1 /* 2 * validator/validator.c - secure validator DNS query response module 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains a module that performs validation of DNS queries. 40 * According to RFC 4034. 41 */ 42 #include "config.h" 43 #include <ctype.h> 44 #include "validator/validator.h" 45 #include "validator/val_anchor.h" 46 #include "validator/val_kcache.h" 47 #include "validator/val_kentry.h" 48 #include "validator/val_utils.h" 49 #include "validator/val_nsec.h" 50 #include "validator/val_nsec3.h" 51 #include "validator/val_neg.h" 52 #include "validator/val_sigcrypt.h" 53 #include "validator/autotrust.h" 54 #include "services/cache/dns.h" 55 #include "services/cache/rrset.h" 56 #include "util/data/dname.h" 57 #include "util/module.h" 58 #include "util/log.h" 59 #include "util/net_help.h" 60 #include "util/regional.h" 61 #include "util/config_file.h" 62 #include "util/fptr_wlist.h" 63 #include "sldns/rrdef.h" 64 #include "sldns/wire2str.h" 65 #include "sldns/str2wire.h" 66 67 /* forward decl for cache response and normal super inform calls of a DS */ 68 static void process_ds_response(struct module_qstate* qstate, 69 struct val_qstate* vq, int id, int rcode, struct dns_msg* msg, 70 struct query_info* qinfo, struct sock_list* origin); 71 72 73 /* Updates the suplied EDE (RFC8914) code selectively so we don't lose 74 * a more specific code */ 75 static void 76 update_reason_bogus(struct reply_info* rep, sldns_ede_code reason_bogus) 77 { 78 if(reason_bogus == LDNS_EDE_NONE) return; 79 if(reason_bogus == LDNS_EDE_DNSSEC_BOGUS 80 && rep->reason_bogus != LDNS_EDE_NONE 81 && rep->reason_bogus != LDNS_EDE_DNSSEC_BOGUS) return; 82 rep->reason_bogus = reason_bogus; 83 } 84 85 86 /** fill up nsec3 key iterations config entry */ 87 static int 88 fill_nsec3_iter(struct val_env* ve, char* s, int c) 89 { 90 char* e; 91 int i; 92 free(ve->nsec3_keysize); 93 free(ve->nsec3_maxiter); 94 ve->nsec3_keysize = (size_t*)calloc(sizeof(size_t), (size_t)c); 95 ve->nsec3_maxiter = (size_t*)calloc(sizeof(size_t), (size_t)c); 96 if(!ve->nsec3_keysize || !ve->nsec3_maxiter) { 97 log_err("out of memory"); 98 return 0; 99 } 100 for(i=0; i<c; i++) { 101 ve->nsec3_keysize[i] = (size_t)strtol(s, &e, 10); 102 if(s == e) { 103 log_err("cannot parse: %s", s); 104 return 0; 105 } 106 s = e; 107 ve->nsec3_maxiter[i] = (size_t)strtol(s, &e, 10); 108 if(s == e) { 109 log_err("cannot parse: %s", s); 110 return 0; 111 } 112 s = e; 113 if(i>0 && ve->nsec3_keysize[i-1] >= ve->nsec3_keysize[i]) { 114 log_err("nsec3 key iterations not ascending: %d %d", 115 (int)ve->nsec3_keysize[i-1], 116 (int)ve->nsec3_keysize[i]); 117 return 0; 118 } 119 verbose(VERB_ALGO, "validator nsec3cfg keysz %d mxiter %d", 120 (int)ve->nsec3_keysize[i], (int)ve->nsec3_maxiter[i]); 121 } 122 return 1; 123 } 124 125 /** apply config settings to validator */ 126 static int 127 val_apply_cfg(struct module_env* env, struct val_env* val_env, 128 struct config_file* cfg) 129 { 130 int c; 131 val_env->bogus_ttl = (uint32_t)cfg->bogus_ttl; 132 if(!env->anchors) 133 env->anchors = anchors_create(); 134 if(!env->anchors) { 135 log_err("out of memory"); 136 return 0; 137 } 138 if (env->key_cache) 139 val_env->kcache = env->key_cache; 140 if(!val_env->kcache) 141 val_env->kcache = key_cache_create(cfg); 142 if(!val_env->kcache) { 143 log_err("out of memory"); 144 return 0; 145 } 146 env->key_cache = val_env->kcache; 147 if(!anchors_apply_cfg(env->anchors, cfg)) { 148 log_err("validator: error in trustanchors config"); 149 return 0; 150 } 151 val_env->date_override = cfg->val_date_override; 152 val_env->skew_min = cfg->val_sig_skew_min; 153 val_env->skew_max = cfg->val_sig_skew_max; 154 val_env->max_restart = cfg->val_max_restart; 155 c = cfg_count_numbers(cfg->val_nsec3_key_iterations); 156 if(c < 1 || (c&1)) { 157 log_err("validator: unparsable or odd nsec3 key " 158 "iterations: %s", cfg->val_nsec3_key_iterations); 159 return 0; 160 } 161 val_env->nsec3_keyiter_count = c/2; 162 if(!fill_nsec3_iter(val_env, cfg->val_nsec3_key_iterations, c/2)) { 163 log_err("validator: cannot apply nsec3 key iterations"); 164 return 0; 165 } 166 if (env->neg_cache) 167 val_env->neg_cache = env->neg_cache; 168 if(!val_env->neg_cache) 169 val_env->neg_cache = val_neg_create(cfg, 170 val_env->nsec3_maxiter[val_env->nsec3_keyiter_count-1]); 171 if(!val_env->neg_cache) { 172 log_err("out of memory"); 173 return 0; 174 } 175 env->neg_cache = val_env->neg_cache; 176 return 1; 177 } 178 179 #ifdef USE_ECDSA_EVP_WORKAROUND 180 void ecdsa_evp_workaround_init(void); 181 #endif 182 int 183 val_init(struct module_env* env, int id) 184 { 185 struct val_env* val_env = (struct val_env*)calloc(1, 186 sizeof(struct val_env)); 187 if(!val_env) { 188 log_err("malloc failure"); 189 return 0; 190 } 191 env->modinfo[id] = (void*)val_env; 192 env->need_to_validate = 1; 193 lock_basic_init(&val_env->bogus_lock); 194 lock_protect(&val_env->bogus_lock, &val_env->num_rrset_bogus, 195 sizeof(val_env->num_rrset_bogus)); 196 #ifdef USE_ECDSA_EVP_WORKAROUND 197 ecdsa_evp_workaround_init(); 198 #endif 199 if(!val_apply_cfg(env, val_env, env->cfg)) { 200 log_err("validator: could not apply configuration settings."); 201 return 0; 202 } 203 204 return 1; 205 } 206 207 void 208 val_deinit(struct module_env* env, int id) 209 { 210 struct val_env* val_env; 211 if(!env || !env->modinfo[id]) 212 return; 213 val_env = (struct val_env*)env->modinfo[id]; 214 lock_basic_destroy(&val_env->bogus_lock); 215 anchors_delete(env->anchors); 216 env->anchors = NULL; 217 key_cache_delete(val_env->kcache); 218 env->key_cache = NULL; 219 neg_cache_delete(val_env->neg_cache); 220 env->neg_cache = NULL; 221 free(val_env->nsec3_keysize); 222 free(val_env->nsec3_maxiter); 223 free(val_env); 224 env->modinfo[id] = NULL; 225 } 226 227 /** fill in message structure */ 228 static struct val_qstate* 229 val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq) 230 { 231 if(!qstate->return_msg || qstate->return_rcode != LDNS_RCODE_NOERROR) { 232 /* create a message to verify */ 233 verbose(VERB_ALGO, "constructing reply for validation"); 234 vq->orig_msg = (struct dns_msg*)regional_alloc(qstate->region, 235 sizeof(struct dns_msg)); 236 if(!vq->orig_msg) 237 return NULL; 238 vq->orig_msg->qinfo = qstate->qinfo; 239 vq->orig_msg->rep = (struct reply_info*)regional_alloc( 240 qstate->region, sizeof(struct reply_info)); 241 if(!vq->orig_msg->rep) 242 return NULL; 243 memset(vq->orig_msg->rep, 0, sizeof(struct reply_info)); 244 vq->orig_msg->rep->flags = (uint16_t)(qstate->return_rcode&0xf) 245 |BIT_QR|BIT_RA|(qstate->query_flags|(BIT_CD|BIT_RD)); 246 vq->orig_msg->rep->qdcount = 1; 247 vq->orig_msg->rep->reason_bogus = LDNS_EDE_NONE; 248 } else { 249 vq->orig_msg = qstate->return_msg; 250 } 251 vq->qchase = qstate->qinfo; 252 /* chase reply will be an edited (sub)set of the orig msg rrset ptrs */ 253 vq->chase_reply = regional_alloc_init(qstate->region, 254 vq->orig_msg->rep, 255 sizeof(struct reply_info) - sizeof(struct rrset_ref)); 256 if(!vq->chase_reply) 257 return NULL; 258 if(vq->orig_msg->rep->rrset_count > RR_COUNT_MAX) 259 return NULL; /* protect against integer overflow */ 260 vq->chase_reply->rrsets = regional_alloc_init(qstate->region, 261 vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*) 262 * vq->orig_msg->rep->rrset_count); 263 if(!vq->chase_reply->rrsets) 264 return NULL; 265 vq->rrset_skip = 0; 266 return vq; 267 } 268 269 /** allocate new validator query state */ 270 static struct val_qstate* 271 val_new(struct module_qstate* qstate, int id) 272 { 273 struct val_qstate* vq = (struct val_qstate*)regional_alloc( 274 qstate->region, sizeof(*vq)); 275 log_assert(!qstate->minfo[id]); 276 if(!vq) 277 return NULL; 278 memset(vq, 0, sizeof(*vq)); 279 qstate->minfo[id] = vq; 280 vq->state = VAL_INIT_STATE; 281 return val_new_getmsg(qstate, vq); 282 } 283 284 /** 285 * Exit validation with an error status 286 * 287 * @param qstate: query state 288 * @param id: validator id. 289 * @return false, for use by caller to return to stop processing. 290 */ 291 static int 292 val_error(struct module_qstate* qstate, int id) 293 { 294 qstate->ext_state[id] = module_error; 295 qstate->return_rcode = LDNS_RCODE_SERVFAIL; 296 return 0; 297 } 298 299 /** 300 * Check to see if a given response needs to go through the validation 301 * process. Typical reasons for this routine to return false are: CD bit was 302 * on in the original request, or the response is a kind of message that 303 * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.) 304 * 305 * @param qstate: query state. 306 * @param ret_rc: rcode for this message (if noerror - examine ret_msg). 307 * @param ret_msg: return msg, can be NULL; look at rcode instead. 308 * @return true if the response could use validation (although this does not 309 * mean we can actually validate this response). 310 */ 311 static int 312 needs_validation(struct module_qstate* qstate, int ret_rc, 313 struct dns_msg* ret_msg) 314 { 315 int rcode; 316 317 /* If the CD bit is on in the original request, then you could think 318 * that we don't bother to validate anything. 319 * But this is signalled internally with the valrec flag. 320 * User queries are validated with BIT_CD to make our cache clean 321 * so that bogus messages get retried by the upstream also for 322 * downstream validators that set BIT_CD. 323 * For DNS64 bit_cd signals no dns64 processing, but we want to 324 * provide validation there too */ 325 /* 326 if(qstate->query_flags & BIT_CD) { 327 verbose(VERB_ALGO, "not validating response due to CD bit"); 328 return 0; 329 } 330 */ 331 if(qstate->is_valrec) { 332 verbose(VERB_ALGO, "not validating response, is valrec" 333 "(validation recursion lookup)"); 334 return 0; 335 } 336 337 if(ret_rc != LDNS_RCODE_NOERROR || !ret_msg) 338 rcode = ret_rc; 339 else rcode = (int)FLAGS_GET_RCODE(ret_msg->rep->flags); 340 341 if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) { 342 if(verbosity >= VERB_ALGO) { 343 char rc[16]; 344 rc[0]=0; 345 (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc)); 346 verbose(VERB_ALGO, "cannot validate non-answer, rcode %s", rc); 347 } 348 return 0; 349 } 350 351 /* cannot validate positive RRSIG response. (negatives can) */ 352 if(qstate->qinfo.qtype == LDNS_RR_TYPE_RRSIG && 353 rcode == LDNS_RCODE_NOERROR && ret_msg && 354 ret_msg->rep->an_numrrsets > 0) { 355 verbose(VERB_ALGO, "cannot validate RRSIG, no sigs on sigs."); 356 return 0; 357 } 358 return 1; 359 } 360 361 /** 362 * Check to see if the response has already been validated. 363 * @param ret_msg: return msg, can be NULL 364 * @return true if the response has already been validated 365 */ 366 static int 367 already_validated(struct dns_msg* ret_msg) 368 { 369 /* validate unchecked, and re-validate bogus messages */ 370 if (ret_msg && ret_msg->rep->security > sec_status_bogus) 371 { 372 verbose(VERB_ALGO, "response has already been validated: %s", 373 sec_status_to_string(ret_msg->rep->security)); 374 return 1; 375 } 376 return 0; 377 } 378 379 /** 380 * Generate a request for DNS data. 381 * 382 * @param qstate: query state that is the parent. 383 * @param id: module id. 384 * @param name: what name to query for. 385 * @param namelen: length of name. 386 * @param qtype: query type. 387 * @param qclass: query class. 388 * @param flags: additional flags, such as the CD bit (BIT_CD), or 0. 389 * @param newq: If the subquery is newly created, it is returned, 390 * otherwise NULL is returned 391 * @param detached: true if this qstate should not attach to the subquery 392 * @return false on alloc failure. 393 */ 394 static int 395 generate_request(struct module_qstate* qstate, int id, uint8_t* name, 396 size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags, 397 struct module_qstate** newq, int detached) 398 { 399 struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id]; 400 struct query_info ask; 401 int valrec; 402 ask.qname = name; 403 ask.qname_len = namelen; 404 ask.qtype = qtype; 405 ask.qclass = qclass; 406 ask.local_alias = NULL; 407 log_query_info(VERB_ALGO, "generate request", &ask); 408 /* enable valrec flag to avoid recursion to the same validation 409 * routine, this lookup is simply a lookup. */ 410 valrec = 1; 411 412 fptr_ok(fptr_whitelist_modenv_detect_cycle(qstate->env->detect_cycle)); 413 if((*qstate->env->detect_cycle)(qstate, &ask, 414 (uint16_t)(BIT_RD|flags), 0, valrec)) { 415 verbose(VERB_ALGO, "Could not generate request: cycle detected"); 416 return 0; 417 } 418 419 if(detached) { 420 struct mesh_state* sub = NULL; 421 fptr_ok(fptr_whitelist_modenv_add_sub( 422 qstate->env->add_sub)); 423 if(!(*qstate->env->add_sub)(qstate, &ask, 424 (uint16_t)(BIT_RD|flags), 0, valrec, newq, &sub)){ 425 log_err("Could not generate request: out of memory"); 426 return 0; 427 } 428 } 429 else { 430 fptr_ok(fptr_whitelist_modenv_attach_sub( 431 qstate->env->attach_sub)); 432 if(!(*qstate->env->attach_sub)(qstate, &ask, 433 (uint16_t)(BIT_RD|flags), 0, valrec, newq)){ 434 log_err("Could not generate request: out of memory"); 435 return 0; 436 } 437 } 438 /* newq; validator does not need state created for that 439 * query, and its a 'normal' for iterator as well */ 440 if(*newq) { 441 /* add our blacklist to the query blacklist */ 442 sock_list_merge(&(*newq)->blacklist, (*newq)->region, 443 vq->chain_blacklist); 444 } 445 qstate->ext_state[id] = module_wait_subquery; 446 return 1; 447 } 448 449 /** 450 * Generate, send and detach key tag signaling query. 451 * 452 * @param qstate: query state. 453 * @param id: module id. 454 * @param ta: trust anchor, locked. 455 * @return false on a processing error. 