1b7579f77SDag-Erling Smørgrav /* 2b7579f77SDag-Erling Smørgrav * validator/val_utils.c - validator utility functions. 3b7579f77SDag-Erling Smørgrav * 4b7579f77SDag-Erling Smørgrav * Copyright (c) 2007, NLnet Labs. All rights reserved. 5b7579f77SDag-Erling Smørgrav * 6b7579f77SDag-Erling Smørgrav * This software is open source. 7b7579f77SDag-Erling Smørgrav * 8b7579f77SDag-Erling Smørgrav * Redistribution and use in source and binary forms, with or without 9b7579f77SDag-Erling Smørgrav * modification, are permitted provided that the following conditions 10b7579f77SDag-Erling Smørgrav * are met: 11b7579f77SDag-Erling Smørgrav * 12b7579f77SDag-Erling Smørgrav * Redistributions of source code must retain the above copyright notice, 13b7579f77SDag-Erling Smørgrav * this list of conditions and the following disclaimer. 14b7579f77SDag-Erling Smørgrav * 15b7579f77SDag-Erling Smørgrav * Redistributions in binary form must reproduce the above copyright notice, 16b7579f77SDag-Erling Smørgrav * this list of conditions and the following disclaimer in the documentation 17b7579f77SDag-Erling Smørgrav * and/or other materials provided with the distribution. 18b7579f77SDag-Erling Smørgrav * 19b7579f77SDag-Erling Smørgrav * Neither the name of the NLNET LABS nor the names of its contributors may 20b7579f77SDag-Erling Smørgrav * be used to endorse or promote products derived from this software without 21b7579f77SDag-Erling Smørgrav * specific prior written permission. 22b7579f77SDag-Erling Smørgrav * 23b7579f77SDag-Erling Smørgrav * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 2417d15b25SDag-Erling Smørgrav * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 2517d15b25SDag-Erling Smørgrav * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 2617d15b25SDag-Erling Smørgrav * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 2717d15b25SDag-Erling Smørgrav * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 2817d15b25SDag-Erling Smørgrav * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 2917d15b25SDag-Erling Smørgrav * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 3017d15b25SDag-Erling Smørgrav * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 3117d15b25SDag-Erling Smørgrav * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 3217d15b25SDag-Erling Smørgrav * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 3317d15b25SDag-Erling Smørgrav * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34b7579f77SDag-Erling Smørgrav */ 35b7579f77SDag-Erling Smørgrav 36b7579f77SDag-Erling Smørgrav /** 37b7579f77SDag-Erling Smørgrav * \file 38b7579f77SDag-Erling Smørgrav * 39b7579f77SDag-Erling Smørgrav * This file contains helper functions for the validator module. 40b7579f77SDag-Erling Smørgrav */ 41b7579f77SDag-Erling Smørgrav #include "config.h" 42b7579f77SDag-Erling Smørgrav #include "validator/val_utils.h" 43b7579f77SDag-Erling Smørgrav #include "validator/validator.h" 44b7579f77SDag-Erling Smørgrav #include "validator/val_kentry.h" 45b7579f77SDag-Erling Smørgrav #include "validator/val_sigcrypt.h" 46b7579f77SDag-Erling Smørgrav #include "validator/val_anchor.h" 47b7579f77SDag-Erling Smørgrav #include "validator/val_nsec.h" 48b7579f77SDag-Erling Smørgrav #include "validator/val_neg.h" 49b7579f77SDag-Erling Smørgrav #include "services/cache/rrset.h" 50b7579f77SDag-Erling Smørgrav #include "services/cache/dns.h" 51b7579f77SDag-Erling Smørgrav #include "util/data/msgreply.h" 52b7579f77SDag-Erling Smørgrav #include "util/data/packed_rrset.h" 53b7579f77SDag-Erling Smørgrav #include "util/data/dname.h" 54b7579f77SDag-Erling Smørgrav #include "util/net_help.h" 55b7579f77SDag-Erling Smørgrav #include "util/module.h" 56b7579f77SDag-Erling Smørgrav #include "util/regional.h" 57c7f4d7adSDag-Erling Smørgrav #include "util/config_file.h" 58f61ef7f6SDag-Erling Smørgrav #include "sldns/wire2str.h" 59f61ef7f6SDag-Erling Smørgrav #include "sldns/parseutil.h" 60b7579f77SDag-Erling Smørgrav 61b76ef9a7SCy Schubert /** Maximum allowed digest match failures per DS, for DNSKEYs with the same 62b76ef9a7SCy Schubert * properties */ 63b76ef9a7SCy Schubert #define MAX_DS_MATCH_FAILURES 4 64b76ef9a7SCy Schubert 65b7579f77SDag-Erling Smørgrav enum val_classification 66b7579f77SDag-Erling Smørgrav val_classify_response(uint16_t query_flags, struct query_info* origqinf, 67b7579f77SDag-Erling Smørgrav struct query_info* qinf, struct reply_info* rep, size_t skip) 68b7579f77SDag-Erling Smørgrav { 69b7579f77SDag-Erling Smørgrav int rcode = (int)FLAGS_GET_RCODE(rep->flags); 70b7579f77SDag-Erling Smørgrav size_t i; 71b7579f77SDag-Erling Smørgrav 72b7579f77SDag-Erling Smørgrav /* Normal Name Error's are easy to detect -- but don't mistake a CNAME 73b7579f77SDag-Erling Smørgrav * chain ending in NXDOMAIN. */ 74b7579f77SDag-Erling Smørgrav if(rcode == LDNS_RCODE_NXDOMAIN && rep->an_numrrsets == 0) 75b7579f77SDag-Erling Smørgrav return VAL_CLASS_NAMEERROR; 76b7579f77SDag-Erling Smørgrav 77b7579f77SDag-Erling Smørgrav /* check for referral: nonRD query and it looks like a nodata */ 78b7579f77SDag-Erling Smørgrav if(!(query_flags&BIT_RD) && rep->an_numrrsets == 0 && 79b7579f77SDag-Erling Smørgrav rcode == LDNS_RCODE_NOERROR) { 80b7579f77SDag-Erling Smørgrav /* SOA record in auth indicates it is NODATA instead. 81b7579f77SDag-Erling Smørgrav * All validation requiring NODATA messages have SOA in 82b7579f77SDag-Erling Smørgrav * authority section. */ 83b7579f77SDag-Erling Smørgrav /* uses fact that answer section is empty */ 84b7579f77SDag-Erling Smørgrav int saw_ns = 0; 85b7579f77SDag-Erling Smørgrav for(i=0; i<rep->ns_numrrsets; i++) { 86b7579f77SDag-Erling Smørgrav if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_SOA) 87b7579f77SDag-Erling Smørgrav return VAL_CLASS_NODATA; 88b7579f77SDag-Erling Smørgrav if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_DS) 89b7579f77SDag-Erling Smørgrav return VAL_CLASS_REFERRAL; 90b7579f77SDag-Erling Smørgrav if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS) 91b7579f77SDag-Erling Smørgrav saw_ns = 1; 92b7579f77SDag-Erling Smørgrav } 93b7579f77SDag-Erling Smørgrav return saw_ns?VAL_CLASS_REFERRAL:VAL_CLASS_NODATA; 94b7579f77SDag-Erling Smørgrav } 95b7579f77SDag-Erling Smørgrav /* root referral where NS set is in the answer section */ 96b7579f77SDag-Erling Smørgrav if(!(query_flags&BIT_RD) && rep->ns_numrrsets == 0 && 97b7579f77SDag-Erling Smørgrav rep->an_numrrsets == 1 && rcode == LDNS_RCODE_NOERROR && 98b7579f77SDag-Erling Smørgrav ntohs(rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_NS && 99b7579f77SDag-Erling Smørgrav query_dname_compare(rep->rrsets[0]->rk.dname, 100b7579f77SDag-Erling Smørgrav origqinf->qname) != 0) 101b7579f77SDag-Erling Smørgrav return VAL_CLASS_REFERRAL; 102b7579f77SDag-Erling Smørgrav 103b7579f77SDag-Erling Smørgrav /* dump bad messages */ 104b7579f77SDag-Erling Smørgrav if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) 105b7579f77SDag-Erling Smørgrav return VAL_CLASS_UNKNOWN; 106b7579f77SDag-Erling Smørgrav /* next check if the skip into the answer section shows no answer */ 107b7579f77SDag-Erling Smørgrav if(skip>0 && rep->an_numrrsets <= skip) 108b7579f77SDag-Erling Smørgrav return VAL_CLASS_CNAMENOANSWER; 109b7579f77SDag-Erling Smørgrav 110b7579f77SDag-Erling Smørgrav /* Next is NODATA */ 111b7579f77SDag-Erling Smørgrav if(rcode == LDNS_RCODE_NOERROR && rep->an_numrrsets == 0) 112b7579f77SDag-Erling Smørgrav return VAL_CLASS_NODATA; 113b7579f77SDag-Erling Smørgrav 114b7579f77SDag-Erling Smørgrav /* We distinguish between CNAME response and other positive/negative 115b7579f77SDag-Erling Smørgrav * responses because CNAME answers require extra processing. */ 116b7579f77SDag-Erling Smørgrav 117b7579f77SDag-Erling Smørgrav /* We distinguish between ANY and CNAME or POSITIVE because 118b7579f77SDag-Erling Smørgrav * ANY responses are validated differently. */ 119b7579f77SDag-Erling Smørgrav if(rcode == LDNS_RCODE_NOERROR && qinf->qtype == LDNS_RR_TYPE_ANY) 120b7579f77SDag-Erling Smørgrav return VAL_CLASS_ANY; 121b7579f77SDag-Erling Smørgrav 122*335c7cdaSCy Schubert /* For the query type DNAME, the name matters. Equal name is the 123*335c7cdaSCy Schubert * answer looked for, but a subdomain redirects the query. */ 124*335c7cdaSCy Schubert if(qinf->qtype == LDNS_RR_TYPE_DNAME) { 125*335c7cdaSCy Schubert for(i=skip; i<rep->an_numrrsets; i++) { 126*335c7cdaSCy Schubert if(rcode == LDNS_RCODE_NOERROR && 127*335c7cdaSCy Schubert ntohs(rep->rrsets[i]->rk.type) 128*335c7cdaSCy Schubert == LDNS_RR_TYPE_DNAME && 129*335c7cdaSCy Schubert query_dname_compare(qinf->qname, 130*335c7cdaSCy Schubert rep->rrsets[i]->rk.dname) == 0) { 131*335c7cdaSCy Schubert /* type is DNAME and name is equal, it is 132*335c7cdaSCy Schubert * the answer. For the query name a subdomain 133*335c7cdaSCy Schubert * of the rrset.dname it would redirect. */ 134*335c7cdaSCy Schubert return VAL_CLASS_POSITIVE; 135*335c7cdaSCy Schubert } 136*335c7cdaSCy Schubert if(ntohs(rep->rrsets[i]->rk.type) 137*335c7cdaSCy Schubert == LDNS_RR_TYPE_CNAME) 138*335c7cdaSCy Schubert return VAL_CLASS_CNAME; 139*335c7cdaSCy Schubert } 140*335c7cdaSCy Schubert log_dns_msg("validator: error. failed to classify response message: ", 141*335c7cdaSCy Schubert qinf, rep); 142*335c7cdaSCy Schubert return VAL_CLASS_UNKNOWN; 143*335c7cdaSCy Schubert } 144*335c7cdaSCy Schubert 145b7579f77SDag-Erling Smørgrav /* Note that DNAMEs will be ignored here, unless qtype=DNAME. Unless 146b7579f77SDag-Erling Smørgrav * qtype=CNAME, this will yield a CNAME response. */ 147b7579f77SDag-Erling Smørgrav for(i=skip; i<rep->an_numrrsets; i++) { 148b7579f77SDag-Erling Smørgrav if(rcode == LDNS_RCODE_NOERROR && 149b7579f77SDag-Erling Smørgrav ntohs(rep->rrsets[i]->rk.type) == qinf->qtype) 150b7579f77SDag-Erling Smørgrav return VAL_CLASS_POSITIVE; 151b7579f77SDag-Erling Smørgrav if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME) 152b7579f77SDag-Erling Smørgrav return VAL_CLASS_CNAME; 