validator/val_utils.c

   1 /*
   2  * validator/val_utils.c - validator utility functions.
   3  *
   4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file contains helper functions for the validator module.
  40  */
  41 #include "config.h"
  42 #include "validator/val_utils.h"
  43 #include "validator/validator.h"
  44 #include "validator/val_kentry.h"
  45 #include "validator/val_sigcrypt.h"
  46 #include "validator/val_anchor.h"
  47 #include "validator/val_nsec.h"
  48 #include "validator/val_neg.h"
  49 #include "services/cache/rrset.h"
  50 #include "services/cache/dns.h"
  51 #include "util/data/msgreply.h"
  52 #include "util/data/packed_rrset.h"
  53 #include "util/data/dname.h"
  54 #include "util/net_help.h"
  55 #include "util/module.h"
  56 #include "util/regional.h"
  57 #include "sldns/wire2str.h"
  58 #include "sldns/parseutil.h"
  59
  60 enum val_classification
  61 val_classify_response(uint16_t query_flags, struct query_info* origqinf,
  62         struct query_info* qinf, struct reply_info* rep, size_t skip)
  63 {
  64         int rcode = (int)FLAGS_GET_RCODE(rep->flags);
  65         size_t i;
  66
  67         /* Normal Name Error's are easy to detect -- but don't mistake a CNAME
  68          * chain ending in NXDOMAIN. */
  69         if(rcode == LDNS_RCODE_NXDOMAIN && rep->an_numrrsets == 0)
  70                 return VAL_CLASS_NAMEERROR;
  71
  72         /* check for referral: nonRD query and it looks like a nodata */
  73         if(!(query_flags&BIT_RD) && rep->an_numrrsets == 0 &&
  74                 rcode == LDNS_RCODE_NOERROR) {
  75                 /* SOA record in auth indicates it is NODATA instead.
  76                  * All validation requiring NODATA messages have SOA in
  77                  * authority section. */
  78                 /* uses fact that answer section is empty */
  79                 int saw_ns = 0;
  80                 for(i=0; i<rep->ns_numrrsets; i++) {
  81                         if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_SOA)
  82                                 return VAL_CLASS_NODATA;
  83                         if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_DS)
  84                                 return VAL_CLASS_REFERRAL;
  85                         if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS)
  86                                 saw_ns = 1;
  87                 }
  88                 return saw_ns?VAL_CLASS_REFERRAL:VAL_CLASS_NODATA;
  89         }
  90         /* root referral where NS set is in the answer section */
  91         if(!(query_flags&BIT_RD) && rep->ns_numrrsets == 0 &&
  92                 rep->an_numrrsets == 1 && rcode == LDNS_RCODE_NOERROR &&
  93                 ntohs(rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_NS &&
  94                 query_dname_compare(rep->rrsets[0]->rk.dname,
  95                         origqinf->qname) != 0)
  96                 return VAL_CLASS_REFERRAL;
  97
  98         /* dump bad messages */
  99         if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN)
 100                 return VAL_CLASS_UNKNOWN;
 101         /* next check if the skip into the answer section shows no answer */
 102         if(skip>0 && rep->an_numrrsets <= skip)
 103                 return VAL_CLASS_CNAMENOANSWER;
 104
 105         /* Next is NODATA */
 106         if(rcode == LDNS_RCODE_NOERROR && rep->an_numrrsets == 0)
 107                 return VAL_CLASS_NODATA;
 108
 109         /* We distinguish between CNAME response and other positive/negative
 110          * responses because CNAME answers require extra processing. */
 111
 112         /* We distinguish between ANY and CNAME or POSITIVE because
 113          * ANY responses are validated differently. */
 114         if(rcode == LDNS_RCODE_NOERROR && qinf->qtype == LDNS_RR_TYPE_ANY)
 115                 return VAL_CLASS_ANY;
 116
 117         /* Note that DNAMEs will be ignored here, unless qtype=DNAME. Unless
 118          * qtype=CNAME, this will yield a CNAME response. */
 119         for(i=skip; i<rep->an_numrrsets; i++) {
 120                 if(rcode == LDNS_RCODE_NOERROR &&
 121                         ntohs(rep->rrsets[i]->rk.type) == qinf->qtype)
 122                         return VAL_CLASS_POSITIVE;
 123                 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME)
 124                         return VAL_CLASS_CNAME;
 125         }
 126         log_dns_msg("validator: error. failed to classify response message: ",
 127                 qinf, rep);
 128         return VAL_CLASS_UNKNOWN;
 129 }
 130
 131 /** Get signer name from RRSIG */
 132 static void
 133 rrsig_get_signer(uint8_t* data, size_t len, uint8_t** sname, size_t* slen)
 134 {
 135         /* RRSIG rdata is not allowed to be compressed, it is stored
 136          * uncompressed in memory as well, so return a ptr to the name */
 137         if(len < 21) {
 138                 /* too short RRSig:
 139                  * short, byte, byte, long, long, long, short, "." is
 140                  * 2    1       1       4       4  4    2       1 = 19
 141                  *                      and a skip of 18 bytes to the name.
 142                  * +2 for the rdatalen is 21 bytes len for root label */
 143                 *sname = NULL;
 144                 *slen = 0;
 145                 return;
 146         }
 147         data += 20; /* skip the fixed size bits */
 148         len -= 20;
 149         *slen = dname_valid(data, len);
 150         if(!*slen) {
 151                 /* bad dname in this rrsig. */
 152                 *sname = NULL;
 153                 return;
 154         }
 155         *sname = data;
 156 }
 157
 158 void
 159 val_find_rrset_signer(struct ub_packed_rrset_key* rrset, uint8_t** sname,
 160         size_t* slen)
 161 {
 162         struct packed_rrset_data* d = (struct packed_rrset_data*)
 163                 rrset->entry.data;
 164         /* return signer for first signature, or NULL */
 165         if(d->rrsig_count == 0) {
 166                 *sname = NULL;
 167                 *slen = 0;
 168                 return;
 169         }
 170         /* get rrsig signer name out of the signature */
 171         rrsig_get_signer(d->rr_data[d->count], d->rr_len[d->count],
 172                 sname, slen);
 173 }
 174
 175 /**
 176  * Find best signer name in this set of rrsigs.
