2 * validator/validator.c - secure validator DNS query response module
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 * This file contains a module that performs validation of DNS queries.
40 * According to RFC 4034.
44 #include "validator/validator.h"
45 #include "validator/val_anchor.h"
46 #include "validator/val_kcache.h"
47 #include "validator/val_kentry.h"
48 #include "validator/val_utils.h"
49 #include "validator/val_nsec.h"
50 #include "validator/val_nsec3.h"
51 #include "validator/val_neg.h"
52 #include "validator/val_sigcrypt.h"
53 #include "validator/autotrust.h"
54 #include "services/cache/dns.h"
55 #include "services/cache/rrset.h"
56 #include "util/data/dname.h"
57 #include "util/module.h"
59 #include "util/net_help.h"
60 #include "util/regional.h"
61 #include "util/config_file.h"
62 #include "util/fptr_wlist.h"
63 #include "sldns/rrdef.h"
64 #include "sldns/wire2str.h"
65 #include "sldns/str2wire.h"
67 /* forward decl for cache response and normal super inform calls of a DS */
68 static void process_ds_response(struct module_qstate* qstate,
69 struct val_qstate* vq, int id, int rcode, struct dns_msg* msg,
70 struct query_info* qinfo, struct sock_list* origin);
72 /** fill up nsec3 key iterations config entry */
74 fill_nsec3_iter(struct val_env* ve, char* s, int c)
78 free(ve->nsec3_keysize);
79 free(ve->nsec3_maxiter);
80 ve->nsec3_keysize = (size_t*)calloc(sizeof(size_t), (size_t)c);
81 ve->nsec3_maxiter = (size_t*)calloc(sizeof(size_t), (size_t)c);
82 if(!ve->nsec3_keysize || !ve->nsec3_maxiter) {
83 log_err("out of memory");
87 ve->nsec3_keysize[i] = (size_t)strtol(s, &e, 10);
89 log_err("cannot parse: %s", s);
93 ve->nsec3_maxiter[i] = (size_t)strtol(s, &e, 10);
95 log_err("cannot parse: %s", s);
99 if(i>0 && ve->nsec3_keysize[i-1] >= ve->nsec3_keysize[i]) {
100 log_err("nsec3 key iterations not ascending: %d %d",
101 (int)ve->nsec3_keysize[i-1],
102 (int)ve->nsec3_keysize[i]);
105 verbose(VERB_ALGO, "validator nsec3cfg keysz %d mxiter %d",
106 (int)ve->nsec3_keysize[i], (int)ve->nsec3_maxiter[i]);
111 /** apply config settings to validator */
113 val_apply_cfg(struct module_env* env, struct val_env* val_env,
114 struct config_file* cfg)
117 val_env->bogus_ttl = (uint32_t)cfg->bogus_ttl;
119 env->anchors = anchors_create();
121 log_err("out of memory");
125 val_env->kcache = env->key_cache;
127 val_env->kcache = key_cache_create(cfg);
128 if(!val_env->kcache) {
129 log_err("out of memory");
132 env->key_cache = val_env->kcache;
133 if(!anchors_apply_cfg(env->anchors, cfg)) {
134 log_err("validator: error in trustanchors config");
137 val_env->date_override = cfg->val_date_override;
138 val_env->skew_min = cfg->val_sig_skew_min;
139 val_env->skew_max = cfg->val_sig_skew_max;
140 c = cfg_count_numbers(cfg->val_nsec3_key_iterations);
142 log_err("validator: unparseable or odd nsec3 key "
143 "iterations: %s", cfg->val_nsec3_key_iterations);
146 val_env->nsec3_keyiter_count = c/2;
147 if(!fill_nsec3_iter(val_env, cfg->val_nsec3_key_iterations, c/2)) {
148 log_err("validator: cannot apply nsec3 key iterations");
152 val_env->neg_cache = env->neg_cache;
153 if(!val_env->neg_cache)
154 val_env->neg_cache = val_neg_create(cfg,
155 val_env->nsec3_maxiter[val_env->nsec3_keyiter_count-1]);
156 if(!val_env->neg_cache) {
157 log_err("out of memory");
160 env->neg_cache = val_env->neg_cache;
164 #ifdef USE_ECDSA_EVP_WORKAROUND
165 void ecdsa_evp_workaround_init(void);
168 val_init(struct module_env* env, int id)
170 struct val_env* val_env = (struct val_env*)calloc(1,
171 sizeof(struct val_env));
173 log_err("malloc failure");
176 env->modinfo[id] = (void*)val_env;
177 env->need_to_validate = 1;
178 lock_basic_init(&val_env->bogus_lock);
179 lock_protect(&val_env->bogus_lock, &val_env->num_rrset_bogus,
180 sizeof(val_env->num_rrset_bogus));
181 #ifdef USE_ECDSA_EVP_WORKAROUND
182 ecdsa_evp_workaround_init();
184 if(!val_apply_cfg(env, val_env, env->cfg)) {
185 log_err("validator: could not apply configuration settings.");
193 val_deinit(struct module_env* env, int id)
195 struct val_env* val_env;
196 if(!env || !env->modinfo[id])
198 val_env = (struct val_env*)env->modinfo[id];
199 lock_basic_destroy(&val_env->bogus_lock);
200 anchors_delete(env->anchors);
202 key_cache_delete(val_env->kcache);
203 env->key_cache = NULL;
204 neg_cache_delete(val_env->neg_cache);
205 env->neg_cache = NULL;
206 free(val_env->nsec3_keysize);
207 free(val_env->nsec3_maxiter);
209 env->modinfo[id] = NULL;
212 /** fill in message structure */
213 static struct val_qstate*
214 val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq)
216 if(!qstate->return_msg || qstate->return_rcode != LDNS_RCODE_NOERROR) {
217 /* create a message to verify */
218 verbose(VERB_ALGO, "constructing reply for validation");
219 vq->orig_msg = (struct dns_msg*)regional_alloc(qstate->region,
220 sizeof(struct dns_msg));
223 vq->orig_msg->qinfo = qstate->qinfo;
224 vq->orig_msg->rep = (struct reply_info*)regional_alloc(
225 qstate->region, sizeof(struct reply_info));
226 if(!vq->orig_msg->rep)
228 memset(vq->orig_msg->rep, 0, sizeof(struct reply_info));
229 vq->orig_msg->rep->flags = (uint16_t)(qstate->return_rcode&0xf)
230 |BIT_QR|BIT_RA|(qstate->query_flags|(BIT_CD|BIT_RD));
231 vq->orig_msg->rep->qdcount = 1;
233 vq->orig_msg = qstate->return_msg;
235 vq->qchase = qstate->qinfo;
236 /* chase reply will be an edited (sub)set of the orig msg rrset ptrs */
237 vq->chase_reply = regional_alloc_init(qstate->region,
239 sizeof(struct reply_info) - sizeof(struct rrset_ref));
242 if(vq->orig_msg->rep->rrset_count > RR_COUNT_MAX)
243 return NULL; /* protect against integer overflow */
244 vq->chase_reply->rrsets = regional_alloc_init(qstate->region,
245 vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*)
246 * vq->orig_msg->rep->rrset_count);
247 if(!vq->chase_reply->rrsets)
253 /** allocate new validator query state */
254 static struct val_qstate*
255 val_new(struct module_qstate* qstate, int id)
257 struct val_qstate* vq = (struct val_qstate*)regional_alloc(
258 qstate->region, sizeof(*vq));
259 log_assert(!qstate->minfo[id]);
262 memset(vq, 0, sizeof(*vq));
263 qstate->minfo[id] = vq;
264 vq->state = VAL_INIT_STATE;
265 return val_new_getmsg(qstate, vq);
269 * Exit validation with an error status
271 * @param qstate: query state
272 * @param id: validator id.
273 * @return false, for use by caller to return to stop processing.
276 val_error(struct module_qstate* qstate, int id)
278 qstate->ext_state[id] = module_error;
279 qstate->return_rcode = LDNS_RCODE_SERVFAIL;
284 * Check to see if a given response needs to go through the validation
285 * process. Typical reasons for this routine to return false are: CD bit was
286 * on in the original request, or the response is a kind of message that
287 * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.)
289 * @param qstate: query state.
290 * @param ret_rc: rcode for this message (if noerror - examine ret_msg).
291 * @param ret_msg: return msg, can be NULL; look at rcode instead.
292 * @return true if the response could use validation (although this does not
293 * mean we can actually validate this response).
296 needs_validation(struct module_qstate* qstate, int ret_rc,
297 struct dns_msg* ret_msg)
301 /* If the CD bit is on in the original request, then you could think
302 * that we don't bother to validate anything.
303 * But this is signalled internally with the valrec flag.
304 * User queries are validated with BIT_CD to make our cache clean
305 * so that bogus messages get retried by the upstream also for
306 * downstream validators that set BIT_CD.
307 * For DNS64 bit_cd signals no dns64 processing, but we want to
308 * provide validation there too */
310 if(qstate->query_flags & BIT_CD) {
311 verbose(VERB_ALGO, "not validating response due to CD bit");
315 if(qstate->is_valrec) {
316 verbose(VERB_ALGO, "not validating response, is valrec"
317 "(validation recursion lookup)");
321 if(ret_rc != LDNS_RCODE_NOERROR || !ret_msg)
323 else rcode = (int)FLAGS_GET_RCODE(ret_msg->rep->flags);
325 if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) {
326 if(verbosity >= VERB_ALGO) {
329 (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
330 verbose(VERB_ALGO, "cannot validate non-answer, rcode %s", rc);
335 /* cannot validate positive RRSIG response. (negatives can) */
336 if(qstate->qinfo.qtype == LDNS_RR_TYPE_RRSIG &&
337 rcode == LDNS_RCODE_NOERROR && ret_msg &&
338 ret_msg->rep->an_numrrsets > 0) {
339 verbose(VERB_ALGO, "cannot validate RRSIG, no sigs on sigs.");
346 * Check to see if the response has already been validated.
347 * @param ret_msg: return msg, can be NULL
348 * @return true if the response has already been validated
351 already_validated(struct dns_msg* ret_msg)
353 /* validate unchecked, and re-validate bogus messages */
354 if (ret_msg && ret_msg->rep->security > sec_status_bogus)
356 verbose(VERB_ALGO, "response has already been validated: %s",
357 sec_status_to_string(ret_msg->rep->security));
364 * Generate a request for DNS data.
366 * @param qstate: query state that is the parent.
367 * @param id: module id.
368 * @param name: what name to query for.
369 * @param namelen: length of name.
370 * @param qtype: query type.
371 * @param qclass: query class.
372 * @param flags: additional flags, such as the CD bit (BIT_CD), or 0.
373 * @param newq: If the subquery is newly created, it is returned,
374 * otherwise NULL is returned
375 * @param detached: true if this qstate should not attach to the subquery
376 * @return false on alloc failure.
379 generate_request(struct module_qstate* qstate, int id, uint8_t* name,
380 size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags,
381 struct module_qstate** newq, int detached)
383 struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
384 struct query_info ask;
387 ask.qname_len = namelen;
390 ask.local_alias = NULL;
391 log_query_info(VERB_ALGO, "generate request", &ask);
392 /* enable valrec flag to avoid recursion to the same validation
393 * routine, this lookup is simply a lookup. */
396 fptr_ok(fptr_whitelist_modenv_detect_cycle(qstate->env->detect_cycle));
397 if((*qstate->env->detect_cycle)(qstate, &ask,
398 (uint16_t)(BIT_RD|flags), 0, valrec)) {
399 verbose(VERB_ALGO, "Could not generate request: cycle detected");
404 struct mesh_state* sub = NULL;
405 fptr_ok(fptr_whitelist_modenv_add_sub(
406 qstate->env->add_sub));
407 if(!(*qstate->env->add_sub)(qstate, &ask,
408 (uint16_t)(BIT_RD|flags), 0, valrec, newq, &sub)){
409 log_err("Could not generate request: out of memory");
414 fptr_ok(fptr_whitelist_modenv_attach_sub(
415 qstate->env->attach_sub));
416 if(!(*qstate->env->attach_sub)(qstate, &ask,
417 (uint16_t)(BIT_RD|flags), 0, valrec, newq)){
418 log_err("Could not generate request: out of memory");
422 /* newq; validator does not need state created for that
423 * query, and its a 'normal' for iterator as well */
425 /* add our blacklist to the query blacklist */
426 sock_list_merge(&(*newq)->blacklist, (*newq)->region,
427 vq->chain_blacklist);
429 qstate->ext_state[id] = module_wait_subquery;
434 * Generate, send and detach key tag signaling query.
436 * @param qstate: query state.
