1 /*
2 * validator/autotrust.c - RFC5011 trust anchor management for unbound.
3 *
4 * Copyright (c) 2009, NLnet Labs. All rights reserved.
5 *
6 * This software is open source.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
14 *
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
18 *
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 */
35
36 /**
37 * \file
38 *
39 * Contains autotrust implementation. The implementation was taken from
40 * the autotrust daemon (BSD licensed), written by Matthijs Mekking.
41 * It was modified to fit into unbound. The state table process is the same.
42 */
43 #include "config.h"
44 #include "validator/autotrust.h"
45 #include "validator/val_anchor.h"
46 #include "validator/val_utils.h"
47 #include "validator/val_sigcrypt.h"
48 #include "util/data/dname.h"
49 #include "util/data/packed_rrset.h"
50 #include "util/log.h"
51 #include "util/module.h"
52 #include "util/net_help.h"
53 #include "util/config_file.h"
54 #include "util/regional.h"
55 #include "util/random.h"
56 #include "util/data/msgparse.h"
57 #include "services/mesh.h"
58 #include "services/cache/rrset.h"
59 #include "validator/val_kcache.h"
60 #include "sldns/sbuffer.h"
61 #include "sldns/wire2str.h"
62 #include "sldns/str2wire.h"
63 #include "sldns/keyraw.h"
64 #include "sldns/rrdef.h"
65 #include <stdarg.h>
66 #include <ctype.h>
67
68 /** number of times a key must be seen before it can become valid */
69 #define MIN_PENDINGCOUNT 2
70
71 /** Event: Revoked */
72 static void do_revoked(struct module_env* env, struct autr_ta* anchor, int* c);
73
autr_global_create(void)74 struct autr_global_data* autr_global_create(void)
75 {
76 struct autr_global_data* global;
77 global = (struct autr_global_data*)malloc(sizeof(*global));
78 if(!global)
79 return NULL;
80 rbtree_init(&global->probe, &probetree_cmp);
81 return global;
82 }
83
autr_global_delete(struct autr_global_data * global)84 void autr_global_delete(struct autr_global_data* global)
85 {
86 if(!global)
87 return;
88 /* elements deleted by parent */
89 free(global);
90 }
91
probetree_cmp(const void * x,const void * y)92 int probetree_cmp(const void* x, const void* y)
93 {
94 struct trust_anchor* a = (struct trust_anchor*)x;
95 struct trust_anchor* b = (struct trust_anchor*)y;
96 log_assert(a->autr && b->autr);
97 if(a->autr->next_probe_time < b->autr->next_probe_time)
98 return -1;
99 if(a->autr->next_probe_time > b->autr->next_probe_time)
100 return 1;
101 /* time is equal, sort on trust point identity */
102 return anchor_cmp(x, y);
103 }
104
105 size_t
autr_get_num_anchors(struct val_anchors * anchors)106 autr_get_num_anchors(struct val_anchors* anchors)
107 {
108 size_t res = 0;
109 if(!anchors)
110 return 0;
111 lock_basic_lock(&anchors->lock);
112 if(anchors->autr)
113 res = anchors->autr->probe.count;
114 lock_basic_unlock(&anchors->lock);
115 return res;
116 }
117
118 /** Position in string */
119 static int
position_in_string(char * str,const char * sub)120 position_in_string(char *str, const char* sub)
121 {
122 char* pos = strstr(str, sub);
123 if(pos)
124 return (int)(pos-str)+(int)strlen(sub);
125 return -1;
126 }
127
128 /** Debug routine to print pretty key information */
129 static void
130 verbose_key(struct autr_ta* ta, enum verbosity_value level,
131 const char* format, ...) ATTR_FORMAT(printf, 3, 4);
132
133 /**
134 * Implementation of debug pretty key print
135 * @param ta: trust anchor key with DNSKEY data.
136 * @param level: verbosity level to print at.
137 * @param format: printf style format string.
138 */
139 static void
verbose_key(struct autr_ta * ta,enum verbosity_value level,const char * format,...)140 verbose_key(struct autr_ta* ta, enum verbosity_value level,
141 const char* format, ...)
142 {
143 va_list args;
144 va_start(args, format);
145 if(verbosity >= level) {
146 char* str = sldns_wire2str_dname(ta->rr, ta->dname_len);
147 int keytag = (int)sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
148 ta->rr, ta->rr_len, ta->dname_len),
149 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
150 ta->dname_len));
151 char msg[MAXSYSLOGMSGLEN];
152 vsnprintf(msg, sizeof(msg), format, args);
153 verbose(level, "%s key %d %s", str?str:"??", keytag, msg);
154 free(str);
155 }
156 va_end(args);
157 }
158
159 /**
160 * Parse comments
161 * @param str: to parse
162 * @param ta: trust key autotrust metadata
163 * @return false on failure.
164 */
165 static int
parse_comments(char * str,struct autr_ta * ta)166 parse_comments(char* str, struct autr_ta* ta)
167 {
168 int len = (int)strlen(str), pos = 0, timestamp = 0;
169 char* comment = (char*) malloc(sizeof(char)*len+1);
170 char* comments = comment;
171 if(!comment) {
172 log_err("malloc failure in parse");
173 return 0;
174 }
175 /* skip over whitespace and data at start of line */
176 while (*str != '\0' && *str != ';')
177 str++;
178 if (*str == ';')
179 str++;
180 /* copy comments */
181 while (*str != '\0')
182 {
183 *comments = *str;
184 comments++;
185 str++;
186 }
187 *comments = '\0';
188
189 comments = comment;
190
191 /* read state */
192 pos = position_in_string(comments, "state=");
193 if (pos >= (int) strlen(comments))
194 {
195 log_err("parse error");
196 free(comment);
197 return 0;
198 }
199 if (pos <= 0)
200 ta->s = AUTR_STATE_VALID;
201 else
202 {
203 int s = (int) comments[pos] - '0';
204 switch(s)
205 {
206 case AUTR_STATE_START:
207 case AUTR_STATE_ADDPEND:
208 case AUTR_STATE_VALID:
209 case AUTR_STATE_MISSING:
210 case AUTR_STATE_REVOKED:
211 case AUTR_STATE_REMOVED:
212 ta->s = s;
213 break;
214 default:
215 verbose_key(ta, VERB_OPS, "has undefined "
216 "state, considered NewKey");
217 ta->s = AUTR_STATE_START;
218 break;
219 }
220 }
221 /* read pending count */
222 pos = position_in_string(comments, "count=");
223 if (pos >= (int) strlen(comments))
224 {
225 log_err("parse error");
226 free(comment);
227 return 0;
228 }
229 if (pos <= 0)
230 ta->pending_count = 0;
231 else
232 {
233 comments += pos;
234 ta->pending_count = (uint8_t)atoi(comments);
235 }
236
237 /* read last change */
238 pos = position_in_string(comments, "lastchange=");
239 if (pos >= (int) strlen(comments))
240 {
241 log_err("parse error");
242 free(comment);
243 return 0;
244 }
245 if (pos >= 0)
246 {
247 comments += pos;
248 timestamp = atoi(comments);
249 }
250 if (pos < 0 || !timestamp)
251 ta->last_change = 0;
252 else
253 ta->last_change = (time_t)timestamp;
254
255 free(comment);
256 return 1;
257 }
258
259 /** Check if a line contains data (besides comments) */
260 static int
str_contains_data(char * str,char comment)261 str_contains_data(char* str, char comment)
262 {
263 while (*str != '\0') {
264 if (*str == comment || *str == '\n')
265 return 0;
266 if (*str != ' ' && *str != '\t')
267 return 1;
268 str++;
269 }
270 return 0;
271 }
272
273 /** Get DNSKEY flags
274 * rdata without rdatalen in front of it. */
275 static int
dnskey_flags(uint16_t t,uint8_t * rdata,size_t len)276 dnskey_flags(uint16_t t, uint8_t* rdata, size_t len)
277 {
278 uint16_t f;
279 if(t != LDNS_RR_TYPE_DNSKEY)
280 return 0;
281 if(len < 2)
282 return 0;
283 memmove(&f, rdata, 2);
284 f = ntohs(f);
285 return (int)f;
286 }
287
288 /** Check if KSK DNSKEY.
289 * pass rdata without rdatalen in front of it */
290 static int
rr_is_dnskey_sep(uint16_t t,uint8_t * rdata,size_t len)291 rr_is_dnskey_sep(uint16_t t, uint8_t* rdata, size_t len)
292 {
293 return (dnskey_flags(t, rdata, len)&DNSKEY_BIT_SEP);
294 }
295
296 /** Check if TA is KSK DNSKEY */
297 static int
ta_is_dnskey_sep(struct autr_ta * ta)298 ta_is_dnskey_sep(struct autr_ta* ta)
299 {
300 return (dnskey_flags(
301 sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len),
302 sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len),
303 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len)
304 ) & DNSKEY_BIT_SEP);
305 }
306
307 /** Check if REVOKED DNSKEY
308 * pass rdata without rdatalen in front of it */
309 static int
rr_is_dnskey_revoked(uint16_t t,uint8_t * rdata,size_t len)310 rr_is_dnskey_revoked(uint16_t t, uint8_t* rdata, size_t len)
311 {
312 return (dnskey_flags(t, rdata, len)&LDNS_KEY_REVOKE_KEY);
313 }
314
315 /** create ta */
316 static struct autr_ta*
autr_ta_create(uint8_t * rr,size_t rr_len,size_t dname_len)317 autr_ta_create(uint8_t* rr, size_t rr_len, size_t dname_len)
318 {
319 struct autr_ta* ta = (struct autr_ta*)calloc(1, sizeof(*ta));
320 if(!ta) {
321 free(rr);
322 return NULL;
323 }
324 ta->rr = rr;
325 ta->rr_len = rr_len;
326 ta->dname_len = dname_len;
327 return ta;
328 }
329
330 /** create tp */
331 static struct trust_anchor*
autr_tp_create(struct val_anchors * anchors,uint8_t * own,size_t own_len,uint16_t dc)332 autr_tp_create(struct val_anchors* anchors, uint8_t* own, size_t own_len,
333 uint16_t dc)
334 {
335 struct trust_anchor* tp = (struct trust_anchor*)calloc(1, sizeof(*tp));
336 if(!tp) return NULL;
337 tp->name = memdup(own, own_len);
338 if(!tp->name) {
339 free(tp);
340 return NULL;
341 }
342 tp->namelen = own_len;
343 tp->namelabs = dname_count_labels(tp->name);
344 tp->node.key = tp;
345 tp->dclass = dc;
346 tp->autr = (struct autr_point_data*)calloc(1, sizeof(*tp->autr));
347 if(!tp->autr) {
348 free(tp->name);
349 free(tp);
350 return NULL;
351 }
352 tp->autr->pnode.key = tp;
353
354 lock_basic_lock(&anchors->lock);
355 if(!rbtree_insert(anchors->tree, &tp->node)) {
356 char buf[LDNS_MAX_DOMAINLEN+1];
357 lock_basic_unlock(&anchors->lock);
358 dname_str(tp->name, buf);
359 log_err("trust anchor for '%s' presented twice", buf);
360 free(tp->name);
361 free(tp->autr);
362 free(tp);
363 return NULL;
364 }
365 if(!rbtree_insert(&anchors->autr->probe, &tp->autr->pnode)) {
366 char buf[LDNS_MAX_DOMAINLEN+1];
367 (void)rbtree_delete(anchors->tree, tp);
368 lock_basic_unlock(&anchors->lock);
369 dname_str(tp->name, buf);
370 log_err("trust anchor for '%s' in probetree twice", buf);
371 free(tp->name);
372 free(tp->autr);
373 free(tp);
374 return NULL;
375 }
376 lock_basic_init(&tp->lock);
377 lock_protect(&tp->lock, tp, sizeof(*tp));
378 lock_protect(&tp->lock, tp->autr, sizeof(*tp->autr));
379 lock_basic_unlock(&anchors->lock);
380 return tp;
381 }
382
383 /** delete assembled rrsets */
384 static void
autr_rrset_delete(struct ub_packed_rrset_key * r)385 autr_rrset_delete(struct ub_packed_rrset_key* r)
386 {
387 if(r) {
388 free(r->rk.dname);
389 free(r->entry.data);
390 free(r);
391 }
392 }
393
autr_point_delete(struct trust_anchor * tp)394 void autr_point_delete(struct trust_anchor* tp)
395 {
396 if(!tp)
397 return;
398 lock_unprotect(&tp->lock, tp);
399 lock_unprotect(&tp->lock, tp->autr);
400 lock_basic_destroy(&tp->lock);
401 autr_rrset_delete(tp->ds_rrset);
402 autr_rrset_delete(tp->dnskey_rrset);
403 if(tp->autr) {
404 struct autr_ta* p = tp->autr->keys, *np;
405 while(p) {
406 np = p->next;
407 free(p->rr);
408 free(p);
409 p = np;
410 }
411 free(tp->autr->file);
412 free(tp->autr);
413 }
414 free(tp->name);
415 free(tp);
416 }
417
418 /** find or add a new trust point for autotrust */
419 static struct trust_anchor*
find_add_tp(struct val_anchors * anchors,uint8_t * rr,size_t rr_len,size_t dname_len)420 find_add_tp(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
421 size_t dname_len)
422 {
423 struct trust_anchor* tp;
424 tp = anchor_find(anchors, rr, dname_count_labels(rr), dname_len,
425 sldns_wirerr_get_class(rr, rr_len, dname_len));
426 if(tp) {
427 if(!tp->autr) {
428 log_err("anchor cannot be with and without autotrust");
429 lock_basic_unlock(&tp->lock);
430 return NULL;
431 }
432 return tp;
433 }
434 tp = autr_tp_create(anchors, rr, dname_len, sldns_wirerr_get_class(rr,
435 rr_len, dname_len));
436 if(!tp)
437 return NULL;
438 lock_basic_lock(&tp->lock);
439 return tp;
440 }
441
442 /** Add trust anchor from RR */
443 static struct autr_ta*
add_trustanchor_frm_rr(struct val_anchors * anchors,uint8_t * rr,size_t rr_len,size_t dname_len,struct trust_anchor ** tp)444 add_trustanchor_frm_rr(struct val_anchors* anchors, uint8_t* rr, size_t rr_len,
445 size_t dname_len, struct trust_anchor** tp)
446 {
447 struct autr_ta* ta = autr_ta_create(rr, rr_len, dname_len);
448 if(!ta)
449 return NULL;
450 *tp = find_add_tp(anchors, rr, rr_len, dname_len);
451 if(!*tp) {
452 free(ta->rr);
453 free(ta);
454 return NULL;
455 }
456 /* add ta to tp */
457 ta->next = (*tp)->autr->keys;
458 (*tp)->autr->keys = ta;
459 lock_basic_unlock(&(*tp)->lock);
460 return ta;
461 }
462
463 /**
464 * Add new trust anchor from a string in file.
