2 * validator/validator.c - secure validator DNS query response module
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 * This file contains a module that performs validation of DNS queries.
40 * According to RFC 4034.
43 #include "validator/validator.h"
44 #include "validator/val_anchor.h"
45 #include "validator/val_kcache.h"
46 #include "validator/val_kentry.h"
47 #include "validator/val_utils.h"
48 #include "validator/val_nsec.h"
49 #include "validator/val_nsec3.h"
50 #include "validator/val_neg.h"
51 #include "validator/val_sigcrypt.h"
52 #include "validator/autotrust.h"
53 #include "services/cache/dns.h"
54 #include "services/cache/rrset.h"
55 #include "util/data/dname.h"
56 #include "util/module.h"
58 #include "util/net_help.h"
59 #include "util/regional.h"
60 #include "util/config_file.h"
61 #include "util/fptr_wlist.h"
62 #include "sldns/rrdef.h"
63 #include "sldns/wire2str.h"
64 #include "sldns/str2wire.h"
66 /* forward decl for cache response and normal super inform calls of a DS */
67 static void process_ds_response(struct module_qstate* qstate,
68 struct val_qstate* vq, int id, int rcode, struct dns_msg* msg,
69 struct query_info* qinfo, struct sock_list* origin);
71 /** fill up nsec3 key iterations config entry */
73 fill_nsec3_iter(struct val_env* ve, char* s, int c)
77 free(ve->nsec3_keysize);
78 free(ve->nsec3_maxiter);
79 ve->nsec3_keysize = (size_t*)calloc(sizeof(size_t), (size_t)c);
80 ve->nsec3_maxiter = (size_t*)calloc(sizeof(size_t), (size_t)c);
81 if(!ve->nsec3_keysize || !ve->nsec3_maxiter) {
82 log_err("out of memory");
86 ve->nsec3_keysize[i] = (size_t)strtol(s, &e, 10);
88 log_err("cannot parse: %s", s);
92 ve->nsec3_maxiter[i] = (size_t)strtol(s, &e, 10);
94 log_err("cannot parse: %s", s);
98 if(i>0 && ve->nsec3_keysize[i-1] >= ve->nsec3_keysize[i]) {
99 log_err("nsec3 key iterations not ascending: %d %d",
100 (int)ve->nsec3_keysize[i-1],
101 (int)ve->nsec3_keysize[i]);
104 verbose(VERB_ALGO, "validator nsec3cfg keysz %d mxiter %d",
105 (int)ve->nsec3_keysize[i], (int)ve->nsec3_maxiter[i]);
110 /** apply config settings to validator */
112 val_apply_cfg(struct module_env* env, struct val_env* val_env,
113 struct config_file* cfg)
116 val_env->bogus_ttl = (uint32_t)cfg->bogus_ttl;
118 env->anchors = anchors_create();
120 log_err("out of memory");
124 val_env->kcache = key_cache_create(cfg);
125 if(!val_env->kcache) {
126 log_err("out of memory");
129 env->key_cache = val_env->kcache;
130 if(!anchors_apply_cfg(env->anchors, cfg)) {
131 log_err("validator: error in trustanchors config");
134 val_env->date_override = cfg->val_date_override;
135 val_env->skew_min = cfg->val_sig_skew_min;
136 val_env->skew_max = cfg->val_sig_skew_max;
137 c = cfg_count_numbers(cfg->val_nsec3_key_iterations);
139 log_err("validator: unparseable or odd nsec3 key "
140 "iterations: %s", cfg->val_nsec3_key_iterations);
143 val_env->nsec3_keyiter_count = c/2;
144 if(!fill_nsec3_iter(val_env, cfg->val_nsec3_key_iterations, c/2)) {
145 log_err("validator: cannot apply nsec3 key iterations");
148 if(!val_env->neg_cache)
149 val_env->neg_cache = val_neg_create(cfg,
150 val_env->nsec3_maxiter[val_env->nsec3_keyiter_count-1]);
151 if(!val_env->neg_cache) {
152 log_err("out of memory");
155 env->neg_cache = val_env->neg_cache;
159 #ifdef USE_ECDSA_EVP_WORKAROUND
160 void ecdsa_evp_workaround_init(void);
163 val_init(struct module_env* env, int id)
165 struct val_env* val_env = (struct val_env*)calloc(1,
166 sizeof(struct val_env));
168 log_err("malloc failure");
171 env->modinfo[id] = (void*)val_env;
172 env->need_to_validate = 1;
173 lock_basic_init(&val_env->bogus_lock);
174 lock_protect(&val_env->bogus_lock, &val_env->num_rrset_bogus,
175 sizeof(val_env->num_rrset_bogus));
176 #ifdef USE_ECDSA_EVP_WORKAROUND
177 ecdsa_evp_workaround_init();
179 if(!val_apply_cfg(env, val_env, env->cfg)) {
180 log_err("validator: could not apply configuration settings.");
188 val_deinit(struct module_env* env, int id)
190 struct val_env* val_env;
191 if(!env || !env->modinfo[id])
193 val_env = (struct val_env*)env->modinfo[id];
194 lock_basic_destroy(&val_env->bogus_lock);
195 anchors_delete(env->anchors);
197 key_cache_delete(val_env->kcache);
198 neg_cache_delete(val_env->neg_cache);
199 free(val_env->nsec3_keysize);
200 free(val_env->nsec3_maxiter);
202 env->modinfo[id] = NULL;
205 /** fill in message structure */
206 static struct val_qstate*
207 val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq)
209 if(!qstate->return_msg || qstate->return_rcode != LDNS_RCODE_NOERROR) {
210 /* create a message to verify */
211 verbose(VERB_ALGO, "constructing reply for validation");
212 vq->orig_msg = (struct dns_msg*)regional_alloc(qstate->region,
213 sizeof(struct dns_msg));
216 vq->orig_msg->qinfo = qstate->qinfo;
217 vq->orig_msg->rep = (struct reply_info*)regional_alloc(
218 qstate->region, sizeof(struct reply_info));
219 if(!vq->orig_msg->rep)
221 memset(vq->orig_msg->rep, 0, sizeof(struct reply_info));
222 vq->orig_msg->rep->flags = (uint16_t)(qstate->return_rcode&0xf)
223 |BIT_QR|BIT_RA|(qstate->query_flags|(BIT_CD|BIT_RD));
224 vq->orig_msg->rep->qdcount = 1;
226 vq->orig_msg = qstate->return_msg;
228 vq->qchase = qstate->qinfo;
229 /* chase reply will be an edited (sub)set of the orig msg rrset ptrs */
230 vq->chase_reply = regional_alloc_init(qstate->region,
232 sizeof(struct reply_info) - sizeof(struct rrset_ref));
235 if(vq->orig_msg->rep->rrset_count > RR_COUNT_MAX)
236 return NULL; /* protect against integer overflow */
237 vq->chase_reply->rrsets = regional_alloc_init(qstate->region,
238 vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*)
239 * vq->orig_msg->rep->rrset_count);
240 if(!vq->chase_reply->rrsets)
246 /** allocate new validator query state */
247 static struct val_qstate*
248 val_new(struct module_qstate* qstate, int id)
250 struct val_qstate* vq = (struct val_qstate*)regional_alloc(
251 qstate->region, sizeof(*vq));
252 log_assert(!qstate->minfo[id]);
255 memset(vq, 0, sizeof(*vq));
256 qstate->minfo[id] = vq;
257 vq->state = VAL_INIT_STATE;
258 return val_new_getmsg(qstate, vq);
262 * Exit validation with an error status
264 * @param qstate: query state
265 * @param id: validator id.
266 * @return false, for use by caller to return to stop processing.
269 val_error(struct module_qstate* qstate, int id)
271 qstate->ext_state[id] = module_error;
272 qstate->return_rcode = LDNS_RCODE_SERVFAIL;
277 * Check to see if a given response needs to go through the validation
278 * process. Typical reasons for this routine to return false are: CD bit was
279 * on in the original request, or the response is a kind of message that
280 * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.)
282 * @param qstate: query state.
283 * @param ret_rc: rcode for this message (if noerror - examine ret_msg).
284 * @param ret_msg: return msg, can be NULL; look at rcode instead.
285 * @return true if the response could use validation (although this does not
286 * mean we can actually validate this response).
289 needs_validation(struct module_qstate* qstate, int ret_rc,
290 struct dns_msg* ret_msg)
294 /* If the CD bit is on in the original request, then you could think
295 * that we don't bother to validate anything.
296 * But this is signalled internally with the valrec flag.
297 * User queries are validated with BIT_CD to make our cache clean
298 * so that bogus messages get retried by the upstream also for
299 * downstream validators that set BIT_CD.
300 * For DNS64 bit_cd signals no dns64 processing, but we want to
301 * provide validation there too */
303 if(qstate->query_flags & BIT_CD) {
304 verbose(VERB_ALGO, "not validating response due to CD bit");
308 if(qstate->is_valrec) {
309 verbose(VERB_ALGO, "not validating response, is valrec"
310 "(validation recursion lookup)");
314 if(ret_rc != LDNS_RCODE_NOERROR || !ret_msg)
316 else rcode = (int)FLAGS_GET_RCODE(ret_msg->rep->flags);
318 if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) {
319 if(verbosity >= VERB_ALGO) {
322 (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
323 verbose(VERB_ALGO, "cannot validate non-answer, rcode %s", rc);
328 /* cannot validate positive RRSIG response. (negatives can) */
329 if(qstate->qinfo.qtype == LDNS_RR_TYPE_RRSIG &&
330 rcode == LDNS_RCODE_NOERROR && ret_msg &&
331 ret_msg->rep->an_numrrsets > 0) {
332 verbose(VERB_ALGO, "cannot validate RRSIG, no sigs on sigs.");
339 * Check to see if the response has already been validated.
340 * @param ret_msg: return msg, can be NULL
341 * @return true if the response has already been validated
344 already_validated(struct dns_msg* ret_msg)
346 /* validate unchecked, and re-validate bogus messages */
347 if (ret_msg && ret_msg->rep->security > sec_status_bogus)
349 verbose(VERB_ALGO, "response has already been validated: %s",
350 sec_status_to_string(ret_msg->rep->security));
357 * Generate a request for DNS data.
359 * @param qstate: query state that is the parent.
360 * @param id: module id.
361 * @param name: what name to query for.
362 * @param namelen: length of name.
363 * @param qtype: query type.
364 * @param qclass: query class.
365 * @param flags: additional flags, such as the CD bit (BIT_CD), or 0.
366 * @param newq: If the subquery is newly created, it is returned,
367 * otherwise NULL is returned
368 * @param detached: true if this qstate should not attach to the subquery
369 * @return false on alloc failure.
372 generate_request(struct module_qstate* qstate, int id, uint8_t* name,
373 size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags,
374 struct module_qstate** newq, int detached)
376 struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
377 struct query_info ask;
380 ask.qname_len = namelen;
383 ask.local_alias = NULL;
384 log_query_info(VERB_ALGO, "generate request", &ask);
385 /* enable valrec flag to avoid recursion to the same validation
386 * routine, this lookup is simply a lookup. DLVs need validation */
387 if(qtype == LDNS_RR_TYPE_DLV)
391 struct mesh_state* sub = NULL;
392 fptr_ok(fptr_whitelist_modenv_add_sub(
393 qstate->env->add_sub));
394 if(!(*qstate->env->add_sub)(qstate, &ask,
395 (uint16_t)(BIT_RD|flags), 0, valrec, newq, &sub)){
396 log_err("Could not generate request: out of memory");
401 fptr_ok(fptr_whitelist_modenv_attach_sub(
402 qstate->env->attach_sub));
403 if(!(*qstate->env->attach_sub)(qstate, &ask,
404 (uint16_t)(BIT_RD|flags), 0, valrec, newq)){
405 log_err("Could not generate request: out of memory");
409 /* newq; validator does not need state created for that
410 * query, and its a 'normal' for iterator as well */
412 /* add our blacklist to the query blacklist */
413 sock_list_merge(&(*newq)->blacklist, (*newq)->region,
414 vq->chain_blacklist);
416 qstate->ext_state[id] = module_wait_subquery;
421 * Generate, send and detach key tag signaling query.
423 * @param qstate: query state.
424 * @param id: module id.
425 * @param ta: trust anchor, locked.
426 * @return false on a processing error.
429 generate_keytag_query(struct module_qstate* qstate, int id,
430 struct trust_anchor* ta)
432 /* 3 bytes for "_ta", 5 bytes per tag (4 bytes + "-") */
433 #define MAX_LABEL_TAGS (LDNS_MAX_LABELLEN-3)/5
435 uint16_t tags[MAX_LABEL_TAGS];
436 char tagstr[LDNS_MAX_LABELLEN+1] = "_ta"; /* +1 for NULL byte */
437 size_t tagstr_left = sizeof(tagstr) - strlen(tagstr);
438 char* tagstr_pos = tagstr + strlen(tagstr);
439 uint8_t dnamebuf[LDNS_MAX_DOMAINLEN+1]; /* +1 for label length byte */
440 size_t dnamebuf_len = sizeof(dnamebuf);
441 uint8_t* keytagdname;
442 struct module_qstate* newq = NULL;
443 enum module_ext_state ext_state = qstate->ext_state[id];
445 numtag = anchor_list_keytags(ta, tags, MAX_LABEL_TAGS);
449 for(i=0; i<numtag; i++) {
450 /* Buffer can't overflow; numtag is limited to tags that fit in
452 snprintf(tagstr_pos, tagstr_left, "-%04x", (unsigned)tags[i]);
453 tagstr_left -= strlen(tagstr_pos);
454 tagstr_pos += strlen(tagstr_pos);
457 sldns_str2wire_dname_buf_origin(tagstr, dnamebuf, &dnamebuf_len,
458 ta->name, ta->namelen);
459 if(!(keytagdname = (uint8_t*)regional_alloc_init(qstate->region,
460 dnamebuf, dnamebuf_len))) {
461 log_err("could not generate key tag query: out of memory");
465 log_nametypeclass(VERB_OPS, "generate keytag query", keytagdname,
466 LDNS_RR_TYPE_NULL, ta->dclass);
467 if(!generate_request(qstate, id, keytagdname, dnamebuf_len,
468 LDNS_RR_TYPE_NULL, ta->dclass, 0, &newq, 1)) {
469 log_err("failed to generate key tag signaling request");
473 /* Not interrested in subquery response. Restore the ext_state,
474 * that might be changed by generate_request() */
475 qstate->ext_state[id] = ext_state;
481 * Prime trust anchor for use.
