contrib/unbound/validator/autotrust.c

   1 /*
   2  * validator/autotrust.c - RFC5011 trust anchor management for unbound.
   3  *
   4  * Copyright (c) 2009, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * Contains autotrust implementation. The implementation was taken from
  40  * the autotrust daemon (BSD licensed), written by Matthijs Mekking.
  41  * It was modified to fit into unbound. The state table process is the same.
  42  */
  43 #include "config.h"
  44 #include "validator/autotrust.h"
  45 #include "validator/val_anchor.h"
  46 #include "validator/val_utils.h"
  47 #include "validator/val_sigcrypt.h"
  48 #include "util/data/dname.h"
  49 #include "util/data/packed_rrset.h"
  50 #include "util/log.h"
  51 #include "util/module.h"
  52 #include "util/net_help.h"
  53 #include "util/config_file.h"
  54 #include "util/regional.h"
  55 #include "util/random.h"
  56 #include "util/data/msgparse.h"
  57 #include "services/mesh.h"
  58 #include "services/cache/rrset.h"
  59 #include "validator/val_kcache.h"
  60 #include "sldns/sbuffer.h"
  61 #include "sldns/wire2str.h"
  62 #include "sldns/str2wire.h"
  63 #include "sldns/keyraw.h"
  64 #include "sldns/rrdef.h"
  65 #include <stdarg.h>
  66 #include <ctype.h>
  67
  68 /** number of times a key must be seen before it can become valid */
  69 #define MIN_PENDINGCOUNT 2
  70
  71 /** Event: Revoked */
  72 static void do_revoked(struct module_env* env, struct autr_ta* anchor, int* c);
  73
  74 struct autr_global_data* autr_global_create(void)
  75 {
  76         struct autr_global_data* global;
  77         global = (struct autr_global_data*)malloc(sizeof(*global));
  78         if(!global)
  79                 return NULL;
  80         rbtree_init(&global->probe, &probetree_cmp);
  81         return global;
  82 }
  83
  84 void autr_global_delete(struct autr_global_data* global)
  85 {
  86         if(!global)
  87                 return;
  88         /* elements deleted by parent */
  89         memset(global, 0, sizeof(*global));
  90         free(global);
  91 }
  92
  93 int probetree_cmp(const void* x, const void* y)
  94 {
  95         struct trust_anchor* a = (struct trust_anchor*)x;
  96         struct trust_anchor* b = (struct trust_anchor*)y;
  97         log_assert(a->autr && b->autr);
  98         if(a->autr->next_probe_time < b->autr->next_probe_time)
  99                 return -1;
 100         if(a->autr->next_probe_time > b->autr->next_probe_time)
 101                 return 1;
 102         /* time is equal, sort on trust point identity */
 103         return anchor_cmp(x, y);
 104 }
 105
 106 size_t
 107 autr_get_num_anchors(struct val_anchors* anchors)
 108 {
 109         size_t res = 0;
 110         if(!anchors)
 111                 return 0;
 112         lock_basic_lock(&anchors->lock);
 113         if(anchors->autr)
 114                 res = anchors->autr->probe.count;
 115         lock_basic_unlock(&anchors->lock);
 116         return res;
 117 }
 118
 119 /** Position in string */
 120 static int
 121 position_in_string(char *str, const char* sub)
 122 {
 123         char* pos = strstr(str, sub);
 124         if(pos)
 125                 return (int)(pos-str)+(int)strlen(sub);
 126         return -1;
 127 }
 128
 129 /** Debug routine to print pretty key information */
 130 static void
 131 verbose_key(struct autr_ta* ta, enum verbosity_value level,
 132         const char* format, ...) ATTR_FORMAT(printf, 3, 4);
 133
 134 /**
 135  * Implementation of debug pretty key print
 136  * @param ta: trust anchor key with DNSKEY data.
 137  * @param level: verbosity level to print at.
 138  * @param format: printf style format string.
 139  */
 140 static void
 141 verbose_key(struct autr_ta* ta, enum verbosity_value level,
 142         const char* format, ...)
 143 {
 144         va_list args;
 145         va_start(args, format);
 146         if(verbosity >= level) {
 147                 char* str = sldns_wire2str_dname(ta->rr, ta->dname_len);
 148                 int keytag = (int)sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
 149                         ta->rr, ta->rr_len, ta->dname_len),
 150                         sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
 151                         ta->dname_len));
 152                 char msg[MAXSYSLOGMSGLEN];
 153                 vsnprintf(msg, sizeof(msg), format, args);
 154                 verbose(level, "%s key %d %s", str?str:"??", keytag, msg);
 155                 free(str);
 156         }
 157         va_end(args);
 158 }
 159
 160 /**
 161  * Parse comments
 162  * @param str: to parse
 163  * @param ta: trust key autotrust metadata
 164  * @return false on failure.
 165  */
 166 static int
 167 parse_comments(char* str, struct autr_ta* ta)
 168 {
 169         int len = (int)strlen(str), pos = 0, timestamp = 0;
 170         char* comment = (char*) malloc(sizeof(char)*len+1);
 171         char* comments = comment;
 172         if(!comment) {
 173                 log_err("malloc failure in parse");
 174                 return 0;
 175         }
 176         /* skip over whitespace and data at start of line */
 177         while (*str != '\0' && *str != ';')
 178                 str++;
 179         if (*str == ';')
 180                 str++;
 181         /* copy comments */
 182         while (*str != '\0')
 183         {
 184                 *comments = *str;
 185                 comments++;
 186                 str++;
 187         }
 188         *comments = '\0';
 189
 190         comments = comment;
 191
 192         /* read state */
 193         pos = position_in_string(comments, "state=");
 194         if (pos >= (int) strlen(comments))
 195         {
 196                 log_err("parse error");
 197                 free(comment);
 198                 return 0;
 199         }
 200         if (pos <= 0)
 201                 ta->s = AUTR_STATE_VALID;
 202         else
 203         {
 204                 int s = (int) comments[pos] - '0';
 205                 switch(s)
 206                 {
 207                         case AUTR_STATE_START:
 208                         case AUTR_STATE_ADDPEND:
 209                         case AUTR_STATE_VALID:
 210                         case AUTR_STATE_MISSING:
 211                         case AUTR_STATE_REVOKED:
 212                         case AUTR_STATE_REMOVED:
 213                                 ta->s = s;
 214                                 break;
 215                         default:
 216                                 verbose_key(ta, VERB_OPS, "has undefined "
 217                                         "state, considered NewKey");
 218                                 ta->s = AUTR_STATE_START;
 219                                 break;
 220                 }
 221         }
 222         /* read pending count */
 223         pos = position_in_string(comments, "count=");
 224         if (pos >= (int) strlen(comments))
 225         {
 226                 log_err("parse error");
 227                 free(comment);
 228                 return 0;
 229         }
 230         if (pos <= 0)
 231                 ta->pending_count = 0;
 232         else
 233         {
 234                 comments += pos;
 235                 ta->pending_count = (uint8_t)atoi(comments);
 236         }
 237
 238         /* read last change */
 239         pos = position_in_string(comments, "lastchange=");
 240         if (pos >= (int) strlen(comments))
 241         {
 242                 log_err("parse error");
 243                 free(comment);
 244                 return 0;
 245         }
 246         if (pos >= 0)
 247         {
 248                 comments += pos;
 249                 timestamp = atoi(comments);
 250         }
 251         if (pos < 0 || !timestamp)
 252                 ta->last_change = 0;
 253         else
 254                 ta->last_change = (time_t)timestamp;
 255
 256         free(comment);
 257         return 1;
 258 }
 259
 260 /** Check if a line contains data (besides comments) */
 261 static int
 262 str_contains_data(char* str, char comment)
 263 {
 264         while (*str != '\0') {
 265                 if (*str == comment || *str == '\n')
 266                         return 0;
 267                 if (*str != ' ' && *str != '\t')
 268                         return 1;
 269                 str++;
 270         }
 271         return 0;
 272 }
 273
 274 /** Get DNSKEY flags
 275  * rdata without rdatalen in front of it. */
 276 static int
 277 dnskey_flags(uint16_t t, uint8_t* rdata, size_t len)
 278 {
 279         uint16_t f;
 280         if(t != LDNS_RR_TYPE_DNSKEY)
 281                 return 0;
 282         if(len < 2)
 283                 return 0;
 284         memmove(&f, rdata, 2);
 285         f = ntohs(f);
 286         return (int)f;
 287 }
 288
 289 /** Check if KSK DNSKEY.
 290  * pass rdata without rdatalen in front of it */
 291 static int
 292 rr_is_dnskey_sep(uint16_t t, uint8_t* rdata, size_t len)
 293 {
 294         return (dnskey_flags(t, rdata, len)&DNSKEY_BIT_SEP);
 295 }
 296
 297 /** Check if TA is KSK DNSKEY */
 298 static int
 299 ta_is_dnskey_sep(struct autr_ta* ta)
 300 {
 301         return (dnskey_flags(
 302                 sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len),
 303                 sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len),
 304                 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len)
 305                 ) & DNSKEY_BIT_SEP);
 306 }
 307
 308 /** Check if REVOKED DNSKEY
 309  * pass rdata without rdatalen in front of it */
 310 static int
 311 rr_is_dnskey_revoked(uint16_t t, uint8_t* rdata, size_t len)
 312 {
 313         return (dnskey_flags(t, rdata, len)&LDNS_KEY_REVOKE_KEY);
 314 }
 315
 316 /** create ta */
 317 static struct autr_ta*
 318 autr_ta_create(uint8_t* rr, size_t rr_len, size_t dname_len)
 319 {
 320         struct autr_ta* ta = (struct autr_ta*)calloc(1, sizeof(*ta));
 321         if(!ta) {
 322                 free(rr);
 323                 return NULL;
 324         }
 325         ta->rr = rr;
 326         ta->rr_len = rr_len;
 327         ta->dname_len = dname_len;
 328         return ta;
 329 }
 330
 331 /** create tp */
 332 static struct trust_anchor*
 333 autr_tp_create(struct val_anchors* anchors, uint8_t* own, size_t own_len,
 334         uint16_t dc)
 335 {
 336         struct trust_anchor* tp = (struct trust_anchor*)calloc(1, sizeof(*tp));
 337         if(!tp) return NULL;
 338         tp->name = memdup(own, own_len);
 339         if(!tp->name) {
 340                 free(tp);
 341                 return NULL;
 342         }
 343         tp->namelen = own_len;
 344         tp->namelabs = dname_count_labels(tp->name);
 345         tp->node.key = tp;
 346         tp->dclass = dc;
 347         tp->autr = (struct autr_point_data*)calloc(1, sizeof(*tp->autr));
 348         if(!tp->autr) {
 349                 free(tp->name);
 350                 free(tp);
 351                 return NULL;
 352         }
 353         tp->autr->pnode.key = tp;
 354
 355         lock_basic_lock(&anchors->lock);
 356         if(!rbtree_insert(anchors->tree, &tp->node)) {
 357                 lock_basic_unlock(&anchors->lock);
 358                 log_err("trust anchor presented twice");
 359                 free(tp->name);
 360                 free(tp->autr);
 361                 free(tp);
 362                 return NULL;
 363         }
 364         if(!rbtree_insert(&anchors->autr->probe, &tp->autr->pnode)) {
 365                 (void)rbtree_delete(anchors->tree, tp);
 366                 lock_basic_unlock(&anchors->lock);
 367                 log_err("trust anchor in probetree twice");
 368                 free(tp->name);
 369                 free(tp->autr);
 370                 free(tp);
 371                 return NULL;
 372         }
 373         lock_basic_unlock(&anchors->lock);
 374         lock_basic_init(&tp->lock);
 375         lock_protect(&tp->lock, tp, sizeof(*tp));
 376         lock_protect(&tp->lock, tp->autr, sizeof(*tp->autr));
 377         return tp;
 378 }
 379
 380 /** delete assembled rrsets */
 381 static void
 382 autr_rrset_delete(struct ub_packed_rrset_key* r)
 383 {
 384         if(r) {
 385                 free(r->rk.dname);
 386                 free(r->entry.data);
 387                 free(r);
 388         }
 389 }
 390
 391 void autr_point_delete(struct trust_anchor* tp)
 392 {
 393         if(!tp)
 394                 return;
 395         lock_unprotect(&tp->lock, tp);
 396         lock_unprotect(&tp->lock, tp->autr);
 397         lock_basic_destroy(&tp->lock);
 398         autr_rrset_delete(tp->ds_rrset);
 399         autr_rrset_delete(tp->dnskey_rrset);
 400         if(tp->autr) {
 401                 struct autr_ta* p = tp->autr->keys, *np;
 402                 while(p) {
 403                         np = p->next;
 404                         free(p->rr);
 405                         free(p);
 406                         p = np;
 407                 }
 408                 free(tp->autr->file);
 409                 free(tp->autr);
 410         }
 411         free(tp->name);
 412         free(tp);
 413 }
 414
 415 /** find or add a new trust point for autotrust */
 416 static struct trust_anchor*
 417 find_add_tp(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
 418         size_t dname_len)
 419 {
 420         struct trust_anchor* tp;
 421         tp = anchor_find(anchors, rr, dname_count_labels(rr), dname_len,
 422                 sldns_wirerr_get_class(rr, rr_len, dname_len));
 423         if(tp) {
 424                 if(!tp->autr) {
 425                         log_err("anchor cannot be with and without autotrust");
 426                         lock_basic_unlock(&tp->lock);
 427                         return NULL;
 428                 }
 429                 return tp;
 430         }
 431         tp = autr_tp_create(anchors, rr, dname_len, sldns_wirerr_get_class(rr,
 432                 rr_len, dname_len));
 433         if(!tp)
 434                 return NULL;
 435         lock_basic_lock(&tp->lock);
 436         return tp;
 437 }
 438
 439 /** Add trust anchor from RR */
 440 static struct autr_ta*
 441 add_trustanchor_frm_rr(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
 442         size_t dname_len, struct trust_anchor** tp)
 443 {
 444         struct autr_ta* ta = autr_ta_create(rr, rr_len, dname_len);
 445         if(!ta)
 446                 return NULL;
 447         *tp = find_add_tp(anchors, rr, rr_len, dname_len);
 448         if(!*tp) {
 449                 free(ta->rr);
 450                 free(ta);
 451                 return NULL;
 452         }
 453         /* add ta to tp */
 454         ta->next = (*tp)->autr->keys;
 455         (*tp)->autr->keys = ta;
 456         lock_basic_unlock(&(*tp)->lock);
 457         return ta;
 458 }
 459
 460 /**
 461  * Add new trust anchor from a string in file.
