xref: /freebsd/contrib/unbound/validator/validator.c (revision 190cef3d52236565eb22e18b33e9e865ec634aa3)
1 /*
2  * validator/validator.c - secure validator DNS query response module
3  *
4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * This file contains a module that performs validation of DNS queries.
40  * According to RFC 4034.
41  */
42 #include "config.h"
43 #include <ctype.h>
44 #include "validator/validator.h"
45 #include "validator/val_anchor.h"
46 #include "validator/val_kcache.h"
47 #include "validator/val_kentry.h"
48 #include "validator/val_utils.h"
49 #include "validator/val_nsec.h"
50 #include "validator/val_nsec3.h"
51 #include "validator/val_neg.h"
52 #include "validator/val_sigcrypt.h"
53 #include "validator/autotrust.h"
54 #include "services/cache/dns.h"
55 #include "services/cache/rrset.h"
56 #include "util/data/dname.h"
57 #include "util/module.h"
58 #include "util/log.h"
59 #include "util/net_help.h"
60 #include "util/regional.h"
61 #include "util/config_file.h"
62 #include "util/fptr_wlist.h"
63 #include "sldns/rrdef.h"
64 #include "sldns/wire2str.h"
65 #include "sldns/str2wire.h"
66 
67 /* forward decl for cache response and normal super inform calls of a DS */
68 static void process_ds_response(struct module_qstate* qstate,
69 	struct val_qstate* vq, int id, int rcode, struct dns_msg* msg,
70 	struct query_info* qinfo, struct sock_list* origin);
71 
72 /** fill up nsec3 key iterations config entry */
73 static int
74 fill_nsec3_iter(struct val_env* ve, char* s, int c)
75 {
76 	char* e;
77 	int i;
78 	free(ve->nsec3_keysize);
79 	free(ve->nsec3_maxiter);
80 	ve->nsec3_keysize = (size_t*)calloc(sizeof(size_t), (size_t)c);
81 	ve->nsec3_maxiter = (size_t*)calloc(sizeof(size_t), (size_t)c);
82 	if(!ve->nsec3_keysize || !ve->nsec3_maxiter) {
83 		log_err("out of memory");
84 		return 0;
85 	}
86 	for(i=0; i<c; i++) {
87 		ve->nsec3_keysize[i] = (size_t)strtol(s, &e, 10);
88 		if(s == e) {
89 			log_err("cannot parse: %s", s);
90 			return 0;
91 		}
92 		s = e;
93 		ve->nsec3_maxiter[i] = (size_t)strtol(s, &e, 10);
94 		if(s == e) {
95 			log_err("cannot parse: %s", s);
96 			return 0;
97 		}
98 		s = e;
99 		if(i>0 && ve->nsec3_keysize[i-1] >= ve->nsec3_keysize[i]) {
100 			log_err("nsec3 key iterations not ascending: %d %d",
101 				(int)ve->nsec3_keysize[i-1],
102 				(int)ve->nsec3_keysize[i]);
103 			return 0;
104 		}
105 		verbose(VERB_ALGO, "validator nsec3cfg keysz %d mxiter %d",
106 			(int)ve->nsec3_keysize[i], (int)ve->nsec3_maxiter[i]);
107 	}
108 	return 1;
109 }
110 
111 /** apply config settings to validator */
112 static int
113 val_apply_cfg(struct module_env* env, struct val_env* val_env,
114 	struct config_file* cfg)
115 {
116 	int c;
117 	val_env->bogus_ttl = (uint32_t)cfg->bogus_ttl;
118 	if(!env->anchors)
119 		env->anchors = anchors_create();
120 	if(!env->anchors) {
121 		log_err("out of memory");
122 		return 0;
123 	}
124 	if(!val_env->kcache)
125 		val_env->kcache = key_cache_create(cfg);
126 	if(!val_env->kcache) {
127 		log_err("out of memory");
128 		return 0;
129 	}
130 	env->key_cache = val_env->kcache;
131 	if(!anchors_apply_cfg(env->anchors, cfg)) {
132 		log_err("validator: error in trustanchors config");
133 		return 0;
134 	}
135 	val_env->date_override = cfg->val_date_override;
136 	val_env->skew_min = cfg->val_sig_skew_min;
137 	val_env->skew_max = cfg->val_sig_skew_max;
138 	c = cfg_count_numbers(cfg->val_nsec3_key_iterations);
139 	if(c < 1 || (c&1)) {
140 		log_err("validator: unparseable or odd nsec3 key "
141 			"iterations: %s", cfg->val_nsec3_key_iterations);
142 		return 0;
143 	}
144 	val_env->nsec3_keyiter_count = c/2;
145 	if(!fill_nsec3_iter(val_env, cfg->val_nsec3_key_iterations, c/2)) {
146 		log_err("validator: cannot apply nsec3 key iterations");
147 		return 0;
148 	}
149 	if(!val_env->neg_cache)
150 		val_env->neg_cache = val_neg_create(cfg,
151 			val_env->nsec3_maxiter[val_env->nsec3_keyiter_count-1]);
152 	if(!val_env->neg_cache) {
153 		log_err("out of memory");
154 		return 0;
155 	}
156 	env->neg_cache = val_env->neg_cache;
157 	return 1;
158 }
159 
160 #ifdef USE_ECDSA_EVP_WORKAROUND
161 void ecdsa_evp_workaround_init(void);
162 #endif
163 int
164 val_init(struct module_env* env, int id)
165 {
166 	struct val_env* val_env = (struct val_env*)calloc(1,
167 		sizeof(struct val_env));
168 	if(!val_env) {
169 		log_err("malloc failure");
170 		return 0;
171 	}
172 	env->modinfo[id] = (void*)val_env;
173 	env->need_to_validate = 1;
174 	lock_basic_init(&val_env->bogus_lock);
175 	lock_protect(&val_env->bogus_lock, &val_env->num_rrset_bogus,
176 		sizeof(val_env->num_rrset_bogus));
177 #ifdef USE_ECDSA_EVP_WORKAROUND
178 	ecdsa_evp_workaround_init();
179 #endif
180 	if(!val_apply_cfg(env, val_env, env->cfg)) {
181 		log_err("validator: could not apply configuration settings.");
182 		return 0;
183 	}
184 
185 	return 1;
186 }
187 
188 void
189 val_deinit(struct module_env* env, int id)
190 {
191 	struct val_env* val_env;
192 	if(!env || !env->modinfo[id])
193 		return;
194 	val_env = (struct val_env*)env->modinfo[id];
195 	lock_basic_destroy(&val_env->bogus_lock);
196 	anchors_delete(env->anchors);
197 	env->anchors = NULL;
198 	key_cache_delete(val_env->kcache);
199 	neg_cache_delete(val_env->neg_cache);
200 	free(val_env->nsec3_keysize);
201 	free(val_env->nsec3_maxiter);
202 	free(val_env);
203 	env->modinfo[id] = NULL;
204 }
205 
206 /** fill in message structure */
207 static struct val_qstate*
208 val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq)
209 {
210 	if(!qstate->return_msg || qstate->return_rcode != LDNS_RCODE_NOERROR) {
211 		/* create a message to verify */
212 		verbose(VERB_ALGO, "constructing reply for validation");
213 		vq->orig_msg = (struct dns_msg*)regional_alloc(qstate->region,
214 			sizeof(struct dns_msg));
215 		if(!vq->orig_msg)
216 			return NULL;
217 		vq->orig_msg->qinfo = qstate->qinfo;
218 		vq->orig_msg->rep = (struct reply_info*)regional_alloc(
219 			qstate->region, sizeof(struct reply_info));
220 		if(!vq->orig_msg->rep)
221 			return NULL;
222 		memset(vq->orig_msg->rep, 0, sizeof(struct reply_info));
223 		vq->orig_msg->rep->flags = (uint16_t)(qstate->return_rcode&0xf)
224 			|BIT_QR|BIT_RA|(qstate->query_flags|(BIT_CD|BIT_RD));
225 		vq->orig_msg->rep->qdcount = 1;
226 	} else {
227 		vq->orig_msg = qstate->return_msg;
228 	}
229 	vq->qchase = qstate->qinfo;
230 	/* chase reply will be an edited (sub)set of the orig msg rrset ptrs */
231 	vq->chase_reply = regional_alloc_init(qstate->region,
232 		vq->orig_msg->rep,
233 		sizeof(struct reply_info) - sizeof(struct rrset_ref));
234 	if(!vq->chase_reply)
235 		return NULL;
236 	if(vq->orig_msg->rep->rrset_count > RR_COUNT_MAX)
237 		return NULL; /* protect against integer overflow */
238 	vq->chase_reply->rrsets = regional_alloc_init(qstate->region,
239 		vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*)
240 			* vq->orig_msg->rep->rrset_count);
241 	if(!vq->chase_reply->rrsets)
242 		return NULL;
243 	vq->rrset_skip = 0;
244 	return vq;
245 }
246 
247 /** allocate new validator query state */
248 static struct val_qstate*
249 val_new(struct module_qstate* qstate, int id)
250 {
251 	struct val_qstate* vq = (struct val_qstate*)regional_alloc(
252 		qstate->region, sizeof(*vq));
253 	log_assert(!qstate->minfo[id]);
254 	if(!vq)
255 		return NULL;
256 	memset(vq, 0, sizeof(*vq));
257 	qstate->minfo[id] = vq;
258 	vq->state = VAL_INIT_STATE;
259 	return val_new_getmsg(qstate, vq);
260 }
261 
262 /**
263  * Exit validation with an error status
264  *
265  * @param qstate: query state
266  * @param id: validator id.
267  * @return false, for use by caller to return to stop processing.
268  */
269 static int
270 val_error(struct module_qstate* qstate, int id)
271 {
272 	qstate->ext_state[id] = module_error;
273 	qstate->return_rcode = LDNS_RCODE_SERVFAIL;
274 	return 0;
275 }
276 
277 /**
278  * Check to see if a given response needs to go through the validation
279  * process. Typical reasons for this routine to return false are: CD bit was
280  * on in the original request, or the response is a kind of message that
281  * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.)
282  *
283  * @param qstate: query state.
284  * @param ret_rc: rcode for this message (if noerror - examine ret_msg).
285  * @param ret_msg: return msg, can be NULL; look at rcode instead.
286  * @return true if the response could use validation (although this does not
287  *         mean we can actually validate this response).
288  */
289 static int
290 needs_validation(struct module_qstate* qstate, int ret_rc,
291 	struct dns_msg* ret_msg)
292 {
293 	int rcode;
294 
295 	/* If the CD bit is on in the original request, then you could think
296 	 * that we don't bother to validate anything.
297 	 * But this is signalled internally with the valrec flag.
298 	 * User queries are validated with BIT_CD to make our cache clean
299 	 * so that bogus messages get retried by the upstream also for
300 	 * downstream validators that set BIT_CD.
301 	 * For DNS64 bit_cd signals no dns64 processing, but we want to
302 	 * provide validation there too */
303 	/*
304 	if(qstate->query_flags & BIT_CD) {
305 		verbose(VERB_ALGO, "not validating response due to CD bit");
306 		return 0;
307 	}
308 	*/
309 	if(qstate->is_valrec) {
310 		verbose(VERB_ALGO, "not validating response, is valrec"
311 			"(validation recursion lookup)");
312 		return 0;
313 	}
314 
315 	if(ret_rc != LDNS_RCODE_NOERROR || !ret_msg)
316 		rcode = ret_rc;
317 	else 	rcode = (int)FLAGS_GET_RCODE(ret_msg->rep->flags);
318 
319 	if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) {
320 		if(verbosity >= VERB_ALGO) {
321 			char rc[16];
322 			rc[0]=0;
323 			(void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
324 			verbose(VERB_ALGO, "cannot validate non-answer, rcode %s", rc);
325 		}
326 		return 0;
327 	}
328 
329 	/* cannot validate positive RRSIG response. (negatives can) */
330 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_RRSIG &&
331 		rcode == LDNS_RCODE_NOERROR && ret_msg &&
332 		ret_msg->rep->an_numrrsets > 0) {
333 		verbose(VERB_ALGO, "cannot validate RRSIG, no sigs on sigs.");
334 		return 0;
335 	}
336 	return 1;
337 }
338 
339 /**
340  * Check to see if the response has already been validated.
341  * @param ret_msg: return msg, can be NULL
342  * @return true if the response has already been validated
343  */
344 static int
345 already_validated(struct dns_msg* ret_msg)
346 {
347 	/* validate unchecked, and re-validate bogus messages */
348 	if (ret_msg && ret_msg->rep->security > sec_status_bogus)
349 	{
350 		verbose(VERB_ALGO, "response has already been validated: %s",
351 			sec_status_to_string(ret_msg->rep->security));
352 		return 1;
353 	}
354 	return 0;
355 }
356 
357 /**
358  * Generate a request for DNS data.
359  *
360  * @param qstate: query state that is the parent.
361  * @param id: module id.
362  * @param name: what name to query for.
363  * @param namelen: length of name.
364  * @param qtype: query type.
365  * @param qclass: query class.
366  * @param flags: additional flags, such as the CD bit (BIT_CD), or 0.
367  * @param newq: If the subquery is newly created, it is returned,
368  * 	otherwise NULL is returned
369  * @param detached: true if this qstate should not attach to the subquery
370  * @return false on alloc failure.
371  */
372 static int
373 generate_request(struct module_qstate* qstate, int id, uint8_t* name,
374 	size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags,
375 	struct module_qstate** newq, int detached)
376 {
377 	struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
378 	struct query_info ask;
379 	int valrec;
380 	ask.qname = name;
381 	ask.qname_len = namelen;
382 	ask.qtype = qtype;
383 	ask.qclass = qclass;
384 	ask.local_alias = NULL;
385 	log_query_info(VERB_ALGO, "generate request", &ask);
386 	/* enable valrec flag to avoid recursion to the same validation
387 	 * routine, this lookup is simply a lookup. DLVs need validation */
388 	if(qtype == LDNS_RR_TYPE_DLV)
389 		valrec = 0;
390 	else valrec = 1;
391 	if(detached) {
392 		struct mesh_state* sub = NULL;
393 		fptr_ok(fptr_whitelist_modenv_add_sub(
394 			qstate->env->add_sub));
395 		if(!(*qstate->env->add_sub)(qstate, &ask,
396 			(uint16_t)(BIT_RD|flags), 0, valrec, newq, &sub)){
397 			log_err("Could not generate request: out of memory");
398 			return 0;
399 		}
400 	}
401 	else {
402 		fptr_ok(fptr_whitelist_modenv_attach_sub(
403 			qstate->env->attach_sub));
404 		if(!(*qstate->env->attach_sub)(qstate, &ask,
405 			(uint16_t)(BIT_RD|flags), 0, valrec, newq)){
406 			log_err("Could not generate request: out of memory");
407 			return 0;
408 		}
409 	}
410 	/* newq; validator does not need state created for that
411 	 * query, and its a 'normal' for iterator as well */
412 	if(*newq) {
413 		/* add our blacklist to the query blacklist */
414 		sock_list_merge(&(*newq)->blacklist, (*newq)->region,
415 			vq->chain_blacklist);
416 	}
417 	qstate->ext_state[id] = module_wait_subquery;
418 	return 1;
419 }
420 
421 /**
422  * Generate, send and detach key tag signaling query.
423  *
424  * @param qstate: query state.
425  * @param id: module id.
426  * @param ta: trust anchor, locked.
427  * @return false on a processing error.
428  */
429 static int
430 generate_keytag_query(struct module_qstate* qstate, int id,
431 	struct trust_anchor* ta)
432 {
433 	/* 3 bytes for "_ta", 5 bytes per tag (4 bytes + "-") */
434 #define MAX_LABEL_TAGS (LDNS_MAX_LABELLEN-3)/5
435 	size_t i, numtag;
436 	uint16_t tags[MAX_LABEL_TAGS];
437 	char tagstr[LDNS_MAX_LABELLEN+1] = "_ta"; /* +1 for NULL byte */
438 	size_t tagstr_left = sizeof(tagstr) - strlen(tagstr);
439 	char* tagstr_pos = tagstr + strlen(tagstr);
440 	uint8_t dnamebuf[LDNS_MAX_DOMAINLEN+1]; /* +1 for label length byte */
441 	size_t dnamebuf_len = sizeof(dnamebuf);
442 	uint8_t* keytagdname;
443 	struct module_qstate* newq = NULL;
444 	enum module_ext_state ext_state = qstate->ext_state[id];
445 
446 	numtag = anchor_list_keytags(ta, tags, MAX_LABEL_TAGS);
447 	if(numtag == 0)
448 		return 0;
449 
450 	for(i=0; i<numtag; i++) {
451 		/* Buffer can't overflow; numtag is limited to tags that fit in
452 		 * the buffer. */
453 		snprintf(tagstr_pos, tagstr_left, "-%04x", (unsigned)tags[i]);
454 		tagstr_left -= strlen(tagstr_pos);
455 		tagstr_pos += strlen(tagstr_pos);
456 	}
457 
458 	sldns_str2wire_dname_buf_origin(tagstr, dnamebuf, &dnamebuf_len,
459 		ta->name, ta->namelen);
460 	if(!(keytagdname = (uint8_t*)regional_alloc_init(qstate->region,
461 		dnamebuf, dnamebuf_len))) {
462 		log_err("could not generate key tag query: out of memory");
463 		return 0;
464 	}
465 
466 	log_nametypeclass(VERB_OPS, "generate keytag query", keytagdname,
467 		LDNS_RR_TYPE_NULL, ta->dclass);
468 	if(!generate_request(qstate, id, keytagdname, dnamebuf_len,
469 		LDNS_RR_TYPE_NULL, ta->dclass, 0, &newq, 1)) {
470 		log_err("failed to generate key tag signaling request");
471 		return 0;
472 	}
473 
474 	/* Not interrested in subquery response. Restore the ext_state,
475 	 * that might be changed by generate_request() */
476 	qstate->ext_state[id] = ext_state;
477 
478 	return 1;
479 }
480 
481 /**
482  * Get keytag as uint16_t from string
483  *
484  * @param start: start of string containing keytag
485  * @param keytag: pointer where to store the extracted keytag
486  * @return: 1 if keytag was extracted, else 0.
