contrib/unbound/validator/autotrust.c

   1 /*
   2  * validator/autotrust.c - RFC5011 trust anchor management for unbound.
   3  *
   4  * Copyright (c) 2009, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * Contains autotrust implementation. The implementation was taken from
  40  * the autotrust daemon (BSD licensed), written by Matthijs Mekking.
  41  * It was modified to fit into unbound. The state table process is the same.
  42  */
  43 #include "config.h"
  44 #include "validator/autotrust.h"
  45 #include "validator/val_anchor.h"
  46 #include "validator/val_utils.h"
  47 #include "validator/val_sigcrypt.h"
  48 #include "util/data/dname.h"
  49 #include "util/data/packed_rrset.h"
  50 #include "util/log.h"
  51 #include "util/module.h"
  52 #include "util/net_help.h"
  53 #include "util/config_file.h"
  54 #include "util/regional.h"
  55 #include "util/random.h"
  56 #include "util/data/msgparse.h"
  57 #include "services/mesh.h"
  58 #include "services/cache/rrset.h"
  59 #include "validator/val_kcache.h"
  60 #include "sldns/sbuffer.h"
  61 #include "sldns/wire2str.h"
  62 #include "sldns/str2wire.h"
  63 #include "sldns/keyraw.h"
  64 #include "sldns/rrdef.h"
  65 #include <stdarg.h>
  66 #include <ctype.h>
  67
  68 /** number of times a key must be seen before it can become valid */
  69 #define MIN_PENDINGCOUNT 2
  70
  71 /** Event: Revoked */
  72 static void do_revoked(struct module_env* env, struct autr_ta* anchor, int* c);
  73
  74 struct autr_global_data* autr_global_create(void)
  75 {
  76         struct autr_global_data* global;
  77         global = (struct autr_global_data*)malloc(sizeof(*global));
  78         if(!global)
  79                 return NULL;
  80         rbtree_init(&global->probe, &probetree_cmp);
  81         return global;
  82 }
  83
  84 void autr_global_delete(struct autr_global_data* global)
  85 {
  86         if(!global)
  87                 return;
  88         /* elements deleted by parent */
  89         free(global);
  90 }
  91
  92 int probetree_cmp(const void* x, const void* y)
  93 {
  94         struct trust_anchor* a = (struct trust_anchor*)x;
  95         struct trust_anchor* b = (struct trust_anchor*)y;
  96         log_assert(a->autr && b->autr);
  97         if(a->autr->next_probe_time < b->autr->next_probe_time)
  98                 return -1;
  99         if(a->autr->next_probe_time > b->autr->next_probe_time)
 100                 return 1;
 101         /* time is equal, sort on trust point identity */
 102         return anchor_cmp(x, y);
 103 }
 104
 105 size_t
 106 autr_get_num_anchors(struct val_anchors* anchors)
 107 {
 108         size_t res = 0;
 109         if(!anchors)
 110                 return 0;
 111         lock_basic_lock(&anchors->lock);
 112         if(anchors->autr)
 113                 res = anchors->autr->probe.count;
 114         lock_basic_unlock(&anchors->lock);
 115         return res;
 116 }
 117
 118 /** Position in string */
 119 static int
 120 position_in_string(char *str, const char* sub)
 121 {
 122         char* pos = strstr(str, sub);
 123         if(pos)
 124                 return (int)(pos-str)+(int)strlen(sub);
 125         return -1;
 126 }
 127
 128 /** Debug routine to print pretty key information */
 129 static void
 130 verbose_key(struct autr_ta* ta, enum verbosity_value level,
 131         const char* format, ...) ATTR_FORMAT(printf, 3, 4);
 132
 133 /**
 134  * Implementation of debug pretty key print
 135  * @param ta: trust anchor key with DNSKEY data.
 136  * @param level: verbosity level to print at.
 137  * @param format: printf style format string.
 138  */
 139 static void
 140 verbose_key(struct autr_ta* ta, enum verbosity_value level,
 141         const char* format, ...)
 142 {
 143         va_list args;
 144         va_start(args, format);
 145         if(verbosity >= level) {
 146                 char* str = sldns_wire2str_dname(ta->rr, ta->dname_len);
 147                 int keytag = (int)sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
 148                         ta->rr, ta->rr_len, ta->dname_len),
 149                         sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
 150                         ta->dname_len));
 151                 char msg[MAXSYSLOGMSGLEN];
 152                 vsnprintf(msg, sizeof(msg), format, args);
 153                 verbose(level, "%s key %d %s", str?str:"??", keytag, msg);
 154                 free(str);
 155         }
 156         va_end(args);
 157 }
 158
 159 /**
 160  * Parse comments
 161  * @param str: to parse
 162  * @param ta: trust key autotrust metadata
 163  * @return false on failure.
 164  */
 165 static int
 166 parse_comments(char* str, struct autr_ta* ta)
 167 {
 168         int len = (int)strlen(str), pos = 0, timestamp = 0;
 169         char* comment = (char*) malloc(sizeof(char)*len+1);
 170         char* comments = comment;
 171         if(!comment) {
 172                 log_err("malloc failure in parse");
 173                 return 0;
 174         }
 175         /* skip over whitespace and data at start of line */
 176         while (*str != '\0' && *str != ';')
 177                 str++;
 178         if (*str == ';')
 179                 str++;
 180         /* copy comments */
 181         while (*str != '\0')
 182         {
 183                 *comments = *str;
 184                 comments++;
 185                 str++;
 186         }
 187         *comments = '\0';
 188
 189         comments = comment;
 190
 191         /* read state */
 192         pos = position_in_string(comments, "state=");
 193         if (pos >= (int) strlen(comments))
 194         {
 195                 log_err("parse error");
 196                 free(comment);
 197                 return 0;
 198         }
 199         if (pos <= 0)
 200                 ta->s = AUTR_STATE_VALID;
 201         else
 202         {
 203                 int s = (int) comments[pos] - '0';
 204                 switch(s)
 205                 {
 206                         case AUTR_STATE_START:
 207                         case AUTR_STATE_ADDPEND:
 208                         case AUTR_STATE_VALID:
 209                         case AUTR_STATE_MISSING:
 210                         case AUTR_STATE_REVOKED:
 211                         case AUTR_STATE_REMOVED:
 212                                 ta->s = s;
 213                                 break;
 214                         default:
 215                                 verbose_key(ta, VERB_OPS, "has undefined "
 216                                         "state, considered NewKey");
 217                                 ta->s = AUTR_STATE_START;
 218                                 break;
 219                 }
 220         }
 221         /* read pending count */
 222         pos = position_in_string(comments, "count=");
 223         if (pos >= (int) strlen(comments))
 224         {
 225                 log_err("parse error");
 226                 free(comment);
 227                 return 0;
 228         }
 229         if (pos <= 0)
 230                 ta->pending_count = 0;
 231         else
 232         {
 233                 comments += pos;
 234                 ta->pending_count = (uint8_t)atoi(comments);
 235         }
 236
 237         /* read last change */
 238         pos = position_in_string(comments, "lastchange=");
 239         if (pos >= (int) strlen(comments))
 240         {
 241                 log_err("parse error");
 242                 free(comment);
 243                 return 0;
 244         }
 245         if (pos >= 0)
 246         {
 247                 comments += pos;
 248                 timestamp = atoi(comments);
 249         }
 250         if (pos < 0 || !timestamp)
 251                 ta->last_change = 0;
 252         else
 253                 ta->last_change = (time_t)timestamp;
 254
 255         free(comment);
 256         return 1;
 257 }
 258
 259 /** Check if a line contains data (besides comments) */
 260 static int
 261 str_contains_data(char* str, char comment)
 262 {
 263         while (*str != '\0') {
 264                 if (*str == comment || *str == '\n')
 265                         return 0;
 266                 if (*str != ' ' && *str != '\t')
 267                         return 1;
 268                 str++;
 269         }
 270         return 0;
 271 }
 272
 273 /** Get DNSKEY flags
 274  * rdata without rdatalen in front of it. */
 275 static int
 276 dnskey_flags(uint16_t t, uint8_t* rdata, size_t len)
 277 {
 278         uint16_t f;
 279         if(t != LDNS_RR_TYPE_DNSKEY)
 280                 return 0;
 281         if(len < 2)
 282                 return 0;
 283         memmove(&f, rdata, 2);
 284         f = ntohs(f);
 285         return (int)f;
 286 }
 287
 288 /** Check if KSK DNSKEY.
 289  * pass rdata without rdatalen in front of it */
 290 static int
 291 rr_is_dnskey_sep(uint16_t t, uint8_t* rdata, size_t len)
 292 {
 293         return (dnskey_flags(t, rdata, len)&DNSKEY_BIT_SEP);
 294 }
 295
 296 /** Check if TA is KSK DNSKEY */
 297 static int
 298 ta_is_dnskey_sep(struct autr_ta* ta)
 299 {
 300         return (dnskey_flags(
 301                 sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len),
 302                 sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len),
 303                 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len)
 304                 ) & DNSKEY_BIT_SEP);
 305 }
 306
 307 /** Check if REVOKED DNSKEY
 308  * pass rdata without rdatalen in front of it */
 309 static int
 310 rr_is_dnskey_revoked(uint16_t t, uint8_t* rdata, size_t len)
 311 {
 312         return (dnskey_flags(t, rdata, len)&LDNS_KEY_REVOKE_KEY);
 313 }
 314
 315 /** create ta */
 316 static struct autr_ta*
 317 autr_ta_create(uint8_t* rr, size_t rr_len, size_t dname_len)
 318 {
 319         struct autr_ta* ta = (struct autr_ta*)calloc(1, sizeof(*ta));
 320         if(!ta) {
 321                 free(rr);
 322                 return NULL;
 323         }
 324         ta->rr = rr;
 325         ta->rr_len = rr_len;
 326         ta->dname_len = dname_len;
 327         return ta;
 328 }
 329
 330 /** create tp */
 331 static struct trust_anchor*
 332 autr_tp_create(struct val_anchors* anchors, uint8_t* own, size_t own_len,
 333         uint16_t dc)
 334 {
 335         struct trust_anchor* tp = (struct trust_anchor*)calloc(1, sizeof(*tp));
 336         if(!tp) return NULL;
 337         tp->name = memdup(own, own_len);
 338         if(!tp->name) {
 339                 free(tp);
 340                 return NULL;
 341         }
 342         tp->namelen = own_len;
 343         tp->namelabs = dname_count_labels(tp->name);
 344         tp->node.key = tp;
 345         tp->dclass = dc;
 346         tp->autr = (struct autr_point_data*)calloc(1, sizeof(*tp->autr));
 347         if(!tp->autr) {
 348                 free(tp->name);
 349                 free(tp);
 350                 return NULL;
 351         }
 352         tp->autr->pnode.key = tp;
 353
 354         lock_basic_lock(&anchors->lock);
 355         if(!rbtree_insert(anchors->tree, &tp->node)) {
 356                 lock_basic_unlock(&anchors->lock);
 357                 log_err("trust anchor presented twice");
 358                 free(tp->name);
 359                 free(tp->autr);
 360                 free(tp);
 361                 return NULL;
 362         }
 363         if(!rbtree_insert(&anchors->autr->probe, &tp->autr->pnode)) {
 364                 (void)rbtree_delete(anchors->tree, tp);
 365                 lock_basic_unlock(&anchors->lock);
 366                 log_err("trust anchor in probetree twice");
 367                 free(tp->name);
 368                 free(tp->autr);
 369                 free(tp);
 370                 return NULL;
 371         }
 372         lock_basic_init(&tp->lock);
 373         lock_protect(&tp->lock, tp, sizeof(*tp));
 374         lock_protect(&tp->lock, tp->autr, sizeof(*tp->autr));
 375         lock_basic_unlock(&anchors->lock);
 376         return tp;
 377 }
 378
 379 /** delete assembled rrsets */
 380 static void
 381 autr_rrset_delete(struct ub_packed_rrset_key* r)
 382 {
 383         if(r) {
 384                 free(r->rk.dname);
 385                 free(r->entry.data);
 386                 free(r);
 387         }
 388 }
 389
 390 void autr_point_delete(struct trust_anchor* tp)
 391 {
 392         if(!tp)
 393                 return;
 394         lock_unprotect(&tp->lock, tp);
 395         lock_unprotect(&tp->lock, tp->autr);
 396         lock_basic_destroy(&tp->lock);
 397         autr_rrset_delete(tp->ds_rrset);
 398         autr_rrset_delete(tp->dnskey_rrset);
 399         if(tp->autr) {
 400                 struct autr_ta* p = tp->autr->keys, *np;
 401                 while(p) {
 402                         np = p->next;
 403                         free(p->rr);
 404                         free(p);
 405                         p = np;
 406                 }
 407                 free(tp->autr->file);
 408                 free(tp->autr);
 409         }
 410         free(tp->name);
 411         free(tp);
 412 }
 413
 414 /** find or add a new trust point for autotrust */
 415 static struct trust_anchor*
 416 find_add_tp(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
 417         size_t dname_len)
 418 {
 419         struct trust_anchor* tp;
 420         tp = anchor_find(anchors, rr, dname_count_labels(rr), dname_len,
 421                 sldns_wirerr_get_class(rr, rr_len, dname_len));
 422         if(tp) {
 423                 if(!tp->autr) {
 424                         log_err("anchor cannot be with and without autotrust");
 425                         lock_basic_unlock(&tp->lock);
 426                         return NULL;
 427                 }
 428                 return tp;
 429         }
 430         tp = autr_tp_create(anchors, rr, dname_len, sldns_wirerr_get_class(rr,
 431                 rr_len, dname_len));
 432         if(!tp)
 433                 return NULL;
 434         lock_basic_lock(&tp->lock);
 435         return tp;
 436 }
 437
 438 /** Add trust anchor from RR */
 439 static struct autr_ta*
 440 add_trustanchor_frm_rr(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
 441         size_t dname_len, struct trust_anchor** tp)
 442 {
 443         struct autr_ta* ta = autr_ta_create(rr, rr_len, dname_len);
 444         if(!ta)
 445                 return NULL;
 446         *tp = find_add_tp(anchors, rr, rr_len, dname_len);
 447         if(!*tp) {
 448                 free(ta->rr);
 449                 free(ta);
 450                 return NULL;
 451         }
 452         /* add ta to tp */
 453         ta->next = (*tp)->autr->keys;
 454         (*tp)->autr->keys = ta;
 455         lock_basic_unlock(&(*tp)->lock);
 456         return ta;
 457 }
 458
 459 /**
 460  * Add new trust anchor from a string in file.
