contrib/unbound/validator/autotrust.c

   1 /*
   2  * validator/autotrust.c - RFC5011 trust anchor management for unbound.
   3  *
   4  * Copyright (c) 2009, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * Contains autotrust implementation. The implementation was taken from
  40  * the autotrust daemon (BSD licensed), written by Matthijs Mekking.
  41  * It was modified to fit into unbound. The state table process is the same.
  42  */
  43 #include "config.h"
  44 #include "validator/autotrust.h"
  45 #include "validator/val_anchor.h"
  46 #include "validator/val_utils.h"
  47 #include "validator/val_sigcrypt.h"
  48 #include "util/data/dname.h"
  49 #include "util/data/packed_rrset.h"
  50 #include "util/log.h"
  51 #include "util/module.h"
  52 #include "util/net_help.h"
  53 #include "util/config_file.h"
  54 #include "util/regional.h"
  55 #include "util/random.h"
  56 #include "util/data/msgparse.h"
  57 #include "services/mesh.h"
  58 #include "services/cache/rrset.h"
  59 #include "validator/val_kcache.h"
  60 #include "sldns/sbuffer.h"
  61 #include "sldns/wire2str.h"
  62 #include "sldns/str2wire.h"
  63 #include "sldns/keyraw.h"
  64 #include "sldns/rrdef.h"
  65 #include <stdarg.h>
  66 #include <ctype.h>
  67
  68 /** number of times a key must be seen before it can become valid */
  69 #define MIN_PENDINGCOUNT 2
  70
  71 /** Event: Revoked */
  72 static void do_revoked(struct module_env* env, struct autr_ta* anchor, int* c);
  73
  74 struct autr_global_data* autr_global_create(void)
  75 {
  76         struct autr_global_data* global;
  77         global = (struct autr_global_data*)malloc(sizeof(*global));
  78         if(!global)
  79                 return NULL;
  80         rbtree_init(&global->probe, &probetree_cmp);
  81         return global;
  82 }
  83
  84 void autr_global_delete(struct autr_global_data* global)
  85 {
  86         if(!global)
  87                 return;
  88         /* elements deleted by parent */
  89         memset(global, 0, sizeof(*global));
  90         free(global);
  91 }
  92
  93 int probetree_cmp(const void* x, const void* y)
  94 {
  95         struct trust_anchor* a = (struct trust_anchor*)x;
  96         struct trust_anchor* b = (struct trust_anchor*)y;
  97         log_assert(a->autr && b->autr);
  98         if(a->autr->next_probe_time < b->autr->next_probe_time)
  99                 return -1;
 100         if(a->autr->next_probe_time > b->autr->next_probe_time)
 101                 return 1;
 102         /* time is equal, sort on trust point identity */
 103         return anchor_cmp(x, y);
 104 }
 105
 106 size_t
 107 autr_get_num_anchors(struct val_anchors* anchors)
 108 {
 109         size_t res = 0;
 110         if(!anchors)
 111                 return 0;
 112         lock_basic_lock(&anchors->lock);
 113         if(anchors->autr)
 114                 res = anchors->autr->probe.count;
 115         lock_basic_unlock(&anchors->lock);
 116         return res;
 117 }
 118
 119 /** Position in string */
 120 static int
 121 position_in_string(char *str, const char* sub)
 122 {
 123         char* pos = strstr(str, sub);
 124         if(pos)
 125                 return (int)(pos-str)+(int)strlen(sub);
 126         return -1;
 127 }
 128
 129 /** Debug routine to print pretty key information */
 130 static void
 131 verbose_key(struct autr_ta* ta, enum verbosity_value level,
 132         const char* format, ...) ATTR_FORMAT(printf, 3, 4);
 133
 134 /**
 135  * Implementation of debug pretty key print
 136  * @param ta: trust anchor key with DNSKEY data.
 137  * @param level: verbosity level to print at.
 138  * @param format: printf style format string.
 139  */
 140 static void
 141 verbose_key(struct autr_ta* ta, enum verbosity_value level,
 142         const char* format, ...)
 143 {
 144         va_list args;
 145         va_start(args, format);
 146         if(verbosity >= level) {
 147                 char* str = sldns_wire2str_dname(ta->rr, ta->dname_len);
 148                 int keytag = (int)sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
 149                         ta->rr, ta->rr_len, ta->dname_len),
 150                         sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
 151                         ta->dname_len));
 152                 char msg[MAXSYSLOGMSGLEN];
 153                 vsnprintf(msg, sizeof(msg), format, args);
 154                 verbose(level, "%s key %d %s", str?str:"??", keytag, msg);
 155                 free(str);
 156         }
 157         va_end(args);
 158 }
 159
 160 /**
 161  * Parse comments
 162  * @param str: to parse
 163  * @param ta: trust key autotrust metadata
 164  * @return false on failure.
 165  */
 166 static int
 167 parse_comments(char* str, struct autr_ta* ta)
 168 {
 169         int len = (int)strlen(str), pos = 0, timestamp = 0;
 170         char* comment = (char*) malloc(sizeof(char)*len+1);
 171         char* comments = comment;
 172         if(!comment) {
 173                 log_err("malloc failure in parse");
 174                 return 0;
 175         }
 176         /* skip over whitespace and data at start of line */
 177         while (*str != '\0' && *str != ';')
 178                 str++;
 179         if (*str == ';')
 180                 str++;
 181         /* copy comments */
 182         while (*str != '\0')
 183         {
 184                 *comments = *str;
 185                 comments++;
 186                 str++;
 187         }
 188         *comments = '\0';
 189
 190         comments = comment;
 191
 192         /* read state */
 193         pos = position_in_string(comments, "state=");
 194         if (pos >= (int) strlen(comments))
 195         {
 196                 log_err("parse error");
 197                 free(comment);
 198                 return 0;
 199         }
 200         if (pos <= 0)
 201                 ta->s = AUTR_STATE_VALID;
 202         else
 203         {
 204                 int s = (int) comments[pos] - '0';
 205                 switch(s)
 206                 {
 207                         case AUTR_STATE_START:
 208                         case AUTR_STATE_ADDPEND:
 209                         case AUTR_STATE_VALID:
 210                         case AUTR_STATE_MISSING:
 211                         case AUTR_STATE_REVOKED:
 212                         case AUTR_STATE_REMOVED:
 213                                 ta->s = s;
 214                                 break;
 215                         default:
 216                                 verbose_key(ta, VERB_OPS, "has undefined "
 217                                         "state, considered NewKey");
 218                                 ta->s = AUTR_STATE_START;
 219                                 break;
 220                 }
 221         }
 222         /* read pending count */
 223         pos = position_in_string(comments, "count=");
 224         if (pos >= (int) strlen(comments))
 225         {
 226                 log_err("parse error");
 227                 free(comment);
 228                 return 0;
 229         }
 230         if (pos <= 0)
 231                 ta->pending_count = 0;
 232         else
 233         {
 234                 comments += pos;
 235                 ta->pending_count = (uint8_t)atoi(comments);
 236         }
 237
 238         /* read last change */
 239         pos = position_in_string(comments, "lastchange=");
 240         if (pos >= (int) strlen(comments))
 241         {
 242                 log_err("parse error");
 243                 free(comment);
 244                 return 0;
 245         }
 246         if (pos >= 0)
 247         {
 248                 comments += pos;
 249                 timestamp = atoi(comments);
 250         }
 251         if (pos < 0 || !timestamp)
 252                 ta->last_change = 0;
 253         else
 254                 ta->last_change = (time_t)timestamp;
 255
 256         free(comment);
 257         return 1;
 258 }
 259
 260 /** Check if a line contains data (besides comments) */
 261 static int
 262 str_contains_data(char* str, char comment)
 263 {
 264         while (*str != '\0') {
 265                 if (*str == comment || *str == '\n')
 266                         return 0;
 267                 if (*str != ' ' && *str != '\t')
 268                         return 1;
 269                 str++;
 270         }
 271         return 0;
 272 }
 273
 274 /** Get DNSKEY flags
 275  * rdata without rdatalen in front of it. */
 276 static int
 277 dnskey_flags(uint16_t t, uint8_t* rdata, size_t len)
 278 {
 279         uint16_t f;
 280         if(t != LDNS_RR_TYPE_DNSKEY)
 281                 return 0;
 282         if(len < 2)
 283                 return 0;
 284         memmove(&f, rdata, 2);
 285         f = ntohs(f);
 286         return (int)f;
 287 }
 288
 289 /** Check if KSK DNSKEY.
 290  * pass rdata without rdatalen in front of it */
 291 static int
 292 rr_is_dnskey_sep(uint16_t t, uint8_t* rdata, size_t len)
 293 {
 294         return (dnskey_flags(t, rdata, len)&DNSKEY_BIT_SEP);
 295 }
 296
 297 /** Check if TA is KSK DNSKEY */
 298 static int
 299 ta_is_dnskey_sep(struct autr_ta* ta)
 300 {
 301         return (dnskey_flags(
 302                 sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len),
 303                 sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len),
 304                 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len)
 305                 ) & DNSKEY_BIT_SEP);
 306 }
 307
 308 /** Check if REVOKED DNSKEY
 309  * pass rdata without rdatalen in front of it */
 310 static int
 311 rr_is_dnskey_revoked(uint16_t t, uint8_t* rdata, size_t len)
 312 {
 313         return (dnskey_flags(t, rdata, len)&LDNS_KEY_REVOKE_KEY);
 314 }
 315
 316 /** create ta */
 317 static struct autr_ta*
 318 autr_ta_create(uint8_t* rr, size_t rr_len, size_t dname_len)
 319 {
 320         struct autr_ta* ta = (struct autr_ta*)calloc(1, sizeof(*ta));
 321         if(!ta) {
 322                 free(rr);
 323                 return NULL;
 324         }
 325         ta->rr = rr;
 326         ta->rr_len = rr_len;
 327         ta->dname_len = dname_len;
 328         return ta;
 329 }
 330
 331 /** create tp */
 332 static struct trust_anchor*
 333 autr_tp_create(struct val_anchors* anchors, uint8_t* own, size_t own_len,
 334         uint16_t dc)
 335 {
 336         struct trust_anchor* tp = (struct trust_anchor*)calloc(1, sizeof(*tp));
 337         if(!tp) return NULL;
 338         tp->name = memdup(own, own_len);
 339         if(!tp->name) {
 340                 free(tp);
 341                 return NULL;
 342         }
 343         tp->namelen = own_len;
 344         tp->namelabs = dname_count_labels(tp->name);
 345         tp->node.key = tp;
 346         tp->dclass = dc;
 347         tp->autr = (struct autr_point_data*)calloc(1, sizeof(*tp->autr));
 348         if(!tp->autr) {
 349                 free(tp->name);
 350                 free(tp);
 351                 return NULL;
 352         }
 353         tp->autr->pnode.key = tp;
 354
 355         lock_basic_lock(&anchors->lock);
 356         if(!rbtree_insert(anchors->tree, &tp->node)) {
 357                 lock_basic_unlock(&anchors->lock);
 358                 log_err("trust anchor presented twice");
 359                 free(tp->name);
 360                 free(tp->autr);
 361                 free(tp);
 362                 return NULL;
 363         }
 364         if(!rbtree_insert(&anchors->autr->probe, &tp->autr->pnode)) {
 365                 (void)rbtree_delete(anchors->tree, tp);
 366                 lock_basic_unlock(&anchors->lock);
 367                 log_err("trust anchor in probetree twice");
 368                 free(tp->name);
 369                 free(tp->autr);
 370                 free(tp);
 371                 return NULL;
 372         }
 373         lock_basic_unlock(&anchors->lock);
 374         lock_basic_init(&tp->lock);
 375         lock_protect(&tp->lock, tp, sizeof(*tp));
 376         lock_protect(&tp->lock, tp->autr, sizeof(*tp->autr));
 377         return tp;
 378 }
 379
 380 /** delete assembled rrsets */
 381 static void
 382 autr_rrset_delete(struct ub_packed_rrset_key* r)
 383 {
 384         if(r) {
 385                 free(r->rk.dname);
 386                 free(r->entry.data);
 387                 free(r);
 388         }
 389 }
 390
 391 void autr_point_delete(struct trust_anchor* tp)
 392 {
 393         if(!tp)
 394                 return;
 395         lock_unprotect(&tp->lock, tp);
 396         lock_unprotect(&tp->lock, tp->autr);
 397         lock_basic_destroy(&tp->lock);
 398         autr_rrset_delete(tp->ds_rrset);
 399         autr_rrset_delete(tp->dnskey_rrset);
 400         if(tp->autr) {
 401                 struct autr_ta* p = tp->autr->keys, *np;
 402                 while(p) {
 403                         np = p->next;
 404                         free(p->rr);
 405                         free(p);
 406                         p = np;
 407                 }
 408                 free(tp->autr->file);
 409                 free(tp->autr);
 410         }
 411         free(tp->name);
 412         free(tp);
 413 }
 414
 415 /** find or add a new trust point for autotrust */
 416 static struct trust_anchor*
 417 find_add_tp(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
 418         size_t dname_len)
 419 {
 420         struct trust_anchor* tp;
 421         tp = anchor_find(anchors, rr, dname_count_labels(rr), dname_len,
 422                 sldns_wirerr_get_class(rr, rr_len, dname_len));
 423         if(tp) {
 424                 if(!tp->autr) {
 425                         log_err("anchor cannot be with and without autotrust");
 426                         lock_basic_unlock(&tp->lock);
 427                         return NULL;
 428                 }
 429                 return tp;
 430         }
 431         tp = autr_tp_create(anchors, rr, dname_len, sldns_wirerr_get_class(rr,
 432                 rr_len, dname_len));
 433         if(!tp)
 434                 return NULL;
 435         lock_basic_lock(&tp->lock);
 436         return tp;
 437 }
 438
 439 /** Add trust anchor from RR */
 440 static struct autr_ta*
 441 add_trustanchor_frm_rr(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
 442         size_t dname_len, struct trust_anchor** tp)
 443 {
 444         struct autr_ta* ta = autr_ta_create(rr, rr_len, dname_len);
 445         if(!ta)
 446                 return NULL;
 447         *tp = find_add_tp(anchors, rr, rr_len, dname_len);
 448         if(!*tp) {
 449                 free(ta->rr);
 450                 free(ta);
 451                 return NULL;
 452         }
 453         /* add ta to tp */
 454         ta->next = (*tp)->autr->keys;
 455         (*tp)->autr->keys = ta;
 456         lock_basic_unlock(&(*tp)->lock);
 457         return ta;
 458 }
 459
 460 /**
 461  * Add new trust anchor from a string in file.
