2 * validator/val_utils.c - validator utility functions.
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 * This file contains helper functions for the validator module.
42 #include "validator/val_utils.h"
43 #include "validator/validator.h"
44 #include "validator/val_kentry.h"
45 #include "validator/val_sigcrypt.h"
46 #include "validator/val_anchor.h"
47 #include "validator/val_nsec.h"
48 #include "validator/val_neg.h"
49 #include "services/cache/rrset.h"
50 #include "services/cache/dns.h"
51 #include "util/data/msgreply.h"
52 #include "util/data/packed_rrset.h"
53 #include "util/data/dname.h"
54 #include "util/net_help.h"
55 #include "util/module.h"
56 #include "util/regional.h"
57 #include "util/config_file.h"
58 #include "sldns/wire2str.h"
59 #include "sldns/parseutil.h"
61 enum val_classification
62 val_classify_response(uint16_t query_flags, struct query_info* origqinf,
63 struct query_info* qinf, struct reply_info* rep, size_t skip)
65 int rcode = (int)FLAGS_GET_RCODE(rep->flags);
68 /* Normal Name Error's are easy to detect -- but don't mistake a CNAME
69 * chain ending in NXDOMAIN. */
70 if(rcode == LDNS_RCODE_NXDOMAIN && rep->an_numrrsets == 0)
71 return VAL_CLASS_NAMEERROR;
73 /* check for referral: nonRD query and it looks like a nodata */
74 if(!(query_flags&BIT_RD) && rep->an_numrrsets == 0 &&
75 rcode == LDNS_RCODE_NOERROR) {
76 /* SOA record in auth indicates it is NODATA instead.
77 * All validation requiring NODATA messages have SOA in
78 * authority section. */
79 /* uses fact that answer section is empty */
81 for(i=0; i<rep->ns_numrrsets; i++) {
82 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_SOA)
83 return VAL_CLASS_NODATA;
84 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_DS)
85 return VAL_CLASS_REFERRAL;
86 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS)
89 return saw_ns?VAL_CLASS_REFERRAL:VAL_CLASS_NODATA;
91 /* root referral where NS set is in the answer section */
92 if(!(query_flags&BIT_RD) && rep->ns_numrrsets == 0 &&
93 rep->an_numrrsets == 1 && rcode == LDNS_RCODE_NOERROR &&
94 ntohs(rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_NS &&
95 query_dname_compare(rep->rrsets[0]->rk.dname,
96 origqinf->qname) != 0)
97 return VAL_CLASS_REFERRAL;
99 /* dump bad messages */
100 if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN)
101 return VAL_CLASS_UNKNOWN;
102 /* next check if the skip into the answer section shows no answer */
103 if(skip>0 && rep->an_numrrsets <= skip)
104 return VAL_CLASS_CNAMENOANSWER;
107 if(rcode == LDNS_RCODE_NOERROR && rep->an_numrrsets == 0)
108 return VAL_CLASS_NODATA;
110 /* We distinguish between CNAME response and other positive/negative
111 * responses because CNAME answers require extra processing. */
113 /* We distinguish between ANY and CNAME or POSITIVE because
114 * ANY responses are validated differently. */
115 if(rcode == LDNS_RCODE_NOERROR && qinf->qtype == LDNS_RR_TYPE_ANY)
116 return VAL_CLASS_ANY;
118 /* Note that DNAMEs will be ignored here, unless qtype=DNAME. Unless
119 * qtype=CNAME, this will yield a CNAME response. */
120 for(i=skip; i<rep->an_numrrsets; i++) {
121 if(rcode == LDNS_RCODE_NOERROR &&
122 ntohs(rep->rrsets[i]->rk.type) == qinf->qtype)
123 return VAL_CLASS_POSITIVE;
124 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME)
125 return VAL_CLASS_CNAME;
127 log_dns_msg("validator: error. failed to classify response message: ",
129 return VAL_CLASS_UNKNOWN;
132 /** Get signer name from RRSIG */
134 rrsig_get_signer(uint8_t* data, size_t len, uint8_t** sname, size_t* slen)
136 /* RRSIG rdata is not allowed to be compressed, it is stored
137 * uncompressed in memory as well, so return a ptr to the name */
140 * short, byte, byte, long, long, long, short, "." is
141 * 2 1 1 4 4 4 2 1 = 19
142 * and a skip of 18 bytes to the name.
143 * +2 for the rdatalen is 21 bytes len for root label */
148 data += 20; /* skip the fixed size bits */
150 *slen = dname_valid(data, len);
152 /* bad dname in this rrsig. */
160 val_find_rrset_signer(struct ub_packed_rrset_key* rrset, uint8_t** sname,
163 struct packed_rrset_data* d = (struct packed_rrset_data*)
165 /* return signer for first signature, or NULL */
166 if(d->rrsig_count == 0) {
171 /* get rrsig signer name out of the signature */
172 rrsig_get_signer(d->rr_data[d->count], d->rr_len[d->count],
177 * Find best signer name in this set of rrsigs.
