1 /* 2 * validator/validator.c - secure validator DNS query response module 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains a module that performs validation of DNS queries. 40 * According to RFC 4034. 41 */ 42 #include "config.h" 43 #include "validator/validator.h" 44 #include "validator/val_anchor.h" 45 #include "validator/val_kcache.h" 46 #include "validator/val_kentry.h" 47 #include "validator/val_utils.h" 48 #include "validator/val_nsec.h" 49 #include "validator/val_nsec3.h" 50 #include "validator/val_neg.h" 51 #include "validator/val_sigcrypt.h" 52 #include "validator/autotrust.h" 53 #include "services/cache/dns.h" 54 #include "util/data/dname.h" 55 #include "util/module.h" 56 #include "util/log.h" 57 #include "util/net_help.h" 58 #include "util/regional.h" 59 #include "util/config_file.h" 60 #include "util/fptr_wlist.h" 61 #include "ldns/rrdef.h" 62 #include "ldns/wire2str.h" 63 64 /* forward decl for cache response and normal super inform calls of a DS */ 65 static void process_ds_response(struct module_qstate* qstate, 66 struct val_qstate* vq, int id, int rcode, struct dns_msg* msg, 67 struct query_info* qinfo, struct sock_list* origin); 68 69 /** fill up nsec3 key iterations config entry */ 70 static int 71 fill_nsec3_iter(struct val_env* ve, char* s, int c) 72 { 73 char* e; 74 int i; 75 free(ve->nsec3_keysize); 76 free(ve->nsec3_maxiter); 77 ve->nsec3_keysize = (size_t*)calloc(sizeof(size_t), (size_t)c); 78 ve->nsec3_maxiter = (size_t*)calloc(sizeof(size_t), (size_t)c); 79 if(!ve->nsec3_keysize || !ve->nsec3_maxiter) { 80 log_err("out of memory"); 81 return 0; 82 } 83 for(i=0; i<c; i++) { 84 ve->nsec3_keysize[i] = (size_t)strtol(s, &e, 10); 85 if(s == e) { 86 log_err("cannot parse: %s", s); 87 return 0; 88 } 89 s = e; 90 ve->nsec3_maxiter[i] = (size_t)strtol(s, &e, 10); 91 if(s == e) { 92 log_err("cannot parse: %s", s); 93 return 0; 94 } 95 s = e; 96 if(i>0 && ve->nsec3_keysize[i-1] >= ve->nsec3_keysize[i]) { 97 log_err("nsec3 key iterations not ascending: %d %d", 98 (int)ve->nsec3_keysize[i-1], 99 (int)ve->nsec3_keysize[i]); 100 return 0; 101 } 102 verbose(VERB_ALGO, "validator nsec3cfg keysz %d mxiter %d", 103 (int)ve->nsec3_keysize[i], (int)ve->nsec3_maxiter[i]); 104 } 105 return 1; 106 } 107 108 /** apply config settings to validator */ 109 static int 110 val_apply_cfg(struct module_env* env, struct val_env* val_env, 111 struct config_file* cfg) 112 { 113 int c; 114 val_env->bogus_ttl = (uint32_t)cfg->bogus_ttl; 115 val_env->clean_additional = cfg->val_clean_additional; 116 val_env->permissive_mode = cfg->val_permissive_mode; 117 if(!env->anchors) 118 env->anchors = anchors_create(); 119 if(!env->anchors) { 120 log_err("out of memory"); 121 return 0; 122 } 123 if(!val_env->kcache) 124 val_env->kcache = key_cache_create(cfg); 125 if(!val_env->kcache) { 126 log_err("out of memory"); 127 return 0; 128 } 129 env->key_cache = val_env->kcache; 130 if(!anchors_apply_cfg(env->anchors, cfg)) { 131 log_err("validator: error in trustanchors config"); 132 return 0; 133 } 134 val_env->date_override = cfg->val_date_override; 135 val_env->skew_min = cfg->val_sig_skew_min; 136 val_env->skew_max = cfg->val_sig_skew_max; 137 c = cfg_count_numbers(cfg->val_nsec3_key_iterations); 138 if(c < 1 || (c&1)) { 139 log_err("validator: unparseable or odd nsec3 key " 140 "iterations: %s", cfg->val_nsec3_key_iterations); 141 return 0; 142 } 143 val_env->nsec3_keyiter_count = c/2; 144 if(!fill_nsec3_iter(val_env, cfg->val_nsec3_key_iterations, c/2)) { 145 log_err("validator: cannot apply nsec3 key iterations"); 146 return 0; 147 } 148 if(!val_env->neg_cache) 149 val_env->neg_cache = val_neg_create(cfg, 150 val_env->nsec3_maxiter[val_env->nsec3_keyiter_count-1]); 151 if(!val_env->neg_cache) { 152 log_err("out of memory"); 153 return 0; 154 } 155 env->neg_cache = val_env->neg_cache; 156 return 1; 157 } 158 159 int 160 val_init(struct module_env* env, int id) 161 { 162 struct val_env* val_env = (struct val_env*)calloc(1, 163 sizeof(struct val_env)); 164 if(!val_env) { 165 log_err("malloc failure"); 166 return 0; 167 } 168 env->modinfo[id] = (void*)val_env; 169 env->need_to_validate = 1; 170 val_env->permissive_mode = 0; 171 lock_basic_init(&val_env->bogus_lock); 172 lock_protect(&val_env->bogus_lock, &val_env->num_rrset_bogus, 173 sizeof(val_env->num_rrset_bogus)); 174 if(!val_apply_cfg(env, val_env, env->cfg)) { 175 log_err("validator: could not apply configuration settings."); 176 return 0; 177 } 178 return 1; 179 } 180 181 void 182 val_deinit(struct module_env* env, int id) 183 { 184 struct val_env* val_env; 185 if(!env || !env->modinfo[id]) 186 return; 187 val_env = (struct val_env*)env->modinfo[id]; 188 lock_basic_destroy(&val_env->bogus_lock); 189 anchors_delete(env->anchors); 190 env->anchors = NULL; 191 key_cache_delete(val_env->kcache); 192 neg_cache_delete(val_env->neg_cache); 193 free(val_env->nsec3_keysize); 194 free(val_env->nsec3_maxiter); 195 free(val_env); 196 env->modinfo[id] = NULL; 197 } 198 199 /** fill in message structure */ 200 static struct val_qstate* 201 val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq) 202 { 203 if(!qstate->return_msg || qstate->return_rcode != LDNS_RCODE_NOERROR) { 204 /* create a message to verify */ 205 verbose(VERB_ALGO, "constructing reply for validation"); 206 vq->orig_msg = (struct dns_msg*)regional_alloc(qstate->region, 207 sizeof(struct dns_msg)); 208 if(!vq->orig_msg) 209 return NULL; 210 vq->orig_msg->qinfo = qstate->qinfo; 211 vq->orig_msg->rep = (struct reply_info*)regional_alloc( 212 qstate->region, sizeof(struct reply_info)); 213 if(!vq->orig_msg->rep) 214 return NULL; 215 memset(vq->orig_msg->rep, 0, sizeof(struct reply_info)); 216 vq->orig_msg->rep->flags = (uint16_t)(qstate->return_rcode&0xf) 217 |BIT_QR|BIT_RA|(qstate->query_flags|(BIT_CD|BIT_RD)); 218 vq->orig_msg->rep->qdcount = 1; 219 } else { 220 vq->orig_msg = qstate->return_msg; 221 } 222 vq->qchase = qstate->qinfo; 223 /* chase reply will be an edited (sub)set of the orig msg rrset ptrs */ 224 vq->chase_reply = regional_alloc_init(qstate->region, 225 vq->orig_msg->rep, 226 sizeof(struct reply_info) - sizeof(struct rrset_ref)); 227 if(!vq->chase_reply) 228 return NULL; 229 vq->chase_reply->rrsets = regional_alloc_init(qstate->region, 230 vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*) 231 * vq->orig_msg->rep->rrset_count); 232 if(!vq->chase_reply->rrsets) 233 return NULL; 234 vq->rrset_skip = 0; 235 return vq; 236 } 237 238 /** allocate new validator query state */ 239 static struct val_qstate* 240 val_new(struct module_qstate* qstate, int id) 241 { 242 struct val_qstate* vq = (struct val_qstate*)regional_alloc( 243 qstate->region, sizeof(*vq)); 244 log_assert(!qstate->minfo[id]); 245 if(!vq) 246 return NULL; 247 memset(vq, 0, sizeof(*vq)); 248 qstate->minfo[id] = vq; 249 vq->state = VAL_INIT_STATE; 250 return val_new_getmsg(qstate, vq); 251 } 252 253 /** 254 * Exit validation with an error status 255 * 256 * @param qstate: query state 257 * @param id: validator id. 258 * @return false, for use by caller to return to stop processing. 259 */ 260 static int 261 val_error(struct module_qstate* qstate, int id) 262 { 263 qstate->ext_state[id] = module_error; 264 qstate->return_rcode = LDNS_RCODE_SERVFAIL; 265 return 0; 266 } 267 268 /** 269 * Check to see if a given response needs to go through the validation 270 * process. Typical reasons for this routine to return false are: CD bit was 271 * on in the original request, or the response is a kind of message that 272 * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.) 273 * 274 * @param qstate: query state. 275 * @param ret_rc: rcode for this message (if noerror - examine ret_msg). 276 * @param ret_msg: return msg, can be NULL; look at rcode instead. 277 * @return true if the response could use validation (although this does not 278 * mean we can actually validate this response). 279 */ 280 static int 281 needs_validation(struct module_qstate* qstate, int ret_rc, 282 struct dns_msg* ret_msg) 283 { 284 int rcode; 285 286 /* If the CD bit is on in the original request, then you could think 287 * that we don't bother to validate anything. 288 * But this is signalled internally with the valrec flag. 289 * User queries are validated with BIT_CD to make our cache clean 290 * so that bogus messages get retried by the upstream also for 291 * downstream validators that set BIT_CD. 292 * For DNS64 bit_cd signals no dns64 processing, but we want to 293 * provide validation there too */ 294 /* 295 if(qstate->query_flags & BIT_CD) { 296 verbose(VERB_ALGO, "not validating response due to CD bit"); 297 return 0; 298 } 299 */ 300 if(qstate->is_valrec) { 301 verbose(VERB_ALGO, "not validating response, is valrec" 302 "(validation recursion lookup)"); 303 return 0; 304 } 305 306 if(ret_rc != LDNS_RCODE_NOERROR || !ret_msg) 307 rcode = ret_rc; 308 else rcode = (int)FLAGS_GET_RCODE(ret_msg->rep->flags); 309 310 if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) { 311 if(verbosity >= VERB_ALGO) { 312 char rc[16]; 313 rc[0]=0; 314 (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc)); 315 verbose(VERB_ALGO, "cannot validate non-answer, rcode %s", rc); 316 } 317 return 0; 318 } 319 320 /* cannot validate positive RRSIG response. (negatives can) */ 321 if(qstate->qinfo.qtype == LDNS_RR_TYPE_RRSIG && 322 rcode == LDNS_RCODE_NOERROR && ret_msg && 323 ret_msg->rep->an_numrrsets > 0) { 324 verbose(VERB_ALGO, "cannot validate RRSIG, no sigs on sigs."); 325 return 0; 326 } 327 return 1; 328 } 329 330 /** 331 * Check to see if the response has already been validated. 332 * @param ret_msg: return msg, can be NULL 333 * @return true if the response has already been validated 334 */ 335 static int 336 already_validated(struct dns_msg* ret_msg) 337 { 338 /* validate unchecked, and re-validate bogus messages */ 339 if (ret_msg && ret_msg->rep->security > sec_status_bogus) 340 { 341 verbose(VERB_ALGO, "response has already been validated: %s", 342 sec_status_to_string(ret_msg->rep->security)); 343 return 1; 344 } 345 return 0; 346 } 347 348 /** 349 * Generate a request for DNS data. 350 * 351 * @param qstate: query state that is the parent. 352 * @param id: module id. 353 * @param name: what name to query for. 354 * @param namelen: length of name. 355 * @param qtype: query type. 356 * @param qclass: query class. 357 * @param flags: additional flags, such as the CD bit (BIT_CD), or 0. 358 * @return false on alloc failure. 359 */ 360 static int 361 generate_request(struct module_qstate* qstate, int id, uint8_t* name, 362 size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags) 363 { 364 struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id]; 365 struct module_qstate* newq; 366 struct query_info ask; 367 int valrec; 368 ask.qname = name; 369 ask.qname_len = namelen; 370 ask.qtype = qtype; 371 ask.qclass = qclass; 372 log_query_info(VERB_ALGO, "generate request", &ask); 373 fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub)); 374 /* enable valrec flag to avoid recursion to the same validation 375 * routine, this lookup is simply a lookup. DLVs need validation */ 376 if(qtype == LDNS_RR_TYPE_DLV) 377 valrec = 0; 378 else valrec = 1; 379 if(!(*qstate->env->attach_sub)(qstate, &ask, 380 (uint16_t)(BIT_RD|flags), 0, valrec, &newq)){ 381 log_err("Could not generate request: out of memory"); 382 return 0; 383 } 384 /* newq; validator does not need state created for that 385 * query, and its a 'normal' for iterator as well */ 386 if(newq) { 387 /* add our blacklist to the query blacklist */ 388 sock_list_merge(&newq->blacklist, newq->region, 389 vq->chain_blacklist); 390 } 391 qstate->ext_state[id] = module_wait_subquery; 392 return 1; 393 } 394 395 /** 396 * Prime trust anchor for use. 397 * Generate and dispatch a priming query for the given trust anchor. 398 * The trust anchor can be DNSKEY or DS and does not have to be signed. 399 * 400 * @param qstate: query state. 401 * @param vq: validator query state. 402 * @param id: module id. 403 * @param toprime: what to prime. 404 * @return false on a processing error. 405 */ 406 static int 407 prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq, 408 int id, struct trust_anchor* toprime) 409 { 410 int ret = generate_request(qstate, id, toprime->name, toprime->namelen, 411 LDNS_RR_TYPE_DNSKEY, toprime->dclass, BIT_CD); 412 if(!ret) { 413 log_err("Could not prime trust anchor: out of memory"); 414 return 0; 415 } 416 /* ignore newq; validator does not need state created for that 417 * query, and its a 'normal' for iterator as well */ 418 vq->wait_prime_ta = 1; /* to elicit PRIME_RESP_STATE processing 419 from the validator inform_super() routine */ 420 /* store trust anchor name for later lookup when prime returns */ 421 vq->trust_anchor_name = regional_alloc_init(qstate->region, 422 toprime->name, toprime->namelen); 423 vq->trust_anchor_len = toprime->namelen; 424 vq->trust_anchor_labs = toprime->namelabs; 425 if(!vq->trust_anchor_name) { 426 log_err("Could not prime trust anchor: out of memory"); 427 return 0; 428 } 429 return 1; 430 } 431 432 /** 433 * Validate if the ANSWER and AUTHORITY sections contain valid rrsets. 434 * They must be validly signed with the given key. 435 * Tries to validate ADDITIONAL rrsets as well, but only to check them. 436 * Allows unsigned CNAME after a DNAME that expands the DNAME. 437 * 438 * Note that by the time this method is called, the process of finding the 439 * trusted DNSKEY rrset that signs this response must already have been 440 * completed. 441 * 442 * @param qstate: query state. 443 * @param env: module env for verify. 444 * @param ve: validator env for verify. 445 * @param qchase: query that was made. 446 * @param chase_reply: answer to validate. 447 * @param key_entry: the key entry, which is trusted, and which matches 448 * the signer of the answer. The key entry isgood(). 