1 /* 2 * validator/val_utils.c - validator utility functions. 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains helper functions for the validator module. 40 */ 41 #include "config.h" 42 #include "validator/val_utils.h" 43 #include "validator/validator.h" 44 #include "validator/val_kentry.h" 45 #include "validator/val_sigcrypt.h" 46 #include "validator/val_anchor.h" 47 #include "validator/val_nsec.h" 48 #include "validator/val_neg.h" 49 #include "services/cache/rrset.h" 50 #include "services/cache/dns.h" 51 #include "util/data/msgreply.h" 52 #include "util/data/packed_rrset.h" 53 #include "util/data/dname.h" 54 #include "util/net_help.h" 55 #include "util/module.h" 56 #include "util/regional.h" 57 #include "util/config_file.h" 58 #include "sldns/wire2str.h" 59 #include "sldns/parseutil.h" 60 61 /** Maximum allowed digest match failures per DS, for DNSKEYs with the same 62 * properties */ 63 #define MAX_DS_MATCH_FAILURES 4 64 65 enum val_classification 66 val_classify_response(uint16_t query_flags, struct query_info* origqinf, 67 struct query_info* qinf, struct reply_info* rep, size_t skip) 68 { 69 int rcode = (int)FLAGS_GET_RCODE(rep->flags); 70 size_t i; 71 72 /* Normal Name Error's are easy to detect -- but don't mistake a CNAME 73 * chain ending in NXDOMAIN. */ 74 if(rcode == LDNS_RCODE_NXDOMAIN && rep->an_numrrsets == 0) 75 return VAL_CLASS_NAMEERROR; 76 77 /* check for referral: nonRD query and it looks like a nodata */ 78 if(!(query_flags&BIT_RD) && rep->an_numrrsets == 0 && 79 rcode == LDNS_RCODE_NOERROR) { 80 /* SOA record in auth indicates it is NODATA instead. 81 * All validation requiring NODATA messages have SOA in 82 * authority section. */ 83 /* uses fact that answer section is empty */ 84 int saw_ns = 0; 85 for(i=0; i<rep->ns_numrrsets; i++) { 86 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_SOA) 87 return VAL_CLASS_NODATA; 88 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_DS) 89 return VAL_CLASS_REFERRAL; 90 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS) 91 saw_ns = 1; 92 } 93 return saw_ns?VAL_CLASS_REFERRAL:VAL_CLASS_NODATA; 94 } 95 /* root referral where NS set is in the answer section */ 96 if(!(query_flags&BIT_RD) && rep->ns_numrrsets == 0 && 97 rep->an_numrrsets == 1 && rcode == LDNS_RCODE_NOERROR && 98 ntohs(rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_NS && 99 query_dname_compare(rep->rrsets[0]->rk.dname, 100 origqinf->qname) != 0) 101 return VAL_CLASS_REFERRAL; 102 103 /* dump bad messages */ 104 if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) 105 return VAL_CLASS_UNKNOWN; 106 /* next check if the skip into the answer section shows no answer */ 107 if(skip>0 && rep->an_numrrsets <= skip) 108 return VAL_CLASS_CNAMENOANSWER; 109 110 /* Next is NODATA */ 111 if(rcode == LDNS_RCODE_NOERROR && rep->an_numrrsets == 0) 112 return VAL_CLASS_NODATA; 113 114 /* We distinguish between CNAME response and other positive/negative 115 * responses because CNAME answers require extra processing. */ 116 117 /* We distinguish between ANY and CNAME or POSITIVE because 118 * ANY responses are validated differently. */ 119 if(rcode == LDNS_RCODE_NOERROR && qinf->qtype == LDNS_RR_TYPE_ANY) 120 return VAL_CLASS_ANY; 121 122 /* For the query type DNAME, the name matters. Equal name is the 123 * answer looked for, but a subdomain redirects the query. */ 124 if(qinf->qtype == LDNS_RR_TYPE_DNAME) { 125 for(i=skip; i<rep->an_numrrsets; i++) { 126 if(rcode == LDNS_RCODE_NOERROR && 127 ntohs(rep->rrsets[i]->rk.type) 128 == LDNS_RR_TYPE_DNAME && 129 query_dname_compare(qinf->qname, 130 rep->rrsets[i]->rk.dname) == 0) { 131 /* type is DNAME and name is equal, it is 132 * the answer. For the query name a subdomain 133 * of the rrset.dname it would redirect. */ 134 return VAL_CLASS_POSITIVE; 135 } 136 if(ntohs(rep->rrsets[i]->rk.type) 137 == LDNS_RR_TYPE_CNAME) 138 return VAL_CLASS_CNAME; 139 } 140 log_dns_msg("validator: error. failed to classify response message: ", 141 qinf, rep); 142 return VAL_CLASS_UNKNOWN; 143 } 144 145 /* Note that DNAMEs will be ignored here, unless qtype=DNAME. Unless 146 * qtype=CNAME, this will yield a CNAME response. */ 147 for(i=skip; i<rep->an_numrrsets; i++) { 148 if(rcode == LDNS_RCODE_NOERROR && 149 ntohs(rep->rrsets[i]->rk.type) == qinf->qtype) 150 return VAL_CLASS_POSITIVE; 151 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME) 152 return VAL_CLASS_CNAME; 153 } 154 log_dns_msg("validator: error. failed to classify response message: ", 155 qinf, rep); 156 return VAL_CLASS_UNKNOWN; 157 } 158 159 /** Get signer name from RRSIG */ 160 void 161 rrsig_get_signer(uint8_t* data, size_t len, uint8_t** sname, size_t* slen) 162 { 163 /* RRSIG rdata is not allowed to be compressed, it is stored 164 * uncompressed in memory as well, so return a ptr to the name */ 165 if(len < 21) { 166 /* too short RRSig: 167 * short, byte, byte, long, long, long, short, "." is 168 * 2 1 1 4 4 4 2 1 = 19 169 * and a skip of 18 bytes to the name. 170 * +2 for the rdatalen is 21 bytes len for root label */ 171 *sname = NULL; 172 *slen = 0; 173 return; 174 } 175 data += 20; /* skip the fixed size bits */ 176 len -= 20; 177 *slen = dname_valid(data, len); 178 if(!*slen) { 179 /* bad dname in this rrsig. */ 180 *sname = NULL; 181 return; 182 } 183 *sname = data; 184 } 185 186 void 187 val_find_rrset_signer(struct ub_packed_rrset_key* rrset, uint8_t** sname, 188 size_t* slen) 189 { 190 struct packed_rrset_data* d = (struct packed_rrset_data*) 191 rrset->entry.data; 192 /* return signer for first signature, or NULL */ 193 if(d->rrsig_count == 0) { 194 *sname = NULL; 195 *slen = 0; 196 return; 197 } 198 /* get rrsig signer name out of the signature */ 199 rrsig_get_signer(d->rr_data[d->count], d->rr_len[d->count], 200 sname, slen); 201 } 202 203 /** 204 * Find best signer name in this set of rrsigs. 205 * @param rrset: which rrsigs to look through. 206 * @param qinf: the query name that needs validation. 207 * @param signer_name: the best signer_name. Updated if a better one is found. 208 * @param signer_len: length of signer name. 209 * @param matchcount: count of current best name (starts at 0 for no match). 210 * Updated if match is improved. 