contrib/unbound/validator/validator.c

   1 /*
   2  * validator/validator.c - secure validator DNS query response module
   3  *
   4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  25  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  26  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
  27  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  28  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33  * POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file contains a module that performs validation of DNS queries.
  40  * According to RFC 4034.
  41  */
  42 #include "config.h"
  43 #include <ldns/ldns.h>
  44 #include "validator/validator.h"
  45 #include "validator/val_anchor.h"
  46 #include "validator/val_kcache.h"
  47 #include "validator/val_kentry.h"
  48 #include "validator/val_utils.h"
  49 #include "validator/val_nsec.h"
  50 #include "validator/val_nsec3.h"
  51 #include "validator/val_neg.h"
  52 #include "validator/val_sigcrypt.h"
  53 #include "validator/autotrust.h"
  54 #include "services/cache/dns.h"
  55 #include "util/data/dname.h"
  56 #include "util/module.h"
  57 #include "util/log.h"
  58 #include "util/net_help.h"
  59 #include "util/regional.h"
  60 #include "util/config_file.h"
  61 #include "util/fptr_wlist.h"
  62
  63 /* forward decl for cache response and normal super inform calls of a DS */
  64 static void process_ds_response(struct module_qstate* qstate,
  65         struct val_qstate* vq, int id, int rcode, struct dns_msg* msg,
  66         struct query_info* qinfo, struct sock_list* origin);
  67
  68 /** fill up nsec3 key iterations config entry */
  69 static int
  70 fill_nsec3_iter(struct val_env* ve, char* s, int c)
  71 {
  72         char* e;
  73         int i;
  74         free(ve->nsec3_keysize);
  75         free(ve->nsec3_maxiter);
  76         ve->nsec3_keysize = (size_t*)calloc(sizeof(size_t), (size_t)c);
  77         ve->nsec3_maxiter = (size_t*)calloc(sizeof(size_t), (size_t)c);
  78         if(!ve->nsec3_keysize || !ve->nsec3_maxiter) {
  79                 log_err("out of memory");
  80                 return 0;
  81         }
  82         for(i=0; i<c; i++) {
  83                 ve->nsec3_keysize[i] = (size_t)strtol(s, &e, 10);
  84                 if(s == e) {
  85                         log_err("cannot parse: %s", s);
  86                         return 0;
  87                 }
  88                 s = e;
  89                 ve->nsec3_maxiter[i] = (size_t)strtol(s, &e, 10);
  90                 if(s == e) {
  91                         log_err("cannot parse: %s", s);
  92                         return 0;
  93                 }
  94                 s = e;
  95                 if(i>0 && ve->nsec3_keysize[i-1] >= ve->nsec3_keysize[i]) {
  96                         log_err("nsec3 key iterations not ascending: %d %d",
  97                                 (int)ve->nsec3_keysize[i-1],
  98                                 (int)ve->nsec3_keysize[i]);
  99                         return 0;
 100                 }
 101                 verbose(VERB_ALGO, "validator nsec3cfg keysz %d mxiter %d",
 102                         (int)ve->nsec3_keysize[i], (int)ve->nsec3_maxiter[i]);
 103         }
 104         return 1;
 105 }
 106
 107 /** apply config settings to validator */
 108 static int
 109 val_apply_cfg(struct module_env* env, struct val_env* val_env,
 110         struct config_file* cfg)
 111 {
 112         int c;
 113         val_env->bogus_ttl = (uint32_t)cfg->bogus_ttl;
 114         val_env->clean_additional = cfg->val_clean_additional;
 115         val_env->permissive_mode = cfg->val_permissive_mode;
 116         if(!env->anchors)
 117                 env->anchors = anchors_create();
 118         if(!env->anchors) {
 119                 log_err("out of memory");
 120                 return 0;
 121         }
 122         if(!val_env->kcache)
 123                 val_env->kcache = key_cache_create(cfg);
 124         if(!val_env->kcache) {
 125                 log_err("out of memory");
 126                 return 0;
 127         }
 128         env->key_cache = val_env->kcache;
 129         if(!anchors_apply_cfg(env->anchors, cfg)) {
 130                 log_err("validator: error in trustanchors config");
 131                 return 0;
 132         }
 133         val_env->date_override = cfg->val_date_override;
 134         val_env->skew_min = cfg->val_sig_skew_min;
 135         val_env->skew_max = cfg->val_sig_skew_max;
 136         c = cfg_count_numbers(cfg->val_nsec3_key_iterations);
 137         if(c < 1 || (c&1)) {
 138                 log_err("validator: unparseable or odd nsec3 key "
 139                         "iterations: %s", cfg->val_nsec3_key_iterations);
 140                 return 0;
 141         }
 142         val_env->nsec3_keyiter_count = c/2;
 143         if(!fill_nsec3_iter(val_env, cfg->val_nsec3_key_iterations, c/2)) {
 144                 log_err("validator: cannot apply nsec3 key iterations");
 145                 return 0;
 146         }
 147         if(!val_env->neg_cache)
 148                 val_env->neg_cache = val_neg_create(cfg,
 149                         val_env->nsec3_maxiter[val_env->nsec3_keyiter_count-1]);
 150         if(!val_env->neg_cache) {
 151                 log_err("out of memory");
 152                 return 0;
 153         }
 154         env->neg_cache = val_env->neg_cache;
 155         return 1;
 156 }
 157
 158 int
 159 val_init(struct module_env* env, int id)
 160 {
 161         struct val_env* val_env = (struct val_env*)calloc(1,
 162                 sizeof(struct val_env));
 163         if(!val_env) {
 164                 log_err("malloc failure");
 165                 return 0;
 166         }
 167         env->modinfo[id] = (void*)val_env;
 168         env->need_to_validate = 1;
 169         val_env->permissive_mode = 0;
 170         lock_basic_init(&val_env->bogus_lock);
 171         lock_protect(&val_env->bogus_lock, &val_env->num_rrset_bogus,
 172                 sizeof(val_env->num_rrset_bogus));
 173         if(!val_apply_cfg(env, val_env, env->cfg)) {
 174                 log_err("validator: could not apply configuration settings.");
 175                 return 0;
 176         }
 177         return 1;
 178 }
 179
 180 void
 181 val_deinit(struct module_env* env, int id)
 182 {
 183         struct val_env* val_env;
 184         if(!env || !env->modinfo[id])
 185                 return;
 186         val_env = (struct val_env*)env->modinfo[id];
 187         lock_basic_destroy(&val_env->bogus_lock);
 188         anchors_delete(env->anchors);
 189         env->anchors = NULL;
 190         key_cache_delete(val_env->kcache);
 191         neg_cache_delete(val_env->neg_cache);
 192         free(val_env->nsec3_keysize);
 193         free(val_env->nsec3_maxiter);
 194         free(val_env);
 195         env->modinfo[id] = NULL;
 196 }
 197
 198 /** fill in message structure */
 199 static struct val_qstate*
 200 val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq)
 201 {
 202         if(!qstate->return_msg || qstate->return_rcode != LDNS_RCODE_NOERROR) {
 203                 /* create a message to verify */
 204                 verbose(VERB_ALGO, "constructing reply for validation");
 205                 vq->orig_msg = (struct dns_msg*)regional_alloc(qstate->region,
 206                         sizeof(struct dns_msg));
 207                 if(!vq->orig_msg)
 208                         return NULL;
 209                 vq->orig_msg->qinfo = qstate->qinfo;
 210                 vq->orig_msg->rep = (struct reply_info*)regional_alloc(
 211                         qstate->region, sizeof(struct reply_info));
 212                 if(!vq->orig_msg->rep)
 213                         return NULL;
 214                 memset(vq->orig_msg->rep, 0, sizeof(struct reply_info));
 215                 vq->orig_msg->rep->flags = (uint16_t)(qstate->return_rcode&0xf)
 216                         |BIT_QR|BIT_RA|(qstate->query_flags|(BIT_CD|BIT_RD));
 217                 vq->orig_msg->rep->qdcount = 1;
 218         } else {
 219                 vq->orig_msg = qstate->return_msg;
 220         }
 221         vq->qchase = qstate->qinfo;
 222         /* chase reply will be an edited (sub)set of the orig msg rrset ptrs */
 223         vq->chase_reply = regional_alloc_init(qstate->region,
 224                 vq->orig_msg->rep,
 225                 sizeof(struct reply_info) - sizeof(struct rrset_ref));
 226         if(!vq->chase_reply)
 227                 return NULL;
 228         vq->chase_reply->rrsets = regional_alloc_init(qstate->region,
 229                 vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*)
 230                         * vq->orig_msg->rep->rrset_count);
 231         if(!vq->chase_reply->rrsets)
 232                 return NULL;
 233         vq->rrset_skip = 0;
 234         return vq;
 235 }
 236
 237 /** allocate new validator query state */
 238 static struct val_qstate*
 239 val_new(struct module_qstate* qstate, int id)
 240 {
 241         struct val_qstate* vq = (struct val_qstate*)regional_alloc(
 242                 qstate->region, sizeof(*vq));
 243         log_assert(!qstate->minfo[id]);
 244         if(!vq)
 245                 return NULL;
 246         memset(vq, 0, sizeof(*vq));
 247         qstate->minfo[id] = vq;
 248         vq->state = VAL_INIT_STATE;
 249         return val_new_getmsg(qstate, vq);
 250 }
 251
 252 /**
 253  * Exit validation with an error status
 254  *
 255  * @param qstate: query state
 256  * @param id: validator id.
 257  * @return false, for use by caller to return to stop processing.
 258  */
 259 static int
 260 val_error(struct module_qstate* qstate, int id)
 261 {
 262         qstate->ext_state[id] = module_error;
 263         qstate->return_rcode = LDNS_RCODE_SERVFAIL;
 264         return 0;
 265 }
 266
 267 /**
 268  * Check to see if a given response needs to go through the validation
 269  * process. Typical reasons for this routine to return false are: CD bit was
 270  * on in the original request, or the response is a kind of message that
 271  * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.)
 272  *
 273  * @param qstate: query state.
 274  * @param ret_rc: rcode for this message (if noerror - examine ret_msg).
 275  * @param ret_msg: return msg, can be NULL; look at rcode instead.
 276  * @return true if the response could use validation (although this does not
 277  *         mean we can actually validate this response).
 278  */
 279 static int
 280 needs_validation(struct module_qstate* qstate, int ret_rc,
 281         struct dns_msg* ret_msg)
 282 {
 283         int rcode;
 284
 285         /* If the CD bit is on in the original request, then we don't bother to
 286          * validate anything.*/
 287         if(qstate->query_flags & BIT_CD) {
 288                 verbose(VERB_ALGO, "not validating response due to CD bit");
 289                 return 0;
 290         }
 291
 292         if(ret_rc != LDNS_RCODE_NOERROR || !ret_msg)
 293                 rcode = ret_rc;
 294         else    rcode = (int)FLAGS_GET_RCODE(ret_msg->rep->flags);
 295
 296         if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) {
 297                 verbose(VERB_ALGO, "cannot validate non-answer, rcode %s",
 298                         ldns_lookup_by_id(ldns_rcodes, rcode)?
 299                         ldns_lookup_by_id(ldns_rcodes, rcode)->name:"??");
 300                 return 0;
 301         }
 302
 303         /* cannot validate positive RRSIG response. (negatives can) */
 304         if(qstate->qinfo.qtype == LDNS_RR_TYPE_RRSIG &&
 305                 rcode == LDNS_RCODE_NOERROR && ret_msg &&
 306                 ret_msg->rep->an_numrrsets > 0) {
 307                 verbose(VERB_ALGO, "cannot validate RRSIG, no sigs on sigs.");
 308                 return 0;
 309         }
 310         return 1;
 311 }
 312
 313 /**
 314  * Check to see if the response has already been validated.
 315  * @param ret_msg: return msg, can be NULL
 316  * @return true if the response has already been validated
 317  */
 318 static int
 319 already_validated(struct dns_msg* ret_msg)
 320 {
 321         /* validate unchecked, and re-validate bogus messages */
 322         if (ret_msg && ret_msg->rep->security > sec_status_bogus)
 323         {
 324                 verbose(VERB_ALGO, "response has already been validated: %s",
 325                         sec_status_to_string(ret_msg->rep->security));
 326                 return 1;
 327         }
 328         return 0;
 329 }
 330
 331 /**
 332  * Generate a request for DNS data.
 333  *
 334  * @param qstate: query state that is the parent.
 335  * @param id: module id.
 336  * @param name: what name to query for.
 337  * @param namelen: length of name.
 338  * @param qtype: query type.
 339  * @param qclass: query class.
 340  * @param flags: additional flags, such as the CD bit (BIT_CD), or 0.
 341  * @return false on alloc failure.
 342  */
 343 static int
 344 generate_request(struct module_qstate* qstate, int id, uint8_t* name,
 345         size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags)
 346 {
 347         struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
 348         struct module_qstate* newq;
 349         struct query_info ask;
 350         ask.qname = name;
 351         ask.qname_len = namelen;
 352         ask.qtype = qtype;
 353         ask.qclass = qclass;
 354         log_query_info(VERB_ALGO, "generate request", &ask);
 355         fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
 356         if(!(*qstate->env->attach_sub)(qstate, &ask,
 357                 (uint16_t)(BIT_RD|flags), 0, &newq)){
 358                 log_err("Could not generate request: out of memory");
 359                 return 0;
 360         }
 361         /* newq; validator does not need state created for that
 362          * query, and its a 'normal' for iterator as well */
 363         if(newq) {
 364                 /* add our blacklist to the query blacklist */
 365                 sock_list_merge(&newq->blacklist, newq->region,
 366                         vq->chain_blacklist);
 367         }
 368         qstate->ext_state[id] = module_wait_subquery;
 369         return 1;
 370 }
 371
 372 /**
 373  * Prime trust anchor for use.
 374  * Generate and dispatch a priming query for the given trust anchor.
 375  * The trust anchor can be DNSKEY or DS and does not have to be signed.
 376  *
 377  * @param qstate: query state.
 378  * @param vq: validator query state.
 379  * @param id: module id.
 380  * @param toprime: what to prime.
 381  * @return false on a processing error.
 382  */
 383 static int
 384 prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq,
 385         int id, struct trust_anchor* toprime)
 386 {
 387         int ret = generate_request(qstate, id, toprime->name, toprime->namelen,
 388                 LDNS_RR_TYPE_DNSKEY, toprime->dclass, BIT_CD);
 389         if(!ret) {
 390                 log_err("Could not prime trust anchor: out of memory");
 391                 return 0;
 392         }
 393         /* ignore newq; validator does not need state created for that
 394          * query, and its a 'normal' for iterator as well */
 395         vq->wait_prime_ta = 1; /* to elicit PRIME_RESP_STATE processing
 396                 from the validator inform_super() routine */
 397         /* store trust anchor name for later lookup when prime returns */
 398         vq->trust_anchor_name = regional_alloc_init(qstate->region,
 399                 toprime->name, toprime->namelen);
 400         vq->trust_anchor_len = toprime->namelen;
 401         vq->trust_anchor_labs = toprime->namelabs;
 402         if(!vq->trust_anchor_name) {
 403                 log_err("Could not prime trust anchor: out of memory");
 404                 return 0;
 405         }
 406         return 1;
 407 }
 408
 409 /**
 410  * Validate if the ANSWER and AUTHORITY sections contain valid rrsets.
 411  * They must be validly signed with the given key.
 412  * Tries to validate ADDITIONAL rrsets as well, but only to check them.
 413  * Allows unsigned CNAME after a DNAME that expands the DNAME.
 414  *
 415  * Note that by the time this method is called, the process of finding the
 416  * trusted DNSKEY rrset that signs this response must already have been
 417  * completed.
