contrib/unbound/validator/autotrust.c

   1 /*
   2  * validator/autotrust.c - RFC5011 trust anchor management for unbound.
   3  *
   4  * Copyright (c) 2009, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * Contains autotrust implementation. The implementation was taken from
  40  * the autotrust daemon (BSD licensed), written by Matthijs Mekking.
  41  * It was modified to fit into unbound. The state table process is the same.
  42  */
  43 #include "config.h"
  44 #include "validator/autotrust.h"
  45 #include "validator/val_anchor.h"
  46 #include "validator/val_utils.h"
  47 #include "validator/val_sigcrypt.h"
  48 #include "util/data/dname.h"
  49 #include "util/data/packed_rrset.h"
  50 #include "util/log.h"
  51 #include "util/module.h"
  52 #include "util/net_help.h"
  53 #include "util/config_file.h"
  54 #include "util/regional.h"
  55 #include "util/random.h"
  56 #include "util/data/msgparse.h"
  57 #include "services/mesh.h"
  58 #include "services/cache/rrset.h"
  59 #include "validator/val_kcache.h"
  60 #include "sldns/sbuffer.h"
  61 #include "sldns/wire2str.h"
  62 #include "sldns/str2wire.h"
  63 #include "sldns/keyraw.h"
  64 #include "sldns/rrdef.h"
  65 #include <stdarg.h>
  66 #include <ctype.h>
  67
  68 /** number of times a key must be seen before it can become valid */
  69 #define MIN_PENDINGCOUNT 2
  70
  71 /** Event: Revoked */
  72 static void do_revoked(struct module_env* env, struct autr_ta* anchor, int* c);
  73
  74 struct autr_global_data* autr_global_create(void)
  75 {
  76         struct autr_global_data* global;
  77         global = (struct autr_global_data*)malloc(sizeof(*global));
  78         if(!global)
  79                 return NULL;
  80         rbtree_init(&global->probe, &probetree_cmp);
  81         return global;
  82 }
  83
  84 void autr_global_delete(struct autr_global_data* global)
  85 {
  86         if(!global)
  87                 return;
  88         /* elements deleted by parent */
  89         memset(global, 0, sizeof(*global));
  90         free(global);
  91 }
  92
  93 int probetree_cmp(const void* x, const void* y)
  94 {
  95         struct trust_anchor* a = (struct trust_anchor*)x;
  96         struct trust_anchor* b = (struct trust_anchor*)y;
  97         log_assert(a->autr && b->autr);
  98         if(a->autr->next_probe_time < b->autr->next_probe_time)
  99                 return -1;
 100         if(a->autr->next_probe_time > b->autr->next_probe_time)
 101                 return 1;
 102         /* time is equal, sort on trust point identity */
 103         return anchor_cmp(x, y);
 104 }
 105
 106 size_t
 107 autr_get_num_anchors(struct val_anchors* anchors)
 108 {
 109         size_t res = 0;
 110         if(!anchors)
 111                 return 0;
 112         lock_basic_lock(&anchors->lock);
 113         if(anchors->autr)
 114                 res = anchors->autr->probe.count;
 115         lock_basic_unlock(&anchors->lock);
 116         return res;
 117 }
 118
 119 /** Position in string */
 120 static int
 121 position_in_string(char *str, const char* sub)
 122 {
 123         char* pos = strstr(str, sub);
 124         if(pos)
 125                 return (int)(pos-str)+(int)strlen(sub);
 126         return -1;
 127 }
 128
 129 /** Debug routine to print pretty key information */
 130 static void
 131 verbose_key(struct autr_ta* ta, enum verbosity_value level,
 132         const char* format, ...) ATTR_FORMAT(printf, 3, 4);
 133
 134 /**
 135  * Implementation of debug pretty key print
 136  * @param ta: trust anchor key with DNSKEY data.
 137  * @param level: verbosity level to print at.
 138  * @param format: printf style format string.
 139  */
 140 static void
 141 verbose_key(struct autr_ta* ta, enum verbosity_value level,
 142         const char* format, ...)
 143 {
 144         va_list args;
 145         va_start(args, format);
 146         if(verbosity >= level) {
 147                 char* str = sldns_wire2str_dname(ta->rr, ta->dname_len);
 148                 int keytag = (int)sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
 149                         ta->rr, ta->rr_len, ta->dname_len),
 150                         sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
 151                         ta->dname_len));
 152                 char msg[MAXSYSLOGMSGLEN];
 153                 vsnprintf(msg, sizeof(msg), format, args);
 154                 verbose(level, "%s key %d %s", str?str:"??", keytag, msg);
 155                 free(str);
 156         }
 157         va_end(args);
 158 }
 159
 160 /**
 161  * Parse comments
 162  * @param str: to parse
 163  * @param ta: trust key autotrust metadata
 164  * @return false on failure.
 165  */
 166 static int
 167 parse_comments(char* str, struct autr_ta* ta)
 168 {
 169         int len = (int)strlen(str), pos = 0, timestamp = 0;
 170         char* comment = (char*) malloc(sizeof(char)*len+1);
 171         char* comments = comment;
 172         if(!comment) {
 173                 log_err("malloc failure in parse");
 174                 return 0;
 175         }
 176         /* skip over whitespace and data at start of line */
 177         while (*str != '\0' && *str != ';')
 178                 str++;
 179         if (*str == ';')
 180                 str++;
 181         /* copy comments */
 182         while (*str != '\0')
 183         {
 184                 *comments = *str;
 185                 comments++;
 186                 str++;
 187         }
 188         *comments = '\0';
 189
 190         comments = comment;
 191
 192         /* read state */
 193         pos = position_in_string(comments, "state=");
 194         if (pos >= (int) strlen(comments))
 195         {
 196                 log_err("parse error");
 197                 free(comment);
 198                 return 0;
 199         }
 200         if (pos <= 0)
 201                 ta->s = AUTR_STATE_VALID;
 202         else
 203         {
 204                 int s = (int) comments[pos] - '0';
 205                 switch(s)
 206                 {
 207                         case AUTR_STATE_START:
 208                         case AUTR_STATE_ADDPEND:
 209                         case AUTR_STATE_VALID:
 210                         case AUTR_STATE_MISSING:
 211                         case AUTR_STATE_REVOKED:
 212                         case AUTR_STATE_REMOVED:
 213                                 ta->s = s;
 214                                 break;
 215                         default:
 216                                 verbose_key(ta, VERB_OPS, "has undefined "
 217                                         "state, considered NewKey");
 218                                 ta->s = AUTR_STATE_START;
 219                                 break;
 220                 }
 221         }
 222         /* read pending count */
 223         pos = position_in_string(comments, "count=");
 224         if (pos >= (int) strlen(comments))
 225         {
 226                 log_err("parse error");
 227                 free(comment);
 228                 return 0;
 229         }
 230         if (pos <= 0)
 231                 ta->pending_count = 0;
 232         else
 233         {
 234                 comments += pos;
 235                 ta->pending_count = (uint8_t)atoi(comments);
 236         }
 237
 238         /* read last change */
 239         pos = position_in_string(comments, "lastchange=");
 240         if (pos >= (int) strlen(comments))
 241         {
 242                 log_err("parse error");
 243                 free(comment);
 244                 return 0;
 245         }
 246         if (pos >= 0)
 247         {
 248                 comments += pos;
 249                 timestamp = atoi(comments);
 250         }
 251         if (pos < 0 || !timestamp)
 252                 ta->last_change = 0;
 253         else
 254                 ta->last_change = (time_t)timestamp;
 255
 256         free(comment);
 257         return 1;
 258 }
 259
 260 /** Check if a line contains data (besides comments) */
 261 static int
 262 str_contains_data(char* str, char comment)
 263 {
 264         while (*str != '\0') {
 265                 if (*str == comment || *str == '\n')
 266                         return 0;
 267                 if (*str != ' ' && *str != '\t')
 268                         return 1;
 269                 str++;
 270         }
 271         return 0;
 272 }
 273
 274 /** Get DNSKEY flags
 275  * rdata without rdatalen in front of it. */
 276 static int
 277 dnskey_flags(uint16_t t, uint8_t* rdata, size_t len)
 278 {
 279         uint16_t f;
 280         if(t != LDNS_RR_TYPE_DNSKEY)
 281                 return 0;
 282         if(len < 2)
 283                 return 0;
 284         memmove(&f, rdata, 2);
 285         f = ntohs(f);
 286         return (int)f;
 287 }
 288
 289 /** Check if KSK DNSKEY.
 290  * pass rdata without rdatalen in front of it */
 291 static int
 292 rr_is_dnskey_sep(uint16_t t, uint8_t* rdata, size_t len)
 293 {
 294         return (dnskey_flags(t, rdata, len)&DNSKEY_BIT_SEP);
 295 }
 296
 297 /** Check if TA is KSK DNSKEY */
 298 static int
 299 ta_is_dnskey_sep(struct autr_ta* ta)
 300 {
 301         return (dnskey_flags(
 302                 sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len),
 303                 sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len),
 304                 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len)
 305                 ) & DNSKEY_BIT_SEP);
 306 }
 307
 308 /** Check if REVOKED DNSKEY
 309  * pass rdata without rdatalen in front of it */
 310 static int
 311 rr_is_dnskey_revoked(uint16_t t, uint8_t* rdata, size_t len)
 312 {
 313         return (dnskey_flags(t, rdata, len)&LDNS_KEY_REVOKE_KEY);
 314 }
 315
 316 /** create ta */
 317 static struct autr_ta*
 318 autr_ta_create(uint8_t* rr, size_t rr_len, size_t dname_len)
 319 {
 320         struct autr_ta* ta = (struct autr_ta*)calloc(1, sizeof(*ta));
 321         if(!ta) {
 322                 free(rr);
 323                 return NULL;
 324         }
 325         ta->rr = rr;
 326         ta->rr_len = rr_len;
 327         ta->dname_len = dname_len;
 328         return ta;
 329 }
 330
 331 /** create tp */
 332 static struct trust_anchor*
 333 autr_tp_create(struct val_anchors* anchors, uint8_t* own, size_t own_len,
 334         uint16_t dc)
 335 {
 336         struct trust_anchor* tp = (struct trust_anchor*)calloc(1, sizeof(*tp));
 337         if(!tp) return NULL;
 338         tp->name = memdup(own, own_len);
 339         if(!tp->name) {
 340                 free(tp);
 341                 return NULL;
 342         }
 343         tp->namelen = own_len;
 344         tp->namelabs = dname_count_labels(tp->name);
 345         tp->node.key = tp;
 346         tp->dclass = dc;
 347         tp->autr = (struct autr_point_data*)calloc(1, sizeof(*tp->autr));
 348         if(!tp->autr) {
 349                 free(tp->name);
 350                 free(tp);
 351                 return NULL;
 352         }
 353         tp->autr->pnode.key = tp;
 354
 355         lock_basic_lock(&anchors->lock);
 356         if(!rbtree_insert(anchors->tree, &tp->node)) {
 357                 lock_basic_unlock(&anchors->lock);
 358                 log_err("trust anchor presented twice");
 359                 free(tp->name);
 360                 free(tp->autr);
 361                 free(tp);
 362                 return NULL;
 363         }
 364         if(!rbtree_insert(&anchors->autr->probe, &tp->autr->pnode)) {
 365                 (void)rbtree_delete(anchors->tree, tp);
 366                 lock_basic_unlock(&anchors->lock);
 367                 log_err("trust anchor in probetree twice");
 368                 free(tp->name);
 369                 free(tp->autr);
 370                 free(tp);
 371                 return NULL;
 372         }
 373         lock_basic_unlock(&anchors->lock);
 374         lock_basic_init(&tp->lock);
 375         lock_protect(&tp->lock, tp, sizeof(*tp));
 376         lock_protect(&tp->lock, tp->autr, sizeof(*tp->autr));
 377         return tp;
 378 }
 379
 380 /** delete assembled rrsets */
 381 static void
 382 autr_rrset_delete(struct ub_packed_rrset_key* r)
 383 {
 384         if(r) {
 385                 free(r->rk.dname);
 386                 free(r->entry.data);
 387                 free(r);
 388         }
 389 }
 390
 391 void autr_point_delete(struct trust_anchor* tp)
 392 {
 393         if(!tp)
 394                 return;
 395         lock_unprotect(&tp->lock, tp);
 396         lock_unprotect(&tp->lock, tp->autr);
 397         lock_basic_destroy(&tp->lock);
 398         autr_rrset_delete(tp->ds_rrset);
 399         autr_rrset_delete(tp->dnskey_rrset);
 400         if(tp->autr) {
 401                 struct autr_ta* p = tp->autr->keys, *np;
 402                 while(p) {
 403                         np = p->next;
 404                         free(p->rr);
 405                         free(p);
 406                         p = np;
 407                 }
 408                 free(tp->autr->file);
 409                 free(tp->autr);
 410         }
 411         free(tp->name);
 412         free(tp);
 413 }
 414
 415 /** find or add a new trust point for autotrust */
 416 static struct trust_anchor*
 417 find_add_tp(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
 418         size_t dname_len)
 419 {
 420         struct trust_anchor* tp;
 421         tp = anchor_find(anchors, rr, dname_count_labels(rr), dname_len,
 422                 sldns_wirerr_get_class(rr, rr_len, dname_len));
 423         if(tp) {
 424                 if(!tp->autr) {
 425                         log_err("anchor cannot be with and without autotrust");
 426                         lock_basic_unlock(&tp->lock);
 427                         return NULL;
 428                 }
 429                 return tp;
 430         }
 431         tp = autr_tp_create(anchors, rr, dname_len, sldns_wirerr_get_class(rr,
 432                 rr_len, dname_len));
 433         if(!tp)
 434                 return NULL;
 435         lock_basic_lock(&tp->lock);
 436         return tp;
 437 }
 438
 439 /** Add trust anchor from RR */
 440 static struct autr_ta*
 441 add_trustanchor_frm_rr(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
 442         size_t dname_len, struct trust_anchor** tp)
 443 {
 444         struct autr_ta* ta = autr_ta_create(rr, rr_len, dname_len);
 445         if(!ta)
 446                 return NULL;
 447         *tp = find_add_tp(anchors, rr, rr_len, dname_len);
 448         if(!*tp) {
 449                 free(ta->rr);
 450                 free(ta);
 451                 return NULL;
 452         }
 453         /* add ta to tp */
 454         ta->next = (*tp)->autr->keys;
 455         (*tp)->autr->keys = ta;
 456         lock_basic_unlock(&(*tp)->lock);
 457         return ta;
 458 }
 459
 460 /**
 461  * Add new trust anchor from a string in file.
