 0;
5757 			xfr->notify_serial = 0;
5758 			if(!xfr_start_probe(xfr, env, NULL)) {
5759 				/* if we couldn't start it, already in
5760 				 * progress; restore notify serial,
5761 				 * while xfr still locked */
5762 				xfr->notify_received = 1;
5763 				xfr->notify_has_serial = has_sr;
5764 				xfr->notify_serial = sr;
5765 				lock_basic_unlock(&xfr->lock);
5766 			}
5767 			return;
5768 		} else {
5769 			/* pick up the nextprobe task and wait (normail wait time) */
5770 			if(xfr->task_nextprobe->worker == NULL)
5771 				xfr_set_timeout(xfr, env, 0, 0);
5772 		}
5773 		lock_basic_unlock(&xfr->lock);
5774 		return;
5775 	}
5776 	/* processing failed */
5777 	/* when done, delete data from list */
5778 	auth_chunks_delete(xfr->task_transfer);
5779 	if(ixfr_fail) {
5780 		xfr->task_transfer->ixfr_fail = 1;
5781 	} else {
5782 		xfr_transfer_nextmaster(xfr);
5783 	}
5784 	xfr_transfer_nexttarget_or_end(xfr, env);
5785 }
5786 
5787 /** callback for the task_transfer timer */
5788 void
5789 auth_xfer_transfer_timer_callback(void* arg)
5790 {
5791 	struct auth_xfer* xfr = (struct auth_xfer*)arg;
5792 	struct module_env* env;
5793 	int gonextonfail = 1;
5794 	log_assert(xfr->task_transfer);
5795 	lock_basic_lock(&xfr->lock);
5796 	env = xfr->task_transfer->env;
5797 	if(!env || env->outnet->want_to_quit) {
5798 		lock_basic_unlock(&xfr->lock);
5799 		return; /* stop on quit */
5800 	}
5801 
5802 	verbose(VERB_ALGO, "xfr stopped, connection timeout to %s",
5803 		xfr->task_transfer->master->host);
5804 
5805 	/* see if IXFR caused the failure, if so, try AXFR */
5806 	if(xfr->task_transfer->on_ixfr) {
5807 		xfr->task_transfer->ixfr_possible_timeout_count++;
5808 		if(xfr->task_transfer->ixfr_possible_timeout_count >=
5809 			NUM_TIMEOUTS_FALLBACK_IXFR) {
5810 			verbose(VERB_ALGO, "xfr to %s, fallback "
5811 				"from IXFR to AXFR (because of timeouts)",
5812 				xfr->task_transfer->master->host);
5813 			xfr->task_transfer->ixfr_fail = 1;
5814 			gonextonfail = 0;
5815 		}
5816 	}
5817 
5818 	/* delete transferred data from list */
5819 	auth_chunks_delete(xfr->task_transfer);
5820 	comm_point_delete(xfr->task_transfer->cp);
5821 	xfr->task_transfer->cp = NULL;
5822 	if(gonextonfail)
5823 		xfr_transfer_nextmaster(xfr);
5824 	xfr_transfer_nexttarget_or_end(xfr, env);
5825 }
5826 
5827 /** callback for task_transfer tcp connections */
5828 int
5829 auth_xfer_transfer_tcp_callback(struct comm_point* c, void* arg, int err,
5830 	struct comm_reply* ATTR_UNUSED(repinfo))
5831 {
5832 	struct auth_xfer* xfr = (struct auth_xfer*)arg;
5833 	struct module_env* env;
5834 	int gonextonfail = 1;
5835 	int transferdone = 0;
5836 	log_assert(xfr->task_transfer);
5837 	lock_basic_lock(&xfr->lock);
5838 	env = xfr->task_transfer->env;
5839 	if(!env || env->outnet->want_to_quit) {
5840 		lock_basic_unlock(&xfr->lock);
5841 		return 0; /* stop on quit */
5842 	}
5843 	/* stop the timer */
5844 	comm_timer_disable(xfr->task_transfer->timer);
5845 
5846 	if(err != NETEVENT_NOERROR) {
5847 		/* connection failed, closed, or timeout */
5848 		/* stop this transfer, cleanup
5849 		 * and continue task_transfer*/
5850 		verbose(VERB_ALGO, "xfr stopped, connection lost to %s",
5851 			xfr->task_transfer->master->host);
5852 
5853 		/* see if IXFR caused the failure, if so, try AXFR */
5854 		if(xfr->task_transfer->on_ixfr) {
5855 			xfr->task_transfer->ixfr_possible_timeout_count++;
5856 			if(xfr->task_transfer->ixfr_possible_timeout_count >=
5857 				NUM_TIMEOUTS_FALLBACK_IXFR) {
5858 				verbose(VERB_ALGO, "xfr to %s, fallback "
5859 					"from IXFR to AXFR (because of timeouts)",
5860 					xfr->task_transfer->master->host);
5861 				xfr->task_transfer->ixfr_fail = 1;
5862 				gonextonfail = 0;
5863 			}
5864 		}
5865 
5866 	failed:
5867 		/* delete transferred data from list */
5868 		auth_chunks_delete(xfr->task_transfer);
5869 		comm_point_delete(xfr->task_transfer->cp);
5870 		xfr->task_transfer->cp = NULL;
5871 		if(gonextonfail)
5872 			xfr_transfer_nextmaster(xfr);
5873 		xfr_transfer_nexttarget_or_end(xfr, env);
5874 		return 0;
5875 	}
5876 	/* note that IXFR worked without timeout */
5877 	if(xfr->task_transfer->on_ixfr)
5878 		xfr->task_transfer->ixfr_possible_timeout_count = 0;
5879 
5880 	/* handle returned packet */
5881 	/* if it fails, cleanup and end this transfer */
5882 	/* if it needs to fallback from IXFR to AXFR, do that */
5883 	if(!check_xfer_packet(c->buffer, xfr, &gonextonfail, &transferdone)) {
5884 		goto failed;
5885 	}
5886 	/* if it is good, link it into the list of data */
5887 	/* if the link into list of data fails (malloc fail) cleanup and end */
5888 	if(!xfer_link_data(c->buffer, xfr)) {
5889 		verbose(VERB_ALGO, "xfr stopped to %s, malloc failed",
5890 			xfr->task_transfer->master->host);
5891 		goto failed;
5892 	}
5893 	/* if the transfer is done now, disconnect and process the list */
5894 	if(transferdone) {
5895 		comm_point_delete(xfr->task_transfer->cp);
5896 		xfr->task_transfer->cp = NULL;
5897 		process_list_end_transfer(xfr, env);
5898 		return 0;
5899 	}
5900 
5901 	/* if we want to read more messages, setup the commpoint to read
5902 	 * a DNS packet, and the timeout */
5903 	lock_basic_unlock(&xfr->lock);
5904 	c->tcp_is_reading = 1;
5905 	sldns_buffer_clear(c->buffer);
5906 	comm_point_start_listening(c, -1, AUTH_TRANSFER_TIMEOUT);