 418  *
 419  * @param qstate: query state.
 420  * @param env: module env for verify.
 421  * @param ve: validator env for verify.
 422  * @param qchase: query that was made.
 423  * @param chase_reply: answer to validate.
 424  * @param key_entry: the key entry, which is trusted, and which matches
 425  *      the signer of the answer. The key entry isgood().
 426  * @return false if any of the rrsets in the an or ns sections of the message
 427  *      fail to verify. The message is then set to bogus.
 428  */
 429 static int
 430 validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
 431         struct val_env* ve, struct query_info* qchase,
 432         struct reply_info* chase_reply, struct key_entry_key* key_entry)
 433 {
 434         uint8_t* sname;
 435         size_t i, slen;
 436         struct ub_packed_rrset_key* s;
 437         enum sec_status sec;
 438         int dname_seen = 0;
 439         char* reason = NULL;
 440
 441         /* validate the ANSWER section */
 442         for(i=0; i<chase_reply->an_numrrsets; i++) {
 443                 s = chase_reply->rrsets[i];
 444                 /* Skip the CNAME following a (validated) DNAME.
 445                  * Because of the normalization routines in the iterator,
 446                  * there will always be an unsigned CNAME following a DNAME
 447                  * (unless qtype=DNAME). */
 448                 if(dname_seen && ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
 449                         dname_seen = 0;
 450                         /* CNAME was synthesized by our own iterator */
 451                         /* since the DNAME verified, mark the CNAME as secure */
 452                         ((struct packed_rrset_data*)s->entry.data)->security =
 453                                 sec_status_secure;
 454                         ((struct packed_rrset_data*)s->entry.data)->trust =
 455                                 rrset_trust_validated;
 456                         continue;
 457                 }
 458
 459                 /* Verify the answer rrset */
 460                 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason);
 461                 /* If the (answer) rrset failed to validate, then this
 462                  * message is BAD. */
 463                 if(sec != sec_status_secure) {
 464                         log_nametypeclass(VERB_QUERY, "validator: response "
 465                                 "has failed ANSWER rrset:", s->rk.dname,
 466                                 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
 467                         errinf(qstate, reason);
 468                         if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME)
 469                                 errinf(qstate, "for CNAME");
 470                         else if(ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME)
 471                                 errinf(qstate, "for DNAME");
 472                         errinf_origin(qstate, qstate->reply_origin);
 473                         chase_reply->security = sec_status_bogus;
 474                         return 0;
 475                 }
 476
 477                 /* Notice a DNAME that should be followed by an unsigned
 478                  * CNAME. */
 479                 if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
 480                         ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) {
 481                         dname_seen = 1;
 482                 }
 483         }
 484
 485         /* validate the AUTHORITY section */
 486         for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
 487                 chase_reply->ns_numrrsets; i++) {
 488                 s = chase_reply->rrsets[i];
 489                 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason);
 490                 /* If anything in the authority section fails to be secure,
 491                  * we have a bad message. */
 492                 if(sec != sec_status_secure) {
 493                         log_nametypeclass(VERB_QUERY, "validator: response "
 494                                 "has failed AUTHORITY rrset:", s->rk.dname,
 495                                 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
 496                         errinf(qstate, reason);
 497                         errinf_rrset(qstate, s);
 498                         errinf_origin(qstate, qstate->reply_origin);
 499                         chase_reply->security = sec_status_bogus;
 500                         return 0;
 501                 }
 502         }
 503
 504         /* attempt to validate the ADDITIONAL section rrsets */
 505         if(!ve->clean_additional)
 506                 return 1;
 507         for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
 508                 i<chase_reply->rrset_count; i++) {
 509                 s = chase_reply->rrsets[i];
 510                 /* only validate rrs that have signatures with the key */
 511                 /* leave others unchecked, those get removed later on too */
 512                 val_find_rrset_signer(s, &sname, &slen);
 513                 if(sname && query_dname_compare(sname, key_entry->name)==0)
 514                         (void)val_verify_rrset_entry(env, ve, s, key_entry,
 515                                 &reason);
 516                 /* the additional section can fail to be secure,
 517                  * it is optional, check signature in case we need
 518                  * to clean the additional section later. */
 519         }
 520
 521         return 1;
 522 }
 523
 524 /**
 525  * Detect wrong truncated response (say from BIND 9.6.1 that is forwarding
 526  * and saw the NS record without signatures from a referral).
 527  * The positive response has a mangled authority section.
 528  * Remove that authority section and the additional section.
 529  * @param rep: reply
 530  * @return true if a wrongly truncated response.
 531  */
 532 static int
 533 detect_wrongly_truncated(struct reply_info* rep)
 534 {
 535         size_t i;
 536         /* only NS in authority, and it is bogus */
 537         if(rep->ns_numrrsets != 1 || rep->an_numrrsets == 0)
 538                 return 0;
 539         if(ntohs(rep->rrsets[ rep->an_numrrsets ]->rk.type) != LDNS_RR_TYPE_NS)
 540                 return 0;
 541         if(((struct packed_rrset_data*)rep->rrsets[ rep->an_numrrsets ]
 542                 ->entry.data)->security == sec_status_secure)
 543                 return 0;
 544         /* answer section is present and secure */
 545         for(i=0; i<rep->an_numrrsets; i++) {
 546                 if(((struct packed_rrset_data*)rep->rrsets[ i ]
 547                         ->entry.data)->security != sec_status_secure)
 548                         return 0;
 549         }
 550         verbose(VERB_ALGO, "truncating to minimal response");
 551         return 1;
 552 }
 553
 554
 555 /**
 556  * Given a "positive" response -- a response that contains an answer to the
 557  * question, and no CNAME chain, validate this response.
 558  *
 559  * The answer and authority RRsets must already be verified as secure.
 560  *
 561  * @param env: module env for verify.
 562  * @param ve: validator env for verify.
 563  * @param qchase: query that was made.
 564  * @param chase_reply: answer to that query to validate.
 565  * @param kkey: the key entry, which is trusted, and which matches
 566  *      the signer of the answer. The key entry isgood().
 567  */
 568 static void
 569 validate_positive_response(struct module_env* env, struct val_env* ve,
 570         struct query_info* qchase, struct reply_info* chase_reply,
 571         struct key_entry_key* kkey)
 572 {
 573         uint8_t* wc = NULL;
 574         int wc_NSEC_ok = 0;
 575         int nsec3s_seen = 0;
 576         size_t i;
 577         struct ub_packed_rrset_key* s;
 578
 579         /* validate the ANSWER section - this will be the answer itself */
 580         for(i=0; i<chase_reply->an_numrrsets; i++) {
 581                 s = chase_reply->rrsets[i];
 582
 583                 /* Check to see if the rrset is the result of a wildcard
 584                  * expansion. If so, an additional check will need to be
 585                  * made in the authority section. */
 586                 if(!val_rrset_wildcard(s, &wc)) {
 587                         log_nametypeclass(VERB_QUERY, "Positive response has "
 588                                 "inconsistent wildcard sigs:", s->rk.dname,
 589                                 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
 590                         chase_reply->security = sec_status_bogus;
 591                         return;
 592                 }
 593         }
 594
 595         /* validate the AUTHORITY section as well - this will generally be
 596          * the NS rrset (which could be missing, no problem) */
 597         for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
 598                 chase_reply->ns_numrrsets; i++) {
 599                 s = chase_reply->rrsets[i];
 600
 601                 /* If this is a positive wildcard response, and we have a
 602                  * (just verified) NSEC record, try to use it to 1) prove
 603                  * that qname doesn't exist and 2) that the correct wildcard
 604                  * was used. */
 605                 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
 606                         if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
 607                                 wc_NSEC_ok = 1;
 608                         }
 609                         /* if not, continue looking for proof */
 610                 }
 611
 612                 /* Otherwise, if this is a positive wildcard response and
 613                  * we have NSEC3 records */
 614                 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
 615                         nsec3s_seen = 1;
 616                 }
 617         }
 618
 619         /* If this was a positive wildcard response that we haven't already
 620          * proven, and we have NSEC3 records, try to prove it using the NSEC3
 621          * records. */
 622         if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
 623                 enum sec_status sec = nsec3_prove_wildcard(env, ve,
 624                         chase_reply->rrsets+chase_reply->an_numrrsets,
 625                         chase_reply->ns_numrrsets, qchase, kkey, wc);
 626                 if(sec == sec_status_insecure) {
 627                         verbose(VERB_ALGO, "Positive wildcard response is "
 628                                 "insecure");
 629                         chase_reply->security = sec_status_insecure;
 630                         return;
 631                 } else if(sec == sec_status_secure)
 632                         wc_NSEC_ok = 1;
 633         }
 634
 635         /* If after all this, we still haven't proven the positive wildcard
 636          * response, fail. */
 637         if(wc != NULL && !wc_NSEC_ok) {
 638                 verbose(VERB_QUERY, "positive response was wildcard "
 639                         "expansion and did not prove original data "
 640                         "did not exist");
 641                 chase_reply->security = sec_status_bogus;
 642                 return;
 643         }
 644
 645         verbose(VERB_ALGO, "Successfully validated positive response");
 646         chase_reply->security = sec_status_secure;
 647 }
 648
 649 /**
 650  * Validate a NOERROR/NODATA signed response -- a response that has a
 651  * NOERROR Rcode but no ANSWER section RRsets. This consists of making
 652  * certain that the authority section NSEC/NSEC3s proves that the qname
 653  * does exist and the qtype doesn't.
 654  *
 655  * The answer and authority RRsets must already be verified as secure.
 656  *
 657  * @param env: module env for verify.
 658  * @param ve: validator env for verify.
 659  * @param qchase: query that was made.
 660  * @param chase_reply: answer to that query to validate.
 661  * @param kkey: the key entry, which is trusted, and which matches
 662  *      the signer of the answer. The key entry isgood().
 663  */
 664 static void
 665 validate_nodata_response(struct module_env* env, struct val_env* ve,
 666         struct query_info* qchase, struct reply_info* chase_reply,
 667         struct key_entry_key* kkey)
 668 {
 669         /* Since we are here, there must be nothing in the ANSWER section to
 670          * validate. */
 671         /* (Note: CNAME/DNAME responses will not directly get here --
 672          * instead, they are chased down into indiviual CNAME validations,
 673          * and at the end of the cname chain a POSITIVE, or CNAME_NOANSWER
 674          * validation.) */
 675
 676         /* validate the AUTHORITY section */
 677         int has_valid_nsec = 0; /* If true, then the NODATA has been proven.*/
 678         uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
 679                                 proven closest encloser. */
 680         uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
 681         int nsec3s_seen = 0; /* nsec3s seen */
 682         struct ub_packed_rrset_key* s;
 683         size_t i;
 684
 685         for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
 686                 chase_reply->ns_numrrsets; i++) {
 687                 s = chase_reply->rrsets[i];
 688                 /* If we encounter an NSEC record, try to use it to prove
 689                  * NODATA.
 690                  * This needs to handle the ENT NODATA case. */
 691                 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
 692                         if(nsec_proves_nodata(s, qchase, &wc)) {
 693                                 has_valid_nsec = 1;
 694                                 /* sets wc-encloser if wildcard applicable */
 695                         }
 696                         if(val_nsec_proves_name_error(s, qchase->qname)) {
 697                                 ce = nsec_closest_encloser(qchase->qname, s);
 698                         }
 699                         if(val_nsec_proves_insecuredelegation(s, qchase)) {
 700                                 verbose(VERB_ALGO, "delegation is insecure");
 701                                 chase_reply->security = sec_status_insecure;
 702                                 return;
 703                         }
 704                 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
 705                         nsec3s_seen = 1;
 706                 }
 707         }
 708
 709         /* check to see if we have a wildcard NODATA proof. */
 710
 711         /* The wildcard NODATA is 1 NSEC proving that qname does not exist
 712          * (and also proving what the closest encloser is), and 1 NSEC
 713          * showing the matching wildcard, which must be *.closest_encloser. */
 714         if(wc && !ce)
 715                 has_valid_nsec = 0;
 716         else if(wc && ce) {
 717                 if(query_dname_compare(wc, ce) != 0) {
 718                         has_valid_nsec = 0;
 719                 }
 720         }
 721
 722         if(!has_valid_nsec && nsec3s_seen) {
 723                 enum sec_status sec = nsec3_prove_nodata(env, ve,
 724                         chase_reply->rrsets+chase_reply->an_numrrsets,
 725                         chase_reply->ns_numrrsets, qchase, kkey);
 726                 if(sec == sec_status_insecure) {
 727                         verbose(VERB_ALGO, "NODATA response is insecure");
 728                         chase_reply->security = sec_status_insecure;
 729                         return;
 730                 } else if(sec == sec_status_secure)
 731                         has_valid_nsec = 1;
 732         }
 733
 734         if(!has_valid_nsec) {
 735                 verbose(VERB_QUERY, "NODATA response failed to prove NODATA "
 736                         "status with NSEC/NSEC3");
 737                 if(verbosity >= VERB_ALGO)
 738                         log_dns_msg("Failed NODATA", qchase, chase_reply);
 739                 chase_reply->security = sec_status_bogus;
 740                 return;
 741         }
 742
 743         verbose(VERB_ALGO, "successfully validated NODATA response.");
 744         chase_reply->security = sec_status_secure;
 745 }
 746
 747 /**
 748  * Validate a NAMEERROR signed response -- a response that has a NXDOMAIN
 749  * Rcode.
 750  * This consists of making certain that the authority section NSEC proves
 751  * that the qname doesn't exist and the covering wildcard also doesn't exist..
 752  *
 753  * The answer and authority RRsets must have already been verified as secure.
 754  *
 755  * @param env: module env for verify.
 756  * @param ve: validator env for verify.
 757  * @param qchase: query that was made.
 758  * @param chase_reply: answer to that query to validate.
 759  * @param kkey: the key entry, which is trusted, and which matches
 760  *      the signer of the answer. The key entry isgood().
 761  */
 762 static void
 763 validate_nameerror_response(struct module_env* env, struct val_env* ve,
 764         struct query_info* qchase, struct reply_info* chase_reply,
 765         struct key_entry_key* kkey)
 766 {
 767         int has_valid_nsec = 0;
 768         int has_valid_wnsec = 0;
 769         int nsec3s_seen = 0;
 770         struct ub_packed_rrset_key* s;
 771         size_t i;
 772
 773         for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
 774                 chase_reply->ns_numrrsets; i++) {
 775                 s = chase_reply->rrsets[i];
 776                 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
 777                         if(val_nsec_proves_name_error(s, qchase->qname))
 778                                 has_valid_nsec = 1;
 779                         if(val_nsec_proves_no_wc(s, qchase->qname,
 780                                 qchase->qname_len))
 781                                 has_valid_wnsec = 1;
 782                         if(val_nsec_proves_insecuredelegation(s, qchase)) {
 783                                 verbose(VERB_ALGO, "delegation is insecure");
 784                                 chase_reply->security = sec_status_insecure;
 785                                 return;
 786                         }
 787                 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3)
 788                         nsec3s_seen = 1;
 789         }
 790
 791         if((!has_valid_nsec || !has_valid_wnsec) && nsec3s_seen) {
 792                 /* use NSEC3 proof, both answer and auth rrsets, in case
 793                  * NSEC3s end up in the answer (due to qtype=NSEC3 or so) */
 794                 chase_reply->security = nsec3_prove_nameerror(env, ve,
 795                         chase_reply->rrsets, chase_reply->an_numrrsets+
 796                         chase_reply->ns_numrrsets, qchase, kkey);
 797                 if(chase_reply->security != sec_status_secure) {
 798                         verbose(VERB_QUERY, "NameError response failed nsec, "
 799                                 "nsec3 proof was %s", sec_status_to_string(
 800                                 chase_reply->security));
 801                         return;
 802                 }
 803                 has_valid_nsec = 1;
 804                 has_valid_wnsec = 1;
 805         }
 806
 807         /* If the message fails to prove either condition, it is bogus. */
 808         if(!has_valid_nsec) {
 809                 verbose(VERB_QUERY, "NameError response has failed to prove: "
 810                           "qname does not exist");
 811                 chase_reply->security = sec_status_bogus;
 812                 return;
 813         }
 814
 815         if(!has_valid_wnsec) {
 816                 verbose(VERB_QUERY, "NameError response has failed to prove: "
 817                           "covering wildcard does not exist");
 818                 chase_reply->security = sec_status_bogus;
 819                 return;
 820         }
 821
 822         /* Otherwise, we consider the message secure. */
 823         verbose(VERB_ALGO, "successfully validated NAME ERROR response.");
 824         chase_reply->security = sec_status_secure;
 825 }
 826
 827 /**
 828  * Given a referral response, validate rrsets and take least trusted rrset
 829  * as the current validation status.
