#include "config.h"
#ifdef HAVE_OPENSSL_SSL_H
#include "openssl/ssl.h"
#define NSEC3_SHA_LEN SHA_DIGEST_LENGTH
#else
#define NSEC3_SHA_LEN 20
#endif
#include "validator/val_neg.h"
#include "validator/val_nsec.h"
#include "validator/val_nsec3.h"
#include "validator/val_utils.h"
#include "util/data/dname.h"
#include "util/data/msgreply.h"
#include "util/log.h"
#include "util/net_help.h"
#include "util/config_file.h"
#include "services/cache/rrset.h"
#include "services/cache/dns.h"
#include "ldns/rrdef.h"
#include "ldns/sbuffer.h"
int val_neg_data_compare(const void* a, const void* b)
{
struct val_neg_data* x = (struct val_neg_data*)a;
struct val_neg_data* y = (struct val_neg_data*)b;
int m;
return dname_canon_lab_cmp(x->name, x->labs, y->name, y->labs, &m);
}
int val_neg_zone_compare(const void* a, const void* b)
{
struct val_neg_zone* x = (struct val_neg_zone*)a;
struct val_neg_zone* y = (struct val_neg_zone*)b;
int m;
if(x->dclass != y->dclass) {
if(x->dclass < y->dclass)
return -1;
return 1;
}
return dname_canon_lab_cmp(x->name, x->labs, y->name, y->labs, &m);
}
struct val_neg_cache* val_neg_create(struct config_file* cfg, size_t maxiter)
{
struct val_neg_cache* neg = (struct val_neg_cache*)calloc(1,
sizeof(*neg));
if(!neg) {
log_err("Could not create neg cache: out of memory");
return NULL;
}
neg->nsec3_max_iter = maxiter;
neg->max = 1024*1024;
if(cfg) neg->max = cfg->neg_cache_size;
rbtree_init(&neg->tree, &val_neg_zone_compare);
lock_basic_init(&neg->lock);
lock_protect(&neg->lock, neg, sizeof(*neg));
return neg;
}
size_t val_neg_get_mem(struct val_neg_cache* neg)
{
size_t result;
lock_basic_lock(&neg->lock);
result = sizeof(*neg) + neg->use;
lock_basic_unlock(&neg->lock);
return result;
}
static void
neg_clear_datas(rbnode_t* n, void* ATTR_UNUSED(arg))
{
struct val_neg_data* d = (struct val_neg_data*)n;
free(d->name);
free(d);
}
static void
neg_clear_zones(rbnode_t* n, void* ATTR_UNUSED(arg))
{
struct val_neg_zone* z = (struct val_neg_zone*)n;
traverse_postorder(&z->tree, &neg_clear_datas, NULL);
free(z->nsec3_salt);
free(z->name);
free(z);
}
void neg_cache_delete(struct val_neg_cache* neg)
{
if(!neg) return;
lock_basic_destroy(&neg->lock);
traverse_postorder(&neg->tree, &neg_clear_zones, NULL);
free(neg);
}
static void neg_lru_front(struct val_neg_cache* neg,
struct val_neg_data* data)
{
data->prev = NULL;
data->next = neg->first;
if(!neg->first)
neg->last = data;
else neg->first->prev = data;
neg->first = data;
}
static void neg_lru_remove(struct val_neg_cache* neg,
struct val_neg_data* data)
{
if(data->prev)
data->prev->next = data->next;
else neg->first = data->next;
if(data->next)
data->next->prev = data->prev;
else neg->last = data->prev;
}
static void neg_lru_touch(struct val_neg_cache* neg,
struct val_neg_data* data)
{
if(data == neg->first)
return;
neg_lru_remove(neg, data);
neg_lru_front(neg, data);
}
static void neg_delete_zone(struct val_neg_cache* neg, struct val_neg_zone* z)
{
struct val_neg_zone* p, *np;
if(!z) return;
log_assert(z->in_use);
log_assert(z->count > 0);
z->in_use = 0;
p = z;
while(p) {
log_assert(p->count > 0);
p->count --;
p = p->parent;
}
p = z;
while(p && p->count == 0) {
np = p->parent;
