unbound: validator/validator.c File Reference

unbound 0.1

Macros | Functions | Variables
validator.c File Reference

This file contains a module that performs validation of DNS queries. More...

`#include "config.h"`
`#include <ctype.h>`
`#include "validator/validator.h"`
`#include "validator/val_anchor.h"`
`#include "validator/val_kcache.h"`
`#include "validator/val_kentry.h"`
`#include "validator/val_utils.h"`
`#include "validator/val_nsec.h"`
`#include "validator/val_nsec3.h"`
`#include "validator/val_neg.h"`
`#include "validator/val_sigcrypt.h"`
`#include "validator/autotrust.h"`
`#include "services/cache/dns.h"`
`#include "services/cache/rrset.h"`
`#include "util/data/dname.h"`
`#include "util/module.h"`
`#include "util/log.h"`
`#include "util/net_help.h"`
`#include "util/regional.h"`
`#include "util/config_file.h"`
`#include "util/fptr_wlist.h"`
`#include "sldns/rrdef.h"`
`#include "sldns/wire2str.h"`
`#include "sldns/str2wire.h"`

## Macros
#define | MAX_VALIDATE_AT_ONCE 8
| Max number of RRSIGs to validate at once, suspend query for later.
#define | MAX_VALIDATION_SUSPENDS 16
| Max number of validation suspends allowed, error out otherwise.
#define | MAX_LABEL_TAGS (LDNS_MAX_LABELLEN-3)/5

## Functions
static void | process_ds_response (struct module_qstate *qstate, struct val_qstate *vq, int id, int rcode, struct dns_msg *msg, struct query_info *qinfo, struct sock_list *origin, int *suspend, struct module_qstate *sub_qstate)
| Process DS response.
static void | update_reason_bogus (struct reply_info *rep, sldns_ede_code reason_bogus)
static int | fill_nsec3_iter (size_t **keysize, size_t **maxiter, char *s, int c)
| fill up nsec3 key iterations config entry
int | val_env_parse_key_iter (char *val_nsec3_key_iterations, size_t **keysize, size_t **maxiter, int *keyiter_count)
| Parse the val_nsec3_key_iterations string.
void | val_env_apply_cfg (struct val_env *val_env, struct config_file *cfg, size_t *keysize, size_t *maxiter, int keyiter_count)
| Apply config to validator env.
static int | val_apply_cfg (struct module_env *env, struct val_env *val_env, struct config_file *cfg)
| apply config settings to validator
int | val_init (struct module_env *env, int id)
| validator init
void | val_deinit (struct module_env *env, int id)
| validator deinit
static struct val_qstate * | val_new_getmsg (struct module_qstate *qstate, struct val_qstate *vq)
| fill in message structure
static struct val_qstate * | val_new (struct module_qstate *qstate, int id)
| allocate new validator query state
static void | val_restart (struct val_qstate *vq)
| reset validator query state for query restart
static int | val_error (struct module_qstate *qstate, int id)
| Exit validation with an error status.
static int | needs_validation (struct module_qstate *qstate, int ret_rc, struct dns_msg *ret_msg)
| Check to see if a given response needs to go through the validation process.
static int | already_validated (struct dns_msg *ret_msg)
| Check to see if the response has already been validated.
static int | generate_request (struct module_qstate *qstate, int id, uint8_t *name, size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags, struct module_qstate **newq, int detached)
| Generate a request for DNS data.
static int | generate_keytag_query (struct module_qstate *qstate, int id, struct trust_anchor *ta)
| Generate, send and detach key tag signaling query.
static int | sentinel_get_keytag (char *start, uint16_t *keytag)
| Get keytag as uint16_t from string.
static int | prime_trust_anchor (struct module_qstate *qstate, struct val_qstate *vq, int id, struct trust_anchor *toprime)
| Prime trust anchor for use.
static int | validate_msg_signatures (struct module_qstate *qstate, struct val_qstate *vq, struct module_env *env, struct val_env *ve, struct reply_info *chase_reply, struct key_entry_key *key_entry, int *suspend)
| Validate if the ANSWER and AUTHORITY sections contain valid rrsets.
void | validate_suspend_timer_cb (void *arg)
| Timer callback for msg signatures continue timer.
static int | validate_suspend_setup_timer (struct module_qstate *qstate, struct val_qstate *vq, int id, enum val_state resume_state)
| Setup timer to continue validation of msg signatures later.
static int | detect_wrongly_truncated (struct reply_info *rep)
| Detect wrong truncated response (say from BIND 9.6.1 that is forwarding and saw the NS record without signatures from a referral).
static void | remove_spurious_authority (struct reply_info *chase_reply, struct reply_info *orig_reply)
| For messages that are not referrals, if the chase reply contains an unsigned NS record in the authority section it could have been inserted by a (BIND) forwarder that thinks the zone is insecure, and that has an NS record without signatures in cache.
static void | validate_positive_response (struct module_env *env, struct val_env *ve, struct query_info *qchase, struct reply_info *chase_reply, struct key_entry_key *kkey, struct module_qstate *qstate, struct val_qstate *vq, int *nsec3_calculations, int *suspend)
| Given a "positive" response – a response that contains an answer to the question, and no CNAME chain, validate this response.
static void | validate_nodata_response (struct module_env *env, struct val_env *ve, struct query_info *qchase, struct reply_info *chase_reply, struct key_entry_key *kkey, struct module_qstate *qstate, struct val_qstate *vq, int *nsec3_calculations, int *suspend)
| Validate a NOERROR/NODATA signed response – a response that has a NOERROR Rcode but no ANSWER section RRsets.
static void | validate_nameerror_response (struct module_env *env, struct val_env *ve, struct query_info *qchase, struct reply_info *chase_reply, struct key_entry_key *kkey, int *rcode, struct module_qstate *qstate, struct val_qstate *vq, int *nsec3_calculations, int *suspend)
| Validate a NAMEERROR signed response – a response that has a NXDOMAIN Rcode.
static void | validate_referral_response (struct reply_info *chase_reply)
| Given a referral response, validate rrsets and take least trusted rrset as the current validation status.
static void | validate_any_response (struct module_env *env, struct val_env *ve, struct query_info *qchase, struct reply_info *chase_reply, struct key_entry_key *kkey, struct module_qstate *qstate, struct val_qstate *vq, int *nsec3_calculations, int *suspend)
| Given an "ANY" response – a response that contains an answer to a qtype==ANY question, with answers.
static void | validate_cname_response (struct module_env *env, struct val_env *ve, struct query_info *qchase, struct reply_info *chase_reply, struct key_entry_key *kkey, struct module_qstate *qstate, struct val_qstate *vq, int *nsec3_calculations, int *suspend)
| Validate CNAME response, or DNAME+CNAME.
static void | validate_cname_noanswer_response (struct module_env *env, struct val_env *ve, struct query_info *qchase, struct reply_info *chase_reply, struct key_entry_key *kkey, struct module_qstate *qstate, struct val_qstate *vq, int *nsec3_calculations, int *suspend)
| Validate CNAME NOANSWER response, no more data after a CNAME chain.
static int | processInit (struct module_qstate *qstate, struct val_qstate *vq, struct val_env *ve, int id)
| Process init state for validator.
static int | processFindKey (struct module_qstate *qstate, struct val_qstate *vq, int id)
| Process the FINDKEY state.
static int | processValidate (struct module_qstate *qstate, struct val_qstate *vq, struct val_env *ve, int id)
| Process the VALIDATE stage, the init and findkey stages are finished, and the right keys are available to validate the response.
static int | processFinished (struct module_qstate *qstate, struct val_qstate *vq, struct val_env *ve, int id)
| The Finished state.
static void | val_handle (struct module_qstate *qstate, struct val_qstate *vq, struct val_env *ve, int id)
| Handle validator state.
void | val_operate (struct module_qstate *qstate, enum module_ev event, int id, struct outbound_entry *outbound)
| validator operate on a query
static struct key_entry_key * | primeResponseToKE (struct ub_packed_rrset_key *dnskey_rrset, struct trust_anchor *ta, struct module_qstate *qstate, int id, struct module_qstate *sub_qstate)
| Evaluate the response to a priming request.
static int | ds_response_to_ke (struct module_qstate *qstate, struct val_qstate *vq, int id, int rcode, struct dns_msg *msg, struct query_info *qinfo, struct key_entry_key **ke, struct module_qstate *sub_qstate)
| In inform supers, with the resulting message and rcode and the current keyset in the super state, validate the DS response, returning a KeyEntry.
static void | process_dnskey_response (struct module_qstate *qstate, struct val_qstate *vq, int id, int rcode, struct dns_msg *msg, struct query_info *qinfo, struct sock_list *origin, struct module_qstate *sub_qstate)
| Process DNSKEY response.
static void | process_prime_response (struct module_qstate *qstate, struct val_qstate *vq, int id, int rcode, struct dns_msg *msg, struct sock_list *origin, struct module_qstate *sub_qstate)
| Process prime response Sets the key entry in the state.
void | val_inform_super (struct module_qstate *qstate, int id, struct module_qstate *super)
| inform validator super.
void | val_clear (struct module_qstate *qstate, int id)
| validator cleanup query state
size_t | val_get_mem (struct module_env *env, int id)
| Debug helper routine that assists worker in determining memory in use.
struct module_func_block * | val_get_funcblock (void)
| Get the validator function block.
const char * | val_state_to_string (enum val_state state)
| Get validator state as a string.