 462  * @param anchors: all anchors
 463  * @param str: string with anchor and comments, if any comments.
 464  * @param tp: trust point returned.
 465  * @param origin: what to use for @
 466  * @param origin_len: length of origin
 467  * @param prev: previous rr name
 468  * @param prev_len: length of prev
 469  * @param skip: if true, the result is NULL, but not an error, skip it.
 470  * @return new key in trust point.
 471  */
 472 static struct autr_ta*
 473 add_trustanchor_frm_str(struct val_anchors* anchors, char* str,
 474         struct trust_anchor** tp, uint8_t* origin, size_t origin_len,
 475         uint8_t** prev, size_t* prev_len, int* skip)
 476 {
 477         uint8_t rr[LDNS_RR_BUF_SIZE];
 478         size_t rr_len = sizeof(rr), dname_len;
 479         uint8_t* drr;
 480         int lstatus;
 481         if (!str_contains_data(str, ';')) {
 482                 *skip = 1;
 483                 return NULL; /* empty line */
 484         }
 485         if(0 != (lstatus = sldns_str2wire_rr_buf(str, rr, &rr_len, &dname_len,
 486                 0, origin, origin_len, *prev, *prev_len)))
 487         {
 488                 log_err("ldns error while converting string to RR at%d: %s: %s",
 489                         LDNS_WIREPARSE_OFFSET(lstatus),
 490                         sldns_get_errorstr_parse(lstatus), str);
 491                 return NULL;
 492         }
 493         free(*prev);
 494         *prev = memdup(rr, dname_len);
 495         *prev_len = dname_len;
 496         if(!*prev) {
 497                 log_err("malloc failure in add_trustanchor");
 498                 return NULL;
 499         }
 500         if(sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DNSKEY &&
 501                 sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DS) {
 502                 *skip = 1;
 503                 return NULL; /* only DS and DNSKEY allowed */
 504         }
 505         drr = memdup(rr, rr_len);
 506         if(!drr) {
 507                 log_err("malloc failure in add trustanchor");
 508                 return NULL;
 509         }
 510         return add_trustanchor_frm_rr(anchors, drr, rr_len, dname_len, tp);
 511 }
 512
 513 /**
 514  * Load single anchor
 515  * @param anchors: all points.
 516  * @param str: comments line
 517  * @param fname: filename
 518  * @param origin: the $ORIGIN.
 519  * @param origin_len: length of origin
 520  * @param prev: passed to ldns.
 521  * @param prev_len: length of prev
 522  * @param skip: if true, the result is NULL, but not an error, skip it.
 523  * @return false on failure, otherwise the tp read.
 524  */
 525 static struct trust_anchor*
 526 load_trustanchor(struct val_anchors* anchors, char* str, const char* fname,
 527         uint8_t* origin, size_t origin_len, uint8_t** prev, size_t* prev_len,
 528         int* skip)
 529 {
 530         struct autr_ta* ta = NULL;
 531         struct trust_anchor* tp = NULL;
 532
 533         ta = add_trustanchor_frm_str(anchors, str, &tp, origin, origin_len,
 534                 prev, prev_len, skip);
 535         if(!ta)
 536                 return NULL;
 537         lock_basic_lock(&tp->lock);
 538         if(!parse_comments(str, ta)) {
 539                 lock_basic_unlock(&tp->lock);
 540                 return NULL;
 541         }
 542         if(!tp->autr->file) {
 543                 tp->autr->file = strdup(fname);
 544                 if(!tp->autr->file) {
 545                         lock_basic_unlock(&tp->lock);
 546                         log_err("malloc failure");
 547                         return NULL;
 548                 }
 549         }
 550         lock_basic_unlock(&tp->lock);
 551         return tp;
 552 }
 553
 554 /** iterator for DSes from keylist. return true if a next element exists */
 555 static int
 556 assemble_iterate_ds(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
 557         size_t* dname_len)
 558 {
 559         while(*list) {
 560                 if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
 561                         (*list)->dname_len) == LDNS_RR_TYPE_DS) {
 562                         *rr = (*list)->rr;
 563                         *rr_len = (*list)->rr_len;
 564                         *dname_len = (*list)->dname_len;
 565                         *list = (*list)->next;
 566                         return 1;
 567                 }
 568                 *list = (*list)->next;
 569         }
 570         return 0;
 571 }
 572
 573 /** iterator for DNSKEYs from keylist. return true if a next element exists */
 574 static int
 575 assemble_iterate_dnskey(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
 576         size_t* dname_len)
 577 {
 578         while(*list) {
 579                 if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
 580                    (*list)->dname_len) != LDNS_RR_TYPE_DS &&
 581                         ((*list)->s == AUTR_STATE_VALID ||
 582                          (*list)->s == AUTR_STATE_MISSING)) {
 583                         *rr = (*list)->rr;
 584                         *rr_len = (*list)->rr_len;
 585                         *dname_len = (*list)->dname_len;
 586                         *list = (*list)->next;
 587                         return 1;
 588                 }
 589                 *list = (*list)->next;
 590         }
 591         return 0;
 592 }
 593
 594 /** see if iterator-list has any elements in it, or it is empty */
 595 static int
 596 assemble_iterate_hasfirst(int iter(struct autr_ta**, uint8_t**, size_t*,
 597         size_t*), struct autr_ta* list)
 598 {
 599         uint8_t* rr = NULL;
 600         size_t rr_len = 0, dname_len = 0;
 601         return iter(&list, &rr, &rr_len, &dname_len);
 602 }
 603
 604 /** number of elements in iterator list */
 605 static size_t
 606 assemble_iterate_count(int iter(struct autr_ta**, uint8_t**, size_t*,
 607         size_t*), struct autr_ta* list)
 608 {
 609         uint8_t* rr = NULL;
 610         size_t i = 0, rr_len = 0, dname_len = 0;
 611         while(iter(&list, &rr, &rr_len, &dname_len)) {
 612                 i++;
 613         }
 614         return i;
 615 }
 616
 617 /**
 618  * Create a ub_packed_rrset_key allocated on the heap.
 619  * It therefore does not have the correct ID value, and cannot be used
 620  * inside the cache.  It can be used in storage outside of the cache.
 621  * Keys for the cache have to be obtained from alloc.h .
 622  * @param iter: iterator over the elements in the list.  It filters elements.
 623  * @param list: the list.
 624  * @return key allocated or NULL on failure.
 625  */
 626 static struct ub_packed_rrset_key*
 627 ub_packed_rrset_heap_key(int iter(struct autr_ta**, uint8_t**, size_t*,
 628         size_t*), struct autr_ta* list)
 629 {
 630         uint8_t* rr = NULL;
 631         size_t rr_len = 0, dname_len = 0;
 632         struct ub_packed_rrset_key* k;
 633         if(!iter(&list, &rr, &rr_len, &dname_len))
 634                 return NULL;
 635         k = (struct ub_packed_rrset_key*)calloc(1, sizeof(*k));
 636         if(!k)
 637                 return NULL;
 638         k->rk.type = htons(sldns_wirerr_get_type(rr, rr_len, dname_len));
 639         k->rk.rrset_class = htons(sldns_wirerr_get_class(rr, rr_len, dname_len));
 640         k->rk.dname_len = dname_len;
 641         k->rk.dname = memdup(rr, dname_len);
 642         if(!k->rk.dname) {
 643                 free(k);
 644                 return NULL;
 645         }
 646         return k;
 647 }
 648
 649 /**
 650  * Create packed_rrset data on the heap.
 651  * @param iter: iterator over the elements in the list.  It filters elements.
 652  * @param list: the list.
 653  * @return data allocated or NULL on failure.