178 * @param rrset: which rrsigs to look through.
179 * @param qinf: the query name that needs validation.
180 * @param signer_name: the best signer_name. Updated if a better one is found.
181 * @param signer_len: length of signer name.
182 * @param matchcount: count of current best name (starts at 0 for no match).
183 * Updated if match is improved.
186 val_find_best_signer(struct ub_packed_rrset_key* rrset,
187 struct query_info* qinf, uint8_t** signer_name, size_t* signer_len,
190 struct packed_rrset_data* d = (struct packed_rrset_data*)
195 for(i=d->count; i<d->count+d->rrsig_count; i++) {
196 sign = d->rr_data[i]+2+18;
197 /* look at signatures that are valid (long enough),
198 * and have a signer name that is a superdomain of qname,
199 * and then check the number of labels in the shared topdomain
200 * improve the match if possible */
201 if(d->rr_len[i] > 2+19 && /* rdata, sig + root label*/
202 dname_subdomain_c(qinf->qname, sign)) {
203 (void)dname_lab_cmp(qinf->qname,
204 dname_count_labels(qinf->qname),
205 sign, dname_count_labels(sign), &m);
206 if(m > *matchcount) {
209 (void)dname_count_size_labels(*signer_name,
217 val_find_signer(enum val_classification subtype, struct query_info* qinf,
218 struct reply_info* rep, size_t skip, uint8_t** signer_name,
223 if(subtype == VAL_CLASS_POSITIVE) {
224 /* check for the answer rrset */
225 for(i=skip; i<rep->an_numrrsets; i++) {
226 if(query_dname_compare(qinf->qname,
227 rep->rrsets[i]->rk.dname) == 0) {
228 val_find_rrset_signer(rep->rrsets[i],
229 signer_name, signer_len);
235 } else if(subtype == VAL_CLASS_CNAME) {
236 /* check for the first signed cname/dname rrset */
237 for(i=skip; i<rep->an_numrrsets; i++) {
238 val_find_rrset_signer(rep->rrsets[i],
239 signer_name, signer_len);
242 if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_DNAME)
243 break; /* only check CNAME after a DNAME */
247 } else if(subtype == VAL_CLASS_NAMEERROR
248 || subtype == VAL_CLASS_NODATA) {
249 /*Check to see if the AUTH section NSEC record(s) have rrsigs*/
250 for(i=rep->an_numrrsets; i<
251 rep->an_numrrsets+rep->ns_numrrsets; i++) {
252 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC
253 || ntohs(rep->rrsets[i]->rk.type) ==
254 LDNS_RR_TYPE_NSEC3) {
255 val_find_rrset_signer(rep->rrsets[i],
256 signer_name, signer_len);
260 } else if(subtype == VAL_CLASS_CNAMENOANSWER) {
261 /* find closest superdomain signer name in authority section
266 for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->
268 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC
269 || ntohs(rep->rrsets[i]->rk.type) ==
270 LDNS_RR_TYPE_NSEC3) {
271 val_find_best_signer(rep->rrsets[i], qinf,
272 signer_name, signer_len, &matchcount);
275 } else if(subtype == VAL_CLASS_ANY) {
276 /* check for one of the answer rrset that has signatures,
277 * or potentially a DNAME is in use with a different qname */
278 for(i=skip; i<rep->an_numrrsets; i++) {
279 if(query_dname_compare(qinf->qname,
280 rep->rrsets[i]->rk.dname) == 0) {
281 val_find_rrset_signer(rep->rrsets[i],
282 signer_name, signer_len);
287 /* no answer RRSIGs with qname, try a DNAME */
288 if(skip < rep->an_numrrsets &&
289 ntohs(rep->rrsets[skip]->rk.type) ==
290 LDNS_RR_TYPE_DNAME) {
291 val_find_rrset_signer(rep->rrsets[skip],
292 signer_name, signer_len);
298 } else if(subtype == VAL_CLASS_REFERRAL) {
299 /* find keys for the item at skip */
300 if(skip < rep->rrset_count) {
301 val_find_rrset_signer(rep->rrsets[skip],
302 signer_name, signer_len);
308 verbose(VERB_QUERY, "find_signer: could not find signer name"
309 " for unknown type response");
315 /** return number of rrs in an rrset */
317 rrset_get_count(struct ub_packed_rrset_key* rrset)
319 struct packed_rrset_data* d = (struct packed_rrset_data*)
325 /** return TTL of rrset */
327 rrset_get_ttl(struct ub_packed_rrset_key* rrset)
329 struct packed_rrset_data* d = (struct packed_rrset_data*)
336 val_verify_rrset(struct module_env* env, struct val_env* ve,
337 struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* keys,
338 uint8_t* sigalg, char** reason, sldns_pkt_section section,
339 struct module_qstate* qstate)
342 struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
344 if(d->security == sec_status_secure) {
345 /* re-verify all other statuses, because keyset may change*/
346 log_nametypeclass(VERB_ALGO, "verify rrset cached",
347 rrset->rk.dname, ntohs(rrset->rk.type),
