xref: /freebsd/contrib/unbound/validator/validator.c (revision 4c75e3aa0f1368f18240b8bfd0e1e88f64994a1c)
1b7579f77SDag-Erling Smørgrav /*
2b7579f77SDag-Erling Smørgrav  * validator/validator.c - secure validator DNS query response module
3b7579f77SDag-Erling Smørgrav  *
4b7579f77SDag-Erling Smørgrav  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5b7579f77SDag-Erling Smørgrav  *
6b7579f77SDag-Erling Smørgrav  * This software is open source.
7b7579f77SDag-Erling Smørgrav  *
8b7579f77SDag-Erling Smørgrav  * Redistribution and use in source and binary forms, with or without
9b7579f77SDag-Erling Smørgrav  * modification, are permitted provided that the following conditions
10b7579f77SDag-Erling Smørgrav  * are met:
11b7579f77SDag-Erling Smørgrav  *
12b7579f77SDag-Erling Smørgrav  * Redistributions of source code must retain the above copyright notice,
13b7579f77SDag-Erling Smørgrav  * this list of conditions and the following disclaimer.
14b7579f77SDag-Erling Smørgrav  *
15b7579f77SDag-Erling Smørgrav  * Redistributions in binary form must reproduce the above copyright notice,
16b7579f77SDag-Erling Smørgrav  * this list of conditions and the following disclaimer in the documentation
17b7579f77SDag-Erling Smørgrav  * and/or other materials provided with the distribution.
18b7579f77SDag-Erling Smørgrav  *
19b7579f77SDag-Erling Smørgrav  * Neither the name of the NLNET LABS nor the names of its contributors may
20b7579f77SDag-Erling Smørgrav  * be used to endorse or promote products derived from this software without
21b7579f77SDag-Erling Smørgrav  * specific prior written permission.
22b7579f77SDag-Erling Smørgrav  *
23b7579f77SDag-Erling Smørgrav  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
2417d15b25SDag-Erling Smørgrav  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
2517d15b25SDag-Erling Smørgrav  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
2617d15b25SDag-Erling Smørgrav  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
2717d15b25SDag-Erling Smørgrav  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
2817d15b25SDag-Erling Smørgrav  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
2917d15b25SDag-Erling Smørgrav  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
3017d15b25SDag-Erling Smørgrav  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
3117d15b25SDag-Erling Smørgrav  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
3217d15b25SDag-Erling Smørgrav  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
3317d15b25SDag-Erling Smørgrav  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34b7579f77SDag-Erling Smørgrav  */
35b7579f77SDag-Erling Smørgrav 
36b7579f77SDag-Erling Smørgrav /**
37b7579f77SDag-Erling Smørgrav  * \file
38b7579f77SDag-Erling Smørgrav  *
39b7579f77SDag-Erling Smørgrav  * This file contains a module that performs validation of DNS queries.
40b7579f77SDag-Erling Smørgrav  * According to RFC 4034.
41b7579f77SDag-Erling Smørgrav  */
42b7579f77SDag-Erling Smørgrav #include "config.h"
430fb34990SDag-Erling Smørgrav #include <ctype.h>
44b7579f77SDag-Erling Smørgrav #include "validator/validator.h"
45b7579f77SDag-Erling Smørgrav #include "validator/val_anchor.h"
46b7579f77SDag-Erling Smørgrav #include "validator/val_kcache.h"
47b7579f77SDag-Erling Smørgrav #include "validator/val_kentry.h"
48b7579f77SDag-Erling Smørgrav #include "validator/val_utils.h"
49b7579f77SDag-Erling Smørgrav #include "validator/val_nsec.h"
50b7579f77SDag-Erling Smørgrav #include "validator/val_nsec3.h"
51b7579f77SDag-Erling Smørgrav #include "validator/val_neg.h"
52b7579f77SDag-Erling Smørgrav #include "validator/val_sigcrypt.h"
53b7579f77SDag-Erling Smørgrav #include "validator/autotrust.h"
54b7579f77SDag-Erling Smørgrav #include "services/cache/dns.h"
5557bddd21SDag-Erling Smørgrav #include "services/cache/rrset.h"
56b7579f77SDag-Erling Smørgrav #include "util/data/dname.h"
57b7579f77SDag-Erling Smørgrav #include "util/module.h"
58b7579f77SDag-Erling Smørgrav #include "util/log.h"
59b7579f77SDag-Erling Smørgrav #include "util/net_help.h"
60b7579f77SDag-Erling Smørgrav #include "util/regional.h"
61b7579f77SDag-Erling Smørgrav #include "util/config_file.h"
62b7579f77SDag-Erling Smørgrav #include "util/fptr_wlist.h"
6309a3aaf3SDag-Erling Smørgrav #include "sldns/rrdef.h"
6409a3aaf3SDag-Erling Smørgrav #include "sldns/wire2str.h"
65c7f4d7adSDag-Erling Smørgrav #include "sldns/str2wire.h"
66b7579f77SDag-Erling Smørgrav 
67b7579f77SDag-Erling Smørgrav /* forward decl for cache response and normal super inform calls of a DS */
68b7579f77SDag-Erling Smørgrav static void process_ds_response(struct module_qstate* qstate,
69b7579f77SDag-Erling Smørgrav 	struct val_qstate* vq, int id, int rcode, struct dns_msg* msg,
70b7579f77SDag-Erling Smørgrav 	struct query_info* qinfo, struct sock_list* origin);
71b7579f77SDag-Erling Smørgrav 
72b7579f77SDag-Erling Smørgrav /** fill up nsec3 key iterations config entry */
73b7579f77SDag-Erling Smørgrav static int
74b7579f77SDag-Erling Smørgrav fill_nsec3_iter(struct val_env* ve, char* s, int c)
75b7579f77SDag-Erling Smørgrav {
76b7579f77SDag-Erling Smørgrav 	char* e;
77b7579f77SDag-Erling Smørgrav 	int i;
78b7579f77SDag-Erling Smørgrav 	free(ve->nsec3_keysize);
79b7579f77SDag-Erling Smørgrav 	free(ve->nsec3_maxiter);
80b7579f77SDag-Erling Smørgrav 	ve->nsec3_keysize = (size_t*)calloc(sizeof(size_t), (size_t)c);
81b7579f77SDag-Erling Smørgrav 	ve->nsec3_maxiter = (size_t*)calloc(sizeof(size_t), (size_t)c);
82b7579f77SDag-Erling Smørgrav 	if(!ve->nsec3_keysize || !ve->nsec3_maxiter) {
83b7579f77SDag-Erling Smørgrav 		log_err("out of memory");
84b7579f77SDag-Erling Smørgrav 		return 0;
85b7579f77SDag-Erling Smørgrav 	}
86b7579f77SDag-Erling Smørgrav 	for(i=0; i<c; i++) {
87b7579f77SDag-Erling Smørgrav 		ve->nsec3_keysize[i] = (size_t)strtol(s, &e, 10);
88b7579f77SDag-Erling Smørgrav 		if(s == e) {
89b7579f77SDag-Erling Smørgrav 			log_err("cannot parse: %s", s);
90b7579f77SDag-Erling Smørgrav 			return 0;
91b7579f77SDag-Erling Smørgrav 		}
92b7579f77SDag-Erling Smørgrav 		s = e;
93b7579f77SDag-Erling Smørgrav 		ve->nsec3_maxiter[i] = (size_t)strtol(s, &e, 10);
94b7579f77SDag-Erling Smørgrav 		if(s == e) {
95b7579f77SDag-Erling Smørgrav 			log_err("cannot parse: %s", s);
96b7579f77SDag-Erling Smørgrav 			return 0;
97b7579f77SDag-Erling Smørgrav 		}
98b7579f77SDag-Erling Smørgrav 		s = e;
99b7579f77SDag-Erling Smørgrav 		if(i>0 && ve->nsec3_keysize[i-1] >= ve->nsec3_keysize[i]) {
100b7579f77SDag-Erling Smørgrav 			log_err("nsec3 key iterations not ascending: %d %d",
101b7579f77SDag-Erling Smørgrav 				(int)ve->nsec3_keysize[i-1],
102b7579f77SDag-Erling Smørgrav 				(int)ve->nsec3_keysize[i]);
103b7579f77SDag-Erling Smørgrav 			return 0;
104b7579f77SDag-Erling Smørgrav 		}
105b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "validator nsec3cfg keysz %d mxiter %d",
106b7579f77SDag-Erling Smørgrav 			(int)ve->nsec3_keysize[i], (int)ve->nsec3_maxiter[i]);
107b7579f77SDag-Erling Smørgrav 	}
108b7579f77SDag-Erling Smørgrav 	return 1;
109b7579f77SDag-Erling Smørgrav }
110b7579f77SDag-Erling Smørgrav 
111b7579f77SDag-Erling Smørgrav /** apply config settings to validator */
112b7579f77SDag-Erling Smørgrav static int
113b7579f77SDag-Erling Smørgrav val_apply_cfg(struct module_env* env, struct val_env* val_env,
114b7579f77SDag-Erling Smørgrav 	struct config_file* cfg)
115b7579f77SDag-Erling Smørgrav {
116b7579f77SDag-Erling Smørgrav 	int c;
117b7579f77SDag-Erling Smørgrav 	val_env->bogus_ttl = (uint32_t)cfg->bogus_ttl;
118b7579f77SDag-Erling Smørgrav 	if(!env->anchors)
119b7579f77SDag-Erling Smørgrav 		env->anchors = anchors_create();
120b7579f77SDag-Erling Smørgrav 	if(!env->anchors) {
121b7579f77SDag-Erling Smørgrav 		log_err("out of memory");
122b7579f77SDag-Erling Smørgrav 		return 0;
123b7579f77SDag-Erling Smørgrav 	}
124b7579f77SDag-Erling Smørgrav 	if(!val_env->kcache)
125b7579f77SDag-Erling Smørgrav 		val_env->kcache = key_cache_create(cfg);
126b7579f77SDag-Erling Smørgrav 	if(!val_env->kcache) {
127b7579f77SDag-Erling Smørgrav 		log_err("out of memory");
128b7579f77SDag-Erling Smørgrav 		return 0;
129b7579f77SDag-Erling Smørgrav 	}
130b7579f77SDag-Erling Smørgrav 	env->key_cache = val_env->kcache;
131b7579f77SDag-Erling Smørgrav 	if(!anchors_apply_cfg(env->anchors, cfg)) {
132b7579f77SDag-Erling Smørgrav 		log_err("validator: error in trustanchors config");
133b7579f77SDag-Erling Smørgrav 		return 0;
134b7579f77SDag-Erling Smørgrav 	}
135b7579f77SDag-Erling Smørgrav 	val_env->date_override = cfg->val_date_override;
136b7579f77SDag-Erling Smørgrav 	val_env->skew_min = cfg->val_sig_skew_min;
137b7579f77SDag-Erling Smørgrav 	val_env->skew_max = cfg->val_sig_skew_max;
138b7579f77SDag-Erling Smørgrav 	c = cfg_count_numbers(cfg->val_nsec3_key_iterations);
139b7579f77SDag-Erling Smørgrav 	if(c < 1 || (c&1)) {
140b7579f77SDag-Erling Smørgrav 		log_err("validator: unparseable or odd nsec3 key "
141b7579f77SDag-Erling Smørgrav 			"iterations: %s", cfg->val_nsec3_key_iterations);
142b7579f77SDag-Erling Smørgrav 		return 0;
143b7579f77SDag-Erling Smørgrav 	}
144b7579f77SDag-Erling Smørgrav 	val_env->nsec3_keyiter_count = c/2;
145b7579f77SDag-Erling Smørgrav 	if(!fill_nsec3_iter(val_env, cfg->val_nsec3_key_iterations, c/2)) {
146b7579f77SDag-Erling Smørgrav 		log_err("validator: cannot apply nsec3 key iterations");
147b7579f77SDag-Erling Smørgrav 		return 0;
148b7579f77SDag-Erling Smørgrav 	}
149b7579f77SDag-Erling Smørgrav 	if(!val_env->neg_cache)
150b7579f77SDag-Erling Smørgrav 		val_env->neg_cache = val_neg_create(cfg,
151b7579f77SDag-Erling Smørgrav 			val_env->nsec3_maxiter[val_env->nsec3_keyiter_count-1]);
152b7579f77SDag-Erling Smørgrav 	if(!val_env->neg_cache) {
153b7579f77SDag-Erling Smørgrav 		log_err("out of memory");
154b7579f77SDag-Erling Smørgrav 		return 0;
155b7579f77SDag-Erling Smørgrav 	}
156b7579f77SDag-Erling Smørgrav 	env->neg_cache = val_env->neg_cache;
157b7579f77SDag-Erling Smørgrav 	return 1;
158b7579f77SDag-Erling Smørgrav }
159b7579f77SDag-Erling Smørgrav 
160b5663de9SDag-Erling Smørgrav #ifdef USE_ECDSA_EVP_WORKAROUND
161b5663de9SDag-Erling Smørgrav void ecdsa_evp_workaround_init(void);
162b5663de9SDag-Erling Smørgrav #endif
163b7579f77SDag-Erling Smørgrav int
164b7579f77SDag-Erling Smørgrav val_init(struct module_env* env, int id)
165b7579f77SDag-Erling Smørgrav {
166b7579f77SDag-Erling Smørgrav 	struct val_env* val_env = (struct val_env*)calloc(1,
167b7579f77SDag-Erling Smørgrav 		sizeof(struct val_env));
168b7579f77SDag-Erling Smørgrav 	if(!val_env) {
169b7579f77SDag-Erling Smørgrav 		log_err("malloc failure");
170b7579f77SDag-Erling Smørgrav 		return 0;
171b7579f77SDag-Erling Smørgrav 	}
172b7579f77SDag-Erling Smørgrav 	env->modinfo[id] = (void*)val_env;
173b7579f77SDag-Erling Smørgrav 	env->need_to_validate = 1;
174b7579f77SDag-Erling Smørgrav 	lock_basic_init(&val_env->bogus_lock);
175b7579f77SDag-Erling Smørgrav 	lock_protect(&val_env->bogus_lock, &val_env->num_rrset_bogus,
176b7579f77SDag-Erling Smørgrav 		sizeof(val_env->num_rrset_bogus));
177b5663de9SDag-Erling Smørgrav #ifdef USE_ECDSA_EVP_WORKAROUND
178b5663de9SDag-Erling Smørgrav 	ecdsa_evp_workaround_init();
179b5663de9SDag-Erling Smørgrav #endif
180b7579f77SDag-Erling Smørgrav 	if(!val_apply_cfg(env, val_env, env->cfg)) {
181b7579f77SDag-Erling Smørgrav 		log_err("validator: could not apply configuration settings.");
182b7579f77SDag-Erling Smørgrav 		return 0;
183b7579f77SDag-Erling Smørgrav 	}
184bc892140SDag-Erling Smørgrav 
185b7579f77SDag-Erling Smørgrav 	return 1;
186b7579f77SDag-Erling Smørgrav }
187b7579f77SDag-Erling Smørgrav 
188b7579f77SDag-Erling Smørgrav void
189b7579f77SDag-Erling Smørgrav val_deinit(struct module_env* env, int id)
190b7579f77SDag-Erling Smørgrav {
191b7579f77SDag-Erling Smørgrav 	struct val_env* val_env;
192b7579f77SDag-Erling Smørgrav 	if(!env || !env->modinfo[id])
193b7579f77SDag-Erling Smørgrav 		return;
194b7579f77SDag-Erling Smørgrav 	val_env = (struct val_env*)env->modinfo[id];
195b7579f77SDag-Erling Smørgrav 	lock_basic_destroy(&val_env->bogus_lock);
196b7579f77SDag-Erling Smørgrav 	anchors_delete(env->anchors);
197b7579f77SDag-Erling Smørgrav 	env->anchors = NULL;
198b7579f77SDag-Erling Smørgrav 	key_cache_delete(val_env->kcache);
199b7579f77SDag-Erling Smørgrav 	neg_cache_delete(val_env->neg_cache);
200b7579f77SDag-Erling Smørgrav 	free(val_env->nsec3_keysize);
201b7579f77SDag-Erling Smørgrav 	free(val_env->nsec3_maxiter);
202b7579f77SDag-Erling Smørgrav 	free(val_env);
203b7579f77SDag-Erling Smørgrav 	env->modinfo[id] = NULL;
204b7579f77SDag-Erling Smørgrav }
205b7579f77SDag-Erling Smørgrav 
206b7579f77SDag-Erling Smørgrav /** fill in message structure */
207b7579f77SDag-Erling Smørgrav static struct val_qstate*
208b7579f77SDag-Erling Smørgrav val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq)
209b7579f77SDag-Erling Smørgrav {
210b7579f77SDag-Erling Smørgrav 	if(!qstate->return_msg || qstate->return_rcode != LDNS_RCODE_NOERROR) {
211b7579f77SDag-Erling Smørgrav 		/* create a message to verify */
212b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "constructing reply for validation");
213b7579f77SDag-Erling Smørgrav 		vq->orig_msg = (struct dns_msg*)regional_alloc(qstate->region,
214b7579f77SDag-Erling Smørgrav 			sizeof(struct dns_msg));
215b7579f77SDag-Erling Smørgrav 		if(!vq->orig_msg)
216b7579f77SDag-Erling Smørgrav 			return NULL;
217b7579f77SDag-Erling Smørgrav 		vq->orig_msg->qinfo = qstate->qinfo;
218b7579f77SDag-Erling Smørgrav 		vq->orig_msg->rep = (struct reply_info*)regional_alloc(
219b7579f77SDag-Erling Smørgrav 			qstate->region, sizeof(struct reply_info));
220b7579f77SDag-Erling Smørgrav 		if(!vq->orig_msg->rep)
221b7579f77SDag-Erling Smørgrav 			return NULL;
222b7579f77SDag-Erling Smørgrav 		memset(vq->orig_msg->rep, 0, sizeof(struct reply_info));
223b7579f77SDag-Erling Smørgrav 		vq->orig_msg->rep->flags = (uint16_t)(qstate->return_rcode&0xf)
224b7579f77SDag-Erling Smørgrav 			|BIT_QR|BIT_RA|(qstate->query_flags|(BIT_CD|BIT_RD));
225b7579f77SDag-Erling Smørgrav 		vq->orig_msg->rep->qdcount = 1;
226b7579f77SDag-Erling Smørgrav 	} else {
227b7579f77SDag-Erling Smørgrav 		vq->orig_msg = qstate->return_msg;
228b7579f77SDag-Erling Smørgrav 	}
229b7579f77SDag-Erling Smørgrav 	vq->qchase = qstate->qinfo;
230b7579f77SDag-Erling Smørgrav 	/* chase reply will be an edited (sub)set of the orig msg rrset ptrs */
231b7579f77SDag-Erling Smørgrav 	vq->chase_reply = regional_alloc_init(qstate->region,
232b7579f77SDag-Erling Smørgrav 		vq->orig_msg->rep,
233b7579f77SDag-Erling Smørgrav 		sizeof(struct reply_info) - sizeof(struct rrset_ref));
234b7579f77SDag-Erling Smørgrav 	if(!vq->chase_reply)
235b7579f77SDag-Erling Smørgrav 		return NULL;
23609a3aaf3SDag-Erling Smørgrav 	if(vq->orig_msg->rep->rrset_count > RR_COUNT_MAX)
23709a3aaf3SDag-Erling Smørgrav 		return NULL; /* protect against integer overflow */
238b7579f77SDag-Erling Smørgrav 	vq->chase_reply->rrsets = regional_alloc_init(qstate->region,
239b7579f77SDag-Erling Smørgrav 		vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*)
240b7579f77SDag-Erling Smørgrav 			* vq->orig_msg->rep->rrset_count);
241b7579f77SDag-Erling Smørgrav 	if(!vq->chase_reply->rrsets)
242b7579f77SDag-Erling Smørgrav 		return NULL;
243b7579f77SDag-Erling Smørgrav 	vq->rrset_skip = 0;
244b7579f77SDag-Erling Smørgrav 	return vq;
245b7579f77SDag-Erling Smørgrav }
246b7579f77SDag-Erling Smørgrav 
247b7579f77SDag-Erling Smørgrav /** allocate new validator query state */
248b7579f77SDag-Erling Smørgrav static struct val_qstate*
249b7579f77SDag-Erling Smørgrav val_new(struct module_qstate* qstate, int id)
250b7579f77SDag-Erling Smørgrav {
251b7579f77SDag-Erling Smørgrav 	struct val_qstate* vq = (struct val_qstate*)regional_alloc(
252b7579f77SDag-Erling Smørgrav 		qstate->region, sizeof(*vq));
253b7579f77SDag-Erling Smørgrav 	log_assert(!qstate->minfo[id]);
254b7579f77SDag-Erling Smørgrav 	if(!vq)
255b7579f77SDag-Erling Smørgrav 		return NULL;
256b7579f77SDag-Erling Smørgrav 	memset(vq, 0, sizeof(*vq));
257b7579f77SDag-Erling Smørgrav 	qstate->minfo[id] = vq;
258b7579f77SDag-Erling Smørgrav 	vq->state = VAL_INIT_STATE;
259b7579f77SDag-Erling Smørgrav 	return val_new_getmsg(qstate, vq);
260b7579f77SDag-Erling Smørgrav }
261b7579f77SDag-Erling Smørgrav 
262b7579f77SDag-Erling Smørgrav /**
263b7579f77SDag-Erling Smørgrav  * Exit validation with an error status
264b7579f77SDag-Erling Smørgrav  *
265b7579f77SDag-Erling Smørgrav  * @param qstate: query state
266b7579f77SDag-Erling Smørgrav  * @param id: validator id.
267b7579f77SDag-Erling Smørgrav  * @return false, for use by caller to return to stop processing.
268b7579f77SDag-Erling Smørgrav  */
269b7579f77SDag-Erling Smørgrav static int
270b7579f77SDag-Erling Smørgrav val_error(struct module_qstate* qstate, int id)
271b7579f77SDag-Erling Smørgrav {
272b7579f77SDag-Erling Smørgrav 	qstate->ext_state[id] = module_error;
273b7579f77SDag-Erling Smørgrav 	qstate->return_rcode = LDNS_RCODE_SERVFAIL;
274b7579f77SDag-Erling Smørgrav 	return 0;
275b7579f77SDag-Erling Smørgrav }
276b7579f77SDag-Erling Smørgrav 
277b7579f77SDag-Erling Smørgrav /**
278b7579f77SDag-Erling Smørgrav  * Check to see if a given response needs to go through the validation
279b7579f77SDag-Erling Smørgrav  * process. Typical reasons for this routine to return false are: CD bit was
280b7579f77SDag-Erling Smørgrav  * on in the original request, or the response is a kind of message that
281b7579f77SDag-Erling Smørgrav  * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.)
282b7579f77SDag-Erling Smørgrav  *
283b7579f77SDag-Erling Smørgrav  * @param qstate: query state.
284b7579f77SDag-Erling Smørgrav  * @param ret_rc: rcode for this message (if noerror - examine ret_msg).
285b7579f77SDag-Erling Smørgrav  * @param ret_msg: return msg, can be NULL; look at rcode instead.
286b7579f77SDag-Erling Smørgrav  * @return true if the response could use validation (although this does not
287b7579f77SDag-Erling Smørgrav  *         mean we can actually validate this response).
288b7579f77SDag-Erling Smørgrav  */
289b7579f77SDag-Erling Smørgrav static int
290b7579f77SDag-Erling Smørgrav needs_validation(struct module_qstate* qstate, int ret_rc,
291b7579f77SDag-Erling Smørgrav 	struct dns_msg* ret_msg)
292b7579f77SDag-Erling Smørgrav {
293b7579f77SDag-Erling Smørgrav 	int rcode;
294b7579f77SDag-Erling Smørgrav 
295ff825849SDag-Erling Smørgrav 	/* If the CD bit is on in the original request, then you could think
296ff825849SDag-Erling Smørgrav 	 * that we don't bother to validate anything.
297ff825849SDag-Erling Smørgrav 	 * But this is signalled internally with the valrec flag.
298ff825849SDag-Erling Smørgrav 	 * User queries are validated with BIT_CD to make our cache clean
299ff825849SDag-Erling Smørgrav 	 * so that bogus messages get retried by the upstream also for
300ff825849SDag-Erling Smørgrav 	 * downstream validators that set BIT_CD.
301ff825849SDag-Erling Smørgrav 	 * For DNS64 bit_cd signals no dns64 processing, but we want to
302ff825849SDag-Erling Smørgrav 	 * provide validation there too */
303ff825849SDag-Erling Smørgrav 	/*
304b7579f77SDag-Erling Smørgrav 	if(qstate->query_flags & BIT_CD) {
305b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "not validating response due to CD bit");
306b7579f77SDag-Erling Smørgrav 		return 0;
307b7579f77SDag-Erling Smørgrav 	}
308ff825849SDag-Erling Smørgrav 	*/
309ff825849SDag-Erling Smørgrav 	if(qstate->is_valrec) {
310ff825849SDag-Erling Smørgrav 		verbose(VERB_ALGO, "not validating response, is valrec"
311ff825849SDag-Erling Smørgrav 			"(validation recursion lookup)");
312ff825849SDag-Erling Smørgrav 		return 0;
313ff825849SDag-Erling Smørgrav 	}
314b7579f77SDag-Erling Smørgrav 
315b7579f77SDag-Erling Smørgrav 	if(ret_rc != LDNS_RCODE_NOERROR || !ret_msg)
316b7579f77SDag-Erling Smørgrav 		rcode = ret_rc;
317b7579f77SDag-Erling Smørgrav 	else 	rcode = (int)FLAGS_GET_RCODE(ret_msg->rep->flags);
318b7579f77SDag-Erling Smørgrav 
319b7579f77SDag-Erling Smørgrav 	if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) {
32017d15b25SDag-Erling Smørgrav 		if(verbosity >= VERB_ALGO) {
32117d15b25SDag-Erling Smørgrav 			char rc[16];
32217d15b25SDag-Erling Smørgrav 			rc[0]=0;
32317d15b25SDag-Erling Smørgrav 			(void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
32417d15b25SDag-Erling Smørgrav 			verbose(VERB_ALGO, "cannot validate non-answer, rcode %s", rc);
32517d15b25SDag-Erling Smørgrav 		}
326b7579f77SDag-Erling Smørgrav 		return 0;
327b7579f77SDag-Erling Smørgrav 	}
328b7579f77SDag-Erling Smørgrav 
329b7579f77SDag-Erling Smørgrav 	/* cannot validate positive RRSIG response. (negatives can) */
330b7579f77SDag-Erling Smørgrav 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_RRSIG &&
331b7579f77SDag-Erling Smørgrav 		rcode == LDNS_RCODE_NOERROR && ret_msg &&
332b7579f77SDag-Erling Smørgrav 		ret_msg->rep->an_numrrsets > 0) {
333b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "cannot validate RRSIG, no sigs on sigs.");
334b7579f77SDag-Erling Smørgrav 		return 0;
335b7579f77SDag-Erling Smørgrav 	}
336b7579f77SDag-Erling Smørgrav 	return 1;
337b7579f77SDag-Erling Smørgrav }
338b7579f77SDag-Erling Smørgrav 
339b7579f77SDag-Erling Smørgrav /**
340b7579f77SDag-Erling Smørgrav  * Check to see if the response has already been validated.
341b7579f77SDag-Erling Smørgrav  * @param ret_msg: return msg, can be NULL
342b7579f77SDag-Erling Smørgrav  * @return true if the response has already been validated
343b7579f77SDag-Erling Smørgrav  */
344b7579f77SDag-Erling Smørgrav static int
345b7579f77SDag-Erling Smørgrav already_validated(struct dns_msg* ret_msg)
346b7579f77SDag-Erling Smørgrav {
347b7579f77SDag-Erling Smørgrav 	/* validate unchecked, and re-validate bogus messages */
348b7579f77SDag-Erling Smørgrav 	if (ret_msg && ret_msg->rep->security > sec_status_bogus)
349b7579f77SDag-Erling Smørgrav 	{
350b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "response has already been validated: %s",
351b7579f77SDag-Erling Smørgrav 			sec_status_to_string(ret_msg->rep->security));
352b7579f77SDag-Erling Smørgrav 		return 1;
353b7579f77SDag-Erling Smørgrav 	}
354b7579f77SDag-Erling Smørgrav 	return 0;
355b7579f77SDag-Erling Smørgrav }
356b7579f77SDag-Erling Smørgrav 
357b7579f77SDag-Erling Smørgrav /**
358b7579f77SDag-Erling Smørgrav  * Generate a request for DNS data.
359b7579f77SDag-Erling Smørgrav  *
360b7579f77SDag-Erling Smørgrav  * @param qstate: query state that is the parent.
361b7579f77SDag-Erling Smørgrav  * @param id: module id.
362b7579f77SDag-Erling Smørgrav  * @param name: what name to query for.
363b7579f77SDag-Erling Smørgrav  * @param namelen: length of name.
364b7579f77SDag-Erling Smørgrav  * @param qtype: query type.
365b7579f77SDag-Erling Smørgrav  * @param qclass: query class.
366b7579f77SDag-Erling Smørgrav  * @param flags: additional flags, such as the CD bit (BIT_CD), or 0.
367c7f4d7adSDag-Erling Smørgrav  * @param newq: If the subquery is newly created, it is returned,
368c7f4d7adSDag-Erling Smørgrav  * 	otherwise NULL is returned
369c7f4d7adSDag-Erling Smørgrav  * @param detached: true if this qstate should not attach to the subquery
370b7579f77SDag-Erling Smørgrav  * @return false on alloc failure.
371b7579f77SDag-Erling Smørgrav  */
372b7579f77SDag-Erling Smørgrav static int
373b7579f77SDag-Erling Smørgrav generate_request(struct module_qstate* qstate, int id, uint8_t* name,
374c7f4d7adSDag-Erling Smørgrav 	size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags,
375c7f4d7adSDag-Erling Smørgrav 	struct module_qstate** newq, int detached)
376b7579f77SDag-Erling Smørgrav {
377b7579f77SDag-Erling Smørgrav 	struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
378b7579f77SDag-Erling Smørgrav 	struct query_info ask;
379ff825849SDag-Erling Smørgrav 	int valrec;
380b7579f77SDag-Erling Smørgrav 	ask.qname = name;
381b7579f77SDag-Erling Smørgrav 	ask.qname_len = namelen;
382b7579f77SDag-Erling Smørgrav 	ask.qtype = qtype;
383b7579f77SDag-Erling Smørgrav 	ask.qclass = qclass;
384bc892140SDag-Erling Smørgrav 	ask.local_alias = NULL;
385b7579f77SDag-Erling Smørgrav 	log_query_info(VERB_ALGO, "generate request", &ask);
386ff825849SDag-Erling Smørgrav 	/* enable valrec flag to avoid recursion to the same validation
387ff825849SDag-Erling Smørgrav 	 * routine, this lookup is simply a lookup. DLVs need validation */
388ff825849SDag-Erling Smørgrav 	if(qtype == LDNS_RR_TYPE_DLV)
389ff825849SDag-Erling Smørgrav 		valrec = 0;
390ff825849SDag-Erling Smørgrav 	else valrec = 1;
391*4c75e3aaSDag-Erling Smørgrav 
392*4c75e3aaSDag-Erling Smørgrav 	fptr_ok(fptr_whitelist_modenv_detect_cycle(qstate->env->detect_cycle));
393*4c75e3aaSDag-Erling Smørgrav 	if((*qstate->env->detect_cycle)(qstate, &ask,
394*4c75e3aaSDag-Erling Smørgrav 		(uint16_t)(BIT_RD|flags), 0, valrec)) {
395*4c75e3aaSDag-Erling Smørgrav 		verbose(VERB_ALGO, "Could not generate request: cycle detected");
396*4c75e3aaSDag-Erling Smørgrav 		return 0;
397*4c75e3aaSDag-Erling Smørgrav 	}
398*4c75e3aaSDag-Erling Smørgrav 
399c7f4d7adSDag-Erling Smørgrav 	if(detached) {
400c7f4d7adSDag-Erling Smørgrav 		struct mesh_state* sub = NULL;
401c7f4d7adSDag-Erling Smørgrav 		fptr_ok(fptr_whitelist_modenv_add_sub(
402c7f4d7adSDag-Erling Smørgrav 			qstate->env->add_sub));
403c7f4d7adSDag-Erling Smørgrav 		if(!(*qstate->env->add_sub)(qstate, &ask,
404c7f4d7adSDag-Erling Smørgrav 			(uint16_t)(BIT_RD|flags), 0, valrec, newq, &sub)){
405b7579f77SDag-Erling Smørgrav 			log_err("Could not generate request: out of memory");
406b7579f77SDag-Erling Smørgrav 			return 0;
407b7579f77SDag-Erling Smørgrav 		}
408c7f4d7adSDag-Erling Smørgrav 	}
409c7f4d7adSDag-Erling Smørgrav 	else {
410c7f4d7adSDag-Erling Smørgrav 		fptr_ok(fptr_whitelist_modenv_attach_sub(
411c7f4d7adSDag-Erling Smørgrav 			qstate->env->attach_sub));
412c7f4d7adSDag-Erling Smørgrav 		if(!(*qstate->env->attach_sub)(qstate, &ask,
413c7f4d7adSDag-Erling Smørgrav 			(uint16_t)(BIT_RD|flags), 0, valrec, newq)){
414c7f4d7adSDag-Erling Smørgrav 			log_err("Could not generate request: out of memory");
415c7f4d7adSDag-Erling Smørgrav 			return 0;
416c7f4d7adSDag-Erling Smørgrav 		}
417c7f4d7adSDag-Erling Smørgrav 	}
418b7579f77SDag-Erling Smørgrav 	/* newq; validator does not need state created for that
419b7579f77SDag-Erling Smørgrav 	 * query, and its a 'normal' for iterator as well */
420c7f4d7adSDag-Erling Smørgrav 	if(*newq) {
421b7579f77SDag-Erling Smørgrav 		/* add our blacklist to the query blacklist */
422c7f4d7adSDag-Erling Smørgrav 		sock_list_merge(&(*newq)->blacklist, (*newq)->region,
423b7579f77SDag-Erling Smørgrav 			vq->chain_blacklist);
424b7579f77SDag-Erling Smørgrav 	}
425b7579f77SDag-Erling Smørgrav 	qstate->ext_state[id] = module_wait_subquery;
426b7579f77SDag-Erling Smørgrav 	return 1;
427b7579f77SDag-Erling Smørgrav }
428b7579f77SDag-Erling Smørgrav 
429b7579f77SDag-Erling Smørgrav /**
430c7f4d7adSDag-Erling Smørgrav  * Generate, send and detach key tag signaling query.
431c7f4d7adSDag-Erling Smørgrav  *
432c7f4d7adSDag-Erling Smørgrav  * @param qstate: query state.
433c7f4d7adSDag-Erling Smørgrav  * @param id: module id.
434c7f4d7adSDag-Erling Smørgrav  * @param ta: trust anchor, locked.
