xref: /freebsd/contrib/unbound/validator/autotrust.c (revision e53a21abdf2953714e44e3c54b4bb78557cb096c)
1 /*
2  * validator/autotrust.c - RFC5011 trust anchor management for unbound.
3  *
4  * Copyright (c) 2009, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * Contains autotrust implementation. The implementation was taken from
40  * the autotrust daemon (BSD licensed), written by Matthijs Mekking.
41  * It was modified to fit into unbound. The state table process is the same.
42  */
43 #include "config.h"
44 #include "validator/autotrust.h"
45 #include "validator/val_anchor.h"
46 #include "validator/val_utils.h"
47 #include "validator/val_sigcrypt.h"
48 #include "util/data/dname.h"
49 #include "util/data/packed_rrset.h"
50 #include "util/log.h"
51 #include "util/module.h"
52 #include "util/net_help.h"
53 #include "util/config_file.h"
54 #include "util/regional.h"
55 #include "util/random.h"
56 #include "util/data/msgparse.h"
57 #include "services/mesh.h"
58 #include "services/cache/rrset.h"
59 #include "validator/val_kcache.h"
60 #include "sldns/sbuffer.h"
61 #include "sldns/wire2str.h"
62 #include "sldns/str2wire.h"
63 #include "sldns/keyraw.h"
64 #include "sldns/rrdef.h"
65 #include <stdarg.h>
66 #include <ctype.h>
67 
68 /** number of times a key must be seen before it can become valid */
69 #define MIN_PENDINGCOUNT 2
70 
71 /** Event: Revoked */
72 static void do_revoked(struct module_env* env, struct autr_ta* anchor, int* c);
73 
74 struct autr_global_data* autr_global_create(void)
75 {
76 	struct autr_global_data* global;
77 	global = (struct autr_global_data*)malloc(sizeof(*global));
78 	if(!global)
79 		return NULL;
80 	rbtree_init(&global->probe, &probetree_cmp);
81 	return global;
82 }
83 
84 void autr_global_delete(struct autr_global_data* global)
85 {
86 	if(!global)
87 		return;
88 	/* elements deleted by parent */
89 	free(global);
90 }
91 
92 int probetree_cmp(const void* x, const void* y)
93 {
94 	struct trust_anchor* a = (struct trust_anchor*)x;
95 	struct trust_anchor* b = (struct trust_anchor*)y;
96 	log_assert(a->autr && b->autr);
97 	if(a->autr->next_probe_time < b->autr->next_probe_time)
98 		return -1;
99 	if(a->autr->next_probe_time > b->autr->next_probe_time)
100 		return 1;
101 	/* time is equal, sort on trust point identity */
102 	return anchor_cmp(x, y);
103 }
104 
105 size_t
106 autr_get_num_anchors(struct val_anchors* anchors)
107 {
108 	size_t res = 0;
109 	if(!anchors)
110 		return 0;
111 	lock_basic_lock(&anchors->lock);
112 	if(anchors->autr)
113 		res = anchors->autr->probe.count;
114 	lock_basic_unlock(&anchors->lock);
115 	return res;
116 }
117 
118 /** Position in string */
119 static int
120 position_in_string(char *str, const char* sub)
121 {
122 	char* pos = strstr(str, sub);
123 	if(pos)
124 		return (int)(pos-str)+(int)strlen(sub);
125 	return -1;
126 }
127 
128 /** Debug routine to print pretty key information */
129 static void
130 verbose_key(struct autr_ta* ta, enum verbosity_value level,
131 	const char* format, ...) ATTR_FORMAT(printf, 3, 4);
132 
133 /**
134  * Implementation of debug pretty key print
135  * @param ta: trust anchor key with DNSKEY data.
136  * @param level: verbosity level to print at.
137  * @param format: printf style format string.
138  */
139 static void
140 verbose_key(struct autr_ta* ta, enum verbosity_value level,
141 	const char* format, ...)
142 {
143 	va_list args;
144 	va_start(args, format);
145 	if(verbosity >= level) {
146 		char* str = sldns_wire2str_dname(ta->rr, ta->dname_len);
147 		int keytag = (int)sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
148 			ta->rr, ta->rr_len, ta->dname_len),
149 			sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
150 			ta->dname_len));
151 		char msg[MAXSYSLOGMSGLEN];
152 		vsnprintf(msg, sizeof(msg), format, args);
153 		verbose(level, "%s key %d %s", str?str:"??", keytag, msg);
154 		free(str);
155 	}
156 	va_end(args);
157 }
158 
159 /**
160  * Parse comments
161  * @param str: to parse
162  * @param ta: trust key autotrust metadata
163  * @return false on failure.
164  */
165 static int
166 parse_comments(char* str, struct autr_ta* ta)
167 {
168         int len = (int)strlen(str), pos = 0, timestamp = 0;
169         char* comment = (char*) malloc(sizeof(char)*len+1);
170         char* comments = comment;
171 	if(!comment) {
172 		log_err("malloc failure in parse");
173                 return 0;
174 	}
175 	/* skip over whitespace and data at start of line */
176         while (*str != '\0' && *str != ';')
177                 str++;
178         if (*str == ';')
179                 str++;
180         /* copy comments */
181         while (*str != '\0')
182         {
183                 *comments = *str;
184                 comments++;
185                 str++;
186         }
187         *comments = '\0';
188 
189         comments = comment;
190 
191         /* read state */
192         pos = position_in_string(comments, "state=");
193         if (pos >= (int) strlen(comments))
194         {
195 		log_err("parse error");
196                 free(comment);
197                 return 0;
198         }
199         if (pos <= 0)
200                 ta->s = AUTR_STATE_VALID;
201         else
202         {
203                 int s = (int) comments[pos] - '0';
204                 switch(s)
205                 {
206                         case AUTR_STATE_START:
207                         case AUTR_STATE_ADDPEND:
208                         case AUTR_STATE_VALID:
209                         case AUTR_STATE_MISSING:
210                         case AUTR_STATE_REVOKED:
211                         case AUTR_STATE_REMOVED:
212                                 ta->s = s;
213                                 break;
214                         default:
215 				verbose_key(ta, VERB_OPS, "has undefined "
216 					"state, considered NewKey");
217                                 ta->s = AUTR_STATE_START;
218                                 break;
219                 }
220         }
221         /* read pending count */
222         pos = position_in_string(comments, "count=");
223         if (pos >= (int) strlen(comments))
224         {
225 		log_err("parse error");
226                 free(comment);
227                 return 0;
228         }
229         if (pos <= 0)
230                 ta->pending_count = 0;
231         else
232         {
233                 comments += pos;
234                 ta->pending_count = (uint8_t)atoi(comments);
235         }
236 
237         /* read last change */
238         pos = position_in_string(comments, "lastchange=");
239         if (pos >= (int) strlen(comments))
240         {
241 		log_err("parse error");
242                 free(comment);
243                 return 0;
244         }
245         if (pos >= 0)
246         {
247                 comments += pos;
248                 timestamp = atoi(comments);
249         }
250         if (pos < 0 || !timestamp)
251 		ta->last_change = 0;
252         else
253                 ta->last_change = (time_t)timestamp;
254 
255         free(comment);
256         return 1;
257 }
258 
259 /** Check if a line contains data (besides comments) */
260 static int
261 str_contains_data(char* str, char comment)
262 {
263         while (*str != '\0') {
264                 if (*str == comment || *str == '\n')
265                         return 0;
266                 if (*str != ' ' && *str != '\t')
267                         return 1;
268                 str++;
269         }
270         return 0;
271 }
272 
273 /** Get DNSKEY flags
274  * rdata without rdatalen in front of it. */
275 static int
276 dnskey_flags(uint16_t t, uint8_t* rdata, size_t len)
277 {
278 	uint16_t f;
279 	if(t != LDNS_RR_TYPE_DNSKEY)
280 		return 0;
281 	if(len < 2)
282 		return 0;
283 	memmove(&f, rdata, 2);
284 	f = ntohs(f);
285 	return (int)f;
286 }
287 
288 /** Check if KSK DNSKEY.
289  * pass rdata without rdatalen in front of it */
290 static int
291 rr_is_dnskey_sep(uint16_t t, uint8_t* rdata, size_t len)
292 {
293 	return (dnskey_flags(t, rdata, len)&DNSKEY_BIT_SEP);
294 }
295 
296 /** Check if TA is KSK DNSKEY */
297 static int
298 ta_is_dnskey_sep(struct autr_ta* ta)
299 {
300 	return (dnskey_flags(
301 		sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len),
302 		sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len),
303 		sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len)
304 		) & DNSKEY_BIT_SEP);
305 }
306 
307 /** Check if REVOKED DNSKEY
308  * pass rdata without rdatalen in front of it */
309 static int
310 rr_is_dnskey_revoked(uint16_t t, uint8_t* rdata, size_t len)
311 {
312 	return (dnskey_flags(t, rdata, len)&LDNS_KEY_REVOKE_KEY);
313 }
314 
315 /** create ta */
316 static struct autr_ta*
317 autr_ta_create(uint8_t* rr, size_t rr_len, size_t dname_len)
318 {
319 	struct autr_ta* ta = (struct autr_ta*)calloc(1, sizeof(*ta));
320 	if(!ta) {
321 		free(rr);
322 		return NULL;
323 	}
324 	ta->rr = rr;
325 	ta->rr_len = rr_len;
326 	ta->dname_len = dname_len;
327 	return ta;
328 }
329 
330 /** create tp */
331 static struct trust_anchor*
332 autr_tp_create(struct val_anchors* anchors, uint8_t* own, size_t own_len,
333 	uint16_t dc)
334 {
335 	struct trust_anchor* tp = (struct trust_anchor*)calloc(1, sizeof(*tp));
336 	if(!tp) return NULL;
337 	tp->name = memdup(own, own_len);
338 	if(!tp->name) {
339 		free(tp);
340 		return NULL;
341 	}
342 	tp->namelen = own_len;
343 	tp->namelabs = dname_count_labels(tp->name);
344 	tp->node.key = tp;
345 	tp->dclass = dc;
346 	tp->autr = (struct autr_point_data*)calloc(1, sizeof(*tp->autr));
347 	if(!tp->autr) {
348 		free(tp->name);
349 		free(tp);
350 		return NULL;
351 	}
352 	tp->autr->pnode.key = tp;
353 
354 	lock_basic_lock(&anchors->lock);
355 	if(!rbtree_insert(anchors->tree, &tp->node)) {
356 		char buf[LDNS_MAX_DOMAINLEN+1];
357 		lock_basic_unlock(&anchors->lock);
358 		dname_str(tp->name, buf);
359 		log_err("trust anchor for '%s' presented twice", buf);
360 		free(tp->name);
361 		free(tp->autr);
362 		free(tp);
363 		return NULL;
364 	}
365 	if(!rbtree_insert(&anchors->autr->probe, &tp->autr->pnode)) {
366 		char buf[LDNS_MAX_DOMAINLEN+1];
367 		(void)rbtree_delete(anchors->tree, tp);
368 		lock_basic_unlock(&anchors->lock);
369 		dname_str(tp->name, buf);
370 		log_err("trust anchor for '%s' in probetree twice", buf);
371 		free(tp->name);
372 		free(tp->autr);
373 		free(tp);
374 		return NULL;
375 	}
376 	lock_basic_init(&tp->lock);
377 	lock_protect(&tp->lock, tp, sizeof(*tp));
378 	lock_protect(&tp->lock, tp->autr, sizeof(*tp->autr));
379 	lock_basic_unlock(&anchors->lock);
380 	return tp;
381 }
382 
383 /** delete assembled rrsets */
384 static void
385 autr_rrset_delete(struct ub_packed_rrset_key* r)
386 {
387 	if(r) {
388 		free(r->rk.dname);
389 		free(r->entry.data);
390 		free(r);
391 	}
392 }
393 
394 void autr_point_delete(struct trust_anchor* tp)
395 {
396 	if(!tp)
397 		return;
398 	lock_unprotect(&tp->lock, tp);
399 	lock_unprotect(&tp->lock, tp->autr);
400 	lock_basic_destroy(&tp->lock);
401 	autr_rrset_delete(tp->ds_rrset);
402 	autr_rrset_delete(tp->dnskey_rrset);
403 	if(tp->autr) {
404 		struct autr_ta* p = tp->autr->keys, *np;
405 		while(p) {
406 			np = p->next;
407 			free(p->rr);
408 			free(p);
409 			p = np;
410 		}
411 		free(tp->autr->file);
412 		free(tp->autr);
413 	}
414 	free(tp->name);
415 	free(tp);
416 }
417 
418 /** find or add a new trust point for autotrust */
419 static struct trust_anchor*
420 find_add_tp(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
421 	size_t dname_len)
422 {
423 	struct trust_anchor* tp;
424 	tp = anchor_find(anchors, rr, dname_count_labels(rr), dname_len,
425 		sldns_wirerr_get_class(rr, rr_len, dname_len));
426 	if(tp) {
427 		if(!tp->autr) {
428 			log_err("anchor cannot be with and without autotrust");
429 			lock_basic_unlock(&tp->lock);
430 			return NULL;
431 		}
432 		return tp;
433 	}
434 	tp = autr_tp_create(anchors, rr, dname_len, sldns_wirerr_get_class(rr,
435 		rr_len, dname_len));
436 	if(!tp)
437 		return NULL;
438 	lock_basic_lock(&tp->lock);
439 	return tp;
440 }
441 
442 /** Add trust anchor from RR */
443 static struct autr_ta*
444 add_trustanchor_frm_rr(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
445         size_t dname_len, struct trust_anchor** tp)
446 {
447 	struct autr_ta* ta = autr_ta_create(rr, rr_len, dname_len);
448 	if(!ta)
449 		return NULL;
450 	*tp = find_add_tp(anchors, rr, rr_len, dname_len);
451 	if(!*tp) {
452 		free(ta->rr);
453 		free(ta);
454 		return NULL;
455 	}
456 	/* add ta to tp */
457 	ta->next = (*tp)->autr->keys;
458 	(*tp)->autr->keys = ta;
459 	lock_basic_unlock(&(*tp)->lock);
460 	return ta;
461 }
462 
463 /**
464  * Add new trust anchor from a string in file.