 654  */
 655 static struct packed_rrset_data*
 656 packed_rrset_heap_data(int iter(struct autr_ta**, uint8_t**, size_t*,
 657         size_t*), struct autr_ta* list)
 658 {
 659         uint8_t* rr = NULL;
 660         size_t rr_len = 0, dname_len = 0;
 661         struct packed_rrset_data* data;
 662         size_t count=0, rrsig_count=0, len=0, i, total;
 663         uint8_t* nextrdata;
 664         struct autr_ta* list_i;
 665         time_t ttl = 0;
 666
 667         list_i = list;
 668         while(iter(&list_i, &rr, &rr_len, &dname_len)) {
 669                 if(sldns_wirerr_get_type(rr, rr_len, dname_len) ==
 670                         LDNS_RR_TYPE_RRSIG)
 671                         rrsig_count++;
 672                 else    count++;
 673                 /* sizeof the rdlength + rdatalen */
 674                 len += 2 + sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
 675                 ttl = (time_t)sldns_wirerr_get_ttl(rr, rr_len, dname_len);
 676         }
 677         if(count == 0 && rrsig_count == 0)
 678                 return NULL;
 679
 680         /* allocate */
 681         total = count + rrsig_count;
 682         len += sizeof(*data) + total*(sizeof(size_t) + sizeof(time_t) +
 683                 sizeof(uint8_t*));
 684         data = (struct packed_rrset_data*)calloc(1, len);
 685         if(!data)
 686                 return NULL;
 687
 688         /* fill it */
 689         data->ttl = ttl;
 690         data->count = count;
 691         data->rrsig_count = rrsig_count;
 692         data->rr_len = (size_t*)((uint8_t*)data +
 693                 sizeof(struct packed_rrset_data));
 694         data->rr_data = (uint8_t**)&(data->rr_len[total]);
 695         data->rr_ttl = (time_t*)&(data->rr_data[total]);
 696         nextrdata = (uint8_t*)&(data->rr_ttl[total]);
 697
 698         /* fill out len, ttl, fields */
 699         list_i = list;
 700         i = 0;
 701         while(iter(&list_i, &rr, &rr_len, &dname_len)) {
 702                 data->rr_ttl[i] = (time_t)sldns_wirerr_get_ttl(rr, rr_len,
 703                         dname_len);
 704                 if(data->rr_ttl[i] < data->ttl)
 705                         data->ttl = data->rr_ttl[i];
 706                 data->rr_len[i] = 2 /* the rdlength */ +
 707                         sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
 708                 i++;
 709         }
 710
 711         /* fixup rest of ptrs */
 712         for(i=0; i<total; i++) {
 713                 data->rr_data[i] = nextrdata;
 714                 nextrdata += data->rr_len[i];
 715         }
 716
 717         /* copy data in there */
 718         list_i = list;
 719         i = 0;
 720         while(iter(&list_i, &rr, &rr_len, &dname_len)) {
 721                 memmove(data->rr_data[i],
 722                         sldns_wirerr_get_rdatawl(rr, rr_len, dname_len),
 723                         data->rr_len[i]);
 724                 i++;
 725         }
 726
 727         if(data->rrsig_count && data->count == 0) {
 728                 data->count = data->rrsig_count; /* rrset type is RRSIG */
 729                 data->rrsig_count = 0;
 730         }
 731         return data;
 732 }
 733
 734 /**
 735  * Assemble the trust anchors into DS and DNSKEY packed rrsets.
 736  * Uses only VALID and MISSING DNSKEYs.
 737  * Read the sldns_rrs and builds packed rrsets
 738  * @param tp: the trust point. Must be locked.
 739  * @return false on malloc failure.
 740  */
 741 static int
 742 autr_assemble(struct trust_anchor* tp)
 743 {
 744         struct ub_packed_rrset_key* ubds=NULL, *ubdnskey=NULL;
 745
 746         /* make packed rrset keys - malloced with no ID number, they
 747          * are not in the cache */
 748         /* make packed rrset data (if there is a key) */
 749         if(assemble_iterate_hasfirst(assemble_iterate_ds, tp->autr->keys)) {
 750                 ubds = ub_packed_rrset_heap_key(
 751                         assemble_iterate_ds, tp->autr->keys);
 752                 if(!ubds)
 753                         goto error_cleanup;
 754                 ubds->entry.data = packed_rrset_heap_data(
 755                         assemble_iterate_ds, tp->autr->keys);
 756                 if(!ubds->entry.data)
 757                         goto error_cleanup;
 758         }
 759
 760         /* make packed DNSKEY data */
 761         if(assemble_iterate_hasfirst(assemble_iterate_dnskey, tp->autr->keys)) {
 762                 ubdnskey = ub_packed_rrset_heap_key(
 763                         assemble_iterate_dnskey, tp->autr->keys);
 764                 if(!ubdnskey)
 765                         goto error_cleanup;
 766                 ubdnskey->entry.data = packed_rrset_heap_data(
 767                         assemble_iterate_dnskey, tp->autr->keys);
 768                 if(!ubdnskey->entry.data) {
 769                 error_cleanup:
 770                         autr_rrset_delete(ubds);
 771                         autr_rrset_delete(ubdnskey);
 772                         return 0;
 773                 }
 774         }
 775
 776         /* we have prepared the new keys so nothing can go wrong any more.
 777          * And we are sure we cannot be left without trustanchor after
 778          * any errors. Put in the new keys and remove old ones. */
 779
 780         /* free the old data */
 781         autr_rrset_delete(tp->ds_rrset);
 782         autr_rrset_delete(tp->dnskey_rrset);
 783
 784         /* assign the data to replace the old */
 785         tp->ds_rrset = ubds;
 786         tp->dnskey_rrset = ubdnskey;
 787         tp->numDS = assemble_iterate_count(assemble_iterate_ds,
 788                 tp->autr->keys);
 789         tp->numDNSKEY = assemble_iterate_count(assemble_iterate_dnskey,
 790                 tp->autr->keys);
 791         return 1;
 792 }
 793
 794 /** parse integer */
 795 static unsigned int
 796 parse_int(char* line, int* ret)
 797 {
 798         char *e;
 799         unsigned int x = (unsigned int)strtol(line, &e, 10);
 800         if(line == e) {
 801                 *ret = -1; /* parse error */
 802                 return 0;
 803         }
 804         *ret = 1; /* matched */
 805         return x;
 806 }
 807
 808 /** parse id sequence for anchor */
 809 static struct trust_anchor*
 810 parse_id(struct val_anchors* anchors, char* line)
 811 {
 812         struct trust_anchor *tp;
 813         int r;
 814         uint16_t dclass;
 815         uint8_t* dname;
 816         size_t dname_len;
 817         /* read the owner name */
 818         char* next = strchr(line, ' ');
 819         if(!next)
 820                 return NULL;
 821         next[0] = 0;
 822         dname = sldns_str2wire_dname(line, &dname_len);
 823         if(!dname)
 824                 return NULL;
 825
 826         /* read the class */
 827         dclass = parse_int(next+1, &r);
 828         if(r == -1) {
 829                 free(dname);
 830                 return NULL;
 831         }
 832
 833         /* find the trust point */
 834         tp = autr_tp_create(anchors, dname, dname_len, dclass);
 835         free(dname);
 836         return tp;
 837 }
 838
 839 /**
 840  * Parse variable from trustanchor header
 841  * @param line: to parse
 842  * @param anchors: the anchor is added to this, if "id:" is seen.
 843  * @param anchor: the anchor as result value or previously returned anchor
 844  *      value to read the variable lines into.
 845  * @return: 0 no match, -1 failed syntax error, +1 success line read.
 846  *      +2 revoked trust anchor file.
 847  */
 848 static int
 849 parse_var_line(char* line, struct val_anchors* anchors,
 850         struct trust_anchor** anchor)
 851 {
 852         struct trust_anchor* tp = *anchor;
 853         int r = 0;
 854         if(strncmp(line, ";;id: ", 6) == 0) {
 855                 *anchor = parse_id(anchors, line+6);
 856                 if(!*anchor) return -1;
 857                 else return 1;
 858         } else if(strncmp(line, ";;REVOKED", 9) == 0) {
 859                 if(tp) {
 860                         log_err("REVOKED statement must be at start of file");
 861                         return -1;
 862                 }
 863                 return 2;
 864         } else if(strncmp(line, ";;last_queried: ", 16) == 0) {
 865                 if(!tp) return -1;
 866                 lock_basic_lock(&tp->lock);
 867                 tp->autr->last_queried = (time_t)parse_int(line+16, &r);
 868                 lock_basic_unlock(&tp->lock);
 869         } else if(strncmp(line, ";;last_success: ", 16) == 0) {
 870                 if(!tp) return -1;
 871                 lock_basic_lock(&tp->lock);
 872                 tp->autr->last_success = (time_t)parse_int(line+16, &r);
 873                 lock_basic_unlock(&tp->lock);
 874         } else if(strncmp(line, ";;next_probe_time: ", 19) == 0) {
 875                 if(!tp) return -1;
 876                 lock_basic_lock(&anchors->lock);
 877                 lock_basic_lock(&tp->lock);
 878                 (void)rbtree_delete(&anchors->autr->probe, tp);
 879                 tp->autr->next_probe_time = (time_t)parse_int(line+19, &r);
 880                 (void)rbtree_insert(&anchors->autr->probe, &tp->autr->pnode);
 881                 lock_basic_unlock(&tp->lock);
 882                 lock_basic_unlock(&anchors->lock);
 883         } else if(strncmp(line, ";;query_failed: ", 16) == 0) {
 884                 if(!tp) return -1;
 885                 lock_basic_lock(&tp->lock);
 886                 tp->autr->query_failed = (uint8_t)parse_int(line+16, &r);
 887                 lock_basic_unlock(&tp->lock);
 888         } else if(strncmp(line, ";;query_interval: ", 18) == 0) {
 889                 if(!tp) return -1;
 890                 lock_basic_lock(&tp->lock);
 891                 tp->autr->query_interval = (time_t)parse_int(line+18, &r);
 892                 lock_basic_unlock(&tp->lock);
 893         } else if(strncmp(line, ";;retry_time: ", 14) == 0) {
 894                 if(!tp) return -1;
 895                 lock_basic_lock(&tp->lock);
 896                 tp->autr->retry_time = (time_t)parse_int(line+14, &r);
 897                 lock_basic_unlock(&tp->lock);
 898         }
 899         return r;
 900 }
 901
 902 /** handle origin lines */
 903 static int
 904 handle_origin(char* line, uint8_t** origin, size_t* origin_len)
 905 {
 906         size_t len = 0;
 907         while(isspace((unsigned char)*line))
 908                 line++;
 909         if(strncmp(line, "$ORIGIN", 7) != 0)
 910                 return 0;
 911         free(*origin);
 912         line += 7;
 913         while(isspace((unsigned char)*line))
 914                 line++;
 915         *origin = sldns_str2wire_dname(line, &len);
 916         *origin_len = len;
 917         if(!*origin)
 918                 log_warn("malloc failure or parse error in $ORIGIN");
 919         return 1;
 920 }
 921
 922 /** Read one line and put multiline RRs onto one line string */
 923 static int
 924 read_multiline(char* buf, size_t len, FILE* in, int* linenr)
 925 {
 926         char* pos = buf;
 927         size_t left = len;
 928         int depth = 0;
 929         buf[len-1] = 0;
 930         while(left > 0 && fgets(pos, (int)left, in) != NULL) {
 931                 size_t i, poslen = strlen(pos);
 932                 (*linenr)++;
 933
 934                 /* check what the new depth is after the line */
 935                 /* this routine cannot handle braces inside quotes,
 936                    say for TXT records, but this routine only has to read keys */
 937                 for(i=0; i<poslen; i++) {
 938                         if(pos[i] == '(') {
 939                                 depth++;
 940                         } else if(pos[i] == ')') {
 941                                 if(depth == 0) {
 942                                         log_err("mismatch: too many ')'");
 943                                         return -1;
 944                                 }
 945                                 depth--;
 946                         } else if(pos[i] == ';') {
 947                                 break;
 948                         }
 949                 }
