1 /*
2 * validator/validator.c - secure validator DNS query response module
3 *
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
5 *
6 * This software is open source.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
14 *
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
18 *
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 */
35
36 /**
37 * \file
38 *
39 * This file contains a module that performs validation of DNS queries.
40 * According to RFC 4034.
41 */
42 #include "config.h"
43 #include <ctype.h>
44 #include "validator/validator.h"
45 #include "validator/val_anchor.h"
46 #include "validator/val_kcache.h"
47 #include "validator/val_kentry.h"
48 #include "validator/val_utils.h"
49 #include "validator/val_nsec.h"
50 #include "validator/val_nsec3.h"
51 #include "validator/val_neg.h"
52 #include "validator/val_sigcrypt.h"
53 #include "validator/autotrust.h"
54 #include "services/cache/dns.h"
55 #include "services/cache/rrset.h"
56 #include "util/data/dname.h"
57 #include "util/module.h"
58 #include "util/log.h"
59 #include "util/net_help.h"
60 #include "util/regional.h"
61 #include "util/config_file.h"
62 #include "util/fptr_wlist.h"
63 #include "sldns/rrdef.h"
64 #include "sldns/wire2str.h"
65 #include "sldns/str2wire.h"
66
67 /* forward decl for cache response and normal super inform calls of a DS */
68 static void process_ds_response(struct module_qstate* qstate,
69 struct val_qstate* vq, int id, int rcode, struct dns_msg* msg,
70 struct query_info* qinfo, struct sock_list* origin);
71
72 /** fill up nsec3 key iterations config entry */
73 static int
fill_nsec3_iter(struct val_env * ve,char * s,int c)74 fill_nsec3_iter(struct val_env* ve, char* s, int c)
75 {
76 char* e;
77 int i;
78 free(ve->nsec3_keysize);
79 free(ve->nsec3_maxiter);
80 ve->nsec3_keysize = (size_t*)calloc(sizeof(size_t), (size_t)c);
81 ve->nsec3_maxiter = (size_t*)calloc(sizeof(size_t), (size_t)c);
82 if(!ve->nsec3_keysize || !ve->nsec3_maxiter) {
83 log_err("out of memory");
84 return 0;
85 }
86 for(i=0; i<c; i++) {
87 ve->nsec3_keysize[i] = (size_t)strtol(s, &e, 10);
88 if(s == e) {
89 log_err("cannot parse: %s", s);
90 return 0;
91 }
92 s = e;
93 ve->nsec3_maxiter[i] = (size_t)strtol(s, &e, 10);
94 if(s == e) {
95 log_err("cannot parse: %s", s);
96 return 0;
97 }
98 s = e;
99 if(i>0 && ve->nsec3_keysize[i-1] >= ve->nsec3_keysize[i]) {
100 log_err("nsec3 key iterations not ascending: %d %d",
101 (int)ve->nsec3_keysize[i-1],
102 (int)ve->nsec3_keysize[i]);
103 return 0;
104 }
105 verbose(VERB_ALGO, "validator nsec3cfg keysz %d mxiter %d",
106 (int)ve->nsec3_keysize[i], (int)ve->nsec3_maxiter[i]);
107 }
108 return 1;
109 }
110
111 /** apply config settings to validator */
112 static int
val_apply_cfg(struct module_env * env,struct val_env * val_env,struct config_file * cfg)113 val_apply_cfg(struct module_env* env, struct val_env* val_env,
114 struct config_file* cfg)
115 {
116 int c;
117 val_env->bogus_ttl = (uint32_t)cfg->bogus_ttl;
118 if(!env->anchors)
119 env->anchors = anchors_create();
120 if(!env->anchors) {
121 log_err("out of memory");
122 return 0;
123 }
124 if (env->key_cache)
125 val_env->kcache = env->key_cache;
126 if(!val_env->kcache)
127 val_env->kcache = key_cache_create(cfg);
128 if(!val_env->kcache) {
129 log_err("out of memory");
130 return 0;
131 }
132 env->key_cache = val_env->kcache;
133 if(!anchors_apply_cfg(env->anchors, cfg)) {
134 log_err("validator: error in trustanchors config");
135 return 0;
136 }
137 val_env->date_override = cfg->val_date_override;
138 val_env->skew_min = cfg->val_sig_skew_min;
139 val_env->skew_max = cfg->val_sig_skew_max;
140 val_env->max_restart = cfg->val_max_restart;
141 c = cfg_count_numbers(cfg->val_nsec3_key_iterations);
142 if(c < 1 || (c&1)) {
143 log_err("validator: unparsable or odd nsec3 key "
144 "iterations: %s", cfg->val_nsec3_key_iterations);
145 return 0;
146 }
147 val_env->nsec3_keyiter_count = c/2;
148 if(!fill_nsec3_iter(val_env, cfg->val_nsec3_key_iterations, c/2)) {
149 log_err("validator: cannot apply nsec3 key iterations");
150 return 0;
151 }
152 if (env->neg_cache)
153 val_env->neg_cache = env->neg_cache;
154 if(!val_env->neg_cache)
155 val_env->neg_cache = val_neg_create(cfg,
156 val_env->nsec3_maxiter[val_env->nsec3_keyiter_count-1]);
157 if(!val_env->neg_cache) {
158 log_err("out of memory");
159 return 0;
160 }
161 env->neg_cache = val_env->neg_cache;
162 return 1;
163 }
164
165 #ifdef USE_ECDSA_EVP_WORKAROUND
166 void ecdsa_evp_workaround_init(void);
167 #endif
168 int
val_init(struct module_env * env,int id)169 val_init(struct module_env* env, int id)
170 {
171 struct val_env* val_env = (struct val_env*)calloc(1,
172 sizeof(struct val_env));
173 if(!val_env) {
174 log_err("malloc failure");
175 return 0;
176 }
177 env->modinfo[id] = (void*)val_env;
178 env->need_to_validate = 1;
179 lock_basic_init(&val_env->bogus_lock);
180 lock_protect(&val_env->bogus_lock, &val_env->num_rrset_bogus,
181 sizeof(val_env->num_rrset_bogus));
182 #ifdef USE_ECDSA_EVP_WORKAROUND
183 ecdsa_evp_workaround_init();
184 #endif
185 if(!val_apply_cfg(env, val_env, env->cfg)) {
186 log_err("validator: could not apply configuration settings.");
187 return 0;
188 }
189
190 return 1;
191 }
192
193 void
val_deinit(struct module_env * env,int id)194 val_deinit(struct module_env* env, int id)
195 {
196 struct val_env* val_env;
197 if(!env || !env->modinfo[id])
198 return;
199 val_env = (struct val_env*)env->modinfo[id];
200 lock_basic_destroy(&val_env->bogus_lock);
201 anchors_delete(env->anchors);
202 env->anchors = NULL;
203 key_cache_delete(val_env->kcache);
204 env->key_cache = NULL;
205 neg_cache_delete(val_env->neg_cache);
206 env->neg_cache = NULL;
207 free(val_env->nsec3_keysize);
208 free(val_env->nsec3_maxiter);
209 free(val_env);
210 env->modinfo[id] = NULL;
211 }
212
213 /** fill in message structure */
214 static struct val_qstate*
val_new_getmsg(struct module_qstate * qstate,struct val_qstate * vq)215 val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq)
216 {
217 if(!qstate->return_msg || qstate->return_rcode != LDNS_RCODE_NOERROR) {
218 /* create a message to verify */
219 verbose(VERB_ALGO, "constructing reply for validation");
220 vq->orig_msg = (struct dns_msg*)regional_alloc(qstate->region,
221 sizeof(struct dns_msg));
222 if(!vq->orig_msg)
223 return NULL;
224 vq->orig_msg->qinfo = qstate->qinfo;
225 vq->orig_msg->rep = (struct reply_info*)regional_alloc(
226 qstate->region, sizeof(struct reply_info));
227 if(!vq->orig_msg->rep)
228 return NULL;
229 memset(vq->orig_msg->rep, 0, sizeof(struct reply_info));
230 vq->orig_msg->rep->flags = (uint16_t)(qstate->return_rcode&0xf)
231 |BIT_QR|BIT_RA|(qstate->query_flags|(BIT_CD|BIT_RD));
232 vq->orig_msg->rep->qdcount = 1;
233 } else {
234 vq->orig_msg = qstate->return_msg;
235 }
236 vq->qchase = qstate->qinfo;
237 /* chase reply will be an edited (sub)set of the orig msg rrset ptrs */
238 vq->chase_reply = regional_alloc_init(qstate->region,
239 vq->orig_msg->rep,
240 sizeof(struct reply_info) - sizeof(struct rrset_ref));
241 if(!vq->chase_reply)
242 return NULL;
243 if(vq->orig_msg->rep->rrset_count > RR_COUNT_MAX)
244 return NULL; /* protect against integer overflow */
245 vq->chase_reply->rrsets = regional_alloc_init(qstate->region,
246 vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*)
247 * vq->orig_msg->rep->rrset_count);
248 if(!vq->chase_reply->rrsets)
249 return NULL;
250 vq->rrset_skip = 0;
251 return vq;
252 }
253
254 /** allocate new validator query state */
255 static struct val_qstate*
val_new(struct module_qstate * qstate,int id)256 val_new(struct module_qstate* qstate, int id)
257 {
258 struct val_qstate* vq = (struct val_qstate*)regional_alloc(
259 qstate->region, sizeof(*vq));
260 log_assert(!qstate->minfo[id]);
261 if(!vq)
262 return NULL;
263 memset(vq, 0, sizeof(*vq));
264 qstate->minfo[id] = vq;
265 vq->state = VAL_INIT_STATE;
266 return val_new_getmsg(qstate, vq);
267 }
268
269 /**
270 * Exit validation with an error status
271 *
272 * @param qstate: query state
273 * @param id: validator id.
274 * @return false, for use by caller to return to stop processing.
275 */
276 static int
val_error(struct module_qstate * qstate,int id)277 val_error(struct module_qstate* qstate, int id)
278 {
279 qstate->ext_state[id] = module_error;
280 qstate->return_rcode = LDNS_RCODE_SERVFAIL;
281 return 0;
282 }
283
284 /**
285 * Check to see if a given response needs to go through the validation
286 * process. Typical reasons for this routine to return false are: CD bit was
287 * on in the original request, or the response is a kind of message that
288 * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.)
289 *
290 * @param qstate: query state.
291 * @param ret_rc: rcode for this message (if noerror - examine ret_msg).
292 * @param ret_msg: return msg, can be NULL; look at rcode instead.
293 * @return true if the response could use validation (although this does not
294 * mean we can actually validate this response).
295 */
296 static int
needs_validation(struct module_qstate * qstate,int ret_rc,struct dns_msg * ret_msg)297 needs_validation(struct module_qstate* qstate, int ret_rc,
298 struct dns_msg* ret_msg)
299 {
300 int rcode;
301
302 /* If the CD bit is on in the original request, then you could think
303 * that we don't bother to validate anything.
304 * But this is signalled internally with the valrec flag.
305 * User queries are validated with BIT_CD to make our cache clean
306 * so that bogus messages get retried by the upstream also for
307 * downstream validators that set BIT_CD.
308 * For DNS64 bit_cd signals no dns64 processing, but we want to
309 * provide validation there too */
310 /*
311 if(qstate->query_flags & BIT_CD) {
312 verbose(VERB_ALGO, "not validating response due to CD bit");
313 return 0;
314 }
315 */
316 if(qstate->is_valrec) {
317 verbose(VERB_ALGO, "not validating response, is valrec"
318 "(validation recursion lookup)");
319 return 0;
320 }
321
322 if(ret_rc != LDNS_RCODE_NOERROR || !ret_msg)
323 rcode = ret_rc;
324 else rcode = (int)FLAGS_GET_RCODE(ret_msg->rep->flags);
325
326 if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) {
327 if(verbosity >= VERB_ALGO) {
328 char rc[16];
329 rc[0]=0;
330 (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
331 verbose(VERB_ALGO, "cannot validate non-answer, rcode %s", rc);
332 }
333 return 0;
334 }
335
336 /* cannot validate positive RRSIG response. (negatives can) */
337 if(qstate->qinfo.qtype == LDNS_RR_TYPE_RRSIG &&
338 rcode == LDNS_RCODE_NOERROR && ret_msg &&
339 ret_msg->rep->an_numrrsets > 0) {
340 verbose(VERB_ALGO, "cannot validate RRSIG, no sigs on sigs.");
341 return 0;
342 }
343 return 1;
344 }
345
346 /**
347 * Check to see if the response has already been validated.
348 * @param ret_msg: return msg, can be NULL
349 * @return true if the response has already been validated
350 */
351 static int
already_validated(struct dns_msg * ret_msg)352 already_validated(struct dns_msg* ret_msg)
353 {
354 /* validate unchecked, and re-validate bogus messages */
355 if (ret_msg && ret_msg->rep->security > sec_status_bogus)
356 {
357 verbose(VERB_ALGO, "response has already been validated: %s",
358 sec_status_to_string(ret_msg->rep->security));
359 return 1;
360 }
361 return 0;
362 }
363
364 /**
365 * Generate a request for DNS data.
366 *
367 * @param qstate: query state that is the parent.
368 * @param id: module id.
369 * @param name: what name to query for.
370 * @param namelen: length of name.
371 * @param qtype: query type.
372 * @param qclass: query class.
373 * @param flags: additional flags, such as the CD bit (BIT_CD), or 0.
374 * @param newq: If the subquery is newly created, it is returned,
375 * otherwise NULL is returned
376 * @param detached: true if this qstate should not attach to the subquery
377 * @return false on alloc failure.
378 */
379 static int
generate_request(struct module_qstate * qstate,int id,uint8_t * name,size_t namelen,uint16_t qtype,uint16_t qclass,uint16_t flags,struct module_qstate ** newq,int detached)380 generate_request(struct module_qstate* qstate, int id, uint8_t* name,
381 size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags,
382 struct module_qstate** newq, int detached)
383 {
384 struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
385 struct query_info ask;
386 int valrec;
387 ask.qname = name;
388 ask.qname_len = namelen;
389 ask.qtype = qtype;
390 ask.qclass = qclass;
391 ask.local_alias = NULL;
392 log_query_info(VERB_ALGO, "generate request", &ask);
393 /* enable valrec flag to avoid recursion to the same validation
394 * routine, this lookup is simply a lookup. */
395 valrec = 1;
396
397 fptr_ok(fptr_whitelist_modenv_detect_cycle(qstate->env->detect_cycle));
398 if((*qstate->env->detect_cycle)(qstate, &ask,
399 (uint16_t)(BIT_RD|flags), 0, valrec)) {
400 verbose(VERB_ALGO, "Could not generate request: cycle detected");
401 return 0;
402 }
403
404 if(detached) {
405 struct mesh_state* sub = NULL;
406 fptr_ok(fptr_whitelist_modenv_add_sub(
407 qstate->env->add_sub));
408 if(!(*qstate->env->add_sub)(qstate, &ask,
409 (uint16_t)(BIT_RD|flags), 0, valrec, newq, &sub)){
410 log_err("Could not generate request: out of memory");
411 return 0;
412 }
413 }
414 else {
415 fptr_ok(fptr_whitelist_modenv_attach_sub(
416 qstate->env->attach_sub));
417 if(!(*qstate->env->attach_sub)(qstate, &ask,
418 (uint16_t)(BIT_RD|flags), 0, valrec, newq)){
419 log_err("Could not generate request: out of memory");
420 return 0;
421 }
422 }
423 /* newq; validator does not need state created for that
424 * query, and its a 'normal' for iterator as well */
425 if(*newq) {
426 /* add our blacklist to the query blacklist */
427 sock_list_merge(&(*newq)->blacklist, (*newq)->region,
428 vq->chain_blacklist);
429 }
430 qstate->ext_state[id] = module_wait_subquery;
431 return 1;
432 }
433
434 /**
435 * Generate, send and detach key tag signaling query.