5907 	return 0;
5908 }
5909 
5910 /** callback for task_transfer http connections */
5911 int
5912 auth_xfer_transfer_http_callback(struct comm_point* c, void* arg, int err,
5913 	struct comm_reply* repinfo)
5914 {
5915 	struct auth_xfer* xfr = (struct auth_xfer*)arg;
5916 	struct module_env* env;
5917 	log_assert(xfr->task_transfer);
5918 	lock_basic_lock(&xfr->lock);
5919 	env = xfr->task_transfer->env;
5920 	if(!env || env->outnet->want_to_quit) {
5921 		lock_basic_unlock(&xfr->lock);
5922 		return 0; /* stop on quit */
5923 	}
5924 	verbose(VERB_ALGO, "auth zone transfer http callback");
5925 	/* stop the timer */
5926 	comm_timer_disable(xfr->task_transfer->timer);
5927 
5928 	if(err != NETEVENT_NOERROR && err != NETEVENT_DONE) {
5929 		/* connection failed, closed, or timeout */
5930 		/* stop this transfer, cleanup
5931 		 * and continue task_transfer*/
5932 		verbose(VERB_ALGO, "http stopped, connection lost to %s",
5933 			xfr->task_transfer->master->host);
5934 	failed:
5935 		/* delete transferred data from list */
5936 		auth_chunks_delete(xfr->task_transfer);
5937 		if(repinfo) repinfo->c = NULL; /* signal cp deleted to
5938 				the routine calling this callback */
5939 		comm_point_delete(xfr->task_transfer->cp);
5940 		xfr->task_transfer->cp = NULL;
5941 		xfr_transfer_nextmaster(xfr);
5942 		xfr_transfer_nexttarget_or_end(xfr, env);
5943 		return 0;
5944 	}
5945 
5946 	/* if it is good, link it into the list of data */
5947 	/* if the link into list of data fails (malloc fail) cleanup and end */
5948 	if(sldns_buffer_limit(c->buffer) > 0) {
5949 		verbose(VERB_ALGO, "auth zone http queued up %d bytes",
5950 			(int)sldns_buffer_limit(c->buffer));
5951 		if(!xfer_link_data(c->buffer, xfr)) {
5952 			verbose(VERB_ALGO, "http stopped to %s, malloc failed",
5953 				xfr->task_transfer->master->host);
5954 			goto failed;
5955 		}
5956 	}
5957 	/* if the transfer is done now, disconnect and process the list */
5958 	if(err == NETEVENT_DONE) {
5959 		if(repinfo) repinfo->c = NULL; /* signal cp deleted to
5960 				the routine calling this callback */
5961 		comm_point_delete(xfr->task_transfer->cp);
5962 		xfr->task_transfer->cp = NULL;
5963 		process_list_end_transfer(xfr, env);
5964 		return 0;
5965 	}
5966 
5967 	/* if we want to read more messages, setup the commpoint to read
5968 	 * a DNS packet, and the timeout */
5969 	lock_basic_unlock(&xfr->lock);
5970 	c->tcp_is_reading = 1;
5971 	sldns_buffer_clear(c->buffer);
5972 	comm_point_start_listening(c, -1, AUTH_TRANSFER_TIMEOUT);
5973 	return 0;
5974 }
5975 
5976 
5977 /** start transfer task by this worker , xfr is locked. */
5978 static void
5979 xfr_start_transfer(struct auth_xfer* xfr, struct module_env* env,
5980 	struct auth_master* master)
5981 {
5982 	log_assert(xfr->task_transfer != NULL);
5983 	log_assert(xfr->task_transfer->worker == NULL);
5984 	log_assert(xfr->task_transfer->chunks_first == NULL);
5985 	log_assert(xfr->task_transfer->chunks_last == NULL);
5986 	xfr->task_transfer->worker = env->worker;
5987 	xfr->task_transfer->env = env;
5988 
5989 	/* init transfer process */
5990 	/* find that master in the transfer's list of masters? */
5991 	xfr_transfer_start_list(xfr, master);
5992 	/* start lookup for hostnames in transfer master list */
5993 	xfr_transfer_start_lookups(xfr);
5994 
5995 	/* initiate TCP, and set timeout on it */
5996 	xfr_transfer_nexttarget_or_end(xfr, env);
5997 }
5998 
5999 /** disown task_probe.  caller must hold xfr.lock */
6000 static void
6001 xfr_probe_disown(struct auth_xfer* xfr)
6002 {
6003 	/* remove timer (from this worker's event base) */
6004 	comm_timer_delete(xfr->task_probe->timer);
6005 	xfr->task_probe->timer = NULL;
6006 	/* remove the commpoint */
6007 	comm_point_delete(xfr->task_probe->cp);
6008 	xfr->task_probe->cp = NULL;
6009 	/* we don't own this item anymore */
6010 	xfr->task_probe->worker = NULL;
6011 	xfr->task_probe->env = NULL;
6012 }
6013 
6014 /** send the UDP probe to the master, this is part of task_probe */
6015 static int
6016 xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
6017 	int timeout)
6018 {
6019 	struct sockaddr_storage addr;
6020 	socklen_t addrlen = 0;
6021 	struct timeval t;
6022 	/* pick master */
6023 	struct auth_master* master = xfr_probe_current_master(xfr);
6024 	char *auth_name = NULL;
6025 	if(!master) return 0;
6026 	if(master->allow_notify) return 0; /* only for notify */
6027 	if(master->http) return 0; /* only masters get SOA UDP probe,
6028 		not urls, if those are in this list */
6029 
6030 	/* get master addr */
6031 	if(xfr->task_probe->scan_addr) {
6032 		addrlen = xfr->task_probe->scan_addr->addrlen;
6033 		memmove(&addr, &xfr->task_probe->scan_addr->addr, addrlen);
6034 	} else {
6035 		if(!authextstrtoaddr(master->host, &addr, &addrlen, &auth_name)) {
6036 			/* the ones that are not in addr format are supposed
6037 			 * to be looked up.  The lookup has failed however,
6038 			 * so skip them */
6039 			char zname[255+1];
6040 			dname_str(xfr->name, zname);
6041 			log_err("%s: failed lookup, cannot probe to master %s",
6042 				zname, master->host);
6043 			return 0;
6044 		}
6045 		if (auth_name != NULL) {
6046 			if (addr.ss_family == AF_INET
6047 			&&  (int)ntohs(((struct sockaddr_in *)&addr)->sin_port)
6048 		            == env->cfg->ssl_port)
6049 				((struct sockaddr_in *)&addr)->sin_port