449 * @return false if any of the rrsets in the an or ns sections of the message 450 * fail to verify. The message is then set to bogus. 451 */ 452 static int 453 validate_msg_signatures(struct module_qstate* qstate, struct module_env* env, 454 struct val_env* ve, struct query_info* qchase, 455 struct reply_info* chase_reply, struct key_entry_key* key_entry) 456 { 457 uint8_t* sname; 458 size_t i, slen; 459 struct ub_packed_rrset_key* s; 460 enum sec_status sec; 461 int dname_seen = 0; 462 char* reason = NULL; 463 464 /* validate the ANSWER section */ 465 for(i=0; i<chase_reply->an_numrrsets; i++) { 466 s = chase_reply->rrsets[i]; 467 /* Skip the CNAME following a (validated) DNAME. 468 * Because of the normalization routines in the iterator, 469 * there will always be an unsigned CNAME following a DNAME 470 * (unless qtype=DNAME). */ 471 if(dname_seen && ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) { 472 dname_seen = 0; 473 /* CNAME was synthesized by our own iterator */ 474 /* since the DNAME verified, mark the CNAME as secure */ 475 ((struct packed_rrset_data*)s->entry.data)->security = 476 sec_status_secure; 477 ((struct packed_rrset_data*)s->entry.data)->trust = 478 rrset_trust_validated; 479 continue; 480 } 481 482 /* Verify the answer rrset */ 483 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason); 484 /* If the (answer) rrset failed to validate, then this 485 * message is BAD. */ 486 if(sec != sec_status_secure) { 487 log_nametypeclass(VERB_QUERY, "validator: response " 488 "has failed ANSWER rrset:", s->rk.dname, 489 ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 490 errinf(qstate, reason); 491 if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) 492 errinf(qstate, "for CNAME"); 493 else if(ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) 494 errinf(qstate, "for DNAME"); 495 errinf_origin(qstate, qstate->reply_origin); 496 chase_reply->security = sec_status_bogus; 497 return 0; 498 } 499 500 /* Notice a DNAME that should be followed by an unsigned 501 * CNAME. */ 502 if(qchase->qtype != LDNS_RR_TYPE_DNAME && 503 ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) { 504 dname_seen = 1; 505 } 506 } 507 508 /* validate the AUTHORITY section */ 509 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 510 chase_reply->ns_numrrsets; i++) { 511 s = chase_reply->rrsets[i]; 512 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason); 513 /* If anything in the authority section fails to be secure, 514 * we have a bad message. */ 515 if(sec != sec_status_secure) { 516 log_nametypeclass(VERB_QUERY, "validator: response " 517 "has failed AUTHORITY rrset:", s->rk.dname, 518 ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 519 errinf(qstate, reason); 520 errinf_rrset(qstate, s); 521 errinf_origin(qstate, qstate->reply_origin); 522 chase_reply->security = sec_status_bogus; 523 return 0; 524 } 525 } 526 527 /* attempt to validate the ADDITIONAL section rrsets */ 528 if(!ve->clean_additional) 529 return 1; 530 for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets; 531 i<chase_reply->rrset_count; i++) { 532 s = chase_reply->rrsets[i]; 533 /* only validate rrs that have signatures with the key */ 534 /* leave others unchecked, those get removed later on too */ 535 val_find_rrset_signer(s, &sname, &slen); 536 if(sname && query_dname_compare(sname, key_entry->name)==0) 537 (void)val_verify_rrset_entry(env, ve, s, key_entry, 538 &reason); 539 /* the additional section can fail to be secure, 540 * it is optional, check signature in case we need 541 * to clean the additional section later. */ 542 } 543 544 return 1; 545 } 546 547 /** 548 * Detect wrong truncated response (say from BIND 9.6.1 that is forwarding 549 * and saw the NS record without signatures from a referral). 550 * The positive response has a mangled authority section. 551 * Remove that authority section and the additional section. 552 * @param rep: reply 553 * @return true if a wrongly truncated response. 554 */ 555 static int 556 detect_wrongly_truncated(struct reply_info* rep) 557 { 558 size_t i; 559 /* only NS in authority, and it is bogus */ 560 if(rep->ns_numrrsets != 1 || rep->an_numrrsets == 0) 561 return 0; 562 if(ntohs(rep->rrsets[ rep->an_numrrsets ]->rk.type) != LDNS_RR_TYPE_NS) 563 return 0; 564 if(((struct packed_rrset_data*)rep->rrsets[ rep->an_numrrsets ] 565 ->entry.data)->security == sec_status_secure) 566 return 0; 567 /* answer section is present and secure */ 568 for(i=0; i<rep->an_numrrsets; i++) { 569 if(((struct packed_rrset_data*)rep->rrsets[ i ] 570 ->entry.data)->security != sec_status_secure) 571 return 0; 572 } 573 verbose(VERB_ALGO, "truncating to minimal response"); 574 return 1; 575 } 576 577 /** 578 * For messages that are not referrals, if the chase reply contains an 579 * unsigned NS record in the authority section it could have been 580 * inserted by a (BIND) forwarder that thinks the zone is insecure, and 581 * that has an NS record without signatures in cache. Remove the NS 582 * record since the reply does not hinge on that record (in the authority 583 * section), but do not remove it if it removes the last record from the 584 * answer+authority sections. 585 * @param chase_reply: the chased reply, we have a key for this contents, 586 * so we should have signatures for these rrsets and not having 587 * signatures means it will be bogus. 588 * @param orig_reply: original reply, remove NS from there as well because 589 * we cannot mark the NS record as DNSSEC valid because it is not 590 * validated by signatures. 591 */ 592 static void 593 remove_spurious_authority(struct reply_info* chase_reply, 594 struct reply_info* orig_reply) 595 { 596 size_t i, found = 0; 597 int remove = 0; 598 /* if no answer and only 1 auth RRset, do not remove that one */ 599 if(chase_reply->an_numrrsets == 0 && chase_reply->ns_numrrsets == 1) 600 return; 601 /* search authority section for unsigned NS records */ 602 for(i = chase_reply->an_numrrsets; 603 i < chase_reply->an_numrrsets+chase_reply->ns_numrrsets; i++) { 604 struct packed_rrset_data* d = (struct packed_rrset_data*) 605 chase_reply->rrsets[i]->entry.data; 606 if(ntohs(chase_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS 607 && d->rrsig_count == 0) { 608 found = i; 609 remove = 1; 610 break; 611 } 612 } 613 /* see if we found the entry */ 614 if(!remove) return; 615 log_rrset_key(VERB_ALGO, "Removing spurious unsigned NS record " 616 "(likely inserted by forwarder)", chase_reply->rrsets[found]); 617 618 /* find rrset in orig_reply */ 619 for(i = orig_reply->an_numrrsets; 620 i < orig_reply->an_numrrsets+orig_reply->ns_numrrsets; i++) { 621 if(ntohs(orig_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS 622 && query_dname_compare(orig_reply->rrsets[i]->rk.dname, 623 chase_reply->rrsets[found]->rk.dname) == 0) { 624 /* remove from orig_msg */ 625 val_reply_remove_auth(orig_reply, i); 626 break; 627 } 628 } 629 /* remove rrset from chase_reply */ 630 val_reply_remove_auth(chase_reply, found); 631 } 632 633 /** 634 * Given a "positive" response -- a response that contains an answer to the 635 * question, and no CNAME chain, validate this response. 636 * 637 * The answer and authority RRsets must already be verified as secure. 638 * 639 * @param env: module env for verify. 640 * @param ve: validator env for verify. 641 * @param qchase: query that was made. 642 * @param chase_reply: answer to that query to validate. 643 * @param kkey: the key entry, which is trusted, and which matches 644 * the signer of the answer. The key entry isgood(). 645 */ 646 static void 647 validate_positive_response(struct module_env* env, struct val_env* ve, 648 struct query_info* qchase, struct reply_info* chase_reply, 649 struct key_entry_key* kkey) 650 { 651 uint8_t* wc = NULL; 652 int wc_NSEC_ok = 0; 653 int nsec3s_seen = 0; 654 size_t i; 655 struct ub_packed_rrset_key* s; 656 657 /* validate the ANSWER section - this will be the answer itself */ 658 for(i=0; i<chase_reply->an_numrrsets; i++) { 659 s = chase_reply->rrsets[i]; 660 661 /* Check to see if the rrset is the result of a wildcard 662 * expansion. If so, an additional check will need to be 663 * made in the authority section. */ 664 if(!val_rrset_wildcard(s, &wc)) { 665 log_nametypeclass(VERB_QUERY, "Positive response has " 666 "inconsistent wildcard sigs:", s->rk.dname, 667 ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 668 chase_reply->security = sec_status_bogus; 669 return; 670 } 671 } 672 673 /* validate the AUTHORITY section as well - this will generally be 674 * the NS rrset (which could be missing, no problem) */ 675 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 676 chase_reply->ns_numrrsets; i++) { 677 s = chase_reply->rrsets[i]; 678 679 /* If this is a positive wildcard response, and we have a 680 * (just verified) NSEC record, try to use it to 1) prove 681 * that qname doesn't exist and 2) that the correct wildcard 682 * was used. */ 683 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 684 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) { 685 wc_NSEC_ok = 1; 686 } 687 /* if not, continue looking for proof */ 688 } 689 690 /* Otherwise, if this is a positive wildcard response and 691 * we have NSEC3 records */ 692 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 693 nsec3s_seen = 1; 694 } 695 } 696 697 /* If this was a positive wildcard response that we haven't already 698 * proven, and we have NSEC3 records, try to prove it using the NSEC3 699 * records. */ 700 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) { 701 enum sec_status sec = nsec3_prove_wildcard(env, ve, 702 chase_reply->rrsets+chase_reply->an_numrrsets, 703 chase_reply->ns_numrrsets, qchase, kkey, wc); 704 if(sec == sec_status_insecure) { 705 verbose(VERB_ALGO, "Positive wildcard response is " 706 "insecure"); 707 chase_reply->security = sec_status_insecure; 708 return; 709 } else if(sec == sec_status_secure) 710 wc_NSEC_ok = 1; 711 } 712 713 /* If after all this, we still haven't proven the positive wildcard 714 * response, fail. */ 715 if(wc != NULL && !wc_NSEC_ok) { 716 verbose(VERB_QUERY, "positive response was wildcard " 717 "expansion and did not prove original data " 718 "did not exist"); 719 chase_reply->security = sec_status_bogus; 720 return; 721 } 722 723 verbose(VERB_ALGO, "Successfully validated positive response"); 724 chase_reply->security = sec_status_secure; 725 } 726 727 /** 728 * Validate a NOERROR/NODATA signed response -- a response that has a 729 * NOERROR Rcode but no ANSWER section RRsets. This consists of making 730 * certain that the authority section NSEC/NSEC3s proves that the qname 731 * does exist and the qtype doesn't. 732 * 733 * The answer and authority RRsets must already be verified as secure. 734 * 735 * @param env: module env for verify. 736 * @param ve: validator env for verify. 737 * @param qchase: query that was made. 738 * @param chase_reply: answer to that query to validate. 739 * @param kkey: the key entry, which is trusted, and which matches 740 * the signer of the answer. The key entry isgood(). 741 */ 742 static void 743 validate_nodata_response(struct module_env* env, struct val_env* ve, 744 struct query_info* qchase, struct reply_info* chase_reply, 745 struct key_entry_key* kkey) 746 { 747 /* Since we are here, there must be nothing in the ANSWER section to 748 * validate. */ 749 /* (Note: CNAME/DNAME responses will not directly get here -- 750 * instead, they are chased down into indiviual CNAME validations, 751 * and at the end of the cname chain a POSITIVE, or CNAME_NOANSWER 752 * validation.) */ 753 754 /* validate the AUTHORITY section */ 755 int has_valid_nsec = 0; /* If true, then the NODATA has been proven.*/ 756 uint8_t* ce = NULL; /* for wildcard nodata responses. This is the 757 proven closest encloser. */ 758 uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */ 759 int nsec3s_seen = 0; /* nsec3s seen */ 760 struct ub_packed_rrset_key* s; 761 size_t i; 762 763 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 764 chase_reply->ns_numrrsets; i++) { 765 s = chase_reply->rrsets[i]; 766 /* If we encounter an NSEC record, try to use it to prove 767 * NODATA. 768 * This needs to handle the ENT NODATA case. */ 769 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 770 if(nsec_proves_nodata(s, qchase, &wc)) { 771 has_valid_nsec = 1; 772 /* sets wc-encloser if wildcard applicable */ 773 } 774 if(val_nsec_proves_name_error(s, qchase->qname)) { 775 ce = nsec_closest_encloser(qchase->qname, s); 776 } 777 if(val_nsec_proves_insecuredelegation(s, qchase)) { 778 verbose(VERB_ALGO, "delegation is insecure"); 779 chase_reply->security = sec_status_insecure; 780 return; 781 } 782 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 783 nsec3s_seen = 1; 784 } 785 } 786 787 /* check to see if we have a wildcard NODATA proof. */ 788 789 /* The wildcard NODATA is 1 NSEC proving that qname does not exist 790 * (and also proving what the closest encloser is), and 1 NSEC 791 * showing the matching wildcard, which must be *.closest_encloser. */ 792 if(wc && !ce) 793 has_valid_nsec = 0; 794 else if(wc && ce) { 795 if(query_dname_compare(wc, ce) != 0) { 796 has_valid_nsec = 0; 797 } 798 } 799 800 if(!has_valid_nsec && nsec3s_seen) { 801 enum sec_status sec = nsec3_prove_nodata(env, ve, 802 chase_reply->rrsets+chase_reply->an_numrrsets, 803 chase_reply->ns_numrrsets, qchase, kkey); 804 if(sec == sec_status_insecure) { 805 verbose(VERB_ALGO, "NODATA response is insecure"); 806 chase_reply->security = sec_status_insecure; 807 return; 808 } else if(sec == sec_status_secure) 809 has_valid_nsec = 1; 810 } 811 812 if(!has_valid_nsec) { 813 verbose(VERB_QUERY, "NODATA response failed to prove NODATA " 814 "status with NSEC/NSEC3"); 815 if(verbosity >= VERB_ALGO) 816 log_dns_msg("Failed NODATA", qchase, chase_reply); 817 chase_reply->security = sec_status_bogus; 818 return; 819 } 820 821 verbose(VERB_ALGO, "successfully validated NODATA response."); 822 chase_reply->security = sec_status_secure; 823 } 824 825 /** 826 * Validate a NAMEERROR signed response -- a response that has a NXDOMAIN 827 * Rcode. 