482 * Generate and dispatch a priming query for the given trust anchor.
483 * The trust anchor can be DNSKEY or DS and does not have to be signed.
485 * @param qstate: query state.
486 * @param vq: validator query state.
487 * @param id: module id.
488 * @param toprime: what to prime.
489 * @return false on a processing error.
492 prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq,
493 int id, struct trust_anchor* toprime)
495 struct module_qstate* newq = NULL;
496 int ret = generate_request(qstate, id, toprime->name, toprime->namelen,
497 LDNS_RR_TYPE_DNSKEY, toprime->dclass, BIT_CD, &newq, 0);
499 if(newq && qstate->env->cfg->trust_anchor_signaling &&
500 !generate_keytag_query(qstate, id, toprime)) {
501 log_err("keytag signaling query failed");
506 log_err("Could not prime trust anchor: out of memory");
509 /* ignore newq; validator does not need state created for that
510 * query, and its a 'normal' for iterator as well */
511 vq->wait_prime_ta = 1; /* to elicit PRIME_RESP_STATE processing
512 from the validator inform_super() routine */
513 /* store trust anchor name for later lookup when prime returns */
514 vq->trust_anchor_name = regional_alloc_init(qstate->region,
515 toprime->name, toprime->namelen);
516 vq->trust_anchor_len = toprime->namelen;
517 vq->trust_anchor_labs = toprime->namelabs;
518 if(!vq->trust_anchor_name) {
519 log_err("Could not prime trust anchor: out of memory");
526 * Validate if the ANSWER and AUTHORITY sections contain valid rrsets.
527 * They must be validly signed with the given key.
528 * Tries to validate ADDITIONAL rrsets as well, but only to check them.
529 * Allows unsigned CNAME after a DNAME that expands the DNAME.
531 * Note that by the time this method is called, the process of finding the
532 * trusted DNSKEY rrset that signs this response must already have been
535 * @param qstate: query state.
536 * @param env: module env for verify.
537 * @param ve: validator env for verify.
538 * @param qchase: query that was made.
539 * @param chase_reply: answer to validate.
540 * @param key_entry: the key entry, which is trusted, and which matches
541 * the signer of the answer. The key entry isgood().
542 * @return false if any of the rrsets in the an or ns sections of the message
543 * fail to verify. The message is then set to bogus.
546 validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
547 struct val_env* ve, struct query_info* qchase,
548 struct reply_info* chase_reply, struct key_entry_key* key_entry)
552 struct ub_packed_rrset_key* s;
557 /* validate the ANSWER section */
558 for(i=0; i<chase_reply->an_numrrsets; i++) {
559 s = chase_reply->rrsets[i];
560 /* Skip the CNAME following a (validated) DNAME.
561 * Because of the normalization routines in the iterator,
562 * there will always be an unsigned CNAME following a DNAME
563 * (unless qtype=DNAME). */
564 if(dname_seen && ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
566 /* CNAME was synthesized by our own iterator */
567 /* since the DNAME verified, mark the CNAME as secure */
568 ((struct packed_rrset_data*)s->entry.data)->security =
570 ((struct packed_rrset_data*)s->entry.data)->trust =
571 rrset_trust_validated;
575 /* Verify the answer rrset */
576 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
577 LDNS_SECTION_ANSWER, qstate);
578 /* If the (answer) rrset failed to validate, then this
580 if(sec != sec_status_secure) {
581 log_nametypeclass(VERB_QUERY, "validator: response "
582 "has failed ANSWER rrset:", s->rk.dname,
583 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
584 errinf(qstate, reason);
585 if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME)
586 errinf(qstate, "for CNAME");
587 else if(ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME)
588 errinf(qstate, "for DNAME");
589 errinf_origin(qstate, qstate->reply_origin);
590 chase_reply->security = sec_status_bogus;
594 /* Notice a DNAME that should be followed by an unsigned
596 if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
597 ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) {
602 /* validate the AUTHORITY section */
603 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
604 chase_reply->ns_numrrsets; i++) {
605 s = chase_reply->rrsets[i];
606 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
607 LDNS_SECTION_AUTHORITY, qstate);
608 /* If anything in the authority section fails to be secure,
609 * we have a bad message. */
610 if(sec != sec_status_secure) {
611 log_nametypeclass(VERB_QUERY, "validator: response "
612 "has failed AUTHORITY rrset:", s->rk.dname,
613 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
614 errinf(qstate, reason);
615 errinf_origin(qstate, qstate->reply_origin);
616 errinf_rrset(qstate, s);
617 chase_reply->security = sec_status_bogus;
622 /* If set, the validator should clean the additional section of
623 * secure messages. */
624 if(!env->cfg->val_clean_additional)
626 /* attempt to validate the ADDITIONAL section rrsets */
627 for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
628 i<chase_reply->rrset_count; i++) {
629 s = chase_reply->rrsets[i];
630 /* only validate rrs that have signatures with the key */
631 /* leave others unchecked, those get removed later on too */
632 val_find_rrset_signer(s, &sname, &slen);
633 if(sname && query_dname_compare(sname, key_entry->name)==0)
634 (void)val_verify_rrset_entry(env, ve, s, key_entry,
635 &reason, LDNS_SECTION_ADDITIONAL, qstate);
636 /* the additional section can fail to be secure,
637 * it is optional, check signature in case we need
638 * to clean the additional section later. */
645 * Detect wrong truncated response (say from BIND 9.6.1 that is forwarding
646 * and saw the NS record without signatures from a referral).
647 * The positive response has a mangled authority section.
648 * Remove that authority section and the additional section.
650 * @return true if a wrongly truncated response.
653 detect_wrongly_truncated(struct reply_info* rep)
656 /* only NS in authority, and it is bogus */
657 if(rep->ns_numrrsets != 1 || rep->an_numrrsets == 0)
659 if(ntohs(rep->rrsets[ rep->an_numrrsets ]->rk.type) != LDNS_RR_TYPE_NS)
661 if(((struct packed_rrset_data*)rep->rrsets[ rep->an_numrrsets ]
662 ->entry.data)->security == sec_status_secure)
664 /* answer section is present and secure */
665 for(i=0; i<rep->an_numrrsets; i++) {
666 if(((struct packed_rrset_data*)rep->rrsets[ i ]
667 ->entry.data)->security != sec_status_secure)
670 verbose(VERB_ALGO, "truncating to minimal response");
675 * For messages that are not referrals, if the chase reply contains an
676 * unsigned NS record in the authority section it could have been
677 * inserted by a (BIND) forwarder that thinks the zone is insecure, and
678 * that has an NS record without signatures in cache. Remove the NS
679 * record since the reply does not hinge on that record (in the authority
680 * section), but do not remove it if it removes the last record from the
681 * answer+authority sections.
682 * @param chase_reply: the chased reply, we have a key for this contents,
683 * so we should have signatures for these rrsets and not having
684 * signatures means it will be bogus.
685 * @param orig_reply: original reply, remove NS from there as well because
686 * we cannot mark the NS record as DNSSEC valid because it is not
687 * validated by signatures.
690 remove_spurious_authority(struct reply_info* chase_reply,
691 struct reply_info* orig_reply)
695 /* if no answer and only 1 auth RRset, do not remove that one */
696 if(chase_reply->an_numrrsets == 0 && chase_reply->ns_numrrsets == 1)
698 /* search authority section for unsigned NS records */
699 for(i = chase_reply->an_numrrsets;
700 i < chase_reply->an_numrrsets+chase_reply->ns_numrrsets; i++) {
701 struct packed_rrset_data* d = (struct packed_rrset_data*)
702 chase_reply->rrsets[i]->entry.data;
703 if(ntohs(chase_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
704 && d->rrsig_count == 0) {
710 /* see if we found the entry */
712 log_rrset_key(VERB_ALGO, "Removing spurious unsigned NS record "
713 "(likely inserted by forwarder)", chase_reply->rrsets[found]);
715 /* find rrset in orig_reply */
716 for(i = orig_reply->an_numrrsets;
717 i < orig_reply->an_numrrsets+orig_reply->ns_numrrsets; i++) {
718 if(ntohs(orig_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
719 && query_dname_compare(orig_reply->rrsets[i]->rk.dname,
720 chase_reply->rrsets[found]->rk.dname) == 0) {
721 /* remove from orig_msg */
722 val_reply_remove_auth(orig_reply, i);
726 /* remove rrset from chase_reply */
727 val_reply_remove_auth(chase_reply, found);
731 * Given a "positive" response -- a response that contains an answer to the
732 * question, and no CNAME chain, validate this response.
734 * The answer and authority RRsets must already be verified as secure.
736 * @param env: module env for verify.
737 * @param ve: validator env for verify.
738 * @param qchase: query that was made.
739 * @param chase_reply: answer to that query to validate.
740 * @param kkey: the key entry, which is trusted, and which matches
741 * the signer of the answer. The key entry isgood().
744 validate_positive_response(struct module_env* env, struct val_env* ve,
745 struct query_info* qchase, struct reply_info* chase_reply,
746 struct key_entry_key* kkey)
754 struct ub_packed_rrset_key* s;
756 /* validate the ANSWER section - this will be the answer itself */
757 for(i=0; i<chase_reply->an_numrrsets; i++) {
758 s = chase_reply->rrsets[i];
760 /* Check to see if the rrset is the result of a wildcard
761 * expansion. If so, an additional check will need to be
762 * made in the authority section. */
763 if(!val_rrset_wildcard(s, &wc, &wl)) {
764 log_nametypeclass(VERB_QUERY, "Positive response has "
765 "inconsistent wildcard sigs:", s->rk.dname,
766 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
767 chase_reply->security = sec_status_bogus;
770 if(wc && !wc_cached && env->cfg->aggressive_nsec) {
771 rrset_cache_update_wildcard(env->rrset_cache, s, wc, wl,
772 env->alloc, *env->now);
778 /* validate the AUTHORITY section as well - this will generally be
779 * the NS rrset (which could be missing, no problem) */
780 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
781 chase_reply->ns_numrrsets; i++) {
782 s = chase_reply->rrsets[i];
784 /* If this is a positive wildcard response, and we have a
785 * (just verified) NSEC record, try to use it to 1) prove
786 * that qname doesn't exist and 2) that the correct wildcard
788 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
789 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
792 /* if not, continue looking for proof */
795 /* Otherwise, if this is a positive wildcard response and
796 * we have NSEC3 records */
797 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
802 /* If this was a positive wildcard response that we haven't already
803 * proven, and we have NSEC3 records, try to prove it using the NSEC3
805 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
806 enum sec_status sec = nsec3_prove_wildcard(env, ve,
807 chase_reply->rrsets+chase_reply->an_numrrsets,
808 chase_reply->ns_numrrsets, qchase, kkey, wc);
809 if(sec == sec_status_insecure) {
810 verbose(VERB_ALGO, "Positive wildcard response is "
812 chase_reply->security = sec_status_insecure;
814 } else if(sec == sec_status_secure)
818 /* If after all this, we still haven't proven the positive wildcard
820 if(wc != NULL && !wc_NSEC_ok) {
821 verbose(VERB_QUERY, "positive response was wildcard "
822 "expansion and did not prove original data "
824 chase_reply->security = sec_status_bogus;
828 verbose(VERB_ALGO, "Successfully validated positive response");
829 chase_reply->security = sec_status_secure;
833 * Validate a NOERROR/NODATA signed response -- a response that has a
834 * NOERROR Rcode but no ANSWER section RRsets. This consists of making
835 * certain that the authority section NSEC/NSEC3s proves that the qname
836 * does exist and the qtype doesn't.
838 * The answer and authority RRsets must already be verified as secure.
840 * @param env: module env for verify.
841 * @param ve: validator env for verify.
842 * @param qchase: query that was made.
843 * @param chase_reply: answer to that query to validate.
844 * @param kkey: the key entry, which is trusted, and which matches
845 * the signer of the answer. The key entry isgood().
848 validate_nodata_response(struct module_env* env, struct val_env* ve,
849 struct query_info* qchase, struct reply_info* chase_reply,
850 struct key_entry_key* kkey)
852 /* Since we are here, there must be nothing in the ANSWER section to
854 /* (Note: CNAME/DNAME responses will not directly get here --
855 * instead, they are chased down into individual CNAME validations,
856 * and at the end of the cname chain a POSITIVE, or CNAME_NOANSWER
859 /* validate the AUTHORITY section */
860 int has_valid_nsec = 0; /* If true, then the NODATA has been proven.*/
861 uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
862 proven closest encloser. */
863 uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
864 int nsec3s_seen = 0; /* nsec3s seen */
865 struct ub_packed_rrset_key* s;
868 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
869 chase_reply->ns_numrrsets; i++) {
870 s = chase_reply->rrsets[i];
871 /* If we encounter an NSEC record, try to use it to prove
873 * This needs to handle the ENT NODATA case. */
874 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
875 if(nsec_proves_nodata(s, qchase, &wc)) {
877 /* sets wc-encloser if wildcard applicable */
879 if(val_nsec_proves_name_error(s, qchase->qname)) {
880 ce = nsec_closest_encloser(qchase->qname, s);
882 if(val_nsec_proves_insecuredelegation(s, qchase)) {
883 verbose(VERB_ALGO, "delegation is insecure");
884 chase_reply->security = sec_status_insecure;
887 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
892 /* check to see if we have a wildcard NODATA proof. */
894 /* The wildcard NODATA is 1 NSEC proving that qname does not exist
895 * (and also proving what the closest encloser is), and 1 NSEC
896 * showing the matching wildcard, which must be *.closest_encloser. */
900 if(query_dname_compare(wc, ce) != 0) {
905 if(!has_valid_nsec && nsec3s_seen) {
906 enum sec_status sec = nsec3_prove_nodata(env, ve,
907 chase_reply->rrsets+chase_reply->an_numrrsets,
908 chase_reply->ns_numrrsets, qchase, kkey);
909 if(sec == sec_status_insecure) {
910 verbose(VERB_ALGO, "NODATA response is insecure");
911 chase_reply->security = sec_status_insecure;
913 } else if(sec == sec_status_secure)
917 if(!has_valid_nsec) {
918 verbose(VERB_QUERY, "NODATA response failed to prove NODATA "
919 "status with NSEC/NSEC3");
920 if(verbosity >= VERB_ALGO)
921 log_dns_msg("Failed NODATA", qchase, chase_reply);
922 chase_reply->security = sec_status_bogus;
926 verbose(VERB_ALGO, "successfully validated NODATA response.");
927 chase_reply->security = sec_status_secure;
931 * Validate a NAMEERROR signed response -- a response that has a NXDOMAIN
933 * This consists of making certain that the authority section NSEC proves
934 * that the qname doesn't exist and the covering wildcard also doesn't exist..