 461  * @param anchors: all anchors
 462  * @param str: string with anchor and comments, if any comments.
 463  * @param tp: trust point returned.
 464  * @param origin: what to use for @
 465  * @param origin_len: length of origin
 466  * @param prev: previous rr name
 467  * @param prev_len: length of prev
 468  * @param skip: if true, the result is NULL, but not an error, skip it.
 469  * @return new key in trust point.
 470  */
 471 static struct autr_ta*
 472 add_trustanchor_frm_str(struct val_anchors* anchors, char* str,
 473         struct trust_anchor** tp, uint8_t* origin, size_t origin_len,
 474         uint8_t** prev, size_t* prev_len, int* skip)
 475 {
 476         uint8_t rr[LDNS_RR_BUF_SIZE];
 477         size_t rr_len = sizeof(rr), dname_len;
 478         uint8_t* drr;
 479         int lstatus;
 480         if (!str_contains_data(str, ';')) {
 481                 *skip = 1;
 482                 return NULL; /* empty line */
 483         }
 484         if(0 != (lstatus = sldns_str2wire_rr_buf(str, rr, &rr_len, &dname_len,
 485                 0, origin, origin_len, *prev, *prev_len)))
 486         {
 487                 log_err("ldns error while converting string to RR at%d: %s: %s",
 488                         LDNS_WIREPARSE_OFFSET(lstatus),
 489                         sldns_get_errorstr_parse(lstatus), str);
 490                 return NULL;
 491         }
 492         free(*prev);
 493         *prev = memdup(rr, dname_len);
 494         *prev_len = dname_len;
 495         if(!*prev) {
 496                 log_err("malloc failure in add_trustanchor");
 497                 return NULL;
 498         }
 499         if(sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DNSKEY &&
 500                 sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DS) {
 501                 *skip = 1;
 502                 return NULL; /* only DS and DNSKEY allowed */
 503         }
 504         drr = memdup(rr, rr_len);
 505         if(!drr) {
 506                 log_err("malloc failure in add trustanchor");
 507                 return NULL;
 508         }
 509         return add_trustanchor_frm_rr(anchors, drr, rr_len, dname_len, tp);
 510 }
 511
 512 /**
 513  * Load single anchor
 514  * @param anchors: all points.
 515  * @param str: comments line
 516  * @param fname: filename
 517  * @param origin: the $ORIGIN.
 518  * @param origin_len: length of origin
 519  * @param prev: passed to ldns.
 520  * @param prev_len: length of prev
 521  * @param skip: if true, the result is NULL, but not an error, skip it.
 522  * @return false on failure, otherwise the tp read.
 523  */
 524 static struct trust_anchor*
 525 load_trustanchor(struct val_anchors* anchors, char* str, const char* fname,
 526         uint8_t* origin, size_t origin_len, uint8_t** prev, size_t* prev_len,
 527         int* skip)
 528 {
 529         struct autr_ta* ta = NULL;
 530         struct trust_anchor* tp = NULL;
 531
 532         ta = add_trustanchor_frm_str(anchors, str, &tp, origin, origin_len,
 533                 prev, prev_len, skip);
 534         if(!ta)
 535                 return NULL;
 536         lock_basic_lock(&tp->lock);
 537         if(!parse_comments(str, ta)) {
 538                 lock_basic_unlock(&tp->lock);
 539                 return NULL;
 540         }
 541         if(!tp->autr->file) {
 542                 tp->autr->file = strdup(fname);
 543                 if(!tp->autr->file) {
 544                         lock_basic_unlock(&tp->lock);
 545                         log_err("malloc failure");
 546                         return NULL;
 547                 }
 548         }
 549         lock_basic_unlock(&tp->lock);
 550         return tp;
 551 }
 552
 553 /** iterator for DSes from keylist. return true if a next element exists */
 554 static int
 555 assemble_iterate_ds(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
 556         size_t* dname_len)
 557 {
 558         while(*list) {
 559                 if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
 560                         (*list)->dname_len) == LDNS_RR_TYPE_DS) {
 561                         *rr = (*list)->rr;
 562                         *rr_len = (*list)->rr_len;
 563                         *dname_len = (*list)->dname_len;
 564                         *list = (*list)->next;
 565                         return 1;
 566                 }
 567                 *list = (*list)->next;
 568         }
 569         return 0;
 570 }
 571
 572 /** iterator for DNSKEYs from keylist. return true if a next element exists */
 573 static int
 574 assemble_iterate_dnskey(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
 575         size_t* dname_len)
 576 {
 577         while(*list) {
 578                 if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
 579                    (*list)->dname_len) != LDNS_RR_TYPE_DS &&
 580                         ((*list)->s == AUTR_STATE_VALID ||
 581                          (*list)->s == AUTR_STATE_MISSING)) {
 582                         *rr = (*list)->rr;
 583                         *rr_len = (*list)->rr_len;
 584                         *dname_len = (*list)->dname_len;
 585                         *list = (*list)->next;
 586                         return 1;
 587                 }
 588                 *list = (*list)->next;
 589         }
 590         return 0;
 591 }
 592
 593 /** see if iterator-list has any elements in it, or it is empty */
 594 static int
 595 assemble_iterate_hasfirst(int iter(struct autr_ta**, uint8_t**, size_t*,
 596         size_t*), struct autr_ta* list)
 597 {
 598         uint8_t* rr = NULL;
 599         size_t rr_len = 0, dname_len = 0;
 600         return iter(&list, &rr, &rr_len, &dname_len);
 601 }
 602
 603 /** number of elements in iterator list */
 604 static size_t
 605 assemble_iterate_count(int iter(struct autr_ta**, uint8_t**, size_t*,
 606         size_t*), struct autr_ta* list)
 607 {
 608         uint8_t* rr = NULL;
 609         size_t i = 0, rr_len = 0, dname_len = 0;
 610         while(iter(&list, &rr, &rr_len, &dname_len)) {
 611                 i++;
 612         }
 613         return i;
 614 }
 615
 616 /**
 617  * Create a ub_packed_rrset_key allocated on the heap.
 618  * It therefore does not have the correct ID value, and cannot be used
 619  * inside the cache.  It can be used in storage outside of the cache.
 620  * Keys for the cache have to be obtained from alloc.h .
 621  * @param iter: iterator over the elements in the list.  It filters elements.
 622  * @param list: the list.
 623  * @return key allocated or NULL on failure.
 624  */
 625 static struct ub_packed_rrset_key*
 626 ub_packed_rrset_heap_key(int iter(struct autr_ta**, uint8_t**, size_t*,
 627         size_t*), struct autr_ta* list)
 628 {
 629         uint8_t* rr = NULL;
 630         size_t rr_len = 0, dname_len = 0;
 631         struct ub_packed_rrset_key* k;
 632         if(!iter(&list, &rr, &rr_len, &dname_len))
 633                 return NULL;
 634         k = (struct ub_packed_rrset_key*)calloc(1, sizeof(*k));
 635         if(!k)
 636                 return NULL;
 637         k->rk.type = htons(sldns_wirerr_get_type(rr, rr_len, dname_len));
 638         k->rk.rrset_class = htons(sldns_wirerr_get_class(rr, rr_len, dname_len));
 639         k->rk.dname_len = dname_len;
 640         k->rk.dname = memdup(rr, dname_len);
 641         if(!k->rk.dname) {
 642                 free(k);
 643                 return NULL;
 644         }
 645         return k;
 646 }
 647
 648 /**
 649  * Create packed_rrset data on the heap.
 650  * @param iter: iterator over the elements in the list.  It filters elements.
 651  * @param list: the list.
 652  * @return data allocated or NULL on failure.
 653  */
 654 static struct packed_rrset_data*
 655 packed_rrset_heap_data(int iter(struct autr_ta**, uint8_t**, size_t*,
 656         size_t*), struct autr_ta* list)
 657 {
 658         uint8_t* rr = NULL;
 659         size_t rr_len = 0, dname_len = 0;
 660         struct packed_rrset_data* data;
 661         size_t count=0, rrsig_count=0, len=0, i, total;
 662         uint8_t* nextrdata;
 663         struct autr_ta* list_i;
 664         time_t ttl = 0;
 665
 666         list_i = list;
 667         while(iter(&list_i, &rr, &rr_len, &dname_len)) {
 668                 if(sldns_wirerr_get_type(rr, rr_len, dname_len) ==
 669                         LDNS_RR_TYPE_RRSIG)
 670                         rrsig_count++;
 671                 else    count++;
 672                 /* sizeof the rdlength + rdatalen */
 673                 len += 2 + sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
 674                 ttl = (time_t)sldns_wirerr_get_ttl(rr, rr_len, dname_len);
 675         }
 676         if(count == 0 && rrsig_count == 0)
 677                 return NULL;
 678
 679         /* allocate */
 680         total = count + rrsig_count;
 681         len += sizeof(*data) + total*(sizeof(size_t) + sizeof(time_t) +
 682                 sizeof(uint8_t*));
 683         data = (struct packed_rrset_data*)calloc(1, len);
 684         if(!data)
 685                 return NULL;
 686
 687         /* fill it */
 688         data->ttl = ttl;
 689         data->count = count;
 690         data->rrsig_count = rrsig_count;
 691         data->rr_len = (size_t*)((uint8_t*)data +
 692                 sizeof(struct packed_rrset_data));
 693         data->rr_data = (uint8_t**)&(data->rr_len[total]);
 694         data->rr_ttl = (time_t*)&(data->rr_data[total]);
 695         nextrdata = (uint8_t*)&(data->rr_ttl[total]);
 696
 697         /* fill out len, ttl, fields */
 698         list_i = list;
 699         i = 0;
 700         while(iter(&list_i, &rr, &rr_len, &dname_len)) {
 701                 data->rr_ttl[i] = (time_t)sldns_wirerr_get_ttl(rr, rr_len,
 702                         dname_len);
 703                 if(data->rr_ttl[i] < data->ttl)
 704                         data->ttl = data->rr_ttl[i];
 705                 data->rr_len[i] = 2 /* the rdlength */ +
 706                         sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
 707                 i++;
 708         }
 709
 710         /* fixup rest of ptrs */
 711         for(i=0; i<total; i++) {
 712                 data->rr_data[i] = nextrdata;
 713                 nextrdata += data->rr_len[i];
 714         }
 715
 716         /* copy data in there */
 717         list_i = list;
 718         i = 0;
 719         while(iter(&list_i, &rr, &rr_len, &dname_len)) {
 720                 log_assert(data->rr_data[i]);
 721                 memmove(data->rr_data[i],
 722                         sldns_wirerr_get_rdatawl(rr, rr_len, dname_len),
 723                         data->rr_len[i]);
 724                 i++;
 725         }
 726
 727         if(data->rrsig_count && data->count == 0) {
 728                 data->count = data->rrsig_count; /* rrset type is RRSIG */
 729                 data->rrsig_count = 0;
 730         }
 731         return data;
 732 }
 733
 734 /**
 735  * Assemble the trust anchors into DS and DNSKEY packed rrsets.