487  */
488 static int
489 sentinel_get_keytag(char* start, uint16_t* keytag) {
490 	char* keytag_str;
491 	char* e = NULL;
492 	keytag_str = calloc(1, SENTINEL_KEYTAG_LEN + 1 /* null byte */);
493 	if(!keytag_str)
494 		return 0;
495 	memmove(keytag_str, start, SENTINEL_KEYTAG_LEN);
496 	keytag_str[SENTINEL_KEYTAG_LEN] = '\0';
497 	*keytag = (uint16_t)strtol(keytag_str, &e, 10);
498 	if(!e || *e != '\0') {
499 		free(keytag_str);
500 		return 0;
501 	}
502 	free(keytag_str);
503 	return 1;
504 }
505 
506 /**
507  * Prime trust anchor for use.
508  * Generate and dispatch a priming query for the given trust anchor.
509  * The trust anchor can be DNSKEY or DS and does not have to be signed.
510  *
511  * @param qstate: query state.
512  * @param vq: validator query state.
513  * @param id: module id.
514  * @param toprime: what to prime.
515  * @return false on a processing error.
516  */
517 static int
518 prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq,
519 	int id, struct trust_anchor* toprime)
520 {
521 	struct module_qstate* newq = NULL;
522 	int ret = generate_request(qstate, id, toprime->name, toprime->namelen,
523 		LDNS_RR_TYPE_DNSKEY, toprime->dclass, BIT_CD, &newq, 0);
524 
525 	if(newq && qstate->env->cfg->trust_anchor_signaling &&
526 		!generate_keytag_query(qstate, id, toprime)) {
527 		log_err("keytag signaling query failed");
528 		return 0;
529 	}
530 
531 	if(!ret) {
532 		log_err("Could not prime trust anchor: out of memory");
533 		return 0;
534 	}
535 	/* ignore newq; validator does not need state created for that
536 	 * query, and its a 'normal' for iterator as well */
537 	vq->wait_prime_ta = 1; /* to elicit PRIME_RESP_STATE processing
538 		from the validator inform_super() routine */
539 	/* store trust anchor name for later lookup when prime returns */
540 	vq->trust_anchor_name = regional_alloc_init(qstate->region,
541 		toprime->name, toprime->namelen);
542 	vq->trust_anchor_len = toprime->namelen;
543 	vq->trust_anchor_labs = toprime->namelabs;
544 	if(!vq->trust_anchor_name) {
545 		log_err("Could not prime trust anchor: out of memory");
546 		return 0;
547 	}
548 	return 1;
549 }
550 
551 /**
552  * Validate if the ANSWER and AUTHORITY sections contain valid rrsets.
553  * They must be validly signed with the given key.
554  * Tries to validate ADDITIONAL rrsets as well, but only to check them.
555  * Allows unsigned CNAME after a DNAME that expands the DNAME.
556  *
557  * Note that by the time this method is called, the process of finding the
558  * trusted DNSKEY rrset that signs this response must already have been
559  * completed.
560  *
561  * @param qstate: query state.
562  * @param env: module env for verify.
563  * @param ve: validator env for verify.
564  * @param qchase: query that was made.
565  * @param chase_reply: answer to validate.
566  * @param key_entry: the key entry, which is trusted, and which matches
567  * 	the signer of the answer. The key entry isgood().
568  * @return false if any of the rrsets in the an or ns sections of the message
569  * 	fail to verify. The message is then set to bogus.
570  */
571 static int
572 validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
573 	struct val_env* ve, struct query_info* qchase,
574 	struct reply_info* chase_reply, struct key_entry_key* key_entry)
575 {
576 	uint8_t* sname;
577 	size_t i, slen;
578 	struct ub_packed_rrset_key* s;
579 	enum sec_status sec;
580 	int dname_seen = 0;
581 	char* reason = NULL;
582 
583 	/* validate the ANSWER section */
584 	for(i=0; i<chase_reply->an_numrrsets; i++) {
585 		s = chase_reply->rrsets[i];
586 		/* Skip the CNAME following a (validated) DNAME.
587 		 * Because of the normalization routines in the iterator,
588 		 * there will always be an unsigned CNAME following a DNAME
589 		 * (unless qtype=DNAME). */
590 		if(dname_seen && ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
591 			dname_seen = 0;
592 			/* CNAME was synthesized by our own iterator */
593 			/* since the DNAME verified, mark the CNAME as secure */
594 			((struct packed_rrset_data*)s->entry.data)->security =
595 				sec_status_secure;
596 			((struct packed_rrset_data*)s->entry.data)->trust =
597 				rrset_trust_validated;
598 			continue;
599 		}
600 
601 		/* Verify the answer rrset */
602 		sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
603 			LDNS_SECTION_ANSWER, qstate);
604 		/* If the (answer) rrset failed to validate, then this
605 		 * message is BAD. */
606 		if(sec != sec_status_secure) {
607 			log_nametypeclass(VERB_QUERY, "validator: response "
608 				"has failed ANSWER rrset:", s->rk.dname,
609 				ntohs(s->rk.type), ntohs(s->rk.rrset_class));
610 			errinf(qstate, reason);
611 			if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME)
612 				errinf(qstate, "for CNAME");
613 			else if(ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME)
614 				errinf(qstate, "for DNAME");
615 			errinf_origin(qstate, qstate->reply_origin);
616 			chase_reply->security = sec_status_bogus;
617 			return 0;
618 		}
619 
620 		/* Notice a DNAME that should be followed by an unsigned
621 		 * CNAME. */
622 		if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
623 			ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) {
624 			dname_seen = 1;
625 		}
626 	}
627 
628 	/* validate the AUTHORITY section */
629 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
630 		chase_reply->ns_numrrsets; i++) {
631 		s = chase_reply->rrsets[i];
632 		sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
633 			LDNS_SECTION_AUTHORITY, qstate);
634 		/* If anything in the authority section fails to be secure,
635 		 * we have a bad message. */
636 		if(sec != sec_status_secure) {
637 			log_nametypeclass(VERB_QUERY, "validator: response "
638 				"has failed AUTHORITY rrset:", s->rk.dname,
639 				ntohs(s->rk.type), ntohs(s->rk.rrset_class));
640 			errinf(qstate, reason);
641 			errinf_origin(qstate, qstate->reply_origin);
642 			errinf_rrset(qstate, s);
643 			chase_reply->security = sec_status_bogus;
644 			return 0;
645 		}
646 	}
647 
648 	/* If set, the validator should clean the additional section of
649 	 * secure messages. */
650 	if(!env->cfg->val_clean_additional)
651 		return 1;
652 	/* attempt to validate the ADDITIONAL section rrsets */
653 	for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
654 		i<chase_reply->rrset_count; i++) {
655 		s = chase_reply->rrsets[i];
656 		/* only validate rrs that have signatures with the key */
657 		/* leave others unchecked, those get removed later on too */
658 		val_find_rrset_signer(s, &sname, &slen);
659 		if(sname && query_dname_compare(sname, key_entry->name)==0)
660 			(void)val_verify_rrset_entry(env, ve, s, key_entry,
661 				&reason, LDNS_SECTION_ADDITIONAL, qstate);
662 		/* the additional section can fail to be secure,
663 		 * it is optional, check signature in case we need
664 		 * to clean the additional section later. */
665 	}
666 
667 	return 1;
668 }
669 
670 /**
671  * Detect wrong truncated response (say from BIND 9.6.1 that is forwarding
672  * and saw the NS record without signatures from a referral).
673  * The positive response has a mangled authority section.
674  * Remove that authority section and the additional section.
675  * @param rep: reply
676  * @return true if a wrongly truncated response.
677  */
678 static int
679 detect_wrongly_truncated(struct reply_info* rep)
680 {
681 	size_t i;
682 	/* only NS in authority, and it is bogus */
683 	if(rep->ns_numrrsets != 1 || rep->an_numrrsets == 0)
684 		return 0;
685 	if(ntohs(rep->rrsets[ rep->an_numrrsets ]->rk.type) != LDNS_RR_TYPE_NS)
686 		return 0;
687 	if(((struct packed_rrset_data*)rep->rrsets[ rep->an_numrrsets ]
688 		->entry.data)->security == sec_status_secure)
689 		return 0;
690 	/* answer section is present and secure */
691 	for(i=0; i<rep->an_numrrsets; i++) {
692 		if(((struct packed_rrset_data*)rep->rrsets[ i ]
693 			->entry.data)->security != sec_status_secure)
694 			return 0;
695 	}
696 	verbose(VERB_ALGO, "truncating to minimal response");
697 	return 1;
698 }
699 
700 /**
701  * For messages that are not referrals, if the chase reply contains an
702  * unsigned NS record in the authority section it could have been
703  * inserted by a (BIND) forwarder that thinks the zone is insecure, and
704  * that has an NS record without signatures in cache.  Remove the NS
705  * record since the reply does not hinge on that record (in the authority
706  * section), but do not remove it if it removes the last record from the
707  * answer+authority sections.
708  * @param chase_reply: the chased reply, we have a key for this contents,
709  * 	so we should have signatures for these rrsets and not having
710  * 	signatures means it will be bogus.
711  * @param orig_reply: original reply, remove NS from there as well because
712  * 	we cannot mark the NS record as DNSSEC valid because it is not
713  * 	validated by signatures.
714  */
715 static void
716 remove_spurious_authority(struct reply_info* chase_reply,
717 	struct reply_info* orig_reply)
718 {
719 	size_t i, found = 0;
720 	int remove = 0;
721 	/* if no answer and only 1 auth RRset, do not remove that one */
722 	if(chase_reply->an_numrrsets == 0 && chase_reply->ns_numrrsets == 1)
723 		return;
724 	/* search authority section for unsigned NS records */
725 	for(i = chase_reply->an_numrrsets;
726 		i < chase_reply->an_numrrsets+chase_reply->ns_numrrsets; i++) {
727 		struct packed_rrset_data* d = (struct packed_rrset_data*)
728 			chase_reply->rrsets[i]->entry.data;
729 		if(ntohs(chase_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
730 			&& d->rrsig_count == 0) {
731 			found = i;
732 			remove = 1;
733 			break;
734 		}
735 	}
736 	/* see if we found the entry */
737 	if(!remove) return;
738 	log_rrset_key(VERB_ALGO, "Removing spurious unsigned NS record "
739 		"(likely inserted by forwarder)", chase_reply->rrsets[found]);
740 
741 	/* find rrset in orig_reply */
742 	for(i = orig_reply->an_numrrsets;
743 		i < orig_reply->an_numrrsets+orig_reply->ns_numrrsets; i++) {
744 		if(ntohs(orig_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
745 			&& query_dname_compare(orig_reply->rrsets[i]->rk.dname,
746 				chase_reply->rrsets[found]->rk.dname) == 0) {
747 			/* remove from orig_msg */
748 			val_reply_remove_auth(orig_reply, i);
749 			break;
750 		}
751 	}
752 	/* remove rrset from chase_reply */
753 	val_reply_remove_auth(chase_reply, found);
754 }
755 
756 /**
757  * Given a "positive" response -- a response that contains an answer to the
758  * question, and no CNAME chain, validate this response.
759  *
760  * The answer and authority RRsets must already be verified as secure.
761  *
762  * @param env: module env for verify.
763  * @param ve: validator env for verify.
764  * @param qchase: query that was made.
765  * @param chase_reply: answer to that query to validate.
766  * @param kkey: the key entry, which is trusted, and which matches
767  * 	the signer of the answer. The key entry isgood().
768  */
769 static void
770 validate_positive_response(struct module_env* env, struct val_env* ve,
771 	struct query_info* qchase, struct reply_info* chase_reply,
772 	struct key_entry_key* kkey)
773 {
774 	uint8_t* wc = NULL;
775 	size_t wl;
776 	int wc_cached = 0;
777 	int wc_NSEC_ok = 0;
778 	int nsec3s_seen = 0;
779 	size_t i;
780 	struct ub_packed_rrset_key* s;
781 
782 	/* validate the ANSWER section - this will be the answer itself */
783 	for(i=0; i<chase_reply->an_numrrsets; i++) {
784 		s = chase_reply->rrsets[i];
785 
786 		/* Check to see if the rrset is the result of a wildcard
787 		 * expansion. If so, an additional check will need to be
788 		 * made in the authority section. */
789 		if(!val_rrset_wildcard(s, &wc, &wl)) {
790 			log_nametypeclass(VERB_QUERY, "Positive response has "
791 				"inconsistent wildcard sigs:", s->rk.dname,
792 				ntohs(s->rk.type), ntohs(s->rk.rrset_class));
793 			chase_reply->security = sec_status_bogus;
794 			return;
795 		}
796 		if(wc && !wc_cached && env->cfg->aggressive_nsec) {
797 			rrset_cache_update_wildcard(env->rrset_cache, s, wc, wl,
798 				env->alloc, *env->now);
799 			wc_cached = 1;
800 		}
801 
802 	}
803 
804 	/* validate the AUTHORITY section as well - this will generally be
805 	 * the NS rrset (which could be missing, no problem) */
806 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
807 		chase_reply->ns_numrrsets; i++) {
808 		s = chase_reply->rrsets[i];
809 
810 		/* If this is a positive wildcard response, and we have a
811 		 * (just verified) NSEC record, try to use it to 1) prove
812 		 * that qname doesn't exist and 2) that the correct wildcard
813 		 * was used. */
814 		if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
815 			if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
816 				wc_NSEC_ok = 1;
817 			}
818 			/* if not, continue looking for proof */
819 		}
820 
821 		/* Otherwise, if this is a positive wildcard response and
822 		 * we have NSEC3 records */
823 		if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
824 			nsec3s_seen = 1;
825 		}
826 	}
827 
828 	/* If this was a positive wildcard response that we haven't already
829 	 * proven, and we have NSEC3 records, try to prove it using the NSEC3
830 	 * records. */
831 	if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
832 		enum sec_status sec = nsec3_prove_wildcard(env, ve,
833 			chase_reply->rrsets+chase_reply->an_numrrsets,
834 			chase_reply->ns_numrrsets, qchase, kkey, wc);
835 		if(sec == sec_status_insecure) {
836 			verbose(VERB_ALGO, "Positive wildcard response is "
837 				"insecure");
838 			chase_reply->security = sec_status_insecure;
839 			return;
840 		} else if(sec == sec_status_secure)
841 			wc_NSEC_ok = 1;
842 	}
843 
844 	/* If after all this, we still haven't proven the positive wildcard
845 	 * response, fail. */
846 	if(wc != NULL && !wc_NSEC_ok) {
847 		verbose(VERB_QUERY, "positive response was wildcard "
848 			"expansion and did not prove original data "
849 			"did not exist");
850 		chase_reply->security = sec_status_bogus;
851 		return;
852 	}
853 
854 	verbose(VERB_ALGO, "Successfully validated positive response");
855 	chase_reply->security = sec_status_secure;
856 }
857 
858 /**
859  * Validate a NOERROR/NODATA signed response -- a response that has a
860  * NOERROR Rcode but no ANSWER section RRsets. This consists of making
861  * certain that the authority section NSEC/NSEC3s proves that the qname
862  * does exist and the qtype doesn't.
863  *
864  * The answer and authority RRsets must already be verified as secure.
865  *
866  * @param env: module env for verify.
867  * @param ve: validator env for verify.
868  * @param qchase: query that was made.
869  * @param chase_reply: answer to that query to validate.
870  * @param kkey: the key entry, which is trusted, and which matches
871  * 	the signer of the answer. The key entry isgood().
872  */
873 static void
874 validate_nodata_response(struct module_env* env, struct val_env* ve,
875 	struct query_info* qchase, struct reply_info* chase_reply,
876 	struct key_entry_key* kkey)
877 {
878 	/* Since we are here, there must be nothing in the ANSWER section to
879 	 * validate. */
880 	/* (Note: CNAME/DNAME responses will not directly get here --
881 	 * instead, they are chased down into individual CNAME validations,
882 	 * and at the end of the cname chain a POSITIVE, or CNAME_NOANSWER
883 	 * validation.) */
884 
885 	/* validate the AUTHORITY section */
886 	int has_valid_nsec = 0; /* If true, then the NODATA has been proven.*/
887 	uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
888 				proven closest encloser. */
889 	uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
890 	int nsec3s_seen = 0; /* nsec3s seen */
891 	struct ub_packed_rrset_key* s;
892 	size_t i;
893 
894 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
895 		chase_reply->ns_numrrsets; i++) {
896 		s = chase_reply->rrsets[i];
897 		/* If we encounter an NSEC record, try to use it to prove
898 		 * NODATA.