 462  * @param anchors: all anchors
 463  * @param str: string with anchor and comments, if any comments.
 464  * @param tp: trust point returned.
 465  * @param origin: what to use for @
 466  * @param origin_len: length of origin
 467  * @param prev: previous rr name
 468  * @param prev_len: length of prev
 469  * @param skip: if true, the result is NULL, but not an error, skip it.
 470  * @return new key in trust point.
 471  */
 472 static struct autr_ta*
 473 add_trustanchor_frm_str(struct val_anchors* anchors, char* str,
 474         struct trust_anchor** tp, uint8_t* origin, size_t origin_len,
 475         uint8_t** prev, size_t* prev_len, int* skip)
 476 {
 477         uint8_t rr[LDNS_RR_BUF_SIZE];
 478         size_t rr_len = sizeof(rr), dname_len;
 479         uint8_t* drr;
 480         int lstatus;
 481         if (!str_contains_data(str, ';')) {
 482                 *skip = 1;
 483                 return NULL; /* empty line */
 484         }
 485         if(0 != (lstatus = sldns_str2wire_rr_buf(str, rr, &rr_len, &dname_len,
 486                 0, origin, origin_len, *prev, *prev_len)))
 487         {
 488                 log_err("ldns error while converting string to RR at%d: %s: %s",
 489                         LDNS_WIREPARSE_OFFSET(lstatus),
 490                         sldns_get_errorstr_parse(lstatus), str);
 491                 return NULL;
 492         }
 493         free(*prev);
 494         *prev = memdup(rr, dname_len);
 495         *prev_len = dname_len;
 496         if(!*prev) {
 497                 log_err("malloc failure in add_trustanchor");
 498                 return NULL;
 499         }
 500         if(sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DNSKEY &&
 501                 sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DS) {
 502                 *skip = 1;
 503                 return NULL; /* only DS and DNSKEY allowed */
 504         }
 505         drr = memdup(rr, rr_len);
 506         if(!drr) {
 507                 log_err("malloc failure in add trustanchor");
 508                 return NULL;
 509         }
 510         return add_trustanchor_frm_rr(anchors, drr, rr_len, dname_len, tp);
 511 }
 512
 513 /**
 514  * Load single anchor
 515  * @param anchors: all points.
 516  * @param str: comments line
 517  * @param fname: filename
 518  * @param origin: the $ORIGIN.
 519  * @param origin_len: length of origin
 520  * @param prev: passed to ldns.
 521  * @param prev_len: length of prev
 522  * @param skip: if true, the result is NULL, but not an error, skip it.
 523  * @return false on failure, otherwise the tp read.
 524  */
 525 static struct trust_anchor*
 526 load_trustanchor(struct val_anchors* anchors, char* str, const char* fname,
 527         uint8_t* origin, size_t origin_len, uint8_t** prev, size_t* prev_len,
 528         int* skip)
 529 {
 530         struct autr_ta* ta = NULL;
 531         struct trust_anchor* tp = NULL;
 532
 533         ta = add_trustanchor_frm_str(anchors, str, &tp, origin, origin_len,
 534                 prev, prev_len, skip);
 535         if(!ta)
 536                 return NULL;
 537         lock_basic_lock(&tp->lock);
 538         if(!parse_comments(str, ta)) {
 539                 lock_basic_unlock(&tp->lock);
 540                 return NULL;
 541         }
 542         if(!tp->autr->file) {
 543                 tp->autr->file = strdup(fname);
 544                 if(!tp->autr->file) {
 545                         lock_basic_unlock(&tp->lock);
 546                         log_err("malloc failure");
 547                         return NULL;
 548                 }
 549         }
 550         lock_basic_unlock(&tp->lock);
 551         return tp;
 552 }
 553
 554 /** iterator for DSes from keylist. return true if a next element exists */
 555 static int
 556 assemble_iterate_ds(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
 557         size_t* dname_len)
 558 {
 559         while(*list) {
 560                 if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
 561                         (*list)->dname_len) == LDNS_RR_TYPE_DS) {
 562                         *rr = (*list)->rr;
 563                         *rr_len = (*list)->rr_len;
 564                         *dname_len = (*list)->dname_len;
 565                         *list = (*list)->next;
 566                         return 1;
 567                 }
 568                 *list = (*list)->next;
 569         }
 570         return 0;
 571 }
 572
 573 /** iterator for DNSKEYs from keylist. return true if a next element exists */
 574 static int
 575 assemble_iterate_dnskey(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
 576         size_t* dname_len)
 577 {
 578         while(*list) {
 579                 if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
 580                    (*list)->dname_len) != LDNS_RR_TYPE_DS &&
 581                         ((*list)->s == AUTR_STATE_VALID ||
 582                          (*list)->s == AUTR_STATE_MISSING)) {
 583                         *rr = (*list)->rr;
 584                         *rr_len = (*list)->rr_len;
 585                         *dname_len = (*list)->dname_len;
 586                         *list = (*list)->next;
 587                         return 1;
 588                 }
 589                 *list = (*list)->next;
 590         }
 591         return 0;
 592 }
 593
 594 /** see if iterator-list has any elements in it, or it is empty */
 595 static int
 596 assemble_iterate_hasfirst(int iter(struct autr_ta**, uint8_t**, size_t*,
 597         size_t*), struct autr_ta* list)
 598 {
 599         uint8_t* rr = NULL;
 600         size_t rr_len = 0, dname_len = 0;
 601         return iter(&list, &rr, &rr_len, &dname_len);
 602 }
 603
 604 /** number of elements in iterator list */
 605 static size_t
 606 assemble_iterate_count(int iter(struct autr_ta**, uint8_t**, size_t*,
 607         size_t*), struct autr_ta* list)
 608 {
 609         uint8_t* rr = NULL;
 610         size_t i = 0, rr_len = 0, dname_len = 0;
 611         while(iter(&list, &rr, &rr_len, &dname_len)) {
 612                 i++;
 613         }
 614         return i;
 615 }
 616
 617 /**
 618  * Create a ub_packed_rrset_key allocated on the heap.
 619  * It therefore does not have the correct ID value, and cannot be used
 620  * inside the cache.  It can be used in storage outside of the cache.
 621  * Keys for the cache have to be obtained from alloc.h .
 622  * @param iter: iterator over the elements in the list.  It filters elements.
 623  * @param list: the list.
 624  * @return key allocated or NULL on failure.
 625  */
 626 static struct ub_packed_rrset_key*
 627 ub_packed_rrset_heap_key(int iter(struct autr_ta**, uint8_t**, size_t*,
 628         size_t*), struct autr_ta* list)
 629 {
 630         uint8_t* rr = NULL;
 631         size_t rr_len = 0, dname_len = 0;
 632         struct ub_packed_rrset_key* k;
 633         if(!iter(&list, &rr, &rr_len, &dname_len))
 634                 return NULL;
 635         k = (struct ub_packed_rrset_key*)calloc(1, sizeof(*k));
 636         if(!k)
 637                 return NULL;
 638         k->rk.type = htons(sldns_wirerr_get_type(rr, rr_len, dname_len));
 639         k->rk.rrset_class = htons(sldns_wirerr_get_class(rr, rr_len, dname_len));
 640         k->rk.dname_len = dname_len;
 641         k->rk.dname = memdup(rr, dname_len);
 642         if(!k->rk.dname) {
 643                 free(k);
 644                 return NULL;
 645         }
 646         return k;
 647 }
 648
 649 /**
 650  * Create packed_rrset data on the heap.
 651  * @param iter: iterator over the elements in the list.  It filters elements.
 652  * @param list: the list.
 653  * @return data allocated or NULL on failure.