348 ntohs(rrset->rk.rrset_class));
351 /* check in the cache if verification has already been done */
352 rrset_check_sec_status(env->rrset_cache, rrset, *env->now);
353 if(d->security == sec_status_secure) {
354 log_nametypeclass(VERB_ALGO, "verify rrset from cache",
355 rrset->rk.dname, ntohs(rrset->rk.type),
356 ntohs(rrset->rk.rrset_class));
359 log_nametypeclass(VERB_ALGO, "verify rrset", rrset->rk.dname,
360 ntohs(rrset->rk.type), ntohs(rrset->rk.rrset_class));
361 sec = dnskeyset_verify_rrset(env, ve, rrset, keys, sigalg, reason,
363 verbose(VERB_ALGO, "verify result: %s", sec_status_to_string(sec));
364 regional_free_all(env->scratch);
366 /* update rrset security status
367 * only improves security status
368 * and bogus is set only once, even if we rechecked the status */
369 if(sec > d->security) {
371 if(sec == sec_status_secure)
372 d->trust = rrset_trust_validated;
373 else if(sec == sec_status_bogus) {
375 /* update ttl for rrset to fixed value. */
376 d->ttl = ve->bogus_ttl;
377 for(i=0; i<d->count+d->rrsig_count; i++)
378 d->rr_ttl[i] = ve->bogus_ttl;
379 /* leave RR specific TTL: not used for determine
380 * if RRset timed out and clients see proper value. */
381 lock_basic_lock(&ve->bogus_lock);
382 ve->num_rrset_bogus++;
383 lock_basic_unlock(&ve->bogus_lock);
385 /* if status updated - store in cache for reuse */
386 rrset_update_sec_status(env->rrset_cache, rrset, *env->now);
393 val_verify_rrset_entry(struct module_env* env, struct val_env* ve,
394 struct ub_packed_rrset_key* rrset, struct key_entry_key* kkey,
395 char** reason, sldns_pkt_section section, struct module_qstate* qstate)
397 /* temporary dnskey rrset-key */
398 struct ub_packed_rrset_key dnskey;
399 struct key_entry_data* kd = (struct key_entry_data*)kkey->entry.data;
401 dnskey.rk.type = htons(kd->rrset_type);
402 dnskey.rk.rrset_class = htons(kkey->key_class);
404 dnskey.rk.dname = kkey->name;
405 dnskey.rk.dname_len = kkey->namelen;
406 dnskey.entry.key = &dnskey;
407 dnskey.entry.data = kd->rrset_data;
408 sec = val_verify_rrset(env, ve, rrset, &dnskey, kd->algo, reason,
413 /** verify that a DS RR hashes to a key and that key signs the set */
414 static enum sec_status
415 verify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve,
416 struct ub_packed_rrset_key* dnskey_rrset,
417 struct ub_packed_rrset_key* ds_rrset, size_t ds_idx, char** reason,
418 struct module_qstate* qstate)
420 enum sec_status sec = sec_status_bogus;
421 size_t i, num, numchecked = 0, numhashok = 0;
422 num = rrset_get_count(dnskey_rrset);
423 for(i=0; i<num; i++) {
424 /* Skip DNSKEYs that don't match the basic criteria. */
425 if(ds_get_key_algo(ds_rrset, ds_idx)
426 != dnskey_get_algo(dnskey_rrset, i)
427 || dnskey_calc_keytag(dnskey_rrset, i)
428 != ds_get_keytag(ds_rrset, ds_idx)) {
432 verbose(VERB_ALGO, "attempt DS match algo %d keytag %d",
433 ds_get_key_algo(ds_rrset, ds_idx),
434 ds_get_keytag(ds_rrset, ds_idx));
436 /* Convert the candidate DNSKEY into a hash using the
437 * same DS hash algorithm. */
438 if(!ds_digest_match_dnskey(env, dnskey_rrset, i, ds_rrset,
440 verbose(VERB_ALGO, "DS match attempt failed");
444 verbose(VERB_ALGO, "DS match digest ok, trying signature");
446 /* Otherwise, we have a match! Make sure that the DNSKEY
447 * verifies *with this key* */
448 sec = dnskey_verify_rrset(env, ve, dnskey_rrset,
449 dnskey_rrset, i, reason, LDNS_SECTION_ANSWER, qstate);
450 if(sec == sec_status_secure) {
453 /* If it didn't validate with the DNSKEY, try the next one! */
456 algo_needs_reason(env, ds_get_key_algo(ds_rrset, ds_idx),
457 reason, "no keys have a DS");
458 else if(numhashok == 0)
459 *reason = "DS hash mismatches key";
461 *reason = "keyset not secured by DNSKEY that matches DS";
462 return sec_status_bogus;
465 int val_favorite_ds_algo(struct ub_packed_rrset_key* ds_rrset)
467 size_t i, num = rrset_get_count(ds_rrset);
468 int d, digest_algo = 0; /* DS digest algo 0 is not used. */
469 /* find favorite algo, for now, highest number supported */
470 for(i=0; i<num; i++) {
471 if(!ds_digest_algo_is_supported(ds_rrset, i) ||
472 !ds_key_algo_is_supported(ds_rrset, i)) {
475 d = ds_get_digest_algo(ds_rrset, i);
483 val_verify_DNSKEY_with_DS(struct module_env* env, struct val_env* ve,
484 struct ub_packed_rrset_key* dnskey_rrset,
485 struct ub_packed_rrset_key* ds_rrset, uint8_t* sigalg, char** reason,
486 struct module_qstate* qstate)