 736  * Uses only VALID and MISSING DNSKEYs.
 737  * Read the sldns_rrs and builds packed rrsets
 738  * @param tp: the trust point. Must be locked.
 739  * @return false on malloc failure.
 740  */
 741 static int
 742 autr_assemble(struct trust_anchor* tp)
 743 {
 744         struct ub_packed_rrset_key* ubds=NULL, *ubdnskey=NULL;
 745
 746         /* make packed rrset keys - malloced with no ID number, they
 747          * are not in the cache */
 748         /* make packed rrset data (if there is a key) */
 749         if(assemble_iterate_hasfirst(assemble_iterate_ds, tp->autr->keys)) {
 750                 ubds = ub_packed_rrset_heap_key(
 751                         assemble_iterate_ds, tp->autr->keys);
 752                 if(!ubds)
 753                         goto error_cleanup;
 754                 ubds->entry.data = packed_rrset_heap_data(
 755                         assemble_iterate_ds, tp->autr->keys);
 756                 if(!ubds->entry.data)
 757                         goto error_cleanup;
 758         }
 759
 760         /* make packed DNSKEY data */
 761         if(assemble_iterate_hasfirst(assemble_iterate_dnskey, tp->autr->keys)) {
 762                 ubdnskey = ub_packed_rrset_heap_key(
 763                         assemble_iterate_dnskey, tp->autr->keys);
 764                 if(!ubdnskey)
 765                         goto error_cleanup;
 766                 ubdnskey->entry.data = packed_rrset_heap_data(
 767                         assemble_iterate_dnskey, tp->autr->keys);
 768                 if(!ubdnskey->entry.data) {
 769                 error_cleanup:
 770                         autr_rrset_delete(ubds);
 771                         autr_rrset_delete(ubdnskey);
 772                         return 0;
 773                 }
 774         }
 775
 776         /* we have prepared the new keys so nothing can go wrong any more.
 777          * And we are sure we cannot be left without trustanchor after
 778          * any errors. Put in the new keys and remove old ones. */
 779
 780         /* free the old data */
 781         autr_rrset_delete(tp->ds_rrset);
 782         autr_rrset_delete(tp->dnskey_rrset);
 783
 784         /* assign the data to replace the old */
 785         tp->ds_rrset = ubds;
 786         tp->dnskey_rrset = ubdnskey;
 787         tp->numDS = assemble_iterate_count(assemble_iterate_ds,
 788                 tp->autr->keys);
 789         tp->numDNSKEY = assemble_iterate_count(assemble_iterate_dnskey,
 790                 tp->autr->keys);
 791         return 1;
 792 }
 793
 794 /** parse integer */
 795 static unsigned int
 796 parse_int(char* line, int* ret)
 797 {
 798         char *e;
 799         unsigned int x = (unsigned int)strtol(line, &e, 10);
 800         if(line == e) {
 801                 *ret = -1; /* parse error */
 802                 return 0;
 803         }
 804         *ret = 1; /* matched */
 805         return x;
 806 }
 807
 808 /** parse id sequence for anchor */
 809 static struct trust_anchor*
 810 parse_id(struct val_anchors* anchors, char* line)
 811 {
 812         struct trust_anchor *tp;
 813         int r;
 814         uint16_t dclass;
 815         uint8_t* dname;
 816         size_t dname_len;
 817         /* read the owner name */
 818         char* next = strchr(line, ' ');
 819         if(!next)
 820                 return NULL;
 821         next[0] = 0;
 822         dname = sldns_str2wire_dname(line, &dname_len);
 823         if(!dname)
 824                 return NULL;
 825
 826         /* read the class */
 827         dclass = parse_int(next+1, &r);
 828         if(r == -1) {
 829                 free(dname);
 830                 return NULL;
 831         }
 832
 833         /* find the trust point */
 834         tp = autr_tp_create(anchors, dname, dname_len, dclass);
 835         free(dname);
 836         return tp;
 837 }
 838
 839 /**
 840  * Parse variable from trustanchor header
 841  * @param line: to parse
 842  * @param anchors: the anchor is added to this, if "id:" is seen.
 843  * @param anchor: the anchor as result value or previously returned anchor
 844  *      value to read the variable lines into.
 845  * @return: 0 no match, -1 failed syntax error, +1 success line read.
 846  *      +2 revoked trust anchor file.
 847  */
 848 static int
 849 parse_var_line(char* line, struct val_anchors* anchors,
 850         struct trust_anchor** anchor)
 851 {
 852         struct trust_anchor* tp = *anchor;
 853         int r = 0;
 854         if(strncmp(line, ";;id: ", 6) == 0) {
 855                 *anchor = parse_id(anchors, line+6);
 856                 if(!*anchor) return -1;
 857                 else return 1;
 858         } else if(strncmp(line, ";;REVOKED", 9) == 0) {
 859                 if(tp) {
 860                         log_err("REVOKED statement must be at start of file");
 861                         return -1;
 862                 }
 863                 return 2;
 864         } else if(strncmp(line, ";;last_queried: ", 16) == 0) {
 865                 if(!tp) return -1;
 866                 lock_basic_lock(&tp->lock);
 867                 tp->autr->last_queried = (time_t)parse_int(line+16, &r);
 868                 lock_basic_unlock(&tp->lock);
 869         } else if(strncmp(line, ";;last_success: ", 16) == 0) {
 870                 if(!tp) return -1;
 871                 lock_basic_lock(&tp->lock);
 872                 tp->autr->last_success = (time_t)parse_int(line+16, &r);
 873                 lock_basic_unlock(&tp->lock);
 874         } else if(strncmp(line, ";;next_probe_time: ", 19) == 0) {
 875                 if(!tp) return -1;
 876                 lock_basic_lock(&anchors->lock);
 877                 lock_basic_lock(&tp->lock);
 878                 (void)rbtree_delete(&anchors->autr->probe, tp);
 879                 tp->autr->next_probe_time = (time_t)parse_int(line+19, &r);
 880                 (void)rbtree_insert(&anchors->autr->probe, &tp->autr->pnode);
 881                 lock_basic_unlock(&tp->lock);
 882                 lock_basic_unlock(&anchors->lock);
 883         } else if(strncmp(line, ";;query_failed: ", 16) == 0) {
 884                 if(!tp) return -1;
 885                 lock_basic_lock(&tp->lock);
 886                 tp->autr->query_failed = (uint8_t)parse_int(line+16, &r);
 887                 lock_basic_unlock(&tp->lock);
 888         } else if(strncmp(line, ";;query_interval: ", 18) == 0) {
 889                 if(!tp) return -1;
 890                 lock_basic_lock(&tp->lock);
 891                 tp->autr->query_interval = (time_t)parse_int(line+18, &r);
 892                 lock_basic_unlock(&tp->lock);
 893         } else if(strncmp(line, ";;retry_time: ", 14) == 0) {
 894                 if(!tp) return -1;
 895                 lock_basic_lock(&tp->lock);
 896                 tp->autr->retry_time = (time_t)parse_int(line+14, &r);
 897                 lock_basic_unlock(&tp->lock);
 898         }
 899         return r;
 900 }
 901
 902 /** handle origin lines */
 903 static int
 904 handle_origin(char* line, uint8_t** origin, size_t* origin_len)
 905 {
 906         size_t len = 0;
 907         while(isspace((unsigned char)*line))
 908                 line++;
 909         if(strncmp(line, "$ORIGIN", 7) != 0)
 910                 return 0;
 911         free(*origin);
 912         line += 7;
 913         while(isspace((unsigned char)*line))
 914                 line++;
 915         *origin = sldns_str2wire_dname(line, &len);
 916         *origin_len = len;
 917         if(!*origin)
 918                 log_warn("malloc failure or parse error in $ORIGIN");
 919         return 1;
 920 }
 921
 922 /** Read one line and put multiline RRs onto one line string */
 923 static int
 924 read_multiline(char* buf, size_t len, FILE* in, int* linenr)
 925 {
 926         char* pos = buf;
 927         size_t left = len;
 928         int depth = 0;
 929         buf[len-1] = 0;
 930         while(left > 0 && fgets(pos, (int)left, in) != NULL) {
 931                 size_t i, poslen = strlen(pos);
 932                 (*linenr)++;
 933
 934                 /* check what the new depth is after the line */
 935                 /* this routine cannot handle braces inside quotes,
 936                    say for TXT records, but this routine only has to read keys */
 937                 for(i=0; i<poslen; i++) {
 938                         if(pos[i] == '(') {
 939                                 depth++;
 940                         } else if(pos[i] == ')') {
 941                                 if(depth == 0) {
 942                                         log_err("mismatch: too many ')'");
 943                                         return -1;
 944                                 }
 945                                 depth--;
 946                         } else if(pos[i] == ';') {
 947                                 break;
 948                         }
 949                 }
 950
 951                 /* normal oneline or last line: keeps newline and comments */
 952                 if(depth == 0) {
 953                         return 1;
 954                 }
 955
 956                 /* more lines expected, snip off comments and newline */
 957                 if(poslen>0)
 958                         pos[poslen-1] = 0; /* strip newline */
 959                 if(strchr(pos, ';'))
 960                         strchr(pos, ';')[0] = 0; /* strip comments */
 961
 962                 /* move to paste other lines behind this one */
 963                 poslen = strlen(pos);
 964                 pos += poslen;
 965                 left -= poslen;
 966                 /* the newline is changed into a space */
 967                 if(left <= 2 /* space and eos */) {
 968                         log_err("line too long");
 969                         return -1;
 970                 }
 971                 pos[0] = ' ';
 972                 pos[1] = 0;
 973                 pos += 1;
 974                 left -= 1;
 975         }
 976         if(depth != 0) {
 977                 log_err("mismatch: too many '('");
 978                 return -1;
 979         }
 980         if(pos != buf)
 981                 return 1;
 982         return 0;
 983 }
 984
 985 int autr_read_file(struct val_anchors* anchors, const char* nm)
 986 {
 987         /* the file descriptor */
 988         FILE* fd;
 989         /* keep track of line numbers */
 990         int line_nr = 0;
 991         /* single line */
 992         char line[10240];
 993         /* trust point being read */
 994         struct trust_anchor *tp = NULL, *tp2;
 995         int r;
 996         /* for $ORIGIN parsing */
 997         uint8_t *origin=NULL, *prev=NULL;
 998         size_t origin_len=0, prev_len=0;
 999
1000         if (!(fd = fopen(nm, "r"))) {
1001                 log_err("unable to open %s for reading: %s",
1002                         nm, strerror(errno));