 462  * @param anchors: all anchors
 463  * @param str: string with anchor and comments, if any comments.
 464  * @param tp: trust point returned.
 465  * @param origin: what to use for @
 466  * @param origin_len: length of origin
 467  * @param prev: previous rr name
 468  * @param prev_len: length of prev
 469  * @param skip: if true, the result is NULL, but not an error, skip it.
 470  * @return new key in trust point.
 471  */
 472 static struct autr_ta*
 473 add_trustanchor_frm_str(struct val_anchors* anchors, char* str,
 474         struct trust_anchor** tp, uint8_t* origin, size_t origin_len,
 475         uint8_t** prev, size_t* prev_len, int* skip)
 476 {
 477         uint8_t rr[LDNS_RR_BUF_SIZE];
 478         size_t rr_len = sizeof(rr), dname_len;
 479         uint8_t* drr;
 480         int lstatus;
 481         if (!str_contains_data(str, ';')) {
 482                 *skip = 1;
 483                 return NULL; /* empty line */
 484         }
 485         if(0 != (lstatus = sldns_str2wire_rr_buf(str, rr, &rr_len, &dname_len,
 486                 0, origin, origin_len, *prev, *prev_len)))
 487         {
 488                 log_err("ldns error while converting string to RR at%d: %s: %s",
 489                         LDNS_WIREPARSE_OFFSET(lstatus),
 490                         sldns_get_errorstr_parse(lstatus), str);
 491                 return NULL;
 492         }
 493         free(*prev);
 494         *prev = memdup(rr, dname_len);
 495         *prev_len = dname_len;
 496         if(!*prev) {
 497                 log_err("malloc failure in add_trustanchor");
 498                 return NULL;
 499         }
 500         if(sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DNSKEY &&
 501                 sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DS) {
 502                 *skip = 1;
 503                 return NULL; /* only DS and DNSKEY allowed */
 504         }
 505         drr = memdup(rr, rr_len);
 506         if(!drr) {
 507                 log_err("malloc failure in add trustanchor");
 508                 return NULL;
 509         }
 510         return add_trustanchor_frm_rr(anchors, drr, rr_len, dname_len, tp);
 511 }
 512
 513 /**
 514  * Load single anchor
 515  * @param anchors: all points.
 516  * @param str: comments line
 517  * @param fname: filename
 518  * @param origin: the $ORIGIN.
 519  * @param origin_len: length of origin
 520  * @param prev: passed to ldns.
 521  * @param prev_len: length of prev
 522  * @param skip: if true, the result is NULL, but not an error, skip it.
 523  * @return false on failure, otherwise the tp read.
 524  */
 525 static struct trust_anchor*
 526 load_trustanchor(struct val_anchors* anchors, char* str, const char* fname,
 527         uint8_t* origin, size_t origin_len, uint8_t** prev, size_t* prev_len,
 528         int* skip)
 529 {
 530         struct autr_ta* ta = NULL;
 531         struct trust_anchor* tp = NULL;
 532
 533         ta = add_trustanchor_frm_str(anchors, str, &tp, origin, origin_len,
 534                 prev, prev_len, skip);
 535         if(!ta)
 536                 return NULL;
 537         lock_basic_lock(&tp->lock);
 538         if(!parse_comments(str, ta)) {
 539                 lock_basic_unlock(&tp->lock);
 540                 return NULL;
 541         }
 542         if(!tp->autr->file) {
 543                 tp->autr->file = strdup(fname);
 544                 if(!tp->autr->file) {
 545                         lock_basic_unlock(&tp->lock);
 546                         log_err("malloc failure");
 547                         return NULL;
 548                 }
 549         }
 550         lock_basic_unlock(&tp->lock);
 551         return tp;
 552 }
 553
 554 /** iterator for DSes from keylist. return true if a next element exists */
 555 static int
 556 assemble_iterate_ds(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
 557         size_t* dname_len)
 558 {
 559         while(*list) {
 560                 if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
 561                         (*list)->dname_len) == LDNS_RR_TYPE_DS) {
 562                         *rr = (*list)->rr;
 563                         *rr_len = (*list)->rr_len;
 564                         *dname_len = (*list)->dname_len;
 565                         *list = (*list)->next;
 566                         return 1;
 567                 }
 568                 *list = (*list)->next;
 569         }
 570         return 0;
 571 }
 572
 573 /** iterator for DNSKEYs from keylist. return true if a next element exists */
 574 static int
 575 assemble_iterate_dnskey(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
 576         size_t* dname_len)
 577 {
 578         while(*list) {
 579                 if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
 580                    (*list)->dname_len) != LDNS_RR_TYPE_DS &&
 581                         ((*list)->s == AUTR_STATE_VALID ||
 582                          (*list)->s == AUTR_STATE_MISSING)) {
 583                         *rr = (*list)->rr;
 584                         *rr_len = (*list)->rr_len;
 585                         *dname_len = (*list)->dname_len;
 586                         *list = (*list)->next;
 587                         return 1;
 588                 }
 589                 *list = (*list)->next;
 590         }
 591         return 0;
 592 }
 593
 594 /** see if iterator-list has any elements in it, or it is empty */
 595 static int
 596 assemble_iterate_hasfirst(int iter(struct autr_ta**, uint8_t**, size_t*,
 597         size_t*), struct autr_ta* list)
 598 {
 599         uint8_t* rr = NULL;
 600         size_t rr_len = 0, dname_len = 0;
 601         return iter(&list, &rr, &rr_len, &dname_len);
 602 }
 603
 604 /** number of elements in iterator list */
 605 static size_t
 606 assemble_iterate_count(int iter(struct autr_ta**, uint8_t**, size_t*,
 607         size_t*), struct autr_ta* list)
 608 {
 609         uint8_t* rr = NULL;
 610         size_t i = 0, rr_len = 0, dname_len = 0;
 611         while(iter(&list, &rr, &rr_len, &dname_len)) {
 612                 i++;
 613         }
 614         return i;
 615 }
 616
 617 /**
 618  * Create a ub_packed_rrset_key allocated on the heap.
 619  * It therefore does not have the correct ID value, and cannot be used
 620  * inside the cache.  It can be used in storage outside of the cache.
 621  * Keys for the cache have to be obtained from alloc.h .
 622  * @param iter: iterator over the elements in the list.  It filters elements.
 623  * @param list: the list.
 624  * @return key allocated or NULL on failure.
 625  */
 626 static struct ub_packed_rrset_key*
 627 ub_packed_rrset_heap_key(int iter(struct autr_ta**, uint8_t**, size_t*,
 628         size_t*), struct autr_ta* list)
 629 {
 630         uint8_t* rr = NULL;
 631         size_t rr_len = 0, dname_len = 0;
 632         struct ub_packed_rrset_key* k;
 633         if(!iter(&list, &rr, &rr_len, &dname_len))
 634                 return NULL;
 635         k = (struct ub_packed_rrset_key*)calloc(1, sizeof(*k));
 636         if(!k)
 637                 return NULL;
 638         k->rk.type = htons(sldns_wirerr_get_type(rr, rr_len, dname_len));
 639         k->rk.rrset_class = htons(sldns_wirerr_get_class(rr, rr_len, dname_len));
 640         k->rk.dname_len = dname_len;
 641         k->rk.dname = memdup(rr, dname_len);
 642         if(!k->rk.dname) {
 643                 free(k);
 644                 return NULL;
 645         }
 646         return k;
 647 }
 648
 649 /**
 650  * Create packed_rrset data on the heap.
 651  * @param iter: iterator over the elements in the list.  It filters elements.
 652  * @param list: the list.
 653  * @return data allocated or NULL on failure.