456 */ 457 static int 458 generate_keytag_query(struct module_qstate* qstate, int id, 459 struct trust_anchor* ta) 460 { 461 /* 3 bytes for "_ta", 5 bytes per tag (4 bytes + "-") */ 462 #define MAX_LABEL_TAGS (LDNS_MAX_LABELLEN-3)/5 463 size_t i, numtag; 464 uint16_t tags[MAX_LABEL_TAGS]; 465 char tagstr[LDNS_MAX_LABELLEN+1] = "_ta"; /* +1 for NULL byte */ 466 size_t tagstr_left = sizeof(tagstr) - strlen(tagstr); 467 char* tagstr_pos = tagstr + strlen(tagstr); 468 uint8_t dnamebuf[LDNS_MAX_DOMAINLEN+1]; /* +1 for label length byte */ 469 size_t dnamebuf_len = sizeof(dnamebuf); 470 uint8_t* keytagdname; 471 struct module_qstate* newq = NULL; 472 enum module_ext_state ext_state = qstate->ext_state[id]; 473 474 numtag = anchor_list_keytags(ta, tags, MAX_LABEL_TAGS); 475 if(numtag == 0) 476 return 0; 477 478 for(i=0; i<numtag; i++) { 479 /* Buffer can't overflow; numtag is limited to tags that fit in 480 * the buffer. */ 481 snprintf(tagstr_pos, tagstr_left, "-%04x", (unsigned)tags[i]); 482 tagstr_left -= strlen(tagstr_pos); 483 tagstr_pos += strlen(tagstr_pos); 484 } 485 486 sldns_str2wire_dname_buf_origin(tagstr, dnamebuf, &dnamebuf_len, 487 ta->name, ta->namelen); 488 if(!(keytagdname = (uint8_t*)regional_alloc_init(qstate->region, 489 dnamebuf, dnamebuf_len))) { 490 log_err("could not generate key tag query: out of memory"); 491 return 0; 492 } 493 494 log_nametypeclass(VERB_OPS, "generate keytag query", keytagdname, 495 LDNS_RR_TYPE_NULL, ta->dclass); 496 if(!generate_request(qstate, id, keytagdname, dnamebuf_len, 497 LDNS_RR_TYPE_NULL, ta->dclass, 0, &newq, 1)) { 498 verbose(VERB_ALGO, "failed to generate key tag signaling request"); 499 return 0; 500 } 501 502 /* Not interested in subquery response. Restore the ext_state, 503 * that might be changed by generate_request() */ 504 qstate->ext_state[id] = ext_state; 505 506 return 1; 507 } 508 509 /** 510 * Get keytag as uint16_t from string 511 * 512 * @param start: start of string containing keytag 513 * @param keytag: pointer where to store the extracted keytag 514 * @return: 1 if keytag was extracted, else 0. 515 */ 516 static int 517 sentinel_get_keytag(char* start, uint16_t* keytag) { 518 char* keytag_str; 519 char* e = NULL; 520 keytag_str = calloc(1, SENTINEL_KEYTAG_LEN + 1 /* null byte */); 521 if(!keytag_str) 522 return 0; 523 memmove(keytag_str, start, SENTINEL_KEYTAG_LEN); 524 keytag_str[SENTINEL_KEYTAG_LEN] = '\0'; 525 *keytag = (uint16_t)strtol(keytag_str, &e, 10); 526 if(!e || *e != '\0') { 527 free(keytag_str); 528 return 0; 529 } 530 free(keytag_str); 531 return 1; 532 } 533 534 /** 535 * Prime trust anchor for use. 536 * Generate and dispatch a priming query for the given trust anchor. 537 * The trust anchor can be DNSKEY or DS and does not have to be signed. 538 * 539 * @param qstate: query state. 540 * @param vq: validator query state. 541 * @param id: module id. 542 * @param toprime: what to prime. 543 * @return false on a processing error. 544 */ 545 static int 546 prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq, 547 int id, struct trust_anchor* toprime) 548 { 549 struct module_qstate* newq = NULL; 550 int ret = generate_request(qstate, id, toprime->name, toprime->namelen, 551 LDNS_RR_TYPE_DNSKEY, toprime->dclass, BIT_CD, &newq, 0); 552 553 if(newq && qstate->env->cfg->trust_anchor_signaling && 554 !generate_keytag_query(qstate, id, toprime)) { 555 verbose(VERB_ALGO, "keytag signaling query failed"); 556 return 0; 557 } 558 559 if(!ret) { 560 verbose(VERB_ALGO, "Could not prime trust anchor"); 561 return 0; 562 } 563 /* ignore newq; validator does not need state created for that 564 * query, and its a 'normal' for iterator as well */ 565 vq->wait_prime_ta = 1; /* to elicit PRIME_RESP_STATE processing 566 from the validator inform_super() routine */ 567 /* store trust anchor name for later lookup when prime returns */ 568 vq->trust_anchor_name = regional_alloc_init(qstate->region, 569 toprime->name, toprime->namelen); 570 vq->trust_anchor_len = toprime->namelen; 571 vq->trust_anchor_labs = toprime->namelabs; 572 if(!vq->trust_anchor_name) { 573 log_err("Could not prime trust anchor: out of memory"); 574 return 0; 575 } 576 return 1; 577 } 578 579 /** 580 * Validate if the ANSWER and AUTHORITY sections contain valid rrsets. 581 * They must be validly signed with the given key. 582 * Tries to validate ADDITIONAL rrsets as well, but only to check them. 583 * Allows unsigned CNAME after a DNAME that expands the DNAME. 584 * 585 * Note that by the time this method is called, the process of finding the 586 * trusted DNSKEY rrset that signs this response must already have been 587 * completed. 588 * 589 * @param qstate: query state. 590 * @param env: module env for verify. 591 * @param ve: validator env for verify. 592 * @param qchase: query that was made. 593 * @param chase_reply: answer to validate. 594 * @param key_entry: the key entry, which is trusted, and which matches 595 * the signer of the answer. The key entry isgood(). 596 * @return false if any of the rrsets in the an or ns sections of the message 597 * fail to verify. The message is then set to bogus. 598 */ 599 static int 600 validate_msg_signatures(struct module_qstate* qstate, struct module_env* env, 601 struct val_env* ve, struct query_info* qchase, 602 struct reply_info* chase_reply, struct key_entry_key* key_entry) 603 { 604 uint8_t* sname; 605 size_t i, slen; 606 struct ub_packed_rrset_key* s; 607 enum sec_status sec; 608 int dname_seen = 0; 609 char* reason = NULL; 610 sldns_ede_code reason_bogus = LDNS_EDE_DNSSEC_BOGUS; 611 612 /* validate the ANSWER section */ 613 for(i=0; i<chase_reply->an_numrrsets; i++) { 614 s = chase_reply->rrsets[i]; 615 /* Skip the CNAME following a (validated) DNAME. 616 * Because of the normalization routines in the iterator, 617 * there will always be an unsigned CNAME following a DNAME 618 * (unless qtype=DNAME). */ 619 if(dname_seen && ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) { 620 dname_seen = 0; 621 /* CNAME was synthesized by our own iterator */ 622 /* since the DNAME verified, mark the CNAME as secure */ 623 ((struct packed_rrset_data*)s->entry.data)->security = 624 sec_status_secure; 625 ((struct packed_rrset_data*)s->entry.data)->trust = 626 rrset_trust_validated; 627 continue; 628 } 629 630 /* Verify the answer rrset */ 631 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason, 632 &reason_bogus, LDNS_SECTION_ANSWER, qstate); 633 /* If the (answer) rrset failed to validate, then this 634 * message is BAD. */ 635 if(sec != sec_status_secure) { 636 log_nametypeclass(VERB_QUERY, "validator: response " 637 "has failed ANSWER rrset:", s->rk.dname, 638 ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 639 errinf_ede(qstate, reason, reason_bogus); 640 if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) 641 errinf(qstate, "for CNAME"); 642 else if(ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) 643 errinf(qstate, "for DNAME"); 644 errinf_origin(qstate, qstate->reply_origin); 645 chase_reply->security = sec_status_bogus; 646 update_reason_bogus(chase_reply, reason_bogus); 647 648 return 0; 649 } 650 651 /* Notice a DNAME that should be followed by an unsigned 652 * CNAME. */ 653 if(qchase->qtype != LDNS_RR_TYPE_DNAME && 654 ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) { 655 dname_seen = 1; 656 } 657 } 658 659 /* validate the AUTHORITY section */ 660 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 661 chase_reply->ns_numrrsets; i++) { 662 s = chase_reply->rrsets[i]; 663 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason, 664 &reason_bogus, LDNS_SECTION_AUTHORITY, qstate); 665 /* If anything in the authority section fails to be secure, 666 * we have a bad message. */ 667 if(sec != sec_status_secure) { 668 log_nametypeclass(VERB_QUERY, "validator: response " 669 "has failed AUTHORITY rrset:", s->rk.dname, 670 ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 671 errinf_ede(qstate, reason, reason_bogus); 672 errinf_origin(qstate, qstate->reply_origin); 673 errinf_rrset(qstate, s); 674 chase_reply->security = sec_status_bogus; 675 update_reason_bogus(chase_reply, reason_bogus); 676 return 0; 677 } 678 } 679 680 /* If set, the validator should clean the additional section of 681 * secure messages. */ 682 if(!env->cfg->val_clean_additional) 683 return 1; 684 /* attempt to validate the ADDITIONAL section rrsets */ 685 for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets; 686 i<chase_reply->rrset_count; i++) { 687 s = chase_reply->rrsets[i]; 688 /* only validate rrs that have signatures with the key */ 689 /* leave others unchecked, those get removed later on too */ 690 val_find_rrset_signer(s, &sname, &slen); 691 692 if(sname && query_dname_compare(sname, key_entry->name)==0) 693 (void)val_verify_rrset_entry(env, ve, s, key_entry, 694 &reason, NULL, LDNS_SECTION_ADDITIONAL, qstate); 695 /* the additional section can fail to be secure, 696 * it is optional, check signature in case we need 697 * to clean the additional section later. */ 698 } 699 700 return 1; 701 } 702 703 /** 704 * Detect wrong truncated response (say from BIND 9.6.1 that is forwarding 705 * and saw the NS record without signatures from a referral). 706 * The positive response has a mangled authority section. 707 * Remove that authority section and the additional section. 708 * @param rep: reply 709 * @return true if a wrongly truncated response. 710 */ 711 static int 712 detect_wrongly_truncated(struct reply_info* rep) 713 { 714 size_t i; 715 /* only NS in authority, and it is bogus */ 716 if(rep->ns_numrrsets != 1 || rep->an_numrrsets == 0) 717 return 0; 718 if(ntohs(rep->rrsets[ rep->an_numrrsets ]->rk.type) != LDNS_RR_TYPE_NS) 719 return 0; 720 if(((struct packed_rrset_data*)rep->rrsets[ rep->an_numrrsets ] 721 ->entry.data)->security == sec_status_secure) 722 return 0; 723 /* answer section is present and secure */ 724 for(i=0; i<rep->an_numrrsets; i++) { 725 if(((struct packed_rrset_data*)rep->rrsets[ i ] 726 ->entry.data)->security != sec_status_secure) 727 return 0; 728 } 729 verbose(VERB_ALGO, "truncating to minimal response"); 730 return 1; 731 } 732 733 /** 734 * For messages that are not referrals, if the chase reply contains an 735 * unsigned NS record in the authority section it could have been 736 * inserted by a (BIND) forwarder that thinks the zone is insecure, and 737 * that has an NS record without signatures in cache. Remove the NS 738 * record since the reply does not hinge on that record (in the authority 739 * section), but do not remove it if it removes the last record from the 740 * answer+authority sections. 741 * @param chase_reply: the chased reply, we have a key for this contents, 742 * so we should have signatures for these rrsets and not having 743 * signatures means it will be bogus. 744 * @param orig_reply: original reply, remove NS from there as well because 745 * we cannot mark the NS record as DNSSEC valid because it is not 746 * validated by signatures. 747 */ 748 static void 749 remove_spurious_authority(struct reply_info* chase_reply, 750 struct reply_info* orig_reply) 751 { 752 size_t i, found = 0; 753 int remove = 0; 754 /* if no answer and only 1 auth RRset, do not remove that one */ 755 if(chase_reply->an_numrrsets == 0 && chase_reply->ns_numrrsets == 1) 756 return; 757 /* search authority section for unsigned NS records */ 758 for(i = chase_reply->an_numrrsets; 759 i < chase_reply->an_numrrsets+chase_reply->ns_numrrsets; i++) { 760 struct packed_rrset_data* d = (struct packed_rrset_data*) 761 chase_reply->rrsets[i]->entry.data; 762 if(ntohs(chase_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS 763 && d->rrsig_count == 0) { 764 found = i; 765 remove = 1; 766 break; 767 } 768 } 769 /* see if we found the entry */ 770 if(!remove) return; 771 log_rrset_key(VERB_ALGO, "Removing spurious unsigned NS record " 772 "(likely inserted by forwarder)", chase_reply->rrsets[found]); 773 774 /* find rrset in orig_reply */ 775 for(i = orig_reply->an_numrrsets; 776 i < orig_reply->an_numrrsets+orig_reply->ns_numrrsets; i++) { 777 if(ntohs(orig_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS 778 && query_dname_compare(orig_reply->rrsets[i]->rk.dname, 779 chase_reply->rrsets[found]->rk.dname) == 0) { 780 /* remove from orig_msg */ 781 val_reply_remove_auth(orig_reply, i); 782 break; 783 } 784 } 785 /* remove rrset from chase_reply */ 786 val_reply_remove_auth(chase_reply, found); 787 } 788 789 /** 790 * Given a "positive" response -- a response that contains an answer to the 791 * question, and no CNAME chain, validate this response. 792 * 793 * The answer and authority RRsets must already be verified as secure. 794 * 795 * @param env: module env for verify. 796 * @param ve: validator env for verify. 797 * @param qchase: query that was made. 798 * @param chase_reply: answer to that query to validate. 799 * @param kkey: the key entry, which is trusted, and which matches 800 * the signer of the answer. The key entry isgood(). 