435c7f4d7adSDag-Erling Smørgrav  * @return false on a processing error.
436c7f4d7adSDag-Erling Smørgrav  */
437c7f4d7adSDag-Erling Smørgrav static int
438c7f4d7adSDag-Erling Smørgrav generate_keytag_query(struct module_qstate* qstate, int id,
439c7f4d7adSDag-Erling Smørgrav 	struct trust_anchor* ta)
440c7f4d7adSDag-Erling Smørgrav {
441c7f4d7adSDag-Erling Smørgrav 	/* 3 bytes for "_ta", 5 bytes per tag (4 bytes + "-") */
442c7f4d7adSDag-Erling Smørgrav #define MAX_LABEL_TAGS (LDNS_MAX_LABELLEN-3)/5
443c7f4d7adSDag-Erling Smørgrav 	size_t i, numtag;
444c7f4d7adSDag-Erling Smørgrav 	uint16_t tags[MAX_LABEL_TAGS];
445c7f4d7adSDag-Erling Smørgrav 	char tagstr[LDNS_MAX_LABELLEN+1] = "_ta"; /* +1 for NULL byte */
446c7f4d7adSDag-Erling Smørgrav 	size_t tagstr_left = sizeof(tagstr) - strlen(tagstr);
447c7f4d7adSDag-Erling Smørgrav 	char* tagstr_pos = tagstr + strlen(tagstr);
448c7f4d7adSDag-Erling Smørgrav 	uint8_t dnamebuf[LDNS_MAX_DOMAINLEN+1]; /* +1 for label length byte */
449c7f4d7adSDag-Erling Smørgrav 	size_t dnamebuf_len = sizeof(dnamebuf);
450c7f4d7adSDag-Erling Smørgrav 	uint8_t* keytagdname;
451c7f4d7adSDag-Erling Smørgrav 	struct module_qstate* newq = NULL;
452c7f4d7adSDag-Erling Smørgrav 	enum module_ext_state ext_state = qstate->ext_state[id];
453c7f4d7adSDag-Erling Smørgrav 
454c7f4d7adSDag-Erling Smørgrav 	numtag = anchor_list_keytags(ta, tags, MAX_LABEL_TAGS);
455c7f4d7adSDag-Erling Smørgrav 	if(numtag == 0)
456c7f4d7adSDag-Erling Smørgrav 		return 0;
457c7f4d7adSDag-Erling Smørgrav 
458c7f4d7adSDag-Erling Smørgrav 	for(i=0; i<numtag; i++) {
459c7f4d7adSDag-Erling Smørgrav 		/* Buffer can't overflow; numtag is limited to tags that fit in
460c7f4d7adSDag-Erling Smørgrav 		 * the buffer. */
461c7f4d7adSDag-Erling Smørgrav 		snprintf(tagstr_pos, tagstr_left, "-%04x", (unsigned)tags[i]);
462c7f4d7adSDag-Erling Smørgrav 		tagstr_left -= strlen(tagstr_pos);
463c7f4d7adSDag-Erling Smørgrav 		tagstr_pos += strlen(tagstr_pos);
464c7f4d7adSDag-Erling Smørgrav 	}
465c7f4d7adSDag-Erling Smørgrav 
466c7f4d7adSDag-Erling Smørgrav 	sldns_str2wire_dname_buf_origin(tagstr, dnamebuf, &dnamebuf_len,
467c7f4d7adSDag-Erling Smørgrav 		ta->name, ta->namelen);
468c7f4d7adSDag-Erling Smørgrav 	if(!(keytagdname = (uint8_t*)regional_alloc_init(qstate->region,
469c7f4d7adSDag-Erling Smørgrav 		dnamebuf, dnamebuf_len))) {
470c7f4d7adSDag-Erling Smørgrav 		log_err("could not generate key tag query: out of memory");
471c7f4d7adSDag-Erling Smørgrav 		return 0;
472c7f4d7adSDag-Erling Smørgrav 	}
473c7f4d7adSDag-Erling Smørgrav 
47457bddd21SDag-Erling Smørgrav 	log_nametypeclass(VERB_OPS, "generate keytag query", keytagdname,
475c7f4d7adSDag-Erling Smørgrav 		LDNS_RR_TYPE_NULL, ta->dclass);
476c7f4d7adSDag-Erling Smørgrav 	if(!generate_request(qstate, id, keytagdname, dnamebuf_len,
477c7f4d7adSDag-Erling Smørgrav 		LDNS_RR_TYPE_NULL, ta->dclass, 0, &newq, 1)) {
478*4c75e3aaSDag-Erling Smørgrav 		verbose(VERB_ALGO, "failed to generate key tag signaling request");
479c7f4d7adSDag-Erling Smørgrav 		return 0;
480c7f4d7adSDag-Erling Smørgrav 	}
481c7f4d7adSDag-Erling Smørgrav 
482c7f4d7adSDag-Erling Smørgrav 	/* Not interrested in subquery response. Restore the ext_state,
483c7f4d7adSDag-Erling Smørgrav 	 * that might be changed by generate_request() */
484c7f4d7adSDag-Erling Smørgrav 	qstate->ext_state[id] = ext_state;
485c7f4d7adSDag-Erling Smørgrav 
486c7f4d7adSDag-Erling Smørgrav 	return 1;
487c7f4d7adSDag-Erling Smørgrav }
488c7f4d7adSDag-Erling Smørgrav 
489c7f4d7adSDag-Erling Smørgrav /**
4900fb34990SDag-Erling Smørgrav  * Get keytag as uint16_t from string
4910fb34990SDag-Erling Smørgrav  *
4920fb34990SDag-Erling Smørgrav  * @param start: start of string containing keytag
4930fb34990SDag-Erling Smørgrav  * @param keytag: pointer where to store the extracted keytag
4940fb34990SDag-Erling Smørgrav  * @return: 1 if keytag was extracted, else 0.
4950fb34990SDag-Erling Smørgrav  */
4960fb34990SDag-Erling Smørgrav static int
4970fb34990SDag-Erling Smørgrav sentinel_get_keytag(char* start, uint16_t* keytag) {
4980fb34990SDag-Erling Smørgrav 	char* keytag_str;
4990fb34990SDag-Erling Smørgrav 	char* e = NULL;
5000fb34990SDag-Erling Smørgrav 	keytag_str = calloc(1, SENTINEL_KEYTAG_LEN + 1 /* null byte */);
5010fb34990SDag-Erling Smørgrav 	if(!keytag_str)
5020fb34990SDag-Erling Smørgrav 		return 0;
5030fb34990SDag-Erling Smørgrav 	memmove(keytag_str, start, SENTINEL_KEYTAG_LEN);
5040fb34990SDag-Erling Smørgrav 	keytag_str[SENTINEL_KEYTAG_LEN] = '\0';
5050fb34990SDag-Erling Smørgrav 	*keytag = (uint16_t)strtol(keytag_str, &e, 10);
5060fb34990SDag-Erling Smørgrav 	if(!e || *e != '\0') {
5070fb34990SDag-Erling Smørgrav 		free(keytag_str);
5080fb34990SDag-Erling Smørgrav 		return 0;
5090fb34990SDag-Erling Smørgrav 	}
5100fb34990SDag-Erling Smørgrav 	free(keytag_str);
5110fb34990SDag-Erling Smørgrav 	return 1;
5120fb34990SDag-Erling Smørgrav }
5130fb34990SDag-Erling Smørgrav 
5140fb34990SDag-Erling Smørgrav /**
515b7579f77SDag-Erling Smørgrav  * Prime trust anchor for use.
516b7579f77SDag-Erling Smørgrav  * Generate and dispatch a priming query for the given trust anchor.
517b7579f77SDag-Erling Smørgrav  * The trust anchor can be DNSKEY or DS and does not have to be signed.
518b7579f77SDag-Erling Smørgrav  *
519b7579f77SDag-Erling Smørgrav  * @param qstate: query state.
520b7579f77SDag-Erling Smørgrav  * @param vq: validator query state.
521b7579f77SDag-Erling Smørgrav  * @param id: module id.
522b7579f77SDag-Erling Smørgrav  * @param toprime: what to prime.
523b7579f77SDag-Erling Smørgrav  * @return false on a processing error.
524b7579f77SDag-Erling Smørgrav  */
525b7579f77SDag-Erling Smørgrav static int
526b7579f77SDag-Erling Smørgrav prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq,
527b7579f77SDag-Erling Smørgrav 	int id, struct trust_anchor* toprime)
528b7579f77SDag-Erling Smørgrav {
529c7f4d7adSDag-Erling Smørgrav 	struct module_qstate* newq = NULL;
530b7579f77SDag-Erling Smørgrav 	int ret = generate_request(qstate, id, toprime->name, toprime->namelen,
531c7f4d7adSDag-Erling Smørgrav 		LDNS_RR_TYPE_DNSKEY, toprime->dclass, BIT_CD, &newq, 0);
532c7f4d7adSDag-Erling Smørgrav 
533c7f4d7adSDag-Erling Smørgrav 	if(newq && qstate->env->cfg->trust_anchor_signaling &&
534c7f4d7adSDag-Erling Smørgrav 		!generate_keytag_query(qstate, id, toprime)) {
535*4c75e3aaSDag-Erling Smørgrav 		verbose(VERB_ALGO, "keytag signaling query failed");
536c7f4d7adSDag-Erling Smørgrav 		return 0;
537c7f4d7adSDag-Erling Smørgrav 	}
538c7f4d7adSDag-Erling Smørgrav 
539b7579f77SDag-Erling Smørgrav 	if(!ret) {
540*4c75e3aaSDag-Erling Smørgrav 		verbose(VERB_ALGO, "Could not prime trust anchor");
541b7579f77SDag-Erling Smørgrav 		return 0;
542b7579f77SDag-Erling Smørgrav 	}
543b7579f77SDag-Erling Smørgrav 	/* ignore newq; validator does not need state created for that
544b7579f77SDag-Erling Smørgrav 	 * query, and its a 'normal' for iterator as well */
545b7579f77SDag-Erling Smørgrav 	vq->wait_prime_ta = 1; /* to elicit PRIME_RESP_STATE processing
546b7579f77SDag-Erling Smørgrav 		from the validator inform_super() routine */
547b7579f77SDag-Erling Smørgrav 	/* store trust anchor name for later lookup when prime returns */
548b7579f77SDag-Erling Smørgrav 	vq->trust_anchor_name = regional_alloc_init(qstate->region,
549b7579f77SDag-Erling Smørgrav 		toprime->name, toprime->namelen);
550b7579f77SDag-Erling Smørgrav 	vq->trust_anchor_len = toprime->namelen;
551b7579f77SDag-Erling Smørgrav 	vq->trust_anchor_labs = toprime->namelabs;
552b7579f77SDag-Erling Smørgrav 	if(!vq->trust_anchor_name) {
553b7579f77SDag-Erling Smørgrav 		log_err("Could not prime trust anchor: out of memory");
554b7579f77SDag-Erling Smørgrav 		return 0;
555b7579f77SDag-Erling Smørgrav 	}
556b7579f77SDag-Erling Smørgrav 	return 1;
557b7579f77SDag-Erling Smørgrav }
558b7579f77SDag-Erling Smørgrav 
559b7579f77SDag-Erling Smørgrav /**
560b7579f77SDag-Erling Smørgrav  * Validate if the ANSWER and AUTHORITY sections contain valid rrsets.
561b7579f77SDag-Erling Smørgrav  * They must be validly signed with the given key.
562b7579f77SDag-Erling Smørgrav  * Tries to validate ADDITIONAL rrsets as well, but only to check them.
563b7579f77SDag-Erling Smørgrav  * Allows unsigned CNAME after a DNAME that expands the DNAME.
564b7579f77SDag-Erling Smørgrav  *
565b7579f77SDag-Erling Smørgrav  * Note that by the time this method is called, the process of finding the
566b7579f77SDag-Erling Smørgrav  * trusted DNSKEY rrset that signs this response must already have been
567b7579f77SDag-Erling Smørgrav  * completed.
568b7579f77SDag-Erling Smørgrav  *
569b7579f77SDag-Erling Smørgrav  * @param qstate: query state.
570b7579f77SDag-Erling Smørgrav  * @param env: module env for verify.
571b7579f77SDag-Erling Smørgrav  * @param ve: validator env for verify.
572b7579f77SDag-Erling Smørgrav  * @param qchase: query that was made.
573b7579f77SDag-Erling Smørgrav  * @param chase_reply: answer to validate.
574b7579f77SDag-Erling Smørgrav  * @param key_entry: the key entry, which is trusted, and which matches
575b7579f77SDag-Erling Smørgrav  * 	the signer of the answer. The key entry isgood().
576b7579f77SDag-Erling Smørgrav  * @return false if any of the rrsets in the an or ns sections of the message
577b7579f77SDag-Erling Smørgrav  * 	fail to verify. The message is then set to bogus.
578b7579f77SDag-Erling Smørgrav  */
579b7579f77SDag-Erling Smørgrav static int
580b7579f77SDag-Erling Smørgrav validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
581b7579f77SDag-Erling Smørgrav 	struct val_env* ve, struct query_info* qchase,
582b7579f77SDag-Erling Smørgrav 	struct reply_info* chase_reply, struct key_entry_key* key_entry)
583b7579f77SDag-Erling Smørgrav {
584b7579f77SDag-Erling Smørgrav 	uint8_t* sname;
585b7579f77SDag-Erling Smørgrav 	size_t i, slen;
586b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key* s;
587b7579f77SDag-Erling Smørgrav 	enum sec_status sec;
588b7579f77SDag-Erling Smørgrav 	int dname_seen = 0;
589b7579f77SDag-Erling Smørgrav 	char* reason = NULL;
590b7579f77SDag-Erling Smørgrav 
591b7579f77SDag-Erling Smørgrav 	/* validate the ANSWER section */
592b7579f77SDag-Erling Smørgrav 	for(i=0; i<chase_reply->an_numrrsets; i++) {
593b7579f77SDag-Erling Smørgrav 		s = chase_reply->rrsets[i];
594b7579f77SDag-Erling Smørgrav 		/* Skip the CNAME following a (validated) DNAME.
595b7579f77SDag-Erling Smørgrav 		 * Because of the normalization routines in the iterator,
596b7579f77SDag-Erling Smørgrav 		 * there will always be an unsigned CNAME following a DNAME
597b7579f77SDag-Erling Smørgrav 		 * (unless qtype=DNAME). */
598b7579f77SDag-Erling Smørgrav 		if(dname_seen && ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
599b7579f77SDag-Erling Smørgrav 			dname_seen = 0;
600b7579f77SDag-Erling Smørgrav 			/* CNAME was synthesized by our own iterator */
601b7579f77SDag-Erling Smørgrav 			/* since the DNAME verified, mark the CNAME as secure */
602b7579f77SDag-Erling Smørgrav 			((struct packed_rrset_data*)s->entry.data)->security =
603b7579f77SDag-Erling Smørgrav 				sec_status_secure;
604b7579f77SDag-Erling Smørgrav 			((struct packed_rrset_data*)s->entry.data)->trust =
605b7579f77SDag-Erling Smørgrav 				rrset_trust_validated;
606b7579f77SDag-Erling Smørgrav 			continue;
607b7579f77SDag-Erling Smørgrav 		}
608b7579f77SDag-Erling Smørgrav 
609b7579f77SDag-Erling Smørgrav 		/* Verify the answer rrset */
610838e13ceSDag-Erling Smørgrav 		sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
611838e13ceSDag-Erling Smørgrav 			LDNS_SECTION_ANSWER, qstate);
612b7579f77SDag-Erling Smørgrav 		/* If the (answer) rrset failed to validate, then this
613b7579f77SDag-Erling Smørgrav 		 * message is BAD. */
614b7579f77SDag-Erling Smørgrav 		if(sec != sec_status_secure) {
615b7579f77SDag-Erling Smørgrav 			log_nametypeclass(VERB_QUERY, "validator: response "
616b7579f77SDag-Erling Smørgrav 				"has failed ANSWER rrset:", s->rk.dname,
617b7579f77SDag-Erling Smørgrav 				ntohs(s->rk.type), ntohs(s->rk.rrset_class));
618b7579f77SDag-Erling Smørgrav 			errinf(qstate, reason);
619b7579f77SDag-Erling Smørgrav 			if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME)
620b7579f77SDag-Erling Smørgrav 				errinf(qstate, "for CNAME");
621b7579f77SDag-Erling Smørgrav 			else if(ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME)
622b7579f77SDag-Erling Smørgrav 				errinf(qstate, "for DNAME");
623b7579f77SDag-Erling Smørgrav 			errinf_origin(qstate, qstate->reply_origin);
624b7579f77SDag-Erling Smørgrav 			chase_reply->security = sec_status_bogus;
625b7579f77SDag-Erling Smørgrav 			return 0;
626b7579f77SDag-Erling Smørgrav 		}
627b7579f77SDag-Erling Smørgrav 
628b7579f77SDag-Erling Smørgrav 		/* Notice a DNAME that should be followed by an unsigned
629b7579f77SDag-Erling Smørgrav 		 * CNAME. */
630b7579f77SDag-Erling Smørgrav 		if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
631b7579f77SDag-Erling Smørgrav 			ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) {
632b7579f77SDag-Erling Smørgrav 			dname_seen = 1;
633b7579f77SDag-Erling Smørgrav 		}
634b7579f77SDag-Erling Smørgrav 	}
635b7579f77SDag-Erling Smørgrav 
636b7579f77SDag-Erling Smørgrav 	/* validate the AUTHORITY section */
637b7579f77SDag-Erling Smørgrav 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
638b7579f77SDag-Erling Smørgrav 		chase_reply->ns_numrrsets; i++) {
639b7579f77SDag-Erling Smørgrav 		s = chase_reply->rrsets[i];
640838e13ceSDag-Erling Smørgrav 		sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
641838e13ceSDag-Erling Smørgrav 			LDNS_SECTION_AUTHORITY, qstate);
642b7579f77SDag-Erling Smørgrav 		/* If anything in the authority section fails to be secure,
643b7579f77SDag-Erling Smørgrav 		 * we have a bad message. */
644b7579f77SDag-Erling Smørgrav 		if(sec != sec_status_secure) {
645b7579f77SDag-Erling Smørgrav 			log_nametypeclass(VERB_QUERY, "validator: response "
646b7579f77SDag-Erling Smørgrav 				"has failed AUTHORITY rrset:", s->rk.dname,
647b7579f77SDag-Erling Smørgrav 				ntohs(s->rk.type), ntohs(s->rk.rrset_class));
648b7579f77SDag-Erling Smørgrav 			errinf(qstate, reason);
649b7579f77SDag-Erling Smørgrav 			errinf_origin(qstate, qstate->reply_origin);
65009a3aaf3SDag-Erling Smørgrav 			errinf_rrset(qstate, s);
651b7579f77SDag-Erling Smørgrav 			chase_reply->security = sec_status_bogus;
652b7579f77SDag-Erling Smørgrav 			return 0;
653b7579f77SDag-Erling Smørgrav 		}
654b7579f77SDag-Erling Smørgrav 	}
655b7579f77SDag-Erling Smørgrav 
656c7f4d7adSDag-Erling Smørgrav 	/* If set, the validator should clean the additional section of
657c7f4d7adSDag-Erling Smørgrav 	 * secure messages. */
658c7f4d7adSDag-Erling Smørgrav 	if(!env->cfg->val_clean_additional)
659b7579f77SDag-Erling Smørgrav 		return 1;
660c7f4d7adSDag-Erling Smørgrav 	/* attempt to validate the ADDITIONAL section rrsets */
661b7579f77SDag-Erling Smørgrav 	for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
662b7579f77SDag-Erling Smørgrav 		i<chase_reply->rrset_count; i++) {
663b7579f77SDag-Erling Smørgrav 		s = chase_reply->rrsets[i];
664b7579f77SDag-Erling Smørgrav 		/* only validate rrs that have signatures with the key */
665b7579f77SDag-Erling Smørgrav 		/* leave others unchecked, those get removed later on too */
666b7579f77SDag-Erling Smørgrav 		val_find_rrset_signer(s, &sname, &slen);
667b7579f77SDag-Erling Smørgrav 		if(sname && query_dname_compare(sname, key_entry->name)==0)
668b7579f77SDag-Erling Smørgrav 			(void)val_verify_rrset_entry(env, ve, s, key_entry,
669838e13ceSDag-Erling Smørgrav 				&reason, LDNS_SECTION_ADDITIONAL, qstate);
670b7579f77SDag-Erling Smørgrav 		/* the additional section can fail to be secure,
671b7579f77SDag-Erling Smørgrav 		 * it is optional, check signature in case we need
672b7579f77SDag-Erling Smørgrav 		 * to clean the additional section later. */
673b7579f77SDag-Erling Smørgrav 	}
674b7579f77SDag-Erling Smørgrav 
675b7579f77SDag-Erling Smørgrav 	return 1;
676b7579f77SDag-Erling Smørgrav }
677b7579f77SDag-Erling Smørgrav 
678b7579f77SDag-Erling Smørgrav /**
679b7579f77SDag-Erling Smørgrav  * Detect wrong truncated response (say from BIND 9.6.1 that is forwarding
680b7579f77SDag-Erling Smørgrav  * and saw the NS record without signatures from a referral).
681b7579f77SDag-Erling Smørgrav  * The positive response has a mangled authority section.
682b7579f77SDag-Erling Smørgrav  * Remove that authority section and the additional section.
683b7579f77SDag-Erling Smørgrav  * @param rep: reply
684b7579f77SDag-Erling Smørgrav  * @return true if a wrongly truncated response.
685b7579f77SDag-Erling Smørgrav  */
686b7579f77SDag-Erling Smørgrav static int
687b7579f77SDag-Erling Smørgrav detect_wrongly_truncated(struct reply_info* rep)
688b7579f77SDag-Erling Smørgrav {
689b7579f77SDag-Erling Smørgrav 	size_t i;
690b7579f77SDag-Erling Smørgrav 	/* only NS in authority, and it is bogus */
691b7579f77SDag-Erling Smørgrav 	if(rep->ns_numrrsets != 1 || rep->an_numrrsets == 0)
692b7579f77SDag-Erling Smørgrav 		return 0;
693b7579f77SDag-Erling Smørgrav 	if(ntohs(rep->rrsets[ rep->an_numrrsets ]->rk.type) != LDNS_RR_TYPE_NS)
694b7579f77SDag-Erling Smørgrav 		return 0;
695b7579f77SDag-Erling Smørgrav 	if(((struct packed_rrset_data*)rep->rrsets[ rep->an_numrrsets ]
696b7579f77SDag-Erling Smørgrav 		->entry.data)->security == sec_status_secure)
697b7579f77SDag-Erling Smørgrav 		return 0;
698b7579f77SDag-Erling Smørgrav 	/* answer section is present and secure */
699b7579f77SDag-Erling Smørgrav 	for(i=0; i<rep->an_numrrsets; i++) {
700b7579f77SDag-Erling Smørgrav 		if(((struct packed_rrset_data*)rep->rrsets[ i ]
701b7579f77SDag-Erling Smørgrav 			->entry.data)->security != sec_status_secure)
702b7579f77SDag-Erling Smørgrav 			return 0;
703b7579f77SDag-Erling Smørgrav 	}
704b7579f77SDag-Erling Smørgrav 	verbose(VERB_ALGO, "truncating to minimal response");
705b7579f77SDag-Erling Smørgrav 	return 1;
706b7579f77SDag-Erling Smørgrav }
707b7579f77SDag-Erling Smørgrav 
7086480faa8SDag-Erling Smørgrav /**
7096480faa8SDag-Erling Smørgrav  * For messages that are not referrals, if the chase reply contains an
7106480faa8SDag-Erling Smørgrav  * unsigned NS record in the authority section it could have been
7116480faa8SDag-Erling Smørgrav  * inserted by a (BIND) forwarder that thinks the zone is insecure, and
7126480faa8SDag-Erling Smørgrav  * that has an NS record without signatures in cache.  Remove the NS
7136480faa8SDag-Erling Smørgrav  * record since the reply does not hinge on that record (in the authority
7146480faa8SDag-Erling Smørgrav  * section), but do not remove it if it removes the last record from the
7156480faa8SDag-Erling Smørgrav  * answer+authority sections.
7166480faa8SDag-Erling Smørgrav  * @param chase_reply: the chased reply, we have a key for this contents,
7176480faa8SDag-Erling Smørgrav  * 	so we should have signatures for these rrsets and not having
7186480faa8SDag-Erling Smørgrav  * 	signatures means it will be bogus.
7196480faa8SDag-Erling Smørgrav  * @param orig_reply: original reply, remove NS from there as well because
7206480faa8SDag-Erling Smørgrav  * 	we cannot mark the NS record as DNSSEC valid because it is not
7216480faa8SDag-Erling Smørgrav  * 	validated by signatures.
7226480faa8SDag-Erling Smørgrav  */
7236480faa8SDag-Erling Smørgrav static void
7246480faa8SDag-Erling Smørgrav remove_spurious_authority(struct reply_info* chase_reply,
7256480faa8SDag-Erling Smørgrav 	struct reply_info* orig_reply)
7266480faa8SDag-Erling Smørgrav {
7276480faa8SDag-Erling Smørgrav 	size_t i, found = 0;
7286480faa8SDag-Erling Smørgrav 	int remove = 0;
7296480faa8SDag-Erling Smørgrav 	/* if no answer and only 1 auth RRset, do not remove that one */
7306480faa8SDag-Erling Smørgrav 	if(chase_reply->an_numrrsets == 0 && chase_reply->ns_numrrsets == 1)
7316480faa8SDag-Erling Smørgrav 		return;
7326480faa8SDag-Erling Smørgrav 	/* search authority section for unsigned NS records */
7336480faa8SDag-Erling Smørgrav 	for(i = chase_reply->an_numrrsets;
7346480faa8SDag-Erling Smørgrav 		i < chase_reply->an_numrrsets+chase_reply->ns_numrrsets; i++) {
7356480faa8SDag-Erling Smørgrav 		struct packed_rrset_data* d = (struct packed_rrset_data*)
7366480faa8SDag-Erling Smørgrav 			chase_reply->rrsets[i]->entry.data;
7376480faa8SDag-Erling Smørgrav 		if(ntohs(chase_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
7386480faa8SDag-Erling Smørgrav 			&& d->rrsig_count == 0) {
7396480faa8SDag-Erling Smørgrav 			found = i;
7406480faa8SDag-Erling Smørgrav 			remove = 1;
7416480faa8SDag-Erling Smørgrav 			break;
7426480faa8SDag-Erling Smørgrav 		}
7436480faa8SDag-Erling Smørgrav 	}
7446480faa8SDag-Erling Smørgrav 	/* see if we found the entry */
7456480faa8SDag-Erling Smørgrav 	if(!remove) return;
7466480faa8SDag-Erling Smørgrav 	log_rrset_key(VERB_ALGO, "Removing spurious unsigned NS record "
7476480faa8SDag-Erling Smørgrav 		"(likely inserted by forwarder)", chase_reply->rrsets[found]);
7486480faa8SDag-Erling Smørgrav 
7496480faa8SDag-Erling Smørgrav 	/* find rrset in orig_reply */
7506480faa8SDag-Erling Smørgrav 	for(i = orig_reply->an_numrrsets;
7516480faa8SDag-Erling Smørgrav 		i < orig_reply->an_numrrsets+orig_reply->ns_numrrsets; i++) {
7526480faa8SDag-Erling Smørgrav 		if(ntohs(orig_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
7536480faa8SDag-Erling Smørgrav 			&& query_dname_compare(orig_reply->rrsets[i]->rk.dname,
7546480faa8SDag-Erling Smørgrav 				chase_reply->rrsets[found]->rk.dname) == 0) {
7556480faa8SDag-Erling Smørgrav 			/* remove from orig_msg */
7566480faa8SDag-Erling Smørgrav 			val_reply_remove_auth(orig_reply, i);
7576480faa8SDag-Erling Smørgrav 			break;
7586480faa8SDag-Erling Smørgrav 		}
7596480faa8SDag-Erling Smørgrav 	}
7606480faa8SDag-Erling Smørgrav 	/* remove rrset from chase_reply */
7616480faa8SDag-Erling Smørgrav 	val_reply_remove_auth(chase_reply, found);
7626480faa8SDag-Erling Smørgrav }
763b7579f77SDag-Erling Smørgrav 
764b7579f77SDag-Erling Smørgrav /**
765b7579f77SDag-Erling Smørgrav  * Given a "positive" response -- a response that contains an answer to the
766b7579f77SDag-Erling Smørgrav  * question, and no CNAME chain, validate this response.
767b7579f77SDag-Erling Smørgrav  *
768b7579f77SDag-Erling Smørgrav  * The answer and authority RRsets must already be verified as secure.
769b7579f77SDag-Erling Smørgrav  *
770b7579f77SDag-Erling Smørgrav  * @param env: module env for verify.
771b7579f77SDag-Erling Smørgrav  * @param ve: validator env for verify.
772b7579f77SDag-Erling Smørgrav  * @param qchase: query that was made.
773b7579f77SDag-Erling Smørgrav  * @param chase_reply: answer to that query to validate.
774b7579f77SDag-Erling Smørgrav  * @param kkey: the key entry, which is trusted, and which matches
775b7579f77SDag-Erling Smørgrav  * 	the signer of the answer. The key entry isgood().
776b7579f77SDag-Erling Smørgrav  */
777b7579f77SDag-Erling Smørgrav static void
778b7579f77SDag-Erling Smørgrav validate_positive_response(struct module_env* env, struct val_env* ve,
779b7579f77SDag-Erling Smørgrav 	struct query_info* qchase, struct reply_info* chase_reply,
780b7579f77SDag-Erling Smørgrav 	struct key_entry_key* kkey)
781b7579f77SDag-Erling Smørgrav {
782b7579f77SDag-Erling Smørgrav 	uint8_t* wc = NULL;
78357bddd21SDag-Erling Smørgrav 	size_t wl;
78457bddd21SDag-Erling Smørgrav 	int wc_cached = 0;
785b7579f77SDag-Erling Smørgrav 	int wc_NSEC_ok = 0;
786b7579f77SDag-Erling Smørgrav 	int nsec3s_seen = 0;
787b7579f77SDag-Erling Smørgrav 	size_t i;
788b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key* s;
789b7579f77SDag-Erling Smørgrav 
790b7579f77SDag-Erling Smørgrav 	/* validate the ANSWER section - this will be the answer itself */
791b7579f77SDag-Erling Smørgrav 	for(i=0; i<chase_reply->an_numrrsets; i++) {
792b7579f77SDag-Erling Smørgrav 		s = chase_reply->rrsets[i];
793b7579f77SDag-Erling Smørgrav 
794b7579f77SDag-Erling Smørgrav 		/* Check to see if the rrset is the result of a wildcard
795b7579f77SDag-Erling Smørgrav 		 * expansion. If so, an additional check will need to be
796b7579f77SDag-Erling Smørgrav 		 * made in the authority section. */
79757bddd21SDag-Erling Smørgrav 		if(!val_rrset_wildcard(s, &wc, &wl)) {
798b7579f77SDag-Erling Smørgrav 			log_nametypeclass(VERB_QUERY, "Positive response has "
799b7579f77SDag-Erling Smørgrav 				"inconsistent wildcard sigs:", s->rk.dname,
800b7579f77SDag-Erling Smørgrav 				ntohs(s->rk.type), ntohs(s->rk.rrset_class));
801b7579f77SDag-Erling Smørgrav 			chase_reply->security = sec_status_bogus;
802b7579f77SDag-Erling Smørgrav 			return;
803b7579f77SDag-Erling Smørgrav 		}
80457bddd21SDag-Erling Smørgrav 		if(wc && !wc_cached && env->cfg->aggressive_nsec) {
80557bddd21SDag-Erling Smørgrav 			rrset_cache_update_wildcard(env->rrset_cache, s, wc, wl,
80657bddd21SDag-Erling Smørgrav 				env->alloc, *env->now);
80757bddd21SDag-Erling Smørgrav 			wc_cached = 1;
80857bddd21SDag-Erling Smørgrav 		}
80957bddd21SDag-Erling Smørgrav 
810b7579f77SDag-Erling Smørgrav 	}
811b7579f77SDag-Erling Smørgrav 
812b7579f77SDag-Erling Smørgrav 	/* validate the AUTHORITY section as well - this will generally be
813b7579f77SDag-Erling Smørgrav 	 * the NS rrset (which could be missing, no problem) */
814b7579f77SDag-Erling Smørgrav 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
815b7579f77SDag-Erling Smørgrav 		chase_reply->ns_numrrsets; i++) {
816b7579f77SDag-Erling Smørgrav 		s = chase_reply->rrsets[i];
817b7579f77SDag-Erling Smørgrav 
818b7579f77SDag-Erling Smørgrav 		/* If this is a positive wildcard response, and we have a
819b7579f77SDag-Erling Smørgrav 		 * (just verified) NSEC record, try to use it to 1) prove
820b7579f77SDag-Erling Smørgrav 		 * that qname doesn't exist and 2) that the correct wildcard
821b7579f77SDag-Erling Smørgrav 		 * was used. */
822b7579f77SDag-Erling Smørgrav 		if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
823b7579f77SDag-Erling Smørgrav 			if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
824b7579f77SDag-Erling Smørgrav 				wc_NSEC_ok = 1;
825b7579f77SDag-Erling Smørgrav 			}
826b7579f77SDag-Erling Smørgrav 			/* if not, continue looking for proof */
827b7579f77SDag-Erling Smørgrav 		}
828b7579f77SDag-Erling Smørgrav 
829b7579f77SDag-Erling Smørgrav 		/* Otherwise, if this is a positive wildcard response and
830b7579f77SDag-Erling Smørgrav 		 * we have NSEC3 records */
831b7579f77SDag-Erling Smørgrav 		if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
832b7579f77SDag-Erling Smørgrav 			nsec3s_seen = 1;
833b7579f77SDag-Erling Smørgrav 		}
834b7579f77SDag-Erling Smørgrav 	}
835b7579f77SDag-Erling Smørgrav 
836b7579f77SDag-Erling Smørgrav 	/* If this was a positive wildcard response that we haven't already
837b7579f77SDag-Erling Smørgrav 	 * proven, and we have NSEC3 records, try to prove it using the NSEC3
838b7579f77SDag-Erling Smørgrav 	 * records. */
839b7579f77SDag-Erling Smørgrav 	if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
840b7579f77SDag-Erling Smørgrav 		enum sec_status sec = nsec3_prove_wildcard(env, ve,
841b7579f77SDag-Erling Smørgrav 			chase_reply->rrsets+chase_reply->an_numrrsets,
842b7579f77SDag-Erling Smørgrav 			chase_reply->ns_numrrsets, qchase, kkey, wc);
843b7579f77SDag-Erling Smørgrav 		if(sec == sec_status_insecure) {
844b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "Positive wildcard response is "
845b7579f77SDag-Erling Smørgrav 				"insecure");
846b7579f77SDag-Erling Smørgrav 			chase_reply->security = sec_status_insecure;
847b7579f77SDag-Erling Smørgrav 			return;
848b7579f77SDag-Erling Smørgrav 		} else if(sec == sec_status_secure)
849b7579f77SDag-Erling Smørgrav 			wc_NSEC_ok = 1;
850b7579f77SDag-Erling Smørgrav 	}
851b7579f77SDag-Erling Smørgrav 
852b7579f77SDag-Erling Smørgrav 	/* If after all this, we still haven't proven the positive wildcard
853b7579f77SDag-Erling Smørgrav 	 * response, fail. */
854b7579f77SDag-Erling Smørgrav 	if(wc != NULL && !wc_NSEC_ok) {
855b7579f77SDag-Erling Smørgrav 		verbose(VERB_QUERY, "positive response was wildcard "
856b7579f77SDag-Erling Smørgrav 			"expansion and did not prove original data "
857b7579f77SDag-Erling Smørgrav 			"did not exist");
858b7579f77SDag-Erling Smørgrav 		chase_reply->security = sec_status_bogus;
859b7579f77SDag-Erling Smørgrav 		return;
860b7579f77SDag-Erling Smørgrav 	}
861b7579f77SDag-Erling Smørgrav 
862b7579f77SDag-Erling Smørgrav 	verbose(VERB_ALGO, "Successfully validated positive response");
863b7579f77SDag-Erling Smørgrav 	chase_reply->security = sec_status_secure;
864b7579f77SDag-Erling Smørgrav }
865b7579f77SDag-Erling Smørgrav 
866b7579f77SDag-Erling Smørgrav /**
867b7579f77SDag-Erling Smørgrav  * Validate a NOERROR/NODATA signed response -- a response that has a
868b7579f77SDag-Erling Smørgrav  * NOERROR Rcode but no ANSWER section RRsets. This consists of making
869b7579f77SDag-Erling Smørgrav  * certain that the authority section NSEC/NSEC3s proves that the qname
870b7579f77SDag-Erling Smørgrav  * does exist and the qtype doesn't.
