Contains autotrust implementation. More...

#include "config.h"
#include <ldns/ldns.h>
#include "validator/autotrust.h"
#include "validator/val_anchor.h"
#include "validator/val_utils.h"
#include "validator/val_sigcrypt.h"
#include "util/data/dname.h"
#include "util/data/packed_rrset.h"
#include "util/log.h"
#include "util/module.h"
#include "util/net_help.h"
#include "util/config_file.h"
#include "util/regional.h"
#include "util/random.h"
#include "util/data/msgparse.h"
#include "services/mesh.h"
#include "services/cache/rrset.h"
#include "validator/val_kcache.h"

Defines
#define	MIN_PENDINGCOUNT 2
	number of times a key must be seen before it can become valid
Functions
static void	do_revoked (struct module_env env, struct autr_ta anchor, int *c)
	Event: Revoked.
struct autr_global_data *	autr_global_create (void)
	Create new global 5011 data structure.
void	autr_global_delete (struct autr_global_data *global)
	Delete global 5011 data structure.
int	probetree_cmp (const void x, const void y)
	probe tree compare function
size_t	autr_get_num_anchors (struct val_anchors *anchors)
	See if autotrust anchors are configured and how many.
static int	position_in_string (char str, const char sub)
	Position in string.
static void	verbose_key (struct autr_ta ta, enum verbosity_value level, const char format,...) ATTR_FORMAT(printf
	Debug routine to print pretty key information.
static int	parse_comments (char str, struct autr_ta ta)
	Parse comments.
static int	str_contains_data (char *str, char comment)
	Check if a line contains data (besides comments)
static int	dnskey_flags (ldns_rr *rr)
	Get DNSKEY flags.
static int	rr_is_dnskey_sep (ldns_rr *rr)
	Check if KSK DNSKEY.
static int	rr_is_dnskey_revoked (ldns_rr *rr)
	Check if REVOKED DNSKEY.
static struct autr_ta *	autr_ta_create (ldns_rr *rr)
	create ta
static struct trust_anchor *	autr_tp_create (struct val_anchors anchors, ldns_rdf own, uint16_t dc)
	create tp
static void	autr_rrset_delete (struct ub_packed_rrset_key *r)
	delete assembled rrsets
void	autr_point_delete (struct trust_anchor *tp)
	Delete autr anchor, deletes the autr data but does not do unlinking from trees, caller does that.
static struct trust_anchor *	find_add_tp (struct val_anchors anchors, ldns_rr rr)
	find or add a new trust point for autotrust
static struct autr_ta *	add_trustanchor_frm_rr (struct val_anchors anchors, ldns_rr rr, struct trust_anchor **tp)
	Add trust anchor from RR.
static struct autr_ta *	add_trustanchor_frm_str (struct val_anchors anchors, char str, struct trust_anchor *tp, ldns_rdf origin, ldns_rdf *prev, int skip)
	Add new trust anchor from a string in file.
static struct trust_anchor *	load_trustanchor (struct val_anchors anchors, char str, const char fname, ldns_rdf origin, ldns_rdf *prev, int skip)
	Load single anchor.
static int	autr_assemble (struct trust_anchor *tp)
	Assemble the trust anchors into DS and DNSKEY packed rrsets.
static unsigned int	parse_int (char line, int ret)
	parse integer
static struct trust_anchor *	parse_id (struct val_anchors anchors, char line)
	parse id sequence for anchor
static int	parse_var_line (char line, struct val_anchors anchors, struct trust_anchor **anchor)
	Parse variable from trustanchor header.
static int	handle_origin (char line, ldns_rdf *origin)
	handle origin lines
static int	read_multiline (char buf, size_t len, FILE in, int *linenr)
	Read one line and put multiline RRs onto one line string.
int	autr_read_file (struct val_anchors anchors, const char nm)
	Read autotrust file.
static const char *	trustanchor_state2str (autr_state_t s)
	string for a trustanchor state
static int	print_id (FILE out, char fname, struct module_env env, uint8_t nm, size_t nmlen, uint16_t dclass)
	print ID to file
static int	autr_write_contents (FILE out, char fn, struct module_env env, struct trust_anchor tp)
void	autr_write_file (struct module_env env, struct trust_anchor tp)
	Write autotrust file.
static int	verify_dnskey (struct module_env env, struct val_env ve, struct trust_anchor tp, struct ub_packed_rrset_key rrset)
	Verify if dnskey works for trust point.
static uint32_t	min_expiry (struct module_env env, ldns_rr_list rrset)
	Find minimum expiration interval from signatures.
static int	rr_is_selfsigned_revoked (struct module_env env, struct val_env ve, struct ub_packed_rrset_key *dnskey_rrset, size_t i)
	Is rr self-signed revoked key.
static void	seen_trustanchor (struct autr_ta *ta, uint8_t seen)
	Set fetched value.
static void	seen_revoked_trustanchor (struct autr_ta *ta, uint8_t revoked)
	set revoked value
static void	revoke_dnskey (struct autr_ta *ta, int off)
	revoke a trust anchor
