Bug Summary

File:build-scan/../src/resolve/resolved-dns-trust-anchor.c
Warning:line 370, column 9
Value stored to 'old_answer' is never read

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name resolved-dns-trust-anchor.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -menable-no-infs -menable-no-nans -menable-unsafe-fp-math -fno-signed-zeros -mreassociate -freciprocal-math -fdenormal-fp-math=preserve-sign,preserve-sign -ffp-contract=fast -fno-rounding-math -ffast-math -ffinite-math-only -mconstructor-aliases -munwind-tables -target-cpu x86-64 -tune-cpu generic -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib64/clang/12.0.0 -include config.h -I systemd-resolved.p -I . -I .. -I src/basic -I ../src/basic -I src/shared -I ../src/shared -I src/systemd -I ../src/systemd -I src/journal -I ../src/journal -I src/journal-remote -I ../src/journal-remote -I src/nspawn -I ../src/nspawn -I src/resolve -I ../src/resolve -I src/timesync -I ../src/timesync -I ../src/time-wait-sync -I src/login -I ../src/login -I src/udev -I ../src/udev -I src/libudev -I ../src/libudev -I src/core -I ../src/core -I ../src/libsystemd/sd-bus -I ../src/libsystemd/sd-device -I ../src/libsystemd/sd-hwdb -I ../src/libsystemd/sd-id128 -I ../src/libsystemd/sd-netlink -I ../src/libsystemd/sd-network -I src/libsystemd-network -I ../src/libsystemd-network -I /usr/include/p11-kit-1 -D _FILE_OFFSET_BITS=64 -internal-isystem /usr/local/include -internal-isystem /usr/lib64/clang/12.0.0/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -Wwrite-strings -Wno-unused-parameter -Wno-missing-field-initializers -Wno-unused-result -Wno-format-signedness -Wno-error=nonnull -std=gnu99 -fconst-strings -fdebug-compilation-dir /home/mrc0mmand/repos/@redhat-plumbers/systemd-rhel8/build-scan -ferror-limit 19 -fvisibility hidden -stack-protector 2 -fgnuc-version=4.2.1 -fcolor-diagnostics -analyzer-output=html -faddrsig -o /tmp/scan-build-2021-07-16-221226-1465241-1 -x c ../src/resolve/resolved-dns-trust-anchor.c
1/* SPDX-License-Identifier: LGPL-2.1+ */
2
3#include "sd-messages.h"
4
5#include "alloc-util.h"
6#include "conf-files.h"
7#include "def.h"
8#include "dns-domain.h"
9#include "fd-util.h"
10#include "fileio.h"
11#include "hexdecoct.h"
12#include "parse-util.h"
13#include "resolved-dns-trust-anchor.h"
14#include "resolved-dns-dnssec.h"
15#include "set.h"
16#include "string-util.h"
17#include "strv.h"
18
19static const char trust_anchor_dirs[] = CONF_PATHS_NULSTR("dnssec-trust-anchors.d")"/etc/" "dnssec-trust-anchors.d" "\0" "/run/" "dnssec-trust-anchors.d"
"\0" "/usr/local/lib/" "dnssec-trust-anchors.d" "\0" "/usr/lib/"
"dnssec-trust-anchors.d" "\0";
20
21/* The first DS RR from https://data.iana.org/root-anchors/root-anchors.xml, retrieved December 2015 */
22static const uint8_t root_digest1[] =
23 { 0x49, 0xAA, 0xC1, 0x1D, 0x7B, 0x6F, 0x64, 0x46, 0x70, 0x2E, 0x54, 0xA1, 0x60, 0x73, 0x71, 0x60,
