val_utils.c revision 356345
1238106Sdes/* 2238106Sdes * validator/val_utils.c - validator utility functions. 3238106Sdes * 4238106Sdes * Copyright (c) 2007, NLnet Labs. All rights reserved. 5238106Sdes * 6238106Sdes * This software is open source. 7238106Sdes * 8238106Sdes * Redistribution and use in source and binary forms, with or without 9238106Sdes * modification, are permitted provided that the following conditions 10238106Sdes * are met: 11238106Sdes * 12238106Sdes * Redistributions of source code must retain the above copyright notice, 13238106Sdes * this list of conditions and the following disclaimer. 14238106Sdes * 15238106Sdes * Redistributions in binary form must reproduce the above copyright notice, 16238106Sdes * this list of conditions and the following disclaimer in the documentation 17238106Sdes * and/or other materials provided with the distribution. 18238106Sdes * 19238106Sdes * Neither the name of the NLNET LABS nor the names of its contributors may 20238106Sdes * be used to endorse or promote products derived from this software without 21238106Sdes * specific prior written permission. 22238106Sdes * 23238106Sdes * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24266114Sdes * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25266114Sdes * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26266114Sdes * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27266114Sdes * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28266114Sdes * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29266114Sdes * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30266114Sdes * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31266114Sdes * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32266114Sdes * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33266114Sdes * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34238106Sdes */ 35238106Sdes 36238106Sdes/** 37238106Sdes * \file 38238106Sdes * 39238106Sdes * This file contains helper functions for the validator module. 40238106Sdes */ 41238106Sdes#include "config.h" 42238106Sdes#include "validator/val_utils.h" 43238106Sdes#include "validator/validator.h" 44238106Sdes#include "validator/val_kentry.h" 45238106Sdes#include "validator/val_sigcrypt.h" 46238106Sdes#include "validator/val_anchor.h" 47238106Sdes#include "validator/val_nsec.h" 48238106Sdes#include "validator/val_neg.h" 49238106Sdes#include "services/cache/rrset.h" 50238106Sdes#include "services/cache/dns.h" 51238106Sdes#include "util/data/msgreply.h" 52238106Sdes#include "util/data/packed_rrset.h" 53238106Sdes#include "util/data/dname.h" 54238106Sdes#include "util/net_help.h" 55238106Sdes#include "util/module.h" 56238106Sdes#include "util/regional.h" 57356345Scy#include "util/config_file.h" 58296415Sdes#include "sldns/wire2str.h" 59296415Sdes#include "sldns/parseutil.h" 60238106Sdes 61238106Sdesenum val_classification 62238106Sdesval_classify_response(uint16_t query_flags, struct query_info* origqinf, 63238106Sdes struct query_info* qinf, struct reply_info* rep, size_t skip) 64238106Sdes{ 65238106Sdes int rcode = (int)FLAGS_GET_RCODE(rep->flags); 66238106Sdes size_t i; 67238106Sdes 68238106Sdes /* Normal Name Error's are easy to detect -- but don't mistake a CNAME 69238106Sdes * chain ending in NXDOMAIN. */ 70238106Sdes if(rcode == LDNS_RCODE_NXDOMAIN && rep->an_numrrsets == 0) 71238106Sdes return VAL_CLASS_NAMEERROR; 72238106Sdes 73238106Sdes /* check for referral: nonRD query and it looks like a nodata */ 74238106Sdes if(!(query_flags&BIT_RD) && rep->an_numrrsets == 0 && 75238106Sdes rcode == LDNS_RCODE_NOERROR) { 76238106Sdes /* SOA record in auth indicates it is NODATA instead. 77238106Sdes * All validation requiring NODATA messages have SOA in 78238106Sdes * authority section. */ 79238106Sdes /* uses fact that answer section is empty */ 80238106Sdes int saw_ns = 0; 81238106Sdes for(i=0; i<rep->ns_numrrsets; i++) { 82238106Sdes if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_SOA) 83238106Sdes return VAL_CLASS_NODATA; 84238106Sdes if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_DS) 85238106Sdes return VAL_CLASS_REFERRAL; 86238106Sdes if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS) 87238106Sdes saw_ns = 1; 88238106Sdes } 89238106Sdes return saw_ns?VAL_CLASS_REFERRAL:VAL_CLASS_NODATA; 90238106Sdes } 91238106Sdes /* root referral where NS set is in the answer section */ 92238106Sdes if(!(query_flags&BIT_RD) && rep->ns_numrrsets == 0 && 93238106Sdes rep->an_numrrsets == 1 && rcode == LDNS_RCODE_NOERROR && 94238106Sdes ntohs(rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_NS && 95238106Sdes query_dname_compare(rep->rrsets[0]->rk.dname, 96238106Sdes origqinf->qname) != 0) 97238106Sdes return VAL_CLASS_REFERRAL; 98238106Sdes 99238106Sdes /* dump bad messages */ 100238106Sdes if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) 101238106Sdes return VAL_CLASS_UNKNOWN; 102238106Sdes /* next check if the skip into the answer section shows no answer */ 103238106Sdes if(skip>0 && rep->an_numrrsets <= skip) 104238106Sdes return VAL_CLASS_CNAMENOANSWER; 105238106Sdes 106238106Sdes /* Next is NODATA */ 107238106Sdes if(rcode == LDNS_RCODE_NOERROR && rep->an_numrrsets == 0) 108238106Sdes return VAL_CLASS_NODATA; 109238106Sdes 110238106Sdes /* We distinguish between CNAME response and other positive/negative 111238106Sdes * responses because CNAME answers require extra processing. */ 112238106Sdes 113238106Sdes /* We distinguish between ANY and CNAME or POSITIVE because 114238106Sdes * ANY responses are validated differently. */ 115238106Sdes if(rcode == LDNS_RCODE_NOERROR && qinf->qtype == LDNS_RR_TYPE_ANY) 116238106Sdes return VAL_CLASS_ANY; 117238106Sdes 118238106Sdes /* Note that DNAMEs will be ignored here, unless qtype=DNAME. Unless 119238106Sdes * qtype=CNAME, this will yield a CNAME response. */ 120238106Sdes for(i=skip; i<rep->an_numrrsets; i++) { 121238106Sdes if(rcode == LDNS_RCODE_NOERROR && 122238106Sdes ntohs(rep->rrsets[i]->rk.type) == qinf->qtype) 123238106Sdes return VAL_CLASS_POSITIVE; 124238106Sdes if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME) 125238106Sdes return VAL_CLASS_CNAME; 126238106Sdes } 127238106Sdes log_dns_msg("validator: error. failed to classify response message: ", 128238106Sdes qinf, rep); 129238106Sdes return VAL_CLASS_UNKNOWN; 130238106Sdes} 131238106Sdes 132238106Sdes/** Get signer name from RRSIG */ 133238106Sdesstatic void 134238106Sdesrrsig_get_signer(uint8_t* data, size_t len, uint8_t** sname, size_t* slen) 135238106Sdes{ 136238106Sdes /* RRSIG rdata is not allowed to be compressed, it is stored 137238106Sdes * uncompressed in memory as well, so return a ptr to the name */ 138238106Sdes if(len < 21) { 139238106Sdes /* too short RRSig: 140238106Sdes * short, byte, byte, long, long, long, short, "." is 141238106Sdes * 2 1 1 4 4 4 2 1 = 19 142238106Sdes * and a skip of 18 bytes to the name. 143238106Sdes * +2 for the rdatalen is 21 bytes len for root label */ 144238106Sdes *sname = NULL; 145238106Sdes *slen = 0; 146238106Sdes return; 147238106Sdes } 148238106Sdes data += 20; /* skip the fixed size bits */ 149238106Sdes len -= 20; 150238106Sdes *slen = dname_valid(data, len); 151238106Sdes if(!