?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Ignore machine-check MSRs
[freebsd-src/fkvm-freebsd.git] / contrib / bind9 / bin / dig / dighost.c
blob9e7e79659a69cc81c0a4639bd3e35aa6ae0a7b5d
1 /*
2 * Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
3 * Copyright (C) 2000-2003 Internet Software Consortium.
4 *
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
10 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
11 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
12 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
13 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
15 * PERFORMANCE OF THIS SOFTWARE.
16 */
17
18 /* $Id: dighost.c,v 1.259.18.43.10.3 2008/07/23 23:16:43 marka Exp $ */
19
20 /*! \file
21 * \note
22 * Notice to programmers: Do not use this code as an example of how to
23 * use the ISC library to perform DNS lookups. Dig and Host both operate
24 * on the request level, since they allow fine-tuning of output and are
25 * intended as debugging tools. As a result, they perform many of the
26 * functions which could be better handled using the dns_resolver
27 * functions in most applications.
28 */
29
30 #include <config.h>
31 #include <stdlib.h>
32 #include <unistd.h>
33 #include <string.h>
34 #include <limits.h>
35
36 #ifdef HAVE_LOCALE_H
37 #include <locale.h>
38 #endif
39
40 #ifdef WITH_IDN
41 #include <idn/result.h>
42 #include <idn/log.h>
43 #include <idn/resconf.h>
44 #include <idn/api.h>
45 #endif
46
47 #include <dns/byaddr.h>
48 #ifdef DIG_SIGCHASE
49 #include <dns/dnssec.h>
50 #include <dns/ds.h>
51 #include <dns/nsec.h>
52 #include <isc/random.h>
53 #include <ctype.h>
54 #endif
55 #include <dns/fixedname.h>
56 #include <dns/message.h>
57 #include <dns/name.h>
58 #include <dns/rdata.h>
59 #include <dns/rdataclass.h>
60 #include <dns/rdatalist.h>
61 #include <dns/rdataset.h>
62 #include <dns/rdatastruct.h>
63 #include <dns/rdatatype.h>
64 #include <dns/result.h>
65 #include <dns/tsig.h>
66
67 #include <dst/dst.h>
68
69 #include <isc/app.h>
70 #include <isc/base64.h>
71 #include <isc/entropy.h>
72 #include <isc/file.h>
73 #include <isc/lang.h>
74 #include <isc/netaddr.h>
75 #ifdef DIG_SIGCHASE
76 #include <isc/netdb.h>
77 #endif
78 #include <isc/print.h>
79 #include <isc/random.h>
80 #include <isc/result.h>
81 #include <isc/string.h>
82 #include <isc/task.h>
83 #include <isc/timer.h>
84 #include <isc/types.h>
85 #include <isc/util.h>
86
87 #include <lwres/lwres.h>
88 #include <lwres/net.h>
89
90 #include <bind9/getaddresses.h>
91
92 #include <dig/dig.h>
93
94 #if ! defined(NS_INADDRSZ)
95 #define NS_INADDRSZ 4
96 #endif
97
98 #if ! defined(NS_IN6ADDRSZ)
99 #define NS_IN6ADDRSZ 16
100 #endif
101
102 static lwres_context_t *lwctx = NULL;
103 static lwres_conf_t *lwconf;
104
105 dig_lookuplist_t lookup_list;
106 dig_serverlist_t server_list;
107 dig_searchlistlist_t search_list;
108
109 isc_boolean_t
110 check_ra = ISC_FALSE,
111 have_ipv4 = ISC_FALSE,
112 have_ipv6 = ISC_FALSE,
113 specified_source = ISC_FALSE,
114 free_now = ISC_FALSE,
115 cancel_now = ISC_FALSE,
116 usesearch = ISC_FALSE,
117 showsearch = ISC_FALSE,
118 qr = ISC_FALSE,
119 is_dst_up = ISC_FALSE;
120 in_port_t port = 53;
121 unsigned int timeout = 0;
122 unsigned int extrabytes;
123 isc_mem_t *mctx = NULL;
124 isc_taskmgr_t *taskmgr = NULL;
125 isc_task_t *global_task = NULL;
126 isc_timermgr_t *timermgr = NULL;
127 isc_socketmgr_t *socketmgr = NULL;
128 isc_sockaddr_t bind_address;
129 isc_sockaddr_t bind_any;
130 int sendcount = 0;
131 int recvcount = 0;
132 int sockcount = 0;
133 int ndots = -1;
134 int tries = 3;
135 int lookup_counter = 0;
136
137 #ifdef WITH_IDN
138 static void initialize_idn(void);
139 static isc_result_t output_filter(isc_buffer_t *buffer,
140 unsigned int used_org,
141 isc_boolean_t absolute);
142 static idn_result_t append_textname(char *name, const char *origin,
143 size_t namesize);
144 static void idn_check_result(idn_result_t r, const char *msg);
145
146 #define MAXDLEN 256
147 int idnoptions = 0;
148 #endif
149
150 /*%
151 * Exit Codes:
152 *
153 *\li 0 Everything went well, including things like NXDOMAIN
154 *\li 1 Usage error
155 *\li 7 Got too many RR's or Names
156 *\li 8 Couldn't open batch file
157 *\li 9 No reply from server
158 *\li 10 Internal error
159 */
160 int exitcode = 0;
161 int fatalexit = 0;
162 char keynametext[MXNAME];
163 char keyfile[MXNAME] = "";
164 char keysecret[MXNAME] = "";
165 dns_name_t *hmacname = NULL;
166 unsigned int digestbits = 0;
167 isc_buffer_t *namebuf = NULL;
168 dns_tsigkey_t *key = NULL;
169 isc_boolean_t validated = ISC_TRUE;
170 isc_entropy_t *entp = NULL;
171 isc_mempool_t *commctx = NULL;
172 isc_boolean_t debugging = ISC_FALSE;
173 isc_boolean_t memdebugging = ISC_FALSE;
174 char *progname = NULL;
175 isc_mutex_t lookup_lock;
176 dig_lookup_t *current_lookup = NULL;
177
178 #ifdef DIG_SIGCHASE
179
180 isc_result_t get_trusted_key(isc_mem_t *mctx);
181 dns_rdataset_t * sigchase_scanname(dns_rdatatype_t type,
182 dns_rdatatype_t covers,
183 isc_boolean_t *lookedup,
184 dns_name_t *rdata_name);
185 dns_rdataset_t * chase_scanname_section(dns_message_t *msg,
186 dns_name_t *name,
187 dns_rdatatype_t type,
188 dns_rdatatype_t covers,
189 int section);
190 isc_result_t advanced_rrsearch(dns_rdataset_t **rdataset,
191 dns_name_t *name,
192 dns_rdatatype_t type,
193 dns_rdatatype_t covers,
194 isc_boolean_t *lookedup);
195 isc_result_t sigchase_verify_sig_key(dns_name_t *name,
196 dns_rdataset_t *rdataset,
197 dst_key_t* dnsseckey,
198 dns_rdataset_t *sigrdataset,
199 isc_mem_t *mctx);
200 isc_result_t sigchase_verify_sig(dns_name_t *name,
201 dns_rdataset_t *rdataset,
202 dns_rdataset_t *keyrdataset,
203 dns_rdataset_t *sigrdataset,
204 isc_mem_t *mctx);
205 isc_result_t sigchase_verify_ds(dns_name_t *name,
206 dns_rdataset_t *keyrdataset,
207 dns_rdataset_t *dsrdataset,
208 isc_mem_t *mctx);
209 void sigchase(dns_message_t *msg);
210 void print_rdata(dns_rdata_t *rdata, isc_mem_t *mctx);
211 void print_rdataset(dns_name_t *name,
212 dns_rdataset_t *rdataset, isc_mem_t *mctx);
213 void dup_name(dns_name_t *source, dns_name_t* target,
214 isc_mem_t *mctx);
215 void free_name(dns_name_t *name, isc_mem_t *mctx);
216 void dump_database(void);
217 void dump_database_section(dns_message_t *msg, int section);
218 dns_rdataset_t * search_type(dns_name_t *name, dns_rdatatype_t type,
219 dns_rdatatype_t covers);
220 isc_result_t contains_trusted_key(dns_name_t *name,
221 dns_rdataset_t *rdataset,
222 dns_rdataset_t *sigrdataset,
223 isc_mem_t *mctx);
224 void print_type(dns_rdatatype_t type);
225 isc_result_t prove_nx_domain(dns_message_t * msg,
226 dns_name_t * name,
227 dns_name_t * rdata_name,
228 dns_rdataset_t ** rdataset,
229 dns_rdataset_t ** sigrdataset);
230 isc_result_t prove_nx_type(dns_message_t * msg, dns_name_t *name,
231 dns_rdataset_t *nsec,
232 dns_rdataclass_t class,
233 dns_rdatatype_t type,
234 dns_name_t * rdata_name,
235 dns_rdataset_t ** rdataset,
236 dns_rdataset_t ** sigrdataset);
237 isc_result_t prove_nx(dns_message_t * msg, dns_name_t * name,
238 dns_rdataclass_t class,
239 dns_rdatatype_t type,
240 dns_name_t * rdata_name,
241 dns_rdataset_t ** rdataset,
242 dns_rdataset_t ** sigrdataset);
243 static void nameFromString(const char *str, dns_name_t *p_ret);
244 int inf_name(dns_name_t * name1, dns_name_t * name2);
245 isc_result_t opentmpkey(isc_mem_t *mctx, const char *file,
246 char **tempp, FILE **fp);
247 isc_result_t removetmpkey(isc_mem_t *mctx, const char *file);
248 void clean_trustedkey(void);
249 void insert_trustedkey(dst_key_t * key);
250 #if DIG_SIGCHASE_BU
251 isc_result_t getneededrr(dns_message_t *msg);
252 void sigchase_bottom_up(dns_message_t *msg);
253 void sigchase_bu(dns_message_t *msg);
254 #endif
255 #if DIG_SIGCHASE_TD
256 isc_result_t initialization(dns_name_t *name);
257 isc_result_t prepare_lookup(dns_name_t *name);
258 isc_result_t grandfather_pb_test(dns_name_t * zone_name,
259 dns_rdataset_t *sigrdataset);
260 isc_result_t child_of_zone(dns_name_t *name,
261 dns_name_t *zone_name,
262 dns_name_t *child_name);
263 void sigchase_td(dns_message_t *msg);
264 #endif
265 char trustedkey[MXNAME] = "";
266
267 dns_rdataset_t *chase_rdataset = NULL;
268 dns_rdataset_t *chase_sigrdataset = NULL;
269 dns_rdataset_t *chase_dsrdataset = NULL;
270 dns_rdataset_t *chase_sigdsrdataset = NULL;
271 dns_rdataset_t *chase_keyrdataset = NULL;
272 dns_rdataset_t *chase_sigkeyrdataset = NULL;
273 dns_rdataset_t *chase_nsrdataset = NULL;
274
275 dns_name_t chase_name; /* the query name */
276 #if DIG_SIGCHASE_TD
277 /*
278 * the current name is the parent name when we follow delegation
279 */
280 dns_name_t chase_current_name;
281 /*
282 * the child name is used for delegation (NS DS responses in AUTHORITY section)
283 */
284 dns_name_t chase_authority_name;
285 #endif
286 #if DIG_SIGCHASE_BU
287 dns_name_t chase_signame;
288 #endif
289
290
291 isc_boolean_t chase_siglookedup = ISC_FALSE;
292 isc_boolean_t chase_keylookedup = ISC_FALSE;
293 isc_boolean_t chase_sigkeylookedup = ISC_FALSE;
294 isc_boolean_t chase_dslookedup = ISC_FALSE;
295 isc_boolean_t chase_sigdslookedup = ISC_FALSE;
296 #if DIG_SIGCHASE_TD
297 isc_boolean_t chase_nslookedup = ISC_FALSE;
298 isc_boolean_t chase_lookedup = ISC_FALSE;
299
300
301 isc_boolean_t delegation_follow = ISC_FALSE;
302 isc_boolean_t grandfather_pb = ISC_FALSE;
303 isc_boolean_t have_response = ISC_FALSE;
304 isc_boolean_t have_delegation_ns = ISC_FALSE;
305 dns_message_t * error_message = NULL;
306 #endif
307
308 isc_boolean_t dsvalidating = ISC_FALSE;
309 isc_boolean_t chase_name_dup = ISC_FALSE;
310
311 ISC_LIST(dig_message_t) chase_message_list;
312 ISC_LIST(dig_message_t) chase_message_list2;
313
314
315 #define MAX_TRUSTED_KEY 5
316 typedef struct struct_trusted_key_list {
317 dst_key_t * key[MAX_TRUSTED_KEY];
318 int nb_tk;
319 } struct_tk_list;
320
321 struct_tk_list tk_list = { {NULL, NULL, NULL, NULL, NULL}, 0};
322
323 #endif
324
325 #define DIG_MAX_ADDRESSES 20
326
327 /*%
328 * Apply and clear locks at the event level in global task.
329 * Can I get rid of these using shutdown events? XXX
330 */
331 #define LOCK_LOOKUP {\
332 debug("lock_lookup %s:%d", __FILE__, __LINE__);\
333 check_result(isc_mutex_lock((&lookup_lock)), "isc_mutex_lock");\
334 debug("success");\
335 }
336 #define UNLOCK_LOOKUP {\
337 debug("unlock_lookup %s:%d", __FILE__, __LINE__);\
338 check_result(isc_mutex_unlock((&lookup_lock)),\
339 "isc_mutex_unlock");\
340 }
341
342 static void
343 cancel_lookup(dig_lookup_t *lookup);
344
345 static void
346 recv_done(isc_task_t *task, isc_event_t *event);
347
348 static void
349 send_udp(dig_query_t *query);
350
351 static void
352 connect_timeout(isc_task_t *task, isc_event_t *event);
353
354 static void
355 launch_next_query(dig_query_t *query, isc_boolean_t include_question);
356
357
358 static void *
359 mem_alloc(void *arg, size_t size) {
360 return (isc_mem_get(arg, size));
361 }
362
363 static void
364 mem_free(void *arg, void *mem, size_t size) {
365 isc_mem_put(arg, mem, size);
366 }
367
368 char *
369 next_token(char **stringp, const char *delim) {
370 char *res;
371
372 do {
373 res = strsep(stringp, delim);
374 if (res == NULL)
375 break;
376 } while (*res == '\0');
377 return (res);
378 }
379
380 static int
381 count_dots(char *string) {
382 char *s;
383 int i = 0;
384
385 s = string;
386 while (*s != '\0') {
387 if (*s == '.')
388 i++;
389 s++;
390 }
391 return (i);
392 }
393
394 static void
395 hex_dump(isc_buffer_t *b) {
396 unsigned int len;
397 isc_region_t r;
398
399 isc_buffer_usedregion(b, &r);
400
401 printf("%d bytes\n", r.length);
402 for (len = 0; len < r.length; len++) {
403 printf("%02x ", r.base[len]);
404 if (len % 16 == 15)
405 printf("\n");
406 }
407 if (len % 16 != 0)
408 printf("\n");
409 }
410
411 /*%
412 * Append 'len' bytes of 'text' at '*p', failing with
413 * ISC_R_NOSPACE if that would advance p past 'end'.
414 */
415 static isc_result_t
416 append(const char *text, int len, char **p, char *end) {
417 if (len > end - *p)
418 return (ISC_R_NOSPACE);
419 memcpy(*p, text, len);
420 *p += len;
421 return (ISC_R_SUCCESS);
422 }
423
424 static isc_result_t
425 reverse_octets(const char *in, char **p, char *end) {
426 char *dot = strchr(in, '.');
427 int len;
428 if (dot != NULL) {
429 isc_result_t result;
430 result = reverse_octets(dot + 1, p, end);
431 if (result != ISC_R_SUCCESS)
432 return (result);
433 result = append(".", 1, p, end);
434 if (result != ISC_R_SUCCESS)
435 return (result);
436 len = dot - in;
437 } else {
438 len = strlen(in);
439 }
440 return (append(in, len, p, end));
441 }
442
443 isc_result_t
444 get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,
445 isc_boolean_t strict)
446 {
447 int r;
448 isc_result_t result;
449 isc_netaddr_t addr;
450
451 addr.family = AF_INET6;
452 r = inet_pton(AF_INET6, value, &addr.type.in6);
453 if (r > 0) {
454 /* This is a valid IPv6 address. */
455 dns_fixedname_t fname;
456 dns_name_t *name;
457 unsigned int options = 0;
458
459 if (ip6_int)
460 options |= DNS_BYADDROPT_IPV6INT;
461 dns_fixedname_init(&fname);
462 name = dns_fixedname_name(&fname);
463 result = dns_byaddr_createptrname2(&addr, options, name);
464 if (result != ISC_R_SUCCESS)
465 return (result);
466 dns_name_format(name, reverse, len);
467 return (ISC_R_SUCCESS);
468 } else {
469 /*
470 * Not a valid IPv6 address. Assume IPv4.
471 * If 'strict' is not set, construct the
472 * in-addr.arpa name by blindly reversing
473 * octets whether or not they look like integers,
474 * so that this can be used for RFC2317 names
475 * and such.
476 */
477 char *p = reverse;
478 char *end = reverse + len;
479 if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1)
480 return (DNS_R_BADDOTTEDQUAD);
481 result = reverse_octets(value, &p, end);
482 if (result != ISC_R_SUCCESS)
483 return (result);
484 /* Append .in-addr.arpa. and a terminating NUL. */
485 result = append(".in-addr.arpa.", 15, &p, end);
486 if (result != ISC_R_SUCCESS)
487 return (result);
488 return (ISC_R_SUCCESS);
489 }
490 }
491
492 void
493 fatal(const char *format, ...) {
494 va_list args;
495
496 fprintf(stderr, "%s: ", progname);
497 va_start(args, format);
498 vfprintf(stderr, format, args);
499 va_end(args);
500 fprintf(stderr, "\n");
501 if (exitcode < 10)
502 exitcode = 10;
503 if (fatalexit != 0)
504 exitcode = fatalexit;
505 exit(exitcode);
506 }
507
508 void
509 debug(const char *format, ...) {
510 va_list args;
511
512 if (debugging) {
513 va_start(args, format);
514 vfprintf(stderr, format, args);
515 va_end(args);
516 fprintf(stderr, "\n");
517 }
518 }
519
520 void
521 check_result(isc_result_t result, const char *msg) {
522 if (result != ISC_R_SUCCESS) {
523 fatal("%s: %s", msg, isc_result_totext(result));
524 }
525 }
526
527 /*%
528 * Create a server structure, which is part of the lookup structure.
529 * This is little more than a linked list of servers to query in hopes
530 * of finding the answer the user is looking for
531 */
532 dig_server_t *
533 make_server(const char *servname, const char *userarg) {
534 dig_server_t *srv;
535
536 REQUIRE(servname != NULL);
537
538 debug("make_server(%s)", servname);
539 srv = isc_mem_allocate(mctx, sizeof(struct dig_server));
540 if (srv == NULL)
541 fatal("memory allocation failure in %s:%d",
542 __FILE__, __LINE__);
543 strncpy(srv->servername, servname, MXNAME);
544 strncpy(srv->userarg, userarg, MXNAME);
545 srv->servername[MXNAME-1] = 0;
546 srv->userarg[MXNAME-1] = 0;
547 ISC_LINK_INIT(srv, link);
548 return (srv);
549 }
550
551 static int
552 addr2af(int lwresaddrtype)
553 {
554 int af = 0;
555
556 switch (lwresaddrtype) {
557 case LWRES_ADDRTYPE_V4:
558 af = AF_INET;
559 break;
560
561 case LWRES_ADDRTYPE_V6:
562 af = AF_INET6;
563 break;
564 }
565
566 return (af);
567 }
568
569 /*%
570 * Create a copy of the server list from the lwres configuration structure.
571 * The dest list must have already had ISC_LIST_INIT applied.
572 */
573 static void
574 copy_server_list(lwres_conf_t *confdata, dig_serverlist_t *dest) {
575 dig_server_t *newsrv;
576 char tmp[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
577 int af;
578 int i;
579
580 debug("copy_server_list()");
581 for (i = 0; i < confdata->nsnext; i++) {
582 af = addr2af(confdata->nameservers[i].family);
583
584 lwres_net_ntop(af, confdata->nameservers[i].address,
585 tmp, sizeof(tmp));
586 newsrv = make_server(tmp, tmp);
587 ISC_LINK_INIT(newsrv, link);
588 ISC_LIST_ENQUEUE(*dest, newsrv, link);
589 }
590 }
591
592 void
593 flush_server_list(void) {
594 dig_server_t *s, *ps;
595
596 debug("flush_server_list()");
597 s = ISC_LIST_HEAD(server_list);
598 while (s != NULL) {
599 ps = s;
600 s = ISC_LIST_NEXT(s, link);
601 ISC_LIST_DEQUEUE(server_list, ps, link);
602 isc_mem_free(mctx, ps);
603 }
604 }
605
606 void
607 set_nameserver(char *opt) {
608 isc_result_t result;
609 isc_sockaddr_t sockaddrs[DIG_MAX_ADDRESSES];
610 isc_netaddr_t netaddr;
611 int count, i;
612 dig_server_t *srv;
613 char tmp[ISC_NETADDR_FORMATSIZE];
614
615 if (opt == NULL)
616 return;
617
618 result = bind9_getaddresses(opt, 0, sockaddrs,
619 DIG_MAX_ADDRESSES, &count);
620 if (result != ISC_R_SUCCESS)
621 fatal("couldn't get address for '%s': %s",
622 opt, isc_result_totext(result));
623
624 flush_server_list();
625
626 for (i = 0; i < count; i++) {
627 isc_netaddr_fromsockaddr(&netaddr, &sockaddrs[i]);
628 isc_netaddr_format(&netaddr, tmp, sizeof(tmp));
629 srv = make_server(tmp, opt);
630 if (srv == NULL)
631 fatal("memory allocation failure");
632 ISC_LIST_APPEND(server_list, srv, link);
633 }
634 }
635
636 static isc_result_t
637 add_nameserver(lwres_conf_t *confdata, const char *addr, int af) {
638
639 int i = confdata->nsnext;
640
641 if (confdata->nsnext >= LWRES_CONFMAXNAMESERVERS)
642 return (ISC_R_FAILURE);
643
644 switch (af) {
645 case AF_INET:
646 confdata->nameservers[i].family = LWRES_ADDRTYPE_V4;
647 confdata->nameservers[i].length = NS_INADDRSZ;
648 break;
649 case AF_INET6:
650 confdata->nameservers[i].family = LWRES_ADDRTYPE_V6;
651 confdata->nameservers[i].length = NS_IN6ADDRSZ;
652 break;
653 default:
654 return (ISC_R_FAILURE);
655 }
656
657 if (lwres_net_pton(af, addr, &confdata->nameservers[i].address) == 1) {
658 confdata->nsnext++;
659 return (ISC_R_SUCCESS);
660 }
661 return (ISC_R_FAILURE);
662 }
663
664 /*%
665 * Produce a cloned server list. The dest list must have already had
666 * ISC_LIST_INIT applied.
667 */
668 void
669 clone_server_list(dig_serverlist_t src, dig_serverlist_t *dest) {
670 dig_server_t *srv, *newsrv;
671
672 debug("clone_server_list()");
673 srv = ISC_LIST_HEAD(src);
674 while (srv != NULL) {
675 newsrv = make_server(srv->servername, srv->userarg);
676 ISC_LINK_INIT(newsrv, link);
677 ISC_LIST_ENQUEUE(*dest, newsrv, link);
678 srv = ISC_LIST_NEXT(srv, link);
679 }
680 }
681
682 /*%
683 * Create an empty lookup structure, which holds all the information needed
684 * to get an answer to a user's question. This structure contains two
685 * linked lists: the server list (servers to query) and the query list
686 * (outstanding queries which have been made to the listed servers).