## Variables
static struct module_func_block | val_block
| The validator function block.

## Detailed Description

This file contains a module that performs validation of DNS queries.

According to RFC 4034.

## Function Documentation

## ◆ process_ds_response()

void process_ds_response | ( | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | int | id,
|  | int | rcode,
|  | struct dns_msg * | msg,
|  | struct query_info * | qinfo,
|  | struct sock_list * | origin,
|  | int * | suspend,
|  | struct module_qstate * | sub_qstate )
| static

Process DS response.

Called from inform_supers. Because it is in inform_supers, the mesh itself is busy doing callbacks for a state that is to be deleted soon; don't touch the mesh; instead set a state in the super, as the super will be reactivated soon. Perform processing to determine what state to set in the super.

Parameters

  qstate | query state that is validating and asked for a DS.
  vq | validator query state
  id | module id.
  rcode | rcode result value.
  msg | result message (if rcode is OK).
  qinfo | from the sub query state, query info.
  origin | the origin of msg.
  suspend | returned true if the task takes too long and needs to suspend to continue the effort later.
  sub_qstate | the sub query state, that is the lookup that fetched the trust anchor data, it contains error information for the answer. Can be NULL.

References val_qstate::chain_blacklist, val_qstate::chase_reply, ds_response_to_ke(), val_qstate::ds_rrset, val_qstate::empty_DS_len, val_qstate::empty_DS_name, module_qstate::env, module_qstate::errinf, errinf_dname(), errinf_origin(), val_qstate::key_entry, key_entry_get_rrset(), key_entry_isbad(), key_entry_isgood(), log_err(), val_env::max_restart, module_env::modinfo, query_info::qname, query_info::qname_len, module_qstate::region, regional_alloc_init(), val_qstate::restart_count, module_qstate::rpz_applied, sec_status_insecure, reply_info::security, val_qstate::state, val_blacklist(), VAL_FINISHED_STATE, VAL_VALIDATE_STATE, VERB_ALGO, and verbose().

Referenced by processFindKey(), and val_inform_super().

## ◆ val_env_parse_key_iter()

int val_env_parse_key_iter | ( | char * | val_nsec3_key_iterations,
|  | size_t ** | keysize,
|  | size_t ** | maxiter,
|  | int * | keyiter_count )

Parse the val_nsec3_key_iterations string.

Parameters

  val_nsec3_key_iterations | the string with nsec3 iterations config.
  keysize | returns malloced key size array on success.
  maxiter | returns malloced max iterations array on success.
  keyiter_count | returns size of keysize and maxiter arrays.

Returns
  false if it does not parse correctly.

References cfg_count_numbers(), fill_nsec3_iter(), and log_err().

Referenced by fr_construct_from_config(), and val_apply_cfg().

## ◆ val_env_apply_cfg()

void val_env_apply_cfg | ( | struct val_env * | val_env,
|  | struct config_file * | cfg,
|  | size_t * | keysize,
|  | size_t * | maxiter,
|  | int | keyiter_count )

Apply config to validator env.

Parameters

  val_env | validator env.
  cfg | config
  keysize | nsec3 key size array.
  maxiter | nsec3 max iterations array.
  keyiter_count | size of keysize and maxiter arrays.

References config_file::bogus_ttl, val_env::bogus_ttl, val_env::date_override, val_env::max_restart, val_env::nsec3_keyiter_count, val_env::nsec3_keysize, val_env::nsec3_maxiter, val_env::skew_max, val_env::skew_min, config_file::val_date_override, config_file::val_max_restart, config_file::val_sig_skew_max, and config_file::val_sig_skew_min.

Referenced by fr_adjust_val_env(), and val_apply_cfg().

## ◆ val_error()

int val_error | ( | struct module_qstate * | qstate,
|  | int | id )
| static

Exit validation with an error status.

Parameters

  qstate | query state
  id | validator id.

Returns
  false, for use by caller to return to stop processing.

References module_qstate::ext_state, module_error, and module_qstate::return_rcode.

Referenced by processFindKey(), processInit(), and processValidate().

## ◆ needs_validation()

int needs_validation | ( | struct module_qstate * | qstate,
|  | int | ret_rc,
|  | struct dns_msg * | ret_msg )
| static

Check to see if a given response needs to go through the validation process.

