?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
acpi.4: Add some missing references.
[dragonfly.git] / contrib / bind-9.3 / bin / dig / dighost.c
blob398711d4f1cd136611a3687df029da8142de08e5
1 /*
2 * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
3 * Copyright (C) 2000-2003 Internet Software Consortium.
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
10 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
11 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
12 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
13 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
15 * PERFORMANCE OF THIS SOFTWARE.
16 */
17
18 /* $Id: dighost.c,v 1.221.2.19.2.36 2006/12/07 01:26:33 marka Exp $ */
19
20 /*
21 * Notice to programmers: Do not use this code as an example of how to
22 * use the ISC library to perform DNS lookups. Dig and Host both operate
23 * on the request level, since they allow fine-tuning of output and are
24 * intended as debugging tools. As a result, they perform many of the
25 * functions which could be better handled using the dns_resolver
26 * functions in most applications.
27 */
28
29 #include <config.h>
30 #include <stdlib.h>
31 #include <unistd.h>
32 #include <string.h>
33 #include <limits.h>
34
35 #include <dns/byaddr.h>
36 #ifdef DIG_SIGCHASE
37 #include <dns/dnssec.h>
38 #include <dns/ds.h>
39 #include <dns/nsec.h>
40 #include <isc/random.h>
41 #include <ctype.h>
42 #endif
43 #include <dns/fixedname.h>
44 #include <dns/message.h>
45 #include <dns/name.h>
46 #include <dns/rdata.h>
47 #include <dns/rdataclass.h>
48 #include <dns/rdatalist.h>
49 #include <dns/rdataset.h>
50 #include <dns/rdatastruct.h>
51 #include <dns/rdatatype.h>
52 #include <dns/result.h>
53 #include <dns/tsig.h>
54
55 #include <dst/dst.h>
56
57 #include <isc/app.h>
58 #include <isc/base64.h>
59 #include <isc/entropy.h>
60 #include <isc/file.h>
61 #include <isc/lang.h>
62 #include <isc/netaddr.h>
63 #ifdef DIG_SIGCHASE
64 #include <isc/netdb.h>
65 #endif
66 #include <isc/print.h>
67 #include <isc/random.h>
68 #include <isc/result.h>
69 #include <isc/string.h>
70 #include <isc/task.h>
71 #include <isc/timer.h>
72 #include <isc/types.h>
73 #include <isc/util.h>
74
75 #include <lwres/lwres.h>
76 #include <lwres/net.h>
77
78 #include <bind9/getaddresses.h>
79
80 #include <dig/dig.h>
81
82 #if ! defined(NS_INADDRSZ)
83 #define NS_INADDRSZ 4
84 #endif
85
86 #if ! defined(NS_IN6ADDRSZ)
87 #define NS_IN6ADDRSZ 16
88 #endif
89
90 static lwres_context_t *lwctx = NULL;
91 static lwres_conf_t *lwconf;
92
93 dig_lookuplist_t lookup_list;
94 dig_serverlist_t server_list;
95 dig_searchlistlist_t search_list;
96
97 isc_boolean_t
98 have_ipv4 = ISC_FALSE,
99 have_ipv6 = ISC_FALSE,
100 specified_source = ISC_FALSE,
101 free_now = ISC_FALSE,
102 cancel_now = ISC_FALSE,
103 usesearch = ISC_FALSE,
104 qr = ISC_FALSE,
105 is_dst_up = ISC_FALSE;
106 in_port_t port = 53;
107 unsigned int timeout = 0;
108 isc_mem_t *mctx = NULL;
109 isc_taskmgr_t *taskmgr = NULL;
110 isc_task_t *global_task = NULL;
111 isc_timermgr_t *timermgr = NULL;
112 isc_socketmgr_t *socketmgr = NULL;
113 isc_sockaddr_t bind_address;
114 isc_sockaddr_t bind_any;
115 int sendcount = 0;
116 int recvcount = 0;
117 int sockcount = 0;
118 int ndots = -1;
119 int tries = 3;
120 int lookup_counter = 0;
121
122 /*
123 * Exit Codes:
124 * 0 Everything went well, including things like NXDOMAIN
125 * 1 Usage error
126 * 7 Got too many RR's or Names
127 * 8 Couldn't open batch file
128 * 9 No reply from server
129 * 10 Internal error
130 */
131 int exitcode = 0;
132 int fatalexit = 0;
133 char keynametext[MXNAME];
134 char keyfile[MXNAME] = "";
135 char keysecret[MXNAME] = "";
136 isc_buffer_t *namebuf = NULL;
137 dns_tsigkey_t *key = NULL;
138 isc_boolean_t validated = ISC_TRUE;
139 isc_entropy_t *entp = NULL;
140 isc_mempool_t *commctx = NULL;
141 isc_boolean_t debugging = ISC_FALSE;
142 isc_boolean_t memdebugging = ISC_FALSE;
143 char *progname = NULL;
144 isc_mutex_t lookup_lock;
145 dig_lookup_t *current_lookup = NULL;
146
147 #ifdef DIG_SIGCHASE
148
149 isc_result_t get_trusted_key(isc_mem_t *mctx);
150 dns_rdataset_t * sigchase_scanname(dns_rdatatype_t type,
151 dns_rdatatype_t covers,
152 isc_boolean_t *lookedup,
153 dns_name_t *rdata_name);
154 dns_rdataset_t * chase_scanname_section(dns_message_t *msg,
155 dns_name_t *name,
156 dns_rdatatype_t type,
157 dns_rdatatype_t covers,
158 int section);
159 isc_result_t advanced_rrsearch(dns_rdataset_t **rdataset,
160 dns_name_t *name,
161 dns_rdatatype_t type,
162 dns_rdatatype_t covers,
163 isc_boolean_t *lookedup);
164 isc_result_t sigchase_verify_sig_key(dns_name_t *name,
165 dns_rdataset_t *rdataset,
166 dst_key_t* dnsseckey,
167 dns_rdataset_t *sigrdataset,
168 isc_mem_t *mctx);
169 isc_result_t sigchase_verify_sig(dns_name_t *name,
170 dns_rdataset_t *rdataset,
171 dns_rdataset_t *keyrdataset,
172 dns_rdataset_t *sigrdataset,
173 isc_mem_t *mctx);
174 isc_result_t sigchase_verify_ds(dns_name_t *name,
175 dns_rdataset_t *keyrdataset,
176 dns_rdataset_t *dsrdataset,
177 isc_mem_t *mctx);
178 void sigchase(dns_message_t *msg);
179 void print_rdata(dns_rdata_t *rdata, isc_mem_t *mctx);
180 void print_rdataset(dns_name_t *name,
181 dns_rdataset_t *rdataset, isc_mem_t *mctx);
182 void dup_name(dns_name_t *source, dns_name_t* target,
183 isc_mem_t *mctx);
184 void free_name(dns_name_t *name, isc_mem_t *mctx);
185 void dump_database(void);
186 void dump_database_section(dns_message_t *msg, int section);
187 dns_rdataset_t * search_type(dns_name_t *name, dns_rdatatype_t type,
188 dns_rdatatype_t covers);
189 isc_result_t contains_trusted_key(dns_name_t *name,
190 dns_rdataset_t *rdataset,
191 dns_rdataset_t *sigrdataset,
192 isc_mem_t *mctx);
193 void print_type(dns_rdatatype_t type);
194 isc_result_t prove_nx_domain(dns_message_t * msg,
195 dns_name_t * name,
196 dns_name_t * rdata_name,
197 dns_rdataset_t ** rdataset,
198 dns_rdataset_t ** sigrdataset);
199 isc_result_t prove_nx_type(dns_message_t * msg, dns_name_t *name,
200 dns_rdataset_t *nsec,
201 dns_rdataclass_t class,
202 dns_rdatatype_t type,
203 dns_name_t * rdata_name,
204 dns_rdataset_t ** rdataset,
205 dns_rdataset_t ** sigrdataset);
206 isc_result_t prove_nx(dns_message_t * msg, dns_name_t * name,
207 dns_rdataclass_t class,
208 dns_rdatatype_t type,
209 dns_name_t * rdata_name,
210 dns_rdataset_t ** rdataset,
211 dns_rdataset_t ** sigrdataset);
212 static void nameFromString(const char *str, dns_name_t *p_ret);
213 int inf_name(dns_name_t * name1, dns_name_t * name2);
214 isc_result_t opentmpkey(isc_mem_t *mctx, const char *file,
215 char **tempp, FILE **fp);
216 isc_result_t removetmpkey(isc_mem_t *mctx, const char *file);
217 void clean_trustedkey(void);
218 void insert_trustedkey(dst_key_t * key);
219 #if DIG_SIGCHASE_BU
220 isc_result_t getneededrr(dns_message_t *msg);
221 void sigchase_bottom_up(dns_message_t *msg);
222 void sigchase_bu(dns_message_t *msg);
223 #endif
224 #if DIG_SIGCHASE_TD
225 isc_result_t initialization(dns_name_t *name);
226 isc_result_t prepare_lookup(dns_name_t *name);
227 isc_result_t grandfather_pb_test(dns_name_t * zone_name,
228 dns_rdataset_t *sigrdataset);
229 isc_result_t child_of_zone(dns_name_t *name,
230 dns_name_t *zone_name,
231 dns_name_t *child_name);
232 void sigchase_td(dns_message_t *msg);
233 #endif
234 char trustedkey[MXNAME] = "";
235
236 dns_rdataset_t *chase_rdataset = NULL;
237 dns_rdataset_t *chase_sigrdataset = NULL;
238 dns_rdataset_t *chase_dsrdataset = NULL;
239 dns_rdataset_t *chase_sigdsrdataset = NULL;
240 dns_rdataset_t *chase_keyrdataset = NULL;
241 dns_rdataset_t *chase_sigkeyrdataset = NULL;
242 dns_rdataset_t *chase_nsrdataset = NULL;
243
244 dns_name_t chase_name; /* the query name */
245 #if DIG_SIGCHASE_TD
246 /*
247 * the current name is the parent name when we follow delegation
248 */
249 dns_name_t chase_current_name;
250 /*
251 * the child name is used for delegation (NS DS responses in AUTHORITY section)
252 */
253 dns_name_t chase_authority_name;
254 #endif
255 #if DIG_SIGCHASE_BU
256 dns_name_t chase_signame;
257 #endif
258
259
260 isc_boolean_t chase_siglookedup = ISC_FALSE;
261 isc_boolean_t chase_keylookedup = ISC_FALSE;
262 isc_boolean_t chase_sigkeylookedup = ISC_FALSE;
263 isc_boolean_t chase_dslookedup = ISC_FALSE;
264 isc_boolean_t chase_sigdslookedup = ISC_FALSE;
265 #if DIG_SIGCHASE_TD
266 isc_boolean_t chase_nslookedup = ISC_FALSE;
267 isc_boolean_t chase_lookedup = ISC_FALSE;
268
269
270 isc_boolean_t delegation_follow = ISC_FALSE;
271 isc_boolean_t grandfather_pb = ISC_FALSE;
272 isc_boolean_t have_response = ISC_FALSE;
273 isc_boolean_t have_delegation_ns = ISC_FALSE;
274 dns_message_t * error_message = NULL;
275 #endif
276
277 isc_boolean_t dsvalidating = ISC_FALSE;
278 isc_boolean_t chase_name_dup = ISC_FALSE;
279
280 ISC_LIST(dig_message_t) chase_message_list;
281 ISC_LIST(dig_message_t) chase_message_list2;
282
283
284 #define MAX_TRUSTED_KEY 5
285 typedef struct struct_trusted_key_list {
286 dst_key_t * key[MAX_TRUSTED_KEY];
287 int nb_tk;
288 } struct_tk_list;
289
290 struct_tk_list tk_list = { {NULL, NULL, NULL, NULL, NULL}, 0};
291
292 #endif
293
294 #define DIG_MAX_ADDRESSES 20
295
296 /*
297 * Apply and clear locks at the event level in global task.
298 * Can I get rid of these using shutdown events? XXX
299 */
300 #define LOCK_LOOKUP {\
301 debug("lock_lookup %s:%d", __FILE__, __LINE__);\
302 check_result(isc_mutex_lock((&lookup_lock)), "isc_mutex_lock");\
303 debug("success");\
304 }
305 #define UNLOCK_LOOKUP {\
306 debug("unlock_lookup %s:%d", __FILE__, __LINE__);\
307 check_result(isc_mutex_unlock((&lookup_lock)),\
308 "isc_mutex_unlock");\
309 }
310
311 static void
312 cancel_lookup(dig_lookup_t *lookup);
313
314 static void
315 recv_done(isc_task_t *task, isc_event_t *event);
316
317 static void
318 send_udp(dig_query_t *query);
319
320 static void
321 connect_timeout(isc_task_t *task, isc_event_t *event);
322
323 static void
324 launch_next_query(dig_query_t *query, isc_boolean_t include_question);
325
326
327 static void *
328 mem_alloc(void *arg, size_t size) {
329 return (isc_mem_get(arg, size));
330 }
331
332 static void
333 mem_free(void *arg, void *mem, size_t size) {
334 isc_mem_put(arg, mem, size);
335 }
336
337 char *
338 next_token(char **stringp, const char *delim) {
339 char *res;
340
341 do {
342 res = strsep(stringp, delim);
343 if (res == NULL)
344 break;
345 } while (*res == '\0');
346 return (res);
347 }
348
349 static int
350 count_dots(char *string) {
351 char *s;
352 int i = 0;
353
354 s = string;
355 while (*s != '\0') {
356 if (*s == '.')
357 i++;
358 s++;
359 }
360 return (i);
361 }
362
363 static void
364 hex_dump(isc_buffer_t *b) {
365 unsigned int len;
366 isc_region_t r;
367
368 isc_buffer_usedregion(b, &r);
369
370 printf("%d bytes\n", r.length);
371 for (len = 0; len < r.length; len++) {
372 printf("%02x ", r.base[len]);
373 if (len % 16 == 15)
374 printf("\n");
375 }
376 if (len % 16 != 0)
377 printf("\n");
378 }
379
380 /*
381 * Append 'len' bytes of 'text' at '*p', failing with
382 * ISC_R_NOSPACE if that would advance p past 'end'.
383 */
384 static isc_result_t
385 append(const char *text, int len, char **p, char *end) {
386 if (len > end - *p)
387 return (ISC_R_NOSPACE);
388 memcpy(*p, text, len);
389 *p += len;
390 return (ISC_R_SUCCESS);
391 }
392
393 static isc_result_t
394 reverse_octets(const char *in, char **p, char *end) {
395 char *dot = strchr(in, '.');
396 int len;
397 if (dot != NULL) {
398 isc_result_t result;
399 result = reverse_octets(dot + 1, p, end);
400 if (result != ISC_R_SUCCESS)
401 return (result);
402 result = append(".", 1, p, end);
403 if (result != ISC_R_SUCCESS)
404 return (result);
405 len = dot - in;
406 } else {
407 len = strlen(in);
408 }
409 return (append(in, len, p, end));
410 }
411
412 isc_result_t
413 get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,
414 isc_boolean_t strict)
415 {
416 int r;
417 isc_result_t result;
418 isc_netaddr_t addr;
419
420 addr.family = AF_INET6;
421 r = inet_pton(AF_INET6, value, &addr.type.in6);
422 if (r > 0) {
423 /* This is a valid IPv6 address. */
424 dns_fixedname_t fname;
425 dns_name_t *name;
426 unsigned int options = 0;
427
428 if (ip6_int)
429 options |= DNS_BYADDROPT_IPV6INT;
430 dns_fixedname_init(&fname);
431 name = dns_fixedname_name(&fname);
432 result = dns_byaddr_createptrname2(&addr, options, name);
433 if (result != ISC_R_SUCCESS)
434 return (result);
435 dns_name_format(name, reverse, len);
436 return (ISC_R_SUCCESS);
437 } else {
438 /*
439 * Not a valid IPv6 address. Assume IPv4.
440 * If 'strict' is not set, construct the
441 * in-addr.arpa name by blindly reversing
442 * octets whether or not they look like integers,
443 * so that this can be used for RFC2317 names
444 * and such.
445 */
446 char *p = reverse;
447 char *end = reverse + len;
448 if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1)
449 return (DNS_R_BADDOTTEDQUAD);
450 result = reverse_octets(value, &p, end);
451 if (result != ISC_R_SUCCESS)
452 return (result);
453 /* Append .in-addr.arpa. and a terminating NUL. */
454 result = append(".in-addr.arpa.", 15, &p, end);
455 if (result != ISC_R_SUCCESS)
456 return (result);
457 return (ISC_R_SUCCESS);
458 }
459 }
460
461 void
462 fatal(const char *format, ...) {
463 va_list args;
464
465 fprintf(stderr, "%s: ", progname);
466 va_start(args, format);
467 vfprintf(stderr, format, args);
468 va_end(args);
469 fprintf(stderr, "\n");
470 if (exitcode < 10)
471 exitcode = 10;
472 if (fatalexit != 0)
473 exitcode = fatalexit;
474 exit(exitcode);
475 }
476
477 void
478 debug(const char *format, ...) {
479 va_list args;
480
481 if (debugging) {
482 va_start(args, format);
483 vfprintf(stderr, format, args);
484 va_end(args);
485 fprintf(stderr, "\n");
486 }
487 }
488
489 void
490 check_result(isc_result_t result, const char *msg) {
491 if (result != ISC_R_SUCCESS) {
492 fatal("%s: %s", msg, isc_result_totext(result));
493 }
494 }
495
496 /*
497 * Create a server structure, which is part of the lookup structure.
498 * This is little more than a linked list of servers to query in hopes
499 * of finding the answer the user is looking for
500 */
501 dig_server_t *
502 make_server(const char *servname, const char *userarg) {
503 dig_server_t *srv;
504
505 REQUIRE(servname != NULL);
506
507 debug("make_server(%s)", servname);
508 srv = isc_mem_allocate(mctx, sizeof(struct dig_server));
509 if (srv == NULL)
510 fatal("memory allocation failure in %s:%d",
511 __FILE__, __LINE__);
512 strncpy(srv->servername, servname, MXNAME);
513 strncpy(srv->userarg, userarg, MXNAME);
514 srv->servername[MXNAME-1] = 0;
515 srv->userarg[MXNAME-1] = 0;
516 ISC_LINK_INIT(srv, link);
517 return (srv);
518 }
519
520 static int
521 addr2af(int lwresaddrtype)
522 {
523 int af = 0;
524
525 switch (lwresaddrtype) {
526 case LWRES_ADDRTYPE_V4:
527 af = AF_INET;
528 break;
529
530 case LWRES_ADDRTYPE_V6:
531 af = AF_INET6;
532 break;
533 }
534
535 return (af);
536 }
537
538 /*
539 * Create a copy of the server list from the lwres configuration structure.
540 * The dest list must have already had ISC_LIST_INIT applied.
541 */
542 static void
543 copy_server_list(lwres_conf_t *confdata, dig_serverlist_t *dest) {
544 dig_server_t *newsrv;
545 char tmp[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
546 int af;
547 int i;
548
549 debug("copy_server_list()");
550 for (i = 0; i < confdata->nsnext; i++) {
551 af = addr2af(confdata->nameservers[i].family);
552
553 lwres_net_ntop(af, confdata->nameservers[i].address,
554 tmp, sizeof(tmp));
555 newsrv = make_server(tmp, tmp);
556 ISC_LINK_INIT(newsrv, link);
557 ISC_LIST_ENQUEUE(*dest, newsrv, link);
558 }
559 }
560
561 void
562 flush_server_list(void) {
563 dig_server_t *s, *ps;
564
565 debug("flush_server_list()");
566 s = ISC_LIST_HEAD(server_list);
567 while (s != NULL) {
568 ps = s;
569 s = ISC_LIST_NEXT(s, link);
570 ISC_LIST_DEQUEUE(server_list, ps, link);
571 isc_mem_free(mctx, ps);
572 }
573 }
574
575 void
576 set_nameserver(char *opt) {
577 isc_result_t result;
578 isc_sockaddr_t sockaddrs[DIG_MAX_ADDRESSES];
579 isc_netaddr_t netaddr;
580 int count, i;
581 dig_server_t *srv;
582 char tmp[ISC_NETADDR_FORMATSIZE];
583
584 if (opt == NULL)
585 return;
586
587 result = bind9_getaddresses(opt, 0, sockaddrs,
588 DIG_MAX_ADDRESSES, &count);
589 if (result != ISC_R_SUCCESS)
590 fatal("couldn't get address for '%s': %s",
591 opt, isc_result_totext(result));
592
593 flush_server_list();
594
595 for (i = 0; i < count; i++) {
596 isc_netaddr_fromsockaddr(&netaddr, &sockaddrs[i]);
597 isc_netaddr_format(&netaddr, tmp, sizeof(tmp));
598 srv = make_server(tmp, opt);
599 if (srv == NULL)
600 fatal("memory allocation failure");
601 ISC_LIST_APPEND(server_list, srv, link);
602 }
603 }
604
605 static isc_result_t
606 add_nameserver(lwres_conf_t *confdata, const char *addr, int af) {
607
608 int i = confdata->nsnext;
609
610 if (confdata->nsnext >= LWRES_CONFMAXNAMESERVERS)
611 return (ISC_R_FAILURE);
612
613 switch (af) {
614 case AF_INET:
615 confdata->nameservers[i].family = LWRES_ADDRTYPE_V4;
616 confdata->nameservers[i].length = NS_INADDRSZ;
617 break;
618 case AF_INET6:
619 confdata->nameservers[i].family = LWRES_ADDRTYPE_V6;
620 confdata->nameservers[i].length = NS_IN6ADDRSZ;
621 break;
622 default:
623 return (ISC_R_FAILURE);
624 }
625
626 if (lwres_net_pton(af, addr, &confdata->nameservers[i].address) == 1) {
627 confdata->nsnext++;
628 return (ISC_R_SUCCESS);
629 }
630 return (ISC_R_FAILURE);
631 }
632
633 /*
634 * Produce a cloned server list. The dest list must have already had
635 * ISC_LIST_INIT applied.
636 */
637 void
638 clone_server_list(dig_serverlist_t src, dig_serverlist_t *dest) {
639 dig_server_t *srv, *newsrv;
640
641 debug("clone_server_list()");
642 srv = ISC_LIST_HEAD(src);
643 while (srv != NULL) {
644 newsrv = make_server(srv->servername, srv->userarg);
645 ISC_LINK_INIT(newsrv, link);
646 ISC_LIST_ENQUEUE(*dest, newsrv, link);
647 srv = ISC_LIST_NEXT(srv, link);
648 }
649 }
650
651 /*
652 * Create an empty lookup structure, which holds all the information needed
653 * to get an answer to a user's question. This structure contains two
654 * linked lists: the server list (servers to query) and the query list
655 * (outstanding queries which have been made to the listed servers).