828 * This consists of making certain that the authority section NSEC proves 829 * that the qname doesn't exist and the covering wildcard also doesn't exist.. 830 * 831 * The answer and authority RRsets must have already been verified as secure. 832 * 833 * @param env: module env for verify. 834 * @param ve: validator env for verify. 835 * @param qchase: query that was made. 836 * @param chase_reply: answer to that query to validate. 837 * @param kkey: the key entry, which is trusted, and which matches 838 * the signer of the answer. The key entry isgood(). 839 * @param rcode: adjusted RCODE, in case of RCODE/proof mismatch leniency. 840 */ 841 static void 842 validate_nameerror_response(struct module_env* env, struct val_env* ve, 843 struct query_info* qchase, struct reply_info* chase_reply, 844 struct key_entry_key* kkey, int* rcode) 845 { 846 int has_valid_nsec = 0; 847 int has_valid_wnsec = 0; 848 int nsec3s_seen = 0; 849 struct ub_packed_rrset_key* s; 850 size_t i; 851 852 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 853 chase_reply->ns_numrrsets; i++) { 854 s = chase_reply->rrsets[i]; 855 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 856 if(val_nsec_proves_name_error(s, qchase->qname)) 857 has_valid_nsec = 1; 858 if(val_nsec_proves_no_wc(s, qchase->qname, 859 qchase->qname_len)) 860 has_valid_wnsec = 1; 861 if(val_nsec_proves_insecuredelegation(s, qchase)) { 862 verbose(VERB_ALGO, "delegation is insecure"); 863 chase_reply->security = sec_status_insecure; 864 return; 865 } 866 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) 867 nsec3s_seen = 1; 868 } 869 870 if((!has_valid_nsec || !has_valid_wnsec) && nsec3s_seen) { 871 /* use NSEC3 proof, both answer and auth rrsets, in case 872 * NSEC3s end up in the answer (due to qtype=NSEC3 or so) */ 873 chase_reply->security = nsec3_prove_nameerror(env, ve, 874 chase_reply->rrsets, chase_reply->an_numrrsets+ 875 chase_reply->ns_numrrsets, qchase, kkey); 876 if(chase_reply->security != sec_status_secure) { 877 verbose(VERB_QUERY, "NameError response failed nsec, " 878 "nsec3 proof was %s", sec_status_to_string( 879 chase_reply->security)); 880 return; 881 } 882 has_valid_nsec = 1; 883 has_valid_wnsec = 1; 884 } 885 886 /* If the message fails to prove either condition, it is bogus. */ 887 if(!has_valid_nsec) { 888 verbose(VERB_QUERY, "NameError response has failed to prove: " 889 "qname does not exist"); 890 chase_reply->security = sec_status_bogus; 891 /* Be lenient with RCODE in NSEC NameError responses */ 892 validate_nodata_response(env, ve, qchase, chase_reply, kkey); 893 if (chase_reply->security == sec_status_secure) 894 *rcode = LDNS_RCODE_NOERROR; 895 return; 896 } 897 898 if(!has_valid_wnsec) { 899 verbose(VERB_QUERY, "NameError response has failed to prove: " 900 "covering wildcard does not exist"); 901 chase_reply->security = sec_status_bogus; 902 /* Be lenient with RCODE in NSEC NameError responses */ 903 validate_nodata_response(env, ve, qchase, chase_reply, kkey); 904 if (chase_reply->security == sec_status_secure) 905 *rcode = LDNS_RCODE_NOERROR; 906 return; 907 } 908 909 /* Otherwise, we consider the message secure. */ 910 verbose(VERB_ALGO, "successfully validated NAME ERROR response."); 911 chase_reply->security = sec_status_secure; 912 } 913 914 /** 915 * Given a referral response, validate rrsets and take least trusted rrset 916 * as the current validation status. 917 * 918 * Note that by the time this method is called, the process of finding the 919 * trusted DNSKEY rrset that signs this response must already have been 920 * completed. 921 * 922 * @param chase_reply: answer to validate. 923 */ 924 static void 925 validate_referral_response(struct reply_info* chase_reply) 926 { 927 size_t i; 928 enum sec_status s; 929 /* message security equals lowest rrset security */ 930 chase_reply->security = sec_status_secure; 931 for(i=0; i<chase_reply->rrset_count; i++) { 932 s = ((struct packed_rrset_data*)chase_reply->rrsets[i] 933 ->entry.data)->security; 934 if(s < chase_reply->security) 935 chase_reply->security = s; 936 } 937 verbose(VERB_ALGO, "validated part of referral response as %s", 938 sec_status_to_string(chase_reply->security)); 939 } 940 941 /** 942 * Given an "ANY" response -- a response that contains an answer to a 943 * qtype==ANY question, with answers. This does no checking that all 944 * types are present. 945 * 946 * NOTE: it may be possible to get parent-side delegation point records 947 * here, which won't all be signed. Right now, this routine relies on the 948 * upstream iterative resolver to not return these responses -- instead 949 * treating them as referrals. 950 * 951 * NOTE: RFC 4035 is silent on this issue, so this may change upon 952 * clarification. Clarification draft -05 says to not check all types are 953 * present. 954 * 955 * Note that by the time this method is called, the process of finding the 956 * trusted DNSKEY rrset that signs this response must already have been 957 * completed. 958 * 959 * @param env: module env for verify. 960 * @param ve: validator env for verify. 961 * @param qchase: query that was made. 962 * @param chase_reply: answer to that query to validate. 963 * @param kkey: the key entry, which is trusted, and which matches 964 * the signer of the answer. The key entry isgood(). 965 */ 966 static void 967 validate_any_response(struct module_env* env, struct val_env* ve, 968 struct query_info* qchase, struct reply_info* chase_reply, 969 struct key_entry_key* kkey) 970 { 971 /* all answer and auth rrsets already verified */ 972 /* but check if a wildcard response is given, then check NSEC/NSEC3 973 * for qname denial to see if wildcard is applicable */ 974 uint8_t* wc = NULL; 975 int wc_NSEC_ok = 0; 976 int nsec3s_seen = 0; 977 size_t i; 978 struct ub_packed_rrset_key* s; 979 980 if(qchase->qtype != LDNS_RR_TYPE_ANY) { 981 log_err("internal error: ANY validation called for non-ANY"); 982 chase_reply->security = sec_status_bogus; 983 return; 984 } 985 986 /* validate the ANSWER section - this will be the answer itself */ 987 for(i=0; i<chase_reply->an_numrrsets; i++) { 988 s = chase_reply->rrsets[i]; 989 990 /* Check to see if the rrset is the result of a wildcard 991 * expansion. If so, an additional check will need to be 992 * made in the authority section. */ 993 if(!val_rrset_wildcard(s, &wc)) { 994 log_nametypeclass(VERB_QUERY, "Positive ANY response" 995 " has inconsistent wildcard sigs:", 996 s->rk.dname, ntohs(s->rk.type), 997 ntohs(s->rk.rrset_class)); 998 chase_reply->security = sec_status_bogus; 999 return; 1000 } 1001 } 1002 1003 /* if it was a wildcard, check for NSEC/NSEC3s in both answer 1004 * and authority sections (NSEC may be moved to the ANSWER section) */ 1005 if(wc != NULL) 1006 for(i=0; i<chase_reply->an_numrrsets+chase_reply->ns_numrrsets; 1007 i++) { 1008 s = chase_reply->rrsets[i]; 1009 1010 /* If this is a positive wildcard response, and we have a 1011 * (just verified) NSEC record, try to use it to 1) prove 1012 * that qname doesn't exist and 2) that the correct wildcard 1013 * was used. */ 1014 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 1015 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) { 1016 wc_NSEC_ok = 1; 1017 } 1018 /* if not, continue looking for proof */ 1019 } 1020 1021 /* Otherwise, if this is a positive wildcard response and 1022 * we have NSEC3 records */ 1023 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 1024 nsec3s_seen = 1; 1025 } 1026 } 1027 1028 /* If this was a positive wildcard response that we haven't already 1029 * proven, and we have NSEC3 records, try to prove it using the NSEC3 1030 * records. */ 1031 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) { 1032 /* look both in answer and auth section for NSEC3s */ 1033 enum sec_status sec = nsec3_prove_wildcard(env, ve, 1034 chase_reply->rrsets, 1035 chase_reply->an_numrrsets+chase_reply->ns_numrrsets, 1036 qchase, kkey, wc); 1037 if(sec == sec_status_insecure) { 1038 verbose(VERB_ALGO, "Positive ANY wildcard response is " 1039 "insecure"); 1040 chase_reply->security = sec_status_insecure; 1041 return; 1042 } else if(sec == sec_status_secure) 1043 wc_NSEC_ok = 1; 1044 } 1045 1046 /* If after all this, we still haven't proven the positive wildcard 1047 * response, fail. */ 1048 if(wc != NULL && !wc_NSEC_ok) { 1049 verbose(VERB_QUERY, "positive ANY response was wildcard " 1050 "expansion and did not prove original data " 1051 "did not exist"); 1052 chase_reply->security = sec_status_bogus; 1053 return; 1054 } 1055 1056 verbose(VERB_ALGO, "Successfully validated positive ANY response"); 1057 chase_reply->security = sec_status_secure; 1058 } 1059 1060 /** 1061 * Validate CNAME response, or DNAME+CNAME. 1062 * This is just like a positive proof, except that this is about a 1063 * DNAME+CNAME. Possible wildcard proof. 1064 * Difference with positive proof is that this routine refuses 1065 * wildcarded DNAMEs. 1066 * 1067 * The answer and authority rrsets must already be verified as secure. 1068 * 1069 * @param env: module env for verify. 1070 * @param ve: validator env for verify. 1071 * @param qchase: query that was made. 1072 * @param chase_reply: answer to that query to validate. 1073 * @param kkey: the key entry, which is trusted, and which matches 1074 * the signer of the answer. The key entry isgood(). 1075 */ 1076 static void 1077 validate_cname_response(struct module_env* env, struct val_env* ve, 1078 struct query_info* qchase, struct reply_info* chase_reply, 1079 struct key_entry_key* kkey) 1080 { 1081 uint8_t* wc = NULL; 1082 int wc_NSEC_ok = 0; 1083 int nsec3s_seen = 0; 1084 size_t i; 1085 struct ub_packed_rrset_key* s; 1086 1087 /* validate the ANSWER section - this will be the CNAME (+DNAME) */ 1088 for(i=0; i<chase_reply->an_numrrsets; i++) { 1089 s = chase_reply->rrsets[i]; 1090 1091 /* Check to see if the rrset is the result of a wildcard 1092 * expansion. If so, an additional check will need to be 1093 * made in the authority section. */ 1094 if(!val_rrset_wildcard(s, &wc)) { 1095 log_nametypeclass(VERB_QUERY, "Cname response has " 1096 "inconsistent wildcard sigs:", s->rk.dname, 1097 ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 1098 chase_reply->security = sec_status_bogus; 1099 return; 1100 } 1101 1102 /* Refuse wildcarded DNAMEs rfc 4597. 1103 * Do not follow a wildcarded DNAME because 1104 * its synthesized CNAME expansion is underdefined */ 1105 if(qchase->qtype != LDNS_RR_TYPE_DNAME && 1106 ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME && wc) { 1107 log_nametypeclass(VERB_QUERY, "cannot validate a " 1108 "wildcarded DNAME:", s->rk.dname, 1109 ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 1110 chase_reply->security = sec_status_bogus; 1111 return; 1112 } 1113 1114 /* If we have found a CNAME, stop looking for one. 1115 * The iterator has placed the CNAME chain in correct 1116 * order. */ 1117 if (ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) { 1118 break; 1119 } 1120 } 1121 1122 /* AUTHORITY section */ 1123 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 1124 chase_reply->ns_numrrsets; i++) { 1125 s = chase_reply->rrsets[i]; 1126 1127 /* If this is a positive wildcard response, and we have a 1128 * (just verified) NSEC record, try to use it to 1) prove 1129 * that qname doesn't exist and 2) that the correct wildcard 1130 * was used. */ 1131 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 1132 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) { 1133 wc_NSEC_ok = 1; 1134 } 1135 /* if not, continue looking for proof */ 1136 } 1137 1138 /* Otherwise, if this is a positive wildcard response and 1139 * we have NSEC3 records */ 1140 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 1141 nsec3s_seen = 1; 1142 } 1143 } 1144 1145 /* If this was a positive wildcard response that we haven't already 1146 * proven, and we have NSEC3 records, try to prove it using the NSEC3 1147 * records. */ 1148 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) { 1149 enum sec_status sec = nsec3_prove_wildcard(env, ve, 1150 chase_reply->rrsets+chase_reply->an_numrrsets, 1151 chase_reply->ns_numrrsets, qchase, kkey, wc); 1152 if(sec == sec_status_insecure) { 1153 verbose(VERB_ALGO, "wildcard CNAME response is " 1154 "insecure"); 1155 chase_reply->security = sec_status_insecure; 1156 return; 1157 } else if(sec == sec_status_secure) 1158 wc_NSEC_ok = 1; 1159 } 1160 1161 /* If after all this, we still haven't proven the positive wildcard 1162 * response, fail. */ 1163 if(wc != NULL && !wc_NSEC_ok) { 1164 verbose(VERB_QUERY, "CNAME response was wildcard " 1165 "expansion and did not prove original data " 1166 "did not exist"); 1167 chase_reply->security = sec_status_bogus; 1168 return; 1169 } 1170 1171 verbose(VERB_ALGO, "Successfully validated CNAME response"); 1172 chase_reply->security = sec_status_secure; 1173 } 1174 1175 /** 1176 * Validate CNAME NOANSWER response, no more data after a CNAME chain. 1177 * This can be a NODATA or a NAME ERROR case, but not both at the same time. 1178 * We don't know because the rcode has been set to NOERROR by the CNAME. 1179 * 1180 * The answer and authority rrsets must already be verified as secure. 1181 * 1182 * @param env: module env for verify. 1183 * @param ve: validator env for verify. 1184 * @param qchase: query that was made. 1185 * @param chase_reply: answer to that query to validate. 1186 * @param kkey: the key entry, which is trusted, and which matches 1187 * the signer of the answer. The key entry isgood(). 