488 /* as long as this is false, we can consider this DS rrset to be
489 * equivalent to no DS rrset. */
490 int has_useful_ds = 0, digest_algo, alg;
491 struct algo_needs needs;
495 if(dnskey_rrset->rk.dname_len != ds_rrset->rk.dname_len ||
496 query_dname_compare(dnskey_rrset->rk.dname, ds_rrset->rk.dname)
498 verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset "
500 *reason = "DNSKEY RRset did not match DS RRset by name";
501 return sec_status_bogus;
505 /* harden against algo downgrade is enabled */
506 digest_algo = val_favorite_ds_algo(ds_rrset);
507 algo_needs_init_ds(&needs, ds_rrset, digest_algo, sigalg);
509 /* accept any key algo, any digest algo */
512 num = rrset_get_count(ds_rrset);
513 for(i=0; i<num; i++) {
514 /* Check to see if we can understand this DS.
515 * And check it is the strongest digest */
516 if(!ds_digest_algo_is_supported(ds_rrset, i) ||
517 !ds_key_algo_is_supported(ds_rrset, i) ||
518 (sigalg && (ds_get_digest_algo(ds_rrset, i) != digest_algo))) {
522 /* Once we see a single DS with a known digestID and
523 * algorithm, we cannot return INSECURE (with a
524 * "null" KeyEntry). */
527 sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset,
528 ds_rrset, i, reason, qstate);
529 if(sec == sec_status_secure) {
530 if(!sigalg || algo_needs_set_secure(&needs,
531 (uint8_t)ds_get_key_algo(ds_rrset, i))) {
532 verbose(VERB_ALGO, "DS matched DNSKEY.");
533 return sec_status_secure;
535 } else if(sigalg && sec == sec_status_bogus) {
536 algo_needs_set_bogus(&needs,
537 (uint8_t)ds_get_key_algo(ds_rrset, i));
541 /* None of the DS's worked out. */
543 /* If no DSs were understandable, then this is OK. */
545 verbose(VERB_ALGO, "No usable DS records were found -- "
546 "treating as insecure.");
547 return sec_status_insecure;
549 /* If any were understandable, then it is bad. */
550 verbose(VERB_QUERY, "Failed to match any usable DS to a DNSKEY.");
551 if(sigalg && (alg=algo_needs_missing(&needs)) != 0) {
552 algo_needs_reason(env, alg, reason, "missing verification of "
555 return sec_status_bogus;
558 struct key_entry_key*
559 val_verify_new_DNSKEYs(struct regional* region, struct module_env* env,
560 struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset,
561 struct ub_packed_rrset_key* ds_rrset, int downprot, char** reason,
562 struct module_qstate* qstate)
564 uint8_t sigalg[ALGO_NEEDS_MAX+1];
565 enum sec_status sec = val_verify_DNSKEY_with_DS(env, ve,
566 dnskey_rrset, ds_rrset, downprot?sigalg:NULL, reason, qstate);
568 if(sec == sec_status_secure) {
569 return key_entry_create_rrset(region,
570 ds_rrset->rk.dname, ds_rrset->rk.dname_len,
571 ntohs(ds_rrset->rk.rrset_class), dnskey_rrset,
572 downprot?sigalg:NULL, *env->now);
573 } else if(sec == sec_status_insecure) {
574 return key_entry_create_null(region, ds_rrset->rk.dname,
575 ds_rrset->rk.dname_len,
576 ntohs(ds_rrset->rk.rrset_class),
577 rrset_get_ttl(ds_rrset), *env->now);
579 return key_entry_create_bad(region, ds_rrset->rk.dname,
580 ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class),
581 BOGUS_KEY_TTL, *env->now);
585 val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve,
586 struct ub_packed_rrset_key* dnskey_rrset,
587 struct ub_packed_rrset_key* ta_ds,
588 struct ub_packed_rrset_key* ta_dnskey, uint8_t* sigalg, char** reason,
589 struct module_qstate* qstate)
591 /* as long as this is false, we can consider this anchor to be
592 * equivalent to no anchor. */
593 int has_useful_ta = 0, digest_algo = 0, alg;
594 struct algo_needs needs;
598 if(ta_ds && (dnskey_rrset->rk.dname_len != ta_ds->rk.dname_len ||
599 query_dname_compare(dnskey_rrset->rk.dname, ta_ds->rk.dname)
601 verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset "
603 *reason = "DNSKEY RRset did not match DS RRset by name";
604 return sec_status_bogus;
606 if(ta_dnskey && (dnskey_rrset->rk.dname_len != ta_dnskey->rk.dname_len
607 || query_dname_compare(dnskey_rrset->rk.dname, ta_dnskey->rk.dname)
609 verbose(VERB_QUERY, "DNSKEY RRset did not match anchor RRset "
611 *reason = "DNSKEY RRset did not match anchor RRset by name";
612 return sec_status_bogus;
616 digest_algo = val_favorite_ds_algo(ta_ds);
619 algo_needs_init_ds(&needs, ta_ds, digest_algo, sigalg);
620 else memset(&needs, 0, sizeof(needs));
622 algo_needs_init_dnskey_add(&needs, ta_dnskey, sigalg);
625 num = rrset_get_count(ta_ds);
626 for(i=0; i<num; i++) {
627 /* Check to see if we can understand this DS.