436 *
437 * @param qstate: query state.
438 * @param id: module id.
439 * @param ta: trust anchor, locked.
440 * @return false on a processing error.
441 */
442 static int
generate_keytag_query(struct module_qstate * qstate,int id,struct trust_anchor * ta)443 generate_keytag_query(struct module_qstate* qstate, int id,
444 struct trust_anchor* ta)
445 {
446 /* 3 bytes for "_ta", 5 bytes per tag (4 bytes + "-") */
447 #define MAX_LABEL_TAGS (LDNS_MAX_LABELLEN-3)/5
448 size_t i, numtag;
449 uint16_t tags[MAX_LABEL_TAGS];
450 char tagstr[LDNS_MAX_LABELLEN+1] = "_ta"; /* +1 for NULL byte */
451 size_t tagstr_left = sizeof(tagstr) - strlen(tagstr);
452 char* tagstr_pos = tagstr + strlen(tagstr);
453 uint8_t dnamebuf[LDNS_MAX_DOMAINLEN+1]; /* +1 for label length byte */
454 size_t dnamebuf_len = sizeof(dnamebuf);
455 uint8_t* keytagdname;
456 struct module_qstate* newq = NULL;
457 enum module_ext_state ext_state = qstate->ext_state[id];
458
459 numtag = anchor_list_keytags(ta, tags, MAX_LABEL_TAGS);
460 if(numtag == 0)
461 return 0;
462
463 for(i=0; i<numtag; i++) {
464 /* Buffer can't overflow; numtag is limited to tags that fit in
465 * the buffer. */
466 snprintf(tagstr_pos, tagstr_left, "-%04x", (unsigned)tags[i]);
467 tagstr_left -= strlen(tagstr_pos);
468 tagstr_pos += strlen(tagstr_pos);
469 }
470
471 sldns_str2wire_dname_buf_origin(tagstr, dnamebuf, &dnamebuf_len,
472 ta->name, ta->namelen);
473 if(!(keytagdname = (uint8_t*)regional_alloc_init(qstate->region,
474 dnamebuf, dnamebuf_len))) {
475 log_err("could not generate key tag query: out of memory");
476 return 0;
477 }
478
479 log_nametypeclass(VERB_OPS, "generate keytag query", keytagdname,
480 LDNS_RR_TYPE_NULL, ta->dclass);
481 if(!generate_request(qstate, id, keytagdname, dnamebuf_len,
482 LDNS_RR_TYPE_NULL, ta->dclass, 0, &newq, 1)) {
483 verbose(VERB_ALGO, "failed to generate key tag signaling request");
484 return 0;
485 }
486
487 /* Not interested in subquery response. Restore the ext_state,
488 * that might be changed by generate_request() */
489 qstate->ext_state[id] = ext_state;
490
491 return 1;
492 }
493
494 /**
495 * Get keytag as uint16_t from string
496 *
497 * @param start: start of string containing keytag
498 * @param keytag: pointer where to store the extracted keytag
499 * @return: 1 if keytag was extracted, else 0.
500 */
501 static int
sentinel_get_keytag(char * start,uint16_t * keytag)502 sentinel_get_keytag(char* start, uint16_t* keytag) {
503 char* keytag_str;
504 char* e = NULL;
505 keytag_str = calloc(1, SENTINEL_KEYTAG_LEN + 1 /* null byte */);
506 if(!keytag_str)
507 return 0;
508 memmove(keytag_str, start, SENTINEL_KEYTAG_LEN);
509 keytag_str[SENTINEL_KEYTAG_LEN] = '\0';
510 *keytag = (uint16_t)strtol(keytag_str, &e, 10);
511 if(!e || *e != '\0') {
512 free(keytag_str);
513 return 0;
514 }
515 free(keytag_str);
516 return 1;
517 }
518
519 /**
520 * Prime trust anchor for use.
521 * Generate and dispatch a priming query for the given trust anchor.
522 * The trust anchor can be DNSKEY or DS and does not have to be signed.
523 *
524 * @param qstate: query state.
525 * @param vq: validator query state.
526 * @param id: module id.
527 * @param toprime: what to prime.
528 * @return false on a processing error.
529 */
530 static int
prime_trust_anchor(struct module_qstate * qstate,struct val_qstate * vq,int id,struct trust_anchor * toprime)531 prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq,
532 int id, struct trust_anchor* toprime)
533 {
534 struct module_qstate* newq = NULL;
535 int ret = generate_request(qstate, id, toprime->name, toprime->namelen,
536 LDNS_RR_TYPE_DNSKEY, toprime->dclass, BIT_CD, &newq, 0);
537
538 if(newq && qstate->env->cfg->trust_anchor_signaling &&
539 !generate_keytag_query(qstate, id, toprime)) {
540 verbose(VERB_ALGO, "keytag signaling query failed");
541 return 0;
542 }
543
544 if(!ret) {
545 verbose(VERB_ALGO, "Could not prime trust anchor");
546 return 0;
547 }
548 /* ignore newq; validator does not need state created for that
549 * query, and its a 'normal' for iterator as well */
550 vq->wait_prime_ta = 1; /* to elicit PRIME_RESP_STATE processing
551 from the validator inform_super() routine */
552 /* store trust anchor name for later lookup when prime returns */
553 vq->trust_anchor_name = regional_alloc_init(qstate->region,
554 toprime->name, toprime->namelen);
555 vq->trust_anchor_len = toprime->namelen;
556 vq->trust_anchor_labs = toprime->namelabs;
557 if(!vq->trust_anchor_name) {
558 log_err("Could not prime trust anchor: out of memory");
559 return 0;
560 }
561 return 1;
562 }
563
564 /**
565 * Validate if the ANSWER and AUTHORITY sections contain valid rrsets.
566 * They must be validly signed with the given key.
567 * Tries to validate ADDITIONAL rrsets as well, but only to check them.
568 * Allows unsigned CNAME after a DNAME that expands the DNAME.
569 *
570 * Note that by the time this method is called, the process of finding the
571 * trusted DNSKEY rrset that signs this response must already have been
572 * completed.
573 *
574 * @param qstate: query state.
575 * @param env: module env for verify.
576 * @param ve: validator env for verify.
577 * @param qchase: query that was made.
578 * @param chase_reply: answer to validate.
579 * @param key_entry: the key entry, which is trusted, and which matches
580 * the signer of the answer. The key entry isgood().
581 * @return false if any of the rrsets in the an or ns sections of the message
582 * fail to verify. The message is then set to bogus.
583 */
584 static int
validate_msg_signatures(struct module_qstate * qstate,struct module_env * env,struct val_env * ve,struct query_info * qchase,struct reply_info * chase_reply,struct key_entry_key * key_entry)585 validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
586 struct val_env* ve, struct query_info* qchase,
587 struct reply_info* chase_reply, struct key_entry_key* key_entry)
588 {
589 uint8_t* sname;
590 size_t i, slen;
591 struct ub_packed_rrset_key* s;
592 enum sec_status sec;
593 int dname_seen = 0;
594 char* reason = NULL;
595
596 /* validate the ANSWER section */
597 for(i=0; i<chase_reply->an_numrrsets; i++) {
598 s = chase_reply->rrsets[i];
599 /* Skip the CNAME following a (validated) DNAME.
600 * Because of the normalization routines in the iterator,
601 * there will always be an unsigned CNAME following a DNAME
602 * (unless qtype=DNAME). */
603 if(dname_seen && ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
604 dname_seen = 0;
605 /* CNAME was synthesized by our own iterator */
606 /* since the DNAME verified, mark the CNAME as secure */
607 ((struct packed_rrset_data*)s->entry.data)->security =
608 sec_status_secure;
609 ((struct packed_rrset_data*)s->entry.data)->trust =
610 rrset_trust_validated;
611 continue;
612 }
613
614 /* Verify the answer rrset */
615 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
616 LDNS_SECTION_ANSWER, qstate);
617 /* If the (answer) rrset failed to validate, then this
618 * message is BAD. */
619 if(sec != sec_status_secure) {
620 log_nametypeclass(VERB_QUERY, "validator: response "
621 "has failed ANSWER rrset:", s->rk.dname,
622 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
623 errinf(qstate, reason);
624 if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME)
625 errinf(qstate, "for CNAME");
626 else if(ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME)
627 errinf(qstate, "for DNAME");
628 errinf_origin(qstate, qstate->reply_origin);
629 chase_reply->security = sec_status_bogus;
630 return 0;
631 }
632
633 /* Notice a DNAME that should be followed by an unsigned
634 * CNAME. */
635 if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
636 ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) {
637 dname_seen = 1;
638 }
639 }
640
641 /* validate the AUTHORITY section */
642 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
643 chase_reply->ns_numrrsets; i++) {
644 s = chase_reply->rrsets[i];
645 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason,
646 LDNS_SECTION_AUTHORITY, qstate);
647 /* If anything in the authority section fails to be secure,
648 * we have a bad message. */
649 if(sec != sec_status_secure) {
650 log_nametypeclass(VERB_QUERY, "validator: response "
651 "has failed AUTHORITY rrset:", s->rk.dname,
652 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
653 errinf(qstate, reason);
654 errinf_origin(qstate, qstate->reply_origin);
655 errinf_rrset(qstate, s);
656 chase_reply->security = sec_status_bogus;
657 return 0;
658 }
659 }
660
661 /* If set, the validator should clean the additional section of
662 * secure messages. */
663 if(!env->cfg->val_clean_additional)
664 return 1;
665 /* attempt to validate the ADDITIONAL section rrsets */
666 for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
667 i<chase_reply->rrset_count; i++) {
668 s = chase_reply->rrsets[i];
669 /* only validate rrs that have signatures with the key */
670 /* leave others unchecked, those get removed later on too */
671 val_find_rrset_signer(s, &sname, &slen);
672 if(sname && query_dname_compare(sname, key_entry->name)==0)
673 (void)val_verify_rrset_entry(env, ve, s, key_entry,
674 &reason, LDNS_SECTION_ADDITIONAL, qstate);
675 /* the additional section can fail to be secure,
676 * it is optional, check signature in case we need
677 * to clean the additional section later. */
678 }
679
680 return 1;
681 }
682
683 /**
684 * Detect wrong truncated response (say from BIND 9.6.1 that is forwarding
685 * and saw the NS record without signatures from a referral).
686 * The positive response has a mangled authority section.
687 * Remove that authority section and the additional section.
688 * @param rep: reply
689 * @return true if a wrongly truncated response.
690 */
691 static int
detect_wrongly_truncated(struct reply_info * rep)692 detect_wrongly_truncated(struct reply_info* rep)
693 {
694 size_t i;
695 /* only NS in authority, and it is bogus */
696 if(rep->ns_numrrsets != 1 || rep->an_numrrsets == 0)
697 return 0;
698 if(ntohs(rep->rrsets[ rep->an_numrrsets ]->rk.type) != LDNS_RR_TYPE_NS)
699 return 0;
700 if(((struct packed_rrset_data*)rep->rrsets[ rep->an_numrrsets ]
701 ->entry.data)->security == sec_status_secure)
702 return 0;
703 /* answer section is present and secure */
704 for(i=0; i<rep->an_numrrsets; i++) {
705 if(((struct packed_rrset_data*)rep->rrsets[ i ]
706 ->entry.data)->security != sec_status_secure)
707 return 0;
708 }
709 verbose(VERB_ALGO, "truncating to minimal response");
710 return 1;
711 }
712
713 /**
714 * For messages that are not referrals, if the chase reply contains an
715 * unsigned NS record in the authority section it could have been
716 * inserted by a (BIND) forwarder that thinks the zone is insecure, and
717 * that has an NS record without signatures in cache. Remove the NS
718 * record since the reply does not hinge on that record (in the authority
719 * section), but do not remove it if it removes the last record from the
720 * answer+authority sections.
721 * @param chase_reply: the chased reply, we have a key for this contents,
722 * so we should have signatures for these rrsets and not having
723 * signatures means it will be bogus.
724 * @param orig_reply: original reply, remove NS from there as well because
725 * we cannot mark the NS record as DNSSEC valid because it is not
726 * validated by signatures.
727 */
728 static void
remove_spurious_authority(struct reply_info * chase_reply,struct reply_info * orig_reply)729 remove_spurious_authority(struct reply_info* chase_reply,
730 struct reply_info* orig_reply)
731 {
732 size_t i, found = 0;
733 int remove = 0;
734 /* if no answer and only 1 auth RRset, do not remove that one */
735 if(chase_reply->an_numrrsets == 0 && chase_reply->ns_numrrsets == 1)
736 return;
737 /* search authority section for unsigned NS records */
738 for(i = chase_reply->an_numrrsets;
739 i < chase_reply->an_numrrsets+chase_reply->ns_numrrsets; i++) {
740 struct packed_rrset_data* d = (struct packed_rrset_data*)
741 chase_reply->rrsets[i]->entry.data;
742 if(ntohs(chase_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
743 && d->rrsig_count == 0) {
744 found = i;
745 remove = 1;
746 break;
747 }
748 }
749 /* see if we found the entry */
750 if(!remove) return;
751 log_rrset_key(VERB_ALGO, "Removing spurious unsigned NS record "
752 "(likely inserted by forwarder)", chase_reply->rrsets[found]);
753
754 /* find rrset in orig_reply */
755 for(i = orig_reply->an_numrrsets;
756 i < orig_reply->an_numrrsets+orig_reply->ns_numrrsets; i++) {
757 if(ntohs(orig_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
758 && query_dname_compare(orig_reply->rrsets[i]->rk.dname,
759 chase_reply->rrsets[found]->rk.dname) == 0) {
760 /* remove from orig_msg */
761 val_reply_remove_auth(orig_reply, i);
762 break;
763 }
764 }
765 /* remove rrset from chase_reply */
766 val_reply_remove_auth(chase_reply, found);
767 }
768
769 /**
770 * Given a "positive" response -- a response that contains an answer to the
771 * question, and no CNAME chain, validate this response.
772 *
773 * The answer and authority RRsets must already be verified as secure.
774 *
775 * @param env: module env for verify.
776 * @param ve: validator env for verify.
777 * @param qchase: query that was made.
778 * @param chase_reply: answer to that query to validate.
779 * @param kkey: the key entry, which is trusted, and which matches
780 * the signer of the answer. The key entry isgood().
