2 * validator/validator.c - secure validator DNS query response module
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 * This file contains a module that performs validation of DNS queries.
40 * According to RFC 4034.
44 #include "validator/validator.h"
45 #include "validator/val_anchor.h"
46 #include "validator/val_kcache.h"
47 #include "validator/val_kentry.h"
48 #include "validator/val_utils.h"
49 #include "validator/val_nsec.h"
50 #include "validator/val_nsec3.h"
51 #include "validator/val_neg.h"
52 #include "validator/val_sigcrypt.h"
53 #include "validator/autotrust.h"
54 #include "services/cache/dns.h"
55 #include "services/cache/rrset.h"
56 #include "util/data/dname.h"
57 #include "util/module.h"
59 #include "util/net_help.h"
60 #include "util/regional.h"
61 #include "util/config_file.h"
62 #include "util/fptr_wlist.h"
63 #include "sldns/rrdef.h"
64 #include "sldns/wire2str.h"
65 #include "sldns/str2wire.h"
67 /* forward decl for cache response and normal super inform calls of a DS */
68 static void process_ds_response(struct module_qstate* qstate,
69 struct val_qstate* vq, int id, int rcode, struct dns_msg* msg,
70 struct query_info* qinfo, struct sock_list* origin);
72 /** fill up nsec3 key iterations config entry */
74 fill_nsec3_iter(struct val_env* ve, char* s, int c)
78 free(ve->nsec3_keysize);
79 free(ve->nsec3_maxiter);
80 ve->nsec3_keysize = (size_t*)calloc(sizeof(size_t), (size_t)c);
81 ve->nsec3_maxiter = (size_t*)calloc(sizeof(size_t), (size_t)c);
82 if(!ve->nsec3_keysize || !ve->nsec3_maxiter) {
83 log_err("out of memory");
87 ve->nsec3_keysize[i] = (size_t)strtol(s, &e, 10);
89 log_err("cannot parse: %s", s);
93 ve->nsec3_maxiter[i] = (size_t)strtol(s, &e, 10);
95 log_err("cannot parse: %s", s);
99 if(i>0 && ve->nsec3_keysize[i-1] >= ve->nsec3_keysize[i]) {
100 log_err("nsec3 key iterations not ascending: %d %d",
101 (int)ve->nsec3_keysize[i-1],
102 (int)ve->nsec3_keysize[i]);
105 verbose(VERB_ALGO, "validator nsec3cfg keysz %d mxiter %d",
106 (int)ve->nsec3_keysize[i], (int)ve->nsec3_maxiter[i]);
111 /** apply config settings to validator */
113 val_apply_cfg(struct module_env* env, struct val_env* val_env,
114 struct config_file* cfg)
117 val_env->bogus_ttl = (uint32_t)cfg->bogus_ttl;
119 env->anchors = anchors_create();
121 log_err("out of memory");
125 val_env->kcache = key_cache_create(cfg);
126 if(!val_env->kcache) {
127 log_err("out of memory");
130 env->key_cache = val_env->kcache;
131 if(!anchors_apply_cfg(env->anchors, cfg)) {
132 log_err("validator: error in trustanchors config");
135 val_env->date_override = cfg->val_date_override;
136 val_env->skew_min = cfg->val_sig_skew_min;
137 val_env->skew_max = cfg->val_sig_skew_max;
138 c = cfg_count_numbers(cfg->val_nsec3_key_iterations);
140 log_err("validator: unparseable or odd nsec3 key "
141 "iterations: %s", cfg->val_nsec3_key_iterations);
144 val_env->nsec3_keyiter_count = c/2;
145 if(!fill_nsec3_iter(val_env, cfg->val_nsec3_key_iterations, c/2)) {
146 log_err("validator: cannot apply nsec3 key iterations");
149 if(!val_env->neg_cache)
150 val_env->neg_cache = val_neg_create(cfg,
151 val_env->nsec3_maxiter[val_env->nsec3_keyiter_count-1]);
152 if(!val_env->neg_cache) {
153 log_err("out of memory");
156 env->neg_cache = val_env->neg_cache;
160 #ifdef USE_ECDSA_EVP_WORKAROUND
161 void ecdsa_evp_workaround_init(void);
164 val_init(struct module_env* env, int id)
166 struct val_env* val_env = (struct val_env*)calloc(1,
167 sizeof(struct val_env));
169 log_err("malloc failure");
172 env->modinfo[id] = (void*)val_env;
173 env->need_to_validate = 1;
174 lock_basic_init(&val_env->bogus_lock);
175 lock_protect(&val_env->bogus_lock, &val_env->num_rrset_bogus,
176 sizeof(val_env->num_rrset_bogus));
177 #ifdef USE_ECDSA_EVP_WORKAROUND
178 ecdsa_evp_workaround_init();
180 if(!val_apply_cfg(env, val_env, env->cfg)) {
181 log_err("validator: could not apply configuration settings.");
189 val_deinit(struct module_env* env, int id)
191 struct val_env* val_env;
192 if(!env || !env->modinfo[id])
194 val_env = (struct val_env*)env->modinfo[id];
195 lock_basic_destroy(&val_env->bogus_lock);
196 anchors_delete(env->anchors);
198 key_cache_delete(val_env->kcache);
199 neg_cache_delete(val_env->neg_cache);
200 free(val_env->nsec3_keysize);
201 free(val_env->nsec3_maxiter);
203 env->modinfo[id] = NULL;
206 /** fill in message structure */
207 static struct val_qstate*
208 val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq)
210 if(!qstate->return_msg || qstate->return_rcode != LDNS_RCODE_NOERROR) {
211 /* create a message to verify */
212 verbose(VERB_ALGO, "constructing reply for validation");
213 vq->orig_msg = (struct dns_msg*)regional_alloc(qstate->region,
214 sizeof(struct dns_msg));
217 vq->orig_msg->qinfo = qstate->qinfo;
218 vq->orig_msg->rep = (struct reply_info*)regional_alloc(
219 qstate->region, sizeof(struct reply_info));
220 if(!vq->orig_msg->rep)
222 memset(vq->orig_msg->rep, 0, sizeof(struct reply_info));
223 vq->orig_msg->rep->flags = (uint16_t)(qstate->return_rcode&0xf)
224 |BIT_QR|BIT_RA|(qstate->query_flags|(BIT_CD|BIT_RD));
225 vq->orig_msg->rep->qdcount = 1;
227 vq->orig_msg = qstate->return_msg;
229 vq->qchase = qstate->qinfo;
230 /* chase reply will be an edited (sub)set of the orig msg rrset ptrs */
231 vq->chase_reply = regional_alloc_init(qstate->region,
233 sizeof(struct reply_info) - sizeof(struct rrset_ref));
236 if(vq->orig_msg->rep->rrset_count > RR_COUNT_MAX)
237 return NULL; /* protect against integer overflow */
238 vq->chase_reply->rrsets = regional_alloc_init(qstate->region,
239 vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*)
240 * vq->orig_msg->rep->rrset_count);
241 if(!vq->chase_reply->rrsets)
247 /** allocate new validator query state */
248 static struct val_qstate*
249 val_new(struct module_qstate* qstate, int id)
251 struct val_qstate* vq = (struct val_qstate*)regional_alloc(
252 qstate->region, sizeof(*vq));
253 log_assert(!qstate->minfo[id]);
256 memset(vq, 0, sizeof(*vq));
257 qstate->minfo[id] = vq;
258 vq->state = VAL_INIT_STATE;
259 return val_new_getmsg(qstate, vq);
263 * Exit validation with an error status
265 * @param qstate: query state
266 * @param id: validator id.
267 * @return false, for use by caller to return to stop processing.
270 val_error(struct module_qstate* qstate, int id)
272 qstate->ext_state[id] = module_error;
273 qstate->return_rcode = LDNS_RCODE_SERVFAIL;
278 * Check to see if a given response needs to go through the validation
279 * process. Typical reasons for this routine to return false are: CD bit was
280 * on in the original request, or the response is a kind of message that
281 * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.)
283 * @param qstate: query state.
284 * @param ret_rc: rcode for this message (if noerror - examine ret_msg).
285 * @param ret_msg: return msg, can be NULL; look at rcode instead.
286 * @return true if the response could use validation (although this does not
287 * mean we can actually validate this response).
290 needs_validation(struct module_qstate* qstate, int ret_rc,
291 struct dns_msg* ret_msg)
295 /* If the CD bit is on in the original request, then you could think
296 * that we don't bother to validate anything.
297 * But this is signalled internally with the valrec flag.
298 * User queries are validated with BIT_CD to make our cache clean
299 * so that bogus messages get retried by the upstream also for
300 * downstream validators that set BIT_CD.
301 * For DNS64 bit_cd signals no dns64 processing, but we want to
302 * provide validation there too */
304 if(qstate->query_flags & BIT_CD) {
305 verbose(VERB_ALGO, "not validating response due to CD bit");
309 if(qstate->is_valrec) {
310 verbose(VERB_ALGO, "not validating response, is valrec"
311 "(validation recursion lookup)");
315 if(ret_rc != LDNS_RCODE_NOERROR || !ret_msg)
317 else rcode = (int)FLAGS_GET_RCODE(ret_msg->rep->flags);
319 if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) {
320 if(verbosity >= VERB_ALGO) {
323 (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
324 verbose(VERB_ALGO, "cannot validate non-answer, rcode %s", rc);
329 /* cannot validate positive RRSIG response. (negatives can) */
330 if(qstate->qinfo.qtype == LDNS_RR_TYPE_RRSIG &&
331 rcode == LDNS_RCODE_NOERROR && ret_msg &&
332 ret_msg->rep->an_numrrsets > 0) {
333 verbose(VERB_ALGO, "cannot validate RRSIG, no sigs on sigs.");
340 * Check to see if the response has already been validated.
341 * @param ret_msg: return msg, can be NULL
342 * @return true if the response has already been validated
345 already_validated(struct dns_msg* ret_msg)
347 /* validate unchecked, and re-validate bogus messages */
348 if (ret_msg && ret_msg->rep->security > sec_status_bogus)
350 verbose(VERB_ALGO, "response has already been validated: %s",
351 sec_status_to_string(ret_msg->rep->security));
358 * Generate a request for DNS data.
360 * @param qstate: query state that is the parent.
361 * @param id: module id.
362 * @param name: what name to query for.
363 * @param namelen: length of name.
364 * @param qtype: query type.
365 * @param qclass: query class.
366 * @param flags: additional flags, such as the CD bit (BIT_CD), or 0.
367 * @param newq: If the subquery is newly created, it is returned,
368 * otherwise NULL is returned
369 * @param detached: true if this qstate should not attach to the subquery
370 * @return false on alloc failure.
373 generate_request(struct module_qstate* qstate, int id, uint8_t* name,
374 size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags,
375 struct module_qstate** newq, int detached)
377 struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
378 struct query_info ask;
381 ask.qname_len = namelen;
384 ask.local_alias = NULL;
385 log_query_info(VERB_ALGO, "generate request", &ask);
386 /* enable valrec flag to avoid recursion to the same validation
387 * routine, this lookup is simply a lookup. DLVs need validation */
388 if(qtype == LDNS_RR_TYPE_DLV)
392 struct mesh_state* sub = NULL;
393 fptr_ok(fptr_whitelist_modenv_add_sub(
394 qstate->env->add_sub));
395 if(!(*qstate->env->add_sub)(qstate, &ask,
396 (uint16_t)(BIT_RD|flags), 0, valrec, newq, &sub)){
397 log_err("Could not generate request: out of memory");
402 fptr_ok(fptr_whitelist_modenv_attach_sub(
403 qstate->env->attach_sub));
404 if(!(*qstate->env->attach_sub)(qstate, &ask,
405 (uint16_t)(BIT_RD|flags), 0, valrec, newq)){
406 log_err("Could not generate request: out of memory");
410 /* newq; validator does not need state created for that
411 * query, and its a 'normal' for iterator as well */
413 /* add our blacklist to the query blacklist */
414 sock_list_merge(&(*newq)->blacklist, (*newq)->region,
415 vq->chain_blacklist);
417 qstate->ext_state[id] = module_wait_subquery;
422 * Generate, send and detach key tag signaling query.
424 * @param qstate: query state.
425 * @param id: module id.
426 * @param ta: trust anchor, locked.
427 * @return false on a processing error.
430 generate_keytag_query(struct module_qstate* qstate, int id,
431 struct trust_anchor* ta)
433 /* 3 bytes for "_ta", 5 bytes per tag (4 bytes + "-") */
434 #define MAX_LABEL_TAGS (LDNS_MAX_LABELLEN-3)/5
436 uint16_t tags[MAX_LABEL_TAGS];
437 char tagstr[LDNS_MAX_LABELLEN+1] = "_ta"; /* +1 for NULL byte */
438 size_t tagstr_left = sizeof(tagstr) - strlen(tagstr);
439 char* tagstr_pos = tagstr + strlen(tagstr);
440 uint8_t dnamebuf[LDNS_MAX_DOMAINLEN+1]; /* +1 for label length byte */
441 size_t dnamebuf_len = sizeof(dnamebuf);
442 uint8_t* keytagdname;
443 struct module_qstate* newq = NULL;
444 enum module_ext_state ext_state = qstate->ext_state[id];
446 numtag = anchor_list_keytags(ta, tags, MAX_LABEL_TAGS);
450 for(i=0; i<numtag; i++) {
451 /* Buffer can't overflow; numtag is limited to tags that fit in
453 snprintf(tagstr_pos, tagstr_left, "-%04x", (unsigned)tags[i]);
454 tagstr_left -= strlen(tagstr_pos);
455 tagstr_pos += strlen(tagstr_pos);
458 sldns_str2wire_dname_buf_origin(tagstr, dnamebuf, &dnamebuf_len,
459 ta->name, ta->namelen);
460 if(!(keytagdname = (uint8_t*)regional_alloc_init(qstate->region,
461 dnamebuf, dnamebuf_len))) {
462 log_err("could not generate key tag query: out of memory");
466 log_nametypeclass(VERB_OPS, "generate keytag query", keytagdname,
467 LDNS_RR_TYPE_NULL, ta->dclass);
468 if(!generate_request(qstate, id, keytagdname, dnamebuf_len,
469 LDNS_RR_TYPE_NULL, ta->dclass, 0, &newq, 1)) {
470 log_err("failed to generate key tag signaling request");
474 /* Not interrested in subquery response. Restore the ext_state,
475 * that might be changed by generate_request() */
476 qstate->ext_state[id] = ext_state;
482 * Get keytag as uint16_t from string
484 * @param start: start of string containing keytag
485 * @param keytag: pointer where to store the extracted keytag
486 * @return: 1 if keytag was extracted, else 0.