6050 					= htons((uint16_t)env->cfg->port);
6051 			else if (addr.ss_family == AF_INET6
6052 			&&  (int)ntohs(((struct sockaddr_in6 *)&addr)->sin6_port)
6053 		            == env->cfg->ssl_port)
6054                         	((struct sockaddr_in6 *)&addr)->sin6_port
6055 					= htons((uint16_t)env->cfg->port);
6056 		}
6057 	}
6058 
6059 	/* create packet */
6060 	/* create new ID for new probes, but not on timeout retries,
6061 	 * this means we'll accept replies to previous retries to same ip */
6062 	if(timeout == AUTH_PROBE_TIMEOUT)
6063 		xfr->task_probe->id = (uint16_t)(ub_random(env->rnd)&0xffff);
6064 	xfr_create_soa_probe_packet(xfr, env->scratch_buffer,
6065 		xfr->task_probe->id);
6066 	/* we need to remove the cp if we have a different ip4/ip6 type now */
6067 	if(xfr->task_probe->cp &&
6068 		((xfr->task_probe->cp_is_ip6 && !addr_is_ip6(&addr, addrlen)) ||
6069 		(!xfr->task_probe->cp_is_ip6 && addr_is_ip6(&addr, addrlen)))
6070 		) {
6071 		comm_point_delete(xfr->task_probe->cp);
6072 		xfr->task_probe->cp = NULL;
6073 	}
6074 	if(!xfr->task_probe->cp) {
6075 		if(addr_is_ip6(&addr, addrlen))
6076 			xfr->task_probe->cp_is_ip6 = 1;
6077 		else 	xfr->task_probe->cp_is_ip6 = 0;
6078 		xfr->task_probe->cp = outnet_comm_point_for_udp(env->outnet,
6079 			auth_xfer_probe_udp_callback, xfr, &addr, addrlen);
6080 		if(!xfr->task_probe->cp) {
6081 			char zname[255+1], as[256];
6082 			dname_str(xfr->name, zname);
6083 			addr_to_str(&addr, addrlen, as, sizeof(as));
6084 			verbose(VERB_ALGO, "cannot create udp cp for "
6085 				"probe %s to %s", zname, as);
6086 			return 0;
6087 		}
6088 	}
6089 	if(!xfr->task_probe->timer) {
6090 		xfr->task_probe->timer = comm_timer_create(env->worker_base,
6091 			auth_xfer_probe_timer_callback, xfr);
6092 		if(!xfr->task_probe->timer) {
6093 			log_err("malloc failure");
6094 			return 0;
6095 		}
6096 	}
6097 
6098 	/* send udp packet */
6099 	if(!comm_point_send_udp_msg(xfr->task_probe->cp, env->scratch_buffer,
6100 		(struct sockaddr*)&addr, addrlen, 0)) {
6101 		char zname[255+1], as[256];
6102 		dname_str(xfr->name, zname);
6103 		addr_to_str(&addr, addrlen, as, sizeof(as));
6104 		verbose(VERB_ALGO, "failed to send soa probe for %s to %s",
6105 			zname, as);
6106 		return 0;
6107 	}
6108 	if(verbosity >= VERB_ALGO) {
6109 		char zname[255+1], as[256];
6110 		dname_str(xfr->name, zname);
6111 		addr_to_str(&addr, addrlen, as, sizeof(as));
6112 		verbose(VERB_ALGO, "auth zone %s soa probe sent to %s", zname,
6113 			as);
6114 	}
6115 	xfr->task_probe->timeout = timeout;
6116 #ifndef S_SPLINT_S
6117 	t.tv_sec = timeout/1000;
6118 	t.tv_usec = (timeout%1000)*1000;
6119 #endif
6120 	comm_timer_set(xfr->task_probe->timer, &t);
6121 
6122 	return 1;
6123 }
6124 
6125 /** callback for task_probe timer */
6126 void
6127 auth_xfer_probe_timer_callback(void* arg)
6128 {
6129 	struct auth_xfer* xfr = (struct auth_xfer*)arg;
6130 	struct module_env* env;
6131 	log_assert(xfr->task_probe);
6132 	lock_basic_lock(&xfr->lock);
6133 	env = xfr->task_probe->env;
6134 	if(!env || env->outnet->want_to_quit) {
6135 		lock_basic_unlock(&xfr->lock);
6136 		return; /* stop on quit */
6137 	}
6138 
6139 	if(verbosity >= VERB_ALGO) {
6140 		char zname[255+1];
6141 		dname_str(xfr->name, zname);
6142 		verbose(VERB_ALGO, "auth zone %s soa probe timeout", zname);
6143 	}
6144 	if(xfr->task_probe->timeout <= AUTH_PROBE_TIMEOUT_STOP) {
6145 		/* try again with bigger timeout */
6146 		if(xfr_probe_send_probe(xfr, env, xfr->task_probe->timeout*2)) {
6147 			lock_basic_unlock(&xfr->lock);
6148 			return;
6149 		}
6150 	}
6151 	/* delete commpoint so a new one is created, with a fresh port nr */
6152 	comm_point_delete(xfr->task_probe->cp);
6153 	xfr->task_probe->cp = NULL;
6154 
6155 	/* too many timeouts (or fail to send), move to next or end */
6156 	xfr_probe_nextmaster(xfr);
6157 	xfr_probe_send_or_end(xfr, env);
6158 }
6159 
6160 /** callback for task_probe udp packets */
6161 int
6162 auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err,
6163 	struct comm_reply* repinfo)
6164 {
6165 	struct auth_xfer* xfr = (struct auth_xfer*)arg;
6166 	struct module_env* env;
6167 	log_assert(xfr->task_probe);
6168 	lock_basic_lock(&xfr->lock);
6169 	env = xfr->task_probe->env;
6170 	if(!env || env->outnet->want_to_quit) {
6171 		lock_basic_unlock(&xfr->lock);
6172 		return 0; /* stop on quit */
6173 	}
6174 
6175 	/* the comm_point_udp_callback is in a for loop for NUM_UDP_PER_SELECT
6176 	 * and we set rep.c=NULL to stop if from looking inside the commpoint*/
6177 	repinfo->c = NULL;
6178 	/* stop the timer */
6179 	comm_timer_disable(xfr->task_probe->timer);
6180 
6181 	/* see if we got a packet and what that means */
6182 	if(err == NETEVENT_NOERROR) {
6183 		uint32_t serial = 0;
6184 		if(check_packet_ok(c->buffer, LDNS_RR_TYPE_SOA, xfr,
6185 			&serial)) {
6186 			/* successful lookup */
6187 			if(verbosity >= VERB_ALGO) {
6188 				char buf[256];
6189 				dname_str(xfr->name, buf);
6190 				verbose(VERB_ALGO, "auth zone %s: soa probe "
6191 					"serial is %u", buf, (unsigned)serial);
6192 			}
6193 			/* see if this serial indicates that the zone has
6194 			 * to be updated */
6195 			if(xfr_serial_means_update(xfr, serial)) {
6196 				/* if updated, start the transfer task, if needed */
6197 				verbose(VERB_ALGO, "auth_zone updated, start transfer");