936 * The answer and authority RRsets must have already been verified as secure.
938 * @param env: module env for verify.
939 * @param ve: validator env for verify.
940 * @param qchase: query that was made.
941 * @param chase_reply: answer to that query to validate.
942 * @param kkey: the key entry, which is trusted, and which matches
943 * the signer of the answer. The key entry isgood().
944 * @param rcode: adjusted RCODE, in case of RCODE/proof mismatch leniency.
947 validate_nameerror_response(struct module_env* env, struct val_env* ve,
948 struct query_info* qchase, struct reply_info* chase_reply,
949 struct key_entry_key* kkey, int* rcode)
951 int has_valid_nsec = 0;
952 int has_valid_wnsec = 0;
954 struct ub_packed_rrset_key* s;
958 int prev_ce_labs = 0;
960 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
961 chase_reply->ns_numrrsets; i++) {
962 s = chase_reply->rrsets[i];
963 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
964 if(val_nsec_proves_name_error(s, qchase->qname))
966 ce = nsec_closest_encloser(qchase->qname, s);
967 ce_labs = dname_count_labels(ce);
968 /* Use longest closest encloser to prove wildcard. */
969 if(ce_labs > prev_ce_labs ||
970 (ce_labs == prev_ce_labs &&
971 has_valid_wnsec == 0)) {
972 if(val_nsec_proves_no_wc(s, qchase->qname,
978 prev_ce_labs = ce_labs;
979 if(val_nsec_proves_insecuredelegation(s, qchase)) {
980 verbose(VERB_ALGO, "delegation is insecure");
981 chase_reply->security = sec_status_insecure;
984 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3)
988 if((!has_valid_nsec || !has_valid_wnsec) && nsec3s_seen) {
989 /* use NSEC3 proof, both answer and auth rrsets, in case
990 * NSEC3s end up in the answer (due to qtype=NSEC3 or so) */
991 chase_reply->security = nsec3_prove_nameerror(env, ve,
992 chase_reply->rrsets, chase_reply->an_numrrsets+
993 chase_reply->ns_numrrsets, qchase, kkey);
994 if(chase_reply->security != sec_status_secure) {
995 verbose(VERB_QUERY, "NameError response failed nsec, "
996 "nsec3 proof was %s", sec_status_to_string(
997 chase_reply->security));
1001 has_valid_wnsec = 1;
1004 /* If the message fails to prove either condition, it is bogus. */
1005 if(!has_valid_nsec) {
1006 verbose(VERB_QUERY, "NameError response has failed to prove: "
1007 "qname does not exist");
1008 chase_reply->security = sec_status_bogus;
1009 /* Be lenient with RCODE in NSEC NameError responses */
1010 validate_nodata_response(env, ve, qchase, chase_reply, kkey);
1011 if (chase_reply->security == sec_status_secure)
1012 *rcode = LDNS_RCODE_NOERROR;
1016 if(!has_valid_wnsec) {
1017 verbose(VERB_QUERY, "NameError response has failed to prove: "
1018 "covering wildcard does not exist");
1019 chase_reply->security = sec_status_bogus;
1020 /* Be lenient with RCODE in NSEC NameError responses */
1021 validate_nodata_response(env, ve, qchase, chase_reply, kkey);
1022 if (chase_reply->security == sec_status_secure)
1023 *rcode = LDNS_RCODE_NOERROR;
1027 /* Otherwise, we consider the message secure. */
1028 verbose(VERB_ALGO, "successfully validated NAME ERROR response.");
1029 chase_reply->security = sec_status_secure;
1033 * Given a referral response, validate rrsets and take least trusted rrset
1034 * as the current validation status.
1036 * Note that by the time this method is called, the process of finding the
1037 * trusted DNSKEY rrset that signs this response must already have been
1040 * @param chase_reply: answer to validate.
1043 validate_referral_response(struct reply_info* chase_reply)
1047 /* message security equals lowest rrset security */
1048 chase_reply->security = sec_status_secure;
1049 for(i=0; i<chase_reply->rrset_count; i++) {
1050 s = ((struct packed_rrset_data*)chase_reply->rrsets[i]
1051 ->entry.data)->security;
1052 if(s < chase_reply->security)
1053 chase_reply->security = s;
1055 verbose(VERB_ALGO, "validated part of referral response as %s",
1056 sec_status_to_string(chase_reply->security));
1060 * Given an "ANY" response -- a response that contains an answer to a
1061 * qtype==ANY question, with answers. This does no checking that all
1062 * types are present.
1064 * NOTE: it may be possible to get parent-side delegation point records
1065 * here, which won't all be signed. Right now, this routine relies on the
1066 * upstream iterative resolver to not return these responses -- instead
1067 * treating them as referrals.
1069 * NOTE: RFC 4035 is silent on this issue, so this may change upon
1070 * clarification. Clarification draft -05 says to not check all types are
1073 * Note that by the time this method is called, the process of finding the
1074 * trusted DNSKEY rrset that signs this response must already have been
1077 * @param env: module env for verify.
1078 * @param ve: validator env for verify.
1079 * @param qchase: query that was made.
1080 * @param chase_reply: answer to that query to validate.
1081 * @param kkey: the key entry, which is trusted, and which matches
1082 * the signer of the answer. The key entry isgood().
1085 validate_any_response(struct module_env* env, struct val_env* ve,
1086 struct query_info* qchase, struct reply_info* chase_reply,
1087 struct key_entry_key* kkey)
1089 /* all answer and auth rrsets already verified */
1090 /* but check if a wildcard response is given, then check NSEC/NSEC3
1091 * for qname denial to see if wildcard is applicable */
1095 int nsec3s_seen = 0;
1097 struct ub_packed_rrset_key* s;
1099 if(qchase->qtype != LDNS_RR_TYPE_ANY) {
1100 log_err("internal error: ANY validation called for non-ANY");
1101 chase_reply->security = sec_status_bogus;
1105 /* validate the ANSWER section - this will be the answer itself */
1106 for(i=0; i<chase_reply->an_numrrsets; i++) {
1107 s = chase_reply->rrsets[i];
1109 /* Check to see if the rrset is the result of a wildcard
1110 * expansion. If so, an additional check will need to be
1111 * made in the authority section. */
1112 if(!val_rrset_wildcard(s, &wc, &wl)) {
1113 log_nametypeclass(VERB_QUERY, "Positive ANY response"
1114 " has inconsistent wildcard sigs:",
1115 s->rk.dname, ntohs(s->rk.type),
1116 ntohs(s->rk.rrset_class));
1117 chase_reply->security = sec_status_bogus;
1122 /* if it was a wildcard, check for NSEC/NSEC3s in both answer
1123 * and authority sections (NSEC may be moved to the ANSWER section) */
1125 for(i=0; i<chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
1127 s = chase_reply->rrsets[i];
1129 /* If this is a positive wildcard response, and we have a
1130 * (just verified) NSEC record, try to use it to 1) prove
1131 * that qname doesn't exist and 2) that the correct wildcard
1133 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1134 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1137 /* if not, continue looking for proof */
1140 /* Otherwise, if this is a positive wildcard response and
1141 * we have NSEC3 records */
1142 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1147 /* If this was a positive wildcard response that we haven't already
1148 * proven, and we have NSEC3 records, try to prove it using the NSEC3
1150 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1151 /* look both in answer and auth section for NSEC3s */
1152 enum sec_status sec = nsec3_prove_wildcard(env, ve,
1153 chase_reply->rrsets,
1154 chase_reply->an_numrrsets+chase_reply->ns_numrrsets,
1156 if(sec == sec_status_insecure) {
1157 verbose(VERB_ALGO, "Positive ANY wildcard response is "
1159 chase_reply->security = sec_status_insecure;
1161 } else if(sec == sec_status_secure)
1165 /* If after all this, we still haven't proven the positive wildcard
1166 * response, fail. */
1167 if(wc != NULL && !wc_NSEC_ok) {
1168 verbose(VERB_QUERY, "positive ANY response was wildcard "
1169 "expansion and did not prove original data "
1171 chase_reply->security = sec_status_bogus;
1175 verbose(VERB_ALGO, "Successfully validated positive ANY response");
1176 chase_reply->security = sec_status_secure;
1180 * Validate CNAME response, or DNAME+CNAME.
1181 * This is just like a positive proof, except that this is about a
1182 * DNAME+CNAME. Possible wildcard proof.
1183 * Difference with positive proof is that this routine refuses
1184 * wildcarded DNAMEs.
1186 * The answer and authority rrsets must already be verified as secure.
1188 * @param env: module env for verify.
1189 * @param ve: validator env for verify.
1190 * @param qchase: query that was made.
1191 * @param chase_reply: answer to that query to validate.
1192 * @param kkey: the key entry, which is trusted, and which matches
1193 * the signer of the answer. The key entry isgood().
1196 validate_cname_response(struct module_env* env, struct val_env* ve,
1197 struct query_info* qchase, struct reply_info* chase_reply,
1198 struct key_entry_key* kkey)
1203 int nsec3s_seen = 0;
1205 struct ub_packed_rrset_key* s;
1207 /* validate the ANSWER section - this will be the CNAME (+DNAME) */
1208 for(i=0; i<chase_reply->an_numrrsets; i++) {
1209 s = chase_reply->rrsets[i];
1211 /* Check to see if the rrset is the result of a wildcard
1212 * expansion. If so, an additional check will need to be
1213 * made in the authority section. */
1214 if(!val_rrset_wildcard(s, &wc, &wl)) {
1215 log_nametypeclass(VERB_QUERY, "Cname response has "
1216 "inconsistent wildcard sigs:", s->rk.dname,
1217 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1218 chase_reply->security = sec_status_bogus;
1222 /* Refuse wildcarded DNAMEs rfc 4597.
1223 * Do not follow a wildcarded DNAME because
1224 * its synthesized CNAME expansion is underdefined */
1225 if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
1226 ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME && wc) {
1227 log_nametypeclass(VERB_QUERY, "cannot validate a "
1228 "wildcarded DNAME:", s->rk.dname,
1229 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1230 chase_reply->security = sec_status_bogus;
1234 /* If we have found a CNAME, stop looking for one.
1235 * The iterator has placed the CNAME chain in correct
1237 if (ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
1242 /* AUTHORITY section */
1243 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1244 chase_reply->ns_numrrsets; i++) {
1245 s = chase_reply->rrsets[i];
1247 /* If this is a positive wildcard response, and we have a
1248 * (just verified) NSEC record, try to use it to 1) prove
1249 * that qname doesn't exist and 2) that the correct wildcard
1251 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1252 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1255 /* if not, continue looking for proof */
1258 /* Otherwise, if this is a positive wildcard response and
1259 * we have NSEC3 records */
1260 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1265 /* If this was a positive wildcard response that we haven't already
1266 * proven, and we have NSEC3 records, try to prove it using the NSEC3
1268 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1269 enum sec_status sec = nsec3_prove_wildcard(env, ve,
1270 chase_reply->rrsets+chase_reply->an_numrrsets,
1271 chase_reply->ns_numrrsets, qchase, kkey, wc);
1272 if(sec == sec_status_insecure) {
1273 verbose(VERB_ALGO, "wildcard CNAME response is "
1275 chase_reply->security = sec_status_insecure;
1277 } else if(sec == sec_status_secure)
1281 /* If after all this, we still haven't proven the positive wildcard
1282 * response, fail. */
1283 if(wc != NULL && !wc_NSEC_ok) {
1284 verbose(VERB_QUERY, "CNAME response was wildcard "
1285 "expansion and did not prove original data "
1287 chase_reply->security = sec_status_bogus;
1291 verbose(VERB_ALGO, "Successfully validated CNAME response");
1292 chase_reply->security = sec_status_secure;
1296 * Validate CNAME NOANSWER response, no more data after a CNAME chain.
1297 * This can be a NODATA or a NAME ERROR case, but not both at the same time.
1298 * We don't know because the rcode has been set to NOERROR by the CNAME.
1300 * The answer and authority rrsets must already be verified as secure.
1302 * @param env: module env for verify.
1303 * @param ve: validator env for verify.
1304 * @param qchase: query that was made.
1305 * @param chase_reply: answer to that query to validate.
1306 * @param kkey: the key entry, which is trusted, and which matches
1307 * the signer of the answer. The key entry isgood().
1310 validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
1311 struct query_info* qchase, struct reply_info* chase_reply,
1312 struct key_entry_key* kkey)
1314 int nodata_valid_nsec = 0; /* If true, then NODATA has been proven.*/
1315 uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
1316 proven closest encloser. */
1317 uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
1318 int nxdomain_valid_nsec = 0; /* if true, nameerror has been proven */
1319 int nxdomain_valid_wnsec = 0;
1320 int nsec3s_seen = 0; /* nsec3s seen */
1321 struct ub_packed_rrset_key* s;
1323 uint8_t* nsec_ce; /* Used to find the NSEC with the longest ce */
1325 int prev_ce_labs = 0;
1327 /* the AUTHORITY section */
1328 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1329 chase_reply->ns_numrrsets; i++) {
1330 s = chase_reply->rrsets[i];
1332 /* If we encounter an NSEC record, try to use it to prove
1333 * NODATA. This needs to handle the ENT NODATA case.