628 * And check it is the strongest digest */
629 if(!ds_digest_algo_is_supported(ta_ds, i) ||
630 !ds_key_algo_is_supported(ta_ds, i) ||
631 ds_get_digest_algo(ta_ds, i) != digest_algo)
634 /* Once we see a single DS with a known digestID and
635 * algorithm, we cannot return INSECURE (with a
636 * "null" KeyEntry). */
639 sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset,
640 ta_ds, i, reason, qstate);
641 if(sec == sec_status_secure) {
642 if(!sigalg || algo_needs_set_secure(&needs,
643 (uint8_t)ds_get_key_algo(ta_ds, i))) {
644 verbose(VERB_ALGO, "DS matched DNSKEY.");
645 return sec_status_secure;
647 } else if(sigalg && sec == sec_status_bogus) {
648 algo_needs_set_bogus(&needs,
649 (uint8_t)ds_get_key_algo(ta_ds, i));
654 /* None of the DS's worked out: check the DNSKEYs. */
656 num = rrset_get_count(ta_dnskey);
657 for(i=0; i<num; i++) {
658 /* Check to see if we can understand this DNSKEY */
659 if(!dnskey_algo_is_supported(ta_dnskey, i))
662 /* we saw a useful TA */
665 sec = dnskey_verify_rrset(env, ve, dnskey_rrset,
666 ta_dnskey, i, reason, LDNS_SECTION_ANSWER, qstate);
667 if(sec == sec_status_secure) {
668 if(!sigalg || algo_needs_set_secure(&needs,
669 (uint8_t)dnskey_get_algo(ta_dnskey, i))) {
670 verbose(VERB_ALGO, "anchor matched DNSKEY.");
671 return sec_status_secure;
673 } else if(sigalg && sec == sec_status_bogus) {
674 algo_needs_set_bogus(&needs,
675 (uint8_t)dnskey_get_algo(ta_dnskey, i));
680 /* If no DSs were understandable, then this is OK. */
682 verbose(VERB_ALGO, "No usable trust anchors were found -- "
683 "treating as insecure.");
684 return sec_status_insecure;
686 /* If any were understandable, then it is bad. */
687 verbose(VERB_QUERY, "Failed to match any usable anchor to a DNSKEY.");
688 if(sigalg && (alg=algo_needs_missing(&needs)) != 0) {
689 algo_needs_reason(env, alg, reason, "missing verification of "
692 return sec_status_bogus;
695 struct key_entry_key*
696 val_verify_new_DNSKEYs_with_ta(struct regional* region, struct module_env* env,
697 struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset,
698 struct ub_packed_rrset_key* ta_ds_rrset,
699 struct ub_packed_rrset_key* ta_dnskey_rrset, int downprot,
700 char** reason, struct module_qstate* qstate)
702 uint8_t sigalg[ALGO_NEEDS_MAX+1];
703 enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve,
704 dnskey_rrset, ta_ds_rrset, ta_dnskey_rrset,
705 downprot?sigalg:NULL, reason, qstate);
707 if(sec == sec_status_secure) {
708 return key_entry_create_rrset(region,
709 dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len,
710 ntohs(dnskey_rrset->rk.rrset_class), dnskey_rrset,
711 downprot?sigalg:NULL, *env->now);
712 } else if(sec == sec_status_insecure) {
713 return key_entry_create_null(region, dnskey_rrset->rk.dname,
714 dnskey_rrset->rk.dname_len,
715 ntohs(dnskey_rrset->rk.rrset_class),
716 rrset_get_ttl(dnskey_rrset), *env->now);
718 return key_entry_create_bad(region, dnskey_rrset->rk.dname,
719 dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class),
720 BOGUS_KEY_TTL, *env->now);
724 val_dsset_isusable(struct ub_packed_rrset_key* ds_rrset)
727 for(i=0; i<rrset_get_count(ds_rrset); i++) {
728 if(ds_digest_algo_is_supported(ds_rrset, i) &&
729 ds_key_algo_is_supported(ds_rrset, i))
732 if(verbosity < VERB_ALGO)
734 if(rrset_get_count(ds_rrset) == 0)
735 verbose(VERB_ALGO, "DS is not usable");
737 /* report usability for the first DS RR */
738 sldns_lookup_table *lt;
739 char herr[64], aerr[64];
740 lt = sldns_lookup_by_id(sldns_hashes,
741 (int)ds_get_digest_algo(ds_rrset, i));
742 if(lt) snprintf(herr, sizeof(herr), "%s", lt->name);
743 else snprintf(herr, sizeof(herr), "%d",
744 (int)ds_get_digest_algo(ds_rrset, i));
745 lt = sldns_lookup_by_id(sldns_algorithms,
