contrib/bind-9.3/bin/named/query.c

   1 /*
   2  * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
   3  * Copyright (C) 1999-2003  Internet Software Consortium.
   4  *
   5  * Permission to use, copy, modify, and distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  10  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  11  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  12  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  13  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  14  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  15  * PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 /* $Id: query.c,v 1.198.2.13.4.43 2006/08/31 03:57:11 marka Exp $ */
  19
  20 #include <config.h>
  21
  22 #include <string.h>
  23
  24 #include <isc/mem.h>
  25 #include <isc/util.h>
  26
  27 #include <dns/adb.h>
  28 #include <dns/byaddr.h>
  29 #include <dns/db.h>
  30 #include <dns/events.h>
  31 #include <dns/message.h>
  32 #include <dns/order.h>
  33 #include <dns/rdata.h>
  34 #include <dns/rdataclass.h>
  35 #include <dns/rdatalist.h>
  36 #include <dns/rdataset.h>
  37 #include <dns/rdatasetiter.h>
  38 #include <dns/rdatastruct.h>
  39 #include <dns/rdatatype.h>
  40 #include <dns/resolver.h>
  41 #include <dns/result.h>
  42 #include <dns/stats.h>
  43 #include <dns/tkey.h>
  44 #include <dns/view.h>
  45 #include <dns/zone.h>
  46 #include <dns/zt.h>
  47
  48 #include <named/client.h>
  49 #include <named/log.h>
  50 #include <named/server.h>
  51 #include <named/sortlist.h>
  52 #include <named/xfrout.h>
  53
  54 #define PARTIALANSWER(c)        (((c)->query.attributes & \
  55                                   NS_QUERYATTR_PARTIALANSWER) != 0)
  56 #define USECACHE(c)             (((c)->query.attributes & \
  57                                   NS_QUERYATTR_CACHEOK) != 0)
  58 #define RECURSIONOK(c)          (((c)->query.attributes & \
  59                                   NS_QUERYATTR_RECURSIONOK) != 0)
  60 #define RECURSING(c)            (((c)->query.attributes & \
  61                                   NS_QUERYATTR_RECURSING) != 0)
  62 #define CACHEGLUEOK(c)          (((c)->query.attributes & \
  63                                   NS_QUERYATTR_CACHEGLUEOK) != 0)
  64 #define WANTRECURSION(c)        (((c)->query.attributes & \
  65                                   NS_QUERYATTR_WANTRECURSION) != 0)
  66 #define WANTDNSSEC(c)           (((c)->attributes & \
  67                                   NS_CLIENTATTR_WANTDNSSEC) != 0)
  68 #define NOAUTHORITY(c)          (((c)->query.attributes & \
  69                                   NS_QUERYATTR_NOAUTHORITY) != 0)
  70 #define NOADDITIONAL(c)         (((c)->query.attributes & \
  71                                   NS_QUERYATTR_NOADDITIONAL) != 0)
  72 #define SECURE(c)               (((c)->query.attributes & \
  73                                   NS_QUERYATTR_SECURE) != 0)
  74
  75 #if 0
  76 #define CTRACE(m)       isc_log_write(ns_g_lctx, \
  77                                       NS_LOGCATEGORY_CLIENT, \
  78                                       NS_LOGMODULE_QUERY, \
  79                                       ISC_LOG_DEBUG(3), \
  80                                       "client %p: %s", client, (m))
  81 #define QTRACE(m)       isc_log_write(ns_g_lctx, \
  82                                       NS_LOGCATEGORY_GENERAL, \
  83                                       NS_LOGMODULE_QUERY, \
  84                                       ISC_LOG_DEBUG(3), \
  85                                       "query %p: %s", query, (m))
  86 #else
  87 #define CTRACE(m) ((void)m)
  88 #define QTRACE(m) ((void)m)
  89 #endif
  90
  91 #define DNS_GETDB_NOEXACT 0x01U
  92 #define DNS_GETDB_NOLOG 0x02U
  93 #define DNS_GETDB_PARTIAL 0x04U
  94
  95 static void
  96 query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype);
  97
  98 /*
  99  * Increment query statistics counters.
 100  */
 101 static inline void
 102 inc_stats(ns_client_t *client, dns_statscounter_t counter) {
 103         dns_zone_t *zone = client->query.authzone;
 104
 105         REQUIRE(counter < DNS_STATS_NCOUNTERS);
 106
 107         ns_g_server->querystats[counter]++;
 108
 109         if (zone != NULL) {
 110                 isc_uint64_t *zonestats = dns_zone_getstatscounters(zone);
 111                 if (zonestats != NULL)
 112                         zonestats[counter]++;
 113         }
 114 }
 115
 116 static void
 117 query_send(ns_client_t *client) {
 118         dns_statscounter_t counter;
 119         if (client->message->rcode == dns_rcode_noerror) {
 120                 if (ISC_LIST_EMPTY(client->message->sections[DNS_SECTION_ANSWER])) {
 121                         if (client->query.isreferral) {
 122                                 counter = dns_statscounter_referral;
 123                         } else {
 124                                 counter = dns_statscounter_nxrrset;
 125                         }
 126                 } else {
 127                         counter = dns_statscounter_success;
 128                 }
 129         } else if (client->message->rcode == dns_rcode_nxdomain) {
 130                 counter = dns_statscounter_nxdomain;
 131         } else {
 132                 /* We end up here in case of YXDOMAIN, and maybe others */
 133                 counter = dns_statscounter_failure;
 134         }
 135         inc_stats(client, counter);
 136         ns_client_send(client);
 137 }
 138
 139 static void
 140 query_error(ns_client_t *client, isc_result_t result) {
 141         inc_stats(client, dns_statscounter_failure);
 142         ns_client_error(client, result);
 143 }
 144
 145 static void
 146 query_next(ns_client_t *client, isc_result_t result) {
 147         inc_stats(client, dns_statscounter_failure);
 148         ns_client_next(client, result);
 149 }
 150
 151 static inline void
 152 query_freefreeversions(ns_client_t *client, isc_boolean_t everything) {
 153         ns_dbversion_t *dbversion, *dbversion_next;
 154         unsigned int i;
 155
 156         for (dbversion = ISC_LIST_HEAD(client->query.freeversions), i = 0;
 157              dbversion != NULL;
 158              dbversion = dbversion_next, i++)
 159         {
 160                 dbversion_next = ISC_LIST_NEXT(dbversion, link);
 161                 /*
 162                  * If we're not freeing everything, we keep the first three
 163                  * dbversions structures around.
 164                  */
 165                 if (i > 3 || everything) {
 166                         ISC_LIST_UNLINK(client->query.freeversions, dbversion,
 167                                         link);
 168                         isc_mem_put(client->mctx, dbversion,
 169                                     sizeof(*dbversion));
 170                 }
 171         }
 172 }
 173
 174 void
 175 ns_query_cancel(ns_client_t *client) {
 176         LOCK(&client->query.fetchlock);
 177         if (client->query.fetch != NULL) {
 178                 dns_resolver_cancelfetch(client->query.fetch);
 179
 180                 client->query.fetch = NULL;
 181         }
 182         UNLOCK(&client->query.fetchlock);
 183 }
 184
 185 static inline void
 186 query_reset(ns_client_t *client, isc_boolean_t everything) {
 187         isc_buffer_t *dbuf, *dbuf_next;
 188         ns_dbversion_t *dbversion, *dbversion_next;
 189
 190         /*
 191          * Reset the query state of a client to its default state.
 192          */
 193
 194         /*
 195          * Cancel the fetch if it's running.
 196          */
 197         ns_query_cancel(client);
 198
 199         /*
 200          * Cleanup any active versions.
 201          */
 202         for (dbversion = ISC_LIST_HEAD(client->query.activeversions);
 203              dbversion != NULL;
 204              dbversion = dbversion_next) {
 205                 dbversion_next = ISC_LIST_NEXT(dbversion, link);
 206                 dns_db_closeversion(dbversion->db, &dbversion->version,
 207                                     ISC_FALSE);
 208                 dns_db_detach(&dbversion->db);
 209                 ISC_LIST_INITANDAPPEND(client->query.freeversions,
 210                                       dbversion, link);
 211         }
 212         ISC_LIST_INIT(client->query.activeversions);
 213
 214         if (client->query.authdb != NULL)
 215                 dns_db_detach(&client->query.authdb);
 216         if (client->query.authzone != NULL)
 217                 dns_zone_detach(&client->query.authzone);
 218
 219         query_freefreeversions(client, everything);
 220
 221         for (dbuf = ISC_LIST_HEAD(client->query.namebufs);
 222              dbuf != NULL;
 223              dbuf = dbuf_next) {
 224                 dbuf_next = ISC_LIST_NEXT(dbuf, link);
 225                 if (dbuf_next != NULL || everything) {
 226                         ISC_LIST_UNLINK(client->query.namebufs, dbuf, link);
 227                         isc_buffer_free(&dbuf);
 228                 }
 229         }
 230
 231         if (client->query.restarts > 0) {
 232                 /*
 233                  * client->query.qname was dynamically allocated.
 234                  */
 235                 dns_message_puttempname(client->message,
 236                                         &client->query.qname);
 237         }
 238         client->query.qname = NULL;
 239         client->query.attributes = (NS_QUERYATTR_RECURSIONOK |
 240                                     NS_QUERYATTR_CACHEOK |
 241                                     NS_QUERYATTR_SECURE);
 242         client->query.restarts = 0;
 243         client->query.timerset = ISC_FALSE;
 244         client->query.origqname = NULL;
 245         client->query.qname = NULL;
 246         client->query.dboptions = 0;
 247         client->query.fetchoptions = 0;
 248         client->query.gluedb = NULL;
 249         client->query.authdbset = ISC_FALSE;
 250         client->query.isreferral = ISC_FALSE;
 251 }
 252
 253 static void
 254 query_next_callback(ns_client_t *client) {
 255         query_reset(client, ISC_FALSE);
 256 }
 257
 258 void
 259 ns_query_free(ns_client_t *client) {
 260         query_reset(client, ISC_TRUE);
 261 }
 262
 263 static inline isc_result_t
 264 query_newnamebuf(ns_client_t *client) {
 265         isc_buffer_t *dbuf;
 266         isc_result_t result;
 267
 268         CTRACE("query_newnamebuf");
 269         /*
 270          * Allocate a name buffer.
 271          */
 272
 273         dbuf = NULL;
 274         result = isc_buffer_allocate(client->mctx, &dbuf, 1024);
 275         if (result != ISC_R_SUCCESS) {
 276                 CTRACE("query_newnamebuf: isc_buffer_allocate failed: done");
 277                 return (result);
 278         }
 279         ISC_LIST_APPEND(client->query.namebufs, dbuf, link);
 280
 281         CTRACE("query_newnamebuf: done");
 282         return (ISC_R_SUCCESS);
 283 }
 284
 285 static inline isc_buffer_t *
 286 query_getnamebuf(ns_client_t *client) {
 287         isc_buffer_t *dbuf;
 288         isc_result_t result;
 289         isc_region_t r;
 290
 291         CTRACE("query_getnamebuf");
 292         /*
 293          * Return a name buffer with space for a maximal name, allocating
 294          * a new one if necessary.
 295          */
 296
 297         if (ISC_LIST_EMPTY(client->query.namebufs)) {
 298                 result = query_newnamebuf(client);
 299                 if (result != ISC_R_SUCCESS) {
 300                     CTRACE("query_getnamebuf: query_newnamebuf failed: done");
 301                         return (NULL);
 302                 }
 303         }
 304
 305         dbuf = ISC_LIST_TAIL(client->query.namebufs);
 306         INSIST(dbuf != NULL);
 307         isc_buffer_availableregion(dbuf, &r);
 308         if (r.length < 255) {
 309                 result = query_newnamebuf(client);
 310                 if (result != ISC_R_SUCCESS) {
 311                     CTRACE("query_getnamebuf: query_newnamebuf failed: done");
 312                         return (NULL);
 313
 314                 }
 315                 dbuf = ISC_LIST_TAIL(client->query.namebufs);
 316                 isc_buffer_availableregion(dbuf, &r);
 317                 INSIST(r.length >= 255);
 318         }
 319         CTRACE("query_getnamebuf: done");
 320         return (dbuf);
 321 }
 322
 323 static inline void
 324 query_keepname(ns_client_t *client, dns_name_t *name, isc_buffer_t *dbuf) {
 325         isc_region_t r;
 326
 327         CTRACE("query_keepname");
 328         /*
 329          * 'name' is using space in 'dbuf', but 'dbuf' has not yet been
 330          * adjusted to take account of that.  We do the adjustment.
 331          */
 332
 333         REQUIRE((client->query.attributes & NS_QUERYATTR_NAMEBUFUSED) != 0);
 334
 335         dns_name_toregion(name, &r);
 336         isc_buffer_add(dbuf, r.length);
 337         dns_name_setbuffer(name, NULL);
 338         client->query.attributes &= ~NS_QUERYATTR_NAMEBUFUSED;
 339 }
 340
 341 static inline void
 342 query_releasename(ns_client_t *client, dns_name_t **namep) {
 343         dns_name_t *name = *namep;
 344
 345         /*
 346          * 'name' is no longer needed.  Return it to our pool of temporary
 347          * names.  If it is using a name buffer, relinquish its exclusive
 348          * rights on the buffer.
 349          */
 350
 351         CTRACE("query_releasename");
 352         if (dns_name_hasbuffer(name)) {
 353                 INSIST((client->query.attributes & NS_QUERYATTR_NAMEBUFUSED)
 354                        != 0);
 355                 client->query.attributes &= ~NS_QUERYATTR_NAMEBUFUSED;
 356         }
 357         dns_message_puttempname(client->message, namep);
 358         CTRACE("query_releasename: done");
 359 }
 360
 361 static inline dns_name_t *
 362 query_newname(ns_client_t *client, isc_buffer_t *dbuf,
 363               isc_buffer_t *nbuf)
 364 {
 365         dns_name_t *name;
 366         isc_region_t r;
 367         isc_result_t result;
 368
 369         REQUIRE((client->query.attributes & NS_QUERYATTR_NAMEBUFUSED) == 0);
 370
 371         CTRACE("query_newname");
 372         name = NULL;
 373         result = dns_message_gettempname(client->message, &name);
 374         if (result != ISC_R_SUCCESS) {
 375                 CTRACE("query_newname: dns_message_gettempname failed: done");
 376                 return (NULL);
 377         }
 378         isc_buffer_availableregion(dbuf, &r);
 379         isc_buffer_init(nbuf, r.base, r.length);
 380         dns_name_init(name, NULL);
 381         dns_name_setbuffer(name, nbuf);
 382         client->query.attributes |= NS_QUERYATTR_NAMEBUFUSED;
 383
 384         CTRACE("query_newname: done");
 385         return (name);
 386 }
 387
 388 static inline dns_rdataset_t *
 389 query_newrdataset(ns_client_t *client) {
 390         dns_rdataset_t *rdataset;
 391         isc_result_t result;
 392
 393         CTRACE("query_newrdataset");
 394         rdataset = NULL;
 395         result = dns_message_gettemprdataset(client->message, &rdataset);
 396         if (result != ISC_R_SUCCESS) {
 397           CTRACE("query_newrdataset: "
 398                  "dns_message_gettemprdataset failed: done");
 399                 return (NULL);
 400         }
 401         dns_rdataset_init(rdataset);
 402
 403         CTRACE("query_newrdataset: done");
 404         return (rdataset);
 405 }
 406
 407 static inline void
 408 query_putrdataset(ns_client_t *client, dns_rdataset_t **rdatasetp) {
 409         dns_rdataset_t *rdataset = *rdatasetp;
 410
 411         CTRACE("query_putrdataset");
 412         if (rdataset != NULL) {
 413                 if (dns_rdataset_isassociated(rdataset))
 414                         dns_rdataset_disassociate(rdataset);
 415                 dns_message_puttemprdataset(client->message, rdatasetp);
 416         }
 417         CTRACE("query_putrdataset: done");
 418 }
 419
 420
 421 static inline isc_result_t
 422 query_newdbversion(ns_client_t *client, unsigned int n) {
 423         unsigned int i;
 424         ns_dbversion_t *dbversion;
 425
 426         for (i = 0; i < n; i++) {
 427                 dbversion = isc_mem_get(client->mctx, sizeof(*dbversion));
 428                 if (dbversion != NULL) {
 429                         dbversion->db = NULL;
 430                         dbversion->version = NULL;
 431                         ISC_LIST_INITANDAPPEND(client->query.freeversions,
 432                                               dbversion, link);
 433                 } else {
 434                         /*
 435                          * We only return ISC_R_NOMEMORY if we couldn't
 436                          * allocate anything.