871b7579f77SDag-Erling Smørgrav  *
872b7579f77SDag-Erling Smørgrav  * The answer and authority RRsets must already be verified as secure.
873b7579f77SDag-Erling Smørgrav  *
874b7579f77SDag-Erling Smørgrav  * @param env: module env for verify.
875b7579f77SDag-Erling Smørgrav  * @param ve: validator env for verify.
876b7579f77SDag-Erling Smørgrav  * @param qchase: query that was made.
877b7579f77SDag-Erling Smørgrav  * @param chase_reply: answer to that query to validate.
878b7579f77SDag-Erling Smørgrav  * @param kkey: the key entry, which is trusted, and which matches
879b7579f77SDag-Erling Smørgrav  * 	the signer of the answer. The key entry isgood().
880b7579f77SDag-Erling Smørgrav  */
881b7579f77SDag-Erling Smørgrav static void
882b7579f77SDag-Erling Smørgrav validate_nodata_response(struct module_env* env, struct val_env* ve,
883b7579f77SDag-Erling Smørgrav 	struct query_info* qchase, struct reply_info* chase_reply,
884b7579f77SDag-Erling Smørgrav 	struct key_entry_key* kkey)
885b7579f77SDag-Erling Smørgrav {
886b7579f77SDag-Erling Smørgrav 	/* Since we are here, there must be nothing in the ANSWER section to
887b7579f77SDag-Erling Smørgrav 	 * validate. */
888b7579f77SDag-Erling Smørgrav 	/* (Note: CNAME/DNAME responses will not directly get here --
88905ab2901SDag-Erling Smørgrav 	 * instead, they are chased down into individual CNAME validations,
890b7579f77SDag-Erling Smørgrav 	 * and at the end of the cname chain a POSITIVE, or CNAME_NOANSWER
891b7579f77SDag-Erling Smørgrav 	 * validation.) */
892b7579f77SDag-Erling Smørgrav 
893b7579f77SDag-Erling Smørgrav 	/* validate the AUTHORITY section */
894b7579f77SDag-Erling Smørgrav 	int has_valid_nsec = 0; /* If true, then the NODATA has been proven.*/
895b7579f77SDag-Erling Smørgrav 	uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
896b7579f77SDag-Erling Smørgrav 				proven closest encloser. */
897b7579f77SDag-Erling Smørgrav 	uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
898b7579f77SDag-Erling Smørgrav 	int nsec3s_seen = 0; /* nsec3s seen */
899b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key* s;
900b7579f77SDag-Erling Smørgrav 	size_t i;
901b7579f77SDag-Erling Smørgrav 
902b7579f77SDag-Erling Smørgrav 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
903b7579f77SDag-Erling Smørgrav 		chase_reply->ns_numrrsets; i++) {
904b7579f77SDag-Erling Smørgrav 		s = chase_reply->rrsets[i];
905b7579f77SDag-Erling Smørgrav 		/* If we encounter an NSEC record, try to use it to prove
906b7579f77SDag-Erling Smørgrav 		 * NODATA.
907b7579f77SDag-Erling Smørgrav 		 * This needs to handle the ENT NODATA case. */
908b7579f77SDag-Erling Smørgrav 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
909b7579f77SDag-Erling Smørgrav 			if(nsec_proves_nodata(s, qchase, &wc)) {
910b7579f77SDag-Erling Smørgrav 				has_valid_nsec = 1;
911b7579f77SDag-Erling Smørgrav 				/* sets wc-encloser if wildcard applicable */
912b7579f77SDag-Erling Smørgrav 			}
913b7579f77SDag-Erling Smørgrav 			if(val_nsec_proves_name_error(s, qchase->qname)) {
914b7579f77SDag-Erling Smørgrav 				ce = nsec_closest_encloser(qchase->qname, s);
915b7579f77SDag-Erling Smørgrav 			}
916b7579f77SDag-Erling Smørgrav 			if(val_nsec_proves_insecuredelegation(s, qchase)) {
917b7579f77SDag-Erling Smørgrav 				verbose(VERB_ALGO, "delegation is insecure");
918b7579f77SDag-Erling Smørgrav 				chase_reply->security = sec_status_insecure;
919b7579f77SDag-Erling Smørgrav 				return;
920b7579f77SDag-Erling Smørgrav 			}
921b7579f77SDag-Erling Smørgrav 		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
922b7579f77SDag-Erling Smørgrav 			nsec3s_seen = 1;
923b7579f77SDag-Erling Smørgrav 		}
924b7579f77SDag-Erling Smørgrav 	}
925b7579f77SDag-Erling Smørgrav 
926b7579f77SDag-Erling Smørgrav 	/* check to see if we have a wildcard NODATA proof. */
927b7579f77SDag-Erling Smørgrav 
928b7579f77SDag-Erling Smørgrav 	/* The wildcard NODATA is 1 NSEC proving that qname does not exist
929b7579f77SDag-Erling Smørgrav 	 * (and also proving what the closest encloser is), and 1 NSEC
930b7579f77SDag-Erling Smørgrav 	 * showing the matching wildcard, which must be *.closest_encloser. */
931b7579f77SDag-Erling Smørgrav 	if(wc && !ce)
932b7579f77SDag-Erling Smørgrav 		has_valid_nsec = 0;
933b7579f77SDag-Erling Smørgrav 	else if(wc && ce) {
934b7579f77SDag-Erling Smørgrav 		if(query_dname_compare(wc, ce) != 0) {
935b7579f77SDag-Erling Smørgrav 			has_valid_nsec = 0;
936b7579f77SDag-Erling Smørgrav 		}
937b7579f77SDag-Erling Smørgrav 	}
938b7579f77SDag-Erling Smørgrav 
939b7579f77SDag-Erling Smørgrav 	if(!has_valid_nsec && nsec3s_seen) {
940b7579f77SDag-Erling Smørgrav 		enum sec_status sec = nsec3_prove_nodata(env, ve,
941b7579f77SDag-Erling Smørgrav 			chase_reply->rrsets+chase_reply->an_numrrsets,
942b7579f77SDag-Erling Smørgrav 			chase_reply->ns_numrrsets, qchase, kkey);
943b7579f77SDag-Erling Smørgrav 		if(sec == sec_status_insecure) {
944b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "NODATA response is insecure");
945b7579f77SDag-Erling Smørgrav 			chase_reply->security = sec_status_insecure;
946b7579f77SDag-Erling Smørgrav 			return;
947b7579f77SDag-Erling Smørgrav 		} else if(sec == sec_status_secure)
948b7579f77SDag-Erling Smørgrav 			has_valid_nsec = 1;
949b7579f77SDag-Erling Smørgrav 	}
950b7579f77SDag-Erling Smørgrav 
951b7579f77SDag-Erling Smørgrav 	if(!has_valid_nsec) {
952b7579f77SDag-Erling Smørgrav 		verbose(VERB_QUERY, "NODATA response failed to prove NODATA "
953b7579f77SDag-Erling Smørgrav 			"status with NSEC/NSEC3");
954b7579f77SDag-Erling Smørgrav 		if(verbosity >= VERB_ALGO)
955b7579f77SDag-Erling Smørgrav 			log_dns_msg("Failed NODATA", qchase, chase_reply);
956b7579f77SDag-Erling Smørgrav 		chase_reply->security = sec_status_bogus;
957b7579f77SDag-Erling Smørgrav 		return;
958b7579f77SDag-Erling Smørgrav 	}
959b7579f77SDag-Erling Smørgrav 
960b7579f77SDag-Erling Smørgrav 	verbose(VERB_ALGO, "successfully validated NODATA response.");
961b7579f77SDag-Erling Smørgrav 	chase_reply->security = sec_status_secure;
962b7579f77SDag-Erling Smørgrav }
963b7579f77SDag-Erling Smørgrav 
964b7579f77SDag-Erling Smørgrav /**
965b7579f77SDag-Erling Smørgrav  * Validate a NAMEERROR signed response -- a response that has a NXDOMAIN
966b7579f77SDag-Erling Smørgrav  * Rcode.
967b7579f77SDag-Erling Smørgrav  * This consists of making certain that the authority section NSEC proves
968b7579f77SDag-Erling Smørgrav  * that the qname doesn't exist and the covering wildcard also doesn't exist..
969b7579f77SDag-Erling Smørgrav  *
970b7579f77SDag-Erling Smørgrav  * The answer and authority RRsets must have already been verified as secure.
971b7579f77SDag-Erling Smørgrav  *
972b7579f77SDag-Erling Smørgrav  * @param env: module env for verify.
973b7579f77SDag-Erling Smørgrav  * @param ve: validator env for verify.
974b7579f77SDag-Erling Smørgrav  * @param qchase: query that was made.
975b7579f77SDag-Erling Smørgrav  * @param chase_reply: answer to that query to validate.
976b7579f77SDag-Erling Smørgrav  * @param kkey: the key entry, which is trusted, and which matches
977b7579f77SDag-Erling Smørgrav  * 	the signer of the answer. The key entry isgood().
97817d15b25SDag-Erling Smørgrav  * @param rcode: adjusted RCODE, in case of RCODE/proof mismatch leniency.
979b7579f77SDag-Erling Smørgrav  */
980b7579f77SDag-Erling Smørgrav static void
981b7579f77SDag-Erling Smørgrav validate_nameerror_response(struct module_env* env, struct val_env* ve,
982b7579f77SDag-Erling Smørgrav 	struct query_info* qchase, struct reply_info* chase_reply,
98317d15b25SDag-Erling Smørgrav 	struct key_entry_key* kkey, int* rcode)
984b7579f77SDag-Erling Smørgrav {
985b7579f77SDag-Erling Smørgrav 	int has_valid_nsec = 0;
986b7579f77SDag-Erling Smørgrav 	int has_valid_wnsec = 0;
987b7579f77SDag-Erling Smørgrav 	int nsec3s_seen = 0;
988b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key* s;
989b7579f77SDag-Erling Smørgrav 	size_t i;
99057bddd21SDag-Erling Smørgrav 	uint8_t* ce;
99157bddd21SDag-Erling Smørgrav 	int ce_labs = 0;
99257bddd21SDag-Erling Smørgrav 	int prev_ce_labs = 0;
993b7579f77SDag-Erling Smørgrav 
994b7579f77SDag-Erling Smørgrav 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
995b7579f77SDag-Erling Smørgrav 		chase_reply->ns_numrrsets; i++) {
996b7579f77SDag-Erling Smørgrav 		s = chase_reply->rrsets[i];
997b7579f77SDag-Erling Smørgrav 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
998b7579f77SDag-Erling Smørgrav 			if(val_nsec_proves_name_error(s, qchase->qname))
999b7579f77SDag-Erling Smørgrav 				has_valid_nsec = 1;
100057bddd21SDag-Erling Smørgrav 			ce = nsec_closest_encloser(qchase->qname, s);
100157bddd21SDag-Erling Smørgrav 			ce_labs = dname_count_labels(ce);
100257bddd21SDag-Erling Smørgrav 			/* Use longest closest encloser to prove wildcard. */
100357bddd21SDag-Erling Smørgrav 			if(ce_labs > prev_ce_labs ||
100457bddd21SDag-Erling Smørgrav 			       (ce_labs == prev_ce_labs &&
100557bddd21SDag-Erling Smørgrav 				       has_valid_wnsec == 0)) {
1006b7579f77SDag-Erling Smørgrav 			       if(val_nsec_proves_no_wc(s, qchase->qname,
1007b7579f77SDag-Erling Smørgrav 				       qchase->qname_len))
1008b7579f77SDag-Erling Smørgrav 				       has_valid_wnsec = 1;
100957bddd21SDag-Erling Smørgrav 			       else
101057bddd21SDag-Erling Smørgrav 				       has_valid_wnsec = 0;
101157bddd21SDag-Erling Smørgrav 			}
101257bddd21SDag-Erling Smørgrav 			prev_ce_labs = ce_labs;
1013b7579f77SDag-Erling Smørgrav 			if(val_nsec_proves_insecuredelegation(s, qchase)) {
1014b7579f77SDag-Erling Smørgrav 				verbose(VERB_ALGO, "delegation is insecure");
1015b7579f77SDag-Erling Smørgrav 				chase_reply->security = sec_status_insecure;
1016b7579f77SDag-Erling Smørgrav 				return;
1017b7579f77SDag-Erling Smørgrav 			}
1018b7579f77SDag-Erling Smørgrav 		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3)
1019b7579f77SDag-Erling Smørgrav 			nsec3s_seen = 1;
1020b7579f77SDag-Erling Smørgrav 	}
1021b7579f77SDag-Erling Smørgrav 
1022b7579f77SDag-Erling Smørgrav 	if((!has_valid_nsec || !has_valid_wnsec) && nsec3s_seen) {
1023b7579f77SDag-Erling Smørgrav 		/* use NSEC3 proof, both answer and auth rrsets, in case
1024b7579f77SDag-Erling Smørgrav 		 * NSEC3s end up in the answer (due to qtype=NSEC3 or so) */
1025b7579f77SDag-Erling Smørgrav 		chase_reply->security = nsec3_prove_nameerror(env, ve,
1026b7579f77SDag-Erling Smørgrav 			chase_reply->rrsets, chase_reply->an_numrrsets+
1027b7579f77SDag-Erling Smørgrav 			chase_reply->ns_numrrsets, qchase, kkey);
1028b7579f77SDag-Erling Smørgrav 		if(chase_reply->security != sec_status_secure) {
1029b7579f77SDag-Erling Smørgrav 			verbose(VERB_QUERY, "NameError response failed nsec, "
1030b7579f77SDag-Erling Smørgrav 				"nsec3 proof was %s", sec_status_to_string(
1031b7579f77SDag-Erling Smørgrav 				chase_reply->security));
1032b7579f77SDag-Erling Smørgrav 			return;
1033b7579f77SDag-Erling Smørgrav 		}
1034b7579f77SDag-Erling Smørgrav 		has_valid_nsec = 1;
1035b7579f77SDag-Erling Smørgrav 		has_valid_wnsec = 1;
1036b7579f77SDag-Erling Smørgrav 	}
1037b7579f77SDag-Erling Smørgrav 
1038b7579f77SDag-Erling Smørgrav 	/* If the message fails to prove either condition, it is bogus. */
1039b7579f77SDag-Erling Smørgrav 	if(!has_valid_nsec) {
1040b7579f77SDag-Erling Smørgrav 		verbose(VERB_QUERY, "NameError response has failed to prove: "
1041b7579f77SDag-Erling Smørgrav 		          "qname does not exist");
1042b7579f77SDag-Erling Smørgrav 		chase_reply->security = sec_status_bogus;
104317d15b25SDag-Erling Smørgrav 		/* Be lenient with RCODE in NSEC NameError responses */
104417d15b25SDag-Erling Smørgrav 		validate_nodata_response(env, ve, qchase, chase_reply, kkey);
104517d15b25SDag-Erling Smørgrav 		if (chase_reply->security == sec_status_secure)
104617d15b25SDag-Erling Smørgrav 			*rcode = LDNS_RCODE_NOERROR;
1047b7579f77SDag-Erling Smørgrav 		return;
1048b7579f77SDag-Erling Smørgrav 	}
1049b7579f77SDag-Erling Smørgrav 
1050b7579f77SDag-Erling Smørgrav 	if(!has_valid_wnsec) {
1051b7579f77SDag-Erling Smørgrav 		verbose(VERB_QUERY, "NameError response has failed to prove: "
1052b7579f77SDag-Erling Smørgrav 		          "covering wildcard does not exist");
1053b7579f77SDag-Erling Smørgrav 		chase_reply->security = sec_status_bogus;
105417d15b25SDag-Erling Smørgrav 		/* Be lenient with RCODE in NSEC NameError responses */
105517d15b25SDag-Erling Smørgrav 		validate_nodata_response(env, ve, qchase, chase_reply, kkey);
105617d15b25SDag-Erling Smørgrav 		if (chase_reply->security == sec_status_secure)
105717d15b25SDag-Erling Smørgrav 			*rcode = LDNS_RCODE_NOERROR;
1058b7579f77SDag-Erling Smørgrav 		return;
1059b7579f77SDag-Erling Smørgrav 	}
1060b7579f77SDag-Erling Smørgrav 
1061b7579f77SDag-Erling Smørgrav 	/* Otherwise, we consider the message secure. */
1062b7579f77SDag-Erling Smørgrav 	verbose(VERB_ALGO, "successfully validated NAME ERROR response.");
1063b7579f77SDag-Erling Smørgrav 	chase_reply->security = sec_status_secure;
1064b7579f77SDag-Erling Smørgrav }
1065b7579f77SDag-Erling Smørgrav 
1066b7579f77SDag-Erling Smørgrav /**
1067b7579f77SDag-Erling Smørgrav  * Given a referral response, validate rrsets and take least trusted rrset
1068b7579f77SDag-Erling Smørgrav  * as the current validation status.
1069b7579f77SDag-Erling Smørgrav  *
1070b7579f77SDag-Erling Smørgrav  * Note that by the time this method is called, the process of finding the
1071b7579f77SDag-Erling Smørgrav  * trusted DNSKEY rrset that signs this response must already have been
1072b7579f77SDag-Erling Smørgrav  * completed.
1073b7579f77SDag-Erling Smørgrav  *
1074b7579f77SDag-Erling Smørgrav  * @param chase_reply: answer to validate.
1075b7579f77SDag-Erling Smørgrav  */
1076b7579f77SDag-Erling Smørgrav static void
1077b7579f77SDag-Erling Smørgrav validate_referral_response(struct reply_info* chase_reply)
1078b7579f77SDag-Erling Smørgrav {
1079b7579f77SDag-Erling Smørgrav 	size_t i;
1080b7579f77SDag-Erling Smørgrav 	enum sec_status s;
1081b7579f77SDag-Erling Smørgrav 	/* message security equals lowest rrset security */
1082b7579f77SDag-Erling Smørgrav 	chase_reply->security = sec_status_secure;
1083b7579f77SDag-Erling Smørgrav 	for(i=0; i<chase_reply->rrset_count; i++) {
1084b7579f77SDag-Erling Smørgrav 		s = ((struct packed_rrset_data*)chase_reply->rrsets[i]
1085b7579f77SDag-Erling Smørgrav 			->entry.data)->security;
1086b7579f77SDag-Erling Smørgrav 		if(s < chase_reply->security)
1087b7579f77SDag-Erling Smørgrav 			chase_reply->security = s;
1088b7579f77SDag-Erling Smørgrav 	}
1089b7579f77SDag-Erling Smørgrav 	verbose(VERB_ALGO, "validated part of referral response as %s",
1090b7579f77SDag-Erling Smørgrav 		sec_status_to_string(chase_reply->security));
1091b7579f77SDag-Erling Smørgrav }
1092b7579f77SDag-Erling Smørgrav 
1093b7579f77SDag-Erling Smørgrav /**
1094b7579f77SDag-Erling Smørgrav  * Given an "ANY" response -- a response that contains an answer to a
1095b7579f77SDag-Erling Smørgrav  * qtype==ANY question, with answers. This does no checking that all
1096b7579f77SDag-Erling Smørgrav  * types are present.
1097b7579f77SDag-Erling Smørgrav  *
1098b7579f77SDag-Erling Smørgrav  * NOTE: it may be possible to get parent-side delegation point records
1099b7579f77SDag-Erling Smørgrav  * here, which won't all be signed. Right now, this routine relies on the
1100b7579f77SDag-Erling Smørgrav  * upstream iterative resolver to not return these responses -- instead
1101b7579f77SDag-Erling Smørgrav  * treating them as referrals.
1102b7579f77SDag-Erling Smørgrav  *
1103b7579f77SDag-Erling Smørgrav  * NOTE: RFC 4035 is silent on this issue, so this may change upon
1104b7579f77SDag-Erling Smørgrav  * clarification. Clarification draft -05 says to not check all types are
1105b7579f77SDag-Erling Smørgrav  * present.
1106b7579f77SDag-Erling Smørgrav  *
1107b7579f77SDag-Erling Smørgrav  * Note that by the time this method is called, the process of finding the
1108b7579f77SDag-Erling Smørgrav  * trusted DNSKEY rrset that signs this response must already have been
1109b7579f77SDag-Erling Smørgrav  * completed.
1110b7579f77SDag-Erling Smørgrav  *
1111b7579f77SDag-Erling Smørgrav  * @param env: module env for verify.
1112b7579f77SDag-Erling Smørgrav  * @param ve: validator env for verify.
1113b7579f77SDag-Erling Smørgrav  * @param qchase: query that was made.
1114b7579f77SDag-Erling Smørgrav  * @param chase_reply: answer to that query to validate.
1115b7579f77SDag-Erling Smørgrav  * @param kkey: the key entry, which is trusted, and which matches
1116b7579f77SDag-Erling Smørgrav  * 	the signer of the answer. The key entry isgood().
1117b7579f77SDag-Erling Smørgrav  */
1118b7579f77SDag-Erling Smørgrav static void
1119b7579f77SDag-Erling Smørgrav validate_any_response(struct module_env* env, struct val_env* ve,
1120b7579f77SDag-Erling Smørgrav 	struct query_info* qchase, struct reply_info* chase_reply,
1121b7579f77SDag-Erling Smørgrav 	struct key_entry_key* kkey)
1122b7579f77SDag-Erling Smørgrav {
1123b7579f77SDag-Erling Smørgrav 	/* all answer and auth rrsets already verified */
1124b7579f77SDag-Erling Smørgrav 	/* but check if a wildcard response is given, then check NSEC/NSEC3
1125b7579f77SDag-Erling Smørgrav 	 * for qname denial to see if wildcard is applicable */
1126b7579f77SDag-Erling Smørgrav 	uint8_t* wc = NULL;
112757bddd21SDag-Erling Smørgrav 	size_t wl;
1128b7579f77SDag-Erling Smørgrav 	int wc_NSEC_ok = 0;
1129b7579f77SDag-Erling Smørgrav 	int nsec3s_seen = 0;
1130b7579f77SDag-Erling Smørgrav 	size_t i;
1131b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key* s;
1132b7579f77SDag-Erling Smørgrav 
1133b7579f77SDag-Erling Smørgrav 	if(qchase->qtype != LDNS_RR_TYPE_ANY) {
1134b7579f77SDag-Erling Smørgrav 		log_err("internal error: ANY validation called for non-ANY");
1135b7579f77SDag-Erling Smørgrav 		chase_reply->security = sec_status_bogus;
1136b7579f77SDag-Erling Smørgrav 		return;
1137b7579f77SDag-Erling Smørgrav 	}
1138b7579f77SDag-Erling Smørgrav 
1139b7579f77SDag-Erling Smørgrav 	/* validate the ANSWER section - this will be the answer itself */
1140b7579f77SDag-Erling Smørgrav 	for(i=0; i<chase_reply->an_numrrsets; i++) {
1141b7579f77SDag-Erling Smørgrav 		s = chase_reply->rrsets[i];
1142b7579f77SDag-Erling Smørgrav 
1143b7579f77SDag-Erling Smørgrav 		/* Check to see if the rrset is the result of a wildcard
1144b7579f77SDag-Erling Smørgrav 		 * expansion. If so, an additional check will need to be
1145b7579f77SDag-Erling Smørgrav 		 * made in the authority section. */
114657bddd21SDag-Erling Smørgrav 		if(!val_rrset_wildcard(s, &wc, &wl)) {
1147b7579f77SDag-Erling Smørgrav 			log_nametypeclass(VERB_QUERY, "Positive ANY response"
1148b7579f77SDag-Erling Smørgrav 				" has inconsistent wildcard sigs:",
1149b7579f77SDag-Erling Smørgrav 				s->rk.dname, ntohs(s->rk.type),
1150b7579f77SDag-Erling Smørgrav 				ntohs(s->rk.rrset_class));
1151b7579f77SDag-Erling Smørgrav 			chase_reply->security = sec_status_bogus;
1152b7579f77SDag-Erling Smørgrav 			return;
1153b7579f77SDag-Erling Smørgrav 		}
1154b7579f77SDag-Erling Smørgrav 	}
1155b7579f77SDag-Erling Smørgrav 
1156b7579f77SDag-Erling Smørgrav 	/* if it was a wildcard, check for NSEC/NSEC3s in both answer
1157b7579f77SDag-Erling Smørgrav 	 * and authority sections (NSEC may be moved to the ANSWER section) */
1158b7579f77SDag-Erling Smørgrav 	if(wc != NULL)
1159b7579f77SDag-Erling Smørgrav 	  for(i=0; i<chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
1160b7579f77SDag-Erling Smørgrav 	  	i++) {
1161b7579f77SDag-Erling Smørgrav 		s = chase_reply->rrsets[i];
1162b7579f77SDag-Erling Smørgrav 
1163b7579f77SDag-Erling Smørgrav 		/* If this is a positive wildcard response, and we have a
1164b7579f77SDag-Erling Smørgrav 		 * (just verified) NSEC record, try to use it to 1) prove
1165b7579f77SDag-Erling Smørgrav 		 * that qname doesn't exist and 2) that the correct wildcard
1166b7579f77SDag-Erling Smørgrav 		 * was used. */
1167b7579f77SDag-Erling Smørgrav 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1168b7579f77SDag-Erling Smørgrav 			if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1169b7579f77SDag-Erling Smørgrav 				wc_NSEC_ok = 1;
1170b7579f77SDag-Erling Smørgrav 			}
1171b7579f77SDag-Erling Smørgrav 			/* if not, continue looking for proof */
1172b7579f77SDag-Erling Smørgrav 		}
1173b7579f77SDag-Erling Smørgrav 
1174b7579f77SDag-Erling Smørgrav 		/* Otherwise, if this is a positive wildcard response and
1175b7579f77SDag-Erling Smørgrav 		 * we have NSEC3 records */
1176b7579f77SDag-Erling Smørgrav 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1177b7579f77SDag-Erling Smørgrav 			nsec3s_seen = 1;
1178b7579f77SDag-Erling Smørgrav 		}
1179b7579f77SDag-Erling Smørgrav 	}
1180b7579f77SDag-Erling Smørgrav 
1181b7579f77SDag-Erling Smørgrav 	/* If this was a positive wildcard response that we haven't already
1182b7579f77SDag-Erling Smørgrav 	 * proven, and we have NSEC3 records, try to prove it using the NSEC3
1183b7579f77SDag-Erling Smørgrav 	 * records. */
1184b7579f77SDag-Erling Smørgrav 	if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1185b7579f77SDag-Erling Smørgrav 		/* look both in answer and auth section for NSEC3s */
1186b7579f77SDag-Erling Smørgrav 		enum sec_status sec = nsec3_prove_wildcard(env, ve,
1187b7579f77SDag-Erling Smørgrav 			chase_reply->rrsets,
1188b7579f77SDag-Erling Smørgrav 			chase_reply->an_numrrsets+chase_reply->ns_numrrsets,
1189b7579f77SDag-Erling Smørgrav 			qchase, kkey, wc);
1190b7579f77SDag-Erling Smørgrav 		if(sec == sec_status_insecure) {
1191b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "Positive ANY wildcard response is "
1192b7579f77SDag-Erling Smørgrav 				"insecure");
1193b7579f77SDag-Erling Smørgrav 			chase_reply->security = sec_status_insecure;
1194b7579f77SDag-Erling Smørgrav 			return;
1195b7579f77SDag-Erling Smørgrav 		} else if(sec == sec_status_secure)
1196b7579f77SDag-Erling Smørgrav 			wc_NSEC_ok = 1;
1197b7579f77SDag-Erling Smørgrav 	}
1198b7579f77SDag-Erling Smørgrav 
1199b7579f77SDag-Erling Smørgrav 	/* If after all this, we still haven't proven the positive wildcard
1200b7579f77SDag-Erling Smørgrav 	 * response, fail. */
1201b7579f77SDag-Erling Smørgrav 	if(wc != NULL && !wc_NSEC_ok) {
1202b7579f77SDag-Erling Smørgrav 		verbose(VERB_QUERY, "positive ANY response was wildcard "
1203b7579f77SDag-Erling Smørgrav 			"expansion and did not prove original data "
1204b7579f77SDag-Erling Smørgrav 			"did not exist");
1205b7579f77SDag-Erling Smørgrav 		chase_reply->security = sec_status_bogus;
1206b7579f77SDag-Erling Smørgrav 		return;
1207b7579f77SDag-Erling Smørgrav 	}
1208b7579f77SDag-Erling Smørgrav 
1209b7579f77SDag-Erling Smørgrav 	verbose(VERB_ALGO, "Successfully validated positive ANY response");
1210b7579f77SDag-Erling Smørgrav 	chase_reply->security = sec_status_secure;
1211b7579f77SDag-Erling Smørgrav }
1212b7579f77SDag-Erling Smørgrav 
1213b7579f77SDag-Erling Smørgrav /**
1214b7579f77SDag-Erling Smørgrav  * Validate CNAME response, or DNAME+CNAME.
1215b7579f77SDag-Erling Smørgrav  * This is just like a positive proof, except that this is about a
1216b7579f77SDag-Erling Smørgrav  * DNAME+CNAME. Possible wildcard proof.
1217b7579f77SDag-Erling Smørgrav  * Difference with positive proof is that this routine refuses
1218b7579f77SDag-Erling Smørgrav  * wildcarded DNAMEs.
1219b7579f77SDag-Erling Smørgrav  *
1220b7579f77SDag-Erling Smørgrav  * The answer and authority rrsets must already be verified as secure.
1221b7579f77SDag-Erling Smørgrav  *
1222b7579f77SDag-Erling Smørgrav  * @param env: module env for verify.
1223b7579f77SDag-Erling Smørgrav  * @param ve: validator env for verify.
1224b7579f77SDag-Erling Smørgrav  * @param qchase: query that was made.
1225b7579f77SDag-Erling Smørgrav  * @param chase_reply: answer to that query to validate.
1226b7579f77SDag-Erling Smørgrav  * @param kkey: the key entry, which is trusted, and which matches
1227b7579f77SDag-Erling Smørgrav  * 	the signer of the answer. The key entry isgood().
1228b7579f77SDag-Erling Smørgrav  */
1229b7579f77SDag-Erling Smørgrav static void
1230b7579f77SDag-Erling Smørgrav validate_cname_response(struct module_env* env, struct val_env* ve,
1231b7579f77SDag-Erling Smørgrav 	struct query_info* qchase, struct reply_info* chase_reply,
1232b7579f77SDag-Erling Smørgrav 	struct key_entry_key* kkey)
1233b7579f77SDag-Erling Smørgrav {
1234b7579f77SDag-Erling Smørgrav 	uint8_t* wc = NULL;
123557bddd21SDag-Erling Smørgrav 	size_t wl;
1236b7579f77SDag-Erling Smørgrav 	int wc_NSEC_ok = 0;
1237b7579f77SDag-Erling Smørgrav 	int nsec3s_seen = 0;
1238b7579f77SDag-Erling Smørgrav 	size_t i;
1239b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key* s;
1240b7579f77SDag-Erling Smørgrav 
1241b7579f77SDag-Erling Smørgrav 	/* validate the ANSWER section - this will be the CNAME (+DNAME) */
1242b7579f77SDag-Erling Smørgrav 	for(i=0; i<chase_reply->an_numrrsets; i++) {
1243b7579f77SDag-Erling Smørgrav 		s = chase_reply->rrsets[i];
1244b7579f77SDag-Erling Smørgrav 
1245b7579f77SDag-Erling Smørgrav 		/* Check to see if the rrset is the result of a wildcard
1246b7579f77SDag-Erling Smørgrav 		 * expansion. If so, an additional check will need to be
1247b7579f77SDag-Erling Smørgrav 		 * made in the authority section. */
124857bddd21SDag-Erling Smørgrav 		if(!val_rrset_wildcard(s, &wc, &wl)) {
1249b7579f77SDag-Erling Smørgrav 			log_nametypeclass(VERB_QUERY, "Cname response has "
1250b7579f77SDag-Erling Smørgrav 				"inconsistent wildcard sigs:", s->rk.dname,
1251b7579f77SDag-Erling Smørgrav 				ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1252b7579f77SDag-Erling Smørgrav 			chase_reply->security = sec_status_bogus;
1253b7579f77SDag-Erling Smørgrav 			return;
1254b7579f77SDag-Erling Smørgrav 		}
1255b7579f77SDag-Erling Smørgrav 
1256b7579f77SDag-Erling Smørgrav 		/* Refuse wildcarded DNAMEs rfc 4597.
1257b7579f77SDag-Erling Smørgrav 		 * Do not follow a wildcarded DNAME because
1258b7579f77SDag-Erling Smørgrav 		 * its synthesized CNAME expansion is underdefined */
1259b7579f77SDag-Erling Smørgrav 		if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
1260b7579f77SDag-Erling Smørgrav 			ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME && wc) {
1261b7579f77SDag-Erling Smørgrav 			log_nametypeclass(VERB_QUERY, "cannot validate a "
1262b7579f77SDag-Erling Smørgrav 				"wildcarded DNAME:", s->rk.dname,
1263b7579f77SDag-Erling Smørgrav 				ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1264b7579f77SDag-Erling Smørgrav 			chase_reply->security = sec_status_bogus;
1265b7579f77SDag-Erling Smørgrav 			return;
1266b7579f77SDag-Erling Smørgrav 		}
12678ed2b524SDag-Erling Smørgrav 
12688ed2b524SDag-Erling Smørgrav 		/* If we have found a CNAME, stop looking for one.
