xref: /freebsd/contrib/unbound/validator/autotrust.c (revision d3d381b2b194b4d24853e92eecef55f262688d1a)
1 /*
2  * validator/autotrust.c - RFC5011 trust anchor management for unbound.
3  *
4  * Copyright (c) 2009, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * Contains autotrust implementation. The implementation was taken from
40  * the autotrust daemon (BSD licensed), written by Matthijs Mekking.
41  * It was modified to fit into unbound. The state table process is the same.
42  */
43 #include "config.h"
44 #include "validator/autotrust.h"
45 #include "validator/val_anchor.h"
46 #include "validator/val_utils.h"
47 #include "validator/val_sigcrypt.h"
48 #include "util/data/dname.h"
49 #include "util/data/packed_rrset.h"
50 #include "util/log.h"
51 #include "util/module.h"
52 #include "util/net_help.h"
53 #include "util/config_file.h"
54 #include "util/regional.h"
55 #include "util/random.h"
56 #include "util/data/msgparse.h"
57 #include "services/mesh.h"
58 #include "services/cache/rrset.h"
59 #include "validator/val_kcache.h"
60 #include "sldns/sbuffer.h"
61 #include "sldns/wire2str.h"
62 #include "sldns/str2wire.h"
63 #include "sldns/keyraw.h"
64 #include "sldns/rrdef.h"
65 #include <stdarg.h>
66 #include <ctype.h>
67 
68 /** number of times a key must be seen before it can become valid */
69 #define MIN_PENDINGCOUNT 2
70 
71 /** Event: Revoked */
72 static void do_revoked(struct module_env* env, struct autr_ta* anchor, int* c);
73 
74 struct autr_global_data* autr_global_create(void)
75 {
76 	struct autr_global_data* global;
77 	global = (struct autr_global_data*)malloc(sizeof(*global));
78 	if(!global)
79 		return NULL;
80 	rbtree_init(&global->probe, &probetree_cmp);
81 	return global;
82 }
83 
84 void autr_global_delete(struct autr_global_data* global)
85 {
86 	if(!global)
87 		return;
88 	/* elements deleted by parent */
89 	memset(global, 0, sizeof(*global));
90 	free(global);
91 }
92 
93 int probetree_cmp(const void* x, const void* y)
94 {
95 	struct trust_anchor* a = (struct trust_anchor*)x;
96 	struct trust_anchor* b = (struct trust_anchor*)y;
97 	log_assert(a->autr && b->autr);
98 	if(a->autr->next_probe_time < b->autr->next_probe_time)
99 		return -1;
100 	if(a->autr->next_probe_time > b->autr->next_probe_time)
101 		return 1;
102 	/* time is equal, sort on trust point identity */
103 	return anchor_cmp(x, y);
104 }
105 
106 size_t
107 autr_get_num_anchors(struct val_anchors* anchors)
108 {
109 	size_t res = 0;
110 	if(!anchors)
111 		return 0;
112 	lock_basic_lock(&anchors->lock);
113 	if(anchors->autr)
114 		res = anchors->autr->probe.count;
115 	lock_basic_unlock(&anchors->lock);
116 	return res;
117 }
118 
119 /** Position in string */
120 static int
121 position_in_string(char *str, const char* sub)
122 {
123 	char* pos = strstr(str, sub);
124 	if(pos)
125 		return (int)(pos-str)+(int)strlen(sub);
126 	return -1;
127 }
128 
129 /** Debug routine to print pretty key information */
130 static void
131 verbose_key(struct autr_ta* ta, enum verbosity_value level,
132 	const char* format, ...) ATTR_FORMAT(printf, 3, 4);
133 
134 /**
135  * Implementation of debug pretty key print
136  * @param ta: trust anchor key with DNSKEY data.
137  * @param level: verbosity level to print at.
138  * @param format: printf style format string.
139  */
140 static void
141 verbose_key(struct autr_ta* ta, enum verbosity_value level,
142 	const char* format, ...)
143 {
144 	va_list args;
145 	va_start(args, format);
146 	if(verbosity >= level) {
147 		char* str = sldns_wire2str_dname(ta->rr, ta->dname_len);
148 		int keytag = (int)sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
149 			ta->rr, ta->rr_len, ta->dname_len),
150 			sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
151 			ta->dname_len));
152 		char msg[MAXSYSLOGMSGLEN];
153 		vsnprintf(msg, sizeof(msg), format, args);
154 		verbose(level, "%s key %d %s", str?str:"??", keytag, msg);
155 		free(str);
156 	}
157 	va_end(args);
158 }
159 
160 /**
161  * Parse comments
162  * @param str: to parse
163  * @param ta: trust key autotrust metadata
164  * @return false on failure.
165  */
166 static int
167 parse_comments(char* str, struct autr_ta* ta)
168 {
169         int len = (int)strlen(str), pos = 0, timestamp = 0;
170         char* comment = (char*) malloc(sizeof(char)*len+1);
171         char* comments = comment;
172 	if(!comment) {
173 		log_err("malloc failure in parse");
174                 return 0;
175 	}
176 	/* skip over whitespace and data at start of line */
177         while (*str != '\0' && *str != ';')
178                 str++;
179         if (*str == ';')
180                 str++;
181         /* copy comments */
182         while (*str != '\0')
183         {
184                 *comments = *str;
185                 comments++;
186                 str++;
187         }
188         *comments = '\0';
189 
190         comments = comment;
191 
192         /* read state */
193         pos = position_in_string(comments, "state=");
194         if (pos >= (int) strlen(comments))
195         {
196 		log_err("parse error");
197                 free(comment);
198                 return 0;
199         }
200         if (pos <= 0)
201                 ta->s = AUTR_STATE_VALID;
202         else
203         {
204                 int s = (int) comments[pos] - '0';
205                 switch(s)
206                 {
207                         case AUTR_STATE_START:
208                         case AUTR_STATE_ADDPEND:
209                         case AUTR_STATE_VALID:
210                         case AUTR_STATE_MISSING:
211                         case AUTR_STATE_REVOKED:
212                         case AUTR_STATE_REMOVED:
213                                 ta->s = s;
214                                 break;
215                         default:
216 				verbose_key(ta, VERB_OPS, "has undefined "
217 					"state, considered NewKey");
218                                 ta->s = AUTR_STATE_START;
219                                 break;
220                 }
221         }
222         /* read pending count */
223         pos = position_in_string(comments, "count=");
224         if (pos >= (int) strlen(comments))
225         {
226 		log_err("parse error");
227                 free(comment);
228                 return 0;
229         }
230         if (pos <= 0)
231                 ta->pending_count = 0;
232         else
233         {
234                 comments += pos;
235                 ta->pending_count = (uint8_t)atoi(comments);
236         }
237 
238         /* read last change */
239         pos = position_in_string(comments, "lastchange=");
240         if (pos >= (int) strlen(comments))
241         {
242 		log_err("parse error");
243                 free(comment);
244                 return 0;
245         }
246         if (pos >= 0)
247         {
248                 comments += pos;
249                 timestamp = atoi(comments);
250         }
251         if (pos < 0 || !timestamp)
252 		ta->last_change = 0;
253         else
254                 ta->last_change = (time_t)timestamp;
255 
256         free(comment);
257         return 1;
258 }
259 
260 /** Check if a line contains data (besides comments) */
261 static int
262 str_contains_data(char* str, char comment)
263 {
264         while (*str != '\0') {
265                 if (*str == comment || *str == '\n')
266                         return 0;
267                 if (*str != ' ' && *str != '\t')
268                         return 1;
269                 str++;
270         }
271         return 0;
272 }
273 
274 /** Get DNSKEY flags
275  * rdata without rdatalen in front of it. */
276 static int
277 dnskey_flags(uint16_t t, uint8_t* rdata, size_t len)
278 {
279 	uint16_t f;
280 	if(t != LDNS_RR_TYPE_DNSKEY)
281 		return 0;
282 	if(len < 2)
283 		return 0;
284 	memmove(&f, rdata, 2);
285 	f = ntohs(f);
286 	return (int)f;
287 }
288 
289 /** Check if KSK DNSKEY.
290  * pass rdata without rdatalen in front of it */
291 static int
292 rr_is_dnskey_sep(uint16_t t, uint8_t* rdata, size_t len)
293 {
294 	return (dnskey_flags(t, rdata, len)&DNSKEY_BIT_SEP);
295 }
296 
297 /** Check if TA is KSK DNSKEY */
298 static int
299 ta_is_dnskey_sep(struct autr_ta* ta)
300 {
301 	return (dnskey_flags(
302 		sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len),
303 		sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len),
304 		sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len)
305 		) & DNSKEY_BIT_SEP);
306 }
307 
308 /** Check if REVOKED DNSKEY
309  * pass rdata without rdatalen in front of it */
310 static int
311 rr_is_dnskey_revoked(uint16_t t, uint8_t* rdata, size_t len)
312 {
313 	return (dnskey_flags(t, rdata, len)&LDNS_KEY_REVOKE_KEY);
314 }
315 
316 /** create ta */
317 static struct autr_ta*
318 autr_ta_create(uint8_t* rr, size_t rr_len, size_t dname_len)
319 {
320 	struct autr_ta* ta = (struct autr_ta*)calloc(1, sizeof(*ta));
321 	if(!ta) {
322 		free(rr);
323 		return NULL;
324 	}
325 	ta->rr = rr;
326 	ta->rr_len = rr_len;
327 	ta->dname_len = dname_len;
328 	return ta;
329 }
330 
331 /** create tp */
332 static struct trust_anchor*
333 autr_tp_create(struct val_anchors* anchors, uint8_t* own, size_t own_len,
334 	uint16_t dc)
335 {
336 	struct trust_anchor* tp = (struct trust_anchor*)calloc(1, sizeof(*tp));
337 	if(!tp) return NULL;
338 	tp->name = memdup(own, own_len);
339 	if(!tp->name) {
340 		free(tp);
341 		return NULL;
342 	}
343 	tp->namelen = own_len;
344 	tp->namelabs = dname_count_labels(tp->name);
345 	tp->node.key = tp;
346 	tp->dclass = dc;
347 	tp->autr = (struct autr_point_data*)calloc(1, sizeof(*tp->autr));
348 	if(!tp->autr) {
349 		free(tp->name);
350 		free(tp);
351 		return NULL;
352 	}
353 	tp->autr->pnode.key = tp;
354 
355 	lock_basic_lock(&anchors->lock);
356 	if(!rbtree_insert(anchors->tree, &tp->node)) {
357 		lock_basic_unlock(&anchors->lock);
358 		log_err("trust anchor presented twice");
359 		free(tp->name);
360 		free(tp->autr);
361 		free(tp);
362 		return NULL;
363 	}
364 	if(!rbtree_insert(&anchors->autr->probe, &tp->autr->pnode)) {
365 		(void)rbtree_delete(anchors->tree, tp);
366 		lock_basic_unlock(&anchors->lock);
367 		log_err("trust anchor in probetree twice");
368 		free(tp->name);
369 		free(tp->autr);
370 		free(tp);
371 		return NULL;
372 	}
373 	lock_basic_unlock(&anchors->lock);
374 	lock_basic_init(&tp->lock);
375 	lock_protect(&tp->lock, tp, sizeof(*tp));
376 	lock_protect(&tp->lock, tp->autr, sizeof(*tp->autr));
377 	return tp;
378 }
379 
380 /** delete assembled rrsets */
381 static void
382 autr_rrset_delete(struct ub_packed_rrset_key* r)
383 {
384 	if(r) {
385 		free(r->rk.dname);
386 		free(r->entry.data);
387 		free(r);
388 	}
389 }
390 
391 void autr_point_delete(struct trust_anchor* tp)
392 {
393 	if(!tp)
394 		return;
395 	lock_unprotect(&tp->lock, tp);
396 	lock_unprotect(&tp->lock, tp->autr);
397 	lock_basic_destroy(&tp->lock);
398 	autr_rrset_delete(tp->ds_rrset);
399 	autr_rrset_delete(tp->dnskey_rrset);
400 	if(tp->autr) {
401 		struct autr_ta* p = tp->autr->keys, *np;
402 		while(p) {
403 			np = p->next;
404 			free(p->rr);
405 			free(p);
406 			p = np;
407 		}
408 		free(tp->autr->file);
409 		free(tp->autr);
410 	}
411 	free(tp->name);
412 	free(tp);
413 }
414 
415 /** find or add a new trust point for autotrust */
416 static struct trust_anchor*
417 find_add_tp(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
418 	size_t dname_len)
419 {
420 	struct trust_anchor* tp;
421 	tp = anchor_find(anchors, rr, dname_count_labels(rr), dname_len,
422 		sldns_wirerr_get_class(rr, rr_len, dname_len));
423 	if(tp) {
424 		if(!tp->autr) {
425 			log_err("anchor cannot be with and without autotrust");
426 			lock_basic_unlock(&tp->lock);
427 			return NULL;
428 		}
429 		return tp;
430 	}
431 	tp = autr_tp_create(anchors, rr, dname_len, sldns_wirerr_get_class(rr,
432 		rr_len, dname_len));
433 	if(!tp)
434 		return NULL;
435 	lock_basic_lock(&tp->lock);
436 	return tp;
437 }
438 
439 /** Add trust anchor from RR */
440 static struct autr_ta*
441 add_trustanchor_frm_rr(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
442         size_t dname_len, struct trust_anchor** tp)
443 {
444 	struct autr_ta* ta = autr_ta_create(rr, rr_len, dname_len);
445 	if(!ta)
446 		return NULL;
447 	*tp = find_add_tp(anchors, rr, rr_len, dname_len);
448 	if(!*tp) {
449 		free(ta->rr);
450 		free(ta);
451 		return NULL;
452 	}
453 	/* add ta to tp */
454 	ta->next = (*tp)->autr->keys;
455 	(*tp)->autr->keys = ta;
456 	lock_basic_unlock(&(*tp)->lock);
457 	return ta;
458 }
459 
460 /**
461  * Add new trust anchor from a string in file.