211 */ 212 static void 213 val_find_best_signer(struct ub_packed_rrset_key* rrset, 214 struct query_info* qinf, uint8_t** signer_name, size_t* signer_len, 215 int* matchcount) 216 { 217 struct packed_rrset_data* d = (struct packed_rrset_data*) 218 rrset->entry.data; 219 uint8_t* sign; 220 size_t i; 221 int m; 222 for(i=d->count; i<d->count+d->rrsig_count; i++) { 223 sign = d->rr_data[i]+2+18; 224 /* look at signatures that are valid (long enough), 225 * and have a signer name that is a superdomain of qname, 226 * and then check the number of labels in the shared topdomain 227 * improve the match if possible */ 228 if(d->rr_len[i] > 2+19 && /* rdata, sig + root label*/ 229 dname_subdomain_c(qinf->qname, sign)) { 230 (void)dname_lab_cmp(qinf->qname, 231 dname_count_labels(qinf->qname), 232 sign, dname_count_labels(sign), &m); 233 if(m > *matchcount) { 234 *matchcount = m; 235 *signer_name = sign; 236 (void)dname_count_size_labels(*signer_name, 237 signer_len); 238 } 239 } 240 } 241 } 242 243 /** Detect if the, unsigned, CNAME is under a previous DNAME RR in the 244 * message, and thus it was generated from that previous DNAME. 245 */ 246 static int 247 cname_under_previous_dname(struct reply_info* rep, size_t cname_idx, 248 size_t* ret) 249 { 250 size_t i; 251 for(i=0; i<cname_idx; i++) { 252 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_DNAME && 253 dname_strict_subdomain_c(rep->rrsets[cname_idx]-> 254 rk.dname, rep->rrsets[i]->rk.dname)) { 255 *ret = i; 256 return 1; 257 } 258 } 259 *ret = 0; 260 return 0; 261 } 262 263 void 264 val_find_signer(enum val_classification subtype, struct query_info* qinf, 265 struct reply_info* rep, size_t skip, uint8_t** signer_name, 266 size_t* signer_len) 267 { 268 size_t i; 269 270 if(subtype == VAL_CLASS_POSITIVE) { 271 /* check for the answer rrset */ 272 for(i=skip; i<rep->an_numrrsets; i++) { 273 if(query_dname_compare(qinf->qname, 274 rep->rrsets[i]->rk.dname) == 0) { 275 val_find_rrset_signer(rep->rrsets[i], 276 signer_name, signer_len); 277 /* If there was no signer, and the query 278 * was for type CNAME, and this is a CNAME, 279 * and the previous is a DNAME, then this 280 * is the synthesized CNAME, use the signer 281 * of the DNAME record. */ 282 if(*signer_name == NULL && 283 qinf->qtype == LDNS_RR_TYPE_CNAME && 284 ntohs(rep->rrsets[i]->rk.type) == 285 LDNS_RR_TYPE_CNAME && i > skip && 286 ntohs(rep->rrsets[i-1]->rk.type) == 287 LDNS_RR_TYPE_DNAME && 288 dname_strict_subdomain_c(rep->rrsets[i]->rk.dname, rep->rrsets[i-1]->rk.dname)) { 289 val_find_rrset_signer(rep->rrsets[i-1], 290 signer_name, signer_len); 291 } 292 return; 293 } 294 } 295 *signer_name = NULL; 296 *signer_len = 0; 297 } else if(subtype == VAL_CLASS_CNAME) { 298 size_t j; 299 /* check for the first signed cname/dname rrset */ 300 for(i=skip; i<rep->an_numrrsets; i++) { 301 val_find_rrset_signer(rep->rrsets[i], 302 signer_name, signer_len); 303 if(*signer_name) 304 return; 305 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME 306 && cname_under_previous_dname(rep, i, &j)) { 307 val_find_rrset_signer(rep->rrsets[j], 308 signer_name, signer_len); 309 return; 310 } 311 if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_DNAME) 312 break; /* only check CNAME after a DNAME */ 313 } 314 *signer_name = NULL; 315 *signer_len = 0; 316 } else if(subtype == VAL_CLASS_NAMEERROR 317 || subtype == VAL_CLASS_NODATA) { 318 /*Check to see if the AUTH section NSEC record(s) have rrsigs*/ 319 for(i=rep->an_numrrsets; i< 320 rep->an_numrrsets+rep->ns_numrrsets; i++) { 321 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC 322 || ntohs(rep->rrsets[i]->rk.type) == 323 LDNS_RR_TYPE_NSEC3) { 324 val_find_rrset_signer(rep->rrsets[i], 325 signer_name, signer_len); 326 return; 327 } 328 } 329 } else if(subtype == VAL_CLASS_CNAMENOANSWER) { 330 /* find closest superdomain signer name in authority section 331 * NSEC and NSEC3s */ 332 int matchcount = 0; 333 *signer_name = NULL; 334 *signer_len = 0; 335 for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep-> 336 ns_numrrsets; i++) { 337 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC 338 || ntohs(rep->rrsets[i]->rk.type) == 339 LDNS_RR_TYPE_NSEC3) { 340 val_find_best_signer(rep->rrsets[i], qinf, 341 signer_name, signer_len, &matchcount); 342 } 343 } 344 } else if(subtype == VAL_CLASS_ANY) { 345 /* check for one of the answer rrset that has signatures, 346 * or potentially a DNAME is in use with a different qname */ 347 for(i=skip; i<rep->an_numrrsets; i++) { 348 if(query_dname_compare(qinf->qname, 349 rep->rrsets[i]->rk.dname) == 0) { 350 val_find_rrset_signer(rep->rrsets[i], 351 signer_name, signer_len); 352 if(*signer_name) 353 return; 354 } 355 } 356 /* no answer RRSIGs with qname, try a DNAME */ 357 if(skip < rep->an_numrrsets && 358 ntohs(rep->rrsets[skip]->rk.type) == 359 LDNS_RR_TYPE_DNAME) { 360 val_find_rrset_signer(rep->rrsets[skip], 361 signer_name, signer_len); 362 if(*signer_name) 363 return; 364 } 365 *signer_name = NULL; 366 *signer_len = 0; 367 } else if(subtype == VAL_CLASS_REFERRAL) { 368 /* find keys for the item at skip */ 369 if(skip < rep->rrset_count) { 370 val_find_rrset_signer(rep->rrsets[skip], 371 signer_name, signer_len); 372 return; 373 } 374 *signer_name = NULL; 375 *signer_len = 0; 376 } else { 377 verbose(VERB_QUERY, "find_signer: could not find signer name" 378 " for unknown type response"); 379 *signer_name = NULL; 380 *signer_len = 0; 381 } 382 } 383 384 /** return number of rrs in an rrset */ 385 static size_t 386 rrset_get_count(struct ub_packed_rrset_key* rrset) 387 { 388 struct packed_rrset_data* d = (struct packed_rrset_data*) 389 rrset->entry.data; 390 if(!d) return 0; 391 return d->count; 392 } 393 394 /** return TTL of rrset */ 395 static uint32_t 396 rrset_get_ttl(struct ub_packed_rrset_key* rrset) 397 { 398 struct packed_rrset_data* d = (struct packed_rrset_data*) 399 rrset->entry.data; 400 if(!d) return 0; 401 return d->ttl; 402 } 403 404 static enum sec_status 405 val_verify_rrset(struct module_env* env, struct val_env* ve, 406 struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* keys, 407 uint8_t* sigalg, char** reason, sldns_ede_code *reason_bogus, 408 sldns_pkt_section section, struct module_qstate* qstate, 409 struct val_qstate* vq, int *verified, char* reasonbuf, 410 size_t reasonlen) 411 { 412 enum sec_status sec; 413 struct packed_rrset_data* d = (struct