24 0x7A, 0x1A, 0x41, 0x85, 0x52, 0x00, 0xFD, 0x2C, 0xE1, 0xCD, 0xDE, 0x32, 0xF2, 0x4E, 0x8F, 0xB5 };
25
26/* The second DS RR from https://data.iana.org/root-anchors/root-anchors.xml, retrieved February 2017 */
27static const uint8_t root_digest2[] =
28 { 0xE0, 0x6D, 0x44, 0xB8, 0x0B, 0x8F, 0x1D, 0x39, 0xA9, 0x5C, 0x0B, 0x0D, 0x7C, 0x65, 0xD0, 0x84,
29 0x58, 0xE8, 0x80, 0x40, 0x9B, 0xBC, 0x68, 0x34, 0x57, 0x10, 0x42, 0x37, 0xC7, 0xF8, 0xEC, 0x8D };
30
31static bool_Bool dns_trust_anchor_knows_domain_positive(DnsTrustAnchor *d, const char *name) {
32 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 32, __PRETTY_FUNCTION__); } while (0);
33
34 /* Returns true if there's an entry for the specified domain
35 * name in our trust anchor */
36
37 return
38 hashmap_contains(d->positive_by_key, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_IN, DNS_TYPE_DNSKEY, name)((DnsResourceKey) { .n_ref = (unsigned) -1, .class = DNS_CLASS_IN
, .type = DNS_TYPE_DNSKEY, ._name = (char*) name, })) ||
39 hashmap_contains(d->positive_by_key, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_IN, DNS_TYPE_DS, name)((DnsResourceKey) { .n_ref = (unsigned) -1, .class = DNS_CLASS_IN
, .type = DNS_TYPE_DS, ._name = (char*) name, }));
40}
41
42static int add_root_ksk(
43 DnsAnswer *answer,
44 DnsResourceKey *key,
45 uint16_t key_tag,
46 uint8_t algorithm,
47 uint8_t digest_type,
48 const void *digest,
49 size_t digest_size) {
50
51 _cleanup_(dns_resource_record_unrefp)__attribute__((cleanup(dns_resource_record_unrefp))) DnsResourceRecord *rr = NULL((void*)0);
52 int r;
53
54 rr = dns_resource_record_new(key);
55 if (!rr)
56 return -ENOMEM12;
57
58 rr->ds.key_tag = key_tag;
59 rr->ds.algorithm = algorithm;
60 rr->ds.digest_type = digest_type;
61 rr->ds.digest_size = digest_size;
62 rr->ds.digest = memdup(digest, rr->ds.digest_size);
63 if (!rr->ds.digest)
64 return -ENOMEM12;
65
66 r = dns_answer_add(answer, rr, 0, DNS_ANSWER_AUTHENTICATED);
67 if (r < 0)
68 return r;
69
70 return 0;
71}
72
73static int dns_trust_anchor_add_builtin_positive(DnsTrustAnchor *d) {
74 _cleanup_(dns_answer_unrefp)__attribute__((cleanup(dns_answer_unrefp))) DnsAnswer *answer = NULL((void*)0);
75 _cleanup_(dns_resource_key_unrefp)__attribute__((cleanup(dns_resource_key_unrefp))) DnsResourceKey *key = NULL((void*)0);
76 int r;
77
78 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 78, __PRETTY_FUNCTION__); } while (0);
79
80 r = hashmap_ensure_allocated(&d->positive_by_key, &dns_resource_key_hash_ops)internal_hashmap_ensure_allocated(&d->positive_by_key,
&dns_resource_key_hash_ops );
81 if (r < 0)
82 return r;
83
84 /* Only add the built-in trust anchor if there's neither a DS nor a DNSKEY defined for the root domain. That
85 * way users have an easy way to override the root domain DS/DNSKEY data. */
86 if (dns_trust_anchor_knows_domain_positive(d, "."))