*slen) { 152238106Sdes /* bad dname in this rrsig. */ 153238106Sdes *sname = NULL; 154238106Sdes return; 155238106Sdes } 156238106Sdes *sname = data; 157238106Sdes} 158238106Sdes 159238106Sdesvoid 160238106Sdesval_find_rrset_signer(struct ub_packed_rrset_key* rrset, uint8_t** sname, 161238106Sdes size_t* slen) 162238106Sdes{ 163238106Sdes struct packed_rrset_data* d = (struct packed_rrset_data*) 164238106Sdes rrset->entry.data; 165238106Sdes /* return signer for first signature, or NULL */ 166238106Sdes if(d->rrsig_count == 0) { 167238106Sdes *sname = NULL; 168238106Sdes *slen = 0; 169238106Sdes return; 170238106Sdes } 171238106Sdes /* get rrsig signer name out of the signature */ 172238106Sdes rrsig_get_signer(d->rr_data[d->count], d->rr_len[d->count], 173238106Sdes sname, slen); 174238106Sdes} 175238106Sdes 176238106Sdes/** 177238106Sdes * Find best signer name in this set of rrsigs. 178238106Sdes * @param rrset: which rrsigs to look through. 179238106Sdes * @param qinf: the query name that needs validation. 180238106Sdes * @param signer_name: the best signer_name. Updated if a better one is found. 181238106Sdes * @param signer_len: length of signer name. 182238106Sdes * @param matchcount: count of current best name (starts at 0 for no match). 183238106Sdes * Updated if match is improved. 184238106Sdes */ 185238106Sdesstatic void 186238106Sdesval_find_best_signer(struct ub_packed_rrset_key* rrset, 187238106Sdes struct query_info* qinf, uint8_t** signer_name, size_t* signer_len, 188238106Sdes int* matchcount) 189238106Sdes{ 190238106Sdes struct packed_rrset_data* d = (struct packed_rrset_data*) 191238106Sdes rrset->entry.data; 192238106Sdes uint8_t* sign; 193238106Sdes size_t i; 194238106Sdes int m; 195238106Sdes for(i=d->count; i<d->count+d->rrsig_count; i++) { 196238106Sdes sign = d->rr_data[i]+2+18; 197238106Sdes /* look at signatures that are valid (long enough), 198238106Sdes * and have a signer name that is a superdomain of qname, 199238106Sdes * and then check the number of labels in the shared topdomain 200238106Sdes * improve the match if possible */ 201238106Sdes if(d->rr_len[i] > 2+19 && /* rdata, sig + root label*/ 202238106Sdes dname_subdomain_c(qinf->qname, sign)) { 203238106Sdes (void)dname_lab_cmp(qinf->qname, 204238106Sdes dname_count_labels(qinf->qname), 205238106Sdes sign, dname_count_labels(sign), &m); 206238106Sdes if(m > *matchcount) { 207238106Sdes *matchcount = m; 208238106Sdes *signer_name = sign; 209238106Sdes (void)dname_count_size_labels(*signer_name, 210238106Sdes signer_len); 211238106Sdes } 212238106Sdes } 213238106Sdes } 214238106Sdes} 215238106Sdes 216238106Sdesvoid 217238106Sdesval_find_signer(enum val_classification subtype, struct query_info* qinf, 218238106Sdes struct reply_info* rep, size_t skip, uint8_t** signer_name, 219238106Sdes size_t* signer_len) 220238106Sdes{ 221238106Sdes size_t i; 222238106Sdes 223356345Scy if(subtype == VAL_CLASS_POSITIVE) { 224238106Sdes /* check for the answer rrset */ 225238106Sdes for(i=skip; i<rep->an_numrrsets; i++) { 226238106Sdes if(query_dname_compare(qinf->qname, 227238106Sdes rep->rrsets[i]->rk.dname) == 0) { 228238106Sdes val_find_rrset_signer(rep->rrsets[i], 229238106Sdes signer_name, signer_len); 230238106Sdes return; 231238106Sdes } 232238106Sdes } 233238106Sdes *signer_name = NULL; 234238106Sdes *signer_len = 0; 235238106Sdes } else if(subtype == VAL_CLASS_CNAME) { 236238106Sdes /* check for the first signed cname/dname rrset */ 237238106Sdes for(i=skip; i<rep->an_numrrsets; i++) { 238238106Sdes val_find_rrset_signer(rep->rrsets[i], 239238106Sdes signer_name, signer_len); 240238106Sdes if(*signer_name) 241238106Sdes return; 242238106Sdes if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_DNAME) 243238106Sdes break; /* only check CNAME after a DNAME */ 244238106Sdes } 245238106Sdes *signer_name = NULL; 246238106Sdes *signer_len = 0; 247238106Sdes } else if(subtype == VAL_CLASS_NAMEERROR 248238106Sdes || subtype == VAL_CLASS_NODATA) { 249238106Sdes /*Check to see if the AUTH section NSEC record(s) have rrsigs*/ 250238106Sdes for(i=rep->an_numrrsets; i< 251238106Sdes rep->an_numrrsets+rep->ns_numrrsets; i++) { 252238106Sdes if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC 253238106Sdes || ntohs(rep->rrsets[i]->rk.type) == 254238106Sdes LDNS_RR_TYPE_NSEC3) { 255238106Sdes val_find_rrset_signer(rep->rrsets[i], 256238106Sdes signer_name, signer_len); 257238106Sdes return; 258238106Sdes } 259238106Sdes } 260238106Sdes } else if(subtype == VAL_CLASS_CNAMENOANSWER) { 261238106Sdes /* find closest superdomain signer name in authority section 262238106Sdes * NSEC and NSEC3s */ 263238106Sdes int matchcount = 0; 264238106Sdes *signer_name = NULL; 265238106Sdes *signer_len = 0; 266238106Sdes for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep-> 267238106Sdes ns_numrrsets; i++) { 268238106Sdes if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC 269238106Sdes || ntohs(rep->rrsets[i]->rk.type) == 270238106Sdes LDNS_RR_TYPE_NSEC3) { 271238106Sdes val_find_best_signer(rep->rrsets[i], qinf, 272238106Sdes signer_name, signer_len, &matchcount); 273238106Sdes } 274238106Sdes } 275356345Scy } else if(subtype == VAL_CLASS_ANY) { 276356345Scy /* check for one of the answer rrset that has signatures, 277356345Scy * or potentially a DNAME is in use with a different qname */ 278356345Scy for(i=skip; i<rep->an_numrrsets; i++) { 279356345Scy if(query_dname_compare(qinf->qname, 280356345Scy rep->rrsets[i]->rk.dname) == 0) { 281356345Scy