687 */
688 dig_lookup_t *
689 make_empty_lookup(void) {
690 dig_lookup_t *looknew;
691
692 debug("make_empty_lookup()");
693
694 INSIST(!free_now);
695
696 looknew = isc_mem_allocate(mctx, sizeof(struct dig_lookup));
697 if (looknew == NULL)
698 fatal("memory allocation failure in %s:%d",
699 __FILE__, __LINE__);
700 looknew->pending = ISC_TRUE;
701 looknew->textname[0] = 0;
702 looknew->cmdline[0] = 0;
703 looknew->rdtype = dns_rdatatype_a;
704 looknew->qrdtype = dns_rdatatype_a;
705 looknew->rdclass = dns_rdataclass_in;
706 looknew->rdtypeset = ISC_FALSE;
707 looknew->rdclassset = ISC_FALSE;
708 looknew->sendspace = NULL;
709 looknew->sendmsg = NULL;
710 looknew->name = NULL;
711 looknew->oname = NULL;
712 looknew->timer = NULL;
713 looknew->xfr_q = NULL;
714 looknew->current_query = NULL;
715 looknew->doing_xfr = ISC_FALSE;
716 looknew->ixfr_serial = ISC_FALSE;
717 looknew->trace = ISC_FALSE;
718 looknew->trace_root = ISC_FALSE;
719 looknew->identify = ISC_FALSE;
720 looknew->identify_previous_line = ISC_FALSE;
721 looknew->ignore = ISC_FALSE;
722 looknew->servfail_stops = ISC_TRUE;
723 looknew->besteffort = ISC_TRUE;
724 looknew->dnssec = ISC_FALSE;
725 #ifdef DIG_SIGCHASE
726 looknew->sigchase = ISC_FALSE;
727 #if DIG_SIGCHASE_TD
728 looknew->do_topdown = ISC_FALSE;
729 looknew->trace_root_sigchase = ISC_FALSE;
730 looknew->rdtype_sigchaseset = ISC_FALSE;
731 looknew->rdtype_sigchase = dns_rdatatype_any;
732 looknew->qrdtype_sigchase = dns_rdatatype_any;
733 looknew->rdclass_sigchase = dns_rdataclass_in;
734 looknew->rdclass_sigchaseset = ISC_FALSE;
735 #endif
736 #endif
737 looknew->udpsize = 0;
738 looknew->edns = -1;
739 looknew->recurse = ISC_TRUE;
740 looknew->aaonly = ISC_FALSE;
741 looknew->adflag = ISC_FALSE;
742 looknew->cdflag = ISC_FALSE;
743 looknew->ns_search_only = ISC_FALSE;
744 looknew->origin = NULL;
745 looknew->tsigctx = NULL;
746 looknew->querysig = NULL;
747 looknew->retries = tries;
748 looknew->nsfound = 0;
749 looknew->tcp_mode = ISC_FALSE;
750 looknew->ip6_int = ISC_FALSE;
751 looknew->comments = ISC_TRUE;
752 looknew->stats = ISC_TRUE;
753 looknew->section_question = ISC_TRUE;
754 looknew->section_answer = ISC_TRUE;
755 looknew->section_authority = ISC_TRUE;
756 looknew->section_additional = ISC_TRUE;
757 looknew->new_search = ISC_FALSE;
758 looknew->done_as_is = ISC_FALSE;
759 looknew->need_search = ISC_FALSE;
760 ISC_LINK_INIT(looknew, link);
761 ISC_LIST_INIT(looknew->q);
762 ISC_LIST_INIT(looknew->my_server_list);
763 return (looknew);
764 }
765
766 /*%
767 * Clone a lookup, perhaps copying the server list. This does not clone
768 * the query list, since it will be regenerated by the setup_lookup()
769 * function, nor does it queue up the new lookup for processing.
770 * Caution: If you don't clone the servers, you MUST clone the server
771 * list seperately from somewhere else, or construct it by hand.
772 */
773 dig_lookup_t *
774 clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
775 dig_lookup_t *looknew;
776
777 debug("clone_lookup()");
778
779 INSIST(!free_now);
780
781 looknew = make_empty_lookup();
782 INSIST(looknew != NULL);
783 strncpy(looknew->textname, lookold->textname, MXNAME);
784 #if DIG_SIGCHASE_TD
785 strncpy(looknew->textnamesigchase, lookold->textnamesigchase, MXNAME);
786 #endif
787 strncpy(looknew->cmdline, lookold->cmdline, MXNAME);
788 looknew->textname[MXNAME-1] = 0;
789 looknew->rdtype = lookold->rdtype;
790 looknew->qrdtype = lookold->qrdtype;
791 looknew->rdclass = lookold->rdclass;
792 looknew->rdtypeset = lookold->rdtypeset;
793 looknew->rdclassset = lookold->rdclassset;
794 looknew->doing_xfr = lookold->doing_xfr;
795 looknew->ixfr_serial = lookold->ixfr_serial;
796 looknew->trace = lookold->trace;
797 looknew->trace_root = lookold->trace_root;
798 looknew->identify = lookold->identify;
799 looknew->identify_previous_line = lookold->identify_previous_line;
800 looknew->ignore = lookold->ignore;
801 looknew->servfail_stops = lookold->servfail_stops;
802 looknew->besteffort = lookold->besteffort;
803 looknew->dnssec = lookold->dnssec;
804 #ifdef DIG_SIGCHASE
805 looknew->sigchase = lookold->sigchase;
806 #if DIG_SIGCHASE_TD
807 looknew->do_topdown = lookold->do_topdown;
808 looknew->trace_root_sigchase = lookold->trace_root_sigchase;
809 looknew->rdtype_sigchaseset = lookold->rdtype_sigchaseset;
810 looknew->rdtype_sigchase = lookold->rdtype_sigchase;
811 looknew->qrdtype_sigchase = lookold->qrdtype_sigchase;
812 looknew->rdclass_sigchase = lookold->rdclass_sigchase;
813 looknew->rdclass_sigchaseset = lookold->rdclass_sigchaseset;
814 #endif
815 #endif
816 looknew->udpsize = lookold->udpsize;
817 looknew->edns = lookold->edns;
818 looknew->recurse = lookold->recurse;
819 looknew->aaonly = lookold->aaonly;
820 looknew->adflag = lookold->adflag;
821 looknew->cdflag = lookold->cdflag;
822 looknew->ns_search_only = lookold->ns_search_only;
823 looknew->tcp_mode = lookold->tcp_mode;
824 looknew->comments = lookold->comments;
825 looknew->stats = lookold->stats;
826 looknew->section_question = lookold->section_question;
827 looknew->section_answer = lookold->section_answer;
828 looknew->section_authority = lookold->section_authority;
829 looknew->section_additional = lookold->section_additional;
830 looknew->retries = lookold->retries;
831 looknew->tsigctx = NULL;
832 looknew->need_search = lookold->need_search;
833 looknew->done_as_is = lookold->done_as_is;
834
835 if (servers)
836 clone_server_list(lookold->my_server_list,
837 &looknew->my_server_list);
838 return (looknew);
839 }
840
841 /*%
842 * Requeue a lookup for further processing, perhaps copying the server
843 * list. The new lookup structure is returned to the caller, and is
844 * queued for processing. If servers are not cloned in the requeue, they
845 * must be added before allowing the current event to complete, since the
846 * completion of the event may result in the next entry on the lookup
847 * queue getting run.
848 */
849 dig_lookup_t *
850 requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
851 dig_lookup_t *looknew;
852
853 debug("requeue_lookup()");
854
855 lookup_counter++;
856 if (lookup_counter > LOOKUP_LIMIT)
857 fatal("too many lookups");
858
859 looknew = clone_lookup(lookold, servers);
860 INSIST(looknew != NULL);
861
862 debug("before insertion, init@%p -> %p, new@%p -> %p",
863 lookold, lookold->link.next, looknew, looknew->link.next);
864 ISC_LIST_PREPEND(lookup_list, looknew, link);
865 debug("after insertion, init -> %p, new = %p, new -> %p",
866 lookold, looknew, looknew->link.next);
867 return (looknew);
868 }
869
870
871 static void
872 setup_text_key(void) {
873 isc_result_t result;
874 dns_name_t keyname;
875 isc_buffer_t secretbuf;
876 int secretsize;
877 unsigned char *secretstore;
878
879 debug("setup_text_key()");
880 result = isc_buffer_allocate(mctx, &namebuf, MXNAME);
881 check_result(result, "isc_buffer_allocate");
882 dns_name_init(&keyname, NULL);
883 check_result(result, "dns_name_init");
884 isc_buffer_putstr(namebuf, keynametext);
885 secretsize = strlen(keysecret) * 3 / 4;
886 secretstore = isc_mem_allocate(mctx, secretsize);
887 if (secretstore == NULL)
888 fatal("memory allocation failure in %s:%d",
889 __FILE__, __LINE__);
890 isc_buffer_init(&secretbuf, secretstore, secretsize);
891 result = isc_base64_decodestring(keysecret, &secretbuf);
892 if (result != ISC_R_SUCCESS)
893 goto failure;
894
895 secretsize = isc_buffer_usedlength(&secretbuf);
896
897 result = dns_name_fromtext(&keyname, namebuf,
898 dns_rootname, ISC_FALSE,
899 namebuf);
900 if (result != ISC_R_SUCCESS)
901 goto failure;
902
903 result = dns_tsigkey_create(&keyname, hmacname, secretstore,
904 secretsize, ISC_FALSE, NULL, 0, 0, mctx,
905 NULL, &key);
906 failure:
907 if (result != ISC_R_SUCCESS)
908 printf(";; Couldn't create key %s: %s\n",
909 keynametext, isc_result_totext(result));
910 else
911 dst_key_setbits(key->key, digestbits);
912
913 isc_mem_free(mctx, secretstore);
914 dns_name_invalidate(&keyname);
915 isc_buffer_free(&namebuf);
916 }
917
918 static void
919 setup_file_key(void) {
920 isc_result_t result;
921 dst_key_t *dstkey = NULL;
922
923 debug("setup_file_key()");
924 result = dst_key_fromnamedfile(keyfile, DST_TYPE_PRIVATE | DST_TYPE_KEY,
925 mctx, &dstkey);
926 if (result != ISC_R_SUCCESS) {
927 fprintf(stderr, "Couldn't read key from %s: %s\n",
928 keyfile, isc_result_totext(result));
929 goto failure;
930 }
931
932 switch (dst_key_alg(dstkey)) {
933 case DST_ALG_HMACMD5:
934 hmacname = DNS_TSIG_HMACMD5_NAME;
935 break;
936 case DST_ALG_HMACSHA1:
937 hmacname = DNS_TSIG_HMACSHA1_NAME;
938 break;
939 case DST_ALG_HMACSHA224:
940 hmacname = DNS_TSIG_HMACSHA224_NAME;
941 break;
942 case DST_ALG_HMACSHA256:
943 hmacname = DNS_TSIG_HMACSHA256_NAME;
944 break;
945 case DST_ALG_HMACSHA384:
946 hmacname = DNS_TSIG_HMACSHA384_NAME;
947 break;
948 case DST_ALG_HMACSHA512:
949 hmacname = DNS_TSIG_HMACSHA512_NAME;
950 break;
951 default:
952 printf(";; Couldn't create key %s: bad algorithm\n",
953 keynametext);
954 goto failure;
955 }
956 result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmacname,
957 dstkey, ISC_FALSE, NULL, 0, 0,
958 mctx, NULL, &key);
959 if (result != ISC_R_SUCCESS) {
960 printf(";; Couldn't create key %s: %s\n",
961 keynametext, isc_result_totext(result));
962 goto failure;
963 }
964 dstkey = NULL;
965 failure:
966 if (dstkey != NULL)
967 dst_key_free(&dstkey);
968 }
969
970 static dig_searchlist_t *
971 make_searchlist_entry(char *domain) {
972 dig_searchlist_t *search;
973 search = isc_mem_allocate(mctx, sizeof(*search));
974 if (search == NULL)
975 fatal("memory allocation failure in %s:%d",
976 __FILE__, __LINE__);
977 strncpy(search->origin, domain, MXNAME);
978 search->origin[MXNAME-1] = 0;
979 ISC_LINK_INIT(search, link);
980 return (search);
981 }
982
983 static void
984 create_search_list(lwres_conf_t *confdata) {
985 int i;
986 dig_searchlist_t *search;
987
988 debug("create_search_list()");
989 ISC_LIST_INIT(search_list);
990
991 for (i = 0; i < confdata->searchnxt; i++) {
992 search = make_searchlist_entry(confdata->search[i]);
993 ISC_LIST_APPEND(search_list, search, link);
994 }
995 }
996
997 /*%
998 * Setup the system as a whole, reading key information and resolv.conf
999 * settings.
1000 */
1001 void
1002 setup_system(void) {
1003 dig_searchlist_t *domain = NULL;
1004 lwres_result_t lwresult;
1005
1006 debug("setup_system()");
1007
1008 lwresult = lwres_context_create(&lwctx, mctx, mem_alloc, mem_free, 1);
1009 if (lwresult != LWRES_R_SUCCESS)
1010 fatal("lwres_context_create failed");
1011
1012 lwresult = lwres_conf_parse(lwctx, RESOLV_CONF);
1013 if (lwresult != LWRES_R_SUCCESS && lwresult != LWRES_R_NOTFOUND)
1014 fatal("parse of %s failed", RESOLV_CONF);
1015
1016 lwconf = lwres_conf_get(lwctx);
1017
1018 /* Make the search list */
1019 if (lwconf->searchnxt > 0)
1020 create_search_list(lwconf);
1021 else { /* No search list. Use the domain name if any */
1022 if (lwconf->domainname != NULL) {
1023 domain = make_searchlist_entry(lwconf->domainname);
1024 ISC_LIST_INITANDAPPEND(search_list, domain, link);
1025 domain = NULL;
1026 }
1027 }
1028
1029 if (ndots == -1) {
1030 ndots = lwconf->ndots;
1031 debug("ndots is %d.", ndots);
1032 }
1033
1034 /* If we don't find a nameserver fall back to localhost */
1035 if (lwconf->nsnext == 0) {
1036 if (have_ipv4) {
1037 lwresult = add_nameserver(lwconf, "127.0.0.1", AF_INET);
1038 if (lwresult != ISC_R_SUCCESS)
1039 fatal("add_nameserver failed");
1040 }
1041 if (have_ipv6) {
1042 lwresult = add_nameserver(lwconf, "::1", AF_INET6);
1043 if (lwresult != ISC_R_SUCCESS)
1044 fatal("add_nameserver failed");
1045 }
1046 }
1047
1048 if (ISC_LIST_EMPTY(server_list))
1049 copy_server_list(lwconf, &server_list);
1050
1051 #ifdef WITH_IDN
1052 initialize_idn();
1053 #endif
1054
1055 if (keyfile[0] != 0)
1056 setup_file_key();
1057 else if (keysecret[0] != 0)
1058 setup_text_key();
1059 #ifdef DIG_SIGCHASE
1060 /* Setup the list of messages for +sigchase */
1061 ISC_LIST_INIT(chase_message_list);
1062 ISC_LIST_INIT(chase_message_list2);
1063 dns_name_init(&chase_name, NULL);
1064 #if DIG_SIGCHASE_TD
1065 dns_name_init(&chase_current_name, NULL);
1066 dns_name_init(&chase_authority_name, NULL);
1067 #endif
1068 #if DIG_SIGCHASE_BU
1069 dns_name_init(&chase_signame, NULL);
1070 #endif
1071
1072 #endif
1073
1074 }
1075
1076 static void
1077 clear_searchlist(void) {
1078 dig_searchlist_t *search;
1079 while ((search = ISC_LIST_HEAD(search_list)) != NULL) {
1080 ISC_LIST_UNLINK(search_list, search, link);
1081 isc_mem_free(mctx, search);
1082 }
1083 }
1084
1085 /*%
1086 * Override the search list derived from resolv.conf by 'domain'.
1087 */
1088 void
1089 set_search_domain(char *domain) {
1090 dig_searchlist_t *search;
1091
1092 clear_searchlist();
1093 search = make_searchlist_entry(domain);
1094 ISC_LIST_APPEND(search_list, search, link);
1095 }
1096
1097 /*%
1098 * Setup the ISC and DNS libraries for use by the system.
1099 */
1100 void
1101 setup_libs(void) {
1102 isc_result_t result;
1103
1104 debug("setup_libs()");
1105
1106 result = isc_net_probeipv4();
1107 if (result == ISC_R_SUCCESS)
1108 have_ipv4 = ISC_TRUE;
1109
1110 result = isc_net_probeipv6();
1111 if (result == ISC_R_SUCCESS)
1112 have_ipv6 = ISC_TRUE;
1113 if (!have_ipv6 && !have_ipv4)
1114 fatal("can't find either v4 or v6 networking");
1115
1116 result = isc_mem_create(0, 0, &mctx);
1117 check_result(result, "isc_mem_create");
1118
1119 result = isc_taskmgr_create(mctx, 1, 0, &taskmgr);
1120 check_result(result, "isc_taskmgr_create");
1121
1122 result = isc_task_create(taskmgr, 0, &global_task);
1123 check_result(result, "isc_task_create");
1124
1125 result = isc_timermgr_create(mctx, &timermgr);
1126 check_result(result, "isc_timermgr_create");
1127
1128 result = isc_socketmgr_create(mctx, &socketmgr);
1129 check_result(result, "isc_socketmgr_create");
1130
1131 result = isc_entropy_create(mctx, &entp);
1132 check_result(result, "isc_entropy_create");
1133
1134 result = dst_lib_init(mctx, entp, 0);
1135 check_result(result, "dst_lib_init");
1136 is_dst_up = ISC_TRUE;
1137
1138 result = isc_mempool_create(mctx, COMMSIZE, &commctx);
1139 check_result(result, "isc_mempool_create");
1140 isc_mempool_setname(commctx, "COMMPOOL");
1141 /*
1142 * 6 and 2 set as reasonable parameters for 3 or 4 nameserver
1143 * systems.
1144 */
1145 isc_mempool_setfreemax(commctx, 6);
1146 isc_mempool_setfillcount(commctx, 2);
1147
1148 result = isc_mutex_init(&lookup_lock);
1149 check_result(result, "isc_mutex_init");
1150
1151 dns_result_register();
1152 }
1153
1154 /*%
1155 * Add EDNS0 option record to a message. Currently, the only supported
1156 * options are UDP buffer size and the DO bit.
1157 */
1158 static void
1159 add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns,
1160 isc_boolean_t dnssec)
1161 {
1162 dns_rdataset_t *rdataset = NULL;
1163 dns_rdatalist_t *rdatalist = NULL;
1164 dns_rdata_t *rdata = NULL;
1165 isc_result_t result;
1166
1167 debug("add_opt()");
1168 result = dns_message_gettemprdataset(msg, &rdataset);
1169 check_result(result, "dns_message_gettemprdataset");
1170 dns_rdataset_init(rdataset);
1171 result = dns_message_gettemprdatalist(msg, &rdatalist);
1172 check_result(result, "dns_message_gettemprdatalist");
1173 result = dns_message_gettemprdata(msg, &rdata);
1174 check_result(result, "dns_message_gettemprdata");
1175
1176 debug("setting udp size of %d", udpsize);
1177 rdatalist->type = dns_rdatatype_opt;
1178 rdatalist->covers = 0;
1179 rdatalist->rdclass = udpsize;
1180 rdatalist->ttl = edns << 16;
1181 if (dnssec)
1182 rdatalist->ttl |= DNS_MESSAGEEXTFLAG_DO;
1183 rdata->data = NULL;
1184 rdata->length = 0;
1185 ISC_LIST_INIT(rdatalist->rdata);
1186 ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
1187 dns_rdatalist_tordataset(rdatalist, rdataset);
1188 result = dns_message_setopt(msg, rdataset);
1189 check_result(result, "dns_message_setopt");
1190 }
1191
1192 /*%
1193 * Add a question section to a message, asking for the specified name,
1194 * type, and class.
1195 */
1196 static void
1197 add_question(dns_message_t *message, dns_name_t *name,
1198 dns_rdataclass_t rdclass, dns_rdatatype_t rdtype)
1199 {
1200 dns_rdataset_t *rdataset;
1201 isc_result_t result;
1202
1203 debug("add_question()");
1204 rdataset = NULL;
1205 result = dns_message_gettemprdataset(message, &rdataset);
1206 check_result(result, "dns_message_gettemprdataset()");
1207 dns_rdataset_init(rdataset);
1208 dns_rdataset_makequestion(rdataset, rdclass, rdtype);
1209 ISC_LIST_APPEND(name->list, rdataset, link);
1210 }
1211
1212 /*%
1213 * Check if we're done with all the queued lookups, which is true iff
1214 * all sockets, sends, and recvs are accounted for (counters == 0),
1215 * and the lookup list is empty.
1216 * If we are done, pass control back out to dighost_shutdown() (which is
1217 * part of dig.c, host.c, or nslookup.c) to either shutdown the system as
1218 * a whole or reseed the lookup list.
1219 */
1220 static void
1221 check_if_done(void) {
1222 debug("check_if_done()");
1223 debug("list %s", ISC_LIST_EMPTY(lookup_list) ? "empty" : "full");
1224 if (ISC_LIST_EMPTY(lookup_list) && current_lookup == NULL &&
1225 sendcount == 0) {
1226 INSIST(sockcount == 0);
1227 INSIST(recvcount == 0);
1228 debug("shutting down");
1229 dighost_shutdown();
1230 }
1231 }
1232
1233 /*%
1234 * Clear out a query when we're done with it. WARNING: This routine
1235 * WILL invalidate the query pointer.
1236 */
1237 static void
1238 clear_query(dig_query_t *query) {
1239 dig_lookup_t *lookup;
1240
1241 REQUIRE(query != NULL);
1242
1243 debug("clear_query(%p)", query);
1244
1245 lookup = query->lookup;
1246
1247 if (lookup->current_query == query)
1248 lookup->current_query = NULL;
1249
1250 ISC_LIST_UNLINK(lookup->q, query, link);
1251 if (ISC_LINK_LINKED(&query->recvbuf, link))
1252 ISC_LIST_DEQUEUE(query->recvlist, &query->recvbuf,
1253 link);
1254 if (ISC_LINK_LINKED(&query->lengthbuf, link))
1255 ISC_LIST_DEQUEUE(query->lengthlist, &query->lengthbuf,
1256 link);
1257 INSIST(query->recvspace != NULL);
1258 if (query->sock != NULL) {
1259 isc_socket_detach(&query->sock);
1260 sockcount--;
1261 debug("sockcount=%d", sockcount);
1262 }
1263 isc_mempool_put(commctx, query->recvspace);
1264 isc_buffer_invalidate(&query->recvbuf);
1265 isc_buffer_invalidate(&query->lengthbuf);
1266 if (query->waiting_senddone)
1267 query->pending_free = ISC_TRUE;
1268 else
1269 isc_mem_free(mctx, query);
1270 }
1271
1272 /*%
1273 * Try and clear out a lookup if we're done with it. Return ISC_TRUE if
1274 * the lookup was successfully cleared. If ISC_TRUE is returned, the
1275 * lookup pointer has been invalidated.
1276 */
1277 static isc_boolean_t
1278 try_clear_lookup(dig_lookup_t *lookup) {
1279 dig_query_t *q;
1280
1281 REQUIRE(lookup != NULL);
1282
1283 debug("try_clear_lookup(%p)", lookup);
1284
1285 if (ISC_LIST_HEAD(lookup->q) != NULL) {
1286 if (debugging) {
1287 q = ISC_LIST_HEAD(lookup->q);
1288 while (q != NULL) {
1289 debug("query to %s still pending", q->servname);
1290 q = ISC_LIST_NEXT(q, link);
1291 }
1292 }
1293 return (ISC_FALSE);
1294 }
1295
1296 /*
1297 * At this point, we know there are no queries on the lookup,
1298 * so can make it go away also.
1299 */
1300 destroy_lookup(lookup);
1301 return (ISC_TRUE);
1302 }
1303
1304 void
1305 destroy_lookup(dig_lookup_t *lookup) {
1306 dig_server_t *s;
1307 void *ptr;
1308
1309 debug("destroy");
1310 s = ISC_LIST_HEAD(lookup->my_server_list);
1311 while (s != NULL) {
1312 debug("freeing server %p belonging to %p", s, lookup);
1313 ptr = s;
1314 s = ISC_LIST_NEXT(s, link);
1315 ISC_LIST_DEQUEUE(lookup->my_server_list,
1316 (dig_server_t *)ptr, link);
1317 isc_mem_free(mctx, ptr);
1318 }
1319 if (lookup->sendmsg != NULL)
1320 dns_message_destroy(&lookup->sendmsg);
1321 if (lookup->querysig != NULL) {
1322 debug("freeing buffer %p", lookup->querysig);
1323 isc_buffer_free(&lookup->querysig);
1324 }
1325 if (lookup->timer != NULL)
1326 isc_timer_detach(&lookup->timer);
1327 if (lookup->sendspace != NULL)
1328 isc_mempool_put(commctx, lookup->sendspace);
1329
1330 if (lookup->tsigctx != NULL)
1331 dst_context_destroy(&lookup->tsigctx);
1332
1333 isc_mem_free(mctx, lookup);
1334 }
1335
1336 /*%
1337 * If we can, start the next lookup in the queue running.
1338 * This assumes that the lookup on the head of the queue hasn't been
1339 * started yet. It also removes the lookup from the head of the queue,
1340 * setting the current_lookup pointer pointing to it.
1341 */
1342 void
1343 start_lookup(void) {
1344 debug("start_lookup()");
1345 if (cancel_now)
1346 return;
1347
1348 /*
1349 * If there's a current lookup running, we really shouldn't get
1350 * here.