899 		 * This needs to handle the ENT NODATA case. */
900 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
901 			if(nsec_proves_nodata(s, qchase, &wc)) {
902 				has_valid_nsec = 1;
903 				/* sets wc-encloser if wildcard applicable */
904 			}
905 			if(val_nsec_proves_name_error(s, qchase->qname)) {
906 				ce = nsec_closest_encloser(qchase->qname, s);
907 			}
908 			if(val_nsec_proves_insecuredelegation(s, qchase)) {
909 				verbose(VERB_ALGO, "delegation is insecure");
910 				chase_reply->security = sec_status_insecure;
911 				return;
912 			}
913 		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
914 			nsec3s_seen = 1;
915 		}
916 	}
917 
918 	/* check to see if we have a wildcard NODATA proof. */
919 
920 	/* The wildcard NODATA is 1 NSEC proving that qname does not exist
921 	 * (and also proving what the closest encloser is), and 1 NSEC
922 	 * showing the matching wildcard, which must be *.closest_encloser. */
923 	if(wc && !ce)
924 		has_valid_nsec = 0;
925 	else if(wc && ce) {
926 		if(query_dname_compare(wc, ce) != 0) {
927 			has_valid_nsec = 0;
928 		}
929 	}
930 
931 	if(!has_valid_nsec && nsec3s_seen) {
932 		enum sec_status sec = nsec3_prove_nodata(env, ve,
933 			chase_reply->rrsets+chase_reply->an_numrrsets,
934 			chase_reply->ns_numrrsets, qchase, kkey);
935 		if(sec == sec_status_insecure) {
936 			verbose(VERB_ALGO, "NODATA response is insecure");
937 			chase_reply->security = sec_status_insecure;
938 			return;
939 		} else if(sec == sec_status_secure)
940 			has_valid_nsec = 1;
941 	}
942 
943 	if(!has_valid_nsec) {
944 		verbose(VERB_QUERY, "NODATA response failed to prove NODATA "
945 			"status with NSEC/NSEC3");
946 		if(verbosity >= VERB_ALGO)
947 			log_dns_msg("Failed NODATA", qchase, chase_reply);
948 		chase_reply->security = sec_status_bogus;
949 		return;
950 	}
951 
952 	verbose(VERB_ALGO, "successfully validated NODATA response.");
953 	chase_reply->security = sec_status_secure;
954 }
955 
956 /**
957  * Validate a NAMEERROR signed response -- a response that has a NXDOMAIN
958  * Rcode.
959  * This consists of making certain that the authority section NSEC proves
960  * that the qname doesn't exist and the covering wildcard also doesn't exist..
961  *
962  * The answer and authority RRsets must have already been verified as secure.
963  *
964  * @param env: module env for verify.
965  * @param ve: validator env for verify.
966  * @param qchase: query that was made.
967  * @param chase_reply: answer to that query to validate.
968  * @param kkey: the key entry, which is trusted, and which matches
969  * 	the signer of the answer. The key entry isgood().
970  * @param rcode: adjusted RCODE, in case of RCODE/proof mismatch leniency.
971  */
972 static void
973 validate_nameerror_response(struct module_env* env, struct val_env* ve,
974 	struct query_info* qchase, struct reply_info* chase_reply,
975 	struct key_entry_key* kkey, int* rcode)
976 {
977 	int has_valid_nsec = 0;
978 	int has_valid_wnsec = 0;
979 	int nsec3s_seen = 0;
980 	struct ub_packed_rrset_key* s;
981 	size_t i;
982 	uint8_t* ce;
983 	int ce_labs = 0;
984 	int prev_ce_labs = 0;
985 
986 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
987 		chase_reply->ns_numrrsets; i++) {
988 		s = chase_reply->rrsets[i];
989 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
990 			if(val_nsec_proves_name_error(s, qchase->qname))
991 				has_valid_nsec = 1;
992 			ce = nsec_closest_encloser(qchase->qname, s);
993 			ce_labs = dname_count_labels(ce);
994 			/* Use longest closest encloser to prove wildcard. */
995 			if(ce_labs > prev_ce_labs ||
996 			       (ce_labs == prev_ce_labs &&
997 				       has_valid_wnsec == 0)) {
998 			       if(val_nsec_proves_no_wc(s, qchase->qname,
999 				       qchase->qname_len))
1000 				       has_valid_wnsec = 1;
1001 			       else
1002 				       has_valid_wnsec = 0;
1003 			}
1004 			prev_ce_labs = ce_labs;
1005 			if(val_nsec_proves_insecuredelegation(s, qchase)) {
1006 				verbose(VERB_ALGO, "delegation is insecure");
1007 				chase_reply->security = sec_status_insecure;
1008 				return;
1009 			}
1010 		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3)
1011 			nsec3s_seen = 1;
1012 	}
1013 
1014 	if((!has_valid_nsec || !has_valid_wnsec) && nsec3s_seen) {
1015 		/* use NSEC3 proof, both answer and auth rrsets, in case
1016 		 * NSEC3s end up in the answer (due to qtype=NSEC3 or so) */
1017 		chase_reply->security = nsec3_prove_nameerror(env, ve,
1018 			chase_reply->rrsets, chase_reply->an_numrrsets+
1019 			chase_reply->ns_numrrsets, qchase, kkey);
1020 		if(chase_reply->security != sec_status_secure) {
1021 			verbose(VERB_QUERY, "NameError response failed nsec, "
1022 				"nsec3 proof was %s", sec_status_to_string(
1023 				chase_reply->security));
1024 			return;
1025 		}
1026 		has_valid_nsec = 1;
1027 		has_valid_wnsec = 1;
1028 	}
1029 
1030 	/* If the message fails to prove either condition, it is bogus. */
1031 	if(!has_valid_nsec) {
1032 		verbose(VERB_QUERY, "NameError response has failed to prove: "
1033 		          "qname does not exist");
1034 		chase_reply->security = sec_status_bogus;
1035 		/* Be lenient with RCODE in NSEC NameError responses */
1036 		validate_nodata_response(env, ve, qchase, chase_reply, kkey);
1037 		if (chase_reply->security == sec_status_secure)
1038 			*rcode = LDNS_RCODE_NOERROR;
1039 		return;
1040 	}
1041 
1042 	if(!has_valid_wnsec) {
1043 		verbose(VERB_QUERY, "NameError response has failed to prove: "
1044 		          "covering wildcard does not exist");
1045 		chase_reply->security = sec_status_bogus;
1046 		/* Be lenient with RCODE in NSEC NameError responses */
1047 		validate_nodata_response(env, ve, qchase, chase_reply, kkey);
1048 		if (chase_reply->security == sec_status_secure)
1049 			*rcode = LDNS_RCODE_NOERROR;
1050 		return;
1051 	}
1052 
1053 	/* Otherwise, we consider the message secure. */
1054 	verbose(VERB_ALGO, "successfully validated NAME ERROR response.");
1055 	chase_reply->security = sec_status_secure;
1056 }
1057 
1058 /**
1059  * Given a referral response, validate rrsets and take least trusted rrset
1060  * as the current validation status.
1061  *
1062  * Note that by the time this method is called, the process of finding the
1063  * trusted DNSKEY rrset that signs this response must already have been
1064  * completed.
1065  *
1066  * @param chase_reply: answer to validate.
1067  */
1068 static void
1069 validate_referral_response(struct reply_info* chase_reply)
1070 {
1071 	size_t i;
1072 	enum sec_status s;
1073 	/* message security equals lowest rrset security */
1074 	chase_reply->security = sec_status_secure;
1075 	for(i=0; i<chase_reply->rrset_count; i++) {
1076 		s = ((struct packed_rrset_data*)chase_reply->rrsets[i]
1077 			->entry.data)->security;
1078 		if(s < chase_reply->security)
1079 			chase_reply->security = s;
1080 	}
1081 	verbose(VERB_ALGO, "validated part of referral response as %s",
1082 		sec_status_to_string(chase_reply->security));
1083 }
1084 
1085 /**
1086  * Given an "ANY" response -- a response that contains an answer to a
1087  * qtype==ANY question, with answers. This does no checking that all
1088  * types are present.
1089  *
1090  * NOTE: it may be possible to get parent-side delegation point records
1091  * here, which won't all be signed. Right now, this routine relies on the
1092  * upstream iterative resolver to not return these responses -- instead
1093  * treating them as referrals.
1094  *
1095  * NOTE: RFC 4035 is silent on this issue, so this may change upon
1096  * clarification. Clarification draft -05 says to not check all types are
1097  * present.
1098  *
1099  * Note that by the time this method is called, the process of finding the
1100  * trusted DNSKEY rrset that signs this response must already have been
1101  * completed.
1102  *
1103  * @param env: module env for verify.
1104  * @param ve: validator env for verify.
1105  * @param qchase: query that was made.
1106  * @param chase_reply: answer to that query to validate.
1107  * @param kkey: the key entry, which is trusted, and which matches
1108  * 	the signer of the answer. The key entry isgood().
1109  */
1110 static void
1111 validate_any_response(struct module_env* env, struct val_env* ve,
1112 	struct query_info* qchase, struct reply_info* chase_reply,
1113 	struct key_entry_key* kkey)
1114 {
1115 	/* all answer and auth rrsets already verified */
1116 	/* but check if a wildcard response is given, then check NSEC/NSEC3
1117 	 * for qname denial to see if wildcard is applicable */
1118 	uint8_t* wc = NULL;
1119 	size_t wl;
1120 	int wc_NSEC_ok = 0;
1121 	int nsec3s_seen = 0;
1122 	size_t i;
1123 	struct ub_packed_rrset_key* s;
1124 
1125 	if(qchase->qtype != LDNS_RR_TYPE_ANY) {
1126 		log_err("internal error: ANY validation called for non-ANY");
1127 		chase_reply->security = sec_status_bogus;
1128 		return;
1129 	}
1130 
1131 	/* validate the ANSWER section - this will be the answer itself */
1132 	for(i=0; i<chase_reply->an_numrrsets; i++) {
1133 		s = chase_reply->rrsets[i];
1134 
1135 		/* Check to see if the rrset is the result of a wildcard
1136 		 * expansion. If so, an additional check will need to be
1137 		 * made in the authority section. */
1138 		if(!val_rrset_wildcard(s, &wc, &wl)) {
1139 			log_nametypeclass(VERB_QUERY, "Positive ANY response"
1140 				" has inconsistent wildcard sigs:",
1141 				s->rk.dname, ntohs(s->rk.type),
1142 				ntohs(s->rk.rrset_class));
1143 			chase_reply->security = sec_status_bogus;
1144 			return;
1145 		}
1146 	}
1147 
1148 	/* if it was a wildcard, check for NSEC/NSEC3s in both answer
1149 	 * and authority sections (NSEC may be moved to the ANSWER section) */
1150 	if(wc != NULL)
1151 	  for(i=0; i<chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
1152 	  	i++) {
1153 		s = chase_reply->rrsets[i];
1154 
1155 		/* If this is a positive wildcard response, and we have a
1156 		 * (just verified) NSEC record, try to use it to 1) prove
1157 		 * that qname doesn't exist and 2) that the correct wildcard
1158 		 * was used. */
1159 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1160 			if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1161 				wc_NSEC_ok = 1;
1162 			}
1163 			/* if not, continue looking for proof */
1164 		}
1165 
1166 		/* Otherwise, if this is a positive wildcard response and
1167 		 * we have NSEC3 records */
1168 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1169 			nsec3s_seen = 1;
1170 		}
1171 	}
1172 
1173 	/* If this was a positive wildcard response that we haven't already
1174 	 * proven, and we have NSEC3 records, try to prove it using the NSEC3
1175 	 * records. */
1176 	if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1177 		/* look both in answer and auth section for NSEC3s */
1178 		enum sec_status sec = nsec3_prove_wildcard(env, ve,
1179 			chase_reply->rrsets,
1180 			chase_reply->an_numrrsets+chase_reply->ns_numrrsets,
1181 			qchase, kkey, wc);
1182 		if(sec == sec_status_insecure) {
1183 			verbose(VERB_ALGO, "Positive ANY wildcard response is "
1184 				"insecure");
1185 			chase_reply->security = sec_status_insecure;
1186 			return;
1187 		} else if(sec == sec_status_secure)
1188 			wc_NSEC_ok = 1;
1189 	}
1190 
1191 	/* If after all this, we still haven't proven the positive wildcard
1192 	 * response, fail. */
1193 	if(wc != NULL && !wc_NSEC_ok) {
1194 		verbose(VERB_QUERY, "positive ANY response was wildcard "
1195 			"expansion and did not prove original data "
1196 			"did not exist");
1197 		chase_reply->security = sec_status_bogus;
1198 		return;
1199 	}
1200 
1201 	verbose(VERB_ALGO, "Successfully validated positive ANY response");
1202 	chase_reply->security = sec_status_secure;
1203 }
1204 
1205 /**
1206  * Validate CNAME response, or DNAME+CNAME.
1207  * This is just like a positive proof, except that this is about a
1208  * DNAME+CNAME. Possible wildcard proof.
1209  * Difference with positive proof is that this routine refuses
1210  * wildcarded DNAMEs.
1211  *
1212  * The answer and authority rrsets must already be verified as secure.
1213  *
1214  * @param env: module env for verify.
1215  * @param ve: validator env for verify.
1216  * @param qchase: query that was made.
1217  * @param chase_reply: answer to that query to validate.
1218  * @param kkey: the key entry, which is trusted, and which matches
1219  * 	the signer of the answer. The key entry isgood().
1220  */
1221 static void
1222 validate_cname_response(struct module_env* env, struct val_env* ve,
1223 	struct query_info* qchase, struct reply_info* chase_reply,
1224 	struct key_entry_key* kkey)
1225 {
1226 	uint8_t* wc = NULL;
1227 	size_t wl;
1228 	int wc_NSEC_ok = 0;
1229 	int nsec3s_seen = 0;
1230 	size_t i;
1231 	struct ub_packed_rrset_key* s;
1232 
1233 	/* validate the ANSWER section - this will be the CNAME (+DNAME) */
1234 	for(i=0; i<chase_reply->an_numrrsets; i++) {
1235 		s = chase_reply->rrsets[i];
1236 
1237 		/* Check to see if the rrset is the result of a wildcard
1238 		 * expansion. If so, an additional check will need to be
1239 		 * made in the authority section. */
1240 		if(!val_rrset_wildcard(s, &wc, &wl)) {
1241 			log_nametypeclass(VERB_QUERY, "Cname response has "
1242 				"inconsistent wildcard sigs:", s->rk.dname,
1243 				ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1244 			chase_reply->security = sec_status_bogus;
1245 			return;
1246 		}
1247 
1248 		/* Refuse wildcarded DNAMEs rfc 4597.
1249 		 * Do not follow a wildcarded DNAME because
1250 		 * its synthesized CNAME expansion is underdefined */
1251 		if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
1252 			ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME && wc) {
1253 			log_nametypeclass(VERB_QUERY, "cannot validate a "
1254 				"wildcarded DNAME:", s->rk.dname,
1255 				ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1256 			chase_reply->security = sec_status_bogus;
1257 			return;
1258 		}
1259 
1260 		/* If we have found a CNAME, stop looking for one.
1261 		 * The iterator has placed the CNAME chain in correct
1262 		 * order. */
1263 		if (ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
1264 			break;
1265 		}
1266 	}
1267 
1268 	/* AUTHORITY section */
1269 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1270 		chase_reply->ns_numrrsets; i++) {
1271 		s = chase_reply->rrsets[i];
1272 
1273 		/* If this is a positive wildcard response, and we have a
1274 		 * (just verified) NSEC record, try to use it to 1) prove
1275 		 * that qname doesn't exist and 2) that the correct wildcard
1276 		 * was used. */
1277 		if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1278 			if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1279 				wc_NSEC_ok = 1;
1280 			}
1281 			/* if not, continue looking for proof */
1282 		}
1283 
1284 		/* Otherwise, if this is a positive wildcard response and
1285 		 * we have NSEC3 records */
1286 		if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1287 			nsec3s_seen = 1;
1288 		}
1289 	}
1290 
1291 	/* If this was a positive wildcard response that we haven't already
1292 	 * proven, and we have NSEC3 records, try to prove it using the NSEC3
1293 	 * records. */
1294 	if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1295 		enum sec_status sec = nsec3_prove_wildcard(env, ve,
1296 			chase_reply->rrsets+chase_reply->an_numrrsets,
1297 			chase_reply->ns_numrrsets, qchase, kkey, wc);
1298 		if(sec == sec_status_insecure) {
1299 			verbose(VERB_ALGO, "wildcard CNAME response is "
1300 				"insecure");
1301 			chase_reply->security = sec_status_insecure;
1302 			return;
1303 		} else if(sec == sec_status_secure)
1304 			wc_NSEC_ok = 1;
1305 	}
1306 
1307 	/* If after all this, we still haven't proven the positive wildcard
1308 	 * response, fail. */
1309 	if(wc != NULL && !wc_NSEC_ok) {
1310 		verbose(VERB_QUERY, "CNAME response was wildcard "
1311 			"expansion and did not prove original data "
1312 			"did not exist");
1313 		chase_reply->security = sec_status_bogus;
1314 		return;
1315 	}
1316 
1317 	verbose(VERB_ALGO, "Successfully validated CNAME response");
1318 	chase_reply->security = sec_status_secure;
1319 }
1320 
1321 /**
1322  * Validate CNAME NOANSWER response, no more data after a CNAME chain.
1323  * This can be a NODATA or a NAME ERROR case, but not both at the same time.
1324  * We don't know because the rcode has been set to NOERROR by the CNAME.
1325  *
1326  * The answer and authority rrsets must already be verified as secure.