packed_rrset_data*)rrset-> 414 entry.data; 415 if(d->security == sec_status_secure) { 416 /* re-verify all other statuses, because keyset may change*/ 417 log_nametypeclass(VERB_ALGO, "verify rrset cached", 418 rrset->rk.dname, ntohs(rrset->rk.type), 419 ntohs(rrset->rk.rrset_class)); 420 *verified = 0; 421 return d->security; 422 } 423 /* check in the cache if verification has already been done */ 424 rrset_check_sec_status(env->rrset_cache, rrset, *env->now); 425 if(d->security == sec_status_secure) { 426 log_nametypeclass(VERB_ALGO, "verify rrset from cache", 427 rrset->rk.dname, ntohs(rrset->rk.type), 428 ntohs(rrset->rk.rrset_class)); 429 *verified = 0; 430 return d->security; 431 } 432 log_nametypeclass(VERB_ALGO, "verify rrset", rrset->rk.dname, 433 ntohs(rrset->rk.type), ntohs(rrset->rk.rrset_class)); 434 sec = dnskeyset_verify_rrset(env, ve, rrset, keys, sigalg, reason, 435 reason_bogus, section, qstate, vq, verified, reasonbuf, 436 reasonlen); 437 verbose(VERB_ALGO, "verify result: %s", sec_status_to_string(sec)); 438 regional_free_all(env->scratch); 439 440 /* update rrset security status 441 * only improves security status 442 * and bogus is set only once, even if we rechecked the status */ 443 if(sec > d->security) { 444 int wc_expanded = 0; 445 d->security = sec; 446 if(sec == sec_status_secure) { 447 uint8_t* wc = NULL; 448 size_t wclen = 0; 449 d->trust = rrset_trust_validated; 450 if(val_rrset_wildcard(rrset, &wc, &wclen) && wc) 451 wc_expanded = 1; 452 } else if(sec == sec_status_bogus) { 453 size_t i; 454 /* update ttl for rrset to fixed value. */ 455 d->ttl = ve->bogus_ttl; 456 for(i=0; i<d->count+d->rrsig_count; i++) 457 d->rr_ttl[i] = ve->bogus_ttl; 458 /* leave RR specific TTL: not used for determine 459 * if RRset timed out and clients see proper value. */ 460 lock_basic_lock(&ve->bogus_lock); 461 ve->num_rrset_bogus++; 462 lock_basic_unlock(&ve->bogus_lock); 463 } 464 /* if status updated - store in cache for reuse */ 465 /* For a wildcard rrset, that is secure, do not store this 466 * into the cache, because it changes proofs around the 467 * item. */ 468 if(!wc_expanded) 469 rrset_update_sec_status(env->rrset_cache, rrset, *env->now); 470 } 471 472 return sec; 473 } 474 475 enum sec_status 476 val_verify_rrset_entry(struct module_env* env, struct val_env* ve, 477 struct ub_packed_rrset_key* rrset, struct key_entry_key* kkey, 478 char** reason, sldns_ede_code *reason_bogus, 479 sldns_pkt_section section, struct module_qstate* qstate, 480 struct val_qstate* vq, int* verified, char* reasonbuf, 481 size_t reasonlen) 482 { 483 /* temporary dnskey rrset-key */ 484 struct ub_packed_rrset_key dnskey; 485 struct key_entry_data* kd = (struct key_entry_data*)kkey->entry.data; 486 enum sec_status sec; 487 dnskey.rk.type = htons(kd->rrset_type); 488 dnskey.rk.rrset_class = htons(kkey->key_class); 489 dnskey.rk.flags = 0; 490 dnskey.rk.dname = kkey->name; 491 dnskey.rk.dname_len = kkey->namelen; 492 dnskey.entry.key = &dnskey; 493 dnskey.entry.data = kd->rrset_data; 494 sec = val_verify_rrset(env, ve, rrset, &dnskey, kd->algo, reason, 495 reason_bogus, section, qstate, vq, verified, reasonbuf, 496 reasonlen); 497 return sec; 498 } 499 500 /** verify that a DS RR hashes to a key and that key signs the set */ 501 static enum sec_status 502 verify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve, 503 struct ub_packed_rrset_key* dnskey_rrset, 504 struct ub_packed_rrset_key* ds_rrset, size_t ds_idx, char** reason, 505 sldns_ede_code *reason_bogus, struct module_qstate* qstate, 506 struct val_qstate* vq, int *nonechecked, char* reasonbuf, 507 size_t reasonlen, size_t* num_tagmatches, 508 size_t* num_tagmatches_dnskeysig) 509 { 510 enum sec_status sec = sec_status_bogus; 511 size_t i, num, numchecked = 0, numhashok = 0, numsizesupp = 0; 512 num = rrset_get_count(dnskey_rrset); 513 *nonechecked = 0; 514 for(i=0; i<num; i++) { 515 if((*num_tagmatches)++ > MAX_TAG_MATCHES) { 516 verbose(VERB_ALGO, "DS match attempt reached " 517 "MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES); 518 return sec_status_bogus; 519 } 520 /* Skip DNSKEYs that don't match the basic criteria. */ 521 if(ds_get_key_algo(ds_rrset, ds_idx) 522 != dnskey_get_algo(dnskey_rrset, i) 523 || dnskey_calc_keytag(dnskey_rrset, i) 524 != ds_get_keytag(ds_rrset, ds_idx)) { 525 continue; 526 } 527 numchecked++; 528 verbose(VERB_ALGO, "attempt DS match algo %d keytag %d", 529 ds_get_key_algo(ds_rrset, ds_idx), 530 ds_get_keytag(ds_rrset, ds_idx)); 531 532 if(vq && vq->num_hash_attempts++ > env->cfg->val_hash_attempts) { 533 *reason = "too many hash attempts"; 534 if(reason_bogus) 535 *reason_bogus = LDNS_EDE_DNSSEC_BOGUS; 536 verbose(VERB_ALGO, "rrset failed to verify: too many hash attempts, " 537 "val-hash-attempts (%d); bogus", env->cfg->val_hash_attempts); 538 return sec_status_bogus; 539 } 540 541 /* Convert the candidate DNSKEY into a hash using the 542 * same DS hash algorithm. */ 543 if(!ds_digest_match_dnskey(env, dnskey_rrset, i, ds_rrset, 544 ds_idx)) { 545 verbose(VERB_ALGO, "DS match attempt failed"); 546 if(numchecked > numhashok + MAX_DS_MATCH_FAILURES) { 547 verbose(VERB_ALGO, "DS match attempt reached " 548 "MAX_DS_MATCH_FAILURES (%d); bogus", 549 MAX_DS_MATCH_FAILURES); 550 return sec_status_bogus; 551 } 552 continue; 553 } 554 numhashok++; 555 if(!dnskey_size_is_supported(dnskey_rrset, i)) { 556 verbose(VERB_ALGO, "DS okay but that DNSKEY size is not supported"); 557 numsizesupp++; 558 continue; 559 } 560 verbose(VERB_ALGO, "DS match digest ok, trying signature"); 561 562 /* Otherwise, we have a match! Make sure that the DNSKEY 563 * verifies *with this key* */ 564 if(*num_tagmatches_dnskeysig > MAX_TAG_MATCHES) { 565 verbose(VERB_ALGO, "DS that matched has too many DNSKEY to RRSIG tag matches " 566 "MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES); 567 return sec_status_bogus; 568 } 569 sec = dnskey_verify_rrset(env, ve, dnskey_rrset, dnskey_rrset, 570 i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate, 571 vq, num_tagmatches_dnskeysig); 572 if(sec == sec_status_secure) { 573 return sec; 574 } 575 /* If it didn't validate with the DNSKEY, try the next one! */ 576 } 577 if(numsizesupp != 0 || sec == sec_status_indeterminate) { 578 /* there is a working DS, but that DNSKEY is not supported */ 579 return sec_status_insecure; 580 } 581 if(numchecked == 0) { 582 algo_needs_reason(ds_get_key_algo(ds_rrset, ds_idx), 583 reason, "no keys have a DS", reasonbuf, reasonlen); 584 *nonechecked = 1; 585 } else if(numhashok == 0) { 586 *reason = "DS hash mismatches key"; 587 } else if(!