1351 */
1352 INSIST(current_lookup == NULL);
1353
1354 current_lookup = ISC_LIST_HEAD(lookup_list);
1355 /*
1356 * Put the current lookup somewhere so cancel_all can find it
1357 */
1358 if (current_lookup != NULL) {
1359 ISC_LIST_DEQUEUE(lookup_list, current_lookup, link);
1360 #if DIG_SIGCHASE_TD
1361 if (current_lookup->do_topdown &&
1362 !current_lookup->rdtype_sigchaseset) {
1363 dst_key_t *trustedkey = NULL;
1364 isc_buffer_t *b = NULL;
1365 isc_region_t r;
1366 isc_result_t result;
1367 dns_name_t query_name;
1368 dns_name_t *key_name;
1369 int i;
1370
1371 result = get_trusted_key(mctx);
1372 if (result != ISC_R_SUCCESS) {
1373 printf("\n;; No trusted key, "
1374 "+sigchase option is disabled\n");
1375 current_lookup->sigchase = ISC_FALSE;
1376 goto novalidation;
1377 }
1378 dns_name_init(&query_name, NULL);
1379 nameFromString(current_lookup->textname, &query_name);
1380
1381 for (i = 0; i < tk_list.nb_tk; i++) {
1382 key_name = dst_key_name(tk_list.key[i]);
1383
1384 if (dns_name_issubdomain(&query_name,
1385 key_name) == ISC_TRUE)
1386 trustedkey = tk_list.key[i];
1387 /*
1388 * Verifier que la temp est bien la plus basse
1389 * WARNING
1390 */
1391 }
1392 if (trustedkey == NULL) {
1393 printf("\n;; The queried zone: ");
1394 dns_name_print(&query_name, stdout);
1395 printf(" isn't a subdomain of any Trusted Keys"
1396 ": +sigchase option is disable\n");
1397 current_lookup->sigchase = ISC_FALSE;
1398 free_name(&query_name, mctx);
1399 goto novalidation;
1400 }
1401 free_name(&query_name, mctx);
1402
1403 current_lookup->rdtype_sigchase
1404 = current_lookup->rdtype;
1405 current_lookup->rdtype_sigchaseset
1406 = current_lookup->rdtypeset;
1407 current_lookup->rdtype = dns_rdatatype_ns;
1408
1409 current_lookup->qrdtype_sigchase
1410 = current_lookup->qrdtype;
1411 current_lookup->qrdtype = dns_rdatatype_ns;
1412
1413 current_lookup->rdclass_sigchase
1414 = current_lookup->rdclass;
1415 current_lookup->rdclass_sigchaseset
1416 = current_lookup->rdclassset;
1417 current_lookup->rdclass = dns_rdataclass_in;
1418
1419 strncpy(current_lookup->textnamesigchase,
1420 current_lookup->textname, MXNAME);
1421
1422 current_lookup->trace_root_sigchase = ISC_TRUE;
1423
1424 result = isc_buffer_allocate(mctx, &b, BUFSIZE);
1425 check_result(result, "isc_buffer_allocate");
1426 result = dns_name_totext(dst_key_name(trustedkey),
1427 ISC_FALSE, b);
1428 check_result(result, "dns_name_totext");
1429 isc_buffer_usedregion(b, &r);
1430 r.base[r.length] = '\0';
1431 strncpy(current_lookup->textname, (char*)r.base,
1432 MXNAME);
1433 isc_buffer_free(&b);
1434
1435 nameFromString(current_lookup->textnamesigchase,
1436 &chase_name);
1437
1438 dns_name_init(&chase_authority_name, NULL);
1439 }
1440 novalidation:
1441 #endif
1442 setup_lookup(current_lookup);
1443 do_lookup(current_lookup);
1444 } else {
1445 check_if_done();
1446 }
1447 }
1448
1449 /*%
1450 * If we can, clear the current lookup and start the next one running.
1451 * This calls try_clear_lookup, so may invalidate the lookup pointer.
1452 */
1453 static void
1454 check_next_lookup(dig_lookup_t *lookup) {
1455
1456 INSIST(!free_now);
1457
1458 debug("check_next_lookup(%p)", lookup);
1459
1460 if (ISC_LIST_HEAD(lookup->q) != NULL) {
1461 debug("still have a worker");
1462 return;
1463 }
1464 if (try_clear_lookup(lookup)) {
1465 current_lookup = NULL;
1466 start_lookup();
1467 }
1468 }
1469
1470 /*%
1471 * Create and queue a new lookup as a followup to the current lookup,
1472 * based on the supplied message and section. This is used in trace and
1473 * name server search modes to start a new lookup using servers from
1474 * NS records in a reply. Returns the number of followup lookups made.
1475 */
1476 static int
1477 followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
1478 {
1479 dig_lookup_t *lookup = NULL;
1480 dig_server_t *srv = NULL;
1481 dns_rdataset_t *rdataset = NULL;
1482 dns_rdata_t rdata = DNS_RDATA_INIT;
1483 dns_name_t *name = NULL;
1484 isc_result_t result;
1485 isc_boolean_t success = ISC_FALSE;
1486 int numLookups = 0;
1487 dns_name_t *domain;
1488 isc_boolean_t horizontal = ISC_FALSE, bad = ISC_FALSE;
1489
1490 INSIST(!free_now);
1491
1492 debug("following up %s", query->lookup->textname);
1493
1494 for (result = dns_message_firstname(msg, section);
1495 result == ISC_R_SUCCESS;
1496 result = dns_message_nextname(msg, section)) {
1497 name = NULL;
1498 dns_message_currentname(msg, section, &name);
1499
1500 if (section == DNS_SECTION_AUTHORITY) {
1501 rdataset = NULL;
1502 result = dns_message_findtype(name, dns_rdatatype_soa,
1503 0, &rdataset);
1504 if (result == ISC_R_SUCCESS)
1505 return (0);
1506 }
1507 rdataset = NULL;
1508 result = dns_message_findtype(name, dns_rdatatype_ns, 0,
1509 &rdataset);
1510 if (result != ISC_R_SUCCESS)
1511 continue;
1512
1513 debug("found NS set");
1514
1515 if (query->lookup->trace && !query->lookup->trace_root) {
1516 dns_namereln_t namereln;
1517 unsigned int nlabels;
1518 int order;
1519
1520 domain = dns_fixedname_name(&query->lookup->fdomain);
1521 namereln = dns_name_fullcompare(name, domain,
1522 &order, &nlabels);
1523 if (namereln == dns_namereln_equal) {
1524 if (!horizontal)
1525 printf(";; BAD (HORIZONTAL) REFERRAL\n");
1526 horizontal = ISC_TRUE;
1527 } else if (namereln != dns_namereln_subdomain) {
1528 if (!bad)
1529 printf(";; BAD REFERRAL\n");
1530 bad = ISC_TRUE;
1531 continue;
1532 }
1533 }
1534
1535 for (result = dns_rdataset_first(rdataset);
1536 result == ISC_R_SUCCESS;
1537 result = dns_rdataset_next(rdataset)) {
1538 char namestr[DNS_NAME_FORMATSIZE];
1539 dns_rdata_ns_t ns;
1540
1541 if (query->lookup->trace_root &&
1542 query->lookup->nsfound >= MXSERV)
1543 break;
1544
1545 dns_rdataset_current(rdataset, &rdata);
1546
1547 query->lookup->nsfound++;
1548 (void)dns_rdata_tostruct(&rdata, &ns, NULL);
1549 dns_name_format(&ns.name, namestr, sizeof(namestr));
1550 dns_rdata_freestruct(&ns);
1551
1552 /* Initialize lookup if we've not yet */
1553 debug("found NS %d %s", numLookups, namestr);
1554 numLookups++;
1555 if (!success) {
1556 success = ISC_TRUE;
1557 lookup_counter++;
1558 lookup = requeue_lookup(query->lookup,
1559 ISC_FALSE);
1560 cancel_lookup(query->lookup);
1561 lookup->doing_xfr = ISC_FALSE;
1562 if (!lookup->trace_root &&
1563 section == DNS_SECTION_ANSWER)
1564 lookup->trace = ISC_FALSE;
1565 else
1566 lookup->trace = query->lookup->trace;
1567 lookup->ns_search_only =
1568 query->lookup->ns_search_only;
1569 lookup->trace_root = ISC_FALSE;
1570 if (lookup->ns_search_only)
1571 lookup->recurse = ISC_FALSE;
1572 dns_fixedname_init(&lookup->fdomain);
1573 domain = dns_fixedname_name(&lookup->fdomain);
1574 dns_name_copy(name, domain, NULL);
1575 }
1576 srv = make_server(namestr, namestr);
1577 debug("adding server %s", srv->servername);
1578 ISC_LIST_APPEND(lookup->my_server_list, srv, link);
1579 dns_rdata_reset(&rdata);
1580 }
1581 }
1582
1583 if (lookup == NULL &&
1584 section == DNS_SECTION_ANSWER &&
1585 (query->lookup->trace || query->lookup->ns_search_only))
1586 return (followup_lookup(msg, query, DNS_SECTION_AUTHORITY));
1587
1588 /*
1589 * Randomize the order the nameserver will be tried.
1590 */
1591 if (numLookups > 1) {
1592 isc_uint32_t i, j;
1593 dig_serverlist_t my_server_list;
1594
1595 ISC_LIST_INIT(my_server_list);
1596
1597 for (i = numLookups; i > 0; i--) {
1598 isc_random_get(&j);
1599 j %= i;
1600 srv = ISC_LIST_HEAD(lookup->my_server_list);
1601 while (j-- > 0)
1602 srv = ISC_LIST_NEXT(srv, link);
1603 ISC_LIST_DEQUEUE(lookup->my_server_list, srv, link);
1604 ISC_LIST_APPEND(my_server_list, srv, link);
1605 }
1606 ISC_LIST_APPENDLIST(lookup->my_server_list,
1607 my_server_list, link);
1608 }
1609
1610 return (numLookups);
1611 }
1612
1613 /*%
1614 * Create and queue a new lookup using the next origin from the search
1615 * list, read in setup_system().
1616 *
1617 * Return ISC_TRUE iff there was another searchlist entry.
1618 */
1619 static isc_boolean_t
1620 next_origin(dns_message_t *msg, dig_query_t *query) {
1621 dig_lookup_t *lookup;
1622 dig_searchlist_t *search;
1623
1624 UNUSED(msg);
1625
1626 INSIST(!free_now);
1627
1628 debug("next_origin()");
1629 debug("following up %s", query->lookup->textname);
1630
1631 if (!usesearch)
1632 /*
1633 * We're not using a search list, so don't even think
1634 * about finding the next entry.
1635 */
1636 return (ISC_FALSE);
1637 if (query->lookup->origin == NULL && !query->lookup->need_search)
1638 /*
1639 * Then we just did rootorg; there's nothing left.
1640 */
1641 return (ISC_FALSE);
1642 if (query->lookup->origin == NULL && query->lookup->need_search) {
1643 lookup = requeue_lookup(query->lookup, ISC_TRUE);
1644 lookup->origin = ISC_LIST_HEAD(search_list);
1645 lookup->need_search = ISC_FALSE;
1646 } else {
1647 search = ISC_LIST_NEXT(query->lookup->origin, link);
1648 if (search == NULL && query->lookup->done_as_is)
1649 return (ISC_FALSE);
1650 lookup = requeue_lookup(query->lookup, ISC_TRUE);
1651 lookup->origin = search;
1652 }
1653 cancel_lookup(query->lookup);
1654 return (ISC_TRUE);
1655 }
1656
1657 /*%
1658 * Insert an SOA record into the sendmessage in a lookup. Used for
1659 * creating IXFR queries.
1660 */
1661 static void
1662 insert_soa(dig_lookup_t *lookup) {
1663 isc_result_t result;
1664 dns_rdata_soa_t soa;
1665 dns_rdata_t *rdata = NULL;
1666 dns_rdatalist_t *rdatalist = NULL;
1667 dns_rdataset_t *rdataset = NULL;
1668 dns_name_t *soaname = NULL;
1669
1670 debug("insert_soa()");
1671 soa.mctx = mctx;
1672 soa.serial = lookup->ixfr_serial;
1673 soa.refresh = 0;
1674 soa.retry = 0;
1675 soa.expire = 0;
1676 soa.minimum = 0;
1677 soa.common.rdclass = lookup->rdclass;
1678 soa.common.rdtype = dns_rdatatype_soa;
1679
1680 dns_name_init(&soa.origin, NULL);
1681 dns_name_init(&soa.contact, NULL);
1682
1683 dns_name_clone(dns_rootname, &soa.origin);
1684 dns_name_clone(dns_rootname, &soa.contact);
1685
1686 isc_buffer_init(&lookup->rdatabuf, lookup->rdatastore,
1687 sizeof(lookup->rdatastore));
1688
1689 result = dns_message_gettemprdata(lookup->sendmsg, &rdata);
1690 check_result(result, "dns_message_gettemprdata");
1691
1692 result = dns_rdata_fromstruct(rdata, lookup->rdclass,
1693 dns_rdatatype_soa, &soa,
1694 &lookup->rdatabuf);
1695 check_result(result, "isc_rdata_fromstruct");
1696
1697 result = dns_message_gettemprdatalist(lookup->sendmsg, &rdatalist);
1698 check_result(result, "dns_message_gettemprdatalist");
1699
1700 result = dns_message_gettemprdataset(lookup->sendmsg, &rdataset);
1701 check_result(result, "dns_message_gettemprdataset");
1702
1703 dns_rdatalist_init(rdatalist);
1704 rdatalist->type = dns_rdatatype_soa;
1705 rdatalist->rdclass = lookup->rdclass;
1706 rdatalist->covers = 0;
1707 rdatalist->ttl = 0;
1708 ISC_LIST_INIT(rdatalist->rdata);
1709 ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
1710
1711 dns_rdataset_init(rdataset);
1712 dns_rdatalist_tordataset(rdatalist, rdataset);
1713
1714 result = dns_message_gettempname(lookup->sendmsg, &soaname);
1715 check_result(result, "dns_message_gettempname");
1716 dns_name_init(soaname, NULL);
1717 dns_name_clone(lookup->name, soaname);
1718 ISC_LIST_INIT(soaname->list);
1719 ISC_LIST_APPEND(soaname->list, rdataset, link);
1720 dns_message_addname(lookup->sendmsg, soaname, DNS_SECTION_AUTHORITY);
1721 }
1722
1723 /*%
1724 * Setup the supplied lookup structure, making it ready to start sending
1725 * queries to servers. Create and initialize the message to be sent as
1726 * well as the query structures and buffer space for the replies. If the
1727 * server list is empty, clone it from the system default list.
1728 */
1729 void
1730 setup_lookup(dig_lookup_t *lookup) {
1731 isc_result_t result;
1732 isc_uint32_t id;
1733 int len;
1734 dig_server_t *serv;
1735 dig_query_t *query;
1736 isc_buffer_t b;
1737 dns_compress_t cctx;
1738 char store[MXNAME];
1739 #ifdef WITH_IDN
1740 idn_result_t mr;
1741 char utf8_textname[MXNAME], utf8_origin[MXNAME], idn_textname[MXNAME];
1742 #endif
1743
1744 #ifdef WITH_IDN
1745 result = dns_name_settotextfilter(output_filter);
1746 check_result(result, "dns_name_settotextfilter");
1747 #endif
1748
1749 REQUIRE(lookup != NULL);
1750 INSIST(!free_now);
1751
1752 debug("setup_lookup(%p)", lookup);
1753
1754 result = dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER,
1755 &lookup->sendmsg);
1756 check_result(result, "dns_message_create");
1757
1758 if (lookup->new_search) {
1759 debug("resetting lookup counter.");
1760 lookup_counter = 0;
1761 }
1762
1763 if (ISC_LIST_EMPTY(lookup->my_server_list)) {
1764 debug("cloning server list");
1765 clone_server_list(server_list, &lookup->my_server_list);
1766 }
1767 result = dns_message_gettempname(lookup->sendmsg, &lookup->name);
1768 check_result(result, "dns_message_gettempname");
1769 dns_name_init(lookup->name, NULL);
1770
1771 isc_buffer_init(&lookup->namebuf, lookup->namespace,
1772 sizeof(lookup->namespace));
1773 isc_buffer_init(&lookup->onamebuf, lookup->onamespace,
1774 sizeof(lookup->onamespace));
1775
1776 #ifdef WITH_IDN
1777 /*
1778 * We cannot convert `textname' and `origin' separately.
1779 * `textname' doesn't contain TLD, but local mapping needs
1780 * TLD.
1781 */
1782 mr = idn_encodename(IDN_LOCALCONV | IDN_DELIMMAP, lookup->textname,
1783 utf8_textname, sizeof(utf8_textname));
1784 idn_check_result(mr, "convert textname to UTF-8");
1785 #endif
1786
1787 /*
1788 * If the name has too many dots, force the origin to be NULL
1789 * (which produces an absolute lookup). Otherwise, take the origin
1790 * we have if there's one in the struct already. If it's NULL,
1791 * take the first entry in the searchlist iff either usesearch
1792 * is TRUE or we got a domain line in the resolv.conf file.
1793 */
1794 if (lookup->new_search) {
1795 #ifdef WITH_IDN
1796 if ((count_dots(utf8_textname) >= ndots) || !usesearch) {
1797 lookup->origin = NULL; /* Force abs lookup */
1798 lookup->done_as_is = ISC_TRUE;
1799 lookup->need_search = usesearch;
1800 } else if (lookup->origin == NULL && usesearch) {
1801 lookup->origin = ISC_LIST_HEAD(search_list);
1802 lookup->need_search = ISC_FALSE;
1803 }
1804 #else
1805 if ((count_dots(lookup->textname) >= ndots) || !usesearch) {
1806 lookup->origin = NULL; /* Force abs lookup */
1807 lookup->done_as_is = ISC_TRUE;
1808 lookup->need_search = usesearch;
1809 } else if (lookup->origin == NULL && usesearch) {
1810 lookup->origin = ISC_LIST_HEAD(search_list);
1811 lookup->need_search = ISC_FALSE;
1812 }
1813 #endif
1814 }
1815
1816 #ifdef WITH_IDN
1817 if (lookup->origin != NULL) {
1818 mr = idn_encodename(IDN_LOCALCONV | IDN_DELIMMAP,
1819 lookup->origin->origin, utf8_origin,
1820 sizeof(utf8_origin));
1821 idn_check_result(mr, "convert origin to UTF-8");
1822 mr = append_textname(utf8_textname, utf8_origin,
1823 sizeof(utf8_textname));
1824 idn_check_result(mr, "append origin to textname");
1825 }
1826 mr = idn_encodename(idnoptions | IDN_LOCALMAP | IDN_NAMEPREP |
1827 IDN_IDNCONV | IDN_LENCHECK, utf8_textname,
1828 idn_textname, sizeof(idn_textname));
1829 idn_check_result(mr, "convert UTF-8 textname to IDN encoding");
1830 #else
1831 if (lookup->origin != NULL) {
1832 debug("trying origin %s", lookup->origin->origin);
1833 result = dns_message_gettempname(lookup->sendmsg,
1834 &lookup->oname);
1835 check_result(result, "dns_message_gettempname");
1836 dns_name_init(lookup->oname, NULL);
1837 /* XXX Helper funct to conv char* to name? */
1838 len = strlen(lookup->origin->origin);
1839 isc_buffer_init(&b, lookup->origin->origin, len);
1840 isc_buffer_add(&b, len);
1841 result = dns_name_fromtext(lookup->oname, &b, dns_rootname,
1842 ISC_FALSE, &lookup->onamebuf);
1843 if (result != ISC_R_SUCCESS) {
1844 dns_message_puttempname(lookup->sendmsg,
1845 &lookup->name);
1846 dns_message_puttempname(lookup->sendmsg,
1847 &lookup->oname);
1848 fatal("'%s' is not in legal name syntax (%s)",
1849 lookup->origin->origin,
1850 isc_result_totext(result));
1851 }
1852 if (lookup->trace && lookup->trace_root) {
1853 dns_name_clone(dns_rootname, lookup->name);
1854 } else {
1855 len = strlen(lookup->textname);
1856 isc_buffer_init(&b, lookup->textname, len);
1857 isc_buffer_add(&b, len);
1858 result = dns_name_fromtext(lookup->name, &b,
1859 lookup->oname, ISC_FALSE,
1860 &lookup->namebuf);
1861 }
1862 if (result != ISC_R_SUCCESS) {
1863 dns_message_puttempname(lookup->sendmsg,
1864 &lookup->name);
1865 dns_message_puttempname(lookup->sendmsg,
1866 &lookup->oname);
1867 fatal("'%s' is not in legal name syntax (%s)",
1868 lookup->textname, isc_result_totext(result));
1869 }
1870 dns_message_puttempname(lookup->sendmsg, &lookup->oname);
1871 } else
1872 #endif
1873 {
1874 debug("using root origin");
1875 if (lookup->trace && lookup->trace_root)
1876 dns_name_clone(dns_rootname, lookup->name);
1877 else {
1878 #ifdef WITH_IDN
1879 len = strlen(idn_textname);
1880 isc_buffer_init(&b, idn_textname, len);
1881 isc_buffer_add(&b, len);
1882 result = dns_name_fromtext(lookup->name, &b,
1883 dns_rootname,
1884 ISC_FALSE,
1885 &lookup->namebuf);
1886 #else
1887 len = strlen(lookup->textname);
1888 isc_buffer_init(&b, lookup->textname, len);
1889 isc_buffer_add(&b, len);
1890 result = dns_name_fromtext(lookup->name, &b,
1891 dns_rootname,
1892 ISC_FALSE,
1893 &lookup->namebuf);
1894 #endif
1895 }
1896 if (result != ISC_R_SUCCESS) {
1897 dns_message_puttempname(lookup->sendmsg,
1898 &lookup->name);
1899 isc_buffer_init(&b, store, MXNAME);
1900 fatal("'%s' is not a legal name "
1901 "(%s)", lookup->textname,
1902 isc_result_totext(result));
1903 }
1904 }
1905 dns_name_format(lookup->name, store, sizeof(store));
1906 trying(store, lookup);
1907 INSIST(dns_name_isabsolute(lookup->name));
1908
1909 isc_random_get(&id);
1910 lookup->sendmsg->id = (unsigned short)id & 0xFFFF;
1911 lookup->sendmsg->opcode = dns_opcode_query;
1912 lookup->msgcounter = 0;
1913 /*
1914 * If this is a trace request, completely disallow recursion, since
1915 * it's meaningless for traces.
1916 */
1917 if (lookup->trace || (lookup->ns_search_only && !lookup->trace_root))
1918 lookup->recurse = ISC_FALSE;
1919
1920 if (lookup->recurse &&
1921 lookup->rdtype != dns_rdatatype_axfr &&
1922 lookup->rdtype != dns_rdatatype_ixfr) {
1923 debug("recursive query");
1924 lookup->sendmsg->flags |= DNS_MESSAGEFLAG_RD;
1925 }
1926
1927 /* XXX aaflag */
1928 if (lookup->aaonly) {
1929 debug("AA query");
1930 lookup->sendmsg->flags |= DNS_MESSAGEFLAG_AA;
1931 }
1932
1933 if (lookup->adflag) {
1934 debug("AD query");
1935 lookup->sendmsg->flags |= DNS_MESSAGEFLAG_AD;
1936 }
1937
1938 if (lookup->cdflag) {
1939 debug("CD query");
1940 lookup->sendmsg->flags |= DNS_MESSAGEFLAG_CD;
1941 }
1942
1943 dns_message_addname(lookup->sendmsg, lookup->name,
1944 DNS_SECTION_QUESTION);
1945
1946 if (lookup->trace && lookup->trace_root) {
1947 lookup->qrdtype = lookup->rdtype;
1948 lookup->rdtype = dns_rdatatype_ns;
1949 }
1950
1951 if ((lookup->rdtype == dns_rdatatype_axfr) ||
1952 (lookup->rdtype == dns_rdatatype_ixfr)) {
1953 lookup->doing_xfr = ISC_TRUE;
1954 /*
1955 * Force TCP mode if we're doing an xfr.
1956 * XXX UDP ixfr's would be useful
1957 */
1958 lookup->tcp_mode = ISC_TRUE;
1959 }
1960
1961 add_question(lookup->sendmsg, lookup->name, lookup->rdclass,
1962 lookup->rdtype);
1963
1964 /* add_soa */
1965 if (lookup->rdtype == dns_rdatatype_ixfr)
1966 insert_soa(lookup);
1967
1968 /* XXX Insist this? */
1969 lookup->tsigctx = NULL;
1970 lookup->querysig = NULL;
1971 if (key != NULL) {
1972 debug("initializing keys");
1973 result = dns_message_settsigkey(lookup->sendmsg, key);
1974 check_result(result, "dns_message_settsigkey");
1975 }
1976
1977 lookup->sendspace = isc_mempool_get(commctx);
1978 if (lookup->sendspace == NULL)
1979 fatal("memory allocation failure");
1980
1981 result = dns_compress_init(&cctx, -1, mctx);
1982 check_result(result, "dns_compress_init");
1983
1984 debug("starting to render the message");
1985 isc_buffer_init(&lookup->renderbuf, lookup->sendspace, COMMSIZE);
1986 result = dns_message_renderbegin(lookup->sendmsg, &cctx,
1987 &lookup->renderbuf);
1988 check_result(result, "dns_message_renderbegin");
1989 if (lookup->udpsize > 0 || lookup->dnssec || lookup->edns > -1) {
1990 if (lookup->udpsize == 0)
1991 lookup->udpsize = 4096;
1992 if (lookup->edns < 0)
1993 lookup->edns = 0;
1994 add_opt(lookup->sendmsg, lookup->udpsize,
1995 lookup->edns, lookup->dnssec);
1996 }
1997
1998 result = dns_message_rendersection(lookup->sendmsg,
1999 DNS_SECTION_QUESTION, 0);
2000 check_result(result, "dns_message_rendersection");
2001 result = dns_message_rendersection(lookup->sendmsg,
2002 DNS_SECTION_AUTHORITY, 0);
2003 check_result(result, "dns_message_rendersection");
2004 result = dns_message_renderend(lookup->sendmsg);
2005 check_result(result, "dns_message_renderend");
2006 debug("done rendering");
2007
2008 dns_compress_invalidate(&cctx);
2009
2010 /*
2011 * Force TCP mode if the request is larger than 512 bytes.