1188 */ 1189 static void 1190 validate_cname_noanswer_response(struct module_env* env, struct val_env* ve, 1191 struct query_info* qchase, struct reply_info* chase_reply, 1192 struct key_entry_key* kkey) 1193 { 1194 int nodata_valid_nsec = 0; /* If true, then NODATA has been proven.*/ 1195 uint8_t* ce = NULL; /* for wildcard nodata responses. This is the 1196 proven closest encloser. */ 1197 uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */ 1198 int nxdomain_valid_nsec = 0; /* if true, namerror has been proven */ 1199 int nxdomain_valid_wnsec = 0; 1200 int nsec3s_seen = 0; /* nsec3s seen */ 1201 struct ub_packed_rrset_key* s; 1202 size_t i; 1203 1204 /* the AUTHORITY section */ 1205 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 1206 chase_reply->ns_numrrsets; i++) { 1207 s = chase_reply->rrsets[i]; 1208 1209 /* If we encounter an NSEC record, try to use it to prove 1210 * NODATA. This needs to handle the ENT NODATA case. 1211 * Also try to prove NAMEERROR, and absence of a wildcard */ 1212 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 1213 if(nsec_proves_nodata(s, qchase, &wc)) { 1214 nodata_valid_nsec = 1; 1215 /* set wc encloser if wildcard applicable */ 1216 } 1217 if(val_nsec_proves_name_error(s, qchase->qname)) { 1218 ce = nsec_closest_encloser(qchase->qname, s); 1219 nxdomain_valid_nsec = 1; 1220 } 1221 if(val_nsec_proves_no_wc(s, qchase->qname, 1222 qchase->qname_len)) 1223 nxdomain_valid_wnsec = 1; 1224 if(val_nsec_proves_insecuredelegation(s, qchase)) { 1225 verbose(VERB_ALGO, "delegation is insecure"); 1226 chase_reply->security = sec_status_insecure; 1227 return; 1228 } 1229 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 1230 nsec3s_seen = 1; 1231 } 1232 } 1233 1234 /* check to see if we have a wildcard NODATA proof. */ 1235 1236 /* The wildcard NODATA is 1 NSEC proving that qname does not exists 1237 * (and also proving what the closest encloser is), and 1 NSEC 1238 * showing the matching wildcard, which must be *.closest_encloser. */ 1239 if(wc && !ce) 1240 nodata_valid_nsec = 0; 1241 else if(wc && ce) { 1242 if(query_dname_compare(wc, ce) != 0) { 1243 nodata_valid_nsec = 0; 1244 } 1245 } 1246 if(nxdomain_valid_nsec && !nxdomain_valid_wnsec) { 1247 /* name error is missing wildcard denial proof */ 1248 nxdomain_valid_nsec = 0; 1249 } 1250 1251 if(nodata_valid_nsec && nxdomain_valid_nsec) { 1252 verbose(VERB_QUERY, "CNAMEchain to noanswer proves that name " 1253 "exists and not exists, bogus"); 1254 chase_reply->security = sec_status_bogus; 1255 return; 1256 } 1257 if(!nodata_valid_nsec && !nxdomain_valid_nsec && nsec3s_seen) { 1258 int nodata; 1259 enum sec_status sec = nsec3_prove_nxornodata(env, ve, 1260 chase_reply->rrsets+chase_reply->an_numrrsets, 1261 chase_reply->ns_numrrsets, qchase, kkey, &nodata); 1262 if(sec == sec_status_insecure) { 1263 verbose(VERB_ALGO, "CNAMEchain to noanswer response " 1264 "is insecure"); 1265 chase_reply->security = sec_status_insecure; 1266 return; 1267 } else if(sec == sec_status_secure) { 1268 if(nodata) 1269 nodata_valid_nsec = 1; 1270 else nxdomain_valid_nsec = 1; 1271 } 1272 } 1273 1274 if(!nodata_valid_nsec && !nxdomain_valid_nsec) { 1275 verbose(VERB_QUERY, "CNAMEchain to noanswer response failed " 1276 "to prove status with NSEC/NSEC3"); 1277 if(verbosity >= VERB_ALGO) 1278 log_dns_msg("Failed CNAMEnoanswer", qchase, chase_reply); 1279 chase_reply->security = sec_status_bogus; 1280 return; 1281 } 1282 1283 if(nodata_valid_nsec) 1284 verbose(VERB_ALGO, "successfully validated CNAME chain to a " 1285 "NODATA response."); 1286 else verbose(VERB_ALGO, "successfully validated CNAME chain to a " 1287 "NAMEERROR response."); 1288 chase_reply->security = sec_status_secure; 1289 } 1290 1291 /** 1292 * Process init state for validator. 1293 * Process the INIT state. First tier responses start in the INIT state. 1294 * This is where they are vetted for validation suitability, and the initial 1295 * key search is done. 1296 * 1297 * Currently, events the come through this routine will be either promoted 1298 * to FINISHED/CNAME_RESP (no validation needed), FINDKEY (next step to 1299 * validation), or will be (temporarily) retired and a new priming request 1300 * event will be generated. 1301 * 1302 * @param qstate: query state. 1303 * @param vq: validator query state. 1304 * @param ve: validator shared global environment. 1305 * @param id: module id. 1306 * @return true if the event should be processed further on return, false if 1307 * not. 1308 */ 1309 static int 1310 processInit(struct module_qstate* qstate, struct val_qstate* vq, 1311 struct val_env* ve, int id) 1312 { 1313 uint8_t* lookup_name; 1314 size_t lookup_len; 1315 struct trust_anchor* anchor; 1316 enum val_classification subtype = val_classify_response( 1317 qstate->query_flags, &qstate->qinfo, &vq->qchase, 1318 vq->orig_msg->rep, vq->rrset_skip); 1319 if(vq->restart_count > VAL_MAX_RESTART_COUNT) { 1320 verbose(VERB_ALGO, "restart count exceeded"); 1321 return val_error(qstate, id); 1322 } 1323 verbose(VERB_ALGO, "validator classification %s", 1324 val_classification_to_string(subtype)); 1325 if(subtype == VAL_CLASS_REFERRAL && 1326 vq->rrset_skip < vq->orig_msg->rep->rrset_count) { 1327 /* referral uses the rrset name as qchase, to find keys for 1328 * that rrset */ 1329 vq->qchase.qname = vq->orig_msg->rep-> 1330 rrsets[vq->rrset_skip]->rk.dname; 1331 vq->qchase.qname_len = vq->orig_msg->rep-> 1332 rrsets[vq->rrset_skip]->rk.dname_len; 1333 vq->qchase.qtype = ntohs(vq->orig_msg->rep-> 1334 rrsets[vq->rrset_skip]->rk.type); 1335 vq->qchase.qclass = ntohs(vq->orig_msg->rep-> 1336 rrsets[vq->rrset_skip]->rk.rrset_class); 1337 } 1338 lookup_name = vq->qchase.qname; 1339 lookup_len = vq->qchase.qname_len; 1340 /* for type DS look at the parent side for keys/trustanchor */ 1341 /* also for NSEC not at apex */ 1342 if(vq->qchase.qtype == LDNS_RR_TYPE_DS || 1343 (vq->qchase.qtype == LDNS_RR_TYPE_NSEC && 1344 vq->orig_msg->rep->rrset_count > vq->rrset_skip && 1345 ntohs(vq->orig_msg->rep->rrsets[vq->rrset_skip]->rk.type) == 1346 LDNS_RR_TYPE_NSEC && 1347 !(vq->orig_msg->rep->rrsets[vq->rrset_skip]-> 1348 rk.flags&PACKED_RRSET_NSEC_AT_APEX))) { 1349 dname_remove_label(&lookup_name, &lookup_len); 1350 } 1351 1352 val_mark_indeterminate(vq->chase_reply, qstate->env->anchors, 1353 qstate->env->rrset_cache, qstate->env); 1354 vq->key_entry = NULL; 1355 vq->empty_DS_name = NULL; 1356 vq->ds_rrset = 0; 1357 anchor = anchors_lookup(qstate->env->anchors, 1358 lookup_name, lookup_len, vq->qchase.qclass); 1359 1360 /* Determine the signer/lookup name */ 1361 val_find_signer(subtype, &vq->qchase, vq->orig_msg->rep, 1362 vq->rrset_skip, &vq->signer_name, &vq->signer_len); 1363 if(vq->signer_name != NULL && 1364 !dname_subdomain_c(lookup_name, vq->signer_name)) { 1365 log_nametypeclass(VERB_ALGO, "this signer name is not a parent " 1366 "of lookupname, omitted", vq->signer_name, 0, 0); 1367 vq->signer_name = NULL; 1368 } 1369 if(vq->signer_name == NULL) { 1370 log_nametypeclass(VERB_ALGO, "no signer, using", lookup_name, 1371 0, 0); 1372 } else { 1373 lookup_name = vq->signer_name; 1374 lookup_len = vq->signer_len; 1375 log_nametypeclass(VERB_ALGO, "signer is", lookup_name, 0, 0); 1376 } 1377 1378 /* for NXDOMAIN it could be signed by a parent of the trust anchor */ 1379 if(subtype == VAL_CLASS_NAMEERROR && vq->signer_name && 1380 anchor && dname_strict_subdomain_c(anchor->name, lookup_name)){ 1381 lock_basic_unlock(&anchor->lock); 1382 anchor = anchors_lookup(qstate->env->anchors, 1383 lookup_name, lookup_len, vq->qchase.qclass); 1384 if(!anchor) { /* unsigned parent denies anchor*/ 1385 verbose(VERB_QUERY, "unsigned parent zone denies" 1386 " trust anchor, indeterminate"); 1387 vq->chase_reply->security = sec_status_indeterminate; 1388 vq->state = VAL_FINISHED_STATE; 1389 return 1; 1390 } 1391 verbose(VERB_ALGO, "trust anchor NXDOMAIN by signed parent"); 1392 } else if(subtype == VAL_CLASS_POSITIVE && 1393 qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY && 1394 query_dname_compare(lookup_name, qstate->qinfo.qname) == 0) { 1395 /* is a DNSKEY so lookup a bit higher since we want to 1396 * get it from a parent or from trustanchor */ 1397 dname_remove_label(&lookup_name, &lookup_len); 1398 } 1399 1400 if(vq->rrset_skip > 0 || subtype == VAL_CLASS_CNAME || 1401 subtype == VAL_CLASS_REFERRAL) { 1402 /* extract this part of orig_msg into chase_reply for 1403 * the eventual VALIDATE stage */ 1404 val_fill_reply(vq->chase_reply, vq->orig_msg->rep, 1405 vq->rrset_skip, lookup_name, lookup_len, 1406 vq->signer_name); 1407 if(verbosity >= VERB_ALGO) 1408 log_dns_msg("chased extract", &vq->qchase, 1409 vq->chase_reply); 1410 } 1411 1412 vq->key_entry = key_cache_obtain(ve->kcache, lookup_name, lookup_len, 1413 vq->qchase.qclass, qstate->region, *qstate->env->now); 1414 1415 /* there is no key(from DLV) and no trust anchor */ 1416 if(vq->key_entry == NULL && anchor == NULL) { 1417 /*response isn't under a trust anchor, so we cannot validate.*/ 1418 vq->chase_reply->security = sec_status_indeterminate; 1419 /* go to finished state to cache this result */ 1420 vq->state = VAL_FINISHED_STATE; 1421 return 1; 1422 } 1423 /* if not key, or if keyentry is *above* the trustanchor, i.e. 1424 * the keyentry is based on another (higher) trustanchor */ 1425 else if(vq->key_entry == NULL || (anchor && 1426 dname_strict_subdomain_c(anchor->name, vq->key_entry->name))) { 1427 /* trust anchor is an 'unsigned' trust anchor */ 1428 if(anchor && anchor->numDS == 0 && anchor->numDNSKEY == 0) { 1429 vq->chase_reply->security = sec_status_insecure; 1430 val_mark_insecure(vq->chase_reply, anchor->name, 1431 qstate->env->rrset_cache, qstate->env); 1432 lock_basic_unlock(&anchor->lock); 1433 vq->dlv_checked=1; /* skip DLV check */ 1434 /* go to finished state to cache this result */ 1435 vq->state = VAL_FINISHED_STATE; 1436 return 1; 1437 } 1438 /* fire off a trust anchor priming query. */ 1439 verbose(VERB_DETAIL, "prime trust anchor"); 1440 if(!prime_trust_anchor(qstate, vq, id, anchor)) { 1441 lock_basic_unlock(&anchor->lock); 1442 return val_error(qstate, id); 1443 } 1444 lock_basic_unlock(&anchor->lock); 1445 /* and otherwise, don't continue processing this event. 1446 * (it will be reactivated when the priming query returns). */ 1447 vq->state = VAL_FINDKEY_STATE; 1448 return 0; 1449 } 1450 if(anchor) { 1451 lock_basic_unlock(&anchor->lock); 1452 } 1453 1454 if(key_entry_isnull(vq->key_entry)) { 1455 /* response is under a null key, so we cannot validate 1456 * However, we do set the status to INSECURE, since it is 1457 * essentially proven insecure. */ 1458 vq->chase_reply->security = sec_status_insecure; 1459 val_mark_insecure(vq->chase_reply, vq->key_entry->name, 1460 qstate->env->rrset_cache, qstate->env); 1461 /* go to finished state to cache this result */ 1462 vq->state = VAL_FINISHED_STATE; 1463 return 1; 1464 } else if(key_entry_isbad(vq->key_entry)) { 1465 /* key is bad, chain is bad, reply is bogus */ 1466 errinf_dname(qstate, "key for validation", vq->key_entry->name); 1467 errinf(qstate, "is marked as invalid"); 1468 if(key_entry_get_reason(vq->key_entry)) { 1469 errinf(qstate, "because of a previous"); 1470 errinf(qstate, key_entry_get_reason(vq->key_entry)); 1471 } 1472 /* no retries, stop bothering the authority until timeout */ 1473 vq->restart_count = VAL_MAX_RESTART_COUNT; 1474 vq->chase_reply->security = sec_status_bogus; 1475 vq->state = VAL_FINISHED_STATE; 1476 return 1; 1477 } 1478 1479 /* otherwise, we have our "closest" cached key -- continue 1480 * processing in the next state. */ 1481 vq->state = VAL_FINDKEY_STATE; 1482 return 1; 1483 } 1484 1485 /** 1486 * Process the FINDKEY state. Generally this just calculates the next name 1487 * to query and either issues a DS or a DNSKEY query. It will check to see 1488 * if the correct key has already been reached, in which case it will 1489 * advance the event to the next state. 1490 * 1491 * @param qstate: query state. 1492 * @param vq: validator query state. 1493 * @param id: module id. 1494 * @return true if the event should be processed further on return, false if 1495 * not. 1496 */ 1497 static int 1498 processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id) 1499 { 1500 uint8_t* target_key_name, *current_key_name; 1501 size_t target_key_len; 1502 int strip_lab; 1503 1504 log_query_info(VERB_ALGO, "validator: FindKey", &vq->qchase); 1505 /* We know that state.key_entry is not 0 or bad key -- if it were, 1506 * then previous processing should have directed this event to 1507 * a different state. 