6198 				if(xfr->task_transfer->worker == NULL) {
6199 					struct auth_master* master =
6200 						xfr_probe_current_master(xfr);
6201 					/* if we have download URLs use them
6202 					 * in preference to this master we
6203 					 * just probed the SOA from */
6204 					if(xfr->task_transfer->masters &&
6205 						xfr->task_transfer->masters->http)
6206 						master = NULL;
6207 					xfr_probe_disown(xfr);
6208 					xfr_start_transfer(xfr, env, master);
6209 					return 0;
6210 
6211 				}
6212 				/* other tasks are running, we don't do this anymore */
6213 				xfr_probe_disown(xfr);
6214 				lock_basic_unlock(&xfr->lock);
6215 				/* return, we don't sent a reply to this udp packet,
6216 				 * and we setup the tasks to do next */
6217 				return 0;
6218 			} else {
6219 				verbose(VERB_ALGO, "auth_zone master reports unchanged soa serial");
6220 				/* we if cannot find updates amongst the
6221 				 * masters, this means we then have a new lease
6222 				 * on the zone */
6223 				xfr->task_probe->have_new_lease = 1;
6224 			}
6225 		} else {
6226 			if(verbosity >= VERB_ALGO) {
6227 				char buf[256];
6228 				dname_str(xfr->name, buf);
6229 				verbose(VERB_ALGO, "auth zone %s: bad reply to soa probe", buf);
6230 			}
6231 		}
6232 	} else {
6233 		if(verbosity >= VERB_ALGO) {
6234 			char buf[256];
6235 			dname_str(xfr->name, buf);
6236 			verbose(VERB_ALGO, "auth zone %s: soa probe failed", buf);
6237 		}
6238 	}
6239 
6240 	/* failed lookup or not an update */
6241 	/* delete commpoint so a new one is created, with a fresh port nr */
6242 	comm_point_delete(xfr->task_probe->cp);
6243 	xfr->task_probe->cp = NULL;
6244 
6245 	/* if the result was not a successfull probe, we need
6246 	 * to send the next one */
6247 	xfr_probe_nextmaster(xfr);
6248 	xfr_probe_send_or_end(xfr, env);
6249 	return 0;
6250 }
6251 
6252 /** lookup a host name for its addresses, if needed */
6253 static int
6254 xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env)
6255 {
6256 	struct sockaddr_storage addr;
6257 	socklen_t addrlen = 0;
6258 	struct auth_master* master = xfr->task_probe->lookup_target;
6259 	struct query_info qinfo;
6260 	uint16_t qflags = BIT_RD;
6261 	uint8_t dname[LDNS_MAX_DOMAINLEN+1];
6262 	struct edns_data edns;
6263 	sldns_buffer* buf = env->scratch_buffer;
6264 	if(!master) return 0;
6265 	if(extstrtoaddr(master->host, &addr, &addrlen)) {
6266 		/* not needed, host is in IP addr format */
6267 		return 0;
6268 	}
6269 	if(master->allow_notify && !master->http &&
6270 		strchr(master->host, '/') != NULL &&
6271 		strchr(master->host, '/') == strrchr(master->host, '/')) {
6272 		return 0; /* is IP/prefix format, not something to look up */
6273 	}
6274 
6275 	/* use mesh_new_callback to probe for non-addr hosts,
6276 	 * and then wait for them to be looked up (in cache, or query) */
6277 	qinfo.qname_len = sizeof(dname);
6278 	if(sldns_str2wire_dname_buf(master->host, dname, &qinfo.qname_len)
6279 		!= 0) {
6280 		log_err("cannot parse host name of master %s", master->host);
6281 		return 0;
6282 	}
6283 	qinfo.qname = dname;
6284 	qinfo.qclass = xfr->dclass;
6285 	qinfo.qtype = LDNS_RR_TYPE_A;
6286 	if(xfr->task_probe->lookup_aaaa)
6287 		qinfo.qtype = LDNS_RR_TYPE_AAAA;
6288 	qinfo.local_alias = NULL;
6289 	if(verbosity >= VERB_ALGO) {
6290 		char buf1[512];
6291 		char buf2[LDNS_MAX_DOMAINLEN+1];
6292 		dname_str(xfr->name, buf2);
6293 		snprintf(buf1, sizeof(buf1), "auth zone %s: master lookup"
6294 			" for task_probe", buf2);
6295 		log_query_info(VERB_ALGO, buf1, &qinfo);
6296 	}
6297 	edns.edns_present = 1;
6298 	edns.ext_rcode = 0;
6299 	edns.edns_version = 0;
6300 	edns.bits = EDNS_DO;
6301 	edns.opt_list = NULL;
6302 	edns.padding_block_size = 0;
6303 	if(sldns_buffer_capacity(buf) < 65535)
6304 		edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
6305 	else	edns.udp_size = 65535;
6306 
6307 	/* unlock xfr during mesh_new_callback() because the callback can be
6308 	 * called straight away */
6309 	lock_basic_unlock(&xfr->lock);
6310 	if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
6311 		&auth_xfer_probe_lookup_callback, xfr)) {
6312 		lock_basic_lock(&xfr->lock);
6313 		log_err("out of memory lookup up master %s", master->host);
6314 		return 0;
6315 	}
6316 	lock_basic_lock(&xfr->lock);
6317 	return 1;
6318 }
6319 
6320 /** move to sending the probe packets, next if fails. task_probe */
6321 static void
6322 xfr_probe_send_or_end(struct auth_xfer* xfr, struct module_env* env)
6323 {
6324 	/* are we doing hostname lookups? */
6325 	while(xfr->task_probe->lookup_target) {
6326 		if(xfr_probe_lookup_host(xfr, env)) {
6327 			/* wait for lookup to finish,
6328 			 * note that the hostname may be in unbound's cache
6329 			 * and we may then get an instant cache response,
6330 			 * and that calls the callback just like a full
6331 			 * lookup and lookup failures also call callback */
6332 			if(verbosity >= VERB_ALGO) {
6333 				char zname[255+1];
6334 				dname_str(xfr->name, zname);
6335 				verbose(VERB_ALGO, "auth zone %s probe next target lookup", zname);
6336 			}
6337 			lock_basic_unlock(&xfr->lock);
6338 			return;
6339 		}
6340 		xfr_probe_move_to_next_lookup(xfr, env);
6341 	}
6342 	/* probe of list has ended.  Create or refresh the list of of
6343 	 * allow_notify addrs */
