1b7579f77SDag-Erling Smørgrav /* 2b7579f77SDag-Erling Smørgrav * validator/validator.c - secure validator DNS query response module 3b7579f77SDag-Erling Smørgrav * 4b7579f77SDag-Erling Smørgrav * Copyright (c) 2007, NLnet Labs. All rights reserved. 5b7579f77SDag-Erling Smørgrav * 6b7579f77SDag-Erling Smørgrav * This software is open source. 7b7579f77SDag-Erling Smørgrav * 8b7579f77SDag-Erling Smørgrav * Redistribution and use in source and binary forms, with or without 9b7579f77SDag-Erling Smørgrav * modification, are permitted provided that the following conditions 10b7579f77SDag-Erling Smørgrav * are met: 11b7579f77SDag-Erling Smørgrav * 12b7579f77SDag-Erling Smørgrav * Redistributions of source code must retain the above copyright notice, 13b7579f77SDag-Erling Smørgrav * this list of conditions and the following disclaimer. 14b7579f77SDag-Erling Smørgrav * 15b7579f77SDag-Erling Smørgrav * Redistributions in binary form must reproduce the above copyright notice, 16b7579f77SDag-Erling Smørgrav * this list of conditions and the following disclaimer in the documentation 17b7579f77SDag-Erling Smørgrav * and/or other materials provided with the distribution. 18b7579f77SDag-Erling Smørgrav * 19b7579f77SDag-Erling Smørgrav * Neither the name of the NLNET LABS nor the names of its contributors may 20b7579f77SDag-Erling Smørgrav * be used to endorse or promote products derived from this software without 21b7579f77SDag-Erling Smørgrav * specific prior written permission. 22b7579f77SDag-Erling Smørgrav * 23b7579f77SDag-Erling Smørgrav * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 2417d15b25SDag-Erling Smørgrav * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 2517d15b25SDag-Erling Smørgrav * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 2617d15b25SDag-Erling Smørgrav * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 2717d15b25SDag-Erling Smørgrav * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 2817d15b25SDag-Erling Smørgrav * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 2917d15b25SDag-Erling Smørgrav * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 3017d15b25SDag-Erling Smørgrav * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 3117d15b25SDag-Erling Smørgrav * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 3217d15b25SDag-Erling Smørgrav * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 3317d15b25SDag-Erling Smørgrav * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34b7579f77SDag-Erling Smørgrav */ 35b7579f77SDag-Erling Smørgrav 36b7579f77SDag-Erling Smørgrav /** 37b7579f77SDag-Erling Smørgrav * \file 38b7579f77SDag-Erling Smørgrav * 39b7579f77SDag-Erling Smørgrav * This file contains a module that performs validation of DNS queries. 40b7579f77SDag-Erling Smørgrav * According to RFC 4034. 41b7579f77SDag-Erling Smørgrav */ 42b7579f77SDag-Erling Smørgrav #include "config.h" 430fb34990SDag-Erling Smørgrav #include <ctype.h> 44b7579f77SDag-Erling Smørgrav #include "validator/validator.h" 45b7579f77SDag-Erling Smørgrav #include "validator/val_anchor.h" 46b7579f77SDag-Erling Smørgrav #include "validator/val_kcache.h" 47b7579f77SDag-Erling Smørgrav #include "validator/val_kentry.h" 48b7579f77SDag-Erling Smørgrav #include "validator/val_utils.h" 49b7579f77SDag-Erling Smørgrav #include "validator/val_nsec.h" 50b7579f77SDag-Erling Smørgrav #include "validator/val_nsec3.h" 51b7579f77SDag-Erling Smørgrav #include "validator/val_neg.h" 52b7579f77SDag-Erling Smørgrav #include "validator/val_sigcrypt.h" 53b7579f77SDag-Erling Smørgrav #include "validator/autotrust.h" 54b7579f77SDag-Erling Smørgrav #include "services/cache/dns.h" 5557bddd21SDag-Erling Smørgrav #include "services/cache/rrset.h" 56b7579f77SDag-Erling Smørgrav #include "util/data/dname.h" 57b7579f77SDag-Erling Smørgrav #include "util/module.h" 58b7579f77SDag-Erling Smørgrav #include "util/log.h" 59b7579f77SDag-Erling Smørgrav #include "util/net_help.h" 60b7579f77SDag-Erling Smørgrav #include "util/regional.h" 61b7579f77SDag-Erling Smørgrav #include "util/config_file.h" 62b7579f77SDag-Erling Smørgrav #include "util/fptr_wlist.h" 6309a3aaf3SDag-Erling Smørgrav #include "sldns/rrdef.h" 6409a3aaf3SDag-Erling Smørgrav #include "sldns/wire2str.h" 65c7f4d7adSDag-Erling Smørgrav #include "sldns/str2wire.h" 66b7579f77SDag-Erling Smørgrav 67b7579f77SDag-Erling Smørgrav /* forward decl for cache response and normal super inform calls of a DS */ 68b7579f77SDag-Erling Smørgrav static void process_ds_response(struct module_qstate* qstate, 69b7579f77SDag-Erling Smørgrav struct val_qstate* vq, int id, int rcode, struct dns_msg* msg, 70b7579f77SDag-Erling Smørgrav struct query_info* qinfo, struct sock_list* origin); 71b7579f77SDag-Erling Smørgrav 72b7579f77SDag-Erling Smørgrav /** fill up nsec3 key iterations config entry */ 73b7579f77SDag-Erling Smørgrav static int 74b7579f77SDag-Erling Smørgrav fill_nsec3_iter(struct val_env* ve, char* s, int c) 75b7579f77SDag-Erling Smørgrav { 76b7579f77SDag-Erling Smørgrav char* e; 77b7579f77SDag-Erling Smørgrav int i; 78b7579f77SDag-Erling Smørgrav free(ve->nsec3_keysize); 79b7579f77SDag-Erling Smørgrav free(ve->nsec3_maxiter); 80b7579f77SDag-Erling Smørgrav ve->nsec3_keysize = (size_t*)calloc(sizeof(size_t), (size_t)c); 81b7579f77SDag-Erling Smørgrav ve->nsec3_maxiter = (size_t*)calloc(sizeof(size_t), (size_t)c); 82b7579f77SDag-Erling Smørgrav if(!ve->nsec3_keysize || !ve->nsec3_maxiter) { 83b7579f77SDag-Erling Smørgrav log_err("out of memory"); 84b7579f77SDag-Erling Smørgrav return 0; 85b7579f77SDag-Erling Smørgrav } 86b7579f77SDag-Erling Smørgrav for(i=0; i<c; i++) { 87b7579f77SDag-Erling Smørgrav ve->nsec3_keysize[i] = (size_t)strtol(s, &e, 10); 88b7579f77SDag-Erling Smørgrav if(s == e) { 89b7579f77SDag-Erling Smørgrav log_err("cannot parse: %s", s); 90b7579f77SDag-Erling Smørgrav return 0; 91b7579f77SDag-Erling Smørgrav } 92b7579f77SDag-Erling Smørgrav s = e; 93b7579f77SDag-Erling Smørgrav ve->nsec3_maxiter[i] = (size_t)strtol(s, &e, 10); 94b7579f77SDag-Erling Smørgrav if(s == e) { 95b7579f77SDag-Erling Smørgrav log_err("cannot parse: %s", s); 96b7579f77SDag-Erling Smørgrav return 0; 97b7579f77SDag-Erling Smørgrav } 98b7579f77SDag-Erling Smørgrav s = e; 99b7579f77SDag-Erling Smørgrav if(i>0 && ve->nsec3_keysize[i-1] >= ve->nsec3_keysize[i]) { 100b7579f77SDag-Erling Smørgrav log_err("nsec3 key iterations not ascending: %d %d", 101b7579f77SDag-Erling Smørgrav (int)ve->nsec3_keysize[i-1], 102b7579f77SDag-Erling Smørgrav (int)ve->nsec3_keysize[i]); 103b7579f77SDag-Erling Smørgrav return 0; 104b7579f77SDag-Erling Smørgrav } 105b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "validator nsec3cfg keysz %d mxiter %d", 106b7579f77SDag-Erling Smørgrav (int)ve->nsec3_keysize[i], (int)ve->nsec3_maxiter[i]); 107b7579f77SDag-Erling Smørgrav } 108b7579f77SDag-Erling Smørgrav return 1; 109b7579f77SDag-Erling Smørgrav } 110b7579f77SDag-Erling Smørgrav 111b7579f77SDag-Erling Smørgrav /** apply config settings to validator */ 112b7579f77SDag-Erling Smørgrav static int 113b7579f77SDag-Erling Smørgrav val_apply_cfg(struct module_env* env, struct val_env* val_env, 114b7579f77SDag-Erling Smørgrav struct config_file* cfg) 115b7579f77SDag-Erling Smørgrav { 116b7579f77SDag-Erling Smørgrav int c; 117b7579f77SDag-Erling Smørgrav val_env->bogus_ttl = (uint32_t)cfg->bogus_ttl; 118b7579f77SDag-Erling Smørgrav if(!env->anchors) 119b7579f77SDag-Erling Smørgrav env->anchors = anchors_create(); 120b7579f77SDag-Erling Smørgrav if(!env->anchors) { 121b7579f77SDag-Erling Smørgrav log_err("out of memory"); 122b7579f77SDag-Erling Smørgrav return 0; 123b7579f77SDag-Erling Smørgrav } 124b7579f77SDag-Erling Smørgrav if(!val_env->kcache) 125b7579f77SDag-Erling Smørgrav val_env->kcache = key_cache_create(cfg); 126b7579f77SDag-Erling Smørgrav if(!val_env->kcache) { 127b7579f77SDag-Erling Smørgrav log_err("out of memory"); 128b7579f77SDag-Erling Smørgrav return 0; 129b7579f77SDag-Erling Smørgrav } 130b7579f77SDag-Erling Smørgrav env->key_cache = val_env->kcache; 131b7579f77SDag-Erling Smørgrav if(!anchors_apply_cfg(env->anchors, cfg)) { 132b7579f77SDag-Erling Smørgrav log_err("validator: error in trustanchors config"); 133b7579f77SDag-Erling Smørgrav return 0; 134b7579f77SDag-Erling Smørgrav } 135b7579f77SDag-Erling Smørgrav val_env->date_override = cfg->val_date_override; 136b7579f77SDag-Erling Smørgrav val_env->skew_min = cfg->val_sig_skew_min; 137b7579f77SDag-Erling Smørgrav val_env->skew_max = cfg->val_sig_skew_max; 138b7579f77SDag-Erling Smørgrav c = cfg_count_numbers(cfg->val_nsec3_key_iterations); 139b7579f77SDag-Erling Smørgrav if(c < 1 || (c&1)) { 140b7579f77SDag-Erling Smørgrav log_err("validator: unparseable or odd nsec3 key " 141b7579f77SDag-Erling Smørgrav "iterations: %s", cfg->val_nsec3_key_iterations); 142b7579f77SDag-Erling Smørgrav return 0; 143b7579f77SDag-Erling Smørgrav } 144b7579f77SDag-Erling Smørgrav val_env->nsec3_keyiter_count = c/2; 145b7579f77SDag-Erling Smørgrav if(!fill_nsec3_iter(val_env, cfg->val_nsec3_key_iterations, c/2)) { 146b7579f77SDag-Erling Smørgrav log_err("validator: cannot apply nsec3 key iterations"); 147b7579f77SDag-Erling Smørgrav return 0; 148b7579f77SDag-Erling Smørgrav } 149b7579f77SDag-Erling Smørgrav if(!val_env->neg_cache) 150b7579f77SDag-Erling Smørgrav val_env->neg_cache = val_neg_create(cfg, 151b7579f77SDag-Erling Smørgrav val_env->nsec3_maxiter[val_env->nsec3_keyiter_count-1]); 152b7579f77SDag-Erling Smørgrav if(!val_env->neg_cache) { 153b7579f77SDag-Erling Smørgrav log_err("out of memory"); 154b7579f77SDag-Erling Smørgrav return 0; 155b7579f77SDag-Erling Smørgrav } 156b7579f77SDag-Erling Smørgrav env->neg_cache = val_env->neg_cache; 157b7579f77SDag-Erling Smørgrav return 1; 158b7579f77SDag-Erling Smørgrav } 159b7579f77SDag-Erling Smørgrav 160b5663de9SDag-Erling Smørgrav #ifdef USE_ECDSA_EVP_WORKAROUND 161b5663de9SDag-Erling Smørgrav void ecdsa_evp_workaround_init(void); 162b5663de9SDag-Erling Smørgrav #endif 163b7579f77SDag-Erling Smørgrav int 164b7579f77SDag-Erling Smørgrav val_init(struct module_env* env, int id) 165b7579f77SDag-Erling Smørgrav { 166b7579f77SDag-Erling Smørgrav struct val_env* val_env = (struct val_env*)calloc(1, 167b7579f77SDag-Erling Smørgrav sizeof(struct val_env)); 168b7579f77SDag-Erling Smørgrav if(!val_env) { 169b7579f77SDag-Erling Smørgrav log_err("malloc failure"); 170b7579f77SDag-Erling Smørgrav return 0; 171b7579f77SDag-Erling Smørgrav } 172b7579f77SDag-Erling Smørgrav env->modinfo[id] = (void*)val_env; 173b7579f77SDag-Erling Smørgrav env->need_to_validate = 1; 174b7579f77SDag-Erling Smørgrav lock_basic_init(&val_env->bogus_lock); 175b7579f77SDag-Erling Smørgrav lock_protect(&val_env->bogus_lock, &val_env->num_rrset_bogus, 176b7579f77SDag-Erling Smørgrav sizeof(val_env->num_rrset_bogus)); 177b5663de9SDag-Erling Smørgrav #ifdef USE_ECDSA_EVP_WORKAROUND 178b5663de9SDag-Erling Smørgrav ecdsa_evp_workaround_init(); 179b5663de9SDag-Erling Smørgrav #endif 180b7579f77SDag-Erling Smørgrav if(!val_apply_cfg(env, val_env, env->cfg)) { 181b7579f77SDag-Erling Smørgrav log_err("validator: could not apply configuration settings."); 182b7579f77SDag-Erling Smørgrav return 0; 183b7579f77SDag-Erling Smørgrav } 184bc892140SDag-Erling Smørgrav 185b7579f77SDag-Erling Smørgrav return 1; 186b7579f77SDag-Erling Smørgrav } 187b7579f77SDag-Erling Smørgrav 188b7579f77SDag-Erling Smørgrav void 189b7579f77SDag-Erling Smørgrav val_deinit(struct module_env* env, int id) 190b7579f77SDag-Erling Smørgrav { 191b7579f77SDag-Erling Smørgrav struct val_env* val_env; 192b7579f77SDag-Erling Smørgrav if(!env || !env->modinfo[id]) 193b7579f77SDag-Erling Smørgrav return; 194b7579f77SDag-Erling Smørgrav val_env = (struct val_env*)env->modinfo[id]; 195b7579f77SDag-Erling Smørgrav lock_basic_destroy(&val_env->bogus_lock); 196b7579f77SDag-Erling Smørgrav anchors_delete(env->anchors); 197b7579f77SDag-Erling Smørgrav env->anchors = NULL; 198b7579f77SDag-Erling Smørgrav key_cache_delete(val_env->kcache); 199b7579f77SDag-Erling Smørgrav neg_cache_delete(val_env->neg_cache); 200b7579f77SDag-Erling Smørgrav free(val_env->nsec3_keysize); 201b7579f77SDag-Erling Smørgrav free(val_env->nsec3_maxiter); 202b7579f77SDag-Erling Smørgrav free(val_env); 203b7579f77SDag-Erling Smørgrav env->modinfo[id] = NULL; 204b7579f77SDag-Erling Smørgrav } 205b7579f77SDag-Erling Smørgrav 206b7579f77SDag-Erling Smørgrav /** fill in message structure */ 207b7579f77SDag-Erling Smørgrav static struct val_qstate* 208b7579f77SDag-Erling Smørgrav val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq) 209b7579f77SDag-Erling Smørgrav { 210b7579f77SDag-Erling Smørgrav if(!qstate->return_msg || qstate->return_rcode != LDNS_RCODE_NOERROR) { 211b7579f77SDag-Erling Smørgrav /* create a message to verify */ 212b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "constructing reply for validation"); 213b7579f77SDag-Erling Smørgrav vq->orig_msg = (struct dns_msg*)regional_alloc(qstate->region, 214b7579f77SDag-Erling Smørgrav sizeof(struct dns_msg)); 215b7579f77SDag-Erling Smørgrav if(!vq->orig_msg) 216b7579f77SDag-Erling Smørgrav return NULL; 217b7579f77SDag-Erling Smørgrav vq->orig_msg->qinfo = qstate->qinfo; 218b7579f77SDag-Erling Smørgrav vq->orig_msg->rep = (struct reply_info*)regional_alloc( 219b7579f77SDag-Erling Smørgrav qstate->region, sizeof(struct reply_info)); 220b7579f77SDag-Erling Smørgrav if(!vq->orig_msg->rep) 221b7579f77SDag-Erling Smørgrav return NULL; 222b7579f77SDag-Erling Smørgrav memset(vq->orig_msg->rep, 0, sizeof(struct reply_info)); 223b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->flags = (uint16_t)(qstate->return_rcode&0xf) 224b7579f77SDag-Erling Smørgrav |BIT_QR|BIT_RA|(qstate->query_flags|(BIT_CD|BIT_RD)); 225b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->qdcount = 1; 226b7579f77SDag-Erling Smørgrav } else { 227b7579f77SDag-Erling Smørgrav vq->orig_msg = qstate->return_msg; 228b7579f77SDag-Erling Smørgrav } 229b7579f77SDag-Erling Smørgrav vq->qchase = qstate->qinfo; 230b7579f77SDag-Erling Smørgrav /* chase reply will be an edited (sub)set of the orig msg rrset ptrs */ 231b7579f77SDag-Erling Smørgrav vq->chase_reply = regional_alloc_init(qstate->region, 232b7579f77SDag-Erling Smørgrav vq->orig_msg->rep, 233b7579f77SDag-Erling Smørgrav sizeof(struct reply_info) - sizeof(struct rrset_ref)); 234b7579f77SDag-Erling Smørgrav if(!vq->chase_reply) 235b7579f77SDag-Erling Smørgrav return NULL; 23609a3aaf3SDag-Erling Smørgrav if(vq->orig_msg->rep->rrset_count > RR_COUNT_MAX) 23709a3aaf3SDag-Erling Smørgrav return NULL; /* protect against integer overflow */ 238b7579f77SDag-Erling Smørgrav vq->chase_reply->rrsets = regional_alloc_init(qstate->region, 239b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*) 240b7579f77SDag-Erling Smørgrav * vq->orig_msg->rep->rrset_count); 241b7579f77SDag-Erling Smørgrav if(!vq->chase_reply->rrsets) 242b7579f77SDag-Erling Smørgrav return NULL; 243b7579f77SDag-Erling Smørgrav vq->rrset_skip = 0; 244b7579f77SDag-Erling Smørgrav return vq; 245b7579f77SDag-Erling Smørgrav } 246b7579f77SDag-Erling Smørgrav 247b7579f77SDag-Erling Smørgrav /** allocate new validator query state */ 248b7579f77SDag-Erling Smørgrav static struct val_qstate* 249b7579f77SDag-Erling Smørgrav val_new(struct module_qstate* qstate, int id) 250b7579f77SDag-Erling Smørgrav { 251b7579f77SDag-Erling Smørgrav struct val_qstate* vq = (struct val_qstate*)regional_alloc( 252b7579f77SDag-Erling Smørgrav qstate->region, sizeof(*vq)); 253b7579f77SDag-Erling Smørgrav log_assert(!qstate->minfo[id]); 254b7579f77SDag-Erling Smørgrav if(!vq) 255b7579f77SDag-Erling Smørgrav return NULL; 256b7579f77SDag-Erling Smørgrav memset(vq, 0, sizeof(*vq)); 257b7579f77SDag-Erling Smørgrav qstate->minfo[id] = vq; 258b7579f77SDag-Erling Smørgrav vq->state = VAL_INIT_STATE; 259b7579f77SDag-Erling Smørgrav return val_new_getmsg(qstate, vq); 260b7579f77SDag-Erling Smørgrav } 261b7579f77SDag-Erling Smørgrav 262b7579f77SDag-Erling Smørgrav /** 263b7579f77SDag-Erling Smørgrav * Exit validation with an error status 264b7579f77SDag-Erling Smørgrav * 265b7579f77SDag-Erling Smørgrav * @param qstate: query state 266b7579f77SDag-Erling Smørgrav * @param id: validator id. 267b7579f77SDag-Erling Smørgrav * @return false, for use by caller to return to stop processing. 268b7579f77SDag-Erling Smørgrav */ 269b7579f77SDag-Erling Smørgrav static int 270b7579f77SDag-Erling Smørgrav val_error(struct module_qstate* qstate, int id) 271b7579f77SDag-Erling Smørgrav { 272b7579f77SDag-Erling Smørgrav qstate->ext_state[id] = module_error; 273b7579f77SDag-Erling Smørgrav qstate->return_rcode = LDNS_RCODE_SERVFAIL; 274b7579f77SDag-Erling Smørgrav return 0; 275b7579f77SDag-Erling Smørgrav } 276b7579f77SDag-Erling Smørgrav 277b7579f77SDag-Erling Smørgrav /** 278b7579f77SDag-Erling Smørgrav * Check to see if a given response needs to go through the validation 279b7579f77SDag-Erling Smørgrav * process. Typical reasons for this routine to return false are: CD bit was 280b7579f77SDag-Erling Smørgrav * on in the original request, or the response is a kind of message that 281b7579f77SDag-Erling Smørgrav * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.) 282b7579f77SDag-Erling Smørgrav * 283b7579f77SDag-Erling Smørgrav * @param qstate: query state. 284b7579f77SDag-Erling Smørgrav * @param ret_rc: rcode for this message (if noerror - examine ret_msg). 285b7579f77SDag-Erling Smørgrav * @param ret_msg: return msg, can be NULL; look at rcode instead. 286b7579f77SDag-Erling Smørgrav * @return true if the response could use validation (although this does not 287b7579f77SDag-Erling Smørgrav * mean we can actually validate this response). 288b7579f77SDag-Erling Smørgrav */ 289b7579f77SDag-Erling Smørgrav static int 290b7579f77SDag-Erling Smørgrav needs_validation(struct module_qstate* qstate, int ret_rc, 291b7579f77SDag-Erling Smørgrav struct dns_msg* ret_msg) 292b7579f77SDag-Erling Smørgrav { 293b7579f77SDag-Erling Smørgrav int rcode; 294b7579f77SDag-Erling Smørgrav 295ff825849SDag-Erling Smørgrav /* If the CD bit is on in the original request, then you could think 296ff825849SDag-Erling Smørgrav * that we don't bother to validate anything. 297ff825849SDag-Erling Smørgrav * But this is signalled internally with the valrec flag. 298ff825849SDag-Erling Smørgrav * User queries are validated with BIT_CD to make our cache clean 299ff825849SDag-Erling Smørgrav * so that bogus messages get retried by the upstream also for 300ff825849SDag-Erling Smørgrav * downstream validators that set BIT_CD. 301ff825849SDag-Erling Smørgrav * For DNS64 bit_cd signals no dns64 processing, but we want to 302ff825849SDag-Erling Smørgrav * provide validation there too */ 303ff825849SDag-Erling Smørgrav /* 304b7579f77SDag-Erling Smørgrav if(qstate->query_flags & BIT_CD) { 305b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "not validating response due to CD bit"); 306b7579f77SDag-Erling Smørgrav return 0; 307b7579f77SDag-Erling Smørgrav } 308ff825849SDag-Erling Smørgrav */ 309ff825849SDag-Erling Smørgrav if(qstate->is_valrec) { 310ff825849SDag-Erling Smørgrav verbose(VERB_ALGO, "not validating response, is valrec" 311ff825849SDag-Erling Smørgrav "(validation recursion lookup)"); 312ff825849SDag-Erling Smørgrav return 0; 313ff825849SDag-Erling Smørgrav } 314b7579f77SDag-Erling Smørgrav 315b7579f77SDag-Erling Smørgrav if(ret_rc != LDNS_RCODE_NOERROR || !ret_msg) 316b7579f77SDag-Erling Smørgrav rcode = ret_rc; 317b7579f77SDag-Erling Smørgrav else rcode = (int)FLAGS_GET_RCODE(ret_msg->rep->flags); 318b7579f77SDag-Erling Smørgrav 319b7579f77SDag-Erling Smørgrav if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) { 32017d15b25SDag-Erling Smørgrav if(verbosity >= VERB_ALGO) { 32117d15b25SDag-Erling Smørgrav char rc[16]; 32217d15b25SDag-Erling Smørgrav rc[0]=0; 32317d15b25SDag-Erling Smørgrav (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc)); 32417d15b25SDag-Erling Smørgrav verbose(VERB_ALGO, "cannot validate non-answer, rcode %s", rc); 32517d15b25SDag-Erling Smørgrav } 326b7579f77SDag-Erling Smørgrav return 0; 327b7579f77SDag-Erling Smørgrav } 328b7579f77SDag-Erling Smørgrav 329b7579f77SDag-Erling Smørgrav /* cannot validate positive RRSIG response. (negatives can) */ 330b7579f77SDag-Erling Smørgrav if(qstate->qinfo.qtype == LDNS_RR_TYPE_RRSIG && 331b7579f77SDag-Erling Smørgrav rcode == LDNS_RCODE_NOERROR && ret_msg && 332b7579f77SDag-Erling Smørgrav ret_msg->rep->an_numrrsets > 0) { 333b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "cannot validate RRSIG, no sigs on sigs."); 334b7579f77SDag-Erling Smørgrav return 0; 335b7579f77SDag-Erling Smørgrav } 336b7579f77SDag-Erling Smørgrav return 1; 337b7579f77SDag-Erling Smørgrav } 338b7579f77SDag-Erling Smørgrav 339b7579f77SDag-Erling Smørgrav /** 340b7579f77SDag-Erling Smørgrav * Check to see if the response has already been validated. 341b7579f77SDag-Erling Smørgrav * @param ret_msg: return msg, can be NULL 342b7579f77SDag-Erling Smørgrav * @return true if the response has already been validated 343b7579f77SDag-Erling Smørgrav */ 344b7579f77SDag-Erling Smørgrav static int 345b7579f77SDag-Erling Smørgrav already_validated(struct dns_msg* ret_msg) 346b7579f77SDag-Erling Smørgrav { 347b7579f77SDag-Erling Smørgrav /* validate unchecked, and re-validate bogus messages */ 348b7579f77SDag-Erling Smørgrav if (ret_msg && ret_msg->rep->security > sec_status_bogus) 349b7579f77SDag-Erling Smørgrav { 350b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "response has already been validated: %s", 351b7579f77SDag-Erling Smørgrav sec_status_to_string(ret_msg->rep->security)); 352b7579f77SDag-Erling Smørgrav return 1; 353b7579f77SDag-Erling Smørgrav } 354b7579f77SDag-Erling Smørgrav return 0; 355b7579f77SDag-Erling Smørgrav } 356b7579f77SDag-Erling Smørgrav 357b7579f77SDag-Erling Smørgrav /** 358b7579f77SDag-Erling Smørgrav * Generate a request for DNS data. 359b7579f77SDag-Erling Smørgrav * 360b7579f77SDag-Erling Smørgrav * @param qstate: query state that is the parent. 361b7579f77SDag-Erling Smørgrav * @param id: module id. 362b7579f77SDag-Erling Smørgrav * @param name: what name to query for. 363b7579f77SDag-Erling Smørgrav * @param namelen: length of name. 364b7579f77SDag-Erling Smørgrav * @param qtype: query type. 365b7579f77SDag-Erling Smørgrav * @param qclass: query class. 366b7579f77SDag-Erling Smørgrav * @param flags: additional flags, such as the CD bit (BIT_CD), or 0. 367c7f4d7adSDag-Erling Smørgrav * @param newq: If the subquery is newly created, it is returned, 368c7f4d7adSDag-Erling Smørgrav * otherwise NULL is returned 369c7f4d7adSDag-Erling Smørgrav * @param detached: true if this qstate should not attach to the subquery 370b7579f77SDag-Erling Smørgrav * @return false on alloc failure. 371b7579f77SDag-Erling Smørgrav */ 372b7579f77SDag-Erling Smørgrav static int 373b7579f77SDag-Erling Smørgrav generate_request(struct module_qstate* qstate, int id, uint8_t* name, 374c7f4d7adSDag-Erling Smørgrav size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags, 375c7f4d7adSDag-Erling Smørgrav struct module_qstate** newq, int detached) 376b7579f77SDag-Erling Smørgrav { 377b7579f77SDag-Erling Smørgrav struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id]; 378b7579f77SDag-Erling Smørgrav struct query_info ask; 379ff825849SDag-Erling Smørgrav int valrec; 380b7579f77SDag-Erling Smørgrav ask.qname = name; 381b7579f77SDag-Erling Smørgrav ask.qname_len = namelen; 382b7579f77SDag-Erling Smørgrav ask.qtype = qtype; 383b7579f77SDag-Erling Smørgrav ask.qclass = qclass; 384bc892140SDag-Erling Smørgrav ask.local_alias = NULL; 385b7579f77SDag-Erling Smørgrav log_query_info(VERB_ALGO, "generate request", &ask); 386ff825849SDag-Erling Smørgrav /* enable valrec flag to avoid recursion to the same validation 387ff825849SDag-Erling Smørgrav * routine, this lookup is simply a lookup. DLVs need validation */ 388ff825849SDag-Erling Smørgrav if(qtype == LDNS_RR_TYPE_DLV) 389ff825849SDag-Erling Smørgrav valrec = 0; 390ff825849SDag-Erling Smørgrav else valrec = 1; 391*4c75e3aaSDag-Erling Smørgrav 392*4c75e3aaSDag-Erling Smørgrav fptr_ok(fptr_whitelist_modenv_detect_cycle(qstate->env->detect_cycle)); 393*4c75e3aaSDag-Erling Smørgrav if((*qstate->env->detect_cycle)(qstate, &ask, 394*4c75e3aaSDag-Erling Smørgrav (uint16_t)(BIT_RD|flags), 0, valrec)) { 395*4c75e3aaSDag-Erling Smørgrav verbose(VERB_ALGO, "Could not generate request: cycle detected"); 396*4c75e3aaSDag-Erling Smørgrav return 0; 397*4c75e3aaSDag-Erling Smørgrav } 398*4c75e3aaSDag-Erling Smørgrav 399c7f4d7adSDag-Erling Smørgrav if(detached) { 400c7f4d7adSDag-Erling Smørgrav struct mesh_state* sub = NULL; 401c7f4d7adSDag-Erling Smørgrav fptr_ok(fptr_whitelist_modenv_add_sub( 402c7f4d7adSDag-Erling Smørgrav qstate->env->add_sub)); 403c7f4d7adSDag-Erling Smørgrav if(!(*qstate->env->add_sub)(qstate, &ask, 404c7f4d7adSDag-Erling Smørgrav (uint16_t)(BIT_RD|flags), 0, valrec, newq, &sub)){ 405b7579f77SDag-Erling Smørgrav log_err("Could not generate request: out of memory"); 406b7579f77SDag-Erling Smørgrav return 0; 407b7579f77SDag-Erling Smørgrav } 408c7f4d7adSDag-Erling Smørgrav } 409c7f4d7adSDag-Erling Smørgrav else { 410c7f4d7adSDag-Erling Smørgrav fptr_ok(fptr_whitelist_modenv_attach_sub( 411c7f4d7adSDag-Erling Smørgrav qstate->env->attach_sub)); 412c7f4d7adSDag-Erling Smørgrav if(!(*qstate->env->attach_sub)(qstate, &ask, 413c7f4d7adSDag-Erling Smørgrav (uint16_t)(BIT_RD|flags), 0, valrec, newq)){ 414c7f4d7adSDag-Erling Smørgrav log_err("Could not generate request: out of memory"); 415c7f4d7adSDag-Erling Smørgrav return 0; 416c7f4d7adSDag-Erling Smørgrav } 417c7f4d7adSDag-Erling Smørgrav } 418b7579f77SDag-Erling Smørgrav /* newq; validator does not need state created for that 419b7579f77SDag-Erling Smørgrav * query, and its a 'normal' for iterator as well */ 420c7f4d7adSDag-Erling Smørgrav if(*newq) { 421b7579f77SDag-Erling Smørgrav /* add our blacklist to the query blacklist */ 422c7f4d7adSDag-Erling Smørgrav sock_list_merge(&(*newq)->blacklist, (*newq)->region, 423b7579f77SDag-Erling Smørgrav vq->chain_blacklist); 424b7579f77SDag-Erling Smørgrav } 425b7579f77SDag-Erling Smørgrav qstate->ext_state[id] = module_wait_subquery; 426b7579f77SDag-Erling Smørgrav return 1; 427b7579f77SDag-Erling Smørgrav } 428b7579f77SDag-Erling Smørgrav 429b7579f77SDag-Erling Smørgrav /** 430c7f4d7adSDag-Erling Smørgrav * Generate, send and detach key tag signaling query. 431c7f4d7adSDag-Erling Smørgrav * 432c7f4d7adSDag-Erling Smørgrav * @param qstate: query state. 433c7f4d7adSDag-Erling Smørgrav * @param id: module id. 434c7f4d7adSDag-Erling Smørgrav * @param ta: trust anchor, locked. 