462  * @param anchors: all anchors
463  * @param str: string with anchor and comments, if any comments.
464  * @param tp: trust point returned.
465  * @param origin: what to use for @
466  * @param origin_len: length of origin
467  * @param prev: previous rr name
468  * @param prev_len: length of prev
469  * @param skip: if true, the result is NULL, but not an error, skip it.
470  * @return new key in trust point.
471  */
472 static struct autr_ta*
473 add_trustanchor_frm_str(struct val_anchors* anchors, char* str,
474 	struct trust_anchor** tp, uint8_t* origin, size_t origin_len,
475 	uint8_t** prev, size_t* prev_len, int* skip)
476 {
477 	uint8_t rr[LDNS_RR_BUF_SIZE];
478 	size_t rr_len = sizeof(rr), dname_len;
479 	uint8_t* drr;
480 	int lstatus;
481         if (!str_contains_data(str, ';')) {
482 		*skip = 1;
483                 return NULL; /* empty line */
484 	}
485 	if(0 != (lstatus = sldns_str2wire_rr_buf(str, rr, &rr_len, &dname_len,
486 		0, origin, origin_len, *prev, *prev_len)))
487 	{
488 		log_err("ldns error while converting string to RR at%d: %s: %s",
489 			LDNS_WIREPARSE_OFFSET(lstatus),
490 			sldns_get_errorstr_parse(lstatus), str);
491 		return NULL;
492 	}
493 	free(*prev);
494 	*prev = memdup(rr, dname_len);
495 	*prev_len = dname_len;
496 	if(!*prev) {
497 		log_err("malloc failure in add_trustanchor");
498 		return NULL;
499 	}
500 	if(sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DNSKEY &&
501 		sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DS) {
502 		*skip = 1;
503 		return NULL; /* only DS and DNSKEY allowed */
504 	}
505 	drr = memdup(rr, rr_len);
506 	if(!drr) {
507 		log_err("malloc failure in add trustanchor");
508 		return NULL;
509 	}
510 	return add_trustanchor_frm_rr(anchors, drr, rr_len, dname_len, tp);
511 }
512 
513 /**
514  * Load single anchor
515  * @param anchors: all points.
516  * @param str: comments line
517  * @param fname: filename
518  * @param origin: the $ORIGIN.
519  * @param origin_len: length of origin
520  * @param prev: passed to ldns.
521  * @param prev_len: length of prev
522  * @param skip: if true, the result is NULL, but not an error, skip it.
523  * @return false on failure, otherwise the tp read.
524  */
525 static struct trust_anchor*
526 load_trustanchor(struct val_anchors* anchors, char* str, const char* fname,
527 	uint8_t* origin, size_t origin_len, uint8_t** prev, size_t* prev_len,
528 	int* skip)
529 {
530 	struct autr_ta* ta = NULL;
531 	struct trust_anchor* tp = NULL;
532 
533 	ta = add_trustanchor_frm_str(anchors, str, &tp, origin, origin_len,
534 		prev, prev_len, skip);
535 	if(!ta)
536 		return NULL;
537 	lock_basic_lock(&tp->lock);
538 	if(!parse_comments(str, ta)) {
539 		lock_basic_unlock(&tp->lock);
540 		return NULL;
541 	}
542 	if(!tp->autr->file) {
543 		tp->autr->file = strdup(fname);
544 		if(!tp->autr->file) {
545 			lock_basic_unlock(&tp->lock);
546 			log_err("malloc failure");
547 			return NULL;
548 		}
549 	}
550 	lock_basic_unlock(&tp->lock);
551         return tp;
552 }
553 
554 /** iterator for DSes from keylist. return true if a next element exists */
555 static int
556 assemble_iterate_ds(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
557 	size_t* dname_len)
558 {
559 	while(*list) {
560 		if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
561 			(*list)->dname_len) == LDNS_RR_TYPE_DS) {
562 			*rr = (*list)->rr;
563 			*rr_len = (*list)->rr_len;
564 			*dname_len = (*list)->dname_len;
565 			*list = (*list)->next;
566 			return 1;
567 		}
568 		*list = (*list)->next;
569 	}
570 	return 0;
571 }
572 
573 /** iterator for DNSKEYs from keylist. return true if a next element exists */
574 static int
575 assemble_iterate_dnskey(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
576 	size_t* dname_len)
577 {
578 	while(*list) {
579 		if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
580 		   (*list)->dname_len) != LDNS_RR_TYPE_DS &&
581 			((*list)->s == AUTR_STATE_VALID ||
582 			 (*list)->s == AUTR_STATE_MISSING)) {
583 			*rr = (*list)->rr;
584 			*rr_len = (*list)->rr_len;
585 			*dname_len = (*list)->dname_len;
586 			*list = (*list)->next;
587 			return 1;
588 		}
589 		*list = (*list)->next;
590 	}
591 	return 0;
592 }
593 
594 /** see if iterator-list has any elements in it, or it is empty */
595 static int
596 assemble_iterate_hasfirst(int iter(struct autr_ta**, uint8_t**, size_t*,
597 	size_t*), struct autr_ta* list)
598 {
599 	uint8_t* rr = NULL;
600 	size_t rr_len = 0, dname_len = 0;
601 	return iter(&list, &rr, &rr_len, &dname_len);
602 }
603 
604 /** number of elements in iterator list */
605 static size_t
606 assemble_iterate_count(int iter(struct autr_ta**, uint8_t**, size_t*,
607 	size_t*), struct autr_ta* list)
608 {
609 	uint8_t* rr = NULL;
610 	size_t i = 0, rr_len = 0, dname_len = 0;
611 	while(iter(&list, &rr, &rr_len, &dname_len)) {
612 		i++;
613 	}
614 	return i;
615 }
616 
617 /**
618  * Create a ub_packed_rrset_key allocated on the heap.
619  * It therefore does not have the correct ID value, and cannot be used
620  * inside the cache.  It can be used in storage outside of the cache.
621  * Keys for the cache have to be obtained from alloc.h .
622  * @param iter: iterator over the elements in the list.  It filters elements.
623  * @param list: the list.
624  * @return key allocated or NULL on failure.
625  */
626 static struct ub_packed_rrset_key*
627 ub_packed_rrset_heap_key(int iter(struct autr_ta**, uint8_t**, size_t*,
628 	size_t*), struct autr_ta* list)
629 {
630 	uint8_t* rr = NULL;
631 	size_t rr_len = 0, dname_len = 0;
632 	struct ub_packed_rrset_key* k;
633 	if(!iter(&list, &rr, &rr_len, &dname_len))
634 		return NULL;
635 	k = (struct ub_packed_rrset_key*)calloc(1, sizeof(*k));
636 	if(!k)
637 		return NULL;
638 	k->rk.type = htons(sldns_wirerr_get_type(rr, rr_len, dname_len));
639 	k->rk.rrset_class = htons(sldns_wirerr_get_class(rr, rr_len, dname_len));
640 	k->rk.dname_len = dname_len;
641 	k->rk.dname = memdup(rr, dname_len);
642 	if(!k->rk.dname) {
643 		free(k);
644 		return NULL;
645 	}
646 	return k;
647 }
648 
649 /**
650  * Create packed_rrset data on the heap.
651  * @param iter: iterator over the elements in the list.  It filters elements.
652  * @param list: the list.
653  * @return data allocated or NULL on failure.
654  */
655 static struct packed_rrset_data*
656 packed_rrset_heap_data(int iter(struct autr_ta**, uint8_t**, size_t*,
657 	size_t*), struct autr_ta* list)
658 {
659 	uint8_t* rr = NULL;
660 	size_t rr_len = 0, dname_len = 0;
661 	struct packed_rrset_data* data;
662 	size_t count=0, rrsig_count=0, len=0, i, total;
663 	uint8_t* nextrdata;
664 	struct autr_ta* list_i;
665 	time_t ttl = 0;
666 
667 	list_i = list;
668 	while(iter(&list_i, &rr, &rr_len, &dname_len)) {
669 		if(sldns_wirerr_get_type(rr, rr_len, dname_len) ==
670 			LDNS_RR_TYPE_RRSIG)
671 			rrsig_count++;
672 		else	count++;
673 		/* sizeof the rdlength + rdatalen */
674 		len += 2 + sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
675 		ttl = (time_t)sldns_wirerr_get_ttl(rr, rr_len, dname_len);
676 	}
677 	if(count == 0 && rrsig_count == 0)
678 		return NULL;
679 
680 	/* allocate */
681 	total = count + rrsig_count;
682 	len += sizeof(*data) + total*(sizeof(size_t) + sizeof(time_t) +
683 		sizeof(uint8_t*));
684 	data = (struct packed_rrset_data*)calloc(1, len);
685 	if(!data)
686 		return NULL;
687 
688 	/* fill it */
689 	data->ttl = ttl;
690 	data->count = count;
691 	data->rrsig_count = rrsig_count;
692 	data->rr_len = (size_t*)((uint8_t*)data +
693 		sizeof(struct packed_rrset_data));
694 	data->rr_data = (uint8_t**)&(data->rr_len[total]);
695 	data->rr_ttl = (time_t*)&(data->rr_data[total]);
696 	nextrdata = (uint8_t*)&(data->rr_ttl[total]);
697 
698 	/* fill out len, ttl, fields */
699 	list_i = list;
700 	i = 0;
701 	while(iter(&list_i, &rr, &rr_len, &dname_len)) {
702 		data->rr_ttl[i] = (time_t)sldns_wirerr_get_ttl(rr, rr_len,
703 			dname_len);
704 		if(data->rr_ttl[i] < data->ttl)
705 			data->ttl = data->rr_ttl[i];
706 		data->rr_len[i] = 2 /* the rdlength */ +
707 			sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
708 		i++;
709 	}
710 
711 	/* fixup rest of ptrs */
712 	for(i=0; i<total; i++) {
713 		data->rr_data[i] = nextrdata;
714 		nextrdata += data->rr_len[i];
715 	}
716 
717 	/* copy data in there */
718 	list_i = list;
719 	i = 0;
720 	while(iter(&list_i, &rr, &rr_len, &dname_len)) {
721 		memmove(data->rr_data[i],
722 			sldns_wirerr_get_rdatawl(rr, rr_len, dname_len),
723 			data->rr_len[i]);
724 		i++;
725 	}
726 
727 	if(data->rrsig_count && data->count == 0) {
728 		data->count = data->rrsig_count; /* rrset type is RRSIG */
729 		data->rrsig_count = 0;
730 	}
731 	return data;
732 }
733 
734 /**
735  * Assemble the trust anchors into DS and DNSKEY packed rrsets.