Typical reasons for this routine to return false are: CD bit was on in the original request, or the response is a kind of message that is unvalidatable (i.e., SERVFAIL, REFUSED, etc.)

Parameters

  qstate | query state.
  ret_rc | rcode for this message (if noerror - examine ret_msg).
  ret_msg | return msg, can be NULL; look at rcode instead.

Returns
  true if the response could use validation (although this does not mean we can actually validate this response).

References reply_info::an_numrrsets, reply_info::flags, FLAGS_GET_RCODE, module_qstate::is_valrec, LDNS_RR_TYPE_RRSIG, module_qstate::qinfo, query_info::qtype, dns_msg::rep, sldns_wire2str_rcode_buf(), VERB_ALGO, verbose(), and verbosity.

Referenced by val_operate().

## ◆ already_validated()

int already_validated | ( | struct dns_msg * | ret_msg | ) |
| static

Check to see if the response has already been validated.

Parameters

  ret_msg | return msg, can be NULL

Returns
  true if the response has already been validated

References dns_msg::rep, sec_status_bogus, sec_status_to_string(), reply_info::security, VERB_ALGO, and verbose().

Referenced by val_operate().

## ◆ generate_request()

int generate_request | ( | struct module_qstate * | qstate,
|  | int | id,
|  | uint8_t * | name,
|  | size_t | namelen,
|  | uint16_t | qtype,
|  | uint16_t | qclass,
|  | uint16_t | flags,
|  | struct module_qstate ** | newq,
|  | int | detached )
| static

Generate a request for DNS data.

Parameters

  qstate | query state that is the parent.
  id | module id.
  name | what name to query for.
  namelen | length of name.
  qtype | query type.
  qclass | query class.
  flags | additional flags, such as the CD bit (BIT_CD), or 0.
  newq | If the subquery is newly created, it is returned, otherwise NULL is returned
  detached | true if this qstate should not attach to the subquery

Returns
  false on alloc failure.

References module_env::add_sub, module_env::attach_sub, BIT_RD, val_qstate::chain_blacklist, module_env::detect_cycle, module_qstate::env, module_qstate::ext_state, fptr_ok, fptr_whitelist_modenv_add_sub(), fptr_whitelist_modenv_attach_sub(), fptr_whitelist_modenv_detect_cycle(), query_info::local_alias, log_err(), log_query_info(), module_qstate::minfo, module_wait_subquery, query_info::qclass, query_info::qname, query_info::qname_len, query_info::qtype, sock_list_merge(), VERB_ALGO, and verbose().

Referenced by generate_keytag_query(), prime_trust_anchor(), and processFindKey().

## ◆ generate_keytag_query()

int generate_keytag_query | ( | struct module_qstate * | qstate,
|  | int | id,
|  | struct trust_anchor * | ta )
| static

Generate, send and detach key tag signaling query.

Parameters

  qstate | query state.
  id | module id.
  ta | trust anchor, locked.

Returns
  false on a processing error.

References anchor_list_keytags(), trust_anchor::dclass, module_qstate::ext_state, generate_request(), LDNS_MAX_DOMAINLEN, LDNS_MAX_LABELLEN, LDNS_RR_TYPE_NULL, log_err(), log_nametypeclass(), trust_anchor::name, trust_anchor::namelen, module_qstate::region, regional_alloc_init(), sldns_str2wire_dname_buf_origin(), VERB_ALGO, VERB_OPS, and verbose().

Referenced by prime_trust_anchor().

## ◆ sentinel_get_keytag()

int sentinel_get_keytag | ( | char * | start,
|  | uint16_t * | keytag )
| static

Get keytag as uint16_t from string.

Parameters

  start | start of string containing keytag
  keytag | pointer where to store the extracted keytag

Returns
  : 1 if keytag was extracted, else 0.

References SENTINEL_KEYTAG_LEN.

Referenced by processFinished().

## ◆ prime_trust_anchor()

int prime_trust_anchor | ( | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | int | id,
|  | struct trust_anchor * | toprime )
| static

Prime trust anchor for use.

Generate and dispatch a priming query for the given trust anchor. The trust anchor can be DNSKEY or DS and does not have to be signed.

Parameters

  qstate | query state.
  vq | validator query state.
  id | module id.
  toprime | what to prime.

Returns
  false on a processing error.

References BIT_CD, module_env::cfg, trust_anchor::dclass, module_qstate::env, generate_keytag_query(), generate_request(), log_err(), trust_anchor::name, trust_anchor::namelabs, trust_anchor::namelen, module_qstate::region, regional_alloc_init(), val_qstate::trust_anchor_labs, val_qstate::trust_anchor_len, val_qstate::trust_anchor_name, config_file::trust_anchor_signaling, VERB_ALGO, verbose(), and val_qstate::wait_prime_ta.

Referenced by processInit().

## ◆ validate_msg_signatures()

int validate_msg_signatures | ( | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | struct module_env * | env,
|  | struct val_env * | ve,
|  | struct reply_info * | chase_reply,
|  | struct key_entry_key * | key_entry,
|  | int * | suspend )
| static

Validate if the ANSWER and AUTHORITY sections contain valid rrsets.

They must be validly signed with the given key. Tries to validate ADDITIONAL rrsets as well, but only to check them. Allows unsigned CNAME after a DNAME that expands the DNAME.

Note that by the time this method is called, the process of finding the trusted DNSKEY rrset that signs this response must already have been completed.

Parameters

  qstate | query state.
  vq | validator query state.
  env | module env for verify.
  ve | validator env for verify.
  chase_reply | answer to validate.
  key_entry | the key entry, which is trusted, and which matches the signer of the answer. The key entry isgood().
  suspend | returned true if the task takes too long and needs to suspend to continue the effort later.

Returns
  false if any of the rrsets in the an or ns sections of the message fail to verify. The message is then set to bogus.

References reply_info::an_numrrsets, module_env::cfg, lruhash_entry::data, derive_cname_from_dname(), packed_rrset_key::dname, dname_strict_subdomain_c(), ub_packed_rrset_key::entry, errinf(), errinf_dname(), errinf_origin(), errinf_rrset(), get_cname_target(), LDNS_MAX_DOMAINLEN, LDNS_RR_TYPE_CNAME, LDNS_RR_TYPE_DNAME, log_nametypeclass(), MAX_VALIDATE_AT_ONCE, val_qstate::msg_signatures_index, val_qstate::msg_signatures_state, key_entry_key::name, reply_info::ns_numrrsets, query_dname_compare(), module_qstate::reply_origin, ub_packed_rrset_key::rk, packed_rrset_key::rrset_class, reply_info::rrset_count, rrset_trust_validated, reply_info::rrsets, sec_status_bogus, sec_status_secure, packed_rrset_data::security, reply_info::security, packed_rrset_data::trust, packed_rrset_key::type, config_file::val_clean_additional, val_find_rrset_signer(), val_verify_rrset_entry(), VERB_ALGO, VERB_QUERY, and verbose().