435c7f4d7adSDag-Erling Smørgrav * @return false on a processing error. 436c7f4d7adSDag-Erling Smørgrav */ 437c7f4d7adSDag-Erling Smørgrav static int 438c7f4d7adSDag-Erling Smørgrav generate_keytag_query(struct module_qstate* qstate, int id, 439c7f4d7adSDag-Erling Smørgrav struct trust_anchor* ta) 440c7f4d7adSDag-Erling Smørgrav { 441c7f4d7adSDag-Erling Smørgrav /* 3 bytes for "_ta", 5 bytes per tag (4 bytes + "-") */ 442c7f4d7adSDag-Erling Smørgrav #define MAX_LABEL_TAGS (LDNS_MAX_LABELLEN-3)/5 443c7f4d7adSDag-Erling Smørgrav size_t i, numtag; 444c7f4d7adSDag-Erling Smørgrav uint16_t tags[MAX_LABEL_TAGS]; 445c7f4d7adSDag-Erling Smørgrav char tagstr[LDNS_MAX_LABELLEN+1] = "_ta"; /* +1 for NULL byte */ 446c7f4d7adSDag-Erling Smørgrav size_t tagstr_left = sizeof(tagstr) - strlen(tagstr); 447c7f4d7adSDag-Erling Smørgrav char* tagstr_pos = tagstr + strlen(tagstr); 448c7f4d7adSDag-Erling Smørgrav uint8_t dnamebuf[LDNS_MAX_DOMAINLEN+1]; /* +1 for label length byte */ 449c7f4d7adSDag-Erling Smørgrav size_t dnamebuf_len = sizeof(dnamebuf); 450c7f4d7adSDag-Erling Smørgrav uint8_t* keytagdname; 451c7f4d7adSDag-Erling Smørgrav struct module_qstate* newq = NULL; 452c7f4d7adSDag-Erling Smørgrav enum module_ext_state ext_state = qstate->ext_state[id]; 453c7f4d7adSDag-Erling Smørgrav 454c7f4d7adSDag-Erling Smørgrav numtag = anchor_list_keytags(ta, tags, MAX_LABEL_TAGS); 455c7f4d7adSDag-Erling Smørgrav if(numtag == 0) 456c7f4d7adSDag-Erling Smørgrav return 0; 457c7f4d7adSDag-Erling Smørgrav 458c7f4d7adSDag-Erling Smørgrav for(i=0; i<numtag; i++) { 459c7f4d7adSDag-Erling Smørgrav /* Buffer can't overflow; numtag is limited to tags that fit in 460c7f4d7adSDag-Erling Smørgrav * the buffer. */ 461c7f4d7adSDag-Erling Smørgrav snprintf(tagstr_pos, tagstr_left, "-%04x", (unsigned)tags[i]); 462c7f4d7adSDag-Erling Smørgrav tagstr_left -= strlen(tagstr_pos); 463c7f4d7adSDag-Erling Smørgrav tagstr_pos += strlen(tagstr_pos); 464c7f4d7adSDag-Erling Smørgrav } 465c7f4d7adSDag-Erling Smørgrav 466c7f4d7adSDag-Erling Smørgrav sldns_str2wire_dname_buf_origin(tagstr, dnamebuf, &dnamebuf_len, 467c7f4d7adSDag-Erling Smørgrav ta->name, ta->namelen); 468c7f4d7adSDag-Erling Smørgrav if(!(keytagdname = (uint8_t*)regional_alloc_init(qstate->region, 469c7f4d7adSDag-Erling Smørgrav dnamebuf, dnamebuf_len))) { 470c7f4d7adSDag-Erling Smørgrav log_err("could not generate key tag query: out of memory"); 471c7f4d7adSDag-Erling Smørgrav return 0; 472c7f4d7adSDag-Erling Smørgrav } 473c7f4d7adSDag-Erling Smørgrav 47457bddd21SDag-Erling Smørgrav log_nametypeclass(VERB_OPS, "generate keytag query", keytagdname, 475c7f4d7adSDag-Erling Smørgrav LDNS_RR_TYPE_NULL, ta->dclass); 476c7f4d7adSDag-Erling Smørgrav if(!generate_request(qstate, id, keytagdname, dnamebuf_len, 477c7f4d7adSDag-Erling Smørgrav LDNS_RR_TYPE_NULL, ta->dclass, 0, &newq, 1)) { 478*4c75e3aaSDag-Erling Smørgrav verbose(VERB_ALGO, "failed to generate key tag signaling request"); 479c7f4d7adSDag-Erling Smørgrav return 0; 480c7f4d7adSDag-Erling Smørgrav } 481c7f4d7adSDag-Erling Smørgrav 482c7f4d7adSDag-Erling Smørgrav /* Not interrested in subquery response. Restore the ext_state, 483c7f4d7adSDag-Erling Smørgrav * that might be changed by generate_request() */ 484c7f4d7adSDag-Erling Smørgrav qstate->ext_state[id] = ext_state; 485c7f4d7adSDag-Erling Smørgrav 486c7f4d7adSDag-Erling Smørgrav return 1; 487c7f4d7adSDag-Erling Smørgrav } 488c7f4d7adSDag-Erling Smørgrav 489c7f4d7adSDag-Erling Smørgrav /** 4900fb34990SDag-Erling Smørgrav * Get keytag as uint16_t from string 4910fb34990SDag-Erling Smørgrav * 4920fb34990SDag-Erling Smørgrav * @param start: start of string containing keytag 4930fb34990SDag-Erling Smørgrav * @param keytag: pointer where to store the extracted keytag 4940fb34990SDag-Erling Smørgrav * @return: 1 if keytag was extracted, else 0. 4950fb34990SDag-Erling Smørgrav */ 4960fb34990SDag-Erling Smørgrav static int 4970fb34990SDag-Erling Smørgrav sentinel_get_keytag(char* start, uint16_t* keytag) { 4980fb34990SDag-Erling Smørgrav char* keytag_str; 4990fb34990SDag-Erling Smørgrav char* e = NULL; 5000fb34990SDag-Erling Smørgrav keytag_str = calloc(1, SENTINEL_KEYTAG_LEN + 1 /* null byte */); 5010fb34990SDag-Erling Smørgrav if(!keytag_str) 5020fb34990SDag-Erling Smørgrav return 0; 5030fb34990SDag-Erling Smørgrav memmove(keytag_str, start, SENTINEL_KEYTAG_LEN); 5040fb34990SDag-Erling Smørgrav keytag_str[SENTINEL_KEYTAG_LEN] = '\0'; 5050fb34990SDag-Erling Smørgrav *keytag = (uint16_t)strtol(keytag_str, &e, 10); 5060fb34990SDag-Erling Smørgrav if(!e || *e != '\0') { 5070fb34990SDag-Erling Smørgrav free(keytag_str); 5080fb34990SDag-Erling Smørgrav return 0; 5090fb34990SDag-Erling Smørgrav } 5100fb34990SDag-Erling Smørgrav free(keytag_str); 5110fb34990SDag-Erling Smørgrav return 1; 5120fb34990SDag-Erling Smørgrav } 5130fb34990SDag-Erling Smørgrav 5140fb34990SDag-Erling Smørgrav /** 515b7579f77SDag-Erling Smørgrav * Prime trust anchor for use. 516b7579f77SDag-Erling Smørgrav * Generate and dispatch a priming query for the given trust anchor. 517b7579f77SDag-Erling Smørgrav * The trust anchor can be DNSKEY or DS and does not have to be signed. 518b7579f77SDag-Erling Smørgrav * 519b7579f77SDag-Erling Smørgrav * @param qstate: query state. 520b7579f77SDag-Erling Smørgrav * @param vq: validator query state. 521b7579f77SDag-Erling Smørgrav * @param id: module id. 522b7579f77SDag-Erling Smørgrav * @param toprime: what to prime. 523b7579f77SDag-Erling Smørgrav * @return false on a processing error. 524b7579f77SDag-Erling Smørgrav */ 525b7579f77SDag-Erling Smørgrav static int 526b7579f77SDag-Erling Smørgrav prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq, 527b7579f77SDag-Erling Smørgrav int id, struct trust_anchor* toprime) 528b7579f77SDag-Erling Smørgrav { 529c7f4d7adSDag-Erling Smørgrav struct module_qstate* newq = NULL; 530b7579f77SDag-Erling Smørgrav int ret = generate_request(qstate, id, toprime->name, toprime->namelen, 531c7f4d7adSDag-Erling Smørgrav LDNS_RR_TYPE_DNSKEY, toprime->dclass, BIT_CD, &newq, 0); 532c7f4d7adSDag-Erling Smørgrav 533c7f4d7adSDag-Erling Smørgrav if(newq && qstate->env->cfg->trust_anchor_signaling && 534c7f4d7adSDag-Erling Smørgrav !generate_keytag_query(qstate, id, toprime)) { 535*4c75e3aaSDag-Erling Smørgrav verbose(VERB_ALGO, "keytag signaling query failed"); 536c7f4d7adSDag-Erling Smørgrav return 0; 537c7f4d7adSDag-Erling Smørgrav } 538c7f4d7adSDag-Erling Smørgrav 539b7579f77SDag-Erling Smørgrav if(!ret) { 540*4c75e3aaSDag-Erling Smørgrav verbose(VERB_ALGO, "Could not prime trust anchor"); 541b7579f77SDag-Erling Smørgrav return 0; 542b7579f77SDag-Erling Smørgrav } 543b7579f77SDag-Erling Smørgrav /* ignore newq; validator does not need state created for that 544b7579f77SDag-Erling Smørgrav * query, and its a 'normal' for iterator as well */ 545b7579f77SDag-Erling Smørgrav vq->wait_prime_ta = 1; /* to elicit PRIME_RESP_STATE processing 546b7579f77SDag-Erling Smørgrav from the validator inform_super() routine */ 547b7579f77SDag-Erling Smørgrav /* store trust anchor name for later lookup when prime returns */ 548b7579f77SDag-Erling Smørgrav vq->trust_anchor_name = regional_alloc_init(qstate->region, 549b7579f77SDag-Erling Smørgrav toprime->name, toprime->namelen); 550b7579f77SDag-Erling Smørgrav vq->trust_anchor_len = toprime->namelen; 551b7579f77SDag-Erling Smørgrav vq->trust_anchor_labs = toprime->namelabs; 552b7579f77SDag-Erling Smørgrav if(!vq->trust_anchor_name) { 553b7579f77SDag-Erling Smørgrav log_err("Could not prime trust anchor: out of memory"); 554b7579f77SDag-Erling Smørgrav return 0; 555b7579f77SDag-Erling Smørgrav } 556b7579f77SDag-Erling Smørgrav return 1; 557b7579f77SDag-Erling Smørgrav } 558b7579f77SDag-Erling Smørgrav 559b7579f77SDag-Erling Smørgrav /** 560b7579f77SDag-Erling Smørgrav * Validate if the ANSWER and AUTHORITY sections contain valid rrsets. 561b7579f77SDag-Erling Smørgrav * They must be validly signed with the given key. 562b7579f77SDag-Erling Smørgrav * Tries to validate ADDITIONAL rrsets as well, but only to check them. 563b7579f77SDag-Erling Smørgrav * Allows unsigned CNAME after a DNAME that expands the DNAME. 564b7579f77SDag-Erling Smørgrav * 565b7579f77SDag-Erling Smørgrav * Note that by the time this method is called, the process of finding the 566b7579f77SDag-Erling Smørgrav * trusted DNSKEY rrset that signs this response must already have been 567b7579f77SDag-Erling Smørgrav * completed. 568b7579f77SDag-Erling Smørgrav * 569b7579f77SDag-Erling Smørgrav * @param qstate: query state. 570b7579f77SDag-Erling Smørgrav * @param env: module env for verify. 571b7579f77SDag-Erling Smørgrav * @param ve: validator env for verify. 572b7579f77SDag-Erling Smørgrav * @param qchase: query that was made. 573b7579f77SDag-Erling Smørgrav * @param chase_reply: answer to validate. 574b7579f77SDag-Erling Smørgrav * @param key_entry: the key entry, which is trusted, and which matches 575b7579f77SDag-Erling Smørgrav * the signer of the answer. The key entry isgood(). 576b7579f77SDag-Erling Smørgrav * @return false if any of the rrsets in the an or ns sections of the message 577b7579f77SDag-Erling Smørgrav * fail to verify. The message is then set to bogus. 578b7579f77SDag-Erling Smørgrav */ 579b7579f77SDag-Erling Smørgrav static int 580b7579f77SDag-Erling Smørgrav validate_msg_signatures(struct module_qstate* qstate, struct module_env* env, 581b7579f77SDag-Erling Smørgrav struct val_env* ve, struct query_info* qchase, 582b7579f77SDag-Erling Smørgrav struct reply_info* chase_reply, struct key_entry_key* key_entry) 583b7579f77SDag-Erling Smørgrav { 584b7579f77SDag-Erling Smørgrav uint8_t* sname; 585b7579f77SDag-Erling Smørgrav size_t i, slen; 586b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* s; 587b7579f77SDag-Erling Smørgrav enum sec_status sec; 588b7579f77SDag-Erling Smørgrav int dname_seen = 0; 589b7579f77SDag-Erling Smørgrav char* reason = NULL; 590b7579f77SDag-Erling Smørgrav 591b7579f77SDag-Erling Smørgrav /* validate the ANSWER section */ 592b7579f77SDag-Erling Smørgrav for(i=0; i<chase_reply->an_numrrsets; i++) { 593b7579f77SDag-Erling Smørgrav s = chase_reply->rrsets[i]; 594b7579f77SDag-Erling Smørgrav /* Skip the CNAME following a (validated) DNAME. 595b7579f77SDag-Erling Smørgrav * Because of the normalization routines in the iterator, 596b7579f77SDag-Erling Smørgrav * there will always be an unsigned CNAME following a DNAME 597b7579f77SDag-Erling Smørgrav * (unless qtype=DNAME). */ 598b7579f77SDag-Erling Smørgrav if(dname_seen && ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) { 599b7579f77SDag-Erling Smørgrav dname_seen = 0; 600b7579f77SDag-Erling Smørgrav /* CNAME was synthesized by our own iterator */ 601b7579f77SDag-Erling Smørgrav /* since the DNAME verified, mark the CNAME as secure */ 602b7579f77SDag-Erling Smørgrav ((struct packed_rrset_data*)s->entry.data)->security = 603b7579f77SDag-Erling Smørgrav sec_status_secure; 604b7579f77SDag-Erling Smørgrav ((struct packed_rrset_data*)s->entry.data)->trust = 605b7579f77SDag-Erling Smørgrav rrset_trust_validated; 606b7579f77SDag-Erling Smørgrav continue; 607b7579f77SDag-Erling Smørgrav } 608b7579f77SDag-Erling Smørgrav 609b7579f77SDag-Erling Smørgrav /* Verify the answer rrset */ 610838e13ceSDag-Erling Smørgrav sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason, 611838e13ceSDag-Erling Smørgrav LDNS_SECTION_ANSWER, qstate); 612b7579f77SDag-Erling Smørgrav /* If the (answer) rrset failed to validate, then this 613b7579f77SDag-Erling Smørgrav * message is BAD. */ 614b7579f77SDag-Erling Smørgrav if(sec != sec_status_secure) { 615b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_QUERY, "validator: response " 616b7579f77SDag-Erling Smørgrav "has failed ANSWER rrset:", s->rk.dname, 617b7579f77SDag-Erling Smørgrav ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 618b7579f77SDag-Erling Smørgrav errinf(qstate, reason); 619b7579f77SDag-Erling Smørgrav if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) 620b7579f77SDag-Erling Smørgrav errinf(qstate, "for CNAME"); 621b7579f77SDag-Erling Smørgrav else if(ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) 622b7579f77SDag-Erling Smørgrav errinf(qstate, "for DNAME"); 623b7579f77SDag-Erling Smørgrav errinf_origin(qstate, qstate->reply_origin); 624b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 625b7579f77SDag-Erling Smørgrav return 0; 626b7579f77SDag-Erling Smørgrav } 627b7579f77SDag-Erling Smørgrav 628b7579f77SDag-Erling Smørgrav /* Notice a DNAME that should be followed by an unsigned 629b7579f77SDag-Erling Smørgrav * CNAME. */ 630b7579f77SDag-Erling Smørgrav if(qchase->qtype != LDNS_RR_TYPE_DNAME && 631b7579f77SDag-Erling Smørgrav ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) { 632b7579f77SDag-Erling Smørgrav dname_seen = 1; 633b7579f77SDag-Erling Smørgrav } 634b7579f77SDag-Erling Smørgrav } 635b7579f77SDag-Erling Smørgrav 636b7579f77SDag-Erling Smørgrav /* validate the AUTHORITY section */ 637b7579f77SDag-Erling Smørgrav for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 638b7579f77SDag-Erling Smørgrav chase_reply->ns_numrrsets; i++) { 639b7579f77SDag-Erling Smørgrav s = chase_reply->rrsets[i]; 640838e13ceSDag-Erling Smørgrav sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason, 641838e13ceSDag-Erling Smørgrav LDNS_SECTION_AUTHORITY, qstate); 642b7579f77SDag-Erling Smørgrav /* If anything in the authority section fails to be secure, 643b7579f77SDag-Erling Smørgrav * we have a bad message. */ 644b7579f77SDag-Erling Smørgrav if(sec != sec_status_secure) { 645b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_QUERY, "validator: response " 646b7579f77SDag-Erling Smørgrav "has failed AUTHORITY rrset:", s->rk.dname, 647b7579f77SDag-Erling Smørgrav ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 648b7579f77SDag-Erling Smørgrav errinf(qstate, reason); 649b7579f77SDag-Erling Smørgrav errinf_origin(qstate, qstate->reply_origin); 65009a3aaf3SDag-Erling Smørgrav errinf_rrset(qstate, s); 651b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 652b7579f77SDag-Erling Smørgrav return 0; 653b7579f77SDag-Erling Smørgrav } 654b7579f77SDag-Erling Smørgrav } 655b7579f77SDag-Erling Smørgrav 656c7f4d7adSDag-Erling Smørgrav /* If set, the validator should clean the additional section of 657c7f4d7adSDag-Erling Smørgrav * secure messages. */ 658c7f4d7adSDag-Erling Smørgrav if(!env->cfg->val_clean_additional) 659b7579f77SDag-Erling Smørgrav return 1; 660c7f4d7adSDag-Erling Smørgrav /* attempt to validate the ADDITIONAL section rrsets */ 661b7579f77SDag-Erling Smørgrav for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets; 662b7579f77SDag-Erling Smørgrav i<chase_reply->rrset_count; i++) { 663b7579f77SDag-Erling Smørgrav s = chase_reply->rrsets[i]; 664b7579f77SDag-Erling Smørgrav /* only validate rrs that have signatures with the key */ 665b7579f77SDag-Erling Smørgrav /* leave others unchecked, those get removed later on too */ 666b7579f77SDag-Erling Smørgrav val_find_rrset_signer(s, &sname, &slen); 667b7579f77SDag-Erling Smørgrav if(sname && query_dname_compare(sname, key_entry->name)==0) 668b7579f77SDag-Erling Smørgrav (void)val_verify_rrset_entry(env, ve, s, key_entry, 669838e13ceSDag-Erling Smørgrav &reason, LDNS_SECTION_ADDITIONAL, qstate); 670b7579f77SDag-Erling Smørgrav /* the additional section can fail to be secure, 671b7579f77SDag-Erling Smørgrav * it is optional, check signature in case we need 672b7579f77SDag-Erling Smørgrav * to clean the additional section later. */ 673b7579f77SDag-Erling Smørgrav } 674b7579f77SDag-Erling Smørgrav 675b7579f77SDag-Erling Smørgrav return 1; 676b7579f77SDag-Erling Smørgrav } 677b7579f77SDag-Erling Smørgrav 678b7579f77SDag-Erling Smørgrav /** 679b7579f77SDag-Erling Smørgrav * Detect wrong truncated response (say from BIND 9.6.1 that is forwarding 680b7579f77SDag-Erling Smørgrav * and saw the NS record without signatures from a referral). 681b7579f77SDag-Erling Smørgrav * The positive response has a mangled authority section. 682b7579f77SDag-Erling Smørgrav * Remove that authority section and the additional section. 683b7579f77SDag-Erling Smørgrav * @param rep: reply 684b7579f77SDag-Erling Smørgrav * @return true if a wrongly truncated response. 685b7579f77SDag-Erling Smørgrav */ 686b7579f77SDag-Erling Smørgrav static int 687b7579f77SDag-Erling Smørgrav detect_wrongly_truncated(struct reply_info* rep) 688b7579f77SDag-Erling Smørgrav { 689b7579f77SDag-Erling Smørgrav size_t i; 690b7579f77SDag-Erling Smørgrav /* only NS in authority, and it is bogus */ 691b7579f77SDag-Erling Smørgrav if(rep->ns_numrrsets != 1 || rep->an_numrrsets == 0) 692b7579f77SDag-Erling Smørgrav return 0; 693b7579f77SDag-Erling Smørgrav if(ntohs(rep->rrsets[ rep->an_numrrsets ]->rk.type) != LDNS_RR_TYPE_NS) 694b7579f77SDag-Erling Smørgrav return 0; 695b7579f77SDag-Erling Smørgrav if(((struct packed_rrset_data*)rep->rrsets[ rep->an_numrrsets ] 696b7579f77SDag-Erling Smørgrav ->entry.data)->security == sec_status_secure) 697b7579f77SDag-Erling Smørgrav return 0; 698b7579f77SDag-Erling Smørgrav /* answer section is present and secure */ 699b7579f77SDag-Erling Smørgrav for(i=0; i<rep->an_numrrsets; i++) { 700b7579f77SDag-Erling Smørgrav if(((struct packed_rrset_data*)rep->rrsets[ i ] 701b7579f77SDag-Erling Smørgrav ->entry.data)->security != sec_status_secure) 702b7579f77SDag-Erling Smørgrav return 0; 703b7579f77SDag-Erling Smørgrav } 704b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "truncating to minimal response"); 705b7579f77SDag-Erling Smørgrav return 1; 706b7579f77SDag-Erling Smørgrav } 707b7579f77SDag-Erling Smørgrav 7086480faa8SDag-Erling Smørgrav /** 7096480faa8SDag-Erling Smørgrav * For messages that are not referrals, if the chase reply contains an 7106480faa8SDag-Erling Smørgrav * unsigned NS record in the authority section it could have been 7116480faa8SDag-Erling Smørgrav * inserted by a (BIND) forwarder that thinks the zone is insecure, and 7126480faa8SDag-Erling Smørgrav * that has an NS record without signatures in cache. Remove the NS 7136480faa8SDag-Erling Smørgrav * record since the reply does not hinge on that record (in the authority 7146480faa8SDag-Erling Smørgrav * section), but do not remove it if it removes the last record from the 7156480faa8SDag-Erling Smørgrav * answer+authority sections. 7166480faa8SDag-Erling Smørgrav * @param chase_reply: the chased reply, we have a key for this contents, 7176480faa8SDag-Erling Smørgrav * so we should have signatures for these rrsets and not having 7186480faa8SDag-Erling Smørgrav * signatures means it will be bogus. 7196480faa8SDag-Erling Smørgrav * @param orig_reply: original reply, remove NS from there as well because 7206480faa8SDag-Erling Smørgrav * we cannot mark the NS record as DNSSEC valid because it is not 7216480faa8SDag-Erling Smørgrav * validated by signatures. 7226480faa8SDag-Erling Smørgrav */ 7236480faa8SDag-Erling Smørgrav static void 7246480faa8SDag-Erling Smørgrav remove_spurious_authority(struct reply_info* chase_reply, 7256480faa8SDag-Erling Smørgrav struct reply_info* orig_reply) 7266480faa8SDag-Erling Smørgrav { 7276480faa8SDag-Erling Smørgrav size_t i, found = 0; 7286480faa8SDag-Erling Smørgrav int remove = 0; 7296480faa8SDag-Erling Smørgrav /* if no answer and only 1 auth RRset, do not remove that one */ 7306480faa8SDag-Erling Smørgrav if(chase_reply->an_numrrsets == 0 && chase_reply->ns_numrrsets == 1) 7316480faa8SDag-Erling Smørgrav return; 7326480faa8SDag-Erling Smørgrav /* search authority section for unsigned NS records */ 7336480faa8SDag-Erling Smørgrav for(i = chase_reply->an_numrrsets; 7346480faa8SDag-Erling Smørgrav i < chase_reply->an_numrrsets+chase_reply->ns_numrrsets; i++) { 7356480faa8SDag-Erling Smørgrav struct packed_rrset_data* d = (struct packed_rrset_data*) 7366480faa8SDag-Erling Smørgrav chase_reply->rrsets[i]->entry.data; 7376480faa8SDag-Erling Smørgrav if(ntohs(chase_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS 7386480faa8SDag-Erling Smørgrav && d->rrsig_count == 0) { 7396480faa8SDag-Erling Smørgrav found = i; 7406480faa8SDag-Erling Smørgrav remove = 1; 7416480faa8SDag-Erling Smørgrav break; 7426480faa8SDag-Erling Smørgrav } 7436480faa8SDag-Erling Smørgrav } 7446480faa8SDag-Erling Smørgrav /* see if we found the entry */ 7456480faa8SDag-Erling Smørgrav if(!remove) return; 7466480faa8SDag-Erling Smørgrav log_rrset_key(VERB_ALGO, "Removing spurious unsigned NS record " 7476480faa8SDag-Erling Smørgrav "(likely inserted by forwarder)", chase_reply->rrsets[found]); 7486480faa8SDag-Erling Smørgrav 7496480faa8SDag-Erling Smørgrav /* find rrset in orig_reply */ 7506480faa8SDag-Erling Smørgrav for(i = orig_reply->an_numrrsets; 7516480faa8SDag-Erling Smørgrav i < orig_reply->an_numrrsets+orig_reply->ns_numrrsets; i++) { 7526480faa8SDag-Erling Smørgrav if(ntohs(orig_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS 7536480faa8SDag-Erling Smørgrav && query_dname_compare(orig_reply->rrsets[i]->rk.dname, 7546480faa8SDag-Erling Smørgrav chase_reply->rrsets[found]->rk.dname) == 0) { 7556480faa8SDag-Erling Smørgrav /* remove from orig_msg */ 7566480faa8SDag-Erling Smørgrav val_reply_remove_auth(orig_reply, i); 7576480faa8SDag-Erling Smørgrav break; 7586480faa8SDag-Erling Smørgrav } 7596480faa8SDag-Erling Smørgrav } 7606480faa8SDag-Erling Smørgrav /* remove rrset from chase_reply */ 7616480faa8SDag-Erling Smørgrav val_reply_remove_auth(chase_reply, found); 7626480faa8SDag-Erling Smørgrav } 763b7579f77SDag-Erling Smørgrav 764b7579f77SDag-Erling Smørgrav /** 765b7579f77SDag-Erling Smørgrav * Given a "positive" response -- a response that contains an answer to the 766b7579f77SDag-Erling Smørgrav * question, and no CNAME chain, validate this response. 767b7579f77SDag-Erling Smørgrav * 768b7579f77SDag-Erling Smørgrav * The answer and authority RRsets must already be verified as secure. 769b7579f77SDag-Erling Smørgrav * 770b7579f77SDag-Erling Smørgrav * @param env: module env for verify. 771b7579f77SDag-Erling Smørgrav * @param ve: validator env for verify. 772b7579f77SDag-Erling Smørgrav * @param qchase: query that was made. 773b7579f77SDag-Erling Smørgrav * @param chase_reply: answer to that query to validate. 774b7579f77SDag-Erling Smørgrav * @param kkey: the key entry, which is trusted, and which matches 775b7579f77SDag-Erling Smørgrav * the signer of the answer. The key entry isgood(). 776b7579f77SDag-Erling Smørgrav */ 777b7579f77SDag-Erling Smørgrav static void 778b7579f77SDag-Erling Smørgrav validate_positive_response(struct module_env* env, struct val_env* ve, 779b7579f77SDag-Erling Smørgrav struct query_info* qchase, struct reply_info* chase_reply, 780b7579f77SDag-Erling Smørgrav struct key_entry_key* kkey) 781b7579f77SDag-Erling Smørgrav { 782b7579f77SDag-Erling Smørgrav uint8_t* wc = NULL; 78357bddd21SDag-Erling Smørgrav size_t wl; 78457bddd21SDag-Erling Smørgrav int wc_cached = 0; 785b7579f77SDag-Erling Smørgrav int wc_NSEC_ok = 0; 786b7579f77SDag-Erling Smørgrav int nsec3s_seen = 0; 787b7579f77SDag-Erling Smørgrav size_t i; 788b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* s; 789b7579f77SDag-Erling Smørgrav 790b7579f77SDag-Erling Smørgrav /* validate the ANSWER section - this will be the answer itself */ 791b7579f77SDag-Erling Smørgrav for(i=0; i<chase_reply->an_numrrsets; i++) { 792b7579f77SDag-Erling Smørgrav s = chase_reply->rrsets[i]; 793b7579f77SDag-Erling Smørgrav 794b7579f77SDag-Erling Smørgrav /* Check to see if the rrset is the result of a wildcard 795b7579f77SDag-Erling Smørgrav * expansion. If so, an additional check will need to be 796b7579f77SDag-Erling Smørgrav * made in the authority section. */ 79757bddd21SDag-Erling Smørgrav if(!val_rrset_wildcard(s, &wc, &wl)) { 798b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_QUERY, "Positive response has " 799b7579f77SDag-Erling Smørgrav "inconsistent wildcard sigs:", s->rk.dname, 800b7579f77SDag-Erling Smørgrav ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 801b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 802b7579f77SDag-Erling Smørgrav return; 803b7579f77SDag-Erling Smørgrav } 80457bddd21SDag-Erling Smørgrav if(wc && !wc_cached && env->cfg->aggressive_nsec) { 80557bddd21SDag-Erling Smørgrav rrset_cache_update_wildcard(env->rrset_cache, s, wc, wl, 80657bddd21SDag-Erling Smørgrav env->alloc, *env->now); 80757bddd21SDag-Erling Smørgrav wc_cached = 1; 80857bddd21SDag-Erling Smørgrav } 80957bddd21SDag-Erling Smørgrav 810b7579f77SDag-Erling Smørgrav } 811b7579f77SDag-Erling Smørgrav 812b7579f77SDag-Erling Smørgrav /* validate the AUTHORITY section as well - this will generally be 813b7579f77SDag-Erling Smørgrav * the NS rrset (which could be missing, no problem) */ 814b7579f77SDag-Erling Smørgrav for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 815b7579f77SDag-Erling Smørgrav chase_reply->ns_numrrsets; i++) { 816b7579f77SDag-Erling Smørgrav s = chase_reply->rrsets[i]; 817b7579f77SDag-Erling Smørgrav 818b7579f77SDag-Erling Smørgrav /* If this is a positive wildcard response, and we have a 819b7579f77SDag-Erling Smørgrav * (just verified) NSEC record, try to use it to 1) prove 820b7579f77SDag-Erling Smørgrav * that qname doesn't exist and 2) that the correct wildcard 821b7579f77SDag-Erling Smørgrav * was used. */ 822b7579f77SDag-Erling Smørgrav if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 823b7579f77SDag-Erling Smørgrav if(val_nsec_proves_positive_wildcard(s, qchase, wc)) { 824b7579f77SDag-Erling Smørgrav wc_NSEC_ok = 1; 825b7579f77SDag-Erling Smørgrav } 826b7579f77SDag-Erling Smørgrav /* if not, continue looking for proof */ 827b7579f77SDag-Erling Smørgrav } 828b7579f77SDag-Erling Smørgrav 829b7579f77SDag-Erling Smørgrav /* Otherwise, if this is a positive wildcard response and 830b7579f77SDag-Erling Smørgrav * we have NSEC3 records */ 831b7579f77SDag-Erling Smørgrav if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 832b7579f77SDag-Erling Smørgrav nsec3s_seen = 1; 833b7579f77SDag-Erling Smørgrav } 834b7579f77SDag-Erling Smørgrav } 835b7579f77SDag-Erling Smørgrav 836b7579f77SDag-Erling Smørgrav /* If this was a positive wildcard response that we haven't already 837b7579f77SDag-Erling Smørgrav * proven, and we have NSEC3 records, try to prove it using the NSEC3 838b7579f77SDag-Erling Smørgrav * records. */ 839b7579f77SDag-Erling Smørgrav if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) { 840b7579f77SDag-Erling Smørgrav enum sec_status sec = nsec3_prove_wildcard(env, ve, 841b7579f77SDag-Erling Smørgrav chase_reply->rrsets+chase_reply->an_numrrsets, 842b7579f77SDag-Erling Smørgrav chase_reply->ns_numrrsets, qchase, kkey, wc); 843b7579f77SDag-Erling Smørgrav if(sec == sec_status_insecure) { 844b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Positive wildcard response is " 845b7579f77SDag-Erling Smørgrav "insecure"); 846b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_insecure; 847b7579f77SDag-Erling Smørgrav return; 848b7579f77SDag-Erling Smørgrav } else if(sec == sec_status_secure) 849b7579f77SDag-Erling Smørgrav wc_NSEC_ok = 1; 850b7579f77SDag-Erling Smørgrav } 851b7579f77SDag-Erling Smørgrav 852b7579f77SDag-Erling Smørgrav /* If after all this, we still haven't proven the positive wildcard 853b7579f77SDag-Erling Smørgrav * response, fail. */ 854b7579f77SDag-Erling Smørgrav if(wc != NULL && !wc_NSEC_ok) { 855b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "positive response was wildcard " 856b7579f77SDag-Erling Smørgrav "expansion and did not prove original data " 857b7579f77SDag-Erling Smørgrav "did not exist"); 858b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 859b7579f77SDag-Erling Smørgrav return; 860b7579f77SDag-Erling Smørgrav } 861b7579f77SDag-Erling Smørgrav 862b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Successfully validated positive response"); 863b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_secure; 864b7579f77SDag-Erling Smørgrav } 865b7579f77SDag-Erling Smørgrav 866b7579f77SDag-Erling Smørgrav /** 867b7579f77SDag-Erling Smørgrav * Validate a NOERROR/NODATA signed response -- a response that has a 868b7579f77SDag-Erling Smørgrav * NOERROR Rcode but no ANSWER section RRsets. This consists of making 869b7579f77SDag-Erling Smørgrav * certain that the authority section NSEC/NSEC3s proves that the qname 870b7579f77SDag-Erling Smørgrav * does exist and the qtype doesn't. 871b7579f77SDag-Erling Smørgrav * 872b7579f77SDag-Erling Smørgrav * The answer and authority RRsets must already be verified as secure. 