ldns: Update vendor branch from 1.6.16 to 1.7.0
[dragonfly.git] / contrib / ldns / drill / chasetrace.c
1 /*
2  * chasetrace.c
3  * Where all the hard work concerning chasing
4  * and tracing is done
5  * (c) 2005, 2006 NLnet Labs
6  *
7  * See the file LICENSE for the license
8  *
9  */
10
11 #include "drill.h"
12 #include <ldns/ldns.h>
13
14 /* Cache all RRs from rr_list "rr_list" to "referrals" database for lookup
15  * later on.  Print the NS RRs that were not already present.
16  */
17 static void add_rr_list_to_referrals(
18     ldns_dnssec_zone *referrals, ldns_rr_list *rr_list)
19 {
20         size_t i;
21         ldns_rr *rr;
22         ldns_dnssec_rrsets *rrset;
23         ldns_dnssec_rrs *rrs;
24
25         for (i = 0; i < ldns_rr_list_rr_count(rr_list); i++) {
26                 rr = ldns_rr_list_rr(rr_list, i);
27                 /* Check if a RR equal to "rr" is present in "referrals" */
28                 rrset = ldns_dnssec_zone_find_rrset(
29                     referrals, ldns_rr_owner(rr), ldns_rr_get_type(rr));
30                 if (rrset) {
31                         for (rrs = rrset->rrs; rrs; rrs = rrs->next)
32                                 if (ldns_rr_compare(rr, rrs->rr) == 0)
33                                         break;
34                         if (rrs) continue; /* "rr" is present, next! */
35                 }
36                 if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_NS && verbosity != -1)
37                         ldns_rr_print(stdout, rr);
38                 (void) ldns_dnssec_zone_add_rr(referrals, rr);
39         }
40 }
41
42 /* Cache all RRs from packet "p" to "referrals" database for lookup later on.
43  * Print the NS RRs that were not already present.
44  */
45 static void add_referrals(ldns_dnssec_zone *referrals, ldns_pkt *p)
46 {
47         ldns_rr_list *l = ldns_pkt_all_noquestion(p);
48         if (l) {
49                 add_rr_list_to_referrals(referrals, l);
50                 ldns_rr_list_free(l);
51         }
52 }
53
54 /* Equip name-server "res" with the name-servers authoritative for as much
55  * of "name" as possible.  Lookup addresses if needed.
56  */
57 static bool set_nss_for_name(
58     ldns_resolver *res, ldns_dnssec_zone *referrals, ldns_rdf *name,
59     ldns_resolver *local_res, ldns_rr_class c)
60 {
61         ldns_dnssec_rrsets *nss = NULL;
62         ldns_dnssec_rrs *nss_rrs;
63         ldns_dnssec_rrsets *as = NULL;
64         ldns_dnssec_rrs *as_rrs;
65         ldns_rdf *lookup = ldns_rdf_clone(name);
66         ldns_rdf *new_lookup;
67         ldns_rdf *addr;
68         ldns_rr_list *addrs;
69
70         /* nss will become the rrset of as much of "name" as possible */
71         for (;;) {
72                 nss = ldns_dnssec_zone_find_rrset(
73                     referrals, lookup, LDNS_RR_TYPE_NS);
74                 if (nss != NULL) {
75                         ldns_rdf_deep_free(lookup);
76                         break;
77                 }
78                 new_lookup = ldns_dname_left_chop(lookup);
79                 ldns_rdf_deep_free(lookup);
80                 lookup = new_lookup;
81                 if (!lookup) {
82                         error("No referrals for name found");
83                         return false;
84                 }
85         }
86
87         /* remove the old nameserver from the resolver */
88         while ((addr = ldns_resolver_pop_nameserver(res)))
89                 ldns_rdf_deep_free(addr);
90
91         /* Find and add the address records for the rrset as name-servers */
92         for (nss_rrs = nss->rrs; nss_rrs; nss_rrs = nss_rrs->next) {
93
94                 if ((as = ldns_dnssec_zone_find_rrset(
95                     referrals, ldns_rr_rdf(nss_rrs->rr, 0), LDNS_RR_TYPE_A)))
96                         for (as_rrs = as->rrs; as_rrs; as_rrs = as_rrs->next)
97                                 (void) ldns_resolver_push_nameserver(
98                                     res, ldns_rr_rdf(as_rrs->rr, 0));
99
100                 if ((as = ldns_dnssec_zone_find_rrset(
101                     referrals, ldns_rr_rdf(nss_rrs->rr, 0), LDNS_RR_TYPE_AAAA)))