437 * @param id: module id.
438 * @param ta: trust anchor, locked.
439 * @return false on a processing error.
442 generate_keytag_query(struct module_qstate* qstate, int id,
443 struct trust_anchor* ta)
445 /* 3 bytes for "_ta", 5 bytes per tag (4 bytes + "-") */
446 #define MAX_LABEL_TAGS (LDNS_MAX_LABELLEN-3)/5
448 uint16_t tags[MAX_LABEL_TAGS];
449 char tagstr[LDNS_MAX_LABELLEN+1] = "_ta"; /* +1 for NULL byte */
450 size_t tagstr_left = sizeof(tagstr) - strlen(tagstr);
451 char* tagstr_pos = tagstr + strlen(tagstr);
452 uint8_t dnamebuf[LDNS_MAX_DOMAINLEN+1]; /* +1 for label length byte */
453 size_t dnamebuf_len = sizeof(dnamebuf);
454 uint8_t* keytagdname;
455 struct module_qstate* newq = NULL;
456 enum module_ext_state ext_state = qstate->ext_state[id];
458 numtag = anchor_list_keytags(ta, tags, MAX_LABEL_TAGS);
462 for(i=0; i<numtag; i++) {
463 /* Buffer can't overflow; numtag is limited to tags that fit in
465 snprintf(tagstr_pos, tagstr_left, "-%04x", (unsigned)tags[i]);
466 tagstr_left -= strlen(tagstr_pos);
467 tagstr_pos += strlen(tagstr_pos);
470 sldns_str2wire_dname_buf_origin(tagstr, dnamebuf, &dnamebuf_len,
471 ta->name, ta->namelen);
472 if(!(keytagdname = (uint8_t*)regional_alloc_init(qstate->region,
473 dnamebuf, dnamebuf_len))) {
474 log_err("could not generate key tag query: out of memory");
478 log_nametypeclass(VERB_OPS, "generate keytag query", keytagdname,
479 LDNS_RR_TYPE_NULL, ta->dclass);
480 if(!generate_request(qstate, id, keytagdname, dnamebuf_len,
481 LDNS_RR_TYPE_NULL, ta->dclass, 0, &newq, 1)) {
482 verbose(VERB_ALGO, "failed to generate key tag signaling request");
486 /* Not interrested in subquery response. Restore the ext_state,
487 * that might be changed by generate_request() */
488 qstate->ext_state[id] = ext_state;
494 * Get keytag as uint16_t from string
496 * @param start: start of string containing keytag
497 * @param keytag: pointer where to store the extracted keytag
498 * @return: 1 if keytag was extracted, else 0.
501 sentinel_get_keytag(char* start, uint16_t* keytag) {
504 keytag_str = calloc(1, SENTINEL_KEYTAG_LEN + 1 /* null byte */);
507 memmove(keytag_str, start, SENTINEL_KEYTAG_LEN);
508 keytag_str[SENTINEL_KEYTAG_LEN] = '\0';
509 *keytag = (uint16_t)strtol(keytag_str, &e, 10);
510 if(!e || *e != '\0') {
519 * Prime trust anchor for use.
520 * Generate and dispatch a priming query for the given trust anchor.
521 * The trust anchor can be DNSKEY or DS and does not have to be signed.
523 * @param qstate: query state.
524 * @param vq: validator query state.
525 * @param id: module id.
526 * @param toprime: what to prime.
527 * @return false on a processing error.
530 prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq,
531 int id, struct trust_anchor* toprime)
533 struct module_qstate* newq = NULL;
534 int ret = generate_request(qstate, id, toprime->name, toprime->namelen,
535 LDNS_RR_TYPE_DNSKEY, toprime->dclass, BIT_CD, &newq, 0);
537 if(newq && qstate->env->cfg->trust_anchor_signaling &&
538 !generate_keytag_query(qstate, id, toprime)) {
539 verbose(VERB_ALGO, "keytag signaling query failed");
544 verbose(VERB_ALGO, "Could not prime trust anchor");
547 /* ignore newq; validator does not need state created for that
548 * query, and its a 'normal' for iterator as well */
549 vq->wait_prime_ta = 1; /* to elicit PRIME_RESP_STATE processing
550 from the validator inform_super() routine */
551 /* store trust anchor name for later lookup when prime returns */
552 vq->trust_anchor_name = regional_alloc_init(qstate->region,
553 toprime->name, toprime->namelen);
554 vq->trust_anchor_len = toprime->namelen;
555 vq->trust_anchor_labs = toprime->namelabs;
556 if(!vq->trust_anchor_name) {
557 log_err("Could not prime trust anchor: out of memory");
564 * Validate if the ANSWER and AUTHORITY sections contain valid rrsets.
565 * They must be validly signed with the given key.
566 * Tries to validate ADDITIONAL rrsets as well, but only to check them.
567 * Allows unsigned CNAME after a DNAME that expands the DNAME.
569 * Note that by the time this method is called, the process of finding the
570 * trusted DNSKEY rrset that signs this response must already have been
573 * @param qstate: query state.
574 * @param env: module env for verify.
575 * @param ve: validator env for verify.
576 * @param qchase: query that was made.
577 * @param chase_reply: answer to validate.
578 * @param key_entry: the key entry, which is trusted, and which matches
579 * the signer of the answer. The key entry isgood().
580 * @return false if any of the rrsets in the an or ns sections of the message
581 * fail to verify. The message is then set to bogus.
584 validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
585 struct val_env* ve, struct query_info* qchase,
586 struct reply_info* chase_reply, struct key_entry_key* key_entry)
590 struct ub_packed_rrset_key* s;
595 /* validate the ANSWER section */
596 for(i=0; i<chase_reply->an_numrrsets; i++) {
597 s = chase_reply->rrsets[i];
598 /* Skip the CNAME following a (validated) DNAME.
599 * Because of the normalization routines in the iterator,
600 * there will always be an unsigned CNAME following a DNAME
601 * (unless qtype=DNAME). */
602 if(dname_seen && ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
604 /* CNAME was synthesized by our own iterator */
605 /* since the DNAME verified, mark the CNAME as secure */
606 ((struct packed_rrset_data*)s->entry.data)->security =
608 ((struct packed_rrset_data*)s->entry.data)->trust =
609 rrset_trust_validated;
613 /* Verify the answer rrset */
614 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
615 LDNS_SECTION_ANSWER, qstate);
616 /* If the (answer) rrset failed to validate, then this
618 if(sec != sec_status_secure) {
619 log_nametypeclass(VERB_QUERY, "validator: response "
620 "has failed ANSWER rrset:", s->rk.dname,
621 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
622 errinf(qstate, reason);
623 if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME)
624 errinf(qstate, "for CNAME");
625 else if(ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME)
626 errinf(qstate, "for DNAME");
627 errinf_origin(qstate, qstate->reply_origin);
628 chase_reply->security = sec_status_bogus;
632 /* Notice a DNAME that should be followed by an unsigned
634 if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
635 ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) {
640 /* validate the AUTHORITY section */
641 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
642 chase_reply->ns_numrrsets; i++) {
643 s = chase_reply->rrsets[i];
644 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
645 LDNS_SECTION_AUTHORITY, qstate);
646 /* If anything in the authority section fails to be secure,
647 * we have a bad message. */
648 if(sec != sec_status_secure) {
649 log_nametypeclass(VERB_QUERY, "validator: response "
650 "has failed AUTHORITY rrset:", s->rk.dname,
651 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
652 errinf(qstate, reason);
653 errinf_origin(qstate, qstate->reply_origin);
654 errinf_rrset(qstate, s);
655 chase_reply->security = sec_status_bogus;
660 /* If set, the validator should clean the additional section of
661 * secure messages. */
662 if(!env->cfg->val_clean_additional)
664 /* attempt to validate the ADDITIONAL section rrsets */
665 for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
666 i<chase_reply->rrset_count; i++) {
667 s = chase_reply->rrsets[i];
668 /* only validate rrs that have signatures with the key */
669 /* leave others unchecked, those get removed later on too */
670 val_find_rrset_signer(s, &sname, &slen);
671 if(sname && query_dname_compare(sname, key_entry->name)==0)
672 (void)val_verify_rrset_entry(env, ve, s, key_entry,
673 &reason, LDNS_SECTION_ADDITIONAL, qstate);
674 /* the additional section can fail to be secure,
675 * it is optional, check signature in case we need
676 * to clean the additional section later. */
683 * Detect wrong truncated response (say from BIND 9.6.1 that is forwarding
684 * and saw the NS record without signatures from a referral).
685 * The positive response has a mangled authority section.
686 * Remove that authority section and the additional section.
688 * @return true if a wrongly truncated response.
691 detect_wrongly_truncated(struct reply_info* rep)
694 /* only NS in authority, and it is bogus */
695 if(rep->ns_numrrsets != 1 || rep->an_numrrsets == 0)
697 if(ntohs(rep->rrsets[ rep->an_numrrsets ]->rk.type) != LDNS_RR_TYPE_NS)
699 if(((struct packed_rrset_data*)rep->rrsets[ rep->an_numrrsets ]
700 ->entry.data)->security == sec_status_secure)
702 /* answer section is present and secure */
703 for(i=0; i<rep->an_numrrsets; i++) {
704 if(((struct packed_rrset_data*)rep->rrsets[ i ]
705 ->entry.data)->security != sec_status_secure)
708 verbose(VERB_ALGO, "truncating to minimal response");
713 * For messages that are not referrals, if the chase reply contains an
714 * unsigned NS record in the authority section it could have been
715 * inserted by a (BIND) forwarder that thinks the zone is insecure, and
716 * that has an NS record without signatures in cache. Remove the NS
717 * record since the reply does not hinge on that record (in the authority
718 * section), but do not remove it if it removes the last record from the
719 * answer+authority sections.
720 * @param chase_reply: the chased reply, we have a key for this contents,
721 * so we should have signatures for these rrsets and not having
722 * signatures means it will be bogus.
723 * @param orig_reply: original reply, remove NS from there as well because
724 * we cannot mark the NS record as DNSSEC valid because it is not
725 * validated by signatures.
728 remove_spurious_authority(struct reply_info* chase_reply,
729 struct reply_info* orig_reply)
733 /* if no answer and only 1 auth RRset, do not remove that one */
734 if(chase_reply->an_numrrsets == 0 && chase_reply->ns_numrrsets == 1)
736 /* search authority section for unsigned NS records */
737 for(i = chase_reply->an_numrrsets;
738 i < chase_reply->an_numrrsets+chase_reply->ns_numrrsets; i++) {
739 struct packed_rrset_data* d = (struct packed_rrset_data*)
740 chase_reply->rrsets[i]->entry.data;
741 if(ntohs(chase_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
742 && d->rrsig_count == 0) {
748 /* see if we found the entry */
750 log_rrset_key(VERB_ALGO, "Removing spurious unsigned NS record "
751 "(likely inserted by forwarder)", chase_reply->rrsets[found]);
753 /* find rrset in orig_reply */
754 for(i = orig_reply->an_numrrsets;
755 i < orig_reply->an_numrrsets+orig_reply->ns_numrrsets; i++) {
756 if(ntohs(orig_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
757 && query_dname_compare(orig_reply->rrsets[i]->rk.dname,
758 chase_reply->rrsets[found]->rk.dname) == 0) {
759 /* remove from orig_msg */
760 val_reply_remove_auth(orig_reply, i);
764 /* remove rrset from chase_reply */
765 val_reply_remove_auth(chase_reply, found);
769 * Given a "positive" response -- a response that contains an answer to the
770 * question, and no CNAME chain, validate this response.
772 * The answer and authority RRsets must already be verified as secure.
774 * @param env: module env for verify.
775 * @param ve: validator env for verify.
776 * @param qchase: query that was made.
777 * @param chase_reply: answer to that query to validate.
778 * @param kkey: the key entry, which is trusted, and which matches
779 * the signer of the answer. The key entry isgood().