 177  * @param rrset: which rrsigs to look through.
 178  * @param qinf: the query name that needs validation.
 179  * @param signer_name: the best signer_name. Updated if a better one is found.
 180  * @param signer_len: length of signer name.
 181  * @param matchcount: count of current best name (starts at 0 for no match).
 182  *      Updated if match is improved.
 183  */
 184 static void
 185 val_find_best_signer(struct ub_packed_rrset_key* rrset,
 186         struct query_info* qinf, uint8_t** signer_name, size_t* signer_len,
 187         int* matchcount)
 188 {
 189         struct packed_rrset_data* d = (struct packed_rrset_data*)
 190                 rrset->entry.data;
 191         uint8_t* sign;
 192         size_t i;
 193         int m;
 194         for(i=d->count; i<d->count+d->rrsig_count; i++) {
 195                 sign = d->rr_data[i]+2+18;
 196                 /* look at signatures that are valid (long enough),
 197                  * and have a signer name that is a superdomain of qname,
 198                  * and then check the number of labels in the shared topdomain
 199                  * improve the match if possible */
 200                 if(d->rr_len[i] > 2+19 && /* rdata, sig + root label*/
 201                         dname_subdomain_c(qinf->qname, sign)) {
 202                         (void)dname_lab_cmp(qinf->qname,
 203                                 dname_count_labels(qinf->qname),
 204                                 sign, dname_count_labels(sign), &m);
 205                         if(m > *matchcount) {
 206                                 *matchcount = m;
 207                                 *signer_name = sign;
 208                                 (void)dname_count_size_labels(*signer_name,
 209                                         signer_len);
 210                         }
 211                 }
 212         }
 213 }
 214
 215 void
 216 val_find_signer(enum val_classification subtype, struct query_info* qinf,
 217         struct reply_info* rep, size_t skip, uint8_t** signer_name,
 218         size_t* signer_len)
 219 {
 220         size_t i;
 221
 222         if(subtype == VAL_CLASS_POSITIVE) {
 223                 /* check for the answer rrset */
 224                 for(i=skip; i<rep->an_numrrsets; i++) {
 225                         if(query_dname_compare(qinf->qname,
 226                                 rep->rrsets[i]->rk.dname) == 0) {
 227                                 val_find_rrset_signer(rep->rrsets[i],
 228                                         signer_name, signer_len);
 229                                 return;
 230                         }
 231                 }
 232                 *signer_name = NULL;
 233                 *signer_len = 0;
 234         } else if(subtype == VAL_CLASS_CNAME) {
 235                 /* check for the first signed cname/dname rrset */
 236                 for(i=skip; i<rep->an_numrrsets; i++) {
 237                         val_find_rrset_signer(rep->rrsets[i],
 238                                 signer_name, signer_len);
 239                         if(*signer_name)
 240                                 return;
 241                         if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_DNAME)
 242                                 break; /* only check CNAME after a DNAME */
 243                 }
 244                 *signer_name = NULL;
 245                 *signer_len = 0;
 246         } else if(subtype == VAL_CLASS_NAMEERROR
 247                 || subtype == VAL_CLASS_NODATA) {
 248                 /*Check to see if the AUTH section NSEC record(s) have rrsigs*/
 249                 for(i=rep->an_numrrsets; i<
 250                         rep->an_numrrsets+rep->ns_numrrsets; i++) {
 251                         if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC
 252                                 || ntohs(rep->rrsets[i]->rk.type) ==
 253                                 LDNS_RR_TYPE_NSEC3) {
 254                                 val_find_rrset_signer(rep->rrsets[i],
 255                                         signer_name, signer_len);
 256                                 return;
 257                         }
 258                 }
 259         } else if(subtype == VAL_CLASS_CNAMENOANSWER) {
 260                 /* find closest superdomain signer name in authority section
 261                  * NSEC and NSEC3s */
 262                 int matchcount = 0;
 263                 *signer_name = NULL;
 264                 *signer_len = 0;
 265                 for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->
 266                         ns_numrrsets; i++) {
 267                         if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC
 268                                 || ntohs(rep->rrsets[i]->rk.type) ==
 269                                 LDNS_RR_TYPE_NSEC3) {
 270                                 val_find_best_signer(rep->rrsets[i], qinf,
 271                                         signer_name, signer_len, &matchcount);
 272                         }
 273                 }
 274         } else if(subtype == VAL_CLASS_ANY) {
 275                 /* check for one of the answer rrset that has signatures,
 276                  * or potentially a DNAME is in use with a different qname */
 277                 for(i=skip; i<rep->an_numrrsets; i++) {
 278                         if(query_dname_compare(qinf->qname,
 279                                 rep->rrsets[i]->rk.dname) == 0) {
 280                                 val_find_rrset_signer(rep->rrsets[i],
 281                                         signer_name, signer_len);
 282                                 if(*signer_name)
 283                                         return;
 284                         }
 285                 }
 286                 /* no answer RRSIGs with qname, try a DNAME */
 287                 if(skip < rep->an_numrrsets &&
 288                         ntohs(rep->rrsets[skip]->rk.type) ==
 289                         LDNS_RR_TYPE_DNAME) {
 290                         val_find_rrset_signer(rep->rrsets[skip],
 291                                 signer_name, signer_len);
 292                         if(*signer_name)
 293                                 return;
 294                 }
 295                 *signer_name = NULL;
 296                 *signer_len = 0;
 297         } else if(subtype == VAL_CLASS_REFERRAL) {
 298                 /* find keys for the item at skip */
 299                 if(skip < rep->rrset_count) {
 300                         val_find_rrset_signer(rep->rrsets[skip],
 301                                 signer_name, signer_len);
 302                         return;
 303                 }
 304                 *signer_name = NULL;
 305                 *signer_len = 0;
 306         } else {
 307                 verbose(VERB_QUERY, "find_signer: could not find signer name"
 308                         " for unknown type response");
 309                 *signer_name = NULL;
 310                 *signer_len = 0;
 311         }
 312 }
 313
 314 /** return number of rrs in an rrset */
 315 static size_t
 316 rrset_get_count(struct ub_packed_rrset_key* rrset)
 317 {