12698ed2b524SDag-Erling Smørgrav 		 * The iterator has placed the CNAME chain in correct
12708ed2b524SDag-Erling Smørgrav 		 * order. */
12718ed2b524SDag-Erling Smørgrav 		if (ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
12728ed2b524SDag-Erling Smørgrav 			break;
12738ed2b524SDag-Erling Smørgrav 		}
1274b7579f77SDag-Erling Smørgrav 	}
1275b7579f77SDag-Erling Smørgrav 
1276b7579f77SDag-Erling Smørgrav 	/* AUTHORITY section */
1277b7579f77SDag-Erling Smørgrav 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1278b7579f77SDag-Erling Smørgrav 		chase_reply->ns_numrrsets; i++) {
1279b7579f77SDag-Erling Smørgrav 		s = chase_reply->rrsets[i];
1280b7579f77SDag-Erling Smørgrav 
1281b7579f77SDag-Erling Smørgrav 		/* If this is a positive wildcard response, and we have a
1282b7579f77SDag-Erling Smørgrav 		 * (just verified) NSEC record, try to use it to 1) prove
1283b7579f77SDag-Erling Smørgrav 		 * that qname doesn't exist and 2) that the correct wildcard
1284b7579f77SDag-Erling Smørgrav 		 * was used. */
1285b7579f77SDag-Erling Smørgrav 		if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1286b7579f77SDag-Erling Smørgrav 			if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1287b7579f77SDag-Erling Smørgrav 				wc_NSEC_ok = 1;
1288b7579f77SDag-Erling Smørgrav 			}
1289b7579f77SDag-Erling Smørgrav 			/* if not, continue looking for proof */
1290b7579f77SDag-Erling Smørgrav 		}
1291b7579f77SDag-Erling Smørgrav 
1292b7579f77SDag-Erling Smørgrav 		/* Otherwise, if this is a positive wildcard response and
1293b7579f77SDag-Erling Smørgrav 		 * we have NSEC3 records */
1294b7579f77SDag-Erling Smørgrav 		if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1295b7579f77SDag-Erling Smørgrav 			nsec3s_seen = 1;
1296b7579f77SDag-Erling Smørgrav 		}
1297b7579f77SDag-Erling Smørgrav 	}
1298b7579f77SDag-Erling Smørgrav 
1299b7579f77SDag-Erling Smørgrav 	/* If this was a positive wildcard response that we haven't already
1300b7579f77SDag-Erling Smørgrav 	 * proven, and we have NSEC3 records, try to prove it using the NSEC3
1301b7579f77SDag-Erling Smørgrav 	 * records. */
1302b7579f77SDag-Erling Smørgrav 	if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1303b7579f77SDag-Erling Smørgrav 		enum sec_status sec = nsec3_prove_wildcard(env, ve,
1304b7579f77SDag-Erling Smørgrav 			chase_reply->rrsets+chase_reply->an_numrrsets,
1305b7579f77SDag-Erling Smørgrav 			chase_reply->ns_numrrsets, qchase, kkey, wc);
1306b7579f77SDag-Erling Smørgrav 		if(sec == sec_status_insecure) {
1307b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "wildcard CNAME response is "
1308b7579f77SDag-Erling Smørgrav 				"insecure");
1309b7579f77SDag-Erling Smørgrav 			chase_reply->security = sec_status_insecure;
1310b7579f77SDag-Erling Smørgrav 			return;
1311b7579f77SDag-Erling Smørgrav 		} else if(sec == sec_status_secure)
1312b7579f77SDag-Erling Smørgrav 			wc_NSEC_ok = 1;
1313b7579f77SDag-Erling Smørgrav 	}
1314b7579f77SDag-Erling Smørgrav 
1315b7579f77SDag-Erling Smørgrav 	/* If after all this, we still haven't proven the positive wildcard
1316b7579f77SDag-Erling Smørgrav 	 * response, fail. */
1317b7579f77SDag-Erling Smørgrav 	if(wc != NULL && !wc_NSEC_ok) {
1318b7579f77SDag-Erling Smørgrav 		verbose(VERB_QUERY, "CNAME response was wildcard "
1319b7579f77SDag-Erling Smørgrav 			"expansion and did not prove original data "
1320b7579f77SDag-Erling Smørgrav 			"did not exist");
1321b7579f77SDag-Erling Smørgrav 		chase_reply->security = sec_status_bogus;
1322b7579f77SDag-Erling Smørgrav 		return;
1323b7579f77SDag-Erling Smørgrav 	}
1324b7579f77SDag-Erling Smørgrav 
1325b7579f77SDag-Erling Smørgrav 	verbose(VERB_ALGO, "Successfully validated CNAME response");
1326b7579f77SDag-Erling Smørgrav 	chase_reply->security = sec_status_secure;
1327b7579f77SDag-Erling Smørgrav }
1328b7579f77SDag-Erling Smørgrav 
1329b7579f77SDag-Erling Smørgrav /**
1330b7579f77SDag-Erling Smørgrav  * Validate CNAME NOANSWER response, no more data after a CNAME chain.
1331b7579f77SDag-Erling Smørgrav  * This can be a NODATA or a NAME ERROR case, but not both at the same time.
1332b7579f77SDag-Erling Smørgrav  * We don't know because the rcode has been set to NOERROR by the CNAME.
1333b7579f77SDag-Erling Smørgrav  *
1334b7579f77SDag-Erling Smørgrav  * The answer and authority rrsets must already be verified as secure.
1335b7579f77SDag-Erling Smørgrav  *
1336b7579f77SDag-Erling Smørgrav  * @param env: module env for verify.
1337b7579f77SDag-Erling Smørgrav  * @param ve: validator env for verify.
1338b7579f77SDag-Erling Smørgrav  * @param qchase: query that was made.
1339b7579f77SDag-Erling Smørgrav  * @param chase_reply: answer to that query to validate.
1340b7579f77SDag-Erling Smørgrav  * @param kkey: the key entry, which is trusted, and which matches
1341b7579f77SDag-Erling Smørgrav  * 	the signer of the answer. The key entry isgood().
1342b7579f77SDag-Erling Smørgrav  */
1343b7579f77SDag-Erling Smørgrav static void
1344b7579f77SDag-Erling Smørgrav validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
1345b7579f77SDag-Erling Smørgrav 	struct query_info* qchase, struct reply_info* chase_reply,
1346b7579f77SDag-Erling Smørgrav 	struct key_entry_key* kkey)
1347b7579f77SDag-Erling Smørgrav {
1348b7579f77SDag-Erling Smørgrav 	int nodata_valid_nsec = 0; /* If true, then NODATA has been proven.*/
1349b7579f77SDag-Erling Smørgrav 	uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
1350b7579f77SDag-Erling Smørgrav 				proven closest encloser. */
1351b7579f77SDag-Erling Smørgrav 	uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
13528a384985SDag-Erling Smørgrav 	int nxdomain_valid_nsec = 0; /* if true, nameerror has been proven */
1353b7579f77SDag-Erling Smørgrav 	int nxdomain_valid_wnsec = 0;
1354b7579f77SDag-Erling Smørgrav 	int nsec3s_seen = 0; /* nsec3s seen */
1355b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key* s;
1356b7579f77SDag-Erling Smørgrav 	size_t i;
135757bddd21SDag-Erling Smørgrav 	uint8_t* nsec_ce; /* Used to find the NSEC with the longest ce */
135857bddd21SDag-Erling Smørgrav 	int ce_labs = 0;
135957bddd21SDag-Erling Smørgrav 	int prev_ce_labs = 0;
1360b7579f77SDag-Erling Smørgrav 
1361b7579f77SDag-Erling Smørgrav 	/* the AUTHORITY section */
1362b7579f77SDag-Erling Smørgrav 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1363b7579f77SDag-Erling Smørgrav 		chase_reply->ns_numrrsets; i++) {
1364b7579f77SDag-Erling Smørgrav 		s = chase_reply->rrsets[i];
1365b7579f77SDag-Erling Smørgrav 
1366b7579f77SDag-Erling Smørgrav 		/* If we encounter an NSEC record, try to use it to prove
1367b7579f77SDag-Erling Smørgrav 		 * NODATA. This needs to handle the ENT NODATA case.
1368b7579f77SDag-Erling Smørgrav 		 * Also try to prove NAMEERROR, and absence of a wildcard */
1369b7579f77SDag-Erling Smørgrav 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1370b7579f77SDag-Erling Smørgrav 			if(nsec_proves_nodata(s, qchase, &wc)) {
1371b7579f77SDag-Erling Smørgrav 				nodata_valid_nsec = 1;
1372b7579f77SDag-Erling Smørgrav 				/* set wc encloser if wildcard applicable */
1373b7579f77SDag-Erling Smørgrav 			}
1374b7579f77SDag-Erling Smørgrav 			if(val_nsec_proves_name_error(s, qchase->qname)) {
1375b7579f77SDag-Erling Smørgrav 				ce = nsec_closest_encloser(qchase->qname, s);
1376b7579f77SDag-Erling Smørgrav 				nxdomain_valid_nsec = 1;
1377b7579f77SDag-Erling Smørgrav 			}
137857bddd21SDag-Erling Smørgrav 			nsec_ce = nsec_closest_encloser(qchase->qname, s);
137957bddd21SDag-Erling Smørgrav 			ce_labs = dname_count_labels(nsec_ce);
138057bddd21SDag-Erling Smørgrav 			/* Use longest closest encloser to prove wildcard. */
138157bddd21SDag-Erling Smørgrav 			if(ce_labs > prev_ce_labs ||
138257bddd21SDag-Erling Smørgrav 			       (ce_labs == prev_ce_labs &&
138357bddd21SDag-Erling Smørgrav 				       nxdomain_valid_wnsec == 0)) {
1384b7579f77SDag-Erling Smørgrav 			       if(val_nsec_proves_no_wc(s, qchase->qname,
1385b7579f77SDag-Erling Smørgrav 				       qchase->qname_len))
1386b7579f77SDag-Erling Smørgrav 				       nxdomain_valid_wnsec = 1;
138757bddd21SDag-Erling Smørgrav 			       else
138857bddd21SDag-Erling Smørgrav 				       nxdomain_valid_wnsec = 0;
138957bddd21SDag-Erling Smørgrav 			}
139057bddd21SDag-Erling Smørgrav 			prev_ce_labs = ce_labs;
1391b7579f77SDag-Erling Smørgrav 			if(val_nsec_proves_insecuredelegation(s, qchase)) {
1392b7579f77SDag-Erling Smørgrav 				verbose(VERB_ALGO, "delegation is insecure");
1393b7579f77SDag-Erling Smørgrav 				chase_reply->security = sec_status_insecure;
1394b7579f77SDag-Erling Smørgrav 				return;
1395b7579f77SDag-Erling Smørgrav 			}
1396b7579f77SDag-Erling Smørgrav 		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1397b7579f77SDag-Erling Smørgrav 			nsec3s_seen = 1;
1398b7579f77SDag-Erling Smørgrav 		}
1399b7579f77SDag-Erling Smørgrav 	}
1400b7579f77SDag-Erling Smørgrav 
1401b7579f77SDag-Erling Smørgrav 	/* check to see if we have a wildcard NODATA proof. */
1402b7579f77SDag-Erling Smørgrav 
1403b7579f77SDag-Erling Smørgrav 	/* The wildcard NODATA is 1 NSEC proving that qname does not exists
1404b7579f77SDag-Erling Smørgrav 	 * (and also proving what the closest encloser is), and 1 NSEC
1405b7579f77SDag-Erling Smørgrav 	 * showing the matching wildcard, which must be *.closest_encloser. */
1406b7579f77SDag-Erling Smørgrav 	if(wc && !ce)
1407b7579f77SDag-Erling Smørgrav 		nodata_valid_nsec = 0;
1408b7579f77SDag-Erling Smørgrav 	else if(wc && ce) {
1409b7579f77SDag-Erling Smørgrav 		if(query_dname_compare(wc, ce) != 0) {
1410b7579f77SDag-Erling Smørgrav 			nodata_valid_nsec = 0;
1411b7579f77SDag-Erling Smørgrav 		}
1412b7579f77SDag-Erling Smørgrav 	}
1413b7579f77SDag-Erling Smørgrav 	if(nxdomain_valid_nsec && !nxdomain_valid_wnsec) {
1414b7579f77SDag-Erling Smørgrav 		/* name error is missing wildcard denial proof */
1415b7579f77SDag-Erling Smørgrav 		nxdomain_valid_nsec = 0;
1416b7579f77SDag-Erling Smørgrav 	}
1417b7579f77SDag-Erling Smørgrav 
1418b7579f77SDag-Erling Smørgrav 	if(nodata_valid_nsec && nxdomain_valid_nsec) {
1419b7579f77SDag-Erling Smørgrav 		verbose(VERB_QUERY, "CNAMEchain to noanswer proves that name "
1420b7579f77SDag-Erling Smørgrav 			"exists and not exists, bogus");
1421b7579f77SDag-Erling Smørgrav 		chase_reply->security = sec_status_bogus;
1422b7579f77SDag-Erling Smørgrav 		return;
1423b7579f77SDag-Erling Smørgrav 	}
1424b7579f77SDag-Erling Smørgrav 	if(!nodata_valid_nsec && !nxdomain_valid_nsec && nsec3s_seen) {
1425b7579f77SDag-Erling Smørgrav 		int nodata;
1426b7579f77SDag-Erling Smørgrav 		enum sec_status sec = nsec3_prove_nxornodata(env, ve,
1427b7579f77SDag-Erling Smørgrav 			chase_reply->rrsets+chase_reply->an_numrrsets,
1428b7579f77SDag-Erling Smørgrav 			chase_reply->ns_numrrsets, qchase, kkey, &nodata);
1429b7579f77SDag-Erling Smørgrav 		if(sec == sec_status_insecure) {
1430b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "CNAMEchain to noanswer response "
1431b7579f77SDag-Erling Smørgrav 				"is insecure");
1432b7579f77SDag-Erling Smørgrav 			chase_reply->security = sec_status_insecure;
1433b7579f77SDag-Erling Smørgrav 			return;
1434b7579f77SDag-Erling Smørgrav 		} else if(sec == sec_status_secure) {
1435b7579f77SDag-Erling Smørgrav 			if(nodata)
1436b7579f77SDag-Erling Smørgrav 				nodata_valid_nsec = 1;
1437b7579f77SDag-Erling Smørgrav 			else	nxdomain_valid_nsec = 1;
1438b7579f77SDag-Erling Smørgrav 		}
1439b7579f77SDag-Erling Smørgrav 	}
1440b7579f77SDag-Erling Smørgrav 
1441b7579f77SDag-Erling Smørgrav 	if(!nodata_valid_nsec && !nxdomain_valid_nsec) {
1442b7579f77SDag-Erling Smørgrav 		verbose(VERB_QUERY, "CNAMEchain to noanswer response failed "
1443b7579f77SDag-Erling Smørgrav 			"to prove status with NSEC/NSEC3");
1444b7579f77SDag-Erling Smørgrav 		if(verbosity >= VERB_ALGO)
1445b7579f77SDag-Erling Smørgrav 			log_dns_msg("Failed CNAMEnoanswer", qchase, chase_reply);
1446b7579f77SDag-Erling Smørgrav 		chase_reply->security = sec_status_bogus;
1447b7579f77SDag-Erling Smørgrav 		return;
1448b7579f77SDag-Erling Smørgrav 	}
1449b7579f77SDag-Erling Smørgrav 
1450b7579f77SDag-Erling Smørgrav 	if(nodata_valid_nsec)
1451b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1452b7579f77SDag-Erling Smørgrav 			"NODATA response.");
1453b7579f77SDag-Erling Smørgrav 	else	verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1454b7579f77SDag-Erling Smørgrav 			"NAMEERROR response.");
1455b7579f77SDag-Erling Smørgrav 	chase_reply->security = sec_status_secure;
1456b7579f77SDag-Erling Smørgrav }
1457b7579f77SDag-Erling Smørgrav 
1458b7579f77SDag-Erling Smørgrav /**
1459b7579f77SDag-Erling Smørgrav  * Process init state for validator.
1460b7579f77SDag-Erling Smørgrav  * Process the INIT state. First tier responses start in the INIT state.
1461b7579f77SDag-Erling Smørgrav  * This is where they are vetted for validation suitability, and the initial
1462b7579f77SDag-Erling Smørgrav  * key search is done.
1463b7579f77SDag-Erling Smørgrav  *
1464b7579f77SDag-Erling Smørgrav  * Currently, events the come through this routine will be either promoted
1465b7579f77SDag-Erling Smørgrav  * to FINISHED/CNAME_RESP (no validation needed), FINDKEY (next step to
1466b7579f77SDag-Erling Smørgrav  * validation), or will be (temporarily) retired and a new priming request
1467b7579f77SDag-Erling Smørgrav  * event will be generated.
1468b7579f77SDag-Erling Smørgrav  *
1469b7579f77SDag-Erling Smørgrav  * @param qstate: query state.
1470b7579f77SDag-Erling Smørgrav  * @param vq: validator query state.
1471b7579f77SDag-Erling Smørgrav  * @param ve: validator shared global environment.
1472b7579f77SDag-Erling Smørgrav  * @param id: module id.
1473b7579f77SDag-Erling Smørgrav  * @return true if the event should be processed further on return, false if
1474b7579f77SDag-Erling Smørgrav  *         not.
1475b7579f77SDag-Erling Smørgrav  */
1476b7579f77SDag-Erling Smørgrav static int
1477b7579f77SDag-Erling Smørgrav processInit(struct module_qstate* qstate, struct val_qstate* vq,
1478b7579f77SDag-Erling Smørgrav 	struct val_env* ve, int id)
1479b7579f77SDag-Erling Smørgrav {
1480b7579f77SDag-Erling Smørgrav 	uint8_t* lookup_name;
1481b7579f77SDag-Erling Smørgrav 	size_t lookup_len;
1482b7579f77SDag-Erling Smørgrav 	struct trust_anchor* anchor;
1483b7579f77SDag-Erling Smørgrav 	enum val_classification subtype = val_classify_response(
1484b7579f77SDag-Erling Smørgrav 		qstate->query_flags, &qstate->qinfo, &vq->qchase,
1485b7579f77SDag-Erling Smørgrav 		vq->orig_msg->rep, vq->rrset_skip);
1486b7579f77SDag-Erling Smørgrav 	if(vq->restart_count > VAL_MAX_RESTART_COUNT) {
1487b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "restart count exceeded");
1488b7579f77SDag-Erling Smørgrav 		return val_error(qstate, id);
1489b7579f77SDag-Erling Smørgrav 	}
1490b7579f77SDag-Erling Smørgrav 	verbose(VERB_ALGO, "validator classification %s",
1491b7579f77SDag-Erling Smørgrav 		val_classification_to_string(subtype));
1492b7579f77SDag-Erling Smørgrav 	if(subtype == VAL_CLASS_REFERRAL &&
1493b7579f77SDag-Erling Smørgrav 		vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
1494b7579f77SDag-Erling Smørgrav 		/* referral uses the rrset name as qchase, to find keys for
1495b7579f77SDag-Erling Smørgrav 		 * that rrset */
1496b7579f77SDag-Erling Smørgrav 		vq->qchase.qname = vq->orig_msg->rep->
1497b7579f77SDag-Erling Smørgrav 			rrsets[vq->rrset_skip]->rk.dname;
1498b7579f77SDag-Erling Smørgrav 		vq->qchase.qname_len = vq->orig_msg->rep->
1499b7579f77SDag-Erling Smørgrav 			rrsets[vq->rrset_skip]->rk.dname_len;
1500b7579f77SDag-Erling Smørgrav 		vq->qchase.qtype = ntohs(vq->orig_msg->rep->
1501b7579f77SDag-Erling Smørgrav 			rrsets[vq->rrset_skip]->rk.type);
1502b7579f77SDag-Erling Smørgrav 		vq->qchase.qclass = ntohs(vq->orig_msg->rep->
1503b7579f77SDag-Erling Smørgrav 			rrsets[vq->rrset_skip]->rk.rrset_class);
1504b7579f77SDag-Erling Smørgrav 	}
1505b7579f77SDag-Erling Smørgrav 	lookup_name = vq->qchase.qname;
1506b7579f77SDag-Erling Smørgrav 	lookup_len = vq->qchase.qname_len;
1507b7579f77SDag-Erling Smørgrav 	/* for type DS look at the parent side for keys/trustanchor */
1508b7579f77SDag-Erling Smørgrav 	/* also for NSEC not at apex */
1509b7579f77SDag-Erling Smørgrav 	if(vq->qchase.qtype == LDNS_RR_TYPE_DS ||
1510b7579f77SDag-Erling Smørgrav 		(vq->qchase.qtype == LDNS_RR_TYPE_NSEC &&
1511b7579f77SDag-Erling Smørgrav 		 vq->orig_msg->rep->rrset_count > vq->rrset_skip &&
1512b7579f77SDag-Erling Smørgrav 		 ntohs(vq->orig_msg->rep->rrsets[vq->rrset_skip]->rk.type) ==
1513b7579f77SDag-Erling Smørgrav 		 LDNS_RR_TYPE_NSEC &&
1514b7579f77SDag-Erling Smørgrav 		 !(vq->orig_msg->rep->rrsets[vq->rrset_skip]->
1515b7579f77SDag-Erling Smørgrav 		 rk.flags&PACKED_RRSET_NSEC_AT_APEX))) {
1516b7579f77SDag-Erling Smørgrav 		dname_remove_label(&lookup_name, &lookup_len);
1517b7579f77SDag-Erling Smørgrav 	}
1518b7579f77SDag-Erling Smørgrav 
1519b7579f77SDag-Erling Smørgrav 	val_mark_indeterminate(vq->chase_reply, qstate->env->anchors,
1520b7579f77SDag-Erling Smørgrav 		qstate->env->rrset_cache, qstate->env);
1521b7579f77SDag-Erling Smørgrav 	vq->key_entry = NULL;
1522b7579f77SDag-Erling Smørgrav 	vq->empty_DS_name = NULL;
1523b7579f77SDag-Erling Smørgrav 	vq->ds_rrset = 0;
1524b7579f77SDag-Erling Smørgrav 	anchor = anchors_lookup(qstate->env->anchors,
1525b7579f77SDag-Erling Smørgrav 		lookup_name, lookup_len, vq->qchase.qclass);
1526b7579f77SDag-Erling Smørgrav 
1527b7579f77SDag-Erling Smørgrav 	/* Determine the signer/lookup name */
1528b7579f77SDag-Erling Smørgrav 	val_find_signer(subtype, &vq->qchase, vq->orig_msg->rep,
1529b7579f77SDag-Erling Smørgrav 		vq->rrset_skip, &vq->signer_name, &vq->signer_len);
1530b7579f77SDag-Erling Smørgrav 	if(vq->signer_name != NULL &&
1531b7579f77SDag-Erling Smørgrav 		!dname_subdomain_c(lookup_name, vq->signer_name)) {
1532b7579f77SDag-Erling Smørgrav 		log_nametypeclass(VERB_ALGO, "this signer name is not a parent "
1533b7579f77SDag-Erling Smørgrav 			"of lookupname, omitted", vq->signer_name, 0, 0);
1534b7579f77SDag-Erling Smørgrav 		vq->signer_name = NULL;
1535b7579f77SDag-Erling Smørgrav 	}
1536b7579f77SDag-Erling Smørgrav 	if(vq->signer_name == NULL) {
1537b7579f77SDag-Erling Smørgrav 		log_nametypeclass(VERB_ALGO, "no signer, using", lookup_name,
1538b7579f77SDag-Erling Smørgrav 			0, 0);
1539b7579f77SDag-Erling Smørgrav 	} else {
1540b7579f77SDag-Erling Smørgrav 		lookup_name = vq->signer_name;
1541b7579f77SDag-Erling Smørgrav 		lookup_len = vq->signer_len;
1542b7579f77SDag-Erling Smørgrav 		log_nametypeclass(VERB_ALGO, "signer is", lookup_name, 0, 0);
1543b7579f77SDag-Erling Smørgrav 	}
1544b7579f77SDag-Erling Smørgrav 
1545b7579f77SDag-Erling Smørgrav 	/* for NXDOMAIN it could be signed by a parent of the trust anchor */
1546b7579f77SDag-Erling Smørgrav 	if(subtype == VAL_CLASS_NAMEERROR && vq->signer_name &&
1547b7579f77SDag-Erling Smørgrav 		anchor && dname_strict_subdomain_c(anchor->name, lookup_name)){
1548b7579f77SDag-Erling Smørgrav 		lock_basic_unlock(&anchor->lock);
1549b7579f77SDag-Erling Smørgrav 		anchor = anchors_lookup(qstate->env->anchors,
1550b7579f77SDag-Erling Smørgrav 			lookup_name, lookup_len, vq->qchase.qclass);
1551b7579f77SDag-Erling Smørgrav 		if(!anchor) { /* unsigned parent denies anchor*/
1552b7579f77SDag-Erling Smørgrav 			verbose(VERB_QUERY, "unsigned parent zone denies"
1553b7579f77SDag-Erling Smørgrav 				" trust anchor, indeterminate");
1554b7579f77SDag-Erling Smørgrav 			vq->chase_reply->security = sec_status_indeterminate;
1555b7579f77SDag-Erling Smørgrav 			vq->state = VAL_FINISHED_STATE;
1556b7579f77SDag-Erling Smørgrav 			return 1;
1557b7579f77SDag-Erling Smørgrav 		}
1558b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "trust anchor NXDOMAIN by signed parent");
1559b7579f77SDag-Erling Smørgrav 	} else if(subtype == VAL_CLASS_POSITIVE &&
1560b7579f77SDag-Erling Smørgrav 		qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY &&
1561b7579f77SDag-Erling Smørgrav 		query_dname_compare(lookup_name, qstate->qinfo.qname) == 0) {
1562b7579f77SDag-Erling Smørgrav 		/* is a DNSKEY so lookup a bit higher since we want to
1563b7579f77SDag-Erling Smørgrav 		 * get it from a parent or from trustanchor */
1564b7579f77SDag-Erling Smørgrav 		dname_remove_label(&lookup_name, &lookup_len);
1565b7579f77SDag-Erling Smørgrav 	}
1566b7579f77SDag-Erling Smørgrav 
1567b7579f77SDag-Erling Smørgrav 	if(vq->rrset_skip > 0 || subtype == VAL_CLASS_CNAME ||
1568b7579f77SDag-Erling Smørgrav 		subtype == VAL_CLASS_REFERRAL) {
1569b7579f77SDag-Erling Smørgrav 		/* extract this part of orig_msg into chase_reply for
1570b7579f77SDag-Erling Smørgrav 		 * the eventual VALIDATE stage */
1571b7579f77SDag-Erling Smørgrav 		val_fill_reply(vq->chase_reply, vq->orig_msg->rep,
1572b7579f77SDag-Erling Smørgrav 			vq->rrset_skip, lookup_name, lookup_len,
1573b7579f77SDag-Erling Smørgrav 			vq->signer_name);
1574b7579f77SDag-Erling Smørgrav 		if(verbosity >= VERB_ALGO)
1575b7579f77SDag-Erling Smørgrav 			log_dns_msg("chased extract", &vq->qchase,
1576b7579f77SDag-Erling Smørgrav 				vq->chase_reply);
1577b7579f77SDag-Erling Smørgrav 	}
1578b7579f77SDag-Erling Smørgrav 
1579b7579f77SDag-Erling Smørgrav 	vq->key_entry = key_cache_obtain(ve->kcache, lookup_name, lookup_len,
1580b7579f77SDag-Erling Smørgrav 		vq->qchase.qclass, qstate->region, *qstate->env->now);
1581b7579f77SDag-Erling Smørgrav 
1582b7579f77SDag-Erling Smørgrav 	/* there is no key(from DLV) and no trust anchor */
1583b7579f77SDag-Erling Smørgrav 	if(vq->key_entry == NULL && anchor == NULL) {
1584b7579f77SDag-Erling Smørgrav 		/*response isn't under a trust anchor, so we cannot validate.*/
1585b7579f77SDag-Erling Smørgrav 		vq->chase_reply->security = sec_status_indeterminate;
1586b7579f77SDag-Erling Smørgrav 		/* go to finished state to cache this result */
1587b7579f77SDag-Erling Smørgrav 		vq->state = VAL_FINISHED_STATE;
1588b7579f77SDag-Erling Smørgrav 		return 1;
1589b7579f77SDag-Erling Smørgrav 	}
1590b7579f77SDag-Erling Smørgrav 	/* if not key, or if keyentry is *above* the trustanchor, i.e.
1591b7579f77SDag-Erling Smørgrav 	 * the keyentry is based on another (higher) trustanchor */
1592b7579f77SDag-Erling Smørgrav 	else if(vq->key_entry == NULL || (anchor &&
1593b7579f77SDag-Erling Smørgrav 		dname_strict_subdomain_c(anchor->name, vq->key_entry->name))) {
1594b7579f77SDag-Erling Smørgrav 		/* trust anchor is an 'unsigned' trust anchor */
1595b7579f77SDag-Erling Smørgrav 		if(anchor && anchor->numDS == 0 && anchor->numDNSKEY == 0) {
1596b7579f77SDag-Erling Smørgrav 			vq->chase_reply->security = sec_status_insecure;
1597b7579f77SDag-Erling Smørgrav 			val_mark_insecure(vq->chase_reply, anchor->name,
1598b7579f77SDag-Erling Smørgrav 				qstate->env->rrset_cache, qstate->env);
1599b7579f77SDag-Erling Smørgrav 			lock_basic_unlock(&anchor->lock);
1600b7579f77SDag-Erling Smørgrav 			vq->dlv_checked=1; /* skip DLV check */
1601b7579f77SDag-Erling Smørgrav 			/* go to finished state to cache this result */
1602b7579f77SDag-Erling Smørgrav 			vq->state = VAL_FINISHED_STATE;
1603b7579f77SDag-Erling Smørgrav 			return 1;
1604b7579f77SDag-Erling Smørgrav 		}
1605b7579f77SDag-Erling Smørgrav 		/* fire off a trust anchor priming query. */
1606b7579f77SDag-Erling Smørgrav 		verbose(VERB_DETAIL, "prime trust anchor");
1607b7579f77SDag-Erling Smørgrav 		if(!prime_trust_anchor(qstate, vq, id, anchor)) {
1608b7579f77SDag-Erling Smørgrav 			lock_basic_unlock(&anchor->lock);
1609b7579f77SDag-Erling Smørgrav 			return val_error(qstate, id);
1610b7579f77SDag-Erling Smørgrav 		}
1611b7579f77SDag-Erling Smørgrav 		lock_basic_unlock(&anchor->lock);
1612b7579f77SDag-Erling Smørgrav 		/* and otherwise, don't continue processing this event.
1613b7579f77SDag-Erling Smørgrav 		 * (it will be reactivated when the priming query returns). */
1614b7579f77SDag-Erling Smørgrav 		vq->state = VAL_FINDKEY_STATE;
1615b7579f77SDag-Erling Smørgrav 		return 0;
1616b7579f77SDag-Erling Smørgrav 	}
1617b7579f77SDag-Erling Smørgrav 	if(anchor) {
1618b7579f77SDag-Erling Smørgrav 		lock_basic_unlock(&anchor->lock);
1619b7579f77SDag-Erling Smørgrav 	}
1620b7579f77SDag-Erling Smørgrav 
1621b7579f77SDag-Erling Smørgrav 	if(key_entry_isnull(vq->key_entry)) {
1622b7579f77SDag-Erling Smørgrav 		/* response is under a null key, so we cannot validate
1623b7579f77SDag-Erling Smørgrav 		 * However, we do set the status to INSECURE, since it is
1624b7579f77SDag-Erling Smørgrav 		 * essentially proven insecure. */
1625b7579f77SDag-Erling Smørgrav 		vq->chase_reply->security = sec_status_insecure;
1626b7579f77SDag-Erling Smørgrav 		val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1627b7579f77SDag-Erling Smørgrav 			qstate->env->rrset_cache, qstate->env);
1628b7579f77SDag-Erling Smørgrav 		/* go to finished state to cache this result */
1629b7579f77SDag-Erling Smørgrav 		vq->state = VAL_FINISHED_STATE;
1630b7579f77SDag-Erling Smørgrav 		return 1;
1631b7579f77SDag-Erling Smørgrav 	} else if(key_entry_isbad(vq->key_entry)) {
1632b7579f77SDag-Erling Smørgrav 		/* key is bad, chain is bad, reply is bogus */
1633b7579f77SDag-Erling Smørgrav 		errinf_dname(qstate, "key for validation", vq->key_entry->name);
1634b7579f77SDag-Erling Smørgrav 		errinf(qstate, "is marked as invalid");
1635b7579f77SDag-Erling Smørgrav 		if(key_entry_get_reason(vq->key_entry)) {
1636b7579f77SDag-Erling Smørgrav 			errinf(qstate, "because of a previous");
1637b7579f77SDag-Erling Smørgrav 			errinf(qstate, key_entry_get_reason(vq->key_entry));
1638b7579f77SDag-Erling Smørgrav 		}
1639b7579f77SDag-Erling Smørgrav 		/* no retries, stop bothering the authority until timeout */
1640b7579f77SDag-Erling Smørgrav 		vq->restart_count = VAL_MAX_RESTART_COUNT;
1641b7579f77SDag-Erling Smørgrav 		vq->chase_reply->security = sec_status_bogus;
1642b7579f77SDag-Erling Smørgrav 		vq->state = VAL_FINISHED_STATE;
1643b7579f77SDag-Erling Smørgrav 		return 1;
1644b7579f77SDag-Erling Smørgrav 	}
1645b7579f77SDag-Erling Smørgrav 
1646b7579f77SDag-Erling Smørgrav 	/* otherwise, we have our "closest" cached key -- continue
1647b7579f77SDag-Erling Smørgrav 	 * processing in the next state. */
1648b7579f77SDag-Erling Smørgrav 	vq->state = VAL_FINDKEY_STATE;
1649b7579f77SDag-Erling Smørgrav 	return 1;
1650b7579f77SDag-Erling Smørgrav }
1651b7579f77SDag-Erling Smørgrav 
1652b7579f77SDag-Erling Smørgrav /**
1653b7579f77SDag-Erling Smørgrav  * Process the FINDKEY state. Generally this just calculates the next name
1654b7579f77SDag-Erling Smørgrav  * to query and either issues a DS or a DNSKEY query. It will check to see
1655b7579f77SDag-Erling Smørgrav  * if the correct key has already been reached, in which case it will
1656b7579f77SDag-Erling Smørgrav  * advance the event to the next state.
1657b7579f77SDag-Erling Smørgrav  *
1658b7579f77SDag-Erling Smørgrav  * @param qstate: query state.