873b7579f77SDag-Erling Smørgrav * 874b7579f77SDag-Erling Smørgrav * @param env: module env for verify. 875b7579f77SDag-Erling Smørgrav * @param ve: validator env for verify. 876b7579f77SDag-Erling Smørgrav * @param qchase: query that was made. 877b7579f77SDag-Erling Smørgrav * @param chase_reply: answer to that query to validate. 878b7579f77SDag-Erling Smørgrav * @param kkey: the key entry, which is trusted, and which matches 879b7579f77SDag-Erling Smørgrav * the signer of the answer. The key entry isgood(). 880b7579f77SDag-Erling Smørgrav */ 881b7579f77SDag-Erling Smørgrav static void 882b7579f77SDag-Erling Smørgrav validate_nodata_response(struct module_env* env, struct val_env* ve, 883b7579f77SDag-Erling Smørgrav struct query_info* qchase, struct reply_info* chase_reply, 884b7579f77SDag-Erling Smørgrav struct key_entry_key* kkey) 885b7579f77SDag-Erling Smørgrav { 886b7579f77SDag-Erling Smørgrav /* Since we are here, there must be nothing in the ANSWER section to 887b7579f77SDag-Erling Smørgrav * validate. */ 888b7579f77SDag-Erling Smørgrav /* (Note: CNAME/DNAME responses will not directly get here -- 88905ab2901SDag-Erling Smørgrav * instead, they are chased down into individual CNAME validations, 890b7579f77SDag-Erling Smørgrav * and at the end of the cname chain a POSITIVE, or CNAME_NOANSWER 891b7579f77SDag-Erling Smørgrav * validation.) */ 892b7579f77SDag-Erling Smørgrav 893b7579f77SDag-Erling Smørgrav /* validate the AUTHORITY section */ 894b7579f77SDag-Erling Smørgrav int has_valid_nsec = 0; /* If true, then the NODATA has been proven.*/ 895b7579f77SDag-Erling Smørgrav uint8_t* ce = NULL; /* for wildcard nodata responses. This is the 896b7579f77SDag-Erling Smørgrav proven closest encloser. */ 897b7579f77SDag-Erling Smørgrav uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */ 898b7579f77SDag-Erling Smørgrav int nsec3s_seen = 0; /* nsec3s seen */ 899b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* s; 900b7579f77SDag-Erling Smørgrav size_t i; 901b7579f77SDag-Erling Smørgrav 902b7579f77SDag-Erling Smørgrav for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 903b7579f77SDag-Erling Smørgrav chase_reply->ns_numrrsets; i++) { 904b7579f77SDag-Erling Smørgrav s = chase_reply->rrsets[i]; 905b7579f77SDag-Erling Smørgrav /* If we encounter an NSEC record, try to use it to prove 906b7579f77SDag-Erling Smørgrav * NODATA. 907b7579f77SDag-Erling Smørgrav * This needs to handle the ENT NODATA case. */ 908b7579f77SDag-Erling Smørgrav if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 909b7579f77SDag-Erling Smørgrav if(nsec_proves_nodata(s, qchase, &wc)) { 910b7579f77SDag-Erling Smørgrav has_valid_nsec = 1; 911b7579f77SDag-Erling Smørgrav /* sets wc-encloser if wildcard applicable */ 912b7579f77SDag-Erling Smørgrav } 913b7579f77SDag-Erling Smørgrav if(val_nsec_proves_name_error(s, qchase->qname)) { 914b7579f77SDag-Erling Smørgrav ce = nsec_closest_encloser(qchase->qname, s); 915b7579f77SDag-Erling Smørgrav } 916b7579f77SDag-Erling Smørgrav if(val_nsec_proves_insecuredelegation(s, qchase)) { 917b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "delegation is insecure"); 918b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_insecure; 919b7579f77SDag-Erling Smørgrav return; 920b7579f77SDag-Erling Smørgrav } 921b7579f77SDag-Erling Smørgrav } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 922b7579f77SDag-Erling Smørgrav nsec3s_seen = 1; 923b7579f77SDag-Erling Smørgrav } 924b7579f77SDag-Erling Smørgrav } 925b7579f77SDag-Erling Smørgrav 926b7579f77SDag-Erling Smørgrav /* check to see if we have a wildcard NODATA proof. */ 927b7579f77SDag-Erling Smørgrav 928b7579f77SDag-Erling Smørgrav /* The wildcard NODATA is 1 NSEC proving that qname does not exist 929b7579f77SDag-Erling Smørgrav * (and also proving what the closest encloser is), and 1 NSEC 930b7579f77SDag-Erling Smørgrav * showing the matching wildcard, which must be *.closest_encloser. */ 931b7579f77SDag-Erling Smørgrav if(wc && !ce) 932b7579f77SDag-Erling Smørgrav has_valid_nsec = 0; 933b7579f77SDag-Erling Smørgrav else if(wc && ce) { 934b7579f77SDag-Erling Smørgrav if(query_dname_compare(wc, ce) != 0) { 935b7579f77SDag-Erling Smørgrav has_valid_nsec = 0; 936b7579f77SDag-Erling Smørgrav } 937b7579f77SDag-Erling Smørgrav } 938b7579f77SDag-Erling Smørgrav 939b7579f77SDag-Erling Smørgrav if(!has_valid_nsec && nsec3s_seen) { 940b7579f77SDag-Erling Smørgrav enum sec_status sec = nsec3_prove_nodata(env, ve, 941b7579f77SDag-Erling Smørgrav chase_reply->rrsets+chase_reply->an_numrrsets, 942b7579f77SDag-Erling Smørgrav chase_reply->ns_numrrsets, qchase, kkey); 943b7579f77SDag-Erling Smørgrav if(sec == sec_status_insecure) { 944b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "NODATA response is insecure"); 945b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_insecure; 946b7579f77SDag-Erling Smørgrav return; 947b7579f77SDag-Erling Smørgrav } else if(sec == sec_status_secure) 948b7579f77SDag-Erling Smørgrav has_valid_nsec = 1; 949b7579f77SDag-Erling Smørgrav } 950b7579f77SDag-Erling Smørgrav 951b7579f77SDag-Erling Smørgrav if(!has_valid_nsec) { 952b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "NODATA response failed to prove NODATA " 953b7579f77SDag-Erling Smørgrav "status with NSEC/NSEC3"); 954b7579f77SDag-Erling Smørgrav if(verbosity >= VERB_ALGO) 955b7579f77SDag-Erling Smørgrav log_dns_msg("Failed NODATA", qchase, chase_reply); 956b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 957b7579f77SDag-Erling Smørgrav return; 958b7579f77SDag-Erling Smørgrav } 959b7579f77SDag-Erling Smørgrav 960b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "successfully validated NODATA response."); 961b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_secure; 962b7579f77SDag-Erling Smørgrav } 963b7579f77SDag-Erling Smørgrav 964b7579f77SDag-Erling Smørgrav /** 965b7579f77SDag-Erling Smørgrav * Validate a NAMEERROR signed response -- a response that has a NXDOMAIN 966b7579f77SDag-Erling Smørgrav * Rcode. 967b7579f77SDag-Erling Smørgrav * This consists of making certain that the authority section NSEC proves 968b7579f77SDag-Erling Smørgrav * that the qname doesn't exist and the covering wildcard also doesn't exist.. 969b7579f77SDag-Erling Smørgrav * 970b7579f77SDag-Erling Smørgrav * The answer and authority RRsets must have already been verified as secure. 971b7579f77SDag-Erling Smørgrav * 972b7579f77SDag-Erling Smørgrav * @param env: module env for verify. 973b7579f77SDag-Erling Smørgrav * @param ve: validator env for verify. 974b7579f77SDag-Erling Smørgrav * @param qchase: query that was made. 975b7579f77SDag-Erling Smørgrav * @param chase_reply: answer to that query to validate. 976b7579f77SDag-Erling Smørgrav * @param kkey: the key entry, which is trusted, and which matches 977b7579f77SDag-Erling Smørgrav * the signer of the answer. The key entry isgood(). 97817d15b25SDag-Erling Smørgrav * @param rcode: adjusted RCODE, in case of RCODE/proof mismatch leniency. 979b7579f77SDag-Erling Smørgrav */ 980b7579f77SDag-Erling Smørgrav static void 981b7579f77SDag-Erling Smørgrav validate_nameerror_response(struct module_env* env, struct val_env* ve, 982b7579f77SDag-Erling Smørgrav struct query_info* qchase, struct reply_info* chase_reply, 98317d15b25SDag-Erling Smørgrav struct key_entry_key* kkey, int* rcode) 984b7579f77SDag-Erling Smørgrav { 985b7579f77SDag-Erling Smørgrav int has_valid_nsec = 0; 986b7579f77SDag-Erling Smørgrav int has_valid_wnsec = 0; 987b7579f77SDag-Erling Smørgrav int nsec3s_seen = 0; 988b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* s; 989b7579f77SDag-Erling Smørgrav size_t i; 99057bddd21SDag-Erling Smørgrav uint8_t* ce; 99157bddd21SDag-Erling Smørgrav int ce_labs = 0; 99257bddd21SDag-Erling Smørgrav int prev_ce_labs = 0; 993b7579f77SDag-Erling Smørgrav 994b7579f77SDag-Erling Smørgrav for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 995b7579f77SDag-Erling Smørgrav chase_reply->ns_numrrsets; i++) { 996b7579f77SDag-Erling Smørgrav s = chase_reply->rrsets[i]; 997b7579f77SDag-Erling Smørgrav if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 998b7579f77SDag-Erling Smørgrav if(val_nsec_proves_name_error(s, qchase->qname)) 999b7579f77SDag-Erling Smørgrav has_valid_nsec = 1; 100057bddd21SDag-Erling Smørgrav ce = nsec_closest_encloser(qchase->qname, s); 100157bddd21SDag-Erling Smørgrav ce_labs = dname_count_labels(ce); 100257bddd21SDag-Erling Smørgrav /* Use longest closest encloser to prove wildcard. */ 100357bddd21SDag-Erling Smørgrav if(ce_labs > prev_ce_labs || 100457bddd21SDag-Erling Smørgrav (ce_labs == prev_ce_labs && 100557bddd21SDag-Erling Smørgrav has_valid_wnsec == 0)) { 1006b7579f77SDag-Erling Smørgrav if(val_nsec_proves_no_wc(s, qchase->qname, 1007b7579f77SDag-Erling Smørgrav qchase->qname_len)) 1008b7579f77SDag-Erling Smørgrav has_valid_wnsec = 1; 100957bddd21SDag-Erling Smørgrav else 101057bddd21SDag-Erling Smørgrav has_valid_wnsec = 0; 101157bddd21SDag-Erling Smørgrav } 101257bddd21SDag-Erling Smørgrav prev_ce_labs = ce_labs; 1013b7579f77SDag-Erling Smørgrav if(val_nsec_proves_insecuredelegation(s, qchase)) { 1014b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "delegation is insecure"); 1015b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_insecure; 1016b7579f77SDag-Erling Smørgrav return; 1017b7579f77SDag-Erling Smørgrav } 1018b7579f77SDag-Erling Smørgrav } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) 1019b7579f77SDag-Erling Smørgrav nsec3s_seen = 1; 1020b7579f77SDag-Erling Smørgrav } 1021b7579f77SDag-Erling Smørgrav 1022b7579f77SDag-Erling Smørgrav if((!has_valid_nsec || !has_valid_wnsec) && nsec3s_seen) { 1023b7579f77SDag-Erling Smørgrav /* use NSEC3 proof, both answer and auth rrsets, in case 1024b7579f77SDag-Erling Smørgrav * NSEC3s end up in the answer (due to qtype=NSEC3 or so) */ 1025b7579f77SDag-Erling Smørgrav chase_reply->security = nsec3_prove_nameerror(env, ve, 1026b7579f77SDag-Erling Smørgrav chase_reply->rrsets, chase_reply->an_numrrsets+ 1027b7579f77SDag-Erling Smørgrav chase_reply->ns_numrrsets, qchase, kkey); 1028b7579f77SDag-Erling Smørgrav if(chase_reply->security != sec_status_secure) { 1029b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "NameError response failed nsec, " 1030b7579f77SDag-Erling Smørgrav "nsec3 proof was %s", sec_status_to_string( 1031b7579f77SDag-Erling Smørgrav chase_reply->security)); 1032b7579f77SDag-Erling Smørgrav return; 1033b7579f77SDag-Erling Smørgrav } 1034b7579f77SDag-Erling Smørgrav has_valid_nsec = 1; 1035b7579f77SDag-Erling Smørgrav has_valid_wnsec = 1; 1036b7579f77SDag-Erling Smørgrav } 1037b7579f77SDag-Erling Smørgrav 1038b7579f77SDag-Erling Smørgrav /* If the message fails to prove either condition, it is bogus. */ 1039b7579f77SDag-Erling Smørgrav if(!has_valid_nsec) { 1040b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "NameError response has failed to prove: " 1041b7579f77SDag-Erling Smørgrav "qname does not exist"); 1042b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 104317d15b25SDag-Erling Smørgrav /* Be lenient with RCODE in NSEC NameError responses */ 104417d15b25SDag-Erling Smørgrav validate_nodata_response(env, ve, qchase, chase_reply, kkey); 104517d15b25SDag-Erling Smørgrav if (chase_reply->security == sec_status_secure) 104617d15b25SDag-Erling Smørgrav *rcode = LDNS_RCODE_NOERROR; 1047b7579f77SDag-Erling Smørgrav return; 1048b7579f77SDag-Erling Smørgrav } 1049b7579f77SDag-Erling Smørgrav 1050b7579f77SDag-Erling Smørgrav if(!has_valid_wnsec) { 1051b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "NameError response has failed to prove: " 1052b7579f77SDag-Erling Smørgrav "covering wildcard does not exist"); 1053b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 105417d15b25SDag-Erling Smørgrav /* Be lenient with RCODE in NSEC NameError responses */ 105517d15b25SDag-Erling Smørgrav validate_nodata_response(env, ve, qchase, chase_reply, kkey); 105617d15b25SDag-Erling Smørgrav if (chase_reply->security == sec_status_secure) 105717d15b25SDag-Erling Smørgrav *rcode = LDNS_RCODE_NOERROR; 1058b7579f77SDag-Erling Smørgrav return; 1059b7579f77SDag-Erling Smørgrav } 1060b7579f77SDag-Erling Smørgrav 1061b7579f77SDag-Erling Smørgrav /* Otherwise, we consider the message secure. */ 1062b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "successfully validated NAME ERROR response."); 1063b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_secure; 1064b7579f77SDag-Erling Smørgrav } 1065b7579f77SDag-Erling Smørgrav 1066b7579f77SDag-Erling Smørgrav /** 1067b7579f77SDag-Erling Smørgrav * Given a referral response, validate rrsets and take least trusted rrset 1068b7579f77SDag-Erling Smørgrav * as the current validation status. 1069b7579f77SDag-Erling Smørgrav * 1070b7579f77SDag-Erling Smørgrav * Note that by the time this method is called, the process of finding the 1071b7579f77SDag-Erling Smørgrav * trusted DNSKEY rrset that signs this response must already have been 1072b7579f77SDag-Erling Smørgrav * completed. 1073b7579f77SDag-Erling Smørgrav * 1074b7579f77SDag-Erling Smørgrav * @param chase_reply: answer to validate. 1075b7579f77SDag-Erling Smørgrav */ 1076b7579f77SDag-Erling Smørgrav static void 1077b7579f77SDag-Erling Smørgrav validate_referral_response(struct reply_info* chase_reply) 1078b7579f77SDag-Erling Smørgrav { 1079b7579f77SDag-Erling Smørgrav size_t i; 1080b7579f77SDag-Erling Smørgrav enum sec_status s; 1081b7579f77SDag-Erling Smørgrav /* message security equals lowest rrset security */ 1082b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_secure; 1083b7579f77SDag-Erling Smørgrav for(i=0; i<chase_reply->rrset_count; i++) { 1084b7579f77SDag-Erling Smørgrav s = ((struct packed_rrset_data*)chase_reply->rrsets[i] 1085b7579f77SDag-Erling Smørgrav ->entry.data)->security; 1086b7579f77SDag-Erling Smørgrav if(s < chase_reply->security) 1087b7579f77SDag-Erling Smørgrav chase_reply->security = s; 1088b7579f77SDag-Erling Smørgrav } 1089b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "validated part of referral response as %s", 1090b7579f77SDag-Erling Smørgrav sec_status_to_string(chase_reply->security)); 1091b7579f77SDag-Erling Smørgrav } 1092b7579f77SDag-Erling Smørgrav 1093b7579f77SDag-Erling Smørgrav /** 1094b7579f77SDag-Erling Smørgrav * Given an "ANY" response -- a response that contains an answer to a 1095b7579f77SDag-Erling Smørgrav * qtype==ANY question, with answers. This does no checking that all 1096b7579f77SDag-Erling Smørgrav * types are present. 1097b7579f77SDag-Erling Smørgrav * 1098b7579f77SDag-Erling Smørgrav * NOTE: it may be possible to get parent-side delegation point records 1099b7579f77SDag-Erling Smørgrav * here, which won't all be signed. Right now, this routine relies on the 1100b7579f77SDag-Erling Smørgrav * upstream iterative resolver to not return these responses -- instead 1101b7579f77SDag-Erling Smørgrav * treating them as referrals. 1102b7579f77SDag-Erling Smørgrav * 1103b7579f77SDag-Erling Smørgrav * NOTE: RFC 4035 is silent on this issue, so this may change upon 1104b7579f77SDag-Erling Smørgrav * clarification. Clarification draft -05 says to not check all types are 1105b7579f77SDag-Erling Smørgrav * present. 1106b7579f77SDag-Erling Smørgrav * 1107b7579f77SDag-Erling Smørgrav * Note that by the time this method is called, the process of finding the 1108b7579f77SDag-Erling Smørgrav * trusted DNSKEY rrset that signs this response must already have been 1109b7579f77SDag-Erling Smørgrav * completed. 1110b7579f77SDag-Erling Smørgrav * 1111b7579f77SDag-Erling Smørgrav * @param env: module env for verify. 1112b7579f77SDag-Erling Smørgrav * @param ve: validator env for verify. 1113b7579f77SDag-Erling Smørgrav * @param qchase: query that was made. 1114b7579f77SDag-Erling Smørgrav * @param chase_reply: answer to that query to validate. 1115b7579f77SDag-Erling Smørgrav * @param kkey: the key entry, which is trusted, and which matches 1116b7579f77SDag-Erling Smørgrav * the signer of the answer. The key entry isgood(). 1117b7579f77SDag-Erling Smørgrav */ 1118b7579f77SDag-Erling Smørgrav static void 1119b7579f77SDag-Erling Smørgrav validate_any_response(struct module_env* env, struct val_env* ve, 1120b7579f77SDag-Erling Smørgrav struct query_info* qchase, struct reply_info* chase_reply, 1121b7579f77SDag-Erling Smørgrav struct key_entry_key* kkey) 1122b7579f77SDag-Erling Smørgrav { 1123b7579f77SDag-Erling Smørgrav /* all answer and auth rrsets already verified */ 1124b7579f77SDag-Erling Smørgrav /* but check if a wildcard response is given, then check NSEC/NSEC3 1125b7579f77SDag-Erling Smørgrav * for qname denial to see if wildcard is applicable */ 1126b7579f77SDag-Erling Smørgrav uint8_t* wc = NULL; 112757bddd21SDag-Erling Smørgrav size_t wl; 1128b7579f77SDag-Erling Smørgrav int wc_NSEC_ok = 0; 1129b7579f77SDag-Erling Smørgrav int nsec3s_seen = 0; 1130b7579f77SDag-Erling Smørgrav size_t i; 1131b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* s; 1132b7579f77SDag-Erling Smørgrav 1133b7579f77SDag-Erling Smørgrav if(qchase->qtype != LDNS_RR_TYPE_ANY) { 1134b7579f77SDag-Erling Smørgrav log_err("internal error: ANY validation called for non-ANY"); 1135b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 1136b7579f77SDag-Erling Smørgrav return; 1137b7579f77SDag-Erling Smørgrav } 1138b7579f77SDag-Erling Smørgrav 1139b7579f77SDag-Erling Smørgrav /* validate the ANSWER section - this will be the answer itself */ 1140b7579f77SDag-Erling Smørgrav for(i=0; i<chase_reply->an_numrrsets; i++) { 1141b7579f77SDag-Erling Smørgrav s = chase_reply->rrsets[i]; 1142b7579f77SDag-Erling Smørgrav 1143b7579f77SDag-Erling Smørgrav /* Check to see if the rrset is the result of a wildcard 1144b7579f77SDag-Erling Smørgrav * expansion. If so, an additional check will need to be 1145b7579f77SDag-Erling Smørgrav * made in the authority section. */ 114657bddd21SDag-Erling Smørgrav if(!val_rrset_wildcard(s, &wc, &wl)) { 1147b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_QUERY, "Positive ANY response" 1148b7579f77SDag-Erling Smørgrav " has inconsistent wildcard sigs:", 1149b7579f77SDag-Erling Smørgrav s->rk.dname, ntohs(s->rk.type), 1150b7579f77SDag-Erling Smørgrav ntohs(s->rk.rrset_class)); 1151b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 1152b7579f77SDag-Erling Smørgrav return; 1153b7579f77SDag-Erling Smørgrav } 1154b7579f77SDag-Erling Smørgrav } 1155b7579f77SDag-Erling Smørgrav 1156b7579f77SDag-Erling Smørgrav /* if it was a wildcard, check for NSEC/NSEC3s in both answer 1157b7579f77SDag-Erling Smørgrav * and authority sections (NSEC may be moved to the ANSWER section) */ 1158b7579f77SDag-Erling Smørgrav if(wc != NULL) 1159b7579f77SDag-Erling Smørgrav for(i=0; i<chase_reply->an_numrrsets+chase_reply->ns_numrrsets; 1160b7579f77SDag-Erling Smørgrav i++) { 1161b7579f77SDag-Erling Smørgrav s = chase_reply->rrsets[i]; 1162b7579f77SDag-Erling Smørgrav 1163b7579f77SDag-Erling Smørgrav /* If this is a positive wildcard response, and we have a 1164b7579f77SDag-Erling Smørgrav * (just verified) NSEC record, try to use it to 1) prove 1165b7579f77SDag-Erling Smørgrav * that qname doesn't exist and 2) that the correct wildcard 1166b7579f77SDag-Erling Smørgrav * was used. */ 1167b7579f77SDag-Erling Smørgrav if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 1168b7579f77SDag-Erling Smørgrav if(val_nsec_proves_positive_wildcard(s, qchase, wc)) { 1169b7579f77SDag-Erling Smørgrav wc_NSEC_ok = 1; 1170b7579f77SDag-Erling Smørgrav } 1171b7579f77SDag-Erling Smørgrav /* if not, continue looking for proof */ 1172b7579f77SDag-Erling Smørgrav } 1173b7579f77SDag-Erling Smørgrav 1174b7579f77SDag-Erling Smørgrav /* Otherwise, if this is a positive wildcard response and 1175b7579f77SDag-Erling Smørgrav * we have NSEC3 records */ 1176b7579f77SDag-Erling Smørgrav if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 1177b7579f77SDag-Erling Smørgrav nsec3s_seen = 1; 1178b7579f77SDag-Erling Smørgrav } 1179b7579f77SDag-Erling Smørgrav } 1180b7579f77SDag-Erling Smørgrav 1181b7579f77SDag-Erling Smørgrav /* If this was a positive wildcard response that we haven't already 1182b7579f77SDag-Erling Smørgrav * proven, and we have NSEC3 records, try to prove it using the NSEC3 1183b7579f77SDag-Erling Smørgrav * records. */ 1184b7579f77SDag-Erling Smørgrav if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) { 1185b7579f77SDag-Erling Smørgrav /* look both in answer and auth section for NSEC3s */ 1186b7579f77SDag-Erling Smørgrav enum sec_status sec = nsec3_prove_wildcard(env, ve, 1187b7579f77SDag-Erling Smørgrav chase_reply->rrsets, 1188b7579f77SDag-Erling Smørgrav chase_reply->an_numrrsets+chase_reply->ns_numrrsets, 1189b7579f77SDag-Erling Smørgrav qchase, kkey, wc); 1190b7579f77SDag-Erling Smørgrav if(sec == sec_status_insecure) { 1191b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Positive ANY wildcard response is " 1192b7579f77SDag-Erling Smørgrav "insecure"); 1193b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_insecure; 1194b7579f77SDag-Erling Smørgrav return; 1195b7579f77SDag-Erling Smørgrav } else if(sec == sec_status_secure) 1196b7579f77SDag-Erling Smørgrav wc_NSEC_ok = 1; 1197b7579f77SDag-Erling Smørgrav } 1198b7579f77SDag-Erling Smørgrav 1199b7579f77SDag-Erling Smørgrav /* If after all this, we still haven't proven the positive wildcard 1200b7579f77SDag-Erling Smørgrav * response, fail. */ 1201b7579f77SDag-Erling Smørgrav if(wc != NULL && !wc_NSEC_ok) { 1202b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "positive ANY response was wildcard " 1203b7579f77SDag-Erling Smørgrav "expansion and did not prove original data " 1204b7579f77SDag-Erling Smørgrav "did not exist"); 1205b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 1206b7579f77SDag-Erling Smørgrav return; 1207b7579f77SDag-Erling Smørgrav } 1208b7579f77SDag-Erling Smørgrav 1209b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Successfully validated positive ANY response"); 1210b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_secure; 1211b7579f77SDag-Erling Smørgrav } 1212b7579f77SDag-Erling Smørgrav 1213b7579f77SDag-Erling Smørgrav /** 1214b7579f77SDag-Erling Smørgrav * Validate CNAME response, or DNAME+CNAME. 1215b7579f77SDag-Erling Smørgrav * This is just like a positive proof, except that this is about a 1216b7579f77SDag-Erling Smørgrav * DNAME+CNAME. Possible wildcard proof. 1217b7579f77SDag-Erling Smørgrav * Difference with positive proof is that this routine refuses 1218b7579f77SDag-Erling Smørgrav * wildcarded DNAMEs. 1219b7579f77SDag-Erling Smørgrav * 1220b7579f77SDag-Erling Smørgrav * The answer and authority rrsets must already be verified as secure. 1221b7579f77SDag-Erling Smørgrav * 1222b7579f77SDag-Erling Smørgrav * @param env: module env for verify. 1223b7579f77SDag-Erling Smørgrav * @param ve: validator env for verify. 1224b7579f77SDag-Erling Smørgrav * @param qchase: query that was made. 1225b7579f77SDag-Erling Smørgrav * @param chase_reply: answer to that query to validate. 1226b7579f77SDag-Erling Smørgrav * @param kkey: the key entry, which is trusted, and which matches 1227b7579f77SDag-Erling Smørgrav * the signer of the answer. The key entry isgood(). 1228b7579f77SDag-Erling Smørgrav */ 1229b7579f77SDag-Erling Smørgrav static void 1230b7579f77SDag-Erling Smørgrav validate_cname_response(struct module_env* env, struct val_env* ve, 1231b7579f77SDag-Erling Smørgrav struct query_info* qchase, struct reply_info* chase_reply, 1232b7579f77SDag-Erling Smørgrav struct key_entry_key* kkey) 1233b7579f77SDag-Erling Smørgrav { 1234b7579f77SDag-Erling Smørgrav uint8_t* wc = NULL; 123557bddd21SDag-Erling Smørgrav size_t wl; 1236b7579f77SDag-Erling Smørgrav int wc_NSEC_ok = 0; 1237b7579f77SDag-Erling Smørgrav int nsec3s_seen = 0; 1238b7579f77SDag-Erling Smørgrav size_t i; 1239b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* s; 1240b7579f77SDag-Erling Smørgrav 1241b7579f77SDag-Erling Smørgrav /* validate the ANSWER section - this will be the CNAME (+DNAME) */ 1242b7579f77SDag-Erling Smørgrav for(i=0; i<chase_reply->an_numrrsets; i++) { 1243b7579f77SDag-Erling Smørgrav s = chase_reply->rrsets[i]; 1244b7579f77SDag-Erling Smørgrav 1245b7579f77SDag-Erling Smørgrav /* Check to see if the rrset is the result of a wildcard 1246b7579f77SDag-Erling Smørgrav * expansion. If so, an additional check will need to be 1247b7579f77SDag-Erling Smørgrav * made in the authority section. */ 124857bddd21SDag-Erling Smørgrav if(!val_rrset_wildcard(s, &wc, &wl)) { 1249b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_QUERY, "Cname response has " 1250b7579f77SDag-Erling Smørgrav "inconsistent wildcard sigs:", s->rk.dname, 1251b7579f77SDag-Erling Smørgrav ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 1252b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 1253b7579f77SDag-Erling Smørgrav return; 1254b7579f77SDag-Erling Smørgrav } 1255b7579f77SDag-Erling Smørgrav 1256b7579f77SDag-Erling Smørgrav /* Refuse wildcarded DNAMEs rfc 4597. 