Referenced by processValidate().

## ◆ detect_wrongly_truncated()

int detect_wrongly_truncated | ( | struct reply_info * | rep | ) |
| static

Detect wrong truncated response (say from BIND 9.6.1 that is forwarding and saw the NS record without signatures from a referral).

The positive response has a mangled authority section. Remove that authority section and the additional section.

Parameters

  rep | reply

Returns
  true if a wrongly truncated response.

References reply_info::an_numrrsets, lruhash_entry::data, ub_packed_rrset_key::entry, LDNS_RR_TYPE_NS, reply_info::ns_numrrsets, ub_packed_rrset_key::rk, reply_info::rrsets, sec_status_secure, packed_rrset_key::type, VERB_ALGO, and verbose().

Referenced by processValidate().

## ◆ remove_spurious_authority()

void remove_spurious_authority | ( | struct reply_info * | chase_reply,
|  | struct reply_info * | orig_reply )
| static

For messages that are not referrals, if the chase reply contains an unsigned NS record in the authority section it could have been inserted by a (BIND) forwarder that thinks the zone is insecure, and that has an NS record without signatures in cache.

Remove the NS record since the reply does not hinge on that record (in the authority section), but do not remove it if it removes the last record from the answer+authority sections.

Parameters

  chase_reply | the chased reply, we have a key for this contents, so we should have signatures for these rrsets and not having signatures means it will be bogus.
  orig_reply | original reply, remove NS from there as well because we cannot mark the NS record as DNSSEC valid because it is not validated by signatures.

References reply_info::an_numrrsets, lruhash_entry::data, packed_rrset_key::dname, ub_packed_rrset_key::entry, LDNS_RR_TYPE_NS, log_rrset_key(), reply_info::ns_numrrsets, query_dname_compare(), ub_packed_rrset_key::rk, reply_info::rrsets, packed_rrset_data::rrsig_count, packed_rrset_key::type, val_reply_remove_auth(), and VERB_ALGO.

Referenced by processValidate().

## ◆ validate_positive_response()

void validate_positive_response | ( | struct module_env * | env,
|  | struct val_env * | ve,
|  | struct query_info * | qchase,
|  | struct reply_info * | chase_reply,
|  | struct key_entry_key * | kkey,
|  | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | int * | nsec3_calculations,
|  | int * | suspend )
| static

Given a "positive" response – a response that contains an answer to the question, and no CNAME chain, validate this response.

The answer and authority RRsets must already be verified as secure.

Parameters

  env | module env for verify.
  ve | validator env for verify.
  qchase | query that was made.
  chase_reply | answer to that query to validate.
  kkey | the key entry, which is trusted, and which matches the signer of the answer. The key entry isgood().
  qstate | query state for the region.
  vq | validator state for the nsec3 cache table.
  nsec3_calculations | current nsec3 hash calculations.
  suspend | returned true if the task takes too long and needs to suspend to continue the effort later.

References config_file::aggressive_nsec, module_env::alloc, reply_info::an_numrrsets, module_env::cfg, packed_rrset_key::dname, log_nametypeclass(), module_env::now, reply_info::ns_numrrsets, val_qstate::nsec3_cache_table, nsec3_cache_table_init(), nsec3_prove_wildcard(), module_qstate::region, ub_packed_rrset_key::rk, module_env::rrset_cache, rrset_cache_update_wildcard(), packed_rrset_key::rrset_class, reply_info::rrsets, sec_status_bogus, sec_status_insecure, sec_status_secure, sec_status_unchecked, reply_info::security, packed_rrset_key::type, val_nsec_proves_positive_wildcard(), val_rrset_wildcard(), VERB_ALGO, VERB_QUERY, and verbose().

Referenced by processValidate().

## ◆ validate_nodata_response()

void validate_nodata_response | ( | struct module_env * | env,
|  | struct val_env * | ve,
|  | struct query_info * | qchase,
|  | struct reply_info * | chase_reply,
|  | struct key_entry_key * | kkey,
|  | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | int * | nsec3_calculations,
|  | int * | suspend )
| static

Validate a NOERROR/NODATA signed response – a response that has a NOERROR Rcode but no ANSWER section RRsets.

This consists of making certain that the authority section NSEC/NSEC3s proves that the qname does exist and the qtype doesn't.

The answer and authority RRsets must already be verified as secure.

Parameters

  env | module env for verify.
  ve | validator env for verify.
  qchase | query that was made.
  chase_reply | answer to that query to validate.
  kkey | the key entry, which is trusted, and which matches the signer of the answer. The key entry isgood().
  qstate | query state for the region.
  vq | validator state for the nsec3 cache table.
  nsec3_calculations | current nsec3 hash calculations.
  suspend | returned true if the task takes too long and needs to suspend to continue the effort later.

References reply_info::an_numrrsets, log_dns_msg(), reply_info::ns_numrrsets, val_qstate::nsec3_cache_table, nsec3_cache_table_init(), nsec3_prove_nodata(), nsec_closest_encloser(), nsec_proves_nodata(), query_info::qname, query_dname_compare(), module_qstate::region, ub_packed_rrset_key::rk, reply_info::rrsets, sec_status_bogus, sec_status_insecure, sec_status_secure, sec_status_unchecked, reply_info::security, packed_rrset_key::type, val_nsec_proves_insecuredelegation(), val_nsec_proves_name_error(), VERB_ALGO, VERB_QUERY, verbose(), and verbosity.

Referenced by processValidate(), and validate_nameerror_response().

## ◆ validate_nameerror_response()

void validate_nameerror_response | ( | struct module_env * | env,
|  | struct val_env * | ve,
|  | struct query_info * | qchase,
|  | struct reply_info * | chase_reply,
|  | struct key_entry_key * | kkey,
|  | int * | rcode,
|  | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | int * | nsec3_calculations,
|  | int * | suspend )
| static

Validate a NAMEERROR signed response – a response that has a NXDOMAIN Rcode.

This consists of making certain that the authority section NSEC proves that the qname doesn't exist and the covering wildcard also doesn't exist..

The answer and authority RRsets must have already been verified as secure.

Parameters

  env | module env for verify.
  ve | validator env for verify.
  qchase | query that was made.
  chase_reply | answer to that query to validate.
  kkey | the key entry, which is trusted, and which matches the signer of the answer. The key entry isgood().
  rcode | adjusted RCODE, in case of RCODE/proof mismatch leniency.
  qstate | query state for the region.
  vq | validator state for the nsec3 cache table.
  nsec3_calculations | current nsec3 hash calculations.
  suspend | returned true if the task takes too long and needs to suspend to continue the effort later.