736  * Uses only VALID and MISSING DNSKEYs.
737  * Read the sldns_rrs and builds packed rrsets
738  * @param tp: the trust point. Must be locked.
739  * @return false on malloc failure.
740  */
741 static int
742 autr_assemble(struct trust_anchor* tp)
743 {
744 	struct ub_packed_rrset_key* ubds=NULL, *ubdnskey=NULL;
745 
746 	/* make packed rrset keys - malloced with no ID number, they
747 	 * are not in the cache */
748 	/* make packed rrset data (if there is a key) */
749 	if(assemble_iterate_hasfirst(assemble_iterate_ds, tp->autr->keys)) {
750 		ubds = ub_packed_rrset_heap_key(
751 			assemble_iterate_ds, tp->autr->keys);
752 		if(!ubds)
753 			goto error_cleanup;
754 		ubds->entry.data = packed_rrset_heap_data(
755 			assemble_iterate_ds, tp->autr->keys);
756 		if(!ubds->entry.data)
757 			goto error_cleanup;
758 	}
759 
760 	/* make packed DNSKEY data */
761 	if(assemble_iterate_hasfirst(assemble_iterate_dnskey, tp->autr->keys)) {
762 		ubdnskey = ub_packed_rrset_heap_key(
763 			assemble_iterate_dnskey, tp->autr->keys);
764 		if(!ubdnskey)
765 			goto error_cleanup;
766 		ubdnskey->entry.data = packed_rrset_heap_data(
767 			assemble_iterate_dnskey, tp->autr->keys);
768 		if(!ubdnskey->entry.data) {
769 		error_cleanup:
770 			autr_rrset_delete(ubds);
771 			autr_rrset_delete(ubdnskey);
772 			return 0;
773 		}
774 	}
775 
776 	/* we have prepared the new keys so nothing can go wrong any more.
777 	 * And we are sure we cannot be left without trustanchor after
778 	 * any errors. Put in the new keys and remove old ones. */
779 
780 	/* free the old data */
781 	autr_rrset_delete(tp->ds_rrset);
782 	autr_rrset_delete(tp->dnskey_rrset);
783 
784 	/* assign the data to replace the old */
785 	tp->ds_rrset = ubds;
786 	tp->dnskey_rrset = ubdnskey;
787 	tp->numDS = assemble_iterate_count(assemble_iterate_ds,
788 		tp->autr->keys);
789 	tp->numDNSKEY = assemble_iterate_count(assemble_iterate_dnskey,
790 		tp->autr->keys);
791 	return 1;
792 }
793 
794 /** parse integer */
795 static unsigned int
796 parse_int(char* line, int* ret)
797 {
798 	char *e;
799 	unsigned int x = (unsigned int)strtol(line, &e, 10);
800 	if(line == e) {
801 		*ret = -1; /* parse error */
802 		return 0;
803 	}
804 	*ret = 1; /* matched */
805 	return x;
806 }
807 
808 /** parse id sequence for anchor */
809 static struct trust_anchor*
810 parse_id(struct val_anchors* anchors, char* line)
811 {
812 	struct trust_anchor *tp;
813 	int r;
814 	uint16_t dclass;
815 	uint8_t* dname;
816 	size_t dname_len;
817 	/* read the owner name */
818 	char* next = strchr(line, ' ');
819 	if(!next)
820 		return NULL;
821 	next[0] = 0;
822 	dname = sldns_str2wire_dname(line, &dname_len);
823 	if(!dname)
824 		return NULL;
825 
826 	/* read the class */
827 	dclass = parse_int(next+1, &r);
828 	if(r == -1) {
829 		free(dname);
830 		return NULL;
831 	}
832 
833 	/* find the trust point */
834 	tp = autr_tp_create(anchors, dname, dname_len, dclass);
835 	free(dname);
836 	return tp;
837 }
838 
839 /**
840  * Parse variable from trustanchor header
841  * @param line: to parse
842  * @param anchors: the anchor is added to this, if "id:" is seen.
843  * @param anchor: the anchor as result value or previously returned anchor
844  * 	value to read the variable lines into.
845  * @return: 0 no match, -1 failed syntax error, +1 success line read.
846  * 	+2 revoked trust anchor file.
847  */
848 static int
849 parse_var_line(char* line, struct val_anchors* anchors,
850 	struct trust_anchor** anchor)
851 {
852 	struct trust_anchor* tp = *anchor;
853 	int r = 0;
854 	if(strncmp(line, ";;id: ", 6) == 0) {
855 		*anchor = parse_id(anchors, line+6);
856 		if(!*anchor) return -1;
857 		else return 1;
858 	} else if(strncmp(line, ";;REVOKED", 9) == 0) {
859 		if(tp) {
860 			log_err("REVOKED statement must be at start of file");
861 			return -1;
862 		}
863 		return 2;
864 	} else if(strncmp(line, ";;last_queried: ", 16) == 0) {
865 		if(!tp) return -1;
866 		lock_basic_lock(&tp->lock);
867 		tp->autr->last_queried = (time_t)parse_int(line+16, &r);
868 		lock_basic_unlock(&tp->lock);
869 	} else if(strncmp(line, ";;last_success: ", 16) == 0) {
870 		if(!tp) return -1;
871 		lock_basic_lock(&tp->lock);
872 		tp->autr->last_success = (time_t)parse_int(line+16, &r);
873 		lock_basic_unlock(&tp->lock);
874 	} else if(strncmp(line, ";;next_probe_time: ", 19) == 0) {
875 		if(!tp) return -1;
876 		lock_basic_lock(&anchors->lock);
877 		lock_basic_lock(&tp->lock);
878 		(void)rbtree_delete(&anchors->autr->probe, tp);
879 		tp->autr->next_probe_time = (time_t)parse_int(line+19, &r);
880 		(void)rbtree_insert(&anchors->autr->probe, &tp->autr->pnode);
881 		lock_basic_unlock(&tp->lock);
882 		lock_basic_unlock(&anchors->lock);
883 	} else if(strncmp(line, ";;query_failed: ", 16) == 0) {
884 		if(!tp) return -1;
885 		lock_basic_lock(&tp->lock);
886 		tp->autr->query_failed = (uint8_t)parse_int(line+16, &r);
887 		lock_basic_unlock(&tp->lock);
888 	} else if(strncmp(line, ";;query_interval: ", 18) == 0) {
889 		if(!tp) return -1;
890 		lock_basic_lock(&tp->lock);
891 		tp->autr->query_interval = (time_t)parse_int(line+18, &r);
892 		lock_basic_unlock(&tp->lock);
893 	} else if(strncmp(line, ";;retry_time: ", 14) == 0) {
894 		if(!tp) return -1;
895 		lock_basic_lock(&tp->lock);
896 		tp->autr->retry_time = (time_t)parse_int(line+14, &r);
897 		lock_basic_unlock(&tp->lock);
898 	}
899 	return r;
900 }
901 
902 /** handle origin lines */
903 static int
904 handle_origin(char* line, uint8_t** origin, size_t* origin_len)
905 {
906 	size_t len = 0;
907 	while(isspace((unsigned char)*line))
908 		line++;
909 	if(strncmp(line, "$ORIGIN", 7) != 0)
910 		return 0;
911 	free(*origin);
912 	line += 7;
913 	while(isspace((unsigned char)*line))
914 		line++;
915 	*origin = sldns_str2wire_dname(line, &len);
916 	*origin_len = len;
917 	if(!*origin)
918 		log_warn("malloc failure or parse error in $ORIGIN");
919 	return 1;
920 }
921 
922 /** Read one line and put multiline RRs onto one line string */
923 static int
924 read_multiline(char* buf, size_t len, FILE* in, int* linenr)
925 {
926 	char* pos = buf;
927 	size_t left = len;
928 	int depth = 0;
929 	buf[len-1] = 0;
930 	while(left > 0 && fgets(pos, (int)left, in) != NULL) {
931 		size_t i, poslen = strlen(pos);
932 		(*linenr)++;
933 
934 		/* check what the new depth is after the line */
935 		/* this routine cannot handle braces inside quotes,
936 		   say for TXT records, but this routine only has to read keys */
937 		for(i=0; i<poslen; i++) {
938 			if(pos[i] == '(') {
939 				depth++;
940 			} else if(pos[i] == ')') {
941 				if(depth == 0) {
942 					log_err("mismatch: too many ')'");
943 					return -1;
944 				}
945 				depth--;
946 			} else if(pos[i] == ';') {
947 				break;
948 			}
949 		}
950 
951 		/* normal oneline or last line: keeps newline and comments */
952 		if(depth == 0) {
953 			return 1;
954 		}
955 
956 		/* more lines expected, snip off comments and newline */
957 		if(poslen>0)
958 			pos[poslen-1] = 0; /* strip newline */
959 		if(strchr(pos, ';'))
960 			strchr(pos, ';')[0] = 0; /* strip comments */
961 
962 		/* move to paste other lines behind this one */
963 		poslen = strlen(pos);
964 		pos += poslen;
965 		left -= poslen;
966 		/* the newline is changed into a space */
967 		if(left <= 2 /* space and eos */) {
968 			log_err("line too long");
969 			return -1;
970 		}
971 		pos[0] = ' ';
972 		pos[1] = 0;
973 		pos += 1;
974 		left -= 1;
975 	}
976 	if(depth != 0) {
977 		log_err("mismatch: too many '('");
978 		return -1;
979 	}
980 	if(pos != buf)
981 		return 1;
982 	return 0;
983 }
984 
985 int autr_read_file(struct val_anchors* anchors, const char* nm)
986 {
987         /* the file descriptor */
988         FILE* fd;
989         /* keep track of line numbers */
990         int line_nr = 0;
991         /* single line */
992         char line[10240];
993 	/* trust point being read */
994 	struct trust_anchor *tp = NULL, *tp2;
995 	int r;
996 	/* for $ORIGIN parsing */
997 	uint8_t *origin=NULL, *prev=NULL;
998 	size_t origin_len=0, prev_len=0;
999 
1000         if (!(fd = fopen(nm, "r"))) {
1001                 log_err("unable to open %s for reading: %s",
1002 			nm, strerror(errno));
1003                 return 0;
1004         }
1005         verbose(VERB_ALGO, "reading autotrust anchor file %s", nm);
1006         while ( (r=read_multiline(line, sizeof(line), fd, &line_nr)) != 0) {
1007 		if(r == -1 || (r = parse_var_line(line, anchors, &tp)) == -1) {
1008 			log_err("could not parse auto-trust-anchor-file "
1009 				"%s line %d", nm, line_nr);
1010 			fclose(fd);
1011 			free(origin);
1012 			free(prev);
1013 			return 0;
1014 		} else if(r == 1) {
1015 			continue;
1016 		} else if(r == 2) {
1017 			log_warn("trust anchor %s has been revoked", nm);
1018 			fclose(fd);
1019 			free(origin);
1020 			free(prev);
1021 			return 1;
1022 		}
1023         	if (!str_contains_data(line, ';'))
1024                 	continue; /* empty lines allowed */
1025  		if(handle_origin(line, &origin, &origin_len))
1026 			continue;
1027 		r = 0;
1028                 if(!(tp2=load_trustanchor(anchors, line, nm, origin,
1029 			origin_len, &prev, &prev_len, &r))) {
1030 			if(!r) log_err("failed to load trust anchor from %s "
1031 				"at line %i, skipping", nm, line_nr);
1032                         /* try to do the rest */
1033 			continue;
1034                 }
1035 		if(tp && tp != tp2) {
1036 			log_err("file %s has mismatching data inside: "
1037 				"the file may only contain keys for one name, "
1038 				"remove keys for other domain names", nm);
1039         		fclose(fd);
1040 			free(origin);
1041 			free(prev);
1042 			return 0;
1043 		}
1044 		tp = tp2;
1045         }
1046         fclose(fd);
1047 	free(origin);
1048 	free(prev);
1049 	if(!tp) {
1050 		log_err("failed to read %s", nm);
1051 		return 0;
1052 	}
1053 
1054 	/* now assemble the data into DNSKEY and DS packed rrsets */
1055 	lock_basic_lock(&tp->lock);
1056 	if(!autr_assemble(tp)) {
1057 		lock_basic_unlock(&tp->lock);
1058 		log_err("malloc failure assembling %s", nm);
1059 		return 0;
1060 	}
1061 	lock_basic_unlock(&tp->lock);
1062 	return 1;
1063 }
1064 
1065 /** string for a trustanchor state */
1066 static const char*
1067 trustanchor_state2str(autr_state_type s)
1068 {
1069         switch (s) {
1070                 case AUTR_STATE_START:       return "  START  ";
1071                 case AUTR_STATE_ADDPEND:     return " ADDPEND ";
1072                 case AUTR_STATE_VALID:       return "  VALID  ";
1073                 case AUTR_STATE_MISSING:     return " MISSING ";