1257b7579f77SDag-Erling Smørgrav * Do not follow a wildcarded DNAME because 1258b7579f77SDag-Erling Smørgrav * its synthesized CNAME expansion is underdefined */ 1259b7579f77SDag-Erling Smørgrav if(qchase->qtype != LDNS_RR_TYPE_DNAME && 1260b7579f77SDag-Erling Smørgrav ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME && wc) { 1261b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_QUERY, "cannot validate a " 1262b7579f77SDag-Erling Smørgrav "wildcarded DNAME:", s->rk.dname, 1263b7579f77SDag-Erling Smørgrav ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 1264b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 1265b7579f77SDag-Erling Smørgrav return; 1266b7579f77SDag-Erling Smørgrav } 12678ed2b524SDag-Erling Smørgrav 12688ed2b524SDag-Erling Smørgrav /* If we have found a CNAME, stop looking for one. 12698ed2b524SDag-Erling Smørgrav * The iterator has placed the CNAME chain in correct 12708ed2b524SDag-Erling Smørgrav * order. */ 12718ed2b524SDag-Erling Smørgrav if (ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) { 12728ed2b524SDag-Erling Smørgrav break; 12738ed2b524SDag-Erling Smørgrav } 1274b7579f77SDag-Erling Smørgrav } 1275b7579f77SDag-Erling Smørgrav 1276b7579f77SDag-Erling Smørgrav /* AUTHORITY section */ 1277b7579f77SDag-Erling Smørgrav for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 1278b7579f77SDag-Erling Smørgrav chase_reply->ns_numrrsets; i++) { 1279b7579f77SDag-Erling Smørgrav s = chase_reply->rrsets[i]; 1280b7579f77SDag-Erling Smørgrav 1281b7579f77SDag-Erling Smørgrav /* If this is a positive wildcard response, and we have a 1282b7579f77SDag-Erling Smørgrav * (just verified) NSEC record, try to use it to 1) prove 1283b7579f77SDag-Erling Smørgrav * that qname doesn't exist and 2) that the correct wildcard 1284b7579f77SDag-Erling Smørgrav * was used. */ 1285b7579f77SDag-Erling Smørgrav if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 1286b7579f77SDag-Erling Smørgrav if(val_nsec_proves_positive_wildcard(s, qchase, wc)) { 1287b7579f77SDag-Erling Smørgrav wc_NSEC_ok = 1; 1288b7579f77SDag-Erling Smørgrav } 1289b7579f77SDag-Erling Smørgrav /* if not, continue looking for proof */ 1290b7579f77SDag-Erling Smørgrav } 1291b7579f77SDag-Erling Smørgrav 1292b7579f77SDag-Erling Smørgrav /* Otherwise, if this is a positive wildcard response and 1293b7579f77SDag-Erling Smørgrav * we have NSEC3 records */ 1294b7579f77SDag-Erling Smørgrav if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 1295b7579f77SDag-Erling Smørgrav nsec3s_seen = 1; 1296b7579f77SDag-Erling Smørgrav } 1297b7579f77SDag-Erling Smørgrav } 1298b7579f77SDag-Erling Smørgrav 1299b7579f77SDag-Erling Smørgrav /* If this was a positive wildcard response that we haven't already 1300b7579f77SDag-Erling Smørgrav * proven, and we have NSEC3 records, try to prove it using the NSEC3 1301b7579f77SDag-Erling Smørgrav * records. */ 1302b7579f77SDag-Erling Smørgrav if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) { 1303b7579f77SDag-Erling Smørgrav enum sec_status sec = nsec3_prove_wildcard(env, ve, 1304b7579f77SDag-Erling Smørgrav chase_reply->rrsets+chase_reply->an_numrrsets, 1305b7579f77SDag-Erling Smørgrav chase_reply->ns_numrrsets, qchase, kkey, wc); 1306b7579f77SDag-Erling Smørgrav if(sec == sec_status_insecure) { 1307b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "wildcard CNAME response is " 1308b7579f77SDag-Erling Smørgrav "insecure"); 1309b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_insecure; 1310b7579f77SDag-Erling Smørgrav return; 1311b7579f77SDag-Erling Smørgrav } else if(sec == sec_status_secure) 1312b7579f77SDag-Erling Smørgrav wc_NSEC_ok = 1; 1313b7579f77SDag-Erling Smørgrav } 1314b7579f77SDag-Erling Smørgrav 1315b7579f77SDag-Erling Smørgrav /* If after all this, we still haven't proven the positive wildcard 1316b7579f77SDag-Erling Smørgrav * response, fail. */ 1317b7579f77SDag-Erling Smørgrav if(wc != NULL && !wc_NSEC_ok) { 1318b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "CNAME response was wildcard " 1319b7579f77SDag-Erling Smørgrav "expansion and did not prove original data " 1320b7579f77SDag-Erling Smørgrav "did not exist"); 1321b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 1322b7579f77SDag-Erling Smørgrav return; 1323b7579f77SDag-Erling Smørgrav } 1324b7579f77SDag-Erling Smørgrav 1325b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Successfully validated CNAME response"); 1326b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_secure; 1327b7579f77SDag-Erling Smørgrav } 1328b7579f77SDag-Erling Smørgrav 1329b7579f77SDag-Erling Smørgrav /** 1330b7579f77SDag-Erling Smørgrav * Validate CNAME NOANSWER response, no more data after a CNAME chain. 1331b7579f77SDag-Erling Smørgrav * This can be a NODATA or a NAME ERROR case, but not both at the same time. 1332b7579f77SDag-Erling Smørgrav * We don't know because the rcode has been set to NOERROR by the CNAME. 1333b7579f77SDag-Erling Smørgrav * 1334b7579f77SDag-Erling Smørgrav * The answer and authority rrsets must already be verified as secure. 1335b7579f77SDag-Erling Smørgrav * 1336b7579f77SDag-Erling Smørgrav * @param env: module env for verify. 1337b7579f77SDag-Erling Smørgrav * @param ve: validator env for verify. 1338b7579f77SDag-Erling Smørgrav * @param qchase: query that was made. 1339b7579f77SDag-Erling Smørgrav * @param chase_reply: answer to that query to validate. 1340b7579f77SDag-Erling Smørgrav * @param kkey: the key entry, which is trusted, and which matches 1341b7579f77SDag-Erling Smørgrav * the signer of the answer. The key entry isgood(). 1342b7579f77SDag-Erling Smørgrav */ 1343b7579f77SDag-Erling Smørgrav static void 1344b7579f77SDag-Erling Smørgrav validate_cname_noanswer_response(struct module_env* env, struct val_env* ve, 1345b7579f77SDag-Erling Smørgrav struct query_info* qchase, struct reply_info* chase_reply, 1346b7579f77SDag-Erling Smørgrav struct key_entry_key* kkey) 1347b7579f77SDag-Erling Smørgrav { 1348b7579f77SDag-Erling Smørgrav int nodata_valid_nsec = 0; /* If true, then NODATA has been proven.*/ 1349b7579f77SDag-Erling Smørgrav uint8_t* ce = NULL; /* for wildcard nodata responses. This is the 1350b7579f77SDag-Erling Smørgrav proven closest encloser. */ 1351b7579f77SDag-Erling Smørgrav uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */ 13528a384985SDag-Erling Smørgrav int nxdomain_valid_nsec = 0; /* if true, nameerror has been proven */ 1353b7579f77SDag-Erling Smørgrav int nxdomain_valid_wnsec = 0; 1354b7579f77SDag-Erling Smørgrav int nsec3s_seen = 0; /* nsec3s seen */ 1355b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* s; 1356b7579f77SDag-Erling Smørgrav size_t i; 135757bddd21SDag-Erling Smørgrav uint8_t* nsec_ce; /* Used to find the NSEC with the longest ce */ 135857bddd21SDag-Erling Smørgrav int ce_labs = 0; 135957bddd21SDag-Erling Smørgrav int prev_ce_labs = 0; 1360b7579f77SDag-Erling Smørgrav 1361b7579f77SDag-Erling Smørgrav /* the AUTHORITY section */ 1362b7579f77SDag-Erling Smørgrav for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 1363b7579f77SDag-Erling Smørgrav chase_reply->ns_numrrsets; i++) { 1364b7579f77SDag-Erling Smørgrav s = chase_reply->rrsets[i]; 1365b7579f77SDag-Erling Smørgrav 1366b7579f77SDag-Erling Smørgrav /* If we encounter an NSEC record, try to use it to prove 1367b7579f77SDag-Erling Smørgrav * NODATA. This needs to handle the ENT NODATA case. 1368b7579f77SDag-Erling Smørgrav * Also try to prove NAMEERROR, and absence of a wildcard */ 1369b7579f77SDag-Erling Smørgrav if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 1370b7579f77SDag-Erling Smørgrav if(nsec_proves_nodata(s, qchase, &wc)) { 1371b7579f77SDag-Erling Smørgrav nodata_valid_nsec = 1; 1372b7579f77SDag-Erling Smørgrav /* set wc encloser if wildcard applicable */ 1373b7579f77SDag-Erling Smørgrav } 1374b7579f77SDag-Erling Smørgrav if(val_nsec_proves_name_error(s, qchase->qname)) { 1375b7579f77SDag-Erling Smørgrav ce = nsec_closest_encloser(qchase->qname, s); 1376b7579f77SDag-Erling Smørgrav nxdomain_valid_nsec = 1; 1377b7579f77SDag-Erling Smørgrav } 137857bddd21SDag-Erling Smørgrav nsec_ce = nsec_closest_encloser(qchase->qname, s); 137957bddd21SDag-Erling Smørgrav ce_labs = dname_count_labels(nsec_ce); 138057bddd21SDag-Erling Smørgrav /* Use longest closest encloser to prove wildcard. */ 138157bddd21SDag-Erling Smørgrav if(ce_labs > prev_ce_labs || 138257bddd21SDag-Erling Smørgrav (ce_labs == prev_ce_labs && 138357bddd21SDag-Erling Smørgrav nxdomain_valid_wnsec == 0)) { 1384b7579f77SDag-Erling Smørgrav if(val_nsec_proves_no_wc(s, qchase->qname, 1385b7579f77SDag-Erling Smørgrav qchase->qname_len)) 1386b7579f77SDag-Erling Smørgrav nxdomain_valid_wnsec = 1; 138757bddd21SDag-Erling Smørgrav else 138857bddd21SDag-Erling Smørgrav nxdomain_valid_wnsec = 0; 138957bddd21SDag-Erling Smørgrav } 139057bddd21SDag-Erling Smørgrav prev_ce_labs = ce_labs; 1391b7579f77SDag-Erling Smørgrav if(val_nsec_proves_insecuredelegation(s, qchase)) { 1392b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "delegation is insecure"); 1393b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_insecure; 1394b7579f77SDag-Erling Smørgrav return; 1395b7579f77SDag-Erling Smørgrav } 1396b7579f77SDag-Erling Smørgrav } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 1397b7579f77SDag-Erling Smørgrav nsec3s_seen = 1; 1398b7579f77SDag-Erling Smørgrav } 1399b7579f77SDag-Erling Smørgrav } 1400b7579f77SDag-Erling Smørgrav 1401b7579f77SDag-Erling Smørgrav /* check to see if we have a wildcard NODATA proof. */ 1402b7579f77SDag-Erling Smørgrav 1403b7579f77SDag-Erling Smørgrav /* The wildcard NODATA is 1 NSEC proving that qname does not exists 1404b7579f77SDag-Erling Smørgrav * (and also proving what the closest encloser is), and 1 NSEC 1405b7579f77SDag-Erling Smørgrav * showing the matching wildcard, which must be *.closest_encloser. */ 1406b7579f77SDag-Erling Smørgrav if(wc && !ce) 1407b7579f77SDag-Erling Smørgrav nodata_valid_nsec = 0; 1408b7579f77SDag-Erling Smørgrav else if(wc && ce) { 1409b7579f77SDag-Erling Smørgrav if(query_dname_compare(wc, ce) != 0) { 1410b7579f77SDag-Erling Smørgrav nodata_valid_nsec = 0; 1411b7579f77SDag-Erling Smørgrav } 1412b7579f77SDag-Erling Smørgrav } 1413b7579f77SDag-Erling Smørgrav if(nxdomain_valid_nsec && !nxdomain_valid_wnsec) { 1414b7579f77SDag-Erling Smørgrav /* name error is missing wildcard denial proof */ 1415b7579f77SDag-Erling Smørgrav nxdomain_valid_nsec = 0; 1416b7579f77SDag-Erling Smørgrav } 1417b7579f77SDag-Erling Smørgrav 1418b7579f77SDag-Erling Smørgrav if(nodata_valid_nsec && nxdomain_valid_nsec) { 1419b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "CNAMEchain to noanswer proves that name " 1420b7579f77SDag-Erling Smørgrav "exists and not exists, bogus"); 1421b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 1422b7579f77SDag-Erling Smørgrav return; 1423b7579f77SDag-Erling Smørgrav } 1424b7579f77SDag-Erling Smørgrav if(!nodata_valid_nsec && !nxdomain_valid_nsec && nsec3s_seen) { 1425b7579f77SDag-Erling Smørgrav int nodata; 1426b7579f77SDag-Erling Smørgrav enum sec_status sec = nsec3_prove_nxornodata(env, ve, 1427b7579f77SDag-Erling Smørgrav chase_reply->rrsets+chase_reply->an_numrrsets, 1428b7579f77SDag-Erling Smørgrav chase_reply->ns_numrrsets, qchase, kkey, &nodata); 1429b7579f77SDag-Erling Smørgrav if(sec == sec_status_insecure) { 1430b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "CNAMEchain to noanswer response " 1431b7579f77SDag-Erling Smørgrav "is insecure"); 1432b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_insecure; 1433b7579f77SDag-Erling Smørgrav return; 1434b7579f77SDag-Erling Smørgrav } else if(sec == sec_status_secure) { 1435b7579f77SDag-Erling Smørgrav if(nodata) 1436b7579f77SDag-Erling Smørgrav nodata_valid_nsec = 1; 1437b7579f77SDag-Erling Smørgrav else nxdomain_valid_nsec = 1; 1438b7579f77SDag-Erling Smørgrav } 1439b7579f77SDag-Erling Smørgrav } 1440b7579f77SDag-Erling Smørgrav 1441b7579f77SDag-Erling Smørgrav if(!nodata_valid_nsec && !nxdomain_valid_nsec) { 1442b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "CNAMEchain to noanswer response failed " 1443b7579f77SDag-Erling Smørgrav "to prove status with NSEC/NSEC3"); 1444b7579f77SDag-Erling Smørgrav if(verbosity >= VERB_ALGO) 1445b7579f77SDag-Erling Smørgrav log_dns_msg("Failed CNAMEnoanswer", qchase, chase_reply); 1446b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_bogus; 1447b7579f77SDag-Erling Smørgrav return; 1448b7579f77SDag-Erling Smørgrav } 1449b7579f77SDag-Erling Smørgrav 1450b7579f77SDag-Erling Smørgrav if(nodata_valid_nsec) 1451b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "successfully validated CNAME chain to a " 1452b7579f77SDag-Erling Smørgrav "NODATA response."); 1453b7579f77SDag-Erling Smørgrav else verbose(VERB_ALGO, "successfully validated CNAME chain to a " 1454b7579f77SDag-Erling Smørgrav "NAMEERROR response."); 1455b7579f77SDag-Erling Smørgrav chase_reply->security = sec_status_secure; 1456b7579f77SDag-Erling Smørgrav } 1457b7579f77SDag-Erling Smørgrav 1458b7579f77SDag-Erling Smørgrav /** 1459b7579f77SDag-Erling Smørgrav * Process init state for validator. 1460b7579f77SDag-Erling Smørgrav * Process the INIT state. First tier responses start in the INIT state. 1461b7579f77SDag-Erling Smørgrav * This is where they are vetted for validation suitability, and the initial 1462b7579f77SDag-Erling Smørgrav * key search is done. 1463b7579f77SDag-Erling Smørgrav * 1464b7579f77SDag-Erling Smørgrav * Currently, events the come through this routine will be either promoted 1465b7579f77SDag-Erling Smørgrav * to FINISHED/CNAME_RESP (no validation needed), FINDKEY (next step to 1466b7579f77SDag-Erling Smørgrav * validation), or will be (temporarily) retired and a new priming request 1467b7579f77SDag-Erling Smørgrav * event will be generated. 1468b7579f77SDag-Erling Smørgrav * 1469b7579f77SDag-Erling Smørgrav * @param qstate: query state. 1470b7579f77SDag-Erling Smørgrav * @param vq: validator query state. 1471b7579f77SDag-Erling Smørgrav * @param ve: validator shared global environment. 1472b7579f77SDag-Erling Smørgrav * @param id: module id. 1473b7579f77SDag-Erling Smørgrav * @return true if the event should be processed further on return, false if 1474b7579f77SDag-Erling Smørgrav * not. 1475b7579f77SDag-Erling Smørgrav */ 1476b7579f77SDag-Erling Smørgrav static int 1477b7579f77SDag-Erling Smørgrav processInit(struct module_qstate* qstate, struct val_qstate* vq, 1478b7579f77SDag-Erling Smørgrav struct val_env* ve, int id) 1479b7579f77SDag-Erling Smørgrav { 1480b7579f77SDag-Erling Smørgrav uint8_t* lookup_name; 1481b7579f77SDag-Erling Smørgrav size_t lookup_len; 1482b7579f77SDag-Erling Smørgrav struct trust_anchor* anchor; 1483b7579f77SDag-Erling Smørgrav enum val_classification subtype = val_classify_response( 1484b7579f77SDag-Erling Smørgrav qstate->query_flags, &qstate->qinfo, &vq->qchase, 1485b7579f77SDag-Erling Smørgrav vq->orig_msg->rep, vq->rrset_skip); 1486b7579f77SDag-Erling Smørgrav if(vq->restart_count > VAL_MAX_RESTART_COUNT) { 1487b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "restart count exceeded"); 1488b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 1489b7579f77SDag-Erling Smørgrav } 1490b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "validator classification %s", 1491b7579f77SDag-Erling Smørgrav val_classification_to_string(subtype)); 1492b7579f77SDag-Erling Smørgrav if(subtype == VAL_CLASS_REFERRAL && 1493b7579f77SDag-Erling Smørgrav vq->rrset_skip < vq->orig_msg->rep->rrset_count) { 1494b7579f77SDag-Erling Smørgrav /* referral uses the rrset name as qchase, to find keys for 1495b7579f77SDag-Erling Smørgrav * that rrset */ 1496b7579f77SDag-Erling Smørgrav vq->qchase.qname = vq->orig_msg->rep-> 1497b7579f77SDag-Erling Smørgrav rrsets[vq->rrset_skip]->rk.dname; 1498b7579f77SDag-Erling Smørgrav vq->qchase.qname_len = vq->orig_msg->rep-> 1499b7579f77SDag-Erling Smørgrav rrsets[vq->rrset_skip]->rk.dname_len; 1500b7579f77SDag-Erling Smørgrav vq->qchase.qtype = ntohs(vq->orig_msg->rep-> 1501b7579f77SDag-Erling Smørgrav rrsets[vq->rrset_skip]->rk.type); 1502b7579f77SDag-Erling Smørgrav vq->qchase.qclass = ntohs(vq->orig_msg->rep-> 1503b7579f77SDag-Erling Smørgrav rrsets[vq->rrset_skip]->rk.rrset_class); 1504b7579f77SDag-Erling Smørgrav } 1505b7579f77SDag-Erling Smørgrav lookup_name = vq->qchase.qname; 1506b7579f77SDag-Erling Smørgrav lookup_len = vq->qchase.qname_len; 1507b7579f77SDag-Erling Smørgrav /* for type DS look at the parent side for keys/trustanchor */ 1508b7579f77SDag-Erling Smørgrav /* also for NSEC not at apex */ 1509b7579f77SDag-Erling Smørgrav if(vq->qchase.qtype == LDNS_RR_TYPE_DS || 1510b7579f77SDag-Erling Smørgrav (vq->qchase.qtype == LDNS_RR_TYPE_NSEC && 1511b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->rrset_count > vq->rrset_skip && 1512b7579f77SDag-Erling Smørgrav ntohs(vq->orig_msg->rep->rrsets[vq->rrset_skip]->rk.type) == 1513b7579f77SDag-Erling Smørgrav LDNS_RR_TYPE_NSEC && 1514b7579f77SDag-Erling Smørgrav !(vq->orig_msg->rep->rrsets[vq->rrset_skip]-> 1515b7579f77SDag-Erling Smørgrav rk.flags&PACKED_RRSET_NSEC_AT_APEX))) { 1516b7579f77SDag-Erling Smørgrav dname_remove_label(&lookup_name, &lookup_len); 1517b7579f77SDag-Erling Smørgrav } 1518b7579f77SDag-Erling Smørgrav 1519b7579f77SDag-Erling Smørgrav val_mark_indeterminate(vq->chase_reply, qstate->env->anchors, 1520b7579f77SDag-Erling Smørgrav qstate->env->rrset_cache, qstate->env); 1521b7579f77SDag-Erling Smørgrav vq->key_entry = NULL; 1522b7579f77SDag-Erling Smørgrav vq->empty_DS_name = NULL; 1523b7579f77SDag-Erling Smørgrav vq->ds_rrset = 0; 1524b7579f77SDag-Erling Smørgrav anchor = anchors_lookup(qstate->env->anchors, 1525b7579f77SDag-Erling Smørgrav lookup_name, lookup_len, vq->qchase.qclass); 1526b7579f77SDag-Erling Smørgrav 1527b7579f77SDag-Erling Smørgrav /* Determine the signer/lookup name */ 1528b7579f77SDag-Erling Smørgrav val_find_signer(subtype, &vq->qchase, vq->orig_msg->rep, 1529b7579f77SDag-Erling Smørgrav vq->rrset_skip, &vq->signer_name, &vq->signer_len); 1530b7579f77SDag-Erling Smørgrav if(vq->signer_name != NULL && 1531b7579f77SDag-Erling Smørgrav !dname_subdomain_c(lookup_name, vq->signer_name)) { 1532b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "this signer name is not a parent " 1533b7579f77SDag-Erling Smørgrav "of lookupname, omitted", vq->signer_name, 0, 0); 1534b7579f77SDag-Erling Smørgrav vq->signer_name = NULL; 1535b7579f77SDag-Erling Smørgrav } 1536b7579f77SDag-Erling Smørgrav if(vq->signer_name == NULL) { 1537b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "no signer, using", lookup_name, 1538b7579f77SDag-Erling Smørgrav 0, 0); 1539b7579f77SDag-Erling Smørgrav } else { 1540b7579f77SDag-Erling Smørgrav lookup_name = vq->signer_name; 1541b7579f77SDag-Erling Smørgrav lookup_len = vq->signer_len; 1542b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "signer is", lookup_name, 0, 0); 1543b7579f77SDag-Erling Smørgrav } 1544b7579f77SDag-Erling Smørgrav 1545b7579f77SDag-Erling Smørgrav /* for NXDOMAIN it could be signed by a parent of the trust anchor */ 1546b7579f77SDag-Erling Smørgrav if(subtype == VAL_CLASS_NAMEERROR && vq->signer_name && 1547b7579f77SDag-Erling Smørgrav anchor && dname_strict_subdomain_c(anchor->name, lookup_name)){ 1548b7579f77SDag-Erling Smørgrav lock_basic_unlock(&anchor->lock); 1549b7579f77SDag-Erling Smørgrav anchor = anchors_lookup(qstate->env->anchors, 1550b7579f77SDag-Erling Smørgrav lookup_name, lookup_len, vq->qchase.qclass); 1551b7579f77SDag-Erling Smørgrav if(!anchor) { /* unsigned parent denies anchor*/ 1552b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "unsigned parent zone denies" 1553b7579f77SDag-Erling Smørgrav " trust anchor, indeterminate"); 1554b7579f77SDag-Erling Smørgrav vq->chase_reply->security = sec_status_indeterminate; 1555b7579f77SDag-Erling Smørgrav vq->state = VAL_FINISHED_STATE; 1556b7579f77SDag-Erling Smørgrav return 1; 1557b7579f77SDag-Erling Smørgrav } 1558b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "trust anchor NXDOMAIN by signed parent"); 1559b7579f77SDag-Erling Smørgrav } else if(subtype == VAL_CLASS_POSITIVE && 1560b7579f77SDag-Erling Smørgrav qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY && 1561b7579f77SDag-Erling Smørgrav query_dname_compare(lookup_name, qstate->qinfo.qname) == 0) { 1562b7579f77SDag-Erling Smørgrav /* is a DNSKEY so lookup a bit higher since we want to 1563b7579f77SDag-Erling Smørgrav * get it from a parent or from trustanchor */ 1564b7579f77SDag-Erling Smørgrav dname_remove_label(&lookup_name, &lookup_len); 1565b7579f77SDag-Erling Smørgrav } 1566b7579f77SDag-Erling Smørgrav 1567b7579f77SDag-Erling Smørgrav if(vq->rrset_skip > 0 || subtype == VAL_CLASS_CNAME || 1568b7579f77SDag-Erling Smørgrav subtype == VAL_CLASS_REFERRAL) { 1569b7579f77SDag-Erling Smørgrav /* extract this part of orig_msg into chase_reply for 1570b7579f77SDag-Erling Smørgrav * the eventual VALIDATE stage */ 1571b7579f77SDag-Erling Smørgrav val_fill_reply(vq->chase_reply, vq->orig_msg->rep, 1572b7579f77SDag-Erling Smørgrav vq->rrset_skip, lookup_name, lookup_len, 1573b7579f77SDag-Erling Smørgrav vq->signer_name); 1574b7579f77SDag-Erling Smørgrav if(verbosity >= VERB_ALGO) 1575b7579f77SDag-Erling Smørgrav log_dns_msg("chased extract", &vq->qchase, 1576b7579f77SDag-Erling Smørgrav vq->chase_reply); 1577b7579f77SDag-Erling Smørgrav } 1578b7579f77SDag-Erling Smørgrav 1579b7579f77SDag-Erling Smørgrav vq->key_entry = key_cache_obtain(ve->kcache, lookup_name, lookup_len, 1580b7579f77SDag-Erling Smørgrav vq->qchase.qclass, qstate->region, *qstate->env->now); 1581b7579f77SDag-Erling Smørgrav 1582b7579f77SDag-Erling Smørgrav /* there is no key(from DLV) and no trust anchor */ 1583b7579f77SDag-Erling Smørgrav if(vq->key_entry == NULL && anchor == NULL) { 1584b7579f77SDag-Erling Smørgrav /*response isn't under a trust anchor, so we cannot validate.*/ 1585b7579f77SDag-Erling Smørgrav vq->chase_reply->security = sec_status_indeterminate; 1586b7579f77SDag-Erling Smørgrav /* go to finished state to cache this result */ 1587b7579f77SDag-Erling Smørgrav vq->state = VAL_FINISHED_STATE; 1588b7579f77SDag-Erling Smørgrav return 1; 1589b7579f77SDag-Erling Smørgrav } 1590b7579f77SDag-Erling Smørgrav /* if not key, or if keyentry is *above* the trustanchor, i.e. 1591b7579f77SDag-Erling Smørgrav * the keyentry is based on another (higher) trustanchor */ 1592b7579f77SDag-Erling Smørgrav else if(vq->key_entry == NULL || (anchor && 1593b7579f77SDag-Erling Smørgrav dname_strict_subdomain_c(anchor->name, vq->key_entry->name))) { 1594b7579f77SDag-Erling Smørgrav /* trust anchor is an 'unsigned' trust anchor */ 1595b7579f77SDag-Erling Smørgrav if(anchor && anchor->numDS == 0 && anchor->numDNSKEY == 0) { 1596b7579f77SDag-Erling Smørgrav vq->chase_reply->security = sec_status_insecure; 1597b7579f77SDag-Erling Smørgrav val_mark_insecure(vq->chase_reply, anchor->name, 1598b7579f77SDag-Erling Smørgrav qstate->env->rrset_cache, qstate->env); 1599b7579f77SDag-Erling Smørgrav lock_basic_unlock(&anchor->lock); 1600b7579f77SDag-Erling Smørgrav vq->dlv_checked=1; /* skip DLV check */ 1601b7579f77SDag-Erling Smørgrav /* go to finished state to cache this result */ 1602b7579f77SDag-Erling Smørgrav vq->state = VAL_FINISHED_STATE; 1603b7579f77SDag-Erling Smørgrav return 1; 1604b7579f77SDag-Erling Smørgrav } 1605b7579f77SDag-Erling Smørgrav /* fire off a trust anchor priming query. */ 1606b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "prime trust anchor"); 1607b7579f77SDag-Erling Smørgrav if(!prime_trust_anchor(qstate, vq, id, anchor)) { 1608b7579f77SDag-Erling Smørgrav lock_basic_unlock(&anchor->lock); 1609b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 1610b7579f77SDag-Erling Smørgrav } 1611b7579f77SDag-Erling Smørgrav lock_basic_unlock(&anchor->lock); 1612b7579f77SDag-Erling Smørgrav /* and otherwise, don't continue processing this event. 1613b7579f77SDag-Erling Smørgrav * (it will be reactivated when the priming query returns). */ 1614b7579f77SDag-Erling Smørgrav vq->state = VAL_FINDKEY_STATE; 1615b7579f77SDag-Erling Smørgrav return 0; 1616b7579f77SDag-Erling Smørgrav } 1617b7579f77SDag-Erling Smørgrav if(anchor) { 1618b7579f77SDag-Erling Smørgrav lock_basic_unlock(&anchor->lock); 1619b7579f77SDag-Erling Smørgrav } 1620b7579f77SDag-Erling Smørgrav 1621b7579f77SDag-Erling Smørgrav if(key_entry_isnull(vq->key_entry)) { 1622b7579f77SDag-Erling Smørgrav /* response is under a null key, so we cannot validate 1623b7579f77SDag-Erling Smørgrav * However, we do set the status to INSECURE, since it is 1624b7579f77SDag-Erling Smørgrav * essentially proven insecure. */ 1625b7579f77SDag-Erling Smørgrav vq->chase_reply->security = sec_status_insecure; 1626b7579f77SDag-Erling Smørgrav val_mark_insecure(vq->chase_reply, vq->key_entry->name, 1627b7579f77SDag-Erling Smørgrav qstate->env->rrset_cache, qstate->env); 1628b7579f77SDag-Erling Smørgrav /* go to finished state to cache this result */ 1629b7579f77SDag-Erling Smørgrav vq->state = VAL_FINISHED_STATE; 1630b7579f77SDag-Erling Smørgrav return 1; 1631b7579f77SDag-Erling Smørgrav } else if(key_entry_isbad(vq->key_entry)) { 1632b7579f77SDag-Erling Smørgrav /* key is bad, chain is bad, reply is bogus */ 1633b7579f77SDag-Erling Smørgrav errinf_dname(qstate, "key for validation", vq->key_entry->name); 1634b7579f77SDag-Erling Smørgrav errinf(qstate, "is marked as invalid"); 1635b7579f77SDag-Erling Smørgrav if(key_entry_get_reason(vq->key_entry)) { 1636b7579f77SDag-Erling Smørgrav errinf(qstate, "because of a previous"); 1637b7579f77SDag-Erling Smørgrav errinf(qstate, key_entry_get_reason(vq->key_entry)); 1638b7579f77SDag-Erling Smørgrav } 1639b7579f77SDag-Erling Smørgrav /* no retries, stop bothering the authority until timeout */ 1640b7579f77SDag-Erling Smørgrav vq->restart_count = VAL_MAX_RESTART_COUNT; 1641b7579f77SDag-Erling Smørgrav vq->chase_reply->security = sec_status_bogus; 1642b7579f77SDag-Erling Smørgrav vq->state = VAL_FINISHED_STATE; 1643b7579f77SDag-Erling Smørgrav return 1; 1644b7579f77SDag-Erling Smørgrav } 1645b7579f77SDag-Erling Smørgrav 1646b7579f77SDag-Erling Smørgrav /* otherwise, we have our "closest" cached key -- continue 1647b7579f77SDag-Erling Smørgrav * processing in the next state. */ 1648b7579f77SDag-Erling Smørgrav vq->state = VAL_FINDKEY_STATE; 1649b7579f77SDag-Erling Smørgrav return 1; 1650b7579f77SDag-Erling Smørgrav } 1651b7579f77SDag-Erling Smørgrav 1652b7579f77SDag-Erling Smørgrav /** 1653b7579f77SDag-Erling Smørgrav * Process the FINDKEY state. Generally this just calculates the next name 1654b7579f77SDag-Erling Smørgrav * to query and either issues a DS or a DNSKEY query. It will check to see 1655b7579f77SDag-Erling Smørgrav * if the correct key has already been reached, in which case it will 1656b7579f77SDag-Erling Smørgrav * advance the event to the next state. 