87 return 0;
88
89 key = dns_resource_key_new(DNS_CLASS_IN, DNS_TYPE_DS, "");
90 if (!key)
91 return -ENOMEM12;
92
93 answer = dns_answer_new(2);
94 if (!answer)
95 return -ENOMEM12;
96
97 /* Add the two RRs from https://data.iana.org/root-anchors/root-anchors.xml */
98 r = add_root_ksk(answer, key, 19036, DNSSEC_ALGORITHM_RSASHA256, DNSSEC_DIGEST_SHA256, root_digest1, sizeof(root_digest1));
99 if (r < 0)
100 return r;
101
102 r = add_root_ksk(answer, key, 20326, DNSSEC_ALGORITHM_RSASHA256, DNSSEC_DIGEST_SHA256, root_digest2, sizeof(root_digest2));
103 if (r < 0)
104 return r;
105
106 r = hashmap_put(d->positive_by_key, key, answer);
107 if (r < 0)
108 return r;
109
110 answer = NULL((void*)0);
111 return 0;
112}
113
114static int dns_trust_anchor_add_builtin_negative(DnsTrustAnchor *d) {
115
116 static const char private_domains[] =
117 /* RFC 6761 says that .test is a special domain for
118 * testing and not to be installed in the root zone */
119 "test\0"
120
121 /* RFC 6761 says that these reverse IP lookup ranges
122 * are for private addresses, and hence should not
123 * show up in the root zone */
124 "10.in-addr.arpa\0"
125 "16.172.in-addr.arpa\0"
126 "17.172.in-addr.arpa\0"
127 "18.172.in-addr.arpa\0"
128 "19.172.in-addr.arpa\0"
129 "20.172.in-addr.arpa\0"
130 "21.172.in-addr.arpa\0"
131 "22.172.in-addr.arpa\0"
132 "23.172.in-addr.arpa\0"
133 "24.172.in-addr.arpa\0"
134 "25.172.in-addr.arpa\0"
135 "26.172.in-addr.arpa\0"
136 "27.172.in-addr.arpa\0"
137 "28.172.in-addr.arpa\0"
138 "29.172.in-addr.arpa\0"
139 "30.172.in-addr.arpa\0"
140 "31.172.in-addr.arpa\0"
141 "168.192.in-addr.arpa\0"
142
143 /* The same, but for IPv6. */
144 "d.f.ip6.arpa\0"
145
146 /* RFC 6762 reserves the .local domain for Multicast
147 * DNS, it hence cannot appear in the root zone. (Note
148 * that we by default do not route .local traffic to
149 * DNS anyway, except when a configured search domain
150 * suggests so.) */
151 "local\0"
152
153 /* These two are well known, popular private zone
154 * TLDs, that are blocked from delegation, according
155 * to:
156 * http://icannwiki.com/Name_Collision#NGPC_Resolution
157 *
158 * There's also ongoing work on making this official
159 * in an RRC:
160 * https://www.ietf.org/archive/id/draft-chapin-additional-reserved-tlds-02.txt */
161 "home\0"
162 "corp\0"
163
164 /* The following four TLDs are suggested for private
165 * zones in RFC 6762, Appendix G, and are hence very
166 * unlikely to be made official TLDs any day soon */
167 "lan\0"
168 "intranet\0"
169 "internal\0"
170 "private\0";
171
172 const char *name;
173 int r;
174
175 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 175, __PRETTY_FUNCTION__); } while (0);
176
177 /* Only add the built-in trust anchor if there's no negative
178 * trust anchor defined at all. This enables easy overriding
179 * of negative trust anchors. */
180
181 if (set_size(d->negative_by_name) > 0)
182 return 0;
183
184 r = set_ensure_allocated(&d->negative_by_name, &dns_name_hash_ops)internal_set_ensure_allocated(&d->negative_by_name, &
dns_name_hash_ops );
185 if (r < 0)
186 return r;
187
188 /* We add a couple of domains as default negative trust
189 * anchors, where it's very unlikely they will be installed in
190 * the root zone. If they exist they must be private, and thus
191 * unsigned. */
192
193 NULSTR_FOREACH(name, private_domains)for ((name) = (private_domains); (name) && *(name); (
name) = strchr((name), 0)+1) {
194
195 if (dns_trust_anchor_knows_domain_positive(d, name))
196 continue;
197