656 */
657 dig_lookup_t *
658 make_empty_lookup(void) {
659 dig_lookup_t *looknew;
660
661 debug("make_empty_lookup()");
662
663 INSIST(!free_now);
664
665 looknew = isc_mem_allocate(mctx, sizeof(struct dig_lookup));
666 if (looknew == NULL)
667 fatal("memory allocation failure in %s:%d",
668 __FILE__, __LINE__);
669 looknew->pending = ISC_TRUE;
670 looknew->textname[0] = 0;
671 looknew->cmdline[0] = 0;
672 looknew->rdtype = dns_rdatatype_a;
673 looknew->qrdtype = dns_rdatatype_a;
674 looknew->rdclass = dns_rdataclass_in;
675 looknew->rdtypeset = ISC_FALSE;
676 looknew->rdclassset = ISC_FALSE;
677 looknew->sendspace = NULL;
678 looknew->sendmsg = NULL;
679 looknew->name = NULL;
680 looknew->oname = NULL;
681 looknew->timer = NULL;
682 looknew->xfr_q = NULL;
683 looknew->current_query = NULL;
684 looknew->doing_xfr = ISC_FALSE;
685 looknew->ixfr_serial = ISC_FALSE;
686 looknew->trace = ISC_FALSE;
687 looknew->trace_root = ISC_FALSE;
688 looknew->identify = ISC_FALSE;
689 looknew->identify_previous_line = ISC_FALSE;
690 looknew->ignore = ISC_FALSE;
691 looknew->servfail_stops = ISC_TRUE;
692 looknew->besteffort = ISC_TRUE;
693 looknew->dnssec = ISC_FALSE;
694 #ifdef DIG_SIGCHASE
695 looknew->sigchase = ISC_FALSE;
696 #if DIG_SIGCHASE_TD
697 looknew->do_topdown = ISC_FALSE;
698 looknew->trace_root_sigchase = ISC_FALSE;
699 looknew->rdtype_sigchaseset = ISC_FALSE;
700 looknew->rdtype_sigchase = dns_rdatatype_any;
701 looknew->qrdtype_sigchase = dns_rdatatype_any;
702 looknew->rdclass_sigchase = dns_rdataclass_in;
703 looknew->rdclass_sigchaseset = ISC_FALSE;
704 #endif
705 #endif
706 looknew->udpsize = 0;
707 looknew->recurse = ISC_TRUE;
708 looknew->aaonly = ISC_FALSE;
709 looknew->adflag = ISC_FALSE;
710 looknew->cdflag = ISC_FALSE;
711 looknew->ns_search_only = ISC_FALSE;
712 looknew->origin = NULL;
713 looknew->tsigctx = NULL;
714 looknew->querysig = NULL;
715 looknew->retries = tries;
716 looknew->nsfound = 0;
717 looknew->tcp_mode = ISC_FALSE;
718 looknew->ip6_int = ISC_FALSE;
719 looknew->comments = ISC_TRUE;
720 looknew->stats = ISC_TRUE;
721 looknew->section_question = ISC_TRUE;
722 looknew->section_answer = ISC_TRUE;
723 looknew->section_authority = ISC_TRUE;
724 looknew->section_additional = ISC_TRUE;
725 looknew->new_search = ISC_FALSE;
726 ISC_LINK_INIT(looknew, link);
727 ISC_LIST_INIT(looknew->q);
728 ISC_LIST_INIT(looknew->my_server_list);
729 return (looknew);
730 }
731
732 /*
733 * Clone a lookup, perhaps copying the server list. This does not clone
734 * the query list, since it will be regenerated by the setup_lookup()
735 * function, nor does it queue up the new lookup for processing.
736 * Caution: If you don't clone the servers, you MUST clone the server
737 * list seperately from somewhere else, or construct it by hand.
738 */
739 dig_lookup_t *
740 clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
741 dig_lookup_t *looknew;
742
743 debug("clone_lookup()");
744
745 INSIST(!free_now);
746
747 looknew = make_empty_lookup();
748 INSIST(looknew != NULL);
749 strncpy(looknew->textname, lookold->textname, MXNAME);
750 #if DIG_SIGCHASE_TD
751 strncpy(looknew->textnamesigchase, lookold->textnamesigchase, MXNAME);
752 #endif
753 strncpy(looknew->cmdline, lookold->cmdline, MXNAME);
754 looknew->textname[MXNAME-1] = 0;
755 looknew->rdtype = lookold->rdtype;
756 looknew->qrdtype = lookold->qrdtype;
757 looknew->rdclass = lookold->rdclass;
758 looknew->rdtypeset = lookold->rdtypeset;
759 looknew->rdclassset = lookold->rdclassset;
760 looknew->doing_xfr = lookold->doing_xfr;
761 looknew->ixfr_serial = lookold->ixfr_serial;
762 looknew->trace = lookold->trace;
763 looknew->trace_root = lookold->trace_root;
764 looknew->identify = lookold->identify;
765 looknew->identify_previous_line = lookold->identify_previous_line;
766 looknew->ignore = lookold->ignore;
767 looknew->servfail_stops = lookold->servfail_stops;
768 looknew->besteffort = lookold->besteffort;
769 looknew->dnssec = lookold->dnssec;
770 #ifdef DIG_SIGCHASE
771 looknew->sigchase = lookold->sigchase;
772 #if DIG_SIGCHASE_TD
773 looknew->do_topdown = lookold->do_topdown;
774 looknew->trace_root_sigchase = lookold->trace_root_sigchase;
775 looknew->rdtype_sigchaseset = lookold->rdtype_sigchaseset;
776 looknew->rdtype_sigchase = lookold->rdtype_sigchase;
777 looknew->qrdtype_sigchase = lookold->qrdtype_sigchase;
778 looknew->rdclass_sigchase = lookold->rdclass_sigchase;
779 looknew->rdclass_sigchaseset = lookold->rdclass_sigchaseset;
780 #endif
781 #endif
782 looknew->udpsize = lookold->udpsize;
783 looknew->recurse = lookold->recurse;
784 looknew->aaonly = lookold->aaonly;
785 looknew->adflag = lookold->adflag;
786 looknew->cdflag = lookold->cdflag;
787 looknew->ns_search_only = lookold->ns_search_only;
788 looknew->tcp_mode = lookold->tcp_mode;
789 looknew->comments = lookold->comments;
790 looknew->stats = lookold->stats;
791 looknew->section_question = lookold->section_question;
792 looknew->section_answer = lookold->section_answer;
793 looknew->section_authority = lookold->section_authority;
794 looknew->section_additional = lookold->section_additional;
795 looknew->retries = lookold->retries;
796 looknew->tsigctx = NULL;
797
798 if (servers)
799 clone_server_list(lookold->my_server_list,
800 &looknew->my_server_list);
801 return (looknew);
802 }
803
804 /*
805 * Requeue a lookup for further processing, perhaps copying the server
806 * list. The new lookup structure is returned to the caller, and is
807 * queued for processing. If servers are not cloned in the requeue, they
808 * must be added before allowing the current event to complete, since the
809 * completion of the event may result in the next entry on the lookup
810 * queue getting run.
811 */
812 dig_lookup_t *
813 requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
814 dig_lookup_t *looknew;
815
816 debug("requeue_lookup()");
817
818 lookup_counter++;
819 if (lookup_counter > LOOKUP_LIMIT)
820 fatal("too many lookups");
821
822 looknew = clone_lookup(lookold, servers);
823 INSIST(looknew != NULL);
824
825 debug("before insertion, init@%p -> %p, new@%p -> %p",
826 lookold, lookold->link.next, looknew, looknew->link.next);
827 ISC_LIST_PREPEND(lookup_list, looknew, link);
828 debug("after insertion, init -> %p, new = %p, new -> %p",
829 lookold, looknew, looknew->link.next);
830 return (looknew);
831 }
832
833
834 static void
835 setup_text_key(void) {
836 isc_result_t result;
837 dns_name_t keyname;
838 isc_buffer_t secretbuf;
839 int secretsize;
840 unsigned char *secretstore;
841
842 debug("setup_text_key()");
843 result = isc_buffer_allocate(mctx, &namebuf, MXNAME);
844 check_result(result, "isc_buffer_allocate");
845 dns_name_init(&keyname, NULL);
846 check_result(result, "dns_name_init");
847 isc_buffer_putstr(namebuf, keynametext);
848 secretsize = strlen(keysecret) * 3 / 4;
849 secretstore = isc_mem_allocate(mctx, secretsize);
850 if (secretstore == NULL)
851 fatal("memory allocation failure in %s:%d",
852 __FILE__, __LINE__);
853 isc_buffer_init(&secretbuf, secretstore, secretsize);
854 result = isc_base64_decodestring(keysecret, &secretbuf);
855 if (result != ISC_R_SUCCESS)
856 goto failure;
857
858 secretsize = isc_buffer_usedlength(&secretbuf);
859
860 result = dns_name_fromtext(&keyname, namebuf,
861 dns_rootname, ISC_FALSE,
862 namebuf);
863 if (result != ISC_R_SUCCESS)
864 goto failure;
865
866 result = dns_tsigkey_create(&keyname, dns_tsig_hmacmd5_name,
867 secretstore, secretsize,
868 ISC_FALSE, NULL, 0, 0, mctx,
869 NULL, &key);
870 failure:
871 if (result != ISC_R_SUCCESS)
872 printf(";; Couldn't create key %s: %s\n",
873 keynametext, isc_result_totext(result));
874
875 isc_mem_free(mctx, secretstore);
876 dns_name_invalidate(&keyname);
877 isc_buffer_free(&namebuf);
878 }
879
880 static void
881 setup_file_key(void) {
882 isc_result_t result;
883 dst_key_t *dstkey = NULL;
884
885 debug("setup_file_key()");
886 result = dst_key_fromnamedfile(keyfile, DST_TYPE_PRIVATE | DST_TYPE_KEY,
887 mctx, &dstkey);
888 if (result != ISC_R_SUCCESS) {
889 fprintf(stderr, "Couldn't read key from %s: %s\n",
890 keyfile, isc_result_totext(result));
891 goto failure;
892 }
893
894 result = dns_tsigkey_createfromkey(dst_key_name(dstkey),
895 dns_tsig_hmacmd5_name,
896 dstkey, ISC_FALSE, NULL, 0, 0,
897 mctx, NULL, &key);
898 if (result != ISC_R_SUCCESS) {
899 printf(";; Couldn't create key %s: %s\n",
900 keynametext, isc_result_totext(result));
901 goto failure;
902 }
903 dstkey = NULL;
904 failure:
905 if (dstkey != NULL)
906 dst_key_free(&dstkey);
907 }
908
909 static dig_searchlist_t *
910 make_searchlist_entry(char *domain) {
911 dig_searchlist_t *search;
912 search = isc_mem_allocate(mctx, sizeof(*search));
913 if (search == NULL)
914 fatal("memory allocation failure in %s:%d",
915 __FILE__, __LINE__);
916 strncpy(search->origin, domain, MXNAME);
917 search->origin[MXNAME-1] = 0;
918 ISC_LINK_INIT(search, link);
919 return (search);
920 }
921
922 static void
923 create_search_list(lwres_conf_t *confdata) {
924 int i;
925 dig_searchlist_t *search;
926
927 debug("create_search_list()");
928 ISC_LIST_INIT(search_list);
929
930 for (i = 0; i < confdata->searchnxt; i++) {
931 search = make_searchlist_entry(confdata->search[i]);
932 ISC_LIST_APPEND(search_list, search, link);
933 }
934 }
935
936 /*
937 * Setup the system as a whole, reading key information and resolv.conf
938 * settings.
939 */
940 void
941 setup_system(void) {
942 dig_searchlist_t *domain = NULL;
943 lwres_result_t lwresult;
944
945 debug("setup_system()");
946
947 lwresult = lwres_context_create(&lwctx, mctx, mem_alloc, mem_free, 1);
948 if (lwresult != LWRES_R_SUCCESS)
949 fatal("lwres_context_create failed");
950
951 lwresult = lwres_conf_parse(lwctx, RESOLV_CONF);
952 if (lwresult != LWRES_R_SUCCESS && lwresult != LWRES_R_NOTFOUND)
953 fatal("parse of %s failed", RESOLV_CONF);
954
955 lwconf = lwres_conf_get(lwctx);
956
957 /* Make the search list */
958 if (lwconf->searchnxt > 0)
959 create_search_list(lwconf);
960 else { /* No search list. Use the domain name if any */
961 if (lwconf->domainname != NULL) {
962 domain = make_searchlist_entry(lwconf->domainname);
963 ISC_LIST_INITANDAPPEND(search_list, domain, link);
964 domain = NULL;
965 }
966 }
967
968 if (ndots == -1) {
969 ndots = lwconf->ndots;
970 debug("ndots is %d.", ndots);
971 }
972
973 /* If we don't find a nameserver fall back to localhost */
974 if (lwconf->nsnext == 0) {
975 if (have_ipv4) {
976 lwresult = add_nameserver(lwconf, "127.0.0.1", AF_INET);
977 if (lwresult != ISC_R_SUCCESS)
978 fatal("add_nameserver failed");
979 }
980 if (have_ipv6) {
981 lwresult = add_nameserver(lwconf, "::1", AF_INET6);
982 if (lwresult != ISC_R_SUCCESS)
983 fatal("add_nameserver failed");
984 }
985 }
986
987 if (ISC_LIST_EMPTY(server_list))
988 copy_server_list(lwconf, &server_list);
989
990 if (keyfile[0] != 0)
991 setup_file_key();
992 else if (keysecret[0] != 0)
993 setup_text_key();
994 #ifdef DIG_SIGCHASE
995 /* Setup the list of messages for +sigchase */
996 ISC_LIST_INIT(chase_message_list);
997 ISC_LIST_INIT(chase_message_list2);
998 dns_name_init(&chase_name, NULL);
999 #if DIG_SIGCHASE_TD
1000 dns_name_init(&chase_current_name, NULL);
1001 dns_name_init(&chase_authority_name, NULL);
1002 #endif
1003 #if DIG_SIGCHASE_BU
1004 dns_name_init(&chase_signame, NULL);
1005 #endif
1006
1007 #endif
1008
1009 }
1010
1011 static void
1012 clear_searchlist(void) {
1013 dig_searchlist_t *search;
1014 while ((search = ISC_LIST_HEAD(search_list)) != NULL) {
1015 ISC_LIST_UNLINK(search_list, search, link);
1016 isc_mem_free(mctx, search);
1017 }
1018 }
1019
1020 /*
1021 * Override the search list derived from resolv.conf by 'domain'.
1022 */
1023 void
1024 set_search_domain(char *domain) {
1025 dig_searchlist_t *search;
1026
1027 clear_searchlist();
1028 search = make_searchlist_entry(domain);
1029 ISC_LIST_APPEND(search_list, search, link);
1030 }
1031
1032 /*
1033 * Setup the ISC and DNS libraries for use by the system.
1034 */
1035 void
1036 setup_libs(void) {
1037 isc_result_t result;
1038
1039 debug("setup_libs()");
1040
1041 result = isc_net_probeipv4();
1042 if (result == ISC_R_SUCCESS)
1043 have_ipv4 = ISC_TRUE;
1044
1045 result = isc_net_probeipv6();
1046 if (result == ISC_R_SUCCESS)
1047 have_ipv6 = ISC_TRUE;
1048 if (!have_ipv6 && !have_ipv4)
1049 fatal("can't find either v4 or v6 networking");
1050
1051 result = isc_mem_create(0, 0, &mctx);
1052 check_result(result, "isc_mem_create");
1053
1054 result = isc_taskmgr_create(mctx, 1, 0, &taskmgr);
1055 check_result(result, "isc_taskmgr_create");
1056
1057 result = isc_task_create(taskmgr, 0, &global_task);
1058 check_result(result, "isc_task_create");
1059
1060 result = isc_timermgr_create(mctx, &timermgr);
1061 check_result(result, "isc_timermgr_create");
1062
1063 result = isc_socketmgr_create(mctx, &socketmgr);
1064 check_result(result, "isc_socketmgr_create");
1065
1066 result = isc_entropy_create(mctx, &entp);
1067 check_result(result, "isc_entropy_create");
1068
1069 result = dst_lib_init(mctx, entp, 0);
1070 check_result(result, "dst_lib_init");
1071 is_dst_up = ISC_TRUE;
1072
1073 result = isc_mempool_create(mctx, COMMSIZE, &commctx);
1074 check_result(result, "isc_mempool_create");
1075 isc_mempool_setname(commctx, "COMMPOOL");
1076 /*
1077 * 6 and 2 set as reasonable parameters for 3 or 4 nameserver
1078 * systems.
1079 */
1080 isc_mempool_setfreemax(commctx, 6);
1081 isc_mempool_setfillcount(commctx, 2);
1082
1083 result = isc_mutex_init(&lookup_lock);
1084 check_result(result, "isc_mutex_init");
1085
1086 dns_result_register();
1087 }
1088
1089 /*
1090 * Add EDNS0 option record to a message. Currently, the only supported
1091 * options are UDP buffer size and the DO bit.
1092 */
1093 static void
1094 add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_boolean_t dnssec) {
1095 dns_rdataset_t *rdataset = NULL;
1096 dns_rdatalist_t *rdatalist = NULL;
1097 dns_rdata_t *rdata = NULL;
1098 isc_result_t result;
1099
1100 debug("add_opt()");
1101 result = dns_message_gettemprdataset(msg, &rdataset);
1102 check_result(result, "dns_message_gettemprdataset");
1103 dns_rdataset_init(rdataset);
1104 result = dns_message_gettemprdatalist(msg, &rdatalist);
1105 check_result(result, "dns_message_gettemprdatalist");
1106 result = dns_message_gettemprdata(msg, &rdata);
1107 check_result(result, "dns_message_gettemprdata");
1108
1109 debug("setting udp size of %d", udpsize);
1110 rdatalist->type = dns_rdatatype_opt;
1111 rdatalist->covers = 0;
1112 rdatalist->rdclass = udpsize;
1113 rdatalist->ttl = 0;
1114 if (dnssec)
1115 rdatalist->ttl = DNS_MESSAGEEXTFLAG_DO;
1116 rdata->data = NULL;
1117 rdata->length = 0;
1118 ISC_LIST_INIT(rdatalist->rdata);
1119 ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
1120 dns_rdatalist_tordataset(rdatalist, rdataset);
1121 result = dns_message_setopt(msg, rdataset);
1122 check_result(result, "dns_message_setopt");
1123 }
1124
1125 /*
1126 * Add a question section to a message, asking for the specified name,
1127 * type, and class.
1128 */
1129 static void
1130 add_question(dns_message_t *message, dns_name_t *name,
1131 dns_rdataclass_t rdclass, dns_rdatatype_t rdtype)
1132 {
1133 dns_rdataset_t *rdataset;
1134 isc_result_t result;
1135
1136 debug("add_question()");
1137 rdataset = NULL;
1138 result = dns_message_gettemprdataset(message, &rdataset);
1139 check_result(result, "dns_message_gettemprdataset()");
1140 dns_rdataset_init(rdataset);
1141 dns_rdataset_makequestion(rdataset, rdclass, rdtype);
1142 ISC_LIST_APPEND(name->list, rdataset, link);
1143 }
1144
1145 /*
1146 * Check if we're done with all the queued lookups, which is true iff
1147 * all sockets, sends, and recvs are accounted for (counters == 0),
1148 * and the lookup list is empty.
1149 * If we are done, pass control back out to dighost_shutdown() (which is
1150 * part of dig.c, host.c, or nslookup.c) to either shutdown the system as
1151 * a whole or reseed the lookup list.
1152 */
1153 static void
1154 check_if_done(void) {
1155 debug("check_if_done()");
1156 debug("list %s", ISC_LIST_EMPTY(lookup_list) ? "empty" : "full");
1157 if (ISC_LIST_EMPTY(lookup_list) && current_lookup == NULL &&
1158 sendcount == 0) {
1159 INSIST(sockcount == 0);
1160 INSIST(recvcount == 0);
1161 debug("shutting down");
1162 dighost_shutdown();
1163 }
1164 }
1165
1166 /*
1167 * Clear out a query when we're done with it. WARNING: This routine
1168 * WILL invalidate the query pointer.
1169 */
1170 static void
1171 clear_query(dig_query_t *query) {
1172 dig_lookup_t *lookup;
1173
1174 REQUIRE(query != NULL);
1175
1176 debug("clear_query(%p)", query);
1177
1178 lookup = query->lookup;
1179
1180 if (lookup->current_query == query)
1181 lookup->current_query = NULL;
1182
1183 ISC_LIST_UNLINK(lookup->q, query, link);
1184 if (ISC_LINK_LINKED(&query->recvbuf, link))
1185 ISC_LIST_DEQUEUE(query->recvlist, &query->recvbuf,
1186 link);
1187 if (ISC_LINK_LINKED(&query->lengthbuf, link))
1188 ISC_LIST_DEQUEUE(query->lengthlist, &query->lengthbuf,
1189 link);
1190 INSIST(query->recvspace != NULL);
1191 if (query->sock != NULL) {
1192 isc_socket_detach(&query->sock);
1193 sockcount--;
1194 debug("sockcount=%d", sockcount);
1195 }
1196 isc_mempool_put(commctx, query->recvspace);
1197 isc_buffer_invalidate(&query->recvbuf);
1198 isc_buffer_invalidate(&query->lengthbuf);
1199 if (query->waiting_senddone)
1200 query->pending_free = ISC_TRUE;
1201 else
1202 isc_mem_free(mctx, query);
1203 }
1204
1205 /*
1206 * Try and clear out a lookup if we're done with it. Return ISC_TRUE if
1207 * the lookup was successfully cleared. If ISC_TRUE is returned, the
1208 * lookup pointer has been invalidated.
1209 */
1210 static isc_boolean_t
1211 try_clear_lookup(dig_lookup_t *lookup) {
1212 dig_server_t *s;
1213 dig_query_t *q;
1214 void *ptr;
1215
1216 REQUIRE(lookup != NULL);
1217
1218 debug("try_clear_lookup(%p)", lookup);
1219
1220 if (ISC_LIST_HEAD(lookup->q) != NULL) {
1221 if (debugging) {
1222 q = ISC_LIST_HEAD(lookup->q);
1223 while (q != NULL) {
1224 debug("query to %s still pending", q->servname);
1225 q = ISC_LIST_NEXT(q, link);
1226 }
1227 }
1228 return (ISC_FALSE);
1229 }
1230
1231 /*
1232 * At this point, we know there are no queries on the lookup,
1233 * so can make it go away also.
1234 */
1235 debug("cleared");
1236 s = ISC_LIST_HEAD(lookup->my_server_list);
1237 while (s != NULL) {
1238 debug("freeing server %p belonging to %p", s, lookup);
1239 ptr = s;
1240 s = ISC_LIST_NEXT(s, link);
1241 ISC_LIST_DEQUEUE(lookup->my_server_list,
1242 (dig_server_t *)ptr, link);
1243 isc_mem_free(mctx, ptr);
1244 }
1245 if (lookup->sendmsg != NULL)
1246 dns_message_destroy(&lookup->sendmsg);
1247 if (lookup->querysig != NULL) {
1248 debug("freeing buffer %p", lookup->querysig);
1249 isc_buffer_free(&lookup->querysig);
1250 }
1251 if (lookup->timer != NULL)
1252 isc_timer_detach(&lookup->timer);
1253 if (lookup->sendspace != NULL)
1254 isc_mempool_put(commctx, lookup->sendspace);
1255
1256 if (lookup->tsigctx != NULL)
1257 dst_context_destroy(&lookup->tsigctx);
1258
1259 isc_mem_free(mctx, lookup);
1260 return (ISC_TRUE);
1261 }
1262
1263 /*
1264 * If we can, start the next lookup in the queue running.
1265 * This assumes that the lookup on the head of the queue hasn't been
1266 * started yet. It also removes the lookup from the head of the queue,
1267 * setting the current_lookup pointer pointing to it.
1268 */
1269 void
1270 start_lookup(void) {
1271 debug("start_lookup()");
1272 if (cancel_now)
1273 return;
1274
1275 /*
1276 * If there's a current lookup running, we really shouldn't get
1277 * here.