*reason) { 588 *reason = "keyset not secured by DNSKEY that matches DS"; 589 } 590 return sec_status_bogus; 591 } 592 593 int val_favorite_ds_algo(struct ub_packed_rrset_key* ds_rrset) 594 { 595 size_t i, num = rrset_get_count(ds_rrset); 596 int d, digest_algo = 0; /* DS digest algo 0 is not used. */ 597 /* find favorite algo, for now, highest number supported */ 598 for(i=0; i<num; i++) { 599 if(!ds_digest_algo_is_supported(ds_rrset, i) || 600 !ds_key_algo_is_supported(ds_rrset, i)) { 601 continue; 602 } 603 d = ds_get_digest_algo(ds_rrset, i); 604 if(d > digest_algo) 605 digest_algo = d; 606 } 607 return digest_algo; 608 } 609 610 enum sec_status 611 val_verify_DNSKEY_with_DS(struct module_env* env, struct val_env* ve, 612 struct ub_packed_rrset_key* dnskey_rrset, 613 struct ub_packed_rrset_key* ds_rrset, uint8_t* sigalg, char** reason, 614 sldns_ede_code *reason_bogus, struct module_qstate* qstate, 615 struct val_qstate* vq, char* reasonbuf, size_t reasonlen) 616 { 617 /* as long as this is false, we can consider this DS rrset to be 618 * equivalent to no DS rrset. */ 619 int has_useful_ds = 0, digest_algo, alg, has_algo_refusal = 0, 620 nonechecked, has_checked_ds = 0; 621 struct algo_needs needs; 622 size_t i, num, num_tagmatches = 0, num_tagmatches_dnskeysig = 0; 623 enum sec_status sec; 624 625 if(dnskey_rrset->rk.dname_len != ds_rrset->rk.dname_len || 626 query_dname_compare(dnskey_rrset->rk.dname, ds_rrset->rk.dname) 627 != 0) { 628 verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset " 629 "by name"); 630 *reason = "DNSKEY RRset did not match DS RRset by name"; 631 return sec_status_bogus; 632 } 633 634 if(sigalg) { 635 /* harden against algo downgrade is enabled */ 636 digest_algo = val_favorite_ds_algo(ds_rrset); 637 algo_needs_init_ds(&needs, ds_rrset, digest_algo, sigalg); 638 } else { 639 /* accept any key algo, any digest algo */ 640 digest_algo = -1; 641 } 642 num = rrset_get_count(ds_rrset); 643 for(i=0; i<num; i++) { 644 if(num_tagmatches > MAX_TAG_MATCHES) { 645 verbose(VERB_ALGO, "DS verify attempt reached " 646 "MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES); 647 *reason = "DS verify has too many tag matches"; 648 return sec_status_bogus; 649 } 650 651 /* Check to see if we can understand this DS. 652 * And check it is the strongest digest */ 653 if(!ds_digest_algo_is_supported(ds_rrset, i) || 654 !ds_key_algo_is_supported(ds_rrset, i) || 655 (sigalg && (ds_get_digest_algo(ds_rrset, i) != digest_algo))) { 656 continue; 657 } 658 659 if(num_tagmatches_dnskeysig > MAX_TAG_MATCHES) { 660 verbose(VERB_ALGO, "DS verify attempt reached " 661 "DNSKEY to RRSIG MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES); 662 *reason = "DS verify has too many DNSKEY to RRSIG tag matches"; 663 return sec_status_bogus; 664 } 665 sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset, 666 ds_rrset, i, reason, reason_bogus, qstate, vq, 667 &nonechecked, reasonbuf, reasonlen, &num_tagmatches, 668 &num_tagmatches_dnskeysig); 669 if(sec == sec_status_insecure) { 670 /* DNSKEY too large unsupported or algo refused by 671 * crypto lib. */ 672 has_algo_refusal = 1; 673 continue; 674 } 675 if(!nonechecked) 676 has_checked_ds = 1; 677 678 /* Once we see a single DS with a known digestID and 679 * algorithm, we cannot return INSECURE (with a 680 * "null" KeyEntry). */ 681 has_useful_ds = 1; 682 683 if(sec == sec_status_secure) { 684 if(!sigalg || algo_needs_set_secure(&needs, 685 (uint8_t)ds_get_key_algo(ds_rrset, i))) { 686 verbose(VERB_ALGO, "DS matched DNSKEY."); 687 if(!dnskeyset_size_is_supported(dnskey_rrset)) { 688 verbose(VERB_ALGO, "DS works, but dnskeyset contain keys that are unsupported, treat as insecure"); 689 return sec_status_insecure; 690 } 691 return sec_status_secure; 692 } 693 } else if(sigalg && sec == sec_status_bogus) { 694 algo_needs_set_bogus(&needs, 695 (uint8_t)ds_get_key_algo(ds_rrset, i)); 696 } 697 } 698 699 /* None of the DS's worked out. */ 700 701 /* If none of the DSes have been checked, eg. that means no matches 702 * for keytags, and the other dses are all algo_refusal, it is an 703 * insecure delegation point, since the only matched DS records 704 * have an algo refusal, or are unsupported. */ 705 if(has_algo_refusal && !has_checked_ds) { 706 verbose(VERB_ALGO, "No supported DS records were found -- " 707 "treating as insecure."); 708 return sec_status_insecure; 709 } 710 /* If no DSs were understandable, then this is OK. */ 711 if(!has_useful_ds) { 712 verbose(VERB_ALGO, "No usable DS records were found -- " 713 "treating as insecure."); 714 return sec_status_insecure; 715 } 716 /* If any were understandable, then it is bad. */ 717 verbose(VERB_QUERY, "Failed to match any usable DS to a DNSKEY."); 718 if(sigalg && (alg=algo_needs_missing(&needs)) != 0) { 719 algo_needs_reason(alg, reason, "missing verification of " 720 "DNSKEY signature", reasonbuf, reasonlen); 721 } 722 return sec_status_bogus; 723 } 724 725 struct key_entry_key* 726 val_verify_new_DNSKEYs(struct regional* region, struct module_env* env, 727 struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset, 728 struct ub_packed_rrset_key* ds_rrset, int downprot, char** reason, 729 sldns_ede_code *reason_bogus, struct module_qstate* qstate, 730 struct val_qstate* vq, char* reasonbuf, size_t reasonlen) 731 { 732 uint8_t sigalg[ALGO_NEEDS_MAX+1]; 733 enum sec_status sec = val_verify_DNSKEY_with_DS(env, ve, 734 dnskey_rrset, ds_rrset, downprot?sigalg:NULL, reason, 735 reason_bogus, qstate, vq, reasonbuf, reasonlen); 736 737 if(sec == sec_status_secure) { 738 return key_entry_create_rrset(region, 739 ds_rrset->rk.dname, ds_rrset->rk.dname_len, 740 ntohs(ds_rrset->rk.rrset_class), dnskey_rrset, 741 downprot?sigalg:NULL, LDNS_EDE_NONE, NULL, 742 *env->now); 743 } else if(sec == sec_status_insecure) { 744 return key_entry_create_null(region, ds_rrset->rk.dname, 745 ds_rrset->rk.dname_len, 746 ntohs(ds_rrset->rk.rrset_class), 747 rrset_get_ttl(ds_rrset), *reason_bogus, *reason, 748 *env->now); 