489 sentinel_get_keytag(char* start, uint16_t* keytag) {
492 keytag_str = calloc(1, SENTINEL_KEYTAG_LEN + 1 /* null byte */);
495 memmove(keytag_str, start, SENTINEL_KEYTAG_LEN);
496 keytag_str[SENTINEL_KEYTAG_LEN] = '\0';
497 *keytag = (uint16_t)strtol(keytag_str, &e, 10);
498 if(!e || *e != '\0') {
507 * Prime trust anchor for use.
508 * Generate and dispatch a priming query for the given trust anchor.
509 * The trust anchor can be DNSKEY or DS and does not have to be signed.
511 * @param qstate: query state.
512 * @param vq: validator query state.
513 * @param id: module id.
514 * @param toprime: what to prime.
515 * @return false on a processing error.
518 prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq,
519 int id, struct trust_anchor* toprime)
521 struct module_qstate* newq = NULL;
522 int ret = generate_request(qstate, id, toprime->name, toprime->namelen,
523 LDNS_RR_TYPE_DNSKEY, toprime->dclass, BIT_CD, &newq, 0);
525 if(newq && qstate->env->cfg->trust_anchor_signaling &&
526 !generate_keytag_query(qstate, id, toprime)) {
527 log_err("keytag signaling query failed");
532 log_err("Could not prime trust anchor: out of memory");
535 /* ignore newq; validator does not need state created for that
536 * query, and its a 'normal' for iterator as well */
537 vq->wait_prime_ta = 1; /* to elicit PRIME_RESP_STATE processing
538 from the validator inform_super() routine */
539 /* store trust anchor name for later lookup when prime returns */
540 vq->trust_anchor_name = regional_alloc_init(qstate->region,
541 toprime->name, toprime->namelen);
542 vq->trust_anchor_len = toprime->namelen;
543 vq->trust_anchor_labs = toprime->namelabs;
544 if(!vq->trust_anchor_name) {
545 log_err("Could not prime trust anchor: out of memory");
552 * Validate if the ANSWER and AUTHORITY sections contain valid rrsets.
553 * They must be validly signed with the given key.
554 * Tries to validate ADDITIONAL rrsets as well, but only to check them.
555 * Allows unsigned CNAME after a DNAME that expands the DNAME.
557 * Note that by the time this method is called, the process of finding the
558 * trusted DNSKEY rrset that signs this response must already have been
561 * @param qstate: query state.
562 * @param env: module env for verify.
563 * @param ve: validator env for verify.
564 * @param qchase: query that was made.
565 * @param chase_reply: answer to validate.
566 * @param key_entry: the key entry, which is trusted, and which matches
567 * the signer of the answer. The key entry isgood().
568 * @return false if any of the rrsets in the an or ns sections of the message
569 * fail to verify. The message is then set to bogus.
572 validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
573 struct val_env* ve, struct query_info* qchase,
574 struct reply_info* chase_reply, struct key_entry_key* key_entry)
578 struct ub_packed_rrset_key* s;
583 /* validate the ANSWER section */
584 for(i=0; i<chase_reply->an_numrrsets; i++) {
585 s = chase_reply->rrsets[i];
586 /* Skip the CNAME following a (validated) DNAME.
587 * Because of the normalization routines in the iterator,
588 * there will always be an unsigned CNAME following a DNAME
589 * (unless qtype=DNAME). */
590 if(dname_seen && ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
592 /* CNAME was synthesized by our own iterator */
593 /* since the DNAME verified, mark the CNAME as secure */
594 ((struct packed_rrset_data*)s->entry.data)->security =
596 ((struct packed_rrset_data*)s->entry.data)->trust =
597 rrset_trust_validated;
601 /* Verify the answer rrset */
602 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
603 LDNS_SECTION_ANSWER, qstate);
604 /* If the (answer) rrset failed to validate, then this
606 if(sec != sec_status_secure) {
607 log_nametypeclass(VERB_QUERY, "validator: response "
608 "has failed ANSWER rrset:", s->rk.dname,
609 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
610 errinf(qstate, reason);
611 if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME)
612 errinf(qstate, "for CNAME");
613 else if(ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME)
614 errinf(qstate, "for DNAME");
615 errinf_origin(qstate, qstate->reply_origin);
616 chase_reply->security = sec_status_bogus;
620 /* Notice a DNAME that should be followed by an unsigned
622 if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
623 ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) {
628 /* validate the AUTHORITY section */
629 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
630 chase_reply->ns_numrrsets; i++) {
631 s = chase_reply->rrsets[i];
632 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
633 LDNS_SECTION_AUTHORITY, qstate);
634 /* If anything in the authority section fails to be secure,
635 * we have a bad message. */
636 if(sec != sec_status_secure) {
637 log_nametypeclass(VERB_QUERY, "validator: response "
638 "has failed AUTHORITY rrset:", s->rk.dname,
639 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
640 errinf(qstate, reason);
641 errinf_origin(qstate, qstate->reply_origin);
642 errinf_rrset(qstate, s);
643 chase_reply->security = sec_status_bogus;
648 /* If set, the validator should clean the additional section of
649 * secure messages. */
650 if(!env->cfg->val_clean_additional)
652 /* attempt to validate the ADDITIONAL section rrsets */
653 for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
654 i<chase_reply->rrset_count; i++) {
655 s = chase_reply->rrsets[i];
656 /* only validate rrs that have signatures with the key */
657 /* leave others unchecked, those get removed later on too */
658 val_find_rrset_signer(s, &sname, &slen);
659 if(sname && query_dname_compare(sname, key_entry->name)==0)
660 (void)val_verify_rrset_entry(env, ve, s, key_entry,
661 &reason, LDNS_SECTION_ADDITIONAL, qstate);
662 /* the additional section can fail to be secure,
663 * it is optional, check signature in case we need
664 * to clean the additional section later. */
671 * Detect wrong truncated response (say from BIND 9.6.1 that is forwarding
672 * and saw the NS record without signatures from a referral).
673 * The positive response has a mangled authority section.
674 * Remove that authority section and the additional section.
676 * @return true if a wrongly truncated response.
679 detect_wrongly_truncated(struct reply_info* rep)
682 /* only NS in authority, and it is bogus */
683 if(rep->ns_numrrsets != 1 || rep->an_numrrsets == 0)
685 if(ntohs(rep->rrsets[ rep->an_numrrsets ]->rk.type) != LDNS_RR_TYPE_NS)
687 if(((struct packed_rrset_data*)rep->rrsets[ rep->an_numrrsets ]
688 ->entry.data)->security == sec_status_secure)
690 /* answer section is present and secure */
691 for(i=0; i<rep->an_numrrsets; i++) {
692 if(((struct packed_rrset_data*)rep->rrsets[ i ]
693 ->entry.data)->security != sec_status_secure)
696 verbose(VERB_ALGO, "truncating to minimal response");
701 * For messages that are not referrals, if the chase reply contains an
702 * unsigned NS record in the authority section it could have been
703 * inserted by a (BIND) forwarder that thinks the zone is insecure, and
704 * that has an NS record without signatures in cache. Remove the NS
705 * record since the reply does not hinge on that record (in the authority
706 * section), but do not remove it if it removes the last record from the
707 * answer+authority sections.
708 * @param chase_reply: the chased reply, we have a key for this contents,
709 * so we should have signatures for these rrsets and not having
710 * signatures means it will be bogus.
711 * @param orig_reply: original reply, remove NS from there as well because
712 * we cannot mark the NS record as DNSSEC valid because it is not
713 * validated by signatures.
716 remove_spurious_authority(struct reply_info* chase_reply,
717 struct reply_info* orig_reply)
721 /* if no answer and only 1 auth RRset, do not remove that one */
722 if(chase_reply->an_numrrsets == 0 && chase_reply->ns_numrrsets == 1)
724 /* search authority section for unsigned NS records */
725 for(i = chase_reply->an_numrrsets;
726 i < chase_reply->an_numrrsets+chase_reply->ns_numrrsets; i++) {
727 struct packed_rrset_data* d = (struct packed_rrset_data*)
728 chase_reply->rrsets[i]->entry.data;
729 if(ntohs(chase_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
730 && d->rrsig_count == 0) {
736 /* see if we found the entry */
738 log_rrset_key(VERB_ALGO, "Removing spurious unsigned NS record "
739 "(likely inserted by forwarder)", chase_reply->rrsets[found]);
741 /* find rrset in orig_reply */
742 for(i = orig_reply->an_numrrsets;
743 i < orig_reply->an_numrrsets+orig_reply->ns_numrrsets; i++) {
744 if(ntohs(orig_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
745 && query_dname_compare(orig_reply->rrsets[i]->rk.dname,
746 chase_reply->rrsets[found]->rk.dname) == 0) {
747 /* remove from orig_msg */
748 val_reply_remove_auth(orig_reply, i);
752 /* remove rrset from chase_reply */
753 val_reply_remove_auth(chase_reply, found);
757 * Given a "positive" response -- a response that contains an answer to the
758 * question, and no CNAME chain, validate this response.
760 * The answer and authority RRsets must already be verified as secure.
762 * @param env: module env for verify.
763 * @param ve: validator env for verify.
764 * @param qchase: query that was made.
765 * @param chase_reply: answer to that query to validate.
766 * @param kkey: the key entry, which is trusted, and which matches
767 * the signer of the answer. The key entry isgood().
770 validate_positive_response(struct module_env* env, struct val_env* ve,
771 struct query_info* qchase, struct reply_info* chase_reply,
772 struct key_entry_key* kkey)
780 struct ub_packed_rrset_key* s;
782 /* validate the ANSWER section - this will be the answer itself */
783 for(i=0; i<chase_reply->an_numrrsets; i++) {
784 s = chase_reply->rrsets[i];
786 /* Check to see if the rrset is the result of a wildcard
787 * expansion. If so, an additional check will need to be
788 * made in the authority section. */
789 if(!val_rrset_wildcard(s, &wc, &wl)) {
790 log_nametypeclass(VERB_QUERY, "Positive response has "
791 "inconsistent wildcard sigs:", s->rk.dname,
792 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
793 chase_reply->security = sec_status_bogus;
796 if(wc && !wc_cached && env->cfg->aggressive_nsec) {
797 rrset_cache_update_wildcard(env->rrset_cache, s, wc, wl,
798 env->alloc, *env->now);
804 /* validate the AUTHORITY section as well - this will generally be
805 * the NS rrset (which could be missing, no problem) */
806 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
807 chase_reply->ns_numrrsets; i++) {
808 s = chase_reply->rrsets[i];
810 /* If this is a positive wildcard response, and we have a
811 * (just verified) NSEC record, try to use it to 1) prove
812 * that qname doesn't exist and 2) that the correct wildcard
814 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
815 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
818 /* if not, continue looking for proof */
821 /* Otherwise, if this is a positive wildcard response and
822 * we have NSEC3 records */
823 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
828 /* If this was a positive wildcard response that we haven't already
829 * proven, and we have NSEC3 records, try to prove it using the NSEC3
831 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
832 enum sec_status sec = nsec3_prove_wildcard(env, ve,
833 chase_reply->rrsets+chase_reply->an_numrrsets,
834 chase_reply->ns_numrrsets, qchase, kkey, wc);
835 if(sec == sec_status_insecure) {
836 verbose(VERB_ALGO, "Positive wildcard response is "
838 chase_reply->security = sec_status_insecure;
840 } else if(sec == sec_status_secure)
844 /* If after all this, we still haven't proven the positive wildcard
846 if(wc != NULL && !wc_NSEC_ok) {
847 verbose(VERB_QUERY, "positive response was wildcard "
848 "expansion and did not prove original data "
850 chase_reply->security = sec_status_bogus;
854 verbose(VERB_ALGO, "Successfully validated positive response");
855 chase_reply->security = sec_status_secure;
859 * Validate a NOERROR/NODATA signed response -- a response that has a
860 * NOERROR Rcode but no ANSWER section RRsets. This consists of making
861 * certain that the authority section NSEC/NSEC3s proves that the qname
862 * does exist and the qtype doesn't.
864 * The answer and authority RRsets must already be verified as secure.
866 * @param env: module env for verify.
867 * @param ve: validator env for verify.
868 * @param qchase: query that was made.
869 * @param chase_reply: answer to that query to validate.
870 * @param kkey: the key entry, which is trusted, and which matches
871 * the signer of the answer. The key entry isgood().
874 validate_nodata_response(struct module_env* env, struct val_env* ve,
875 struct query_info* qchase, struct reply_info* chase_reply,
876 struct key_entry_key* kkey)
878 /* Since we are here, there must be nothing in the ANSWER section to
880 /* (Note: CNAME/DNAME responses will not directly get here --
881 * instead, they are chased down into individual CNAME validations,
882 * and at the end of the cname chain a POSITIVE, or CNAME_NOANSWER
885 /* validate the AUTHORITY section */
886 int has_valid_nsec = 0; /* If true, then the NODATA has been proven.*/
887 uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
888 proven closest encloser. */
889 uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
890 int nsec3s_seen = 0; /* nsec3s seen */
891 struct ub_packed_rrset_key* s;
894 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
895 chase_reply->ns_numrrsets; i++) {
896 s = chase_reply->rrsets[i];
897 /* If we encounter an NSEC record, try to use it to prove
899 * This needs to handle the ENT NODATA case. */
900 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
901 if(nsec_proves_nodata(s, qchase, &wc)) {
903 /* sets wc-encloser if wildcard applicable */
905 if(val_nsec_proves_name_error(s, qchase->qname)) {
906 ce = nsec_closest_encloser(qchase->qname, s);
908 if(val_nsec_proves_insecuredelegation(s, qchase)) {
909 verbose(VERB_ALGO, "delegation is insecure");
910 chase_reply->security = sec_status_insecure;
913 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
918 /* check to see if we have a wildcard NODATA proof. */
920 /* The wildcard NODATA is 1 NSEC proving that qname does not exist
921 * (and also proving what the closest encloser is), and 1 NSEC
922 * showing the matching wildcard, which must be *.closest_encloser. */
926 if(query_dname_compare(wc, ce) != 0) {
931 if(!has_valid_nsec && nsec3s_seen) {
932 enum sec_status sec = nsec3_prove_nodata(env, ve,
933 chase_reply->rrsets+chase_reply->an_numrrsets,
934 chase_reply->ns_numrrsets, qchase, kkey);
935 if(sec == sec_status_insecure) {
936 verbose(VERB_ALGO, "NODATA response is insecure");
937 chase_reply->security = sec_status_insecure;
939 } else if(sec == sec_status_secure)
943 if(!has_valid_nsec) {
944 verbose(VERB_QUERY, "NODATA response failed to prove NODATA "
945 "status with NSEC/NSEC3");
946 if(verbosity >= VERB_ALGO)
947 log_dns_msg("Failed NODATA", qchase, chase_reply);
948 chase_reply->security = sec_status_bogus;
952 verbose(VERB_ALGO, "successfully validated NODATA response.");
953 chase_reply->security = sec_status_secure;
957 * Validate a NAMEERROR signed response -- a response that has a NXDOMAIN
959 * This consists of making certain that the authority section NSEC proves
960 * that the qname doesn't exist and the covering wildcard also doesn't exist..