 654  */
 655 static struct packed_rrset_data*
 656 packed_rrset_heap_data(int iter(struct autr_ta**, uint8_t**, size_t*,
 657         size_t*), struct autr_ta* list)
 658 {
 659         uint8_t* rr = NULL;
 660         size_t rr_len = 0, dname_len = 0;
 661         struct packed_rrset_data* data;
 662         size_t count=0, rrsig_count=0, len=0, i, total;
 663         uint8_t* nextrdata;
 664         struct autr_ta* list_i;
 665         time_t ttl = 0;
 666
 667         list_i = list;
 668         while(iter(&list_i, &rr, &rr_len, &dname_len)) {
 669                 if(sldns_wirerr_get_type(rr, rr_len, dname_len) ==
 670                         LDNS_RR_TYPE_RRSIG)
 671                         rrsig_count++;
 672                 else    count++;
 673                 /* sizeof the rdlength + rdatalen */
 674                 len += 2 + sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
 675                 ttl = (time_t)sldns_wirerr_get_ttl(rr, rr_len, dname_len);
 676         }
 677         if(count == 0 && rrsig_count == 0)
 678                 return NULL;
 679
 680         /* allocate */
 681         total = count + rrsig_count;
 682         len += sizeof(*data) + total*(sizeof(size_t) + sizeof(time_t) +
 683                 sizeof(uint8_t*));
 684         data = (struct packed_rrset_data*)calloc(1, len);
 685         if(!data)
 686                 return NULL;
 687
 688         /* fill it */
 689         data->ttl = ttl;
 690         data->count = count;
 691         data->rrsig_count = rrsig_count;
 692         data->rr_len = (size_t*)((uint8_t*)data +
 693                 sizeof(struct packed_rrset_data));
 694         data->rr_data = (uint8_t**)&(data->rr_len[total]);
 695         data->rr_ttl = (time_t*)&(data->rr_data[total]);
 696         nextrdata = (uint8_t*)&(data->rr_ttl[total]);
 697
 698         /* fill out len, ttl, fields */
 699         list_i = list;
 700         i = 0;
 701         while(iter(&list_i, &rr, &rr_len, &dname_len)) {
 702                 data->rr_ttl[i] = (time_t)sldns_wirerr_get_ttl(rr, rr_len,
 703                         dname_len);
 704                 if(data->rr_ttl[i] < data->ttl)
 705                         data->ttl = data->rr_ttl[i];
 706                 data->rr_len[i] = 2 /* the rdlength */ +
 707                         sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
 708                 i++;
 709         }
 710
 711         /* fixup rest of ptrs */
 712         for(i=0; i<total; i++) {
 713                 data->rr_data[i] = nextrdata;
 714                 nextrdata += data->rr_len[i];
 715         }
 716
 717         /* copy data in there */
 718         list_i = list;
 719         i = 0;
 720         while(iter(&list_i, &rr, &rr_len, &dname_len)) {
 721                 log_assert(data->rr_data[i]);
 722                 memmove(data->rr_data[i],
 723                         sldns_wirerr_get_rdatawl(rr, rr_len, dname_len),
 724                         data->rr_len[i]);
 725                 i++;
 726         }
 727
 728         if(data->rrsig_count && data->count == 0) {
 729                 data->count = data->rrsig_count; /* rrset type is RRSIG */
 730                 data->rrsig_count = 0;
 731         }
 732         return data;
 733 }
 734
 735 /**
 736  * Assemble the trust anchors into DS and DNSKEY packed rrsets.
 737  * Uses only VALID and MISSING DNSKEYs.
 738  * Read the sldns_rrs and builds packed rrsets
 739  * @param tp: the trust point. Must be locked.
 740  * @return false on malloc failure.
 741  */
 742 static int
 743 autr_assemble(struct trust_anchor* tp)
 744 {
 745         struct ub_packed_rrset_key* ubds=NULL, *ubdnskey=NULL;
 746
 747         /* make packed rrset keys - malloced with no ID number, they
 748          * are not in the cache */
 749         /* make packed rrset data (if there is a key) */
 750         if(assemble_iterate_hasfirst(assemble_iterate_ds, tp->autr->keys)) {
 751                 ubds = ub_packed_rrset_heap_key(
 752                         assemble_iterate_ds, tp->autr->keys);
 753                 if(!ubds)
 754                         goto error_cleanup;
 755                 ubds->entry.data = packed_rrset_heap_data(
 756                         assemble_iterate_ds, tp->autr->keys);
 757                 if(!ubds->entry.data)
 758                         goto error_cleanup;
 759         }
 760
 761         /* make packed DNSKEY data */
 762         if(assemble_iterate_hasfirst(assemble_iterate_dnskey, tp->autr->keys)) {
 763                 ubdnskey = ub_packed_rrset_heap_key(
 764                         assemble_iterate_dnskey, tp->autr->keys);
 765                 if(!ubdnskey)
 766                         goto error_cleanup;
 767                 ubdnskey->entry.data = packed_rrset_heap_data(
 768                         assemble_iterate_dnskey, tp->autr->keys);
 769                 if(!ubdnskey->entry.data) {
 770                 error_cleanup:
 771                         autr_rrset_delete(ubds);
 772                         autr_rrset_delete(ubdnskey);
 773                         return 0;
 774                 }
 775         }
 776
 777         /* we have prepared the new keys so nothing can go wrong any more.
 778          * And we are sure we cannot be left without trustanchor after
 779          * any errors. Put in the new keys and remove old ones. */
 780
 781         /* free the old data */
 782         autr_rrset_delete(tp->ds_rrset);
 783         autr_rrset_delete(tp->dnskey_rrset);
 784
 785         /* assign the data to replace the old */
 786         tp->ds_rrset = ubds;
 787         tp->dnskey_rrset = ubdnskey;
 788         tp->numDS = assemble_iterate_count(assemble_iterate_ds,
 789                 tp->autr->keys);
 790         tp->numDNSKEY = assemble_iterate_count(assemble_iterate_dnskey,
 791                 tp->autr->keys);
 792         return 1;
 793 }
 794
 795 /** parse integer */
 796 static unsigned int
 797 parse_int(char* line, int* ret)
 798 {
 799         char *e;
 800         unsigned int x = (unsigned int)strtol(line, &e, 10);
 801         if(line == e) {
 802                 *ret = -1; /* parse error */
 803                 return 0;
 804         }
 805         *ret = 1; /* matched */
 806         return x;
 807 }
 808
 809 /** parse id sequence for anchor */
 810 static struct trust_anchor*
 811 parse_id(struct val_anchors* anchors, char* line)
 812 {
 813         struct trust_anchor *tp;
 814         int r;
 815         uint16_t dclass;
 816         uint8_t* dname;
 817         size_t dname_len;
 818         /* read the owner name */
 819         char* next = strchr(line, ' ');
 820         if(!next)
 821                 return NULL;
 822         next[0] = 0;
 823         dname = sldns_str2wire_dname(line, &dname_len);
 824         if(!dname)
 825                 return NULL;
 826
 827         /* read the class */
 828         dclass = parse_int(next+1, &r);
 829         if(r == -1) {
 830                 free(dname);
 831                 return NULL;
 832         }
 833
 834         /* find the trust point */
 835         tp = autr_tp_create(anchors, dname, dname_len, dclass);
 836         free(dname);
 837         return tp;
 838 }
 839
 840 /**
 841  * Parse variable from trustanchor header
 842  * @param line: to parse
 843  * @param anchors: the anchor is added to this, if "id:" is seen.
 844  * @param anchor: the anchor as result value or previously returned anchor
 845  *      value to read the variable lines into.
 846  * @return: 0 no match, -1 failed syntax error, +1 success line read.
 847  *      +2 revoked trust anchor file.
 848  */
 849 static int
 850 parse_var_line(char* line, struct val_anchors* anchors,
 851         struct trust_anchor** anchor)
 852 {
 853         struct trust_anchor* tp = *anchor;
 854         int r = 0;
 855         if(strncmp(line, ";;id: ", 6) == 0) {
 856                 *anchor = parse_id(anchors, line+6);
 857                 if(!*anchor) return -1;
 858                 else return 1;
 859         } else if(strncmp(line, ";;REVOKED", 9) == 0) {
 860                 if(tp) {
 861                         log_err("REVOKED statement must be at start of file");
 862                         return -1;
 863                 }
 864                 return 2;
 865         } else if(strncmp(line, ";;last_queried: ", 16) == 0) {
 866                 if(!tp) return -1;
 867                 lock_basic_lock(&tp->lock);
 868                 tp->autr->last_queried = (time_t)parse_int(line+16, &r);
 869                 lock_basic_unlock(&tp->lock);
 870         } else if(strncmp(line, ";;last_success: ", 16) == 0) {
 871                 if(!tp) return -1;
 872                 lock_basic_lock(&tp->lock);
 873                 tp->autr->last_success = (time_t)parse_int(line+16, &r);
 874                 lock_basic_unlock(&tp->lock);
 875         } else if(strncmp(line, ";;next_probe_time: ", 19) == 0) {
 876                 if(!tp) return -1;
 877                 lock_basic_lock(&anchors->lock);
 878                 lock_basic_lock(&tp->lock);
 879                 (void)rbtree_delete(&anchors->autr->probe, tp);
 880                 tp->autr->next_probe_time = (time_t)parse_int(line+19, &r);
 881                 (void)rbtree_insert(&anchors->autr->probe, &tp->autr->pnode);
 882                 lock_basic_unlock(&tp->lock);
 883                 lock_basic_unlock(&anchors->lock);
 884         } else if(strncmp(line, ";;query_failed: ", 16) == 0) {
 885                 if(!tp) return -1;
 886                 lock_basic_lock(&tp->lock);
 887                 tp->autr->query_failed = (uint8_t)parse_int(line+16, &r);
 888                 lock_basic_unlock(&tp->lock);
 889         } else if(strncmp(line, ";;query_interval: ", 18) == 0) {
 890                 if(!tp) return -1;
 891                 lock_basic_lock(&tp->lock);
 892                 tp->autr->query_interval = (time_t)parse_int(line+18, &r);
 893                 lock_basic_unlock(&tp->lock);
 894         } else if(strncmp(line, ";;retry_time: ", 14) == 0) {
 895                 if(!tp) return -1;
 896                 lock_basic_lock(&tp->lock);
 897                 tp->autr->retry_time = (time_t)parse_int(line+14, &r);
 898                 lock_basic_unlock(&tp->lock);
 899         }
 900         return r;
 901 }
 902
 903 /** handle origin lines */
 904 static int
 905 handle_origin(char* line, uint8_t** origin, size_t* origin_len)
 906 {
 907         size_t len = 0;
 908         while(isspace((unsigned char)*line))
 909                 line++;
 910         if(strncmp(line, "$ORIGIN", 7) != 0)
 911                 return 0;
 912         free(*origin);
 913         line += 7;
 914         while(isspace((unsigned char)*line))
 915                 line++;
 916         *origin = sldns_str2wire_dname(line, &len);
 917         *origin_len = len;
 918         if(!*origin)
 919                 log_warn("malloc failure or parse error in $ORIGIN");
 920         return 1;
 921 }
 922
 923 /** Read one line and put multiline RRs onto one line string */
 924 static int
 925 read_multiline(char* buf, size_t len, FILE* in, int* linenr)
 926 {
 927         char* pos = buf;
 928         size_t left = len;
 929         int depth = 0;
 930         buf[len-1] = 0;
 931         while(left > 0 && fgets(pos, (int)left, in) != NULL) {
 932                 size_t i, poslen = strlen(pos);
 933                 (*linenr)++;
 934
 935                 /* check what the new depth is after the line */
 936                 /* this routine cannot handle braces inside quotes,
 937                    say for TXT records, but this routine only has to read keys */
 938                 for(i=0; i<poslen; i++) {
 939                         if(pos[i] == '(') {
 940                                 depth++;
 941                         } else if(pos[i] == ')') {
 942                                 if(depth == 0) {
 943                                         log_err("mismatch: too many ')'");
 944                                         return -1;
 945                                 }
 946                                 depth--;
 947                         } else if(pos[i] == ';') {
 948                                 break;
 949                         }