1327  *
1328  * @param env: module env for verify.
1329  * @param ve: validator env for verify.
1330  * @param qchase: query that was made.
1331  * @param chase_reply: answer to that query to validate.
1332  * @param kkey: the key entry, which is trusted, and which matches
1333  * 	the signer of the answer. The key entry isgood().
1334  */
1335 static void
1336 validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
1337 	struct query_info* qchase, struct reply_info* chase_reply,
1338 	struct key_entry_key* kkey)
1339 {
1340 	int nodata_valid_nsec = 0; /* If true, then NODATA has been proven.*/
1341 	uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
1342 				proven closest encloser. */
1343 	uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
1344 	int nxdomain_valid_nsec = 0; /* if true, nameerror has been proven */
1345 	int nxdomain_valid_wnsec = 0;
1346 	int nsec3s_seen = 0; /* nsec3s seen */
1347 	struct ub_packed_rrset_key* s;
1348 	size_t i;
1349 	uint8_t* nsec_ce; /* Used to find the NSEC with the longest ce */
1350 	int ce_labs = 0;
1351 	int prev_ce_labs = 0;
1352 
1353 	/* the AUTHORITY section */
1354 	for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1355 		chase_reply->ns_numrrsets; i++) {
1356 		s = chase_reply->rrsets[i];
1357 
1358 		/* If we encounter an NSEC record, try to use it to prove
1359 		 * NODATA. This needs to handle the ENT NODATA case.
1360 		 * Also try to prove NAMEERROR, and absence of a wildcard */
1361 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1362 			if(nsec_proves_nodata(s, qchase, &wc)) {
1363 				nodata_valid_nsec = 1;
1364 				/* set wc encloser if wildcard applicable */
1365 			}
1366 			if(val_nsec_proves_name_error(s, qchase->qname)) {
1367 				ce = nsec_closest_encloser(qchase->qname, s);
1368 				nxdomain_valid_nsec = 1;
1369 			}
1370 			nsec_ce = nsec_closest_encloser(qchase->qname, s);
1371 			ce_labs = dname_count_labels(nsec_ce);
1372 			/* Use longest closest encloser to prove wildcard. */
1373 			if(ce_labs > prev_ce_labs ||
1374 			       (ce_labs == prev_ce_labs &&
1375 				       nxdomain_valid_wnsec == 0)) {
1376 			       if(val_nsec_proves_no_wc(s, qchase->qname,
1377 				       qchase->qname_len))
1378 				       nxdomain_valid_wnsec = 1;
1379 			       else
1380 				       nxdomain_valid_wnsec = 0;
1381 			}
1382 			prev_ce_labs = ce_labs;
1383 			if(val_nsec_proves_insecuredelegation(s, qchase)) {
1384 				verbose(VERB_ALGO, "delegation is insecure");
1385 				chase_reply->security = sec_status_insecure;
1386 				return;
1387 			}
1388 		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1389 			nsec3s_seen = 1;
1390 		}
1391 	}
1392 
1393 	/* check to see if we have a wildcard NODATA proof. */
1394 
1395 	/* The wildcard NODATA is 1 NSEC proving that qname does not exists
1396 	 * (and also proving what the closest encloser is), and 1 NSEC
1397 	 * showing the matching wildcard, which must be *.closest_encloser. */
1398 	if(wc && !ce)
1399 		nodata_valid_nsec = 0;
1400 	else if(wc && ce) {
1401 		if(query_dname_compare(wc, ce) != 0) {
1402 			nodata_valid_nsec = 0;
1403 		}
1404 	}
1405 	if(nxdomain_valid_nsec && !nxdomain_valid_wnsec) {
1406 		/* name error is missing wildcard denial proof */
1407 		nxdomain_valid_nsec = 0;
1408 	}
1409 
1410 	if(nodata_valid_nsec && nxdomain_valid_nsec) {
1411 		verbose(VERB_QUERY, "CNAMEchain to noanswer proves that name "
1412 			"exists and not exists, bogus");
1413 		chase_reply->security = sec_status_bogus;
1414 		return;
1415 	}
1416 	if(!nodata_valid_nsec && !nxdomain_valid_nsec && nsec3s_seen) {
1417 		int nodata;
1418 		enum sec_status sec = nsec3_prove_nxornodata(env, ve,
1419 			chase_reply->rrsets+chase_reply->an_numrrsets,
1420 			chase_reply->ns_numrrsets, qchase, kkey, &nodata);
1421 		if(sec == sec_status_insecure) {
1422 			verbose(VERB_ALGO, "CNAMEchain to noanswer response "
1423 				"is insecure");
1424 			chase_reply->security = sec_status_insecure;
1425 			return;
1426 		} else if(sec == sec_status_secure) {
1427 			if(nodata)
1428 				nodata_valid_nsec = 1;
1429 			else	nxdomain_valid_nsec = 1;
1430 		}
1431 	}
1432 
1433 	if(!nodata_valid_nsec && !nxdomain_valid_nsec) {
1434 		verbose(VERB_QUERY, "CNAMEchain to noanswer response failed "
1435 			"to prove status with NSEC/NSEC3");
1436 		if(verbosity >= VERB_ALGO)
1437 			log_dns_msg("Failed CNAMEnoanswer", qchase, chase_reply);
1438 		chase_reply->security = sec_status_bogus;
1439 		return;
1440 	}
1441 
1442 	if(nodata_valid_nsec)
1443 		verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1444 			"NODATA response.");
1445 	else	verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1446 			"NAMEERROR response.");
1447 	chase_reply->security = sec_status_secure;
1448 }
1449 
1450 /**
1451  * Process init state for validator.
1452  * Process the INIT state. First tier responses start in the INIT state.
1453  * This is where they are vetted for validation suitability, and the initial
1454  * key search is done.
1455  *
1456  * Currently, events the come through this routine will be either promoted
1457  * to FINISHED/CNAME_RESP (no validation needed), FINDKEY (next step to
1458  * validation), or will be (temporarily) retired and a new priming request
1459  * event will be generated.
1460  *
1461  * @param qstate: query state.
1462  * @param vq: validator query state.
1463  * @param ve: validator shared global environment.
1464  * @param id: module id.
1465  * @return true if the event should be processed further on return, false if
1466  *         not.
1467  */
1468 static int
1469 processInit(struct module_qstate* qstate, struct val_qstate* vq,
1470 	struct val_env* ve, int id)
1471 {
1472 	uint8_t* lookup_name;
1473 	size_t lookup_len;
1474 	struct trust_anchor* anchor;
1475 	enum val_classification subtype = val_classify_response(
1476 		qstate->query_flags, &qstate->qinfo, &vq->qchase,
1477 		vq->orig_msg->rep, vq->rrset_skip);
1478 	if(vq->restart_count > VAL_MAX_RESTART_COUNT) {
1479 		verbose(VERB_ALGO, "restart count exceeded");
1480 		return val_error(qstate, id);
1481 	}
1482 	verbose(VERB_ALGO, "validator classification %s",
1483 		val_classification_to_string(subtype));
1484 	if(subtype == VAL_CLASS_REFERRAL &&
1485 		vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
1486 		/* referral uses the rrset name as qchase, to find keys for
1487 		 * that rrset */
1488 		vq->qchase.qname = vq->orig_msg->rep->
1489 			rrsets[vq->rrset_skip]->rk.dname;
1490 		vq->qchase.qname_len = vq->orig_msg->rep->
1491 			rrsets[vq->rrset_skip]->rk.dname_len;
1492 		vq->qchase.qtype = ntohs(vq->orig_msg->rep->
1493 			rrsets[vq->rrset_skip]->rk.type);
1494 		vq->qchase.qclass = ntohs(vq->orig_msg->rep->
1495 			rrsets[vq->rrset_skip]->rk.rrset_class);
1496 	}
1497 	lookup_name = vq->qchase.qname;
1498 	lookup_len = vq->qchase.qname_len;
1499 	/* for type DS look at the parent side for keys/trustanchor */
1500 	/* also for NSEC not at apex */
1501 	if(vq->qchase.qtype == LDNS_RR_TYPE_DS ||
1502 		(vq->qchase.qtype == LDNS_RR_TYPE_NSEC &&
1503 		 vq->orig_msg->rep->rrset_count > vq->rrset_skip &&
1504 		 ntohs(vq->orig_msg->rep->rrsets[vq->rrset_skip]->rk.type) ==
1505 		 LDNS_RR_TYPE_NSEC &&
1506 		 !(vq->orig_msg->rep->rrsets[vq->rrset_skip]->
1507 		 rk.flags&PACKED_RRSET_NSEC_AT_APEX))) {
1508 		dname_remove_label(&lookup_name, &lookup_len);
1509 	}
1510 
1511 	val_mark_indeterminate(vq->chase_reply, qstate->env->anchors,
1512 		qstate->env->rrset_cache, qstate->env);
1513 	vq->key_entry = NULL;
1514 	vq->empty_DS_name = NULL;
1515 	vq->ds_rrset = 0;
1516 	anchor = anchors_lookup(qstate->env->anchors,
1517 		lookup_name, lookup_len, vq->qchase.qclass);
1518 
1519 	/* Determine the signer/lookup name */
1520 	val_find_signer(subtype, &vq->qchase, vq->orig_msg->rep,
1521 		vq->rrset_skip, &vq->signer_name, &vq->signer_len);
1522 	if(vq->signer_name != NULL &&
1523 		!dname_subdomain_c(lookup_name, vq->signer_name)) {
1524 		log_nametypeclass(VERB_ALGO, "this signer name is not a parent "
1525 			"of lookupname, omitted", vq->signer_name, 0, 0);
1526 		vq->signer_name = NULL;
1527 	}
1528 	if(vq->signer_name == NULL) {
1529 		log_nametypeclass(VERB_ALGO, "no signer, using", lookup_name,
1530 			0, 0);
1531 	} else {
1532 		lookup_name = vq->signer_name;
1533 		lookup_len = vq->signer_len;
1534 		log_nametypeclass(VERB_ALGO, "signer is", lookup_name, 0, 0);
1535 	}
1536 
1537 	/* for NXDOMAIN it could be signed by a parent of the trust anchor */
1538 	if(subtype == VAL_CLASS_NAMEERROR && vq->signer_name &&
1539 		anchor && dname_strict_subdomain_c(anchor->name, lookup_name)){
1540 		lock_basic_unlock(&anchor->lock);
1541 		anchor = anchors_lookup(qstate->env->anchors,
1542 			lookup_name, lookup_len, vq->qchase.qclass);
1543 		if(!anchor) { /* unsigned parent denies anchor*/
1544 			verbose(VERB_QUERY, "unsigned parent zone denies"
1545 				" trust anchor, indeterminate");
1546 			vq->chase_reply->security = sec_status_indeterminate;
1547 			vq->state = VAL_FINISHED_STATE;
1548 			return 1;
1549 		}
1550 		verbose(VERB_ALGO, "trust anchor NXDOMAIN by signed parent");
1551 	} else if(subtype == VAL_CLASS_POSITIVE &&
1552 		qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY &&
1553 		query_dname_compare(lookup_name, qstate->qinfo.qname) == 0) {
1554 		/* is a DNSKEY so lookup a bit higher since we want to
1555 		 * get it from a parent or from trustanchor */
1556 		dname_remove_label(&lookup_name, &lookup_len);
1557 	}
1558 
1559 	if(vq->rrset_skip > 0 || subtype == VAL_CLASS_CNAME ||
1560 		subtype == VAL_CLASS_REFERRAL) {
1561 		/* extract this part of orig_msg into chase_reply for
1562 		 * the eventual VALIDATE stage */
1563 		val_fill_reply(vq->chase_reply, vq->orig_msg->rep,
1564 			vq->rrset_skip, lookup_name, lookup_len,
1565 			vq->signer_name);
1566 		if(verbosity >= VERB_ALGO)
1567 			log_dns_msg("chased extract", &vq->qchase,
1568 				vq->chase_reply);
1569 	}
1570 
1571 	vq->key_entry = key_cache_obtain(ve->kcache, lookup_name, lookup_len,
1572 		vq->qchase.qclass, qstate->region, *qstate->env->now);
1573 
1574 	/* there is no key(from DLV) and no trust anchor */
1575 	if(vq->key_entry == NULL && anchor == NULL) {
1576 		/*response isn't under a trust anchor, so we cannot validate.*/
1577 		vq->chase_reply->security = sec_status_indeterminate;
1578 		/* go to finished state to cache this result */
1579 		vq->state = VAL_FINISHED_STATE;
1580 		return 1;
1581 	}
1582 	/* if not key, or if keyentry is *above* the trustanchor, i.e.
1583 	 * the keyentry is based on another (higher) trustanchor */
1584 	else if(vq->key_entry == NULL || (anchor &&
1585 		dname_strict_subdomain_c(anchor->name, vq->key_entry->name))) {
1586 		/* trust anchor is an 'unsigned' trust anchor */
1587 		if(anchor && anchor->numDS == 0 && anchor->numDNSKEY == 0) {
1588 			vq->chase_reply->security = sec_status_insecure;
1589 			val_mark_insecure(vq->chase_reply, anchor->name,
1590 				qstate->env->rrset_cache, qstate->env);
1591 			lock_basic_unlock(&anchor->lock);
1592 			vq->dlv_checked=1; /* skip DLV check */
1593 			/* go to finished state to cache this result */
1594 			vq->state = VAL_FINISHED_STATE;
1595 			return 1;
1596 		}
1597 		/* fire off a trust anchor priming query. */
1598 		verbose(VERB_DETAIL, "prime trust anchor");
1599 		if(!prime_trust_anchor(qstate, vq, id, anchor)) {
1600 			lock_basic_unlock(&anchor->lock);
1601 			return val_error(qstate, id);
1602 		}
1603 		lock_basic_unlock(&anchor->lock);
1604 		/* and otherwise, don't continue processing this event.
1605 		 * (it will be reactivated when the priming query returns). */
1606 		vq->state = VAL_FINDKEY_STATE;
1607 		return 0;
1608 	}
1609 	if(anchor) {
1610 		lock_basic_unlock(&anchor->lock);
1611 	}
1612 
1613 	if(key_entry_isnull(vq->key_entry)) {
1614 		/* response is under a null key, so we cannot validate
1615 		 * However, we do set the status to INSECURE, since it is
1616 		 * essentially proven insecure. */
1617 		vq->chase_reply->security = sec_status_insecure;
1618 		val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1619 			qstate->env->rrset_cache, qstate->env);
1620 		/* go to finished state to cache this result */
1621 		vq->state = VAL_FINISHED_STATE;
1622 		return 1;
1623 	} else if(key_entry_isbad(vq->key_entry)) {
1624 		/* key is bad, chain is bad, reply is bogus */
1625 		errinf_dname(qstate, "key for validation", vq->key_entry->name);
1626 		errinf(qstate, "is marked as invalid");
1627 		if(key_entry_get_reason(vq->key_entry)) {
1628 			errinf(qstate, "because of a previous");
1629 			errinf(qstate, key_entry_get_reason(vq->key_entry));
1630 		}
1631 		/* no retries, stop bothering the authority until timeout */
1632 		vq->restart_count = VAL_MAX_RESTART_COUNT;
1633 		vq->chase_reply->security = sec_status_bogus;
1634 		vq->state = VAL_FINISHED_STATE;
1635 		return 1;
1636 	}
1637 
1638 	/* otherwise, we have our "closest" cached key -- continue
1639 	 * processing in the next state. */
1640 	vq->state = VAL_FINDKEY_STATE;
1641 	return 1;
1642 }
1643 
1644 /**
1645  * Process the FINDKEY state. Generally this just calculates the next name
1646  * to query and either issues a DS or a DNSKEY query. It will check to see
1647  * if the correct key has already been reached, in which case it will
1648  * advance the event to the next state.
1649  *
1650  * @param qstate: query state.
1651  * @param vq: validator query state.
1652  * @param id: module id.
1653  * @return true if the event should be processed further on return, false if
1654  *         not.
1655  */
1656 static int
1657 processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
1658 {
1659 	uint8_t* target_key_name, *current_key_name;
1660 	size_t target_key_len;
1661 	int strip_lab;
1662 	struct module_qstate* newq = NULL;
1663 
1664 	log_query_info(VERB_ALGO, "validator: FindKey", &vq->qchase);
1665 	/* We know that state.key_entry is not 0 or bad key -- if it were,
1666 	 * then previous processing should have directed this event to
1667 	 * a different state.