153b7579f77SDag-Erling Smørgrav } 154b7579f77SDag-Erling Smørgrav log_dns_msg("validator: error. failed to classify response message: ", 155b7579f77SDag-Erling Smørgrav qinf, rep); 156b7579f77SDag-Erling Smørgrav return VAL_CLASS_UNKNOWN; 157b7579f77SDag-Erling Smørgrav } 158b7579f77SDag-Erling Smørgrav 159b7579f77SDag-Erling Smørgrav /** Get signer name from RRSIG */ 160b7579f77SDag-Erling Smørgrav static void 161b7579f77SDag-Erling Smørgrav rrsig_get_signer(uint8_t* data, size_t len, uint8_t** sname, size_t* slen) 162b7579f77SDag-Erling Smørgrav { 163b7579f77SDag-Erling Smørgrav /* RRSIG rdata is not allowed to be compressed, it is stored 164b7579f77SDag-Erling Smørgrav * uncompressed in memory as well, so return a ptr to the name */ 165b7579f77SDag-Erling Smørgrav if(len < 21) { 166b7579f77SDag-Erling Smørgrav /* too short RRSig: 167b7579f77SDag-Erling Smørgrav * short, byte, byte, long, long, long, short, "." is 168b7579f77SDag-Erling Smørgrav * 2 1 1 4 4 4 2 1 = 19 169b7579f77SDag-Erling Smørgrav * and a skip of 18 bytes to the name. 170b7579f77SDag-Erling Smørgrav * +2 for the rdatalen is 21 bytes len for root label */ 171b7579f77SDag-Erling Smørgrav *sname = NULL; 172b7579f77SDag-Erling Smørgrav *slen = 0; 173b7579f77SDag-Erling Smørgrav return; 174b7579f77SDag-Erling Smørgrav } 175b7579f77SDag-Erling Smørgrav data += 20; /* skip the fixed size bits */ 176b7579f77SDag-Erling Smørgrav len -= 20; 177b7579f77SDag-Erling Smørgrav *slen = dname_valid(data, len); 178b7579f77SDag-Erling Smørgrav if(!*slen) { 179b7579f77SDag-Erling Smørgrav /* bad dname in this rrsig. */ 180b7579f77SDag-Erling Smørgrav *sname = NULL; 181b7579f77SDag-Erling Smørgrav return; 182b7579f77SDag-Erling Smørgrav } 183b7579f77SDag-Erling Smørgrav *sname = data; 184b7579f77SDag-Erling Smørgrav } 185b7579f77SDag-Erling Smørgrav 186b7579f77SDag-Erling Smørgrav void 187b7579f77SDag-Erling Smørgrav val_find_rrset_signer(struct ub_packed_rrset_key* rrset, uint8_t** sname, 188b7579f77SDag-Erling Smørgrav size_t* slen) 189b7579f77SDag-Erling Smørgrav { 190b7579f77SDag-Erling Smørgrav struct packed_rrset_data* d = (struct packed_rrset_data*) 191b7579f77SDag-Erling Smørgrav rrset->entry.data; 192b7579f77SDag-Erling Smørgrav /* return signer for first signature, or NULL */ 193b7579f77SDag-Erling Smørgrav if(d->rrsig_count == 0) { 194b7579f77SDag-Erling Smørgrav *sname = NULL; 195b7579f77SDag-Erling Smørgrav *slen = 0; 196b7579f77SDag-Erling Smørgrav return; 197b7579f77SDag-Erling Smørgrav } 198b7579f77SDag-Erling Smørgrav /* get rrsig signer name out of the signature */ 199b7579f77SDag-Erling Smørgrav rrsig_get_signer(d->rr_data[d->count], d->rr_len[d->count], 200b7579f77SDag-Erling Smørgrav sname, slen); 201b7579f77SDag-Erling Smørgrav } 202b7579f77SDag-Erling Smørgrav 203b7579f77SDag-Erling Smørgrav /** 204b7579f77SDag-Erling Smørgrav * Find best signer name in this set of rrsigs. 205b7579f77SDag-Erling Smørgrav * @param rrset: which rrsigs to look through. 206b7579f77SDag-Erling Smørgrav * @param qinf: the query name that needs validation. 207b7579f77SDag-Erling Smørgrav * @param signer_name: the best signer_name. Updated if a better one is found. 208b7579f77SDag-Erling Smørgrav * @param signer_len: length of signer name. 209b7579f77SDag-Erling Smørgrav * @param matchcount: count of current best name (starts at 0 for no match). 210b7579f77SDag-Erling Smørgrav * Updated if match is improved. 211b7579f77SDag-Erling Smørgrav */ 212b7579f77SDag-Erling Smørgrav static void 213b7579f77SDag-Erling Smørgrav val_find_best_signer(struct ub_packed_rrset_key* rrset, 214b7579f77SDag-Erling Smørgrav struct query_info* qinf, uint8_t** signer_name, size_t* signer_len, 215b7579f77SDag-Erling Smørgrav int* matchcount) 216b7579f77SDag-Erling Smørgrav { 217b7579f77SDag-Erling Smørgrav struct packed_rrset_data* d = (struct packed_rrset_data*) 218b7579f77SDag-Erling Smørgrav rrset->entry.data; 219b7579f77SDag-Erling Smørgrav uint8_t* sign; 220b7579f77SDag-Erling Smørgrav size_t i; 221b7579f77SDag-Erling Smørgrav int m; 222b7579f77SDag-Erling Smørgrav for(i=d->count; i<d->count+d->rrsig_count; i++) { 223b7579f77SDag-Erling Smørgrav sign = d->rr_data[i]+2+18; 224b7579f77SDag-Erling Smørgrav /* look at signatures that are valid (long enough), 225b7579f77SDag-Erling Smørgrav * and have a signer name that is a superdomain of qname, 226b7579f77SDag-Erling Smørgrav * and then check the number of labels in the shared topdomain 227b7579f77SDag-Erling Smørgrav * improve the match if possible */ 228b7579f77SDag-Erling Smørgrav if(d->rr_len[i] > 2+19 && /* rdata, sig + root label*/ 229b7579f77SDag-Erling Smørgrav dname_subdomain_c(qinf->qname, sign)) { 230b7579f77SDag-Erling Smørgrav (void)dname_lab_cmp(qinf->qname, 231b7579f77SDag-Erling Smørgrav dname_count_labels(qinf->qname), 232b7579f77SDag-Erling Smørgrav sign, dname_count_labels(sign), &m); 233b7579f77SDag-Erling Smørgrav if(m > *matchcount) { 234b7579f77SDag-Erling Smørgrav *matchcount = m; 235b7579f77SDag-Erling Smørgrav *signer_name = sign; 236b7579f77SDag-Erling Smørgrav (void)dname_count_size_labels(*signer_name, 237b7579f77SDag-Erling Smørgrav signer_len); 238b7579f77SDag-Erling Smørgrav } 239b7579f77SDag-Erling Smørgrav } 240b7579f77SDag-Erling Smørgrav } 241b7579f77SDag-Erling Smørgrav } 242b7579f77SDag-Erling Smørgrav 243b7579f77SDag-Erling Smørgrav void 244b7579f77SDag-Erling Smørgrav val_find_signer(enum val_classification subtype, struct query_info* qinf, 245b7579f77SDag-Erling Smørgrav struct reply_info* rep, size_t skip, uint8_t** signer_name, 246b7579f77SDag-Erling Smørgrav size_t* signer_len) 247b7579f77SDag-Erling Smørgrav { 248b7579f77SDag-Erling Smørgrav size_t i; 249b7579f77SDag-Erling Smørgrav 250bc892140SDag-Erling Smørgrav if(subtype == VAL_CLASS_POSITIVE) { 251b7579f77SDag-Erling Smørgrav /* check for the answer rrset */ 252b7579f77SDag-Erling Smørgrav for(i=skip; i<rep->an_numrrsets; i++) { 253b7579f77SDag-Erling Smørgrav if(query_dname_compare(qinf->qname, 254b7579f77SDag-Erling Smørgrav rep->rrsets[i]->rk.dname) == 0) { 255b7579f77SDag-Erling Smørgrav val_find_rrset_signer(rep->rrsets[i], 256b7579f77SDag-Erling Smørgrav signer_name, signer_len); 257*335c7cdaSCy Schubert /* If there was no signer, and the query 258*335c7cdaSCy Schubert * was for type CNAME, and this is a CNAME, 259*335c7cdaSCy Schubert * and the previous is a DNAME, then this 260*335c7cdaSCy Schubert * is the synthesized CNAME, use the signer 261*335c7cdaSCy Schubert * of the DNAME record. */ 262*335c7cdaSCy Schubert if(*signer_name == NULL && 263*335c7cdaSCy Schubert qinf->qtype == LDNS_RR_TYPE_CNAME && 264*335c7cdaSCy Schubert ntohs(rep->rrsets[i]->rk.type) == 265*335c7cdaSCy Schubert LDNS_RR_TYPE_CNAME && i > skip && 266*335c7cdaSCy Schubert ntohs(rep->rrsets[i-1]->rk.type) == 267*335c7cdaSCy Schubert LDNS_RR_TYPE_DNAME && 268*335c7cdaSCy Schubert dname_strict_subdomain_c(rep->rrsets[i]->rk.dname, rep->rrsets[i-1]->rk.dname)) { 269*335c7cdaSCy Schubert val_find_rrset_signer(rep->rrsets[i-1], 270*335c7cdaSCy Schubert signer_name, signer_len); 271*335c7cdaSCy Schubert } 272b7579f77SDag-Erling Smørgrav return; 273b7579f77SDag-Erling Smørgrav } 274b7579f77SDag-Erling Smørgrav } 275b7579f77SDag-Erling Smørgrav *signer_name = NULL; 276b7579f77SDag-Erling Smørgrav *signer_len = 0; 277b7579f77SDag-Erling Smørgrav } else if(subtype == VAL_CLASS_CNAME) { 278b7579f77SDag-Erling Smørgrav /* check for the first signed cname/dname rrset */ 279b7579f77SDag-Erling Smørgrav for(i=skip; i<rep->an_numrrsets; i++) { 280b7579f77SDag-Erling Smørgrav val_find_rrset_signer(rep->rrsets[i], 281b7579f77SDag-Erling Smørgrav signer_name, signer_len); 282b7579f77SDag-Erling Smørgrav if(*signer_name) 283b7579f77SDag-Erling Smørgrav return; 284b7579f77SDag-Erling Smørgrav if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_DNAME) 285b7579f77SDag-Erling Smørgrav break; /* only check CNAME after a DNAME */ 286b7579f77SDag-Erling Smørgrav } 287b7579f77SDag-Erling Smørgrav *signer_name = NULL; 288b7579f77SDag-Erling Smørgrav *signer_len = 0; 289b7579f77SDag-Erling Smørgrav } else if(subtype == VAL_CLASS_NAMEERROR 290b7579f77SDag-Erling Smørgrav || subtype == VAL_CLASS_NODATA) { 291b7579f77SDag-Erling Smørgrav /*Check to see if the AUTH section NSEC record(s) have rrsigs*/ 292b7579f77SDag-Erling Smørgrav for(i=rep->an_numrrsets; i< 293b7579f77SDag-Erling Smørgrav rep->an_numrrsets+rep->ns_numrrsets; i++) { 294b7579f77SDag-Erling Smørgrav if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC 295b7579f77SDag-Erling Smørgrav || ntohs(rep->rrsets[i]->rk.type) == 296b7579f77SDag-Erling Smørgrav LDNS_RR_TYPE_NSEC3) { 297b7579f77SDag-Erling Smørgrav val_find_rrset_signer(rep->rrsets[i], 298b7579f77SDag-Erling Smørgrav signer_name, signer_len); 299b7579f77SDag-Erling Smørgrav return; 300b7579f77SDag-Erling Smørgrav } 301b7579f77SDag-Erling Smørgrav } 302b7579f77SDag-Erling Smørgrav } else if(subtype == VAL_CLASS_CNAMENOANSWER) { 303b7579f77SDag-Erling Smørgrav /* find closest superdomain signer name in authority section 304b7579f77SDag-Erling Smørgrav * NSEC and NSEC3s */ 305b7579f77SDag-Erling Smørgrav int matchcount = 0; 306b7579f77SDag-Erling Smørgrav *signer_name = NULL; 307b7579f77SDag-Erling Smørgrav *signer_len = 0; 308b7579f77SDag-Erling Smørgrav for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep-> 309b7579f77SDag-Erling Smørgrav ns_numrrsets; i++) { 310b7579f77SDag-Erling Smørgrav if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC 311b7579f77SDag-Erling Smørgrav || ntohs(rep->rrsets[i]->rk.type) == 312b7579f77SDag-Erling Smørgrav LDNS_RR_TYPE_NSEC3) { 313b7579f77SDag-Erling Smørgrav val_find_best_signer(rep->rrsets[i], qinf, 314b7579f77SDag-Erling Smørgrav signer_name, signer_len, &matchcount); 315b7579f77SDag-Erling Smørgrav } 316b7579f77SDag-Erling Smørgrav } 317bc892140SDag-Erling Smørgrav } else if(subtype == VAL_CLASS_ANY) { 318bc892140SDag-Erling Smørgrav /* check for one of the