749 } 750 return key_entry_create_bad(region, ds_rrset->rk.dname, 751 ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class), 752 BOGUS_KEY_TTL, *reason_bogus, *reason, *env->now); 753 } 754 755 enum sec_status 756 val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve, 757 struct ub_packed_rrset_key* dnskey_rrset, 758 struct ub_packed_rrset_key* ta_ds, 759 struct ub_packed_rrset_key* ta_dnskey, uint8_t* sigalg, char** reason, 760 sldns_ede_code *reason_bogus, struct module_qstate* qstate, 761 struct val_qstate* vq, char* reasonbuf, size_t reasonlen) 762 { 763 /* as long as this is false, we can consider this anchor to be 764 * equivalent to no anchor. */ 765 int has_useful_ta = 0, digest_algo = 0, alg, has_algo_refusal = 0, 766 nonechecked, has_checked_ds = 0; 767 struct algo_needs needs; 768 size_t i, num, num_tagmatches = 0, num_tagmatches_dnskeysig = 0; 769 enum sec_status sec; 770 771 if(ta_ds && (dnskey_rrset->rk.dname_len != ta_ds->rk.dname_len || 772 query_dname_compare(dnskey_rrset->rk.dname, ta_ds->rk.dname) 773 != 0)) { 774 verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset " 775 "by name"); 776 *reason = "DNSKEY RRset did not match DS RRset by name"; 777 if(reason_bogus) 778 *reason_bogus = LDNS_EDE_DNSKEY_MISSING; 779 return sec_status_bogus; 780 } 781 if(ta_dnskey && (dnskey_rrset->rk.dname_len != ta_dnskey->rk.dname_len 782 || query_dname_compare(dnskey_rrset->rk.dname, ta_dnskey->rk.dname) 783 != 0)) { 784 verbose(VERB_QUERY, "DNSKEY RRset did not match anchor RRset " 785 "by name"); 786 *reason = "DNSKEY RRset did not match anchor RRset by name"; 787 if(reason_bogus) 788 *reason_bogus = LDNS_EDE_DNSKEY_MISSING; 789 return sec_status_bogus; 790 } 791 792 if(ta_ds) 793 digest_algo = val_favorite_ds_algo(ta_ds); 794 if(sigalg) { 795 if(ta_ds) 796 algo_needs_init_ds(&needs, ta_ds, digest_algo, sigalg); 797 else memset(&needs, 0, sizeof(needs)); 798 if(ta_dnskey) 799 algo_needs_init_dnskey_add(&needs, ta_dnskey, sigalg); 800 } 801 if(ta_ds) { 802 num = rrset_get_count(ta_ds); 803 for(i=0; i<num; i++) { 804 if(num_tagmatches > MAX_TAG_MATCHES) { 805 verbose(VERB_ALGO, "anchor DS verify attempt reached " 806 "MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES); 807 *reason = "anchor DS verify has too many tag matches"; 808 if(reason_bogus) 809 *reason_bogus = LDNS_EDE_DNSSEC_BOGUS; 810 return sec_status_bogus; 811 } 812 813 /* Check to see if we can understand this DS. 814 * And check it is the strongest digest */ 815 if(!ds_digest_algo_is_supported(ta_ds, i) || 816 !ds_key_algo_is_supported(ta_ds, i) || 817 ds_get_digest_algo(ta_ds, i) != digest_algo) 818 continue; 819 820 if(num_tagmatches_dnskeysig > MAX_TAG_MATCHES) { 821 verbose(VERB_ALGO, "anchor DS verify has too many DNSKEY to RRSIG tag matches " 822 "MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES); 823 *reason = "anchor DS verify has too many DNSKEY to RRSIG tag matches"; 824 if(reason_bogus) 825 *reason_bogus = LDNS_EDE_DNSSEC_BOGUS; 826 return sec_status_bogus; 827 } 828 sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset, 829 ta_ds, i, reason, reason_bogus, qstate, vq, 830 &nonechecked, reasonbuf, reasonlen, &num_tagmatches, 831 &num_tagmatches_dnskeysig); 832 if(sec == sec_status_insecure) { 833 has_algo_refusal = 1; 834 continue; 835 } 836 if(!nonechecked) 837 has_checked_ds = 1; 838 839 /* Once we see a single DS with a known digestID and 840 * algorithm, we cannot return INSECURE (with a 841 * "null" KeyEntry). */ 842 has_useful_ta = 1; 843 844 if(sec == sec_status_secure) { 845 if(!sigalg || algo_needs_set_secure(&needs, 846 (uint8_t)ds_get_key_algo(ta_ds, i))) { 847 verbose(VERB_ALGO, "DS matched DNSKEY."); 848 if(!dnskeyset_size_is_supported(dnskey_rrset)) { 849 verbose(VERB_ALGO, "trustanchor works, but dnskeyset contain keys that are unsupported, treat as insecure"); 850 return sec_status_insecure; 851 } 852 return sec_status_secure; 853 } 854 } else if(sigalg && sec == sec_status_bogus) { 855 algo_needs_set_bogus(&needs, 856 (uint8_t)ds_get_key_algo(ta_ds, i)); 857 } 858 } 859 } 860 861 /* None of the DS's worked out: check the DNSKEYs. */ 862 if(ta_dnskey) { 863 num = rrset_get_count(ta_dnskey); 864 for(i=0; i<num; i++) { 865 /* Check to see if we can understand this DNSKEY */ 866 if(!dnskey_algo_is_supported(ta_dnskey, i)) 867 continue; 868 if(!dnskey_size_is_supported(ta_dnskey, i)) 869 continue; 870 871 /* we saw a useful TA */ 872 has_useful_ta = 1; 873 874 if(num_tagmatches_dnskeysig > MAX_TAG_MATCHES) { 875 verbose(VERB_ALGO, "anchor DS that matched has too many DNSKEY to RRSIG tag matches " 876 "MAX_TAG_MATCHES (%d); bogus", MAX_TAG_MATCHES); 877 *reason = "anchor DS that matched has too many DNSKEY to RRSIG tag matches"; 878 if(reason_bogus) 879 *reason_bogus = LDNS_EDE_DNSSEC_BOGUS; 880 return sec_status_bogus; 881 } 882 sec = dnskey_verify_rrset(env, ve, dnskey_rrset, 883 ta_dnskey, i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate, vq, &num_tagmatches_dnskeysig); 884 if(sec == sec_status_secure) { 885 if(!sigalg || algo_needs_set_secure(&needs, 886 (uint8_t)dnskey_get_algo(ta_dnskey, i))) { 887 verbose(VERB_ALGO, "anchor matched DNSKEY."); 888 if(!dnskeyset_size_is_supported(dnskey_rrset)) { 889 verbose(VERB_ALGO, "trustanchor works, but dnskeyset contain keys that are unsupported, treat as insecure"); 890 return sec_status_insecure; 891 } 892 return sec_status_secure; 893 } 894 } else if(sigalg && sec == sec_status_bogus) { 895 algo_needs_set_bogus(&needs, 896 (uint8_t)dnskey_get_algo(ta_dnskey, i)); 897 } 898 } 899 } 900 901 /* If none of the DSes have been checked, eg. that means no matches 902 * for keytags, and the other dses are all algo_refusal, it is an 903 * insecure delegation point, since the only matched DS records 904 * have an algo refusal, or are unsupported. */ 905 if(has_algo_refusal && !has_checked_ds) { 906 verbose(VERB_ALGO, "No supported trust anchors were found -- " 907 "treating as insecure."); 908 return sec_status_insecure; 909 } 910 /* If no DSs were understandable, then this is OK. */ 911 if(!has_useful_ta) { 912 verbose(VERB_ALGO, "No usable trust anchors were found -- " 913 "treating as insecure."); 914 return sec_status_insecure; 915 } 916 /* If any were understandable, then it is bad. */ 917 verbose(VERB_QUERY, "Failed