781 */
782 static void
validate_positive_response(struct module_env * env,struct val_env * ve,struct query_info * qchase,struct reply_info * chase_reply,struct key_entry_key * kkey)783 validate_positive_response(struct module_env* env, struct val_env* ve,
784 struct query_info* qchase, struct reply_info* chase_reply,
785 struct key_entry_key* kkey)
786 {
787 uint8_t* wc = NULL;
788 size_t wl;
789 int wc_cached = 0;
790 int wc_NSEC_ok = 0;
791 int nsec3s_seen = 0;
792 size_t i;
793 struct ub_packed_rrset_key* s;
794
795 /* validate the ANSWER section - this will be the answer itself */
796 for(i=0; i<chase_reply->an_numrrsets; i++) {
797 s = chase_reply->rrsets[i];
798
799 /* Check to see if the rrset is the result of a wildcard
800 * expansion. If so, an additional check will need to be
801 * made in the authority section. */
802 if(!val_rrset_wildcard(s, &wc, &wl)) {
803 log_nametypeclass(VERB_QUERY, "Positive response has "
804 "inconsistent wildcard sigs:", s->rk.dname,
805 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
806 chase_reply->security = sec_status_bogus;
807 return;
808 }
809 if(wc && !wc_cached && env->cfg->aggressive_nsec) {
810 rrset_cache_update_wildcard(env->rrset_cache, s, wc, wl,
811 env->alloc, *env->now);
812 wc_cached = 1;
813 }
814
815 }
816
817 /* validate the AUTHORITY section as well - this will generally be
818 * the NS rrset (which could be missing, no problem) */
819 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
820 chase_reply->ns_numrrsets; i++) {
821 s = chase_reply->rrsets[i];
822
823 /* If this is a positive wildcard response, and we have a
824 * (just verified) NSEC record, try to use it to 1) prove
825 * that qname doesn't exist and 2) that the correct wildcard
826 * was used. */
827 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
828 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
829 wc_NSEC_ok = 1;
830 }
831 /* if not, continue looking for proof */
832 }
833
834 /* Otherwise, if this is a positive wildcard response and
835 * we have NSEC3 records */
836 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
837 nsec3s_seen = 1;
838 }
839 }
840
841 /* If this was a positive wildcard response that we haven't already
842 * proven, and we have NSEC3 records, try to prove it using the NSEC3
843 * records. */
844 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
845 enum sec_status sec = nsec3_prove_wildcard(env, ve,
846 chase_reply->rrsets+chase_reply->an_numrrsets,
847 chase_reply->ns_numrrsets, qchase, kkey, wc);
848 if(sec == sec_status_insecure) {
849 verbose(VERB_ALGO, "Positive wildcard response is "
850 "insecure");
851 chase_reply->security = sec_status_insecure;
852 return;
853 } else if(sec == sec_status_secure)
854 wc_NSEC_ok = 1;
855 }
856
857 /* If after all this, we still haven't proven the positive wildcard
858 * response, fail. */
859 if(wc != NULL && !wc_NSEC_ok) {
860 verbose(VERB_QUERY, "positive response was wildcard "
861 "expansion and did not prove original data "
862 "did not exist");
863 chase_reply->security = sec_status_bogus;
864 return;
865 }
866
867 verbose(VERB_ALGO, "Successfully validated positive response");
868 chase_reply->security = sec_status_secure;
869 }
870
871 /**
872 * Validate a NOERROR/NODATA signed response -- a response that has a
873 * NOERROR Rcode but no ANSWER section RRsets. This consists of making
874 * certain that the authority section NSEC/NSEC3s proves that the qname
875 * does exist and the qtype doesn't.
876 *
877 * The answer and authority RRsets must already be verified as secure.
878 *
879 * @param env: module env for verify.
880 * @param ve: validator env for verify.
881 * @param qchase: query that was made.
882 * @param chase_reply: answer to that query to validate.
883 * @param kkey: the key entry, which is trusted, and which matches
884 * the signer of the answer. The key entry isgood().
885 */
886 static void
validate_nodata_response(struct module_env * env,struct val_env * ve,struct query_info * qchase,struct reply_info * chase_reply,struct key_entry_key * kkey)887 validate_nodata_response(struct module_env* env, struct val_env* ve,
888 struct query_info* qchase, struct reply_info* chase_reply,
889 struct key_entry_key* kkey)
890 {
891 /* Since we are here, there must be nothing in the ANSWER section to
892 * validate. */
893 /* (Note: CNAME/DNAME responses will not directly get here --
894 * instead, they are chased down into individual CNAME validations,
895 * and at the end of the cname chain a POSITIVE, or CNAME_NOANSWER
896 * validation.) */
897
898 /* validate the AUTHORITY section */
899 int has_valid_nsec = 0; /* If true, then the NODATA has been proven.*/
900 uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
901 proven closest encloser. */
902 uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
903 int nsec3s_seen = 0; /* nsec3s seen */
904 struct ub_packed_rrset_key* s;
905 size_t i;
906
907 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
908 chase_reply->ns_numrrsets; i++) {
909 s = chase_reply->rrsets[i];
910 /* If we encounter an NSEC record, try to use it to prove
911 * NODATA.
912 * This needs to handle the ENT NODATA case. */
913 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
914 if(nsec_proves_nodata(s, qchase, &wc)) {
915 has_valid_nsec = 1;
916 /* sets wc-encloser if wildcard applicable */
917 }
918 if(val_nsec_proves_name_error(s, qchase->qname)) {
919 ce = nsec_closest_encloser(qchase->qname, s);
920 }
921 if(val_nsec_proves_insecuredelegation(s, qchase)) {
922 verbose(VERB_ALGO, "delegation is insecure");
923 chase_reply->security = sec_status_insecure;
924 return;
925 }
926 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
927 nsec3s_seen = 1;
928 }
929 }
930
931 /* check to see if we have a wildcard NODATA proof. */
932
933 /* The wildcard NODATA is 1 NSEC proving that qname does not exist
934 * (and also proving what the closest encloser is), and 1 NSEC
935 * showing the matching wildcard, which must be *.closest_encloser. */
936 if(wc && !ce)
937 has_valid_nsec = 0;
938 else if(wc && ce) {
939 if(query_dname_compare(wc, ce) != 0) {
940 has_valid_nsec = 0;
941 }
942 }
943
944 if(!has_valid_nsec && nsec3s_seen) {
945 enum sec_status sec = nsec3_prove_nodata(env, ve,
946 chase_reply->rrsets+chase_reply->an_numrrsets,
947 chase_reply->ns_numrrsets, qchase, kkey);
948 if(sec == sec_status_insecure) {
949 verbose(VERB_ALGO, "NODATA response is insecure");
950 chase_reply->security = sec_status_insecure;
951 return;
952 } else if(sec == sec_status_secure)
953 has_valid_nsec = 1;
954 }
955
956 if(!has_valid_nsec) {
957 verbose(VERB_QUERY, "NODATA response failed to prove NODATA "
958 "status with NSEC/NSEC3");
959 if(verbosity >= VERB_ALGO)
960 log_dns_msg("Failed NODATA", qchase, chase_reply);
961 chase_reply->security = sec_status_bogus;
962 return;
963 }
964
965 verbose(VERB_ALGO, "successfully validated NODATA response.");
966 chase_reply->security = sec_status_secure;
967 }
968
969 /**
970 * Validate a NAMEERROR signed response -- a response that has a NXDOMAIN
971 * Rcode.
972 * This consists of making certain that the authority section NSEC proves
973 * that the qname doesn't exist and the covering wildcard also doesn't exist..
974 *
975 * The answer and authority RRsets must have already been verified as secure.
976 *
977 * @param env: module env for verify.
978 * @param ve: validator env for verify.
979 * @param qchase: query that was made.
980 * @param chase_reply: answer to that query to validate.
981 * @param kkey: the key entry, which is trusted, and which matches
982 * the signer of the answer. The key entry isgood().
983 * @param rcode: adjusted RCODE, in case of RCODE/proof mismatch leniency.
984 */
985 static void
validate_nameerror_response(struct module_env * env,struct val_env * ve,struct query_info * qchase,struct reply_info * chase_reply,struct key_entry_key * kkey,int * rcode)986 validate_nameerror_response(struct module_env* env, struct val_env* ve,
987 struct query_info* qchase, struct reply_info* chase_reply,
988 struct key_entry_key* kkey, int* rcode)
989 {
990 int has_valid_nsec = 0;
991 int has_valid_wnsec = 0;
992 int nsec3s_seen = 0;
993 struct ub_packed_rrset_key* s;
994 size_t i;
995 uint8_t* ce;
996 int ce_labs = 0;
997 int prev_ce_labs = 0;
998
999 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1000 chase_reply->ns_numrrsets; i++) {
1001 s = chase_reply->rrsets[i];
1002 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1003 if(val_nsec_proves_name_error(s, qchase->qname))
1004 has_valid_nsec = 1;
1005 ce = nsec_closest_encloser(qchase->qname, s);
1006 ce_labs = dname_count_labels(ce);
1007 /* Use longest closest encloser to prove wildcard. */
1008 if(ce_labs > prev_ce_labs ||
1009 (ce_labs == prev_ce_labs &&
1010 has_valid_wnsec == 0)) {
1011 if(val_nsec_proves_no_wc(s, qchase->qname,
1012 qchase->qname_len))
1013 has_valid_wnsec = 1;
1014 else
1015 has_valid_wnsec = 0;
1016 }
1017 prev_ce_labs = ce_labs;
1018 if(val_nsec_proves_insecuredelegation(s, qchase)) {
1019 verbose(VERB_ALGO, "delegation is insecure");
1020 chase_reply->security = sec_status_insecure;
1021 return;
1022 }
1023 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3)
1024 nsec3s_seen = 1;
1025 }
1026
1027 if((!has_valid_nsec || !has_valid_wnsec) && nsec3s_seen) {
1028 /* use NSEC3 proof, both answer and auth rrsets, in case
1029 * NSEC3s end up in the answer (due to qtype=NSEC3 or so) */
1030 chase_reply->security = nsec3_prove_nameerror(env, ve,
1031 chase_reply->rrsets, chase_reply->an_numrrsets+
1032 chase_reply->ns_numrrsets, qchase, kkey);
1033 if(chase_reply->security != sec_status_secure) {
1034 verbose(VERB_QUERY, "NameError response failed nsec, "
1035 "nsec3 proof was %s", sec_status_to_string(
1036 chase_reply->security));
1037 return;
1038 }
1039 has_valid_nsec = 1;
1040 has_valid_wnsec = 1;
1041 }
1042
1043 /* If the message fails to prove either condition, it is bogus. */
1044 if(!has_valid_nsec) {
1045 verbose(VERB_QUERY, "NameError response has failed to prove: "
1046 "qname does not exist");
1047 chase_reply->security = sec_status_bogus;
1048 /* Be lenient with RCODE in NSEC NameError responses */
1049 validate_nodata_response(env, ve, qchase, chase_reply, kkey);
1050 if (chase_reply->security == sec_status_secure)
1051 *rcode = LDNS_RCODE_NOERROR;
1052 return;
1053 }
1054
1055 if(!has_valid_wnsec) {
1056 verbose(VERB_QUERY, "NameError response has failed to prove: "
1057 "covering wildcard does not exist");
1058 chase_reply->security = sec_status_bogus;
1059 /* Be lenient with RCODE in NSEC NameError responses */
1060 validate_nodata_response(env, ve, qchase, chase_reply, kkey);
1061 if (chase_reply->security == sec_status_secure)
1062 *rcode = LDNS_RCODE_NOERROR;
1063 return;
1064 }
1065
1066 /* Otherwise, we consider the message secure. */
1067 verbose(VERB_ALGO, "successfully validated NAME ERROR response.");
1068 chase_reply->security = sec_status_secure;
1069 }
1070
1071 /**
1072 * Given a referral response, validate rrsets and take least trusted rrset
1073 * as the current validation status.
1074 *
1075 * Note that by the time this method is called, the process of finding the
1076 * trusted DNSKEY rrset that signs this response must already have been
1077 * completed.
1078 *
1079 * @param chase_reply: answer to validate.
1080 */
1081 static void
validate_referral_response(struct reply_info * chase_reply)1082 validate_referral_response(struct reply_info* chase_reply)
1083 {
1084 size_t i;
1085 enum sec_status s;
1086 /* message security equals lowest rrset security */
1087 chase_reply->security = sec_status_secure;
1088 for(i=0; i<chase_reply->rrset_count; i++) {
1089 s = ((struct packed_rrset_data*)chase_reply->rrsets[i]
1090 ->entry.data)->security;
1091 if(s < chase_reply->security)
1092 chase_reply->security = s;
1093 }
1094 verbose(VERB_ALGO, "validated part of referral response as %s",
1095 sec_status_to_string(chase_reply->security));
1096 }
1097
1098 /**
1099 * Given an "ANY" response -- a response that contains an answer to a
1100 * qtype==ANY question, with answers. This does no checking that all
1101 * types are present.
1102 *
1103 * NOTE: it may be possible to get parent-side delegation point records
1104 * here, which won't all be signed. Right now, this routine relies on the
1105 * upstream iterative resolver to not return these responses -- instead
1106 * treating them as referrals.
1107 *
1108 * NOTE: RFC 4035 is silent on this issue, so this may change upon
1109 * clarification. Clarification draft -05 says to not check all types are
1110 * present.
1111 *
1112 * Note that by the time this method is called, the process of finding the
1113 * trusted DNSKEY rrset that signs this response must already have been
1114 * completed.
1115 *
1116 * @param env: module env for verify.
1117 * @param ve: validator env for verify.
1118 * @param qchase: query that was made.
1119 * @param chase_reply: answer to that query to validate.
1120 * @param kkey: the key entry, which is trusted, and which matches
1121 * the signer of the answer. The key entry isgood().