val_find_rrset_signer(rep->rrsets[i], 282356345Scy signer_name, signer_len); 283356345Scy if(*signer_name) 284356345Scy return; 285356345Scy } 286356345Scy } 287356345Scy /* no answer RRSIGs with qname, try a DNAME */ 288356345Scy if(skip < rep->an_numrrsets && 289356345Scy ntohs(rep->rrsets[skip]->rk.type) == 290356345Scy LDNS_RR_TYPE_DNAME) { 291356345Scy val_find_rrset_signer(rep->rrsets[skip], 292356345Scy signer_name, signer_len); 293356345Scy if(*signer_name) 294356345Scy return; 295356345Scy } 296356345Scy *signer_name = NULL; 297356345Scy *signer_len = 0; 298238106Sdes } else if(subtype == VAL_CLASS_REFERRAL) { 299238106Sdes /* find keys for the item at skip */ 300238106Sdes if(skip < rep->rrset_count) { 301238106Sdes val_find_rrset_signer(rep->rrsets[skip], 302238106Sdes signer_name, signer_len); 303238106Sdes return; 304238106Sdes } 305238106Sdes *signer_name = NULL; 306238106Sdes *signer_len = 0; 307238106Sdes } else { 308238106Sdes verbose(VERB_QUERY, "find_signer: could not find signer name" 309238106Sdes " for unknown type response"); 310238106Sdes *signer_name = NULL; 311238106Sdes *signer_len = 0; 312238106Sdes } 313238106Sdes} 314238106Sdes 315238106Sdes/** return number of rrs in an rrset */ 316238106Sdesstatic size_t 317238106Sdesrrset_get_count(struct ub_packed_rrset_key* rrset) 318238106Sdes{ 319238106Sdes struct packed_rrset_data* d = (struct packed_rrset_data*) 320238106Sdes rrset->entry.data; 321238106Sdes if(!d) return 0; 322238106Sdes return d->count; 323238106Sdes} 324238106Sdes 325238106Sdes/** return TTL of rrset */ 326238106Sdesstatic uint32_t 327238106Sdesrrset_get_ttl(struct ub_packed_rrset_key* rrset) 328238106Sdes{ 329238106Sdes struct packed_rrset_data* d = (struct packed_rrset_data*) 330238106Sdes rrset->entry.data; 331238106Sdes if(!d) return 0; 332238106Sdes return d->ttl; 333238106Sdes} 334238106Sdes 335238106Sdesenum sec_status 336238106Sdesval_verify_rrset(struct module_env* env, struct val_env* ve, 337238106Sdes struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* keys, 338356345Scy uint8_t* sigalg, char** reason, sldns_pkt_section section, 339356345Scy struct module_qstate* qstate) 340238106Sdes{ 341238106Sdes enum sec_status sec; 342238106Sdes struct packed_rrset_data* d = (struct packed_rrset_data*)rrset-> 343238106Sdes entry.data; 344238106Sdes if(d->security == sec_status_secure) { 345238106Sdes /* re-verify all other statuses, because keyset may change*/ 346238106Sdes log_nametypeclass(VERB_ALGO, "verify rrset cached", 347238106Sdes rrset->rk.dname, ntohs(rrset->rk.type), 348238106Sdes ntohs(rrset->rk.rrset_class)); 349238106Sdes return d->security; 350238106Sdes } 351238106Sdes /* check in the cache if verification has already been done */ 352238106Sdes rrset_check_sec_status(env->rrset_cache, rrset, *env->now); 353238106Sdes if(d->security == sec_status_secure) { 354238106Sdes log_nametypeclass(VERB_ALGO, "verify rrset from cache", 355238106Sdes rrset->rk.dname, ntohs(rrset->rk.type), 356238106Sdes ntohs(rrset->rk.rrset_class)); 357238106Sdes return d->security; 358238106Sdes } 359238106Sdes log_nametypeclass(VERB_ALGO, "verify rrset", rrset->rk.dname, 360238106Sdes ntohs(rrset->rk.type), ntohs(rrset->rk.rrset_class)); 361356345Scy sec = dnskeyset_verify_rrset(env, ve, rrset, keys, sigalg, reason, 362356345Scy section, qstate); 363238106Sdes verbose(VERB_ALGO, "verify result: %s", sec_status_to_string(sec)); 364238106Sdes regional_free_all(env->scratch); 365238106Sdes 366238106Sdes /* update rrset security status 367238106Sdes * only improves security status 368238106Sdes * and bogus is set only once, even if we rechecked the status */ 369238106Sdes if(sec > d->security) { 370238106Sdes d->security = sec; 371238106Sdes if(sec == sec_status_secure) 372238106Sdes d->trust = rrset_trust_validated; 373238106Sdes else if(sec == sec_status_bogus) { 374238106Sdes size_t i; 375238106Sdes /* update ttl for rrset to fixed value. */ 376238106Sdes d->ttl = ve->bogus_ttl; 377238106Sdes for(i=0; i<d->count+d->rrsig_count; i++) 378238106Sdes d->rr_ttl[i] = ve->bogus_ttl; 379238106Sdes /* leave RR specific TTL: not used for determine 380238106Sdes * if RRset timed out and clients see proper value. */ 381238106Sdes lock_basic_lock(&ve->bogus_lock); 382238106Sdes ve->num_rrset_bogus++; 383238106Sdes lock_basic_unlock(&ve->bogus_lock); 384238106Sdes } 385238106Sdes /* if status updated - store in cache for reuse */ 386238106Sdes rrset_update_sec_status(env->rrset_cache, rrset, *env->now); 387238106Sdes } 388238106Sdes 389238106Sdes return sec; 390238106Sdes} 391238106Sdes 392238106Sdesenum sec_status 393238106Sdesval_verify_rrset_entry(struct module_env* env, struct val_env* ve, 394238106Sdes struct ub_packed_rrset_key* rrset, struct key_entry_key* kkey, 395356345Scy char** reason, sldns_pkt_section section, struct module_qstate* qstate) 396238106Sdes{ 397238106Sdes /* temporary dnskey rrset-key */ 398238106Sdes struct ub_packed_rrset_key dnskey; 399238106Sdes struct key_entry_data* kd = (struct key_entry_data*)kkey->entry.data; 400238106Sdes enum sec_status sec; 401238106Sdes dnskey.rk.type = htons(kd->rrset_type); 402238106Sdes dnskey.rk.rrset_class = htons(kkey->key_class); 403238106Sdes dnskey.rk.flags = 0; 404238106Sdes dnskey.rk.dname = kkey->name; 405238106Sdes dnskey.rk.dname_len = kkey->namelen; 406238106Sdes dnskey.entry.key = &dnskey; 407238106Sdes dnskey.entry.data = kd->rrset_data; 408356345Scy sec = val_verify_rrset(env, ve, rrset, &dnskey, kd->algo, reason, 409356345Scy section, qstate); 410238106Sdes return sec; 411238106Sdes} 412238106Sdes 413238106Sdes/** verify that a DS RR hashes to a key and that key signs the set */ 414238106Sdesstatic enum sec_status 415238106Sdesverify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve, 416238106Sdes struct ub_packed_rrset_key* dnskey_rrset, 417356345Scy struct ub_packed_rrset_key* ds_rrset, size_t ds_idx, char** reason, 418356345Scy struct module_qstate* qstate) 419238106Sdes{ 420238106Sdes enum sec_status sec = sec_status_bogus; 421238106Sdes size_t i, num, numchecked = 0, numhashok = 0; 422238106Sdes num = rrset_get_count(dnskey_rrset); 423238106Sdes for(i=0; i<num; i++) { 424238106Sdes /* Skip DNSKEYs that don't match the basic criteria. */ 425238106Sdes if(ds_get_key_algo(ds_rrset, ds_idx) 426238106Sdes != dnskey_get_algo(dnskey_rrset, i) 427238106Sdes || dnskey_calc_keytag(dnskey_rrset, i) 428238106Sdes != ds_get_keytag(ds_rrset, ds_idx)) { 429238106Sdes continue; 430238106Sdes } 431238106Sdes numchecked++; 432238106Sdes verbose(VERB_ALGO, "attempt DS match algo %d keytag %d", 433238106Sdes ds_get_key_algo(ds_rrset, ds_idx), 434238106Sdes ds_get_keytag(ds_rrset, ds_idx)); 435238106Sdes 436238106Sdes /* Convert the candidate DNSKEY into a hash using the 437238106Sdes * same DS hash algorithm. */ 438238106Sdes if(!ds_digest_match_dnskey(env, dnskey_rrset, i, ds_rrset, 439238106Sdes ds_idx)) { 440238106Sdes verbose(VERB_ALGO, "DS match attempt failed"); 441238106Sdes continue; 442238106Sdes } 443238106Sdes numhashok++; 444238106Sdes verbose(VERB_ALGO, "DS match digest ok, trying signature"); 445238106Sdes 446238106Sdes /* Otherwise, we have a match! Make sure that the DNSKEY 447238106Sdes * verifies *with this key* */ 448238106Sdes sec = dnskey_verify_rrset(env, ve, dnskey_rrset, 449356345Scy dnskey_rrset, i, reason, LDNS_SECTION_ANSWER, qstate); 450238106Sdes if(sec == sec_status_secure) { 451238106Sdes return sec; 452238106Sdes } 453238106Sdes /* If it didn't validate with the DNSKEY, try the next one! */ 454238106Sdes } 455238106Sdes if(numchecked == 0) 456238106Sdes algo_needs_reason(env, ds_get_key_algo(ds_rrset, ds_idx), 457238106Sdes reason, "no keys have a DS"); 458238106Sdes else if(numhashok == 0) 459238106Sdes *reason = "DS hash mismatches key"; 460238106Sdes else if(!*reason) 461238106Sdes *reason = "keyset not secured by DNSKEY that matches DS"; 462238106Sdes return sec_status_bogus; 463238106Sdes} 464238106Sdes 465238106Sdesint val_favorite_ds_algo(struct ub_packed_rrset_key* ds_rrset) 466238106Sdes{ 467238106Sdes size_t i, num = rrset_get_count(ds_rrset); 468238106Sdes int d, digest_algo = 0; /* DS digest algo 0 is not used. */ 469238106Sdes /* find favorite algo, for now, highest number supported */ 470238106Sdes for(i=0; i<num; i++) { 471238106Sdes if(!ds_digest_algo_is_supported(ds_rrset, i) || 472238106Sdes !ds_key_algo_is_supported(ds_rrset, i)) { 473238106Sdes continue; 474238106Sdes } 475238106Sdes d = ds_get_digest_algo(ds_rrset, i); 476238106Sdes if(d > digest_algo) 477238106Sdes digest_algo = d; 478238106Sdes } 479238106Sdes return digest_algo; 480238106Sdes} 481238106Sdes 482238106Sdesenum sec_status 483238106Sdesval_verify_DNSKEY_with_DS(struct module_env* env, struct val_env* ve, 484238106Sdes struct ub_packed_rrset_key* dnskey_rrset, 485356345Scy struct ub_packed_rrset_key* ds_rrset, uint8_t* sigalg, char** reason, 486356345Scy struct module_qstate* qstate) 487238106Sdes{ 488238106Sdes /* as long as this is false, we can consider this DS rrset to be 489238106Sdes * equivalent to no DS rrset. */ 490238106Sdes int has_useful_ds = 0, digest_algo, alg; 491238106Sdes struct algo_needs needs; 492238106Sdes size_t i, num; 493238106Sdes enum sec_status sec; 494238106Sdes 495238106Sdes if(dnskey_rrset->rk.dname_len != ds_rrset->rk.dname_len || 496238106Sdes query_dname_compare(dnskey_rrset->rk.dname, ds_rrset->rk.dname) 497238106Sdes != 0) { 498238106Sdes verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset " 499238106Sdes "by name"); 500238106Sdes *reason = "DNSKEY RRset did not match DS RRset by name"; 501238106Sdes return sec_status_bogus; 502238106Sdes } 503238106Sdes 504356345Scy if(sigalg) { 505356345Scy /* harden against algo downgrade is enabled */ 506356345Scy digest_algo = val_favorite_ds_algo(ds_rrset); 507238106Sdes algo_needs_init_ds(&needs, ds_rrset, digest_algo, sigalg); 508356345Scy } else { 509356345Scy /* accept any key algo, any digest algo */ 510356345Scy digest_algo = -1; 511356345Scy } 512238106Sdes num = rrset_get_count(ds_rrset); 513238106Sdes for(i=0; i<num; i++) { 514238106Sdes /* Check to see if we can understand this DS. 515238106Sdes * And check it is the strongest digest */ 516238106Sdes if(!ds_digest_algo_is_supported(ds_rrset, i) || 517238106Sdes !ds_key_algo_is_supported(ds_rrset, i) || 518356345Scy (sigalg && (ds_get_digest_algo(ds_rrset, i) != digest_algo))) { 519238106Sdes continue; 520238106Sdes } 521238106Sdes 522238106Sdes /* Once we see a single DS with a known digestID and 523238106Sdes * algorithm, we cannot return INSECURE (with a 524238106Sdes * "null" KeyEntry). */ 525266114Sdes has_useful_ds = 1; 526238106Sdes 527238106Sdes sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset, 528356345Scy ds_rrset, i, reason, qstate); 529238106Sdes if(sec == sec_status_secure) { 530238106Sdes if(!sigalg || algo_needs_set_secure(&needs, 531238106Sdes (uint8_t)ds_get_key_algo(ds_rrset, i))) { 532238106Sdes verbose(VERB_ALGO, "DS matched DNSKEY."); 533238106Sdes return sec_status_secure; 534238106Sdes } 535238106Sdes } else if(sigalg && sec == sec_status_bogus) { 536238106Sdes algo_needs_set_bogus(&needs, 537238106Sdes (uint8_t)ds_get_key_algo(ds_rrset, i)); 538238106Sdes } 539238106Sdes } 540238106Sdes 541238106Sdes /* None of the DS's worked out. */ 542238106Sdes 543238106Sdes /* If no DSs were understandable, then this is OK. */ 544238106Sdes if(!has_useful_ds) { 545238106Sdes verbose(VERB_ALGO, "No usable DS records were found -- " 546238106Sdes "treating as insecure."); 547238106Sdes return sec_status_insecure; 548238106Sdes } 549238106Sdes /* If any were understandable, then it is bad. */ 550238106Sdes verbose(VERB_QUERY, "Failed to match any usable DS to a DNSKEY."); 551238106Sdes if(sigalg && (alg=algo_needs_missing(&needs)) != 0) { 552238106Sdes algo_needs_reason(env, alg, reason, "missing verification of " 553238106Sdes "DNSKEY signature"); 554238106Sdes } 555238106Sdes return sec_status_bogus; 556238106Sdes} 557238106Sdes 558238106Sdesstruct key_entry_key* 559238106Sdesval_verify_new_DNSKEYs(struct regional* region, struct module_env* env, 560238106Sdes struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset, 561356345Scy struct ub_packed_rrset_key* ds_rrset, int downprot, char** reason, 562356345Scy struct module_qstate* qstate) 563238106Sdes{ 564238106Sdes uint8_t sigalg[ALGO_NEEDS_MAX+1]; 565238106Sdes enum sec_status sec = val_verify_DNSKEY_with_DS(env, ve, 566356345Scy dnskey_rrset, ds_rrset, downprot?sigalg:NULL, reason, qstate); 567238106Sdes 568238106Sdes if(sec == sec_status_secure) { 569238106Sdes return key_entry_create_rrset(region, 570238106Sdes ds_rrset->rk.dname, ds_rrset->rk.dname_len, 571238106Sdes ntohs(ds_rrset->rk.rrset_class), dnskey_rrset, 