 830  *
 831  * Note that by the time this method is called, the process of finding the
 832  * trusted DNSKEY rrset that signs this response must already have been
 833  * completed.
 834  *
 835  * @param chase_reply: answer to validate.
 836  */
 837 static void
 838 validate_referral_response(struct reply_info* chase_reply)
 839 {
 840         size_t i;
 841         enum sec_status s;
 842         /* message security equals lowest rrset security */
 843         chase_reply->security = sec_status_secure;
 844         for(i=0; i<chase_reply->rrset_count; i++) {
 845                 s = ((struct packed_rrset_data*)chase_reply->rrsets[i]
 846                         ->entry.data)->security;
 847                 if(s < chase_reply->security)
 848                         chase_reply->security = s;
 849         }
 850         verbose(VERB_ALGO, "validated part of referral response as %s",
 851                 sec_status_to_string(chase_reply->security));
 852 }
 853
 854 /**
 855  * Given an "ANY" response -- a response that contains an answer to a
 856  * qtype==ANY question, with answers. This does no checking that all
 857  * types are present.
 858  *
 859  * NOTE: it may be possible to get parent-side delegation point records
 860  * here, which won't all be signed. Right now, this routine relies on the
 861  * upstream iterative resolver to not return these responses -- instead
 862  * treating them as referrals.
 863  *
 864  * NOTE: RFC 4035 is silent on this issue, so this may change upon
 865  * clarification. Clarification draft -05 says to not check all types are
 866  * present.
 867  *
 868  * Note that by the time this method is called, the process of finding the
 869  * trusted DNSKEY rrset that signs this response must already have been
 870  * completed.
 871  *
 872  * @param env: module env for verify.
 873  * @param ve: validator env for verify.
 874  * @param qchase: query that was made.
 875  * @param chase_reply: answer to that query to validate.
 876  * @param kkey: the key entry, which is trusted, and which matches
 877  *      the signer of the answer. The key entry isgood().
 878  */
 879 static void
 880 validate_any_response(struct module_env* env, struct val_env* ve,
 881         struct query_info* qchase, struct reply_info* chase_reply,
 882         struct key_entry_key* kkey)
 883 {
 884         /* all answer and auth rrsets already verified */
 885         /* but check if a wildcard response is given, then check NSEC/NSEC3
 886          * for qname denial to see if wildcard is applicable */
 887         uint8_t* wc = NULL;
 888         int wc_NSEC_ok = 0;
 889         int nsec3s_seen = 0;
 890         size_t i;
 891         struct ub_packed_rrset_key* s;
 892
 893         if(qchase->qtype != LDNS_RR_TYPE_ANY) {
 894                 log_err("internal error: ANY validation called for non-ANY");
 895                 chase_reply->security = sec_status_bogus;
 896                 return;
 897         }
 898
 899         /* validate the ANSWER section - this will be the answer itself */
 900         for(i=0; i<chase_reply->an_numrrsets; i++) {
 901                 s = chase_reply->rrsets[i];
 902
 903                 /* Check to see if the rrset is the result of a wildcard
 904                  * expansion. If so, an additional check will need to be
 905                  * made in the authority section. */
 906                 if(!val_rrset_wildcard(s, &wc)) {
 907                         log_nametypeclass(VERB_QUERY, "Positive ANY response"
 908                                 " has inconsistent wildcard sigs:",
 909                                 s->rk.dname, ntohs(s->rk.type),
 910                                 ntohs(s->rk.rrset_class));
 911                         chase_reply->security = sec_status_bogus;
 912                         return;
 913                 }
 914         }
 915
 916         /* if it was a wildcard, check for NSEC/NSEC3s in both answer
 917          * and authority sections (NSEC may be moved to the ANSWER section) */
 918         if(wc != NULL)
 919           for(i=0; i<chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
 920                 i++) {
 921                 s = chase_reply->rrsets[i];
 922
 923                 /* If this is a positive wildcard response, and we have a
 924                  * (just verified) NSEC record, try to use it to 1) prove
 925                  * that qname doesn't exist and 2) that the correct wildcard
 926                  * was used. */
 927                 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
 928                         if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
 929                                 wc_NSEC_ok = 1;
 930                         }
 931                         /* if not, continue looking for proof */
 932                 }
 933
 934                 /* Otherwise, if this is a positive wildcard response and
 935                  * we have NSEC3 records */
 936                 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
 937                         nsec3s_seen = 1;
 938                 }
 939         }
 940
 941         /* If this was a positive wildcard response that we haven't already
 942          * proven, and we have NSEC3 records, try to prove it using the NSEC3
 943          * records. */
 944         if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
 945                 /* look both in answer and auth section for NSEC3s */
 946                 enum sec_status sec = nsec3_prove_wildcard(env, ve,
 947                         chase_reply->rrsets,
 948                         chase_reply->an_numrrsets+chase_reply->ns_numrrsets,
 949                         qchase, kkey, wc);
 950                 if(sec == sec_status_insecure) {
 951                         verbose(VERB_ALGO, "Positive ANY wildcard response is "
 952                                 "insecure");
 953                         chase_reply->security = sec_status_insecure;
 954                         return;
 955                 } else if(sec == sec_status_secure)
 956                         wc_NSEC_ok = 1;
 957         }
 958
 959         /* If after all this, we still haven't proven the positive wildcard
 960          * response, fail. */
 961         if(wc != NULL && !wc_NSEC_ok) {
 962                 verbose(VERB_QUERY, "positive ANY response was wildcard "
 963                         "expansion and did not prove original data "
 964                         "did not exist");
 965                 chase_reply->security = sec_status_bogus;
 966                 return;
 967         }
 968
 969         verbose(VERB_ALGO, "Successfully validated positive ANY response");
 970         chase_reply->security = sec_status_secure;
 971 }
 972
 973 /**
 974  * Validate CNAME response, or DNAME+CNAME.
 975  * This is just like a positive proof, except that this is about a
 976  * DNAME+CNAME. Possible wildcard proof.
 977  * Difference with positive proof is that this routine refuses
 978  * wildcarded DNAMEs.
 979  *
 980  * The answer and authority rrsets must already be verified as secure.
 981  *
 982  * @param env: module env for verify.
 983  * @param ve: validator env for verify.
 984  * @param qchase: query that was made.
 985  * @param chase_reply: answer to that query to validate.
 986  * @param kkey: the key entry, which is trusted, and which matches
 987  *      the signer of the answer. The key entry isgood().
 988  */
 989 static void
 990 validate_cname_response(struct module_env* env, struct val_env* ve,
 991         struct query_info* qchase, struct reply_info* chase_reply,
 992         struct key_entry_key* kkey)
 993 {
 994         uint8_t* wc = NULL;
 995         int wc_NSEC_ok = 0;
 996         int nsec3s_seen = 0;
 997         size_t i;
 998         struct ub_packed_rrset_key* s;
 999
1000         /* validate the ANSWER section - this will be the CNAME (+DNAME) */
1001         for(i=0; i<chase_reply->an_numrrsets; i++) {
1002                 s = chase_reply->rrsets[i];
1003
1004                 /* Check to see if the rrset is the result of a wildcard
1005                  * expansion. If so, an additional check will need to be
1006                  * made in the authority section. */
1007                 if(!val_rrset_wildcard(s, &wc)) {
1008                         log_nametypeclass(VERB_QUERY, "Cname response has "
1009                                 "inconsistent wildcard sigs:", s->rk.dname,
1010                                 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1011                         chase_reply->security = sec_status_bogus;
1012                         return;
1013                 }
1014
1015                 /* Refuse wildcarded DNAMEs rfc 4597.
1016                  * Do not follow a wildcarded DNAME because
1017                  * its synthesized CNAME expansion is underdefined */
1018                 if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
1019                         ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME && wc) {
1020                         log_nametypeclass(VERB_QUERY, "cannot validate a "
1021                                 "wildcarded DNAME:", s->rk.dname,
1022                                 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1023                         chase_reply->security = sec_status_bogus;
1024                         return;
1025                 }
1026
1027                 /* If we have found a CNAME, stop looking for one.
1028                  * The iterator has placed the CNAME chain in correct
1029                  * order. */
1030                 if (ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
1031                         break;
1032                 }
1033         }
1034
1035         /* AUTHORITY section */
1036         for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1037                 chase_reply->ns_numrrsets; i++) {
1038                 s = chase_reply->rrsets[i];
1039
1040                 /* If this is a positive wildcard response, and we have a
1041                  * (just verified) NSEC record, try to use it to 1) prove
1042                  * that qname doesn't exist and 2) that the correct wildcard
1043                  * was used. */
1044                 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1045                         if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1046                                 wc_NSEC_ok = 1;
1047                         }
1048                         /* if not, continue looking for proof */
1049                 }
1050
1051                 /* Otherwise, if this is a positive wildcard response and
1052                  * we have NSEC3 records */
1053                 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1054                         nsec3s_seen = 1;
1055                 }
1056         }
1057
1058         /* If this was a positive wildcard response that we haven't already
1059          * proven, and we have NSEC3 records, try to prove it using the NSEC3
1060          * records. */
1061         if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1062                 enum sec_status sec = nsec3_prove_wildcard(env, ve,
1063                         chase_reply->rrsets+chase_reply->an_numrrsets,
1064                         chase_reply->ns_numrrsets, qchase, kkey, wc);
1065                 if(sec == sec_status_insecure) {
1066                         verbose(VERB_ALGO, "wildcard CNAME response is "
1067                                 "insecure");
1068                         chase_reply->security = sec_status_insecure;
1069                         return;
1070                 } else if(sec == sec_status_secure)
1071                         wc_NSEC_ok = 1;
1072         }
1073
1074         /* If after all this, we still haven't proven the positive wildcard
1075          * response, fail. */
1076         if(wc != NULL && !wc_NSEC_ok) {
1077                 verbose(VERB_QUERY, "CNAME response was wildcard "
1078                         "expansion and did not prove original data "
1079                         "did not exist");
1080                 chase_reply->security = sec_status_bogus;
1081                 return;
1082         }
1083
1084         verbose(VERB_ALGO, "Successfully validated CNAME response");
1085         chase_reply->security = sec_status_secure;
1086 }
1087
1088 /**
1089  * Validate CNAME NOANSWER response, no more data after a CNAME chain.
1090  * This can be a NODATA or a NAME ERROR case, but not both at the same time.
1091  * We don't know because the rcode has been set to NOERROR by the CNAME.
1092  *
1093  * The answer and authority rrsets must already be verified as secure.
1094  *
1095  * @param env: module env for verify.
1096  * @param ve: validator env for verify.
1097  * @param qchase: query that was made.
1098  * @param chase_reply: answer to that query to validate.
1099  * @param kkey: the key entry, which is trusted, and which matches
1100  *      the signer of the answer. The key entry isgood().
1101  */
1102 static void
1103 validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
1104         struct query_info* qchase, struct reply_info* chase_reply,
1105         struct key_entry_key* kkey)
1106 {
1107         int nodata_valid_nsec = 0; /* If true, then NODATA has been proven.*/
1108         uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
1109                                 proven closest encloser. */
1110         uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
1111         int nxdomain_valid_nsec = 0; /* if true, namerror has been proven */
1112         int nxdomain_valid_wnsec = 0;
1113         int nsec3s_seen = 0; /* nsec3s seen */
1114         struct ub_packed_rrset_key* s;
1115         size_t i;
1116
1117         /* the AUTHORITY section */
1118         for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1119                 chase_reply->ns_numrrsets; i++) {
1120                 s = chase_reply->rrsets[i];
1121
1122                 /* If we encounter an NSEC record, try to use it to prove
1123                  * NODATA. This needs to handle the ENT NODATA case.
1124                  * Also try to prove NAMEERROR, and absence of a wildcard */
1125                 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1126                         if(nsec_proves_nodata(s, qchase, &wc)) {
1127                                 nodata_valid_nsec = 1;
1128                                 /* set wc encloser if wildcard applicable */
1129                         }
1130                         if(val_nsec_proves_name_error(s, qchase->qname)) {
1131                                 ce = nsec_closest_encloser(qchase->qname, s);
1132                                 nxdomain_valid_nsec = 1;
1133                         }
1134                         if(val_nsec_proves_no_wc(s, qchase->qname,
1135                                 qchase->qname_len))
1136                                 nxdomain_valid_wnsec = 1;
1137                         if(val_nsec_proves_insecuredelegation(s, qchase)) {
1138                                 verbose(VERB_ALGO, "delegation is insecure");
1139                                 chase_reply->security = sec_status_insecure;
1140                                 return;
1141                         }
1142                 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1143                         nsec3s_seen = 1;
1144                 }
1145         }
1146
1147         /* check to see if we have a wildcard NODATA proof. */
1148
1149         /* The wildcard NODATA is 1 NSEC proving that qname does not exists
1150          * (and also proving what the closest encloser is), and 1 NSEC
1151          * showing the matching wildcard, which must be *.closest_encloser. */
1152         if(wc && !ce)
1153                 nodata_valid_nsec = 0;
1154         else if(wc && ce) {
1155                 if(query_dname_compare(wc, ce) != 0) {
1156                         nodata_valid_nsec = 0;
1157                 }
1158         }
1159         if(nxdomain_valid_nsec && !nxdomain_valid_wnsec) {
1160                 /* name error is missing wildcard denial proof */
1161                 nxdomain_valid_nsec = 0;
1162         }
1163
1164         if(nodata_valid_nsec && nxdomain_valid_nsec) {
1165                 verbose(VERB_QUERY, "CNAMEchain to noanswer proves that name "
1166                         "exists and not exists, bogus");
1167                 chase_reply->security = sec_status_bogus;
1168                 return;
1169         }
1170         if(!nodata_valid_nsec && !nxdomain_valid_nsec && nsec3s_seen) {
1171                 int nodata;
1172                 enum sec_status sec = nsec3_prove_nxornodata(env, ve,
1173                         chase_reply->rrsets+chase_reply->an_numrrsets,
1174                         chase_reply->ns_numrrsets, qchase, kkey, &nodata);
1175                 if(sec == sec_status_insecure) {
1176                         verbose(VERB_ALGO, "CNAMEchain to noanswer response "
1177                                 "is insecure");
1178                         chase_reply->security = sec_status_insecure;
1179                         return;
1180                 } else if(sec == sec_status_secure) {
1181                         if(nodata)
1182                                 nodata_valid_nsec = 1;
1183                         else    nxdomain_valid_nsec = 1;
1184                 }
1185         }
1186
1187         if(!nodata_valid_nsec && !nxdomain_valid_nsec) {
1188                 verbose(VERB_QUERY, "CNAMEchain to noanswer response failed "
1189                         "to prove status with NSEC/NSEC3");
1190                 if(verbosity >= VERB_ALGO)
1191                         log_dns_msg("Failed CNAMEnoanswer", qchase, chase_reply);
1192                 chase_reply->security = sec_status_bogus;
1193                 return;
1194         }
1195
1196         if(nodata_valid_nsec)
1197                 verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1198                         "NODATA response.");
1199         else    verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1200                         "NAMEERROR response.");
1201         chase_reply->security = sec_status_secure;
1202 }
1203
1204 /**
1205  * Process init state for validator.