465  * @param anchors: all anchors
466  * @param str: string with anchor and comments, if any comments.
467  * @param tp: trust point returned.
468  * @param origin: what to use for @
469  * @param origin_len: length of origin
470  * @param prev: previous rr name
471  * @param prev_len: length of prev
472  * @param skip: if true, the result is NULL, but not an error, skip it.
473  * @return new key in trust point.
474  */
475 static struct autr_ta*
476 add_trustanchor_frm_str(struct val_anchors* anchors, char* str,
477 	struct trust_anchor** tp, uint8_t* origin, size_t origin_len,
478 	uint8_t** prev, size_t* prev_len, int* skip)
479 {
480 	uint8_t rr[LDNS_RR_BUF_SIZE];
481 	size_t rr_len = sizeof(rr), dname_len;
482 	uint8_t* drr;
483 	int lstatus;
484         if (!str_contains_data(str, ';')) {
485 		*skip = 1;
486                 return NULL; /* empty line */
487 	}
488 	if(0 != (lstatus = sldns_str2wire_rr_buf(str, rr, &rr_len, &dname_len,
489 		0, origin, origin_len, *prev, *prev_len)))
490 	{
491 		log_err("ldns error while converting string to RR at%d: %s: %s",
492 			LDNS_WIREPARSE_OFFSET(lstatus),
493 			sldns_get_errorstr_parse(lstatus), str);
494 		return NULL;
495 	}
496 	free(*prev);
497 	*prev = memdup(rr, dname_len);
498 	*prev_len = dname_len;
499 	if(!*prev) {
500 		log_err("malloc failure in add_trustanchor");
501 		return NULL;
502 	}
503 	if(sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DNSKEY &&
504 		sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DS) {
505 		*skip = 1;
506 		return NULL; /* only DS and DNSKEY allowed */
507 	}
508 	drr = memdup(rr, rr_len);
509 	if(!drr) {
510 		log_err("malloc failure in add trustanchor");
511 		return NULL;
512 	}
513 	return add_trustanchor_frm_rr(anchors, drr, rr_len, dname_len, tp);
514 }
515 
516 /**
517  * Load single anchor
518  * @param anchors: all points.
519  * @param str: comments line
520  * @param fname: filename
521  * @param origin: the $ORIGIN.
522  * @param origin_len: length of origin
523  * @param prev: passed to ldns.
524  * @param prev_len: length of prev
525  * @param skip: if true, the result is NULL, but not an error, skip it.
526  * @return false on failure, otherwise the tp read.
527  */
528 static struct trust_anchor*
529 load_trustanchor(struct val_anchors* anchors, char* str, const char* fname,
530 	uint8_t* origin, size_t origin_len, uint8_t** prev, size_t* prev_len,
531 	int* skip)
532 {
533 	struct autr_ta* ta = NULL;
534 	struct trust_anchor* tp = NULL;
535 
536 	ta = add_trustanchor_frm_str(anchors, str, &tp, origin, origin_len,
537 		prev, prev_len, skip);
538 	if(!ta)
539 		return NULL;
540 	lock_basic_lock(&tp->lock);
541 	if(!parse_comments(str, ta)) {
542 		lock_basic_unlock(&tp->lock);
543 		return NULL;
544 	}
545 	if(!tp->autr->file) {
546 		tp->autr->file = strdup(fname);
547 		if(!tp->autr->file) {
548 			lock_basic_unlock(&tp->lock);
549 			log_err("malloc failure");
550 			return NULL;
551 		}
552 	}
553 	lock_basic_unlock(&tp->lock);
554         return tp;
555 }
556 
557 /** iterator for DSes from keylist. return true if a next element exists */
558 static int
559 assemble_iterate_ds(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
560 	size_t* dname_len)
561 {
562 	while(*list) {
563 		if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
564 			(*list)->dname_len) == LDNS_RR_TYPE_DS) {
565 			*rr = (*list)->rr;
566 			*rr_len = (*list)->rr_len;
567 			*dname_len = (*list)->dname_len;
568 			*list = (*list)->next;
569 			return 1;
570 		}
571 		*list = (*list)->next;
572 	}
573 	return 0;
574 }
575 
576 /** iterator for DNSKEYs from keylist. return true if a next element exists */
577 static int
578 assemble_iterate_dnskey(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
579 	size_t* dname_len)
580 {
581 	while(*list) {
582 		if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
583 		   (*list)->dname_len) != LDNS_RR_TYPE_DS &&
584 			((*list)->s == AUTR_STATE_VALID ||
585 			 (*list)->s == AUTR_STATE_MISSING)) {
586 			*rr = (*list)->rr;
587 			*rr_len = (*list)->rr_len;
588 			*dname_len = (*list)->dname_len;
589 			*list = (*list)->next;
590 			return 1;
591 		}
592 		*list = (*list)->next;
593 	}
594 	return 0;
595 }
596 
597 /** see if iterator-list has any elements in it, or it is empty */
598 static int
599 assemble_iterate_hasfirst(int iter(struct autr_ta**, uint8_t**, size_t*,
600 	size_t*), struct autr_ta* list)
601 {
602 	uint8_t* rr = NULL;
603 	size_t rr_len = 0, dname_len = 0;
604 	return iter(&list, &rr, &rr_len, &dname_len);
605 }
606 
607 /** number of elements in iterator list */
608 static size_t
609 assemble_iterate_count(int iter(struct autr_ta**, uint8_t**, size_t*,
610 	size_t*), struct autr_ta* list)
611 {
612 	uint8_t* rr = NULL;
613 	size_t i = 0, rr_len = 0, dname_len = 0;
614 	while(iter(&list, &rr, &rr_len, &dname_len)) {
615 		i++;
616 	}
617 	return i;
618 }
619 
620 /**
621  * Create a ub_packed_rrset_key allocated on the heap.
622  * It therefore does not have the correct ID value, and cannot be used
623  * inside the cache.  It can be used in storage outside of the cache.
624  * Keys for the cache have to be obtained from alloc.h .
625  * @param iter: iterator over the elements in the list.  It filters elements.
626  * @param list: the list.
627  * @return key allocated or NULL on failure.
628  */
629 static struct ub_packed_rrset_key*
630 ub_packed_rrset_heap_key(int iter(struct autr_ta**, uint8_t**, size_t*,
631 	size_t*), struct autr_ta* list)
632 {
633 	uint8_t* rr = NULL;
634 	size_t rr_len = 0, dname_len = 0;
635 	struct ub_packed_rrset_key* k;
636 	if(!iter(&list, &rr, &rr_len, &dname_len))
637 		return NULL;
638 	k = (struct ub_packed_rrset_key*)calloc(1, sizeof(*k));
639 	if(!k)
640 		return NULL;
641 	k->rk.type = htons(sldns_wirerr_get_type(rr, rr_len, dname_len));
642 	k->rk.rrset_class = htons(sldns_wirerr_get_class(rr, rr_len, dname_len));
643 	k->rk.dname_len = dname_len;
644 	k->rk.dname = memdup(rr, dname_len);
645 	if(!k->rk.dname) {
646 		free(k);
647 		return NULL;
648 	}
649 	return k;
650 }
651 
652 /**
653  * Create packed_rrset data on the heap.
654  * @param iter: iterator over the elements in the list.  It filters elements.
655  * @param list: the list.
656  * @return data allocated or NULL on failure.
657  */
658 static struct packed_rrset_data*
659 packed_rrset_heap_data(int iter(struct autr_ta**, uint8_t**, size_t*,
660 	size_t*), struct autr_ta* list)
661 {
662 	uint8_t* rr = NULL;
663 	size_t rr_len = 0, dname_len = 0;
664 	struct packed_rrset_data* data;
665 	size_t count=0, rrsig_count=0, len=0, i, total;
666 	uint8_t* nextrdata;
667 	struct autr_ta* list_i;
668 	time_t ttl = 0;
669 
670 	list_i = list;
671 	while(iter(&list_i, &rr, &rr_len, &dname_len)) {
672 		if(sldns_wirerr_get_type(rr, rr_len, dname_len) ==
673 			LDNS_RR_TYPE_RRSIG)
674 			rrsig_count++;
675 		else	count++;
676 		/* sizeof the rdlength + rdatalen */
677 		len += 2 + sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
678 		ttl = (time_t)sldns_wirerr_get_ttl(rr, rr_len, dname_len);
679 	}
680 	if(count == 0 && rrsig_count == 0)
681 		return NULL;
682 
683 	/* allocate */
684 	total = count + rrsig_count;
685 	len += sizeof(*data) + total*(sizeof(size_t) + sizeof(time_t) +
686 		sizeof(uint8_t*));
687 	data = (struct packed_rrset_data*)calloc(1, len);
688 	if(!data)
689 		return NULL;
690 
691 	/* fill it */
692 	data->ttl = ttl;
693 	data->count = count;
694 	data->rrsig_count = rrsig_count;
695 	data->rr_len = (size_t*)((uint8_t*)data +
696 		sizeof(struct packed_rrset_data));
697 	data->rr_data = (uint8_t**)&(data->rr_len[total]);
698 	data->rr_ttl = (time_t*)&(data->rr_data[total]);
699 	nextrdata = (uint8_t*)&(data->rr_ttl[total]);
700 
701 	/* fill out len, ttl, fields */
702 	list_i = list;
703 	i = 0;
704 	while(iter(&list_i, &rr, &rr_len, &dname_len)) {
705 		data->rr_ttl[i] = (time_t)sldns_wirerr_get_ttl(rr, rr_len,
706 			dname_len);
707 		if(data->rr_ttl[i] < data->ttl)
708 			data->ttl = data->rr_ttl[i];
709 		data->rr_len[i] = 2 /* the rdlength */ +
710 			sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
711 		i++;
712 	}
713 
714 	/* fixup rest of ptrs */
715 	for(i=0; i<total; i++) {
716 		data->rr_data[i] = nextrdata;
717 		nextrdata += data->rr_len[i];
718 	}
719 
720 	/* copy data in there */
721 	list_i = list;
722 	i = 0;
723 	while(iter(&list_i, &rr, &rr_len, &dname_len)) {
724 		log_assert(data->rr_data[i]);
725 		memmove(data->rr_data[i],
726 			sldns_wirerr_get_rdatawl(rr, rr_len, dname_len),
727 			data->rr_len[i]);
728 		i++;
729 	}
730 
731 	if(data->rrsig_count && data->count == 0) {
732 		data->count = data->rrsig_count; /* rrset type is RRSIG */
733 		data->rrsig_count = 0;
734 	}
735 	return data;
736 }
737 
738 /**
739  * Assemble the trust anchors into DS and DNSKEY packed rrsets.