1668 	 * It could be an isnull key, which signals that a DLV was just
1669 	 * done and the DNSKEY after the DLV failed with dnssec-retry state
1670 	 * and the DNSKEY has to be performed again. */
1671 	log_assert(vq->key_entry && !key_entry_isbad(vq->key_entry));
1672 	if(key_entry_isnull(vq->key_entry)) {
1673 		if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1674 			vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1675 			vq->qchase.qclass, BIT_CD, &newq, 0)) {
1676 			log_err("mem error generating DNSKEY request");
1677 			return val_error(qstate, id);
1678 		}
1679 		return 0;
1680 	}
1681 
1682 	target_key_name = vq->signer_name;
1683 	target_key_len = vq->signer_len;
1684 	if(!target_key_name) {
1685 		target_key_name = vq->qchase.qname;
1686 		target_key_len = vq->qchase.qname_len;
1687 	}
1688 
1689 	current_key_name = vq->key_entry->name;
1690 
1691 	/* If our current key entry matches our target, then we are done. */
1692 	if(query_dname_compare(target_key_name, current_key_name) == 0) {
1693 		vq->state = VAL_VALIDATE_STATE;
1694 		return 1;
1695 	}
1696 
1697 	if(vq->empty_DS_name) {
1698 		/* if the last empty nonterminal/emptyDS name we detected is
1699 		 * below the current key, use that name to make progress
1700 		 * along the chain of trust */
1701 		if(query_dname_compare(target_key_name,
1702 			vq->empty_DS_name) == 0) {
1703 			/* do not query for empty_DS_name again */
1704 			verbose(VERB_ALGO, "Cannot retrieve DS for signature");
1705 			errinf(qstate, "no signatures");
1706 			errinf_origin(qstate, qstate->reply_origin);
1707 			vq->chase_reply->security = sec_status_bogus;
1708 			vq->state = VAL_FINISHED_STATE;
1709 			return 1;
1710 		}
1711 		current_key_name = vq->empty_DS_name;
1712 	}
1713 
1714 	log_nametypeclass(VERB_ALGO, "current keyname", current_key_name,
1715 		LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1716 	log_nametypeclass(VERB_ALGO, "target keyname", target_key_name,
1717 		LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1718 	/* assert we are walking down the DNS tree */
1719 	if(!dname_subdomain_c(target_key_name, current_key_name)) {
1720 		verbose(VERB_ALGO, "bad signer name");
1721 		vq->chase_reply->security = sec_status_bogus;
1722 		vq->state = VAL_FINISHED_STATE;
1723 		return 1;
1724 	}
1725 	/* so this value is >= -1 */
1726 	strip_lab = dname_count_labels(target_key_name) -
1727 		dname_count_labels(current_key_name) - 1;
1728 	log_assert(strip_lab >= -1);
1729 	verbose(VERB_ALGO, "striplab %d", strip_lab);
1730 	if(strip_lab > 0) {
1731 		dname_remove_labels(&target_key_name, &target_key_len,
1732 			strip_lab);
1733 	}
1734 	log_nametypeclass(VERB_ALGO, "next keyname", target_key_name,
1735 		LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1736 
1737 	/* The next step is either to query for the next DS, or to query
1738 	 * for the next DNSKEY. */
1739 	if(vq->ds_rrset)
1740 		log_nametypeclass(VERB_ALGO, "DS RRset", vq->ds_rrset->rk.dname, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN);
1741 	else verbose(VERB_ALGO, "No DS RRset");
1742 
1743 	if(vq->ds_rrset && query_dname_compare(vq->ds_rrset->rk.dname,
1744 		vq->key_entry->name) != 0) {
1745 		if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1746 			vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1747 			vq->qchase.qclass, BIT_CD, &newq, 0)) {
1748 			log_err("mem error generating DNSKEY request");
1749 			return val_error(qstate, id);
1750 		}
1751 		return 0;
1752 	}
1753 
1754 	if(!vq->ds_rrset || query_dname_compare(vq->ds_rrset->rk.dname,
1755 		target_key_name) != 0) {
1756 		/* check if there is a cache entry : pick up an NSEC if
1757 		 * there is no DS, check if that NSEC has DS-bit unset, and
1758 		 * thus can disprove the secure delegation we seek.
1759 		 * We can then use that NSEC even in the absence of a SOA
1760 		 * record that would be required by the iterator to supply
1761 		 * a completely protocol-correct response.
1762 		 * Uses negative cache for NSEC3 lookup of DS responses. */
1763 		/* only if cache not blacklisted, of course */
1764 		struct dns_msg* msg;
1765 		if(!qstate->blacklist && !vq->chain_blacklist &&
1766 			(msg=val_find_DS(qstate->env, target_key_name,
1767 			target_key_len, vq->qchase.qclass, qstate->region,
1768 			vq->key_entry->name)) ) {
1769 			verbose(VERB_ALGO, "Process cached DS response");
1770 			process_ds_response(qstate, vq, id, LDNS_RCODE_NOERROR,
1771 				msg, &msg->qinfo, NULL);
1772 			return 1; /* continue processing ds-response results */
1773 		}
1774 		if(!generate_request(qstate, id, target_key_name,
1775 			target_key_len, LDNS_RR_TYPE_DS, vq->qchase.qclass,
1776 			BIT_CD, &newq, 0)) {
1777 			log_err("mem error generating DS request");
1778 			return val_error(qstate, id);
1779 		}
1780 		return 0;
1781 	}
1782 
1783 	/* Otherwise, it is time to query for the DNSKEY */
1784 	if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1785 		vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1786 		vq->qchase.qclass, BIT_CD, &newq, 0)) {
1787 		log_err("mem error generating DNSKEY request");
1788 		return val_error(qstate, id);
1789 	}
1790 
1791 	return 0;
1792 }
1793 
1794 /**
1795  * Process the VALIDATE stage, the init and findkey stages are finished,
1796  * and the right keys are available to validate the response.
1797  * Or, there are no keys available, in order to invalidate the response.
1798  *
1799  * After validation, the status is recorded in the message and rrsets,
1800  * and finished state is started.
1801  *
1802  * @param qstate: query state.
1803  * @param vq: validator query state.
1804  * @param ve: validator shared global environment.
1805  * @param id: module id.
1806  * @return true if the event should be processed further on return, false if
1807  *         not.
1808  */
1809 static int
1810 processValidate(struct module_qstate* qstate, struct val_qstate* vq,
1811 	struct val_env* ve, int id)
1812 {
1813 	enum val_classification subtype;
1814 	int rcode;
1815 
1816 	if(!vq->key_entry) {
1817 		verbose(VERB_ALGO, "validate: no key entry, failed");
1818 		return val_error(qstate, id);
1819 	}
1820 
1821 	/* This is the default next state. */
1822 	vq->state = VAL_FINISHED_STATE;
1823 
1824 	/* Unsigned responses must be underneath a "null" key entry.*/
1825 	if(key_entry_isnull(vq->key_entry)) {
1826 		verbose(VERB_DETAIL, "Verified that %sresponse is INSECURE",
1827 			vq->signer_name?"":"unsigned ");
1828 		vq->chase_reply->security = sec_status_insecure;
1829 		val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1830 			qstate->env->rrset_cache, qstate->env);
1831 		key_cache_insert(ve->kcache, vq->key_entry, qstate);
1832 		return 1;
1833 	}
1834 
1835 	if(key_entry_isbad(vq->key_entry)) {
1836 		log_nametypeclass(VERB_DETAIL, "Could not establish a chain "
1837 			"of trust to keys for", vq->key_entry->name,
1838 			LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class);
1839 		vq->chase_reply->security = sec_status_bogus;
1840 		errinf(qstate, "while building chain of trust");
1841 		if(vq->restart_count >= VAL_MAX_RESTART_COUNT)
1842 			key_cache_insert(ve->kcache, vq->key_entry, qstate);
1843 		return 1;
1844 	}
1845 
1846 	/* signerName being null is the indicator that this response was
1847 	 * unsigned */
1848 	if(vq->signer_name == NULL) {
1849 		log_query_info(VERB_ALGO, "processValidate: state has no "
1850 			"signer name", &vq->qchase);
1851 		verbose(VERB_DETAIL, "Could not establish validation of "
1852 		          "INSECURE status of unsigned response.");
1853 		errinf(qstate, "no signatures");
1854 		errinf_origin(qstate, qstate->reply_origin);
1855 		vq->chase_reply->security = sec_status_bogus;
1856 		return 1;
1857 	}
1858 	subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
1859 		&vq->qchase, vq->orig_msg->rep, vq->rrset_skip);
1860 	if(subtype != VAL_CLASS_REFERRAL)
1861 		remove_spurious_authority(vq->chase_reply, vq->orig_msg->rep);
1862 
1863 	/* check signatures in the message;
1864 	 * answer and authority must be valid, additional is only checked. */
1865 	if(!validate_msg_signatures(qstate, qstate->env, ve, &vq->qchase,
1866 		vq->chase_reply, vq->key_entry)) {
1867 		/* workaround bad recursor out there that truncates (even
1868 		 * with EDNS4k) to 512 by removing RRSIG from auth section
1869 		 * for positive replies*/
1870 		if((subtype == VAL_CLASS_POSITIVE || subtype == VAL_CLASS_ANY
1871 			|| subtype == VAL_CLASS_CNAME) &&
1872 			detect_wrongly_truncated(vq->orig_msg->rep)) {
1873 			/* truncate the message some more */
1874 			vq->orig_msg->rep->ns_numrrsets = 0;
1875 			vq->orig_msg->rep->ar_numrrsets = 0;
1876 			vq->orig_msg->rep->rrset_count =
1877 				vq->orig_msg->rep->an_numrrsets;
1878 			vq->chase_reply->ns_numrrsets = 0;
1879 			vq->chase_reply->ar_numrrsets = 0;
1880 			vq->chase_reply->rrset_count =
1881 				vq->chase_reply->an_numrrsets;
1882 			qstate->errinf = NULL;
1883 		}
1884 		else {
1885 			verbose(VERB_DETAIL, "Validate: message contains "
1886 				"bad rrsets");
1887 			return 1;
1888 		}
1889 	}
1890 
1891 	switch(subtype) {
1892 		case VAL_CLASS_POSITIVE:
1893 			verbose(VERB_ALGO, "Validating a positive response");
1894 			validate_positive_response(qstate->env, ve,
1895 				&vq->qchase, vq->chase_reply, vq->key_entry);
1896 			verbose(VERB_DETAIL, "validate(positive): %s",
1897 			  	sec_status_to_string(
1898 				vq->chase_reply->security));
1899 			break;
1900 
1901 		case VAL_CLASS_NODATA:
1902 			verbose(VERB_ALGO, "Validating a nodata response");
1903 			validate_nodata_response(qstate->env, ve,
1904 				&vq->qchase, vq->chase_reply, vq->key_entry);
1905 			verbose(VERB_DETAIL, "validate(nodata): %s",
1906 			  	sec_status_to_string(
1907 				vq->chase_reply->security));
1908 			break;
1909 
1910 		case VAL_CLASS_NAMEERROR:
1911 			rcode = (int)FLAGS_GET_RCODE(vq->orig_msg->rep->flags);
1912 			verbose(VERB_ALGO, "Validating a nxdomain response");
1913 			validate_nameerror_response(qstate->env, ve,
1914 				&vq->qchase, vq->chase_reply, vq->key_entry, &rcode);
1915 			verbose(VERB_DETAIL, "validate(nxdomain): %s",
1916 			  	sec_status_to_string(
1917 				vq->chase_reply->security));
1918 			FLAGS_SET_RCODE(vq->orig_msg->rep->flags, rcode);
1919 			FLAGS_SET_RCODE(vq->chase_reply->flags, rcode);
1920 			break;
1921 
1922 		case VAL_CLASS_CNAME:
1923 			verbose(VERB_ALGO, "Validating a cname response");
1924 			validate_cname_response(qstate->env, ve,
1925 				&vq->qchase, vq->chase_reply, vq->key_entry);
1926 			verbose(VERB_DETAIL, "validate(cname): %s",
1927 			  	sec_status_to_string(
1928 				vq->chase_reply->security));
1929 			break;
1930 
1931 		case VAL_CLASS_CNAMENOANSWER:
1932 			verbose(VERB_ALGO, "Validating a cname noanswer "
1933 				"response");
1934 			validate_cname_noanswer_response(qstate->env, ve,
1935 				&vq->qchase, vq->chase_reply, vq->key_entry);
1936 			verbose(VERB_DETAIL, "validate(cname_noanswer): %s",
1937 			  	sec_status_to_string(
1938 				vq->chase_reply->security));
1939 			break;
1940 
1941 		case VAL_CLASS_REFERRAL:
1942 			verbose(VERB_ALGO, "Validating a referral response");
1943 			validate_referral_response(vq->chase_reply);
1944 			verbose(VERB_DETAIL, "validate(referral): %s",
1945 			  	sec_status_to_string(
1946 				vq->chase_reply->security));
1947 			break;
1948 
1949 		case VAL_CLASS_ANY:
1950 			verbose(VERB_ALGO, "Validating a positive ANY "
1951 				"response");
1952 			validate_any_response(qstate->env, ve, &vq->qchase,
1953 				vq->chase_reply, vq->key_entry);
1954 			verbose(VERB_DETAIL, "validate(positive_any): %s",
1955 			  	sec_status_to_string(
1956 				vq->chase_reply->security));
1957 			break;
1958 
1959 		default:
1960 			log_err("validate: unhandled response subtype: %d",
1961 				subtype);
1962 	}
1963 	if(vq->chase_reply->security == sec_status_bogus) {
1964 		if(subtype == VAL_CLASS_POSITIVE)
1965 			errinf(qstate, "wildcard");
1966 		else errinf(qstate, val_classification_to_string(subtype));
1967 		errinf(qstate, "proof failed");
1968 		errinf_origin(qstate, qstate->reply_origin);
1969 	}
1970 
1971 	return 1;
1972 }
1973 
1974 /**
1975  * Init DLV check.
1976  * DLV is going to be decommissioned, but the code is still here for some time.
1977  *
1978  * Called when a query is determined by other trust anchors to be insecure
1979  * (or indeterminate).  Then we look if there is a key in the DLV.
1980  * Performs aggressive negative cache check to see if there is no key.
1981  * Otherwise, spawns a DLV query, and changes to the DLV wait state.
1982  *
1983  * @param qstate: query state.
1984  * @param vq: validator query state.
1985  * @param ve: validator shared global environment.
1986  * @param id: module id.
1987  * @return  true if there is no DLV.
1988  * 	false: processing is finished for the validator operate().
1989  * 	This function may exit in three ways:
1990  *         o	no DLV (aggressive cache), so insecure. (true)
1991  *         o	error - stop processing (false)
1992  *         o	DLV lookup was started, stop processing (false)
1993  */
1994 static int
1995 val_dlv_init(struct module_qstate* qstate, struct val_qstate* vq,
1996 	struct val_env* ve, int id)
1997 {
1998 	uint8_t* nm;
1999 	size_t nm_len;
2000 	struct module_qstate* newq = NULL;
2001 	/* there must be a DLV configured */
2002 	log_assert(qstate->env->anchors->dlv_anchor);
2003 	/* this bool is true to avoid looping in the DLV checks */
2004 	log_assert(vq->dlv_checked);
2005 
2006 	/* init the DLV lookup variables */
2007 	vq->dlv_lookup_name = NULL;
2008 	vq->dlv_lookup_name_len = 0;
2009 	vq->dlv_insecure_at = NULL;
2010 	vq->dlv_insecure_at_len = 0;
2011 
2012 	/* Determine the name for which we want to lookup DLV.
2013 	 * This name is for the current message, or
2014 	 * for the current RRset for CNAME, referral subtypes.
2015 	 * If there is a signer, use that, otherwise the domain name */
2016 	if(vq->signer_name) {
2017 		nm = vq->signer_name;
2018 		nm_len = vq->signer_len;
2019 	} else {
2020 		/* use qchase */
2021 		nm = vq->qchase.qname;
2022 		nm_len = vq->qchase.qname_len;
2023 		if(vq->qchase.qtype == LDNS_RR_TYPE_DS)
2024 			dname_remove_label(&nm, &nm_len);
2025 	}
2026 	log_nametypeclass(VERB_ALGO, "DLV init look", nm, LDNS_RR_TYPE_DS,
2027 		vq->qchase.qclass);
2028 	log_assert(nm && nm_len);
2029 	/* sanity check: no DLV lookups below the DLV anchor itself.
2030 	 * Like, an securely insecure delegation there makes no sense. */
2031 	if(dname_subdomain_c(nm, qstate->env->anchors->dlv_anchor->name)) {
2032 		verbose(VERB_ALGO, "DLV lookup within DLV repository denied");
2033 		return 1;
2034 	}
2035 	/* concat name (minus root label) + dlv name */
2036 	vq->dlv_lookup_name_len = nm_len - 1 +
2037 		qstate->env->anchors->dlv_anchor->namelen;
2038 	vq->dlv_lookup_name = regional_alloc(qstate->region,
2039 		vq->dlv_lookup_name_len);
2040 	if(!vq->dlv_lookup_name) {
2041 		log_err("Out of memory preparing DLV lookup");
2042 		return val_error(qstate, id);
2043 	}
2044 	memmove(vq->dlv_lookup_name, nm, nm_len-1);
2045 	memmove(vq->dlv_lookup_name+nm_len-1,
2046 		qstate->env->anchors->dlv_anchor->name,
2047 		qstate->env->anchors->dlv_anchor->namelen);
2048 	log_nametypeclass(VERB_ALGO, "DLV name", vq->dlv_lookup_name,
2049 		LDNS_RR_TYPE_DLV, vq->qchase.qclass);
2050 
2051 	/* determine where the insecure point was determined, the DLV must
2052 	 * be equal or below that to continue building the trust chain
2053 	 * down. May be NULL if no trust chain was built yet */
2054 	nm = NULL;
2055 	if(vq->key_entry && key_entry_isnull(vq->key_entry)) {
2056 		nm = vq->key_entry->name;
2057 		nm_len = vq->key_entry->namelen;
2058 	}
2059 	if(nm) {
2060 		vq->dlv_insecure_at_len = nm_len - 1 +
2061 			qstate->env->anchors->dlv_anchor->namelen;
2062 		vq->dlv_insecure_at = regional_alloc(qstate->region,
2063 			vq->dlv_insecure_at_len);
2064 		if(!vq->dlv_insecure_at) {
2065 			log_err("Out of memory preparing DLV lookup");
2066 			return val_error(qstate, id);
2067 		}
2068 		memmove(vq->dlv_insecure_at, nm, nm_len-1);
2069 		memmove(vq->dlv_insecure_at+nm_len-1,
2070 			qstate->env->anchors->dlv_anchor->name,
2071 			qstate->env->anchors->dlv_anchor->namelen);
2072 		log_nametypeclass(VERB_ALGO, "insecure_at",
2073 			vq->dlv_insecure_at, 0, vq->qchase.qclass);
2074 	}
2075 
2076 	/* If we can find the name in the aggressive negative cache,
2077 	 * give up; insecure is the answer */
2078 	while(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
2079 		vq->dlv_lookup_name_len, vq->qchase.qclass,
2080 		qstate->env->rrset_cache, *qstate->env->now)) {
2081 		/* go up */
2082 		dname_remove_label(&vq->dlv_lookup_name,
2083 			&vq->dlv_lookup_name_len);
2084 		/* too high? */
2085 		if(!dname_subdomain_c(vq->dlv_lookup_name,
2086 			qstate->env->anchors->dlv_anchor->name)) {
2087 			verbose(VERB_ALGO, "ask above dlv repo");
2088 			return 1; /* Above the repo is insecure */
2089 		}
2090 		/* above chain of trust? */
2091 		if(vq->dlv_insecure_at && !dname_subdomain_c(
2092 			vq->dlv_lookup_name, vq->dlv_insecure_at)) {
2093 			verbose(VERB_ALGO, "ask above insecure endpoint");
2094 			return 1;
2095 		}
2096 	}
2097 
2098 	/* perform a lookup for the DLV; with validation */
2099 	vq->state = VAL_DLVLOOKUP_STATE;
2100 	if(!generate_request(qstate, id, vq->dlv_lookup_name,
2101 		vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV,
2102 		vq->qchase.qclass, 0, &newq, 0)) {
2103 		return val_error(qstate, id);
2104 	}
2105 
2106 	/* Find the closest encloser DLV from the repository.