 654  */
 655 static struct packed_rrset_data*
 656 packed_rrset_heap_data(int iter(struct autr_ta**, uint8_t**, size_t*,
 657         size_t*), struct autr_ta* list)
 658 {
 659         uint8_t* rr = NULL;
 660         size_t rr_len = 0, dname_len = 0;
 661         struct packed_rrset_data* data;
 662         size_t count=0, rrsig_count=0, len=0, i, total;
 663         uint8_t* nextrdata;
 664         struct autr_ta* list_i;
 665         time_t ttl = 0;
 666
 667         list_i = list;
 668         while(iter(&list_i, &rr, &rr_len, &dname_len)) {
 669                 if(sldns_wirerr_get_type(rr, rr_len, dname_len) ==
 670                         LDNS_RR_TYPE_RRSIG)
 671                         rrsig_count++;
 672                 else    count++;
 673                 /* sizeof the rdlength + rdatalen */
 674                 len += 2 + sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
 675                 ttl = (time_t)sldns_wirerr_get_ttl(rr, rr_len, dname_len);
 676         }
 677         if(count == 0 && rrsig_count == 0)
 678                 return NULL;
 679
 680         /* allocate */
 681         total = count + rrsig_count;
 682         len += sizeof(*data) + total*(sizeof(size_t) + sizeof(time_t) +
 683                 sizeof(uint8_t*));
 684         data = (struct packed_rrset_data*)calloc(1, len);
 685         if(!data)
 686                 return NULL;
 687
 688         /* fill it */
 689         data->ttl = ttl;
 690         data->count = count;
 691         data->rrsig_count = rrsig_count;
 692         data->rr_len = (size_t*)((uint8_t*)data +
 693                 sizeof(struct packed_rrset_data));
 694         data->rr_data = (uint8_t**)&(data->rr_len[total]);
 695         data->rr_ttl = (time_t*)&(data->rr_data[total]);
 696         nextrdata = (uint8_t*)&(data->rr_ttl[total]);
 697
 698         /* fill out len, ttl, fields */
 699         list_i = list;
 700         i = 0;
 701         while(iter(&list_i, &rr, &rr_len, &dname_len)) {
 702                 data->rr_ttl[i] = (time_t)sldns_wirerr_get_ttl(rr, rr_len,
 703                         dname_len);
 704                 if(data->rr_ttl[i] < data->ttl)
 705                         data->ttl = data->rr_ttl[i];
 706                 data->rr_len[i] = 2 /* the rdlength */ +
 707                         sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
 708                 i++;
 709         }
 710
 711         /* fixup rest of ptrs */
 712         for(i=0; i<total; i++) {
 713                 data->rr_data[i] = nextrdata;
 714                 nextrdata += data->rr_len[i];
 715         }
 716
 717         /* copy data in there */
 718         list_i = list;
 719         i = 0;
 720         while(iter(&list_i, &rr, &rr_len, &dname_len)) {
 721                 memmove(data->rr_data[i],
 722                         sldns_wirerr_get_rdatawl(rr, rr_len, dname_len),
 723                         data->rr_len[i]);
 724                 i++;
 725         }
 726
 727         if(data->rrsig_count && data->count == 0) {
 728                 data->count = data->rrsig_count; /* rrset type is RRSIG */
 729                 data->rrsig_count = 0;
 730         }
 731         return data;
 732 }
 733
 734 /**
 735  * Assemble the trust anchors into DS and DNSKEY packed rrsets.
 736  * Uses only VALID and MISSING DNSKEYs.
 737  * Read the sldns_rrs and builds packed rrsets
 738  * @param tp: the trust point. Must be locked.
 739  * @return false on malloc failure.
 740  */
 741 static int
 742 autr_assemble(struct trust_anchor* tp)
 743 {
 744         struct ub_packed_rrset_key* ubds=NULL, *ubdnskey=NULL;
 745
 746         /* make packed rrset keys - malloced with no ID number, they
 747          * are not in the cache */
 748         /* make packed rrset data (if there is a key) */
 749         if(assemble_iterate_hasfirst(assemble_iterate_ds, tp->autr->keys)) {
 750                 ubds = ub_packed_rrset_heap_key(
 751                         assemble_iterate_ds, tp->autr->keys);
 752                 if(!ubds)
 753                         goto error_cleanup;
 754                 ubds->entry.data = packed_rrset_heap_data(
 755                         assemble_iterate_ds, tp->autr->keys);
 756                 if(!ubds->entry.data)
 757                         goto error_cleanup;
 758         }
 759
 760         /* make packed DNSKEY data */
 761         if(assemble_iterate_hasfirst(assemble_iterate_dnskey, tp->autr->keys)) {
 762                 ubdnskey = ub_packed_rrset_heap_key(
 763                         assemble_iterate_dnskey, tp->autr->keys);
 764                 if(!ubdnskey)
 765                         goto error_cleanup;
 766                 ubdnskey->entry.data = packed_rrset_heap_data(
 767                         assemble_iterate_dnskey, tp->autr->keys);
 768                 if(!ubdnskey->entry.data) {
 769                 error_cleanup:
 770                         autr_rrset_delete(ubds);
 771                         autr_rrset_delete(ubdnskey);
 772                         return 0;
 773                 }
 774         }
 775
 776         /* we have prepared the new keys so nothing can go wrong any more.
 777          * And we are sure we cannot be left without trustanchor after
 778          * any errors. Put in the new keys and remove old ones. */
 779
 780         /* free the old data */
 781         autr_rrset_delete(tp->ds_rrset);
 782         autr_rrset_delete(tp->dnskey_rrset);
 783
 784         /* assign the data to replace the old */
 785         tp->ds_rrset = ubds;
 786         tp->dnskey_rrset = ubdnskey;
 787         tp->numDS = assemble_iterate_count(assemble_iterate_ds,
 788                 tp->autr->keys);
 789         tp->numDNSKEY = assemble_iterate_count(assemble_iterate_dnskey,
 790                 tp->autr->keys);
 791         return 1;
 792 }
 793
 794 /** parse integer */
 795 static unsigned int
 796 parse_int(char* line, int* ret)
 797 {
 798         char *e;
 799         unsigned int x = (unsigned int)strtol(line, &e, 10);
 800         if(line == e) {
 801                 *ret = -1; /* parse error */
 802                 return 0;
 803         }
 804         *ret = 1; /* matched */
 805         return x;
 806 }
 807
 808 /** parse id sequence for anchor */
 809 static struct trust_anchor*
 810 parse_id(struct val_anchors* anchors, char* line)
 811 {
 812         struct trust_anchor *tp;
 813         int r;
 814         uint16_t dclass;
 815         uint8_t* dname;
 816         size_t dname_len;
 817         /* read the owner name */
 818         char* next = strchr(line, ' ');
 819         if(!next)
 820                 return NULL;
 821         next[0] = 0;
 822         dname = sldns_str2wire_dname(line, &dname_len);
 823         if(!dname)
 824                 return NULL;
 825
 826         /* read the class */
 827         dclass = parse_int(next+1, &r);
 828         if(r == -1) {
 829                 free(dname);
 830                 return NULL;
 831         }
 832
 833         /* find the trust point */
 834         tp = autr_tp_create(anchors, dname, dname_len, dclass);
 835         free(dname);
 836         return tp;
 837 }
 838
 839 /**
 840  * Parse variable from trustanchor header
 841  * @param line: to parse
 842  * @param anchors: the anchor is added to this, if "id:" is seen.
 843  * @param anchor: the anchor as result value or previously returned anchor
 844  *      value to read the variable lines into.
 845  * @return: 0 no match, -1 failed syntax error, +1 success line read.
 846  *      +2 revoked trust anchor file.
 847  */
 848 static int
 849 parse_var_line(char* line, struct val_anchors* anchors,
 850         struct trust_anchor** anchor)
 851 {
 852         struct trust_anchor* tp = *anchor;
 853         int r = 0;
 854         if(strncmp(line, ";;id: ", 6) == 0) {
 855                 *anchor = parse_id(anchors, line+6);
 856                 if(!*anchor) return -1;
 857                 else return 1;
 858         } else if(strncmp(line, ";;REVOKED", 9) == 0) {
 859                 if(tp) {
 860                         log_err("REVOKED statement must be at start of file");
 861                         return -1;
 862                 }
 863                 return 2;
 864         } else if(strncmp(line, ";;last_queried: ", 16) == 0) {
 865                 if(!tp) return -1;
 866                 lock_basic_lock(&tp->lock);
 867                 tp->autr->last_queried = (time_t)parse_int(line+16, &r);
 868                 lock_basic_unlock(&tp->lock);
 869         } else if(strncmp(line, ";;last_success: ", 16) == 0) {
 870                 if(!tp) return -1;
 871                 lock_basic_lock(&tp->lock);
 872                 tp->autr->last_success = (time_t)parse_int(line+16, &r);
 873                 lock_basic_unlock(&tp->lock);
 874         } else if(strncmp(line, ";;next_probe_time: ", 19) == 0) {
 875                 if(!tp) return -1;
 876                 lock_basic_lock(&anchors->lock);
 877                 lock_basic_lock(&tp->lock);
 878                 (void)rbtree_delete(&anchors->autr->probe, tp);
 879                 tp->autr->next_probe_time = (time_t)parse_int(line+19, &r);
 880                 (void)rbtree_insert(&anchors->autr->probe, &tp->autr->pnode);
 881                 lock_basic_unlock(&tp->lock);
 882                 lock_basic_unlock(&anchors->lock);
 883         } else if(strncmp(line, ";;query_failed: ", 16) == 0) {
 884                 if(!tp) return -1;
 885                 lock_basic_lock(&tp->lock);
 886                 tp->autr->query_failed = (uint8_t)parse_int(line+16, &r);
 887                 lock_basic_unlock(&tp->lock);
 888         } else if(strncmp(line, ";;query_interval: ", 18) == 0) {
 889                 if(!tp) return -1;
 890                 lock_basic_lock(&tp->lock);
 891                 tp->autr->query_interval = (time_t)parse_int(line+18, &r);
 892                 lock_basic_unlock(&tp->lock);
 893         } else if(strncmp(line, ";;retry_time: ", 14) == 0) {
 894                 if(!tp) return -1;
 895                 lock_basic_lock(&tp->lock);
 896                 tp->autr->retry_time = (time_t)parse_int(line+14, &r);
 897                 lock_basic_unlock(&tp->lock);
 898         }
 899         return r;
 900 }
 901
 902 /** handle origin lines */
 903 static int
 904 handle_origin(char* line, uint8_t** origin, size_t* origin_len)
 905 {
 906         size_t len = 0;
 907         while(isspace((unsigned char)*line))
 908                 line++;
 909         if(strncmp(line, "$ORIGIN", 7) != 0)
 910                 return 0;
 911         free(*origin);
 912         line += 7;
 913         while(isspace((unsigned char)*line))
 914                 line++;
 915         *origin = sldns_str2wire_dname(line, &len);
 916         *origin_len = len;
 917         if(!*origin)
 918                 log_warn("malloc failure or parse error in $ORIGIN");
 919         return 1;
 920 }
 921
 922 /** Read one line and put multiline RRs onto one line string */
 923 static int
 924 read_multiline(char* buf, size_t len, FILE* in, int* linenr)
 925 {
 926         char* pos = buf;
 927         size_t left = len;
 928         int depth = 0;
 929         buf[len-1] = 0;
 930         while(left > 0 && fgets(pos, (int)left, in) != NULL) {
 931                 size_t i, poslen = strlen(pos);
 932                 (*linenr)++;
 933
 934                 /* check what the new depth is after the line */
 935                 /* this routine cannot handle braces inside quotes,
 936                    say for TXT records, but this routine only has to read keys */
 937                 for(i=0; i<poslen; i++) {
 938                         if(pos[i] == '(') {
 939                                 depth++;
 940                         } else if(pos[i] == ')') {
 941                                 if(depth == 0) {
 942                                         log_err("mismatch: too many ')'");
 943                                         return -1;
 944                                 }
 945                                 depth--;
 946                         } else if(pos[i] == ';') {
 947                                 break;
 948                         }
