2 * validator/val_anchor.c - validator trust anchor storage.
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 * This file contains storage for the trust anchors for the validator.
43 #include "validator/val_anchor.h"
44 #include "validator/val_sigcrypt.h"
45 #include "validator/autotrust.h"
46 #include "util/data/packed_rrset.h"
47 #include "util/data/dname.h"
49 #include "util/net_help.h"
50 #include "util/config_file.h"
51 #include "util/as112.h"
52 #include "sldns/sbuffer.h"
53 #include "sldns/rrdef.h"
54 #include "sldns/str2wire.h"
60 anchor_cmp(const void* k1, const void* k2)
63 struct trust_anchor* n1 = (struct trust_anchor*)k1;
64 struct trust_anchor* n2 = (struct trust_anchor*)k2;
65 /* no need to ntohs(class) because sort order is irrelevant */
66 if(n1->dclass != n2->dclass) {
67 if(n1->dclass < n2->dclass)
71 return dname_lab_cmp(n1->name, n1->namelabs, n2->name, n2->namelabs,
78 struct val_anchors* a = (struct val_anchors*)calloc(1, sizeof(*a));
81 a->tree = rbtree_create(anchor_cmp);
86 a->autr = autr_global_create();
91 lock_basic_init(&a->lock);
92 lock_protect(&a->lock, a, sizeof(*a));
93 lock_protect(&a->lock, a->autr, sizeof(*a->autr));
97 /** delete assembled rrset */
99 assembled_rrset_delete(struct ub_packed_rrset_key* pkey)
102 if(pkey->entry.data) {
103 struct packed_rrset_data* pd = (struct packed_rrset_data*)
110 free(pkey->rk.dname);
114 /** destroy locks in tree and delete autotrust anchors */
116 anchors_delfunc(rbnode_t* elem, void* ATTR_UNUSED(arg))
118 struct trust_anchor* ta = (struct trust_anchor*)elem;
121 autr_point_delete(ta);
123 struct ta_key* p, *np;
124 lock_basic_destroy(&ta->lock);
133 assembled_rrset_delete(ta->ds_rrset);
134 assembled_rrset_delete(ta->dnskey_rrset);
140 anchors_delete(struct val_anchors* anchors)
144 lock_unprotect(&anchors->lock, anchors->autr);
145 lock_unprotect(&anchors->lock, anchors);
146 lock_basic_destroy(&anchors->lock);
148 traverse_postorder(anchors->tree, anchors_delfunc, NULL);
150 autr_global_delete(anchors->autr);
155 anchors_init_parents_locked(struct val_anchors* anchors)
157 struct trust_anchor* node, *prev = NULL, *p;
159 /* nobody else can grab locks because we hold the main lock.
160 * Thus the previous items, after unlocked, are not deleted */
161 RBTREE_FOR(node, struct trust_anchor*, anchors->tree) {
162 lock_basic_lock(&node->lock);
164 if(!prev || prev->dclass != node->dclass) {
166 lock_basic_unlock(&node->lock);
169 (void)dname_lab_cmp(prev->name, prev->namelabs, node->name,
170 node->namelabs, &m); /* we know prev is smaller */
171 /* sort order like: . com. bla.com. zwb.com. net. */
172 /* find the previous, or parent-parent-parent */
173 for(p = prev; p; p = p->parent)
174 /* looking for name with few labels, a parent */
175 if(p->namelabs <= m) {
176 /* ==: since prev matched m, this is closest*/
177 /* <: prev matches more, but is not a parent,
178 * this one is a (grand)parent */
182 lock_basic_unlock(&node->lock);
187 /** initialise parent pointers in the tree */
189 init_parents(struct val_anchors* anchors)
191 lock_basic_lock(&anchors->lock);
192 anchors_init_parents_locked(anchors);
193 lock_basic_unlock(&anchors->lock);
197 anchor_find(struct val_anchors* anchors, uint8_t* name, int namelabs,
198 size_t namelen, uint16_t dclass)
200 struct trust_anchor key;
202 if(!name) return NULL;
205 key.namelabs = namelabs;
206 key.namelen = namelen;
208 lock_basic_lock(&anchors->lock);
209 n = rbtree_search(anchors->tree, &key);
211 lock_basic_lock(&((struct trust_anchor*)n->key)->lock);