answer rrset that has signatures, 319bc892140SDag-Erling Smørgrav * or potentially a DNAME is in use with a different qname */ 320bc892140SDag-Erling Smørgrav for(i=skip; i<rep->an_numrrsets; i++) { 321bc892140SDag-Erling Smørgrav if(query_dname_compare(qinf->qname, 322bc892140SDag-Erling Smørgrav rep->rrsets[i]->rk.dname) == 0) { 323bc892140SDag-Erling Smørgrav val_find_rrset_signer(rep->rrsets[i], 324bc892140SDag-Erling Smørgrav signer_name, signer_len); 325bc892140SDag-Erling Smørgrav if(*signer_name) 326bc892140SDag-Erling Smørgrav return; 327bc892140SDag-Erling Smørgrav } 328bc892140SDag-Erling Smørgrav } 329bc892140SDag-Erling Smørgrav /* no answer RRSIGs with qname, try a DNAME */ 330bc892140SDag-Erling Smørgrav if(skip < rep->an_numrrsets && 331bc892140SDag-Erling Smørgrav ntohs(rep->rrsets[skip]->rk.type) == 332bc892140SDag-Erling Smørgrav LDNS_RR_TYPE_DNAME) { 333bc892140SDag-Erling Smørgrav val_find_rrset_signer(rep->rrsets[skip], 334bc892140SDag-Erling Smørgrav signer_name, signer_len); 335bc892140SDag-Erling Smørgrav if(*signer_name) 336bc892140SDag-Erling Smørgrav return; 337bc892140SDag-Erling Smørgrav } 338bc892140SDag-Erling Smørgrav *signer_name = NULL; 339bc892140SDag-Erling Smørgrav *signer_len = 0; 340b7579f77SDag-Erling Smørgrav } else if(subtype == VAL_CLASS_REFERRAL) { 341b7579f77SDag-Erling Smørgrav /* find keys for the item at skip */ 342b7579f77SDag-Erling Smørgrav if(skip < rep->rrset_count) { 343b7579f77SDag-Erling Smørgrav val_find_rrset_signer(rep->rrsets[skip], 344b7579f77SDag-Erling Smørgrav signer_name, signer_len); 345b7579f77SDag-Erling Smørgrav return; 346b7579f77SDag-Erling Smørgrav } 347b7579f77SDag-Erling Smørgrav *signer_name = NULL; 348b7579f77SDag-Erling Smørgrav *signer_len = 0; 349b7579f77SDag-Erling Smørgrav } else { 350b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "find_signer: could not find signer name" 351b7579f77SDag-Erling Smørgrav " for unknown type response"); 352b7579f77SDag-Erling Smørgrav *signer_name = NULL; 353b7579f77SDag-Erling Smørgrav *signer_len = 0; 354b7579f77SDag-Erling Smørgrav } 355b7579f77SDag-Erling Smørgrav } 356b7579f77SDag-Erling Smørgrav 357b7579f77SDag-Erling Smørgrav /** return number of rrs in an rrset */ 358b7579f77SDag-Erling Smørgrav static size_t 359b7579f77SDag-Erling Smørgrav rrset_get_count(struct ub_packed_rrset_key* rrset) 360b7579f77SDag-Erling Smørgrav { 361b7579f77SDag-Erling Smørgrav struct packed_rrset_data* d = (struct packed_rrset_data*) 362b7579f77SDag-Erling Smørgrav rrset->entry.data; 363b7579f77SDag-Erling Smørgrav if(!d) return 0; 364b7579f77SDag-Erling Smørgrav return d->count; 365b7579f77SDag-Erling Smørgrav } 366b7579f77SDag-Erling Smørgrav 367b7579f77SDag-Erling Smørgrav /** return TTL of rrset */ 368b7579f77SDag-Erling Smørgrav static uint32_t 369b7579f77SDag-Erling Smørgrav rrset_get_ttl(struct ub_packed_rrset_key* rrset) 370b7579f77SDag-Erling Smørgrav { 371b7579f77SDag-Erling Smørgrav struct packed_rrset_data* d = (struct packed_rrset_data*) 372b7579f77SDag-Erling Smørgrav rrset->entry.data; 373b7579f77SDag-Erling Smørgrav if(!d) return 0; 374b7579f77SDag-Erling Smørgrav return d->ttl; 375b7579f77SDag-Erling Smørgrav } 376b7579f77SDag-Erling Smørgrav 377a39a5a69SCy Schubert static enum sec_status 378b7579f77SDag-Erling Smørgrav val_verify_rrset(struct module_env* env, struct val_env* ve, 379b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* keys, 380a39a5a69SCy Schubert uint8_t* sigalg, char** reason, sldns_ede_code *reason_bogus, 381b76ef9a7SCy Schubert sldns_pkt_section section, struct module_qstate* qstate, 382b76ef9a7SCy Schubert int *verified) 383b7579f77SDag-Erling Smørgrav { 384b7579f77SDag-Erling Smørgrav enum sec_status sec; 385b7579f77SDag-Erling Smørgrav struct packed_rrset_data* d = (struct packed_rrset_data*)rrset-> 386b7579f77SDag-Erling Smørgrav entry.data; 387b7579f77SDag-Erling Smørgrav if(d->security == sec_status_secure) { 388b7579f77SDag-Erling Smørgrav /* re-verify all other statuses, because keyset may change*/ 389b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "verify rrset cached", 390b7579f77SDag-Erling Smørgrav rrset->rk.dname, ntohs(rrset->rk.type), 391b7579f77SDag-Erling Smørgrav ntohs(rrset->rk.rrset_class)); 392b76ef9a7SCy Schubert *verified = 0; 393b7579f77SDag-Erling Smørgrav return d->security; 394b7579f77SDag-Erling Smørgrav } 395b7579f77SDag-Erling Smørgrav /* check in the cache if verification has already been done */ 396b7579f77SDag-Erling Smørgrav rrset_check_sec_status(env->rrset_cache, rrset, *env->now); 397b7579f77SDag-Erling Smørgrav if(d->security == sec_status_secure) { 398b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "verify rrset from cache", 399b7579f77SDag-Erling Smørgrav rrset->rk.dname, ntohs(rrset->rk.type), 400b7579f77SDag-Erling Smørgrav ntohs(rrset->rk.rrset_class)); 401b76ef9a7SCy Schubert *verified = 0; 402b7579f77SDag-Erling Smørgrav return d->security; 403b7579f77SDag-Erling Smørgrav } 404b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "verify rrset", rrset->rk.dname, 405b7579f77SDag-Erling Smørgrav ntohs(rrset->rk.type), ntohs(rrset->rk.rrset_class)); 406838e13ceSDag-Erling Smørgrav sec = dnskeyset_verify_rrset(env, ve, rrset, keys, sigalg, reason, 407b76ef9a7SCy Schubert reason_bogus, section, qstate, verified); 408b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "verify result: %s", sec_status_to_string(sec)); 409b7579f77SDag-Erling Smørgrav regional_free_all(env->scratch); 410b7579f77SDag-Erling Smørgrav 411b7579f77SDag-Erling Smørgrav /* update rrset security status 412b7579f77SDag-Erling Smørgrav * only improves security status 413b7579f77SDag-Erling Smørgrav * and bogus is set only once, even if we rechecked the status */ 414b7579f77SDag-Erling Smørgrav if(sec > d->security) { 415b7579f77SDag-Erling Smørgrav d->security = sec; 416b7579f77SDag-Erling Smørgrav if(sec == sec_status_secure) 417b7579f77SDag-Erling Smørgrav d->trust = rrset_trust_validated; 418b7579f77SDag-Erling Smørgrav else if(sec == sec_status_bogus) { 419b7579f77SDag-Erling Smørgrav size_t i; 420b7579f77SDag-Erling Smørgrav /* update ttl for rrset to fixed value. */ 421b7579f77SDag-Erling Smørgrav d->ttl = ve->bogus_ttl; 422b7579f77SDag-Erling Smørgrav for(i=0; i<d->count+d->rrsig_count; i++) 423b7579f77SDag-Erling Smørgrav d->rr_ttl[i] = ve->bogus_ttl; 424b7579f77SDag-Erling Smørgrav /* leave RR specific TTL: not used for determine 425b7579f77SDag-Erling Smørgrav * if RRset timed out and clients see proper value. */ 426b7579f77SDag-Erling Smørgrav lock_basic_lock(&ve->bogus_lock); 427b7579f77SDag-Erling Smørgrav ve->num_rrset_bogus++; 428b7579f77SDag-Erling Smørgrav lock_basic_unlock(&ve->bogus_lock); 429b7579f77SDag-Erling Smørgrav } 430b7579f77SDag-Erling Smørgrav /* if status updated - store in cache for reuse */ 431b7579f77SDag-Erling Smørgrav rrset_update_sec_status(env->rrset_cache, rrset, *env->now); 432b7579f77SDag-Erling Smørgrav } 433b7579f77SDag-Erling Smørgrav 434b7579f77SDag-Erling Smørgrav return sec; 435b7579f77SDag-Erling Smørgrav } 436b7579f77SDag-Erling Smørgrav 437b7579f77SDag-Erling Smørgrav enum sec_status 438b7579f77SDag-Erling Smørgrav val_verify_rrset_entry(struct module_env* env, struct val_env* ve, 439b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* rrset, struct key_entry_key* kkey, 440a39a5a69SCy Schubert char** reason, sldns_ede_code *reason_bogus, 441b76ef9a7SCy Schubert sldns_pkt_section section, struct module_qstate* qstate, 442b76ef9a7SCy Schubert int* verified) 443b7579f77SDag-Erling Smørgrav { 444b7579f77SDag-Erling Smørgrav /* temporary dnskey rrset-key */ 445b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key dnskey; 446b7579f77SDag-Erling Smørgrav struct key_entry_data* kd = (struct key_entry_data*)kkey->entry.data; 447b7579f77SDag-Erling Smørgrav enum sec_status sec; 448b7579f77SDag-Erling Smørgrav dnskey.rk.type = htons(kd->rrset_type); 449b7579f77SDag-Erling Smørgrav dnskey.rk.rrset_class = htons(kkey->key_class); 450b7579f77SDag-Erling Smørgrav dnskey.rk.flags = 0; 451b7579f77SDag-Erling Smørgrav dnskey.rk.dname = kkey->name; 452b7579f77SDag-Erling Smørgrav dnskey.rk.dname_len = kkey->namelen; 453b7579f77SDag-Erling Smørgrav dnskey.entry.key = &dnskey; 454b7579f77SDag-Erling Smørgrav dnskey.entry.data = kd->rrset_data; 455838e13ceSDag-Erling Smørgrav sec = val_verify_rrset(env, ve, rrset, &dnskey, kd->algo, reason, 456b76ef9a7SCy Schubert reason_bogus, section, qstate, verified); 457b7579f77SDag-Erling Smørgrav return sec; 458b7579f77SDag-Erling Smørgrav } 459b7579f77SDag-Erling Smørgrav 460b7579f77SDag-Erling Smørgrav /** verify that a DS RR hashes to a key and that key signs the set */ 461b7579f77SDag-Erling Smørgrav static enum sec_status 462b7579f77SDag-Erling Smørgrav verify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve, 463b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* dnskey_rrset, 464838e13ceSDag-Erling Smørgrav struct ub_packed_rrset_key* ds_rrset, size_t ds_idx, char** reason, 465b7c0c8c1SCy Schubert sldns_ede_code *reason_bogus, struct module_qstate* qstate, 466b7c0c8c1SCy Schubert int *nonechecked) 467b7579f77SDag-Erling Smørgrav { 468b7579f77SDag-Erling Smørgrav enum sec_status sec = sec_status_bogus; 4695469a995SCy Schubert size_t i, num, numchecked = 0, numhashok = 0, numsizesupp = 0; 470b7579f77SDag-Erling Smørgrav num = rrset_get_count(dnskey_rrset); 471b7c0c8c1SCy Schubert *nonechecked = 0; 472b7579f77SDag-Erling Smørgrav for(i=0; i<num; i++) { 473b7579f77SDag-Erling Smørgrav /* Skip DNSKEYs that don't match the basic criteria. */ 474b7579f77SDag-Erling Smørgrav if(ds_get_key_algo(ds_rrset, ds_idx) 475b7579f77SDag-Erling Smørgrav != dnskey_get_algo(dnskey_rrset, i) 476b7579f77SDag-Erling Smørgrav || dnskey_calc_keytag(dnskey_rrset, i) 477b7579f77SDag-Erling Smørgrav != ds_get_keytag(ds_rrset, ds_idx)) { 478b7579f77SDag-Erling Smørgrav continue; 479b7579f77SDag-Erling Smørgrav } 480b7579f77SDag-Erling