198 r = set_put_strdup(d->negative_by_name, name);
199 if (r < 0)
200 return r;
201 }
202
203 return 0;
204}
205
206static int dns_trust_anchor_load_positive(DnsTrustAnchor *d, const char *path, unsigned line, const char *s) {
207 _cleanup_(dns_resource_record_unrefp)__attribute__((cleanup(dns_resource_record_unrefp))) DnsResourceRecord *rr = NULL((void*)0);
208 _cleanup_free___attribute__((cleanup(freep))) char *domain = NULL((void*)0), *class = NULL((void*)0), *type = NULL((void*)0);
209 _cleanup_(dns_answer_unrefp)__attribute__((cleanup(dns_answer_unrefp))) DnsAnswer *answer = NULL((void*)0);
210 DnsAnswer *old_answer = NULL((void*)0);
211 const char *p = s;
212 int r;
213
214 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 214, __PRETTY_FUNCTION__); } while (0);
215 assert(line)do { if ((__builtin_expect(!!(!(line)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("line"), "../src/resolve/resolved-dns-trust-anchor.c"
, 215, __PRETTY_FUNCTION__); } while (0);
216
217 r = extract_first_word(&p, &domain, NULL((void*)0), EXTRACT_QUOTES);
218 if (r < 0)
219 return log_warning_errno(r, "Unable to parse domain in line %s:%u: %m", path, line)({ int _level = ((4)), _e = ((r)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 219, __func__
, "Unable to parse domain in line %s:%u: %m", path, line) : -
abs(_e); });
220
221 if (!dns_name_is_valid(domain)) {
222 log_warning("Domain name %s is invalid, at line %s:%u, ignoring line.", domain, path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 222, __func__
, "Domain name %s is invalid, at line %s:%u, ignoring line.",
domain, path, line) : -abs(_e); });
223 return -EINVAL22;
224 }
225
226 r = extract_many_words(&p, NULL((void*)0), 0, &class, &type, NULL((void*)0));
227 if (r < 0)
228 return log_warning_errno(r, "Unable to parse class and type in line %s:%u: %m", path, line)({ int _level = ((4)), _e = ((r)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 228, __func__
, "Unable to parse class and type in line %s:%u: %m", path, line
) : -abs(_e); });
229 if (r != 2) {
230 log_warning("Missing class or type in line %s:%u", path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 230, __func__
, "Missing class or type in line %s:%u", path, line) : -abs(_e
); });
231 return -EINVAL22;
232 }
233
234 if (!strcaseeq(class, "IN")(strcasecmp((class),("IN")) == 0)) {
235 log_warning("RR class %s is not supported, ignoring line %s:%u.", class, path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 235, __func__
, "RR class %s is not supported, ignoring line %s:%u.", class
, path, line) : -abs(_e); });
236 return -EINVAL22;
237 }
238
239 if (strcaseeq(type, "DS")(strcasecmp((type),("DS")) == 0)) {
240 _cleanup_free___attribute__((cleanup(freep))) char *key_tag = NULL((void*)0), *algorithm = NULL((void*)0), *digest_type = NULL((void*)0);
241 _cleanup_free___attribute__((cleanup(freep))) void *dd = NULL((void*)0);
242 uint16_t kt;
243 int a, dt;
244 size_t l;
245
246 r = extract_many_words(&p, NULL((void*)0), 0, &key_tag, &algorithm, &digest_type, NULL((void*)0));
247 if (r < 0) {
248 log_warning_errno(r, "Failed to parse DS parameters on line %s:%u: %m", path, line)({ int _level = ((4)), _e = ((r)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 248, __func__
, "Failed to parse DS parameters on line %s:%u: %m", path, line
) : -abs(_e); });
249 return -EINVAL22;
250 }
251 if (r != 3) {
252 log_warning("Missing DS parameters on line %s:%u", path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 252, __func__
, "Missing DS parameters on line %s:%u", path, line) : -abs(_e