962 * The answer and authority RRsets must have already been verified as secure.
964 * @param env: module env for verify.
965 * @param ve: validator env for verify.
966 * @param qchase: query that was made.
967 * @param chase_reply: answer to that query to validate.
968 * @param kkey: the key entry, which is trusted, and which matches
969 * the signer of the answer. The key entry isgood().
970 * @param rcode: adjusted RCODE, in case of RCODE/proof mismatch leniency.
973 validate_nameerror_response(struct module_env* env, struct val_env* ve,
974 struct query_info* qchase, struct reply_info* chase_reply,
975 struct key_entry_key* kkey, int* rcode)
977 int has_valid_nsec = 0;
978 int has_valid_wnsec = 0;
980 struct ub_packed_rrset_key* s;
984 int prev_ce_labs = 0;
986 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
987 chase_reply->ns_numrrsets; i++) {
988 s = chase_reply->rrsets[i];
989 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
990 if(val_nsec_proves_name_error(s, qchase->qname))
992 ce = nsec_closest_encloser(qchase->qname, s);
993 ce_labs = dname_count_labels(ce);
994 /* Use longest closest encloser to prove wildcard. */
995 if(ce_labs > prev_ce_labs ||
996 (ce_labs == prev_ce_labs &&
997 has_valid_wnsec == 0)) {
998 if(val_nsec_proves_no_wc(s, qchase->qname,
1000 has_valid_wnsec = 1;
1002 has_valid_wnsec = 0;
1004 prev_ce_labs = ce_labs;
1005 if(val_nsec_proves_insecuredelegation(s, qchase)) {
1006 verbose(VERB_ALGO, "delegation is insecure");
1007 chase_reply->security = sec_status_insecure;
1010 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3)
1014 if((!has_valid_nsec || !has_valid_wnsec) && nsec3s_seen) {
1015 /* use NSEC3 proof, both answer and auth rrsets, in case
1016 * NSEC3s end up in the answer (due to qtype=NSEC3 or so) */
1017 chase_reply->security = nsec3_prove_nameerror(env, ve,
1018 chase_reply->rrsets, chase_reply->an_numrrsets+
1019 chase_reply->ns_numrrsets, qchase, kkey);
1020 if(chase_reply->security != sec_status_secure) {
1021 verbose(VERB_QUERY, "NameError response failed nsec, "
1022 "nsec3 proof was %s", sec_status_to_string(
1023 chase_reply->security));
1027 has_valid_wnsec = 1;
1030 /* If the message fails to prove either condition, it is bogus. */
1031 if(!has_valid_nsec) {
1032 verbose(VERB_QUERY, "NameError response has failed to prove: "
1033 "qname does not exist");
1034 chase_reply->security = sec_status_bogus;
1035 /* Be lenient with RCODE in NSEC NameError responses */
1036 validate_nodata_response(env, ve, qchase, chase_reply, kkey);
1037 if (chase_reply->security == sec_status_secure)
1038 *rcode = LDNS_RCODE_NOERROR;
1042 if(!has_valid_wnsec) {
1043 verbose(VERB_QUERY, "NameError response has failed to prove: "
1044 "covering wildcard does not exist");
1045 chase_reply->security = sec_status_bogus;
1046 /* Be lenient with RCODE in NSEC NameError responses */
1047 validate_nodata_response(env, ve, qchase, chase_reply, kkey);
1048 if (chase_reply->security == sec_status_secure)
1049 *rcode = LDNS_RCODE_NOERROR;
1053 /* Otherwise, we consider the message secure. */
1054 verbose(VERB_ALGO, "successfully validated NAME ERROR response.");
1055 chase_reply->security = sec_status_secure;
1059 * Given a referral response, validate rrsets and take least trusted rrset
1060 * as the current validation status.
1062 * Note that by the time this method is called, the process of finding the
1063 * trusted DNSKEY rrset that signs this response must already have been
1066 * @param chase_reply: answer to validate.
1069 validate_referral_response(struct reply_info* chase_reply)
1073 /* message security equals lowest rrset security */
1074 chase_reply->security = sec_status_secure;
1075 for(i=0; i<chase_reply->rrset_count; i++) {
1076 s = ((struct packed_rrset_data*)chase_reply->rrsets[i]
1077 ->entry.data)->security;
1078 if(s < chase_reply->security)
1079 chase_reply->security = s;
1081 verbose(VERB_ALGO, "validated part of referral response as %s",
1082 sec_status_to_string(chase_reply->security));
1086 * Given an "ANY" response -- a response that contains an answer to a
1087 * qtype==ANY question, with answers. This does no checking that all
1088 * types are present.
1090 * NOTE: it may be possible to get parent-side delegation point records
1091 * here, which won't all be signed. Right now, this routine relies on the
1092 * upstream iterative resolver to not return these responses -- instead
1093 * treating them as referrals.
1095 * NOTE: RFC 4035 is silent on this issue, so this may change upon
1096 * clarification. Clarification draft -05 says to not check all types are
1099 * Note that by the time this method is called, the process of finding the
1100 * trusted DNSKEY rrset that signs this response must already have been
1103 * @param env: module env for verify.
1104 * @param ve: validator env for verify.
1105 * @param qchase: query that was made.
1106 * @param chase_reply: answer to that query to validate.
1107 * @param kkey: the key entry, which is trusted, and which matches
1108 * the signer of the answer. The key entry isgood().
1111 validate_any_response(struct module_env* env, struct val_env* ve,
1112 struct query_info* qchase, struct reply_info* chase_reply,
1113 struct key_entry_key* kkey)
1115 /* all answer and auth rrsets already verified */
1116 /* but check if a wildcard response is given, then check NSEC/NSEC3
1117 * for qname denial to see if wildcard is applicable */
1121 int nsec3s_seen = 0;
1123 struct ub_packed_rrset_key* s;
1125 if(qchase->qtype != LDNS_RR_TYPE_ANY) {
1126 log_err("internal error: ANY validation called for non-ANY");
1127 chase_reply->security = sec_status_bogus;
1131 /* validate the ANSWER section - this will be the answer itself */
1132 for(i=0; i<chase_reply->an_numrrsets; i++) {
1133 s = chase_reply->rrsets[i];
1135 /* Check to see if the rrset is the result of a wildcard
1136 * expansion. If so, an additional check will need to be
1137 * made in the authority section. */
1138 if(!val_rrset_wildcard(s, &wc, &wl)) {
1139 log_nametypeclass(VERB_QUERY, "Positive ANY response"
1140 " has inconsistent wildcard sigs:",
1141 s->rk.dname, ntohs(s->rk.type),
1142 ntohs(s->rk.rrset_class));
1143 chase_reply->security = sec_status_bogus;
1148 /* if it was a wildcard, check for NSEC/NSEC3s in both answer
1149 * and authority sections (NSEC may be moved to the ANSWER section) */
1151 for(i=0; i<chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
1153 s = chase_reply->rrsets[i];
1155 /* If this is a positive wildcard response, and we have a
1156 * (just verified) NSEC record, try to use it to 1) prove
1157 * that qname doesn't exist and 2) that the correct wildcard
1159 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1160 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1163 /* if not, continue looking for proof */
1166 /* Otherwise, if this is a positive wildcard response and
1167 * we have NSEC3 records */
1168 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1173 /* If this was a positive wildcard response that we haven't already
1174 * proven, and we have NSEC3 records, try to prove it using the NSEC3
1176 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1177 /* look both in answer and auth section for NSEC3s */
1178 enum sec_status sec = nsec3_prove_wildcard(env, ve,
1179 chase_reply->rrsets,
1180 chase_reply->an_numrrsets+chase_reply->ns_numrrsets,
1182 if(sec == sec_status_insecure) {
1183 verbose(VERB_ALGO, "Positive ANY wildcard response is "
1185 chase_reply->security = sec_status_insecure;
1187 } else if(sec == sec_status_secure)
1191 /* If after all this, we still haven't proven the positive wildcard
1192 * response, fail. */
1193 if(wc != NULL && !wc_NSEC_ok) {
1194 verbose(VERB_QUERY, "positive ANY response was wildcard "
1195 "expansion and did not prove original data "
1197 chase_reply->security = sec_status_bogus;
1201 verbose(VERB_ALGO, "Successfully validated positive ANY response");
1202 chase_reply->security = sec_status_secure;
1206 * Validate CNAME response, or DNAME+CNAME.
1207 * This is just like a positive proof, except that this is about a
1208 * DNAME+CNAME. Possible wildcard proof.
1209 * Difference with positive proof is that this routine refuses
1210 * wildcarded DNAMEs.
1212 * The answer and authority rrsets must already be verified as secure.
1214 * @param env: module env for verify.
1215 * @param ve: validator env for verify.
1216 * @param qchase: query that was made.
1217 * @param chase_reply: answer to that query to validate.
1218 * @param kkey: the key entry, which is trusted, and which matches
1219 * the signer of the answer. The key entry isgood().
1222 validate_cname_response(struct module_env* env, struct val_env* ve,
1223 struct query_info* qchase, struct reply_info* chase_reply,
1224 struct key_entry_key* kkey)
1229 int nsec3s_seen = 0;
1231 struct ub_packed_rrset_key* s;
1233 /* validate the ANSWER section - this will be the CNAME (+DNAME) */
1234 for(i=0; i<chase_reply->an_numrrsets; i++) {
1235 s = chase_reply->rrsets[i];
1237 /* Check to see if the rrset is the result of a wildcard
1238 * expansion. If so, an additional check will need to be
1239 * made in the authority section. */
1240 if(!val_rrset_wildcard(s, &wc, &wl)) {
1241 log_nametypeclass(VERB_QUERY, "Cname response has "
1242 "inconsistent wildcard sigs:", s->rk.dname,
1243 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1244 chase_reply->security = sec_status_bogus;
1248 /* Refuse wildcarded DNAMEs rfc 4597.
1249 * Do not follow a wildcarded DNAME because
1250 * its synthesized CNAME expansion is underdefined */
1251 if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
1252 ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME && wc) {
1253 log_nametypeclass(VERB_QUERY, "cannot validate a "
1254 "wildcarded DNAME:", s->rk.dname,
1255 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1256 chase_reply->security = sec_status_bogus;
1260 /* If we have found a CNAME, stop looking for one.
1261 * The iterator has placed the CNAME chain in correct
1263 if (ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
1268 /* AUTHORITY section */
1269 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1270 chase_reply->ns_numrrsets; i++) {
1271 s = chase_reply->rrsets[i];
1273 /* If this is a positive wildcard response, and we have a
1274 * (just verified) NSEC record, try to use it to 1) prove
1275 * that qname doesn't exist and 2) that the correct wildcard
1277 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1278 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1281 /* if not, continue looking for proof */
1284 /* Otherwise, if this is a positive wildcard response and
1285 * we have NSEC3 records */
1286 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1291 /* If this was a positive wildcard response that we haven't already
1292 * proven, and we have NSEC3 records, try to prove it using the NSEC3
1294 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1295 enum sec_status sec = nsec3_prove_wildcard(env, ve,
1296 chase_reply->rrsets+chase_reply->an_numrrsets,
1297 chase_reply->ns_numrrsets, qchase, kkey, wc);
1298 if(sec == sec_status_insecure) {
1299 verbose(VERB_ALGO, "wildcard CNAME response is "
1301 chase_reply->security = sec_status_insecure;
1303 } else if(sec == sec_status_secure)
1307 /* If after all this, we still haven't proven the positive wildcard
1308 * response, fail. */
1309 if(wc != NULL && !wc_NSEC_ok) {
1310 verbose(VERB_QUERY, "CNAME response was wildcard "
1311 "expansion and did not prove original data "
1313 chase_reply->security = sec_status_bogus;
1317 verbose(VERB_ALGO, "Successfully validated CNAME response");
1318 chase_reply->security = sec_status_secure;
1322 * Validate CNAME NOANSWER response, no more data after a CNAME chain.
1323 * This can be a NODATA or a NAME ERROR case, but not both at the same time.
1324 * We don't know because the rcode has been set to NOERROR by the CNAME.
1326 * The answer and authority rrsets must already be verified as secure.
1328 * @param env: module env for verify.
1329 * @param ve: validator env for verify.
1330 * @param qchase: query that was made.
1331 * @param chase_reply: answer to that query to validate.
1332 * @param kkey: the key entry, which is trusted, and which matches
1333 * the signer of the answer. The key entry isgood().
1336 validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
1337 struct query_info* qchase, struct reply_info* chase_reply,
1338 struct key_entry_key* kkey)
1340 int nodata_valid_nsec = 0; /* If true, then NODATA has been proven.*/
1341 uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
1342 proven closest encloser. */
1343 uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
1344 int nxdomain_valid_nsec = 0; /* if true, nameerror has been proven */
1345 int nxdomain_valid_wnsec = 0;
1346 int nsec3s_seen = 0; /* nsec3s seen */
1347 struct ub_packed_rrset_key* s;
1349 uint8_t* nsec_ce; /* Used to find the NSEC with the longest ce */
1351 int prev_ce_labs = 0;
1353 /* the AUTHORITY section */
1354 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1355 chase_reply->ns_numrrsets; i++) {
1356 s = chase_reply->rrsets[i];
1358 /* If we encounter an NSEC record, try to use it to prove
1359 * NODATA. This needs to handle the ENT NODATA case.