Smørgrav numchecked++; 481b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "attempt DS match algo %d keytag %d", 482b7579f77SDag-Erling Smørgrav ds_get_key_algo(ds_rrset, ds_idx), 483b7579f77SDag-Erling Smørgrav ds_get_keytag(ds_rrset, ds_idx)); 484b7579f77SDag-Erling Smørgrav 485b7579f77SDag-Erling Smørgrav /* Convert the candidate DNSKEY into a hash using the 486b7579f77SDag-Erling Smørgrav * same DS hash algorithm. */ 487b7579f77SDag-Erling Smørgrav if(!ds_digest_match_dnskey(env, dnskey_rrset, i, ds_rrset, 488b7579f77SDag-Erling Smørgrav ds_idx)) { 489b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "DS match attempt failed"); 490b76ef9a7SCy Schubert if(numchecked > numhashok + MAX_DS_MATCH_FAILURES) { 491b76ef9a7SCy Schubert verbose(VERB_ALGO, "DS match attempt reached " 492b76ef9a7SCy Schubert "MAX_DS_MATCH_FAILURES (%d); bogus", 493b76ef9a7SCy Schubert MAX_DS_MATCH_FAILURES); 494b76ef9a7SCy Schubert return sec_status_bogus; 495b76ef9a7SCy Schubert } 496b7579f77SDag-Erling Smørgrav continue; 497b7579f77SDag-Erling Smørgrav } 498b7579f77SDag-Erling Smørgrav numhashok++; 4995469a995SCy Schubert if(!dnskey_size_is_supported(dnskey_rrset, i)) { 5005469a995SCy Schubert verbose(VERB_ALGO, "DS okay but that DNSKEY size is not supported"); 5015469a995SCy Schubert numsizesupp++; 5025469a995SCy Schubert continue; 5035469a995SCy Schubert } 504b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "DS match digest ok, trying signature"); 505b7579f77SDag-Erling Smørgrav 506b7579f77SDag-Erling Smørgrav /* Otherwise, we have a match! Make sure that the DNSKEY 507b7579f77SDag-Erling Smørgrav * verifies *with this key* */ 508a39a5a69SCy Schubert sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset, 509a39a5a69SCy Schubert i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate); 510b7579f77SDag-Erling Smørgrav if(sec == sec_status_secure) { 511b7579f77SDag-Erling Smørgrav return sec; 512b7579f77SDag-Erling Smørgrav } 513b7579f77SDag-Erling Smørgrav /* If it didn't validate with the DNSKEY, try the next one! */ 514b7579f77SDag-Erling Smørgrav } 5150a92a9fcSCy Schubert if(numsizesupp != 0 || sec == sec_status_indeterminate) { 5165469a995SCy Schubert /* there is a working DS, but that DNSKEY is not supported */ 5175469a995SCy Schubert return sec_status_insecure; 5185469a995SCy Schubert } 519b7c0c8c1SCy Schubert if(numchecked == 0) { 520b7579f77SDag-Erling Smørgrav algo_needs_reason(env, ds_get_key_algo(ds_rrset, ds_idx), 521b7579f77SDag-Erling Smørgrav reason, "no keys have a DS"); 522b7c0c8c1SCy Schubert *nonechecked = 1; 523b7c0c8c1SCy Schubert } else if(numhashok == 0) { 524b7579f77SDag-Erling Smørgrav *reason = "DS hash mismatches key"; 525b7c0c8c1SCy Schubert } else if(!*reason) { 526b7579f77SDag-Erling Smørgrav *reason = "keyset not secured by DNSKEY that matches DS"; 527b7c0c8c1SCy Schubert } 528b7579f77SDag-Erling Smørgrav return sec_status_bogus; 529b7579f77SDag-Erling Smørgrav } 530b7579f77SDag-Erling Smørgrav 531b7579f77SDag-Erling Smørgrav int val_favorite_ds_algo(struct ub_packed_rrset_key* ds_rrset) 532b7579f77SDag-Erling Smørgrav { 533b7579f77SDag-Erling Smørgrav size_t i, num = rrset_get_count(ds_rrset); 534b7579f77SDag-Erling Smørgrav int d, digest_algo = 0; /* DS digest algo 0 is not used. */ 535b7579f77SDag-Erling Smørgrav /* find favorite algo, for now, highest number supported */ 536b7579f77SDag-Erling Smørgrav for(i=0; i<num; i++) { 537b7579f77SDag-Erling Smørgrav if(!ds_digest_algo_is_supported(ds_rrset, i) || 538b7579f77SDag-Erling Smørgrav !ds_key_algo_is_supported(ds_rrset, i)) { 539b7579f77SDag-Erling Smørgrav continue; 540b7579f77SDag-Erling Smørgrav } 541b7579f77SDag-Erling Smørgrav d = ds_get_digest_algo(ds_rrset, i); 542b7579f77SDag-Erling Smørgrav if(d > digest_algo) 543b7579f77SDag-Erling Smørgrav digest_algo = d; 544b7579f77SDag-Erling Smørgrav } 545b7579f77SDag-Erling Smørgrav return digest_algo; 546b7579f77SDag-Erling Smørgrav } 547b7579f77SDag-Erling Smørgrav 548b7579f77SDag-Erling Smørgrav enum sec_status 549b7579f77SDag-Erling Smørgrav val_verify_DNSKEY_with_DS(struct module_env* env, struct val_env* ve, 550b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* dnskey_rrset, 551838e13ceSDag-Erling Smørgrav struct ub_packed_rrset_key* ds_rrset, uint8_t* sigalg, char** reason, 552a39a5a69SCy Schubert sldns_ede_code *reason_bogus, struct module_qstate* qstate) 553b7579f77SDag-Erling Smørgrav { 554b7579f77SDag-Erling Smørgrav /* as long as this is false, we can consider this DS rrset to be 555b7579f77SDag-Erling Smørgrav * equivalent to no DS rrset. */ 556b7c0c8c1SCy Schubert int has_useful_ds = 0, digest_algo, alg, has_algo_refusal = 0, 557b7c0c8c1SCy Schubert nonechecked, has_checked_ds = 0; 558b7579f77SDag-Erling Smørgrav struct algo_needs needs; 559b7579f77SDag-Erling Smørgrav size_t i, num; 560b7579f77SDag-Erling Smørgrav enum sec_status sec; 561b7579f77SDag-Erling Smørgrav 562b7579f77SDag-Erling Smørgrav if(dnskey_rrset->rk.dname_len != ds_rrset->rk.dname_len || 563b7579f77SDag-Erling Smørgrav query_dname_compare(dnskey_rrset->rk.dname, ds_rrset->rk.dname) 564b7579f77SDag-Erling Smørgrav != 0) { 565b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset " 566b7579f77SDag-Erling Smørgrav "by name"); 567b7579f77SDag-Erling Smørgrav *reason = "DNSKEY RRset did not match DS RRset by name"; 568b7579f77SDag-Erling Smørgrav return sec_status_bogus; 569b7579f77SDag-Erling Smørgrav } 570b7579f77SDag-Erling Smørgrav 57165b390aaSDag-Erling Smørgrav if(sigalg) { 57265b390aaSDag-Erling Smørgrav /* harden against algo downgrade is enabled */ 573b7579f77SDag-Erling Smørgrav digest_algo = val_favorite_ds_algo(ds_rrset); 574b7579f77SDag-Erling Smørgrav algo_needs_init_ds(&needs, ds_rrset, digest_algo, sigalg); 57565b390aaSDag-Erling Smørgrav } else { 57665b390aaSDag-Erling Smørgrav /* accept any key algo, any digest algo */ 57765b390aaSDag-Erling Smørgrav digest_algo = -1; 57865b390aaSDag-Erling Smørgrav } 579b7579f77SDag-Erling Smørgrav num = rrset_get_count(ds_rrset); 580b7579f77SDag-Erling Smørgrav for(i=0; i<num; i++) { 581b7579f77SDag-Erling Smørgrav /* Check to see if we can understand this DS. 582b7579f77SDag-Erling Smørgrav * And check it is the strongest digest */ 583b7579f77SDag-Erling Smørgrav if(!ds_digest_algo_is_supported(ds_rrset, i) || 584b7579f77SDag-Erling Smørgrav !ds_key_algo_is_supported(ds_rrset, i) || 58565b390aaSDag-Erling Smørgrav (sigalg && (ds_get_digest_algo(ds_rrset, i) != digest_algo))) { 586b7579f77SDag-Erling Smørgrav continue; 587b7579f77SDag-Erling Smørgrav } 588b7579f77SDag-Erling Smørgrav 5895469a995SCy Schubert sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset, 590b7c0c8c1SCy Schubert ds_rrset, i, reason, reason_bogus, qstate, 591b7c0c8c1SCy Schubert &nonechecked); 592b7c0c8c1SCy Schubert if(sec == sec_status_insecure) { 593b7c0c8c1SCy Schubert /* DNSKEY too large unsupported or algo refused by 594b7c0c8c1SCy Schubert * crypto lib. */ 595b7c0c8c1SCy Schubert has_algo_refusal = 1; 5965469a995SCy Schubert continue; 597b7c0c8c1SCy Schubert } 598b7c0c8c1SCy Schubert if(!nonechecked) 599b7c0c8c1SCy Schubert has_checked_ds = 1; 6005469a995SCy Schubert 601b7579f77SDag-Erling Smørgrav /* Once we see a single DS with a known digestID and 602b7579f77SDag-Erling Smørgrav * algorithm, we cannot return INSECURE (with a 603b7579f77SDag-Erling Smørgrav * "null" KeyEntry). */ 60417d15b25SDag-Erling Smørgrav has_useful_ds = 1; 605b7579f77SDag-Erling Smørgrav 606b7579f77SDag-Erling Smørgrav if(sec == sec_status_secure) { 607b7579f77SDag-Erling Smørgrav if(!sigalg || algo_needs_set_secure(&needs, 608b7579f77SDag-Erling Smørgrav (uint8_t)ds_get_key_algo(ds_rrset, i))) { 609b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "DS matched DNSKEY."); 6105469a995SCy Schubert if(!dnskeyset_size_is_supported(dnskey_rrset)) { 6115469a995SCy Schubert verbose(VERB_ALGO, "DS works, but dnskeyset contain keys that are unsupported, treat as insecure"); 6125469a995SCy Schubert return sec_status_insecure; 6135469a995SCy Schubert } 614b7579f77SDag-Erling Smørgrav return sec_status_secure; 615b7579f77SDag-Erling Smørgrav } 616b7579f77SDag-Erling Smørgrav } else if(sigalg && sec == sec_status_bogus) { 617b7579f77SDag-Erling Smørgrav algo_needs_set_bogus(&needs, 618b7579f77SDag-Erling Smørgrav (uint8_t)ds_get_key_algo(ds_rrset, i)); 619b7579f77SDag-Erling Smørgrav } 620b7579f77SDag-Erling Smørgrav } 621b7579f77SDag-Erling Smørgrav 622b7579f77SDag-Erling Smørgrav /* None of the DS's worked out. */ 623b7579f77SDag-Erling Smørgrav 624b7c0c8c1SCy Schubert /* If none of the DSes have been checked, eg. that means no matches 625b7c0c8c1SCy Schubert * for keytags, and the other dses are all algo_refusal, it is an 626b7c0c8c1SCy Schubert * insecure delegation point, since the only matched DS records 627b7c0c8c1SCy Schubert * have an algo refusal, or are unsupported. */ 628b7c0c8c1SCy Schubert if(has_algo_refusal && !has_checked_ds) { 629b7c0c8c1SCy Schubert verbose(VERB_ALGO, "No supported DS records were found -- " 630b7c0c8c1SCy Schubert "treating as insecure."); 631b7c0c8c1SCy Schubert return sec_status_insecure; 632b7c0c8c1SCy Schubert } 633b7579f77SDag-Erling Smørgrav /* If no DSs were understandable, then this is OK. */ 634b7579f77SDag-Erling Smørgrav if(!has_useful_ds) { 635b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "No usable DS records were found -- " 636b7579f77SDag-Erling Smørgrav "treating as insecure."); 637b7579f77SDag-Erling Smørgrav return sec_status_insecure; 638b7579f77SDag-Erling Smørgrav } 639b7579f77SDag-Erling Smørgrav /* If any were understandable, then it is bad. */ 640b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "Failed to match any usable DS to a DNSKEY."); 641b7579f77SDag-Erling Smørgrav if(sigalg && (alg=algo_needs_missing(&needs)) != 0) { 642b7579f77SDag-Erling Smørgrav algo_needs_reason(env, alg, reason, "missing verification of " 643b7579f77SDag-Erling Smørgrav "DNSKEY signature"); 