801 */ 802 static void 803 validate_positive_response(struct module_env* env, struct val_env* ve, 804 struct query_info* qchase, struct reply_info* chase_reply, 805 struct key_entry_key* kkey) 806 { 807 uint8_t* wc = NULL; 808 size_t wl; 809 int wc_cached = 0; 810 int wc_NSEC_ok = 0; 811 int nsec3s_seen = 0; 812 size_t i; 813 struct ub_packed_rrset_key* s; 814 815 /* validate the ANSWER section - this will be the answer itself */ 816 for(i=0; i<chase_reply->an_numrrsets; i++) { 817 s = chase_reply->rrsets[i]; 818 819 /* Check to see if the rrset is the result of a wildcard 820 * expansion. If so, an additional check will need to be 821 * made in the authority section. */ 822 if(!val_rrset_wildcard(s, &wc, &wl)) { 823 log_nametypeclass(VERB_QUERY, "Positive response has " 824 "inconsistent wildcard sigs:", s->rk.dname, 825 ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 826 chase_reply->security = sec_status_bogus; 827 update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); 828 return; 829 } 830 if(wc && !wc_cached && env->cfg->aggressive_nsec) { 831 rrset_cache_update_wildcard(env->rrset_cache, s, wc, wl, 832 env->alloc, *env->now); 833 wc_cached = 1; 834 } 835 836 } 837 838 /* validate the AUTHORITY section as well - this will generally be 839 * the NS rrset (which could be missing, no problem) */ 840 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 841 chase_reply->ns_numrrsets; i++) { 842 s = chase_reply->rrsets[i]; 843 844 /* If this is a positive wildcard response, and we have a 845 * (just verified) NSEC record, try to use it to 1) prove 846 * that qname doesn't exist and 2) that the correct wildcard 847 * was used. */ 848 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 849 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) { 850 wc_NSEC_ok = 1; 851 } 852 /* if not, continue looking for proof */ 853 } 854 855 /* Otherwise, if this is a positive wildcard response and 856 * we have NSEC3 records */ 857 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 858 nsec3s_seen = 1; 859 } 860 } 861 862 /* If this was a positive wildcard response that we haven't already 863 * proven, and we have NSEC3 records, try to prove it using the NSEC3 864 * records. */ 865 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) { 866 enum sec_status sec = nsec3_prove_wildcard(env, ve, 867 chase_reply->rrsets+chase_reply->an_numrrsets, 868 chase_reply->ns_numrrsets, qchase, kkey, wc); 869 if(sec == sec_status_insecure) { 870 verbose(VERB_ALGO, "Positive wildcard response is " 871 "insecure"); 872 chase_reply->security = sec_status_insecure; 873 return; 874 } else if(sec == sec_status_secure) 875 wc_NSEC_ok = 1; 876 } 877 878 /* If after all this, we still haven't proven the positive wildcard 879 * response, fail. */ 880 if(wc != NULL && !wc_NSEC_ok) { 881 verbose(VERB_QUERY, "positive response was wildcard " 882 "expansion and did not prove original data " 883 "did not exist"); 884 chase_reply->security = sec_status_bogus; 885 update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); 886 return; 887 } 888 889 verbose(VERB_ALGO, "Successfully validated positive response"); 890 chase_reply->security = sec_status_secure; 891 } 892 893 /** 894 * Validate a NOERROR/NODATA signed response -- a response that has a 895 * NOERROR Rcode but no ANSWER section RRsets. This consists of making 896 * certain that the authority section NSEC/NSEC3s proves that the qname 897 * does exist and the qtype doesn't. 898 * 899 * The answer and authority RRsets must already be verified as secure. 900 * 901 * @param env: module env for verify. 902 * @param ve: validator env for verify. 903 * @param qchase: query that was made. 904 * @param chase_reply: answer to that query to validate. 905 * @param kkey: the key entry, which is trusted, and which matches 906 * the signer of the answer. The key entry isgood(). 907 */ 908 static void 909 validate_nodata_response(struct module_env* env, struct val_env* ve, 910 struct query_info* qchase, struct reply_info* chase_reply, 911 struct key_entry_key* kkey) 912 { 913 /* Since we are here, there must be nothing in the ANSWER section to 914 * validate. */ 915 /* (Note: CNAME/DNAME responses will not directly get here -- 916 * instead, they are chased down into individual CNAME validations, 917 * and at the end of the cname chain a POSITIVE, or CNAME_NOANSWER 918 * validation.) */ 919 920 /* validate the AUTHORITY section */ 921 int has_valid_nsec = 0; /* If true, then the NODATA has been proven.*/ 922 uint8_t* ce = NULL; /* for wildcard nodata responses. This is the 923 proven closest encloser. */ 924 uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */ 925 int nsec3s_seen = 0; /* nsec3s seen */ 926 struct ub_packed_rrset_key* s; 927 size_t i; 928 929 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 930 chase_reply->ns_numrrsets; i++) { 931 s = chase_reply->rrsets[i]; 932 /* If we encounter an NSEC record, try to use it to prove 933 * NODATA. 934 * This needs to handle the ENT NODATA case. */ 935 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 936 if(nsec_proves_nodata(s, qchase, &wc)) { 937 has_valid_nsec = 1; 938 /* sets wc-encloser if wildcard applicable */ 939 } 940 if(val_nsec_proves_name_error(s, qchase->qname)) { 941 ce = nsec_closest_encloser(qchase->qname, s); 942 } 943 if(val_nsec_proves_insecuredelegation(s, qchase)) { 944 verbose(VERB_ALGO, "delegation is insecure"); 945 chase_reply->security = sec_status_insecure; 946 return; 947 } 948 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 949 nsec3s_seen = 1; 950 } 951 } 952 953 /* check to see if we have a wildcard NODATA proof. */ 954 955 /* The wildcard NODATA is 1 NSEC proving that qname does not exist 956 * (and also proving what the closest encloser is), and 1 NSEC 957 * showing the matching wildcard, which must be *.closest_encloser. */ 958 if(wc && !ce) 959 has_valid_nsec = 0; 960 else if(wc && ce) { 961 if(query_dname_compare(wc, ce) != 0) { 962 has_valid_nsec = 0; 963 } 964 } 965 966 if(!has_valid_nsec && nsec3s_seen) { 967 enum sec_status sec = nsec3_prove_nodata(env, ve, 968 chase_reply->rrsets+chase_reply->an_numrrsets, 969 chase_reply->ns_numrrsets, qchase, kkey); 970 if(sec == sec_status_insecure) { 971 verbose(VERB_ALGO, "NODATA response is insecure"); 972 chase_reply->security = sec_status_insecure; 973 return; 974 } else if(sec == sec_status_secure) 975 has_valid_nsec = 1; 976 } 977 978 if(!has_valid_nsec) { 979 verbose(VERB_QUERY, "NODATA response failed to prove NODATA " 980 "status with NSEC/NSEC3"); 981 if(verbosity >= VERB_ALGO) 982 log_dns_msg("Failed NODATA", qchase, chase_reply); 983 chase_reply->security = sec_status_bogus; 984 update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); 985 return; 986 } 987 988 verbose(VERB_ALGO, "successfully validated NODATA response."); 989 chase_reply->security = sec_status_secure; 990 } 991 992 /** 993 * Validate a NAMEERROR signed response -- a response that has a NXDOMAIN 994 * Rcode. 995 * This consists of making certain that the authority section NSEC proves 996 * that the qname doesn't exist and the covering wildcard also doesn't exist.. 997 * 998 * The answer and authority RRsets must have already been verified as secure. 999 * 1000 * @param env: module env for verify. 1001 * @param ve: validator env for verify. 1002 * @param qchase: query that was made. 1003 * @param chase_reply: answer to that query to validate. 1004 * @param kkey: the key entry, which is trusted, and which matches 1005 * the signer of the answer. The key entry isgood(). 1006 * @param rcode: adjusted RCODE, in case of RCODE/proof mismatch leniency. 1007 */ 1008 static void 1009 validate_nameerror_response(struct module_env* env, struct val_env* ve, 1010 struct query_info* qchase, struct reply_info* chase_reply, 1011 struct key_entry_key* kkey, int* rcode) 1012 { 1013 int has_valid_nsec = 0; 1014 int has_valid_wnsec = 0; 1015 int nsec3s_seen = 0; 1016 struct ub_packed_rrset_key* s; 1017 size_t i; 1018 uint8_t* ce; 1019 int ce_labs = 0; 1020 int prev_ce_labs = 0; 1021 1022 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 1023 chase_reply->ns_numrrsets; i++) { 1024 s = chase_reply->rrsets[i]; 1025 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 1026 if(val_nsec_proves_name_error(s, qchase->qname)) 1027 has_valid_nsec = 1; 1028 ce = nsec_closest_encloser(qchase->qname, s); 1029 ce_labs = dname_count_labels(ce); 1030 /* Use longest closest encloser to prove wildcard. */ 1031 if(ce_labs > prev_ce_labs || 1032 (ce_labs == prev_ce_labs && 1033 has_valid_wnsec == 0)) { 1034 if(val_nsec_proves_no_wc(s, qchase->qname, 1035 qchase->qname_len)) 1036 has_valid_wnsec = 1; 1037 else 1038 has_valid_wnsec = 0; 1039 } 1040 prev_ce_labs = ce_labs; 1041 if(val_nsec_proves_insecuredelegation(s, qchase)) { 1042 verbose(VERB_ALGO, "delegation is insecure"); 1043 chase_reply->security = sec_status_insecure; 1044 return; 1045 } 1046 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) 1047 nsec3s_seen = 1; 1048 } 1049 1050 if((!has_valid_nsec || !has_valid_wnsec) && nsec3s_seen) { 1051 /* use NSEC3 proof, both answer and auth rrsets, in case 1052 * NSEC3s end up in the answer (due to qtype=NSEC3 or so) */ 1053 chase_reply->security = nsec3_prove_nameerror(env, ve, 1054 chase_reply->rrsets, chase_reply->an_numrrsets+ 1055 chase_reply->ns_numrrsets, qchase, kkey); 1056 if(chase_reply->security != sec_status_secure) { 1057 verbose(VERB_QUERY, "NameError response failed nsec, " 1058 "nsec3 proof was %s", sec_status_to_string( 1059 chase_reply->security)); 1060 return; 1061 } 1062 has_valid_nsec = 1; 1063 has_valid_wnsec = 1; 1064 } 1065 1066 /* If the message fails to prove either condition, it is bogus. */ 1067 if(!has_valid_nsec) { 1068 verbose(VERB_QUERY, "NameError response has failed to prove: " 1069 "qname does not exist"); 1070 chase_reply->security = sec_status_bogus; 1071 update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); 1072 /* Be lenient with RCODE in NSEC NameError responses */ 1073 validate_nodata_response(env, ve, qchase, chase_reply, kkey); 1074 if (chase_reply->security == sec_status_secure) 1075 *rcode = LDNS_RCODE_NOERROR; 1076 return; 1077 } 1078 1079 if(!has_valid_wnsec) { 1080 verbose(VERB_QUERY, "NameError response has failed to prove: " 1081 "covering wildcard does not exist"); 1082 chase_reply->security = sec_status_bogus; 1083 update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); 1084 /* Be lenient with RCODE in NSEC NameError responses */ 1085 validate_nodata_response(env, ve, qchase, chase_reply, kkey); 1086 if (chase_reply->security == sec_status_secure) 1087 *rcode = LDNS_RCODE_NOERROR; 1088 return; 1089 } 1090 1091 /* Otherwise, we consider the message secure. */ 1092 verbose(VERB_ALGO, "successfully validated NAME ERROR response."); 1093 chase_reply->security = sec_status_secure; 1094 } 1095 1096 /** 1097 * Given a referral response, validate rrsets and take least trusted rrset 1098 * as the current validation status. 1099 * 1100 * Note that by the time this method is called, the process of finding the 1101 * trusted DNSKEY rrset that signs this response must already have been 1102 * completed. 1103 * 1104 * @param chase_reply: answer to validate. 1105 */ 1106 static void 1107 validate_referral_response(struct reply_info* chase_reply) 1108 { 1109 size_t i; 1110 enum sec_status s; 1111 /* message security equals lowest rrset security */ 1112 chase_reply->security = sec_status_secure; 1113 for(i=0; i<chase_reply->rrset_count; i++) { 1114 s = ((struct packed_rrset_data*)chase_reply->rrsets[i] 1115 ->entry.data)->security; 1116 if(s < chase_reply->security) 1117 chase_reply->security = s; 1118 } 1119 verbose(VERB_ALGO, "validated part of referral response as %s", 1120 sec_status_to_string(chase_reply->security)); 1121 } 1122 1123 /** 1124 * Given an "ANY" response -- a response that contains an answer to a 1125 * qtype==ANY question, with answers. This does no checking that all 1126 * types are present. 1127 * 1128 * NOTE: it may be possible to get parent-side delegation point records 1129 * here, which won't all be signed. Right now, this routine relies on the 1130 * upstream iterative resolver to not return these responses -- instead 1131 * treating them as referrals. 1132 * 1133 * NOTE: RFC 4035 is silent on this issue, so this may change upon 1134 * clarification. Clarification draft -05 says to not check all types are 1135 * present. 1136 * 1137 * Note that by the time this method is called, the process of finding the 1138 * trusted DNSKEY rrset that signs this response must already have been 1139 * completed. 1140 * 1141 * @param env: module env for verify. 1142 * @param ve: validator env for verify. 1143 * @param qchase: query that was made. 1144 * @param chase_reply: answer to that query to validate. 1145 * @param kkey: the key entry, which is trusted, and which matches 1146 * the signer of the answer. The key entry isgood(). 