1508 * It could be an isnull key, which signals that a DLV was just 1509 * done and the DNSKEY after the DLV failed with dnssec-retry state 1510 * and the DNSKEY has to be performed again. */ 1511 log_assert(vq->key_entry && !key_entry_isbad(vq->key_entry)); 1512 if(key_entry_isnull(vq->key_entry)) { 1513 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 1514 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 1515 vq->qchase.qclass, BIT_CD)) { 1516 log_err("mem error generating DNSKEY request"); 1517 return val_error(qstate, id); 1518 } 1519 return 0; 1520 } 1521 1522 target_key_name = vq->signer_name; 1523 target_key_len = vq->signer_len; 1524 if(!target_key_name) { 1525 target_key_name = vq->qchase.qname; 1526 target_key_len = vq->qchase.qname_len; 1527 } 1528 1529 current_key_name = vq->key_entry->name; 1530 1531 /* If our current key entry matches our target, then we are done. */ 1532 if(query_dname_compare(target_key_name, current_key_name) == 0) { 1533 vq->state = VAL_VALIDATE_STATE; 1534 return 1; 1535 } 1536 1537 if(vq->empty_DS_name) { 1538 /* if the last empty nonterminal/emptyDS name we detected is 1539 * below the current key, use that name to make progress 1540 * along the chain of trust */ 1541 if(query_dname_compare(target_key_name, 1542 vq->empty_DS_name) == 0) { 1543 /* do not query for empty_DS_name again */ 1544 verbose(VERB_ALGO, "Cannot retrieve DS for signature"); 1545 errinf(qstate, "no signatures"); 1546 errinf_origin(qstate, qstate->reply_origin); 1547 vq->chase_reply->security = sec_status_bogus; 1548 vq->state = VAL_FINISHED_STATE; 1549 return 1; 1550 } 1551 current_key_name = vq->empty_DS_name; 1552 } 1553 1554 log_nametypeclass(VERB_ALGO, "current keyname", current_key_name, 1555 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN); 1556 log_nametypeclass(VERB_ALGO, "target keyname", target_key_name, 1557 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN); 1558 /* assert we are walking down the DNS tree */ 1559 if(!dname_subdomain_c(target_key_name, current_key_name)) { 1560 verbose(VERB_ALGO, "bad signer name"); 1561 vq->chase_reply->security = sec_status_bogus; 1562 vq->state = VAL_FINISHED_STATE; 1563 return 1; 1564 } 1565 /* so this value is >= -1 */ 1566 strip_lab = dname_count_labels(target_key_name) - 1567 dname_count_labels(current_key_name) - 1; 1568 log_assert(strip_lab >= -1); 1569 verbose(VERB_ALGO, "striplab %d", strip_lab); 1570 if(strip_lab > 0) { 1571 dname_remove_labels(&target_key_name, &target_key_len, 1572 strip_lab); 1573 } 1574 log_nametypeclass(VERB_ALGO, "next keyname", target_key_name, 1575 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN); 1576 1577 /* The next step is either to query for the next DS, or to query 1578 * for the next DNSKEY. */ 1579 if(vq->ds_rrset) 1580 log_nametypeclass(VERB_ALGO, "DS RRset", vq->ds_rrset->rk.dname, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN); 1581 else verbose(VERB_ALGO, "No DS RRset"); 1582 1583 if(vq->ds_rrset && query_dname_compare(vq->ds_rrset->rk.dname, 1584 vq->key_entry->name) != 0) { 1585 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 1586 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 1587 vq->qchase.qclass, BIT_CD)) { 1588 log_err("mem error generating DNSKEY request"); 1589 return val_error(qstate, id); 1590 } 1591 return 0; 1592 } 1593 1594 if(!vq->ds_rrset || query_dname_compare(vq->ds_rrset->rk.dname, 1595 target_key_name) != 0) { 1596 /* check if there is a cache entry : pick up an NSEC if 1597 * there is no DS, check if that NSEC has DS-bit unset, and 1598 * thus can disprove the secure delagation we seek. 1599 * We can then use that NSEC even in the absence of a SOA 1600 * record that would be required by the iterator to supply 1601 * a completely protocol-correct response. 1602 * Uses negative cache for NSEC3 lookup of DS responses. */ 1603 /* only if cache not blacklisted, of course */ 1604 struct dns_msg* msg; 1605 if(!qstate->blacklist && !vq->chain_blacklist && 1606 (msg=val_find_DS(qstate->env, target_key_name, 1607 target_key_len, vq->qchase.qclass, qstate->region, 1608 vq->key_entry->name)) ) { 1609 verbose(VERB_ALGO, "Process cached DS response"); 1610 process_ds_response(qstate, vq, id, LDNS_RCODE_NOERROR, 1611 msg, &msg->qinfo, NULL); 1612 return 1; /* continue processing ds-response results */ 1613 } 1614 if(!generate_request(qstate, id, target_key_name, 1615 target_key_len, LDNS_RR_TYPE_DS, vq->qchase.qclass, 1616 BIT_CD)) { 1617 log_err("mem error generating DS request"); 1618 return val_error(qstate, id); 1619 } 1620 return 0; 1621 } 1622 1623 /* Otherwise, it is time to query for the DNSKEY */ 1624 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 1625 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 1626 vq->qchase.qclass, BIT_CD)) { 1627 log_err("mem error generating DNSKEY request"); 1628 return val_error(qstate, id); 1629 } 1630 1631 return 0; 1632 } 1633 1634 /** 1635 * Process the VALIDATE stage, the init and findkey stages are finished, 1636 * and the right keys are available to validate the response. 1637 * Or, there are no keys available, in order to invalidate the response. 1638 * 1639 * After validation, the status is recorded in the message and rrsets, 1640 * and finished state is started. 1641 * 1642 * @param qstate: query state. 1643 * @param vq: validator query state. 1644 * @param ve: validator shared global environment. 1645 * @param id: module id. 1646 * @return true if the event should be processed further on return, false if 1647 * not. 1648 */ 1649 static int 1650 processValidate(struct module_qstate* qstate, struct val_qstate* vq, 1651 struct val_env* ve, int id) 1652 { 1653 enum val_classification subtype; 1654 int rcode; 1655 1656 if(!vq->key_entry) { 1657 verbose(VERB_ALGO, "validate: no key entry, failed"); 1658 return val_error(qstate, id); 1659 } 1660 1661 /* This is the default next state. */ 1662 vq->state = VAL_FINISHED_STATE; 1663 1664 /* Unsigned responses must be underneath a "null" key entry.*/ 1665 if(key_entry_isnull(vq->key_entry)) { 1666 verbose(VERB_DETAIL, "Verified that %sresponse is INSECURE", 1667 vq->signer_name?"":"unsigned "); 1668 vq->chase_reply->security = sec_status_insecure; 1669 val_mark_insecure(vq->chase_reply, vq->key_entry->name, 1670 qstate->env->rrset_cache, qstate->env); 1671 key_cache_insert(ve->kcache, vq->key_entry, qstate); 1672 return 1; 1673 } 1674 1675 if(key_entry_isbad(vq->key_entry)) { 1676 log_nametypeclass(VERB_DETAIL, "Could not establish a chain " 1677 "of trust to keys for", vq->key_entry->name, 1678 LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class); 1679 vq->chase_reply->security = sec_status_bogus; 1680 errinf(qstate, "while building chain of trust"); 1681 if(vq->restart_count >= VAL_MAX_RESTART_COUNT) 1682 key_cache_insert(ve->kcache, vq->key_entry, qstate); 1683 return 1; 1684 } 1685 1686 /* signerName being null is the indicator that this response was 1687 * unsigned */ 1688 if(vq->signer_name == NULL) { 1689 log_query_info(VERB_ALGO, "processValidate: state has no " 1690 "signer name", &vq->qchase); 1691 verbose(VERB_DETAIL, "Could not establish validation of " 1692 "INSECURE status of unsigned response."); 1693 errinf(qstate, "no signatures"); 1694 errinf_origin(qstate, qstate->reply_origin); 1695 vq->chase_reply->security = sec_status_bogus; 1696 return 1; 1697 } 1698 subtype = val_classify_response(qstate->query_flags, &qstate->qinfo, 1699 &vq->qchase, vq->orig_msg->rep, vq->rrset_skip); 1700 if(subtype != VAL_CLASS_REFERRAL) 1701 remove_spurious_authority(vq->chase_reply, vq->orig_msg->rep); 1702 1703 /* check signatures in the message; 1704 * answer and authority must be valid, additional is only checked. */ 1705 if(!validate_msg_signatures(qstate, qstate->env, ve, &vq->qchase, 1706 vq->chase_reply, vq->key_entry)) { 1707 /* workaround bad recursor out there that truncates (even 1708 * with EDNS4k) to 512 by removing RRSIG from auth section 1709 * for positive replies*/ 1710 if((subtype == VAL_CLASS_POSITIVE || subtype == VAL_CLASS_ANY 1711 || subtype == VAL_CLASS_CNAME) && 1712 detect_wrongly_truncated(vq->orig_msg->rep)) { 1713 /* truncate the message some more */ 1714 vq->orig_msg->rep->ns_numrrsets = 0; 1715 vq->orig_msg->rep->ar_numrrsets = 0; 1716 vq->orig_msg->rep->rrset_count = 1717 vq->orig_msg->rep->an_numrrsets; 1718 vq->chase_reply->ns_numrrsets = 0; 1719 vq->chase_reply->ar_numrrsets = 0; 1720 vq->chase_reply->rrset_count = 1721 vq->chase_reply->an_numrrsets; 1722 qstate->errinf = NULL; 1723 } 1724 else { 1725 verbose(VERB_DETAIL, "Validate: message contains " 1726 "bad rrsets"); 1727 return 1; 1728 } 1729 } 1730 1731 switch(subtype) { 1732 case VAL_CLASS_POSITIVE: 1733 verbose(VERB_ALGO, "Validating a positive response"); 1734 validate_positive_response(qstate->env, ve, 1735 &vq->qchase, vq->chase_reply, vq->key_entry); 1736 verbose(VERB_DETAIL, "validate(positive): %s", 1737 sec_status_to_string( 1738 vq->chase_reply->security)); 1739 break; 1740 1741 case VAL_CLASS_NODATA: 1742 verbose(VERB_ALGO, "Validating a nodata response"); 1743 validate_nodata_response(qstate->env, ve, 1744 &vq->qchase, vq->chase_reply, vq->key_entry); 1745 verbose(VERB_DETAIL, "validate(nodata): %s", 1746 sec_status_to_string( 1747 vq->chase_reply->security)); 1748 break; 1749 1750 case VAL_CLASS_NAMEERROR: 1751 rcode = (int)FLAGS_GET_RCODE(vq->orig_msg->rep->flags); 1752 verbose(VERB_ALGO, "Validating a nxdomain response"); 1753 validate_nameerror_response(qstate->env, ve, 1754 &vq->qchase, vq->chase_reply, vq->key_entry, &rcode); 1755 verbose(VERB_DETAIL, "validate(nxdomain): %s", 1756 sec_status_to_string( 1757 vq->chase_reply->security)); 1758 FLAGS_SET_RCODE(vq->orig_msg->rep->flags, rcode); 1759 FLAGS_SET_RCODE(vq->chase_reply->flags, rcode); 1760 break; 1761 1762 case VAL_CLASS_CNAME: 1763 verbose(VERB_ALGO, "Validating a cname response"); 1764 validate_cname_response(qstate->env, ve, 1765 &vq->qchase, vq->chase_reply, vq->key_entry); 1766 verbose(VERB_DETAIL, "validate(cname): %s", 1767 sec_status_to_string( 1768 vq->chase_reply->security)); 1769 break; 1770 1771 case VAL_CLASS_CNAMENOANSWER: 1772 verbose(VERB_ALGO, "Validating a cname noanswer " 1773 "response"); 1774 validate_cname_noanswer_response(qstate->env, ve, 1775 &vq->qchase, vq->chase_reply, vq->key_entry); 1776 verbose(VERB_DETAIL, "validate(cname_noanswer): %s", 1777 sec_status_to_string( 1778 vq->chase_reply->security)); 1779 break; 1780 1781 case VAL_CLASS_REFERRAL: 1782 verbose(VERB_ALGO, "Validating a referral response"); 1783 validate_referral_response(vq->chase_reply); 1784 verbose(VERB_DETAIL, "validate(referral): %s", 1785 sec_status_to_string( 1786 vq->chase_reply->security)); 1787 break; 1788 1789 case VAL_CLASS_ANY: 1790 verbose(VERB_ALGO, "Validating a positive ANY " 1791 "response"); 1792 validate_any_response(qstate->env, ve, &vq->qchase, 1793 vq->chase_reply, vq->key_entry); 1794 verbose(VERB_DETAIL, "validate(positive_any): %s", 1795 sec_status_to_string( 1796 vq->chase_reply->security)); 1797 break; 1798 1799 default: 1800 log_err("validate: unhandled response subtype: %d", 1801 subtype); 1802 } 1803 if(vq->chase_reply->security == sec_status_bogus) { 1804 if(subtype == VAL_CLASS_POSITIVE) 1805 errinf(qstate, "wildcard"); 1806 else errinf(qstate, val_classification_to_string(subtype)); 1807 errinf(qstate, "proof failed"); 1808 errinf_origin(qstate, qstate->reply_origin); 1809 } 1810 1811 return 1; 1812 } 1813 1814 /** 1815 * Init DLV check. 1816 * Called when a query is determined by other trust anchors to be insecure 1817 * (or indeterminate). Then we look if there is a key in the DLV. 1818 * Performs aggressive negative cache check to see if there is no key. 1819 * Otherwise, spawns a DLV query, and changes to the DLV wait state. 1820 * 1821 * @param qstate: query state. 1822 * @param vq: validator query state. 1823 * @param ve: validator shared global environment. 1824 * @param id: module id. 1825 * @return true if there is no DLV. 1826 * false: processing is finished for the validator operate(). 1827 * This function may exit in three ways: 1828 * o no DLV (agressive cache), so insecure. (true) 1829 * o error - stop processing (false) 1830 * o DLV lookup was started, stop processing (false) 1831 */ 1832 static int 1833 val_dlv_init(struct module_qstate* qstate, struct val_qstate* vq, 1834 struct val_env* ve, int id) 1835 { 1836 uint8_t* nm; 1837 size_t nm_len; 1838 /* there must be a DLV configured */ 1839 log_assert(qstate->env->anchors->dlv_anchor); 1840 /* this bool is true to avoid looping in the DLV checks */ 1841 log_assert(vq->dlv_checked); 1842 1843 /* init the DLV lookup variables */ 1844 vq->dlv_lookup_name = NULL; 1845 vq->dlv_lookup_name_len = 0; 1846 vq->dlv_insecure_at = NULL; 1847 vq->dlv_insecure_at_len = 0; 1848 1849 /* Determine the name for which we want to lookup DLV. 1850 * This name is for the current message, or 1851 * for the current RRset for CNAME, referral subtypes. 1852 * If there is a signer, use that, otherwise the domain name */ 1853 if(vq->signer_name) { 1854 nm = vq->signer_name; 1855 nm_len = vq->signer_len; 1856 } else { 1857 /* use qchase */ 1858 nm = vq->qchase.qname; 1859 nm_len = vq->qchase.qname_len; 1860 if(vq->qchase.qtype == LDNS_RR_TYPE_DS) 1861 dname_remove_label(&nm, &nm_len); 1862 } 1863 log_nametypeclass(VERB_ALGO, "DLV init look", nm, LDNS_RR_TYPE_DS, 1864 vq->qchase.qclass); 1865 log_assert(nm && nm_len); 1866 /* sanity check: no DLV lookups below the DLV anchor itself. 1867 * Like, an securely insecure delegation there makes no sense. */ 1868 if(dname_subdomain_c(nm, qstate->env->anchors->dlv_anchor->name)) { 1869 verbose(VERB_ALGO, "DLV lookup within DLV repository denied"); 1870 return 1; 1871 } 1872 /* concat name (minus root label) + dlv name */ 1873 vq->dlv_lookup_name_len = nm_len - 1 + 1874 qstate->env->anchors->dlv_anchor->namelen; 1875 vq->dlv_lookup_name = regional_alloc(qstate->region, 1876 vq->dlv_lookup_name_len); 1877 if(!vq->dlv_lookup_name) { 1878 log_err("Out of memory preparing DLV lookup"); 1879 return val_error(qstate, id); 1880 } 1881 memmove(vq->dlv_lookup_name, nm, nm_len-1); 1882 memmove(vq->dlv_lookup_name+nm_len-1, 1883 qstate->env->anchors->dlv_anchor->name, 1884 qstate->env->anchors->dlv_anchor->namelen); 1885 log_nametypeclass(VERB_ALGO, "DLV name", vq->dlv_lookup_name, 1886 LDNS_RR_TYPE_DLV, vq->qchase.qclass); 1887 1888 /* determine where the insecure point was determined, the DLV must 1889 * be equal or below that to continue building the trust chain 1890 * down. May be NULL if no trust chain was built yet */ 1891 nm = NULL; 1892 if(vq->key_entry && key_entry_isnull(vq->key_entry)) { 1893 nm = vq->key_entry->name; 1894 nm_len = vq->key_entry->namelen; 1895 } 1896 if(nm) { 1897 vq->dlv_insecure_at_len = nm_len - 1 + 1898 qstate->env->anchors->dlv_anchor->namelen; 1899 vq->dlv_insecure_at = regional_alloc(qstate->region, 1900 vq->dlv_insecure_at_len); 1901 if(!vq->dlv_insecure_at) { 1902 log_err("Out of memory preparing DLV lookup"); 1903 return val_error(qstate, id); 1904 } 1905 memmove(vq->dlv_insecure_at, nm, nm_len-1); 1906 memmove(vq->dlv_insecure_at+nm_len-1, 1907 qstate->env->anchors->dlv_anchor->name, 1908 qstate->env->anchors->dlv_anchor->namelen); 1909 log_nametypeclass(VERB_ALGO, "insecure_at", 1910 vq->dlv_insecure_at, 0, vq->qchase.qclass); 1911 } 1912 1913 /* If we can find the name in the aggressive negative cache, 1914 * give up; insecure is the answer */ 1915 while(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name, 1916 vq->dlv_lookup_name_len, vq->qchase.qclass, 1917 qstate->env->rrset_cache, *qstate->env->now)) { 1918 /* go up */ 1919 dname_remove_label(&vq->dlv_lookup_name, 1920 &vq->dlv_lookup_name_len); 1921 /* too high? */ 1922 if(!dname_subdomain_c(vq->dlv_lookup_name, 1923 qstate->env->anchors->dlv_anchor->name)) { 1924 verbose(VERB_ALGO, "ask above dlv repo"); 1925 return 1; /* Above the repo is insecure */ 1926 } 1927 /* above chain of trust? */ 1928 if(vq->dlv_insecure_at && !dname_subdomain_c( 1929 vq->dlv_lookup_name, vq->dlv_insecure_at)) { 1930 verbose(VERB_ALGO, "ask above insecure endpoint"); 1931 return 1; 1932 } 1933 } 1934 1935 /* perform a lookup for the DLV; with validation */ 1936 vq->state = VAL_DLVLOOKUP_STATE; 1937 if(!generate_request(qstate, id, vq->dlv_lookup_name, 1938 vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV, 1939 vq->qchase.qclass, 0)) { 1940 return val_error(qstate, id); 1941 } 1942 1943 /* Find the closest encloser DLV from the repository. 