1334 * Also try to prove NAMEERROR, and absence of a wildcard */
1335 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1336 if(nsec_proves_nodata(s, qchase, &wc)) {
1337 nodata_valid_nsec = 1;
1338 /* set wc encloser if wildcard applicable */
1340 if(val_nsec_proves_name_error(s, qchase->qname)) {
1341 ce = nsec_closest_encloser(qchase->qname, s);
1342 nxdomain_valid_nsec = 1;
1344 nsec_ce = nsec_closest_encloser(qchase->qname, s);
1345 ce_labs = dname_count_labels(nsec_ce);
1346 /* Use longest closest encloser to prove wildcard. */
1347 if(ce_labs > prev_ce_labs ||
1348 (ce_labs == prev_ce_labs &&
1349 nxdomain_valid_wnsec == 0)) {
1350 if(val_nsec_proves_no_wc(s, qchase->qname,
1352 nxdomain_valid_wnsec = 1;
1354 nxdomain_valid_wnsec = 0;
1356 prev_ce_labs = ce_labs;
1357 if(val_nsec_proves_insecuredelegation(s, qchase)) {
1358 verbose(VERB_ALGO, "delegation is insecure");
1359 chase_reply->security = sec_status_insecure;
1362 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1367 /* check to see if we have a wildcard NODATA proof. */
1369 /* The wildcard NODATA is 1 NSEC proving that qname does not exists
1370 * (and also proving what the closest encloser is), and 1 NSEC
1371 * showing the matching wildcard, which must be *.closest_encloser. */
1373 nodata_valid_nsec = 0;
1375 if(query_dname_compare(wc, ce) != 0) {
1376 nodata_valid_nsec = 0;
1379 if(nxdomain_valid_nsec && !nxdomain_valid_wnsec) {
1380 /* name error is missing wildcard denial proof */
1381 nxdomain_valid_nsec = 0;
1384 if(nodata_valid_nsec && nxdomain_valid_nsec) {
1385 verbose(VERB_QUERY, "CNAMEchain to noanswer proves that name "
1386 "exists and not exists, bogus");
1387 chase_reply->security = sec_status_bogus;
1390 if(!nodata_valid_nsec && !nxdomain_valid_nsec && nsec3s_seen) {
1392 enum sec_status sec = nsec3_prove_nxornodata(env, ve,
1393 chase_reply->rrsets+chase_reply->an_numrrsets,
1394 chase_reply->ns_numrrsets, qchase, kkey, &nodata);
1395 if(sec == sec_status_insecure) {
1396 verbose(VERB_ALGO, "CNAMEchain to noanswer response "
1398 chase_reply->security = sec_status_insecure;
1400 } else if(sec == sec_status_secure) {
1402 nodata_valid_nsec = 1;
1403 else nxdomain_valid_nsec = 1;
1407 if(!nodata_valid_nsec && !nxdomain_valid_nsec) {
1408 verbose(VERB_QUERY, "CNAMEchain to noanswer response failed "
1409 "to prove status with NSEC/NSEC3");
1410 if(verbosity >= VERB_ALGO)
1411 log_dns_msg("Failed CNAMEnoanswer", qchase, chase_reply);
1412 chase_reply->security = sec_status_bogus;
1416 if(nodata_valid_nsec)
1417 verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1418 "NODATA response.");
1419 else verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1420 "NAMEERROR response.");
1421 chase_reply->security = sec_status_secure;
1425 * Process init state for validator.
1426 * Process the INIT state. First tier responses start in the INIT state.
1427 * This is where they are vetted for validation suitability, and the initial
1428 * key search is done.
1430 * Currently, events the come through this routine will be either promoted
1431 * to FINISHED/CNAME_RESP (no validation needed), FINDKEY (next step to
1432 * validation), or will be (temporarily) retired and a new priming request
1433 * event will be generated.
1435 * @param qstate: query state.
1436 * @param vq: validator query state.
1437 * @param ve: validator shared global environment.
1438 * @param id: module id.
1439 * @return true if the event should be processed further on return, false if
1443 processInit(struct module_qstate* qstate, struct val_qstate* vq,
1444 struct val_env* ve, int id)
1446 uint8_t* lookup_name;
1448 struct trust_anchor* anchor;
1449 enum val_classification subtype = val_classify_response(
1450 qstate->query_flags, &qstate->qinfo, &vq->qchase,
1451 vq->orig_msg->rep, vq->rrset_skip);
1452 if(vq->restart_count > VAL_MAX_RESTART_COUNT) {
1453 verbose(VERB_ALGO, "restart count exceeded");
1454 return val_error(qstate, id);
1456 verbose(VERB_ALGO, "validator classification %s",
1457 val_classification_to_string(subtype));
1458 if(subtype == VAL_CLASS_REFERRAL &&
1459 vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
1460 /* referral uses the rrset name as qchase, to find keys for
1462 vq->qchase.qname = vq->orig_msg->rep->
1463 rrsets[vq->rrset_skip]->rk.dname;
1464 vq->qchase.qname_len = vq->orig_msg->rep->
1465 rrsets[vq->rrset_skip]->rk.dname_len;
1466 vq->qchase.qtype = ntohs(vq->orig_msg->rep->
1467 rrsets[vq->rrset_skip]->rk.type);
1468 vq->qchase.qclass = ntohs(vq->orig_msg->rep->
1469 rrsets[vq->rrset_skip]->rk.rrset_class);
1471 lookup_name = vq->qchase.qname;
1472 lookup_len = vq->qchase.qname_len;
1473 /* for type DS look at the parent side for keys/trustanchor */
1474 /* also for NSEC not at apex */
1475 if(vq->qchase.qtype == LDNS_RR_TYPE_DS ||
1476 (vq->qchase.qtype == LDNS_RR_TYPE_NSEC &&
1477 vq->orig_msg->rep->rrset_count > vq->rrset_skip &&
1478 ntohs(vq->orig_msg->rep->rrsets[vq->rrset_skip]->rk.type) ==
1479 LDNS_RR_TYPE_NSEC &&
1480 !(vq->orig_msg->rep->rrsets[vq->rrset_skip]->
1481 rk.flags&PACKED_RRSET_NSEC_AT_APEX))) {
1482 dname_remove_label(&lookup_name, &lookup_len);
1485 val_mark_indeterminate(vq->chase_reply, qstate->env->anchors,
1486 qstate->env->rrset_cache, qstate->env);
1487 vq->key_entry = NULL;
1488 vq->empty_DS_name = NULL;
1490 anchor = anchors_lookup(qstate->env->anchors,
1491 lookup_name, lookup_len, vq->qchase.qclass);
1493 /* Determine the signer/lookup name */
1494 val_find_signer(subtype, &vq->qchase, vq->orig_msg->rep,
1495 vq->rrset_skip, &vq->signer_name, &vq->signer_len);
1496 if(vq->signer_name != NULL &&
1497 !dname_subdomain_c(lookup_name, vq->signer_name)) {
1498 log_nametypeclass(VERB_ALGO, "this signer name is not a parent "
1499 "of lookupname, omitted", vq->signer_name, 0, 0);
1500 vq->signer_name = NULL;
1502 if(vq->signer_name == NULL) {
1503 log_nametypeclass(VERB_ALGO, "no signer, using", lookup_name,
1506 lookup_name = vq->signer_name;
1507 lookup_len = vq->signer_len;
1508 log_nametypeclass(VERB_ALGO, "signer is", lookup_name, 0, 0);
1511 /* for NXDOMAIN it could be signed by a parent of the trust anchor */
1512 if(subtype == VAL_CLASS_NAMEERROR && vq->signer_name &&
1513 anchor && dname_strict_subdomain_c(anchor->name, lookup_name)){
1514 lock_basic_unlock(&anchor->lock);
1515 anchor = anchors_lookup(qstate->env->anchors,
1516 lookup_name, lookup_len, vq->qchase.qclass);
1517 if(!anchor) { /* unsigned parent denies anchor*/
1518 verbose(VERB_QUERY, "unsigned parent zone denies"
1519 " trust anchor, indeterminate");
1520 vq->chase_reply->security = sec_status_indeterminate;
1521 vq->state = VAL_FINISHED_STATE;
1524 verbose(VERB_ALGO, "trust anchor NXDOMAIN by signed parent");
1525 } else if(subtype == VAL_CLASS_POSITIVE &&
1526 qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY &&
1527 query_dname_compare(lookup_name, qstate->qinfo.qname) == 0) {
1528 /* is a DNSKEY so lookup a bit higher since we want to
1529 * get it from a parent or from trustanchor */
1530 dname_remove_label(&lookup_name, &lookup_len);
1533 if(vq->rrset_skip > 0 || subtype == VAL_CLASS_CNAME ||
1534 subtype == VAL_CLASS_REFERRAL) {
1535 /* extract this part of orig_msg into chase_reply for
1536 * the eventual VALIDATE stage */
1537 val_fill_reply(vq->chase_reply, vq->orig_msg->rep,
1538 vq->rrset_skip, lookup_name, lookup_len,
1540 if(verbosity >= VERB_ALGO)
1541 log_dns_msg("chased extract", &vq->qchase,
1545 vq->key_entry = key_cache_obtain(ve->kcache, lookup_name, lookup_len,
1546 vq->qchase.qclass, qstate->region, *qstate->env->now);
1548 /* there is no key(from DLV) and no trust anchor */
1549 if(vq->key_entry == NULL && anchor == NULL) {
1550 /*response isn't under a trust anchor, so we cannot validate.*/
1551 vq->chase_reply->security = sec_status_indeterminate;
1552 /* go to finished state to cache this result */
1553 vq->state = VAL_FINISHED_STATE;
1556 /* if not key, or if keyentry is *above* the trustanchor, i.e.
1557 * the keyentry is based on another (higher) trustanchor */
1558 else if(vq->key_entry == NULL || (anchor &&
1559 dname_strict_subdomain_c(anchor->name, vq->key_entry->name))) {
1560 /* trust anchor is an 'unsigned' trust anchor */
1561 if(anchor && anchor->numDS == 0 && anchor->numDNSKEY == 0) {
1562 vq->chase_reply->security = sec_status_insecure;
1563 val_mark_insecure(vq->chase_reply, anchor->name,
1564 qstate->env->rrset_cache, qstate->env);
1565 lock_basic_unlock(&anchor->lock);
1566 vq->dlv_checked=1; /* skip DLV check */
1567 /* go to finished state to cache this result */
1568 vq->state = VAL_FINISHED_STATE;
1571 /* fire off a trust anchor priming query. */
1572 verbose(VERB_DETAIL, "prime trust anchor");
1573 if(!prime_trust_anchor(qstate, vq, id, anchor)) {
1574 lock_basic_unlock(&anchor->lock);
1575 return val_error(qstate, id);
1577 lock_basic_unlock(&anchor->lock);
1578 /* and otherwise, don't continue processing this event.
1579 * (it will be reactivated when the priming query returns). */
1580 vq->state = VAL_FINDKEY_STATE;
1584 lock_basic_unlock(&anchor->lock);
1587 if(key_entry_isnull(vq->key_entry)) {
1588 /* response is under a null key, so we cannot validate
1589 * However, we do set the status to INSECURE, since it is
1590 * essentially proven insecure. */
1591 vq->chase_reply->security = sec_status_insecure;
1592 val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1593 qstate->env->rrset_cache, qstate->env);
1594 /* go to finished state to cache this result */
1595 vq->state = VAL_FINISHED_STATE;
1597 } else if(key_entry_isbad(vq->key_entry)) {
1598 /* key is bad, chain is bad, reply is bogus */
1599 errinf_dname(qstate, "key for validation", vq->key_entry->name);
1600 errinf(qstate, "is marked as invalid");
1601 if(key_entry_get_reason(vq->key_entry)) {
1602 errinf(qstate, "because of a previous");
1603 errinf(qstate, key_entry_get_reason(vq->key_entry));
1605 /* no retries, stop bothering the authority until timeout */
1606 vq->restart_count = VAL_MAX_RESTART_COUNT;
1607 vq->chase_reply->security = sec_status_bogus;
1608 vq->state = VAL_FINISHED_STATE;
1612 /* otherwise, we have our "closest" cached key -- continue
1613 * processing in the next state. */
1614 vq->state = VAL_FINDKEY_STATE;
1619 * Process the FINDKEY state. Generally this just calculates the next name
1620 * to query and either issues a DS or a DNSKEY query. It will check to see
1621 * if the correct key has already been reached, in which case it will
1622 * advance the event to the next state.
1624 * @param qstate: query state.
1625 * @param vq: validator query state.
1626 * @param id: module id.
1627 * @return true if the event should be processed further on return, false if
1631 processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
1633 uint8_t* target_key_name, *current_key_name;
1634 size_t target_key_len;
1636 struct module_qstate* newq = NULL;
1638 log_query_info(VERB_ALGO, "validator: FindKey", &vq->qchase);
1639 /* We know that state.key_entry is not 0 or bad key -- if it were,
1640 * then previous processing should have directed this event to
1641 * a different state.