1147 */ 1148 static void 1149 validate_any_response(struct module_env* env, struct val_env* ve, 1150 struct query_info* qchase, struct reply_info* chase_reply, 1151 struct key_entry_key* kkey) 1152 { 1153 /* all answer and auth rrsets already verified */ 1154 /* but check if a wildcard response is given, then check NSEC/NSEC3 1155 * for qname denial to see if wildcard is applicable */ 1156 uint8_t* wc = NULL; 1157 size_t wl; 1158 int wc_NSEC_ok = 0; 1159 int nsec3s_seen = 0; 1160 size_t i; 1161 struct ub_packed_rrset_key* s; 1162 1163 if(qchase->qtype != LDNS_RR_TYPE_ANY) { 1164 log_err("internal error: ANY validation called for non-ANY"); 1165 chase_reply->security = sec_status_bogus; 1166 update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); 1167 return; 1168 } 1169 1170 /* validate the ANSWER section - this will be the answer itself */ 1171 for(i=0; i<chase_reply->an_numrrsets; i++) { 1172 s = chase_reply->rrsets[i]; 1173 1174 /* Check to see if the rrset is the result of a wildcard 1175 * expansion. If so, an additional check will need to be 1176 * made in the authority section. */ 1177 if(!val_rrset_wildcard(s, &wc, &wl)) { 1178 log_nametypeclass(VERB_QUERY, "Positive ANY response" 1179 " has inconsistent wildcard sigs:", 1180 s->rk.dname, ntohs(s->rk.type), 1181 ntohs(s->rk.rrset_class)); 1182 chase_reply->security = sec_status_bogus; 1183 update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); 1184 return; 1185 } 1186 } 1187 1188 /* if it was a wildcard, check for NSEC/NSEC3s in both answer 1189 * and authority sections (NSEC may be moved to the ANSWER section) */ 1190 if(wc != NULL) 1191 for(i=0; i<chase_reply->an_numrrsets+chase_reply->ns_numrrsets; 1192 i++) { 1193 s = chase_reply->rrsets[i]; 1194 1195 /* If this is a positive wildcard response, and we have a 1196 * (just verified) NSEC record, try to use it to 1) prove 1197 * that qname doesn't exist and 2) that the correct wildcard 1198 * was used. */ 1199 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 1200 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) { 1201 wc_NSEC_ok = 1; 1202 } 1203 /* if not, continue looking for proof */ 1204 } 1205 1206 /* Otherwise, if this is a positive wildcard response and 1207 * we have NSEC3 records */ 1208 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 1209 nsec3s_seen = 1; 1210 } 1211 } 1212 1213 /* If this was a positive wildcard response that we haven't already 1214 * proven, and we have NSEC3 records, try to prove it using the NSEC3 1215 * records. */ 1216 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) { 1217 /* look both in answer and auth section for NSEC3s */ 1218 enum sec_status sec = nsec3_prove_wildcard(env, ve, 1219 chase_reply->rrsets, 1220 chase_reply->an_numrrsets+chase_reply->ns_numrrsets, 1221 qchase, kkey, wc); 1222 if(sec == sec_status_insecure) { 1223 verbose(VERB_ALGO, "Positive ANY wildcard response is " 1224 "insecure"); 1225 chase_reply->security = sec_status_insecure; 1226 return; 1227 } else if(sec == sec_status_secure) 1228 wc_NSEC_ok = 1; 1229 } 1230 1231 /* If after all this, we still haven't proven the positive wildcard 1232 * response, fail. */ 1233 if(wc != NULL && !wc_NSEC_ok) { 1234 verbose(VERB_QUERY, "positive ANY response was wildcard " 1235 "expansion and did not prove original data " 1236 "did not exist"); 1237 chase_reply->security = sec_status_bogus; 1238 update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); 1239 return; 1240 } 1241 1242 verbose(VERB_ALGO, "Successfully validated positive ANY response"); 1243 chase_reply->security = sec_status_secure; 1244 } 1245 1246 /** 1247 * Validate CNAME response, or DNAME+CNAME. 1248 * This is just like a positive proof, except that this is about a 1249 * DNAME+CNAME. Possible wildcard proof. 1250 * Difference with positive proof is that this routine refuses 1251 * wildcarded DNAMEs. 1252 * 1253 * The answer and authority rrsets must already be verified as secure. 1254 * 1255 * @param env: module env for verify. 1256 * @param ve: validator env for verify. 1257 * @param qchase: query that was made. 1258 * @param chase_reply: answer to that query to validate. 1259 * @param kkey: the key entry, which is trusted, and which matches 1260 * the signer of the answer. The key entry isgood(). 1261 */ 1262 static void 1263 validate_cname_response(struct module_env* env, struct val_env* ve, 1264 struct query_info* qchase, struct reply_info* chase_reply, 1265 struct key_entry_key* kkey) 1266 { 1267 uint8_t* wc = NULL; 1268 size_t wl; 1269 int wc_NSEC_ok = 0; 1270 int nsec3s_seen = 0; 1271 size_t i; 1272 struct ub_packed_rrset_key* s; 1273 1274 /* validate the ANSWER section - this will be the CNAME (+DNAME) */ 1275 for(i=0; i<chase_reply->an_numrrsets; i++) { 1276 s = chase_reply->rrsets[i]; 1277 1278 /* Check to see if the rrset is the result of a wildcard 1279 * expansion. If so, an additional check will need to be 1280 * made in the authority section. */ 1281 if(!val_rrset_wildcard(s, &wc, &wl)) { 1282 log_nametypeclass(VERB_QUERY, "Cname response has " 1283 "inconsistent wildcard sigs:", s->rk.dname, 1284 ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 1285 chase_reply->security = sec_status_bogus; 1286 update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); 1287 return; 1288 } 1289 1290 /* Refuse wildcarded DNAMEs rfc 4597. 1291 * Do not follow a wildcarded DNAME because 1292 * its synthesized CNAME expansion is underdefined */ 1293 if(qchase->qtype != LDNS_RR_TYPE_DNAME && 1294 ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME && wc) { 1295 log_nametypeclass(VERB_QUERY, "cannot validate a " 1296 "wildcarded DNAME:", s->rk.dname, 1297 ntohs(s->rk.type), ntohs(s->rk.rrset_class)); 1298 chase_reply->security = sec_status_bogus; 1299 update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); 1300 return; 1301 } 1302 1303 /* If we have found a CNAME, stop looking for one. 1304 * The iterator has placed the CNAME chain in correct 1305 * order. */ 1306 if (ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) { 1307 break; 1308 } 1309 } 1310 1311 /* AUTHORITY section */ 1312 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 1313 chase_reply->ns_numrrsets; i++) { 1314 s = chase_reply->rrsets[i]; 1315 1316 /* If this is a positive wildcard response, and we have a 1317 * (just verified) NSEC record, try to use it to 1) prove 1318 * that qname doesn't exist and 2) that the correct wildcard 1319 * was used. */ 1320 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 1321 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) { 1322 wc_NSEC_ok = 1; 1323 } 1324 /* if not, continue looking for proof */ 1325 } 1326 1327 /* Otherwise, if this is a positive wildcard response and 1328 * we have NSEC3 records */ 1329 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 1330 nsec3s_seen = 1; 1331 } 1332 } 1333 1334 /* If this was a positive wildcard response that we haven't already 1335 * proven, and we have NSEC3 records, try to prove it using the NSEC3 1336 * records. */ 1337 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) { 1338 enum sec_status sec = nsec3_prove_wildcard(env, ve, 1339 chase_reply->rrsets+chase_reply->an_numrrsets, 1340 chase_reply->ns_numrrsets, qchase, kkey, wc); 1341 if(sec == sec_status_insecure) { 1342 verbose(VERB_ALGO, "wildcard CNAME response is " 1343 "insecure"); 1344 chase_reply->security = sec_status_insecure; 1345 return; 1346 } else if(sec == sec_status_secure) 1347 wc_NSEC_ok = 1; 1348 } 1349 1350 /* If after all this, we still haven't proven the positive wildcard 1351 * response, fail. */ 1352 if(wc != NULL && !wc_NSEC_ok) { 1353 verbose(VERB_QUERY, "CNAME response was wildcard " 1354 "expansion and did not prove original data " 1355 "did not exist"); 1356 chase_reply->security = sec_status_bogus; 1357 update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); 1358 return; 1359 } 1360 1361 verbose(VERB_ALGO, "Successfully validated CNAME response"); 1362 chase_reply->security = sec_status_secure; 1363 } 1364 1365 /** 1366 * Validate CNAME NOANSWER response, no more data after a CNAME chain. 1367 * This can be a NODATA or a NAME ERROR case, but not both at the same time. 1368 * We don't know because the rcode has been set to NOERROR by the CNAME. 1369 * 1370 * The answer and authority rrsets must already be verified as secure. 1371 * 1372 * @param env: module env for verify. 1373 * @param ve: validator env for verify. 1374 * @param qchase: query that was made. 1375 * @param chase_reply: answer to that query to validate. 1376 * @param kkey: the key entry, which is trusted, and which matches 1377 * the signer of the answer. The key entry isgood(). 1378 */ 1379 static void 1380 validate_cname_noanswer_response(struct module_env* env, struct val_env* ve, 1381 struct query_info* qchase, struct reply_info* chase_reply, 1382 struct key_entry_key* kkey) 1383 { 1384 int nodata_valid_nsec = 0; /* If true, then NODATA has been proven.*/ 1385 uint8_t* ce = NULL; /* for wildcard nodata responses. This is the 1386 proven closest encloser. */ 1387 uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */ 1388 int nxdomain_valid_nsec = 0; /* if true, nameerror has been proven */ 1389 int nxdomain_valid_wnsec = 0; 1390 int nsec3s_seen = 0; /* nsec3s seen */ 1391 struct ub_packed_rrset_key* s; 1392 size_t i; 1393 uint8_t* nsec_ce; /* Used to find the NSEC with the longest ce */ 1394 int ce_labs = 0; 1395 int prev_ce_labs = 0; 1396 1397 /* the AUTHORITY section */ 1398 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+ 1399 chase_reply->ns_numrrsets; i++) { 1400 s = chase_reply->rrsets[i]; 1401 1402 /* If we encounter an NSEC record, try to use it to prove 1403 * NODATA. This needs to handle the ENT NODATA case. 1404 * Also try to prove NAMEERROR, and absence of a wildcard */ 1405 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) { 1406 if(nsec_proves_nodata(s, qchase, &wc)) { 1407 nodata_valid_nsec = 1; 1408 /* set wc encloser if wildcard applicable */ 1409 } 1410 if(val_nsec_proves_name_error(s, qchase->qname)) { 1411 ce = nsec_closest_encloser(qchase->qname, s); 1412 nxdomain_valid_nsec = 1; 1413 } 1414 nsec_ce = nsec_closest_encloser(qchase->qname, s); 1415 ce_labs = dname_count_labels(nsec_ce); 1416 /* Use longest closest encloser to prove wildcard. */ 1417 if(ce_labs > prev_ce_labs || 1418 (ce_labs == prev_ce_labs && 1419 nxdomain_valid_wnsec == 0)) { 1420 if(val_nsec_proves_no_wc(s, qchase->qname, 1421 qchase->qname_len)) 1422 nxdomain_valid_wnsec = 1; 1423 else 1424 nxdomain_valid_wnsec = 0; 1425 } 1426 prev_ce_labs = ce_labs; 1427 if(val_nsec_proves_insecuredelegation(s, qchase)) { 1428 verbose(VERB_ALGO, "delegation is insecure"); 1429 chase_reply->security = sec_status_insecure; 1430 return; 1431 } 1432 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) { 1433 nsec3s_seen = 1; 1434 } 1435 } 1436 1437 /* check to see if we have a wildcard NODATA proof. */ 1438 1439 /* The wildcard NODATA is 1 NSEC proving that qname does not exists 1440 * (and also proving what the closest encloser is), and 1 NSEC 1441 * showing the matching wildcard, which must be *.closest_encloser. */ 1442 if(wc && !ce) 1443 nodata_valid_nsec = 0; 1444 else if(wc && ce) { 1445 if(query_dname_compare(wc, ce) != 0) { 1446 nodata_valid_nsec = 0; 1447 } 1448 } 1449 if(nxdomain_valid_nsec && !nxdomain_valid_wnsec) { 1450 /* name error is missing wildcard denial proof */ 1451 nxdomain_valid_nsec = 0; 1452 } 1453 1454 if(nodata_valid_nsec && nxdomain_valid_nsec) { 1455 verbose(VERB_QUERY, "CNAMEchain to noanswer proves that name " 1456 "exists and not exists, bogus"); 1457 chase_reply->security = sec_status_bogus; 1458 update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); 1459 return; 1460 } 1461 if(!nodata_valid_nsec && !nxdomain_valid_nsec && nsec3s_seen) { 1462 int nodata; 1463 enum sec_status sec = nsec3_prove_nxornodata(env, ve, 1464 chase_reply->rrsets+chase_reply->an_numrrsets, 1465 chase_reply->ns_numrrsets, qchase, kkey, &nodata); 1466 if(sec == sec_status_insecure) { 1467 verbose(VERB_ALGO, "CNAMEchain to noanswer response " 1468 "is insecure"); 1469 chase_reply->security = sec_status_insecure; 1470 return; 1471 } else if(sec == sec_status_secure) { 1472 if(nodata) 1473 nodata_valid_nsec = 1; 1474 else nxdomain_valid_nsec = 1; 1475 } 1476 } 1477 1478 if(!nodata_valid_nsec && !nxdomain_valid_nsec) { 1479 verbose(VERB_QUERY, "CNAMEchain to noanswer response failed " 1480 "to prove status with NSEC/NSEC3"); 1481 if(verbosity >= VERB_ALGO) 1482 log_dns_msg("Failed CNAMEnoanswer", qchase, chase_reply); 1483 chase_reply->security = sec_status_bogus; 1484 update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); 1485 return; 1486 } 1487 1488 if(nodata_valid_nsec) 1489 verbose(VERB_ALGO, "successfully validated CNAME chain to a " 1490 "NODATA response."); 1491 else verbose(VERB_ALGO, "successfully validated CNAME chain to a " 1492 "NAMEERROR response."); 1493 chase_reply->security = sec_status_secure; 1494 } 1495 1496 /** 1497 * Process init state for validator. 1498 * Process the INIT state. First tier responses start in the INIT state. 1499 * This is where they are vetted for validation suitability, and the initial 1500 * key search is done. 1501 * 1502 * Currently, events the come through this routine will be either promoted 1503 * to FINISHED/CNAME_RESP (no validation needed), FINDKEY (next step to 1504 * validation), or will be (temporarily) retired and a new priming request 1505 * event will be generated. 1506 * 1507 * @param qstate: query state. 1508 * @param vq: validator query state. 1509 * @param ve: validator shared global environment. 1510 * @param id: module id. 1511 * @return true if the event should be processed further on return, false if 1512 * not. 1513 */ 1514 static int 1515 processInit(struct module_qstate* qstate, struct val_qstate* vq, 1516 struct val_env* ve, int id) 1517 { 1518 uint8_t* lookup_name; 1519 size_t lookup_len; 1520 struct trust_anchor* anchor; 1521 enum val_classification subtype = val_classify_response( 1522 qstate->query_flags, &qstate->qinfo, &vq->qchase, 1523 vq->orig_msg->rep, vq->rrset_skip); 1524 if(vq->restart_count > ve->max_restart) { 1525 verbose(VERB_ALGO, "restart count exceeded"); 1526 return val_error(qstate, id); 1527 } 1528 1529 /* correctly initialize reason_bogus */ 1530 update_reason_bogus(vq->chase_reply, LDNS_EDE_DNSSEC_BOGUS); 1531 1532 verbose(VERB_ALGO, "validator classification %s", 1533 val_classification_to_string(subtype)); 1534 if(subtype == VAL_CLASS_REFERRAL && 1535 vq->rrset_skip < vq->orig_msg->rep->rrset_count) { 1536 /* referral uses the rrset name as qchase, to find keys for 1537 * that rrset */ 1538 vq->qchase.qname = vq->orig_msg->rep-> 1539 rrsets[vq->rrset_skip]->rk.dname; 1540 vq->qchase.qname_len = vq->orig_msg->rep-> 1541 rrsets[vq->rrset_skip]->rk.dname_len; 1542 vq->qchase.qtype = ntohs(vq->orig_msg->rep-> 1543 rrsets[vq->rrset_skip]->rk.type); 1544 vq->qchase.qclass = ntohs(vq->orig_msg->rep-> 1545 rrsets[vq->rrset_skip]->rk.rrset_class); 1546 } 1547 lookup_name = vq->qchase.qname; 1548 lookup_len = vq->qchase.qname_len; 1549 /* for type DS look at the parent side for keys/trustanchor */ 1550 /* also for NSEC not at apex */ 1551 if(vq->qchase.qtype == LDNS_RR_TYPE_DS || 1552 (vq->qchase.qtype == LDNS_RR_TYPE_NSEC && 1553 vq->orig_msg->rep->rrset_count > vq->rrset_skip && 1554 ntohs(vq->orig_msg->rep->rrsets[vq->rrset_skip]->rk.type) == 1555 LDNS_RR_TYPE_NSEC && 1556 !