1278 */
1279 INSIST(current_lookup == NULL);
1280
1281 current_lookup = ISC_LIST_HEAD(lookup_list);
1282 /*
1283 * Put the current lookup somewhere so cancel_all can find it
1284 */
1285 if (current_lookup != NULL) {
1286 ISC_LIST_DEQUEUE(lookup_list, current_lookup, link);
1287 #if DIG_SIGCHASE_TD
1288 if (current_lookup->do_topdown &&
1289 !current_lookup->rdtype_sigchaseset) {
1290 dst_key_t *trustedkey = NULL;
1291 isc_buffer_t *b = NULL;
1292 isc_region_t r;
1293 isc_result_t result;
1294 dns_name_t query_name;
1295 dns_name_t *key_name;
1296 int i;
1297
1298 result = get_trusted_key(mctx);
1299 if (result != ISC_R_SUCCESS) {
1300 printf("\n;; No trusted key, "
1301 "+sigchase option is disabled\n");
1302 current_lookup->sigchase = ISC_FALSE;
1303 goto novalidation;
1304 }
1305 dns_name_init(&query_name, NULL);
1306 nameFromString(current_lookup->textname, &query_name);
1307
1308 for (i = 0; i < tk_list.nb_tk; i++) {
1309 key_name = dst_key_name(tk_list.key[i]);
1310
1311 if (dns_name_issubdomain(&query_name,
1312 key_name) == ISC_TRUE)
1313 trustedkey = tk_list.key[i];
1314 /*
1315 * Verifier que la temp est bien la plus basse
1316 * WARNING
1317 */
1318 }
1319 if (trustedkey == NULL) {
1320 printf("\n;; The queried zone: ");
1321 dns_name_print(&query_name, stdout);
1322 printf(" isn't a subdomain of any Trusted Keys"
1323 ": +sigchase option is disable\n");
1324 current_lookup->sigchase = ISC_FALSE;
1325 free_name(&query_name, mctx);
1326 goto novalidation;
1327 }
1328 free_name(&query_name, mctx);
1329
1330 current_lookup->rdtype_sigchase
1331 = current_lookup->rdtype;
1332 current_lookup->rdtype_sigchaseset
1333 = current_lookup->rdtypeset;
1334 current_lookup->rdtype = dns_rdatatype_ns;
1335
1336 current_lookup->qrdtype_sigchase
1337 = current_lookup->qrdtype;
1338 current_lookup->qrdtype = dns_rdatatype_ns;
1339
1340 current_lookup->rdclass_sigchase
1341 = current_lookup->rdclass;
1342 current_lookup->rdclass_sigchaseset
1343 = current_lookup->rdclassset;
1344 current_lookup->rdclass = dns_rdataclass_in;
1345
1346 strncpy(current_lookup->textnamesigchase,
1347 current_lookup->textname, MXNAME);
1348
1349 current_lookup->trace_root_sigchase = ISC_TRUE;
1350
1351 result = isc_buffer_allocate(mctx, &b, BUFSIZE);
1352 check_result(result, "isc_buffer_allocate");
1353 result = dns_name_totext(dst_key_name(trustedkey),
1354 ISC_FALSE, b);
1355 check_result(result, "dns_name_totext");
1356 isc_buffer_usedregion(b, &r);
1357 r.base[r.length] = '\0';
1358 strncpy(current_lookup->textname, (char*)r.base,
1359 MXNAME);
1360 isc_buffer_free(&b);
1361
1362 nameFromString(current_lookup->textnamesigchase,
1363 &chase_name);
1364
1365 dns_name_init(&chase_authority_name, NULL);
1366 }
1367 novalidation:
1368 #endif
1369 setup_lookup(current_lookup);
1370 do_lookup(current_lookup);
1371 } else {
1372 check_if_done();
1373 }
1374 }
1375
1376 /*
1377 * If we can, clear the current lookup and start the next one running.
1378 * This calls try_clear_lookup, so may invalidate the lookup pointer.
1379 */
1380 static void
1381 check_next_lookup(dig_lookup_t *lookup) {
1382
1383 INSIST(!free_now);
1384
1385 debug("check_next_lookup(%p)", lookup);
1386
1387 if (ISC_LIST_HEAD(lookup->q) != NULL) {
1388 debug("still have a worker");
1389 return;
1390 }
1391 if (try_clear_lookup(lookup)) {
1392 current_lookup = NULL;
1393 start_lookup();
1394 }
1395 }
1396
1397 /*
1398 * Create and queue a new lookup as a followup to the current lookup,
1399 * based on the supplied message and section. This is used in trace and
1400 * name server search modes to start a new lookup using servers from
1401 * NS records in a reply. Returns the number of followup lookups made.
1402 */
1403 static int
1404 followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
1405 {
1406 dig_lookup_t *lookup = NULL;
1407 dig_server_t *srv = NULL;
1408 dns_rdataset_t *rdataset = NULL;
1409 dns_rdata_t rdata = DNS_RDATA_INIT;
1410 dns_name_t *name = NULL;
1411 isc_result_t result;
1412 isc_boolean_t success = ISC_FALSE;
1413 int numLookups = 0;
1414
1415 INSIST(!free_now);
1416
1417 debug("following up %s", query->lookup->textname);
1418
1419 for (result = dns_message_firstname(msg, section);
1420 result == ISC_R_SUCCESS;
1421 result = dns_message_nextname(msg, section)) {
1422 name = NULL;
1423 dns_message_currentname(msg, section, &name);
1424
1425 if (section == DNS_SECTION_AUTHORITY) {
1426 rdataset = NULL;
1427 result = dns_message_findtype(name, dns_rdatatype_soa,
1428 0, &rdataset);
1429 if (result == ISC_R_SUCCESS)
1430 return (0);
1431 }
1432 rdataset = NULL;
1433 result = dns_message_findtype(name, dns_rdatatype_ns, 0,
1434 &rdataset);
1435 if (result != ISC_R_SUCCESS)
1436 continue;
1437
1438 debug("found NS set");
1439
1440 for (result = dns_rdataset_first(rdataset);
1441 result == ISC_R_SUCCESS;
1442 result = dns_rdataset_next(rdataset)) {
1443 char namestr[DNS_NAME_FORMATSIZE];
1444 dns_rdata_ns_t ns;
1445
1446 if (query->lookup->trace_root &&
1447 query->lookup->nsfound >= MXSERV)
1448 break;
1449
1450 dns_rdataset_current(rdataset, &rdata);
1451
1452 query->lookup->nsfound++;
1453 (void)dns_rdata_tostruct(&rdata, &ns, NULL);
1454 dns_name_format(&ns.name, namestr, sizeof(namestr));
1455 dns_rdata_freestruct(&ns);
1456
1457 /* Initialize lookup if we've not yet */
1458 debug("found NS %d %s", numLookups, namestr);
1459 numLookups++;
1460 if (!success) {
1461 success = ISC_TRUE;
1462 lookup_counter++;
1463 lookup = requeue_lookup(query->lookup,
1464 ISC_FALSE);
1465 cancel_lookup(query->lookup);
1466 lookup->doing_xfr = ISC_FALSE;
1467 if (!lookup->trace_root &&
1468 section == DNS_SECTION_ANSWER)
1469 lookup->trace = ISC_FALSE;
1470 else
1471 lookup->trace = query->lookup->trace;
1472 lookup->ns_search_only =
1473 query->lookup->ns_search_only;
1474 lookup->trace_root = ISC_FALSE;
1475 if (lookup->ns_search_only)
1476 lookup->recurse = ISC_FALSE;
1477 }
1478 srv = make_server(namestr, namestr);
1479 debug("adding server %s", srv->servername);
1480 ISC_LIST_APPEND(lookup->my_server_list, srv, link);
1481 dns_rdata_reset(&rdata);
1482 }
1483 }
1484
1485 if (lookup == NULL &&
1486 section == DNS_SECTION_ANSWER &&
1487 (query->lookup->trace || query->lookup->ns_search_only))
1488 return (followup_lookup(msg, query, DNS_SECTION_AUTHORITY));
1489
1490 return numLookups;
1491 }
1492
1493 /*
1494 * Create and queue a new lookup using the next origin from the search
1495 * list, read in setup_system().
1496 *
1497 * Return ISC_TRUE iff there was another searchlist entry.
1498 */
1499 static isc_boolean_t
1500 next_origin(dns_message_t *msg, dig_query_t *query) {
1501 dig_lookup_t *lookup;
1502
1503 UNUSED(msg);
1504
1505 INSIST(!free_now);
1506
1507 debug("next_origin()");
1508 debug("following up %s", query->lookup->textname);
1509
1510 if (!usesearch)
1511 /*
1512 * We're not using a search list, so don't even think
1513 * about finding the next entry.
1514 */
1515 return (ISC_FALSE);
1516 if (query->lookup->origin == NULL)
1517 /*
1518 * Then we just did rootorg; there's nothing left.
1519 */
1520 return (ISC_FALSE);
1521 lookup = requeue_lookup(query->lookup, ISC_TRUE);
1522 lookup->origin = ISC_LIST_NEXT(query->lookup->origin, link);
1523 cancel_lookup(query->lookup);
1524 return (ISC_TRUE);
1525 }
1526
1527 /*
1528 * Insert an SOA record into the sendmessage in a lookup. Used for
1529 * creating IXFR queries.
1530 */
1531 static void
1532 insert_soa(dig_lookup_t *lookup) {
1533 isc_result_t result;
1534 dns_rdata_soa_t soa;
1535 dns_rdata_t *rdata = NULL;
1536 dns_rdatalist_t *rdatalist = NULL;
1537 dns_rdataset_t *rdataset = NULL;
1538 dns_name_t *soaname = NULL;
1539
1540 debug("insert_soa()");
1541 soa.mctx = mctx;
1542 soa.serial = lookup->ixfr_serial;
1543 soa.refresh = 0;
1544 soa.retry = 0;
1545 soa.expire = 0;
1546 soa.minimum = 0;
1547 soa.common.rdclass = lookup->rdclass;
1548 soa.common.rdtype = dns_rdatatype_soa;
1549
1550 dns_name_init(&soa.origin, NULL);
1551 dns_name_init(&soa.contact, NULL);
1552
1553 dns_name_clone(dns_rootname, &soa.origin);
1554 dns_name_clone(dns_rootname, &soa.contact);
1555
1556 isc_buffer_init(&lookup->rdatabuf, lookup->rdatastore,
1557 sizeof(lookup->rdatastore));
1558
1559 result = dns_message_gettemprdata(lookup->sendmsg, &rdata);
1560 check_result(result, "dns_message_gettemprdata");
1561
1562 result = dns_rdata_fromstruct(rdata, lookup->rdclass,
1563 dns_rdatatype_soa, &soa,
1564 &lookup->rdatabuf);
1565 check_result(result, "isc_rdata_fromstruct");
1566
1567 result = dns_message_gettemprdatalist(lookup->sendmsg, &rdatalist);
1568 check_result(result, "dns_message_gettemprdatalist");
1569
1570 result = dns_message_gettemprdataset(lookup->sendmsg, &rdataset);
1571 check_result(result, "dns_message_gettemprdataset");
1572
1573 dns_rdatalist_init(rdatalist);
1574 rdatalist->type = dns_rdatatype_soa;
1575 rdatalist->rdclass = lookup->rdclass;
1576 rdatalist->covers = 0;
1577 rdatalist->ttl = 0;
1578 ISC_LIST_INIT(rdatalist->rdata);
1579 ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
1580
1581 dns_rdataset_init(rdataset);
1582 dns_rdatalist_tordataset(rdatalist, rdataset);
1583
1584 result = dns_message_gettempname(lookup->sendmsg, &soaname);
1585 check_result(result, "dns_message_gettempname");
1586 dns_name_init(soaname, NULL);
1587 dns_name_clone(lookup->name, soaname);
1588 ISC_LIST_INIT(soaname->list);
1589 ISC_LIST_APPEND(soaname->list, rdataset, link);
1590 dns_message_addname(lookup->sendmsg, soaname, DNS_SECTION_AUTHORITY);
1591 }
1592
1593 /*
1594 * Setup the supplied lookup structure, making it ready to start sending
1595 * queries to servers. Create and initialize the message to be sent as
1596 * well as the query structures and buffer space for the replies. If the
1597 * server list is empty, clone it from the system default list.
1598 */
1599 void
1600 setup_lookup(dig_lookup_t *lookup) {
1601 isc_result_t result;
1602 isc_uint32_t id;
1603 int len;
1604 dig_server_t *serv;
1605 dig_query_t *query;
1606 isc_buffer_t b;
1607 dns_compress_t cctx;
1608 char store[MXNAME];
1609
1610 REQUIRE(lookup != NULL);
1611 INSIST(!free_now);
1612
1613 debug("setup_lookup(%p)", lookup);
1614
1615 result = dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER,
1616 &lookup->sendmsg);
1617 check_result(result, "dns_message_create");
1618
1619 if (lookup->new_search) {
1620 debug("resetting lookup counter.");
1621 lookup_counter = 0;
1622 }
1623
1624 if (ISC_LIST_EMPTY(lookup->my_server_list)) {
1625 debug("cloning server list");
1626 clone_server_list(server_list, &lookup->my_server_list);
1627 }
1628 result = dns_message_gettempname(lookup->sendmsg, &lookup->name);
1629 check_result(result, "dns_message_gettempname");
1630 dns_name_init(lookup->name, NULL);
1631
1632 isc_buffer_init(&lookup->namebuf, lookup->namespace,
1633 sizeof(lookup->namespace));
1634 isc_buffer_init(&lookup->onamebuf, lookup->onamespace,
1635 sizeof(lookup->onamespace));
1636
1637 /*
1638 * If the name has too many dots, force the origin to be NULL
1639 * (which produces an absolute lookup). Otherwise, take the origin
1640 * we have if there's one in the struct already. If it's NULL,
1641 * take the first entry in the searchlist iff either usesearch
1642 * is TRUE or we got a domain line in the resolv.conf file.
1643 */
1644 /* XXX New search here? */
1645 if ((count_dots(lookup->textname) >= ndots) || !usesearch)
1646 lookup->origin = NULL; /* Force abs lookup */
1647 else if (lookup->origin == NULL && lookup->new_search && usesearch)
1648 lookup->origin = ISC_LIST_HEAD(search_list);
1649
1650 if (lookup->origin != NULL) {
1651 debug("trying origin %s", lookup->origin->origin);
1652 result = dns_message_gettempname(lookup->sendmsg,
1653 &lookup->oname);
1654 check_result(result, "dns_message_gettempname");
1655 dns_name_init(lookup->oname, NULL);
1656 /* XXX Helper funct to conv char* to name? */
1657 len = strlen(lookup->origin->origin);
1658 isc_buffer_init(&b, lookup->origin->origin, len);
1659 isc_buffer_add(&b, len);
1660 result = dns_name_fromtext(lookup->oname, &b, dns_rootname,
1661 ISC_FALSE, &lookup->onamebuf);
1662 if (result != ISC_R_SUCCESS) {
1663 dns_message_puttempname(lookup->sendmsg,
1664 &lookup->name);
1665 dns_message_puttempname(lookup->sendmsg,
1666 &lookup->oname);
1667 fatal("'%s' is not in legal name syntax (%s)",
1668 lookup->origin->origin,
1669 isc_result_totext(result));
1670 }
1671 if (lookup->trace && lookup->trace_root) {
1672 dns_name_clone(dns_rootname, lookup->name);
1673 } else {
1674 len = strlen(lookup->textname);
1675 isc_buffer_init(&b, lookup->textname, len);
1676 isc_buffer_add(&b, len);
1677 result = dns_name_fromtext(lookup->name, &b,
1678 lookup->oname, ISC_FALSE,
1679 &lookup->namebuf);
1680 }
1681 if (result != ISC_R_SUCCESS) {
1682 dns_message_puttempname(lookup->sendmsg,
1683 &lookup->name);
1684 dns_message_puttempname(lookup->sendmsg,
1685 &lookup->oname);
1686 fatal("'%s' is not in legal name syntax (%s)",
1687 lookup->textname, isc_result_totext(result));
1688 }
1689 dns_message_puttempname(lookup->sendmsg, &lookup->oname);
1690 } else {
1691 debug("using root origin");
1692 if (lookup->trace && lookup->trace_root)
1693 dns_name_clone(dns_rootname, lookup->name);
1694 else {
1695 len = strlen(lookup->textname);
1696 isc_buffer_init(&b, lookup->textname, len);
1697 isc_buffer_add(&b, len);
1698 result = dns_name_fromtext(lookup->name, &b,
1699 dns_rootname,
1700 ISC_FALSE,
1701 &lookup->namebuf);
1702 }
1703 if (result != ISC_R_SUCCESS) {
1704 dns_message_puttempname(lookup->sendmsg,
1705 &lookup->name);
1706 isc_buffer_init(&b, store, MXNAME);
1707 fatal("'%s' is not a legal name "
1708 "(%s)", lookup->textname,
1709 isc_result_totext(result));
1710 }
1711 }
1712 dns_name_format(lookup->name, store, sizeof(store));
1713 trying(store, lookup);
1714 INSIST(dns_name_isabsolute(lookup->name));
1715
1716 isc_random_get(&id);
1717 lookup->sendmsg->id = (unsigned short)id & 0xFFFF;
1718 lookup->sendmsg->opcode = dns_opcode_query;
1719 lookup->msgcounter = 0;
1720 /*
1721 * If this is a trace request, completely disallow recursion, since
1722 * it's meaningless for traces.
1723 */
1724 if (lookup->trace || (lookup->ns_search_only && !lookup->trace_root))
1725 lookup->recurse = ISC_FALSE;
1726
1727 if (lookup->recurse &&
1728 lookup->rdtype != dns_rdatatype_axfr &&
1729 lookup->rdtype != dns_rdatatype_ixfr) {
1730 debug("recursive query");
1731 lookup->sendmsg->flags |= DNS_MESSAGEFLAG_RD;
1732 }
1733
1734 /* XXX aaflag */
1735 if (lookup->aaonly) {
1736 debug("AA query");
1737 lookup->sendmsg->flags |= DNS_MESSAGEFLAG_AA;
1738 }
1739
1740 if (lookup->adflag) {
1741 debug("AD query");
1742 lookup->sendmsg->flags |= DNS_MESSAGEFLAG_AD;
1743 }
1744
1745 if (lookup->cdflag) {
1746 debug("CD query");
1747 lookup->sendmsg->flags |= DNS_MESSAGEFLAG_CD;
1748 }
1749
1750 dns_message_addname(lookup->sendmsg, lookup->name,
1751 DNS_SECTION_QUESTION);
1752
1753 if (lookup->trace && lookup->trace_root) {
1754 lookup->qrdtype = lookup->rdtype;
1755 lookup->rdtype = dns_rdatatype_ns;
1756 }
1757
1758 if ((lookup->rdtype == dns_rdatatype_axfr) ||
1759 (lookup->rdtype == dns_rdatatype_ixfr)) {
1760 lookup->doing_xfr = ISC_TRUE;
1761 /*
1762 * Force TCP mode if we're doing an xfr.
1763 * XXX UDP ixfr's would be useful
1764 */
1765 lookup->tcp_mode = ISC_TRUE;
1766 }
1767
1768 add_question(lookup->sendmsg, lookup->name, lookup->rdclass,
1769 lookup->rdtype);
1770
1771 /* add_soa */
1772 if (lookup->rdtype == dns_rdatatype_ixfr)
1773 insert_soa(lookup);
1774
1775 /* XXX Insist this? */
1776 lookup->tsigctx = NULL;
1777 lookup->querysig = NULL;
1778 if (key != NULL) {
1779 debug("initializing keys");
1780 result = dns_message_settsigkey(lookup->sendmsg, key);
1781 check_result(result, "dns_message_settsigkey");
1782 }
1783
1784 lookup->sendspace = isc_mempool_get(commctx);
1785 if (lookup->sendspace == NULL)
1786 fatal("memory allocation failure");
1787
1788 result = dns_compress_init(&cctx, -1, mctx);
1789 check_result(result, "dns_compress_init");
1790
1791 debug("starting to render the message");
1792 isc_buffer_init(&lookup->renderbuf, lookup->sendspace, COMMSIZE);
1793 result = dns_message_renderbegin(lookup->sendmsg, &cctx,
1794 &lookup->renderbuf);
1795 check_result(result, "dns_message_renderbegin");
1796 if (lookup->udpsize > 0 || lookup->dnssec) {
1797 if (lookup->udpsize == 0)
1798 lookup->udpsize = 2048;
1799 add_opt(lookup->sendmsg, lookup->udpsize, lookup->dnssec);
1800 }
1801
1802 result = dns_message_rendersection(lookup->sendmsg,
1803 DNS_SECTION_QUESTION, 0);
1804 check_result(result, "dns_message_rendersection");
1805 result = dns_message_rendersection(lookup->sendmsg,
1806 DNS_SECTION_AUTHORITY, 0);
1807 check_result(result, "dns_message_rendersection");
1808 result = dns_message_renderend(lookup->sendmsg);
1809 check_result(result, "dns_message_renderend");
1810 debug("done rendering");
1811
1812 dns_compress_invalidate(&cctx);
1813
1814 /*
1815 * Force TCP mode if the request is larger than 512 bytes.
1816 */
1817 if (isc_buffer_usedlength(&lookup->renderbuf) > 512)
1818 lookup->tcp_mode = ISC_TRUE;
1819
1820 lookup->pending = ISC_FALSE;
1821
1822 for (serv = ISC_LIST_HEAD(lookup->my_server_list);
1823 serv != NULL;
1824 serv = ISC_LIST_NEXT(serv, link)) {
1825 query = isc_mem_allocate(mctx, sizeof(dig_query_t));
1826 if (query == NULL)
1827 fatal("memory allocation failure in %s:%d",
1828 __FILE__, __LINE__);
1829 debug("create query %p linked to lookup %p",
1830 query, lookup);
1831 query->lookup = lookup;
1832 query->waiting_connect = ISC_FALSE;
1833 query->waiting_senddone = ISC_FALSE;
1834 query->pending_free = ISC_FALSE;
1835 query->recv_made = ISC_FALSE;
1836 query->first_pass = ISC_TRUE;
1837 query->first_soa_rcvd = ISC_FALSE;
1838 query->second_rr_rcvd = ISC_FALSE;
1839 query->first_repeat_rcvd = ISC_FALSE;
1840 query->warn_id = ISC_TRUE;
1841 query->first_rr_serial = 0;
1842 query->second_rr_serial = 0;
1843 query->servname = serv->servername;
1844 query->userarg = serv->userarg;
1845 query->rr_count = 0;
1846 query->msg_count = 0;
1847 ISC_LINK_INIT(query, link);
1848 ISC_LIST_INIT(query->recvlist);
1849 ISC_LIST_INIT(query->lengthlist);
1850 query->sock = NULL;
1851 query->recvspace = isc_mempool_get(commctx);
1852 if (query->recvspace == NULL)
1853 fatal("memory allocation failure");
1854
1855 isc_buffer_init(&query->recvbuf, query->recvspace, COMMSIZE);
1856 isc_buffer_init(&query->lengthbuf, query->lengthspace, 2);
1857 isc_buffer_init(&query->slbuf, query->slspace, 2);
1858 query->sendbuf = lookup->renderbuf;
1859
1860 ISC_LINK_INIT(query, link);
1861 ISC_LIST_ENQUEUE(lookup->q, query, link);
1862 }
1863 /* XXX qrflag, print_query, etc... */
1864 if (!ISC_LIST_EMPTY(lookup->q) && qr) {
1865 printmessage(ISC_LIST_HEAD(lookup->q), lookup->sendmsg,
1866 ISC_TRUE);
1867 }
1868 }
1869
1870 /*
1871 * Event handler for send completion. Track send counter, and clear out
1872 * the query if the send was canceled.