 950
 951                 /* normal oneline or last line: keeps newline and comments */
 952                 if(depth == 0) {
 953                         return 1;
 954                 }
 955
 956                 /* more lines expected, snip off comments and newline */
 957                 if(poslen>0)
 958                         pos[poslen-1] = 0; /* strip newline */
 959                 if(strchr(pos, ';'))
 960                         strchr(pos, ';')[0] = 0; /* strip comments */
 961
 962                 /* move to paste other lines behind this one */
 963                 poslen = strlen(pos);
 964                 pos += poslen;
 965                 left -= poslen;
 966                 /* the newline is changed into a space */
 967                 if(left <= 2 /* space and eos */) {
 968                         log_err("line too long");
 969                         return -1;
 970                 }
 971                 pos[0] = ' ';
 972                 pos[1] = 0;
 973                 pos += 1;
 974                 left -= 1;
 975         }
 976         if(depth != 0) {
 977                 log_err("mismatch: too many '('");
 978                 return -1;
 979         }
 980         if(pos != buf)
 981                 return 1;
 982         return 0;
 983 }
 984
 985 int autr_read_file(struct val_anchors* anchors, const char* nm)
 986 {
 987         /* the file descriptor */
 988         FILE* fd;
 989         /* keep track of line numbers */
 990         int line_nr = 0;
 991         /* single line */
 992         char line[10240];
 993         /* trust point being read */
 994         struct trust_anchor *tp = NULL, *tp2;
 995         int r;
 996         /* for $ORIGIN parsing */
 997         uint8_t *origin=NULL, *prev=NULL;
 998         size_t origin_len=0, prev_len=0;
 999
1000         if (!(fd = fopen(nm, "r"))) {
1001                 log_err("unable to open %s for reading: %s",
1002                         nm, strerror(errno));
1003                 return 0;
1004         }
1005         verbose(VERB_ALGO, "reading autotrust anchor file %s", nm);
1006         while ( (r=read_multiline(line, sizeof(line), fd, &line_nr)) != 0) {
1007                 if(r == -1 || (r = parse_var_line(line, anchors, &tp)) == -1) {
1008                         log_err("could not parse auto-trust-anchor-file "
1009                                 "%s line %d", nm, line_nr);
1010                         fclose(fd);
1011                         free(origin);
1012                         free(prev);
1013                         return 0;
1014                 } else if(r == 1) {
1015                         continue;
1016                 } else if(r == 2) {
1017                         log_warn("trust anchor %s has been revoked", nm);
1018                         fclose(fd);
1019                         free(origin);
1020                         free(prev);
1021                         return 1;
1022                 }
1023                 if (!str_contains_data(line, ';'))
1024                         continue; /* empty lines allowed */
1025                 if(handle_origin(line, &origin, &origin_len))
1026                         continue;
1027                 r = 0;
1028                 if(!(tp2=load_trustanchor(anchors, line, nm, origin,
1029                         origin_len, &prev, &prev_len, &r))) {
1030                         if(!r) log_err("failed to load trust anchor from %s "
1031                                 "at line %i, skipping", nm, line_nr);
1032                         /* try to do the rest */
1033                         continue;
1034                 }
1035                 if(tp && tp != tp2) {
1036                         log_err("file %s has mismatching data inside: "
1037                                 "the file may only contain keys for one name, "
1038                                 "remove keys for other domain names", nm);
1039                         fclose(fd);
1040                         free(origin);
1041                         free(prev);
1042                         return 0;
1043                 }
1044                 tp = tp2;
1045         }
1046         fclose(fd);
1047         free(origin);
1048         free(prev);
1049         if(!tp) {
1050                 log_err("failed to read %s", nm);
1051                 return 0;
1052         }
1053
1054         /* now assemble the data into DNSKEY and DS packed rrsets */
1055         lock_basic_lock(&tp->lock);
1056         if(!autr_assemble(tp)) {
1057                 lock_basic_unlock(&tp->lock);
1058                 log_err("malloc failure assembling %s", nm);
1059                 return 0;
1060         }
1061         lock_basic_unlock(&tp->lock);
1062         return 1;
1063 }
1064
1065 /** string for a trustanchor state */
1066 static const char*
1067 trustanchor_state2str(autr_state_type s)
1068 {
1069         switch (s) {
1070                 case AUTR_STATE_START:       return "  START  ";
1071                 case AUTR_STATE_ADDPEND:     return " ADDPEND ";
1072                 case AUTR_STATE_VALID:       return "  VALID  ";
1073                 case AUTR_STATE_MISSING:     return " MISSING ";
1074                 case AUTR_STATE_REVOKED:     return " REVOKED ";
1075                 case AUTR_STATE_REMOVED:     return " REMOVED ";
1076         }
1077         return " UNKNOWN ";
1078 }
1079
1080 /** print ID to file */
1081 static int
1082 print_id(FILE* out, char* fname, uint8_t* nm, size_t nmlen, uint16_t dclass)
1083 {
1084         char* s = sldns_wire2str_dname(nm, nmlen);
1085         if(!s) {
1086                 log_err("malloc failure in write to %s", fname);
1087                 return 0;
1088         }
1089         if(fprintf(out, ";;id: %s %d\n", s, (int)dclass) < 0) {
1090                 log_err("could not write to %s: %s", fname, strerror(errno));
1091                 free(s);
1092                 return 0;
1093         }
1094         free(s);
1095         return 1;
1096 }
1097
1098 static int
1099 autr_write_contents(FILE* out, char* fn, struct trust_anchor* tp)
1100 {
1101         char tmi[32];
1102         struct autr_ta* ta;
1103         char* str;
1104
1105         /* write pretty header */
1106         if(fprintf(out, "; autotrust trust anchor file\n") < 0) {
1107                 log_err("could not write to %s: %s", fn, strerror(errno));
1108                 return 0;
1109         }
1110         if(tp->autr->revoked) {
1111                 if(fprintf(out, ";;REVOKED\n") < 0 ||
1112                    fprintf(out, "; The zone has all keys revoked, and is\n"
1113                         "; considered as if it has no trust anchors.\n"
1114                         "; the remainder of the file is the last probe.\n"
1115                         "; to restart the trust anchor, overwrite this file.\n"
1116                         "; with one containing valid DNSKEYs or DSes.\n") < 0) {
1117                    log_err("could not write to %s: %s", fn, strerror(errno));
1118                    return 0;
1119                 }
1120         }
1121         if(!print_id(out, fn, tp->name, tp->namelen, tp->dclass)) {
1122                 return 0;
1123         }
1124         if(fprintf(out, ";;last_queried: %u ;;%s",
1125                 (unsigned int)tp->autr->last_queried,
1126                 ctime_r(&(tp->autr->last_queried), tmi)) < 0 ||
1127            fprintf(out, ";;last_success: %u ;;%s",
1128                 (unsigned int)tp->autr->last_success,
1129                 ctime_r(&(tp->autr->last_success), tmi)) < 0 ||
1130            fprintf(out, ";;next_probe_time: %u ;;%s",
1131                 (unsigned int)tp->autr->next_probe_time,
1132                 ctime_r(&(tp->autr->next_probe_time), tmi)) < 0 ||
1133            fprintf(out, ";;query_failed: %d\n", (int)tp->autr->query_failed)<0
1134            || fprintf(out, ";;query_interval: %d\n",
1135            (int)tp->autr->query_interval) < 0 ||
1136            fprintf(out, ";;retry_time: %d\n", (int)tp->autr->retry_time) < 0) {
1137                 log_err("could not write to %s: %s", fn, strerror(errno));
1138                 return 0;
1139         }
1140
1141         /* write anchors */
1142         for(ta=tp->autr->keys; ta; ta=ta->next) {
1143                 /* by default do not store START and REMOVED keys */
1144                 if(ta->s == AUTR_STATE_START)
1145                         continue;
1146                 if(ta->s == AUTR_STATE_REMOVED)
1147                         continue;
1148                 /* only store keys */
1149                 if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len)
1150                         != LDNS_RR_TYPE_DNSKEY)
1151                         continue;
1152                 str = sldns_wire2str_rr(ta->rr, ta->rr_len);
1153                 if(!str || !str[0]) {
1154                         free(str);
1155                         log_err("malloc failure writing %s", fn);
1156                         return 0;
1157                 }
1158                 str[strlen(str)-1] = 0; /* remove newline */
1159                 if(fprintf(out, "%s ;;state=%d [%s] ;;count=%d "
1160                         ";;lastchange=%u ;;%s", str, (int)ta->s,
1161                         trustanchor_state2str(ta->s), (int)ta->pending_count,
1162                         (unsigned int)ta->last_change,
1163                         ctime_r(&(ta->last_change), tmi)) < 0) {
1164                    log_err("could not write to %s: %s", fn, strerror(errno));
1165                    free(str);
1166                    return 0;
1167                 }
1168                 free(str);
1169         }
1170         return 1;
1171 }
1172
1173 void autr_write_file(struct module_env* env, struct trust_anchor* tp)
1174 {
1175         FILE* out;
1176         char* fname = tp->autr->file;
1177         char tempf[2048];
1178         log_assert(tp->autr);
1179         if(!env) {
1180                 log_err("autr_write_file: Module environment is NULL.");
1181                 return;
1182         }
1183         /* unique name with pid number and thread number */
1184         snprintf(tempf, sizeof(tempf), "%s.%d-%d", fname, (int)getpid(),
1185                 env->worker?*(int*)env->worker:0);
1186         verbose(VERB_ALGO, "autotrust: write to disk: %s", tempf);
1187         out = fopen(tempf, "w");
1188         if(!out) {
1189                 fatal_exit("could not open autotrust file for writing, %s: %s",
1190                         tempf, strerror(errno));
1191                 return;
1192         }
1193         if(!autr_write_contents(out, tempf, tp)) {
1194                 /* failed to write contents (completely) */
1195                 fclose(out);
1196                 unlink(tempf);
1197                 fatal_exit("could not completely write: %s", fname);
1198                 return;
1199         }
1200         if(fflush(out) != 0)
1201                 log_err("could not fflush(%s): %s", fname, strerror(errno));
1202 #ifdef HAVE_FSYNC
1203         if(fsync(fileno(out)) != 0)
1204                 log_err("could not fsync(%s): %s", fname, strerror(errno));
1205 #else
1206         FlushFileBuffers((HANDLE)_get_osfhandle(_fileno(out)));
1207 #endif
1208         if(fclose(out) != 0) {
1209                 fatal_exit("could not complete write: %s: %s",
1210                         fname, strerror(errno));
1211                 unlink(tempf);
1212                 return;
1213         }
1214         /* success; overwrite actual file */
1215         verbose(VERB_ALGO, "autotrust: replaced %s", fname);
1216 #ifdef UB_ON_WINDOWS
1217         (void)unlink(fname); /* windows does not replace file with rename() */
1218 #endif
1219         if(rename(tempf, fname) < 0) {
1220                 fatal_exit("rename(%s to %s): %s", tempf, fname, strerror(errno));
1221         }
1222 }
1223
1224 /**
1225  * Verify if dnskey works for trust point
1226  * @param env: environment (with time) for verification
1227  * @param ve: validator environment (with options) for verification.
1228  * @param tp: trust point to verify with
1229  * @param rrset: DNSKEY rrset to verify.
1230  * @param qstate: qstate with region.
1231  * @return false on failure, true if verification successful.