213 lock_basic_unlock(&anchors->lock);
216 return (struct trust_anchor*)n->key;
219 /** create new trust anchor object */
220 static struct trust_anchor*
221 anchor_new_ta(struct val_anchors* anchors, uint8_t* name, int namelabs,
222 size_t namelen, uint16_t dclass, int lockit)
227 struct trust_anchor* ta = (struct trust_anchor*)malloc(
228 sizeof(struct trust_anchor));
231 memset(ta, 0, sizeof(*ta));
233 ta->name = memdup(name, namelen);
238 ta->namelabs = namelabs;
239 ta->namelen = namelen;
241 lock_basic_init(&ta->lock);
243 lock_basic_lock(&anchors->lock);
250 rbtree_insert(anchors->tree, &ta->node);
252 lock_basic_unlock(&anchors->lock);
254 log_assert(r != NULL);
258 /** find trustanchor key by exact data match */
259 static struct ta_key*
260 anchor_find_key(struct trust_anchor* ta, uint8_t* rdata, size_t rdata_len,
264 for(k = ta->keylist; k; k = k->next) {
265 if(k->type == type && k->len == rdata_len &&
266 memcmp(k->data, rdata, rdata_len) == 0)
272 /** create new trustanchor key */
273 static struct ta_key*
274 anchor_new_ta_key(uint8_t* rdata, size_t rdata_len, uint16_t type)
276 struct ta_key* k = (struct ta_key*)malloc(sizeof(*k));
279 memset(k, 0, sizeof(*k));
280 k->data = memdup(rdata, rdata_len);
291 * This routine adds a new RR to a trust anchor. The trust anchor may not
292 * exist yet, and is created if not. The RR can be DS or DNSKEY.
293 * This routine will also remove duplicates; storing them only once.
294 * @param anchors: anchor storage.
295 * @param name: name of trust anchor (wireformat)
296 * @param type: type or RR
297 * @param dclass: class of RR
298 * @param rdata: rdata wireformat, starting with rdlength.
299 * If NULL, nothing is stored, but an entry is created.
300 * @param rdata_len: length of rdata including rdlength.
301 * @return: NULL on error, else the trust anchor.
303 static struct trust_anchor*
304 anchor_store_new_key(struct val_anchors* anchors, uint8_t* name, uint16_t type,
305 uint16_t dclass, uint8_t* rdata, size_t rdata_len)
308 struct trust_anchor* ta;
311 namelabs = dname_count_size_labels(name, &namelen);
312 if(type != LDNS_RR_TYPE_DS && type != LDNS_RR_TYPE_DNSKEY) {
313 log_err("Bad type for trust anchor");
316 /* lookup or create trustanchor */
317 ta = anchor_find(anchors, name, namelabs, namelen, dclass);
319 ta = anchor_new_ta(anchors, name, namelabs, namelen, dclass, 1);
322 lock_basic_lock(&ta->lock);
325 lock_basic_unlock(&ta->lock);
328 /* look for duplicates */
329 if(anchor_find_key(ta, rdata, rdata_len, type)) {
330 lock_basic_unlock(&ta->lock);
333 k = anchor_new_ta_key(rdata, rdata_len, type);
335 lock_basic_unlock(&ta->lock);
339 if(type == LDNS_RR_TYPE_DS)
341 else ta->numDNSKEY++;
342 k->next = ta->keylist;
344 lock_basic_unlock(&ta->lock);
349 * Add new RR. It converts ldns RR to wire format.
350 * @param anchors: anchor storage.
351 * @param rr: the wirerr.
352 * @param rl: length of rr.
353 * @param dl: length of dname.
354 * @return NULL on error, else the trust anchor.
356 static struct trust_anchor*
357 anchor_store_new_rr(struct val_anchors* anchors, uint8_t* rr, size_t rl,
360 struct trust_anchor* ta;
361 if(!(ta=anchor_store_new_key(anchors, rr,
362 sldns_wirerr_get_type(rr, rl, dl),
363 sldns_wirerr_get_class(rr, rl, dl),
364 sldns_wirerr_get_rdatawl(rr, rl, dl),
365 sldns_wirerr_get_rdatalen(rr, rl, dl)+2))) {
368 log_nametypeclass(VERB_QUERY, "adding trusted key",
369 rr, sldns_wirerr_get_type(rr, rl, dl),
370 sldns_wirerr_get_class(rr, rl, dl));
375 * Insert insecure anchor
376 * @param anchors: anchor storage.