1873 */
1874 static void
1875 send_done(isc_task_t *_task, isc_event_t *event) {
1876 isc_socketevent_t *sevent = (isc_socketevent_t *)event;
1877 isc_buffer_t *b = NULL;
1878 dig_query_t *query, *next;
1879 dig_lookup_t *l;
1880
1881 REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
1882
1883 UNUSED(_task);
1884
1885 LOCK_LOOKUP;
1886
1887 debug("send_done()");
1888 sendcount--;
1889 debug("sendcount=%d", sendcount);
1890 INSIST(sendcount >= 0);
1891
1892 for (b = ISC_LIST_HEAD(sevent->bufferlist);
1893 b != NULL;
1894 b = ISC_LIST_HEAD(sevent->bufferlist))
1895 ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
1896
1897 query = event->ev_arg;
1898 query->waiting_senddone = ISC_FALSE;
1899 l = query->lookup;
1900
1901 if (l->ns_search_only && !l->trace_root) {
1902 debug("sending next, since searching");
1903 next = ISC_LIST_NEXT(query, link);
1904 if (next != NULL)
1905 send_udp(next);
1906 }
1907
1908 isc_event_free(&event);
1909
1910 if (query->pending_free)
1911 isc_mem_free(mctx, query);
1912
1913 check_if_done();
1914 UNLOCK_LOOKUP;
1915 }
1916
1917 /*
1918 * Cancel a lookup, sending isc_socket_cancel() requests to all outstanding
1919 * IO sockets. The cancel handlers should take care of cleaning up the
1920 * query and lookup structures
1921 */
1922 static void
1923 cancel_lookup(dig_lookup_t *lookup) {
1924 dig_query_t *query, *next;
1925
1926 debug("cancel_lookup()");
1927 query = ISC_LIST_HEAD(lookup->q);
1928 while (query != NULL) {
1929 next = ISC_LIST_NEXT(query, link);
1930 if (query->sock != NULL) {
1931 isc_socket_cancel(query->sock, global_task,
1932 ISC_SOCKCANCEL_ALL);
1933 check_if_done();
1934 } else {
1935 clear_query(query);
1936 }
1937 query = next;
1938 }
1939 if (lookup->timer != NULL)
1940 isc_timer_detach(&lookup->timer);
1941 lookup->pending = ISC_FALSE;
1942 lookup->retries = 0;
1943 }
1944
1945 static void
1946 bringup_timer(dig_query_t *query, unsigned int default_timeout) {
1947 dig_lookup_t *l;
1948 unsigned int local_timeout;
1949 isc_result_t result;
1950
1951 debug("bringup_timer()");
1952 /*
1953 * If the timer already exists, that means we're calling this
1954 * a second time (for a retry). Don't need to recreate it,
1955 * just reset it.
1956 */
1957 l = query->lookup;
1958 if (ISC_LIST_NEXT(query, link) != NULL)
1959 local_timeout = SERVER_TIMEOUT;
1960 else {
1961 if (timeout == 0)
1962 local_timeout = default_timeout;
1963 else
1964 local_timeout = timeout;
1965 }
1966 debug("have local timeout of %d", local_timeout);
1967 isc_interval_set(&l->interval, local_timeout, 0);
1968 if (l->timer != NULL)
1969 isc_timer_detach(&l->timer);
1970 result = isc_timer_create(timermgr, isc_timertype_once, NULL,
1971 &l->interval, global_task, connect_timeout,
1972 l, &l->timer);
1973 check_result(result, "isc_timer_create");
1974 }
1975
1976 static void
1977 connect_done(isc_task_t *task, isc_event_t *event);
1978
1979 /*
1980 * Unlike send_udp, this can't be called multiple times with the same
1981 * query. When we retry TCP, we requeue the whole lookup, which should
1982 * start anew.
1983 */
1984 static void
1985 send_tcp_connect(dig_query_t *query) {
1986 isc_result_t result;
1987 dig_query_t *next;
1988 dig_lookup_t *l;
1989
1990 debug("send_tcp_connect(%p)", query);
1991
1992 l = query->lookup;
1993 query->waiting_connect = ISC_TRUE;
1994 query->lookup->current_query = query;
1995 get_address(query->servname, port, &query->sockaddr);
1996
1997 if (specified_source &&
1998 (isc_sockaddr_pf(&query->sockaddr) !=
1999 isc_sockaddr_pf(&bind_address))) {
2000 printf(";; Skipping server %s, incompatible "
2001 "address family\n", query->servname);
2002 query->waiting_connect = ISC_FALSE;
2003 next = ISC_LIST_NEXT(query, link);
2004 l = query->lookup;
2005 clear_query(query);
2006 if (next == NULL) {
2007 printf(";; No acceptable nameservers\n");
2008 check_next_lookup(l);
2009 return;
2010 }
2011 send_tcp_connect(next);
2012 return;
2013 }
2014 INSIST(query->sock == NULL);
2015 result = isc_socket_create(socketmgr,
2016 isc_sockaddr_pf(&query->sockaddr),
2017 isc_sockettype_tcp, &query->sock);
2018 check_result(result, "isc_socket_create");
2019 sockcount++;
2020 debug("sockcount=%d", sockcount);
2021 if (specified_source)
2022 result = isc_socket_bind(query->sock, &bind_address);
2023 else {
2024 if ((isc_sockaddr_pf(&query->sockaddr) == AF_INET) &&
2025 have_ipv4)
2026 isc_sockaddr_any(&bind_any);
2027 else
2028 isc_sockaddr_any6(&bind_any);
2029 result = isc_socket_bind(query->sock, &bind_any);
2030 }
2031 check_result(result, "isc_socket_bind");
2032 bringup_timer(query, TCP_TIMEOUT);
2033 result = isc_socket_connect(query->sock, &query->sockaddr,
2034 global_task, connect_done, query);
2035 check_result(result, "isc_socket_connect");
2036 /*
2037 * If we're at the endgame of a nameserver search, we need to
2038 * immediately bring up all the queries. Do it here.
2039 */
2040 if (l->ns_search_only && !l->trace_root) {
2041 debug("sending next, since searching");
2042 next = ISC_LIST_NEXT(query, link);
2043 if (next != NULL)
2044 send_tcp_connect(next);
2045 }
2046 }
2047
2048 /*
2049 * Send a UDP packet to the remote nameserver, possible starting the
2050 * recv action as well. Also make sure that the timer is running and
2051 * is properly reset.
2052 */
2053 static void
2054 send_udp(dig_query_t *query) {
2055 dig_lookup_t *l = NULL;
2056 isc_result_t result;
2057
2058 debug("send_udp(%p)", query);
2059
2060 l = query->lookup;
2061 bringup_timer(query, UDP_TIMEOUT);
2062 l->current_query = query;
2063 debug("working on lookup %p, query %p", query->lookup, query);
2064 if (!query->recv_made) {
2065 /* XXX Check the sense of this, need assertion? */
2066 query->waiting_connect = ISC_FALSE;
2067 get_address(query->servname, port, &query->sockaddr);
2068
2069 result = isc_socket_create(socketmgr,
2070 isc_sockaddr_pf(&query->sockaddr),
2071 isc_sockettype_udp, &query->sock);
2072 check_result(result, "isc_socket_create");
2073 sockcount++;
2074 debug("sockcount=%d", sockcount);
2075 if (specified_source) {
2076 result = isc_socket_bind(query->sock, &bind_address);
2077 } else {
2078 isc_sockaddr_anyofpf(&bind_any,
2079 isc_sockaddr_pf(&query->sockaddr));
2080 result = isc_socket_bind(query->sock, &bind_any);
2081 }
2082 check_result(result, "isc_socket_bind");
2083
2084 query->recv_made = ISC_TRUE;
2085 ISC_LINK_INIT(&query->recvbuf, link);
2086 ISC_LIST_ENQUEUE(query->recvlist, &query->recvbuf,
2087 link);
2088 debug("recving with lookup=%p, query=%p, sock=%p",
2089 query->lookup, query, query->sock);
2090 result = isc_socket_recvv(query->sock, &query->recvlist, 1,
2091 global_task, recv_done, query);
2092 check_result(result, "isc_socket_recvv");
2093 recvcount++;
2094 debug("recvcount=%d", recvcount);
2095 }
2096 ISC_LIST_INIT(query->sendlist);
2097 ISC_LIST_ENQUEUE(query->sendlist, &query->sendbuf, link);
2098 debug("sending a request");
2099 TIME_NOW(&query->time_sent);
2100 INSIST(query->sock != NULL);
2101 query->waiting_senddone = ISC_TRUE;
2102 result = isc_socket_sendtov(query->sock, &query->sendlist,
2103 global_task, send_done, query,
2104 &query->sockaddr, NULL);
2105 check_result(result, "isc_socket_sendtov");
2106 sendcount++;
2107 }
2108
2109 /*
2110 * IO timeout handler, used for both connect and recv timeouts. If
2111 * retries are still allowed, either resend the UDP packet or queue a
2112 * new TCP lookup. Otherwise, cancel the lookup.
2113 */
2114 static void
2115 connect_timeout(isc_task_t *task, isc_event_t *event) {
2116 dig_lookup_t *l = NULL;
2117 dig_query_t *query = NULL, *cq;
2118
2119 UNUSED(task);
2120 REQUIRE(event->ev_type == ISC_TIMEREVENT_IDLE);
2121
2122 debug("connect_timeout()");
2123
2124 LOCK_LOOKUP;
2125 l = event->ev_arg;
2126 query = l->current_query;
2127 isc_event_free(&event);
2128
2129 INSIST(!free_now);
2130
2131 if ((query != NULL) && (query->lookup->current_query != NULL) &&
2132 (ISC_LIST_NEXT(query->lookup->current_query, link) != NULL)) {
2133 debug("trying next server...");
2134 cq = query->lookup->current_query;
2135 if (!l->tcp_mode)
2136 send_udp(ISC_LIST_NEXT(cq, link));
2137 else
2138 send_tcp_connect(ISC_LIST_NEXT(cq, link));
2139 UNLOCK_LOOKUP;
2140 return;
2141 }
2142
2143 if (l->retries > 1) {
2144 if (!l->tcp_mode) {
2145 l->retries--;
2146 debug("resending UDP request to first server");
2147 send_udp(ISC_LIST_HEAD(l->q));
2148 } else {
2149 debug("making new TCP request, %d tries left",
2150 l->retries);
2151 l->retries--;
2152 requeue_lookup(l, ISC_TRUE);
2153 cancel_lookup(l);
2154 check_next_lookup(l);
2155 }
2156 } else {
2157 fputs(l->cmdline, stdout);
2158 printf(";; connection timed out; no servers could be "
2159 "reached\n");
2160 cancel_lookup(l);
2161 check_next_lookup(l);
2162 if (exitcode < 9)
2163 exitcode = 9;
2164 }
2165 UNLOCK_LOOKUP;
2166 }
2167
2168 /*
2169 * Event handler for the TCP recv which gets the length header of TCP
2170 * packets. Start the next recv of length bytes.
2171 */
2172 static void
2173 tcp_length_done(isc_task_t *task, isc_event_t *event) {
2174 isc_socketevent_t *sevent;
2175 isc_buffer_t *b = NULL;
2176 isc_result_t result;
2177 dig_query_t *query = NULL;
2178 dig_lookup_t *l;
2179 isc_uint16_t length;
2180
2181 REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE);
2182 INSIST(!free_now);
2183
2184 UNUSED(task);
2185
2186 debug("tcp_length_done()");
2187
2188 LOCK_LOOKUP;
2189 sevent = (isc_socketevent_t *)event;
2190 query = event->ev_arg;
2191
2192 recvcount--;
2193 INSIST(recvcount >= 0);
2194
2195 b = ISC_LIST_HEAD(sevent->bufferlist);
2196 INSIST(b == &query->lengthbuf);
2197 ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
2198
2199 if (sevent->result == ISC_R_CANCELED) {
2200 isc_event_free(&event);
2201 l = query->lookup;
2202 clear_query(query);
2203 check_next_lookup(l);
2204 UNLOCK_LOOKUP;
2205 return;
2206 }
2207 if (sevent->result != ISC_R_SUCCESS) {
2208 char sockstr[ISC_SOCKADDR_FORMATSIZE];
2209 isc_sockaddr_format(&query->sockaddr, sockstr,
2210 sizeof(sockstr));
2211 printf(";; communications error to %s: %s\n",
2212 sockstr, isc_result_totext(sevent->result));
2213 l = query->lookup;
2214 isc_socket_detach(&query->sock);
2215 sockcount--;
2216 debug("sockcount=%d", sockcount);
2217 INSIST(sockcount >= 0);
2218 isc_event_free(&event);
2219 clear_query(query);
2220 check_next_lookup(l);
2221 UNLOCK_LOOKUP;
2222 return;
2223 }
2224 length = isc_buffer_getuint16(b);
2225 if (length == 0) {
2226 isc_event_free(&event);
2227 launch_next_query(query, ISC_FALSE);
2228 UNLOCK_LOOKUP;
2229 return;
2230 }
2231
2232 /*
2233 * Even though the buffer was already init'ed, we need
2234 * to redo it now, to force the length we want.
2235 */
2236 isc_buffer_invalidate(&query->recvbuf);
2237 isc_buffer_init(&query->recvbuf, query->recvspace, length);
2238 ENSURE(ISC_LIST_EMPTY(query->recvlist));
2239 ISC_LINK_INIT(&query->recvbuf, link);
2240 ISC_LIST_ENQUEUE(query->recvlist, &query->recvbuf, link);
2241 debug("recving with lookup=%p, query=%p", query->lookup, query);
2242 result = isc_socket_recvv(query->sock, &query->recvlist, length, task,
2243 recv_done, query);
2244 check_result(result, "isc_socket_recvv");
2245 recvcount++;
2246 debug("resubmitted recv request with length %d, recvcount=%d",
2247 length, recvcount);
2248 isc_event_free(&event);
2249 UNLOCK_LOOKUP;
2250 }
2251
2252 /*
2253 * For transfers that involve multiple recvs (XFR's in particular),
2254 * launch the next recv.
2255 */
2256 static void
2257 launch_next_query(dig_query_t *query, isc_boolean_t include_question) {
2258 isc_result_t result;
2259 dig_lookup_t *l;
2260
2261 INSIST(!free_now);
2262
2263 debug("launch_next_query()");
2264
2265 if (!query->lookup->pending) {
2266 debug("ignoring launch_next_query because !pending");
2267 isc_socket_detach(&query->sock);
2268 sockcount--;
2269 debug("sockcount=%d", sockcount);
2270 INSIST(sockcount >= 0);
2271 query->waiting_connect = ISC_FALSE;
2272 l = query->lookup;
2273 clear_query(query);
2274 check_next_lookup(l);
2275 return;
2276 }
2277
2278 isc_buffer_clear(&query->slbuf);
2279 isc_buffer_clear(&query->lengthbuf);
2280 isc_buffer_putuint16(&query->slbuf, (isc_uint16_t) query->sendbuf.used);
2281 ISC_LIST_INIT(query->sendlist);
2282 ISC_LINK_INIT(&query->slbuf, link);
2283 ISC_LIST_ENQUEUE(query->sendlist, &query->slbuf, link);
2284 if (include_question)
2285 ISC_LIST_ENQUEUE(query->sendlist, &query->sendbuf, link);
2286 ISC_LINK_INIT(&query->lengthbuf, link);
2287 ISC_LIST_ENQUEUE(query->lengthlist, &query->lengthbuf, link);
2288
2289 result = isc_socket_recvv(query->sock, &query->lengthlist, 0,
2290 global_task, tcp_length_done, query);
2291 check_result(result, "isc_socket_recvv");
2292 recvcount++;
2293 debug("recvcount=%d", recvcount);
2294 if (!query->first_soa_rcvd) {
2295 debug("sending a request in launch_next_query");
2296 TIME_NOW(&query->time_sent);
2297 query->waiting_senddone = ISC_TRUE;
2298 result = isc_socket_sendv(query->sock, &query->sendlist,
2299 global_task, send_done, query);
2300 check_result(result, "isc_socket_sendv");
2301 sendcount++;
2302 debug("sendcount=%d", sendcount);
2303 }
2304 query->waiting_connect = ISC_FALSE;
2305 #if 0
2306 check_next_lookup(query->lookup);
2307 #endif
2308 return;
2309 }
2310
2311 /*
2312 * Event handler for TCP connect complete. Make sure the connection was
2313 * successful, then pass into launch_next_query to actually send the
2314 * question.
2315 */
2316 static void
2317 connect_done(isc_task_t *task, isc_event_t *event) {
2318 isc_socketevent_t *sevent = NULL;
2319 dig_query_t *query = NULL, *next;
2320 dig_lookup_t *l;
2321
2322 UNUSED(task);
2323
2324 REQUIRE(event->ev_type == ISC_SOCKEVENT_CONNECT);
2325 INSIST(!free_now);
2326
2327 debug("connect_done()");
2328
2329 LOCK_LOOKUP;
2330 sevent = (isc_socketevent_t *)event;
2331 query = sevent->ev_arg;
2332
2333 INSIST(query->waiting_connect);
2334
2335 query->waiting_connect = ISC_FALSE;
2336
2337 if (sevent->result == ISC_R_CANCELED) {
2338 debug("in cancel handler");
2339 isc_socket_detach(&query->sock);
2340 sockcount--;
2341 INSIST(sockcount >= 0);
2342 debug("sockcount=%d", sockcount);
2343 query->waiting_connect = ISC_FALSE;
2344 isc_event_free(&event);
2345 l = query->lookup;
2346 clear_query(query);
2347 check_next_lookup(l);
2348 UNLOCK_LOOKUP;
2349 return;
2350 }
2351 if (sevent->result != ISC_R_SUCCESS) {
2352 char sockstr[ISC_SOCKADDR_FORMATSIZE];
2353
2354 debug("unsuccessful connection: %s",
2355 isc_result_totext(sevent->result));
2356 isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
2357 if (sevent->result != ISC_R_CANCELED)
2358 printf(";; Connection to %s(%s) for %s failed: "
2359 "%s.\n", sockstr,
2360 query->servname, query->lookup->textname,
2361 isc_result_totext(sevent->result));
2362 isc_socket_detach(&query->sock);
2363 sockcount--;
2364 INSIST(sockcount >= 0);
2365 /* XXX Clean up exitcodes */
2366 if (exitcode < 9)
2367 exitcode = 9;
2368 debug("sockcount=%d", sockcount);
2369 query->waiting_connect = ISC_FALSE;
2370 isc_event_free(&event);
2371 l = query->lookup;
2372 if (l->current_query != NULL)
2373 next = ISC_LIST_NEXT(l->current_query, link);
2374 else
2375 next = NULL;
2376 clear_query(query);
2377 if (next != NULL) {
2378 bringup_timer(next, TCP_TIMEOUT);
2379 send_tcp_connect(next);
2380 } else {
2381 check_next_lookup(l);
2382 }
2383 UNLOCK_LOOKUP;
2384 return;
2385 }
2386 launch_next_query(query, ISC_TRUE);
2387 isc_event_free(&event);
2388 UNLOCK_LOOKUP;
2389 }
2390
2391 /*
2392 * Check if the ongoing XFR needs more data before it's complete, using
2393 * the semantics of IXFR and AXFR protocols. Much of the complexity of
2394 * this routine comes from determining when an IXFR is complete.
2395 * ISC_FALSE means more data is on the way, and the recv has been issued.
2396 */
2397 static isc_boolean_t
2398 check_for_more_data(dig_query_t *query, dns_message_t *msg,
2399 isc_socketevent_t *sevent)
2400 {
2401 dns_rdataset_t *rdataset = NULL;
2402 dns_rdata_t rdata = DNS_RDATA_INIT;
2403 dns_rdata_soa_t soa;
2404 isc_uint32_t serial;
2405 isc_result_t result;
2406
2407 debug("check_for_more_data()");
2408
2409 /*
2410 * By the time we're in this routine, we know we're doing
2411 * either an AXFR or IXFR. If there's no second_rr_type,
2412 * then we don't yet know which kind of answer we got back
2413 * from the server. Here, we're going to walk through the
2414 * rr's in the message, acting as necessary whenever we hit
2415 * an SOA rr.
2416 */
2417
2418 query->msg_count++;
2419 result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
2420 if (result != ISC_R_SUCCESS) {
2421 puts("; Transfer failed.");
2422 return (ISC_TRUE);
2423 }
2424 do {
2425 dns_name_t *name;
2426 name = NULL;
2427 dns_message_currentname(msg, DNS_SECTION_ANSWER,
2428 &name);
2429 for (rdataset = ISC_LIST_HEAD(name->list);
2430 rdataset != NULL;
2431 rdataset = ISC_LIST_NEXT(rdataset, link)) {
2432 result = dns_rdataset_first(rdataset);
2433 if (result != ISC_R_SUCCESS)
2434 continue;
2435 do {
2436 query->rr_count++;
2437 dns_rdata_reset(&rdata);
2438 dns_rdataset_current(rdataset, &rdata);
2439 /*
2440 * If this is the first rr, make sure
2441 * it's an SOA
2442 */
2443 if ((!query->first_soa_rcvd) &&
2444 (rdata.type != dns_rdatatype_soa)) {
2445 puts("; Transfer failed. "
2446 "Didn't start with SOA answer.");
2447 return (ISC_TRUE);
2448 }
2449 if ((!query->second_rr_rcvd) &&
2450 (rdata.type != dns_rdatatype_soa)) {
2451 query->second_rr_rcvd = ISC_TRUE;
2452 query->second_rr_serial = 0;
2453 debug("got the second rr as nonsoa");
2454 goto next_rdata;
2455 }
2456
2457 /*
2458 * If the record is anything except an SOA
2459 * now, just continue on...
2460 */
2461 if (rdata.type != dns_rdatatype_soa)
2462 goto next_rdata;
2463 /* Now we have an SOA. Work with it. */
2464 debug("got an SOA");
2465 (void)dns_rdata_tostruct(&rdata, &soa, NULL);
2466 serial = soa.serial;
2467 dns_rdata_freestruct(&soa);
2468 if (!query->first_soa_rcvd) {
2469 query->first_soa_rcvd = ISC_TRUE;
2470 query->first_rr_serial = serial;
2471 debug("this is the first %d",
2472 query->lookup->ixfr_serial);
2473 if (query->lookup->ixfr_serial >=
2474 serial)
2475 goto doexit;
2476 goto next_rdata;
2477 }
2478 if (query->lookup->rdtype ==
2479 dns_rdatatype_axfr) {
2480 debug("doing axfr, got second SOA");
2481 goto doexit;
2482 }
2483 if (!query->second_rr_rcvd) {
2484 if (query->first_rr_serial == serial) {
2485 debug("doing ixfr, got "
2486 "empty zone");
2487 goto doexit;
2488 }
2489 debug("this is the second %d",
2490 query->lookup->ixfr_serial);
2491 query->second_rr_rcvd = ISC_TRUE;
2492 query->second_rr_serial = serial;
2493 goto next_rdata;
2494 }
2495 if (query->second_rr_serial == 0) {
2496 /*
2497 * If the second RR was a non-SOA
2498 * record, and we're getting any
2499 * other SOA, then this is an
2500 * AXFR, and we're done.
2501 */
2502 debug("done, since axfr");
2503 goto doexit;
2504 }
2505 /*
2506 * If we get to this point, we're doing an
2507 * IXFR and have to start really looking
2508 * at serial numbers.
2509 */
2510 if (query->first_rr_serial == serial) {
2511 debug("got a match for ixfr");
2512 if (!query->first_repeat_rcvd) {
2513 query->first_repeat_rcvd =
2514 ISC_TRUE;
2515 goto next_rdata;
2516 }
2517 debug("done with ixfr");
2518 goto doexit;
2519 }
2520 debug("meaningless soa %d", serial);
2521 next_rdata:
2522 result = dns_rdataset_next(rdataset);
2523 } while (result == ISC_R_SUCCESS);
2524 }
2525 result = dns_message_nextname(msg, DNS_SECTION_ANSWER);
2526 } while (result == ISC_R_SUCCESS);
2527 launch_next_query(query, ISC_FALSE);
2528 return (ISC_FALSE);
2529 doexit:
2530 received(sevent->n, &sevent->address, query);
2531 return (ISC_TRUE);
2532 }
2533
2534 /*
2535 * Event handler for recv complete. Perform whatever actions are necessary,
2536 * based on the specifics of the user's request.