1360 * Also try to prove NAMEERROR, and absence of a wildcard */
1361 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1362 if(nsec_proves_nodata(s, qchase, &wc)) {
1363 nodata_valid_nsec = 1;
1364 /* set wc encloser if wildcard applicable */
1366 if(val_nsec_proves_name_error(s, qchase->qname)) {
1367 ce = nsec_closest_encloser(qchase->qname, s);
1368 nxdomain_valid_nsec = 1;
1370 nsec_ce = nsec_closest_encloser(qchase->qname, s);
1371 ce_labs = dname_count_labels(nsec_ce);
1372 /* Use longest closest encloser to prove wildcard. */
1373 if(ce_labs > prev_ce_labs ||
1374 (ce_labs == prev_ce_labs &&
1375 nxdomain_valid_wnsec == 0)) {
1376 if(val_nsec_proves_no_wc(s, qchase->qname,
1378 nxdomain_valid_wnsec = 1;
1380 nxdomain_valid_wnsec = 0;
1382 prev_ce_labs = ce_labs;
1383 if(val_nsec_proves_insecuredelegation(s, qchase)) {
1384 verbose(VERB_ALGO, "delegation is insecure");
1385 chase_reply->security = sec_status_insecure;
1388 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1393 /* check to see if we have a wildcard NODATA proof. */
1395 /* The wildcard NODATA is 1 NSEC proving that qname does not exists
1396 * (and also proving what the closest encloser is), and 1 NSEC
1397 * showing the matching wildcard, which must be *.closest_encloser. */
1399 nodata_valid_nsec = 0;
1401 if(query_dname_compare(wc, ce) != 0) {
1402 nodata_valid_nsec = 0;
1405 if(nxdomain_valid_nsec && !nxdomain_valid_wnsec) {
1406 /* name error is missing wildcard denial proof */
1407 nxdomain_valid_nsec = 0;
1410 if(nodata_valid_nsec && nxdomain_valid_nsec) {
1411 verbose(VERB_QUERY, "CNAMEchain to noanswer proves that name "
1412 "exists and not exists, bogus");
1413 chase_reply->security = sec_status_bogus;
1416 if(!nodata_valid_nsec && !nxdomain_valid_nsec && nsec3s_seen) {
1418 enum sec_status sec = nsec3_prove_nxornodata(env, ve,
1419 chase_reply->rrsets+chase_reply->an_numrrsets,
1420 chase_reply->ns_numrrsets, qchase, kkey, &nodata);
1421 if(sec == sec_status_insecure) {
1422 verbose(VERB_ALGO, "CNAMEchain to noanswer response "
1424 chase_reply->security = sec_status_insecure;
1426 } else if(sec == sec_status_secure) {
1428 nodata_valid_nsec = 1;
1429 else nxdomain_valid_nsec = 1;
1433 if(!nodata_valid_nsec && !nxdomain_valid_nsec) {
1434 verbose(VERB_QUERY, "CNAMEchain to noanswer response failed "
1435 "to prove status with NSEC/NSEC3");
1436 if(verbosity >= VERB_ALGO)
1437 log_dns_msg("Failed CNAMEnoanswer", qchase, chase_reply);
1438 chase_reply->security = sec_status_bogus;
1442 if(nodata_valid_nsec)
1443 verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1444 "NODATA response.");
1445 else verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1446 "NAMEERROR response.");
1447 chase_reply->security = sec_status_secure;
1451 * Process init state for validator.
1452 * Process the INIT state. First tier responses start in the INIT state.
1453 * This is where they are vetted for validation suitability, and the initial
1454 * key search is done.
1456 * Currently, events the come through this routine will be either promoted
1457 * to FINISHED/CNAME_RESP (no validation needed), FINDKEY (next step to
1458 * validation), or will be (temporarily) retired and a new priming request
1459 * event will be generated.
1461 * @param qstate: query state.
1462 * @param vq: validator query state.
1463 * @param ve: validator shared global environment.
1464 * @param id: module id.
1465 * @return true if the event should be processed further on return, false if
1469 processInit(struct module_qstate* qstate, struct val_qstate* vq,
1470 struct val_env* ve, int id)
1472 uint8_t* lookup_name;
1474 struct trust_anchor* anchor;
1475 enum val_classification subtype = val_classify_response(
1476 qstate->query_flags, &qstate->qinfo, &vq->qchase,
1477 vq->orig_msg->rep, vq->rrset_skip);
1478 if(vq->restart_count > VAL_MAX_RESTART_COUNT) {
1479 verbose(VERB_ALGO, "restart count exceeded");
1480 return val_error(qstate, id);
1482 verbose(VERB_ALGO, "validator classification %s",
1483 val_classification_to_string(subtype));
1484 if(subtype == VAL_CLASS_REFERRAL &&
1485 vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
1486 /* referral uses the rrset name as qchase, to find keys for
1488 vq->qchase.qname = vq->orig_msg->rep->
1489 rrsets[vq->rrset_skip]->rk.dname;
1490 vq->qchase.qname_len = vq->orig_msg->rep->
1491 rrsets[vq->rrset_skip]->rk.dname_len;
1492 vq->qchase.qtype = ntohs(vq->orig_msg->rep->
1493 rrsets[vq->rrset_skip]->rk.type);
1494 vq->qchase.qclass = ntohs(vq->orig_msg->rep->
1495 rrsets[vq->rrset_skip]->rk.rrset_class);
1497 lookup_name = vq->qchase.qname;
1498 lookup_len = vq->qchase.qname_len;
1499 /* for type DS look at the parent side for keys/trustanchor */
1500 /* also for NSEC not at apex */
1501 if(vq->qchase.qtype == LDNS_RR_TYPE_DS ||
1502 (vq->qchase.qtype == LDNS_RR_TYPE_NSEC &&
1503 vq->orig_msg->rep->rrset_count > vq->rrset_skip &&
1504 ntohs(vq->orig_msg->rep->rrsets[vq->rrset_skip]->rk.type) ==
1505 LDNS_RR_TYPE_NSEC &&
1506 !(vq->orig_msg->rep->rrsets[vq->rrset_skip]->
1507 rk.flags&PACKED_RRSET_NSEC_AT_APEX))) {
1508 dname_remove_label(&lookup_name, &lookup_len);
1511 val_mark_indeterminate(vq->chase_reply, qstate->env->anchors,
1512 qstate->env->rrset_cache, qstate->env);
1513 vq->key_entry = NULL;
1514 vq->empty_DS_name = NULL;
1516 anchor = anchors_lookup(qstate->env->anchors,
1517 lookup_name, lookup_len, vq->qchase.qclass);
1519 /* Determine the signer/lookup name */
1520 val_find_signer(subtype, &vq->qchase, vq->orig_msg->rep,
1521 vq->rrset_skip, &vq->signer_name, &vq->signer_len);
1522 if(vq->signer_name != NULL &&
1523 !dname_subdomain_c(lookup_name, vq->signer_name)) {
1524 log_nametypeclass(VERB_ALGO, "this signer name is not a parent "
1525 "of lookupname, omitted", vq->signer_name, 0, 0);
1526 vq->signer_name = NULL;
1528 if(vq->signer_name == NULL) {
1529 log_nametypeclass(VERB_ALGO, "no signer, using", lookup_name,
1532 lookup_name = vq->signer_name;
1533 lookup_len = vq->signer_len;
1534 log_nametypeclass(VERB_ALGO, "signer is", lookup_name, 0, 0);
1537 /* for NXDOMAIN it could be signed by a parent of the trust anchor */
1538 if(subtype == VAL_CLASS_NAMEERROR && vq->signer_name &&
1539 anchor && dname_strict_subdomain_c(anchor->name, lookup_name)){
1540 lock_basic_unlock(&anchor->lock);
1541 anchor = anchors_lookup(qstate->env->anchors,
1542 lookup_name, lookup_len, vq->qchase.qclass);
1543 if(!anchor) { /* unsigned parent denies anchor*/
1544 verbose(VERB_QUERY, "unsigned parent zone denies"
1545 " trust anchor, indeterminate");
1546 vq->chase_reply->security = sec_status_indeterminate;
1547 vq->state = VAL_FINISHED_STATE;
1550 verbose(VERB_ALGO, "trust anchor NXDOMAIN by signed parent");
1551 } else if(subtype == VAL_CLASS_POSITIVE &&
1552 qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY &&
1553 query_dname_compare(lookup_name, qstate->qinfo.qname) == 0) {
1554 /* is a DNSKEY so lookup a bit higher since we want to
1555 * get it from a parent or from trustanchor */
1556 dname_remove_label(&lookup_name, &lookup_len);
1559 if(vq->rrset_skip > 0 || subtype == VAL_CLASS_CNAME ||
1560 subtype == VAL_CLASS_REFERRAL) {
1561 /* extract this part of orig_msg into chase_reply for
1562 * the eventual VALIDATE stage */
1563 val_fill_reply(vq->chase_reply, vq->orig_msg->rep,
1564 vq->rrset_skip, lookup_name, lookup_len,
1566 if(verbosity >= VERB_ALGO)
1567 log_dns_msg("chased extract", &vq->qchase,
1571 vq->key_entry = key_cache_obtain(ve->kcache, lookup_name, lookup_len,
1572 vq->qchase.qclass, qstate->region, *qstate->env->now);
1574 /* there is no key(from DLV) and no trust anchor */
1575 if(vq->key_entry == NULL && anchor == NULL) {
1576 /*response isn't under a trust anchor, so we cannot validate.*/
1577 vq->chase_reply->security = sec_status_indeterminate;
1578 /* go to finished state to cache this result */
1579 vq->state = VAL_FINISHED_STATE;
1582 /* if not key, or if keyentry is *above* the trustanchor, i.e.
1583 * the keyentry is based on another (higher) trustanchor */
1584 else if(vq->key_entry == NULL || (anchor &&
1585 dname_strict_subdomain_c(anchor->name, vq->key_entry->name))) {
1586 /* trust anchor is an 'unsigned' trust anchor */
1587 if(anchor && anchor->numDS == 0 && anchor->numDNSKEY == 0) {
1588 vq->chase_reply->security = sec_status_insecure;
1589 val_mark_insecure(vq->chase_reply, anchor->name,
1590 qstate->env->rrset_cache, qstate->env);
1591 lock_basic_unlock(&anchor->lock);
1592 vq->dlv_checked=1; /* skip DLV check */
1593 /* go to finished state to cache this result */
1594 vq->state = VAL_FINISHED_STATE;
1597 /* fire off a trust anchor priming query. */
1598 verbose(VERB_DETAIL, "prime trust anchor");
1599 if(!prime_trust_anchor(qstate, vq, id, anchor)) {
1600 lock_basic_unlock(&anchor->lock);
1601 return val_error(qstate, id);
1603 lock_basic_unlock(&anchor->lock);
1604 /* and otherwise, don't continue processing this event.
1605 * (it will be reactivated when the priming query returns). */
1606 vq->state = VAL_FINDKEY_STATE;
1610 lock_basic_unlock(&anchor->lock);
1613 if(key_entry_isnull(vq->key_entry)) {
1614 /* response is under a null key, so we cannot validate
1615 * However, we do set the status to INSECURE, since it is
1616 * essentially proven insecure. */
1617 vq->chase_reply->security = sec_status_insecure;
1618 val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1619 qstate->env->rrset_cache, qstate->env);
1620 /* go to finished state to cache this result */
1621 vq->state = VAL_FINISHED_STATE;
1623 } else if(key_entry_isbad(vq->key_entry)) {
1624 /* key is bad, chain is bad, reply is bogus */
1625 errinf_dname(qstate, "key for validation", vq->key_entry->name);
1626 errinf(qstate, "is marked as invalid");
1627 if(key_entry_get_reason(vq->key_entry)) {
1628 errinf(qstate, "because of a previous");
1629 errinf(qstate, key_entry_get_reason(vq->key_entry));
1631 /* no retries, stop bothering the authority until timeout */
1632 vq->restart_count = VAL_MAX_RESTART_COUNT;
1633 vq->chase_reply->security = sec_status_bogus;
1634 vq->state = VAL_FINISHED_STATE;
1638 /* otherwise, we have our "closest" cached key -- continue
1639 * processing in the next state. */
1640 vq->state = VAL_FINDKEY_STATE;
1645 * Process the FINDKEY state. Generally this just calculates the next name
1646 * to query and either issues a DS or a DNSKEY query. It will check to see
1647 * if the correct key has already been reached, in which case it will
1648 * advance the event to the next state.
1650 * @param qstate: query state.
1651 * @param vq: validator query state.
1652 * @param id: module id.
1653 * @return true if the event should be processed further on return, false if
1657 processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
1659 uint8_t* target_key_name, *current_key_name;
1660 size_t target_key_len;
1662 struct module_qstate* newq = NULL;
1664 log_query_info(VERB_ALGO, "validator: FindKey", &vq->qchase);
1665 /* We know that state.key_entry is not 0 or bad key -- if it were,
1666 * then previous processing should have directed this event to
1667 * a different state.