782 validate_positive_response(struct module_env* env, struct val_env* ve,
783 struct query_info* qchase, struct reply_info* chase_reply,
784 struct key_entry_key* kkey)
792 struct ub_packed_rrset_key* s;
794 /* validate the ANSWER section - this will be the answer itself */
795 for(i=0; i<chase_reply->an_numrrsets; i++) {
796 s = chase_reply->rrsets[i];
798 /* Check to see if the rrset is the result of a wildcard
799 * expansion. If so, an additional check will need to be
800 * made in the authority section. */
801 if(!val_rrset_wildcard(s, &wc, &wl)) {
802 log_nametypeclass(VERB_QUERY, "Positive response has "
803 "inconsistent wildcard sigs:", s->rk.dname,
804 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
805 chase_reply->security = sec_status_bogus;
808 if(wc && !wc_cached && env->cfg->aggressive_nsec) {
809 rrset_cache_update_wildcard(env->rrset_cache, s, wc, wl,
810 env->alloc, *env->now);
816 /* validate the AUTHORITY section as well - this will generally be
817 * the NS rrset (which could be missing, no problem) */
818 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
819 chase_reply->ns_numrrsets; i++) {
820 s = chase_reply->rrsets[i];
822 /* If this is a positive wildcard response, and we have a
823 * (just verified) NSEC record, try to use it to 1) prove
824 * that qname doesn't exist and 2) that the correct wildcard
826 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
827 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
830 /* if not, continue looking for proof */
833 /* Otherwise, if this is a positive wildcard response and
834 * we have NSEC3 records */
835 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
840 /* If this was a positive wildcard response that we haven't already
841 * proven, and we have NSEC3 records, try to prove it using the NSEC3
843 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
844 enum sec_status sec = nsec3_prove_wildcard(env, ve,
845 chase_reply->rrsets+chase_reply->an_numrrsets,
846 chase_reply->ns_numrrsets, qchase, kkey, wc);
847 if(sec == sec_status_insecure) {
848 verbose(VERB_ALGO, "Positive wildcard response is "
850 chase_reply->security = sec_status_insecure;
852 } else if(sec == sec_status_secure)
856 /* If after all this, we still haven't proven the positive wildcard
858 if(wc != NULL && !wc_NSEC_ok) {
859 verbose(VERB_QUERY, "positive response was wildcard "
860 "expansion and did not prove original data "
862 chase_reply->security = sec_status_bogus;
866 verbose(VERB_ALGO, "Successfully validated positive response");
867 chase_reply->security = sec_status_secure;
871 * Validate a NOERROR/NODATA signed response -- a response that has a
872 * NOERROR Rcode but no ANSWER section RRsets. This consists of making
873 * certain that the authority section NSEC/NSEC3s proves that the qname
874 * does exist and the qtype doesn't.
876 * The answer and authority RRsets must already be verified as secure.
878 * @param env: module env for verify.
879 * @param ve: validator env for verify.
880 * @param qchase: query that was made.
881 * @param chase_reply: answer to that query to validate.
882 * @param kkey: the key entry, which is trusted, and which matches
883 * the signer of the answer. The key entry isgood().
886 validate_nodata_response(struct module_env* env, struct val_env* ve,
887 struct query_info* qchase, struct reply_info* chase_reply,
888 struct key_entry_key* kkey)
890 /* Since we are here, there must be nothing in the ANSWER section to
892 /* (Note: CNAME/DNAME responses will not directly get here --
893 * instead, they are chased down into individual CNAME validations,
894 * and at the end of the cname chain a POSITIVE, or CNAME_NOANSWER
897 /* validate the AUTHORITY section */
898 int has_valid_nsec = 0; /* If true, then the NODATA has been proven.*/
899 uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
900 proven closest encloser. */
901 uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
902 int nsec3s_seen = 0; /* nsec3s seen */
903 struct ub_packed_rrset_key* s;
906 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
907 chase_reply->ns_numrrsets; i++) {
908 s = chase_reply->rrsets[i];
909 /* If we encounter an NSEC record, try to use it to prove
911 * This needs to handle the ENT NODATA case. */
912 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
913 if(nsec_proves_nodata(s, qchase, &wc)) {
915 /* sets wc-encloser if wildcard applicable */
917 if(val_nsec_proves_name_error(s, qchase->qname)) {
918 ce = nsec_closest_encloser(qchase->qname, s);
920 if(val_nsec_proves_insecuredelegation(s, qchase)) {
921 verbose(VERB_ALGO, "delegation is insecure");
922 chase_reply->security = sec_status_insecure;
925 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
930 /* check to see if we have a wildcard NODATA proof. */
932 /* The wildcard NODATA is 1 NSEC proving that qname does not exist
933 * (and also proving what the closest encloser is), and 1 NSEC
934 * showing the matching wildcard, which must be *.closest_encloser. */
938 if(query_dname_compare(wc, ce) != 0) {
943 if(!has_valid_nsec && nsec3s_seen) {
944 enum sec_status sec = nsec3_prove_nodata(env, ve,
945 chase_reply->rrsets+chase_reply->an_numrrsets,
946 chase_reply->ns_numrrsets, qchase, kkey);
947 if(sec == sec_status_insecure) {
948 verbose(VERB_ALGO, "NODATA response is insecure");
949 chase_reply->security = sec_status_insecure;
951 } else if(sec == sec_status_secure)
955 if(!has_valid_nsec) {
956 verbose(VERB_QUERY, "NODATA response failed to prove NODATA "
957 "status with NSEC/NSEC3");
958 if(verbosity >= VERB_ALGO)
959 log_dns_msg("Failed NODATA", qchase, chase_reply);
960 chase_reply->security = sec_status_bogus;
964 verbose(VERB_ALGO, "successfully validated NODATA response.");
965 chase_reply->security = sec_status_secure;
969 * Validate a NAMEERROR signed response -- a response that has a NXDOMAIN
971 * This consists of making certain that the authority section NSEC proves
972 * that the qname doesn't exist and the covering wildcard also doesn't exist..
974 * The answer and authority RRsets must have already been verified as secure.
976 * @param env: module env for verify.
977 * @param ve: validator env for verify.
978 * @param qchase: query that was made.
979 * @param chase_reply: answer to that query to validate.
980 * @param kkey: the key entry, which is trusted, and which matches
981 * the signer of the answer. The key entry isgood().
982 * @param rcode: adjusted RCODE, in case of RCODE/proof mismatch leniency.
985 validate_nameerror_response(struct module_env* env, struct val_env* ve,
986 struct query_info* qchase, struct reply_info* chase_reply,
987 struct key_entry_key* kkey, int* rcode)
989 int has_valid_nsec = 0;
990 int has_valid_wnsec = 0;
992 struct ub_packed_rrset_key* s;
996 int prev_ce_labs = 0;
998 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
999 chase_reply->ns_numrrsets; i++) {
1000 s = chase_reply->rrsets[i];
1001 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1002 if(val_nsec_proves_name_error(s, qchase->qname))
1004 ce = nsec_closest_encloser(qchase->qname, s);
1005 ce_labs = dname_count_labels(ce);
1006 /* Use longest closest encloser to prove wildcard. */
1007 if(ce_labs > prev_ce_labs ||
1008 (ce_labs == prev_ce_labs &&
1009 has_valid_wnsec == 0)) {
1010 if(val_nsec_proves_no_wc(s, qchase->qname,
1012 has_valid_wnsec = 1;
1014 has_valid_wnsec = 0;
1016 prev_ce_labs = ce_labs;
1017 if(val_nsec_proves_insecuredelegation(s, qchase)) {
1018 verbose(VERB_ALGO, "delegation is insecure");
1019 chase_reply->security = sec_status_insecure;
1022 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3)
1026 if((!has_valid_nsec || !has_valid_wnsec) && nsec3s_seen) {
1027 /* use NSEC3 proof, both answer and auth rrsets, in case
1028 * NSEC3s end up in the answer (due to qtype=NSEC3 or so) */
1029 chase_reply->security = nsec3_prove_nameerror(env, ve,
1030 chase_reply->rrsets, chase_reply->an_numrrsets+
1031 chase_reply->ns_numrrsets, qchase, kkey);
1032 if(chase_reply->security != sec_status_secure) {
1033 verbose(VERB_QUERY, "NameError response failed nsec, "
1034 "nsec3 proof was %s", sec_status_to_string(
1035 chase_reply->security));
1039 has_valid_wnsec = 1;
1042 /* If the message fails to prove either condition, it is bogus. */
1043 if(!has_valid_nsec) {
1044 verbose(VERB_QUERY, "NameError response has failed to prove: "
1045 "qname does not exist");
1046 chase_reply->security = sec_status_bogus;
1047 /* Be lenient with RCODE in NSEC NameError responses */
1048 validate_nodata_response(env, ve, qchase, chase_reply, kkey);
1049 if (chase_reply->security == sec_status_secure)
1050 *rcode = LDNS_RCODE_NOERROR;
1054 if(!has_valid_wnsec) {
1055 verbose(VERB_QUERY, "NameError response has failed to prove: "
1056 "covering wildcard does not exist");
1057 chase_reply->security = sec_status_bogus;
1058 /* Be lenient with RCODE in NSEC NameError responses */
1059 validate_nodata_response(env, ve, qchase, chase_reply, kkey);
1060 if (chase_reply->security == sec_status_secure)
1061 *rcode = LDNS_RCODE_NOERROR;
1065 /* Otherwise, we consider the message secure. */
1066 verbose(VERB_ALGO, "successfully validated NAME ERROR response.");
1067 chase_reply->security = sec_status_secure;
1071 * Given a referral response, validate rrsets and take least trusted rrset
1072 * as the current validation status.
1074 * Note that by the time this method is called, the process of finding the
1075 * trusted DNSKEY rrset that signs this response must already have been
1078 * @param chase_reply: answer to validate.
1081 validate_referral_response(struct reply_info* chase_reply)
1085 /* message security equals lowest rrset security */
1086 chase_reply->security = sec_status_secure;
1087 for(i=0; i<chase_reply->rrset_count; i++) {
1088 s = ((struct packed_rrset_data*)chase_reply->rrsets[i]
1089 ->entry.data)->security;
1090 if(s < chase_reply->security)
1091 chase_reply->security = s;
1093 verbose(VERB_ALGO, "validated part of referral response as %s",
1094 sec_status_to_string(chase_reply->security));
1098 * Given an "ANY" response -- a response that contains an answer to a
1099 * qtype==ANY question, with answers. This does no checking that all
1100 * types are present.
1102 * NOTE: it may be possible to get parent-side delegation point records
1103 * here, which won't all be signed. Right now, this routine relies on the
1104 * upstream iterative resolver to not return these responses -- instead
1105 * treating them as referrals.
1107 * NOTE: RFC 4035 is silent on this issue, so this may change upon
1108 * clarification. Clarification draft -05 says to not check all types are
1111 * Note that by the time this method is called, the process of finding the
1112 * trusted DNSKEY rrset that signs this response must already have been
1115 * @param env: module env for verify.
1116 * @param ve: validator env for verify.
1117 * @param qchase: query that was made.
1118 * @param chase_reply: answer to that query to validate.
1119 * @param kkey: the key entry, which is trusted, and which matches
1120 * the signer of the answer. The key entry isgood().
1123 validate_any_response(struct module_env* env, struct val_env* ve,
1124 struct query_info* qchase, struct reply_info* chase_reply,
1125 struct key_entry_key* kkey)
1127 /* all answer and auth rrsets already verified */
1128 /* but check if a wildcard response is given, then check NSEC/NSEC3
1129 * for qname denial to see if wildcard is applicable */
1133 int nsec3s_seen = 0;
1135 struct ub_packed_rrset_key* s;
1137 if(qchase->qtype != LDNS_RR_TYPE_ANY) {
1138 log_err("internal error: ANY validation called for non-ANY");
1139 chase_reply->security = sec_status_bogus;
1143 /* validate the ANSWER section - this will be the answer itself */
1144 for(i=0; i<chase_reply->an_numrrsets; i++) {
1145 s = chase_reply->rrsets[i];
1147 /* Check to see if the rrset is the result of a wildcard
1148 * expansion. If so, an additional check will need to be
1149 * made in the authority section. */
1150 if(!val_rrset_wildcard(s, &wc, &wl)) {
1151 log_nametypeclass(VERB_QUERY, "Positive ANY response"
1152 " has inconsistent wildcard sigs:",
1153 s->rk.dname, ntohs(s->rk.type),
1154 ntohs(s->rk.rrset_class));
1155 chase_reply->security = sec_status_bogus;
1160 /* if it was a wildcard, check for NSEC/NSEC3s in both answer
1161 * and authority sections (NSEC may be moved to the ANSWER section) */
1163 for(i=0; i<chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
1165 s = chase_reply->rrsets[i];
1167 /* If this is a positive wildcard response, and we have a
1168 * (just verified) NSEC record, try to use it to 1) prove
1169 * that qname doesn't exist and 2) that the correct wildcard
1171 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1172 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1175 /* if not, continue looking for proof */
1178 /* Otherwise, if this is a positive wildcard response and
1179 * we have NSEC3 records */
1180 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1185 /* If this was a positive wildcard response that we haven't already
1186 * proven, and we have NSEC3 records, try to prove it using the NSEC3
1188 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1189 /* look both in answer and auth section for NSEC3s */
1190 enum sec_status sec = nsec3_prove_wildcard(env, ve,
1191 chase_reply->rrsets,
1192 chase_reply->an_numrrsets+chase_reply->ns_numrrsets,
1194 if(sec == sec_status_insecure) {
1195 verbose(VERB_ALGO, "Positive ANY wildcard response is "
1197 chase_reply->security = sec_status_insecure;
1199 } else if(sec == sec_status_secure)
1203 /* If after all this, we still haven't proven the positive wildcard
1204 * response, fail. */
1205 if(wc != NULL && !wc_NSEC_ok) {
1206 verbose(VERB_QUERY, "positive ANY response was wildcard "
1207 "expansion and did not prove original data "
1209 chase_reply->security = sec_status_bogus;
1213 verbose(VERB_ALGO, "Successfully validated positive ANY response");
1214 chase_reply->security = sec_status_secure;
1218 * Validate CNAME response, or DNAME+CNAME.