377 * @param str: the domain name.
378 * @return NULL on error, Else last trust anchor point
380 static struct trust_anchor*
381 anchor_insert_insecure(struct val_anchors* anchors, const char* str)
383 struct trust_anchor* ta;
384 size_t dname_len = 0;
385 uint8_t* nm = sldns_str2wire_dname(str, &dname_len);
387 log_err("parse error in domain name '%s'", str);
390 ta = anchor_store_new_key(anchors, nm, LDNS_RR_TYPE_DS,
391 LDNS_RR_CLASS_IN, NULL, 0);
397 anchor_store_str(struct val_anchors* anchors, sldns_buffer* buffer,
400 struct trust_anchor* ta;
401 uint8_t* rr = sldns_buffer_begin(buffer);
402 size_t len = sldns_buffer_capacity(buffer), dname_len = 0;
403 int status = sldns_str2wire_rr_buf(str, rr, &len, &dname_len,
404 0, NULL, 0, NULL, 0);
406 log_err("error parsing trust anchor %s: at %d: %s",
407 str, LDNS_WIREPARSE_OFFSET(status),
408 sldns_get_errorstr_parse(status));
411 if(!(ta=anchor_store_new_rr(anchors, rr, len, dname_len))) {
412 log_err("out of memory");
419 * Read a file with trust anchors
420 * @param anchors: anchor storage.
421 * @param buffer: parsing buffer.
422 * @param fname: string.
423 * @param onlyone: only one trust anchor allowed in file.
424 * @return NULL on error. Else last trust-anchor point.
426 static struct trust_anchor*
427 anchor_read_file(struct val_anchors* anchors, sldns_buffer* buffer,
428 const char* fname, int onlyone)
430 struct trust_anchor* ta = NULL, *tanew;
431 struct sldns_file_parse_state pst;
433 size_t len, dname_len;
434 uint8_t* rr = sldns_buffer_begin(buffer);
436 FILE* in = fopen(fname, "r");
438 log_err("error opening file %s: %s", fname, strerror(errno));
441 memset(&pst, 0, sizeof(pst));
442 pst.default_ttl = 3600;
445 len = sldns_buffer_capacity(buffer);
447 status = sldns_fp2wire_rr_buf(in, rr, &len, &dname_len, &pst);
448 if(len == 0) /* empty, $TTL, $ORIGIN */
451 log_err("parse error in %s:%d:%d : %s", fname,
452 pst.lineno, LDNS_WIREPARSE_OFFSET(status),
453 sldns_get_errorstr_parse(status));
457 if(sldns_wirerr_get_type(rr, len, dname_len) !=
458 LDNS_RR_TYPE_DS && sldns_wirerr_get_type(rr, len,
459 dname_len) != LDNS_RR_TYPE_DNSKEY) {
462 if(!(tanew=anchor_store_new_rr(anchors, rr, len, dname_len))) {
463 log_err("mem error at %s line %d", fname, pst.lineno);
467 if(onlyone && ta && ta != tanew) {
468 log_err("error at %s line %d: no multiple anchor "
469 "domains allowed (you can have multiple "
470 "keys, but they must have the same name).",
479 /* empty file is OK when multiple anchors are allowed */
480 if(!onlyone && !ta) return (struct trust_anchor*)1;
484 /** skip file to end of line */
486 skip_to_eol(FILE* in)
489 while((c = getc(in)) != EOF ) {
495 /** true for special characters in bind configs */
497 is_bind_special(int c)
510 * Read a keyword skipping bind comments; spaces, specials, restkeywords.
511 * The file is split into the following tokens:
512 * * special characters, on their own, rdlen=1, { } doublequote ;
513 * * whitespace becomes a single ' ' or tab. Newlines become spaces.
514 * * other words ('keywords')
515 * * comments are skipped if desired
516 * / / C++ style comment to end of line
518 * / * C style comment * /
519 * @param in: file to read from.
520 * @param buf: buffer, what is read is stored after current buffer position.
521 * Space is left in the buffer to write a terminating 0.
522 * @param line: line number is increased per line, for error reports.
523 * @param comments: if 0, comments are not possible and become text.