(vq->orig_msg->rep->rrsets[vq->rrset_skip]-> 1557 rk.flags&PACKED_RRSET_NSEC_AT_APEX))) { 1558 dname_remove_label(&lookup_name, &lookup_len); 1559 } 1560 1561 val_mark_indeterminate(vq->chase_reply, qstate->env->anchors, 1562 qstate->env->rrset_cache, qstate->env); 1563 vq->key_entry = NULL; 1564 vq->empty_DS_name = NULL; 1565 vq->ds_rrset = 0; 1566 anchor = anchors_lookup(qstate->env->anchors, 1567 lookup_name, lookup_len, vq->qchase.qclass); 1568 1569 /* Determine the signer/lookup name */ 1570 val_find_signer(subtype, &vq->qchase, vq->orig_msg->rep, 1571 vq->rrset_skip, &vq->signer_name, &vq->signer_len); 1572 if(vq->signer_name != NULL && 1573 !dname_subdomain_c(lookup_name, vq->signer_name)) { 1574 log_nametypeclass(VERB_ALGO, "this signer name is not a parent " 1575 "of lookupname, omitted", vq->signer_name, 0, 0); 1576 vq->signer_name = NULL; 1577 } 1578 if(vq->signer_name == NULL) { 1579 log_nametypeclass(VERB_ALGO, "no signer, using", lookup_name, 1580 0, 0); 1581 } else { 1582 lookup_name = vq->signer_name; 1583 lookup_len = vq->signer_len; 1584 log_nametypeclass(VERB_ALGO, "signer is", lookup_name, 0, 0); 1585 } 1586 1587 /* for NXDOMAIN it could be signed by a parent of the trust anchor */ 1588 if(subtype == VAL_CLASS_NAMEERROR && vq->signer_name && 1589 anchor && dname_strict_subdomain_c(anchor->name, lookup_name)){ 1590 lock_basic_unlock(&anchor->lock); 1591 anchor = anchors_lookup(qstate->env->anchors, 1592 lookup_name, lookup_len, vq->qchase.qclass); 1593 if(!anchor) { /* unsigned parent denies anchor*/ 1594 verbose(VERB_QUERY, "unsigned parent zone denies" 1595 " trust anchor, indeterminate"); 1596 vq->chase_reply->security = sec_status_indeterminate; 1597 update_reason_bogus(vq->chase_reply, LDNS_EDE_DNSSEC_INDETERMINATE); 1598 vq->state = VAL_FINISHED_STATE; 1599 return 1; 1600 } 1601 verbose(VERB_ALGO, "trust anchor NXDOMAIN by signed parent"); 1602 } else if(subtype == VAL_CLASS_POSITIVE && 1603 qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY && 1604 query_dname_compare(lookup_name, qstate->qinfo.qname) == 0) { 1605 /* is a DNSKEY so lookup a bit higher since we want to 1606 * get it from a parent or from trustanchor */ 1607 dname_remove_label(&lookup_name, &lookup_len); 1608 } 1609 1610 if(vq->rrset_skip > 0 || subtype == VAL_CLASS_CNAME || 1611 subtype == VAL_CLASS_REFERRAL) { 1612 /* extract this part of orig_msg into chase_reply for 1613 * the eventual VALIDATE stage */ 1614 val_fill_reply(vq->chase_reply, vq->orig_msg->rep, 1615 vq->rrset_skip, lookup_name, lookup_len, 1616 vq->signer_name); 1617 if(verbosity >= VERB_ALGO) 1618 log_dns_msg("chased extract", &vq->qchase, 1619 vq->chase_reply); 1620 } 1621 1622 vq->key_entry = key_cache_obtain(ve->kcache, lookup_name, lookup_len, 1623 vq->qchase.qclass, qstate->region, *qstate->env->now); 1624 1625 /* there is no key and no trust anchor */ 1626 if(vq->key_entry == NULL && anchor == NULL) { 1627 /*response isn't under a trust anchor, so we cannot validate.*/ 1628 vq->chase_reply->security = sec_status_indeterminate; 1629 update_reason_bogus(vq->chase_reply, LDNS_EDE_DNSSEC_INDETERMINATE); 1630 /* go to finished state to cache this result */ 1631 vq->state = VAL_FINISHED_STATE; 1632 return 1; 1633 } 1634 /* if not key, or if keyentry is *above* the trustanchor, i.e. 1635 * the keyentry is based on another (higher) trustanchor */ 1636 else if(vq->key_entry == NULL || (anchor && 1637 dname_strict_subdomain_c(anchor->name, vq->key_entry->name))) { 1638 /* trust anchor is an 'unsigned' trust anchor */ 1639 if(anchor && anchor->numDS == 0 && anchor->numDNSKEY == 0) { 1640 vq->chase_reply->security = sec_status_insecure; 1641 val_mark_insecure(vq->chase_reply, anchor->name, 1642 qstate->env->rrset_cache, qstate->env); 1643 lock_basic_unlock(&anchor->lock); 1644 /* go to finished state to cache this result */ 1645 vq->state = VAL_FINISHED_STATE; 1646 return 1; 1647 } 1648 /* fire off a trust anchor priming query. */ 1649 verbose(VERB_DETAIL, "prime trust anchor"); 1650 if(!prime_trust_anchor(qstate, vq, id, anchor)) { 1651 lock_basic_unlock(&anchor->lock); 1652 return val_error(qstate, id); 1653 } 1654 lock_basic_unlock(&anchor->lock); 1655 /* and otherwise, don't continue processing this event. 1656 * (it will be reactivated when the priming query returns). */ 1657 vq->state = VAL_FINDKEY_STATE; 1658 return 0; 1659 } 1660 if(anchor) { 1661 lock_basic_unlock(&anchor->lock); 1662 } 1663 1664 if(key_entry_isnull(vq->key_entry)) { 1665 /* response is under a null key, so we cannot validate 1666 * However, we do set the status to INSECURE, since it is 1667 * essentially proven insecure. */ 1668 vq->chase_reply->security = sec_status_insecure; 1669 val_mark_insecure(vq->chase_reply, vq->key_entry->name, 1670 qstate->env->rrset_cache, qstate->env); 1671 /* go to finished state to cache this result */ 1672 vq->state = VAL_FINISHED_STATE; 1673 return 1; 1674 } else if(key_entry_isbad(vq->key_entry)) { 1675 /* Bad keys should have the relevant EDE code and text */ 1676 sldns_ede_code ede = key_entry_get_reason_bogus(vq->key_entry); 1677 /* key is bad, chain is bad, reply is bogus */ 1678 errinf_dname(qstate, "key for validation", vq->key_entry->name); 1679 errinf_ede(qstate, "is marked as invalid", ede); 1680 errinf(qstate, "because of a previous"); 1681 errinf(qstate, key_entry_get_reason(vq->key_entry)); 1682 1683 /* no retries, stop bothering the authority until timeout */ 1684 vq->restart_count = ve->max_restart; 1685 vq->chase_reply->security = sec_status_bogus; 1686 update_reason_bogus(vq->chase_reply, ede); 1687 vq->state = VAL_FINISHED_STATE; 1688 return 1; 1689 } 1690 1691 /* otherwise, we have our "closest" cached key -- continue 1692 * processing in the next state. */ 1693 vq->state = VAL_FINDKEY_STATE; 1694 return 1; 1695 } 1696 1697 /** 1698 * Process the FINDKEY state. Generally this just calculates the next name 1699 * to query and either issues a DS or a DNSKEY query. It will check to see 1700 * if the correct key has already been reached, in which case it will 1701 * advance the event to the next state. 1702 * 1703 * @param qstate: query state. 1704 * @param vq: validator query state. 1705 * @param id: module id. 1706 * @return true if the event should be processed further on return, false if 1707 * not. 1708 */ 1709 static int 1710 processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id) 1711 { 1712 uint8_t* target_key_name, *current_key_name; 1713 size_t target_key_len; 1714 int strip_lab; 1715 struct module_qstate* newq = NULL; 1716 1717 log_query_info(VERB_ALGO, "validator: FindKey", &vq->qchase); 1718 /* We know that state.key_entry is not 0 or bad key -- if it were, 1719 * then previous processing should have directed this event to 1720 * a different state. 1721 * It could be an isnull key, which signals the DNSKEY failed 1722 * with retry and has to be looked up again. */ 1723 log_assert(vq->key_entry && !key_entry_isbad(vq->key_entry)); 1724 if(key_entry_isnull(vq->key_entry)) { 1725 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 1726 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 1727 vq->qchase.qclass, BIT_CD, &newq, 0)) { 1728 verbose(VERB_ALGO, "error generating DNSKEY request"); 1729 return val_error(qstate, id); 1730 } 1731 return 0; 1732 } 1733 1734 target_key_name = vq->signer_name; 1735 target_key_len = vq->signer_len; 1736 if(!target_key_name) { 1737 target_key_name = vq->qchase.qname; 1738 target_key_len = vq->qchase.qname_len; 1739 } 1740 1741 current_key_name = vq->key_entry->name; 1742 1743 /* If our current key entry matches our target, then we are done. */ 1744 if(query_dname_compare(target_key_name, current_key_name) == 0) { 1745 vq->state = VAL_VALIDATE_STATE; 1746 return 1; 1747 } 1748 1749 if(vq->empty_DS_name) { 1750 /* if the last empty nonterminal/emptyDS name we detected is 1751 * below the current key, use that name to make progress 1752 * along the chain of trust */ 1753 if(query_dname_compare(target_key_name, 1754 vq->empty_DS_name) == 0) { 1755 /* do not query for empty_DS_name again */ 1756 verbose(VERB_ALGO, "Cannot retrieve DS for signature"); 1757 errinf_ede(qstate, "no signatures", LDNS_EDE_RRSIGS_MISSING); 1758 errinf_origin(qstate, qstate->reply_origin); 1759 vq->chase_reply->security = sec_status_bogus; 1760 update_reason_bogus(vq->chase_reply, LDNS_EDE_RRSIGS_MISSING); 1761 vq->state = VAL_FINISHED_STATE; 1762 return 1; 1763 } 1764 current_key_name = vq->empty_DS_name; 1765 } 1766 1767 log_nametypeclass(VERB_ALGO, "current keyname", current_key_name, 1768 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN); 1769 log_nametypeclass(VERB_ALGO, "target keyname", target_key_name, 1770 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN); 1771 /* assert we are walking down the DNS tree */ 1772 if(!dname_subdomain_c(target_key_name, current_key_name)) { 1773 verbose(VERB_ALGO, "bad signer name"); 1774 vq->chase_reply->security = sec_status_bogus; 1775 vq->state = VAL_FINISHED_STATE; 1776 return 1; 1777 } 1778 /* so this value is >= -1 */ 1779 strip_lab = dname_count_labels(target_key_name) - 1780 dname_count_labels(current_key_name) - 1; 1781 log_assert(strip_lab >= -1); 1782 verbose(VERB_ALGO, "striplab %d", strip_lab); 1783 if(strip_lab > 0) { 1784 dname_remove_labels(&target_key_name, &target_key_len, 1785 strip_lab); 1786 } 1787 log_nametypeclass(VERB_ALGO, "next keyname", target_key_name, 1788 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN); 1789 1790 /* The next step is either to query for the next DS, or to query 1791 * for the next DNSKEY. */ 1792 if(vq->ds_rrset) 1793 log_nametypeclass(VERB_ALGO, "DS RRset", vq->ds_rrset->rk.dname, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN); 1794 else verbose(VERB_ALGO, "No DS RRset"); 1795 1796 if(vq->ds_rrset && query_dname_compare(vq->ds_rrset->rk.dname, 1797 vq->key_entry->name) != 0) { 1798 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 1799 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 1800 vq->qchase.qclass, BIT_CD, &newq, 0)) { 1801 verbose(VERB_ALGO, "error generating DNSKEY request"); 1802 return val_error(qstate, id); 1803 } 1804 return 0; 1805 } 1806 1807 if(!vq->ds_rrset || query_dname_compare(vq->ds_rrset->rk.dname, 1808 target_key_name) != 0) { 1809 /* check if there is a cache entry : pick up an NSEC if 1810 * there is no DS, check if that NSEC has DS-bit unset, and 1811 * thus can disprove the secure delegation we seek. 1812 * We can then use that NSEC even in the absence of a SOA 1813 * record that would be required by the iterator to supply 1814 * a completely protocol-correct response. 1815 * Uses negative cache for NSEC3 lookup of DS responses. */ 1816 /* only if cache not blacklisted, of course */ 1817 struct dns_msg* msg; 1818 if(!qstate->blacklist && !vq->chain_blacklist && 1819 (msg=val_find_DS(qstate->env, target_key_name, 1820 target_key_len, vq->qchase.qclass, qstate->region, 1821 vq->key_entry->name)) ) { 1822 verbose(VERB_ALGO, "Process cached DS response"); 1823 process_ds_response(qstate, vq, id, LDNS_RCODE_NOERROR, 1824 msg, &msg->qinfo, NULL); 1825 return 1; /* continue processing ds-response results */ 1826 } 1827 if(!generate_request(qstate, id, target_key_name, 1828 target_key_len, LDNS_RR_TYPE_DS, vq->qchase.qclass, 1829 BIT_CD, &newq, 0)) { 1830 verbose(VERB_ALGO, "error generating DS request"); 1831 return val_error(qstate, id); 1832 } 1833 return 0; 1834 } 1835 1836 /* Otherwise, it is time to query for the DNSKEY */ 1837 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname, 1838 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY, 1839 vq->qchase.qclass, BIT_CD, &newq, 0)) { 1840 verbose(VERB_ALGO, "error generating DNSKEY request"); 1841 return val_error(qstate, id); 1842 } 1843 1844 return 0; 1845 } 1846 1847 /** 1848 * Process the VALIDATE stage, the init and findkey stages are finished, 1849 * and the right keys are available to validate the response. 1850 * Or, there are no keys available, in order to invalidate the response. 1851 * 1852 * After validation, the status is recorded in the message and rrsets, 1853 * and finished state is started. 1854 * 1855 * @param qstate: query state. 1856 * @param vq: validator query state. 1857 * @param ve: validator shared global environment. 1858 * @param id: module id. 1859 * @return true if the event should be processed further on return, false if 1860 * not. 1861 */ 1862 static int 1863 processValidate(struct module_qstate* qstate, struct val_qstate* vq, 1864 struct val_env* ve, int id) 1865 { 1866 enum val_classification subtype; 1867 int rcode; 1868 1869 if(!vq->key_entry) { 1870 verbose(VERB_ALGO, "validate: no key entry, failed"); 1871 return val_error(qstate, id); 1872 } 1873 1874 /* This is the default next state. */ 1875 vq->state = VAL_FINISHED_STATE; 1876 1877 /* Unsigned responses must be underneath a "null" key entry.