746 (int)ds_get_key_algo(ds_rrset, i));
747 if(lt) snprintf(aerr, sizeof(aerr), "%s", lt->name);
748 else snprintf(aerr, sizeof(aerr), "%d",
749 (int)ds_get_key_algo(ds_rrset, i));
750 verbose(VERB_ALGO, "DS unsupported, hash %s %s, "
751 "key algorithm %s %s", herr,
752 (ds_digest_algo_is_supported(ds_rrset, 0)?
753 "(supported)":"(unsupported)"), aerr,
754 (ds_key_algo_is_supported(ds_rrset, 0)?
755 "(supported)":"(unsupported)"));
760 /** get label count for a signature */
762 rrsig_get_labcount(struct packed_rrset_data* d, size_t sig)
764 if(d->rr_len[sig] < 2+4)
765 return 0; /* bad sig length */
766 return d->rr_data[sig][2+3];
770 val_rrset_wildcard(struct ub_packed_rrset_key* rrset, uint8_t** wc,
773 struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
779 if(d->rrsig_count == 0) {
782 labcount = rrsig_get_labcount(d, d->count + 0);
783 /* check rest of signatures identical */
784 for(i=1; i<d->rrsig_count; i++) {
785 if(labcount != rrsig_get_labcount(d, d->count + i)) {
789 /* OK the rrsigs check out */
790 /* if the RRSIG label count is shorter than the number of actual
791 * labels, then this rrset was synthesized from a wildcard.
792 * Note that the RRSIG label count doesn't count the root label. */
793 wn = rrset->rk.dname;
794 wl = rrset->rk.dname_len;
795 /* skip a leading wildcard label in the dname (RFC4035 2.2) */
796 if(dname_is_wild(wn)) {
800 labdiff = (dname_count_labels(wn) - 1) - (int)labcount;
803 dname_remove_labels(wc, &wl, labdiff);
811 val_chase_cname(struct query_info* qchase, struct reply_info* rep,
812 size_t* cname_skip) {
814 /* skip any DNAMEs, go to the CNAME for next part */
815 for(i = *cname_skip; i < rep->an_numrrsets; i++) {
816 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME &&
817 query_dname_compare(qchase->qname, rep->rrsets[i]->
819 qchase->qname = NULL;
820 get_cname_target(rep->rrsets[i], &qchase->qname,
823 return 0; /* bad CNAME rdata */
828 return 0; /* CNAME classified but no matching CNAME ?! */
831 /** see if rrset has signer name as one of the rrsig signers */
833 rrset_has_signer(struct ub_packed_rrset_key* rrset, uint8_t* name, size_t len)
835 struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
838 for(i = d->count; i< d->count+d->rrsig_count; i++) {
839 if(d->rr_len[i] > 2+18+len) {
840 /* at least rdatalen + signature + signame (+1 sig)*/
841 if(!dname_valid(d->rr_data[i]+2+18, d->rr_len[i]-2-18))
843 if(query_dname_compare(name, d->rr_data[i]+2+18) == 0)
853 val_fill_reply(struct reply_info* chase, struct reply_info* orig,
854 size_t skip, uint8_t* name, size_t len, uint8_t* signer)
858 chase->rrset_count = 0;
859 chase->an_numrrsets = 0;
860 chase->ns_numrrsets = 0;
861 chase->ar_numrrsets = 0;
863 for(i=skip; i<orig->an_numrrsets; i++) {
865 if(query_dname_compare(name,
866 orig->rrsets[i]->rk.dname) == 0)
867 chase->rrsets[chase->an_numrrsets++] =
869 } else if(seen_dname && ntohs(orig->rrsets[i]->rk.type) ==
870 LDNS_RR_TYPE_CNAME) {
871 chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i];
873 } else if(rrset_has_signer(orig->rrsets[i], name, len)) {
874 chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i];
875 if(ntohs(orig->rrsets[i]->rk.type) ==
876 LDNS_RR_TYPE_DNAME) {
881 /* AUTHORITY section */
882 for(i = (skip > orig->an_numrrsets)?skip:orig->an_numrrsets;
883 i<orig->an_numrrsets+orig->ns_numrrsets;
886 if(query_dname_compare(name,
887 orig->rrsets[i]->rk.dname) == 0)
888 chase->rrsets[chase->an_numrrsets+
889 chase->ns_numrrsets++] = orig->rrsets[i];
890 } else if(rrset_has_signer(orig->rrsets[i], name, len)) {
891 chase->rrsets[chase->an_numrrsets+
892 chase->ns_numrrsets++] = orig->rrsets[i];
895 /* ADDITIONAL section */
896 for(i= (skip>orig->an_numrrsets+orig->ns_numrrsets)?