1003                 return 0;
1004         }
1005         verbose(VERB_ALGO, "reading autotrust anchor file %s", nm);
1006         while ( (r=read_multiline(line, sizeof(line), fd, &line_nr)) != 0) {
1007                 if(r == -1 || (r = parse_var_line(line, anchors, &tp)) == -1) {
1008                         log_err("could not parse auto-trust-anchor-file "
1009                                 "%s line %d", nm, line_nr);
1010                         fclose(fd);
1011                         free(origin);
1012                         free(prev);
1013                         return 0;
1014                 } else if(r == 1) {
1015                         continue;
1016                 } else if(r == 2) {
1017                         log_warn("trust anchor %s has been revoked", nm);
1018                         fclose(fd);
1019                         free(origin);
1020                         free(prev);
1021                         return 1;
1022                 }
1023                 if (!str_contains_data(line, ';'))
1024                         continue; /* empty lines allowed */
1025                 if(handle_origin(line, &origin, &origin_len))
1026                         continue;
1027                 r = 0;
1028                 if(!(tp2=load_trustanchor(anchors, line, nm, origin,
1029                         origin_len, &prev, &prev_len, &r))) {
1030                         if(!r) log_err("failed to load trust anchor from %s "
1031                                 "at line %i, skipping", nm, line_nr);
1032                         /* try to do the rest */
1033                         continue;
1034                 }
1035                 if(tp && tp != tp2) {
1036                         log_err("file %s has mismatching data inside: "
1037                                 "the file may only contain keys for one name, "
1038                                 "remove keys for other domain names", nm);
1039                         fclose(fd);
1040                         free(origin);
1041                         free(prev);
1042                         return 0;
1043                 }
1044                 tp = tp2;
1045         }
1046         fclose(fd);
1047         free(origin);
1048         free(prev);
1049         if(!tp) {
1050                 log_err("failed to read %s", nm);
1051                 return 0;
1052         }
1053
1054         /* now assemble the data into DNSKEY and DS packed rrsets */
1055         lock_basic_lock(&tp->lock);
1056         if(!autr_assemble(tp)) {
1057                 lock_basic_unlock(&tp->lock);
1058                 log_err("malloc failure assembling %s", nm);
1059                 return 0;
1060         }
1061         lock_basic_unlock(&tp->lock);
1062         return 1;
1063 }
1064
1065 /** string for a trustanchor state */
1066 static const char*
1067 trustanchor_state2str(autr_state_type s)
1068 {
1069         switch (s) {
1070                 case AUTR_STATE_START:       return "  START  ";
1071                 case AUTR_STATE_ADDPEND:     return " ADDPEND ";
1072                 case AUTR_STATE_VALID:       return "  VALID  ";
1073                 case AUTR_STATE_MISSING:     return " MISSING ";
1074                 case AUTR_STATE_REVOKED:     return " REVOKED ";
1075                 case AUTR_STATE_REMOVED:     return " REMOVED ";
1076         }
1077         return " UNKNOWN ";
1078 }
1079
1080 /** print ID to file */
1081 static int
1082 print_id(FILE* out, char* fname, uint8_t* nm, size_t nmlen, uint16_t dclass)
1083 {
1084         char* s = sldns_wire2str_dname(nm, nmlen);
1085         if(!s) {
1086                 log_err("malloc failure in write to %s", fname);
1087                 return 0;
1088         }
1089         if(fprintf(out, ";;id: %s %d\n", s, (int)dclass) < 0) {
1090                 log_err("could not write to %s: %s", fname, strerror(errno));
1091                 free(s);
1092                 return 0;
1093         }
1094         free(s);
1095         return 1;
1096 }
1097
1098 static int
1099 autr_write_contents(FILE* out, char* fn, struct trust_anchor* tp)
1100 {
1101         char tmi[32];
1102         struct autr_ta* ta;
1103         char* str;
1104
1105         /* write pretty header */
1106         if(fprintf(out, "; autotrust trust anchor file\n") < 0) {
1107                 log_err("could not write to %s: %s", fn, strerror(errno));
1108                 return 0;
1109         }
1110         if(tp->autr->revoked) {
1111                 if(fprintf(out, ";;REVOKED\n") < 0 ||
1112                    fprintf(out, "; The zone has all keys revoked, and is\n"
1113                         "; considered as if it has no trust anchors.\n"
1114                         "; the remainder of the file is the last probe.\n"
1115                         "; to restart the trust anchor, overwrite this file.\n"
1116                         "; with one containing valid DNSKEYs or DSes.\n") < 0) {
1117                    log_err("could not write to %s: %s", fn, strerror(errno));
1118                    return 0;
1119                 }
1120         }
1121         if(!print_id(out, fn, tp->name, tp->namelen, tp->dclass)) {
1122                 return 0;
1123         }
1124         if(fprintf(out, ";;last_queried: %u ;;%s",
1125                 (unsigned int)tp->autr->last_queried,
1126                 ctime_r(&(tp->autr->last_queried), tmi)) < 0 ||
1127            fprintf(out, ";;last_success: %u ;;%s",
1128                 (unsigned int)tp->autr->last_success,
1129                 ctime_r(&(tp->autr->last_success), tmi)) < 0 ||
1130            fprintf(out, ";;next_probe_time: %u ;;%s",
1131                 (unsigned int)tp->autr->next_probe_time,
1132                 ctime_r(&(tp->autr->next_probe_time), tmi)) < 0 ||
1133            fprintf(out, ";;query_failed: %d\n", (int)tp->autr->query_failed)<0
1134            || fprintf(out, ";;query_interval: %d\n",
1135            (int)tp->autr->query_interval) < 0 ||
1136            fprintf(out, ";;retry_time: %d\n", (int)tp->autr->retry_time) < 0) {
1137                 log_err("could not write to %s: %s", fn, strerror(errno));
1138                 return 0;
1139         }
1140
1141         /* write anchors */
1142         for(ta=tp->autr->keys; ta; ta=ta->next) {
1143                 /* by default do not store START and REMOVED keys */
1144                 if(ta->s == AUTR_STATE_START)
1145                         continue;
1146                 if(ta->s == AUTR_STATE_REMOVED)
1147                         continue;
1148                 /* only store keys */
1149                 if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len)
1150                         != LDNS_RR_TYPE_DNSKEY)
1151                         continue;
1152                 str = sldns_wire2str_rr(ta->rr, ta->rr_len);
1153                 if(!str || !str[0]) {
1154                         free(str);
1155                         log_err("malloc failure writing %s", fn);
1156                         return 0;
1157                 }
1158                 str[strlen(str)-1] = 0; /* remove newline */
1159                 if(fprintf(out, "%s ;;state=%d [%s] ;;count=%d "
1160                         ";;lastchange=%u ;;%s", str, (int)ta->s,
1161                         trustanchor_state2str(ta->s), (int)ta->pending_count,
1162                         (unsigned int)ta->last_change,
1163                         ctime_r(&(ta->last_change), tmi)) < 0) {
1164                    log_err("could not write to %s: %s", fn, strerror(errno));
1165                    free(str);
1166                    return 0;
1167                 }
1168                 free(str);
1169         }
1170         return 1;
1171 }
1172
1173 void autr_write_file(struct module_env* env, struct trust_anchor* tp)
1174 {
1175         FILE* out;
1176         char* fname = tp->autr->file;
1177 #ifndef S_SPLINT_S
1178         long long llvalue;
1179 #endif
1180         char tempf[2048];
1181         log_assert(tp->autr);
1182         if(!env) {
1183                 log_err("autr_write_file: Module environment is NULL.");
1184                 return;
1185         }
1186         /* unique name with pid number, thread number, and struct pointer
1187          * (the pointer uniquifies for multiple libunbound contexts) */
1188 #ifndef S_SPLINT_S
1189 #if defined(SIZE_MAX) && defined(UINT32_MAX) && (UINT32_MAX == SIZE_MAX || INT32_MAX == SIZE_MAX)
1190         /* avoid warning about upcast on 32bit systems */
1191         llvalue = (unsigned long)tp;
1192 #else
1193         llvalue = (unsigned long long)tp;
1194 #endif
1195 #ifndef USE_WINSOCK
1196         snprintf(tempf, sizeof(tempf), "%s.%d-%d-%llx", fname, (int)getpid(),
1197                 env->worker?*(int*)env->worker:0, llvalue);
1198 #else
1199         snprintf(tempf, sizeof(tempf), "%s.%d-%d-%I64x", fname, (int)getpid(),
1200                 env->worker?*(int*)env->worker:0, llvalue);
1201 #endif
1202 #endif /* S_SPLINT_S */
1203         verbose(VERB_ALGO, "autotrust: write to disk: %s", tempf);
1204         out = fopen(tempf, "w");
1205         if(!out) {
1206                 fatal_exit("could not open autotrust file for writing, %s: %s",
1207                         tempf, strerror(errno));
1208                 return;
1209         }
1210         if(!autr_write_contents(out, tempf, tp)) {
1211                 /* failed to write contents (completely) */
1212                 fclose(out);
1213                 unlink(tempf);
1214                 fatal_exit("could not completely write: %s", fname);
1215                 return;
1216         }
1217         if(fflush(out) != 0)
1218                 log_err("could not fflush(%s): %s", fname, strerror(errno));
1219 #ifdef HAVE_FSYNC
1220         if(fsync(fileno(out)) != 0)
1221                 log_err("could not fsync(%s): %s", fname, strerror(errno));
1222 #else
1223         FlushFileBuffers((HANDLE)_get_osfhandle(_fileno(out)));
1224 #endif
1225         if(fclose(out) != 0) {
1226                 fatal_exit("could not complete write: %s: %s",
1227                         fname, strerror(errno));
1228                 unlink(tempf);
1229                 return;
1230         }
1231         /* success; overwrite actual file */
1232         verbose(VERB_ALGO, "autotrust: replaced %s", fname);
1233 #ifdef UB_ON_WINDOWS
1234         (void)unlink(fname); /* windows does not replace file with rename() */
1235 #endif
1236         if(rename(tempf, fname) < 0) {
1237                 fatal_exit("rename(%s to %s): %s", tempf, fname, strerror(errno));
1238         }
1239 }
1240
1241 /**
1242  * Verify if dnskey works for trust point
1243  * @param env: environment (with time) for verification
1244  * @param ve: validator environment (with options) for verification.
1245  * @param tp: trust point to verify with
1246  * @param rrset: DNSKEY rrset to verify.
1247  * @param qstate: qstate with region.
1248  * @return false on failure, true if verification successful.