1219 * This is just like a positive proof, except that this is about a
1220 * DNAME+CNAME. Possible wildcard proof.
1221 * Difference with positive proof is that this routine refuses
1222 * wildcarded DNAMEs.
1224 * The answer and authority rrsets must already be verified as secure.
1226 * @param env: module env for verify.
1227 * @param ve: validator env for verify.
1228 * @param qchase: query that was made.
1229 * @param chase_reply: answer to that query to validate.
1230 * @param kkey: the key entry, which is trusted, and which matches
1231 * the signer of the answer. The key entry isgood().
1234 validate_cname_response(struct module_env* env, struct val_env* ve,
1235 struct query_info* qchase, struct reply_info* chase_reply,
1236 struct key_entry_key* kkey)
1241 int nsec3s_seen = 0;
1243 struct ub_packed_rrset_key* s;
1245 /* validate the ANSWER section - this will be the CNAME (+DNAME) */
1246 for(i=0; i<chase_reply->an_numrrsets; i++) {
1247 s = chase_reply->rrsets[i];
1249 /* Check to see if the rrset is the result of a wildcard
1250 * expansion. If so, an additional check will need to be
1251 * made in the authority section. */
1252 if(!val_rrset_wildcard(s, &wc, &wl)) {
1253 log_nametypeclass(VERB_QUERY, "Cname response has "
1254 "inconsistent wildcard sigs:", s->rk.dname,
1255 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1256 chase_reply->security = sec_status_bogus;
1260 /* Refuse wildcarded DNAMEs rfc 4597.
1261 * Do not follow a wildcarded DNAME because
1262 * its synthesized CNAME expansion is underdefined */
1263 if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
1264 ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME && wc) {
1265 log_nametypeclass(VERB_QUERY, "cannot validate a "
1266 "wildcarded DNAME:", s->rk.dname,
1267 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1268 chase_reply->security = sec_status_bogus;
1272 /* If we have found a CNAME, stop looking for one.
1273 * The iterator has placed the CNAME chain in correct
1275 if (ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
1280 /* AUTHORITY section */
1281 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1282 chase_reply->ns_numrrsets; i++) {
1283 s = chase_reply->rrsets[i];
1285 /* If this is a positive wildcard response, and we have a
1286 * (just verified) NSEC record, try to use it to 1) prove
1287 * that qname doesn't exist and 2) that the correct wildcard
1289 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1290 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1293 /* if not, continue looking for proof */
1296 /* Otherwise, if this is a positive wildcard response and
1297 * we have NSEC3 records */
1298 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1303 /* If this was a positive wildcard response that we haven't already
1304 * proven, and we have NSEC3 records, try to prove it using the NSEC3
1306 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1307 enum sec_status sec = nsec3_prove_wildcard(env, ve,
1308 chase_reply->rrsets+chase_reply->an_numrrsets,
1309 chase_reply->ns_numrrsets, qchase, kkey, wc);
1310 if(sec == sec_status_insecure) {
1311 verbose(VERB_ALGO, "wildcard CNAME response is "
1313 chase_reply->security = sec_status_insecure;
1315 } else if(sec == sec_status_secure)
1319 /* If after all this, we still haven't proven the positive wildcard
1320 * response, fail. */
1321 if(wc != NULL && !wc_NSEC_ok) {
1322 verbose(VERB_QUERY, "CNAME response was wildcard "
1323 "expansion and did not prove original data "
1325 chase_reply->security = sec_status_bogus;
1329 verbose(VERB_ALGO, "Successfully validated CNAME response");
1330 chase_reply->security = sec_status_secure;
1334 * Validate CNAME NOANSWER response, no more data after a CNAME chain.
1335 * This can be a NODATA or a NAME ERROR case, but not both at the same time.
1336 * We don't know because the rcode has been set to NOERROR by the CNAME.
1338 * The answer and authority rrsets must already be verified as secure.
1340 * @param env: module env for verify.
1341 * @param ve: validator env for verify.
1342 * @param qchase: query that was made.
1343 * @param chase_reply: answer to that query to validate.
1344 * @param kkey: the key entry, which is trusted, and which matches
1345 * the signer of the answer. The key entry isgood().
1348 validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
1349 struct query_info* qchase, struct reply_info* chase_reply,
1350 struct key_entry_key* kkey)
1352 int nodata_valid_nsec = 0; /* If true, then NODATA has been proven.*/
1353 uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
1354 proven closest encloser. */
1355 uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
1356 int nxdomain_valid_nsec = 0; /* if true, nameerror has been proven */
1357 int nxdomain_valid_wnsec = 0;
1358 int nsec3s_seen = 0; /* nsec3s seen */
1359 struct ub_packed_rrset_key* s;
1361 uint8_t* nsec_ce; /* Used to find the NSEC with the longest ce */
1363 int prev_ce_labs = 0;
1365 /* the AUTHORITY section */
1366 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1367 chase_reply->ns_numrrsets; i++) {
1368 s = chase_reply->rrsets[i];
1370 /* If we encounter an NSEC record, try to use it to prove
1371 * NODATA. This needs to handle the ENT NODATA case.
1372 * Also try to prove NAMEERROR, and absence of a wildcard */
1373 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1374 if(nsec_proves_nodata(s, qchase, &wc)) {
1375 nodata_valid_nsec = 1;
1376 /* set wc encloser if wildcard applicable */
1378 if(val_nsec_proves_name_error(s, qchase->qname)) {
1379 ce = nsec_closest_encloser(qchase->qname, s);
1380 nxdomain_valid_nsec = 1;
1382 nsec_ce = nsec_closest_encloser(qchase->qname, s);
1383 ce_labs = dname_count_labels(nsec_ce);
1384 /* Use longest closest encloser to prove wildcard. */
1385 if(ce_labs > prev_ce_labs ||
1386 (ce_labs == prev_ce_labs &&
1387 nxdomain_valid_wnsec == 0)) {
1388 if(val_nsec_proves_no_wc(s, qchase->qname,
1390 nxdomain_valid_wnsec = 1;
1392 nxdomain_valid_wnsec = 0;
1394 prev_ce_labs = ce_labs;
1395 if(val_nsec_proves_insecuredelegation(s, qchase)) {
1396 verbose(VERB_ALGO, "delegation is insecure");
1397 chase_reply->security = sec_status_insecure;
1400 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1405 /* check to see if we have a wildcard NODATA proof. */
1407 /* The wildcard NODATA is 1 NSEC proving that qname does not exists
1408 * (and also proving what the closest encloser is), and 1 NSEC
1409 * showing the matching wildcard, which must be *.closest_encloser. */
1411 nodata_valid_nsec = 0;
1413 if(query_dname_compare(wc, ce) != 0) {
1414 nodata_valid_nsec = 0;
1417 if(nxdomain_valid_nsec && !nxdomain_valid_wnsec) {
1418 /* name error is missing wildcard denial proof */
1419 nxdomain_valid_nsec = 0;
1422 if(nodata_valid_nsec && nxdomain_valid_nsec) {
1423 verbose(VERB_QUERY, "CNAMEchain to noanswer proves that name "
1424 "exists and not exists, bogus");
1425 chase_reply->security = sec_status_bogus;
1428 if(!nodata_valid_nsec && !nxdomain_valid_nsec && nsec3s_seen) {
1430 enum sec_status sec = nsec3_prove_nxornodata(env, ve,
1431 chase_reply->rrsets+chase_reply->an_numrrsets,
1432 chase_reply->ns_numrrsets, qchase, kkey, &nodata);
1433 if(sec == sec_status_insecure) {
1434 verbose(VERB_ALGO, "CNAMEchain to noanswer response "
1436 chase_reply->security = sec_status_insecure;
1438 } else if(sec == sec_status_secure) {
1440 nodata_valid_nsec = 1;
1441 else nxdomain_valid_nsec = 1;
1445 if(!nodata_valid_nsec && !nxdomain_valid_nsec) {
1446 verbose(VERB_QUERY, "CNAMEchain to noanswer response failed "
1447 "to prove status with NSEC/NSEC3");
1448 if(verbosity >= VERB_ALGO)
1449 log_dns_msg("Failed CNAMEnoanswer", qchase, chase_reply);
1450 chase_reply->security = sec_status_bogus;
1454 if(nodata_valid_nsec)
1455 verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1456 "NODATA response.");
1457 else verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1458 "NAMEERROR response.");
1459 chase_reply->security = sec_status_secure;
1463 * Process init state for validator.
1464 * Process the INIT state. First tier responses start in the INIT state.
1465 * This is where they are vetted for validation suitability, and the initial
1466 * key search is done.
1468 * Currently, events the come through this routine will be either promoted
1469 * to FINISHED/CNAME_RESP (no validation needed), FINDKEY (next step to
1470 * validation), or will be (temporarily) retired and a new priming request
1471 * event will be generated.
1473 * @param qstate: query state.
1474 * @param vq: validator query state.
1475 * @param ve: validator shared global environment.
1476 * @param id: module id.