897 skip:orig->an_numrrsets+orig->ns_numrrsets;
898 i<orig->rrset_count; i++) {
900 if(query_dname_compare(name,
901 orig->rrsets[i]->rk.dname) == 0)
902 chase->rrsets[chase->an_numrrsets
903 +orig->ns_numrrsets+chase->ar_numrrsets++]
905 } else if(rrset_has_signer(orig->rrsets[i], name, len)) {
906 chase->rrsets[chase->an_numrrsets+orig->ns_numrrsets+
907 chase->ar_numrrsets++] = orig->rrsets[i];
910 chase->rrset_count = chase->an_numrrsets + chase->ns_numrrsets +
914 void val_reply_remove_auth(struct reply_info* rep, size_t index)
916 log_assert(index < rep->rrset_count);
917 log_assert(index >= rep->an_numrrsets);
918 log_assert(index < rep->an_numrrsets+rep->ns_numrrsets);
919 memmove(rep->rrsets+index, rep->rrsets+index+1,
920 sizeof(struct ub_packed_rrset_key*)*
921 (rep->rrset_count - index - 1));
927 val_check_nonsecure(struct module_env* env, struct reply_info* rep)
931 for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
932 if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
933 ->security != sec_status_secure) {
934 /* because we want to return the authentic original
935 * message when presented with CD-flagged queries,
936 * we need to preserve AUTHORITY section data.
937 * However, this rrset is not signed or signed
938 * with the wrong keys. Validation has tried to
939 * verify this rrset with the keysets of import.
940 * But this rrset did not verify.
941 * Therefore the message is bogus.
944 /* check if authority has an NS record
945 * which is bad, and there is an answer section with
946 * data. In that case, delete NS and additional to
947 * be lenient and make a minimal response */
948 if(rep->an_numrrsets != 0 &&
949 ntohs(rep->rrsets[i]->rk.type)
950 == LDNS_RR_TYPE_NS) {
951 verbose(VERB_ALGO, "truncate to minimal");
952 rep->ar_numrrsets = 0;
953 rep->rrset_count = rep->an_numrrsets +
955 /* remove this unneeded authority rrset */
956 memmove(rep->rrsets+i, rep->rrsets+i+1,
957 sizeof(struct ub_packed_rrset_key*)*
958 (rep->rrset_count - i - 1));
965 log_nametypeclass(VERB_QUERY, "message is bogus, "
967 rep->rrsets[i]->rk.dname,
968 ntohs(rep->rrsets[i]->rk.type),
969 ntohs(rep->rrsets[i]->rk.rrset_class));
970 rep->security = sec_status_bogus;
975 if(!env->cfg->val_clean_additional)
977 for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) {
978 if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
979 ->security != sec_status_secure) {
980 /* This does not cause message invalidation. It was
981 * simply unsigned data in the additional. The
982 * RRSIG must have been truncated off the message.
984 * However, we do not want to return possible bogus
985 * data to clients that rely on this service for
986 * their authentication.