1642 * It could be an isnull key, which signals that a DLV was just
1643 * done and the DNSKEY after the DLV failed with dnssec-retry state
1644 * and the DNSKEY has to be performed again. */
1645 log_assert(vq->key_entry && !key_entry_isbad(vq->key_entry));
1646 if(key_entry_isnull(vq->key_entry)) {
1647 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1648 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1649 vq->qchase.qclass, BIT_CD, &newq, 0)) {
1650 log_err("mem error generating DNSKEY request");
1651 return val_error(qstate, id);
1656 target_key_name = vq->signer_name;
1657 target_key_len = vq->signer_len;
1658 if(!target_key_name) {
1659 target_key_name = vq->qchase.qname;
1660 target_key_len = vq->qchase.qname_len;
1663 current_key_name = vq->key_entry->name;
1665 /* If our current key entry matches our target, then we are done. */
1666 if(query_dname_compare(target_key_name, current_key_name) == 0) {
1667 vq->state = VAL_VALIDATE_STATE;
1671 if(vq->empty_DS_name) {
1672 /* if the last empty nonterminal/emptyDS name we detected is
1673 * below the current key, use that name to make progress
1674 * along the chain of trust */
1675 if(query_dname_compare(target_key_name,
1676 vq->empty_DS_name) == 0) {
1677 /* do not query for empty_DS_name again */
1678 verbose(VERB_ALGO, "Cannot retrieve DS for signature");
1679 errinf(qstate, "no signatures");
1680 errinf_origin(qstate, qstate->reply_origin);
1681 vq->chase_reply->security = sec_status_bogus;
1682 vq->state = VAL_FINISHED_STATE;
1685 current_key_name = vq->empty_DS_name;
1688 log_nametypeclass(VERB_ALGO, "current keyname", current_key_name,
1689 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1690 log_nametypeclass(VERB_ALGO, "target keyname", target_key_name,
1691 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1692 /* assert we are walking down the DNS tree */
1693 if(!dname_subdomain_c(target_key_name, current_key_name)) {
1694 verbose(VERB_ALGO, "bad signer name");
1695 vq->chase_reply->security = sec_status_bogus;
1696 vq->state = VAL_FINISHED_STATE;
1699 /* so this value is >= -1 */
1700 strip_lab = dname_count_labels(target_key_name) -
1701 dname_count_labels(current_key_name) - 1;
1702 log_assert(strip_lab >= -1);
1703 verbose(VERB_ALGO, "striplab %d", strip_lab);
1705 dname_remove_labels(&target_key_name, &target_key_len,
1708 log_nametypeclass(VERB_ALGO, "next keyname", target_key_name,
1709 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1711 /* The next step is either to query for the next DS, or to query
1712 * for the next DNSKEY. */
1714 log_nametypeclass(VERB_ALGO, "DS RRset", vq->ds_rrset->rk.dname, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN);
1715 else verbose(VERB_ALGO, "No DS RRset");
1717 if(vq->ds_rrset && query_dname_compare(vq->ds_rrset->rk.dname,
1718 vq->key_entry->name) != 0) {
1719 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1720 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1721 vq->qchase.qclass, BIT_CD, &newq, 0)) {
1722 log_err("mem error generating DNSKEY request");
1723 return val_error(qstate, id);
1728 if(!vq->ds_rrset || query_dname_compare(vq->ds_rrset->rk.dname,
1729 target_key_name) != 0) {
1730 /* check if there is a cache entry : pick up an NSEC if
1731 * there is no DS, check if that NSEC has DS-bit unset, and
1732 * thus can disprove the secure delegation we seek.
1733 * We can then use that NSEC even in the absence of a SOA
1734 * record that would be required by the iterator to supply
1735 * a completely protocol-correct response.
1736 * Uses negative cache for NSEC3 lookup of DS responses. */
1737 /* only if cache not blacklisted, of course */
1738 struct dns_msg* msg;
1739 if(!qstate->blacklist && !vq->chain_blacklist &&
1740 (msg=val_find_DS(qstate->env, target_key_name,
1741 target_key_len, vq->qchase.qclass, qstate->region,
1742 vq->key_entry->name)) ) {
1743 verbose(VERB_ALGO, "Process cached DS response");
1744 process_ds_response(qstate, vq, id, LDNS_RCODE_NOERROR,
1745 msg, &msg->qinfo, NULL);
1746 return 1; /* continue processing ds-response results */
1748 if(!generate_request(qstate, id, target_key_name,
1749 target_key_len, LDNS_RR_TYPE_DS, vq->qchase.qclass,
1750 BIT_CD, &newq, 0)) {
1751 log_err("mem error generating DS request");
1752 return val_error(qstate, id);
1757 /* Otherwise, it is time to query for the DNSKEY */
1758 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1759 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1760 vq->qchase.qclass, BIT_CD, &newq, 0)) {
1761 log_err("mem error generating DNSKEY request");
1762 return val_error(qstate, id);
1769 * Process the VALIDATE stage, the init and findkey stages are finished,
1770 * and the right keys are available to validate the response.
1771 * Or, there are no keys available, in order to invalidate the response.
1773 * After validation, the status is recorded in the message and rrsets,
1774 * and finished state is started.
1776 * @param qstate: query state.
1777 * @param vq: validator query state.
1778 * @param ve: validator shared global environment.
1779 * @param id: module id.
1780 * @return true if the event should be processed further on return, false if
1784 processValidate(struct module_qstate* qstate, struct val_qstate* vq,
1785 struct val_env* ve, int id)
1787 enum val_classification subtype;
1790 if(!vq->key_entry) {
1791 verbose(VERB_ALGO, "validate: no key entry, failed");
1792 return val_error(qstate, id);
1795 /* This is the default next state. */
1796 vq->state = VAL_FINISHED_STATE;
1798 /* Unsigned responses must be underneath a "null" key entry.*/
1799 if(key_entry_isnull(vq->key_entry)) {
1800 verbose(VERB_DETAIL, "Verified that %sresponse is INSECURE",
1801 vq->signer_name?"":"unsigned ");
1802 vq->chase_reply->security = sec_status_insecure;
1803 val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1804 qstate->env->rrset_cache, qstate->env);
1805 key_cache_insert(ve->kcache, vq->key_entry, qstate);
1809 if(key_entry_isbad(vq->key_entry)) {
1810 log_nametypeclass(VERB_DETAIL, "Could not establish a chain "
1811 "of trust to keys for", vq->key_entry->name,
1812 LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class);
1813 vq->chase_reply->security = sec_status_bogus;
1814 errinf(qstate, "while building chain of trust");
1815 if(vq->restart_count >= VAL_MAX_RESTART_COUNT)
1816 key_cache_insert(ve->kcache, vq->key_entry, qstate);
1820 /* signerName being null is the indicator that this response was
1822 if(vq->signer_name == NULL) {
1823 log_query_info(VERB_ALGO, "processValidate: state has no "
1824 "signer name", &vq->qchase);
1825 verbose(VERB_DETAIL, "Could not establish validation of "
1826 "INSECURE status of unsigned response.");
1827 errinf(qstate, "no signatures");
1828 errinf_origin(qstate, qstate->reply_origin);
1829 vq->chase_reply->security = sec_status_bogus;
1832 subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
1833 &vq->qchase, vq->orig_msg->rep, vq->rrset_skip);
1834 if(subtype != VAL_CLASS_REFERRAL)
1835 remove_spurious_authority(vq->chase_reply, vq->orig_msg->rep);
1837 /* check signatures in the message;
1838 * answer and authority must be valid, additional is only checked. */
1839 if(!validate_msg_signatures(qstate, qstate->env, ve, &vq->qchase,
1840 vq->chase_reply, vq->key_entry)) {
1841 /* workaround bad recursor out there that truncates (even
1842 * with EDNS4k) to 512 by removing RRSIG from auth section
1843 * for positive replies*/
1844 if((subtype == VAL_CLASS_POSITIVE || subtype == VAL_CLASS_ANY
1845 || subtype == VAL_CLASS_CNAME) &&
1846 detect_wrongly_truncated(vq->orig_msg->rep)) {
1847 /* truncate the message some more */
1848 vq->orig_msg->rep->ns_numrrsets = 0;
1849 vq->orig_msg->rep->ar_numrrsets = 0;
1850 vq->orig_msg->rep->rrset_count =
1851 vq->orig_msg->rep->an_numrrsets;
1852 vq->chase_reply->ns_numrrsets = 0;
1853 vq->chase_reply->ar_numrrsets = 0;
1854 vq->chase_reply->rrset_count =
1855 vq->chase_reply->an_numrrsets;
1856 qstate->errinf = NULL;
1859 verbose(VERB_DETAIL, "Validate: message contains "
1866 case VAL_CLASS_POSITIVE:
1867 verbose(VERB_ALGO, "Validating a positive response");
1868 validate_positive_response(qstate->env, ve,
1869 &vq->qchase, vq->chase_reply, vq->key_entry);
1870 verbose(VERB_DETAIL, "validate(positive): %s",
1871 sec_status_to_string(
1872 vq->chase_reply->security));
1875 case VAL_CLASS_NODATA:
1876 verbose(VERB_ALGO, "Validating a nodata response");
1877 validate_nodata_response(qstate->env, ve,
1878 &vq->qchase, vq->chase_reply, vq->key_entry);
1879 verbose(VERB_DETAIL, "validate(nodata): %s",
1880 sec_status_to_string(
1881 vq->chase_reply->security));
1884 case VAL_CLASS_NAMEERROR:
1885 rcode = (int)FLAGS_GET_RCODE(vq->orig_msg->rep->flags);
1886 verbose(VERB_ALGO, "Validating a nxdomain response");
1887 validate_nameerror_response(qstate->env, ve,
1888 &vq->qchase, vq->chase_reply, vq->key_entry, &rcode);
1889 verbose(VERB_DETAIL, "validate(nxdomain): %s",
1890 sec_status_to_string(
1891 vq->chase_reply->security));
1892 FLAGS_SET_RCODE(vq->orig_msg->rep->flags, rcode);
1893 FLAGS_SET_RCODE(vq->chase_reply->flags, rcode);
1896 case VAL_CLASS_CNAME:
1897 verbose(VERB_ALGO, "Validating a cname response");
1898 validate_cname_response(qstate->env, ve,
1899 &vq->qchase, vq->chase_reply, vq->key_entry);
1900 verbose(VERB_DETAIL, "validate(cname): %s",
1901 sec_status_to_string(
1902 vq->chase_reply->security));
1905 case VAL_CLASS_CNAMENOANSWER:
1906 verbose(VERB_ALGO, "Validating a cname noanswer "
1908 validate_cname_noanswer_response(qstate->env, ve,
1909 &vq->qchase, vq->chase_reply, vq->key_entry);
1910 verbose(VERB_DETAIL, "validate(cname_noanswer): %s",
1911 sec_status_to_string(
1912 vq->chase_reply->security));
1915 case VAL_CLASS_REFERRAL:
1916 verbose(VERB_ALGO, "Validating a referral response");
1917 validate_referral_response(vq->chase_reply);
1918 verbose(VERB_DETAIL, "validate(referral): %s",
1919 sec_status_to_string(
1920 vq->chase_reply->security));
1924 verbose(VERB_ALGO, "Validating a positive ANY "
1926 validate_any_response(qstate->env, ve, &vq->qchase,
1927 vq->chase_reply, vq->key_entry);
1928 verbose(VERB_DETAIL, "validate(positive_any): %s",
1929 sec_status_to_string(
1930 vq->chase_reply->security));
1934 log_err("validate: unhandled response subtype: %d",
1937 if(vq->chase_reply->security == sec_status_bogus) {
1938 if(subtype == VAL_CLASS_POSITIVE)
1939 errinf(qstate, "wildcard");
1940 else errinf(qstate, val_classification_to_string(subtype));
1941 errinf(qstate, "proof failed");
1942 errinf_origin(qstate, qstate->reply_origin);
1950 * DLV is going to be decommissioned, but the code is still here for some time.
1952 * Called when a query is determined by other trust anchors to be insecure
1953 * (or indeterminate). Then we look if there is a key in the DLV.
1954 * Performs aggressive negative cache check to see if there is no key.
1955 * Otherwise, spawns a DLV query, and changes to the DLV wait state.
1957 * @param qstate: query state.
1958 * @param vq: validator query state.
1959 * @param ve: validator shared global environment.
1960 * @param id: module id.
1961 * @return true if there is no DLV.
1962 * false: processing is finished for the validator operate().
1963 * This function may exit in three ways:
1964 * o no DLV (aggressive cache), so insecure. (true)
1965 * o error - stop processing (false)
1966 * o DLV lookup was started, stop processing (false)
1969 val_dlv_init(struct module_qstate* qstate, struct val_qstate* vq,
1970 struct val_env* ve, int id)
1974 struct module_qstate* newq = NULL;
1975 /* there must be a DLV configured */
1976 log_assert(qstate->env->anchors->dlv_anchor);
1977 /* this bool is true to avoid looping in the DLV checks */
1978 log_assert(vq->dlv_checked);
1980 /* init the DLV lookup variables */
1981 vq->dlv_lookup_name = NULL;
1982 vq->dlv_lookup_name_len = 0;
1983 vq->dlv_insecure_at = NULL;
1984 vq->dlv_insecure_at_len = 0;
1986 /* Determine the name for which we want to lookup DLV.
1987 * This name is for the current message, or
1988 * for the current RRset for CNAME, referral subtypes.
1989 * If there is a signer, use that, otherwise the domain name */
1990 if(vq->signer_name) {
1991 nm = vq->signer_name;
1992 nm_len = vq->signer_len;
1995 nm = vq->qchase.qname;
1996 nm_len = vq->qchase.qname_len;
1997 if(vq->qchase.qtype == LDNS_RR_TYPE_DS)
1998 dname_remove_label(&nm, &nm_len);
2000 log_nametypeclass(VERB_ALGO, "DLV init look", nm, LDNS_RR_TYPE_DS,
2002 log_assert(nm && nm_len);
2003 /* sanity check: no DLV lookups below the DLV anchor itself.