References reply_info::an_numrrsets, dname_count_labels(), reply_info::ns_numrrsets, val_qstate::nsec3_cache_table, nsec3_cache_table_init(), nsec3_prove_nameerror(), nsec_closest_encloser(), query_info::qname, query_info::qname_len, module_qstate::region, ub_packed_rrset_key::rk, reply_info::rrsets, sec_status_bogus, sec_status_insecure, sec_status_secure, sec_status_to_string(), sec_status_unchecked, reply_info::security, packed_rrset_key::type, val_nsec_proves_insecuredelegation(), val_nsec_proves_name_error(), val_nsec_proves_no_wc(), validate_nodata_response(), VERB_ALGO, VERB_QUERY, and verbose().

Referenced by processValidate().

## ◆ validate_referral_response()

void validate_referral_response | ( | struct reply_info * | chase_reply | ) |
| static

Given a referral response, validate rrsets and take least trusted rrset as the current validation status.

Note that by the time this method is called, the process of finding the trusted DNSKEY rrset that signs this response must already have been completed.

Parameters

  chase_reply | answer to validate.

References lruhash_entry::data, ub_packed_rrset_key::entry, reply_info::rrset_count, reply_info::rrsets, sec_status_secure, sec_status_to_string(), packed_rrset_data::security, reply_info::security, VERB_ALGO, and verbose().

Referenced by processValidate().

## ◆ validate_any_response()

void validate_any_response | ( | struct module_env * | env,
|  | struct val_env * | ve,
|  | struct query_info * | qchase,
|  | struct reply_info * | chase_reply,
|  | struct key_entry_key * | kkey,
|  | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | int * | nsec3_calculations,
|  | int * | suspend )
| static

Given an "ANY" response – a response that contains an answer to a qtype==ANY question, with answers.

This does no checking that all types are present.

NOTE: it may be possible to get parent-side delegation point records here, which won't all be signed. Right now, this routine relies on the upstream iterative resolver to not return these responses – instead treating them as referrals.

NOTE: RFC 4035 is silent on this issue, so this may change upon clarification. Clarification draft -05 says to not check all types are present.

Note that by the time this method is called, the process of finding the trusted DNSKEY rrset that signs this response must already have been completed.

Parameters

  env | module env for verify.
  ve | validator env for verify.
  qchase | query that was made.
  chase_reply | answer to that query to validate.
  kkey | the key entry, which is trusted, and which matches the signer of the answer. The key entry isgood().
  qstate | query state for the region.
  vq | validator state for the nsec3 cache table.
  nsec3_calculations | current nsec3 hash calculations.
  suspend | returned true if the task takes too long and needs to suspend to continue the effort later.

References reply_info::an_numrrsets, packed_rrset_key::dname, LDNS_RR_TYPE_ANY, log_err(), log_nametypeclass(), reply_info::ns_numrrsets, val_qstate::nsec3_cache_table, nsec3_cache_table_init(), nsec3_prove_wildcard(), query_info::qtype, module_qstate::region, ub_packed_rrset_key::rk, packed_rrset_key::rrset_class, reply_info::rrsets, sec_status_bogus, sec_status_insecure, sec_status_secure, sec_status_unchecked, reply_info::security, packed_rrset_key::type, val_nsec_proves_positive_wildcard(), val_rrset_wildcard(), VERB_ALGO, VERB_QUERY, and verbose().

Referenced by processValidate().

## ◆ validate_cname_response()

void validate_cname_response | ( | struct module_env * | env,
|  | struct val_env * | ve,
|  | struct query_info * | qchase,
|  | struct reply_info * | chase_reply,
|  | struct key_entry_key * | kkey,
|  | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | int * | nsec3_calculations,
|  | int * | suspend )
| static

Validate CNAME response, or DNAME+CNAME.

This is just like a positive proof, except that this is about a DNAME+CNAME. Possible wildcard proof. Difference with positive proof is that this routine refuses wildcarded DNAMEs.

The answer and authority rrsets must already be verified as secure.

Parameters

  env | module env for verify.
  ve | validator env for verify.
  qchase | query that was made.
  chase_reply | answer to that query to validate.
  kkey | the key entry, which is trusted, and which matches the signer of the answer. The key entry isgood().
  qstate | query state for the region.
  vq | validator state for the nsec3 cache table.
  nsec3_calculations | current nsec3 hash calculations.
  suspend | returned true if the task takes too long and needs to suspend to continue the effort later.

References reply_info::an_numrrsets, packed_rrset_key::dname, LDNS_RR_TYPE_CNAME, LDNS_RR_TYPE_DNAME, log_nametypeclass(), reply_info::ns_numrrsets, val_qstate::nsec3_cache_table, nsec3_cache_table_init(), nsec3_prove_wildcard(), query_info::qtype, module_qstate::region, ub_packed_rrset_key::rk, packed_rrset_key::rrset_class, reply_info::rrsets, sec_status_bogus, sec_status_insecure, sec_status_secure, sec_status_unchecked, reply_info::security, packed_rrset_key::type, val_nsec_proves_positive_wildcard(), val_rrset_wildcard(), VERB_ALGO, VERB_QUERY, and verbose().

Referenced by processValidate().

## ◆ validate_cname_noanswer_response()

void validate_cname_noanswer_response | ( | struct module_env * | env,
|  | struct val_env * | ve,
|  | struct query_info * | qchase,
|  | struct reply_info * | chase_reply,
|  | struct key_entry_key * | kkey,
|  | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | int * | nsec3_calculations,
|  | int * | suspend )
| static

Validate CNAME NOANSWER response, no more data after a CNAME chain.

This can be a NODATA or a NAME ERROR case, but not both at the same time. We don't know because the rcode has been set to NOERROR by the CNAME.

The answer and authority rrsets must already be verified as secure.

Parameters

  env | module env for verify.
  ve | validator env for verify.
  qchase | query that was made.
  chase_reply | answer to that query to validate.
  kkey | the key entry, which is trusted, and which matches the signer of the answer. The key entry isgood().
  qstate | query state for the region.
  vq | validator state for the nsec3 cache table.
  nsec3_calculations | current nsec3 hash calculations.
  suspend | returned true if the task takes too long and needs to suspend to continue the effort later.

References reply_info::an_numrrsets, dname_count_labels(), log_dns_msg(), reply_info::ns_numrrsets, val_qstate::nsec3_cache_table, nsec3_cache_table_init(), nsec3_prove_nxornodata(), nsec_closest_encloser(), nsec_proves_nodata(), query_info::qname, query_info::qname_len, query_dname_compare(), module_qstate::region, ub_packed_rrset_key::rk, reply_info::rrsets, sec_status_bogus, sec_status_insecure, sec_status_secure, sec_status_unchecked, reply_info::security, packed_rrset_key::type, val_nsec_proves_insecuredelegation(), val_nsec_proves_name_error(), val_nsec_proves_no_wc(), VERB_ALGO, VERB_QUERY, verbose(), and verbosity.

Referenced by processValidate().

## ◆ processInit()

int processInit | ( | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | struct val_env * | ve,
|  | int | id )
| static

Process init state for validator.