572238106Sdes downprot?sigalg:NULL, *env->now); 573238106Sdes } else if(sec == sec_status_insecure) { 574238106Sdes return key_entry_create_null(region, ds_rrset->rk.dname, 575238106Sdes ds_rrset->rk.dname_len, 576238106Sdes ntohs(ds_rrset->rk.rrset_class), 577238106Sdes rrset_get_ttl(ds_rrset), *env->now); 578238106Sdes } 579238106Sdes return key_entry_create_bad(region, ds_rrset->rk.dname, 580238106Sdes ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class), 581238106Sdes BOGUS_KEY_TTL, *env->now); 582238106Sdes} 583238106Sdes 584238106Sdesenum sec_status 585238106Sdesval_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve, 586238106Sdes struct ub_packed_rrset_key* dnskey_rrset, 587238106Sdes struct ub_packed_rrset_key* ta_ds, 588356345Scy struct ub_packed_rrset_key* ta_dnskey, uint8_t* sigalg, char** reason, 589356345Scy struct module_qstate* qstate) 590238106Sdes{ 591238106Sdes /* as long as this is false, we can consider this anchor to be 592238106Sdes * equivalent to no anchor. */ 593238106Sdes int has_useful_ta = 0, digest_algo = 0, alg; 594238106Sdes struct algo_needs needs; 595238106Sdes size_t i, num; 596238106Sdes enum sec_status sec; 597238106Sdes 598238106Sdes if(ta_ds && (dnskey_rrset->rk.dname_len != ta_ds->rk.dname_len || 599238106Sdes query_dname_compare(dnskey_rrset->rk.dname, ta_ds->rk.dname) 600238106Sdes != 0)) { 601238106Sdes verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset " 602238106Sdes "by name"); 603238106Sdes *reason = "DNSKEY RRset did not match DS RRset by name"; 604238106Sdes return sec_status_bogus; 605238106Sdes } 606238106Sdes if(ta_dnskey && (dnskey_rrset->rk.dname_len != ta_dnskey->rk.dname_len 607238106Sdes || query_dname_compare(dnskey_rrset->rk.dname, ta_dnskey->rk.dname) 608238106Sdes != 0)) { 609238106Sdes verbose(VERB_QUERY, "DNSKEY RRset did not match anchor RRset " 610238106Sdes "by name"); 611238106Sdes *reason = "DNSKEY RRset did not match anchor RRset by name"; 612238106Sdes return sec_status_bogus; 613238106Sdes } 614238106Sdes 615238106Sdes if(ta_ds) 616238106Sdes digest_algo = val_favorite_ds_algo(ta_ds); 617238106Sdes if(sigalg) { 618238106Sdes if(ta_ds) 619238106Sdes algo_needs_init_ds(&needs, ta_ds, digest_algo, sigalg); 620238106Sdes else memset(&needs, 0, sizeof(needs)); 621238106Sdes if(ta_dnskey) 622238106Sdes algo_needs_init_dnskey_add(&needs, ta_dnskey, sigalg); 623238106Sdes } 624238106Sdes if(ta_ds) { 625238106Sdes num = rrset_get_count(ta_ds); 626238106Sdes for(i=0; i<num; i++) { 627238106Sdes /* Check to see if we can understand this DS. 628238106Sdes * And check it is the strongest digest */ 629238106Sdes if(!ds_digest_algo_is_supported(ta_ds, i) || 630238106Sdes !ds_key_algo_is_supported(ta_ds, i) || 631238106Sdes ds_get_digest_algo(ta_ds, i) != digest_algo) 632238106Sdes continue; 633238106Sdes 634238106Sdes /* Once we see a single DS with a known digestID and 635238106Sdes * algorithm, we cannot return INSECURE (with a 636238106Sdes * "null" KeyEntry). */ 637266114Sdes has_useful_ta = 1; 638238106Sdes 639238106Sdes sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset, 640356345Scy ta_ds, i, reason, qstate); 641238106Sdes if(sec == sec_status_secure) { 642238106Sdes if(!sigalg || algo_needs_set_secure(&needs, 643238106Sdes (uint8_t)ds_get_key_algo(ta_ds, i))) { 644238106Sdes verbose(VERB_ALGO, "DS matched DNSKEY."); 645238106Sdes return sec_status_secure; 646238106Sdes } 647238106Sdes } else if(sigalg && sec == sec_status_bogus) { 648238106Sdes algo_needs_set_bogus(&needs, 649238106Sdes (uint8_t)ds_get_key_algo(ta_ds, i)); 650238106Sdes } 651238106Sdes } 652238106Sdes } 653238106Sdes 654238106Sdes /* None of the DS's worked out: check the DNSKEYs. */ 655238106Sdes if(ta_dnskey) { 656238106Sdes num = rrset_get_count(ta_dnskey); 657238106Sdes for(i=0; i<num; i++) { 658238106Sdes /* Check to see if we can understand this DNSKEY */ 659238106Sdes if(!dnskey_algo_is_supported(ta_dnskey, i)) 660238106Sdes continue; 661238106Sdes 662238106Sdes /* we saw a useful TA */ 663266114Sdes has_useful_ta = 1; 664238106Sdes 665238106Sdes sec = dnskey_verify_rrset(env, ve, dnskey_rrset, 666356345Scy ta_dnskey, i, reason, LDNS_SECTION_ANSWER, qstate); 667238106Sdes if(sec == sec_status_secure) { 668238106Sdes if(!sigalg || algo_needs_set_secure(&needs, 669238106Sdes (uint8_t)dnskey_get_algo(ta_dnskey, i))) { 670238106Sdes verbose(VERB_ALGO, "anchor matched DNSKEY."); 671238106Sdes return sec_status_secure; 672238106Sdes } 673238106Sdes } else if(sigalg && sec == sec_status_bogus) { 674238106Sdes algo_needs_set_bogus(&needs, 675238106Sdes (uint8_t)dnskey_get_algo(ta_dnskey, i)); 676238106Sdes } 677238106Sdes } 678238106Sdes } 679238106Sdes 680238106Sdes /* If no DSs were understandable, then this is OK. */ 681238106Sdes if(!has_useful_ta) { 682238106Sdes verbose(VERB_ALGO, "No usable trust anchors were found -- " 683238106Sdes "treating as insecure."); 684238106Sdes return sec_status_insecure; 685238106Sdes } 686238106Sdes /* If any were understandable, then it is bad. */ 687238106Sdes verbose(VERB_QUERY, "Failed to match any usable anchor to a DNSKEY."); 688238106Sdes if(sigalg && (alg=algo_needs_missing(&needs)) != 0) { 689238106Sdes algo_needs_reason(env, alg, reason, "missing verification of " 690238106Sdes "DNSKEY signature"); 691238106Sdes } 692238106Sdes return sec_status_bogus; 693238106Sdes} 694238106Sdes 695238106Sdesstruct key_entry_key* 696238106Sdesval_verify_new_DNSKEYs_with_ta(struct regional* region, struct module_env* env, 697238106Sdes struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset, 698238106Sdes struct ub_packed_rrset_key* ta_ds_rrset, 699238106Sdes struct ub_packed_rrset_key* ta_dnskey_rrset, int downprot, 700356345Scy char** reason, struct module_qstate* qstate) 701238106Sdes{ 702238106Sdes uint8_t sigalg[ALGO_NEEDS_MAX+1]; 703238106Sdes enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve, 704238106Sdes dnskey_rrset, ta_ds_rrset, ta_dnskey_rrset, 705356345Scy downprot?sigalg:NULL, reason, qstate); 706238106Sdes 707238106Sdes if(sec == sec_status_secure) { 708238106Sdes return key_entry_create_rrset(region, 709238106Sdes dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len, 710238106Sdes ntohs(dnskey_rrset->rk.rrset_class), dnskey_rrset, 711238106Sdes downprot?sigalg:NULL, *env->now); 712238106Sdes } else if(sec == sec_status_insecure) { 