1206  * Process the INIT state. First tier responses start in the INIT state.
1207  * This is where they are vetted for validation suitability, and the initial
1208  * key search is done.
1209  *
1210  * Currently, events the come through this routine will be either promoted
1211  * to FINISHED/CNAME_RESP (no validation needed), FINDKEY (next step to
1212  * validation), or will be (temporarily) retired and a new priming request
1213  * event will be generated.
1214  *
1215  * @param qstate: query state.
1216  * @param vq: validator query state.
1217  * @param ve: validator shared global environment.
1218  * @param id: module id.
1219  * @return true if the event should be processed further on return, false if
1220  *         not.
1221  */
1222 static int
1223 processInit(struct module_qstate* qstate, struct val_qstate* vq,
1224         struct val_env* ve, int id)
1225 {
1226         uint8_t* lookup_name;
1227         size_t lookup_len;
1228         struct trust_anchor* anchor;
1229         enum val_classification subtype = val_classify_response(
1230                 qstate->query_flags, &qstate->qinfo, &vq->qchase,
1231                 vq->orig_msg->rep, vq->rrset_skip);
1232         if(vq->restart_count > VAL_MAX_RESTART_COUNT) {
1233                 verbose(VERB_ALGO, "restart count exceeded");
1234                 return val_error(qstate, id);
1235         }
1236         verbose(VERB_ALGO, "validator classification %s",
1237                 val_classification_to_string(subtype));
1238         if(subtype == VAL_CLASS_REFERRAL &&
1239                 vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
1240                 /* referral uses the rrset name as qchase, to find keys for
1241                  * that rrset */
1242                 vq->qchase.qname = vq->orig_msg->rep->
1243                         rrsets[vq->rrset_skip]->rk.dname;
1244                 vq->qchase.qname_len = vq->orig_msg->rep->
1245                         rrsets[vq->rrset_skip]->rk.dname_len;
1246                 vq->qchase.qtype = ntohs(vq->orig_msg->rep->
1247                         rrsets[vq->rrset_skip]->rk.type);
1248                 vq->qchase.qclass = ntohs(vq->orig_msg->rep->
1249                         rrsets[vq->rrset_skip]->rk.rrset_class);
1250         }
1251         lookup_name = vq->qchase.qname;
1252         lookup_len = vq->qchase.qname_len;
1253         /* for type DS look at the parent side for keys/trustanchor */
1254         /* also for NSEC not at apex */
1255         if(vq->qchase.qtype == LDNS_RR_TYPE_DS ||
1256                 (vq->qchase.qtype == LDNS_RR_TYPE_NSEC &&
1257                  vq->orig_msg->rep->rrset_count > vq->rrset_skip &&
1258                  ntohs(vq->orig_msg->rep->rrsets[vq->rrset_skip]->rk.type) ==
1259                  LDNS_RR_TYPE_NSEC &&
1260                  !(vq->orig_msg->rep->rrsets[vq->rrset_skip]->
1261                  rk.flags&PACKED_RRSET_NSEC_AT_APEX))) {
1262                 dname_remove_label(&lookup_name, &lookup_len);
1263         }
1264
1265         val_mark_indeterminate(vq->chase_reply, qstate->env->anchors,
1266                 qstate->env->rrset_cache, qstate->env);
1267         vq->key_entry = NULL;
1268         vq->empty_DS_name = NULL;
1269         vq->ds_rrset = 0;
1270         anchor = anchors_lookup(qstate->env->anchors,
1271                 lookup_name, lookup_len, vq->qchase.qclass);
1272
1273         /* Determine the signer/lookup name */
1274         val_find_signer(subtype, &vq->qchase, vq->orig_msg->rep,
1275                 vq->rrset_skip, &vq->signer_name, &vq->signer_len);
1276         if(vq->signer_name != NULL &&
1277                 !dname_subdomain_c(lookup_name, vq->signer_name)) {
1278                 log_nametypeclass(VERB_ALGO, "this signer name is not a parent "
1279                         "of lookupname, omitted", vq->signer_name, 0, 0);
1280                 vq->signer_name = NULL;
1281         }
1282         if(vq->signer_name == NULL) {
1283                 log_nametypeclass(VERB_ALGO, "no signer, using", lookup_name,
1284                         0, 0);
1285         } else {
1286                 lookup_name = vq->signer_name;
1287                 lookup_len = vq->signer_len;
1288                 log_nametypeclass(VERB_ALGO, "signer is", lookup_name, 0, 0);
1289         }
1290
1291         /* for NXDOMAIN it could be signed by a parent of the trust anchor */
1292         if(subtype == VAL_CLASS_NAMEERROR && vq->signer_name &&
1293                 anchor && dname_strict_subdomain_c(anchor->name, lookup_name)){
1294                 lock_basic_unlock(&anchor->lock);
1295                 anchor = anchors_lookup(qstate->env->anchors,
1296                         lookup_name, lookup_len, vq->qchase.qclass);
1297                 if(!anchor) { /* unsigned parent denies anchor*/
1298                         verbose(VERB_QUERY, "unsigned parent zone denies"
1299                                 " trust anchor, indeterminate");
1300                         vq->chase_reply->security = sec_status_indeterminate;
1301                         vq->state = VAL_FINISHED_STATE;
1302                         return 1;
1303                 }
1304                 verbose(VERB_ALGO, "trust anchor NXDOMAIN by signed parent");
1305         } else if(subtype == VAL_CLASS_POSITIVE &&
1306                 qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY &&
1307                 query_dname_compare(lookup_name, qstate->qinfo.qname) == 0) {
1308                 /* is a DNSKEY so lookup a bit higher since we want to
1309                  * get it from a parent or from trustanchor */
1310                 dname_remove_label(&lookup_name, &lookup_len);
1311         }
1312
1313         if(vq->rrset_skip > 0 || subtype == VAL_CLASS_CNAME ||
1314                 subtype == VAL_CLASS_REFERRAL) {
1315                 /* extract this part of orig_msg into chase_reply for
1316                  * the eventual VALIDATE stage */
1317                 val_fill_reply(vq->chase_reply, vq->orig_msg->rep,
1318                         vq->rrset_skip, lookup_name, lookup_len,
1319                         vq->signer_name);
1320                 if(verbosity >= VERB_ALGO)
1321                         log_dns_msg("chased extract", &vq->qchase,
1322                                 vq->chase_reply);
1323         }
1324
1325         vq->key_entry = key_cache_obtain(ve->kcache, lookup_name, lookup_len,
1326                 vq->qchase.qclass, qstate->region, *qstate->env->now);
1327
1328         /* there is no key(from DLV) and no trust anchor */
1329         if(vq->key_entry == NULL && anchor == NULL) {
1330                 /*response isn't under a trust anchor, so we cannot validate.*/
1331                 vq->chase_reply->security = sec_status_indeterminate;
1332                 /* go to finished state to cache this result */
1333                 vq->state = VAL_FINISHED_STATE;
1334                 return 1;
1335         }
1336         /* if not key, or if keyentry is *above* the trustanchor, i.e.
1337          * the keyentry is based on another (higher) trustanchor */
1338         else if(vq->key_entry == NULL || (anchor &&
1339                 dname_strict_subdomain_c(anchor->name, vq->key_entry->name))) {
1340                 /* trust anchor is an 'unsigned' trust anchor */
1341                 if(anchor && anchor->numDS == 0 && anchor->numDNSKEY == 0) {
1342                         vq->chase_reply->security = sec_status_insecure;
1343                         val_mark_insecure(vq->chase_reply, anchor->name,
1344                                 qstate->env->rrset_cache, qstate->env);
1345                         lock_basic_unlock(&anchor->lock);
1346                         vq->dlv_checked=1; /* skip DLV check */
1347                         /* go to finished state to cache this result */
1348                         vq->state = VAL_FINISHED_STATE;
1349                         return 1;
1350                 }
1351                 /* fire off a trust anchor priming query. */
1352                 verbose(VERB_DETAIL, "prime trust anchor");
1353                 if(!prime_trust_anchor(qstate, vq, id, anchor)) {
1354                         lock_basic_unlock(&anchor->lock);
1355                         return val_error(qstate, id);
1356                 }
1357                 lock_basic_unlock(&anchor->lock);
1358                 /* and otherwise, don't continue processing this event.
1359                  * (it will be reactivated when the priming query returns). */
1360                 vq->state = VAL_FINDKEY_STATE;
1361                 return 0;
1362         }
1363         if(anchor) {
1364                 lock_basic_unlock(&anchor->lock);
1365         }
1366
1367         if(key_entry_isnull(vq->key_entry)) {
1368                 /* response is under a null key, so we cannot validate
1369                  * However, we do set the status to INSECURE, since it is
1370                  * essentially proven insecure. */
1371                 vq->chase_reply->security = sec_status_insecure;
1372                 val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1373                         qstate->env->rrset_cache, qstate->env);
1374                 /* go to finished state to cache this result */
1375                 vq->state = VAL_FINISHED_STATE;
1376                 return 1;
1377         } else if(key_entry_isbad(vq->key_entry)) {
1378                 /* key is bad, chain is bad, reply is bogus */
1379                 errinf_dname(qstate, "key for validation", vq->key_entry->name);
1380                 errinf(qstate, "is marked as invalid");
1381                 if(key_entry_get_reason(vq->key_entry)) {
1382                         errinf(qstate, "because of a previous");
1383                         errinf(qstate, key_entry_get_reason(vq->key_entry));
1384                 }
1385                 /* no retries, stop bothering the authority until timeout */
1386                 vq->restart_count = VAL_MAX_RESTART_COUNT;
1387                 vq->chase_reply->security = sec_status_bogus;
1388                 vq->state = VAL_FINISHED_STATE;
1389                 return 1;
1390         }
1391
1392         /* otherwise, we have our "closest" cached key -- continue
1393          * processing in the next state. */
1394         vq->state = VAL_FINDKEY_STATE;
1395         return 1;
1396 }
1397
1398 /**
1399  * Process the FINDKEY state. Generally this just calculates the next name
1400  * to query and either issues a DS or a DNSKEY query. It will check to see
1401  * if the correct key has already been reached, in which case it will
1402  * advance the event to the next state.
1403  *
1404  * @param qstate: query state.
1405  * @param vq: validator query state.
1406  * @param id: module id.
1407  * @return true if the event should be processed further on return, false if
1408  *         not.
1409  */
1410 static int
1411 processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
1412 {
1413         uint8_t* target_key_name, *current_key_name;
1414         size_t target_key_len;
1415         int strip_lab;
1416
1417         log_query_info(VERB_ALGO, "validator: FindKey", &vq->qchase);
1418         /* We know that state.key_entry is not 0 or bad key -- if it were,
1419          * then previous processing should have directed this event to
1420          * a different state.
1421          * It could be an isnull key, which signals that a DLV was just
1422          * done and the DNSKEY after the DLV failed with dnssec-retry state
1423          * and the DNSKEY has to be performed again. */
1424         log_assert(vq->key_entry && !key_entry_isbad(vq->key_entry));
1425         if(key_entry_isnull(vq->key_entry)) {
1426                 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1427                         vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1428                         vq->qchase.qclass, BIT_CD)) {
1429                         log_err("mem error generating DNSKEY request");
1430                         return val_error(qstate, id);
1431                 }
1432                 return 0;
1433         }
1434
1435         target_key_name = vq->signer_name;
1436         target_key_len = vq->signer_len;
1437         if(!target_key_name) {
1438                 target_key_name = vq->qchase.qname;
1439                 target_key_len = vq->qchase.qname_len;
1440         }
1441
1442         current_key_name = vq->key_entry->name;
1443
1444         /* If our current key entry matches our target, then we are done. */
1445         if(query_dname_compare(target_key_name, current_key_name) == 0) {
1446                 vq->state = VAL_VALIDATE_STATE;
1447                 return 1;
1448         }
1449
1450         if(vq->empty_DS_name) {
1451                 /* if the last empty nonterminal/emptyDS name we detected is
1452                  * below the current key, use that name to make progress
1453                  * along the chain of trust */
1454                 if(query_dname_compare(target_key_name,
1455                         vq->empty_DS_name) == 0) {
1456                         /* do not query for empty_DS_name again */
1457                         verbose(VERB_ALGO, "Cannot retrieve DS for signature");
1458                         errinf(qstate, "no signatures");
1459                         errinf_origin(qstate, qstate->reply_origin);
1460                         vq->chase_reply->security = sec_status_bogus;
1461                         vq->state = VAL_FINISHED_STATE;
1462                         return 1;
1463                 }
1464                 current_key_name = vq->empty_DS_name;
1465         }
1466
1467         log_nametypeclass(VERB_ALGO, "current keyname", current_key_name,
1468                 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1469         log_nametypeclass(VERB_ALGO, "target keyname", target_key_name,
1470                 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1471         /* assert we are walking down the DNS tree */
1472         if(!dname_subdomain_c(target_key_name, current_key_name)) {
1473                 verbose(VERB_ALGO, "bad signer name");
1474                 vq->chase_reply->security = sec_status_bogus;
1475                 vq->state = VAL_FINISHED_STATE;
1476                 return 1;
1477         }
1478         /* so this value is >= -1 */
1479         strip_lab = dname_count_labels(target_key_name) -
1480                 dname_count_labels(current_key_name) - 1;
1481         log_assert(strip_lab >= -1);
1482         verbose(VERB_ALGO, "striplab %d", strip_lab);
1483         if(strip_lab > 0) {
1484                 dname_remove_labels(&target_key_name, &target_key_len,
1485                         strip_lab);
1486         }
1487         log_nametypeclass(VERB_ALGO, "next keyname", target_key_name,
1488                 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1489
1490         /* The next step is either to query for the next DS, or to query
1491          * for the next DNSKEY. */
1492         if(vq->ds_rrset)
1493                 log_nametypeclass(VERB_ALGO, "DS RRset", vq->ds_rrset->rk.dname, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN);
1494         else verbose(VERB_ALGO, "No DS RRset");
1495
1496         if(vq->ds_rrset && query_dname_compare(vq->ds_rrset->rk.dname,
1497                 vq->key_entry->name) != 0) {
1498                 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1499                         vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1500                         vq->qchase.qclass, BIT_CD)) {
1501                         log_err("mem error generating DNSKEY request");
1502                         return val_error(qstate, id);
1503                 }
1504                 return 0;
1505         }
1506
1507         if(!vq->ds_rrset || query_dname_compare(vq->ds_rrset->rk.dname,
1508                 target_key_name) != 0) {
1509                 /* check if there is a cache entry : pick up an NSEC if
1510                  * there is no DS, check if that NSEC has DS-bit unset, and
1511                  * thus can disprove the secure delagation we seek.
1512                  * We can then use that NSEC even in the absence of a SOA
1513                  * record that would be required by the iterator to supply
1514                  * a completely protocol-correct response.