2012 */
2013 if (isc_buffer_usedlength(&lookup->renderbuf) > 512)
2014 lookup->tcp_mode = ISC_TRUE;
2015
2016 lookup->pending = ISC_FALSE;
2017
2018 for (serv = ISC_LIST_HEAD(lookup->my_server_list);
2019 serv != NULL;
2020 serv = ISC_LIST_NEXT(serv, link)) {
2021 query = isc_mem_allocate(mctx, sizeof(dig_query_t));
2022 if (query == NULL)
2023 fatal("memory allocation failure in %s:%d",
2024 __FILE__, __LINE__);
2025 debug("create query %p linked to lookup %p",
2026 query, lookup);
2027 query->lookup = lookup;
2028 query->waiting_connect = ISC_FALSE;
2029 query->waiting_senddone = ISC_FALSE;
2030 query->pending_free = ISC_FALSE;
2031 query->recv_made = ISC_FALSE;
2032 query->first_pass = ISC_TRUE;
2033 query->first_soa_rcvd = ISC_FALSE;
2034 query->second_rr_rcvd = ISC_FALSE;
2035 query->first_repeat_rcvd = ISC_FALSE;
2036 query->warn_id = ISC_TRUE;
2037 query->first_rr_serial = 0;
2038 query->second_rr_serial = 0;
2039 query->servname = serv->servername;
2040 query->userarg = serv->userarg;
2041 query->rr_count = 0;
2042 query->msg_count = 0;
2043 query->byte_count = 0;
2044 ISC_LINK_INIT(query, link);
2045 ISC_LIST_INIT(query->recvlist);
2046 ISC_LIST_INIT(query->lengthlist);
2047 query->sock = NULL;
2048 query->recvspace = isc_mempool_get(commctx);
2049 if (query->recvspace == NULL)
2050 fatal("memory allocation failure");
2051
2052 isc_buffer_init(&query->recvbuf, query->recvspace, COMMSIZE);
2053 isc_buffer_init(&query->lengthbuf, query->lengthspace, 2);
2054 isc_buffer_init(&query->slbuf, query->slspace, 2);
2055 query->sendbuf = lookup->renderbuf;
2056
2057 ISC_LINK_INIT(query, link);
2058 ISC_LIST_ENQUEUE(lookup->q, query, link);
2059 }
2060 /* XXX qrflag, print_query, etc... */
2061 if (!ISC_LIST_EMPTY(lookup->q) && qr) {
2062 extrabytes = 0;
2063 printmessage(ISC_LIST_HEAD(lookup->q), lookup->sendmsg,
2064 ISC_TRUE);
2065 }
2066 }
2067
2068 /*%
2069 * Event handler for send completion. Track send counter, and clear out
2070 * the query if the send was canceled.
2071 */
2072 static void
2073 send_done(isc_task_t *_task, isc_event_t *event) {
2074 isc_socketevent_t *sevent = (isc_socketevent_t *)event;
2075 isc_buffer_t *b = NULL;
2076 dig_query_t *query, *next;
2077 dig_lookup_t *l;
2078
2079 REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
2080
2081 UNUSED(_task);
2082
2083 LOCK_LOOKUP;
2084
2085 debug("send_done()");
2086 sendcount--;
2087 debug("sendcount=%d", sendcount);
2088 INSIST(sendcount >= 0);
2089
2090 for (b = ISC_LIST_HEAD(sevent->bufferlist);
2091 b != NULL;
2092 b = ISC_LIST_HEAD(sevent->bufferlist))
2093 ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
2094
2095 query = event->ev_arg;
2096 query->waiting_senddone = ISC_FALSE;
2097 l = query->lookup;
2098
2099 if (l->ns_search_only && !l->trace_root) {
2100 debug("sending next, since searching");
2101 next = ISC_LIST_NEXT(query, link);
2102 if (next != NULL)
2103 send_udp(next);
2104 }
2105
2106 isc_event_free(&event);
2107
2108 if (query->pending_free)
2109 isc_mem_free(mctx, query);
2110
2111 check_if_done();
2112 UNLOCK_LOOKUP;
2113 }
2114
2115 /*%
2116 * Cancel a lookup, sending isc_socket_cancel() requests to all outstanding
2117 * IO sockets. The cancel handlers should take care of cleaning up the
2118 * query and lookup structures
2119 */
2120 static void
2121 cancel_lookup(dig_lookup_t *lookup) {
2122 dig_query_t *query, *next;
2123
2124 debug("cancel_lookup()");
2125 query = ISC_LIST_HEAD(lookup->q);
2126 while (query != NULL) {
2127 next = ISC_LIST_NEXT(query, link);
2128 if (query->sock != NULL) {
2129 isc_socket_cancel(query->sock, global_task,
2130 ISC_SOCKCANCEL_ALL);
2131 check_if_done();
2132 } else {
2133 clear_query(query);
2134 }
2135 query = next;
2136 }
2137 if (lookup->timer != NULL)
2138 isc_timer_detach(&lookup->timer);
2139 lookup->pending = ISC_FALSE;
2140 lookup->retries = 0;
2141 }
2142
2143 static void
2144 bringup_timer(dig_query_t *query, unsigned int default_timeout) {
2145 dig_lookup_t *l;
2146 unsigned int local_timeout;
2147 isc_result_t result;
2148
2149 debug("bringup_timer()");
2150 /*
2151 * If the timer already exists, that means we're calling this
2152 * a second time (for a retry). Don't need to recreate it,
2153 * just reset it.
2154 */
2155 l = query->lookup;
2156 if (ISC_LIST_NEXT(query, link) != NULL)
2157 local_timeout = SERVER_TIMEOUT;
2158 else {
2159 if (timeout == 0)
2160 local_timeout = default_timeout;
2161 else
2162 local_timeout = timeout;
2163 }
2164 debug("have local timeout of %d", local_timeout);
2165 isc_interval_set(&l->interval, local_timeout, 0);
2166 if (l->timer != NULL)
2167 isc_timer_detach(&l->timer);
2168 result = isc_timer_create(timermgr, isc_timertype_once, NULL,
2169 &l->interval, global_task, connect_timeout,
2170 l, &l->timer);
2171 check_result(result, "isc_timer_create");
2172 }
2173
2174 static void
2175 connect_done(isc_task_t *task, isc_event_t *event);
2176
2177 /*%
2178 * Unlike send_udp, this can't be called multiple times with the same
2179 * query. When we retry TCP, we requeue the whole lookup, which should
2180 * start anew.
2181 */
2182 static void
2183 send_tcp_connect(dig_query_t *query) {
2184 isc_result_t result;
2185 dig_query_t *next;
2186 dig_lookup_t *l;
2187
2188 debug("send_tcp_connect(%p)", query);
2189
2190 l = query->lookup;
2191 query->waiting_connect = ISC_TRUE;
2192 query->lookup->current_query = query;
2193 get_address(query->servname, port, &query->sockaddr);
2194
2195 if (specified_source &&
2196 (isc_sockaddr_pf(&query->sockaddr) !=
2197 isc_sockaddr_pf(&bind_address))) {
2198 printf(";; Skipping server %s, incompatible "
2199 "address family\n", query->servname);
2200 query->waiting_connect = ISC_FALSE;
2201 next = ISC_LIST_NEXT(query, link);
2202 l = query->lookup;
2203 clear_query(query);
2204 if (next == NULL) {
2205 printf(";; No acceptable nameservers\n");
2206 check_next_lookup(l);
2207 return;
2208 }
2209 send_tcp_connect(next);
2210 return;
2211 }
2212 INSIST(query->sock == NULL);
2213 result = isc_socket_create(socketmgr,
2214 isc_sockaddr_pf(&query->sockaddr),
2215 isc_sockettype_tcp, &query->sock);
2216 check_result(result, "isc_socket_create");
2217 sockcount++;
2218 debug("sockcount=%d", sockcount);
2219 if (specified_source)
2220 result = isc_socket_bind(query->sock, &bind_address,
2221 ISC_SOCKET_REUSEADDRESS);
2222 else {
2223 if ((isc_sockaddr_pf(&query->sockaddr) == AF_INET) &&
2224 have_ipv4)
2225 isc_sockaddr_any(&bind_any);
2226 else
2227 isc_sockaddr_any6(&bind_any);
2228 result = isc_socket_bind(query->sock, &bind_any, 0);
2229 }
2230 check_result(result, "isc_socket_bind");
2231 bringup_timer(query, TCP_TIMEOUT);
2232 result = isc_socket_connect(query->sock, &query->sockaddr,
2233 global_task, connect_done, query);
2234 check_result(result, "isc_socket_connect");
2235 /*
2236 * If we're at the endgame of a nameserver search, we need to
2237 * immediately bring up all the queries. Do it here.
2238 */
2239 if (l->ns_search_only && !l->trace_root) {
2240 debug("sending next, since searching");
2241 next = ISC_LIST_NEXT(query, link);
2242 if (next != NULL)
2243 send_tcp_connect(next);
2244 }
2245 }
2246
2247 /*%
2248 * Send a UDP packet to the remote nameserver, possible starting the
2249 * recv action as well. Also make sure that the timer is running and
2250 * is properly reset.
2251 */
2252 static void
2253 send_udp(dig_query_t *query) {
2254 dig_lookup_t *l = NULL;
2255 isc_result_t result;
2256
2257 debug("send_udp(%p)", query);
2258
2259 l = query->lookup;
2260 bringup_timer(query, UDP_TIMEOUT);
2261 l->current_query = query;
2262 debug("working on lookup %p, query %p", query->lookup, query);
2263 if (!query->recv_made) {
2264 /* XXX Check the sense of this, need assertion? */
2265 query->waiting_connect = ISC_FALSE;
2266 get_address(query->servname, port, &query->sockaddr);
2267
2268 result = isc_socket_create(socketmgr,
2269 isc_sockaddr_pf(&query->sockaddr),
2270 isc_sockettype_udp, &query->sock);
2271 check_result(result, "isc_socket_create");
2272 sockcount++;
2273 debug("sockcount=%d", sockcount);
2274 if (specified_source) {
2275 result = isc_socket_bind(query->sock, &bind_address,
2276 ISC_SOCKET_REUSEADDRESS);
2277 } else {
2278 isc_sockaddr_anyofpf(&bind_any,
2279 isc_sockaddr_pf(&query->sockaddr));
2280 result = isc_socket_bind(query->sock, &bind_any, 0);
2281 }
2282 check_result(result, "isc_socket_bind");
2283
2284 query->recv_made = ISC_TRUE;
2285 ISC_LINK_INIT(&query->recvbuf, link);
2286 ISC_LIST_ENQUEUE(query->recvlist, &query->recvbuf,
2287 link);
2288 debug("recving with lookup=%p, query=%p, sock=%p",
2289 query->lookup, query, query->sock);
2290 result = isc_socket_recvv(query->sock, &query->recvlist, 1,
2291 global_task, recv_done, query);
2292 check_result(result, "isc_socket_recvv");
2293 recvcount++;
2294 debug("recvcount=%d", recvcount);
2295 }
2296 ISC_LIST_INIT(query->sendlist);
2297 ISC_LIST_ENQUEUE(query->sendlist, &query->sendbuf, link);
2298 debug("sending a request");
2299 TIME_NOW(&query->time_sent);
2300 INSIST(query->sock != NULL);
2301 query->waiting_senddone = ISC_TRUE;
2302 result = isc_socket_sendtov(query->sock, &query->sendlist,
2303 global_task, send_done, query,
2304 &query->sockaddr, NULL);
2305 check_result(result, "isc_socket_sendtov");
2306 sendcount++;
2307 }
2308
2309 /*%
2310 * IO timeout handler, used for both connect and recv timeouts. If
2311 * retries are still allowed, either resend the UDP packet or queue a
2312 * new TCP lookup. Otherwise, cancel the lookup.
2313 */
2314 static void
2315 connect_timeout(isc_task_t *task, isc_event_t *event) {
2316 dig_lookup_t *l = NULL;
2317 dig_query_t *query = NULL, *cq;
2318
2319 UNUSED(task);
2320 REQUIRE(event->ev_type == ISC_TIMEREVENT_IDLE);
2321
2322 debug("connect_timeout()");
2323
2324 LOCK_LOOKUP;
2325 l = event->ev_arg;
2326 query = l->current_query;
2327 isc_event_free(&event);
2328
2329 INSIST(!free_now);
2330
2331 if ((query != NULL) && (query->lookup->current_query != NULL) &&
2332 (ISC_LIST_NEXT(query->lookup->current_query, link) != NULL)) {
2333 debug("trying next server...");
2334 cq = query->lookup->current_query;
2335 if (!l->tcp_mode)
2336 send_udp(ISC_LIST_NEXT(cq, link));
2337 else
2338 send_tcp_connect(ISC_LIST_NEXT(cq, link));
2339 UNLOCK_LOOKUP;
2340 return;
2341 }
2342
2343 if (l->retries > 1) {
2344 if (!l->tcp_mode) {
2345 l->retries--;
2346 debug("resending UDP request to first server");
2347 send_udp(ISC_LIST_HEAD(l->q));
2348 } else {
2349 debug("making new TCP request, %d tries left",
2350 l->retries);
2351 l->retries--;
2352 requeue_lookup(l, ISC_TRUE);
2353 cancel_lookup(l);
2354 check_next_lookup(l);
2355 }
2356 } else {
2357 fputs(l->cmdline, stdout);
2358 printf(";; connection timed out; no servers could be "
2359 "reached\n");
2360 cancel_lookup(l);
2361 check_next_lookup(l);
2362 if (exitcode < 9)
2363 exitcode = 9;
2364 }
2365 UNLOCK_LOOKUP;
2366 }
2367
2368 /*%
2369 * Event handler for the TCP recv which gets the length header of TCP
2370 * packets. Start the next recv of length bytes.
2371 */
2372 static void
2373 tcp_length_done(isc_task_t *task, isc_event_t *event) {
2374 isc_socketevent_t *sevent;
2375 isc_buffer_t *b = NULL;
2376 isc_result_t result;
2377 dig_query_t *query = NULL;
2378 dig_lookup_t *l;
2379 isc_uint16_t length;
2380
2381 REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE);
2382 INSIST(!free_now);
2383
2384 UNUSED(task);
2385
2386 debug("tcp_length_done()");
2387
2388 LOCK_LOOKUP;
2389 sevent = (isc_socketevent_t *)event;
2390 query = event->ev_arg;
2391
2392 recvcount--;
2393 INSIST(recvcount >= 0);
2394
2395 b = ISC_LIST_HEAD(sevent->bufferlist);
2396 INSIST(b == &query->lengthbuf);
2397 ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
2398
2399 if (sevent->result == ISC_R_CANCELED) {
2400 isc_event_free(&event);
2401 l = query->lookup;
2402 clear_query(query);
2403 check_next_lookup(l);
2404 UNLOCK_LOOKUP;
2405 return;
2406 }
2407 if (sevent->result != ISC_R_SUCCESS) {
2408 char sockstr[ISC_SOCKADDR_FORMATSIZE];
2409 isc_sockaddr_format(&query->sockaddr, sockstr,
2410 sizeof(sockstr));
2411 printf(";; communications error to %s: %s\n",
2412 sockstr, isc_result_totext(sevent->result));
2413 l = query->lookup;
2414 isc_socket_detach(&query->sock);
2415 sockcount--;
2416 debug("sockcount=%d", sockcount);
2417 INSIST(sockcount >= 0);
2418 isc_event_free(&event);
2419 clear_query(query);
2420 check_next_lookup(l);
2421 UNLOCK_LOOKUP;
2422 return;
2423 }
2424 length = isc_buffer_getuint16(b);
2425 if (length == 0) {
2426 isc_event_free(&event);
2427 launch_next_query(query, ISC_FALSE);
2428 UNLOCK_LOOKUP;
2429 return;
2430 }
2431
2432 /*
2433 * Even though the buffer was already init'ed, we need
2434 * to redo it now, to force the length we want.
2435 */
2436 isc_buffer_invalidate(&query->recvbuf);
2437 isc_buffer_init(&query->recvbuf, query->recvspace, length);
2438 ENSURE(ISC_LIST_EMPTY(query->recvlist));
2439 ISC_LINK_INIT(&query->recvbuf, link);
2440 ISC_LIST_ENQUEUE(query->recvlist, &query->recvbuf, link);
2441 debug("recving with lookup=%p, query=%p", query->lookup, query);
2442 result = isc_socket_recvv(query->sock, &query->recvlist, length, task,
2443 recv_done, query);
2444 check_result(result, "isc_socket_recvv");
2445 recvcount++;
2446 debug("resubmitted recv request with length %d, recvcount=%d",
2447 length, recvcount);
2448 isc_event_free(&event);
2449 UNLOCK_LOOKUP;
2450 }
2451
2452 /*%
2453 * For transfers that involve multiple recvs (XFR's in particular),
2454 * launch the next recv.
2455 */
2456 static void
2457 launch_next_query(dig_query_t *query, isc_boolean_t include_question) {
2458 isc_result_t result;
2459 dig_lookup_t *l;
2460
2461 INSIST(!free_now);
2462
2463 debug("launch_next_query()");
2464
2465 if (!query->lookup->pending) {
2466 debug("ignoring launch_next_query because !pending");
2467 isc_socket_detach(&query->sock);
2468 sockcount--;
2469 debug("sockcount=%d", sockcount);
2470 INSIST(sockcount >= 0);
2471 query->waiting_connect = ISC_FALSE;
2472 l = query->lookup;
2473 clear_query(query);
2474 check_next_lookup(l);
2475 return;
2476 }
2477
2478 isc_buffer_clear(&query->slbuf);
2479 isc_buffer_clear(&query->lengthbuf);
2480 isc_buffer_putuint16(&query->slbuf, (isc_uint16_t) query->sendbuf.used);
2481 ISC_LIST_INIT(query->sendlist);
2482 ISC_LINK_INIT(&query->slbuf, link);
2483 ISC_LIST_ENQUEUE(query->sendlist, &query->slbuf, link);
2484 if (include_question)
2485 ISC_LIST_ENQUEUE(query->sendlist, &query->sendbuf, link);
2486 ISC_LINK_INIT(&query->lengthbuf, link);
2487 ISC_LIST_ENQUEUE(query->lengthlist, &query->lengthbuf, link);
2488
2489 result = isc_socket_recvv(query->sock, &query->lengthlist, 0,
2490 global_task, tcp_length_done, query);
2491 check_result(result, "isc_socket_recvv");
2492 recvcount++;
2493 debug("recvcount=%d", recvcount);
2494 if (!query->first_soa_rcvd) {
2495 debug("sending a request in launch_next_query");
2496 TIME_NOW(&query->time_sent);
2497 query->waiting_senddone = ISC_TRUE;
2498 result = isc_socket_sendv(query->sock, &query->sendlist,
2499 global_task, send_done, query);
2500 check_result(result, "isc_socket_sendv");
2501 sendcount++;
2502 debug("sendcount=%d", sendcount);
2503 }
2504 query->waiting_connect = ISC_FALSE;
2505 #if 0
2506 check_next_lookup(query->lookup);
2507 #endif
2508 return;
2509 }
2510
2511 /*%
2512 * Event handler for TCP connect complete. Make sure the connection was
2513 * successful, then pass into launch_next_query to actually send the
2514 * question.
2515 */
2516 static void
2517 connect_done(isc_task_t *task, isc_event_t *event) {
2518 isc_socketevent_t *sevent = NULL;
2519 dig_query_t *query = NULL, *next;
2520 dig_lookup_t *l;
2521
2522 UNUSED(task);
2523
2524 REQUIRE(event->ev_type == ISC_SOCKEVENT_CONNECT);
2525 INSIST(!free_now);
2526
2527 debug("connect_done()");
2528
2529 LOCK_LOOKUP;
2530 sevent = (isc_socketevent_t *)event;
2531 query = sevent->ev_arg;
2532
2533 INSIST(query->waiting_connect);
2534
2535 query->waiting_connect = ISC_FALSE;
2536
2537 if (sevent->result == ISC_R_CANCELED) {
2538 debug("in cancel handler");
2539 isc_socket_detach(&query->sock);
2540 sockcount--;
2541 INSIST(sockcount >= 0);
2542 debug("sockcount=%d", sockcount);
2543 query->waiting_connect = ISC_FALSE;
2544 isc_event_free(&event);
2545 l = query->lookup;
2546 clear_query(query);
2547 check_next_lookup(l);
2548 UNLOCK_LOOKUP;
2549 return;
2550 }
2551 if (sevent->result != ISC_R_SUCCESS) {
2552 char sockstr[ISC_SOCKADDR_FORMATSIZE];
2553
2554 debug("unsuccessful connection: %s",
2555 isc_result_totext(sevent->result));
2556 isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
2557 if (sevent->result != ISC_R_CANCELED)
2558 printf(";; Connection to %s(%s) for %s failed: "
2559 "%s.\n", sockstr,
2560 query->servname, query->lookup->textname,
2561 isc_result_totext(sevent->result));
2562 isc_socket_detach(&query->sock);
2563 sockcount--;
2564 INSIST(sockcount >= 0);
2565 /* XXX Clean up exitcodes */
2566 if (exitcode < 9)
2567 exitcode = 9;
2568 debug("sockcount=%d", sockcount);
2569 query->waiting_connect = ISC_FALSE;
2570 isc_event_free(&event);
2571 l = query->lookup;
2572 if (l->current_query != NULL)
2573 next = ISC_LIST_NEXT(l->current_query, link);
2574 else
2575 next = NULL;
2576 clear_query(query);
2577 if (next != NULL) {
2578 bringup_timer(next, TCP_TIMEOUT);
2579 send_tcp_connect(next);
2580 } else {
2581 check_next_lookup(l);
2582 }
2583 UNLOCK_LOOKUP;
2584 return;
2585 }
2586 launch_next_query(query, ISC_TRUE);
2587 isc_event_free(&event);
2588 UNLOCK_LOOKUP;
2589 }
2590
2591 /*%
2592 * Check if the ongoing XFR needs more data before it's complete, using
2593 * the semantics of IXFR and AXFR protocols. Much of the complexity of
2594 * this routine comes from determining when an IXFR is complete.
2595 * ISC_FALSE means more data is on the way, and the recv has been issued.
2596 */
2597 static isc_boolean_t
2598 check_for_more_data(dig_query_t *query, dns_message_t *msg,
2599 isc_socketevent_t *sevent)
2600 {
2601 dns_rdataset_t *rdataset = NULL;
2602 dns_rdata_t rdata = DNS_RDATA_INIT;
2603 dns_rdata_soa_t soa;
2604 isc_uint32_t serial;
2605 isc_result_t result;
2606
2607 debug("check_for_more_data()");
2608
2609 /*
2610 * By the time we're in this routine, we know we're doing
2611 * either an AXFR or IXFR. If there's no second_rr_type,
2612 * then we don't yet know which kind of answer we got back
2613 * from the server. Here, we're going to walk through the
2614 * rr's in the message, acting as necessary whenever we hit
2615 * an SOA rr.
2616 */
2617
2618 query->msg_count++;
2619 query->byte_count += sevent->n;
2620 result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
2621 if (result != ISC_R_SUCCESS) {
2622 puts("; Transfer failed.");
2623 return (ISC_TRUE);
2624 }
2625 do {
2626 dns_name_t *name;
2627 name = NULL;
2628 dns_message_currentname(msg, DNS_SECTION_ANSWER,
2629 &name);
2630 for (rdataset = ISC_LIST_HEAD(name->list);
2631 rdataset != NULL;
2632 rdataset = ISC_LIST_NEXT(rdataset, link)) {
2633 result = dns_rdataset_first(rdataset);
2634 if (result != ISC_R_SUCCESS)
2635 continue;
2636 do {
2637 query->rr_count++;
2638 dns_rdata_reset(&rdata);
2639 dns_rdataset_current(rdataset, &rdata);
2640 /*
2641 * If this is the first rr, make sure
2642 * it's an SOA
2643 */
2644 if ((!query->first_soa_rcvd) &&
2645 (rdata.type != dns_rdatatype_soa)) {
2646 puts("; Transfer failed. "
2647 "Didn't start with SOA answer.");
2648 return (ISC_TRUE);
2649 }
2650 if ((!query->second_rr_rcvd) &&
2651 (rdata.type != dns_rdatatype_soa)) {
2652 query->second_rr_rcvd = ISC_TRUE;
2653 query->second_rr_serial = 0;
2654 debug("got the second rr as nonsoa");
2655 goto next_rdata;
2656 }
2657
2658 /*
2659 * If the record is anything except an SOA
2660 * now, just continue on...