1668 * It could be an isnull key, which signals that a DLV was just
1669 * done and the DNSKEY after the DLV failed with dnssec-retry state
1670 * and the DNSKEY has to be performed again. */
1671 log_assert(vq->key_entry && !key_entry_isbad(vq->key_entry));
1672 if(key_entry_isnull(vq->key_entry)) {
1673 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1674 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1675 vq->qchase.qclass, BIT_CD, &newq, 0)) {
1676 log_err("mem error generating DNSKEY request");
1677 return val_error(qstate, id);
1682 target_key_name = vq->signer_name;
1683 target_key_len = vq->signer_len;
1684 if(!target_key_name) {
1685 target_key_name = vq->qchase.qname;
1686 target_key_len = vq->qchase.qname_len;
1689 current_key_name = vq->key_entry->name;
1691 /* If our current key entry matches our target, then we are done. */
1692 if(query_dname_compare(target_key_name, current_key_name) == 0) {
1693 vq->state = VAL_VALIDATE_STATE;
1697 if(vq->empty_DS_name) {
1698 /* if the last empty nonterminal/emptyDS name we detected is
1699 * below the current key, use that name to make progress
1700 * along the chain of trust */
1701 if(query_dname_compare(target_key_name,
1702 vq->empty_DS_name) == 0) {
1703 /* do not query for empty_DS_name again */
1704 verbose(VERB_ALGO, "Cannot retrieve DS for signature");
1705 errinf(qstate, "no signatures");
1706 errinf_origin(qstate, qstate->reply_origin);
1707 vq->chase_reply->security = sec_status_bogus;
1708 vq->state = VAL_FINISHED_STATE;
1711 current_key_name = vq->empty_DS_name;
1714 log_nametypeclass(VERB_ALGO, "current keyname", current_key_name,
1715 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1716 log_nametypeclass(VERB_ALGO, "target keyname", target_key_name,
1717 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1718 /* assert we are walking down the DNS tree */
1719 if(!dname_subdomain_c(target_key_name, current_key_name)) {
1720 verbose(VERB_ALGO, "bad signer name");
1721 vq->chase_reply->security = sec_status_bogus;
1722 vq->state = VAL_FINISHED_STATE;
1725 /* so this value is >= -1 */
1726 strip_lab = dname_count_labels(target_key_name) -
1727 dname_count_labels(current_key_name) - 1;
1728 log_assert(strip_lab >= -1);
1729 verbose(VERB_ALGO, "striplab %d", strip_lab);
1731 dname_remove_labels(&target_key_name, &target_key_len,
1734 log_nametypeclass(VERB_ALGO, "next keyname", target_key_name,
1735 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1737 /* The next step is either to query for the next DS, or to query
1738 * for the next DNSKEY. */
1740 log_nametypeclass(VERB_ALGO, "DS RRset", vq->ds_rrset->rk.dname, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN);
1741 else verbose(VERB_ALGO, "No DS RRset");
1743 if(vq->ds_rrset && query_dname_compare(vq->ds_rrset->rk.dname,
1744 vq->key_entry->name) != 0) {
1745 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1746 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1747 vq->qchase.qclass, BIT_CD, &newq, 0)) {
1748 log_err("mem error generating DNSKEY request");
1749 return val_error(qstate, id);
1754 if(!vq->ds_rrset || query_dname_compare(vq->ds_rrset->rk.dname,
1755 target_key_name) != 0) {
1756 /* check if there is a cache entry : pick up an NSEC if
1757 * there is no DS, check if that NSEC has DS-bit unset, and
1758 * thus can disprove the secure delegation we seek.
1759 * We can then use that NSEC even in the absence of a SOA
1760 * record that would be required by the iterator to supply
1761 * a completely protocol-correct response.
1762 * Uses negative cache for NSEC3 lookup of DS responses. */
1763 /* only if cache not blacklisted, of course */
1764 struct dns_msg* msg;
1765 if(!qstate->blacklist && !vq->chain_blacklist &&
1766 (msg=val_find_DS(qstate->env, target_key_name,
1767 target_key_len, vq->qchase.qclass, qstate->region,
1768 vq->key_entry->name)) ) {
1769 verbose(VERB_ALGO, "Process cached DS response");
1770 process_ds_response(qstate, vq, id, LDNS_RCODE_NOERROR,
1771 msg, &msg->qinfo, NULL);
1772 return 1; /* continue processing ds-response results */
1774 if(!generate_request(qstate, id, target_key_name,
1775 target_key_len, LDNS_RR_TYPE_DS, vq->qchase.qclass,
1776 BIT_CD, &newq, 0)) {
1777 log_err("mem error generating DS request");
1778 return val_error(qstate, id);
1783 /* Otherwise, it is time to query for the DNSKEY */
1784 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1785 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1786 vq->qchase.qclass, BIT_CD, &newq, 0)) {
1787 log_err("mem error generating DNSKEY request");
1788 return val_error(qstate, id);
1795 * Process the VALIDATE stage, the init and findkey stages are finished,
1796 * and the right keys are available to validate the response.
1797 * Or, there are no keys available, in order to invalidate the response.
1799 * After validation, the status is recorded in the message and rrsets,
1800 * and finished state is started.
1802 * @param qstate: query state.
1803 * @param vq: validator query state.
1804 * @param ve: validator shared global environment.
1805 * @param id: module id.
1806 * @return true if the event should be processed further on return, false if
1810 processValidate(struct module_qstate* qstate, struct val_qstate* vq,
1811 struct val_env* ve, int id)
1813 enum val_classification subtype;
1816 if(!vq->key_entry) {
1817 verbose(VERB_ALGO, "validate: no key entry, failed");
1818 return val_error(qstate, id);
1821 /* This is the default next state. */
1822 vq->state = VAL_FINISHED_STATE;
1824 /* Unsigned responses must be underneath a "null" key entry.*/
1825 if(key_entry_isnull(vq->key_entry)) {
1826 verbose(VERB_DETAIL, "Verified that %sresponse is INSECURE",
1827 vq->signer_name?"":"unsigned ");
1828 vq->chase_reply->security = sec_status_insecure;
1829 val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1830 qstate->env->rrset_cache, qstate->env);
1831 key_cache_insert(ve->kcache, vq->key_entry, qstate);
1835 if(key_entry_isbad(vq->key_entry)) {
1836 log_nametypeclass(VERB_DETAIL, "Could not establish a chain "
1837 "of trust to keys for", vq->key_entry->name,
1838 LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class);
1839 vq->chase_reply->security = sec_status_bogus;
1840 errinf(qstate, "while building chain of trust");
1841 if(vq->restart_count >= VAL_MAX_RESTART_COUNT)
1842 key_cache_insert(ve->kcache, vq->key_entry, qstate);
1846 /* signerName being null is the indicator that this response was
1848 if(vq->signer_name == NULL) {
1849 log_query_info(VERB_ALGO, "processValidate: state has no "
1850 "signer name", &vq->qchase);
1851 verbose(VERB_DETAIL, "Could not establish validation of "
1852 "INSECURE status of unsigned response.");
1853 errinf(qstate, "no signatures");
1854 errinf_origin(qstate, qstate->reply_origin);
1855 vq->chase_reply->security = sec_status_bogus;
1858 subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
1859 &vq->qchase, vq->orig_msg->rep, vq->rrset_skip);
1860 if(subtype != VAL_CLASS_REFERRAL)
1861 remove_spurious_authority(vq->chase_reply, vq->orig_msg->rep);
1863 /* check signatures in the message;
1864 * answer and authority must be valid, additional is only checked. */
1865 if(!validate_msg_signatures(qstate, qstate->env, ve, &vq->qchase,
1866 vq->chase_reply, vq->key_entry)) {
1867 /* workaround bad recursor out there that truncates (even
1868 * with EDNS4k) to 512 by removing RRSIG from auth section
1869 * for positive replies*/
1870 if((subtype == VAL_CLASS_POSITIVE || subtype == VAL_CLASS_ANY
1871 || subtype == VAL_CLASS_CNAME) &&
1872 detect_wrongly_truncated(vq->orig_msg->rep)) {
1873 /* truncate the message some more */
1874 vq->orig_msg->rep->ns_numrrsets = 0;
1875 vq->orig_msg->rep->ar_numrrsets = 0;
1876 vq->orig_msg->rep->rrset_count =
1877 vq->orig_msg->rep->an_numrrsets;
1878 vq->chase_reply->ns_numrrsets = 0;
1879 vq->chase_reply->ar_numrrsets = 0;
1880 vq->chase_reply->rrset_count =
1881 vq->chase_reply->an_numrrsets;
1882 qstate->errinf = NULL;
1885 verbose(VERB_DETAIL, "Validate: message contains "
1892 case VAL_CLASS_POSITIVE:
1893 verbose(VERB_ALGO, "Validating a positive response");
1894 validate_positive_response(qstate->env, ve,
1895 &vq->qchase, vq->chase_reply, vq->key_entry);
1896 verbose(VERB_DETAIL, "validate(positive): %s",
1897 sec_status_to_string(
1898 vq->chase_reply->security));
1901 case VAL_CLASS_NODATA:
1902 verbose(VERB_ALGO, "Validating a nodata response");
1903 validate_nodata_response(qstate->env, ve,
1904 &vq->qchase, vq->chase_reply, vq->key_entry);
1905 verbose(VERB_DETAIL, "validate(nodata): %s",
1906 sec_status_to_string(
1907 vq->chase_reply->security));
1910 case VAL_CLASS_NAMEERROR:
1911 rcode = (int)FLAGS_GET_RCODE(vq->orig_msg->rep->flags);
1912 verbose(VERB_ALGO, "Validating a nxdomain response");
1913 validate_nameerror_response(qstate->env, ve,
1914 &vq->qchase, vq->chase_reply, vq->key_entry, &rcode);
1915 verbose(VERB_DETAIL, "validate(nxdomain): %s",
1916 sec_status_to_string(
1917 vq->chase_reply->security));
1918 FLAGS_SET_RCODE(vq->orig_msg->rep->flags, rcode);
1919 FLAGS_SET_RCODE(vq->chase_reply->flags, rcode);
1922 case VAL_CLASS_CNAME:
1923 verbose(VERB_ALGO, "Validating a cname response");
1924 validate_cname_response(qstate->env, ve,
1925 &vq->qchase, vq->chase_reply, vq->key_entry);
1926 verbose(VERB_DETAIL, "validate(cname): %s",
1927 sec_status_to_string(
1928 vq->chase_reply->security));
1931 case VAL_CLASS_CNAMENOANSWER:
1932 verbose(VERB_ALGO, "Validating a cname noanswer "
1934 validate_cname_noanswer_response(qstate->env, ve,
1935 &vq->qchase, vq->chase_reply, vq->key_entry);
1936 verbose(VERB_DETAIL, "validate(cname_noanswer): %s",
1937 sec_status_to_string(
1938 vq->chase_reply->security));
1941 case VAL_CLASS_REFERRAL:
1942 verbose(VERB_ALGO, "Validating a referral response");
1943 validate_referral_response(vq->chase_reply);
1944 verbose(VERB_DETAIL, "validate(referral): %s",
1945 sec_status_to_string(
1946 vq->chase_reply->security));
1950 verbose(VERB_ALGO, "Validating a positive ANY "
1952 validate_any_response(qstate->env, ve, &vq->qchase,
1953 vq->chase_reply, vq->key_entry);
1954 verbose(VERB_DETAIL, "validate(positive_any): %s",
1955 sec_status_to_string(
1956 vq->chase_reply->security));
1960 log_err("validate: unhandled response subtype: %d",
1963 if(vq->chase_reply->security == sec_status_bogus) {
1964 if(subtype == VAL_CLASS_POSITIVE)
1965 errinf(qstate, "wildcard");
1966 else errinf(qstate, val_classification_to_string(subtype));
1967 errinf(qstate, "proof failed");
1968 errinf_origin(qstate, qstate->reply_origin);
1976 * DLV is going to be decommissioned, but the code is still here for some time.
1978 * Called when a query is determined by other trust anchors to be insecure
1979 * (or indeterminate). Then we look if there is a key in the DLV.
1980 * Performs aggressive negative cache check to see if there is no key.
1981 * Otherwise, spawns a DLV query, and changes to the DLV wait state.
1983 * @param qstate: query state.
1984 * @param vq: validator query state.
1985 * @param ve: validator shared global environment.
1986 * @param id: module id.
1987 * @return true if there is no DLV.
1988 * false: processing is finished for the validator operate().
1989 * This function may exit in three ways:
1990 * o no DLV (aggressive cache), so insecure. (true)
1991 * o error - stop processing (false)
1992 * o DLV lookup was started, stop processing (false)
1995 val_dlv_init(struct module_qstate* qstate, struct val_qstate* vq,
1996 struct val_env* ve, int id)
2000 struct module_qstate* newq = NULL;
2001 /* there must be a DLV configured */
2002 log_assert(qstate->env->anchors->dlv_anchor);
2003 /* this bool is true to avoid looping in the DLV checks */
2004 log_assert(vq->dlv_checked);
2006 /* init the DLV lookup variables */
2007 vq->dlv_lookup_name = NULL;
2008 vq->dlv_lookup_name_len = 0;
2009 vq->dlv_insecure_at = NULL;
2010 vq->dlv_insecure_at_len = 0;
2012 /* Determine the name for which we want to lookup DLV.
2013 * This name is for the current message, or
2014 * for the current RRset for CNAME, referral subtypes.
2015 * If there is a signer, use that, otherwise the domain name */
2016 if(vq->signer_name) {
2017 nm = vq->signer_name;
2018 nm_len = vq->signer_len;
2021 nm = vq->qchase.qname;
2022 nm_len = vq->qchase.qname_len;
2023 if(vq->qchase.qtype == LDNS_RR_TYPE_DS)
2024 dname_remove_label(&nm, &nm_len);
2026 log_nametypeclass(VERB_ALGO, "DLV init look", nm, LDNS_RR_TYPE_DS,
2028 log_assert(nm && nm_len);
2029 /* sanity check: no DLV lookups below the DLV anchor itself.
2030 * Like, an securely insecure delegation there makes no sense. */
2031 if(dname_subdomain_c(nm, qstate->env->anchors->dlv_anchor->name)) {
2032 verbose(VERB_ALGO, "DLV lookup within DLV repository denied");
2035 /* concat name (minus root label) + dlv name */
2036 vq->dlv_lookup_name_len = nm_len - 1 +
2037 qstate->env->anchors->dlv_anchor->namelen;
2038 vq->dlv_lookup_name = regional_alloc(qstate->region,
2039 vq->dlv_lookup_name_len);
2040 if(!vq->dlv_lookup_name) {
2041 log_err("Out of memory preparing DLV lookup");
2042 return val_error(qstate, id);
2044 memmove(vq->dlv_lookup_name, nm, nm_len-1);
2045 memmove(vq->dlv_lookup_name+nm_len-1,
2046 qstate->env->anchors->dlv_anchor->name,
2047 qstate->env->anchors->dlv_anchor->namelen);
2048 log_nametypeclass(VERB_ALGO, "DLV name", vq->dlv_lookup_name,
2049 LDNS_RR_TYPE_DLV, vq->qchase.qclass);
2051 /* determine where the insecure point was determined, the DLV must
2052 * be equal or below that to continue building the trust chain
2053 * down. May be NULL if no trust chain was built yet */
2055 if(vq->key_entry && key_entry_isnull(vq->key_entry)) {
2056 nm = vq->key_entry->name;
2057 nm_len = vq->key_entry->namelen;
2060 vq->dlv_insecure_at_len = nm_len - 1 +
2061 qstate->env->anchors->dlv_anchor->namelen;
2062 vq->dlv_insecure_at = regional_alloc(qstate->region,
2063 vq->dlv_insecure_at_len);
2064 if(!vq->dlv_insecure_at) {
2065 log_err("Out of memory preparing DLV lookup");
2066 return val_error(qstate, id);
2068 memmove(vq->dlv_insecure_at, nm, nm_len-1);
2069 memmove(vq->dlv_insecure_at+nm_len-1,
2070 qstate->env->anchors->dlv_anchor->name,
2071 qstate->env->anchors->dlv_anchor->namelen);
2072 log_nametypeclass(VERB_ALGO, "insecure_at",
2073 vq->dlv_insecure_at, 0, vq->qchase.qclass);
2076 /* If we can find the name in the aggressive negative cache,
2077 * give up; insecure is the answer */
2078 while(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
2079 vq->dlv_lookup_name_len, vq->qchase.qclass,
2080 qstate->env->rrset_cache, *qstate->env->now)) {
2082 dname_remove_label(&vq->dlv_lookup_name,
2083 &vq->dlv_lookup_name_len);
2085 if(!dname_subdomain_c(vq->dlv_lookup_name,
2086 qstate->env->anchors->dlv_anchor->name)) {
2087 verbose(VERB_ALGO, "ask above dlv repo");
2088 return 1; /* Above the repo is insecure */
2090 /* above chain of trust? */
2091 if(vq->dlv_insecure_at && !dname_subdomain_c(
2092 vq->dlv_lookup_name, vq->dlv_insecure_at)) {
2093 verbose(VERB_ALGO, "ask above insecure endpoint");
2098 /* perform a lookup for the DLV; with validation */
2099 vq->state = VAL_DLVLOOKUP_STATE;
2100 if(!generate_request(qstate, id, vq->dlv_lookup_name,
2101 vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV,
2102 vq->qchase.qclass, 0, &newq, 0)) {
2103 return val_error(qstate, id);
2106 /* Find the closest encloser DLV from the repository.