*/ 1878 if(key_entry_isnull(vq->key_entry)) { 1879 verbose(VERB_DETAIL, "Verified that %sresponse is INSECURE", 1880 vq->signer_name?"":"unsigned "); 1881 vq->chase_reply->security = sec_status_insecure; 1882 val_mark_insecure(vq->chase_reply, vq->key_entry->name, 1883 qstate->env->rrset_cache, qstate->env); 1884 key_cache_insert(ve->kcache, vq->key_entry, 1885 qstate->env->cfg->val_log_level >= 2); 1886 return 1; 1887 } 1888 1889 if(key_entry_isbad(vq->key_entry)) { 1890 log_nametypeclass(VERB_DETAIL, "Could not establish a chain " 1891 "of trust to keys for", vq->key_entry->name, 1892 LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class); 1893 vq->chase_reply->security = sec_status_bogus; 1894 update_reason_bogus(vq->chase_reply, 1895 key_entry_get_reason_bogus(vq->key_entry)); 1896 errinf_ede(qstate, "while building chain of trust", 1897 key_entry_get_reason_bogus(vq->key_entry)); 1898 if(vq->restart_count >= ve->max_restart) 1899 key_cache_insert(ve->kcache, vq->key_entry, 1900 qstate->env->cfg->val_log_level >= 2); 1901 return 1; 1902 } 1903 1904 /* signerName being null is the indicator that this response was 1905 * unsigned */ 1906 if(vq->signer_name == NULL) { 1907 log_query_info(VERB_ALGO, "processValidate: state has no " 1908 "signer name", &vq->qchase); 1909 verbose(VERB_DETAIL, "Could not establish validation of " 1910 "INSECURE status of unsigned response."); 1911 errinf_ede(qstate, "no signatures", LDNS_EDE_RRSIGS_MISSING); 1912 errinf_origin(qstate, qstate->reply_origin); 1913 vq->chase_reply->security = sec_status_bogus; 1914 update_reason_bogus(vq->chase_reply, LDNS_EDE_RRSIGS_MISSING); 1915 return 1; 1916 } 1917 subtype = val_classify_response(qstate->query_flags, &qstate->qinfo, 1918 &vq->qchase, vq->orig_msg->rep, vq->rrset_skip); 1919 if(subtype != VAL_CLASS_REFERRAL) 1920 remove_spurious_authority(vq->chase_reply, vq->orig_msg->rep); 1921 1922 /* check signatures in the message; 1923 * answer and authority must be valid, additional is only checked. */ 1924 if(!validate_msg_signatures(qstate, qstate->env, ve, &vq->qchase, 1925 vq->chase_reply, vq->key_entry)) { 1926 /* workaround bad recursor out there that truncates (even 1927 * with EDNS4k) to 512 by removing RRSIG from auth section 1928 * for positive replies*/ 1929 if((subtype == VAL_CLASS_POSITIVE || subtype == VAL_CLASS_ANY 1930 || subtype == VAL_CLASS_CNAME) && 1931 detect_wrongly_truncated(vq->orig_msg->rep)) { 1932 /* truncate the message some more */ 1933 vq->orig_msg->rep->ns_numrrsets = 0; 1934 vq->orig_msg->rep->ar_numrrsets = 0; 1935 vq->orig_msg->rep->rrset_count = 1936 vq->orig_msg->rep->an_numrrsets; 1937 vq->chase_reply->ns_numrrsets = 0; 1938 vq->chase_reply->ar_numrrsets = 0; 1939 vq->chase_reply->rrset_count = 1940 vq->chase_reply->an_numrrsets; 1941 qstate->errinf = NULL; 1942 } 1943 else { 1944 verbose(VERB_DETAIL, "Validate: message contains " 1945 "bad rrsets"); 1946 return 1; 1947 } 1948 } 1949 1950 switch(subtype) { 1951 case VAL_CLASS_POSITIVE: 1952 verbose(VERB_ALGO, "Validating a positive response"); 1953 validate_positive_response(qstate->env, ve, 1954 &vq->qchase, vq->chase_reply, vq->key_entry); 1955 verbose(VERB_DETAIL, "validate(positive): %s", 1956 sec_status_to_string( 1957 vq->chase_reply->security)); 1958 break; 1959 1960 case VAL_CLASS_NODATA: 1961 verbose(VERB_ALGO, "Validating a nodata response"); 1962 validate_nodata_response(qstate->env, ve, 1963 &vq->qchase, vq->chase_reply, vq->key_entry); 1964 verbose(VERB_DETAIL, "validate(nodata): %s", 1965 sec_status_to_string( 1966 vq->chase_reply->security)); 1967 break; 1968 1969 case VAL_CLASS_NAMEERROR: 1970 rcode = (int)FLAGS_GET_RCODE(vq->orig_msg->rep->flags); 1971 verbose(VERB_ALGO, "Validating a nxdomain response"); 1972 validate_nameerror_response(qstate->env, ve, 1973 &vq->qchase, vq->chase_reply, vq->key_entry, &rcode); 1974 verbose(VERB_DETAIL, "validate(nxdomain): %s", 1975 sec_status_to_string( 1976 vq->chase_reply->security)); 1977 FLAGS_SET_RCODE(vq->orig_msg->rep->flags, rcode); 1978 FLAGS_SET_RCODE(vq->chase_reply->flags, rcode); 1979 break; 1980 1981 case VAL_CLASS_CNAME: 1982 verbose(VERB_ALGO, "Validating a cname response"); 1983 validate_cname_response(qstate->env, ve, 1984 &vq->qchase, vq->chase_reply, vq->key_entry); 1985 verbose(VERB_DETAIL, "validate(cname): %s", 1986 sec_status_to_string( 1987 vq->chase_reply->security)); 1988 break; 1989 1990 case VAL_CLASS_CNAMENOANSWER: 1991 verbose(VERB_ALGO, "Validating a cname noanswer " 1992 "response"); 1993 validate_cname_noanswer_response(qstate->env, ve, 1994 &vq->qchase, vq->chase_reply, vq->key_entry); 1995 verbose(VERB_DETAIL, "validate(cname_noanswer): %s", 1996 sec_status_to_string( 1997 vq->chase_reply->security)); 1998 break; 1999 2000 case VAL_CLASS_REFERRAL: 2001 verbose(VERB_ALGO, "Validating a referral response"); 2002 validate_referral_response(vq->chase_reply); 2003 verbose(VERB_DETAIL, "validate(referral): %s", 2004 sec_status_to_string( 2005 vq->chase_reply->security)); 2006 break; 2007 2008 case VAL_CLASS_ANY: 2009 verbose(VERB_ALGO, "Validating a positive ANY " 2010 "response"); 2011 validate_any_response(qstate->env, ve, &vq->qchase, 2012 vq->chase_reply, vq->key_entry); 2013 verbose(VERB_DETAIL, "validate(positive_any): %s", 2014 sec_status_to_string( 2015 vq->chase_reply->security)); 2016 break; 2017 2018 default: 2019 log_err("validate: unhandled response subtype: %d", 2020 subtype); 2021 } 2022 if(vq->chase_reply->security == sec_status_bogus) { 2023 if(subtype == VAL_CLASS_POSITIVE) 2024 errinf(qstate, "wildcard"); 2025 else errinf(qstate, val_classification_to_string(subtype)); 2026 errinf(qstate, "proof failed"); 2027 errinf_origin(qstate, qstate->reply_origin); 2028 } 2029 2030 return 1; 2031 } 2032 2033 /** 2034 * The Finished state. The validation status (good or bad) has been determined. 2035 * 2036 * @param qstate: query state. 2037 * @param vq: validator query state. 2038 * @param ve: validator shared global environment. 2039 * @param id: module id. 2040 * @return true if the event should be processed further on return, false if 2041 * not. 2042 */ 2043 static int 2044 processFinished(struct module_qstate* qstate, struct val_qstate* vq, 2045 struct val_env* ve, int id) 2046 { 2047 enum val_classification subtype = val_classify_response( 2048 qstate->query_flags, &qstate->qinfo, &vq->qchase, 2049 vq->orig_msg->rep, vq->rrset_skip); 2050 2051 /* store overall validation result in orig_msg */ 2052 if(vq->rrset_skip == 0) { 2053 vq->orig_msg->rep->security = vq->chase_reply->security; 2054 update_reason_bogus(vq->orig_msg->rep, vq->chase_reply->reason_bogus); 2055 } else if(subtype != VAL_CLASS_REFERRAL || 2056 vq->rrset_skip < vq->orig_msg->rep->an_numrrsets + 2057 vq->orig_msg->rep->ns_numrrsets) { 2058 /* ignore sec status of additional section if a referral 2059 * type message skips there and 2060 * use the lowest security status as end result. */ 2061 if(vq->chase_reply->security < vq->orig_msg->rep->security) { 2062 vq->orig_msg->rep->security = 2063 vq->chase_reply->security; 2064 update_reason_bogus(vq->orig_msg->rep, vq->chase_reply->reason_bogus); 2065 } 2066 } 2067 2068 if(subtype == VAL_CLASS_REFERRAL) { 2069 /* for a referral, move to next unchecked rrset and check it*/ 2070 vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep, 2071 vq->rrset_skip); 2072 if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) { 2073 /* and restart for this rrset */ 2074 verbose(VERB_ALGO, "validator: go to next rrset"); 2075 vq->chase_reply->security = sec_status_unchecked; 2076 vq->state = VAL_INIT_STATE; 2077 return 1; 2078 } 2079 /* referral chase is done */ 2080 } 2081 if(vq->chase_reply->security != sec_status_bogus && 2082 subtype == VAL_CLASS_CNAME) { 2083 /* chase the CNAME; process next part of the message */ 2084 if(!val_chase_cname(&vq->qchase, vq->orig_msg->rep, 2085 &vq->rrset_skip)) { 2086 verbose(VERB_ALGO, "validator: failed to chase CNAME"); 2087 vq->orig_msg->rep->security = sec_status_bogus; 2088 update_reason_bogus(vq->orig_msg->rep, LDNS_EDE_DNSSEC_BOGUS); 2089 } else { 2090 /* restart process for new qchase at rrset_skip */ 2091 log_query_info(VERB_ALGO, "validator: chased to", 2092 &vq->qchase); 2093 vq->chase_reply->security = sec_status_unchecked; 2094 vq->state = VAL_INIT_STATE; 2095 return 1; 2096 } 2097 } 2098 2099 if(vq->orig_msg->rep->security == sec_status_secure) { 2100 /* If the message is secure, check that all rrsets are 2101 * secure (i.e. some inserted RRset for CNAME chain with 2102 * a different signer name). And drop additional rrsets 2103 * that are not secure (if clean-additional option is set) */ 2104 /* this may cause the msg to be marked bogus */ 2105 val_check_nonsecure(qstate->env, vq->orig_msg->rep); 2106 if(vq->orig_msg->rep->security == sec_status_secure) { 2107 log_query_info(VERB_DETAIL, "validation success", 2108 &qstate->qinfo); 2109 if(!qstate->no_cache_store) { 2110 val_neg_addreply(qstate->env->neg_cache, 2111 vq->orig_msg->rep); 2112 } 2113 } 2114 } 2115 2116 /* if the result is bogus - set message ttl to bogus ttl to avoid 2117 * endless bogus revalidation */ 2118 if(vq->orig_msg->rep->security == sec_status_bogus) { 2119 /* see if we can try again to fetch data */ 2120 if(vq->restart_count < ve->max_restart) { 2121 int restart_count = vq->restart_count+1; 2122 verbose(VERB_ALGO, "validation failed, " 2123 "blacklist and retry to fetch data"); 2124 val_blacklist(&qstate->blacklist, qstate->region, 2125 qstate->reply_origin, 0); 2126 qstate->reply_origin = NULL; 2127 qstate->errinf = NULL; 2128 memset(vq, 0, sizeof(*vq)); 2129 vq->restart_count = restart_count; 2130 vq->state = VAL_INIT_STATE; 2131 verbose(VERB_ALGO, "pass back to next module"); 2132 qstate->ext_state[id] = module_restart_next; 2133 return 0; 2134 } 2135 2136 vq->orig_msg->rep->ttl = ve->bogus_ttl; 2137 vq->orig_msg->rep->prefetch_ttl = 2138 PREFETCH_TTL_CALC(vq->orig_msg->rep->ttl); 2139 vq->orig_msg->rep->serve_expired_ttl = 2140 vq->orig_msg->rep->ttl + qstate->env->cfg->serve_expired_ttl; 2141 if((qstate->env->cfg->val_log_level >= 1 || 2142 qstate->env->cfg->log_servfail) && 2143 !qstate->env->cfg->val_log_squelch) { 2144 if(qstate->env->cfg->val_log_level < 2 && 2145 !qstate->env->cfg->log_servfail) 2146 log_query_info(NO_VERBOSE, "validation failure", 2147 &qstate->qinfo); 2148 else { 2149 char* err_str = errinf_to_str_bogus(qstate); 2150 if(err_str) { 2151 size_t err_str_len = strlen(err_str); 2152 log_info("%s", err_str); 2153 /* allocate space and store the error 2154 * string */ 2155 vq->orig_msg->rep->reason_bogus_str = regional_alloc( 2156 qstate->region, 2157 sizeof(char) * (err_str_len+1)); 2158 memcpy(vq->orig_msg->rep->reason_bogus_str, 2159 err_str, err_str_len+1); 2160 } 2161 free(err_str); 2162 } 2163 } 2164 /* 2165 * If set, the validator will not make messages bogus, instead 2166 * indeterminate is issued, so that no clients receive SERVFAIL. 2167 * This allows an operator to run validation 'shadow' without 2168 * hurting responses to clients. 2169 */ 2170 /* If we are in permissive mode, bogus gets indeterminate */ 2171 if(qstate->env->cfg->val_permissive_mode) 2172 vq->orig_msg->rep->security = sec_status_indeterminate; 2173 } 2174 2175 if(vq->orig_msg->rep->security == sec_status_secure && 2176 qstate->env->cfg->root_key_sentinel && 2177 (qstate->qinfo.qtype == LDNS_RR_TYPE_A || 2178 qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)) { 2179 char* keytag_start; 2180 uint16_t keytag; 2181 if(*qstate->qinfo.qname == strlen(SENTINEL_IS) + 2182 SENTINEL_KEYTAG_LEN && 2183 dname_lab_startswith(qstate->qinfo.qname, SENTINEL_IS, 2184 &keytag_start)) { 2185 if(sentinel_get_keytag(keytag_start, &keytag) && 2186 !anchor_has_keytag(qstate->env->anchors, 2187 (uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) { 2188 vq->orig_msg->rep->security = 2189 sec_status_secure_sentinel_fail; 2190 } 2191 } else if(*qstate->qinfo.qname == strlen(SENTINEL_NOT) + 2192 SENTINEL_KEYTAG_LEN && 2193 dname_lab_startswith(qstate->qinfo.qname, SENTINEL_NOT, 2194 &keytag_start)) { 2195 if(sentinel_get_keytag(keytag_start, &keytag) && 2196 anchor_has_keytag(qstate->env->anchors, 2197 (uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) { 2198 vq->orig_msg->rep->security = 2199 sec_status_secure_sentinel_fail; 2200 } 2201 } 2202 } 2203 2204 /* Update rep->reason_bogus as it is the one being cached */ 2205 update_reason_bogus(vq->orig_msg->rep, errinf_to_reason_bogus(qstate)); 2206 /* store results in cache */ 2207 if(qstate->query_flags&BIT_RD) { 2208 /* if secure, this will override cache anyway, no need 2209 * to check if from parentNS */ 2210 if(!qstate->no_cache_store) { 2211 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo, 2212 vq->orig_msg->rep, 0, qstate->prefetch_leeway, 0, NULL, 2213 qstate->query_flags, qstate->qstarttime)) { 2214 log_err("out of memory caching validator results"); 2215 } 2216 } 2217 } else { 2218 /* for a referral, store the verified RRsets */ 2219 /* and this does not get prefetched, so no leeway */ 2220 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo, 2221 vq->orig_msg->rep, 1, 0, 0, NULL, 2222 qstate->query_flags, qstate->qstarttime)) { 2223 log_err("out of memory caching validator results"); 2224 } 2225 } 2226 qstate->return_rcode = LDNS_RCODE_NOERROR; 2227 qstate->return_msg = vq->orig_msg; 2228 qstate->ext_state[id] = module_finished; 2229 return 0; 2230 } 2231 2232 /** 2233 * Handle validator state. 2234 * If a method returns true, the next state is started. If false, then 2235 * processing will stop. 2236 * @param qstate: query state. 2237 * @param vq: validator query state. 2238 * @param ve: validator shared global environment. 