713238106Sdes return key_entry_create_null(region, dnskey_rrset->rk.dname, 714238106Sdes dnskey_rrset->rk.dname_len, 715238106Sdes ntohs(dnskey_rrset->rk.rrset_class), 716238106Sdes rrset_get_ttl(dnskey_rrset), *env->now); 717238106Sdes } 718238106Sdes return key_entry_create_bad(region, dnskey_rrset->rk.dname, 719238106Sdes dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class), 720238106Sdes BOGUS_KEY_TTL, *env->now); 721238106Sdes} 722238106Sdes 723238106Sdesint 724238106Sdesval_dsset_isusable(struct ub_packed_rrset_key* ds_rrset) 725238106Sdes{ 726238106Sdes size_t i; 727238106Sdes for(i=0; i<rrset_get_count(ds_rrset); i++) { 728238106Sdes if(ds_digest_algo_is_supported(ds_rrset, i) && 729238106Sdes ds_key_algo_is_supported(ds_rrset, i)) 730238106Sdes return 1; 731238106Sdes } 732296415Sdes if(verbosity < VERB_ALGO) 733296415Sdes return 0; 734296415Sdes if(rrset_get_count(ds_rrset) == 0) 735296415Sdes verbose(VERB_ALGO, "DS is not usable"); 736296415Sdes else { 737296415Sdes /* report usability for the first DS RR */ 738296415Sdes sldns_lookup_table *lt; 739296415Sdes char herr[64], aerr[64]; 740296415Sdes lt = sldns_lookup_by_id(sldns_hashes, 741296415Sdes (int)ds_get_digest_algo(ds_rrset, i)); 742296415Sdes if(lt) snprintf(herr, sizeof(herr), "%s", lt->name); 743296415Sdes else snprintf(herr, sizeof(herr), "%d", 744296415Sdes (int)ds_get_digest_algo(ds_rrset, i)); 745296415Sdes lt = sldns_lookup_by_id(sldns_algorithms, 746296415Sdes (int)ds_get_key_algo(ds_rrset, i)); 747296415Sdes if(lt) snprintf(aerr, sizeof(aerr), "%s", lt->name); 748296415Sdes else snprintf(aerr, sizeof(aerr), "%d", 749296415Sdes (int)ds_get_key_algo(ds_rrset, i)); 750296415Sdes verbose(VERB_ALGO, "DS unsupported, hash %s %s, " 751296415Sdes "key algorithm %s %s", herr, 752296415Sdes (ds_digest_algo_is_supported(ds_rrset, 0)? 753296415Sdes "(supported)":"(unsupported)"), aerr, 754296415Sdes (ds_key_algo_is_supported(ds_rrset, 0)? 755296415Sdes "(supported)":"(unsupported)")); 756296415Sdes } 757238106Sdes return 0; 758238106Sdes} 759238106Sdes 760238106Sdes/** get label count for a signature */ 761238106Sdesstatic uint8_t 762238106Sdesrrsig_get_labcount(struct packed_rrset_data* d, size_t sig) 763238106Sdes{ 764238106Sdes if(d->rr_len[sig] < 2+4) 765238106Sdes return 0; /* bad sig length */ 766238106Sdes return d->rr_data[sig][2+3]; 767238106Sdes} 768238106Sdes 769238106Sdesint 770356345Scyval_rrset_wildcard(struct ub_packed_rrset_key* rrset, uint8_t** wc, 771356345Scy size_t* wc_len) 772238106Sdes{ 773238106Sdes struct packed_rrset_data* d = (struct packed_rrset_data*)rrset-> 774238106Sdes entry.data; 775238106Sdes uint8_t labcount; 776238106Sdes int labdiff; 777238106Sdes uint8_t* wn; 778238106Sdes size_t i, wl; 779238106Sdes if(d->rrsig_count == 0) { 780238106Sdes return 1; 781238106Sdes } 782238106Sdes labcount = rrsig_get_labcount(d, d->count + 0); 783238106Sdes /* check rest of signatures identical */ 784238106Sdes for(i=1; i<d->rrsig_count; i++) { 785238106Sdes if(labcount != rrsig_get_labcount(d, d->count + i)) { 786238106Sdes return 0; 787238106Sdes } 788238106Sdes } 789238106Sdes /* OK the rrsigs check out */ 790238106Sdes /* if the RRSIG label count is shorter than the number of actual 791238106Sdes * labels, then this rrset was synthesized from a wildcard. 792238106Sdes * Note that the RRSIG label count doesn't count the root label. */ 793238106Sdes wn = rrset->rk.dname; 794238106Sdes wl = rrset->rk.dname_len; 795238106Sdes /* skip a leading wildcard label in the dname (RFC4035 2.2) */ 796238106Sdes if(dname_is_wild(wn)) { 797238106Sdes wn += 2; 798238106Sdes wl -= 2; 799238106Sdes } 800238106Sdes labdiff = (dname_count_labels(wn) - 1) - (int)labcount; 801238106Sdes if(labdiff > 0) { 802238106Sdes *wc = wn; 803238106Sdes dname_remove_labels(wc, &wl, labdiff); 804356345Scy *wc_len = wl; 805238106Sdes return 1; 806238106Sdes } 807238106Sdes return 1; 808238106Sdes} 809238106Sdes 810238106Sdesint 811238106Sdesval_chase_cname(struct query_info* qchase, struct reply_info* rep, 812238106Sdes size_t* cname_skip) { 813238106Sdes size_t i; 814238106Sdes /* skip any DNAMEs, go to the CNAME for next part */ 815238106Sdes for(i = *cname_skip; i < rep->an_numrrsets; i++) { 816238106Sdes if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME && 817238106Sdes query_dname_compare(qchase->qname, rep->rrsets[i]-> 818238106Sdes rk.dname) == 0) { 819238106Sdes qchase->qname = NULL; 820238106Sdes get_cname_target(rep->rrsets[i], &qchase->qname, 821238106Sdes &qchase->qname_len); 822238106Sdes if(!qchase->qname) 823238106Sdes return 0; /* bad CNAME rdata */ 824238106Sdes (*cname_skip) = i+1; 825238106Sdes return 1; 826238106Sdes } 827238106Sdes } 828238106Sdes return 0; /* CNAME classified but no matching CNAME ?! */ 829238106Sdes} 830238106Sdes 831238106Sdes/** see if rrset has signer name as one of the rrsig signers */ 832238106Sdesstatic int 833238106Sdesrrset_has_signer(struct ub_packed_rrset_key* rrset, uint8_t* name, size_t len) 834238106Sdes{ 835238106Sdes struct packed_rrset_data* d = (struct packed_rrset_data*)rrset-> 836238106Sdes entry.data; 837238106Sdes size_t i; 838238106Sdes for(i = d->count; i< d->count+d->rrsig_count; i++) { 839238106Sdes if(d->rr_len[i] > 2+18+len) { 840238106Sdes /* at least rdatalen + signature + signame (+1 sig)*/ 841266114Sdes if(!dname_valid(d->rr_data[i]+2+18, d->rr_len[i]-2-18)) 842266114Sdes continue; 843238106Sdes if(query_dname_compare(name, d->rr_data[i]+2+18) == 0) 844238106Sdes { 845238106Sdes return 1; 846238106Sdes } 847238106Sdes } 848238106Sdes } 849238106Sdes return 0; 850238106Sdes} 851238106Sdes 852238106Sdesvoid 853238106Sdesval_fill_reply(struct reply_info* chase, struct reply_info* orig, 854238106Sdes size_t skip, uint8_t* name, size_t len, uint8_t* signer) 855238106Sdes{ 856238106Sdes size_t i; 857238106Sdes int seen_dname = 0; 858238106Sdes chase->rrset_count = 0; 859238106Sdes chase->an_numrrsets = 0; 860238106Sdes chase->ns_numrrsets = 0; 861238106Sdes chase->ar_numrrsets = 0; 862238106Sdes /* ANSWER section */ 863238106Sdes for(i=skip; i<orig->an_numrrsets; i++) { 864238106Sdes if(!signer) { 865238106Sdes if(query_dname_compare(name, 866238106Sdes orig->rrsets[i]->rk.dname) == 0) 867238106Sdes chase->rrsets[chase->an_numrrsets++] = 868238106Sdes orig->rrsets[i]; 869238106Sdes } else if(seen_dname && ntohs(orig->rrsets[i]->rk.type) == 