1249  */
1250 static int
1251 verify_dnskey(struct module_env* env, struct val_env* ve,
1252         struct trust_anchor* tp, struct ub_packed_rrset_key* rrset,
1253         struct module_qstate* qstate)
1254 {
1255         char* reason = NULL;
1256         uint8_t sigalg[ALGO_NEEDS_MAX+1];
1257         int downprot = env->cfg->harden_algo_downgrade;
1258         enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve, rrset,
1259                 tp->ds_rrset, tp->dnskey_rrset, downprot?sigalg:NULL, &reason,
1260                 qstate);
1261         /* sigalg is ignored, it returns algorithms signalled to exist, but
1262          * in 5011 there are no other rrsets to check.  if downprot is
1263          * enabled, then it checks that the DNSKEY is signed with all
1264          * algorithms available in the trust store. */
1265         verbose(VERB_ALGO, "autotrust: validate DNSKEY with anchor: %s",
1266                 sec_status_to_string(sec));
1267         return sec == sec_status_secure;
1268 }
1269
1270 static int32_t
1271 rrsig_get_expiry(uint8_t* d, size_t len)
1272 {
1273         /* rrsig: 2(rdlen), 2(type) 1(alg) 1(v) 4(origttl), then 4(expi), (4)incep) */
1274         if(len < 2+8+4)
1275                 return 0;
1276         return sldns_read_uint32(d+2+8);
1277 }
1278
1279 /** Find minimum expiration interval from signatures */
1280 static time_t
1281 min_expiry(struct module_env* env, struct packed_rrset_data* dd)
1282 {
1283         size_t i;
1284         int32_t t, r = 15 * 24 * 3600; /* 15 days max */
1285         for(i=dd->count; i<dd->count+dd->rrsig_count; i++) {
1286                 t = rrsig_get_expiry(dd->rr_data[i], dd->rr_len[i]);
1287                 if((int32_t)t - (int32_t)*env->now > 0) {
1288                         t -= (int32_t)*env->now;
1289                         if(t < r)
1290                                 r = t;
1291                 }
1292         }
1293         return (time_t)r;
1294 }
1295
1296 /** Is rr self-signed revoked key */
1297 static int
1298 rr_is_selfsigned_revoked(struct module_env* env, struct val_env* ve,
1299         struct ub_packed_rrset_key* dnskey_rrset, size_t i,
1300         struct module_qstate* qstate)
1301 {
1302         enum sec_status sec;
1303         char* reason = NULL;
1304         verbose(VERB_ALGO, "seen REVOKE flag, check self-signed, rr %d",
1305                 (int)i);
1306         /* no algorithm downgrade protection necessary, if it is selfsigned
1307          * revoked it can be removed. */
1308         sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset, i,
1309                 &reason, LDNS_SECTION_ANSWER, qstate);
1310         return (sec == sec_status_secure);
1311 }
1312
1313 /** Set fetched value */
1314 static void
1315 seen_trustanchor(struct autr_ta* ta, uint8_t seen)
1316 {
1317         ta->fetched = seen;
1318         if(ta->pending_count < 250) /* no numerical overflow, please */
1319                 ta->pending_count++;
1320 }
1321
1322 /** set revoked value */
1323 static void
1324 seen_revoked_trustanchor(struct autr_ta* ta, uint8_t revoked)
1325 {
1326         ta->revoked = revoked;
1327 }
1328
1329 /** revoke a trust anchor */
1330 static void
1331 revoke_dnskey(struct autr_ta* ta, int off)
1332 {
1333         uint16_t flags;
1334         uint8_t* data;
1335         if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len) !=
1336                 LDNS_RR_TYPE_DNSKEY)
1337                 return;
1338         if(sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len) < 2)
1339                 return;
1340         data = sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len);
1341         flags = sldns_read_uint16(data);
1342         if (off && (flags&LDNS_KEY_REVOKE_KEY))
1343                 flags ^= LDNS_KEY_REVOKE_KEY; /* flip */
1344         else
1345                 flags |= LDNS_KEY_REVOKE_KEY;
1346         sldns_write_uint16(data, flags);
1347 }
1348
1349 /** Compare two RRs skipping the REVOKED bit. Pass rdata(no len) */
1350 static int
1351 dnskey_compare_skip_revbit(uint8_t* a, size_t a_len, uint8_t* b, size_t b_len)
1352 {
1353         size_t i;
1354         if(a_len != b_len)
1355                 return -1;
1356         /* compare RRs RDATA byte for byte. */
1357         for(i = 0; i < a_len; i++)
1358         {
1359                 uint8_t rdf1, rdf2;
1360                 rdf1 = a[i];
1361                 rdf2 = b[i];
1362                 if(i==1) {
1363                         /* this is the second part of the flags field */
1364                         rdf1 |= LDNS_KEY_REVOKE_KEY;
1365                         rdf2 |= LDNS_KEY_REVOKE_KEY;
1366                 }
1367                 if (rdf1 < rdf2)        return -1;
1368                 else if (rdf1 > rdf2)   return 1;
1369         }
1370         return 0;
1371 }
1372
1373
1374 /** compare trust anchor with rdata, 0 if equal. Pass rdata(no len) */
1375 static int
1376 ta_compare(struct autr_ta* a, uint16_t t, uint8_t* b, size_t b_len)
1377 {
1378         if(!a) return -1;
1379         else if(!b) return -1;
1380         else if(sldns_wirerr_get_type(a->rr, a->rr_len, a->dname_len) != t)
1381                 return (int)sldns_wirerr_get_type(a->rr, a->rr_len,
1382                         a->dname_len) - (int)t;
1383         else if(t == LDNS_RR_TYPE_DNSKEY) {
1384                 return dnskey_compare_skip_revbit(
1385                         sldns_wirerr_get_rdata(a->rr, a->rr_len, a->dname_len),
1386                         sldns_wirerr_get_rdatalen(a->rr, a->rr_len,
1387                         a->dname_len), b, b_len);
1388         }
1389         else if(t == LDNS_RR_TYPE_DS) {
1390                 if(sldns_wirerr_get_rdatalen(a->rr, a->rr_len, a->dname_len) !=
1391                         b_len)
1392                         return -1;
1393                 return memcmp(sldns_wirerr_get_rdata(a->rr,
1394                         a->rr_len, a->dname_len), b, b_len);
1395         }
1396         return -1;
1397 }
1398
1399 /**
1400  * Find key
1401  * @param tp: to search in
1402  * @param t: rr type of the rdata.
1403  * @param rdata: to look for  (no rdatalen in it)
1404  * @param rdata_len: length of rdata
1405  * @param result: returns NULL or the ta key looked for.
1406  * @return false on malloc failure during search. if true examine result.
1407  */
1408 static int
1409 find_key(struct trust_anchor* tp, uint16_t t, uint8_t* rdata, size_t rdata_len,
1410         struct autr_ta** result)
1411 {
1412         struct autr_ta* ta;
1413         if(!tp || !rdata) {
1414                 *result = NULL;
1415                 return 0;
1416         }
1417         for(ta=tp->autr->keys; ta; ta=ta->next) {
1418                 if(ta_compare(ta, t, rdata, rdata_len) == 0) {
1419                         *result = ta;
1420                         return 1;
1421                 }
1422         }
1423         *result = NULL;
1424         return 1;
1425 }
1426
1427 /** add key and clone RR and tp already locked. rdata without rdlen. */
1428 static struct autr_ta*
1429 add_key(struct trust_anchor* tp, uint32_t ttl, uint8_t* rdata, size_t rdata_len)
1430 {
1431         struct autr_ta* ta;
1432         uint8_t* rr;
1433         size_t rr_len, dname_len;
1434         uint16_t rrtype = htons(LDNS_RR_TYPE_DNSKEY);
1435         uint16_t rrclass = htons(LDNS_RR_CLASS_IN);
1436         uint16_t rdlen = htons(rdata_len);
1437         dname_len = tp->namelen;
1438         ttl = htonl(ttl);
1439         rr_len = dname_len + 10 /* type,class,ttl,rdatalen */ + rdata_len;
1440         rr = (uint8_t*)malloc(rr_len);
1441         if(!rr) return NULL;
1442         memmove(rr, tp->name, tp->namelen);
1443         memmove(rr+dname_len, &rrtype, 2);
1444         memmove(rr+dname_len+2, &rrclass, 2);
1445         memmove(rr+dname_len+4, &ttl, 4);
1446         memmove(rr+dname_len+8, &rdlen, 2);
1447         memmove(rr+dname_len+10, rdata, rdata_len);
1448         ta = autr_ta_create(rr, rr_len, dname_len);
1449         if(!ta) {
1450                 /* rr freed in autr_ta_create */
1451                 return NULL;
1452         }
1453         /* link in, tp already locked */
1454         ta->next = tp->autr->keys;
1455         tp->autr->keys = ta;
1456         return ta;
1457 }
1458
1459 /** get TTL from DNSKEY rrset */
1460 static time_t
1461 key_ttl(struct ub_packed_rrset_key* k)
1462 {
1463         struct packed_rrset_data* d = (struct packed_rrset_data*)k->entry.data;
1464         return d->ttl;
1465 }
1466
1467 /** update the time values for the trustpoint */
1468 static void
1469 set_tp_times(struct trust_anchor* tp, time_t rrsig_exp_interval,
1470         time_t origttl, int* changed)
1471 {
1472         time_t x, qi = tp->autr->query_interval, rt = tp->autr->retry_time;
1473
1474         /* x = MIN(15days, ttl/2, expire/2) */
1475         x = 15 * 24 * 3600;
1476         if(origttl/2 < x)
1477                 x = origttl/2;
1478         if(rrsig_exp_interval/2 < x)
1479                 x = rrsig_exp_interval/2;
1480         /* MAX(1hr, x) */
1481         if(!autr_permit_small_holddown) {
1482                 if(x < 3600)
1483                         tp->autr->query_interval = 3600;
1484                 else    tp->autr->query_interval = x;
1485         }       else    tp->autr->query_interval = x;
1486
1487         /* x= MIN(1day, ttl/10, expire/10) */
1488         x = 24 * 3600;
1489         if(origttl/10 < x)
1490                 x = origttl/10;
1491         if(rrsig_exp_interval/10 < x)
1492                 x = rrsig_exp_interval/10;
1493         /* MAX(1hr, x) */
1494         if(!autr_permit_small_holddown) {
1495                 if(x < 3600)
1496                         tp->autr->retry_time = 3600;
1497                 else    tp->autr->retry_time = x;
1498         }       else    tp->autr->retry_time = x;
1499
1500         if(qi != tp->autr->query_interval || rt != tp->autr->retry_time) {
1501                 *changed = 1;
1502                 verbose(VERB_ALGO, "orig_ttl is %d", (int)origttl);
1503                 verbose(VERB_ALGO, "rrsig_exp_interval is %d",
1504                         (int)rrsig_exp_interval);
1505                 verbose(VERB_ALGO, "query_interval: %d, retry_time: %d",
1506                         (int)tp->autr->query_interval,
1507                         (int)tp->autr->retry_time);
1508         }
1509 }
1510
1511 /** init events to zero */
1512 static void
1513 init_events(struct trust_anchor* tp)
1514 {
1515         struct autr_ta* ta;
1516         for(ta=tp->autr->keys; ta; ta=ta->next) {
1517                 ta->fetched = 0;
1518         }
1519 }
1520
1521 /** check for revoked keys without trusting any other information */
1522 static void
1523 check_contains_revoked(struct module_env* env, struct val_env* ve,
1524         struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1525         int* changed, struct module_qstate* qstate)
1526 {
1527         struct packed_rrset_data* dd = (struct packed_rrset_data*)
1528                 dnskey_rrset->entry.data;
1529         size_t i;
1530         log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1531         for(i=0; i<dd->count; i++) {
1532                 struct autr_ta* ta = NULL;
1533                 if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1534                         dd->rr_data[i]+2, dd->rr_len[i]-2) ||
1535                         !rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1536                         dd->rr_data[i]+2, dd->rr_len[i]-2))
1537                         continue; /* not a revoked KSK */
1538                 if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1539                         dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1540                         log_err("malloc failure");
1541                         continue; /* malloc fail in compare*/
1542                 }
1543                 if(!ta)
1544                         continue; /* key not found */
1545                 if(rr_is_selfsigned_revoked(env, ve, dnskey_rrset, i, qstate)) {
1546                         /* checked if there is an rrsig signed by this key. */
1547                         /* same keytag, but stored can be revoked already, so
1548                          * compare keytags, with +0 or +128(REVOKE flag) */
1549                         log_assert(dnskey_calc_keytag(dnskey_rrset, i)-128 ==
1550                                 sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1551                                 ta->rr, ta->rr_len, ta->dname_len),
1552                                 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1553                                 ta->dname_len)) ||
1554                                 dnskey_calc_keytag(dnskey_rrset, i) ==
1555                                 sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1556                                 ta->rr, ta->rr_len, ta->dname_len),
1557                                 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1558                                 ta->dname_len))); /* checks conversion*/
1559                         verbose_key(ta, VERB_ALGO, "is self-signed revoked");
1560                         if(!ta->revoked)
1561                                 *changed = 1;
1562                         seen_revoked_trustanchor(ta, 1);
1563                         do_revoked(env, ta, changed);
1564                 }
1565         }
1566 }
1567
1568 /** See if a DNSKEY is verified by one of the DSes */
1569 static int
1570 key_matches_a_ds(struct module_env* env, struct val_env* ve,
1571         struct ub_packed_rrset_key* dnskey_rrset, size_t key_idx,
1572         struct ub_packed_rrset_key* ds_rrset)
1573 {
1574         struct packed_rrset_data* dd = (struct packed_rrset_data*)
1575                         ds_rrset->entry.data;
1576         size_t ds_idx, num = dd->count;
1577         int d = val_favorite_ds_algo(ds_rrset);
1578         char* reason = "";