2239 * @param id: module id. 2240 */ 2241 static void 2242 val_handle(struct module_qstate* qstate, struct val_qstate* vq, 2243 struct val_env* ve, int id) 2244 { 2245 int cont = 1; 2246 while(cont) { 2247 verbose(VERB_ALGO, "val handle processing q with state %s", 2248 val_state_to_string(vq->state)); 2249 switch(vq->state) { 2250 case VAL_INIT_STATE: 2251 cont = processInit(qstate, vq, ve, id); 2252 break; 2253 case VAL_FINDKEY_STATE: 2254 cont = processFindKey(qstate, vq, id); 2255 break; 2256 case VAL_VALIDATE_STATE: 2257 cont = processValidate(qstate, vq, ve, id); 2258 break; 2259 case VAL_FINISHED_STATE: 2260 cont = processFinished(qstate, vq, ve, id); 2261 break; 2262 default: 2263 log_warn("validator: invalid state %d", 2264 vq->state); 2265 cont = 0; 2266 break; 2267 } 2268 } 2269 } 2270 2271 void 2272 val_operate(struct module_qstate* qstate, enum module_ev event, int id, 2273 struct outbound_entry* outbound) 2274 { 2275 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2276 struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id]; 2277 verbose(VERB_QUERY, "validator[module %d] operate: extstate:%s " 2278 "event:%s", id, strextstate(qstate->ext_state[id]), 2279 strmodulevent(event)); 2280 log_query_info(VERB_QUERY, "validator operate: query", 2281 &qstate->qinfo); 2282 if(vq && qstate->qinfo.qname != vq->qchase.qname) 2283 log_query_info(VERB_QUERY, "validator operate: chased to", 2284 &vq->qchase); 2285 (void)outbound; 2286 if(event == module_event_new || 2287 (event == module_event_pass && vq == NULL)) { 2288 2289 /* pass request to next module, to get it */ 2290 verbose(VERB_ALGO, "validator: pass to next module"); 2291 qstate->ext_state[id] = module_wait_module; 2292 return; 2293 } 2294 if(event == module_event_moddone) { 2295 /* check if validation is needed */ 2296 verbose(VERB_ALGO, "validator: nextmodule returned"); 2297 2298 if(!needs_validation(qstate, qstate->return_rcode, 2299 qstate->return_msg)) { 2300 /* no need to validate this */ 2301 if(qstate->return_msg) 2302 qstate->return_msg->rep->security = 2303 sec_status_indeterminate; 2304 qstate->ext_state[id] = module_finished; 2305 return; 2306 } 2307 if(already_validated(qstate->return_msg)) { 2308 qstate->ext_state[id] = module_finished; 2309 return; 2310 } 2311 /* qclass ANY should have validation result from spawned 2312 * queries. If we get here, it is bogus or an internal error */ 2313 if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) { 2314 verbose(VERB_ALGO, "cannot validate classANY: bogus"); 2315 if(qstate->return_msg) { 2316 qstate->return_msg->rep->security = 2317 sec_status_bogus; 2318 update_reason_bogus(qstate->return_msg->rep, LDNS_EDE_DNSSEC_BOGUS); 2319 } 2320 qstate->ext_state[id] = module_finished; 2321 return; 2322 } 2323 /* create state to start validation */ 2324 qstate->ext_state[id] = module_error; /* override this */ 2325 if(!vq) { 2326 vq = val_new(qstate, id); 2327 if(!vq) { 2328 log_err("validator: malloc failure"); 2329 qstate->ext_state[id] = module_error; 2330 return; 2331 } 2332 } else if(!vq->orig_msg) { 2333 if(!val_new_getmsg(qstate, vq)) { 2334 log_err("validator: malloc failure"); 2335 qstate->ext_state[id] = module_error; 2336 return; 2337 } 2338 } 2339 val_handle(qstate, vq, ve, id); 2340 return; 2341 } 2342 if(event == module_event_pass) { 2343 qstate->ext_state[id] = module_error; /* override this */ 2344 /* continue processing, since val_env exists */ 2345 val_handle(qstate, vq, ve, id); 2346 return; 2347 } 2348 log_err("validator: bad event %s", strmodulevent(event)); 2349 qstate->ext_state[id] = module_error; 2350 return; 2351 } 2352 2353 /** 2354 * Evaluate the response to a priming request. 2355 * 2356 * @param dnskey_rrset: DNSKEY rrset (can be NULL if none) in prime reply. 2357 * (this rrset is allocated in the wrong region, not the qstate). 2358 * @param ta: trust anchor. 2359 * @param qstate: qstate that needs key. 2360 * @param id: module id. 2361 * @return new key entry or NULL on allocation failure. 2362 * The key entry will either contain a validated DNSKEY rrset, or 2363 * represent a Null key (query failed, but validation did not), or a 2364 * Bad key (validation failed). 2365 */ 2366 static struct key_entry_key* 2367 primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset, 2368 struct trust_anchor* ta, struct module_qstate* qstate, int id) 2369 { 2370 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2371 struct key_entry_key* kkey = NULL; 2372 enum sec_status sec = sec_status_unchecked; 2373 char* reason = NULL; 2374 sldns_ede_code reason_bogus = LDNS_EDE_DNSSEC_BOGUS; 2375 int downprot = qstate->env->cfg->harden_algo_downgrade; 2376 2377 if(!dnskey_rrset) { 2378 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- " 2379 "could not fetch DNSKEY rrset", 2380 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass); 2381 reason_bogus = LDNS_EDE_DNSKEY_MISSING; 2382 reason = "no DNSKEY rrset"; 2383 if(qstate->env->cfg->harden_dnssec_stripped) { 2384 errinf_ede(qstate, reason, reason_bogus); 2385 kkey = key_entry_create_bad(qstate->region, ta->name, 2386 ta->namelen, ta->dclass, BOGUS_KEY_TTL, 2387 reason_bogus, reason, 2388 *qstate->env->now); 2389 } else kkey = key_entry_create_null(qstate->region, ta->name, 2390 ta->namelen, ta->dclass, NULL_KEY_TTL, 2391 reason_bogus, reason, 2392 *qstate->env->now); 2393 if(!kkey) { 2394 log_err("out of memory: allocate fail prime key"); 2395 return NULL; 2396 } 2397 return kkey; 2398 } 2399 /* attempt to verify with trust anchor DS and DNSKEY */ 2400 kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve, 2401 dnskey_rrset, ta->ds_rrset, ta->dnskey_rrset, downprot, 2402 &reason, &reason_bogus, qstate); 2403 if(!kkey) { 2404 log_err("out of memory: verifying prime TA"); 2405 return NULL; 2406 } 2407 if(key_entry_isgood(kkey)) 2408 sec = sec_status_secure; 2409 else 2410 sec = sec_status_bogus; 2411 verbose(VERB_DETAIL, "validate keys with anchor(DS): %s", 2412 sec_status_to_string(sec)); 2413 2414 if(sec != sec_status_secure) { 2415 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- " 2416 "DNSKEY rrset is not secure", 2417 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass); 2418 /* NOTE: in this case, we should probably reject the trust 2419 * anchor for longer, perhaps forever. */ 2420 if(qstate->env->cfg->harden_dnssec_stripped) { 2421 errinf_ede(qstate, reason, reason_bogus); 2422 kkey = key_entry_create_bad(qstate->region, ta->name, 2423 ta->namelen, ta->dclass, BOGUS_KEY_TTL, 2424 reason_bogus, reason, 2425 *qstate->env->now); 2426 } else kkey = key_entry_create_null(qstate->region, ta->name, 2427 ta->namelen, ta->dclass, NULL_KEY_TTL, 2428 reason_bogus, reason, 2429 *qstate->env->now); 2430 if(!kkey) { 2431 log_err("out of memory: allocate null prime key"); 2432 return NULL; 2433 } 2434 return kkey; 2435 } 2436 2437 log_nametypeclass(VERB_DETAIL, "Successfully primed trust anchor", 2438 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass); 2439 return kkey; 2440 } 2441 2442 /** 2443 * In inform supers, with the resulting message and rcode and the current 2444 * keyset in the super state, validate the DS response, returning a KeyEntry. 2445 * 2446 * @param qstate: query state that is validating and asked for a DS. 2447 * @param vq: validator query state 2448 * @param id: module id. 2449 * @param rcode: rcode result value. 2450 * @param msg: result message (if rcode is OK). 2451 * @param qinfo: from the sub query state, query info. 2452 * @param ke: the key entry to return. It returns 2453 * is_bad if the DS response fails to validate, is_null if the 2454 * DS response indicated an end to secure space, is_good if the DS 2455 * validated. It returns ke=NULL if the DS response indicated that the 2456 * request wasn't a delegation point. 2457 * @return 0 on servfail error (malloc failure). 2458 */ 2459 static int 2460 ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, 2461 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo, 2462 struct key_entry_key** ke) 2463 { 2464 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2465 char* reason = NULL; 2466 sldns_ede_code reason_bogus = LDNS_EDE_DNSSEC_BOGUS; 2467 enum val_classification subtype; 2468 if(rcode != LDNS_RCODE_NOERROR) { 2469 char rc[16]; 2470 rc[0]=0; 2471 (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc)); 2472 /* errors here pretty much break validation */ 2473 verbose(VERB_DETAIL, "DS response was error, thus bogus"); 2474 errinf(qstate, rc); 2475 reason = "no DS"; 2476 reason_bogus = LDNS_EDE_NETWORK_ERROR; 2477 errinf_ede(qstate, reason, reason_bogus); 2478 goto return_bogus; 2479 } 2480 2481 subtype = val_classify_response(BIT_RD, qinfo, qinfo, msg->rep, 0); 2482 if(subtype == VAL_CLASS_POSITIVE) { 2483 struct ub_packed_rrset_key* ds; 2484 enum sec_status sec; 2485 ds = reply_find_answer_rrset(qinfo, msg->rep); 2486 /* If there was no DS rrset, then we have mis-classified 2487 * this message. */ 2488 if(!ds) { 2489 log_warn("internal error: POSITIVE DS response was " 2490 "missing DS."); 2491 reason = "no DS record"; 2492 errinf_ede(qstate, reason, reason_bogus); 2493 goto return_bogus; 2494 } 2495 /* Verify only returns BOGUS or SECURE. If the rrset is 2496 * bogus, then we are done. */ 2497 sec = val_verify_rrset_entry(qstate->env, ve, ds, 2498 vq->key_entry, &reason, &reason_bogus, LDNS_SECTION_ANSWER, qstate); 2499 if(sec != sec_status_secure) { 2500 verbose(VERB_DETAIL, "DS rrset in DS response did " 2501 "not verify"); 2502 errinf_ede(qstate, reason, reason_bogus); 2503 goto return_bogus; 2504 } 2505 2506 /* If the DS rrset validates, we still have to make sure 2507 * that they are usable. */ 2508 if(!val_dsset_isusable(ds)) { 2509 /* If they aren't usable, then we treat it like 2510 * there was no DS. */ 2511 *ke = key_entry_create_null(qstate->region, 2512 qinfo->qname, qinfo->qname_len, qinfo->qclass, 2513 ub_packed_rrset_ttl(ds), 2514 LDNS_EDE_UNSUPPORTED_DS_DIGEST, NULL, 2515 *qstate->env->now); 2516 return (*ke) != NULL; 2517 } 2518 2519 /* Otherwise, we return the positive response. */ 2520 log_query_info(VERB_DETAIL, "validated DS", qinfo); 2521 *ke = key_entry_create_rrset(qstate->region, 2522 qinfo->qname, qinfo->qname_len, qinfo->qclass, ds, 2523 NULL, LDNS_EDE_NONE, NULL, *qstate->env->now); 2524 return (*ke) != NULL; 2525 } else if(subtype == VAL_CLASS_NODATA || 2526 subtype == VAL_CLASS_NAMEERROR) { 2527 /* NODATA means that the qname exists, but that there was 2528 * no DS. This is a pretty normal case. */ 2529 time_t proof_ttl = 0; 2530 enum sec_status sec; 2531 2532 /* make sure there are NSECs or NSEC3s with signatures */ 2533 if(!val_has_signed_nsecs(msg->rep, &reason)) { 2534 verbose(VERB_ALGO, "no NSECs: %s", reason); 2535 reason_bogus = LDNS_EDE_NSEC_MISSING; 2536 errinf_ede(qstate, reason, reason_bogus); 2537 goto return_bogus; 2538 } 2539 2540 /* For subtype Name Error. 2541 * attempt ANS 2.8.1.0 compatibility where it sets rcode 2542 * to nxdomain, but really this is an Nodata/Noerror response. 2543 * Find and prove the empty nonterminal in that case */ 2544 2545 /* Try to prove absence of the DS with NSEC */ 2546 sec = val_nsec_prove_nodata_dsreply( 2547 qstate->env, ve, qinfo, msg->rep, vq->key_entry, 2548 &proof_ttl, &reason, &reason_bogus, qstate); 2549 switch(sec) { 2550 case sec_status_secure: 2551 verbose(VERB_DETAIL, "NSEC RRset for the " 2552 "referral proved no DS."); 2553 *ke = key_entry_create_null(qstate->region, 2554 qinfo->qname, qinfo->qname_len, 2555 qinfo->qclass, proof_ttl, 2556 LDNS_EDE_NONE, NULL, 2557 *qstate->env->now); 2558 return (*ke) != NULL; 2559 case sec_status_insecure: 2560 verbose(VERB_DETAIL, "NSEC RRset for the " 2561 "referral proved not a delegation point"); 2562 *ke = NULL; 2563 return 1; 2564 case sec_status_bogus: 2565 verbose(VERB_DETAIL, "NSEC RRset for the " 2566 "referral did not prove no DS."); 2567 errinf(qstate, reason); 2568 goto return_bogus; 2569 case sec_status_unchecked: 2570 default: 2571 /* NSEC proof did not work, try next */ 2572 break; 2573 } 2574 2575 sec = nsec3_prove_nods(qstate->env, ve, 2576 msg->rep->rrsets + msg->rep->an_numrrsets, 2577 msg->rep->ns_numrrsets, qinfo, vq->key_entry, &reason, 2578 &reason_bogus, qstate); 2579 switch(sec) { 2580 case sec_status_insecure: 2581 /* case insecure also continues to unsigned 2582 * space. If nsec3-iter-count too high or 2583 * optout, then treat below as unsigned */ 2584 case sec_status_secure: 2585 verbose(VERB_DETAIL, "NSEC3s for the " 2586 "referral proved no DS."); 2587 *ke = key_entry_create_null(qstate->region, 2588 qinfo->qname, qinfo->qname_len, 2589 qinfo->qclass, proof_ttl, 2590 LDNS_EDE_NONE, NULL, 2591 *qstate->env->now); 2592 return (*ke) != NULL; 2593 case sec_status_indeterminate: 2594 verbose(VERB_DETAIL, "NSEC3s for the " 2595 "referral proved no delegation"); 2596 *ke = NULL; 2597 return 1; 2598 case sec_status_bogus: 2599 verbose(VERB_DETAIL, "NSEC3s for the " 2600 "referral did not prove no DS."); 2601 errinf_ede(qstate, reason, reason_bogus); 2602 goto return_bogus; 2603 case sec_status_unchecked: 2604 default: 2605 /* NSEC3 proof did not work */ 2606 break; 2607 } 2608 2609 /* Apparently, no available NSEC/NSEC3 proved NODATA, so 2610 * this is BOGUS. */ 2611 verbose(VERB_DETAIL, "DS %s ran out of options, so return " 2612 "bogus", val_classification_to_string(subtype)); 2613 reason = "no DS but also no proof of that"; 2614 errinf_ede(qstate, reason, reason_bogus); 2615 goto return_bogus; 2616 } else if(subtype == VAL_CLASS_CNAME || 2617 subtype == VAL_CLASS_CNAMENOANSWER) { 2618 /* if the CNAME matches the exact name we want and is signed 2619 * properly, then also, we are sure that no DS exists there, 2620 * much like a NODATA proof */ 2621 enum sec_status sec; 2622 struct ub_packed_rrset_key* cname; 2623 cname = reply_find_rrset_section_an(msg->rep, qinfo->qname, 2624 qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass); 2625 if(!cname) { 2626 reason = "validator classified CNAME but no " 2627 "CNAME of the queried name for DS"; 2628 errinf_ede(qstate, reason, reason_bogus); 2629 goto return_bogus; 2630 } 2631 if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count 2632 == 0) { 2633 if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep-> 2634 rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) { 2635 reason = "DS got DNAME answer"; 2636 } else { 2637 reason = "DS got unsigned CNAME answer"; 2638 } 2639 errinf_ede(qstate, reason, reason_bogus); 2640 goto return_bogus; 2641 } 2642 sec = val_verify_rrset_entry(qstate->env, ve, cname, 2643 vq->key_entry, &reason, &reason_bogus, 2644 LDNS_SECTION_ANSWER, qstate); 2645 if(sec == sec_status_secure) { 2646 verbose(VERB_ALGO, "CNAME validated, " 2647 "proof that DS does not exist"); 2648 /* and that it is not a referral point */ 2649 *ke = NULL; 2650 return 1; 2651 } 2652 errinf(qstate, "CNAME in DS response was not secure."); 2653 errinf_ede(qstate, reason, reason_bogus); 2654 goto return_bogus; 2655 } else { 2656 verbose(VERB_QUERY, "Encountered an unhandled type of " 2657 "DS response, thus bogus."); 2658 errinf(qstate, "no DS and"); 2659 reason = "no DS"; 2660 if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) { 2661 char rc[16]; 2662 rc[0]=0; 2663 (void)sldns_wire2str_rcode_buf((int)FLAGS_GET_RCODE( 2664 msg->rep->flags), rc, sizeof(rc)); 2665 errinf(qstate, rc); 2666 } else errinf(qstate, val_classification_to_string(subtype)); 2667 errinf(qstate, "message fails to prove that"); 2668 goto return_bogus; 2669 } 2670 return_bogus: 2671 *ke = key_entry_create_bad(qstate->region, qinfo->qname, 2672 qinfo->qname_len, qinfo->qclass, BOGUS_KEY_TTL, 2673 reason_bogus, reason, *qstate->env->now); 2674 return (*ke) != NULL; 2675 } 2676 2677 /** 2678 * Process DS response. Called from inform_supers. 