 950                 }
 951
 952                 /* normal oneline or last line: keeps newline and comments */
 953                 if(depth == 0) {
 954                         return 1;
 955                 }
 956
 957                 /* more lines expected, snip off comments and newline */
 958                 if(poslen>0)
 959                         pos[poslen-1] = 0; /* strip newline */
 960                 if(strchr(pos, ';'))
 961                         strchr(pos, ';')[0] = 0; /* strip comments */
 962
 963                 /* move to paste other lines behind this one */
 964                 poslen = strlen(pos);
 965                 pos += poslen;
 966                 left -= poslen;
 967                 /* the newline is changed into a space */
 968                 if(left <= 2 /* space and eos */) {
 969                         log_err("line too long");
 970                         return -1;
 971                 }
 972                 pos[0] = ' ';
 973                 pos[1] = 0;
 974                 pos += 1;
 975                 left -= 1;
 976         }
 977         if(depth != 0) {
 978                 log_err("mismatch: too many '('");
 979                 return -1;
 980         }
 981         if(pos != buf)
 982                 return 1;
 983         return 0;
 984 }
 985
 986 int autr_read_file(struct val_anchors* anchors, const char* nm)
 987 {
 988         /* the file descriptor */
 989         FILE* fd;
 990         /* keep track of line numbers */
 991         int line_nr = 0;
 992         /* single line */
 993         char line[10240];
 994         /* trust point being read */
 995         struct trust_anchor *tp = NULL, *tp2;
 996         int r;
 997         /* for $ORIGIN parsing */
 998         uint8_t *origin=NULL, *prev=NULL;
 999         size_t origin_len=0, prev_len=0;
1000
1001         if (!(fd = fopen(nm, "r"))) {
1002                 log_err("unable to open %s for reading: %s",
1003                         nm, strerror(errno));
1004                 return 0;
1005         }
1006         verbose(VERB_ALGO, "reading autotrust anchor file %s", nm);
1007         while ( (r=read_multiline(line, sizeof(line), fd, &line_nr)) != 0) {
1008                 if(r == -1 || (r = parse_var_line(line, anchors, &tp)) == -1) {
1009                         log_err("could not parse auto-trust-anchor-file "
1010                                 "%s line %d", nm, line_nr);
1011                         fclose(fd);
1012                         free(origin);
1013                         free(prev);
1014                         return 0;
1015                 } else if(r == 1) {
1016                         continue;
1017                 } else if(r == 2) {
1018                         log_warn("trust anchor %s has been revoked", nm);
1019                         fclose(fd);
1020                         free(origin);
1021                         free(prev);
1022                         return 1;
1023                 }
1024                 if (!str_contains_data(line, ';'))
1025                         continue; /* empty lines allowed */
1026                 if(handle_origin(line, &origin, &origin_len))
1027                         continue;
1028                 r = 0;
1029                 if(!(tp2=load_trustanchor(anchors, line, nm, origin,
1030                         origin_len, &prev, &prev_len, &r))) {
1031                         if(!r) log_err("failed to load trust anchor from %s "
1032                                 "at line %i, skipping", nm, line_nr);
1033                         /* try to do the rest */
1034                         continue;
1035                 }
1036                 if(tp && tp != tp2) {
1037                         log_err("file %s has mismatching data inside: "
1038                                 "the file may only contain keys for one name, "
1039                                 "remove keys for other domain names", nm);
1040                         fclose(fd);
1041                         free(origin);
1042                         free(prev);
1043                         return 0;
1044                 }
1045                 tp = tp2;
1046         }
1047         fclose(fd);
1048         free(origin);
1049         free(prev);
1050         if(!tp) {
1051                 log_err("failed to read %s", nm);
1052                 return 0;
1053         }
1054
1055         /* now assemble the data into DNSKEY and DS packed rrsets */
1056         lock_basic_lock(&tp->lock);
1057         if(!autr_assemble(tp)) {
1058                 lock_basic_unlock(&tp->lock);
1059                 log_err("malloc failure assembling %s", nm);
1060                 return 0;
1061         }
1062         lock_basic_unlock(&tp->lock);
1063         return 1;
1064 }
1065
1066 /** string for a trustanchor state */
1067 static const char*
1068 trustanchor_state2str(autr_state_type s)
1069 {
1070         switch (s) {
1071                 case AUTR_STATE_START:       return "  START  ";
1072                 case AUTR_STATE_ADDPEND:     return " ADDPEND ";
1073                 case AUTR_STATE_VALID:       return "  VALID  ";
1074                 case AUTR_STATE_MISSING:     return " MISSING ";
1075                 case AUTR_STATE_REVOKED:     return " REVOKED ";
1076                 case AUTR_STATE_REMOVED:     return " REMOVED ";
1077         }
1078         return " UNKNOWN ";
1079 }
1080
1081 /** print ID to file */
1082 static int
1083 print_id(FILE* out, char* fname, uint8_t* nm, size_t nmlen, uint16_t dclass)
1084 {
1085         char* s = sldns_wire2str_dname(nm, nmlen);
1086         if(!s) {
1087                 log_err("malloc failure in write to %s", fname);
1088                 return 0;
1089         }
1090         if(fprintf(out, ";;id: %s %d\n", s, (int)dclass) < 0) {
1091                 log_err("could not write to %s: %s", fname, strerror(errno));
1092                 free(s);
1093                 return 0;
1094         }
1095         free(s);
1096         return 1;
1097 }
1098
1099 static int
1100 autr_write_contents(FILE* out, char* fn, struct trust_anchor* tp)
1101 {
1102         char tmi[32];
1103         struct autr_ta* ta;
1104         char* str;
1105
1106         /* write pretty header */
1107         if(fprintf(out, "; autotrust trust anchor file\n") < 0) {
1108                 log_err("could not write to %s: %s", fn, strerror(errno));
1109                 return 0;
1110         }
1111         if(tp->autr->revoked) {
1112                 if(fprintf(out, ";;REVOKED\n") < 0 ||
1113                    fprintf(out, "; The zone has all keys revoked, and is\n"
1114                         "; considered as if it has no trust anchors.\n"
1115                         "; the remainder of the file is the last probe.\n"
1116                         "; to restart the trust anchor, overwrite this file.\n"
1117                         "; with one containing valid DNSKEYs or DSes.\n") < 0) {
1118                    log_err("could not write to %s: %s", fn, strerror(errno));
1119                    return 0;
1120                 }
1121         }
1122         if(!print_id(out, fn, tp->name, tp->namelen, tp->dclass)) {
1123                 return 0;
1124         }
1125         if(fprintf(out, ";;last_queried: %u ;;%s",
1126                 (unsigned int)tp->autr->last_queried,
1127                 ctime_r(&(tp->autr->last_queried), tmi)) < 0 ||
1128            fprintf(out, ";;last_success: %u ;;%s",
1129                 (unsigned int)tp->autr->last_success,
1130                 ctime_r(&(tp->autr->last_success), tmi)) < 0 ||
1131            fprintf(out, ";;next_probe_time: %u ;;%s",
1132                 (unsigned int)tp->autr->next_probe_time,
1133                 ctime_r(&(tp->autr->next_probe_time), tmi)) < 0 ||
1134            fprintf(out, ";;query_failed: %d\n", (int)tp->autr->query_failed)<0
1135            || fprintf(out, ";;query_interval: %d\n",
1136            (int)tp->autr->query_interval) < 0 ||
1137            fprintf(out, ";;retry_time: %d\n", (int)tp->autr->retry_time) < 0) {
1138                 log_err("could not write to %s: %s", fn, strerror(errno));
1139                 return 0;
1140         }
1141
1142         /* write anchors */
1143         for(ta=tp->autr->keys; ta; ta=ta->next) {
1144                 /* by default do not store START and REMOVED keys */
1145                 if(ta->s == AUTR_STATE_START)
1146                         continue;
1147                 if(ta->s == AUTR_STATE_REMOVED)
1148                         continue;
1149                 /* only store keys */
1150                 if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len)
1151                         != LDNS_RR_TYPE_DNSKEY)
1152                         continue;
1153                 str = sldns_wire2str_rr(ta->rr, ta->rr_len);
1154                 if(!str || !str[0]) {
1155                         free(str);
1156                         log_err("malloc failure writing %s", fn);
1157                         return 0;
1158                 }
1159                 str[strlen(str)-1] = 0; /* remove newline */
1160                 if(fprintf(out, "%s ;;state=%d [%s] ;;count=%d "
1161                         ";;lastchange=%u ;;%s", str, (int)ta->s,
1162                         trustanchor_state2str(ta->s), (int)ta->pending_count,
1163                         (unsigned int)ta->last_change,
1164                         ctime_r(&(ta->last_change), tmi)) < 0) {
1165                    log_err("could not write to %s: %s", fn, strerror(errno));
1166                    free(str);
1167                    return 0;
1168                 }
1169                 free(str);
1170         }
1171         return 1;
1172 }
1173
1174 void autr_write_file(struct module_env* env, struct trust_anchor* tp)
1175 {
1176         FILE* out;
1177         char* fname = tp->autr->file;
1178         char tempf[2048];
1179         log_assert(tp->autr);
1180         if(!env) {
1181                 log_err("autr_write_file: Module environment is NULL.");
1182                 return;
1183         }
1184         /* unique name with pid number and thread number */
1185         snprintf(tempf, sizeof(tempf), "%s.%d-%d", fname, (int)getpid(),
1186                 env->worker?*(int*)env->worker:0);
1187         verbose(VERB_ALGO, "autotrust: write to disk: %s", tempf);
1188         out = fopen(tempf, "w");
1189         if(!out) {
1190                 fatal_exit("could not open autotrust file for writing, %s: %s",
1191                         tempf, strerror(errno));
1192                 return;
1193         }
1194         if(!autr_write_contents(out, tempf, tp)) {
1195                 /* failed to write contents (completely) */
1196                 fclose(out);
1197                 unlink(tempf);
1198                 fatal_exit("could not completely write: %s", fname);
1199                 return;
1200         }
1201         if(fflush(out) != 0)
1202                 log_err("could not fflush(%s): %s", fname, strerror(errno));
1203 #ifdef HAVE_FSYNC
1204         if(fsync(fileno(out)) != 0)
1205                 log_err("could not fsync(%s): %s", fname, strerror(errno));
1206 #else
1207         FlushFileBuffers((HANDLE)_get_osfhandle(_fileno(out)));
1208 #endif
1209         if(fclose(out) != 0) {
1210                 fatal_exit("could not complete write: %s: %s",
1211                         fname, strerror(errno));
1212                 unlink(tempf);
1213                 return;
1214         }
1215         /* success; overwrite actual file */
1216         verbose(VERB_ALGO, "autotrust: replaced %s", fname);
1217 #ifdef UB_ON_WINDOWS
1218         (void)unlink(fname); /* windows does not replace file with rename() */
1219 #endif
1220         if(rename(tempf, fname) < 0) {
1221                 fatal_exit("rename(%s to %s): %s", tempf, fname, strerror(errno));
1222         }
1223 }
1224
1225 /**
1226  * Verify if dnskey works for trust point
1227  * @param env: environment (with time) for verification
1228  * @param ve: validator environment (with options) for verification.
1229  * @param tp: trust point to verify with
1230  * @param rrset: DNSKEY rrset to verify.
1231  * @param qstate: qstate with region.
1232  * @return false on failure, true if verification successful.