1232  */
1233 static int
1234 verify_dnskey(struct module_env* env, struct val_env* ve,
1235         struct trust_anchor* tp, struct ub_packed_rrset_key* rrset,
1236         struct module_qstate* qstate)
1237 {
1238         char* reason = NULL;
1239         uint8_t sigalg[ALGO_NEEDS_MAX+1];
1240         int downprot = env->cfg->harden_algo_downgrade;
1241         enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve, rrset,
1242                 tp->ds_rrset, tp->dnskey_rrset, downprot?sigalg:NULL, &reason,
1243                 qstate);
1244         /* sigalg is ignored, it returns algorithms signalled to exist, but
1245          * in 5011 there are no other rrsets to check.  if downprot is
1246          * enabled, then it checks that the DNSKEY is signed with all
1247          * algorithms available in the trust store. */
1248         verbose(VERB_ALGO, "autotrust: validate DNSKEY with anchor: %s",
1249                 sec_status_to_string(sec));
1250         return sec == sec_status_secure;
1251 }
1252
1253 static int32_t
1254 rrsig_get_expiry(uint8_t* d, size_t len)
1255 {
1256         /* rrsig: 2(rdlen), 2(type) 1(alg) 1(v) 4(origttl), then 4(expi), (4)incep) */
1257         if(len < 2+8+4)
1258                 return 0;
1259         return sldns_read_uint32(d+2+8);
1260 }
1261
1262 /** Find minimum expiration interval from signatures */
1263 static time_t
1264 min_expiry(struct module_env* env, struct packed_rrset_data* dd)
1265 {
1266         size_t i;
1267         int32_t t, r = 15 * 24 * 3600; /* 15 days max */
1268         for(i=dd->count; i<dd->count+dd->rrsig_count; i++) {
1269                 t = rrsig_get_expiry(dd->rr_data[i], dd->rr_len[i]);
1270                 if((int32_t)t - (int32_t)*env->now > 0) {
1271                         t -= (int32_t)*env->now;
1272                         if(t < r)
1273                                 r = t;
1274                 }
1275         }
1276         return (time_t)r;
1277 }
1278
1279 /** Is rr self-signed revoked key */
1280 static int
1281 rr_is_selfsigned_revoked(struct module_env* env, struct val_env* ve,
1282         struct ub_packed_rrset_key* dnskey_rrset, size_t i,
1283         struct module_qstate* qstate)
1284 {
1285         enum sec_status sec;
1286         char* reason = NULL;
1287         verbose(VERB_ALGO, "seen REVOKE flag, check self-signed, rr %d",
1288                 (int)i);
1289         /* no algorithm downgrade protection necessary, if it is selfsigned
1290          * revoked it can be removed. */
1291         sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset, i,
1292                 &reason, LDNS_SECTION_ANSWER, qstate);
1293         return (sec == sec_status_secure);
1294 }
1295
1296 /** Set fetched value */
1297 static void
1298 seen_trustanchor(struct autr_ta* ta, uint8_t seen)
1299 {
1300         ta->fetched = seen;
1301         if(ta->pending_count < 250) /* no numerical overflow, please */
1302                 ta->pending_count++;
1303 }
1304
1305 /** set revoked value */
1306 static void
1307 seen_revoked_trustanchor(struct autr_ta* ta, uint8_t revoked)
1308 {
1309         ta->revoked = revoked;
1310 }
1311
1312 /** revoke a trust anchor */
1313 static void
1314 revoke_dnskey(struct autr_ta* ta, int off)
1315 {
1316         uint16_t flags;
1317         uint8_t* data;
1318         if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len) !=
1319                 LDNS_RR_TYPE_DNSKEY)
1320                 return;
1321         if(sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len) < 2)
1322                 return;
1323         data = sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len);
1324         flags = sldns_read_uint16(data);
1325         if (off && (flags&LDNS_KEY_REVOKE_KEY))
1326                 flags ^= LDNS_KEY_REVOKE_KEY; /* flip */
1327         else
1328                 flags |= LDNS_KEY_REVOKE_KEY;
1329         sldns_write_uint16(data, flags);
1330 }
1331
1332 /** Compare two RRs skipping the REVOKED bit. Pass rdata(no len) */
1333 static int
1334 dnskey_compare_skip_revbit(uint8_t* a, size_t a_len, uint8_t* b, size_t b_len)
1335 {
1336         size_t i;
1337         if(a_len != b_len)
1338                 return -1;
1339         /* compare RRs RDATA byte for byte. */
1340         for(i = 0; i < a_len; i++)
1341         {
1342                 uint8_t rdf1, rdf2;
1343                 rdf1 = a[i];
1344                 rdf2 = b[i];
1345                 if(i==1) {
1346                         /* this is the second part of the flags field */
1347                         rdf1 |= LDNS_KEY_REVOKE_KEY;
1348                         rdf2 |= LDNS_KEY_REVOKE_KEY;
1349                 }
1350                 if (rdf1 < rdf2)        return -1;
1351                 else if (rdf1 > rdf2)   return 1;
1352         }
1353         return 0;
1354 }
1355
1356
1357 /** compare trust anchor with rdata, 0 if equal. Pass rdata(no len) */
1358 static int
1359 ta_compare(struct autr_ta* a, uint16_t t, uint8_t* b, size_t b_len)
1360 {
1361         if(!a) return -1;
1362         else if(!b) return -1;
1363         else if(sldns_wirerr_get_type(a->rr, a->rr_len, a->dname_len) != t)
1364                 return (int)sldns_wirerr_get_type(a->rr, a->rr_len,
1365                         a->dname_len) - (int)t;
1366         else if(t == LDNS_RR_TYPE_DNSKEY) {
1367                 return dnskey_compare_skip_revbit(
1368                         sldns_wirerr_get_rdata(a->rr, a->rr_len, a->dname_len),
1369                         sldns_wirerr_get_rdatalen(a->rr, a->rr_len,
1370                         a->dname_len), b, b_len);
1371         }
1372         else if(t == LDNS_RR_TYPE_DS) {
1373                 if(sldns_wirerr_get_rdatalen(a->rr, a->rr_len, a->dname_len) !=
1374                         b_len)
1375                         return -1;
1376                 return memcmp(sldns_wirerr_get_rdata(a->rr,
1377                         a->rr_len, a->dname_len), b, b_len);
1378         }
1379         return -1;
1380 }
1381
1382 /**
1383  * Find key
1384  * @param tp: to search in
1385  * @param t: rr type of the rdata.
1386  * @param rdata: to look for  (no rdatalen in it)
1387  * @param rdata_len: length of rdata
1388  * @param result: returns NULL or the ta key looked for.
1389  * @return false on malloc failure during search. if true examine result.
1390  */
1391 static int
1392 find_key(struct trust_anchor* tp, uint16_t t, uint8_t* rdata, size_t rdata_len,
1393         struct autr_ta** result)
1394 {
1395         struct autr_ta* ta;
1396         if(!tp || !rdata) {
1397                 *result = NULL;
1398                 return 0;
1399         }
1400         for(ta=tp->autr->keys; ta; ta=ta->next) {
1401                 if(ta_compare(ta, t, rdata, rdata_len) == 0) {
1402                         *result = ta;
1403                         return 1;
1404                 }
1405         }
1406         *result = NULL;
1407         return 1;
1408 }
1409
1410 /** add key and clone RR and tp already locked. rdata without rdlen. */
1411 static struct autr_ta*
1412 add_key(struct trust_anchor* tp, uint32_t ttl, uint8_t* rdata, size_t rdata_len)
1413 {
1414         struct autr_ta* ta;
1415         uint8_t* rr;
1416         size_t rr_len, dname_len;
1417         uint16_t rrtype = htons(LDNS_RR_TYPE_DNSKEY);
1418         uint16_t rrclass = htons(LDNS_RR_CLASS_IN);
1419         uint16_t rdlen = htons(rdata_len);
1420         dname_len = tp->namelen;
1421         ttl = htonl(ttl);
1422         rr_len = dname_len + 10 /* type,class,ttl,rdatalen */ + rdata_len;
1423         rr = (uint8_t*)malloc(rr_len);
1424         if(!rr) return NULL;
1425         memmove(rr, tp->name, tp->namelen);
1426         memmove(rr+dname_len, &rrtype, 2);
1427         memmove(rr+dname_len+2, &rrclass, 2);
1428         memmove(rr+dname_len+4, &ttl, 4);
1429         memmove(rr+dname_len+8, &rdlen, 2);
1430         memmove(rr+dname_len+10, rdata, rdata_len);
1431         ta = autr_ta_create(rr, rr_len, dname_len);
1432         if(!ta) {
1433                 /* rr freed in autr_ta_create */
1434                 return NULL;
1435         }
1436         /* link in, tp already locked */
1437         ta->next = tp->autr->keys;
1438         tp->autr->keys = ta;
1439         return ta;
1440 }
1441
1442 /** get TTL from DNSKEY rrset */
1443 static time_t
1444 key_ttl(struct ub_packed_rrset_key* k)
1445 {
1446         struct packed_rrset_data* d = (struct packed_rrset_data*)k->entry.data;
1447         return d->ttl;
1448 }
1449
1450 /** update the time values for the trustpoint */
1451 static void
1452 set_tp_times(struct trust_anchor* tp, time_t rrsig_exp_interval,
1453         time_t origttl, int* changed)
1454 {
1455         time_t x, qi = tp->autr->query_interval, rt = tp->autr->retry_time;
1456
1457         /* x = MIN(15days, ttl/2, expire/2) */
1458         x = 15 * 24 * 3600;
1459         if(origttl/2 < x)
1460                 x = origttl/2;
1461         if(rrsig_exp_interval/2 < x)
1462                 x = rrsig_exp_interval/2;
1463         /* MAX(1hr, x) */
1464         if(!autr_permit_small_holddown) {
1465                 if(x < 3600)
1466                         tp->autr->query_interval = 3600;
1467                 else    tp->autr->query_interval = x;
1468         }       else    tp->autr->query_interval = x;
1469
1470         /* x= MIN(1day, ttl/10, expire/10) */
1471         x = 24 * 3600;
1472         if(origttl/10 < x)
1473                 x = origttl/10;
1474         if(rrsig_exp_interval/10 < x)
1475                 x = rrsig_exp_interval/10;
1476         /* MAX(1hr, x) */
1477         if(!autr_permit_small_holddown) {
1478                 if(x < 3600)
1479                         tp->autr->retry_time = 3600;
1480                 else    tp->autr->retry_time = x;
1481         }       else    tp->autr->retry_time = x;
1482
1483         if(qi != tp->autr->query_interval || rt != tp->autr->retry_time) {
1484                 *changed = 1;
1485                 verbose(VERB_ALGO, "orig_ttl is %d", (int)origttl);
1486                 verbose(VERB_ALGO, "rrsig_exp_interval is %d",
1487                         (int)rrsig_exp_interval);
1488                 verbose(VERB_ALGO, "query_interval: %d, retry_time: %d",
1489                         (int)tp->autr->query_interval,
1490                         (int)tp->autr->retry_time);
1491         }
1492 }
1493
1494 /** init events to zero */
1495 static void
1496 init_events(struct trust_anchor* tp)
1497 {
1498         struct autr_ta* ta;
1499         for(ta=tp->autr->keys; ta; ta=ta->next) {
1500                 ta->fetched = 0;
1501         }
1502 }
1503
1504 /** check for revoked keys without trusting any other information */
1505 static void
1506 check_contains_revoked(struct module_env* env, struct val_env* ve,
1507         struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1508         int* changed, struct module_qstate* qstate)
1509 {
1510         struct packed_rrset_data* dd = (struct packed_rrset_data*)
1511                 dnskey_rrset->entry.data;
1512         size_t i;
1513         log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1514         for(i=0; i<dd->count; i++) {
1515                 struct autr_ta* ta = NULL;
1516                 if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1517                         dd->rr_data[i]+2, dd->rr_len[i]-2) ||
1518                         !rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1519                         dd->rr_data[i]+2, dd->rr_len[i]-2))
1520                         continue; /* not a revoked KSK */
1521                 if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1522                         dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1523                         log_err("malloc failure");
1524                         continue; /* malloc fail in compare*/
1525                 }
1526                 if(!ta)
1527                         continue; /* key not found */
1528                 if(rr_is_selfsigned_revoked(env, ve, dnskey_rrset, i, qstate)) {
1529                         /* checked if there is an rrsig signed by this key. */
1530                         /* same keytag, but stored can be revoked already, so
1531                          * compare keytags, with +0 or +128(REVOKE flag) */
1532                         log_assert(dnskey_calc_keytag(dnskey_rrset, i)-128 ==
1533                                 sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1534                                 ta->rr, ta->rr_len, ta->dname_len),
1535                                 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1536                                 ta->dname_len)) ||
1537                                 dnskey_calc_keytag(dnskey_rrset, i) ==
1538                                 sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1539                                 ta->rr, ta->rr_len, ta->dname_len),
1540                                 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1541                                 ta->dname_len))); /* checks conversion*/
1542                         verbose_key(ta, VERB_ALGO, "is self-signed revoked");
1543                         if(!ta->revoked)
1544                                 *changed = 1;
1545                         seen_revoked_trustanchor(ta, 1);
1546                         do_revoked(env, ta, changed);
1547                 }
1548         }
1549 }
1550
1551 /** See if a DNSKEY is verified by one of the DSes */
1552 static int
1553 key_matches_a_ds(struct module_env* env, struct val_env* ve,
1554         struct ub_packed_rrset_key* dnskey_rrset, size_t key_idx,
1555         struct ub_packed_rrset_key* ds_rrset)
1556 {
1557         struct packed_rrset_data* dd = (struct packed_rrset_data*)
1558                         ds_rrset->entry.data;
1559         size_t ds_idx, num = dd->count;
1560         int d = val_favorite_ds_algo(ds_rrset);
1561         char* reason = "";