988 /* remove this unneeded additional rrset */
989 memmove(rep->rrsets+i, rep->rrsets+i+1,
990 sizeof(struct ub_packed_rrset_key*)*
991 (rep->rrset_count - i - 1));
999 /** check no anchor and unlock */
1001 check_no_anchor(struct val_anchors* anchors, uint8_t* nm, size_t l, uint16_t c)
1003 struct trust_anchor* ta;
1004 if((ta=anchors_lookup(anchors, nm, l, c))) {
1005 lock_basic_unlock(&ta->lock);
1011 val_mark_indeterminate(struct reply_info* rep, struct val_anchors* anchors,
1012 struct rrset_cache* r, struct module_env* env)
1015 struct packed_rrset_data* d;
1016 for(i=0; i<rep->rrset_count; i++) {
1017 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1018 if(d->security == sec_status_unchecked &&
1019 check_no_anchor(anchors, rep->rrsets[i]->rk.dname,
1020 rep->rrsets[i]->rk.dname_len,
1021 ntohs(rep->rrsets[i]->rk.rrset_class)))
1023 /* mark as indeterminate */
1024 d->security = sec_status_indeterminate;
1025 rrset_update_sec_status(r, rep->rrsets[i], *env->now);
1031 val_mark_insecure(struct reply_info* rep, uint8_t* kname,
1032 struct rrset_cache* r, struct module_env* env)
1035 struct packed_rrset_data* d;
1036 for(i=0; i<rep->rrset_count; i++) {
1037 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1038 if(d->security == sec_status_unchecked &&
1039 dname_subdomain_c(rep->rrsets[i]->rk.dname, kname)) {
1040 /* mark as insecure */
1041 d->security = sec_status_insecure;
1042 rrset_update_sec_status(r, rep->rrsets[i], *env->now);
1048 val_next_unchecked(struct reply_info* rep, size_t skip)
1051 struct packed_rrset_data* d;
1052 for(i=skip+1; i<rep->rrset_count; i++) {
1053 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1054 if(d->security == sec_status_unchecked) {
1058 return rep->rrset_count;
1062 val_classification_to_string(enum val_classification subtype)
1065 case VAL_CLASS_UNTYPED: return "untyped";
1066 case VAL_CLASS_UNKNOWN: return "unknown";
1067 case VAL_CLASS_POSITIVE: return "positive";
1068 case VAL_CLASS_CNAME: return "cname";
1069 case VAL_CLASS_NODATA: return "nodata";
1070 case VAL_CLASS_NAMEERROR: return "nameerror";
1071 case VAL_CLASS_CNAMENOANSWER: return "cnamenoanswer";
1072 case VAL_CLASS_REFERRAL: return "referral";
1073 case VAL_CLASS_ANY: return "qtype_any";
1075 return "bad_val_classification";
1079 /** log a sock_list entry */
1081 sock_list_logentry(enum verbosity_value v, const char* s, struct sock_list* p)
1084 log_addr(v, s, &p->addr, p->len);
1085 else verbose(v, "%s cache", s);
1088 void val_blacklist(struct sock_list** blacklist, struct regional* region,
1089 struct sock_list* origin, int cross)
1091 /* debug printout */
1092 if(verbosity >= VERB_ALGO) {
1093 struct sock_list* p;
1094 for(p=*blacklist; p; p=p->next)
1095 sock_list_logentry(VERB_ALGO, "blacklist", p);
1097 verbose(VERB_ALGO, "blacklist add: cache");
1098 for(p=origin; p; p=p->next)
1099 sock_list_logentry(VERB_ALGO, "blacklist add", p);
1101 /* blacklist the IPs or the cache */
1103 /* only add if nothing there. anything else also stops cache*/
1105 sock_list_insert(blacklist, NULL, 0, region);
1107 sock_list_prepend(blacklist, origin);
1108 else sock_list_merge(blacklist, region, origin);
1111 int val_has_signed_nsecs(struct reply_info* rep, char** reason)
1113 size_t i, num_nsec = 0, num_nsec3 = 0;
1114 struct packed_rrset_data* d;
1115 for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
1116 if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC))
1118 else if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC3))
1121 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1122 if(d && d->rrsig_count != 0) {
1126 if(num_nsec == 0 && num_nsec3 == 0)
1127 *reason = "no DNSSEC records";
1128 else if(num_nsec != 0)
1129 *reason = "no signatures over NSECs";
1130 else *reason = "no signatures over NSEC3s";
1135 val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c,
1136 struct regional* region, uint8_t* topname)
1138 struct dns_msg* msg;
1139 struct query_info qinfo;
1140 struct ub_packed_rrset_key *rrset = rrset_cache_lookup(
1141 env->rrset_cache, nm, nmlen, LDNS_RR_TYPE_DS, c, 0,
1144 /* DS rrset exists. Return it to the validator immediately*/
1145 struct ub_packed_rrset_key* copy = packed_rrset_copy_region(
1146 rrset, region, *env->now);
1147 lock_rw_unlock(&rrset->entry.lock);
1150 msg = dns_msg_create(nm, nmlen, LDNS_RR_TYPE_DS, c, region, 1);
1153 msg->rep->rrsets[0] = copy;
1154 msg->rep->rrset_count++;
1155 msg->rep->an_numrrsets++;
1158 /* lookup in rrset and negative cache for NSEC/NSEC3 */
1160 qinfo.qname_len = nmlen;
1161 qinfo.qtype = LDNS_RR_TYPE_DS;
1163 qinfo.local_alias = NULL;
1164 /* do not add SOA to reply message, it is going to be used internal */
1165 msg = val_neg_getmsg(env->neg_cache, &qinfo, region, env->rrset_cache,
1166 env->scratch_buffer, *env->now, 0, topname, env->cfg);