6344 	probe_copy_masters_for_allow_notify(xfr);
6345 	if(verbosity >= VERB_ALGO) {
6346 		char zname[255+1];
6347 		dname_str(xfr->name, zname);
6348 		verbose(VERB_ALGO, "auth zone %s probe: notify addrs updated", zname);
6349 	}
6350 	if(xfr->task_probe->only_lookup) {
6351 		/* only wanted lookups for copy, stop probe and start wait */
6352 		xfr->task_probe->only_lookup = 0;
6353 		if(verbosity >= VERB_ALGO) {
6354 			char zname[255+1];
6355 			dname_str(xfr->name, zname);
6356 			verbose(VERB_ALGO, "auth zone %s probe: finished only_lookup", zname);
6357 		}
6358 		xfr_probe_disown(xfr);
6359 		if(xfr->task_nextprobe->worker == NULL)
6360 			xfr_set_timeout(xfr, env, 0, 0);
6361 		lock_basic_unlock(&xfr->lock);
6362 		return;
6363 	}
6364 
6365 	/* send probe packets */
6366 	while(!xfr_probe_end_of_list(xfr)) {
6367 		if(xfr_probe_send_probe(xfr, env, AUTH_PROBE_TIMEOUT)) {
6368 			/* successfully sent probe, wait for callback */
6369 			lock_basic_unlock(&xfr->lock);
6370 			return;
6371 		}
6372 		/* failed to send probe, next master */
6373 		xfr_probe_nextmaster(xfr);
6374 	}
6375 
6376 	/* done with probe sequence, wait */
6377 	if(xfr->task_probe->have_new_lease) {
6378 		/* if zone not updated, start the wait timer again */
6379 		if(verbosity >= VERB_ALGO) {
6380 			char zname[255+1];
6381 			dname_str(xfr->name, zname);
6382 			verbose(VERB_ALGO, "auth_zone %s unchanged, new lease, wait", zname);
6383 		}
6384 		xfr_probe_disown(xfr);
6385 		if(xfr->have_zone)
6386 			xfr->lease_time = *env->now;
6387 		if(xfr->task_nextprobe->worker == NULL)
6388 			xfr_set_timeout(xfr, env, 0, 0);
6389 	} else {
6390 		if(verbosity >= VERB_ALGO) {
6391 			char zname[255+1];
6392 			dname_str(xfr->name, zname);
6393 			verbose(VERB_ALGO, "auth zone %s soa probe failed, wait to retry", zname);
6394 		}
6395 		/* we failed to send this as well, move to the wait task,
6396 		 * use the shorter retry timeout */
6397 		xfr_probe_disown(xfr);
6398 		/* pick up the nextprobe task and wait */
6399 		if(xfr->task_nextprobe->worker == NULL)
6400 			xfr_set_timeout(xfr, env, 1, 0);
6401 	}
6402 
6403 	lock_basic_unlock(&xfr->lock);
6404 }
6405 
6406 /** callback for task_probe lookup of host name, of A or AAAA */
6407 void auth_xfer_probe_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
6408 	enum sec_status ATTR_UNUSED(sec), char* ATTR_UNUSED(why_bogus),
6409 	int ATTR_UNUSED(was_ratelimited))
6410 {
6411 	struct auth_xfer* xfr = (struct auth_xfer*)arg;
6412 	struct module_env* env;
6413 	log_assert(xfr->task_probe);
6414 	lock_basic_lock(&xfr->lock);
6415 	env = xfr->task_probe->env;
6416 	if(!env || env->outnet->want_to_quit) {
6417 		lock_basic_unlock(&xfr->lock);
6418 		return; /* stop on quit */
6419 	}
6420 
6421 	/* process result */
6422 	if(rcode == LDNS_RCODE_NOERROR) {
6423 		uint16_t wanted_qtype = LDNS_RR_TYPE_A;
6424 		struct regional* temp = env->scratch;
6425 		struct query_info rq;
6426 		struct reply_info* rep;
6427 		if(xfr->task_probe->lookup_aaaa)
6428 			wanted_qtype = LDNS_RR_TYPE_AAAA;
6429 		memset(&rq, 0, sizeof(rq));
6430 		rep = parse_reply_in_temp_region(buf, temp, &rq);
6431 		if(rep && rq.qtype == wanted_qtype &&
6432 			FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_NOERROR) {
6433 			/* parsed successfully */
6434 			struct ub_packed_rrset_key* answer =
6435 				reply_find_answer_rrset(&rq, rep);
6436 			if(answer) {
6437 				xfr_master_add_addrs(xfr->task_probe->
6438 					lookup_target, answer, wanted_qtype);
6439 			} else {
6440 				if(verbosity >= VERB_ALGO) {
6441 					char zname[255+1];
6442 					dname_str(xfr->name, zname);
6443 					verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup has nodata", zname, xfr->task_probe->lookup_target->host, (xfr->task_probe->lookup_aaaa?"AAAA":"A"));
6444 				}
6445 			}
6446 		} else {
6447 			if(verbosity >= VERB_ALGO) {
6448 				char zname[255+1];
6449 				dname_str(xfr->name, zname);
6450 				verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup has no address", zname, xfr->task_probe->lookup_target->host, (xfr->task_probe->lookup_aaaa?"AAAA":"A"));
6451 			}
6452 		}
6453 		regional_free_all(temp);
6454 	} else {
6455 		if(verbosity >= VERB_ALGO) {
6456 			char zname[255+1];
6457 			dname_str(xfr->name, zname);
6458 			verbose(VERB_ALGO, "auth zone %s host %s type %s probe lookup failed", zname, xfr->task_probe->lookup_target->host, (xfr->task_probe->lookup_aaaa?"AAAA":"A"));
6459 		}
6460 	}
6461 	if(xfr->task_probe->lookup_target->list &&
6462 		xfr->task_probe->lookup_target == xfr_probe_current_master(xfr))
6463 		xfr->task_probe->scan_addr = xfr->task_probe->lookup_target->list;
6464 
6465 	/* move to lookup AAAA after A lookup, move to next hostname lookup,
6466 	 * or move to send the probes, or, if nothing to do, end task_probe */
6467 	xfr_probe_move_to_next_lookup(xfr, env);
6468 	xfr_probe_send_or_end(xfr, env);
6469 }
6470 
6471 /** disown task_nextprobe.  caller must hold xfr.lock */
6472 static void
6473 xfr_nextprobe_disown(struct auth_xfer* xfr)
6474 {
6475 	/* delete the timer, because the next worker to pick this up may
6476 	 * not have the same event base */
6477 	comm_timer_delete(xfr->task_nextprobe->timer);
6478 	xfr->task_nextprobe->timer = NULL;
6479 	xfr->task_nextprobe->next_probe = 0;
6480 	/* we don't own this item anymore */
6481 	xfr->task_nextprobe->worker = NULL;