740  * Uses only VALID and MISSING DNSKEYs.
741  * Read the sldns_rrs and builds packed rrsets
742  * @param tp: the trust point. Must be locked.
743  * @return false on malloc failure.
744  */
745 static int
746 autr_assemble(struct trust_anchor* tp)
747 {
748 	struct ub_packed_rrset_key* ubds=NULL, *ubdnskey=NULL;
749 
750 	/* make packed rrset keys - malloced with no ID number, they
751 	 * are not in the cache */
752 	/* make packed rrset data (if there is a key) */
753 	if(assemble_iterate_hasfirst(assemble_iterate_ds, tp->autr->keys)) {
754 		ubds = ub_packed_rrset_heap_key(
755 			assemble_iterate_ds, tp->autr->keys);
756 		if(!ubds)
757 			goto error_cleanup;
758 		ubds->entry.data = packed_rrset_heap_data(
759 			assemble_iterate_ds, tp->autr->keys);
760 		if(!ubds->entry.data)
761 			goto error_cleanup;
762 	}
763 
764 	/* make packed DNSKEY data */
765 	if(assemble_iterate_hasfirst(assemble_iterate_dnskey, tp->autr->keys)) {
766 		ubdnskey = ub_packed_rrset_heap_key(
767 			assemble_iterate_dnskey, tp->autr->keys);
768 		if(!ubdnskey)
769 			goto error_cleanup;
770 		ubdnskey->entry.data = packed_rrset_heap_data(
771 			assemble_iterate_dnskey, tp->autr->keys);
772 		if(!ubdnskey->entry.data) {
773 		error_cleanup:
774 			autr_rrset_delete(ubds);
775 			autr_rrset_delete(ubdnskey);
776 			return 0;
777 		}
778 	}
779 
780 	/* we have prepared the new keys so nothing can go wrong any more.
781 	 * And we are sure we cannot be left without trustanchor after
782 	 * any errors. Put in the new keys and remove old ones. */
783 
784 	/* free the old data */
785 	autr_rrset_delete(tp->ds_rrset);
786 	autr_rrset_delete(tp->dnskey_rrset);
787 
788 	/* assign the data to replace the old */
789 	tp->ds_rrset = ubds;
790 	tp->dnskey_rrset = ubdnskey;
791 	tp->numDS = assemble_iterate_count(assemble_iterate_ds,
792 		tp->autr->keys);
793 	tp->numDNSKEY = assemble_iterate_count(assemble_iterate_dnskey,
794 		tp->autr->keys);
795 	return 1;
796 }
797 
798 /** parse integer */
799 static unsigned int
800 parse_int(char* line, int* ret)
801 {
802 	char *e;
803 	unsigned int x = (unsigned int)strtol(line, &e, 10);
804 	if(line == e) {
805 		*ret = -1; /* parse error */
806 		return 0;
807 	}
808 	*ret = 1; /* matched */
809 	return x;
810 }
811 
812 /** parse id sequence for anchor */
813 static struct trust_anchor*
814 parse_id(struct val_anchors* anchors, char* line)
815 {
816 	struct trust_anchor *tp;
817 	int r;
818 	uint16_t dclass;
819 	uint8_t* dname;
820 	size_t dname_len;
821 	/* read the owner name */
822 	char* next = strchr(line, ' ');
823 	if(!next)
824 		return NULL;
825 	next[0] = 0;
826 	dname = sldns_str2wire_dname(line, &dname_len);
827 	if(!dname)
828 		return NULL;
829 
830 	/* read the class */
831 	dclass = parse_int(next+1, &r);
832 	if(r == -1) {
833 		free(dname);
834 		return NULL;
835 	}
836 
837 	/* find the trust point */
838 	tp = autr_tp_create(anchors, dname, dname_len, dclass);
839 	free(dname);
840 	return tp;
841 }
842 
843 /**
844  * Parse variable from trustanchor header
845  * @param line: to parse
846  * @param anchors: the anchor is added to this, if "id:" is seen.
847  * @param anchor: the anchor as result value or previously returned anchor
848  * 	value to read the variable lines into.
849  * @return: 0 no match, -1 failed syntax error, +1 success line read.
850  * 	+2 revoked trust anchor file.
851  */
852 static int
853 parse_var_line(char* line, struct val_anchors* anchors,
854 	struct trust_anchor** anchor)
855 {
856 	struct trust_anchor* tp = *anchor;
857 	int r = 0;
858 	if(strncmp(line, ";;id: ", 6) == 0) {
859 		*anchor = parse_id(anchors, line+6);
860 		if(!*anchor) return -1;
861 		else return 1;
862 	} else if(strncmp(line, ";;REVOKED", 9) == 0) {
863 		if(tp) {
864 			log_err("REVOKED statement must be at start of file");
865 			return -1;
866 		}
867 		return 2;
868 	} else if(strncmp(line, ";;last_queried: ", 16) == 0) {
869 		if(!tp) return -1;
870 		lock_basic_lock(&tp->lock);
871 		tp->autr->last_queried = (time_t)parse_int(line+16, &r);
872 		lock_basic_unlock(&tp->lock);
873 	} else if(strncmp(line, ";;last_success: ", 16) == 0) {
874 		if(!tp) return -1;
875 		lock_basic_lock(&tp->lock);
876 		tp->autr->last_success = (time_t)parse_int(line+16, &r);
877 		lock_basic_unlock(&tp->lock);
878 	} else if(strncmp(line, ";;next_probe_time: ", 19) == 0) {
879 		if(!tp) return -1;
880 		lock_basic_lock(&anchors->lock);
881 		lock_basic_lock(&tp->lock);
882 		(void)rbtree_delete(&anchors->autr->probe, tp);
883 		tp->autr->next_probe_time = (time_t)parse_int(line+19, &r);
884 		(void)rbtree_insert(&anchors->autr->probe, &tp->autr->pnode);
885 		lock_basic_unlock(&tp->lock);
886 		lock_basic_unlock(&anchors->lock);
887 	} else if(strncmp(line, ";;query_failed: ", 16) == 0) {
888 		if(!tp) return -1;
889 		lock_basic_lock(&tp->lock);
890 		tp->autr->query_failed = (uint8_t)parse_int(line+16, &r);
891 		lock_basic_unlock(&tp->lock);
892 	} else if(strncmp(line, ";;query_interval: ", 18) == 0) {
893 		if(!tp) return -1;
894 		lock_basic_lock(&tp->lock);
895 		tp->autr->query_interval = (time_t)parse_int(line+18, &r);
896 		lock_basic_unlock(&tp->lock);
897 	} else if(strncmp(line, ";;retry_time: ", 14) == 0) {
898 		if(!tp) return -1;
899 		lock_basic_lock(&tp->lock);
900 		tp->autr->retry_time = (time_t)parse_int(line+14, &r);
901 		lock_basic_unlock(&tp->lock);
902 	}
903 	return r;
904 }
905 
906 /** handle origin lines */
907 static int
908 handle_origin(char* line, uint8_t** origin, size_t* origin_len)
909 {
910 	size_t len = 0;
911 	while(isspace((unsigned char)*line))
912 		line++;
913 	if(strncmp(line, "$ORIGIN", 7) != 0)
914 		return 0;
915 	free(*origin);
916 	line += 7;
917 	while(isspace((unsigned char)*line))
918 		line++;
919 	*origin = sldns_str2wire_dname(line, &len);
920 	*origin_len = len;
921 	if(!*origin)
922 		log_warn("malloc failure or parse error in $ORIGIN");
923 	return 1;
924 }
925 
926 /** Read one line and put multiline RRs onto one line string */
927 static int
928 read_multiline(char* buf, size_t len, FILE* in, int* linenr)
929 {
930 	char* pos = buf;
931 	size_t left = len;
932 	int depth = 0;
933 	buf[len-1] = 0;
934 	while(left > 0 && fgets(pos, (int)left, in) != NULL) {
935 		size_t i, poslen = strlen(pos);
936 		(*linenr)++;
937 
938 		/* check what the new depth is after the line */
939 		/* this routine cannot handle braces inside quotes,
940 		   say for TXT records, but this routine only has to read keys */
941 		for(i=0; i<poslen; i++) {
942 			if(pos[i] == '(') {
943 				depth++;
944 			} else if(pos[i] == ')') {
945 				if(depth == 0) {
946 					log_err("mismatch: too many ')'");
947 					return -1;
948 				}
949 				depth--;
950 			} else if(pos[i] == ';') {
951 				break;
952 			}
953 		}
954 
955 		/* normal oneline or last line: keeps newline and comments */
956 		if(depth == 0) {
957 			return 1;
958 		}
959 
960 		/* more lines expected, snip off comments and newline */
961 		if(poslen>0)
962 			pos[poslen-1] = 0; /* strip newline */
963 		if(strchr(pos, ';'))
964 			strchr(pos, ';')[0] = 0; /* strip comments */
965 
966 		/* move to paste other lines behind this one */
967 		poslen = strlen(pos);
968 		pos += poslen;
969 		left -= poslen;
970 		/* the newline is changed into a space */
971 		if(left <= 2 /* space and eos */) {
972 			log_err("line too long");
973 			return -1;
974 		}
975 		pos[0] = ' ';
976 		pos[1] = 0;
977 		pos += 1;
978 		left -= 1;
979 	}
980 	if(depth != 0) {
981 		log_err("mismatch: too many '('");
982 		return -1;
983 	}
984 	if(pos != buf)
985 		return 1;
986 	return 0;
987 }
988 
989 int autr_read_file(struct val_anchors* anchors, const char* nm)
990 {
991         /* the file descriptor */
992         FILE* fd;
993         /* keep track of line numbers */
994         int line_nr = 0;
995         /* single line */
996         char line[10240];
997 	/* trust point being read */
998 	struct trust_anchor *tp = NULL, *tp2;
999 	int r;
1000 	/* for $ORIGIN parsing */
1001 	uint8_t *origin=NULL, *prev=NULL;
1002 	size_t origin_len=0, prev_len=0;
1003 
1004         if (!(fd = fopen(nm, "r"))) {
1005                 log_err("unable to open %s for reading: %s",
1006 			nm, strerror(errno));
1007                 return 0;
1008         }
1009         verbose(VERB_ALGO, "reading autotrust anchor file %s", nm);
1010         while ( (r=read_multiline(line, sizeof(line), fd, &line_nr)) != 0) {
1011 		if(r == -1 || (r = parse_var_line(line, anchors, &tp)) == -1) {