 949                 }
 950
 951                 /* normal oneline or last line: keeps newline and comments */
 952                 if(depth == 0) {
 953                         return 1;
 954                 }
 955
 956                 /* more lines expected, snip off comments and newline */
 957                 if(poslen>0)
 958                         pos[poslen-1] = 0; /* strip newline */
 959                 if(strchr(pos, ';'))
 960                         strchr(pos, ';')[0] = 0; /* strip comments */
 961
 962                 /* move to paste other lines behind this one */
 963                 poslen = strlen(pos);
 964                 pos += poslen;
 965                 left -= poslen;
 966                 /* the newline is changed into a space */
 967                 if(left <= 2 /* space and eos */) {
 968                         log_err("line too long");
 969                         return -1;
 970                 }
 971                 pos[0] = ' ';
 972                 pos[1] = 0;
 973                 pos += 1;
 974                 left -= 1;
 975         }
 976         if(depth != 0) {
 977                 log_err("mismatch: too many '('");
 978                 return -1;
 979         }
 980         if(pos != buf)
 981                 return 1;
 982         return 0;
 983 }
 984
 985 int autr_read_file(struct val_anchors* anchors, const char* nm)
 986 {
 987         /* the file descriptor */
 988         FILE* fd;
 989         /* keep track of line numbers */
 990         int line_nr = 0;
 991         /* single line */
 992         char line[10240];
 993         /* trust point being read */
 994         struct trust_anchor *tp = NULL, *tp2;
 995         int r;
 996         /* for $ORIGIN parsing */
 997         uint8_t *origin=NULL, *prev=NULL;
 998         size_t origin_len=0, prev_len=0;
 999
1000         if (!(fd = fopen(nm, "r"))) {
1001                 log_err("unable to open %s for reading: %s",
1002                         nm, strerror(errno));
1003                 return 0;
1004         }
1005         verbose(VERB_ALGO, "reading autotrust anchor file %s", nm);
1006         while ( (r=read_multiline(line, sizeof(line), fd, &line_nr)) != 0) {
1007                 if(r == -1 || (r = parse_var_line(line, anchors, &tp)) == -1) {
1008                         log_err("could not parse auto-trust-anchor-file "
1009                                 "%s line %d", nm, line_nr);
1010                         fclose(fd);
1011                         free(origin);
1012                         free(prev);
1013                         return 0;
1014                 } else if(r == 1) {
1015                         continue;
1016                 } else if(r == 2) {
1017                         log_warn("trust anchor %s has been revoked", nm);
1018                         fclose(fd);
1019                         free(origin);
1020                         free(prev);
1021                         return 1;
1022                 }
1023                 if (!str_contains_data(line, ';'))
1024                         continue; /* empty lines allowed */
1025                 if(handle_origin(line, &origin, &origin_len))
1026                         continue;
1027                 r = 0;
1028                 if(!(tp2=load_trustanchor(anchors, line, nm, origin,
1029                         origin_len, &prev, &prev_len, &r))) {
1030                         if(!r) log_err("failed to load trust anchor from %s "
1031                                 "at line %i, skipping", nm, line_nr);
1032                         /* try to do the rest */
1033                         continue;
1034                 }
1035                 if(tp && tp != tp2) {
1036                         log_err("file %s has mismatching data inside: "
1037                                 "the file may only contain keys for one name, "
1038                                 "remove keys for other domain names", nm);
1039                         fclose(fd);
1040                         free(origin);
1041                         free(prev);
1042                         return 0;
1043                 }
1044                 tp = tp2;
1045         }
1046         fclose(fd);
1047         free(origin);
1048         free(prev);
1049         if(!tp) {
1050                 log_err("failed to read %s", nm);
1051                 return 0;
1052         }
1053
1054         /* now assemble the data into DNSKEY and DS packed rrsets */
1055         lock_basic_lock(&tp->lock);
1056         if(!autr_assemble(tp)) {
1057                 lock_basic_unlock(&tp->lock);
1058                 log_err("malloc failure assembling %s", nm);
1059                 return 0;
1060         }
1061         lock_basic_unlock(&tp->lock);
1062         return 1;
1063 }
1064
1065 /** string for a trustanchor state */
1066 static const char*
1067 trustanchor_state2str(autr_state_t s)
1068 {
1069         switch (s) {
1070                 case AUTR_STATE_START:       return "  START  ";
1071                 case AUTR_STATE_ADDPEND:     return " ADDPEND ";
1072                 case AUTR_STATE_VALID:       return "  VALID  ";
1073                 case AUTR_STATE_MISSING:     return " MISSING ";
1074                 case AUTR_STATE_REVOKED:     return " REVOKED ";
1075                 case AUTR_STATE_REMOVED:     return " REMOVED ";
1076         }
1077         return " UNKNOWN ";
1078 }
1079
1080 /** print ID to file */
1081 static int
1082 print_id(FILE* out, char* fname, uint8_t* nm, size_t nmlen, uint16_t dclass)
1083 {
1084         char* s = sldns_wire2str_dname(nm, nmlen);
1085         if(!s) {
1086                 log_err("malloc failure in write to %s", fname);
1087                 return 0;
1088         }
1089         if(fprintf(out, ";;id: %s %d\n", s, (int)dclass) < 0) {
1090                 log_err("could not write to %s: %s", fname, strerror(errno));
1091                 free(s);
1092                 return 0;
1093         }
1094         free(s);
1095         return 1;
1096 }
1097
1098 static int
1099 autr_write_contents(FILE* out, char* fn, struct trust_anchor* tp)
1100 {
1101         char tmi[32];
1102         struct autr_ta* ta;
1103         char* str;
1104
1105         /* write pretty header */
1106         if(fprintf(out, "; autotrust trust anchor file\n") < 0) {
1107                 log_err("could not write to %s: %s", fn, strerror(errno));
1108                 return 0;
1109         }
1110         if(tp->autr->revoked) {
1111                 if(fprintf(out, ";;REVOKED\n") < 0 ||
1112                    fprintf(out, "; The zone has all keys revoked, and is\n"
1113                         "; considered as if it has no trust anchors.\n"
1114                         "; the remainder of the file is the last probe.\n"
1115                         "; to restart the trust anchor, overwrite this file.\n"
1116                         "; with one containing valid DNSKEYs or DSes.\n") < 0) {
1117                    log_err("could not write to %s: %s", fn, strerror(errno));
1118                    return 0;
1119                 }
1120         }
1121         if(!print_id(out, fn, tp->name, tp->namelen, tp->dclass)) {
1122                 return 0;
1123         }
1124         if(fprintf(out, ";;last_queried: %u ;;%s",
1125                 (unsigned int)tp->autr->last_queried,
1126                 ctime_r(&(tp->autr->last_queried), tmi)) < 0 ||
1127            fprintf(out, ";;last_success: %u ;;%s",
1128                 (unsigned int)tp->autr->last_success,
1129                 ctime_r(&(tp->autr->last_success), tmi)) < 0 ||
1130            fprintf(out, ";;next_probe_time: %u ;;%s",
1131                 (unsigned int)tp->autr->next_probe_time,
1132                 ctime_r(&(tp->autr->next_probe_time), tmi)) < 0 ||
1133            fprintf(out, ";;query_failed: %d\n", (int)tp->autr->query_failed)<0
1134            || fprintf(out, ";;query_interval: %d\n",
1135            (int)tp->autr->query_interval) < 0 ||
1136            fprintf(out, ";;retry_time: %d\n", (int)tp->autr->retry_time) < 0) {
1137                 log_err("could not write to %s: %s", fn, strerror(errno));
1138                 return 0;
1139         }
1140
1141         /* write anchors */
1142         for(ta=tp->autr->keys; ta; ta=ta->next) {
1143                 /* by default do not store START and REMOVED keys */
1144                 if(ta->s == AUTR_STATE_START)
1145                         continue;
1146                 if(ta->s == AUTR_STATE_REMOVED)
1147                         continue;
1148                 /* only store keys */
1149                 if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len)
1150                         != LDNS_RR_TYPE_DNSKEY)
1151                         continue;
1152                 str = sldns_wire2str_rr(ta->rr, ta->rr_len);
1153                 if(!str || !str[0]) {
1154                         free(str);
1155                         log_err("malloc failure writing %s", fn);
1156                         return 0;
1157                 }
1158                 str[strlen(str)-1] = 0; /* remove newline */
1159                 if(fprintf(out, "%s ;;state=%d [%s] ;;count=%d "
1160                         ";;lastchange=%u ;;%s", str, (int)ta->s,
1161                         trustanchor_state2str(ta->s), (int)ta->pending_count,
1162                         (unsigned int)ta->last_change,
1163                         ctime_r(&(ta->last_change), tmi)) < 0) {
1164                    log_err("could not write to %s: %s", fn, strerror(errno));
1165                    free(str);
1166                    return 0;
1167                 }
1168                 free(str);
1169         }
1170         return 1;
1171 }
1172
1173 void autr_write_file(struct module_env* env, struct trust_anchor* tp)
1174 {
1175         FILE* out;
1176         char* fname = tp->autr->file;
1177         char tempf[2048];
1178         log_assert(tp->autr);
1179         if(!env) {
1180                 log_err("autr_write_file: Module environment is NULL.");
1181                 return;
1182         }
1183         /* unique name with pid number and thread number */
1184         snprintf(tempf, sizeof(tempf), "%s.%d-%d", fname, (int)getpid(),
1185                 env->worker?*(int*)env->worker:0);
1186         verbose(VERB_ALGO, "autotrust: write to disk: %s", tempf);
1187         out = fopen(tempf, "w");
1188         if(!out) {
1189                 fatal_exit("could not open autotrust file for writing, %s: %s",
1190                         tempf, strerror(errno));
1191                 return;
1192         }
1193         if(!autr_write_contents(out, tempf, tp)) {
1194                 /* failed to write contents (completely) */
1195                 fclose(out);
1196                 unlink(tempf);
1197                 fatal_exit("could not completely write: %s", fname);
1198                 return;
1199         }
1200         if(fflush(out) != 0)
1201                 log_err("could not fflush(%s): %s", fname, strerror(errno));
1202 #ifdef HAVE_FSYNC
1203         if(fsync(fileno(out)) != 0)
1204                 log_err("could not fsync(%s): %s", fname, strerror(errno));
1205 #else
1206         FlushFileBuffers((HANDLE)_get_osfhandle(_fileno(out)));
1207 #endif
1208         if(fclose(out) != 0) {
1209                 fatal_exit("could not complete write: %s: %s",
1210                         fname, strerror(errno));
1211                 unlink(tempf);
1212                 return;
1213         }
1214         /* success; overwrite actual file */
1215         verbose(VERB_ALGO, "autotrust: replaced %s", fname);
1216 #ifdef UB_ON_WINDOWS
1217         (void)unlink(fname); /* windows does not replace file with rename() */
1218 #endif
1219         if(rename(tempf, fname) < 0) {
1220                 fatal_exit("rename(%s to %s): %s", tempf, fname, strerror(errno));
1221         }
1222 }
1223
1224 /**
1225  * Verify if dnskey works for trust point
1226  * @param env: environment (with time) for verification
1227  * @param ve: validator environment (with options) for verification.
1228  * @param tp: trust point to verify with
1229  * @param rrset: DNSKEY rrset to verify.
1230  * @return false on failure, true if verification successful.