1122 */
1123 static void
validate_any_response(struct module_env * env,struct val_env * ve,struct query_info * qchase,struct reply_info * chase_reply,struct key_entry_key * kkey)1124 validate_any_response(struct module_env* env, struct val_env* ve,
1125 struct query_info* qchase, struct reply_info* chase_reply,
1126 struct key_entry_key* kkey)
1127 {
1128 /* all answer and auth rrsets already verified */
1129 /* but check if a wildcard response is given, then check NSEC/NSEC3
1130 * for qname denial to see if wildcard is applicable */
1131 uint8_t* wc = NULL;
1132 size_t wl;
1133 int wc_NSEC_ok = 0;
1134 int nsec3s_seen = 0;
1135 size_t i;
1136 struct ub_packed_rrset_key* s;
1137
1138 if(qchase->qtype != LDNS_RR_TYPE_ANY) {
1139 log_err("internal error: ANY validation called for non-ANY");
1140 chase_reply->security = sec_status_bogus;
1141 return;
1142 }
1143
1144 /* validate the ANSWER section - this will be the answer itself */
1145 for(i=0; i<chase_reply->an_numrrsets; i++) {
1146 s = chase_reply->rrsets[i];
1147
1148 /* Check to see if the rrset is the result of a wildcard
1149 * expansion. If so, an additional check will need to be
1150 * made in the authority section. */
1151 if(!val_rrset_wildcard(s, &wc, &wl)) {
1152 log_nametypeclass(VERB_QUERY, "Positive ANY response"
1153 " has inconsistent wildcard sigs:",
1154 s->rk.dname, ntohs(s->rk.type),
1155 ntohs(s->rk.rrset_class));
1156 chase_reply->security = sec_status_bogus;
1157 return;
1158 }
1159 }
1160
1161 /* if it was a wildcard, check for NSEC/NSEC3s in both answer
1162 * and authority sections (NSEC may be moved to the ANSWER section) */
1163 if(wc != NULL)
1164 for(i=0; i<chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
1165 i++) {
1166 s = chase_reply->rrsets[i];
1167
1168 /* If this is a positive wildcard response, and we have a
1169 * (just verified) NSEC record, try to use it to 1) prove
1170 * that qname doesn't exist and 2) that the correct wildcard
1171 * was used. */
1172 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1173 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1174 wc_NSEC_ok = 1;
1175 }
1176 /* if not, continue looking for proof */
1177 }
1178
1179 /* Otherwise, if this is a positive wildcard response and
1180 * we have NSEC3 records */
1181 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1182 nsec3s_seen = 1;
1183 }
1184 }
1185
1186 /* If this was a positive wildcard response that we haven't already
1187 * proven, and we have NSEC3 records, try to prove it using the NSEC3
1188 * records. */
1189 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1190 /* look both in answer and auth section for NSEC3s */
1191 enum sec_status sec = nsec3_prove_wildcard(env, ve,
1192 chase_reply->rrsets,
1193 chase_reply->an_numrrsets+chase_reply->ns_numrrsets,
1194 qchase, kkey, wc);
1195 if(sec == sec_status_insecure) {
1196 verbose(VERB_ALGO, "Positive ANY wildcard response is "
1197 "insecure");
1198 chase_reply->security = sec_status_insecure;
1199 return;
1200 } else if(sec == sec_status_secure)
1201 wc_NSEC_ok = 1;
1202 }
1203
1204 /* If after all this, we still haven't proven the positive wildcard
1205 * response, fail. */
1206 if(wc != NULL && !wc_NSEC_ok) {
1207 verbose(VERB_QUERY, "positive ANY response was wildcard "
1208 "expansion and did not prove original data "
1209 "did not exist");
1210 chase_reply->security = sec_status_bogus;
1211 return;
1212 }
1213
1214 verbose(VERB_ALGO, "Successfully validated positive ANY response");
1215 chase_reply->security = sec_status_secure;
1216 }
1217
1218 /**
1219 * Validate CNAME response, or DNAME+CNAME.
1220 * This is just like a positive proof, except that this is about a
1221 * DNAME+CNAME. Possible wildcard proof.
1222 * Difference with positive proof is that this routine refuses
1223 * wildcarded DNAMEs.
1224 *
1225 * The answer and authority rrsets must already be verified as secure.
1226 *
1227 * @param env: module env for verify.
1228 * @param ve: validator env for verify.
1229 * @param qchase: query that was made.
1230 * @param chase_reply: answer to that query to validate.
1231 * @param kkey: the key entry, which is trusted, and which matches
1232 * the signer of the answer. The key entry isgood().
1233 */
1234 static void
validate_cname_response(struct module_env * env,struct val_env * ve,struct query_info * qchase,struct reply_info * chase_reply,struct key_entry_key * kkey)1235 validate_cname_response(struct module_env* env, struct val_env* ve,
1236 struct query_info* qchase, struct reply_info* chase_reply,
1237 struct key_entry_key* kkey)
1238 {
1239 uint8_t* wc = NULL;
1240 size_t wl;
1241 int wc_NSEC_ok = 0;
1242 int nsec3s_seen = 0;
1243 size_t i;
1244 struct ub_packed_rrset_key* s;
1245
1246 /* validate the ANSWER section - this will be the CNAME (+DNAME) */
1247 for(i=0; i<chase_reply->an_numrrsets; i++) {
1248 s = chase_reply->rrsets[i];
1249
1250 /* Check to see if the rrset is the result of a wildcard
1251 * expansion. If so, an additional check will need to be
1252 * made in the authority section. */
1253 if(!val_rrset_wildcard(s, &wc, &wl)) {
1254 log_nametypeclass(VERB_QUERY, "Cname response has "
1255 "inconsistent wildcard sigs:", s->rk.dname,
1256 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1257 chase_reply->security = sec_status_bogus;
1258 return;
1259 }
1260
1261 /* Refuse wildcarded DNAMEs rfc 4597.
1262 * Do not follow a wildcarded DNAME because
1263 * its synthesized CNAME expansion is underdefined */
1264 if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
1265 ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME && wc) {
1266 log_nametypeclass(VERB_QUERY, "cannot validate a "
1267 "wildcarded DNAME:", s->rk.dname,
1268 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1269 chase_reply->security = sec_status_bogus;
1270 return;
1271 }
1272
1273 /* If we have found a CNAME, stop looking for one.
1274 * The iterator has placed the CNAME chain in correct
1275 * order. */
1276 if (ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
1277 break;
1278 }
1279 }
1280
1281 /* AUTHORITY section */
1282 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1283 chase_reply->ns_numrrsets; i++) {
1284 s = chase_reply->rrsets[i];
1285
1286 /* If this is a positive wildcard response, and we have a
1287 * (just verified) NSEC record, try to use it to 1) prove
1288 * that qname doesn't exist and 2) that the correct wildcard
1289 * was used. */
1290 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1291 if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1292 wc_NSEC_ok = 1;
1293 }
1294 /* if not, continue looking for proof */
1295 }
1296
1297 /* Otherwise, if this is a positive wildcard response and
1298 * we have NSEC3 records */
1299 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1300 nsec3s_seen = 1;
1301 }
1302 }
1303
1304 /* If this was a positive wildcard response that we haven't already
1305 * proven, and we have NSEC3 records, try to prove it using the NSEC3
1306 * records. */
1307 if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1308 enum sec_status sec = nsec3_prove_wildcard(env, ve,
1309 chase_reply->rrsets+chase_reply->an_numrrsets,
1310 chase_reply->ns_numrrsets, qchase, kkey, wc);
1311 if(sec == sec_status_insecure) {
1312 verbose(VERB_ALGO, "wildcard CNAME response is "
1313 "insecure");
1314 chase_reply->security = sec_status_insecure;
1315 return;
1316 } else if(sec == sec_status_secure)
1317 wc_NSEC_ok = 1;
1318 }
1319
1320 /* If after all this, we still haven't proven the positive wildcard
1321 * response, fail. */
1322 if(wc != NULL && !wc_NSEC_ok) {
1323 verbose(VERB_QUERY, "CNAME response was wildcard "
1324 "expansion and did not prove original data "
1325 "did not exist");
1326 chase_reply->security = sec_status_bogus;
1327 return;
1328 }
1329
1330 verbose(VERB_ALGO, "Successfully validated CNAME response");
1331 chase_reply->security = sec_status_secure;
1332 }
1333
1334 /**
1335 * Validate CNAME NOANSWER response, no more data after a CNAME chain.
1336 * This can be a NODATA or a NAME ERROR case, but not both at the same time.
1337 * We don't know because the rcode has been set to NOERROR by the CNAME.
1338 *
1339 * The answer and authority rrsets must already be verified as secure.
1340 *
1341 * @param env: module env for verify.
1342 * @param ve: validator env for verify.
1343 * @param qchase: query that was made.
1344 * @param chase_reply: answer to that query to validate.
1345 * @param kkey: the key entry, which is trusted, and which matches
1346 * the signer of the answer. The key entry isgood().
1347 */
1348 static void
validate_cname_noanswer_response(struct module_env * env,struct val_env * ve,struct query_info * qchase,struct reply_info * chase_reply,struct key_entry_key * kkey)1349 validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
1350 struct query_info* qchase, struct reply_info* chase_reply,
1351 struct key_entry_key* kkey)
1352 {
1353 int nodata_valid_nsec = 0; /* If true, then NODATA has been proven.*/
1354 uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
1355 proven closest encloser. */
1356 uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
1357 int nxdomain_valid_nsec = 0; /* if true, nameerror has been proven */
1358 int nxdomain_valid_wnsec = 0;
1359 int nsec3s_seen = 0; /* nsec3s seen */
1360 struct ub_packed_rrset_key* s;
1361 size_t i;
1362 uint8_t* nsec_ce; /* Used to find the NSEC with the longest ce */
1363 int ce_labs = 0;
1364 int prev_ce_labs = 0;
1365
1366 /* the AUTHORITY section */
1367 for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1368 chase_reply->ns_numrrsets; i++) {
1369 s = chase_reply->rrsets[i];
1370
1371 /* If we encounter an NSEC record, try to use it to prove
1372 * NODATA. This needs to handle the ENT NODATA case.
1373 * Also try to prove NAMEERROR, and absence of a wildcard */
1374 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1375 if(nsec_proves_nodata(s, qchase, &wc)) {
1376 nodata_valid_nsec = 1;
1377 /* set wc encloser if wildcard applicable */
1378 }
1379 if(val_nsec_proves_name_error(s, qchase->qname)) {
1380 ce = nsec_closest_encloser(qchase->qname, s);
1381 nxdomain_valid_nsec = 1;
1382 }
1383 nsec_ce = nsec_closest_encloser(qchase->qname, s);
1384 ce_labs = dname_count_labels(nsec_ce);
1385 /* Use longest closest encloser to prove wildcard. */
1386 if(ce_labs > prev_ce_labs ||
1387 (ce_labs == prev_ce_labs &&
1388 nxdomain_valid_wnsec == 0)) {
1389 if(val_nsec_proves_no_wc(s, qchase->qname,
1390 qchase->qname_len))
1391 nxdomain_valid_wnsec = 1;
1392 else
1393 nxdomain_valid_wnsec = 0;
1394 }
1395 prev_ce_labs = ce_labs;
1396 if(val_nsec_proves_insecuredelegation(s, qchase)) {
1397 verbose(VERB_ALGO, "delegation is insecure");
1398 chase_reply->security = sec_status_insecure;
1399 return;
1400 }
1401 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1402 nsec3s_seen = 1;
1403 }
1404 }
1405
1406 /* check to see if we have a wildcard NODATA proof. */
1407
1408 /* The wildcard NODATA is 1 NSEC proving that qname does not exists
1409 * (and also proving what the closest encloser is), and 1 NSEC
1410 * showing the matching wildcard, which must be *.closest_encloser. */
1411 if(wc && !ce)
1412 nodata_valid_nsec = 0;
1413 else if(wc && ce) {
1414 if(query_dname_compare(wc, ce) != 0) {
1415 nodata_valid_nsec = 0;
1416 }
1417 }
1418 if(nxdomain_valid_nsec && !nxdomain_valid_wnsec) {
1419 /* name error is missing wildcard denial proof */
1420 nxdomain_valid_nsec = 0;
1421 }
1422
1423 if(nodata_valid_nsec && nxdomain_valid_nsec) {
1424 verbose(VERB_QUERY, "CNAMEchain to noanswer proves that name "
1425 "exists and not exists, bogus");
1426 chase_reply->security = sec_status_bogus;
1427 return;
1428 }
1429 if(!nodata_valid_nsec && !nxdomain_valid_nsec && nsec3s_seen) {
1430 int nodata;
1431 enum sec_status sec = nsec3_prove_nxornodata(env, ve,
1432 chase_reply->rrsets+chase_reply->an_numrrsets,
1433 chase_reply->ns_numrrsets, qchase, kkey, &nodata);
1434 if(sec == sec_status_insecure) {
1435 verbose(VERB_ALGO, "CNAMEchain to noanswer response "
1436 "is insecure");
1437 chase_reply->security = sec_status_insecure;
1438 return;
1439 } else if(sec == sec_status_secure) {
1440 if(nodata)
1441 nodata_valid_nsec = 1;
1442 else nxdomain_valid_nsec = 1;
1443 }
1444 }
1445
1446 if(!nodata_valid_nsec && !nxdomain_valid_nsec) {
1447 verbose(VERB_QUERY, "CNAMEchain to noanswer response failed "
1448 "to prove status with NSEC/NSEC3");
1449 if(verbosity >= VERB_ALGO)
1450 log_dns_msg("Failed CNAMEnoanswer", qchase, chase_reply);
1451 chase_reply->security = sec_status_bogus;
1452 return;
1453 }
1454
1455 if(nodata_valid_nsec)
1456 verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1457 "NODATA response.");
1458 else verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1459 "NAMEERROR response.");
1460 chase_reply->security = sec_status_secure;
1461 }
1462
1463 /**
1464 * Process init state for validator.
1465 * Process the INIT state. First tier responses start in the INIT state.
1466 * This is where they are vetted for validation suitability, and the initial
1467 * key search is done.
1468 *
1469 * Currently, events the come through this routine will be either promoted
1470 * to FINISHED/CNAME_RESP (no validation needed), FINDKEY (next step to
1471 * validation), or will be (temporarily) retired and a new priming request
1472 * event will be generated.
1473 *
1474 * @param qstate: query state.
1475 * @param vq: validator query state.
1476 * @param ve: validator shared global environment.
1477 * @param id: module id.
1478 * @return true if the event should be processed further on return, false if
1479 * not.