102                         for (as_rrs = as->rrs; as_rrs; as_rrs = as_rrs->next)
103                                 (void) ldns_resolver_push_nameserver(
104                                     res, ldns_rr_rdf(as_rrs->rr, 0));
105         }
106         /* Is our resolver equipped with name-servers? Good! We're done */
107         if (ldns_resolver_nameserver_count(res) > 0)
108                 return true;
109
110         /* Lookup addresses with local resolver add add to "referrals" database */
111         addrs = ldns_rr_list_new();
112         for (nss_rrs = nss->rrs; nss_rrs; nss_rrs = nss_rrs->next) {
113                 ldns_rr_list *addrs_by_name =
114                     ldns_get_rr_list_addr_by_name(
115                         local_res, ldns_rr_rdf(nss_rrs->rr, 0), c, 0);
116                 ldns_rr_list_cat(addrs, addrs_by_name);
117                 ldns_rr_list_free(addrs_by_name);
118         }
119
120         if (ldns_rr_list_rr_count(addrs) == 0)
121                 error("Could not find the nameserver ip addr; abort");
122
123         else if (ldns_resolver_push_nameserver_rr_list(res, addrs) !=
124             LDNS_STATUS_OK)
125
126                 error("Error adding new nameservers");
127         else {
128                 ldns_rr_list_deep_free(addrs);
129                 return true;
130         }
131         add_rr_list_to_referrals(referrals, addrs);
132         ldns_rr_list_deep_free(addrs);
133         return false;
134 }
135
136 /**
137  * trace down from the root to name
138  */
139
140 /* same naive method as in drill0.9 
141  * We resolve _ALL_ the names, which is of course not needed.
142  * We _do_ use the local resolver to do that, so it still is
143  * fast, but it can be made to run much faster.
144  */
145 void
146 do_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
147                 ldns_rr_class c)
148 {
149
150         static uint8_t zero[1] = { 0 };
151         static const ldns_rdf root_dname = { 1, LDNS_RDF_TYPE_DNAME, &zero };
152
153         ldns_resolver *res = NULL;
154         ldns_pkt *p = NULL;
155         ldns_rr_list *final_answer;
156         ldns_rr_list *new_nss;
157         ldns_rr_list *cname = NULL;
158         ldns_rr_list *answers = NULL;
159         uint16_t loop_count;
160         ldns_status status;
161         ldns_dnssec_zone* referrals = NULL;
162         ldns_rdf *addr;
163         
164         loop_count = 0;
165         final_answer = NULL;
166         res = ldns_resolver_new();
167
168         if (!res) {
169                 error("Memory allocation failed");
170                 goto cleanup;
171         }
172
173         /* transfer some properties of local_res to res,
174          * because they were given on the commandline */
175         ldns_resolver_set_ip6(res, 
176                         ldns_resolver_ip6(local_res));
177         ldns_resolver_set_port(res, 
178                         ldns_resolver_port(local_res));
179         ldns_resolver_set_debug(res, 
180                         ldns_resolver_debug(local_res));
181         ldns_resolver_set_dnssec(res, 
182                         ldns_resolver_dnssec(local_res));
183         ldns_resolver_set_fail(res, 
184                         ldns_resolver_fail(local_res));
185         ldns_resolver_set_usevc(res, 
186                         ldns_resolver_usevc(local_res));
187         ldns_resolver_set_random(res, 
188                         ldns_resolver_random(local_res));
189         ldns_resolver_set_source(res,
190                         ldns_resolver_source(local_res));
191         ldns_resolver_set_recursive(res, false);
192
193         /* setup the root nameserver in the new resolver */
194         status = ldns_resolver_push_nameserver_rr_list(res, global_dns_root);
195         if (status != LDNS_STATUS_OK) {
196                 fprintf(stderr, "Error adding root servers to resolver: %s\n", ldns_get_errorstr_by_id(status));
197                 ldns_rr_list_print(stdout, global_dns_root);
198                 goto cleanup;
199         }
200