2004 * Like, an securely insecure delegation there makes no sense. */
2005 if(dname_subdomain_c(nm, qstate->env->anchors->dlv_anchor->name)) {
2006 verbose(VERB_ALGO, "DLV lookup within DLV repository denied");
2009 /* concat name (minus root label) + dlv name */
2010 vq->dlv_lookup_name_len = nm_len - 1 +
2011 qstate->env->anchors->dlv_anchor->namelen;
2012 vq->dlv_lookup_name = regional_alloc(qstate->region,
2013 vq->dlv_lookup_name_len);
2014 if(!vq->dlv_lookup_name) {
2015 log_err("Out of memory preparing DLV lookup");
2016 return val_error(qstate, id);
2018 memmove(vq->dlv_lookup_name, nm, nm_len-1);
2019 memmove(vq->dlv_lookup_name+nm_len-1,
2020 qstate->env->anchors->dlv_anchor->name,
2021 qstate->env->anchors->dlv_anchor->namelen);
2022 log_nametypeclass(VERB_ALGO, "DLV name", vq->dlv_lookup_name,
2023 LDNS_RR_TYPE_DLV, vq->qchase.qclass);
2025 /* determine where the insecure point was determined, the DLV must
2026 * be equal or below that to continue building the trust chain
2027 * down. May be NULL if no trust chain was built yet */
2029 if(vq->key_entry && key_entry_isnull(vq->key_entry)) {
2030 nm = vq->key_entry->name;
2031 nm_len = vq->key_entry->namelen;
2034 vq->dlv_insecure_at_len = nm_len - 1 +
2035 qstate->env->anchors->dlv_anchor->namelen;
2036 vq->dlv_insecure_at = regional_alloc(qstate->region,
2037 vq->dlv_insecure_at_len);
2038 if(!vq->dlv_insecure_at) {
2039 log_err("Out of memory preparing DLV lookup");
2040 return val_error(qstate, id);
2042 memmove(vq->dlv_insecure_at, nm, nm_len-1);
2043 memmove(vq->dlv_insecure_at+nm_len-1,
2044 qstate->env->anchors->dlv_anchor->name,
2045 qstate->env->anchors->dlv_anchor->namelen);
2046 log_nametypeclass(VERB_ALGO, "insecure_at",
2047 vq->dlv_insecure_at, 0, vq->qchase.qclass);
2050 /* If we can find the name in the aggressive negative cache,
2051 * give up; insecure is the answer */
2052 while(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
2053 vq->dlv_lookup_name_len, vq->qchase.qclass,
2054 qstate->env->rrset_cache, *qstate->env->now)) {
2056 dname_remove_label(&vq->dlv_lookup_name,
2057 &vq->dlv_lookup_name_len);
2059 if(!dname_subdomain_c(vq->dlv_lookup_name,
2060 qstate->env->anchors->dlv_anchor->name)) {
2061 verbose(VERB_ALGO, "ask above dlv repo");
2062 return 1; /* Above the repo is insecure */
2064 /* above chain of trust? */
2065 if(vq->dlv_insecure_at && !dname_subdomain_c(
2066 vq->dlv_lookup_name, vq->dlv_insecure_at)) {
2067 verbose(VERB_ALGO, "ask above insecure endpoint");
2072 /* perform a lookup for the DLV; with validation */
2073 vq->state = VAL_DLVLOOKUP_STATE;
2074 if(!generate_request(qstate, id, vq->dlv_lookup_name,
2075 vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV,
2076 vq->qchase.qclass, 0, &newq, 0)) {
2077 return val_error(qstate, id);
2080 /* Find the closest encloser DLV from the repository.
2081 * then that is used to build another chain of trust
2082 * This may first require a query 'too low' that has NSECs in
2083 * the answer, from which we determine the closest encloser DLV.
2084 * When determine the closest encloser, skip empty nonterminals,
2085 * since we want a nonempty node in the DLV repository. */
2091 * The Finished state. The validation status (good or bad) has been determined.
2093 * @param qstate: query state.
2094 * @param vq: validator query state.
2095 * @param ve: validator shared global environment.
2096 * @param id: module id.
2097 * @return true if the event should be processed further on return, false if
2101 processFinished(struct module_qstate* qstate, struct val_qstate* vq,
2102 struct val_env* ve, int id)
2104 enum val_classification subtype = val_classify_response(
2105 qstate->query_flags, &qstate->qinfo, &vq->qchase,
2106 vq->orig_msg->rep, vq->rrset_skip);
2108 /* if the result is insecure or indeterminate and we have not
2109 * checked the DLV yet, check the DLV */
2110 if((vq->chase_reply->security == sec_status_insecure ||
2111 vq->chase_reply->security == sec_status_indeterminate) &&
2112 qstate->env->anchors->dlv_anchor && !vq->dlv_checked) {
2113 vq->dlv_checked = 1;
2114 if(!val_dlv_init(qstate, vq, ve, id))
2118 /* store overall validation result in orig_msg */
2119 if(vq->rrset_skip == 0)
2120 vq->orig_msg->rep->security = vq->chase_reply->security;
2121 else if(subtype != VAL_CLASS_REFERRAL ||
2122 vq->rrset_skip < vq->orig_msg->rep->an_numrrsets +
2123 vq->orig_msg->rep->ns_numrrsets) {
2124 /* ignore sec status of additional section if a referral
2125 * type message skips there and
2126 * use the lowest security status as end result. */
2127 if(vq->chase_reply->security < vq->orig_msg->rep->security)
2128 vq->orig_msg->rep->security =
2129 vq->chase_reply->security;
2132 if(subtype == VAL_CLASS_REFERRAL) {
2133 /* for a referral, move to next unchecked rrset and check it*/
2134 vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep,
2136 if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
2137 /* and restart for this rrset */
2138 verbose(VERB_ALGO, "validator: go to next rrset");
2139 vq->chase_reply->security = sec_status_unchecked;
2140 vq->dlv_checked = 0; /* can do DLV for this RR */
2141 vq->state = VAL_INIT_STATE;
2144 /* referral chase is done */
2146 if(vq->chase_reply->security != sec_status_bogus &&
2147 subtype == VAL_CLASS_CNAME) {
2148 /* chase the CNAME; process next part of the message */
2149 if(!val_chase_cname(&vq->qchase, vq->orig_msg->rep,
2151 verbose(VERB_ALGO, "validator: failed to chase CNAME");
2152 vq->orig_msg->rep->security = sec_status_bogus;
2154 /* restart process for new qchase at rrset_skip */
2155 log_query_info(VERB_ALGO, "validator: chased to",
2157 vq->chase_reply->security = sec_status_unchecked;
2158 vq->dlv_checked = 0; /* can do DLV for this RR */
2159 vq->state = VAL_INIT_STATE;
2164 if(vq->orig_msg->rep->security == sec_status_secure) {
2165 /* If the message is secure, check that all rrsets are
2166 * secure (i.e. some inserted RRset for CNAME chain with
2167 * a different signer name). And drop additional rrsets
2168 * that are not secure (if clean-additional option is set) */
2169 /* this may cause the msg to be marked bogus */
2170 val_check_nonsecure(qstate->env, vq->orig_msg->rep);
2171 if(vq->orig_msg->rep->security == sec_status_secure) {
2172 log_query_info(VERB_DETAIL, "validation success",
2174 if(!qstate->no_cache_store) {
2175 val_neg_addreply(qstate->env->neg_cache,
2181 /* if the result is bogus - set message ttl to bogus ttl to avoid
2182 * endless bogus revalidation */
2183 if(vq->orig_msg->rep->security == sec_status_bogus) {
2184 /* see if we can try again to fetch data */
2185 if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2186 int restart_count = vq->restart_count+1;
2187 verbose(VERB_ALGO, "validation failed, "
2188 "blacklist and retry to fetch data");
2189 val_blacklist(&qstate->blacklist, qstate->region,
2190 qstate->reply_origin, 0);
2191 qstate->reply_origin = NULL;
2192 qstate->errinf = NULL;
2193 memset(vq, 0, sizeof(*vq));
2194 vq->restart_count = restart_count;
2195 vq->state = VAL_INIT_STATE;
2196 verbose(VERB_ALGO, "pass back to next module");
2197 qstate->ext_state[id] = module_restart_next;
2201 vq->orig_msg->rep->ttl = ve->bogus_ttl;
2202 vq->orig_msg->rep->prefetch_ttl =
2203 PREFETCH_TTL_CALC(vq->orig_msg->rep->ttl);
2204 if(qstate->env->cfg->val_log_level >= 1 &&
2205 !qstate->env->cfg->val_log_squelch) {
2206 if(qstate->env->cfg->val_log_level < 2)
2207 log_query_info(0, "validation failure",
2210 char* err = errinf_to_str(qstate);
2211 if(err) log_info("%s", err);
2216 * If set, the validator will not make messages bogus, instead
2217 * indeterminate is issued, so that no clients receive SERVFAIL.
2218 * This allows an operator to run validation 'shadow' without
2219 * hurting responses to clients.
2221 /* If we are in permissive mode, bogus gets indeterminate */
2222 if(qstate->env->cfg->val_permissive_mode)
2223 vq->orig_msg->rep->security = sec_status_indeterminate;
2226 /* store results in cache */
2227 if(qstate->query_flags&BIT_RD) {
2228 /* if secure, this will override cache anyway, no need
2229 * to check if from parentNS */
2230 if(!qstate->no_cache_store) {
2231 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2232 vq->orig_msg->rep, 0, qstate->prefetch_leeway, 0, NULL,
2233 qstate->query_flags)) {
2234 log_err("out of memory caching validator results");
2238 /* for a referral, store the verified RRsets */
2239 /* and this does not get prefetched, so no leeway */
2240 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2241 vq->orig_msg->rep, 1, 0, 0, NULL,
2242 qstate->query_flags)) {
2243 log_err("out of memory caching validator results");
2246 qstate->return_rcode = LDNS_RCODE_NOERROR;
2247 qstate->return_msg = vq->orig_msg;
2248 qstate->ext_state[id] = module_finished;
2253 * The DLVLookup state. Process DLV lookups.
2255 * @param qstate: query state.
2256 * @param vq: validator query state.
2257 * @param ve: validator shared global environment.
2258 * @param id: module id.
2259 * @return true if the event should be processed further on return, false if
2263 processDLVLookup(struct module_qstate* qstate, struct val_qstate* vq,
2264 struct val_env* ve, int id)
2266 struct module_qstate* newq = NULL;
2267 /* see if this we are ready to continue normal resolution */
2268 /* we may need more DLV lookups */
2269 if(vq->dlv_status==dlv_error)
2270 verbose(VERB_ALGO, "DLV woke up with status dlv_error");
2271 else if(vq->dlv_status==dlv_success)
2272 verbose(VERB_ALGO, "DLV woke up with status dlv_success");
2273 else if(vq->dlv_status==dlv_ask_higher)
2274 verbose(VERB_ALGO, "DLV woke up with status dlv_ask_higher");
2275 else if(vq->dlv_status==dlv_there_is_no_dlv)
2276 verbose(VERB_ALGO, "DLV woke up with status dlv_there_is_no_dlv");
2277 else verbose(VERB_ALGO, "DLV woke up with status unknown");
2279 if(vq->dlv_status == dlv_error) {
2280 verbose(VERB_QUERY, "failed DLV lookup");
2281 return val_error(qstate, id);
2282 } else if(vq->dlv_status == dlv_success) {
2285 /* chain continues with DNSKEY, continue in FINDKEY */
2286 vq->state = VAL_FINDKEY_STATE;
2288 /* strip off the DLV suffix from the name; could result in . */
2289 log_assert(dname_subdomain_c(vq->ds_rrset->rk.dname,
2290 qstate->env->anchors->dlv_anchor->name));
2291 nmlen = vq->ds_rrset->rk.dname_len -
2292 qstate->env->anchors->dlv_anchor->namelen + 1;
2293 nm = regional_alloc_init(qstate->region,
2294 vq->ds_rrset->rk.dname, nmlen);
2296 log_err("Out of memory in DLVLook");
2297 return val_error(qstate, id);
2301 vq->ds_rrset->rk.dname = nm;
2302 vq->ds_rrset->rk.dname_len = nmlen;
2304 /* create a nullentry for the key so the dnskey lookup
2305 * can be retried after a validation failure for it */
2306 vq->key_entry = key_entry_create_null(qstate->region,
2307 nm, nmlen, vq->qchase.qclass, 0, 0);
2308 if(!vq->key_entry) {
2309 log_err("Out of memory in DLVLook");
2310 return val_error(qstate, id);
2313 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
2314 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
2315 vq->qchase.qclass, BIT_CD, &newq, 0)) {
2316 log_err("mem error generating DNSKEY request");
2317 return val_error(qstate, id);
2320 } else if(vq->dlv_status == dlv_there_is_no_dlv) {
2321 /* continue with the insecure result we got */
2322 vq->state = VAL_FINISHED_STATE;
2325 log_assert(vq->dlv_status == dlv_ask_higher);
2327 /* ask higher, make sure we stay in DLV repo, below dlv_at */
2328 if(!dname_subdomain_c(vq->dlv_lookup_name,
2329 qstate->env->anchors->dlv_anchor->name)) {
2330 /* just like, there is no DLV */
2331 verbose(VERB_ALGO, "ask above dlv repo");
2332 vq->state = VAL_FINISHED_STATE;
2335 if(vq->dlv_insecure_at && !dname_subdomain_c(vq->dlv_lookup_name,
2336 vq->dlv_insecure_at)) {
2337 /* already checked a chain lower than dlv_lookup_name */
2338 verbose(VERB_ALGO, "ask above insecure endpoint");
2339 log_nametypeclass(VERB_ALGO, "enpt", vq->dlv_insecure_at, 0, 0);
2340 vq->state = VAL_FINISHED_STATE;
2344 /* check negative cache before making new request */
2345 if(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
2346 vq->dlv_lookup_name_len, vq->qchase.qclass,
2347 qstate->env->rrset_cache, *qstate->env->now)) {
2348 /* does not exist, go up one (go higher). */
2349 dname_remove_label(&vq->dlv_lookup_name,
2350 &vq->dlv_lookup_name_len);
2351 /* limit number of labels, limited number of recursion */
2352 return processDLVLookup(qstate, vq, ve, id);
2355 if(!generate_request(qstate, id, vq->dlv_lookup_name,
2356 vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV,
2357 vq->qchase.qclass, 0, &newq, 0)) {
2358 return val_error(qstate, id);
2365 * Handle validator state.
2366 * If a method returns true, the next state is started. If false, then
2367 * processing will stop.
2368 * @param qstate: query state.
2369 * @param vq: validator query state.
2370 * @param ve: validator shared global environment.
2371 * @param id: module id.