1012 			log_err("could not parse auto-trust-anchor-file "
1013 				"%s line %d", nm, line_nr);
1014 			fclose(fd);
1015 			free(origin);
1016 			free(prev);
1017 			return 0;
1018 		} else if(r == 1) {
1019 			continue;
1020 		} else if(r == 2) {
1021 			log_warn("trust anchor %s has been revoked", nm);
1022 			fclose(fd);
1023 			free(origin);
1024 			free(prev);
1025 			return 1;
1026 		}
1027         	if (!str_contains_data(line, ';'))
1028                 	continue; /* empty lines allowed */
1029  		if(handle_origin(line, &origin, &origin_len))
1030 			continue;
1031 		r = 0;
1032                 if(!(tp2=load_trustanchor(anchors, line, nm, origin,
1033 			origin_len, &prev, &prev_len, &r))) {
1034 			if(!r) log_err("failed to load trust anchor from %s "
1035 				"at line %i, skipping", nm, line_nr);
1036                         /* try to do the rest */
1037 			continue;
1038                 }
1039 		if(tp && tp != tp2) {
1040 			log_err("file %s has mismatching data inside: "
1041 				"the file may only contain keys for one name, "
1042 				"remove keys for other domain names", nm);
1043         		fclose(fd);
1044 			free(origin);
1045 			free(prev);
1046 			return 0;
1047 		}
1048 		tp = tp2;
1049         }
1050         fclose(fd);
1051 	free(origin);
1052 	free(prev);
1053 	if(!tp) {
1054 		log_err("failed to read %s", nm);
1055 		return 0;
1056 	}
1057 
1058 	/* now assemble the data into DNSKEY and DS packed rrsets */
1059 	lock_basic_lock(&tp->lock);
1060 	if(!autr_assemble(tp)) {
1061 		lock_basic_unlock(&tp->lock);
1062 		log_err("malloc failure assembling %s", nm);
1063 		return 0;
1064 	}
1065 	lock_basic_unlock(&tp->lock);
1066 	return 1;
1067 }
1068 
1069 /** string for a trustanchor state */
1070 static const char*
1071 trustanchor_state2str(autr_state_type s)
1072 {
1073         switch (s) {
1074                 case AUTR_STATE_START:       return "  START  ";
1075                 case AUTR_STATE_ADDPEND:     return " ADDPEND ";
1076                 case AUTR_STATE_VALID:       return "  VALID  ";
1077                 case AUTR_STATE_MISSING:     return " MISSING ";
1078                 case AUTR_STATE_REVOKED:     return " REVOKED ";
1079                 case AUTR_STATE_REMOVED:     return " REMOVED ";
1080         }
1081         return " UNKNOWN ";
1082 }
1083 
1084 /** ctime r for autotrust */
1085 static char* autr_ctime_r(time_t* t, char* s)
1086 {
1087 	ctime_r(t, s);
1088 #ifdef USE_WINSOCK
1089 	if(strlen(s) > 10 && s[7]==' ' && s[8]=='0')
1090 		s[8]=' '; /* fix error in windows ctime */
1091 #endif
1092 	return s;
1093 }
1094 
1095 /** print ID to file */
1096 static int
1097 print_id(FILE* out, char* fname, uint8_t* nm, size_t nmlen, uint16_t dclass)
1098 {
1099 	char* s = sldns_wire2str_dname(nm, nmlen);
1100 	if(!s) {
1101 		log_err("malloc failure in write to %s", fname);
1102 		return 0;
1103 	}
1104 	if(fprintf(out, ";;id: %s %d\n", s, (int)dclass) < 0) {
1105 		log_err("could not write to %s: %s", fname, strerror(errno));
1106 		free(s);
1107 		return 0;
1108 	}
1109 	free(s);
1110 	return 1;
1111 }
1112 
1113 static int
1114 autr_write_contents(FILE* out, char* fn, struct trust_anchor* tp)
1115 {
1116 	char tmi[32];
1117 	struct autr_ta* ta;
1118 	char* str;
1119 
1120 	/* write pretty header */
1121 	if(fprintf(out, "; autotrust trust anchor file\n") < 0) {
1122 		log_err("could not write to %s: %s", fn, strerror(errno));
1123 		return 0;
1124 	}
1125 	if(tp->autr->revoked) {
1126 		if(fprintf(out, ";;REVOKED\n") < 0 ||
1127 		   fprintf(out, "; The zone has all keys revoked, and is\n"
1128 			"; considered as if it has no trust anchors.\n"
1129 			"; the remainder of the file is the last probe.\n"
1130 			"; to restart the trust anchor, overwrite this file.\n"
1131 			"; with one containing valid DNSKEYs or DSes.\n") < 0) {
1132 		   log_err("could not write to %s: %s", fn, strerror(errno));
1133 		   return 0;
1134 		}
1135 	}
1136 	if(!print_id(out, fn, tp->name, tp->namelen, tp->dclass)) {
1137 		return 0;
1138 	}
1139 	if(fprintf(out, ";;last_queried: %u ;;%s",
1140 		(unsigned int)tp->autr->last_queried,
1141 		autr_ctime_r(&(tp->autr->last_queried), tmi)) < 0 ||
1142 	   fprintf(out, ";;last_success: %u ;;%s",
1143 		(unsigned int)tp->autr->last_success,
1144 		autr_ctime_r(&(tp->autr->last_success), tmi)) < 0 ||
1145 	   fprintf(out, ";;next_probe_time: %u ;;%s",
1146 		(unsigned int)tp->autr->next_probe_time,
1147 		autr_ctime_r(&(tp->autr->next_probe_time), tmi)) < 0 ||
1148 	   fprintf(out, ";;query_failed: %d\n", (int)tp->autr->query_failed)<0
1149 	   || fprintf(out, ";;query_interval: %d\n",
1150 	   (int)tp->autr->query_interval) < 0 ||
1151 	   fprintf(out, ";;retry_time: %d\n", (int)tp->autr->retry_time) < 0) {
1152 		log_err("could not write to %s: %s", fn, strerror(errno));
1153 		return 0;
1154 	}
1155 
1156 	/* write anchors */
1157 	for(ta=tp->autr->keys; ta; ta=ta->next) {
1158 		/* by default do not store START and REMOVED keys */
1159 		if(ta->s == AUTR_STATE_START)
1160 			continue;
1161 		if(ta->s == AUTR_STATE_REMOVED)
1162 			continue;
1163 		/* only store keys */
1164 		if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len)
1165 			!= LDNS_RR_TYPE_DNSKEY)
1166 			continue;
1167 		str = sldns_wire2str_rr(ta->rr, ta->rr_len);
1168 		if(!str || !str[0]) {
1169 			free(str);
1170 			log_err("malloc failure writing %s", fn);
1171 			return 0;
1172 		}
1173 		str[strlen(str)-1] = 0; /* remove newline */
1174 		if(fprintf(out, "%s ;;state=%d [%s] ;;count=%d "
1175 			";;lastchange=%u ;;%s", str, (int)ta->s,
1176 			trustanchor_state2str(ta->s), (int)ta->pending_count,
1177 			(unsigned int)ta->last_change,
1178 			autr_ctime_r(&(ta->last_change), tmi)) < 0) {
1179 		   log_err("could not write to %s: %s", fn, strerror(errno));
1180 		   free(str);
1181 		   return 0;
1182 		}
1183 		free(str);
1184 	}
1185 	return 1;
1186 }
1187 
1188 void autr_write_file(struct module_env* env, struct trust_anchor* tp)
1189 {
1190 	FILE* out;
1191 	char* fname = tp->autr->file;
1192 #ifndef S_SPLINT_S
1193 	long long llvalue;
1194 #endif
1195 	char tempf[2048];
1196 	log_assert(tp->autr);
1197 	if(!env) {
1198 		log_err("autr_write_file: Module environment is NULL.");
1199 		return;
1200 	}
1201 	/* unique name with pid number, thread number, and struct pointer
1202 	 * (the pointer uniquifies for multiple libunbound contexts) */
1203 #ifndef S_SPLINT_S
1204 #if defined(SIZE_MAX) && defined(UINT32_MAX) && (UINT32_MAX == SIZE_MAX || INT32_MAX == SIZE_MAX)
1205 	/* avoid warning about upcast on 32bit systems */
1206 	llvalue = (unsigned long)tp;
1207 #else
1208 	llvalue = (unsigned long long)tp;
1209 #endif
1210 	snprintf(tempf, sizeof(tempf), "%s.%d-%d-" ARG_LL "x", fname, (int)getpid(),
1211 		env->worker?*(int*)env->worker:0, llvalue);
1212 #endif /* S_SPLINT_S */
1213 	verbose(VERB_ALGO, "autotrust: write to disk: %s", tempf);
1214 	out = fopen(tempf, "w");
1215 	if(!out) {
1216 		fatal_exit("could not open autotrust file for writing, %s: %s",
1217 			tempf, strerror(errno));
1218 		return;
1219 	}
1220 	if(!autr_write_contents(out, tempf, tp)) {
1221 		/* failed to write contents (completely) */
1222 		fclose(out);
1223 		unlink(tempf);
1224 		fatal_exit("could not completely write: %s", fname);
1225 		return;
1226 	}
1227 	if(fflush(out) != 0)
1228 		log_err("could not fflush(%s): %s", fname, strerror(errno));
1229 #ifdef HAVE_FSYNC
1230 	if(fsync(fileno(out)) != 0)
1231 		log_err("could not fsync(%s): %s", fname, strerror(errno));
1232 #else
1233 	FlushFileBuffers((HANDLE)_get_osfhandle(_fileno(out)));
1234 #endif
1235 	if(fclose(out) != 0) {
1236 		fatal_exit("could not complete write: %s: %s",
1237 			fname, strerror(errno));
1238 		unlink(tempf);
1239 		return;
1240 	}
1241 	/* success; overwrite actual file */
1242 	verbose(VERB_ALGO, "autotrust: replaced %s", fname);
1243 #ifdef UB_ON_WINDOWS
1244 	(void)unlink(fname); /* windows does not replace file with rename() */
1245 #endif
1246 	if(rename(tempf, fname) < 0) {
1247 		fatal_exit("rename(%s to %s): %s", tempf, fname, strerror(errno));
1248 	}
1249 }
1250 
1251 /**
1252  * Verify if dnskey works for trust point
1253  * @param env: environment (with time) for verification
1254  * @param ve: validator environment (with options) for verification.
1255  * @param tp: trust point to verify with
1256  * @param rrset: DNSKEY rrset to verify.
1257  * @param qstate: qstate with region.
1258  * @return false on failure, true if verification successful.