1659b7579f77SDag-Erling Smørgrav  * @param vq: validator query state.
1660b7579f77SDag-Erling Smørgrav  * @param id: module id.
1661b7579f77SDag-Erling Smørgrav  * @return true if the event should be processed further on return, false if
1662b7579f77SDag-Erling Smørgrav  *         not.
1663b7579f77SDag-Erling Smørgrav  */
1664b7579f77SDag-Erling Smørgrav static int
1665b7579f77SDag-Erling Smørgrav processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
1666b7579f77SDag-Erling Smørgrav {
1667b7579f77SDag-Erling Smørgrav 	uint8_t* target_key_name, *current_key_name;
1668b7579f77SDag-Erling Smørgrav 	size_t target_key_len;
1669b7579f77SDag-Erling Smørgrav 	int strip_lab;
1670c7f4d7adSDag-Erling Smørgrav 	struct module_qstate* newq = NULL;
1671b7579f77SDag-Erling Smørgrav 
1672b7579f77SDag-Erling Smørgrav 	log_query_info(VERB_ALGO, "validator: FindKey", &vq->qchase);
1673b7579f77SDag-Erling Smørgrav 	/* We know that state.key_entry is not 0 or bad key -- if it were,
1674b7579f77SDag-Erling Smørgrav 	 * then previous processing should have directed this event to
1675b7579f77SDag-Erling Smørgrav 	 * a different state.
1676b7579f77SDag-Erling Smørgrav 	 * It could be an isnull key, which signals that a DLV was just
1677b7579f77SDag-Erling Smørgrav 	 * done and the DNSKEY after the DLV failed with dnssec-retry state
1678b7579f77SDag-Erling Smørgrav 	 * and the DNSKEY has to be performed again. */
1679b7579f77SDag-Erling Smørgrav 	log_assert(vq->key_entry && !key_entry_isbad(vq->key_entry));
1680b7579f77SDag-Erling Smørgrav 	if(key_entry_isnull(vq->key_entry)) {
1681b7579f77SDag-Erling Smørgrav 		if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1682b7579f77SDag-Erling Smørgrav 			vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1683c7f4d7adSDag-Erling Smørgrav 			vq->qchase.qclass, BIT_CD, &newq, 0)) {
1684*4c75e3aaSDag-Erling Smørgrav 			verbose(VERB_ALGO, "error generating DNSKEY request");
1685b7579f77SDag-Erling Smørgrav 			return val_error(qstate, id);
1686b7579f77SDag-Erling Smørgrav 		}
1687b7579f77SDag-Erling Smørgrav 		return 0;
1688b7579f77SDag-Erling Smørgrav 	}
1689b7579f77SDag-Erling Smørgrav 
1690b7579f77SDag-Erling Smørgrav 	target_key_name = vq->signer_name;
1691b7579f77SDag-Erling Smørgrav 	target_key_len = vq->signer_len;
1692b7579f77SDag-Erling Smørgrav 	if(!target_key_name) {
1693b7579f77SDag-Erling Smørgrav 		target_key_name = vq->qchase.qname;
1694b7579f77SDag-Erling Smørgrav 		target_key_len = vq->qchase.qname_len;
1695b7579f77SDag-Erling Smørgrav 	}
1696b7579f77SDag-Erling Smørgrav 
1697b7579f77SDag-Erling Smørgrav 	current_key_name = vq->key_entry->name;
1698b7579f77SDag-Erling Smørgrav 
1699b7579f77SDag-Erling Smørgrav 	/* If our current key entry matches our target, then we are done. */
1700b7579f77SDag-Erling Smørgrav 	if(query_dname_compare(target_key_name, current_key_name) == 0) {
1701b7579f77SDag-Erling Smørgrav 		vq->state = VAL_VALIDATE_STATE;
1702b7579f77SDag-Erling Smørgrav 		return 1;
1703b7579f77SDag-Erling Smørgrav 	}
1704b7579f77SDag-Erling Smørgrav 
1705b7579f77SDag-Erling Smørgrav 	if(vq->empty_DS_name) {
1706b7579f77SDag-Erling Smørgrav 		/* if the last empty nonterminal/emptyDS name we detected is
1707b7579f77SDag-Erling Smørgrav 		 * below the current key, use that name to make progress
1708b7579f77SDag-Erling Smørgrav 		 * along the chain of trust */
1709b7579f77SDag-Erling Smørgrav 		if(query_dname_compare(target_key_name,
1710b7579f77SDag-Erling Smørgrav 			vq->empty_DS_name) == 0) {
1711b7579f77SDag-Erling Smørgrav 			/* do not query for empty_DS_name again */
1712b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "Cannot retrieve DS for signature");
1713b7579f77SDag-Erling Smørgrav 			errinf(qstate, "no signatures");
1714b7579f77SDag-Erling Smørgrav 			errinf_origin(qstate, qstate->reply_origin);
1715b7579f77SDag-Erling Smørgrav 			vq->chase_reply->security = sec_status_bogus;
1716b7579f77SDag-Erling Smørgrav 			vq->state = VAL_FINISHED_STATE;
1717b7579f77SDag-Erling Smørgrav 			return 1;
1718b7579f77SDag-Erling Smørgrav 		}
1719b7579f77SDag-Erling Smørgrav 		current_key_name = vq->empty_DS_name;
1720b7579f77SDag-Erling Smørgrav 	}
1721b7579f77SDag-Erling Smørgrav 
1722b7579f77SDag-Erling Smørgrav 	log_nametypeclass(VERB_ALGO, "current keyname", current_key_name,
1723b7579f77SDag-Erling Smørgrav 		LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1724b7579f77SDag-Erling Smørgrav 	log_nametypeclass(VERB_ALGO, "target keyname", target_key_name,
1725b7579f77SDag-Erling Smørgrav 		LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1726b7579f77SDag-Erling Smørgrav 	/* assert we are walking down the DNS tree */
1727b7579f77SDag-Erling Smørgrav 	if(!dname_subdomain_c(target_key_name, current_key_name)) {
1728b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "bad signer name");
1729b7579f77SDag-Erling Smørgrav 		vq->chase_reply->security = sec_status_bogus;
1730b7579f77SDag-Erling Smørgrav 		vq->state = VAL_FINISHED_STATE;
1731b7579f77SDag-Erling Smørgrav 		return 1;
1732b7579f77SDag-Erling Smørgrav 	}
1733b7579f77SDag-Erling Smørgrav 	/* so this value is >= -1 */
1734b7579f77SDag-Erling Smørgrav 	strip_lab = dname_count_labels(target_key_name) -
1735b7579f77SDag-Erling Smørgrav 		dname_count_labels(current_key_name) - 1;
1736b7579f77SDag-Erling Smørgrav 	log_assert(strip_lab >= -1);
1737b7579f77SDag-Erling Smørgrav 	verbose(VERB_ALGO, "striplab %d", strip_lab);
1738b7579f77SDag-Erling Smørgrav 	if(strip_lab > 0) {
1739b7579f77SDag-Erling Smørgrav 		dname_remove_labels(&target_key_name, &target_key_len,
1740b7579f77SDag-Erling Smørgrav 			strip_lab);
1741b7579f77SDag-Erling Smørgrav 	}
1742b7579f77SDag-Erling Smørgrav 	log_nametypeclass(VERB_ALGO, "next keyname", target_key_name,
1743b7579f77SDag-Erling Smørgrav 		LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1744b7579f77SDag-Erling Smørgrav 
1745b7579f77SDag-Erling Smørgrav 	/* The next step is either to query for the next DS, or to query
1746b7579f77SDag-Erling Smørgrav 	 * for the next DNSKEY. */
1747b7579f77SDag-Erling Smørgrav 	if(vq->ds_rrset)
1748b7579f77SDag-Erling Smørgrav 		log_nametypeclass(VERB_ALGO, "DS RRset", vq->ds_rrset->rk.dname, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN);
1749b7579f77SDag-Erling Smørgrav 	else verbose(VERB_ALGO, "No DS RRset");
1750b7579f77SDag-Erling Smørgrav 
1751b7579f77SDag-Erling Smørgrav 	if(vq->ds_rrset && query_dname_compare(vq->ds_rrset->rk.dname,
1752b7579f77SDag-Erling Smørgrav 		vq->key_entry->name) != 0) {
1753b7579f77SDag-Erling Smørgrav 		if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1754b7579f77SDag-Erling Smørgrav 			vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1755c7f4d7adSDag-Erling Smørgrav 			vq->qchase.qclass, BIT_CD, &newq, 0)) {
1756*4c75e3aaSDag-Erling Smørgrav 			verbose(VERB_ALGO, "error generating DNSKEY request");
1757b7579f77SDag-Erling Smørgrav 			return val_error(qstate, id);
1758b7579f77SDag-Erling Smørgrav 		}
1759b7579f77SDag-Erling Smørgrav 		return 0;
1760b7579f77SDag-Erling Smørgrav 	}
1761b7579f77SDag-Erling Smørgrav 
1762b7579f77SDag-Erling Smørgrav 	if(!vq->ds_rrset || query_dname_compare(vq->ds_rrset->rk.dname,
1763b7579f77SDag-Erling Smørgrav 		target_key_name) != 0) {
1764b7579f77SDag-Erling Smørgrav 		/* check if there is a cache entry : pick up an NSEC if
1765b7579f77SDag-Erling Smørgrav 		 * there is no DS, check if that NSEC has DS-bit unset, and
176605ab2901SDag-Erling Smørgrav 		 * thus can disprove the secure delegation we seek.
1767b7579f77SDag-Erling Smørgrav 		 * We can then use that NSEC even in the absence of a SOA
1768b7579f77SDag-Erling Smørgrav 		 * record that would be required by the iterator to supply
1769b7579f77SDag-Erling Smørgrav 		 * a completely protocol-correct response.
1770b7579f77SDag-Erling Smørgrav 		 * Uses negative cache for NSEC3 lookup of DS responses. */
1771b7579f77SDag-Erling Smørgrav 		/* only if cache not blacklisted, of course */
1772b7579f77SDag-Erling Smørgrav 		struct dns_msg* msg;
1773b7579f77SDag-Erling Smørgrav 		if(!qstate->blacklist && !vq->chain_blacklist &&
1774b7579f77SDag-Erling Smørgrav 			(msg=val_find_DS(qstate->env, target_key_name,
1775b7579f77SDag-Erling Smørgrav 			target_key_len, vq->qchase.qclass, qstate->region,
1776b7579f77SDag-Erling Smørgrav 			vq->key_entry->name)) ) {
1777b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "Process cached DS response");
1778b7579f77SDag-Erling Smørgrav 			process_ds_response(qstate, vq, id, LDNS_RCODE_NOERROR,
1779b7579f77SDag-Erling Smørgrav 				msg, &msg->qinfo, NULL);
1780b7579f77SDag-Erling Smørgrav 			return 1; /* continue processing ds-response results */
1781b7579f77SDag-Erling Smørgrav 		}
1782b7579f77SDag-Erling Smørgrav 		if(!generate_request(qstate, id, target_key_name,
1783b7579f77SDag-Erling Smørgrav 			target_key_len, LDNS_RR_TYPE_DS, vq->qchase.qclass,
1784c7f4d7adSDag-Erling Smørgrav 			BIT_CD, &newq, 0)) {
1785*4c75e3aaSDag-Erling Smørgrav 			verbose(VERB_ALGO, "error generating DS request");
1786b7579f77SDag-Erling Smørgrav 			return val_error(qstate, id);
1787b7579f77SDag-Erling Smørgrav 		}
1788b7579f77SDag-Erling Smørgrav 		return 0;
1789b7579f77SDag-Erling Smørgrav 	}
1790b7579f77SDag-Erling Smørgrav 
1791b7579f77SDag-Erling Smørgrav 	/* Otherwise, it is time to query for the DNSKEY */
1792b7579f77SDag-Erling Smørgrav 	if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1793b7579f77SDag-Erling Smørgrav 		vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1794c7f4d7adSDag-Erling Smørgrav 		vq->qchase.qclass, BIT_CD, &newq, 0)) {
1795*4c75e3aaSDag-Erling Smørgrav 		verbose(VERB_ALGO, "error generating DNSKEY request");
1796b7579f77SDag-Erling Smørgrav 		return val_error(qstate, id);
1797b7579f77SDag-Erling Smørgrav 	}
1798b7579f77SDag-Erling Smørgrav 
1799b7579f77SDag-Erling Smørgrav 	return 0;
1800b7579f77SDag-Erling Smørgrav }
1801b7579f77SDag-Erling Smørgrav 
1802b7579f77SDag-Erling Smørgrav /**
1803b7579f77SDag-Erling Smørgrav  * Process the VALIDATE stage, the init and findkey stages are finished,
1804b7579f77SDag-Erling Smørgrav  * and the right keys are available to validate the response.
1805b7579f77SDag-Erling Smørgrav  * Or, there are no keys available, in order to invalidate the response.
1806b7579f77SDag-Erling Smørgrav  *
1807b7579f77SDag-Erling Smørgrav  * After validation, the status is recorded in the message and rrsets,
1808b7579f77SDag-Erling Smørgrav  * and finished state is started.
1809b7579f77SDag-Erling Smørgrav  *
1810b7579f77SDag-Erling Smørgrav  * @param qstate: query state.
1811b7579f77SDag-Erling Smørgrav  * @param vq: validator query state.
1812b7579f77SDag-Erling Smørgrav  * @param ve: validator shared global environment.
1813b7579f77SDag-Erling Smørgrav  * @param id: module id.
1814b7579f77SDag-Erling Smørgrav  * @return true if the event should be processed further on return, false if
1815b7579f77SDag-Erling Smørgrav  *         not.
1816b7579f77SDag-Erling Smørgrav  */
1817b7579f77SDag-Erling Smørgrav static int
1818b7579f77SDag-Erling Smørgrav processValidate(struct module_qstate* qstate, struct val_qstate* vq,
1819b7579f77SDag-Erling Smørgrav 	struct val_env* ve, int id)
1820b7579f77SDag-Erling Smørgrav {
1821b7579f77SDag-Erling Smørgrav 	enum val_classification subtype;
182217d15b25SDag-Erling Smørgrav 	int rcode;
1823b7579f77SDag-Erling Smørgrav 
1824b7579f77SDag-Erling Smørgrav 	if(!vq->key_entry) {
1825b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "validate: no key entry, failed");
1826b7579f77SDag-Erling Smørgrav 		return val_error(qstate, id);
1827b7579f77SDag-Erling Smørgrav 	}
1828b7579f77SDag-Erling Smørgrav 
1829b7579f77SDag-Erling Smørgrav 	/* This is the default next state. */
1830b7579f77SDag-Erling Smørgrav 	vq->state = VAL_FINISHED_STATE;
1831b7579f77SDag-Erling Smørgrav 
1832b7579f77SDag-Erling Smørgrav 	/* Unsigned responses must be underneath a "null" key entry.*/
1833b7579f77SDag-Erling Smørgrav 	if(key_entry_isnull(vq->key_entry)) {
1834b7579f77SDag-Erling Smørgrav 		verbose(VERB_DETAIL, "Verified that %sresponse is INSECURE",
1835b7579f77SDag-Erling Smørgrav 			vq->signer_name?"":"unsigned ");
1836b7579f77SDag-Erling Smørgrav 		vq->chase_reply->security = sec_status_insecure;
1837b7579f77SDag-Erling Smørgrav 		val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1838b7579f77SDag-Erling Smørgrav 			qstate->env->rrset_cache, qstate->env);
1839b7579f77SDag-Erling Smørgrav 		key_cache_insert(ve->kcache, vq->key_entry, qstate);
1840b7579f77SDag-Erling Smørgrav 		return 1;
1841b7579f77SDag-Erling Smørgrav 	}
1842b7579f77SDag-Erling Smørgrav 
1843b7579f77SDag-Erling Smørgrav 	if(key_entry_isbad(vq->key_entry)) {
1844b7579f77SDag-Erling Smørgrav 		log_nametypeclass(VERB_DETAIL, "Could not establish a chain "
1845b7579f77SDag-Erling Smørgrav 			"of trust to keys for", vq->key_entry->name,
1846b7579f77SDag-Erling Smørgrav 			LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class);
1847b7579f77SDag-Erling Smørgrav 		vq->chase_reply->security = sec_status_bogus;
1848b7579f77SDag-Erling Smørgrav 		errinf(qstate, "while building chain of trust");
1849b7579f77SDag-Erling Smørgrav 		if(vq->restart_count >= VAL_MAX_RESTART_COUNT)
1850b7579f77SDag-Erling Smørgrav 			key_cache_insert(ve->kcache, vq->key_entry, qstate);
1851b7579f77SDag-Erling Smørgrav 		return 1;
1852b7579f77SDag-Erling Smørgrav 	}
1853b7579f77SDag-Erling Smørgrav 
1854b7579f77SDag-Erling Smørgrav 	/* signerName being null is the indicator that this response was
1855b7579f77SDag-Erling Smørgrav 	 * unsigned */
1856b7579f77SDag-Erling Smørgrav 	if(vq->signer_name == NULL) {
1857b7579f77SDag-Erling Smørgrav 		log_query_info(VERB_ALGO, "processValidate: state has no "
1858b7579f77SDag-Erling Smørgrav 			"signer name", &vq->qchase);
1859b7579f77SDag-Erling Smørgrav 		verbose(VERB_DETAIL, "Could not establish validation of "
1860b7579f77SDag-Erling Smørgrav 		          "INSECURE status of unsigned response.");
1861b7579f77SDag-Erling Smørgrav 		errinf(qstate, "no signatures");
1862b7579f77SDag-Erling Smørgrav 		errinf_origin(qstate, qstate->reply_origin);
1863b7579f77SDag-Erling Smørgrav 		vq->chase_reply->security = sec_status_bogus;
1864b7579f77SDag-Erling Smørgrav 		return 1;
1865b7579f77SDag-Erling Smørgrav 	}
1866b7579f77SDag-Erling Smørgrav 	subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
1867b7579f77SDag-Erling Smørgrav 		&vq->qchase, vq->orig_msg->rep, vq->rrset_skip);
18686480faa8SDag-Erling Smørgrav 	if(subtype != VAL_CLASS_REFERRAL)
18696480faa8SDag-Erling Smørgrav 		remove_spurious_authority(vq->chase_reply, vq->orig_msg->rep);
1870b7579f77SDag-Erling Smørgrav 
1871b7579f77SDag-Erling Smørgrav 	/* check signatures in the message;
1872b7579f77SDag-Erling Smørgrav 	 * answer and authority must be valid, additional is only checked. */
1873b7579f77SDag-Erling Smørgrav 	if(!validate_msg_signatures(qstate, qstate->env, ve, &vq->qchase,
1874b7579f77SDag-Erling Smørgrav 		vq->chase_reply, vq->key_entry)) {
1875b7579f77SDag-Erling Smørgrav 		/* workaround bad recursor out there that truncates (even
1876b7579f77SDag-Erling Smørgrav 		 * with EDNS4k) to 512 by removing RRSIG from auth section
1877b7579f77SDag-Erling Smørgrav 		 * for positive replies*/
1878b7579f77SDag-Erling Smørgrav 		if((subtype == VAL_CLASS_POSITIVE || subtype == VAL_CLASS_ANY
1879b7579f77SDag-Erling Smørgrav 			|| subtype == VAL_CLASS_CNAME) &&
1880b7579f77SDag-Erling Smørgrav 			detect_wrongly_truncated(vq->orig_msg->rep)) {
1881b7579f77SDag-Erling Smørgrav 			/* truncate the message some more */
1882b7579f77SDag-Erling Smørgrav 			vq->orig_msg->rep->ns_numrrsets = 0;
1883b7579f77SDag-Erling Smørgrav 			vq->orig_msg->rep->ar_numrrsets = 0;
1884b7579f77SDag-Erling Smørgrav 			vq->orig_msg->rep->rrset_count =
1885b7579f77SDag-Erling Smørgrav 				vq->orig_msg->rep->an_numrrsets;
1886b7579f77SDag-Erling Smørgrav 			vq->chase_reply->ns_numrrsets = 0;
1887b7579f77SDag-Erling Smørgrav 			vq->chase_reply->ar_numrrsets = 0;
1888b7579f77SDag-Erling Smørgrav 			vq->chase_reply->rrset_count =
1889b7579f77SDag-Erling Smørgrav 				vq->chase_reply->an_numrrsets;
1890b7579f77SDag-Erling Smørgrav 			qstate->errinf = NULL;
1891b7579f77SDag-Erling Smørgrav 		}
1892b7579f77SDag-Erling Smørgrav 		else {
1893b7579f77SDag-Erling Smørgrav 			verbose(VERB_DETAIL, "Validate: message contains "
1894b7579f77SDag-Erling Smørgrav 				"bad rrsets");
1895b7579f77SDag-Erling Smørgrav 			return 1;
1896b7579f77SDag-Erling Smørgrav 		}
1897b7579f77SDag-Erling Smørgrav 	}
1898b7579f77SDag-Erling Smørgrav 
1899b7579f77SDag-Erling Smørgrav 	switch(subtype) {
1900b7579f77SDag-Erling Smørgrav 		case VAL_CLASS_POSITIVE:
1901b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "Validating a positive response");
1902b7579f77SDag-Erling Smørgrav 			validate_positive_response(qstate->env, ve,
1903b7579f77SDag-Erling Smørgrav 				&vq->qchase, vq->chase_reply, vq->key_entry);
1904b7579f77SDag-Erling Smørgrav 			verbose(VERB_DETAIL, "validate(positive): %s",
1905b7579f77SDag-Erling Smørgrav 			  	sec_status_to_string(
1906b7579f77SDag-Erling Smørgrav 				vq->chase_reply->security));
1907b7579f77SDag-Erling Smørgrav 			break;
1908b7579f77SDag-Erling Smørgrav 
1909b7579f77SDag-Erling Smørgrav 		case VAL_CLASS_NODATA:
1910b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "Validating a nodata response");
1911b7579f77SDag-Erling Smørgrav 			validate_nodata_response(qstate->env, ve,
1912b7579f77SDag-Erling Smørgrav 				&vq->qchase, vq->chase_reply, vq->key_entry);
1913b7579f77SDag-Erling Smørgrav 			verbose(VERB_DETAIL, "validate(nodata): %s",
1914b7579f77SDag-Erling Smørgrav 			  	sec_status_to_string(
1915b7579f77SDag-Erling Smørgrav 				vq->chase_reply->security));
1916b7579f77SDag-Erling Smørgrav 			break;
1917b7579f77SDag-Erling Smørgrav 
1918b7579f77SDag-Erling Smørgrav 		case VAL_CLASS_NAMEERROR:
191917d15b25SDag-Erling Smørgrav 			rcode = (int)FLAGS_GET_RCODE(vq->orig_msg->rep->flags);
1920b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "Validating a nxdomain response");
1921b7579f77SDag-Erling Smørgrav 			validate_nameerror_response(qstate->env, ve,
192217d15b25SDag-Erling Smørgrav 				&vq->qchase, vq->chase_reply, vq->key_entry, &rcode);
1923b7579f77SDag-Erling Smørgrav 			verbose(VERB_DETAIL, "validate(nxdomain): %s",
1924b7579f77SDag-Erling Smørgrav 			  	sec_status_to_string(
1925b7579f77SDag-Erling Smørgrav 				vq->chase_reply->security));
192617d15b25SDag-Erling Smørgrav 			FLAGS_SET_RCODE(vq->orig_msg->rep->flags, rcode);
192717d15b25SDag-Erling Smørgrav 			FLAGS_SET_RCODE(vq->chase_reply->flags, rcode);
1928b7579f77SDag-Erling Smørgrav 			break;
1929b7579f77SDag-Erling Smørgrav 
1930b7579f77SDag-Erling Smørgrav 		case VAL_CLASS_CNAME:
1931b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "Validating a cname response");
1932b7579f77SDag-Erling Smørgrav 			validate_cname_response(qstate->env, ve,
1933b7579f77SDag-Erling Smørgrav 				&vq->qchase, vq->chase_reply, vq->key_entry);
1934b7579f77SDag-Erling Smørgrav 			verbose(VERB_DETAIL, "validate(cname): %s",
1935b7579f77SDag-Erling Smørgrav 			  	sec_status_to_string(
1936b7579f77SDag-Erling Smørgrav 				vq->chase_reply->security));
1937b7579f77SDag-Erling Smørgrav 			break;
1938b7579f77SDag-Erling Smørgrav 
1939b7579f77SDag-Erling Smørgrav 		case VAL_CLASS_CNAMENOANSWER:
1940b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "Validating a cname noanswer "
1941b7579f77SDag-Erling Smørgrav 				"response");
1942b7579f77SDag-Erling Smørgrav 			validate_cname_noanswer_response(qstate->env, ve,
1943b7579f77SDag-Erling Smørgrav 				&vq->qchase, vq->chase_reply, vq->key_entry);
1944b7579f77SDag-Erling Smørgrav 			verbose(VERB_DETAIL, "validate(cname_noanswer): %s",
1945b7579f77SDag-Erling Smørgrav 			  	sec_status_to_string(
1946b7579f77SDag-Erling Smørgrav 				vq->chase_reply->security));
1947b7579f77SDag-Erling Smørgrav 			break;
1948b7579f77SDag-Erling Smørgrav 
1949b7579f77SDag-Erling Smørgrav 		case VAL_CLASS_REFERRAL:
1950b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "Validating a referral response");
1951b7579f77SDag-Erling Smørgrav 			validate_referral_response(vq->chase_reply);
1952b7579f77SDag-Erling Smørgrav 			verbose(VERB_DETAIL, "validate(referral): %s",
1953b7579f77SDag-Erling Smørgrav 			  	sec_status_to_string(
1954b7579f77SDag-Erling Smørgrav 				vq->chase_reply->security));
1955b7579f77SDag-Erling Smørgrav 			break;
1956b7579f77SDag-Erling Smørgrav 
1957b7579f77SDag-Erling Smørgrav 		case VAL_CLASS_ANY:
1958b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "Validating a positive ANY "
1959b7579f77SDag-Erling Smørgrav 				"response");
1960b7579f77SDag-Erling Smørgrav 			validate_any_response(qstate->env, ve, &vq->qchase,
1961b7579f77SDag-Erling Smørgrav 				vq->chase_reply, vq->key_entry);
1962b7579f77SDag-Erling Smørgrav 			verbose(VERB_DETAIL, "validate(positive_any): %s",
1963b7579f77SDag-Erling Smørgrav 			  	sec_status_to_string(
1964b7579f77SDag-Erling Smørgrav 				vq->chase_reply->security));
1965b7579f77SDag-Erling Smørgrav 			break;
1966b7579f77SDag-Erling Smørgrav 
1967b7579f77SDag-Erling Smørgrav 		default:
1968b7579f77SDag-Erling Smørgrav 			log_err("validate: unhandled response subtype: %d",
1969b7579f77SDag-Erling Smørgrav 				subtype);
1970b7579f77SDag-Erling Smørgrav 	}
1971b7579f77SDag-Erling Smørgrav 	if(vq->chase_reply->security == sec_status_bogus) {
1972b7579f77SDag-Erling Smørgrav 		if(subtype == VAL_CLASS_POSITIVE)
1973b7579f77SDag-Erling Smørgrav 			errinf(qstate, "wildcard");
1974b7579f77SDag-Erling Smørgrav 		else errinf(qstate, val_classification_to_string(subtype));
1975b7579f77SDag-Erling Smørgrav 		errinf(qstate, "proof failed");
1976b7579f77SDag-Erling Smørgrav 		errinf_origin(qstate, qstate->reply_origin);
1977b7579f77SDag-Erling Smørgrav 	}
1978b7579f77SDag-Erling Smørgrav 
1979b7579f77SDag-Erling Smørgrav 	return 1;
1980b7579f77SDag-Erling Smørgrav }
1981b7579f77SDag-Erling Smørgrav 
1982b7579f77SDag-Erling Smørgrav /**
1983b7579f77SDag-Erling Smørgrav  * Init DLV check.
198409a3aaf3SDag-Erling Smørgrav  * DLV is going to be decommissioned, but the code is still here for some time.
198509a3aaf3SDag-Erling Smørgrav  *
1986b7579f77SDag-Erling Smørgrav  * Called when a query is determined by other trust anchors to be insecure
1987b7579f77SDag-Erling Smørgrav  * (or indeterminate).  Then we look if there is a key in the DLV.
1988b7579f77SDag-Erling Smørgrav  * Performs aggressive negative cache check to see if there is no key.
1989b7579f77SDag-Erling Smørgrav  * Otherwise, spawns a DLV query, and changes to the DLV wait state.
1990b7579f77SDag-Erling Smørgrav  *
1991b7579f77SDag-Erling Smørgrav  * @param qstate: query state.
1992b7579f77SDag-Erling Smørgrav  * @param vq: validator query state.
1993b7579f77SDag-Erling Smørgrav  * @param ve: validator shared global environment.
1994b7579f77SDag-Erling Smørgrav  * @param id: module id.
1995b7579f77SDag-Erling Smørgrav  * @return  true if there is no DLV.
1996b7579f77SDag-Erling Smørgrav  * 	false: processing is finished for the validator operate().
1997b7579f77SDag-Erling Smørgrav  * 	This function may exit in three ways:
199805ab2901SDag-Erling Smørgrav  *         o	no DLV (aggressive cache), so insecure. (true)
1999b7579f77SDag-Erling Smørgrav  *         o	error - stop processing (false)
2000b7579f77SDag-Erling Smørgrav  *         o	DLV lookup was started, stop processing (false)
2001b7579f77SDag-Erling Smørgrav  */
2002b7579f77SDag-Erling Smørgrav static int
2003b7579f77SDag-Erling Smørgrav val_dlv_init(struct module_qstate* qstate, struct val_qstate* vq,
2004b7579f77SDag-Erling Smørgrav 	struct val_env* ve, int id)
2005b7579f77SDag-Erling Smørgrav {
2006b7579f77SDag-Erling Smørgrav 	uint8_t* nm;
2007b7579f77SDag-Erling Smørgrav 	size_t nm_len;
2008c7f4d7adSDag-Erling Smørgrav 	struct module_qstate* newq = NULL;
2009b7579f77SDag-Erling Smørgrav 	/* there must be a DLV configured */
2010b7579f77SDag-Erling Smørgrav 	log_assert(qstate->env->anchors->dlv_anchor);
2011b7579f77SDag-Erling Smørgrav 	/* this bool is true to avoid looping in the DLV checks */
2012b7579f77SDag-Erling Smørgrav 	log_assert(vq->dlv_checked);
2013b7579f77SDag-Erling Smørgrav 
2014b7579f77SDag-Erling Smørgrav 	/* init the DLV lookup variables */
2015b7579f77SDag-Erling Smørgrav 	vq->dlv_lookup_name = NULL;
2016b7579f77SDag-Erling Smørgrav 	vq->dlv_lookup_name_len = 0;
2017b7579f77SDag-Erling Smørgrav 	vq->dlv_insecure_at = NULL;
2018b7579f77SDag-Erling Smørgrav 	vq->dlv_insecure_at_len = 0;
2019b7579f77SDag-Erling Smørgrav 
2020b7579f77SDag-Erling Smørgrav 	/* Determine the name for which we want to lookup DLV.
2021b7579f77SDag-Erling Smørgrav 	 * This name is for the current message, or
2022b7579f77SDag-Erling Smørgrav 	 * for the current RRset for CNAME, referral subtypes.
2023b7579f77SDag-Erling Smørgrav 	 * If there is a signer, use that, otherwise the domain name */
2024b7579f77SDag-Erling Smørgrav 	if(vq->signer_name) {
2025b7579f77SDag-Erling Smørgrav 		nm = vq->signer_name;
2026b7579f77SDag-Erling Smørgrav 		nm_len = vq->signer_len;
2027b7579f77SDag-Erling Smørgrav 	} else {
2028b7579f77SDag-Erling Smørgrav 		/* use qchase */
2029b7579f77SDag-Erling Smørgrav 		nm = vq->qchase.qname;
2030b7579f77SDag-Erling Smørgrav 		nm_len = vq->qchase.qname_len;
2031b7579f77SDag-Erling Smørgrav 		if(vq->qchase.qtype == LDNS_RR_TYPE_DS)
2032b7579f77SDag-Erling Smørgrav 			dname_remove_label(&nm, &nm_len);
2033b7579f77SDag-Erling Smørgrav 	}
2034b7579f77SDag-Erling Smørgrav 	log_nametypeclass(VERB_ALGO, "DLV init look", nm, LDNS_RR_TYPE_DS,
2035b7579f77SDag-Erling Smørgrav 		vq->qchase.qclass);
2036b7579f77SDag-Erling Smørgrav 	log_assert(nm && nm_len);
2037b7579f77SDag-Erling Smørgrav 	/* sanity check: no DLV lookups below the DLV anchor itself.