2537 */
2538 static void
2539 recv_done(isc_task_t *task, isc_event_t *event) {
2540 isc_socketevent_t *sevent = NULL;
2541 dig_query_t *query = NULL;
2542 isc_buffer_t *b = NULL;
2543 dns_message_t *msg = NULL;
2544 #ifdef DIG_SIGCHASE
2545 dig_message_t *chase_msg = NULL;
2546 dig_message_t *chase_msg2 = NULL;
2547 #endif
2548 isc_result_t result;
2549 dig_lookup_t *n, *l;
2550 isc_boolean_t docancel = ISC_FALSE;
2551 isc_boolean_t match = ISC_TRUE;
2552 unsigned int parseflags;
2553 dns_messageid_t id;
2554 unsigned int msgflags;
2555 #ifdef DIG_SIGCHASE
2556 isc_result_t do_sigchase = ISC_FALSE;
2557
2558 dns_message_t *msg_temp = NULL;
2559 isc_region_t r;
2560 isc_buffer_t *buf = NULL;
2561 #endif
2562
2563 UNUSED(task);
2564 INSIST(!free_now);
2565
2566 debug("recv_done()");
2567
2568 LOCK_LOOKUP;
2569 recvcount--;
2570 debug("recvcount=%d", recvcount);
2571 INSIST(recvcount >= 0);
2572
2573 query = event->ev_arg;
2574 debug("lookup=%p, query=%p", query->lookup, query);
2575
2576 l = query->lookup;
2577
2578 REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE);
2579 sevent = (isc_socketevent_t *)event;
2580
2581 b = ISC_LIST_HEAD(sevent->bufferlist);
2582 INSIST(b == &query->recvbuf);
2583 ISC_LIST_DEQUEUE(sevent->bufferlist, &query->recvbuf, link);
2584
2585 if ((l->tcp_mode) && (l->timer != NULL))
2586 isc_timer_touch(l->timer);
2587 if ((!l->pending && !l->ns_search_only) || cancel_now) {
2588 debug("no longer pending. Got %s",
2589 isc_result_totext(sevent->result));
2590 query->waiting_connect = ISC_FALSE;
2591
2592 isc_event_free(&event);
2593 clear_query(query);
2594 check_next_lookup(l);
2595 UNLOCK_LOOKUP;
2596 return;
2597 }
2598
2599 if (sevent->result != ISC_R_SUCCESS) {
2600 if (sevent->result == ISC_R_CANCELED) {
2601 debug("in recv cancel handler");
2602 query->waiting_connect = ISC_FALSE;
2603 } else {
2604 printf(";; communications error: %s\n",
2605 isc_result_totext(sevent->result));
2606 isc_socket_detach(&query->sock);
2607 sockcount--;
2608 debug("sockcount=%d", sockcount);
2609 INSIST(sockcount >= 0);
2610 }
2611 isc_event_free(&event);
2612 clear_query(query);
2613 check_next_lookup(l);
2614 UNLOCK_LOOKUP;
2615 return;
2616 }
2617
2618 if (!l->tcp_mode &&
2619 !isc_sockaddr_equal(&sevent->address, &query->sockaddr)) {
2620 char buf1[ISC_SOCKADDR_FORMATSIZE];
2621 char buf2[ISC_SOCKADDR_FORMATSIZE];
2622 isc_sockaddr_t any;
2623
2624 if (isc_sockaddr_pf(&query->sockaddr) == AF_INET)
2625 isc_sockaddr_any(&any);
2626 else
2627 isc_sockaddr_any6(&any);
2628
2629 #ifdef ISC_PLATFORM_HAVESCOPEID
2630 /*
2631 * Accept answers from any scope if we havn't specified the
2632 * scope as long as the address and port match.
2633 */
2634 if (isc_sockaddr_pf(&query->sockaddr) == AF_INET6 &&
2635 query->sockaddr.type.sin6.sin6_scope_id == 0 &&
2636 memcmp(&sevent->address.type.sin6.sin6_addr,
2637 &query->sockaddr.type.sin6.sin6_addr,
2638 sizeof(query->sockaddr.type.sin6.sin6_addr)) == 0 &&
2639 isc_sockaddr_getport(&sevent->address) ==
2640 isc_sockaddr_getport(&query->sockaddr))
2641 /* empty */;
2642 else
2643 #endif
2644 /*
2645 * We don't expect a match above when the packet is
2646 * sent to 0.0.0.0, :: or to a multicast addresses.
2647 * XXXMPA broadcast needs to be handled here as well.
2648 */
2649 if ((!isc_sockaddr_eqaddr(&query->sockaddr, &any) &&
2650 !isc_sockaddr_ismulticast(&query->sockaddr)) ||
2651 isc_sockaddr_getport(&query->sockaddr) !=
2652 isc_sockaddr_getport(&sevent->address)) {
2653 isc_sockaddr_format(&sevent->address, buf1,
2654 sizeof(buf1));
2655 isc_sockaddr_format(&query->sockaddr, buf2,
2656 sizeof(buf2));
2657 printf(";; reply from unexpected source: %s,"
2658 " expected %s\n", buf1, buf2);
2659 match = ISC_FALSE;
2660 }
2661 }
2662
2663 result = dns_message_peekheader(b, &id, &msgflags);
2664 if (result != ISC_R_SUCCESS || l->sendmsg->id != id) {
2665 match = ISC_FALSE;
2666 if (l->tcp_mode) {
2667 isc_boolean_t fail = ISC_TRUE;
2668 if (result == ISC_R_SUCCESS) {
2669 if (!query->first_soa_rcvd ||
2670 query->warn_id)
2671 printf(";; %s: ID mismatch: "
2672 "expected ID %u, got %u\n",
2673 query->first_soa_rcvd ?
2674 "WARNING" : "ERROR",
2675 l->sendmsg->id, id);
2676 if (query->first_soa_rcvd)
2677 fail = ISC_FALSE;
2678 query->warn_id = ISC_FALSE;
2679 } else
2680 printf(";; ERROR: short "
2681 "(< header size) message\n");
2682 if (fail) {
2683 isc_event_free(&event);
2684 clear_query(query);
2685 check_next_lookup(l);
2686 UNLOCK_LOOKUP;
2687 return;
2688 }
2689 match = ISC_TRUE;
2690 } else if (result == ISC_R_SUCCESS)
2691 printf(";; Warning: ID mismatch: "
2692 "expected ID %u, got %u\n", l->sendmsg->id, id);
2693 else
2694 printf(";; Warning: short "
2695 "(< header size) message received\n");
2696 }
2697
2698 if (!match) {
2699 isc_buffer_invalidate(&query->recvbuf);
2700 isc_buffer_init(&query->recvbuf, query->recvspace, COMMSIZE);
2701 ISC_LIST_ENQUEUE(query->recvlist, &query->recvbuf, link);
2702 result = isc_socket_recvv(query->sock, &query->recvlist, 1,
2703 global_task, recv_done, query);
2704 check_result(result, "isc_socket_recvv");
2705 recvcount++;
2706 isc_event_free(&event);
2707 UNLOCK_LOOKUP;
2708 return;
2709 }
2710
2711 result = dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &msg);
2712 check_result(result, "dns_message_create");
2713
2714 if (key != NULL) {
2715 if (l->querysig == NULL) {
2716 debug("getting initial querysig");
2717 result = dns_message_getquerytsig(l->sendmsg, mctx,
2718 &l->querysig);
2719 check_result(result, "dns_message_getquerytsig");
2720 }
2721 result = dns_message_setquerytsig(msg, l->querysig);
2722 check_result(result, "dns_message_setquerytsig");
2723 result = dns_message_settsigkey(msg, key);
2724 check_result(result, "dns_message_settsigkey");
2725 msg->tsigctx = l->tsigctx;
2726 l->tsigctx = NULL;
2727 if (l->msgcounter != 0)
2728 msg->tcp_continuation = 1;
2729 l->msgcounter++;
2730 }
2731
2732 debug("before parse starts");
2733 parseflags = DNS_MESSAGEPARSE_PRESERVEORDER;
2734 #ifdef DIG_SIGCHASE
2735 if (!l->sigchase) {
2736 do_sigchase = ISC_FALSE;
2737 } else {
2738 parseflags = 0;
2739 do_sigchase = ISC_TRUE;
2740 }
2741 #endif
2742 if (l->besteffort) {
2743 parseflags |= DNS_MESSAGEPARSE_BESTEFFORT;
2744 parseflags |= DNS_MESSAGEPARSE_IGNORETRUNCATION;
2745 }
2746 result = dns_message_parse(msg, b, parseflags);
2747 if (result == DNS_R_RECOVERABLE) {
2748 printf(";; Warning: Message parser reports malformed "
2749 "message packet.\n");
2750 result = ISC_R_SUCCESS;
2751 }
2752 if (result != ISC_R_SUCCESS) {
2753 printf(";; Got bad packet: %s\n", isc_result_totext(result));
2754 hex_dump(b);
2755 query->waiting_connect = ISC_FALSE;
2756 dns_message_destroy(&msg);
2757 isc_event_free(&event);
2758 clear_query(query);
2759 cancel_lookup(l);
2760 check_next_lookup(l);
2761 UNLOCK_LOOKUP;
2762 return;
2763 }
2764 if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0
2765 && !l->ignore && !l->tcp_mode) {
2766 printf(";; Truncated, retrying in TCP mode.\n");
2767 n = requeue_lookup(l, ISC_TRUE);
2768 n->tcp_mode = ISC_TRUE;
2769 n->origin = query->lookup->origin;
2770 dns_message_destroy(&msg);
2771 isc_event_free(&event);
2772 clear_query(query);
2773 cancel_lookup(l);
2774 check_next_lookup(l);
2775 UNLOCK_LOOKUP;
2776 return;
2777 }
2778 if (msg->rcode == dns_rcode_servfail && !l->servfail_stops) {
2779 dig_query_t *next = ISC_LIST_NEXT(query, link);
2780 if (l->current_query == query)
2781 l->current_query = NULL;
2782 if (next != NULL) {
2783 debug("sending query %p\n", next);
2784 if (l->tcp_mode)
2785 send_tcp_connect(next);
2786 else
2787 send_udp(next);
2788 }
2789 /*
2790 * If our query is at the head of the list and there
2791 * is no next, we're the only one left, so fall
2792 * through to print the message.
2793 */
2794 if ((ISC_LIST_HEAD(l->q) != query) ||
2795 (ISC_LIST_NEXT(query, link) != NULL)) {
2796 printf(";; Got SERVFAIL reply from %s, "
2797 "trying next server\n",
2798 query->servname);
2799 clear_query(query);
2800 check_next_lookup(l);
2801 dns_message_destroy(&msg);
2802 isc_event_free(&event);
2803 UNLOCK_LOOKUP;
2804 return;
2805 }
2806 }
2807
2808 if (key != NULL) {
2809 result = dns_tsig_verify(&query->recvbuf, msg, NULL, NULL);
2810 if (result != ISC_R_SUCCESS) {
2811 printf(";; Couldn't verify signature: %s\n",
2812 isc_result_totext(result));
2813 validated = ISC_FALSE;
2814 }
2815 l->tsigctx = msg->tsigctx;
2816 msg->tsigctx = NULL;
2817 if (l->querysig != NULL) {
2818 debug("freeing querysig buffer %p", l->querysig);
2819 isc_buffer_free(&l->querysig);
2820 }
2821 result = dns_message_getquerytsig(msg, mctx, &l->querysig);
2822 check_result(result,"dns_message_getquerytsig");
2823 }
2824
2825 debug("after parse");
2826 if (l->doing_xfr && l->xfr_q == NULL) {
2827 l->xfr_q = query;
2828 /*
2829 * Once we are in the XFR message, increase
2830 * the timeout to much longer, so brief network
2831 * outages won't cause the XFR to abort
2832 */
2833 if (timeout != INT_MAX && l->timer != NULL) {
2834 unsigned int local_timeout;
2835
2836 if (timeout == 0) {
2837 if (l->tcp_mode)
2838 local_timeout = TCP_TIMEOUT * 4;
2839 else
2840 local_timeout = UDP_TIMEOUT * 4;
2841 } else {
2842 if (timeout < (INT_MAX / 4))
2843 local_timeout = timeout * 4;
2844 else
2845 local_timeout = INT_MAX;
2846 }
2847 debug("have local timeout of %d", local_timeout);
2848 isc_interval_set(&l->interval, local_timeout, 0);
2849 result = isc_timer_reset(l->timer,
2850 isc_timertype_once,
2851 NULL,
2852 &l->interval,
2853 ISC_FALSE);
2854 check_result(result, "isc_timer_reset");
2855 }
2856 }
2857
2858 if (!l->doing_xfr || l->xfr_q == query) {
2859 if (msg->rcode != dns_rcode_noerror && l->origin != NULL) {
2860 if (!next_origin(msg, query)) {
2861 printmessage(query, msg, ISC_TRUE);
2862 received(b->used, &sevent->address, query);
2863 }
2864 } else if (!l->trace && !l->ns_search_only) {
2865 #ifdef DIG_SIGCHASE
2866 if (!do_sigchase)
2867 #endif
2868 printmessage(query, msg, ISC_TRUE);
2869 } else if (l->trace) {
2870 int n = 0;
2871 int count = msg->counts[DNS_SECTION_ANSWER];
2872
2873 debug("in TRACE code");
2874 if (!l->ns_search_only)
2875 printmessage(query, msg, ISC_TRUE);
2876
2877 l->rdtype = l->qrdtype;
2878 if (l->trace_root || (l->ns_search_only && count > 0)) {
2879 if (!l->trace_root)
2880 l->rdtype = dns_rdatatype_soa;
2881 n = followup_lookup(msg, query,
2882 DNS_SECTION_ANSWER);
2883 l->trace_root = ISC_FALSE;
2884 } else if (count == 0)
2885 n = followup_lookup(msg, query,
2886 DNS_SECTION_AUTHORITY);
2887 if (n == 0)
2888 docancel = ISC_TRUE;
2889 } else {
2890 debug("in NSSEARCH code");
2891
2892 if (l->trace_root) {
2893 /*
2894 * This is the initial NS query.
2895 */
2896 int n;
2897
2898 l->rdtype = dns_rdatatype_soa;
2899 n = followup_lookup(msg, query,
2900 DNS_SECTION_ANSWER);
2901 if (n == 0)
2902 docancel = ISC_TRUE;
2903 l->trace_root = ISC_FALSE;
2904 } else
2905 #ifdef DIG_SIGCHASE
2906 if (!do_sigchase)
2907 #endif
2908 printmessage(query, msg, ISC_TRUE);
2909 }
2910 #ifdef DIG_SIGCHASE
2911 if (do_sigchase) {
2912 chase_msg = isc_mem_allocate(mctx,
2913 sizeof(dig_message_t));
2914 if (chase_msg == NULL) {
2915 fatal("Memory allocation failure in %s:%d",
2916 __FILE__, __LINE__);
2917 }
2918 ISC_LIST_INITANDAPPEND(chase_message_list, chase_msg,
2919 link);
2920 if (dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE,
2921 &msg_temp) != ISC_R_SUCCESS) {
2922 fatal("dns_message_create in %s:%d",
2923 __FILE__, __LINE__);
2924 }
2925
2926 isc_buffer_usedregion(b, &r);
2927 result = isc_buffer_allocate(mctx, &buf, r.length);
2928
2929 check_result(result, "isc_buffer_allocate");
2930 result = isc_buffer_copyregion(buf, &r);
2931 check_result(result, "isc_buffer_copyregion");
2932
2933 result = dns_message_parse(msg_temp, buf, 0);
2934
2935 isc_buffer_free(&buf);
2936 chase_msg->msg = msg_temp;
2937
2938 chase_msg2 = isc_mem_allocate(mctx,
2939 sizeof(dig_message_t));
2940 if (chase_msg2 == NULL) {
2941 fatal("Memory allocation failure in %s:%d",
2942 __FILE__, __LINE__);
2943 }
2944 ISC_LIST_INITANDAPPEND(chase_message_list2, chase_msg2,
2945 link);
2946 chase_msg2->msg = msg;
2947 }
2948 #endif
2949
2950 }
2951
2952 #ifdef DIG_SIGCHASE
2953 if (l->sigchase && ISC_LIST_EMPTY(lookup_list)) {
2954 sigchase(msg_temp);
2955 }
2956 #endif
2957
2958 if (l->pending)
2959 debug("still pending.");
2960 if (l->doing_xfr) {
2961 if (query != l->xfr_q) {
2962 dns_message_destroy(&msg);
2963 isc_event_free(&event);
2964 query->waiting_connect = ISC_FALSE;
2965 UNLOCK_LOOKUP;
2966 return;
2967 }
2968 if (!docancel)
2969 docancel = check_for_more_data(query, msg, sevent);
2970 if (docancel) {
2971 dns_message_destroy(&msg);
2972 clear_query(query);
2973 cancel_lookup(l);
2974 check_next_lookup(l);
2975 }
2976 } else {
2977
2978 if (msg->rcode == dns_rcode_noerror || l->origin == NULL) {
2979
2980 #ifdef DIG_SIGCHASE
2981 if (!l->sigchase)
2982 #endif
2983 received(b->used, &sevent->address, query);
2984 }
2985
2986 if (!query->lookup->ns_search_only)
2987 query->lookup->pending = ISC_FALSE;
2988 if (!query->lookup->ns_search_only ||
2989 query->lookup->trace_root || docancel) {
2990 #ifdef DIG_SIGCHASE
2991 if (!do_sigchase)
2992 #endif
2993 dns_message_destroy(&msg);
2994
2995 cancel_lookup(l);
2996 }
2997 clear_query(query);
2998 check_next_lookup(l);
2999 }
3000 if (msg != NULL) {
3001 #ifdef DIG_SIGCHASE
3002 if (do_sigchase)
3003 msg = NULL;
3004 else
3005 #endif
3006 dns_message_destroy(&msg);
3007 }
3008 isc_event_free(&event);
3009 UNLOCK_LOOKUP;
3010 }
3011
3012 /*
3013 * Turn a name into an address, using system-supplied routines. This is
3014 * used in looking up server names, etc... and needs to use system-supplied
3015 * routines, since they may be using a non-DNS system for these lookups.
3016 */
3017 void
3018 get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr) {
3019 int count;
3020 isc_result_t result;
3021
3022 isc_app_block();
3023 result = bind9_getaddresses(host, port, sockaddr, 1, &count);
3024 isc_app_unblock();
3025 if (result != ISC_R_SUCCESS)
3026 fatal("couldn't get address for '%s': %s",
3027 host, isc_result_totext(result));
3028 INSIST(count == 1);
3029 }
3030
3031 /*
3032 * Initiate either a TCP or UDP lookup
3033 */
3034 void
3035 do_lookup(dig_lookup_t *lookup) {
3036
3037 REQUIRE(lookup != NULL);
3038
3039 debug("do_lookup()");
3040 lookup->pending = ISC_TRUE;
3041 if (lookup->tcp_mode)
3042 send_tcp_connect(ISC_LIST_HEAD(lookup->q));
3043 else
3044 send_udp(ISC_LIST_HEAD(lookup->q));
3045 }
3046
3047 /*
3048 * Start everything in action upon task startup.
3049 */
3050 void
3051 onrun_callback(isc_task_t *task, isc_event_t *event) {
3052 UNUSED(task);
3053
3054 isc_event_free(&event);
3055 LOCK_LOOKUP;
3056 start_lookup();
3057 UNLOCK_LOOKUP;
3058 }
3059
3060 /*
3061 * Make everything on the lookup queue go away. Mainly used by the
3062 * SIGINT handler.
3063 */
3064 void
3065 cancel_all(void) {
3066 dig_lookup_t *l, *n;
3067 dig_query_t *q, *nq;
3068
3069 debug("cancel_all()");
3070
3071 LOCK_LOOKUP;
3072 if (free_now) {
3073 UNLOCK_LOOKUP;
3074 return;
3075 }
3076 cancel_now = ISC_TRUE;
3077 if (current_lookup != NULL) {
3078 if (current_lookup->timer != NULL)
3079 isc_timer_detach(&current_lookup->timer);
3080 q = ISC_LIST_HEAD(current_lookup->q);
3081 while (q != NULL) {
3082 debug("cancelling query %p, belonging to %p",
3083 q, current_lookup);
3084 nq = ISC_LIST_NEXT(q, link);
3085 if (q->sock != NULL) {
3086 isc_socket_cancel(q->sock, NULL,
3087 ISC_SOCKCANCEL_ALL);
3088 } else {
3089 clear_query(q);
3090 }
3091 q = nq;
3092 }
3093 }
3094 l = ISC_LIST_HEAD(lookup_list);
3095 while (l != NULL) {
3096 n = ISC_LIST_NEXT(l, link);
3097 ISC_LIST_DEQUEUE(lookup_list, l, link);
3098 try_clear_lookup(l);
3099 l = n;
3100 }
3101 UNLOCK_LOOKUP;
3102 }
3103
3104 /*
3105 * Destroy all of the libs we are using, and get everything ready for a
3106 * clean shutdown.
3107 */
3108 void
3109 destroy_libs(void) {
3110 #ifdef DIG_SIGCHASE
3111 void * ptr;
3112 dig_message_t *chase_msg;
3113 #endif
3114
3115 debug("destroy_libs()");
3116 if (global_task != NULL) {
3117 debug("freeing task");
3118 isc_task_detach(&global_task);
3119 }
3120 /*
3121 * The taskmgr_destroy() call blocks until all events are cleared
3122 * from the task.