1231  */
1232 static int
1233 verify_dnskey(struct module_env* env, struct val_env* ve,
1234         struct trust_anchor* tp, struct ub_packed_rrset_key* rrset)
1235 {
1236         char* reason = NULL;
1237         uint8_t sigalg[ALGO_NEEDS_MAX+1];
1238         int downprot = env->cfg->harden_algo_downgrade;
1239         enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve, rrset,
1240                 tp->ds_rrset, tp->dnskey_rrset, downprot?sigalg:NULL, &reason);
1241         /* sigalg is ignored, it returns algorithms signalled to exist, but
1242          * in 5011 there are no other rrsets to check.  if downprot is
1243          * enabled, then it checks that the DNSKEY is signed with all
1244          * algorithms available in the trust store. */
1245         verbose(VERB_ALGO, "autotrust: validate DNSKEY with anchor: %s",
1246                 sec_status_to_string(sec));
1247         return sec == sec_status_secure;
1248 }
1249
1250 static int32_t
1251 rrsig_get_expiry(uint8_t* d, size_t len)
1252 {
1253         /* rrsig: 2(rdlen), 2(type) 1(alg) 1(v) 4(origttl), then 4(expi), (4)incep) */
1254         if(len < 2+8+4)
1255                 return 0;
1256         return sldns_read_uint32(d+2+8);
1257 }
1258
1259 /** Find minimum expiration interval from signatures */
1260 static time_t
1261 min_expiry(struct module_env* env, struct packed_rrset_data* dd)
1262 {
1263         size_t i;
1264         int32_t t, r = 15 * 24 * 3600; /* 15 days max */
1265         for(i=dd->count; i<dd->count+dd->rrsig_count; i++) {
1266                 t = rrsig_get_expiry(dd->rr_data[i], dd->rr_len[i]);
1267                 if((int32_t)t - (int32_t)*env->now > 0) {
1268                         t -= (int32_t)*env->now;
1269                         if(t < r)
1270                                 r = t;
1271                 }
1272         }
1273         return (time_t)r;
1274 }
1275
1276 /** Is rr self-signed revoked key */
1277 static int
1278 rr_is_selfsigned_revoked(struct module_env* env, struct val_env* ve,
1279         struct ub_packed_rrset_key* dnskey_rrset, size_t i)
1280 {
1281         enum sec_status sec;
1282         char* reason = NULL;
1283         verbose(VERB_ALGO, "seen REVOKE flag, check self-signed, rr %d",
1284                 (int)i);
1285         /* no algorithm downgrade protection necessary, if it is selfsigned
1286          * revoked it can be removed. */
1287         sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset, i,
1288                 &reason);
1289         return (sec == sec_status_secure);
1290 }
1291
1292 /** Set fetched value */
1293 static void
1294 seen_trustanchor(struct autr_ta* ta, uint8_t seen)
1295 {
1296         ta->fetched = seen;
1297         if(ta->pending_count < 250) /* no numerical overflow, please */
1298                 ta->pending_count++;
1299 }
1300
1301 /** set revoked value */
1302 static void
1303 seen_revoked_trustanchor(struct autr_ta* ta, uint8_t revoked)
1304 {
1305         ta->revoked = revoked;
1306 }
1307
1308 /** revoke a trust anchor */
1309 static void
1310 revoke_dnskey(struct autr_ta* ta, int off)
1311 {
1312         uint16_t flags;
1313         uint8_t* data;
1314         if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len) !=
1315                 LDNS_RR_TYPE_DNSKEY)
1316                 return;
1317         if(sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len) < 2)
1318                 return;
1319         data = sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len);
1320         flags = sldns_read_uint16(data);
1321         if (off && (flags&LDNS_KEY_REVOKE_KEY))
1322                 flags ^= LDNS_KEY_REVOKE_KEY; /* flip */
1323         else
1324                 flags |= LDNS_KEY_REVOKE_KEY;
1325         sldns_write_uint16(data, flags);
1326 }
1327
1328 /** Compare two RRs skipping the REVOKED bit. Pass rdata(no len) */
1329 static int
1330 dnskey_compare_skip_revbit(uint8_t* a, size_t a_len, uint8_t* b, size_t b_len)
1331 {
1332         size_t i;
1333         if(a_len != b_len)
1334                 return -1;
1335         /* compare RRs RDATA byte for byte. */
1336         for(i = 0; i < a_len; i++)
1337         {
1338                 uint8_t rdf1, rdf2;
1339                 rdf1 = a[i];
1340                 rdf2 = b[i];
1341                 if(i==1) {
1342                         /* this is the second part of the flags field */
1343                         rdf1 |= LDNS_KEY_REVOKE_KEY;
1344                         rdf2 |= LDNS_KEY_REVOKE_KEY;
1345                 }
1346                 if (rdf1 < rdf2)        return -1;
1347                 else if (rdf1 > rdf2)   return 1;
1348         }
1349         return 0;
1350 }
1351
1352
1353 /** compare trust anchor with rdata, 0 if equal. Pass rdata(no len) */
1354 static int
1355 ta_compare(struct autr_ta* a, uint16_t t, uint8_t* b, size_t b_len)
1356 {
1357         if(!a) return -1;
1358         else if(!b) return -1;
1359         else if(sldns_wirerr_get_type(a->rr, a->rr_len, a->dname_len) != t)
1360                 return (int)sldns_wirerr_get_type(a->rr, a->rr_len,
1361                         a->dname_len) - (int)t;
1362         else if(t == LDNS_RR_TYPE_DNSKEY) {
1363                 return dnskey_compare_skip_revbit(
1364                         sldns_wirerr_get_rdata(a->rr, a->rr_len, a->dname_len),
1365                         sldns_wirerr_get_rdatalen(a->rr, a->rr_len,
1366                         a->dname_len), b, b_len);
1367         }
1368         else if(t == LDNS_RR_TYPE_DS) {
1369                 if(sldns_wirerr_get_rdatalen(a->rr, a->rr_len, a->dname_len) !=
1370                         b_len)
1371                         return -1;
1372                 return memcmp(sldns_wirerr_get_rdata(a->rr,
1373                         a->rr_len, a->dname_len), b, b_len);
1374         }
1375         return -1;
1376 }
1377
1378 /**
1379  * Find key
1380  * @param tp: to search in
1381  * @param t: rr type of the rdata.
1382  * @param rdata: to look for  (no rdatalen in it)
1383  * @param rdata_len: length of rdata
1384  * @param result: returns NULL or the ta key looked for.
1385  * @return false on malloc failure during search. if true examine result.
1386  */
1387 static int
1388 find_key(struct trust_anchor* tp, uint16_t t, uint8_t* rdata, size_t rdata_len,
1389         struct autr_ta** result)
1390 {
1391         struct autr_ta* ta;
1392         if(!tp || !rdata) {
1393                 *result = NULL;
1394                 return 0;
1395         }
1396         for(ta=tp->autr->keys; ta; ta=ta->next) {
1397                 if(ta_compare(ta, t, rdata, rdata_len) == 0) {
1398                         *result = ta;
1399                         return 1;
1400                 }
1401         }
1402         *result = NULL;
1403         return 1;
1404 }
1405
1406 /** add key and clone RR and tp already locked. rdata without rdlen. */
1407 static struct autr_ta*
1408 add_key(struct trust_anchor* tp, uint32_t ttl, uint8_t* rdata, size_t rdata_len)
1409 {
1410         struct autr_ta* ta;
1411         uint8_t* rr;
1412         size_t rr_len, dname_len;
1413         uint16_t rrtype = htons(LDNS_RR_TYPE_DNSKEY);
1414         uint16_t rrclass = htons(LDNS_RR_CLASS_IN);
1415         uint16_t rdlen = htons(rdata_len);
1416         dname_len = tp->namelen;
1417         ttl = htonl(ttl);
1418         rr_len = dname_len + 10 /* type,class,ttl,rdatalen */ + rdata_len;
1419         rr = (uint8_t*)malloc(rr_len);
1420         if(!rr) return NULL;
1421         memmove(rr, tp->name, tp->namelen);
1422         memmove(rr+dname_len, &rrtype, 2);
1423         memmove(rr+dname_len+2, &rrclass, 2);
1424         memmove(rr+dname_len+4, &ttl, 4);
1425         memmove(rr+dname_len+8, &rdlen, 2);
1426         memmove(rr+dname_len+10, rdata, rdata_len);
1427         ta = autr_ta_create(rr, rr_len, dname_len);
1428         if(!ta) {
1429                 /* rr freed in autr_ta_create */
1430                 return NULL;
1431         }
1432         /* link in, tp already locked */
1433         ta->next = tp->autr->keys;
1434         tp->autr->keys = ta;
1435         return ta;
1436 }
1437
1438 /** get TTL from DNSKEY rrset */
1439 static time_t
1440 key_ttl(struct ub_packed_rrset_key* k)
1441 {
1442         struct packed_rrset_data* d = (struct packed_rrset_data*)k->entry.data;
1443         return d->ttl;
1444 }
1445
1446 /** update the time values for the trustpoint */
1447 static void
1448 set_tp_times(struct trust_anchor* tp, time_t rrsig_exp_interval,
1449         time_t origttl, int* changed)
1450 {
1451         time_t x, qi = tp->autr->query_interval, rt = tp->autr->retry_time;
1452
1453         /* x = MIN(15days, ttl/2, expire/2) */
1454         x = 15 * 24 * 3600;
1455         if(origttl/2 < x)
1456                 x = origttl/2;
1457         if(rrsig_exp_interval/2 < x)
1458                 x = rrsig_exp_interval/2;
1459         /* MAX(1hr, x) */
1460         if(!autr_permit_small_holddown) {
1461                 if(x < 3600)
1462                         tp->autr->query_interval = 3600;
1463                 else    tp->autr->query_interval = x;
1464         }       else    tp->autr->query_interval = x;
1465
1466         /* x= MIN(1day, ttl/10, expire/10) */
1467         x = 24 * 3600;
1468         if(origttl/10 < x)
1469                 x = origttl/10;
1470         if(rrsig_exp_interval/10 < x)
1471                 x = rrsig_exp_interval/10;
1472         /* MAX(1hr, x) */
1473         if(!autr_permit_small_holddown) {
1474                 if(x < 3600)
1475                         tp->autr->retry_time = 3600;
1476                 else    tp->autr->retry_time = x;
1477         }       else    tp->autr->retry_time = x;
1478
1479         if(qi != tp->autr->query_interval || rt != tp->autr->retry_time) {
1480                 *changed = 1;
1481                 verbose(VERB_ALGO, "orig_ttl is %d", (int)origttl);
1482                 verbose(VERB_ALGO, "rrsig_exp_interval is %d",
1483                         (int)rrsig_exp_interval);
1484                 verbose(VERB_ALGO, "query_interval: %d, retry_time: %d",
1485                         (int)tp->autr->query_interval,
1486                         (int)tp->autr->retry_time);
1487         }
1488 }
1489
1490 /** init events to zero */
1491 static void
1492 init_events(struct trust_anchor* tp)
1493 {
1494         struct autr_ta* ta;
1495         for(ta=tp->autr->keys; ta; ta=ta->next) {
1496                 ta->fetched = 0;
1497         }
1498 }
1499
1500 /** check for revoked keys without trusting any other information */
1501 static void
1502 check_contains_revoked(struct module_env* env, struct val_env* ve,
1503         struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1504         int* changed)
1505 {
1506         struct packed_rrset_data* dd = (struct packed_rrset_data*)
1507                 dnskey_rrset->entry.data;
1508         size_t i;
1509         log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1510         for(i=0; i<dd->count; i++) {
1511                 struct autr_ta* ta = NULL;
1512                 if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1513                         dd->rr_data[i]+2, dd->rr_len[i]-2) ||
1514                         !rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1515                         dd->rr_data[i]+2, dd->rr_len[i]-2))
1516                         continue; /* not a revoked KSK */
1517                 if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1518                         dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1519                         log_err("malloc failure");
1520                         continue; /* malloc fail in compare*/
1521                 }
1522                 if(!ta)
1523                         continue; /* key not found */
1524                 if(rr_is_selfsigned_revoked(env, ve, dnskey_rrset, i)) {
1525                         /* checked if there is an rrsig signed by this key. */
1526                         /* same keytag, but stored can be revoked already, so
1527                          * compare keytags, with +0 or +128(REVOKE flag) */
1528                         log_assert(dnskey_calc_keytag(dnskey_rrset, i)-128 ==
1529                                 sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1530                                 ta->rr, ta->rr_len, ta->dname_len),
1531                                 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1532                                 ta->dname_len)) ||
1533                                 dnskey_calc_keytag(dnskey_rrset, i) ==
1534                                 sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1535                                 ta->rr, ta->rr_len, ta->dname_len),
1536                                 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1537                                 ta->dname_len))); /* checks conversion*/
1538                         verbose_key(ta, VERB_ALGO, "is self-signed revoked");
1539                         if(!ta->revoked)
1540                                 *changed = 1;
1541                         seen_revoked_trustanchor(ta, 1);
1542                         do_revoked(env, ta, changed);
1543                 }
1544         }
1545 }
1546
1547 /** See if a DNSKEY is verified by one of the DSes */
1548 static int
1549 key_matches_a_ds(struct module_env* env, struct val_env* ve,
1550         struct ub_packed_rrset_key* dnskey_rrset, size_t key_idx,
1551         struct ub_packed_rrset_key* ds_rrset)
1552 {
1553         struct packed_rrset_data* dd = (struct packed_rrset_data*)
1554                         ds_rrset->entry.data;
1555         size_t ds_idx, num = dd->count;
1556         int d = val_favorite_ds_algo(ds_rrset);
1557         char* reason = "";