(void)rbtree_delete(&neg->tree, &p->node);
neg->use -= p->len + sizeof(*p);
free(p->nsec3_salt);
free(p->name);
free(p);
p = np;
}
}
void neg_delete_data(struct val_neg_cache* neg, struct val_neg_data* el)
{
struct val_neg_zone* z;
struct val_neg_data* p, *np;
if(!el) return;
z = el->zone;
log_assert(el->in_use);
log_assert(el->count > 0);
el->in_use = 0;
neg_lru_remove(neg, el);
p = el;
while(p) {
log_assert(p->count > 0);
p->count --;
p = p->parent;
}
p = el;
while(p && p->count == 0) {
np = p->parent;
(void)rbtree_delete(&z->tree, &p->node);
neg->use -= p->len + sizeof(*p);
free(p->name);
free(p);
p = np;
}
if(z->tree.count == 0) {
neg_delete_zone(neg, z);
}
}
static void neg_make_space(struct val_neg_cache* neg, size_t need)
{
while(neg->last && neg->max < neg->use + need) {
neg_delete_data(neg, neg->last);
}
}
struct val_neg_zone* neg_find_zone(struct val_neg_cache* neg,
uint8_t* nm, size_t len, uint16_t dclass)
{
struct val_neg_zone lookfor;
struct val_neg_zone* result;
lookfor.node.key = &lookfor;
lookfor.name = nm;
lookfor.len = len;
lookfor.labs = dname_count_labels(lookfor.name);
lookfor.dclass = dclass;
result = (struct val_neg_zone*)
rbtree_search(&neg->tree, lookfor.node.key);
return result;
}
static struct val_neg_data* neg_find_data(struct val_neg_zone* zone,
uint8_t* nm, size_t len, int labs)
{
struct val_neg_data lookfor;
struct val_neg_data* result;
lookfor.node.key = &lookfor;
lookfor.name = nm;
lookfor.len = len;
lookfor.labs = labs;
result = (struct val_neg_data*)
rbtree_search(&zone->tree, lookfor.node.key);
return result;
}
static size_t calc_data_need(struct reply_info* rep)
{
uint8_t* d;
size_t i, len, res = 0;
for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC) {
d = rep->rrsets[i]->rk.dname;
len = rep->rrsets[i]->rk.dname_len;
res = sizeof(struct val_neg_data) + len;
while(!dname_is_root(d)) {
log_assert(len > 1);
dname_remove_label(&d, &len);
res += sizeof(struct val_neg_data) + len;
}
}
}
return res;
}
static size_t calc_zone_need(uint8_t* d, size_t len)
{
size_t res = sizeof(struct val_neg_zone) + len;
while(!dname_is_root(d)) {
log_assert(len > 1);
dname_remove_label(&d, &len);
res += sizeof(struct val_neg_zone) + len;
}
return res;
}
static struct val_neg_zone* neg_closest_zone_parent(struct val_neg_cache* neg,
uint8_t* nm, size_t nm_len, int labs, uint16_t qclass)
{
struct val_neg_zone key;
struct val_neg_zone* result;
rbnode_t* res = NULL;
key.node.key = &key;
key.name = nm;
key.len = nm_len;
key.labs = labs;
key.dclass = qclass;
if(rbtree_find_less_equal(&neg->tree, &key, &res)) {
result = (struct val_neg_zone*)res;
} else {
int m;
result = (struct val_neg_zone*)res;
if(!result || result->dclass != qclass)
return NULL;
(void)dname_lab_cmp(result->name, result->labs, key.name,
key.labs, &m);
while(result) {
if(result->labs <= m)
break;
result = result->parent;
}
}
return result;
}
static struct val_neg_data* neg_closest_data_parent(
struct val_neg_zone* zone, uint8_t* nm, size_t nm_len, int labs)
{
struct val_neg_data key;
struct val_neg_data* result;
rbnode_t* res = NULL;
key.node.key = &key;
key.name = nm;
key.len = nm_len;
key.labs = labs;
if(rbtree_find_less_equal(&zone->tree, &key, &res)) {