1477 * @return true if the event should be processed further on return, false if
1481 processInit(struct module_qstate* qstate, struct val_qstate* vq,
1482 struct val_env* ve, int id)
1484 uint8_t* lookup_name;
1486 struct trust_anchor* anchor;
1487 enum val_classification subtype = val_classify_response(
1488 qstate->query_flags, &qstate->qinfo, &vq->qchase,
1489 vq->orig_msg->rep, vq->rrset_skip);
1490 if(vq->restart_count > VAL_MAX_RESTART_COUNT) {
1491 verbose(VERB_ALGO, "restart count exceeded");
1492 return val_error(qstate, id);
1494 verbose(VERB_ALGO, "validator classification %s",
1495 val_classification_to_string(subtype));
1496 if(subtype == VAL_CLASS_REFERRAL &&
1497 vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
1498 /* referral uses the rrset name as qchase, to find keys for
1500 vq->qchase.qname = vq->orig_msg->rep->
1501 rrsets[vq->rrset_skip]->rk.dname;
1502 vq->qchase.qname_len = vq->orig_msg->rep->
1503 rrsets[vq->rrset_skip]->rk.dname_len;
1504 vq->qchase.qtype = ntohs(vq->orig_msg->rep->
1505 rrsets[vq->rrset_skip]->rk.type);
1506 vq->qchase.qclass = ntohs(vq->orig_msg->rep->
1507 rrsets[vq->rrset_skip]->rk.rrset_class);
1509 lookup_name = vq->qchase.qname;
1510 lookup_len = vq->qchase.qname_len;
1511 /* for type DS look at the parent side for keys/trustanchor */
1512 /* also for NSEC not at apex */
1513 if(vq->qchase.qtype == LDNS_RR_TYPE_DS ||
1514 (vq->qchase.qtype == LDNS_RR_TYPE_NSEC &&
1515 vq->orig_msg->rep->rrset_count > vq->rrset_skip &&
1516 ntohs(vq->orig_msg->rep->rrsets[vq->rrset_skip]->rk.type) ==
1517 LDNS_RR_TYPE_NSEC &&
1518 !(vq->orig_msg->rep->rrsets[vq->rrset_skip]->
1519 rk.flags&PACKED_RRSET_NSEC_AT_APEX))) {
1520 dname_remove_label(&lookup_name, &lookup_len);
1523 val_mark_indeterminate(vq->chase_reply, qstate->env->anchors,
1524 qstate->env->rrset_cache, qstate->env);
1525 vq->key_entry = NULL;
1526 vq->empty_DS_name = NULL;
1528 anchor = anchors_lookup(qstate->env->anchors,
1529 lookup_name, lookup_len, vq->qchase.qclass);
1531 /* Determine the signer/lookup name */
1532 val_find_signer(subtype, &vq->qchase, vq->orig_msg->rep,
1533 vq->rrset_skip, &vq->signer_name, &vq->signer_len);
1534 if(vq->signer_name != NULL &&
1535 !dname_subdomain_c(lookup_name, vq->signer_name)) {
1536 log_nametypeclass(VERB_ALGO, "this signer name is not a parent "
1537 "of lookupname, omitted", vq->signer_name, 0, 0);
1538 vq->signer_name = NULL;
1540 if(vq->signer_name == NULL) {
1541 log_nametypeclass(VERB_ALGO, "no signer, using", lookup_name,
1544 lookup_name = vq->signer_name;
1545 lookup_len = vq->signer_len;
1546 log_nametypeclass(VERB_ALGO, "signer is", lookup_name, 0, 0);
1549 /* for NXDOMAIN it could be signed by a parent of the trust anchor */
1550 if(subtype == VAL_CLASS_NAMEERROR && vq->signer_name &&
1551 anchor && dname_strict_subdomain_c(anchor->name, lookup_name)){
1552 lock_basic_unlock(&anchor->lock);
1553 anchor = anchors_lookup(qstate->env->anchors,
1554 lookup_name, lookup_len, vq->qchase.qclass);
1555 if(!anchor) { /* unsigned parent denies anchor*/
1556 verbose(VERB_QUERY, "unsigned parent zone denies"
1557 " trust anchor, indeterminate");
1558 vq->chase_reply->security = sec_status_indeterminate;
1559 vq->state = VAL_FINISHED_STATE;
1562 verbose(VERB_ALGO, "trust anchor NXDOMAIN by signed parent");
1563 } else if(subtype == VAL_CLASS_POSITIVE &&
1564 qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY &&
1565 query_dname_compare(lookup_name, qstate->qinfo.qname) == 0) {
1566 /* is a DNSKEY so lookup a bit higher since we want to
1567 * get it from a parent or from trustanchor */
1568 dname_remove_label(&lookup_name, &lookup_len);
1571 if(vq->rrset_skip > 0 || subtype == VAL_CLASS_CNAME ||
1572 subtype == VAL_CLASS_REFERRAL) {
1573 /* extract this part of orig_msg into chase_reply for
1574 * the eventual VALIDATE stage */
1575 val_fill_reply(vq->chase_reply, vq->orig_msg->rep,
1576 vq->rrset_skip, lookup_name, lookup_len,
1578 if(verbosity >= VERB_ALGO)
1579 log_dns_msg("chased extract", &vq->qchase,
1583 vq->key_entry = key_cache_obtain(ve->kcache, lookup_name, lookup_len,
1584 vq->qchase.qclass, qstate->region, *qstate->env->now);
1586 /* there is no key and no trust anchor */
1587 if(vq->key_entry == NULL && anchor == NULL) {
1588 /*response isn't under a trust anchor, so we cannot validate.*/
1589 vq->chase_reply->security = sec_status_indeterminate;
1590 /* go to finished state to cache this result */
1591 vq->state = VAL_FINISHED_STATE;
1594 /* if not key, or if keyentry is *above* the trustanchor, i.e.
1595 * the keyentry is based on another (higher) trustanchor */
1596 else if(vq->key_entry == NULL || (anchor &&
1597 dname_strict_subdomain_c(anchor->name, vq->key_entry->name))) {
1598 /* trust anchor is an 'unsigned' trust anchor */
1599 if(anchor && anchor->numDS == 0 && anchor->numDNSKEY == 0) {
1600 vq->chase_reply->security = sec_status_insecure;
1601 val_mark_insecure(vq->chase_reply, anchor->name,
1602 qstate->env->rrset_cache, qstate->env);
1603 lock_basic_unlock(&anchor->lock);
1604 /* go to finished state to cache this result */
1605 vq->state = VAL_FINISHED_STATE;
1608 /* fire off a trust anchor priming query. */
1609 verbose(VERB_DETAIL, "prime trust anchor");
1610 if(!prime_trust_anchor(qstate, vq, id, anchor)) {
1611 lock_basic_unlock(&anchor->lock);
1612 return val_error(qstate, id);
1614 lock_basic_unlock(&anchor->lock);
1615 /* and otherwise, don't continue processing this event.
1616 * (it will be reactivated when the priming query returns). */
1617 vq->state = VAL_FINDKEY_STATE;
1621 lock_basic_unlock(&anchor->lock);
1624 if(key_entry_isnull(vq->key_entry)) {
1625 /* response is under a null key, so we cannot validate
1626 * However, we do set the status to INSECURE, since it is
1627 * essentially proven insecure. */
1628 vq->chase_reply->security = sec_status_insecure;
1629 val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1630 qstate->env->rrset_cache, qstate->env);
1631 /* go to finished state to cache this result */
1632 vq->state = VAL_FINISHED_STATE;
1634 } else if(key_entry_isbad(vq->key_entry)) {
1635 /* key is bad, chain is bad, reply is bogus */
1636 errinf_dname(qstate, "key for validation", vq->key_entry->name);
1637 errinf(qstate, "is marked as invalid");
1638 if(key_entry_get_reason(vq->key_entry)) {
1639 errinf(qstate, "because of a previous");
1640 errinf(qstate, key_entry_get_reason(vq->key_entry));
1642 /* no retries, stop bothering the authority until timeout */
1643 vq->restart_count = VAL_MAX_RESTART_COUNT;
1644 vq->chase_reply->security = sec_status_bogus;
1645 vq->state = VAL_FINISHED_STATE;
1649 /* otherwise, we have our "closest" cached key -- continue
1650 * processing in the next state. */
1651 vq->state = VAL_FINDKEY_STATE;
1656 * Process the FINDKEY state. Generally this just calculates the next name
1657 * to query and either issues a DS or a DNSKEY query. It will check to see
1658 * if the correct key has already been reached, in which case it will
1659 * advance the event to the next state.
1661 * @param qstate: query state.
1662 * @param vq: validator query state.
1663 * @param id: module id.
1664 * @return true if the event should be processed further on return, false if
1668 processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
1670 uint8_t* target_key_name, *current_key_name;
1671 size_t target_key_len;
1673 struct module_qstate* newq = NULL;
1675 log_query_info(VERB_ALGO, "validator: FindKey", &vq->qchase);
1676 /* We know that state.key_entry is not 0 or bad key -- if it were,
1677 * then previous processing should have directed this event to
1678 * a different state.
1679 * It could be an isnull key, which signals the DNSKEY failed
1680 * with retry and has to be looked up again. */
1681 log_assert(vq->key_entry && !key_entry_isbad(vq->key_entry));
1682 if(key_entry_isnull(vq->key_entry)) {
1683 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1684 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1685 vq->qchase.qclass, BIT_CD, &newq, 0)) {
1686 verbose(VERB_ALGO, "error generating DNSKEY request");
1687 return val_error(qstate, id);
1692 target_key_name = vq->signer_name;
1693 target_key_len = vq->signer_len;
1694 if(!target_key_name) {
1695 target_key_name = vq->qchase.qname;
1696 target_key_len = vq->qchase.qname_len;
1699 current_key_name = vq->key_entry->name;
1701 /* If our current key entry matches our target, then we are done. */
1702 if(query_dname_compare(target_key_name, current_key_name) == 0) {
1703 vq->state = VAL_VALIDATE_STATE;
1707 if(vq->empty_DS_name) {
1708 /* if the last empty nonterminal/emptyDS name we detected is
1709 * below the current key, use that name to make progress
1710 * along the chain of trust */
1711 if(query_dname_compare(target_key_name,
1712 vq->empty_DS_name) == 0) {
1713 /* do not query for empty_DS_name again */
1714 verbose(VERB_ALGO, "Cannot retrieve DS for signature");
1715 errinf(qstate, "no signatures");
1716 errinf_origin(qstate, qstate->reply_origin);
1717 vq->chase_reply->security = sec_status_bogus;
1718 vq->state = VAL_FINISHED_STATE;
1721 current_key_name = vq->empty_DS_name;
1724 log_nametypeclass(VERB_ALGO, "current keyname", current_key_name,
1725 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1726 log_nametypeclass(VERB_ALGO, "target keyname", target_key_name,
1727 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1728 /* assert we are walking down the DNS tree */
1729 if(!dname_subdomain_c(target_key_name, current_key_name)) {
1730 verbose(VERB_ALGO, "bad signer name");
1731 vq->chase_reply->security = sec_status_bogus;
1732 vq->state = VAL_FINISHED_STATE;
1735 /* so this value is >= -1 */
1736 strip_lab = dname_count_labels(target_key_name) -
1737 dname_count_labels(current_key_name) - 1;
1738 log_assert(strip_lab >= -1);
1739 verbose(VERB_ALGO, "striplab %d", strip_lab);
1741 dname_remove_labels(&target_key_name, &target_key_len,
1744 log_nametypeclass(VERB_ALGO, "next keyname", target_key_name,
1745 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1747 /* The next step is either to query for the next DS, or to query
1748 * for the next DNSKEY. */
1750 log_nametypeclass(VERB_ALGO, "DS RRset", vq->ds_rrset->rk.dname, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN);
1751 else verbose(VERB_ALGO, "No DS RRset");
1753 if(vq->ds_rrset && query_dname_compare(vq->ds_rrset->rk.dname,
1754 vq->key_entry->name) != 0) {
1755 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1756 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1757 vq->qchase.qclass, BIT_CD, &newq, 0)) {
1758 verbose(VERB_ALGO, "error generating DNSKEY request");
1759 return val_error(qstate, id);
1764 if(!vq->ds_rrset || query_dname_compare(vq->ds_rrset->rk.dname,
1765 target_key_name) != 0) {
1766 /* check if there is a cache entry : pick up an NSEC if
1767 * there is no DS, check if that NSEC has DS-bit unset, and
1768 * thus can disprove the secure delegation we seek.
1769 * We can then use that NSEC even in the absence of a SOA
1770 * record that would be required by the iterator to supply
1771 * a completely protocol-correct response.
1772 * Uses negative cache for NSEC3 lookup of DS responses. */
1773 /* only if cache not blacklisted, of course */
1774 struct dns_msg* msg;
1775 if(!qstate->blacklist && !vq->chain_blacklist &&
1776 (msg=val_find_DS(qstate->env, target_key_name,
1777 target_key_len, vq->qchase.qclass, qstate->region,
1778 vq->key_entry->name)) ) {
1779 verbose(VERB_ALGO, "Process cached DS response");
1780 process_ds_response(qstate, vq, id, LDNS_RCODE_NOERROR,
1781 msg, &msg->qinfo, NULL);
1782 return 1; /* continue processing ds-response results */
1784 if(!generate_request(qstate, id, target_key_name,
1785 target_key_len, LDNS_RR_TYPE_DS, vq->qchase.qclass,
1786 BIT_CD, &newq, 0)) {
1787 verbose(VERB_ALGO, "error generating DS request");
1788 return val_error(qstate, id);
1793 /* Otherwise, it is time to query for the DNSKEY */
1794 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1795 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1796 vq->qchase.qclass, BIT_CD, &newq, 0)) {
1797 verbose(VERB_ALGO, "error generating DNSKEY request");
1798 return val_error(qstate, id);
1805 * Process the VALIDATE stage, the init and findkey stages are finished,
1806 * and the right keys are available to validate the response.
1807 * Or, there are no keys available, in order to invalidate the response.
1809 * After validation, the status is recorded in the message and rrsets,
1810 * and finished state is started.
1812 * @param qstate: query state.
1813 * @param vq: validator query state.
1814 * @param ve: validator shared global environment.
1815 * @param id: module id.