); });
253 return -EINVAL22;
254 }
255
256 r = safe_atou16(key_tag, &kt);
257 if (r < 0)
258 return log_warning_errno(r, "Failed to parse DS key tag %s on line %s:%u: %m", key_tag, path, line)({ int _level = ((4)), _e = ((r)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 258, __func__
, "Failed to parse DS key tag %s on line %s:%u: %m", key_tag,
path, line) : -abs(_e); });
259
260 a = dnssec_algorithm_from_string(algorithm);
261 if (a < 0) {
262 log_warning("Failed to parse DS algorithm %s on line %s:%u", algorithm, path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 262, __func__
, "Failed to parse DS algorithm %s on line %s:%u", algorithm,
path, line) : -abs(_e); });
263 return -EINVAL22;
264 }
265
266 dt = dnssec_digest_from_string(digest_type);
267 if (dt < 0) {
268 log_warning("Failed to parse DS digest type %s on line %s:%u", digest_type, path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 268, __func__
, "Failed to parse DS digest type %s on line %s:%u", digest_type
, path, line) : -abs(_e); });
269 return -EINVAL22;
270 }
271
272 if (isempty(p)) {
273 log_warning("Missing DS digest on line %s:%u", path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 273, __func__
, "Missing DS digest on line %s:%u", path, line) : -abs(_e); }
);
274 return -EINVAL22;
275 }
276
277 r = unhexmem(p, strlen(p), &dd, &l);
278 if (r < 0) {
279 log_warning("Failed to parse DS digest %s on line %s:%u", p, path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 279, __func__
, "Failed to parse DS digest %s on line %s:%u", p, path, line
) : -abs(_e); });
280 return -EINVAL22;
281 }
282
283 rr = dns_resource_record_new_full(DNS_CLASS_IN, DNS_TYPE_DS, domain);
284 if (!rr)
285 return log_oom()log_oom_internal(LOG_REALM_SYSTEMD, "../src/resolve/resolved-dns-trust-anchor.c"
, 285, __func__);
286
287 rr->ds.key_tag = kt;
288 rr->ds.algorithm = a;
289 rr->ds.digest_type = dt;
290 rr->ds.digest_size = l;
291 rr->ds.digest = TAKE_PTR(dd)({ typeof(dd) _ptr_ = (dd); (dd) = ((void*)0); _ptr_; });
292
293 } else if (strcaseeq(type, "DNSKEY")(strcasecmp((type),("DNSKEY")) == 0)) {
294 _cleanup_free___attribute__((cleanup(freep))) char *flags = NULL((void*)0), *protocol = NULL((void*)0), *algorithm = NULL((void*)0);
295 _cleanup_free___attribute__((cleanup(freep))) void *k = NULL((void*)0);
296 uint16_t f;
297 size_t l;
298 int a;
299
300 r = extract_many_words(&p, NULL((void*)0), 0, &flags, &protocol, &algorithm, NULL((void*)0));
301 if (r < 0)
302 return log_warning_errno(r, "Failed to parse DNSKEY parameters on line %s:%u: %m", path, line)({ int _level = ((4)), _e = ((r)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 302, __func__
, "Failed to parse DNSKEY parameters on line %s:%u: %m", path
, line) : -abs(_e); });
303 if (r != 3) {
304 log_warning("Missing DNSKEY parameters on line %s:%u", path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 304, __func__
, "Missing DNSKEY parameters on line %s:%u", path, line) : -abs
(_e); });
305 return -EINVAL22;
306 }
307
308 if (!streq(protocol, "3")(strcmp((protocol),("3")) == 0)) {
309 log_warning("DNSKEY Protocol is not 3 on line %s:%u", path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 309, __func__
, "DNSKEY Protocol is not 3 on line %s:%u", path, line) : -abs
(_e); });
310 return -EINVAL22;
311 }
312
313 r = safe_atou16(flags, &f);
314 if (r < 0)
315 return log_warning_errno(r, "Failed to parse DNSKEY flags field %s on line %s:%u", flags, path, line)({ int _level = ((4)), _e = ((r)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 315, __func__