524 * if 1, comments are skipped entirely.
525 * In BIND files, this is when reading quoted strings, for example
526 * " base 64 text with / / in there "
527 * @return the number of character written to the buffer.
531 readkeyword_bindfile(FILE* in, sldns_buffer* buf, int* line, int comments)
535 while((c = getc(in)) != EOF ) {
536 if(comments && c == '#') { /* # blabla */
540 } else if(comments && c=='/' && numdone>0 && /* /_/ bla*/
541 sldns_buffer_read_u8_at(buf,
542 sldns_buffer_position(buf)-1) == '/') {
543 sldns_buffer_skip(buf, -1);
548 } else if(comments && c=='*' && numdone>0 && /* /_* bla *_/ */
549 sldns_buffer_read_u8_at(buf,
550 sldns_buffer_position(buf)-1) == '/') {
551 sldns_buffer_skip(buf, -1);
553 /* skip to end of comment */
554 while(c != EOF && (c=getc(in)) != EOF ) {
556 if((c=getc(in)) == '/')
564 /* not a comment, complete the keyword */
566 /* check same type */
567 if(isspace((unsigned char)c)) {
571 if(is_bind_special(c)) {
580 /* space for 1 char + 0 string terminator */
581 if(sldns_buffer_remaining(buf) < 2) {
582 fatal_exit("trusted-keys, %d, string too long", *line);
584 sldns_buffer_write_u8(buf, (uint8_t)c);
586 if(isspace((unsigned char)c)) {
587 /* collate whitespace into ' ' */
588 while((c = getc(in)) != EOF ) {
591 if(!isspace((unsigned char)c)) {
598 if(is_bind_special(c))
604 /** skip through file to { or ; */
606 skip_to_special(FILE* in, sldns_buffer* buf, int* line, int spec)
609 sldns_buffer_clear(buf);
610 while((rdlen=readkeyword_bindfile(in, buf, line, 1))) {
611 if(rdlen == 1 && isspace((unsigned char)*sldns_buffer_begin(buf))) {
612 sldns_buffer_clear(buf);
615 if(rdlen != 1 || *sldns_buffer_begin(buf) != (uint8_t)spec) {
616 sldns_buffer_write_u8(buf, 0);
617 log_err("trusted-keys, line %d, expected %c",
623 log_err("trusted-keys, line %d, expected %c got EOF", *line, spec);
628 * read contents of trusted-keys{ ... ; clauses and insert keys into storage.
629 * @param anchors: where to store keys
630 * @param buf: buffer to use
631 * @param line: line number in file
632 * @param in: file to read from.
633 * @return 0 on error.
636 process_bind_contents(struct val_anchors* anchors, sldns_buffer* buf,
639 /* loop over contents, collate strings before ; */
640 /* contents is (numbered): 0 1 2 3 4 5 6 7 8 */
641 /* name. 257 3 5 base64 base64 */
642 /* quoted value: 0 "111" 0 0 0 0 0 0 0 */
643 /* comments value: 1 "000" 1 1 1 "0 0 0 0" 1 */
649 sldns_buffer_clear(buf);
650 while((rdlen=readkeyword_bindfile(in, buf, line, comments))) {
651 if(rdlen == 1 && sldns_buffer_position(buf) == 1
652 && isspace((unsigned char)*sldns_buffer_begin(buf))) {
653 /* starting whitespace is removed */
654 sldns_buffer_clear(buf);
656 } else if(rdlen == 1 && sldns_buffer_current(buf)[-1] == '"') {
657 /* remove " from the string */
662 sldns_buffer_skip(buf, -1);
663 if(contnum > 0 && quoted) {
664 if(sldns_buffer_remaining(buf) < 8+1) {
665 log_err("line %d, too long", *line);
668 sldns_buffer_write(buf, " DNSKEY ", 8);
671 } else if(contnum > 0)
672 comments = !comments;
674 } else if(rdlen == 1 && sldns_buffer_current(buf)[-1] == ';') {
677 sldns_buffer_write_u8(buf, 0);
678 log_err("line %d, bad key", *line);
681 sldns_buffer_skip(buf, -1);
682 sldns_buffer_write_u8(buf, 0);
683 str = strdup((char*)sldns_buffer_begin(buf));
685 log_err("line %d, allocation failure", *line);
688 if(!anchor_store_str(anchors, buf, str)) {
689 log_err("line %d, bad key", *line);
694 sldns_buffer_clear(buf);
699 } else if(rdlen == 1 && sldns_buffer_current(buf)[-1] == '}') {
701 sldns_buffer_write_u8(buf, 0);
702 log_err("line %d, bad key before }", *line);
706 } else if(rdlen == 1 &&
707 isspace((unsigned char)sldns_buffer_current(buf)[-1])) {
708 /* leave whitespace here */
710 /* not space or whatnot, so actual content */
712 if(contnum == 1 && !quoted) {
713 if(sldns_buffer_remaining(buf) < 8+1) {
714 log_err("line %d, too long", *line);
717 sldns_buffer_write(buf, " DNSKEY ", 8);
722 log_err("line %d, EOF before }", *line);
727 * Read a BIND9 like file with trust anchors in named.conf format.