1657b7579f77SDag-Erling Smørgrav * 1658b7579f77SDag-Erling Smørgrav * @param qstate: query state. 1659b7579f77SDag-Erling Smørgrav * @param vq: validator query state. 1660b7579f77SDag-Erling Smørgrav * @param id: module id. 1661b7579f77SDag-Erling Smørgrav * @return true if the event should be processed further on return, false if 1662b7579f77SDag-Erling Smørgrav * not. 1663b7579f77SDag-Erling Smørgrav */ 1664b7579f77SDag-Erling Smørgrav static int 1665b7579f77SDag-Erling Smørgrav processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id) 1666b7579f77SDag-Erling Smørgrav { 1667b7579f77SDag-Erling Smørgrav uint8_t* target_key_name, *current_key_name; 1668b7579f77SDag-Erling Smørgrav size_t target_key_len; 1669b7579f77SDag-Erling Smørgrav int strip_lab; 1670c7f4d7adSDag-Erling Smørgrav struct module_qstate* newq = NULL; 1671b7579f77SDag-Erling Smørgrav 1672b7579f77SDag-Erling Smørgrav log_query_info(VERB_ALGO, "validator: FindKey", &vq->qchase); 1673b7579f77SDag-Erling Smørgrav /* We know that state.key_entry is not 0 or bad key -- if it were, 1674b7579f77SDag-Erling Smørgrav * then previous processing should have directed this event to 1675b7579f77SDag-Erling Smørgrav * a different state. 1676b7579f77SDag-Erling Smørgrav * It could be an isnull key, which signals that a DLV was just 1677b7579f77SDag-Erling Smørgrav * done and the DNSKEY after the DLV failed with dnssec-retry state 1678b7579f77SDag-Erling Smørgrav * and the DNSKEY has to be performed again. */ 1679b7579f77SDag-Erling Smørgrav log_assert(vq->key_entry && !key_entry_isbad(vq->key_entry)); 1680b7579f77SDag-Erling Smørgrav if(key_entry_isnull(vq->key_entry)) { 1681b7579f77SDag-Erling Smørgrav if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 1682b7579f77SDag-Erling Smørgrav vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 1683c7f4d7adSDag-Erling Smørgrav vq->qchase.qclass, BIT_CD, &newq, 0)) { 1684*4c75e3aaSDag-Erling Smørgrav verbose(VERB_ALGO, "error generating DNSKEY request"); 1685b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 1686b7579f77SDag-Erling Smørgrav } 1687b7579f77SDag-Erling Smørgrav return 0; 1688b7579f77SDag-Erling Smørgrav } 1689b7579f77SDag-Erling Smørgrav 1690b7579f77SDag-Erling Smørgrav target_key_name = vq->signer_name; 1691b7579f77SDag-Erling Smørgrav target_key_len = vq->signer_len; 1692b7579f77SDag-Erling Smørgrav if(!target_key_name) { 1693b7579f77SDag-Erling Smørgrav target_key_name = vq->qchase.qname; 1694b7579f77SDag-Erling Smørgrav target_key_len = vq->qchase.qname_len; 1695b7579f77SDag-Erling Smørgrav } 1696b7579f77SDag-Erling Smørgrav 1697b7579f77SDag-Erling Smørgrav current_key_name = vq->key_entry->name; 1698b7579f77SDag-Erling Smørgrav 1699b7579f77SDag-Erling Smørgrav /* If our current key entry matches our target, then we are done. */ 1700b7579f77SDag-Erling Smørgrav if(query_dname_compare(target_key_name, current_key_name) == 0) { 1701b7579f77SDag-Erling Smørgrav vq->state = VAL_VALIDATE_STATE; 1702b7579f77SDag-Erling Smørgrav return 1; 1703b7579f77SDag-Erling Smørgrav } 1704b7579f77SDag-Erling Smørgrav 1705b7579f77SDag-Erling Smørgrav if(vq->empty_DS_name) { 1706b7579f77SDag-Erling Smørgrav /* if the last empty nonterminal/emptyDS name we detected is 1707b7579f77SDag-Erling Smørgrav * below the current key, use that name to make progress 1708b7579f77SDag-Erling Smørgrav * along the chain of trust */ 1709b7579f77SDag-Erling Smørgrav if(query_dname_compare(target_key_name, 1710b7579f77SDag-Erling Smørgrav vq->empty_DS_name) == 0) { 1711b7579f77SDag-Erling Smørgrav /* do not query for empty_DS_name again */ 1712b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Cannot retrieve DS for signature"); 1713b7579f77SDag-Erling Smørgrav errinf(qstate, "no signatures"); 1714b7579f77SDag-Erling Smørgrav errinf_origin(qstate, qstate->reply_origin); 1715b7579f77SDag-Erling Smørgrav vq->chase_reply->security = sec_status_bogus; 1716b7579f77SDag-Erling Smørgrav vq->state = VAL_FINISHED_STATE; 1717b7579f77SDag-Erling Smørgrav return 1; 1718b7579f77SDag-Erling Smørgrav } 1719b7579f77SDag-Erling Smørgrav current_key_name = vq->empty_DS_name; 1720b7579f77SDag-Erling Smørgrav } 1721b7579f77SDag-Erling Smørgrav 1722b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "current keyname", current_key_name, 1723b7579f77SDag-Erling Smørgrav LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN); 1724b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "target keyname", target_key_name, 1725b7579f77SDag-Erling Smørgrav LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN); 1726b7579f77SDag-Erling Smørgrav /* assert we are walking down the DNS tree */ 1727b7579f77SDag-Erling Smørgrav if(!dname_subdomain_c(target_key_name, current_key_name)) { 1728b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "bad signer name"); 1729b7579f77SDag-Erling Smørgrav vq->chase_reply->security = sec_status_bogus; 1730b7579f77SDag-Erling Smørgrav vq->state = VAL_FINISHED_STATE; 1731b7579f77SDag-Erling Smørgrav return 1; 1732b7579f77SDag-Erling Smørgrav } 1733b7579f77SDag-Erling Smørgrav /* so this value is >= -1 */ 1734b7579f77SDag-Erling Smørgrav strip_lab = dname_count_labels(target_key_name) - 1735b7579f77SDag-Erling Smørgrav dname_count_labels(current_key_name) - 1; 1736b7579f77SDag-Erling Smørgrav log_assert(strip_lab >= -1); 1737b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "striplab %d", strip_lab); 1738b7579f77SDag-Erling Smørgrav if(strip_lab > 0) { 1739b7579f77SDag-Erling Smørgrav dname_remove_labels(&target_key_name, &target_key_len, 1740b7579f77SDag-Erling Smørgrav strip_lab); 1741b7579f77SDag-Erling Smørgrav } 1742b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "next keyname", target_key_name, 1743b7579f77SDag-Erling Smørgrav LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN); 1744b7579f77SDag-Erling Smørgrav 1745b7579f77SDag-Erling Smørgrav /* The next step is either to query for the next DS, or to query 1746b7579f77SDag-Erling Smørgrav * for the next DNSKEY. */ 1747b7579f77SDag-Erling Smørgrav if(vq->ds_rrset) 1748b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "DS RRset", vq->ds_rrset->rk.dname, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN); 1749b7579f77SDag-Erling Smørgrav else verbose(VERB_ALGO, "No DS RRset"); 1750b7579f77SDag-Erling Smørgrav 1751b7579f77SDag-Erling Smørgrav if(vq->ds_rrset && query_dname_compare(vq->ds_rrset->rk.dname, 1752b7579f77SDag-Erling Smørgrav vq->key_entry->name) != 0) { 1753b7579f77SDag-Erling Smørgrav if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 1754b7579f77SDag-Erling Smørgrav vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 1755c7f4d7adSDag-Erling Smørgrav vq->qchase.qclass, BIT_CD, &newq, 0)) { 1756*4c75e3aaSDag-Erling Smørgrav verbose(VERB_ALGO, "error generating DNSKEY request"); 1757b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 1758b7579f77SDag-Erling Smørgrav } 1759b7579f77SDag-Erling Smørgrav return 0; 1760b7579f77SDag-Erling Smørgrav } 1761b7579f77SDag-Erling Smørgrav 1762b7579f77SDag-Erling Smørgrav if(!vq->ds_rrset || query_dname_compare(vq->ds_rrset->rk.dname, 1763b7579f77SDag-Erling Smørgrav target_key_name) != 0) { 1764b7579f77SDag-Erling Smørgrav /* check if there is a cache entry : pick up an NSEC if 1765b7579f77SDag-Erling Smørgrav * there is no DS, check if that NSEC has DS-bit unset, and 176605ab2901SDag-Erling Smørgrav * thus can disprove the secure delegation we seek. 1767b7579f77SDag-Erling Smørgrav * We can then use that NSEC even in the absence of a SOA 1768b7579f77SDag-Erling Smørgrav * record that would be required by the iterator to supply 1769b7579f77SDag-Erling Smørgrav * a completely protocol-correct response. 1770b7579f77SDag-Erling Smørgrav * Uses negative cache for NSEC3 lookup of DS responses. */ 1771b7579f77SDag-Erling Smørgrav /* only if cache not blacklisted, of course */ 1772b7579f77SDag-Erling Smørgrav struct dns_msg* msg; 1773b7579f77SDag-Erling Smørgrav if(!qstate->blacklist && !vq->chain_blacklist && 1774b7579f77SDag-Erling Smørgrav (msg=val_find_DS(qstate->env, target_key_name, 1775b7579f77SDag-Erling Smørgrav target_key_len, vq->qchase.qclass, qstate->region, 1776b7579f77SDag-Erling Smørgrav vq->key_entry->name)) ) { 1777b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Process cached DS response"); 1778b7579f77SDag-Erling Smørgrav process_ds_response(qstate, vq, id, LDNS_RCODE_NOERROR, 1779b7579f77SDag-Erling Smørgrav msg, &msg->qinfo, NULL); 1780b7579f77SDag-Erling Smørgrav return 1; /* continue processing ds-response results */ 1781b7579f77SDag-Erling Smørgrav } 1782b7579f77SDag-Erling Smørgrav if(!generate_request(qstate, id, target_key_name, 1783b7579f77SDag-Erling Smørgrav target_key_len, LDNS_RR_TYPE_DS, vq->qchase.qclass, 1784c7f4d7adSDag-Erling Smørgrav BIT_CD, &newq, 0)) { 1785*4c75e3aaSDag-Erling Smørgrav verbose(VERB_ALGO, "error generating DS request"); 1786b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 1787b7579f77SDag-Erling Smørgrav } 1788b7579f77SDag-Erling Smørgrav return 0; 1789b7579f77SDag-Erling Smørgrav } 1790b7579f77SDag-Erling Smørgrav 1791b7579f77SDag-Erling Smørgrav /* Otherwise, it is time to query for the DNSKEY */ 1792b7579f77SDag-Erling Smørgrav if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 1793b7579f77SDag-Erling Smørgrav vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 1794c7f4d7adSDag-Erling Smørgrav vq->qchase.qclass, BIT_CD, &newq, 0)) { 1795*4c75e3aaSDag-Erling Smørgrav verbose(VERB_ALGO, "error generating DNSKEY request"); 1796b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 1797b7579f77SDag-Erling Smørgrav } 1798b7579f77SDag-Erling Smørgrav 1799b7579f77SDag-Erling Smørgrav return 0; 1800b7579f77SDag-Erling Smørgrav } 1801b7579f77SDag-Erling Smørgrav 1802b7579f77SDag-Erling Smørgrav /** 1803b7579f77SDag-Erling Smørgrav * Process the VALIDATE stage, the init and findkey stages are finished, 1804b7579f77SDag-Erling Smørgrav * and the right keys are available to validate the response. 1805b7579f77SDag-Erling Smørgrav * Or, there are no keys available, in order to invalidate the response. 1806b7579f77SDag-Erling Smørgrav * 1807b7579f77SDag-Erling Smørgrav * After validation, the status is recorded in the message and rrsets, 1808b7579f77SDag-Erling Smørgrav * and finished state is started. 1809b7579f77SDag-Erling Smørgrav * 1810b7579f77SDag-Erling Smørgrav * @param qstate: query state. 1811b7579f77SDag-Erling Smørgrav * @param vq: validator query state. 1812b7579f77SDag-Erling Smørgrav * @param ve: validator shared global environment. 1813b7579f77SDag-Erling Smørgrav * @param id: module id. 1814b7579f77SDag-Erling Smørgrav * @return true if the event should be processed further on return, false if 1815b7579f77SDag-Erling Smørgrav * not. 1816b7579f77SDag-Erling Smørgrav */ 1817b7579f77SDag-Erling Smørgrav static int 1818b7579f77SDag-Erling Smørgrav processValidate(struct module_qstate* qstate, struct val_qstate* vq, 1819b7579f77SDag-Erling Smørgrav struct val_env* ve, int id) 1820b7579f77SDag-Erling Smørgrav { 1821b7579f77SDag-Erling Smørgrav enum val_classification subtype; 182217d15b25SDag-Erling Smørgrav int rcode; 1823b7579f77SDag-Erling Smørgrav 1824b7579f77SDag-Erling Smørgrav if(!vq->key_entry) { 1825b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "validate: no key entry, failed"); 1826b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 1827b7579f77SDag-Erling Smørgrav } 1828b7579f77SDag-Erling Smørgrav 1829b7579f77SDag-Erling Smørgrav /* This is the default next state. */ 1830b7579f77SDag-Erling Smørgrav vq->state = VAL_FINISHED_STATE; 1831b7579f77SDag-Erling Smørgrav 1832b7579f77SDag-Erling Smørgrav /* Unsigned responses must be underneath a "null" key entry.*/ 1833b7579f77SDag-Erling Smørgrav if(key_entry_isnull(vq->key_entry)) { 1834b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "Verified that %sresponse is INSECURE", 1835b7579f77SDag-Erling Smørgrav vq->signer_name?"":"unsigned "); 1836b7579f77SDag-Erling Smørgrav vq->chase_reply->security = sec_status_insecure; 1837b7579f77SDag-Erling Smørgrav val_mark_insecure(vq->chase_reply, vq->key_entry->name, 1838b7579f77SDag-Erling Smørgrav qstate->env->rrset_cache, qstate->env); 1839b7579f77SDag-Erling Smørgrav key_cache_insert(ve->kcache, vq->key_entry, qstate); 1840b7579f77SDag-Erling Smørgrav return 1; 1841b7579f77SDag-Erling Smørgrav } 1842b7579f77SDag-Erling Smørgrav 1843b7579f77SDag-Erling Smørgrav if(key_entry_isbad(vq->key_entry)) { 1844b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_DETAIL, "Could not establish a chain " 1845b7579f77SDag-Erling Smørgrav "of trust to keys for", vq->key_entry->name, 1846b7579f77SDag-Erling Smørgrav LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class); 1847b7579f77SDag-Erling Smørgrav vq->chase_reply->security = sec_status_bogus; 1848b7579f77SDag-Erling Smørgrav errinf(qstate, "while building chain of trust"); 1849b7579f77SDag-Erling Smørgrav if(vq->restart_count >= VAL_MAX_RESTART_COUNT) 1850b7579f77SDag-Erling Smørgrav key_cache_insert(ve->kcache, vq->key_entry, qstate); 1851b7579f77SDag-Erling Smørgrav return 1; 1852b7579f77SDag-Erling Smørgrav } 1853b7579f77SDag-Erling Smørgrav 1854b7579f77SDag-Erling Smørgrav /* signerName being null is the indicator that this response was 1855b7579f77SDag-Erling Smørgrav * unsigned */ 1856b7579f77SDag-Erling Smørgrav if(vq->signer_name == NULL) { 1857b7579f77SDag-Erling Smørgrav log_query_info(VERB_ALGO, "processValidate: state has no " 1858b7579f77SDag-Erling Smørgrav "signer name", &vq->qchase); 1859b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "Could not establish validation of " 1860b7579f77SDag-Erling Smørgrav "INSECURE status of unsigned response."); 1861b7579f77SDag-Erling Smørgrav errinf(qstate, "no signatures"); 1862b7579f77SDag-Erling Smørgrav errinf_origin(qstate, qstate->reply_origin); 1863b7579f77SDag-Erling Smørgrav vq->chase_reply->security = sec_status_bogus; 1864b7579f77SDag-Erling Smørgrav return 1; 1865b7579f77SDag-Erling Smørgrav } 1866b7579f77SDag-Erling Smørgrav subtype = val_classify_response(qstate->query_flags, &qstate->qinfo, 1867b7579f77SDag-Erling Smørgrav &vq->qchase, vq->orig_msg->rep, vq->rrset_skip); 18686480faa8SDag-Erling Smørgrav if(subtype != VAL_CLASS_REFERRAL) 18696480faa8SDag-Erling Smørgrav remove_spurious_authority(vq->chase_reply, vq->orig_msg->rep); 1870b7579f77SDag-Erling Smørgrav 1871b7579f77SDag-Erling Smørgrav /* check signatures in the message; 1872b7579f77SDag-Erling Smørgrav * answer and authority must be valid, additional is only checked. */ 1873b7579f77SDag-Erling Smørgrav if(!validate_msg_signatures(qstate, qstate->env, ve, &vq->qchase, 1874b7579f77SDag-Erling Smørgrav vq->chase_reply, vq->key_entry)) { 1875b7579f77SDag-Erling Smørgrav /* workaround bad recursor out there that truncates (even 1876b7579f77SDag-Erling Smørgrav * with EDNS4k) to 512 by removing RRSIG from auth section 1877b7579f77SDag-Erling Smørgrav * for positive replies*/ 1878b7579f77SDag-Erling Smørgrav if((subtype == VAL_CLASS_POSITIVE || subtype == VAL_CLASS_ANY 1879b7579f77SDag-Erling Smørgrav || subtype == VAL_CLASS_CNAME) && 1880b7579f77SDag-Erling Smørgrav detect_wrongly_truncated(vq->orig_msg->rep)) { 1881b7579f77SDag-Erling Smørgrav /* truncate the message some more */ 1882b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->ns_numrrsets = 0; 1883b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->ar_numrrsets = 0; 1884b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->rrset_count = 1885b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->an_numrrsets; 1886b7579f77SDag-Erling Smørgrav vq->chase_reply->ns_numrrsets = 0; 1887b7579f77SDag-Erling Smørgrav vq->chase_reply->ar_numrrsets = 0; 1888b7579f77SDag-Erling Smørgrav vq->chase_reply->rrset_count = 1889b7579f77SDag-Erling Smørgrav vq->chase_reply->an_numrrsets; 1890b7579f77SDag-Erling Smørgrav qstate->errinf = NULL; 1891b7579f77SDag-Erling Smørgrav } 1892b7579f77SDag-Erling Smørgrav else { 1893b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "Validate: message contains " 1894b7579f77SDag-Erling Smørgrav "bad rrsets"); 1895b7579f77SDag-Erling Smørgrav return 1; 1896b7579f77SDag-Erling Smørgrav } 1897b7579f77SDag-Erling Smørgrav } 1898b7579f77SDag-Erling Smørgrav 1899b7579f77SDag-Erling Smørgrav switch(subtype) { 1900b7579f77SDag-Erling Smørgrav case VAL_CLASS_POSITIVE: 1901b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Validating a positive response"); 1902b7579f77SDag-Erling Smørgrav validate_positive_response(qstate->env, ve, 1903b7579f77SDag-Erling Smørgrav &vq->qchase, vq->chase_reply, vq->key_entry); 1904b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "validate(positive): %s", 1905b7579f77SDag-Erling Smørgrav sec_status_to_string( 1906b7579f77SDag-Erling Smørgrav vq->chase_reply->security)); 1907b7579f77SDag-Erling Smørgrav break; 1908b7579f77SDag-Erling Smørgrav 1909b7579f77SDag-Erling Smørgrav case VAL_CLASS_NODATA: 1910b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Validating a nodata response"); 1911b7579f77SDag-Erling Smørgrav validate_nodata_response(qstate->env, ve, 1912b7579f77SDag-Erling Smørgrav &vq->qchase, vq->chase_reply, vq->key_entry); 1913b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "validate(nodata): %s", 1914b7579f77SDag-Erling Smørgrav sec_status_to_string( 1915b7579f77SDag-Erling Smørgrav vq->chase_reply->security)); 1916b7579f77SDag-Erling Smørgrav break; 1917b7579f77SDag-Erling Smørgrav 1918b7579f77SDag-Erling Smørgrav case VAL_CLASS_NAMEERROR: 191917d15b25SDag-Erling Smørgrav rcode = (int)FLAGS_GET_RCODE(vq->orig_msg->rep->flags); 1920b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Validating a nxdomain response"); 1921b7579f77SDag-Erling Smørgrav validate_nameerror_response(qstate->env, ve, 192217d15b25SDag-Erling Smørgrav &vq->qchase, vq->chase_reply, vq->key_entry, &rcode); 1923b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "validate(nxdomain): %s", 1924b7579f77SDag-Erling Smørgrav sec_status_to_string( 1925b7579f77SDag-Erling Smørgrav vq->chase_reply->security)); 192617d15b25SDag-Erling Smørgrav FLAGS_SET_RCODE(vq->orig_msg->rep->flags, rcode); 192717d15b25SDag-Erling Smørgrav FLAGS_SET_RCODE(vq->chase_reply->flags, rcode); 1928b7579f77SDag-Erling Smørgrav break; 1929b7579f77SDag-Erling Smørgrav 1930b7579f77SDag-Erling Smørgrav case VAL_CLASS_CNAME: 1931b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Validating a cname response"); 1932b7579f77SDag-Erling Smørgrav validate_cname_response(qstate->env, ve, 1933b7579f77SDag-Erling Smørgrav &vq->qchase, vq->chase_reply, vq->key_entry); 1934b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "validate(cname): %s", 1935b7579f77SDag-Erling Smørgrav sec_status_to_string( 1936b7579f77SDag-Erling Smørgrav vq->chase_reply->security)); 1937b7579f77SDag-Erling Smørgrav break; 1938b7579f77SDag-Erling Smørgrav 1939b7579f77SDag-Erling Smørgrav case VAL_CLASS_CNAMENOANSWER: 1940b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Validating a cname noanswer " 1941b7579f77SDag-Erling Smørgrav "response"); 1942b7579f77SDag-Erling Smørgrav validate_cname_noanswer_response(qstate->env, ve, 1943b7579f77SDag-Erling Smørgrav &vq->qchase, vq->chase_reply, vq->key_entry); 1944b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "validate(cname_noanswer): %s", 1945b7579f77SDag-Erling Smørgrav sec_status_to_string( 1946b7579f77SDag-Erling Smørgrav vq->chase_reply->security)); 1947b7579f77SDag-Erling Smørgrav break; 1948b7579f77SDag-Erling Smørgrav 1949b7579f77SDag-Erling Smørgrav case VAL_CLASS_REFERRAL: 1950b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Validating a referral response"); 1951b7579f77SDag-Erling Smørgrav validate_referral_response(vq->chase_reply); 1952b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "validate(referral): %s", 1953b7579f77SDag-Erling Smørgrav sec_status_to_string( 1954b7579f77SDag-Erling Smørgrav vq->chase_reply->security)); 1955b7579f77SDag-Erling Smørgrav break; 1956b7579f77SDag-Erling Smørgrav 1957b7579f77SDag-Erling Smørgrav case VAL_CLASS_ANY: 1958b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "Validating a positive ANY " 1959b7579f77SDag-Erling Smørgrav "response"); 1960b7579f77SDag-Erling Smørgrav validate_any_response(qstate->env, ve, &vq->qchase, 1961b7579f77SDag-Erling Smørgrav vq->chase_reply, vq->key_entry); 1962b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "validate(positive_any): %s", 1963b7579f77SDag-Erling Smørgrav sec_status_to_string( 1964b7579f77SDag-Erling Smørgrav vq->chase_reply->security)); 1965b7579f77SDag-Erling Smørgrav break; 1966b7579f77SDag-Erling Smørgrav 1967b7579f77SDag-Erling Smørgrav default: 1968b7579f77SDag-Erling Smørgrav log_err("validate: unhandled response subtype: %d", 1969b7579f77SDag-Erling Smørgrav subtype); 1970b7579f77SDag-Erling Smørgrav } 1971b7579f77SDag-Erling Smørgrav if(vq->chase_reply->security == sec_status_bogus) { 1972b7579f77SDag-Erling Smørgrav if(subtype == VAL_CLASS_POSITIVE) 1973b7579f77SDag-Erling Smørgrav errinf(qstate, "wildcard"); 1974b7579f77SDag-Erling Smørgrav else errinf(qstate, val_classification_to_string(subtype)); 1975b7579f77SDag-Erling Smørgrav errinf(qstate, "proof failed"); 1976b7579f77SDag-Erling Smørgrav errinf_origin(qstate, qstate->reply_origin); 1977b7579f77SDag-Erling Smørgrav } 1978b7579f77SDag-Erling Smørgrav 1979b7579f77SDag-Erling Smørgrav return 1; 1980b7579f77SDag-Erling Smørgrav } 1981b7579f77SDag-Erling Smørgrav 1982b7579f77SDag-Erling Smørgrav /** 1983b7579f77SDag-Erling Smørgrav * Init DLV check. 198409a3aaf3SDag-Erling Smørgrav * DLV is going to be decommissioned, but the code is still here for some time. 198509a3aaf3SDag-Erling Smørgrav * 1986b7579f77SDag-Erling Smørgrav * Called when a query is determined by other trust anchors to be insecure 1987b7579f77SDag-Erling Smørgrav * (or indeterminate). Then we look if there is a key in the DLV. 1988b7579f77SDag-Erling Smørgrav * Performs aggressive negative cache check to see if there is no key. 1989b7579f77SDag-Erling Smørgrav * Otherwise, spawns a DLV query, and changes to the DLV wait state. 1990b7579f77SDag-Erling Smørgrav * 1991b7579f77SDag-Erling Smørgrav * @param qstate: query state. 1992b7579f77SDag-Erling Smørgrav * @param vq: validator query state. 1993b7579f77SDag-Erling Smørgrav * @param ve: validator shared global environment. 1994b7579f77SDag-Erling Smørgrav * @param id: module id. 1995b7579f77SDag-Erling Smørgrav * @return true if there is no DLV. 1996b7579f77SDag-Erling Smørgrav * false: processing is finished for the validator operate(). 1997b7579f77SDag-Erling Smørgrav * This function may exit in three ways: 199805ab2901SDag-Erling Smørgrav * o no DLV (aggressive cache), so insecure. (true) 1999b7579f77SDag-Erling Smørgrav * o error - stop processing (false) 2000b7579f77SDag-Erling Smørgrav * o DLV lookup was started, stop processing (false) 2001b7579f77SDag-Erling Smørgrav */ 2002b7579f77SDag-Erling Smørgrav static int 2003b7579f77SDag-Erling Smørgrav val_dlv_init(struct module_qstate* qstate, struct val_qstate* vq, 2004b7579f77SDag-Erling Smørgrav struct val_env* ve, int id) 2005b7579f77SDag-Erling Smørgrav { 2006b7579f77SDag-Erling Smørgrav uint8_t* nm; 2007b7579f77SDag-Erling Smørgrav size_t nm_len; 2008c7f4d7adSDag-Erling Smørgrav struct module_qstate* newq = NULL; 2009b7579f77SDag-Erling Smørgrav /* there must be a DLV configured */ 2010b7579f77SDag-Erling Smørgrav log_assert(qstate->env->anchors->dlv_anchor); 2011b7579f77SDag-Erling Smørgrav /* this bool is true to avoid looping in the DLV checks */ 2012b7579f77SDag-Erling Smørgrav log_assert(vq->dlv_checked); 2013b7579f77SDag-Erling Smørgrav 2014b7579f77SDag-Erling Smørgrav /* init the DLV lookup variables */ 2015b7579f77SDag-Erling Smørgrav vq->dlv_lookup_name = NULL; 2016b7579f77SDag-Erling Smørgrav vq->dlv_lookup_name_len = 0; 2017b7579f77SDag-Erling Smørgrav vq->dlv_insecure_at = NULL; 2018b7579f77SDag-Erling Smørgrav vq->dlv_insecure_at_len = 0; 2019b7579f77SDag-Erling Smørgrav 2020b7579f77SDag-Erling Smørgrav /* Determine the name for which we want to lookup DLV. 2021b7579f77SDag-Erling Smørgrav * This name is for the current message, or 2022b7579f77SDag-Erling Smørgrav * for the current RRset for CNAME, referral subtypes. 2023b7579f77SDag-Erling Smørgrav * If there is a signer, use that, otherwise the domain name */ 2024b7579f77SDag-Erling Smørgrav if(vq->signer_name) { 2025b7579f77SDag-Erling Smørgrav nm = vq->signer_name; 2026b7579f77SDag-Erling Smørgrav nm_len = vq->signer_len; 2027b7579f77SDag-Erling Smørgrav } else { 2028b7579f77SDag-Erling Smørgrav /* use qchase */ 2029b7579f77SDag-Erling Smørgrav nm = vq->qchase.qname; 2030b7579f77SDag-Erling Smørgrav nm_len = vq->qchase.qname_len; 2031b7579f77SDag-Erling Smørgrav if(vq->qchase.qtype == LDNS_RR_TYPE_DS) 2032b7579f77SDag-Erling Smørgrav dname_remove_label(&nm, &nm_len); 2033b7579f77SDag-Erling Smørgrav } 2034b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "DLV init look", nm, LDNS_RR_TYPE_DS, 2035b7579f77SDag-Erling Smørgrav vq->qchase.qclass); 2036b7579f77SDag-Erling Smørgrav log_assert(nm && nm_len); 2037b7579f77SDag-Erling Smørgrav /* sanity check: no DLV lookups below the DLV anchor itself. 