1562         for(ds_idx=0; ds_idx<num; ds_idx++) {
1563                 if(!ds_digest_algo_is_supported(ds_rrset, ds_idx) ||
1564                         !ds_key_algo_is_supported(ds_rrset, ds_idx) ||
1565                         ds_get_digest_algo(ds_rrset, ds_idx) != d)
1566                         continue;
1567                 if(ds_get_key_algo(ds_rrset, ds_idx)
1568                    != dnskey_get_algo(dnskey_rrset, key_idx)
1569                    || dnskey_calc_keytag(dnskey_rrset, key_idx)
1570                    != ds_get_keytag(ds_rrset, ds_idx)) {
1571                         continue;
1572                 }
1573                 if(!ds_digest_match_dnskey(env, dnskey_rrset, key_idx,
1574                         ds_rrset, ds_idx)) {
1575                         verbose(VERB_ALGO, "DS match attempt failed");
1576                         continue;
1577                 }
1578                 /* match of hash is sufficient for bootstrap of trust point */
1579                 (void)reason;
1580                 (void)ve;
1581                 return 1;
1582                 /* no need to check RRSIG, DS hash already matched with source
1583                 if(dnskey_verify_rrset(env, ve, dnskey_rrset,
1584                         dnskey_rrset, key_idx, &reason) == sec_status_secure) {
1585                         return 1;
1586                 } else {
1587                         verbose(VERB_ALGO, "DS match failed because the key "
1588                                 "does not verify the keyset: %s", reason);
1589                 }
1590                 */
1591         }
1592         return 0;
1593 }
1594
1595 /** Set update events */
1596 static int
1597 update_events(struct module_env* env, struct val_env* ve,
1598         struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1599         int* changed)
1600 {
1601         struct packed_rrset_data* dd = (struct packed_rrset_data*)
1602                 dnskey_rrset->entry.data;
1603         size_t i;
1604         log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1605         init_events(tp);
1606         for(i=0; i<dd->count; i++) {
1607                 struct autr_ta* ta = NULL;
1608                 if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1609                         dd->rr_data[i]+2, dd->rr_len[i]-2))
1610                         continue;
1611                 if(rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1612                         dd->rr_data[i]+2, dd->rr_len[i]-2)) {
1613                         /* self-signed revoked keys already detected before,
1614                          * other revoked keys are not 'added' again */
1615                         continue;
1616                 }
1617                 /* is a key of this type supported?. Note rr_list and
1618                  * packed_rrset are in the same order. */
1619                 if(!dnskey_algo_is_supported(dnskey_rrset, i)) {
1620                         /* skip unknown algorithm key, it is useless to us */
1621                         log_nametypeclass(VERB_DETAIL, "trust point has "
1622                                 "unsupported algorithm at",
1623                                 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
1624                         continue;
1625                 }
1626
1627                 /* is it new? if revocation bit set, find the unrevoked key */
1628                 if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1629                         dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1630                         return 0;
1631                 }
1632                 if(!ta) {
1633                         ta = add_key(tp, (uint32_t)dd->rr_ttl[i],
1634                                 dd->rr_data[i]+2, dd->rr_len[i]-2);
1635                         *changed = 1;
1636                         /* first time seen, do we have DSes? if match: VALID */
1637                         if(ta && tp->ds_rrset && key_matches_a_ds(env, ve,
1638                                 dnskey_rrset, i, tp->ds_rrset)) {
1639                                 verbose_key(ta, VERB_ALGO, "verified by DS");
1640                                 ta->s = AUTR_STATE_VALID;
1641                         }
1642                 }
1643                 if(!ta) {
1644                         return 0;
1645                 }
1646                 seen_trustanchor(ta, 1);
1647                 verbose_key(ta, VERB_ALGO, "in DNS response");
1648         }
1649         set_tp_times(tp, min_expiry(env, dd), key_ttl(dnskey_rrset), changed);
1650         return 1;
1651 }
1652
1653 /**
1654  * Check if the holddown time has already exceeded
1655  * setting: add-holddown: add holddown timer
1656  * setting: del-holddown: del holddown timer
1657  * @param env: environment with current time
1658  * @param ta: trust anchor to check for.
1659  * @param holddown: the timer value
1660  * @return number of seconds the holddown has passed.
1661  */
1662 static time_t
1663 check_holddown(struct module_env* env, struct autr_ta* ta,
1664         unsigned int holddown)
1665 {
1666         time_t elapsed;
1667         if(*env->now < ta->last_change) {
1668                 log_warn("time goes backwards. delaying key holddown");
1669                 return 0;
1670         }
1671         elapsed = *env->now - ta->last_change;
1672         if (elapsed > (time_t)holddown) {
1673                 return elapsed-(time_t)holddown;
1674         }
1675         verbose_key(ta, VERB_ALGO, "holddown time " ARG_LL "d seconds to go",
1676                 (long long) ((time_t)holddown-elapsed));
1677         return 0;
1678 }
1679
1680
1681 /** Set last_change to now */
1682 static void
1683 reset_holddown(struct module_env* env, struct autr_ta* ta, int* changed)
1684 {
1685         ta->last_change = *env->now;
1686         *changed = 1;
1687 }
1688
1689 /** Set the state for this trust anchor */
1690 static void
1691 set_trustanchor_state(struct module_env* env, struct autr_ta* ta, int* changed,
1692         autr_state_type s)
1693 {
1694         verbose_key(ta, VERB_ALGO, "update: %s to %s",
1695                 trustanchor_state2str(ta->s), trustanchor_state2str(s));
1696         ta->s = s;
1697         reset_holddown(env, ta, changed);
1698 }
1699
1700
1701 /** Event: NewKey */
1702 static void
1703 do_newkey(struct module_env* env, struct autr_ta* anchor, int* c)
1704 {
1705         if (anchor->s == AUTR_STATE_START)
1706                 set_trustanchor_state(env, anchor, c, AUTR_STATE_ADDPEND);
1707 }
1708
1709 /** Event: AddTime */
1710 static void
1711 do_addtime(struct module_env* env, struct autr_ta* anchor, int* c)
1712 {
1713         /* This not according to RFC, this is 30 days, but the RFC demands
1714          * MAX(30days, TTL expire time of first DNSKEY set with this key),
1715          * The value may be too small if a very large TTL was used. */
1716         time_t exceeded = check_holddown(env, anchor, env->cfg->add_holddown);
1717         if (exceeded && anchor->s == AUTR_STATE_ADDPEND) {
1718                 verbose_key(anchor, VERB_ALGO, "add-holddown time exceeded "
1719                         ARG_LL "d seconds ago, and pending-count %d",
1720                         (long long)exceeded, anchor->pending_count);
1721                 if(anchor->pending_count >= MIN_PENDINGCOUNT) {
1722                         set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1723                         anchor->pending_count = 0;
1724                         return;
1725                 }
1726                 verbose_key(anchor, VERB_ALGO, "add-holddown time sanity check "
1727                         "failed (pending count: %d)", anchor->pending_count);
1728         }
1729 }
1730
1731 /** Event: RemTime */
1732 static void
1733 do_remtime(struct module_env* env, struct autr_ta* anchor, int* c)
1734 {
1735         time_t exceeded = check_holddown(env, anchor, env->cfg->del_holddown);
1736         if(exceeded && anchor->s == AUTR_STATE_REVOKED) {
1737                 verbose_key(anchor, VERB_ALGO, "del-holddown time exceeded "
1738                         ARG_LL "d seconds ago", (long long)exceeded);
1739                 set_trustanchor_state(env, anchor, c, AUTR_STATE_REMOVED);
1740         }
1741 }
1742
1743 /** Event: KeyRem */
1744 static void
1745 do_keyrem(struct module_env* env, struct autr_ta* anchor, int* c)
1746 {
1747         if(anchor->s == AUTR_STATE_ADDPEND) {
1748                 set_trustanchor_state(env, anchor, c, AUTR_STATE_START);
1749                 anchor->pending_count = 0;
1750         } else if(anchor->s == AUTR_STATE_VALID)
1751                 set_trustanchor_state(env, anchor, c, AUTR_STATE_MISSING);
1752 }
1753
1754 /** Event: KeyPres */
1755 static void
1756 do_keypres(struct module_env* env, struct autr_ta* anchor, int* c)
1757 {
1758         if(anchor->s == AUTR_STATE_MISSING)
1759                 set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1760 }
1761
1762 /* Event: Revoked */
1763 static void
1764 do_revoked(struct module_env* env, struct autr_ta* anchor, int* c)
1765 {
1766         if(anchor->s == AUTR_STATE_VALID || anchor->s == AUTR_STATE_MISSING) {
1767                 set_trustanchor_state(env, anchor, c, AUTR_STATE_REVOKED);
1768                 verbose_key(anchor, VERB_ALGO, "old id, prior to revocation");
1769                 revoke_dnskey(anchor, 0);
1770                 verbose_key(anchor, VERB_ALGO, "new id, after revocation");
1771         }
1772 }
1773
1774 /** Do statestable transition matrix for anchor */
1775 static void
1776 anchor_state_update(struct module_env* env, struct autr_ta* anchor, int* c)
1777 {
1778         log_assert(anchor);
1779         switch(anchor->s) {
1780         /* START */
1781         case AUTR_STATE_START:
1782                 /* NewKey: ADDPEND */
1783                 if (anchor->fetched)
1784                         do_newkey(env, anchor, c);
1785                 break;
1786         /* ADDPEND */
1787         case AUTR_STATE_ADDPEND:
1788                 /* KeyRem: START */
1789                 if (!anchor->fetched)
1790                         do_keyrem(env, anchor, c);
1791                 /* AddTime: VALID */
1792                 else    do_addtime(env, anchor, c);
1793                 break;
1794         /* VALID */
1795         case AUTR_STATE_VALID:
1796                 /* RevBit: REVOKED */
1797                 if (anchor->revoked)
1798                         do_revoked(env, anchor, c);
1799                 /* KeyRem: MISSING */
1800                 else if (!anchor->fetched)
1801                         do_keyrem(env, anchor, c);
1802                 else if(!anchor->last_change) {
1803                         verbose_key(anchor, VERB_ALGO, "first seen");
1804                         reset_holddown(env, anchor, c);
1805                 }
1806                 break;
1807         /* MISSING */
1808         case AUTR_STATE_MISSING:
1809                 /* RevBit: REVOKED */
1810                 if (anchor->revoked)
1811                         do_revoked(env, anchor, c);
1812                 /* KeyPres */
1813                 else if (anchor->fetched)
1814                         do_keypres(env, anchor, c);
1815                 break;
1816         /* REVOKED */
1817         case AUTR_STATE_REVOKED:
1818                 if (anchor->fetched)
1819                         reset_holddown(env, anchor, c);
1820                 /* RemTime: REMOVED */
1821                 else    do_remtime(env, anchor, c);
1822                 break;
1823         /* REMOVED */
1824         case AUTR_STATE_REMOVED:
1825         default:
1826                 break;
1827         }
1828 }
1829
1830 /** if ZSK init then trust KSKs */
1831 static int
1832 init_zsk_to_ksk(struct module_env* env, struct trust_anchor* tp, int* changed)
1833 {
1834         /* search for VALID ZSKs */
1835         struct autr_ta* anchor;
1836         int validzsk = 0;
1837         int validksk = 0;
1838         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1839                 /* last_change test makes sure it was manually configured */
1840                 if(sldns_wirerr_get_type(anchor->rr, anchor->rr_len,
1841                         anchor->dname_len) == LDNS_RR_TYPE_DNSKEY &&
1842                         anchor->last_change == 0 &&
1843                         !ta_is_dnskey_sep(anchor) &&
1844                         anchor->s == AUTR_STATE_VALID)
1845                         validzsk++;
1846         }
1847         if(validzsk == 0)
1848                 return 0;
1849         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1850                 if (ta_is_dnskey_sep(anchor) &&
1851                         anchor->s == AUTR_STATE_ADDPEND) {
1852                         verbose_key(anchor, VERB_ALGO, "trust KSK from "
1853                                 "ZSK(config)");
1854                         set_trustanchor_state(env, anchor, changed,
1855                                 AUTR_STATE_VALID);
1856                         validksk++;
1857                 }
1858         }
1859         return validksk;
1860 }
1861
1862 /** Remove missing trustanchors so the list does not grow forever */
1863 static void
1864 remove_missing_trustanchors(struct module_env* env, struct trust_anchor* tp,
1865         int* changed)
1866 {
1867         struct autr_ta* anchor;
1868         time_t exceeded;
1869         int valid = 0;
1870         /* see if we have anchors that are valid */
1871         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1872                 /* Only do KSKs */
1873                 if (!ta_is_dnskey_sep(anchor))
1874                         continue;
1875                 if (anchor->s == AUTR_STATE_VALID)
1876                         valid++;
1877         }
1878         /* if there are no SEP Valid anchors, see if we started out with
1879          * a ZSK (last-change=0) anchor, which is VALID and there are KSKs
1880          * now that can be made valid.  Do this immediately because there