201         /* this must be a real query to local_res */
202         status = ldns_resolver_send(&p, res, &root_dname, LDNS_RR_TYPE_NS, c, 0);
203         /* p can still be NULL */
204
205         if (ldns_pkt_empty(p)) {
206                 warning("No root server information received");
207         } 
208         
209         if (status == LDNS_STATUS_OK) {
210                 if (!ldns_pkt_empty(p)) {
211                         drill_pkt_print(stdout, local_res, p);
212                 }
213                 referrals = ldns_dnssec_zone_new();
214                 add_referrals(referrals, p);
215         } else {
216                 error("cannot use local resolver");
217                 goto cleanup;
218         }
219         if (! set_nss_for_name(res, referrals, name, local_res, c)) {
220                 goto cleanup;
221         }
222         ldns_pkt_free(p);
223         p = NULL;
224         status = ldns_resolver_send(&p, res, name, t, c, 0);
225         while(status == LDNS_STATUS_OK && 
226               ldns_pkt_reply_type(p) == LDNS_PACKET_REFERRAL) {
227
228                 if (!p) {
229                         /* some error occurred -- bail out */
230                         goto cleanup;
231                 }
232                 add_referrals(referrals, p);
233
234                 /* checks itself for verbosity */
235                 drill_pkt_print_footer(stdout, local_res, p);
236                 
237                 if (! set_nss_for_name(res, referrals, name, local_res, c)) {
238                         goto cleanup;
239                 }
240                 if (loop_count++ > 20) {
241                         /* unlikely that we are doing anything useful */
242                         error("Looks like we are looping");
243                         goto cleanup;
244                 }
245                 ldns_pkt_free(p);
246                 p = NULL;
247                 status = ldns_resolver_send(&p, res, name, t, c, 0);
248
249                 /* Exit trace on error */
250                 if (status != LDNS_STATUS_OK)
251                         break;
252
253                 /* An answer might be the desired answer (and no referral) */
254                 if (ldns_pkt_reply_type(p) != LDNS_PACKET_ANSWER)
255                         continue;
256
257                 /* Exit trace when the requested type is found */
258                 answers = ldns_pkt_rr_list_by_type(p, t, LDNS_SECTION_ANSWER);
259                 if (answers && ldns_rr_list_rr_count(answers) > 0) {
260                         ldns_rr_list_free(answers);
261                         answers = NULL;
262                         break;
263                 }
264                 ldns_rr_list_free(answers);
265                 answers = NULL;
266
267                 /* Get the CNAMEs from the answer */
268                 cname = ldns_pkt_rr_list_by_type(
269                     p, LDNS_RR_TYPE_CNAME, LDNS_SECTION_ANSWER);
270
271                 /* No CNAME either: exit trace */
272                 if (ldns_rr_list_rr_count(cname) == 0)
273                         break;
274
275                 /* Print CNAME referral */
276                 ldns_rr_list_print(stdout, cname);
277
278                 /* restart with the CNAME */
279                 name = ldns_rr_rdf(ldns_rr_list_rr(cname, 0), 0);
280                 ldns_rr_list_free(cname);
281                 cname = NULL;
282
283                 /* remove the old nameserver from the resolver */
284                 while((addr = ldns_resolver_pop_nameserver(res)))
285                         ldns_rdf_deep_free(addr);
286
287                 /* Restart trace from the root up */
288                 (void) ldns_resolver_push_nameserver_rr_list(
289                     res, global_dns_root);
290
291                 ldns_pkt_free(p);
292                 p = NULL;
293                 status = ldns_resolver_send(&p, res, name, t, c, 0);
294         }
295
296         ldns_pkt_free(p);
297         p = NULL;
298         status = ldns_resolver_send(&p, res, name, t, c, 0);
299         if (!p) {
300                 goto cleanup;