1259  */
1260 static int
1261 verify_dnskey(struct module_env* env, struct val_env* ve,
1262         struct trust_anchor* tp, struct ub_packed_rrset_key* rrset,
1263 	struct module_qstate* qstate)
1264 {
1265 	char reasonbuf[256];
1266 	char* reason = NULL;
1267 	uint8_t sigalg[ALGO_NEEDS_MAX+1];
1268 	int downprot = env->cfg->harden_algo_downgrade;
1269 	enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve, rrset,
1270 		tp->ds_rrset, tp->dnskey_rrset, downprot?sigalg:NULL, &reason,
1271 		NULL, qstate, reasonbuf, sizeof(reasonbuf));
1272 	/* sigalg is ignored, it returns algorithms signalled to exist, but
1273 	 * in 5011 there are no other rrsets to check.  if downprot is
1274 	 * enabled, then it checks that the DNSKEY is signed with all
1275 	 * algorithms available in the trust store. */
1276 	verbose(VERB_ALGO, "autotrust: validate DNSKEY with anchor: %s",
1277 		sec_status_to_string(sec));
1278 	return sec == sec_status_secure;
1279 }
1280 
1281 static int32_t
1282 rrsig_get_expiry(uint8_t* d, size_t len)
1283 {
1284 	/* rrsig: 2(rdlen), 2(type) 1(alg) 1(v) 4(origttl), then 4(expi), (4)incep) */
1285 	if(len < 2+8+4)
1286 		return 0;
1287 	return sldns_read_uint32(d+2+8);
1288 }
1289 
1290 /** Find minimum expiration interval from signatures */
1291 static time_t
1292 min_expiry(struct module_env* env, struct packed_rrset_data* dd)
1293 {
1294 	size_t i;
1295 	int32_t t, r = 15 * 24 * 3600; /* 15 days max */
1296 	for(i=dd->count; i<dd->count+dd->rrsig_count; i++) {
1297 		t = rrsig_get_expiry(dd->rr_data[i], dd->rr_len[i]);
1298 		if((int32_t)t - (int32_t)*env->now > 0) {
1299 			t -= (int32_t)*env->now;
1300 			if(t < r)
1301 				r = t;
1302 		}
1303 	}
1304 	return (time_t)r;
1305 }
1306 
1307 /** Is rr self-signed revoked key */
1308 static int
1309 rr_is_selfsigned_revoked(struct module_env* env, struct val_env* ve,
1310 	struct ub_packed_rrset_key* dnskey_rrset, size_t i,
1311 	struct module_qstate* qstate)
1312 {
1313 	enum sec_status sec;
1314 	char* reason = NULL;
1315 	verbose(VERB_ALGO, "seen REVOKE flag, check self-signed, rr %d",
1316 		(int)i);
1317 	/* no algorithm downgrade protection necessary, if it is selfsigned
1318 	 * revoked it can be removed. */
1319 	sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset, i,
1320 		&reason, NULL, LDNS_SECTION_ANSWER, qstate);
1321 	return (sec == sec_status_secure);
1322 }
1323 
1324 /** Set fetched value */
1325 static void
1326 seen_trustanchor(struct autr_ta* ta, uint8_t seen)
1327 {
1328 	ta->fetched = seen;
1329 	if(ta->pending_count < 250) /* no numerical overflow, please */
1330 		ta->pending_count++;
1331 }
1332 
1333 /** set revoked value */
1334 static void
1335 seen_revoked_trustanchor(struct autr_ta* ta, uint8_t revoked)
1336 {
1337 	ta->revoked = revoked;
1338 }
1339 
1340 /** revoke a trust anchor */
1341 static void
1342 revoke_dnskey(struct autr_ta* ta, int off)
1343 {
1344 	uint16_t flags;
1345 	uint8_t* data;
1346 	if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len) !=
1347 		LDNS_RR_TYPE_DNSKEY)
1348 		return;
1349 	if(sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len) < 2)
1350 		return;
1351 	data = sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len);
1352 	flags = sldns_read_uint16(data);
1353 	if (off && (flags&LDNS_KEY_REVOKE_KEY))
1354 		flags ^= LDNS_KEY_REVOKE_KEY; /* flip */
1355 	else
1356 		flags |= LDNS_KEY_REVOKE_KEY;
1357 	sldns_write_uint16(data, flags);
1358 }
1359 
1360 /** Compare two RRs skipping the REVOKED bit. Pass rdata(no len) */
1361 static int
1362 dnskey_compare_skip_revbit(uint8_t* a, size_t a_len, uint8_t* b, size_t b_len)
1363 {
1364 	size_t i;
1365 	if(a_len != b_len)
1366 		return -1;
1367 	/* compare RRs RDATA byte for byte. */
1368 	for(i = 0; i < a_len; i++)
1369 	{
1370 		uint8_t rdf1, rdf2;
1371 		rdf1 = a[i];
1372 		rdf2 = b[i];
1373 		if(i==1) {
1374 			/* this is the second part of the flags field */
1375 			rdf1 |= LDNS_KEY_REVOKE_KEY;
1376 			rdf2 |= LDNS_KEY_REVOKE_KEY;
1377 		}
1378 		if (rdf1 < rdf2)	return -1;
1379 		else if (rdf1 > rdf2)	return 1;
1380         }
1381 	return 0;
1382 }
1383 
1384 
1385 /** compare trust anchor with rdata, 0 if equal. Pass rdata(no len) */
1386 static int
1387 ta_compare(struct autr_ta* a, uint16_t t, uint8_t* b, size_t b_len)
1388 {
1389 	if(!a) return -1;
1390 	else if(!b) return -1;
1391 	else if(sldns_wirerr_get_type(a->rr, a->rr_len, a->dname_len) != t)
1392 		return (int)sldns_wirerr_get_type(a->rr, a->rr_len,
1393 			a->dname_len) - (int)t;
1394 	else if(t == LDNS_RR_TYPE_DNSKEY) {
1395 		return dnskey_compare_skip_revbit(
1396 			sldns_wirerr_get_rdata(a->rr, a->rr_len, a->dname_len),
1397 			sldns_wirerr_get_rdatalen(a->rr, a->rr_len,
1398 			a->dname_len), b, b_len);
1399 	}
1400 	else if(t == LDNS_RR_TYPE_DS) {
1401 		if(sldns_wirerr_get_rdatalen(a->rr, a->rr_len, a->dname_len) !=
1402 			b_len)
1403 			return -1;
1404 		return memcmp(sldns_wirerr_get_rdata(a->rr,
1405 			a->rr_len, a->dname_len), b, b_len);
1406 	}
1407 	return -1;
1408 }
1409 
1410 /**
1411  * Find key
1412  * @param tp: to search in
1413  * @param t: rr type of the rdata.
1414  * @param rdata: to look for  (no rdatalen in it)
1415  * @param rdata_len: length of rdata
1416  * @param result: returns NULL or the ta key looked for.
1417  * @return false on malloc failure during search. if true examine result.
1418  */
1419 static int
1420 find_key(struct trust_anchor* tp, uint16_t t, uint8_t* rdata, size_t rdata_len,
1421 	struct autr_ta** result)
1422 {
1423 	struct autr_ta* ta;
1424 	if(!tp || !rdata) {
1425 		*result = NULL;
1426 		return 0;
1427 	}
1428 	for(ta=tp->autr->keys; ta; ta=ta->next) {
1429 		if(ta_compare(ta, t, rdata, rdata_len) == 0) {
1430 			*result = ta;
1431 			return 1;
1432 		}
1433 	}
1434 	*result = NULL;
1435 	return 1;
1436 }
1437 
1438 /** add key and clone RR and tp already locked. rdata without rdlen. */
1439 static struct autr_ta*
1440 add_key(struct trust_anchor* tp, uint32_t ttl, uint8_t* rdata, size_t rdata_len)
1441 {
1442 	struct autr_ta* ta;
1443 	uint8_t* rr;
1444 	size_t rr_len, dname_len;
1445 	uint16_t rrtype = htons(LDNS_RR_TYPE_DNSKEY);
1446 	uint16_t rrclass = htons(LDNS_RR_CLASS_IN);
1447 	uint16_t rdlen = htons(rdata_len);
1448 	dname_len = tp->namelen;
1449 	ttl = htonl(ttl);
1450 	rr_len = dname_len + 10 /* type,class,ttl,rdatalen */ + rdata_len;
1451 	rr = (uint8_t*)malloc(rr_len);
1452 	if(!rr) return NULL;
1453 	memmove(rr, tp->name, tp->namelen);
1454 	memmove(rr+dname_len, &rrtype, 2);
1455 	memmove(rr+dname_len+2, &rrclass, 2);
1456 	memmove(rr+dname_len+4, &ttl, 4);
1457 	memmove(rr+dname_len+8, &rdlen, 2);
1458 	memmove(rr+dname_len+10, rdata, rdata_len);
1459 	ta = autr_ta_create(rr, rr_len, dname_len);
1460 	if(!ta) {
1461 		/* rr freed in autr_ta_create */
1462 		return NULL;
1463 	}
1464 	/* link in, tp already locked */
1465 	ta->next = tp->autr->keys;
1466 	tp->autr->keys = ta;
1467 	return ta;
1468 }
1469 
1470 /** get TTL from DNSKEY rrset */
1471 static time_t
1472 key_ttl(struct ub_packed_rrset_key* k)
1473 {
1474 	struct packed_rrset_data* d = (struct packed_rrset_data*)k->entry.data;
1475 	return d->ttl;
1476 }
1477 
1478 /** update the time values for the trustpoint */
1479 static void
1480 set_tp_times(struct trust_anchor* tp, time_t rrsig_exp_interval,
1481 	time_t origttl, int* changed)
1482 {
1483 	time_t x, qi = tp->autr->query_interval, rt = tp->autr->retry_time;
1484 
1485 	/* x = MIN(15days, ttl/2, expire/2) */
1486 	x = 15 * 24 * 3600;
1487 	if(origttl/2 < x)
1488 		x = origttl/2;
1489 	if(rrsig_exp_interval/2 < x)
1490 		x = rrsig_exp_interval/2;
1491 	/* MAX(1hr, x) */
1492 	if(!autr_permit_small_holddown) {
1493 		if(x < 3600)
1494 			tp->autr->query_interval = 3600;
1495 		else	tp->autr->query_interval = x;
1496 	}	else    tp->autr->query_interval = x;
1497 
1498 	/* x= MIN(1day, ttl/10, expire/10) */
1499 	x = 24 * 3600;
1500 	if(origttl/10 < x)
1501 		x = origttl/10;
1502 	if(rrsig_exp_interval/10 < x)
1503 		x = rrsig_exp_interval/10;
1504 	/* MAX(1hr, x) */
1505 	if(!autr_permit_small_holddown) {
1506 		if(x < 3600)
1507 			tp->autr->retry_time = 3600;
1508 		else	tp->autr->retry_time = x;
1509 	}	else    tp->autr->retry_time = x;
1510 
1511 	if(qi != tp->autr->query_interval || rt != tp->autr->retry_time) {
1512 		*changed = 1;
1513 		verbose(VERB_ALGO, "orig_ttl is %d", (int)origttl);
1514 		verbose(VERB_ALGO, "rrsig_exp_interval is %d",
1515 			(int)rrsig_exp_interval);
1516 		verbose(VERB_ALGO, "query_interval: %d, retry_time: %d",
1517 			(int)tp->autr->query_interval,
1518 			(int)tp->autr->retry_time);
1519 	}
1520 }
1521 
1522 /** init events to zero */
1523 static void
1524 init_events(struct trust_anchor* tp)
1525 {
1526 	struct autr_ta* ta;
1527 	for(ta=tp->autr->keys; ta; ta=ta->next) {
1528 		ta->fetched = 0;
1529 	}
1530 }
1531 
1532 /** check for revoked keys without trusting any other information */
1533 static void
1534 check_contains_revoked(struct module_env* env, struct val_env* ve,
1535 	struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1536 	int* changed, struct module_qstate* qstate)
1537 {
1538 	struct packed_rrset_data* dd = (struct packed_rrset_data*)
1539 		dnskey_rrset->entry.data;
1540 	size_t i;
1541 	log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1542 	for(i=0; i<dd->count; i++) {
1543 		struct autr_ta* ta = NULL;
1544 		if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1545 			dd->rr_data[i]+2, dd->rr_len[i]-2) ||
1546 			!rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1547 			dd->rr_data[i]+2, dd->rr_len[i]-2))
1548 			continue; /* not a revoked KSK */
1549 		if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1550 			dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1551 			log_err("malloc failure");
1552 			continue; /* malloc fail in compare*/
1553 		}
1554 		if(!ta)
1555 			continue; /* key not found */
1556 		if(rr_is_selfsigned_revoked(env, ve, dnskey_rrset, i, qstate)) {
1557 			/* checked if there is an rrsig signed by this key. */
1558 			/* same keytag, but stored can be revoked already, so
1559 			 * compare keytags, with +0 or +128(REVOKE flag) */
1560 			log_assert(dnskey_calc_keytag(dnskey_rrset, i)-128 ==
1561 				sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1562 				ta->rr, ta->rr_len, ta->dname_len),
1563 				sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1564 				ta->dname_len)) ||
1565 				dnskey_calc_keytag(dnskey_rrset, i) ==
1566 				sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1567 				ta->rr, ta->rr_len, ta->dname_len),
1568 				sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1569 				ta->dname_len))); /* checks conversion*/
1570 			verbose_key(ta, VERB_ALGO, "is self-signed revoked");
1571 			if(!ta->revoked)
1572 				*changed = 1;
1573 			seen_revoked_trustanchor(ta, 1);
1574 			do_revoked(env, ta, changed);
1575 		}
1576 	}
1577 }
1578 
1579 /** See if a DNSKEY is verified by one of the DSes */
1580 static int
1581 key_matches_a_ds(struct module_env* env, struct val_env* ve,
1582 	struct ub_packed_rrset_key* dnskey_rrset, size_t key_idx,
1583 	struct ub_packed_rrset_key* ds_rrset)
1584 {
1585 	struct packed_rrset_data* dd = (struct packed_rrset_data*)
1586 	                ds_rrset->entry.data;
1587 	size_t ds_idx, num = dd->count;
1588 	int d = val_favorite_ds_algo(ds_rrset);
1589 	char* reason = "";
1590 	for(ds_idx=0; ds_idx<num; ds_idx++) {
1591 		if(!ds_digest_algo_is_supported(ds_rrset, ds_idx) ||
1592 			!ds_key_algo_is_supported(ds_rrset, ds_idx) ||
1593 			!dnskey_size_is_supported(dnskey_rrset, key_idx) ||
1594 			ds_get_digest_algo(ds_rrset, ds_idx) != d)
1595 			continue;
1596 		if(ds_get_key_algo(ds_rrset, ds_idx)
1597 		   != dnskey_get_algo(dnskey_rrset, key_idx)
1598 		   || dnskey_calc_keytag(dnskey_rrset, key_idx)
1599 		   != ds_get_keytag(ds_rrset, ds_idx)) {
1600 			continue;
1601 		}
1602 		if(!ds_digest_match_dnskey(env, dnskey_rrset, key_idx,
1603 			ds_rrset, ds_idx)) {
1604 			verbose(VERB_ALGO, "DS match attempt failed");
1605 			continue;
1606 		}
1607 		/* match of hash is sufficient for bootstrap of trust point */
1608 		(void)reason;
1609 		(void)ve;
1610 		return 1;
1611 		/* no need to check RRSIG, DS hash already matched with source
1612 		if(dnskey_verify_rrset(env, ve, dnskey_rrset,
1613 			dnskey_rrset, key_idx, &reason) == sec_status_secure) {
1614 			return 1;
1615 		} else {
1616 			verbose(VERB_ALGO, "DS match failed because the key "
1617 				"does not verify the keyset: %s", reason);
1618 		}
1619 		*/
1620 	}
1621 	return 0;
1622 }
1623 
1624 /** Set update events */
1625 static int
1626 update_events(struct module_env* env, struct val_env* ve,
1627 	struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1628 	int* changed)
1629 {
1630 	struct packed_rrset_data* dd = (struct packed_rrset_data*)
1631 		dnskey_rrset->entry.data;
1632 	size_t i;
1633 	log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1634 	init_events(tp);
1635 	for(i=0; i<dd->count; i++) {
1636 		struct autr_ta* ta = NULL;
1637 		if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1638 			dd->rr_data[i]+2, dd->rr_len[i]-2))
1639 			continue;
1640 		if(rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1641 			dd->rr_data[i]+2, dd->rr_len[i]-2)) {
1642 			/* self-signed revoked keys already detected before,
1643 			 * other revoked keys are not 'added' again */
1644 			continue;
1645 		}
1646 		/* is a key of this type supported?. Note rr_list and
1647 		 * packed_rrset are in the same order. */
1648 		if(!dnskey_algo_is_supported(dnskey_rrset, i) ||
1649 			!dnskey_size_is_supported(dnskey_rrset, i)) {
1650 			/* skip unknown algorithm key, it is useless to us */
1651 			log_nametypeclass(VERB_DETAIL, "trust point has "
1652 				"unsupported algorithm at",
1653 				tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
1654 			continue;
1655 		}
1656 
1657 		/* is it new? if revocation bit set, find the unrevoked key */
1658 		if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1659 			dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1660 			return 0;
1661 		}
1662 		if(!ta) {
1663 			ta = add_key(tp, (uint32_t)dd->rr_ttl[i],
1664 				dd->rr_data[i]+2, dd->rr_len[i]-2);
1665 			*changed = 1;
1666 			/* first time seen, do we have DSes? if match: VALID */
1667 			if(ta && tp->ds_rrset && key_matches_a_ds(env, ve,
1668 				dnskey_rrset, i, tp->ds_rrset)) {
1669 				verbose_key(ta, VERB_ALGO, "verified by DS");
1670 				ta->s = AUTR_STATE_VALID;
1671 			}
1672 		}
1673 		if(!ta) {
1674 			return 0;
1675 		}
1676 		seen_trustanchor(ta, 1);
1677 		verbose_key(ta, VERB_ALGO, "in DNS response");
1678 	}
1679 	set_tp_times(tp, min_expiry(env, dd), key_ttl(dnskey_rrset), changed);
1680 	return 1;
1681 }
1682 
1683 /**
1684  * Check if the holddown time has already exceeded
1685  * setting: add-holddown: add holddown timer
1686  * setting: del-holddown: del holddown timer
1687  * @param env: environment with current time
1688  * @param ta: trust anchor to check for.