1579         for(ds_idx=0; ds_idx<num; ds_idx++) {
1580                 if(!ds_digest_algo_is_supported(ds_rrset, ds_idx) ||
1581                         !ds_key_algo_is_supported(ds_rrset, ds_idx) ||
1582                         ds_get_digest_algo(ds_rrset, ds_idx) != d)
1583                         continue;
1584                 if(ds_get_key_algo(ds_rrset, ds_idx)
1585                    != dnskey_get_algo(dnskey_rrset, key_idx)
1586                    || dnskey_calc_keytag(dnskey_rrset, key_idx)
1587                    != ds_get_keytag(ds_rrset, ds_idx)) {
1588                         continue;
1589                 }
1590                 if(!ds_digest_match_dnskey(env, dnskey_rrset, key_idx,
1591                         ds_rrset, ds_idx)) {
1592                         verbose(VERB_ALGO, "DS match attempt failed");
1593                         continue;
1594                 }
1595                 /* match of hash is sufficient for bootstrap of trust point */
1596                 (void)reason;
1597                 (void)ve;
1598                 return 1;
1599                 /* no need to check RRSIG, DS hash already matched with source
1600                 if(dnskey_verify_rrset(env, ve, dnskey_rrset,
1601                         dnskey_rrset, key_idx, &reason) == sec_status_secure) {
1602                         return 1;
1603                 } else {
1604                         verbose(VERB_ALGO, "DS match failed because the key "
1605                                 "does not verify the keyset: %s", reason);
1606                 }
1607                 */
1608         }
1609         return 0;
1610 }
1611
1612 /** Set update events */
1613 static int
1614 update_events(struct module_env* env, struct val_env* ve,
1615         struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1616         int* changed)
1617 {
1618         struct packed_rrset_data* dd = (struct packed_rrset_data*)
1619                 dnskey_rrset->entry.data;
1620         size_t i;
1621         log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1622         init_events(tp);
1623         for(i=0; i<dd->count; i++) {
1624                 struct autr_ta* ta = NULL;
1625                 if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1626                         dd->rr_data[i]+2, dd->rr_len[i]-2))
1627                         continue;
1628                 if(rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1629                         dd->rr_data[i]+2, dd->rr_len[i]-2)) {
1630                         /* self-signed revoked keys already detected before,
1631                          * other revoked keys are not 'added' again */
1632                         continue;
1633                 }
1634                 /* is a key of this type supported?. Note rr_list and
1635                  * packed_rrset are in the same order. */
1636                 if(!dnskey_algo_is_supported(dnskey_rrset, i)) {
1637                         /* skip unknown algorithm key, it is useless to us */
1638                         log_nametypeclass(VERB_DETAIL, "trust point has "
1639                                 "unsupported algorithm at",
1640                                 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
1641                         continue;
1642                 }
1643
1644                 /* is it new? if revocation bit set, find the unrevoked key */
1645                 if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1646                         dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1647                         return 0;
1648                 }
1649                 if(!ta) {
1650                         ta = add_key(tp, (uint32_t)dd->rr_ttl[i],
1651                                 dd->rr_data[i]+2, dd->rr_len[i]-2);
1652                         *changed = 1;
1653                         /* first time seen, do we have DSes? if match: VALID */
1654                         if(ta && tp->ds_rrset && key_matches_a_ds(env, ve,
1655                                 dnskey_rrset, i, tp->ds_rrset)) {
1656                                 verbose_key(ta, VERB_ALGO, "verified by DS");
1657                                 ta->s = AUTR_STATE_VALID;
1658                         }
1659                 }
1660                 if(!ta) {
1661                         return 0;
1662                 }
1663                 seen_trustanchor(ta, 1);
1664                 verbose_key(ta, VERB_ALGO, "in DNS response");
1665         }
1666         set_tp_times(tp, min_expiry(env, dd), key_ttl(dnskey_rrset), changed);
1667         return 1;
1668 }
1669
1670 /**
1671  * Check if the holddown time has already exceeded
1672  * setting: add-holddown: add holddown timer
1673  * setting: del-holddown: del holddown timer
1674  * @param env: environment with current time
1675  * @param ta: trust anchor to check for.
1676  * @param holddown: the timer value
1677  * @return number of seconds the holddown has passed.
1678  */
1679 static time_t
1680 check_holddown(struct module_env* env, struct autr_ta* ta,
1681         unsigned int holddown)
1682 {
1683         time_t elapsed;
1684         if(*env->now < ta->last_change) {
1685                 log_warn("time goes backwards. delaying key holddown");
1686                 return 0;
1687         }
1688         elapsed = *env->now - ta->last_change;
1689         if (elapsed > (time_t)holddown) {
1690                 return elapsed-(time_t)holddown;
1691         }
1692         verbose_key(ta, VERB_ALGO, "holddown time " ARG_LL "d seconds to go",
1693                 (long long) ((time_t)holddown-elapsed));
1694         return 0;
1695 }
1696
1697
1698 /** Set last_change to now */
1699 static void
1700 reset_holddown(struct module_env* env, struct autr_ta* ta, int* changed)
1701 {
1702         ta->last_change = *env->now;
1703         *changed = 1;
1704 }
1705
1706 /** Set the state for this trust anchor */
1707 static void
1708 set_trustanchor_state(struct module_env* env, struct autr_ta* ta, int* changed,
1709         autr_state_type s)
1710 {
1711         verbose_key(ta, VERB_ALGO, "update: %s to %s",
1712                 trustanchor_state2str(ta->s), trustanchor_state2str(s));
1713         ta->s = s;
1714         reset_holddown(env, ta, changed);
1715 }
1716
1717
1718 /** Event: NewKey */
1719 static void
1720 do_newkey(struct module_env* env, struct autr_ta* anchor, int* c)
1721 {
1722         if (anchor->s == AUTR_STATE_START)
1723                 set_trustanchor_state(env, anchor, c, AUTR_STATE_ADDPEND);
1724 }
1725
1726 /** Event: AddTime */
1727 static void
1728 do_addtime(struct module_env* env, struct autr_ta* anchor, int* c)
1729 {
1730         /* This not according to RFC, this is 30 days, but the RFC demands
1731          * MAX(30days, TTL expire time of first DNSKEY set with this key),
1732          * The value may be too small if a very large TTL was used. */
1733         time_t exceeded = check_holddown(env, anchor, env->cfg->add_holddown);
1734         if (exceeded && anchor->s == AUTR_STATE_ADDPEND) {
1735                 verbose_key(anchor, VERB_ALGO, "add-holddown time exceeded "
1736                         ARG_LL "d seconds ago, and pending-count %d",
1737                         (long long)exceeded, anchor->pending_count);
1738                 if(anchor->pending_count >= MIN_PENDINGCOUNT) {
1739                         set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1740                         anchor->pending_count = 0;
1741                         return;
1742                 }
1743                 verbose_key(anchor, VERB_ALGO, "add-holddown time sanity check "
1744                         "failed (pending count: %d)", anchor->pending_count);
1745         }
1746 }
1747
1748 /** Event: RemTime */
1749 static void
1750 do_remtime(struct module_env* env, struct autr_ta* anchor, int* c)
1751 {
1752         time_t exceeded = check_holddown(env, anchor, env->cfg->del_holddown);
1753         if(exceeded && anchor->s == AUTR_STATE_REVOKED) {
1754                 verbose_key(anchor, VERB_ALGO, "del-holddown time exceeded "
1755                         ARG_LL "d seconds ago", (long long)exceeded);
1756                 set_trustanchor_state(env, anchor, c, AUTR_STATE_REMOVED);
1757         }
1758 }
1759
1760 /** Event: KeyRem */
1761 static void
1762 do_keyrem(struct module_env* env, struct autr_ta* anchor, int* c)
1763 {
1764         if(anchor->s == AUTR_STATE_ADDPEND) {
1765                 set_trustanchor_state(env, anchor, c, AUTR_STATE_START);
1766                 anchor->pending_count = 0;
1767         } else if(anchor->s == AUTR_STATE_VALID)
1768                 set_trustanchor_state(env, anchor, c, AUTR_STATE_MISSING);
1769 }
1770
1771 /** Event: KeyPres */
1772 static void
1773 do_keypres(struct module_env* env, struct autr_ta* anchor, int* c)
1774 {
1775         if(anchor->s == AUTR_STATE_MISSING)
1776                 set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1777 }
1778
1779 /* Event: Revoked */
1780 static void
1781 do_revoked(struct module_env* env, struct autr_ta* anchor, int* c)
1782 {
1783         if(anchor->s == AUTR_STATE_VALID || anchor->s == AUTR_STATE_MISSING) {
1784                 set_trustanchor_state(env, anchor, c, AUTR_STATE_REVOKED);
1785                 verbose_key(anchor, VERB_ALGO, "old id, prior to revocation");
1786                 revoke_dnskey(anchor, 0);
1787                 verbose_key(anchor, VERB_ALGO, "new id, after revocation");
1788         }
1789 }
1790
1791 /** Do statestable transition matrix for anchor */
1792 static void
1793 anchor_state_update(struct module_env* env, struct autr_ta* anchor, int* c)
1794 {
1795         log_assert(anchor);
1796         switch(anchor->s) {
1797         /* START */
1798         case AUTR_STATE_START:
1799                 /* NewKey: ADDPEND */
1800                 if (anchor->fetched)
1801                         do_newkey(env, anchor, c);
1802                 break;
1803         /* ADDPEND */
1804         case AUTR_STATE_ADDPEND:
1805                 /* KeyRem: START */
1806                 if (!anchor->fetched)
1807                         do_keyrem(env, anchor, c);
1808                 /* AddTime: VALID */
1809                 else    do_addtime(env, anchor, c);
1810                 break;
1811         /* VALID */
1812         case AUTR_STATE_VALID:
1813                 /* RevBit: REVOKED */
1814                 if (anchor->revoked)
1815                         do_revoked(env, anchor, c);
1816                 /* KeyRem: MISSING */
1817                 else if (!anchor->fetched)
1818                         do_keyrem(env, anchor, c);
1819                 else if(!anchor->last_change) {
1820                         verbose_key(anchor, VERB_ALGO, "first seen");
1821                         reset_holddown(env, anchor, c);
1822                 }
1823                 break;
1824         /* MISSING */
1825         case AUTR_STATE_MISSING:
1826                 /* RevBit: REVOKED */
1827                 if (anchor->revoked)
1828                         do_revoked(env, anchor, c);
1829                 /* KeyPres */
1830                 else if (anchor->fetched)
1831                         do_keypres(env, anchor, c);
1832                 break;
1833         /* REVOKED */
1834         case AUTR_STATE_REVOKED:
1835                 if (anchor->fetched)
1836                         reset_holddown(env, anchor, c);
1837                 /* RemTime: REMOVED */
1838                 else    do_remtime(env, anchor, c);
1839                 break;
1840         /* REMOVED */
1841         case AUTR_STATE_REMOVED:
1842         default:
1843                 break;
1844         }
1845 }
1846
1847 /** if ZSK init then trust KSKs */
1848 static int
1849 init_zsk_to_ksk(struct module_env* env, struct trust_anchor* tp, int* changed)
1850 {
1851         /* search for VALID ZSKs */
1852         struct autr_ta* anchor;
1853         int validzsk = 0;
1854         int validksk = 0;
1855         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1856                 /* last_change test makes sure it was manually configured */
1857                 if(sldns_wirerr_get_type(anchor->rr, anchor->rr_len,
1858                         anchor->dname_len) == LDNS_RR_TYPE_DNSKEY &&
1859                         anchor->last_change == 0 &&
1860                         !ta_is_dnskey_sep(anchor) &&
1861                         anchor->s == AUTR_STATE_VALID)
1862                         validzsk++;
1863         }
1864         if(validzsk == 0)
1865                 return 0;
1866         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1867                 if (ta_is_dnskey_sep(anchor) &&
1868                         anchor->s == AUTR_STATE_ADDPEND) {
1869                         verbose_key(anchor, VERB_ALGO, "trust KSK from "
1870                                 "ZSK(config)");
1871                         set_trustanchor_state(env, anchor, changed,
1872                                 AUTR_STATE_VALID);
1873                         validksk++;
1874                 }
1875         }
1876         return validksk;
1877 }
1878
1879 /** Remove missing trustanchors so the list does not grow forever */
1880 static void
1881 remove_missing_trustanchors(struct module_env* env, struct trust_anchor* tp,
1882         int* changed)
1883 {
1884         struct autr_ta* anchor;
1885         time_t exceeded;
1886         int valid = 0;
1887         /* see if we have anchors that are valid */
1888         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1889                 /* Only do KSKs */
1890                 if (!ta_is_dnskey_sep(anchor))
1891                         continue;
1892                 if (anchor->s == AUTR_STATE_VALID)
1893                         valid++;
1894         }
1895         /* if there are no SEP Valid anchors, see if we started out with
1896          * a ZSK (last-change=0) anchor, which is VALID and there are KSKs
1897          * now that can be made valid.  Do this immediately because there