1233  */
1234 static int
1235 verify_dnskey(struct module_env* env, struct val_env* ve,
1236         struct trust_anchor* tp, struct ub_packed_rrset_key* rrset,
1237         struct module_qstate* qstate)
1238 {
1239         char* reason = NULL;
1240         uint8_t sigalg[ALGO_NEEDS_MAX+1];
1241         int downprot = env->cfg->harden_algo_downgrade;
1242         enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve, rrset,
1243                 tp->ds_rrset, tp->dnskey_rrset, downprot?sigalg:NULL, &reason,
1244                 qstate);
1245         /* sigalg is ignored, it returns algorithms signalled to exist, but
1246          * in 5011 there are no other rrsets to check.  if downprot is
1247          * enabled, then it checks that the DNSKEY is signed with all
1248          * algorithms available in the trust store. */
1249         verbose(VERB_ALGO, "autotrust: validate DNSKEY with anchor: %s",
1250                 sec_status_to_string(sec));
1251         return sec == sec_status_secure;
1252 }
1253
1254 static int32_t
1255 rrsig_get_expiry(uint8_t* d, size_t len)
1256 {
1257         /* rrsig: 2(rdlen), 2(type) 1(alg) 1(v) 4(origttl), then 4(expi), (4)incep) */
1258         if(len < 2+8+4)
1259                 return 0;
1260         return sldns_read_uint32(d+2+8);
1261 }
1262
1263 /** Find minimum expiration interval from signatures */
1264 static time_t
1265 min_expiry(struct module_env* env, struct packed_rrset_data* dd)
1266 {
1267         size_t i;
1268         int32_t t, r = 15 * 24 * 3600; /* 15 days max */
1269         for(i=dd->count; i<dd->count+dd->rrsig_count; i++) {
1270                 t = rrsig_get_expiry(dd->rr_data[i], dd->rr_len[i]);
1271                 if((int32_t)t - (int32_t)*env->now > 0) {
1272                         t -= (int32_t)*env->now;
1273                         if(t < r)
1274                                 r = t;
1275                 }
1276         }
1277         return (time_t)r;
1278 }
1279
1280 /** Is rr self-signed revoked key */
1281 static int
1282 rr_is_selfsigned_revoked(struct module_env* env, struct val_env* ve,
1283         struct ub_packed_rrset_key* dnskey_rrset, size_t i,
1284         struct module_qstate* qstate)
1285 {
1286         enum sec_status sec;
1287         char* reason = NULL;
1288         verbose(VERB_ALGO, "seen REVOKE flag, check self-signed, rr %d",
1289                 (int)i);
1290         /* no algorithm downgrade protection necessary, if it is selfsigned
1291          * revoked it can be removed. */
1292         sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset, i,
1293                 &reason, LDNS_SECTION_ANSWER, qstate);
1294         return (sec == sec_status_secure);
1295 }
1296
1297 /** Set fetched value */
1298 static void
1299 seen_trustanchor(struct autr_ta* ta, uint8_t seen)
1300 {
1301         ta->fetched = seen;
1302         if(ta->pending_count < 250) /* no numerical overflow, please */
1303                 ta->pending_count++;
1304 }
1305
1306 /** set revoked value */
1307 static void
1308 seen_revoked_trustanchor(struct autr_ta* ta, uint8_t revoked)
1309 {
1310         ta->revoked = revoked;
1311 }
1312
1313 /** revoke a trust anchor */
1314 static void
1315 revoke_dnskey(struct autr_ta* ta, int off)
1316 {
1317         uint16_t flags;
1318         uint8_t* data;
1319         if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len) !=
1320                 LDNS_RR_TYPE_DNSKEY)
1321                 return;
1322         if(sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len) < 2)
1323                 return;
1324         data = sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len);
1325         flags = sldns_read_uint16(data);
1326         if (off && (flags&LDNS_KEY_REVOKE_KEY))
1327                 flags ^= LDNS_KEY_REVOKE_KEY; /* flip */
1328         else
1329                 flags |= LDNS_KEY_REVOKE_KEY;
1330         sldns_write_uint16(data, flags);
1331 }
1332
1333 /** Compare two RRs skipping the REVOKED bit. Pass rdata(no len) */
1334 static int
1335 dnskey_compare_skip_revbit(uint8_t* a, size_t a_len, uint8_t* b, size_t b_len)
1336 {
1337         size_t i;
1338         if(a_len != b_len)
1339                 return -1;
1340         /* compare RRs RDATA byte for byte. */
1341         for(i = 0; i < a_len; i++)
1342         {
1343                 uint8_t rdf1, rdf2;
1344                 rdf1 = a[i];
1345                 rdf2 = b[i];
1346                 if(i==1) {
1347                         /* this is the second part of the flags field */
1348                         rdf1 |= LDNS_KEY_REVOKE_KEY;
1349                         rdf2 |= LDNS_KEY_REVOKE_KEY;
1350                 }
1351                 if (rdf1 < rdf2)        return -1;
1352                 else if (rdf1 > rdf2)   return 1;
1353         }
1354         return 0;
1355 }
1356
1357
1358 /** compare trust anchor with rdata, 0 if equal. Pass rdata(no len) */
1359 static int
1360 ta_compare(struct autr_ta* a, uint16_t t, uint8_t* b, size_t b_len)
1361 {
1362         if(!a) return -1;
1363         else if(!b) return -1;
1364         else if(sldns_wirerr_get_type(a->rr, a->rr_len, a->dname_len) != t)
1365                 return (int)sldns_wirerr_get_type(a->rr, a->rr_len,
1366                         a->dname_len) - (int)t;
1367         else if(t == LDNS_RR_TYPE_DNSKEY) {
1368                 return dnskey_compare_skip_revbit(
1369                         sldns_wirerr_get_rdata(a->rr, a->rr_len, a->dname_len),
1370                         sldns_wirerr_get_rdatalen(a->rr, a->rr_len,
1371                         a->dname_len), b, b_len);
1372         }
1373         else if(t == LDNS_RR_TYPE_DS) {
1374                 if(sldns_wirerr_get_rdatalen(a->rr, a->rr_len, a->dname_len) !=
1375                         b_len)
1376                         return -1;
1377                 return memcmp(sldns_wirerr_get_rdata(a->rr,
1378                         a->rr_len, a->dname_len), b, b_len);
1379         }
1380         return -1;
1381 }
1382
1383 /**
1384  * Find key
1385  * @param tp: to search in
1386  * @param t: rr type of the rdata.
1387  * @param rdata: to look for  (no rdatalen in it)
1388  * @param rdata_len: length of rdata
1389  * @param result: returns NULL or the ta key looked for.
1390  * @return false on malloc failure during search. if true examine result.
1391  */
1392 static int
1393 find_key(struct trust_anchor* tp, uint16_t t, uint8_t* rdata, size_t rdata_len,
1394         struct autr_ta** result)
1395 {
1396         struct autr_ta* ta;
1397         if(!tp || !rdata) {
1398                 *result = NULL;
1399                 return 0;
1400         }
1401         for(ta=tp->autr->keys; ta; ta=ta->next) {
1402                 if(ta_compare(ta, t, rdata, rdata_len) == 0) {
1403                         *result = ta;
1404                         return 1;
1405                 }
1406         }
1407         *result = NULL;
1408         return 1;
1409 }
1410
1411 /** add key and clone RR and tp already locked. rdata without rdlen. */
1412 static struct autr_ta*
1413 add_key(struct trust_anchor* tp, uint32_t ttl, uint8_t* rdata, size_t rdata_len)
1414 {
1415         struct autr_ta* ta;
1416         uint8_t* rr;
1417         size_t rr_len, dname_len;
1418         uint16_t rrtype = htons(LDNS_RR_TYPE_DNSKEY);
1419         uint16_t rrclass = htons(LDNS_RR_CLASS_IN);
1420         uint16_t rdlen = htons(rdata_len);
1421         dname_len = tp->namelen;
1422         ttl = htonl(ttl);
1423         rr_len = dname_len + 10 /* type,class,ttl,rdatalen */ + rdata_len;
1424         rr = (uint8_t*)malloc(rr_len);
1425         if(!rr) return NULL;
1426         memmove(rr, tp->name, tp->namelen);
1427         memmove(rr+dname_len, &rrtype, 2);
1428         memmove(rr+dname_len+2, &rrclass, 2);
1429         memmove(rr+dname_len+4, &ttl, 4);
1430         memmove(rr+dname_len+8, &rdlen, 2);
1431         memmove(rr+dname_len+10, rdata, rdata_len);
1432         ta = autr_ta_create(rr, rr_len, dname_len);
1433         if(!ta) {
1434                 /* rr freed in autr_ta_create */
1435                 return NULL;
1436         }
1437         /* link in, tp already locked */
1438         ta->next = tp->autr->keys;
1439         tp->autr->keys = ta;
1440         return ta;
1441 }
1442
1443 /** get TTL from DNSKEY rrset */
1444 static time_t
1445 key_ttl(struct ub_packed_rrset_key* k)
1446 {
1447         struct packed_rrset_data* d = (struct packed_rrset_data*)k->entry.data;
1448         return d->ttl;
1449 }
1450
1451 /** update the time values for the trustpoint */
1452 static void
1453 set_tp_times(struct trust_anchor* tp, time_t rrsig_exp_interval,
1454         time_t origttl, int* changed)
1455 {
1456         time_t x, qi = tp->autr->query_interval, rt = tp->autr->retry_time;
1457
1458         /* x = MIN(15days, ttl/2, expire/2) */
1459         x = 15 * 24 * 3600;
1460         if(origttl/2 < x)
1461                 x = origttl/2;
1462         if(rrsig_exp_interval/2 < x)
1463                 x = rrsig_exp_interval/2;
1464         /* MAX(1hr, x) */
1465         if(!autr_permit_small_holddown) {
1466                 if(x < 3600)
1467                         tp->autr->query_interval = 3600;
1468                 else    tp->autr->query_interval = x;
1469         }       else    tp->autr->query_interval = x;
1470
1471         /* x= MIN(1day, ttl/10, expire/10) */
1472         x = 24 * 3600;
1473         if(origttl/10 < x)
1474                 x = origttl/10;
1475         if(rrsig_exp_interval/10 < x)
1476                 x = rrsig_exp_interval/10;
1477         /* MAX(1hr, x) */
1478         if(!autr_permit_small_holddown) {
1479                 if(x < 3600)
1480                         tp->autr->retry_time = 3600;
1481                 else    tp->autr->retry_time = x;
1482         }       else    tp->autr->retry_time = x;
1483
1484         if(qi != tp->autr->query_interval || rt != tp->autr->retry_time) {
1485                 *changed = 1;
1486                 verbose(VERB_ALGO, "orig_ttl is %d", (int)origttl);
1487                 verbose(VERB_ALGO, "rrsig_exp_interval is %d",
1488                         (int)rrsig_exp_interval);
1489                 verbose(VERB_ALGO, "query_interval: %d, retry_time: %d",
1490                         (int)tp->autr->query_interval,
1491                         (int)tp->autr->retry_time);
1492         }
1493 }
1494
1495 /** init events to zero */
1496 static void
1497 init_events(struct trust_anchor* tp)
1498 {
1499         struct autr_ta* ta;
1500         for(ta=tp->autr->keys; ta; ta=ta->next) {
1501                 ta->fetched = 0;
1502         }
1503 }
1504
1505 /** check for revoked keys without trusting any other information */
1506 static void
1507 check_contains_revoked(struct module_env* env, struct val_env* ve,
1508         struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1509         int* changed, struct module_qstate* qstate)
1510 {
1511         struct packed_rrset_data* dd = (struct packed_rrset_data*)
1512                 dnskey_rrset->entry.data;
1513         size_t i;
1514         log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1515         for(i=0; i<dd->count; i++) {
1516                 struct autr_ta* ta = NULL;
1517                 if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1518                         dd->rr_data[i]+2, dd->rr_len[i]-2) ||
1519                         !rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1520                         dd->rr_data[i]+2, dd->rr_len[i]-2))
1521                         continue; /* not a revoked KSK */
1522                 if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1523                         dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1524                         log_err("malloc failure");
1525                         continue; /* malloc fail in compare*/
1526                 }
1527                 if(!ta)
1528                         continue; /* key not found */
1529                 if(rr_is_selfsigned_revoked(env, ve, dnskey_rrset, i, qstate)) {
1530                         /* checked if there is an rrsig signed by this key. */
1531                         /* same keytag, but stored can be revoked already, so
1532                          * compare keytags, with +0 or +128(REVOKE flag) */
1533                         log_assert(dnskey_calc_keytag(dnskey_rrset, i)-128 ==
1534                                 sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1535                                 ta->rr, ta->rr_len, ta->dname_len),
1536                                 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1537                                 ta->dname_len)) ||
1538                                 dnskey_calc_keytag(dnskey_rrset, i) ==
1539                                 sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1540                                 ta->rr, ta->rr_len, ta->dname_len),
1541                                 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1542                                 ta->dname_len))); /* checks conversion*/
1543                         verbose_key(ta, VERB_ALGO, "is self-signed revoked");
1544                         if(!ta->revoked)
1545                                 *changed = 1;
1546                         seen_revoked_trustanchor(ta, 1);
1547                         do_revoked(env, ta, changed);
1548                 }
1549         }
1550 }
1551
1552 /** See if a DNSKEY is verified by one of the DSes */
1553 static int
1554 key_matches_a_ds(struct module_env* env, struct val_env* ve,
1555         struct ub_packed_rrset_key* dnskey_rrset, size_t key_idx,
1556         struct ub_packed_rrset_key* ds_rrset)
1557 {
1558         struct packed_rrset_data* dd = (struct packed_rrset_data*)
1559                         ds_rrset->entry.data;
1560         size_t ds_idx, num = dd->count;
1561         int d = val_favorite_ds_algo(ds_rrset);
1562         char* reason = "";