1689  * @param holddown: the timer value
1690  * @return number of seconds the holddown has passed.
1691  */
1692 static time_t
1693 check_holddown(struct module_env* env, struct autr_ta* ta,
1694 	unsigned int holddown)
1695 {
1696         time_t elapsed;
1697 	if(*env->now < ta->last_change) {
1698 		log_warn("time goes backwards. delaying key holddown");
1699 		return 0;
1700 	}
1701 	elapsed = *env->now - ta->last_change;
1702         if (elapsed > (time_t)holddown) {
1703                 return elapsed-(time_t)holddown;
1704         }
1705 	verbose_key(ta, VERB_ALGO, "holddown time " ARG_LL "d seconds to go",
1706 		(long long) ((time_t)holddown-elapsed));
1707         return 0;
1708 }
1709 
1710 
1711 /** Set last_change to now */
1712 static void
1713 reset_holddown(struct module_env* env, struct autr_ta* ta, int* changed)
1714 {
1715 	ta->last_change = *env->now;
1716 	*changed = 1;
1717 }
1718 
1719 /** Set the state for this trust anchor */
1720 static void
1721 set_trustanchor_state(struct module_env* env, struct autr_ta* ta, int* changed,
1722 	autr_state_type s)
1723 {
1724 	verbose_key(ta, VERB_ALGO, "update: %s to %s",
1725 		trustanchor_state2str(ta->s), trustanchor_state2str(s));
1726 	ta->s = s;
1727 	reset_holddown(env, ta, changed);
1728 }
1729 
1730 
1731 /** Event: NewKey */
1732 static void
1733 do_newkey(struct module_env* env, struct autr_ta* anchor, int* c)
1734 {
1735 	if (anchor->s == AUTR_STATE_START)
1736 		set_trustanchor_state(env, anchor, c, AUTR_STATE_ADDPEND);
1737 }
1738 
1739 /** Event: AddTime */
1740 static void
1741 do_addtime(struct module_env* env, struct autr_ta* anchor, int* c)
1742 {
1743 	/* This not according to RFC, this is 30 days, but the RFC demands
1744 	 * MAX(30days, TTL expire time of first DNSKEY set with this key),
1745 	 * The value may be too small if a very large TTL was used. */
1746 	time_t exceeded = check_holddown(env, anchor, env->cfg->add_holddown);
1747 	if (exceeded && anchor->s == AUTR_STATE_ADDPEND) {
1748 		verbose_key(anchor, VERB_ALGO, "add-holddown time exceeded "
1749 			ARG_LL "d seconds ago, and pending-count %d",
1750 			(long long)exceeded, anchor->pending_count);
1751 		if(anchor->pending_count >= MIN_PENDINGCOUNT) {
1752 			set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1753 			anchor->pending_count = 0;
1754 			return;
1755 		}
1756 		verbose_key(anchor, VERB_ALGO, "add-holddown time sanity check "
1757 			"failed (pending count: %d)", anchor->pending_count);
1758 	}
1759 }
1760 
1761 /** Event: RemTime */
1762 static void
1763 do_remtime(struct module_env* env, struct autr_ta* anchor, int* c)
1764 {
1765 	time_t exceeded = check_holddown(env, anchor, env->cfg->del_holddown);
1766 	if(exceeded && anchor->s == AUTR_STATE_REVOKED) {
1767 		verbose_key(anchor, VERB_ALGO, "del-holddown time exceeded "
1768 			ARG_LL "d seconds ago", (long long)exceeded);
1769 		set_trustanchor_state(env, anchor, c, AUTR_STATE_REMOVED);
1770 	}
1771 }
1772 
1773 /** Event: KeyRem */
1774 static void
1775 do_keyrem(struct module_env* env, struct autr_ta* anchor, int* c)
1776 {
1777 	if(anchor->s == AUTR_STATE_ADDPEND) {
1778 		set_trustanchor_state(env, anchor, c, AUTR_STATE_START);
1779 		anchor->pending_count = 0;
1780 	} else if(anchor->s == AUTR_STATE_VALID)
1781 		set_trustanchor_state(env, anchor, c, AUTR_STATE_MISSING);
1782 }
1783 
1784 /** Event: KeyPres */
1785 static void
1786 do_keypres(struct module_env* env, struct autr_ta* anchor, int* c)
1787 {
1788 	if(anchor->s == AUTR_STATE_MISSING)
1789 		set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1790 }
1791 
1792 /* Event: Revoked */
1793 static void
1794 do_revoked(struct module_env* env, struct autr_ta* anchor, int* c)
1795 {
1796 	if(anchor->s == AUTR_STATE_VALID || anchor->s == AUTR_STATE_MISSING) {
1797                 set_trustanchor_state(env, anchor, c, AUTR_STATE_REVOKED);
1798 		verbose_key(anchor, VERB_ALGO, "old id, prior to revocation");
1799                 revoke_dnskey(anchor, 0);
1800 		verbose_key(anchor, VERB_ALGO, "new id, after revocation");
1801 	}
1802 }
1803 
1804 /** Do statestable transition matrix for anchor */
1805 static void
1806 anchor_state_update(struct module_env* env, struct autr_ta* anchor, int* c)
1807 {
1808 	log_assert(anchor);
1809 	switch(anchor->s) {
1810 	/* START */
1811 	case AUTR_STATE_START:
1812 		/* NewKey: ADDPEND */
1813 		if (anchor->fetched)
1814 			do_newkey(env, anchor, c);
1815 		break;
1816 	/* ADDPEND */
1817 	case AUTR_STATE_ADDPEND:
1818 		/* KeyRem: START */
1819 		if (!anchor->fetched)
1820 			do_keyrem(env, anchor, c);
1821 		/* AddTime: VALID */
1822 		else	do_addtime(env, anchor, c);
1823 		break;
1824 	/* VALID */
1825 	case AUTR_STATE_VALID:
1826 		/* RevBit: REVOKED */
1827 		if (anchor->revoked)
1828 			do_revoked(env, anchor, c);
1829 		/* KeyRem: MISSING */
1830 		else if (!anchor->fetched)
1831 			do_keyrem(env, anchor, c);
1832 		else if(!anchor->last_change) {
1833 			verbose_key(anchor, VERB_ALGO, "first seen");
1834 			reset_holddown(env, anchor, c);
1835 		}
1836 		break;
1837 	/* MISSING */
1838 	case AUTR_STATE_MISSING:
1839 		/* RevBit: REVOKED */
1840 		if (anchor->revoked)
1841 			do_revoked(env, anchor, c);
1842 		/* KeyPres */
1843 		else if (anchor->fetched)
1844 			do_keypres(env, anchor, c);
1845 		break;
1846 	/* REVOKED */
1847 	case AUTR_STATE_REVOKED:
1848 		if (anchor->fetched)
1849 			reset_holddown(env, anchor, c);
1850 		/* RemTime: REMOVED */
1851 		else	do_remtime(env, anchor, c);
1852 		break;
1853 	/* REMOVED */
1854 	case AUTR_STATE_REMOVED:
1855 	default:
1856 		break;
1857 	}
1858 }
1859 
1860 /** if ZSK init then trust KSKs */
1861 static int
1862 init_zsk_to_ksk(struct module_env* env, struct trust_anchor* tp, int* changed)
1863 {
1864 	/* search for VALID ZSKs */
1865 	struct autr_ta* anchor;
1866 	int validzsk = 0;
1867 	int validksk = 0;
1868 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1869 		/* last_change test makes sure it was manually configured */
1870 		if(sldns_wirerr_get_type(anchor->rr, anchor->rr_len,
1871 			anchor->dname_len) == LDNS_RR_TYPE_DNSKEY &&
1872 			anchor->last_change == 0 &&
1873 			!ta_is_dnskey_sep(anchor) &&
1874 			anchor->s == AUTR_STATE_VALID)
1875                         validzsk++;
1876 	}
1877 	if(validzsk == 0)
1878 		return 0;
1879 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1880                 if (ta_is_dnskey_sep(anchor) &&
1881 			anchor->s == AUTR_STATE_ADDPEND) {
1882 			verbose_key(anchor, VERB_ALGO, "trust KSK from "
1883 				"ZSK(config)");
1884 			set_trustanchor_state(env, anchor, changed,
1885 				AUTR_STATE_VALID);
1886 			validksk++;
1887 		}
1888 	}
1889 	return validksk;
1890 }
1891 
1892 /** Remove missing trustanchors so the list does not grow forever */
1893 static void
1894 remove_missing_trustanchors(struct module_env* env, struct trust_anchor* tp,
1895 	int* changed)
1896 {
1897 	struct autr_ta* anchor;
1898 	time_t exceeded;
1899 	int valid = 0;
1900 	/* see if we have anchors that are valid */
1901 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1902 		/* Only do KSKs */
1903                 if (!ta_is_dnskey_sep(anchor))
1904                         continue;
1905                 if (anchor->s == AUTR_STATE_VALID)
1906                         valid++;
1907 	}
1908 	/* if there are no SEP Valid anchors, see if we started out with
1909 	 * a ZSK (last-change=0) anchor, which is VALID and there are KSKs
1910 	 * now that can be made valid.  Do this immediately because there
1911 	 * is no guarantee that the ZSKs get announced long enough.  Usually
1912 	 * this is immediately after init with a ZSK trusted, unless the domain
1913 	 * was not advertising any KSKs at all.  In which case we perfectly
1914 	 * track the zero number of KSKs. */
1915 	if(valid == 0) {
1916 		valid = init_zsk_to_ksk(env, tp, changed);
1917 		if(valid == 0)
1918 			return;
1919 	}
1920 
1921 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1922 		/* ignore ZSKs if newly added */
1923 		if(anchor->s == AUTR_STATE_START)
1924 			continue;
1925 		/* remove ZSKs if a KSK is present */
1926                 if (!ta_is_dnskey_sep(anchor)) {
1927 			if(valid > 0) {
1928 				verbose_key(anchor, VERB_ALGO, "remove ZSK "
1929 					"[%d key(s) VALID]", valid);
1930 				set_trustanchor_state(env, anchor, changed,
1931 					AUTR_STATE_REMOVED);
1932 			}
1933                         continue;
1934 		}
1935                 /* Only do MISSING keys */
1936                 if (anchor->s != AUTR_STATE_MISSING)
1937                         continue;
1938 		if(env->cfg->keep_missing == 0)
1939 			continue; /* keep forever */
1940 
1941 		exceeded = check_holddown(env, anchor, env->cfg->keep_missing);
1942 		/* If keep_missing has exceeded and we still have more than
1943 		 * one valid KSK: remove missing trust anchor */
1944                 if (exceeded && valid > 0) {
1945 			verbose_key(anchor, VERB_ALGO, "keep-missing time "
1946 				"exceeded " ARG_LL "d seconds ago, [%d key(s) VALID]",
1947 				(long long)exceeded, valid);
1948 			set_trustanchor_state(env, anchor, changed,
1949 				AUTR_STATE_REMOVED);
1950 		}
1951 	}
1952 }
1953 
1954 /** Do the statetable from RFC5011 transition matrix */
1955 static int
1956 do_statetable(struct module_env* env, struct trust_anchor* tp, int* changed)
1957 {
1958 	struct autr_ta* anchor;
