unbound: validator/val_anchor.h File Reference

unbound 0.1

Data Structures | Functions
val_anchor.h File Reference

This file contains storage for the trust anchors for the validator. More...

`#include "util/rbtree.h"`
`#include "util/locks.h"`

## Data Structures
struct | val_anchors
| Trust anchor store. More...
struct | ta_key
| Trust anchor key. More...
struct | trust_anchor
| A trust anchor in the trust anchor store. More...

## Functions
struct val_anchors * | anchors_create (void)
| Create trust anchor storage.
void | anchors_delete (struct val_anchors *anchors)
| Delete trust anchor storage.
int | anchors_apply_cfg (struct val_anchors *anchors, struct config_file *cfg)
| Process trust anchor config.
void | anchors_init_parents_locked (struct val_anchors *anchors)
| Recalculate parent pointers.
struct trust_anchor * | anchors_lookup (struct val_anchors *anchors, uint8_t *qname, size_t qname_len, uint16_t qclass)
| Given a qname/qclass combination, find the trust anchor closest above it.
struct trust_anchor * | anchor_find (struct val_anchors *anchors, uint8_t *name, int namelabs, size_t namelen, uint16_t dclass)
| Find a trust anchor.
struct trust_anchor * | anchor_store_str (struct val_anchors *anchors, struct sldns_buffer *buffer, const char *str)
| Store one string as trust anchor RR.
size_t | anchors_get_mem (struct val_anchors *anchors)
| Get memory in use by the trust anchor storage.
int | anchor_cmp (const void *k1, const void *k2)
| compare two trust anchors
int | anchors_add_insecure (struct val_anchors *anchors, uint16_t c, uint8_t *nm)
| Add insecure point trust anchor.
void | anchors_delete_insecure (struct val_anchors *anchors, uint16_t c, uint8_t *nm)
| Delete insecure point trust anchor.
size_t | anchor_list_keytags (struct trust_anchor *ta, uint16_t *list, size_t num)
| Get a list of keytags for the trust anchor.
int | anchor_has_keytag (struct val_anchors *anchors, uint8_t *name, int namelabs, size_t namelen, uint16_t dclass, uint16_t keytag)
| Check if there is a trust anchor for given zone with this keytag.
struct trust_anchor * | anchors_find_any_noninsecure (struct val_anchors *anchors)
| Find an anchor that is not an insecure point, if any, or there are no DNSSEC verification anchors if none.
void | anchors_swap_tree (struct val_anchors *anchors, struct val_anchors *data)
| Swap internal tree with preallocated entries.

## Detailed Description

This file contains storage for the trust anchors for the validator.

## Function Documentation

## ◆ anchors_create()

struct val_anchors * anchors_create | ( | void |  | ) |

Create trust anchor storage.

Returns
  new storage or NULL on error.

References anchor_cmp(), anchors_delete(), val_anchors::autr, autr_global_create(), val_anchors::lock, rbtree_create(), and val_anchors::tree.

Referenced by anchors_test(), fr_construct_from_config(), val_apply_cfg(), and zonemd_verify_test().

## ◆ anchors_delete()

void anchors_delete | ( | struct val_anchors * | anchors | ) |

Delete trust anchor storage.

Parameters

  anchors | to delete.

References anchors_delfunc(), val_anchors::autr, autr_global_delete(), val_anchors::lock, traverse_postorder(), and val_anchors::tree.

Referenced by anchors_create(), anchors_test(), fr_construct_clear(), val_deinit(), and zonemd_verify_test().

## ◆ anchors_apply_cfg()

int anchors_apply_cfg | ( | struct val_anchors * | anchors,
|  | struct config_file * | cfg )

Process trust anchor config.

Parameters

  anchors | struct anchor storage
  cfg | config options.

Returns
  0 on error.

References anchor_insert_insecure(), anchor_read_bind_file_wild(), anchor_read_file(), anchor_store_str(), anchors_assemble_rrsets(), as112_zones, config_file::auto_trust_anchor_file_list, autr_debug_print(), autr_read_file(), config_file::chrootdir, config_file::domain_insecure, init_parents(), config_file::insecure_lan_zones, log_err(), config_strlist::next, sldns_buffer_free(), sldns_buffer_new(), config_strlist::str, config_file::trust_anchor_file_list, config_file::trust_anchor_list, config_file::trusted_keys_file_list, VERB_ALGO, and verbosity.