 437                          */
 438                         if (i == 0)
 439                                 return (ISC_R_NOMEMORY);
 440                         else
 441                                 return (ISC_R_SUCCESS);
 442                 }
 443         }
 444
 445         return (ISC_R_SUCCESS);
 446 }
 447
 448 static inline ns_dbversion_t *
 449 query_getdbversion(ns_client_t *client) {
 450         isc_result_t result;
 451         ns_dbversion_t *dbversion;
 452
 453         if (ISC_LIST_EMPTY(client->query.freeversions)) {
 454                 result = query_newdbversion(client, 1);
 455                 if (result != ISC_R_SUCCESS)
 456                         return (NULL);
 457         }
 458         dbversion = ISC_LIST_HEAD(client->query.freeversions);
 459         INSIST(dbversion != NULL);
 460         ISC_LIST_UNLINK(client->query.freeversions, dbversion, link);
 461
 462         return (dbversion);
 463 }
 464
 465 isc_result_t
 466 ns_query_init(ns_client_t *client) {
 467         isc_result_t result;
 468
 469         ISC_LIST_INIT(client->query.namebufs);
 470         ISC_LIST_INIT(client->query.activeversions);
 471         ISC_LIST_INIT(client->query.freeversions);
 472         client->query.restarts = 0;
 473         client->query.timerset = ISC_FALSE;
 474         client->query.qname = NULL;
 475         result = isc_mutex_init(&client->query.fetchlock);
 476         if (result != ISC_R_SUCCESS)
 477                 return (result);
 478         client->query.fetch = NULL;
 479         client->query.authdb = NULL;
 480         client->query.authzone = NULL;
 481         client->query.authdbset = ISC_FALSE;
 482         client->query.isreferral = ISC_FALSE;
 483         query_reset(client, ISC_FALSE);
 484         result = query_newdbversion(client, 3);
 485         if (result != ISC_R_SUCCESS) {
 486                 DESTROYLOCK(&client->query.fetchlock);
 487                 return (result);
 488         }
 489         result = query_newnamebuf(client);
 490         if (result != ISC_R_SUCCESS)
 491                 query_freefreeversions(client, ISC_TRUE);
 492
 493         return (result);
 494 }
 495
 496 static inline ns_dbversion_t *
 497 query_findversion(ns_client_t *client, dns_db_t *db,
 498                   isc_boolean_t *newzonep)
 499 {
 500         ns_dbversion_t *dbversion;
 501
 502         /*
 503          * We may already have done a query related to this
 504          * database.  If so, we must be sure to make subsequent
 505          * queries from the same version.
 506          */
 507         for (dbversion = ISC_LIST_HEAD(client->query.activeversions);
 508              dbversion != NULL;
 509              dbversion = ISC_LIST_NEXT(dbversion, link)) {
 510                 if (dbversion->db == db)
 511                         break;
 512         }
 513
 514         if (dbversion == NULL) {
 515                 /*
 516                  * This is a new zone for this query.  Add it to
 517                  * the active list.
 518                  */
 519                 dbversion = query_getdbversion(client);
 520                 if (dbversion == NULL)
 521                         return (NULL);
 522                 dns_db_attach(db, &dbversion->db);
 523                 dns_db_currentversion(db, &dbversion->version);
 524                 dbversion->queryok = ISC_FALSE;
 525                 ISC_LIST_APPEND(client->query.activeversions,
 526                                 dbversion, link);
 527                 *newzonep = ISC_TRUE;
 528         } else
 529                 *newzonep = ISC_FALSE;
 530
 531         return (dbversion);
 532 }
 533
 534 static inline isc_result_t
 535 query_getzonedb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
 536                 unsigned int options, dns_zone_t **zonep, dns_db_t **dbp,
 537                 dns_dbversion_t **versionp)
 538 {
 539         isc_result_t result;
 540         isc_boolean_t check_acl, new_zone;
 541         dns_acl_t *queryacl;
 542         ns_dbversion_t *dbversion;
 543         unsigned int ztoptions;
 544         dns_zone_t *zone = NULL;
 545         dns_db_t *db = NULL;
 546         isc_boolean_t partial = ISC_FALSE;
 547
 548         REQUIRE(zonep != NULL && *zonep == NULL);
 549         REQUIRE(dbp != NULL && *dbp == NULL);
 550
 551         /*
 552          * Find a zone database to answer the query.
 553          */
 554         ztoptions = ((options & DNS_GETDB_NOEXACT) != 0) ?
 555                 DNS_ZTFIND_NOEXACT : 0;
 556
 557         result = dns_zt_find(client->view->zonetable, name, ztoptions, NULL,
 558                              &zone);
 559         if (result == DNS_R_PARTIALMATCH)
 560                 partial = ISC_TRUE;
 561         if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH)
 562                 result = dns_zone_getdb(zone, &db);
 563
 564         if (result != ISC_R_SUCCESS)
 565                 goto fail;
 566
 567         /*
 568          * This limits our searching to the zone where the first name
 569          * (the query target) was looked for.  This prevents following
 570          * CNAMES or DNAMES into other zones and prevents returning
 571          * additional data from other zones.
 572          */
 573         if (!client->view->additionalfromauth &&
 574             client->query.authdbset &&
 575             db != client->query.authdb)
 576                 goto refuse;
 577
 578         /*
 579          * If the zone has an ACL, we'll check it, otherwise
 580          * we use the view's "allow-query" ACL.  Each ACL is only checked
 581          * once per query.
 582          *
 583          * Also, get the database version to use.
 584          */
 585
 586         check_acl = ISC_TRUE;   /* Keep compiler happy. */
 587         queryacl = NULL;
 588
 589         /*
 590          * Get the current version of this database.
 591          */
 592         dbversion = query_findversion(client, db, &new_zone);
 593         if (dbversion == NULL) {
 594                 result = DNS_R_SERVFAIL;
 595                 goto fail;
 596         }
 597         if (new_zone) {
 598                 check_acl = ISC_TRUE;
 599         } else if (!dbversion->queryok) {
 600                 goto refuse;
 601         } else {
 602                 check_acl = ISC_FALSE;
 603         }
 604
 605         queryacl = dns_zone_getqueryacl(zone);
 606         if (queryacl == NULL) {
 607                 queryacl = client->view->queryacl;
 608                 if ((client->query.attributes &
 609                      NS_QUERYATTR_QUERYOKVALID) != 0) {
 610                         /*
 611                          * We've evaluated the view's queryacl already.  If
 612                          * NS_QUERYATTR_QUERYOK is set, then the client is
 613                          * allowed to make queries, otherwise the query should
 614                          * be refused.
 615                          */
 616                         check_acl = ISC_FALSE;
 617                         if ((client->query.attributes &
 618                              NS_QUERYATTR_QUERYOK) == 0)
 619                                 goto refuse;
 620                 } else {
 621                         /*
 622                          * We haven't evaluated the view's queryacl yet.
 623                          */
 624                         check_acl = ISC_TRUE;
 625                 }
 626         }
 627
 628         if (check_acl) {
 629                 isc_boolean_t log = ISC_TF((options & DNS_GETDB_NOLOG) == 0);
 630
 631                 result = ns_client_checkaclsilent(client, queryacl, ISC_TRUE);
 632                 if (log) {
 633                         char msg[NS_CLIENT_ACLMSGSIZE("query")];
 634                         if (result == ISC_R_SUCCESS) {
 635                                 if (isc_log_wouldlog(ns_g_lctx,
 636                                                      ISC_LOG_DEBUG(3)))
 637                                 {
 638                                         ns_client_aclmsg("query", name, qtype,
 639                                                          client->view->rdclass,
 640                                                          msg, sizeof(msg));
 641                                         ns_client_log(client,
 642                                                       DNS_LOGCATEGORY_SECURITY,
 643                                                       NS_LOGMODULE_QUERY,
 644                                                       ISC_LOG_DEBUG(3),
 645                                                       "%s approved", msg);
 646                                 }
 647                         } else {
 648                                 ns_client_aclmsg("query", name, qtype,
 649                                                  client->view->rdclass,
 650                                                  msg, sizeof(msg));
 651                                 ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 652                                               NS_LOGMODULE_QUERY, ISC_LOG_INFO,
 653                                               "%s denied", msg);
 654                         }
 655                 }
 656
 657                 if (queryacl == client->view->queryacl) {
 658                         if (result == ISC_R_SUCCESS) {
 659                                 /*
 660                                  * We were allowed by the default
 661                                  * "allow-query" ACL.  Remember this so we
 662                                  * don't have to check again.
 663                                  */
 664                                 client->query.attributes |=
 665                                         NS_QUERYATTR_QUERYOK;
 666                         }
 667                         /*
 668                          * We've now evaluated the view's query ACL, and
 669                          * the NS_QUERYATTR_QUERYOK attribute is now valid.
 670                          */
 671                         client->query.attributes |= NS_QUERYATTR_QUERYOKVALID;
 672                 }
 673
 674                 if (result != ISC_R_SUCCESS)
 675                         goto refuse;
 676         }
 677
 678         /* Approved. */
 679
 680         /*
 681          * Remember the result of the ACL check so we
 682          * don't have to check again.
 683          */
 684         dbversion->queryok = ISC_TRUE;
 685
 686         /* Transfer ownership. */
 687         *zonep = zone;
 688         *dbp = db;
 689         *versionp = dbversion->version;
 690
 691         if (partial && (options & DNS_GETDB_PARTIAL) != 0)
 692                 return (DNS_R_PARTIALMATCH);
 693         return (ISC_R_SUCCESS);
 694
 695  refuse:
 696         result = DNS_R_REFUSED;
 697  fail:
 698         if (zone != NULL)
 699                 dns_zone_detach(&zone);
 700         if (db != NULL)
 701                 dns_db_detach(&db);
 702
 703         return (result);
 704 }
 705
 706 static inline isc_result_t
 707 query_getcachedb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
 708                  dns_db_t **dbp, unsigned int options)
 709 {
 710         isc_result_t result;
 711         isc_boolean_t check_acl;
 712         dns_db_t *db = NULL;
 713
 714         REQUIRE(dbp != NULL && *dbp == NULL);
 715
 716         /*
 717          * Find a cache database to answer the query.
 718          * This may fail with DNS_R_REFUSED if the client
 719          * is not allowed to use the cache.
 720          */
 721
 722         if (!USECACHE(client))
 723                 return (DNS_R_REFUSED);
 724         dns_db_attach(client->view->cachedb, &db);
 725
 726         if ((client->query.attributes &
 727              NS_QUERYATTR_QUERYOKVALID) != 0) {
 728                 /*
 729                  * We've evaluated the view's queryacl already.  If
 730                  * NS_QUERYATTR_QUERYOK is set, then the client is
 731                  * allowed to make queries, otherwise the query should
 732                  * be refused.
 733                  */
 734                 check_acl = ISC_FALSE;
 735                 if ((client->query.attributes &
 736                      NS_QUERYATTR_QUERYOK) == 0)
 737                         goto refuse;
 738         } else {
 739                 /*
 740                  * We haven't evaluated the view's queryacl yet.
 741                  */
 742                 check_acl = ISC_TRUE;
 743         }
 744
 745         if (check_acl) {
 746                 isc_boolean_t log = ISC_TF((options & DNS_GETDB_NOLOG) == 0);
 747                 char msg[NS_CLIENT_ACLMSGSIZE("query (cache)")];
 748
 749                 result = ns_client_checkaclsilent(client,
 750                                                   client->view->queryacl,
 751                                                   ISC_TRUE);
 752                 if (result == ISC_R_SUCCESS) {
 753                         /*
 754                          * We were allowed by the default
 755                          * "allow-query" ACL.  Remember this so we
 756                          * don't have to check again.
 757                          */
 758                         client->query.attributes |=
 759                                 NS_QUERYATTR_QUERYOK;
 760                         if (log && isc_log_wouldlog(ns_g_lctx,
 761                                                      ISC_LOG_DEBUG(3)))
 762                         {
 763                                 ns_client_aclmsg("query (cache)", name, qtype,
 764                                                  client->view->rdclass,
 765                                                  msg, sizeof(msg));
 766                                 ns_client_log(client,
 767                                               DNS_LOGCATEGORY_SECURITY,
 768                                               NS_LOGMODULE_QUERY,
 769                                               ISC_LOG_DEBUG(3),
 770                                               "%s approved", msg);
 771                         }
 772                 } else if (log) {
 773                         ns_client_aclmsg("query (cache)", name, qtype,
 774                                          client->view->rdclass, msg,
 775                                          sizeof(msg));
 776                         ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 777                                       NS_LOGMODULE_QUERY, ISC_LOG_INFO,
 778                                       "%s denied", msg);
 779                 }
 780                 /*
 781                  * We've now evaluated the view's query ACL, and
 782                  * the NS_QUERYATTR_QUERYOK attribute is now valid.
 783                  */
 784                 client->query.attributes |= NS_QUERYATTR_QUERYOKVALID;
 785
 786                 if (result != ISC_R_SUCCESS)
 787                         goto refuse;
 788         }
 789
 790         /* Approved. */
 791
 792         /* Transfer ownership. */
 793         *dbp = db;
 794
 795         return (ISC_R_SUCCESS);
 796
 797  refuse:
 798         result = DNS_R_REFUSED;
 799
 800         if (db != NULL)
 801                 dns_db_detach(&db);
 802
 803         return (result);
 804 }
 805
 806
 807 static inline isc_result_t
 808 query_getdb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
 809             unsigned int options, dns_zone_t **zonep, dns_db_t **dbp,
 810             dns_dbversion_t **versionp, isc_boolean_t *is_zonep)
 811 {
 812         isc_result_t result;
 813
 814         result = query_getzonedb(client, name, qtype, options,
 815                                  zonep, dbp, versionp);
 816         if (result == ISC_R_SUCCESS) {
 817                 *is_zonep = ISC_TRUE;
 818         } else if (result == ISC_R_NOTFOUND) {
 819                 result = query_getcachedb(client, name, qtype, dbp, options);
 820                 *is_zonep = ISC_FALSE;
 821         }
 822         return (result);
 823 }
 824
 825 static inline isc_boolean_t
 826 query_isduplicate(ns_client_t *client, dns_name_t *name,
 827                   dns_rdatatype_t type, dns_name_t **mnamep)
 828 {
 829         dns_section_t section;
 830         dns_name_t *mname = NULL;
 831         isc_result_t result;
 832
 833         CTRACE("query_isduplicate");
 834
 835         for (section = DNS_SECTION_ANSWER;
 836              section <= DNS_SECTION_ADDITIONAL;
 837              section++) {
 838                 result = dns_message_findname(client->message, section,
 839                                               name, type, 0, &mname, NULL);
 840                 if (result == ISC_R_SUCCESS) {
 841                         /*
 842                          * We've already got this RRset in the response.
 843                          */
 844                         CTRACE("query_isduplicate: true: done");
 845                         return (ISC_TRUE);
 846                 } else if (result == DNS_R_NXRRSET) {
 847                         /*
 848                          * The name exists, but the rdataset does not.
 849                          */
 850                         if (section == DNS_SECTION_ADDITIONAL)
 851                                 break;
 852                 } else
 853                         RUNTIME_CHECK(result == DNS_R_NXDOMAIN);
 854                 mname = NULL;
 855         }
 856
 857         /*
 858          * If the dns_name_t we're looking up is already in the message,
 859          * we don't want to trigger the caller's name replacement logic.
 860          */
 861         if (name == mname)
 862                 mname = NULL;
 863
 864         *mnamep = mname;
 865
 866         CTRACE("query_isduplicate: false: done");
 867         return (ISC_FALSE);
 868 }
 869
 870 static isc_result_t
 871 query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 872         ns_client_t *client = arg;
 873         isc_result_t result, eresult;
 874         dns_dbnode_t *node;
 875         dns_db_t *db;
 876         dns_name_t *fname, *mname;
 877         dns_rdataset_t *rdataset, *sigrdataset, *trdataset;
 878         isc_buffer_t *dbuf;
 879         isc_buffer_t b;
 880         dns_dbversion_t *version;
 881         isc_boolean_t added_something, need_addname;
 882         dns_zone_t *zone;
 883         dns_rdatatype_t type;
 884
 885         REQUIRE(NS_CLIENT_VALID(client));
 886         REQUIRE(qtype != dns_rdatatype_any);
 887
 888         if (!WANTDNSSEC(client) && dns_rdatatype_isdnssec(qtype))
 889                 return (ISC_R_SUCCESS);
 890
 891         CTRACE("query_addadditional");
 892
 893         /*
 894          * Initialization.
 895          */
 896         eresult = ISC_R_SUCCESS;
 897         fname = NULL;
 898         rdataset = NULL;
 899         sigrdataset = NULL;
 900         trdataset = NULL;
 901         db = NULL;
 902         version = NULL;
 903         node = NULL;
 904         added_something = ISC_FALSE;
 905         need_addname = ISC_FALSE;
 906         zone = NULL;
 907
 908         /*
 909          * We treat type A additional section processing as if it
 910          * were "any address type" additional section processing.
 911          * To avoid multiple lookups, we do an 'any' database
 912          * lookup and iterate over the node.
 913          */
 914         if (qtype == dns_rdatatype_a)
 915                 type = dns_rdatatype_any;
 916         else
 917                 type = qtype;
 918
 919         /*
 920          * Get some resources.