465 * @param anchors: all anchors
466 * @param str: string with anchor and comments, if any comments.
467 * @param tp: trust point returned.
468 * @param origin: what to use for @
469 * @param origin_len: length of origin
470 * @param prev: previous rr name
471 * @param prev_len: length of prev
472 * @param skip: if true, the result is NULL, but not an error, skip it.
473 * @return new key in trust point.
474 */
475 static struct autr_ta*
add_trustanchor_frm_str(struct val_anchors * anchors,char * str,struct trust_anchor ** tp,uint8_t * origin,size_t origin_len,uint8_t ** prev,size_t * prev_len,int * skip)476 add_trustanchor_frm_str(struct val_anchors* anchors, char* str,
477 struct trust_anchor** tp, uint8_t* origin, size_t origin_len,
478 uint8_t** prev, size_t* prev_len, int* skip)
479 {
480 uint8_t rr[LDNS_RR_BUF_SIZE];
481 size_t rr_len = sizeof(rr), dname_len;
482 uint8_t* drr;
483 int lstatus;
484 if (!str_contains_data(str, ';')) {
485 *skip = 1;
486 return NULL; /* empty line */
487 }
488 if(0 != (lstatus = sldns_str2wire_rr_buf(str, rr, &rr_len, &dname_len,
489 0, origin, origin_len, *prev, *prev_len)))
490 {
491 log_err("ldns error while converting string to RR at%d: %s: %s",
492 LDNS_WIREPARSE_OFFSET(lstatus),
493 sldns_get_errorstr_parse(lstatus), str);
494 return NULL;
495 }
496 free(*prev);
497 *prev = memdup(rr, dname_len);
498 *prev_len = dname_len;
499 if(!*prev) {
500 log_err("malloc failure in add_trustanchor");
501 return NULL;
502 }
503 if(sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DNSKEY &&
504 sldns_wirerr_get_type(rr, rr_len, dname_len)!=LDNS_RR_TYPE_DS) {
505 *skip = 1;
506 return NULL; /* only DS and DNSKEY allowed */
507 }
508 drr = memdup(rr, rr_len);
509 if(!drr) {
510 log_err("malloc failure in add trustanchor");
511 return NULL;
512 }
513 return add_trustanchor_frm_rr(anchors, drr, rr_len, dname_len, tp);
514 }
515
516 /**
517 * Load single anchor
518 * @param anchors: all points.
519 * @param str: comments line
520 * @param fname: filename
521 * @param origin: the $ORIGIN.
522 * @param origin_len: length of origin
523 * @param prev: passed to ldns.
524 * @param prev_len: length of prev
525 * @param skip: if true, the result is NULL, but not an error, skip it.
526 * @return false on failure, otherwise the tp read.
527 */
528 static struct trust_anchor*
load_trustanchor(struct val_anchors * anchors,char * str,const char * fname,uint8_t * origin,size_t origin_len,uint8_t ** prev,size_t * prev_len,int * skip)529 load_trustanchor(struct val_anchors* anchors, char* str, const char* fname,
530 uint8_t* origin, size_t origin_len, uint8_t** prev, size_t* prev_len,
531 int* skip)
532 {
533 struct autr_ta* ta = NULL;
534 struct trust_anchor* tp = NULL;
535
536 ta = add_trustanchor_frm_str(anchors, str, &tp, origin, origin_len,
537 prev, prev_len, skip);
538 if(!ta)
539 return NULL;
540 lock_basic_lock(&tp->lock);
541 if(!parse_comments(str, ta)) {
542 lock_basic_unlock(&tp->lock);
543 return NULL;
544 }
545 if(!tp->autr->file) {
546 tp->autr->file = strdup(fname);
547 if(!tp->autr->file) {
548 lock_basic_unlock(&tp->lock);
549 log_err("malloc failure");
550 return NULL;
551 }
552 }
553 lock_basic_unlock(&tp->lock);
554 return tp;
555 }
556
557 /** iterator for DSes from keylist. return true if a next element exists */
558 static int
assemble_iterate_ds(struct autr_ta ** list,uint8_t ** rr,size_t * rr_len,size_t * dname_len)559 assemble_iterate_ds(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
560 size_t* dname_len)
561 {
562 while(*list) {
563 if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
564 (*list)->dname_len) == LDNS_RR_TYPE_DS) {
565 *rr = (*list)->rr;
566 *rr_len = (*list)->rr_len;
567 *dname_len = (*list)->dname_len;
568 *list = (*list)->next;
569 return 1;
570 }
571 *list = (*list)->next;
572 }
573 return 0;
574 }
575
576 /** iterator for DNSKEYs from keylist. return true if a next element exists */
577 static int
assemble_iterate_dnskey(struct autr_ta ** list,uint8_t ** rr,size_t * rr_len,size_t * dname_len)578 assemble_iterate_dnskey(struct autr_ta** list, uint8_t** rr, size_t* rr_len,
579 size_t* dname_len)
580 {
581 while(*list) {
582 if(sldns_wirerr_get_type((*list)->rr, (*list)->rr_len,
583 (*list)->dname_len) != LDNS_RR_TYPE_DS &&
584 ((*list)->s == AUTR_STATE_VALID ||
585 (*list)->s == AUTR_STATE_MISSING)) {
586 *rr = (*list)->rr;
587 *rr_len = (*list)->rr_len;
588 *dname_len = (*list)->dname_len;
589 *list = (*list)->next;
590 return 1;
591 }
592 *list = (*list)->next;
593 }
594 return 0;
595 }
596
597 /** see if iterator-list has any elements in it, or it is empty */
598 static int
assemble_iterate_hasfirst(int iter (struct autr_ta **,uint8_t **,size_t *,size_t *),struct autr_ta * list)599 assemble_iterate_hasfirst(int iter(struct autr_ta**, uint8_t**, size_t*,
600 size_t*), struct autr_ta* list)
601 {
602 uint8_t* rr = NULL;
603 size_t rr_len = 0, dname_len = 0;
604 return iter(&list, &rr, &rr_len, &dname_len);
605 }
606
607 /** number of elements in iterator list */
608 static size_t
assemble_iterate_count(int iter (struct autr_ta **,uint8_t **,size_t *,size_t *),struct autr_ta * list)609 assemble_iterate_count(int iter(struct autr_ta**, uint8_t**, size_t*,
610 size_t*), struct autr_ta* list)
611 {
612 uint8_t* rr = NULL;
613 size_t i = 0, rr_len = 0, dname_len = 0;
614 while(iter(&list, &rr, &rr_len, &dname_len)) {
615 i++;
616 }
617 return i;
618 }
619
620 /**
621 * Create a ub_packed_rrset_key allocated on the heap.
622 * It therefore does not have the correct ID value, and cannot be used
623 * inside the cache. It can be used in storage outside of the cache.
624 * Keys for the cache have to be obtained from alloc.h .
625 * @param iter: iterator over the elements in the list. It filters elements.
626 * @param list: the list.
627 * @return key allocated or NULL on failure.
628 */
629 static struct ub_packed_rrset_key*
ub_packed_rrset_heap_key(int iter (struct autr_ta **,uint8_t **,size_t *,size_t *),struct autr_ta * list)630 ub_packed_rrset_heap_key(int iter(struct autr_ta**, uint8_t**, size_t*,
631 size_t*), struct autr_ta* list)
632 {
633 uint8_t* rr = NULL;
634 size_t rr_len = 0, dname_len = 0;
635 struct ub_packed_rrset_key* k;
636 if(!iter(&list, &rr, &rr_len, &dname_len))
637 return NULL;
638 k = (struct ub_packed_rrset_key*)calloc(1, sizeof(*k));
639 if(!k)
640 return NULL;
641 k->rk.type = htons(sldns_wirerr_get_type(rr, rr_len, dname_len));
642 k->rk.rrset_class = htons(sldns_wirerr_get_class(rr, rr_len, dname_len));
643 k->rk.dname_len = dname_len;
644 k->rk.dname = memdup(rr, dname_len);
645 if(!k->rk.dname) {
646 free(k);
647 return NULL;
648 }
649 return k;
650 }
651
652 /**
653 * Create packed_rrset data on the heap.
654 * @param iter: iterator over the elements in the list. It filters elements.
655 * @param list: the list.
656 * @return data allocated or NULL on failure.
657 */
658 static struct packed_rrset_data*
packed_rrset_heap_data(int iter (struct autr_ta **,uint8_t **,size_t *,size_t *),struct autr_ta * list)659 packed_rrset_heap_data(int iter(struct autr_ta**, uint8_t**, size_t*,
660 size_t*), struct autr_ta* list)
661 {
662 uint8_t* rr = NULL;
663 size_t rr_len = 0, dname_len = 0;
664 struct packed_rrset_data* data;
665 size_t count=0, rrsig_count=0, len=0, i, total;
666 uint8_t* nextrdata;
667 struct autr_ta* list_i;
668 time_t ttl = 0;
669
670 list_i = list;
671 while(iter(&list_i, &rr, &rr_len, &dname_len)) {
672 if(sldns_wirerr_get_type(rr, rr_len, dname_len) ==
673 LDNS_RR_TYPE_RRSIG)
674 rrsig_count++;
675 else count++;
676 /* sizeof the rdlength + rdatalen */
677 len += 2 + sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
678 ttl = (time_t)sldns_wirerr_get_ttl(rr, rr_len, dname_len);
679 }
680 if(count == 0 && rrsig_count == 0)
681 return NULL;
682
683 /* allocate */
684 total = count + rrsig_count;
685 len += sizeof(*data) + total*(sizeof(size_t) + sizeof(time_t) +
686 sizeof(uint8_t*));
687 data = (struct packed_rrset_data*)calloc(1, len);
688 if(!data)
689 return NULL;
690
691 /* fill it */
692 data->ttl = ttl;
693 data->count = count;
694 data->rrsig_count = rrsig_count;
695 data->rr_len = (size_t*)((uint8_t*)data +
696 sizeof(struct packed_rrset_data));
697 data->rr_data = (uint8_t**)&(data->rr_len[total]);
698 data->rr_ttl = (time_t*)&(data->rr_data[total]);
699 nextrdata = (uint8_t*)&(data->rr_ttl[total]);
700
701 /* fill out len, ttl, fields */
702 list_i = list;
703 i = 0;
704 while(iter(&list_i, &rr, &rr_len, &dname_len)) {
705 data->rr_ttl[i] = (time_t)sldns_wirerr_get_ttl(rr, rr_len,
706 dname_len);
707 if(data->rr_ttl[i] < data->ttl)
708 data->ttl = data->rr_ttl[i];
709 data->rr_len[i] = 2 /* the rdlength */ +
710 sldns_wirerr_get_rdatalen(rr, rr_len, dname_len);
711 i++;
712 }
713
714 /* fixup rest of ptrs */
715 for(i=0; i<total; i++) {
716 data->rr_data[i] = nextrdata;
717 nextrdata += data->rr_len[i];
718 }
719
720 /* copy data in there */
721 list_i = list;
722 i = 0;
723 while(iter(&list_i, &rr, &rr_len, &dname_len)) {
724 log_assert(data->rr_data[i]);
725 memmove(data->rr_data[i],
726 sldns_wirerr_get_rdatawl(rr, rr_len, dname_len),
727 data->rr_len[i]);
728 i++;
729 }
730
731 if(data->rrsig_count && data->count == 0) {
732 data->count = data->rrsig_count; /* rrset type is RRSIG */
733 data->rrsig_count = 0;
734 }
735 return data;
736 }
737
738 /**
739 * Assemble the trust anchors into DS and DNSKEY packed rrsets.