result = (struct val_neg_data*)res;
} else {
int m;
result = (struct val_neg_data*)res;
if(!result)
return NULL;
(void)dname_lab_cmp(result->name, result->labs, key.name,
key.labs, &m);
while(result) {
if(result->labs <= m)
break;
result = result->parent;
}
}
return result;
}
static struct val_neg_zone* neg_setup_zone_node(
uint8_t* nm, size_t nm_len, int labs, uint16_t dclass)
{
struct val_neg_zone* zone =
(struct val_neg_zone*)calloc(1, sizeof(*zone));
if(!zone) {
return NULL;
}
zone->node.key = zone;
zone->name = memdup(nm, nm_len);
if(!zone->name) {
free(zone);
return NULL;
}
zone->len = nm_len;
zone->labs = labs;
zone->dclass = dclass;
rbtree_init(&zone->tree, &val_neg_data_compare);
return zone;
}
static struct val_neg_zone* neg_zone_chain(
uint8_t* nm, size_t nm_len, int labs, uint16_t dclass,
struct val_neg_zone* parent)
{
int i;
int tolabs = parent?parent->labs:0;
struct val_neg_zone* zone, *prev = NULL, *first = NULL;
for(i=labs; i!=tolabs; i--) {
zone = neg_setup_zone_node(nm, nm_len, i, dclass);
if(!zone) {
struct val_neg_zone* p=first, *np;
while(p) {
np = p->parent;
free(p->name);
free(p);
p = np;
}
return NULL;
}
if(i == labs) {
first = zone;
} else {
prev->parent = zone;
}
prev = zone;
dname_remove_label(&nm, &nm_len);
}
return first;
}
void val_neg_zone_take_inuse(struct val_neg_zone* zone)
{
if(!zone->in_use) {
struct val_neg_zone* p;
zone->in_use = 1;
for(p=zone; p; p = p->parent) {
p->count++;
}
}
}
struct val_neg_zone* neg_create_zone(struct val_neg_cache* neg,
uint8_t* nm, size_t nm_len, uint16_t dclass)
{
struct val_neg_zone* zone;
struct val_neg_zone* parent;
struct val_neg_zone* p, *np;
int labs = dname_count_labels(nm);
parent = neg_closest_zone_parent(neg, nm, nm_len, labs, dclass);
if(parent && query_dname_compare(parent->name, nm) == 0)
return parent;
log_assert(!parent || parent->count > 0);
zone = neg_zone_chain(nm, nm_len, labs, dclass, parent);
if(!zone) {
return NULL;
}
p = zone;
while(p) {
np = p->parent;
neg->use += sizeof(struct val_neg_zone) + p->len;
(void)rbtree_insert(&neg->tree, &p->node);
if(np == NULL)
p->parent = parent;
p = np;
}
return zone;
}
static struct ub_packed_rrset_key* reply_find_soa(struct reply_info* rep)
{
size_t i;
for(i=rep->an_numrrsets; i< rep->an_numrrsets+rep->ns_numrrsets; i++){
if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_SOA)
return rep->rrsets[i];
}
return NULL;
}
static int reply_has_nsec(struct reply_info* rep)
{
size_t i;
struct packed_rrset_data* d;
if(rep->security != sec_status_secure)
return 0;
for(i=rep->an_numrrsets; i< rep->an_numrrsets+rep->ns_numrrsets; i++){
if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC) {
d = (struct packed_rrset_data*)rep->rrsets[i]->
entry.data;
if(d->security == sec_status_secure)
return 1;
}
}
return 0;
}
static struct val_neg_data* neg_setup_data_node(
uint8_t* nm, size_t nm_len, int labs)
{
struct val_neg_data* el;
el = (struct val_neg_data*)calloc(1, sizeof(*el));
if(!el) {
return NULL;
}
el->node.key = el;
el->name = memdup(nm, nm_len);
if(!el->name) {
free(el);
return NULL;
}
el->len = nm_len;
el->labs = labs;
return el;
}
static struct val_neg_data* neg_data_chain(