728 * @param anchors: anchor storage.
729 * @param buffer: parsing buffer.
730 * @param fname: string.
731 * @return false on error.
734 anchor_read_bind_file(struct val_anchors* anchors, sldns_buffer* buffer,
738 FILE* in = fopen(fname, "r");
741 log_err("error opening file %s: %s", fname, strerror(errno));
744 verbose(VERB_QUERY, "reading in bind-compat-mode: '%s'", fname);
745 /* scan for trusted-keys keyword, ignore everything else */
746 sldns_buffer_clear(buffer);
747 while((rdlen=readkeyword_bindfile(in, buffer, &line_nr, 1)) != 0) {
748 if(rdlen != 12 || strncmp((char*)sldns_buffer_begin(buffer),
749 "trusted-keys", 12) != 0) {
750 sldns_buffer_clear(buffer);
751 /* ignore everything but trusted-keys */
754 if(!skip_to_special(in, buffer, &line_nr, '{')) {
755 log_err("error in trusted key: \"%s\"", fname);
759 /* process contents */
760 if(!process_bind_contents(anchors, buffer, &line_nr, in)) {
761 log_err("error in trusted key: \"%s\"", fname);
765 if(!skip_to_special(in, buffer, &line_nr, ';')) {
766 log_err("error in trusted key: \"%s\"", fname);
770 sldns_buffer_clear(buffer);
777 * Read a BIND9 like files with trust anchors in named.conf format.
778 * Performs wildcard processing of name.
779 * @param anchors: anchor storage.
780 * @param buffer: parsing buffer.
781 * @param pat: pattern string. (can be wildcarded)
782 * @return false on error.
785 anchor_read_bind_file_wild(struct val_anchors* anchors, sldns_buffer* buffer,
792 if(!strchr(pat, '*') && !strchr(pat, '?') && !strchr(pat, '[') &&
793 !strchr(pat, '{') && !strchr(pat, '~')) {
794 return anchor_read_bind_file(anchors, buffer, pat);
796 verbose(VERB_QUERY, "wildcard found, processing %s", pat);
811 memset(&g, 0, sizeof(g));
812 r = glob(pat, flags, NULL, &g);
815 if(r == GLOB_NOMATCH) {
816 verbose(VERB_QUERY, "trusted-keys-file: "
817 "no matches for %s", pat);
819 } else if(r == GLOB_NOSPACE) {
820 log_err("wildcard trusted-keys-file %s: "
821 "pattern out of memory", pat);
822 } else if(r == GLOB_ABORTED) {
823 log_err("wildcard trusted-keys-file %s: expansion "
824 "aborted (%s)", pat, strerror(errno));
826 log_err("wildcard trusted-keys-file %s: expansion "
827 "failed (%s)", pat, strerror(errno));
829 /* ignore globs that yield no files */
832 /* process files found, if any */
833 for(i=0; i<(size_t)g.gl_pathc; i++) {
834 if(!anchor_read_bind_file(anchors, buffer, g.gl_pathv[i])) {
835 log_err("error reading wildcard "
836 "trusted-keys-file: %s", g.gl_pathv[i]);
843 #else /* not HAVE_GLOB */
844 return anchor_read_bind_file(anchors, buffer, pat);
845 #endif /* HAVE_GLOB */
849 * Assemble an rrset structure for the type
850 * @param ta: trust anchor.
851 * @param num: number of items to fetch from list.