740 * Uses only VALID and MISSING DNSKEYs.
741 * Read the sldns_rrs and builds packed rrsets
742 * @param tp: the trust point. Must be locked.
743 * @return false on malloc failure.
744 */
745 static int
autr_assemble(struct trust_anchor * tp)746 autr_assemble(struct trust_anchor* tp)
747 {
748 struct ub_packed_rrset_key* ubds=NULL, *ubdnskey=NULL;
749
750 /* make packed rrset keys - malloced with no ID number, they
751 * are not in the cache */
752 /* make packed rrset data (if there is a key) */
753 if(assemble_iterate_hasfirst(assemble_iterate_ds, tp->autr->keys)) {
754 ubds = ub_packed_rrset_heap_key(
755 assemble_iterate_ds, tp->autr->keys);
756 if(!ubds)
757 goto error_cleanup;
758 ubds->entry.data = packed_rrset_heap_data(
759 assemble_iterate_ds, tp->autr->keys);
760 if(!ubds->entry.data)
761 goto error_cleanup;
762 }
763
764 /* make packed DNSKEY data */
765 if(assemble_iterate_hasfirst(assemble_iterate_dnskey, tp->autr->keys)) {
766 ubdnskey = ub_packed_rrset_heap_key(
767 assemble_iterate_dnskey, tp->autr->keys);
768 if(!ubdnskey)
769 goto error_cleanup;
770 ubdnskey->entry.data = packed_rrset_heap_data(
771 assemble_iterate_dnskey, tp->autr->keys);
772 if(!ubdnskey->entry.data) {
773 error_cleanup:
774 autr_rrset_delete(ubds);
775 autr_rrset_delete(ubdnskey);
776 return 0;
777 }
778 }
779
780 /* we have prepared the new keys so nothing can go wrong any more.
781 * And we are sure we cannot be left without trustanchor after
782 * any errors. Put in the new keys and remove old ones. */
783
784 /* free the old data */
785 autr_rrset_delete(tp->ds_rrset);
786 autr_rrset_delete(tp->dnskey_rrset);
787
788 /* assign the data to replace the old */
789 tp->ds_rrset = ubds;
790 tp->dnskey_rrset = ubdnskey;
791 tp->numDS = assemble_iterate_count(assemble_iterate_ds,
792 tp->autr->keys);
793 tp->numDNSKEY = assemble_iterate_count(assemble_iterate_dnskey,
794 tp->autr->keys);
795 return 1;
796 }
797
798 /** parse integer */
799 static unsigned int
parse_int(char * line,int * ret)800 parse_int(char* line, int* ret)
801 {
802 char *e;
803 unsigned int x = (unsigned int)strtol(line, &e, 10);
804 if(line == e) {
805 *ret = -1; /* parse error */
806 return 0;
807 }
808 *ret = 1; /* matched */
809 return x;
810 }
811
812 /** parse id sequence for anchor */
813 static struct trust_anchor*
parse_id(struct val_anchors * anchors,char * line)814 parse_id(struct val_anchors* anchors, char* line)
815 {
816 struct trust_anchor *tp;
817 int r;
818 uint16_t dclass;
819 uint8_t* dname;
820 size_t dname_len;
821 /* read the owner name */
822 char* next = strchr(line, ' ');
823 if(!next)
824 return NULL;
825 next[0] = 0;
826 dname = sldns_str2wire_dname(line, &dname_len);
827 if(!dname)
828 return NULL;
829
830 /* read the class */
831 dclass = parse_int(next+1, &r);
832 if(r == -1) {
833 free(dname);
834 return NULL;
835 }
836
837 /* find the trust point */
838 tp = autr_tp_create(anchors, dname, dname_len, dclass);
839 free(dname);
840 return tp;
841 }
842
843 /**
844 * Parse variable from trustanchor header
845 * @param line: to parse
846 * @param anchors: the anchor is added to this, if "id:" is seen.
847 * @param anchor: the anchor as result value or previously returned anchor
848 * value to read the variable lines into.
849 * @return: 0 no match, -1 failed syntax error, +1 success line read.
850 * +2 revoked trust anchor file.
851 */
852 static int
parse_var_line(char * line,struct val_anchors * anchors,struct trust_anchor ** anchor)853 parse_var_line(char* line, struct val_anchors* anchors,
854 struct trust_anchor** anchor)
855 {
856 struct trust_anchor* tp = *anchor;
857 int r = 0;
858 if(strncmp(line, ";;id: ", 6) == 0) {
859 *anchor = parse_id(anchors, line+6);
860 if(!*anchor) return -1;
861 else return 1;
862 } else if(strncmp(line, ";;REVOKED", 9) == 0) {
863 if(tp) {
864 log_err("REVOKED statement must be at start of file");
865 return -1;
866 }
867 return 2;
868 } else if(strncmp(line, ";;last_queried: ", 16) == 0) {
869 if(!tp) return -1;
870 lock_basic_lock(&tp->lock);
871 tp->autr->last_queried = (time_t)parse_int(line+16, &r);
872 lock_basic_unlock(&tp->lock);
873 } else if(strncmp(line, ";;last_success: ", 16) == 0) {
874 if(!tp) return -1;
875 lock_basic_lock(&tp->lock);
876 tp->autr->last_success = (time_t)parse_int(line+16, &r);
877 lock_basic_unlock(&tp->lock);
878 } else if(strncmp(line, ";;next_probe_time: ", 19) == 0) {
879 if(!tp) return -1;
880 lock_basic_lock(&anchors->lock);
881 lock_basic_lock(&tp->lock);
882 (void)rbtree_delete(&anchors->autr->probe, tp);
883 tp->autr->next_probe_time = (time_t)parse_int(line+19, &r);
884 (void)rbtree_insert(&anchors->autr->probe, &tp->autr->pnode);
885 lock_basic_unlock(&tp->lock);
886 lock_basic_unlock(&anchors->lock);
887 } else if(strncmp(line, ";;query_failed: ", 16) == 0) {
888 if(!tp) return -1;
889 lock_basic_lock(&tp->lock);
890 tp->autr->query_failed = (uint8_t)parse_int(line+16, &r);
891 lock_basic_unlock(&tp->lock);
892 } else if(strncmp(line, ";;query_interval: ", 18) == 0) {
893 if(!tp) return -1;
894 lock_basic_lock(&tp->lock);
895 tp->autr->query_interval = (time_t)parse_int(line+18, &r);
896 lock_basic_unlock(&tp->lock);
897 } else if(strncmp(line, ";;retry_time: ", 14) == 0) {
898 if(!tp) return -1;
899 lock_basic_lock(&tp->lock);
900 tp->autr->retry_time = (time_t)parse_int(line+14, &r);
901 lock_basic_unlock(&tp->lock);
902 }
903 return r;
904 }
905
906 /** handle origin lines */
907 static int
handle_origin(char * line,uint8_t ** origin,size_t * origin_len)908 handle_origin(char* line, uint8_t** origin, size_t* origin_len)
909 {
910 size_t len = 0;
911 while(isspace((unsigned char)*line))
912 line++;
913 if(strncmp(line, "$ORIGIN", 7) != 0)
914 return 0;
915 free(*origin);
916 line += 7;
917 while(isspace((unsigned char)*line))
918 line++;
919 *origin = sldns_str2wire_dname(line, &len);
920 *origin_len = len;
921 if(!*origin)
922 log_warn("malloc failure or parse error in $ORIGIN");
923 return 1;
924 }
925
926 /** Read one line and put multiline RRs onto one line string */
927 static int
read_multiline(char * buf,size_t len,FILE * in,int * linenr)928 read_multiline(char* buf, size_t len, FILE* in, int* linenr)
929 {
930 char* pos = buf;
931 size_t left = len;
932 int depth = 0;
933 buf[len-1] = 0;
934 while(left > 0 && fgets(pos, (int)left, in) != NULL) {
935 size_t i, poslen = strlen(pos);
936 (*linenr)++;
937
938 /* check what the new depth is after the line */
939 /* this routine cannot handle braces inside quotes,
940 say for TXT records, but this routine only has to read keys */
941 for(i=0; i<poslen; i++) {
942 if(pos[i] == '(') {
943 depth++;
944 } else if(pos[i] == ')') {
945 if(depth == 0) {
946 log_err("mismatch: too many ')'");
947 return -1;
948 }
949 depth--;
950 } else if(pos[i] == ';') {
951 break;
952 }
953 }
954
955 /* normal oneline or last line: keeps newline and comments */
956 if(depth == 0) {
957 return 1;
958 }
959
960 /* more lines expected, snip off comments and newline */
961 if(poslen>0)
962 pos[poslen-1] = 0; /* strip newline */
963 if(strchr(pos, ';'))
964 strchr(pos, ';')[0] = 0; /* strip comments */
965
966 /* move to paste other lines behind this one */
967 poslen = strlen(pos);
968 pos += poslen;
969 left -= poslen;
970 /* the newline is changed into a space */
971 if(left <= 2 /* space and eos */) {
972 log_err("line too long");
973 return -1;
974 }
975 pos[0] = ' ';
976 pos[1] = 0;
977 pos += 1;
978 left -= 1;
979 }
980 if(depth != 0) {
981 log_err("mismatch: too many '('");
982 return -1;
983 }
984 if(pos != buf)
985 return 1;
986 return 0;
987 }
988
autr_read_file(struct val_anchors * anchors,const char * nm)989 int autr_read_file(struct val_anchors* anchors, const char* nm)
990 {
991 /* the file descriptor */
992 FILE* fd;
993 /* keep track of line numbers */
994 int line_nr = 0;
995 /* single line */
996 char line[10240];
997 /* trust point being read */
998 struct trust_anchor *tp = NULL, *tp2;
999 int r;
1000 /* for $ORIGIN parsing */
1001 uint8_t *origin=NULL, *prev=NULL;
1002 size_t origin_len=0, prev_len=0;
1003
1004 if (!(fd = fopen(nm, "r"))) {
1005 log_err("unable to open %s for reading: %s",
1006 nm, strerror(errno));
1007 return 0;
1008 }
1009 verbose(VERB_ALGO, "reading autotrust anchor file %s", nm);
1010 while ( (r=read_multiline(line, sizeof(line), fd, &line_nr)) != 0) {
1011 if(r == -1 || (r = parse_var_line(line, anchors, &tp)) == -1) {
1012 log_err("could not parse auto-trust-anchor-file "
1013 "%s line %d", nm, line_nr);
1014 fclose(fd);
1015 free(origin);
1016 free(prev);
1017 return 0;
1018 } else if(r == 1) {
1019 continue;
1020 } else if(r == 2) {
1021 log_warn("trust anchor %s has been revoked", nm);
1022 fclose(fd);
1023 free(origin);
1024 free(prev);
1025 return 1;
1026 }
1027 if (!str_contains_data(line, ';'))
1028 continue; /* empty lines allowed */
1029 if(handle_origin(line, &origin, &origin_len))
1030 continue;
1031 r = 0;
1032 if(!(tp2=load_trustanchor(anchors, line, nm, origin,
1033 origin_len, &prev, &prev_len, &r))) {
1034 if(!r) log_err("failed to load trust anchor from %s "
1035 "at line %i, skipping", nm, line_nr);
1036 /* try to do the rest */
1037 continue;
1038 }
1039 if(tp && tp != tp2) {
1040 log_err("file %s has mismatching data inside: "
1041 "the file may only contain keys for one name, "
1042 "remove keys for other domain names", nm);
1043 fclose(fd);
1044 free(origin);
1045 free(prev);
1046 return 0;
1047 }
1048 tp = tp2;
1049 }
1050 fclose(fd);
1051 free(origin);
1052 free(prev);
1053 if(!tp) {
1054 log_err("failed to read %s", nm);
1055 return 0;
1056 }
1057
1058 /* now assemble the data into DNSKEY and DS packed rrsets */
1059 lock_basic_lock(&tp->lock);
1060 if(!autr_assemble(tp)) {
1061 lock_basic_unlock(&tp->lock);
1062 log_err("malloc failure assembling %s", nm);
1063 return 0;
1064 }
1065 lock_basic_unlock(&tp->lock);
1066 return 1;
1067 }
1068
1069 /** string for a trustanchor state */
1070 static const char*
trustanchor_state2str(autr_state_type s)1071 trustanchor_state2str(autr_state_type s)
1072 {
1073 switch (s) {
1074 case AUTR_STATE_START: return " START ";
1075 case AUTR_STATE_ADDPEND: return " ADDPEND ";
1076 case AUTR_STATE_VALID: return " VALID ";
1077 case AUTR_STATE_MISSING: return " MISSING ";
1078 case AUTR_STATE_REVOKED: return " REVOKED ";
1079 case AUTR_STATE_REMOVED: return " REMOVED ";
1080 }
1081 return " UNKNOWN ";
1082 }
1083
1084 /** ctime r for autotrust */
autr_ctime_r(time_t * t,char * s)1085 static char* autr_ctime_r(time_t* t, char* s)
1086 {
1087 ctime_r(t, s);
1088 #ifdef USE_WINSOCK
1089 if(strlen(s) > 10 && s[7]==' ' && s[8]=='0')
1090 s[8]=' '; /* fix error in windows ctime */
1091 #endif
1092 return s;
1093 }
1094
1095 /** print ID to file */
1096 static int
print_id(FILE * out,char * fname,uint8_t * nm,size_t nmlen,uint16_t dclass)1097 print_id(FILE* out, char* fname, uint8_t* nm, size_t nmlen, uint16_t dclass)
1098 {
1099 char* s = sldns_wire2str_dname(nm, nmlen);
1100 if(!s) {
1101 log_err("malloc failure in write to %s", fname);
1102 return 0;
1103 }
1104 if(fprintf(out, ";;id: %s %d\n", s, (int)dclass) < 0) {