1959 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1960 		/* Only do KSKs */
1961 		if(!ta_is_dnskey_sep(anchor))
1962 			continue;
1963 		anchor_state_update(env, anchor, changed);
1964 	}
1965 	remove_missing_trustanchors(env, tp, changed);
1966 	return 1;
1967 }
1968 
1969 /** See if time alone makes ADDPEND to VALID transition */
1970 static void
1971 autr_holddown_exceed(struct module_env* env, struct trust_anchor* tp, int* c)
1972 {
1973 	struct autr_ta* anchor;
1974 	for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1975 		if(ta_is_dnskey_sep(anchor) &&
1976 			anchor->s == AUTR_STATE_ADDPEND)
1977 			do_addtime(env, anchor, c);
1978 	}
1979 }
1980 
1981 /** cleanup key list */
1982 static void
1983 autr_cleanup_keys(struct trust_anchor* tp)
1984 {
1985 	struct autr_ta* p, **prevp;
1986 	prevp = &tp->autr->keys;
1987 	p = tp->autr->keys;
1988 	while(p) {
1989 		/* do we want to remove this key? */
1990 		if(p->s == AUTR_STATE_START || p->s == AUTR_STATE_REMOVED ||
1991 			sldns_wirerr_get_type(p->rr, p->rr_len, p->dname_len)
1992 			!= LDNS_RR_TYPE_DNSKEY) {
1993 			struct autr_ta* np = p->next;
1994 			/* remove */
1995 			free(p->rr);
1996 			free(p);
1997 			/* snip and go to next item */
1998 			*prevp = np;
1999 			p = np;
2000 			continue;
2001 		}
2002 		/* remove pending counts if no longer pending */
2003 		if(p->s != AUTR_STATE_ADDPEND)
2004 			p->pending_count = 0;
2005 		prevp = &p->next;
2006 		p = p->next;
2007 	}
2008 }
2009 
2010 /** calculate next probe time */
2011 static time_t
2012 calc_next_probe(struct module_env* env, time_t wait)
2013 {
2014 	/* make it random, 90-100% */
2015 	time_t rnd, rest;
2016 	if(!autr_permit_small_holddown) {
2017 		if(wait < 3600)
2018 			wait = 3600;
2019 	} else {
2020 		if(wait == 0) wait = 1;
2021 	}
2022 	rnd = wait/10;
2023 	rest = wait-rnd;
2024 	rnd = (time_t)ub_random_max(env->rnd, (long int)rnd);
2025 	return (time_t)(*env->now + rest + rnd);
2026 }
2027 
2028 /** what is first probe time (anchors must be locked) */
2029 static time_t
2030 wait_probe_time(struct val_anchors* anchors)
2031 {
2032 	rbnode_type* t = rbtree_first(&anchors->autr->probe);
2033 	if(t != RBTREE_NULL)
2034 		return ((struct trust_anchor*)t->key)->autr->next_probe_time;
2035 	return 0;
2036 }
2037 
2038 /** reset worker timer */
2039 static void
2040 reset_worker_timer(struct module_env* env)
2041 {
2042 	struct timeval tv;
2043 #ifndef S_SPLINT_S
2044 	time_t next = (time_t)wait_probe_time(env->anchors);
2045 	/* in case this is libunbound, no timer */
2046 	if(!env->probe_timer)
2047 		return;
2048 	if(next > *env->now)
2049 		tv.tv_sec = (time_t)(next - *env->now);
2050 	else	tv.tv_sec = 0;
2051 #endif
2052 	tv.tv_usec = 0;
2053 	comm_timer_set(env->probe_timer, &tv);
2054 	verbose(VERB_ALGO, "scheduled next probe in " ARG_LL "d sec", (long long)tv.tv_sec);
2055 }
2056 
2057 /** set next probe for trust anchor */
2058 static int
2059 set_next_probe(struct module_env* env, struct trust_anchor* tp,
2060 	struct ub_packed_rrset_key* dnskey_rrset)
2061 {
2062 	struct trust_anchor key, *tp2;
2063 	time_t mold, mnew;
2064 	/* use memory allocated in rrset for temporary name storage */
2065 	key.node.key = &key;
2066 	key.name = dnskey_rrset->rk.dname;
2067 	key.namelen = dnskey_rrset->rk.dname_len;
2068 	key.namelabs = dname_count_labels(key.name);
2069 	key.dclass = tp->dclass;
2070 	lock_basic_unlock(&tp->lock);
2071 
2072 	/* fetch tp again and lock anchors, so that we can modify the trees */
2073 	lock_basic_lock(&env->anchors->lock);
2074 	tp2 = (struct trust_anchor*)rbtree_search(env->anchors->tree, &key);
2075 	if(!tp2) {
2076 		verbose(VERB_ALGO, "trustpoint was deleted in set_next_probe");
2077 		lock_basic_unlock(&env->anchors->lock);
2078 		return 0;
2079 	}
2080 	log_assert(tp == tp2);
2081 	lock_basic_lock(&tp->lock);
2082 
2083 	/* schedule */
2084 	mold = wait_probe_time(env->anchors);
2085 	(void)rbtree_delete(&env->anchors->autr->probe, tp);
2086 	tp->autr->next_probe_time = calc_next_probe(env,
2087 		tp->autr->query_interval);
2088 	(void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2089 	mnew = wait_probe_time(env->anchors);
2090 
2091 	lock_basic_unlock(&env->anchors->lock);
2092 	verbose(VERB_ALGO, "next probe set in %d seconds",
2093 		(int)tp->autr->next_probe_time - (int)*env->now);
2094 	if(mold != mnew) {
2095 		reset_worker_timer(env);
2096 	}
2097 	return 1;
2098 }
2099 
2100 /** Revoke and Delete a trust point */
2101 static void
2102 autr_tp_remove(struct module_env* env, struct trust_anchor* tp,
2103 	struct ub_packed_rrset_key* dnskey_rrset)
2104 {
2105 	struct trust_anchor* del_tp;
2106 	struct trust_anchor key;
2107 	struct autr_point_data pd;
2108 	time_t mold, mnew;
2109 
2110 	log_nametypeclass(VERB_OPS, "trust point was revoked",
2111 		tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2112 	tp->autr->revoked = 1;
2113 
2114 	/* use space allocated for dnskey_rrset to save name of anchor */
2115 	memset(&key, 0, sizeof(key));
2116 	memset(&pd, 0, sizeof(pd));
2117 	key.autr = &pd;
2118 	key.node.key = &key;
2119 	pd.pnode.key = &key;
2120 	pd.next_probe_time = tp->autr->next_probe_time;
2121 	key.name = dnskey_rrset->rk.dname;
2122 	key.namelen = tp->namelen;
2123 	key.namelabs = tp->namelabs;
2124 	key.dclass = tp->dclass;
2125 
2126 	/* unlock */
2127 	lock_basic_unlock(&tp->lock);
2128 
2129 	/* take from tree. It could be deleted by someone else,hence (void). */
2130 	lock_basic_lock(&env->anchors->lock);
2131 	del_tp = (struct trust_anchor*)rbtree_delete(env->anchors->tree, &key);
2132 	mold = wait_probe_time(env->anchors);
2133 	(void)rbtree_delete(&env->anchors->autr->probe, &key);
2134 	mnew = wait_probe_time(env->anchors);
2135 	anchors_init_parents_locked(env->anchors);
2136 	lock_basic_unlock(&env->anchors->lock);
2137 
2138 	/* if !del_tp then the trust point is no longer present in the tree,
2139 	 * it was deleted by someone else, who will write the zonefile and
2140 	 * clean up the structure */
2141 	if(del_tp) {
2142 		/* save on disk */
2143 		del_tp->autr->next_probe_time = 0; /* no more probing for it */
2144 		autr_write_file(env, del_tp);
2145 
2146 		/* delete */
2147 		autr_point_delete(del_tp);
2148 	}
2149 	if(mold != mnew) {
2150 		reset_worker_timer(env);
2151 	}
2152 }
2153 
2154 int autr_process_prime(struct module_env* env, struct val_env* ve,
2155 	struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
2156 	struct module_qstate* qstate)
2157 {
2158 	int changed = 0;
2159 	log_assert(tp && tp->autr);
2160 	/* autotrust update trust anchors */
2161 	/* the tp is locked, and stays locked unless it is deleted */
2162 
2163 	/* we could just catch the anchor here while another thread
2164 	 * is busy deleting it. Just unlock and let the other do its job */
2165 	if(tp->autr->revoked) {
2166 		log_nametypeclass(VERB_ALGO, "autotrust not processed, "
2167 			"trust point revoked", tp->name,
2168 			LDNS_RR_TYPE_DNSKEY, tp->dclass);
2169 		lock_basic_unlock(&tp->lock);
2170 		return 0; /* it is revoked */
2171 	}
2172 
2173 	/* query_dnskeys(): */
2174 	tp->autr->last_queried = *env->now;
2175 
2176 	log_nametypeclass(VERB_ALGO, "autotrust process for",
2177 		tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2178 	/* see if time alone makes some keys valid */
2179 	autr_holddown_exceed(env, tp, &changed);
2180 	if(changed) {
2181 		verbose(VERB_ALGO, "autotrust: morekeys, reassemble");
2182 		if(!autr_assemble(tp)) {
2183 			log_err("malloc failure assembling autotrust keys");
2184 			return 1; /* unchanged */
2185 		}
2186 	}
2187 	/* did we get any data? */
2188 	if(!dnskey_rrset) {
2189 		verbose(VERB_ALGO, "autotrust: no dnskey rrset");
2190 		/* no update of query_failed, because then we would have
2191 		 * to write to disk. But we cannot because we maybe are
2192 		 * still 'initializing' with DS records, that we cannot write
2193 		 * in the full format (which only contains KSKs). */
2194 		return 1; /* trust point exists */
2195 	}
2196 	/* check for revoked keys to remove immediately */
2197 	check_contains_revoked(env, ve, tp, dnskey_rrset, &changed, qstate);
2198 	if(changed) {
2199 		verbose(VERB_ALGO, "autotrust: revokedkeys, reassemble");
2200 		if(!autr_assemble(tp)) {
2201 			log_err("malloc failure assembling autotrust keys");
2202 			return 1; /* unchanged */
2203 		}
2204 		if(!tp->ds_rrset && !tp->dnskey_rrset) {
2205 			/* no more keys, all are revoked */
2206 			/* this is a success for this probe attempt */
2207 			tp->autr->last_success = *env->now;
2208 			autr_tp_remove(env, tp, dnskey_rrset);
2209 			return 0; /* trust point removed */
2210 		}
2211 	}
2212 	/* verify the dnskey rrset and see if it is valid. */
2213 	if(!verify_dnskey(env, ve, tp, dnskey_rrset, qstate)) {
2214 		verbose(VERB_ALGO, "autotrust: dnskey did not verify.");
2215 		/* only increase failure count if this is not the first prime,
2216 		 * this means there was a previous successful probe */
2217 		if(tp->autr->last_success) {
2218 			tp->autr->query_failed += 1;
2219 			autr_write_file(env, tp);
2220 		}
2221 		return 1; /* trust point exists */
2222 	}
2223 
2224 	tp->autr->last_success = *env->now;
2225 	tp->autr->query_failed = 0;
2226 
2227 	/* Add new trust anchors to the data structure
2228 	 * - note which trust anchors are seen this probe.