644b7579f77SDag-Erling Smørgrav } 645b7579f77SDag-Erling Smørgrav return sec_status_bogus; 646b7579f77SDag-Erling Smørgrav } 647b7579f77SDag-Erling Smørgrav 648b7579f77SDag-Erling Smørgrav struct key_entry_key* 649b7579f77SDag-Erling Smørgrav val_verify_new_DNSKEYs(struct regional* region, struct module_env* env, 650b7579f77SDag-Erling Smørgrav struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset, 651838e13ceSDag-Erling Smørgrav struct ub_packed_rrset_key* ds_rrset, int downprot, char** reason, 652a39a5a69SCy Schubert sldns_ede_code *reason_bogus, struct module_qstate* qstate) 653b7579f77SDag-Erling Smørgrav { 654b7579f77SDag-Erling Smørgrav uint8_t sigalg[ALGO_NEEDS_MAX+1]; 655b7579f77SDag-Erling Smørgrav enum sec_status sec = val_verify_DNSKEY_with_DS(env, ve, 656a39a5a69SCy Schubert dnskey_rrset, ds_rrset, downprot?sigalg:NULL, reason, 657a39a5a69SCy Schubert reason_bogus, qstate); 658b7579f77SDag-Erling Smørgrav 659b7579f77SDag-Erling Smørgrav if(sec == sec_status_secure) { 660b7579f77SDag-Erling Smørgrav return key_entry_create_rrset(region, 661b7579f77SDag-Erling Smørgrav ds_rrset->rk.dname, ds_rrset->rk.dname_len, 662b7579f77SDag-Erling Smørgrav ntohs(ds_rrset->rk.rrset_class), dnskey_rrset, 6638f76bb7dSCy Schubert downprot?sigalg:NULL, LDNS_EDE_NONE, NULL, 6648f76bb7dSCy Schubert *env->now); 665b7579f77SDag-Erling Smørgrav } else if(sec == sec_status_insecure) { 666b7579f77SDag-Erling Smørgrav return key_entry_create_null(region, ds_rrset->rk.dname, 667b7579f77SDag-Erling Smørgrav ds_rrset->rk.dname_len, 668b7579f77SDag-Erling Smørgrav ntohs(ds_rrset->rk.rrset_class), 6698f76bb7dSCy Schubert rrset_get_ttl(ds_rrset), *reason_bogus, *reason, 6708f76bb7dSCy Schubert *env->now); 671b7579f77SDag-Erling Smørgrav } 672b7579f77SDag-Erling Smørgrav return key_entry_create_bad(region, ds_rrset->rk.dname, 673b7579f77SDag-Erling Smørgrav ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class), 6748f76bb7dSCy Schubert BOGUS_KEY_TTL, *reason_bogus, *reason, *env->now); 675b7579f77SDag-Erling Smørgrav } 676b7579f77SDag-Erling Smørgrav 677b7579f77SDag-Erling Smørgrav enum sec_status 678b7579f77SDag-Erling Smørgrav val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve, 679b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* dnskey_rrset, 680b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* ta_ds, 681838e13ceSDag-Erling Smørgrav struct ub_packed_rrset_key* ta_dnskey, uint8_t* sigalg, char** reason, 682a39a5a69SCy Schubert sldns_ede_code *reason_bogus, struct module_qstate* qstate) 683b7579f77SDag-Erling Smørgrav { 684b7579f77SDag-Erling Smørgrav /* as long as this is false, we can consider this anchor to be 685b7579f77SDag-Erling Smørgrav * equivalent to no anchor. */ 686b7c0c8c1SCy Schubert int has_useful_ta = 0, digest_algo = 0, alg, has_algo_refusal = 0, 687b7c0c8c1SCy Schubert nonechecked, has_checked_ds = 0; 688b7579f77SDag-Erling Smørgrav struct algo_needs needs; 689b7579f77SDag-Erling Smørgrav size_t i, num; 690b7579f77SDag-Erling Smørgrav enum sec_status sec; 691b7579f77SDag-Erling Smørgrav 692b7579f77SDag-Erling Smørgrav if(ta_ds && (dnskey_rrset->rk.dname_len != ta_ds->rk.dname_len || 693b7579f77SDag-Erling Smørgrav query_dname_compare(dnskey_rrset->rk.dname, ta_ds->rk.dname) 694b7579f77SDag-Erling Smørgrav != 0)) { 695b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset " 696b7579f77SDag-Erling Smørgrav "by name"); 697b7579f77SDag-Erling Smørgrav *reason = "DNSKEY RRset did not match DS RRset by name"; 698a39a5a69SCy Schubert if(reason_bogus) 699a39a5a69SCy Schubert *reason_bogus = LDNS_EDE_DNSKEY_MISSING; 700b7579f77SDag-Erling Smørgrav return sec_status_bogus; 701b7579f77SDag-Erling Smørgrav } 702b7579f77SDag-Erling Smørgrav if(ta_dnskey && (dnskey_rrset->rk.dname_len != ta_dnskey->rk.dname_len 703b7579f77SDag-Erling Smørgrav || query_dname_compare(dnskey_rrset->rk.dname, ta_dnskey->rk.dname) 704b7579f77SDag-Erling Smørgrav != 0)) { 705b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "DNSKEY RRset did not match anchor RRset " 706b7579f77SDag-Erling Smørgrav "by name"); 707b7579f77SDag-Erling Smørgrav *reason = "DNSKEY RRset did not match anchor RRset by name"; 708a39a5a69SCy Schubert if(reason_bogus) 709a39a5a69SCy Schubert *reason_bogus = LDNS_EDE_DNSKEY_MISSING; 710b7579f77SDag-Erling Smørgrav return sec_status_bogus; 711b7579f77SDag-Erling Smørgrav } 712b7579f77SDag-Erling Smørgrav 713b7579f77SDag-Erling Smørgrav if(ta_ds) 714b7579f77SDag-Erling Smørgrav digest_algo = val_favorite_ds_algo(ta_ds); 715b7579f77SDag-Erling Smørgrav if(sigalg) { 716b7579f77SDag-Erling Smørgrav if(ta_ds) 717b7579f77SDag-Erling Smørgrav algo_needs_init_ds(&needs, ta_ds, digest_algo, sigalg); 718b7579f77SDag-Erling Smørgrav else memset(&needs, 0, sizeof(needs)); 719b7579f77SDag-Erling Smørgrav if(ta_dnskey) 720b7579f77SDag-Erling Smørgrav algo_needs_init_dnskey_add(&needs, ta_dnskey, sigalg); 721b7579f77SDag-Erling Smørgrav } 722b7579f77SDag-Erling Smørgrav if(ta_ds) { 723b7579f77SDag-Erling Smørgrav num = rrset_get_count(ta_ds); 724b7579f77SDag-Erling Smørgrav for(i=0; i<num; i++) { 725b7579f77SDag-Erling Smørgrav /* Check to see if we can understand this DS. 726b7579f77SDag-Erling Smørgrav * And check it is the strongest digest */ 727b7579f77SDag-Erling Smørgrav if(!ds_digest_algo_is_supported(ta_ds, i) || 728b7579f77SDag-Erling Smørgrav !ds_key_algo_is_supported(ta_ds, i) || 729b7579f77SDag-Erling Smørgrav ds_get_digest_algo(ta_ds, i) != digest_algo) 730b7579f77SDag-Erling Smørgrav continue; 731b7579f77SDag-Erling Smørgrav 7325469a995SCy Schubert sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset, 733b7c0c8c1SCy Schubert ta_ds, i, reason, reason_bogus, qstate, &nonechecked); 734b7c0c8c1SCy Schubert if(sec == sec_status_insecure) { 735b7c0c8c1SCy Schubert has_algo_refusal = 1; 7365469a995SCy Schubert continue; 737b7c0c8c1SCy Schubert } 738b7c0c8c1SCy Schubert if(!nonechecked) 739b7c0c8c1SCy Schubert has_checked_ds = 1; 7405469a995SCy Schubert 741b7579f77SDag-Erling Smørgrav /* Once we see a single DS with a known digestID and 742b7579f77SDag-Erling Smørgrav * algorithm, we cannot return INSECURE (with a 743b7579f77SDag-Erling Smørgrav * "null" KeyEntry). */ 74417d15b25SDag-Erling Smørgrav has_useful_ta = 1; 745b7579f77SDag-Erling Smørgrav 746b7579f77SDag-Erling Smørgrav if(sec == sec_status_secure) { 747b7579f77SDag-Erling Smørgrav if(!sigalg || algo_needs_set_secure(&needs, 748b7579f77SDag-Erling Smørgrav (uint8_t)ds_get_key_algo(ta_ds, i))) { 749b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "DS matched DNSKEY."); 7505469a995SCy Schubert if(!dnskeyset_size_is_supported(dnskey_rrset)) { 7515469a995SCy Schubert verbose(VERB_ALGO, "trustanchor works, but dnskeyset contain keys that are unsupported, treat as insecure"); 7525469a995SCy Schubert return sec_status_insecure; 7535469a995SCy Schubert } 754b7579f77SDag-Erling Smørgrav return sec_status_secure; 755b7579f77SDag-Erling Smørgrav } 756b7579f77SDag-Erling Smørgrav } else if(sigalg && sec == sec_status_bogus) { 757b7579f77SDag-Erling Smørgrav algo_needs_set_bogus(&needs, 758b7579f77SDag-Erling Smørgrav (uint8_t)ds_get_key_algo(ta_ds, i)); 759b7579f77SDag-Erling Smørgrav } 760b7579f77SDag-Erling Smørgrav } 761b7579f77SDag-Erling Smørgrav } 762b7579f77SDag-Erling Smørgrav 763b7579f77SDag-Erling Smørgrav /* None of the DS's worked out: check the DNSKEYs. */ 764b7579f77SDag-Erling Smørgrav if(ta_dnskey) { 765b7579f77SDag-Erling Smørgrav num = rrset_get_count(ta_dnskey); 766b7579f77SDag-Erling Smørgrav for(i=0; i<num; i++) { 767b7579f77SDag-Erling Smørgrav /* Check to see if we can understand this DNSKEY */ 768b7579f77SDag-Erling Smørgrav if(!dnskey_algo_is_supported(ta_dnskey, i)) 769b7579f77SDag-Erling Smørgrav continue; 7705469a995SCy Schubert if(!dnskey_size_is_supported(ta_dnskey, i)) 7715469a995SCy Schubert continue; 772b7579f77SDag-Erling Smørgrav 773b7579f77SDag-Erling Smørgrav /* we saw a useful TA */ 77417d15b25SDag-Erling Smørgrav has_useful_ta = 1; 775b7579f77SDag-Erling Smørgrav 776b7579f77SDag-Erling Smørgrav sec = dnskey_verify_rrset(env, ve, dnskey_rrset, 7778f76bb7dSCy Schubert ta_dnskey, i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate); 778b7579f77SDag-Erling Smørgrav if(sec == sec_status_secure) { 779b7579f77SDag-Erling Smørgrav if(!sigalg || algo_needs_set_secure(&needs, 780b7579f77SDag-Erling Smørgrav (uint8_t)dnskey_get_algo(ta_dnskey, i))) { 781b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "anchor matched DNSKEY."); 7825469a995SCy Schubert if(!dnskeyset_size_is_supported(dnskey_rrset)) { 7835469a995SCy Schubert verbose(VERB_ALGO, "trustanchor works, but dnskeyset contain keys that are unsupported, treat as insecure"); 7845469a995SCy Schubert return sec_status_insecure; 7855469a995SCy Schubert } 786b7579f77SDag-Erling Smørgrav return sec_status_secure; 787b7579f77SDag-Erling Smørgrav } 788b7579f77SDag-Erling Smørgrav } else if(sigalg && sec == sec_status_bogus) { 789b7579f77SDag-Erling Smørgrav algo_needs_set_bogus(&needs, 790b7579f77SDag-Erling Smørgrav (uint8_t)dnskey_get_algo(ta_dnskey, i)); 791b7579f77SDag-Erling Smørgrav } 792b7579f77SDag-Erling Smørgrav } 793b7579f77SDag-Erling Smørgrav } 794b7579f77SDag-Erling Smørgrav 795b7c0c8c1SCy Schubert /* If none of the DSes have been checked, eg. that means no matches 796b7c0c8c1SCy Schubert * for keytags, and the other dses are all algo_refusal, it is an 797b7c0c8c1SCy Schubert * insecure delegation point, since the only matched DS records 798b7c0c8c1SCy Schubert * have an algo refusal, or are unsupported. */ 799b7c0c8c1SCy Schubert if(has_algo_refusal && !has_checked_ds) { 800b7c0c8c1SCy Schubert verbose(VERB_ALGO, "No supported trust anchors were found -- " 801b7c0c8c1SCy Schubert "treating as insecure."); 802b7c0c8c1SCy Schubert return sec_status_insecure; 803b7c0c8c1SCy Schubert } 804b7579f77SDag-Erling Smørgrav /* If no DSs were understandable, then this is OK. */ 805b7579f77SDag-Erling