2038b7579f77SDag-Erling Smørgrav * Like, an securely insecure delegation there makes no sense. */ 2039b7579f77SDag-Erling Smørgrav if(dname_subdomain_c(nm, qstate->env->anchors->dlv_anchor->name)) { 2040b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "DLV lookup within DLV repository denied"); 2041b7579f77SDag-Erling Smørgrav return 1; 2042b7579f77SDag-Erling Smørgrav } 2043b7579f77SDag-Erling Smørgrav /* concat name (minus root label) + dlv name */ 2044b7579f77SDag-Erling Smørgrav vq->dlv_lookup_name_len = nm_len - 1 + 2045b7579f77SDag-Erling Smørgrav qstate->env->anchors->dlv_anchor->namelen; 2046b7579f77SDag-Erling Smørgrav vq->dlv_lookup_name = regional_alloc(qstate->region, 2047b7579f77SDag-Erling Smørgrav vq->dlv_lookup_name_len); 2048b7579f77SDag-Erling Smørgrav if(!vq->dlv_lookup_name) { 2049b7579f77SDag-Erling Smørgrav log_err("Out of memory preparing DLV lookup"); 2050b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 2051b7579f77SDag-Erling Smørgrav } 2052b7579f77SDag-Erling Smørgrav memmove(vq->dlv_lookup_name, nm, nm_len-1); 2053b7579f77SDag-Erling Smørgrav memmove(vq->dlv_lookup_name+nm_len-1, 2054b7579f77SDag-Erling Smørgrav qstate->env->anchors->dlv_anchor->name, 2055b7579f77SDag-Erling Smørgrav qstate->env->anchors->dlv_anchor->namelen); 2056b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "DLV name", vq->dlv_lookup_name, 2057b7579f77SDag-Erling Smørgrav LDNS_RR_TYPE_DLV, vq->qchase.qclass); 2058b7579f77SDag-Erling Smørgrav 2059b7579f77SDag-Erling Smørgrav /* determine where the insecure point was determined, the DLV must 2060b7579f77SDag-Erling Smørgrav * be equal or below that to continue building the trust chain 2061b7579f77SDag-Erling Smørgrav * down. May be NULL if no trust chain was built yet */ 2062b7579f77SDag-Erling Smørgrav nm = NULL; 2063b7579f77SDag-Erling Smørgrav if(vq->key_entry && key_entry_isnull(vq->key_entry)) { 2064b7579f77SDag-Erling Smørgrav nm = vq->key_entry->name; 2065b7579f77SDag-Erling Smørgrav nm_len = vq->key_entry->namelen; 2066b7579f77SDag-Erling Smørgrav } 2067b7579f77SDag-Erling Smørgrav if(nm) { 2068b7579f77SDag-Erling Smørgrav vq->dlv_insecure_at_len = nm_len - 1 + 2069b7579f77SDag-Erling Smørgrav qstate->env->anchors->dlv_anchor->namelen; 2070b7579f77SDag-Erling Smørgrav vq->dlv_insecure_at = regional_alloc(qstate->region, 2071b7579f77SDag-Erling Smørgrav vq->dlv_insecure_at_len); 2072b7579f77SDag-Erling Smørgrav if(!vq->dlv_insecure_at) { 2073b7579f77SDag-Erling Smørgrav log_err("Out of memory preparing DLV lookup"); 2074b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 2075b7579f77SDag-Erling Smørgrav } 2076b7579f77SDag-Erling Smørgrav memmove(vq->dlv_insecure_at, nm, nm_len-1); 2077b7579f77SDag-Erling Smørgrav memmove(vq->dlv_insecure_at+nm_len-1, 2078b7579f77SDag-Erling Smørgrav qstate->env->anchors->dlv_anchor->name, 2079b7579f77SDag-Erling Smørgrav qstate->env->anchors->dlv_anchor->namelen); 2080b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "insecure_at", 2081b7579f77SDag-Erling Smørgrav vq->dlv_insecure_at, 0, vq->qchase.qclass); 2082b7579f77SDag-Erling Smørgrav } 2083b7579f77SDag-Erling Smørgrav 2084b7579f77SDag-Erling Smørgrav /* If we can find the name in the aggressive negative cache, 2085b7579f77SDag-Erling Smørgrav * give up; insecure is the answer */ 2086b7579f77SDag-Erling Smørgrav while(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name, 2087b7579f77SDag-Erling Smørgrav vq->dlv_lookup_name_len, vq->qchase.qclass, 2088b7579f77SDag-Erling Smørgrav qstate->env->rrset_cache, *qstate->env->now)) { 2089b7579f77SDag-Erling Smørgrav /* go up */ 2090b7579f77SDag-Erling Smørgrav dname_remove_label(&vq->dlv_lookup_name, 2091b7579f77SDag-Erling Smørgrav &vq->dlv_lookup_name_len); 2092b7579f77SDag-Erling Smørgrav /* too high? */ 2093b7579f77SDag-Erling Smørgrav if(!dname_subdomain_c(vq->dlv_lookup_name, 2094b7579f77SDag-Erling Smørgrav qstate->env->anchors->dlv_anchor->name)) { 2095b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "ask above dlv repo"); 2096b7579f77SDag-Erling Smørgrav return 1; /* Above the repo is insecure */ 2097b7579f77SDag-Erling Smørgrav } 2098b7579f77SDag-Erling Smørgrav /* above chain of trust? */ 2099b7579f77SDag-Erling Smørgrav if(vq->dlv_insecure_at && !dname_subdomain_c( 2100b7579f77SDag-Erling Smørgrav vq->dlv_lookup_name, vq->dlv_insecure_at)) { 2101b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "ask above insecure endpoint"); 2102b7579f77SDag-Erling Smørgrav return 1; 2103b7579f77SDag-Erling Smørgrav } 2104b7579f77SDag-Erling Smørgrav } 2105b7579f77SDag-Erling Smørgrav 2106b7579f77SDag-Erling Smørgrav /* perform a lookup for the DLV; with validation */ 2107b7579f77SDag-Erling Smørgrav vq->state = VAL_DLVLOOKUP_STATE; 2108b7579f77SDag-Erling Smørgrav if(!generate_request(qstate, id, vq->dlv_lookup_name, 2109b7579f77SDag-Erling Smørgrav vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV, 2110c7f4d7adSDag-Erling Smørgrav vq->qchase.qclass, 0, &newq, 0)) { 2111b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 2112b7579f77SDag-Erling Smørgrav } 2113b7579f77SDag-Erling Smørgrav 2114b7579f77SDag-Erling Smørgrav /* Find the closest encloser DLV from the repository. 2115b7579f77SDag-Erling Smørgrav * then that is used to build another chain of trust 2116b7579f77SDag-Erling Smørgrav * This may first require a query 'too low' that has NSECs in 2117b7579f77SDag-Erling Smørgrav * the answer, from which we determine the closest encloser DLV. 2118b7579f77SDag-Erling Smørgrav * When determine the closest encloser, skip empty nonterminals, 2119b7579f77SDag-Erling Smørgrav * since we want a nonempty node in the DLV repository. */ 2120b7579f77SDag-Erling Smørgrav 2121b7579f77SDag-Erling Smørgrav return 0; 2122b7579f77SDag-Erling Smørgrav } 2123b7579f77SDag-Erling Smørgrav 2124b7579f77SDag-Erling Smørgrav /** 2125b7579f77SDag-Erling Smørgrav * The Finished state. The validation status (good or bad) has been determined. 2126b7579f77SDag-Erling Smørgrav * 2127b7579f77SDag-Erling Smørgrav * @param qstate: query state. 2128b7579f77SDag-Erling Smørgrav * @param vq: validator query state. 2129b7579f77SDag-Erling Smørgrav * @param ve: validator shared global environment. 2130b7579f77SDag-Erling Smørgrav * @param id: module id. 2131b7579f77SDag-Erling Smørgrav * @return true if the event should be processed further on return, false if 2132b7579f77SDag-Erling Smørgrav * not. 2133b7579f77SDag-Erling Smørgrav */ 2134b7579f77SDag-Erling Smørgrav static int 2135b7579f77SDag-Erling Smørgrav processFinished(struct module_qstate* qstate, struct val_qstate* vq, 2136b7579f77SDag-Erling Smørgrav struct val_env* ve, int id) 2137b7579f77SDag-Erling Smørgrav { 2138b7579f77SDag-Erling Smørgrav enum val_classification subtype = val_classify_response( 2139b7579f77SDag-Erling Smørgrav qstate->query_flags, &qstate->qinfo, &vq->qchase, 2140b7579f77SDag-Erling Smørgrav vq->orig_msg->rep, vq->rrset_skip); 2141b7579f77SDag-Erling Smørgrav 2142b7579f77SDag-Erling Smørgrav /* if the result is insecure or indeterminate and we have not 2143b7579f77SDag-Erling Smørgrav * checked the DLV yet, check the DLV */ 2144b7579f77SDag-Erling Smørgrav if((vq->chase_reply->security == sec_status_insecure || 2145b7579f77SDag-Erling Smørgrav vq->chase_reply->security == sec_status_indeterminate) && 2146b7579f77SDag-Erling Smørgrav qstate->env->anchors->dlv_anchor && !vq->dlv_checked) { 2147b7579f77SDag-Erling Smørgrav vq->dlv_checked = 1; 2148b7579f77SDag-Erling Smørgrav if(!val_dlv_init(qstate, vq, ve, id)) 2149b7579f77SDag-Erling Smørgrav return 0; 2150b7579f77SDag-Erling Smørgrav } 2151b7579f77SDag-Erling Smørgrav 2152b7579f77SDag-Erling Smørgrav /* store overall validation result in orig_msg */ 2153b7579f77SDag-Erling Smørgrav if(vq->rrset_skip == 0) 2154b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->security = vq->chase_reply->security; 21558ed2b524SDag-Erling Smørgrav else if(subtype != VAL_CLASS_REFERRAL || 21568ed2b524SDag-Erling Smørgrav vq->rrset_skip < vq->orig_msg->rep->an_numrrsets + 2157b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->ns_numrrsets) { 2158b7579f77SDag-Erling Smørgrav /* ignore sec status of additional section if a referral 2159b7579f77SDag-Erling Smørgrav * type message skips there and 2160b7579f77SDag-Erling Smørgrav * use the lowest security status as end result. */ 2161b7579f77SDag-Erling Smørgrav if(vq->chase_reply->security < vq->orig_msg->rep->security) 2162b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->security = 2163b7579f77SDag-Erling Smørgrav vq->chase_reply->security; 2164b7579f77SDag-Erling Smørgrav } 2165b7579f77SDag-Erling Smørgrav 2166b7579f77SDag-Erling Smørgrav if(subtype == VAL_CLASS_REFERRAL) { 2167b7579f77SDag-Erling Smørgrav /* for a referral, move to next unchecked rrset and check it*/ 2168b7579f77SDag-Erling Smørgrav vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep, 2169b7579f77SDag-Erling Smørgrav vq->rrset_skip); 2170b7579f77SDag-Erling Smørgrav if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) { 2171b7579f77SDag-Erling Smørgrav /* and restart for this rrset */ 2172b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "validator: go to next rrset"); 2173b7579f77SDag-Erling Smørgrav vq->chase_reply->security = sec_status_unchecked; 2174b7579f77SDag-Erling Smørgrav vq->dlv_checked = 0; /* can do DLV for this RR */ 2175b7579f77SDag-Erling Smørgrav vq->state = VAL_INIT_STATE; 2176b7579f77SDag-Erling Smørgrav return 1; 2177b7579f77SDag-Erling Smørgrav } 2178b7579f77SDag-Erling Smørgrav /* referral chase is done */ 2179b7579f77SDag-Erling Smørgrav } 2180b7579f77SDag-Erling Smørgrav if(vq->chase_reply->security != sec_status_bogus && 2181b7579f77SDag-Erling Smørgrav subtype == VAL_CLASS_CNAME) { 2182b7579f77SDag-Erling Smørgrav /* chase the CNAME; process next part of the message */ 2183b7579f77SDag-Erling Smørgrav if(!val_chase_cname(&vq->qchase, vq->orig_msg->rep, 2184b7579f77SDag-Erling Smørgrav &vq->rrset_skip)) { 2185b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "validator: failed to chase CNAME"); 2186b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->security = sec_status_bogus; 2187b7579f77SDag-Erling Smørgrav } else { 2188b7579f77SDag-Erling Smørgrav /* restart process for new qchase at rrset_skip */ 2189b7579f77SDag-Erling Smørgrav log_query_info(VERB_ALGO, "validator: chased to", 2190b7579f77SDag-Erling Smørgrav &vq->qchase); 2191b7579f77SDag-Erling Smørgrav vq->chase_reply->security = sec_status_unchecked; 2192b7579f77SDag-Erling Smørgrav vq->dlv_checked = 0; /* can do DLV for this RR */ 2193b7579f77SDag-Erling Smørgrav vq->state = VAL_INIT_STATE; 2194b7579f77SDag-Erling Smørgrav return 1; 2195b7579f77SDag-Erling Smørgrav } 2196b7579f77SDag-Erling Smørgrav } 2197b7579f77SDag-Erling Smørgrav 2198b7579f77SDag-Erling Smørgrav if(vq->orig_msg->rep->security == sec_status_secure) { 2199b7579f77SDag-Erling Smørgrav /* If the message is secure, check that all rrsets are 2200b7579f77SDag-Erling Smørgrav * secure (i.e. some inserted RRset for CNAME chain with 2201b7579f77SDag-Erling Smørgrav * a different signer name). And drop additional rrsets 2202b7579f77SDag-Erling Smørgrav * that are not secure (if clean-additional option is set) */ 2203b7579f77SDag-Erling Smørgrav /* this may cause the msg to be marked bogus */ 2204c7f4d7adSDag-Erling Smørgrav val_check_nonsecure(qstate->env, vq->orig_msg->rep); 2205b7579f77SDag-Erling Smørgrav if(vq->orig_msg->rep->security == sec_status_secure) { 2206b7579f77SDag-Erling Smørgrav log_query_info(VERB_DETAIL, "validation success", 2207b7579f77SDag-Erling Smørgrav &qstate->qinfo); 220857bddd21SDag-Erling Smørgrav if(!qstate->no_cache_store) { 220957bddd21SDag-Erling Smørgrav val_neg_addreply(qstate->env->neg_cache, 221057bddd21SDag-Erling Smørgrav vq->orig_msg->rep); 221157bddd21SDag-Erling Smørgrav } 2212b7579f77SDag-Erling Smørgrav } 2213b7579f77SDag-Erling Smørgrav } 2214b7579f77SDag-Erling Smørgrav 2215b7579f77SDag-Erling Smørgrav /* if the result is bogus - set message ttl to bogus ttl to avoid 2216b7579f77SDag-Erling Smørgrav * endless bogus revalidation */ 2217b7579f77SDag-Erling Smørgrav if(vq->orig_msg->rep->security == sec_status_bogus) { 2218b7579f77SDag-Erling Smørgrav /* see if we can try again to fetch data */ 2219b7579f77SDag-Erling Smørgrav if(vq->restart_count < VAL_MAX_RESTART_COUNT) { 2220b7579f77SDag-Erling Smørgrav int restart_count = vq->restart_count+1; 2221b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "validation failed, " 2222b7579f77SDag-Erling Smørgrav "blacklist and retry to fetch data"); 2223b7579f77SDag-Erling Smørgrav val_blacklist(&qstate->blacklist, qstate->region, 2224b7579f77SDag-Erling Smørgrav qstate->reply_origin, 0); 2225b7579f77SDag-Erling Smørgrav qstate->reply_origin = NULL; 2226b7579f77SDag-Erling Smørgrav qstate->errinf = NULL; 2227b7579f77SDag-Erling Smørgrav memset(vq, 0, sizeof(*vq)); 2228b7579f77SDag-Erling Smørgrav vq->restart_count = restart_count; 2229b7579f77SDag-Erling Smørgrav vq->state = VAL_INIT_STATE; 2230b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "pass back to next module"); 2231b7579f77SDag-Erling Smørgrav qstate->ext_state[id] = module_restart_next; 2232b7579f77SDag-Erling Smørgrav return 0; 2233b7579f77SDag-Erling Smørgrav } 2234b7579f77SDag-Erling Smørgrav 2235b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->ttl = ve->bogus_ttl; 2236b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->prefetch_ttl = 2237b7579f77SDag-Erling Smørgrav PREFETCH_TTL_CALC(vq->orig_msg->rep->ttl); 2238*4c75e3aaSDag-Erling Smørgrav vq->orig_msg->rep->serve_expired_ttl = 2239*4c75e3aaSDag-Erling Smørgrav vq->orig_msg->rep->ttl + qstate->env->cfg->serve_expired_ttl; 2240*4c75e3aaSDag-Erling Smørgrav if((qstate->env->cfg->val_log_level >= 1 || 2241*4c75e3aaSDag-Erling Smørgrav qstate->env->cfg->log_servfail) && 2242b7579f77SDag-Erling Smørgrav !qstate->env->cfg->val_log_squelch) { 2243*4c75e3aaSDag-Erling Smørgrav if(qstate->env->cfg->val_log_level < 2 && 2244*4c75e3aaSDag-Erling Smørgrav !qstate->env->cfg->log_servfail) 2245b7579f77SDag-Erling Smørgrav log_query_info(0, "validation failure", 2246b7579f77SDag-Erling Smørgrav &qstate->qinfo); 2247b7579f77SDag-Erling Smørgrav else { 2248*4c75e3aaSDag-Erling Smørgrav char* err = errinf_to_str_bogus(qstate); 2249b7579f77SDag-Erling Smørgrav if(err) log_info("%s", err); 2250b7579f77SDag-Erling Smørgrav free(err); 2251b7579f77SDag-Erling Smørgrav } 2252b7579f77SDag-Erling Smørgrav } 2253c7f4d7adSDag-Erling Smørgrav /* 2254c7f4d7adSDag-Erling Smørgrav * If set, the validator will not make messages bogus, instead 2255c7f4d7adSDag-Erling Smørgrav * indeterminate is issued, so that no clients receive SERVFAIL. 2256c7f4d7adSDag-Erling Smørgrav * This allows an operator to run validation 'shadow' without 2257c7f4d7adSDag-Erling Smørgrav * hurting responses to clients. 2258c7f4d7adSDag-Erling Smørgrav */ 2259b7579f77SDag-Erling Smørgrav /* If we are in permissive mode, bogus gets indeterminate */ 2260c7f4d7adSDag-Erling Smørgrav if(qstate->env->cfg->val_permissive_mode) 2261b7579f77SDag-Erling Smørgrav vq->orig_msg->rep->security = sec_status_indeterminate; 2262b7579f77SDag-Erling Smørgrav } 2263b7579f77SDag-Erling Smørgrav 22640fb34990SDag-Erling Smørgrav if(vq->orig_msg->rep->security == sec_status_secure && 22650fb34990SDag-Erling Smørgrav qstate->env->cfg->root_key_sentinel && 22660fb34990SDag-Erling Smørgrav (qstate->qinfo.qtype == LDNS_RR_TYPE_A || 22670fb34990SDag-Erling Smørgrav qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)) { 22680fb34990SDag-Erling Smørgrav char* keytag_start; 22690fb34990SDag-Erling Smørgrav uint16_t keytag; 22700fb34990SDag-Erling Smørgrav if(*qstate->qinfo.qname == strlen(SENTINEL_IS) + 22710fb34990SDag-Erling Smørgrav SENTINEL_KEYTAG_LEN && 22720fb34990SDag-Erling Smørgrav dname_lab_startswith(qstate->qinfo.qname, SENTINEL_IS, 22730fb34990SDag-Erling Smørgrav &keytag_start)) { 22740fb34990SDag-Erling Smørgrav if(sentinel_get_keytag(keytag_start, &keytag) && 22750fb34990SDag-Erling Smørgrav !anchor_has_keytag(qstate->env->anchors, 22760fb34990SDag-Erling Smørgrav (uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) { 22770fb34990SDag-Erling Smørgrav vq->orig_msg->rep->security = 22780fb34990SDag-Erling Smørgrav sec_status_secure_sentinel_fail; 22790fb34990SDag-Erling Smørgrav } 22800fb34990SDag-Erling Smørgrav } else if(*qstate->qinfo.qname == strlen(SENTINEL_NOT) + 22810fb34990SDag-Erling Smørgrav SENTINEL_KEYTAG_LEN && 22820fb34990SDag-Erling Smørgrav dname_lab_startswith(qstate->qinfo.qname, SENTINEL_NOT, 22830fb34990SDag-Erling Smørgrav &keytag_start)) { 22840fb34990SDag-Erling Smørgrav if(sentinel_get_keytag(keytag_start, &keytag) && 22850fb34990SDag-Erling Smørgrav anchor_has_keytag(qstate->env->anchors, 22860fb34990SDag-Erling Smørgrav (uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) { 22870fb34990SDag-Erling Smørgrav vq->orig_msg->rep->security = 22880fb34990SDag-Erling Smørgrav sec_status_secure_sentinel_fail; 22890fb34990SDag-Erling Smørgrav } 22900fb34990SDag-Erling Smørgrav } 22910fb34990SDag-Erling Smørgrav } 2292b7579f77SDag-Erling Smørgrav /* store results in cache */ 229365b390aaSDag-Erling Smørgrav if(qstate->query_flags&BIT_RD) { 2294b7579f77SDag-Erling Smørgrav /* if secure, this will override cache anyway, no need 2295b7579f77SDag-Erling Smørgrav * to check if from parentNS */ 229665b390aaSDag-Erling Smørgrav if(!qstate->no_cache_store) { 2297b7579f77SDag-Erling Smørgrav if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo, 2298ff825849SDag-Erling Smørgrav vq->orig_msg->rep, 0, qstate->prefetch_leeway, 0, NULL, 2299ff825849SDag-Erling Smørgrav qstate->query_flags)) { 2300b7579f77SDag-Erling Smørgrav log_err("out of memory caching validator results"); 2301b7579f77SDag-Erling Smørgrav } 230265b390aaSDag-Erling Smørgrav } 2303b7579f77SDag-Erling Smørgrav } else { 2304b7579f77SDag-Erling Smørgrav /* for a referral, store the verified RRsets */ 2305b7579f77SDag-Erling Smørgrav /* and this does not get prefetched, so no leeway */ 2306b7579f77SDag-Erling Smørgrav if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo, 2307ff825849SDag-Erling Smørgrav vq->orig_msg->rep, 1, 0, 0, NULL, 2308ff825849SDag-Erling Smørgrav qstate->query_flags)) { 2309b7579f77SDag-Erling Smørgrav log_err("out of memory caching validator results"); 2310b7579f77SDag-Erling Smørgrav } 2311b7579f77SDag-Erling Smørgrav } 2312b7579f77SDag-Erling Smørgrav qstate->return_rcode = LDNS_RCODE_NOERROR; 2313b7579f77SDag-Erling Smørgrav qstate->return_msg = vq->orig_msg; 2314b7579f77SDag-Erling Smørgrav qstate->ext_state[id] = module_finished; 2315b7579f77SDag-Erling Smørgrav return 0; 2316b7579f77SDag-Erling Smørgrav } 2317b7579f77SDag-Erling Smørgrav 2318b7579f77SDag-Erling Smørgrav /** 2319b7579f77SDag-Erling Smørgrav * The DLVLookup state. Process DLV lookups. 2320b7579f77SDag-Erling Smørgrav * 2321b7579f77SDag-Erling Smørgrav * @param qstate: query state. 2322b7579f77SDag-Erling Smørgrav * @param vq: validator query state. 2323b7579f77SDag-Erling Smørgrav * @param ve: validator shared global environment. 2324b7579f77SDag-Erling Smørgrav * @param id: module id. 2325b7579f77SDag-Erling Smørgrav * @return true if the event should be processed further on return, false if 2326b7579f77SDag-Erling Smørgrav * not. 2327b7579f77SDag-Erling Smørgrav */ 2328b7579f77SDag-Erling Smørgrav static int 2329b7579f77SDag-Erling Smørgrav processDLVLookup(struct module_qstate* qstate, struct val_qstate* vq, 2330b7579f77SDag-Erling Smørgrav struct val_env* ve, int id) 2331b7579f77SDag-Erling Smørgrav { 2332c7f4d7adSDag-Erling Smørgrav struct module_qstate* newq = NULL; 2333b7579f77SDag-Erling Smørgrav /* see if this we are ready to continue normal resolution */ 2334b7579f77SDag-Erling Smørgrav /* we may need more DLV lookups */ 2335b7579f77SDag-Erling Smørgrav if(vq->dlv_status==dlv_error) 2336b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "DLV woke up with status dlv_error"); 2337b7579f77SDag-Erling Smørgrav else if(vq->dlv_status==dlv_success) 2338b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "DLV woke up with status dlv_success"); 2339b7579f77SDag-Erling Smørgrav else if(vq->dlv_status==dlv_ask_higher) 2340b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "DLV woke up with status dlv_ask_higher"); 2341b7579f77SDag-Erling Smørgrav else if(vq->dlv_status==dlv_there_is_no_dlv) 2342b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "DLV woke up with status dlv_there_is_no_dlv"); 2343b7579f77SDag-Erling Smørgrav else verbose(VERB_ALGO, "DLV woke up with status unknown"); 2344b7579f77SDag-Erling Smørgrav 2345b7579f77SDag-Erling Smørgrav if(vq->dlv_status == dlv_error) { 2346b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "failed DLV lookup"); 2347*4c75e3aaSDag-Erling Smørgrav errinf(qstate, "failed DLV lookup"); 2348b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 2349b7579f77SDag-Erling Smørgrav } else if(vq->dlv_status == dlv_success) { 2350b7579f77SDag-Erling Smørgrav uint8_t* nm; 2351b7579f77SDag-Erling Smørgrav size_t nmlen; 2352b7579f77SDag-Erling Smørgrav /* chain continues with DNSKEY, continue in FINDKEY */ 2353b7579f77SDag-Erling Smørgrav vq->state = VAL_FINDKEY_STATE; 2354b7579f77SDag-Erling Smørgrav 2355b7579f77SDag-Erling Smørgrav /* strip off the DLV suffix from the name; could result in . */ 2356b7579f77SDag-Erling Smørgrav log_assert(dname_subdomain_c(vq->ds_rrset->rk.dname, 2357b7579f77SDag-Erling Smørgrav qstate->env->anchors->dlv_anchor->name)); 2358b7579f77SDag-Erling Smørgrav nmlen = vq->ds_rrset->rk.dname_len - 2359b7579f77SDag-Erling Smørgrav qstate->env->anchors->dlv_anchor->namelen + 1; 2360b7579f77SDag-Erling Smørgrav nm = regional_alloc_init(qstate->region, 2361b7579f77SDag-Erling Smørgrav vq->ds_rrset->rk.dname, nmlen); 2362b7579f77SDag-Erling Smørgrav if(!nm) { 2363b7579f77SDag-Erling Smørgrav log_err("Out of memory in DLVLook"); 2364b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 2365b7579f77SDag-Erling Smørgrav } 2366b7579f77SDag-Erling Smørgrav nm[nmlen-1] = 0; 2367b7579f77SDag-Erling Smørgrav 2368b7579f77SDag-Erling Smørgrav vq->ds_rrset->rk.dname = nm; 2369b7579f77SDag-Erling Smørgrav vq->ds_rrset->rk.dname_len = nmlen; 2370b7579f77SDag-Erling Smørgrav 2371b7579f77SDag-Erling Smørgrav /* create a nullentry for the key so the dnskey lookup 2372b7579f77SDag-Erling Smørgrav * can be retried after a validation failure for it */ 2373b7579f77SDag-Erling Smørgrav vq->key_entry = key_entry_create_null(qstate->region, 2374b7579f77SDag-Erling Smørgrav nm, nmlen, vq->qchase.qclass, 0, 0); 2375b7579f77SDag-Erling Smørgrav if(!vq->key_entry) { 2376b7579f77SDag-Erling Smørgrav log_err("Out of memory in DLVLook"); 2377b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 2378b7579f77SDag-Erling Smørgrav } 2379b7579f77SDag-Erling Smørgrav 2380b7579f77SDag-Erling Smørgrav if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 2381b7579f77SDag-Erling Smørgrav vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 2382c7f4d7adSDag-Erling Smørgrav vq->qchase.qclass, BIT_CD, &newq, 0)) { 2383*4c75e3aaSDag-Erling Smørgrav verbose(VERB_ALGO, "error generating DNSKEY request"); 2384b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 2385b7579f77SDag-Erling Smørgrav } 2386b7579f77SDag-Erling Smørgrav return 0; 2387b7579f77SDag-Erling Smørgrav } else if(vq->dlv_status == dlv_there_is_no_dlv) { 2388b7579f77SDag-Erling Smørgrav /* continue with the insecure result we got */ 2389b7579f77SDag-Erling Smørgrav vq->state = VAL_FINISHED_STATE; 2390b7579f77SDag-Erling Smørgrav return 1; 2391b7579f77SDag-Erling Smørgrav } 2392b7579f77SDag-Erling Smørgrav log_assert(vq->dlv_status == dlv_ask_higher); 2393b7579f77SDag-Erling Smørgrav 2394b7579f77SDag-Erling Smørgrav /* ask higher, make sure we stay in DLV repo, below dlv_at */ 2395b7579f77SDag-Erling Smørgrav if(!dname_subdomain_c(vq->dlv_lookup_name, 2396b7579f77SDag-Erling Smørgrav qstate->env->anchors->dlv_anchor->name)) { 2397b7579f77SDag-Erling Smørgrav /* just like, there is no DLV */ 2398b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "ask above dlv repo"); 2399b7579f77SDag-Erling Smørgrav vq->state = VAL_FINISHED_STATE; 2400b7579f77SDag-Erling Smørgrav return 1; 2401b7579f77SDag-Erling Smørgrav } 2402b7579f77SDag-Erling Smørgrav if(vq->dlv_insecure_at && !dname_subdomain_c(vq->dlv_lookup_name, 2403b7579f77SDag-Erling Smørgrav vq->dlv_insecure_at)) { 2404b7579f77SDag-Erling Smørgrav /* already checked a chain lower than dlv_lookup_name */ 2405b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "ask above insecure endpoint"); 2406b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_ALGO, "enpt", vq->dlv_insecure_at, 0, 0); 2407b7579f77SDag-Erling Smørgrav vq->state = VAL_FINISHED_STATE; 2408b7579f77SDag-Erling Smørgrav return 1; 2409b7579f77SDag-Erling Smørgrav } 2410b7579f77SDag-Erling Smørgrav 2411b7579f77SDag-Erling Smørgrav /* check negative cache before making new request */ 2412b7579f77SDag-Erling Smørgrav if(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name, 2413b7579f77SDag-Erling Smørgrav vq->dlv_lookup_name_len, vq->qchase.qclass, 2414b7579f77SDag-Erling Smørgrav qstate->env->rrset_cache, *qstate->env->now)) { 2415b7579f77SDag-Erling Smørgrav /* does not exist, go up one (go higher). */ 2416b7579f77SDag-Erling Smørgrav dname_remove_label(&vq->dlv_lookup_name, 2417b7579f77SDag-Erling Smørgrav &vq->dlv_lookup_name_len); 2418b7579f77SDag-Erling Smørgrav /* limit number of labels, limited number of recursion */ 2419b7579f77SDag-Erling Smørgrav return processDLVLookup(qstate, vq, ve, id); 2420b7579f77SDag-Erling Smørgrav } 2421b7579f77SDag-Erling Smørgrav 2422b7579f77SDag-Erling Smørgrav if(!generate_request(qstate, id, vq->dlv_lookup_name, 2423b7579f77SDag-Erling Smørgrav vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV, 2424c7f4d7adSDag-Erling Smørgrav vq->qchase.qclass, 0, &newq, 0)) { 2425b7579f77SDag-Erling Smørgrav return val_error(qstate, id); 2426b7579f77SDag-Erling Smørgrav } 2427b7579f77SDag-Erling Smørgrav 2428b7579f77SDag-Erling Smørgrav return 0; 2429b7579f77SDag-Erling Smørgrav } 2430b7579f77SDag-Erling Smørgrav 2431b7579f77SDag-Erling Smørgrav /** 2432b7579f77SDag-Erling Smørgrav * Handle validator state. 2433b7579f77SDag-Erling Smørgrav * If a method returns true, the next state is started. If false, then 2434b7579f77SDag-Erling Smørgrav * processing will stop. 2435b7579f77SDag-Erling Smørgrav * @param qstate: query state. 2436b7579f77SDag-Erling Smørgrav * @param vq: validator query state. 2437b7579f77SDag-Erling Smørgrav * @param ve: validator shared global environment. 