 318         struct packed_rrset_data* d = (struct packed_rrset_data*)
 319                 rrset->entry.data;
 320         if(!d) return 0;
 321         return d->count;
 322 }
 323
 324 /** return TTL of rrset */
 325 static uint32_t
 326 rrset_get_ttl(struct ub_packed_rrset_key* rrset)
 327 {
 328         struct packed_rrset_data* d = (struct packed_rrset_data*)
 329                 rrset->entry.data;
 330         if(!d) return 0;
 331         return d->ttl;
 332 }
 333
 334 enum sec_status
 335 val_verify_rrset(struct module_env* env, struct val_env* ve,
 336         struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* keys,
 337         uint8_t* sigalg, char** reason)
 338 {
 339         enum sec_status sec;
 340         struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
 341                 entry.data;
 342         if(d->security == sec_status_secure) {
 343                 /* re-verify all other statuses, because keyset may change*/
 344                 log_nametypeclass(VERB_ALGO, "verify rrset cached",
 345                         rrset->rk.dname, ntohs(rrset->rk.type),
 346                         ntohs(rrset->rk.rrset_class));
 347                 return d->security;
 348         }
 349         /* check in the cache if verification has already been done */
 350         rrset_check_sec_status(env->rrset_cache, rrset, *env->now);
 351         if(d->security == sec_status_secure) {
 352                 log_nametypeclass(VERB_ALGO, "verify rrset from cache",
 353                         rrset->rk.dname, ntohs(rrset->rk.type),
 354                         ntohs(rrset->rk.rrset_class));
 355                 return d->security;
 356         }
 357         log_nametypeclass(VERB_ALGO, "verify rrset", rrset->rk.dname,
 358                 ntohs(rrset->rk.type), ntohs(rrset->rk.rrset_class));
 359         sec = dnskeyset_verify_rrset(env, ve, rrset, keys, sigalg, reason);
 360         verbose(VERB_ALGO, "verify result: %s", sec_status_to_string(sec));
 361         regional_free_all(env->scratch);
 362
 363         /* update rrset security status
 364          * only improves security status
 365          * and bogus is set only once, even if we rechecked the status */
 366         if(sec > d->security) {
 367                 d->security = sec;
 368                 if(sec == sec_status_secure)
 369                         d->trust = rrset_trust_validated;
 370                 else if(sec == sec_status_bogus) {
 371                         size_t i;
 372                         /* update ttl for rrset to fixed value. */
 373                         d->ttl = ve->bogus_ttl;
 374                         for(i=0; i<d->count+d->rrsig_count; i++)
 375                                 d->rr_ttl[i] = ve->bogus_ttl;
 376                         /* leave RR specific TTL: not used for determine
 377                          * if RRset timed out and clients see proper value. */
 378                         lock_basic_lock(&ve->bogus_lock);
 379                         ve->num_rrset_bogus++;
 380                         lock_basic_unlock(&ve->bogus_lock);
 381                 }
 382                 /* if status updated - store in cache for reuse */
 383                 rrset_update_sec_status(env->rrset_cache, rrset, *env->now);
 384         }
 385
 386         return sec;
 387 }
 388
 389 enum sec_status
 390 val_verify_rrset_entry(struct module_env* env, struct val_env* ve,
 391         struct ub_packed_rrset_key* rrset, struct key_entry_key* kkey,
 392         char** reason)
 393 {
 394         /* temporary dnskey rrset-key */
 395         struct ub_packed_rrset_key dnskey;
 396         struct key_entry_data* kd = (struct key_entry_data*)kkey->entry.data;
 397         enum sec_status sec;
 398         dnskey.rk.type = htons(kd->rrset_type);
 399         dnskey.rk.rrset_class = htons(kkey->key_class);
 400         dnskey.rk.flags = 0;
 401         dnskey.rk.dname = kkey->name;
 402         dnskey.rk.dname_len = kkey->namelen;
 403         dnskey.entry.key = &dnskey;
 404         dnskey.entry.data = kd->rrset_data;
 405         sec = val_verify_rrset(env, ve, rrset, &dnskey, kd->algo, reason);
 406         return sec;
 407 }
 408
 409 /** verify that a DS RR hashes to a key and that key signs the set */
 410 static enum sec_status
 411 verify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve,
 412         struct ub_packed_rrset_key* dnskey_rrset,
 413         struct ub_packed_rrset_key* ds_rrset, size_t ds_idx, char** reason)
 414 {
 415         enum sec_status sec = sec_status_bogus;
 416         size_t i, num, numchecked = 0, numhashok = 0;
 417         num = rrset_get_count(dnskey_rrset);
 418         for(i=0; i<num; i++) {
 419                 /* Skip DNSKEYs that don't match the basic criteria. */
 420                 if(ds_get_key_algo(ds_rrset, ds_idx)
 421                    != dnskey_get_algo(dnskey_rrset, i)
 422                    || dnskey_calc_keytag(dnskey_rrset, i)
 423                    != ds_get_keytag(ds_rrset, ds_idx)) {
 424                         continue;
 425                 }
 426                 numchecked++;
 427                 verbose(VERB_ALGO, "attempt DS match algo %d keytag %d",
 428                         ds_get_key_algo(ds_rrset, ds_idx),
 429                         ds_get_keytag(ds_rrset, ds_idx));
 430
 431                 /* Convert the candidate DNSKEY into a hash using the
 432                  * same DS hash algorithm. */
 433                 if(!ds_digest_match_dnskey(env, dnskey_rrset, i, ds_rrset,
 434                         ds_idx)) {
 435                         verbose(VERB_ALGO, "DS match attempt failed");
 436                         continue;
 437                 }
 438                 numhashok++;
 439                 verbose(VERB_ALGO, "DS match digest ok, trying signature");
 440
 441                 /* Otherwise, we have a match! Make sure that the DNSKEY
 442                  * verifies *with this key*  */
 443                 sec = dnskey_verify_rrset(env, ve, dnskey_rrset,
 444                         dnskey_rrset, i, reason);
 445                 if(sec == sec_status_secure) {
 446                         return sec;
 447                 }
 448                 /* If it didn't validate with the DNSKEY, try the next one! */
 449         }
 450         if(numchecked == 0)
 451                 algo_needs_reason(env, ds_get_key_algo(ds_rrset, ds_idx),
 452                         reason, "no keys have a DS");
 453         else if(numhashok == 0)
 454                 *reason = "DS hash mismatches key";
 455         else if(!*reason)
 456                 *reason = "keyset not secured by DNSKEY that matches DS";
 457         return sec_status_bogus;
 458 }
 459
 460 int val_favorite_ds_algo(struct ub_packed_rrset_key* ds_rrset)
 461 {
 462         size_t i, num = rrset_get_count(ds_rrset);
 463         int d, digest_algo = 0; /* DS digest algo 0 is not used. */
 464         /* find favorite algo, for now, highest number supported */
 465         for(i=0; i<num; i++) {
 466                 if(!ds_digest_algo_is_supported(ds_rrset, i) ||
 467                         !ds_key_algo_is_supported(ds_rrset, i)) {
 468                         continue;
 469                 }