1898          * is no guarantee that the ZSKs get announced long enough.  Usually
1899          * this is immediately after init with a ZSK trusted, unless the domain
1900          * was not advertising any KSKs at all.  In which case we perfectly
1901          * track the zero number of KSKs. */
1902         if(valid == 0) {
1903                 valid = init_zsk_to_ksk(env, tp, changed);
1904                 if(valid == 0)
1905                         return;
1906         }
1907
1908         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1909                 /* ignore ZSKs if newly added */
1910                 if(anchor->s == AUTR_STATE_START)
1911                         continue;
1912                 /* remove ZSKs if a KSK is present */
1913                 if (!ta_is_dnskey_sep(anchor)) {
1914                         if(valid > 0) {
1915                                 verbose_key(anchor, VERB_ALGO, "remove ZSK "
1916                                         "[%d key(s) VALID]", valid);
1917                                 set_trustanchor_state(env, anchor, changed,
1918                                         AUTR_STATE_REMOVED);
1919                         }
1920                         continue;
1921                 }
1922                 /* Only do MISSING keys */
1923                 if (anchor->s != AUTR_STATE_MISSING)
1924                         continue;
1925                 if(env->cfg->keep_missing == 0)
1926                         continue; /* keep forever */
1927
1928                 exceeded = check_holddown(env, anchor, env->cfg->keep_missing);
1929                 /* If keep_missing has exceeded and we still have more than
1930                  * one valid KSK: remove missing trust anchor */
1931                 if (exceeded && valid > 0) {
1932                         verbose_key(anchor, VERB_ALGO, "keep-missing time "
1933                                 "exceeded " ARG_LL "d seconds ago, [%d key(s) VALID]",
1934                                 (long long)exceeded, valid);
1935                         set_trustanchor_state(env, anchor, changed,
1936                                 AUTR_STATE_REMOVED);
1937                 }
1938         }
1939 }
1940
1941 /** Do the statetable from RFC5011 transition matrix */
1942 static int
1943 do_statetable(struct module_env* env, struct trust_anchor* tp, int* changed)
1944 {
1945         struct autr_ta* anchor;
1946         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1947                 /* Only do KSKs */
1948                 if(!ta_is_dnskey_sep(anchor))
1949                         continue;
1950                 anchor_state_update(env, anchor, changed);
1951         }
1952         remove_missing_trustanchors(env, tp, changed);
1953         return 1;
1954 }
1955
1956 /** See if time alone makes ADDPEND to VALID transition */
1957 static void
1958 autr_holddown_exceed(struct module_env* env, struct trust_anchor* tp, int* c)
1959 {
1960         struct autr_ta* anchor;
1961         for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1962                 if(ta_is_dnskey_sep(anchor) &&
1963                         anchor->s == AUTR_STATE_ADDPEND)
1964                         do_addtime(env, anchor, c);
1965         }
1966 }
1967
1968 /** cleanup key list */
1969 static void
1970 autr_cleanup_keys(struct trust_anchor* tp)
1971 {
1972         struct autr_ta* p, **prevp;
1973         prevp = &tp->autr->keys;
1974         p = tp->autr->keys;
1975         while(p) {
1976                 /* do we want to remove this key? */
1977                 if(p->s == AUTR_STATE_START || p->s == AUTR_STATE_REMOVED ||
1978                         sldns_wirerr_get_type(p->rr, p->rr_len, p->dname_len)
1979                         != LDNS_RR_TYPE_DNSKEY) {
1980                         struct autr_ta* np = p->next;
1981                         /* remove */
1982                         free(p->rr);
1983                         free(p);
1984                         /* snip and go to next item */
1985                         *prevp = np;
1986                         p = np;
1987                         continue;
1988                 }
1989                 /* remove pending counts if no longer pending */
1990                 if(p->s != AUTR_STATE_ADDPEND)
1991                         p->pending_count = 0;
1992                 prevp = &p->next;
1993                 p = p->next;
1994         }
1995 }
1996
1997 /** calculate next probe time */
1998 static time_t
1999 calc_next_probe(struct module_env* env, time_t wait)
2000 {
2001         /* make it random, 90-100% */
2002         time_t rnd, rest;
2003         if(!autr_permit_small_holddown) {
2004                 if(wait < 3600)
2005                         wait = 3600;
2006         } else {
2007                 if(wait == 0) wait = 1;
2008         }
2009         rnd = wait/10;
2010         rest = wait-rnd;
2011         rnd = (time_t)ub_random_max(env->rnd, (long int)rnd);
2012         return (time_t)(*env->now + rest + rnd);
2013 }
2014
2015 /** what is first probe time (anchors must be locked) */
2016 static time_t
2017 wait_probe_time(struct val_anchors* anchors)
2018 {
2019         rbnode_type* t = rbtree_first(&anchors->autr->probe);
2020         if(t != RBTREE_NULL)
2021                 return ((struct trust_anchor*)t->key)->autr->next_probe_time;
2022         return 0;
2023 }
2024
2025 /** reset worker timer */
2026 static void
2027 reset_worker_timer(struct module_env* env)
2028 {
2029         struct timeval tv;
2030 #ifndef S_SPLINT_S
2031         time_t next = (time_t)wait_probe_time(env->anchors);
2032         /* in case this is libunbound, no timer */
2033         if(!env->probe_timer)
2034                 return;
2035         if(next > *env->now)
2036                 tv.tv_sec = (time_t)(next - *env->now);
2037         else    tv.tv_sec = 0;
2038 #endif
2039         tv.tv_usec = 0;
2040         comm_timer_set(env->probe_timer, &tv);
2041         verbose(VERB_ALGO, "scheduled next probe in " ARG_LL "d sec", (long long)tv.tv_sec);
2042 }
2043
2044 /** set next probe for trust anchor */
2045 static int
2046 set_next_probe(struct module_env* env, struct trust_anchor* tp,
2047         struct ub_packed_rrset_key* dnskey_rrset)
2048 {
2049         struct trust_anchor key, *tp2;
2050         time_t mold, mnew;
2051         /* use memory allocated in rrset for temporary name storage */
2052         key.node.key = &key;
2053         key.name = dnskey_rrset->rk.dname;
2054         key.namelen = dnskey_rrset->rk.dname_len;
2055         key.namelabs = dname_count_labels(key.name);
2056         key.dclass = tp->dclass;
2057         lock_basic_unlock(&tp->lock);
2058
2059         /* fetch tp again and lock anchors, so that we can modify the trees */
2060         lock_basic_lock(&env->anchors->lock);
2061         tp2 = (struct trust_anchor*)rbtree_search(env->anchors->tree, &key);
2062         if(!tp2) {
2063                 verbose(VERB_ALGO, "trustpoint was deleted in set_next_probe");
2064                 lock_basic_unlock(&env->anchors->lock);
2065                 return 0;
2066         }
2067         log_assert(tp == tp2);
2068         lock_basic_lock(&tp->lock);
2069
2070         /* schedule */
2071         mold = wait_probe_time(env->anchors);
2072         (void)rbtree_delete(&env->anchors->autr->probe, tp);
2073         tp->autr->next_probe_time = calc_next_probe(env,
2074                 tp->autr->query_interval);
2075         (void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2076         mnew = wait_probe_time(env->anchors);
2077
2078         lock_basic_unlock(&env->anchors->lock);
2079         verbose(VERB_ALGO, "next probe set in %d seconds",
2080                 (int)tp->autr->next_probe_time - (int)*env->now);
2081         if(mold != mnew) {
2082                 reset_worker_timer(env);
2083         }
2084         return 1;
2085 }
2086
2087 /** Revoke and Delete a trust point */
2088 static void
2089 autr_tp_remove(struct module_env* env, struct trust_anchor* tp,
2090         struct ub_packed_rrset_key* dnskey_rrset)
2091 {
2092         struct trust_anchor* del_tp;
2093         struct trust_anchor key;
2094         struct autr_point_data pd;
2095         time_t mold, mnew;
2096
2097         log_nametypeclass(VERB_OPS, "trust point was revoked",
2098                 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2099         tp->autr->revoked = 1;
2100
2101         /* use space allocated for dnskey_rrset to save name of anchor */
2102         memset(&key, 0, sizeof(key));
2103         memset(&pd, 0, sizeof(pd));
2104         key.autr = &pd;
2105         key.node.key = &key;
2106         pd.pnode.key = &key;
2107         pd.next_probe_time = tp->autr->next_probe_time;
2108         key.name = dnskey_rrset->rk.dname;
2109         key.namelen = tp->namelen;
2110         key.namelabs = tp->namelabs;
2111         key.dclass = tp->dclass;
2112
2113         /* unlock */
2114         lock_basic_unlock(&tp->lock);
2115
2116         /* take from tree. It could be deleted by someone else,hence (void). */
2117         lock_basic_lock(&env->anchors->lock);
2118         del_tp = (struct trust_anchor*)rbtree_delete(env->anchors->tree, &key);
2119         mold = wait_probe_time(env->anchors);
2120         (void)rbtree_delete(&env->anchors->autr->probe, &key);
2121         mnew = wait_probe_time(env->anchors);
2122         anchors_init_parents_locked(env->anchors);
2123         lock_basic_unlock(&env->anchors->lock);
2124
2125         /* if !del_tp then the trust point is no longer present in the tree,
2126          * it was deleted by someone else, who will write the zonefile and
2127          * clean up the structure */
2128         if(del_tp) {
2129                 /* save on disk */
2130                 del_tp->autr->next_probe_time = 0; /* no more probing for it */
2131                 autr_write_file(env, del_tp);
2132
2133                 /* delete */
2134                 autr_point_delete(del_tp);
2135         }
2136         if(mold != mnew) {
2137                 reset_worker_timer(env);
2138         }
2139 }
2140
2141 int autr_process_prime(struct module_env* env, struct val_env* ve,
2142         struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
2143         struct module_qstate* qstate)
2144 {
2145         int changed = 0;
2146         log_assert(tp && tp->autr);
2147         /* autotrust update trust anchors */
2148         /* the tp is locked, and stays locked unless it is deleted */
2149
2150         /* we could just catch the anchor here while another thread
2151          * is busy deleting it. Just unlock and let the other do its job */
2152         if(tp->autr->revoked) {
2153                 log_nametypeclass(VERB_ALGO, "autotrust not processed, "
2154                         "trust point revoked", tp->name,
2155                         LDNS_RR_TYPE_DNSKEY, tp->dclass);
2156                 lock_basic_unlock(&tp->lock);
2157                 return 0; /* it is revoked */
2158         }
2159
2160         /* query_dnskeys(): */
2161         tp->autr->last_queried = *env->now;
2162
2163         log_nametypeclass(VERB_ALGO, "autotrust process for",
2164                 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2165         /* see if time alone makes some keys valid */
2166         autr_holddown_exceed(env, tp, &changed);
2167         if(changed) {
2168                 verbose(VERB_ALGO, "autotrust: morekeys, reassemble");
2169                 if(!autr_assemble(tp)) {
2170                         log_err("malloc failure assembling autotrust keys");
2171                         return 1; /* unchanged */
2172                 }
2173         }
2174         /* did we get any data? */
2175         if(!dnskey_rrset) {
2176                 verbose(VERB_ALGO, "autotrust: no dnskey rrset");
2177                 /* no update of query_failed, because then we would have
2178                  * to write to disk. But we cannot because we maybe are
2179                  * still 'initializing' with DS records, that we cannot write
2180                  * in the full format (which only contains KSKs). */
2181                 return 1; /* trust point exists */
2182         }
2183         /* check for revoked keys to remove immediately */
2184         check_contains_revoked(env, ve, tp, dnskey_rrset, &changed, qstate);
2185         if(changed) {
2186                 verbose(VERB_ALGO, "autotrust: revokedkeys, reassemble");
2187                 if(!autr_assemble(tp)) {
2188                         log_err("malloc failure assembling autotrust keys");
2189                         return 1; /* unchanged */
2190                 }
2191                 if(!tp->ds_rrset && !tp->dnskey_rrset) {
2192                         /* no more keys, all are revoked */
2193                         /* this is a success for this probe attempt */
2194                         tp->autr->last_success = *env->now;
2195                         autr_tp_remove(env, tp, dnskey_rrset);
2196                         return 0; /* trust point removed */
2197                 }
2198         }
2199         /* verify the dnskey rrset and see if it is valid. */
2200         if(!verify_dnskey(env, ve, tp, dnskey_rrset, qstate)) {
2201                 verbose(VERB_ALGO, "autotrust: dnskey did not verify.");
2202                 /* only increase failure count if this is not the first prime,
2203                  * this means there was a previous successful probe */
2204                 if(tp->autr->last_success) {
2205                         tp->autr->query_failed += 1;
2206                         autr_write_file(env, tp);
2207                 }
2208                 return 1; /* trust point exists */
2209         }
2210
2211         tp->autr->last_success = *env->now;
2212         tp->autr->query_failed = 0;
2213
2214         /* Add new trust anchors to the data structure
2215          * - note which trust anchors are seen this probe.