2038b7579f77SDag-Erling Smørgrav 	 * Like, an securely insecure delegation there makes no sense. */
2039b7579f77SDag-Erling Smørgrav 	if(dname_subdomain_c(nm, qstate->env->anchors->dlv_anchor->name)) {
2040b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "DLV lookup within DLV repository denied");
2041b7579f77SDag-Erling Smørgrav 		return 1;
2042b7579f77SDag-Erling Smørgrav 	}
2043b7579f77SDag-Erling Smørgrav 	/* concat name (minus root label) + dlv name */
2044b7579f77SDag-Erling Smørgrav 	vq->dlv_lookup_name_len = nm_len - 1 +
2045b7579f77SDag-Erling Smørgrav 		qstate->env->anchors->dlv_anchor->namelen;
2046b7579f77SDag-Erling Smørgrav 	vq->dlv_lookup_name = regional_alloc(qstate->region,
2047b7579f77SDag-Erling Smørgrav 		vq->dlv_lookup_name_len);
2048b7579f77SDag-Erling Smørgrav 	if(!vq->dlv_lookup_name) {
2049b7579f77SDag-Erling Smørgrav 		log_err("Out of memory preparing DLV lookup");
2050b7579f77SDag-Erling Smørgrav 		return val_error(qstate, id);
2051b7579f77SDag-Erling Smørgrav 	}
2052b7579f77SDag-Erling Smørgrav 	memmove(vq->dlv_lookup_name, nm, nm_len-1);
2053b7579f77SDag-Erling Smørgrav 	memmove(vq->dlv_lookup_name+nm_len-1,
2054b7579f77SDag-Erling Smørgrav 		qstate->env->anchors->dlv_anchor->name,
2055b7579f77SDag-Erling Smørgrav 		qstate->env->anchors->dlv_anchor->namelen);
2056b7579f77SDag-Erling Smørgrav 	log_nametypeclass(VERB_ALGO, "DLV name", vq->dlv_lookup_name,
2057b7579f77SDag-Erling Smørgrav 		LDNS_RR_TYPE_DLV, vq->qchase.qclass);
2058b7579f77SDag-Erling Smørgrav 
2059b7579f77SDag-Erling Smørgrav 	/* determine where the insecure point was determined, the DLV must
2060b7579f77SDag-Erling Smørgrav 	 * be equal or below that to continue building the trust chain
2061b7579f77SDag-Erling Smørgrav 	 * down. May be NULL if no trust chain was built yet */
2062b7579f77SDag-Erling Smørgrav 	nm = NULL;
2063b7579f77SDag-Erling Smørgrav 	if(vq->key_entry && key_entry_isnull(vq->key_entry)) {
2064b7579f77SDag-Erling Smørgrav 		nm = vq->key_entry->name;
2065b7579f77SDag-Erling Smørgrav 		nm_len = vq->key_entry->namelen;
2066b7579f77SDag-Erling Smørgrav 	}
2067b7579f77SDag-Erling Smørgrav 	if(nm) {
2068b7579f77SDag-Erling Smørgrav 		vq->dlv_insecure_at_len = nm_len - 1 +
2069b7579f77SDag-Erling Smørgrav 			qstate->env->anchors->dlv_anchor->namelen;
2070b7579f77SDag-Erling Smørgrav 		vq->dlv_insecure_at = regional_alloc(qstate->region,
2071b7579f77SDag-Erling Smørgrav 			vq->dlv_insecure_at_len);
2072b7579f77SDag-Erling Smørgrav 		if(!vq->dlv_insecure_at) {
2073b7579f77SDag-Erling Smørgrav 			log_err("Out of memory preparing DLV lookup");
2074b7579f77SDag-Erling Smørgrav 			return val_error(qstate, id);
2075b7579f77SDag-Erling Smørgrav 		}
2076b7579f77SDag-Erling Smørgrav 		memmove(vq->dlv_insecure_at, nm, nm_len-1);
2077b7579f77SDag-Erling Smørgrav 		memmove(vq->dlv_insecure_at+nm_len-1,
2078b7579f77SDag-Erling Smørgrav 			qstate->env->anchors->dlv_anchor->name,
2079b7579f77SDag-Erling Smørgrav 			qstate->env->anchors->dlv_anchor->namelen);
2080b7579f77SDag-Erling Smørgrav 		log_nametypeclass(VERB_ALGO, "insecure_at",
2081b7579f77SDag-Erling Smørgrav 			vq->dlv_insecure_at, 0, vq->qchase.qclass);
2082b7579f77SDag-Erling Smørgrav 	}
2083b7579f77SDag-Erling Smørgrav 
2084b7579f77SDag-Erling Smørgrav 	/* If we can find the name in the aggressive negative cache,
2085b7579f77SDag-Erling Smørgrav 	 * give up; insecure is the answer */
2086b7579f77SDag-Erling Smørgrav 	while(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
2087b7579f77SDag-Erling Smørgrav 		vq->dlv_lookup_name_len, vq->qchase.qclass,
2088b7579f77SDag-Erling Smørgrav 		qstate->env->rrset_cache, *qstate->env->now)) {
2089b7579f77SDag-Erling Smørgrav 		/* go up */
2090b7579f77SDag-Erling Smørgrav 		dname_remove_label(&vq->dlv_lookup_name,
2091b7579f77SDag-Erling Smørgrav 			&vq->dlv_lookup_name_len);
2092b7579f77SDag-Erling Smørgrav 		/* too high? */
2093b7579f77SDag-Erling Smørgrav 		if(!dname_subdomain_c(vq->dlv_lookup_name,
2094b7579f77SDag-Erling Smørgrav 			qstate->env->anchors->dlv_anchor->name)) {
2095b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "ask above dlv repo");
2096b7579f77SDag-Erling Smørgrav 			return 1; /* Above the repo is insecure */
2097b7579f77SDag-Erling Smørgrav 		}
2098b7579f77SDag-Erling Smørgrav 		/* above chain of trust? */
2099b7579f77SDag-Erling Smørgrav 		if(vq->dlv_insecure_at && !dname_subdomain_c(
2100b7579f77SDag-Erling Smørgrav 			vq->dlv_lookup_name, vq->dlv_insecure_at)) {
2101b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "ask above insecure endpoint");
2102b7579f77SDag-Erling Smørgrav 			return 1;
2103b7579f77SDag-Erling Smørgrav 		}
2104b7579f77SDag-Erling Smørgrav 	}
2105b7579f77SDag-Erling Smørgrav 
2106b7579f77SDag-Erling Smørgrav 	/* perform a lookup for the DLV; with validation */
2107b7579f77SDag-Erling Smørgrav 	vq->state = VAL_DLVLOOKUP_STATE;
2108b7579f77SDag-Erling Smørgrav 	if(!generate_request(qstate, id, vq->dlv_lookup_name,
2109b7579f77SDag-Erling Smørgrav 		vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV,
2110c7f4d7adSDag-Erling Smørgrav 		vq->qchase.qclass, 0, &newq, 0)) {
2111b7579f77SDag-Erling Smørgrav 		return val_error(qstate, id);
2112b7579f77SDag-Erling Smørgrav 	}
2113b7579f77SDag-Erling Smørgrav 
2114b7579f77SDag-Erling Smørgrav 	/* Find the closest encloser DLV from the repository.
2115b7579f77SDag-Erling Smørgrav 	 * then that is used to build another chain of trust
2116b7579f77SDag-Erling Smørgrav 	 * This may first require a query 'too low' that has NSECs in
2117b7579f77SDag-Erling Smørgrav 	 * the answer, from which we determine the closest encloser DLV.
2118b7579f77SDag-Erling Smørgrav 	 * When determine the closest encloser, skip empty nonterminals,
2119b7579f77SDag-Erling Smørgrav 	 * since we want a nonempty node in the DLV repository. */
2120b7579f77SDag-Erling Smørgrav 
2121b7579f77SDag-Erling Smørgrav 	return 0;
2122b7579f77SDag-Erling Smørgrav }
2123b7579f77SDag-Erling Smørgrav 
2124b7579f77SDag-Erling Smørgrav /**
2125b7579f77SDag-Erling Smørgrav  * The Finished state. The validation status (good or bad) has been determined.
2126b7579f77SDag-Erling Smørgrav  *
2127b7579f77SDag-Erling Smørgrav  * @param qstate: query state.
2128b7579f77SDag-Erling Smørgrav  * @param vq: validator query state.
2129b7579f77SDag-Erling Smørgrav  * @param ve: validator shared global environment.
2130b7579f77SDag-Erling Smørgrav  * @param id: module id.
2131b7579f77SDag-Erling Smørgrav  * @return true if the event should be processed further on return, false if
2132b7579f77SDag-Erling Smørgrav  *         not.
2133b7579f77SDag-Erling Smørgrav  */
2134b7579f77SDag-Erling Smørgrav static int
2135b7579f77SDag-Erling Smørgrav processFinished(struct module_qstate* qstate, struct val_qstate* vq,
2136b7579f77SDag-Erling Smørgrav 	struct val_env* ve, int id)
2137b7579f77SDag-Erling Smørgrav {
2138b7579f77SDag-Erling Smørgrav 	enum val_classification subtype = val_classify_response(
2139b7579f77SDag-Erling Smørgrav 		qstate->query_flags, &qstate->qinfo, &vq->qchase,
2140b7579f77SDag-Erling Smørgrav 		vq->orig_msg->rep, vq->rrset_skip);
2141b7579f77SDag-Erling Smørgrav 
2142b7579f77SDag-Erling Smørgrav 	/* if the result is insecure or indeterminate and we have not
2143b7579f77SDag-Erling Smørgrav 	 * checked the DLV yet, check the DLV */
2144b7579f77SDag-Erling Smørgrav 	if((vq->chase_reply->security == sec_status_insecure ||
2145b7579f77SDag-Erling Smørgrav 		vq->chase_reply->security == sec_status_indeterminate) &&
2146b7579f77SDag-Erling Smørgrav 		qstate->env->anchors->dlv_anchor && !vq->dlv_checked) {
2147b7579f77SDag-Erling Smørgrav 		vq->dlv_checked = 1;
2148b7579f77SDag-Erling Smørgrav 		if(!val_dlv_init(qstate, vq, ve, id))
2149b7579f77SDag-Erling Smørgrav 			return 0;
2150b7579f77SDag-Erling Smørgrav 	}
2151b7579f77SDag-Erling Smørgrav 
2152b7579f77SDag-Erling Smørgrav 	/* store overall validation result in orig_msg */
2153b7579f77SDag-Erling Smørgrav 	if(vq->rrset_skip == 0)
2154b7579f77SDag-Erling Smørgrav 		vq->orig_msg->rep->security = vq->chase_reply->security;
21558ed2b524SDag-Erling Smørgrav 	else if(subtype != VAL_CLASS_REFERRAL ||
21568ed2b524SDag-Erling Smørgrav 		vq->rrset_skip < vq->orig_msg->rep->an_numrrsets +
2157b7579f77SDag-Erling Smørgrav 		vq->orig_msg->rep->ns_numrrsets) {
2158b7579f77SDag-Erling Smørgrav 		/* ignore sec status of additional section if a referral
2159b7579f77SDag-Erling Smørgrav 		 * type message skips there and
2160b7579f77SDag-Erling Smørgrav 		 * use the lowest security status as end result. */
2161b7579f77SDag-Erling Smørgrav 		if(vq->chase_reply->security < vq->orig_msg->rep->security)
2162b7579f77SDag-Erling Smørgrav 			vq->orig_msg->rep->security =
2163b7579f77SDag-Erling Smørgrav 				vq->chase_reply->security;
2164b7579f77SDag-Erling Smørgrav 	}
2165b7579f77SDag-Erling Smørgrav 
2166b7579f77SDag-Erling Smørgrav 	if(subtype == VAL_CLASS_REFERRAL) {
2167b7579f77SDag-Erling Smørgrav 		/* for a referral, move to next unchecked rrset and check it*/
2168b7579f77SDag-Erling Smørgrav 		vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep,
2169b7579f77SDag-Erling Smørgrav 			vq->rrset_skip);
2170b7579f77SDag-Erling Smørgrav 		if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
2171b7579f77SDag-Erling Smørgrav 			/* and restart for this rrset */
2172b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "validator: go to next rrset");
2173b7579f77SDag-Erling Smørgrav 			vq->chase_reply->security = sec_status_unchecked;
2174b7579f77SDag-Erling Smørgrav 			vq->dlv_checked = 0; /* can do DLV for this RR */
2175b7579f77SDag-Erling Smørgrav 			vq->state = VAL_INIT_STATE;
2176b7579f77SDag-Erling Smørgrav 			return 1;
2177b7579f77SDag-Erling Smørgrav 		}
2178b7579f77SDag-Erling Smørgrav 		/* referral chase is done */
2179b7579f77SDag-Erling Smørgrav 	}
2180b7579f77SDag-Erling Smørgrav 	if(vq->chase_reply->security != sec_status_bogus &&
2181b7579f77SDag-Erling Smørgrav 		subtype == VAL_CLASS_CNAME) {
2182b7579f77SDag-Erling Smørgrav 		/* chase the CNAME; process next part of the message */
2183b7579f77SDag-Erling Smørgrav 		if(!val_chase_cname(&vq->qchase, vq->orig_msg->rep,
2184b7579f77SDag-Erling Smørgrav 			&vq->rrset_skip)) {
2185b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "validator: failed to chase CNAME");
2186b7579f77SDag-Erling Smørgrav 			vq->orig_msg->rep->security = sec_status_bogus;
2187b7579f77SDag-Erling Smørgrav 		} else {
2188b7579f77SDag-Erling Smørgrav 			/* restart process for new qchase at rrset_skip */
2189b7579f77SDag-Erling Smørgrav 			log_query_info(VERB_ALGO, "validator: chased to",
2190b7579f77SDag-Erling Smørgrav 				&vq->qchase);
2191b7579f77SDag-Erling Smørgrav 			vq->chase_reply->security = sec_status_unchecked;
2192b7579f77SDag-Erling Smørgrav 			vq->dlv_checked = 0; /* can do DLV for this RR */
2193b7579f77SDag-Erling Smørgrav 			vq->state = VAL_INIT_STATE;
2194b7579f77SDag-Erling Smørgrav 			return 1;
2195b7579f77SDag-Erling Smørgrav 		}
2196b7579f77SDag-Erling Smørgrav 	}
2197b7579f77SDag-Erling Smørgrav 
2198b7579f77SDag-Erling Smørgrav 	if(vq->orig_msg->rep->security == sec_status_secure) {
2199b7579f77SDag-Erling Smørgrav 		/* If the message is secure, check that all rrsets are
2200b7579f77SDag-Erling Smørgrav 		 * secure (i.e. some inserted RRset for CNAME chain with
2201b7579f77SDag-Erling Smørgrav 		 * a different signer name). And drop additional rrsets
2202b7579f77SDag-Erling Smørgrav 		 * that are not secure (if clean-additional option is set) */
2203b7579f77SDag-Erling Smørgrav 		/* this may cause the msg to be marked bogus */
2204c7f4d7adSDag-Erling Smørgrav 		val_check_nonsecure(qstate->env, vq->orig_msg->rep);
2205b7579f77SDag-Erling Smørgrav 		if(vq->orig_msg->rep->security == sec_status_secure) {
2206b7579f77SDag-Erling Smørgrav 			log_query_info(VERB_DETAIL, "validation success",
2207b7579f77SDag-Erling Smørgrav 				&qstate->qinfo);
220857bddd21SDag-Erling Smørgrav 			if(!qstate->no_cache_store) {
220957bddd21SDag-Erling Smørgrav 				val_neg_addreply(qstate->env->neg_cache,
221057bddd21SDag-Erling Smørgrav 					vq->orig_msg->rep);
221157bddd21SDag-Erling Smørgrav 			}
2212b7579f77SDag-Erling Smørgrav 		}
2213b7579f77SDag-Erling Smørgrav 	}
2214b7579f77SDag-Erling Smørgrav 
2215b7579f77SDag-Erling Smørgrav 	/* if the result is bogus - set message ttl to bogus ttl to avoid
2216b7579f77SDag-Erling Smørgrav 	 * endless bogus revalidation */
2217b7579f77SDag-Erling Smørgrav 	if(vq->orig_msg->rep->security == sec_status_bogus) {
2218b7579f77SDag-Erling Smørgrav 		/* see if we can try again to fetch data */
2219b7579f77SDag-Erling Smørgrav 		if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2220b7579f77SDag-Erling Smørgrav 			int restart_count = vq->restart_count+1;
2221b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "validation failed, "
2222b7579f77SDag-Erling Smørgrav 				"blacklist and retry to fetch data");
2223b7579f77SDag-Erling Smørgrav 			val_blacklist(&qstate->blacklist, qstate->region,
2224b7579f77SDag-Erling Smørgrav 				qstate->reply_origin, 0);
2225b7579f77SDag-Erling Smørgrav 			qstate->reply_origin = NULL;
2226b7579f77SDag-Erling Smørgrav 			qstate->errinf = NULL;
2227b7579f77SDag-Erling Smørgrav 			memset(vq, 0, sizeof(*vq));
2228b7579f77SDag-Erling Smørgrav 			vq->restart_count = restart_count;
2229b7579f77SDag-Erling Smørgrav 			vq->state = VAL_INIT_STATE;
2230b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "pass back to next module");
2231b7579f77SDag-Erling Smørgrav 			qstate->ext_state[id] = module_restart_next;
2232b7579f77SDag-Erling Smørgrav 			return 0;
2233b7579f77SDag-Erling Smørgrav 		}
2234b7579f77SDag-Erling Smørgrav 
2235b7579f77SDag-Erling Smørgrav 		vq->orig_msg->rep->ttl = ve->bogus_ttl;
2236b7579f77SDag-Erling Smørgrav 		vq->orig_msg->rep->prefetch_ttl =
2237b7579f77SDag-Erling Smørgrav 			PREFETCH_TTL_CALC(vq->orig_msg->rep->ttl);
2238*4c75e3aaSDag-Erling Smørgrav 		vq->orig_msg->rep->serve_expired_ttl =
2239*4c75e3aaSDag-Erling Smørgrav 			vq->orig_msg->rep->ttl + qstate->env->cfg->serve_expired_ttl;
2240*4c75e3aaSDag-Erling Smørgrav 		if((qstate->env->cfg->val_log_level >= 1 ||
2241*4c75e3aaSDag-Erling Smørgrav 			qstate->env->cfg->log_servfail) &&
2242b7579f77SDag-Erling Smørgrav 			!qstate->env->cfg->val_log_squelch) {
2243*4c75e3aaSDag-Erling Smørgrav 			if(qstate->env->cfg->val_log_level < 2 &&
2244*4c75e3aaSDag-Erling Smørgrav 				!qstate->env->cfg->log_servfail)
2245b7579f77SDag-Erling Smørgrav 				log_query_info(0, "validation failure",
2246b7579f77SDag-Erling Smørgrav 					&qstate->qinfo);
2247b7579f77SDag-Erling Smørgrav 			else {
2248*4c75e3aaSDag-Erling Smørgrav 				char* err = errinf_to_str_bogus(qstate);
2249b7579f77SDag-Erling Smørgrav 				if(err) log_info("%s", err);
2250b7579f77SDag-Erling Smørgrav 				free(err);
2251b7579f77SDag-Erling Smørgrav 			}
2252b7579f77SDag-Erling Smørgrav 		}
2253c7f4d7adSDag-Erling Smørgrav 		/*
2254c7f4d7adSDag-Erling Smørgrav 		 * If set, the validator will not make messages bogus, instead
2255c7f4d7adSDag-Erling Smørgrav 		 * indeterminate is issued, so that no clients receive SERVFAIL.
2256c7f4d7adSDag-Erling Smørgrav 		 * This allows an operator to run validation 'shadow' without
2257c7f4d7adSDag-Erling Smørgrav 		 * hurting responses to clients.
2258c7f4d7adSDag-Erling Smørgrav 		 */
2259b7579f77SDag-Erling Smørgrav 		/* If we are in permissive mode, bogus gets indeterminate */
2260c7f4d7adSDag-Erling Smørgrav 		if(qstate->env->cfg->val_permissive_mode)
2261b7579f77SDag-Erling Smørgrav 			vq->orig_msg->rep->security = sec_status_indeterminate;
2262b7579f77SDag-Erling Smørgrav 	}
2263b7579f77SDag-Erling Smørgrav 
22640fb34990SDag-Erling Smørgrav 	if(vq->orig_msg->rep->security == sec_status_secure &&
22650fb34990SDag-Erling Smørgrav 		qstate->env->cfg->root_key_sentinel &&
22660fb34990SDag-Erling Smørgrav 		(qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
22670fb34990SDag-Erling Smørgrav 		qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)) {
22680fb34990SDag-Erling Smørgrav 		char* keytag_start;
22690fb34990SDag-Erling Smørgrav 		uint16_t keytag;
22700fb34990SDag-Erling Smørgrav 		if(*qstate->qinfo.qname == strlen(SENTINEL_IS) +
22710fb34990SDag-Erling Smørgrav 			SENTINEL_KEYTAG_LEN &&
22720fb34990SDag-Erling Smørgrav 			dname_lab_startswith(qstate->qinfo.qname, SENTINEL_IS,
22730fb34990SDag-Erling Smørgrav 			&keytag_start)) {
22740fb34990SDag-Erling Smørgrav 			if(sentinel_get_keytag(keytag_start, &keytag) &&
22750fb34990SDag-Erling Smørgrav 				!anchor_has_keytag(qstate->env->anchors,
22760fb34990SDag-Erling Smørgrav 				(uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) {
22770fb34990SDag-Erling Smørgrav 				vq->orig_msg->rep->security =
22780fb34990SDag-Erling Smørgrav 					sec_status_secure_sentinel_fail;
22790fb34990SDag-Erling Smørgrav 			}
22800fb34990SDag-Erling Smørgrav 		} else if(*qstate->qinfo.qname == strlen(SENTINEL_NOT) +
22810fb34990SDag-Erling Smørgrav 			SENTINEL_KEYTAG_LEN &&
22820fb34990SDag-Erling Smørgrav 			dname_lab_startswith(qstate->qinfo.qname, SENTINEL_NOT,
22830fb34990SDag-Erling Smørgrav 			&keytag_start)) {
22840fb34990SDag-Erling Smørgrav 			if(sentinel_get_keytag(keytag_start, &keytag) &&
22850fb34990SDag-Erling Smørgrav 				anchor_has_keytag(qstate->env->anchors,
22860fb34990SDag-Erling Smørgrav 				(uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) {
22870fb34990SDag-Erling Smørgrav 				vq->orig_msg->rep->security =
22880fb34990SDag-Erling Smørgrav 					sec_status_secure_sentinel_fail;
22890fb34990SDag-Erling Smørgrav 			}
22900fb34990SDag-Erling Smørgrav 		}
22910fb34990SDag-Erling Smørgrav 	}
2292b7579f77SDag-Erling Smørgrav 	/* store results in cache */
229365b390aaSDag-Erling Smørgrav 	if(qstate->query_flags&BIT_RD) {
2294b7579f77SDag-Erling Smørgrav 		/* if secure, this will override cache anyway, no need
2295b7579f77SDag-Erling Smørgrav 		 * to check if from parentNS */
229665b390aaSDag-Erling Smørgrav 		if(!qstate->no_cache_store) {
2297b7579f77SDag-Erling Smørgrav 			if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2298ff825849SDag-Erling Smørgrav 				vq->orig_msg->rep, 0, qstate->prefetch_leeway, 0, NULL,
2299ff825849SDag-Erling Smørgrav 				qstate->query_flags)) {
2300b7579f77SDag-Erling Smørgrav 				log_err("out of memory caching validator results");
2301b7579f77SDag-Erling Smørgrav 			}
230265b390aaSDag-Erling Smørgrav 		}
2303b7579f77SDag-Erling Smørgrav 	} else {
2304b7579f77SDag-Erling Smørgrav 		/* for a referral, store the verified RRsets */
2305b7579f77SDag-Erling Smørgrav 		/* and this does not get prefetched, so no leeway */
2306b7579f77SDag-Erling Smørgrav 		if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2307ff825849SDag-Erling Smørgrav 			vq->orig_msg->rep, 1, 0, 0, NULL,
2308ff825849SDag-Erling Smørgrav 			qstate->query_flags)) {
2309b7579f77SDag-Erling Smørgrav 			log_err("out of memory caching validator results");
2310b7579f77SDag-Erling Smørgrav 		}
2311b7579f77SDag-Erling Smørgrav 	}
2312b7579f77SDag-Erling Smørgrav 	qstate->return_rcode = LDNS_RCODE_NOERROR;
2313b7579f77SDag-Erling Smørgrav 	qstate->return_msg = vq->orig_msg;
2314b7579f77SDag-Erling Smørgrav 	qstate->ext_state[id] = module_finished;
2315b7579f77SDag-Erling Smørgrav 	return 0;
2316b7579f77SDag-Erling Smørgrav }
2317b7579f77SDag-Erling Smørgrav 
2318b7579f77SDag-Erling Smørgrav /**
2319b7579f77SDag-Erling Smørgrav  * The DLVLookup state. Process DLV lookups.
2320b7579f77SDag-Erling Smørgrav  *
2321b7579f77SDag-Erling Smørgrav  * @param qstate: query state.
2322b7579f77SDag-Erling Smørgrav  * @param vq: validator query state.
2323b7579f77SDag-Erling Smørgrav  * @param ve: validator shared global environment.
2324b7579f77SDag-Erling Smørgrav  * @param id: module id.
2325b7579f77SDag-Erling Smørgrav  * @return true if the event should be processed further on return, false if
2326b7579f77SDag-Erling Smørgrav  *         not.
2327b7579f77SDag-Erling Smørgrav  */
2328b7579f77SDag-Erling Smørgrav static int
2329b7579f77SDag-Erling Smørgrav processDLVLookup(struct module_qstate* qstate, struct val_qstate* vq,
2330b7579f77SDag-Erling Smørgrav 	struct val_env* ve, int id)
2331b7579f77SDag-Erling Smørgrav {
2332c7f4d7adSDag-Erling Smørgrav 	struct module_qstate* newq = NULL;
2333b7579f77SDag-Erling Smørgrav 	/* see if this we are ready to continue normal resolution */
2334b7579f77SDag-Erling Smørgrav 	/* we may need more DLV lookups */
2335b7579f77SDag-Erling Smørgrav 	if(vq->dlv_status==dlv_error)
2336b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "DLV woke up with status dlv_error");
2337b7579f77SDag-Erling Smørgrav 	else if(vq->dlv_status==dlv_success)
2338b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "DLV woke up with status dlv_success");
2339b7579f77SDag-Erling Smørgrav 	else if(vq->dlv_status==dlv_ask_higher)
2340b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "DLV woke up with status dlv_ask_higher");
2341b7579f77SDag-Erling Smørgrav 	else if(vq->dlv_status==dlv_there_is_no_dlv)
2342b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "DLV woke up with status dlv_there_is_no_dlv");
2343b7579f77SDag-Erling Smørgrav 	else 	verbose(VERB_ALGO, "DLV woke up with status unknown");
2344b7579f77SDag-Erling Smørgrav 
2345b7579f77SDag-Erling Smørgrav 	if(vq->dlv_status == dlv_error) {
2346b7579f77SDag-Erling Smørgrav 		verbose(VERB_QUERY, "failed DLV lookup");
2347*4c75e3aaSDag-Erling Smørgrav 		errinf(qstate, "failed DLV lookup");
2348b7579f77SDag-Erling Smørgrav 		return val_error(qstate, id);
2349b7579f77SDag-Erling Smørgrav 	} else if(vq->dlv_status == dlv_success) {
2350b7579f77SDag-Erling Smørgrav 		uint8_t* nm;
2351b7579f77SDag-Erling Smørgrav 		size_t nmlen;
2352b7579f77SDag-Erling Smørgrav 		/* chain continues with DNSKEY, continue in FINDKEY */
2353b7579f77SDag-Erling Smørgrav 		vq->state = VAL_FINDKEY_STATE;
2354b7579f77SDag-Erling Smørgrav 
2355b7579f77SDag-Erling Smørgrav 		/* strip off the DLV suffix from the name; could result in . */
2356b7579f77SDag-Erling Smørgrav 		log_assert(dname_subdomain_c(vq->ds_rrset->rk.dname,
2357b7579f77SDag-Erling Smørgrav 			qstate->env->anchors->dlv_anchor->name));
2358b7579f77SDag-Erling Smørgrav 		nmlen = vq->ds_rrset->rk.dname_len -
2359b7579f77SDag-Erling Smørgrav 			qstate->env->anchors->dlv_anchor->namelen + 1;
2360b7579f77SDag-Erling Smørgrav 		nm = regional_alloc_init(qstate->region,
2361b7579f77SDag-Erling Smørgrav 			vq->ds_rrset->rk.dname, nmlen);
2362b7579f77SDag-Erling Smørgrav 		if(!nm) {
2363b7579f77SDag-Erling Smørgrav 			log_err("Out of memory in DLVLook");
2364b7579f77SDag-Erling Smørgrav 			return val_error(qstate, id);
2365b7579f77SDag-Erling Smørgrav 		}
2366b7579f77SDag-Erling Smørgrav 		nm[nmlen-1] = 0;
2367b7579f77SDag-Erling Smørgrav 
2368b7579f77SDag-Erling Smørgrav 		vq->ds_rrset->rk.dname = nm;
2369b7579f77SDag-Erling Smørgrav 		vq->ds_rrset->rk.dname_len = nmlen;
2370b7579f77SDag-Erling Smørgrav 
2371b7579f77SDag-Erling Smørgrav 		/* create a nullentry for the key so the dnskey lookup
2372b7579f77SDag-Erling Smørgrav 		 * can be retried after a validation failure for it */
2373b7579f77SDag-Erling Smørgrav 		vq->key_entry = key_entry_create_null(qstate->region,
2374b7579f77SDag-Erling Smørgrav 			nm, nmlen, vq->qchase.qclass, 0, 0);
2375b7579f77SDag-Erling Smørgrav 		if(!vq->key_entry) {
2376b7579f77SDag-Erling Smørgrav 			log_err("Out of memory in DLVLook");
2377b7579f77SDag-Erling Smørgrav 			return val_error(qstate, id);
2378b7579f77SDag-Erling Smørgrav 		}
2379b7579f77SDag-Erling Smørgrav 
2380b7579f77SDag-Erling Smørgrav 		if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
2381b7579f77SDag-Erling Smørgrav 			vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
2382c7f4d7adSDag-Erling Smørgrav 			vq->qchase.qclass, BIT_CD, &newq, 0)) {
2383*4c75e3aaSDag-Erling Smørgrav 			verbose(VERB_ALGO, "error generating DNSKEY request");
2384b7579f77SDag-Erling Smørgrav 			return val_error(qstate, id);
2385b7579f77SDag-Erling Smørgrav 		}
2386b7579f77SDag-Erling Smørgrav 		return 0;
2387b7579f77SDag-Erling Smørgrav 	} else if(vq->dlv_status == dlv_there_is_no_dlv) {
2388b7579f77SDag-Erling Smørgrav 		/* continue with the insecure result we got */
2389b7579f77SDag-Erling Smørgrav 		vq->state = VAL_FINISHED_STATE;
2390b7579f77SDag-Erling Smørgrav 		return 1;
2391b7579f77SDag-Erling Smørgrav 	}
2392b7579f77SDag-Erling Smørgrav 	log_assert(vq->dlv_status == dlv_ask_higher);
2393b7579f77SDag-Erling Smørgrav 
2394b7579f77SDag-Erling Smørgrav 	/* ask higher, make sure we stay in DLV repo, below dlv_at */
2395b7579f77SDag-Erling Smørgrav 	if(!dname_subdomain_c(vq->dlv_lookup_name,
2396b7579f77SDag-Erling Smørgrav 		qstate->env->anchors->dlv_anchor->name)) {
2397b7579f77SDag-Erling Smørgrav 		/* just like, there is no DLV */
2398b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "ask above dlv repo");
2399b7579f77SDag-Erling Smørgrav 		vq->state = VAL_FINISHED_STATE;
2400b7579f77SDag-Erling Smørgrav 		return 1;
2401b7579f77SDag-Erling Smørgrav 	}
2402b7579f77SDag-Erling Smørgrav 	if(vq->dlv_insecure_at && !dname_subdomain_c(vq->dlv_lookup_name,
2403b7579f77SDag-Erling Smørgrav 		vq->dlv_insecure_at)) {
2404b7579f77SDag-Erling Smørgrav 		/* already checked a chain lower than dlv_lookup_name */
2405b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "ask above insecure endpoint");
2406b7579f77SDag-Erling Smørgrav 		log_nametypeclass(VERB_ALGO, "enpt", vq->dlv_insecure_at, 0, 0);
2407b7579f77SDag-Erling Smørgrav 		vq->state = VAL_FINISHED_STATE;
2408b7579f77SDag-Erling Smørgrav 		return 1;
2409b7579f77SDag-Erling Smørgrav 	}
2410b7579f77SDag-Erling Smørgrav 
2411b7579f77SDag-Erling Smørgrav 	/* check negative cache before making new request */
2412b7579f77SDag-Erling Smørgrav 	if(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
2413b7579f77SDag-Erling Smørgrav 		vq->dlv_lookup_name_len, vq->qchase.qclass,
2414b7579f77SDag-Erling Smørgrav 		qstate->env->rrset_cache, *qstate->env->now)) {
2415b7579f77SDag-Erling Smørgrav 		/* does not exist, go up one (go higher). */
2416b7579f77SDag-Erling Smørgrav 		dname_remove_label(&vq->dlv_lookup_name,
2417b7579f77SDag-Erling Smørgrav 			&vq->dlv_lookup_name_len);
2418b7579f77SDag-Erling Smørgrav 		/* limit number of labels, limited number of recursion */
2419b7579f77SDag-Erling Smørgrav 		return processDLVLookup(qstate, vq, ve, id);
2420b7579f77SDag-Erling Smørgrav 	}
2421b7579f77SDag-Erling Smørgrav 
2422b7579f77SDag-Erling Smørgrav 	if(!generate_request(qstate, id, vq->dlv_lookup_name,
2423b7579f77SDag-Erling Smørgrav 		vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV,
2424c7f4d7adSDag-Erling Smørgrav 		vq->qchase.qclass, 0, &newq, 0)) {
2425b7579f77SDag-Erling Smørgrav 		return val_error(qstate, id);
2426b7579f77SDag-Erling Smørgrav 	}
2427b7579f77SDag-Erling Smørgrav 
2428b7579f77SDag-Erling Smørgrav 	return 0;
2429b7579f77SDag-Erling Smørgrav }
2430b7579f77SDag-Erling Smørgrav 
2431b7579f77SDag-Erling Smørgrav /**
2432b7579f77SDag-Erling Smørgrav  * Handle validator state.
2433b7579f77SDag-Erling Smørgrav  * If a method returns true, the next state is started. If false, then
2434b7579f77SDag-Erling Smørgrav  * processing will stop.
2435b7579f77SDag-Erling Smørgrav  * @param qstate: query state.
2436b7579f77SDag-Erling Smørgrav  * @param vq: validator query state.
2437b7579f77SDag-Erling Smørgrav  * @param ve: validator shared global environment.
2438b7579f77SDag-Erling Smørgrav  * @param id: module id.