Smørgrav if(!has_useful_ta) { 806b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "No usable trust anchors were found -- " 807b7579f77SDag-Erling Smørgrav "treating as insecure."); 808b7579f77SDag-Erling Smørgrav return sec_status_insecure; 809b7579f77SDag-Erling Smørgrav } 810b7579f77SDag-Erling Smørgrav /* If any were understandable, then it is bad. */ 811b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "Failed to match any usable anchor to a DNSKEY."); 812b7579f77SDag-Erling Smørgrav if(sigalg && (alg=algo_needs_missing(&needs)) != 0) { 813b7579f77SDag-Erling Smørgrav algo_needs_reason(env, alg, reason, "missing verification of " 814b7579f77SDag-Erling Smørgrav "DNSKEY signature"); 815b7579f77SDag-Erling Smørgrav } 816b7579f77SDag-Erling Smørgrav return sec_status_bogus; 817b7579f77SDag-Erling Smørgrav } 818b7579f77SDag-Erling Smørgrav 819b7579f77SDag-Erling Smørgrav struct key_entry_key* 820b7579f77SDag-Erling Smørgrav val_verify_new_DNSKEYs_with_ta(struct regional* region, struct module_env* env, 821b7579f77SDag-Erling Smørgrav struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset, 822b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* ta_ds_rrset, 823b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* ta_dnskey_rrset, int downprot, 824a39a5a69SCy Schubert char** reason, sldns_ede_code *reason_bogus, struct module_qstate* qstate) 825b7579f77SDag-Erling Smørgrav { 826b7579f77SDag-Erling Smørgrav uint8_t sigalg[ALGO_NEEDS_MAX+1]; 827b7579f77SDag-Erling Smørgrav enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve, 828b7579f77SDag-Erling Smørgrav dnskey_rrset, ta_ds_rrset, ta_dnskey_rrset, 829a39a5a69SCy Schubert downprot?sigalg:NULL, reason, reason_bogus, qstate); 830b7579f77SDag-Erling Smørgrav 831b7579f77SDag-Erling Smørgrav if(sec == sec_status_secure) { 832b7579f77SDag-Erling Smørgrav return key_entry_create_rrset(region, 833b7579f77SDag-Erling Smørgrav dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len, 834b7579f77SDag-Erling Smørgrav ntohs(dnskey_rrset->rk.rrset_class), dnskey_rrset, 8358f76bb7dSCy Schubert downprot?sigalg:NULL, LDNS_EDE_NONE, NULL, *env->now); 836b7579f77SDag-Erling Smørgrav } else if(sec == sec_status_insecure) { 837b7579f77SDag-Erling Smørgrav return key_entry_create_null(region, dnskey_rrset->rk.dname, 838b7579f77SDag-Erling Smørgrav dnskey_rrset->rk.dname_len, 839b7579f77SDag-Erling Smørgrav ntohs(dnskey_rrset->rk.rrset_class), 8408f76bb7dSCy Schubert rrset_get_ttl(dnskey_rrset), *reason_bogus, *reason, 8418f76bb7dSCy Schubert *env->now); 842b7579f77SDag-Erling Smørgrav } 843b7579f77SDag-Erling Smørgrav return key_entry_create_bad(region, dnskey_rrset->rk.dname, 844b7579f77SDag-Erling Smørgrav dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class), 8458f76bb7dSCy Schubert BOGUS_KEY_TTL, *reason_bogus, *reason, *env->now); 846b7579f77SDag-Erling Smørgrav } 847b7579f77SDag-Erling Smørgrav 848b7579f77SDag-Erling Smørgrav int 849b7579f77SDag-Erling Smørgrav val_dsset_isusable(struct ub_packed_rrset_key* ds_rrset) 850b7579f77SDag-Erling Smørgrav { 851b7579f77SDag-Erling Smørgrav size_t i; 852b7579f77SDag-Erling Smørgrav for(i=0; i<rrset_get_count(ds_rrset); i++) { 853b7579f77SDag-Erling Smørgrav if(ds_digest_algo_is_supported(ds_rrset, i) && 854b7579f77SDag-Erling Smørgrav ds_key_algo_is_supported(ds_rrset, i)) 855b7579f77SDag-Erling Smørgrav return 1; 856b7579f77SDag-Erling Smørgrav } 857f61ef7f6SDag-Erling Smørgrav if(verbosity < VERB_ALGO) 858f61ef7f6SDag-Erling Smørgrav return 0; 859f61ef7f6SDag-Erling Smørgrav if(rrset_get_count(ds_rrset) == 0) 860f61ef7f6SDag-Erling Smørgrav verbose(VERB_ALGO, "DS is not usable"); 861f61ef7f6SDag-Erling Smørgrav else { 862f61ef7f6SDag-Erling Smørgrav /* report usability for the first DS RR */ 863f61ef7f6SDag-Erling Smørgrav sldns_lookup_table *lt; 864f61ef7f6SDag-Erling Smørgrav char herr[64], aerr[64]; 865f61ef7f6SDag-Erling Smørgrav lt = sldns_lookup_by_id(sldns_hashes, 8669cf5bc93SCy Schubert (int)ds_get_digest_algo(ds_rrset, 0)); 867f61ef7f6SDag-Erling Smørgrav if(lt) snprintf(herr, sizeof(herr), "%s", lt->name); 868f61ef7f6SDag-Erling Smørgrav else snprintf(herr, sizeof(herr), "%d", 8699cf5bc93SCy Schubert (int)ds_get_digest_algo(ds_rrset, 0)); 870f61ef7f6SDag-Erling Smørgrav lt = sldns_lookup_by_id(sldns_algorithms, 8719cf5bc93SCy Schubert (int)ds_get_key_algo(ds_rrset, 0)); 872f61ef7f6SDag-Erling Smørgrav if(lt) snprintf(aerr, sizeof(aerr), "%s", lt->name); 873f61ef7f6SDag-Erling Smørgrav else snprintf(aerr, sizeof(aerr), "%d", 8749cf5bc93SCy Schubert (int)ds_get_key_algo(ds_rrset, 0)); 875a39a5a69SCy Schubert 876f61ef7f6SDag-Erling Smørgrav verbose(VERB_ALGO, "DS unsupported, hash %s %s, " 877f61ef7f6SDag-Erling Smørgrav "key algorithm %s %s", herr, 878f61ef7f6SDag-Erling Smørgrav (ds_digest_algo_is_supported(ds_rrset, 0)? 879f61ef7f6SDag-Erling Smørgrav "(supported)":"(unsupported)"), aerr, 880f61ef7f6SDag-Erling Smørgrav (ds_key_algo_is_supported(ds_rrset, 0)? 881f61ef7f6SDag-Erling Smørgrav "(supported)":"(unsupported)")); 882f61ef7f6SDag-Erling Smørgrav } 883b7579f77SDag-Erling Smørgrav return 0; 884b7579f77SDag-Erling Smørgrav } 885b7579f77SDag-Erling Smørgrav 886b7579f77SDag-Erling Smørgrav /** get label count for a signature */ 887b7579f77SDag-Erling Smørgrav static uint8_t 888b7579f77SDag-Erling Smørgrav rrsig_get_labcount(struct packed_rrset_data* d, size_t sig) 889b7579f77SDag-Erling Smørgrav { 890b7579f77SDag-Erling Smørgrav if(d->rr_len[sig] < 2+4) 891b7579f77SDag-Erling Smørgrav return 0; /* bad sig length */ 892b7579f77SDag-Erling Smørgrav return d->rr_data[sig][2+3]; 893b7579f77SDag-Erling Smørgrav } 894b7579f77SDag-Erling Smørgrav 895b7579f77SDag-Erling Smørgrav int 89657bddd21SDag-Erling Smørgrav val_rrset_wildcard(struct ub_packed_rrset_key* rrset, uint8_t** wc, 89757bddd21SDag-Erling Smørgrav size_t* wc_len) 898b7579f77SDag-Erling Smørgrav { 899b7579f77SDag-Erling Smørgrav struct packed_rrset_data* d = (struct packed_rrset_data*)rrset-> 900b7579f77SDag-Erling Smørgrav entry.data; 901b7579f77SDag-Erling Smørgrav uint8_t labcount; 902b7579f77SDag-Erling Smørgrav int labdiff; 903b7579f77SDag-Erling Smørgrav uint8_t* wn; 904b7579f77SDag-Erling Smørgrav size_t i, wl; 905b7579f77SDag-Erling Smørgrav if(d->rrsig_count == 0) { 906b7579f77SDag-Erling Smørgrav return 1; 907b7579f77SDag-Erling Smørgrav } 908b7579f77SDag-Erling Smørgrav labcount = rrsig_get_labcount(d, d->count + 0); 909b7579f77SDag-Erling Smørgrav /* check rest of signatures identical */ 910b7579f77SDag-Erling Smørgrav for(i=1; i<d->rrsig_count; i++) { 911b7579f77SDag-Erling Smørgrav if(labcount != rrsig_get_labcount(d, d->count + i)) { 912b7579f77SDag-Erling Smørgrav return 0; 913b7579f77SDag-Erling Smørgrav } 914b7579f77SDag-Erling Smørgrav } 915b7579f77SDag-Erling Smørgrav /* OK the rrsigs check out */ 916b7579f77SDag-Erling Smørgrav /* if the RRSIG label count is shorter than the number of actual 917b7579f77SDag-Erling Smørgrav * labels, then this rrset was synthesized from a wildcard. 918b7579f77SDag-Erling Smørgrav * Note that the RRSIG label count doesn't count the root label. */ 919b7579f77SDag-Erling Smørgrav wn = rrset->rk.dname; 920b7579f77SDag-Erling Smørgrav wl = rrset->rk.dname_len; 921b7579f77SDag-Erling Smørgrav /* skip a leading wildcard label in the dname (RFC4035 2.2) */ 922b7579f77SDag-Erling Smørgrav if(dname_is_wild(wn)) { 923b7579f77SDag-Erling Smørgrav wn += 2; 924b7579f77SDag-Erling Smørgrav wl -= 2; 925b7579f77SDag-Erling Smørgrav } 926b7579f77SDag-Erling Smørgrav labdiff = (dname_count_labels(wn) - 1) - (int)labcount; 927b7579f77SDag-Erling Smørgrav if(labdiff > 0) { 928b7579f77SDag-Erling Smørgrav *wc = wn; 929b7579f77SDag-Erling Smørgrav dname_remove_labels(wc, &wl, labdiff); 93057bddd21SDag-Erling Smørgrav *wc_len = wl; 931b7579f77SDag-Erling Smørgrav return 1; 932b7579f77SDag-Erling Smørgrav } 933b7579f77SDag-Erling Smørgrav return 1; 934b7579f77SDag-Erling Smørgrav } 935b7579f77SDag-Erling Smørgrav 936b7579f77SDag-Erling Smørgrav int 937b7579f77SDag-Erling Smørgrav val_chase_cname(struct query_info* qchase, struct reply_info* rep, 938b7579f77SDag-Erling Smørgrav size_t* cname_skip) { 939b7579f77SDag-Erling Smørgrav size_t i; 940b7579f77SDag-Erling Smørgrav /* skip any DNAMEs, go to the CNAME for next part */ 941b7579f77SDag-Erling Smørgrav for(i = *cname_skip; i < rep->an_numrrsets; i++) { 942b7579f77SDag-Erling Smørgrav if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME && 943b7579f77SDag-Erling Smørgrav query_dname_compare(qchase->qname, rep->rrsets[i]-> 944b7579f77SDag-Erling Smørgrav rk.dname) == 0) { 945b7579f77SDag-Erling Smørgrav qchase->qname = NULL; 946b7579f77SDag-Erling Smørgrav get_cname_target(rep->rrsets[i], &qchase->qname, 947b7579f77SDag-Erling Smørgrav &qchase->qname_len); 948b7579f77SDag-Erling Smørgrav if(!qchase->qname) 949b7579f77SDag-Erling Smørgrav return 0; /* bad CNAME rdata */ 950b7579f77SDag-Erling Smørgrav (*cname_skip) = i+1; 951b7579f77SDag-Erling Smørgrav return 1; 952b7579f77SDag-Erling Smørgrav } 953b7579f77SDag-Erling Smørgrav } 954b7579f77SDag-Erling Smørgrav return 0; /* CNAME classified but no matching CNAME ?! */ 955b7579f77SDag-Erling Smørgrav } 956b7579f77SDag-Erling Smørgrav 957b7579f77SDag-Erling Smørgrav /** see if rrset has signer name as one of the rrsig signers */ 958b7579f77SDag-Erling Smørgrav static int 959b7579f77SDag-Erling Smørgrav rrset_has_signer(struct ub_packed_rrset_key* rrset, uint8_t* name, size_t len) 960b7579f77SDag-Erling Smørgrav { 961b7579f77SDag-Erling Smørgrav struct packed_rrset_data* d = (struct packed_rrset_data*)rrset-> 962b7579f77SDag-Erling Smørgrav entry.data; 963b7579f77SDag-Erling Smørgrav size_t i; 964b7579f77SDag-Erling Smørgrav for(i = d->count; i< d->count+d->rrsig_count; i++) { 965b7579f77SDag-Erling Smørgrav if(d->rr_len[i] > 2+18+len) { 966b7579f77SDag-Erling Smørgrav /* at least rdatalen + signature + signame (+1 sig)*/ 96717d15b25SDag-Erling Smørgrav