 470                 d = ds_get_digest_algo(ds_rrset, i);
 471                 if(d > digest_algo)
 472                         digest_algo = d;
 473         }
 474         return digest_algo;
 475 }
 476
 477 enum sec_status
 478 val_verify_DNSKEY_with_DS(struct module_env* env, struct val_env* ve,
 479         struct ub_packed_rrset_key* dnskey_rrset,
 480         struct ub_packed_rrset_key* ds_rrset, uint8_t* sigalg, char** reason)
 481 {
 482         /* as long as this is false, we can consider this DS rrset to be
 483          * equivalent to no DS rrset. */
 484         int has_useful_ds = 0, digest_algo, alg;
 485         struct algo_needs needs;
 486         size_t i, num;
 487         enum sec_status sec;
 488
 489         if(dnskey_rrset->rk.dname_len != ds_rrset->rk.dname_len ||
 490                 query_dname_compare(dnskey_rrset->rk.dname, ds_rrset->rk.dname)
 491                 != 0) {
 492                 verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset "
 493                         "by name");
 494                 *reason = "DNSKEY RRset did not match DS RRset by name";
 495                 return sec_status_bogus;
 496         }
 497
 498         if(sigalg) {
 499                 /* harden against algo downgrade is enabled */
 500                 digest_algo = val_favorite_ds_algo(ds_rrset);
 501                 algo_needs_init_ds(&needs, ds_rrset, digest_algo, sigalg);
 502         } else {
 503                 /* accept any key algo, any digest algo */
 504                 digest_algo = -1;
 505         }
 506         num = rrset_get_count(ds_rrset);
 507         for(i=0; i<num; i++) {
 508                 /* Check to see if we can understand this DS.
 509                  * And check it is the strongest digest */
 510                 if(!ds_digest_algo_is_supported(ds_rrset, i) ||
 511                         !ds_key_algo_is_supported(ds_rrset, i) ||
 512                         (sigalg && (ds_get_digest_algo(ds_rrset, i) != digest_algo))) {
 513                         continue;
 514                 }
 515
 516                 /* Once we see a single DS with a known digestID and
 517                  * algorithm, we cannot return INSECURE (with a
 518                  * "null" KeyEntry). */
 519                 has_useful_ds = 1;
 520
 521                 sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset,
 522                         ds_rrset, i, reason);
 523                 if(sec == sec_status_secure) {
 524                         if(!sigalg || algo_needs_set_secure(&needs,
 525                                 (uint8_t)ds_get_key_algo(ds_rrset, i))) {
 526                                 verbose(VERB_ALGO, "DS matched DNSKEY.");
 527                                 return sec_status_secure;
 528                         }
 529                 } else if(sigalg && sec == sec_status_bogus) {
 530                         algo_needs_set_bogus(&needs,
 531                                 (uint8_t)ds_get_key_algo(ds_rrset, i));
 532                 }
 533         }
 534
 535         /* None of the DS's worked out. */
 536
 537         /* If no DSs were understandable, then this is OK. */
 538         if(!has_useful_ds) {
 539                 verbose(VERB_ALGO, "No usable DS records were found -- "
 540                         "treating as insecure.");
 541                 return sec_status_insecure;
 542         }
 543         /* If any were understandable, then it is bad. */
 544         verbose(VERB_QUERY, "Failed to match any usable DS to a DNSKEY.");
 545         if(sigalg && (alg=algo_needs_missing(&needs)) != 0) {
 546                 algo_needs_reason(env, alg, reason, "missing verification of "
 547                         "DNSKEY signature");
 548         }
 549         return sec_status_bogus;
 550 }
 551
 552 struct key_entry_key*
 553 val_verify_new_DNSKEYs(struct regional* region, struct module_env* env,
 554         struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset,
 555         struct ub_packed_rrset_key* ds_rrset, int downprot, char** reason)
 556 {
 557         uint8_t sigalg[ALGO_NEEDS_MAX+1];
 558         enum sec_status sec = val_verify_DNSKEY_with_DS(env, ve,
 559                 dnskey_rrset, ds_rrset, downprot?sigalg:NULL, reason);
 560
 561         if(sec == sec_status_secure) {
 562                 return key_entry_create_rrset(region,
 563                         ds_rrset->rk.dname, ds_rrset->rk.dname_len,
 564                         ntohs(ds_rrset->rk.rrset_class), dnskey_rrset,
 565                         downprot?sigalg:NULL, *env->now);
 566         } else if(sec == sec_status_insecure) {
 567                 return key_entry_create_null(region, ds_rrset->rk.dname,
 568                         ds_rrset->rk.dname_len,
 569                         ntohs(ds_rrset->rk.rrset_class),
 570                         rrset_get_ttl(ds_rrset), *env->now);
 571         }
 572         return key_entry_create_bad(region, ds_rrset->rk.dname,
 573                 ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class),
 574                 BOGUS_KEY_TTL, *env->now);
 575 }
 576
 577 enum sec_status
 578 val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve,
 579         struct ub_packed_rrset_key* dnskey_rrset,
 580         struct ub_packed_rrset_key* ta_ds,
 581         struct ub_packed_rrset_key* ta_dnskey, uint8_t* sigalg, char** reason)
 582 {
 583         /* as long as this is false, we can consider this anchor to be
 584          * equivalent to no anchor. */
 585         int has_useful_ta = 0, digest_algo = 0, alg;
 586         struct algo_needs needs;
 587         size_t i, num;
 588         enum sec_status sec;
 589
 590         if(ta_ds && (dnskey_rrset->rk.dname_len != ta_ds->rk.dname_len ||
 591                 query_dname_compare(dnskey_rrset->rk.dname, ta_ds->rk.dname)
 592                 != 0)) {
 593                 verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset "
 594                         "by name");
 595                 *reason = "DNSKEY RRset did not match DS RRset by name";
 596                 return sec_status_bogus;
 597         }
 598         if(ta_dnskey && (dnskey_rrset->rk.dname_len != ta_dnskey->rk.dname_len
 599              || query_dname_compare(dnskey_rrset->rk.dname, ta_dnskey->rk.dname)
 600                 != 0)) {
 601                 verbose(VERB_QUERY, "DNSKEY RRset did not match anchor RRset "
 602                         "by name");
 603                 *reason = "DNSKEY RRset did not match anchor RRset by name";
 604                 return sec_status_bogus;
 605         }
 606
 607         if(ta_ds)
 608                 digest_algo = val_favorite_ds_algo(ta_ds);
 609         if(sigalg) {
 610                 if(ta_ds)
 611                         algo_needs_init_ds(&needs, ta_ds, digest_algo, sigalg);
 612                 else    memset(&needs, 0, sizeof(needs));
 613                 if(ta_dnskey)
 614                         algo_needs_init_dnskey_add(&needs, ta_dnskey, sigalg);
 615         }
 616         if(ta_ds) {
 617             num = rrset_get_count(ta_ds);
 618             for(i=0; i<num; i++) {
 619                 /* Check to see if we can understand this DS.