 921          */
 922         dbuf = query_getnamebuf(client);
 923         if (dbuf == NULL)
 924                 goto cleanup;
 925         fname = query_newname(client, dbuf, &b);
 926         rdataset = query_newrdataset(client);
 927         if (fname == NULL || rdataset == NULL)
 928                 goto cleanup;
 929         if (WANTDNSSEC(client)) {
 930                 sigrdataset = query_newrdataset(client);
 931                 if (sigrdataset == NULL)
 932                         goto cleanup;
 933         }
 934
 935         /*
 936          * Look for a zone database that might contain authoritative
 937          * additional data.
 938          */
 939         result = query_getzonedb(client, name, qtype, DNS_GETDB_NOLOG,
 940                                  &zone, &db, &version);
 941         if (result != ISC_R_SUCCESS)
 942                 goto try_cache;
 943
 944         CTRACE("query_addadditional: db_find");
 945
 946         /*
 947          * Since we are looking for authoritative data, we do not set
 948          * the GLUEOK flag.  Glue will be looked for later, but not
 949          * necessarily in the same database.
 950          */
 951         node = NULL;
 952         result = dns_db_find(db, name, version, type, client->query.dboptions,
 953                              client->now, &node, fname, rdataset,
 954                              sigrdataset);
 955         if (result == ISC_R_SUCCESS)
 956                 goto found;
 957
 958         if (dns_rdataset_isassociated(rdataset))
 959                 dns_rdataset_disassociate(rdataset);
 960         if (sigrdataset != NULL && dns_rdataset_isassociated(sigrdataset))
 961                 dns_rdataset_disassociate(sigrdataset);
 962         if (node != NULL)
 963                 dns_db_detachnode(db, &node);
 964         version = NULL;
 965         dns_db_detach(&db);
 966
 967         /*
 968          * No authoritative data was found.  The cache is our next best bet.
 969          */
 970
 971  try_cache:
 972         result = query_getcachedb(client, name, qtype, &db, DNS_GETDB_NOLOG);
 973         if (result != ISC_R_SUCCESS)
 974                 /*
 975                  * Most likely the client isn't allowed to query the cache.
 976                  */
 977                 goto try_glue;
 978
 979         result = dns_db_find(db, name, version, type,  client->query.dboptions,
 980                              client->now, &node, fname, rdataset,
 981                              sigrdataset);
 982         if (result == ISC_R_SUCCESS)
 983                 goto found;
 984
 985         if (dns_rdataset_isassociated(rdataset))
 986                 dns_rdataset_disassociate(rdataset);
 987         if (sigrdataset != NULL && dns_rdataset_isassociated(sigrdataset))
 988                 dns_rdataset_disassociate(sigrdataset);
 989         if (node != NULL)
 990                 dns_db_detachnode(db, &node);
 991         dns_db_detach(&db);
 992
 993  try_glue:
 994         /*
 995          * No cached data was found.  Glue is our last chance.
 996          * RFC1035 sayeth:
 997          *
 998          *      NS records cause both the usual additional section
 999          *      processing to locate a type A record, and, when used
1000          *      in a referral, a special search of the zone in which
1001          *      they reside for glue information.
1002          *
1003          * This is the "special search".  Note that we must search
1004          * the zone where the NS record resides, not the zone it
1005          * points to, and that we only do the search in the delegation
1006          * case (identified by client->query.gluedb being set).
1007          */
1008
1009         if (client->query.gluedb == NULL)
1010                 goto cleanup;
1011
1012         /*
1013          * Don't poision caches using the bailiwick protection model.
1014          */
1015         if (!dns_name_issubdomain(name, dns_db_origin(client->query.gluedb)))
1016                 goto cleanup;
1017
1018         dns_db_attach(client->query.gluedb, &db);
1019         result = dns_db_find(db, name, version, type,
1020                              client->query.dboptions | DNS_DBFIND_GLUEOK,
1021                              client->now, &node, fname, rdataset,
1022                              sigrdataset);
1023         if (!(result == ISC_R_SUCCESS ||
1024               result == DNS_R_ZONECUT ||
1025               result == DNS_R_GLUE))
1026                 goto cleanup;
1027
1028  found:
1029         /*
1030          * We have found a potential additional data rdataset, or
1031          * at least a node to iterate over.
1032          */
1033         query_keepname(client, fname, dbuf);
1034
1035         /*
1036          * If we have an rdataset, add it to the additional data
1037          * section.
1038          */
1039         mname = NULL;
1040         if (dns_rdataset_isassociated(rdataset) &&
1041             !query_isduplicate(client, fname, type, &mname)) {
1042                 if (mname != NULL) {
1043                         query_releasename(client, &fname);
1044                         fname = mname;
1045                 } else
1046                         need_addname = ISC_TRUE;
1047                 ISC_LIST_APPEND(fname->list, rdataset, link);
1048                 trdataset = rdataset;
1049                 rdataset = NULL;
1050                 added_something = ISC_TRUE;
1051                 /*
1052                  * Note: we only add SIGs if we've added the type they cover,
1053                  * so we do not need to check if the SIG rdataset is already
1054                  * in the response.
1055                  */
1056                 if (sigrdataset != NULL &&
1057                     dns_rdataset_isassociated(sigrdataset))
1058                 {
1059                         ISC_LIST_APPEND(fname->list, sigrdataset, link);
1060                         sigrdataset = NULL;
1061                 }
1062         }
1063
1064         if (qtype == dns_rdatatype_a) {
1065                 /*
1066                  * We now go looking for A and AAAA records, along with
1067                  * their signatures.
1068                  *
1069                  * XXXRTH  This code could be more efficient.
1070                  */
1071                 if (rdataset != NULL) {
1072                         if (dns_rdataset_isassociated(rdataset))
1073                                 dns_rdataset_disassociate(rdataset);
1074                 } else {
1075                         rdataset = query_newrdataset(client);
1076                         if (rdataset == NULL)
1077                                 goto addname;
1078                 }
1079                 if (sigrdataset != NULL) {
1080                         if (dns_rdataset_isassociated(sigrdataset))
1081                                 dns_rdataset_disassociate(sigrdataset);
1082                 } else if (WANTDNSSEC(client)) {
1083                         sigrdataset = query_newrdataset(client);
1084                         if (sigrdataset == NULL)
1085                                 goto addname;
1086                 }
1087                 result = dns_db_findrdataset(db, node, version,
1088                                              dns_rdatatype_a, 0,
1089                                              client->now, rdataset,
1090                                              sigrdataset);
1091                 if (result == DNS_R_NCACHENXDOMAIN)
1092                         goto addname;
1093                 if (result == DNS_R_NCACHENXRRSET) {
1094                         dns_rdataset_disassociate(rdataset);
1095                         /*
1096                          * Negative cache entries don't have sigrdatasets.
1097                          */
1098                         INSIST(sigrdataset == NULL ||
1099                                ! dns_rdataset_isassociated(sigrdataset));
1100                 }
1101                 if (result == ISC_R_SUCCESS) {
1102                         mname = NULL;
1103                         if (!query_isduplicate(client, fname,
1104                                                dns_rdatatype_a, &mname)) {
1105                                 if (mname != NULL) {
1106                                         query_releasename(client, &fname);
1107                                         fname = mname;
1108                                 } else
1109                                         need_addname = ISC_TRUE;
1110                                 ISC_LIST_APPEND(fname->list, rdataset, link);
1111                                 added_something = ISC_TRUE;
1112                                 if (sigrdataset != NULL &&
1113                                     dns_rdataset_isassociated(sigrdataset))
1114                                 {
1115                                         ISC_LIST_APPEND(fname->list,
1116                                                         sigrdataset, link);
1117                                         sigrdataset =
1118                                                 query_newrdataset(client);
1119                                 }
1120                                 rdataset = query_newrdataset(client);
1121                                 if (rdataset == NULL)
1122                                         goto addname;
1123                                 if (WANTDNSSEC(client) && sigrdataset == NULL)
1124                                         goto addname;
1125                         } else {
1126                                 dns_rdataset_disassociate(rdataset);
1127                                 if (sigrdataset != NULL &&
1128                                     dns_rdataset_isassociated(sigrdataset))
1129                                         dns_rdataset_disassociate(sigrdataset);
1130                         }
1131                 }
1132                 result = dns_db_findrdataset(db, node, version,
1133                                              dns_rdatatype_aaaa, 0,
1134                                              client->now, rdataset,
1135                                              sigrdataset);
1136                 if (result == DNS_R_NCACHENXDOMAIN)
1137                         goto addname;
1138                 if (result == DNS_R_NCACHENXRRSET) {
1139                         dns_rdataset_disassociate(rdataset);
1140                         INSIST(sigrdataset == NULL ||
1141                                ! dns_rdataset_isassociated(sigrdataset));
1142                 }
1143                 if (result == ISC_R_SUCCESS) {
1144                         mname = NULL;
1145                         if (!query_isduplicate(client, fname,
1146                                                dns_rdatatype_aaaa, &mname)) {
1147                                 if (mname != NULL) {
1148                                         query_releasename(client, &fname);
1149                                         fname = mname;
1150                                 } else
1151                                         need_addname = ISC_TRUE;
1152                                 ISC_LIST_APPEND(fname->list, rdataset, link);
1153                                 added_something = ISC_TRUE;
1154                                 if (sigrdataset != NULL &&
1155                                     dns_rdataset_isassociated(sigrdataset))
1156                                 {
1157                                         ISC_LIST_APPEND(fname->list,
1158                                                         sigrdataset, link);
1159                                         sigrdataset = NULL;
1160                                 }
1161                                 rdataset = NULL;
1162                         }
1163                 }
1164         }
1165
1166  addname:
1167         CTRACE("query_addadditional: addname");
1168         /*
1169          * If we haven't added anything, then we're done.
1170          */
1171         if (!added_something)
1172                 goto cleanup;
1173
1174         /*
1175          * We may have added our rdatasets to an existing name, if so, then
1176          * need_addname will be ISC_FALSE.  Whether we used an existing name
1177          * or a new one, we must set fname to NULL to prevent cleanup.
1178          */
1179         if (need_addname)
1180                 dns_message_addname(client->message, fname,
1181                                     DNS_SECTION_ADDITIONAL);
1182         fname = NULL;
1183
1184         /*
1185          * In a few cases, we want to add additional data for additional
1186          * data.  It's simpler to just deal with special cases here than
1187          * to try to create a general purpose mechanism and allow the
1188          * rdata implementations to do it themselves.
1189          *
1190          * This involves recursion, but the depth is limited.  The
1191          * most complex case is adding a SRV rdataset, which involves
1192          * recursing to add address records, which in turn can cause
1193          * recursion to add KEYs.
1194          */
1195         if (type == dns_rdatatype_srv && trdataset != NULL) {
1196                 /*
1197                  * If we're adding SRV records to the additional data
1198                  * section, it's helpful if we add the SRV additional data
1199                  * as well.
1200                  */
1201                 eresult = dns_rdataset_additionaldata(trdataset,
1202                                                       query_addadditional,
1203                                                       client);
1204         }
1205
1206  cleanup:
1207         CTRACE("query_addadditional: cleanup");
1208         query_putrdataset(client, &rdataset);
1209         if (sigrdataset != NULL)
1210                 query_putrdataset(client, &sigrdataset);
1211         if (fname != NULL)
1212                 query_releasename(client, &fname);
1213         if (node != NULL)
1214                 dns_db_detachnode(db, &node);
1215         if (db != NULL)
1216                 dns_db_detach(&db);
1217         if (zone != NULL)
1218                 dns_zone_detach(&zone);
1219
1220         CTRACE("query_addadditional: done");
1221         return (eresult);
1222 }
1223
1224 static inline void
1225 query_addrdataset(ns_client_t *client, dns_name_t *fname,
1226                   dns_rdataset_t *rdataset)
1227 {
1228         /*
1229          * Add 'rdataset' and any pertinent additional data to
1230          * 'fname', a name in the response message for 'client'.
1231          */
1232
1233         CTRACE("query_addrdataset");
1234
1235         ISC_LIST_APPEND(fname->list, rdataset, link);
1236
1237         if (client->view->order != NULL)
1238                 rdataset->attributes |= dns_order_find(client->view->order,
1239                                                        fname, rdataset->type,
1240                                                        rdataset->rdclass);
1241         if (NOADDITIONAL(client))
1242                 return;
1243
1244         /*
1245          * Add additional data.
1246          *
1247          * We don't care if dns_rdataset_additionaldata() fails.
1248          */
1249         (void)dns_rdataset_additionaldata(rdataset,
1250                                           query_addadditional, client);
1251         CTRACE("query_addrdataset: done");
1252 }
1253
1254 static void
1255 query_addrrset(ns_client_t *client, dns_name_t **namep,
1256                dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp,
1257                isc_buffer_t *dbuf, dns_section_t section)
1258 {
1259         dns_name_t *name, *mname;
1260         dns_rdataset_t *rdataset, *mrdataset, *sigrdataset;
1261         isc_result_t result;
1262
1263         /*
1264          * To the current response for 'client', add the answer RRset
1265          * '*rdatasetp' and an optional signature set '*sigrdatasetp', with
1266          * owner name '*namep', to section 'section', unless they are
1267          * already there.  Also add any pertinent additional data.
1268          *
1269          * If 'dbuf' is not NULL, then '*namep' is the name whose data is
1270          * stored in 'dbuf'.  In this case, query_addrrset() guarantees that
1271          * when it returns the name will either have been kept or released.
1272          */
1273         CTRACE("query_addrrset");
1274         name = *namep;
1275         rdataset = *rdatasetp;
1276         if (sigrdatasetp != NULL)
1277                 sigrdataset = *sigrdatasetp;
1278         else
1279                 sigrdataset = NULL;
1280         mname = NULL;
1281         mrdataset = NULL;
1282         result = dns_message_findname(client->message, section,
1283                                       name, rdataset->type, rdataset->covers,
1284                                       &mname, &mrdataset);
1285         if (result == ISC_R_SUCCESS) {
1286                 /*
1287                  * We've already got an RRset of the given name and type.
1288                  * There's nothing else to do;
1289                  */
1290                 CTRACE("query_addrrset: dns_message_findname succeeded: done");
1291                 if (dbuf != NULL)
1292                         query_releasename(client, namep);
1293                 return;
1294         } else if (result == DNS_R_NXDOMAIN) {
1295                 /*
1296                  * The name doesn't exist.
1297                  */
1298                 if (dbuf != NULL)
1299                         query_keepname(client, name, dbuf);
1300                 dns_message_addname(client->message, name, section);
1301                 *namep = NULL;
1302                 mname = name;
1303         } else {
1304                 RUNTIME_CHECK(result == DNS_R_NXRRSET);
1305                 if (dbuf != NULL)
1306                         query_releasename(client, namep);
1307         }
1308
1309         if (rdataset->trust != dns_trust_secure &&
1310             (section == DNS_SECTION_ANSWER ||
1311              section == DNS_SECTION_AUTHORITY))
1312                 client->query.attributes &= ~NS_QUERYATTR_SECURE;
1313         /*
1314          * Note: we only add SIGs if we've added the type they cover, so
1315          * we do not need to check if the SIG rdataset is already in the
1316          * response.
1317          */
1318         query_addrdataset(client, mname, rdataset);
1319         *rdatasetp = NULL;
1320         if (sigrdataset != NULL && dns_rdataset_isassociated(sigrdataset)) {
1321                 /*
1322                  * We have a signature.  Add it to the response.
1323                  */
1324                 ISC_LIST_APPEND(mname->list, sigrdataset, link);
1325                 *sigrdatasetp = NULL;
1326         }
1327         CTRACE("query_addrrset: done");
1328 }
1329
1330 static inline isc_result_t
1331 query_addsoa(ns_client_t *client, dns_db_t *db, isc_boolean_t zero_ttl) {
1332         dns_name_t *name, *fname;
1333         dns_dbnode_t *node;
1334         isc_result_t result, eresult;
1335         dns_fixedname_t foundname;
1336         dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
1337         dns_rdataset_t **sigrdatasetp = NULL;
1338
1339         CTRACE("query_addsoa");
1340         /*
1341          * Initialization.
1342          */
1343         eresult = ISC_R_SUCCESS;
1344         name = NULL;
1345         rdataset = NULL;
1346         node = NULL;
1347         dns_fixedname_init(&foundname);
1348         fname = dns_fixedname_name(&foundname);
1349
1350         /*
1351          * Get resources and make 'name' be the database origin.
1352          */
1353         result = dns_message_gettempname(client->message, &name);
1354         if (result != ISC_R_SUCCESS)
1355                 return (result);
1356         dns_name_init(name, NULL);
1357         dns_name_clone(dns_db_origin(db), name);
1358         rdataset = query_newrdataset(client);
1359         if (rdataset == NULL) {
1360                 eresult = DNS_R_SERVFAIL;
1361                 goto cleanup;
1362         }
1363         if (WANTDNSSEC(client)) {
1364                 sigrdataset = query_newrdataset(client);
1365                 if (sigrdataset == NULL) {
1366                         eresult = DNS_R_SERVFAIL;
1367                         goto cleanup;
1368                 }
1369         }
1370
1371         /*
1372          * Find the SOA.