1881          * is no guarantee that the ZSKs get announced long enough.  Usually
1882          * this is immediately after init with a ZSK trusted, unless the domain
1883          * was not advertising any KSKs at all.  In which case we perfectly
1884          * track the zero number of KSKs. */
1885         if(valid == 0) {
1886                 valid = init_zsk_to_ksk(env, tp, changed);
1887                 if(valid == 0)
1888                         return;
1889         }
1890
1891         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1892                 /* ignore ZSKs if newly added */
1893                 if(anchor->s == AUTR_STATE_START)
1894                         continue;
1895                 /* remove ZSKs if a KSK is present */
1896                 if (!ta_is_dnskey_sep(anchor)) {
1897                         if(valid > 0) {
1898                                 verbose_key(anchor, VERB_ALGO, "remove ZSK "
1899                                         "[%d key(s) VALID]", valid);
1900                                 set_trustanchor_state(env, anchor, changed,
1901                                         AUTR_STATE_REMOVED);
1902                         }
1903                         continue;
1904                 }
1905                 /* Only do MISSING keys */
1906                 if (anchor->s != AUTR_STATE_MISSING)
1907                         continue;
1908                 if(env->cfg->keep_missing == 0)
1909                         continue; /* keep forever */
1910
1911                 exceeded = check_holddown(env, anchor, env->cfg->keep_missing);
1912                 /* If keep_missing has exceeded and we still have more than
1913                  * one valid KSK: remove missing trust anchor */
1914                 if (exceeded && valid > 0) {
1915                         verbose_key(anchor, VERB_ALGO, "keep-missing time "
1916                                 "exceeded " ARG_LL "d seconds ago, [%d key(s) VALID]",
1917                                 (long long)exceeded, valid);
1918                         set_trustanchor_state(env, anchor, changed,
1919                                 AUTR_STATE_REMOVED);
1920                 }
1921         }
1922 }
1923
1924 /** Do the statetable from RFC5011 transition matrix */
1925 static int
1926 do_statetable(struct module_env* env, struct trust_anchor* tp, int* changed)
1927 {
1928         struct autr_ta* anchor;
1929         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1930                 /* Only do KSKs */
1931                 if(!ta_is_dnskey_sep(anchor))
1932                         continue;
1933                 anchor_state_update(env, anchor, changed);
1934         }
1935         remove_missing_trustanchors(env, tp, changed);
1936         return 1;
1937 }
1938
1939 /** See if time alone makes ADDPEND to VALID transition */
1940 static void
1941 autr_holddown_exceed(struct module_env* env, struct trust_anchor* tp, int* c)
1942 {
1943         struct autr_ta* anchor;
1944         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1945                 if(ta_is_dnskey_sep(anchor) &&
1946                         anchor->s == AUTR_STATE_ADDPEND)
1947                         do_addtime(env, anchor, c);
1948         }
1949 }
1950
1951 /** cleanup key list */
1952 static void
1953 autr_cleanup_keys(struct trust_anchor* tp)
1954 {
1955         struct autr_ta* p, **prevp;
1956         prevp = &tp->autr->keys;
1957         p = tp->autr->keys;
1958         while(p) {
1959                 /* do we want to remove this key? */
1960                 if(p->s == AUTR_STATE_START || p->s == AUTR_STATE_REMOVED ||
1961                         sldns_wirerr_get_type(p->rr, p->rr_len, p->dname_len)
1962                         != LDNS_RR_TYPE_DNSKEY) {
1963                         struct autr_ta* np = p->next;
1964                         /* remove */
1965                         free(p->rr);
1966                         free(p);
1967                         /* snip and go to next item */
1968                         *prevp = np;
1969                         p = np;
1970                         continue;
1971                 }
1972                 /* remove pending counts if no longer pending */
1973                 if(p->s != AUTR_STATE_ADDPEND)
1974                         p->pending_count = 0;
1975                 prevp = &p->next;
1976                 p = p->next;
1977         }
1978 }
1979
1980 /** calculate next probe time */
1981 static time_t
1982 calc_next_probe(struct module_env* env, time_t wait)
1983 {
1984         /* make it random, 90-100% */
1985         time_t rnd, rest;
1986         if(!autr_permit_small_holddown) {
1987                 if(wait < 3600)
1988                         wait = 3600;
1989         } else {
1990                 if(wait == 0) wait = 1;
1991         }
1992         rnd = wait/10;
1993         rest = wait-rnd;
1994         rnd = (time_t)ub_random_max(env->rnd, (long int)rnd);
1995         return (time_t)(*env->now + rest + rnd);
1996 }
1997
1998 /** what is first probe time (anchors must be locked) */
1999 static time_t
2000 wait_probe_time(struct val_anchors* anchors)
2001 {
2002         rbnode_type* t = rbtree_first(&anchors->autr->probe);
2003         if(t != RBTREE_NULL)
2004                 return ((struct trust_anchor*)t->key)->autr->next_probe_time;
2005         return 0;
2006 }
2007
2008 /** reset worker timer */
2009 static void
2010 reset_worker_timer(struct module_env* env)
2011 {
2012         struct timeval tv;
2013 #ifndef S_SPLINT_S
2014         time_t next = (time_t)wait_probe_time(env->anchors);
2015         /* in case this is libunbound, no timer */
2016         if(!env->probe_timer)
2017                 return;
2018         if(next > *env->now)
2019                 tv.tv_sec = (time_t)(next - *env->now);
2020         else    tv.tv_sec = 0;
2021 #endif
2022         tv.tv_usec = 0;
2023         comm_timer_set(env->probe_timer, &tv);
2024         verbose(VERB_ALGO, "scheduled next probe in " ARG_LL "d sec", (long long)tv.tv_sec);
2025 }
2026
2027 /** set next probe for trust anchor */
2028 static int
2029 set_next_probe(struct module_env* env, struct trust_anchor* tp,
2030         struct ub_packed_rrset_key* dnskey_rrset)
2031 {
2032         struct trust_anchor key, *tp2;
2033         time_t mold, mnew;
2034         /* use memory allocated in rrset for temporary name storage */
2035         key.node.key = &key;
2036         key.name = dnskey_rrset->rk.dname;
2037         key.namelen = dnskey_rrset->rk.dname_len;
2038         key.namelabs = dname_count_labels(key.name);
2039         key.dclass = tp->dclass;
2040         lock_basic_unlock(&tp->lock);
2041
2042         /* fetch tp again and lock anchors, so that we can modify the trees */
2043         lock_basic_lock(&env->anchors->lock);
2044         tp2 = (struct trust_anchor*)rbtree_search(env->anchors->tree, &key);
2045         if(!tp2) {
2046                 verbose(VERB_ALGO, "trustpoint was deleted in set_next_probe");
2047                 lock_basic_unlock(&env->anchors->lock);
2048                 return 0;
2049         }
2050         log_assert(tp == tp2);
2051         lock_basic_lock(&tp->lock);
2052
2053         /* schedule */
2054         mold = wait_probe_time(env->anchors);
2055         (void)rbtree_delete(&env->anchors->autr->probe, tp);
2056         tp->autr->next_probe_time = calc_next_probe(env,
2057                 tp->autr->query_interval);
2058         (void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2059         mnew = wait_probe_time(env->anchors);
2060
2061         lock_basic_unlock(&env->anchors->lock);
2062         verbose(VERB_ALGO, "next probe set in %d seconds",
2063                 (int)tp->autr->next_probe_time - (int)*env->now);
2064         if(mold != mnew) {
2065                 reset_worker_timer(env);
2066         }
2067         return 1;
2068 }
2069
2070 /** Revoke and Delete a trust point */
2071 static void
2072 autr_tp_remove(struct module_env* env, struct trust_anchor* tp,
2073         struct ub_packed_rrset_key* dnskey_rrset)
2074 {
2075         struct trust_anchor* del_tp;
2076         struct trust_anchor key;
2077         struct autr_point_data pd;
2078         time_t mold, mnew;
2079
2080         log_nametypeclass(VERB_OPS, "trust point was revoked",
2081                 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2082         tp->autr->revoked = 1;
2083
2084         /* use space allocated for dnskey_rrset to save name of anchor */
2085         memset(&key, 0, sizeof(key));
2086         memset(&pd, 0, sizeof(pd));
2087         key.autr = &pd;
2088         key.node.key = &key;
2089         pd.pnode.key = &key;
2090         pd.next_probe_time = tp->autr->next_probe_time;
2091         key.name = dnskey_rrset->rk.dname;
2092         key.namelen = tp->namelen;
2093         key.namelabs = tp->namelabs;
2094         key.dclass = tp->dclass;
2095
2096         /* unlock */
2097         lock_basic_unlock(&tp->lock);
2098
2099         /* take from tree. It could be deleted by someone else,hence (void). */
2100         lock_basic_lock(&env->anchors->lock);
2101         del_tp = (struct trust_anchor*)rbtree_delete(env->anchors->tree, &key);
2102         mold = wait_probe_time(env->anchors);
2103         (void)rbtree_delete(&env->anchors->autr->probe, &key);
2104         mnew = wait_probe_time(env->anchors);
2105         anchors_init_parents_locked(env->anchors);
2106         lock_basic_unlock(&env->anchors->lock);
2107
2108         /* if !del_tp then the trust point is no longer present in the tree,
2109          * it was deleted by someone else, who will write the zonefile and
2110          * clean up the structure */
2111         if(del_tp) {
2112                 /* save on disk */
2113                 del_tp->autr->next_probe_time = 0; /* no more probing for it */
2114                 autr_write_file(env, del_tp);
2115
2116                 /* delete */
2117                 autr_point_delete(del_tp);
2118         }
2119         if(mold != mnew) {
2120                 reset_worker_timer(env);
2121         }
2122 }
2123
2124 int autr_process_prime(struct module_env* env, struct val_env* ve,
2125         struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
2126         struct module_qstate* qstate)
2127 {
2128         int changed = 0;
2129         log_assert(tp && tp->autr);
2130         /* autotrust update trust anchors */
2131         /* the tp is locked, and stays locked unless it is deleted */
2132
2133         /* we could just catch the anchor here while another thread
2134          * is busy deleting it. Just unlock and let the other do its job */
2135         if(tp->autr->revoked) {
2136                 log_nametypeclass(VERB_ALGO, "autotrust not processed, "
2137                         "trust point revoked", tp->name,
2138                         LDNS_RR_TYPE_DNSKEY, tp->dclass);
2139                 lock_basic_unlock(&tp->lock);
2140                 return 0; /* it is revoked */
2141         }
2142
2143         /* query_dnskeys(): */
2144         tp->autr->last_queried = *env->now;
2145
2146         log_nametypeclass(VERB_ALGO, "autotrust process for",
2147                 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2148         /* see if time alone makes some keys valid */
2149         autr_holddown_exceed(env, tp, &changed);
2150         if(changed) {
2151                 verbose(VERB_ALGO, "autotrust: morekeys, reassemble");
2152                 if(!autr_assemble(tp)) {
2153                         log_err("malloc failure assembling autotrust keys");
2154                         return 1; /* unchanged */
2155                 }
2156         }
2157         /* did we get any data? */
2158         if(!dnskey_rrset) {
2159                 verbose(VERB_ALGO, "autotrust: no dnskey rrset");
2160                 /* no update of query_failed, because then we would have
2161                  * to write to disk. But we cannot because we maybe are
2162                  * still 'initializing' with DS records, that we cannot write
2163                  * in the full format (which only contains KSKs). */
2164                 return 1; /* trust point exists */
2165         }
2166         /* check for revoked keys to remove immediately */
2167         check_contains_revoked(env, ve, tp, dnskey_rrset, &changed, qstate);
2168         if(changed) {
2169                 verbose(VERB_ALGO, "autotrust: revokedkeys, reassemble");
2170                 if(!autr_assemble(tp)) {
2171                         log_err("malloc failure assembling autotrust keys");
2172                         return 1; /* unchanged */
2173                 }
2174                 if(!tp->ds_rrset && !tp->dnskey_rrset) {
2175                         /* no more keys, all are revoked */
2176                         /* this is a success for this probe attempt */
2177                         tp->autr->last_success = *env->now;
2178                         autr_tp_remove(env, tp, dnskey_rrset);
2179                         return 0; /* trust point removed */
2180                 }
2181         }
2182         /* verify the dnskey rrset and see if it is valid. */
2183         if(!verify_dnskey(env, ve, tp, dnskey_rrset, qstate)) {
2184                 verbose(VERB_ALGO, "autotrust: dnskey did not verify.");
2185                 /* only increase failure count if this is not the first prime,
2186                  * this means there was a previous successful probe */
2187                 if(tp->autr->last_success) {
2188                         tp->autr->query_failed += 1;
2189                         autr_write_file(env, tp);
2190                 }
2191                 return 1; /* trust point exists */
2192         }
2193
2194         tp->autr->last_success = *env->now;
2195         tp->autr->query_failed = 0;
2196
2197         /* Add new trust anchors to the data structure
2198          * - note which trust anchors are seen this probe.