1944 * then that is used to build another chain of trust 1945 * This may first require a query 'too low' that has NSECs in 1946 * the answer, from which we determine the closest encloser DLV. 1947 * When determine the closest encloser, skip empty nonterminals, 1948 * since we want a nonempty node in the DLV repository. */ 1949 1950 return 0; 1951 } 1952 1953 /** 1954 * The Finished state. The validation status (good or bad) has been determined. 1955 * 1956 * @param qstate: query state. 1957 * @param vq: validator query state. 1958 * @param ve: validator shared global environment. 1959 * @param id: module id. 1960 * @return true if the event should be processed further on return, false if 1961 * not. 1962 */ 1963 static int 1964 processFinished(struct module_qstate* qstate, struct val_qstate* vq, 1965 struct val_env* ve, int id) 1966 { 1967 enum val_classification subtype = val_classify_response( 1968 qstate->query_flags, &qstate->qinfo, &vq->qchase, 1969 vq->orig_msg->rep, vq->rrset_skip); 1970 1971 /* if the result is insecure or indeterminate and we have not 1972 * checked the DLV yet, check the DLV */ 1973 if((vq->chase_reply->security == sec_status_insecure || 1974 vq->chase_reply->security == sec_status_indeterminate) && 1975 qstate->env->anchors->dlv_anchor && !vq->dlv_checked) { 1976 vq->dlv_checked = 1; 1977 if(!val_dlv_init(qstate, vq, ve, id)) 1978 return 0; 1979 } 1980 1981 /* store overall validation result in orig_msg */ 1982 if(vq->rrset_skip == 0) 1983 vq->orig_msg->rep->security = vq->chase_reply->security; 1984 else if(subtype != VAL_CLASS_REFERRAL || 1985 vq->rrset_skip < vq->orig_msg->rep->an_numrrsets + 1986 vq->orig_msg->rep->ns_numrrsets) { 1987 /* ignore sec status of additional section if a referral 1988 * type message skips there and 1989 * use the lowest security status as end result. */ 1990 if(vq->chase_reply->security < vq->orig_msg->rep->security) 1991 vq->orig_msg->rep->security = 1992 vq->chase_reply->security; 1993 } 1994 1995 if(subtype == VAL_CLASS_REFERRAL) { 1996 /* for a referral, move to next unchecked rrset and check it*/ 1997 vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep, 1998 vq->rrset_skip); 1999 if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) { 2000 /* and restart for this rrset */ 2001 verbose(VERB_ALGO, "validator: go to next rrset"); 2002 vq->chase_reply->security = sec_status_unchecked; 2003 vq->dlv_checked = 0; /* can do DLV for this RR */ 2004 vq->state = VAL_INIT_STATE; 2005 return 1; 2006 } 2007 /* referral chase is done */ 2008 } 2009 if(vq->chase_reply->security != sec_status_bogus && 2010 subtype == VAL_CLASS_CNAME) { 2011 /* chase the CNAME; process next part of the message */ 2012 if(!val_chase_cname(&vq->qchase, vq->orig_msg->rep, 2013 &vq->rrset_skip)) { 2014 verbose(VERB_ALGO, "validator: failed to chase CNAME"); 2015 vq->orig_msg->rep->security = sec_status_bogus; 2016 } else { 2017 /* restart process for new qchase at rrset_skip */ 2018 log_query_info(VERB_ALGO, "validator: chased to", 2019 &vq->qchase); 2020 vq->chase_reply->security = sec_status_unchecked; 2021 vq->dlv_checked = 0; /* can do DLV for this RR */ 2022 vq->state = VAL_INIT_STATE; 2023 return 1; 2024 } 2025 } 2026 2027 if(vq->orig_msg->rep->security == sec_status_secure) { 2028 /* If the message is secure, check that all rrsets are 2029 * secure (i.e. some inserted RRset for CNAME chain with 2030 * a different signer name). And drop additional rrsets 2031 * that are not secure (if clean-additional option is set) */ 2032 /* this may cause the msg to be marked bogus */ 2033 val_check_nonsecure(ve, vq->orig_msg->rep); 2034 if(vq->orig_msg->rep->security == sec_status_secure) { 2035 log_query_info(VERB_DETAIL, "validation success", 2036 &qstate->qinfo); 2037 } 2038 } 2039 2040 /* if the result is bogus - set message ttl to bogus ttl to avoid 2041 * endless bogus revalidation */ 2042 if(vq->orig_msg->rep->security == sec_status_bogus) { 2043 /* see if we can try again to fetch data */ 2044 if(vq->restart_count < VAL_MAX_RESTART_COUNT) { 2045 int restart_count = vq->restart_count+1; 2046 verbose(VERB_ALGO, "validation failed, " 2047 "blacklist and retry to fetch data"); 2048 val_blacklist(&qstate->blacklist, qstate->region, 2049 qstate->reply_origin, 0); 2050 qstate->reply_origin = NULL; 2051 qstate->errinf = NULL; 2052 memset(vq, 0, sizeof(*vq)); 2053 vq->restart_count = restart_count; 2054 vq->state = VAL_INIT_STATE; 2055 verbose(VERB_ALGO, "pass back to next module"); 2056 qstate->ext_state[id] = module_restart_next; 2057 return 0; 2058 } 2059 2060 vq->orig_msg->rep->ttl = ve->bogus_ttl; 2061 vq->orig_msg->rep->prefetch_ttl = 2062 PREFETCH_TTL_CALC(vq->orig_msg->rep->ttl); 2063 if(qstate->env->cfg->val_log_level >= 1 && 2064 !qstate->env->cfg->val_log_squelch) { 2065 if(qstate->env->cfg->val_log_level < 2) 2066 log_query_info(0, "validation failure", 2067 &qstate->qinfo); 2068 else { 2069 char* err = errinf_to_str(qstate); 2070 if(err) log_info("%s", err); 2071 free(err); 2072 } 2073 } 2074 /* If we are in permissive mode, bogus gets indeterminate */ 2075 if(ve->permissive_mode) 2076 vq->orig_msg->rep->security = sec_status_indeterminate; 2077 } 2078 2079 /* store results in cache */ 2080 if(qstate->query_flags&BIT_RD) { 2081 /* if secure, this will override cache anyway, no need 2082 * to check if from parentNS */ 2083 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo, 2084 vq->orig_msg->rep, 0, qstate->prefetch_leeway, 0, NULL, 2085 qstate->query_flags)) { 2086 log_err("out of memory caching validator results"); 2087 } 2088 } else { 2089 /* for a referral, store the verified RRsets */ 2090 /* and this does not get prefetched, so no leeway */ 2091 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo, 2092 vq->orig_msg->rep, 1, 0, 0, NULL, 2093 qstate->query_flags)) { 2094 log_err("out of memory caching validator results"); 2095 } 2096 } 2097 qstate->return_rcode = LDNS_RCODE_NOERROR; 2098 qstate->return_msg = vq->orig_msg; 2099 qstate->ext_state[id] = module_finished; 2100 return 0; 2101 } 2102 2103 /** 2104 * The DLVLookup state. Process DLV lookups. 2105 * 2106 * @param qstate: query state. 2107 * @param vq: validator query state. 2108 * @param ve: validator shared global environment. 2109 * @param id: module id. 2110 * @return true if the event should be processed further on return, false if 2111 * not. 2112 */ 2113 static int 2114 processDLVLookup(struct module_qstate* qstate, struct val_qstate* vq, 2115 struct val_env* ve, int id) 2116 { 2117 /* see if this we are ready to continue normal resolution */ 2118 /* we may need more DLV lookups */ 2119 if(vq->dlv_status==dlv_error) 2120 verbose(VERB_ALGO, "DLV woke up with status dlv_error"); 2121 else if(vq->dlv_status==dlv_success) 2122 verbose(VERB_ALGO, "DLV woke up with status dlv_success"); 2123 else if(vq->dlv_status==dlv_ask_higher) 2124 verbose(VERB_ALGO, "DLV woke up with status dlv_ask_higher"); 2125 else if(vq->dlv_status==dlv_there_is_no_dlv) 2126 verbose(VERB_ALGO, "DLV woke up with status dlv_there_is_no_dlv"); 2127 else verbose(VERB_ALGO, "DLV woke up with status unknown"); 2128 2129 if(vq->dlv_status == dlv_error) { 2130 verbose(VERB_QUERY, "failed DLV lookup"); 2131 return val_error(qstate, id); 2132 } else if(vq->dlv_status == dlv_success) { 2133 uint8_t* nm; 2134 size_t nmlen; 2135 /* chain continues with DNSKEY, continue in FINDKEY */ 2136 vq->state = VAL_FINDKEY_STATE; 2137 2138 /* strip off the DLV suffix from the name; could result in . */ 2139 log_assert(dname_subdomain_c(vq->ds_rrset->rk.dname, 2140 qstate->env->anchors->dlv_anchor->name)); 2141 nmlen = vq->ds_rrset->rk.dname_len - 2142 qstate->env->anchors->dlv_anchor->namelen + 1; 2143 nm = regional_alloc_init(qstate->region, 2144 vq->ds_rrset->rk.dname, nmlen); 2145 if(!nm) { 2146 log_err("Out of memory in DLVLook"); 2147 return val_error(qstate, id); 2148 } 2149 nm[nmlen-1] = 0; 2150 2151 vq->ds_rrset->rk.dname = nm; 2152 vq->ds_rrset->rk.dname_len = nmlen; 2153 2154 /* create a nullentry for the key so the dnskey lookup 2155 * can be retried after a validation failure for it */ 2156 vq->key_entry = key_entry_create_null(qstate->region, 2157 nm, nmlen, vq->qchase.qclass, 0, 0); 2158 if(!vq->key_entry) { 2159 log_err("Out of memory in DLVLook"); 2160 return val_error(qstate, id); 2161 } 2162 2163 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 2164 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 2165 vq->qchase.qclass, BIT_CD)) { 2166 log_err("mem error generating DNSKEY request"); 2167 return val_error(qstate, id); 2168 } 2169 return 0; 2170 } else if(vq->dlv_status == dlv_there_is_no_dlv) { 2171 /* continue with the insecure result we got */ 2172 vq->state = VAL_FINISHED_STATE; 2173 return 1; 2174 } 2175 log_assert(vq->dlv_status == dlv_ask_higher); 2176 2177 /* ask higher, make sure we stay in DLV repo, below dlv_at */ 2178 if(!dname_subdomain_c(vq->dlv_lookup_name, 2179 qstate->env->anchors->dlv_anchor->name)) { 2180 /* just like, there is no DLV */ 2181 verbose(VERB_ALGO, "ask above dlv repo"); 2182 vq->state = VAL_FINISHED_STATE; 2183 return 1; 2184 } 2185 if(vq->dlv_insecure_at && !dname_subdomain_c(vq->dlv_lookup_name, 2186 vq->dlv_insecure_at)) { 2187 /* already checked a chain lower than dlv_lookup_name */ 2188 verbose(VERB_ALGO, "ask above insecure endpoint"); 2189 log_nametypeclass(VERB_ALGO, "enpt", vq->dlv_insecure_at, 0, 0); 2190 vq->state = VAL_FINISHED_STATE; 2191 return 1; 2192 } 2193 2194 /* check negative cache before making new request */ 2195 if(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name, 2196 vq->dlv_lookup_name_len, vq->qchase.qclass, 2197 qstate->env->rrset_cache, *qstate->env->now)) { 2198 /* does not exist, go up one (go higher). */ 2199 dname_remove_label(&vq->dlv_lookup_name, 2200 &vq->dlv_lookup_name_len); 2201 /* limit number of labels, limited number of recursion */ 2202 return processDLVLookup(qstate, vq, ve, id); 2203 } 2204 2205 if(!generate_request(qstate, id, vq->dlv_lookup_name, 2206 vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV, 2207 vq->qchase.qclass, 0)) { 2208 return val_error(qstate, id); 2209 } 2210 2211 return 0; 2212 } 2213 2214 /** 2215 * Handle validator state. 2216 * If a method returns true, the next state is started. If false, then 2217 * processing will stop. 2218 * @param qstate: query state. 2219 * @param vq: validator query state. 2220 * @param ve: validator shared global environment. 2221 * @param id: module id. 2222 */ 2223 static void 2224 val_handle(struct module_qstate* qstate, struct val_qstate* vq, 2225 struct val_env* ve, int id) 2226 { 2227 int cont = 1; 2228 while(cont) { 2229 verbose(VERB_ALGO, "val handle processing q with state %s", 2230 val_state_to_string(vq->state)); 2231 switch(vq->state) { 2232 case VAL_INIT_STATE: 2233 cont = processInit(qstate, vq, ve, id); 2234 break; 2235 case VAL_FINDKEY_STATE: 2236 cont = processFindKey(qstate, vq, id); 2237 break; 2238 case VAL_VALIDATE_STATE: 2239 cont = processValidate(qstate, vq, ve, id); 2240 break; 2241 case VAL_FINISHED_STATE: 2242 cont = processFinished(qstate, vq, ve, id); 2243 break; 2244 case VAL_DLVLOOKUP_STATE: 2245 cont = processDLVLookup(qstate, vq, ve, id); 2246 break; 2247 default: 2248 log_warn("validator: invalid state %d", 2249 vq->state); 2250 cont = 0; 2251 break; 2252 } 2253 } 2254 } 2255 2256 void 2257 val_operate(struct module_qstate* qstate, enum module_ev event, int id, 2258 struct outbound_entry* outbound) 2259 { 2260 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2261 struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id]; 2262 verbose(VERB_QUERY, "validator[module %d] operate: extstate:%s " 2263 "event:%s", id, strextstate(qstate->ext_state[id]), 2264 strmodulevent(event)); 2265 log_query_info(VERB_QUERY, "validator operate: query", 2266 &qstate->qinfo); 2267 if(vq && qstate->qinfo.qname != vq->qchase.qname) 2268 log_query_info(VERB_QUERY, "validator operate: chased to", 2269 &vq->qchase); 2270 (void)outbound; 2271 if(event == module_event_new || 2272 (event == module_event_pass && vq == NULL)) { 2273 /* pass request to next module, to get it */ 2274 verbose(VERB_ALGO, "validator: pass to next module"); 2275 qstate->ext_state[id] = module_wait_module; 2276 return; 2277 } 2278 if(event == module_event_moddone) { 2279 /* check if validation is needed */ 2280 verbose(VERB_ALGO, "validator: nextmodule returned"); 2281 if(!needs_validation(qstate, qstate->return_rcode, 2282 qstate->return_msg)) { 2283 /* no need to validate this */ 2284 if(qstate->return_msg) 2285 qstate->return_msg->rep->security = 2286 sec_status_indeterminate; 2287 qstate->ext_state[id] = module_finished; 2288 return; 2289 } 2290 if(already_validated(qstate->return_msg)) { 2291 qstate->ext_state[id] = module_finished; 2292 return; 2293 } 2294 /* qclass ANY should have validation result from spawned 2295 * queries. If we get here, it is bogus or an internal error */ 2296 if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) { 2297 verbose(VERB_ALGO, "cannot validate classANY: bogus"); 2298 if(qstate->return_msg) 2299 qstate->return_msg->rep->security = 2300 sec_status_bogus; 2301 qstate->ext_state[id] = module_finished; 2302 return; 2303 } 2304 /* create state to start validation */ 2305 qstate->ext_state[id] = module_error; /* override this */ 2306 if(!vq) { 2307 vq = val_new(qstate, id); 2308 if(!vq) { 2309 log_err("validator: malloc failure"); 2310 qstate->ext_state[id] = module_error; 2311 return; 2312 } 2313 } else if(!vq->orig_msg) { 2314 if(!val_new_getmsg(qstate, vq)) { 2315 log_err("validator: malloc failure"); 2316 qstate->ext_state[id] = module_error; 2317 return; 2318 } 2319 } 2320 val_handle(qstate, vq, ve, id); 2321 return; 2322 } 2323 if(event == module_event_pass) { 2324 qstate->ext_state[id] = module_error; /* override this */ 2325 /* continue processing, since val_env exists */ 2326 val_handle(qstate, vq, ve, id); 2327 return; 2328 } 2329 log_err("validator: bad event %s", strmodulevent(event)); 2330 qstate->ext_state[id] = module_error; 2331 return; 2332 } 2333 2334 /** 2335 * Evaluate the response to a priming request. 