2216          * Set trustpoint query_interval and retry_time.
2217          * - find minimum rrsig expiration interval
2218          */
2219         if(!update_events(env, ve, tp, dnskey_rrset, &changed)) {
2220                 log_err("malloc failure in autotrust update_events. "
2221                         "trust point unchanged.");
2222                 return 1; /* trust point unchanged, so exists */
2223         }
2224
2225         /* - for every SEP key do the 5011 statetable.
2226          * - remove missing trustanchors (if veryold and we have new anchors).
2227          */
2228         if(!do_statetable(env, tp, &changed)) {
2229                 log_err("malloc failure in autotrust do_statetable. "
2230                         "trust point unchanged.");
2231                 return 1; /* trust point unchanged, so exists */
2232         }
2233
2234         autr_cleanup_keys(tp);
2235         if(!set_next_probe(env, tp, dnskey_rrset))
2236                 return 0; /* trust point does not exist */
2237         autr_write_file(env, tp);
2238         if(changed) {
2239                 verbose(VERB_ALGO, "autotrust: changed, reassemble");
2240                 if(!autr_assemble(tp)) {
2241                         log_err("malloc failure assembling autotrust keys");
2242                         return 1; /* unchanged */
2243                 }
2244                 if(!tp->ds_rrset && !tp->dnskey_rrset) {
2245                         /* no more keys, all are revoked */
2246                         autr_tp_remove(env, tp, dnskey_rrset);
2247                         return 0; /* trust point removed */
2248                 }
2249         } else verbose(VERB_ALGO, "autotrust: no changes");
2250
2251         return 1; /* trust point exists */
2252 }
2253
2254 /** debug print a trust anchor key */
2255 static void
2256 autr_debug_print_ta(struct autr_ta* ta)
2257 {
2258         char buf[32];
2259         char* str = sldns_wire2str_rr(ta->rr, ta->rr_len);
2260         if(!str) {
2261                 log_info("out of memory in debug_print_ta");
2262                 return;
2263         }
2264         if(str[0]) str[strlen(str)-1]=0; /* remove newline */
2265         ctime_r(&ta->last_change, buf);
2266         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2267         log_info("[%s] %s ;;state:%d ;;pending_count:%d%s%s last:%s",
2268                 trustanchor_state2str(ta->s), str, ta->s, ta->pending_count,
2269                 ta->fetched?" fetched":"", ta->revoked?" revoked":"", buf);
2270         free(str);
2271 }
2272
2273 /** debug print a trust point */
2274 static void
2275 autr_debug_print_tp(struct trust_anchor* tp)
2276 {
2277         struct autr_ta* ta;
2278         char buf[257];
2279         if(!tp->autr)
2280                 return;
2281         dname_str(tp->name, buf);
2282         log_info("trust point %s : %d", buf, (int)tp->dclass);
2283         log_info("assembled %d DS and %d DNSKEYs",
2284                 (int)tp->numDS, (int)tp->numDNSKEY);
2285         if(tp->ds_rrset) {
2286                 log_packed_rrset(NO_VERBOSE, "DS:", tp->ds_rrset);
2287         }
2288         if(tp->dnskey_rrset) {
2289                 log_packed_rrset(NO_VERBOSE, "DNSKEY:", tp->dnskey_rrset);
2290         }
2291         log_info("file %s", tp->autr->file);
2292         ctime_r(&tp->autr->last_queried, buf);
2293         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2294         log_info("last_queried: %u %s", (unsigned)tp->autr->last_queried, buf);
2295         ctime_r(&tp->autr->last_success, buf);
2296         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2297         log_info("last_success: %u %s", (unsigned)tp->autr->last_success, buf);
2298         ctime_r(&tp->autr->next_probe_time, buf);
2299         if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2300         log_info("next_probe_time: %u %s", (unsigned)tp->autr->next_probe_time,
2301                 buf);
2302         log_info("query_interval: %u", (unsigned)tp->autr->query_interval);
2303         log_info("retry_time: %u", (unsigned)tp->autr->retry_time);
2304         log_info("query_failed: %u", (unsigned)tp->autr->query_failed);
2305
2306         for(ta=tp->autr->keys; ta; ta=ta->next) {
2307                 autr_debug_print_ta(ta);
2308         }
2309 }
2310
2311 void
2312 autr_debug_print(struct val_anchors* anchors)
2313 {
2314         struct trust_anchor* tp;
2315         lock_basic_lock(&anchors->lock);
2316         RBTREE_FOR(tp, struct trust_anchor*, anchors->tree) {
2317                 lock_basic_lock(&tp->lock);
2318                 autr_debug_print_tp(tp);
2319                 lock_basic_unlock(&tp->lock);
2320         }
2321         lock_basic_unlock(&anchors->lock);
2322 }
2323
2324 void probe_answer_cb(void* arg, int ATTR_UNUSED(rcode),
2325         sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(sec),
2326         char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
2327 {
2328         /* retry was set before the query was done,
2329          * re-querytime is set when query succeeded, but that may not
2330          * have reset this timer because the query could have been
2331          * handled by another thread. In that case, this callback would
2332          * get called after the original timeout is done.
2333          * By not resetting the timer, it may probe more often, but not
2334          * less often.
2335          * Unless the new lookup resulted in smaller TTLs and thus smaller
2336          * timeout values. In that case one old TTL could be mistakenly done.
2337          */
2338         struct module_env* env = (struct module_env*)arg;
2339         verbose(VERB_ALGO, "autotrust probe answer cb");
2340         reset_worker_timer(env);
2341 }
2342
2343 /** probe a trust anchor DNSKEY and unlocks tp */
2344 static void
2345 probe_anchor(struct module_env* env, struct trust_anchor* tp)
2346 {
2347         struct query_info qinfo;
2348         uint16_t qflags = BIT_RD;
2349         struct edns_data edns;
2350         sldns_buffer* buf = env->scratch_buffer;
2351         qinfo.qname = regional_alloc_init(env->scratch, tp->name, tp->namelen);
2352         if(!qinfo.qname) {
2353                 log_err("out of memory making 5011 probe");
2354                 return;
2355         }
2356         qinfo.qname_len = tp->namelen;
2357         qinfo.qtype = LDNS_RR_TYPE_DNSKEY;
2358         qinfo.qclass = tp->dclass;
2359         qinfo.local_alias = NULL;
2360         log_query_info(VERB_ALGO, "autotrust probe", &qinfo);
2361         verbose(VERB_ALGO, "retry probe set in %d seconds",
2362                 (int)tp->autr->next_probe_time - (int)*env->now);
2363         edns.edns_present = 1;
2364         edns.ext_rcode = 0;
2365         edns.edns_version = 0;
2366         edns.bits = EDNS_DO;
2367         edns.opt_list = NULL;
2368         if(sldns_buffer_capacity(buf) < 65535)
2369                 edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
2370         else    edns.udp_size = 65535;
2371
2372         /* can't hold the lock while mesh_run is processing */
2373         lock_basic_unlock(&tp->lock);
2374
2375         /* delete the DNSKEY from rrset and key cache so an active probe
2376          * is done. First the rrset so another thread does not use it
2377          * to recreate the key entry in a race condition. */
2378         rrset_cache_remove(env->rrset_cache, qinfo.qname, qinfo.qname_len,
2379                 qinfo.qtype, qinfo.qclass, 0);
2380         key_cache_remove(env->key_cache, qinfo.qname, qinfo.qname_len,
2381                 qinfo.qclass);
2382
2383         if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
2384                 &probe_answer_cb, env)) {
2385                 log_err("out of memory making 5011 probe");
2386         }
2387 }
2388
2389 /** fetch first to-probe trust-anchor and lock it and set retrytime */
2390 static struct trust_anchor*
2391 todo_probe(struct module_env* env, time_t* next)
2392 {
2393         struct trust_anchor* tp;
2394         rbnode_type* el;
2395         /* get first one */
2396         lock_basic_lock(&env->anchors->lock);
2397         if( (el=rbtree_first(&env->anchors->autr->probe)) == RBTREE_NULL) {
2398                 /* in case of revoked anchors */
2399                 lock_basic_unlock(&env->anchors->lock);
2400                 /* signal that there are no anchors to probe */
2401                 *next = 0;
2402                 return NULL;
2403         }
2404         tp = (struct trust_anchor*)el->key;
2405         lock_basic_lock(&tp->lock);
2406
2407         /* is it eligible? */
2408         if((time_t)tp->autr->next_probe_time > *env->now) {
2409                 /* no more to probe */
2410                 *next = (time_t)tp->autr->next_probe_time - *env->now;
2411                 lock_basic_unlock(&tp->lock);
2412                 lock_basic_unlock(&env->anchors->lock);
2413                 return NULL;
2414         }
2415
2416         /* reset its next probe time */
2417         (void)rbtree_delete(&env->anchors->autr->probe, tp);
2418         tp->autr->next_probe_time = calc_next_probe(env, tp->autr->retry_time);
2419         (void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2420         lock_basic_unlock(&env->anchors->lock);
2421
2422         return tp;
2423 }
2424
2425 time_t
2426 autr_probe_timer(struct module_env* env)
2427 {
2428         struct trust_anchor* tp;
2429         time_t next_probe = 3600;
2430         int num = 0;
2431         if(autr_permit_small_holddown) next_probe = 1;
2432         verbose(VERB_ALGO, "autotrust probe timer callback");
2433         /* while there are still anchors to probe */
2434         while( (tp = todo_probe(env, &next_probe)) ) {
2435                 /* make a probe for this anchor */
2436                 probe_anchor(env, tp);
2437                 num++;
2438         }
2439         regional_free_all(env->scratch);
2440         if(next_probe == 0)
2441                 return 0; /* no trust points to probe */
2442         verbose(VERB_ALGO, "autotrust probe timer %d callbacks done", num);
2443         return next_probe;
2444 }