2439b7579f77SDag-Erling Smørgrav  */
2440b7579f77SDag-Erling Smørgrav static void
2441b7579f77SDag-Erling Smørgrav val_handle(struct module_qstate* qstate, struct val_qstate* vq,
2442b7579f77SDag-Erling Smørgrav 	struct val_env* ve, int id)
2443b7579f77SDag-Erling Smørgrav {
2444b7579f77SDag-Erling Smørgrav 	int cont = 1;
2445b7579f77SDag-Erling Smørgrav 	while(cont) {
2446b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "val handle processing q with state %s",
2447b7579f77SDag-Erling Smørgrav 			val_state_to_string(vq->state));
2448b7579f77SDag-Erling Smørgrav 		switch(vq->state) {
2449b7579f77SDag-Erling Smørgrav 			case VAL_INIT_STATE:
2450b7579f77SDag-Erling Smørgrav 				cont = processInit(qstate, vq, ve, id);
2451b7579f77SDag-Erling Smørgrav 				break;
2452b7579f77SDag-Erling Smørgrav 			case VAL_FINDKEY_STATE:
2453b7579f77SDag-Erling Smørgrav 				cont = processFindKey(qstate, vq, id);
2454b7579f77SDag-Erling Smørgrav 				break;
2455b7579f77SDag-Erling Smørgrav 			case VAL_VALIDATE_STATE:
2456b7579f77SDag-Erling Smørgrav 				cont = processValidate(qstate, vq, ve, id);
2457b7579f77SDag-Erling Smørgrav 				break;
2458b7579f77SDag-Erling Smørgrav 			case VAL_FINISHED_STATE:
2459b7579f77SDag-Erling Smørgrav 				cont = processFinished(qstate, vq, ve, id);
2460b7579f77SDag-Erling Smørgrav 				break;
2461b7579f77SDag-Erling Smørgrav 			case VAL_DLVLOOKUP_STATE:
2462b7579f77SDag-Erling Smørgrav 				cont = processDLVLookup(qstate, vq, ve, id);
2463b7579f77SDag-Erling Smørgrav 				break;
2464b7579f77SDag-Erling Smørgrav 			default:
2465b7579f77SDag-Erling Smørgrav 				log_warn("validator: invalid state %d",
2466b7579f77SDag-Erling Smørgrav 					vq->state);
2467b7579f77SDag-Erling Smørgrav 				cont = 0;
2468b7579f77SDag-Erling Smørgrav 				break;
2469b7579f77SDag-Erling Smørgrav 		}
2470b7579f77SDag-Erling Smørgrav 	}
2471b7579f77SDag-Erling Smørgrav }
2472b7579f77SDag-Erling Smørgrav 
2473b7579f77SDag-Erling Smørgrav void
2474b7579f77SDag-Erling Smørgrav val_operate(struct module_qstate* qstate, enum module_ev event, int id,
2475b7579f77SDag-Erling Smørgrav         struct outbound_entry* outbound)
2476b7579f77SDag-Erling Smørgrav {
2477b7579f77SDag-Erling Smørgrav 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2478b7579f77SDag-Erling Smørgrav 	struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
2479b7579f77SDag-Erling Smørgrav 	verbose(VERB_QUERY, "validator[module %d] operate: extstate:%s "
2480b7579f77SDag-Erling Smørgrav 		"event:%s", id, strextstate(qstate->ext_state[id]),
2481b7579f77SDag-Erling Smørgrav 		strmodulevent(event));
2482b7579f77SDag-Erling Smørgrav 	log_query_info(VERB_QUERY, "validator operate: query",
2483b7579f77SDag-Erling Smørgrav 		&qstate->qinfo);
2484b7579f77SDag-Erling Smørgrav 	if(vq && qstate->qinfo.qname != vq->qchase.qname)
2485b7579f77SDag-Erling Smørgrav 		log_query_info(VERB_QUERY, "validator operate: chased to",
2486b7579f77SDag-Erling Smørgrav 		&vq->qchase);
2487b7579f77SDag-Erling Smørgrav 	(void)outbound;
2488b7579f77SDag-Erling Smørgrav 	if(event == module_event_new ||
2489b7579f77SDag-Erling Smørgrav 		(event == module_event_pass && vq == NULL)) {
2490bc892140SDag-Erling Smørgrav 
2491b7579f77SDag-Erling Smørgrav 		/* pass request to next module, to get it */
2492b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "validator: pass to next module");
2493b7579f77SDag-Erling Smørgrav 		qstate->ext_state[id] = module_wait_module;
2494b7579f77SDag-Erling Smørgrav 		return;
2495b7579f77SDag-Erling Smørgrav 	}
2496b7579f77SDag-Erling Smørgrav 	if(event == module_event_moddone) {
2497b7579f77SDag-Erling Smørgrav 		/* check if validation is needed */
2498b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "validator: nextmodule returned");
2499bc892140SDag-Erling Smørgrav 
2500b7579f77SDag-Erling Smørgrav 		if(!needs_validation(qstate, qstate->return_rcode,
2501b7579f77SDag-Erling Smørgrav 			qstate->return_msg)) {
2502b7579f77SDag-Erling Smørgrav 			/* no need to validate this */
2503b7579f77SDag-Erling Smørgrav 			if(qstate->return_msg)
2504b7579f77SDag-Erling Smørgrav 				qstate->return_msg->rep->security =
2505b7579f77SDag-Erling Smørgrav 					sec_status_indeterminate;
2506b7579f77SDag-Erling Smørgrav 			qstate->ext_state[id] = module_finished;
2507b7579f77SDag-Erling Smørgrav 			return;
2508b7579f77SDag-Erling Smørgrav 		}
2509b7579f77SDag-Erling Smørgrav 		if(already_validated(qstate->return_msg)) {
2510b7579f77SDag-Erling Smørgrav 			qstate->ext_state[id] = module_finished;
2511b7579f77SDag-Erling Smørgrav 			return;
2512b7579f77SDag-Erling Smørgrav 		}
2513b7579f77SDag-Erling Smørgrav 		/* qclass ANY should have validation result from spawned
2514b7579f77SDag-Erling Smørgrav 		 * queries. If we get here, it is bogus or an internal error */
2515b7579f77SDag-Erling Smørgrav 		if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) {
2516b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "cannot validate classANY: bogus");
2517b7579f77SDag-Erling Smørgrav 			if(qstate->return_msg)
2518b7579f77SDag-Erling Smørgrav 				qstate->return_msg->rep->security =
2519b7579f77SDag-Erling Smørgrav 					sec_status_bogus;
2520b7579f77SDag-Erling Smørgrav 			qstate->ext_state[id] = module_finished;
2521b7579f77SDag-Erling Smørgrav 			return;
2522b7579f77SDag-Erling Smørgrav 		}
2523b7579f77SDag-Erling Smørgrav 		/* create state to start validation */
2524b7579f77SDag-Erling Smørgrav 		qstate->ext_state[id] = module_error; /* override this */
2525b7579f77SDag-Erling Smørgrav 		if(!vq) {
2526b7579f77SDag-Erling Smørgrav 			vq = val_new(qstate, id);
2527b7579f77SDag-Erling Smørgrav 			if(!vq) {
2528b7579f77SDag-Erling Smørgrav 				log_err("validator: malloc failure");
2529b7579f77SDag-Erling Smørgrav 				qstate->ext_state[id] = module_error;
2530b7579f77SDag-Erling Smørgrav 				return;
2531b7579f77SDag-Erling Smørgrav 			}
2532b7579f77SDag-Erling Smørgrav 		} else if(!vq->orig_msg) {
2533b7579f77SDag-Erling Smørgrav 			if(!val_new_getmsg(qstate, vq)) {
2534b7579f77SDag-Erling Smørgrav 				log_err("validator: malloc failure");
2535b7579f77SDag-Erling Smørgrav 				qstate->ext_state[id] = module_error;
2536b7579f77SDag-Erling Smørgrav 				return;
2537b7579f77SDag-Erling Smørgrav 			}
2538b7579f77SDag-Erling Smørgrav 		}
2539b7579f77SDag-Erling Smørgrav 		val_handle(qstate, vq, ve, id);
2540b7579f77SDag-Erling Smørgrav 		return;
2541b7579f77SDag-Erling Smørgrav 	}
2542b7579f77SDag-Erling Smørgrav 	if(event == module_event_pass) {
2543b7579f77SDag-Erling Smørgrav 		qstate->ext_state[id] = module_error; /* override this */
2544b7579f77SDag-Erling Smørgrav 		/* continue processing, since val_env exists */
2545b7579f77SDag-Erling Smørgrav 		val_handle(qstate, vq, ve, id);
2546b7579f77SDag-Erling Smørgrav 		return;
2547b7579f77SDag-Erling Smørgrav 	}
2548b7579f77SDag-Erling Smørgrav 	log_err("validator: bad event %s", strmodulevent(event));
2549b7579f77SDag-Erling Smørgrav 	qstate->ext_state[id] = module_error;
2550b7579f77SDag-Erling Smørgrav 	return;
2551b7579f77SDag-Erling Smørgrav }
2552b7579f77SDag-Erling Smørgrav 
2553b7579f77SDag-Erling Smørgrav /**
2554b7579f77SDag-Erling Smørgrav  * Evaluate the response to a priming request.
2555b7579f77SDag-Erling Smørgrav  *
2556b7579f77SDag-Erling Smørgrav  * @param dnskey_rrset: DNSKEY rrset (can be NULL if none) in prime reply.
2557b7579f77SDag-Erling Smørgrav  * 	(this rrset is allocated in the wrong region, not the qstate).
2558b7579f77SDag-Erling Smørgrav  * @param ta: trust anchor.
2559b7579f77SDag-Erling Smørgrav  * @param qstate: qstate that needs key.
2560b7579f77SDag-Erling Smørgrav  * @param id: module id.
2561b7579f77SDag-Erling Smørgrav  * @return new key entry or NULL on allocation failure.
2562b7579f77SDag-Erling Smørgrav  *	The key entry will either contain a validated DNSKEY rrset, or
2563b7579f77SDag-Erling Smørgrav  *	represent a Null key (query failed, but validation did not), or a
2564b7579f77SDag-Erling Smørgrav  *	Bad key (validation failed).
2565b7579f77SDag-Erling Smørgrav  */
2566b7579f77SDag-Erling Smørgrav static struct key_entry_key*
2567b7579f77SDag-Erling Smørgrav primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
2568b7579f77SDag-Erling Smørgrav 	struct trust_anchor* ta, struct module_qstate* qstate, int id)
2569b7579f77SDag-Erling Smørgrav {
2570b7579f77SDag-Erling Smørgrav 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2571b7579f77SDag-Erling Smørgrav 	struct key_entry_key* kkey = NULL;
2572b7579f77SDag-Erling Smørgrav 	enum sec_status sec = sec_status_unchecked;
2573b7579f77SDag-Erling Smørgrav 	char* reason = NULL;
257409a3aaf3SDag-Erling Smørgrav 	int downprot = qstate->env->cfg->harden_algo_downgrade;
2575b7579f77SDag-Erling Smørgrav 
2576b7579f77SDag-Erling Smørgrav 	if(!dnskey_rrset) {
2577b7579f77SDag-Erling Smørgrav 		log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2578b7579f77SDag-Erling Smørgrav 			"could not fetch DNSKEY rrset",
2579b7579f77SDag-Erling Smørgrav 			ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2580b7579f77SDag-Erling Smørgrav 		if(qstate->env->cfg->harden_dnssec_stripped) {
2581b7579f77SDag-Erling Smørgrav 			errinf(qstate, "no DNSKEY rrset");
2582b7579f77SDag-Erling Smørgrav 			kkey = key_entry_create_bad(qstate->region, ta->name,
2583b7579f77SDag-Erling Smørgrav 				ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2584b7579f77SDag-Erling Smørgrav 				*qstate->env->now);
2585b7579f77SDag-Erling Smørgrav 		} else 	kkey = key_entry_create_null(qstate->region, ta->name,
2586b7579f77SDag-Erling Smørgrav 				ta->namelen, ta->dclass, NULL_KEY_TTL,
2587b7579f77SDag-Erling Smørgrav 				*qstate->env->now);
2588b7579f77SDag-Erling Smørgrav 		if(!kkey) {
2589b7579f77SDag-Erling Smørgrav 			log_err("out of memory: allocate fail prime key");
2590b7579f77SDag-Erling Smørgrav 			return NULL;
2591b7579f77SDag-Erling Smørgrav 		}
2592b7579f77SDag-Erling Smørgrav 		return kkey;
2593b7579f77SDag-Erling Smørgrav 	}
2594b7579f77SDag-Erling Smørgrav 	/* attempt to verify with trust anchor DS and DNSKEY */
2595b7579f77SDag-Erling Smørgrav 	kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve,
2596b7579f77SDag-Erling Smørgrav 		dnskey_rrset, ta->ds_rrset, ta->dnskey_rrset, downprot,
2597838e13ceSDag-Erling Smørgrav 		&reason, qstate);
2598b7579f77SDag-Erling Smørgrav 	if(!kkey) {
2599b7579f77SDag-Erling Smørgrav 		log_err("out of memory: verifying prime TA");
2600b7579f77SDag-Erling Smørgrav 		return NULL;
2601b7579f77SDag-Erling Smørgrav 	}
2602b7579f77SDag-Erling Smørgrav 	if(key_entry_isgood(kkey))
2603b7579f77SDag-Erling Smørgrav 		sec = sec_status_secure;
2604b7579f77SDag-Erling Smørgrav 	else
2605b7579f77SDag-Erling Smørgrav 		sec = sec_status_bogus;
2606b7579f77SDag-Erling Smørgrav 	verbose(VERB_DETAIL, "validate keys with anchor(DS): %s",
2607b7579f77SDag-Erling Smørgrav 		sec_status_to_string(sec));
2608b7579f77SDag-Erling Smørgrav 
2609b7579f77SDag-Erling Smørgrav 	if(sec != sec_status_secure) {
2610b7579f77SDag-Erling Smørgrav 		log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2611b7579f77SDag-Erling Smørgrav 			"DNSKEY rrset is not secure",
2612b7579f77SDag-Erling Smørgrav 			ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2613b7579f77SDag-Erling Smørgrav 		/* NOTE: in this case, we should probably reject the trust
2614b7579f77SDag-Erling Smørgrav 		 * anchor for longer, perhaps forever. */
2615b7579f77SDag-Erling Smørgrav 		if(qstate->env->cfg->harden_dnssec_stripped) {
2616b7579f77SDag-Erling Smørgrav 			errinf(qstate, reason);
2617b7579f77SDag-Erling Smørgrav 			kkey = key_entry_create_bad(qstate->region, ta->name,
2618b7579f77SDag-Erling Smørgrav 				ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2619b7579f77SDag-Erling Smørgrav 				*qstate->env->now);
2620b7579f77SDag-Erling Smørgrav 		} else 	kkey = key_entry_create_null(qstate->region, ta->name,
2621b7579f77SDag-Erling Smørgrav 				ta->namelen, ta->dclass, NULL_KEY_TTL,
2622b7579f77SDag-Erling Smørgrav 				*qstate->env->now);
2623b7579f77SDag-Erling Smørgrav 		if(!kkey) {
2624b7579f77SDag-Erling Smørgrav 			log_err("out of memory: allocate null prime key");
2625b7579f77SDag-Erling Smørgrav 			return NULL;
2626b7579f77SDag-Erling Smørgrav 		}
2627b7579f77SDag-Erling Smørgrav 		return kkey;
2628b7579f77SDag-Erling Smørgrav 	}
2629b7579f77SDag-Erling Smørgrav 
2630b7579f77SDag-Erling Smørgrav 	log_nametypeclass(VERB_DETAIL, "Successfully primed trust anchor",
2631b7579f77SDag-Erling Smørgrav 		ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2632b7579f77SDag-Erling Smørgrav 	return kkey;
2633b7579f77SDag-Erling Smørgrav }
2634b7579f77SDag-Erling Smørgrav 
2635b7579f77SDag-Erling Smørgrav /**
2636b7579f77SDag-Erling Smørgrav  * In inform supers, with the resulting message and rcode and the current
2637b7579f77SDag-Erling Smørgrav  * keyset in the super state, validate the DS response, returning a KeyEntry.
2638b7579f77SDag-Erling Smørgrav  *
2639b7579f77SDag-Erling Smørgrav  * @param qstate: query state that is validating and asked for a DS.
2640b7579f77SDag-Erling Smørgrav  * @param vq: validator query state
2641b7579f77SDag-Erling Smørgrav  * @param id: module id.
2642b7579f77SDag-Erling Smørgrav  * @param rcode: rcode result value.
2643b7579f77SDag-Erling Smørgrav  * @param msg: result message (if rcode is OK).
2644b7579f77SDag-Erling Smørgrav  * @param qinfo: from the sub query state, query info.
2645b7579f77SDag-Erling Smørgrav  * @param ke: the key entry to return. It returns
2646b7579f77SDag-Erling Smørgrav  *	is_bad if the DS response fails to validate, is_null if the
2647b7579f77SDag-Erling Smørgrav  *	DS response indicated an end to secure space, is_good if the DS
2648b7579f77SDag-Erling Smørgrav  *	validated. It returns ke=NULL if the DS response indicated that the
2649b7579f77SDag-Erling Smørgrav  *	request wasn't a delegation point.
2650b7579f77SDag-Erling Smørgrav  * @return 0 on servfail error (malloc failure).
2651b7579f77SDag-Erling Smørgrav  */
2652b7579f77SDag-Erling Smørgrav static int
2653b7579f77SDag-Erling Smørgrav ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
2654b7579f77SDag-Erling Smørgrav         int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2655b7579f77SDag-Erling Smørgrav 	struct key_entry_key** ke)
2656b7579f77SDag-Erling Smørgrav {
2657b7579f77SDag-Erling Smørgrav 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2658b7579f77SDag-Erling Smørgrav 	char* reason = NULL;
2659b7579f77SDag-Erling Smørgrav 	enum val_classification subtype;
2660b7579f77SDag-Erling Smørgrav 	if(rcode != LDNS_RCODE_NOERROR) {
266117d15b25SDag-Erling Smørgrav 		char rc[16];
266217d15b25SDag-Erling Smørgrav 		rc[0]=0;
266317d15b25SDag-Erling Smørgrav 		(void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
2664b7579f77SDag-Erling Smørgrav 		/* errors here pretty much break validation */
2665b7579f77SDag-Erling Smørgrav 		verbose(VERB_DETAIL, "DS response was error, thus bogus");
2666b7579f77SDag-Erling Smørgrav 		errinf(qstate, rc);
2667b7579f77SDag-Erling Smørgrav 		errinf(qstate, "no DS");
2668b7579f77SDag-Erling Smørgrav 		goto return_bogus;
2669b7579f77SDag-Erling Smørgrav 	}
2670b7579f77SDag-Erling Smørgrav 
2671b7579f77SDag-Erling Smørgrav 	subtype = val_classify_response(BIT_RD, qinfo, qinfo, msg->rep, 0);
2672b7579f77SDag-Erling Smørgrav 	if(subtype == VAL_CLASS_POSITIVE) {
2673b7579f77SDag-Erling Smørgrav 		struct ub_packed_rrset_key* ds;
2674b7579f77SDag-Erling Smørgrav 		enum sec_status sec;
2675b7579f77SDag-Erling Smørgrav 		ds = reply_find_answer_rrset(qinfo, msg->rep);
2676b7579f77SDag-Erling Smørgrav 		/* If there was no DS rrset, then we have mis-classified
2677b7579f77SDag-Erling Smørgrav 		 * this message. */
2678b7579f77SDag-Erling Smørgrav 		if(!ds) {
2679b7579f77SDag-Erling Smørgrav 			log_warn("internal error: POSITIVE DS response was "
2680b7579f77SDag-Erling Smørgrav 				"missing DS.");
2681b7579f77SDag-Erling Smørgrav 			errinf(qstate, "no DS record");
2682b7579f77SDag-Erling Smørgrav 			goto return_bogus;
2683b7579f77SDag-Erling Smørgrav 		}
2684b7579f77SDag-Erling Smørgrav 		/* Verify only returns BOGUS or SECURE. If the rrset is
2685b7579f77SDag-Erling Smørgrav 		 * bogus, then we are done. */
2686b7579f77SDag-Erling Smørgrav 		sec = val_verify_rrset_entry(qstate->env, ve, ds,
2687838e13ceSDag-Erling Smørgrav 			vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate);
2688b7579f77SDag-Erling Smørgrav 		if(sec != sec_status_secure) {
2689b7579f77SDag-Erling Smørgrav 			verbose(VERB_DETAIL, "DS rrset in DS response did "
2690b7579f77SDag-Erling Smørgrav 				"not verify");
2691b7579f77SDag-Erling Smørgrav 			errinf(qstate, reason);
2692b7579f77SDag-Erling Smørgrav 			goto return_bogus;
2693b7579f77SDag-Erling Smørgrav 		}
2694b7579f77SDag-Erling Smørgrav 
2695b7579f77SDag-Erling Smørgrav 		/* If the DS rrset validates, we still have to make sure
2696b7579f77SDag-Erling Smørgrav 		 * that they are usable. */
2697b7579f77SDag-Erling Smørgrav 		if(!val_dsset_isusable(ds)) {
2698b7579f77SDag-Erling Smørgrav 			/* If they aren't usable, then we treat it like
2699b7579f77SDag-Erling Smørgrav 			 * there was no DS. */
2700b7579f77SDag-Erling Smørgrav 			*ke = key_entry_create_null(qstate->region,
2701b7579f77SDag-Erling Smørgrav 				qinfo->qname, qinfo->qname_len, qinfo->qclass,
2702b7579f77SDag-Erling Smørgrav 				ub_packed_rrset_ttl(ds), *qstate->env->now);
2703b7579f77SDag-Erling Smørgrav 			return (*ke) != NULL;
2704b7579f77SDag-Erling Smørgrav 		}
2705b7579f77SDag-Erling Smørgrav 
2706b7579f77SDag-Erling Smørgrav 		/* Otherwise, we return the positive response. */
2707b7579f77SDag-Erling Smørgrav 		log_query_info(VERB_DETAIL, "validated DS", qinfo);
2708b7579f77SDag-Erling Smørgrav 		*ke = key_entry_create_rrset(qstate->region,
2709b7579f77SDag-Erling Smørgrav 			qinfo->qname, qinfo->qname_len, qinfo->qclass, ds,
2710b7579f77SDag-Erling Smørgrav 			NULL, *qstate->env->now);
2711b7579f77SDag-Erling Smørgrav 		return (*ke) != NULL;
2712b7579f77SDag-Erling Smørgrav 	} else if(subtype == VAL_CLASS_NODATA ||
2713b7579f77SDag-Erling Smørgrav 		subtype == VAL_CLASS_NAMEERROR) {
2714b7579f77SDag-Erling Smørgrav 		/* NODATA means that the qname exists, but that there was
2715b7579f77SDag-Erling Smørgrav 		 * no DS.  This is a pretty normal case. */
271617d15b25SDag-Erling Smørgrav 		time_t proof_ttl = 0;
2717b7579f77SDag-Erling Smørgrav 		enum sec_status sec;
2718b7579f77SDag-Erling Smørgrav 
2719b7579f77SDag-Erling Smørgrav 		/* make sure there are NSECs or NSEC3s with signatures */
2720b7579f77SDag-Erling Smørgrav 		if(!val_has_signed_nsecs(msg->rep, &reason)) {
2721b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "no NSECs: %s", reason);
2722b7579f77SDag-Erling Smørgrav 			errinf(qstate, reason);
2723b7579f77SDag-Erling Smørgrav 			goto return_bogus;
2724b7579f77SDag-Erling Smørgrav 		}
2725b7579f77SDag-Erling Smørgrav 
2726b7579f77SDag-Erling Smørgrav 		/* For subtype Name Error.
2727b7579f77SDag-Erling Smørgrav 		 * attempt ANS 2.8.1.0 compatibility where it sets rcode
2728b7579f77SDag-Erling Smørgrav 		 * to nxdomain, but really this is an Nodata/Noerror response.
2729b7579f77SDag-Erling Smørgrav 		 * Find and prove the empty nonterminal in that case */
2730b7579f77SDag-Erling Smørgrav 
2731b7579f77SDag-Erling Smørgrav 		/* Try to prove absence of the DS with NSEC */
2732b7579f77SDag-Erling Smørgrav 		sec = val_nsec_prove_nodata_dsreply(
2733b7579f77SDag-Erling Smørgrav 			qstate->env, ve, qinfo, msg->rep, vq->key_entry,
2734838e13ceSDag-Erling Smørgrav 			&proof_ttl, &reason, qstate);
2735b7579f77SDag-Erling Smørgrav 		switch(sec) {
2736b7579f77SDag-Erling Smørgrav 			case sec_status_secure:
2737b7579f77SDag-Erling Smørgrav 				verbose(VERB_DETAIL, "NSEC RRset for the "
2738b7579f77SDag-Erling Smørgrav 					"referral proved no DS.");
2739b7579f77SDag-Erling Smørgrav 				*ke = key_entry_create_null(qstate->region,
2740b7579f77SDag-Erling Smørgrav 					qinfo->qname, qinfo->qname_len,
2741b7579f77SDag-Erling Smørgrav 					qinfo->qclass, proof_ttl,
2742b7579f77SDag-Erling Smørgrav 					*qstate->env->now);
2743b7579f77SDag-Erling Smørgrav 				return (*ke) != NULL;
2744b7579f77SDag-Erling Smørgrav 			case sec_status_insecure:
2745b7579f77SDag-Erling Smørgrav 				verbose(VERB_DETAIL, "NSEC RRset for the "
2746b7579f77SDag-Erling Smørgrav 				  "referral proved not a delegation point");
2747b7579f77SDag-Erling Smørgrav 				*ke = NULL;
2748b7579f77SDag-Erling Smørgrav 				return 1;
2749b7579f77SDag-Erling Smørgrav 			case sec_status_bogus:
2750b7579f77SDag-Erling Smørgrav 				verbose(VERB_DETAIL, "NSEC RRset for the "
2751b7579f77SDag-Erling Smørgrav 					"referral did not prove no DS.");
2752b7579f77SDag-Erling Smørgrav 				errinf(qstate, reason);
2753b7579f77SDag-Erling Smørgrav 				goto return_bogus;
2754b7579f77SDag-Erling Smørgrav 			case sec_status_unchecked:
2755b7579f77SDag-Erling Smørgrav 			default:
2756b7579f77SDag-Erling Smørgrav 				/* NSEC proof did not work, try next */
2757b7579f77SDag-Erling Smørgrav 				break;
2758b7579f77SDag-Erling Smørgrav 		}
2759b7579f77SDag-Erling Smørgrav 
2760b7579f77SDag-Erling Smørgrav 		sec = nsec3_prove_nods(qstate->env, ve,
2761b7579f77SDag-Erling Smørgrav 			msg->rep->rrsets + msg->rep->an_numrrsets,
2762838e13ceSDag-Erling Smørgrav 			msg->rep->ns_numrrsets, qinfo, vq->key_entry, &reason,
2763838e13ceSDag-Erling Smørgrav 			qstate);
2764b7579f77SDag-Erling Smørgrav 		switch(sec) {
2765b7579f77SDag-Erling Smørgrav 			case sec_status_insecure:
2766b7579f77SDag-Erling Smørgrav 				/* case insecure also continues to unsigned
2767b7579f77SDag-Erling Smørgrav 				 * space.  If nsec3-iter-count too high or
2768b7579f77SDag-Erling Smørgrav 				 * optout, then treat below as unsigned */
2769b7579f77SDag-Erling Smørgrav 			case sec_status_secure:
2770b7579f77SDag-Erling Smørgrav 				verbose(VERB_DETAIL, "NSEC3s for the "
2771b7579f77SDag-Erling Smørgrav 					"referral proved no DS.");
2772b7579f77SDag-Erling Smørgrav 				*ke = key_entry_create_null(qstate->region,
2773b7579f77SDag-Erling Smørgrav 					qinfo->qname, qinfo->qname_len,
2774b7579f77SDag-Erling Smørgrav 					qinfo->qclass, proof_ttl,
2775b7579f77SDag-Erling Smørgrav 					*qstate->env->now);
2776b7579f77SDag-Erling Smørgrav 				return (*ke) != NULL;
2777b7579f77SDag-Erling Smørgrav 			case sec_status_indeterminate:
2778b7579f77SDag-Erling Smørgrav 				verbose(VERB_DETAIL, "NSEC3s for the "
2779b7579f77SDag-Erling Smørgrav 				  "referral proved no delegation");
2780b7579f77SDag-Erling Smørgrav 				*ke = NULL;
2781b7579f77SDag-Erling Smørgrav 				return 1;
2782b7579f77SDag-Erling Smørgrav 			case sec_status_bogus:
2783b7579f77SDag-Erling Smørgrav 				verbose(VERB_DETAIL, "NSEC3s for the "
2784b7579f77SDag-Erling Smørgrav 					"referral did not prove no DS.");
2785b7579f77SDag-Erling Smørgrav 				errinf(qstate, reason);
2786b7579f77SDag-Erling Smørgrav 				goto return_bogus;
2787b7579f77SDag-Erling Smørgrav 			case sec_status_unchecked:
2788b7579f77SDag-Erling Smørgrav 			default:
2789b7579f77SDag-Erling Smørgrav 				/* NSEC3 proof did not work */
2790b7579f77SDag-Erling Smørgrav 				break;
2791b7579f77SDag-Erling Smørgrav 		}
2792b7579f77SDag-Erling Smørgrav 
2793b7579f77SDag-Erling Smørgrav 		/* Apparently, no available NSEC/NSEC3 proved NODATA, so
2794b7579f77SDag-Erling Smørgrav 		 * this is BOGUS. */
2795b7579f77SDag-Erling Smørgrav 		verbose(VERB_DETAIL, "DS %s ran out of options, so return "
2796b7579f77SDag-Erling Smørgrav 			"bogus", val_classification_to_string(subtype));
2797b7579f77SDag-Erling Smørgrav 		errinf(qstate, "no DS but also no proof of that");
2798b7579f77SDag-Erling Smørgrav 		goto return_bogus;
2799b7579f77SDag-Erling Smørgrav 	} else if(subtype == VAL_CLASS_CNAME ||
2800b7579f77SDag-Erling Smørgrav 		subtype == VAL_CLASS_CNAMENOANSWER) {
2801b7579f77SDag-Erling Smørgrav 		/* if the CNAME matches the exact name we want and is signed
2802b7579f77SDag-Erling Smørgrav 		 * properly, then also, we are sure that no DS exists there,
2803b7579f77SDag-Erling Smørgrav 		 * much like a NODATA proof */
2804b7579f77SDag-Erling Smørgrav 		enum sec_status sec;
2805b7579f77SDag-Erling Smørgrav 		struct ub_packed_rrset_key* cname;
2806b7579f77SDag-Erling Smørgrav 		cname = reply_find_rrset_section_an(msg->rep, qinfo->qname,
2807b7579f77SDag-Erling Smørgrav 			qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass);
2808b7579f77SDag-Erling Smørgrav 		if(!cname) {
2809b7579f77SDag-Erling Smørgrav 			errinf(qstate, "validator classified CNAME but no "
2810b7579f77SDag-Erling Smørgrav 				"CNAME of the queried name for DS");
2811b7579f77SDag-Erling Smørgrav 			goto return_bogus;
2812b7579f77SDag-Erling Smørgrav 		}
2813b7579f77SDag-Erling Smørgrav 		if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count
2814b7579f77SDag-Erling Smørgrav 			== 0) {
2815b7579f77SDag-Erling Smørgrav 		        if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep->
2816b7579f77SDag-Erling Smørgrav 				rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) {
2817b7579f77SDag-Erling Smørgrav 				errinf(qstate, "DS got DNAME answer");
2818b7579f77SDag-Erling Smørgrav 			} else {
2819b7579f77SDag-Erling Smørgrav 				errinf(qstate, "DS got unsigned CNAME answer");
2820b7579f77SDag-Erling Smørgrav 			}
2821b7579f77SDag-Erling Smørgrav 			goto return_bogus;
2822b7579f77SDag-Erling Smørgrav 		}
2823b7579f77SDag-Erling Smørgrav 		sec = val_verify_rrset_entry(qstate->env, ve, cname,
2824838e13ceSDag-Erling Smørgrav 			vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate);
2825b7579f77SDag-Erling Smørgrav 		if(sec == sec_status_secure) {
2826b7579f77SDag-Erling Smørgrav 			verbose(VERB_ALGO, "CNAME validated, "
2827b7579f77SDag-Erling Smørgrav 				"proof that DS does not exist");
2828b7579f77SDag-Erling Smørgrav 			/* and that it is not a referral point */
2829b7579f77SDag-Erling Smørgrav 			*ke = NULL;
2830b7579f77SDag-Erling Smørgrav 			return 1;
2831b7579f77SDag-Erling Smørgrav 		}
2832b7579f77SDag-Erling Smørgrav 		errinf(qstate, "CNAME in DS response was not secure.");
2833b7579f77SDag-Erling Smørgrav 		errinf(qstate, reason);
2834b7579f77SDag-Erling Smørgrav 		goto return_bogus;
2835b7579f77SDag-Erling Smørgrav 	} else {
2836b7579f77SDag-Erling Smørgrav 		verbose(VERB_QUERY, "Encountered an unhandled type of "
2837b7579f77SDag-Erling Smørgrav 			"DS response, thus bogus.");
2838b7579f77SDag-Erling Smørgrav 		errinf(qstate, "no DS and");
2839b7579f77SDag-Erling Smørgrav 		if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) {
284017d15b25SDag-Erling Smørgrav 			char rc[16];
284117d15b25SDag-Erling Smørgrav 			rc[0]=0;
284217d15b25SDag-Erling Smørgrav 			(void)sldns_wire2str_rcode_buf((int)FLAGS_GET_RCODE(
284317d15b25SDag-Erling Smørgrav 				msg->rep->flags), rc, sizeof(rc));
2844b7579f77SDag-Erling Smørgrav 			errinf(qstate, rc);
2845b7579f77SDag-Erling Smørgrav 		} else	errinf(qstate, val_classification_to_string(subtype));
2846b7579f77SDag-Erling Smørgrav 		errinf(qstate, "message fails to prove that");
2847b7579f77SDag-Erling Smørgrav 		goto return_bogus;
2848b7579f77SDag-Erling Smørgrav 	}
2849b7579f77SDag-Erling Smørgrav return_bogus:
2850b7579f77SDag-Erling Smørgrav 	*ke = key_entry_create_bad(qstate->region, qinfo->qname,
2851b7579f77SDag-Erling Smørgrav 		qinfo->qname_len, qinfo->qclass,
2852b7579f77SDag-Erling Smørgrav 		BOGUS_KEY_TTL, *qstate->env->now);
2853b7579f77SDag-Erling Smørgrav 	return (*ke) != NULL;
2854b7579f77SDag-Erling Smørgrav }
2855b7579f77SDag-Erling Smørgrav 
2856b7579f77SDag-Erling Smørgrav /**
2857b7579f77SDag-Erling Smørgrav  * Process DS response. Called from inform_supers.
2858b7579f77SDag-Erling Smørgrav  * Because it is in inform_supers, the mesh itself is busy doing callbacks
2859b7579f77SDag-Erling Smørgrav  * for a state that is to be deleted soon; don't touch the mesh; instead
2860b7579f77SDag-Erling Smørgrav  * set a state in the super, as the super will be reactivated soon.
2861b7579f77SDag-Erling Smørgrav  * Perform processing to determine what state to set in the super.
2862b7579f77SDag-Erling Smørgrav  *
2863b7579f77SDag-Erling Smørgrav  * @param qstate: query state that is validating and asked for a DS.
2864b7579f77SDag-Erling Smørgrav  * @param vq: validator query state
2865b7579f77SDag-Erling Smørgrav  * @param id: module id.
2866b7579f77SDag-Erling Smørgrav  * @param rcode: rcode result value.
2867b7579f77SDag-Erling Smørgrav  * @param msg: result message (if rcode is OK).
2868b7579f77SDag-Erling Smørgrav  * @param qinfo: from the sub query state, query info.
2869b7579f77SDag-Erling Smørgrav  * @param origin: the origin of msg.