1074                 case AUTR_STATE_REVOKED:     return " REVOKED ";
1075                 case AUTR_STATE_REMOVED:     return " REMOVED ";
1076         }
1077         return " UNKNOWN ";
1078 }
1079 
1080 /** print ID to file */
1081 static int
1082 print_id(FILE* out, char* fname, uint8_t* nm, size_t nmlen, uint16_t dclass)
1083 {
1084 	char* s = sldns_wire2str_dname(nm, nmlen);
1085 	if(!s) {
1086 		log_err("malloc failure in write to %s", fname);
1087 		return 0;
1088 	}
1089 	if(fprintf(out, ";;id: %s %d\n", s, (int)dclass) < 0) {
1090 		log_err("could not write to %s: %s", fname, strerror(errno));
1091 		free(s);
1092 		return 0;
1093 	}
1094 	free(s);
1095 	return 1;
1096 }
1097 
1098 static int
1099 autr_write_contents(FILE* out, char* fn, struct trust_anchor* tp)
1100 {
1101 	char tmi[32];
1102 	struct autr_ta* ta;
1103 	char* str;
1104 
1105 	/* write pretty header */
1106 	if(fprintf(out, "; autotrust trust anchor file\n") < 0) {
1107 		log_err("could not write to %s: %s", fn, strerror(errno));
1108 		return 0;
1109 	}
1110 	if(tp->autr->revoked) {
1111 		if(fprintf(out, ";;REVOKED\n") < 0 ||
1112 		   fprintf(out, "; The zone has all keys revoked, and is\n"
1113 			"; considered as if it has no trust anchors.\n"
1114 			"; the remainder of the file is the last probe.\n"
1115 			"; to restart the trust anchor, overwrite this file.\n"
1116 			"; with one containing valid DNSKEYs or DSes.\n") < 0) {
1117 		   log_err("could not write to %s: %s", fn, strerror(errno));
1118 		   return 0;
1119 		}
1120 	}
1121 	if(!print_id(out, fn, tp->name, tp->namelen, tp->dclass)) {
1122 		return 0;
1123 	}
1124 	if(fprintf(out, ";;last_queried: %u ;;%s",
1125 		(unsigned int)tp->autr->last_queried,
1126 		ctime_r(&(tp->autr->last_queried), tmi)) < 0 ||
1127 	   fprintf(out, ";;last_success: %u ;;%s",
1128 		(unsigned int)tp->autr->last_success,
1129 		ctime_r(&(tp->autr->last_success), tmi)) < 0 ||
1130 	   fprintf(out, ";;next_probe_time: %u ;;%s",
1131 		(unsigned int)tp->autr->next_probe_time,
1132 		ctime_r(&(tp->autr->next_probe_time), tmi)) < 0 ||
1133 	   fprintf(out, ";;query_failed: %d\n", (int)tp->autr->query_failed)<0
1134 	   || fprintf(out, ";;query_interval: %d\n",
1135 	   (int)tp->autr->query_interval) < 0 ||
1136 	   fprintf(out, ";;retry_time: %d\n", (int)tp->autr->retry_time) < 0) {
1137 		log_err("could not write to %s: %s", fn, strerror(errno));
1138 		return 0;
1139 	}
1140 
1141 	/* write anchors */
1142 	for(ta=tp->autr->keys; ta; ta=ta->next) {
1143 		/* by default do not store START and REMOVED keys */
1144 		if(ta->s == AUTR_STATE_START)
1145 			continue;
1146 		if(ta->s == AUTR_STATE_REMOVED)
1147 			continue;
1148 		/* only store keys */
1149 		if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len)
1150 			!= LDNS_RR_TYPE_DNSKEY)
1151 			continue;
1152 		str = sldns_wire2str_rr(ta->rr, ta->rr_len);
1153 		if(!str || !str[0]) {
1154 			free(str);
1155 			log_err("malloc failure writing %s", fn);
1156 			return 0;
1157 		}
1158 		str[strlen(str)-1] = 0; /* remove newline */
1159 		if(fprintf(out, "%s ;;state=%d [%s] ;;count=%d "
1160 			";;lastchange=%u ;;%s", str, (int)ta->s,
1161 			trustanchor_state2str(ta->s), (int)ta->pending_count,
1162 			(unsigned int)ta->last_change,
1163 			ctime_r(&(ta->last_change), tmi)) < 0) {
1164 		   log_err("could not write to %s: %s", fn, strerror(errno));
1165 		   free(str);
1166 		   return 0;
1167 		}
1168 		free(str);
1169 	}
1170 	return 1;
1171 }
1172 
1173 void autr_write_file(struct module_env* env, struct trust_anchor* tp)
1174 {
1175 	FILE* out;
1176 	char* fname = tp->autr->file;
1177 	char tempf[2048];
1178 	log_assert(tp->autr);
1179 	if(!env) {
1180 		log_err("autr_write_file: Module environment is NULL.");
1181 		return;
1182 	}
1183 	/* unique name with pid number and thread number */
1184 	snprintf(tempf, sizeof(tempf), "%s.%d-%d", fname, (int)getpid(),
1185 		env->worker?*(int*)env->worker:0);
1186 	verbose(VERB_ALGO, "autotrust: write to disk: %s", tempf);
1187 	out = fopen(tempf, "w");
1188 	if(!out) {
1189 		fatal_exit("could not open autotrust file for writing, %s: %s",
1190 			tempf, strerror(errno));
1191 		return;
1192 	}
1193 	if(!autr_write_contents(out, tempf, tp)) {
1194 		/* failed to write contents (completely) */
1195 		fclose(out);
1196 		unlink(tempf);
1197 		fatal_exit("could not completely write: %s", fname);
1198 		return;
1199 	}
1200 	if(fflush(out) != 0)
1201 		log_err("could not fflush(%s): %s", fname, strerror(errno));
1202 #ifdef HAVE_FSYNC
1203 	if(fsync(fileno(out)) != 0)
1204 		log_err("could not fsync(%s): %s", fname, strerror(errno));
1205 #else
1206 	FlushFileBuffers((HANDLE)_get_osfhandle(_fileno(out)));
1207 #endif
1208 	if(fclose(out) != 0) {
1209 		fatal_exit("could not complete write: %s: %s",
1210 			fname, strerror(errno));
1211 		unlink(tempf);
1212 		return;
1213 	}
1214 	/* success; overwrite actual file */
1215 	verbose(VERB_ALGO, "autotrust: replaced %s", fname);
1216 #ifdef UB_ON_WINDOWS
1217 	(void)unlink(fname); /* windows does not replace file with rename() */
1218 #endif
1219 	if(rename(tempf, fname) < 0) {
1220 		fatal_exit("rename(%s to %s): %s", tempf, fname, strerror(errno));
1221 	}
1222 }
1223 
1224 /**
1225  * Verify if dnskey works for trust point
1226  * @param env: environment (with time) for verification
1227  * @param ve: validator environment (with options) for verification.
1228  * @param tp: trust point to verify with
1229  * @param rrset: DNSKEY rrset to verify.
1230  * @param qstate: qstate with region.
1231  * @return false on failure, true if verification successful.
1232  */
1233 static int
1234 verify_dnskey(struct module_env* env, struct val_env* ve,
1235         struct trust_anchor* tp, struct ub_packed_rrset_key* rrset,
1236 	struct module_qstate* qstate)
1237 {
1238 	char* reason = NULL;
1239 	uint8_t sigalg[ALGO_NEEDS_MAX+1];
1240 	int downprot = env->cfg->harden_algo_downgrade;
1241 	enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve, rrset,
1242 		tp->ds_rrset, tp->dnskey_rrset, downprot?sigalg:NULL, &reason,
1243 		qstate);
1244 	/* sigalg is ignored, it returns algorithms signalled to exist, but
1245 	 * in 5011 there are no other rrsets to check.  if downprot is
1246 	 * enabled, then it checks that the DNSKEY is signed with all
1247 	 * algorithms available in the trust store. */
1248 	verbose(VERB_ALGO, "autotrust: validate DNSKEY with anchor: %s",
1249 		sec_status_to_string(sec));
1250 	return sec == sec_status_secure;
1251 }
1252 
1253 static int32_t
1254 rrsig_get_expiry(uint8_t* d, size_t len)
1255 {
1256 	/* rrsig: 2(rdlen), 2(type) 1(alg) 1(v) 4(origttl), then 4(expi), (4)incep) */
1257 	if(len < 2+8+4)
1258 		return 0;
1259 	return sldns_read_uint32(d+2+8);
1260 }
1261 
1262 /** Find minimum expiration interval from signatures */
1263 static time_t
1264 min_expiry(struct module_env* env, struct packed_rrset_data* dd)
1265 {
1266 	size_t i;
1267 	int32_t t, r = 15 * 24 * 3600; /* 15 days max */
1268 	for(i=dd->count; i<dd->count+dd->rrsig_count; i++) {
1269 		t = rrsig_get_expiry(dd->rr_data[i], dd->rr_len[i]);
1270 		if((int32_t)t - (int32_t)*env->now > 0) {
1271 			t -= (int32_t)*env->now;
1272 			if(t < r)
1273 				r = t;
1274 		}
1275 	}
1276 	return (time_t)r;
1277 }
1278 
1279 /** Is rr self-signed revoked key */
1280 static int
1281 rr_is_selfsigned_revoked(struct module_env* env, struct val_env* ve,
1282 	struct ub_packed_rrset_key* dnskey_rrset, size_t i,
1283 	struct module_qstate* qstate)
1284 {
1285 	enum sec_status sec;
1286 	char* reason = NULL;
1287 	verbose(VERB_ALGO, "seen REVOKE flag, check self-signed, rr %d",
1288 		(int)i);
1289 	/* no algorithm downgrade protection necessary, if it is selfsigned
1290 	 * revoked it can be removed. */
1291 	sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset, i,
1292 		&reason, LDNS_SECTION_ANSWER, qstate);
1293 	return (sec == sec_status_secure);
1294 }
1295 
1296 /** Set fetched value */
1297 static void
1298 seen_trustanchor(struct autr_ta* ta, uint8_t seen)
1299 {
1300 	ta->fetched = seen;
1301 	if(ta->pending_count < 250) /* no numerical overflow, please */
1302 		ta->pending_count++;
1303 }
1304 
1305 /** set revoked value */
1306 static void
1307 seen_revoked_trustanchor(struct autr_ta* ta, uint8_t revoked)
1308 {
1309 	ta->revoked = revoked;
1310 }
1311 
1312 /** revoke a trust anchor */
1313 static void
1314 revoke_dnskey(struct autr_ta* ta, int off)
1315 {
1316 	uint16_t flags;
1317 	uint8_t* data;
1318 	if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len) !=
1319 		LDNS_RR_TYPE_DNSKEY)
1320 		return;
1321 	if(sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len) < 2)
1322 		return;
1323 	data = sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len);
1324 	flags = sldns_read_uint16(data);
1325 	if (off && (flags&LDNS_KEY_REVOKE_KEY))
1326 		flags ^= LDNS_KEY_REVOKE_KEY; /* flip */
1327 	else
1328 		flags |= LDNS_KEY_REVOKE_KEY;
1329 	sldns_write_uint16(data, flags);
1330 }
1331 
1332 /** Compare two RRs skipping the REVOKED bit. Pass rdata(no len) */
1333 static int
1334 dnskey_compare_skip_revbit(uint8_t* a, size_t a_len, uint8_t* b, size_t b_len)
1335 {
1336 	size_t i;
1337 	if(a_len != b_len)
1338 		return -1;
1339 	/* compare RRs RDATA byte for byte. */
1340 	for(i = 0; i < a_len; i++)
1341 	{
1342 		uint8_t rdf1, rdf2;
1343 		rdf1 = a[i];
1344 		rdf2 = b[i];
1345 		if(i==1) {
1346 			/* this is the second part of the flags field */
1347 			rdf1 |= LDNS_KEY_REVOKE_KEY;
1348 			rdf2 |= LDNS_KEY_REVOKE_KEY;
1349 		}
1350 		if (rdf1 < rdf2)	return -1;
1351 		else if (rdf1 > rdf2)	return 1;
1352         }
1353 	return 0;
1354 }
1355 
1356 
1357 /** compare trust anchor with rdata, 0 if equal. Pass rdata(no len) */
1358 static int
1359 ta_compare(struct autr_ta* a, uint16_t t, uint8_t* b, size_t b_len)
1360 {
1361 	if(!a) return -1;
1362 	else if(!b) return -1;
1363 	else if(sldns_wirerr_get_type(a->rr, a->rr_len, a->dname_len) != t)
1364 		return (int)sldns_wirerr_get_type(a->rr, a->rr_len,
1365 			a->dname_len) - (int)t;
1366 	else if(t == LDNS_RR_TYPE_DNSKEY) {
1367 		return dnskey_compare_skip_revbit(
1368 			sldns_wirerr_get_rdata(a->rr, a->rr_len, a->dname_len),
1369 			sldns_wirerr_get_rdatalen(a->rr, a->rr_len,
1370 			a->dname_len), b, b_len);
1371 	}
1372 	else if(t == LDNS_RR_TYPE_DS) {
1373 		if(sldns_wirerr_get_rdatalen(a->rr, a->rr_len, a->dname_len) !=
1374 			b_len)
1375 			return -1;
1376 		return memcmp(sldns_wirerr_get_rdata(a->rr,
1377 			a->rr_len, a->dname_len), b, b_len);
1378 	}
1379 	return -1;
1380 }
1381 
1382 /**
1383  * Find key
1384  * @param tp: to search in
1385  * @param t: rr type of the rdata.