uint8_t* nm, size_t nm_len, int labs, struct val_neg_data* parent)
{
int i;
int tolabs = parent?parent->labs:0;
struct val_neg_data* el, *first = NULL, *prev = NULL;
for(i=labs; i!=tolabs; i--) {
el = neg_setup_data_node(nm, nm_len, i);
if(!el) {
struct val_neg_data* p = first, *np;
while(p) {
np = p->parent;
free(p->name);
free(p);
p = np;
}
return NULL;
}
if(i == labs) {
first = el;
} else {
prev->parent = el;
}
prev = el;
dname_remove_label(&nm, &nm_len);
}
return first;
}
static void wipeout(struct val_neg_cache* neg, struct val_neg_zone* zone,
struct val_neg_data* el, struct ub_packed_rrset_key* nsec)
{
struct packed_rrset_data* d = (struct packed_rrset_data*)nsec->
entry.data;
uint8_t* end;
size_t end_len;
int end_labs, m;
rbnode_t* walk, *next;
struct val_neg_data* cur;
uint8_t buf[257];
if(!d || d->count == 0 || d->rr_len[0] < 2+1)
return;
if(ntohs(nsec->rk.type) == LDNS_RR_TYPE_NSEC) {
end = d->rr_data[0]+2;
end_len = dname_valid(end, d->rr_len[0]-2);
end_labs = dname_count_labels(end);
} else {
if(!nsec3_get_nextowner_b32(nsec, 0, buf, sizeof(buf)))
return;
end = buf;
end_labs = dname_count_size_labels(end, &end_len);
}
if(!dname_subdomain_c(el->name, zone->name) ||
!dname_subdomain_c(end, zone->name))
return;
if(query_dname_compare(end, zone->name) == 0) {
end = NULL;
}
walk = rbtree_next(&el->node);
while(walk && walk != RBTREE_NULL) {
cur = (struct val_neg_data*)walk;
if(dname_canon_lab_cmp(cur->name, cur->labs,
el->name, el->labs, &m) <= 0) {
walk = rbtree_next(walk);
continue;
}
if(end && dname_canon_lab_cmp(cur->name, cur->labs,
end, end_labs, &m) >= 0) {
break;
}
next = rbtree_next(walk);
if(cur->in_use)
neg_delete_data(neg, cur);
walk = next;
}
}
void neg_insert_data(struct val_neg_cache* neg,
struct val_neg_zone* zone, struct ub_packed_rrset_key* nsec)
{
struct packed_rrset_data* d;
struct val_neg_data* parent;
struct val_neg_data* el;
uint8_t* nm = nsec->rk.dname;
size_t nm_len = nsec->rk.dname_len;
int labs = dname_count_labels(nsec->rk.dname);
d = (struct packed_rrset_data*)nsec->entry.data;
if( !(d->security == sec_status_secure ||
(d->security == sec_status_unchecked && d->rrsig_count > 0)))
return;
log_nametypeclass(VERB_ALGO, "negcache rr",
nsec->rk.dname, ntohs(nsec->rk.type),
ntohs(nsec->rk.rrset_class));
parent = neg_closest_data_parent(zone, nm, nm_len, labs);
if(parent && query_dname_compare(parent->name, nm) == 0) {
log_assert(parent->count > 0);
el = parent;
} else {
struct val_neg_data* p, *np;
log_assert(!parent || parent->count > 0);
el = neg_data_chain(nm, nm_len, labs, parent);
if(!el) {
log_err("out of memory inserting NSEC negative cache");
return;
}
el->in_use = 0;
p = el;
while(p) {
np = p->parent;
neg->use += sizeof(struct val_neg_data) + p->len;
p->zone = zone;
(void)rbtree_insert(&zone->tree, &p->node);
if(np == NULL)
p->parent = parent;
p = np;
}
}
if(!el->in_use) {
struct val_neg_data* p;
el->in_use = 1;
for(p=el; p; p = p->parent) {
p->count++;
}
neg_lru_front(neg, el);
} else {
neg_lru_touch(neg, el);
}
if(ntohs(nsec->rk.type) == LDNS_RR_TYPE_NSEC3) {
int h;
uint8_t* s;
size_t slen, it;
if(nsec3_get_params(nsec, 0, &h, &it, &s, &slen) &&
it <= neg->nsec3_max_iter &&
(h != zone->nsec3_hash || it != zone->nsec3_iter ||