static int	ldns_rr_compare_wire_skip_revbit (ldns_buffer rr1_buf, ldns_buffer rr2_buf)
	Compare two RR buffers skipping the REVOKED bit.
static int	ldns_rr_compare_skip_revbit (const ldns_rr rr1, const ldns_rr rr2, int *result)
	Compare two RRs skipping the REVOKED bit.
static int	ta_compare (ldns_rr a, ldns_rr b, int *result)
	compare two trust anchors
static int	find_key (struct trust_anchor tp, ldns_rr rr, struct autr_ta **result)
	Find key.
static struct autr_ta *	add_key (struct trust_anchor tp, ldns_rr rr)
	add key and clone RR and tp already locked
static uint32_t	key_ttl (struct ub_packed_rrset_key *k)
	get TTL from DNSKEY rrset
static void	set_tp_times (struct trust_anchor tp, uint32_t rrsig_exp_interval, uint32_t origttl, int changed)
	update the time values for the trustpoint
static void	init_events (struct trust_anchor *tp)
	init events to zero
static void	check_contains_revoked (struct module_env env, struct val_env ve, struct trust_anchor tp, struct ub_packed_rrset_key dnskey_rrset, int *changed)
	check for revoked keys without trusting any other information
static int	key_matches_a_ds (struct module_env env, struct val_env ve, struct ub_packed_rrset_key dnskey_rrset, size_t key_idx, struct ub_packed_rrset_key ds_rrset)
	See if a DNSKEY is verified by one of the DSes.
static int	update_events (struct module_env env, struct val_env ve, struct trust_anchor tp, struct ub_packed_rrset_key dnskey_rrset, int *changed)
	Set update events.
static int	check_holddown (struct module_env env, struct autr_ta ta, unsigned int holddown)
	Check if the holddown time has already exceeded setting: add-holddown: add holddown timer setting: del-holddown: del holddown timer.
static void	reset_holddown (struct module_env env, struct autr_ta ta, int *changed)
	Set last_change to now.
static void	set_trustanchor_state (struct module_env env, struct autr_ta ta, int *changed, autr_state_t s)
	Set the state for this trust anchor.
static void	do_newkey (struct module_env env, struct autr_ta anchor, int *c)
	Event: NewKey.
static void	do_addtime (struct module_env env, struct autr_ta anchor, int *c)
	Event: AddTime.
static void	do_remtime (struct module_env env, struct autr_ta anchor, int *c)
	Event: RemTime.
static void	do_keyrem (struct module_env env, struct autr_ta anchor, int *c)
	Event: KeyRem.
static void	do_keypres (struct module_env env, struct autr_ta anchor, int *c)
	Event: KeyPres.
static void	anchor_state_update (struct module_env env, struct autr_ta anchor, int *c)
	Do statestable transition matrix for anchor.
static int	init_zsk_to_ksk (struct module_env env, struct trust_anchor tp, int *changed)
	if ZSK init then trust KSKs
static void	remove_missing_trustanchors (struct module_env env, struct trust_anchor tp, int *changed)
	Remove missing trustanchors so the list does not grow forever.
static int	do_statetable (struct module_env env, struct trust_anchor tp, int *changed)
	Do the statetable from RFC5011 transition matrix.
static void	autr_holddown_exceed (struct module_env env, struct trust_anchor tp, int *c)
	See if time alone makes ADDPEND to VALID transition.
static void	autr_cleanup_keys (struct trust_anchor *tp)
	cleanup key list
static time_t	calc_next_probe (struct module_env *env, uint32_t wait)
	calculate next probe time
static time_t	wait_probe_time (struct val_anchors *anchors)
	what is first probe time (anchors must be locked)
static void	reset_worker_timer (struct module_env *env)
	reset worker timer
static int	set_next_probe (struct module_env env, struct trust_anchor tp, struct ub_packed_rrset_key *dnskey_rrset)
	set next probe for trust anchor
static void	autr_tp_remove (struct module_env env, struct trust_anchor tp, struct ub_packed_rrset_key *dnskey_rrset)
	Revoke and Delete a trust point.
int	autr_process_prime (struct module_env env, struct val_env ve, struct trust_anchor tp, struct ub_packed_rrset_key dnskey_rrset)
	Perform autotrust processing.
static void	autr_debug_print_ta (struct autr_ta *ta)
	debug print a trust anchor key
static void	autr_debug_print_tp (struct trust_anchor *tp)
	debug print a trust point
void	autr_debug_print (struct val_anchors *anchors)
	Debug printout of rfc5011 tracked anchors.
void	probe_answer_cb (void arg, int rcode, ldns_buffer buf, enum sec_status sec, char *why_bogus)
	callback for query answer to 5011 probe
static void	probe_anchor (struct module_env env, struct trust_anchor tp)
	probe a trust anchor DNSKEY and unlocks tp
static struct trust_anchor *	todo_probe (struct module_env env, uint32_t next)
	fetch first to-probe trust-anchor and lock it and set retrytime
uint32_t	autr_probe_timer (struct module_env *env)
	Process probe timer.