2229 	 * Set trustpoint query_interval and retry_time.
2230 	 * - find minimum rrsig expiration interval
2231 	 */
2232 	if(!update_events(env, ve, tp, dnskey_rrset, &changed)) {
2233 		log_err("malloc failure in autotrust update_events. "
2234 			"trust point unchanged.");
2235 		return 1; /* trust point unchanged, so exists */
2236 	}
2237 
2238 	/* - for every SEP key do the 5011 statetable.
2239 	 * - remove missing trustanchors (if veryold and we have new anchors).
2240 	 */
2241 	if(!do_statetable(env, tp, &changed)) {
2242 		log_err("malloc failure in autotrust do_statetable. "
2243 			"trust point unchanged.");
2244 		return 1; /* trust point unchanged, so exists */
2245 	}
2246 
2247 	autr_cleanup_keys(tp);
2248 	if(!set_next_probe(env, tp, dnskey_rrset))
2249 		return 0; /* trust point does not exist */
2250 	autr_write_file(env, tp);
2251 	if(changed) {
2252 		verbose(VERB_ALGO, "autotrust: changed, reassemble");
2253 		if(!autr_assemble(tp)) {
2254 			log_err("malloc failure assembling autotrust keys");
2255 			return 1; /* unchanged */
2256 		}
2257 		if(!tp->ds_rrset && !tp->dnskey_rrset) {
2258 			/* no more keys, all are revoked */
2259 			autr_tp_remove(env, tp, dnskey_rrset);
2260 			return 0; /* trust point removed */
2261 		}
2262 	} else verbose(VERB_ALGO, "autotrust: no changes");
2263 
2264 	return 1; /* trust point exists */
2265 }
2266 
2267 /** debug print a trust anchor key */
2268 static void
2269 autr_debug_print_ta(struct autr_ta* ta)
2270 {
2271 	char buf[32];
2272 	char* str = sldns_wire2str_rr(ta->rr, ta->rr_len);
2273 	if(!str) {
2274 		log_info("out of memory in debug_print_ta");
2275 		return;
2276 	}
2277 	if(str[0]) str[strlen(str)-1]=0; /* remove newline */
2278 	(void)autr_ctime_r(&ta->last_change, buf);
2279 	if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2280 	log_info("[%s] %s ;;state:%d ;;pending_count:%d%s%s last:%s",
2281 		trustanchor_state2str(ta->s), str, ta->s, ta->pending_count,
2282 		ta->fetched?" fetched":"", ta->revoked?" revoked":"", buf);
2283 	free(str);
2284 }
2285 
2286 /** debug print a trust point */
2287 static void
2288 autr_debug_print_tp(struct trust_anchor* tp)
2289 {
2290 	struct autr_ta* ta;
2291 	char buf[257];
2292 	if(!tp->autr)
2293 		return;
2294 	dname_str(tp->name, buf);
2295 	log_info("trust point %s : %d", buf, (int)tp->dclass);
2296 	log_info("assembled %d DS and %d DNSKEYs",
2297 		(int)tp->numDS, (int)tp->numDNSKEY);
2298 	if(tp->ds_rrset) {
2299 		log_packed_rrset(NO_VERBOSE, "DS:", tp->ds_rrset);
2300 	}
2301 	if(tp->dnskey_rrset) {
2302 		log_packed_rrset(NO_VERBOSE, "DNSKEY:", tp->dnskey_rrset);
2303 	}
2304 	log_info("file %s", tp->autr->file);
2305 	(void)autr_ctime_r(&tp->autr->last_queried, buf);
2306 	if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2307 	log_info("last_queried: %u %s", (unsigned)tp->autr->last_queried, buf);
2308 	(void)autr_ctime_r(&tp->autr->last_success, buf);
2309 	if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2310 	log_info("last_success: %u %s", (unsigned)tp->autr->last_success, buf);
2311 	(void)autr_ctime_r(&tp->autr->next_probe_time, buf);
2312 	if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2313 	log_info("next_probe_time: %u %s", (unsigned)tp->autr->next_probe_time,
2314 		buf);
2315 	log_info("query_interval: %u", (unsigned)tp->autr->query_interval);
2316 	log_info("retry_time: %u", (unsigned)tp->autr->retry_time);
2317 	log_info("query_failed: %u", (unsigned)tp->autr->query_failed);
2318 
2319 	for(ta=tp->autr->keys; ta; ta=ta->next) {
2320 		autr_debug_print_ta(ta);
2321 	}
2322 }
2323 
2324 void
2325 autr_debug_print(struct val_anchors* anchors)
2326 {
2327 	struct trust_anchor* tp;
2328 	lock_basic_lock(&anchors->lock);
2329 	RBTREE_FOR(tp, struct trust_anchor*, anchors->tree) {
2330 		lock_basic_lock(&tp->lock);
2331 		autr_debug_print_tp(tp);
2332 		lock_basic_unlock(&tp->lock);
2333 	}
2334 	lock_basic_unlock(&anchors->lock);
2335 }
2336 
2337 void probe_answer_cb(void* arg, int ATTR_UNUSED(rcode),
2338 	sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(sec),
2339 	char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
2340 {
2341 	/* retry was set before the query was done,
2342 	 * re-querytime is set when query succeeded, but that may not
2343 	 * have reset this timer because the query could have been
2344 	 * handled by another thread. In that case, this callback would
2345 	 * get called after the original timeout is done.
2346 	 * By not resetting the timer, it may probe more often, but not
2347 	 * less often.
2348 	 * Unless the new lookup resulted in smaller TTLs and thus smaller
2349 	 * timeout values. In that case one old TTL could be mistakenly done.
2350 	 */
2351 	struct module_env* env = (struct module_env*)arg;
2352 	verbose(VERB_ALGO, "autotrust probe answer cb");
2353 	reset_worker_timer(env);
2354 }
2355 
2356 /** probe a trust anchor DNSKEY and unlocks tp */
2357 static void
2358 probe_anchor(struct module_env* env, struct trust_anchor* tp)
2359 {
2360 	struct query_info qinfo;
2361 	uint16_t qflags = BIT_RD;
2362 	struct edns_data edns;
2363 	sldns_buffer* buf = env->scratch_buffer;
2364 	qinfo.qname = regional_alloc_init(env->scratch, tp->name, tp->namelen);
2365 	if(!qinfo.qname) {
2366 		log_err("out of memory making 5011 probe");
2367 		return;
2368 	}
2369 	qinfo.qname_len = tp->namelen;
2370 	qinfo.qtype = LDNS_RR_TYPE_DNSKEY;
2371 	qinfo.qclass = tp->dclass;
2372 	qinfo.local_alias = NULL;
2373 	log_query_info(VERB_ALGO, "autotrust probe", &qinfo);
2374 	verbose(VERB_ALGO, "retry probe set in %d seconds",
2375 		(int)tp->autr->next_probe_time - (int)*env->now);
2376 	edns.edns_present = 1;
2377 	edns.ext_rcode = 0;
2378 	edns.edns_version = 0;
2379 	edns.bits = EDNS_DO;
2380 	edns.opt_list_in = NULL;
2381 	edns.opt_list_out = NULL;
2382 	edns.opt_list_inplace_cb_out = NULL;
2383 	edns.padding_block_size = 0;
2384 	edns.cookie_present = 0;
2385 	edns.cookie_valid = 0;
2386 	if(sldns_buffer_capacity(buf) < 65535)
2387 		edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
2388 	else	edns.udp_size = 65535;
2389 
2390 	/* can't hold the lock while mesh_run is processing */
2391 	lock_basic_unlock(&tp->lock);
2392 
2393 	/* delete the DNSKEY from rrset and key cache so an active probe
2394 	 * is done. First the rrset so another thread does not use it
2395 	 * to recreate the key entry in a race condition. */
2396 	rrset_cache_remove(env->rrset_cache, qinfo.qname, qinfo.qname_len,
2397 		qinfo.qtype, qinfo.qclass, 0);
2398 	key_cache_remove(env->key_cache, qinfo.qname, qinfo.qname_len,
2399 		qinfo.qclass);
2400 
2401 	if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
2402 		&probe_answer_cb, env, 0)) {
2403 		log_err("out of memory making 5011 probe");
2404 	}
2405 }
2406 
2407 /** fetch first to-probe trust-anchor and lock it and set retrytime */
2408 static struct trust_anchor*
2409 todo_probe(struct module_env* env, time_t* next)
2410 {
2411 	struct trust_anchor* tp;
2412 	rbnode_type* el;
2413 	/* get first one */
2414 	lock_basic_lock(&env->anchors->lock);
2415 	if( (el=rbtree_first(&env->anchors->autr->probe)) == RBTREE_NULL) {
2416 		/* in case of revoked anchors */
2417 		lock_basic_unlock(&env->anchors->lock);
2418 		/* signal that there are no anchors to probe */
2419 		*next = 0;
2420 		return NULL;
2421 	}
2422 	tp = (struct trust_anchor*)el->key;
2423 	lock_basic_lock(&tp->lock);
2424 
2425 	/* is it eligible? */
2426 	if((time_t)tp->autr->next_probe_time > *env->now) {
2427 		/* no more to probe */
2428 		*next = (time_t)tp->autr->next_probe_time - *env->now;
2429 		lock_basic_unlock(&tp->lock);
2430 		lock_basic_unlock(&env->anchors->lock);
2431 		return NULL;
2432 	}
2433 
2434 	/* reset its next probe time */
2435 	(void)rbtree_delete(&env->anchors->autr->probe, tp);
2436 	tp->autr->next_probe_time = calc_next_probe(env, tp->autr->retry_time);
2437 	(void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2438 	lock_basic_unlock(&env->anchors->lock);
2439 
2440 	return tp;
2441 }
2442 
2443 time_t
2444 autr_probe_timer(struct module_env* env)
2445 {
2446 	struct trust_anchor* tp;
2447 	time_t next_probe = 3600;
2448 	int num = 0;
2449 	if(autr_permit_small_holddown) next_probe = 1;
2450 	verbose(VERB_ALGO, "autotrust probe timer callback");
2451 	/* while there are still anchors to probe */
2452 	while( (tp = todo_probe(env, &next_probe)) ) {
2453 		/* make a probe for this anchor */
2454 		probe_anchor(env, tp);
2455 		num++;
2456 	}
2457 	regional_free_all(env->scratch);
2458 	if(next_probe == 0)
2459 		return 0; /* no trust points to probe */
2460 	verbose(VERB_ALGO, "autotrust probe timer %d callbacks done", num);
2461 	return next_probe;
2462 }
2463