1558         for(ds_idx=0; ds_idx<num; ds_idx++) {
1559                 if(!ds_digest_algo_is_supported(ds_rrset, ds_idx) ||
1560                         !ds_key_algo_is_supported(ds_rrset, ds_idx) ||
1561                         ds_get_digest_algo(ds_rrset, ds_idx) != d)
1562                         continue;
1563                 if(ds_get_key_algo(ds_rrset, ds_idx)
1564                    != dnskey_get_algo(dnskey_rrset, key_idx)
1565                    || dnskey_calc_keytag(dnskey_rrset, key_idx)
1566                    != ds_get_keytag(ds_rrset, ds_idx)) {
1567                         continue;
1568                 }
1569                 if(!ds_digest_match_dnskey(env, dnskey_rrset, key_idx,
1570                         ds_rrset, ds_idx)) {
1571                         verbose(VERB_ALGO, "DS match attempt failed");
1572                         continue;
1573                 }
1574                 if(dnskey_verify_rrset(env, ve, dnskey_rrset,
1575                         dnskey_rrset, key_idx, &reason) == sec_status_secure) {
1576                         return 1;
1577                 } else {
1578                         verbose(VERB_ALGO, "DS match failed because the key "
1579                                 "does not verify the keyset: %s", reason);
1580                 }
1581         }
1582         return 0;
1583 }
1584
1585 /** Set update events */
1586 static int
1587 update_events(struct module_env* env, struct val_env* ve,
1588         struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1589         int* changed)
1590 {
1591         struct packed_rrset_data* dd = (struct packed_rrset_data*)
1592                 dnskey_rrset->entry.data;
1593         size_t i;
1594         log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1595         init_events(tp);
1596         for(i=0; i<dd->count; i++) {
1597                 struct autr_ta* ta = NULL;
1598                 if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1599                         dd->rr_data[i]+2, dd->rr_len[i]-2))
1600                         continue;
1601                 if(rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1602                         dd->rr_data[i]+2, dd->rr_len[i]-2)) {
1603                         /* self-signed revoked keys already detected before,
1604                          * other revoked keys are not 'added' again */
1605                         continue;
1606                 }
1607                 /* is a key of this type supported?. Note rr_list and
1608                  * packed_rrset are in the same order. */
1609                 if(!dnskey_algo_is_supported(dnskey_rrset, i)) {
1610                         /* skip unknown algorithm key, it is useless to us */
1611                         log_nametypeclass(VERB_DETAIL, "trust point has "
1612                                 "unsupported algorithm at",
1613                                 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
1614                         continue;
1615                 }
1616
1617                 /* is it new? if revocation bit set, find the unrevoked key */
1618                 if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1619                         dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1620                         return 0;
1621                 }
1622                 if(!ta) {
1623                         ta = add_key(tp, (uint32_t)dd->rr_ttl[i],
1624                                 dd->rr_data[i]+2, dd->rr_len[i]-2);
1625                         *changed = 1;
1626                         /* first time seen, do we have DSes? if match: VALID */
1627                         if(ta && tp->ds_rrset && key_matches_a_ds(env, ve,
1628                                 dnskey_rrset, i, tp->ds_rrset)) {
1629                                 verbose_key(ta, VERB_ALGO, "verified by DS");
1630                                 ta->s = AUTR_STATE_VALID;
1631                         }
1632                 }
1633                 if(!ta) {
1634                         return 0;
1635                 }
1636                 seen_trustanchor(ta, 1);
1637                 verbose_key(ta, VERB_ALGO, "in DNS response");
1638         }
1639         set_tp_times(tp, min_expiry(env, dd), key_ttl(dnskey_rrset), changed);
1640         return 1;
1641 }
1642
1643 /**
1644  * Check if the holddown time has already exceeded
1645  * setting: add-holddown: add holddown timer
1646  * setting: del-holddown: del holddown timer
1647  * @param env: environment with current time
1648  * @param ta: trust anchor to check for.
1649  * @param holddown: the timer value
1650  * @return number of seconds the holddown has passed.
1651  */
1652 static time_t
1653 check_holddown(struct module_env* env, struct autr_ta* ta,
1654         unsigned int holddown)
1655 {
1656         time_t elapsed;
1657         if(*env->now < ta->last_change) {
1658                 log_warn("time goes backwards. delaying key holddown");
1659                 return 0;
1660         }
1661         elapsed = *env->now - ta->last_change;
1662         if (elapsed > (time_t)holddown) {
1663                 return elapsed-(time_t)holddown;
1664         }
1665         verbose_key(ta, VERB_ALGO, "holddown time " ARG_LL "d seconds to go",
1666                 (long long) ((time_t)holddown-elapsed));
1667         return 0;
1668 }
1669
1670
1671 /** Set last_change to now */
1672 static void
1673 reset_holddown(struct module_env* env, struct autr_ta* ta, int* changed)
1674 {
1675         ta->last_change = *env->now;
1676         *changed = 1;
1677 }
1678
1679 /** Set the state for this trust anchor */
1680 static void
1681 set_trustanchor_state(struct module_env* env, struct autr_ta* ta, int* changed,
1682         autr_state_t s)
1683 {
1684         verbose_key(ta, VERB_ALGO, "update: %s to %s",
1685                 trustanchor_state2str(ta->s), trustanchor_state2str(s));
1686         ta->s = s;
1687         reset_holddown(env, ta, changed);
1688 }
1689
1690
1691 /** Event: NewKey */
1692 static void
1693 do_newkey(struct module_env* env, struct autr_ta* anchor, int* c)
1694 {
1695         if (anchor->s == AUTR_STATE_START)
1696                 set_trustanchor_state(env, anchor, c, AUTR_STATE_ADDPEND);
1697 }
1698
1699 /** Event: AddTime */
1700 static void
1701 do_addtime(struct module_env* env, struct autr_ta* anchor, int* c)
1702 {
1703         /* This not according to RFC, this is 30 days, but the RFC demands
1704          * MAX(30days, TTL expire time of first DNSKEY set with this key),
1705          * The value may be too small if a very large TTL was used. */
1706         time_t exceeded = check_holddown(env, anchor, env->cfg->add_holddown);
1707         if (exceeded && anchor->s == AUTR_STATE_ADDPEND) {
1708                 verbose_key(anchor, VERB_ALGO, "add-holddown time exceeded "
1709                         ARG_LL "d seconds ago, and pending-count %d",
1710                         (long long)exceeded, anchor->pending_count);
1711                 if(anchor->pending_count >= MIN_PENDINGCOUNT) {
1712                         set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1713                         anchor->pending_count = 0;
1714                         return;
1715                 }
1716                 verbose_key(anchor, VERB_ALGO, "add-holddown time sanity check "
1717                         "failed (pending count: %d)", anchor->pending_count);
1718         }
1719 }
1720
1721 /** Event: RemTime */
1722 static void
1723 do_remtime(struct module_env* env, struct autr_ta* anchor, int* c)
1724 {
1725         time_t exceeded = check_holddown(env, anchor, env->cfg->del_holddown);
1726         if(exceeded && anchor->s == AUTR_STATE_REVOKED) {
1727                 verbose_key(anchor, VERB_ALGO, "del-holddown time exceeded "
1728                         ARG_LL "d seconds ago", (long long)exceeded);
1729                 set_trustanchor_state(env, anchor, c, AUTR_STATE_REMOVED);
1730         }
1731 }
1732
1733 /** Event: KeyRem */
1734 static void
1735 do_keyrem(struct module_env* env, struct autr_ta* anchor, int* c)
1736 {
1737         if(anchor->s == AUTR_STATE_ADDPEND) {
1738                 set_trustanchor_state(env, anchor, c, AUTR_STATE_START);
1739                 anchor->pending_count = 0;
1740         } else if(anchor->s == AUTR_STATE_VALID)
1741                 set_trustanchor_state(env, anchor, c, AUTR_STATE_MISSING);
1742 }
1743
1744 /** Event: KeyPres */
1745 static void
1746 do_keypres(struct module_env* env, struct autr_ta* anchor, int* c)
1747 {
1748         if(anchor->s == AUTR_STATE_MISSING)
1749                 set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1750 }
1751
1752 /* Event: Revoked */
1753 static void
1754 do_revoked(struct module_env* env, struct autr_ta* anchor, int* c)
1755 {
1756         if(anchor->s == AUTR_STATE_VALID || anchor->s == AUTR_STATE_MISSING) {
1757                 set_trustanchor_state(env, anchor, c, AUTR_STATE_REVOKED);
1758                 verbose_key(anchor, VERB_ALGO, "old id, prior to revocation");
1759                 revoke_dnskey(anchor, 0);
1760                 verbose_key(anchor, VERB_ALGO, "new id, after revocation");
1761         }
1762 }
1763
1764 /** Do statestable transition matrix for anchor */
1765 static void
1766 anchor_state_update(struct module_env* env, struct autr_ta* anchor, int* c)
1767 {
1768         log_assert(anchor);
1769         switch(anchor->s) {
1770         /* START */
1771         case AUTR_STATE_START:
1772                 /* NewKey: ADDPEND */
1773                 if (anchor->fetched)
1774                         do_newkey(env, anchor, c);
1775                 break;
1776         /* ADDPEND */
1777         case AUTR_STATE_ADDPEND:
1778                 /* KeyRem: START */
1779                 if (!anchor->fetched)
1780                         do_keyrem(env, anchor, c);
1781                 /* AddTime: VALID */
1782                 else    do_addtime(env, anchor, c);
1783                 break;
1784         /* VALID */
1785         case AUTR_STATE_VALID:
1786                 /* RevBit: REVOKED */
1787                 if (anchor->revoked)
1788                         do_revoked(env, anchor, c);
1789                 /* KeyRem: MISSING */
1790                 else if (!anchor->fetched)
1791                         do_keyrem(env, anchor, c);
1792                 else if(!anchor->last_change) {
1793                         verbose_key(anchor, VERB_ALGO, "first seen");
1794                         reset_holddown(env, anchor, c);
1795                 }
1796                 break;
1797         /* MISSING */
1798         case AUTR_STATE_MISSING:
1799                 /* RevBit: REVOKED */
1800                 if (anchor->revoked)
1801                         do_revoked(env, anchor, c);
1802                 /* KeyPres */
1803                 else if (anchor->fetched)
1804                         do_keypres(env, anchor, c);
1805                 break;
1806         /* REVOKED */
1807         case AUTR_STATE_REVOKED:
1808                 if (anchor->fetched)
1809                         reset_holddown(env, anchor, c);
1810                 /* RemTime: REMOVED */
1811                 else    do_remtime(env, anchor, c);
1812                 break;
1813         /* REMOVED */
1814         case AUTR_STATE_REMOVED:
1815         default:
1816                 break;
1817         }
1818 }
1819
1820 /** if ZSK init then trust KSKs */
1821 static int
1822 init_zsk_to_ksk(struct module_env* env, struct trust_anchor* tp, int* changed)
1823 {
1824         /* search for VALID ZSKs */
1825         struct autr_ta* anchor;
1826         int validzsk = 0;
1827         int validksk = 0;
1828         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1829                 /* last_change test makes sure it was manually configured */
1830                 if(sldns_wirerr_get_type(anchor->rr, anchor->rr_len,
1831                         anchor->dname_len) == LDNS_RR_TYPE_DNSKEY &&
1832                         anchor->last_change == 0 &&
1833                         !ta_is_dnskey_sep(anchor) &&
1834                         anchor->s == AUTR_STATE_VALID)
1835                         validzsk++;
1836         }
1837         if(validzsk == 0)
1838                 return 0;
1839         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1840                 if (ta_is_dnskey_sep(anchor) &&
1841                         anchor->s == AUTR_STATE_ADDPEND) {
1842                         verbose_key(anchor, VERB_ALGO, "trust KSK from "
1843                                 "ZSK(config)");
1844                         set_trustanchor_state(env, anchor, changed,
1845                                 AUTR_STATE_VALID);
1846                         validksk++;
1847                 }
1848         }
1849         return validksk;
1850 }
1851
1852 /** Remove missing trustanchors so the list does not grow forever */
1853 static void
1854 remove_missing_trustanchors(struct module_env* env, struct trust_anchor* tp,
1855         int* changed)
1856 {
1857         struct autr_ta* anchor;
1858         time_t exceeded;
1859         int valid = 0;
1860         /* see if we have anchors that are valid */
1861         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1862                 /* Only do KSKs */
1863                 if (!ta_is_dnskey_sep(anchor))
1864                         continue;
1865                 if (anchor->s == AUTR_STATE_VALID)
1866                         valid++;
1867         }
1868         /* if there are no SEP Valid anchors, see if we started out with
1869          * a ZSK (last-change=0) anchor, which is VALID and there are KSKs
1870          * now that can be made valid.  Do this immediately because there
1871          * is no guarantee that the ZSKs get announced long enough.  Usually