2107 	 * then that is used to build another chain of trust
2108 	 * This may first require a query 'too low' that has NSECs in
2109 	 * the answer, from which we determine the closest encloser DLV.
2110 	 * When determine the closest encloser, skip empty nonterminals,
2111 	 * since we want a nonempty node in the DLV repository. */
2112 
2113 	return 0;
2114 }
2115 
2116 /**
2117  * The Finished state. The validation status (good or bad) has been determined.
2118  *
2119  * @param qstate: query state.
2120  * @param vq: validator query state.
2121  * @param ve: validator shared global environment.
2122  * @param id: module id.
2123  * @return true if the event should be processed further on return, false if
2124  *         not.
2125  */
2126 static int
2127 processFinished(struct module_qstate* qstate, struct val_qstate* vq,
2128 	struct val_env* ve, int id)
2129 {
2130 	enum val_classification subtype = val_classify_response(
2131 		qstate->query_flags, &qstate->qinfo, &vq->qchase,
2132 		vq->orig_msg->rep, vq->rrset_skip);
2133 
2134 	/* if the result is insecure or indeterminate and we have not
2135 	 * checked the DLV yet, check the DLV */
2136 	if((vq->chase_reply->security == sec_status_insecure ||
2137 		vq->chase_reply->security == sec_status_indeterminate) &&
2138 		qstate->env->anchors->dlv_anchor && !vq->dlv_checked) {
2139 		vq->dlv_checked = 1;
2140 		if(!val_dlv_init(qstate, vq, ve, id))
2141 			return 0;
2142 	}
2143 
2144 	/* store overall validation result in orig_msg */
2145 	if(vq->rrset_skip == 0)
2146 		vq->orig_msg->rep->security = vq->chase_reply->security;
2147 	else if(subtype != VAL_CLASS_REFERRAL ||
2148 		vq->rrset_skip < vq->orig_msg->rep->an_numrrsets +
2149 		vq->orig_msg->rep->ns_numrrsets) {
2150 		/* ignore sec status of additional section if a referral
2151 		 * type message skips there and
2152 		 * use the lowest security status as end result. */
2153 		if(vq->chase_reply->security < vq->orig_msg->rep->security)
2154 			vq->orig_msg->rep->security =
2155 				vq->chase_reply->security;
2156 	}
2157 
2158 	if(subtype == VAL_CLASS_REFERRAL) {
2159 		/* for a referral, move to next unchecked rrset and check it*/
2160 		vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep,
2161 			vq->rrset_skip);
2162 		if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
2163 			/* and restart for this rrset */
2164 			verbose(VERB_ALGO, "validator: go to next rrset");
2165 			vq->chase_reply->security = sec_status_unchecked;
2166 			vq->dlv_checked = 0; /* can do DLV for this RR */
2167 			vq->state = VAL_INIT_STATE;
2168 			return 1;
2169 		}
2170 		/* referral chase is done */
2171 	}
2172 	if(vq->chase_reply->security != sec_status_bogus &&
2173 		subtype == VAL_CLASS_CNAME) {
2174 		/* chase the CNAME; process next part of the message */
2175 		if(!val_chase_cname(&vq->qchase, vq->orig_msg->rep,
2176 			&vq->rrset_skip)) {
2177 			verbose(VERB_ALGO, "validator: failed to chase CNAME");
2178 			vq->orig_msg->rep->security = sec_status_bogus;
2179 		} else {
2180 			/* restart process for new qchase at rrset_skip */
2181 			log_query_info(VERB_ALGO, "validator: chased to",
2182 				&vq->qchase);
2183 			vq->chase_reply->security = sec_status_unchecked;
2184 			vq->dlv_checked = 0; /* can do DLV for this RR */
2185 			vq->state = VAL_INIT_STATE;
2186 			return 1;
2187 		}
2188 	}
2189 
2190 	if(vq->orig_msg->rep->security == sec_status_secure) {
2191 		/* If the message is secure, check that all rrsets are
2192 		 * secure (i.e. some inserted RRset for CNAME chain with
2193 		 * a different signer name). And drop additional rrsets
2194 		 * that are not secure (if clean-additional option is set) */
2195 		/* this may cause the msg to be marked bogus */
2196 		val_check_nonsecure(qstate->env, vq->orig_msg->rep);
2197 		if(vq->orig_msg->rep->security == sec_status_secure) {
2198 			log_query_info(VERB_DETAIL, "validation success",
2199 				&qstate->qinfo);
2200 			if(!qstate->no_cache_store) {
2201 				val_neg_addreply(qstate->env->neg_cache,
2202 					vq->orig_msg->rep);
2203 			}
2204 		}
2205 	}
2206 
2207 	/* if the result is bogus - set message ttl to bogus ttl to avoid
2208 	 * endless bogus revalidation */
2209 	if(vq->orig_msg->rep->security == sec_status_bogus) {
2210 		/* see if we can try again to fetch data */
2211 		if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2212 			int restart_count = vq->restart_count+1;
2213 			verbose(VERB_ALGO, "validation failed, "
2214 				"blacklist and retry to fetch data");
2215 			val_blacklist(&qstate->blacklist, qstate->region,
2216 				qstate->reply_origin, 0);
2217 			qstate->reply_origin = NULL;
2218 			qstate->errinf = NULL;
2219 			memset(vq, 0, sizeof(*vq));
2220 			vq->restart_count = restart_count;
2221 			vq->state = VAL_INIT_STATE;
2222 			verbose(VERB_ALGO, "pass back to next module");
2223 			qstate->ext_state[id] = module_restart_next;
2224 			return 0;
2225 		}
2226 
2227 		vq->orig_msg->rep->ttl = ve->bogus_ttl;
2228 		vq->orig_msg->rep->prefetch_ttl =
2229 			PREFETCH_TTL_CALC(vq->orig_msg->rep->ttl);
2230 		if(qstate->env->cfg->val_log_level >= 1 &&
2231 			!qstate->env->cfg->val_log_squelch) {
2232 			if(qstate->env->cfg->val_log_level < 2)
2233 				log_query_info(0, "validation failure",
2234 					&qstate->qinfo);
2235 			else {
2236 				char* err = errinf_to_str(qstate);
2237 				if(err) log_info("%s", err);
2238 				free(err);
2239 			}
2240 		}
2241 		/*
2242 		 * If set, the validator will not make messages bogus, instead
2243 		 * indeterminate is issued, so that no clients receive SERVFAIL.
2244 		 * This allows an operator to run validation 'shadow' without
2245 		 * hurting responses to clients.
2246 		 */
2247 		/* If we are in permissive mode, bogus gets indeterminate */
2248 		if(qstate->env->cfg->val_permissive_mode)
2249 			vq->orig_msg->rep->security = sec_status_indeterminate;
2250 	}
2251 
2252 	if(vq->orig_msg->rep->security == sec_status_secure &&
2253 		qstate->env->cfg->root_key_sentinel &&
2254 		(qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
2255 		qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)) {
2256 		char* keytag_start;
2257 		uint16_t keytag;
2258 		if(*qstate->qinfo.qname == strlen(SENTINEL_IS) +
2259 			SENTINEL_KEYTAG_LEN &&
2260 			dname_lab_startswith(qstate->qinfo.qname, SENTINEL_IS,
2261 			&keytag_start)) {
2262 			if(sentinel_get_keytag(keytag_start, &keytag) &&
2263 				!anchor_has_keytag(qstate->env->anchors,
2264 				(uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) {
2265 				vq->orig_msg->rep->security =
2266 					sec_status_secure_sentinel_fail;
2267 			}
2268 		} else if(*qstate->qinfo.qname == strlen(SENTINEL_NOT) +
2269 			SENTINEL_KEYTAG_LEN &&
2270 			dname_lab_startswith(qstate->qinfo.qname, SENTINEL_NOT,
2271 			&keytag_start)) {
2272 			if(sentinel_get_keytag(keytag_start, &keytag) &&
2273 				anchor_has_keytag(qstate->env->anchors,
2274 				(uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) {
2275 				vq->orig_msg->rep->security =
2276 					sec_status_secure_sentinel_fail;
2277 			}
2278 		}
2279 	}
2280 	/* store results in cache */
2281 	if(qstate->query_flags&BIT_RD) {
2282 		/* if secure, this will override cache anyway, no need
2283 		 * to check if from parentNS */
2284 		if(!qstate->no_cache_store) {
2285 			if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2286 				vq->orig_msg->rep, 0, qstate->prefetch_leeway, 0, NULL,
2287 				qstate->query_flags)) {
2288 				log_err("out of memory caching validator results");
2289 			}
2290 		}
2291 	} else {
2292 		/* for a referral, store the verified RRsets */
2293 		/* and this does not get prefetched, so no leeway */
2294 		if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2295 			vq->orig_msg->rep, 1, 0, 0, NULL,
2296 			qstate->query_flags)) {
2297 			log_err("out of memory caching validator results");
2298 		}
2299 	}
2300 	qstate->return_rcode = LDNS_RCODE_NOERROR;
2301 	qstate->return_msg = vq->orig_msg;
2302 	qstate->ext_state[id] = module_finished;
2303 	return 0;
2304 }
2305 
2306 /**
2307  * The DLVLookup state. Process DLV lookups.
2308  *
2309  * @param qstate: query state.
2310  * @param vq: validator query state.
2311  * @param ve: validator shared global environment.
2312  * @param id: module id.
2313  * @return true if the event should be processed further on return, false if
2314  *         not.
2315  */
2316 static int
2317 processDLVLookup(struct module_qstate* qstate, struct val_qstate* vq,
2318 	struct val_env* ve, int id)
2319 {
2320 	struct module_qstate* newq = NULL;
2321 	/* see if this we are ready to continue normal resolution */
2322 	/* we may need more DLV lookups */
2323 	if(vq->dlv_status==dlv_error)
2324 		verbose(VERB_ALGO, "DLV woke up with status dlv_error");
2325 	else if(vq->dlv_status==dlv_success)
2326 		verbose(VERB_ALGO, "DLV woke up with status dlv_success");
2327 	else if(vq->dlv_status==dlv_ask_higher)
2328 		verbose(VERB_ALGO, "DLV woke up with status dlv_ask_higher");
2329 	else if(vq->dlv_status==dlv_there_is_no_dlv)
2330 		verbose(VERB_ALGO, "DLV woke up with status dlv_there_is_no_dlv");
2331 	else 	verbose(VERB_ALGO, "DLV woke up with status unknown");
2332 
2333 	if(vq->dlv_status == dlv_error) {
2334 		verbose(VERB_QUERY, "failed DLV lookup");
2335 		return val_error(qstate, id);
2336 	} else if(vq->dlv_status == dlv_success) {
2337 		uint8_t* nm;
2338 		size_t nmlen;
2339 		/* chain continues with DNSKEY, continue in FINDKEY */
2340 		vq->state = VAL_FINDKEY_STATE;
2341 
2342 		/* strip off the DLV suffix from the name; could result in . */
2343 		log_assert(dname_subdomain_c(vq->ds_rrset->rk.dname,
2344 			qstate->env->anchors->dlv_anchor->name));
2345 		nmlen = vq->ds_rrset->rk.dname_len -
2346 			qstate->env->anchors->dlv_anchor->namelen + 1;
2347 		nm = regional_alloc_init(qstate->region,
2348 			vq->ds_rrset->rk.dname, nmlen);
2349 		if(!nm) {
2350 			log_err("Out of memory in DLVLook");
2351 			return val_error(qstate, id);
2352 		}
2353 		nm[nmlen-1] = 0;
2354 
2355 		vq->ds_rrset->rk.dname = nm;
2356 		vq->ds_rrset->rk.dname_len = nmlen;
2357 
2358 		/* create a nullentry for the key so the dnskey lookup
2359 		 * can be retried after a validation failure for it */
2360 		vq->key_entry = key_entry_create_null(qstate->region,
2361 			nm, nmlen, vq->qchase.qclass, 0, 0);
2362 		if(!vq->key_entry) {
2363 			log_err("Out of memory in DLVLook");
2364 			return val_error(qstate, id);
2365 		}
2366 
2367 		if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
2368 			vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
2369 			vq->qchase.qclass, BIT_CD, &newq, 0)) {
2370 			log_err("mem error generating DNSKEY request");
2371 			return val_error(qstate, id);
2372 		}
2373 		return 0;
2374 	} else if(vq->dlv_status == dlv_there_is_no_dlv) {
2375 		/* continue with the insecure result we got */
2376 		vq->state = VAL_FINISHED_STATE;
2377 		return 1;
2378 	}
2379 	log_assert(vq->dlv_status == dlv_ask_higher);
2380 
2381 	/* ask higher, make sure we stay in DLV repo, below dlv_at */
2382 	if(!dname_subdomain_c(vq->dlv_lookup_name,
2383 		qstate->env->anchors->dlv_anchor->name)) {
2384 		/* just like, there is no DLV */
2385 		verbose(VERB_ALGO, "ask above dlv repo");
2386 		vq->state = VAL_FINISHED_STATE;
2387 		return 1;
2388 	}
2389 	if(vq->dlv_insecure_at && !dname_subdomain_c(vq->dlv_lookup_name,
2390 		vq->dlv_insecure_at)) {
2391 		/* already checked a chain lower than dlv_lookup_name */
2392 		verbose(VERB_ALGO, "ask above insecure endpoint");
2393 		log_nametypeclass(VERB_ALGO, "enpt", vq->dlv_insecure_at, 0, 0);
2394 		vq->state = VAL_FINISHED_STATE;
2395 		return 1;
2396 	}
2397 
2398 	/* check negative cache before making new request */
2399 	if(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
2400 		vq->dlv_lookup_name_len, vq->qchase.qclass,
2401 		qstate->env->rrset_cache, *qstate->env->now)) {
2402 		/* does not exist, go up one (go higher). */
2403 		dname_remove_label(&vq->dlv_lookup_name,
2404 			&vq->dlv_lookup_name_len);
2405 		/* limit number of labels, limited number of recursion */
2406 		return processDLVLookup(qstate, vq, ve, id);
2407 	}
2408 
2409 	if(!generate_request(qstate, id, vq->dlv_lookup_name,
2410 		vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV,
2411 		vq->qchase.qclass, 0, &newq, 0)) {
2412 		return val_error(qstate, id);
2413 	}
2414 
2415 	return 0;
2416 }
2417 
2418 /**
2419  * Handle validator state.
2420  * If a method returns true, the next state is started. If false, then
2421  * processing will stop.
2422  * @param qstate: query state.
2423  * @param vq: validator query state.
2424  * @param ve: validator shared global environment.
2425  * @param id: module id.