 620                  * And check it is the strongest digest */
 621                 if(!ds_digest_algo_is_supported(ta_ds, i) ||
 622                         !ds_key_algo_is_supported(ta_ds, i) ||
 623                         ds_get_digest_algo(ta_ds, i) != digest_algo)
 624                         continue;
 625
 626                 /* Once we see a single DS with a known digestID and
 627                  * algorithm, we cannot return INSECURE (with a
 628                  * "null" KeyEntry). */
 629                 has_useful_ta = 1;
 630
 631                 sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset,
 632                         ta_ds, i, reason);
 633                 if(sec == sec_status_secure) {
 634                         if(!sigalg || algo_needs_set_secure(&needs,
 635                                 (uint8_t)ds_get_key_algo(ta_ds, i))) {
 636                                 verbose(VERB_ALGO, "DS matched DNSKEY.");
 637                                 return sec_status_secure;
 638                         }
 639                 } else if(sigalg && sec == sec_status_bogus) {
 640                         algo_needs_set_bogus(&needs,
 641                                 (uint8_t)ds_get_key_algo(ta_ds, i));
 642                 }
 643             }
 644         }
 645
 646         /* None of the DS's worked out: check the DNSKEYs. */
 647         if(ta_dnskey) {
 648             num = rrset_get_count(ta_dnskey);
 649             for(i=0; i<num; i++) {
 650                 /* Check to see if we can understand this DNSKEY */
 651                 if(!dnskey_algo_is_supported(ta_dnskey, i))
 652                         continue;
 653
 654                 /* we saw a useful TA */
 655                 has_useful_ta = 1;
 656
 657                 sec = dnskey_verify_rrset(env, ve, dnskey_rrset,
 658                         ta_dnskey, i, reason);
 659                 if(sec == sec_status_secure) {
 660                         if(!sigalg || algo_needs_set_secure(&needs,
 661                                 (uint8_t)dnskey_get_algo(ta_dnskey, i))) {
 662                                 verbose(VERB_ALGO, "anchor matched DNSKEY.");
 663                                 return sec_status_secure;
 664                         }
 665                 } else if(sigalg && sec == sec_status_bogus) {
 666                         algo_needs_set_bogus(&needs,
 667                                 (uint8_t)dnskey_get_algo(ta_dnskey, i));
 668                 }
 669             }
 670         }
 671
 672         /* If no DSs were understandable, then this is OK. */
 673         if(!has_useful_ta) {
 674                 verbose(VERB_ALGO, "No usable trust anchors were found -- "
 675                         "treating as insecure.");
 676                 return sec_status_insecure;
 677         }
 678         /* If any were understandable, then it is bad. */
 679         verbose(VERB_QUERY, "Failed to match any usable anchor to a DNSKEY.");
 680         if(sigalg && (alg=algo_needs_missing(&needs)) != 0) {
 681                 algo_needs_reason(env, alg, reason, "missing verification of "
 682                         "DNSKEY signature");
 683         }
 684         return sec_status_bogus;
 685 }
 686
 687 struct key_entry_key*
 688 val_verify_new_DNSKEYs_with_ta(struct regional* region, struct module_env* env,
 689         struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset,
 690         struct ub_packed_rrset_key* ta_ds_rrset,
 691         struct ub_packed_rrset_key* ta_dnskey_rrset, int downprot,
 692         char** reason)
 693 {
 694         uint8_t sigalg[ALGO_NEEDS_MAX+1];
 695         enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve,
 696                 dnskey_rrset, ta_ds_rrset, ta_dnskey_rrset,
 697                 downprot?sigalg:NULL, reason);
 698
 699         if(sec == sec_status_secure) {
 700                 return key_entry_create_rrset(region,
 701                         dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len,
 702                         ntohs(dnskey_rrset->rk.rrset_class), dnskey_rrset,
 703                         downprot?sigalg:NULL, *env->now);
 704         } else if(sec == sec_status_insecure) {
 705                 return key_entry_create_null(region, dnskey_rrset->rk.dname,
 706                         dnskey_rrset->rk.dname_len,
 707                         ntohs(dnskey_rrset->rk.rrset_class),
 708                         rrset_get_ttl(dnskey_rrset), *env->now);
 709         }
 710         return key_entry_create_bad(region, dnskey_rrset->rk.dname,
 711                 dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class),
 712                 BOGUS_KEY_TTL, *env->now);
 713 }
 714
 715 int
 716 val_dsset_isusable(struct ub_packed_rrset_key* ds_rrset)
 717 {
 718         size_t i;
 719         for(i=0; i<rrset_get_count(ds_rrset); i++) {
 720                 if(ds_digest_algo_is_supported(ds_rrset, i) &&
 721                         ds_key_algo_is_supported(ds_rrset, i))
 722                         return 1;
 723         }
 724         if(verbosity < VERB_ALGO)
 725                 return 0;
 726         if(rrset_get_count(ds_rrset) == 0)
 727                 verbose(VERB_ALGO, "DS is not usable");
 728         else {
 729                 /* report usability for the first DS RR */
 730                 sldns_lookup_table *lt;
 731                 char herr[64], aerr[64];
 732                 lt = sldns_lookup_by_id(sldns_hashes,
 733                         (int)ds_get_digest_algo(ds_rrset, i));
 734                 if(lt) snprintf(herr, sizeof(herr), "%s", lt->name);
 735                 else snprintf(herr, sizeof(herr), "%d",
 736                         (int)ds_get_digest_algo(ds_rrset, i));
 737                 lt = sldns_lookup_by_id(sldns_algorithms,
 738                         (int)ds_get_key_algo(ds_rrset, i));
 739                 if(lt) snprintf(aerr, sizeof(aerr), "%s", lt->name);
 740                 else snprintf(aerr, sizeof(aerr), "%d",
 741                         (int)ds_get_key_algo(ds_rrset, i));
 742                 verbose(VERB_ALGO, "DS unsupported, hash %s %s, "
 743                         "key algorithm %s %s", herr,
 744                         (ds_digest_algo_is_supported(ds_rrset, 0)?