Process the INIT state. First tier responses start in the INIT state. This is where they are vetted for validation suitability, and the initial key search is done.

Currently, events the come through this routine will be either promoted to FINISHED/CNAME_RESP (no validation needed), FINDKEY (next step to validation), or will be (temporarily) retired and a new priming request event will be generated.

Parameters

  qstate | query state.
  vq | validator query state.
  ve | validator shared global environment.
  id | module id.

Returns
  true if the event should be processed further on return, false if not.

References module_env::anchors, anchors_lookup(), val_qstate::chase_reply, dname_remove_label(), dname_strict_subdomain_c(), dname_subdomain_c(), val_qstate::ds_rrset, val_qstate::empty_DS_name, module_qstate::env, errinf(), errinf_dname(), val_env::kcache, key_cache_obtain(), val_qstate::key_entry, key_entry_get_reason(), key_entry_get_reason_bogus(), key_entry_isbad(), key_entry_isnull(), LDNS_RR_TYPE_DS, trust_anchor::lock, log_dns_msg(), log_nametypeclass(), val_env::max_restart, key_entry_key::name, trust_anchor::name, module_env::now, trust_anchor::numDNSKEY, trust_anchor::numDS, val_qstate::orig_msg, PACKED_RRSET_NSEC_AT_APEX, prime_trust_anchor(), val_qstate::qchase, query_info::qclass, module_qstate::qinfo, query_info::qname, query_info::qname_len, query_info::qtype, query_dname_compare(), module_qstate::query_flags, module_qstate::region, dns_msg::rep, val_qstate::restart_count, ub_packed_rrset_key::rk, module_env::rrset_cache, reply_info::rrset_count, val_qstate::rrset_skip, reply_info::rrsets, sec_status_bogus, sec_status_indeterminate, sec_status_insecure, reply_info::security, val_qstate::signer_len, val_qstate::signer_name, val_qstate::state, packed_rrset_key::type, VAL_CLASS_CNAME, VAL_CLASS_NAMEERROR, VAL_CLASS_POSITIVE, VAL_CLASS_REFERRAL, val_classification_to_string(), val_classify_response(), val_error(), val_fill_reply(), val_find_signer(), VAL_FINDKEY_STATE, VAL_FINISHED_STATE, val_mark_indeterminate(), val_mark_insecure(), VERB_ALGO, VERB_DETAIL, VERB_QUERY, verbose(), and verbosity.

Referenced by val_handle().

## ◆ processFindKey()

int processFindKey | ( | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | int | id )
| static

Process the FINDKEY state.

Generally this just calculates the next name to query and either issues a DS or a DNSKEY query. It will check to see if the correct key has already been reached, in which case it will advance the event to the next state.

Parameters

  qstate | query state.
  vq | validator query state.
  id | module id.

Returns
  true if the event should be processed further on return, false if not.

References BIT_CD, module_qstate::blacklist, val_qstate::chain_blacklist, val_qstate::chase_reply, packed_rrset_key::dname, dname_count_labels(), packed_rrset_key::dname_len, dname_remove_labels(), dname_subdomain_c(), val_qstate::ds_rrset, val_qstate::empty_DS_name, module_qstate::env, errinf_origin(), generate_request(), val_qstate::key_entry, key_entry_isbad(), key_entry_isnull(), LDNS_RR_CLASS_IN, LDNS_RR_TYPE_DS, log_assert, log_nametypeclass(), log_query_info(), key_entry_key::name, process_ds_response(), val_qstate::qchase, query_info::qclass, dns_msg::qinfo, query_info::qname, query_info::qname_len, query_dname_compare(), module_qstate::region, module_qstate::reply_origin, ub_packed_rrset_key::rk, sec_status_bogus, reply_info::security, val_qstate::signer_len, val_qstate::signer_name, val_qstate::state, val_qstate::sub_ds_msg, val_error(), val_find_DS(), VAL_FINDKEY_STATE, VAL_FINISHED_STATE, VAL_VALIDATE_STATE, validate_suspend_setup_timer(), VERB_ALGO, and verbose().

Referenced by val_handle().

## ◆ processValidate()

int processValidate | ( | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | struct val_env * | ve,
|  | int | id )
| static

Process the VALIDATE stage, the init and findkey stages are finished, and the right keys are available to validate the response.

Or, there are no keys available, in order to invalidate the response.

After validation, the status is recorded in the message and rrsets, and finished state is started.

Parameters

  qstate | query state.
  vq | validator query state.
  ve | validator shared global environment.
  id | module id.

Returns
  true if the event should be processed further on return, false if not.

References reply_info::an_numrrsets, reply_info::ar_numrrsets, module_env::cfg, val_qstate::chase_reply, detect_wrongly_truncated(), module_qstate::env, errinf(), module_qstate::errinf, errinf_origin(), reply_info::flags, FLAGS_GET_RCODE, FLAGS_SET_RCODE, val_env::kcache, key_cache_insert(), key_entry_key::key_class, val_qstate::key_entry, key_entry_get_reason_bogus(), key_entry_isbad(), key_entry_isnull(), log_err(), log_nametypeclass(), log_query_info(), val_env::max_restart, key_entry_key::name, reply_info::ns_numrrsets, val_qstate::orig_msg, val_qstate::qchase, module_qstate::qinfo, module_qstate::query_flags, remove_spurious_authority(), dns_msg::rep, module_qstate::reply_origin, val_qstate::restart_count, module_env::rrset_cache, reply_info::rrset_count, val_qstate::rrset_skip, sec_status_bogus, sec_status_insecure, sec_status_to_string(), reply_info::security, val_qstate::signer_name, val_qstate::state, VAL_CLASS_ANY, VAL_CLASS_CNAME, VAL_CLASS_CNAMENOANSWER, VAL_CLASS_NAMEERROR, VAL_CLASS_NODATA, VAL_CLASS_POSITIVE, VAL_CLASS_REFERRAL, val_classification_to_string(), val_classify_response(), val_error(), VAL_FINISHED_STATE, config_file::val_log_level, val_mark_insecure(), VAL_VALIDATE_STATE, validate_any_response(), validate_cname_noanswer_response(), validate_cname_response(), validate_msg_signatures(), validate_nameerror_response(), validate_nodata_response(), validate_positive_response(), validate_referral_response(), validate_suspend_setup_timer(), VERB_ALGO, VERB_DETAIL, and verbose().

Referenced by val_handle().

## ◆ processFinished()

int processFinished | ( | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | struct val_env * | ve,
|  | int | id )
| static

The Finished state.

The validation status (good or bad) has been determined.

Parameters

  qstate | query state.
  vq | validator query state.
  ve | validator shared global environment.
  id | module id.

Returns
  true if the event should be processed further on return, false if not.