if(!dname_valid(d->rr_data[i]+2+18, d->rr_len[i]-2-18)) 96817d15b25SDag-Erling Smørgrav continue; 969b7579f77SDag-Erling Smørgrav if(query_dname_compare(name, d->rr_data[i]+2+18) == 0) 970b7579f77SDag-Erling Smørgrav { 971b7579f77SDag-Erling Smørgrav return 1; 972b7579f77SDag-Erling Smørgrav } 973b7579f77SDag-Erling Smørgrav } 974b7579f77SDag-Erling Smørgrav } 975b7579f77SDag-Erling Smørgrav return 0; 976b7579f77SDag-Erling Smørgrav } 977b7579f77SDag-Erling Smørgrav 978b7579f77SDag-Erling Smørgrav void 979b7579f77SDag-Erling Smørgrav val_fill_reply(struct reply_info* chase, struct reply_info* orig, 980b7579f77SDag-Erling Smørgrav size_t skip, uint8_t* name, size_t len, uint8_t* signer) 981b7579f77SDag-Erling Smørgrav { 982b7579f77SDag-Erling Smørgrav size_t i; 983b7579f77SDag-Erling Smørgrav int seen_dname = 0; 984b7579f77SDag-Erling Smørgrav chase->rrset_count = 0; 985b7579f77SDag-Erling Smørgrav chase->an_numrrsets = 0; 986b7579f77SDag-Erling Smørgrav chase->ns_numrrsets = 0; 987b7579f77SDag-Erling Smørgrav chase->ar_numrrsets = 0; 988b7579f77SDag-Erling Smørgrav /* ANSWER section */ 989b7579f77SDag-Erling Smørgrav for(i=skip; i<orig->an_numrrsets; i++) { 990b7579f77SDag-Erling Smørgrav if(!signer) { 991b7579f77SDag-Erling Smørgrav if(query_dname_compare(name, 992b7579f77SDag-Erling Smørgrav orig->rrsets[i]->rk.dname) == 0) 993b7579f77SDag-Erling Smørgrav chase->rrsets[chase->an_numrrsets++] = 994b7579f77SDag-Erling Smørgrav orig->rrsets[i]; 995b7579f77SDag-Erling Smørgrav } else if(seen_dname && ntohs(orig->rrsets[i]->rk.type) == 996b7579f77SDag-Erling Smørgrav LDNS_RR_TYPE_CNAME) { 997b7579f77SDag-Erling Smørgrav chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i]; 998b7579f77SDag-Erling Smørgrav seen_dname = 0; 999b7579f77SDag-Erling Smørgrav } else if(rrset_has_signer(orig->rrsets[i], name, len)) { 1000b7579f77SDag-Erling Smørgrav chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i]; 1001b7579f77SDag-Erling Smørgrav if(ntohs(orig->rrsets[i]->rk.type) == 1002b7579f77SDag-Erling Smørgrav LDNS_RR_TYPE_DNAME) { 1003b7579f77SDag-Erling Smørgrav seen_dname = 1; 1004b7579f77SDag-Erling Smørgrav } 1005b7579f77SDag-Erling Smørgrav } 1006b7579f77SDag-Erling Smørgrav } 1007b7579f77SDag-Erling Smørgrav /* AUTHORITY section */ 1008b7579f77SDag-Erling Smørgrav for(i = (skip > orig->an_numrrsets)?skip:orig->an_numrrsets; 1009b7579f77SDag-Erling Smørgrav i<orig->an_numrrsets+orig->ns_numrrsets; 1010b7579f77SDag-Erling Smørgrav i++) { 1011b7579f77SDag-Erling Smørgrav if(!signer) { 1012b7579f77SDag-Erling Smørgrav if(query_dname_compare(name, 1013b7579f77SDag-Erling Smørgrav orig->rrsets[i]->rk.dname) == 0) 1014b7579f77SDag-Erling Smørgrav chase->rrsets[chase->an_numrrsets+ 1015b7579f77SDag-Erling Smørgrav chase->ns_numrrsets++] = orig->rrsets[i]; 1016b7579f77SDag-Erling Smørgrav } else if(rrset_has_signer(orig->rrsets[i], name, len)) { 1017b7579f77SDag-Erling Smørgrav chase->rrsets[chase->an_numrrsets+ 1018b7579f77SDag-Erling Smørgrav chase->ns_numrrsets++] = orig->rrsets[i]; 1019b7579f77SDag-Erling Smørgrav } 1020b7579f77SDag-Erling Smørgrav } 1021b7579f77SDag-Erling Smørgrav /* ADDITIONAL section */ 1022b7579f77SDag-Erling Smørgrav for(i= (skip>orig->an_numrrsets+orig->ns_numrrsets)? 1023b7579f77SDag-Erling Smørgrav skip:orig->an_numrrsets+orig->ns_numrrsets; 1024b7579f77SDag-Erling Smørgrav i<orig->rrset_count; i++) { 1025b7579f77SDag-Erling Smørgrav if(!signer) { 1026b7579f77SDag-Erling Smørgrav if(query_dname_compare(name, 1027b7579f77SDag-Erling Smørgrav orig->rrsets[i]->rk.dname) == 0) 1028b7579f77SDag-Erling Smørgrav chase->rrsets[chase->an_numrrsets 1029b7579f77SDag-Erling Smørgrav +orig->ns_numrrsets+chase->ar_numrrsets++] 1030b7579f77SDag-Erling Smørgrav = orig->rrsets[i]; 1031b7579f77SDag-Erling Smørgrav } else if(rrset_has_signer(orig->rrsets[i], name, len)) { 1032b7579f77SDag-Erling Smørgrav chase->rrsets[chase->an_numrrsets+orig->ns_numrrsets+ 1033b7579f77SDag-Erling Smørgrav chase->ar_numrrsets++] = orig->rrsets[i]; 1034b7579f77SDag-Erling Smørgrav } 1035b7579f77SDag-Erling Smørgrav } 1036b7579f77SDag-Erling Smørgrav chase->rrset_count = chase->an_numrrsets + chase->ns_numrrsets + 1037b7579f77SDag-Erling Smørgrav chase->ar_numrrsets; 1038b7579f77SDag-Erling Smørgrav } 1039b7579f77SDag-Erling Smørgrav 10406480faa8SDag-Erling Smørgrav void val_reply_remove_auth(struct reply_info* rep, size_t index) 10416480faa8SDag-Erling Smørgrav { 10426480faa8SDag-Erling Smørgrav log_assert(index < rep->rrset_count); 10436480faa8SDag-Erling Smørgrav log_assert(index >= rep->an_numrrsets); 10446480faa8SDag-Erling Smørgrav log_assert(index < rep->an_numrrsets+rep->ns_numrrsets); 10456480faa8SDag-Erling Smørgrav memmove(rep->rrsets+index, rep->rrsets+index+1, 10466480faa8SDag-Erling Smørgrav sizeof(struct ub_packed_rrset_key*)* 10476480faa8SDag-Erling Smørgrav (rep->rrset_count - index - 1)); 10486480faa8SDag-Erling Smørgrav rep->ns_numrrsets--; 10496480faa8SDag-Erling Smørgrav rep->rrset_count--; 10506480faa8SDag-Erling Smørgrav } 10516480faa8SDag-Erling Smørgrav 1052b7579f77SDag-Erling Smørgrav void 1053c7f4d7adSDag-Erling Smørgrav val_check_nonsecure(struct module_env* env, struct reply_info* rep) 1054b7579f77SDag-Erling Smørgrav { 1055b7579f77SDag-Erling Smørgrav size_t i; 1056b7579f77SDag-Erling Smørgrav /* authority */ 1057b7579f77SDag-Erling Smørgrav for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) { 1058b7579f77SDag-Erling Smørgrav if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data) 1059b7579f77SDag-Erling Smørgrav ->security != sec_status_secure) { 1060b7579f77SDag-Erling Smørgrav /* because we want to return the authentic original 1061b7579f77SDag-Erling Smørgrav * message when presented with CD-flagged queries, 1062b7579f77SDag-Erling Smørgrav * we need to preserve AUTHORITY section data. 1063b7579f77SDag-Erling Smørgrav * However, this rrset is not signed or signed 1064b7579f77SDag-Erling Smørgrav * with the wrong keys. Validation has tried to 1065b7579f77SDag-Erling Smørgrav * verify this rrset with the keysets of import. 1066b7579f77SDag-Erling Smørgrav * But this rrset did not verify. 1067b7579f77SDag-Erling Smørgrav * Therefore the message is bogus. 1068b7579f77SDag-Erling Smørgrav */ 1069b7579f77SDag-Erling Smørgrav 1070971980c3SDag-Erling Smørgrav /* check if authority has an NS record 1071b7579f77SDag-Erling Smørgrav * which is bad, and there is an answer section with 1072b7579f77SDag-Erling Smørgrav * data. In that case, delete NS and additional to 1073b7579f77SDag-Erling Smørgrav * be lenient and make a minimal response */ 1074971980c3SDag-Erling Smørgrav if(rep->an_numrrsets != 0 && 1075b7579f77SDag-Erling Smørgrav ntohs(rep->rrsets[i]->rk.type) 1076b7579f77SDag-Erling Smørgrav == LDNS_RR_TYPE_NS) { 1077b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "truncate to minimal"); 1078b7579f77SDag-Erling Smørgrav rep->ar_numrrsets = 0; 1079971980c3SDag-Erling Smørgrav rep->rrset_count = rep->an_numrrsets + 1080971980c3SDag-Erling Smørgrav rep->ns_numrrsets; 1081971980c3SDag-Erling Smørgrav /* remove this unneeded authority rrset */ 1082971980c3SDag-Erling Smørgrav memmove(rep->rrsets+i, rep->rrsets+i+1, 1083971980c3SDag-Erling Smørgrav sizeof(struct ub_packed_rrset_key*)* 1084971980c3SDag-Erling Smørgrav (rep->rrset_count - i - 1)); 1085971980c3SDag-Erling Smørgrav rep->ns_numrrsets--; 1086971980c3SDag-Erling Smørgrav rep->rrset_count--; 1087971980c3SDag-Erling Smørgrav i--; 1088b7579f77SDag-Erling Smørgrav return; 1089b7579f77SDag-Erling Smørgrav } 1090b7579f77SDag-Erling Smørgrav 1091b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_QUERY, "message is bogus, " 1092b7579f77SDag-Erling Smørgrav "non secure rrset", 1093b7579f77SDag-Erling Smørgrav rep->rrsets[i]->rk.dname, 1094b7579f77SDag-Erling Smørgrav ntohs(rep->rrsets[i]->rk.type), 1095b7579f77SDag-Erling Smørgrav ntohs(rep->rrsets[i]->rk.rrset_class)); 1096b7579f77SDag-Erling Smørgrav rep->security = sec_status_bogus; 1097b7579f77SDag-Erling Smørgrav return; 1098b7579f77SDag-Erling Smørgrav } 1099b7579f77SDag-Erling Smørgrav } 1100b7579f77SDag-Erling Smørgrav /* additional */ 1101c7f4d7adSDag-Erling Smørgrav if(!env->cfg->val_clean_additional) 1102b7579f77SDag-Erling Smørgrav return; 1103b7579f77SDag-Erling Smørgrav for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) { 1104b7579f77SDag-Erling Smørgrav if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data) 1105b7579f77SDag-Erling Smørgrav ->security != sec_status_secure) { 1106b7579f77SDag-Erling Smørgrav /* This does not cause message invalidation. It was 1107b7579f77SDag-Erling Smørgrav * simply unsigned data in the additional. The 1108b7579f77SDag-Erling Smørgrav * RRSIG must have been truncated off the message. 1109b7579f77SDag-Erling Smørgrav * 1110b7579f77SDag-Erling Smørgrav * However, we do not want to return possible bogus 1111b7579f77SDag-Erling Smørgrav * data to clients that rely on this service for 1112b7579f77SDag-Erling Smørgrav * their authentication. 