3123 */
3124 if (taskmgr != NULL) {
3125 debug("freeing taskmgr");
3126 isc_taskmgr_destroy(&taskmgr);
3127 }
3128 LOCK_LOOKUP;
3129 REQUIRE(sockcount == 0);
3130 REQUIRE(recvcount == 0);
3131 REQUIRE(sendcount == 0);
3132
3133 INSIST(ISC_LIST_HEAD(lookup_list) == NULL);
3134 INSIST(current_lookup == NULL);
3135 INSIST(!free_now);
3136
3137 free_now = ISC_TRUE;
3138
3139 lwres_conf_clear(lwctx);
3140 lwres_context_destroy(&lwctx);
3141
3142 flush_server_list();
3143
3144 clear_searchlist();
3145 if (commctx != NULL) {
3146 debug("freeing commctx");
3147 isc_mempool_destroy(&commctx);
3148 }
3149 if (socketmgr != NULL) {
3150 debug("freeing socketmgr");
3151 isc_socketmgr_destroy(&socketmgr);
3152 }
3153 if (timermgr != NULL) {
3154 debug("freeing timermgr");
3155 isc_timermgr_destroy(&timermgr);
3156 }
3157 if (key != NULL) {
3158 debug("freeing key %p", key);
3159 dns_tsigkey_detach(&key);
3160 }
3161 if (namebuf != NULL)
3162 isc_buffer_free(&namebuf);
3163
3164 if (is_dst_up) {
3165 debug("destroy DST lib");
3166 dst_lib_destroy();
3167 is_dst_up = ISC_FALSE;
3168 }
3169 if (entp != NULL) {
3170 debug("detach from entropy");
3171 isc_entropy_detach(&entp);
3172 }
3173
3174 UNLOCK_LOOKUP;
3175 DESTROYLOCK(&lookup_lock);
3176 #ifdef DIG_SIGCHASE
3177
3178 debug("Destroy the messages kept for sigchase");
3179 /* Destroy the messages kept for sigchase */
3180 chase_msg = ISC_LIST_HEAD(chase_message_list);
3181
3182 while (chase_msg != NULL) {
3183 INSIST(chase_msg->msg != NULL);
3184 dns_message_destroy(&(chase_msg->msg));
3185 ptr = chase_msg;
3186 chase_msg = ISC_LIST_NEXT(chase_msg, link);
3187 isc_mem_free(mctx, ptr);
3188 }
3189
3190 chase_msg = ISC_LIST_HEAD(chase_message_list2);
3191
3192 while (chase_msg != NULL) {
3193 INSIST(chase_msg->msg != NULL);
3194 dns_message_destroy(&(chase_msg->msg));
3195 ptr = chase_msg;
3196 chase_msg = ISC_LIST_NEXT(chase_msg, link);
3197 isc_mem_free(mctx, ptr);
3198 }
3199 if (dns_name_dynamic(&chase_name))
3200 free_name(&chase_name, mctx);
3201 #if DIG_SIGCHASE_TD
3202 if (dns_name_dynamic(&chase_current_name))
3203 free_name(&chase_current_name, mctx);
3204 if (dns_name_dynamic(&chase_authority_name))
3205 free_name(&chase_authority_name, mctx);
3206 #endif
3207 #if DIG_SIGCHASE_BU
3208 if (dns_name_dynamic(&chase_signame))
3209 free_name(&chase_signame, mctx);
3210 #endif
3211
3212 debug("Destroy memory");
3213
3214 #endif
3215 if (memdebugging != 0)
3216 isc_mem_stats(mctx, stderr);
3217 if (mctx != NULL)
3218 isc_mem_destroy(&mctx);
3219 }
3220
3221
3222
3223
3224 #ifdef DIG_SIGCHASE
3225 void
3226 print_type(dns_rdatatype_t type)
3227 {
3228 isc_buffer_t * b = NULL;
3229 isc_result_t result;
3230 isc_region_t r;
3231
3232 result = isc_buffer_allocate(mctx, &b, 4000);
3233 check_result(result, "isc_buffer_allocate");
3234
3235 result = dns_rdatatype_totext(type, b);
3236 check_result(result, "print_type");
3237
3238 isc_buffer_usedregion(b, &r);
3239 r.base[r.length] = '\0';
3240
3241 printf("%s", r.base);
3242
3243 isc_buffer_free(&b);
3244 }
3245
3246 void
3247 dump_database_section(dns_message_t *msg, int section)
3248 {
3249 dns_name_t *msg_name=NULL;
3250
3251 dns_rdataset_t *rdataset;
3252
3253 do {
3254 dns_message_currentname(msg, section, &msg_name);
3255
3256 for (rdataset = ISC_LIST_HEAD(msg_name->list); rdataset != NULL;
3257 rdataset = ISC_LIST_NEXT(rdataset, link)) {
3258 dns_name_print(msg_name, stdout);
3259 printf("\n");
3260 print_rdataset(msg_name, rdataset, mctx);
3261 printf("end\n");
3262 }
3263 msg_name = NULL;
3264 } while (dns_message_nextname(msg, section) == ISC_R_SUCCESS);
3265 }
3266
3267 void
3268 dump_database(void) {
3269 dig_message_t * msg;
3270
3271 for (msg = ISC_LIST_HEAD(chase_message_list); msg != NULL;
3272 msg = ISC_LIST_NEXT(msg, link)) {
3273 if (dns_message_firstname(msg->msg, DNS_SECTION_ANSWER)
3274 == ISC_R_SUCCESS)
3275 dump_database_section(msg->msg, DNS_SECTION_ANSWER);
3276
3277 if (dns_message_firstname(msg->msg, DNS_SECTION_AUTHORITY)
3278 == ISC_R_SUCCESS)
3279 dump_database_section(msg->msg, DNS_SECTION_AUTHORITY);
3280
3281 if (dns_message_firstname(msg->msg, DNS_SECTION_ADDITIONAL)
3282 == ISC_R_SUCCESS)
3283 dump_database_section(msg->msg, DNS_SECTION_ADDITIONAL);
3284 }
3285 }
3286
3287
3288 dns_rdataset_t *
3289 search_type(dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers) {
3290 dns_rdataset_t *rdataset;
3291 dns_rdata_sig_t siginfo;
3292 dns_rdata_t sigrdata;
3293 isc_result_t result;
3294
3295 for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
3296 rdataset = ISC_LIST_NEXT(rdataset, link)) {
3297 if (type == dns_rdatatype_any) {
3298 if (rdataset->type != dns_rdatatype_rrsig)
3299 return (rdataset);
3300 } else if ((type == dns_rdatatype_rrsig) &&
3301 (rdataset->type == dns_rdatatype_rrsig)) {
3302 dns_rdata_init(&sigrdata);
3303 result = dns_rdataset_first(rdataset);
3304 check_result(result, "empty rdataset");
3305 dns_rdataset_current(rdataset, &sigrdata);
3306 result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
3307 check_result(result, "sigrdata tostruct siginfo");
3308
3309 if ((siginfo.covered == covers) ||
3310 (covers == dns_rdatatype_any)) {
3311 dns_rdata_reset(&sigrdata);
3312 dns_rdata_freestruct(&siginfo);
3313 return (rdataset);
3314 }
3315 dns_rdata_reset(&sigrdata);
3316 dns_rdata_freestruct(&siginfo);
3317 } else if (rdataset->type == type)
3318 return (rdataset);
3319 }
3320 return (NULL);
3321 }
3322
3323 dns_rdataset_t *
3324 chase_scanname_section(dns_message_t *msg, dns_name_t *name,
3325 dns_rdatatype_t type, dns_rdatatype_t covers,
3326 int section)
3327 {
3328 dns_rdataset_t *rdataset;
3329 dns_name_t *msg_name = NULL;
3330
3331 do {
3332 dns_message_currentname(msg, section, &msg_name);
3333 if (dns_name_compare(msg_name, name) == 0) {
3334 rdataset = search_type(msg_name, type, covers);
3335 if (rdataset != NULL)
3336 return (rdataset);
3337 }
3338 msg_name = NULL;
3339 } while (dns_message_nextname(msg, section) == ISC_R_SUCCESS);
3340
3341 return (NULL);
3342 }
3343
3344
3345 dns_rdataset_t *
3346 chase_scanname(dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers)
3347 {
3348 dns_rdataset_t *rdataset = NULL;
3349 dig_message_t * msg;
3350
3351 for (msg = ISC_LIST_HEAD(chase_message_list2); msg != NULL;
3352 msg = ISC_LIST_NEXT(msg, link)) {
3353 if (dns_message_firstname(msg->msg, DNS_SECTION_ANSWER)
3354 == ISC_R_SUCCESS)
3355 rdataset = chase_scanname_section(msg->msg, name,
3356 type, covers,
3357 DNS_SECTION_ANSWER);
3358 if (rdataset != NULL)
3359 return (rdataset);
3360 if (dns_message_firstname(msg->msg, DNS_SECTION_AUTHORITY)
3361 == ISC_R_SUCCESS)
3362 rdataset =
3363 chase_scanname_section(msg->msg, name,
3364 type, covers,
3365 DNS_SECTION_AUTHORITY);
3366 if (rdataset != NULL)
3367 return (rdataset);
3368 if (dns_message_firstname(msg->msg, DNS_SECTION_ADDITIONAL)
3369 == ISC_R_SUCCESS)
3370 rdataset =
3371 chase_scanname_section(msg->msg, name, type,
3372 covers,
3373 DNS_SECTION_ADDITIONAL);
3374 if (rdataset != NULL)
3375 return (rdataset);
3376 }
3377
3378 return (NULL);
3379 }
3380
3381 dns_rdataset_t *
3382 sigchase_scanname(dns_rdatatype_t type, dns_rdatatype_t covers,
3383 isc_boolean_t * lookedup, dns_name_t *rdata_name)
3384 {
3385 dig_lookup_t *lookup;
3386 isc_buffer_t *b = NULL;
3387 isc_region_t r;
3388 isc_result_t result;
3389 dns_rdataset_t * temp;
3390 dns_rdatatype_t querytype;
3391
3392 temp = chase_scanname(rdata_name, type, covers);
3393 if (temp != NULL)
3394 return (temp);
3395
3396 if (*lookedup == ISC_TRUE)
3397 return (NULL);
3398
3399 lookup = clone_lookup(current_lookup, ISC_TRUE);
3400 lookup->trace_root = ISC_FALSE;
3401 lookup->new_search = ISC_TRUE;
3402
3403 result = isc_buffer_allocate(mctx, &b, BUFSIZE);
3404 check_result(result, "isc_buffer_allocate");
3405 result = dns_name_totext(rdata_name, ISC_FALSE, b);
3406 check_result(result, "dns_name_totext");
3407 isc_buffer_usedregion(b, &r);
3408 r.base[r.length] = '\0';
3409 strcpy(lookup->textname, (char*)r.base);
3410 isc_buffer_free(&b);
3411
3412 if (type == dns_rdatatype_rrsig)
3413 querytype = covers;
3414 else
3415 querytype = type;
3416
3417 if (querytype == 0 || querytype == 255) {
3418 printf("Error in the queried type: %d\n", querytype);
3419 return (NULL);
3420 }
3421
3422 lookup->rdtype = querytype;
3423 lookup->rdtypeset = ISC_TRUE;
3424 lookup->qrdtype = querytype;
3425 *lookedup = ISC_TRUE;
3426
3427 ISC_LIST_APPEND(lookup_list, lookup, link);
3428 printf("\n\nLaunch a query to find a RRset of type ");
3429 print_type(type);
3430 printf(" for zone: %s\n", lookup->textname);
3431 return (NULL);
3432 }
3433
3434 void
3435 insert_trustedkey(dst_key_t * key)
3436 {
3437 if (key == NULL)
3438 return;
3439 if (tk_list.nb_tk >= MAX_TRUSTED_KEY)
3440 return;
3441
3442 tk_list.key[tk_list.nb_tk++] = key;
3443 return;
3444 }
3445
3446 void
3447 clean_trustedkey()
3448 {
3449 int i = 0;
3450
3451 for (i= 0; i < MAX_TRUSTED_KEY; i++) {
3452 if (tk_list.key[i] != NULL) {
3453 dst_key_free(&tk_list.key[i]);
3454 tk_list.key[i] = NULL;
3455 } else
3456 break;
3457 }
3458 tk_list.nb_tk = 0;
3459 return;
3460 }
3461
3462 char alphnum[] =
3463 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
3464
3465 isc_result_t
3466 removetmpkey(isc_mem_t *mctx, const char *file)
3467 {
3468 char *tempnamekey = NULL;
3469 int tempnamekeylen;
3470 isc_result_t result;
3471
3472 tempnamekeylen = strlen(file)+10;
3473
3474 tempnamekey = isc_mem_allocate(mctx, tempnamekeylen);
3475 if (tempnamekey == NULL)
3476 return (ISC_R_NOMEMORY);
3477
3478 memset(tempnamekey, 0, tempnamekeylen);
3479
3480 strcat(tempnamekey, file);
3481 strcat(tempnamekey,".key");
3482 isc_file_remove(tempnamekey);
3483
3484 result = isc_file_remove(tempnamekey);
3485 isc_mem_free(mctx, tempnamekey);
3486 return (result);
3487 }
3488
3489 isc_result_t
3490 opentmpkey(isc_mem_t *mctx, const char *file, char **tempp, FILE **fp) {
3491 FILE *f = NULL;
3492 isc_result_t result;
3493 char *tempname = NULL;
3494 char *tempnamekey = NULL;
3495 int tempnamelen;
3496 int tempnamekeylen;
3497 char *x;
3498 char *cp;
3499 isc_uint32_t which;
3500
3501 while (1) {
3502 tempnamelen = strlen(file) + 20;
3503 tempname = isc_mem_allocate(mctx, tempnamelen);
3504 if (tempname == NULL)
3505 return (ISC_R_NOMEMORY);
3506 memset(tempname, 0, tempnamelen);
3507
3508 result = isc_file_mktemplate(file, tempname, tempnamelen);
3509 if (result != ISC_R_SUCCESS)
3510 goto cleanup;
3511
3512 cp = tempname;
3513 while (*cp != '\0')
3514 cp++;
3515 if (cp == tempname) {
3516 isc_mem_free(mctx, tempname);
3517 return (ISC_R_FAILURE);
3518 }
3519
3520 x = cp--;
3521 while (cp >= tempname && *cp == 'X') {
3522 isc_random_get(&which);
3523 *cp = alphnum[which % (sizeof(alphnum) - 1)];
3524 x = cp--;
3525 }
3526
3527 tempnamekeylen = tempnamelen+5;
3528 tempnamekey = isc_mem_allocate(mctx, tempnamekeylen);
3529 if (tempnamekey == NULL)
3530 return (ISC_R_NOMEMORY);
3531
3532 memset(tempnamekey, 0, tempnamekeylen);
3533 strncpy(tempnamekey, tempname, tempnamelen);
3534 strcat(tempnamekey ,".key");
3535
3536
3537 if (isc_file_exists(tempnamekey)) {
3538 isc_mem_free(mctx, tempnamekey);
3539 isc_mem_free(mctx, tempname);
3540 continue;
3541 }
3542
3543 if ((f = fopen(tempnamekey, "w")) == NULL) {
3544 printf("get_trusted_key(): trusted key not found %s\n",
3545 tempnamekey);
3546 return (ISC_R_FAILURE);
3547 }
3548 break;
3549 }
3550 isc_mem_free(mctx, tempnamekey);
3551 *tempp = tempname;
3552 *fp = f;
3553 return (ISC_R_SUCCESS);
3554
3555 cleanup:
3556 isc_mem_free(mctx, tempname);
3557
3558 return (result);
3559 }
3560
3561
3562 isc_result_t
3563 get_trusted_key(isc_mem_t *mctx)
3564 {
3565 isc_result_t result;
3566 const char *filename = NULL;
3567 char *filetemp = NULL;
3568 char buf[1500];
3569 FILE *fp, *fptemp;
3570 dst_key_t *key = NULL;
3571
3572 result = isc_file_exists(trustedkey);
3573 if (result != ISC_TRUE) {
3574 result = isc_file_exists("/etc/trusted-key.key");
3575 if (result != ISC_TRUE) {
3576 result = isc_file_exists("./trusted-key.key");
3577 if (result != ISC_TRUE)
3578 return (ISC_R_FAILURE);
3579 else
3580 filename = "./trusted-key.key";
3581 } else
3582 filename = "/etc/trusted-key.key";
3583 } else
3584 filename = trustedkey;
3585
3586 if (filename == NULL) {
3587 printf("No trusted key\n");
3588 return (ISC_R_FAILURE);
3589 }
3590
3591 if ((fp = fopen(filename, "r")) == NULL) {
3592 printf("get_trusted_key(): trusted key not found %s\n",
3593 filename);
3594 return (ISC_R_FAILURE);
3595 }
3596 while (fgets(buf, 1500, fp) != NULL) {
3597 result = opentmpkey(mctx,"tmp_file", &filetemp, &fptemp);
3598 if (result != ISC_R_SUCCESS) {
3599 fclose(fp);
3600 return (ISC_R_FAILURE);
3601 }
3602 if (fputs(buf, fptemp) < 0) {
3603 fclose(fp);
3604 fclose(fptemp);
3605 return (ISC_R_FAILURE);
3606 }
3607 fclose(fptemp);
3608 result = dst_key_fromnamedfile(filetemp, DST_TYPE_PUBLIC,
3609 mctx, &key);
3610 removetmpkey(mctx, filetemp);
3611 isc_mem_free(mctx, filetemp);
3612 if (result != ISC_R_SUCCESS) {
3613 fclose(fp);
3614 return (ISC_R_FAILURE);
3615 }
3616 insert_trustedkey(key);
3617 #if 0
3618 dst_key_tofile(key, DST_TYPE_PUBLIC,"/tmp");
3619 #endif
3620 key = NULL;
3621 }
3622 return (ISC_R_SUCCESS);
3623 }
3624
3625
3626 static void
3627 nameFromString(const char *str, dns_name_t *p_ret) {
3628 size_t len = strlen(str);
3629 isc_result_t result;
3630 isc_buffer_t buffer;
3631 dns_fixedname_t fixedname;
3632
3633 REQUIRE(p_ret != NULL);
3634 REQUIRE(str != NULL);
3635
3636 isc_buffer_init(&buffer, str, len);
3637 isc_buffer_add(&buffer, len);
3638
3639 dns_fixedname_init(&fixedname);
3640 result = dns_name_fromtext(dns_fixedname_name(&fixedname), &buffer,
3641 dns_rootname, ISC_TRUE, NULL);
3642 check_result(result, "nameFromString");
3643
3644 if (dns_name_dynamic(p_ret))
3645 free_name(p_ret, mctx);
3646
3647 result = dns_name_dup(dns_fixedname_name(&fixedname), mctx, p_ret);
3648 check_result(result, "nameFromString");
3649 }
3650
3651
3652 #if DIG_SIGCHASE_TD
3653 isc_result_t
3654 prepare_lookup(dns_name_t *name)
3655 {
3656 isc_result_t result;
3657 dig_lookup_t *lookup = NULL;
3658 dig_server_t *s;
3659 void *ptr;
3660
3661 lookup = clone_lookup(current_lookup, ISC_TRUE);
3662 lookup->trace_root = ISC_FALSE;
3663 lookup->new_search = ISC_TRUE;
3664 lookup->trace_root_sigchase = ISC_FALSE;
3665
3666 strncpy(lookup->textname, lookup->textnamesigchase, MXNAME);
3667
3668 lookup->rdtype = lookup->rdtype_sigchase;
3669 lookup->rdtypeset = ISC_TRUE;
3670 lookup->qrdtype = lookup->qrdtype_sigchase;
3671
3672 s = ISC_LIST_HEAD(lookup->my_server_list);
3673 while (s != NULL) {
3674 debug("freeing server %p belonging to %p",
3675 s, lookup);
3676 ptr = s;
3677 s = ISC_LIST_NEXT(s, link);
3678 ISC_LIST_DEQUEUE(lookup->my_server_list,
3679 (dig_server_t *)ptr, link);
3680 isc_mem_free(mctx, ptr);
3681 }
3682
3683
3684 for (result = dns_rdataset_first(chase_nsrdataset);
3685 result == ISC_R_SUCCESS;
3686 result = dns_rdataset_next(chase_nsrdataset)) {
3687 char namestr[DNS_NAME_FORMATSIZE];
3688 dns_rdata_ns_t ns;
3689 dns_rdata_t rdata = DNS_RDATA_INIT;
3690 dig_server_t * srv = NULL;
3691 #define __FOLLOW_GLUE__
3692 #ifdef __FOLLOW_GLUE__
3693 isc_buffer_t *b = NULL;
3694 isc_result_t result;
3695 isc_region_t r;
3696 dns_rdataset_t *rdataset = NULL;
3697 isc_boolean_t true = ISC_TRUE;
3698 #endif
3699
3700 memset(namestr, 0, DNS_NAME_FORMATSIZE);
3701
3702 dns_rdataset_current(chase_nsrdataset, &rdata);
3703
3704 (void)dns_rdata_tostruct(&rdata, &ns, NULL);
3705
3706
3707
3708 #ifdef __FOLLOW_GLUE__
3709
3710 result = advanced_rrsearch(&rdataset, &ns.name,
3711 dns_rdatatype_aaaa,
3712 dns_rdatatype_any, &true);
3713 if (result == ISC_R_SUCCESS) {
3714 for (result = dns_rdataset_first(rdataset);
3715 result == ISC_R_SUCCESS;
3716 result = dns_rdataset_next(rdataset)) {
3717 dns_rdata_t aaaa = DNS_RDATA_INIT;
3718 dns_rdataset_current(rdataset, &aaaa);
3719
3720 result = isc_buffer_allocate(mctx, &b, 80);
3721 check_result(result, "isc_buffer_allocate");
3722
3723 dns_rdata_totext(&aaaa, &ns.name, b);
3724 isc_buffer_usedregion(b, &r);
3725 r.base[r.length] = '\0';
3726 strncpy(namestr, (char*)r.base,
3727 DNS_NAME_FORMATSIZE);
3728 isc_buffer_free(&b);
3729 dns_rdata_reset(&aaaa);
3730
3731
3732 srv = make_server(namestr, namestr);
3733
3734 ISC_LIST_APPEND(lookup->my_server_list,
3735 srv, link);
3736 }
3737 }
3738
3739 rdataset = NULL;
3740 result = advanced_rrsearch(&rdataset, &ns.name, dns_rdatatype_a,
3741 dns_rdatatype_any, &true);
3742 if (result == ISC_R_SUCCESS) {
3743 for (result = dns_rdataset_first(rdataset);
3744 result == ISC_R_SUCCESS;
3745 result = dns_rdataset_next(rdataset)) {
3746 dns_rdata_t a = DNS_RDATA_INIT;
3747 dns_rdataset_current(rdataset, &a);
3748
3749 result = isc_buffer_allocate(mctx, &b, 80);
3750 check_result(result, "isc_buffer_allocate");
3751
3752 dns_rdata_totext(&a, &ns.name, b);
3753 isc_buffer_usedregion(b, &r);
3754 r.base[r.length] = '\0';
3755 strncpy(namestr, (char*)r.base,
3756 DNS_NAME_FORMATSIZE);
3757 isc_buffer_free(&b);
3758 dns_rdata_reset(&a);
3759 printf("ns name: %s\n", namestr);
3760
3761
3762 srv = make_server(namestr, namestr);
3763
3764 ISC_LIST_APPEND(lookup->my_server_list,
3765 srv, link);
3766 }
3767 }
3768 #else
3769
3770 dns_name_format(&ns.name, namestr, sizeof(namestr));
3771 printf("ns name: ");
3772 dns_name_print(&ns.name, stdout);
3773 printf("\n");
3774 srv = make_server(namestr, namestr);
3775
3776 ISC_LIST_APPEND(lookup->my_server_list, srv, link);
3777
3778 #endif
3779 dns_rdata_freestruct(&ns);
3780 dns_rdata_reset(&rdata);
3781
3782 }
3783
3784 ISC_LIST_APPEND(lookup_list, lookup, link);
3785 printf("\nLaunch a query to find a RRset of type ");
3786 print_type(lookup->rdtype);
3787 printf(" for zone: %s", lookup->textname);
3788 printf(" with nameservers:");
3789 printf("\n");
3790 print_rdataset(name, chase_nsrdataset, mctx);
3791 return (ISC_R_SUCCESS);
3792 }
3793
3794
3795 isc_result_t
3796 child_of_zone(dns_name_t * name, dns_name_t * zone_name,
3797 dns_name_t * child_name)
3798 {
3799 dns_namereln_t name_reln;
3800 int orderp;
3801 unsigned int nlabelsp;
3802
3803 name_reln = dns_name_fullcompare(name, zone_name, &orderp, &nlabelsp);