slen != zone->nsec3_saltlen ||
memcmp(zone->nsec3_salt, s, slen) != 0)) {
uint8_t* sa = memdup(s, slen);
if(sa) {
free(zone->nsec3_salt);
zone->nsec3_salt = sa;
zone->nsec3_saltlen = slen;
zone->nsec3_hash = h;
zone->nsec3_iter = it;
}
}
}
wipeout(neg, zone, el, nsec);
}
void val_neg_addreply(struct val_neg_cache* neg, struct reply_info* rep)
{
size_t i, need;
struct ub_packed_rrset_key* soa;
struct val_neg_zone* zone;
if(!reply_has_nsec(rep))
return;
soa = reply_find_soa(rep);
if(!soa)
return;
log_nametypeclass(VERB_ALGO, "negcache insert for zone",
soa->rk.dname, LDNS_RR_TYPE_SOA, ntohs(soa->rk.rrset_class));
need = calc_data_need(rep) +
calc_zone_need(soa->rk.dname, soa->rk.dname_len);
lock_basic_lock(&neg->lock);
neg_make_space(neg, need);
zone = neg_find_zone(neg, soa->rk.dname, soa->rk.dname_len,
ntohs(soa->rk.rrset_class));
if(!zone) {
if(!(zone = neg_create_zone(neg, soa->rk.dname,
soa->rk.dname_len, ntohs(soa->rk.rrset_class)))) {
lock_basic_unlock(&neg->lock);
log_err("out of memory adding negative zone");
return;
}
}
val_neg_zone_take_inuse(zone);
for(i=rep->an_numrrsets; i< rep->an_numrrsets+rep->ns_numrrsets; i++){
if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_NSEC)
continue;
if(!dname_subdomain_c(rep->rrsets[i]->rk.dname,
zone->name)) continue;
neg_insert_data(neg, zone, rep->rrsets[i]);
}
if(zone->tree.count == 0) {
neg_delete_zone(neg, zone);
}
lock_basic_unlock(&neg->lock);
}
static int neg_closest_data(struct val_neg_zone* zone,
uint8_t* qname, size_t len, int labs, struct val_neg_data** data)
{
struct val_neg_data key;
rbnode_t* r;
key.node.key = &key;
key.name = qname;
key.len = len;
key.labs = labs;
if(rbtree_find_less_equal(&zone->tree, &key, &r)) {
*data = (struct val_neg_data*)r;
return 1;
} else {
*data = (struct val_neg_data*)r;
return 0;
}
}
int val_neg_dlvlookup(struct val_neg_cache* neg, uint8_t* qname, size_t len,
uint16_t qclass, struct rrset_cache* rrset_cache, time_t now)
{
struct val_neg_zone* zone;
struct val_neg_data* data;
int labs;
struct ub_packed_rrset_key* nsec;
struct packed_rrset_data* d;
uint32_t flags;
uint8_t* wc;
struct query_info qinfo;
if(!neg) return 0;
log_nametypeclass(VERB_ALGO, "negcache dlvlookup", qname,
LDNS_RR_TYPE_DLV, qclass);
labs = dname_count_labels(qname);
lock_basic_lock(&neg->lock);
zone = neg_closest_zone_parent(neg, qname, len, labs, qclass);
while(zone && !zone->in_use)
zone = zone->parent;
if(!zone) {
lock_basic_unlock(&neg->lock);
return 0;
}
log_nametypeclass(VERB_ALGO, "negcache zone", zone->name, 0,
zone->dclass);
if(zone->nsec3_hash) {
lock_basic_unlock(&neg->lock);
return 0;
}
(void)neg_closest_data(zone, qname, len, labs, &data);
while(data && !data->in_use)
data = data->parent;
if(!data) {
lock_basic_unlock(&neg->lock);
return 0;
}
log_nametypeclass(VERB_ALGO, "negcache rr", data->name,
LDNS_RR_TYPE_NSEC, zone->dclass);
flags = 0;
if(query_dname_compare(data->name, zone->name) == 0)
flags = PACKED_RRSET_NSEC_AT_APEX;
nsec = rrset_cache_lookup(rrset_cache, data->name, data->len,
LDNS_RR_TYPE_NSEC, zone->dclass, flags, now, 0);
if(!nsec) {
lock_basic_unlock(&neg->lock);
return 0;
}
d = (struct packed_rrset_data*)nsec->entry.data;