2438b7579f77SDag-Erling Smørgrav * @param id: module id. 2439b7579f77SDag-Erling Smørgrav */ 2440b7579f77SDag-Erling Smørgrav static void 2441b7579f77SDag-Erling Smørgrav val_handle(struct module_qstate* qstate, struct val_qstate* vq, 2442b7579f77SDag-Erling Smørgrav struct val_env* ve, int id) 2443b7579f77SDag-Erling Smørgrav { 2444b7579f77SDag-Erling Smørgrav int cont = 1; 2445b7579f77SDag-Erling Smørgrav while(cont) { 2446b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "val handle processing q with state %s", 2447b7579f77SDag-Erling Smørgrav val_state_to_string(vq->state)); 2448b7579f77SDag-Erling Smørgrav switch(vq->state) { 2449b7579f77SDag-Erling Smørgrav case VAL_INIT_STATE: 2450b7579f77SDag-Erling Smørgrav cont = processInit(qstate, vq, ve, id); 2451b7579f77SDag-Erling Smørgrav break; 2452b7579f77SDag-Erling Smørgrav case VAL_FINDKEY_STATE: 2453b7579f77SDag-Erling Smørgrav cont = processFindKey(qstate, vq, id); 2454b7579f77SDag-Erling Smørgrav break; 2455b7579f77SDag-Erling Smørgrav case VAL_VALIDATE_STATE: 2456b7579f77SDag-Erling Smørgrav cont = processValidate(qstate, vq, ve, id); 2457b7579f77SDag-Erling Smørgrav break; 2458b7579f77SDag-Erling Smørgrav case VAL_FINISHED_STATE: 2459b7579f77SDag-Erling Smørgrav cont = processFinished(qstate, vq, ve, id); 2460b7579f77SDag-Erling Smørgrav break; 2461b7579f77SDag-Erling Smørgrav case VAL_DLVLOOKUP_STATE: 2462b7579f77SDag-Erling Smørgrav cont = processDLVLookup(qstate, vq, ve, id); 2463b7579f77SDag-Erling Smørgrav break; 2464b7579f77SDag-Erling Smørgrav default: 2465b7579f77SDag-Erling Smørgrav log_warn("validator: invalid state %d", 2466b7579f77SDag-Erling Smørgrav vq->state); 2467b7579f77SDag-Erling Smørgrav cont = 0; 2468b7579f77SDag-Erling Smørgrav break; 2469b7579f77SDag-Erling Smørgrav } 2470b7579f77SDag-Erling Smørgrav } 2471b7579f77SDag-Erling Smørgrav } 2472b7579f77SDag-Erling Smørgrav 2473b7579f77SDag-Erling Smørgrav void 2474b7579f77SDag-Erling Smørgrav val_operate(struct module_qstate* qstate, enum module_ev event, int id, 2475b7579f77SDag-Erling Smørgrav struct outbound_entry* outbound) 2476b7579f77SDag-Erling Smørgrav { 2477b7579f77SDag-Erling Smørgrav struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2478b7579f77SDag-Erling Smørgrav struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id]; 2479b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "validator[module %d] operate: extstate:%s " 2480b7579f77SDag-Erling Smørgrav "event:%s", id, strextstate(qstate->ext_state[id]), 2481b7579f77SDag-Erling Smørgrav strmodulevent(event)); 2482b7579f77SDag-Erling Smørgrav log_query_info(VERB_QUERY, "validator operate: query", 2483b7579f77SDag-Erling Smørgrav &qstate->qinfo); 2484b7579f77SDag-Erling Smørgrav if(vq && qstate->qinfo.qname != vq->qchase.qname) 2485b7579f77SDag-Erling Smørgrav log_query_info(VERB_QUERY, "validator operate: chased to", 2486b7579f77SDag-Erling Smørgrav &vq->qchase); 2487b7579f77SDag-Erling Smørgrav (void)outbound; 2488b7579f77SDag-Erling Smørgrav if(event == module_event_new || 2489b7579f77SDag-Erling Smørgrav (event == module_event_pass && vq == NULL)) { 2490bc892140SDag-Erling Smørgrav 2491b7579f77SDag-Erling Smørgrav /* pass request to next module, to get it */ 2492b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "validator: pass to next module"); 2493b7579f77SDag-Erling Smørgrav qstate->ext_state[id] = module_wait_module; 2494b7579f77SDag-Erling Smørgrav return; 2495b7579f77SDag-Erling Smørgrav } 2496b7579f77SDag-Erling Smørgrav if(event == module_event_moddone) { 2497b7579f77SDag-Erling Smørgrav /* check if validation is needed */ 2498b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "validator: nextmodule returned"); 2499bc892140SDag-Erling Smørgrav 2500b7579f77SDag-Erling Smørgrav if(!needs_validation(qstate, qstate->return_rcode, 2501b7579f77SDag-Erling Smørgrav qstate->return_msg)) { 2502b7579f77SDag-Erling Smørgrav /* no need to validate this */ 2503b7579f77SDag-Erling Smørgrav if(qstate->return_msg) 2504b7579f77SDag-Erling Smørgrav qstate->return_msg->rep->security = 2505b7579f77SDag-Erling Smørgrav sec_status_indeterminate; 2506b7579f77SDag-Erling Smørgrav qstate->ext_state[id] = module_finished; 2507b7579f77SDag-Erling Smørgrav return; 2508b7579f77SDag-Erling Smørgrav } 2509b7579f77SDag-Erling Smørgrav if(already_validated(qstate->return_msg)) { 2510b7579f77SDag-Erling Smørgrav qstate->ext_state[id] = module_finished; 2511b7579f77SDag-Erling Smørgrav return; 2512b7579f77SDag-Erling Smørgrav } 2513b7579f77SDag-Erling Smørgrav /* qclass ANY should have validation result from spawned 2514b7579f77SDag-Erling Smørgrav * queries. If we get here, it is bogus or an internal error */ 2515b7579f77SDag-Erling Smørgrav if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) { 2516b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "cannot validate classANY: bogus"); 2517b7579f77SDag-Erling Smørgrav if(qstate->return_msg) 2518b7579f77SDag-Erling Smørgrav qstate->return_msg->rep->security = 2519b7579f77SDag-Erling Smørgrav sec_status_bogus; 2520b7579f77SDag-Erling Smørgrav qstate->ext_state[id] = module_finished; 2521b7579f77SDag-Erling Smørgrav return; 2522b7579f77SDag-Erling Smørgrav } 2523b7579f77SDag-Erling Smørgrav /* create state to start validation */ 2524b7579f77SDag-Erling Smørgrav qstate->ext_state[id] = module_error; /* override this */ 2525b7579f77SDag-Erling Smørgrav if(!vq) { 2526b7579f77SDag-Erling Smørgrav vq = val_new(qstate, id); 2527b7579f77SDag-Erling Smørgrav if(!vq) { 2528b7579f77SDag-Erling Smørgrav log_err("validator: malloc failure"); 2529b7579f77SDag-Erling Smørgrav qstate->ext_state[id] = module_error; 2530b7579f77SDag-Erling Smørgrav return; 2531b7579f77SDag-Erling Smørgrav } 2532b7579f77SDag-Erling Smørgrav } else if(!vq->orig_msg) { 2533b7579f77SDag-Erling Smørgrav if(!val_new_getmsg(qstate, vq)) { 2534b7579f77SDag-Erling Smørgrav log_err("validator: malloc failure"); 2535b7579f77SDag-Erling Smørgrav qstate->ext_state[id] = module_error; 2536b7579f77SDag-Erling Smørgrav return; 2537b7579f77SDag-Erling Smørgrav } 2538b7579f77SDag-Erling Smørgrav } 2539b7579f77SDag-Erling Smørgrav val_handle(qstate, vq, ve, id); 2540b7579f77SDag-Erling Smørgrav return; 2541b7579f77SDag-Erling Smørgrav } 2542b7579f77SDag-Erling Smørgrav if(event == module_event_pass) { 2543b7579f77SDag-Erling Smørgrav qstate->ext_state[id] = module_error; /* override this */ 2544b7579f77SDag-Erling Smørgrav /* continue processing, since val_env exists */ 2545b7579f77SDag-Erling Smørgrav val_handle(qstate, vq, ve, id); 2546b7579f77SDag-Erling Smørgrav return; 2547b7579f77SDag-Erling Smørgrav } 2548b7579f77SDag-Erling Smørgrav log_err("validator: bad event %s", strmodulevent(event)); 2549b7579f77SDag-Erling Smørgrav qstate->ext_state[id] = module_error; 2550b7579f77SDag-Erling Smørgrav return; 2551b7579f77SDag-Erling Smørgrav } 2552b7579f77SDag-Erling Smørgrav 2553b7579f77SDag-Erling Smørgrav /** 2554b7579f77SDag-Erling Smørgrav * Evaluate the response to a priming request. 2555b7579f77SDag-Erling Smørgrav * 2556b7579f77SDag-Erling Smørgrav * @param dnskey_rrset: DNSKEY rrset (can be NULL if none) in prime reply. 2557b7579f77SDag-Erling Smørgrav * (this rrset is allocated in the wrong region, not the qstate). 2558b7579f77SDag-Erling Smørgrav * @param ta: trust anchor. 2559b7579f77SDag-Erling Smørgrav * @param qstate: qstate that needs key. 2560b7579f77SDag-Erling Smørgrav * @param id: module id. 2561b7579f77SDag-Erling Smørgrav * @return new key entry or NULL on allocation failure. 2562b7579f77SDag-Erling Smørgrav * The key entry will either contain a validated DNSKEY rrset, or 2563b7579f77SDag-Erling Smørgrav * represent a Null key (query failed, but validation did not), or a 2564b7579f77SDag-Erling Smørgrav * Bad key (validation failed). 2565b7579f77SDag-Erling Smørgrav */ 2566b7579f77SDag-Erling Smørgrav static struct key_entry_key* 2567b7579f77SDag-Erling Smørgrav primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset, 2568b7579f77SDag-Erling Smørgrav struct trust_anchor* ta, struct module_qstate* qstate, int id) 2569b7579f77SDag-Erling Smørgrav { 2570b7579f77SDag-Erling Smørgrav struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2571b7579f77SDag-Erling Smørgrav struct key_entry_key* kkey = NULL; 2572b7579f77SDag-Erling Smørgrav enum sec_status sec = sec_status_unchecked; 2573b7579f77SDag-Erling Smørgrav char* reason = NULL; 257409a3aaf3SDag-Erling Smørgrav int downprot = qstate->env->cfg->harden_algo_downgrade; 2575b7579f77SDag-Erling Smørgrav 2576b7579f77SDag-Erling Smørgrav if(!dnskey_rrset) { 2577b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- " 2578b7579f77SDag-Erling Smørgrav "could not fetch DNSKEY rrset", 2579b7579f77SDag-Erling Smørgrav ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass); 2580b7579f77SDag-Erling Smørgrav if(qstate->env->cfg->harden_dnssec_stripped) { 2581b7579f77SDag-Erling Smørgrav errinf(qstate, "no DNSKEY rrset"); 2582b7579f77SDag-Erling Smørgrav kkey = key_entry_create_bad(qstate->region, ta->name, 2583b7579f77SDag-Erling Smørgrav ta->namelen, ta->dclass, BOGUS_KEY_TTL, 2584b7579f77SDag-Erling Smørgrav *qstate->env->now); 2585b7579f77SDag-Erling Smørgrav } else kkey = key_entry_create_null(qstate->region, ta->name, 2586b7579f77SDag-Erling Smørgrav ta->namelen, ta->dclass, NULL_KEY_TTL, 2587b7579f77SDag-Erling Smørgrav *qstate->env->now); 2588b7579f77SDag-Erling Smørgrav if(!kkey) { 2589b7579f77SDag-Erling Smørgrav log_err("out of memory: allocate fail prime key"); 2590b7579f77SDag-Erling Smørgrav return NULL; 2591b7579f77SDag-Erling Smørgrav } 2592b7579f77SDag-Erling Smørgrav return kkey; 2593b7579f77SDag-Erling Smørgrav } 2594b7579f77SDag-Erling Smørgrav /* attempt to verify with trust anchor DS and DNSKEY */ 2595b7579f77SDag-Erling Smørgrav kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve, 2596b7579f77SDag-Erling Smørgrav dnskey_rrset, ta->ds_rrset, ta->dnskey_rrset, downprot, 2597838e13ceSDag-Erling Smørgrav &reason, qstate); 2598b7579f77SDag-Erling Smørgrav if(!kkey) { 2599b7579f77SDag-Erling Smørgrav log_err("out of memory: verifying prime TA"); 2600b7579f77SDag-Erling Smørgrav return NULL; 2601b7579f77SDag-Erling Smørgrav } 2602b7579f77SDag-Erling Smørgrav if(key_entry_isgood(kkey)) 2603b7579f77SDag-Erling Smørgrav sec = sec_status_secure; 2604b7579f77SDag-Erling Smørgrav else 2605b7579f77SDag-Erling Smørgrav sec = sec_status_bogus; 2606b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "validate keys with anchor(DS): %s", 2607b7579f77SDag-Erling Smørgrav sec_status_to_string(sec)); 2608b7579f77SDag-Erling Smørgrav 2609b7579f77SDag-Erling Smørgrav if(sec != sec_status_secure) { 2610b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- " 2611b7579f77SDag-Erling Smørgrav "DNSKEY rrset is not secure", 2612b7579f77SDag-Erling Smørgrav ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass); 2613b7579f77SDag-Erling Smørgrav /* NOTE: in this case, we should probably reject the trust 2614b7579f77SDag-Erling Smørgrav * anchor for longer, perhaps forever. */ 2615b7579f77SDag-Erling Smørgrav if(qstate->env->cfg->harden_dnssec_stripped) { 2616b7579f77SDag-Erling Smørgrav errinf(qstate, reason); 2617b7579f77SDag-Erling Smørgrav kkey = key_entry_create_bad(qstate->region, ta->name, 2618b7579f77SDag-Erling Smørgrav ta->namelen, ta->dclass, BOGUS_KEY_TTL, 2619b7579f77SDag-Erling Smørgrav *qstate->env->now); 2620b7579f77SDag-Erling Smørgrav } else kkey = key_entry_create_null(qstate->region, ta->name, 2621b7579f77SDag-Erling Smørgrav ta->namelen, ta->dclass, NULL_KEY_TTL, 2622b7579f77SDag-Erling Smørgrav *qstate->env->now); 2623b7579f77SDag-Erling Smørgrav if(!kkey) { 2624b7579f77SDag-Erling Smørgrav log_err("out of memory: allocate null prime key"); 2625b7579f77SDag-Erling Smørgrav return NULL; 2626b7579f77SDag-Erling Smørgrav } 2627b7579f77SDag-Erling Smørgrav return kkey; 2628b7579f77SDag-Erling Smørgrav } 2629b7579f77SDag-Erling Smørgrav 2630b7579f77SDag-Erling Smørgrav log_nametypeclass(VERB_DETAIL, "Successfully primed trust anchor", 2631b7579f77SDag-Erling Smørgrav ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass); 2632b7579f77SDag-Erling Smørgrav return kkey; 2633b7579f77SDag-Erling Smørgrav } 2634b7579f77SDag-Erling Smørgrav 2635b7579f77SDag-Erling Smørgrav /** 2636b7579f77SDag-Erling Smørgrav * In inform supers, with the resulting message and rcode and the current 2637b7579f77SDag-Erling Smørgrav * keyset in the super state, validate the DS response, returning a KeyEntry. 2638b7579f77SDag-Erling Smørgrav * 2639b7579f77SDag-Erling Smørgrav * @param qstate: query state that is validating and asked for a DS. 2640b7579f77SDag-Erling Smørgrav * @param vq: validator query state 2641b7579f77SDag-Erling Smørgrav * @param id: module id. 2642b7579f77SDag-Erling Smørgrav * @param rcode: rcode result value. 2643b7579f77SDag-Erling Smørgrav * @param msg: result message (if rcode is OK). 2644b7579f77SDag-Erling Smørgrav * @param qinfo: from the sub query state, query info. 2645b7579f77SDag-Erling Smørgrav * @param ke: the key entry to return. It returns 2646b7579f77SDag-Erling Smørgrav * is_bad if the DS response fails to validate, is_null if the 2647b7579f77SDag-Erling Smørgrav * DS response indicated an end to secure space, is_good if the DS 2648b7579f77SDag-Erling Smørgrav * validated. It returns ke=NULL if the DS response indicated that the 2649b7579f77SDag-Erling Smørgrav * request wasn't a delegation point. 2650b7579f77SDag-Erling Smørgrav * @return 0 on servfail error (malloc failure). 2651b7579f77SDag-Erling Smørgrav */ 2652b7579f77SDag-Erling Smørgrav static int 2653b7579f77SDag-Erling Smørgrav ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, 2654b7579f77SDag-Erling Smørgrav int id, int rcode, struct dns_msg* msg, struct query_info* qinfo, 2655b7579f77SDag-Erling Smørgrav struct key_entry_key** ke) 2656b7579f77SDag-Erling Smørgrav { 2657b7579f77SDag-Erling Smørgrav struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2658b7579f77SDag-Erling Smørgrav char* reason = NULL; 2659b7579f77SDag-Erling Smørgrav enum val_classification subtype; 2660b7579f77SDag-Erling Smørgrav if(rcode != LDNS_RCODE_NOERROR) { 266117d15b25SDag-Erling Smørgrav char rc[16]; 266217d15b25SDag-Erling Smørgrav rc[0]=0; 266317d15b25SDag-Erling Smørgrav (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc)); 2664b7579f77SDag-Erling Smørgrav /* errors here pretty much break validation */ 2665b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "DS response was error, thus bogus"); 2666b7579f77SDag-Erling Smørgrav errinf(qstate, rc); 2667b7579f77SDag-Erling Smørgrav errinf(qstate, "no DS"); 2668b7579f77SDag-Erling Smørgrav goto return_bogus; 2669b7579f77SDag-Erling Smørgrav } 2670b7579f77SDag-Erling Smørgrav 2671b7579f77SDag-Erling Smørgrav subtype = val_classify_response(BIT_RD, qinfo, qinfo, msg->rep, 0); 2672b7579f77SDag-Erling Smørgrav if(subtype == VAL_CLASS_POSITIVE) { 2673b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* ds; 2674b7579f77SDag-Erling Smørgrav enum sec_status sec; 2675b7579f77SDag-Erling Smørgrav ds = reply_find_answer_rrset(qinfo, msg->rep); 2676b7579f77SDag-Erling Smørgrav /* If there was no DS rrset, then we have mis-classified 2677b7579f77SDag-Erling Smørgrav * this message. */ 2678b7579f77SDag-Erling Smørgrav if(!ds) { 2679b7579f77SDag-Erling Smørgrav log_warn("internal error: POSITIVE DS response was " 2680b7579f77SDag-Erling Smørgrav "missing DS."); 2681b7579f77SDag-Erling Smørgrav errinf(qstate, "no DS record"); 2682b7579f77SDag-Erling Smørgrav goto return_bogus; 2683b7579f77SDag-Erling Smørgrav } 2684b7579f77SDag-Erling Smørgrav /* Verify only returns BOGUS or SECURE. If the rrset is 2685b7579f77SDag-Erling Smørgrav * bogus, then we are done. */ 2686b7579f77SDag-Erling Smørgrav sec = val_verify_rrset_entry(qstate->env, ve, ds, 2687838e13ceSDag-Erling Smørgrav vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate); 2688b7579f77SDag-Erling Smørgrav if(sec != sec_status_secure) { 2689b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "DS rrset in DS response did " 2690b7579f77SDag-Erling Smørgrav "not verify"); 2691b7579f77SDag-Erling Smørgrav errinf(qstate, reason); 2692b7579f77SDag-Erling Smørgrav goto return_bogus; 2693b7579f77SDag-Erling Smørgrav } 2694b7579f77SDag-Erling Smørgrav 2695b7579f77SDag-Erling Smørgrav /* If the DS rrset validates, we still have to make sure 2696b7579f77SDag-Erling Smørgrav * that they are usable. */ 2697b7579f77SDag-Erling Smørgrav if(!val_dsset_isusable(ds)) { 2698b7579f77SDag-Erling Smørgrav /* If they aren't usable, then we treat it like 2699b7579f77SDag-Erling Smørgrav * there was no DS. */ 2700b7579f77SDag-Erling Smørgrav *ke = key_entry_create_null(qstate->region, 2701b7579f77SDag-Erling Smørgrav qinfo->qname, qinfo->qname_len, qinfo->qclass, 2702b7579f77SDag-Erling Smørgrav ub_packed_rrset_ttl(ds), *qstate->env->now); 2703b7579f77SDag-Erling Smørgrav return (*ke) != NULL; 2704b7579f77SDag-Erling Smørgrav } 2705b7579f77SDag-Erling Smørgrav 2706b7579f77SDag-Erling Smørgrav /* Otherwise, we return the positive response. */ 2707b7579f77SDag-Erling Smørgrav log_query_info(VERB_DETAIL, "validated DS", qinfo); 2708b7579f77SDag-Erling Smørgrav *ke = key_entry_create_rrset(qstate->region, 2709b7579f77SDag-Erling Smørgrav qinfo->qname, qinfo->qname_len, qinfo->qclass, ds, 2710b7579f77SDag-Erling Smørgrav NULL, *qstate->env->now); 2711b7579f77SDag-Erling Smørgrav return (*ke) != NULL; 2712b7579f77SDag-Erling Smørgrav } else if(subtype == VAL_CLASS_NODATA || 2713b7579f77SDag-Erling Smørgrav subtype == VAL_CLASS_NAMEERROR) { 2714b7579f77SDag-Erling Smørgrav /* NODATA means that the qname exists, but that there was 2715b7579f77SDag-Erling Smørgrav * no DS. This is a pretty normal case. */ 271617d15b25SDag-Erling Smørgrav time_t proof_ttl = 0; 2717b7579f77SDag-Erling Smørgrav enum sec_status sec; 2718b7579f77SDag-Erling Smørgrav 2719b7579f77SDag-Erling Smørgrav /* make sure there are NSECs or NSEC3s with signatures */ 2720b7579f77SDag-Erling Smørgrav if(!val_has_signed_nsecs(msg->rep, &reason)) { 2721b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "no NSECs: %s", reason); 2722b7579f77SDag-Erling Smørgrav errinf(qstate, reason); 2723b7579f77SDag-Erling Smørgrav goto return_bogus; 2724b7579f77SDag-Erling Smørgrav } 2725b7579f77SDag-Erling Smørgrav 2726b7579f77SDag-Erling Smørgrav /* For subtype Name Error. 2727b7579f77SDag-Erling Smørgrav * attempt ANS 2.8.1.0 compatibility where it sets rcode 2728b7579f77SDag-Erling Smørgrav * to nxdomain, but really this is an Nodata/Noerror response. 2729b7579f77SDag-Erling Smørgrav * Find and prove the empty nonterminal in that case */ 2730b7579f77SDag-Erling Smørgrav 2731b7579f77SDag-Erling Smørgrav /* Try to prove absence of the DS with NSEC */ 2732b7579f77SDag-Erling Smørgrav sec = val_nsec_prove_nodata_dsreply( 2733b7579f77SDag-Erling Smørgrav qstate->env, ve, qinfo, msg->rep, vq->key_entry, 2734838e13ceSDag-Erling Smørgrav &proof_ttl, &reason, qstate); 2735b7579f77SDag-Erling Smørgrav switch(sec) { 2736b7579f77SDag-Erling Smørgrav case sec_status_secure: 2737b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "NSEC RRset for the " 2738b7579f77SDag-Erling Smørgrav "referral proved no DS."); 2739b7579f77SDag-Erling Smørgrav *ke = key_entry_create_null(qstate->region, 2740b7579f77SDag-Erling Smørgrav qinfo->qname, qinfo->qname_len, 2741b7579f77SDag-Erling Smørgrav qinfo->qclass, proof_ttl, 2742b7579f77SDag-Erling Smørgrav *qstate->env->now); 2743b7579f77SDag-Erling Smørgrav return (*ke) != NULL; 2744b7579f77SDag-Erling Smørgrav case sec_status_insecure: 2745b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "NSEC RRset for the " 2746b7579f77SDag-Erling Smørgrav "referral proved not a delegation point"); 2747b7579f77SDag-Erling Smørgrav *ke = NULL; 2748b7579f77SDag-Erling Smørgrav return 1; 2749b7579f77SDag-Erling Smørgrav case sec_status_bogus: 2750b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "NSEC RRset for the " 2751b7579f77SDag-Erling Smørgrav "referral did not prove no DS."); 2752b7579f77SDag-Erling Smørgrav errinf(qstate, reason); 2753b7579f77SDag-Erling Smørgrav goto return_bogus; 2754b7579f77SDag-Erling Smørgrav case sec_status_unchecked: 2755b7579f77SDag-Erling Smørgrav default: 2756b7579f77SDag-Erling Smørgrav /* NSEC proof did not work, try next */ 2757b7579f77SDag-Erling Smørgrav break; 2758b7579f77SDag-Erling Smørgrav } 2759b7579f77SDag-Erling Smørgrav 2760b7579f77SDag-Erling Smørgrav sec = nsec3_prove_nods(qstate->env, ve, 2761b7579f77SDag-Erling Smørgrav msg->rep->rrsets + msg->rep->an_numrrsets, 2762838e13ceSDag-Erling Smørgrav msg->rep->ns_numrrsets, qinfo, vq->key_entry, &reason, 2763838e13ceSDag-Erling Smørgrav qstate); 2764b7579f77SDag-Erling Smørgrav switch(sec) { 2765b7579f77SDag-Erling Smørgrav case sec_status_insecure: 2766b7579f77SDag-Erling Smørgrav /* case insecure also continues to unsigned 2767b7579f77SDag-Erling Smørgrav * space. If nsec3-iter-count too high or 2768b7579f77SDag-Erling Smørgrav * optout, then treat below as unsigned */ 2769b7579f77SDag-Erling Smørgrav case sec_status_secure: 2770b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "NSEC3s for the " 2771b7579f77SDag-Erling Smørgrav "referral proved no DS."); 2772b7579f77SDag-Erling Smørgrav *ke = key_entry_create_null(qstate->region, 2773b7579f77SDag-Erling Smørgrav qinfo->qname, qinfo->qname_len, 2774b7579f77SDag-Erling Smørgrav qinfo->qclass, proof_ttl, 2775b7579f77SDag-Erling Smørgrav *qstate->env->now); 2776b7579f77SDag-Erling Smørgrav return (*ke) != NULL; 2777b7579f77SDag-Erling Smørgrav case sec_status_indeterminate: 2778b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "NSEC3s for the " 2779b7579f77SDag-Erling Smørgrav "referral proved no delegation"); 2780b7579f77SDag-Erling Smørgrav *ke = NULL; 2781b7579f77SDag-Erling Smørgrav return 1; 2782b7579f77SDag-Erling Smørgrav case sec_status_bogus: 2783b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "NSEC3s for the " 2784b7579f77SDag-Erling Smørgrav "referral did not prove no DS."); 2785b7579f77SDag-Erling Smørgrav errinf(qstate, reason); 2786b7579f77SDag-Erling Smørgrav goto return_bogus; 2787b7579f77SDag-Erling Smørgrav case sec_status_unchecked: 2788b7579f77SDag-Erling Smørgrav default: 2789b7579f77SDag-Erling Smørgrav /* NSEC3 proof did not work */ 2790b7579f77SDag-Erling Smørgrav break; 2791b7579f77SDag-Erling Smørgrav } 2792b7579f77SDag-Erling Smørgrav 2793b7579f77SDag-Erling Smørgrav /* Apparently, no available NSEC/NSEC3 proved NODATA, so 2794b7579f77SDag-Erling Smørgrav * this is BOGUS. */ 2795b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "DS %s ran out of options, so return " 2796b7579f77SDag-Erling Smørgrav "bogus", val_classification_to_string(subtype)); 2797b7579f77SDag-Erling Smørgrav errinf(qstate, "no DS but also no proof of that"); 2798b7579f77SDag-Erling Smørgrav goto return_bogus; 2799b7579f77SDag-Erling Smørgrav } else if(subtype == VAL_CLASS_CNAME || 2800b7579f77SDag-Erling Smørgrav subtype == VAL_CLASS_CNAMENOANSWER) { 2801b7579f77SDag-Erling Smørgrav /* if the CNAME matches the exact name we want and is signed 2802b7579f77SDag-Erling Smørgrav * properly, then also, we are sure that no DS exists there, 2803b7579f77SDag-Erling Smørgrav * much like a NODATA proof */ 2804b7579f77SDag-Erling Smørgrav enum sec_status sec; 2805b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* cname; 2806b7579f77SDag-Erling Smørgrav cname = reply_find_rrset_section_an(msg->rep, qinfo->qname, 2807b7579f77SDag-Erling Smørgrav qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass); 2808b7579f77SDag-Erling Smørgrav if(!cname) { 2809b7579f77SDag-Erling Smørgrav errinf(qstate, "validator classified CNAME but no " 2810b7579f77SDag-Erling Smørgrav "CNAME of the queried name for DS"); 2811b7579f77SDag-Erling Smørgrav goto return_bogus; 2812b7579f77SDag-Erling Smørgrav } 2813b7579f77SDag-Erling Smørgrav if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count 2814b7579f77SDag-Erling Smørgrav == 0) { 2815b7579f77SDag-Erling Smørgrav if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep-> 2816b7579f77SDag-Erling Smørgrav rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) { 2817b7579f77SDag-Erling Smørgrav errinf(qstate, "DS got DNAME answer"); 2818b7579f77SDag-Erling Smørgrav } else { 2819b7579f77SDag-Erling Smørgrav errinf(qstate, "DS got unsigned CNAME answer"); 2820b7579f77SDag-Erling Smørgrav } 2821b7579f77SDag-Erling Smørgrav goto return_bogus; 2822b7579f77SDag-Erling Smørgrav } 2823b7579f77SDag-Erling Smørgrav sec = val_verify_rrset_entry(qstate->env, ve, cname, 2824838e13ceSDag-Erling Smørgrav vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate); 2825b7579f77SDag-Erling Smørgrav if(sec == sec_status_secure) { 2826b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "CNAME validated, " 2827b7579f77SDag-Erling Smørgrav "proof that DS does not exist"); 2828b7579f77SDag-Erling Smørgrav /* and that it is not a referral point */ 2829b7579f77SDag-Erling Smørgrav *ke = NULL; 2830b7579f77SDag-Erling Smørgrav return 1; 2831b7579f77SDag-Erling Smørgrav } 2832b7579f77SDag-Erling Smørgrav errinf(qstate, "CNAME in DS response was not secure."); 2833b7579f77SDag-Erling Smørgrav errinf(qstate, reason); 2834b7579f77SDag-Erling Smørgrav goto return_bogus; 2835b7579f77SDag-Erling Smørgrav } else { 2836b7579f77SDag-Erling Smørgrav verbose(VERB_QUERY, "Encountered an unhandled type of " 2837b7579f77SDag-Erling Smørgrav "DS response, thus bogus."); 2838b7579f77SDag-Erling Smørgrav errinf(qstate, "no DS and"); 2839b7579f77SDag-Erling Smørgrav if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) { 284017d15b25SDag-Erling Smørgrav char rc[16]; 284117d15b25SDag-Erling Smørgrav rc[0]=0; 284217d15b25SDag-Erling Smørgrav (void)sldns_wire2str_rcode_buf((int)FLAGS_GET_RCODE( 284317d15b25SDag-Erling Smørgrav msg->rep->flags), rc, sizeof(rc)); 2844b7579f77SDag-Erling Smørgrav errinf(qstate, rc); 2845b7579f77SDag-Erling Smørgrav } else errinf(qstate, val_classification_to_string(subtype)); 2846b7579f77SDag-Erling Smørgrav errinf(qstate, "message fails to prove that"); 2847b7579f77SDag-Erling Smørgrav goto return_bogus; 2848b7579f77SDag-Erling Smørgrav } 2849b7579f77SDag-Erling Smørgrav return_bogus: 2850b7579f77SDag-Erling Smørgrav *ke = key_entry_create_bad(qstate->region, qinfo->qname, 2851b7579f77SDag-Erling Smørgrav qinfo->qname_len, qinfo->qclass, 2852b7579f77SDag-Erling Smørgrav BOGUS_KEY_TTL, *qstate->env->now); 2853b7579f77SDag-Erling Smørgrav return (*ke) != NULL; 2854b7579f77SDag-Erling Smørgrav } 2855b7579f77SDag-Erling Smørgrav 2856b7579f77SDag-Erling Smørgrav /** 2857b7579f77SDag-Erling Smørgrav * Process DS response. Called from inform_supers. 2858b7579f77SDag-Erling Smørgrav * Because it is in inform_supers, the mesh itself is busy doing callbacks 2859b7579f77SDag-Erling Smørgrav * for a state that is to be deleted soon; don't touch the mesh; instead 2860b7579f77SDag-Erling Smørgrav * set a state in the super, as the super will be reactivated soon. 2861b7579f77SDag-Erling Smørgrav * Perform processing to determine what state to set in the super. 2862b7579f77SDag-Erling Smørgrav * 2863b7579f77SDag-Erling Smørgrav * @param qstate: query state that is validating and asked for a DS. 2864b7579f77SDag-Erling Smørgrav * @param vq: validator query state 2865b7579f77SDag-Erling Smørgrav * @param id: module id. 2866b7579f77SDag-Erling Smørgrav * @param rcode: rcode result value. 