1515                  * Uses negative cache for NSEC3 lookup of DS responses. */
1516                 /* only if cache not blacklisted, of course */
1517                 struct dns_msg* msg;
1518                 if(!qstate->blacklist && !vq->chain_blacklist &&
1519                         (msg=val_find_DS(qstate->env, target_key_name,
1520                         target_key_len, vq->qchase.qclass, qstate->region,
1521                         vq->key_entry->name)) ) {
1522                         verbose(VERB_ALGO, "Process cached DS response");
1523                         process_ds_response(qstate, vq, id, LDNS_RCODE_NOERROR,
1524                                 msg, &msg->qinfo, NULL);
1525                         return 1; /* continue processing ds-response results */
1526                 }
1527                 if(!generate_request(qstate, id, target_key_name,
1528                         target_key_len, LDNS_RR_TYPE_DS, vq->qchase.qclass,
1529                         BIT_CD)) {
1530                         log_err("mem error generating DS request");
1531                         return val_error(qstate, id);
1532                 }
1533                 return 0;
1534         }
1535
1536         /* Otherwise, it is time to query for the DNSKEY */
1537         if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1538                 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1539                 vq->qchase.qclass, BIT_CD)) {
1540                 log_err("mem error generating DNSKEY request");
1541                 return val_error(qstate, id);
1542         }
1543
1544         return 0;
1545 }
1546
1547 /**
1548  * Process the VALIDATE stage, the init and findkey stages are finished,
1549  * and the right keys are available to validate the response.
1550  * Or, there are no keys available, in order to invalidate the response.
1551  *
1552  * After validation, the status is recorded in the message and rrsets,
1553  * and finished state is started.
1554  *
1555  * @param qstate: query state.
1556  * @param vq: validator query state.
1557  * @param ve: validator shared global environment.
1558  * @param id: module id.
1559  * @return true if the event should be processed further on return, false if
1560  *         not.
1561  */
1562 static int
1563 processValidate(struct module_qstate* qstate, struct val_qstate* vq,
1564         struct val_env* ve, int id)
1565 {
1566         enum val_classification subtype;
1567
1568         if(!vq->key_entry) {
1569                 verbose(VERB_ALGO, "validate: no key entry, failed");
1570                 return val_error(qstate, id);
1571         }
1572
1573         /* This is the default next state. */
1574         vq->state = VAL_FINISHED_STATE;
1575
1576         /* Unsigned responses must be underneath a "null" key entry.*/
1577         if(key_entry_isnull(vq->key_entry)) {
1578                 verbose(VERB_DETAIL, "Verified that %sresponse is INSECURE",
1579                         vq->signer_name?"":"unsigned ");
1580                 vq->chase_reply->security = sec_status_insecure;
1581                 val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1582                         qstate->env->rrset_cache, qstate->env);
1583                 key_cache_insert(ve->kcache, vq->key_entry, qstate);
1584                 return 1;
1585         }
1586
1587         if(key_entry_isbad(vq->key_entry)) {
1588                 log_nametypeclass(VERB_DETAIL, "Could not establish a chain "
1589                         "of trust to keys for", vq->key_entry->name,
1590                         LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class);
1591                 vq->chase_reply->security = sec_status_bogus;
1592                 errinf(qstate, "while building chain of trust");
1593                 if(vq->restart_count >= VAL_MAX_RESTART_COUNT)
1594                         key_cache_insert(ve->kcache, vq->key_entry, qstate);
1595                 return 1;
1596         }
1597
1598         /* signerName being null is the indicator that this response was
1599          * unsigned */
1600         if(vq->signer_name == NULL) {
1601                 log_query_info(VERB_ALGO, "processValidate: state has no "
1602                         "signer name", &vq->qchase);
1603                 verbose(VERB_DETAIL, "Could not establish validation of "
1604                           "INSECURE status of unsigned response.");
1605                 errinf(qstate, "no signatures");
1606                 errinf_origin(qstate, qstate->reply_origin);
1607                 vq->chase_reply->security = sec_status_bogus;
1608                 return 1;
1609         }
1610         subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
1611                 &vq->qchase, vq->orig_msg->rep, vq->rrset_skip);
1612
1613         /* check signatures in the message;
1614          * answer and authority must be valid, additional is only checked. */
1615         if(!validate_msg_signatures(qstate, qstate->env, ve, &vq->qchase,
1616                 vq->chase_reply, vq->key_entry)) {
1617                 /* workaround bad recursor out there that truncates (even
1618                  * with EDNS4k) to 512 by removing RRSIG from auth section
1619                  * for positive replies*/
1620                 if((subtype == VAL_CLASS_POSITIVE || subtype == VAL_CLASS_ANY
1621                         || subtype == VAL_CLASS_CNAME) &&
1622                         detect_wrongly_truncated(vq->orig_msg->rep)) {
1623                         /* truncate the message some more */
1624                         vq->orig_msg->rep->ns_numrrsets = 0;
1625                         vq->orig_msg->rep->ar_numrrsets = 0;
1626                         vq->orig_msg->rep->rrset_count =
1627                                 vq->orig_msg->rep->an_numrrsets;
1628                         vq->chase_reply->ns_numrrsets = 0;
1629                         vq->chase_reply->ar_numrrsets = 0;
1630                         vq->chase_reply->rrset_count =
1631                                 vq->chase_reply->an_numrrsets;
1632                         qstate->errinf = NULL;
1633                 }
1634                 else {
1635                         verbose(VERB_DETAIL, "Validate: message contains "
1636                                 "bad rrsets");
1637                         return 1;
1638                 }
1639         }
1640
1641         switch(subtype) {
1642                 case VAL_CLASS_POSITIVE:
1643                         verbose(VERB_ALGO, "Validating a positive response");
1644                         validate_positive_response(qstate->env, ve,
1645                                 &vq->qchase, vq->chase_reply, vq->key_entry);
1646                         verbose(VERB_DETAIL, "validate(positive): %s",
1647                                 sec_status_to_string(
1648                                 vq->chase_reply->security));
1649                         break;
1650
1651                 case VAL_CLASS_NODATA:
1652                         verbose(VERB_ALGO, "Validating a nodata response");
1653                         validate_nodata_response(qstate->env, ve,
1654                                 &vq->qchase, vq->chase_reply, vq->key_entry);
1655                         verbose(VERB_DETAIL, "validate(nodata): %s",
1656                                 sec_status_to_string(
1657                                 vq->chase_reply->security));
1658                         break;
1659
1660                 case VAL_CLASS_NAMEERROR:
1661                         verbose(VERB_ALGO, "Validating a nxdomain response");
1662                         validate_nameerror_response(qstate->env, ve,
1663                                 &vq->qchase, vq->chase_reply, vq->key_entry);
1664                         verbose(VERB_DETAIL, "validate(nxdomain): %s",
1665                                 sec_status_to_string(
1666                                 vq->chase_reply->security));
1667                         break;
1668
1669                 case VAL_CLASS_CNAME:
1670                         verbose(VERB_ALGO, "Validating a cname response");
1671                         validate_cname_response(qstate->env, ve,
1672                                 &vq->qchase, vq->chase_reply, vq->key_entry);
1673                         verbose(VERB_DETAIL, "validate(cname): %s",
1674                                 sec_status_to_string(
1675                                 vq->chase_reply->security));
1676                         break;
1677
1678                 case VAL_CLASS_CNAMENOANSWER:
1679                         verbose(VERB_ALGO, "Validating a cname noanswer "
1680                                 "response");
1681                         validate_cname_noanswer_response(qstate->env, ve,
1682                                 &vq->qchase, vq->chase_reply, vq->key_entry);
1683                         verbose(VERB_DETAIL, "validate(cname_noanswer): %s",
1684                                 sec_status_to_string(
1685                                 vq->chase_reply->security));
1686                         break;
1687
1688                 case VAL_CLASS_REFERRAL:
1689                         verbose(VERB_ALGO, "Validating a referral response");
1690                         validate_referral_response(vq->chase_reply);
1691                         verbose(VERB_DETAIL, "validate(referral): %s",
1692                                 sec_status_to_string(
1693                                 vq->chase_reply->security));
1694                         break;
1695
1696                 case VAL_CLASS_ANY:
1697                         verbose(VERB_ALGO, "Validating a positive ANY "
1698                                 "response");
1699                         validate_any_response(qstate->env, ve, &vq->qchase,
1700                                 vq->chase_reply, vq->key_entry);
1701                         verbose(VERB_DETAIL, "validate(positive_any): %s",
1702                                 sec_status_to_string(
1703                                 vq->chase_reply->security));
1704                         break;
1705
1706                 default:
1707                         log_err("validate: unhandled response subtype: %d",
1708                                 subtype);
1709         }
1710         if(vq->chase_reply->security == sec_status_bogus) {
1711                 if(subtype == VAL_CLASS_POSITIVE)
1712                         errinf(qstate, "wildcard");
1713                 else errinf(qstate, val_classification_to_string(subtype));
1714                 errinf(qstate, "proof failed");
1715                 errinf_origin(qstate, qstate->reply_origin);
1716         }
1717
1718         return 1;
1719 }
1720
1721 /**
1722  * Init DLV check.
1723  * Called when a query is determined by other trust anchors to be insecure
1724  * (or indeterminate).  Then we look if there is a key in the DLV.
1725  * Performs aggressive negative cache check to see if there is no key.
1726  * Otherwise, spawns a DLV query, and changes to the DLV wait state.
1727  *
1728  * @param qstate: query state.
1729  * @param vq: validator query state.
1730  * @param ve: validator shared global environment.
1731  * @param id: module id.
1732  * @return  true if there is no DLV.
1733  *      false: processing is finished for the validator operate().
1734  *      This function may exit in three ways:
1735  *         o    no DLV (agressive cache), so insecure. (true)
1736  *         o    error - stop processing (false)
1737  *         o    DLV lookup was started, stop processing (false)
1738  */
1739 static int
1740 val_dlv_init(struct module_qstate* qstate, struct val_qstate* vq,
1741         struct val_env* ve, int id)
1742 {
1743         uint8_t* nm;
1744         size_t nm_len;
1745         /* there must be a DLV configured */
1746         log_assert(qstate->env->anchors->dlv_anchor);
1747         /* this bool is true to avoid looping in the DLV checks */
1748         log_assert(vq->dlv_checked);
1749
1750         /* init the DLV lookup variables */
1751         vq->dlv_lookup_name = NULL;
1752         vq->dlv_lookup_name_len = 0;
1753         vq->dlv_insecure_at = NULL;
1754         vq->dlv_insecure_at_len = 0;
1755
1756         /* Determine the name for which we want to lookup DLV.
1757          * This name is for the current message, or
1758          * for the current RRset for CNAME, referral subtypes.
1759          * If there is a signer, use that, otherwise the domain name */
1760         if(vq->signer_name) {
1761                 nm = vq->signer_name;
1762                 nm_len = vq->signer_len;
1763         } else {
1764                 /* use qchase */
1765                 nm = vq->qchase.qname;
1766                 nm_len = vq->qchase.qname_len;
1767                 if(vq->qchase.qtype == LDNS_RR_TYPE_DS)
1768                         dname_remove_label(&nm, &nm_len);
1769         }
1770         log_nametypeclass(VERB_ALGO, "DLV init look", nm, LDNS_RR_TYPE_DS,
1771                 vq->qchase.qclass);
1772         log_assert(nm && nm_len);
1773         /* sanity check: no DLV lookups below the DLV anchor itself.
1774          * Like, an securely insecure delegation there makes no sense. */
1775         if(dname_subdomain_c(nm, qstate->env->anchors->dlv_anchor->name)) {
1776                 verbose(VERB_ALGO, "DLV lookup within DLV repository denied");
1777                 return 1;
1778         }
1779         /* concat name (minus root label) + dlv name */
1780         vq->dlv_lookup_name_len = nm_len - 1 +
1781                 qstate->env->anchors->dlv_anchor->namelen;
1782         vq->dlv_lookup_name = regional_alloc(qstate->region,
1783                 vq->dlv_lookup_name_len);
1784         if(!vq->dlv_lookup_name) {
1785                 log_err("Out of memory preparing DLV lookup");
1786                 return val_error(qstate, id);
1787         }
1788         memmove(vq->dlv_lookup_name, nm, nm_len-1);
1789         memmove(vq->dlv_lookup_name+nm_len-1,
1790                 qstate->env->anchors->dlv_anchor->name,
1791                 qstate->env->anchors->dlv_anchor->namelen);
1792         log_nametypeclass(VERB_ALGO, "DLV name", vq->dlv_lookup_name,
1793                 LDNS_RR_TYPE_DLV, vq->qchase.qclass);
1794
1795         /* determine where the insecure point was determined, the DLV must
1796          * be equal or below that to continue building the trust chain
1797          * down. May be NULL if no trust chain was built yet */
1798         nm = NULL;
1799         if(vq->key_entry && key_entry_isnull(vq->key_entry)) {
1800                 nm = vq->key_entry->name;
1801                 nm_len = vq->key_entry->namelen;
1802         }
1803         if(nm) {
1804                 vq->dlv_insecure_at_len = nm_len - 1 +
1805                         qstate->env->anchors->dlv_anchor->namelen;
1806                 vq->dlv_insecure_at = regional_alloc(qstate->region,
1807                         vq->dlv_insecure_at_len);
1808                 if(!vq->dlv_insecure_at) {
1809                         log_err("Out of memory preparing DLV lookup");
1810                         return val_error(qstate, id);
1811                 }
1812                 memmove(vq->dlv_insecure_at, nm, nm_len-1);
1813                 memmove(vq->dlv_insecure_at+nm_len-1,
1814                         qstate->env->anchors->dlv_anchor->name,
1815                         qstate->env->anchors->dlv_anchor->namelen);
1816                 log_nametypeclass(VERB_ALGO, "insecure_at",
1817                         vq->dlv_insecure_at, 0, vq->qchase.qclass);
1818         }
1819
1820         /* If we can find the name in the aggressive negative cache,
1821          * give up; insecure is the answer */
1822         while(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
1823                 vq->dlv_lookup_name_len, vq->qchase.qclass,
1824                 qstate->env->rrset_cache, *qstate->env->now)) {
1825                 /* go up */
1826                 dname_remove_label(&vq->dlv_lookup_name,
1827                         &vq->dlv_lookup_name_len);
1828                 /* too high? */
1829                 if(!dname_subdomain_c(vq->dlv_lookup_name,
1830                         qstate->env->anchors->dlv_anchor->name)) {
1831                         verbose(VERB_ALGO, "ask above dlv repo");
1832                         return 1; /* Above the repo is insecure */
1833                 }
1834                 /* above chain of trust? */
1835                 if(vq->dlv_insecure_at && !dname_subdomain_c(
1836                         vq->dlv_lookup_name, vq->dlv_insecure_at)) {
1837                         verbose(VERB_ALGO, "ask above insecure endpoint");
1838                         return 1;
1839                 }
1840         }
1841
1842         /* perform a lookup for the DLV; with validation */
1843         vq->state = VAL_DLVLOOKUP_STATE;
1844         if(!generate_request(qstate, id, vq->dlv_lookup_name,
1845                 vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV,
1846                 vq->qchase.qclass, 0)) {
1847                 return val_error(qstate, id);
1848         }
1849
1850         /* Find the closest encloser DLV from the repository.
1851          * then that is used to build another chain of trust
1852          * This may first require a query 'too low' that has NSECs in
1853          * the answer, from which we determine the closest encloser DLV.
1854          * When determine the closest encloser, skip empty nonterminals,
1855          * since we want a nonempty node in the DLV repository. */
1856
1857         return 0;
1858 }
1859
1860 /**
1861  * The Finished state. The validation status (good or bad) has been determined.
1862  *
1863  * @param qstate: query state.
1864  * @param vq: validator query state.
1865  * @param ve: validator shared global environment.
1866  * @param id: module id.
1867  * @return true if the event should be processed further on return, false if
1868  *         not.