3804 if (name_reln != dns_namereln_subdomain ||
3805 dns_name_countlabels(name) <= dns_name_countlabels(zone_name) + 1) {
3806 printf("\n;; ERROR : ");
3807 dns_name_print(name, stdout);
3808 printf(" is not a subdomain of: ");
3809 dns_name_print(zone_name, stdout);
3810 printf(" FAILED\n\n");
3811 return (ISC_R_FAILURE);
3812 }
3813
3814 dns_name_getlabelsequence(name,
3815 dns_name_countlabels(name) -
3816 dns_name_countlabels(zone_name) -1,
3817 dns_name_countlabels(zone_name) +1,
3818 child_name);
3819 return (ISC_R_SUCCESS);
3820 }
3821
3822 isc_result_t
3823 grandfather_pb_test(dns_name_t *zone_name, dns_rdataset_t *sigrdataset)
3824 {
3825 isc_result_t result;
3826 dns_rdata_t sigrdata;
3827 dns_rdata_sig_t siginfo;
3828
3829 result = dns_rdataset_first(sigrdataset);
3830 check_result(result, "empty RRSIG dataset");
3831 dns_rdata_init(&sigrdata);
3832
3833 do {
3834 dns_rdataset_current(sigrdataset, &sigrdata);
3835
3836 result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
3837 check_result(result, "sigrdata tostruct siginfo");
3838
3839 if (dns_name_compare(&siginfo.signer, zone_name) == 0) {
3840 dns_rdata_freestruct(&siginfo);
3841 dns_rdata_reset(&sigrdata);
3842 return (ISC_R_SUCCESS);
3843 }
3844
3845 dns_rdata_freestruct(&siginfo);
3846
3847 } while (dns_rdataset_next(chase_sigkeyrdataset) == ISC_R_SUCCESS);
3848
3849 dns_rdata_reset(&sigrdata);
3850
3851 return (ISC_R_FAILURE);
3852 }
3853
3854
3855 isc_result_t
3856 initialization(dns_name_t *name)
3857 {
3858 isc_result_t result;
3859 isc_boolean_t true = ISC_TRUE;
3860
3861 chase_nsrdataset = NULL;
3862 result = advanced_rrsearch(&chase_nsrdataset, name, dns_rdatatype_ns,
3863 dns_rdatatype_any, &true);
3864 if (result != ISC_R_SUCCESS) {
3865 printf("\n;; NS RRset is missing to continue validation:"
3866 " FAILED\n\n");
3867 return (ISC_R_FAILURE);
3868 }
3869 INSIST(chase_nsrdataset != NULL);
3870 prepare_lookup(name);
3871
3872 dup_name(name, &chase_current_name, mctx);
3873
3874 return (ISC_R_SUCCESS);
3875 }
3876 #endif
3877
3878 void
3879 print_rdataset(dns_name_t *name, dns_rdataset_t *rdataset, isc_mem_t *mctx)
3880 {
3881 isc_buffer_t *b = NULL;
3882 isc_result_t result;
3883 isc_region_t r;
3884
3885 result = isc_buffer_allocate(mctx, &b, 9000);
3886 check_result(result, "isc_buffer_allocate");
3887
3888 printrdataset(name, rdataset, b);
3889
3890 isc_buffer_usedregion(b, &r);
3891 r.base[r.length] = '\0';
3892
3893
3894 printf("%s\n", r.base);
3895
3896 isc_buffer_free(&b);
3897 }
3898
3899
3900 void
3901 dup_name(dns_name_t *source, dns_name_t *target, isc_mem_t *mctx) {
3902 isc_result_t result;
3903
3904 if (dns_name_dynamic(target))
3905 free_name(target, mctx);
3906 result = dns_name_dup(source, mctx, target);
3907 check_result(result, "dns_name_dup");
3908 }
3909
3910 void
3911 free_name(dns_name_t *name, isc_mem_t *mctx) {
3912 dns_name_free(name, mctx);
3913 dns_name_init(name, NULL);
3914 }
3915
3916 /*
3917 *
3918 * take a DNSKEY RRset and the RRSIG RRset corresponding in parameter
3919 * return ISC_R_SUCCESS if the DNSKEY RRset contains a trusted_key
3920 * and the RRset is valid
3921 * return ISC_R_NOTFOUND if not contains trusted key
3922 or if the RRset isn't valid
3923 * return ISC_R_FAILURE if problem
3924 *
3925 */
3926 isc_result_t
3927 contains_trusted_key(dns_name_t *name, dns_rdataset_t *rdataset,
3928 dns_rdataset_t *sigrdataset,
3929 isc_mem_t *mctx)
3930 {
3931 isc_result_t result;
3932 dns_rdata_t rdata;
3933 dst_key_t *trustedKey = NULL;
3934 dst_key_t *dnsseckey = NULL;
3935 int i;
3936
3937 if (name == NULL || rdataset == NULL)
3938 return (ISC_R_FAILURE);
3939
3940 result = dns_rdataset_first(rdataset);
3941 check_result(result, "empty rdataset");
3942 dns_rdata_init(&rdata);
3943
3944 do {
3945 dns_rdataset_current(rdataset, &rdata);
3946 INSIST(rdata.type == dns_rdatatype_dnskey);
3947
3948 result = dns_dnssec_keyfromrdata(name, &rdata,
3949 mctx, &dnsseckey);
3950 check_result(result, "dns_dnssec_keyfromrdata");
3951
3952
3953 for (i = 0; i < tk_list.nb_tk; i++) {
3954 if (dst_key_compare(tk_list.key[i], dnsseckey)
3955 == ISC_TRUE) {
3956 dns_rdata_reset(&rdata);
3957
3958 printf(";; Ok, find a Trusted Key in the "
3959 "DNSKEY RRset: %d\n",
3960 dst_key_id(dnsseckey));
3961 if (sigchase_verify_sig_key(name, rdataset,
3962 dnsseckey,
3963 sigrdataset,
3964 mctx)
3965 == ISC_R_SUCCESS) {
3966 dst_key_free(&dnsseckey);
3967 dnsseckey = NULL;
3968 return (ISC_R_SUCCESS);
3969 }
3970 }
3971 }
3972
3973 dns_rdata_reset(&rdata);
3974 if (dnsseckey != NULL)
3975 dst_key_free(&dnsseckey);
3976 } while (dns_rdataset_next(rdataset) == ISC_R_SUCCESS);
3977
3978 if (trustedKey != NULL)
3979 dst_key_free(&trustedKey);
3980 trustedKey = NULL;
3981
3982 return (ISC_R_NOTFOUND);
3983 }
3984
3985 isc_result_t
3986 sigchase_verify_sig(dns_name_t *name, dns_rdataset_t *rdataset,
3987 dns_rdataset_t *keyrdataset,
3988 dns_rdataset_t *sigrdataset,
3989 isc_mem_t *mctx)
3990 {
3991 isc_result_t result;
3992 dns_rdata_t keyrdata;
3993 dst_key_t *dnsseckey = NULL;
3994
3995 result = dns_rdataset_first(keyrdataset);
3996 check_result(result, "empty DNSKEY dataset");
3997 dns_rdata_init(&keyrdata);
3998
3999 do {
4000 dns_rdataset_current(keyrdataset, &keyrdata);
4001 INSIST(keyrdata.type == dns_rdatatype_dnskey);
4002
4003 result = dns_dnssec_keyfromrdata(name, &keyrdata,
4004 mctx, &dnsseckey);
4005 check_result(result, "dns_dnssec_keyfromrdata");
4006
4007 result = sigchase_verify_sig_key(name, rdataset, dnsseckey,
4008 sigrdataset, mctx);
4009 if (result == ISC_R_SUCCESS) {
4010 dns_rdata_reset(&keyrdata);
4011 dst_key_free(&dnsseckey);
4012 return (ISC_R_SUCCESS);
4013 }
4014 dst_key_free(&dnsseckey);
4015 } while (dns_rdataset_next(chase_keyrdataset) == ISC_R_SUCCESS);
4016
4017 dns_rdata_reset(&keyrdata);
4018
4019 return (ISC_R_NOTFOUND);
4020 }
4021
4022 isc_result_t
4023 sigchase_verify_sig_key(dns_name_t *name, dns_rdataset_t *rdataset,
4024 dst_key_t *dnsseckey, dns_rdataset_t *sigrdataset,
4025 isc_mem_t *mctx)
4026 {
4027 isc_result_t result;
4028 dns_rdata_t sigrdata;
4029 dns_rdata_sig_t siginfo;
4030
4031 result = dns_rdataset_first(sigrdataset);
4032 check_result(result, "empty RRSIG dataset");
4033 dns_rdata_init(&sigrdata);
4034
4035 do {
4036 dns_rdataset_current(sigrdataset, &sigrdata);
4037
4038 result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
4039 check_result(result, "sigrdata tostruct siginfo");
4040
4041 /*
4042 * Test if the id of the DNSKEY is
4043 * the id of the DNSKEY signer's
4044 */
4045 if (siginfo.keyid == dst_key_id(dnsseckey)) {
4046
4047 result = dns_rdataset_first(rdataset);
4048 check_result(result, "empty DS dataset");
4049
4050 result = dns_dnssec_verify(name, rdataset, dnsseckey,
4051 ISC_FALSE, mctx, &sigrdata);
4052
4053 printf(";; VERIFYING ");
4054 print_type(rdataset->type);
4055 printf(" RRset for ");
4056 dns_name_print(name, stdout);
4057 printf(" with DNSKEY:%d: %s\n", dst_key_id(dnsseckey),
4058 isc_result_totext(result));
4059
4060 if (result == ISC_R_SUCCESS) {
4061 dns_rdata_reset(&sigrdata);
4062 return (result);
4063 }
4064 }
4065 dns_rdata_freestruct(&siginfo);
4066
4067 } while (dns_rdataset_next(chase_sigkeyrdataset) == ISC_R_SUCCESS);
4068
4069 dns_rdata_reset(&sigrdata);
4070
4071 return (ISC_R_NOTFOUND);
4072 }
4073
4074
4075 isc_result_t
4076 sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
4077 dns_rdataset_t *dsrdataset, isc_mem_t *mctx)
4078 {
4079 isc_result_t result;
4080 dns_rdata_t keyrdata;
4081 dns_rdata_t newdsrdata;
4082 dns_rdata_t dsrdata;
4083 dns_rdata_ds_t dsinfo;
4084 dst_key_t *dnsseckey = NULL;
4085 unsigned char dsbuf[DNS_DS_BUFFERSIZE];
4086
4087 result = dns_rdataset_first(dsrdataset);
4088 check_result(result, "empty DSset dataset");
4089 dns_rdata_init(&dsrdata);
4090 do {
4091 dns_rdataset_current(dsrdataset, &dsrdata);
4092
4093 result = dns_rdata_tostruct(&dsrdata, &dsinfo, NULL);
4094 check_result(result, "dns_rdata_tostruct for DS");
4095
4096 result = dns_rdataset_first(keyrdataset);
4097 check_result(result, "empty KEY dataset");
4098 dns_rdata_init(&keyrdata);
4099
4100 do {
4101 dns_rdataset_current(keyrdataset, &keyrdata);
4102 INSIST(keyrdata.type == dns_rdatatype_dnskey);
4103
4104 result = dns_dnssec_keyfromrdata(name, &keyrdata,
4105 mctx, &dnsseckey);
4106 check_result(result, "dns_dnssec_keyfromrdata");
4107
4108 /*
4109 * Test if the id of the DNSKEY is the
4110 * id of DNSKEY referenced by the DS
4111 */
4112 if (dsinfo.key_tag == dst_key_id(dnsseckey)) {
4113 dns_rdata_init(&newdsrdata);
4114
4115 result = dns_ds_buildrdata(name, &keyrdata,
4116 dsinfo.digest_type,
4117 dsbuf, &newdsrdata);
4118 dns_rdata_freestruct(&dsinfo);
4119
4120 if (result != ISC_R_SUCCESS) {
4121 dns_rdata_reset(&keyrdata);
4122 dns_rdata_reset(&newdsrdata);
4123 dns_rdata_reset(&dsrdata);
4124 dst_key_free(&dnsseckey);
4125 dns_rdata_freestruct(&dsinfo);
4126 printf("Oops: impossible to build"
4127 " new DS rdata\n");
4128 return (result);
4129 }
4130
4131
4132 if (dns_rdata_compare(&dsrdata,
4133 &newdsrdata) == 0) {
4134 printf(";; OK a DS valids a DNSKEY"
4135 " in the RRset\n");
4136 printf(";; Now verify that this"
4137 " DNSKEY validates the "
4138 "DNSKEY RRset\n");
4139
4140 result = sigchase_verify_sig_key(name,
4141 keyrdataset,
4142 dnsseckey,
4143 chase_sigkeyrdataset,
4144 mctx);
4145 if (result == ISC_R_SUCCESS) {
4146 dns_rdata_reset(&keyrdata);
4147 dns_rdata_reset(&newdsrdata);
4148 dns_rdata_reset(&dsrdata);
4149 dst_key_free(&dnsseckey);
4150
4151 return (result);
4152 }
4153 } else {
4154 printf(";; This DS is NOT the DS for"
4155 " the chasing KEY: FAILED\n");
4156 }
4157
4158 dns_rdata_reset(&newdsrdata);
4159 }
4160 dst_key_free(&dnsseckey);
4161 dnsseckey = NULL;
4162 } while (dns_rdataset_next(chase_keyrdataset) == ISC_R_SUCCESS);
4163 dns_rdata_reset(&keyrdata);
4164
4165 } while (dns_rdataset_next(chase_dsrdataset) == ISC_R_SUCCESS);
4166 #if 0
4167 dns_rdata_reset(&dsrdata); WARNING
4168 #endif
4169
4170 return (ISC_R_NOTFOUND);
4171 }
4172
4173 /*
4174 *
4175 * take a pointer on a rdataset in parameter and try to resolv it.
4176 * the searched rrset is a rrset on 'name' with type 'type'
4177 * (and if the type is a rrsig the signature cover 'covers').
4178 * the lookedup is to known if you have already done the query on the net.
4179 * ISC_R_SUCCESS: if we found the rrset
4180 * ISC_R_NOTFOUND: we do not found the rrset in cache
4181 * and we do a query on the net
4182 * ISC_R_FAILURE: rrset not found
4183 */
4184 isc_result_t
4185 advanced_rrsearch(dns_rdataset_t **rdataset, dns_name_t *name,
4186 dns_rdatatype_t type, dns_rdatatype_t covers,
4187 isc_boolean_t *lookedup)
4188 {
4189 isc_boolean_t tmplookedup;
4190
4191 INSIST(rdataset != NULL);
4192
4193 if (*rdataset != NULL)
4194 return (ISC_R_SUCCESS);
4195
4196 tmplookedup = *lookedup;
4197 if ((*rdataset = sigchase_scanname(type, covers,
4198 lookedup, name)) == NULL) {
4199 if (tmplookedup)
4200 return (ISC_R_FAILURE);
4201 return (ISC_R_NOTFOUND);
4202 }
4203 *lookedup = ISC_FALSE;
4204 return (ISC_R_SUCCESS);
4205 }
4206
4207
4208
4209 #if DIG_SIGCHASE_TD
4210 void
4211 sigchase_td(dns_message_t *msg)
4212 {
4213 isc_result_t result;
4214 dns_name_t *name = NULL;
4215 isc_boolean_t have_answer = ISC_FALSE;
4216 isc_boolean_t true = ISC_TRUE;
4217
4218 if ((result = dns_message_firstname(msg, DNS_SECTION_ANSWER))
4219 == ISC_R_SUCCESS) {
4220 dns_message_currentname(msg, DNS_SECTION_ANSWER, &name);
4221 if (current_lookup->trace_root_sigchase) {
4222 initialization(name);
4223 return;
4224 }
4225 have_answer = true;
4226 } else {
4227 if (!current_lookup->trace_root_sigchase) {
4228 result = dns_message_firstname(msg,
4229 DNS_SECTION_AUTHORITY);
4230 if (result == ISC_R_SUCCESS)
4231 dns_message_currentname(msg,
4232 DNS_SECTION_AUTHORITY,
4233 &name);
4234 chase_nsrdataset
4235 = chase_scanname_section(msg, name,
4236 dns_rdatatype_ns,
4237 dns_rdatatype_any,
4238 DNS_SECTION_AUTHORITY);
4239 dup_name(name, &chase_authority_name, mctx);
4240 if (chase_nsrdataset != NULL) {
4241 have_delegation_ns = ISC_TRUE;
4242 printf("no response but there is a delegation"
4243 " in authority section:");
4244 dns_name_print(name, stdout);
4245 printf("\n");
4246 } else {
4247 printf("no response and no delegation in "
4248 "authority section but a reference"
4249 " to: ");
4250 dns_name_print(name, stdout);
4251 printf("\n");
4252 error_message = msg;
4253 }
4254 } else {
4255 printf(";; NO ANSWERS: %s\n",
4256 isc_result_totext(result));
4257 free_name(&chase_name, mctx);
4258 clean_trustedkey();
4259 return;
4260 }
4261 }
4262
4263
4264 if (have_answer) {
4265 chase_rdataset
4266 = chase_scanname_section(msg, &chase_name,
4267 current_lookup
4268 ->rdtype_sigchase,
4269 dns_rdatatype_any,
4270 DNS_SECTION_ANSWER);
4271 if (chase_rdataset != NULL)
4272 have_response = ISC_TRUE;
4273 }
4274
4275 result = advanced_rrsearch(&chase_keyrdataset,
4276 &chase_current_name,
4277 dns_rdatatype_dnskey,
4278 dns_rdatatype_any,
4279 &chase_keylookedup);
4280 if (result == ISC_R_FAILURE) {
4281 printf("\n;; DNSKEY is missing to continue validation:"
4282 " FAILED\n\n");
4283 goto cleanandgo;
4284 }
4285 if (result == ISC_R_NOTFOUND)
4286 return;
4287 INSIST(chase_keyrdataset != NULL);
4288 printf("\n;; DNSKEYset:\n");
4289 print_rdataset(&chase_current_name , chase_keyrdataset, mctx);
4290
4291
4292 result = advanced_rrsearch(&chase_sigkeyrdataset,
4293 &chase_current_name,
4294 dns_rdatatype_rrsig,
4295 dns_rdatatype_dnskey,
4296 &chase_sigkeylookedup);
4297 if (result == ISC_R_FAILURE) {
4298 printf("\n;; RRSIG of DNSKEY is missing to continue validation:"
4299 " FAILED\n\n");
4300 goto cleanandgo;
4301 }
4302 if (result == ISC_R_NOTFOUND)
4303 return;
4304 INSIST(chase_sigkeyrdataset != NULL);
4305 printf("\n;; RRSIG of the DNSKEYset:\n");
4306 print_rdataset(&chase_current_name , chase_sigkeyrdataset, mctx);
4307
4308
4309 if (!chase_dslookedup && !chase_nslookedup) {
4310 if (!delegation_follow) {
4311 result = contains_trusted_key(&chase_current_name,
4312 chase_keyrdataset,
4313 chase_sigkeyrdataset,
4314 mctx);
4315 } else {
4316 INSIST(chase_dsrdataset != NULL);
4317 INSIST(chase_sigdsrdataset != NULL);
4318 result = sigchase_verify_ds(&chase_current_name,
4319 chase_keyrdataset,
4320 chase_dsrdataset,
4321 mctx);
4322 }
4323
4324 if (result != ISC_R_SUCCESS) {
4325 printf("\n;; chain of trust can't be validated:"
4326 " FAILED\n\n");
4327 goto cleanandgo;
4328 } else {
4329 chase_dsrdataset = NULL;
4330 chase_sigdsrdataset = NULL;
4331 }
4332 }
4333
4334 if (have_response || (!have_delegation_ns && !have_response)) {
4335 /* test if it's a grand father case */
4336
4337 if (have_response) {
4338 result = advanced_rrsearch(&chase_sigrdataset,
4339 &chase_name,
4340 dns_rdatatype_rrsig,
4341 current_lookup
4342 ->rdtype_sigchase,
4343 &true);
4344 if (result == ISC_R_FAILURE) {
4345 printf("\n;; RRset is missing to continue"
4346 " validation SHOULD NOT APPEND:"
4347 " FAILED\n\n");
4348 goto cleanandgo;
4349 }
4350
4351 } else {
4352 result = advanced_rrsearch(&chase_sigrdataset,
4353 &chase_authority_name,
4354 dns_rdatatype_rrsig,
4355 dns_rdatatype_any,
4356 &true);
4357 if (result == ISC_R_FAILURE) {
4358 printf("\n;; RRSIG is missing to continue"
4359 " validation SHOULD NOT APPEND:"
4360 " FAILED\n\n");
4361 goto cleanandgo;
4362 }
4363 }
4364 result = grandfather_pb_test(&chase_current_name,
4365 chase_sigrdataset);
4366 if (result != ISC_R_SUCCESS) {
4367 dns_name_t tmp_name;
4368
4369 printf("\n;; We are in a Grand Father Problem:"
4370 " See 2.2.1 in RFC 3568\n");
4371 chase_rdataset = NULL;
4372 chase_sigrdataset = NULL;
4373 have_response = ISC_FALSE;
4374 have_delegation_ns = ISC_FALSE;
4375
4376 dns_name_init(&tmp_name, NULL);
4377 result = child_of_zone(&chase_name, &chase_current_name,
4378 &tmp_name);
4379 if (dns_name_dynamic(&chase_authority_name))
4380 free_name(&chase_authority_name, mctx);
4381 dup_name(&tmp_name, &chase_authority_name, mctx);
4382 printf(";; and we try to continue chain of trust"
4383 " validation of the zone: ");
4384 dns_name_print(&chase_authority_name, stdout);
4385 printf("\n");
4386 have_delegation_ns = ISC_TRUE;
4387 } else {
4388 if (have_response)
4389 goto finalstep;
4390 else
4391 chase_sigrdataset = NULL;
4392 }
4393 }
4394
4395 if (have_delegation_ns) {
4396 chase_nsrdataset = NULL;
4397 result = advanced_rrsearch(&chase_nsrdataset,
4398 &chase_authority_name,
4399 dns_rdatatype_ns,
4400 dns_rdatatype_any,
4401 &chase_nslookedup);
4402 if (result == ISC_R_FAILURE) {
4403 printf("\n;;NSset is missing to continue validation:"
4404 " FAILED\n\n");
4405 goto cleanandgo;
4406 }
4407 if (result == ISC_R_NOTFOUND) {
4408 return;
4409 }
4410 INSIST(chase_nsrdataset != NULL);
4411
4412 result = advanced_rrsearch(&chase_dsrdataset,
4413 &chase_authority_name,
4414 dns_rdatatype_ds,
4415 dns_rdatatype_any,
4416 &chase_dslookedup);
4417 if (result == ISC_R_FAILURE) {
4418 printf("\n;; DSset is missing to continue validation:"
4419 " FAILED\n\n");
4420 goto cleanandgo;
4421 }
4422 if (result == ISC_R_NOTFOUND)
4423 return;
4424 INSIST(chase_dsrdataset != NULL);
4425 printf("\n;; DSset:\n");
4426 print_rdataset(&chase_authority_name , chase_dsrdataset, mctx);
4427
4428 result = advanced_rrsearch(&chase_sigdsrdataset,
4429 &chase_authority_name,
4430 dns_rdatatype_rrsig,
4431 dns_rdatatype_ds,
4432 &true);
4433 if (result != ISC_R_SUCCESS) {
4434 printf("\n;; DSset is missing to continue validation:"
4435 " FAILED\n\n");
4436 goto cleanandgo;
4437 }
4438 printf("\n;; RRSIGset of DSset\n");
4439 print_rdataset(&chase_authority_name,
4440 chase_sigdsrdataset, mctx);
4441 INSIST(chase_sigdsrdataset != NULL);
4442
4443 result = sigchase_verify_sig(&chase_authority_name,
4444 chase_dsrdataset,
4445 chase_keyrdataset,
4446 chase_sigdsrdataset, mctx);
4447 if (result != ISC_R_SUCCESS) {
4448 printf("\n;; Impossible to verify the DSset:"
4449 " FAILED\n\n");
4450 goto cleanandgo;
4451 }
4452 chase_keyrdataset = NULL;
4453 chase_sigkeyrdataset = NULL;
4454
4455
4456 prepare_lookup(&chase_authority_name);
4457
4458 have_response = ISC_FALSE;
4459 have_delegation_ns = ISC_FALSE;
4460 delegation_follow = ISC_TRUE;
4461 error_message = NULL;