Referenced by fr_construct_from_config(), and val_apply_cfg().

## ◆ anchors_init_parents_locked()

void anchors_init_parents_locked | ( | struct val_anchors * | anchors | ) |

Recalculate parent pointers.

The caller must hold the lock on the anchors structure (say after removing an item from the rbtree). Caller must not hold any locks on trust anchors. After the call is complete the parent pointers are updated and an item just removed is no longer referenced in parent pointers.

Parameters

  anchors | the structure to update.

References trust_anchor::dclass, dname_lab_cmp(), trust_anchor::name, trust_anchor::namelabs, trust_anchor::node, rbnode_type::parent, trust_anchor::parent, RBTREE_FOR, and val_anchors::tree.

Referenced by anchors_add_insecure(), anchors_delete_insecure(), autr_tp_remove(), and init_parents().

## ◆ anchors_lookup()

struct trust_anchor * anchors_lookup | ( | struct val_anchors * | anchors,
|  | uint8_t * | qname,
|  | size_t | qname_len,
|  | uint16_t | qclass )

Given a qname/qclass combination, find the trust anchor closest above it.

Or return NULL if none exists.

Parameters

  anchors | struct anchor storage
  qname | query name, uncompressed wireformat.
  qname_len | length of qname.
  qclass | class to query for.

Returns
  the trust anchor or NULL if none is found. The anchor is locked.

References trust_anchor::dclass, dname_count_labels(), dname_lab_cmp(), rbnode_type::key, trust_anchor::lock, val_anchors::lock, trust_anchor::name, trust_anchor::namelabs, trust_anchor::namelen, trust_anchor::node, trust_anchor::parent, rbtree_find_less_equal(), and val_anchors::tree.

Referenced by auth_zone_verify_zonemd(), check_no_anchor(), iter_qname_indicates_dnssec(), processInit(), test_anchor_empty(), test_anchor_one(), and test_anchors().

## ◆ anchor_find()

struct trust_anchor * anchor_find | ( | struct val_anchors * | anchors,
|  | uint8_t * | name,
|  | int | namelabs,
|  | size_t | namelen,
|  | uint16_t | dclass )

Find a trust anchor.

Exact matching.

Parameters

  anchors | anchor storage.
  name | name of trust anchor (wireformat)
  namelabs | labels in name
  namelen | length of name
  dclass | class of trust anchor

Returns
  NULL if not found. The anchor is locked.

References trust_anchor::dclass, rbnode_type::key, val_anchors::lock, trust_anchor::name, trust_anchor::namelabs, trust_anchor::namelen, trust_anchor::node, rbtree_search(), and val_anchors::tree.

Referenced by anchor_has_keytag(), anchor_store_new_key(), do_list_forwards(), do_list_stubs(), find_add_tp(), iter_indicates_dnssec(), and process_prime_response().

## ◆ anchor_store_str()

struct trust_anchor * anchor_store_str | ( | struct val_anchors * | anchors,
|  | struct sldns_buffer * | buffer,
|  | const char * | str )

Store one string as trust anchor RR.

Parameters

  anchors | anchor storage.
  buffer | parsing buffer, to generate the RR wireformat in.
  str | string.

Returns
  NULL on error.

References anchor_store_new_rr(), log_err(), sldns_buffer_begin(), sldns_buffer_capacity(), sldns_get_errorstr_parse(), and sldns_str2wire_rr_buf().

Referenced by anchors_apply_cfg(), process_bind_contents(), test_anchor_one(), and test_anchors().

## ◆ anchors_get_mem()

size_t anchors_get_mem | ( | struct val_anchors * | anchors | ) |

Get memory in use by the trust anchor storage.

Parameters

  anchors | anchor storage.

Returns
  memory in use in bytes.

References assembled_rrset_get_mem(), trust_anchor::autr, trust_anchor::dnskey_rrset, trust_anchor::ds_rrset, autr_point_data::file, trust_anchor::keylist, autr_point_data::keys, ta_key::len, trust_anchor::lock, val_anchors::lock, trust_anchor::namelen, autr_ta::next, ta_key::next, RBTREE_FOR, autr_ta::rr_len, autr_ta::s, and val_anchors::tree.

Referenced by fr_printmem(), and worker_mem_report().

## ◆ anchors_add_insecure()

int anchors_add_insecure | ( | struct val_anchors * | anchors,
|  | uint16_t | c,
|  | uint8_t * | nm )

Add insecure point trust anchor.