1869  */
1870 static int
1871 processFinished(struct module_qstate* qstate, struct val_qstate* vq,
1872         struct val_env* ve, int id)
1873 {
1874         enum val_classification subtype = val_classify_response(
1875                 qstate->query_flags, &qstate->qinfo, &vq->qchase,
1876                 vq->orig_msg->rep, vq->rrset_skip);
1877
1878         /* if the result is insecure or indeterminate and we have not
1879          * checked the DLV yet, check the DLV */
1880         if((vq->chase_reply->security == sec_status_insecure ||
1881                 vq->chase_reply->security == sec_status_indeterminate) &&
1882                 qstate->env->anchors->dlv_anchor && !vq->dlv_checked) {
1883                 vq->dlv_checked = 1;
1884                 if(!val_dlv_init(qstate, vq, ve, id))
1885                         return 0;
1886         }
1887
1888         /* store overall validation result in orig_msg */
1889         if(vq->rrset_skip == 0)
1890                 vq->orig_msg->rep->security = vq->chase_reply->security;
1891         else if(subtype != VAL_CLASS_REFERRAL ||
1892                 vq->rrset_skip < vq->orig_msg->rep->an_numrrsets +
1893                 vq->orig_msg->rep->ns_numrrsets) {
1894                 /* ignore sec status of additional section if a referral
1895                  * type message skips there and
1896                  * use the lowest security status as end result. */
1897                 if(vq->chase_reply->security < vq->orig_msg->rep->security)
1898                         vq->orig_msg->rep->security =
1899                                 vq->chase_reply->security;
1900         }
1901
1902         if(subtype == VAL_CLASS_REFERRAL) {
1903                 /* for a referral, move to next unchecked rrset and check it*/
1904                 vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep,
1905                         vq->rrset_skip);
1906                 if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
1907                         /* and restart for this rrset */
1908                         verbose(VERB_ALGO, "validator: go to next rrset");
1909                         vq->chase_reply->security = sec_status_unchecked;
1910                         vq->dlv_checked = 0; /* can do DLV for this RR */
1911                         vq->state = VAL_INIT_STATE;
1912                         return 1;
1913                 }
1914                 /* referral chase is done */
1915         }
1916         if(vq->chase_reply->security != sec_status_bogus &&
1917                 subtype == VAL_CLASS_CNAME) {
1918                 /* chase the CNAME; process next part of the message */
1919                 if(!val_chase_cname(&vq->qchase, vq->orig_msg->rep,
1920                         &vq->rrset_skip)) {
1921                         verbose(VERB_ALGO, "validator: failed to chase CNAME");
1922                         vq->orig_msg->rep->security = sec_status_bogus;
1923                 } else {
1924                         /* restart process for new qchase at rrset_skip */
1925                         log_query_info(VERB_ALGO, "validator: chased to",
1926                                 &vq->qchase);
1927                         vq->chase_reply->security = sec_status_unchecked;
1928                         vq->dlv_checked = 0; /* can do DLV for this RR */
1929                         vq->state = VAL_INIT_STATE;
1930                         return 1;
1931                 }
1932         }
1933
1934         if(vq->orig_msg->rep->security == sec_status_secure) {
1935                 /* If the message is secure, check that all rrsets are
1936                  * secure (i.e. some inserted RRset for CNAME chain with
1937                  * a different signer name). And drop additional rrsets
1938                  * that are not secure (if clean-additional option is set) */
1939                 /* this may cause the msg to be marked bogus */
1940                 val_check_nonsecure(ve, vq->orig_msg->rep);
1941                 if(vq->orig_msg->rep->security == sec_status_secure) {
1942                         log_query_info(VERB_DETAIL, "validation success",
1943                                 &qstate->qinfo);
1944                 }
1945         }
1946
1947         /* if the result is bogus - set message ttl to bogus ttl to avoid
1948          * endless bogus revalidation */
1949         if(vq->orig_msg->rep->security == sec_status_bogus) {
1950                 /* see if we can try again to fetch data */
1951                 if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
1952                         int restart_count = vq->restart_count+1;
1953                         verbose(VERB_ALGO, "validation failed, "
1954                                 "blacklist and retry to fetch data");
1955                         val_blacklist(&qstate->blacklist, qstate->region,
1956                                 qstate->reply_origin, 0);
1957                         qstate->reply_origin = NULL;
1958                         qstate->errinf = NULL;
1959                         memset(vq, 0, sizeof(*vq));
1960                         vq->restart_count = restart_count;
1961                         vq->state = VAL_INIT_STATE;
1962                         verbose(VERB_ALGO, "pass back to next module");
1963                         qstate->ext_state[id] = module_restart_next;
1964                         return 0;
1965                 }
1966
1967                 vq->orig_msg->rep->ttl = ve->bogus_ttl;
1968                 vq->orig_msg->rep->prefetch_ttl =
1969                         PREFETCH_TTL_CALC(vq->orig_msg->rep->ttl);
1970                 if(qstate->env->cfg->val_log_level >= 1 &&
1971                         !qstate->env->cfg->val_log_squelch) {
1972                         if(qstate->env->cfg->val_log_level < 2)
1973                                 log_query_info(0, "validation failure",
1974                                         &qstate->qinfo);
1975                         else {
1976                                 char* err = errinf_to_str(qstate);
1977                                 if(err) log_info("%s", err);
1978                                 free(err);
1979                         }
1980                 }
1981                 /* If we are in permissive mode, bogus gets indeterminate */
1982                 if(ve->permissive_mode)
1983                         vq->orig_msg->rep->security = sec_status_indeterminate;
1984         }
1985
1986         /* store results in cache */
1987         if(qstate->query_flags&BIT_RD) {
1988                 /* if secure, this will override cache anyway, no need
1989                  * to check if from parentNS */
1990                 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
1991                         vq->orig_msg->rep, 0, qstate->prefetch_leeway, 0, NULL)) {
1992                         log_err("out of memory caching validator results");
1993                 }
1994         } else {
1995                 /* for a referral, store the verified RRsets */
1996                 /* and this does not get prefetched, so no leeway */
1997                 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
1998                         vq->orig_msg->rep, 1, 0, 0, NULL)) {
1999                         log_err("out of memory caching validator results");
2000                 }
2001         }
2002         qstate->return_rcode = LDNS_RCODE_NOERROR;
2003         qstate->return_msg = vq->orig_msg;
2004         qstate->ext_state[id] = module_finished;
2005         return 0;
2006 }
2007
2008 /**
2009  * The DLVLookup state. Process DLV lookups.
2010  *
2011  * @param qstate: query state.
2012  * @param vq: validator query state.
2013  * @param ve: validator shared global environment.
2014  * @param id: module id.
2015  * @return true if the event should be processed further on return, false if
2016  *         not.
2017  */
2018 static int
2019 processDLVLookup(struct module_qstate* qstate, struct val_qstate* vq,
2020         struct val_env* ve, int id)
2021 {
2022         /* see if this we are ready to continue normal resolution */
2023         /* we may need more DLV lookups */
2024         if(vq->dlv_status==dlv_error)
2025                 verbose(VERB_ALGO, "DLV woke up with status dlv_error");
2026         else if(vq->dlv_status==dlv_success)
2027                 verbose(VERB_ALGO, "DLV woke up with status dlv_success");
2028         else if(vq->dlv_status==dlv_ask_higher)
2029                 verbose(VERB_ALGO, "DLV woke up with status dlv_ask_higher");
2030         else if(vq->dlv_status==dlv_there_is_no_dlv)
2031                 verbose(VERB_ALGO, "DLV woke up with status dlv_there_is_no_dlv");
2032         else    verbose(VERB_ALGO, "DLV woke up with status unknown");
2033
2034         if(vq->dlv_status == dlv_error) {
2035                 verbose(VERB_QUERY, "failed DLV lookup");
2036                 return val_error(qstate, id);
2037         } else if(vq->dlv_status == dlv_success) {
2038                 uint8_t* nm;
2039                 size_t nmlen;
2040                 /* chain continues with DNSKEY, continue in FINDKEY */
2041                 vq->state = VAL_FINDKEY_STATE;
2042
2043                 /* strip off the DLV suffix from the name; could result in . */
2044                 log_assert(dname_subdomain_c(vq->ds_rrset->rk.dname,
2045                         qstate->env->anchors->dlv_anchor->name));
2046                 nmlen = vq->ds_rrset->rk.dname_len -
2047                         qstate->env->anchors->dlv_anchor->namelen + 1;
2048                 nm = regional_alloc_init(qstate->region,
2049                         vq->ds_rrset->rk.dname, nmlen);
2050                 if(!nm) {
2051                         log_err("Out of memory in DLVLook");
2052                         return val_error(qstate, id);
2053                 }
2054                 nm[nmlen-1] = 0;
2055
2056                 vq->ds_rrset->rk.dname = nm;
2057                 vq->ds_rrset->rk.dname_len = nmlen;
2058
2059                 /* create a nullentry for the key so the dnskey lookup
2060                  * can be retried after a validation failure for it */
2061                 vq->key_entry = key_entry_create_null(qstate->region,
2062                         nm, nmlen, vq->qchase.qclass, 0, 0);
2063                 if(!vq->key_entry) {
2064                         log_err("Out of memory in DLVLook");
2065                         return val_error(qstate, id);
2066                 }
2067
2068                 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
2069                         vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
2070                         vq->qchase.qclass, BIT_CD)) {
2071                         log_err("mem error generating DNSKEY request");
2072                         return val_error(qstate, id);
2073                 }
2074                 return 0;
2075         } else if(vq->dlv_status == dlv_there_is_no_dlv) {
2076                 /* continue with the insecure result we got */
2077                 vq->state = VAL_FINISHED_STATE;
2078                 return 1;
2079         }
2080         log_assert(vq->dlv_status == dlv_ask_higher);
2081
2082         /* ask higher, make sure we stay in DLV repo, below dlv_at */
2083         if(!dname_subdomain_c(vq->dlv_lookup_name,
2084                 qstate->env->anchors->dlv_anchor->name)) {
2085                 /* just like, there is no DLV */
2086                 verbose(VERB_ALGO, "ask above dlv repo");
2087                 vq->state = VAL_FINISHED_STATE;
2088                 return 1;
2089         }
2090         if(vq->dlv_insecure_at && !dname_subdomain_c(vq->dlv_lookup_name,
2091                 vq->dlv_insecure_at)) {
2092                 /* already checked a chain lower than dlv_lookup_name */
2093                 verbose(VERB_ALGO, "ask above insecure endpoint");
2094                 log_nametypeclass(VERB_ALGO, "enpt", vq->dlv_insecure_at, 0, 0);
2095                 vq->state = VAL_FINISHED_STATE;
2096                 return 1;
2097         }
2098
2099         /* check negative cache before making new request */
2100         if(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
2101                 vq->dlv_lookup_name_len, vq->qchase.qclass,
2102                 qstate->env->rrset_cache, *qstate->env->now)) {
2103                 /* does not exist, go up one (go higher). */
2104                 dname_remove_label(&vq->dlv_lookup_name,
2105                         &vq->dlv_lookup_name_len);
2106                 /* limit number of labels, limited number of recursion */
2107                 return processDLVLookup(qstate, vq, ve, id);
2108         }
2109
2110         if(!generate_request(qstate, id, vq->dlv_lookup_name,
2111                 vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV,
2112                 vq->qchase.qclass, 0)) {
2113                 return val_error(qstate, id);
2114         }
2115
2116         return 0;
2117 }
2118
2119 /**
2120  * Handle validator state.
2121  * If a method returns true, the next state is started. If false, then
2122  * processing will stop.
2123  * @param qstate: query state.
2124  * @param vq: validator query state.
2125  * @param ve: validator shared global environment.
2126  * @param id: module id.
2127  */
2128 static void
2129 val_handle(struct module_qstate* qstate, struct val_qstate* vq,
2130         struct val_env* ve, int id)
2131 {
2132         int cont = 1;
2133         while(cont) {
2134                 verbose(VERB_ALGO, "val handle processing q with state %s",
2135                         val_state_to_string(vq->state));
2136                 switch(vq->state) {
2137                         case VAL_INIT_STATE:
2138                                 cont = processInit(qstate, vq, ve, id);
2139                                 break;
2140                         case VAL_FINDKEY_STATE:
2141                                 cont = processFindKey(qstate, vq, id);
2142                                 break;
2143                         case VAL_VALIDATE_STATE:
2144                                 cont = processValidate(qstate, vq, ve, id);
2145                                 break;
2146                         case VAL_FINISHED_STATE:
2147                                 cont = processFinished(qstate, vq, ve, id);
2148                                 break;
2149                         case VAL_DLVLOOKUP_STATE:
2150                                 cont = processDLVLookup(qstate, vq, ve, id);
2151                                 break;
2152                         default:
2153                                 log_warn("validator: invalid state %d",
2154                                         vq->state);
2155                                 cont = 0;
2156                                 break;
2157                 }
2158         }
2159 }
2160
2161 void
2162 val_operate(struct module_qstate* qstate, enum module_ev event, int id,
2163         struct outbound_entry* outbound)
2164 {
2165         struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2166         struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
2167         verbose(VERB_QUERY, "validator[module %d] operate: extstate:%s "
2168                 "event:%s", id, strextstate(qstate->ext_state[id]),
2169                 strmodulevent(event));
2170         log_query_info(VERB_QUERY, "validator operate: query",
2171                 &qstate->qinfo);
2172         if(vq && qstate->qinfo.qname != vq->qchase.qname)
2173                 log_query_info(VERB_QUERY, "validator operate: chased to",
2174                 &vq->qchase);
2175         (void)outbound;
2176         if(event == module_event_new ||
2177                 (event == module_event_pass && vq == NULL)) {
2178                 /* pass request to next module, to get it */
2179                 verbose(VERB_ALGO, "validator: pass to next module");
2180                 qstate->ext_state[id] = module_wait_module;
2181                 return;
2182         }
2183         if(event == module_event_moddone) {
2184                 /* check if validation is needed */
2185                 verbose(VERB_ALGO, "validator: nextmodule returned");
2186                 if(!needs_validation(qstate, qstate->return_rcode,
2187                         qstate->return_msg)) {
2188                         /* no need to validate this */
2189                         if(qstate->return_msg)
2190                                 qstate->return_msg->rep->security =
2191                                         sec_status_indeterminate;
2192                         qstate->ext_state[id] = module_finished;
2193                         return;
2194                 }
2195                 if(already_validated(qstate->return_msg)) {
2196                         qstate->ext_state[id] = module_finished;
2197                         return;
2198                 }
2199                 /* qclass ANY should have validation result from spawned
2200                  * queries. If we get here, it is bogus or an internal error */
2201                 if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) {
2202                         verbose(VERB_ALGO, "cannot validate classANY: bogus");
2203                         if(qstate->return_msg)
2204                                 qstate->return_msg->rep->security =
2205                                         sec_status_bogus;
2206                         qstate->ext_state[id] = module_finished;
2207                         return;
2208                 }
2209                 /* create state to start validation */
2210                 qstate->ext_state[id] = module_error; /* override this */
2211                 if(!vq) {
2212                         vq = val_new(qstate, id);
2213                         if(!vq) {
2214                                 log_err("validator: malloc failure");
2215                                 qstate->ext_state[id] = module_error;
2216                                 return;
2217                         }
2218                 } else if(!vq->orig_msg) {
2219                         if(!val_new_getmsg(qstate, vq)) {
2220                                 log_err("validator: malloc failure");
2221                                 qstate->ext_state[id] = module_error;
2222                                 return;
2223                         }
2224                 }
2225                 val_handle(qstate, vq, ve, id);
2226                 return;
2227         }
2228         if(event == module_event_pass) {
2229                 qstate->ext_state[id] = module_error; /* override this */
2230                 /* continue processing, since val_env exists */
2231                 val_handle(qstate, vq, ve, id);
2232                 return;
2233         }
2234         log_err("validator: bad event %s", strmodulevent(event));
2235         qstate->ext_state[id] = module_error;
2236         return;
2237 }
2238
2239 /**
2240  * Evaluate the response to a priming request.