1113b7579f77SDag-Erling Smørgrav */ 1114b7579f77SDag-Erling Smørgrav /* remove this unneeded additional rrset */ 1115b7579f77SDag-Erling Smørgrav memmove(rep->rrsets+i, rep->rrsets+i+1, 1116b7579f77SDag-Erling Smørgrav sizeof(struct ub_packed_rrset_key*)* 1117b7579f77SDag-Erling Smørgrav (rep->rrset_count - i - 1)); 1118b7579f77SDag-Erling Smørgrav rep->ar_numrrsets--; 1119b7579f77SDag-Erling Smørgrav rep->rrset_count--; 1120b7579f77SDag-Erling Smørgrav i--; 1121b7579f77SDag-Erling Smørgrav } 1122b7579f77SDag-Erling Smørgrav } 1123b7579f77SDag-Erling Smørgrav } 1124b7579f77SDag-Erling Smørgrav 1125b7579f77SDag-Erling Smørgrav /** check no anchor and unlock */ 1126b7579f77SDag-Erling Smørgrav static int 1127b7579f77SDag-Erling Smørgrav check_no_anchor(struct val_anchors* anchors, uint8_t* nm, size_t l, uint16_t c) 1128b7579f77SDag-Erling Smørgrav { 1129b7579f77SDag-Erling Smørgrav struct trust_anchor* ta; 1130b7579f77SDag-Erling Smørgrav if((ta=anchors_lookup(anchors, nm, l, c))) { 1131b7579f77SDag-Erling Smørgrav lock_basic_unlock(&ta->lock); 1132b7579f77SDag-Erling Smørgrav } 1133b7579f77SDag-Erling Smørgrav return !ta; 1134b7579f77SDag-Erling Smørgrav } 1135b7579f77SDag-Erling Smørgrav 1136b7579f77SDag-Erling Smørgrav void 1137b7579f77SDag-Erling Smørgrav val_mark_indeterminate(struct reply_info* rep, struct val_anchors* anchors, 1138b7579f77SDag-Erling Smørgrav struct rrset_cache* r, struct module_env* env) 1139b7579f77SDag-Erling Smørgrav { 1140b7579f77SDag-Erling Smørgrav size_t i; 1141b7579f77SDag-Erling Smørgrav struct packed_rrset_data* d; 1142b7579f77SDag-Erling Smørgrav for(i=0; i<rep->rrset_count; i++) { 1143b7579f77SDag-Erling Smørgrav d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data; 1144b7579f77SDag-Erling Smørgrav if(d->security == sec_status_unchecked && 1145b7579f77SDag-Erling Smørgrav check_no_anchor(anchors, rep->rrsets[i]->rk.dname, 1146b7579f77SDag-Erling Smørgrav rep->rrsets[i]->rk.dname_len, 1147b7579f77SDag-Erling Smørgrav ntohs(rep->rrsets[i]->rk.rrset_class))) 1148b7579f77SDag-Erling Smørgrav { 1149b7579f77SDag-Erling Smørgrav /* mark as indeterminate */ 1150b7579f77SDag-Erling Smørgrav d->security = sec_status_indeterminate; 1151b7579f77SDag-Erling Smørgrav rrset_update_sec_status(r, rep->rrsets[i], *env->now); 1152b7579f77SDag-Erling Smørgrav } 1153b7579f77SDag-Erling Smørgrav } 1154b7579f77SDag-Erling Smørgrav } 1155b7579f77SDag-Erling Smørgrav 1156b7579f77SDag-Erling Smørgrav void 1157b7579f77SDag-Erling Smørgrav val_mark_insecure(struct reply_info* rep, uint8_t* kname, 1158b7579f77SDag-Erling Smørgrav struct rrset_cache* r, struct module_env* env) 1159b7579f77SDag-Erling Smørgrav { 1160b7579f77SDag-Erling Smørgrav size_t i; 1161b7579f77SDag-Erling Smørgrav struct packed_rrset_data* d; 1162b7579f77SDag-Erling Smørgrav for(i=0; i<rep->rrset_count; i++) { 1163b7579f77SDag-Erling Smørgrav d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data; 1164b7579f77SDag-Erling Smørgrav if(d->security == sec_status_unchecked && 1165b7579f77SDag-Erling Smørgrav dname_subdomain_c(rep->rrsets[i]->rk.dname, kname)) { 1166b7579f77SDag-Erling Smørgrav /* mark as insecure */ 1167b7579f77SDag-Erling Smørgrav d->security = sec_status_insecure; 1168b7579f77SDag-Erling Smørgrav rrset_update_sec_status(r, rep->rrsets[i], *env->now); 1169b7579f77SDag-Erling Smørgrav } 1170b7579f77SDag-Erling Smørgrav } 1171b7579f77SDag-Erling Smørgrav } 1172b7579f77SDag-Erling Smørgrav 1173b7579f77SDag-Erling Smørgrav size_t 1174b7579f77SDag-Erling Smørgrav val_next_unchecked(struct reply_info* rep, size_t skip) 1175b7579f77SDag-Erling Smørgrav { 1176b7579f77SDag-Erling Smørgrav size_t i; 1177b7579f77SDag-Erling Smørgrav struct packed_rrset_data* d; 1178b7579f77SDag-Erling Smørgrav for(i=skip+1; i<rep->rrset_count; i++) { 1179b7579f77SDag-Erling Smørgrav d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data; 1180b7579f77SDag-Erling Smørgrav if(d->security == sec_status_unchecked) { 1181b7579f77SDag-Erling Smørgrav return i; 1182b7579f77SDag-Erling Smørgrav } 1183b7579f77SDag-Erling Smørgrav } 1184b7579f77SDag-Erling Smørgrav return rep->rrset_count; 1185b7579f77SDag-Erling Smørgrav } 1186b7579f77SDag-Erling Smørgrav 1187b7579f77SDag-Erling Smørgrav const char* 1188b7579f77SDag-Erling Smørgrav val_classification_to_string(enum val_classification subtype) 1189b7579f77SDag-Erling Smørgrav { 1190b7579f77SDag-Erling Smørgrav switch(subtype) { 1191b7579f77SDag-Erling Smørgrav case VAL_CLASS_UNTYPED: return "untyped"; 1192b7579f77SDag-Erling Smørgrav case VAL_CLASS_UNKNOWN: return "unknown"; 1193b7579f77SDag-Erling Smørgrav case VAL_CLASS_POSITIVE: return "positive"; 1194b7579f77SDag-Erling Smørgrav case VAL_CLASS_CNAME: return "cname"; 1195b7579f77SDag-Erling Smørgrav case VAL_CLASS_NODATA: return "nodata"; 1196b7579f77SDag-Erling Smørgrav case VAL_CLASS_NAMEERROR: return "nameerror"; 1197b7579f77SDag-Erling Smørgrav case VAL_CLASS_CNAMENOANSWER: return "cnamenoanswer"; 1198b7579f77SDag-Erling Smørgrav case VAL_CLASS_REFERRAL: return "referral"; 1199b7579f77SDag-Erling Smørgrav case VAL_CLASS_ANY: return "qtype_any"; 1200b7579f77SDag-Erling Smørgrav default: 1201b7579f77SDag-Erling Smørgrav return "bad_val_classification"; 1202b7579f77SDag-Erling Smørgrav } 1203b7579f77SDag-Erling Smørgrav } 1204b7579f77SDag-Erling Smørgrav 1205b7579f77SDag-Erling Smørgrav /** log a sock_list entry */ 1206b7579f77SDag-Erling Smørgrav static void 1207b7579f77SDag-Erling Smørgrav sock_list_logentry(enum verbosity_value v, const char* s, struct sock_list* p) 1208b7579f77SDag-Erling Smørgrav { 1209b7579f77SDag-Erling Smørgrav if(p->len) 1210b7579f77SDag-Erling Smørgrav log_addr(v, s, &p->addr, p->len); 1211b7579f77SDag-Erling Smørgrav else verbose(v, "%s cache", s); 1212b7579f77SDag-Erling Smørgrav } 1213b7579f77SDag-Erling Smørgrav 1214b7579f77SDag-Erling Smørgrav void val_blacklist(struct sock_list** blacklist, struct regional* region, 1215b7579f77SDag-Erling Smørgrav struct sock_list* origin, int cross) 1216b7579f77SDag-Erling Smørgrav { 1217b7579f77SDag-Erling Smørgrav /* debug printout */ 1218b7579f77SDag-Erling Smørgrav if(verbosity >= VERB_ALGO) { 1219b7579f77SDag-Erling Smørgrav struct sock_list* p; 1220b7579f77SDag-Erling Smørgrav for(p=*blacklist; p; p=p->next) 1221b7579f77SDag-Erling Smørgrav sock_list_logentry(VERB_ALGO, "blacklist", p); 1222b7579f77SDag-Erling Smørgrav if(!origin) 1223b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "blacklist add: cache"); 1224b7579f77SDag-Erling Smørgrav for(p=origin; p; p=p->next) 1225b7579f77SDag-Erling Smørgrav sock_list_logentry(VERB_ALGO, "blacklist add", p); 1226b7579f77SDag-Erling Smørgrav } 1227b7579f77SDag-Erling Smørgrav /* blacklist the IPs or the cache */ 1228b7579f77SDag-Erling Smørgrav if(!origin) { 1229b7579f77SDag-Erling Smørgrav /* only add if nothing there. anything else also stops cache*/ 1230b7579f77SDag-Erling Smørgrav if(!*blacklist) 1231b7579f77SDag-Erling Smørgrav sock_list_insert(blacklist, NULL, 0, region); 1232b7579f77SDag-Erling Smørgrav } else if(!cross) 1233b7579f77SDag-Erling Smørgrav sock_list_prepend(blacklist, origin); 1234b7579f77SDag-Erling Smørgrav else sock_list_merge(blacklist, region, origin); 1235b7579f77SDag-Erling Smørgrav } 1236b7579f77SDag-Erling Smørgrav 1237b7579f77SDag-Erling Smørgrav int val_has_signed_nsecs(struct reply_info* rep, char** reason) 1238b7579f77SDag-Erling Smørgrav { 1239b7579f77SDag-Erling Smørgrav size_t i, num_nsec = 0, num_nsec3 = 0; 1240b7579f77SDag-Erling Smørgrav struct packed_rrset_data* d; 1241b7579f77SDag-Erling Smørgrav for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) { 1242b7579f77SDag-Erling Smørgrav if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC)) 1243b7579f77SDag-Erling Smørgrav num_nsec++; 1244b7579f77SDag-Erling Smørgrav else if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC3)) 1245b7579f77SDag-Erling Smørgrav num_nsec3++; 1246b7579f77SDag-Erling Smørgrav else continue; 1247b7579f77SDag-Erling Smørgrav d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data; 1248b7579f77SDag-Erling Smørgrav if(d && d->rrsig_count != 0) { 1249b7579f77SDag-Erling Smørgrav return 1; 1250b7579f77SDag-Erling Smørgrav } 1251b7579f77SDag-Erling Smørgrav } 1252b7579f77SDag-Erling Smørgrav if(num_nsec == 0 && num_nsec3 == 0) 1253b7579f77SDag-Erling Smørgrav *reason = "no DNSSEC records"; 1254b7579f77SDag-Erling Smørgrav else if(num_nsec != 0) 1255b7579f77SDag-Erling Smørgrav *reason = "no signatures over NSECs"; 1256b7579f77SDag-Erling Smørgrav else *reason = "no signatures over NSEC3s"; 1257b7579f77SDag-Erling Smørgrav return 0; 1258b7579f77SDag-Erling Smørgrav } 1259b7579f77SDag-Erling Smørgrav 1260b7579f77SDag-Erling Smørgrav struct dns_msg* 1261b7579f77SDag-Erling Smørgrav val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c, 1262b7579f77SDag-Erling Smørgrav struct regional* region, uint8_t* topname) 1263b7579f77SDag-Erling Smørgrav { 1264b7579f77SDag-Erling Smørgrav struct dns_msg* msg; 1265b7579f77SDag-Erling Smørgrav struct query_info qinfo; 1266b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key *rrset = rrset_cache_lookup( 1267b7579f77SDag-Erling Smørgrav env->rrset_cache, nm, nmlen, LDNS_RR_TYPE_DS, c, 0, 1268b7579f77SDag-Erling Smørgrav *env->now, 0); 1269b7579f77SDag-Erling Smørgrav if(rrset) { 1270b7579f77SDag-Erling Smørgrav /* DS rrset exists. Return it to the validator immediately*/ 1271b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* copy = packed_rrset_copy_region( 1272b7579f77SDag-Erling Smørgrav rrset, region, *env->now); 1273b7579f77SDag-Erling Smørgrav lock_rw_unlock(&rrset->entry.lock); 1274b7579f77SDag-Erling Smørgrav if(!copy) 1275b7579f77SDag-Erling Smørgrav return NULL; 1276b7579f77SDag-Erling Smørgrav msg = dns_msg_create(nm, nmlen, LDNS_RR_TYPE_DS, c, region, 1); 1277b7579f77SDag-Erling Smørgrav if(!msg) 1278b7579f77SDag-Erling Smørgrav return NULL; 1279b7579f77SDag-Erling Smørgrav msg->rep->rrsets[0] = copy; 1280b7579f77SDag-Erling Smørgrav msg->rep->rrset_count++; 1281b7579f77SDag-Erling Smørgrav msg->rep->an_numrrsets++; 1282b7579f77SDag-Erling Smørgrav return msg; 1283b7579f77SDag-Erling Smørgrav } 1284b7579f77SDag-Erling Smørgrav /* lookup in rrset and negative cache for NSEC/NSEC3 */ 1285b7579f77SDag-Erling Smørgrav qinfo.qname = nm; 1286b7579f77SDag-Erling Smørgrav qinfo.qname_len = nmlen; 1287b7579f77SDag-Erling Smørgrav qinfo.qtype = LDNS_RR_TYPE_DS; 1288b7579f77SDag-Erling Smørgrav qinfo.qclass = c; 1289bc892140SDag-Erling Smørgrav qinfo.local_alias = NULL; 1290b7579f77SDag-Erling Smørgrav /* do not add SOA to reply message, it is going to be used internal */ 1291b7579f77SDag-Erling Smørgrav msg = val_neg_getmsg(env->neg_cache, &qinfo, region, env->rrset_cache, 129257bddd21SDag-Erling Smørgrav env->scratch_buffer, *env->now, 0, topname, env->cfg); 1293b7579f77SDag-Erling Smørgrav return msg; 1294b7579f77SDag-Erling Smørgrav } 1295