4462 dup_name(&chase_authority_name, &chase_current_name, mctx);
4463 free_name(&chase_authority_name, mctx);
4464 return;
4465 }
4466
4467
4468 if (error_message != NULL) {
4469 dns_rdataset_t *rdataset;
4470 dns_rdataset_t *sigrdataset;
4471 dns_name_t rdata_name;
4472 isc_result_t ret = ISC_R_FAILURE;
4473
4474 dns_name_init(&rdata_name, NULL);
4475 result = prove_nx(error_message, &chase_name,
4476 current_lookup->rdclass_sigchase,
4477 current_lookup->rdtype_sigchase, &rdata_name,
4478 &rdataset, &sigrdataset);
4479 if (rdataset == NULL || sigrdataset == NULL ||
4480 dns_name_countlabels(&rdata_name) == 0) {
4481 printf("\n;; Impossible to verify the non-existence,"
4482 " the NSEC RRset can't be validated:"
4483 " FAILED\n\n");
4484 goto cleanandgo;
4485 }
4486 ret = sigchase_verify_sig(&rdata_name, rdataset,
4487 chase_keyrdataset,
4488 sigrdataset, mctx);
4489 if (ret != ISC_R_SUCCESS) {
4490 free_name(&rdata_name, mctx);
4491 printf("\n;; Impossible to verify the NSEC RR to prove"
4492 " the non-existence : FAILED\n\n");
4493 goto cleanandgo;
4494 }
4495 free_name(&rdata_name, mctx);
4496 if (result != ISC_R_SUCCESS) {
4497 printf("\n;; Impossible to verify the non-existence:"
4498 " FAILED\n\n");
4499 goto cleanandgo;
4500 } else {
4501 printf("\n;; OK the query doesn't have response but"
4502 " we have validate this fact : SUCCESS\n\n");
4503 goto cleanandgo;
4504 }
4505 }
4506
4507 cleanandgo:
4508 printf(";; cleanandgo \n");
4509 if (dns_name_dynamic(&chase_current_name))
4510 free_name(&chase_current_name, mctx);
4511 if (dns_name_dynamic(&chase_authority_name))
4512 free_name(&chase_authority_name, mctx);
4513 clean_trustedkey();
4514 return;
4515
4516 finalstep :
4517 result = advanced_rrsearch(&chase_rdataset, &chase_name,
4518 current_lookup->rdtype_sigchase,
4519 dns_rdatatype_any ,
4520 &true);
4521 if (result == ISC_R_FAILURE) {
4522 printf("\n;; RRsig of RRset is missing to continue validation"
4523 " SHOULD NOT APPEND: FAILED\n\n");
4524 goto cleanandgo;
4525 }
4526 result = sigchase_verify_sig(&chase_name, chase_rdataset,
4527 chase_keyrdataset,
4528 chase_sigrdataset, mctx);
4529 if (result != ISC_R_SUCCESS) {
4530 printf("\n;; Impossible to verify the RRset : FAILED\n\n");
4531 /*
4532 printf("RRset:\n");
4533 print_rdataset(&chase_name , chase_rdataset, mctx);
4534 printf("DNSKEYset:\n");
4535 print_rdataset(&chase_name , chase_keyrdataset, mctx);
4536 printf("RRSIG of RRset:\n");
4537 print_rdataset(&chase_name , chase_sigrdataset, mctx);
4538 printf("\n");
4539 */
4540 goto cleanandgo;
4541 } else {
4542 printf("\n;; The Answer:\n");
4543 print_rdataset(&chase_name , chase_rdataset, mctx);
4544
4545 printf("\n;; FINISH : we have validate the DNSSEC chain"
4546 " of trust: SUCCESS\n\n");
4547 goto cleanandgo;
4548 }
4549 }
4550
4551 #endif
4552
4553
4554 #if DIG_SIGCHASE_BU
4555
4556 isc_result_t
4557 getneededrr(dns_message_t *msg)
4558 {
4559 isc_result_t result;
4560 dns_name_t *name = NULL;
4561 dns_rdata_t sigrdata;
4562 dns_rdata_sig_t siginfo;
4563 isc_boolean_t true = ISC_TRUE;
4564
4565 if ((result = dns_message_firstname(msg, DNS_SECTION_ANSWER))
4566 != ISC_R_SUCCESS) {
4567 printf(";; NO ANSWERS: %s\n", isc_result_totext(result));
4568
4569 if (chase_name.ndata == NULL)
4570 return (ISC_R_ADDRNOTAVAIL);
4571 } else {
4572 dns_message_currentname(msg, DNS_SECTION_ANSWER, &name);
4573 }
4574
4575 /* What do we chase? */
4576 if (chase_rdataset == NULL) {
4577 result = advanced_rrsearch(&chase_rdataset, name,
4578 dns_rdatatype_any,
4579 dns_rdatatype_any, &true);
4580 if (result != ISC_R_SUCCESS) {
4581 printf("\n;; No Answers: Validation FAILED\n\n");
4582 return (ISC_R_NOTFOUND);
4583 }
4584 dup_name(name, &chase_name, mctx);
4585 printf(";; RRset to chase:\n");
4586 print_rdataset(&chase_name, chase_rdataset, mctx);
4587 }
4588 INSIST(chase_rdataset != NULL);
4589
4590
4591 if (chase_sigrdataset == NULL) {
4592 result = advanced_rrsearch(&chase_sigrdataset, name,
4593 dns_rdatatype_rrsig,
4594 chase_rdataset->type,
4595 &chase_siglookedup);
4596 if (result == ISC_R_FAILURE) {
4597 printf("\n;; RRSIG is missing for continue validation:"
4598 " FAILED\n\n");
4599 if (dns_name_dynamic(&chase_name))
4600 free_name(&chase_name, mctx);
4601 return (ISC_R_NOTFOUND);
4602 }
4603 if (result == ISC_R_NOTFOUND) {
4604 return (ISC_R_NOTFOUND);
4605 }
4606 printf("\n;; RRSIG of the RRset to chase:\n");
4607 print_rdataset(&chase_name, chase_sigrdataset, mctx);
4608 }
4609 INSIST(chase_sigrdataset != NULL);
4610
4611
4612 /* first find the DNSKEY name */
4613 result = dns_rdataset_first(chase_sigrdataset);
4614 check_result(result, "empty RRSIG dataset");
4615 dns_rdata_init(&sigrdata);
4616 dns_rdataset_current(chase_sigrdataset, &sigrdata);
4617 result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
4618 check_result(result, "sigrdata tostruct siginfo");
4619 dup_name(&siginfo.signer, &chase_signame, mctx);
4620 dns_rdata_freestruct(&siginfo);
4621 dns_rdata_reset(&sigrdata);
4622
4623 /* Do we have a key? */
4624 if (chase_keyrdataset == NULL) {
4625 result = advanced_rrsearch(&chase_keyrdataset,
4626 &chase_signame,
4627 dns_rdatatype_dnskey,
4628 dns_rdatatype_any,
4629 &chase_keylookedup);
4630 if (result == ISC_R_FAILURE) {
4631 printf("\n;; DNSKEY is missing to continue validation:"
4632 " FAILED\n\n");
4633 free_name(&chase_signame, mctx);
4634 if (dns_name_dynamic(&chase_name))
4635 free_name(&chase_name, mctx);
4636 return (ISC_R_NOTFOUND);
4637 }
4638 if (result == ISC_R_NOTFOUND) {
4639 free_name(&chase_signame, mctx);
4640 return (ISC_R_NOTFOUND);
4641 }
4642 printf("\n;; DNSKEYset that signs the RRset to chase:\n");
4643 print_rdataset(&chase_signame, chase_keyrdataset, mctx);
4644 }
4645 INSIST(chase_keyrdataset != NULL);
4646
4647 if (chase_sigkeyrdataset == NULL) {
4648 result = advanced_rrsearch(&chase_sigkeyrdataset,
4649 &chase_signame,
4650 dns_rdatatype_rrsig,
4651 dns_rdatatype_dnskey,
4652 &chase_sigkeylookedup);
4653 if (result == ISC_R_FAILURE) {
4654 printf("\n;; RRSIG for DNSKEY is missing to continue"
4655 " validation : FAILED\n\n");
4656 free_name(&chase_signame, mctx);
4657 if (dns_name_dynamic(&chase_name))
4658 free_name(&chase_name, mctx);
4659 return (ISC_R_NOTFOUND);
4660 }
4661 if (result == ISC_R_NOTFOUND) {
4662 free_name(&chase_signame, mctx);
4663 return (ISC_R_NOTFOUND);
4664 }
4665 printf("\n;; RRSIG of the DNSKEYset that signs the "
4666 "RRset to chase:\n");
4667 print_rdataset(&chase_signame, chase_sigkeyrdataset, mctx);
4668 }
4669 INSIST(chase_sigkeyrdataset != NULL);
4670
4671
4672 if (chase_dsrdataset == NULL) {
4673 result = advanced_rrsearch(&chase_dsrdataset, &chase_signame,
4674 dns_rdatatype_ds,
4675 dns_rdatatype_any,
4676 &chase_dslookedup);
4677 if (result == ISC_R_FAILURE) {
4678 printf("\n;; WARNING There is no DS for the zone: ");
4679 dns_name_print(&chase_signame, stdout);
4680 printf("\n");
4681 }
4682 if (result == ISC_R_NOTFOUND) {
4683 free_name(&chase_signame, mctx);
4684 return (ISC_R_NOTFOUND);
4685 }
4686 if (chase_dsrdataset != NULL) {
4687 printf("\n;; DSset of the DNSKEYset\n");
4688 print_rdataset(&chase_signame, chase_dsrdataset, mctx);
4689 }
4690 }
4691
4692 if (chase_dsrdataset != NULL) {
4693 /*
4694 * if there is no RRSIG of DS,
4695 * we don't want to search on the network
4696 */
4697 result = advanced_rrsearch(&chase_sigdsrdataset,
4698 &chase_signame,
4699 dns_rdatatype_rrsig,
4700 dns_rdatatype_ds, &true);
4701 if (result == ISC_R_FAILURE) {
4702 printf(";; WARNING : NO RRSIG DS : RRSIG DS"
4703 " should come with DS\n");
4704 /*
4705 * We continue even the DS couldn't be validated,
4706 * because the DNSKEY could be a Trusted Key.
4707 */
4708 chase_dsrdataset = NULL;
4709 } else {
4710 printf("\n;; RRSIG of the DSset of the DNSKEYset\n");
4711 print_rdataset(&chase_signame, chase_sigdsrdataset,
4712 mctx);
4713 }
4714 }
4715 return (1);
4716 }
4717
4718
4719
4720 void
4721 sigchase_bu(dns_message_t *msg)
4722 {
4723 isc_result_t result;
4724 int ret;
4725
4726 if (tk_list.nb_tk == 0) {
4727 result = get_trusted_key(mctx);
4728 if (result != ISC_R_SUCCESS) {
4729 printf("No trusted keys present\n");
4730 return;
4731 }
4732 }
4733
4734
4735 ret = getneededrr(msg);
4736 if (ret == ISC_R_NOTFOUND)
4737 return;
4738
4739 if (ret == ISC_R_ADDRNOTAVAIL) {
4740 /* We have no response */
4741 dns_rdataset_t *rdataset;
4742 dns_rdataset_t *sigrdataset;
4743 dns_name_t rdata_name;
4744 dns_name_t query_name;
4745
4746
4747 dns_name_init(&query_name, NULL);
4748 dns_name_init(&rdata_name, NULL);
4749 nameFromString(current_lookup->textname, &query_name);
4750
4751 result = prove_nx(msg, &query_name, current_lookup->rdclass,
4752 current_lookup->rdtype, &rdata_name,
4753 &rdataset, &sigrdataset);
4754 free_name(&query_name, mctx);
4755 if (rdataset == NULL || sigrdataset == NULL ||
4756 dns_name_countlabels(&rdata_name) == 0) {
4757 printf("\n;; Impossible to verify the Non-existence,"
4758 " the NSEC RRset can't be validated: "
4759 "FAILED\n\n");
4760 clean_trustedkey();
4761 return;
4762 }
4763
4764 if (result != ISC_R_SUCCESS) {
4765 printf("\n No Answers and impossible to prove the"
4766 " unsecurity : Validation FAILED\n\n");
4767 clean_trustedkey();
4768 return;
4769 }
4770 printf(";; An NSEC prove the non-existence of a answers,"
4771 " Now we want validate this NSEC\n");
4772
4773 dup_name(&rdata_name, &chase_name, mctx);
4774 free_name(&rdata_name, mctx);
4775 chase_rdataset = rdataset;
4776 chase_sigrdataset = sigrdataset;
4777 chase_keyrdataset = NULL;
4778 chase_sigkeyrdataset = NULL;
4779 chase_dsrdataset = NULL;
4780 chase_sigdsrdataset = NULL;
4781 chase_siglookedup = ISC_FALSE;
4782 chase_keylookedup = ISC_FALSE;
4783 chase_dslookedup = ISC_FALSE;
4784 chase_sigdslookedup = ISC_FALSE;
4785 sigchase(msg);
4786 clean_trustedkey();
4787 return;
4788 }
4789
4790
4791 printf("\n\n\n;; WE HAVE MATERIAL, WE NOW DO VALIDATION\n");
4792
4793 result = sigchase_verify_sig(&chase_name, chase_rdataset,
4794 chase_keyrdataset,
4795 chase_sigrdataset, mctx);
4796 if (result != ISC_R_SUCCESS) {
4797 free_name(&chase_name, mctx);
4798 free_name(&chase_signame, mctx);
4799 printf(";; No DNSKEY is valid to check the RRSIG"
4800 " of the RRset: FAILED\n");
4801 clean_trustedkey();
4802 return;
4803 }
4804 printf(";; OK We found DNSKEY (or more) to validate the RRset\n");
4805
4806 result = contains_trusted_key(&chase_signame, chase_keyrdataset,
4807 chase_sigkeyrdataset, mctx);
4808 if (result == ISC_R_SUCCESS) {
4809 free_name(&chase_name, mctx);
4810 free_name(&chase_signame, mctx);
4811 printf("\n;; Ok this DNSKEY is a Trusted Key,"
4812 " DNSSEC validation is ok: SUCCESS\n\n");
4813 clean_trustedkey();
4814 return;
4815 }
4816
4817 printf(";; Now, we are going to validate this DNSKEY by the DS\n");
4818
4819 if (chase_dsrdataset == NULL) {
4820 free_name(&chase_name, mctx);
4821 free_name(&chase_signame, mctx);
4822 printf(";; the DNSKEY isn't trusted-key and there isn't"
4823 " DS to validate the DNSKEY: FAILED\n");
4824 clean_trustedkey();
4825 return;
4826 }
4827
4828 result = sigchase_verify_ds(&chase_signame, chase_keyrdataset,
4829 chase_dsrdataset, mctx);
4830 if (result != ISC_R_SUCCESS) {
4831 free_name(&chase_signame, mctx);
4832 free_name(&chase_name, mctx);
4833 printf(";; ERROR no DS validates a DNSKEY in the"
4834 " DNSKEY RRset: FAILED\n");
4835 clean_trustedkey();
4836 return;
4837 } else
4838 printf(";; OK this DNSKEY (validated by the DS) validates"
4839 " the RRset of the DNSKEYs, thus the DNSKEY validates"
4840 " the RRset\n");
4841 INSIST(chase_sigdsrdataset != NULL);
4842
4843 dup_name(&chase_signame, &chase_name, mctx);
4844 free_name(&chase_signame, mctx);
4845 chase_rdataset = chase_dsrdataset;
4846 chase_sigrdataset = chase_sigdsrdataset;
4847 chase_keyrdataset = NULL;
4848 chase_sigkeyrdataset = NULL;
4849 chase_dsrdataset = NULL;
4850 chase_sigdsrdataset = NULL;
4851 chase_siglookedup = chase_keylookedup = ISC_FALSE;
4852 chase_dslookedup = chase_sigdslookedup = ISC_FALSE;
4853
4854 printf(";; Now, we want to validate the DS : recursive call\n");
4855 sigchase(msg);
4856 return;
4857 }
4858 #endif
4859
4860 void
4861 sigchase(dns_message_t *msg) {
4862 #if DIG_SIGCHASE_TD
4863 if (current_lookup->do_topdown) {
4864 sigchase_td(msg);
4865 return;
4866 }
4867 #endif
4868 #if DIG_SIGCHASE_BU
4869 sigchase_bu(msg);
4870 return;
4871 #endif
4872 }
4873
4874
4875 /*
4876 * return 1 if name1 < name2
4877 * 0 if name1 == name2
4878 * -1 if name1 > name2
4879 * and -2 if problem
4880 */
4881 int
4882 inf_name(dns_name_t *name1, dns_name_t *name2)
4883 {
4884 dns_label_t label1;
4885 dns_label_t label2;
4886 unsigned int nblabel1;
4887 unsigned int nblabel2;
4888 int min_lum_label;
4889 int i;
4890 int ret = -2;
4891
4892 nblabel1 = dns_name_countlabels(name1);
4893 nblabel2 = dns_name_countlabels(name2);
4894
4895 if (nblabel1 >= nblabel2)
4896 min_lum_label = nblabel2;
4897 else
4898 min_lum_label = nblabel1;
4899
4900
4901 for (i=1 ; i < min_lum_label; i++) {
4902 dns_name_getlabel(name1, nblabel1 -1 - i, &label1);
4903 dns_name_getlabel(name2, nblabel2 -1 - i, &label2);
4904 if ((ret = isc_region_compare(&label1, &label2)) != 0) {
4905 if (ret < 0)
4906 return (-1);
4907 else if (ret > 0)
4908 return (1);
4909 }
4910 }
4911 if (nblabel1 == nblabel2)
4912 return (0);
4913
4914 if (nblabel1 < nblabel2)
4915 return (-1);
4916 else
4917 return (1);
4918 }
4919
4920 /**
4921 *
4922 *
4923 *
4924 */
4925 isc_result_t
4926 prove_nx_domain(dns_message_t *msg,
4927 dns_name_t *name,
4928 dns_name_t *rdata_name,
4929 dns_rdataset_t **rdataset,
4930 dns_rdataset_t **sigrdataset)
4931 {
4932 isc_result_t ret = ISC_R_FAILURE;
4933 isc_result_t result = ISC_R_NOTFOUND;
4934 dns_rdataset_t *nsecset = NULL;
4935 dns_rdataset_t *signsecset = NULL ;
4936 dns_rdata_t nsec = DNS_RDATA_INIT;
4937 dns_name_t *nsecname;
4938 dns_rdata_nsec_t nsecstruct;
4939
4940 if ((result = dns_message_firstname(msg, DNS_SECTION_AUTHORITY))
4941 != ISC_R_SUCCESS) {
4942 printf(";; nothing in authority section : impossible to"
4943 " validate the non-existence : FAILED\n");
4944 return (ISC_R_FAILURE);
4945 }
4946
4947 do {
4948 nsecname = NULL;
4949 dns_message_currentname(msg, DNS_SECTION_AUTHORITY, &nsecname);
4950 nsecset = search_type(nsecname, dns_rdatatype_nsec,
4951 dns_rdatatype_any);
4952 if (nsecset == NULL)
4953 continue;
4954
4955 printf("There is a NSEC for this zone in the"
4956 " AUTHORITY section:\n");
4957 print_rdataset(nsecname, nsecset, mctx);
4958
4959 for (result = dns_rdataset_first(nsecset);
4960 result == ISC_R_SUCCESS;
4961 result = dns_rdataset_next(nsecset)) {
4962 dns_rdataset_current(nsecset, &nsec);
4963
4964
4965 signsecset
4966 = chase_scanname_section(msg, nsecname,
4967 dns_rdatatype_rrsig,
4968 dns_rdatatype_nsec,
4969 DNS_SECTION_AUTHORITY);
4970 if (signsecset == NULL) {
4971 printf(";; no RRSIG NSEC in authority section:"
4972 " impossible to validate the "
4973 "non-existence: FAILED\n");
4974 return (ISC_R_FAILURE);
4975 }
4976
4977 ret = dns_rdata_tostruct(&nsec, &nsecstruct, NULL);
4978 check_result(ret,"dns_rdata_tostruct");
4979
4980 if ((inf_name(nsecname, &nsecstruct.next) == 1 &&
4981 inf_name(name, &nsecstruct.next) == 1) ||
4982 (inf_name(name, nsecname) == 1 &&
4983 inf_name(&nsecstruct.next, name) == 1)) {
4984 dns_rdata_freestruct(&nsecstruct);
4985 *rdataset = nsecset;
4986 *sigrdataset = signsecset;
4987 dup_name(nsecname, rdata_name, mctx);
4988
4989 return (ISC_R_SUCCESS);
4990 }
4991
4992 dns_rdata_freestruct(&nsecstruct);
4993 }
4994 } while (dns_message_nextname(msg, DNS_SECTION_AUTHORITY)
4995 == ISC_R_SUCCESS);
4996
4997 *rdataset = NULL;
4998 *sigrdataset = NULL;
4999 rdata_name = NULL;
5000 return (ISC_R_FAILURE);
5001 }
5002
5003 /**
5004 *
5005 *
5006 *
5007 *
5008 *
5009 */
5010 isc_result_t
5011 prove_nx_type(dns_message_t *msg, dns_name_t *name, dns_rdataset_t *nsecset,
5012 dns_rdataclass_t class, dns_rdatatype_t type,
5013 dns_name_t *rdata_name, dns_rdataset_t **rdataset,
5014 dns_rdataset_t **sigrdataset)
5015 {
5016 isc_result_t ret;
5017 dns_rdataset_t *signsecset;
5018 dns_rdata_t nsec = DNS_RDATA_INIT;
5019
5020 UNUSED(class);
5021
5022 ret = dns_rdataset_first(nsecset);
5023 check_result(ret,"dns_rdataset_first");
5024
5025 dns_rdataset_current(nsecset, &nsec);
5026
5027 ret = dns_nsec_typepresent(&nsec, type);
5028 if (ret == ISC_R_SUCCESS)
5029 printf("OK the NSEC said that the type doesn't exist \n");
5030
5031 signsecset = chase_scanname_section(msg, name,
5032 dns_rdatatype_rrsig,
5033 dns_rdatatype_nsec,
5034 DNS_SECTION_AUTHORITY);
5035 if (signsecset == NULL) {
5036 printf("There isn't RRSIG NSEC for the zone \n");
5037 return (ISC_R_FAILURE);
5038 }
5039 dup_name(name, rdata_name, mctx);
5040 *rdataset = nsecset;
5041 *sigrdataset = signsecset;
5042
5043 return (ret);
5044 }
5045
5046 /**
5047 *
5048 *
5049 *
5050 *
5051 */
5052 isc_result_t
5053 prove_nx(dns_message_t *msg, dns_name_t *name, dns_rdataclass_t class,
5054 dns_rdatatype_t type, dns_name_t *rdata_name,
5055 dns_rdataset_t **rdataset, dns_rdataset_t **sigrdataset)
5056 {
5057 isc_result_t ret;
5058 dns_rdataset_t *nsecset = NULL;
5059
5060 printf("We want to prove the non-existance of a type of rdata %d"
5061 " or of the zone: \n", type);
5062
5063 if ((ret = dns_message_firstname(msg, DNS_SECTION_AUTHORITY))
5064 != ISC_R_SUCCESS) {
5065 printf(";; nothing in authority section : impossible to"
5066 " validate the non-existence : FAILED\n");
5067 return (ISC_R_FAILURE);
5068 }
5069
5070 nsecset = chase_scanname_section(msg, name, dns_rdatatype_nsec,
5071 dns_rdatatype_any,
5072 DNS_SECTION_AUTHORITY);
5073 if (nsecset != NULL) {
5074 printf("We have a NSEC for this zone :OK\n");
5075 ret = prove_nx_type(msg, name, nsecset, class,
5076 type, rdata_name, rdataset,
5077 sigrdataset);
5078 if (ret != ISC_R_SUCCESS) {
5079 printf("prove_nx: ERROR type exist\n");
5080 return (ret);
5081 } else {
5082 printf("prove_nx: OK type does not exist\n");
5083 return (ISC_R_SUCCESS);
5084 }
5085 } else {
5086 printf("there is no NSEC for this zone: validating "
5087 "that the zone doesn't exist\n");
5088 ret = prove_nx_domain(msg, name, rdata_name,
5089 rdataset, sigrdataset);
5090 return (ret);
5091 }
5092 }
5093 #endif
DragonFly BSD