2661 */
2662 if (rdata.type != dns_rdatatype_soa)
2663 goto next_rdata;
2664 /* Now we have an SOA. Work with it. */
2665 debug("got an SOA");
2666 (void)dns_rdata_tostruct(&rdata, &soa, NULL);
2667 serial = soa.serial;
2668 dns_rdata_freestruct(&soa);
2669 if (!query->first_soa_rcvd) {
2670 query->first_soa_rcvd = ISC_TRUE;
2671 query->first_rr_serial = serial;
2672 debug("this is the first %d",
2673 query->lookup->ixfr_serial);
2674 if (query->lookup->ixfr_serial >=
2675 serial)
2676 goto doexit;
2677 goto next_rdata;
2678 }
2679 if (query->lookup->rdtype ==
2680 dns_rdatatype_axfr) {
2681 debug("doing axfr, got second SOA");
2682 goto doexit;
2683 }
2684 if (!query->second_rr_rcvd) {
2685 if (query->first_rr_serial == serial) {
2686 debug("doing ixfr, got "
2687 "empty zone");
2688 goto doexit;
2689 }
2690 debug("this is the second %d",
2691 query->lookup->ixfr_serial);
2692 query->second_rr_rcvd = ISC_TRUE;
2693 query->second_rr_serial = serial;
2694 goto next_rdata;
2695 }
2696 if (query->second_rr_serial == 0) {
2697 /*
2698 * If the second RR was a non-SOA
2699 * record, and we're getting any
2700 * other SOA, then this is an
2701 * AXFR, and we're done.
2702 */
2703 debug("done, since axfr");
2704 goto doexit;
2705 }
2706 /*
2707 * If we get to this point, we're doing an
2708 * IXFR and have to start really looking
2709 * at serial numbers.
2710 */
2711 if (query->first_rr_serial == serial) {
2712 debug("got a match for ixfr");
2713 if (!query->first_repeat_rcvd) {
2714 query->first_repeat_rcvd =
2715 ISC_TRUE;
2716 goto next_rdata;
2717 }
2718 debug("done with ixfr");
2719 goto doexit;
2720 }
2721 debug("meaningless soa %d", serial);
2722 next_rdata:
2723 result = dns_rdataset_next(rdataset);
2724 } while (result == ISC_R_SUCCESS);
2725 }
2726 result = dns_message_nextname(msg, DNS_SECTION_ANSWER);
2727 } while (result == ISC_R_SUCCESS);
2728 launch_next_query(query, ISC_FALSE);
2729 return (ISC_FALSE);
2730 doexit:
2731 received(sevent->n, &sevent->address, query);
2732 return (ISC_TRUE);
2733 }
2734
2735 /*%
2736 * Event handler for recv complete. Perform whatever actions are necessary,
2737 * based on the specifics of the user's request.
2738 */
2739 static void
2740 recv_done(isc_task_t *task, isc_event_t *event) {
2741 isc_socketevent_t *sevent = NULL;
2742 dig_query_t *query = NULL;
2743 isc_buffer_t *b = NULL;
2744 dns_message_t *msg = NULL;
2745 #ifdef DIG_SIGCHASE
2746 dig_message_t *chase_msg = NULL;
2747 dig_message_t *chase_msg2 = NULL;
2748 #endif
2749 isc_result_t result;
2750 dig_lookup_t *n, *l;
2751 isc_boolean_t docancel = ISC_FALSE;
2752 isc_boolean_t match = ISC_TRUE;
2753 unsigned int parseflags;
2754 dns_messageid_t id;
2755 unsigned int msgflags;
2756 #ifdef DIG_SIGCHASE
2757 isc_result_t do_sigchase = ISC_FALSE;
2758
2759 dns_message_t *msg_temp = NULL;
2760 isc_region_t r;
2761 isc_buffer_t *buf = NULL;
2762 #endif
2763
2764 UNUSED(task);
2765 INSIST(!free_now);
2766
2767 debug("recv_done()");
2768
2769 LOCK_LOOKUP;
2770 recvcount--;
2771 debug("recvcount=%d", recvcount);
2772 INSIST(recvcount >= 0);
2773
2774 query = event->ev_arg;
2775 debug("lookup=%p, query=%p", query->lookup, query);
2776
2777 l = query->lookup;
2778
2779 REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE);
2780 sevent = (isc_socketevent_t *)event;
2781
2782 b = ISC_LIST_HEAD(sevent->bufferlist);
2783 INSIST(b == &query->recvbuf);
2784 ISC_LIST_DEQUEUE(sevent->bufferlist, &query->recvbuf, link);
2785
2786 if ((l->tcp_mode) && (l->timer != NULL))
2787 isc_timer_touch(l->timer);
2788 if ((!l->pending && !l->ns_search_only) || cancel_now) {
2789 debug("no longer pending. Got %s",
2790 isc_result_totext(sevent->result));
2791 query->waiting_connect = ISC_FALSE;
2792
2793 isc_event_free(&event);
2794 clear_query(query);
2795 check_next_lookup(l);
2796 UNLOCK_LOOKUP;
2797 return;
2798 }
2799
2800 if (sevent->result != ISC_R_SUCCESS) {
2801 if (sevent->result == ISC_R_CANCELED) {
2802 debug("in recv cancel handler");
2803 query->waiting_connect = ISC_FALSE;
2804 } else {
2805 printf(";; communications error: %s\n",
2806 isc_result_totext(sevent->result));
2807 isc_socket_detach(&query->sock);
2808 sockcount--;
2809 debug("sockcount=%d", sockcount);
2810 INSIST(sockcount >= 0);
2811 }
2812 isc_event_free(&event);
2813 clear_query(query);
2814 check_next_lookup(l);
2815 UNLOCK_LOOKUP;
2816 return;
2817 }
2818
2819 if (!l->tcp_mode &&
2820 !isc_sockaddr_compare(&sevent->address, &query->sockaddr,
2821 ISC_SOCKADDR_CMPADDR|
2822 ISC_SOCKADDR_CMPPORT|
2823 ISC_SOCKADDR_CMPSCOPE|
2824 ISC_SOCKADDR_CMPSCOPEZERO)) {
2825 char buf1[ISC_SOCKADDR_FORMATSIZE];
2826 char buf2[ISC_SOCKADDR_FORMATSIZE];
2827 isc_sockaddr_t any;
2828
2829 if (isc_sockaddr_pf(&query->sockaddr) == AF_INET)
2830 isc_sockaddr_any(&any);
2831 else
2832 isc_sockaddr_any6(&any);
2833
2834 /*
2835 * We don't expect a match when the packet is
2836 * sent to 0.0.0.0, :: or to a multicast addresses.
2837 * XXXMPA broadcast needs to be handled here as well.
2838 */
2839 if ((!isc_sockaddr_eqaddr(&query->sockaddr, &any) &&
2840 !isc_sockaddr_ismulticast(&query->sockaddr)) ||
2841 isc_sockaddr_getport(&query->sockaddr) !=
2842 isc_sockaddr_getport(&sevent->address)) {
2843 isc_sockaddr_format(&sevent->address, buf1,
2844 sizeof(buf1));
2845 isc_sockaddr_format(&query->sockaddr, buf2,
2846 sizeof(buf2));
2847 printf(";; reply from unexpected source: %s,"
2848 " expected %s\n", buf1, buf2);
2849 match = ISC_FALSE;
2850 }
2851 }
2852
2853 result = dns_message_peekheader(b, &id, &msgflags);
2854 if (result != ISC_R_SUCCESS || l->sendmsg->id != id) {
2855 match = ISC_FALSE;
2856 if (l->tcp_mode) {
2857 isc_boolean_t fail = ISC_TRUE;
2858 if (result == ISC_R_SUCCESS) {
2859 if (!query->first_soa_rcvd ||
2860 query->warn_id)
2861 printf(";; %s: ID mismatch: "
2862 "expected ID %u, got %u\n",
2863 query->first_soa_rcvd ?
2864 "WARNING" : "ERROR",
2865 l->sendmsg->id, id);
2866 if (query->first_soa_rcvd)
2867 fail = ISC_FALSE;
2868 query->warn_id = ISC_FALSE;
2869 } else
2870 printf(";; ERROR: short "
2871 "(< header size) message\n");
2872 if (fail) {
2873 isc_event_free(&event);
2874 clear_query(query);
2875 check_next_lookup(l);
2876 UNLOCK_LOOKUP;
2877 return;
2878 }
2879 match = ISC_TRUE;
2880 } else if (result == ISC_R_SUCCESS)
2881 printf(";; Warning: ID mismatch: "
2882 "expected ID %u, got %u\n", l->sendmsg->id, id);
2883 else
2884 printf(";; Warning: short "
2885 "(< header size) message received\n");
2886 }
2887
2888 if (result == ISC_R_SUCCESS && (msgflags & DNS_MESSAGEFLAG_QR) == 0)
2889 printf(";; Warning: query response not set\n");
2890
2891 if (!match) {
2892 isc_buffer_invalidate(&query->recvbuf);
2893 isc_buffer_init(&query->recvbuf, query->recvspace, COMMSIZE);
2894 ISC_LIST_ENQUEUE(query->recvlist, &query->recvbuf, link);
2895 result = isc_socket_recvv(query->sock, &query->recvlist, 1,
2896 global_task, recv_done, query);
2897 check_result(result, "isc_socket_recvv");
2898 recvcount++;
2899 isc_event_free(&event);
2900 UNLOCK_LOOKUP;
2901 return;
2902 }
2903
2904 result = dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &msg);
2905 check_result(result, "dns_message_create");
2906
2907 if (key != NULL) {
2908 if (l->querysig == NULL) {
2909 debug("getting initial querysig");
2910 result = dns_message_getquerytsig(l->sendmsg, mctx,
2911 &l->querysig);
2912 check_result(result, "dns_message_getquerytsig");
2913 }
2914 result = dns_message_setquerytsig(msg, l->querysig);
2915 check_result(result, "dns_message_setquerytsig");
2916 result = dns_message_settsigkey(msg, key);
2917 check_result(result, "dns_message_settsigkey");
2918 msg->tsigctx = l->tsigctx;
2919 l->tsigctx = NULL;
2920 if (l->msgcounter != 0)
2921 msg->tcp_continuation = 1;
2922 l->msgcounter++;
2923 }
2924
2925 debug("before parse starts");
2926 parseflags = DNS_MESSAGEPARSE_PRESERVEORDER;
2927 #ifdef DIG_SIGCHASE
2928 if (!l->sigchase) {
2929 do_sigchase = ISC_FALSE;
2930 } else {
2931 parseflags = 0;
2932 do_sigchase = ISC_TRUE;
2933 }
2934 #endif
2935 if (l->besteffort) {
2936 parseflags |= DNS_MESSAGEPARSE_BESTEFFORT;
2937 parseflags |= DNS_MESSAGEPARSE_IGNORETRUNCATION;
2938 }
2939 result = dns_message_parse(msg, b, parseflags);
2940 if (result == DNS_R_RECOVERABLE) {
2941 printf(";; Warning: Message parser reports malformed "
2942 "message packet.\n");
2943 result = ISC_R_SUCCESS;
2944 }
2945 if (result != ISC_R_SUCCESS) {
2946 printf(";; Got bad packet: %s\n", isc_result_totext(result));
2947 hex_dump(b);
2948 query->waiting_connect = ISC_FALSE;
2949 dns_message_destroy(&msg);
2950 isc_event_free(&event);
2951 clear_query(query);
2952 cancel_lookup(l);
2953 check_next_lookup(l);
2954 UNLOCK_LOOKUP;
2955 return;
2956 }
2957 if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0 &&
2958 !l->ignore && !l->tcp_mode) {
2959 printf(";; Truncated, retrying in TCP mode.\n");
2960 n = requeue_lookup(l, ISC_TRUE);
2961 n->tcp_mode = ISC_TRUE;
2962 n->origin = query->lookup->origin;
2963 dns_message_destroy(&msg);
2964 isc_event_free(&event);
2965 clear_query(query);
2966 cancel_lookup(l);
2967 check_next_lookup(l);
2968 UNLOCK_LOOKUP;
2969 return;
2970 }
2971 if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) ||
2972 (check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse))
2973 {
2974 dig_query_t *next = ISC_LIST_NEXT(query, link);
2975 if (l->current_query == query)
2976 l->current_query = NULL;
2977 if (next != NULL) {
2978 debug("sending query %p\n", next);
2979 if (l->tcp_mode)
2980 send_tcp_connect(next);
2981 else
2982 send_udp(next);
2983 }
2984 /*
2985 * If our query is at the head of the list and there
2986 * is no next, we're the only one left, so fall
2987 * through to print the message.
2988 */
2989 if ((ISC_LIST_HEAD(l->q) != query) ||
2990 (ISC_LIST_NEXT(query, link) != NULL)) {
2991 if( l->comments == ISC_TRUE )
2992 printf(";; Got %s from %s, "
2993 "trying next server\n",
2994 msg->rcode == dns_rcode_servfail ?
2995 "SERVFAIL reply" :
2996 "recursion not available",
2997 query->servname);
2998 clear_query(query);
2999 check_next_lookup(l);
3000 dns_message_destroy(&msg);
3001 isc_event_free(&event);
3002 UNLOCK_LOOKUP;
3003 return;
3004 }
3005 }
3006
3007 if (key != NULL) {
3008 result = dns_tsig_verify(&query->recvbuf, msg, NULL, NULL);
3009 if (result != ISC_R_SUCCESS) {
3010 printf(";; Couldn't verify signature: %s\n",
3011 isc_result_totext(result));
3012 validated = ISC_FALSE;
3013 }
3014 l->tsigctx = msg->tsigctx;
3015 msg->tsigctx = NULL;
3016 if (l->querysig != NULL) {
3017 debug("freeing querysig buffer %p", l->querysig);
3018 isc_buffer_free(&l->querysig);
3019 }
3020 result = dns_message_getquerytsig(msg, mctx, &l->querysig);
3021 check_result(result,"dns_message_getquerytsig");
3022 }
3023
3024 extrabytes = isc_buffer_remaininglength(b);
3025
3026 debug("after parse");
3027 if (l->doing_xfr && l->xfr_q == NULL) {
3028 l->xfr_q = query;
3029 /*
3030 * Once we are in the XFR message, increase
3031 * the timeout to much longer, so brief network
3032 * outages won't cause the XFR to abort
3033 */
3034 if (timeout != INT_MAX && l->timer != NULL) {
3035 unsigned int local_timeout;
3036
3037 if (timeout == 0) {
3038 if (l->tcp_mode)
3039 local_timeout = TCP_TIMEOUT * 4;
3040 else
3041 local_timeout = UDP_TIMEOUT * 4;
3042 } else {
3043 if (timeout < (INT_MAX / 4))
3044 local_timeout = timeout * 4;
3045 else
3046 local_timeout = INT_MAX;
3047 }
3048 debug("have local timeout of %d", local_timeout);
3049 isc_interval_set(&l->interval, local_timeout, 0);
3050 result = isc_timer_reset(l->timer,
3051 isc_timertype_once,
3052 NULL,
3053 &l->interval,
3054 ISC_FALSE);
3055 check_result(result, "isc_timer_reset");
3056 }
3057 }
3058
3059 if (!l->doing_xfr || l->xfr_q == query) {
3060 if (msg->rcode != dns_rcode_noerror &&
3061 (l->origin != NULL || l->need_search)) {
3062 if (!next_origin(msg, query) || showsearch) {
3063 printmessage(query, msg, ISC_TRUE);
3064 received(b->used, &sevent->address, query);
3065 }
3066 } else if (!l->trace && !l->ns_search_only) {
3067 #ifdef DIG_SIGCHASE
3068 if (!do_sigchase)
3069 #endif
3070 printmessage(query, msg, ISC_TRUE);
3071 } else if (l->trace) {
3072 int n = 0;
3073 int count = msg->counts[DNS_SECTION_ANSWER];
3074
3075 debug("in TRACE code");
3076 if (!l->ns_search_only)
3077 printmessage(query, msg, ISC_TRUE);
3078
3079 l->rdtype = l->qrdtype;
3080 if (l->trace_root || (l->ns_search_only && count > 0)) {
3081 if (!l->trace_root)
3082 l->rdtype = dns_rdatatype_soa;
3083 n = followup_lookup(msg, query,
3084 DNS_SECTION_ANSWER);
3085 l->trace_root = ISC_FALSE;
3086 } else if (count == 0)
3087 n = followup_lookup(msg, query,
3088 DNS_SECTION_AUTHORITY);
3089 if (n == 0)
3090 docancel = ISC_TRUE;
3091 } else {
3092 debug("in NSSEARCH code");
3093
3094 if (l->trace_root) {
3095 /*
3096 * This is the initial NS query.
3097 */
3098 int n;
3099
3100 l->rdtype = dns_rdatatype_soa;
3101 n = followup_lookup(msg, query,
3102 DNS_SECTION_ANSWER);
3103 if (n == 0)
3104 docancel = ISC_TRUE;
3105 l->trace_root = ISC_FALSE;
3106 } else
3107 #ifdef DIG_SIGCHASE
3108 if (!do_sigchase)
3109 #endif
3110 printmessage(query, msg, ISC_TRUE);
3111 }
3112 #ifdef DIG_SIGCHASE
3113 if (do_sigchase) {
3114 chase_msg = isc_mem_allocate(mctx,
3115 sizeof(dig_message_t));
3116 if (chase_msg == NULL) {
3117 fatal("Memory allocation failure in %s:%d",
3118 __FILE__, __LINE__);
3119 }
3120 ISC_LIST_INITANDAPPEND(chase_message_list, chase_msg,
3121 link);
3122 if (dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE,
3123 &msg_temp) != ISC_R_SUCCESS) {
3124 fatal("dns_message_create in %s:%d",
3125 __FILE__, __LINE__);
3126 }
3127
3128 isc_buffer_usedregion(b, &r);
3129 result = isc_buffer_allocate(mctx, &buf, r.length);
3130
3131 check_result(result, "isc_buffer_allocate");
3132 result = isc_buffer_copyregion(buf, &r);
3133 check_result(result, "isc_buffer_copyregion");
3134
3135 result = dns_message_parse(msg_temp, buf, 0);
3136
3137 isc_buffer_free(&buf);
3138 chase_msg->msg = msg_temp;
3139
3140 chase_msg2 = isc_mem_allocate(mctx,
3141 sizeof(dig_message_t));
3142 if (chase_msg2 == NULL) {
3143 fatal("Memory allocation failure in %s:%d",
3144 __FILE__, __LINE__);
3145 }
3146 ISC_LIST_INITANDAPPEND(chase_message_list2, chase_msg2,
3147 link);
3148 chase_msg2->msg = msg;
3149 }
3150 #endif
3151 }
3152
3153 #ifdef DIG_SIGCHASE
3154 if (l->sigchase && ISC_LIST_EMPTY(lookup_list)) {
3155 sigchase(msg_temp);
3156 }
3157 #endif
3158
3159 if (l->pending)
3160 debug("still pending.");
3161 if (l->doing_xfr) {
3162 if (query != l->xfr_q) {
3163 dns_message_destroy(&msg);
3164 isc_event_free(&event);
3165 query->waiting_connect = ISC_FALSE;
3166 UNLOCK_LOOKUP;
3167 return;
3168 }
3169 if (!docancel)
3170 docancel = check_for_more_data(query, msg, sevent);
3171 if (docancel) {
3172 dns_message_destroy(&msg);
3173 clear_query(query);
3174 cancel_lookup(l);
3175 check_next_lookup(l);
3176 }
3177 } else {
3178
3179 if (msg->rcode == dns_rcode_noerror || l->origin == NULL) {
3180
3181 #ifdef DIG_SIGCHASE
3182 if (!l->sigchase)
3183 #endif
3184 received(b->used, &sevent->address, query);
3185 }
3186
3187 if (!query->lookup->ns_search_only)
3188 query->lookup->pending = ISC_FALSE;
3189 if (!query->lookup->ns_search_only ||
3190 query->lookup->trace_root || docancel) {
3191 #ifdef DIG_SIGCHASE
3192 if (!do_sigchase)
3193 #endif
3194 dns_message_destroy(&msg);
3195
3196 cancel_lookup(l);
3197 }
3198 clear_query(query);
3199 check_next_lookup(l);
3200 }
3201 if (msg != NULL) {
3202 #ifdef DIG_SIGCHASE
3203 if (do_sigchase)
3204 msg = NULL;
3205 else
3206 #endif
3207 dns_message_destroy(&msg);
3208 }
3209 isc_event_free(&event);
3210 UNLOCK_LOOKUP;
3211 }
3212
3213 /*%
3214 * Turn a name into an address, using system-supplied routines. This is
3215 * used in looking up server names, etc... and needs to use system-supplied
3216 * routines, since they may be using a non-DNS system for these lookups.
3217 */
3218 void
3219 get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr) {
3220 int count;
3221 isc_result_t result;
3222
3223 isc_app_block();
3224 result = bind9_getaddresses(host, port, sockaddr, 1, &count);
3225 isc_app_unblock();
3226 if (result != ISC_R_SUCCESS)
3227 fatal("couldn't get address for '%s': %s",
3228 host, isc_result_totext(result));
3229 INSIST(count == 1);
3230 }
3231
3232 /*%
3233 * Initiate either a TCP or UDP lookup
3234 */
3235 void
3236 do_lookup(dig_lookup_t *lookup) {
3237
3238 REQUIRE(lookup != NULL);
3239
3240 debug("do_lookup()");
3241 lookup->pending = ISC_TRUE;
3242 if (lookup->tcp_mode)
3243 send_tcp_connect(ISC_LIST_HEAD(lookup->q));
3244 else
3245 send_udp(ISC_LIST_HEAD(lookup->q));
3246 }
3247
3248 /*%
3249 * Start everything in action upon task startup.
3250 */
3251 void
3252 onrun_callback(isc_task_t *task, isc_event_t *event) {
3253 UNUSED(task);
3254
3255 isc_event_free(&event);
3256 LOCK_LOOKUP;
3257 start_lookup();
3258 UNLOCK_LOOKUP;
3259 }
3260
3261 /*%
3262 * Make everything on the lookup queue go away. Mainly used by the
3263 * SIGINT handler.
3264 */
3265 void
3266 cancel_all(void) {
3267 dig_lookup_t *l, *n;
3268 dig_query_t *q, *nq;
3269
3270 debug("cancel_all()");
3271
3272 LOCK_LOOKUP;
3273 if (free_now) {
3274 UNLOCK_LOOKUP;
3275 return;
3276 }
3277 cancel_now = ISC_TRUE;
3278 if (current_lookup != NULL) {
3279 if (current_lookup->timer != NULL)
3280 isc_timer_detach(&current_lookup->timer);
3281 q = ISC_LIST_HEAD(current_lookup->q);
3282 while (q != NULL) {
3283 debug("cancelling query %p, belonging to %p",
3284 q, current_lookup);
3285 nq = ISC_LIST_NEXT(q, link);
3286 if (q->sock != NULL) {
3287 isc_socket_cancel(q->sock, NULL,
3288 ISC_SOCKCANCEL_ALL);
3289 } else {
3290 clear_query(q);
3291 }
3292 q = nq;
3293 }
3294 }
3295 l = ISC_LIST_HEAD(lookup_list);
3296 while (l != NULL) {
3297 n = ISC_LIST_NEXT(l, link);
3298 ISC_LIST_DEQUEUE(lookup_list, l, link);
3299 try_clear_lookup(l);
3300 l = n;
3301 }
3302 UNLOCK_LOOKUP;
3303 }
3304
3305 /*%
3306 * Destroy all of the libs we are using, and get everything ready for a
3307 * clean shutdown.
3308 */
3309 void
3310 destroy_libs(void) {
3311 #ifdef DIG_SIGCHASE
3312 void * ptr;
3313 dig_message_t *chase_msg;
3314 #endif
3315 #ifdef WITH_IDN
3316 isc_result_t result;
3317 #endif
3318
3319 debug("destroy_libs()");
3320 if (global_task != NULL) {
3321 debug("freeing task");
3322 isc_task_detach(&global_task);
3323 }
3324 /*
3325 * The taskmgr_destroy() call blocks until all events are cleared
3326 * from the task.