Detailed Description

Contains autotrust implementation.

The implementation was taken from the autotrust daemon (BSD licensed), written by Matthijs Mekking. It was modified to fit into unbound. The state table process is the same.

Function Documentation

struct autr_global_data* autr_global_create ( void ) [read]

Create new global 5011 data structure.

Returns:: new structure or NULL on malloc failure.

References rbtree_init(), autr_global_data::probe, and probetree_cmp().

Referenced by anchors_create().

void autr_global_delete ( struct autr_global_data * global )

Delete global 5011 data structure.

Parameters:

global,: global autotrust state to delete.

Referenced by anchors_delete().

size_t autr_get_num_anchors ( struct val_anchors * anchors )

See if autotrust anchors are configured and how many.

Parameters:

anchors,: the trust anchors structure.

Returns:: number of autotrust trust anchors

References val_anchors::lock, val_anchors::autr, autr_global_data::probe, and rbtree_t::count.

Referenced by worker_init().

static void static void verbose_key	(	struct autr_ta *	ta,
		enum verbosity_value	level,
		const char *	format,
			...
	)		`[static]`

Debug routine to print pretty key information.

Implementation of debug pretty key print.

Parameters:

ta,:	trust anchor key with DNSKEY data.
level,:	verbosity level to print at.
format,:	printf style format string.

References verbosity, and verbose().

Referenced by parse_comments(), check_contains_revoked(), update_events(), check_holddown(), set_trustanchor_state(), do_addtime(), do_remtime(), do_revoked(), anchor_state_update(), init_zsk_to_ksk(), and remove_missing_trustanchors().

static int parse_comments	(	char *	str,
		struct autr_ta *	ta
	)		`[static]`

Parse comments.