to match any usable anchor to a DNSKEY."); 918 if(sigalg && (alg=algo_needs_missing(&needs)) != 0) { 919 algo_needs_reason(alg, reason, "missing verification of " 920 "DNSKEY signature", reasonbuf, reasonlen); 921 } 922 return sec_status_bogus; 923 } 924 925 struct key_entry_key* 926 val_verify_new_DNSKEYs_with_ta(struct regional* region, struct module_env* env, 927 struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset, 928 struct ub_packed_rrset_key* ta_ds_rrset, 929 struct ub_packed_rrset_key* ta_dnskey_rrset, int downprot, 930 char** reason, sldns_ede_code *reason_bogus, 931 struct module_qstate* qstate, struct val_qstate* vq, char* reasonbuf, 932 size_t reasonlen) 933 { 934 uint8_t sigalg[ALGO_NEEDS_MAX+1]; 935 enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve, 936 dnskey_rrset, ta_ds_rrset, ta_dnskey_rrset, 937 downprot?sigalg:NULL, reason, reason_bogus, qstate, vq, 938 reasonbuf, reasonlen); 939 940 if(sec == sec_status_secure) { 941 return key_entry_create_rrset(region, 942 dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len, 943 ntohs(dnskey_rrset->rk.rrset_class), dnskey_rrset, 944 downprot?sigalg:NULL, LDNS_EDE_NONE, NULL, *env->now); 945 } else if(sec == sec_status_insecure) { 946 return key_entry_create_null(region, dnskey_rrset->rk.dname, 947 dnskey_rrset->rk.dname_len, 948 ntohs(dnskey_rrset->rk.rrset_class), 949 rrset_get_ttl(dnskey_rrset), *reason_bogus, *reason, 950 *env->now); 951 } 952 return key_entry_create_bad(region, dnskey_rrset->rk.dname, 953 dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class), 954 BOGUS_KEY_TTL, *reason_bogus, *reason, *env->now); 955 } 956 957 int 958 val_dsset_isusable(struct ub_packed_rrset_key* ds_rrset) 959 { 960 size_t i; 961 for(i=0; i<rrset_get_count(ds_rrset); i++) { 962 if(ds_digest_algo_is_supported(ds_rrset, i) && 963 ds_key_algo_is_supported(ds_rrset, i)) 964 return 1; 965 } 966 if(verbosity < VERB_ALGO) 967 return 0; 968 if(rrset_get_count(ds_rrset) == 0) 969 verbose(VERB_ALGO, "DS is not usable"); 970 else { 971 /* report usability for the first DS RR */ 972 sldns_lookup_table *lt; 973 char herr[64], aerr[64]; 974 lt = sldns_lookup_by_id(sldns_hashes, 975 (int)ds_get_digest_algo(ds_rrset, 0)); 976 if(lt) snprintf(herr, sizeof(herr), "%s", lt->name); 977 else snprintf(herr, sizeof(herr), "%d", 978 (int)ds_get_digest_algo(ds_rrset, 0)); 979 lt = sldns_lookup_by_id(sldns_algorithms, 980 (int)ds_get_key_algo(ds_rrset, 0)); 981 if(lt) snprintf(aerr, sizeof(aerr), "%s", lt->name); 982 else snprintf(aerr, sizeof(aerr), "%d", 983 (int)ds_get_key_algo(ds_rrset, 0)); 984 985 verbose(VERB_ALGO, "DS unsupported, hash %s %s, " 986 "key algorithm %s %s", herr, 987 (ds_digest_algo_is_supported(ds_rrset, 0)? 988 "(supported)":"(unsupported)"), aerr, 989 (ds_key_algo_is_supported(ds_rrset, 0)? 990 "(supported)":"(unsupported)")); 991 } 992 return 0; 993 } 994 995 /** get label count for a signature */ 996 static uint8_t 997 rrsig_get_labcount(struct packed_rrset_data* d, size_t sig) 998 { 999 if(d->rr_len[sig] < 2+4) 1000 return 0; /* bad sig length */ 1001 return d->rr_data[sig][2+3]; 1002 } 1003 1004 int 1005 val_rrset_wildcard(struct ub_packed_rrset_key* rrset, uint8_t** wc, 1006 size_t* wc_len) 1007 { 1008 struct packed_rrset_data* d = (struct packed_rrset_data*)rrset-> 1009 entry.data; 1010 uint8_t labcount; 1011 int labdiff; 1012 uint8_t* wn; 1013 size_t i, wl; 1014 if(d->rrsig_count == 0) { 1015 return 1; 1016 } 1017 labcount = rrsig_get_labcount(d, d->count + 0); 1018 /* check rest of signatures identical */ 1019 for(i=1; i<d->rrsig_count; i++) { 1020 if(labcount != rrsig_get_labcount(d, d->count + i)) { 1021 return 0; 1022 } 1023 } 1024 /* OK the rrsigs check out */ 1025 /* if the RRSIG label count is shorter than the number of actual 1026 * labels, then this rrset was synthesized from a wildcard. 1027 * Note that the RRSIG label count doesn't count the root label. */ 1028 wn = rrset->rk.dname; 1029 wl = rrset->rk.dname_len; 1030 /* skip a leading wildcard label in the dname (RFC4035 2.2) */ 1031 if(dname_is_wild(wn)) { 1032 wn += 2; 1033 wl -= 2; 1034 } 1035 labdiff = (dname_count_labels(wn) - 1) - (int)labcount; 1036 if(labdiff > 0) { 1037 *wc = wn; 1038 dname_remove_labels(wc, &wl, labdiff); 1039 *wc_len = wl; 1040 return 1; 1041 } 1042 return 1; 1043 } 1044 1045 int 1046 val_chase_cname(struct query_info* qchase, struct reply_info* rep, 1047 size_t* cname_skip) { 1048 size_t i; 1049 /* skip any DNAMEs, go to the CNAME for next part */ 1050 for(i = *cname_skip; i < rep->an_numrrsets; i++) { 1051 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME && 1052 query_dname_compare(qchase->qname, rep->rrsets[i]-> 1053 rk.dname) == 0) { 1054 qchase->qname = NULL; 1055 get_cname_target(rep->rrsets[i], &qchase->qname, 1056 &qchase->qname_len); 1057 if(!qchase->qname) 1058 return 0; /* bad CNAME rdata */ 1059 (*cname_skip) = i+1; 1060 return 1; 1061 } 1062 } 1063 return 0; /* CNAME classified but no matching CNAME ?! */ 1064 } 1065 1066 /** see if rrset has signer name as one of the rrsig signers */ 1067 static int 1068 rrset_has_signer(struct ub_packed_rrset_key* rrset, uint8_t* name, size_t len) 1069 { 1070 struct packed_rrset_data* d = (struct packed_rrset_data*)rrset-> 1071 entry.data; 1072 size_t i; 1073 for(i = d->count; i< d->count+d->rrsig_count; i++) { 1074 if(d->rr_len[i] > 2+18+len) { 1075 /* at least rdatalen + signature + signame (+1 sig)*/ 1076 if(!dname_valid(d->rr_data[i]+2+18, d->rr_len[i]-2-18)) 1077 continue; 1078 if(query_dname_compare(name, d->rr_data[i]+2+18) == 0) 1079 { 1080 return 1; 1081 } 1082 } 1083 } 1084 return 0; 1085 } 1086 1087 void 1088 val_fill_reply(struct reply_info* chase, struct reply_info* orig, 1089 size_t skip, uint8_t* name, size_t len, uint8_t* signer) 1090 { 1091 size_t i, j; 1092 int seen_dname = 0; 1093 chase->rrset_count = 0; 1094 chase->an_numrrsets = 0; 1095 chase->ns_numrrsets = 0; 1096 chase->ar_numrrsets = 0; 1097 /* ANSWER section */ 1098 for(i=skip; i<orig->an_numrrsets; i++) { 1099 if(!signer) { 1100 if(query_dname_compare(name, 1101 orig->rrsets[i]->rk.dname) == 0) 1102 chase->rrsets[chase->an_numrrsets++] = 1103 orig->rrsets[i]; 1104 } else if(seen_dname && ntohs(orig->rrsets[i]->rk.type) == 1105 LDNS_RR_TYPE_CNAME) { 1106 chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i]; 