1373          */
1374         result = dns_db_find(db, name, NULL, dns_rdatatype_soa,
1375                              client->query.dboptions, 0, &node,
1376                              fname, rdataset, sigrdataset);
1377         if (result != ISC_R_SUCCESS) {
1378                 /*
1379                  * This is bad.  We tried to get the SOA RR at the zone top
1380                  * and it didn't work!
1381                  */
1382                 eresult = DNS_R_SERVFAIL;
1383         } else {
1384                 /*
1385                  * Extract the SOA MINIMUM.
1386                  */
1387                 dns_rdata_soa_t soa;
1388                 dns_rdata_t rdata = DNS_RDATA_INIT;
1389                 result = dns_rdataset_first(rdataset);
1390                 RUNTIME_CHECK(result == ISC_R_SUCCESS);
1391                 dns_rdataset_current(rdataset, &rdata);
1392                 result = dns_rdata_tostruct(&rdata, &soa, NULL);
1393                 if (result != ISC_R_SUCCESS)
1394                         goto cleanup;
1395
1396                 if (zero_ttl) {
1397                         rdataset->ttl = 0;
1398                         if (sigrdataset != NULL)
1399                                 sigrdataset->ttl = 0;
1400                 }
1401
1402                 /*
1403                  * Add the SOA and its SIG to the response, with the
1404                  * TTLs adjusted per RFC2308 section 3.
1405                  */
1406                 if (rdataset->ttl > soa.minimum)
1407                         rdataset->ttl = soa.minimum;
1408                 if (sigrdataset != NULL && sigrdataset->ttl > soa.minimum)
1409                         sigrdataset->ttl = soa.minimum;
1410
1411                 if (sigrdataset != NULL)
1412                         sigrdatasetp = &sigrdataset;
1413                 else
1414                         sigrdatasetp = NULL;
1415                 query_addrrset(client, &name, &rdataset, sigrdatasetp, NULL,
1416                                DNS_SECTION_AUTHORITY);
1417         }
1418
1419  cleanup:
1420         query_putrdataset(client, &rdataset);
1421         if (sigrdataset != NULL)
1422                 query_putrdataset(client, &sigrdataset);
1423         if (name != NULL)
1424                 query_releasename(client, &name);
1425         if (node != NULL)
1426                 dns_db_detachnode(db, &node);
1427
1428         return (eresult);
1429 }
1430
1431 static inline isc_result_t
1432 query_addns(ns_client_t *client, dns_db_t *db) {
1433         dns_name_t *name, *fname;
1434         dns_dbnode_t *node;
1435         isc_result_t result, eresult;
1436         dns_fixedname_t foundname;
1437         dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
1438         dns_rdataset_t **sigrdatasetp = NULL;
1439
1440         CTRACE("query_addns");
1441         /*
1442          * Initialization.
1443          */
1444         eresult = ISC_R_SUCCESS;
1445         name = NULL;
1446         rdataset = NULL;
1447         node = NULL;
1448         dns_fixedname_init(&foundname);
1449         fname = dns_fixedname_name(&foundname);
1450
1451         /*
1452          * Get resources and make 'name' be the database origin.
1453          */
1454         result = dns_message_gettempname(client->message, &name);
1455         if (result != ISC_R_SUCCESS) {
1456                 CTRACE("query_addns: dns_message_gettempname failed: done");
1457                 return (result);
1458         }
1459         dns_name_init(name, NULL);
1460         dns_name_clone(dns_db_origin(db), name);
1461         rdataset = query_newrdataset(client);
1462         if (rdataset == NULL) {
1463                 CTRACE("query_addns: query_newrdataset failed");
1464                 eresult = DNS_R_SERVFAIL;
1465                 goto cleanup;
1466         }
1467         if (WANTDNSSEC(client)) {
1468                 sigrdataset = query_newrdataset(client);
1469                 if (sigrdataset == NULL) {
1470                         CTRACE("query_addns: query_newrdataset failed");
1471                         eresult = DNS_R_SERVFAIL;
1472                         goto cleanup;
1473                 }
1474         }
1475
1476         /*
1477          * Find the NS rdataset.
1478          */
1479         CTRACE("query_addns: calling dns_db_find");
1480         result = dns_db_find(db, name, NULL, dns_rdatatype_ns,
1481                              client->query.dboptions, 0, &node,
1482                              fname, rdataset, sigrdataset);
1483         CTRACE("query_addns: dns_db_find complete");
1484         if (result != ISC_R_SUCCESS) {
1485                 CTRACE("query_addns: dns_db_find failed");
1486                 /*
1487                  * This is bad.  We tried to get the NS rdataset at the zone
1488                  * top and it didn't work!
1489                  */
1490                 eresult = DNS_R_SERVFAIL;
1491         } else {
1492                 if (sigrdataset != NULL)
1493                         sigrdatasetp = &sigrdataset;
1494                 else
1495                         sigrdatasetp = NULL;
1496                 query_addrrset(client, &name, &rdataset, sigrdatasetp, NULL,
1497                                DNS_SECTION_AUTHORITY);
1498         }
1499
1500  cleanup:
1501         CTRACE("query_addns: cleanup");
1502         query_putrdataset(client, &rdataset);
1503         if (sigrdataset != NULL)
1504                 query_putrdataset(client, &sigrdataset);
1505         if (name != NULL)
1506                 query_releasename(client, &name);
1507         if (node != NULL)
1508                 dns_db_detachnode(db, &node);
1509
1510         CTRACE("query_addns: done");
1511         return (eresult);
1512 }
1513
1514 static inline isc_result_t
1515 query_addcnamelike(ns_client_t *client, dns_name_t *qname, dns_name_t *tname,
1516                    dns_trust_t trust, dns_name_t **anamep, dns_rdatatype_t type)
1517 {
1518         dns_rdataset_t *rdataset;
1519         dns_rdatalist_t *rdatalist;
1520         dns_rdata_t *rdata;
1521         isc_result_t result;
1522         isc_region_t r;
1523
1524         /*
1525          * We assume the name data referred to by tname won't go away.
1526          */
1527
1528         REQUIRE(anamep != NULL);
1529
1530         rdatalist = NULL;
1531         result = dns_message_gettemprdatalist(client->message, &rdatalist);
1532         if (result != ISC_R_SUCCESS)
1533                 return (result);
1534         rdata = NULL;
1535         result = dns_message_gettemprdata(client->message, &rdata);
1536         if (result != ISC_R_SUCCESS)
1537                 return (result);
1538         rdataset = NULL;
1539         result = dns_message_gettemprdataset(client->message, &rdataset);
1540         if (result != ISC_R_SUCCESS)
1541                 return (result);
1542         dns_rdataset_init(rdataset);
1543         result = dns_name_dup(qname, client->mctx, *anamep);
1544         if (result != ISC_R_SUCCESS) {
1545                 dns_message_puttemprdataset(client->message, &rdataset);
1546                 return (result);
1547         }
1548
1549         rdatalist->type = type;
1550         rdatalist->covers = 0;
1551         rdatalist->rdclass = client->message->rdclass;
1552         rdatalist->ttl = 0;
1553
1554         dns_name_toregion(tname, &r);
1555         rdata->data = r.base;
1556         rdata->length = r.length;
1557         rdata->rdclass = client->message->rdclass;
1558         rdata->type = type;
1559
1560         ISC_LIST_INIT(rdatalist->rdata);
1561         ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
1562         RUNTIME_CHECK(dns_rdatalist_tordataset(rdatalist, rdataset)
1563                       == ISC_R_SUCCESS);
1564         rdataset->trust = trust;
1565
1566         query_addrrset(client, anamep, &rdataset, NULL, NULL,
1567                        DNS_SECTION_ANSWER);
1568
1569         if (rdataset != NULL) {
1570                 if (dns_rdataset_isassociated(rdataset))
1571                         dns_rdataset_disassociate(rdataset);
1572                 dns_message_puttemprdataset(client->message, &rdataset);
1573         }
1574
1575         return (ISC_R_SUCCESS);
1576 }
1577
1578 static void
1579 query_addbestns(ns_client_t *client) {
1580         dns_db_t *db, *zdb;
1581         dns_dbnode_t *node;
1582         dns_name_t *fname, *zfname;
1583         dns_rdataset_t *rdataset, *sigrdataset, *zrdataset, *zsigrdataset;
1584         isc_boolean_t is_zone, use_zone;
1585         isc_buffer_t *dbuf;
1586         isc_result_t result;
1587         dns_dbversion_t *version;
1588         dns_zone_t *zone;
1589         isc_buffer_t b;
1590
1591         CTRACE("query_addbestns");
1592         fname = NULL;
1593         zfname = NULL;
1594         rdataset = NULL;
1595         zrdataset = NULL;
1596         sigrdataset = NULL;
1597         zsigrdataset = NULL;
1598         node = NULL;
1599         db = NULL;
1600         zdb = NULL;
1601         version = NULL;
1602         zone = NULL;
1603         is_zone = ISC_FALSE;
1604         use_zone = ISC_FALSE;
1605
1606         /*
1607          * Find the right database.
1608          */
1609         result = query_getdb(client, client->query.qname, dns_rdatatype_ns, 0,
1610                              &zone, &db, &version, &is_zone);
1611         if (result != ISC_R_SUCCESS)
1612                 goto cleanup;
1613
1614  db_find:
1615         /*
1616          * We'll need some resources...
1617          */
1618         dbuf = query_getnamebuf(client);
1619         if (dbuf == NULL)
1620                 goto cleanup;
1621         fname = query_newname(client, dbuf, &b);
1622         rdataset = query_newrdataset(client);
1623         if (fname == NULL || rdataset == NULL)
1624                 goto cleanup;
1625         if (WANTDNSSEC(client)) {
1626                 sigrdataset = query_newrdataset(client);
1627                 if (sigrdataset == NULL)
1628                         goto cleanup;
1629         }
1630
1631         /*
1632          * Now look for the zonecut.
1633          */
1634         if (is_zone) {
1635                 result = dns_db_find(db, client->query.qname, version,
1636                                      dns_rdatatype_ns, client->query.dboptions,
1637                                      client->now, &node, fname,
1638                                      rdataset, sigrdataset);
1639                 if (result != DNS_R_DELEGATION)
1640                         goto cleanup;
1641                 if (USECACHE(client)) {
1642                         query_keepname(client, fname, dbuf);
1643                         zdb = db;
1644                         zfname = fname;
1645                         fname = NULL;
1646                         zrdataset = rdataset;
1647                         rdataset = NULL;
1648                         zsigrdataset = sigrdataset;
1649                         sigrdataset = NULL;
1650                         dns_db_detachnode(db, &node);
1651                         version = NULL;
1652                         db = NULL;
1653                         dns_db_attach(client->view->cachedb, &db);
1654                         is_zone = ISC_FALSE;
1655                         goto db_find;
1656                 }
1657         } else {
1658                 result = dns_db_findzonecut(db, client->query.qname,
1659                                             client->query.dboptions,
1660                                             client->now, &node, fname,
1661                                             rdataset, sigrdataset);
1662                 if (result == ISC_R_SUCCESS) {
1663                         if (zfname != NULL &&
1664                             !dns_name_issubdomain(fname, zfname)) {
1665                                 /*
1666                                  * We found a zonecut in the cache, but our
1667                                  * zone delegation is better.
1668                                  */
1669                                 use_zone = ISC_TRUE;
1670                         }
1671                 } else if (result == ISC_R_NOTFOUND && zfname != NULL) {
1672                         /*
1673                          * We didn't find anything in the cache, but we
1674                          * have a zone delegation, so use it.
1675                          */
1676                         use_zone = ISC_TRUE;
1677                 } else
1678                         goto cleanup;
1679         }
1680
1681         if (use_zone) {
1682                 query_releasename(client, &fname);
1683                 fname = zfname;
1684                 zfname = NULL;
1685                 /*
1686                  * We've already done query_keepname() on
1687                  * zfname, so we must set dbuf to NULL to
1688                  * prevent query_addrrset() from trying to
1689                  * call query_keepname() again.
1690                  */
1691                 dbuf = NULL;
1692                 query_putrdataset(client, &rdataset);
1693                 if (sigrdataset != NULL)
1694                         query_putrdataset(client, &sigrdataset);
1695                 rdataset = zrdataset;
1696                 zrdataset = NULL;
1697                 sigrdataset = zsigrdataset;
1698                 zsigrdataset = NULL;
1699         }
1700
1701         if ((client->query.dboptions & DNS_DBFIND_PENDINGOK) == 0 &&
1702             (rdataset->trust == dns_trust_pending ||
1703              (sigrdataset != NULL && sigrdataset->trust == dns_trust_pending)))
1704                 goto cleanup;
1705
1706         if (WANTDNSSEC(client) && SECURE(client) &&
1707             (rdataset->trust == dns_trust_glue ||
1708              (sigrdataset != NULL && sigrdataset->trust == dns_trust_glue)))
1709                 goto cleanup;
1710
1711         query_addrrset(client, &fname, &rdataset, &sigrdataset, dbuf,
1712                        DNS_SECTION_AUTHORITY);
1713
1714  cleanup:
1715         if (rdataset != NULL)
1716                 query_putrdataset(client, &rdataset);
1717         if (sigrdataset != NULL)
1718                 query_putrdataset(client, &sigrdataset);
1719         if (fname != NULL)
1720                 query_releasename(client, &fname);
1721         if (node != NULL)
1722                 dns_db_detachnode(db, &node);
1723         if (db != NULL)
1724                 dns_db_detach(&db);
1725         if (zone != NULL)
1726                 dns_zone_detach(&zone);
1727         if (zdb != NULL) {
1728                 query_putrdataset(client, &zrdataset);
1729                 if (zsigrdataset != NULL)
1730                         query_putrdataset(client, &zsigrdataset);
1731                 if (zfname != NULL)
1732                         query_releasename(client, &zfname);
1733                 dns_db_detach(&zdb);
1734         }
1735 }
1736
1737 static void
1738 query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) {
1739         dns_name_t *rname;
1740         dns_rdataset_t *rdataset, *sigrdataset;
1741         isc_result_t result;
1742
1743         CTRACE("query_addds");
1744         rname = NULL;
1745         rdataset = NULL;
1746         sigrdataset = NULL;
1747
1748         /*
1749          * We'll need some resources...
1750          */
1751         rdataset = query_newrdataset(client);
1752         sigrdataset = query_newrdataset(client);
1753         if (rdataset == NULL || sigrdataset == NULL)
1754                 goto cleanup;
1755
1756         /*
1757          * Look for the DS record, which may or may not be present.
1758          */
1759         result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ds, 0,
1760                                      client->now, rdataset, sigrdataset);
1761         /*
1762          * If we didn't find it, look for an NSEC. */
1763         if (result == ISC_R_NOTFOUND)
1764                 result = dns_db_findrdataset(db, node, NULL,
1765                                              dns_rdatatype_nsec, 0, client->now,
1766                                              rdataset, sigrdataset);
1767         if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND)
1768                 goto cleanup;
1769         if (!dns_rdataset_isassociated(rdataset) ||
1770             !dns_rdataset_isassociated(sigrdataset))
1771                 goto cleanup;
1772
1773         /*
1774          * We've already added the NS record, so if the name's not there,
1775          * we have other problems.  Use this name rather than calling
1776          * query_addrrset().
1777          */
1778         result = dns_message_firstname(client->message, DNS_SECTION_AUTHORITY);
1779         if (result != ISC_R_SUCCESS)
1780                 goto cleanup;
1781
1782         rname = NULL;
1783         dns_message_currentname(client->message, DNS_SECTION_AUTHORITY,
1784                                 &rname);
1785         result = dns_message_findtype(rname, dns_rdatatype_ns, 0, NULL);
1786         if (result != ISC_R_SUCCESS)
1787                 goto cleanup;
1788
1789         ISC_LIST_APPEND(rname->list, rdataset, link);
1790         ISC_LIST_APPEND(rname->list, sigrdataset, link);
1791         rdataset = NULL;
1792         sigrdataset = NULL;
1793
1794  cleanup:
1795         if (rdataset != NULL)
1796                 query_putrdataset(client, &rdataset);
1797         if (sigrdataset != NULL)
1798                 query_putrdataset(client, &sigrdataset);
1799 }
1800
1801 static void
1802 query_addwildcardproof(ns_client_t *client, dns_db_t *db,
1803                        dns_name_t *name, isc_boolean_t ispositive)
1804 {
1805         isc_buffer_t *dbuf, b;
1806         dns_name_t *fname;
1807         dns_rdataset_t *rdataset, *sigrdataset;
1808         dns_fixedname_t wfixed;
1809         dns_name_t *wname;
1810         dns_dbnode_t *node;
1811         unsigned int options;
1812         unsigned int olabels, nlabels;
1813         isc_result_t result;
1814         dns_rdata_t rdata = DNS_RDATA_INIT;
1815         dns_rdata_nsec_t nsec;
1816         isc_boolean_t have_wname;
1817         int order;
1818
1819         CTRACE("query_addwildcardproof");
1820         fname = NULL;
1821         rdataset = NULL;
1822         sigrdataset = NULL;
1823         node = NULL;
1824
1825         /*
1826          * Get the NOQNAME proof then if !ispositve
1827          * get the NOWILDCARD proof.