1105 log_err("could not write to %s: %s", fname, strerror(errno));
1106 free(s);
1107 return 0;
1108 }
1109 free(s);
1110 return 1;
1111 }
1112
1113 static int
autr_write_contents(FILE * out,char * fn,struct trust_anchor * tp)1114 autr_write_contents(FILE* out, char* fn, struct trust_anchor* tp)
1115 {
1116 char tmi[32];
1117 struct autr_ta* ta;
1118 char* str;
1119
1120 /* write pretty header */
1121 if(fprintf(out, "; autotrust trust anchor file\n") < 0) {
1122 log_err("could not write to %s: %s", fn, strerror(errno));
1123 return 0;
1124 }
1125 if(tp->autr->revoked) {
1126 if(fprintf(out, ";;REVOKED\n") < 0 ||
1127 fprintf(out, "; The zone has all keys revoked, and is\n"
1128 "; considered as if it has no trust anchors.\n"
1129 "; the remainder of the file is the last probe.\n"
1130 "; to restart the trust anchor, overwrite this file.\n"
1131 "; with one containing valid DNSKEYs or DSes.\n") < 0) {
1132 log_err("could not write to %s: %s", fn, strerror(errno));
1133 return 0;
1134 }
1135 }
1136 if(!print_id(out, fn, tp->name, tp->namelen, tp->dclass)) {
1137 return 0;
1138 }
1139 if(fprintf(out, ";;last_queried: %u ;;%s",
1140 (unsigned int)tp->autr->last_queried,
1141 autr_ctime_r(&(tp->autr->last_queried), tmi)) < 0 ||
1142 fprintf(out, ";;last_success: %u ;;%s",
1143 (unsigned int)tp->autr->last_success,
1144 autr_ctime_r(&(tp->autr->last_success), tmi)) < 0 ||
1145 fprintf(out, ";;next_probe_time: %u ;;%s",
1146 (unsigned int)tp->autr->next_probe_time,
1147 autr_ctime_r(&(tp->autr->next_probe_time), tmi)) < 0 ||
1148 fprintf(out, ";;query_failed: %d\n", (int)tp->autr->query_failed)<0
1149 || fprintf(out, ";;query_interval: %d\n",
1150 (int)tp->autr->query_interval) < 0 ||
1151 fprintf(out, ";;retry_time: %d\n", (int)tp->autr->retry_time) < 0) {
1152 log_err("could not write to %s: %s", fn, strerror(errno));
1153 return 0;
1154 }
1155
1156 /* write anchors */
1157 for(ta=tp->autr->keys; ta; ta=ta->next) {
1158 /* by default do not store START and REMOVED keys */
1159 if(ta->s == AUTR_STATE_START)
1160 continue;
1161 if(ta->s == AUTR_STATE_REMOVED)
1162 continue;
1163 /* only store keys */
1164 if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len)
1165 != LDNS_RR_TYPE_DNSKEY)
1166 continue;
1167 str = sldns_wire2str_rr(ta->rr, ta->rr_len);
1168 if(!str || !str[0]) {
1169 free(str);
1170 log_err("malloc failure writing %s", fn);
1171 return 0;
1172 }
1173 str[strlen(str)-1] = 0; /* remove newline */
1174 if(fprintf(out, "%s ;;state=%d [%s] ;;count=%d "
1175 ";;lastchange=%u ;;%s", str, (int)ta->s,
1176 trustanchor_state2str(ta->s), (int)ta->pending_count,
1177 (unsigned int)ta->last_change,
1178 autr_ctime_r(&(ta->last_change), tmi)) < 0) {
1179 log_err("could not write to %s: %s", fn, strerror(errno));
1180 free(str);
1181 return 0;
1182 }
1183 free(str);
1184 }
1185 return 1;
1186 }
1187
autr_write_file(struct module_env * env,struct trust_anchor * tp)1188 void autr_write_file(struct module_env* env, struct trust_anchor* tp)
1189 {
1190 FILE* out;
1191 char* fname = tp->autr->file;
1192 #ifndef S_SPLINT_S
1193 long long llvalue;
1194 #endif
1195 char tempf[2048];
1196 log_assert(tp->autr);
1197 if(!env) {
1198 log_err("autr_write_file: Module environment is NULL.");
1199 return;
1200 }
1201 /* unique name with pid number, thread number, and struct pointer
1202 * (the pointer uniquifies for multiple libunbound contexts) */
1203 #ifndef S_SPLINT_S
1204 #if defined(SIZE_MAX) && defined(UINT32_MAX) && (UINT32_MAX == SIZE_MAX || INT32_MAX == SIZE_MAX)
1205 /* avoid warning about upcast on 32bit systems */
1206 llvalue = (unsigned long)tp;
1207 #else
1208 llvalue = (unsigned long long)tp;
1209 #endif
1210 snprintf(tempf, sizeof(tempf), "%s.%d-%d-" ARG_LL "x", fname, (int)getpid(),
1211 env->worker?*(int*)env->worker:0, llvalue);
1212 #endif /* S_SPLINT_S */
1213 verbose(VERB_ALGO, "autotrust: write to disk: %s", tempf);
1214 out = fopen(tempf, "w");
1215 if(!out) {
1216 fatal_exit("could not open autotrust file for writing, %s: %s",
1217 tempf, strerror(errno));
1218 return;
1219 }
1220 if(!autr_write_contents(out, tempf, tp)) {
1221 /* failed to write contents (completely) */
1222 fclose(out);
1223 unlink(tempf);
1224 fatal_exit("could not completely write: %s", fname);
1225 return;
1226 }
1227 if(fflush(out) != 0)
1228 log_err("could not fflush(%s): %s", fname, strerror(errno));
1229 #ifdef HAVE_FSYNC
1230 if(fsync(fileno(out)) != 0)
1231 log_err("could not fsync(%s): %s", fname, strerror(errno));
1232 #else
1233 FlushFileBuffers((HANDLE)_get_osfhandle(_fileno(out)));
1234 #endif
1235 if(fclose(out) != 0) {
1236 fatal_exit("could not complete write: %s: %s",
1237 fname, strerror(errno));
1238 unlink(tempf);
1239 return;
1240 }
1241 /* success; overwrite actual file */
1242 verbose(VERB_ALGO, "autotrust: replaced %s", fname);
1243 #ifdef UB_ON_WINDOWS
1244 (void)unlink(fname); /* windows does not replace file with rename() */
1245 #endif
1246 if(rename(tempf, fname) < 0) {
1247 fatal_exit("rename(%s to %s): %s", tempf, fname, strerror(errno));
1248 }
1249 }
1250
1251 /**
1252 * Verify if dnskey works for trust point
1253 * @param env: environment (with time) for verification
1254 * @param ve: validator environment (with options) for verification.
1255 * @param tp: trust point to verify with
1256 * @param rrset: DNSKEY rrset to verify.
1257 * @param qstate: qstate with region.
1258 * @return false on failure, true if verification successful.
1259 */
1260 static int
verify_dnskey(struct module_env * env,struct val_env * ve,struct trust_anchor * tp,struct ub_packed_rrset_key * rrset,struct module_qstate * qstate)1261 verify_dnskey(struct module_env* env, struct val_env* ve,
1262 struct trust_anchor* tp, struct ub_packed_rrset_key* rrset,
1263 struct module_qstate* qstate)
1264 {
1265 char* reason = NULL;
1266 uint8_t sigalg[ALGO_NEEDS_MAX+1];
1267 int downprot = env->cfg->harden_algo_downgrade;
1268 enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve, rrset,
1269 tp->ds_rrset, tp->dnskey_rrset, downprot?sigalg:NULL, &reason,
1270 NULL, qstate);
1271 /* sigalg is ignored, it returns algorithms signalled to exist, but
1272 * in 5011 there are no other rrsets to check. if downprot is
1273 * enabled, then it checks that the DNSKEY is signed with all
1274 * algorithms available in the trust store. */
1275 verbose(VERB_ALGO, "autotrust: validate DNSKEY with anchor: %s",
1276 sec_status_to_string(sec));
1277 return sec == sec_status_secure;
1278 }
1279
1280 static int32_t
rrsig_get_expiry(uint8_t * d,size_t len)1281 rrsig_get_expiry(uint8_t* d, size_t len)
1282 {
1283 /* rrsig: 2(rdlen), 2(type) 1(alg) 1(v) 4(origttl), then 4(expi), (4)incep) */
1284 if(len < 2+8+4)
1285 return 0;
1286 return sldns_read_uint32(d+2+8);
1287 }
1288
1289 /** Find minimum expiration interval from signatures */
1290 static time_t
min_expiry(struct module_env * env,struct packed_rrset_data * dd)1291 min_expiry(struct module_env* env, struct packed_rrset_data* dd)
1292 {
1293 size_t i;
1294 int32_t t, r = 15 * 24 * 3600; /* 15 days max */
1295 for(i=dd->count; i<dd->count+dd->rrsig_count; i++) {
1296 t = rrsig_get_expiry(dd->rr_data[i], dd->rr_len[i]);
1297 if((int32_t)t - (int32_t)*env->now > 0) {
1298 t -= (int32_t)*env->now;
1299 if(t < r)
1300 r = t;
1301 }
1302 }
1303 return (time_t)r;
1304 }
1305
1306 /** Is rr self-signed revoked key */
1307 static int
rr_is_selfsigned_revoked(struct module_env * env,struct val_env * ve,struct ub_packed_rrset_key * dnskey_rrset,size_t i,struct module_qstate * qstate)1308 rr_is_selfsigned_revoked(struct module_env* env, struct val_env* ve,
1309 struct ub_packed_rrset_key* dnskey_rrset, size_t i,
1310 struct module_qstate* qstate)
1311 {
1312 enum sec_status sec;
1313 char* reason = NULL;
1314 verbose(VERB_ALGO, "seen REVOKE flag, check self-signed, rr %d",
1315 (int)i);
1316 /* no algorithm downgrade protection necessary, if it is selfsigned
1317 * revoked it can be removed. */
1318 sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset, i,
1319 &reason, NULL, LDNS_SECTION_ANSWER, qstate);
1320 return (sec == sec_status_secure);
1321 }
1322
1323 /** Set fetched value */
1324 static void
seen_trustanchor(struct autr_ta * ta,uint8_t seen)1325 seen_trustanchor(struct autr_ta* ta, uint8_t seen)
1326 {
1327 ta->fetched = seen;
1328 if(ta->pending_count < 250) /* no numerical overflow, please */
1329 ta->pending_count++;
1330 }
1331
1332 /** set revoked value */
1333 static void
seen_revoked_trustanchor(struct autr_ta * ta,uint8_t revoked)1334 seen_revoked_trustanchor(struct autr_ta* ta, uint8_t revoked)
1335 {
1336 ta->revoked = revoked;
1337 }
1338
1339 /** revoke a trust anchor */
1340 static void
revoke_dnskey(struct autr_ta * ta,int off)1341 revoke_dnskey(struct autr_ta* ta, int off)
1342 {
1343 uint16_t flags;
1344 uint8_t* data;
1345 if(sldns_wirerr_get_type(ta->rr, ta->rr_len, ta->dname_len) !=
1346 LDNS_RR_TYPE_DNSKEY)
1347 return;
1348 if(sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len, ta->dname_len) < 2)
1349 return;
1350 data = sldns_wirerr_get_rdata(ta->rr, ta->rr_len, ta->dname_len);
1351 flags = sldns_read_uint16(data);
1352 if (off && (flags&LDNS_KEY_REVOKE_KEY))
1353 flags ^= LDNS_KEY_REVOKE_KEY; /* flip */
1354 else
1355 flags |= LDNS_KEY_REVOKE_KEY;
1356 sldns_write_uint16(data, flags);
1357 }
1358
1359 /** Compare two RRs skipping the REVOKED bit. Pass rdata(no len) */
1360 static int
dnskey_compare_skip_revbit(uint8_t * a,size_t a_len,uint8_t * b,size_t b_len)1361 dnskey_compare_skip_revbit(uint8_t* a, size_t a_len, uint8_t* b, size_t b_len)
1362 {
1363 size_t i;
1364 if(a_len != b_len)
1365 return -1;
1366 /* compare RRs RDATA byte for byte. */
1367 for(i = 0; i < a_len; i++)
1368 {
1369 uint8_t rdf1, rdf2;
1370 rdf1 = a[i];
1371 rdf2 = b[i];
1372 if(i==1) {
1373 /* this is the second part of the flags field */
1374 rdf1 |= LDNS_KEY_REVOKE_KEY;
1375 rdf2 |= LDNS_KEY_REVOKE_KEY;
1376 }
1377 if (rdf1 < rdf2) return -1;
1378 else if (rdf1 > rdf2) return 1;
1379 }
1380 return 0;
1381 }
1382
1383
1384 /** compare trust anchor with rdata, 0 if equal. Pass rdata(no len) */
1385 static int
ta_compare(struct autr_ta * a,uint16_t t,uint8_t * b,size_t b_len)1386 ta_compare(struct autr_ta* a, uint16_t t, uint8_t* b, size_t b_len)
1387 {
1388 if(!a) return -1;
1389 else if(!b) return -1;
1390 else if(sldns_wirerr_get_type(a->rr, a->rr_len, a->dname_len) != t)
1391 return (int)sldns_wirerr_get_type(a->rr, a->rr_len,
1392 a->dname_len) - (int)t;
1393 else if(t == LDNS_RR_TYPE_DNSKEY) {
1394 return dnskey_compare_skip_revbit(
1395 sldns_wirerr_get_rdata(a->rr, a->rr_len, a->dname_len),
1396 sldns_wirerr_get_rdatalen(a->rr, a->rr_len,
1397 a->dname_len), b, b_len);
1398 }
1399 else if(t == LDNS_RR_TYPE_DS) {
1400 if(sldns_wirerr_get_rdatalen(a->rr, a->rr_len, a->dname_len) !=
1401 b_len)
1402 return -1;
1403 return memcmp(sldns_wirerr_get_rdata(a->rr,
1404 a->rr_len, a->dname_len), b, b_len);
1405 }
1406 return -1;
1407 }
1408
1409 /**
1410 * Find key
1411 * @param tp: to search in
1412 * @param t: rr type of the rdata.