3327 */
3328 if (taskmgr != NULL) {
3329 debug("freeing taskmgr");
3330 isc_taskmgr_destroy(&taskmgr);
3331 }
3332 LOCK_LOOKUP;
3333 REQUIRE(sockcount == 0);
3334 REQUIRE(recvcount == 0);
3335 REQUIRE(sendcount == 0);
3336
3337 INSIST(ISC_LIST_HEAD(lookup_list) == NULL);
3338 INSIST(current_lookup == NULL);
3339 INSIST(!free_now);
3340
3341 free_now = ISC_TRUE;
3342
3343 lwres_conf_clear(lwctx);
3344 lwres_context_destroy(&lwctx);
3345
3346 flush_server_list();
3347
3348 clear_searchlist();
3349
3350 #ifdef WITH_IDN
3351 result = dns_name_settotextfilter(NULL);
3352 check_result(result, "dns_name_settotextfilter");
3353 #endif
3354 dns_name_destroy();
3355
3356 if (commctx != NULL) {
3357 debug("freeing commctx");
3358 isc_mempool_destroy(&commctx);
3359 }
3360 if (socketmgr != NULL) {
3361 debug("freeing socketmgr");
3362 isc_socketmgr_destroy(&socketmgr);
3363 }
3364 if (timermgr != NULL) {
3365 debug("freeing timermgr");
3366 isc_timermgr_destroy(&timermgr);
3367 }
3368 if (key != NULL) {
3369 debug("freeing key %p", key);
3370 dns_tsigkey_detach(&key);
3371 }
3372 if (namebuf != NULL)
3373 isc_buffer_free(&namebuf);
3374
3375 if (is_dst_up) {
3376 debug("destroy DST lib");
3377 dst_lib_destroy();
3378 is_dst_up = ISC_FALSE;
3379 }
3380 if (entp != NULL) {
3381 debug("detach from entropy");
3382 isc_entropy_detach(&entp);
3383 }
3384
3385 UNLOCK_LOOKUP;
3386 DESTROYLOCK(&lookup_lock);
3387 #ifdef DIG_SIGCHASE
3388
3389 debug("Destroy the messages kept for sigchase");
3390 /* Destroy the messages kept for sigchase */
3391 chase_msg = ISC_LIST_HEAD(chase_message_list);
3392
3393 while (chase_msg != NULL) {
3394 INSIST(chase_msg->msg != NULL);
3395 dns_message_destroy(&(chase_msg->msg));
3396 ptr = chase_msg;
3397 chase_msg = ISC_LIST_NEXT(chase_msg, link);
3398 isc_mem_free(mctx, ptr);
3399 }
3400
3401 chase_msg = ISC_LIST_HEAD(chase_message_list2);
3402
3403 while (chase_msg != NULL) {
3404 INSIST(chase_msg->msg != NULL);
3405 dns_message_destroy(&(chase_msg->msg));
3406 ptr = chase_msg;
3407 chase_msg = ISC_LIST_NEXT(chase_msg, link);
3408 isc_mem_free(mctx, ptr);
3409 }
3410 if (dns_name_dynamic(&chase_name))
3411 free_name(&chase_name, mctx);
3412 #if DIG_SIGCHASE_TD
3413 if (dns_name_dynamic(&chase_current_name))
3414 free_name(&chase_current_name, mctx);
3415 if (dns_name_dynamic(&chase_authority_name))
3416 free_name(&chase_authority_name, mctx);
3417 #endif
3418 #if DIG_SIGCHASE_BU
3419 if (dns_name_dynamic(&chase_signame))
3420 free_name(&chase_signame, mctx);
3421 #endif
3422
3423 debug("Destroy memory");
3424
3425 #endif
3426 if (memdebugging != 0)
3427 isc_mem_stats(mctx, stderr);
3428 if (mctx != NULL)
3429 isc_mem_destroy(&mctx);
3430 }
3431
3432 #ifdef WITH_IDN
3433 static void
3434 initialize_idn(void) {
3435 idn_result_t r;
3436 isc_result_t result;
3437
3438 #ifdef HAVE_SETLOCALE
3439 /* Set locale */
3440 (void)setlocale(LC_ALL, "");
3441 #endif
3442 /* Create configuration context. */
3443 r = idn_nameinit(1);
3444 if (r != idn_success)
3445 fatal("idn api initialization failed: %s",
3446 idn_result_tostring(r));
3447
3448 /* Set domain name -> text post-conversion filter. */
3449 result = dns_name_settotextfilter(output_filter);
3450 check_result(result, "dns_name_settotextfilter");
3451 }
3452
3453 static isc_result_t
3454 output_filter(isc_buffer_t *buffer, unsigned int used_org,
3455 isc_boolean_t absolute)
3456 {
3457 char tmp1[MAXDLEN], tmp2[MAXDLEN];
3458 size_t fromlen, tolen;
3459 isc_boolean_t end_with_dot;
3460
3461 /*
3462 * Copy contents of 'buffer' to 'tmp1', supply trailing dot
3463 * if 'absolute' is true, and terminate with NUL.
3464 */
3465 fromlen = isc_buffer_usedlength(buffer) - used_org;
3466 if (fromlen >= MAXDLEN)
3467 return (ISC_R_SUCCESS);
3468 memcpy(tmp1, (char *)isc_buffer_base(buffer) + used_org, fromlen);
3469 end_with_dot = (tmp1[fromlen - 1] == '.') ? ISC_TRUE : ISC_FALSE;
3470 if (absolute && !end_with_dot) {
3471 fromlen++;
3472 if (fromlen >= MAXDLEN)
3473 return (ISC_R_SUCCESS);
3474 tmp1[fromlen - 1] = '.';
3475 }
3476 tmp1[fromlen] = '\0';
3477
3478 /*
3479 * Convert contents of 'tmp1' to local encoding.
3480 */
3481 if (idn_decodename(IDN_DECODE_APP, tmp1, tmp2, MAXDLEN) != idn_success)
3482 return (ISC_R_SUCCESS);
3483 strcpy(tmp1, tmp2);
3484
3485 /*
3486 * Copy the converted contents in 'tmp1' back to 'buffer'.
3487 * If we have appended trailing dot, remove it.
3488 */
3489 tolen = strlen(tmp1);
3490 if (absolute && !end_with_dot && tmp1[tolen - 1] == '.')
3491 tolen--;
3492
3493 if (isc_buffer_length(buffer) < used_org + tolen)
3494 return (ISC_R_NOSPACE);
3495
3496 isc_buffer_subtract(buffer, isc_buffer_usedlength(buffer) - used_org);
3497 memcpy(isc_buffer_used(buffer), tmp1, tolen);
3498 isc_buffer_add(buffer, tolen);
3499
3500 return (ISC_R_SUCCESS);
3501 }
3502
3503 static idn_result_t
3504 append_textname(char *name, const char *origin, size_t namesize) {
3505 size_t namelen = strlen(name);
3506 size_t originlen = strlen(origin);
3507
3508 /* Already absolute? */
3509 if (namelen > 0 && name[namelen - 1] == '.')
3510 return idn_success;
3511
3512 /* Append dot and origin */
3513
3514 if (namelen + 1 + originlen >= namesize)
3515 return idn_buffer_overflow;
3516
3517 name[namelen++] = '.';
3518 (void)strcpy(name + namelen, origin);
3519 return idn_success;
3520 }
3521
3522 static void
3523 idn_check_result(idn_result_t r, const char *msg) {
3524 if (r != idn_success) {
3525 exitcode = 1;
3526 fatal("%s: %s", msg, idn_result_tostring(r));
3527 }
3528 }
3529 #endif /* WITH_IDN */
3530
3531 #ifdef DIG_SIGCHASE
3532 void
3533 print_type(dns_rdatatype_t type)
3534 {
3535 isc_buffer_t * b = NULL;
3536 isc_result_t result;
3537 isc_region_t r;
3538
3539 result = isc_buffer_allocate(mctx, &b, 4000);
3540 check_result(result, "isc_buffer_allocate");
3541
3542 result = dns_rdatatype_totext(type, b);
3543 check_result(result, "print_type");
3544
3545 isc_buffer_usedregion(b, &r);
3546 r.base[r.length] = '\0';
3547
3548 printf("%s", r.base);
3549
3550 isc_buffer_free(&b);
3551 }
3552
3553 void
3554 dump_database_section(dns_message_t *msg, int section)
3555 {
3556 dns_name_t *msg_name=NULL;
3557
3558 dns_rdataset_t *rdataset;
3559
3560 do {
3561 dns_message_currentname(msg, section, &msg_name);
3562
3563 for (rdataset = ISC_LIST_HEAD(msg_name->list); rdataset != NULL;
3564 rdataset = ISC_LIST_NEXT(rdataset, link)) {
3565 dns_name_print(msg_name, stdout);
3566 printf("\n");
3567 print_rdataset(msg_name, rdataset, mctx);
3568 printf("end\n");
3569 }
3570 msg_name = NULL;
3571 } while (dns_message_nextname(msg, section) == ISC_R_SUCCESS);
3572 }
3573
3574 void
3575 dump_database(void) {
3576 dig_message_t * msg;
3577
3578 for (msg = ISC_LIST_HEAD(chase_message_list); msg != NULL;
3579 msg = ISC_LIST_NEXT(msg, link)) {
3580 if (dns_message_firstname(msg->msg, DNS_SECTION_ANSWER)
3581 == ISC_R_SUCCESS)
3582 dump_database_section(msg->msg, DNS_SECTION_ANSWER);
3583
3584 if (dns_message_firstname(msg->msg, DNS_SECTION_AUTHORITY)
3585 == ISC_R_SUCCESS)
3586 dump_database_section(msg->msg, DNS_SECTION_AUTHORITY);
3587
3588 if (dns_message_firstname(msg->msg, DNS_SECTION_ADDITIONAL)
3589 == ISC_R_SUCCESS)
3590 dump_database_section(msg->msg, DNS_SECTION_ADDITIONAL);
3591 }
3592 }
3593
3594
3595 dns_rdataset_t *
3596 search_type(dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers) {
3597 dns_rdataset_t *rdataset;
3598 dns_rdata_sig_t siginfo;
3599 dns_rdata_t sigrdata;
3600 isc_result_t result;
3601
3602 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
3603 rdataset = ISC_LIST_NEXT(rdataset, link)) {
3604 if (type == dns_rdatatype_any) {
3605 if (rdataset->type != dns_rdatatype_rrsig)
3606 return (rdataset);
3607 } else if ((type == dns_rdatatype_rrsig) &&
3608 (rdataset->type == dns_rdatatype_rrsig)) {
3609 dns_rdata_init(&sigrdata);
3610 result = dns_rdataset_first(rdataset);
3611 check_result(result, "empty rdataset");
3612 dns_rdataset_current(rdataset, &sigrdata);
3613 result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
3614 check_result(result, "sigrdata tostruct siginfo");
3615
3616 if ((siginfo.covered == covers) ||
3617 (covers == dns_rdatatype_any)) {
3618 dns_rdata_reset(&sigrdata);
3619 dns_rdata_freestruct(&siginfo);
3620 return (rdataset);
3621 }
3622 dns_rdata_reset(&sigrdata);
3623 dns_rdata_freestruct(&siginfo);
3624 } else if (rdataset->type == type)
3625 return (rdataset);
3626 }
3627 return (NULL);
3628 }
3629
3630 dns_rdataset_t *
3631 chase_scanname_section(dns_message_t *msg, dns_name_t *name,
3632 dns_rdatatype_t type, dns_rdatatype_t covers,
3633 int section)
3634 {
3635 dns_rdataset_t *rdataset;
3636 dns_name_t *msg_name = NULL;
3637
3638 do {
3639 dns_message_currentname(msg, section, &msg_name);
3640 if (dns_name_compare(msg_name, name) == 0) {
3641 rdataset = search_type(msg_name, type, covers);
3642 if (rdataset != NULL)
3643 return (rdataset);
3644 }
3645 msg_name = NULL;
3646 } while (dns_message_nextname(msg, section) == ISC_R_SUCCESS);
3647
3648 return (NULL);
3649 }
3650
3651
3652 dns_rdataset_t *
3653 chase_scanname(dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers)
3654 {
3655 dns_rdataset_t *rdataset = NULL;
3656 dig_message_t * msg;
3657
3658 for (msg = ISC_LIST_HEAD(chase_message_list2); msg != NULL;
3659 msg = ISC_LIST_NEXT(msg, link)) {
3660 if (dns_message_firstname(msg->msg, DNS_SECTION_ANSWER)
3661 == ISC_R_SUCCESS)
3662 rdataset = chase_scanname_section(msg->msg, name,
3663 type, covers,
3664 DNS_SECTION_ANSWER);
3665 if (rdataset != NULL)
3666 return (rdataset);
3667 if (dns_message_firstname(msg->msg, DNS_SECTION_AUTHORITY)
3668 == ISC_R_SUCCESS)
3669 rdataset =
3670 chase_scanname_section(msg->msg, name,
3671 type, covers,
3672 DNS_SECTION_AUTHORITY);
3673 if (rdataset != NULL)
3674 return (rdataset);
3675 if (dns_message_firstname(msg->msg, DNS_SECTION_ADDITIONAL)
3676 == ISC_R_SUCCESS)
3677 rdataset =
3678 chase_scanname_section(msg->msg, name, type,
3679 covers,
3680 DNS_SECTION_ADDITIONAL);
3681 if (rdataset != NULL)
3682 return (rdataset);
3683 }
3684
3685 return (NULL);
3686 }
3687
3688 dns_rdataset_t *
3689 sigchase_scanname(dns_rdatatype_t type, dns_rdatatype_t covers,
3690 isc_boolean_t * lookedup, dns_name_t *rdata_name)
3691 {
3692 dig_lookup_t *lookup;
3693 isc_buffer_t *b = NULL;
3694 isc_region_t r;
3695 isc_result_t result;
3696 dns_rdataset_t * temp;
3697 dns_rdatatype_t querytype;
3698
3699 temp = chase_scanname(rdata_name, type, covers);
3700 if (temp != NULL)
3701 return (temp);
3702
3703 if (*lookedup == ISC_TRUE)
3704 return (NULL);
3705
3706 lookup = clone_lookup(current_lookup, ISC_TRUE);
3707 lookup->trace_root = ISC_FALSE;
3708 lookup->new_search = ISC_TRUE;
3709
3710 result = isc_buffer_allocate(mctx, &b, BUFSIZE);
3711 check_result(result, "isc_buffer_allocate");
3712 result = dns_name_totext(rdata_name, ISC_FALSE, b);
3713 check_result(result, "dns_name_totext");
3714 isc_buffer_usedregion(b, &r);
3715 r.base[r.length] = '\0';
3716 strcpy(lookup->textname, (char*)r.base);
3717 isc_buffer_free(&b);
3718
3719 if (type == dns_rdatatype_rrsig)
3720 querytype = covers;
3721 else
3722 querytype = type;
3723
3724 if (querytype == 0 || querytype == 255) {
3725 printf("Error in the queried type: %d\n", querytype);
3726 return (NULL);
3727 }
3728
3729 lookup->rdtype = querytype;
3730 lookup->rdtypeset = ISC_TRUE;
3731 lookup->qrdtype = querytype;
3732 *lookedup = ISC_TRUE;
3733
3734 ISC_LIST_APPEND(lookup_list, lookup, link);
3735 printf("\n\nLaunch a query to find a RRset of type ");
3736 print_type(type);
3737 printf(" for zone: %s\n", lookup->textname);
3738 return (NULL);
3739 }
3740
3741 void
3742 insert_trustedkey(dst_key_t * key)
3743 {
3744 if (key == NULL)
3745 return;
3746 if (tk_list.nb_tk >= MAX_TRUSTED_KEY)
3747 return;
3748
3749 tk_list.key[tk_list.nb_tk++] = key;
3750 return;
3751 }
3752
3753 void
3754 clean_trustedkey()
3755 {
3756 int i = 0;
3757
3758 for (i= 0; i < MAX_TRUSTED_KEY; i++) {
3759 if (tk_list.key[i] != NULL) {
3760 dst_key_free(&tk_list.key[i]);
3761 tk_list.key[i] = NULL;
3762 } else
3763 break;
3764 }
3765 tk_list.nb_tk = 0;
3766 return;
3767 }
3768
3769 char alphnum[] =
3770 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
3771
3772 isc_result_t
3773 removetmpkey(isc_mem_t *mctx, const char *file)
3774 {
3775 char *tempnamekey = NULL;
3776 int tempnamekeylen;
3777 isc_result_t result;
3778
3779 tempnamekeylen = strlen(file)+10;
3780
3781 tempnamekey = isc_mem_allocate(mctx, tempnamekeylen);
3782 if (tempnamekey == NULL)
3783 return (ISC_R_NOMEMORY);
3784
3785 memset(tempnamekey, 0, tempnamekeylen);
3786
3787 strcat(tempnamekey, file);
3788 strcat(tempnamekey,".key");
3789 isc_file_remove(tempnamekey);
3790
3791 result = isc_file_remove(tempnamekey);
3792 isc_mem_free(mctx, tempnamekey);
3793 return (result);
3794 }
3795
3796 isc_result_t
3797 opentmpkey(isc_mem_t *mctx, const char *file, char **tempp, FILE **fp) {
3798 FILE *f = NULL;
3799 isc_result_t result;
3800 char *tempname = NULL;
3801 char *tempnamekey = NULL;
3802 int tempnamelen;
3803 int tempnamekeylen;
3804 char *x;
3805 char *cp;
3806 isc_uint32_t which;
3807
3808 while (1) {
3809 tempnamelen = strlen(file) + 20;
3810 tempname = isc_mem_allocate(mctx, tempnamelen);
3811 if (tempname == NULL)
3812 return (ISC_R_NOMEMORY);
3813 memset(tempname, 0, tempnamelen);
3814
3815 result = isc_file_mktemplate(file, tempname, tempnamelen);
3816 if (result != ISC_R_SUCCESS)
3817 goto cleanup;
3818
3819 cp = tempname;
3820 while (*cp != '\0')
3821 cp++;
3822 if (cp == tempname) {
3823 isc_mem_free(mctx, tempname);
3824 return (ISC_R_FAILURE);
3825 }
3826
3827 x = cp--;
3828 while (cp >= tempname && *cp == 'X') {
3829 isc_random_get(&which);
3830 *cp = alphnum[which % (sizeof(alphnum) - 1)];
3831 x = cp--;
3832 }
3833
3834 tempnamekeylen = tempnamelen+5;
3835 tempnamekey = isc_mem_allocate(mctx, tempnamekeylen);
3836 if (tempnamekey == NULL)
3837 return (ISC_R_NOMEMORY);
3838
3839 memset(tempnamekey, 0, tempnamekeylen);
3840 strncpy(tempnamekey, tempname, tempnamelen);
3841 strcat(tempnamekey ,".key");
3842
3843
3844 if (isc_file_exists(tempnamekey)) {
3845 isc_mem_free(mctx, tempnamekey);
3846 isc_mem_free(mctx, tempname);
3847 continue;
3848 }
3849
3850 if ((f = fopen(tempnamekey, "w")) == NULL) {
3851 printf("get_trusted_key(): trusted key not found %s\n",
3852 tempnamekey);
3853 return (ISC_R_FAILURE);
3854 }
3855 break;
3856 }
3857 isc_mem_free(mctx, tempnamekey);
3858 *tempp = tempname;
3859 *fp = f;
3860 return (ISC_R_SUCCESS);
3861
3862 cleanup:
3863 isc_mem_free(mctx, tempname);
3864
3865 return (result);
3866 }
3867
3868
3869 isc_result_t
3870 get_trusted_key(isc_mem_t *mctx)
3871 {
3872 isc_result_t result;
3873 const char *filename = NULL;
3874 char *filetemp = NULL;
3875 char buf[1500];
3876 FILE *fp, *fptemp;
3877 dst_key_t *key = NULL;
3878
3879 result = isc_file_exists(trustedkey);
3880 if (result != ISC_TRUE) {
3881 result = isc_file_exists("/etc/trusted-key.key");
3882 if (result != ISC_TRUE) {
3883 result = isc_file_exists("./trusted-key.key");
3884 if (result != ISC_TRUE)
3885 return (ISC_R_FAILURE);
3886 else
3887 filename = "./trusted-key.key";
3888 } else
3889 filename = "/etc/trusted-key.key";
3890 } else
3891 filename = trustedkey;
3892
3893 if (filename == NULL) {
3894 printf("No trusted key\n");
3895 return (ISC_R_FAILURE);
3896 }
3897
3898 if ((fp = fopen(filename, "r")) == NULL) {
3899 printf("get_trusted_key(): trusted key not found %s\n",
3900 filename);
3901 return (ISC_R_FAILURE);
3902 }
3903 while (fgets(buf, sizeof(buf), fp) != NULL) {
3904 result = opentmpkey(mctx,"tmp_file", &filetemp, &fptemp);
3905 if (result != ISC_R_SUCCESS) {
3906 fclose(fp);
3907 return (ISC_R_FAILURE);
3908 }
3909 if (fputs(buf, fptemp) < 0) {
3910 fclose(fp);
3911 fclose(fptemp);
3912 return (ISC_R_FAILURE);
3913 }
3914 fclose(fptemp);
3915 result = dst_key_fromnamedfile(filetemp, DST_TYPE_PUBLIC,
3916 mctx, &key);
3917 removetmpkey(mctx, filetemp);
3918 isc_mem_free(mctx, filetemp);
3919 if (result != ISC_R_SUCCESS) {
3920 fclose(fp);
3921 return (ISC_R_FAILURE);
3922 }
3923 insert_trustedkey(key);
3924 #if 0
3925 dst_key_tofile(key, DST_TYPE_PUBLIC,"/tmp");
3926 #endif
3927 key = NULL;
3928 }
3929 return (ISC_R_SUCCESS);
3930 }
3931
3932
3933 static void
3934 nameFromString(const char *str, dns_name_t *p_ret) {
3935 size_t len = strlen(str);
3936 isc_result_t result;
3937 isc_buffer_t buffer;
3938 dns_fixedname_t fixedname;
3939
3940 REQUIRE(p_ret != NULL);
3941 REQUIRE(str != NULL);
3942
3943 isc_buffer_init(&buffer, str, len);
3944 isc_buffer_add(&buffer, len);
3945
3946 dns_fixedname_init(&fixedname);
3947 result = dns_name_fromtext(dns_fixedname_name(&fixedname), &buffer,
3948 dns_rootname, ISC_TRUE, NULL);
3949 check_result(result, "nameFromString");
3950
3951 if (dns_name_dynamic(p_ret))
3952 free_name(p_ret, mctx);
3953
3954 result = dns_name_dup(dns_fixedname_name(&fixedname), mctx, p_ret);
3955 check_result(result, "nameFromString");
3956 }
3957
3958
3959 #if DIG_SIGCHASE_TD
3960 isc_result_t
3961 prepare_lookup(dns_name_t *name)
3962 {
3963 isc_result_t result;
3964 dig_lookup_t *lookup = NULL;
3965 dig_server_t *s;
3966 void *ptr;
3967
3968 lookup = clone_lookup(current_lookup, ISC_TRUE);
3969 lookup->trace_root = ISC_FALSE;
3970 lookup->new_search = ISC_TRUE;
3971 lookup->trace_root_sigchase = ISC_FALSE;
3972
3973 strncpy(lookup->textname, lookup->textnamesigchase, MXNAME);
3974
3975 lookup->rdtype = lookup->rdtype_sigchase;
3976 lookup->rdtypeset = ISC_TRUE;
3977 lookup->qrdtype = lookup->qrdtype_sigchase;
3978
3979 s = ISC_LIST_HEAD(lookup->my_server_list);
3980 while (s != NULL) {
3981 debug("freeing server %p belonging to %p",
3982 s, lookup);
3983 ptr = s;
3984 s = ISC_LIST_NEXT(s, link);
3985 ISC_LIST_DEQUEUE(lookup->my_server_list,
3986 (dig_server_t *)ptr, link);
3987 isc_mem_free(mctx, ptr);
3988 }
3989
3990
3991 for (result = dns_rdataset_first(chase_nsrdataset);
3992 result == ISC_R_SUCCESS;
3993 result = dns_rdataset_next(chase_nsrdataset)) {
3994 char namestr[DNS_NAME_FORMATSIZE];
3995 dns_rdata_ns_t ns;
3996 dns_rdata_t rdata = DNS_RDATA_INIT;
3997 dig_server_t * srv = NULL;
3998 #define __FOLLOW_GLUE__
3999 #ifdef __FOLLOW_GLUE__
4000 isc_buffer_t *b = NULL;
4001 isc_result_t result;
4002 isc_region_t r;
4003 dns_rdataset_t *rdataset = NULL;
4004 isc_boolean_t true = ISC_TRUE;
4005 #endif
4006
4007 memset(namestr, 0, DNS_NAME_FORMATSIZE);
4008
4009 dns_rdataset_current(chase_nsrdataset, &rdata);
4010
4011 (void)dns_rdata_tostruct(&rdata, &ns, NULL);
4012
4013
4014
4015 #ifdef __FOLLOW_GLUE__
4016
4017 result = advanced_rrsearch(&rdataset, &ns.name,
4018 dns_rdatatype_aaaa,
4019 dns_rdatatype_any, &true);
4020 if (result == ISC_R_SUCCESS) {
4021 for (result = dns_rdataset_first(rdataset);
4022 result == ISC_R_SUCCESS;
4023 result = dns_rdataset_next(rdataset)) {
4024 dns_rdata_t aaaa = DNS_RDATA_INIT;
4025 dns_rdataset_current(rdataset, &aaaa);
4026
4027 result = isc_buffer_allocate(mctx, &b, 80);
4028 check_result(result, "isc_buffer_allocate");
4029
4030 dns_rdata_totext(&aaaa, &ns.name, b);
4031 isc_buffer_usedregion(b, &r);
4032 r.base[r.length] = '\0';
4033 strncpy(namestr, (char*)r.base,
4034 DNS_NAME_FORMATSIZE);
4035 isc_buffer_free(&b);
4036 dns_rdata_reset(&aaaa);