2241  *
2242  * @param dnskey_rrset: DNSKEY rrset (can be NULL if none) in prime reply.
2243  *      (this rrset is allocated in the wrong region, not the qstate).
2244  * @param ta: trust anchor.
2245  * @param qstate: qstate that needs key.
2246  * @param id: module id.
2247  * @return new key entry or NULL on allocation failure.
2248  *      The key entry will either contain a validated DNSKEY rrset, or
2249  *      represent a Null key (query failed, but validation did not), or a
2250  *      Bad key (validation failed).
2251  */
2252 static struct key_entry_key*
2253 primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
2254         struct trust_anchor* ta, struct module_qstate* qstate, int id)
2255 {
2256         struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2257         struct key_entry_key* kkey = NULL;
2258         enum sec_status sec = sec_status_unchecked;
2259         char* reason = NULL;
2260         int downprot = 1;
2261
2262         if(!dnskey_rrset) {
2263                 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2264                         "could not fetch DNSKEY rrset",
2265                         ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2266                 if(qstate->env->cfg->harden_dnssec_stripped) {
2267                         errinf(qstate, "no DNSKEY rrset");
2268                         kkey = key_entry_create_bad(qstate->region, ta->name,
2269                                 ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2270                                 *qstate->env->now);
2271                 } else  kkey = key_entry_create_null(qstate->region, ta->name,
2272                                 ta->namelen, ta->dclass, NULL_KEY_TTL,
2273                                 *qstate->env->now);
2274                 if(!kkey) {
2275                         log_err("out of memory: allocate fail prime key");
2276                         return NULL;
2277                 }
2278                 return kkey;
2279         }
2280         /* attempt to verify with trust anchor DS and DNSKEY */
2281         kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve,
2282                 dnskey_rrset, ta->ds_rrset, ta->dnskey_rrset, downprot,
2283                 &reason);
2284         if(!kkey) {
2285                 log_err("out of memory: verifying prime TA");
2286                 return NULL;
2287         }
2288         if(key_entry_isgood(kkey))
2289                 sec = sec_status_secure;
2290         else
2291                 sec = sec_status_bogus;
2292         verbose(VERB_DETAIL, "validate keys with anchor(DS): %s",
2293                 sec_status_to_string(sec));
2294
2295         if(sec != sec_status_secure) {
2296                 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2297                         "DNSKEY rrset is not secure",
2298                         ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2299                 /* NOTE: in this case, we should probably reject the trust
2300                  * anchor for longer, perhaps forever. */
2301                 if(qstate->env->cfg->harden_dnssec_stripped) {
2302                         errinf(qstate, reason);
2303                         kkey = key_entry_create_bad(qstate->region, ta->name,
2304                                 ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2305                                 *qstate->env->now);
2306                 } else  kkey = key_entry_create_null(qstate->region, ta->name,
2307                                 ta->namelen, ta->dclass, NULL_KEY_TTL,
2308                                 *qstate->env->now);
2309                 if(!kkey) {
2310                         log_err("out of memory: allocate null prime key");
2311                         return NULL;
2312                 }
2313                 return kkey;
2314         }
2315
2316         log_nametypeclass(VERB_DETAIL, "Successfully primed trust anchor",
2317                 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2318         return kkey;
2319 }
2320
2321 /**
2322  * In inform supers, with the resulting message and rcode and the current
2323  * keyset in the super state, validate the DS response, returning a KeyEntry.
2324  *
2325  * @param qstate: query state that is validating and asked for a DS.
2326  * @param vq: validator query state
2327  * @param id: module id.
2328  * @param rcode: rcode result value.
2329  * @param msg: result message (if rcode is OK).
2330  * @param qinfo: from the sub query state, query info.
2331  * @param ke: the key entry to return. It returns
2332  *      is_bad if the DS response fails to validate, is_null if the
2333  *      DS response indicated an end to secure space, is_good if the DS
2334  *      validated. It returns ke=NULL if the DS response indicated that the
2335  *      request wasn't a delegation point.
2336  * @return 0 on servfail error (malloc failure).
2337  */
2338 static int
2339 ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
2340         int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2341         struct key_entry_key** ke)
2342 {
2343         struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2344         char* reason = NULL;
2345         enum val_classification subtype;
2346         if(rcode != LDNS_RCODE_NOERROR) {
2347                 char* rc = ldns_pkt_rcode2str(rcode);
2348                 /* errors here pretty much break validation */
2349                 verbose(VERB_DETAIL, "DS response was error, thus bogus");
2350                 errinf(qstate, rc);
2351                 errinf(qstate, "no DS");
2352                 free(rc);
2353                 goto return_bogus;
2354         }
2355
2356         subtype = val_classify_response(BIT_RD, qinfo, qinfo, msg->rep, 0);
2357         if(subtype == VAL_CLASS_POSITIVE) {
2358                 struct ub_packed_rrset_key* ds;
2359                 enum sec_status sec;
2360                 ds = reply_find_answer_rrset(qinfo, msg->rep);
2361                 /* If there was no DS rrset, then we have mis-classified
2362                  * this message. */
2363                 if(!ds) {
2364                         log_warn("internal error: POSITIVE DS response was "
2365                                 "missing DS.");
2366                         errinf(qstate, "no DS record");
2367                         goto return_bogus;
2368                 }
2369                 /* Verify only returns BOGUS or SECURE. If the rrset is
2370                  * bogus, then we are done. */
2371                 sec = val_verify_rrset_entry(qstate->env, ve, ds,
2372                         vq->key_entry, &reason);
2373                 if(sec != sec_status_secure) {
2374                         verbose(VERB_DETAIL, "DS rrset in DS response did "
2375                                 "not verify");
2376                         errinf(qstate, reason);
2377                         goto return_bogus;
2378                 }
2379
2380                 /* If the DS rrset validates, we still have to make sure
2381                  * that they are usable. */
2382                 if(!val_dsset_isusable(ds)) {
2383                         /* If they aren't usable, then we treat it like
2384                          * there was no DS. */
2385                         *ke = key_entry_create_null(qstate->region,
2386                                 qinfo->qname, qinfo->qname_len, qinfo->qclass,
2387                                 ub_packed_rrset_ttl(ds), *qstate->env->now);
2388                         return (*ke) != NULL;
2389                 }
2390
2391                 /* Otherwise, we return the positive response. */
2392                 log_query_info(VERB_DETAIL, "validated DS", qinfo);
2393                 *ke = key_entry_create_rrset(qstate->region,
2394                         qinfo->qname, qinfo->qname_len, qinfo->qclass, ds,
2395                         NULL, *qstate->env->now);
2396                 return (*ke) != NULL;
2397         } else if(subtype == VAL_CLASS_NODATA ||
2398                 subtype == VAL_CLASS_NAMEERROR) {
2399                 /* NODATA means that the qname exists, but that there was
2400                  * no DS.  This is a pretty normal case. */
2401                 uint32_t proof_ttl = 0;
2402                 enum sec_status sec;
2403
2404                 /* make sure there are NSECs or NSEC3s with signatures */
2405                 if(!val_has_signed_nsecs(msg->rep, &reason)) {
2406                         verbose(VERB_ALGO, "no NSECs: %s", reason);
2407                         errinf(qstate, reason);
2408                         goto return_bogus;
2409                 }
2410
2411                 /* For subtype Name Error.
2412                  * attempt ANS 2.8.1.0 compatibility where it sets rcode
2413                  * to nxdomain, but really this is an Nodata/Noerror response.
2414                  * Find and prove the empty nonterminal in that case */
2415
2416                 /* Try to prove absence of the DS with NSEC */
2417                 sec = val_nsec_prove_nodata_dsreply(
2418                         qstate->env, ve, qinfo, msg->rep, vq->key_entry,
2419                         &proof_ttl, &reason);
2420                 switch(sec) {
2421                         case sec_status_secure:
2422                                 verbose(VERB_DETAIL, "NSEC RRset for the "
2423                                         "referral proved no DS.");
2424                                 *ke = key_entry_create_null(qstate->region,
2425                                         qinfo->qname, qinfo->qname_len,
2426                                         qinfo->qclass, proof_ttl,
2427                                         *qstate->env->now);
2428                                 return (*ke) != NULL;
2429                         case sec_status_insecure:
2430                                 verbose(VERB_DETAIL, "NSEC RRset for the "
2431                                   "referral proved not a delegation point");
2432                                 *ke = NULL;
2433                                 return 1;
2434                         case sec_status_bogus:
2435                                 verbose(VERB_DETAIL, "NSEC RRset for the "
2436                                         "referral did not prove no DS.");
2437                                 errinf(qstate, reason);
2438                                 goto return_bogus;
2439                         case sec_status_unchecked:
2440                         default:
2441                                 /* NSEC proof did not work, try next */
2442                                 break;
2443                 }
2444
2445                 sec = nsec3_prove_nods(qstate->env, ve,
2446                         msg->rep->rrsets + msg->rep->an_numrrsets,
2447                         msg->rep->ns_numrrsets, qinfo, vq->key_entry, &reason);
2448                 switch(sec) {
2449                         case sec_status_insecure:
2450                                 /* case insecure also continues to unsigned
2451                                  * space.  If nsec3-iter-count too high or
2452                                  * optout, then treat below as unsigned */
2453                         case sec_status_secure:
2454                                 verbose(VERB_DETAIL, "NSEC3s for the "
2455                                         "referral proved no DS.");
2456                                 *ke = key_entry_create_null(qstate->region,
2457                                         qinfo->qname, qinfo->qname_len,
2458                                         qinfo->qclass, proof_ttl,
2459                                         *qstate->env->now);
2460                                 return (*ke) != NULL;
2461                         case sec_status_indeterminate:
2462                                 verbose(VERB_DETAIL, "NSEC3s for the "
2463                                   "referral proved no delegation");
2464                                 *ke = NULL;
2465                                 return 1;
2466                         case sec_status_bogus:
2467                                 verbose(VERB_DETAIL, "NSEC3s for the "
2468                                         "referral did not prove no DS.");
2469                                 errinf(qstate, reason);
2470                                 goto return_bogus;
2471                         case sec_status_unchecked:
2472                         default:
2473                                 /* NSEC3 proof did not work */
2474                                 break;
2475                 }
2476
2477                 /* Apparently, no available NSEC/NSEC3 proved NODATA, so
2478                  * this is BOGUS. */
2479                 verbose(VERB_DETAIL, "DS %s ran out of options, so return "
2480                         "bogus", val_classification_to_string(subtype));
2481                 errinf(qstate, "no DS but also no proof of that");
2482                 goto return_bogus;
2483         } else if(subtype == VAL_CLASS_CNAME ||
2484                 subtype == VAL_CLASS_CNAMENOANSWER) {
2485                 /* if the CNAME matches the exact name we want and is signed
2486                  * properly, then also, we are sure that no DS exists there,
2487                  * much like a NODATA proof */
2488                 enum sec_status sec;
2489                 struct ub_packed_rrset_key* cname;
2490                 cname = reply_find_rrset_section_an(msg->rep, qinfo->qname,
2491                         qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass);
2492                 if(!cname) {
2493                         errinf(qstate, "validator classified CNAME but no "
2494                                 "CNAME of the queried name for DS");
2495                         goto return_bogus;
2496                 }
2497                 if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count
2498                         == 0) {
2499                         if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep->
2500                                 rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) {
2501                                 errinf(qstate, "DS got DNAME answer");
2502                         } else {
2503                                 errinf(qstate, "DS got unsigned CNAME answer");
2504                         }
2505                         goto return_bogus;
2506                 }
2507                 sec = val_verify_rrset_entry(qstate->env, ve, cname,
2508                         vq->key_entry, &reason);
2509                 if(sec == sec_status_secure) {
2510                         verbose(VERB_ALGO, "CNAME validated, "
2511                                 "proof that DS does not exist");
2512                         /* and that it is not a referral point */
2513                         *ke = NULL;
2514                         return 1;
2515                 }
2516                 errinf(qstate, "CNAME in DS response was not secure.");
2517                 errinf(qstate, reason);
2518                 goto return_bogus;
2519         } else {
2520                 verbose(VERB_QUERY, "Encountered an unhandled type of "
2521                         "DS response, thus bogus.");
2522                 errinf(qstate, "no DS and");
2523                 if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) {
2524                         char* rc = ldns_pkt_rcode2str(
2525                                 FLAGS_GET_RCODE(msg->rep->flags));
2526                         errinf(qstate, rc);
2527                         free(rc);
2528                 } else  errinf(qstate, val_classification_to_string(subtype));
2529                 errinf(qstate, "message fails to prove that");
2530                 goto return_bogus;
2531         }
2532 return_bogus:
2533         *ke = key_entry_create_bad(qstate->region, qinfo->qname,
2534                 qinfo->qname_len, qinfo->qclass,
2535                 BOGUS_KEY_TTL, *qstate->env->now);
2536         return (*ke) != NULL;
2537 }
2538
2539 /**
2540  * Process DS response. Called from inform_supers.
2541  * Because it is in inform_supers, the mesh itself is busy doing callbacks
2542  * for a state that is to be deleted soon; don't touch the mesh; instead
2543  * set a state in the super, as the super will be reactivated soon.
2544  * Perform processing to determine what state to set in the super.
2545  *
2546  * @param qstate: query state that is validating and asked for a DS.
2547  * @param vq: validator query state
2548  * @param id: module id.
2549  * @param rcode: rcode result value.
2550  * @param msg: result message (if rcode is OK).
2551  * @param qinfo: from the sub query state, query info.
2552  * @param origin: the origin of msg.
2553  */
2554 static void
2555 process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
2556         int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2557         struct sock_list* origin)
2558 {
2559         struct key_entry_key* dske = NULL;
2560         uint8_t* olds = vq->empty_DS_name;
2561         vq->empty_DS_name = NULL;
2562         if(!ds_response_to_ke(qstate, vq, id, rcode, msg, qinfo, &dske)) {
2563                         log_err("malloc failure in process_ds_response");
2564                         vq->key_entry = NULL; /* make it error */
2565                         vq->state = VAL_VALIDATE_STATE;
2566                         return;
2567         }
2568         if(dske == NULL) {
2569                 vq->empty_DS_name = regional_alloc_init(qstate->region,
2570                         qinfo->qname, qinfo->qname_len);
2571                 if(!vq->empty_DS_name) {
2572                         log_err("malloc failure in empty_DS_name");
2573                         vq->key_entry = NULL; /* make it error */
2574                         vq->state = VAL_VALIDATE_STATE;
2575                         return;
2576                 }
2577                 vq->empty_DS_len = qinfo->qname_len;
2578                 vq->chain_blacklist = NULL;
2579                 /* ds response indicated that we aren't on a delegation point.