2199          * Set trustpoint query_interval and retry_time.
2200          * - find minimum rrsig expiration interval
2201          */
2202         if(!update_events(env, ve, tp, dnskey_rrset, &changed)) {
2203                 log_err("malloc failure in autotrust update_events. "
2204                         "trust point unchanged.");
2205                 return 1; /* trust point unchanged, so exists */
2206         }
2207
2208         /* - for every SEP key do the 5011 statetable.
2209          * - remove missing trustanchors (if veryold and we have new anchors).
2210          */
2211         if(!do_statetable(env, tp, &changed)) {
2212                 log_err("malloc failure in autotrust do_statetable. "
2213                         "trust point unchanged.");
2214                 return 1; /* trust point unchanged, so exists */
2215         }
2216
2217         autr_cleanup_keys(tp);
2218         if(!set_next_probe(env, tp, dnskey_rrset))
2219                 return 0; /* trust point does not exist */
2220         autr_write_file(env, tp);
2221         if(changed) {
2222                 verbose(VERB_ALGO, "autotrust: changed, reassemble");
2223                 if(!autr_assemble(tp)) {
2224                         log_err("malloc failure assembling autotrust keys");
2225                         return 1; /* unchanged */
2226                 }
2227                 if(!tp->ds_rrset && !tp->dnskey_rrset) {
2228                         /* no more keys, all are revoked */
2229                         autr_tp_remove(env, tp, dnskey_rrset);
2230                         return 0; /* trust point removed */
2231                 }
2232         } else verbose(VERB_ALGO, "autotrust: no changes");
2233
2234         return 1; /* trust point exists */
2235 }
2236
2237 /** debug print a trust anchor key */
2238 static void
2239 autr_debug_print_ta(struct autr_ta* ta)
2240 {
2241         char buf[32];
2242         char* str = sldns_wire2str_rr(ta->rr, ta->rr_len);
2243         if(!str) {
2244                 log_info("out of memory in debug_print_ta");
2245                 return;
2246         }
2247         if(str && str[0]) str[strlen(str)-1]=0; /* remove newline */
2248         ctime_r(&ta->last_change, buf);
2249         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2250         log_info("[%s] %s ;;state:%d ;;pending_count:%d%s%s last:%s",
2251                 trustanchor_state2str(ta->s), str, ta->s, ta->pending_count,
2252                 ta->fetched?" fetched":"", ta->revoked?" revoked":"", buf);
2253         free(str);
2254 }
2255
2256 /** debug print a trust point */
2257 static void
2258 autr_debug_print_tp(struct trust_anchor* tp)
2259 {
2260         struct autr_ta* ta;
2261         char buf[257];
2262         if(!tp->autr)
2263                 return;
2264         dname_str(tp->name, buf);
2265         log_info("trust point %s : %d", buf, (int)tp->dclass);
2266         log_info("assembled %d DS and %d DNSKEYs",
2267                 (int)tp->numDS, (int)tp->numDNSKEY);
2268         if(tp->ds_rrset) {
2269                 log_packed_rrset(0, "DS:", tp->ds_rrset);
2270         }
2271         if(tp->dnskey_rrset) {
2272                 log_packed_rrset(0, "DNSKEY:", tp->dnskey_rrset);
2273         }
2274         log_info("file %s", tp->autr->file);
2275         ctime_r(&tp->autr->last_queried, buf);
2276         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2277         log_info("last_queried: %u %s", (unsigned)tp->autr->last_queried, buf);
2278         ctime_r(&tp->autr->last_success, buf);
2279         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2280         log_info("last_success: %u %s", (unsigned)tp->autr->last_success, buf);
2281         ctime_r(&tp->autr->next_probe_time, buf);
2282         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2283         log_info("next_probe_time: %u %s", (unsigned)tp->autr->next_probe_time,
2284                 buf);
2285         log_info("query_interval: %u", (unsigned)tp->autr->query_interval);
2286         log_info("retry_time: %u", (unsigned)tp->autr->retry_time);
2287         log_info("query_failed: %u", (unsigned)tp->autr->query_failed);
2288
2289         for(ta=tp->autr->keys; ta; ta=ta->next) {
2290                 autr_debug_print_ta(ta);
2291         }
2292 }
2293
2294 void
2295 autr_debug_print(struct val_anchors* anchors)
2296 {
2297         struct trust_anchor* tp;
2298         lock_basic_lock(&anchors->lock);
2299         RBTREE_FOR(tp, struct trust_anchor*, anchors->tree) {
2300                 lock_basic_lock(&tp->lock);
2301                 autr_debug_print_tp(tp);
2302                 lock_basic_unlock(&tp->lock);
2303         }
2304         lock_basic_unlock(&anchors->lock);
2305 }
2306
2307 void probe_answer_cb(void* arg, int ATTR_UNUSED(rcode),
2308         sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(sec),
2309         char* ATTR_UNUSED(why_bogus))
2310 {
2311         /* retry was set before the query was done,
2312          * re-querytime is set when query succeeded, but that may not
2313          * have reset this timer because the query could have been
2314          * handled by another thread. In that case, this callback would
2315          * get called after the original timeout is done.
2316          * By not resetting the timer, it may probe more often, but not
2317          * less often.
2318          * Unless the new lookup resulted in smaller TTLs and thus smaller
2319          * timeout values. In that case one old TTL could be mistakenly done.
2320          */
2321         struct module_env* env = (struct module_env*)arg;
2322         verbose(VERB_ALGO, "autotrust probe answer cb");
2323         reset_worker_timer(env);
2324 }
2325
2326 /** probe a trust anchor DNSKEY and unlocks tp */
2327 static void
2328 probe_anchor(struct module_env* env, struct trust_anchor* tp)
2329 {
2330         struct query_info qinfo;
2331         uint16_t qflags = BIT_RD;
2332         struct edns_data edns;
2333         sldns_buffer* buf = env->scratch_buffer;
2334         qinfo.qname = regional_alloc_init(env->scratch, tp->name, tp->namelen);
2335         if(!qinfo.qname) {
2336                 log_err("out of memory making 5011 probe");
2337                 return;
2338         }
2339         qinfo.qname_len = tp->namelen;
2340         qinfo.qtype = LDNS_RR_TYPE_DNSKEY;
2341         qinfo.qclass = tp->dclass;
2342         qinfo.local_alias = NULL;
2343         log_query_info(VERB_ALGO, "autotrust probe", &qinfo);
2344         verbose(VERB_ALGO, "retry probe set in %d seconds",
2345                 (int)tp->autr->next_probe_time - (int)*env->now);
2346         edns.edns_present = 1;
2347         edns.ext_rcode = 0;
2348         edns.edns_version = 0;
2349         edns.bits = EDNS_DO;
2350         edns.opt_list = NULL;
2351         if(sldns_buffer_capacity(buf) < 65535)
2352                 edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
2353         else    edns.udp_size = 65535;
2354
2355         /* can't hold the lock while mesh_run is processing */
2356         lock_basic_unlock(&tp->lock);
2357
2358         /* delete the DNSKEY from rrset and key cache so an active probe
2359          * is done. First the rrset so another thread does not use it
2360          * to recreate the key entry in a race condition. */
2361         rrset_cache_remove(env->rrset_cache, qinfo.qname, qinfo.qname_len,
2362                 qinfo.qtype, qinfo.qclass, 0);
2363         key_cache_remove(env->key_cache, qinfo.qname, qinfo.qname_len,
2364                 qinfo.qclass);
2365
2366         if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
2367                 &probe_answer_cb, env)) {
2368                 log_err("out of memory making 5011 probe");
2369         }
2370 }
2371
2372 /** fetch first to-probe trust-anchor and lock it and set retrytime */
2373 static struct trust_anchor*
2374 todo_probe(struct module_env* env, time_t* next)
2375 {
2376         struct trust_anchor* tp;
2377         rbnode_type* el;
2378         /* get first one */
2379         lock_basic_lock(&env->anchors->lock);
2380         if( (el=rbtree_first(&env->anchors->autr->probe)) == RBTREE_NULL) {
2381                 /* in case of revoked anchors */
2382                 lock_basic_unlock(&env->anchors->lock);
2383                 /* signal that there are no anchors to probe */
2384                 *next = 0;
2385                 return NULL;
2386         }
2387         tp = (struct trust_anchor*)el->key;
2388         lock_basic_lock(&tp->lock);
2389
2390         /* is it eligible? */
2391         if((time_t)tp->autr->next_probe_time > *env->now) {
2392                 /* no more to probe */
2393                 *next = (time_t)tp->autr->next_probe_time - *env->now;
2394                 lock_basic_unlock(&tp->lock);
2395                 lock_basic_unlock(&env->anchors->lock);
2396                 return NULL;
2397         }
2398
2399         /* reset its next probe time */
2400         (void)rbtree_delete(&env->anchors->autr->probe, tp);
2401         tp->autr->next_probe_time = calc_next_probe(env, tp->autr->retry_time);
2402         (void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2403         lock_basic_unlock(&env->anchors->lock);
2404
2405         return tp;
2406 }
2407
2408 time_t
2409 autr_probe_timer(struct module_env* env)
2410 {
2411         struct trust_anchor* tp;
2412         time_t next_probe = 3600;
2413         int num = 0;
2414         if(autr_permit_small_holddown) next_probe = 1;
2415         verbose(VERB_ALGO, "autotrust probe timer callback");
2416         /* while there are still anchors to probe */
2417         while( (tp = todo_probe(env, &next_probe)) ) {
2418                 /* make a probe for this anchor */
2419                 probe_anchor(env, tp);
2420                 num++;
2421         }
2422         regional_free_all(env->scratch);
2423         if(next_probe == 0)
2424                 return 0; /* no trust points to probe */
2425         verbose(VERB_ALGO, "autotrust probe timer %d callbacks done", num);
2426         return next_probe;
2427 }