1872          * this is immediately after init with a ZSK trusted, unless the domain
1873          * was not advertising any KSKs at all.  In which case we perfectly
1874          * track the zero number of KSKs. */
1875         if(valid == 0) {
1876                 valid = init_zsk_to_ksk(env, tp, changed);
1877                 if(valid == 0)
1878                         return;
1879         }
1880
1881         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1882                 /* ignore ZSKs if newly added */
1883                 if(anchor->s == AUTR_STATE_START)
1884                         continue;
1885                 /* remove ZSKs if a KSK is present */
1886                 if (!ta_is_dnskey_sep(anchor)) {
1887                         if(valid > 0) {
1888                                 verbose_key(anchor, VERB_ALGO, "remove ZSK "
1889                                         "[%d key(s) VALID]", valid);
1890                                 set_trustanchor_state(env, anchor, changed,
1891                                         AUTR_STATE_REMOVED);
1892                         }
1893                         continue;
1894                 }
1895                 /* Only do MISSING keys */
1896                 if (anchor->s != AUTR_STATE_MISSING)
1897                         continue;
1898                 if(env->cfg->keep_missing == 0)
1899                         continue; /* keep forever */
1900
1901                 exceeded = check_holddown(env, anchor, env->cfg->keep_missing);
1902                 /* If keep_missing has exceeded and we still have more than
1903                  * one valid KSK: remove missing trust anchor */
1904                 if (exceeded && valid > 0) {
1905                         verbose_key(anchor, VERB_ALGO, "keep-missing time "
1906                                 "exceeded " ARG_LL "d seconds ago, [%d key(s) VALID]",
1907                                 (long long)exceeded, valid);
1908                         set_trustanchor_state(env, anchor, changed,
1909                                 AUTR_STATE_REMOVED);
1910                 }
1911         }
1912 }
1913
1914 /** Do the statetable from RFC5011 transition matrix */
1915 static int
1916 do_statetable(struct module_env* env, struct trust_anchor* tp, int* changed)
1917 {
1918         struct autr_ta* anchor;
1919         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1920                 /* Only do KSKs */
1921                 if(!ta_is_dnskey_sep(anchor))
1922                         continue;
1923                 anchor_state_update(env, anchor, changed);
1924         }
1925         remove_missing_trustanchors(env, tp, changed);
1926         return 1;
1927 }
1928
1929 /** See if time alone makes ADDPEND to VALID transition */
1930 static void
1931 autr_holddown_exceed(struct module_env* env, struct trust_anchor* tp, int* c)
1932 {
1933         struct autr_ta* anchor;
1934         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1935                 if(ta_is_dnskey_sep(anchor) &&
1936                         anchor->s == AUTR_STATE_ADDPEND)
1937                         do_addtime(env, anchor, c);
1938         }
1939 }
1940
1941 /** cleanup key list */
1942 static void
1943 autr_cleanup_keys(struct trust_anchor* tp)
1944 {
1945         struct autr_ta* p, **prevp;
1946         prevp = &tp->autr->keys;
1947         p = tp->autr->keys;
1948         while(p) {
1949                 /* do we want to remove this key? */
1950                 if(p->s == AUTR_STATE_START || p->s == AUTR_STATE_REMOVED ||
1951                         sldns_wirerr_get_type(p->rr, p->rr_len, p->dname_len)
1952                         != LDNS_RR_TYPE_DNSKEY) {
1953                         struct autr_ta* np = p->next;
1954                         /* remove */
1955                         free(p->rr);
1956                         free(p);
1957                         /* snip and go to next item */
1958                         *prevp = np;
1959                         p = np;
1960                         continue;
1961                 }
1962                 /* remove pending counts if no longer pending */
1963                 if(p->s != AUTR_STATE_ADDPEND)
1964                         p->pending_count = 0;
1965                 prevp = &p->next;
1966                 p = p->next;
1967         }
1968 }
1969
1970 /** calculate next probe time */
1971 static time_t
1972 calc_next_probe(struct module_env* env, time_t wait)
1973 {
1974         /* make it random, 90-100% */
1975         time_t rnd, rest;
1976         if(!autr_permit_small_holddown) {
1977                 if(wait < 3600)
1978                         wait = 3600;
1979         } else {
1980                 if(wait == 0) wait = 1;
1981         }
1982         rnd = wait/10;
1983         rest = wait-rnd;
1984         rnd = (time_t)ub_random_max(env->rnd, (long int)rnd);
1985         return (time_t)(*env->now + rest + rnd);
1986 }
1987
1988 /** what is first probe time (anchors must be locked) */
1989 static time_t
1990 wait_probe_time(struct val_anchors* anchors)
1991 {
1992         rbnode_t* t = rbtree_first(&anchors->autr->probe);
1993         if(t != RBTREE_NULL)
1994                 return ((struct trust_anchor*)t->key)->autr->next_probe_time;
1995         return 0;
1996 }
1997
1998 /** reset worker timer */
1999 static void
2000 reset_worker_timer(struct module_env* env)
2001 {
2002         struct timeval tv;
2003 #ifndef S_SPLINT_S
2004         time_t next = (time_t)wait_probe_time(env->anchors);
2005         /* in case this is libunbound, no timer */
2006         if(!env->probe_timer)
2007                 return;
2008         if(next > *env->now)
2009                 tv.tv_sec = (time_t)(next - *env->now);
2010         else    tv.tv_sec = 0;
2011 #endif
2012         tv.tv_usec = 0;
2013         comm_timer_set(env->probe_timer, &tv);
2014         verbose(VERB_ALGO, "scheduled next probe in " ARG_LL "d sec", (long long)tv.tv_sec);
2015 }
2016
2017 /** set next probe for trust anchor */
2018 static int
2019 set_next_probe(struct module_env* env, struct trust_anchor* tp,
2020         struct ub_packed_rrset_key* dnskey_rrset)
2021 {
2022         struct trust_anchor key, *tp2;
2023         time_t mold, mnew;
2024         /* use memory allocated in rrset for temporary name storage */
2025         key.node.key = &key;
2026         key.name = dnskey_rrset->rk.dname;
2027         key.namelen = dnskey_rrset->rk.dname_len;
2028         key.namelabs = dname_count_labels(key.name);
2029         key.dclass = tp->dclass;
2030         lock_basic_unlock(&tp->lock);
2031
2032         /* fetch tp again and lock anchors, so that we can modify the trees */
2033         lock_basic_lock(&env->anchors->lock);
2034         tp2 = (struct trust_anchor*)rbtree_search(env->anchors->tree, &key);
2035         if(!tp2) {
2036                 verbose(VERB_ALGO, "trustpoint was deleted in set_next_probe");
2037                 lock_basic_unlock(&env->anchors->lock);
2038                 return 0;
2039         }
2040         log_assert(tp == tp2);
2041         lock_basic_lock(&tp->lock);
2042
2043         /* schedule */
2044         mold = wait_probe_time(env->anchors);
2045         (void)rbtree_delete(&env->anchors->autr->probe, tp);
2046         tp->autr->next_probe_time = calc_next_probe(env,
2047                 tp->autr->query_interval);
2048         (void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2049         mnew = wait_probe_time(env->anchors);
2050
2051         lock_basic_unlock(&env->anchors->lock);
2052         verbose(VERB_ALGO, "next probe set in %d seconds",
2053                 (int)tp->autr->next_probe_time - (int)*env->now);
2054         if(mold != mnew) {
2055                 reset_worker_timer(env);
2056         }
2057         return 1;
2058 }
2059
2060 /** Revoke and Delete a trust point */
2061 static void
2062 autr_tp_remove(struct module_env* env, struct trust_anchor* tp,
2063         struct ub_packed_rrset_key* dnskey_rrset)
2064 {
2065         struct trust_anchor* del_tp;
2066         struct trust_anchor key;
2067         struct autr_point_data pd;
2068         time_t mold, mnew;
2069
2070         log_nametypeclass(VERB_OPS, "trust point was revoked",
2071                 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2072         tp->autr->revoked = 1;
2073
2074         /* use space allocated for dnskey_rrset to save name of anchor */
2075         memset(&key, 0, sizeof(key));
2076         memset(&pd, 0, sizeof(pd));
2077         key.autr = &pd;
2078         key.node.key = &key;
2079         pd.pnode.key = &key;
2080         pd.next_probe_time = tp->autr->next_probe_time;
2081         key.name = dnskey_rrset->rk.dname;
2082         key.namelen = tp->namelen;
2083         key.namelabs = tp->namelabs;
2084         key.dclass = tp->dclass;
2085
2086         /* unlock */
2087         lock_basic_unlock(&tp->lock);
2088
2089         /* take from tree. It could be deleted by someone else,hence (void). */
2090         lock_basic_lock(&env->anchors->lock);
2091         del_tp = (struct trust_anchor*)rbtree_delete(env->anchors->tree, &key);
2092         mold = wait_probe_time(env->anchors);
2093         (void)rbtree_delete(&env->anchors->autr->probe, &key);
2094         mnew = wait_probe_time(env->anchors);
2095         anchors_init_parents_locked(env->anchors);
2096         lock_basic_unlock(&env->anchors->lock);
2097
2098         /* if !del_tp then the trust point is no longer present in the tree,
2099          * it was deleted by someone else, who will write the zonefile and
2100          * clean up the structure */
2101         if(del_tp) {
2102                 /* save on disk */
2103                 del_tp->autr->next_probe_time = 0; /* no more probing for it */
2104                 autr_write_file(env, del_tp);
2105
2106                 /* delete */
2107                 autr_point_delete(del_tp);
2108         }
2109         if(mold != mnew) {
2110                 reset_worker_timer(env);
2111         }
2112 }
2113
2114 int autr_process_prime(struct module_env* env, struct val_env* ve,
2115         struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset)
2116 {
2117         int changed = 0;
2118         log_assert(tp && tp->autr);
2119         /* autotrust update trust anchors */
2120         /* the tp is locked, and stays locked unless it is deleted */
2121
2122         /* we could just catch the anchor here while another thread
2123          * is busy deleting it. Just unlock and let the other do its job */
2124         if(tp->autr->revoked) {
2125                 log_nametypeclass(VERB_ALGO, "autotrust not processed, "
2126                         "trust point revoked", tp->name,
2127                         LDNS_RR_TYPE_DNSKEY, tp->dclass);
2128                 lock_basic_unlock(&tp->lock);
2129                 return 0; /* it is revoked */
2130         }
2131
2132         /* query_dnskeys(): */
2133         tp->autr->last_queried = *env->now;
2134
2135         log_nametypeclass(VERB_ALGO, "autotrust process for",
2136                 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2137         /* see if time alone makes some keys valid */
2138         autr_holddown_exceed(env, tp, &changed);
2139         if(changed) {
2140                 verbose(VERB_ALGO, "autotrust: morekeys, reassemble");
2141                 if(!autr_assemble(tp)) {
2142                         log_err("malloc failure assembling autotrust keys");
2143                         return 1; /* unchanged */
2144                 }
2145         }
2146         /* did we get any data? */
2147         if(!dnskey_rrset) {
2148                 verbose(VERB_ALGO, "autotrust: no dnskey rrset");
2149                 /* no update of query_failed, because then we would have
2150                  * to write to disk. But we cannot because we maybe are
2151                  * still 'initialising' with DS records, that we cannot write
2152                  * in the full format (which only contains KSKs). */
2153                 return 1; /* trust point exists */
2154         }
2155         /* check for revoked keys to remove immediately */
2156         check_contains_revoked(env, ve, tp, dnskey_rrset, &changed);
2157         if(changed) {
2158                 verbose(VERB_ALGO, "autotrust: revokedkeys, reassemble");
2159                 if(!autr_assemble(tp)) {
2160                         log_err("malloc failure assembling autotrust keys");
2161                         return 1; /* unchanged */
2162                 }
2163                 if(!tp->ds_rrset && !tp->dnskey_rrset) {
2164                         /* no more keys, all are revoked */
2165                         /* this is a success for this probe attempt */
2166                         tp->autr->last_success = *env->now;
2167                         autr_tp_remove(env, tp, dnskey_rrset);
2168                         return 0; /* trust point removed */
2169                 }
2170         }
2171         /* verify the dnskey rrset and see if it is valid. */
2172         if(!verify_dnskey(env, ve, tp, dnskey_rrset)) {
2173                 verbose(VERB_ALGO, "autotrust: dnskey did not verify.");
2174                 /* only increase failure count if this is not the first prime,
2175                  * this means there was a previous successful probe */
2176                 if(tp->autr->last_success) {
2177                         tp->autr->query_failed += 1;
2178                         autr_write_file(env, tp);
2179                 }
2180                 return 1; /* trust point exists */
2181         }
2182
2183         tp->autr->last_success = *env->now;
2184         tp->autr->query_failed = 0;
2185
2186         /* Add new trust anchors to the data structure
2187          * - note which trust anchors are seen this probe.