1828          *
1829          * DNS_DBFIND_NOWILD finds the NSEC records that covers the
1830          * name ignoring any wildcard.  From the owner and next names
1831          * of this record you can compute which wildcard (if it exists)
1832          * will match by finding the longest common suffix of the
1833          * owner name and next names with the qname and prefixing that
1834          * with the wildcard label.
1835          *
1836          * e.g.
1837          *   Given:
1838          *      example SOA
1839          *      example NSEC b.example
1840          *      b.example A
1841          *      b.example NSEC a.d.example
1842          *      a.d.example A
1843          *      a.d.example NSEC g.f.example
1844          *      g.f.example A
1845          *      g.f.example NSEC z.i.example
1846          *      z.i.example A
1847          *      z.i.example NSEC example
1848          *
1849          *   QNAME:
1850          *   a.example -> example NSEC b.example
1851          *      owner common example
1852          *      next common example
1853          *      wild *.example
1854          *   d.b.example -> b.example NSEC a.d.example
1855          *      owner common b.example
1856          *      next common example
1857          *      wild *.b.example
1858          *   a.f.example -> a.d.example NSEC g.f.example
1859          *      owner common example
1860          *      next common f.example
1861          *      wild *.f.example
1862          *  j.example -> z.i.example NSEC example
1863          *      owner common example
1864          *      next common example
1865          *      wild *.f.example
1866          */
1867         options = client->query.dboptions | DNS_DBFIND_NOWILD;
1868         dns_fixedname_init(&wfixed);
1869         wname = dns_fixedname_name(&wfixed);
1870  again:
1871         have_wname = ISC_FALSE;
1872         /*
1873          * We'll need some resources...
1874          */
1875         dbuf = query_getnamebuf(client);
1876         if (dbuf == NULL)
1877                 goto cleanup;
1878         fname = query_newname(client, dbuf, &b);
1879         rdataset = query_newrdataset(client);
1880         sigrdataset = query_newrdataset(client);
1881         if (fname == NULL || rdataset == NULL || sigrdataset == NULL)
1882                 goto cleanup;
1883
1884         result = dns_db_find(db, name, NULL, dns_rdatatype_nsec, options,
1885                              0, &node, fname, rdataset, sigrdataset);
1886         if (node != NULL)
1887                 dns_db_detachnode(db, &node);
1888         if (result == DNS_R_NXDOMAIN) {
1889                 if (!ispositive)
1890                         result = dns_rdataset_first(rdataset);
1891                 if (result == ISC_R_SUCCESS) {
1892                         dns_rdataset_current(rdataset, &rdata);
1893                         result = dns_rdata_tostruct(&rdata, &nsec, NULL);
1894                 }
1895                 if (result == ISC_R_SUCCESS) {
1896                         (void)dns_name_fullcompare(name, fname, &order,
1897                                                    &olabels);
1898                         (void)dns_name_fullcompare(name, &nsec.next, &order,
1899                                                    &nlabels);
1900                         if (olabels > nlabels)
1901                                 dns_name_split(name, olabels, NULL, wname);
1902                         else
1903                                 dns_name_split(name, nlabels, NULL, wname);
1904                         result = dns_name_concatenate(dns_wildcardname,
1905                                                       wname, wname, NULL);
1906                         if (result == ISC_R_SUCCESS)
1907                                 have_wname = ISC_TRUE;
1908                         dns_rdata_freestruct(&nsec);
1909                 }
1910                 query_addrrset(client, &fname, &rdataset, &sigrdataset,
1911                                dbuf, DNS_SECTION_AUTHORITY);
1912         }
1913         if (rdataset != NULL)
1914                 query_putrdataset(client, &rdataset);
1915         if (sigrdataset != NULL)
1916                 query_putrdataset(client, &sigrdataset);
1917         if (fname != NULL)
1918                 query_releasename(client, &fname);
1919         if (have_wname) {
1920                 ispositive = ISC_TRUE;  /* prevent loop */
1921                 if (!dns_name_equal(name, wname)) {
1922                         name = wname;
1923                         goto again;
1924                 }
1925         }
1926  cleanup:
1927         if (rdataset != NULL)
1928                 query_putrdataset(client, &rdataset);
1929         if (sigrdataset != NULL)
1930                 query_putrdataset(client, &sigrdataset);
1931         if (fname != NULL)
1932                 query_releasename(client, &fname);
1933 }
1934
1935 static void
1936 query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db, dns_name_t **namep,
1937                     dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp)
1938 {
1939         dns_name_t *name;
1940         dns_rdataset_t *sigrdataset;
1941         dns_rdata_t sigrdata;
1942         dns_rdata_rrsig_t sig;
1943         unsigned int labels;
1944         isc_buffer_t *dbuf, b;
1945         dns_name_t *fname;
1946         isc_result_t result;
1947
1948         name = *namep;
1949         if ((name->attributes & DNS_NAMEATTR_WILDCARD) == 0) {
1950                 query_addrrset(client, namep, rdatasetp, sigrdatasetp,
1951                                NULL, DNS_SECTION_AUTHORITY);
1952                 return;
1953         }
1954
1955         if (sigrdatasetp == NULL)
1956                 return;
1957         sigrdataset = *sigrdatasetp;
1958         if (sigrdataset == NULL || !dns_rdataset_isassociated(sigrdataset))
1959                 return;
1960         result = dns_rdataset_first(sigrdataset);
1961         if (result != ISC_R_SUCCESS)
1962                 return;
1963         dns_rdata_init(&sigrdata);
1964         dns_rdataset_current(sigrdataset, &sigrdata);
1965         result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
1966         if (result != ISC_R_SUCCESS)
1967                 return;
1968
1969         labels = dns_name_countlabels(name);
1970         if ((unsigned int)sig.labels + 1 >= labels)
1971                 return;
1972
1973         /* XXX */
1974         query_addwildcardproof(client, db,
1975                                client->query.qname,
1976                                ISC_TRUE);
1977
1978         /*
1979          * We'll need some resources...
1980          */
1981         dbuf = query_getnamebuf(client);
1982         if (dbuf == NULL)
1983                 return;
1984         fname = query_newname(client, dbuf, &b);
1985         if (fname == NULL)
1986                 return;
1987         dns_name_split(name, sig.labels + 1, NULL, fname);
1988         /* This will succeed, since we've stripped labels. */
1989         RUNTIME_CHECK(dns_name_concatenate(dns_wildcardname, fname, fname,
1990                                            NULL) == ISC_R_SUCCESS);
1991         query_addrrset(client, &fname, rdatasetp, sigrdatasetp,
1992                        dbuf, DNS_SECTION_AUTHORITY);
1993 }
1994
1995 static void
1996 query_resume(isc_task_t *task, isc_event_t *event) {
1997         dns_fetchevent_t *devent = (dns_fetchevent_t *)event;
1998         ns_client_t *client;
1999         isc_boolean_t fetch_cancelled, client_shuttingdown;
2000
2001         /*
2002          * Resume a query after recursion.
2003          */
2004
2005         UNUSED(task);
2006
2007         REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
2008         client = devent->ev_arg;
2009         REQUIRE(NS_CLIENT_VALID(client));
2010         REQUIRE(task == client->task);
2011         REQUIRE(RECURSING(client));
2012
2013         LOCK(&client->query.fetchlock);
2014         if (client->query.fetch != NULL) {
2015                 /*
2016                  * This is the fetch we've been waiting for.
2017                  */
2018                 INSIST(devent->fetch == client->query.fetch);
2019                 client->query.fetch = NULL;
2020                 fetch_cancelled = ISC_FALSE;
2021                 /*
2022                  * Update client->now.
2023                  */
2024                 isc_stdtime_get(&client->now);
2025         } else {
2026                 /*
2027                  * This is a fetch completion event for a cancelled fetch.
2028                  * Clean up and don't resume the find.
2029                  */
2030                 fetch_cancelled = ISC_TRUE;
2031         }
2032         UNLOCK(&client->query.fetchlock);
2033         INSIST(client->query.fetch == NULL);
2034
2035         client->query.attributes &= ~NS_QUERYATTR_RECURSING;
2036         dns_resolver_destroyfetch(&devent->fetch);
2037
2038         /*
2039          * If this client is shutting down, or this transaction
2040          * has timed out, do not resume the find.
2041          */
2042         client_shuttingdown = ns_client_shuttingdown(client);
2043         if (fetch_cancelled || client_shuttingdown) {
2044                 if (devent->node != NULL)
2045                         dns_db_detachnode(devent->db, &devent->node);
2046                 if (devent->db != NULL)
2047                         dns_db_detach(&devent->db);
2048                 query_putrdataset(client, &devent->rdataset);
2049                 if (devent->sigrdataset != NULL)
2050                         query_putrdataset(client, &devent->sigrdataset);
2051                 isc_event_free(&event);
2052                 if (fetch_cancelled)
2053                         query_error(client, DNS_R_SERVFAIL);
2054                 else
2055                         query_next(client, ISC_R_CANCELED);
2056                 /*
2057                  * This may destroy the client.
2058                  */
2059                 ns_client_detach(&client);
2060         } else {
2061                 query_find(client, devent, 0);
2062         }
2063 }
2064
2065 static isc_result_t
2066 query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qdomain,
2067               dns_rdataset_t *nameservers)
2068 {
2069         isc_result_t result;
2070         dns_rdataset_t *rdataset, *sigrdataset;
2071
2072         inc_stats(client, dns_statscounter_recursion);
2073
2074         /*
2075          * We are about to recurse, which means that this client will
2076          * be unavailable for serving new requests for an indeterminate
2077          * amount of time.  If this client is currently responsible
2078          * for handling incoming queries, set up a new client
2079          * object to handle them while we are waiting for a
2080          * response.  There is no need to replace TCP clients
2081          * because those have already been replaced when the
2082          * connection was accepted (if allowed by the TCP quota).
2083          */
2084         if (client->recursionquota == NULL) {
2085                 result = isc_quota_attach(&ns_g_server->recursionquota,
2086                                           &client->recursionquota);
2087                 if  (result == ISC_R_SOFTQUOTA) {
2088                         static isc_stdtime_t last = 0;
2089                         isc_stdtime_t now;
2090                         isc_stdtime_get(&now);
2091                         if (now != last) {
2092                                 last = now;
2093                                 ns_client_log(client, NS_LOGCATEGORY_CLIENT,
2094                                               NS_LOGMODULE_QUERY,
2095                                               ISC_LOG_WARNING,
2096                                               "recursive-clients soft limit "
2097                                               "exceeded, aborting oldest query");
2098                         }
2099                         ns_client_killoldestquery(client);
2100                         result = ISC_R_SUCCESS;
2101                 } else if (result == ISC_R_QUOTA) {
2102                         static isc_stdtime_t last = 0;
2103                         isc_stdtime_t now;
2104                         isc_stdtime_get(&now);
2105                         if (now != last) {
2106                                 last = now;
2107                                 ns_client_log(client, NS_LOGCATEGORY_CLIENT,
2108                                               NS_LOGMODULE_QUERY,
2109                                               ISC_LOG_WARNING,
2110                                               "no more recursive clients: %s",
2111                                               isc_result_totext(result));
2112                         }
2113                         ns_client_killoldestquery(client);
2114                 }
2115                 if (result == ISC_R_SUCCESS && !client->mortal &&
2116                     (client->attributes & NS_CLIENTATTR_TCP) == 0) {
2117                         result = ns_client_replace(client);
2118                         if (result != ISC_R_SUCCESS) {
2119                                 ns_client_log(client, NS_LOGCATEGORY_CLIENT,
2120                                               NS_LOGMODULE_QUERY,
2121                                               ISC_LOG_WARNING,
2122                                               "ns_client_replace() failed: %s",
2123                                               isc_result_totext(result));
2124                                 isc_quota_detach(&client->recursionquota);
2125                         }
2126                 }
2127                 if (result != ISC_R_SUCCESS)
2128                         return (result);
2129                 ns_client_recursing(client);
2130         }
2131
2132         /*
2133          * Invoke the resolver.
2134          */
2135         REQUIRE(nameservers == NULL || nameservers->type == dns_rdatatype_ns);
2136         REQUIRE(client->query.fetch == NULL);
2137
2138         rdataset = query_newrdataset(client);
2139         if (rdataset == NULL)
2140                 return (ISC_R_NOMEMORY);
2141         if (WANTDNSSEC(client)) {
2142                 sigrdataset = query_newrdataset(client);
2143                 if (sigrdataset == NULL) {
2144                         query_putrdataset(client, &rdataset);
2145                         return (ISC_R_NOMEMORY);
2146                 }
2147         } else
2148                 sigrdataset = NULL;
2149
2150         if (client->query.timerset == ISC_FALSE)
2151                 ns_client_settimeout(client, 60);
2152         result = dns_resolver_createfetch(client->view->resolver,
2153                                           client->query.qname,
2154                                           qtype, qdomain, nameservers,
2155                                           NULL, client->query.fetchoptions,
2156                                           client->task,
2157                                           query_resume, client,
2158                                           rdataset, sigrdataset,
2159                                           &client->query.fetch);
2160
2161         if (result == ISC_R_SUCCESS) {
2162                 /*
2163                  * Record that we're waiting for an event.  A client which
2164                  * is shutting down will not be destroyed until all the
2165                  * events have been received.
2166                  */
2167         } else {
2168                 query_putrdataset(client, &rdataset);
2169                 if (sigrdataset != NULL)
2170                         query_putrdataset(client, &sigrdataset);
2171         }
2172
2173         return (result);
2174 }
2175
2176 #define MAX_RESTARTS 16
2177
2178 #define QUERY_ERROR(r) \
2179 do { \
2180         eresult = r; \
2181         want_restart = ISC_FALSE; \
2182 } while (0)
2183
2184 /*
2185  * Extract a network address from the RDATA of an A or AAAA
2186  * record.
2187  *
2188  * Returns:
2189  *      ISC_R_SUCCESS
2190  *      ISC_R_NOTIMPLEMENTED    The rdata is not a known address type.
2191  */
2192 static isc_result_t
2193 rdata_tonetaddr(const dns_rdata_t *rdata, isc_netaddr_t *netaddr) {
2194         struct in_addr ina;
2195         struct in6_addr in6a;
2196
2197         switch (rdata->type) {
2198         case dns_rdatatype_a:
2199                 INSIST(rdata->length == 4);
2200                 memcpy(&ina.s_addr, rdata->data, 4);
2201                 isc_netaddr_fromin(netaddr, &ina);
2202                 return (ISC_R_SUCCESS);
2203         case dns_rdatatype_aaaa:
2204                 INSIST(rdata->length == 16);
2205                 memcpy(in6a.s6_addr, rdata->data, 16);
2206                 isc_netaddr_fromin6(netaddr, &in6a);
2207                 return (ISC_R_SUCCESS);
2208         default:
2209                 return (ISC_R_NOTIMPLEMENTED);
2210         }
2211 }
2212
2213 /*
2214  * Find the sort order of 'rdata' in the topology-like
2215  * ACL forming the second element in a 2-element top-level
2216  * sortlist statement.
2217  */
2218 static int
2219 query_sortlist_order_2element(const dns_rdata_t *rdata, const void *arg) {
2220         isc_netaddr_t netaddr;
2221
2222         if (rdata_tonetaddr(rdata, &netaddr) != ISC_R_SUCCESS)
2223                 return (INT_MAX);
2224         return (ns_sortlist_addrorder2(&netaddr, arg));
2225 }
2226
2227 /*
2228  * Find the sort order of 'rdata' in the matching element
2229  * of a 1-element top-level sortlist statement.
2230  */
2231 static int
2232 query_sortlist_order_1element(const dns_rdata_t *rdata, const void *arg) {
2233         isc_netaddr_t netaddr;
2234
2235         if (rdata_tonetaddr(rdata, &netaddr) != ISC_R_SUCCESS)
2236                 return (INT_MAX);
2237         return (ns_sortlist_addrorder1(&netaddr, arg));
2238 }
2239
2240 /*
2241  * Find the sortlist statement that applies to 'client' and set up
2242  * the sortlist info in in client->message appropriately.