1413 * @param rdata: to look for (no rdatalen in it)
1414 * @param rdata_len: length of rdata
1415 * @param result: returns NULL or the ta key looked for.
1416 * @return false on malloc failure during search. if true examine result.
1417 */
1418 static int
find_key(struct trust_anchor * tp,uint16_t t,uint8_t * rdata,size_t rdata_len,struct autr_ta ** result)1419 find_key(struct trust_anchor* tp, uint16_t t, uint8_t* rdata, size_t rdata_len,
1420 struct autr_ta** result)
1421 {
1422 struct autr_ta* ta;
1423 if(!tp || !rdata) {
1424 *result = NULL;
1425 return 0;
1426 }
1427 for(ta=tp->autr->keys; ta; ta=ta->next) {
1428 if(ta_compare(ta, t, rdata, rdata_len) == 0) {
1429 *result = ta;
1430 return 1;
1431 }
1432 }
1433 *result = NULL;
1434 return 1;
1435 }
1436
1437 /** add key and clone RR and tp already locked. rdata without rdlen. */
1438 static struct autr_ta*
add_key(struct trust_anchor * tp,uint32_t ttl,uint8_t * rdata,size_t rdata_len)1439 add_key(struct trust_anchor* tp, uint32_t ttl, uint8_t* rdata, size_t rdata_len)
1440 {
1441 struct autr_ta* ta;
1442 uint8_t* rr;
1443 size_t rr_len, dname_len;
1444 uint16_t rrtype = htons(LDNS_RR_TYPE_DNSKEY);
1445 uint16_t rrclass = htons(LDNS_RR_CLASS_IN);
1446 uint16_t rdlen = htons(rdata_len);
1447 dname_len = tp->namelen;
1448 ttl = htonl(ttl);
1449 rr_len = dname_len + 10 /* type,class,ttl,rdatalen */ + rdata_len;
1450 rr = (uint8_t*)malloc(rr_len);
1451 if(!rr) return NULL;
1452 memmove(rr, tp->name, tp->namelen);
1453 memmove(rr+dname_len, &rrtype, 2);
1454 memmove(rr+dname_len+2, &rrclass, 2);
1455 memmove(rr+dname_len+4, &ttl, 4);
1456 memmove(rr+dname_len+8, &rdlen, 2);
1457 memmove(rr+dname_len+10, rdata, rdata_len);
1458 ta = autr_ta_create(rr, rr_len, dname_len);
1459 if(!ta) {
1460 /* rr freed in autr_ta_create */
1461 return NULL;
1462 }
1463 /* link in, tp already locked */
1464 ta->next = tp->autr->keys;
1465 tp->autr->keys = ta;
1466 return ta;
1467 }
1468
1469 /** get TTL from DNSKEY rrset */
1470 static time_t
key_ttl(struct ub_packed_rrset_key * k)1471 key_ttl(struct ub_packed_rrset_key* k)
1472 {
1473 struct packed_rrset_data* d = (struct packed_rrset_data*)k->entry.data;
1474 return d->ttl;
1475 }
1476
1477 /** update the time values for the trustpoint */
1478 static void
set_tp_times(struct trust_anchor * tp,time_t rrsig_exp_interval,time_t origttl,int * changed)1479 set_tp_times(struct trust_anchor* tp, time_t rrsig_exp_interval,
1480 time_t origttl, int* changed)
1481 {
1482 time_t x, qi = tp->autr->query_interval, rt = tp->autr->retry_time;
1483
1484 /* x = MIN(15days, ttl/2, expire/2) */
1485 x = 15 * 24 * 3600;
1486 if(origttl/2 < x)
1487 x = origttl/2;
1488 if(rrsig_exp_interval/2 < x)
1489 x = rrsig_exp_interval/2;
1490 /* MAX(1hr, x) */
1491 if(!autr_permit_small_holddown) {
1492 if(x < 3600)
1493 tp->autr->query_interval = 3600;
1494 else tp->autr->query_interval = x;
1495 } else tp->autr->query_interval = x;
1496
1497 /* x= MIN(1day, ttl/10, expire/10) */
1498 x = 24 * 3600;
1499 if(origttl/10 < x)
1500 x = origttl/10;
1501 if(rrsig_exp_interval/10 < x)
1502 x = rrsig_exp_interval/10;
1503 /* MAX(1hr, x) */
1504 if(!autr_permit_small_holddown) {
1505 if(x < 3600)
1506 tp->autr->retry_time = 3600;
1507 else tp->autr->retry_time = x;
1508 } else tp->autr->retry_time = x;
1509
1510 if(qi != tp->autr->query_interval || rt != tp->autr->retry_time) {
1511 *changed = 1;
1512 verbose(VERB_ALGO, "orig_ttl is %d", (int)origttl);
1513 verbose(VERB_ALGO, "rrsig_exp_interval is %d",
1514 (int)rrsig_exp_interval);
1515 verbose(VERB_ALGO, "query_interval: %d, retry_time: %d",
1516 (int)tp->autr->query_interval,
1517 (int)tp->autr->retry_time);
1518 }
1519 }
1520
1521 /** init events to zero */
1522 static void
init_events(struct trust_anchor * tp)1523 init_events(struct trust_anchor* tp)
1524 {
1525 struct autr_ta* ta;
1526 for(ta=tp->autr->keys; ta; ta=ta->next) {
1527 ta->fetched = 0;
1528 }
1529 }
1530
1531 /** check for revoked keys without trusting any other information */
1532 static void
check_contains_revoked(struct module_env * env,struct val_env * ve,struct trust_anchor * tp,struct ub_packed_rrset_key * dnskey_rrset,int * changed,struct module_qstate * qstate)1533 check_contains_revoked(struct module_env* env, struct val_env* ve,
1534 struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1535 int* changed, struct module_qstate* qstate)
1536 {
1537 struct packed_rrset_data* dd = (struct packed_rrset_data*)
1538 dnskey_rrset->entry.data;
1539 size_t i;
1540 log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1541 for(i=0; i<dd->count; i++) {
1542 struct autr_ta* ta = NULL;
1543 if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1544 dd->rr_data[i]+2, dd->rr_len[i]-2) ||
1545 !rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1546 dd->rr_data[i]+2, dd->rr_len[i]-2))
1547 continue; /* not a revoked KSK */
1548 if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1549 dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1550 log_err("malloc failure");
1551 continue; /* malloc fail in compare*/
1552 }
1553 if(!ta)
1554 continue; /* key not found */
1555 if(rr_is_selfsigned_revoked(env, ve, dnskey_rrset, i, qstate)) {
1556 /* checked if there is an rrsig signed by this key. */
1557 /* same keytag, but stored can be revoked already, so
1558 * compare keytags, with +0 or +128(REVOKE flag) */
1559 log_assert(dnskey_calc_keytag(dnskey_rrset, i)-128 ==
1560 sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1561 ta->rr, ta->rr_len, ta->dname_len),
1562 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1563 ta->dname_len)) ||
1564 dnskey_calc_keytag(dnskey_rrset, i) ==
1565 sldns_calc_keytag_raw(sldns_wirerr_get_rdata(
1566 ta->rr, ta->rr_len, ta->dname_len),
1567 sldns_wirerr_get_rdatalen(ta->rr, ta->rr_len,
1568 ta->dname_len))); /* checks conversion*/
1569 verbose_key(ta, VERB_ALGO, "is self-signed revoked");
1570 if(!ta->revoked)
1571 *changed = 1;
1572 seen_revoked_trustanchor(ta, 1);
1573 do_revoked(env, ta, changed);
1574 }
1575 }
1576 }
1577
1578 /** See if a DNSKEY is verified by one of the DSes */
1579 static int
key_matches_a_ds(struct module_env * env,struct val_env * ve,struct ub_packed_rrset_key * dnskey_rrset,size_t key_idx,struct ub_packed_rrset_key * ds_rrset)1580 key_matches_a_ds(struct module_env* env, struct val_env* ve,
1581 struct ub_packed_rrset_key* dnskey_rrset, size_t key_idx,
1582 struct ub_packed_rrset_key* ds_rrset)
1583 {
1584 struct packed_rrset_data* dd = (struct packed_rrset_data*)
1585 ds_rrset->entry.data;
1586 size_t ds_idx, num = dd->count;
1587 int d = val_favorite_ds_algo(ds_rrset);
1588 char* reason = "";
1589 for(ds_idx=0; ds_idx<num; ds_idx++) {
1590 if(!ds_digest_algo_is_supported(ds_rrset, ds_idx) ||
1591 !ds_key_algo_is_supported(ds_rrset, ds_idx) ||
1592 !dnskey_size_is_supported(dnskey_rrset, key_idx) ||
1593 ds_get_digest_algo(ds_rrset, ds_idx) != d)
1594 continue;
1595 if(ds_get_key_algo(ds_rrset, ds_idx)
1596 != dnskey_get_algo(dnskey_rrset, key_idx)
1597 || dnskey_calc_keytag(dnskey_rrset, key_idx)
1598 != ds_get_keytag(ds_rrset, ds_idx)) {
1599 continue;
1600 }
1601 if(!ds_digest_match_dnskey(env, dnskey_rrset, key_idx,
1602 ds_rrset, ds_idx)) {
1603 verbose(VERB_ALGO, "DS match attempt failed");
1604 continue;
1605 }
1606 /* match of hash is sufficient for bootstrap of trust point */
1607 (void)reason;
1608 (void)ve;
1609 return 1;
1610 /* no need to check RRSIG, DS hash already matched with source
1611 if(dnskey_verify_rrset(env, ve, dnskey_rrset,
1612 dnskey_rrset, key_idx, &reason) == sec_status_secure) {
1613 return 1;
1614 } else {
1615 verbose(VERB_ALGO, "DS match failed because the key "
1616 "does not verify the keyset: %s", reason);
1617 }
1618 */
1619 }
1620 return 0;
1621 }
1622
1623 /** Set update events */
1624 static int
update_events(struct module_env * env,struct val_env * ve,struct trust_anchor * tp,struct ub_packed_rrset_key * dnskey_rrset,int * changed)1625 update_events(struct module_env* env, struct val_env* ve,
1626 struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
1627 int* changed)
1628 {
1629 struct packed_rrset_data* dd = (struct packed_rrset_data*)
1630 dnskey_rrset->entry.data;
1631 size_t i;
1632 log_assert(ntohs(dnskey_rrset->rk.type) == LDNS_RR_TYPE_DNSKEY);
1633 init_events(tp);
1634 for(i=0; i<dd->count; i++) {
1635 struct autr_ta* ta = NULL;
1636 if(!rr_is_dnskey_sep(ntohs(dnskey_rrset->rk.type),
1637 dd->rr_data[i]+2, dd->rr_len[i]-2))
1638 continue;
1639 if(rr_is_dnskey_revoked(ntohs(dnskey_rrset->rk.type),
1640 dd->rr_data[i]+2, dd->rr_len[i]-2)) {
1641 /* self-signed revoked keys already detected before,
1642 * other revoked keys are not 'added' again */
1643 continue;
1644 }
1645 /* is a key of this type supported?. Note rr_list and
1646 * packed_rrset are in the same order. */
1647 if(!dnskey_algo_is_supported(dnskey_rrset, i) ||
1648 !dnskey_size_is_supported(dnskey_rrset, i)) {
1649 /* skip unknown algorithm key, it is useless to us */
1650 log_nametypeclass(VERB_DETAIL, "trust point has "
1651 "unsupported algorithm at",
1652 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
1653 continue;
1654 }
1655
1656 /* is it new? if revocation bit set, find the unrevoked key */
1657 if(!find_key(tp, ntohs(dnskey_rrset->rk.type),
1658 dd->rr_data[i]+2, dd->rr_len[i]-2, &ta)) {
1659 return 0;
1660 }
1661 if(!ta) {
1662 ta = add_key(tp, (uint32_t)dd->rr_ttl[i],
1663 dd->rr_data[i]+2, dd->rr_len[i]-2);
1664 *changed = 1;
1665 /* first time seen, do we have DSes? if match: VALID */
1666 if(ta && tp->ds_rrset && key_matches_a_ds(env, ve,
1667 dnskey_rrset, i, tp->ds_rrset)) {
1668 verbose_key(ta, VERB_ALGO, "verified by DS");
1669 ta->s = AUTR_STATE_VALID;
1670 }
1671 }
1672 if(!ta) {
1673 return 0;
1674 }
1675 seen_trustanchor(ta, 1);
1676 verbose_key(ta, VERB_ALGO, "in DNS response");
1677 }