2188          * Set trustpoint query_interval and retry_time.
2189          * - find minimum rrsig expiration interval
2190          */
2191         if(!update_events(env, ve, tp, dnskey_rrset, &changed)) {
2192                 log_err("malloc failure in autotrust update_events. "
2193                         "trust point unchanged.");
2194                 return 1; /* trust point unchanged, so exists */
2195         }
2196
2197         /* - for every SEP key do the 5011 statetable.
2198          * - remove missing trustanchors (if veryold and we have new anchors).
2199          */
2200         if(!do_statetable(env, tp, &changed)) {
2201                 log_err("malloc failure in autotrust do_statetable. "
2202                         "trust point unchanged.");
2203                 return 1; /* trust point unchanged, so exists */
2204         }
2205
2206         autr_cleanup_keys(tp);
2207         if(!set_next_probe(env, tp, dnskey_rrset))
2208                 return 0; /* trust point does not exist */
2209         autr_write_file(env, tp);
2210         if(changed) {
2211                 verbose(VERB_ALGO, "autotrust: changed, reassemble");
2212                 if(!autr_assemble(tp)) {
2213                         log_err("malloc failure assembling autotrust keys");
2214                         return 1; /* unchanged */
2215                 }
2216                 if(!tp->ds_rrset && !tp->dnskey_rrset) {
2217                         /* no more keys, all are revoked */
2218                         autr_tp_remove(env, tp, dnskey_rrset);
2219                         return 0; /* trust point removed */
2220                 }
2221         } else verbose(VERB_ALGO, "autotrust: no changes");
2222
2223         return 1; /* trust point exists */
2224 }
2225
2226 /** debug print a trust anchor key */
2227 static void
2228 autr_debug_print_ta(struct autr_ta* ta)
2229 {
2230         char buf[32];
2231         char* str = sldns_wire2str_rr(ta->rr, ta->rr_len);
2232         if(!str) {
2233                 log_info("out of memory in debug_print_ta");
2234                 return;
2235         }
2236         if(str && str[0]) str[strlen(str)-1]=0; /* remove newline */
2237         ctime_r(&ta->last_change, buf);
2238         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2239         log_info("[%s] %s ;;state:%d ;;pending_count:%d%s%s last:%s",
2240                 trustanchor_state2str(ta->s), str, ta->s, ta->pending_count,
2241                 ta->fetched?" fetched":"", ta->revoked?" revoked":"", buf);
2242         free(str);
2243 }
2244
2245 /** debug print a trust point */
2246 static void
2247 autr_debug_print_tp(struct trust_anchor* tp)
2248 {
2249         struct autr_ta* ta;
2250         char buf[257];
2251         if(!tp->autr)
2252                 return;
2253         dname_str(tp->name, buf);
2254         log_info("trust point %s : %d", buf, (int)tp->dclass);
2255         log_info("assembled %d DS and %d DNSKEYs",
2256                 (int)tp->numDS, (int)tp->numDNSKEY);
2257         if(tp->ds_rrset) {
2258                 log_packed_rrset(0, "DS:", tp->ds_rrset);
2259         }
2260         if(tp->dnskey_rrset) {
2261                 log_packed_rrset(0, "DNSKEY:", tp->dnskey_rrset);
2262         }
2263         log_info("file %s", tp->autr->file);
2264         ctime_r(&tp->autr->last_queried, buf);
2265         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2266         log_info("last_queried: %u %s", (unsigned)tp->autr->last_queried, buf);
2267         ctime_r(&tp->autr->last_success, buf);
2268         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2269         log_info("last_success: %u %s", (unsigned)tp->autr->last_success, buf);
2270         ctime_r(&tp->autr->next_probe_time, buf);
2271         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2272         log_info("next_probe_time: %u %s", (unsigned)tp->autr->next_probe_time,
2273                 buf);
2274         log_info("query_interval: %u", (unsigned)tp->autr->query_interval);
2275         log_info("retry_time: %u", (unsigned)tp->autr->retry_time);
2276         log_info("query_failed: %u", (unsigned)tp->autr->query_failed);
2277
2278         for(ta=tp->autr->keys; ta; ta=ta->next) {
2279                 autr_debug_print_ta(ta);
2280         }
2281 }
2282
2283 void
2284 autr_debug_print(struct val_anchors* anchors)
2285 {
2286         struct trust_anchor* tp;
2287         lock_basic_lock(&anchors->lock);
2288         RBTREE_FOR(tp, struct trust_anchor*, anchors->tree) {
2289                 lock_basic_lock(&tp->lock);
2290                 autr_debug_print_tp(tp);
2291                 lock_basic_unlock(&tp->lock);
2292         }
2293         lock_basic_unlock(&anchors->lock);
2294 }
2295
2296 void probe_answer_cb(void* arg, int ATTR_UNUSED(rcode),
2297         sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(sec),
2298         char* ATTR_UNUSED(why_bogus))
2299 {
2300         /* retry was set before the query was done,
2301          * re-querytime is set when query succeeded, but that may not
2302          * have reset this timer because the query could have been
2303          * handled by another thread. In that case, this callback would
2304          * get called after the original timeout is done.
2305          * By not resetting the timer, it may probe more often, but not
2306          * less often.
2307          * Unless the new lookup resulted in smaller TTLs and thus smaller
2308          * timeout values. In that case one old TTL could be mistakenly done.
2309          */
2310         struct module_env* env = (struct module_env*)arg;
2311         verbose(VERB_ALGO, "autotrust probe answer cb");
2312         reset_worker_timer(env);
2313 }
2314
2315 /** probe a trust anchor DNSKEY and unlocks tp */
2316 static void
2317 probe_anchor(struct module_env* env, struct trust_anchor* tp)
2318 {
2319         struct query_info qinfo;
2320         uint16_t qflags = BIT_RD;
2321         struct edns_data edns;
2322         sldns_buffer* buf = env->scratch_buffer;
2323         qinfo.qname = regional_alloc_init(env->scratch, tp->name, tp->namelen);
2324         if(!qinfo.qname) {
2325                 log_err("out of memory making 5011 probe");
2326                 return;
2327         }
2328         qinfo.qname_len = tp->namelen;
2329         qinfo.qtype = LDNS_RR_TYPE_DNSKEY;
2330         qinfo.qclass = tp->dclass;
2331         log_query_info(VERB_ALGO, "autotrust probe", &qinfo);
2332         verbose(VERB_ALGO, "retry probe set in %d seconds",
2333                 (int)tp->autr->next_probe_time - (int)*env->now);
2334         edns.edns_present = 1;
2335         edns.ext_rcode = 0;
2336         edns.edns_version = 0;
2337         edns.bits = EDNS_DO;
2338         edns.opt_list = NULL;
2339         if(sldns_buffer_capacity(buf) < 65535)
2340                 edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
2341         else    edns.udp_size = 65535;
2342
2343         /* can't hold the lock while mesh_run is processing */
2344         lock_basic_unlock(&tp->lock);
2345
2346         /* delete the DNSKEY from rrset and key cache so an active probe
2347          * is done. First the rrset so another thread does not use it
2348          * to recreate the key entry in a race condition. */
2349         rrset_cache_remove(env->rrset_cache, qinfo.qname, qinfo.qname_len,
2350                 qinfo.qtype, qinfo.qclass, 0);
2351         key_cache_remove(env->key_cache, qinfo.qname, qinfo.qname_len,
2352                 qinfo.qclass);
2353
2354         if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
2355                 &probe_answer_cb, env)) {
2356                 log_err("out of memory making 5011 probe");
2357         }
2358 }
2359
2360 /** fetch first to-probe trust-anchor and lock it and set retrytime */
2361 static struct trust_anchor*
2362 todo_probe(struct module_env* env, time_t* next)
2363 {
2364         struct trust_anchor* tp;
2365         rbnode_t* el;
2366         /* get first one */
2367         lock_basic_lock(&env->anchors->lock);
2368         if( (el=rbtree_first(&env->anchors->autr->probe)) == RBTREE_NULL) {
2369                 /* in case of revoked anchors */
2370                 lock_basic_unlock(&env->anchors->lock);
2371                 /* signal that there are no anchors to probe */
2372                 *next = 0;
2373                 return NULL;
2374         }
2375         tp = (struct trust_anchor*)el->key;
2376         lock_basic_lock(&tp->lock);
2377
2378         /* is it eligible? */
2379         if((time_t)tp->autr->next_probe_time > *env->now) {
2380                 /* no more to probe */
2381                 *next = (time_t)tp->autr->next_probe_time - *env->now;
2382                 lock_basic_unlock(&tp->lock);
2383                 lock_basic_unlock(&env->anchors->lock);
2384                 return NULL;
2385         }
2386
2387         /* reset its next probe time */
2388         (void)rbtree_delete(&env->anchors->autr->probe, tp);
2389         tp->autr->next_probe_time = calc_next_probe(env, tp->autr->retry_time);
2390         (void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2391         lock_basic_unlock(&env->anchors->lock);
2392
2393         return tp;
2394 }
2395
2396 time_t
2397 autr_probe_timer(struct module_env* env)
2398 {
2399         struct trust_anchor* tp;
2400         time_t next_probe = 3600;
2401         int num = 0;
2402         if(autr_permit_small_holddown) next_probe = 1;
2403         verbose(VERB_ALGO, "autotrust probe timer callback");
2404         /* while there are still anchors to probe */
2405         while( (tp = todo_probe(env, &next_probe)) ) {
2406                 /* make a probe for this anchor */
2407                 probe_anchor(env, tp);
2408                 num++;
2409         }
2410         regional_free_all(env->scratch);
2411         if(next_probe == 0)
2412                 return 0; /* no trust points to probe */
2413         verbose(VERB_ALGO, "autotrust probe timer %d callbacks done", num);
2414         return next_probe;
2415 }