 745                         "(supported)":"(unsupported)"), aerr,
 746                         (ds_key_algo_is_supported(ds_rrset, 0)?
 747                         "(supported)":"(unsupported)"));
 748         }
 749         return 0;
 750 }
 751
 752 /** get label count for a signature */
 753 static uint8_t
 754 rrsig_get_labcount(struct packed_rrset_data* d, size_t sig)
 755 {
 756         if(d->rr_len[sig] < 2+4)
 757                 return 0; /* bad sig length */
 758         return d->rr_data[sig][2+3];
 759 }
 760
 761 int
 762 val_rrset_wildcard(struct ub_packed_rrset_key* rrset, uint8_t** wc)
 763 {
 764         struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
 765                 entry.data;
 766         uint8_t labcount;
 767         int labdiff;
 768         uint8_t* wn;
 769         size_t i, wl;
 770         if(d->rrsig_count == 0) {
 771                 return 1;
 772         }
 773         labcount = rrsig_get_labcount(d, d->count + 0);
 774         /* check rest of signatures identical */
 775         for(i=1; i<d->rrsig_count; i++) {
 776                 if(labcount != rrsig_get_labcount(d, d->count + i)) {
 777                         return 0;
 778                 }
 779         }
 780         /* OK the rrsigs check out */
 781         /* if the RRSIG label count is shorter than the number of actual
 782          * labels, then this rrset was synthesized from a wildcard.
 783          * Note that the RRSIG label count doesn't count the root label. */
 784         wn = rrset->rk.dname;
 785         wl = rrset->rk.dname_len;
 786         /* skip a leading wildcard label in the dname (RFC4035 2.2) */
 787         if(dname_is_wild(wn)) {
 788                 wn += 2;
 789                 wl -= 2;
 790         }
 791         labdiff = (dname_count_labels(wn) - 1) - (int)labcount;
 792         if(labdiff > 0) {
 793                 *wc = wn;
 794                 dname_remove_labels(wc, &wl, labdiff);
 795                 return 1;
 796         }
 797         return 1;
 798 }
 799
 800 int
 801 val_chase_cname(struct query_info* qchase, struct reply_info* rep,
 802         size_t* cname_skip) {
 803         size_t i;
 804         /* skip any DNAMEs, go to the CNAME for next part */
 805         for(i = *cname_skip; i < rep->an_numrrsets; i++) {
 806                 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME &&
 807                         query_dname_compare(qchase->qname, rep->rrsets[i]->
 808                                 rk.dname) == 0) {
 809                         qchase->qname = NULL;
 810                         get_cname_target(rep->rrsets[i], &qchase->qname,
 811                                 &qchase->qname_len);
 812                         if(!qchase->qname)
 813                                 return 0; /* bad CNAME rdata */
 814                         (*cname_skip) = i+1;
 815                         return 1;
 816                 }
 817         }
 818         return 0; /* CNAME classified but no matching CNAME ?! */
 819 }
 820
 821 /** see if rrset has signer name as one of the rrsig signers */
 822 static int
 823 rrset_has_signer(struct ub_packed_rrset_key* rrset, uint8_t* name, size_t len)
 824 {
 825         struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
 826                 entry.data;
 827         size_t i;
 828         for(i = d->count; i< d->count+d->rrsig_count; i++) {
 829                 if(d->rr_len[i] > 2+18+len) {
 830                         /* at least rdatalen + signature + signame (+1 sig)*/
 831                         if(!dname_valid(d->rr_data[i]+2+18, d->rr_len[i]-2-18))
 832                                 continue;
 833                         if(query_dname_compare(name, d->rr_data[i]+2+18) == 0)
 834                         {
 835                                 return 1;
 836                         }
 837                 }
 838         }
 839         return 0;
 840 }
 841
 842 void
 843 val_fill_reply(struct reply_info* chase, struct reply_info* orig,
 844         size_t skip, uint8_t* name, size_t len, uint8_t* signer)
 845 {
 846         size_t i;
 847         int seen_dname = 0;
 848         chase->rrset_count = 0;
 849         chase->an_numrrsets = 0;
 850         chase->ns_numrrsets = 0;
 851         chase->ar_numrrsets = 0;
 852         /* ANSWER section */
 853         for(i=skip; i<orig->an_numrrsets; i++) {
 854                 if(!signer) {
 855                         if(query_dname_compare(name,
 856                                 orig->rrsets[i]->rk.dname) == 0)
 857                                 chase->rrsets[chase->an_numrrsets++] =
 858                                         orig->rrsets[i];
 859                 } else if(seen_dname && ntohs(orig->rrsets[i]->rk.type) ==
 860                         LDNS_RR_TYPE_CNAME) {
 861                         chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i];
 862                         seen_dname = 0;
 863                 } else if(rrset_has_signer(orig->rrsets[i], name, len)) {
 864                         chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i];
 865                         if(ntohs(orig->rrsets[i]->rk.type) ==
 866                                 LDNS_RR_TYPE_DNAME) {
 867                                         seen_dname = 1;
 868                         }
 869                 }
 870         }
 871         /* AUTHORITY section */
 872         for(i = (skip > orig->an_numrrsets)?skip:orig->an_numrrsets;
 873                 i<orig->an_numrrsets+orig->ns_numrrsets;
 874                 i++) {
 875                 if(!signer) {
 876                         if(query_dname_compare(name,
 877                                 orig->rrsets[i]->rk.dname) == 0)
 878                                 chase->rrsets[chase->an_numrrsets+
 879                                     chase->ns_numrrsets++] = orig->rrsets[i];
 880                 } else if(rrset_has_signer(orig->rrsets[i], name, len)) {
 881                         chase->rrsets[chase->an_numrrsets+
 882                                 chase->ns_numrrsets++] = orig->rrsets[i];
 883                 }
 884         }
 885         /* ADDITIONAL section */
 886         for(i= (skip>orig->an_numrrsets+orig->ns_numrrsets)?