6482 	xfr->task_nextprobe->env = NULL;
6483 }
6484 
6485 /** xfer nextprobe timeout callback, this is part of task_nextprobe */
6486 void
6487 auth_xfer_timer(void* arg)
6488 {
6489 	struct auth_xfer* xfr = (struct auth_xfer*)arg;
6490 	struct module_env* env;
6491 	log_assert(xfr->task_nextprobe);
6492 	lock_basic_lock(&xfr->lock);
6493 	env = xfr->task_nextprobe->env;
6494 	if(!env || env->outnet->want_to_quit) {
6495 		lock_basic_unlock(&xfr->lock);
6496 		return; /* stop on quit */
6497 	}
6498 
6499 	/* see if zone has expired, and if so, also set auth_zone expired */
6500 	if(xfr->have_zone && !xfr->zone_expired &&
6501 	   *env->now >= xfr->lease_time + xfr->expiry) {
6502 		lock_basic_unlock(&xfr->lock);
6503 		auth_xfer_set_expired(xfr, env, 1);
6504 		lock_basic_lock(&xfr->lock);
6505 	}
6506 
6507 	xfr_nextprobe_disown(xfr);
6508 
6509 	if(!xfr_start_probe(xfr, env, NULL)) {
6510 		/* not started because already in progress */
6511 		lock_basic_unlock(&xfr->lock);
6512 	}
6513 }
6514 
6515 /** return true if there are probe (SOA UDP query) targets in the master list*/
6516 static int
6517 have_probe_targets(struct auth_master* list)
6518 {
6519 	struct auth_master* p;
6520 	for(p=list; p; p = p->next) {
6521 		if(!p->allow_notify && p->host)
6522 			return 1;
6523 	}
6524 	return 0;
6525 }
6526 
6527 /** start task_probe if possible, if no masters for probe start task_transfer
6528  * returns true if task has been started, and false if the task is already
6529  * in progress. */
6530 static int
6531 xfr_start_probe(struct auth_xfer* xfr, struct module_env* env,
6532 	struct auth_master* spec)
6533 {
6534 	/* see if we need to start a probe (or maybe it is already in
6535 	 * progress (due to notify)) */
6536 	if(xfr->task_probe->worker == NULL) {
6537 		if(!have_probe_targets(xfr->task_probe->masters) &&
6538 			!(xfr->task_probe->only_lookup &&
6539 			xfr->task_probe->masters != NULL)) {
6540 			/* useless to pick up task_probe, no masters to
6541 			 * probe. Instead attempt to pick up task transfer */
6542 			if(xfr->task_transfer->worker == NULL) {
6543 				xfr_start_transfer(xfr, env, spec);
6544 				return 1;
6545 			}
6546 			/* task transfer already in progress */
6547 			return 0;
6548 		}
6549 
6550 		/* pick up the probe task ourselves */
6551 		xfr->task_probe->worker = env->worker;
6552 		xfr->task_probe->env = env;
6553 		xfr->task_probe->cp = NULL;
6554 
6555 		/* start the task */
6556 		/* have not seen a new lease yet, this scan */
6557 		xfr->task_probe->have_new_lease = 0;
6558 		/* if this was a timeout, no specific first master to scan */
6559 		/* otherwise, spec is nonNULL the notified master, scan
6560 		 * first and also transfer first from it */
6561 		xfr_probe_start_list(xfr, spec);
6562 		/* setup to start the lookup of hostnames of masters afresh */
6563 		xfr_probe_start_lookups(xfr);
6564 		/* send the probe packet or next send, or end task */
6565 		xfr_probe_send_or_end(xfr, env);
6566 		return 1;
6567 	}
6568 	return 0;
6569 }
6570 
6571 /** for task_nextprobe.
6572  * determine next timeout for auth_xfer. Also (re)sets timer.
6573  * @param xfr: task structure
6574  * @param env: module environment, with worker and time.
6575  * @param failure: set true if timer should be set for failure retry.
6576  * @param lookup_only: only perform lookups when timer done, 0 sec timeout
6577  */
6578 static void
6579 xfr_set_timeout(struct auth_xfer* xfr, struct module_env* env,
6580 	int failure, int lookup_only)
6581 {
6582 	struct timeval tv;
6583 	log_assert(xfr->task_nextprobe != NULL);
6584 	log_assert(xfr->task_nextprobe->worker == NULL ||
6585 		xfr->task_nextprobe->worker == env->worker);
6586 	/* normally, nextprobe = startoflease + refresh,
6587 	 * but if expiry is sooner, use that one.
6588 	 * after a failure, use the retry timer instead. */
6589 	xfr->task_nextprobe->next_probe = *env->now;
6590 	if(xfr->lease_time && !failure)
6591 		xfr->task_nextprobe->next_probe = xfr->lease_time;
6592 
6593 	if(!failure) {
6594 		xfr->task_nextprobe->backoff = 0;
6595 	} else {
6596 		if(xfr->task_nextprobe->backoff == 0)
6597 				xfr->task_nextprobe->backoff = 3;
6598 		else	xfr->task_nextprobe->backoff *= 2;
6599 		if(xfr->task_nextprobe->backoff > AUTH_TRANSFER_MAX_BACKOFF)
6600 			xfr->task_nextprobe->backoff =
6601 				AUTH_TRANSFER_MAX_BACKOFF;
6602 	}
6603 
6604 	if(xfr->have_zone) {
6605 		time_t wait = xfr->refresh;
6606 		if(failure) wait = xfr->retry;
6607 		if(xfr->expiry < wait)
6608 			xfr->task_nextprobe->next_probe += xfr->expiry;
6609 		else	xfr->task_nextprobe->next_probe += wait;
6610 		if(failure)
6611 			xfr->task_nextprobe->next_probe +=
6612 				xfr->task_nextprobe->backoff;
6613 		/* put the timer exactly on expiry, if possible */
6614 		if(xfr->lease_time && xfr->lease_time+xfr->expiry <
6615 			xfr->task_nextprobe->next_probe &&
6616 			xfr->lease_time+xfr->expiry > *env->now)
6617 			xfr->task_nextprobe->next_probe =
6618 				xfr->lease_time+xfr->expiry;
6619 	} else {
6620 		xfr->task_nextprobe->next_probe +=
6621 			xfr->task_nextprobe->backoff;
6622 	}
6623 
6624 	if(!xfr->task_nextprobe->timer) {
6625 		xfr->task_nextprobe->timer = comm_timer_create(
6626 			env->worker_base, auth_xfer_timer, xfr);
6627 		if(!xfr->task_nextprobe->timer) {
6628 			/* failed to malloc memory. likely zone transfer