2426  */
2427 static void
2428 val_handle(struct module_qstate* qstate, struct val_qstate* vq,
2429 	struct val_env* ve, int id)
2430 {
2431 	int cont = 1;
2432 	while(cont) {
2433 		verbose(VERB_ALGO, "val handle processing q with state %s",
2434 			val_state_to_string(vq->state));
2435 		switch(vq->state) {
2436 			case VAL_INIT_STATE:
2437 				cont = processInit(qstate, vq, ve, id);
2438 				break;
2439 			case VAL_FINDKEY_STATE:
2440 				cont = processFindKey(qstate, vq, id);
2441 				break;
2442 			case VAL_VALIDATE_STATE:
2443 				cont = processValidate(qstate, vq, ve, id);
2444 				break;
2445 			case VAL_FINISHED_STATE:
2446 				cont = processFinished(qstate, vq, ve, id);
2447 				break;
2448 			case VAL_DLVLOOKUP_STATE:
2449 				cont = processDLVLookup(qstate, vq, ve, id);
2450 				break;
2451 			default:
2452 				log_warn("validator: invalid state %d",
2453 					vq->state);
2454 				cont = 0;
2455 				break;
2456 		}
2457 	}
2458 }
2459 
2460 void
2461 val_operate(struct module_qstate* qstate, enum module_ev event, int id,
2462         struct outbound_entry* outbound)
2463 {
2464 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2465 	struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
2466 	verbose(VERB_QUERY, "validator[module %d] operate: extstate:%s "
2467 		"event:%s", id, strextstate(qstate->ext_state[id]),
2468 		strmodulevent(event));
2469 	log_query_info(VERB_QUERY, "validator operate: query",
2470 		&qstate->qinfo);
2471 	if(vq && qstate->qinfo.qname != vq->qchase.qname)
2472 		log_query_info(VERB_QUERY, "validator operate: chased to",
2473 		&vq->qchase);
2474 	(void)outbound;
2475 	if(event == module_event_new ||
2476 		(event == module_event_pass && vq == NULL)) {
2477 
2478 		/* pass request to next module, to get it */
2479 		verbose(VERB_ALGO, "validator: pass to next module");
2480 		qstate->ext_state[id] = module_wait_module;
2481 		return;
2482 	}
2483 	if(event == module_event_moddone) {
2484 		/* check if validation is needed */
2485 		verbose(VERB_ALGO, "validator: nextmodule returned");
2486 
2487 		if(!needs_validation(qstate, qstate->return_rcode,
2488 			qstate->return_msg)) {
2489 			/* no need to validate this */
2490 			if(qstate->return_msg)
2491 				qstate->return_msg->rep->security =
2492 					sec_status_indeterminate;
2493 			qstate->ext_state[id] = module_finished;
2494 			return;
2495 		}
2496 		if(already_validated(qstate->return_msg)) {
2497 			qstate->ext_state[id] = module_finished;
2498 			return;
2499 		}
2500 		/* qclass ANY should have validation result from spawned
2501 		 * queries. If we get here, it is bogus or an internal error */
2502 		if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) {
2503 			verbose(VERB_ALGO, "cannot validate classANY: bogus");
2504 			if(qstate->return_msg)
2505 				qstate->return_msg->rep->security =
2506 					sec_status_bogus;
2507 			qstate->ext_state[id] = module_finished;
2508 			return;
2509 		}
2510 		/* create state to start validation */
2511 		qstate->ext_state[id] = module_error; /* override this */
2512 		if(!vq) {
2513 			vq = val_new(qstate, id);
2514 			if(!vq) {
2515 				log_err("validator: malloc failure");
2516 				qstate->ext_state[id] = module_error;
2517 				return;
2518 			}
2519 		} else if(!vq->orig_msg) {
2520 			if(!val_new_getmsg(qstate, vq)) {
2521 				log_err("validator: malloc failure");
2522 				qstate->ext_state[id] = module_error;
2523 				return;
2524 			}
2525 		}
2526 		val_handle(qstate, vq, ve, id);
2527 		return;
2528 	}
2529 	if(event == module_event_pass) {
2530 		qstate->ext_state[id] = module_error; /* override this */
2531 		/* continue processing, since val_env exists */
2532 		val_handle(qstate, vq, ve, id);
2533 		return;
2534 	}
2535 	log_err("validator: bad event %s", strmodulevent(event));
2536 	qstate->ext_state[id] = module_error;
2537 	return;
2538 }
2539 
2540 /**
2541  * Evaluate the response to a priming request.
2542  *
2543  * @param dnskey_rrset: DNSKEY rrset (can be NULL if none) in prime reply.
2544  * 	(this rrset is allocated in the wrong region, not the qstate).
2545  * @param ta: trust anchor.
2546  * @param qstate: qstate that needs key.
2547  * @param id: module id.
2548  * @return new key entry or NULL on allocation failure.
2549  *	The key entry will either contain a validated DNSKEY rrset, or
2550  *	represent a Null key (query failed, but validation did not), or a
2551  *	Bad key (validation failed).
2552  */
2553 static struct key_entry_key*
2554 primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
2555 	struct trust_anchor* ta, struct module_qstate* qstate, int id)
2556 {
2557 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2558 	struct key_entry_key* kkey = NULL;
2559 	enum sec_status sec = sec_status_unchecked;
2560 	char* reason = NULL;
2561 	int downprot = qstate->env->cfg->harden_algo_downgrade;
2562 
2563 	if(!dnskey_rrset) {
2564 		log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2565 			"could not fetch DNSKEY rrset",
2566 			ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2567 		if(qstate->env->cfg->harden_dnssec_stripped) {
2568 			errinf(qstate, "no DNSKEY rrset");
2569 			kkey = key_entry_create_bad(qstate->region, ta->name,
2570 				ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2571 				*qstate->env->now);
2572 		} else 	kkey = key_entry_create_null(qstate->region, ta->name,
2573 				ta->namelen, ta->dclass, NULL_KEY_TTL,
2574 				*qstate->env->now);
2575 		if(!kkey) {
2576 			log_err("out of memory: allocate fail prime key");
2577 			return NULL;
2578 		}
2579 		return kkey;
2580 	}
2581 	/* attempt to verify with trust anchor DS and DNSKEY */
2582 	kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve,
2583 		dnskey_rrset, ta->ds_rrset, ta->dnskey_rrset, downprot,
2584 		&reason, qstate);
2585 	if(!kkey) {
2586 		log_err("out of memory: verifying prime TA");
2587 		return NULL;
2588 	}
2589 	if(key_entry_isgood(kkey))
2590 		sec = sec_status_secure;
2591 	else
2592 		sec = sec_status_bogus;
2593 	verbose(VERB_DETAIL, "validate keys with anchor(DS): %s",
2594 		sec_status_to_string(sec));
2595 
2596 	if(sec != sec_status_secure) {
2597 		log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2598 			"DNSKEY rrset is not secure",
2599 			ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2600 		/* NOTE: in this case, we should probably reject the trust
2601 		 * anchor for longer, perhaps forever. */
2602 		if(qstate->env->cfg->harden_dnssec_stripped) {
2603 			errinf(qstate, reason);
2604 			kkey = key_entry_create_bad(qstate->region, ta->name,
2605 				ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2606 				*qstate->env->now);
2607 		} else 	kkey = key_entry_create_null(qstate->region, ta->name,
2608 				ta->namelen, ta->dclass, NULL_KEY_TTL,
2609 				*qstate->env->now);
2610 		if(!kkey) {
2611 			log_err("out of memory: allocate null prime key");
2612 			return NULL;
2613 		}
2614 		return kkey;
2615 	}
2616 
2617 	log_nametypeclass(VERB_DETAIL, "Successfully primed trust anchor",
2618 		ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2619 	return kkey;
2620 }
2621 
2622 /**
2623  * In inform supers, with the resulting message and rcode and the current
2624  * keyset in the super state, validate the DS response, returning a KeyEntry.
2625  *
2626  * @param qstate: query state that is validating and asked for a DS.
2627  * @param vq: validator query state
2628  * @param id: module id.
2629  * @param rcode: rcode result value.
2630  * @param msg: result message (if rcode is OK).
2631  * @param qinfo: from the sub query state, query info.
2632  * @param ke: the key entry to return. It returns
2633  *	is_bad if the DS response fails to validate, is_null if the
2634  *	DS response indicated an end to secure space, is_good if the DS
2635  *	validated. It returns ke=NULL if the DS response indicated that the
2636  *	request wasn't a delegation point.
2637  * @return 0 on servfail error (malloc failure).
2638  */
2639 static int
2640 ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
2641         int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2642 	struct key_entry_key** ke)
2643 {
2644 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2645 	char* reason = NULL;
2646 	enum val_classification subtype;
2647 	if(rcode != LDNS_RCODE_NOERROR) {
2648 		char rc[16];
2649 		rc[0]=0;
2650 		(void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
2651 		/* errors here pretty much break validation */
2652 		verbose(VERB_DETAIL, "DS response was error, thus bogus");
2653 		errinf(qstate, rc);
2654 		errinf(qstate, "no DS");
2655 		goto return_bogus;
2656 	}
2657 
2658 	subtype = val_classify_response(BIT_RD, qinfo, qinfo, msg->rep, 0);
2659 	if(subtype == VAL_CLASS_POSITIVE) {
2660 		struct ub_packed_rrset_key* ds;
2661 		enum sec_status sec;
2662 		ds = reply_find_answer_rrset(qinfo, msg->rep);
2663 		/* If there was no DS rrset, then we have mis-classified
2664 		 * this message. */
2665 		if(!ds) {
2666 			log_warn("internal error: POSITIVE DS response was "
2667 				"missing DS.");
2668 			errinf(qstate, "no DS record");
2669 			goto return_bogus;
2670 		}
2671 		/* Verify only returns BOGUS or SECURE. If the rrset is
2672 		 * bogus, then we are done. */
2673 		sec = val_verify_rrset_entry(qstate->env, ve, ds,
2674 			vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate);
2675 		if(sec != sec_status_secure) {
2676 			verbose(VERB_DETAIL, "DS rrset in DS response did "
2677 				"not verify");
2678 			errinf(qstate, reason);
2679 			goto return_bogus;
2680 		}
2681 
2682 		/* If the DS rrset validates, we still have to make sure
2683 		 * that they are usable. */
2684 		if(!val_dsset_isusable(ds)) {
2685 			/* If they aren't usable, then we treat it like
2686 			 * there was no DS. */
2687 			*ke = key_entry_create_null(qstate->region,
2688 				qinfo->qname, qinfo->qname_len, qinfo->qclass,
2689 				ub_packed_rrset_ttl(ds), *qstate->env->now);
2690 			return (*ke) != NULL;
2691 		}
2692 
2693 		/* Otherwise, we return the positive response. */
2694 		log_query_info(VERB_DETAIL, "validated DS", qinfo);
2695 		*ke = key_entry_create_rrset(qstate->region,
2696 			qinfo->qname, qinfo->qname_len, qinfo->qclass, ds,
2697 			NULL, *qstate->env->now);
2698 		return (*ke) != NULL;
2699 	} else if(subtype == VAL_CLASS_NODATA ||
2700 		subtype == VAL_CLASS_NAMEERROR) {
2701 		/* NODATA means that the qname exists, but that there was
2702 		 * no DS.  This is a pretty normal case. */
2703 		time_t proof_ttl = 0;
2704 		enum sec_status sec;
2705 
2706 		/* make sure there are NSECs or NSEC3s with signatures */
2707 		if(!val_has_signed_nsecs(msg->rep, &reason)) {
2708 			verbose(VERB_ALGO, "no NSECs: %s", reason);
2709 			errinf(qstate, reason);
2710 			goto return_bogus;
2711 		}
2712 
2713 		/* For subtype Name Error.
2714 		 * attempt ANS 2.8.1.0 compatibility where it sets rcode
2715 		 * to nxdomain, but really this is an Nodata/Noerror response.
2716 		 * Find and prove the empty nonterminal in that case */
2717 
2718 		/* Try to prove absence of the DS with NSEC */
2719 		sec = val_nsec_prove_nodata_dsreply(
2720 			qstate->env, ve, qinfo, msg->rep, vq->key_entry,
2721 			&proof_ttl, &reason, qstate);
2722 		switch(sec) {
2723 			case sec_status_secure:
2724 				verbose(VERB_DETAIL, "NSEC RRset for the "
2725 					"referral proved no DS.");
2726 				*ke = key_entry_create_null(qstate->region,
2727 					qinfo->qname, qinfo->qname_len,
2728 					qinfo->qclass, proof_ttl,
2729 					*qstate->env->now);
2730 				return (*ke) != NULL;
2731 			case sec_status_insecure:
2732 				verbose(VERB_DETAIL, "NSEC RRset for the "
2733 				  "referral proved not a delegation point");
2734 				*ke = NULL;
2735 				return 1;
2736 			case sec_status_bogus:
2737 				verbose(VERB_DETAIL, "NSEC RRset for the "
2738 					"referral did not prove no DS.");
2739 				errinf(qstate, reason);
2740 				goto return_bogus;
2741 			case sec_status_unchecked:
2742 			default:
2743 				/* NSEC proof did not work, try next */
2744 				break;
2745 		}
2746 
2747 		sec = nsec3_prove_nods(qstate->env, ve,
2748 			msg->rep->rrsets + msg->rep->an_numrrsets,
2749 			msg->rep->ns_numrrsets, qinfo, vq->key_entry, &reason,
2750 			qstate);
2751 		switch(sec) {
2752 			case sec_status_insecure:
2753 				/* case insecure also continues to unsigned
2754 				 * space.  If nsec3-iter-count too high or
2755 				 * optout, then treat below as unsigned */
2756 			case sec_status_secure:
2757 				verbose(VERB_DETAIL, "NSEC3s for the "
2758 					"referral proved no DS.");
2759 				*ke = key_entry_create_null(qstate->region,
2760 					qinfo->qname, qinfo->qname_len,
2761 					qinfo->qclass, proof_ttl,
2762 					*qstate->env->now);
2763 				return (*ke) != NULL;
2764 			case sec_status_indeterminate:
2765 				verbose(VERB_DETAIL, "NSEC3s for the "
2766 				  "referral proved no delegation");
2767 				*ke = NULL;
2768 				return 1;
2769 			case sec_status_bogus:
2770 				verbose(VERB_DETAIL, "NSEC3s for the "
2771 					"referral did not prove no DS.");
2772 				errinf(qstate, reason);
2773 				goto return_bogus;
2774 			case sec_status_unchecked:
2775 			default:
2776 				/* NSEC3 proof did not work */
2777 				break;
2778 		}
2779 
2780 		/* Apparently, no available NSEC/NSEC3 proved NODATA, so
2781 		 * this is BOGUS. */
2782 		verbose(VERB_DETAIL, "DS %s ran out of options, so return "
2783 			"bogus", val_classification_to_string(subtype));
2784 		errinf(qstate, "no DS but also no proof of that");
2785 		goto return_bogus;
2786 	} else if(subtype == VAL_CLASS_CNAME ||
2787 		subtype == VAL_CLASS_CNAMENOANSWER) {
2788 		/* if the CNAME matches the exact name we want and is signed
2789 		 * properly, then also, we are sure that no DS exists there,
2790 		 * much like a NODATA proof */
2791 		enum sec_status sec;
2792 		struct ub_packed_rrset_key* cname;
2793 		cname = reply_find_rrset_section_an(msg->rep, qinfo->qname,
2794 			qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass);
2795 		if(!cname) {
2796 			errinf(qstate, "validator classified CNAME but no "
2797 				"CNAME of the queried name for DS");
2798 			goto return_bogus;
2799 		}
2800 		if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count
2801 			== 0) {
2802 		        if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep->
2803 				rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) {
2804 				errinf(qstate, "DS got DNAME answer");
2805 			} else {
2806 				errinf(qstate, "DS got unsigned CNAME answer");
2807 			}
2808 			goto return_bogus;
2809 		}
2810 		sec = val_verify_rrset_entry(qstate->env, ve, cname,
2811 			vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate);
2812 		if(sec == sec_status_secure) {
2813 			verbose(VERB_ALGO, "CNAME validated, "
2814 				"proof that DS does not exist");
2815 			/* and that it is not a referral point */
2816 			*ke = NULL;
2817 			return 1;
2818 		}
2819 		errinf(qstate, "CNAME in DS response was not secure.");
2820 		errinf(qstate, reason);
2821 		goto return_bogus;
2822 	} else {
2823 		verbose(VERB_QUERY, "Encountered an unhandled type of "
2824 			"DS response, thus bogus.");
2825 		errinf(qstate, "no DS and");
2826 		if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) {
2827 			char rc[16];
2828 			rc[0]=0;
2829 			(void)sldns_wire2str_rcode_buf((int)FLAGS_GET_RCODE(
2830 				msg->rep->flags), rc, sizeof(rc));
2831 			errinf(qstate, rc);
2832 		} else	errinf(qstate, val_classification_to_string(subtype));
2833 		errinf(qstate, "message fails to prove that");
2834 		goto return_bogus;
2835 	}
2836 return_bogus:
2837 	*ke = key_entry_create_bad(qstate->region, qinfo->qname,
2838 		qinfo->qname_len, qinfo->qclass,
2839 		BOGUS_KEY_TTL, *qstate->env->now);
2840 	return (*ke) != NULL;
2841 }
2842 
2843 /**
2844  * Process DS response. Called from inform_supers.
2845  * Because it is in inform_supers, the mesh itself is busy doing callbacks
2846  * for a state that is to be deleted soon; don't touch the mesh; instead
2847  * set a state in the super, as the super will be reactivated soon.
2848  * Perform processing to determine what state to set in the super.
2849  *
2850  * @param qstate: query state that is validating and asked for a DS.
2851  * @param vq: validator query state
2852  * @param id: module id.
2853  * @param rcode: rcode result value.
2854  * @param msg: result message (if rcode is OK).
2855  * @param qinfo: from the sub query state, query info.
2856  * @param origin: the origin of msg.