if(!d || now > d->ttl) {
lock_rw_unlock(&nsec->entry.lock);
neg_delete_data(neg, data);
lock_basic_unlock(&neg->lock);
return 0;
}
if(d->security != sec_status_secure) {
lock_rw_unlock(&nsec->entry.lock);
neg_delete_data(neg, data);
lock_basic_unlock(&neg->lock);
return 0;
}
verbose(VERB_ALGO, "negcache got secure rrset");
qinfo.qname = qname;
qinfo.qtype = LDNS_RR_TYPE_DLV;
qinfo.qclass = qclass;
if(!nsec_proves_nodata(nsec, &qinfo, &wc) &&
!val_nsec_proves_name_error(nsec, qname)) {
lock_rw_unlock(&nsec->entry.lock);
lock_basic_unlock(&neg->lock);
verbose(VERB_ALGO, "negcache not proven");
return 0;
}
lock_rw_unlock(&nsec->entry.lock);
neg_lru_touch(neg, data);
lock_basic_unlock(&neg->lock);
verbose(VERB_ALGO, "negcache DLV denial proven");
return 1;
}
static uint8_t* reply_nsec_signer(struct reply_info* rep, size_t* signer_len,
uint16_t* dclass)
{
size_t i;
struct packed_rrset_data* d;
uint8_t* s;
for(i=rep->an_numrrsets; i< rep->an_numrrsets+rep->ns_numrrsets; i++){
if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC ||
ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC3) {
d = (struct packed_rrset_data*)rep->rrsets[i]->
entry.data;
if(d->rrsig_count != 0) {
val_find_rrset_signer(rep->rrsets[i],
&s, signer_len);
if(s && *signer_len) {
*dclass = ntohs(rep->rrsets[i]->
rk.rrset_class);
return s;
}
}
}
}
return 0;
}
void val_neg_addreferral(struct val_neg_cache* neg, struct reply_info* rep,
uint8_t* zone_name)
{
size_t i, need;
uint8_t* signer;
size_t signer_len;
uint16_t dclass;
struct val_neg_zone* zone;
signer = reply_nsec_signer(rep, &signer_len, &dclass);
if(!signer)
return;
if(!dname_subdomain_c(signer, zone_name)) {
return;
}
log_nametypeclass(VERB_ALGO, "negcache insert referral ",
signer, LDNS_RR_TYPE_NS, dclass);
need = calc_data_need(rep) + calc_zone_need(signer, signer_len);
lock_basic_lock(&neg->lock);
neg_make_space(neg, need);
zone = neg_find_zone(neg, signer, signer_len, dclass);
if(!zone) {
if(!(zone = neg_create_zone(neg, signer, signer_len,
dclass))) {
lock_basic_unlock(&neg->lock);
log_err("out of memory adding negative zone");
return;
}
}
val_neg_zone_take_inuse(zone);
for(i=rep->an_numrrsets; i< rep->an_numrrsets+rep->ns_numrrsets; i++){
if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_NSEC &&
ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_NSEC3)
continue;
if(!dname_subdomain_c(rep->rrsets[i]->rk.dname,
zone->name)) continue;
neg_insert_data(neg, zone, rep->rrsets[i]);
}
if(zone->tree.count == 0) {
neg_delete_zone(neg, zone);
}
lock_basic_unlock(&neg->lock);
}
static int nsec3_no_type(struct ub_packed_rrset_key* k, uint16_t t)
{
int count = (int)((struct packed_rrset_data*)k->entry.data)->count;
int i;
for(i=0; i<count; i++)
if(nsec3_has_type(k, i, t))
return 0;
return 1;
}
static struct ub_packed_rrset_key*
grab_nsec(struct rrset_cache* rrset_cache, uint8_t* qname, size_t qname_len,
uint16_t qtype, uint16_t qclass, uint32_t flags,
struct regional* region, int checkbit, uint16_t checktype,
time_t now)
{
struct ub_packed_rrset_key* r, *k = rrset_cache_lookup(rrset_cache,
qname, qname_len, qtype, qclass, flags, now, 0);
struct packed_rrset_data* d;
if(!k) return NULL;