References reply_info::an_numrrsets, anchor_has_keytag(), module_env::anchors, BIT_RD, module_qstate::blacklist, val_env::bogus_ttl, module_env::cfg, val_qstate::chase_reply, lruhash_entry::data, dname_lab_startswith(), dns_cache_store(), msgreply_entry::entry, module_qstate::env, module_qstate::errinf, errinf_to_reason_bogus(), errinf_to_str_bogus(), module_qstate::ext_state, module_qstate::is_valrec, LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA, lruhash_entry::lock, log_err(), log_info(), log_query_info(), config_file::log_servfail, val_env::max_restart, module_finished, module_restart_next, msg_cache_lookup(), module_env::neg_cache, module_qstate::no_cache_store, NORR_TTL, module_env::now, reply_info::ns_numrrsets, val_qstate::orig_msg, module_qstate::prefetch_leeway, reply_info::prefetch_ttl, PREFETCH_TTL_CALC, val_qstate::qchase, query_info::qclass, dns_msg::qinfo, module_qstate::qinfo, query_info::qname, query_info::qname_len, module_qstate::qstarttime, query_info::qtype, module_qstate::query_flags, reply_info::reason_bogus, reply_info::reason_bogus_str, module_qstate::region, dns_msg::rep, module_qstate::reply_origin, val_qstate::restart_count, module_qstate::return_msg, module_qstate::return_rcode, config_file::root_key_sentinel, reply_info::rrset_count, val_qstate::rrset_skip, sec_status_bogus, sec_status_indeterminate, sec_status_secure, sec_status_secure_sentinel_fail, sec_status_unchecked, reply_info::security, sentinel_get_keytag(), SENTINEL_IS, SENTINEL_KEYTAG_LEN, SENTINEL_NOT, config_file::serve_expired, reply_info::serve_expired_norec_ttl, config_file::serve_expired_ttl, reply_info::serve_expired_ttl, config_file::serve_expired_ttl_reset, val_qstate::state, reply_info::ttl, val_blacklist(), val_chase_cname(), val_check_nonsecure(), VAL_CLASS_CNAME, VAL_CLASS_REFERRAL, val_classify_response(), VAL_INIT_STATE, config_file::val_log_level, config_file::val_log_squelch, val_neg_addreply(), val_next_unchecked(), config_file::val_permissive_mode, val_restart(), VERB_ALGO, VERB_DETAIL, and verbose().

Referenced by val_handle().

## ◆ val_handle()

void val_handle | ( | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | struct val_env * | ve,
|  | int | id )
| static

Handle validator state.

If a method returns true, the next state is started. If false, then processing will stop.

Parameters

  qstate | query state.
  vq | validator query state.
  ve | validator shared global environment.
  id | module id.

References log_warn(), processFindKey(), processFinished(), processInit(), processValidate(), val_qstate::state, VAL_FINDKEY_STATE, VAL_FINISHED_STATE, VAL_INIT_STATE, val_state_to_string(), VAL_VALIDATE_STATE, VERB_ALGO, and verbose().

Referenced by val_operate().

## ◆ primeResponseToKE()

struct key_entry_key * primeResponseToKE | ( | struct ub_packed_rrset_key * | dnskey_rrset,
|  | struct trust_anchor * | ta,
|  | struct module_qstate * | qstate,
|  | int | id,
|  | struct module_qstate * | sub_qstate )
| static

Evaluate the response to a priming request.

Parameters

  dnskey_rrset | DNSKEY rrset (can be NULL if none) in prime reply. (this rrset is allocated in the wrong region, not the qstate).
  ta | trust anchor.
  qstate | qstate that needs key.
  id | module id.
  sub_qstate | the sub query state, that is the lookup that fetched the trust anchor data, it contains error information for the answer.

Returns
  new key entry or NULL on allocation failure. The key entry will either contain a validated DNSKEY rrset, or represent a Null key (query failed, but validation did not), or a Bad key (validation failed).

References BOGUS_KEY_TTL, module_env::cfg, trust_anchor::dclass, trust_anchor::dnskey_rrset, trust_anchor::ds_rrset, module_qstate::env, errinf_to_str_misc(), config_file::harden_algo_downgrade, config_file::harden_dnssec_stripped, key_entry_create_bad(), key_entry_create_null(), key_entry_isgood(), log_err(), log_nametypeclass(), module_env::modinfo, trust_anchor::name, trust_anchor::namelen, module_env::now, NULL_KEY_TTL, module_qstate::region, sec_status_bogus, sec_status_secure, sec_status_to_string(), sec_status_unchecked, val_verify_new_DNSKEYs_with_ta(), VERB_DETAIL, VERB_OPS, and verbose().

Referenced by process_prime_response().

## ◆ ds_response_to_ke()

int ds_response_to_ke | ( | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | int | id,
|  | int | rcode,
|  | struct dns_msg * | msg,
|  | struct query_info * | qinfo,
|  | struct key_entry_key ** | ke,
|  | struct module_qstate * | sub_qstate )
| static

In inform supers, with the resulting message and rcode and the current keyset in the super state, validate the DS response, returning a KeyEntry.

Parameters

  qstate | query state that is validating and asked for a DS.
  vq | validator query state
  id | module id.
  rcode | rcode result value.
  msg | result message (if rcode is OK).
  qinfo | from the sub query state, query info.
  ke | the key entry to return. It returns is_bad if the DS response fails to validate, is_null if the DS response indicated an end to secure space, is_good if the DS validated. It returns ke=NULL if the DS response indicated that the request wasn't a delegation point.
  sub_qstate | the sub query state, that is the lookup that fetched the trust anchor data, it contains error information for the answer. Can be NULL.

Returns
  0 on success, 1 on servfail error (malloc failure), 2 on NSEC3 suspend.

References reply_info::an_numrrsets, BIT_RD, BOGUS_KEY_TTL, lruhash_entry::data, ub_packed_rrset_key::entry, module_qstate::env, errinf(), errinf_to_str_misc(), reply_info::flags, FLAGS_GET_RCODE, val_qstate::key_entry, key_entry_create_bad(), key_entry_create_null(), key_entry_create_rrset(), LDNS_RR_TYPE_CNAME, LDNS_RR_TYPE_DNAME, log_err(), log_query_info(), log_warn(), module_env::modinfo, module_env::now, reply_info::ns_numrrsets, val_qstate::nsec3_cache_table, nsec3_cache_table_init(), nsec3_prove_nods(), query_info::qclass, query_info::qname, query_info::qname_len, module_qstate::region, dns_msg::rep, reply_find_answer_rrset(), reply_find_rrset_section_an(), reply_info::rrsets, sec_status_bogus, sec_status_indeterminate, sec_status_insecure, sec_status_secure, sec_status_unchecked, sldns_wire2str_rcode_buf(), ub_packed_rrset_ttl(), VAL_CLASS_CNAME, VAL_CLASS_CNAMENOANSWER, VAL_CLASS_NAMEERROR, VAL_CLASS_NODATA, VAL_CLASS_POSITIVE, val_classification_to_string(), val_classify_response(), val_dsset_isusable(), val_has_signed_nsecs(), val_nsec_prove_nodata_dsreply(), val_rrset_wildcard(), val_verify_rrset_entry(), VERB_ALGO, VERB_DETAIL, VERB_QUERY, and verbose().