1480 */
1481 static int
processInit(struct module_qstate * qstate,struct val_qstate * vq,struct val_env * ve,int id)1482 processInit(struct module_qstate* qstate, struct val_qstate* vq,
1483 struct val_env* ve, int id)
1484 {
1485 uint8_t* lookup_name;
1486 size_t lookup_len;
1487 struct trust_anchor* anchor;
1488 enum val_classification subtype = val_classify_response(
1489 qstate->query_flags, &qstate->qinfo, &vq->qchase,
1490 vq->orig_msg->rep, vq->rrset_skip);
1491 if(vq->restart_count > ve->max_restart) {
1492 verbose(VERB_ALGO, "restart count exceeded");
1493 return val_error(qstate, id);
1494 }
1495 verbose(VERB_ALGO, "validator classification %s",
1496 val_classification_to_string(subtype));
1497 if(subtype == VAL_CLASS_REFERRAL &&
1498 vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
1499 /* referral uses the rrset name as qchase, to find keys for
1500 * that rrset */
1501 vq->qchase.qname = vq->orig_msg->rep->
1502 rrsets[vq->rrset_skip]->rk.dname;
1503 vq->qchase.qname_len = vq->orig_msg->rep->
1504 rrsets[vq->rrset_skip]->rk.dname_len;
1505 vq->qchase.qtype = ntohs(vq->orig_msg->rep->
1506 rrsets[vq->rrset_skip]->rk.type);
1507 vq->qchase.qclass = ntohs(vq->orig_msg->rep->
1508 rrsets[vq->rrset_skip]->rk.rrset_class);
1509 }
1510 lookup_name = vq->qchase.qname;
1511 lookup_len = vq->qchase.qname_len;
1512 /* for type DS look at the parent side for keys/trustanchor */
1513 /* also for NSEC not at apex */
1514 if(vq->qchase.qtype == LDNS_RR_TYPE_DS ||
1515 (vq->qchase.qtype == LDNS_RR_TYPE_NSEC &&
1516 vq->orig_msg->rep->rrset_count > vq->rrset_skip &&
1517 ntohs(vq->orig_msg->rep->rrsets[vq->rrset_skip]->rk.type) ==
1518 LDNS_RR_TYPE_NSEC &&
1519 !(vq->orig_msg->rep->rrsets[vq->rrset_skip]->
1520 rk.flags&PACKED_RRSET_NSEC_AT_APEX))) {
1521 dname_remove_label(&lookup_name, &lookup_len);
1522 }
1523
1524 val_mark_indeterminate(vq->chase_reply, qstate->env->anchors,
1525 qstate->env->rrset_cache, qstate->env);
1526 vq->key_entry = NULL;
1527 vq->empty_DS_name = NULL;
1528 vq->ds_rrset = 0;
1529 anchor = anchors_lookup(qstate->env->anchors,
1530 lookup_name, lookup_len, vq->qchase.qclass);
1531
1532 /* Determine the signer/lookup name */
1533 val_find_signer(subtype, &vq->qchase, vq->orig_msg->rep,
1534 vq->rrset_skip, &vq->signer_name, &vq->signer_len);
1535 if(vq->signer_name != NULL &&
1536 !dname_subdomain_c(lookup_name, vq->signer_name)) {
1537 log_nametypeclass(VERB_ALGO, "this signer name is not a parent "
1538 "of lookupname, omitted", vq->signer_name, 0, 0);
1539 vq->signer_name = NULL;
1540 }
1541 if(vq->signer_name == NULL) {
1542 log_nametypeclass(VERB_ALGO, "no signer, using", lookup_name,
1543 0, 0);
1544 } else {
1545 lookup_name = vq->signer_name;
1546 lookup_len = vq->signer_len;
1547 log_nametypeclass(VERB_ALGO, "signer is", lookup_name, 0, 0);
1548 }
1549
1550 /* for NXDOMAIN it could be signed by a parent of the trust anchor */
1551 if(subtype == VAL_CLASS_NAMEERROR && vq->signer_name &&
1552 anchor && dname_strict_subdomain_c(anchor->name, lookup_name)){
1553 lock_basic_unlock(&anchor->lock);
1554 anchor = anchors_lookup(qstate->env->anchors,
1555 lookup_name, lookup_len, vq->qchase.qclass);
1556 if(!anchor) { /* unsigned parent denies anchor*/
1557 verbose(VERB_QUERY, "unsigned parent zone denies"
1558 " trust anchor, indeterminate");
1559 vq->chase_reply->security = sec_status_indeterminate;
1560 vq->state = VAL_FINISHED_STATE;
1561 return 1;
1562 }
1563 verbose(VERB_ALGO, "trust anchor NXDOMAIN by signed parent");
1564 } else if(subtype == VAL_CLASS_POSITIVE &&
1565 qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY &&
1566 query_dname_compare(lookup_name, qstate->qinfo.qname) == 0) {
1567 /* is a DNSKEY so lookup a bit higher since we want to
1568 * get it from a parent or from trustanchor */
1569 dname_remove_label(&lookup_name, &lookup_len);
1570 }
1571
1572 if(vq->rrset_skip > 0 || subtype == VAL_CLASS_CNAME ||
1573 subtype == VAL_CLASS_REFERRAL) {
1574 /* extract this part of orig_msg into chase_reply for
1575 * the eventual VALIDATE stage */
1576 val_fill_reply(vq->chase_reply, vq->orig_msg->rep,
1577 vq->rrset_skip, lookup_name, lookup_len,
1578 vq->signer_name);
1579 if(verbosity >= VERB_ALGO)
1580 log_dns_msg("chased extract", &vq->qchase,
1581 vq->chase_reply);
1582 }
1583
1584 vq->key_entry = key_cache_obtain(ve->kcache, lookup_name, lookup_len,
1585 vq->qchase.qclass, qstate->region, *qstate->env->now);
1586
1587 /* there is no key and no trust anchor */
1588 if(vq->key_entry == NULL && anchor == NULL) {
1589 /*response isn't under a trust anchor, so we cannot validate.*/
1590 vq->chase_reply->security = sec_status_indeterminate;
1591 /* go to finished state to cache this result */
1592 vq->state = VAL_FINISHED_STATE;
1593 return 1;
1594 }
1595 /* if not key, or if keyentry is *above* the trustanchor, i.e.
1596 * the keyentry is based on another (higher) trustanchor */
1597 else if(vq->key_entry == NULL || (anchor &&
1598 dname_strict_subdomain_c(anchor->name, vq->key_entry->name))) {
1599 /* trust anchor is an 'unsigned' trust anchor */
1600 if(anchor && anchor->numDS == 0 && anchor->numDNSKEY == 0) {
1601 vq->chase_reply->security = sec_status_insecure;
1602 val_mark_insecure(vq->chase_reply, anchor->name,
1603 qstate->env->rrset_cache, qstate->env);
1604 lock_basic_unlock(&anchor->lock);
1605 /* go to finished state to cache this result */
1606 vq->state = VAL_FINISHED_STATE;
1607 return 1;
1608 }
1609 /* fire off a trust anchor priming query. */
1610 verbose(VERB_DETAIL, "prime trust anchor");
1611 if(!prime_trust_anchor(qstate, vq, id, anchor)) {
1612 lock_basic_unlock(&anchor->lock);
1613 return val_error(qstate, id);
1614 }
1615 lock_basic_unlock(&anchor->lock);
1616 /* and otherwise, don't continue processing this event.
1617 * (it will be reactivated when the priming query returns). */
1618 vq->state = VAL_FINDKEY_STATE;
1619 return 0;
1620 }
1621 if(anchor) {
1622 lock_basic_unlock(&anchor->lock);
1623 }
1624
1625 if(key_entry_isnull(vq->key_entry)) {
1626 /* response is under a null key, so we cannot validate
1627 * However, we do set the status to INSECURE, since it is
1628 * essentially proven insecure. */
1629 vq->chase_reply->security = sec_status_insecure;
1630 val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1631 qstate->env->rrset_cache, qstate->env);
1632 /* go to finished state to cache this result */
1633 vq->state = VAL_FINISHED_STATE;
1634 return 1;
1635 } else if(key_entry_isbad(vq->key_entry)) {
1636 /* key is bad, chain is bad, reply is bogus */
1637 errinf_dname(qstate, "key for validation", vq->key_entry->name);
1638 errinf(qstate, "is marked as invalid");
1639 if(key_entry_get_reason(vq->key_entry)) {
1640 errinf(qstate, "because of a previous");
1641 errinf(qstate, key_entry_get_reason(vq->key_entry));
1642 }
1643 /* no retries, stop bothering the authority until timeout */
1644 vq->restart_count = ve->max_restart;
1645 vq->chase_reply->security = sec_status_bogus;
1646 vq->state = VAL_FINISHED_STATE;
1647 return 1;
1648 }
1649
1650 /* otherwise, we have our "closest" cached key -- continue
1651 * processing in the next state. */
1652 vq->state = VAL_FINDKEY_STATE;
1653 return 1;
1654 }
1655
1656 /**
1657 * Process the FINDKEY state. Generally this just calculates the next name
1658 * to query and either issues a DS or a DNSKEY query. It will check to see
1659 * if the correct key has already been reached, in which case it will
1660 * advance the event to the next state.
1661 *
1662 * @param qstate: query state.
1663 * @param vq: validator query state.
1664 * @param id: module id.
1665 * @return true if the event should be processed further on return, false if
1666 * not.
1667 */
1668 static int
processFindKey(struct module_qstate * qstate,struct val_qstate * vq,int id)1669 processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
1670 {
1671 uint8_t* target_key_name, *current_key_name;
1672 size_t target_key_len;
1673 int strip_lab;
1674 struct module_qstate* newq = NULL;
1675
1676 log_query_info(VERB_ALGO, "validator: FindKey", &vq->qchase);
1677 /* We know that state.key_entry is not 0 or bad key -- if it were,
1678 * then previous processing should have directed this event to
1679 * a different state.
1680 * It could be an isnull key, which signals the DNSKEY failed
1681 * with retry and has to be looked up again. */
1682 log_assert(vq->key_entry && !key_entry_isbad(vq->key_entry));
1683 if(key_entry_isnull(vq->key_entry)) {
1684 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1685 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1686 vq->qchase.qclass, BIT_CD, &newq, 0)) {
1687 verbose(VERB_ALGO, "error generating DNSKEY request");
1688 return val_error(qstate, id);
1689 }
1690 return 0;
1691 }
1692
1693 target_key_name = vq->signer_name;
1694 target_key_len = vq->signer_len;
1695 if(!target_key_name) {
1696 target_key_name = vq->qchase.qname;
1697 target_key_len = vq->qchase.qname_len;
1698 }
1699
1700 current_key_name = vq->key_entry->name;
1701
1702 /* If our current key entry matches our target, then we are done. */
1703 if(query_dname_compare(target_key_name, current_key_name) == 0) {
1704 vq->state = VAL_VALIDATE_STATE;
1705 return 1;
1706 }
1707
1708 if(vq->empty_DS_name) {
1709 /* if the last empty nonterminal/emptyDS name we detected is
1710 * below the current key, use that name to make progress
1711 * along the chain of trust */
1712 if(query_dname_compare(target_key_name,
1713 vq->empty_DS_name) == 0) {
1714 /* do not query for empty_DS_name again */
1715 verbose(VERB_ALGO, "Cannot retrieve DS for signature");
1716 errinf(qstate, "no signatures");
1717 errinf_origin(qstate, qstate->reply_origin);
1718 vq->chase_reply->security = sec_status_bogus;
1719 vq->state = VAL_FINISHED_STATE;
1720 return 1;
1721 }
1722 current_key_name = vq->empty_DS_name;
1723 }
1724
1725 log_nametypeclass(VERB_ALGO, "current keyname", current_key_name,
1726 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1727 log_nametypeclass(VERB_ALGO, "target keyname", target_key_name,
1728 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1729 /* assert we are walking down the DNS tree */
1730 if(!dname_subdomain_c(target_key_name, current_key_name)) {
1731 verbose(VERB_ALGO, "bad signer name");
1732 vq->chase_reply->security = sec_status_bogus;
1733 vq->state = VAL_FINISHED_STATE;
1734 return 1;
1735 }
1736 /* so this value is >= -1 */
1737 strip_lab = dname_count_labels(target_key_name) -
1738 dname_count_labels(current_key_name) - 1;
1739 log_assert(strip_lab >= -1);
1740 verbose(VERB_ALGO, "striplab %d", strip_lab);
1741 if(strip_lab > 0) {
1742 dname_remove_labels(&target_key_name, &target_key_len,
1743 strip_lab);
1744 }
1745 log_nametypeclass(VERB_ALGO, "next keyname", target_key_name,
1746 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1747
1748 /* The next step is either to query for the next DS, or to query
1749 * for the next DNSKEY. */
1750 if(vq->ds_rrset)
1751 log_nametypeclass(VERB_ALGO, "DS RRset", vq->ds_rrset->rk.dname, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN);
1752 else verbose(VERB_ALGO, "No DS RRset");
1753
1754 if(vq->ds_rrset && query_dname_compare(vq->ds_rrset->rk.dname,
1755 vq->key_entry->name) != 0) {
1756 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1757 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1758 vq->qchase.qclass, BIT_CD, &newq, 0)) {
1759 verbose(VERB_ALGO, "error generating DNSKEY request");
1760 return val_error(qstate, id);
1761 }
1762 return 0;
1763 }
1764
1765 if(!vq->ds_rrset || query_dname_compare(vq->ds_rrset->rk.dname,
1766 target_key_name) != 0) {
1767 /* check if there is a cache entry : pick up an NSEC if
1768 * there is no DS, check if that NSEC has DS-bit unset, and
1769 * thus can disprove the secure delegation we seek.
1770 * We can then use that NSEC even in the absence of a SOA
1771 * record that would be required by the iterator to supply
1772 * a completely protocol-correct response.
1773 * Uses negative cache for NSEC3 lookup of DS responses. */
1774 /* only if cache not blacklisted, of course */
1775 struct dns_msg* msg;
1776 if(!qstate->blacklist && !vq->chain_blacklist &&
1777 (msg=val_find_DS(qstate->env, target_key_name,
1778 target_key_len, vq->qchase.qclass, qstate->region,
1779 vq->key_entry->name)) ) {
1780 verbose(VERB_ALGO, "Process cached DS response");
1781 process_ds_response(qstate, vq, id, LDNS_RCODE_NOERROR,
1782 msg, &msg->qinfo, NULL);
1783 return 1; /* continue processing ds-response results */
1784 }
1785 if(!generate_request(qstate, id, target_key_name,
1786 target_key_len, LDNS_RR_TYPE_DS, vq->qchase.qclass,
1787 BIT_CD, &newq, 0)) {
1788 verbose(VERB_ALGO, "error generating DS request");
1789 return val_error(qstate, id);
1790 }
1791 return 0;
1792 }
1793
1794 /* Otherwise, it is time to query for the DNSKEY */
1795 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1796 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1797 vq->qchase.qclass, BIT_CD, &newq, 0)) {
1798 verbose(VERB_ALGO, "error generating DNSKEY request");
1799 return val_error(qstate, id);
1800 }
1801
1802 return 0;
1803 }
1804
1805 /**
1806 * Process the VALIDATE stage, the init and findkey stages are finished,
1807 * and the right keys are available to validate the response.
1808 * Or, there are no keys available, in order to invalidate the response.
1809 *
1810 * After validation, the status is recorded in the message and rrsets,
1811 * and finished state is started.
1812 *
1813 * @param qstate: query state.
1814 * @param vq: validator query state.
1815 * @param ve: validator shared global environment.
1816 * @param id: module id.
1817 * @return true if the event should be processed further on return, false if
1818 * not.