852 * @param type: fetch only items of this type.
853 * @return rrset or NULL on error.
855 static struct ub_packed_rrset_key*
856 assemble_it(struct trust_anchor* ta, size_t num, uint16_t type)
858 struct ub_packed_rrset_key* pkey = (struct ub_packed_rrset_key*)
859 malloc(sizeof(*pkey));
860 struct packed_rrset_data* pd;
865 memset(pkey, 0, sizeof(*pkey));
866 pkey->rk.dname = memdup(ta->name, ta->namelen);
867 if(!pkey->rk.dname) {
872 pkey->rk.dname_len = ta->namelen;
873 pkey->rk.type = htons(type);
874 pkey->rk.rrset_class = htons(ta->dclass);
875 /* The rrset is build in an uncompressed way. This means it
876 * cannot be copied in the normal way. */
877 pd = (struct packed_rrset_data*)malloc(sizeof(*pd));
879 free(pkey->rk.dname);
883 memset(pd, 0, sizeof(*pd));
885 pd->trust = rrset_trust_ultimate;
886 pd->rr_len = (size_t*)reallocarray(NULL, num, sizeof(size_t));
889 free(pkey->rk.dname);
893 pd->rr_ttl = (time_t*)reallocarray(NULL, num, sizeof(time_t));
897 free(pkey->rk.dname);
901 pd->rr_data = (uint8_t**)reallocarray(NULL, num, sizeof(uint8_t*));
906 free(pkey->rk.dname);
912 for(tk = ta->keylist; tk; tk = tk->next) {
915 pd->rr_len[i] = tk->len;
916 /* reuse data ptr to allocation in talist */
917 pd->rr_data[i] = tk->data;
921 pkey->entry.data = (void*)pd;
926 * Assemble structures for the trust DS and DNSKEY rrsets.
927 * @param ta: trust anchor
928 * @return: false on error.
931 anchors_assemble(struct trust_anchor* ta)
934 ta->ds_rrset = assemble_it(ta, ta->numDS, LDNS_RR_TYPE_DS);
938 if(ta->numDNSKEY > 0) {
939 ta->dnskey_rrset = assemble_it(ta, ta->numDNSKEY,
940 LDNS_RR_TYPE_DNSKEY);
941 if(!ta->dnskey_rrset)
948 * Check DS algos for support, warn if not.
949 * @param ta: trust anchor
950 * @return number of DS anchors with unsupported algorithms.
953 anchors_ds_unsupported(struct trust_anchor* ta)
956 for(i=0; i<ta->numDS; i++) {
957 if(!ds_digest_algo_is_supported(ta->ds_rrset, i) ||
958 !ds_key_algo_is_supported(ta->ds_rrset, i))
965 * Check DNSKEY algos for support, warn if not.
966 * @param ta: trust anchor
967 * @return number of DNSKEY anchors with unsupported algorithms.
970 anchors_dnskey_unsupported(struct trust_anchor* ta)
973 for(i=0; i<ta->numDNSKEY; i++) {
974 if(!dnskey_algo_is_supported(ta->dnskey_rrset, i))
981 * Assemble the rrsets in the anchors, ready for use by validator.
982 * @param anchors: trust anchor storage.
983 * @return: false on error.