4037
4038
4039 srv = make_server(namestr, namestr);
4040
4041 ISC_LIST_APPEND(lookup->my_server_list,
4042 srv, link);
4043 }
4044 }
4045
4046 rdataset = NULL;
4047 result = advanced_rrsearch(&rdataset, &ns.name, dns_rdatatype_a,
4048 dns_rdatatype_any, &true);
4049 if (result == ISC_R_SUCCESS) {
4050 for (result = dns_rdataset_first(rdataset);
4051 result == ISC_R_SUCCESS;
4052 result = dns_rdataset_next(rdataset)) {
4053 dns_rdata_t a = DNS_RDATA_INIT;
4054 dns_rdataset_current(rdataset, &a);
4055
4056 result = isc_buffer_allocate(mctx, &b, 80);
4057 check_result(result, "isc_buffer_allocate");
4058
4059 dns_rdata_totext(&a, &ns.name, b);
4060 isc_buffer_usedregion(b, &r);
4061 r.base[r.length] = '\0';
4062 strncpy(namestr, (char*)r.base,
4063 DNS_NAME_FORMATSIZE);
4064 isc_buffer_free(&b);
4065 dns_rdata_reset(&a);
4066 printf("ns name: %s\n", namestr);
4067
4068
4069 srv = make_server(namestr, namestr);
4070
4071 ISC_LIST_APPEND(lookup->my_server_list,
4072 srv, link);
4073 }
4074 }
4075 #else
4076
4077 dns_name_format(&ns.name, namestr, sizeof(namestr));
4078 printf("ns name: ");
4079 dns_name_print(&ns.name, stdout);
4080 printf("\n");
4081 srv = make_server(namestr, namestr);
4082
4083 ISC_LIST_APPEND(lookup->my_server_list, srv, link);
4084
4085 #endif
4086 dns_rdata_freestruct(&ns);
4087 dns_rdata_reset(&rdata);
4088
4089 }
4090
4091 ISC_LIST_APPEND(lookup_list, lookup, link);
4092 printf("\nLaunch a query to find a RRset of type ");
4093 print_type(lookup->rdtype);
4094 printf(" for zone: %s", lookup->textname);
4095 printf(" with nameservers:");
4096 printf("\n");
4097 print_rdataset(name, chase_nsrdataset, mctx);
4098 return (ISC_R_SUCCESS);
4099 }
4100
4101
4102 isc_result_t
4103 child_of_zone(dns_name_t * name, dns_name_t * zone_name,
4104 dns_name_t * child_name)
4105 {
4106 dns_namereln_t name_reln;
4107 int orderp;
4108 unsigned int nlabelsp;
4109
4110 name_reln = dns_name_fullcompare(name, zone_name, &orderp, &nlabelsp);
4111 if (name_reln != dns_namereln_subdomain ||
4112 dns_name_countlabels(name) <= dns_name_countlabels(zone_name) + 1) {
4113 printf("\n;; ERROR : ");
4114 dns_name_print(name, stdout);
4115 printf(" is not a subdomain of: ");
4116 dns_name_print(zone_name, stdout);
4117 printf(" FAILED\n\n");
4118 return (ISC_R_FAILURE);
4119 }
4120
4121 dns_name_getlabelsequence(name,
4122 dns_name_countlabels(name) -
4123 dns_name_countlabels(zone_name) -1,
4124 dns_name_countlabels(zone_name) +1,
4125 child_name);
4126 return (ISC_R_SUCCESS);
4127 }
4128
4129 isc_result_t
4130 grandfather_pb_test(dns_name_t *zone_name, dns_rdataset_t *sigrdataset)
4131 {
4132 isc_result_t result;
4133 dns_rdata_t sigrdata;
4134 dns_rdata_sig_t siginfo;
4135
4136 result = dns_rdataset_first(sigrdataset);
4137 check_result(result, "empty RRSIG dataset");
4138 dns_rdata_init(&sigrdata);
4139
4140 do {
4141 dns_rdataset_current(sigrdataset, &sigrdata);
4142
4143 result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
4144 check_result(result, "sigrdata tostruct siginfo");
4145
4146 if (dns_name_compare(&siginfo.signer, zone_name) == 0) {
4147 dns_rdata_freestruct(&siginfo);
4148 dns_rdata_reset(&sigrdata);
4149 return (ISC_R_SUCCESS);
4150 }
4151
4152 dns_rdata_freestruct(&siginfo);
4153
4154 } while (dns_rdataset_next(chase_sigkeyrdataset) == ISC_R_SUCCESS);
4155
4156 dns_rdata_reset(&sigrdata);
4157
4158 return (ISC_R_FAILURE);
4159 }
4160
4161
4162 isc_result_t
4163 initialization(dns_name_t *name)
4164 {
4165 isc_result_t result;
4166 isc_boolean_t true = ISC_TRUE;
4167
4168 chase_nsrdataset = NULL;
4169 result = advanced_rrsearch(&chase_nsrdataset, name, dns_rdatatype_ns,
4170 dns_rdatatype_any, &true);
4171 if (result != ISC_R_SUCCESS) {
4172 printf("\n;; NS RRset is missing to continue validation:"
4173 " FAILED\n\n");
4174 return (ISC_R_FAILURE);
4175 }
4176 INSIST(chase_nsrdataset != NULL);
4177 prepare_lookup(name);
4178
4179 dup_name(name, &chase_current_name, mctx);
4180
4181 return (ISC_R_SUCCESS);
4182 }
4183 #endif
4184
4185 void
4186 print_rdataset(dns_name_t *name, dns_rdataset_t *rdataset, isc_mem_t *mctx)
4187 {
4188 isc_buffer_t *b = NULL;
4189 isc_result_t result;
4190 isc_region_t r;
4191
4192 result = isc_buffer_allocate(mctx, &b, 9000);
4193 check_result(result, "isc_buffer_allocate");
4194
4195 printrdataset(name, rdataset, b);
4196
4197 isc_buffer_usedregion(b, &r);
4198 r.base[r.length] = '\0';
4199
4200
4201 printf("%s\n", r.base);
4202
4203 isc_buffer_free(&b);
4204 }
4205
4206
4207 void
4208 dup_name(dns_name_t *source, dns_name_t *target, isc_mem_t *mctx) {
4209 isc_result_t result;
4210
4211 if (dns_name_dynamic(target))
4212 free_name(target, mctx);
4213 result = dns_name_dup(source, mctx, target);
4214 check_result(result, "dns_name_dup");
4215 }
4216
4217 void
4218 free_name(dns_name_t *name, isc_mem_t *mctx) {
4219 dns_name_free(name, mctx);
4220 dns_name_init(name, NULL);
4221 }
4222
4223 /*
4224 *
4225 * take a DNSKEY RRset and the RRSIG RRset corresponding in parameter
4226 * return ISC_R_SUCCESS if the DNSKEY RRset contains a trusted_key
4227 * and the RRset is valid
4228 * return ISC_R_NOTFOUND if not contains trusted key
4229 or if the RRset isn't valid
4230 * return ISC_R_FAILURE if problem
4231 *
4232 */
4233 isc_result_t
4234 contains_trusted_key(dns_name_t *name, dns_rdataset_t *rdataset,
4235 dns_rdataset_t *sigrdataset,
4236 isc_mem_t *mctx)
4237 {
4238 isc_result_t result;
4239 dns_rdata_t rdata;
4240 dst_key_t *trustedKey = NULL;
4241 dst_key_t *dnsseckey = NULL;
4242 int i;
4243
4244 if (name == NULL || rdataset == NULL)
4245 return (ISC_R_FAILURE);
4246
4247 result = dns_rdataset_first(rdataset);
4248 check_result(result, "empty rdataset");
4249 dns_rdata_init(&rdata);
4250
4251 do {
4252 dns_rdataset_current(rdataset, &rdata);
4253 INSIST(rdata.type == dns_rdatatype_dnskey);
4254
4255 result = dns_dnssec_keyfromrdata(name, &rdata,
4256 mctx, &dnsseckey);
4257 check_result(result, "dns_dnssec_keyfromrdata");
4258
4259
4260 for (i = 0; i < tk_list.nb_tk; i++) {
4261 if (dst_key_compare(tk_list.key[i], dnsseckey)
4262 == ISC_TRUE) {
4263 dns_rdata_reset(&rdata);
4264
4265 printf(";; Ok, find a Trusted Key in the "
4266 "DNSKEY RRset: %d\n",
4267 dst_key_id(dnsseckey));
4268 if (sigchase_verify_sig_key(name, rdataset,
4269 dnsseckey,
4270 sigrdataset,
4271 mctx)
4272 == ISC_R_SUCCESS) {
4273 dst_key_free(&dnsseckey);
4274 dnsseckey = NULL;
4275 return (ISC_R_SUCCESS);
4276 }
4277 }
4278 }
4279
4280 dns_rdata_reset(&rdata);
4281 if (dnsseckey != NULL)
4282 dst_key_free(&dnsseckey);
4283 } while (dns_rdataset_next(rdataset) == ISC_R_SUCCESS);
4284
4285 if (trustedKey != NULL)
4286 dst_key_free(&trustedKey);
4287 trustedKey = NULL;
4288
4289 return (ISC_R_NOTFOUND);
4290 }
4291
4292 isc_result_t
4293 sigchase_verify_sig(dns_name_t *name, dns_rdataset_t *rdataset,
4294 dns_rdataset_t *keyrdataset,
4295 dns_rdataset_t *sigrdataset,
4296 isc_mem_t *mctx)
4297 {
4298 isc_result_t result;
4299 dns_rdata_t keyrdata;
4300 dst_key_t *dnsseckey = NULL;
4301
4302 result = dns_rdataset_first(keyrdataset);
4303 check_result(result, "empty DNSKEY dataset");
4304 dns_rdata_init(&keyrdata);
4305
4306 do {
4307 dns_rdataset_current(keyrdataset, &keyrdata);
4308 INSIST(keyrdata.type == dns_rdatatype_dnskey);
4309
4310 result = dns_dnssec_keyfromrdata(name, &keyrdata,
4311 mctx, &dnsseckey);
4312 check_result(result, "dns_dnssec_keyfromrdata");
4313
4314 result = sigchase_verify_sig_key(name, rdataset, dnsseckey,
4315 sigrdataset, mctx);
4316 if (result == ISC_R_SUCCESS) {
4317 dns_rdata_reset(&keyrdata);
4318 dst_key_free(&dnsseckey);
4319 return (ISC_R_SUCCESS);
4320 }
4321 dst_key_free(&dnsseckey);
4322 } while (dns_rdataset_next(chase_keyrdataset) == ISC_R_SUCCESS);
4323
4324 dns_rdata_reset(&keyrdata);
4325
4326 return (ISC_R_NOTFOUND);
4327 }
4328
4329 isc_result_t
4330 sigchase_verify_sig_key(dns_name_t *name, dns_rdataset_t *rdataset,
4331 dst_key_t *dnsseckey, dns_rdataset_t *sigrdataset,
4332 isc_mem_t *mctx)
4333 {
4334 isc_result_t result;
4335 dns_rdata_t sigrdata;
4336 dns_rdata_sig_t siginfo;
4337
4338 result = dns_rdataset_first(sigrdataset);
4339 check_result(result, "empty RRSIG dataset");
4340 dns_rdata_init(&sigrdata);
4341
4342 do {
4343 dns_rdataset_current(sigrdataset, &sigrdata);
4344
4345 result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
4346 check_result(result, "sigrdata tostruct siginfo");
4347
4348 /*
4349 * Test if the id of the DNSKEY is
4350 * the id of the DNSKEY signer's
4351 */
4352 if (siginfo.keyid == dst_key_id(dnsseckey)) {
4353
4354 result = dns_rdataset_first(rdataset);
4355 check_result(result, "empty DS dataset");
4356
4357 result = dns_dnssec_verify(name, rdataset, dnsseckey,
4358 ISC_FALSE, mctx, &sigrdata);
4359
4360 printf(";; VERIFYING ");
4361 print_type(rdataset->type);
4362 printf(" RRset for ");
4363 dns_name_print(name, stdout);
4364 printf(" with DNSKEY:%d: %s\n", dst_key_id(dnsseckey),
4365 isc_result_totext(result));
4366
4367 if (result == ISC_R_SUCCESS) {
4368 dns_rdata_reset(&sigrdata);
4369 return (result);
4370 }
4371 }
4372 dns_rdata_freestruct(&siginfo);
4373
4374 } while (dns_rdataset_next(chase_sigkeyrdataset) == ISC_R_SUCCESS);
4375
4376 dns_rdata_reset(&sigrdata);
4377
4378 return (ISC_R_NOTFOUND);
4379 }
4380
4381
4382 isc_result_t
4383 sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
4384 dns_rdataset_t *dsrdataset, isc_mem_t *mctx)
4385 {
4386 isc_result_t result;
4387 dns_rdata_t keyrdata;
4388 dns_rdata_t newdsrdata;
4389 dns_rdata_t dsrdata;
4390 dns_rdata_ds_t dsinfo;
4391 dst_key_t *dnsseckey = NULL;
4392 unsigned char dsbuf[DNS_DS_BUFFERSIZE];
4393
4394 result = dns_rdataset_first(dsrdataset);
4395 check_result(result, "empty DSset dataset");
4396 dns_rdata_init(&dsrdata);
4397 do {
4398 dns_rdataset_current(dsrdataset, &dsrdata);
4399
4400 result = dns_rdata_tostruct(&dsrdata, &dsinfo, NULL);
4401 check_result(result, "dns_rdata_tostruct for DS");
4402
4403 result = dns_rdataset_first(keyrdataset);
4404 check_result(result, "empty KEY dataset");
4405 dns_rdata_init(&keyrdata);
4406
4407 do {
4408 dns_rdataset_current(keyrdataset, &keyrdata);
4409 INSIST(keyrdata.type == dns_rdatatype_dnskey);
4410
4411 result = dns_dnssec_keyfromrdata(name, &keyrdata,
4412 mctx, &dnsseckey);
4413 check_result(result, "dns_dnssec_keyfromrdata");
4414
4415 /*
4416 * Test if the id of the DNSKEY is the
4417 * id of DNSKEY referenced by the DS
4418 */
4419 if (dsinfo.key_tag == dst_key_id(dnsseckey)) {
4420 dns_rdata_init(&newdsrdata);
4421
4422 result = dns_ds_buildrdata(name, &keyrdata,
4423 dsinfo.digest_type,
4424 dsbuf, &newdsrdata);
4425 dns_rdata_freestruct(&dsinfo);
4426
4427 if (result != ISC_R_SUCCESS) {
4428 dns_rdata_reset(&keyrdata);
4429 dns_rdata_reset(&newdsrdata);
4430 dns_rdata_reset(&dsrdata);
4431 dst_key_free(&dnsseckey);
4432 dns_rdata_freestruct(&dsinfo);
4433 printf("Oops: impossible to build"
4434 " new DS rdata\n");
4435 return (result);
4436 }
4437
4438
4439 if (dns_rdata_compare(&dsrdata,
4440 &newdsrdata) == 0) {
4441 printf(";; OK a DS valids a DNSKEY"
4442 " in the RRset\n");
4443 printf(";; Now verify that this"
4444 " DNSKEY validates the "
4445 "DNSKEY RRset\n");
4446
4447 result = sigchase_verify_sig_key(name,
4448 keyrdataset,
4449 dnsseckey,
4450 chase_sigkeyrdataset,
4451 mctx);
4452 if (result == ISC_R_SUCCESS) {
4453 dns_rdata_reset(&keyrdata);
4454 dns_rdata_reset(&newdsrdata);
4455 dns_rdata_reset(&dsrdata);
4456 dst_key_free(&dnsseckey);
4457
4458 return (result);
4459 }
4460 } else {
4461 printf(";; This DS is NOT the DS for"
4462 " the chasing KEY: FAILED\n");
4463 }
4464
4465 dns_rdata_reset(&newdsrdata);
4466 }
4467 dst_key_free(&dnsseckey);
4468 dnsseckey = NULL;
4469 } while (dns_rdataset_next(chase_keyrdataset) == ISC_R_SUCCESS);
4470 dns_rdata_reset(&keyrdata);
4471
4472 } while (dns_rdataset_next(chase_dsrdataset) == ISC_R_SUCCESS);
4473 #if 0
4474 dns_rdata_reset(&dsrdata); WARNING
4475 #endif
4476
4477 return (ISC_R_NOTFOUND);
4478 }
4479
4480 /*
4481 *
4482 * take a pointer on a rdataset in parameter and try to resolv it.
4483 * the searched rrset is a rrset on 'name' with type 'type'
4484 * (and if the type is a rrsig the signature cover 'covers').
4485 * the lookedup is to known if you have already done the query on the net.
4486 * ISC_R_SUCCESS: if we found the rrset
4487 * ISC_R_NOTFOUND: we do not found the rrset in cache
4488 * and we do a query on the net
4489 * ISC_R_FAILURE: rrset not found
4490 */
4491 isc_result_t
4492 advanced_rrsearch(dns_rdataset_t **rdataset, dns_name_t *name,
4493 dns_rdatatype_t type, dns_rdatatype_t covers,
4494 isc_boolean_t *lookedup)
4495 {
4496 isc_boolean_t tmplookedup;
4497
4498 INSIST(rdataset != NULL);
4499
4500 if (*rdataset != NULL)
4501 return (ISC_R_SUCCESS);
4502
4503 tmplookedup = *lookedup;
4504 if ((*rdataset = sigchase_scanname(type, covers,
4505 lookedup, name)) == NULL) {
4506 if (tmplookedup)
4507 return (ISC_R_FAILURE);
4508 return (ISC_R_NOTFOUND);
4509 }
4510 *lookedup = ISC_FALSE;
4511 return (ISC_R_SUCCESS);
4512 }
4513
4514
4515
4516 #if DIG_SIGCHASE_TD
4517 void
4518 sigchase_td(dns_message_t *msg)
4519 {
4520 isc_result_t result;
4521 dns_name_t *name = NULL;
4522 isc_boolean_t have_answer = ISC_FALSE;
4523 isc_boolean_t true = ISC_TRUE;
4524
4525 if ((result = dns_message_firstname(msg, DNS_SECTION_ANSWER))
4526 == ISC_R_SUCCESS) {
4527 dns_message_currentname(msg, DNS_SECTION_ANSWER, &name);
4528 if (current_lookup->trace_root_sigchase) {
4529 initialization(name);
4530 return;
4531 }
4532 have_answer = true;
4533 } else {
4534 if (!current_lookup->trace_root_sigchase) {
4535 result = dns_message_firstname(msg,
4536 DNS_SECTION_AUTHORITY);
4537 if (result == ISC_R_SUCCESS)
4538 dns_message_currentname(msg,
4539 DNS_SECTION_AUTHORITY,
4540 &name);
4541 chase_nsrdataset
4542 = chase_scanname_section(msg, name,
4543 dns_rdatatype_ns,
4544 dns_rdatatype_any,
4545 DNS_SECTION_AUTHORITY);
4546 dup_name(name, &chase_authority_name, mctx);
4547 if (chase_nsrdataset != NULL) {
4548 have_delegation_ns = ISC_TRUE;
4549 printf("no response but there is a delegation"
4550 " in authority section:");
4551 dns_name_print(name, stdout);
4552 printf("\n");
4553 } else {
4554 printf("no response and no delegation in "
4555 "authority section but a reference"
4556 " to: ");
4557 dns_name_print(name, stdout);
4558 printf("\n");
4559 error_message = msg;
4560 }
4561 } else {
4562 printf(";; NO ANSWERS: %s\n",
4563 isc_result_totext(result));
4564 free_name(&chase_name, mctx);
4565 clean_trustedkey();
4566 return;
4567 }
4568 }
4569
4570
4571 if (have_answer) {
4572 chase_rdataset
4573 = chase_scanname_section(msg, &chase_name,
4574 current_lookup
4575 ->rdtype_sigchase,
4576 dns_rdatatype_any,
4577 DNS_SECTION_ANSWER);
4578 if (chase_rdataset != NULL)
4579 have_response = ISC_TRUE;
4580 }
4581
4582 result = advanced_rrsearch(&chase_keyrdataset,
4583 &chase_current_name,
4584 dns_rdatatype_dnskey,
4585 dns_rdatatype_any,
4586 &chase_keylookedup);
4587 if (result == ISC_R_FAILURE) {
4588 printf("\n;; DNSKEY is missing to continue validation:"
4589 " FAILED\n\n");
4590 goto cleanandgo;
4591 }
4592 if (result == ISC_R_NOTFOUND)
4593 return;
4594 INSIST(chase_keyrdataset != NULL);
4595 printf("\n;; DNSKEYset:\n");
4596 print_rdataset(&chase_current_name , chase_keyrdataset, mctx);
4597
4598
4599 result = advanced_rrsearch(&chase_sigkeyrdataset,
4600 &chase_current_name,
4601 dns_rdatatype_rrsig,
4602 dns_rdatatype_dnskey,
4603 &chase_sigkeylookedup);
4604 if (result == ISC_R_FAILURE) {
4605 printf("\n;; RRSIG of DNSKEY is missing to continue validation:"
4606 " FAILED\n\n");
4607 goto cleanandgo;
4608 }
4609 if (result == ISC_R_NOTFOUND)
4610 return;
4611 INSIST(chase_sigkeyrdataset != NULL);
4612 printf("\n;; RRSIG of the DNSKEYset:\n");
4613 print_rdataset(&chase_current_name , chase_sigkeyrdataset, mctx);
4614
4615
4616 if (!chase_dslookedup && !chase_nslookedup) {
4617 if (!delegation_follow) {
4618 result = contains_trusted_key(&chase_current_name,
4619 chase_keyrdataset,
4620 chase_sigkeyrdataset,
4621 mctx);
4622 } else {
4623 INSIST(chase_dsrdataset != NULL);
4624 INSIST(chase_sigdsrdataset != NULL);
4625 result = sigchase_verify_ds(&chase_current_name,
4626 chase_keyrdataset,
4627 chase_dsrdataset,
4628 mctx);
4629 }
4630
4631 if (result != ISC_R_SUCCESS) {
4632 printf("\n;; chain of trust can't be validated:"
4633 " FAILED\n\n");
4634 goto cleanandgo;
4635 } else {
4636 chase_dsrdataset = NULL;
4637 chase_sigdsrdataset = NULL;
4638 }
4639 }
4640
4641 if (have_response || (!have_delegation_ns && !have_response)) {
4642 /* test if it's a grand father case */
4643
4644 if (have_response) {
4645 result = advanced_rrsearch(&chase_sigrdataset,
4646 &chase_name,
4647 dns_rdatatype_rrsig,
4648 current_lookup
4649 ->rdtype_sigchase,
4650 &true);
4651 if (result == ISC_R_FAILURE) {
4652 printf("\n;; RRset is missing to continue"
4653 " validation SHOULD NOT APPEND:"
4654 " FAILED\n\n");
4655 goto cleanandgo;
4656 }
4657
4658 } else {
4659 result = advanced_rrsearch(&chase_sigrdataset,
4660 &chase_authority_name,
4661 dns_rdatatype_rrsig,
4662 dns_rdatatype_any,
4663 &true);
4664 if (result == ISC_R_FAILURE) {
4665 printf("\n;; RRSIG is missing to continue"
4666 " validation SHOULD NOT APPEND:"
4667 " FAILED\n\n");
4668 goto cleanandgo;
4669 }
4670 }
4671 result = grandfather_pb_test(&chase_current_name,
4672 chase_sigrdataset);
4673 if (result != ISC_R_SUCCESS) {
4674 dns_name_t tmp_name;
4675
4676 printf("\n;; We are in a Grand Father Problem:"
4677 " See 2.2.1 in RFC 3568\n");
4678 chase_rdataset = NULL;
4679 chase_sigrdataset = NULL;
4680 have_response = ISC_FALSE;
4681 have_delegation_ns = ISC_FALSE;
4682
4683 dns_name_init(&tmp_name, NULL);
4684 result = child_of_zone(&chase_name, &chase_current_name,
4685 &tmp_name);
4686 if (dns_name_dynamic(&chase_authority_name))
4687 free_name(&chase_authority_name, mctx);
4688 dup_name(&tmp_name, &chase_authority_name, mctx);
4689 printf(";; and we try to continue chain of trust"
4690 " validation of the zone: ");
4691 dns_name_print(&chase_authority_name, stdout);
4692 printf("\n");
4693 have_delegation_ns = ISC_TRUE;
4694 } else {
4695 if (have_response)
4696 goto finalstep;
4697 else
4698 chase_sigrdataset = NULL;
4699 }
4700 }
4701
4702 if (have_delegation_ns) {
4703 chase_nsrdataset = NULL;
4704 result = advanced_rrsearch(&chase_nsrdataset,
4705 &chase_authority_name,
4706 dns_rdatatype_ns,
4707 dns_rdatatype_any,
4708 &chase_nslookedup);
4709 if (result == ISC_R_FAILURE) {
4710 printf("\n;;NSset is missing to continue validation:"
4711 " FAILED\n\n");
4712 goto cleanandgo;
4713 }
4714 if (result == ISC_R_NOTFOUND) {
4715 return;
4716 }
4717 INSIST(chase_nsrdataset != NULL);
4718
4719 result = advanced_rrsearch(&chase_dsrdataset,
4720 &chase_authority_name,
4721 dns_rdatatype_ds,
4722 dns_rdatatype_any,
4723 &chase_dslookedup);
4724 if (result == ISC_R_FAILURE) {
4725 printf("\n;; DSset is missing to continue validation:"
4726 " FAILED\n\n");
4727 goto cleanandgo;
4728 }
4729 if (result == ISC_R_NOTFOUND)
4730 return;
4731 INSIST(chase_dsrdataset != NULL);
4732 printf("\n;; DSset:\n");
4733 print_rdataset(&chase_authority_name , chase_dsrdataset, mctx);
4734
4735 result = advanced_rrsearch(&chase_sigdsrdataset,