2857  */
2858 static void
2859 process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
2860 	int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2861 	struct sock_list* origin)
2862 {
2863 	struct key_entry_key* dske = NULL;
2864 	uint8_t* olds = vq->empty_DS_name;
2865 	vq->empty_DS_name = NULL;
2866 	if(!ds_response_to_ke(qstate, vq, id, rcode, msg, qinfo, &dske)) {
2867 			log_err("malloc failure in process_ds_response");
2868 			vq->key_entry = NULL; /* make it error */
2869 			vq->state = VAL_VALIDATE_STATE;
2870 			return;
2871 	}
2872 	if(dske == NULL) {
2873 		vq->empty_DS_name = regional_alloc_init(qstate->region,
2874 			qinfo->qname, qinfo->qname_len);
2875 		if(!vq->empty_DS_name) {
2876 			log_err("malloc failure in empty_DS_name");
2877 			vq->key_entry = NULL; /* make it error */
2878 			vq->state = VAL_VALIDATE_STATE;
2879 			return;
2880 		}
2881 		vq->empty_DS_len = qinfo->qname_len;
2882 		vq->chain_blacklist = NULL;
2883 		/* ds response indicated that we aren't on a delegation point.
2884 		 * Keep the forState.state on FINDKEY. */
2885 	} else if(key_entry_isgood(dske)) {
2886 		vq->ds_rrset = key_entry_get_rrset(dske, qstate->region);
2887 		if(!vq->ds_rrset) {
2888 			log_err("malloc failure in process DS");
2889 			vq->key_entry = NULL; /* make it error */
2890 			vq->state = VAL_VALIDATE_STATE;
2891 			return;
2892 		}
2893 		vq->chain_blacklist = NULL; /* fresh blacklist for next part*/
2894 		/* Keep the forState.state on FINDKEY. */
2895 	} else if(key_entry_isbad(dske)
2896 		&& vq->restart_count < VAL_MAX_RESTART_COUNT) {
2897 		vq->empty_DS_name = olds;
2898 		val_blacklist(&vq->chain_blacklist, qstate->region, origin, 1);
2899 		qstate->errinf = NULL;
2900 		vq->restart_count++;
2901 	} else {
2902 		if(key_entry_isbad(dske)) {
2903 			errinf_origin(qstate, origin);
2904 			errinf_dname(qstate, "for DS", qinfo->qname);
2905 		}
2906 		/* NOTE: the reason for the DS to be not good (that is,
2907 		 * either bad or null) should have been logged by
2908 		 * dsResponseToKE. */
2909 		vq->key_entry = dske;
2910 		/* The FINDKEY phase has ended, so move on. */
2911 		vq->state = VAL_VALIDATE_STATE;
2912 	}
2913 }
2914 
2915 /**
2916  * Process DNSKEY response. Called from inform_supers.
2917  * Sets the key entry in the state.
2918  * Because it is in inform_supers, the mesh itself is busy doing callbacks
2919  * for a state that is to be deleted soon; don't touch the mesh; instead
2920  * set a state in the super, as the super will be reactivated soon.
2921  * Perform processing to determine what state to set in the super.
2922  *
2923  * @param qstate: query state that is validating and asked for a DNSKEY.
2924  * @param vq: validator query state
2925  * @param id: module id.
2926  * @param rcode: rcode result value.
2927  * @param msg: result message (if rcode is OK).
2928  * @param qinfo: from the sub query state, query info.
2929  * @param origin: the origin of msg.
2930  */
2931 static void
2932 process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
2933 	int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2934 	struct sock_list* origin)
2935 {
2936 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2937 	struct key_entry_key* old = vq->key_entry;
2938 	struct ub_packed_rrset_key* dnskey = NULL;
2939 	int downprot;
2940 	char* reason = NULL;
2941 
2942 	if(rcode == LDNS_RCODE_NOERROR)
2943 		dnskey = reply_find_answer_rrset(qinfo, msg->rep);
2944 
2945 	if(dnskey == NULL) {
2946 		/* bad response */
2947 		verbose(VERB_DETAIL, "Missing DNSKEY RRset in response to "
2948 			"DNSKEY query.");
2949 		if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2950 			val_blacklist(&vq->chain_blacklist, qstate->region,
2951 				origin, 1);
2952 			qstate->errinf = NULL;
2953 			vq->restart_count++;
2954 			return;
2955 		}
2956 		vq->key_entry = key_entry_create_bad(qstate->region,
2957 			qinfo->qname, qinfo->qname_len, qinfo->qclass,
2958 			BOGUS_KEY_TTL, *qstate->env->now);
2959 		if(!vq->key_entry) {
2960 			log_err("alloc failure in missing dnskey response");
2961 			/* key_entry is NULL for failure in Validate */
2962 		}
2963 		errinf(qstate, "No DNSKEY record");
2964 		errinf_origin(qstate, origin);
2965 		errinf_dname(qstate, "for key", qinfo->qname);
2966 		vq->state = VAL_VALIDATE_STATE;
2967 		return;
2968 	}
2969 	if(!vq->ds_rrset) {
2970 		log_err("internal error: no DS rrset for new DNSKEY response");
2971 		vq->key_entry = NULL;
2972 		vq->state = VAL_VALIDATE_STATE;
2973 		return;
2974 	}
2975 	downprot = qstate->env->cfg->harden_algo_downgrade;
2976 	vq->key_entry = val_verify_new_DNSKEYs(qstate->region, qstate->env,
2977 		ve, dnskey, vq->ds_rrset, downprot, &reason, qstate);
2978 
2979 	if(!vq->key_entry) {
2980 		log_err("out of memory in verify new DNSKEYs");
2981 		vq->state = VAL_VALIDATE_STATE;
2982 		return;
2983 	}
2984 	/* If the key entry isBad or isNull, then we can move on to the next
2985 	 * state. */
2986 	if(!key_entry_isgood(vq->key_entry)) {
2987 		if(key_entry_isbad(vq->key_entry)) {
2988 			if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2989 				val_blacklist(&vq->chain_blacklist,
2990 					qstate->region, origin, 1);
2991 				qstate->errinf = NULL;
2992 				vq->restart_count++;
2993 				vq->key_entry = old;
2994 				return;
2995 			}
2996 			verbose(VERB_DETAIL, "Did not match a DS to a DNSKEY, "
2997 				"thus bogus.");
2998 			errinf(qstate, reason);
2999 			errinf_origin(qstate, origin);
3000 			errinf_dname(qstate, "for key", qinfo->qname);
3001 		}
3002 		vq->chain_blacklist = NULL;
3003 		vq->state = VAL_VALIDATE_STATE;
3004 		return;
3005 	}
3006 	vq->chain_blacklist = NULL;
3007 	qstate->errinf = NULL;
3008 
3009 	/* The DNSKEY validated, so cache it as a trusted key rrset. */
3010 	key_cache_insert(ve->kcache, vq->key_entry, qstate);
3011 
3012 	/* If good, we stay in the FINDKEY state. */
3013 	log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo);
3014 }
3015 
3016 /**
3017  * Process prime response
3018  * Sets the key entry in the state.
3019  *
3020  * @param qstate: query state that is validating and primed a trust anchor.
3021  * @param vq: validator query state
3022  * @param id: module id.
3023  * @param rcode: rcode result value.
3024  * @param msg: result message (if rcode is OK).
3025  * @param origin: the origin of msg.
3026  */
3027 static void
3028 process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
3029 	int id, int rcode, struct dns_msg* msg, struct sock_list* origin)
3030 {
3031 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
3032 	struct ub_packed_rrset_key* dnskey_rrset = NULL;
3033 	struct trust_anchor* ta = anchor_find(qstate->env->anchors,
3034 		vq->trust_anchor_name, vq->trust_anchor_labs,
3035 		vq->trust_anchor_len, vq->qchase.qclass);
3036 	if(!ta) {
3037 		/* trust anchor revoked, restart with less anchors */
3038 		vq->state = VAL_INIT_STATE;
3039 		if(!vq->trust_anchor_name)
3040 			vq->state = VAL_VALIDATE_STATE; /* break a loop */
3041 		vq->trust_anchor_name = NULL;
3042 		return;
3043 	}
3044 	/* Fetch and validate the keyEntry that corresponds to the
3045 	 * current trust anchor. */
3046 	if(rcode == LDNS_RCODE_NOERROR) {
3047 		dnskey_rrset = reply_find_rrset_section_an(msg->rep,
3048 			ta->name, ta->namelen, LDNS_RR_TYPE_DNSKEY,
3049 			ta->dclass);
3050 	}
3051 
3052 	if(ta->autr) {
3053 		if(!autr_process_prime(qstate->env, ve, ta, dnskey_rrset,
3054 			qstate)) {
3055 			/* trust anchor revoked, restart with less anchors */
3056 			vq->state = VAL_INIT_STATE;
3057 			vq->trust_anchor_name = NULL;
3058 			return;
3059 		}
3060 	}
3061 	vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, id);
3062 	lock_basic_unlock(&ta->lock);
3063 	if(vq->key_entry) {
3064 		if(key_entry_isbad(vq->key_entry)
3065 			&& vq->restart_count < VAL_MAX_RESTART_COUNT) {
3066 			val_blacklist(&vq->chain_blacklist, qstate->region,
3067 				origin, 1);
3068 			qstate->errinf = NULL;
3069 			vq->restart_count++;
3070 			vq->key_entry = NULL;
3071 			vq->state = VAL_INIT_STATE;
3072 			return;
3073 		}
3074 		vq->chain_blacklist = NULL;
3075 		errinf_origin(qstate, origin);
3076 		errinf_dname(qstate, "for trust anchor", ta->name);
3077 		/* store the freshly primed entry in the cache */
3078 		key_cache_insert(ve->kcache, vq->key_entry, qstate);
3079 	}
3080 
3081 	/* If the result of the prime is a null key, skip the FINDKEY state.*/
3082 	if(!vq->key_entry || key_entry_isnull(vq->key_entry) ||
3083 		key_entry_isbad(vq->key_entry)) {
3084 		vq->state = VAL_VALIDATE_STATE;
3085 	}
3086 	/* the qstate will be reactivated after inform_super is done */
3087 }
3088 
3089 /**
3090  * Process DLV response. Called from inform_supers.
3091  * Because it is in inform_supers, the mesh itself is busy doing callbacks
3092  * for a state that is to be deleted soon; don't touch the mesh; instead
3093  * set a state in the super, as the super will be reactivated soon.
3094  * Perform processing to determine what state to set in the super.
3095  *
3096  * @param qstate: query state that is validating and asked for a DLV.
3097  * @param vq: validator query state
3098  * @param id: module id.
3099  * @param rcode: rcode result value.
3100  * @param msg: result message (if rcode is OK).
3101  * @param qinfo: from the sub query state, query info.
3102  */
3103 static void
3104 process_dlv_response(struct module_qstate* qstate, struct val_qstate* vq,
3105 	int id, int rcode, struct dns_msg* msg, struct query_info* qinfo)
3106 {
3107 	struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
3108 
3109 	verbose(VERB_ALGO, "process dlv response to super");
3110 	if(rcode != LDNS_RCODE_NOERROR) {
3111 		/* lookup failed, set in vq to give up */
3112 		vq->dlv_status = dlv_error;
3113 		verbose(VERB_ALGO, "response is error");
3114 		return;
3115 	}
3116 	if(msg->rep->security != sec_status_secure) {
3117 		vq->dlv_status = dlv_error;
3118 		verbose(VERB_ALGO, "response is not secure, %s",
3119 			sec_status_to_string(msg->rep->security));
3120 		return;
3121 	}
3122 	/* was the lookup a success? validated DLV? */
3123 	if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NOERROR &&
3124 		msg->rep->an_numrrsets == 1 &&
3125 		msg->rep->security == sec_status_secure &&
3126 		ntohs(msg->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DLV &&
3127 		ntohs(msg->rep->rrsets[0]->rk.rrset_class) == qinfo->qclass &&
3128 		query_dname_compare(msg->rep->rrsets[0]->rk.dname,
3129 			vq->dlv_lookup_name) == 0) {
3130 		/* yay! it is just like a DS */
3131 		vq->ds_rrset = (struct ub_packed_rrset_key*)
3132 			regional_alloc_init(qstate->region,
3133 			msg->rep->rrsets[0], sizeof(*vq->ds_rrset));
3134 		if(!vq->ds_rrset) {
3135 			log_err("out of memory in process_dlv");
3136 			return;
3137 		}
3138 		vq->ds_rrset->entry.key = vq->ds_rrset;
3139 		vq->ds_rrset->rk.dname = (uint8_t*)regional_alloc_init(
3140 			qstate->region, vq->ds_rrset->rk.dname,
3141 			vq->ds_rrset->rk.dname_len);
3142 		if(!vq->ds_rrset->rk.dname) {
3143 			log_err("out of memory in process_dlv");
3144 			vq->dlv_status = dlv_error;
3145 			return;
3146 		}
3147 		vq->ds_rrset->entry.data = regional_alloc_init(qstate->region,
3148 			vq->ds_rrset->entry.data,
3149 			packed_rrset_sizeof(vq->ds_rrset->entry.data));
3150 		if(!vq->ds_rrset->entry.data) {
3151 			log_err("out of memory in process_dlv");
3152 			vq->dlv_status = dlv_error;
3153 			return;
3154 		}
3155 		packed_rrset_ptr_fixup(vq->ds_rrset->entry.data);
3156 		/* make vq do a DNSKEY query next up */
3157 		vq->dlv_status = dlv_success;
3158 		return;
3159 	}
3160 	/* store NSECs into negative cache */
3161 	val_neg_addreply(ve->neg_cache, msg->rep);
3162 
3163 	/* was the lookup a failure?
3164 	 *   if we have to go up into the DLV for a higher DLV anchor
3165 	 *   then set this in the vq, so it can make queries when activated.
3166 	 * See if the NSECs indicate that we should look for higher DLV
3167 	 * or, that there is no DLV securely */
3168 	if(!val_nsec_check_dlv(qinfo, msg->rep, &vq->dlv_lookup_name,
3169 		&vq->dlv_lookup_name_len)) {
3170 		vq->dlv_status = dlv_error;
3171 		verbose(VERB_ALGO, "nsec error");
3172 		return;
3173 	}
3174 	if(!dname_subdomain_c(vq->dlv_lookup_name,
3175 		qstate->env->anchors->dlv_anchor->name)) {
3176 		vq->dlv_status = dlv_there_is_no_dlv;
3177 		return;
3178 	}
3179 	vq->dlv_status = dlv_ask_higher;
3180 }
3181 
3182 /*
3183  * inform validator super.
3184  *
3185  * @param qstate: query state that finished.
3186  * @param id: module id.
3187  * @param super: the qstate to inform.
3188  */
3189 void
3190 val_inform_super(struct module_qstate* qstate, int id,
3191 	struct module_qstate* super)
3192 {
3193 	struct val_qstate* vq = (struct val_qstate*)super->minfo[id];
3194 	log_query_info(VERB_ALGO, "validator: inform_super, sub is",
3195 		&qstate->qinfo);
3196 	log_query_info(VERB_ALGO, "super is", &super->qinfo);
3197 	if(!vq) {
3198 		verbose(VERB_ALGO, "super: has no validator state");
3199 		return;
3200 	}
3201 	if(vq->wait_prime_ta) {
3202 		vq->wait_prime_ta = 0;
3203 		process_prime_response(super, vq, id, qstate->return_rcode,
3204 			qstate->return_msg, qstate->reply_origin);
3205 		return;
3206 	}
3207 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS) {
3208 		process_ds_response(super, vq, id, qstate->return_rcode,
3209 			qstate->return_msg, &qstate->qinfo,
3210 			qstate->reply_origin);
3211 		return;
3212 	} else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY) {
3213 		process_dnskey_response(super, vq, id, qstate->return_rcode,
3214 			qstate->return_msg, &qstate->qinfo,
3215 			qstate->reply_origin);
3216 		return;
3217 	} else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DLV) {
3218 		process_dlv_response(super, vq, id, qstate->return_rcode,
3219 			qstate->return_msg, &qstate->qinfo);
3220 		return;
3221 	}
3222 	log_err("internal error in validator: no inform_supers possible");
3223 }
3224 
3225 void
3226 val_clear(struct module_qstate* qstate, int id)
3227 {
3228 	if(!qstate)
3229 		return;
3230 	/* everything is allocated in the region, so assign NULL */
3231 	qstate->minfo[id] = NULL;
3232 }
3233 
3234 size_t
3235 val_get_mem(struct module_env* env, int id)
3236 {
3237 	struct val_env* ve = (struct val_env*)env->modinfo[id];
3238 	if(!ve)
3239 		return 0;
3240 	return sizeof(*ve) + key_cache_get_mem(ve->kcache) +
3241 		val_neg_get_mem(ve->neg_cache) +
3242 		sizeof(size_t)*2*ve->nsec3_keyiter_count;
3243 }
3244 
3245 /**
3246  * The validator function block
3247  */
3248 static struct module_func_block val_block = {
3249 	"validator",
3250 	&val_init, &val_deinit, &val_operate, &val_inform_super, &val_clear,
3251 	&val_get_mem
3252 };
3253 
3254 struct module_func_block*
3255 val_get_funcblock(void)
3256 {
3257 	return &val_block;
3258 }
3259 
3260 const char*
3261 val_state_to_string(enum val_state state)
3262 {
3263 	switch(state) {
3264 		case VAL_INIT_STATE: return "VAL_INIT_STATE";
3265 		case VAL_FINDKEY_STATE: return "VAL_FINDKEY_STATE";
3266 		case VAL_VALIDATE_STATE: return "VAL_VALIDATE_STATE";
3267 		case VAL_FINISHED_STATE: return "VAL_FINISHED_STATE";
3268 		case VAL_DLVLOOKUP_STATE: return "VAL_DLVLOOKUP_STATE";
3269 	}
3270 	return "UNKNOWN VALIDATOR STATE";
3271 }
3272 
3273