Referenced by process_ds_response().

## ◆ process_dnskey_response()

void process_dnskey_response | ( | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | int | id,
|  | int | rcode,
|  | struct dns_msg * | msg,
|  | struct query_info * | qinfo,
|  | struct sock_list * | origin,
|  | struct module_qstate * | sub_qstate )
| static

Process DNSKEY response.

Called from inform_supers. Sets the key entry in the state. Because it is in inform_supers, the mesh itself is busy doing callbacks for a state that is to be deleted soon; don't touch the mesh; instead set a state in the super, as the super will be reactivated soon. Perform processing to determine what state to set in the super.

Parameters

  qstate | query state that is validating and asked for a DNSKEY.
  vq | validator query state
  id | module id.
  rcode | rcode result value.
  msg | result message (if rcode is OK).
  qinfo | from the sub query state, query info.
  origin | the origin of msg.
  sub_qstate | the sub query state, that is the lookup that fetched the trust anchor data, it contains error information for the answer.

References BOGUS_KEY_TTL, module_env::cfg, val_qstate::chain_blacklist, val_qstate::chase_reply, val_qstate::ds_rrset, module_qstate::env, module_qstate::errinf, errinf_dname(), errinf_origin(), errinf_to_str_misc(), config_file::harden_algo_downgrade, val_env::kcache, key_cache_insert(), val_qstate::key_entry, key_entry_create_bad(), key_entry_isbad(), key_entry_isgood(), log_err(), log_query_info(), val_env::max_restart, module_env::modinfo, module_env::now, query_info::qclass, query_info::qname, query_info::qname_len, module_qstate::region, dns_msg::rep, reply_find_answer_rrset(), val_qstate::restart_count, module_qstate::rpz_applied, sec_status_insecure, reply_info::security, val_qstate::state, val_blacklist(), VAL_FINISHED_STATE, config_file::val_log_level, VAL_VALIDATE_STATE, val_verify_new_DNSKEYs(), VERB_ALGO, VERB_DETAIL, and verbose().

Referenced by val_inform_super().

## ◆ process_prime_response()

void process_prime_response | ( | struct module_qstate * | qstate,
|  | struct val_qstate * | vq,
|  | int | id,
|  | int | rcode,
|  | struct dns_msg * | msg,
|  | struct sock_list * | origin,
|  | struct module_qstate * | sub_qstate )
| static

Process prime response Sets the key entry in the state.

Parameters

  qstate | query state that is validating and primed a trust anchor.
  vq | validator query state
  id | module id.
  rcode | rcode result value.
  msg | result message (if rcode is OK).
  origin | the origin of msg.
  sub_qstate | the sub query state, that is the lookup that fetched the trust anchor data, it contains error information for the answer.

References anchor_find(), module_env::anchors, trust_anchor::autr, autr_process_prime(), module_env::cfg, val_qstate::chain_blacklist, trust_anchor::dclass, trust_anchor::dnskey_rrset, module_qstate::env, module_qstate::errinf, errinf_dname(), errinf_origin(), val_env::kcache, key_cache_insert(), val_qstate::key_entry, key_entry_isbad(), key_entry_isnull(), trust_anchor::lock, val_env::max_restart, module_env::modinfo, trust_anchor::name, trust_anchor::namelen, primeResponseToKE(), val_qstate::qchase, query_info::qclass, module_qstate::region, dns_msg::rep, reply_find_rrset_section_an(), val_qstate::restart_count, val_qstate::state, val_qstate::trust_anchor_labs, val_qstate::trust_anchor_len, val_qstate::trust_anchor_name, val_blacklist(), VAL_INIT_STATE, config_file::val_log_level, and VAL_VALIDATE_STATE.

Referenced by val_inform_super().

## ◆ val_inform_super()

void val_inform_super | ( | struct module_qstate * | qstate,
|  | int | id,
|  | struct module_qstate * | super )

inform validator super.

Parameters

  qstate | query state that finished.
  id | module id.
  super | the qstate to inform.

References dns_msg_deepcopy_region(), LDNS_RR_TYPE_DS, log_err(), log_query_info(), module_qstate::minfo, val_qstate::nsec3_cache_table, process_dnskey_response(), process_ds_response(), process_prime_response(), module_qstate::qinfo, query_info::qtype, module_qstate::region, module_qstate::reply_origin, module_qstate::return_msg, module_qstate::return_rcode, val_qstate::sub_ds_msg, VERB_ALGO, verbose(), and val_qstate::wait_prime_ta.

Referenced by fptr_whitelist_mod_inform_super().

## ◆ val_get_mem()

size_t val_get_mem | ( | struct module_env * | env,
|  | int | id )

Debug helper routine that assists worker in determining memory in use.

Parameters

  env | module environment
  id | module id.

Returns
  memory in use in bytes.

References val_env::kcache, key_cache_get_mem(), module_env::modinfo, val_env::neg_cache, val_env::nsec3_keyiter_count, and val_neg_get_mem().

Referenced by fptr_whitelist_mod_get_mem().

## ◆ val_get_funcblock()

struct module_func_block * val_get_funcblock | ( | void |  | ) |

Get the validator function block.

Returns
  : function block with function pointers to validator methods.

References val_block.

Referenced by checkconf(), and module_funcs_avail().

## ◆ val_state_to_string()

const char * val_state_to_string | ( | enum val_state | state | ) |

Get validator state as a string.

Parameters

  state | to convert

Returns
  constant string that is printable.

References VAL_FINDKEY_STATE, VAL_FINISHED_STATE, VAL_INIT_STATE, and VAL_VALIDATE_STATE.

Referenced by val_handle().

## Variable Documentation

## ◆ val_block

struct module_func_block val_block
| static

Initial value:
= {
"validator",
NULL, NULL, &val_init, &val_deinit, &val_operate, &val_inform_super,
&val_clear, &val_get_mem
}
val_deinit
void val_deinit(struct module_env *env, int id)
validator deinit
Definition validator.c:263
val_clear
void val_clear(struct module_qstate *qstate, int id)
validator cleanup query state
Definition validator.c:3577
val_operate
void val_operate(struct module_qstate *qstate, enum module_ev event, int id, struct outbound_entry *outbound)
validator operate on a query
Definition validator.c:2704
val_init
int val_init(struct module_env *env, int id)
validator init
Definition validator.c:227
val_get_mem
size_t val_get_mem(struct module_env *env, int id)
Debug helper routine that assists worker in determining memory in use.
Definition validator.c:3593
val_inform_super
void val_inform_super(struct module_qstate *qstate, int id, struct module_qstate *super)
inform validator super.
Definition validator.c:3528

The validator function block.

Referenced by val_get_funcblock().