Parameters:

str,:	to parse
ta,:	trust key autotrust metadata

Returns:: false on failure.

References log_err(), position_in_string(), autr_ta::s, verbose_key(), VERB_OPS, autr_ta::pending_count, and autr_ta::last_change.

Referenced by load_trustanchor().

void autr_point_delete ( struct trust_anchor * tp )

Delete autr anchor, deletes the autr data but does not do unlinking from trees, caller does that.

Parameters:

tp,:	trust point to delete.

References trust_anchor::lock, trust_anchor::autr, autr_rrset_delete(), trust_anchor::ds_rrset, trust_anchor::dnskey_rrset, autr_point_data::keys, autr_ta::next, autr_ta::rr, autr_point_data::file, and trust_anchor::name.

Referenced by autr_tp_remove(), and anchors_delfunc().

static struct autr_ta* add_trustanchor_frm_str	(	struct val_anchors *	anchors,
		char *	str,
		struct trust_anchor **	tp,
		ldns_rdf *	origin,
		ldns_rdf **	prev,
		int *	skip
	)		`[static, read]`

Add new trust anchor from a string in file.

Parameters:

anchors,:	all anchors
str,:	string with anchor and comments, if any comments.
tp,:	trust point returned.
origin,:	what to use for @
prev,:	previous rr name
skip,:	if true, the result is NULL, but not an error, skip it.

Returns:: new key in trust point.

References autr_ta::rr, str_contains_data(), log_err(), and add_trustanchor_frm_rr().

Referenced by load_trustanchor().

static struct trust_anchor* load_trustanchor	(	struct val_anchors *	anchors,
		char *	str,
		const char *	fname,
		ldns_rdf *	origin,
		ldns_rdf **	prev,
		int *	skip
	)		`[static, read]`

Load single anchor.

Parameters:

anchors,:	all points.
str,:	comments line
fname,:	filename
origin,:	$ORIGIN.
prev,:	passed to ldns.
skip,:	if true, the result is NULL, but not an error, skip it.

Returns:: false on failure, otherwise the tp read.

References add_trustanchor_frm_str(), trust_anchor::lock, parse_comments(), trust_anchor::autr, autr_point_data::file, and log_err().

Referenced by autr_read_file().

static int autr_assemble ( struct trust_anchor * tp ) [static]

Assemble the trust anchors into DS and DNSKEY packed rrsets.

Uses only VALID and MISSING DNSKEYs. Read the ldns_rrs and builds packed rrsets

Parameters:

tp,:	the trust point. Must be locked.

Returns:: false on malloc failure.

References trust_anchor::autr, autr_point_data::keys, autr_ta::next, autr_ta::rr, autr_ta::s, ub_packed_rrset_heap_key(), ub_packed_rrset_key::entry, lruhash_entry::data, packed_rrset_heap_data(), autr_rrset_delete(), trust_anchor::ds_rrset, trust_anchor::dnskey_rrset, trust_anchor::numDS, and trust_anchor::numDNSKEY.

Referenced by autr_read_file(), and autr_process_prime().

static int parse_var_line	(	char *	line,
		struct val_anchors *	anchors,
		struct trust_anchor **	anchor
	)		`[static]`

Parse variable from trustanchor header.

Parameters:

line,:	to parse
anchors,:	the anchor is added to this, if "id:" is seen.
anchor,:	the anchor as result value or previously returned anchor value to read the variable lines into.

Returns:: : 0 no match, -1 failed syntax error, +1 success line read. +2 revoked trust anchor file.

References parse_id(), log_err(), trust_anchor::lock, trust_anchor::autr, autr_point_data::last_queried, parse_int(), autr_point_data::last_success, val_anchors::lock, rbtree_delete(), val_anchors::autr, autr_global_data::probe, autr_point_data::next_probe_time, rbtree_insert(), autr_point_data::pnode, autr_point_data::query_failed, autr_point_data::query_interval, and autr_point_data::retry_time.