2580                  * Keep the forState.state on FINDKEY. */
2581         } else if(key_entry_isgood(dske)) {
2582                 vq->ds_rrset = key_entry_get_rrset(dske, qstate->region);
2583                 if(!vq->ds_rrset) {
2584                         log_err("malloc failure in process DS");
2585                         vq->key_entry = NULL; /* make it error */
2586                         vq->state = VAL_VALIDATE_STATE;
2587                         return;
2588                 }
2589                 vq->chain_blacklist = NULL; /* fresh blacklist for next part*/
2590                 /* Keep the forState.state on FINDKEY. */
2591         } else if(key_entry_isbad(dske)
2592                 && vq->restart_count < VAL_MAX_RESTART_COUNT) {
2593                 vq->empty_DS_name = olds;
2594                 val_blacklist(&vq->chain_blacklist, qstate->region, origin, 1);
2595                 qstate->errinf = NULL;
2596                 vq->restart_count++;
2597         } else {
2598                 if(key_entry_isbad(dske)) {
2599                         errinf_origin(qstate, origin);
2600                         errinf_dname(qstate, "for DS", qinfo->qname);
2601                 }
2602                 /* NOTE: the reason for the DS to be not good (that is,
2603                  * either bad or null) should have been logged by
2604                  * dsResponseToKE. */
2605                 vq->key_entry = dske;
2606                 /* The FINDKEY phase has ended, so move on. */
2607                 vq->state = VAL_VALIDATE_STATE;
2608         }
2609 }
2610
2611 /**
2612  * Process DNSKEY response. Called from inform_supers.
2613  * Sets the key entry in the state.
2614  * Because it is in inform_supers, the mesh itself is busy doing callbacks
2615  * for a state that is to be deleted soon; don't touch the mesh; instead
2616  * set a state in the super, as the super will be reactivated soon.
2617  * Perform processing to determine what state to set in the super.
2618  *
2619  * @param qstate: query state that is validating and asked for a DNSKEY.
2620  * @param vq: validator query state
2621  * @param id: module id.
2622  * @param rcode: rcode result value.
2623  * @param msg: result message (if rcode is OK).
2624  * @param qinfo: from the sub query state, query info.
2625  * @param origin: the origin of msg.
2626  */
2627 static void
2628 process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
2629         int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2630         struct sock_list* origin)
2631 {
2632         struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2633         struct key_entry_key* old = vq->key_entry;
2634         struct ub_packed_rrset_key* dnskey = NULL;
2635         int downprot;
2636         char* reason = NULL;
2637
2638         if(rcode == LDNS_RCODE_NOERROR)
2639                 dnskey = reply_find_answer_rrset(qinfo, msg->rep);
2640
2641         if(dnskey == NULL) {
2642                 /* bad response */
2643                 verbose(VERB_DETAIL, "Missing DNSKEY RRset in response to "
2644                         "DNSKEY query.");
2645                 if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2646                         val_blacklist(&vq->chain_blacklist, qstate->region,
2647                                 origin, 1);
2648                         qstate->errinf = NULL;
2649                         vq->restart_count++;
2650                         return;
2651                 }
2652                 vq->key_entry = key_entry_create_bad(qstate->region,
2653                         qinfo->qname, qinfo->qname_len, qinfo->qclass,
2654                         BOGUS_KEY_TTL, *qstate->env->now);
2655                 if(!vq->key_entry) {
2656                         log_err("alloc failure in missing dnskey response");
2657                         /* key_entry is NULL for failure in Validate */
2658                 }
2659                 errinf(qstate, "No DNSKEY record");
2660                 errinf_origin(qstate, origin);
2661                 errinf_dname(qstate, "for key", qinfo->qname);
2662                 vq->state = VAL_VALIDATE_STATE;
2663                 return;
2664         }
2665         if(!vq->ds_rrset) {
2666                 log_err("internal error: no DS rrset for new DNSKEY response");
2667                 vq->key_entry = NULL;
2668                 vq->state = VAL_VALIDATE_STATE;
2669                 return;
2670         }
2671         downprot = 1;
2672         vq->key_entry = val_verify_new_DNSKEYs(qstate->region, qstate->env,
2673                 ve, dnskey, vq->ds_rrset, downprot, &reason);
2674
2675         if(!vq->key_entry) {
2676                 log_err("out of memory in verify new DNSKEYs");
2677                 vq->state = VAL_VALIDATE_STATE;
2678                 return;
2679         }
2680         /* If the key entry isBad or isNull, then we can move on to the next
2681          * state. */
2682         if(!key_entry_isgood(vq->key_entry)) {
2683                 if(key_entry_isbad(vq->key_entry)) {
2684                         if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2685                                 val_blacklist(&vq->chain_blacklist,
2686                                         qstate->region, origin, 1);
2687                                 qstate->errinf = NULL;
2688                                 vq->restart_count++;
2689                                 vq->key_entry = old;
2690                                 return;
2691                         }
2692                         verbose(VERB_DETAIL, "Did not match a DS to a DNSKEY, "
2693                                 "thus bogus.");
2694                         errinf(qstate, reason);
2695                         errinf_origin(qstate, origin);
2696                         errinf_dname(qstate, "for key", qinfo->qname);
2697                 }
2698                 vq->chain_blacklist = NULL;
2699                 vq->state = VAL_VALIDATE_STATE;
2700                 return;
2701         }
2702         vq->chain_blacklist = NULL;
2703         qstate->errinf = NULL;
2704
2705         /* The DNSKEY validated, so cache it as a trusted key rrset. */
2706         key_cache_insert(ve->kcache, vq->key_entry, qstate);
2707
2708         /* If good, we stay in the FINDKEY state. */
2709         log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo);
2710 }
2711
2712 /**
2713  * Process prime response
2714  * Sets the key entry in the state.
2715  *
2716  * @param qstate: query state that is validating and primed a trust anchor.
2717  * @param vq: validator query state
2718  * @param id: module id.
2719  * @param rcode: rcode result value.
2720  * @param msg: result message (if rcode is OK).
2721  * @param origin: the origin of msg.
2722  */
2723 static void
2724 process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
2725         int id, int rcode, struct dns_msg* msg, struct sock_list* origin)
2726 {
2727         struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2728         struct ub_packed_rrset_key* dnskey_rrset = NULL;
2729         struct trust_anchor* ta = anchor_find(qstate->env->anchors,
2730                 vq->trust_anchor_name, vq->trust_anchor_labs,
2731                 vq->trust_anchor_len, vq->qchase.qclass);
2732         if(!ta) {
2733                 /* trust anchor revoked, restart with less anchors */
2734                 vq->state = VAL_INIT_STATE;
2735                 if(!vq->trust_anchor_name)
2736                         vq->state = VAL_VALIDATE_STATE; /* break a loop */
2737                 vq->trust_anchor_name = NULL;
2738                 return;
2739         }
2740         /* Fetch and validate the keyEntry that corresponds to the
2741          * current trust anchor. */
2742         if(rcode == LDNS_RCODE_NOERROR) {
2743                 dnskey_rrset = reply_find_rrset_section_an(msg->rep,
2744                         ta->name, ta->namelen, LDNS_RR_TYPE_DNSKEY,
2745                         ta->dclass);
2746         }
2747         if(ta->autr) {
2748                 if(!autr_process_prime(qstate->env, ve, ta, dnskey_rrset)) {
2749                         /* trust anchor revoked, restart with less anchors */
2750                         vq->state = VAL_INIT_STATE;
2751                         vq->trust_anchor_name = NULL;
2752                         return;
2753                 }
2754         }
2755         vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, id);
2756         lock_basic_unlock(&ta->lock);
2757         if(vq->key_entry) {
2758                 if(key_entry_isbad(vq->key_entry)
2759                         && vq->restart_count < VAL_MAX_RESTART_COUNT) {
2760                         val_blacklist(&vq->chain_blacklist, qstate->region,
2761                                 origin, 1);
2762                         qstate->errinf = NULL;
2763                         vq->restart_count++;
2764                         vq->key_entry = NULL;
2765                         vq->state = VAL_INIT_STATE;
2766                         return;
2767                 }
2768                 vq->chain_blacklist = NULL;
2769                 errinf_origin(qstate, origin);
2770                 errinf_dname(qstate, "for trust anchor", ta->name);
2771                 /* store the freshly primed entry in the cache */
2772                 key_cache_insert(ve->kcache, vq->key_entry, qstate);
2773         }
2774
2775         /* If the result of the prime is a null key, skip the FINDKEY state.*/
2776         if(!vq->key_entry || key_entry_isnull(vq->key_entry) ||
2777                 key_entry_isbad(vq->key_entry)) {
2778                 vq->state = VAL_VALIDATE_STATE;
2779         }
2780         /* the qstate will be reactivated after inform_super is done */
2781 }
2782
2783 /**
2784  * Process DLV response. Called from inform_supers.
2785  * Because it is in inform_supers, the mesh itself is busy doing callbacks
2786  * for a state that is to be deleted soon; don't touch the mesh; instead
2787  * set a state in the super, as the super will be reactivated soon.
2788  * Perform processing to determine what state to set in the super.
2789  *
2790  * @param qstate: query state that is validating and asked for a DLV.
2791  * @param vq: validator query state
2792  * @param id: module id.
2793  * @param rcode: rcode result value.
2794  * @param msg: result message (if rcode is OK).
2795  * @param qinfo: from the sub query state, query info.
2796  */
2797 static void
2798 process_dlv_response(struct module_qstate* qstate, struct val_qstate* vq,
2799         int id, int rcode, struct dns_msg* msg, struct query_info* qinfo)
2800 {
2801         struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2802
2803         verbose(VERB_ALGO, "process dlv response to super");
2804         if(rcode != LDNS_RCODE_NOERROR) {
2805                 /* lookup failed, set in vq to give up */
2806                 vq->dlv_status = dlv_error;
2807                 verbose(VERB_ALGO, "response is error");
2808                 return;
2809         }
2810         if(msg->rep->security != sec_status_secure) {
2811                 vq->dlv_status = dlv_error;
2812                 verbose(VERB_ALGO, "response is not secure, %s",
2813                         sec_status_to_string(msg->rep->security));
2814                 return;
2815         }
2816         /* was the lookup a success? validated DLV? */
2817         if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NOERROR &&
2818                 msg->rep->an_numrrsets == 1 &&
2819                 msg->rep->security == sec_status_secure &&
2820                 ntohs(msg->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DLV &&
2821                 ntohs(msg->rep->rrsets[0]->rk.rrset_class) == qinfo->qclass &&
2822                 query_dname_compare(msg->rep->rrsets[0]->rk.dname,
2823                         vq->dlv_lookup_name) == 0) {
2824                 /* yay! it is just like a DS */
2825                 vq->ds_rrset = (struct ub_packed_rrset_key*)
2826                         regional_alloc_init(qstate->region,
2827                         msg->rep->rrsets[0], sizeof(*vq->ds_rrset));
2828                 if(!vq->ds_rrset) {
2829                         log_err("out of memory in process_dlv");
2830                         return;
2831                 }
2832                 vq->ds_rrset->entry.key = vq->ds_rrset;
2833                 vq->ds_rrset->rk.dname = (uint8_t*)regional_alloc_init(
2834                         qstate->region, vq->ds_rrset->rk.dname,
2835                         vq->ds_rrset->rk.dname_len);
2836                 if(!vq->ds_rrset->rk.dname) {
2837                         log_err("out of memory in process_dlv");
2838                         vq->dlv_status = dlv_error;
2839                         return;
2840                 }
2841                 vq->ds_rrset->entry.data = regional_alloc_init(qstate->region,
2842                         vq->ds_rrset->entry.data,
2843                         packed_rrset_sizeof(vq->ds_rrset->entry.data));
2844                 if(!vq->ds_rrset->entry.data) {
2845                         log_err("out of memory in process_dlv");
2846                         vq->dlv_status = dlv_error;
2847                         return;
2848                 }
2849                 packed_rrset_ptr_fixup(vq->ds_rrset->entry.data);
2850                 /* make vq do a DNSKEY query next up */
2851                 vq->dlv_status = dlv_success;
2852                 return;
2853         }
2854         /* store NSECs into negative cache */
2855         val_neg_addreply(ve->neg_cache, msg->rep);
2856
2857         /* was the lookup a failure?
2858          *   if we have to go up into the DLV for a higher DLV anchor
2859          *   then set this in the vq, so it can make queries when activated.
2860          * See if the NSECs indicate that we should look for higher DLV
2861          * or, that there is no DLV securely */
2862         if(!val_nsec_check_dlv(qinfo, msg->rep, &vq->dlv_lookup_name,
2863                 &vq->dlv_lookup_name_len)) {
2864                 vq->dlv_status = dlv_error;
2865                 verbose(VERB_ALGO, "nsec error");
2866                 return;
2867         }
2868         if(!dname_subdomain_c(vq->dlv_lookup_name,
2869                 qstate->env->anchors->dlv_anchor->name)) {
2870                 vq->dlv_status = dlv_there_is_no_dlv;
2871                 return;
2872         }
2873         vq->dlv_status = dlv_ask_higher;
2874 }
2875
2876 /*
2877  * inform validator super.
2878  *
2879  * @param qstate: query state that finished.
2880  * @param id: module id.
2881  * @param super: the qstate to inform.
2882  */
2883 void
2884 val_inform_super(struct module_qstate* qstate, int id,
2885         struct module_qstate* super)
2886 {
2887         struct val_qstate* vq = (struct val_qstate*)super->minfo[id];
2888         log_query_info(VERB_ALGO, "validator: inform_super, sub is",
2889                 &qstate->qinfo);
2890         log_query_info(VERB_ALGO, "super is", &super->qinfo);
2891         if(!vq) {
2892                 verbose(VERB_ALGO, "super: has no validator state");
2893                 return;
2894         }
2895         if(vq->wait_prime_ta) {
2896                 vq->wait_prime_ta = 0;
2897                 process_prime_response(super, vq, id, qstate->return_rcode,
2898                         qstate->return_msg, qstate->reply_origin);
2899                 return;
2900         }
2901         if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS) {
2902                 process_ds_response(super, vq, id, qstate->return_rcode,
2903                         qstate->return_msg, &qstate->qinfo,
2904                         qstate->reply_origin);
2905                 return;
2906         } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY) {
2907                 process_dnskey_response(super, vq, id, qstate->return_rcode,
2908                         qstate->return_msg, &qstate->qinfo,
2909                         qstate->reply_origin);
2910                 return;
2911         } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DLV) {
2912                 process_dlv_response(super, vq, id, qstate->return_rcode,
2913                         qstate->return_msg, &qstate->qinfo);
2914                 return;
2915         }
2916         log_err("internal error in validator: no inform_supers possible");
2917 }
2918
2919 void
2920 val_clear(struct module_qstate* qstate, int id)
2921 {
2922         if(!qstate)
2923                 return;
2924         /* everything is allocated in the region, so assign NULL */
2925         qstate->minfo[id] = NULL;
2926 }
2927
2928 size_t
2929 val_get_mem(struct module_env* env, int id)
2930 {
2931         struct val_env* ve = (struct val_env*)env->modinfo[id];
2932         if(!ve)
2933                 return 0;
2934         return sizeof(*ve) + key_cache_get_mem(ve->kcache) +
2935                 val_neg_get_mem(ve->neg_cache) +
2936                 sizeof(size_t)*2*ve->nsec3_keyiter_count;
2937 }
2938
2939 /**
2940  * The validator function block
2941  */
2942 static struct module_func_block val_block = {
2943         "validator",
2944         &val_init, &val_deinit, &val_operate, &val_inform_super, &val_clear,
2945         &val_get_mem
2946 };
2947
2948 struct module_func_block*
2949 val_get_funcblock(void)
2950 {
2951         return &val_block;
2952 }
2953
2954 const char*
2955 val_state_to_string(enum val_state state)
2956 {
2957         switch(state) {
2958                 case VAL_INIT_STATE: return "VAL_INIT_STATE";
2959                 case VAL_FINDKEY_STATE: return "VAL_FINDKEY_STATE";
2960                 case VAL_VALIDATE_STATE: return "VAL_VALIDATE_STATE";
2961                 case VAL_FINISHED_STATE: return "VAL_FINISHED_STATE";
2962                 case VAL_DLVLOOKUP_STATE: return "VAL_DLVLOOKUP_STATE";
2963         }
2964         return "UNKNOWN VALIDATOR STATE";
2965 }
2966