d = (struct packed_rrset_data*)k->entry.data;
if(d->ttl < now) {
lock_rw_unlock(&k->entry.lock);
return NULL;
}
if( ! ( d->security == sec_status_secure ||
(d->security == sec_status_unchecked &&
d->rrsig_count > 0) ) ) {
lock_rw_unlock(&k->entry.lock);
return NULL;
}
if(checkbit && (
(qtype == LDNS_RR_TYPE_NSEC && nsec_has_type(k, checktype)) ||
(qtype == LDNS_RR_TYPE_NSEC3 && !nsec3_no_type(k, checktype))
)) {
lock_rw_unlock(&k->entry.lock);
return NULL;
}
r = packed_rrset_copy_region(k, region, now);
lock_rw_unlock(&k->entry.lock);
return r;
}
static struct val_neg_data*
neg_find_nsec3_ce(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
int qlabs, sldns_buffer* buf, uint8_t* hashnc, size_t* nclen)
{
struct val_neg_data* data;
uint8_t hashce[NSEC3_SHA_LEN];
uint8_t b32[257];
size_t celen, b32len;
*nclen = 0;
while(qlabs > 0) {
if(!(celen=nsec3_get_hashed(buf, qname, qname_len,
zone->nsec3_hash, zone->nsec3_iter, zone->nsec3_salt,
zone->nsec3_saltlen, hashce, sizeof(hashce))))
return NULL;
if(!(b32len=nsec3_hash_to_b32(hashce, celen, zone->name,
zone->len, b32, sizeof(b32))))
return NULL;
data = neg_find_data(zone, b32, b32len, zone->labs+1);
if(data && data->in_use) {
return data;
}
*nclen = celen;
memmove(hashnc, hashce, celen);
dname_remove_label(&qname, &qname_len);
qlabs --;
}
return NULL;
}
static int
neg_params_ok(struct val_neg_zone* zone, struct ub_packed_rrset_key* rrset)
{
int h;
uint8_t* s;
size_t slen, it;
if(!nsec3_get_params(rrset, 0, &h, &it, &s, &slen))
return 0;
return (h == zone->nsec3_hash && it == zone->nsec3_iter &&
slen == zone->nsec3_saltlen &&
memcmp(zone->nsec3_salt, s, slen) == 0);
}
static struct ub_packed_rrset_key*
neg_nsec3_getnc(struct val_neg_zone* zone, uint8_t* hashnc, size_t nclen,
struct rrset_cache* rrset_cache, struct regional* region,
time_t now, uint8_t* b32, size_t maxb32)
{
struct ub_packed_rrset_key* nc_rrset;
struct val_neg_data* data;
size_t b32len;
if(!(b32len=nsec3_hash_to_b32(hashnc, nclen, zone->name,
zone->len, b32, maxb32)))
return NULL;
(void)neg_closest_data(zone, b32, b32len, zone->labs+1, &data);
if(!data && zone->tree.count != 0) {
data = (struct val_neg_data*)rbtree_last(&zone->tree);
}
while(data && !data->in_use)
data = data->parent;
if(!data)
return NULL;
nc_rrset = grab_nsec(rrset_cache, data->name, data->len,
LDNS_RR_TYPE_NSEC3, zone->dclass, 0, region, 0, 0, now);
if(!nc_rrset)
return NULL;
if(!neg_params_ok(zone, nc_rrset))
return NULL;
return nc_rrset;
}
static struct dns_msg*
neg_nsec3_proof_ds(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
int qlabs, sldns_buffer* buf, struct rrset_cache* rrset_cache,
struct regional* region, time_t now, uint8_t* topname)
{
struct dns_msg* msg;
struct val_neg_data* data;
uint8_t hashnc[NSEC3_SHA_LEN];
size_t nclen;
struct ub_packed_rrset_key* ce_rrset, *nc_rrset;
struct nsec3_cached_hash c;
uint8_t nc_b32[257];
if(!zone->nsec3_hash)
return NULL;
if(!(data=neg_find_nsec3_ce(zone, qname, qname_len, qlabs, buf,
hashnc, &nclen))) {
return NULL;
}
ce_rrset = grab_nsec(rrset_cache, data->name, data->len,
LDNS_RR_TYPE_NSEC3, zone->dclass, 0, region, 1,
LDNS_RR_TYPE_DS, now);
if(!ce_rrset)
return NULL;
if(!neg_params_ok(zone, ce_rrset))