1819 */
1820 static int
processValidate(struct module_qstate * qstate,struct val_qstate * vq,struct val_env * ve,int id)1821 processValidate(struct module_qstate* qstate, struct val_qstate* vq,
1822 struct val_env* ve, int id)
1823 {
1824 enum val_classification subtype;
1825 int rcode;
1826
1827 if(!vq->key_entry) {
1828 verbose(VERB_ALGO, "validate: no key entry, failed");
1829 return val_error(qstate, id);
1830 }
1831
1832 /* This is the default next state. */
1833 vq->state = VAL_FINISHED_STATE;
1834
1835 /* Unsigned responses must be underneath a "null" key entry.*/
1836 if(key_entry_isnull(vq->key_entry)) {
1837 verbose(VERB_DETAIL, "Verified that %sresponse is INSECURE",
1838 vq->signer_name?"":"unsigned ");
1839 vq->chase_reply->security = sec_status_insecure;
1840 val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1841 qstate->env->rrset_cache, qstate->env);
1842 key_cache_insert(ve->kcache, vq->key_entry, qstate);
1843 return 1;
1844 }
1845
1846 if(key_entry_isbad(vq->key_entry)) {
1847 log_nametypeclass(VERB_DETAIL, "Could not establish a chain "
1848 "of trust to keys for", vq->key_entry->name,
1849 LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class);
1850 vq->chase_reply->security = sec_status_bogus;
1851 errinf(qstate, "while building chain of trust");
1852 if(vq->restart_count >= ve->max_restart)
1853 key_cache_insert(ve->kcache, vq->key_entry, qstate);
1854 return 1;
1855 }
1856
1857 /* signerName being null is the indicator that this response was
1858 * unsigned */
1859 if(vq->signer_name == NULL) {
1860 log_query_info(VERB_ALGO, "processValidate: state has no "
1861 "signer name", &vq->qchase);
1862 verbose(VERB_DETAIL, "Could not establish validation of "
1863 "INSECURE status of unsigned response.");
1864 errinf(qstate, "no signatures");
1865 errinf_origin(qstate, qstate->reply_origin);
1866 vq->chase_reply->security = sec_status_bogus;
1867 return 1;
1868 }
1869 subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
1870 &vq->qchase, vq->orig_msg->rep, vq->rrset_skip);
1871 if(subtype != VAL_CLASS_REFERRAL)
1872 remove_spurious_authority(vq->chase_reply, vq->orig_msg->rep);
1873
1874 /* check signatures in the message;
1875 * answer and authority must be valid, additional is only checked. */
1876 if(!validate_msg_signatures(qstate, qstate->env, ve, &vq->qchase,
1877 vq->chase_reply, vq->key_entry)) {
1878 /* workaround bad recursor out there that truncates (even
1879 * with EDNS4k) to 512 by removing RRSIG from auth section
1880 * for positive replies*/
1881 if((subtype == VAL_CLASS_POSITIVE || subtype == VAL_CLASS_ANY
1882 || subtype == VAL_CLASS_CNAME) &&
1883 detect_wrongly_truncated(vq->orig_msg->rep)) {
1884 /* truncate the message some more */
1885 vq->orig_msg->rep->ns_numrrsets = 0;
1886 vq->orig_msg->rep->ar_numrrsets = 0;
1887 vq->orig_msg->rep->rrset_count =
1888 vq->orig_msg->rep->an_numrrsets;
1889 vq->chase_reply->ns_numrrsets = 0;
1890 vq->chase_reply->ar_numrrsets = 0;
1891 vq->chase_reply->rrset_count =
1892 vq->chase_reply->an_numrrsets;
1893 qstate->errinf = NULL;
1894 }
1895 else {
1896 verbose(VERB_DETAIL, "Validate: message contains "
1897 "bad rrsets");
1898 return 1;
1899 }
1900 }
1901
1902 switch(subtype) {
1903 case VAL_CLASS_POSITIVE:
1904 verbose(VERB_ALGO, "Validating a positive response");
1905 validate_positive_response(qstate->env, ve,
1906 &vq->qchase, vq->chase_reply, vq->key_entry);
1907 verbose(VERB_DETAIL, "validate(positive): %s",
1908 sec_status_to_string(
1909 vq->chase_reply->security));
1910 break;
1911
1912 case VAL_CLASS_NODATA:
1913 verbose(VERB_ALGO, "Validating a nodata response");
1914 validate_nodata_response(qstate->env, ve,
1915 &vq->qchase, vq->chase_reply, vq->key_entry);
1916 verbose(VERB_DETAIL, "validate(nodata): %s",
1917 sec_status_to_string(
1918 vq->chase_reply->security));
1919 break;
1920
1921 case VAL_CLASS_NAMEERROR:
1922 rcode = (int)FLAGS_GET_RCODE(vq->orig_msg->rep->flags);
1923 verbose(VERB_ALGO, "Validating a nxdomain response");
1924 validate_nameerror_response(qstate->env, ve,
1925 &vq->qchase, vq->chase_reply, vq->key_entry, &rcode);
1926 verbose(VERB_DETAIL, "validate(nxdomain): %s",
1927 sec_status_to_string(
1928 vq->chase_reply->security));
1929 FLAGS_SET_RCODE(vq->orig_msg->rep->flags, rcode);
1930 FLAGS_SET_RCODE(vq->chase_reply->flags, rcode);
1931 break;
1932
1933 case VAL_CLASS_CNAME:
1934 verbose(VERB_ALGO, "Validating a cname response");
1935 validate_cname_response(qstate->env, ve,
1936 &vq->qchase, vq->chase_reply, vq->key_entry);
1937 verbose(VERB_DETAIL, "validate(cname): %s",
1938 sec_status_to_string(
1939 vq->chase_reply->security));
1940 break;
1941
1942 case VAL_CLASS_CNAMENOANSWER:
1943 verbose(VERB_ALGO, "Validating a cname noanswer "
1944 "response");
1945 validate_cname_noanswer_response(qstate->env, ve,
1946 &vq->qchase, vq->chase_reply, vq->key_entry);
1947 verbose(VERB_DETAIL, "validate(cname_noanswer): %s",
1948 sec_status_to_string(
1949 vq->chase_reply->security));
1950 break;
1951
1952 case VAL_CLASS_REFERRAL:
1953 verbose(VERB_ALGO, "Validating a referral response");
1954 validate_referral_response(vq->chase_reply);
1955 verbose(VERB_DETAIL, "validate(referral): %s",
1956 sec_status_to_string(
1957 vq->chase_reply->security));
1958 break;
1959
1960 case VAL_CLASS_ANY:
1961 verbose(VERB_ALGO, "Validating a positive ANY "
1962 "response");
1963 validate_any_response(qstate->env, ve, &vq->qchase,
1964 vq->chase_reply, vq->key_entry);
1965 verbose(VERB_DETAIL, "validate(positive_any): %s",
1966 sec_status_to_string(
1967 vq->chase_reply->security));
1968 break;
1969
1970 default:
1971 log_err("validate: unhandled response subtype: %d",
1972 subtype);
1973 }
1974 if(vq->chase_reply->security == sec_status_bogus) {
1975 if(subtype == VAL_CLASS_POSITIVE)
1976 errinf(qstate, "wildcard");
1977 else errinf(qstate, val_classification_to_string(subtype));
1978 errinf(qstate, "proof failed");
1979 errinf_origin(qstate, qstate->reply_origin);
1980 }
1981
1982 return 1;
1983 }
1984
1985 /**
1986 * The Finished state. The validation status (good or bad) has been determined.
1987 *
1988 * @param qstate: query state.
1989 * @param vq: validator query state.
1990 * @param ve: validator shared global environment.
1991 * @param id: module id.
1992 * @return true if the event should be processed further on return, false if
1993 * not.
1994 */
1995 static int
processFinished(struct module_qstate * qstate,struct val_qstate * vq,struct val_env * ve,int id)1996 processFinished(struct module_qstate* qstate, struct val_qstate* vq,
1997 struct val_env* ve, int id)
1998 {
1999 enum val_classification subtype = val_classify_response(
2000 qstate->query_flags, &qstate->qinfo, &vq->qchase,
2001 vq->orig_msg->rep, vq->rrset_skip);
2002
2003 /* store overall validation result in orig_msg */
2004 if(vq->rrset_skip == 0)
2005 vq->orig_msg->rep->security = vq->chase_reply->security;
2006 else if(subtype != VAL_CLASS_REFERRAL ||
2007 vq->rrset_skip < vq->orig_msg->rep->an_numrrsets +
2008 vq->orig_msg->rep->ns_numrrsets) {
2009 /* ignore sec status of additional section if a referral
2010 * type message skips there and
2011 * use the lowest security status as end result. */
2012 if(vq->chase_reply->security < vq->orig_msg->rep->security)
2013 vq->orig_msg->rep->security =
2014 vq->chase_reply->security;
2015 }
2016
2017 if(subtype == VAL_CLASS_REFERRAL) {
2018 /* for a referral, move to next unchecked rrset and check it*/
2019 vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep,
2020 vq->rrset_skip);
2021 if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
2022 /* and restart for this rrset */
2023 verbose(VERB_ALGO, "validator: go to next rrset");
2024 vq->chase_reply->security = sec_status_unchecked;
2025 vq->state = VAL_INIT_STATE;
2026 return 1;
2027 }
2028 /* referral chase is done */
2029 }
2030 if(vq->chase_reply->security != sec_status_bogus &&
2031 subtype == VAL_CLASS_CNAME) {
2032 /* chase the CNAME; process next part of the message */
2033 if(!val_chase_cname(&vq->qchase, vq->orig_msg->rep,
2034 &vq->rrset_skip)) {
2035 verbose(VERB_ALGO, "validator: failed to chase CNAME");
2036 vq->orig_msg->rep->security = sec_status_bogus;
2037 } else {
2038 /* restart process for new qchase at rrset_skip */
2039 log_query_info(VERB_ALGO, "validator: chased to",
2040 &vq->qchase);
2041 vq->chase_reply->security = sec_status_unchecked;
2042 vq->state = VAL_INIT_STATE;
2043 return 1;
2044 }
2045 }
2046
2047 if(vq->orig_msg->rep->security == sec_status_secure) {
2048 /* If the message is secure, check that all rrsets are
2049 * secure (i.e. some inserted RRset for CNAME chain with
2050 * a different signer name). And drop additional rrsets
2051 * that are not secure (if clean-additional option is set) */
2052 /* this may cause the msg to be marked bogus */
2053 val_check_nonsecure(qstate->env, vq->orig_msg->rep);
2054 if(vq->orig_msg->rep->security == sec_status_secure) {
2055 log_query_info(VERB_DETAIL, "validation success",
2056 &qstate->qinfo);
2057 if(!qstate->no_cache_store) {
2058 val_neg_addreply(qstate->env->neg_cache,
2059 vq->orig_msg->rep);
2060 }
2061 }
2062 }
2063
2064 /* if the result is bogus - set message ttl to bogus ttl to avoid
2065 * endless bogus revalidation */
2066 if(vq->orig_msg->rep->security == sec_status_bogus) {
2067 /* see if we can try again to fetch data */
2068 if(vq->restart_count < ve->max_restart) {
2069 int restart_count = vq->restart_count+1;
2070 verbose(VERB_ALGO, "validation failed, "
2071 "blacklist and retry to fetch data");
2072 val_blacklist(&qstate->blacklist, qstate->region,
2073 qstate->reply_origin, 0);
2074 qstate->reply_origin = NULL;
2075 qstate->errinf = NULL;
2076 memset(vq, 0, sizeof(*vq));
2077 vq->restart_count = restart_count;
2078 vq->state = VAL_INIT_STATE;
2079 verbose(VERB_ALGO, "pass back to next module");
2080 qstate->ext_state[id] = module_restart_next;
2081 return 0;
2082 }
2083
2084 vq->orig_msg->rep->ttl = ve->bogus_ttl;
2085 vq->orig_msg->rep->prefetch_ttl =
2086 PREFETCH_TTL_CALC(vq->orig_msg->rep->ttl);
2087 vq->orig_msg->rep->serve_expired_ttl =
2088 vq->orig_msg->rep->ttl + qstate->env->cfg->serve_expired_ttl;
2089 if((qstate->env->cfg->val_log_level >= 1 ||
2090 qstate->env->cfg->log_servfail) &&
2091 !qstate->env->cfg->val_log_squelch) {
2092 if(qstate->env->cfg->val_log_level < 2 &&
2093 !qstate->env->cfg->log_servfail)
2094 log_query_info(NO_VERBOSE, "validation failure",
2095 &qstate->qinfo);
2096 else {
2097 char* err = errinf_to_str_bogus(qstate);
2098 if(err) log_info("%s", err);
2099 free(err);
2100 }
2101 }
2102 /*
2103 * If set, the validator will not make messages bogus, instead
2104 * indeterminate is issued, so that no clients receive SERVFAIL.
2105 * This allows an operator to run validation 'shadow' without
2106 * hurting responses to clients.
2107 */
2108 /* If we are in permissive mode, bogus gets indeterminate */
2109 if(qstate->env->cfg->val_permissive_mode)
2110 vq->orig_msg->rep->security = sec_status_indeterminate;
2111 }
2112
2113 if(vq->orig_msg->rep->security == sec_status_secure &&
2114 qstate->env->cfg->root_key_sentinel &&
2115 (qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
2116 qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)) {
2117 char* keytag_start;
2118 uint16_t keytag;
2119 if(*qstate->qinfo.qname == strlen(SENTINEL_IS) +
2120 SENTINEL_KEYTAG_LEN &&
2121 dname_lab_startswith(qstate->qinfo.qname, SENTINEL_IS,
2122 &keytag_start)) {
2123 if(sentinel_get_keytag(keytag_start, &keytag) &&
2124 !anchor_has_keytag(qstate->env->anchors,
2125 (uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) {
2126 vq->orig_msg->rep->security =
2127 sec_status_secure_sentinel_fail;
2128 }
2129 } else if(*qstate->qinfo.qname == strlen(SENTINEL_NOT) +
2130 SENTINEL_KEYTAG_LEN &&
2131 dname_lab_startswith(qstate->qinfo.qname, SENTINEL_NOT,
2132 &keytag_start)) {
2133 if(sentinel_get_keytag(keytag_start, &keytag) &&
2134 anchor_has_keytag(qstate->env->anchors,
2135 (uint8_t*)"", 1, 0, vq->qchase.qclass, keytag)) {
2136 vq->orig_msg->rep->security =
2137 sec_status_secure_sentinel_fail;
2138 }
2139 }
2140 }
2141 /* store results in cache */
2142 if(qstate->query_flags&BIT_RD) {
2143 /* if secure, this will override cache anyway, no need
2144 * to check if from parentNS */
2145 if(!qstate->no_cache_store) {
2146 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2147 vq->orig_msg->rep, 0, qstate->prefetch_leeway, 0, NULL,
2148 qstate->query_flags)) {
2149 log_err("out of memory caching validator results");
2150 }
2151 }
2152 } else {
2153 /* for a referral, store the verified RRsets */
2154 /* and this does not get prefetched, so no leeway */
2155 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2156 vq->orig_msg->rep, 1, 0, 0, NULL,
2157 qstate->query_flags)) {
2158 log_err("out of memory caching validator results");
2159 }
2160 }
2161 qstate->return_rcode = LDNS_RCODE_NOERROR;
2162 qstate->return_msg = vq->orig_msg;
2163 qstate->ext_state[id] = module_finished;
2164 return 0;
2165 }
2166
2167 /**
2168 * Handle validator state.
2169 * If a method returns true, the next state is started. If false, then
2170 * processing will stop.
2171 * @param qstate: query state.
2172 * @param vq: validator query state.
2173 * @param ve: validator shared global environment.
2174 * @param id: module id.