301         }
302         new_nss = ldns_pkt_authority(p);
303         final_answer = ldns_pkt_answer(p);
304
305         if (verbosity != -1) {
306                 ldns_rr_list_print(stdout, final_answer);
307                 ldns_rr_list_print(stdout, new_nss);
308
309         }
310         drill_pkt_print_footer(stdout, local_res, p);
311 cleanup:
312         if (res) {
313                 while((addr = ldns_resolver_pop_nameserver(res)))
314                         ldns_rdf_deep_free(addr);
315                 ldns_resolver_free(res);
316         }
317         if (referrals)
318                 ldns_dnssec_zone_deep_free(referrals);
319         if (p)
320                 ldns_pkt_free(p); 
321 }
322
323
324 /**
325  * Chase the given rr to a known and trusted key
326  *
327  * Based on drill 0.9
328  *
329  * the last argument prev_key_list, if not null, and type == DS, then the ds
330  * rr list we have must all be a ds for the keys in this list
331  */
332 #ifdef HAVE_SSL
333 ldns_status
334 do_chase(ldns_resolver *res,
335             ldns_rdf *name,
336             ldns_rr_type type,
337             ldns_rr_class c,
338             ldns_rr_list *trusted_keys,
339             ldns_pkt *pkt_o,
340             uint16_t qflags,
341             ldns_rr_list * ATTR_UNUSED(prev_key_list))
342 {
343         ldns_rr_list *rrset = NULL;
344         ldns_status result;
345         ldns_rr *orig_rr = NULL;
346         
347 /*
348         ldns_rr_list *sigs;
349         ldns_rr *cur_sig;
350         uint16_t sig_i;
351         ldns_rr_list *keys;
352 */
353         ldns_pkt *pkt;
354         ldns_status tree_result;
355         ldns_dnssec_data_chain *chain;
356         ldns_dnssec_trust_tree *tree;
357         
358         const ldns_rr_descriptor *descriptor;
359         descriptor = ldns_rr_descript(type);
360
361         ldns_dname2canonical(name);
362         
363         pkt = ldns_pkt_clone(pkt_o);
364         if (!name) {
365                 mesg("No name to chase");
366                 ldns_pkt_free(pkt);
367                 return LDNS_STATUS_EMPTY_LABEL;
368         }
369         if (verbosity != -1) {
370                 printf(";; Chasing: ");
371                         ldns_rdf_print(stdout, name);
372                         if (descriptor && descriptor->_name) {
373                                 printf(" %s\n", descriptor->_name);
374                         } else {
375                                 printf(" type %d\n", type);
376                         }
377         }
378
379         if (!trusted_keys || ldns_rr_list_rr_count(trusted_keys) < 1) {
380                 warning("No trusted keys specified");
381         }
382         
383         if (pkt) {
384                 rrset = ldns_pkt_rr_list_by_name_and_type(pkt,
385                                 name,
386                                 type,
387                                 LDNS_SECTION_ANSWER
388                                 );
389                 if (!rrset) {
390                         /* nothing in answer, try authority */
391                         rrset = ldns_pkt_rr_list_by_name_and_type(pkt,
392                                         name,
393                                         type,
394                                         LDNS_SECTION_AUTHORITY
395                                         );
396                 }
397                 /* answer might be a cname, chase that first, then chase
398                    cname target? (TODO) */
399                 if (!rrset) {
400                         rrset = ldns_pkt_rr_list_by_name_and_type(pkt,
401                                         name,
402                                         LDNS_RR_TYPE_CNAME,
403                                         LDNS_SECTION_ANSWER
404                                         );
405                         if (!rrset) {
406                                 /* nothing in answer, try authority */
407                                 rrset = ldns_pkt_rr_list_by_name_and_type(pkt,
408                                                 name,