1816 * @return true if the event should be processed further on return, false if
1820 processValidate(struct module_qstate* qstate, struct val_qstate* vq,
1821 struct val_env* ve, int id)
1823 enum val_classification subtype;
1826 if(!vq->key_entry) {
1827 verbose(VERB_ALGO, "validate: no key entry, failed");
1828 return val_error(qstate, id);
1831 /* This is the default next state. */
1832 vq->state = VAL_FINISHED_STATE;
1834 /* Unsigned responses must be underneath a "null" key entry.*/
1835 if(key_entry_isnull(vq->key_entry)) {
1836 verbose(VERB_DETAIL, "Verified that %sresponse is INSECURE",
1837 vq->signer_name?"":"unsigned ");
1838 vq->chase_reply->security = sec_status_insecure;
1839 val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1840 qstate->env->rrset_cache, qstate->env);
1841 key_cache_insert(ve->kcache, vq->key_entry, qstate);
1845 if(key_entry_isbad(vq->key_entry)) {
1846 log_nametypeclass(VERB_DETAIL, "Could not establish a chain "
1847 "of trust to keys for", vq->key_entry->name,
1848 LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class);
1849 vq->chase_reply->security = sec_status_bogus;
1850 errinf(qstate, "while building chain of trust");
1851 if(vq->restart_count >= VAL_MAX_RESTART_COUNT)
1852 key_cache_insert(ve->kcache, vq->key_entry, qstate);
1856 /* signerName being null is the indicator that this response was
1858 if(vq->signer_name == NULL) {
1859 log_query_info(VERB_ALGO, "processValidate: state has no "
1860 "signer name", &vq->qchase);
1861 verbose(VERB_DETAIL, "Could not establish validation of "
1862 "INSECURE status of unsigned response.");
1863 errinf(qstate, "no signatures");
1864 errinf_origin(qstate, qstate->reply_origin);
1865 vq->chase_reply->security = sec_status_bogus;
1868 subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
1869 &vq->qchase, vq->orig_msg->rep, vq->rrset_skip);
1870 if(subtype != VAL_CLASS_REFERRAL)
1871 remove_spurious_authority(vq->chase_reply, vq->orig_msg->rep);
1873 /* check signatures in the message;
1874 * answer and authority must be valid, additional is only checked. */
1875 if(!validate_msg_signatures(qstate, qstate->env, ve, &vq->qchase,
1876 vq->chase_reply, vq->key_entry)) {
1877 /* workaround bad recursor out there that truncates (even
1878 * with EDNS4k) to 512 by removing RRSIG from auth section
1879 * for positive replies*/
1880 if((subtype == VAL_CLASS_POSITIVE || subtype == VAL_CLASS_ANY
1881 || subtype == VAL_CLASS_CNAME) &&
1882 detect_wrongly_truncated(vq->orig_msg->rep)) {
1883 /* truncate the message some more */
1884 vq->orig_msg->rep->ns_numrrsets = 0;
1885 vq->orig_msg->rep->ar_numrrsets = 0;
1886 vq->orig_msg->rep->rrset_count =
1887 vq->orig_msg->rep->an_numrrsets;
1888 vq->chase_reply->ns_numrrsets = 0;
1889 vq->chase_reply->ar_numrrsets = 0;
1890 vq->chase_reply->rrset_count =
1891 vq->chase_reply->an_numrrsets;
1892 qstate->errinf = NULL;
1895 verbose(VERB_DETAIL, "Validate: message contains "
1902 case VAL_CLASS_POSITIVE:
1903 verbose(VERB_ALGO, "Validating a positive response");
1904 validate_positive_response(qstate->env, ve,
1905 &vq->qchase, vq->chase_reply, vq->key_entry);
1906 verbose(VERB_DETAIL, "validate(positive): %s",
1907 sec_status_to_string(
1908 vq->chase_reply->security));
1911 case VAL_CLASS_NODATA:
1912 verbose(VERB_ALGO, "Validating a nodata response");
1913 validate_nodata_response(qstate->env, ve,
1914 &vq->qchase, vq->chase_reply, vq->key_entry);
1915 verbose(VERB_DETAIL, "validate(nodata): %s",
1916 sec_status_to_string(
1917 vq->chase_reply->security));
1920 case VAL_CLASS_NAMEERROR:
1921 rcode = (int)FLAGS_GET_RCODE(vq->orig_msg->rep->flags);
1922 verbose(VERB_ALGO, "Validating a nxdomain response");
1923 validate_nameerror_response(qstate->env, ve,
1924 &vq->qchase, vq->chase_reply, vq->key_entry, &rcode);
1925 verbose(VERB_DETAIL, "validate(nxdomain): %s",
1926 sec_status_to_string(
1927 vq->chase_reply->security));
1928 FLAGS_SET_RCODE(vq->orig_msg->rep->flags, rcode);
1929 FLAGS_SET_RCODE(vq->chase_reply->flags, rcode);
1932 case VAL_CLASS_CNAME:
1933 verbose(VERB_ALGO, "Validating a cname response");
1934 validate_cname_response(qstate->env, ve,
1935 &vq->qchase, vq->chase_reply, vq->key_entry);
1936 verbose(VERB_DETAIL, "validate(cname): %s",
1937 sec_status_to_string(
1938 vq->chase_reply->security));
1941 case VAL_CLASS_CNAMENOANSWER:
1942 verbose(VERB_ALGO, "Validating a cname noanswer "
1944 validate_cname_noanswer_response(qstate->env, ve,
1945 &vq->qchase, vq->chase_reply, vq->key_entry);
1946 verbose(VERB_DETAIL, "validate(cname_noanswer): %s",
1947 sec_status_to_string(
1948 vq->chase_reply->security));
1951 case VAL_CLASS_REFERRAL:
1952 verbose(VERB_ALGO, "Validating a referral response");
1953 validate_referral_response(vq->chase_reply);
1954 verbose(VERB_DETAIL, "validate(referral): %s",
1955 sec_status_to_string(
1956 vq->chase_reply->security));
1960 verbose(VERB_ALGO, "Validating a positive ANY "
1962 validate_any_response(qstate->env, ve, &vq->qchase,
1963 vq->chase_reply, vq->key_entry);
1964 verbose(VERB_DETAIL, "validate(positive_any): %s",
1965 sec_status_to_string(
1966 vq->chase_reply->security));
1970 log_err("validate: unhandled response subtype: %d",
1973 if(vq->chase_reply->security == sec_status_bogus) {
1974 if(subtype == VAL_CLASS_POSITIVE)
1975 errinf(qstate, "wildcard");
1976 else errinf(qstate, val_classification_to_string(subtype));
1977 errinf(qstate, "proof failed");
1978 errinf_origin(qstate, qstate->reply_origin);
1985 * The Finished state. The validation status (good or bad) has been determined.
1987 * @param qstate: query state.
1988 * @param vq: validator query state.
1989 * @param ve: validator shared global environment.
1990 * @param id: module id.
1991 * @return true if the event should be processed further on return, false if
1995 processFinished(struct module_qstate* qstate, struct val_qstate* vq,
1996 struct val_env* ve, int id)
1998 enum val_classification subtype = val_classify_response(
1999 qstate->query_flags, &qstate->qinfo, &vq->qchase,
2000 vq->orig_msg->rep, vq->rrset_skip);
2002 /* store overall validation result in orig_msg */
2003 if(vq->rrset_skip == 0)
2004 vq->orig_msg->rep->security = vq->chase_reply->security;
2005 else if(subtype != VAL_CLASS_REFERRAL ||
2006 vq->rrset_skip < vq->orig_msg->rep->an_numrrsets +
2007 vq->orig_msg->rep->ns_numrrsets) {
2008 /* ignore sec status of additional section if a referral
2009 * type message skips there and
2010 * use the lowest security status as end result. */
2011 if(vq->chase_reply->security < vq->orig_msg->rep->security)
2012 vq->orig_msg->rep->security =
2013 vq->chase_reply->security;
2016 if(subtype == VAL_CLASS_REFERRAL) {
2017 /* for a referral, move to next unchecked rrset and check it*/
2018 vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep,
2020 if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
2021 /* and restart for this rrset */
2022 verbose(VERB_ALGO, "validator: go to next rrset");
2023 vq->chase_reply->security = sec_status_unchecked;
2024 vq->state = VAL_INIT_STATE;
2027 /* referral chase is done */
2029 if(vq->chase_reply->security != sec_status_bogus &&
2030 subtype == VAL_CLASS_CNAME) {
2031 /* chase the CNAME; process next part of the message */
2032 if(!val_chase_cname(&vq->qchase, vq->orig_msg->rep,
2034 verbose(VERB_ALGO, "validator: failed to chase CNAME");
2035 vq->orig_msg->rep->security = sec_status_bogus;
2037 /* restart process for new qchase at rrset_skip */
2038 log_query_info(VERB_ALGO, "validator: chased to",
2040 vq->chase_reply->security = sec_status_unchecked;
2041 vq->state = VAL_INIT_STATE;
2046 if(vq->orig_msg->rep->security == sec_status_secure) {
2047 /* If the message is secure, check that all rrsets are
2048 * secure (i.e. some inserted RRset for CNAME chain with
2049 * a different signer name). And drop additional rrsets
2050 * that are not secure (if clean-additional option is set) */
2051 /* this may cause the msg to be marked bogus */
2052 val_check_nonsecure(qstate->env, vq->orig_msg->rep);
2053 if(vq->orig_msg->rep->security == sec_status_secure) {
2054 log_query_info(VERB_DETAIL, "validation success",
2056 if(!qstate->no_cache_store) {
2057 val_neg_addreply(qstate->env->neg_cache,
2063 /* if the result is bogus - set message ttl to bogus ttl to avoid
2064 * endless bogus revalidation */
2065 if(vq->orig_msg->rep->security == sec_status_bogus) {
2066 /* see if we can try again to fetch data */
2067 if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2068 int restart_count = vq->restart_count+1;
2069 verbose(VERB_ALGO, "validation failed, "
2070 "blacklist and retry to fetch data");
2071 val_blacklist(&qstate->blacklist, qstate->region,
2072 qstate->reply_origin, 0);
2073 qstate->reply_origin = NULL;
2074 qstate->errinf = NULL;
2075 memset(vq, 0, sizeof(*vq));
2076 vq->restart_count = restart_count;
2077 vq->state = VAL_INIT_STATE;
2078 verbose(VERB_ALGO, "pass back to next module");
2079 qstate->ext_state[id] = module_restart_next;
2083 vq->orig_msg->rep->ttl = ve->bogus_ttl;
2084 vq->orig_msg->rep->prefetch_ttl =
2085 PREFETCH_TTL_CALC(vq->orig_msg->rep->ttl);
2086 vq->orig_msg->rep->serve_expired_ttl =
2087 vq->orig_msg->rep->ttl + qstate->env->cfg->serve_expired_ttl;
2088 if((qstate->env->cfg->val_log_level >= 1 ||
2089 qstate->env->cfg->log_servfail) &&
2090 !qstate->env->cfg->val_log_squelch) {
2091 if(qstate->env->cfg->val_log_level < 2 &&
2092 !qstate->env->cfg->log_servfail)
2093 log_query_info(NO_VERBOSE, "validation failure",
2096 char* err = errinf_to_str_bogus(qstate);
2097 if(err) log_info("%s", err);
2102 * If set, the validator will not make messages bogus, instead
2103 * indeterminate is issued, so that no clients receive SERVFAIL.
2104 * This allows an operator to run validation 'shadow' without
2105 * hurting responses to clients.
2107 /* If we are in permissive mode, bogus gets indeterminate */
2108 if(qstate->env->cfg->val_permissive_mode)
2109 vq->orig_msg->rep->security = sec_status_indeterminate;
2112 if(vq->orig_msg->rep->security == sec_status_secure &&
2113 qstate->env->cfg->root_key_sentinel &&
2114 (qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
2115 qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)) {
2118 if(*qstate->qinfo.qname == strlen(SENTINEL_IS) +
2119 SENTINEL_KEYTAG_LEN &&
2120 dname_lab_startswith(qstate->qinfo.qname, SENTINEL_IS,
2122 if(sentinel_get_keytag(keytag_start, &keytag) &&
2123 !anchor_has_keytag(qstate->env->anchors,
2124 (uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) {
2125 vq->orig_msg->rep->security =
2126 sec_status_secure_sentinel_fail;
2128 } else if(*qstate->qinfo.qname == strlen(SENTINEL_NOT) +
2129 SENTINEL_KEYTAG_LEN &&
2130 dname_lab_startswith(qstate->qinfo.qname, SENTINEL_NOT,
2132 if(sentinel_get_keytag(keytag_start, &keytag) &&
2133 anchor_has_keytag(qstate->env->anchors,
2134 (uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) {
2135 vq->orig_msg->rep->security =
2136 sec_status_secure_sentinel_fail;
2140 /* store results in cache */
2141 if(qstate->query_flags&BIT_RD) {
2142 /* if secure, this will override cache anyway, no need
2143 * to check if from parentNS */
2144 if(!qstate->no_cache_store) {
2145 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2146 vq->orig_msg->rep, 0, qstate->prefetch_leeway, 0, NULL,
2147 qstate->query_flags)) {
2148 log_err("out of memory caching validator results");
2152 /* for a referral, store the verified RRsets */
2153 /* and this does not get prefetched, so no leeway */
2154 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2155 vq->orig_msg->rep, 1, 0, 0, NULL,
2156 qstate->query_flags)) {
2157 log_err("out of memory caching validator results");
2160 qstate->return_rcode = LDNS_RCODE_NOERROR;
2161 qstate->return_msg = vq->orig_msg;
2162 qstate->ext_state[id] = module_finished;
2167 * Handle validator state.