870238106Sdes LDNS_RR_TYPE_CNAME) { 871238106Sdes chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i]; 872238106Sdes seen_dname = 0; 873238106Sdes } else if(rrset_has_signer(orig->rrsets[i], name, len)) { 874238106Sdes chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i]; 875238106Sdes if(ntohs(orig->rrsets[i]->rk.type) == 876238106Sdes LDNS_RR_TYPE_DNAME) { 877238106Sdes seen_dname = 1; 878238106Sdes } 879238106Sdes } 880238106Sdes } 881238106Sdes /* AUTHORITY section */ 882238106Sdes for(i = (skip > orig->an_numrrsets)?skip:orig->an_numrrsets; 883238106Sdes i<orig->an_numrrsets+orig->ns_numrrsets; 884238106Sdes i++) { 885238106Sdes if(!signer) { 886238106Sdes if(query_dname_compare(name, 887238106Sdes orig->rrsets[i]->rk.dname) == 0) 888238106Sdes chase->rrsets[chase->an_numrrsets+ 889238106Sdes chase->ns_numrrsets++] = orig->rrsets[i]; 890238106Sdes } else if(rrset_has_signer(orig->rrsets[i], name, len)) { 891238106Sdes chase->rrsets[chase->an_numrrsets+ 892238106Sdes chase->ns_numrrsets++] = orig->rrsets[i]; 893238106Sdes } 894238106Sdes } 895238106Sdes /* ADDITIONAL section */ 896238106Sdes for(i= (skip>orig->an_numrrsets+orig->ns_numrrsets)? 897238106Sdes skip:orig->an_numrrsets+orig->ns_numrrsets; 898238106Sdes i<orig->rrset_count; i++) { 899238106Sdes if(!signer) { 900238106Sdes if(query_dname_compare(name, 901238106Sdes orig->rrsets[i]->rk.dname) == 0) 902238106Sdes chase->rrsets[chase->an_numrrsets 903238106Sdes +orig->ns_numrrsets+chase->ar_numrrsets++] 904238106Sdes = orig->rrsets[i]; 905238106Sdes } else if(rrset_has_signer(orig->rrsets[i], name, len)) { 906238106Sdes chase->rrsets[chase->an_numrrsets+orig->ns_numrrsets+ 907238106Sdes chase->ar_numrrsets++] = orig->rrsets[i]; 908238106Sdes } 909238106Sdes } 910238106Sdes chase->rrset_count = chase->an_numrrsets + chase->ns_numrrsets + 911238106Sdes chase->ar_numrrsets; 912238106Sdes} 913238106Sdes 914282089Sdesvoid val_reply_remove_auth(struct reply_info* rep, size_t index) 915282089Sdes{ 916282089Sdes log_assert(index < rep->rrset_count); 917282089Sdes log_assert(index >= rep->an_numrrsets); 918282089Sdes log_assert(index < rep->an_numrrsets+rep->ns_numrrsets); 919282089Sdes memmove(rep->rrsets+index, rep->rrsets+index+1, 920282089Sdes sizeof(struct ub_packed_rrset_key*)* 921282089Sdes (rep->rrset_count - index - 1)); 922282089Sdes rep->ns_numrrsets--; 923282089Sdes rep->rrset_count--; 924282089Sdes} 925282089Sdes 926238106Sdesvoid 927356345Scyval_check_nonsecure(struct module_env* env, struct reply_info* rep) 928238106Sdes{ 929238106Sdes size_t i; 930238106Sdes /* authority */ 931238106Sdes for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) { 932238106Sdes if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data) 933238106Sdes ->security != sec_status_secure) { 934238106Sdes /* because we want to return the authentic original 935238106Sdes * message when presented with CD-flagged queries, 936238106Sdes * we need to preserve AUTHORITY section data. 937238106Sdes * However, this rrset is not signed or signed 938238106Sdes * with the wrong keys. Validation has tried to 939238106Sdes * verify this rrset with the keysets of import. 940238106Sdes * But this rrset did not verify. 941238106Sdes * Therefore the message is bogus. 942238106Sdes */ 943238106Sdes 944356345Scy /* check if authority has an NS record 945238106Sdes * which is bad, and there is an answer section with 946238106Sdes * data. In that case, delete NS and additional to 947238106Sdes * be lenient and make a minimal response */ 948356345Scy if(rep->an_numrrsets != 0 && 949238106Sdes ntohs(rep->rrsets[i]->rk.type) 950238106Sdes == LDNS_RR_TYPE_NS) { 951238106Sdes verbose(VERB_ALGO, "truncate to minimal"); 952238106Sdes rep->ar_numrrsets = 0; 953356345Scy rep->rrset_count = rep->an_numrrsets + 954356345Scy rep->ns_numrrsets; 955356345Scy /* remove this unneeded authority rrset */ 956356345Scy memmove(rep->rrsets+i, rep->rrsets+i+1, 957356345Scy sizeof(struct ub_packed_rrset_key*)* 958356345Scy (rep->rrset_count - i - 1)); 959356345Scy rep->ns_numrrsets--; 960356345Scy rep->rrset_count--; 961356345Scy i--; 962238106Sdes return; 963238106Sdes } 964238106Sdes 965238106Sdes log_nametypeclass(VERB_QUERY, "message is bogus, " 966238106Sdes "non secure rrset", 967238106Sdes rep->rrsets[i]->rk.dname, 968238106Sdes ntohs(rep->rrsets[i]->rk.type), 969238106Sdes ntohs(rep->rrsets[i]->rk.rrset_class)); 970238106Sdes rep->security = sec_status_bogus; 971238106Sdes return; 972238106Sdes } 973238106Sdes } 974238106Sdes /* additional */ 975356345Scy if(!env->cfg->val_clean_additional) 976238106Sdes return; 977238106Sdes for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) { 978238106Sdes if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data) 979238106Sdes ->security != sec_status_secure) { 980238106Sdes /* This does not cause message invalidation. It was 981238106Sdes * simply unsigned data in the additional. The 982238106Sdes * RRSIG must have been truncated off the message. 983238106Sdes * 984238106Sdes * However, we do not want to return possible bogus 985238106Sdes * data to clients that rely on this service for 986238106Sdes * their authentication. 987238106Sdes */ 988238106Sdes /* remove this unneeded additional rrset */ 989238106Sdes memmove(rep->rrsets+i, rep->rrsets+i+1, 990238106Sdes sizeof(struct ub_packed_rrset_key*)* 991238106Sdes (rep->rrset_count - i - 1)); 992238106Sdes rep->ar_numrrsets--; 993238106Sdes rep->rrset_count--; 994238106Sdes i--; 995238106Sdes } 996238106Sdes } 997238106Sdes} 998238106Sdes 999238106Sdes/** check no anchor and unlock */ 1000238106Sdesstatic int 1001238106Sdescheck_no_anchor(struct val_anchors* anchors, uint8_t* nm, size_t l, uint16_t c) 1002238106Sdes{ 1003238106Sdes struct trust_anchor* ta; 1004238106Sdes if((ta=anchors_lookup(anchors, nm, l, c))) { 1005238106Sdes lock_basic_unlock(&ta->lock); 1006238106Sdes } 1007238106Sdes return !ta; 1008238106Sdes} 1009238106Sdes 1010238106Sdesvoid 1011238106Sdesval_mark_indeterminate(struct reply_info* rep, struct val_anchors* anchors, 1012238106Sdes struct rrset_cache* r, struct module_env* env) 1013238106Sdes{ 1014238106Sdes size_t i; 1015238106Sdes struct packed_rrset_data* d; 1016238106Sdes for(i=0; i<rep->rrset_count; i++) { 1017238106Sdes d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data; 1018238106Sdes if(d->security == sec_status_unchecked && 1019238106Sdes check_no_anchor(anchors, rep->rrsets[i]->rk.dname, 1020238106Sdes rep->rrsets[i]->rk.dname_len, 1021238106Sdes ntohs(rep->rrsets[i]->rk.rrset_class))) 1022238106Sdes { 1023238106Sdes /* mark as indeterminate */ 1024238106Sdes d->security = sec_status_indeterminate; 1025238106Sdes rrset_update_sec_status(r, rep->rrsets[i], *env->now); 1026238106Sdes } 1027238106Sdes } 1028238106Sdes} 1029238106Sdes 1030238106Sdesvoid 1031238106Sdesval_mark_insecure(struct reply_info* rep, uint8_t* kname, 1032238106Sdes struct rrset_cache* r, struct module_env* env) 1033238106Sdes{ 1034238106Sdes size_t i; 1035238106Sdes struct packed_rrset_data* d; 1036238106Sdes for(i=0; i<rep->rrset_count; i++) { 1037238106Sdes d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data; 1038238106Sdes if(d->security == sec_status_unchecked && 1039238106Sdes dname_subdomain_c(rep->rrsets[i]->rk.dname, kname)) { 1040238106Sdes /* mark as insecure */ 1041238106Sdes d->security = sec_status_insecure; 1042238106Sdes rrset_update_sec_status(r, rep->rrsets[i], *env->now); 1043238106Sdes } 1044238106Sdes } 1045238106Sdes} 1046238106Sdes 1047238106Sdessize_t 1048238106Sdesval_next_unchecked(struct reply_info* rep, size_t skip) 1049238106Sdes{ 1050238106Sdes size_t i; 1051238106Sdes struct packed_rrset_data* d; 1052238106Sdes for(i=skip+1; i<rep->rrset_count; i++) { 1053238106Sdes d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data; 1054238106Sdes if(d->security == sec_status_unchecked) { 1055238106Sdes return i; 1056238106Sdes } 1057238106Sdes } 1058238106Sdes return rep->rrset_count; 1059238106Sdes} 1060238106Sdes 1061238106Sdesconst char* 1062238106Sdesval_classification_to_string(enum val_classification subtype) 1063238106Sdes{ 1064238106Sdes switch(subtype) { 1065238106Sdes case VAL_CLASS_UNTYPED: return "untyped"; 1066238106Sdes case VAL_CLASS_UNKNOWN: return "unknown"; 1067238106Sdes case VAL_CLASS_POSITIVE: return "positive"; 1068238106Sdes case VAL_CLASS_CNAME: return "cname"; 1069238106Sdes case VAL_CLASS_NODATA: return "nodata"; 1070238106Sdes case VAL_CLASS_NAMEERROR: return "nameerror"; 1071238106Sdes case VAL_CLASS_CNAMENOANSWER: return "cnamenoanswer"; 1072238106Sdes case VAL_CLASS_REFERRAL: return "referral"; 1073238106Sdes case VAL_CLASS_ANY: return "qtype_any"; 1074238106Sdes default: 1075238106Sdes return "bad_val_classification"; 1076238106Sdes } 1077238106Sdes} 1078238106Sdes 1079238106Sdes/** log a sock_list entry */ 1080238106Sdesstatic void 1081238106Sdessock_list_logentry(enum verbosity_value v, const char* s, struct sock_list* p) 1082238106Sdes{ 1083238106Sdes if(p->len) 1084238106Sdes log_addr(v, s, &p->addr, p->len); 1085238106Sdes else verbose(v, "%s cache", s); 1086238106Sdes} 1087238106Sdes 1088238106Sdesvoid val_blacklist(struct sock_list** blacklist, struct regional* region, 1089238106Sdes struct sock_list* origin, int cross) 1090238106Sdes{ 1091238106Sdes /* debug printout */ 1092238106Sdes if(verbosity >= VERB_ALGO) { 1093238106Sdes struct sock_list* p; 1094238106Sdes for(p=*blacklist; p; p=p->next) 1095238106Sdes sock_list_logentry(VERB_ALGO, "blacklist", p); 1096238106Sdes if(!origin) 1097238106Sdes verbose(VERB_ALGO, "blacklist add: cache"); 1098238106Sdes for(p=origin; p; p=p->next) 1099238106Sdes sock_list_logentry(VERB_ALGO, "blacklist add", p); 1100238106Sdes } 1101238106Sdes /* blacklist the IPs or the cache */ 1102238106Sdes if(!origin) { 1103238106Sdes /* only add if nothing there. anything else also stops cache*/ 1104238106Sdes if(!*blacklist) 1105238106Sdes sock_list_insert(blacklist, NULL, 0, region); 1106238106Sdes } else if(!cross) 1107238106Sdes sock_list_prepend(blacklist, origin); 1108238106Sdes else sock_list_merge(blacklist, region, origin); 1109238106Sdes} 1110238106Sdes 1111238106Sdesint val_has_signed_nsecs(struct reply_info* rep, char** reason) 1112238106Sdes{ 1113238106Sdes size_t i, num_nsec = 0, num_nsec3 = 0; 1114238106Sdes struct packed_rrset_data* d; 1115238106Sdes for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) { 1116238106Sdes if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC)) 1117238106Sdes num_nsec++; 1118238106Sdes else if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC3)) 1119238106Sdes num_nsec3++; 1120238106Sdes else continue; 1121238106Sdes d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data; 1122238106Sdes if(d && d->rrsig_count != 0) { 1123238106Sdes return 1; 1124238106Sdes } 1125238106Sdes } 1126238106Sdes if(num_nsec == 0 && num_nsec3 == 0) 1127238106Sdes *reason = "no DNSSEC records"; 1128238106Sdes else if(num_nsec != 0) 1129238106Sdes *reason = "no signatures over NSECs"; 1130238106Sdes else *reason = "no signatures over NSEC3s"; 1131238106Sdes return 0; 1132238106Sdes} 1133238106Sdes 1134238106Sdesstruct dns_msg* 1135238106Sdesval_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c, 1136238106Sdes struct regional* region, uint8_t* topname) 1137238106Sdes{ 1138238106Sdes struct dns_msg* msg; 1139238106Sdes struct query_info qinfo; 1140238106Sdes struct ub_packed_rrset_key *rrset = rrset_cache_lookup( 1141238106Sdes env->rrset_cache, nm, nmlen, LDNS_RR_TYPE_DS, c, 0, 1142238106Sdes *env->now, 0); 1143238106Sdes if(rrset) { 1144238106Sdes /* DS rrset exists. Return it to the validator immediately*/ 1145238106Sdes struct ub_packed_rrset_key* copy = packed_rrset_copy_region( 1146238106Sdes rrset, region, *env->now); 1147238106Sdes lock_rw_unlock(&rrset->entry.lock); 1148238106Sdes if(!copy) 1149238106Sdes return NULL; 1150238106Sdes msg = dns_msg_create(nm, nmlen, LDNS_RR_TYPE_DS, c, region, 1); 1151238106Sdes if(!msg) 1152238106Sdes return NULL; 1153238106Sdes msg->rep->rrsets[0] = copy; 1154238106Sdes msg->rep->rrset_count++; 1155238106Sdes msg->rep->an_numrrsets++; 1156238106Sdes return msg; 1157238106Sdes } 1158238106Sdes /* lookup in rrset and negative cache for NSEC/NSEC3 */ 1159238106Sdes qinfo.qname = nm; 1160238106Sdes qinfo.qname_len = nmlen; 1161238106Sdes qinfo.qtype = LDNS_RR_TYPE_DS; 1162238106Sdes qinfo.qclass = c; 1163356345Scy qinfo.local_alias = NULL; 1164238106Sdes /* do not add SOA to reply message, it is going to be used internal */ 1165238106Sdes msg = val_neg_getmsg(env->neg_cache, &qinfo, region, env->rrset_cache, 1166356345Scy env->scratch_buffer, *env->now, 0, topname, env->cfg); 1167238106Sdes return msg; 1168238106Sdes} 1169