409                                                 LDNS_RR_TYPE_CNAME,
410                                                 LDNS_SECTION_AUTHORITY
411                                                 );
412                         }
413                 }
414         } else {
415                 /* no packet? */
416                 if (verbosity >= 0) {
417                         fprintf(stderr, "%s", ldns_get_errorstr_by_id(LDNS_STATUS_MEM_ERR));
418                         fprintf(stderr, "\n");
419                 }
420                 return LDNS_STATUS_MEM_ERR;
421         }
422         
423         if (!rrset) {
424                 /* not found in original packet, try again */
425                 ldns_pkt_free(pkt);
426                 pkt = NULL;
427                 pkt = ldns_resolver_query(res, name, type, c, qflags);
428                 
429                 if (!pkt) {
430                         if (verbosity >= 0) {
431                                 fprintf(stderr, "%s", ldns_get_errorstr_by_id(LDNS_STATUS_NETWORK_ERR));
432                                 fprintf(stderr, "\n");
433                         }
434                         return LDNS_STATUS_NETWORK_ERR;
435                 }
436                 if (verbosity >= 5) {
437                         ldns_pkt_print(stdout, pkt);
438                 }
439                 
440                 rrset = ldns_pkt_rr_list_by_name_and_type(pkt,
441                                 name,
442                                 type,
443                                 LDNS_SECTION_ANSWER
444                                 );
445         }
446         
447         orig_rr = ldns_rr_new();
448
449 /* if the answer had no answer section, we need to construct our own rr (for instance if
450  * the rr qe asked for doesn't exist. This rr will be destroyed when the chain is freed */
451         if (ldns_pkt_ancount(pkt) < 1) {
452                 ldns_rr_set_type(orig_rr, type);
453                 ldns_rr_set_owner(orig_rr, ldns_rdf_clone(name));
454         
455                 chain = ldns_dnssec_build_data_chain(res, qflags, rrset, pkt, ldns_rr_clone(orig_rr));
456         } else {
457                 /* chase the first answer */
458                 chain = ldns_dnssec_build_data_chain(res, qflags, rrset, pkt, NULL);
459         }
460
461         if (verbosity >= 4) {
462                 printf("\n\nDNSSEC Data Chain:\n");
463                 ldns_dnssec_data_chain_print(stdout, chain);
464         }
465         
466         result = LDNS_STATUS_OK;
467
468         tree = ldns_dnssec_derive_trust_tree(chain, NULL);
469
470         if (verbosity >= 2) {
471                 printf("\n\nDNSSEC Trust tree:\n");
472                 ldns_dnssec_trust_tree_print(stdout, tree, 0, true);
473         }
474
475         if (ldns_rr_list_rr_count(trusted_keys) > 0) {
476                 tree_result = ldns_dnssec_trust_tree_contains_keys(tree, trusted_keys);
477
478                 if (tree_result == LDNS_STATUS_DNSSEC_EXISTENCE_DENIED) {
479                         if (verbosity >= 1) {
480                                 printf("Existence denied or verifiably insecure\n");
481                         }
482                         result = LDNS_STATUS_OK;
483                 } else if (tree_result != LDNS_STATUS_OK) {
484                         if (verbosity >= 1) {
485                                 printf("No trusted keys found in tree: first error was: %s\n", ldns_get_errorstr_by_id(tree_result));
486                         }
487                         result = tree_result;
488                 }
489
490         } else {
491                 if (verbosity >= 0) {
492                         printf("You have not provided any trusted keys.\n");
493                 }
494         }
495         
496         ldns_rr_free(orig_rr);
497         ldns_dnssec_trust_tree_free(tree);
498         ldns_dnssec_data_chain_deep_free(chain);
499         
500         ldns_rr_list_deep_free(rrset);
501         ldns_pkt_free(pkt);
502         /*      ldns_rr_free(orig_rr);*/
503
504         return result;
505 }
506 #endif /* HAVE_SSL */
507