2374 val_handle(struct module_qstate* qstate, struct val_qstate* vq,
2375 struct val_env* ve, int id)
2379 verbose(VERB_ALGO, "val handle processing q with state %s",
2380 val_state_to_string(vq->state));
2382 case VAL_INIT_STATE:
2383 cont = processInit(qstate, vq, ve, id);
2385 case VAL_FINDKEY_STATE:
2386 cont = processFindKey(qstate, vq, id);
2388 case VAL_VALIDATE_STATE:
2389 cont = processValidate(qstate, vq, ve, id);
2391 case VAL_FINISHED_STATE:
2392 cont = processFinished(qstate, vq, ve, id);
2394 case VAL_DLVLOOKUP_STATE:
2395 cont = processDLVLookup(qstate, vq, ve, id);
2398 log_warn("validator: invalid state %d",
2407 val_operate(struct module_qstate* qstate, enum module_ev event, int id,
2408 struct outbound_entry* outbound)
2410 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2411 struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
2412 verbose(VERB_QUERY, "validator[module %d] operate: extstate:%s "
2413 "event:%s", id, strextstate(qstate->ext_state[id]),
2414 strmodulevent(event));
2415 log_query_info(VERB_QUERY, "validator operate: query",
2417 if(vq && qstate->qinfo.qname != vq->qchase.qname)
2418 log_query_info(VERB_QUERY, "validator operate: chased to",
2421 if(event == module_event_new ||
2422 (event == module_event_pass && vq == NULL)) {
2424 /* pass request to next module, to get it */
2425 verbose(VERB_ALGO, "validator: pass to next module");
2426 qstate->ext_state[id] = module_wait_module;
2429 if(event == module_event_moddone) {
2430 /* check if validation is needed */
2431 verbose(VERB_ALGO, "validator: nextmodule returned");
2433 if(!needs_validation(qstate, qstate->return_rcode,
2434 qstate->return_msg)) {
2435 /* no need to validate this */
2436 if(qstate->return_msg)
2437 qstate->return_msg->rep->security =
2438 sec_status_indeterminate;
2439 qstate->ext_state[id] = module_finished;
2442 if(already_validated(qstate->return_msg)) {
2443 qstate->ext_state[id] = module_finished;
2446 /* qclass ANY should have validation result from spawned
2447 * queries. If we get here, it is bogus or an internal error */
2448 if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) {
2449 verbose(VERB_ALGO, "cannot validate classANY: bogus");
2450 if(qstate->return_msg)
2451 qstate->return_msg->rep->security =
2453 qstate->ext_state[id] = module_finished;
2456 /* create state to start validation */
2457 qstate->ext_state[id] = module_error; /* override this */
2459 vq = val_new(qstate, id);
2461 log_err("validator: malloc failure");
2462 qstate->ext_state[id] = module_error;
2465 } else if(!vq->orig_msg) {
2466 if(!val_new_getmsg(qstate, vq)) {
2467 log_err("validator: malloc failure");
2468 qstate->ext_state[id] = module_error;
2472 val_handle(qstate, vq, ve, id);
2475 if(event == module_event_pass) {
2476 qstate->ext_state[id] = module_error; /* override this */
2477 /* continue processing, since val_env exists */
2478 val_handle(qstate, vq, ve, id);
2481 log_err("validator: bad event %s", strmodulevent(event));
2482 qstate->ext_state[id] = module_error;
2487 * Evaluate the response to a priming request.
2489 * @param dnskey_rrset: DNSKEY rrset (can be NULL if none) in prime reply.
2490 * (this rrset is allocated in the wrong region, not the qstate).
2491 * @param ta: trust anchor.
2492 * @param qstate: qstate that needs key.
2493 * @param id: module id.
2494 * @return new key entry or NULL on allocation failure.
2495 * The key entry will either contain a validated DNSKEY rrset, or
2496 * represent a Null key (query failed, but validation did not), or a
2497 * Bad key (validation failed).
2499 static struct key_entry_key*
2500 primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
2501 struct trust_anchor* ta, struct module_qstate* qstate, int id)
2503 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2504 struct key_entry_key* kkey = NULL;
2505 enum sec_status sec = sec_status_unchecked;
2506 char* reason = NULL;
2507 int downprot = qstate->env->cfg->harden_algo_downgrade;
2510 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2511 "could not fetch DNSKEY rrset",
2512 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2513 if(qstate->env->cfg->harden_dnssec_stripped) {
2514 errinf(qstate, "no DNSKEY rrset");
2515 kkey = key_entry_create_bad(qstate->region, ta->name,
2516 ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2518 } else kkey = key_entry_create_null(qstate->region, ta->name,
2519 ta->namelen, ta->dclass, NULL_KEY_TTL,
2522 log_err("out of memory: allocate fail prime key");
2527 /* attempt to verify with trust anchor DS and DNSKEY */
2528 kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve,
2529 dnskey_rrset, ta->ds_rrset, ta->dnskey_rrset, downprot,
2532 log_err("out of memory: verifying prime TA");
2535 if(key_entry_isgood(kkey))
2536 sec = sec_status_secure;
2538 sec = sec_status_bogus;
2539 verbose(VERB_DETAIL, "validate keys with anchor(DS): %s",
2540 sec_status_to_string(sec));
2542 if(sec != sec_status_secure) {
2543 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2544 "DNSKEY rrset is not secure",
2545 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2546 /* NOTE: in this case, we should probably reject the trust
2547 * anchor for longer, perhaps forever. */
2548 if(qstate->env->cfg->harden_dnssec_stripped) {
2549 errinf(qstate, reason);
2550 kkey = key_entry_create_bad(qstate->region, ta->name,
2551 ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2553 } else kkey = key_entry_create_null(qstate->region, ta->name,
2554 ta->namelen, ta->dclass, NULL_KEY_TTL,
2557 log_err("out of memory: allocate null prime key");
2563 log_nametypeclass(VERB_DETAIL, "Successfully primed trust anchor",
2564 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2569 * In inform supers, with the resulting message and rcode and the current
2570 * keyset in the super state, validate the DS response, returning a KeyEntry.
2572 * @param qstate: query state that is validating and asked for a DS.
2573 * @param vq: validator query state
2574 * @param id: module id.
2575 * @param rcode: rcode result value.
2576 * @param msg: result message (if rcode is OK).
2577 * @param qinfo: from the sub query state, query info.
2578 * @param ke: the key entry to return. It returns
2579 * is_bad if the DS response fails to validate, is_null if the
2580 * DS response indicated an end to secure space, is_good if the DS
2581 * validated. It returns ke=NULL if the DS response indicated that the
2582 * request wasn't a delegation point.
2583 * @return 0 on servfail error (malloc failure).
2586 ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
2587 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2588 struct key_entry_key** ke)
2590 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2591 char* reason = NULL;
2592 enum val_classification subtype;
2593 if(rcode != LDNS_RCODE_NOERROR) {
2596 (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
2597 /* errors here pretty much break validation */
2598 verbose(VERB_DETAIL, "DS response was error, thus bogus");
2600 errinf(qstate, "no DS");
2604 subtype = val_classify_response(BIT_RD, qinfo, qinfo, msg->rep, 0);
2605 if(subtype == VAL_CLASS_POSITIVE) {
2606 struct ub_packed_rrset_key* ds;
2607 enum sec_status sec;
2608 ds = reply_find_answer_rrset(qinfo, msg->rep);
2609 /* If there was no DS rrset, then we have mis-classified
2612 log_warn("internal error: POSITIVE DS response was "
2614 errinf(qstate, "no DS record");
2617 /* Verify only returns BOGUS or SECURE. If the rrset is
2618 * bogus, then we are done. */
2619 sec = val_verify_rrset_entry(qstate->env, ve, ds,
2620 vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate);
2621 if(sec != sec_status_secure) {
2622 verbose(VERB_DETAIL, "DS rrset in DS response did "
2624 errinf(qstate, reason);
2628 /* If the DS rrset validates, we still have to make sure
2629 * that they are usable. */
2630 if(!val_dsset_isusable(ds)) {
2631 /* If they aren't usable, then we treat it like
2632 * there was no DS. */
2633 *ke = key_entry_create_null(qstate->region,
2634 qinfo->qname, qinfo->qname_len, qinfo->qclass,
2635 ub_packed_rrset_ttl(ds), *qstate->env->now);
2636 return (*ke) != NULL;
2639 /* Otherwise, we return the positive response. */
2640 log_query_info(VERB_DETAIL, "validated DS", qinfo);
2641 *ke = key_entry_create_rrset(qstate->region,
2642 qinfo->qname, qinfo->qname_len, qinfo->qclass, ds,
2643 NULL, *qstate->env->now);
2644 return (*ke) != NULL;
2645 } else if(subtype == VAL_CLASS_NODATA ||
2646 subtype == VAL_CLASS_NAMEERROR) {
2647 /* NODATA means that the qname exists, but that there was
2648 * no DS. This is a pretty normal case. */
2649 time_t proof_ttl = 0;
2650 enum sec_status sec;
2652 /* make sure there are NSECs or NSEC3s with signatures */
2653 if(!val_has_signed_nsecs(msg->rep, &reason)) {
2654 verbose(VERB_ALGO, "no NSECs: %s", reason);
2655 errinf(qstate, reason);
2659 /* For subtype Name Error.
2660 * attempt ANS 2.8.1.0 compatibility where it sets rcode
2661 * to nxdomain, but really this is an Nodata/Noerror response.
2662 * Find and prove the empty nonterminal in that case */
2664 /* Try to prove absence of the DS with NSEC */
2665 sec = val_nsec_prove_nodata_dsreply(
2666 qstate->env, ve, qinfo, msg->rep, vq->key_entry,
2667 &proof_ttl, &reason, qstate);
2669 case sec_status_secure:
2670 verbose(VERB_DETAIL, "NSEC RRset for the "
2671 "referral proved no DS.");
2672 *ke = key_entry_create_null(qstate->region,
2673 qinfo->qname, qinfo->qname_len,
2674 qinfo->qclass, proof_ttl,
2676 return (*ke) != NULL;
2677 case sec_status_insecure:
2678 verbose(VERB_DETAIL, "NSEC RRset for the "
2679 "referral proved not a delegation point");
2682 case sec_status_bogus:
2683 verbose(VERB_DETAIL, "NSEC RRset for the "
2684 "referral did not prove no DS.");
2685 errinf(qstate, reason);
2687 case sec_status_unchecked:
2689 /* NSEC proof did not work, try next */
2693 sec = nsec3_prove_nods(qstate->env, ve,
2694 msg->rep->rrsets + msg->rep->an_numrrsets,
2695 msg->rep->ns_numrrsets, qinfo, vq->key_entry, &reason,
2698 case sec_status_insecure:
2699 /* case insecure also continues to unsigned
2700 * space. If nsec3-iter-count too high or
2701 * optout, then treat below as unsigned */
2702 case sec_status_secure:
2703 verbose(VERB_DETAIL, "NSEC3s for the "
2704 "referral proved no DS.");
2705 *ke = key_entry_create_null(qstate->region,
2706 qinfo->qname, qinfo->qname_len,
2707 qinfo->qclass, proof_ttl,
2709 return (*ke) != NULL;
2710 case sec_status_indeterminate:
2711 verbose(VERB_DETAIL, "NSEC3s for the "
2712 "referral proved no delegation");
2715 case sec_status_bogus:
2716 verbose(VERB_DETAIL, "NSEC3s for the "
2717 "referral did not prove no DS.");
2718 errinf(qstate, reason);
2720 case sec_status_unchecked:
2722 /* NSEC3 proof did not work */
2726 /* Apparently, no available NSEC/NSEC3 proved NODATA, so
2728 verbose(VERB_DETAIL, "DS %s ran out of options, so return "
2729 "bogus", val_classification_to_string(subtype));
2730 errinf(qstate, "no DS but also no proof of that");
2732 } else if(subtype == VAL_CLASS_CNAME ||
2733 subtype == VAL_CLASS_CNAMENOANSWER) {
2734 /* if the CNAME matches the exact name we want and is signed
2735 * properly, then also, we are sure that no DS exists there,
2736 * much like a NODATA proof */
2737 enum sec_status sec;
2738 struct ub_packed_rrset_key* cname;
2739 cname = reply_find_rrset_section_an(msg->rep, qinfo->qname,
2740 qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass);
2742 errinf(qstate, "validator classified CNAME but no "
2743 "CNAME of the queried name for DS");
2746 if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count
2748 if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep->
2749 rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) {
2750 errinf(qstate, "DS got DNAME answer");
2752 errinf(qstate, "DS got unsigned CNAME answer");
2756 sec = val_verify_rrset_entry(qstate->env, ve, cname,
2757 vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate);
2758 if(sec == sec_status_secure) {
2759 verbose(VERB_ALGO, "CNAME validated, "
2760 "proof that DS does not exist");
2761 /* and that it is not a referral point */
2765 errinf(qstate, "CNAME in DS response was not secure.");
2766 errinf(qstate, reason);
2769 verbose(VERB_QUERY, "Encountered an unhandled type of "
2770 "DS response, thus bogus.");
2771 errinf(qstate, "no DS and");
2772 if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) {
2775 (void)sldns_wire2str_rcode_buf((int)FLAGS_GET_RCODE(
2776 msg->rep->flags), rc, sizeof(rc));
2778 } else errinf(qstate, val_classification_to_string(subtype));
2779 errinf(qstate, "message fails to prove that");
2783 *ke = key_entry_create_bad(qstate->region, qinfo->qname,
2784 qinfo->qname_len, qinfo->qclass,
2785 BOGUS_KEY_TTL, *qstate->env->now);
2786 return (*ke) != NULL;
2790 * Process DS response. Called from inform_supers.
2791 * Because it is in inform_supers, the mesh itself is busy doing callbacks
2792 * for a state that is to be deleted soon; don't touch the mesh; instead
2793 * set a state in the super, as the super will be reactivated soon.
2794 * Perform processing to determine what state to set in the super.
2796 * @param qstate: query state that is validating and asked for a DS.
2797 * @param vq: validator query state
2798 * @param id: module id.
2799 * @param rcode: rcode result value.
2800 * @param msg: result message (if rcode is OK).
2801 * @param qinfo: from the sub query state, query info.
2802 * @param origin: the origin of msg.
2805 process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
2806 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2807 struct sock_list* origin)
2809 struct key_entry_key* dske = NULL;
2810 uint8_t* olds = vq->empty_DS_name;
2811 vq->empty_DS_name = NULL;
2812 if(!ds_response_to_ke(qstate, vq, id, rcode, msg, qinfo, &dske)) {
2813 log_err("malloc failure in process_ds_response");
2814 vq->key_entry = NULL; /* make it error */
2815 vq->state = VAL_VALIDATE_STATE;
2819 vq->empty_DS_name = regional_alloc_init(qstate->region,
2820 qinfo->qname, qinfo->qname_len);
2821 if(!vq->empty_DS_name) {
2822 log_err("malloc failure in empty_DS_name");
2823 vq->key_entry = NULL; /* make it error */
2824 vq->state = VAL_VALIDATE_STATE;
2827 vq->empty_DS_len = qinfo->qname_len;
2828 vq->chain_blacklist = NULL;
2829 /* ds response indicated that we aren't on a delegation point.