1386  * @param rdata: to look for  (no rdatalen in it)
1387  * @param rdata_len: length of rdata
1388  * @param result: returns NULL or the ta key looked for.
1389  * @return false on malloc failure during search. if true examine result.
1390  */
1391 static int
1392 find_key(struct trust_anchor* tp, uint16_t t, uint8_t* rdata, size_t rdata_len,
1393 	struct autr_ta** result)
1394 {
1395 	struct autr_ta* ta;
1396 	if(!tp || !rdata) {
1397 		*result = NULL;
1398 		return 0;
1399 	}
1400 	for(ta=tp->autr->keys; ta; ta=ta->next) {
1401 		if(ta_compare(ta, t, rdata, rdata_len) == 0) {
1402 			*result = ta;
1403 			return 1;
1404 		}
1405 	}
1406 	*result = NULL;
1407 	return 1;
1408 }
1409 
1410 /** add key and clone RR and tp already locked. rdata without rdlen. */
1411 static struct autr_ta*
1412 add_key(struct trust_anchor* tp, uint32_t ttl, uint8_t* rdata, size_t rdata_len)
1413 {
1414 	struct autr_ta* ta;
1415 	uint8_t* rr;
1416 	size_t rr_len, dname_len;
1417 	uint16_t rrtype = htons(LDNS_RR_TYPE_DNSKEY);
1418 	uint16_t rrclass = htons(LDNS_RR_CLASS_IN);
1419 	uint16_t rdlen = htons(rdata_len);
1420 	dname_len = tp->namelen;
1421 	ttl = htonl(ttl);
1422 	rr_len = dname_len + 10 /* type,class,ttl,rdatalen */ + rdata_len;
1423 	rr = (uint8_t*)malloc(rr_len);
1424 	if(!rr) return NULL;
1425 	memmove(rr, tp->name, tp->namelen);
1426 	memmove(rr+dname_len, &rrtype, 2);
1427 	memmove(rr+dname_len+2, &rrclass, 2);
1428 	memmove(rr+dname_len+4, &ttl, 4);
1429 	memmove(rr+dname_len+8, &rdlen, 2);
1430 	memmove(rr+dname_len+10, rdata, rdata_len);
1431 	ta = autr_ta_create(rr, rr_len, dname_len);
1432 	if(!ta) {
1433 		/* rr freed in autr_ta_create */
1434 		return NULL;
1435 	}
1436 	/* link in, tp already locked */
1437 	ta->next = tp->autr->keys;
1438 	tp->autr->keys = ta;
1439 	return ta;
1440 }
1441 
1442 /** get TTL from DNSKEY rrset */
1443 static time_t
1444 key_ttl(struct ub_packed_rrset_key* k)
1445 {
1446 	struct packed_rrset_data* d = (struct packed_rrset_data*)k->entry.data;
1447 	return d->ttl;
1448 }
1449 
1450 /** update the time values for the trustpoint */
1451 static void
1452 set_tp_times(struct trust_anchor* tp, time_t rrsig_exp_interval,
1453 	time_t origttl, int* changed)
1454 {
1455 	time_t x, qi = tp->autr->query_interval, rt = tp->autr->retry_time;
1456 
1457 	/* x = MIN(15days, ttl/2, expire/2) */
1458 	x = 15 * 24 * 3600;
1459 	if(origttl/2 < x)
1460 		x = origttl/2;
1461 	if(rrsig_exp_interval/2 < x)
1462 		x = rrsig_exp_interval/2;
1463 	/* MAX(1hr, x) */
1464 	if(!autr_permit_small_holddown) {
1465 		if(x < 3600)
1466 			tp->autr->query_interval = 3600;
1467 		else	tp->autr->query_interval = x;
1468 	}	else    tp->autr->query_interval = x;
1469 
1470 	/* x= MIN(1day, ttl/10, expire/10) */
1471 	x = 24 * 3600;
1472 	if(origttl/10 < x)
1473 		x = origttl/10;
1474 	if(rrsig_exp_interval/10 < x)
1475 		x = rrsig_exp_interval/10;
1476 	/* MAX(1hr, x) */
1477 	if(!autr_permit_small_holddown) {
1478 		if(x < 3600)
1479 			tp->autr->retry_time = 3600;
1480 		else	tp->autr->retry_time = x;
1481 	}	else    tp->autr->retry_time = x;
1482 
1483 	if(qi != tp->autr->query_interval || rt != tp->autr->retry_time) {
1484 		*changed = 1;
1485 		verbose(VERB_ALGO, "orig_ttl is %d", (int)origttl);
1486 		verbose(VERB_ALGO, "rrsig_exp_interval is %d",
1487 			(int)rrsig_exp_interval);
1488 		verbose(VERB_ALGO, "query_interval: %d, retry_time: %d",
1489 			(int)tp->autr->query_interval,
1490 			(int)tp->autr->retry_time);
1491 	}
1492 }
1493 
1494 /** init events to zero */
1495 static void
1496 init_events(struct trust_anchor* tp)
1497 {
1498 	struct autr_ta* ta;
1499 	for(ta=tp->autr->keys; ta; ta=ta->next) {
1500 		ta->fetched = 0;
1501 	}
1502 }
1503 
1504 /** check for revoked keys without trusting any other information */
1505 static void
1506 check_contains_revoked(struct module_env* env, struct val_env* ve,
1507 	struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1508 	int* changed, struct module_qstate* qstate)
1509 {
1510 	struct packed_rrset_data* dd = (struct packed_rrset_data*)
1511 		dnskey_rrset->entry.data;
1512 	size_t i;
1513 	log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1514 	for(i=0; i<dd->count; i++) {
1515 		struct autr_ta* ta = NULL;
1516 		if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1517 			dd->rr_data[i]+2, dd->rr_len[i]-2) ||
1518 			!rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1519 			dd->rr_data[i]+2, dd->rr_len[i]-2))
1520 			continue; /* not a revoked KSK */
1521 		if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1522 			dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1523 			log_err("malloc failure");
1524 			continue; /* malloc fail in compare*/
1525 		}
1526 		if(!ta)
1527 			continue; /* key not found */
1528 		if(rr_is_selfsigned_revoked(env, ve, dnskey_rrset, i, qstate)) {
1529 			/* checked if there is an rrsig signed by this key. */
1530 			/* same keytag, but stored can be revoked already, so
1531 			 * compare keytags, with +0 or +128(REVOKE flag) */
1532 			log_assert(dnskey_calc_keytag(dnskey_rrset, i)-128 ==
1533 				sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1534 				ta->rr, ta->rr_len, ta->dname_len),
1535 				sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1536 				ta->dname_len)) ||
1537 				dnskey_calc_keytag(dnskey_rrset, i) ==
1538 				sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1539 				ta->rr, ta->rr_len, ta->dname_len),
1540 				sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1541 				ta->dname_len))); /* checks conversion*/
1542 			verbose_key(ta, VERB_ALGO, "is self-signed revoked");
1543 			if(!ta->revoked)
1544 				*changed = 1;
1545 			seen_revoked_trustanchor(ta, 1);
1546 			do_revoked(env, ta, changed);
1547 		}
1548 	}
1549 }
1550 
1551 /** See if a DNSKEY is verified by one of the DSes */
1552 static int
1553 key_matches_a_ds(struct module_env* env, struct val_env* ve,
1554 	struct ub_packed_rrset_key* dnskey_rrset, size_t key_idx,
1555 	struct ub_packed_rrset_key* ds_rrset)
1556 {
1557 	struct packed_rrset_data* dd = (struct packed_rrset_data*)
1558 	                ds_rrset->entry.data;
1559 	size_t ds_idx, num = dd->count;
1560 	int d = val_favorite_ds_algo(ds_rrset);
1561 	char* reason = "";
1562 	for(ds_idx=0; ds_idx<num; ds_idx++) {
1563 		if(!ds_digest_algo_is_supported(ds_rrset, ds_idx) ||
1564 			!ds_key_algo_is_supported(ds_rrset, ds_idx) ||
1565 			ds_get_digest_algo(ds_rrset, ds_idx) != d)
1566 			continue;
1567 		if(ds_get_key_algo(ds_rrset, ds_idx)
1568 		   != dnskey_get_algo(dnskey_rrset, key_idx)
1569 		   || dnskey_calc_keytag(dnskey_rrset, key_idx)
1570 		   != ds_get_keytag(ds_rrset, ds_idx)) {
1571 			continue;
1572 		}
1573 		if(!ds_digest_match_dnskey(env, dnskey_rrset, key_idx,
1574 			ds_rrset, ds_idx)) {
1575 			verbose(VERB_ALGO, "DS match attempt failed");
1576 			continue;
1577 		}
1578 		/* match of hash is sufficient for bootstrap of trust point */
1579 		(void)reason;
1580 		(void)ve;
1581 		return 1;
1582 		/* no need to check RRSIG, DS hash already matched with source
1583 		if(dnskey_verify_rrset(env, ve, dnskey_rrset,
1584 			dnskey_rrset, key_idx, &reason) == sec_status_secure) {
1585 			return 1;
1586 		} else {
1587 			verbose(VERB_ALGO, "DS match failed because the key "
1588 				"does not verify the keyset: %s", reason);
1589 		}
1590 		*/
1591 	}
1592 	return 0;
1593 }
1594 
1595 /** Set update events */
1596 static int
1597 update_events(struct module_env* env, struct val_env* ve,
1598 	struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1599 	int* changed)
1600 {
1601 	struct packed_rrset_data* dd = (struct packed_rrset_data*)
1602 		dnskey_rrset->entry.data;
1603 	size_t i;
1604 	log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1605 	init_events(tp);
1606 	for(i=0; i<dd->count; i++) {
1607 		struct autr_ta* ta = NULL;
1608 		if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1609 			dd->rr_data[i]+2, dd->rr_len[i]-2))
1610 			continue;
1611 		if(rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1612 			dd->rr_data[i]+2, dd->rr_len[i]-2)) {
1613 			/* self-signed revoked keys already detected before,
1614 			 * other revoked keys are not 'added' again */
1615 			continue;
1616 		}
1617 		/* is a key of this type supported?. Note rr_list and
1618 		 * packed_rrset are in the same order. */
1619 		if(!dnskey_algo_is_supported(dnskey_rrset, i)) {
1620 			/* skip unknown algorithm key, it is useless to us */
1621 			log_nametypeclass(VERB_DETAIL, "trust point has "
1622 				"unsupported algorithm at",
1623 				tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
1624 			continue;
1625 		}
1626 
1627 		/* is it new? if revocation bit set, find the unrevoked key */
1628 		if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1629 			dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1630 			return 0;
1631 		}
1632 		if(!ta) {
1633 			ta = add_key(tp, (uint32_t)dd->rr_ttl[i],
1634 				dd->rr_data[i]+2, dd->rr_len[i]-2);
1635 			*changed = 1;
1636 			/* first time seen, do we have DSes? if match: VALID */
1637 			if(ta && tp->ds_rrset && key_matches_a_ds(env, ve,
1638 				dnskey_rrset, i, tp->ds_rrset)) {
1639 				verbose_key(ta, VERB_ALGO, "verified by DS");
1640 				ta->s = AUTR_STATE_VALID;
1641 			}
1642 		}
1643 		if(!ta) {
1644 			return 0;
1645 		}
1646 		seen_trustanchor(ta, 1);
1647 		verbose_key(ta, VERB_ALGO, "in DNS response");
1648 	}
1649 	set_tp_times(tp, min_expiry(env, dd), key_ttl(dnskey_rrset), changed);
1650 	return 1;
1651 }
1652 
1653 /**
1654  * Check if the holddown time has already exceeded
1655  * setting: add-holddown: add holddown timer
1656  * setting: del-holddown: del holddown timer
1657  * @param env: environment with current time
1658  * @param ta: trust anchor to check for.