6629 			 * also fails for that. skip the timeout */
6630 			char zname[255+1];
6631 			dname_str(xfr->name, zname);
6632 			log_err("cannot allocate timer, no refresh for %s",
6633 				zname);
6634 			return;
6635 		}
6636 	}
6637 	xfr->task_nextprobe->worker = env->worker;
6638 	xfr->task_nextprobe->env = env;
6639 	if(*(xfr->task_nextprobe->env->now) <= xfr->task_nextprobe->next_probe)
6640 		tv.tv_sec = xfr->task_nextprobe->next_probe -
6641 			*(xfr->task_nextprobe->env->now);
6642 	else	tv.tv_sec = 0;
6643 	if(tv.tv_sec != 0 && lookup_only && xfr->task_probe->masters) {
6644 		/* don't lookup_only, if lookup timeout is 0 anyway,
6645 		 * or if we don't have masters to lookup */
6646 		tv.tv_sec = 0;
6647 		if(xfr->task_probe->worker == NULL)
6648 			xfr->task_probe->only_lookup = 1;
6649 	}
6650 	if(verbosity >= VERB_ALGO) {
6651 		char zname[255+1];
6652 		dname_str(xfr->name, zname);
6653 		verbose(VERB_ALGO, "auth zone %s timeout in %d seconds",
6654 			zname, (int)tv.tv_sec);
6655 	}
6656 	tv.tv_usec = 0;
6657 	comm_timer_set(xfr->task_nextprobe->timer, &tv);
6658 }
6659 
6660 /** initial pick up of worker timeouts, ties events to worker event loop */
6661 void
6662 auth_xfer_pickup_initial(struct auth_zones* az, struct module_env* env)
6663 {
6664 	struct auth_xfer* x;
6665 	lock_rw_wrlock(&az->lock);
6666 	RBTREE_FOR(x, struct auth_xfer*, &az->xtree) {
6667 		lock_basic_lock(&x->lock);
6668 		/* set lease_time, because we now have timestamp in env,
6669 		 * (not earlier during startup and apply_cfg), and this
6670 		 * notes the start time when the data was acquired */
6671 		if(x->have_zone)
6672 			x->lease_time = *env->now;
6673 		if(x->task_nextprobe && x->task_nextprobe->worker == NULL) {
6674 			xfr_set_timeout(x, env, 0, 1);
6675 		}
6676 		lock_basic_unlock(&x->lock);
6677 	}
6678 	lock_rw_unlock(&az->lock);
6679 }
6680 
6681 void auth_zones_cleanup(struct auth_zones* az)
6682 {
6683 	struct auth_xfer* x;
6684 	lock_rw_wrlock(&az->lock);
6685 	RBTREE_FOR(x, struct auth_xfer*, &az->xtree) {
6686 		lock_basic_lock(&x->lock);
6687 		if(x->task_nextprobe && x->task_nextprobe->worker != NULL) {
6688 			xfr_nextprobe_disown(x);
6689 		}
6690 		if(x->task_probe && x->task_probe->worker != NULL) {
6691 			xfr_probe_disown(x);
6692 		}
6693 		if(x->task_transfer && x->task_transfer->worker != NULL) {
6694 			auth_chunks_delete(x->task_transfer);
6695 			xfr_transfer_disown(x);
6696 		}
6697 		lock_basic_unlock(&x->lock);
6698 	}
6699 	lock_rw_unlock(&az->lock);
6700 }
6701 
6702 /**
6703  * malloc the xfer and tasks
6704  * @param z: auth_zone with name of zone.
6705  */
6706 static struct auth_xfer*
6707 auth_xfer_new(struct auth_zone* z)
6708 {
6709 	struct auth_xfer* xfr;
6710 	xfr = (struct auth_xfer*)calloc(1, sizeof(*xfr));
6711 	if(!xfr) return NULL;
6712 	xfr->name = memdup(z->name, z->namelen);
6713 	if(!xfr->name) {
6714 		free(xfr);
6715 		return NULL;
6716 	}
6717 	xfr->node.key = xfr;
6718 	xfr->namelen = z->namelen;
6719 	xfr->namelabs = z->namelabs;
6720 	xfr->dclass = z->dclass;
6721 
6722 	xfr->task_nextprobe = (struct auth_nextprobe*)calloc(1,
6723 		sizeof(struct auth_nextprobe));
6724 	if(!xfr->task_nextprobe) {
6725 		free(xfr->name);
6726 		free(xfr);
6727 		return NULL;
6728 	}
6729 	xfr->task_probe = (struct auth_probe*)calloc(1,
6730 		sizeof(struct auth_probe));
6731 	if(!xfr->task_probe) {
6732 		free(xfr->task_nextprobe);
6733 		free(xfr->name);
6734 		free(xfr);
6735 		return NULL;
6736 	}
6737 	xfr->task_transfer = (struct auth_transfer*)calloc(1,
6738 		sizeof(struct auth_transfer));
6739 	if(!xfr->task_transfer) {
6740 		free(xfr->task_probe);
6741 		free(xfr->task_nextprobe);
6742 		free(xfr->name);
6743 		free(xfr);
6744 		return NULL;
6745 	}
6746 
6747 	lock_basic_init(&xfr->lock);
6748 	lock_protect(&xfr->lock, &xfr->name, sizeof(xfr->name));
6749 	lock_protect(&xfr->lock, &xfr->namelen, sizeof(xfr->namelen));
6750 	lock_protect(&xfr->lock, xfr->name, xfr->namelen);
6751 	lock_protect(&xfr->lock, &xfr->namelabs, sizeof(xfr->namelabs));
6752 	lock_protect(&xfr->lock, &xfr->dclass, sizeof(xfr->dclass));
6753 	lock_protect(&xfr->lock, &xfr->notify_received, sizeof(xfr->notify_received));
6754 	lock_protect(&xfr->lock, &xfr->notify_serial, sizeof(xfr->notify_serial));
6755 	lock_protect(&xfr->lock, &xfr->zone_expired, sizeof(xfr->zone_expired));
6756 	lock_protect(&xfr->lock, &xfr->have_zone, sizeof(xfr->have_zone));
6757 	lock_protect(&xfr->lock, &xfr->serial, sizeof(xfr->serial));
6758 	lock_protect(&xfr->lock, &xfr->retry, sizeof(xfr->retry));
6759 	lock_protect(&xfr->lock, &xfr->refresh, sizeof(xfr->refresh));
6760 	lock_protect(&xfr->lock, &xfr->expiry, sizeof(xfr->expiry));
6761 	lock_protect(&xfr->lock, &xfr->lease_time, sizeof(xfr->lease_time));
6762 	lock_protect(&xfr->lock, &xfr->task_nextprobe->worker,
6763 		sizeof(xfr->task_nextprobe->worker));
6764 	lock_protect(&xfr->lock, &xfr->task_probe->worker,
6765 		sizeof(xfr->task_probe->worker));
6766 	lock_protect(&xfr->lock, &xfr->task_transfer->worker,
6767 		sizeof(xfr->task_transfer->worker));
6768 	lock_basic_lock(&xfr->lock);
6769 	return xfr;
6770 }
6771 
6772 /** Create auth_xfer structure.
6773  * This populates the have_zone, soa values, and so on times.
6774  * and sets the timeout, if a zone transfer is needed a short timeout is set.