1107 seen_dname = 0; 1108 } else if(rrset_has_signer(orig->rrsets[i], name, len)) { 1109 chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i]; 1110 if(ntohs(orig->rrsets[i]->rk.type) == 1111 LDNS_RR_TYPE_DNAME) { 1112 seen_dname = 1; 1113 } 1114 } else if(ntohs(orig->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME 1115 && ((struct packed_rrset_data*)orig->rrsets[i]-> 1116 entry.data)->rrsig_count == 0 && 1117 cname_under_previous_dname(orig, i, &j) && 1118 rrset_has_signer(orig->rrsets[j], name, len)) { 1119 chase->rrsets[chase->an_numrrsets++] = orig->rrsets[j]; 1120 chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i]; 1121 } 1122 } 1123 /* AUTHORITY section */ 1124 for(i = (skip > orig->an_numrrsets)?skip:orig->an_numrrsets; 1125 i<orig->an_numrrsets+orig->ns_numrrsets; 1126 i++) { 1127 if(!signer) { 1128 if(query_dname_compare(name, 1129 orig->rrsets[i]->rk.dname) == 0) 1130 chase->rrsets[chase->an_numrrsets+ 1131 chase->ns_numrrsets++] = orig->rrsets[i]; 1132 } else if(rrset_has_signer(orig->rrsets[i], name, len)) { 1133 chase->rrsets[chase->an_numrrsets+ 1134 chase->ns_numrrsets++] = orig->rrsets[i]; 1135 } 1136 } 1137 /* ADDITIONAL section */ 1138 for(i= (skip>orig->an_numrrsets+orig->ns_numrrsets)? 1139 skip:orig->an_numrrsets+orig->ns_numrrsets; 1140 i<orig->rrset_count; i++) { 1141 if(!signer) { 1142 if(query_dname_compare(name, 1143 orig->rrsets[i]->rk.dname) == 0) 1144 chase->rrsets[chase->an_numrrsets 1145 +chase->ns_numrrsets+chase->ar_numrrsets++] 1146 = orig->rrsets[i]; 1147 } else if(rrset_has_signer(orig->rrsets[i], name, len)) { 1148 chase->rrsets[chase->an_numrrsets+chase->ns_numrrsets+ 1149 chase->ar_numrrsets++] = orig->rrsets[i]; 1150 } 1151 } 1152 chase->rrset_count = chase->an_numrrsets + chase->ns_numrrsets + 1153 chase->ar_numrrsets; 1154 } 1155 1156 void val_reply_remove_answers(struct reply_info* rep, size_t index, 1157 size_t count) 1158 { 1159 log_assert(index < rep->rrset_count); 1160 log_assert(index < rep->an_numrrsets); 1161 if(count == 0) 1162 return; /* nothing to do */ 1163 log_assert(index+(count-1) < rep->rrset_count); 1164 log_assert(index+(count-1) < rep->an_numrrsets); 1165 if(rep->rrset_count - (count-1) - index - 1 > 0) 1166 memmove(rep->rrsets+index, rep->rrsets+index+(count-1)+1, 1167 sizeof(struct ub_packed_rrset_key*)* 1168 (rep->rrset_count - (count-1) - index - 1)); 1169 rep->an_numrrsets -= count; 1170 rep->rrset_count -= count; 1171 } 1172 1173 void val_reply_remove_auth(struct reply_info* rep, size_t index) 1174 { 1175 log_assert(index < rep->rrset_count); 1176 log_assert(index >= rep->an_numrrsets); 1177 log_assert(index < rep->an_numrrsets+rep->ns_numrrsets); 1178 memmove(rep->rrsets+index, rep->rrsets+index+1, 1179 sizeof(struct ub_packed_rrset_key*)* 1180 (rep->rrset_count - index - 1)); 1181 rep->ns_numrrsets--; 1182 rep->rrset_count--; 1183 } 1184 1185 void 1186 val_check_nonsecure(struct module_env* env, struct reply_info* rep) 1187 { 1188 size_t i; 1189 /* authority */ 1190 for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) { 1191 if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data) 1192 ->security != sec_status_secure) { 1193 /* because we want to return the authentic original 1194 * message when presented with CD-flagged queries, 1195 * we need to preserve AUTHORITY section data. 1196 * However, this rrset is not signed or signed 1197 * with the wrong keys. Validation has tried to 1198 * verify this rrset with the keysets of import. 1199 * But this rrset did not verify. 1200 * Therefore the message is bogus. 1201 */ 1202 1203 /* check if authority has an NS record 1204 * which is bad, and there is an answer section with 1205 * data. In that case, delete NS and additional to 1206 * be lenient and make a minimal response */ 1207 if(rep->an_numrrsets != 0 && 1208 ntohs(rep->rrsets[i]->rk.type) 1209 == LDNS_RR_TYPE_NS) { 1210 verbose(VERB_ALGO, "truncate to minimal"); 1211 rep->ar_numrrsets = 0; 1212 rep->rrset_count = rep->an_numrrsets + 1213 rep->ns_numrrsets; 1214 /* remove this unneeded authority rrset */ 1215 memmove(rep->rrsets+i, rep->rrsets+i+1, 1216 sizeof(struct ub_packed_rrset_key*)* 1217 (rep->rrset_count - i - 1)); 1218 rep->ns_numrrsets--; 1219 rep->rrset_count--; 1220 i--; 1221 return; 1222 } 1223 1224 log_nametypeclass(VERB_QUERY, "message is bogus, " 1225 "non secure rrset", 1226 rep->rrsets[i]->rk.dname, 1227 ntohs(rep->rrsets[i]->rk.type), 1228 ntohs(rep->rrsets[i]->rk.rrset_class)); 1229 rep->security = sec_status_bogus; 1230 return; 1231 } 1232 } 1233 /* additional */ 1234 if(!env->cfg->val_clean_additional) 1235 return; 1236 for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) { 1237 if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data) 1238 ->security != sec_status_secure) { 1239 /* This does not cause message invalidation. It was 1240 * simply unsigned data in the additional. The 1241 * RRSIG must have been truncated off the message. 1242 * 1243 * However, we do not want to return possible bogus 1244 * data to clients that rely on this service for 1245 * their authentication. 1246 */ 1247 /* remove this unneeded additional rrset */ 1248 memmove(rep->rrsets+i, rep->rrsets+i+1, 1249 sizeof(struct ub_packed_rrset_key*)* 1250 (rep->rrset_count - i - 1)); 1251 rep->ar_numrrsets--; 1252 rep->rrset_count--; 1253 i--; 1254 } 1255 } 1256 } 1257 1258 /** check no anchor and unlock */ 1259 static int 1260 check_no_anchor(struct val_anchors* anchors, uint8_t* nm, size_t l, uint16_t c) 1261 { 1262 struct trust_anchor* ta; 1263 if((ta=anchors_lookup(anchors, nm, l, c))) { 1264 lock_basic_unlock(&ta->lock); 1265 } 1266 return !ta; 1267 } 1268 1269 void 1270 val_mark_indeterminate(struct reply_info* rep, struct val_anchors* anchors, 1271 struct rrset_cache* r, struct module_env* env) 1272 { 1273 size_t i; 1274 struct packed_rrset_data* d; 1275 for(i=0; i<rep->rrset_count; i++) { 1276 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data; 1277 if(d->security == sec_status_unchecked && 1278 check_no_anchor(anchors, rep->rrsets[i]->rk.dname, 1279 rep->rrsets[i]->rk.dname_len, 1280 ntohs(rep->rrsets[i]->rk.rrset_class))) 1281 { 1282 /* mark as indeterminate */ 1283 d->security = sec_status_indeterminate; 1284 rrset_update_sec_status(r, rep->rrsets[i], *env->now); 