1659  * @param holddown: the timer value
1660  * @return number of seconds the holddown has passed.
1661  */
1662 static time_t
1663 check_holddown(struct module_env* env, struct autr_ta* ta,
1664 	unsigned int holddown)
1665 {
1666         time_t elapsed;
1667 	if(*env->now < ta->last_change) {
1668 		log_warn("time goes backwards. delaying key holddown");
1669 		return 0;
1670 	}
1671 	elapsed = *env->now - ta->last_change;
1672         if (elapsed > (time_t)holddown) {
1673                 return elapsed-(time_t)holddown;
1674         }
1675 	verbose_key(ta, VERB_ALGO, "holddown time " ARG_LL "d seconds to go",
1676 		(long long) ((time_t)holddown-elapsed));
1677         return 0;
1678 }
1679 
1680 
1681 /** Set last_change to now */
1682 static void
1683 reset_holddown(struct module_env* env, struct autr_ta* ta, int* changed)
1684 {
1685 	ta->last_change = *env->now;
1686 	*changed = 1;
1687 }
1688 
1689 /** Set the state for this trust anchor */
1690 static void
1691 set_trustanchor_state(struct module_env* env, struct autr_ta* ta, int* changed,
1692 	autr_state_type s)
1693 {
1694 	verbose_key(ta, VERB_ALGO, "update: %s to %s",
1695 		trustanchor_state2str(ta->s), trustanchor_state2str(s));
1696 	ta->s = s;
1697 	reset_holddown(env, ta, changed);
1698 }
1699 
1700 
1701 /** Event: NewKey */
1702 static void
1703 do_newkey(struct module_env* env, struct autr_ta* anchor, int* c)
1704 {
1705 	if (anchor->s == AUTR_STATE_START)
1706 		set_trustanchor_state(env, anchor, c, AUTR_STATE_ADDPEND);
1707 }
1708 
1709 /** Event: AddTime */
1710 static void
1711 do_addtime(struct module_env* env, struct autr_ta* anchor, int* c)
1712 {
1713 	/* This not according to RFC, this is 30 days, but the RFC demands
1714 	 * MAX(30days, TTL expire time of first DNSKEY set with this key),
1715 	 * The value may be too small if a very large TTL was used. */
1716 	time_t exceeded = check_holddown(env, anchor, env->cfg->add_holddown);
1717 	if (exceeded && anchor->s == AUTR_STATE_ADDPEND) {
1718 		verbose_key(anchor, VERB_ALGO, "add-holddown time exceeded "
1719 			ARG_LL "d seconds ago, and pending-count %d",
1720 			(long long)exceeded, anchor->pending_count);
1721 		if(anchor->pending_count >= MIN_PENDINGCOUNT) {
1722 			set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1723 			anchor->pending_count = 0;
1724 			return;
1725 		}
1726 		verbose_key(anchor, VERB_ALGO, "add-holddown time sanity check "
1727 			"failed (pending count: %d)", anchor->pending_count);
1728 	}
1729 }
1730 
1731 /** Event: RemTime */
1732 static void
1733 do_remtime(struct module_env* env, struct autr_ta* anchor, int* c)
1734 {
1735 	time_t exceeded = check_holddown(env, anchor, env->cfg->del_holddown);
1736 	if(exceeded && anchor->s == AUTR_STATE_REVOKED) {
1737 		verbose_key(anchor, VERB_ALGO, "del-holddown time exceeded "
1738 			ARG_LL "d seconds ago", (long long)exceeded);
1739 		set_trustanchor_state(env, anchor, c, AUTR_STATE_REMOVED);
1740 	}
1741 }
1742 
1743 /** Event: KeyRem */
1744 static void
1745 do_keyrem(struct module_env* env, struct autr_ta* anchor, int* c)
1746 {
1747 	if(anchor->s == AUTR_STATE_ADDPEND) {
1748 		set_trustanchor_state(env, anchor, c, AUTR_STATE_START);
1749 		anchor->pending_count = 0;
1750 	} else if(anchor->s == AUTR_STATE_VALID)
1751 		set_trustanchor_state(env, anchor, c, AUTR_STATE_MISSING);
1752 }
1753 
1754 /** Event: KeyPres */
1755 static void
1756 do_keypres(struct module_env* env, struct autr_ta* anchor, int* c)
1757 {
1758 	if(anchor->s == AUTR_STATE_MISSING)
1759 		set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1760 }
1761 
1762 /* Event: Revoked */
1763 static void
1764 do_revoked(struct module_env* env, struct autr_ta* anchor, int* c)
1765 {
1766 	if(anchor->s == AUTR_STATE_VALID || anchor->s == AUTR_STATE_MISSING) {
1767                 set_trustanchor_state(env, anchor, c, AUTR_STATE_REVOKED);
1768 		verbose_key(anchor, VERB_ALGO, "old id, prior to revocation");
1769                 revoke_dnskey(anchor, 0);
1770 		verbose_key(anchor, VERB_ALGO, "new id, after revocation");
1771 	}
1772 }
1773 
1774 /** Do statestable transition matrix for anchor */
1775 static void
1776 anchor_state_update(struct module_env* env, struct autr_ta* anchor, int* c)
1777 {
1778 	log_assert(anchor);
1779 	switch(anchor->s) {
1780 	/* START */
1781 	case AUTR_STATE_START:
1782 		/* NewKey: ADDPEND */
1783 		if (anchor->fetched)
1784 			do_newkey(env, anchor, c);
1785 		break;
1786 	/* ADDPEND */
1787 	case AUTR_STATE_ADDPEND:
1788 		/* KeyRem: START */
1789 		if (!anchor->fetched)
1790 			do_keyrem(env, anchor, c);
1791 		/* AddTime: VALID */
1792 		else	do_addtime(env, anchor, c);
1793 		break;
1794 	/* VALID */
1795 	case AUTR_STATE_VALID:
1796 		/* RevBit: REVOKED */
1797 		if (anchor->revoked)
1798 			do_revoked(env, anchor, c);
1799 		/* KeyRem: MISSING */
1800 		else if (!anchor->fetched)
1801 			do_keyrem(env, anchor, c);
1802 		else if(!anchor->last_change) {
1803 			verbose_key(anchor, VERB_ALGO, "first seen");
1804 			reset_holddown(env, anchor, c);
1805 		}
1806 		break;
1807 	/* MISSING */
1808 	case AUTR_STATE_MISSING:
1809 		/* RevBit: REVOKED */
1810 		if (anchor->revoked)
1811 			do_revoked(env, anchor, c);
1812 		/* KeyPres */
1813 		else if (anchor->fetched)
1814 			do_keypres(env, anchor, c);
1815 		break;
1816 	/* REVOKED */
1817 	case AUTR_STATE_REVOKED:
1818 		if (anchor->fetched)
1819 			reset_holddown(env, anchor, c);
1820 		/* RemTime: REMOVED */
1821 		else	do_remtime(env, anchor, c);
1822 		break;
1823 	/* REMOVED */
1824 	case AUTR_STATE_REMOVED:
1825 	default:
1826 		break;
1827 	}
1828 }
1829 
1830 /** if ZSK init then trust KSKs */
1831 static int
1832 init_zsk_to_ksk(struct module_env* env, struct trust_anchor* tp, int* changed)
1833 {
1834 	/* search for VALID ZSKs */
1835 	struct autr_ta* anchor;
1836 	int validzsk = 0;
1837 	int validksk = 0;
1838 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1839 		/* last_change test makes sure it was manually configured */
1840 		if(sldns_wirerr_get_type(anchor->rr, anchor->rr_len,
1841 			anchor->dname_len) == LDNS_RR_TYPE_DNSKEY &&
1842 			anchor->last_change == 0 &&
1843 			!ta_is_dnskey_sep(anchor) &&
1844 			anchor->s == AUTR_STATE_VALID)
1845                         validzsk++;
1846 	}
1847 	if(validzsk == 0)
1848 		return 0;
1849 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1850                 if (ta_is_dnskey_sep(anchor) &&
1851 			anchor->s == AUTR_STATE_ADDPEND) {
1852 			verbose_key(anchor, VERB_ALGO, "trust KSK from "
1853 				"ZSK(config)");
1854 			set_trustanchor_state(env, anchor, changed,
1855 				AUTR_STATE_VALID);
1856 			validksk++;
1857 		}
1858 	}
1859 	return validksk;
1860 }
1861 
1862 /** Remove missing trustanchors so the list does not grow forever */
1863 static void
1864 remove_missing_trustanchors(struct module_env* env, struct trust_anchor* tp,
1865 	int* changed)
1866 {
1867 	struct autr_ta* anchor;
1868 	time_t exceeded;
1869 	int valid = 0;
1870 	/* see if we have anchors that are valid */
1871 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1872 		/* Only do KSKs */
1873                 if (!ta_is_dnskey_sep(anchor))
1874                         continue;
1875                 if (anchor->s == AUTR_STATE_VALID)
1876                         valid++;
1877 	}
1878 	/* if there are no SEP Valid anchors, see if we started out with
1879 	 * a ZSK (last-change=0) anchor, which is VALID and there are KSKs
1880 	 * now that can be made valid.  Do this immediately because there
1881 	 * is no guarantee that the ZSKs get announced long enough.  Usually
1882 	 * this is immediately after init with a ZSK trusted, unless the domain
1883 	 * was not advertising any KSKs at all.  In which case we perfectly
1884 	 * track the zero number of KSKs. */
1885 	if(valid == 0) {
1886 		valid = init_zsk_to_ksk(env, tp, changed);
1887 		if(valid == 0)
1888 			return;
1889 	}
1890 
1891 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1892 		/* ignore ZSKs if newly added */
1893 		if(anchor->s == AUTR_STATE_START)
1894 			continue;
1895 		/* remove ZSKs if a KSK is present */
1896                 if (!ta_is_dnskey_sep(anchor)) {
1897 			if(valid > 0) {
1898 				verbose_key(anchor, VERB_ALGO, "remove ZSK "
1899 					"[%d key(s) VALID]", valid);
1900 				set_trustanchor_state(env, anchor, changed,
1901 					AUTR_STATE_REMOVED);
1902 			}
1903                         continue;
1904 		}
1905                 /* Only do MISSING keys */
1906                 if (anchor->s != AUTR_STATE_MISSING)
1907                         continue;
1908 		if(env->cfg->keep_missing == 0)
1909 			continue; /* keep forever */
1910 
1911 		exceeded = check_holddown(env, anchor, env->cfg->keep_missing);
1912 		/* If keep_missing has exceeded and we still have more than
1913 		 * one valid KSK: remove missing trust anchor */
1914                 if (exceeded && valid > 0) {
1915 			verbose_key(anchor, VERB_ALGO, "keep-missing time "
1916 				"exceeded " ARG_LL "d seconds ago, [%d key(s) VALID]",
1917 				(long long)exceeded, valid);
1918 			set_trustanchor_state(env, anchor, changed,
1919 				AUTR_STATE_REMOVED);
1920 		}
1921 	}
1922 }
1923 
1924 /** Do the statetable from RFC5011 transition matrix */
1925 static int
1926 do_statetable(struct module_env* env, struct trust_anchor* tp, int* changed)
1927 {