2243  */
2244 static void
2245 setup_query_sortlist(ns_client_t *client) {
2246         isc_netaddr_t netaddr;
2247         dns_rdatasetorderfunc_t order = NULL;
2248         const void *order_arg = NULL;
2249
2250         isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
2251         switch (ns_sortlist_setup(client->view->sortlist,
2252                                &netaddr, &order_arg)) {
2253         case NS_SORTLISTTYPE_1ELEMENT:
2254                 order = query_sortlist_order_1element;
2255                 break;
2256         case NS_SORTLISTTYPE_2ELEMENT:
2257                 order = query_sortlist_order_2element;
2258                 break;
2259         case NS_SORTLISTTYPE_NONE:
2260                 order = NULL;
2261                 break;
2262         default:
2263                 INSIST(0);
2264                 break;
2265         }
2266         dns_message_setsortorder(client->message, order, order_arg);
2267 }
2268
2269 static void
2270 query_addnoqnameproof(ns_client_t *client, dns_rdataset_t *rdataset) {
2271         isc_buffer_t *dbuf, b;
2272         dns_name_t *fname;
2273         dns_rdataset_t *nsec, *nsecsig;
2274         isc_result_t result = ISC_R_NOMEMORY;
2275
2276         CTRACE("query_addnoqnameproof");
2277
2278         fname = NULL;
2279         nsec = NULL;
2280         nsecsig = NULL;
2281
2282         dbuf = query_getnamebuf(client);
2283         if (dbuf == NULL)
2284                 goto cleanup;
2285         fname = query_newname(client, dbuf, &b);
2286         nsec = query_newrdataset(client);
2287         nsecsig = query_newrdataset(client);
2288         if (fname == NULL || nsec == NULL || nsecsig == NULL)
2289                 goto cleanup;
2290
2291         result = dns_rdataset_getnoqname(rdataset, fname, nsec, nsecsig);
2292         RUNTIME_CHECK(result == ISC_R_SUCCESS);
2293
2294         query_addrrset(client, &fname, &nsec, &nsecsig, dbuf,
2295                        DNS_SECTION_AUTHORITY);
2296
2297  cleanup:
2298         if (nsec != NULL)
2299                 query_putrdataset(client, &nsec);
2300         if (nsecsig != NULL)
2301                 query_putrdataset(client, &nsecsig);
2302         if (fname != NULL)
2303                 query_releasename(client, &fname);
2304 }
2305
2306 static inline void
2307 answer_in_glue(ns_client_t *client, dns_rdatatype_t qtype) {
2308         dns_name_t *name;
2309         dns_message_t *msg;
2310         dns_section_t section = DNS_SECTION_ADDITIONAL;
2311         dns_rdataset_t *rdataset = NULL;
2312
2313         msg = client->message;
2314         for (name = ISC_LIST_HEAD(msg->sections[section]);
2315              name != NULL;
2316              name = ISC_LIST_NEXT(name, link))
2317                 if (dns_name_equal(name, client->query.qname)) {
2318                         for (rdataset = ISC_LIST_HEAD(name->list);
2319                              rdataset != NULL;
2320                              rdataset = ISC_LIST_NEXT(rdataset, link))
2321                                 if (rdataset->type == qtype)
2322                                         break;
2323                         break;
2324                 }
2325         if (rdataset != NULL) {
2326                 ISC_LIST_UNLINK(msg->sections[section], name, link);
2327                 ISC_LIST_PREPEND(msg->sections[section], name, link);
2328                 ISC_LIST_UNLINK(name->list, rdataset, link);
2329                 ISC_LIST_PREPEND(name->list, rdataset, link);
2330                 rdataset->attributes |= DNS_RDATASETATTR_REQUIREDGLUE;
2331         }
2332 }
2333
2334 /*
2335  * Do the bulk of query processing for the current query of 'client'.
2336  * If 'event' is non-NULL, we are returning from recursion and 'qtype'
2337  * is ignored.  Otherwise, 'qtype' is the query type.
2338  */
2339 static void
2340 query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
2341 {
2342         dns_db_t *db, *zdb;
2343         dns_dbnode_t *node;
2344         dns_rdatatype_t type;
2345         dns_name_t *fname, *zfname, *tname, *prefix;
2346         dns_rdataset_t *rdataset, *trdataset;
2347         dns_rdataset_t *sigrdataset, *zrdataset, *zsigrdataset;
2348         dns_rdataset_t **sigrdatasetp;
2349         dns_rdata_t rdata = DNS_RDATA_INIT;
2350         dns_rdatasetiter_t *rdsiter;
2351         isc_boolean_t want_restart, authoritative, is_zone, need_wildcardproof;
2352         unsigned int n, nlabels;
2353         dns_namereln_t namereln;
2354         int order;
2355         isc_buffer_t *dbuf;
2356         isc_buffer_t b;
2357         isc_result_t result, eresult;
2358         dns_fixedname_t fixed;
2359         dns_fixedname_t wildcardname;
2360         dns_dbversion_t *version;
2361         dns_zone_t *zone;
2362         dns_rdata_cname_t cname;
2363         dns_rdata_dname_t dname;
2364         unsigned int options;
2365         isc_boolean_t empty_wild;
2366         dns_rdataset_t *noqname;
2367
2368         CTRACE("query_find");
2369
2370         /*
2371          * One-time initialization.
2372          *
2373          * It's especially important to initialize anything that the cleanup
2374          * code might cleanup.
2375          */
2376
2377         eresult = ISC_R_SUCCESS;
2378         fname = NULL;
2379         zfname = NULL;
2380         rdataset = NULL;
2381         zrdataset = NULL;
2382         sigrdataset = NULL;
2383         zsigrdataset = NULL;
2384         node = NULL;
2385         db = NULL;
2386         zdb = NULL;
2387         version = NULL;
2388         zone = NULL;
2389         need_wildcardproof = ISC_FALSE;
2390         empty_wild = ISC_FALSE;
2391         options = 0;
2392
2393         if (event != NULL) {
2394                 /*
2395                  * We're returning from recursion.  Restore the query context
2396                  * and resume.
2397                  */
2398
2399                 want_restart = ISC_FALSE;
2400                 authoritative = ISC_FALSE;
2401                 is_zone = ISC_FALSE;
2402
2403                 qtype = event->qtype;
2404                 if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
2405                         type = dns_rdatatype_any;
2406                 else
2407                         type = qtype;
2408                 db = event->db;
2409                 node = event->node;
2410                 rdataset = event->rdataset;
2411                 sigrdataset = event->sigrdataset;
2412
2413                 /*
2414                  * We'll need some resources...
2415                  */
2416                 dbuf = query_getnamebuf(client);
2417                 if (dbuf == NULL) {
2418                         QUERY_ERROR(DNS_R_SERVFAIL);
2419                         goto cleanup;
2420                 }
2421                 fname = query_newname(client, dbuf, &b);
2422                 if (fname == NULL) {
2423                         QUERY_ERROR(DNS_R_SERVFAIL);
2424                         goto cleanup;
2425                 }
2426                 tname = dns_fixedname_name(&event->foundname);
2427                 result = dns_name_copy(tname, fname, NULL);
2428                 if (result != ISC_R_SUCCESS) {
2429                         QUERY_ERROR(DNS_R_SERVFAIL);
2430                         goto cleanup;
2431                 }
2432
2433                 result = event->result;
2434
2435                 goto resume;
2436         }
2437
2438         /*
2439          * Not returning from recursion.
2440          */
2441
2442         /*
2443          * If it's a SIG query, we'll iterate the node.
2444          */
2445         if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
2446                 type = dns_rdatatype_any;
2447         else
2448                 type = qtype;
2449
2450  restart:
2451         CTRACE("query_find: restart");
2452         want_restart = ISC_FALSE;
2453         authoritative = ISC_FALSE;
2454         version = NULL;
2455         need_wildcardproof = ISC_FALSE;
2456
2457         if (client->view->checknames &&
2458             !dns_rdata_checkowner(client->query.qname,
2459                                   client->message->rdclass,
2460                                   qtype, ISC_FALSE)) {
2461                 char namebuf[DNS_NAME_FORMATSIZE];
2462                 char typename[DNS_RDATATYPE_FORMATSIZE];
2463                 char classname[DNS_RDATACLASS_FORMATSIZE];
2464
2465                 dns_name_format(client->query.qname, namebuf, sizeof(namebuf));
2466                 dns_rdatatype_format(qtype, typename, sizeof(typename));
2467                 dns_rdataclass_format(client->message->rdclass, classname,
2468                                       sizeof(classname));
2469                 ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
2470                               NS_LOGMODULE_QUERY, ISC_LOG_ERROR,
2471                               "check-names failure %s/%s/%s", namebuf,
2472                               typename, classname);
2473                 QUERY_ERROR(DNS_R_REFUSED);
2474                 goto cleanup;
2475         }
2476
2477         /*
2478          * First we must find the right database.
2479          */
2480         options &= DNS_GETDB_NOLOG; /* Preserve DNS_GETDB_NOLOG. */
2481         if (dns_rdatatype_atparent(qtype) &&
2482             !dns_name_equal(client->query.qname, dns_rootname))
2483                 options |= DNS_GETDB_NOEXACT;
2484         result = query_getdb(client, client->query.qname, qtype, options,
2485                              &zone, &db, &version, &is_zone);
2486         if ((result != ISC_R_SUCCESS || !is_zone) && !RECURSIONOK(client) &&
2487             (options & DNS_GETDB_NOEXACT) != 0 && qtype == dns_rdatatype_ds) {
2488                 /*
2489                  * Look to see if we are authoritative for the
2490                  * child zone if the query type is DS.
2491                  */
2492                 dns_db_t *tdb = NULL;
2493                 dns_zone_t *tzone = NULL;
2494                 dns_dbversion_t *tversion = NULL;
2495                 isc_result_t tresult;
2496
2497                 tresult = query_getzonedb(client, client->query.qname, qtype,
2498                                          DNS_GETDB_PARTIAL, &tzone, &tdb,
2499                                          &tversion);
2500                 if (tresult == ISC_R_SUCCESS) {
2501                         options &= ~DNS_GETDB_NOEXACT;
2502                         query_putrdataset(client, &rdataset);
2503                         if (db != NULL)
2504                                 dns_db_detach(&db);
2505                         if (zone != NULL)
2506                                 dns_zone_detach(&zone);
2507                         version = tversion;
2508                         db = tdb;
2509                         zone = tzone;
2510                         is_zone = ISC_TRUE;
2511                         result = ISC_R_SUCCESS;
2512                 } else {
2513                         if (tdb != NULL)
2514                                 dns_db_detach(&tdb);
2515                         if (tzone != NULL)
2516                                 dns_zone_detach(&tzone);
2517                 }
2518         }
2519         if (result != ISC_R_SUCCESS) {
2520                 if (result == DNS_R_REFUSED) {
2521                         if (!PARTIALANSWER(client))
2522                                 QUERY_ERROR(DNS_R_REFUSED);
2523                 } else
2524                         QUERY_ERROR(DNS_R_SERVFAIL);
2525                 goto cleanup;
2526         }
2527
2528         if (is_zone)
2529                 authoritative = ISC_TRUE;
2530
2531         if (event == NULL && client->query.restarts == 0) {
2532                 if (is_zone) {
2533                         dns_zone_attach(zone, &client->query.authzone);
2534                         dns_db_attach(db, &client->query.authdb);
2535                 }
2536                 client->query.authdbset = ISC_TRUE;
2537         }
2538
2539  db_find:
2540         CTRACE("query_find: db_find");
2541         /*
2542          * We'll need some resources...
2543          */
2544         dbuf = query_getnamebuf(client);
2545         if (dbuf == NULL) {
2546                 QUERY_ERROR(DNS_R_SERVFAIL);
2547                 goto cleanup;
2548         }
2549         fname = query_newname(client, dbuf, &b);
2550         rdataset = query_newrdataset(client);
2551         if (fname == NULL || rdataset == NULL) {
2552                 QUERY_ERROR(DNS_R_SERVFAIL);
2553                 goto cleanup;
2554         }
2555         if (WANTDNSSEC(client)) {
2556                 sigrdataset = query_newrdataset(client);
2557                 if (sigrdataset == NULL) {
2558                         QUERY_ERROR(DNS_R_SERVFAIL);
2559                         goto cleanup;
2560                 }
2561         }
2562
2563         /*
2564          * Now look for an answer in the database.
2565          */
2566         result = dns_db_find(db, client->query.qname, version, type,
2567                              client->query.dboptions, client->now,
2568                              &node, fname, rdataset, sigrdataset);
2569
2570  resume:
2571         CTRACE("query_find: resume");
2572         switch (result) {
2573         case ISC_R_SUCCESS:
2574                 /*
2575                  * This case is handled in the main line below.
2576                  */
2577                 break;
2578         case DNS_R_GLUE:
2579         case DNS_R_ZONECUT:
2580                 /*
2581                  * These cases are handled in the main line below.
2582                  */
2583                 INSIST(is_zone);
2584                 authoritative = ISC_FALSE;
2585                 break;
2586         case ISC_R_NOTFOUND:
2587                 /*
2588                  * The cache doesn't even have the root NS.  Get them from
2589                  * the hints DB.
2590                  */
2591                 INSIST(!is_zone);
2592                 if (db != NULL)
2593                         dns_db_detach(&db);
2594
2595                 if (client->view->hints == NULL) {
2596                         /* We have no hints. */
2597                         result = ISC_R_FAILURE;
2598                 } else {
2599                         dns_db_attach(client->view->hints, &db);
2600                         result = dns_db_find(db, dns_rootname,
2601                                              NULL, dns_rdatatype_ns,
2602                                              0, client->now, &node, fname,
2603                                              rdataset, sigrdataset);
2604                 }
2605                 if (result != ISC_R_SUCCESS) {
2606                         /*
2607                          * Nonsensical root hints may require cleanup.
2608                          */
2609                         if (dns_rdataset_isassociated(rdataset))
2610                                 dns_rdataset_disassociate(rdataset);
2611                         if (sigrdataset != NULL &&
2612                             dns_rdataset_isassociated(sigrdataset))
2613                                 dns_rdataset_disassociate(sigrdataset);
2614                         if (node != NULL)
2615                                 dns_db_detachnode(db, &node);
2616
2617                         /*
2618                          * We don't have any root server hints, but
2619                          * we may have working forwarders, so try to
2620                          * recurse anyway.
2621                          */
2622                         if (RECURSIONOK(client)) {
2623                                 result = query_recurse(client, qtype,
2624                                                        NULL, NULL);
2625                                 if (result == ISC_R_SUCCESS)
2626                                         client->query.attributes |=
2627                                                 NS_QUERYATTR_RECURSING;
2628                                 else {
2629                                         /* Unable to recurse. */
2630                                         QUERY_ERROR(DNS_R_SERVFAIL);
2631                                 }
2632                                 goto cleanup;
2633                         } else {
2634                                 /* Unable to give root server referral. */
2635                                 QUERY_ERROR(DNS_R_SERVFAIL);
2636                                 goto cleanup;
2637                         }
2638                 }
2639                 /*
2640                  * XXXRTH  We should trigger root server priming here.
2641                  */
2642                 /* FALLTHROUGH */
2643         case DNS_R_DELEGATION:
2644                 authoritative = ISC_FALSE;
2645                 if (is_zone) {
2646                         /*
2647                          * Look to see if we are authoritative for the
2648                          * child zone if the query type is DS.
2649                          */
2650                         if (!RECURSIONOK(client) &&
2651                             (options & DNS_GETDB_NOEXACT) != 0 &&
2652                             qtype == dns_rdatatype_ds) {
2653                                 dns_db_t *tdb = NULL;
2654                                 dns_zone_t *tzone = NULL;
2655                                 dns_dbversion_t *tversion = NULL;
2656                                 result = query_getzonedb(client,
2657                                                          client->query.qname,
2658                                                          qtype,
2659                                                          DNS_GETDB_PARTIAL,
2660                                                          &tzone, &tdb,
2661                                                          &tversion);
2662                                 if (result == ISC_R_SUCCESS) {
2663                                         options &= ~DNS_GETDB_NOEXACT;
2664                                         query_putrdataset(client, &rdataset);
2665                                         if (sigrdataset != NULL)
2666                                                 query_putrdataset(client,
2667                                                                   &sigrdataset);
2668                                         if (fname != NULL)
2669                                                 query_releasename(client,
2670                                                                   &fname);
2671                                         if (node != NULL)
2672                                                 dns_db_detachnode(db, &node);
2673                                         if (db != NULL)
2674                                                 dns_db_detach(&db);
2675                                         if (zone != NULL)
2676                                                 dns_zone_detach(&zone);
2677                                         version = tversion;
2678                                         db = tdb;
2679                                         zone = tzone;
2680                                         authoritative = ISC_TRUE;
2681                                         goto db_find;
2682                                 }
2683                                 if (tdb != NULL)
2684                                         dns_db_detach(&tdb);
2685                                 if (tzone != NULL)
2686                                         dns_zone_detach(&tzone);
2687                         }
2688                         /*
2689                          * We're authoritative for an ancestor of QNAME.
2690                          */
2691                         if (!USECACHE(client) || !RECURSIONOK(client)) {
2692                                 /*
2693                                  * If we don't have a cache, this is the best
2694                                  * answer.
2695                                  *
2696                                  * If the client is making a nonrecursive
2697                                  * query we always give out the authoritative
2698                                  * delegation.  This way even if we get
2699                                  * junk in our cache, we won't fail in our
2700                                  * role as the delegating authority if another
2701                                  * nameserver asks us about a delegated
2702                                  * subzone.