2336 * 2337 * @param dnskey_rrset: DNSKEY rrset (can be NULL if none) in prime reply. 2338 * (this rrset is allocated in the wrong region, not the qstate). 2339 * @param ta: trust anchor. 2340 * @param qstate: qstate that needs key. 2341 * @param id: module id. 2342 * @return new key entry or NULL on allocation failure. 2343 * The key entry will either contain a validated DNSKEY rrset, or 2344 * represent a Null key (query failed, but validation did not), or a 2345 * Bad key (validation failed). 2346 */ 2347 static struct key_entry_key* 2348 primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset, 2349 struct trust_anchor* ta, struct module_qstate* qstate, int id) 2350 { 2351 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2352 struct key_entry_key* kkey = NULL; 2353 enum sec_status sec = sec_status_unchecked; 2354 char* reason = NULL; 2355 int downprot = 1; 2356 2357 if(!dnskey_rrset) { 2358 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- " 2359 "could not fetch DNSKEY rrset", 2360 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass); 2361 if(qstate->env->cfg->harden_dnssec_stripped) { 2362 errinf(qstate, "no DNSKEY rrset"); 2363 kkey = key_entry_create_bad(qstate->region, ta->name, 2364 ta->namelen, ta->dclass, BOGUS_KEY_TTL, 2365 *qstate->env->now); 2366 } else kkey = key_entry_create_null(qstate->region, ta->name, 2367 ta->namelen, ta->dclass, NULL_KEY_TTL, 2368 *qstate->env->now); 2369 if(!kkey) { 2370 log_err("out of memory: allocate fail prime key"); 2371 return NULL; 2372 } 2373 return kkey; 2374 } 2375 /* attempt to verify with trust anchor DS and DNSKEY */ 2376 kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve, 2377 dnskey_rrset, ta->ds_rrset, ta->dnskey_rrset, downprot, 2378 &reason); 2379 if(!kkey) { 2380 log_err("out of memory: verifying prime TA"); 2381 return NULL; 2382 } 2383 if(key_entry_isgood(kkey)) 2384 sec = sec_status_secure; 2385 else 2386 sec = sec_status_bogus; 2387 verbose(VERB_DETAIL, "validate keys with anchor(DS): %s", 2388 sec_status_to_string(sec)); 2389 2390 if(sec != sec_status_secure) { 2391 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- " 2392 "DNSKEY rrset is not secure", 2393 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass); 2394 /* NOTE: in this case, we should probably reject the trust 2395 * anchor for longer, perhaps forever. */ 2396 if(qstate->env->cfg->harden_dnssec_stripped) { 2397 errinf(qstate, reason); 2398 kkey = key_entry_create_bad(qstate->region, ta->name, 2399 ta->namelen, ta->dclass, BOGUS_KEY_TTL, 2400 *qstate->env->now); 2401 } else kkey = key_entry_create_null(qstate->region, ta->name, 2402 ta->namelen, ta->dclass, NULL_KEY_TTL, 2403 *qstate->env->now); 2404 if(!kkey) { 2405 log_err("out of memory: allocate null prime key"); 2406 return NULL; 2407 } 2408 return kkey; 2409 } 2410 2411 log_nametypeclass(VERB_DETAIL, "Successfully primed trust anchor", 2412 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass); 2413 return kkey; 2414 } 2415 2416 /** 2417 * In inform supers, with the resulting message and rcode and the current 2418 * keyset in the super state, validate the DS response, returning a KeyEntry. 2419 * 2420 * @param qstate: query state that is validating and asked for a DS. 2421 * @param vq: validator query state 2422 * @param id: module id. 2423 * @param rcode: rcode result value. 2424 * @param msg: result message (if rcode is OK). 2425 * @param qinfo: from the sub query state, query info. 2426 * @param ke: the key entry to return. It returns 2427 * is_bad if the DS response fails to validate, is_null if the 2428 * DS response indicated an end to secure space, is_good if the DS 2429 * validated. It returns ke=NULL if the DS response indicated that the 2430 * request wasn't a delegation point. 2431 * @return 0 on servfail error (malloc failure). 2432 */ 2433 static int 2434 ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, 2435 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo, 2436 struct key_entry_key** ke) 2437 { 2438 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2439 char* reason = NULL; 2440 enum val_classification subtype; 2441 if(rcode != LDNS_RCODE_NOERROR) { 2442 char rc[16]; 2443 rc[0]=0; 2444 (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc)); 2445 /* errors here pretty much break validation */ 2446 verbose(VERB_DETAIL, "DS response was error, thus bogus"); 2447 errinf(qstate, rc); 2448 errinf(qstate, "no DS"); 2449 goto return_bogus; 2450 } 2451 2452 subtype = val_classify_response(BIT_RD, qinfo, qinfo, msg->rep, 0); 2453 if(subtype == VAL_CLASS_POSITIVE) { 2454 struct ub_packed_rrset_key* ds; 2455 enum sec_status sec; 2456 ds = reply_find_answer_rrset(qinfo, msg->rep); 2457 /* If there was no DS rrset, then we have mis-classified 2458 * this message. */ 2459 if(!ds) { 2460 log_warn("internal error: POSITIVE DS response was " 2461 "missing DS."); 2462 errinf(qstate, "no DS record"); 2463 goto return_bogus; 2464 } 2465 /* Verify only returns BOGUS or SECURE. If the rrset is 2466 * bogus, then we are done. */ 2467 sec = val_verify_rrset_entry(qstate->env, ve, ds, 2468 vq->key_entry, &reason); 2469 if(sec != sec_status_secure) { 2470 verbose(VERB_DETAIL, "DS rrset in DS response did " 2471 "not verify"); 2472 errinf(qstate, reason); 2473 goto return_bogus; 2474 } 2475 2476 /* If the DS rrset validates, we still have to make sure 2477 * that they are usable. */ 2478 if(!val_dsset_isusable(ds)) { 2479 /* If they aren't usable, then we treat it like 2480 * there was no DS. */ 2481 *ke = key_entry_create_null(qstate->region, 2482 qinfo->qname, qinfo->qname_len, qinfo->qclass, 2483 ub_packed_rrset_ttl(ds), *qstate->env->now); 2484 return (*ke) != NULL; 2485 } 2486 2487 /* Otherwise, we return the positive response. */ 2488 log_query_info(VERB_DETAIL, "validated DS", qinfo); 2489 *ke = key_entry_create_rrset(qstate->region, 2490 qinfo->qname, qinfo->qname_len, qinfo->qclass, ds, 2491 NULL, *qstate->env->now); 2492 return (*ke) != NULL; 2493 } else if(subtype == VAL_CLASS_NODATA || 2494 subtype == VAL_CLASS_NAMEERROR) { 2495 /* NODATA means that the qname exists, but that there was 2496 * no DS. This is a pretty normal case. */ 2497 time_t proof_ttl = 0; 2498 enum sec_status sec; 2499 2500 /* make sure there are NSECs or NSEC3s with signatures */ 2501 if(!val_has_signed_nsecs(msg->rep, &reason)) { 2502 verbose(VERB_ALGO, "no NSECs: %s", reason); 2503 errinf(qstate, reason); 2504 goto return_bogus; 2505 } 2506 2507 /* For subtype Name Error. 2508 * attempt ANS 2.8.1.0 compatibility where it sets rcode 2509 * to nxdomain, but really this is an Nodata/Noerror response. 2510 * Find and prove the empty nonterminal in that case */ 2511 2512 /* Try to prove absence of the DS with NSEC */ 2513 sec = val_nsec_prove_nodata_dsreply( 2514 qstate->env, ve, qinfo, msg->rep, vq->key_entry, 2515 &proof_ttl, &reason); 2516 switch(sec) { 2517 case sec_status_secure: 2518 verbose(VERB_DETAIL, "NSEC RRset for the " 2519 "referral proved no DS."); 2520 *ke = key_entry_create_null(qstate->region, 2521 qinfo->qname, qinfo->qname_len, 2522 qinfo->qclass, proof_ttl, 2523 *qstate->env->now); 2524 return (*ke) != NULL; 2525 case sec_status_insecure: 2526 verbose(VERB_DETAIL, "NSEC RRset for the " 2527 "referral proved not a delegation point"); 2528 *ke = NULL; 2529 return 1; 2530 case sec_status_bogus: 2531 verbose(VERB_DETAIL, "NSEC RRset for the " 2532 "referral did not prove no DS."); 2533 errinf(qstate, reason); 2534 goto return_bogus; 2535 case sec_status_unchecked: 2536 default: 2537 /* NSEC proof did not work, try next */ 2538 break; 2539 } 2540 2541 sec = nsec3_prove_nods(qstate->env, ve, 2542 msg->rep->rrsets + msg->rep->an_numrrsets, 2543 msg->rep->ns_numrrsets, qinfo, vq->key_entry, &reason); 2544 switch(sec) { 2545 case sec_status_insecure: 2546 /* case insecure also continues to unsigned 2547 * space. If nsec3-iter-count too high or 2548 * optout, then treat below as unsigned */ 2549 case sec_status_secure: 2550 verbose(VERB_DETAIL, "NSEC3s for the " 2551 "referral proved no DS."); 2552 *ke = key_entry_create_null(qstate->region, 2553 qinfo->qname, qinfo->qname_len, 2554 qinfo->qclass, proof_ttl, 2555 *qstate->env->now); 2556 return (*ke) != NULL; 2557 case sec_status_indeterminate: 2558 verbose(VERB_DETAIL, "NSEC3s for the " 2559 "referral proved no delegation"); 2560 *ke = NULL; 2561 return 1; 2562 case sec_status_bogus: 2563 verbose(VERB_DETAIL, "NSEC3s for the " 2564 "referral did not prove no DS."); 2565 errinf(qstate, reason); 2566 goto return_bogus; 2567 case sec_status_unchecked: 2568 default: 2569 /* NSEC3 proof did not work */ 2570 break; 2571 } 2572 2573 /* Apparently, no available NSEC/NSEC3 proved NODATA, so 2574 * this is BOGUS. */ 2575 verbose(VERB_DETAIL, "DS %s ran out of options, so return " 2576 "bogus", val_classification_to_string(subtype)); 2577 errinf(qstate, "no DS but also no proof of that"); 2578 goto return_bogus; 2579 } else if(subtype == VAL_CLASS_CNAME || 2580 subtype == VAL_CLASS_CNAMENOANSWER) { 2581 /* if the CNAME matches the exact name we want and is signed 2582 * properly, then also, we are sure that no DS exists there, 2583 * much like a NODATA proof */ 2584 enum sec_status sec; 2585 struct ub_packed_rrset_key* cname; 2586 cname = reply_find_rrset_section_an(msg->rep, qinfo->qname, 2587 qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass); 2588 if(!cname) { 2589 errinf(qstate, "validator classified CNAME but no " 2590 "CNAME of the queried name for DS"); 2591 goto return_bogus; 2592 } 2593 if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count 2594 == 0) { 2595 if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep-> 2596 rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) { 2597 errinf(qstate, "DS got DNAME answer"); 2598 } else { 2599 errinf(qstate, "DS got unsigned CNAME answer"); 2600 } 2601 goto return_bogus; 2602 } 2603 sec = val_verify_rrset_entry(qstate->env, ve, cname, 2604 vq->key_entry, &reason); 2605 if(sec == sec_status_secure) { 2606 verbose(VERB_ALGO, "CNAME validated, " 2607 "proof that DS does not exist"); 2608 /* and that it is not a referral point */ 2609 *ke = NULL; 2610 return 1; 2611 } 2612 errinf(qstate, "CNAME in DS response was not secure."); 2613 errinf(qstate, reason); 2614 goto return_bogus; 2615 } else { 2616 verbose(VERB_QUERY, "Encountered an unhandled type of " 2617 "DS response, thus bogus."); 2618 errinf(qstate, "no DS and"); 2619 if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) { 2620 char rc[16]; 2621 rc[0]=0; 2622 (void)sldns_wire2str_rcode_buf((int)FLAGS_GET_RCODE( 2623 msg->rep->flags), rc, sizeof(rc)); 2624 errinf(qstate, rc); 2625 } else errinf(qstate, val_classification_to_string(subtype)); 2626 errinf(qstate, "message fails to prove that"); 2627 goto return_bogus; 2628 } 2629 return_bogus: 2630 *ke = key_entry_create_bad(qstate->region, qinfo->qname, 2631 qinfo->qname_len, qinfo->qclass, 2632 BOGUS_KEY_TTL, *qstate->env->now); 2633 return (*ke) != NULL; 2634 } 2635 2636 /** 2637 * Process DS response. Called from inform_supers. 2638 * Because it is in inform_supers, the mesh itself is busy doing callbacks 2639 * for a state that is to be deleted soon; don't touch the mesh; instead 2640 * set a state in the super, as the super will be reactivated soon. 2641 * Perform processing to determine what state to set in the super. 2642 * 2643 * @param qstate: query state that is validating and asked for a DS. 2644 * @param vq: validator query state 2645 * @param id: module id. 2646 * @param rcode: rcode result value. 2647 * @param msg: result message (if rcode is OK). 2648 * @param qinfo: from the sub query state, query info. 2649 * @param origin: the origin of msg. 2650 */ 2651 static void 2652 process_ds_response(struct module_qstate* qstate, struct val_qstate* vq, 2653 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo, 2654 struct sock_list* origin) 2655 { 2656 struct key_entry_key* dske = NULL; 2657 uint8_t* olds = vq->empty_DS_name; 2658 vq->empty_DS_name = NULL; 2659 if(!ds_response_to_ke(qstate, vq, id, rcode, msg, qinfo, &dske)) { 2660 log_err("malloc failure in process_ds_response"); 2661 vq->key_entry = NULL; /* make it error */ 2662 vq->state = VAL_VALIDATE_STATE; 2663 return; 2664 } 2665 if(dske == NULL) { 2666 vq->empty_DS_name = regional_alloc_init(qstate->region, 2667 qinfo->qname, qinfo->qname_len); 2668 if(!vq->empty_DS_name) { 2669 log_err("malloc failure in empty_DS_name"); 2670 vq->key_entry = NULL; /* make it error */ 2671 vq->state = VAL_VALIDATE_STATE; 2672 return; 2673 } 2674 vq->empty_DS_len = qinfo->qname_len; 2675 vq->chain_blacklist = NULL; 2676 /* ds response indicated that we aren't on a delegation point. 