2168 * If a method returns true, the next state is started. If false, then
2169 * processing will stop.
2170 * @param qstate: query state.
2171 * @param vq: validator query state.
2172 * @param ve: validator shared global environment.
2173 * @param id: module id.
2176 val_handle(struct module_qstate* qstate, struct val_qstate* vq,
2177 struct val_env* ve, int id)
2181 verbose(VERB_ALGO, "val handle processing q with state %s",
2182 val_state_to_string(vq->state));
2184 case VAL_INIT_STATE:
2185 cont = processInit(qstate, vq, ve, id);
2187 case VAL_FINDKEY_STATE:
2188 cont = processFindKey(qstate, vq, id);
2190 case VAL_VALIDATE_STATE:
2191 cont = processValidate(qstate, vq, ve, id);
2193 case VAL_FINISHED_STATE:
2194 cont = processFinished(qstate, vq, ve, id);
2197 log_warn("validator: invalid state %d",
2206 val_operate(struct module_qstate* qstate, enum module_ev event, int id,
2207 struct outbound_entry* outbound)
2209 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2210 struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
2211 verbose(VERB_QUERY, "validator[module %d] operate: extstate:%s "
2212 "event:%s", id, strextstate(qstate->ext_state[id]),
2213 strmodulevent(event));
2214 log_query_info(VERB_QUERY, "validator operate: query",
2216 if(vq && qstate->qinfo.qname != vq->qchase.qname)
2217 log_query_info(VERB_QUERY, "validator operate: chased to",
2220 if(event == module_event_new ||
2221 (event == module_event_pass && vq == NULL)) {
2223 /* pass request to next module, to get it */
2224 verbose(VERB_ALGO, "validator: pass to next module");
2225 qstate->ext_state[id] = module_wait_module;
2228 if(event == module_event_moddone) {
2229 /* check if validation is needed */
2230 verbose(VERB_ALGO, "validator: nextmodule returned");
2232 if(!needs_validation(qstate, qstate->return_rcode,
2233 qstate->return_msg)) {
2234 /* no need to validate this */
2235 if(qstate->return_msg)
2236 qstate->return_msg->rep->security =
2237 sec_status_indeterminate;
2238 qstate->ext_state[id] = module_finished;
2241 if(already_validated(qstate->return_msg)) {
2242 qstate->ext_state[id] = module_finished;
2245 /* qclass ANY should have validation result from spawned
2246 * queries. If we get here, it is bogus or an internal error */
2247 if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) {
2248 verbose(VERB_ALGO, "cannot validate classANY: bogus");
2249 if(qstate->return_msg)
2250 qstate->return_msg->rep->security =
2252 qstate->ext_state[id] = module_finished;
2255 /* create state to start validation */
2256 qstate->ext_state[id] = module_error; /* override this */
2258 vq = val_new(qstate, id);
2260 log_err("validator: malloc failure");
2261 qstate->ext_state[id] = module_error;
2264 } else if(!vq->orig_msg) {
2265 if(!val_new_getmsg(qstate, vq)) {
2266 log_err("validator: malloc failure");
2267 qstate->ext_state[id] = module_error;
2271 val_handle(qstate, vq, ve, id);
2274 if(event == module_event_pass) {
2275 qstate->ext_state[id] = module_error; /* override this */
2276 /* continue processing, since val_env exists */
2277 val_handle(qstate, vq, ve, id);
2280 log_err("validator: bad event %s", strmodulevent(event));
2281 qstate->ext_state[id] = module_error;
2286 * Evaluate the response to a priming request.
2288 * @param dnskey_rrset: DNSKEY rrset (can be NULL if none) in prime reply.
2289 * (this rrset is allocated in the wrong region, not the qstate).
2290 * @param ta: trust anchor.
2291 * @param qstate: qstate that needs key.
2292 * @param id: module id.
2293 * @return new key entry or NULL on allocation failure.
2294 * The key entry will either contain a validated DNSKEY rrset, or
2295 * represent a Null key (query failed, but validation did not), or a
2296 * Bad key (validation failed).
2298 static struct key_entry_key*
2299 primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
2300 struct trust_anchor* ta, struct module_qstate* qstate, int id)
2302 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2303 struct key_entry_key* kkey = NULL;
2304 enum sec_status sec = sec_status_unchecked;
2305 char* reason = NULL;
2306 int downprot = qstate->env->cfg->harden_algo_downgrade;
2309 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2310 "could not fetch DNSKEY rrset",
2311 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2312 if(qstate->env->cfg->harden_dnssec_stripped) {
2313 errinf(qstate, "no DNSKEY rrset");
2314 kkey = key_entry_create_bad(qstate->region, ta->name,
2315 ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2317 } else kkey = key_entry_create_null(qstate->region, ta->name,
2318 ta->namelen, ta->dclass, NULL_KEY_TTL,
2321 log_err("out of memory: allocate fail prime key");
2326 /* attempt to verify with trust anchor DS and DNSKEY */
2327 kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve,
2328 dnskey_rrset, ta->ds_rrset, ta->dnskey_rrset, downprot,
2331 log_err("out of memory: verifying prime TA");
2334 if(key_entry_isgood(kkey))
2335 sec = sec_status_secure;
2337 sec = sec_status_bogus;
2338 verbose(VERB_DETAIL, "validate keys with anchor(DS): %s",
2339 sec_status_to_string(sec));
2341 if(sec != sec_status_secure) {
2342 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2343 "DNSKEY rrset is not secure",
2344 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2345 /* NOTE: in this case, we should probably reject the trust
2346 * anchor for longer, perhaps forever. */
2347 if(qstate->env->cfg->harden_dnssec_stripped) {
2348 errinf(qstate, reason);
2349 kkey = key_entry_create_bad(qstate->region, ta->name,
2350 ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2352 } else kkey = key_entry_create_null(qstate->region, ta->name,
2353 ta->namelen, ta->dclass, NULL_KEY_TTL,
2356 log_err("out of memory: allocate null prime key");
2362 log_nametypeclass(VERB_DETAIL, "Successfully primed trust anchor",
2363 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2368 * In inform supers, with the resulting message and rcode and the current
2369 * keyset in the super state, validate the DS response, returning a KeyEntry.
2371 * @param qstate: query state that is validating and asked for a DS.
2372 * @param vq: validator query state
2373 * @param id: module id.
2374 * @param rcode: rcode result value.
2375 * @param msg: result message (if rcode is OK).
2376 * @param qinfo: from the sub query state, query info.
2377 * @param ke: the key entry to return. It returns
2378 * is_bad if the DS response fails to validate, is_null if the
2379 * DS response indicated an end to secure space, is_good if the DS
2380 * validated. It returns ke=NULL if the DS response indicated that the
2381 * request wasn't a delegation point.
2382 * @return 0 on servfail error (malloc failure).
2385 ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
2386 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2387 struct key_entry_key** ke)
2389 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2390 char* reason = NULL;
2391 enum val_classification subtype;
2392 if(rcode != LDNS_RCODE_NOERROR) {
2395 (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
2396 /* errors here pretty much break validation */
2397 verbose(VERB_DETAIL, "DS response was error, thus bogus");
2399 errinf(qstate, "no DS");
2403 subtype = val_classify_response(BIT_RD, qinfo, qinfo, msg->rep, 0);
2404 if(subtype == VAL_CLASS_POSITIVE) {
2405 struct ub_packed_rrset_key* ds;
2406 enum sec_status sec;
2407 ds = reply_find_answer_rrset(qinfo, msg->rep);
2408 /* If there was no DS rrset, then we have mis-classified
2411 log_warn("internal error: POSITIVE DS response was "
2413 errinf(qstate, "no DS record");
2416 /* Verify only returns BOGUS or SECURE. If the rrset is
2417 * bogus, then we are done. */
2418 sec = val_verify_rrset_entry(qstate->env, ve, ds,
2419 vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate);
2420 if(sec != sec_status_secure) {
2421 verbose(VERB_DETAIL, "DS rrset in DS response did "
2423 errinf(qstate, reason);
2427 /* If the DS rrset validates, we still have to make sure
2428 * that they are usable. */
2429 if(!val_dsset_isusable(ds)) {
2430 /* If they aren't usable, then we treat it like
2431 * there was no DS. */
2432 *ke = key_entry_create_null(qstate->region,
2433 qinfo->qname, qinfo->qname_len, qinfo->qclass,
2434 ub_packed_rrset_ttl(ds), *qstate->env->now);
2435 return (*ke) != NULL;
2438 /* Otherwise, we return the positive response. */
2439 log_query_info(VERB_DETAIL, "validated DS", qinfo);
2440 *ke = key_entry_create_rrset(qstate->region,
2441 qinfo->qname, qinfo->qname_len, qinfo->qclass, ds,
2442 NULL, *qstate->env->now);
2443 return (*ke) != NULL;
2444 } else if(subtype == VAL_CLASS_NODATA ||
2445 subtype == VAL_CLASS_NAMEERROR) {
2446 /* NODATA means that the qname exists, but that there was
2447 * no DS. This is a pretty normal case. */
2448 time_t proof_ttl = 0;
2449 enum sec_status sec;
2451 /* make sure there are NSECs or NSEC3s with signatures */
2452 if(!val_has_signed_nsecs(msg->rep, &reason)) {
2453 verbose(VERB_ALGO, "no NSECs: %s", reason);
2454 errinf(qstate, reason);
2458 /* For subtype Name Error.
2459 * attempt ANS 2.8.1.0 compatibility where it sets rcode
2460 * to nxdomain, but really this is an Nodata/Noerror response.
2461 * Find and prove the empty nonterminal in that case */
2463 /* Try to prove absence of the DS with NSEC */
2464 sec = val_nsec_prove_nodata_dsreply(
2465 qstate->env, ve, qinfo, msg->rep, vq->key_entry,
2466 &proof_ttl, &reason, qstate);
2468 case sec_status_secure:
2469 verbose(VERB_DETAIL, "NSEC RRset for the "
2470 "referral proved no DS.");
2471 *ke = key_entry_create_null(qstate->region,
2472 qinfo->qname, qinfo->qname_len,
2473 qinfo->qclass, proof_ttl,
2475 return (*ke) != NULL;
2476 case sec_status_insecure:
2477 verbose(VERB_DETAIL, "NSEC RRset for the "
2478 "referral proved not a delegation point");
2481 case sec_status_bogus:
2482 verbose(VERB_DETAIL, "NSEC RRset for the "
2483 "referral did not prove no DS.");
2484 errinf(qstate, reason);
2486 case sec_status_unchecked:
2488 /* NSEC proof did not work, try next */
2492 sec = nsec3_prove_nods(qstate->env, ve,
2493 msg->rep->rrsets + msg->rep->an_numrrsets,
2494 msg->rep->ns_numrrsets, qinfo, vq->key_entry, &reason,
2497 case sec_status_insecure:
2498 /* case insecure also continues to unsigned
2499 * space. If nsec3-iter-count too high or
2500 * optout, then treat below as unsigned */
2501 case sec_status_secure:
2502 verbose(VERB_DETAIL, "NSEC3s for the "
2503 "referral proved no DS.");
2504 *ke = key_entry_create_null(qstate->region,
2505 qinfo->qname, qinfo->qname_len,
2506 qinfo->qclass, proof_ttl,
2508 return (*ke) != NULL;
2509 case sec_status_indeterminate:
2510 verbose(VERB_DETAIL, "NSEC3s for the "
2511 "referral proved no delegation");
2514 case sec_status_bogus:
2515 verbose(VERB_DETAIL, "NSEC3s for the "
2516 "referral did not prove no DS.");
2517 errinf(qstate, reason);
2519 case sec_status_unchecked:
2521 /* NSEC3 proof did not work */
2525 /* Apparently, no available NSEC/NSEC3 proved NODATA, so
2527 verbose(VERB_DETAIL, "DS %s ran out of options, so return "
2528 "bogus", val_classification_to_string(subtype));
2529 errinf(qstate, "no DS but also no proof of that");
2531 } else if(subtype == VAL_CLASS_CNAME ||
2532 subtype == VAL_CLASS_CNAMENOANSWER) {
2533 /* if the CNAME matches the exact name we want and is signed
2534 * properly, then also, we are sure that no DS exists there,
2535 * much like a NODATA proof */
2536 enum sec_status sec;
2537 struct ub_packed_rrset_key* cname;
2538 cname = reply_find_rrset_section_an(msg->rep, qinfo->qname,
2539 qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass);
2541 errinf(qstate, "validator classified CNAME but no "
2542 "CNAME of the queried name for DS");
2545 if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count
2547 if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep->
2548 rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) {
2549 errinf(qstate, "DS got DNAME answer");
2551 errinf(qstate, "DS got unsigned CNAME answer");
2555 sec = val_verify_rrset_entry(qstate->env, ve, cname,
2556 vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate);
2557 if(sec == sec_status_secure) {
2558 verbose(VERB_ALGO, "CNAME validated, "
2559 "proof that DS does not exist");
2560 /* and that it is not a referral point */
2564 errinf(qstate, "CNAME in DS response was not secure.");
2565 errinf(qstate, reason);
2568 verbose(VERB_QUERY, "Encountered an unhandled type of "
2569 "DS response, thus bogus.");
2570 errinf(qstate, "no DS and");
2571 if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) {
2574 (void)sldns_wire2str_rcode_buf((int)FLAGS_GET_RCODE(
2575 msg->rep->flags), rc, sizeof(rc));
2577 } else errinf(qstate, val_classification_to_string(subtype));
2578 errinf(qstate, "message fails to prove that");
2582 *ke = key_entry_create_bad(qstate->region, qinfo->qname,
2583 qinfo->qname_len, qinfo->qclass,
2584 BOGUS_KEY_TTL, *qstate->env->now);
2585 return (*ke) != NULL;
2589 * Process DS response. Called from inform_supers.