For external use (locks and init_parents)

Parameters

  anchors | anchor storage.
  c | class.
  nm | name of insecure trust point.

Returns
  false on alloc failure.

References anchor_new_ta(), anchors_init_parents_locked(), trust_anchor::dclass, dname_count_size_labels(), rbnode_type::key, val_anchors::lock, log_err(), trust_anchor::name, trust_anchor::namelabs, trust_anchor::namelen, trust_anchor::node, rbtree_search(), and val_anchors::tree.

Referenced by do_forward_add(), do_insecure_add(), and do_stub_add().

## ◆ anchors_delete_insecure()

void anchors_delete_insecure | ( | struct val_anchors * | anchors,
|  | uint16_t | c,
|  | uint8_t * | nm )

Delete insecure point trust anchor.

Does not remove if no such point. For external use (locks and init_parents)

Parameters

  anchors | anchor storage.
  c | class.
  nm | name of insecure trust point.

References anchors_delfunc(), anchors_init_parents_locked(), trust_anchor::autr, trust_anchor::dclass, dname_count_size_labels(), rbnode_type::key, trust_anchor::keylist, trust_anchor::lock, val_anchors::lock, trust_anchor::name, trust_anchor::namelabs, trust_anchor::namelen, trust_anchor::node, trust_anchor::numDNSKEY, trust_anchor::numDS, rbtree_delete(), rbtree_search(), and val_anchors::tree.

Referenced by do_forward_remove(), do_insecure_remove(), do_stub_add(), and do_stub_remove().

## ◆ anchor_list_keytags()

size_t anchor_list_keytags | ( | struct trust_anchor * | ta,
|  | uint16_t * | list,
|  | size_t | num )

Get a list of keytags for the trust anchor.

Zero tags for insecure points.

Parameters

  ta | trust anchor (locked by caller).
  list | array of uint16_t.
  num | length of array.

Returns
  number of keytags filled into array. If total number of keytags is bigger than the array, it is truncated at num. On errors, less keytags are filled in. The array is sorted.

References packed_rrset_data::count, lruhash_entry::data, dnskey_calc_keytag(), trust_anchor::dnskey_rrset, ds_get_keytag(), trust_anchor::ds_rrset, ub_packed_rrset_key::entry, keytag_compare(), trust_anchor::numDNSKEY, and trust_anchor::numDS.

Referenced by anchor_has_keytag(), chaos_trustanchor(), and generate_keytag_query().

## ◆ anchor_has_keytag()

int anchor_has_keytag | ( | struct val_anchors * | anchors,
|  | uint8_t * | name,
|  | int | namelabs,
|  | size_t | namelen,
|  | uint16_t | dclass,
|  | uint16_t | keytag )

Check if there is a trust anchor for given zone with this keytag.

Parameters

  anchors | anchor storage
  name | name of trust anchor (wireformat)
  namelabs | labels in name
  namelen | length of name
  dclass | class of trust anchor
  keytag | keytag

Returns
  1 if there is a trust anchor in the trustachor store for this zone and keytag, else 0.

References anchor_find(), anchor_list_keytags(), trust_anchor::dclass, trust_anchor::lock, trust_anchor::name, trust_anchor::namelabs, trust_anchor::namelen, trust_anchor::numDNSKEY, and trust_anchor::numDS.

Referenced by processFinished().

## ◆ anchors_find_any_noninsecure()

struct trust_anchor * anchors_find_any_noninsecure | ( | struct val_anchors * | anchors | ) |

Find an anchor that is not an insecure point, if any, or there are no DNSSEC verification anchors if none.

Parameters

  anchors | anchor storage

Returns
  trust anchor or NULL. It is locked.

References trust_anchor::lock, val_anchors::lock, trust_anchor::node, trust_anchor::numDNSKEY, trust_anchor::numDS, rbtree_first(), rbtree_next(), RBTREE_NULL, and val_anchors::tree.

Referenced by val_init().

## ◆ anchors_swap_tree()

void anchors_swap_tree | ( | struct val_anchors * | anchors,
|  | struct val_anchors * | data )

Swap internal tree with preallocated entries.

Parameters

  anchors | anchor storage.
  data | the data structure used to take elements from. This contains the old elements on return.

References val_anchors::autr, autr_global_data::probe, and val_anchors::tree.

Referenced by fr_reload_config().