1563         for(ds_idx=0; ds_idx<num; ds_idx++) {
1564                 if(!ds_digest_algo_is_supported(ds_rrset, ds_idx) ||
1565                         !ds_key_algo_is_supported(ds_rrset, ds_idx) ||
1566                         ds_get_digest_algo(ds_rrset, ds_idx) != d)
1567                         continue;
1568                 if(ds_get_key_algo(ds_rrset, ds_idx)
1569                    != dnskey_get_algo(dnskey_rrset, key_idx)
1570                    || dnskey_calc_keytag(dnskey_rrset, key_idx)
1571                    != ds_get_keytag(ds_rrset, ds_idx)) {
1572                         continue;
1573                 }
1574                 if(!ds_digest_match_dnskey(env, dnskey_rrset, key_idx,
1575                         ds_rrset, ds_idx)) {
1576                         verbose(VERB_ALGO, "DS match attempt failed");
1577                         continue;
1578                 }
1579                 /* match of hash is sufficient for bootstrap of trust point */
1580                 (void)reason;
1581                 (void)ve;
1582                 return 1;
1583                 /* no need to check RRSIG, DS hash already matched with source
1584                 if(dnskey_verify_rrset(env, ve, dnskey_rrset,
1585                         dnskey_rrset, key_idx, &reason) == sec_status_secure) {
1586                         return 1;
1587                 } else {
1588                         verbose(VERB_ALGO, "DS match failed because the key "
1589                                 "does not verify the keyset: %s", reason);
1590                 }
1591                 */
1592         }
1593         return 0;
1594 }
1595
1596 /** Set update events */
1597 static int
1598 update_events(struct module_env* env, struct val_env* ve,
1599         struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1600         int* changed)
1601 {
1602         struct packed_rrset_data* dd = (struct packed_rrset_data*)
1603                 dnskey_rrset->entry.data;
1604         size_t i;
1605         log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1606         init_events(tp);
1607         for(i=0; i<dd->count; i++) {
1608                 struct autr_ta* ta = NULL;
1609                 if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1610                         dd->rr_data[i]+2, dd->rr_len[i]-2))
1611                         continue;
1612                 if(rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1613                         dd->rr_data[i]+2, dd->rr_len[i]-2)) {
1614                         /* self-signed revoked keys already detected before,
1615                          * other revoked keys are not 'added' again */
1616                         continue;
1617                 }
1618                 /* is a key of this type supported?. Note rr_list and
1619                  * packed_rrset are in the same order. */
1620                 if(!dnskey_algo_is_supported(dnskey_rrset, i)) {
1621                         /* skip unknown algorithm key, it is useless to us */
1622                         log_nametypeclass(VERB_DETAIL, "trust point has "
1623                                 "unsupported algorithm at",
1624                                 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
1625                         continue;
1626                 }
1627
1628                 /* is it new? if revocation bit set, find the unrevoked key */
1629                 if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1630                         dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1631                         return 0;
1632                 }
1633                 if(!ta) {
1634                         ta = add_key(tp, (uint32_t)dd->rr_ttl[i],
1635                                 dd->rr_data[i]+2, dd->rr_len[i]-2);
1636                         *changed = 1;
1637                         /* first time seen, do we have DSes? if match: VALID */
1638                         if(ta && tp->ds_rrset && key_matches_a_ds(env, ve,
1639                                 dnskey_rrset, i, tp->ds_rrset)) {
1640                                 verbose_key(ta, VERB_ALGO, "verified by DS");
1641                                 ta->s = AUTR_STATE_VALID;
1642                         }
1643                 }
1644                 if(!ta) {
1645                         return 0;
1646                 }
1647                 seen_trustanchor(ta, 1);
1648                 verbose_key(ta, VERB_ALGO, "in DNS response");
1649         }
1650         set_tp_times(tp, min_expiry(env, dd), key_ttl(dnskey_rrset), changed);
1651         return 1;
1652 }
1653
1654 /**
1655  * Check if the holddown time has already exceeded
1656  * setting: add-holddown: add holddown timer
1657  * setting: del-holddown: del holddown timer
1658  * @param env: environment with current time
1659  * @param ta: trust anchor to check for.
1660  * @param holddown: the timer value
1661  * @return number of seconds the holddown has passed.
1662  */
1663 static time_t
1664 check_holddown(struct module_env* env, struct autr_ta* ta,
1665         unsigned int holddown)
1666 {
1667         time_t elapsed;
1668         if(*env->now < ta->last_change) {
1669                 log_warn("time goes backwards. delaying key holddown");
1670                 return 0;
1671         }
1672         elapsed = *env->now - ta->last_change;
1673         if (elapsed > (time_t)holddown) {
1674                 return elapsed-(time_t)holddown;
1675         }
1676         verbose_key(ta, VERB_ALGO, "holddown time " ARG_LL "d seconds to go",
1677                 (long long) ((time_t)holddown-elapsed));
1678         return 0;
1679 }
1680
1681
1682 /** Set last_change to now */
1683 static void
1684 reset_holddown(struct module_env* env, struct autr_ta* ta, int* changed)
1685 {
1686         ta->last_change = *env->now;
1687         *changed = 1;
1688 }
1689
1690 /** Set the state for this trust anchor */
1691 static void
1692 set_trustanchor_state(struct module_env* env, struct autr_ta* ta, int* changed,
1693         autr_state_type s)
1694 {
1695         verbose_key(ta, VERB_ALGO, "update: %s to %s",
1696                 trustanchor_state2str(ta->s), trustanchor_state2str(s));
1697         ta->s = s;
1698         reset_holddown(env, ta, changed);
1699 }
1700
1701
1702 /** Event: NewKey */
1703 static void
1704 do_newkey(struct module_env* env, struct autr_ta* anchor, int* c)
1705 {
1706         if (anchor->s == AUTR_STATE_START)
1707                 set_trustanchor_state(env, anchor, c, AUTR_STATE_ADDPEND);
1708 }
1709
1710 /** Event: AddTime */
1711 static void
1712 do_addtime(struct module_env* env, struct autr_ta* anchor, int* c)
1713 {
1714         /* This not according to RFC, this is 30 days, but the RFC demands
1715          * MAX(30days, TTL expire time of first DNSKEY set with this key),
1716          * The value may be too small if a very large TTL was used. */
1717         time_t exceeded = check_holddown(env, anchor, env->cfg->add_holddown);
1718         if (exceeded && anchor->s == AUTR_STATE_ADDPEND) {
1719                 verbose_key(anchor, VERB_ALGO, "add-holddown time exceeded "
1720                         ARG_LL "d seconds ago, and pending-count %d",
1721                         (long long)exceeded, anchor->pending_count);
1722                 if(anchor->pending_count >= MIN_PENDINGCOUNT) {
1723                         set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1724                         anchor->pending_count = 0;
1725                         return;
1726                 }
1727                 verbose_key(anchor, VERB_ALGO, "add-holddown time sanity check "
1728                         "failed (pending count: %d)", anchor->pending_count);
1729         }
1730 }
1731
1732 /** Event: RemTime */
1733 static void
1734 do_remtime(struct module_env* env, struct autr_ta* anchor, int* c)
1735 {
1736         time_t exceeded = check_holddown(env, anchor, env->cfg->del_holddown);
1737         if(exceeded && anchor->s == AUTR_STATE_REVOKED) {
1738                 verbose_key(anchor, VERB_ALGO, "del-holddown time exceeded "
1739                         ARG_LL "d seconds ago", (long long)exceeded);
1740                 set_trustanchor_state(env, anchor, c, AUTR_STATE_REMOVED);
1741         }
1742 }
1743
1744 /** Event: KeyRem */
1745 static void
1746 do_keyrem(struct module_env* env, struct autr_ta* anchor, int* c)
1747 {
1748         if(anchor->s == AUTR_STATE_ADDPEND) {
1749                 set_trustanchor_state(env, anchor, c, AUTR_STATE_START);
1750                 anchor->pending_count = 0;
1751         } else if(anchor->s == AUTR_STATE_VALID)
1752                 set_trustanchor_state(env, anchor, c, AUTR_STATE_MISSING);
1753 }
1754
1755 /** Event: KeyPres */
1756 static void
1757 do_keypres(struct module_env* env, struct autr_ta* anchor, int* c)
1758 {
1759         if(anchor->s == AUTR_STATE_MISSING)
1760                 set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1761 }
1762
1763 /* Event: Revoked */
1764 static void
1765 do_revoked(struct module_env* env, struct autr_ta* anchor, int* c)
1766 {
1767         if(anchor->s == AUTR_STATE_VALID || anchor->s == AUTR_STATE_MISSING) {
1768                 set_trustanchor_state(env, anchor, c, AUTR_STATE_REVOKED);
1769                 verbose_key(anchor, VERB_ALGO, "old id, prior to revocation");
1770                 revoke_dnskey(anchor, 0);
1771                 verbose_key(anchor, VERB_ALGO, "new id, after revocation");
1772         }
1773 }
1774
1775 /** Do statestable transition matrix for anchor */
1776 static void
1777 anchor_state_update(struct module_env* env, struct autr_ta* anchor, int* c)
1778 {
1779         log_assert(anchor);
1780         switch(anchor->s) {
1781         /* START */
1782         case AUTR_STATE_START:
1783                 /* NewKey: ADDPEND */
1784                 if (anchor->fetched)
1785                         do_newkey(env, anchor, c);
1786                 break;
1787         /* ADDPEND */
1788         case AUTR_STATE_ADDPEND:
1789                 /* KeyRem: START */
1790                 if (!anchor->fetched)
1791                         do_keyrem(env, anchor, c);
1792                 /* AddTime: VALID */
1793                 else    do_addtime(env, anchor, c);
1794                 break;
1795         /* VALID */
1796         case AUTR_STATE_VALID:
1797                 /* RevBit: REVOKED */
1798                 if (anchor->revoked)
1799                         do_revoked(env, anchor, c);
1800                 /* KeyRem: MISSING */
1801                 else if (!anchor->fetched)
1802                         do_keyrem(env, anchor, c);
1803                 else if(!anchor->last_change) {
1804                         verbose_key(anchor, VERB_ALGO, "first seen");
1805                         reset_holddown(env, anchor, c);
1806                 }
1807                 break;
1808         /* MISSING */
1809         case AUTR_STATE_MISSING:
1810                 /* RevBit: REVOKED */
1811                 if (anchor->revoked)
1812                         do_revoked(env, anchor, c);
1813                 /* KeyPres */
1814                 else if (anchor->fetched)
1815                         do_keypres(env, anchor, c);
1816                 break;
1817         /* REVOKED */
1818         case AUTR_STATE_REVOKED:
1819                 if (anchor->fetched)
1820                         reset_holddown(env, anchor, c);
1821                 /* RemTime: REMOVED */
1822                 else    do_remtime(env, anchor, c);
1823                 break;
1824         /* REMOVED */
1825         case AUTR_STATE_REMOVED:
1826         default:
1827                 break;
1828         }
1829 }
1830
1831 /** if ZSK init then trust KSKs */
1832 static int
1833 init_zsk_to_ksk(struct module_env* env, struct trust_anchor* tp, int* changed)
1834 {
1835         /* search for VALID ZSKs */
1836         struct autr_ta* anchor;
1837         int validzsk = 0;
1838         int validksk = 0;
1839         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1840                 /* last_change test makes sure it was manually configured */
1841                 if(sldns_wirerr_get_type(anchor->rr, anchor->rr_len,
1842                         anchor->dname_len) == LDNS_RR_TYPE_DNSKEY &&
1843                         anchor->last_change == 0 &&
1844                         !ta_is_dnskey_sep(anchor) &&
1845                         anchor->s == AUTR_STATE_VALID)
1846                         validzsk++;
1847         }
1848         if(validzsk == 0)
1849                 return 0;
1850         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1851                 if (ta_is_dnskey_sep(anchor) &&
1852                         anchor->s == AUTR_STATE_ADDPEND) {
1853                         verbose_key(anchor, VERB_ALGO, "trust KSK from "
1854                                 "ZSK(config)");
1855                         set_trustanchor_state(env, anchor, changed,
1856                                 AUTR_STATE_VALID);
1857                         validksk++;
1858                 }
1859         }
1860         return validksk;
1861 }
1862
1863 /** Remove missing trustanchors so the list does not grow forever */
1864 static void
1865 remove_missing_trustanchors(struct module_env* env, struct trust_anchor* tp,
1866         int* changed)
1867 {
1868         struct autr_ta* anchor;
1869         time_t exceeded;
1870         int valid = 0;
1871         /* see if we have anchors that are valid */
1872         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1873                 /* Only do KSKs */
1874                 if (!ta_is_dnskey_sep(anchor))
1875                         continue;
1876                 if (anchor->s == AUTR_STATE_VALID)
1877                         valid++;
1878         }
1879         /* if there are no SEP Valid anchors, see if we started out with
1880          * a ZSK (last-change=0) anchor, which is VALID and there are KSKs
1881          * now that can be made valid.  Do this immediately because there