2107 * then that is used to build another chain of trust
2108 * This may first require a query 'too low' that has NSECs in
2109 * the answer, from which we determine the closest encloser DLV.
2110 * When determine the closest encloser, skip empty nonterminals,
2111 * since we want a nonempty node in the DLV repository. */
2117 * The Finished state. The validation status (good or bad) has been determined.
2119 * @param qstate: query state.
2120 * @param vq: validator query state.
2121 * @param ve: validator shared global environment.
2122 * @param id: module id.
2123 * @return true if the event should be processed further on return, false if
2127 processFinished(struct module_qstate* qstate, struct val_qstate* vq,
2128 struct val_env* ve, int id)
2130 enum val_classification subtype = val_classify_response(
2131 qstate->query_flags, &qstate->qinfo, &vq->qchase,
2132 vq->orig_msg->rep, vq->rrset_skip);
2134 /* if the result is insecure or indeterminate and we have not
2135 * checked the DLV yet, check the DLV */
2136 if((vq->chase_reply->security == sec_status_insecure ||
2137 vq->chase_reply->security == sec_status_indeterminate) &&
2138 qstate->env->anchors->dlv_anchor && !vq->dlv_checked) {
2139 vq->dlv_checked = 1;
2140 if(!val_dlv_init(qstate, vq, ve, id))
2144 /* store overall validation result in orig_msg */
2145 if(vq->rrset_skip == 0)
2146 vq->orig_msg->rep->security = vq->chase_reply->security;
2147 else if(subtype != VAL_CLASS_REFERRAL ||
2148 vq->rrset_skip < vq->orig_msg->rep->an_numrrsets +
2149 vq->orig_msg->rep->ns_numrrsets) {
2150 /* ignore sec status of additional section if a referral
2151 * type message skips there and
2152 * use the lowest security status as end result. */
2153 if(vq->chase_reply->security < vq->orig_msg->rep->security)
2154 vq->orig_msg->rep->security =
2155 vq->chase_reply->security;
2158 if(subtype == VAL_CLASS_REFERRAL) {
2159 /* for a referral, move to next unchecked rrset and check it*/
2160 vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep,
2162 if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
2163 /* and restart for this rrset */
2164 verbose(VERB_ALGO, "validator: go to next rrset");
2165 vq->chase_reply->security = sec_status_unchecked;
2166 vq->dlv_checked = 0; /* can do DLV for this RR */
2167 vq->state = VAL_INIT_STATE;
2170 /* referral chase is done */
2172 if(vq->chase_reply->security != sec_status_bogus &&
2173 subtype == VAL_CLASS_CNAME) {
2174 /* chase the CNAME; process next part of the message */
2175 if(!val_chase_cname(&vq->qchase, vq->orig_msg->rep,
2177 verbose(VERB_ALGO, "validator: failed to chase CNAME");
2178 vq->orig_msg->rep->security = sec_status_bogus;
2180 /* restart process for new qchase at rrset_skip */
2181 log_query_info(VERB_ALGO, "validator: chased to",
2183 vq->chase_reply->security = sec_status_unchecked;
2184 vq->dlv_checked = 0; /* can do DLV for this RR */
2185 vq->state = VAL_INIT_STATE;
2190 if(vq->orig_msg->rep->security == sec_status_secure) {
2191 /* If the message is secure, check that all rrsets are
2192 * secure (i.e. some inserted RRset for CNAME chain with
2193 * a different signer name). And drop additional rrsets
2194 * that are not secure (if clean-additional option is set) */
2195 /* this may cause the msg to be marked bogus */
2196 val_check_nonsecure(qstate->env, vq->orig_msg->rep);
2197 if(vq->orig_msg->rep->security == sec_status_secure) {
2198 log_query_info(VERB_DETAIL, "validation success",
2200 if(!qstate->no_cache_store) {
2201 val_neg_addreply(qstate->env->neg_cache,
2207 /* if the result is bogus - set message ttl to bogus ttl to avoid
2208 * endless bogus revalidation */
2209 if(vq->orig_msg->rep->security == sec_status_bogus) {
2210 /* see if we can try again to fetch data */
2211 if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2212 int restart_count = vq->restart_count+1;
2213 verbose(VERB_ALGO, "validation failed, "
2214 "blacklist and retry to fetch data");
2215 val_blacklist(&qstate->blacklist, qstate->region,
2216 qstate->reply_origin, 0);
2217 qstate->reply_origin = NULL;
2218 qstate->errinf = NULL;
2219 memset(vq, 0, sizeof(*vq));
2220 vq->restart_count = restart_count;
2221 vq->state = VAL_INIT_STATE;
2222 verbose(VERB_ALGO, "pass back to next module");
2223 qstate->ext_state[id] = module_restart_next;
2227 vq->orig_msg->rep->ttl = ve->bogus_ttl;
2228 vq->orig_msg->rep->prefetch_ttl =
2229 PREFETCH_TTL_CALC(vq->orig_msg->rep->ttl);
2230 if(qstate->env->cfg->val_log_level >= 1 &&
2231 !qstate->env->cfg->val_log_squelch) {
2232 if(qstate->env->cfg->val_log_level < 2)
2233 log_query_info(0, "validation failure",
2236 char* err = errinf_to_str(qstate);
2237 if(err) log_info("%s", err);
2242 * If set, the validator will not make messages bogus, instead
2243 * indeterminate is issued, so that no clients receive SERVFAIL.
2244 * This allows an operator to run validation 'shadow' without
2245 * hurting responses to clients.
2247 /* If we are in permissive mode, bogus gets indeterminate */
2248 if(qstate->env->cfg->val_permissive_mode)
2249 vq->orig_msg->rep->security = sec_status_indeterminate;
2252 if(vq->orig_msg->rep->security == sec_status_secure &&
2253 qstate->env->cfg->root_key_sentinel &&
2254 (qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
2255 qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)) {
2258 if(*qstate->qinfo.qname == strlen(SENTINEL_IS) +
2259 SENTINEL_KEYTAG_LEN &&
2260 dname_lab_startswith(qstate->qinfo.qname, SENTINEL_IS,
2262 if(sentinel_get_keytag(keytag_start, &keytag) &&
2263 !anchor_has_keytag(qstate->env->anchors,
2264 (uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) {
2265 vq->orig_msg->rep->security =
2266 sec_status_secure_sentinel_fail;
2268 } else if(*qstate->qinfo.qname == strlen(SENTINEL_NOT) +
2269 SENTINEL_KEYTAG_LEN &&
2270 dname_lab_startswith(qstate->qinfo.qname, SENTINEL_NOT,
2272 if(sentinel_get_keytag(keytag_start, &keytag) &&
2273 anchor_has_keytag(qstate->env->anchors,
2274 (uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) {
2275 vq->orig_msg->rep->security =
2276 sec_status_secure_sentinel_fail;
2280 /* store results in cache */
2281 if(qstate->query_flags&BIT_RD) {
2282 /* if secure, this will override cache anyway, no need
2283 * to check if from parentNS */
2284 if(!qstate->no_cache_store) {
2285 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2286 vq->orig_msg->rep, 0, qstate->prefetch_leeway, 0, NULL,
2287 qstate->query_flags)) {
2288 log_err("out of memory caching validator results");
2292 /* for a referral, store the verified RRsets */
2293 /* and this does not get prefetched, so no leeway */
2294 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2295 vq->orig_msg->rep, 1, 0, 0, NULL,
2296 qstate->query_flags)) {
2297 log_err("out of memory caching validator results");
2300 qstate->return_rcode = LDNS_RCODE_NOERROR;
2301 qstate->return_msg = vq->orig_msg;
2302 qstate->ext_state[id] = module_finished;
2307 * The DLVLookup state. Process DLV lookups.
2309 * @param qstate: query state.
2310 * @param vq: validator query state.
2311 * @param ve: validator shared global environment.
2312 * @param id: module id.
2313 * @return true if the event should be processed further on return, false if
2317 processDLVLookup(struct module_qstate* qstate, struct val_qstate* vq,
2318 struct val_env* ve, int id)
2320 struct module_qstate* newq = NULL;
2321 /* see if this we are ready to continue normal resolution */
2322 /* we may need more DLV lookups */
2323 if(vq->dlv_status==dlv_error)
2324 verbose(VERB_ALGO, "DLV woke up with status dlv_error");
2325 else if(vq->dlv_status==dlv_success)
2326 verbose(VERB_ALGO, "DLV woke up with status dlv_success");
2327 else if(vq->dlv_status==dlv_ask_higher)
2328 verbose(VERB_ALGO, "DLV woke up with status dlv_ask_higher");
2329 else if(vq->dlv_status==dlv_there_is_no_dlv)
2330 verbose(VERB_ALGO, "DLV woke up with status dlv_there_is_no_dlv");
2331 else verbose(VERB_ALGO, "DLV woke up with status unknown");
2333 if(vq->dlv_status == dlv_error) {
2334 verbose(VERB_QUERY, "failed DLV lookup");
2335 return val_error(qstate, id);
2336 } else if(vq->dlv_status == dlv_success) {
2339 /* chain continues with DNSKEY, continue in FINDKEY */
2340 vq->state = VAL_FINDKEY_STATE;
2342 /* strip off the DLV suffix from the name; could result in . */
2343 log_assert(dname_subdomain_c(vq->ds_rrset->rk.dname,
2344 qstate->env->anchors->dlv_anchor->name));
2345 nmlen = vq->ds_rrset->rk.dname_len -
2346 qstate->env->anchors->dlv_anchor->namelen + 1;
2347 nm = regional_alloc_init(qstate->region,
2348 vq->ds_rrset->rk.dname, nmlen);
2350 log_err("Out of memory in DLVLook");
2351 return val_error(qstate, id);
2355 vq->ds_rrset->rk.dname = nm;
2356 vq->ds_rrset->rk.dname_len = nmlen;
2358 /* create a nullentry for the key so the dnskey lookup
2359 * can be retried after a validation failure for it */
2360 vq->key_entry = key_entry_create_null(qstate->region,
2361 nm, nmlen, vq->qchase.qclass, 0, 0);
2362 if(!vq->key_entry) {
2363 log_err("Out of memory in DLVLook");
2364 return val_error(qstate, id);
2367 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
2368 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
2369 vq->qchase.qclass, BIT_CD, &newq, 0)) {
2370 log_err("mem error generating DNSKEY request");
2371 return val_error(qstate, id);
2374 } else if(vq->dlv_status == dlv_there_is_no_dlv) {
2375 /* continue with the insecure result we got */
2376 vq->state = VAL_FINISHED_STATE;
2379 log_assert(vq->dlv_status == dlv_ask_higher);
2381 /* ask higher, make sure we stay in DLV repo, below dlv_at */
2382 if(!dname_subdomain_c(vq->dlv_lookup_name,
2383 qstate->env->anchors->dlv_anchor->name)) {
2384 /* just like, there is no DLV */
2385 verbose(VERB_ALGO, "ask above dlv repo");
2386 vq->state = VAL_FINISHED_STATE;
2389 if(vq->dlv_insecure_at && !dname_subdomain_c(vq->dlv_lookup_name,
2390 vq->dlv_insecure_at)) {
2391 /* already checked a chain lower than dlv_lookup_name */
2392 verbose(VERB_ALGO, "ask above insecure endpoint");
2393 log_nametypeclass(VERB_ALGO, "enpt", vq->dlv_insecure_at, 0, 0);
2394 vq->state = VAL_FINISHED_STATE;
2398 /* check negative cache before making new request */
2399 if(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
2400 vq->dlv_lookup_name_len, vq->qchase.qclass,
2401 qstate->env->rrset_cache, *qstate->env->now)) {
2402 /* does not exist, go up one (go higher). */
2403 dname_remove_label(&vq->dlv_lookup_name,
2404 &vq->dlv_lookup_name_len);
2405 /* limit number of labels, limited number of recursion */
2406 return processDLVLookup(qstate, vq, ve, id);
2409 if(!generate_request(qstate, id, vq->dlv_lookup_name,
2410 vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV,
2411 vq->qchase.qclass, 0, &newq, 0)) {
2412 return val_error(qstate, id);
2419 * Handle validator state.
2420 * If a method returns true, the next state is started. If false, then
2421 * processing will stop.
2422 * @param qstate: query state.
2423 * @param vq: validator query state.
2424 * @param ve: validator shared global environment.
2425 * @param id: module id.