2175 */
2176 static void
val_handle(struct module_qstate * qstate,struct val_qstate * vq,struct val_env * ve,int id)2177 val_handle(struct module_qstate* qstate, struct val_qstate* vq,
2178 struct val_env* ve, int id)
2179 {
2180 int cont = 1;
2181 while(cont) {
2182 verbose(VERB_ALGO, "val handle processing q with state %s",
2183 val_state_to_string(vq->state));
2184 switch(vq->state) {
2185 case VAL_INIT_STATE:
2186 cont = processInit(qstate, vq, ve, id);
2187 break;
2188 case VAL_FINDKEY_STATE:
2189 cont = processFindKey(qstate, vq, id);
2190 break;
2191 case VAL_VALIDATE_STATE:
2192 cont = processValidate(qstate, vq, ve, id);
2193 break;
2194 case VAL_FINISHED_STATE:
2195 cont = processFinished(qstate, vq, ve, id);
2196 break;
2197 default:
2198 log_warn("validator: invalid state %d",
2199 vq->state);
2200 cont = 0;
2201 break;
2202 }
2203 }
2204 }
2205
2206 void
val_operate(struct module_qstate * qstate,enum module_ev event,int id,struct outbound_entry * outbound)2207 val_operate(struct module_qstate* qstate, enum module_ev event, int id,
2208 struct outbound_entry* outbound)
2209 {
2210 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2211 struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
2212 verbose(VERB_QUERY, "validator[module %d] operate: extstate:%s "
2213 "event:%s", id, strextstate(qstate->ext_state[id]),
2214 strmodulevent(event));
2215 log_query_info(VERB_QUERY, "validator operate: query",
2216 &qstate->qinfo);
2217 if(vq && qstate->qinfo.qname != vq->qchase.qname)
2218 log_query_info(VERB_QUERY, "validator operate: chased to",
2219 &vq->qchase);
2220 (void)outbound;
2221 if(event == module_event_new ||
2222 (event == module_event_pass && vq == NULL)) {
2223
2224 /* pass request to next module, to get it */
2225 verbose(VERB_ALGO, "validator: pass to next module");
2226 qstate->ext_state[id] = module_wait_module;
2227 return;
2228 }
2229 if(event == module_event_moddone) {
2230 /* check if validation is needed */
2231 verbose(VERB_ALGO, "validator: nextmodule returned");
2232
2233 if(!needs_validation(qstate, qstate->return_rcode,
2234 qstate->return_msg)) {
2235 /* no need to validate this */
2236 if(qstate->return_msg)
2237 qstate->return_msg->rep->security =
2238 sec_status_indeterminate;
2239 qstate->ext_state[id] = module_finished;
2240 return;
2241 }
2242 if(already_validated(qstate->return_msg)) {
2243 qstate->ext_state[id] = module_finished;
2244 return;
2245 }
2246 /* qclass ANY should have validation result from spawned
2247 * queries. If we get here, it is bogus or an internal error */
2248 if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) {
2249 verbose(VERB_ALGO, "cannot validate classANY: bogus");
2250 if(qstate->return_msg)
2251 qstate->return_msg->rep->security =
2252 sec_status_bogus;
2253 qstate->ext_state[id] = module_finished;
2254 return;
2255 }
2256 /* create state to start validation */
2257 qstate->ext_state[id] = module_error; /* override this */
2258 if(!vq) {
2259 vq = val_new(qstate, id);
2260 if(!vq) {
2261 log_err("validator: malloc failure");
2262 qstate->ext_state[id] = module_error;
2263 return;
2264 }
2265 } else if(!vq->orig_msg) {
2266 if(!val_new_getmsg(qstate, vq)) {
2267 log_err("validator: malloc failure");
2268 qstate->ext_state[id] = module_error;
2269 return;
2270 }
2271 }
2272 val_handle(qstate, vq, ve, id);
2273 return;
2274 }
2275 if(event == module_event_pass) {
2276 qstate->ext_state[id] = module_error; /* override this */
2277 /* continue processing, since val_env exists */
2278 val_handle(qstate, vq, ve, id);
2279 return;
2280 }
2281 log_err("validator: bad event %s", strmodulevent(event));
2282 qstate->ext_state[id] = module_error;
2283 return;
2284 }
2285
2286 /**
2287 * Evaluate the response to a priming request.
2288 *
2289 * @param dnskey_rrset: DNSKEY rrset (can be NULL if none) in prime reply.
2290 * (this rrset is allocated in the wrong region, not the qstate).
2291 * @param ta: trust anchor.
2292 * @param qstate: qstate that needs key.
2293 * @param id: module id.
2294 * @return new key entry or NULL on allocation failure.
2295 * The key entry will either contain a validated DNSKEY rrset, or
2296 * represent a Null key (query failed, but validation did not), or a
2297 * Bad key (validation failed).
2298 */
2299 static struct key_entry_key*
primeResponseToKE(struct ub_packed_rrset_key * dnskey_rrset,struct trust_anchor * ta,struct module_qstate * qstate,int id)2300 primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
2301 struct trust_anchor* ta, struct module_qstate* qstate, int id)
2302 {
2303 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2304 struct key_entry_key* kkey = NULL;
2305 enum sec_status sec = sec_status_unchecked;
2306 char* reason = NULL;
2307 int downprot = qstate->env->cfg->harden_algo_downgrade;
2308
2309 if(!dnskey_rrset) {
2310 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2311 "could not fetch DNSKEY rrset",
2312 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2313 if(qstate->env->cfg->harden_dnssec_stripped) {
2314 errinf(qstate, "no DNSKEY rrset");
2315 kkey = key_entry_create_bad(qstate->region, ta->name,
2316 ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2317 *qstate->env->now);
2318 } else kkey = key_entry_create_null(qstate->region, ta->name,
2319 ta->namelen, ta->dclass, NULL_KEY_TTL,
2320 *qstate->env->now);
2321 if(!kkey) {
2322 log_err("out of memory: allocate fail prime key");
2323 return NULL;
2324 }
2325 return kkey;
2326 }
2327 /* attempt to verify with trust anchor DS and DNSKEY */
2328 kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve,
2329 dnskey_rrset, ta->ds_rrset, ta->dnskey_rrset, downprot,
2330 &reason, qstate);
2331 if(!kkey) {
2332 log_err("out of memory: verifying prime TA");
2333 return NULL;
2334 }
2335 if(key_entry_isgood(kkey))
2336 sec = sec_status_secure;
2337 else
2338 sec = sec_status_bogus;
2339 verbose(VERB_DETAIL, "validate keys with anchor(DS): %s",
2340 sec_status_to_string(sec));
2341
2342 if(sec != sec_status_secure) {
2343 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2344 "DNSKEY rrset is not secure",
2345 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2346 /* NOTE: in this case, we should probably reject the trust
2347 * anchor for longer, perhaps forever. */
2348 if(qstate->env->cfg->harden_dnssec_stripped) {
2349 errinf(qstate, reason);
2350 kkey = key_entry_create_bad(qstate->region, ta->name,
2351 ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2352 *qstate->env->now);
2353 } else kkey = key_entry_create_null(qstate->region, ta->name,
2354 ta->namelen, ta->dclass, NULL_KEY_TTL,
2355 *qstate->env->now);
2356 if(!kkey) {
2357 log_err("out of memory: allocate null prime key");
2358 return NULL;
2359 }
2360 return kkey;
2361 }
2362
2363 log_nametypeclass(VERB_DETAIL, "Successfully primed trust anchor",
2364 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2365 return kkey;
2366 }
2367
2368 /**
2369 * In inform supers, with the resulting message and rcode and the current
2370 * keyset in the super state, validate the DS response, returning a KeyEntry.
2371 *
2372 * @param qstate: query state that is validating and asked for a DS.
2373 * @param vq: validator query state
2374 * @param id: module id.
2375 * @param rcode: rcode result value.
2376 * @param msg: result message (if rcode is OK).
2377 * @param qinfo: from the sub query state, query info.
2378 * @param ke: the key entry to return. It returns
2379 * is_bad if the DS response fails to validate, is_null if the
2380 * DS response indicated an end to secure space, is_good if the DS
2381 * validated. It returns ke=NULL if the DS response indicated that the
2382 * request wasn't a delegation point.
2383 * @return 0 on servfail error (malloc failure).
2384 */
2385 static int
ds_response_to_ke(struct module_qstate * qstate,struct val_qstate * vq,int id,int rcode,struct dns_msg * msg,struct query_info * qinfo,struct key_entry_key ** ke)2386 ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
2387 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2388 struct key_entry_key** ke)
2389 {
2390 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2391 char* reason = NULL;
2392 enum val_classification subtype;
2393 if(rcode != LDNS_RCODE_NOERROR) {
2394 char rc[16];
2395 rc[0]=0;
2396 (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
2397 /* errors here pretty much break validation */
2398 verbose(VERB_DETAIL, "DS response was error, thus bogus");
2399 errinf(qstate, rc);
2400 errinf(qstate, "no DS");
2401 goto return_bogus;
2402 }
2403
2404 subtype = val_classify_response(BIT_RD, qinfo, qinfo, msg->rep, 0);
2405 if(subtype == VAL_CLASS_POSITIVE) {
2406 struct ub_packed_rrset_key* ds;
2407 enum sec_status sec;
2408 ds = reply_find_answer_rrset(qinfo, msg->rep);
2409 /* If there was no DS rrset, then we have mis-classified
2410 * this message. */
2411 if(!ds) {
2412 log_warn("internal error: POSITIVE DS response was "
2413 "missing DS.");
2414 errinf(qstate, "no DS record");
2415 goto return_bogus;
2416 }
2417 /* Verify only returns BOGUS or SECURE. If the rrset is
2418 * bogus, then we are done. */
2419 sec = val_verify_rrset_entry(qstate->env, ve, ds,
2420 vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate);
2421 if(sec != sec_status_secure) {
2422 verbose(VERB_DETAIL, "DS rrset in DS response did "
2423 "not verify");
2424 errinf(qstate, reason);
2425 goto return_bogus;
2426 }
2427
2428 /* If the DS rrset validates, we still have to make sure
2429 * that they are usable. */
2430 if(!val_dsset_isusable(ds)) {
2431 /* If they aren't usable, then we treat it like
2432 * there was no DS. */
2433 *ke = key_entry_create_null(qstate->region,
2434 qinfo->qname, qinfo->qname_len, qinfo->qclass,
2435 ub_packed_rrset_ttl(ds), *qstate->env->now);
2436 return (*ke) != NULL;
2437 }
2438
2439 /* Otherwise, we return the positive response. */
2440 log_query_info(VERB_DETAIL, "validated DS", qinfo);
2441 *ke = key_entry_create_rrset(qstate->region,
2442 qinfo->qname, qinfo->qname_len, qinfo->qclass, ds,
2443 NULL, *qstate->env->now);
2444 return (*ke) != NULL;
2445 } else if(subtype == VAL_CLASS_NODATA ||
2446 subtype == VAL_CLASS_NAMEERROR) {
2447 /* NODATA means that the qname exists, but that there was
2448 * no DS. This is a pretty normal case. */
2449 time_t proof_ttl = 0;
2450 enum sec_status sec;
2451
2452 /* make sure there are NSECs or NSEC3s with signatures */
2453 if(!val_has_signed_nsecs(msg->rep, &reason)) {
2454 verbose(VERB_ALGO, "no NSECs: %s", reason);
2455 errinf(qstate, reason);
2456 goto return_bogus;
2457 }
2458
2459 /* For subtype Name Error.
2460 * attempt ANS 2.8.1.0 compatibility where it sets rcode
2461 * to nxdomain, but really this is an Nodata/Noerror response.
2462 * Find and prove the empty nonterminal in that case */
2463
2464 /* Try to prove absence of the DS with NSEC */
2465 sec = val_nsec_prove_nodata_dsreply(
2466 qstate->env, ve, qinfo, msg->rep, vq->key_entry,
2467 &proof_ttl, &reason, qstate);
2468 switch(sec) {
2469 case sec_status_secure:
2470 verbose(VERB_DETAIL, "NSEC RRset for the "
2471 "referral proved no DS.");
2472 *ke = key_entry_create_null(qstate->region,
2473 qinfo->qname, qinfo->qname_len,
2474 qinfo->qclass, proof_ttl,
2475 *qstate->env->now);
2476 return (*ke) != NULL;
2477 case sec_status_insecure:
2478 verbose(VERB_DETAIL, "NSEC RRset for the "
2479 "referral proved not a delegation point");
2480 *ke = NULL;
2481 return 1;
2482 case sec_status_bogus:
2483 verbose(VERB_DETAIL, "NSEC RRset for the "
2484 "referral did not prove no DS.");
2485 errinf(qstate, reason);
2486 goto return_bogus;
2487 case sec_status_unchecked:
2488 default:
2489 /* NSEC proof did not work, try next */
2490 break;
2491 }
2492
2493 sec = nsec3_prove_nods(qstate->env, ve,
2494 msg->rep->rrsets + msg->rep->an_numrrsets,
2495 msg->rep->ns_numrrsets, qinfo, vq->key_entry, &reason,
2496 qstate);
2497 switch(sec) {
2498 case sec_status_insecure:
2499 /* case insecure also continues to unsigned
2500 * space. If nsec3-iter-count too high or
2501 * optout, then treat below as unsigned */
2502 case sec_status_secure:
2503 verbose(VERB_DETAIL, "NSEC3s for the "
2504 "referral proved no DS.");
2505 *ke = key_entry_create_null(qstate->region,
2506 qinfo->qname, qinfo->qname_len,
2507 qinfo->qclass, proof_ttl,
2508 *qstate->env->now);
2509 return (*ke) != NULL;
2510 case sec_status_indeterminate:
2511 verbose(VERB_DETAIL, "NSEC3s for the "
2512 "referral proved no delegation");
2513 *ke = NULL;
2514 return 1;
2515 case sec_status_bogus:
2516 verbose(VERB_DETAIL, "NSEC3s for the "
2517 "referral did not prove no DS.");
2518 errinf(qstate, reason);
2519 goto return_bogus;
2520 case sec_status_unchecked:
2521 default:
2522 /* NSEC3 proof did not work */
2523 break;
2524 }
2525
2526 /* Apparently, no available NSEC/NSEC3 proved NODATA, so
2527 * this is BOGUS. */
2528 verbose(VERB_DETAIL, "DS %s ran out of options, so return "
2529 "bogus", val_classification_to_string(subtype));
2530 errinf(qstate, "no DS but also no proof of that");
2531 goto return_bogus;
2532 } else if(subtype == VAL_CLASS_CNAME ||
2533 subtype == VAL_CLASS_CNAMENOANSWER) {
2534 /* if the CNAME matches the exact name we want and is signed
2535 * properly, then also, we are sure that no DS exists there,
2536 * much like a NODATA proof */
2537 enum sec_status sec;
2538 struct ub_packed_rrset_key* cname;
2539 cname = reply_find_rrset_section_an(msg->rep, qinfo->qname,
2540 qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass);
2541 if(!cname) {
2542 errinf(qstate, "validator classified CNAME but no "
2543 "CNAME of the queried name for DS");
2544 goto return_bogus;
2545 }
2546 if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count
2547 == 0) {
2548 if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep->
2549 rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) {
2550 errinf(qstate, "DS got DNAME answer");
2551 } else {
2552 errinf(qstate, "DS got unsigned CNAME answer");
2553 }
2554 goto return_bogus;
2555 }
2556 sec = val_verify_rrset_entry(qstate->env, ve, cname,
2557 vq->key_entry, &reason, LDNS_SECTION_ANSWER, qstate);
2558 if(sec == sec_status_secure) {
2559 verbose(VERB_ALGO, "CNAME validated, "
2560 "proof that DS does not exist");
2561 /* and that it is not a referral point */
2562 *ke = NULL;
2563 return 1;
2564 }
2565 errinf(qstate, "CNAME in DS response was not secure.");
2566 errinf(qstate, reason);
2567 goto return_bogus;
2568 } else {
2569 verbose(VERB_QUERY, "Encountered an unhandled type of "
2570 "DS response, thus bogus.");
2571 errinf(qstate, "no DS and");
2572 if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) {
2573 char rc[16];
2574 rc[0]=0;
2575 (void)sldns_wire2str_rcode_buf((int)FLAGS_GET_RCODE(
2576 msg->rep->flags), rc, sizeof(rc));
2577 errinf(qstate, rc);
2578 } else errinf(qstate, val_classification_to_string(subtype));
2579 errinf(qstate, "message fails to prove that");
2580 goto return_bogus;
2581 }
2582 return_bogus:
2583 *ke = key_entry_create_bad(qstate->region, qinfo->qname,
2584 qinfo->qname_len, qinfo->qclass,
2585 BOGUS_KEY_TTL, *qstate->env->now);
2586 return (*ke) != NULL;
2587 }
2588
2589 /**
2590 * Process DS response. Called from inform_supers.