6775  * For that the auth_zone itself must exist (and read in zonefile)
6776  * returns false on alloc failure. */
6777 struct auth_xfer*
6778 auth_xfer_create(struct auth_zones* az, struct auth_zone* z)
6779 {
6780 	struct auth_xfer* xfr;
6781 
6782 	/* malloc it */
6783 	xfr = auth_xfer_new(z);
6784 	if(!xfr) {
6785 		log_err("malloc failure");
6786 		return NULL;
6787 	}
6788 	/* insert in tree */
6789 	(void)rbtree_insert(&az->xtree, &xfr->node);
6790 	return xfr;
6791 }
6792 
6793 /** create new auth_master structure */
6794 static struct auth_master*
6795 auth_master_new(struct auth_master*** list)
6796 {
6797 	struct auth_master *m;
6798 	m = (struct auth_master*)calloc(1, sizeof(*m));
6799 	if(!m) {
6800 		log_err("malloc failure");
6801 		return NULL;
6802 	}
6803 	/* set first pointer to m, or next pointer of previous element to m */
6804 	(**list) = m;
6805 	/* store m's next pointer as future point to store at */
6806 	(*list) = &(m->next);
6807 	return m;
6808 }
6809 
6810 /** dup_prefix : create string from initial part of other string, malloced */
6811 static char*
6812 dup_prefix(char* str, size_t num)
6813 {
6814 	char* result;
6815 	size_t len = strlen(str);
6816 	if(len < num) num = len; /* not more than strlen */
6817 	result = (char*)malloc(num+1);
6818 	if(!result) {
6819 		log_err("malloc failure");
6820 		return result;
6821 	}
6822 	memmove(result, str, num);
6823 	result[num] = 0;
6824 	return result;
6825 }
6826 
6827 /** dup string and print error on error */
6828 static char*
6829 dup_all(char* str)
6830 {
6831 	char* result = strdup(str);
6832 	if(!result) {
6833 		log_err("malloc failure");
6834 		return NULL;
6835 	}
6836 	return result;
6837 }
6838 
6839 /** find first of two characters */
6840 static char*
6841 str_find_first_of_chars(char* s, char a, char b)
6842 {
6843 	char* ra = strchr(s, a);
6844 	char* rb = strchr(s, b);
6845 	if(!ra) return rb;
6846 	if(!rb) return ra;
6847 	if(ra < rb) return ra;
6848 	return rb;
6849 }
6850 
6851 /** parse URL into host and file parts, false on malloc or parse error */
6852 static int
6853 parse_url(char* url, char** host, char** file, int* port, int* ssl)
6854 {
6855 	char* p = url;
6856 	/* parse http://www.example.com/file.htm
6857 	 * or http://127.0.0.1   (index.html)
6858 	 * or https://[::1@1234]/a/b/c/d */
6859 	*ssl = 1;
6860 	*port = AUTH_HTTPS_PORT;
6861 
6862 	/* parse http:// or https:// */
6863 	if(strncmp(p, "http://", 7) == 0) {
6864 		p += 7;
6865 		*ssl = 0;
6866 		*port = AUTH_HTTP_PORT;
6867 	} else if(strncmp(p, "https://", 8) == 0) {
6868 		p += 8;
6869 	} else if(strstr(p, "://") && strchr(p, '/') > strstr(p, "://") &&
6870 		strchr(p, ':') >= strstr(p, "://")) {
6871 		char* uri = dup_prefix(p, (size_t)(strstr(p, "://")-p));
6872 		log_err("protocol %s:// not supported (for url %s)",
6873 			uri?uri:"", p);
6874 		free(uri);
6875 		return 0;
6876 	}
6877 
6878 	/* parse hostname part */
6879 	if(p[0] == '[') {
6880 		char* end = strchr(p, ']');
6881 		p++; /* skip over [ */
6882 		if(end) {
6883 			*host = dup_prefix(p, (size_t)(end-p));
6884 			if(!*host) return 0;
6885 			p = end+1; /* skip over ] */
6886 		} else {
6887 			*host = dup_all(p);
6888 			if(!*host) return 0;
6889 			p = end;
6890 		}
6891 	} else {
6892 		char* end = str_find_first_of_chars(p, ':', '/');
6893 		if(end) {
6894 			*host = dup_prefix(p, (size_t)(end-p));
6895 			if(!*host) return 0;
6896 		} else {
6897 			*host = dup_all(p);
6898 			if(!*host) return 0;
6899 		}
6900 		p = end; /* at next : or / or NULL */
6901 	}
6902 
6903 	/* parse port number */
6904 	if(p && p[0] == ':') {
6905 		char* end = NULL;
6906 		*port = strtol(p+1, &end, 10);
6907 		p = end;
6908 	}
6909 
6910 	/* parse filename part */
6911 	while(p && *p == '/')
6912 		p++;
6913 	if(!p || p[0] == 0)
6914 		*file = strdup("index.html");
6915 	else	*file = strdup(p);
6916 	if(!*file) {
6917 		log_err("malloc failure");
6918 		return 0;
6919 	}
6920 	return 1;
6921 }
6922 
6923 int
6924 xfer_set_masters(struct auth_master** list, struct config_auth* c,
6925 	int with_http)
6926 {
6927 	struct auth_master* m;
6928 	struct config_strlist* p;
6929 	/* list points to the first, or next pointer for the new element */
6930 	while(*list) {
6931 		list = &( (*list)->next );
6932 	}
6933 	if(with_http)
6934 	  for(p = c->urls; p; p = p->next) {
6935 		m = auth_master_new(&list);
6936 		m->http = 1;
6937 		if(!parse_url(p->str, &m->host, &m->file, &m->port, &m->ssl))
6938 			return 0;
6939 	}
6940 	for(p = c->masters; p; p = p->next) {
6941 		m = auth_master_new(&list);
6942 		m->ixfr = 1; /* this flag is not configurable */
6943 		m->host = strdup(p->str);
6944 		if(!m->host) {
6945 			log_err("malloc failure");
6946 			return 0;
6947 		}
6948 	}
6949 	for(p = c->allow_notify; p; p = p->next) {
6950 		m = auth_master_new(&list);
6951 		m->allow_notify = 1;
6952 		m->host = strdup(p->str);
6953 		if(!m->host) {
6954 			log_err("malloc failure");
6955 			return 0;
6956 		}
6957 	}
6958 	return 1;
6959 }
6960 
6961 #define SERIAL_BITS	32
6962 int
6963 compare_serial(uint32_t a, uint32_t b)
6964 {
6965 	const uint32_t cutoff = ((uint32_t) 1 << (SERIAL_BITS - 1));
6966 
6967 	if (a == b) {
6968 		return 0;
6969 	} else if ((a < b && b - a < cutoff) || (a > b && a - b > cutoff)) {
6970 		return -1;
6971 	} else {
6972 		return 1;
6973 	}
6974 }
6975