986 anchors_assemble_rrsets(struct val_anchors* anchors)
988 struct trust_anchor* ta;
989 struct trust_anchor* next;
991 lock_basic_lock(&anchors->lock);
992 ta=(struct trust_anchor*)rbtree_first(anchors->tree);
993 while((rbnode_t*)ta != RBTREE_NULL) {
994 next = (struct trust_anchor*)rbtree_next(&ta->node);
995 lock_basic_lock(&ta->lock);
996 if(ta->autr || (ta->numDS == 0 && ta->numDNSKEY == 0)) {
997 lock_basic_unlock(&ta->lock);
998 ta = next; /* skip */
1001 if(!anchors_assemble(ta)) {
1002 log_err("out of memory");
1003 lock_basic_unlock(&ta->lock);
1004 lock_basic_unlock(&anchors->lock);
1007 nods = anchors_ds_unsupported(ta);
1008 nokey = anchors_dnskey_unsupported(ta);
1010 log_nametypeclass(0, "warning: unsupported "
1011 "algorithm for trust anchor",
1012 ta->name, LDNS_RR_TYPE_DS, ta->dclass);
1015 log_nametypeclass(0, "warning: unsupported "
1016 "algorithm for trust anchor",
1017 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
1019 if(nods == ta->numDS && nokey == ta->numDNSKEY) {
1021 dname_str(ta->name, b);
1022 log_warn("trust anchor %s has no supported algorithms,"
1023 " the anchor is ignored (check if you need to"
1024 " upgrade unbound and "
1025 #ifdef HAVE_LIBRESSL
1031 (void)rbtree_delete(anchors->tree, &ta->node);
1032 lock_basic_unlock(&ta->lock);
1033 if(anchors->dlv_anchor == ta)
1034 anchors->dlv_anchor = NULL;
1035 anchors_delfunc(&ta->node, NULL);
1039 lock_basic_unlock(&ta->lock);
1042 lock_basic_unlock(&anchors->lock);
1047 anchors_apply_cfg(struct val_anchors* anchors, struct config_file* cfg)
1049 struct config_strlist* f;
1052 sldns_buffer* parsebuf = sldns_buffer_new(65535);
1053 if(cfg->insecure_lan_zones) {
1054 for(zstr = as112_zones; *zstr; zstr++) {
1055 if(!anchor_insert_insecure(anchors, *zstr)) {
1056 log_err("error in insecure-lan-zones: %s", *zstr);
1057 sldns_buffer_free(parsebuf);
1062 for(f = cfg->domain_insecure; f; f = f->next) {
1063 if(!f->str || f->str[0] == 0) /* empty "" */
1065 if(!anchor_insert_insecure(anchors, f->str)) {
1066 log_err("error in domain-insecure: %s", f->str);
1067 sldns_buffer_free(parsebuf);
1071 for(f = cfg->trust_anchor_file_list; f; f = f->next) {
1072 if(!f->str || f->str[0] == 0) /* empty "" */
1075 if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(nm,
1076 cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
1077 nm += strlen(cfg->chrootdir);
1078 if(!anchor_read_file(anchors, parsebuf, nm, 0)) {
1079 log_err("error reading trust-anchor-file: %s", f->str);
1080 sldns_buffer_free(parsebuf);
1084 for(f = cfg->trusted_keys_file_list; f; f = f->next) {
1085 if(!f->str || f->str[0] == 0) /* empty "" */
1088 if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(nm,
1089 cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
1090 nm += strlen(cfg->chrootdir);
1091 if(!anchor_read_bind_file_wild(anchors, parsebuf, nm)) {
1092 log_err("error reading trusted-keys-file: %s", f->str);
1093 sldns_buffer_free(parsebuf);
1097 for(f = cfg->trust_anchor_list; f; f = f->next) {
1098 if(!f->str || f->str[0] == 0) /* empty "" */
1100 if(!anchor_store_str(anchors, parsebuf, f->str)) {
1101 log_err("error in trust-anchor: \"%s\"", f->str);
1102 sldns_buffer_free(parsebuf);
1106 if(cfg->dlv_anchor_file && cfg->dlv_anchor_file[0] != 0) {
1107 struct trust_anchor* dlva;
1108 nm = cfg->dlv_anchor_file;
1109 if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(nm,
1110 cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
1111 nm += strlen(cfg->chrootdir);
1112 if(!(dlva = anchor_read_file(anchors, parsebuf,
1114 log_err("error reading dlv-anchor-file: %s",
1115 cfg->dlv_anchor_file);
1116 sldns_buffer_free(parsebuf);
1119 lock_basic_lock(&anchors->lock);
1120 anchors->dlv_anchor = dlva;
1121 lock_basic_unlock(&anchors->lock);
1123 for(f = cfg->dlv_anchor_list; f; f = f->next) {
1124 struct trust_anchor* dlva;
1125 if(!f->str || f->str[0] == 0) /* empty "" */