2679 * Because it is in inform_supers, the mesh itself is busy doing callbacks 2680 * for a state that is to be deleted soon; don't touch the mesh; instead 2681 * set a state in the super, as the super will be reactivated soon. 2682 * Perform processing to determine what state to set in the super. 2683 * 2684 * @param qstate: query state that is validating and asked for a DS. 2685 * @param vq: validator query state 2686 * @param id: module id. 2687 * @param rcode: rcode result value. 2688 * @param msg: result message (if rcode is OK). 2689 * @param qinfo: from the sub query state, query info. 2690 * @param origin: the origin of msg. 2691 */ 2692 static void 2693 process_ds_response(struct module_qstate* qstate, struct val_qstate* vq, 2694 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo, 2695 struct sock_list* origin) 2696 { 2697 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2698 struct key_entry_key* dske = NULL; 2699 uint8_t* olds = vq->empty_DS_name; 2700 vq->empty_DS_name = NULL; 2701 if(!ds_response_to_ke(qstate, vq, id, rcode, msg, qinfo, &dske)) { 2702 log_err("malloc failure in process_ds_response"); 2703 vq->key_entry = NULL; /* make it error */ 2704 vq->state = VAL_VALIDATE_STATE; 2705 return; 2706 } 2707 if(dske == NULL) { 2708 vq->empty_DS_name = regional_alloc_init(qstate->region, 2709 qinfo->qname, qinfo->qname_len); 2710 if(!vq->empty_DS_name) { 2711 log_err("malloc failure in empty_DS_name"); 2712 vq->key_entry = NULL; /* make it error */ 2713 vq->state = VAL_VALIDATE_STATE; 2714 return; 2715 } 2716 vq->empty_DS_len = qinfo->qname_len; 2717 vq->chain_blacklist = NULL; 2718 /* ds response indicated that we aren't on a delegation point. 2719 * Keep the forState.state on FINDKEY. */ 2720 } else if(key_entry_isgood(dske)) { 2721 vq->ds_rrset = key_entry_get_rrset(dske, qstate->region); 2722 if(!vq->ds_rrset) { 2723 log_err("malloc failure in process DS"); 2724 vq->key_entry = NULL; /* make it error */ 2725 vq->state = VAL_VALIDATE_STATE; 2726 return; 2727 } 2728 vq->chain_blacklist = NULL; /* fresh blacklist for next part*/ 2729 /* Keep the forState.state on FINDKEY. */ 2730 } else if(key_entry_isbad(dske) 2731 && vq->restart_count < ve->max_restart) { 2732 vq->empty_DS_name = olds; 2733 val_blacklist(&vq->chain_blacklist, qstate->region, origin, 1); 2734 qstate->errinf = NULL; 2735 vq->restart_count++; 2736 } else { 2737 if(key_entry_isbad(dske)) { 2738 errinf_origin(qstate, origin); 2739 errinf_dname(qstate, "for DS", qinfo->qname); 2740 } 2741 /* NOTE: the reason for the DS to be not good (that is, 2742 * either bad or null) should have been logged by 2743 * dsResponseToKE. */ 2744 vq->key_entry = dske; 2745 /* The FINDKEY phase has ended, so move on. */ 2746 vq->state = VAL_VALIDATE_STATE; 2747 } 2748 } 2749 2750 /** 2751 * Process DNSKEY response. Called from inform_supers. 2752 * Sets the key entry in the state. 2753 * Because it is in inform_supers, the mesh itself is busy doing callbacks 2754 * for a state that is to be deleted soon; don't touch the mesh; instead 2755 * set a state in the super, as the super will be reactivated soon. 2756 * Perform processing to determine what state to set in the super. 2757 * 2758 * @param qstate: query state that is validating and asked for a DNSKEY. 2759 * @param vq: validator query state 2760 * @param id: module id. 2761 * @param rcode: rcode result value. 2762 * @param msg: result message (if rcode is OK). 2763 * @param qinfo: from the sub query state, query info. 2764 * @param origin: the origin of msg. 2765 */ 2766 static void 2767 process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq, 2768 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo, 2769 struct sock_list* origin) 2770 { 2771 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2772 struct key_entry_key* old = vq->key_entry; 2773 struct ub_packed_rrset_key* dnskey = NULL; 2774 int downprot; 2775 char* reason = NULL; 2776 sldns_ede_code reason_bogus = LDNS_EDE_DNSSEC_BOGUS; 2777 2778 if(rcode == LDNS_RCODE_NOERROR) 2779 dnskey = reply_find_answer_rrset(qinfo, msg->rep); 2780 2781 if(dnskey == NULL) { 2782 /* bad response */ 2783 verbose(VERB_DETAIL, "Missing DNSKEY RRset in response to " 2784 "DNSKEY query."); 2785 2786 if(vq->restart_count < ve->max_restart) { 2787 val_blacklist(&vq->chain_blacklist, qstate->region, 2788 origin, 1); 2789 qstate->errinf = NULL; 2790 vq->restart_count++; 2791 return; 2792 } 2793 reason = "No DNSKEY record"; 2794 reason_bogus = LDNS_EDE_DNSKEY_MISSING; 2795 vq->key_entry = key_entry_create_bad(qstate->region, 2796 qinfo->qname, qinfo->qname_len, qinfo->qclass, 2797 BOGUS_KEY_TTL, reason_bogus, reason, 2798 *qstate->env->now); 2799 if(!vq->key_entry) { 2800 log_err("alloc failure in missing dnskey response"); 2801 /* key_entry is NULL for failure in Validate */ 2802 } 2803 errinf_ede(qstate, reason, reason_bogus); 2804 errinf_origin(qstate, origin); 2805 errinf_dname(qstate, "for key", qinfo->qname); 2806 vq->state = VAL_VALIDATE_STATE; 2807 return; 2808 } 2809 if(!vq->ds_rrset) { 2810 log_err("internal error: no DS rrset for new DNSKEY response"); 2811 vq->key_entry = NULL; 2812 vq->state = VAL_VALIDATE_STATE; 2813 return; 2814 } 2815 downprot = qstate->env->cfg->harden_algo_downgrade; 2816 vq->key_entry = val_verify_new_DNSKEYs(qstate->region, qstate->env, 2817 ve, dnskey, vq->ds_rrset, downprot, &reason, &reason_bogus, qstate); 2818 2819 if(!vq->key_entry) { 2820 log_err("out of memory in verify new DNSKEYs"); 2821 vq->state = VAL_VALIDATE_STATE; 2822 return; 2823 } 2824 /* If the key entry isBad or isNull, then we can move on to the next 2825 * state. */ 2826 if(!key_entry_isgood(vq->key_entry)) { 2827 if(key_entry_isbad(vq->key_entry)) { 2828 if(vq->restart_count < ve->max_restart) { 2829 val_blacklist(&vq->chain_blacklist, 2830 qstate->region, origin, 1); 2831 qstate->errinf = NULL; 2832 vq->restart_count++; 2833 vq->key_entry = old; 2834 return; 2835 } 2836 verbose(VERB_DETAIL, "Did not match a DS to a DNSKEY, " 2837 "thus bogus."); 2838 errinf_ede(qstate, reason, reason_bogus); 2839 errinf_origin(qstate, origin); 2840 errinf_dname(qstate, "for key", qinfo->qname); 2841 } 2842 vq->chain_blacklist = NULL; 2843 vq->state = VAL_VALIDATE_STATE; 2844 return; 2845 } 2846 vq->chain_blacklist = NULL; 2847 qstate->errinf = NULL; 2848 2849 /* The DNSKEY validated, so cache it as a trusted key rrset. */ 2850 key_cache_insert(ve->kcache, vq->key_entry, 2851 qstate->env->cfg->val_log_level >= 2); 2852 2853 /* If good, we stay in the FINDKEY state. */ 2854 log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo); 2855 } 2856 2857 /** 2858 * Process prime response 2859 * Sets the key entry in the state. 2860 * 2861 * @param qstate: query state that is validating and primed a trust anchor. 2862 * @param vq: validator query state 2863 * @param id: module id. 2864 * @param rcode: rcode result value. 2865 * @param msg: result message (if rcode is OK). 2866 * @param origin: the origin of msg. 2867 */ 2868 static void 2869 process_prime_response(struct module_qstate* qstate, struct val_qstate* vq, 2870 int id, int rcode, struct dns_msg* msg, struct sock_list* origin) 2871 { 2872 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id]; 2873 struct ub_packed_rrset_key* dnskey_rrset = NULL; 2874 struct trust_anchor* ta = anchor_find(qstate->env->anchors, 2875 vq->trust_anchor_name, vq->trust_anchor_labs, 2876 vq->trust_anchor_len, vq->qchase.qclass); 2877 if(!ta) { 2878 /* trust anchor revoked, restart with less anchors */ 2879 vq->state = VAL_INIT_STATE; 2880 if(!vq->trust_anchor_name) 2881 vq->state = VAL_VALIDATE_STATE; /* break a loop */ 2882 vq->trust_anchor_name = NULL; 2883 return; 2884 } 2885 /* Fetch and validate the keyEntry that corresponds to the 2886 * current trust anchor. */ 2887 if(rcode == LDNS_RCODE_NOERROR) { 2888 dnskey_rrset = reply_find_rrset_section_an(msg->rep, 2889 ta->name, ta->namelen, LDNS_RR_TYPE_DNSKEY, 2890 ta->dclass); 2891 } 2892 2893 if(ta->autr) { 2894 if(!autr_process_prime(qstate->env, ve, ta, dnskey_rrset, 2895 qstate)) { 2896 /* trust anchor revoked, restart with less anchors */ 2897 vq->state = VAL_INIT_STATE; 2898 vq->trust_anchor_name = NULL; 2899 return; 2900 } 2901 } 2902 vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, id); 2903 lock_basic_unlock(&ta->lock); 2904 if(vq->key_entry) { 2905 if(key_entry_isbad(vq->key_entry) 2906 && vq->restart_count < ve->max_restart) { 2907 val_blacklist(&vq->chain_blacklist, qstate->region, 2908 origin, 1); 2909 qstate->errinf = NULL; 2910 vq->restart_count++; 2911 vq->key_entry = NULL; 2912 vq->state = VAL_INIT_STATE; 2913 return; 2914 } 2915 vq->chain_blacklist = NULL; 2916 errinf_origin(qstate, origin); 2917 errinf_dname(qstate, "for trust anchor", ta->name); 2918 /* store the freshly primed entry in the cache */ 2919 key_cache_insert(ve->kcache, vq->key_entry, 2920 qstate->env->cfg->val_log_level >= 2); 2921 } 2922 2923 /* If the result of the prime is a null key, skip the FINDKEY state.*/ 2924 if(!vq->key_entry || key_entry_isnull(vq->key_entry) || 2925 key_entry_isbad(vq->key_entry)) { 2926 vq->state = VAL_VALIDATE_STATE; 2927 } 2928 /* the qstate will be reactivated after inform_super is done */ 2929 } 2930 2931 /* 2932 * inform validator super. 2933 * 2934 * @param qstate: query state that finished. 2935 * @param id: module id. 2936 * @param super: the qstate to inform. 2937 */ 2938 void 2939 val_inform_super(struct module_qstate* qstate, int id, 2940 struct module_qstate* super) 2941 { 2942 struct val_qstate* vq = (struct val_qstate*)super->minfo[id]; 2943 log_query_info(VERB_ALGO, "validator: inform_super, sub is", 2944 &qstate->qinfo); 2945 log_query_info(VERB_ALGO, "super is", &super->qinfo); 2946 if(!vq) { 2947 verbose(VERB_ALGO, "super: has no validator state"); 2948 return; 2949 } 2950 if(vq->wait_prime_ta) { 2951 vq->wait_prime_ta = 0; 2952 process_prime_response(super, vq, id, qstate->return_rcode, 2953 qstate->return_msg, qstate->reply_origin); 2954 return; 2955 } 2956 if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS) { 2957 process_ds_response(super, vq, id, qstate->return_rcode, 2958 qstate->return_msg, &qstate->qinfo, 2959 qstate->reply_origin); 2960 return; 2961 } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY) { 2962 process_dnskey_response(super, vq, id, qstate->return_rcode, 2963 qstate->return_msg, &qstate->qinfo, 2964 qstate->reply_origin); 2965 return; 2966 } 2967 log_err("internal error in validator: no inform_supers possible"); 2968 } 2969 2970 void 2971 val_clear(struct module_qstate* qstate, int id) 2972 { 2973 if(!qstate) 2974 return; 2975 /* everything is allocated in the region, so assign NULL */ 2976 qstate->minfo[id] = NULL; 2977 } 2978 2979 size_t 2980 val_get_mem(struct module_env* env, int id) 2981 { 2982 struct val_env* ve = (struct val_env*)env->modinfo[id]; 2983 if(!ve) 2984 return 0; 2985 return sizeof(*ve) + key_cache_get_mem(ve->kcache) + 2986 val_neg_get_mem(ve->neg_cache) + 2987 sizeof(size_t)*2*ve->nsec3_keyiter_count; 2988 } 2989 2990 /** 2991 * The validator function block 2992 */ 2993 static struct module_func_block val_block = { 2994 "validator", 2995 &val_init, &val_deinit, &val_operate, &val_inform_super, &val_clear, 2996 &val_get_mem 2997 }; 2998 2999 struct module_func_block* 3000 val_get_funcblock(void) 3001 { 3002 return &val_block; 3003 } 3004 3005 const char* 3006 val_state_to_string(enum val_state state) 3007 { 3008 switch(state) { 3009 case VAL_INIT_STATE: return "VAL_INIT_STATE"; 3010 case VAL_FINDKEY_STATE: return "VAL_FINDKEY_STATE"; 3011 case VAL_VALIDATE_STATE: return "VAL_VALIDATE_STATE"; 3012 case VAL_FINISHED_STATE: return "VAL_FINISHED_STATE"; 3013 } 3014 return "UNKNOWN VALIDATOR STATE"; 3015 } 3016 3017