2830 * Keep the forState.state on FINDKEY. */
2831 } else if(key_entry_isgood(dske)) {
2832 vq->ds_rrset = key_entry_get_rrset(dske, qstate->region);
2834 log_err("malloc failure in process DS");
2835 vq->key_entry = NULL; /* make it error */
2836 vq->state = VAL_VALIDATE_STATE;
2839 vq->chain_blacklist = NULL; /* fresh blacklist for next part*/
2840 /* Keep the forState.state on FINDKEY. */
2841 } else if(key_entry_isbad(dske)
2842 && vq->restart_count < VAL_MAX_RESTART_COUNT) {
2843 vq->empty_DS_name = olds;
2844 val_blacklist(&vq->chain_blacklist, qstate->region, origin, 1);
2845 qstate->errinf = NULL;
2846 vq->restart_count++;
2848 if(key_entry_isbad(dske)) {
2849 errinf_origin(qstate, origin);
2850 errinf_dname(qstate, "for DS", qinfo->qname);
2852 /* NOTE: the reason for the DS to be not good (that is,
2853 * either bad or null) should have been logged by
2854 * dsResponseToKE. */
2855 vq->key_entry = dske;
2856 /* The FINDKEY phase has ended, so move on. */
2857 vq->state = VAL_VALIDATE_STATE;
2862 * Process DNSKEY response. Called from inform_supers.
2863 * Sets the key entry in the state.
2864 * Because it is in inform_supers, the mesh itself is busy doing callbacks
2865 * for a state that is to be deleted soon; don't touch the mesh; instead
2866 * set a state in the super, as the super will be reactivated soon.
2867 * Perform processing to determine what state to set in the super.
2869 * @param qstate: query state that is validating and asked for a DNSKEY.
2870 * @param vq: validator query state
2871 * @param id: module id.
2872 * @param rcode: rcode result value.
2873 * @param msg: result message (if rcode is OK).
2874 * @param qinfo: from the sub query state, query info.
2875 * @param origin: the origin of msg.
2878 process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
2879 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2880 struct sock_list* origin)
2882 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2883 struct key_entry_key* old = vq->key_entry;
2884 struct ub_packed_rrset_key* dnskey = NULL;
2886 char* reason = NULL;
2888 if(rcode == LDNS_RCODE_NOERROR)
2889 dnskey = reply_find_answer_rrset(qinfo, msg->rep);
2891 if(dnskey == NULL) {
2893 verbose(VERB_DETAIL, "Missing DNSKEY RRset in response to "
2895 if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2896 val_blacklist(&vq->chain_blacklist, qstate->region,
2898 qstate->errinf = NULL;
2899 vq->restart_count++;
2902 vq->key_entry = key_entry_create_bad(qstate->region,
2903 qinfo->qname, qinfo->qname_len, qinfo->qclass,
2904 BOGUS_KEY_TTL, *qstate->env->now);
2905 if(!vq->key_entry) {
2906 log_err("alloc failure in missing dnskey response");
2907 /* key_entry is NULL for failure in Validate */
2909 errinf(qstate, "No DNSKEY record");
2910 errinf_origin(qstate, origin);
2911 errinf_dname(qstate, "for key", qinfo->qname);
2912 vq->state = VAL_VALIDATE_STATE;
2916 log_err("internal error: no DS rrset for new DNSKEY response");
2917 vq->key_entry = NULL;
2918 vq->state = VAL_VALIDATE_STATE;
2921 downprot = qstate->env->cfg->harden_algo_downgrade;
2922 vq->key_entry = val_verify_new_DNSKEYs(qstate->region, qstate->env,
2923 ve, dnskey, vq->ds_rrset, downprot, &reason, qstate);
2925 if(!vq->key_entry) {
2926 log_err("out of memory in verify new DNSKEYs");
2927 vq->state = VAL_VALIDATE_STATE;
2930 /* If the key entry isBad or isNull, then we can move on to the next
2932 if(!key_entry_isgood(vq->key_entry)) {
2933 if(key_entry_isbad(vq->key_entry)) {
2934 if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2935 val_blacklist(&vq->chain_blacklist,
2936 qstate->region, origin, 1);
2937 qstate->errinf = NULL;
2938 vq->restart_count++;
2939 vq->key_entry = old;
2942 verbose(VERB_DETAIL, "Did not match a DS to a DNSKEY, "
2944 errinf(qstate, reason);
2945 errinf_origin(qstate, origin);
2946 errinf_dname(qstate, "for key", qinfo->qname);
2948 vq->chain_blacklist = NULL;
2949 vq->state = VAL_VALIDATE_STATE;
2952 vq->chain_blacklist = NULL;
2953 qstate->errinf = NULL;
2955 /* The DNSKEY validated, so cache it as a trusted key rrset. */
2956 key_cache_insert(ve->kcache, vq->key_entry, qstate);
2958 /* If good, we stay in the FINDKEY state. */
2959 log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo);
2963 * Process prime response
2964 * Sets the key entry in the state.
2966 * @param qstate: query state that is validating and primed a trust anchor.
2967 * @param vq: validator query state
2968 * @param id: module id.
2969 * @param rcode: rcode result value.
2970 * @param msg: result message (if rcode is OK).
2971 * @param origin: the origin of msg.
2974 process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
2975 int id, int rcode, struct dns_msg* msg, struct sock_list* origin)
2977 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2978 struct ub_packed_rrset_key* dnskey_rrset = NULL;
2979 struct trust_anchor* ta = anchor_find(qstate->env->anchors,
2980 vq->trust_anchor_name, vq->trust_anchor_labs,
2981 vq->trust_anchor_len, vq->qchase.qclass);
2983 /* trust anchor revoked, restart with less anchors */
2984 vq->state = VAL_INIT_STATE;
2985 if(!vq->trust_anchor_name)
2986 vq->state = VAL_VALIDATE_STATE; /* break a loop */
2987 vq->trust_anchor_name = NULL;
2990 /* Fetch and validate the keyEntry that corresponds to the
2991 * current trust anchor. */
2992 if(rcode == LDNS_RCODE_NOERROR) {
2993 dnskey_rrset = reply_find_rrset_section_an(msg->rep,
2994 ta->name, ta->namelen, LDNS_RR_TYPE_DNSKEY,
2999 if(!autr_process_prime(qstate->env, ve, ta, dnskey_rrset,
3001 /* trust anchor revoked, restart with less anchors */
3002 vq->state = VAL_INIT_STATE;
3003 vq->trust_anchor_name = NULL;
3007 vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, id);
3008 lock_basic_unlock(&ta->lock);
3010 if(key_entry_isbad(vq->key_entry)
3011 && vq->restart_count < VAL_MAX_RESTART_COUNT) {
3012 val_blacklist(&vq->chain_blacklist, qstate->region,
3014 qstate->errinf = NULL;
3015 vq->restart_count++;
3016 vq->key_entry = NULL;
3017 vq->state = VAL_INIT_STATE;
3020 vq->chain_blacklist = NULL;
3021 errinf_origin(qstate, origin);
3022 errinf_dname(qstate, "for trust anchor", ta->name);
3023 /* store the freshly primed entry in the cache */
3024 key_cache_insert(ve->kcache, vq->key_entry, qstate);
3027 /* If the result of the prime is a null key, skip the FINDKEY state.*/
3028 if(!vq->key_entry || key_entry_isnull(vq->key_entry) ||
3029 key_entry_isbad(vq->key_entry)) {
3030 vq->state = VAL_VALIDATE_STATE;
3032 /* the qstate will be reactivated after inform_super is done */
3036 * Process DLV response. Called from inform_supers.
3037 * Because it is in inform_supers, the mesh itself is busy doing callbacks
3038 * for a state that is to be deleted soon; don't touch the mesh; instead
3039 * set a state in the super, as the super will be reactivated soon.
3040 * Perform processing to determine what state to set in the super.
3042 * @param qstate: query state that is validating and asked for a DLV.
3043 * @param vq: validator query state
3044 * @param id: module id.
3045 * @param rcode: rcode result value.
3046 * @param msg: result message (if rcode is OK).
3047 * @param qinfo: from the sub query state, query info.
3050 process_dlv_response(struct module_qstate* qstate, struct val_qstate* vq,
3051 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo)
3053 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
3055 verbose(VERB_ALGO, "process dlv response to super");
3056 if(rcode != LDNS_RCODE_NOERROR) {
3057 /* lookup failed, set in vq to give up */
3058 vq->dlv_status = dlv_error;
3059 verbose(VERB_ALGO, "response is error");
3062 if(msg->rep->security != sec_status_secure) {
3063 vq->dlv_status = dlv_error;
3064 verbose(VERB_ALGO, "response is not secure, %s",
3065 sec_status_to_string(msg->rep->security));
3068 /* was the lookup a success? validated DLV? */
3069 if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NOERROR &&
3070 msg->rep->an_numrrsets == 1 &&
3071 msg->rep->security == sec_status_secure &&
3072 ntohs(msg->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DLV &&
3073 ntohs(msg->rep->rrsets[0]->rk.rrset_class) == qinfo->qclass &&
3074 query_dname_compare(msg->rep->rrsets[0]->rk.dname,
3075 vq->dlv_lookup_name) == 0) {
3076 /* yay! it is just like a DS */
3077 vq->ds_rrset = (struct ub_packed_rrset_key*)
3078 regional_alloc_init(qstate->region,
3079 msg->rep->rrsets[0], sizeof(*vq->ds_rrset));
3081 log_err("out of memory in process_dlv");
3084 vq->ds_rrset->entry.key = vq->ds_rrset;
3085 vq->ds_rrset->rk.dname = (uint8_t*)regional_alloc_init(
3086 qstate->region, vq->ds_rrset->rk.dname,
3087 vq->ds_rrset->rk.dname_len);
3088 if(!vq->ds_rrset->rk.dname) {
3089 log_err("out of memory in process_dlv");
3090 vq->dlv_status = dlv_error;
3093 vq->ds_rrset->entry.data = regional_alloc_init(qstate->region,
3094 vq->ds_rrset->entry.data,
3095 packed_rrset_sizeof(vq->ds_rrset->entry.data));
3096 if(!vq->ds_rrset->entry.data) {
3097 log_err("out of memory in process_dlv");
3098 vq->dlv_status = dlv_error;
3101 packed_rrset_ptr_fixup(vq->ds_rrset->entry.data);
3102 /* make vq do a DNSKEY query next up */
3103 vq->dlv_status = dlv_success;
3106 /* store NSECs into negative cache */
3107 val_neg_addreply(ve->neg_cache, msg->rep);
3109 /* was the lookup a failure?
3110 * if we have to go up into the DLV for a higher DLV anchor
3111 * then set this in the vq, so it can make queries when activated.
3112 * See if the NSECs indicate that we should look for higher DLV
3113 * or, that there is no DLV securely */
3114 if(!val_nsec_check_dlv(qinfo, msg->rep, &vq->dlv_lookup_name,
3115 &vq->dlv_lookup_name_len)) {
3116 vq->dlv_status = dlv_error;
3117 verbose(VERB_ALGO, "nsec error");
3120 if(!dname_subdomain_c(vq->dlv_lookup_name,
3121 qstate->env->anchors->dlv_anchor->name)) {
3122 vq->dlv_status = dlv_there_is_no_dlv;
3125 vq->dlv_status = dlv_ask_higher;
3129 * inform validator super.
3131 * @param qstate: query state that finished.
3132 * @param id: module id.
3133 * @param super: the qstate to inform.
3136 val_inform_super(struct module_qstate* qstate, int id,
3137 struct module_qstate* super)
3139 struct val_qstate* vq = (struct val_qstate*)super->minfo[id];
3140 log_query_info(VERB_ALGO, "validator: inform_super, sub is",
3142 log_query_info(VERB_ALGO, "super is", &super->qinfo);
3144 verbose(VERB_ALGO, "super: has no validator state");
3147 if(vq->wait_prime_ta) {
3148 vq->wait_prime_ta = 0;
3149 process_prime_response(super, vq, id, qstate->return_rcode,
3150 qstate->return_msg, qstate->reply_origin);
3153 if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS) {
3154 process_ds_response(super, vq, id, qstate->return_rcode,
3155 qstate->return_msg, &qstate->qinfo,
3156 qstate->reply_origin);
3158 } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY) {
3159 process_dnskey_response(super, vq, id, qstate->return_rcode,
3160 qstate->return_msg, &qstate->qinfo,
3161 qstate->reply_origin);
3163 } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DLV) {
3164 process_dlv_response(super, vq, id, qstate->return_rcode,
3165 qstate->return_msg, &qstate->qinfo);
3168 log_err("internal error in validator: no inform_supers possible");
3172 val_clear(struct module_qstate* qstate, int id)
3176 /* everything is allocated in the region, so assign NULL */
3177 qstate->minfo[id] = NULL;
3181 val_get_mem(struct module_env* env, int id)
3183 struct val_env* ve = (struct val_env*)env->modinfo[id];
3186 return sizeof(*ve) + key_cache_get_mem(ve->kcache) +
3187 val_neg_get_mem(ve->neg_cache) +
3188 sizeof(size_t)*2*ve->nsec3_keyiter_count;
3192 * The validator function block
3194 static struct module_func_block val_block = {
3196 &val_init, &val_deinit, &val_operate, &val_inform_super, &val_clear,
3200 struct module_func_block*
3201 val_get_funcblock(void)
3207 val_state_to_string(enum val_state state)
3210 case VAL_INIT_STATE: return "VAL_INIT_STATE";
3211 case VAL_FINDKEY_STATE: return "VAL_FINDKEY_STATE";
3212 case VAL_VALIDATE_STATE: return "VAL_VALIDATE_STATE";
3213 case VAL_FINISHED_STATE: return "VAL_FINISHED_STATE";
3214 case VAL_DLVLOOKUP_STATE: return "VAL_DLVLOOKUP_STATE";
3216 return "UNKNOWN VALIDATOR STATE";