 887                 skip:orig->an_numrrsets+orig->ns_numrrsets;
 888                 i<orig->rrset_count; i++) {
 889                 if(!signer) {
 890                         if(query_dname_compare(name,
 891                                 orig->rrsets[i]->rk.dname) == 0)
 892                             chase->rrsets[chase->an_numrrsets
 893                                 +orig->ns_numrrsets+chase->ar_numrrsets++]
 894                                 = orig->rrsets[i];
 895                 } else if(rrset_has_signer(orig->rrsets[i], name, len)) {
 896                         chase->rrsets[chase->an_numrrsets+orig->ns_numrrsets+
 897                                 chase->ar_numrrsets++] = orig->rrsets[i];
 898                 }
 899         }
 900         chase->rrset_count = chase->an_numrrsets + chase->ns_numrrsets +
 901                 chase->ar_numrrsets;
 902 }
 903
 904 void val_reply_remove_auth(struct reply_info* rep, size_t index)
 905 {
 906         log_assert(index < rep->rrset_count);
 907         log_assert(index >= rep->an_numrrsets);
 908         log_assert(index < rep->an_numrrsets+rep->ns_numrrsets);
 909         memmove(rep->rrsets+index, rep->rrsets+index+1,
 910                 sizeof(struct ub_packed_rrset_key*)*
 911                 (rep->rrset_count - index - 1));
 912         rep->ns_numrrsets--;
 913         rep->rrset_count--;
 914 }
 915
 916 void
 917 val_check_nonsecure(struct val_env* ve, struct reply_info* rep)
 918 {
 919         size_t i;
 920         /* authority */
 921         for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
 922                 if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
 923                         ->security != sec_status_secure) {
 924                         /* because we want to return the authentic original
 925                          * message when presented with CD-flagged queries,
 926                          * we need to preserve AUTHORITY section data.
 927                          * However, this rrset is not signed or signed
 928                          * with the wrong keys. Validation has tried to
 929                          * verify this rrset with the keysets of import.
 930                          * But this rrset did not verify.
 931                          * Therefore the message is bogus.
 932                          */
 933
 934                         /* check if authority consists of only an NS record
 935                          * which is bad, and there is an answer section with
 936                          * data.  In that case, delete NS and additional to
 937                          * be lenient and make a minimal response */
 938                         if(rep->an_numrrsets != 0 && rep->ns_numrrsets == 1 &&
 939                                 ntohs(rep->rrsets[i]->rk.type)
 940                                 == LDNS_RR_TYPE_NS) {
 941                                 verbose(VERB_ALGO, "truncate to minimal");
 942                                 rep->ns_numrrsets = 0;
 943                                 rep->ar_numrrsets = 0;
 944                                 rep->rrset_count = rep->an_numrrsets;
 945                                 return;
 946                         }
 947
 948                         log_nametypeclass(VERB_QUERY, "message is bogus, "
 949                                 "non secure rrset",
 950                                 rep->rrsets[i]->rk.dname,
 951                                 ntohs(rep->rrsets[i]->rk.type),
 952                                 ntohs(rep->rrsets[i]->rk.rrset_class));
 953                         rep->security = sec_status_bogus;
 954                         return;
 955                 }
 956         }
 957         /* additional */
 958         if(!ve->clean_additional)
 959                 return;
 960         for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) {
 961                 if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
 962                         ->security != sec_status_secure) {
 963                         /* This does not cause message invalidation. It was
 964                          * simply unsigned data in the additional. The
 965                          * RRSIG must have been truncated off the message.
 966                          *
 967                          * However, we do not want to return possible bogus
 968                          * data to clients that rely on this service for
 969                          * their authentication.