2870b7579f77SDag-Erling Smørgrav  */
2871b7579f77SDag-Erling Smørgrav static void
2872b7579f77SDag-Erling Smørgrav process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
2873b7579f77SDag-Erling Smørgrav 	int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2874b7579f77SDag-Erling Smørgrav 	struct sock_list* origin)
2875b7579f77SDag-Erling Smørgrav {
2876b7579f77SDag-Erling Smørgrav 	struct key_entry_key* dske = NULL;
2877b7579f77SDag-Erling Smørgrav 	uint8_t* olds = vq->empty_DS_name;
2878b7579f77SDag-Erling Smørgrav 	vq->empty_DS_name = NULL;
2879b7579f77SDag-Erling Smørgrav 	if(!ds_response_to_ke(qstate, vq, id, rcode, msg, qinfo, &dske)) {
2880b7579f77SDag-Erling Smørgrav 			log_err("malloc failure in process_ds_response");
2881b7579f77SDag-Erling Smørgrav 			vq->key_entry = NULL; /* make it error */
2882b7579f77SDag-Erling Smørgrav 			vq->state = VAL_VALIDATE_STATE;
2883b7579f77SDag-Erling Smørgrav 			return;
2884b7579f77SDag-Erling Smørgrav 	}
2885b7579f77SDag-Erling Smørgrav 	if(dske == NULL) {
2886b7579f77SDag-Erling Smørgrav 		vq->empty_DS_name = regional_alloc_init(qstate->region,
2887b7579f77SDag-Erling Smørgrav 			qinfo->qname, qinfo->qname_len);
2888b7579f77SDag-Erling Smørgrav 		if(!vq->empty_DS_name) {
2889b7579f77SDag-Erling Smørgrav 			log_err("malloc failure in empty_DS_name");
2890b7579f77SDag-Erling Smørgrav 			vq->key_entry = NULL; /* make it error */
2891b7579f77SDag-Erling Smørgrav 			vq->state = VAL_VALIDATE_STATE;
2892b7579f77SDag-Erling Smørgrav 			return;
2893b7579f77SDag-Erling Smørgrav 		}
2894b7579f77SDag-Erling Smørgrav 		vq->empty_DS_len = qinfo->qname_len;
2895b7579f77SDag-Erling Smørgrav 		vq->chain_blacklist = NULL;
2896b7579f77SDag-Erling Smørgrav 		/* ds response indicated that we aren't on a delegation point.
2897b7579f77SDag-Erling Smørgrav 		 * Keep the forState.state on FINDKEY. */
2898b7579f77SDag-Erling Smørgrav 	} else if(key_entry_isgood(dske)) {
2899b7579f77SDag-Erling Smørgrav 		vq->ds_rrset = key_entry_get_rrset(dske, qstate->region);
2900b7579f77SDag-Erling Smørgrav 		if(!vq->ds_rrset) {
2901b7579f77SDag-Erling Smørgrav 			log_err("malloc failure in process DS");
2902b7579f77SDag-Erling Smørgrav 			vq->key_entry = NULL; /* make it error */
2903b7579f77SDag-Erling Smørgrav 			vq->state = VAL_VALIDATE_STATE;
2904b7579f77SDag-Erling Smørgrav 			return;
2905b7579f77SDag-Erling Smørgrav 		}
2906b7579f77SDag-Erling Smørgrav 		vq->chain_blacklist = NULL; /* fresh blacklist for next part*/
2907b7579f77SDag-Erling Smørgrav 		/* Keep the forState.state on FINDKEY. */
2908b7579f77SDag-Erling Smørgrav 	} else if(key_entry_isbad(dske)
2909b7579f77SDag-Erling Smørgrav 		&& vq->restart_count < VAL_MAX_RESTART_COUNT) {
2910b7579f77SDag-Erling Smørgrav 		vq->empty_DS_name = olds;
2911b7579f77SDag-Erling Smørgrav 		val_blacklist(&vq->chain_blacklist, qstate->region, origin, 1);
2912b7579f77SDag-Erling Smørgrav 		qstate->errinf = NULL;
2913b7579f77SDag-Erling Smørgrav 		vq->restart_count++;
2914b7579f77SDag-Erling Smørgrav 	} else {
2915b7579f77SDag-Erling Smørgrav 		if(key_entry_isbad(dske)) {
2916b7579f77SDag-Erling Smørgrav 			errinf_origin(qstate, origin);
2917b7579f77SDag-Erling Smørgrav 			errinf_dname(qstate, "for DS", qinfo->qname);
2918b7579f77SDag-Erling Smørgrav 		}
2919b7579f77SDag-Erling Smørgrav 		/* NOTE: the reason for the DS to be not good (that is,
2920b7579f77SDag-Erling Smørgrav 		 * either bad or null) should have been logged by
2921b7579f77SDag-Erling Smørgrav 		 * dsResponseToKE. */
2922b7579f77SDag-Erling Smørgrav 		vq->key_entry = dske;
2923b7579f77SDag-Erling Smørgrav 		/* The FINDKEY phase has ended, so move on. */
2924b7579f77SDag-Erling Smørgrav 		vq->state = VAL_VALIDATE_STATE;
2925b7579f77SDag-Erling Smørgrav 	}
2926b7579f77SDag-Erling Smørgrav }
2927b7579f77SDag-Erling Smørgrav 
2928b7579f77SDag-Erling Smørgrav /**
2929b7579f77SDag-Erling Smørgrav  * Process DNSKEY response. Called from inform_supers.
2930b7579f77SDag-Erling Smørgrav  * Sets the key entry in the state.
2931b7579f77SDag-Erling Smørgrav  * Because it is in inform_supers, the mesh itself is busy doing callbacks
2932b7579f77SDag-Erling Smørgrav  * for a state that is to be deleted soon; don't touch the mesh; instead
2933b7579f77SDag-Erling Smørgrav  * set a state in the super, as the super will be reactivated soon.
2934b7579f77SDag-Erling Smørgrav  * Perform processing to determine what state to set in the super.
2935b7579f77SDag-Erling Smørgrav  *
2936b7579f77SDag-Erling Smørgrav  * @param qstate: query state that is validating and asked for a DNSKEY.
2937b7579f77SDag-Erling Smørgrav  * @param vq: validator query state
2938b7579f77SDag-Erling Smørgrav  * @param id: module id.
2939b7579f77SDag-Erling Smørgrav  * @param rcode: rcode result value.
2940b7579f77SDag-Erling Smørgrav  * @param msg: result message (if rcode is OK).
2941b7579f77SDag-Erling Smørgrav  * @param qinfo: from the sub query state, query info.
2942b7579f77SDag-Erling Smørgrav  * @param origin: the origin of msg.
2943b7579f77SDag-Erling Smørgrav  */
2944b7579f77SDag-Erling Smørgrav static void
2945b7579f77SDag-Erling Smørgrav process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
2946b7579f77SDag-Erling Smørgrav 	int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2947b7579f77SDag-Erling Smørgrav 	struct sock_list* origin)
2948b7579f77SDag-Erling Smørgrav {
2949b7579f77SDag-Erling Smørgrav 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2950b7579f77SDag-Erling Smørgrav 	struct key_entry_key* old = vq->key_entry;
2951b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key* dnskey = NULL;
2952b7579f77SDag-Erling Smørgrav 	int downprot;
2953b7579f77SDag-Erling Smørgrav 	char* reason = NULL;
2954b7579f77SDag-Erling Smørgrav 
2955b7579f77SDag-Erling Smørgrav 	if(rcode == LDNS_RCODE_NOERROR)
2956b7579f77SDag-Erling Smørgrav 		dnskey = reply_find_answer_rrset(qinfo, msg->rep);
2957b7579f77SDag-Erling Smørgrav 
2958b7579f77SDag-Erling Smørgrav 	if(dnskey == NULL) {
2959b7579f77SDag-Erling Smørgrav 		/* bad response */
2960b7579f77SDag-Erling Smørgrav 		verbose(VERB_DETAIL, "Missing DNSKEY RRset in response to "
2961b7579f77SDag-Erling Smørgrav 			"DNSKEY query.");
2962b7579f77SDag-Erling Smørgrav 		if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2963b7579f77SDag-Erling Smørgrav 			val_blacklist(&vq->chain_blacklist, qstate->region,
2964b7579f77SDag-Erling Smørgrav 				origin, 1);
2965b7579f77SDag-Erling Smørgrav 			qstate->errinf = NULL;
2966b7579f77SDag-Erling Smørgrav 			vq->restart_count++;
2967b7579f77SDag-Erling Smørgrav 			return;
2968b7579f77SDag-Erling Smørgrav 		}
2969b7579f77SDag-Erling Smørgrav 		vq->key_entry = key_entry_create_bad(qstate->region,
2970b7579f77SDag-Erling Smørgrav 			qinfo->qname, qinfo->qname_len, qinfo->qclass,
2971b7579f77SDag-Erling Smørgrav 			BOGUS_KEY_TTL, *qstate->env->now);
2972b7579f77SDag-Erling Smørgrav 		if(!vq->key_entry) {
2973b7579f77SDag-Erling Smørgrav 			log_err("alloc failure in missing dnskey response");
2974b7579f77SDag-Erling Smørgrav 			/* key_entry is NULL for failure in Validate */
2975b7579f77SDag-Erling Smørgrav 		}
2976b7579f77SDag-Erling Smørgrav 		errinf(qstate, "No DNSKEY record");
2977b7579f77SDag-Erling Smørgrav 		errinf_origin(qstate, origin);
2978b7579f77SDag-Erling Smørgrav 		errinf_dname(qstate, "for key", qinfo->qname);
2979b7579f77SDag-Erling Smørgrav 		vq->state = VAL_VALIDATE_STATE;
2980b7579f77SDag-Erling Smørgrav 		return;
2981b7579f77SDag-Erling Smørgrav 	}
2982b7579f77SDag-Erling Smørgrav 	if(!vq->ds_rrset) {
2983b7579f77SDag-Erling Smørgrav 		log_err("internal error: no DS rrset for new DNSKEY response");
2984b7579f77SDag-Erling Smørgrav 		vq->key_entry = NULL;
2985b7579f77SDag-Erling Smørgrav 		vq->state = VAL_VALIDATE_STATE;
2986b7579f77SDag-Erling Smørgrav 		return;
2987b7579f77SDag-Erling Smørgrav 	}
2988b75612f8SDag-Erling Smørgrav 	downprot = qstate->env->cfg->harden_algo_downgrade;
2989b7579f77SDag-Erling Smørgrav 	vq->key_entry = val_verify_new_DNSKEYs(qstate->region, qstate->env,
2990838e13ceSDag-Erling Smørgrav 		ve, dnskey, vq->ds_rrset, downprot, &reason, qstate);
2991b7579f77SDag-Erling Smørgrav 
2992b7579f77SDag-Erling Smørgrav 	if(!vq->key_entry) {
2993b7579f77SDag-Erling Smørgrav 		log_err("out of memory in verify new DNSKEYs");
2994b7579f77SDag-Erling Smørgrav 		vq->state = VAL_VALIDATE_STATE;
2995b7579f77SDag-Erling Smørgrav 		return;
2996b7579f77SDag-Erling Smørgrav 	}
2997b7579f77SDag-Erling Smørgrav 	/* If the key entry isBad or isNull, then we can move on to the next
2998b7579f77SDag-Erling Smørgrav 	 * state. */
2999b7579f77SDag-Erling Smørgrav 	if(!key_entry_isgood(vq->key_entry)) {
3000b7579f77SDag-Erling Smørgrav 		if(key_entry_isbad(vq->key_entry)) {
3001b7579f77SDag-Erling Smørgrav 			if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
3002b7579f77SDag-Erling Smørgrav 				val_blacklist(&vq->chain_blacklist,
3003b7579f77SDag-Erling Smørgrav 					qstate->region, origin, 1);
3004b7579f77SDag-Erling Smørgrav 				qstate->errinf = NULL;
3005b7579f77SDag-Erling Smørgrav 				vq->restart_count++;
3006b7579f77SDag-Erling Smørgrav 				vq->key_entry = old;
3007b7579f77SDag-Erling Smørgrav 				return;
3008b7579f77SDag-Erling Smørgrav 			}
3009b7579f77SDag-Erling Smørgrav 			verbose(VERB_DETAIL, "Did not match a DS to a DNSKEY, "
3010b7579f77SDag-Erling Smørgrav 				"thus bogus.");
3011b7579f77SDag-Erling Smørgrav 			errinf(qstate, reason);
3012b7579f77SDag-Erling Smørgrav 			errinf_origin(qstate, origin);
3013b7579f77SDag-Erling Smørgrav 			errinf_dname(qstate, "for key", qinfo->qname);
3014b7579f77SDag-Erling Smørgrav 		}
3015b7579f77SDag-Erling Smørgrav 		vq->chain_blacklist = NULL;
3016b7579f77SDag-Erling Smørgrav 		vq->state = VAL_VALIDATE_STATE;
3017b7579f77SDag-Erling Smørgrav 		return;
3018b7579f77SDag-Erling Smørgrav 	}
3019b7579f77SDag-Erling Smørgrav 	vq->chain_blacklist = NULL;
3020b7579f77SDag-Erling Smørgrav 	qstate->errinf = NULL;
3021b7579f77SDag-Erling Smørgrav 
3022b7579f77SDag-Erling Smørgrav 	/* The DNSKEY validated, so cache it as a trusted key rrset. */
3023b7579f77SDag-Erling Smørgrav 	key_cache_insert(ve->kcache, vq->key_entry, qstate);
3024b7579f77SDag-Erling Smørgrav 
3025b7579f77SDag-Erling Smørgrav 	/* If good, we stay in the FINDKEY state. */
3026b7579f77SDag-Erling Smørgrav 	log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo);
3027b7579f77SDag-Erling Smørgrav }
3028b7579f77SDag-Erling Smørgrav 
3029b7579f77SDag-Erling Smørgrav /**
3030b7579f77SDag-Erling Smørgrav  * Process prime response
3031b7579f77SDag-Erling Smørgrav  * Sets the key entry in the state.
3032b7579f77SDag-Erling Smørgrav  *
3033b7579f77SDag-Erling Smørgrav  * @param qstate: query state that is validating and primed a trust anchor.
3034b7579f77SDag-Erling Smørgrav  * @param vq: validator query state
3035b7579f77SDag-Erling Smørgrav  * @param id: module id.
3036b7579f77SDag-Erling Smørgrav  * @param rcode: rcode result value.
3037b7579f77SDag-Erling Smørgrav  * @param msg: result message (if rcode is OK).
3038b7579f77SDag-Erling Smørgrav  * @param origin: the origin of msg.
3039b7579f77SDag-Erling Smørgrav  */
3040b7579f77SDag-Erling Smørgrav static void
3041b7579f77SDag-Erling Smørgrav process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
3042b7579f77SDag-Erling Smørgrav 	int id, int rcode, struct dns_msg* msg, struct sock_list* origin)
3043b7579f77SDag-Erling Smørgrav {
3044b7579f77SDag-Erling Smørgrav 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
3045b7579f77SDag-Erling Smørgrav 	struct ub_packed_rrset_key* dnskey_rrset = NULL;
3046b7579f77SDag-Erling Smørgrav 	struct trust_anchor* ta = anchor_find(qstate->env->anchors,
3047b7579f77SDag-Erling Smørgrav 		vq->trust_anchor_name, vq->trust_anchor_labs,
3048b7579f77SDag-Erling Smørgrav 		vq->trust_anchor_len, vq->qchase.qclass);
3049b7579f77SDag-Erling Smørgrav 	if(!ta) {
3050b7579f77SDag-Erling Smørgrav 		/* trust anchor revoked, restart with less anchors */
3051b7579f77SDag-Erling Smørgrav 		vq->state = VAL_INIT_STATE;
3052b7579f77SDag-Erling Smørgrav 		if(!vq->trust_anchor_name)
3053b7579f77SDag-Erling Smørgrav 			vq->state = VAL_VALIDATE_STATE; /* break a loop */
3054b7579f77SDag-Erling Smørgrav 		vq->trust_anchor_name = NULL;
3055b7579f77SDag-Erling Smørgrav 		return;
3056b7579f77SDag-Erling Smørgrav 	}
3057b7579f77SDag-Erling Smørgrav 	/* Fetch and validate the keyEntry that corresponds to the
3058b7579f77SDag-Erling Smørgrav 	 * current trust anchor. */
3059b7579f77SDag-Erling Smørgrav 	if(rcode == LDNS_RCODE_NOERROR) {
3060b7579f77SDag-Erling Smørgrav 		dnskey_rrset = reply_find_rrset_section_an(msg->rep,
3061b7579f77SDag-Erling Smørgrav 			ta->name, ta->namelen, LDNS_RR_TYPE_DNSKEY,
3062b7579f77SDag-Erling Smørgrav 			ta->dclass);
3063b7579f77SDag-Erling Smørgrav 	}
3064c7f4d7adSDag-Erling Smørgrav 
3065b7579f77SDag-Erling Smørgrav 	if(ta->autr) {
3066838e13ceSDag-Erling Smørgrav 		if(!autr_process_prime(qstate->env, ve, ta, dnskey_rrset,
3067838e13ceSDag-Erling Smørgrav 			qstate)) {
3068b7579f77SDag-Erling Smørgrav 			/* trust anchor revoked, restart with less anchors */
3069b7579f77SDag-Erling Smørgrav 			vq->state = VAL_INIT_STATE;
3070b7579f77SDag-Erling Smørgrav 			vq->trust_anchor_name = NULL;
3071b7579f77SDag-Erling Smørgrav 			return;
3072b7579f77SDag-Erling Smørgrav 		}
3073b7579f77SDag-Erling Smørgrav 	}
3074b7579f77SDag-Erling Smørgrav 	vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, id);
3075b7579f77SDag-Erling Smørgrav 	lock_basic_unlock(&ta->lock);
3076b7579f77SDag-Erling Smørgrav 	if(vq->key_entry) {
3077b7579f77SDag-Erling Smørgrav 		if(key_entry_isbad(vq->key_entry)
3078b7579f77SDag-Erling Smørgrav 			&& vq->restart_count < VAL_MAX_RESTART_COUNT) {
3079b7579f77SDag-Erling Smørgrav 			val_blacklist(&vq->chain_blacklist, qstate->region,
3080b7579f77SDag-Erling Smørgrav 				origin, 1);
3081b7579f77SDag-Erling Smørgrav 			qstate->errinf = NULL;
3082b7579f77SDag-Erling Smørgrav 			vq->restart_count++;
3083b7579f77SDag-Erling Smørgrav 			vq->key_entry = NULL;
3084b7579f77SDag-Erling Smørgrav 			vq->state = VAL_INIT_STATE;
3085b7579f77SDag-Erling Smørgrav 			return;
3086b7579f77SDag-Erling Smørgrav 		}
3087b7579f77SDag-Erling Smørgrav 		vq->chain_blacklist = NULL;
3088b7579f77SDag-Erling Smørgrav 		errinf_origin(qstate, origin);
3089b7579f77SDag-Erling Smørgrav 		errinf_dname(qstate, "for trust anchor", ta->name);
3090b7579f77SDag-Erling Smørgrav 		/* store the freshly primed entry in the cache */
3091b7579f77SDag-Erling Smørgrav 		key_cache_insert(ve->kcache, vq->key_entry, qstate);
3092b7579f77SDag-Erling Smørgrav 	}
3093b7579f77SDag-Erling Smørgrav 
3094b7579f77SDag-Erling Smørgrav 	/* If the result of the prime is a null key, skip the FINDKEY state.*/
3095b7579f77SDag-Erling Smørgrav 	if(!vq->key_entry || key_entry_isnull(vq->key_entry) ||
3096b7579f77SDag-Erling Smørgrav 		key_entry_isbad(vq->key_entry)) {
3097b7579f77SDag-Erling Smørgrav 		vq->state = VAL_VALIDATE_STATE;
3098b7579f77SDag-Erling Smørgrav 	}
3099b7579f77SDag-Erling Smørgrav 	/* the qstate will be reactivated after inform_super is done */
3100b7579f77SDag-Erling Smørgrav }
3101b7579f77SDag-Erling Smørgrav 
3102b7579f77SDag-Erling Smørgrav /**
3103b7579f77SDag-Erling Smørgrav  * Process DLV response. Called from inform_supers.
3104b7579f77SDag-Erling Smørgrav  * Because it is in inform_supers, the mesh itself is busy doing callbacks
3105b7579f77SDag-Erling Smørgrav  * for a state that is to be deleted soon; don't touch the mesh; instead
3106b7579f77SDag-Erling Smørgrav  * set a state in the super, as the super will be reactivated soon.
3107b7579f77SDag-Erling Smørgrav  * Perform processing to determine what state to set in the super.
3108b7579f77SDag-Erling Smørgrav  *
3109b7579f77SDag-Erling Smørgrav  * @param qstate: query state that is validating and asked for a DLV.
3110b7579f77SDag-Erling Smørgrav  * @param vq: validator query state
3111b7579f77SDag-Erling Smørgrav  * @param id: module id.
3112b7579f77SDag-Erling Smørgrav  * @param rcode: rcode result value.
3113b7579f77SDag-Erling Smørgrav  * @param msg: result message (if rcode is OK).
3114b7579f77SDag-Erling Smørgrav  * @param qinfo: from the sub query state, query info.
3115b7579f77SDag-Erling Smørgrav  */
3116b7579f77SDag-Erling Smørgrav static void
3117b7579f77SDag-Erling Smørgrav process_dlv_response(struct module_qstate* qstate, struct val_qstate* vq,
3118b7579f77SDag-Erling Smørgrav 	int id, int rcode, struct dns_msg* msg, struct query_info* qinfo)
3119b7579f77SDag-Erling Smørgrav {
3120b7579f77SDag-Erling Smørgrav 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
3121b7579f77SDag-Erling Smørgrav 
3122b7579f77SDag-Erling Smørgrav 	verbose(VERB_ALGO, "process dlv response to super");
3123b7579f77SDag-Erling Smørgrav 	if(rcode != LDNS_RCODE_NOERROR) {
3124b7579f77SDag-Erling Smørgrav 		/* lookup failed, set in vq to give up */
3125b7579f77SDag-Erling Smørgrav 		vq->dlv_status = dlv_error;
3126b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "response is error");
3127b7579f77SDag-Erling Smørgrav 		return;
3128b7579f77SDag-Erling Smørgrav 	}
3129b7579f77SDag-Erling Smørgrav 	if(msg->rep->security != sec_status_secure) {
3130b7579f77SDag-Erling Smørgrav 		vq->dlv_status = dlv_error;
3131b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "response is not secure, %s",
3132b7579f77SDag-Erling Smørgrav 			sec_status_to_string(msg->rep->security));
3133b7579f77SDag-Erling Smørgrav 		return;
3134b7579f77SDag-Erling Smørgrav 	}
3135b7579f77SDag-Erling Smørgrav 	/* was the lookup a success? validated DLV? */
3136b7579f77SDag-Erling Smørgrav 	if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NOERROR &&
3137b7579f77SDag-Erling Smørgrav 		msg->rep->an_numrrsets == 1 &&
3138b7579f77SDag-Erling Smørgrav 		msg->rep->security == sec_status_secure &&
3139b7579f77SDag-Erling Smørgrav 		ntohs(msg->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DLV &&
3140b7579f77SDag-Erling Smørgrav 		ntohs(msg->rep->rrsets[0]->rk.rrset_class) == qinfo->qclass &&
3141b7579f77SDag-Erling Smørgrav 		query_dname_compare(msg->rep->rrsets[0]->rk.dname,
3142b7579f77SDag-Erling Smørgrav 			vq->dlv_lookup_name) == 0) {
3143b7579f77SDag-Erling Smørgrav 		/* yay! it is just like a DS */
3144b7579f77SDag-Erling Smørgrav 		vq->ds_rrset = (struct ub_packed_rrset_key*)
3145b7579f77SDag-Erling Smørgrav 			regional_alloc_init(qstate->region,
3146b7579f77SDag-Erling Smørgrav 			msg->rep->rrsets[0], sizeof(*vq->ds_rrset));
3147b7579f77SDag-Erling Smørgrav 		if(!vq->ds_rrset) {
3148b7579f77SDag-Erling Smørgrav 			log_err("out of memory in process_dlv");
3149b7579f77SDag-Erling Smørgrav 			return;
3150b7579f77SDag-Erling Smørgrav 		}
3151b7579f77SDag-Erling Smørgrav 		vq->ds_rrset->entry.key = vq->ds_rrset;
3152b7579f77SDag-Erling Smørgrav 		vq->ds_rrset->rk.dname = (uint8_t*)regional_alloc_init(
3153b7579f77SDag-Erling Smørgrav 			qstate->region, vq->ds_rrset->rk.dname,
3154b7579f77SDag-Erling Smørgrav 			vq->ds_rrset->rk.dname_len);
3155b7579f77SDag-Erling Smørgrav 		if(!vq->ds_rrset->rk.dname) {
3156b7579f77SDag-Erling Smørgrav 			log_err("out of memory in process_dlv");
3157b7579f77SDag-Erling Smørgrav 			vq->dlv_status = dlv_error;
3158b7579f77SDag-Erling Smørgrav 			return;
3159b7579f77SDag-Erling Smørgrav 		}
3160b7579f77SDag-Erling Smørgrav 		vq->ds_rrset->entry.data = regional_alloc_init(qstate->region,
3161b7579f77SDag-Erling Smørgrav 			vq->ds_rrset->entry.data,
3162b7579f77SDag-Erling Smørgrav 			packed_rrset_sizeof(vq->ds_rrset->entry.data));
3163b7579f77SDag-Erling Smørgrav 		if(!vq->ds_rrset->entry.data) {
3164b7579f77SDag-Erling Smørgrav 			log_err("out of memory in process_dlv");
3165b7579f77SDag-Erling Smørgrav 			vq->dlv_status = dlv_error;
3166b7579f77SDag-Erling Smørgrav 			return;
3167b7579f77SDag-Erling Smørgrav 		}
3168b7579f77SDag-Erling Smørgrav 		packed_rrset_ptr_fixup(vq->ds_rrset->entry.data);
3169b7579f77SDag-Erling Smørgrav 		/* make vq do a DNSKEY query next up */
3170b7579f77SDag-Erling Smørgrav 		vq->dlv_status = dlv_success;
3171b7579f77SDag-Erling Smørgrav 		return;
3172b7579f77SDag-Erling Smørgrav 	}
3173b7579f77SDag-Erling Smørgrav 	/* store NSECs into negative cache */
3174b7579f77SDag-Erling Smørgrav 	val_neg_addreply(ve->neg_cache, msg->rep);
3175b7579f77SDag-Erling Smørgrav 
3176b7579f77SDag-Erling Smørgrav 	/* was the lookup a failure?
3177b7579f77SDag-Erling Smørgrav 	 *   if we have to go up into the DLV for a higher DLV anchor
3178b7579f77SDag-Erling Smørgrav 	 *   then set this in the vq, so it can make queries when activated.
3179b7579f77SDag-Erling Smørgrav 	 * See if the NSECs indicate that we should look for higher DLV
3180b7579f77SDag-Erling Smørgrav 	 * or, that there is no DLV securely */
3181b7579f77SDag-Erling Smørgrav 	if(!val_nsec_check_dlv(qinfo, msg->rep, &vq->dlv_lookup_name,
3182b7579f77SDag-Erling Smørgrav 		&vq->dlv_lookup_name_len)) {
3183b7579f77SDag-Erling Smørgrav 		vq->dlv_status = dlv_error;
3184b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "nsec error");
3185b7579f77SDag-Erling Smørgrav 		return;
3186b7579f77SDag-Erling Smørgrav 	}
3187b7579f77SDag-Erling Smørgrav 	if(!dname_subdomain_c(vq->dlv_lookup_name,
3188b7579f77SDag-Erling Smørgrav 		qstate->env->anchors->dlv_anchor->name)) {
3189b7579f77SDag-Erling Smørgrav 		vq->dlv_status = dlv_there_is_no_dlv;
3190b7579f77SDag-Erling Smørgrav 		return;
3191b7579f77SDag-Erling Smørgrav 	}
3192b7579f77SDag-Erling Smørgrav 	vq->dlv_status = dlv_ask_higher;
3193b7579f77SDag-Erling Smørgrav }
3194b7579f77SDag-Erling Smørgrav 
3195b7579f77SDag-Erling Smørgrav /*
3196b7579f77SDag-Erling Smørgrav  * inform validator super.
3197b7579f77SDag-Erling Smørgrav  *
3198b7579f77SDag-Erling Smørgrav  * @param qstate: query state that finished.
3199b7579f77SDag-Erling Smørgrav  * @param id: module id.
3200b7579f77SDag-Erling Smørgrav  * @param super: the qstate to inform.
3201b7579f77SDag-Erling Smørgrav  */
3202b7579f77SDag-Erling Smørgrav void
3203b7579f77SDag-Erling Smørgrav val_inform_super(struct module_qstate* qstate, int id,
3204b7579f77SDag-Erling Smørgrav 	struct module_qstate* super)
3205b7579f77SDag-Erling Smørgrav {
3206b7579f77SDag-Erling Smørgrav 	struct val_qstate* vq = (struct val_qstate*)super->minfo[id];
3207b7579f77SDag-Erling Smørgrav 	log_query_info(VERB_ALGO, "validator: inform_super, sub is",
3208b7579f77SDag-Erling Smørgrav 		&qstate->qinfo);
3209b7579f77SDag-Erling Smørgrav 	log_query_info(VERB_ALGO, "super is", &super->qinfo);
3210b7579f77SDag-Erling Smørgrav 	if(!vq) {
3211b7579f77SDag-Erling Smørgrav 		verbose(VERB_ALGO, "super: has no validator state");
3212b7579f77SDag-Erling Smørgrav 		return;
3213b7579f77SDag-Erling Smørgrav 	}
3214b7579f77SDag-Erling Smørgrav 	if(vq->wait_prime_ta) {
3215b7579f77SDag-Erling Smørgrav 		vq->wait_prime_ta = 0;
3216b7579f77SDag-Erling Smørgrav 		process_prime_response(super, vq, id, qstate->return_rcode,
3217b7579f77SDag-Erling Smørgrav 			qstate->return_msg, qstate->reply_origin);
3218b7579f77SDag-Erling Smørgrav 		return;
3219b7579f77SDag-Erling Smørgrav 	}
3220b7579f77SDag-Erling Smørgrav 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS) {
3221b7579f77SDag-Erling Smørgrav 		process_ds_response(super, vq, id, qstate->return_rcode,
3222b7579f77SDag-Erling Smørgrav 			qstate->return_msg, &qstate->qinfo,
3223b7579f77SDag-Erling Smørgrav 			qstate->reply_origin);
3224b7579f77SDag-Erling Smørgrav 		return;
3225b7579f77SDag-Erling Smørgrav 	} else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY) {
3226b7579f77SDag-Erling Smørgrav 		process_dnskey_response(super, vq, id, qstate->return_rcode,
3227b7579f77SDag-Erling Smørgrav 			qstate->return_msg, &qstate->qinfo,
3228b7579f77SDag-Erling Smørgrav 			qstate->reply_origin);
3229b7579f77SDag-Erling Smørgrav 		return;
3230b7579f77SDag-Erling Smørgrav 	} else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DLV) {
3231b7579f77SDag-Erling Smørgrav 		process_dlv_response(super, vq, id, qstate->return_rcode,
3232b7579f77SDag-Erling Smørgrav 			qstate->return_msg, &qstate->qinfo);
3233b7579f77SDag-Erling Smørgrav 		return;
3234b7579f77SDag-Erling Smørgrav 	}
3235b7579f77SDag-Erling Smørgrav 	log_err("internal error in validator: no inform_supers possible");
3236b7579f77SDag-Erling Smørgrav }
3237b7579f77SDag-Erling Smørgrav 
3238b7579f77SDag-Erling Smørgrav void
3239b7579f77SDag-Erling Smørgrav val_clear(struct module_qstate* qstate, int id)
3240b7579f77SDag-Erling Smørgrav {
3241b7579f77SDag-Erling Smørgrav 	if(!qstate)
3242b7579f77SDag-Erling Smørgrav 		return;
3243b7579f77SDag-Erling Smørgrav 	/* everything is allocated in the region, so assign NULL */
3244b7579f77SDag-Erling Smørgrav 	qstate->minfo[id] = NULL;
3245b7579f77SDag-Erling Smørgrav }
3246b7579f77SDag-Erling Smørgrav 
3247b7579f77SDag-Erling Smørgrav size_t
3248b7579f77SDag-Erling Smørgrav val_get_mem(struct module_env* env, int id)
3249b7579f77SDag-Erling Smørgrav {
3250b7579f77SDag-Erling Smørgrav 	struct val_env* ve = (struct val_env*)env->modinfo[id];
3251b7579f77SDag-Erling Smørgrav 	if(!ve)
3252b7579f77SDag-Erling Smørgrav 		return 0;
3253b7579f77SDag-Erling Smørgrav 	return sizeof(*ve) + key_cache_get_mem(ve->kcache) +
3254b7579f77SDag-Erling Smørgrav 		val_neg_get_mem(ve->neg_cache) +
3255b7579f77SDag-Erling Smørgrav 		sizeof(size_t)*2*ve->nsec3_keyiter_count;
3256b7579f77SDag-Erling Smørgrav }
3257b7579f77SDag-Erling Smørgrav 
3258b7579f77SDag-Erling Smørgrav /**
3259b7579f77SDag-Erling Smørgrav  * The validator function block
3260b7579f77SDag-Erling Smørgrav  */
3261b7579f77SDag-Erling Smørgrav static struct module_func_block val_block = {
3262b7579f77SDag-Erling Smørgrav 	"validator",
3263b7579f77SDag-Erling Smørgrav 	&val_init, &val_deinit, &val_operate, &val_inform_super, &val_clear,
3264b7579f77SDag-Erling Smørgrav 	&val_get_mem
3265b7579f77SDag-Erling Smørgrav };
3266b7579f77SDag-Erling Smørgrav 
3267b7579f77SDag-Erling Smørgrav struct module_func_block*
3268b7579f77SDag-Erling Smørgrav val_get_funcblock(void)
3269b7579f77SDag-Erling Smørgrav {
3270b7579f77SDag-Erling Smørgrav 	return &val_block;
3271b7579f77SDag-Erling Smørgrav }
3272b7579f77SDag-Erling Smørgrav 
3273b7579f77SDag-Erling Smørgrav const char*
3274b7579f77SDag-Erling Smørgrav val_state_to_string(enum val_state state)
3275b7579f77SDag-Erling Smørgrav {
3276b7579f77SDag-Erling Smørgrav 	switch(state) {
3277b7579f77SDag-Erling Smørgrav 		case VAL_INIT_STATE: return "VAL_INIT_STATE";
3278b7579f77SDag-Erling Smørgrav 		case VAL_FINDKEY_STATE: return "VAL_FINDKEY_STATE";
3279b7579f77SDag-Erling Smørgrav 		case VAL_VALIDATE_STATE: return "VAL_VALIDATE_STATE";
3280b7579f77SDag-Erling Smørgrav 		case VAL_FINISHED_STATE: return "VAL_FINISHED_STATE";
3281b7579f77SDag-Erling Smørgrav 		case VAL_DLVLOOKUP_STATE: return "VAL_DLVLOOKUP_STATE";
3282b7579f77SDag-Erling Smørgrav 	}
3283b7579f77SDag-Erling Smørgrav 	return "UNKNOWN VALIDATOR STATE";
3284b7579f77SDag-Erling Smørgrav }
3285b7579f77SDag-Erling Smørgrav 
3286