1882          * is no guarantee that the ZSKs get announced long enough.  Usually
1883          * this is immediately after init with a ZSK trusted, unless the domain
1884          * was not advertising any KSKs at all.  In which case we perfectly
1885          * track the zero number of KSKs. */
1886         if(valid == 0) {
1887                 valid = init_zsk_to_ksk(env, tp, changed);
1888                 if(valid == 0)
1889                         return;
1890         }
1891
1892         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1893                 /* ignore ZSKs if newly added */
1894                 if(anchor->s == AUTR_STATE_START)
1895                         continue;
1896                 /* remove ZSKs if a KSK is present */
1897                 if (!ta_is_dnskey_sep(anchor)) {
1898                         if(valid > 0) {
1899                                 verbose_key(anchor, VERB_ALGO, "remove ZSK "
1900                                         "[%d key(s) VALID]", valid);
1901                                 set_trustanchor_state(env, anchor, changed,
1902                                         AUTR_STATE_REMOVED);
1903                         }
1904                         continue;
1905                 }
1906                 /* Only do MISSING keys */
1907                 if (anchor->s != AUTR_STATE_MISSING)
1908                         continue;
1909                 if(env->cfg->keep_missing == 0)
1910                         continue; /* keep forever */
1911
1912                 exceeded = check_holddown(env, anchor, env->cfg->keep_missing);
1913                 /* If keep_missing has exceeded and we still have more than
1914                  * one valid KSK: remove missing trust anchor */
1915                 if (exceeded && valid > 0) {
1916                         verbose_key(anchor, VERB_ALGO, "keep-missing time "
1917                                 "exceeded " ARG_LL "d seconds ago, [%d key(s) VALID]",
1918                                 (long long)exceeded, valid);
1919                         set_trustanchor_state(env, anchor, changed,
1920                                 AUTR_STATE_REMOVED);
1921                 }
1922         }
1923 }
1924
1925 /** Do the statetable from RFC5011 transition matrix */
1926 static int
1927 do_statetable(struct module_env* env, struct trust_anchor* tp, int* changed)
1928 {
1929         struct autr_ta* anchor;
1930         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1931                 /* Only do KSKs */
1932                 if(!ta_is_dnskey_sep(anchor))
1933                         continue;
1934                 anchor_state_update(env, anchor, changed);
1935         }
1936         remove_missing_trustanchors(env, tp, changed);
1937         return 1;
1938 }
1939
1940 /** See if time alone makes ADDPEND to VALID transition */
1941 static void
1942 autr_holddown_exceed(struct module_env* env, struct trust_anchor* tp, int* c)
1943 {
1944         struct autr_ta* anchor;
1945         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1946                 if(ta_is_dnskey_sep(anchor) &&
1947                         anchor->s == AUTR_STATE_ADDPEND)
1948                         do_addtime(env, anchor, c);
1949         }
1950 }
1951
1952 /** cleanup key list */
1953 static void
1954 autr_cleanup_keys(struct trust_anchor* tp)
1955 {
1956         struct autr_ta* p, **prevp;
1957         prevp = &tp->autr->keys;
1958         p = tp->autr->keys;
1959         while(p) {
1960                 /* do we want to remove this key? */
1961                 if(p->s == AUTR_STATE_START || p->s == AUTR_STATE_REMOVED ||
1962                         sldns_wirerr_get_type(p->rr, p->rr_len, p->dname_len)
1963                         != LDNS_RR_TYPE_DNSKEY) {
1964                         struct autr_ta* np = p->next;
1965                         /* remove */
1966                         free(p->rr);
1967                         free(p);
1968                         /* snip and go to next item */
1969                         *prevp = np;
1970                         p = np;
1971                         continue;
1972                 }
1973                 /* remove pending counts if no longer pending */
1974                 if(p->s != AUTR_STATE_ADDPEND)
1975                         p->pending_count = 0;
1976                 prevp = &p->next;
1977                 p = p->next;
1978         }
1979 }
1980
1981 /** calculate next probe time */
1982 static time_t
1983 calc_next_probe(struct module_env* env, time_t wait)
1984 {
1985         /* make it random, 90-100% */
1986         time_t rnd, rest;
1987         if(!autr_permit_small_holddown) {
1988                 if(wait < 3600)
1989                         wait = 3600;
1990         } else {
1991                 if(wait == 0) wait = 1;
1992         }
1993         rnd = wait/10;
1994         rest = wait-rnd;
1995         rnd = (time_t)ub_random_max(env->rnd, (long int)rnd);
1996         return (time_t)(*env->now + rest + rnd);
1997 }
1998
1999 /** what is first probe time (anchors must be locked) */
2000 static time_t
2001 wait_probe_time(struct val_anchors* anchors)
2002 {
2003         rbnode_type* t = rbtree_first(&anchors->autr->probe);
2004         if(t != RBTREE_NULL)
2005                 return ((struct trust_anchor*)t->key)->autr->next_probe_time;
2006         return 0;
2007 }
2008
2009 /** reset worker timer */
2010 static void
2011 reset_worker_timer(struct module_env* env)
2012 {
2013         struct timeval tv;
2014 #ifndef S_SPLINT_S
2015         time_t next = (time_t)wait_probe_time(env->anchors);
2016         /* in case this is libunbound, no timer */
2017         if(!env->probe_timer)
2018                 return;
2019         if(next > *env->now)
2020                 tv.tv_sec = (time_t)(next - *env->now);
2021         else    tv.tv_sec = 0;
2022 #endif
2023         tv.tv_usec = 0;
2024         comm_timer_set(env->probe_timer, &tv);
2025         verbose(VERB_ALGO, "scheduled next probe in " ARG_LL "d sec", (long long)tv.tv_sec);
2026 }
2027
2028 /** set next probe for trust anchor */
2029 static int
2030 set_next_probe(struct module_env* env, struct trust_anchor* tp,
2031         struct ub_packed_rrset_key* dnskey_rrset)
2032 {
2033         struct trust_anchor key, *tp2;
2034         time_t mold, mnew;
2035         /* use memory allocated in rrset for temporary name storage */
2036         key.node.key = &key;
2037         key.name = dnskey_rrset->rk.dname;
2038         key.namelen = dnskey_rrset->rk.dname_len;
2039         key.namelabs = dname_count_labels(key.name);
2040         key.dclass = tp->dclass;
2041         lock_basic_unlock(&tp->lock);
2042
2043         /* fetch tp again and lock anchors, so that we can modify the trees */
2044         lock_basic_lock(&env->anchors->lock);
2045         tp2 = (struct trust_anchor*)rbtree_search(env->anchors->tree, &key);
2046         if(!tp2) {
2047                 verbose(VERB_ALGO, "trustpoint was deleted in set_next_probe");
2048                 lock_basic_unlock(&env->anchors->lock);
2049                 return 0;
2050         }
2051         log_assert(tp == tp2);
2052         lock_basic_lock(&tp->lock);
2053
2054         /* schedule */
2055         mold = wait_probe_time(env->anchors);
2056         (void)rbtree_delete(&env->anchors->autr->probe, tp);
2057         tp->autr->next_probe_time = calc_next_probe(env,
2058                 tp->autr->query_interval);
2059         (void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2060         mnew = wait_probe_time(env->anchors);
2061
2062         lock_basic_unlock(&env->anchors->lock);
2063         verbose(VERB_ALGO, "next probe set in %d seconds",
2064                 (int)tp->autr->next_probe_time - (int)*env->now);
2065         if(mold != mnew) {
2066                 reset_worker_timer(env);
2067         }
2068         return 1;
2069 }
2070
2071 /** Revoke and Delete a trust point */
2072 static void
2073 autr_tp_remove(struct module_env* env, struct trust_anchor* tp,
2074         struct ub_packed_rrset_key* dnskey_rrset)
2075 {
2076         struct trust_anchor* del_tp;
2077         struct trust_anchor key;
2078         struct autr_point_data pd;
2079         time_t mold, mnew;
2080
2081         log_nametypeclass(VERB_OPS, "trust point was revoked",
2082                 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2083         tp->autr->revoked = 1;
2084
2085         /* use space allocated for dnskey_rrset to save name of anchor */
2086         memset(&key, 0, sizeof(key));
2087         memset(&pd, 0, sizeof(pd));
2088         key.autr = &pd;
2089         key.node.key = &key;
2090         pd.pnode.key = &key;
2091         pd.next_probe_time = tp->autr->next_probe_time;
2092         key.name = dnskey_rrset->rk.dname;
2093         key.namelen = tp->namelen;
2094         key.namelabs = tp->namelabs;
2095         key.dclass = tp->dclass;
2096
2097         /* unlock */
2098         lock_basic_unlock(&tp->lock);
2099
2100         /* take from tree. It could be deleted by someone else,hence (void). */
2101         lock_basic_lock(&env->anchors->lock);
2102         del_tp = (struct trust_anchor*)rbtree_delete(env->anchors->tree, &key);
2103         mold = wait_probe_time(env->anchors);
2104         (void)rbtree_delete(&env->anchors->autr->probe, &key);
2105         mnew = wait_probe_time(env->anchors);
2106         anchors_init_parents_locked(env->anchors);
2107         lock_basic_unlock(&env->anchors->lock);
2108
2109         /* if !del_tp then the trust point is no longer present in the tree,
2110          * it was deleted by someone else, who will write the zonefile and
2111          * clean up the structure */
2112         if(del_tp) {
2113                 /* save on disk */
2114                 del_tp->autr->next_probe_time = 0; /* no more probing for it */
2115                 autr_write_file(env, del_tp);
2116
2117                 /* delete */
2118                 autr_point_delete(del_tp);
2119         }
2120         if(mold != mnew) {
2121                 reset_worker_timer(env);
2122         }
2123 }
2124
2125 int autr_process_prime(struct module_env* env, struct val_env* ve,
2126         struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
2127         struct module_qstate* qstate)
2128 {
2129         int changed = 0;
2130         log_assert(tp && tp->autr);
2131         /* autotrust update trust anchors */
2132         /* the tp is locked, and stays locked unless it is deleted */
2133
2134         /* we could just catch the anchor here while another thread
2135          * is busy deleting it. Just unlock and let the other do its job */
2136         if(tp->autr->revoked) {
2137                 log_nametypeclass(VERB_ALGO, "autotrust not processed, "
2138                         "trust point revoked", tp->name,
2139                         LDNS_RR_TYPE_DNSKEY, tp->dclass);
2140                 lock_basic_unlock(&tp->lock);
2141                 return 0; /* it is revoked */
2142         }
2143
2144         /* query_dnskeys(): */
2145         tp->autr->last_queried = *env->now;
2146
2147         log_nametypeclass(VERB_ALGO, "autotrust process for",
2148                 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2149         /* see if time alone makes some keys valid */
2150         autr_holddown_exceed(env, tp, &changed);
2151         if(changed) {
2152                 verbose(VERB_ALGO, "autotrust: morekeys, reassemble");
2153                 if(!autr_assemble(tp)) {
2154                         log_err("malloc failure assembling autotrust keys");
2155                         return 1; /* unchanged */
2156                 }
2157         }
2158         /* did we get any data? */
2159         if(!dnskey_rrset) {
2160                 verbose(VERB_ALGO, "autotrust: no dnskey rrset");
2161                 /* no update of query_failed, because then we would have
2162                  * to write to disk. But we cannot because we maybe are
2163                  * still 'initializing' with DS records, that we cannot write
2164                  * in the full format (which only contains KSKs). */
2165                 return 1; /* trust point exists */
2166         }
2167         /* check for revoked keys to remove immediately */
2168         check_contains_revoked(env, ve, tp, dnskey_rrset, &changed, qstate);
2169         if(changed) {
2170                 verbose(VERB_ALGO, "autotrust: revokedkeys, reassemble");
2171                 if(!autr_assemble(tp)) {
2172                         log_err("malloc failure assembling autotrust keys");
2173                         return 1; /* unchanged */
2174                 }
2175                 if(!tp->ds_rrset && !tp->dnskey_rrset) {
2176                         /* no more keys, all are revoked */
2177                         /* this is a success for this probe attempt */
2178                         tp->autr->last_success = *env->now;
2179                         autr_tp_remove(env, tp, dnskey_rrset);
2180                         return 0; /* trust point removed */
2181                 }
2182         }
2183         /* verify the dnskey rrset and see if it is valid. */
2184         if(!verify_dnskey(env, ve, tp, dnskey_rrset, qstate)) {
2185                 verbose(VERB_ALGO, "autotrust: dnskey did not verify.");
2186                 /* only increase failure count if this is not the first prime,
2187                  * this means there was a previous successful probe */
2188                 if(tp->autr->last_success) {
2189                         tp->autr->query_failed += 1;
2190                         autr_write_file(env, tp);
2191                 }
2192                 return 1; /* trust point exists */
2193         }
2194
2195         tp->autr->last_success = *env->now;
2196         tp->autr->query_failed = 0;
2197
2198         /* Add new trust anchors to the data structure
2199          * - note which trust anchors are seen this probe.