1678 set_tp_times(tp, min_expiry(env, dd), key_ttl(dnskey_rrset), changed);
1679 return 1;
1680 }
1681
1682 /**
1683 * Check if the holddown time has already exceeded
1684 * setting: add-holddown: add holddown timer
1685 * setting: del-holddown: del holddown timer
1686 * @param env: environment with current time
1687 * @param ta: trust anchor to check for.
1688 * @param holddown: the timer value
1689 * @return number of seconds the holddown has passed.
1690 */
1691 static time_t
check_holddown(struct module_env * env,struct autr_ta * ta,unsigned int holddown)1692 check_holddown(struct module_env* env, struct autr_ta* ta,
1693 unsigned int holddown)
1694 {
1695 time_t elapsed;
1696 if(*env->now < ta->last_change) {
1697 log_warn("time goes backwards. delaying key holddown");
1698 return 0;
1699 }
1700 elapsed = *env->now - ta->last_change;
1701 if (elapsed > (time_t)holddown) {
1702 return elapsed-(time_t)holddown;
1703 }
1704 verbose_key(ta, VERB_ALGO, "holddown time " ARG_LL "d seconds to go",
1705 (long long) ((time_t)holddown-elapsed));
1706 return 0;
1707 }
1708
1709
1710 /** Set last_change to now */
1711 static void
reset_holddown(struct module_env * env,struct autr_ta * ta,int * changed)1712 reset_holddown(struct module_env* env, struct autr_ta* ta, int* changed)
1713 {
1714 ta->last_change = *env->now;
1715 *changed = 1;
1716 }
1717
1718 /** Set the state for this trust anchor */
1719 static void
set_trustanchor_state(struct module_env * env,struct autr_ta * ta,int * changed,autr_state_type s)1720 set_trustanchor_state(struct module_env* env, struct autr_ta* ta, int* changed,
1721 autr_state_type s)
1722 {
1723 verbose_key(ta, VERB_ALGO, "update: %s to %s",
1724 trustanchor_state2str(ta->s), trustanchor_state2str(s));
1725 ta->s = s;
1726 reset_holddown(env, ta, changed);
1727 }
1728
1729
1730 /** Event: NewKey */
1731 static void
do_newkey(struct module_env * env,struct autr_ta * anchor,int * c)1732 do_newkey(struct module_env* env, struct autr_ta* anchor, int* c)
1733 {
1734 if (anchor->s == AUTR_STATE_START)
1735 set_trustanchor_state(env, anchor, c, AUTR_STATE_ADDPEND);
1736 }
1737
1738 /** Event: AddTime */
1739 static void
do_addtime(struct module_env * env,struct autr_ta * anchor,int * c)1740 do_addtime(struct module_env* env, struct autr_ta* anchor, int* c)
1741 {
1742 /* This not according to RFC, this is 30 days, but the RFC demands
1743 * MAX(30days, TTL expire time of first DNSKEY set with this key),
1744 * The value may be too small if a very large TTL was used. */
1745 time_t exceeded = check_holddown(env, anchor, env->cfg->add_holddown);
1746 if (exceeded && anchor->s == AUTR_STATE_ADDPEND) {
1747 verbose_key(anchor, VERB_ALGO, "add-holddown time exceeded "
1748 ARG_LL "d seconds ago, and pending-count %d",
1749 (long long)exceeded, anchor->pending_count);
1750 if(anchor->pending_count >= MIN_PENDINGCOUNT) {
1751 set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1752 anchor->pending_count = 0;
1753 return;
1754 }
1755 verbose_key(anchor, VERB_ALGO, "add-holddown time sanity check "
1756 "failed (pending count: %d)", anchor->pending_count);
1757 }
1758 }
1759
1760 /** Event: RemTime */
1761 static void
do_remtime(struct module_env * env,struct autr_ta * anchor,int * c)1762 do_remtime(struct module_env* env, struct autr_ta* anchor, int* c)
1763 {
1764 time_t exceeded = check_holddown(env, anchor, env->cfg->del_holddown);
1765 if(exceeded && anchor->s == AUTR_STATE_REVOKED) {
1766 verbose_key(anchor, VERB_ALGO, "del-holddown time exceeded "
1767 ARG_LL "d seconds ago", (long long)exceeded);
1768 set_trustanchor_state(env, anchor, c, AUTR_STATE_REMOVED);
1769 }
1770 }
1771
1772 /** Event: KeyRem */
1773 static void
do_keyrem(struct module_env * env,struct autr_ta * anchor,int * c)1774 do_keyrem(struct module_env* env, struct autr_ta* anchor, int* c)
1775 {
1776 if(anchor->s == AUTR_STATE_ADDPEND) {
1777 set_trustanchor_state(env, anchor, c, AUTR_STATE_START);
1778 anchor->pending_count = 0;
1779 } else if(anchor->s == AUTR_STATE_VALID)
1780 set_trustanchor_state(env, anchor, c, AUTR_STATE_MISSING);
1781 }
1782
1783 /** Event: KeyPres */
1784 static void
do_keypres(struct module_env * env,struct autr_ta * anchor,int * c)1785 do_keypres(struct module_env* env, struct autr_ta* anchor, int* c)
1786 {
1787 if(anchor->s == AUTR_STATE_MISSING)
1788 set_trustanchor_state(env, anchor, c, AUTR_STATE_VALID);
1789 }
1790
1791 /* Event: Revoked */
1792 static void
do_revoked(struct module_env * env,struct autr_ta * anchor,int * c)1793 do_revoked(struct module_env* env, struct autr_ta* anchor, int* c)
1794 {
1795 if(anchor->s == AUTR_STATE_VALID || anchor->s == AUTR_STATE_MISSING) {
1796 set_trustanchor_state(env, anchor, c, AUTR_STATE_REVOKED);
1797 verbose_key(anchor, VERB_ALGO, "old id, prior to revocation");
1798 revoke_dnskey(anchor, 0);
1799 verbose_key(anchor, VERB_ALGO, "new id, after revocation");
1800 }
1801 }
1802
1803 /** Do statestable transition matrix for anchor */
1804 static void
anchor_state_update(struct module_env * env,struct autr_ta * anchor,int * c)1805 anchor_state_update(struct module_env* env, struct autr_ta* anchor, int* c)
1806 {
1807 log_assert(anchor);
1808 switch(anchor->s) {
1809 /* START */
1810 case AUTR_STATE_START:
1811 /* NewKey: ADDPEND */
1812 if (anchor->fetched)
1813 do_newkey(env, anchor, c);
1814 break;
1815 /* ADDPEND */
1816 case AUTR_STATE_ADDPEND:
1817 /* KeyRem: START */
1818 if (!anchor->fetched)
1819 do_keyrem(env, anchor, c);
1820 /* AddTime: VALID */
1821 else do_addtime(env, anchor, c);
1822 break;
1823 /* VALID */
1824 case AUTR_STATE_VALID:
1825 /* RevBit: REVOKED */
1826 if (anchor->revoked)
1827 do_revoked(env, anchor, c);
1828 /* KeyRem: MISSING */
1829 else if (!anchor->fetched)
1830 do_keyrem(env, anchor, c);
1831 else if(!anchor->last_change) {
1832 verbose_key(anchor, VERB_ALGO, "first seen");
1833 reset_holddown(env, anchor, c);
1834 }
1835 break;
1836 /* MISSING */
1837 case AUTR_STATE_MISSING:
1838 /* RevBit: REVOKED */
1839 if (anchor->revoked)
1840 do_revoked(env, anchor, c);
1841 /* KeyPres */
1842 else if (anchor->fetched)
1843 do_keypres(env, anchor, c);
1844 break;
1845 /* REVOKED */
1846 case AUTR_STATE_REVOKED:
1847 if (anchor->fetched)
1848 reset_holddown(env, anchor, c);
1849 /* RemTime: REMOVED */
1850 else do_remtime(env, anchor, c);
1851 break;
1852 /* REMOVED */
1853 case AUTR_STATE_REMOVED:
1854 default:
1855 break;
1856 }
1857 }
1858
1859 /** if ZSK init then trust KSKs */
1860 static int
init_zsk_to_ksk(struct module_env * env,struct trust_anchor * tp,int * changed)1861 init_zsk_to_ksk(struct module_env* env, struct trust_anchor* tp, int* changed)
1862 {
1863 /* search for VALID ZSKs */
1864 struct autr_ta* anchor;
1865 int validzsk = 0;
1866 int validksk = 0;
1867 for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1868 /* last_change test makes sure it was manually configured */
1869 if(sldns_wirerr_get_type(anchor->rr, anchor->rr_len,
1870 anchor->dname_len) == LDNS_RR_TYPE_DNSKEY &&
1871 anchor->last_change == 0 &&
1872 !ta_is_dnskey_sep(anchor) &&
1873 anchor->s == AUTR_STATE_VALID)
1874 validzsk++;
1875 }
1876 if(validzsk == 0)
1877 return 0;
1878 for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1879 if (ta_is_dnskey_sep(anchor) &&
1880 anchor->s == AUTR_STATE_ADDPEND) {
1881 verbose_key(anchor, VERB_ALGO, "trust KSK from "
1882 "ZSK(config)");
1883 set_trustanchor_state(env, anchor, changed,
1884 AUTR_STATE_VALID);
1885 validksk++;
1886 }
1887 }
1888 return validksk;
1889 }
1890
1891 /** Remove missing trustanchors so the list does not grow forever */
1892 static void
remove_missing_trustanchors(struct module_env * env,struct trust_anchor * tp,int * changed)1893 remove_missing_trustanchors(struct module_env* env, struct trust_anchor* tp,
1894 int* changed)
1895 {
1896 struct autr_ta* anchor;
1897 time_t exceeded;
1898 int valid = 0;
1899 /* see if we have anchors that are valid */
1900 for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1901 /* Only do KSKs */
1902 if (!ta_is_dnskey_sep(anchor))
1903 continue;
1904 if (anchor->s == AUTR_STATE_VALID)
1905 valid++;
1906 }
1907 /* if there are no SEP Valid anchors, see if we started out with
1908 * a ZSK (last-change=0) anchor, which is VALID and there are KSKs
1909 * now that can be made valid. Do this immediately because there
1910 * is no guarantee that the ZSKs get announced long enough. Usually
1911 * this is immediately after init with a ZSK trusted, unless the domain
1912 * was not advertising any KSKs at all. In which case we perfectly
1913 * track the zero number of KSKs. */
1914 if(valid == 0) {
1915 valid = init_zsk_to_ksk(env, tp, changed);
1916 if(valid == 0)
1917 return;
1918 }
1919
1920 for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1921 /* ignore ZSKs if newly added */
1922 if(anchor->s == AUTR_STATE_START)
1923 continue;
1924 /* remove ZSKs if a KSK is present */
1925 if (!ta_is_dnskey_sep(anchor)) {
1926 if(valid > 0) {
1927 verbose_key(anchor, VERB_ALGO, "remove ZSK "
1928 "[%d key(s) VALID]", valid);
1929 set_trustanchor_state(env, anchor, changed,
1930 AUTR_STATE_REMOVED);
1931 }
1932 continue;
1933 }
1934 /* Only do MISSING keys */
1935 if (anchor->s != AUTR_STATE_MISSING)
1936 continue;
1937 if(env->cfg->keep_missing == 0)
1938 continue; /* keep forever */
1939
1940 exceeded = check_holddown(env, anchor, env->cfg->keep_missing);
1941 /* If keep_missing has exceeded and we still have more than
1942 * one valid KSK: remove missing trust anchor */
1943 if (exceeded && valid > 0) {
1944 verbose_key(anchor, VERB_ALGO, "keep-missing time "
1945 "exceeded " ARG_LL "d seconds ago, [%d key(s) VALID]",
1946 (long long)exceeded, valid);
1947 set_trustanchor_state(env, anchor, changed,
1948 AUTR_STATE_REMOVED);
1949 }
1950 }
1951 }
1952
1953 /** Do the statetable from RFC5011 transition matrix */