1285 } 1286 } 1287 } 1288 1289 void 1290 val_mark_insecure(struct reply_info* rep, uint8_t* kname, 1291 struct rrset_cache* r, struct module_env* env) 1292 { 1293 size_t i; 1294 struct packed_rrset_data* d; 1295 for(i=0; i<rep->rrset_count; i++) { 1296 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data; 1297 if(d->security == sec_status_unchecked && 1298 dname_subdomain_c(rep->rrsets[i]->rk.dname, kname)) { 1299 /* mark as insecure */ 1300 d->security = sec_status_insecure; 1301 rrset_update_sec_status(r, rep->rrsets[i], *env->now); 1302 } 1303 } 1304 } 1305 1306 size_t 1307 val_next_unchecked(struct reply_info* rep, size_t skip) 1308 { 1309 size_t i; 1310 struct packed_rrset_data* d; 1311 for(i=skip+1; i<rep->rrset_count; i++) { 1312 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data; 1313 if(d->security == sec_status_unchecked) { 1314 return i; 1315 } 1316 } 1317 return rep->rrset_count; 1318 } 1319 1320 const char* 1321 val_classification_to_string(enum val_classification subtype) 1322 { 1323 switch(subtype) { 1324 case VAL_CLASS_UNTYPED: return "untyped"; 1325 case VAL_CLASS_UNKNOWN: return "unknown"; 1326 case VAL_CLASS_POSITIVE: return "positive"; 1327 case VAL_CLASS_CNAME: return "cname"; 1328 case VAL_CLASS_NODATA: return "nodata"; 1329 case VAL_CLASS_NAMEERROR: return "nameerror"; 1330 case VAL_CLASS_CNAMENOANSWER: return "cnamenoanswer"; 1331 case VAL_CLASS_REFERRAL: return "referral"; 1332 case VAL_CLASS_ANY: return "qtype_any"; 1333 default: 1334 return "bad_val_classification"; 1335 } 1336 } 1337 1338 /** log a sock_list entry */ 1339 static void 1340 sock_list_logentry(enum verbosity_value v, const char* s, struct sock_list* p) 1341 { 1342 if(p->len) 1343 log_addr(v, s, &p->addr, p->len); 1344 else verbose(v, "%s cache", s); 1345 } 1346 1347 void val_blacklist(struct sock_list** blacklist, struct regional* region, 1348 struct sock_list* origin, int cross) 1349 { 1350 /* debug printout */ 1351 if(verbosity >= VERB_ALGO) { 1352 struct sock_list* p; 1353 for(p=*blacklist; p; p=p->next) 1354 sock_list_logentry(VERB_ALGO, "blacklist", p); 1355 if(!origin) 1356 verbose(VERB_ALGO, "blacklist add: cache"); 1357 for(p=origin; p; p=p->next) 1358 sock_list_logentry(VERB_ALGO, "blacklist add", p); 1359 } 1360 /* blacklist the IPs or the cache */ 1361 if(!origin) { 1362 /* only add if nothing there. anything else also stops cache*/ 1363 if(!*blacklist) 1364 sock_list_insert(blacklist, NULL, 0, region); 1365 } else if(!cross) 1366 sock_list_prepend(blacklist, origin); 1367 else sock_list_merge(blacklist, region, origin); 1368 } 1369 1370 int val_has_signed_nsecs(struct reply_info* rep, char** reason) 1371 { 1372 size_t i, num_nsec = 0, num_nsec3 = 0; 1373 struct packed_rrset_data* d; 1374 for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) { 1375 if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC)) 1376 num_nsec++; 1377 else if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC3)) 1378 num_nsec3++; 1379 else continue; 1380 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data; 1381 if(d && d->rrsig_count != 0) { 1382 return 1; 1383 } 1384 } 1385 if(num_nsec == 0 && num_nsec3 == 0) 1386 *reason = "no DNSSEC records"; 1387 else if(num_nsec != 0) 1388 *reason = "no signatures over NSECs"; 1389 else *reason = "no signatures over NSEC3s"; 1390 return 0; 1391 } 1392 1393 struct dns_msg* 1394 val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c, 1395 struct regional* region, uint8_t* topname) 1396 { 1397 struct dns_msg* msg; 1398 struct query_info qinfo; 1399 struct ub_packed_rrset_key *rrset = rrset_cache_lookup( 1400 env->rrset_cache, nm, nmlen, LDNS_RR_TYPE_DS, c, 0, 1401 *env->now, 0); 1402 if(rrset) { 1403 /* DS rrset exists. Return it to the validator immediately*/ 1404 struct ub_packed_rrset_key* copy = packed_rrset_copy_region( 1405 rrset, region, *env->now); 1406 struct packed_rrset_data* d; 1407 lock_rw_unlock(&rrset->entry.lock); 1408 if(!copy) 1409 return NULL; 1410 d = (struct packed_rrset_data*)copy->entry.data; 1411 msg = dns_msg_create(nm, nmlen, LDNS_RR_TYPE_DS, c, region, 1); 1412 if(!msg) 1413 return NULL; 1414 msg->rep->rrsets[0] = copy; 1415 msg->rep->rrset_count++; 1416 msg->rep->an_numrrsets++; 1417 UPDATE_TTL_FROM_RRSET(msg->rep->ttl, d->ttl); 1418 return msg; 1419 } 1420 /* lookup in rrset and negative cache for NSEC/NSEC3 */ 1421 qinfo.qname = nm; 1422 qinfo.qname_len = nmlen; 1423 qinfo.qtype = LDNS_RR_TYPE_DS; 1424 qinfo.qclass = c; 1425 qinfo.local_alias = NULL; 1426 /* do not add SOA to reply message, it is going to be used internal */ 1427 msg = val_neg_getmsg(env->neg_cache, &qinfo, region, env->rrset_cache, 1428 env->scratch_buffer, *env->now, 0, topname, env->cfg); 1429 return msg; 1430 } 1431 1432 int derive_cname_from_dname(struct ub_packed_rrset_key* cname, 1433 struct ub_packed_rrset_key* dname, uint8_t* out, size_t outlen) 1434 { 1435 size_t prefix_len; 1436 uint8_t* dname_target = NULL; 1437 size_t dname_target_len = 0; 1438 if(!dname_strict_subdomain_c(cname->rk.dname, dname->rk.dname)) 1439 return 0; /* Invalid: CNAME owner must be subdomain */ 1440 get_cname_target(dname, &dname_target, &dname_target_len); 1441 if(!dname_target || !dname_target_len) 1442 return 0; /* DNAME malformed */ 1443 if(cname->rk.dname_len < dname->rk.dname_len) 1444 return 0; /* Not possible, due to subdomain, but check */ 1445 if(cname->rk.dname_len == 0) 1446 return 0; /* Not possible, but check */ 1447 prefix_len = cname->rk.dname_len - dname->rk.dname_len; 1448 if(prefix_len + dname_target_len > outlen) 1449 return 0; /* Buffer too small */ 1450 memmove(out, cname->rk.dname, prefix_len); 1451 memmove(out+prefix_len, dname_target, dname_target_len); 1452 return 1; 1453 } 1454 1455 int nsec_nextowner_subdomain(struct ub_packed_rrset_key* rrset, uint8_t* name) 1456 { 1457 struct packed_rrset_data* d; 1458 uint8_t* next; 1459 size_t nextlen; 1460 if(ntohs(rrset->rk.type) != LDNS_RR_TYPE_NSEC) 1461 return 0; 1462 d = (struct packed_rrset_data*)rrset->entry.data; 1463 if(!d || d->count == 0) 1464 return 0; 1465 next = d->rr_data[0]+2; 1466 nextlen = dname_valid(next, d->rr_len[0]-2); 1467 if(nextlen == 0) 1468 return 0; /* malformed */ 1469 return dname_subdomain_c(next, name); 1470 } 1471
Indexes created Sat Oct 03 00:25:10 UTC 2026