2867b7579f77SDag-Erling Smørgrav * @param msg: result message (if rcode is OK). 2868b7579f77SDag-Erling Smørgrav * @param qinfo: from the sub query state, query info. 2869b7579f77SDag-Erling Smørgrav * @param origin: the origin of msg. 2870b7579f77SDag-Erling Smørgrav */ 2871b7579f77SDag-Erling Smørgrav static void 2872b7579f77SDag-Erling Smørgrav process_ds_response(struct module_qstate* qstate, struct val_qstate* vq, 2873b7579f77SDag-Erling Smørgrav int id, int rcode, struct dns_msg* msg, struct query_info* qinfo, 2874b7579f77SDag-Erling Smørgrav struct sock_list* origin) 2875b7579f77SDag-Erling Smørgrav { 2876b7579f77SDag-Erling Smørgrav struct key_entry_key* dske = NULL; 2877b7579f77SDag-Erling Smørgrav uint8_t* olds = vq->empty_DS_name; 2878b7579f77SDag-Erling Smørgrav vq->empty_DS_name = NULL; 2879b7579f77SDag-Erling Smørgrav if(!ds_response_to_ke(qstate, vq, id, rcode, msg, qinfo, &dske)) { 2880b7579f77SDag-Erling Smørgrav log_err("malloc failure in process_ds_response"); 2881b7579f77SDag-Erling Smørgrav vq->key_entry = NULL; /* make it error */ 2882b7579f77SDag-Erling Smørgrav vq->state = VAL_VALIDATE_STATE; 2883b7579f77SDag-Erling Smørgrav return; 2884b7579f77SDag-Erling Smørgrav } 2885b7579f77SDag-Erling Smørgrav if(dske == NULL) { 2886b7579f77SDag-Erling Smørgrav vq->empty_DS_name = regional_alloc_init(qstate->region, 2887b7579f77SDag-Erling Smørgrav qinfo->qname, qinfo->qname_len); 2888b7579f77SDag-Erling Smørgrav if(!vq->empty_DS_name) { 2889b7579f77SDag-Erling Smørgrav log_err("malloc failure in empty_DS_name"); 2890b7579f77SDag-Erling Smørgrav vq->key_entry = NULL; /* make it error */ 2891b7579f77SDag-Erling Smørgrav vq->state = VAL_VALIDATE_STATE; 2892b7579f77SDag-Erling Smørgrav return; 2893b7579f77SDag-Erling Smørgrav } 2894b7579f77SDag-Erling Smørgrav vq->empty_DS_len = qinfo->qname_len; 2895b7579f77SDag-Erling Smørgrav vq->chain_blacklist = NULL; 2896b7579f77SDag-Erling Smørgrav /* ds response indicated that we aren't on a delegation point. 2897b7579f77SDag-Erling Smørgrav * Keep the forState.state on FINDKEY. */ 2898b7579f77SDag-Erling Smørgrav } else if(key_entry_isgood(dske)) { 2899b7579f77SDag-Erling Smørgrav vq->ds_rrset = key_entry_get_rrset(dske, qstate->region); 2900b7579f77SDag-Erling Smørgrav if(!vq->ds_rrset) { 2901b7579f77SDag-Erling Smørgrav log_err("malloc failure in process DS"); 2902b7579f77SDag-Erling Smørgrav vq->key_entry = NULL; /* make it error */ 2903b7579f77SDag-Erling Smørgrav vq->state = VAL_VALIDATE_STATE; 2904b7579f77SDag-Erling Smørgrav return; 2905b7579f77SDag-Erling Smørgrav } 2906b7579f77SDag-Erling Smørgrav vq->chain_blacklist = NULL; /* fresh blacklist for next part*/ 2907b7579f77SDag-Erling Smørgrav /* Keep the forState.state on FINDKEY. */ 2908b7579f77SDag-Erling Smørgrav } else if(key_entry_isbad(dske) 2909b7579f77SDag-Erling Smørgrav && vq->restart_count < VAL_MAX_RESTART_COUNT) { 2910b7579f77SDag-Erling Smørgrav vq->empty_DS_name = olds; 2911b7579f77SDag-Erling Smørgrav val_blacklist(&vq->chain_blacklist, qstate->region, origin, 1); 2912b7579f77SDag-Erling Smørgrav qstate->errinf = NULL; 2913b7579f77SDag-Erling Smørgrav vq->restart_count++; 2914b7579f77SDag-Erling Smørgrav } else { 2915b7579f77SDag-Erling Smørgrav if(key_entry_isbad(dske)) { 2916b7579f77SDag-Erling Smørgrav errinf_origin(qstate, origin); 2917b7579f77SDag-Erling Smørgrav errinf_dname(qstate, "for DS", qinfo->qname); 2918b7579f77SDag-Erling Smørgrav } 2919b7579f77SDag-Erling Smørgrav /* NOTE: the reason for the DS to be not good (that is, 2920b7579f77SDag-Erling Smørgrav * either bad or null) should have been logged by 2921b7579f77SDag-Erling Smørgrav * dsResponseToKE. */ 2922b7579f77SDag-Erling Smørgrav vq->key_entry = dske; 2923b7579f77SDag-Erling Smørgrav /* The FINDKEY phase has ended, so move on. */ 2924b7579f77SDag-Erling Smørgrav vq->state = VAL_VALIDATE_STATE; 2925b7579f77SDag-Erling Smørgrav } 2926b7579f77SDag-Erling Smørgrav } 2927b7579f77SDag-Erling Smørgrav 2928b7579f77SDag-Erling Smørgrav /** 2929b7579f77SDag-Erling Smørgrav * Process DNSKEY response. Called from inform_supers. 2930b7579f77SDag-Erling Smørgrav * Sets the key entry in the state. 2931b7579f77SDag-Erling Smørgrav * Because it is in inform_supers, the mesh itself is busy doing callbacks 2932b7579f77SDag-Erling Smørgrav * for a state that is to be deleted soon; don't touch the mesh; instead 2933b7579f77SDag-Erling Smørgrav * set a state in the super, as the super will be reactivated soon. 2934b7579f77SDag-Erling Smørgrav * Perform processing to determine what state to set in the super. 2935b7579f77SDag-Erling Smørgrav * 2936b7579f77SDag-Erling Smørgrav * @param qstate: query state that is validating and asked for a DNSKEY. 2937b7579f77SDag-Erling Smørgrav * @param vq: validator query state 2938b7579f77SDag-Erling Smørgrav * @param id: module id. 2939b7579f77SDag-Erling Smørgrav * @param rcode: rcode result value. 2940b7579f77SDag-Erling Smørgrav * @param msg: result message (if rcode is OK). 2941b7579f77SDag-Erling Smørgrav * @param qinfo: from the sub query state, query info. 2942b7579f77SDag-Erling Smørgrav * @param origin: the origin of msg. 2943b7579f77SDag-Erling Smørgrav */ 2944b7579f77SDag-Erling Smørgrav static void 2945b7579f77SDag-Erling Smørgrav process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq, 2946b7579f77SDag-Erling Smørgrav int id, int rcode, struct dns_msg* msg, struct query_info* qinfo, 2947b7579f77SDag-Erling Smørgrav struct sock_list* origin) 2948b7579f77SDag-Erling Smørgrav { 2949b7579f77SDag-Erling Smørgrav struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2950b7579f77SDag-Erling Smørgrav struct key_entry_key* old = vq->key_entry; 2951b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* dnskey = NULL; 2952b7579f77SDag-Erling Smørgrav int downprot; 2953b7579f77SDag-Erling Smørgrav char* reason = NULL; 2954b7579f77SDag-Erling Smørgrav 2955b7579f77SDag-Erling Smørgrav if(rcode == LDNS_RCODE_NOERROR) 2956b7579f77SDag-Erling Smørgrav dnskey = reply_find_answer_rrset(qinfo, msg->rep); 2957b7579f77SDag-Erling Smørgrav 2958b7579f77SDag-Erling Smørgrav if(dnskey == NULL) { 2959b7579f77SDag-Erling Smørgrav /* bad response */ 2960b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "Missing DNSKEY RRset in response to " 2961b7579f77SDag-Erling Smørgrav "DNSKEY query."); 2962b7579f77SDag-Erling Smørgrav if(vq->restart_count < VAL_MAX_RESTART_COUNT) { 2963b7579f77SDag-Erling Smørgrav val_blacklist(&vq->chain_blacklist, qstate->region, 2964b7579f77SDag-Erling Smørgrav origin, 1); 2965b7579f77SDag-Erling Smørgrav qstate->errinf = NULL; 2966b7579f77SDag-Erling Smørgrav vq->restart_count++; 2967b7579f77SDag-Erling Smørgrav return; 2968b7579f77SDag-Erling Smørgrav } 2969b7579f77SDag-Erling Smørgrav vq->key_entry = key_entry_create_bad(qstate->region, 2970b7579f77SDag-Erling Smørgrav qinfo->qname, qinfo->qname_len, qinfo->qclass, 2971b7579f77SDag-Erling Smørgrav BOGUS_KEY_TTL, *qstate->env->now); 2972b7579f77SDag-Erling Smørgrav if(!vq->key_entry) { 2973b7579f77SDag-Erling Smørgrav log_err("alloc failure in missing dnskey response"); 2974b7579f77SDag-Erling Smørgrav /* key_entry is NULL for failure in Validate */ 2975b7579f77SDag-Erling Smørgrav } 2976b7579f77SDag-Erling Smørgrav errinf(qstate, "No DNSKEY record"); 2977b7579f77SDag-Erling Smørgrav errinf_origin(qstate, origin); 2978b7579f77SDag-Erling Smørgrav errinf_dname(qstate, "for key", qinfo->qname); 2979b7579f77SDag-Erling Smørgrav vq->state = VAL_VALIDATE_STATE; 2980b7579f77SDag-Erling Smørgrav return; 2981b7579f77SDag-Erling Smørgrav } 2982b7579f77SDag-Erling Smørgrav if(!vq->ds_rrset) { 2983b7579f77SDag-Erling Smørgrav log_err("internal error: no DS rrset for new DNSKEY response"); 2984b7579f77SDag-Erling Smørgrav vq->key_entry = NULL; 2985b7579f77SDag-Erling Smørgrav vq->state = VAL_VALIDATE_STATE; 2986b7579f77SDag-Erling Smørgrav return; 2987b7579f77SDag-Erling Smørgrav } 2988b75612f8SDag-Erling Smørgrav downprot = qstate->env->cfg->harden_algo_downgrade; 2989b7579f77SDag-Erling Smørgrav vq->key_entry = val_verify_new_DNSKEYs(qstate->region, qstate->env, 2990838e13ceSDag-Erling Smørgrav ve, dnskey, vq->ds_rrset, downprot, &reason, qstate); 2991b7579f77SDag-Erling Smørgrav 2992b7579f77SDag-Erling Smørgrav if(!vq->key_entry) { 2993b7579f77SDag-Erling Smørgrav log_err("out of memory in verify new DNSKEYs"); 2994b7579f77SDag-Erling Smørgrav vq->state = VAL_VALIDATE_STATE; 2995b7579f77SDag-Erling Smørgrav return; 2996b7579f77SDag-Erling Smørgrav } 2997b7579f77SDag-Erling Smørgrav /* If the key entry isBad or isNull, then we can move on to the next 2998b7579f77SDag-Erling Smørgrav * state. */ 2999b7579f77SDag-Erling Smørgrav if(!key_entry_isgood(vq->key_entry)) { 3000b7579f77SDag-Erling Smørgrav if(key_entry_isbad(vq->key_entry)) { 3001b7579f77SDag-Erling Smørgrav if(vq->restart_count < VAL_MAX_RESTART_COUNT) { 3002b7579f77SDag-Erling Smørgrav val_blacklist(&vq->chain_blacklist, 3003b7579f77SDag-Erling Smørgrav qstate->region, origin, 1); 3004b7579f77SDag-Erling Smørgrav qstate->errinf = NULL; 3005b7579f77SDag-Erling Smørgrav vq->restart_count++; 3006b7579f77SDag-Erling Smørgrav vq->key_entry = old; 3007b7579f77SDag-Erling Smørgrav return; 3008b7579f77SDag-Erling Smørgrav } 3009b7579f77SDag-Erling Smørgrav verbose(VERB_DETAIL, "Did not match a DS to a DNSKEY, " 3010b7579f77SDag-Erling Smørgrav "thus bogus."); 3011b7579f77SDag-Erling Smørgrav errinf(qstate, reason); 3012b7579f77SDag-Erling Smørgrav errinf_origin(qstate, origin); 3013b7579f77SDag-Erling Smørgrav errinf_dname(qstate, "for key", qinfo->qname); 3014b7579f77SDag-Erling Smørgrav } 3015b7579f77SDag-Erling Smørgrav vq->chain_blacklist = NULL; 3016b7579f77SDag-Erling Smørgrav vq->state = VAL_VALIDATE_STATE; 3017b7579f77SDag-Erling Smørgrav return; 3018b7579f77SDag-Erling Smørgrav } 3019b7579f77SDag-Erling Smørgrav vq->chain_blacklist = NULL; 3020b7579f77SDag-Erling Smørgrav qstate->errinf = NULL; 3021b7579f77SDag-Erling Smørgrav 3022b7579f77SDag-Erling Smørgrav /* The DNSKEY validated, so cache it as a trusted key rrset. */ 3023b7579f77SDag-Erling Smørgrav key_cache_insert(ve->kcache, vq->key_entry, qstate); 3024b7579f77SDag-Erling Smørgrav 3025b7579f77SDag-Erling Smørgrav /* If good, we stay in the FINDKEY state. */ 3026b7579f77SDag-Erling Smørgrav log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo); 3027b7579f77SDag-Erling Smørgrav } 3028b7579f77SDag-Erling Smørgrav 3029b7579f77SDag-Erling Smørgrav /** 3030b7579f77SDag-Erling Smørgrav * Process prime response 3031b7579f77SDag-Erling Smørgrav * Sets the key entry in the state. 3032b7579f77SDag-Erling Smørgrav * 3033b7579f77SDag-Erling Smørgrav * @param qstate: query state that is validating and primed a trust anchor. 3034b7579f77SDag-Erling Smørgrav * @param vq: validator query state 3035b7579f77SDag-Erling Smørgrav * @param id: module id. 3036b7579f77SDag-Erling Smørgrav * @param rcode: rcode result value. 3037b7579f77SDag-Erling Smørgrav * @param msg: result message (if rcode is OK). 3038b7579f77SDag-Erling Smørgrav * @param origin: the origin of msg. 3039b7579f77SDag-Erling Smørgrav */ 3040b7579f77SDag-Erling Smørgrav static void 3041b7579f77SDag-Erling Smørgrav process_prime_response(struct module_qstate* qstate, struct val_qstate* vq, 3042b7579f77SDag-Erling Smørgrav int id, int rcode, struct dns_msg* msg, struct sock_list* origin) 3043b7579f77SDag-Erling Smørgrav { 3044b7579f77SDag-Erling Smørgrav struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 3045b7579f77SDag-Erling Smørgrav struct ub_packed_rrset_key* dnskey_rrset = NULL; 3046b7579f77SDag-Erling Smørgrav struct trust_anchor* ta = anchor_find(qstate->env->anchors, 3047b7579f77SDag-Erling Smørgrav vq->trust_anchor_name, vq->trust_anchor_labs, 3048b7579f77SDag-Erling Smørgrav vq->trust_anchor_len, vq->qchase.qclass); 3049b7579f77SDag-Erling Smørgrav if(!ta) { 3050b7579f77SDag-Erling Smørgrav /* trust anchor revoked, restart with less anchors */ 3051b7579f77SDag-Erling Smørgrav vq->state = VAL_INIT_STATE; 3052b7579f77SDag-Erling Smørgrav if(!vq->trust_anchor_name) 3053b7579f77SDag-Erling Smørgrav vq->state = VAL_VALIDATE_STATE; /* break a loop */ 3054b7579f77SDag-Erling Smørgrav vq->trust_anchor_name = NULL; 3055b7579f77SDag-Erling Smørgrav return; 3056b7579f77SDag-Erling Smørgrav } 3057b7579f77SDag-Erling Smørgrav /* Fetch and validate the keyEntry that corresponds to the 3058b7579f77SDag-Erling Smørgrav * current trust anchor. */ 3059b7579f77SDag-Erling Smørgrav if(rcode == LDNS_RCODE_NOERROR) { 3060b7579f77SDag-Erling Smørgrav dnskey_rrset = reply_find_rrset_section_an(msg->rep, 3061b7579f77SDag-Erling Smørgrav ta->name, ta->namelen, LDNS_RR_TYPE_DNSKEY, 3062b7579f77SDag-Erling Smørgrav ta->dclass); 3063b7579f77SDag-Erling Smørgrav } 3064c7f4d7adSDag-Erling Smørgrav 3065b7579f77SDag-Erling Smørgrav if(ta->autr) { 3066838e13ceSDag-Erling Smørgrav if(!autr_process_prime(qstate->env, ve, ta, dnskey_rrset, 3067838e13ceSDag-Erling Smørgrav qstate)) { 3068b7579f77SDag-Erling Smørgrav /* trust anchor revoked, restart with less anchors */ 3069b7579f77SDag-Erling Smørgrav vq->state = VAL_INIT_STATE; 3070b7579f77SDag-Erling Smørgrav vq->trust_anchor_name = NULL; 3071b7579f77SDag-Erling Smørgrav return; 3072b7579f77SDag-Erling Smørgrav } 3073b7579f77SDag-Erling Smørgrav } 3074b7579f77SDag-Erling Smørgrav vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, id); 3075b7579f77SDag-Erling Smørgrav lock_basic_unlock(&ta->lock); 3076b7579f77SDag-Erling Smørgrav if(vq->key_entry) { 3077b7579f77SDag-Erling Smørgrav if(key_entry_isbad(vq->key_entry) 3078b7579f77SDag-Erling Smørgrav && vq->restart_count < VAL_MAX_RESTART_COUNT) { 3079b7579f77SDag-Erling Smørgrav val_blacklist(&vq->chain_blacklist, qstate->region, 3080b7579f77SDag-Erling Smørgrav origin, 1); 3081b7579f77SDag-Erling Smørgrav qstate->errinf = NULL; 3082b7579f77SDag-Erling Smørgrav vq->restart_count++; 3083b7579f77SDag-Erling Smørgrav vq->key_entry = NULL; 3084b7579f77SDag-Erling Smørgrav vq->state = VAL_INIT_STATE; 3085b7579f77SDag-Erling Smørgrav return; 3086b7579f77SDag-Erling Smørgrav } 3087b7579f77SDag-Erling Smørgrav vq->chain_blacklist = NULL; 3088b7579f77SDag-Erling Smørgrav errinf_origin(qstate, origin); 3089b7579f77SDag-Erling Smørgrav errinf_dname(qstate, "for trust anchor", ta->name); 3090b7579f77SDag-Erling Smørgrav /* store the freshly primed entry in the cache */ 3091b7579f77SDag-Erling Smørgrav key_cache_insert(ve->kcache, vq->key_entry, qstate); 3092b7579f77SDag-Erling Smørgrav } 3093b7579f77SDag-Erling Smørgrav 3094b7579f77SDag-Erling Smørgrav /* If the result of the prime is a null key, skip the FINDKEY state.*/ 3095b7579f77SDag-Erling Smørgrav if(!vq->key_entry || key_entry_isnull(vq->key_entry) || 3096b7579f77SDag-Erling Smørgrav key_entry_isbad(vq->key_entry)) { 3097b7579f77SDag-Erling Smørgrav vq->state = VAL_VALIDATE_STATE; 3098b7579f77SDag-Erling Smørgrav } 3099b7579f77SDag-Erling Smørgrav /* the qstate will be reactivated after inform_super is done */ 3100b7579f77SDag-Erling Smørgrav } 3101b7579f77SDag-Erling Smørgrav 3102b7579f77SDag-Erling Smørgrav /** 3103b7579f77SDag-Erling Smørgrav * Process DLV response. Called from inform_supers. 3104b7579f77SDag-Erling Smørgrav * Because it is in inform_supers, the mesh itself is busy doing callbacks 3105b7579f77SDag-Erling Smørgrav * for a state that is to be deleted soon; don't touch the mesh; instead 3106b7579f77SDag-Erling Smørgrav * set a state in the super, as the super will be reactivated soon. 3107b7579f77SDag-Erling Smørgrav * Perform processing to determine what state to set in the super. 3108b7579f77SDag-Erling Smørgrav * 3109b7579f77SDag-Erling Smørgrav * @param qstate: query state that is validating and asked for a DLV. 3110b7579f77SDag-Erling Smørgrav * @param vq: validator query state 3111b7579f77SDag-Erling Smørgrav * @param id: module id. 3112b7579f77SDag-Erling Smørgrav * @param rcode: rcode result value. 3113b7579f77SDag-Erling Smørgrav * @param msg: result message (if rcode is OK). 3114b7579f77SDag-Erling Smørgrav * @param qinfo: from the sub query state, query info. 3115b7579f77SDag-Erling Smørgrav */ 3116b7579f77SDag-Erling Smørgrav static void 3117b7579f77SDag-Erling Smørgrav process_dlv_response(struct module_qstate* qstate, struct val_qstate* vq, 3118b7579f77SDag-Erling Smørgrav int id, int rcode, struct dns_msg* msg, struct query_info* qinfo) 3119b7579f77SDag-Erling Smørgrav { 3120b7579f77SDag-Erling Smørgrav struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 3121b7579f77SDag-Erling Smørgrav 3122b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "process dlv response to super"); 3123b7579f77SDag-Erling Smørgrav if(rcode != LDNS_RCODE_NOERROR) { 3124b7579f77SDag-Erling Smørgrav /* lookup failed, set in vq to give up */ 3125b7579f77SDag-Erling Smørgrav vq->dlv_status = dlv_error; 3126b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "response is error"); 3127b7579f77SDag-Erling Smørgrav return; 3128b7579f77SDag-Erling Smørgrav } 3129b7579f77SDag-Erling Smørgrav if(msg->rep->security != sec_status_secure) { 3130b7579f77SDag-Erling Smørgrav vq->dlv_status = dlv_error; 3131b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "response is not secure, %s", 3132b7579f77SDag-Erling Smørgrav sec_status_to_string(msg->rep->security)); 3133b7579f77SDag-Erling Smørgrav return; 3134b7579f77SDag-Erling Smørgrav } 3135b7579f77SDag-Erling Smørgrav /* was the lookup a success? validated DLV? */ 3136b7579f77SDag-Erling Smørgrav if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NOERROR && 3137b7579f77SDag-Erling Smørgrav msg->rep->an_numrrsets == 1 && 3138b7579f77SDag-Erling Smørgrav msg->rep->security == sec_status_secure && 3139b7579f77SDag-Erling Smørgrav ntohs(msg->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DLV && 3140b7579f77SDag-Erling Smørgrav ntohs(msg->rep->rrsets[0]->rk.rrset_class) == qinfo->qclass && 3141b7579f77SDag-Erling Smørgrav query_dname_compare(msg->rep->rrsets[0]->rk.dname, 3142b7579f77SDag-Erling Smørgrav vq->dlv_lookup_name) == 0) { 3143b7579f77SDag-Erling Smørgrav /* yay! it is just like a DS */ 3144b7579f77SDag-Erling Smørgrav vq->ds_rrset = (struct ub_packed_rrset_key*) 3145b7579f77SDag-Erling Smørgrav regional_alloc_init(qstate->region, 3146b7579f77SDag-Erling Smørgrav msg->rep->rrsets[0], sizeof(*vq->ds_rrset)); 3147b7579f77SDag-Erling Smørgrav if(!vq->ds_rrset) { 3148b7579f77SDag-Erling Smørgrav log_err("out of memory in process_dlv"); 3149b7579f77SDag-Erling Smørgrav return; 3150b7579f77SDag-Erling Smørgrav } 3151b7579f77SDag-Erling Smørgrav vq->ds_rrset->entry.key = vq->ds_rrset; 3152b7579f77SDag-Erling Smørgrav vq->ds_rrset->rk.dname = (uint8_t*)regional_alloc_init( 3153b7579f77SDag-Erling Smørgrav qstate->region, vq->ds_rrset->rk.dname, 3154b7579f77SDag-Erling Smørgrav vq->ds_rrset->rk.dname_len); 3155b7579f77SDag-Erling Smørgrav if(!vq->ds_rrset->rk.dname) { 3156b7579f77SDag-Erling Smørgrav log_err("out of memory in process_dlv"); 3157b7579f77SDag-Erling Smørgrav vq->dlv_status = dlv_error; 3158b7579f77SDag-Erling Smørgrav return; 3159b7579f77SDag-Erling Smørgrav } 3160b7579f77SDag-Erling Smørgrav vq->ds_rrset->entry.data = regional_alloc_init(qstate->region, 3161b7579f77SDag-Erling Smørgrav vq->ds_rrset->entry.data, 3162b7579f77SDag-Erling Smørgrav packed_rrset_sizeof(vq->ds_rrset->entry.data)); 3163b7579f77SDag-Erling Smørgrav if(!vq->ds_rrset->entry.data) { 3164b7579f77SDag-Erling Smørgrav log_err("out of memory in process_dlv"); 3165b7579f77SDag-Erling Smørgrav vq->dlv_status = dlv_error; 3166b7579f77SDag-Erling Smørgrav return; 3167b7579f77SDag-Erling Smørgrav } 3168b7579f77SDag-Erling Smørgrav packed_rrset_ptr_fixup(vq->ds_rrset->entry.data); 3169b7579f77SDag-Erling Smørgrav /* make vq do a DNSKEY query next up */ 3170b7579f77SDag-Erling Smørgrav vq->dlv_status = dlv_success; 3171b7579f77SDag-Erling Smørgrav return; 3172b7579f77SDag-Erling Smørgrav } 3173b7579f77SDag-Erling Smørgrav /* store NSECs into negative cache */ 3174b7579f77SDag-Erling Smørgrav val_neg_addreply(ve->neg_cache, msg->rep); 3175b7579f77SDag-Erling Smørgrav 3176b7579f77SDag-Erling Smørgrav /* was the lookup a failure? 3177b7579f77SDag-Erling Smørgrav * if we have to go up into the DLV for a higher DLV anchor 3178b7579f77SDag-Erling Smørgrav * then set this in the vq, so it can make queries when activated. 3179b7579f77SDag-Erling Smørgrav * See if the NSECs indicate that we should look for higher DLV 3180b7579f77SDag-Erling Smørgrav * or, that there is no DLV securely */ 3181b7579f77SDag-Erling Smørgrav if(!val_nsec_check_dlv(qinfo, msg->rep, &vq->dlv_lookup_name, 3182b7579f77SDag-Erling Smørgrav &vq->dlv_lookup_name_len)) { 3183b7579f77SDag-Erling Smørgrav vq->dlv_status = dlv_error; 3184b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "nsec error"); 3185b7579f77SDag-Erling Smørgrav return; 3186b7579f77SDag-Erling Smørgrav } 3187b7579f77SDag-Erling Smørgrav if(!dname_subdomain_c(vq->dlv_lookup_name, 3188b7579f77SDag-Erling Smørgrav qstate->env->anchors->dlv_anchor->name)) { 3189b7579f77SDag-Erling Smørgrav vq->dlv_status = dlv_there_is_no_dlv; 3190b7579f77SDag-Erling Smørgrav return; 3191b7579f77SDag-Erling Smørgrav } 3192b7579f77SDag-Erling Smørgrav vq->dlv_status = dlv_ask_higher; 3193b7579f77SDag-Erling Smørgrav } 3194b7579f77SDag-Erling Smørgrav 3195b7579f77SDag-Erling Smørgrav /* 3196b7579f77SDag-Erling Smørgrav * inform validator super. 3197b7579f77SDag-Erling Smørgrav * 3198b7579f77SDag-Erling Smørgrav * @param qstate: query state that finished. 3199b7579f77SDag-Erling Smørgrav * @param id: module id. 3200b7579f77SDag-Erling Smørgrav * @param super: the qstate to inform. 3201b7579f77SDag-Erling Smørgrav */ 3202b7579f77SDag-Erling Smørgrav void 3203b7579f77SDag-Erling Smørgrav val_inform_super(struct module_qstate* qstate, int id, 3204b7579f77SDag-Erling Smørgrav struct module_qstate* super) 3205b7579f77SDag-Erling Smørgrav { 3206b7579f77SDag-Erling Smørgrav struct val_qstate* vq = (struct val_qstate*)super->minfo[id]; 3207b7579f77SDag-Erling Smørgrav log_query_info(VERB_ALGO, "validator: inform_super, sub is", 3208b7579f77SDag-Erling Smørgrav &qstate->qinfo); 3209b7579f77SDag-Erling Smørgrav log_query_info(VERB_ALGO, "super is", &super->qinfo); 3210b7579f77SDag-Erling Smørgrav if(!vq) { 3211b7579f77SDag-Erling Smørgrav verbose(VERB_ALGO, "super: has no validator state"); 3212b7579f77SDag-Erling Smørgrav return; 3213b7579f77SDag-Erling Smørgrav } 3214b7579f77SDag-Erling Smørgrav if(vq->wait_prime_ta) { 3215b7579f77SDag-Erling Smørgrav vq->wait_prime_ta = 0; 3216b7579f77SDag-Erling Smørgrav process_prime_response(super, vq, id, qstate->return_rcode, 3217b7579f77SDag-Erling Smørgrav qstate->return_msg, qstate->reply_origin); 3218b7579f77SDag-Erling Smørgrav return; 3219b7579f77SDag-Erling Smørgrav } 3220b7579f77SDag-Erling Smørgrav if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS) { 3221b7579f77SDag-Erling Smørgrav process_ds_response(super, vq, id, qstate->return_rcode, 3222b7579f77SDag-Erling Smørgrav qstate->return_msg, &qstate->qinfo, 3223b7579f77SDag-Erling Smørgrav qstate->reply_origin); 3224b7579f77SDag-Erling Smørgrav return; 3225b7579f77SDag-Erling Smørgrav } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY) { 3226b7579f77SDag-Erling Smørgrav process_dnskey_response(super, vq, id, qstate->return_rcode, 3227b7579f77SDag-Erling Smørgrav qstate->return_msg, &qstate->qinfo, 3228b7579f77SDag-Erling Smørgrav qstate->reply_origin); 3229b7579f77SDag-Erling Smørgrav return; 3230b7579f77SDag-Erling Smørgrav } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DLV) { 3231b7579f77SDag-Erling Smørgrav process_dlv_response(super, vq, id, qstate->return_rcode, 3232b7579f77SDag-Erling Smørgrav qstate->return_msg, &qstate->qinfo); 3233b7579f77SDag-Erling Smørgrav return; 3234b7579f77SDag-Erling Smørgrav } 3235b7579f77SDag-Erling Smørgrav log_err("internal error in validator: no inform_supers possible"); 3236b7579f77SDag-Erling Smørgrav } 3237b7579f77SDag-Erling Smørgrav 3238b7579f77SDag-Erling Smørgrav void 3239b7579f77SDag-Erling Smørgrav val_clear(struct module_qstate* qstate, int id) 3240b7579f77SDag-Erling Smørgrav { 3241b7579f77SDag-Erling Smørgrav if(!qstate) 3242b7579f77SDag-Erling Smørgrav return; 3243b7579f77SDag-Erling Smørgrav /* everything is allocated in the region, so assign NULL */ 3244b7579f77SDag-Erling Smørgrav qstate->minfo[id] = NULL; 3245b7579f77SDag-Erling Smørgrav } 3246b7579f77SDag-Erling Smørgrav 3247b7579f77SDag-Erling Smørgrav size_t 3248b7579f77SDag-Erling Smørgrav val_get_mem(struct module_env* env, int id) 3249b7579f77SDag-Erling Smørgrav { 3250b7579f77SDag-Erling Smørgrav struct val_env* ve = (struct val_env*)env->modinfo[id]; 3251b7579f77SDag-Erling Smørgrav if(!ve) 3252b7579f77SDag-Erling Smørgrav return 0; 3253b7579f77SDag-Erling Smørgrav return sizeof(*ve) + key_cache_get_mem(ve->kcache) + 3254b7579f77SDag-Erling Smørgrav val_neg_get_mem(ve->neg_cache) + 3255b7579f77SDag-Erling Smørgrav sizeof(size_t)*2*ve->nsec3_keyiter_count; 3256b7579f77SDag-Erling Smørgrav } 3257b7579f77SDag-Erling Smørgrav 3258b7579f77SDag-Erling Smørgrav /** 3259b7579f77SDag-Erling Smørgrav * The validator function block 3260b7579f77SDag-Erling Smørgrav */ 3261b7579f77SDag-Erling Smørgrav static struct module_func_block val_block = { 3262b7579f77SDag-Erling Smørgrav "validator", 3263b7579f77SDag-Erling Smørgrav &val_init, &val_deinit, &val_operate, &val_inform_super, &val_clear, 3264b7579f77SDag-Erling Smørgrav &val_get_mem 3265b7579f77SDag-Erling Smørgrav }; 3266b7579f77SDag-Erling Smørgrav 3267b7579f77SDag-Erling Smørgrav struct module_func_block* 3268b7579f77SDag-Erling Smørgrav val_get_funcblock(void) 3269b7579f77SDag-Erling Smørgrav { 3270b7579f77SDag-Erling Smørgrav return &val_block; 3271b7579f77SDag-Erling Smørgrav } 3272b7579f77SDag-Erling Smørgrav 3273b7579f77SDag-Erling Smørgrav const char* 3274b7579f77SDag-Erling Smørgrav val_state_to_string(enum val_state state) 3275b7579f77SDag-Erling Smørgrav { 3276b7579f77SDag-Erling Smørgrav switch(state) { 3277b7579f77SDag-Erling Smørgrav case VAL_INIT_STATE: return "VAL_INIT_STATE"; 3278b7579f77SDag-Erling Smørgrav case VAL_FINDKEY_STATE: return "VAL_FINDKEY_STATE"; 3279b7579f77SDag-Erling Smørgrav case VAL_VALIDATE_STATE: return "VAL_VALIDATE_STATE"; 3280b7579f77SDag-Erling Smørgrav case VAL_FINISHED_STATE: return "VAL_FINISHED_STATE"; 3281b7579f77SDag-Erling Smørgrav case VAL_DLVLOOKUP_STATE: return "VAL_DLVLOOKUP_STATE"; 3282b7579f77SDag-Erling Smørgrav } 3283b7579f77SDag-Erling Smørgrav return "UNKNOWN VALIDATOR STATE"; 3284b7579f77SDag-Erling Smørgrav } 3285b7579f77SDag-Erling Smørgrav 3286