return NULL;
if(nclen == 0) {
if(nsec3_has_type(ce_rrset, 0, LDNS_RR_TYPE_SOA) ||
nsec3_has_type(ce_rrset, 0, LDNS_RR_TYPE_DS) ||
!nsec3_has_type(ce_rrset, 0, LDNS_RR_TYPE_NS))
return NULL;
if(!(msg = dns_msg_create(qname, qname_len,
LDNS_RR_TYPE_DS, zone->dclass, region, 1)))
return NULL;
if(!dns_msg_authadd(msg, region, ce_rrset, 0))
return NULL;
return msg;
}
if(!topname)
return NULL;
nc_rrset = neg_nsec3_getnc(zone, hashnc, nclen, rrset_cache,
region, now, nc_b32, sizeof(nc_b32));
if(!nc_rrset)
return NULL;
if(!neg_params_ok(zone, nc_rrset))
return NULL;
if(!nsec3_has_optout(nc_rrset, 0))
return NULL;
c.hash = hashnc;
c.hash_len = nclen;
c.b32 = nc_b32+1;
c.b32_len = (size_t)nc_b32[0];
if(nsec3_covers(zone->name, &c, nc_rrset, 0, buf)) {
if(!(msg = dns_msg_create(qname, qname_len,
LDNS_RR_TYPE_DS, zone->dclass, region, 3)))
return NULL;
if(!dns_msg_authadd(msg, region, ce_rrset, 0))
return NULL;
if(!dns_msg_authadd(msg, region, nc_rrset, 0))
return NULL;
return msg;
}
return NULL;
}
static int add_soa(struct rrset_cache* rrset_cache, time_t now,
struct regional* region, struct dns_msg* msg, struct val_neg_zone* zone)
{
struct ub_packed_rrset_key* soa;
uint8_t* nm;
size_t nmlen;
uint16_t dclass;
if(zone) {
nm = zone->name;
nmlen = zone->len;
dclass = zone->dclass;
} else {
nm = reply_nsec_signer(msg->rep, &nmlen, &dclass);
if(!nm)
return 0;
}
soa = rrset_cache_lookup(rrset_cache, nm, nmlen, LDNS_RR_TYPE_SOA,
dclass, PACKED_RRSET_SOA_NEG, now, 0);
if(!soa)
return 0;
if(!dns_msg_authadd(msg, region, soa, now)) {
lock_rw_unlock(&soa->entry.lock);
return 0;
}
lock_rw_unlock(&soa->entry.lock);
return 1;
}
struct dns_msg*
val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo,
struct regional* region, struct rrset_cache* rrset_cache,
sldns_buffer* buf, time_t now, int addsoa, uint8_t* topname)
{
struct dns_msg* msg;
struct ub_packed_rrset_key* rrset;
uint8_t* zname;
size_t zname_len;
int zname_labs;
struct val_neg_zone* zone;
if(qinfo->qtype != LDNS_RR_TYPE_DS)
return NULL;
log_assert(!topname || dname_subdomain_c(qinfo->qname, topname));
rrset = grab_nsec(rrset_cache, qinfo->qname, qinfo->qname_len,
LDNS_RR_TYPE_NSEC, qinfo->qclass, 0, region, 1,
qinfo->qtype, now);
if(rrset) {
if(!(msg = dns_msg_create(qinfo->qname, qinfo->qname_len,
qinfo->qtype, qinfo->qclass, region, 2)))
return NULL;
if(!dns_msg_authadd(msg, region, rrset, 0))
return NULL;
if(addsoa && !add_soa(rrset_cache, now, region, msg, NULL))
return NULL;
return msg;
}
zname = qinfo->qname;
zname_len = qinfo->qname_len;
dname_remove_label(&zname, &zname_len);
zname_labs = dname_count_labels(zname);
lock_basic_lock(&neg->lock);
zone = neg_closest_zone_parent(neg, zname, zname_len, zname_labs,
qinfo->qclass);
while(zone && !zone->in_use)
zone = zone->parent;
if(zone && topname) {
if(!dname_subdomain_c(zone->name, topname))
zone = NULL;
}
if(!zone) {
lock_basic_unlock(&neg->lock);
return NULL;
}
msg = neg_nsec3_proof_ds(zone, qinfo->qname, qinfo->qname_len,
zname_labs+1, buf, rrset_cache, region, now, topname);
if(msg && addsoa && !add_soa(rrset_cache, now, region, msg, zone)) {
lock_basic_unlock(&neg->lock);
return NULL;
}
lock_basic_unlock(&neg->lock);
return msg;
}