2200          * Set trustpoint query_interval and retry_time.
2201          * - find minimum rrsig expiration interval
2202          */
2203         if(!update_events(env, ve, tp, dnskey_rrset, &changed)) {
2204                 log_err("malloc failure in autotrust update_events. "
2205                         "trust point unchanged.");
2206                 return 1; /* trust point unchanged, so exists */
2207         }
2208
2209         /* - for every SEP key do the 5011 statetable.
2210          * - remove missing trustanchors (if veryold and we have new anchors).
2211          */
2212         if(!do_statetable(env, tp, &changed)) {
2213                 log_err("malloc failure in autotrust do_statetable. "
2214                         "trust point unchanged.");
2215                 return 1; /* trust point unchanged, so exists */
2216         }
2217
2218         autr_cleanup_keys(tp);
2219         if(!set_next_probe(env, tp, dnskey_rrset))
2220                 return 0; /* trust point does not exist */
2221         autr_write_file(env, tp);
2222         if(changed) {
2223                 verbose(VERB_ALGO, "autotrust: changed, reassemble");
2224                 if(!autr_assemble(tp)) {
2225                         log_err("malloc failure assembling autotrust keys");
2226                         return 1; /* unchanged */
2227                 }
2228                 if(!tp->ds_rrset && !tp->dnskey_rrset) {
2229                         /* no more keys, all are revoked */
2230                         autr_tp_remove(env, tp, dnskey_rrset);
2231                         return 0; /* trust point removed */
2232                 }
2233         } else verbose(VERB_ALGO, "autotrust: no changes");
2234
2235         return 1; /* trust point exists */
2236 }
2237
2238 /** debug print a trust anchor key */
2239 static void
2240 autr_debug_print_ta(struct autr_ta* ta)
2241 {
2242         char buf[32];
2243         char* str = sldns_wire2str_rr(ta->rr, ta->rr_len);
2244         if(!str) {
2245                 log_info("out of memory in debug_print_ta");
2246                 return;
2247         }
2248         if(str && str[0]) str[strlen(str)-1]=0; /* remove newline */
2249         ctime_r(&ta->last_change, buf);
2250         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2251         log_info("[%s] %s ;;state:%d ;;pending_count:%d%s%s last:%s",
2252                 trustanchor_state2str(ta->s), str, ta->s, ta->pending_count,
2253                 ta->fetched?" fetched":"", ta->revoked?" revoked":"", buf);
2254         free(str);
2255 }
2256
2257 /** debug print a trust point */
2258 static void
2259 autr_debug_print_tp(struct trust_anchor* tp)
2260 {
2261         struct autr_ta* ta;
2262         char buf[257];
2263         if(!tp->autr)
2264                 return;
2265         dname_str(tp->name, buf);
2266         log_info("trust point %s : %d", buf, (int)tp->dclass);
2267         log_info("assembled %d DS and %d DNSKEYs",
2268                 (int)tp->numDS, (int)tp->numDNSKEY);
2269         if(tp->ds_rrset) {
2270                 log_packed_rrset(0, "DS:", tp->ds_rrset);
2271         }
2272         if(tp->dnskey_rrset) {
2273                 log_packed_rrset(0, "DNSKEY:", tp->dnskey_rrset);
2274         }
2275         log_info("file %s", tp->autr->file);
2276         ctime_r(&tp->autr->last_queried, buf);
2277         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2278         log_info("last_queried: %u %s", (unsigned)tp->autr->last_queried, buf);
2279         ctime_r(&tp->autr->last_success, buf);
2280         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2281         log_info("last_success: %u %s", (unsigned)tp->autr->last_success, buf);
2282         ctime_r(&tp->autr->next_probe_time, buf);
2283         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2284         log_info("next_probe_time: %u %s", (unsigned)tp->autr->next_probe_time,
2285                 buf);
2286         log_info("query_interval: %u", (unsigned)tp->autr->query_interval);
2287         log_info("retry_time: %u", (unsigned)tp->autr->retry_time);
2288         log_info("query_failed: %u", (unsigned)tp->autr->query_failed);
2289
2290         for(ta=tp->autr->keys; ta; ta=ta->next) {
2291                 autr_debug_print_ta(ta);
2292         }
2293 }
2294
2295 void
2296 autr_debug_print(struct val_anchors* anchors)
2297 {
2298         struct trust_anchor* tp;
2299         lock_basic_lock(&anchors->lock);
2300         RBTREE_FOR(tp, struct trust_anchor*, anchors->tree) {
2301                 lock_basic_lock(&tp->lock);
2302                 autr_debug_print_tp(tp);
2303                 lock_basic_unlock(&tp->lock);
2304         }
2305         lock_basic_unlock(&anchors->lock);
2306 }
2307
2308 void probe_answer_cb(void* arg, int ATTR_UNUSED(rcode),
2309         sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(sec),
2310         char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
2311 {
2312         /* retry was set before the query was done,
2313          * re-querytime is set when query succeeded, but that may not
2314          * have reset this timer because the query could have been
2315          * handled by another thread. In that case, this callback would
2316          * get called after the original timeout is done.
2317          * By not resetting the timer, it may probe more often, but not
2318          * less often.
2319          * Unless the new lookup resulted in smaller TTLs and thus smaller
2320          * timeout values. In that case one old TTL could be mistakenly done.
2321          */
2322         struct module_env* env = (struct module_env*)arg;
2323         verbose(VERB_ALGO, "autotrust probe answer cb");
2324         reset_worker_timer(env);
2325 }
2326
2327 /** probe a trust anchor DNSKEY and unlocks tp */
2328 static void
2329 probe_anchor(struct module_env* env, struct trust_anchor* tp)
2330 {
2331         struct query_info qinfo;
2332         uint16_t qflags = BIT_RD;
2333         struct edns_data edns;
2334         sldns_buffer* buf = env->scratch_buffer;
2335         qinfo.qname = regional_alloc_init(env->scratch, tp->name, tp->namelen);
2336         if(!qinfo.qname) {
2337                 log_err("out of memory making 5011 probe");
2338                 return;
2339         }
2340         qinfo.qname_len = tp->namelen;
2341         qinfo.qtype = LDNS_RR_TYPE_DNSKEY;
2342         qinfo.qclass = tp->dclass;
2343         qinfo.local_alias = NULL;
2344         log_query_info(VERB_ALGO, "autotrust probe", &qinfo);
2345         verbose(VERB_ALGO, "retry probe set in %d seconds",
2346                 (int)tp->autr->next_probe_time - (int)*env->now);
2347         edns.edns_present = 1;
2348         edns.ext_rcode = 0;
2349         edns.edns_version = 0;
2350         edns.bits = EDNS_DO;
2351         edns.opt_list = NULL;
2352         if(sldns_buffer_capacity(buf) < 65535)
2353                 edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
2354         else    edns.udp_size = 65535;
2355
2356         /* can't hold the lock while mesh_run is processing */
2357         lock_basic_unlock(&tp->lock);
2358
2359         /* delete the DNSKEY from rrset and key cache so an active probe
2360          * is done. First the rrset so another thread does not use it
2361          * to recreate the key entry in a race condition. */
2362         rrset_cache_remove(env->rrset_cache, qinfo.qname, qinfo.qname_len,
2363                 qinfo.qtype, qinfo.qclass, 0);
2364         key_cache_remove(env->key_cache, qinfo.qname, qinfo.qname_len,
2365                 qinfo.qclass);
2366
2367         if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
2368                 &probe_answer_cb, env)) {
2369                 log_err("out of memory making 5011 probe");
2370         }
2371 }
2372
2373 /** fetch first to-probe trust-anchor and lock it and set retrytime */
2374 static struct trust_anchor*
2375 todo_probe(struct module_env* env, time_t* next)
2376 {
2377         struct trust_anchor* tp;
2378         rbnode_type* el;
2379         /* get first one */
2380         lock_basic_lock(&env->anchors->lock);
2381         if( (el=rbtree_first(&env->anchors->autr->probe)) == RBTREE_NULL) {
2382                 /* in case of revoked anchors */
2383                 lock_basic_unlock(&env->anchors->lock);
2384                 /* signal that there are no anchors to probe */
2385                 *next = 0;
2386                 return NULL;
2387         }
2388         tp = (struct trust_anchor*)el->key;
2389         lock_basic_lock(&tp->lock);
2390
2391         /* is it eligible? */
2392         if((time_t)tp->autr->next_probe_time > *env->now) {
2393                 /* no more to probe */
2394                 *next = (time_t)tp->autr->next_probe_time - *env->now;
2395                 lock_basic_unlock(&tp->lock);
2396                 lock_basic_unlock(&env->anchors->lock);
2397                 return NULL;
2398         }
2399
2400         /* reset its next probe time */
2401         (void)rbtree_delete(&env->anchors->autr->probe, tp);
2402         tp->autr->next_probe_time = calc_next_probe(env, tp->autr->retry_time);
2403         (void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2404         lock_basic_unlock(&env->anchors->lock);
2405
2406         return tp;
2407 }
2408
2409 time_t
2410 autr_probe_timer(struct module_env* env)
2411 {
2412         struct trust_anchor* tp;
2413         time_t next_probe = 3600;
2414         int num = 0;
2415         if(autr_permit_small_holddown) next_probe = 1;
2416         verbose(VERB_ALGO, "autotrust probe timer callback");
2417         /* while there are still anchors to probe */
2418         while( (tp = todo_probe(env, &next_probe)) ) {
2419                 /* make a probe for this anchor */
2420                 probe_anchor(env, tp);
2421                 num++;
2422         }
2423         regional_free_all(env->scratch);
2424         if(next_probe == 0)
2425                 return 0; /* no trust points to probe */
2426         verbose(VERB_ALGO, "autotrust probe timer %d callbacks done", num);
2427         return next_probe;
2428 }