2428 val_handle(struct module_qstate* qstate, struct val_qstate* vq,
2429 struct val_env* ve, int id)
2433 verbose(VERB_ALGO, "val handle processing q with state %s",
2434 val_state_to_string(vq->state));
2436 case VAL_INIT_STATE:
2437 cont = processInit(qstate, vq, ve, id);
2439 case VAL_FINDKEY_STATE:
2440 cont = processFindKey(qstate, vq, id);
2442 case VAL_VALIDATE_STATE:
2443 cont = processValidate(qstate, vq, ve, id);
2445 case VAL_FINISHED_STATE:
2446 cont = processFinished(qstate, vq, ve, id);
2448 case VAL_DLVLOOKUP_STATE:
2449 cont = processDLVLookup(qstate, vq, ve, id);
2452 log_warn("validator: invalid state %d",
2461 val_operate(struct module_qstate* qstate, enum module_ev event, int id,
2462 struct outbound_entry* outbound)
2464 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2465 struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
2466 verbose(VERB_QUERY, "validator[module %d] operate: extstate:%s "
2467 "event:%s", id, strextstate(qstate->ext_state[id]),
2468 strmodulevent(event));
2469 log_query_info(VERB_QUERY, "validator operate: query",
2471 if(vq && qstate->qinfo.qname != vq->qchase.qname)
2472 log_query_info(VERB_QUERY, "validator operate: chased to",
2475 if(event == module_event_new ||
2476 (event == module_event_pass && vq == NULL)) {
2478 /* pass request to next module, to get it */
2479 verbose(VERB_ALGO, "validator: pass to next module");
2480 qstate->ext_state[id] = module_wait_module;
2483 if(event == module_event_moddone) {
2484 /* check if validation is needed */
2485 verbose(VERB_ALGO, "validator: nextmodule returned");
2487 if(!needs_validation(qstate, qstate->return_rcode,
2488 qstate->return_msg)) {
2489 /* no need to validate this */
2490 if(qstate->return_msg)
2491 qstate->return_msg->rep->security =
2492 sec_status_indeterminate;
2493 qstate->ext_state[id] = module_finished;
2496 if(already_validated(qstate->return_msg)) {
2497 qstate->ext_state[id] = module_finished;
2500 /* qclass ANY should have validation result from spawned
2501 * queries. If we get here, it is bogus or an internal error */
2502 if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) {
2503 verbose(VERB_ALGO, "cannot validate classANY: bogus");
2504 if(qstate->return_msg)
2505 qstate->return_msg->rep->security =
2507 qstate->ext_state[id] = module_finished;
2510 /* create state to start validation */
2511 qstate->ext_state[id] = module_error; /* override this */
2513 vq = val_new(qstate, id);
2515 log_err("validator: malloc failure");
2516 qstate->ext_state[id] = module_error;
2519 } else if(!vq->orig_msg) {
2520 if(!val_new_getmsg(qstate, vq)) {
2521 log_err("validator: malloc failure");
2522 qstate->ext_state[id] = module_error;
2526 val_handle(qstate, vq, ve, id);
2529 if(event == module_event_pass) {
2530 qstate->ext_state[id] = module_error; /* override this */
2531 /* continue processing, since val_env exists */
2532 val_handle(qstate, vq, ve, id);
2535 log_err("validator: bad event %s", strmodulevent(event));
2536 qstate->ext_state[id] = module_error;
2541 * Evaluate the response to a priming request.
2543 * @param dnskey_rrset: DNSKEY rrset (can be NULL if none) in prime reply.
2544 * (this rrset is allocated in the wrong region, not the qstate).
2545 * @param ta: trust anchor.
2546 * @param qstate: qstate that needs key.
2547 * @param id: module id.
2548 * @return new key entry or NULL on allocation failure.
2549 * The key entry will either contain a validated DNSKEY rrset, or
2550 * represent a Null key (query failed, but validation did not), or a
2551 * Bad key (validation failed).
2553 static struct key_entry_key*
2554 primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
2555 struct trust_anchor* ta, struct module_qstate* qstate, int id)
2557 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2558 struct key_entry_key* kkey = NULL;
2559 enum sec_status sec = sec_status_unchecked;
2560 char* reason = NULL;
2561 int downprot = qstate->env->cfg->harden_algo_downgrade;
2564 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2565 "could not fetch DNSKEY rrset",
2566 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2567 if(qstate->env->cfg->harden_dnssec_stripped) {
2568 errinf(qstate, "no DNSKEY rrset");
2569 kkey = key_entry_create_bad(qstate->region, ta->name,
2570 ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2572 } else kkey = key_entry_create_null(qstate->region, ta->name,
2573 ta->namelen, ta->dclass, NULL_KEY_TTL,
2576 log_err("out of memory: allocate fail prime key");
2581 /* attempt to verify with trust anchor DS and DNSKEY */
2582 kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve,
2583 dnskey_rrset, ta->ds_rrset, ta->dnskey_rrset, downprot,
2586 log_err("out of memory: verifying prime TA");
2589 if(key_entry_isgood(kkey))
2590 sec = sec_status_secure;
2592 sec = sec_status_bogus;
2593 verbose(VERB_DETAIL, "validate keys with anchor(DS): %s",
2594 sec_status_to_string(sec));
2596 if(sec != sec_status_secure) {
2597 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2598 "DNSKEY rrset is not secure",
2599 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2600 /* NOTE: in this case, we should probably reject the trust
2601 * anchor for longer, perhaps forever. */
2602 if(qstate->env->cfg->harden_dnssec_stripped) {
2603 errinf(qstate, reason);
2604 kkey = key_entry_create_bad(qstate->region, ta->name,
2605 ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2607 } else kkey = key_entry_create_null(qstate->region, ta->name,
2608 ta->namelen, ta->dclass, NULL_KEY_TTL,
2611 log_err("out of memory: allocate null prime key");
2617 log_nametypeclass(VERB_DETAIL, "Successfully primed trust anchor",
2618 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2623 * In inform supers, with the resulting message and rcode and the current
2624 * keyset in the super state, validate the DS response, returning a KeyEntry.
2626 * @param qstate: query state that is validating and asked for a DS.
2627 * @param vq: validator query state
2628 * @param id: module id.
2629 * @param rcode: rcode result value.
2630 * @param msg: result message (if rcode is OK).
2631 * @param qinfo: from the sub query state, query info.
2632 * @param ke: the key entry to return. It returns
2633 * is_bad if the DS response fails to validate, is_null if the
2634 * DS response indicated an end to secure space, is_good if the DS
2635 * validated. It returns ke=NULL if the DS response indicated that the
2636 * request wasn't a delegation point.
2637 * @return 0 on servfail error (malloc failure).
2640 ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
2641 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2642 struct key_entry_key** ke)
2644 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2645 char* reason = NULL;
2646 enum val_classification subtype;
2647 if(rcode != LDNS_RCODE_NOERROR) {
2650 (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
2651 /* errors here pretty much break validation */
2652 verbose(VERB_DETAIL, "DS response was error, thus bogus");
2654 errinf(qstate, "no DS");
2658 subtype = val_classify_response(BIT_RD, qinfo, qinfo, msg->rep, 0);
2659 if(subtype == VAL_CLASS_POSITIVE) {
2660 struct ub_packed_rrset_key* ds;
2661 enum sec_status sec;
2662 ds = reply_find_answer_rrset(qinfo, msg->rep);
2663 /* If there was no DS rrset, then we have mis-classified
2666 log_warn("internal error: POSITIVE DS response was "
2668 errinf(qstate, "no DS record");
2671 /* Verify only returns BOGUS or SECURE. If the rrset is
2672 * bogus, then we are done. */
2673 sec = val_verify_rrset_entry(qstate->env, ve, ds,
2674 vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate);
2675 if(sec != sec_status_secure) {
2676 verbose(VERB_DETAIL, "DS rrset in DS response did "
2678 errinf(qstate, reason);
2682 /* If the DS rrset validates, we still have to make sure
2683 * that they are usable. */
2684 if(!val_dsset_isusable(ds)) {
2685 /* If they aren't usable, then we treat it like
2686 * there was no DS. */
2687 *ke = key_entry_create_null(qstate->region,
2688 qinfo->qname, qinfo->qname_len, qinfo->qclass,
2689 ub_packed_rrset_ttl(ds), *qstate->env->now);
2690 return (*ke) != NULL;
2693 /* Otherwise, we return the positive response. */
2694 log_query_info(VERB_DETAIL, "validated DS", qinfo);
2695 *ke = key_entry_create_rrset(qstate->region,
2696 qinfo->qname, qinfo->qname_len, qinfo->qclass, ds,
2697 NULL, *qstate->env->now);
2698 return (*ke) != NULL;
2699 } else if(subtype == VAL_CLASS_NODATA ||
2700 subtype == VAL_CLASS_NAMEERROR) {
2701 /* NODATA means that the qname exists, but that there was
2702 * no DS. This is a pretty normal case. */
2703 time_t proof_ttl = 0;
2704 enum sec_status sec;
2706 /* make sure there are NSECs or NSEC3s with signatures */
2707 if(!val_has_signed_nsecs(msg->rep, &reason)) {
2708 verbose(VERB_ALGO, "no NSECs: %s", reason);
2709 errinf(qstate, reason);
2713 /* For subtype Name Error.
2714 * attempt ANS 2.8.1.0 compatibility where it sets rcode
2715 * to nxdomain, but really this is an Nodata/Noerror response.
2716 * Find and prove the empty nonterminal in that case */
2718 /* Try to prove absence of the DS with NSEC */
2719 sec = val_nsec_prove_nodata_dsreply(
2720 qstate->env, ve, qinfo, msg->rep, vq->key_entry,
2721 &proof_ttl, &reason, qstate);
2723 case sec_status_secure:
2724 verbose(VERB_DETAIL, "NSEC RRset for the "
2725 "referral proved no DS.");
2726 *ke = key_entry_create_null(qstate->region,
2727 qinfo->qname, qinfo->qname_len,
2728 qinfo->qclass, proof_ttl,
2730 return (*ke) != NULL;
2731 case sec_status_insecure:
2732 verbose(VERB_DETAIL, "NSEC RRset for the "
2733 "referral proved not a delegation point");
2736 case sec_status_bogus:
2737 verbose(VERB_DETAIL, "NSEC RRset for the "
2738 "referral did not prove no DS.");
2739 errinf(qstate, reason);
2741 case sec_status_unchecked:
2743 /* NSEC proof did not work, try next */
2747 sec = nsec3_prove_nods(qstate->env, ve,
2748 msg->rep->rrsets + msg->rep->an_numrrsets,
2749 msg->rep->ns_numrrsets, qinfo, vq->key_entry, &reason,
2752 case sec_status_insecure:
2753 /* case insecure also continues to unsigned
2754 * space. If nsec3-iter-count too high or
2755 * optout, then treat below as unsigned */
2756 case sec_status_secure:
2757 verbose(VERB_DETAIL, "NSEC3s for the "
2758 "referral proved no DS.");
2759 *ke = key_entry_create_null(qstate->region,
2760 qinfo->qname, qinfo->qname_len,
2761 qinfo->qclass, proof_ttl,
2763 return (*ke) != NULL;
2764 case sec_status_indeterminate:
2765 verbose(VERB_DETAIL, "NSEC3s for the "
2766 "referral proved no delegation");
2769 case sec_status_bogus:
2770 verbose(VERB_DETAIL, "NSEC3s for the "
2771 "referral did not prove no DS.");
2772 errinf(qstate, reason);
2774 case sec_status_unchecked:
2776 /* NSEC3 proof did not work */
2780 /* Apparently, no available NSEC/NSEC3 proved NODATA, so
2782 verbose(VERB_DETAIL, "DS %s ran out of options, so return "
2783 "bogus", val_classification_to_string(subtype));
2784 errinf(qstate, "no DS but also no proof of that");
2786 } else if(subtype == VAL_CLASS_CNAME ||
2787 subtype == VAL_CLASS_CNAMENOANSWER) {
2788 /* if the CNAME matches the exact name we want and is signed
2789 * properly, then also, we are sure that no DS exists there,
2790 * much like a NODATA proof */
2791 enum sec_status sec;
2792 struct ub_packed_rrset_key* cname;
2793 cname = reply_find_rrset_section_an(msg->rep, qinfo->qname,
2794 qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass);
2796 errinf(qstate, "validator classified CNAME but no "
2797 "CNAME of the queried name for DS");
2800 if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count
2802 if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep->
2803 rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) {
2804 errinf(qstate, "DS got DNAME answer");
2806 errinf(qstate, "DS got unsigned CNAME answer");
2810 sec = val_verify_rrset_entry(qstate->env, ve, cname,
2811 vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate);
2812 if(sec == sec_status_secure) {
2813 verbose(VERB_ALGO, "CNAME validated, "
2814 "proof that DS does not exist");
2815 /* and that it is not a referral point */
2819 errinf(qstate, "CNAME in DS response was not secure.");
2820 errinf(qstate, reason);
2823 verbose(VERB_QUERY, "Encountered an unhandled type of "
2824 "DS response, thus bogus.");
2825 errinf(qstate, "no DS and");
2826 if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) {
2829 (void)sldns_wire2str_rcode_buf((int)FLAGS_GET_RCODE(
2830 msg->rep->flags), rc, sizeof(rc));
2832 } else errinf(qstate, val_classification_to_string(subtype));
2833 errinf(qstate, "message fails to prove that");
2837 *ke = key_entry_create_bad(qstate->region, qinfo->qname,
2838 qinfo->qname_len, qinfo->qclass,
2839 BOGUS_KEY_TTL, *qstate->env->now);
2840 return (*ke) != NULL;
2844 * Process DS response. Called from inform_supers.
2845 * Because it is in inform_supers, the mesh itself is busy doing callbacks
2846 * for a state that is to be deleted soon; don't touch the mesh; instead
2847 * set a state in the super, as the super will be reactivated soon.
2848 * Perform processing to determine what state to set in the super.
2850 * @param qstate: query state that is validating and asked for a DS.
2851 * @param vq: validator query state
2852 * @param id: module id.
2853 * @param rcode: rcode result value.
2854 * @param msg: result message (if rcode is OK).
2855 * @param qinfo: from the sub query state, query info.
2856 * @param origin: the origin of msg.