1928 	struct autr_ta* anchor;
1929 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1930 		/* Only do KSKs */
1931 		if(!ta_is_dnskey_sep(anchor))
1932 			continue;
1933 		anchor_state_update(env, anchor, changed);
1934 	}
1935 	remove_missing_trustanchors(env, tp, changed);
1936 	return 1;
1937 }
1938 
1939 /** See if time alone makes ADDPEND to VALID transition */
1940 static void
1941 autr_holddown_exceed(struct module_env* env, struct trust_anchor* tp, int* c)
1942 {
1943 	struct autr_ta* anchor;
1944 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1945 		if(ta_is_dnskey_sep(anchor) &&
1946 			anchor->s == AUTR_STATE_ADDPEND)
1947 			do_addtime(env, anchor, c);
1948 	}
1949 }
1950 
1951 /** cleanup key list */
1952 static void
1953 autr_cleanup_keys(struct trust_anchor* tp)
1954 {
1955 	struct autr_ta* p, **prevp;
1956 	prevp = &tp->autr->keys;
1957 	p = tp->autr->keys;
1958 	while(p) {
1959 		/* do we want to remove this key? */
1960 		if(p->s == AUTR_STATE_START || p->s == AUTR_STATE_REMOVED ||
1961 			sldns_wirerr_get_type(p->rr, p->rr_len, p->dname_len)
1962 			!= LDNS_RR_TYPE_DNSKEY) {
1963 			struct autr_ta* np = p->next;
1964 			/* remove */
1965 			free(p->rr);
1966 			free(p);
1967 			/* snip and go to next item */
1968 			*prevp = np;
1969 			p = np;
1970 			continue;
1971 		}
1972 		/* remove pending counts if no longer pending */
1973 		if(p->s != AUTR_STATE_ADDPEND)
1974 			p->pending_count = 0;
1975 		prevp = &p->next;
1976 		p = p->next;
1977 	}
1978 }
1979 
1980 /** calculate next probe time */
1981 static time_t
1982 calc_next_probe(struct module_env* env, time_t wait)
1983 {
1984 	/* make it random, 90-100% */
1985 	time_t rnd, rest;
1986 	if(!autr_permit_small_holddown) {
1987 		if(wait < 3600)
1988 			wait = 3600;
1989 	} else {
1990 		if(wait == 0) wait = 1;
1991 	}
1992 	rnd = wait/10;
1993 	rest = wait-rnd;
1994 	rnd = (time_t)ub_random_max(env->rnd, (long int)rnd);
1995 	return (time_t)(*env->now + rest + rnd);
1996 }
1997 
1998 /** what is first probe time (anchors must be locked) */
1999 static time_t
2000 wait_probe_time(struct val_anchors* anchors)
2001 {
2002 	rbnode_type* t = rbtree_first(&anchors->autr->probe);
2003 	if(t != RBTREE_NULL)
2004 		return ((struct trust_anchor*)t->key)->autr->next_probe_time;
2005 	return 0;
2006 }
2007 
2008 /** reset worker timer */
2009 static void
2010 reset_worker_timer(struct module_env* env)
2011 {
2012 	struct timeval tv;
2013 #ifndef S_SPLINT_S
2014 	time_t next = (time_t)wait_probe_time(env->anchors);
2015 	/* in case this is libunbound, no timer */
2016 	if(!env->probe_timer)
2017 		return;
2018 	if(next > *env->now)
2019 		tv.tv_sec = (time_t)(next - *env->now);
2020 	else	tv.tv_sec = 0;
2021 #endif
2022 	tv.tv_usec = 0;
2023 	comm_timer_set(env->probe_timer, &tv);
2024 	verbose(VERB_ALGO, "scheduled next probe in " ARG_LL "d sec", (long long)tv.tv_sec);
2025 }
2026 
2027 /** set next probe for trust anchor */
2028 static int
2029 set_next_probe(struct module_env* env, struct trust_anchor* tp,
2030 	struct ub_packed_rrset_key* dnskey_rrset)
2031 {
2032 	struct trust_anchor key, *tp2;
2033 	time_t mold, mnew;
2034 	/* use memory allocated in rrset for temporary name storage */
2035 	key.node.key = &key;
2036 	key.name = dnskey_rrset->rk.dname;
2037 	key.namelen = dnskey_rrset->rk.dname_len;
2038 	key.namelabs = dname_count_labels(key.name);
2039 	key.dclass = tp->dclass;
2040 	lock_basic_unlock(&tp->lock);
2041 
2042 	/* fetch tp again and lock anchors, so that we can modify the trees */
2043 	lock_basic_lock(&env->anchors->lock);
2044 	tp2 = (struct trust_anchor*)rbtree_search(env->anchors->tree, &key);
2045 	if(!tp2) {
2046 		verbose(VERB_ALGO, "trustpoint was deleted in set_next_probe");
2047 		lock_basic_unlock(&env->anchors->lock);
2048 		return 0;
2049 	}
2050 	log_assert(tp == tp2);
2051 	lock_basic_lock(&tp->lock);
2052 
2053 	/* schedule */
2054 	mold = wait_probe_time(env->anchors);
2055 	(void)rbtree_delete(&env->anchors->autr->probe, tp);
2056 	tp->autr->next_probe_time = calc_next_probe(env,
2057 		tp->autr->query_interval);
2058 	(void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2059 	mnew = wait_probe_time(env->anchors);
2060 
2061 	lock_basic_unlock(&env->anchors->lock);
2062 	verbose(VERB_ALGO, "next probe set in %d seconds",
2063 		(int)tp->autr->next_probe_time - (int)*env->now);
2064 	if(mold != mnew) {
2065 		reset_worker_timer(env);
2066 	}
2067 	return 1;
2068 }
2069 
2070 /** Revoke and Delete a trust point */
2071 static void
2072 autr_tp_remove(struct module_env* env, struct trust_anchor* tp,
2073 	struct ub_packed_rrset_key* dnskey_rrset)
2074 {
2075 	struct trust_anchor* del_tp;
2076 	struct trust_anchor key;
2077 	struct autr_point_data pd;
2078 	time_t mold, mnew;
2079 
2080 	log_nametypeclass(VERB_OPS, "trust point was revoked",
2081 		tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2082 	tp->autr->revoked = 1;
2083 
2084 	/* use space allocated for dnskey_rrset to save name of anchor */
2085 	memset(&key, 0, sizeof(key));
2086 	memset(&pd, 0, sizeof(pd));
2087 	key.autr = &pd;
2088 	key.node.key = &key;
2089 	pd.pnode.key = &key;
2090 	pd.next_probe_time = tp->autr->next_probe_time;
2091 	key.name = dnskey_rrset->rk.dname;
2092 	key.namelen = tp->namelen;
2093 	key.namelabs = tp->namelabs;
2094 	key.dclass = tp->dclass;
2095 
2096 	/* unlock */
2097 	lock_basic_unlock(&tp->lock);
2098 
2099 	/* take from tree. It could be deleted by someone else,hence (void). */
2100 	lock_basic_lock(&env->anchors->lock);
2101 	del_tp = (struct trust_anchor*)rbtree_delete(env->anchors->tree, &key);
2102 	mold = wait_probe_time(env->anchors);
2103 	(void)rbtree_delete(&env->anchors->autr->probe, &key);
2104 	mnew = wait_probe_time(env->anchors);
2105 	anchors_init_parents_locked(env->anchors);
2106 	lock_basic_unlock(&env->anchors->lock);
2107 
2108 	/* if !del_tp then the trust point is no longer present in the tree,
2109 	 * it was deleted by someone else, who will write the zonefile and
2110 	 * clean up the structure */
2111 	if(del_tp) {
2112 		/* save on disk */
2113 		del_tp->autr->next_probe_time = 0; /* no more probing for it */
2114 		autr_write_file(env, del_tp);
2115 
2116 		/* delete */
2117 		autr_point_delete(del_tp);
2118 	}
2119 	if(mold != mnew) {
2120 		reset_worker_timer(env);
2121 	}
2122 }
2123 
2124 int autr_process_prime(struct module_env* env, struct val_env* ve,
2125 	struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
2126 	struct module_qstate* qstate)
2127 {
2128 	int changed = 0;
2129 	log_assert(tp && tp->autr);
2130 	/* autotrust update trust anchors */
2131 	/* the tp is locked, and stays locked unless it is deleted */
2132 
2133 	/* we could just catch the anchor here while another thread
2134 	 * is busy deleting it. Just unlock and let the other do its job */
2135 	if(tp->autr->revoked) {
2136 		log_nametypeclass(VERB_ALGO, "autotrust not processed, "
2137 			"trust point revoked", tp->name,
2138 			LDNS_RR_TYPE_DNSKEY, tp->dclass);
2139 		lock_basic_unlock(&tp->lock);
2140 		return 0; /* it is revoked */
2141 	}
2142 
2143 	/* query_dnskeys(): */
2144 	tp->autr->last_queried = *env->now;
2145 
2146 	log_nametypeclass(VERB_ALGO, "autotrust process for",
2147 		tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2148 	/* see if time alone makes some keys valid */
2149 	autr_holddown_exceed(env, tp, &changed);
2150 	if(changed) {
2151 		verbose(VERB_ALGO, "autotrust: morekeys, reassemble");
2152 		if(!autr_assemble(tp)) {
2153 			log_err("malloc failure assembling autotrust keys");
2154 			return 1; /* unchanged */
2155 		}
2156 	}
2157 	/* did we get any data? */
2158 	if(!dnskey_rrset) {
2159 		verbose(VERB_ALGO, "autotrust: no dnskey rrset");
2160 		/* no update of query_failed, because then we would have
2161 		 * to write to disk. But we cannot because we maybe are
2162 		 * still 'initializing' with DS records, that we cannot write
2163 		 * in the full format (which only contains KSKs). */
2164 		return 1; /* trust point exists */
2165 	}
2166 	/* check for revoked keys to remove immediately */
2167 	check_contains_revoked(env, ve, tp, dnskey_rrset, &changed, qstate);
2168 	if(changed) {
2169 		verbose(VERB_ALGO, "autotrust: revokedkeys, reassemble");
2170 		if(!autr_assemble(tp)) {
2171 			log_err("malloc failure assembling autotrust keys");
2172 			return 1; /* unchanged */
2173 		}
2174 		if(!tp->ds_rrset && !tp->dnskey_rrset) {
2175 			/* no more keys, all are revoked */
2176 			/* this is a success for this probe attempt */
2177 			tp->autr->last_success = *env->now;
2178 			autr_tp_remove(env, tp, dnskey_rrset);
2179 			return 0; /* trust point removed */
2180 		}
2181 	}
2182 	/* verify the dnskey rrset and see if it is valid. */
2183 	if(!verify_dnskey(env, ve, tp, dnskey_rrset, qstate)) {
2184 		verbose(VERB_ALGO, "autotrust: dnskey did not verify.");
2185 		/* only increase failure count if this is not the first prime,
2186 		 * this means there was a previous successful probe */
2187 		if(tp->autr->last_success) {
2188 			tp->autr->query_failed += 1;
2189 			autr_write_file(env, tp);
2190 		}
2191 		return 1; /* trust point exists */
2192 	}
2193 
2194 	tp->autr->last_success = *env->now;
2195 	tp->autr->query_failed = 0;
2196 
2197 	/* Add new trust anchors to the data structure
2198 	 * - note which trust anchors are seen this probe.