Referenced by autr_read_file().

int autr_read_file	(	struct val_anchors *	anchors,
		const char *	nm
	)

Read autotrust file.

Parameters:

anchors,:	the anchors structure.
nm,:	name of the file (copied).

Returns:: false on failure.

References log_err(), verbose(), VERB_ALGO, read_multiline(), parse_var_line(), log_warn(), str_contains_data(), handle_origin(), load_trustanchor(), trust_anchor::lock, and autr_assemble().

Referenced by anchors_apply_cfg().

void autr_write_file	(	struct module_env *	env,
		struct trust_anchor *	tp
	)

Write autotrust file.

Parameters:

env,:	environment with scratch space.
tp,:	trust point to write.

References trust_anchor::autr, autr_point_data::file, log_assert, module_env::worker, verbose(), VERB_ALGO, and log_err().

Referenced by autr_tp_remove(), and autr_process_prime().

static int verify_dnskey	(	struct module_env *	env,
		struct val_env *	ve,
		struct trust_anchor *	tp,
		struct ub_packed_rrset_key *	rrset
	)		`[static]`

Verify if dnskey works for trust point.

Parameters:

env,:	environment (with time) for verification
ve,:	validator environment (with options) for verification.
tp,:	trust point to verify with
rrset,:	DNSKEY rrset to verify.

Returns:: false on failure, true if verification successful.

References ALGO_NEEDS_MAX, val_verify_DNSKEY_with_TA(), trust_anchor::ds_rrset, trust_anchor::dnskey_rrset, verbose(), VERB_ALGO, sec_status_to_string(), and sec_status_secure.

Referenced by autr_process_prime().

static int find_key	(	struct trust_anchor *	tp,
		ldns_rr *	rr,
		struct autr_ta **	result
	)		`[static]`

Find key.

Parameters:

tp,:	to search in
rr,:	to look for
result,:	returns NULL or the ta key looked for.

Returns:: false on malloc failure during search. if true examine result.

References trust_anchor::autr, autr_point_data::keys, autr_ta::next, ta_compare(), and autr_ta::rr.

Referenced by check_contains_revoked(), and update_events().

static int check_holddown	(	struct module_env *	env,
		struct autr_ta *	ta,
		unsigned int	holddown
	)		`[static]`

Check if the holddown time has already exceeded setting: add-holddown: add holddown timer setting: del-holddown: del holddown timer.

Parameters:

env,:	environment with current time
ta,:	trust anchor to check for.
holddown,:	the timer value

Returns:: number of seconds the holddown has passed.

References module_env::now, autr_ta::last_change, log_warn(), verbose_key(), and VERB_ALGO.

Referenced by do_addtime(), do_remtime(), and remove_missing_trustanchors().

int autr_process_prime	(	struct module_env *	env,
		struct val_env *	ve,
		struct trust_anchor *	tp,
		struct ub_packed_rrset_key *	dnskey_rrset
	)

Perform autotrust processing.

Parameters:

env,:	qstate environment with the anchors structure.
ve,:	validator environment for verification of rrsigs.
tp,:	trust anchor to process.
dnskey_rrset,:	DNSKEY rrset probed (can be NULL if bad prime result). allocated in a region. Has not been validated yet.

Returns:: false if trust anchor was revoked completely. Otherwise logs errors to log, does not change return value. On errors, likely the trust point has been unchanged.

References log_assert, trust_anchor::autr, autr_point_data::revoked, log_nametypeclass(), VERB_ALGO, trust_anchor::name, trust_anchor::dclass, trust_anchor::lock, autr_point_data::last_queried, module_env::now, autr_holddown_exceed(), verbose(), autr_assemble(), log_err(), check_contains_revoked(), trust_anchor::ds_rrset, trust_anchor::dnskey_rrset, autr_point_data::last_success, autr_tp_remove(), verify_dnskey(), autr_point_data::query_failed, autr_write_file(), update_events(), do_statetable(), autr_cleanup_keys(), and set_next_probe().