2590 * Because it is in inform_supers, the mesh itself is busy doing callbacks
2591 * for a state that is to be deleted soon; don't touch the mesh; instead
2592 * set a state in the super, as the super will be reactivated soon.
2593 * Perform processing to determine what state to set in the super.
2595 * @param qstate: query state that is validating and asked for a DS.
2596 * @param vq: validator query state
2597 * @param id: module id.
2598 * @param rcode: rcode result value.
2599 * @param msg: result message (if rcode is OK).
2600 * @param qinfo: from the sub query state, query info.
2601 * @param origin: the origin of msg.
2604 process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
2605 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2606 struct sock_list* origin)
2608 struct key_entry_key* dske = NULL;
2609 uint8_t* olds = vq->empty_DS_name;
2610 vq->empty_DS_name = NULL;
2611 if(!ds_response_to_ke(qstate, vq, id, rcode, msg, qinfo, &dske)) {
2612 log_err("malloc failure in process_ds_response");
2613 vq->key_entry = NULL; /* make it error */
2614 vq->state = VAL_VALIDATE_STATE;
2618 vq->empty_DS_name = regional_alloc_init(qstate->region,
2619 qinfo->qname, qinfo->qname_len);
2620 if(!vq->empty_DS_name) {
2621 log_err("malloc failure in empty_DS_name");
2622 vq->key_entry = NULL; /* make it error */
2623 vq->state = VAL_VALIDATE_STATE;
2626 vq->empty_DS_len = qinfo->qname_len;
2627 vq->chain_blacklist = NULL;
2628 /* ds response indicated that we aren't on a delegation point.
2629 * Keep the forState.state on FINDKEY. */
2630 } else if(key_entry_isgood(dske)) {
2631 vq->ds_rrset = key_entry_get_rrset(dske, qstate->region);
2633 log_err("malloc failure in process DS");
2634 vq->key_entry = NULL; /* make it error */
2635 vq->state = VAL_VALIDATE_STATE;
2638 vq->chain_blacklist = NULL; /* fresh blacklist for next part*/
2639 /* Keep the forState.state on FINDKEY. */
2640 } else if(key_entry_isbad(dske)
2641 && vq->restart_count < VAL_MAX_RESTART_COUNT) {
2642 vq->empty_DS_name = olds;
2643 val_blacklist(&vq->chain_blacklist, qstate->region, origin, 1);
2644 qstate->errinf = NULL;
2645 vq->restart_count++;
2647 if(key_entry_isbad(dske)) {
2648 errinf_origin(qstate, origin);
2649 errinf_dname(qstate, "for DS", qinfo->qname);
2651 /* NOTE: the reason for the DS to be not good (that is,
2652 * either bad or null) should have been logged by
2653 * dsResponseToKE. */
2654 vq->key_entry = dske;
2655 /* The FINDKEY phase has ended, so move on. */
2656 vq->state = VAL_VALIDATE_STATE;
2661 * Process DNSKEY response. Called from inform_supers.
2662 * Sets the key entry in the state.
2663 * Because it is in inform_supers, the mesh itself is busy doing callbacks
2664 * for a state that is to be deleted soon; don't touch the mesh; instead
2665 * set a state in the super, as the super will be reactivated soon.
2666 * Perform processing to determine what state to set in the super.
2668 * @param qstate: query state that is validating and asked for a DNSKEY.
2669 * @param vq: validator query state
2670 * @param id: module id.
2671 * @param rcode: rcode result value.
2672 * @param msg: result message (if rcode is OK).
2673 * @param qinfo: from the sub query state, query info.
2674 * @param origin: the origin of msg.
2677 process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
2678 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2679 struct sock_list* origin)
2681 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2682 struct key_entry_key* old = vq->key_entry;
2683 struct ub_packed_rrset_key* dnskey = NULL;
2685 char* reason = NULL;
2687 if(rcode == LDNS_RCODE_NOERROR)
2688 dnskey = reply_find_answer_rrset(qinfo, msg->rep);
2690 if(dnskey == NULL) {
2692 verbose(VERB_DETAIL, "Missing DNSKEY RRset in response to "
2694 if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2695 val_blacklist(&vq->chain_blacklist, qstate->region,
2697 qstate->errinf = NULL;
2698 vq->restart_count++;
2701 vq->key_entry = key_entry_create_bad(qstate->region,
2702 qinfo->qname, qinfo->qname_len, qinfo->qclass,
2703 BOGUS_KEY_TTL, *qstate->env->now);
2704 if(!vq->key_entry) {
2705 log_err("alloc failure in missing dnskey response");
2706 /* key_entry is NULL for failure in Validate */
2708 errinf(qstate, "No DNSKEY record");
2709 errinf_origin(qstate, origin);
2710 errinf_dname(qstate, "for key", qinfo->qname);
2711 vq->state = VAL_VALIDATE_STATE;
2715 log_err("internal error: no DS rrset for new DNSKEY response");
2716 vq->key_entry = NULL;
2717 vq->state = VAL_VALIDATE_STATE;
2720 downprot = qstate->env->cfg->harden_algo_downgrade;
2721 vq->key_entry = val_verify_new_DNSKEYs(qstate->region, qstate->env,
2722 ve, dnskey, vq->ds_rrset, downprot, &reason, qstate);
2724 if(!vq->key_entry) {
2725 log_err("out of memory in verify new DNSKEYs");
2726 vq->state = VAL_VALIDATE_STATE;
2729 /* If the key entry isBad or isNull, then we can move on to the next
2731 if(!key_entry_isgood(vq->key_entry)) {
2732 if(key_entry_isbad(vq->key_entry)) {
2733 if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2734 val_blacklist(&vq->chain_blacklist,
2735 qstate->region, origin, 1);
2736 qstate->errinf = NULL;
2737 vq->restart_count++;
2738 vq->key_entry = old;
2741 verbose(VERB_DETAIL, "Did not match a DS to a DNSKEY, "
2743 errinf(qstate, reason);
2744 errinf_origin(qstate, origin);
2745 errinf_dname(qstate, "for key", qinfo->qname);
2747 vq->chain_blacklist = NULL;
2748 vq->state = VAL_VALIDATE_STATE;
2751 vq->chain_blacklist = NULL;
2752 qstate->errinf = NULL;
2754 /* The DNSKEY validated, so cache it as a trusted key rrset. */
2755 key_cache_insert(ve->kcache, vq->key_entry, qstate);
2757 /* If good, we stay in the FINDKEY state. */
2758 log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo);
2762 * Process prime response
2763 * Sets the key entry in the state.
2765 * @param qstate: query state that is validating and primed a trust anchor.
2766 * @param vq: validator query state
2767 * @param id: module id.
2768 * @param rcode: rcode result value.
2769 * @param msg: result message (if rcode is OK).
2770 * @param origin: the origin of msg.
2773 process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
2774 int id, int rcode, struct dns_msg* msg, struct sock_list* origin)
2776 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2777 struct ub_packed_rrset_key* dnskey_rrset = NULL;
2778 struct trust_anchor* ta = anchor_find(qstate->env->anchors,
2779 vq->trust_anchor_name, vq->trust_anchor_labs,
2780 vq->trust_anchor_len, vq->qchase.qclass);
2782 /* trust anchor revoked, restart with less anchors */
2783 vq->state = VAL_INIT_STATE;
2784 if(!vq->trust_anchor_name)
2785 vq->state = VAL_VALIDATE_STATE; /* break a loop */
2786 vq->trust_anchor_name = NULL;
2789 /* Fetch and validate the keyEntry that corresponds to the
2790 * current trust anchor. */
2791 if(rcode == LDNS_RCODE_NOERROR) {
2792 dnskey_rrset = reply_find_rrset_section_an(msg->rep,
2793 ta->name, ta->namelen, LDNS_RR_TYPE_DNSKEY,
2798 if(!autr_process_prime(qstate->env, ve, ta, dnskey_rrset,
2800 /* trust anchor revoked, restart with less anchors */
2801 vq->state = VAL_INIT_STATE;
2802 vq->trust_anchor_name = NULL;
2806 vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, id);
2807 lock_basic_unlock(&ta->lock);
2809 if(key_entry_isbad(vq->key_entry)
2810 && vq->restart_count < VAL_MAX_RESTART_COUNT) {
2811 val_blacklist(&vq->chain_blacklist, qstate->region,
2813 qstate->errinf = NULL;
2814 vq->restart_count++;
2815 vq->key_entry = NULL;
2816 vq->state = VAL_INIT_STATE;
2819 vq->chain_blacklist = NULL;
2820 errinf_origin(qstate, origin);
2821 errinf_dname(qstate, "for trust anchor", ta->name);
2822 /* store the freshly primed entry in the cache */
2823 key_cache_insert(ve->kcache, vq->key_entry, qstate);
2826 /* If the result of the prime is a null key, skip the FINDKEY state.*/
2827 if(!vq->key_entry || key_entry_isnull(vq->key_entry) ||
2828 key_entry_isbad(vq->key_entry)) {
2829 vq->state = VAL_VALIDATE_STATE;
2831 /* the qstate will be reactivated after inform_super is done */
2835 * inform validator super.
2837 * @param qstate: query state that finished.
2838 * @param id: module id.
2839 * @param super: the qstate to inform.
2842 val_inform_super(struct module_qstate* qstate, int id,
2843 struct module_qstate* super)
2845 struct val_qstate* vq = (struct val_qstate*)super->minfo[id];
2846 log_query_info(VERB_ALGO, "validator: inform_super, sub is",
2848 log_query_info(VERB_ALGO, "super is", &super->qinfo);
2850 verbose(VERB_ALGO, "super: has no validator state");
2853 if(vq->wait_prime_ta) {
2854 vq->wait_prime_ta = 0;
2855 process_prime_response(super, vq, id, qstate->return_rcode,
2856 qstate->return_msg, qstate->reply_origin);
2859 if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS) {
2860 process_ds_response(super, vq, id, qstate->return_rcode,
2861 qstate->return_msg, &qstate->qinfo,
2862 qstate->reply_origin);
2864 } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY) {
2865 process_dnskey_response(super, vq, id, qstate->return_rcode,
2866 qstate->return_msg, &qstate->qinfo,
2867 qstate->reply_origin);
2870 log_err("internal error in validator: no inform_supers possible");
2874 val_clear(struct module_qstate* qstate, int id)
2878 /* everything is allocated in the region, so assign NULL */
2879 qstate->minfo[id] = NULL;
2883 val_get_mem(struct module_env* env, int id)
2885 struct val_env* ve = (struct val_env*)env->modinfo[id];
2888 return sizeof(*ve) + key_cache_get_mem(ve->kcache) +
2889 val_neg_get_mem(ve->neg_cache) +
2890 sizeof(size_t)*2*ve->nsec3_keyiter_count;
2894 * The validator function block
2896 static struct module_func_block val_block = {
2898 &val_init, &val_deinit, &val_operate, &val_inform_super, &val_clear,
2902 struct module_func_block*
2903 val_get_funcblock(void)
2909 val_state_to_string(enum val_state state)
2912 case VAL_INIT_STATE: return "VAL_INIT_STATE";
2913 case VAL_FINDKEY_STATE: return "VAL_FINDKEY_STATE";
2914 case VAL_VALIDATE_STATE: return "VAL_VALIDATE_STATE";
2915 case VAL_FINISHED_STATE: return "VAL_FINISHED_STATE";
2917 return "UNKNOWN VALIDATOR STATE";