2199 	 * Set trustpoint query_interval and retry_time.
2200 	 * - find minimum rrsig expiration interval
2201 	 */
2202 	if(!update_events(env, ve, tp, dnskey_rrset, &changed)) {
2203 		log_err("malloc failure in autotrust update_events. "
2204 			"trust point unchanged.");
2205 		return 1; /* trust point unchanged, so exists */
2206 	}
2207 
2208 	/* - for every SEP key do the 5011 statetable.
2209 	 * - remove missing trustanchors (if veryold and we have new anchors).
2210 	 */
2211 	if(!do_statetable(env, tp, &changed)) {
2212 		log_err("malloc failure in autotrust do_statetable. "
2213 			"trust point unchanged.");
2214 		return 1; /* trust point unchanged, so exists */
2215 	}
2216 
2217 	autr_cleanup_keys(tp);
2218 	if(!set_next_probe(env, tp, dnskey_rrset))
2219 		return 0; /* trust point does not exist */
2220 	autr_write_file(env, tp);
2221 	if(changed) {
2222 		verbose(VERB_ALGO, "autotrust: changed, reassemble");
2223 		if(!autr_assemble(tp)) {
2224 			log_err("malloc failure assembling autotrust keys");
2225 			return 1; /* unchanged */
2226 		}
2227 		if(!tp->ds_rrset && !tp->dnskey_rrset) {
2228 			/* no more keys, all are revoked */
2229 			autr_tp_remove(env, tp, dnskey_rrset);
2230 			return 0; /* trust point removed */
2231 		}
2232 	} else verbose(VERB_ALGO, "autotrust: no changes");
2233 
2234 	return 1; /* trust point exists */
2235 }
2236 
2237 /** debug print a trust anchor key */
2238 static void
2239 autr_debug_print_ta(struct autr_ta* ta)
2240 {
2241 	char buf[32];
2242 	char* str = sldns_wire2str_rr(ta->rr, ta->rr_len);
2243 	if(!str) {
2244 		log_info("out of memory in debug_print_ta");
2245 		return;
2246 	}
2247 	if(str && str[0]) str[strlen(str)-1]=0; /* remove newline */
2248 	ctime_r(&ta->last_change, buf);
2249 	if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2250 	log_info("[%s] %s ;;state:%d ;;pending_count:%d%s%s last:%s",
2251 		trustanchor_state2str(ta->s), str, ta->s, ta->pending_count,
2252 		ta->fetched?" fetched":"", ta->revoked?" revoked":"", buf);
2253 	free(str);
2254 }
2255 
2256 /** debug print a trust point */
2257 static void
2258 autr_debug_print_tp(struct trust_anchor* tp)
2259 {
2260 	struct autr_ta* ta;
2261 	char buf[257];
2262 	if(!tp->autr)
2263 		return;
2264 	dname_str(tp->name, buf);
2265 	log_info("trust point %s : %d", buf, (int)tp->dclass);
2266 	log_info("assembled %d DS and %d DNSKEYs",
2267 		(int)tp->numDS, (int)tp->numDNSKEY);
2268 	if(tp->ds_rrset) {
2269 		log_packed_rrset(0, "DS:", tp->ds_rrset);
2270 	}
2271 	if(tp->dnskey_rrset) {
2272 		log_packed_rrset(0, "DNSKEY:", tp->dnskey_rrset);
2273 	}
2274 	log_info("file %s", tp->autr->file);
2275 	ctime_r(&tp->autr->last_queried, buf);
2276 	if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2277 	log_info("last_queried: %u %s", (unsigned)tp->autr->last_queried, buf);
2278 	ctime_r(&tp->autr->last_success, buf);
2279 	if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2280 	log_info("last_success: %u %s", (unsigned)tp->autr->last_success, buf);
2281 	ctime_r(&tp->autr->next_probe_time, buf);
2282 	if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2283 	log_info("next_probe_time: %u %s", (unsigned)tp->autr->next_probe_time,
2284 		buf);
2285 	log_info("query_interval: %u", (unsigned)tp->autr->query_interval);
2286 	log_info("retry_time: %u", (unsigned)tp->autr->retry_time);
2287 	log_info("query_failed: %u", (unsigned)tp->autr->query_failed);
2288 
2289 	for(ta=tp->autr->keys; ta; ta=ta->next) {
2290 		autr_debug_print_ta(ta);
2291 	}
2292 }
2293 
2294 void
2295 autr_debug_print(struct val_anchors* anchors)
2296 {
2297 	struct trust_anchor* tp;
2298 	lock_basic_lock(&anchors->lock);
2299 	RBTREE_FOR(tp, struct trust_anchor*, anchors->tree) {
2300 		lock_basic_lock(&tp->lock);
2301 		autr_debug_print_tp(tp);
2302 		lock_basic_unlock(&tp->lock);
2303 	}
2304 	lock_basic_unlock(&anchors->lock);
2305 }
2306 
2307 void probe_answer_cb(void* arg, int ATTR_UNUSED(rcode),
2308 	sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(sec),
2309 	char* ATTR_UNUSED(why_bogus))
2310 {
2311 	/* retry was set before the query was done,
2312 	 * re-querytime is set when query succeeded, but that may not
2313 	 * have reset this timer because the query could have been
2314 	 * handled by another thread. In that case, this callback would
2315 	 * get called after the original timeout is done.
2316 	 * By not resetting the timer, it may probe more often, but not
2317 	 * less often.
2318 	 * Unless the new lookup resulted in smaller TTLs and thus smaller
2319 	 * timeout values. In that case one old TTL could be mistakenly done.
2320 	 */
2321 	struct module_env* env = (struct module_env*)arg;
2322 	verbose(VERB_ALGO, "autotrust probe answer cb");
2323 	reset_worker_timer(env);
2324 }
2325 
2326 /** probe a trust anchor DNSKEY and unlocks tp */
2327 static void
2328 probe_anchor(struct module_env* env, struct trust_anchor* tp)
2329 {
2330 	struct query_info qinfo;
2331 	uint16_t qflags = BIT_RD;
2332 	struct edns_data edns;
2333 	sldns_buffer* buf = env->scratch_buffer;
2334 	qinfo.qname = regional_alloc_init(env->scratch, tp->name, tp->namelen);
2335 	if(!qinfo.qname) {
2336 		log_err("out of memory making 5011 probe");
2337 		return;
2338 	}
2339 	qinfo.qname_len = tp->namelen;
2340 	qinfo.qtype = LDNS_RR_TYPE_DNSKEY;
2341 	qinfo.qclass = tp->dclass;
2342 	qinfo.local_alias = NULL;
2343 	log_query_info(VERB_ALGO, "autotrust probe", &qinfo);
2344 	verbose(VERB_ALGO, "retry probe set in %d seconds",
2345 		(int)tp->autr->next_probe_time - (int)*env->now);
2346 	edns.edns_present = 1;
2347 	edns.ext_rcode = 0;
2348 	edns.edns_version = 0;
2349 	edns.bits = EDNS_DO;
2350 	edns.opt_list = NULL;
2351 	if(sldns_buffer_capacity(buf) < 65535)
2352 		edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
2353 	else	edns.udp_size = 65535;
2354 
2355 	/* can't hold the lock while mesh_run is processing */
2356 	lock_basic_unlock(&tp->lock);
2357 
2358 	/* delete the DNSKEY from rrset and key cache so an active probe
2359 	 * is done. First the rrset so another thread does not use it
2360 	 * to recreate the key entry in a race condition. */
2361 	rrset_cache_remove(env->rrset_cache, qinfo.qname, qinfo.qname_len,
2362 		qinfo.qtype, qinfo.qclass, 0);
2363 	key_cache_remove(env->key_cache, qinfo.qname, qinfo.qname_len,
2364 		qinfo.qclass);
2365 
2366 	if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
2367 		&probe_answer_cb, env)) {
2368 		log_err("out of memory making 5011 probe");
2369 	}
2370 }
2371 
2372 /** fetch first to-probe trust-anchor and lock it and set retrytime */
2373 static struct trust_anchor*
2374 todo_probe(struct module_env* env, time_t* next)
2375 {
2376 	struct trust_anchor* tp;
2377 	rbnode_type* el;
2378 	/* get first one */
2379 	lock_basic_lock(&env->anchors->lock);
2380 	if( (el=rbtree_first(&env->anchors->autr->probe)) == RBTREE_NULL) {
2381 		/* in case of revoked anchors */
2382 		lock_basic_unlock(&env->anchors->lock);
2383 		/* signal that there are no anchors to probe */
2384 		*next = 0;
2385 		return NULL;
2386 	}
2387 	tp = (struct trust_anchor*)el->key;
2388 	lock_basic_lock(&tp->lock);
2389 
2390 	/* is it eligible? */
2391 	if((time_t)tp->autr->next_probe_time > *env->now) {
2392 		/* no more to probe */
2393 		*next = (time_t)tp->autr->next_probe_time - *env->now;
2394 		lock_basic_unlock(&tp->lock);
2395 		lock_basic_unlock(&env->anchors->lock);
2396 		return NULL;
2397 	}
2398 
2399 	/* reset its next probe time */
2400 	(void)rbtree_delete(&env->anchors->autr->probe, tp);
2401 	tp->autr->next_probe_time = calc_next_probe(env, tp->autr->retry_time);
2402 	(void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2403 	lock_basic_unlock(&env->anchors->lock);
2404 
2405 	return tp;
2406 }
2407 
2408 time_t
2409 autr_probe_timer(struct module_env* env)
2410 {
2411 	struct trust_anchor* tp;
2412 	time_t next_probe = 3600;
2413 	int num = 0;
2414 	if(autr_permit_small_holddown) next_probe = 1;
2415 	verbose(VERB_ALGO, "autotrust probe timer callback");
2416 	/* while there are still anchors to probe */
2417 	while( (tp = todo_probe(env, &next_probe)) ) {
2418 		/* make a probe for this anchor */
2419 		probe_anchor(env, tp);
2420 		num++;
2421 	}
2422 	regional_free_all(env->scratch);
2423 	if(next_probe == 0)
2424 		return 0; /* no trust points to probe */
2425 	verbose(VERB_ALGO, "autotrust probe timer %d callbacks done", num);
2426 	return next_probe;
2427 }
2428