 970                          */
 971                         /* remove this unneeded additional rrset */
 972                         memmove(rep->rrsets+i, rep->rrsets+i+1,
 973                                 sizeof(struct ub_packed_rrset_key*)*
 974                                 (rep->rrset_count - i - 1));
 975                         rep->ar_numrrsets--;
 976                         rep->rrset_count--;
 977                         i--;
 978                 }
 979         }
 980 }
 981
 982 /** check no anchor and unlock */
 983 static int
 984 check_no_anchor(struct val_anchors* anchors, uint8_t* nm, size_t l, uint16_t c)
 985 {
 986         struct trust_anchor* ta;
 987         if((ta=anchors_lookup(anchors, nm, l, c))) {
 988                 lock_basic_unlock(&ta->lock);
 989         }
 990         return !ta;
 991 }
 992
 993 void
 994 val_mark_indeterminate(struct reply_info* rep, struct val_anchors* anchors,
 995         struct rrset_cache* r, struct module_env* env)
 996 {
 997         size_t i;
 998         struct packed_rrset_data* d;
 999         for(i=0; i<rep->rrset_count; i++) {
1000                 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1001                 if(d->security == sec_status_unchecked &&
1002                    check_no_anchor(anchors, rep->rrsets[i]->rk.dname,
1003                         rep->rrsets[i]->rk.dname_len,
1004                         ntohs(rep->rrsets[i]->rk.rrset_class)))
1005                 {
1006                         /* mark as indeterminate */
1007                         d->security = sec_status_indeterminate;
1008                         rrset_update_sec_status(r, rep->rrsets[i], *env->now);
1009                 }
1010         }
1011 }
1012
1013 void
1014 val_mark_insecure(struct reply_info* rep, uint8_t* kname,
1015         struct rrset_cache* r, struct module_env* env)
1016 {
1017         size_t i;
1018         struct packed_rrset_data* d;
1019         for(i=0; i<rep->rrset_count; i++) {
1020                 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1021                 if(d->security == sec_status_unchecked &&
1022                    dname_subdomain_c(rep->rrsets[i]->rk.dname, kname)) {
1023                         /* mark as insecure */
1024                         d->security = sec_status_insecure;
1025                         rrset_update_sec_status(r, rep->rrsets[i], *env->now);
1026                 }
1027         }
1028 }
1029
1030 size_t
1031 val_next_unchecked(struct reply_info* rep, size_t skip)
1032 {
1033         size_t i;
1034         struct packed_rrset_data* d;
1035         for(i=skip+1; i<rep->rrset_count; i++) {
1036                 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1037                 if(d->security == sec_status_unchecked) {
1038                         return i;
1039                 }
1040         }
1041         return rep->rrset_count;
1042 }
1043
1044 const char*
1045 val_classification_to_string(enum val_classification subtype)
1046 {
1047         switch(subtype) {
1048                 case VAL_CLASS_UNTYPED:         return "untyped";
1049                 case VAL_CLASS_UNKNOWN:         return "unknown";
1050                 case VAL_CLASS_POSITIVE:        return "positive";
1051                 case VAL_CLASS_CNAME:           return "cname";
1052                 case VAL_CLASS_NODATA:          return "nodata";
1053                 case VAL_CLASS_NAMEERROR:       return "nameerror";
1054                 case VAL_CLASS_CNAMENOANSWER:   return "cnamenoanswer";
1055                 case VAL_CLASS_REFERRAL:        return "referral";
1056                 case VAL_CLASS_ANY:             return "qtype_any";
1057                 default:
1058                         return "bad_val_classification";
1059         }
1060 }
1061
1062 /** log a sock_list entry */
1063 static void
1064 sock_list_logentry(enum verbosity_value v, const char* s, struct sock_list* p)
1065 {
1066         if(p->len)
1067                 log_addr(v, s, &p->addr, p->len);
1068         else    verbose(v, "%s cache", s);
1069 }
1070
1071 void val_blacklist(struct sock_list** blacklist, struct regional* region,
1072         struct sock_list* origin, int cross)
1073 {
1074         /* debug printout */
1075         if(verbosity >= VERB_ALGO) {
1076                 struct sock_list* p;
1077                 for(p=*blacklist; p; p=p->next)
1078                         sock_list_logentry(VERB_ALGO, "blacklist", p);
1079                 if(!origin)
1080                         verbose(VERB_ALGO, "blacklist add: cache");
1081                 for(p=origin; p; p=p->next)
1082                         sock_list_logentry(VERB_ALGO, "blacklist add", p);
1083         }
1084         /* blacklist the IPs or the cache */
1085         if(!origin) {
1086                 /* only add if nothing there. anything else also stops cache*/
1087                 if(!*blacklist)
1088                         sock_list_insert(blacklist, NULL, 0, region);
1089         } else if(!cross)
1090                 sock_list_prepend(blacklist, origin);
1091         else    sock_list_merge(blacklist, region, origin);
1092 }
1093
1094 int val_has_signed_nsecs(struct reply_info* rep, char** reason)
1095 {
1096         size_t i, num_nsec = 0, num_nsec3 = 0;
1097         struct packed_rrset_data* d;
1098         for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
1099                 if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC))
1100                         num_nsec++;
1101                 else if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC3))
1102                         num_nsec3++;
1103                 else continue;
1104                 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1105                 if(d && d->rrsig_count != 0) {
1106                         return 1;
1107                 }
1108         }
1109         if(num_nsec == 0 && num_nsec3 == 0)
1110                 *reason = "no DNSSEC records";
1111         else if(num_nsec != 0)
1112                 *reason = "no signatures over NSECs";
1113         else    *reason = "no signatures over NSEC3s";
1114         return 0;
1115 }
1116
1117 struct dns_msg*
1118 val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c,
1119         struct regional* region, uint8_t* topname)
1120 {
1121         struct dns_msg* msg;
1122         struct query_info qinfo;
1123         struct ub_packed_rrset_key *rrset = rrset_cache_lookup(
1124                 env->rrset_cache, nm, nmlen, LDNS_RR_TYPE_DS, c, 0,
1125                 *env->now, 0);
1126         if(rrset) {
1127                 /* DS rrset exists. Return it to the validator immediately*/
1128                 struct ub_packed_rrset_key* copy = packed_rrset_copy_region(
1129                         rrset, region, *env->now);
1130                 lock_rw_unlock(&rrset->entry.lock);
1131                 if(!copy)
1132                         return NULL;
1133                 msg = dns_msg_create(nm, nmlen, LDNS_RR_TYPE_DS, c, region, 1);
1134                 if(!msg)
1135                         return NULL;
1136                 msg->rep->rrsets[0] = copy;
1137                 msg->rep->rrset_count++;
1138                 msg->rep->an_numrrsets++;
1139                 return msg;
1140         }
1141         /* lookup in rrset and negative cache for NSEC/NSEC3 */
1142         qinfo.qname = nm;
1143         qinfo.qname_len = nmlen;
1144         qinfo.qtype = LDNS_RR_TYPE_DS;
1145         qinfo.qclass = c;
1146         qinfo.local_alias = NULL;
1147         /* do not add SOA to reply message, it is going to be used internal */
1148         msg = val_neg_getmsg(env->neg_cache, &qinfo, region, env->rrset_cache,
1149                 env->scratch_buffer, *env->now, 0, topname);
1150         return msg;
1151 }