1127 if(!(dlva = anchor_store_str(
1128 anchors, parsebuf, f->str))) {
1129 log_err("error in dlv-anchor: \"%s\"", f->str);
1130 sldns_buffer_free(parsebuf);
1133 lock_basic_lock(&anchors->lock);
1134 anchors->dlv_anchor = dlva;
1135 lock_basic_unlock(&anchors->lock);
1137 /* do autr last, so that it sees what anchors are filled by other
1138 * means can can print errors about double config for the name */
1139 for(f = cfg->auto_trust_anchor_file_list; f; f = f->next) {
1140 if(!f->str || f->str[0] == 0) /* empty "" */
1143 if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(nm,
1144 cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
1145 nm += strlen(cfg->chrootdir);
1146 if(!autr_read_file(anchors, nm)) {
1147 log_err("error reading auto-trust-anchor-file: %s",
1149 sldns_buffer_free(parsebuf);
1153 /* first assemble, since it may delete useless anchors */
1154 anchors_assemble_rrsets(anchors);
1155 init_parents(anchors);
1156 sldns_buffer_free(parsebuf);
1157 if(verbosity >= VERB_ALGO) autr_debug_print(anchors);
1161 struct trust_anchor*
1162 anchors_lookup(struct val_anchors* anchors,
1163 uint8_t* qname, size_t qname_len, uint16_t qclass)
1165 struct trust_anchor key;
1166 struct trust_anchor* result;
1167 rbnode_t* res = NULL;
1168 key.node.key = &key;
1170 key.namelabs = dname_count_labels(qname);
1171 key.namelen = qname_len;
1172 key.dclass = qclass;
1173 lock_basic_lock(&anchors->lock);
1174 if(rbtree_find_less_equal(anchors->tree, &key, &res)) {
1176 result = (struct trust_anchor*)res;
1178 /* smaller element (or no element) */
1180 result = (struct trust_anchor*)res;
1181 if(!result || result->dclass != qclass) {
1182 lock_basic_unlock(&anchors->lock);
1185 /* count number of labels matched */
1186 (void)dname_lab_cmp(result->name, result->namelabs, key.name,
1188 while(result) { /* go up until qname is subdomain of stub */
1189 if(result->namelabs <= m)
1191 result = result->parent;
1195 lock_basic_lock(&result->lock);
1197 lock_basic_unlock(&anchors->lock);
1202 anchors_get_mem(struct val_anchors* anchors)
1204 struct trust_anchor *ta;
1205 size_t s = sizeof(*anchors);
1208 RBTREE_FOR(ta, struct trust_anchor*, anchors->tree) {
1209 s += sizeof(*ta) + ta->namelen;
1210 /* keys and so on */
1216 anchors_add_insecure(struct val_anchors* anchors, uint16_t c, uint8_t* nm)
1218 struct trust_anchor key;
1219 key.node.key = &key;
1221 key.namelabs = dname_count_size_labels(nm, &key.namelen);
1223 lock_basic_lock(&anchors->lock);
1224 if(rbtree_search(anchors->tree, &key)) {
1225 lock_basic_unlock(&anchors->lock);
1226 /* nothing to do, already an anchor or insecure point */
1229 if(!anchor_new_ta(anchors, nm, key.namelabs, key.namelen, c, 0)) {
1230 log_err("out of memory");
1231 lock_basic_unlock(&anchors->lock);
1234 /* no other contents in new ta, because it is insecure point */
1235 anchors_init_parents_locked(anchors);
1236 lock_basic_unlock(&anchors->lock);
1241 anchors_delete_insecure(struct val_anchors* anchors, uint16_t c,
1244 struct trust_anchor key;
1245 struct trust_anchor* ta;
1246 key.node.key = &key;
1248 key.namelabs = dname_count_size_labels(nm, &key.namelen);
1250 lock_basic_lock(&anchors->lock);
1251 if(!(ta=(struct trust_anchor*)rbtree_search(anchors->tree, &key))) {
1252 lock_basic_unlock(&anchors->lock);
1256 /* lock it to drive away other threads that use it */
1257 lock_basic_lock(&ta->lock);
1258 /* see if its really an insecure point */
1259 if(ta->keylist || ta->autr || ta->numDS || ta->numDNSKEY) {
1260 lock_basic_unlock(&anchors->lock);
1261 lock_basic_unlock(&ta->lock);
1262 /* its not an insecure point, do not remove it */
1266 /* remove from tree */
1267 (void)rbtree_delete(anchors->tree, &ta->node);
1268 anchors_init_parents_locked(anchors);
1269 lock_basic_unlock(&anchors->lock);
1271 /* actual free of data */
1272 lock_basic_unlock(&ta->lock);
1273 anchors_delfunc(&ta->node, NULL);