2677 * Keep the forState.state on FINDKEY. */ 2678 } else if(key_entry_isgood(dske)) { 2679 vq->ds_rrset = key_entry_get_rrset(dske, qstate->region); 2680 if(!vq->ds_rrset) { 2681 log_err("malloc failure in process DS"); 2682 vq->key_entry = NULL; /* make it error */ 2683 vq->state = VAL_VALIDATE_STATE; 2684 return; 2685 } 2686 vq->chain_blacklist = NULL; /* fresh blacklist for next part*/ 2687 /* Keep the forState.state on FINDKEY. */ 2688 } else if(key_entry_isbad(dske) 2689 && vq->restart_count < VAL_MAX_RESTART_COUNT) { 2690 vq->empty_DS_name = olds; 2691 val_blacklist(&vq->chain_blacklist, qstate->region, origin, 1); 2692 qstate->errinf = NULL; 2693 vq->restart_count++; 2694 } else { 2695 if(key_entry_isbad(dske)) { 2696 errinf_origin(qstate, origin); 2697 errinf_dname(qstate, "for DS", qinfo->qname); 2698 } 2699 /* NOTE: the reason for the DS to be not good (that is, 2700 * either bad or null) should have been logged by 2701 * dsResponseToKE. */ 2702 vq->key_entry = dske; 2703 /* The FINDKEY phase has ended, so move on. */ 2704 vq->state = VAL_VALIDATE_STATE; 2705 } 2706 } 2707 2708 /** 2709 * Process DNSKEY response. Called from inform_supers. 2710 * Sets the key entry in the state. 2711 * Because it is in inform_supers, the mesh itself is busy doing callbacks 2712 * for a state that is to be deleted soon; don't touch the mesh; instead 2713 * set a state in the super, as the super will be reactivated soon. 2714 * Perform processing to determine what state to set in the super. 2715 * 2716 * @param qstate: query state that is validating and asked for a DNSKEY. 2717 * @param vq: validator query state 2718 * @param id: module id. 2719 * @param rcode: rcode result value. 2720 * @param msg: result message (if rcode is OK). 2721 * @param qinfo: from the sub query state, query info. 2722 * @param origin: the origin of msg. 2723 */ 2724 static void 2725 process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq, 2726 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo, 2727 struct sock_list* origin) 2728 { 2729 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2730 struct key_entry_key* old = vq->key_entry; 2731 struct ub_packed_rrset_key* dnskey = NULL; 2732 int downprot; 2733 char* reason = NULL; 2734 2735 if(rcode == LDNS_RCODE_NOERROR) 2736 dnskey = reply_find_answer_rrset(qinfo, msg->rep); 2737 2738 if(dnskey == NULL) { 2739 /* bad response */ 2740 verbose(VERB_DETAIL, "Missing DNSKEY RRset in response to " 2741 "DNSKEY query."); 2742 if(vq->restart_count < VAL_MAX_RESTART_COUNT) { 2743 val_blacklist(&vq->chain_blacklist, qstate->region, 2744 origin, 1); 2745 qstate->errinf = NULL; 2746 vq->restart_count++; 2747 return; 2748 } 2749 vq->key_entry = key_entry_create_bad(qstate->region, 2750 qinfo->qname, qinfo->qname_len, qinfo->qclass, 2751 BOGUS_KEY_TTL, *qstate->env->now); 2752 if(!vq->key_entry) { 2753 log_err("alloc failure in missing dnskey response"); 2754 /* key_entry is NULL for failure in Validate */ 2755 } 2756 errinf(qstate, "No DNSKEY record"); 2757 errinf_origin(qstate, origin); 2758 errinf_dname(qstate, "for key", qinfo->qname); 2759 vq->state = VAL_VALIDATE_STATE; 2760 return; 2761 } 2762 if(!vq->ds_rrset) { 2763 log_err("internal error: no DS rrset for new DNSKEY response"); 2764 vq->key_entry = NULL; 2765 vq->state = VAL_VALIDATE_STATE; 2766 return; 2767 } 2768 downprot = 1; 2769 vq->key_entry = val_verify_new_DNSKEYs(qstate->region, qstate->env, 2770 ve, dnskey, vq->ds_rrset, downprot, &reason); 2771 2772 if(!vq->key_entry) { 2773 log_err("out of memory in verify new DNSKEYs"); 2774 vq->state = VAL_VALIDATE_STATE; 2775 return; 2776 } 2777 /* If the key entry isBad or isNull, then we can move on to the next 2778 * state. */ 2779 if(!key_entry_isgood(vq->key_entry)) { 2780 if(key_entry_isbad(vq->key_entry)) { 2781 if(vq->restart_count < VAL_MAX_RESTART_COUNT) { 2782 val_blacklist(&vq->chain_blacklist, 2783 qstate->region, origin, 1); 2784 qstate->errinf = NULL; 2785 vq->restart_count++; 2786 vq->key_entry = old; 2787 return; 2788 } 2789 verbose(VERB_DETAIL, "Did not match a DS to a DNSKEY, " 2790 "thus bogus."); 2791 errinf(qstate, reason); 2792 errinf_origin(qstate, origin); 2793 errinf_dname(qstate, "for key", qinfo->qname); 2794 } 2795 vq->chain_blacklist = NULL; 2796 vq->state = VAL_VALIDATE_STATE; 2797 return; 2798 } 2799 vq->chain_blacklist = NULL; 2800 qstate->errinf = NULL; 2801 2802 /* The DNSKEY validated, so cache it as a trusted key rrset. */ 2803 key_cache_insert(ve->kcache, vq->key_entry, qstate); 2804 2805 /* If good, we stay in the FINDKEY state. */ 2806 log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo); 2807 } 2808 2809 /** 2810 * Process prime response 2811 * Sets the key entry in the state. 2812 * 2813 * @param qstate: query state that is validating and primed a trust anchor. 2814 * @param vq: validator query state 2815 * @param id: module id. 2816 * @param rcode: rcode result value. 2817 * @param msg: result message (if rcode is OK). 2818 * @param origin: the origin of msg. 2819 */ 2820 static void 2821 process_prime_response(struct module_qstate* qstate, struct val_qstate* vq, 2822 int id, int rcode, struct dns_msg* msg, struct sock_list* origin) 2823 { 2824 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2825 struct ub_packed_rrset_key* dnskey_rrset = NULL; 2826 struct trust_anchor* ta = anchor_find(qstate->env->anchors, 2827 vq->trust_anchor_name, vq->trust_anchor_labs, 2828 vq->trust_anchor_len, vq->qchase.qclass); 2829 if(!ta) { 2830 /* trust anchor revoked, restart with less anchors */ 2831 vq->state = VAL_INIT_STATE; 2832 if(!vq->trust_anchor_name) 2833 vq->state = VAL_VALIDATE_STATE; /* break a loop */ 2834 vq->trust_anchor_name = NULL; 2835 return; 2836 } 2837 /* Fetch and validate the keyEntry that corresponds to the 2838 * current trust anchor. */ 2839 if(rcode == LDNS_RCODE_NOERROR) { 2840 dnskey_rrset = reply_find_rrset_section_an(msg->rep, 2841 ta->name, ta->namelen, LDNS_RR_TYPE_DNSKEY, 2842 ta->dclass); 2843 } 2844 if(ta->autr) { 2845 if(!autr_process_prime(qstate->env, ve, ta, dnskey_rrset)) { 2846 /* trust anchor revoked, restart with less anchors */ 2847 vq->state = VAL_INIT_STATE; 2848 vq->trust_anchor_name = NULL; 2849 return; 2850 } 2851 } 2852 vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, id); 2853 lock_basic_unlock(&ta->lock); 2854 if(vq->key_entry) { 2855 if(key_entry_isbad(vq->key_entry) 2856 && vq->restart_count < VAL_MAX_RESTART_COUNT) { 2857 val_blacklist(&vq->chain_blacklist, qstate->region, 2858 origin, 1); 2859 qstate->errinf = NULL; 2860 vq->restart_count++; 2861 vq->key_entry = NULL; 2862 vq->state = VAL_INIT_STATE; 2863 return; 2864 } 2865 vq->chain_blacklist = NULL; 2866 errinf_origin(qstate, origin); 2867 errinf_dname(qstate, "for trust anchor", ta->name); 2868 /* store the freshly primed entry in the cache */ 2869 key_cache_insert(ve->kcache, vq->key_entry, qstate); 2870 } 2871 2872 /* If the result of the prime is a null key, skip the FINDKEY state.*/ 2873 if(!vq->key_entry || key_entry_isnull(vq->key_entry) || 2874 key_entry_isbad(vq->key_entry)) { 2875 vq->state = VAL_VALIDATE_STATE; 2876 } 2877 /* the qstate will be reactivated after inform_super is done */ 2878 } 2879 2880 /** 2881 * Process DLV response. Called from inform_supers. 2882 * Because it is in inform_supers, the mesh itself is busy doing callbacks 2883 * for a state that is to be deleted soon; don't touch the mesh; instead 2884 * set a state in the super, as the super will be reactivated soon. 2885 * Perform processing to determine what state to set in the super. 2886 * 2887 * @param qstate: query state that is validating and asked for a DLV. 2888 * @param vq: validator query state 2889 * @param id: module id. 2890 * @param rcode: rcode result value. 2891 * @param msg: result message (if rcode is OK). 2892 * @param qinfo: from the sub query state, query info. 2893 */ 2894 static void 2895 process_dlv_response(struct module_qstate* qstate, struct val_qstate* vq, 2896 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo) 2897 { 2898 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2899 2900 verbose(VERB_ALGO, "process dlv response to super"); 2901 if(rcode != LDNS_RCODE_NOERROR) { 2902 /* lookup failed, set in vq to give up */ 2903 vq->dlv_status = dlv_error; 2904 verbose(VERB_ALGO, "response is error"); 2905 return; 2906 } 2907 if(msg->rep->security != sec_status_secure) { 2908 vq->dlv_status = dlv_error; 2909 verbose(VERB_ALGO, "response is not secure, %s", 2910 sec_status_to_string(msg->rep->security)); 2911 return; 2912 } 2913 /* was the lookup a success? validated DLV? */ 2914 if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NOERROR && 2915 msg->rep->an_numrrsets == 1 && 2916 msg->rep->security == sec_status_secure && 2917 ntohs(msg->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DLV && 2918 ntohs(msg->rep->rrsets[0]->rk.rrset_class) == qinfo->qclass && 2919 query_dname_compare(msg->rep->rrsets[0]->rk.dname, 2920 vq->dlv_lookup_name) == 0) { 2921 /* yay! it is just like a DS */ 2922 vq->ds_rrset = (struct ub_packed_rrset_key*) 2923 regional_alloc_init(qstate->region, 2924 msg->rep->rrsets[0], sizeof(*vq->ds_rrset)); 2925 if(!vq->ds_rrset) { 2926 log_err("out of memory in process_dlv"); 2927 return; 2928 } 2929 vq->ds_rrset->entry.key = vq->ds_rrset; 2930 vq->ds_rrset->rk.dname = (uint8_t*)regional_alloc_init( 2931 qstate->region, vq->ds_rrset->rk.dname, 2932 vq->ds_rrset->rk.dname_len); 2933 if(!vq->ds_rrset->rk.dname) { 2934 log_err("out of memory in process_dlv"); 2935 vq->dlv_status = dlv_error; 2936 return; 2937 } 2938 vq->ds_rrset->entry.data = regional_alloc_init(qstate->region, 2939 vq->ds_rrset->entry.data, 2940 packed_rrset_sizeof(vq->ds_rrset->entry.data)); 2941 if(!vq->ds_rrset->entry.data) { 2942 log_err("out of memory in process_dlv"); 2943 vq->dlv_status = dlv_error; 2944 return; 2945 } 2946 packed_rrset_ptr_fixup(vq->ds_rrset->entry.data); 2947 /* make vq do a DNSKEY query next up */ 2948 vq->dlv_status = dlv_success; 2949 return; 2950 } 2951 /* store NSECs into negative cache */ 2952 val_neg_addreply(ve->neg_cache, msg->rep); 2953 2954 /* was the lookup a failure? 2955 * if we have to go up into the DLV for a higher DLV anchor 2956 * then set this in the vq, so it can make queries when activated. 2957 * See if the NSECs indicate that we should look for higher DLV 2958 * or, that there is no DLV securely */ 2959 if(!val_nsec_check_dlv(qinfo, msg->rep, &vq->dlv_lookup_name, 2960 &vq->dlv_lookup_name_len)) { 2961 vq->dlv_status = dlv_error; 2962 verbose(VERB_ALGO, "nsec error"); 2963 return; 2964 } 2965 if(!dname_subdomain_c(vq->dlv_lookup_name, 2966 qstate->env->anchors->dlv_anchor->name)) { 2967 vq->dlv_status = dlv_there_is_no_dlv; 2968 return; 2969 } 2970 vq->dlv_status = dlv_ask_higher; 2971 } 2972 2973 /* 2974 * inform validator super. 2975 * 2976 * @param qstate: query state that finished. 2977 * @param id: module id. 2978 * @param super: the qstate to inform. 2979 */ 2980 void 2981 val_inform_super(struct module_qstate* qstate, int id, 2982 struct module_qstate* super) 2983 { 2984 struct val_qstate* vq = (struct val_qstate*)super->minfo[id]; 2985 log_query_info(VERB_ALGO, "validator: inform_super, sub is", 2986 &qstate->qinfo); 2987 log_query_info(VERB_ALGO, "super is", &super->qinfo); 2988 if(!vq) { 2989 verbose(VERB_ALGO, "super: has no validator state"); 2990 return; 2991 } 2992 if(vq->wait_prime_ta) { 2993 vq->wait_prime_ta = 0; 2994 process_prime_response(super, vq, id, qstate->return_rcode, 2995 qstate->return_msg, qstate->reply_origin); 2996 return; 2997 } 2998 if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS) { 2999 process_ds_response(super, vq, id, qstate->return_rcode, 3000 qstate->return_msg, &qstate->qinfo, 3001 qstate->reply_origin); 3002 return; 3003 } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY) { 3004 process_dnskey_response(super, vq, id, qstate->return_rcode, 3005 qstate->return_msg, &qstate->qinfo, 3006 qstate->reply_origin); 3007 return; 3008 } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DLV) { 3009 process_dlv_response(super, vq, id, qstate->return_rcode, 3010 qstate->return_msg, &qstate->qinfo); 3011 return; 3012 } 3013 log_err("internal error in validator: no inform_supers possible"); 3014 } 3015 3016 void 3017 val_clear(struct module_qstate* qstate, int id) 3018 { 3019 if(!qstate) 3020 return; 3021 /* everything is allocated in the region, so assign NULL */ 3022 qstate->minfo[id] = NULL; 3023 } 3024 3025 size_t 3026 val_get_mem(struct module_env* env, int id) 3027 { 3028 struct val_env* ve = (struct val_env*)env->modinfo[id]; 3029 if(!ve) 3030 return 0; 3031 return sizeof(*ve) + key_cache_get_mem(ve->kcache) + 3032 val_neg_get_mem(ve->neg_cache) + 3033 sizeof(size_t)*2*ve->nsec3_keyiter_count; 3034 } 3035 3036 /** 3037 * The validator function block 3038 */ 3039 static struct module_func_block val_block = { 3040 "validator", 3041 &val_init, &val_deinit, &val_operate, &val_inform_super, &val_clear, 3042 &val_get_mem 3043 }; 3044 3045 struct module_func_block* 3046 val_get_funcblock(void) 3047 { 3048 return &val_block; 3049 } 3050 3051 const char* 3052 val_state_to_string(enum val_state state) 3053 { 3054 switch(state) { 3055 case VAL_INIT_STATE: return "VAL_INIT_STATE"; 3056 case VAL_FINDKEY_STATE: return "VAL_FINDKEY_STATE"; 3057 case VAL_VALIDATE_STATE: return "VAL_VALIDATE_STATE"; 3058 case VAL_FINISHED_STATE: return "VAL_FINISHED_STATE"; 3059 case VAL_DLVLOOKUP_STATE: return "VAL_DLVLOOKUP_STATE"; 3060 } 3061 return "UNKNOWN VALIDATOR STATE"; 3062 } 3063 3064