1954 static int
do_statetable(struct module_env * env,struct trust_anchor * tp,int * changed)1955 do_statetable(struct module_env* env, struct trust_anchor* tp, int* changed)
1956 {
1957 struct autr_ta* anchor;
1958 for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1959 /* Only do KSKs */
1960 if(!ta_is_dnskey_sep(anchor))
1961 continue;
1962 anchor_state_update(env, anchor, changed);
1963 }
1964 remove_missing_trustanchors(env, tp, changed);
1965 return 1;
1966 }
1967
1968 /** See if time alone makes ADDPEND to VALID transition */
1969 static void
autr_holddown_exceed(struct module_env * env,struct trust_anchor * tp,int * c)1970 autr_holddown_exceed(struct module_env* env, struct trust_anchor* tp, int* c)
1971 {
1972 struct autr_ta* anchor;
1973 for(anchor = tp->autr->keys; anchor; anchor = anchor->next) {
1974 if(ta_is_dnskey_sep(anchor) &&
1975 anchor->s == AUTR_STATE_ADDPEND)
1976 do_addtime(env, anchor, c);
1977 }
1978 }
1979
1980 /** cleanup key list */
1981 static void
autr_cleanup_keys(struct trust_anchor * tp)1982 autr_cleanup_keys(struct trust_anchor* tp)
1983 {
1984 struct autr_ta* p, **prevp;
1985 prevp = &tp->autr->keys;
1986 p = tp->autr->keys;
1987 while(p) {
1988 /* do we want to remove this key? */
1989 if(p->s == AUTR_STATE_START || p->s == AUTR_STATE_REMOVED ||
1990 sldns_wirerr_get_type(p->rr, p->rr_len, p->dname_len)
1991 != LDNS_RR_TYPE_DNSKEY) {
1992 struct autr_ta* np = p->next;
1993 /* remove */
1994 free(p->rr);
1995 free(p);
1996 /* snip and go to next item */
1997 *prevp = np;
1998 p = np;
1999 continue;
2000 }
2001 /* remove pending counts if no longer pending */
2002 if(p->s != AUTR_STATE_ADDPEND)
2003 p->pending_count = 0;
2004 prevp = &p->next;
2005 p = p->next;
2006 }
2007 }
2008
2009 /** calculate next probe time */
2010 static time_t
calc_next_probe(struct module_env * env,time_t wait)2011 calc_next_probe(struct module_env* env, time_t wait)
2012 {
2013 /* make it random, 90-100% */
2014 time_t rnd, rest;
2015 if(!autr_permit_small_holddown) {
2016 if(wait < 3600)
2017 wait = 3600;
2018 } else {
2019 if(wait == 0) wait = 1;
2020 }
2021 rnd = wait/10;
2022 rest = wait-rnd;
2023 rnd = (time_t)ub_random_max(env->rnd, (long int)rnd);
2024 return (time_t)(*env->now + rest + rnd);
2025 }
2026
2027 /** what is first probe time (anchors must be locked) */
2028 static time_t
wait_probe_time(struct val_anchors * anchors)2029 wait_probe_time(struct val_anchors* anchors)
2030 {
2031 rbnode_type* t = rbtree_first(&anchors->autr->probe);
2032 if(t != RBTREE_NULL)
2033 return ((struct trust_anchor*)t->key)->autr->next_probe_time;
2034 return 0;
2035 }
2036
2037 /** reset worker timer */
2038 static void
reset_worker_timer(struct module_env * env)2039 reset_worker_timer(struct module_env* env)
2040 {
2041 struct timeval tv;
2042 #ifndef S_SPLINT_S
2043 time_t next = (time_t)wait_probe_time(env->anchors);
2044 /* in case this is libunbound, no timer */
2045 if(!env->probe_timer)
2046 return;
2047 if(next > *env->now)
2048 tv.tv_sec = (time_t)(next - *env->now);
2049 else tv.tv_sec = 0;
2050 #endif
2051 tv.tv_usec = 0;
2052 comm_timer_set(env->probe_timer, &tv);
2053 verbose(VERB_ALGO, "scheduled next probe in " ARG_LL "d sec", (long long)tv.tv_sec);
2054 }
2055
2056 /** set next probe for trust anchor */
2057 static int
set_next_probe(struct module_env * env,struct trust_anchor * tp,struct ub_packed_rrset_key * dnskey_rrset)2058 set_next_probe(struct module_env* env, struct trust_anchor* tp,
2059 struct ub_packed_rrset_key* dnskey_rrset)
2060 {
2061 struct trust_anchor key, *tp2;
2062 time_t mold, mnew;
2063 /* use memory allocated in rrset for temporary name storage */
2064 key.node.key = &key;
2065 key.name = dnskey_rrset->rk.dname;
2066 key.namelen = dnskey_rrset->rk.dname_len;
2067 key.namelabs = dname_count_labels(key.name);
2068 key.dclass = tp->dclass;
2069 lock_basic_unlock(&tp->lock);
2070
2071 /* fetch tp again and lock anchors, so that we can modify the trees */
2072 lock_basic_lock(&env->anchors->lock);
2073 tp2 = (struct trust_anchor*)rbtree_search(env->anchors->tree, &key);
2074 if(!tp2) {
2075 verbose(VERB_ALGO, "trustpoint was deleted in set_next_probe");
2076 lock_basic_unlock(&env->anchors->lock);
2077 return 0;
2078 }
2079 log_assert(tp == tp2);
2080 lock_basic_lock(&tp->lock);
2081
2082 /* schedule */
2083 mold = wait_probe_time(env->anchors);
2084 (void)rbtree_delete(&env->anchors->autr->probe, tp);
2085 tp->autr->next_probe_time = calc_next_probe(env,
2086 tp->autr->query_interval);
2087 (void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2088 mnew = wait_probe_time(env->anchors);
2089
2090 lock_basic_unlock(&env->anchors->lock);
2091 verbose(VERB_ALGO, "next probe set in %d seconds",
2092 (int)tp->autr->next_probe_time - (int)*env->now);
2093 if(mold != mnew) {
2094 reset_worker_timer(env);
2095 }
2096 return 1;
2097 }
2098
2099 /** Revoke and Delete a trust point */
2100 static void
autr_tp_remove(struct module_env * env,struct trust_anchor * tp,struct ub_packed_rrset_key * dnskey_rrset)2101 autr_tp_remove(struct module_env* env, struct trust_anchor* tp,
2102 struct ub_packed_rrset_key* dnskey_rrset)
2103 {
2104 struct trust_anchor* del_tp;
2105 struct trust_anchor key;
2106 struct autr_point_data pd;
2107 time_t mold, mnew;
2108
2109 log_nametypeclass(VERB_OPS, "trust point was revoked",
2110 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2111 tp->autr->revoked = 1;
2112
2113 /* use space allocated for dnskey_rrset to save name of anchor */
2114 memset(&key, 0, sizeof(key));
2115 memset(&pd, 0, sizeof(pd));
2116 key.autr = &pd;
2117 key.node.key = &key;
2118 pd.pnode.key = &key;
2119 pd.next_probe_time = tp->autr->next_probe_time;
2120 key.name = dnskey_rrset->rk.dname;
2121 key.namelen = tp->namelen;
2122 key.namelabs = tp->namelabs;
2123 key.dclass = tp->dclass;
2124
2125 /* unlock */
2126 lock_basic_unlock(&tp->lock);
2127
2128 /* take from tree. It could be deleted by someone else,hence (void). */
2129 lock_basic_lock(&env->anchors->lock);
2130 del_tp = (struct trust_anchor*)rbtree_delete(env->anchors->tree, &key);
2131 mold = wait_probe_time(env->anchors);
2132 (void)rbtree_delete(&env->anchors->autr->probe, &key);
2133 mnew = wait_probe_time(env->anchors);
2134 anchors_init_parents_locked(env->anchors);
2135 lock_basic_unlock(&env->anchors->lock);
2136
2137 /* if !del_tp then the trust point is no longer present in the tree,
2138 * it was deleted by someone else, who will write the zonefile and
2139 * clean up the structure */
2140 if(del_tp) {
2141 /* save on disk */
2142 del_tp->autr->next_probe_time = 0; /* no more probing for it */
2143 autr_write_file(env, del_tp);
2144
2145 /* delete */
2146 autr_point_delete(del_tp);
2147 }
2148 if(mold != mnew) {
2149 reset_worker_timer(env);
2150 }
2151 }
2152
autr_process_prime(struct module_env * env,struct val_env * ve,struct trust_anchor * tp,struct ub_packed_rrset_key * dnskey_rrset,struct module_qstate * qstate)2153 int autr_process_prime(struct module_env* env, struct val_env* ve,
2154 struct trust_anchor* tp, struct ub_packed_rrset_key* dnskey_rrset,
2155 struct module_qstate* qstate)
2156 {
2157 int changed = 0;
2158 log_assert(tp && tp->autr);
2159 /* autotrust update trust anchors */
2160 /* the tp is locked, and stays locked unless it is deleted */
2161
2162 /* we could just catch the anchor here while another thread
2163 * is busy deleting it. Just unlock and let the other do its job */
2164 if(tp->autr->revoked) {
2165 log_nametypeclass(VERB_ALGO, "autotrust not processed, "
2166 "trust point revoked", tp->name,
2167 LDNS_RR_TYPE_DNSKEY, tp->dclass);
2168 lock_basic_unlock(&tp->lock);
2169 return 0; /* it is revoked */
2170 }
2171
2172 /* query_dnskeys(): */
2173 tp->autr->last_queried = *env->now;
2174
2175 log_nametypeclass(VERB_ALGO, "autotrust process for",
2176 tp->name, LDNS_RR_TYPE_DNSKEY, tp->dclass);
2177 /* see if time alone makes some keys valid */
2178 autr_holddown_exceed(env, tp, &changed);
2179 if(changed) {
2180 verbose(VERB_ALGO, "autotrust: morekeys, reassemble");
2181 if(!autr_assemble(tp)) {
2182 log_err("malloc failure assembling autotrust keys");
2183 return 1; /* unchanged */
2184 }
2185 }
2186 /* did we get any data? */
2187 if(!dnskey_rrset) {
2188 verbose(VERB_ALGO, "autotrust: no dnskey rrset");
2189 /* no update of query_failed, because then we would have
2190 * to write to disk. But we cannot because we maybe are
2191 * still 'initializing' with DS records, that we cannot write
2192 * in the full format (which only contains KSKs). */
2193 return 1; /* trust point exists */
2194 }
2195 /* check for revoked keys to remove immediately */
2196 check_contains_revoked(env, ve, tp, dnskey_rrset, &changed, qstate);
2197 if(changed) {
2198 verbose(VERB_ALGO, "autotrust: revokedkeys, reassemble");
2199 if(!autr_assemble(tp)) {
2200 log_err("malloc failure assembling autotrust keys");
2201 return 1; /* unchanged */
2202 }
2203 if(!tp->ds_rrset && !tp->dnskey_rrset) {
2204 /* no more keys, all are revoked */
2205 /* this is a success for this probe attempt */
2206 tp->autr->last_success = *env->now;
2207 autr_tp_remove(env, tp, dnskey_rrset);
2208 return 0; /* trust point removed */
2209 }
2210 }
2211 /* verify the dnskey rrset and see if it is valid. */
2212 if(!verify_dnskey(env, ve, tp, dnskey_rrset, qstate)) {
2213 verbose(VERB_ALGO, "autotrust: dnskey did not verify.");
2214 /* only increase failure count if this is not the first prime,
2215 * this means there was a previous successful probe */
2216 if(tp->autr->last_success) {
2217 tp->autr->query_failed += 1;
2218 autr_write_file(env, tp);
2219 }
2220 return 1; /* trust point exists */
2221 }
2222
2223 tp->autr->last_success = *env->now;
2224 tp->autr->query_failed = 0;
2225
2226 /* Add new trust anchors to the data structure
2227 * - note which trust anchors are seen this probe.