4736 &chase_authority_name,
4737 dns_rdatatype_rrsig,
4738 dns_rdatatype_ds,
4739 &true);
4740 if (result != ISC_R_SUCCESS) {
4741 printf("\n;; DSset is missing to continue validation:"
4742 " FAILED\n\n");
4743 goto cleanandgo;
4744 }
4745 printf("\n;; RRSIGset of DSset\n");
4746 print_rdataset(&chase_authority_name,
4747 chase_sigdsrdataset, mctx);
4748 INSIST(chase_sigdsrdataset != NULL);
4749
4750 result = sigchase_verify_sig(&chase_authority_name,
4751 chase_dsrdataset,
4752 chase_keyrdataset,
4753 chase_sigdsrdataset, mctx);
4754 if (result != ISC_R_SUCCESS) {
4755 printf("\n;; Impossible to verify the DSset:"
4756 " FAILED\n\n");
4757 goto cleanandgo;
4758 }
4759 chase_keyrdataset = NULL;
4760 chase_sigkeyrdataset = NULL;
4761
4762
4763 prepare_lookup(&chase_authority_name);
4764
4765 have_response = ISC_FALSE;
4766 have_delegation_ns = ISC_FALSE;
4767 delegation_follow = ISC_TRUE;
4768 error_message = NULL;
4769 dup_name(&chase_authority_name, &chase_current_name, mctx);
4770 free_name(&chase_authority_name, mctx);
4771 return;
4772 }
4773
4774
4775 if (error_message != NULL) {
4776 dns_rdataset_t *rdataset;
4777 dns_rdataset_t *sigrdataset;
4778 dns_name_t rdata_name;
4779 isc_result_t ret = ISC_R_FAILURE;
4780
4781 dns_name_init(&rdata_name, NULL);
4782 result = prove_nx(error_message, &chase_name,
4783 current_lookup->rdclass_sigchase,
4784 current_lookup->rdtype_sigchase, &rdata_name,
4785 &rdataset, &sigrdataset);
4786 if (rdataset == NULL || sigrdataset == NULL ||
4787 dns_name_countlabels(&rdata_name) == 0) {
4788 printf("\n;; Impossible to verify the non-existence,"
4789 " the NSEC RRset can't be validated:"
4790 " FAILED\n\n");
4791 goto cleanandgo;
4792 }
4793 ret = sigchase_verify_sig(&rdata_name, rdataset,
4794 chase_keyrdataset,
4795 sigrdataset, mctx);
4796 if (ret != ISC_R_SUCCESS) {
4797 free_name(&rdata_name, mctx);
4798 printf("\n;; Impossible to verify the NSEC RR to prove"
4799 " the non-existence : FAILED\n\n");
4800 goto cleanandgo;
4801 }
4802 free_name(&rdata_name, mctx);
4803 if (result != ISC_R_SUCCESS) {
4804 printf("\n;; Impossible to verify the non-existence:"
4805 " FAILED\n\n");
4806 goto cleanandgo;
4807 } else {
4808 printf("\n;; OK the query doesn't have response but"
4809 " we have validate this fact : SUCCESS\n\n");
4810 goto cleanandgo;
4811 }
4812 }
4813
4814 cleanandgo:
4815 printf(";; cleanandgo \n");
4816 if (dns_name_dynamic(&chase_current_name))
4817 free_name(&chase_current_name, mctx);
4818 if (dns_name_dynamic(&chase_authority_name))
4819 free_name(&chase_authority_name, mctx);
4820 clean_trustedkey();
4821 return;
4822
4823 finalstep :
4824 result = advanced_rrsearch(&chase_rdataset, &chase_name,
4825 current_lookup->rdtype_sigchase,
4826 dns_rdatatype_any ,
4827 &true);
4828 if (result == ISC_R_FAILURE) {
4829 printf("\n;; RRsig of RRset is missing to continue validation"
4830 " SHOULD NOT APPEND: FAILED\n\n");
4831 goto cleanandgo;
4832 }
4833 result = sigchase_verify_sig(&chase_name, chase_rdataset,
4834 chase_keyrdataset,
4835 chase_sigrdataset, mctx);
4836 if (result != ISC_R_SUCCESS) {
4837 printf("\n;; Impossible to verify the RRset : FAILED\n\n");
4838 /*
4839 printf("RRset:\n");
4840 print_rdataset(&chase_name , chase_rdataset, mctx);
4841 printf("DNSKEYset:\n");
4842 print_rdataset(&chase_name , chase_keyrdataset, mctx);
4843 printf("RRSIG of RRset:\n");
4844 print_rdataset(&chase_name , chase_sigrdataset, mctx);
4845 printf("\n");
4846 */
4847 goto cleanandgo;
4848 } else {
4849 printf("\n;; The Answer:\n");
4850 print_rdataset(&chase_name , chase_rdataset, mctx);
4851
4852 printf("\n;; FINISH : we have validate the DNSSEC chain"
4853 " of trust: SUCCESS\n\n");
4854 goto cleanandgo;
4855 }
4856 }
4857
4858 #endif
4859
4860
4861 #if DIG_SIGCHASE_BU
4862
4863 isc_result_t
4864 getneededrr(dns_message_t *msg)
4865 {
4866 isc_result_t result;
4867 dns_name_t *name = NULL;
4868 dns_rdata_t sigrdata;
4869 dns_rdata_sig_t siginfo;
4870 isc_boolean_t true = ISC_TRUE;
4871
4872 if ((result = dns_message_firstname(msg, DNS_SECTION_ANSWER))
4873 != ISC_R_SUCCESS) {
4874 printf(";; NO ANSWERS: %s\n", isc_result_totext(result));
4875
4876 if (chase_name.ndata == NULL)
4877 return (ISC_R_ADDRNOTAVAIL);
4878 } else {
4879 dns_message_currentname(msg, DNS_SECTION_ANSWER, &name);
4880 }
4881
4882 /* What do we chase? */
4883 if (chase_rdataset == NULL) {
4884 result = advanced_rrsearch(&chase_rdataset, name,
4885 dns_rdatatype_any,
4886 dns_rdatatype_any, &true);
4887 if (result != ISC_R_SUCCESS) {
4888 printf("\n;; No Answers: Validation FAILED\n\n");
4889 return (ISC_R_NOTFOUND);
4890 }
4891 dup_name(name, &chase_name, mctx);
4892 printf(";; RRset to chase:\n");
4893 print_rdataset(&chase_name, chase_rdataset, mctx);
4894 }
4895 INSIST(chase_rdataset != NULL);
4896
4897
4898 if (chase_sigrdataset == NULL) {
4899 result = advanced_rrsearch(&chase_sigrdataset, name,
4900 dns_rdatatype_rrsig,
4901 chase_rdataset->type,
4902 &chase_siglookedup);
4903 if (result == ISC_R_FAILURE) {
4904 printf("\n;; RRSIG is missing for continue validation:"
4905 " FAILED\n\n");
4906 if (dns_name_dynamic(&chase_name))
4907 free_name(&chase_name, mctx);
4908 return (ISC_R_NOTFOUND);
4909 }
4910 if (result == ISC_R_NOTFOUND) {
4911 return (ISC_R_NOTFOUND);
4912 }
4913 printf("\n;; RRSIG of the RRset to chase:\n");
4914 print_rdataset(&chase_name, chase_sigrdataset, mctx);
4915 }
4916 INSIST(chase_sigrdataset != NULL);
4917
4918
4919 /* first find the DNSKEY name */
4920 result = dns_rdataset_first(chase_sigrdataset);
4921 check_result(result, "empty RRSIG dataset");
4922 dns_rdata_init(&sigrdata);
4923 dns_rdataset_current(chase_sigrdataset, &sigrdata);
4924 result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
4925 check_result(result, "sigrdata tostruct siginfo");
4926 dup_name(&siginfo.signer, &chase_signame, mctx);
4927 dns_rdata_freestruct(&siginfo);
4928 dns_rdata_reset(&sigrdata);
4929
4930 /* Do we have a key? */
4931 if (chase_keyrdataset == NULL) {
4932 result = advanced_rrsearch(&chase_keyrdataset,
4933 &chase_signame,
4934 dns_rdatatype_dnskey,
4935 dns_rdatatype_any,
4936 &chase_keylookedup);
4937 if (result == ISC_R_FAILURE) {
4938 printf("\n;; DNSKEY is missing to continue validation:"
4939 " FAILED\n\n");
4940 free_name(&chase_signame, mctx);
4941 if (dns_name_dynamic(&chase_name))
4942 free_name(&chase_name, mctx);
4943 return (ISC_R_NOTFOUND);
4944 }
4945 if (result == ISC_R_NOTFOUND) {
4946 free_name(&chase_signame, mctx);
4947 return (ISC_R_NOTFOUND);
4948 }
4949 printf("\n;; DNSKEYset that signs the RRset to chase:\n");
4950 print_rdataset(&chase_signame, chase_keyrdataset, mctx);
4951 }
4952 INSIST(chase_keyrdataset != NULL);
4953
4954 if (chase_sigkeyrdataset == NULL) {
4955 result = advanced_rrsearch(&chase_sigkeyrdataset,
4956 &chase_signame,
4957 dns_rdatatype_rrsig,
4958 dns_rdatatype_dnskey,
4959 &chase_sigkeylookedup);
4960 if (result == ISC_R_FAILURE) {
4961 printf("\n;; RRSIG for DNSKEY is missing to continue"
4962 " validation : FAILED\n\n");
4963 free_name(&chase_signame, mctx);
4964 if (dns_name_dynamic(&chase_name))
4965 free_name(&chase_name, mctx);
4966 return (ISC_R_NOTFOUND);
4967 }
4968 if (result == ISC_R_NOTFOUND) {
4969 free_name(&chase_signame, mctx);
4970 return (ISC_R_NOTFOUND);
4971 }
4972 printf("\n;; RRSIG of the DNSKEYset that signs the "
4973 "RRset to chase:\n");
4974 print_rdataset(&chase_signame, chase_sigkeyrdataset, mctx);
4975 }
4976 INSIST(chase_sigkeyrdataset != NULL);
4977
4978
4979 if (chase_dsrdataset == NULL) {
4980 result = advanced_rrsearch(&chase_dsrdataset, &chase_signame,
4981 dns_rdatatype_ds,
4982 dns_rdatatype_any,
4983 &chase_dslookedup);
4984 if (result == ISC_R_FAILURE) {
4985 printf("\n;; WARNING There is no DS for the zone: ");
4986 dns_name_print(&chase_signame, stdout);
4987 printf("\n");
4988 }
4989 if (result == ISC_R_NOTFOUND) {
4990 free_name(&chase_signame, mctx);
4991 return (ISC_R_NOTFOUND);
4992 }
4993 if (chase_dsrdataset != NULL) {
4994 printf("\n;; DSset of the DNSKEYset\n");
4995 print_rdataset(&chase_signame, chase_dsrdataset, mctx);
4996 }
4997 }
4998
4999 if (chase_dsrdataset != NULL) {
5000 /*
5001 * if there is no RRSIG of DS,
5002 * we don't want to search on the network
5003 */
5004 result = advanced_rrsearch(&chase_sigdsrdataset,
5005 &chase_signame,
5006 dns_rdatatype_rrsig,
5007 dns_rdatatype_ds, &true);
5008 if (result == ISC_R_FAILURE) {
5009 printf(";; WARNING : NO RRSIG DS : RRSIG DS"
5010 " should come with DS\n");
5011 /*
5012 * We continue even the DS couldn't be validated,
5013 * because the DNSKEY could be a Trusted Key.
5014 */
5015 chase_dsrdataset = NULL;
5016 } else {
5017 printf("\n;; RRSIG of the DSset of the DNSKEYset\n");
5018 print_rdataset(&chase_signame, chase_sigdsrdataset,
5019 mctx);
5020 }
5021 }
5022 return (1);
5023 }
5024
5025
5026
5027 void
5028 sigchase_bu(dns_message_t *msg)
5029 {
5030 isc_result_t result;
5031 int ret;
5032
5033 if (tk_list.nb_tk == 0) {
5034 result = get_trusted_key(mctx);
5035 if (result != ISC_R_SUCCESS) {
5036 printf("No trusted keys present\n");
5037 return;
5038 }
5039 }
5040
5041
5042 ret = getneededrr(msg);
5043 if (ret == ISC_R_NOTFOUND)
5044 return;
5045
5046 if (ret == ISC_R_ADDRNOTAVAIL) {
5047 /* We have no response */
5048 dns_rdataset_t *rdataset;
5049 dns_rdataset_t *sigrdataset;
5050 dns_name_t rdata_name;
5051 dns_name_t query_name;
5052
5053
5054 dns_name_init(&query_name, NULL);
5055 dns_name_init(&rdata_name, NULL);
5056 nameFromString(current_lookup->textname, &query_name);
5057
5058 result = prove_nx(msg, &query_name, current_lookup->rdclass,
5059 current_lookup->rdtype, &rdata_name,
5060 &rdataset, &sigrdataset);
5061 free_name(&query_name, mctx);
5062 if (rdataset == NULL || sigrdataset == NULL ||
5063 dns_name_countlabels(&rdata_name) == 0) {
5064 printf("\n;; Impossible to verify the Non-existence,"
5065 " the NSEC RRset can't be validated: "
5066 "FAILED\n\n");
5067 clean_trustedkey();
5068 return;
5069 }
5070
5071 if (result != ISC_R_SUCCESS) {
5072 printf("\n No Answers and impossible to prove the"
5073 " unsecurity : Validation FAILED\n\n");
5074 clean_trustedkey();
5075 return;
5076 }
5077 printf(";; An NSEC prove the non-existence of a answers,"
5078 " Now we want validate this NSEC\n");
5079
5080 dup_name(&rdata_name, &chase_name, mctx);
5081 free_name(&rdata_name, mctx);
5082 chase_rdataset = rdataset;
5083 chase_sigrdataset = sigrdataset;
5084 chase_keyrdataset = NULL;
5085 chase_sigkeyrdataset = NULL;
5086 chase_dsrdataset = NULL;
5087 chase_sigdsrdataset = NULL;
5088 chase_siglookedup = ISC_FALSE;
5089 chase_keylookedup = ISC_FALSE;
5090 chase_dslookedup = ISC_FALSE;
5091 chase_sigdslookedup = ISC_FALSE;
5092 sigchase(msg);
5093 clean_trustedkey();
5094 return;
5095 }
5096
5097
5098 printf("\n\n\n;; WE HAVE MATERIAL, WE NOW DO VALIDATION\n");
5099
5100 result = sigchase_verify_sig(&chase_name, chase_rdataset,
5101 chase_keyrdataset,
5102 chase_sigrdataset, mctx);
5103 if (result != ISC_R_SUCCESS) {
5104 free_name(&chase_name, mctx);
5105 free_name(&chase_signame, mctx);
5106 printf(";; No DNSKEY is valid to check the RRSIG"
5107 " of the RRset: FAILED\n");
5108 clean_trustedkey();
5109 return;
5110 }
5111 printf(";; OK We found DNSKEY (or more) to validate the RRset\n");
5112
5113 result = contains_trusted_key(&chase_signame, chase_keyrdataset,
5114 chase_sigkeyrdataset, mctx);
5115 if (result == ISC_R_SUCCESS) {
5116 free_name(&chase_name, mctx);
5117 free_name(&chase_signame, mctx);
5118 printf("\n;; Ok this DNSKEY is a Trusted Key,"
5119 " DNSSEC validation is ok: SUCCESS\n\n");
5120 clean_trustedkey();
5121 return;
5122 }
5123
5124 printf(";; Now, we are going to validate this DNSKEY by the DS\n");
5125
5126 if (chase_dsrdataset == NULL) {
5127 free_name(&chase_name, mctx);
5128 free_name(&chase_signame, mctx);
5129 printf(";; the DNSKEY isn't trusted-key and there isn't"
5130 " DS to validate the DNSKEY: FAILED\n");
5131 clean_trustedkey();
5132 return;
5133 }
5134
5135 result = sigchase_verify_ds(&chase_signame, chase_keyrdataset,
5136 chase_dsrdataset, mctx);
5137 if (result != ISC_R_SUCCESS) {
5138 free_name(&chase_signame, mctx);
5139 free_name(&chase_name, mctx);
5140 printf(";; ERROR no DS validates a DNSKEY in the"
5141 " DNSKEY RRset: FAILED\n");
5142 clean_trustedkey();
5143 return;
5144 } else
5145 printf(";; OK this DNSKEY (validated by the DS) validates"
5146 " the RRset of the DNSKEYs, thus the DNSKEY validates"
5147 " the RRset\n");
5148 INSIST(chase_sigdsrdataset != NULL);
5149
5150 dup_name(&chase_signame, &chase_name, mctx);
5151 free_name(&chase_signame, mctx);
5152 chase_rdataset = chase_dsrdataset;
5153 chase_sigrdataset = chase_sigdsrdataset;
5154 chase_keyrdataset = NULL;
5155 chase_sigkeyrdataset = NULL;
5156 chase_dsrdataset = NULL;
5157 chase_sigdsrdataset = NULL;
5158 chase_siglookedup = chase_keylookedup = ISC_FALSE;
5159 chase_dslookedup = chase_sigdslookedup = ISC_FALSE;
5160
5161 printf(";; Now, we want to validate the DS : recursive call\n");
5162 sigchase(msg);
5163 return;
5164 }
5165 #endif
5166
5167 void
5168 sigchase(dns_message_t *msg) {
5169 #if DIG_SIGCHASE_TD
5170 if (current_lookup->do_topdown) {
5171 sigchase_td(msg);
5172 return;
5173 }
5174 #endif
5175 #if DIG_SIGCHASE_BU
5176 sigchase_bu(msg);
5177 return;
5178 #endif
5179 }
5180
5181
5182 /*
5183 * return 1 if name1 < name2
5184 * 0 if name1 == name2
5185 * -1 if name1 > name2
5186 * and -2 if problem
5187 */
5188 int
5189 inf_name(dns_name_t *name1, dns_name_t *name2)
5190 {
5191 dns_label_t label1;
5192 dns_label_t label2;
5193 unsigned int nblabel1;
5194 unsigned int nblabel2;
5195 int min_lum_label;
5196 int i;
5197 int ret = -2;
5198
5199 nblabel1 = dns_name_countlabels(name1);
5200 nblabel2 = dns_name_countlabels(name2);
5201
5202 if (nblabel1 >= nblabel2)
5203 min_lum_label = nblabel2;
5204 else
5205 min_lum_label = nblabel1;
5206
5207
5208 for (i=1 ; i < min_lum_label; i++) {
5209 dns_name_getlabel(name1, nblabel1 -1 - i, &label1);
5210 dns_name_getlabel(name2, nblabel2 -1 - i, &label2);
5211 if ((ret = isc_region_compare(&label1, &label2)) != 0) {
5212 if (ret < 0)
5213 return (-1);
5214 else if (ret > 0)
5215 return (1);
5216 }
5217 }
5218 if (nblabel1 == nblabel2)
5219 return (0);
5220
5221 if (nblabel1 < nblabel2)
5222 return (-1);
5223 else
5224 return (1);
5225 }
5226
5227 /**
5228 *
5229 *
5230 *
5231 */
5232 isc_result_t
5233 prove_nx_domain(dns_message_t *msg,
5234 dns_name_t *name,
5235 dns_name_t *rdata_name,
5236 dns_rdataset_t **rdataset,
5237 dns_rdataset_t **sigrdataset)
5238 {
5239 isc_result_t ret = ISC_R_FAILURE;
5240 isc_result_t result = ISC_R_NOTFOUND;
5241 dns_rdataset_t *nsecset = NULL;
5242 dns_rdataset_t *signsecset = NULL ;
5243 dns_rdata_t nsec = DNS_RDATA_INIT;
5244 dns_name_t *nsecname;
5245 dns_rdata_nsec_t nsecstruct;
5246
5247 if ((result = dns_message_firstname(msg, DNS_SECTION_AUTHORITY))
5248 != ISC_R_SUCCESS) {
5249 printf(";; nothing in authority section : impossible to"
5250 " validate the non-existence : FAILED\n");
5251 return (ISC_R_FAILURE);
5252 }
5253
5254 do {
5255 nsecname = NULL;
5256 dns_message_currentname(msg, DNS_SECTION_AUTHORITY, &nsecname);
5257 nsecset = search_type(nsecname, dns_rdatatype_nsec,
5258 dns_rdatatype_any);
5259 if (nsecset == NULL)
5260 continue;
5261
5262 printf("There is a NSEC for this zone in the"
5263 " AUTHORITY section:\n");
5264 print_rdataset(nsecname, nsecset, mctx);
5265
5266 for (result = dns_rdataset_first(nsecset);
5267 result == ISC_R_SUCCESS;
5268 result = dns_rdataset_next(nsecset)) {
5269 dns_rdataset_current(nsecset, &nsec);
5270
5271
5272 signsecset
5273 = chase_scanname_section(msg, nsecname,
5274 dns_rdatatype_rrsig,
5275 dns_rdatatype_nsec,
5276 DNS_SECTION_AUTHORITY);
5277 if (signsecset == NULL) {
5278 printf(";; no RRSIG NSEC in authority section:"
5279 " impossible to validate the "
5280 "non-existence: FAILED\n");
5281 return (ISC_R_FAILURE);
5282 }
5283
5284 ret = dns_rdata_tostruct(&nsec, &nsecstruct, NULL);
5285 check_result(ret,"dns_rdata_tostruct");
5286
5287 if ((inf_name(nsecname, &nsecstruct.next) == 1 &&
5288 inf_name(name, &nsecstruct.next) == 1) ||
5289 (inf_name(name, nsecname) == 1 &&
5290 inf_name(&nsecstruct.next, name) == 1)) {
5291 dns_rdata_freestruct(&nsecstruct);
5292 *rdataset = nsecset;
5293 *sigrdataset = signsecset;
5294 dup_name(nsecname, rdata_name, mctx);
5295
5296 return (ISC_R_SUCCESS);
5297 }
5298
5299 dns_rdata_freestruct(&nsecstruct);
5300 }
5301 } while (dns_message_nextname(msg, DNS_SECTION_AUTHORITY)
5302 == ISC_R_SUCCESS);
5303
5304 *rdataset = NULL;
5305 *sigrdataset = NULL;
5306 rdata_name = NULL;
5307 return (ISC_R_FAILURE);
5308 }
5309
5310 /**
5311 *
5312 *
5313 *
5314 *
5315 *
5316 */
5317 isc_result_t
5318 prove_nx_type(dns_message_t *msg, dns_name_t *name, dns_rdataset_t *nsecset,
5319 dns_rdataclass_t class, dns_rdatatype_t type,
5320 dns_name_t *rdata_name, dns_rdataset_t **rdataset,
5321 dns_rdataset_t **sigrdataset)
5322 {
5323 isc_result_t ret;
5324 dns_rdataset_t *signsecset;
5325 dns_rdata_t nsec = DNS_RDATA_INIT;
5326
5327 UNUSED(class);
5328
5329 ret = dns_rdataset_first(nsecset);
5330 check_result(ret,"dns_rdataset_first");
5331
5332 dns_rdataset_current(nsecset, &nsec);
5333
5334 ret = dns_nsec_typepresent(&nsec, type);
5335 if (ret == ISC_R_SUCCESS)
5336 printf("OK the NSEC said that the type doesn't exist \n");
5337
5338 signsecset = chase_scanname_section(msg, name,
5339 dns_rdatatype_rrsig,
5340 dns_rdatatype_nsec,
5341 DNS_SECTION_AUTHORITY);
5342 if (signsecset == NULL) {
5343 printf("There isn't RRSIG NSEC for the zone \n");
5344 return (ISC_R_FAILURE);
5345 }
5346 dup_name(name, rdata_name, mctx);
5347 *rdataset = nsecset;
5348 *sigrdataset = signsecset;
5349
5350 return (ret);
5351 }
5352
5353 /**
5354 *
5355 *
5356 *
5357 *
5358 */
5359 isc_result_t
5360 prove_nx(dns_message_t *msg, dns_name_t *name, dns_rdataclass_t class,
5361 dns_rdatatype_t type, dns_name_t *rdata_name,
5362 dns_rdataset_t **rdataset, dns_rdataset_t **sigrdataset)
5363 {
5364 isc_result_t ret;
5365 dns_rdataset_t *nsecset = NULL;
5366
5367 printf("We want to prove the non-existance of a type of rdata %d"
5368 " or of the zone: \n", type);
5369
5370 if ((ret = dns_message_firstname(msg, DNS_SECTION_AUTHORITY))
5371 != ISC_R_SUCCESS) {
5372 printf(";; nothing in authority section : impossible to"
5373 " validate the non-existence : FAILED\n");
5374 return (ISC_R_FAILURE);
5375 }
5376
5377 nsecset = chase_scanname_section(msg, name, dns_rdatatype_nsec,
5378 dns_rdatatype_any,
5379 DNS_SECTION_AUTHORITY);
5380 if (nsecset != NULL) {
5381 printf("We have a NSEC for this zone :OK\n");
5382 ret = prove_nx_type(msg, name, nsecset, class,
5383 type, rdata_name, rdataset,
5384 sigrdataset);
5385 if (ret != ISC_R_SUCCESS) {
5386 printf("prove_nx: ERROR type exist\n");
5387 return (ret);
5388 } else {
5389 printf("prove_nx: OK type does not exist\n");
5390 return (ISC_R_SUCCESS);
5391 }
5392 } else {
5393 printf("there is no NSEC for this zone: validating "
5394 "that the zone doesn't exist\n");
5395 ret = prove_nx_domain(msg, name, rdata_name,
5396 rdataset, sigrdataset);
5397 return (ret);
5398 }
5399 /* Never get here */
5400 }
5401 #endif
FreeBSD kvm: FreeBSD sources