2591 * Because it is in inform_supers, the mesh itself is busy doing callbacks
2592 * for a state that is to be deleted soon; don't touch the mesh; instead
2593 * set a state in the super, as the super will be reactivated soon.
2594 * Perform processing to determine what state to set in the super.
2595 *
2596 * @param qstate: query state that is validating and asked for a DS.
2597 * @param vq: validator query state
2598 * @param id: module id.
2599 * @param rcode: rcode result value.
2600 * @param msg: result message (if rcode is OK).
2601 * @param qinfo: from the sub query state, query info.
2602 * @param origin: the origin of msg.
2603 */
2604 static void
process_ds_response(struct module_qstate * qstate,struct val_qstate * vq,int id,int rcode,struct dns_msg * msg,struct query_info * qinfo,struct sock_list * origin)2605 process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
2606 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2607 struct sock_list* origin)
2608 {
2609 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2610 struct key_entry_key* dske = NULL;
2611 uint8_t* olds = vq->empty_DS_name;
2612 vq->empty_DS_name = NULL;
2613 if(!ds_response_to_ke(qstate, vq, id, rcode, msg, qinfo, &dske)) {
2614 log_err("malloc failure in process_ds_response");
2615 vq->key_entry = NULL; /* make it error */
2616 vq->state = VAL_VALIDATE_STATE;
2617 return;
2618 }
2619 if(dske == NULL) {
2620 vq->empty_DS_name = regional_alloc_init(qstate->region,
2621 qinfo->qname, qinfo->qname_len);
2622 if(!vq->empty_DS_name) {
2623 log_err("malloc failure in empty_DS_name");
2624 vq->key_entry = NULL; /* make it error */
2625 vq->state = VAL_VALIDATE_STATE;
2626 return;
2627 }
2628 vq->empty_DS_len = qinfo->qname_len;
2629 vq->chain_blacklist = NULL;
2630 /* ds response indicated that we aren't on a delegation point.
2631 * Keep the forState.state on FINDKEY. */
2632 } else if(key_entry_isgood(dske)) {
2633 vq->ds_rrset = key_entry_get_rrset(dske, qstate->region);
2634 if(!vq->ds_rrset) {
2635 log_err("malloc failure in process DS");
2636 vq->key_entry = NULL; /* make it error */
2637 vq->state = VAL_VALIDATE_STATE;
2638 return;
2639 }
2640 vq->chain_blacklist = NULL; /* fresh blacklist for next part*/
2641 /* Keep the forState.state on FINDKEY. */
2642 } else if(key_entry_isbad(dske)
2643 && vq->restart_count < ve->max_restart) {
2644 vq->empty_DS_name = olds;
2645 val_blacklist(&vq->chain_blacklist, qstate->region, origin, 1);
2646 qstate->errinf = NULL;
2647 vq->restart_count++;
2648 } else {
2649 if(key_entry_isbad(dske)) {
2650 errinf_origin(qstate, origin);
2651 errinf_dname(qstate, "for DS", qinfo->qname);
2652 }
2653 /* NOTE: the reason for the DS to be not good (that is,
2654 * either bad or null) should have been logged by
2655 * dsResponseToKE. */
2656 vq->key_entry = dske;
2657 /* The FINDKEY phase has ended, so move on. */
2658 vq->state = VAL_VALIDATE_STATE;
2659 }
2660 }
2661
2662 /**
2663 * Process DNSKEY response. Called from inform_supers.
2664 * Sets the key entry in the state.
2665 * Because it is in inform_supers, the mesh itself is busy doing callbacks
2666 * for a state that is to be deleted soon; don't touch the mesh; instead
2667 * set a state in the super, as the super will be reactivated soon.
2668 * Perform processing to determine what state to set in the super.
2669 *
2670 * @param qstate: query state that is validating and asked for a DNSKEY.
2671 * @param vq: validator query state
2672 * @param id: module id.
2673 * @param rcode: rcode result value.
2674 * @param msg: result message (if rcode is OK).
2675 * @param qinfo: from the sub query state, query info.
2676 * @param origin: the origin of msg.
2677 */
2678 static void
process_dnskey_response(struct module_qstate * qstate,struct val_qstate * vq,int id,int rcode,struct dns_msg * msg,struct query_info * qinfo,struct sock_list * origin)2679 process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
2680 int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2681 struct sock_list* origin)
2682 {
2683 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2684 struct key_entry_key* old = vq->key_entry;
2685 struct ub_packed_rrset_key* dnskey = NULL;
2686 int downprot;
2687 char* reason = NULL;
2688
2689 if(rcode == LDNS_RCODE_NOERROR)
2690 dnskey = reply_find_answer_rrset(qinfo, msg->rep);
2691
2692 if(dnskey == NULL) {
2693 /* bad response */
2694 verbose(VERB_DETAIL, "Missing DNSKEY RRset in response to "
2695 "DNSKEY query.");
2696 if(vq->restart_count < ve->max_restart) {
2697 val_blacklist(&vq->chain_blacklist, qstate->region,
2698 origin, 1);
2699 qstate->errinf = NULL;
2700 vq->restart_count++;
2701 return;
2702 }
2703 vq->key_entry = key_entry_create_bad(qstate->region,
2704 qinfo->qname, qinfo->qname_len, qinfo->qclass,
2705 BOGUS_KEY_TTL, *qstate->env->now);
2706 if(!vq->key_entry) {
2707 log_err("alloc failure in missing dnskey response");
2708 /* key_entry is NULL for failure in Validate */
2709 }
2710 errinf(qstate, "No DNSKEY record");
2711 errinf_origin(qstate, origin);
2712 errinf_dname(qstate, "for key", qinfo->qname);
2713 vq->state = VAL_VALIDATE_STATE;
2714 return;
2715 }
2716 if(!vq->ds_rrset) {
2717 log_err("internal error: no DS rrset for new DNSKEY response");
2718 vq->key_entry = NULL;
2719 vq->state = VAL_VALIDATE_STATE;
2720 return;
2721 }
2722 downprot = qstate->env->cfg->harden_algo_downgrade;
2723 vq->key_entry = val_verify_new_DNSKEYs(qstate->region, qstate->env,
2724 ve, dnskey, vq->ds_rrset, downprot, &reason, qstate);
2725
2726 if(!vq->key_entry) {
2727 log_err("out of memory in verify new DNSKEYs");
2728 vq->state = VAL_VALIDATE_STATE;
2729 return;
2730 }
2731 /* If the key entry isBad or isNull, then we can move on to the next
2732 * state. */
2733 if(!key_entry_isgood(vq->key_entry)) {
2734 if(key_entry_isbad(vq->key_entry)) {
2735 if(vq->restart_count < ve->max_restart) {
2736 val_blacklist(&vq->chain_blacklist,
2737 qstate->region, origin, 1);
2738 qstate->errinf = NULL;
2739 vq->restart_count++;
2740 vq->key_entry = old;
2741 return;
2742 }
2743 verbose(VERB_DETAIL, "Did not match a DS to a DNSKEY, "
2744 "thus bogus.");
2745 errinf(qstate, reason);
2746 errinf_origin(qstate, origin);
2747 errinf_dname(qstate, "for key", qinfo->qname);
2748 }
2749 vq->chain_blacklist = NULL;
2750 vq->state = VAL_VALIDATE_STATE;
2751 return;
2752 }
2753 vq->chain_blacklist = NULL;
2754 qstate->errinf = NULL;
2755
2756 /* The DNSKEY validated, so cache it as a trusted key rrset. */
2757 key_cache_insert(ve->kcache, vq->key_entry, qstate);
2758
2759 /* If good, we stay in the FINDKEY state. */
2760 log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo);
2761 }
2762
2763 /**
2764 * Process prime response
2765 * Sets the key entry in the state.
2766 *
2767 * @param qstate: query state that is validating and primed a trust anchor.
2768 * @param vq: validator query state
2769 * @param id: module id.
2770 * @param rcode: rcode result value.
2771 * @param msg: result message (if rcode is OK).
2772 * @param origin: the origin of msg.
2773 */
2774 static void
process_prime_response(struct module_qstate * qstate,struct val_qstate * vq,int id,int rcode,struct dns_msg * msg,struct sock_list * origin)2775 process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
2776 int id, int rcode, struct dns_msg* msg, struct sock_list* origin)
2777 {
2778 struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2779 struct ub_packed_rrset_key* dnskey_rrset = NULL;
2780 struct trust_anchor* ta = anchor_find(qstate->env->anchors,
2781 vq->trust_anchor_name, vq->trust_anchor_labs,
2782 vq->trust_anchor_len, vq->qchase.qclass);
2783 if(!ta) {
2784 /* trust anchor revoked, restart with less anchors */
2785 vq->state = VAL_INIT_STATE;
2786 if(!vq->trust_anchor_name)
2787 vq->state = VAL_VALIDATE_STATE; /* break a loop */
2788 vq->trust_anchor_name = NULL;
2789 return;
2790 }
2791 /* Fetch and validate the keyEntry that corresponds to the
2792 * current trust anchor. */
2793 if(rcode == LDNS_RCODE_NOERROR) {
2794 dnskey_rrset = reply_find_rrset_section_an(msg->rep,
2795 ta->name, ta->namelen, LDNS_RR_TYPE_DNSKEY,
2796 ta->dclass);
2797 }
2798
2799 if(ta->autr) {
2800 if(!autr_process_prime(qstate->env, ve, ta, dnskey_rrset,
2801 qstate)) {
2802 /* trust anchor revoked, restart with less anchors */
2803 vq->state = VAL_INIT_STATE;
2804 vq->trust_anchor_name = NULL;
2805 return;
2806 }
2807 }
2808 vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, id);
2809 lock_basic_unlock(&ta->lock);
2810 if(vq->key_entry) {
2811 if(key_entry_isbad(vq->key_entry)
2812 && vq->restart_count < ve->max_restart) {
2813 val_blacklist(&vq->chain_blacklist, qstate->region,
2814 origin, 1);
2815 qstate->errinf = NULL;
2816 vq->restart_count++;
2817 vq->key_entry = NULL;
2818 vq->state = VAL_INIT_STATE;
2819 return;
2820 }
2821 vq->chain_blacklist = NULL;
2822 errinf_origin(qstate, origin);
2823 errinf_dname(qstate, "for trust anchor", ta->name);
2824 /* store the freshly primed entry in the cache */
2825 key_cache_insert(ve->kcache, vq->key_entry, qstate);
2826 }
2827
2828 /* If the result of the prime is a null key, skip the FINDKEY state.*/
2829 if(!vq->key_entry || key_entry_isnull(vq->key_entry) ||
2830 key_entry_isbad(vq->key_entry)) {
2831 vq->state = VAL_VALIDATE_STATE;
2832 }
2833 /* the qstate will be reactivated after inform_super is done */
2834 }
2835
2836 /*
2837 * inform validator super.
2838 *
2839 * @param qstate: query state that finished.
2840 * @param id: module id.
2841 * @param super: the qstate to inform.
2842 */
2843 void
val_inform_super(struct module_qstate * qstate,int id,struct module_qstate * super)2844 val_inform_super(struct module_qstate* qstate, int id,
2845 struct module_qstate* super)
2846 {
2847 struct val_qstate* vq = (struct val_qstate*)super->minfo[id];
2848 log_query_info(VERB_ALGO, "validator: inform_super, sub is",
2849 &qstate->qinfo);
2850 log_query_info(VERB_ALGO, "super is", &super->qinfo);
2851 if(!vq) {
2852 verbose(VERB_ALGO, "super: has no validator state");
2853 return;
2854 }
2855 if(vq->wait_prime_ta) {
2856 vq->wait_prime_ta = 0;
2857 process_prime_response(super, vq, id, qstate->return_rcode,
2858 qstate->return_msg, qstate->reply_origin);
2859 return;
2860 }
2861 if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS) {
2862 process_ds_response(super, vq, id, qstate->return_rcode,
2863 qstate->return_msg, &qstate->qinfo,
2864 qstate->reply_origin);
2865 return;
2866 } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY) {
2867 process_dnskey_response(super, vq, id, qstate->return_rcode,
2868 qstate->return_msg, &qstate->qinfo,
2869 qstate->reply_origin);
2870 return;
2871 }
2872 log_err("internal error in validator: no inform_supers possible");
2873 }
2874
2875 void
val_clear(struct module_qstate * qstate,int id)2876 val_clear(struct module_qstate* qstate, int id)
2877 {
2878 if(!qstate)
2879 return;
2880 /* everything is allocated in the region, so assign NULL */
2881 qstate->minfo[id] = NULL;
2882 }
2883
2884 size_t
val_get_mem(struct module_env * env,int id)2885 val_get_mem(struct module_env* env, int id)
2886 {
2887 struct val_env* ve = (struct val_env*)env->modinfo[id];
2888 if(!ve)
2889 return 0;
2890 return sizeof(*ve) + key_cache_get_mem(ve->kcache) +
2891 val_neg_get_mem(ve->neg_cache) +
2892 sizeof(size_t)*2*ve->nsec3_keyiter_count;
2893 }
2894
2895 /**
2896 * The validator function block
2897 */
2898 static struct module_func_block val_block = {
2899 "validator",
2900 &val_init, &val_deinit, &val_operate, &val_inform_super, &val_clear,
2901 &val_get_mem
2902 };
2903
2904 struct module_func_block*
val_get_funcblock(void)2905 val_get_funcblock(void)
2906 {
2907 return &val_block;
2908 }
2909
2910 const char*
val_state_to_string(enum val_state state)2911 val_state_to_string(enum val_state state)
2912 {
2913 switch(state) {
2914 case VAL_INIT_STATE: return "VAL_INIT_STATE";
2915 case VAL_FINDKEY_STATE: return "VAL_FINDKEY_STATE";
2916 case VAL_VALIDATE_STATE: return "VAL_VALIDATE_STATE";
2917 case VAL_FINISHED_STATE: return "VAL_FINISHED_STATE";
2918 }
2919 return "UNKNOWN VALIDATOR STATE";
2920 }
2921
2922