2703                                  *
2704                                  * We enable the retrieval of glue for this
2705                                  * database by setting client->query.gluedb.
2706                                  */
2707                                 client->query.gluedb = db;
2708                                 client->query.isreferral = ISC_TRUE;
2709                                 /*
2710                                  * We must ensure NOADDITIONAL is off,
2711                                  * because the generation of
2712                                  * additional data is required in
2713                                  * delegations.
2714                                  */
2715                                 client->query.attributes &=
2716                                         ~NS_QUERYATTR_NOADDITIONAL;
2717                                 if (sigrdataset != NULL)
2718                                         sigrdatasetp = &sigrdataset;
2719                                 else
2720                                         sigrdatasetp = NULL;
2721                                 query_addrrset(client, &fname,
2722                                                &rdataset, sigrdatasetp,
2723                                                dbuf, DNS_SECTION_AUTHORITY);
2724                                 client->query.gluedb = NULL;
2725                                 if (WANTDNSSEC(client) && dns_db_issecure(db))
2726                                         query_addds(client, db, node);
2727                         } else {
2728                                 /*
2729                                  * We might have a better answer or delegation
2730                                  * in the cache.  We'll remember the current
2731                                  * values of fname, rdataset, and sigrdataset.
2732                                  * We'll then go looking for QNAME in the
2733                                  * cache.  If we find something better, we'll
2734                                  * use it instead.
2735                                  */
2736                                 query_keepname(client, fname, dbuf);
2737                                 zdb = db;
2738                                 zfname = fname;
2739                                 fname = NULL;
2740                                 zrdataset = rdataset;
2741                                 rdataset = NULL;
2742                                 zsigrdataset = sigrdataset;
2743                                 sigrdataset = NULL;
2744                                 dns_db_detachnode(db, &node);
2745                                 version = NULL;
2746                                 db = NULL;
2747                                 dns_db_attach(client->view->cachedb, &db);
2748                                 is_zone = ISC_FALSE;
2749                                 goto db_find;
2750                         }
2751                 } else {
2752                         if (zfname != NULL &&
2753                             !dns_name_issubdomain(fname, zfname)) {
2754                                 /*
2755                                  * We've already got a delegation from
2756                                  * authoritative data, and it is better
2757                                  * than what we found in the cache.  Use
2758                                  * it instead of the cache delegation.
2759                                  */
2760                                 query_releasename(client, &fname);
2761                                 fname = zfname;
2762                                 zfname = NULL;
2763                                 /*
2764                                  * We've already done query_keepname() on
2765                                  * zfname, so we must set dbuf to NULL to
2766                                  * prevent query_addrrset() from trying to
2767                                  * call query_keepname() again.
2768                                  */
2769                                 dbuf = NULL;
2770                                 query_putrdataset(client, &rdataset);
2771                                 if (sigrdataset != NULL)
2772                                         query_putrdataset(client,
2773                                                           &sigrdataset);
2774                                 rdataset = zrdataset;
2775                                 zrdataset = NULL;
2776                                 sigrdataset = zsigrdataset;
2777                                 zsigrdataset = NULL;
2778                                 /*
2779                                  * We don't clean up zdb here because we
2780                                  * may still need it.  It will get cleaned
2781                                  * up by the main cleanup code.
2782                                  */
2783                         }
2784
2785                         if (RECURSIONOK(client)) {
2786                                 /*
2787                                  * Recurse!
2788                                  */
2789                                 if (dns_rdatatype_atparent(type))
2790                                         result = query_recurse(client, qtype,
2791                                                                NULL, NULL);
2792                                 else
2793                                         result = query_recurse(client, qtype,
2794                                                                fname, rdataset);
2795                                 if (result == ISC_R_SUCCESS)
2796                                         client->query.attributes |=
2797                                                 NS_QUERYATTR_RECURSING;
2798                                 else
2799                                         QUERY_ERROR(DNS_R_SERVFAIL);
2800                         } else {
2801                                 /*
2802                                  * This is the best answer.
2803                                  */
2804                                 client->query.attributes |=
2805                                         NS_QUERYATTR_CACHEGLUEOK;
2806                                 client->query.gluedb = zdb;
2807                                 client->query.isreferral = ISC_TRUE;
2808                                 /*
2809                                  * We must ensure NOADDITIONAL is off,
2810                                  * because the generation of
2811                                  * additional data is required in
2812                                  * delegations.
2813                                  */
2814                                 client->query.attributes &=
2815                                         ~NS_QUERYATTR_NOADDITIONAL;
2816                                 if (sigrdataset != NULL)
2817                                         sigrdatasetp = &sigrdataset;
2818                                 else
2819                                         sigrdatasetp = NULL;
2820                                 query_addrrset(client, &fname,
2821                                                &rdataset, sigrdatasetp,
2822                                                dbuf, DNS_SECTION_AUTHORITY);
2823                                 client->query.gluedb = NULL;
2824                                 client->query.attributes &=
2825                                         ~NS_QUERYATTR_CACHEGLUEOK;
2826                                 if (WANTDNSSEC(client))
2827                                         query_addds(client, db, node);
2828                         }
2829                 }
2830                 goto cleanup;
2831         case DNS_R_EMPTYNAME:
2832                 result = DNS_R_NXRRSET;
2833                 /* FALLTHROUGH */
2834         case DNS_R_NXRRSET:
2835                 INSIST(is_zone);
2836                 if (dns_rdataset_isassociated(rdataset)) {
2837                         /*
2838                          * If we've got a NSEC record, we need to save the
2839                          * name now because we're going call query_addsoa()
2840                          * below, and it needs to use the name buffer.
2841                          */
2842                         query_keepname(client, fname, dbuf);
2843                 } else {
2844                         /*
2845                          * We're not going to use fname, and need to release
2846                          * our hold on the name buffer so query_addsoa()
2847                          * may use it.
2848                          */
2849                         query_releasename(client, &fname);
2850                 }
2851                 /*
2852                  * Add SOA.
2853                  */
2854                 result = query_addsoa(client, db, ISC_FALSE);
2855                 if (result != ISC_R_SUCCESS) {
2856                         QUERY_ERROR(result);
2857                         goto cleanup;
2858                 }
2859                 /*
2860                  * Add NSEC record if we found one.
2861                  */
2862                 if (WANTDNSSEC(client)) {
2863                         if (dns_rdataset_isassociated(rdataset))
2864                                 query_addnxrrsetnsec(client, db, &fname,
2865                                                     &rdataset, &sigrdataset);
2866                 }
2867                 goto cleanup;
2868         case DNS_R_EMPTYWILD:
2869                 empty_wild = ISC_TRUE;
2870                 /* FALLTHROUGH */
2871         case DNS_R_NXDOMAIN:
2872                 INSIST(is_zone);
2873                 if (dns_rdataset_isassociated(rdataset)) {
2874                         /*
2875                          * If we've got a NSEC record, we need to save the
2876                          * name now because we're going call query_addsoa()
2877                          * below, and it needs to use the name buffer.
2878                          */
2879                         query_keepname(client, fname, dbuf);
2880                 } else {
2881                         /*
2882                          * We're not going to use fname, and need to release
2883                          * our hold on the name buffer so query_addsoa()
2884                          * may use it.
2885                          */
2886                         query_releasename(client, &fname);
2887                 }
2888                 /*
2889                  * Add SOA.  If the query was for a SOA record force the
2890                  * ttl to zero so that it is possible for clients to find
2891                  * the containing zone of an arbitrary name with a stub
2892                  * resolver and not have it cached.
2893                  */
2894                 if (qtype == dns_rdatatype_soa)
2895                         result = query_addsoa(client, db, ISC_TRUE);
2896                 else
2897                         result = query_addsoa(client, db, ISC_FALSE);
2898                 if (result != ISC_R_SUCCESS) {
2899                         QUERY_ERROR(result);
2900                         goto cleanup;
2901                 }
2902                 /*
2903                  * Add NSEC record if we found one.
2904                  */
2905                 if (dns_rdataset_isassociated(rdataset)) {
2906                         if (WANTDNSSEC(client)) {
2907                                 query_addrrset(client, &fname, &rdataset,
2908                                                &sigrdataset,
2909                                                NULL, DNS_SECTION_AUTHORITY);
2910                                 query_addwildcardproof(client, db,
2911                                                        client->query.qname,
2912                                                        ISC_FALSE);
2913                         }
2914                 }
2915                 /*
2916                  * Set message rcode.
2917                  */
2918                 if (empty_wild)
2919                         client->message->rcode = dns_rcode_noerror;
2920                 else
2921                         client->message->rcode = dns_rcode_nxdomain;
2922                 goto cleanup;
2923         case DNS_R_NCACHENXDOMAIN:
2924         case DNS_R_NCACHENXRRSET:
2925                 INSIST(!is_zone);
2926                 authoritative = ISC_FALSE;
2927                 /*
2928                  * Set message rcode, if required.
2929                  */
2930                 if (result == DNS_R_NCACHENXDOMAIN)
2931                         client->message->rcode = dns_rcode_nxdomain;
2932                 /*
2933                  * We don't call query_addrrset() because we don't need any
2934                  * of its extra features (and things would probably break!).
2935                  */
2936                 query_keepname(client, fname, dbuf);
2937                 dns_message_addname(client->message, fname,
2938                                     DNS_SECTION_AUTHORITY);
2939                 ISC_LIST_APPEND(fname->list, rdataset, link);
2940                 fname = NULL;
2941                 rdataset = NULL;
2942                 goto cleanup;
2943         case DNS_R_CNAME:
2944                 /*
2945                  * Keep a copy of the rdataset.  We have to do this because
2946                  * query_addrrset may clear 'rdataset' (to prevent the
2947                  * cleanup code from cleaning it up).
2948                  */
2949                 trdataset = rdataset;
2950                 /*
2951                  * Add the CNAME to the answer section.
2952                  */
2953                 if (sigrdataset != NULL)
2954                         sigrdatasetp = &sigrdataset;
2955                 else
2956                         sigrdatasetp = NULL;
2957                 if (WANTDNSSEC(client) &&
2958                     (fname->attributes & DNS_NAMEATTR_WILDCARD) != 0)
2959                 {
2960                         dns_fixedname_init(&wildcardname);
2961                         dns_name_copy(fname, dns_fixedname_name(&wildcardname),
2962                                       NULL);
2963                         need_wildcardproof = ISC_TRUE;
2964                 }
2965                 if ((rdataset->attributes & DNS_RDATASETATTR_NOQNAME) != 0 &&
2966                      WANTDNSSEC(client))
2967                         noqname = rdataset;
2968                 else
2969                         noqname = NULL;
2970                 query_addrrset(client, &fname, &rdataset, sigrdatasetp, dbuf,
2971                                DNS_SECTION_ANSWER);
2972                 if (noqname != NULL)
2973                         query_addnoqnameproof(client, noqname);
2974                 /*
2975                  * We set the PARTIALANSWER attribute so that if anything goes
2976                  * wrong later on, we'll return what we've got so far.
2977                  */
2978                 client->query.attributes |= NS_QUERYATTR_PARTIALANSWER;
2979                 /*
2980                  * Reset qname to be the target name of the CNAME and restart
2981                  * the query.
2982                  */
2983                 tname = NULL;
2984                 result = dns_message_gettempname(client->message, &tname);
2985                 if (result != ISC_R_SUCCESS)
2986                         goto cleanup;
2987                 result = dns_rdataset_first(trdataset);
2988                 if (result != ISC_R_SUCCESS) {
2989                         dns_message_puttempname(client->message, &tname);
2990                         goto cleanup;
2991                 }
2992                 dns_rdataset_current(trdataset, &rdata);
2993                 result = dns_rdata_tostruct(&rdata, &cname, NULL);
2994                 dns_rdata_reset(&rdata);
2995                 if (result != ISC_R_SUCCESS) {
2996                         dns_message_puttempname(client->message, &tname);
2997                         goto cleanup;
2998                 }
2999                 dns_name_init(tname, NULL);
3000                 result = dns_name_dup(&cname.cname, client->mctx, tname);
3001                 if (result != ISC_R_SUCCESS) {
3002                         dns_message_puttempname(client->message, &tname);
3003                         dns_rdata_freestruct(&cname);
3004                         goto cleanup;
3005                 }
3006                 dns_rdata_freestruct(&cname);
3007                 ns_client_qnamereplace(client, tname);
3008                 want_restart = ISC_TRUE;
3009                 if (!WANTRECURSION(client))
3010                         options |= DNS_GETDB_NOLOG;
3011                 goto addauth;
3012         case DNS_R_DNAME:
3013                 /*
3014                  * Compare the current qname to the found name.  We need
3015                  * to know how many labels and bits are in common because
3016                  * we're going to have to split qname later on.
3017                  */
3018                 namereln = dns_name_fullcompare(client->query.qname, fname,
3019                                                 &order, &nlabels);
3020                 INSIST(namereln == dns_namereln_subdomain);
3021                 /*
3022                  * Keep a copy of the rdataset.  We have to do this because
3023                  * query_addrrset may clear 'rdataset' (to prevent the
3024                  * cleanup code from cleaning it up).
3025                  */
3026                 trdataset = rdataset;
3027                 /*
3028                  * Add the DNAME to the answer section.
3029                  */
3030                 if (sigrdataset != NULL)
3031                         sigrdatasetp = &sigrdataset;
3032                 else
3033                         sigrdatasetp = NULL;
3034                 if (WANTDNSSEC(client) &&
3035                     (fname->attributes & DNS_NAMEATTR_WILDCARD) != 0)
3036                 {
3037                         dns_fixedname_init(&wildcardname);
3038                         dns_name_copy(fname, dns_fixedname_name(&wildcardname),
3039                                       NULL);
3040                         need_wildcardproof = ISC_TRUE;
3041                 }
3042                 query_addrrset(client, &fname, &rdataset, sigrdatasetp, dbuf,
3043                                DNS_SECTION_ANSWER);
3044                 /*
3045                  * We set the PARTIALANSWER attribute so that if anything goes
3046                  * wrong later on, we'll return what we've got so far.
3047                  */
3048                 client->query.attributes |= NS_QUERYATTR_PARTIALANSWER;
3049                 /*
3050                  * Get the target name of the DNAME.
3051                  */
3052                 tname = NULL;
3053                 result = dns_message_gettempname(client->message, &tname);
3054                 if (result != ISC_R_SUCCESS)
3055                         goto cleanup;
3056                 result = dns_rdataset_first(trdataset);
3057                 if (result != ISC_R_SUCCESS) {
3058                         dns_message_puttempname(client->message, &tname);
3059                         goto cleanup;
3060                 }
3061                 dns_rdataset_current(trdataset, &rdata);
3062                 result = dns_rdata_tostruct(&rdata, &dname, NULL);
3063                 dns_rdata_reset(&rdata);
3064                 if (result != ISC_R_SUCCESS) {
3065                         dns_message_puttempname(client->message, &tname);
3066                         goto cleanup;
3067                 }
3068                 dns_name_init(tname, NULL);
3069                 dns_name_clone(&dname.dname, tname);
3070                 dns_rdata_freestruct(&dname);
3071                 /*
3072                  * Construct the new qname.
3073                  */
3074                 dns_fixedname_init(&fixed);
3075                 prefix = dns_fixedname_name(&fixed);
3076                 dns_name_split(client->query.qname, nlabels, prefix, NULL);
3077                 INSIST(fname == NULL);
3078                 dbuf = query_getnamebuf(client);
3079                 if (dbuf == NULL) {
3080                         dns_message_puttempname(client->message, &tname);
3081                         goto cleanup;
3082                 }
3083                 fname = query_newname(client, dbuf, &b);
3084                 if (fname == NULL) {
3085                         dns_message_puttempname(client->message, &tname);
3086                         goto cleanup;
3087                 }
3088                 result = dns_name_concatenate(prefix, tname, fname, NULL);
3089                 if (result != ISC_R_SUCCESS) {
3090                         dns_message_puttempname(client->message, &tname);
3091                         if (result == ISC_R_NOSPACE) {
3092                                 /*
3093                                  * RFC 2672, section 4.1, subsection 3c says
3094                                  * we should return YXDOMAIN if the constructed
3095                                  * name would be too long.
3096                                  */
3097                                 client->message->rcode = dns_rcode_yxdomain;
3098                         }
3099                         goto cleanup;
3100                 }
3101                 query_keepname(client, fname, dbuf);
3102                 /*
3103                  * Synthesize a CNAME for this DNAME.
3104                  *
3105                  * We want to synthesize a CNAME since if we don't
3106                  * then older software that doesn't understand DNAME
3107                  * will not chain like it should.
3108                  *
3109                  * We do not try to synthesize a signature because we hope
3110                  * that security aware servers will understand DNAME.  Also,
3111                  * even if we had an online key, making a signature
3112                  * on-the-fly is costly, and not really legitimate anyway
3113                  * since the synthesized CNAME is NOT in the zone.