2228 * Set trustpoint query_interval and retry_time.
2229 * - find minimum rrsig expiration interval
2230 */
2231 if(!update_events(env, ve, tp, dnskey_rrset, &changed)) {
2232 log_err("malloc failure in autotrust update_events. "
2233 "trust point unchanged.");
2234 return 1; /* trust point unchanged, so exists */
2235 }
2236
2237 /* - for every SEP key do the 5011 statetable.
2238 * - remove missing trustanchors (if veryold and we have new anchors).
2239 */
2240 if(!do_statetable(env, tp, &changed)) {
2241 log_err("malloc failure in autotrust do_statetable. "
2242 "trust point unchanged.");
2243 return 1; /* trust point unchanged, so exists */
2244 }
2245
2246 autr_cleanup_keys(tp);
2247 if(!set_next_probe(env, tp, dnskey_rrset))
2248 return 0; /* trust point does not exist */
2249 autr_write_file(env, tp);
2250 if(changed) {
2251 verbose(VERB_ALGO, "autotrust: changed, reassemble");
2252 if(!autr_assemble(tp)) {
2253 log_err("malloc failure assembling autotrust keys");
2254 return 1; /* unchanged */
2255 }
2256 if(!tp->ds_rrset && !tp->dnskey_rrset) {
2257 /* no more keys, all are revoked */
2258 autr_tp_remove(env, tp, dnskey_rrset);
2259 return 0; /* trust point removed */
2260 }
2261 } else verbose(VERB_ALGO, "autotrust: no changes");
2262
2263 return 1; /* trust point exists */
2264 }
2265
2266 /** debug print a trust anchor key */
2267 static void
autr_debug_print_ta(struct autr_ta * ta)2268 autr_debug_print_ta(struct autr_ta* ta)
2269 {
2270 char buf[32];
2271 char* str = sldns_wire2str_rr(ta->rr, ta->rr_len);
2272 if(!str) {
2273 log_info("out of memory in debug_print_ta");
2274 return;
2275 }
2276 if(str[0]) str[strlen(str)-1]=0; /* remove newline */
2277 (void)autr_ctime_r(&ta->last_change, buf);
2278 if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2279 log_info("[%s] %s ;;state:%d ;;pending_count:%d%s%s last:%s",
2280 trustanchor_state2str(ta->s), str, ta->s, ta->pending_count,
2281 ta->fetched?" fetched":"", ta->revoked?" revoked":"", buf);
2282 free(str);
2283 }
2284
2285 /** debug print a trust point */
2286 static void
autr_debug_print_tp(struct trust_anchor * tp)2287 autr_debug_print_tp(struct trust_anchor* tp)
2288 {
2289 struct autr_ta* ta;
2290 char buf[257];
2291 if(!tp->autr)
2292 return;
2293 dname_str(tp->name, buf);
2294 log_info("trust point %s : %d", buf, (int)tp->dclass);
2295 log_info("assembled %d DS and %d DNSKEYs",
2296 (int)tp->numDS, (int)tp->numDNSKEY);
2297 if(tp->ds_rrset) {
2298 log_packed_rrset(NO_VERBOSE, "DS:", tp->ds_rrset);
2299 }
2300 if(tp->dnskey_rrset) {
2301 log_packed_rrset(NO_VERBOSE, "DNSKEY:", tp->dnskey_rrset);
2302 }
2303 log_info("file %s", tp->autr->file);
2304 (void)autr_ctime_r(&tp->autr->last_queried, buf);
2305 if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2306 log_info("last_queried: %u %s", (unsigned)tp->autr->last_queried, buf);
2307 (void)autr_ctime_r(&tp->autr->last_success, buf);
2308 if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2309 log_info("last_success: %u %s", (unsigned)tp->autr->last_success, buf);
2310 (void)autr_ctime_r(&tp->autr->next_probe_time, buf);
2311 if(buf[0]) buf[strlen(buf)-1]=0; /* remove newline */
2312 log_info("next_probe_time: %u %s", (unsigned)tp->autr->next_probe_time,
2313 buf);
2314 log_info("query_interval: %u", (unsigned)tp->autr->query_interval);
2315 log_info("retry_time: %u", (unsigned)tp->autr->retry_time);
2316 log_info("query_failed: %u", (unsigned)tp->autr->query_failed);
2317
2318 for(ta=tp->autr->keys; ta; ta=ta->next) {
2319 autr_debug_print_ta(ta);
2320 }
2321 }
2322
2323 void
autr_debug_print(struct val_anchors * anchors)2324 autr_debug_print(struct val_anchors* anchors)
2325 {
2326 struct trust_anchor* tp;
2327 lock_basic_lock(&anchors->lock);
2328 RBTREE_FOR(tp, struct trust_anchor*, anchors->tree) {
2329 lock_basic_lock(&tp->lock);
2330 autr_debug_print_tp(tp);
2331 lock_basic_unlock(&tp->lock);
2332 }
2333 lock_basic_unlock(&anchors->lock);
2334 }
2335
probe_answer_cb(void * arg,int ATTR_UNUSED (rcode),sldns_buffer * ATTR_UNUSED (buf),enum sec_status ATTR_UNUSED (sec),char * ATTR_UNUSED (why_bogus),int ATTR_UNUSED (was_ratelimited))2336 void probe_answer_cb(void* arg, int ATTR_UNUSED(rcode),
2337 sldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(sec),
2338 char* ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
2339 {
2340 /* retry was set before the query was done,
2341 * re-querytime is set when query succeeded, but that may not
2342 * have reset this timer because the query could have been
2343 * handled by another thread. In that case, this callback would
2344 * get called after the original timeout is done.
2345 * By not resetting the timer, it may probe more often, but not
2346 * less often.
2347 * Unless the new lookup resulted in smaller TTLs and thus smaller
2348 * timeout values. In that case one old TTL could be mistakenly done.
2349 */
2350 struct module_env* env = (struct module_env*)arg;
2351 verbose(VERB_ALGO, "autotrust probe answer cb");
2352 reset_worker_timer(env);
2353 }
2354
2355 /** probe a trust anchor DNSKEY and unlocks tp */
2356 static void
probe_anchor(struct module_env * env,struct trust_anchor * tp)2357 probe_anchor(struct module_env* env, struct trust_anchor* tp)
2358 {
2359 struct query_info qinfo;
2360 uint16_t qflags = BIT_RD;
2361 struct edns_data edns;
2362 sldns_buffer* buf = env->scratch_buffer;
2363 qinfo.qname = regional_alloc_init(env->scratch, tp->name, tp->namelen);
2364 if(!qinfo.qname) {
2365 log_err("out of memory making 5011 probe");
2366 return;
2367 }
2368 qinfo.qname_len = tp->namelen;
2369 qinfo.qtype = LDNS_RR_TYPE_DNSKEY;
2370 qinfo.qclass = tp->dclass;
2371 qinfo.local_alias = NULL;
2372 log_query_info(VERB_ALGO, "autotrust probe", &qinfo);
2373 verbose(VERB_ALGO, "retry probe set in %d seconds",
2374 (int)tp->autr->next_probe_time - (int)*env->now);
2375 edns.edns_present = 1;
2376 edns.ext_rcode = 0;
2377 edns.edns_version = 0;
2378 edns.bits = EDNS_DO;
2379 edns.opt_list_in = NULL;
2380 edns.opt_list_out = NULL;
2381 edns.opt_list_inplace_cb_out = NULL;
2382 edns.padding_block_size = 0;
2383 edns.cookie_present = 0;
2384 edns.cookie_valid = 0;
2385 if(sldns_buffer_capacity(buf) < 65535)
2386 edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);
2387 else edns.udp_size = 65535;
2388
2389 /* can't hold the lock while mesh_run is processing */
2390 lock_basic_unlock(&tp->lock);
2391
2392 /* delete the DNSKEY from rrset and key cache so an active probe
2393 * is done. First the rrset so another thread does not use it
2394 * to recreate the key entry in a race condition. */
2395 rrset_cache_remove(env->rrset_cache, qinfo.qname, qinfo.qname_len,
2396 qinfo.qtype, qinfo.qclass, 0);
2397 key_cache_remove(env->key_cache, qinfo.qname, qinfo.qname_len,
2398 qinfo.qclass);
2399
2400 if(!mesh_new_callback(env->mesh, &qinfo, qflags, &edns, buf, 0,
2401 &probe_answer_cb, env, 0)) {
2402 log_err("out of memory making 5011 probe");
2403 }
2404 }
2405
2406 /** fetch first to-probe trust-anchor and lock it and set retrytime */
2407 static struct trust_anchor*
todo_probe(struct module_env * env,time_t * next)2408 todo_probe(struct module_env* env, time_t* next)
2409 {
2410 struct trust_anchor* tp;
2411 rbnode_type* el;
2412 /* get first one */
2413 lock_basic_lock(&env->anchors->lock);
2414 if( (el=rbtree_first(&env->anchors->autr->probe)) == RBTREE_NULL) {
2415 /* in case of revoked anchors */
2416 lock_basic_unlock(&env->anchors->lock);
2417 /* signal that there are no anchors to probe */
2418 *next = 0;
2419 return NULL;
2420 }
2421 tp = (struct trust_anchor*)el->key;
2422 lock_basic_lock(&tp->lock);
2423
2424 /* is it eligible? */
2425 if((time_t)tp->autr->next_probe_time > *env->now) {
2426 /* no more to probe */
2427 *next = (time_t)tp->autr->next_probe_time - *env->now;
2428 lock_basic_unlock(&tp->lock);
2429 lock_basic_unlock(&env->anchors->lock);
2430 return NULL;
2431 }
2432
2433 /* reset its next probe time */
2434 (void)rbtree_delete(&env->anchors->autr->probe, tp);
2435 tp->autr->next_probe_time = calc_next_probe(env, tp->autr->retry_time);
2436 (void)rbtree_insert(&env->anchors->autr->probe, &tp->autr->pnode);
2437 lock_basic_unlock(&env->anchors->lock);
2438
2439 return tp;
2440 }
2441
2442 time_t
autr_probe_timer(struct module_env * env)2443 autr_probe_timer(struct module_env* env)
2444 {
2445 struct trust_anchor* tp;
2446 time_t next_probe = 3600;
2447 int num = 0;
2448 if(autr_permit_small_holddown) next_probe = 1;
2449 verbose(VERB_ALGO, "autotrust probe timer callback");
2450 /* while there are still anchors to probe */
2451 while( (tp = todo_probe(env, &next_probe)) ) {
2452 /* make a probe for this anchor */
2453 probe_anchor(env, tp);
2454 num++;
2455 }
2456 regional_free_all(env->scratch);
2457 if(next_probe == 0)
2458 return 0; /* no trust points to probe */
2459 verbose(VERB_ALGO, "autotrust probe timer %d callbacks done", num);
2460 return next_probe;
2461 }
2462