2859 process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
2860 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2861 struct sock_list* origin)
2863 struct key_entry_key* dske = NULL;
2864 uint8_t* olds = vq->empty_DS_name;
2865 vq->empty_DS_name = NULL;
2866 if(!ds_response_to_ke(qstate, vq, id, rcode, msg, qinfo, &dske)) {
2867 log_err("malloc failure in process_ds_response");
2868 vq->key_entry = NULL; /* make it error */
2869 vq->state = VAL_VALIDATE_STATE;
2873 vq->empty_DS_name = regional_alloc_init(qstate->region,
2874 qinfo->qname, qinfo->qname_len);
2875 if(!vq->empty_DS_name) {
2876 log_err("malloc failure in empty_DS_name");
2877 vq->key_entry = NULL; /* make it error */
2878 vq->state = VAL_VALIDATE_STATE;
2881 vq->empty_DS_len = qinfo->qname_len;
2882 vq->chain_blacklist = NULL;
2883 /* ds response indicated that we aren't on a delegation point.
2884 * Keep the forState.state on FINDKEY. */
2885 } else if(key_entry_isgood(dske)) {
2886 vq->ds_rrset = key_entry_get_rrset(dske, qstate->region);
2888 log_err("malloc failure in process DS");
2889 vq->key_entry = NULL; /* make it error */
2890 vq->state = VAL_VALIDATE_STATE;
2893 vq->chain_blacklist = NULL; /* fresh blacklist for next part*/
2894 /* Keep the forState.state on FINDKEY. */
2895 } else if(key_entry_isbad(dske)
2896 && vq->restart_count < VAL_MAX_RESTART_COUNT) {
2897 vq->empty_DS_name = olds;
2898 val_blacklist(&vq->chain_blacklist, qstate->region, origin, 1);
2899 qstate->errinf = NULL;
2900 vq->restart_count++;
2902 if(key_entry_isbad(dske)) {
2903 errinf_origin(qstate, origin);
2904 errinf_dname(qstate, "for DS", qinfo->qname);
2906 /* NOTE: the reason for the DS to be not good (that is,
2907 * either bad or null) should have been logged by
2908 * dsResponseToKE. */
2909 vq->key_entry = dske;
2910 /* The FINDKEY phase has ended, so move on. */
2911 vq->state = VAL_VALIDATE_STATE;
2916 * Process DNSKEY response. Called from inform_supers.
2917 * Sets the key entry in the state.
2918 * Because it is in inform_supers, the mesh itself is busy doing callbacks
2919 * for a state that is to be deleted soon; don't touch the mesh; instead
2920 * set a state in the super, as the super will be reactivated soon.
2921 * Perform processing to determine what state to set in the super.
2923 * @param qstate: query state that is validating and asked for a DNSKEY.
2924 * @param vq: validator query state
2925 * @param id: module id.
2926 * @param rcode: rcode result value.
2927 * @param msg: result message (if rcode is OK).
2928 * @param qinfo: from the sub query state, query info.
2929 * @param origin: the origin of msg.
2932 process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
2933 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2934 struct sock_list* origin)
2936 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2937 struct key_entry_key* old = vq->key_entry;
2938 struct ub_packed_rrset_key* dnskey = NULL;
2940 char* reason = NULL;
2942 if(rcode == LDNS_RCODE_NOERROR)
2943 dnskey = reply_find_answer_rrset(qinfo, msg->rep);
2945 if(dnskey == NULL) {
2947 verbose(VERB_DETAIL, "Missing DNSKEY RRset in response to "
2949 if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2950 val_blacklist(&vq->chain_blacklist, qstate->region,
2952 qstate->errinf = NULL;
2953 vq->restart_count++;
2956 vq->key_entry = key_entry_create_bad(qstate->region,
2957 qinfo->qname, qinfo->qname_len, qinfo->qclass,
2958 BOGUS_KEY_TTL, *qstate->env->now);
2959 if(!vq->key_entry) {
2960 log_err("alloc failure in missing dnskey response");
2961 /* key_entry is NULL for failure in Validate */
2963 errinf(qstate, "No DNSKEY record");
2964 errinf_origin(qstate, origin);
2965 errinf_dname(qstate, "for key", qinfo->qname);
2966 vq->state = VAL_VALIDATE_STATE;
2970 log_err("internal error: no DS rrset for new DNSKEY response");
2971 vq->key_entry = NULL;
2972 vq->state = VAL_VALIDATE_STATE;
2975 downprot = qstate->env->cfg->harden_algo_downgrade;
2976 vq->key_entry = val_verify_new_DNSKEYs(qstate->region, qstate->env,
2977 ve, dnskey, vq->ds_rrset, downprot, &reason, qstate);
2979 if(!vq->key_entry) {
2980 log_err("out of memory in verify new DNSKEYs");
2981 vq->state = VAL_VALIDATE_STATE;
2984 /* If the key entry isBad or isNull, then we can move on to the next
2986 if(!key_entry_isgood(vq->key_entry)) {
2987 if(key_entry_isbad(vq->key_entry)) {
2988 if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2989 val_blacklist(&vq->chain_blacklist,
2990 qstate->region, origin, 1);
2991 qstate->errinf = NULL;
2992 vq->restart_count++;
2993 vq->key_entry = old;
2996 verbose(VERB_DETAIL, "Did not match a DS to a DNSKEY, "
2998 errinf(qstate, reason);
2999 errinf_origin(qstate, origin);
3000 errinf_dname(qstate, "for key", qinfo->qname);
3002 vq->chain_blacklist = NULL;
3003 vq->state = VAL_VALIDATE_STATE;
3006 vq->chain_blacklist = NULL;
3007 qstate->errinf = NULL;
3009 /* The DNSKEY validated, so cache it as a trusted key rrset. */
3010 key_cache_insert(ve->kcache, vq->key_entry, qstate);
3012 /* If good, we stay in the FINDKEY state. */
3013 log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo);
3017 * Process prime response
3018 * Sets the key entry in the state.
3020 * @param qstate: query state that is validating and primed a trust anchor.
3021 * @param vq: validator query state
3022 * @param id: module id.
3023 * @param rcode: rcode result value.
3024 * @param msg: result message (if rcode is OK).
3025 * @param origin: the origin of msg.
3028 process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
3029 int id, int rcode, struct dns_msg* msg, struct sock_list* origin)
3031 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
3032 struct ub_packed_rrset_key* dnskey_rrset = NULL;
3033 struct trust_anchor* ta = anchor_find(qstate->env->anchors,
3034 vq->trust_anchor_name, vq->trust_anchor_labs,
3035 vq->trust_anchor_len, vq->qchase.qclass);
3037 /* trust anchor revoked, restart with less anchors */
3038 vq->state = VAL_INIT_STATE;
3039 if(!vq->trust_anchor_name)
3040 vq->state = VAL_VALIDATE_STATE; /* break a loop */
3041 vq->trust_anchor_name = NULL;
3044 /* Fetch and validate the keyEntry that corresponds to the
3045 * current trust anchor. */
3046 if(rcode == LDNS_RCODE_NOERROR) {
3047 dnskey_rrset = reply_find_rrset_section_an(msg->rep,
3048 ta->name, ta->namelen, LDNS_RR_TYPE_DNSKEY,
3053 if(!autr_process_prime(qstate->env, ve, ta, dnskey_rrset,
3055 /* trust anchor revoked, restart with less anchors */
3056 vq->state = VAL_INIT_STATE;
3057 vq->trust_anchor_name = NULL;
3061 vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, id);
3062 lock_basic_unlock(&ta->lock);
3064 if(key_entry_isbad(vq->key_entry)
3065 && vq->restart_count < VAL_MAX_RESTART_COUNT) {
3066 val_blacklist(&vq->chain_blacklist, qstate->region,
3068 qstate->errinf = NULL;
3069 vq->restart_count++;
3070 vq->key_entry = NULL;
3071 vq->state = VAL_INIT_STATE;
3074 vq->chain_blacklist = NULL;
3075 errinf_origin(qstate, origin);
3076 errinf_dname(qstate, "for trust anchor", ta->name);
3077 /* store the freshly primed entry in the cache */
3078 key_cache_insert(ve->kcache, vq->key_entry, qstate);
3081 /* If the result of the prime is a null key, skip the FINDKEY state.*/
3082 if(!vq->key_entry || key_entry_isnull(vq->key_entry) ||
3083 key_entry_isbad(vq->key_entry)) {
3084 vq->state = VAL_VALIDATE_STATE;
3086 /* the qstate will be reactivated after inform_super is done */
3090 * Process DLV response. Called from inform_supers.
3091 * Because it is in inform_supers, the mesh itself is busy doing callbacks
3092 * for a state that is to be deleted soon; don't touch the mesh; instead
3093 * set a state in the super, as the super will be reactivated soon.
3094 * Perform processing to determine what state to set in the super.
3096 * @param qstate: query state that is validating and asked for a DLV.
3097 * @param vq: validator query state
3098 * @param id: module id.
3099 * @param rcode: rcode result value.
3100 * @param msg: result message (if rcode is OK).
3101 * @param qinfo: from the sub query state, query info.
3104 process_dlv_response(struct module_qstate* qstate, struct val_qstate* vq,
3105 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo)
3107 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
3109 verbose(VERB_ALGO, "process dlv response to super");
3110 if(rcode != LDNS_RCODE_NOERROR) {
3111 /* lookup failed, set in vq to give up */
3112 vq->dlv_status = dlv_error;
3113 verbose(VERB_ALGO, "response is error");
3116 if(msg->rep->security != sec_status_secure) {
3117 vq->dlv_status = dlv_error;
3118 verbose(VERB_ALGO, "response is not secure, %s",
3119 sec_status_to_string(msg->rep->security));
3122 /* was the lookup a success? validated DLV? */
3123 if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NOERROR &&
3124 msg->rep->an_numrrsets == 1 &&
3125 msg->rep->security == sec_status_secure &&
3126 ntohs(msg->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DLV &&
3127 ntohs(msg->rep->rrsets[0]->rk.rrset_class) == qinfo->qclass &&
3128 query_dname_compare(msg->rep->rrsets[0]->rk.dname,
3129 vq->dlv_lookup_name) == 0) {
3130 /* yay! it is just like a DS */
3131 vq->ds_rrset = (struct ub_packed_rrset_key*)
3132 regional_alloc_init(qstate->region,
3133 msg->rep->rrsets[0], sizeof(*vq->ds_rrset));
3135 log_err("out of memory in process_dlv");
3138 vq->ds_rrset->entry.key = vq->ds_rrset;
3139 vq->ds_rrset->rk.dname = (uint8_t*)regional_alloc_init(
3140 qstate->region, vq->ds_rrset->rk.dname,
3141 vq->ds_rrset->rk.dname_len);
3142 if(!vq->ds_rrset->rk.dname) {
3143 log_err("out of memory in process_dlv");
3144 vq->dlv_status = dlv_error;
3147 vq->ds_rrset->entry.data = regional_alloc_init(qstate->region,
3148 vq->ds_rrset->entry.data,
3149 packed_rrset_sizeof(vq->ds_rrset->entry.data));
3150 if(!vq->ds_rrset->entry.data) {
3151 log_err("out of memory in process_dlv");
3152 vq->dlv_status = dlv_error;
3155 packed_rrset_ptr_fixup(vq->ds_rrset->entry.data);
3156 /* make vq do a DNSKEY query next up */
3157 vq->dlv_status = dlv_success;
3160 /* store NSECs into negative cache */
3161 val_neg_addreply(ve->neg_cache, msg->rep);
3163 /* was the lookup a failure?
3164 * if we have to go up into the DLV for a higher DLV anchor
3165 * then set this in the vq, so it can make queries when activated.
3166 * See if the NSECs indicate that we should look for higher DLV
3167 * or, that there is no DLV securely */
3168 if(!val_nsec_check_dlv(qinfo, msg->rep, &vq->dlv_lookup_name,
3169 &vq->dlv_lookup_name_len)) {
3170 vq->dlv_status = dlv_error;
3171 verbose(VERB_ALGO, "nsec error");
3174 if(!dname_subdomain_c(vq->dlv_lookup_name,
3175 qstate->env->anchors->dlv_anchor->name)) {
3176 vq->dlv_status = dlv_there_is_no_dlv;
3179 vq->dlv_status = dlv_ask_higher;
3183 * inform validator super.
3185 * @param qstate: query state that finished.
3186 * @param id: module id.
3187 * @param super: the qstate to inform.
3190 val_inform_super(struct module_qstate* qstate, int id,
3191 struct module_qstate* super)
3193 struct val_qstate* vq = (struct val_qstate*)super->minfo[id];
3194 log_query_info(VERB_ALGO, "validator: inform_super, sub is",
3196 log_query_info(VERB_ALGO, "super is", &super->qinfo);
3198 verbose(VERB_ALGO, "super: has no validator state");
3201 if(vq->wait_prime_ta) {
3202 vq->wait_prime_ta = 0;
3203 process_prime_response(super, vq, id, qstate->return_rcode,
3204 qstate->return_msg, qstate->reply_origin);
3207 if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS) {
3208 process_ds_response(super, vq, id, qstate->return_rcode,
3209 qstate->return_msg, &qstate->qinfo,
3210 qstate->reply_origin);
3212 } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY) {
3213 process_dnskey_response(super, vq, id, qstate->return_rcode,
3214 qstate->return_msg, &qstate->qinfo,
3215 qstate->reply_origin);
3217 } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DLV) {
3218 process_dlv_response(super, vq, id, qstate->return_rcode,
3219 qstate->return_msg, &qstate->qinfo);
3222 log_err("internal error in validator: no inform_supers possible");
3226 val_clear(struct module_qstate* qstate, int id)
3230 /* everything is allocated in the region, so assign NULL */
3231 qstate->minfo[id] = NULL;
3235 val_get_mem(struct module_env* env, int id)
3237 struct val_env* ve = (struct val_env*)env->modinfo[id];
3240 return sizeof(*ve) + key_cache_get_mem(ve->kcache) +
3241 val_neg_get_mem(ve->neg_cache) +
3242 sizeof(size_t)*2*ve->nsec3_keyiter_count;
3246 * The validator function block
3248 static struct module_func_block val_block = {
3250 &val_init, &val_deinit, &val_operate, &val_inform_super, &val_clear,
3254 struct module_func_block*
3255 val_get_funcblock(void)
3261 val_state_to_string(enum val_state state)
3264 case VAL_INIT_STATE: return "VAL_INIT_STATE";
3265 case VAL_FINDKEY_STATE: return "VAL_FINDKEY_STATE";
3266 case VAL_VALIDATE_STATE: return "VAL_VALIDATE_STATE";
3267 case VAL_FINISHED_STATE: return "VAL_FINISHED_STATE";
3268 case VAL_DLVLOOKUP_STATE: return "VAL_DLVLOOKUP_STATE";
3270 return "UNKNOWN VALIDATOR STATE";