3114                  */
3115                 dns_name_init(tname, NULL);
3116                 (void)query_addcnamelike(client, client->query.qname, fname,
3117                                          trdataset->trust, &tname,
3118                                          dns_rdatatype_cname);
3119                 if (tname != NULL)
3120                         dns_message_puttempname(client->message, &tname);
3121                 /*
3122                  * Switch to the new qname and restart.
3123                  */
3124                 ns_client_qnamereplace(client, fname);
3125                 fname = NULL;
3126                 want_restart = ISC_TRUE;
3127                 if (!WANTRECURSION(client))
3128                         options |= DNS_GETDB_NOLOG;
3129                 goto addauth;
3130         default:
3131                 /*
3132                  * Something has gone wrong.
3133                  */
3134                 QUERY_ERROR(DNS_R_SERVFAIL);
3135                 goto cleanup;
3136         }
3137
3138         if (WANTDNSSEC(client) &&
3139             (fname->attributes & DNS_NAMEATTR_WILDCARD) != 0)
3140         {
3141                 dns_fixedname_init(&wildcardname);
3142                 dns_name_copy(fname, dns_fixedname_name(&wildcardname), NULL);
3143                 need_wildcardproof = ISC_TRUE;
3144         }
3145
3146         if (type == dns_rdatatype_any) {
3147                 /*
3148                  * XXXRTH  Need to handle zonecuts with special case
3149                  * code.
3150                  */
3151                 n = 0;
3152                 rdsiter = NULL;
3153                 result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);
3154                 if (result != ISC_R_SUCCESS) {
3155                         QUERY_ERROR(DNS_R_SERVFAIL);
3156                         goto cleanup;
3157                 }
3158                 /*
3159                  * Calling query_addrrset() with a non-NULL dbuf is going
3160                  * to either keep or release the name.  We don't want it to
3161                  * release fname, since we may have to call query_addrrset()
3162                  * more than once.  That means we have to call query_keepname()
3163                  * now, and pass a NULL dbuf to query_addrrset().
3164                  *
3165                  * If we do a query_addrrset() below, we must set fname to
3166                  * NULL before leaving this block, otherwise we might try to
3167                  * cleanup fname even though we're using it!
3168                  */
3169                 query_keepname(client, fname, dbuf);
3170                 tname = fname;
3171                 result = dns_rdatasetiter_first(rdsiter);
3172                 while (result == ISC_R_SUCCESS) {
3173                         dns_rdatasetiter_current(rdsiter, rdataset);
3174                         if ((qtype == dns_rdatatype_any ||
3175                              rdataset->type == qtype) && rdataset->type != 0) {
3176                                 query_addrrset(client,
3177                                                fname != NULL ? &fname : &tname,
3178                                                &rdataset, NULL,
3179                                                NULL, DNS_SECTION_ANSWER);
3180                                 n++;
3181                                 INSIST(tname != NULL);
3182                                 /*
3183                                  * rdataset is non-NULL only in certain pathological
3184                                  * cases involving DNAMEs.
3185                                  */
3186                                 if (rdataset != NULL)
3187                                         query_putrdataset(client, &rdataset);
3188                                 rdataset = query_newrdataset(client);
3189                                 if (rdataset == NULL)
3190                                         break;
3191                         } else {
3192                                 /*
3193                                  * We're not interested in this rdataset.
3194                                  */
3195                                 dns_rdataset_disassociate(rdataset);
3196                         }
3197                         result = dns_rdatasetiter_next(rdsiter);
3198                 }
3199
3200                 if (fname != NULL)
3201                         dns_message_puttempname(client->message, &fname);
3202
3203                 if (n == 0) {
3204                         /*
3205                          * We didn't match any rdatasets.
3206                          */
3207                         if (qtype == dns_rdatatype_rrsig &&
3208                             result == ISC_R_NOMORE) {
3209                                 /*
3210                                  * XXXRTH  If this is a secure zone and we
3211                                  * didn't find any SIGs, we should generate
3212                                  * an error unless we were searching for
3213                                  * glue.  Ugh.
3214                                  */
3215                                 /*
3216                                  * We were searching for SIG records in
3217                                  * a nonsecure zone.  Send a "no error,
3218                                  * no data" response.
3219                                  */
3220                                 /*
3221                                  * Add SOA.
3222                                  */
3223                                 result = query_addsoa(client, db, ISC_FALSE);
3224                                 if (result == ISC_R_SUCCESS)
3225                                         result = ISC_R_NOMORE;
3226                         } else {
3227                                 /*
3228                                  * Something went wrong.
3229                                  */
3230                                 result = DNS_R_SERVFAIL;
3231                         }
3232                 }
3233                 dns_rdatasetiter_destroy(&rdsiter);
3234                 if (result != ISC_R_NOMORE) {
3235                         QUERY_ERROR(DNS_R_SERVFAIL);
3236                         goto cleanup;
3237                 }
3238         } else {
3239                 /*
3240                  * This is the "normal" case -- an ordinary question to which
3241                  * we know the answer.
3242                  */
3243                 if (sigrdataset != NULL)
3244                         sigrdatasetp = &sigrdataset;
3245                 else
3246                         sigrdatasetp = NULL;
3247                 if ((rdataset->attributes & DNS_RDATASETATTR_NOQNAME) != 0 &&
3248                      WANTDNSSEC(client))
3249                         noqname = rdataset;
3250                 else
3251                         noqname = NULL;
3252                 query_addrrset(client, &fname, &rdataset, sigrdatasetp, dbuf,
3253                                DNS_SECTION_ANSWER);
3254                 if (noqname != NULL)
3255                         query_addnoqnameproof(client, noqname);
3256                 /*
3257                  * We shouldn't ever fail to add 'rdataset'
3258                  * because it's already in the answer.
3259                  */
3260                 INSIST(rdataset == NULL);
3261         }
3262
3263  addauth:
3264         CTRACE("query_find: addauth");
3265         /*
3266          * Add NS records to the authority section (if we haven't already
3267          * added them to the answer section).
3268          */
3269         if (!want_restart && !NOAUTHORITY(client)) {
3270                 if (is_zone) {
3271                         if (!((qtype == dns_rdatatype_ns ||
3272                                qtype == dns_rdatatype_any) &&
3273                               dns_name_equal(client->query.qname,
3274                                              dns_db_origin(db))))
3275                                 (void)query_addns(client, db);
3276                 } else if (qtype != dns_rdatatype_ns) {
3277                         if (fname != NULL)
3278                                 query_releasename(client, &fname);
3279                         query_addbestns(client);
3280                 }
3281         }
3282
3283         /*
3284          * Add NSEC records to the authority section if they're needed for
3285          * DNSSEC wildcard proofs.
3286          */
3287         if (need_wildcardproof && dns_db_issecure(db))
3288                 query_addwildcardproof(client, db,
3289                                        dns_fixedname_name(&wildcardname),
3290                                        ISC_TRUE);
3291  cleanup:
3292         CTRACE("query_find: cleanup");
3293         /*
3294          * General cleanup.
3295          */
3296         if (rdataset != NULL)
3297                 query_putrdataset(client, &rdataset);
3298         if (sigrdataset != NULL)
3299                 query_putrdataset(client, &sigrdataset);
3300         if (fname != NULL)
3301                 query_releasename(client, &fname);
3302         if (node != NULL)
3303                 dns_db_detachnode(db, &node);
3304         if (db != NULL)
3305                 dns_db_detach(&db);
3306         if (zone != NULL)
3307                 dns_zone_detach(&zone);
3308         if (zdb != NULL) {
3309                 query_putrdataset(client, &zrdataset);
3310                 if (zsigrdataset != NULL)
3311                         query_putrdataset(client, &zsigrdataset);
3312                 if (zfname != NULL)
3313                         query_releasename(client, &zfname);
3314                 dns_db_detach(&zdb);
3315         }
3316         if (event != NULL)
3317                 isc_event_free(ISC_EVENT_PTR(&event));
3318
3319         /*
3320          * AA bit.
3321          */
3322         if (client->query.restarts == 0 && !authoritative) {
3323                 /*
3324                  * We're not authoritative, so we must ensure the AA bit
3325                  * isn't set.
3326                  */
3327                 client->message->flags &= ~DNS_MESSAGEFLAG_AA;
3328         }
3329
3330         /*
3331          * Restart the query?
3332          */
3333         if (want_restart && client->query.restarts < MAX_RESTARTS) {
3334                 client->query.restarts++;
3335                 goto restart;
3336         }
3337
3338         if (eresult != ISC_R_SUCCESS &&
3339             (!PARTIALANSWER(client) || WANTRECURSION(client))) {
3340                 /*
3341                  * If we don't have any answer to give the client,
3342                  * or if the client requested recursion and thus wanted
3343                  * the complete answer, send an error response.
3344                  */
3345                  query_error(client, eresult);
3346                  ns_client_detach(&client);
3347         } else if (!RECURSING(client)) {
3348                 /*
3349                  * We are done.  Set up sortlist data for the message
3350                  * rendering code, make a final tweak to the AA bit if the
3351                  * auth-nxdomain config option says so, then render and
3352                  * send the response.
3353                  */
3354                 setup_query_sortlist(client);
3355
3356                 /*
3357                  * If this is a referral and the answer to the question
3358                  * is in the glue sort it to the start of the additional
3359                  * section.
3360                  */
3361                 if (client->message->counts[DNS_SECTION_ANSWER] == 0 &&
3362                     client->message->rcode == dns_rcode_noerror &&
3363                     (qtype == dns_rdatatype_a || qtype == dns_rdatatype_aaaa))
3364                         answer_in_glue(client, qtype);
3365
3366                 if (client->message->rcode == dns_rcode_nxdomain &&
3367                     client->view->auth_nxdomain == ISC_TRUE)
3368                         client->message->flags |= DNS_MESSAGEFLAG_AA;
3369
3370                 query_send(client);
3371                 ns_client_detach(&client);
3372         }
3373         CTRACE("query_find: done");
3374 }
3375
3376 static inline void
3377 log_query(ns_client_t *client) {
3378         char namebuf[DNS_NAME_FORMATSIZE];
3379         char typename[DNS_RDATATYPE_FORMATSIZE];
3380         char classname[DNS_RDATACLASS_FORMATSIZE];
3381         dns_rdataset_t *rdataset;
3382         int level = ISC_LOG_INFO;
3383
3384         if (! isc_log_wouldlog(ns_g_lctx, level))
3385                 return;
3386
3387         rdataset = ISC_LIST_HEAD(client->query.qname->list);
3388         INSIST(rdataset != NULL);
3389         dns_name_format(client->query.qname, namebuf, sizeof(namebuf));
3390         dns_rdataclass_format(rdataset->rdclass, classname, sizeof(classname));
3391         dns_rdatatype_format(rdataset->type, typename, sizeof(typename));
3392
3393         ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
3394                       level, "query: %s %s %s %s%s%s", namebuf, classname,
3395                       typename, WANTRECURSION(client) ? "+" : "-",
3396                       (client->signer != NULL) ? "S": "",
3397                       (client->opt != NULL) ? "E" : "");
3398 }
3399
3400 void
3401 ns_query_start(ns_client_t *client) {
3402         isc_result_t result;
3403         dns_message_t *message = client->message;
3404         dns_rdataset_t *rdataset;
3405         ns_client_t *qclient;
3406         dns_rdatatype_t qtype;
3407
3408         CTRACE("ns_query_start");
3409
3410         /*
3411          * Ensure that appropriate cleanups occur.
3412          */
3413         client->next = query_next_callback;
3414
3415         /*
3416          * Behave as if we don't support DNSSEC if not enabled.
3417          */
3418         if (!client->view->enablednssec) {
3419                 message->flags &= ~DNS_MESSAGEFLAG_CD;
3420                 client->extflags &= ~DNS_MESSAGEEXTFLAG_DO;
3421         }
3422
3423         if ((message->flags & DNS_MESSAGEFLAG_RD) != 0)
3424                 client->query.attributes |= NS_QUERYATTR_WANTRECURSION;
3425
3426         if ((client->extflags & DNS_MESSAGEEXTFLAG_DO) != 0)
3427                 client->attributes |= NS_CLIENTATTR_WANTDNSSEC;
3428
3429         if (client->view->minimalresponses)
3430                 client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
3431                                              NS_QUERYATTR_NOADDITIONAL);
3432
3433         if ((client->view->cachedb == NULL)
3434             || (!client->view->additionalfromcache)) {
3435                 /*
3436                  * We don't have a cache.  Turn off cache support and
3437                  * recursion.
3438                  */
3439                 client->query.attributes &=
3440                         ~(NS_QUERYATTR_RECURSIONOK|NS_QUERYATTR_CACHEOK);
3441         } else if ((client->attributes & NS_CLIENTATTR_RA) == 0 ||
3442                    (message->flags & DNS_MESSAGEFLAG_RD) == 0) {
3443                 /*
3444                  * If the client isn't allowed to recurse (due to
3445                  * "recursion no", the allow-recursion ACL, or the
3446                  * lack of a resolver in this view), or if it
3447                  * doesn't want recursion, turn recursion off.
3448                  */
3449                 client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK;
3450         }
3451
3452         /*
3453          * Get the question name.
3454          */
3455         result = dns_message_firstname(message, DNS_SECTION_QUESTION);
3456         if (result != ISC_R_SUCCESS) {
3457                 query_error(client, result);
3458                 return;
3459         }
3460         dns_message_currentname(message, DNS_SECTION_QUESTION,
3461                                 &client->query.qname);
3462         client->query.origqname = client->query.qname;
3463         result = dns_message_nextname(message, DNS_SECTION_QUESTION);
3464         if (result != ISC_R_NOMORE) {
3465                 if (result == ISC_R_SUCCESS) {
3466                         /*
3467                          * There's more than one QNAME in the question
3468                          * section.
3469                          */
3470                         query_error(client, DNS_R_FORMERR);
3471                 } else
3472                         query_error(client, result);
3473                 return;
3474         }
3475
3476         if (ns_g_server->log_queries)
3477                 log_query(client);
3478
3479         /*
3480          * Check for multiple question queries, since edns1 is dead.
3481          */
3482         if (message->counts[DNS_SECTION_QUESTION] > 1) {
3483                 query_error(client, DNS_R_FORMERR);
3484                 return;
3485         }
3486
3487         /*
3488          * Check for meta-queries like IXFR and AXFR.
3489          */
3490         rdataset = ISC_LIST_HEAD(client->query.qname->list);
3491         INSIST(rdataset != NULL);
3492         qtype = rdataset->type;
3493         if (dns_rdatatype_ismeta(qtype)) {
3494                 switch (qtype) {
3495                 case dns_rdatatype_any:
3496                         break; /* Let query_find handle it. */
3497                 case dns_rdatatype_ixfr:
3498                 case dns_rdatatype_axfr:
3499                         ns_xfr_start(client, rdataset->type);
3500                         return;
3501                 case dns_rdatatype_maila:
3502                 case dns_rdatatype_mailb:
3503                         query_error(client, DNS_R_NOTIMP);
3504                         return;
3505                 case dns_rdatatype_tkey:
3506                         result = dns_tkey_processquery(client->message,
3507                                                 ns_g_server->tkeyctx,
3508                                                 client->view->dynamickeys);
3509                         if (result == ISC_R_SUCCESS)
3510                                 query_send(client);
3511                         else
3512                                 query_error(client, result);
3513                         return;
3514                 default: /* TSIG, etc. */
3515                         query_error(client, DNS_R_FORMERR);
3516                         return;
3517                 }
3518         }
3519
3520         /*
3521          * If the client has requested that DNSSEC checking be disabled,
3522          * allow lookups to return pending data and instruct the resolver
3523          * to return data before validation has completed.
3524          */
3525         if (message->flags & DNS_MESSAGEFLAG_CD ||
3526             qtype == dns_rdatatype_rrsig)
3527         {
3528                 client->query.dboptions |= DNS_DBFIND_PENDINGOK;
3529                 client->query.fetchoptions |= DNS_FETCHOPT_NOVALIDATE;
3530         }
3531
3532         /*
3533          * Allow glue NS records to be added to the authority section
3534          * if the answer is secure.
3535          */
3536         if (message->flags & DNS_MESSAGEFLAG_CD)
3537                 client->query.attributes &= ~NS_QUERYATTR_SECURE;
3538
3539         /*
3540          * This is an ordinary query.
3541          */
3542         result = dns_message_reply(message, ISC_TRUE);
3543         if (result != ISC_R_SUCCESS) {
3544                 query_next(client, result);
3545                 return;
3546         }
3547
3548         /*
3549          * Assume authoritative response until it is known to be
3550          * otherwise.
3551          */
3552         message->flags |= DNS_MESSAGEFLAG_AA;
3553
3554         /*
3555          * Set AD.  We must clear it if we add non-validated data to a
3556          * response.
3557          */
3558         if (client->view->enablednssec)
3559                 message->flags |= DNS_MESSAGEFLAG_AD;
3560
3561         qclient = NULL;
3562         ns_client_attach(client, &qclient);
3563         query_find(qclient, NULL, qtype);
3564 }