, "Failed to parse DNSKEY flags field %s on line %s:%u", flags
, path, line) : -abs(_e); });
316 if ((f & DNSKEY_FLAG_ZONE_KEY(1 << 8)) == 0) {
317 log_warning("DNSKEY lacks zone key bit set on line %s:%u", path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 317, __func__
, "DNSKEY lacks zone key bit set on line %s:%u", path, line) :
-abs(_e); });
318 return -EINVAL22;
319 }
320 if ((f & DNSKEY_FLAG_REVOKE(1 << 7))) {
321 log_warning("DNSKEY is already revoked on line %s:%u", path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 321, __func__
, "DNSKEY is already revoked on line %s:%u", path, line) : -abs
(_e); });
322 return -EINVAL22;
323 }
324
325 a = dnssec_algorithm_from_string(algorithm);
326 if (a < 0) {
327 log_warning("Failed to parse DNSKEY algorithm %s on line %s:%u", algorithm, path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 327, __func__
, "Failed to parse DNSKEY algorithm %s on line %s:%u", algorithm
, path, line) : -abs(_e); });
328 return -EINVAL22;
329 }
330
331 if (isempty(p)) {
332 log_warning("Missing DNSKEY key on line %s:%u", path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 332, __func__
, "Missing DNSKEY key on line %s:%u", path, line) : -abs(_e);
});
333 return -EINVAL22;
334 }
335
336 r = unbase64mem(p, strlen(p), &k, &l);
337 if (r < 0)
338 return log_warning_errno(r, "Failed to parse DNSKEY key data %s on line %s:%u", p, path, line)({ int _level = ((4)), _e = ((r)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 338, __func__
, "Failed to parse DNSKEY key data %s on line %s:%u", p, path
, line) : -abs(_e); });
339
340 rr = dns_resource_record_new_full(DNS_CLASS_IN, DNS_TYPE_DNSKEY, domain);
341 if (!rr)
342 return log_oom()log_oom_internal(LOG_REALM_SYSTEMD, "../src/resolve/resolved-dns-trust-anchor.c"
, 342, __func__);
343
344 rr->dnskey.flags = f;
345 rr->dnskey.protocol = 3;
346 rr->dnskey.algorithm = a;
347 rr->dnskey.key_size = l;
348 rr->dnskey.key = TAKE_PTR(k)({ typeof(k) _ptr_ = (k); (k) = ((void*)0); _ptr_; });
349
350 } else {
351 log_warning("RR type %s is not supported, ignoring line %s:%u.", type, path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 351, __func__
, "RR type %s is not supported, ignoring line %s:%u.", type, path
, line) : -abs(_e); });
352 return -EINVAL22;
353 }
354
355 r = hashmap_ensure_allocated(&d->positive_by_key, &dns_resource_key_hash_ops)internal_hashmap_ensure_allocated(&d->positive_by_key,
&dns_resource_key_hash_ops );
356 if (r < 0)
357 return log_oom()log_oom_internal(LOG_REALM_SYSTEMD, "../src/resolve/resolved-dns-trust-anchor.c"
, 357, __func__);
358
359 old_answer = hashmap_get(d->positive_by_key, rr->key);
360 answer = dns_answer_ref(old_answer);
361
362 r = dns_answer_add_extend(&answer, rr, 0, DNS_ANSWER_AUTHENTICATED);
363 if (r < 0)
364 return log_error_errno(r, "Failed to add trust anchor RR: %m")({ int _level = ((3)), _e = ((r)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 364, __func__
, "Failed to add trust anchor RR: %m") : -abs(_e); });
365
366 r = hashmap_replace(d->positive_by_key, rr->key, answer);
367 if (r < 0)
368 return log_error_errno(r, "Failed to add answer to trust anchor: %m")({ int _level = ((3)), _e = ((r)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 368, __func__
, "Failed to add answer to trust anchor: %m") : -abs(_e); });
369
370 old_answer = dns_answer_unref(old_answer);
Value stored to 'old_answer' is never read
371 answer = NULL((void*)0);
372
373 return 0;
374}
375
376static int dns_trust_anchor_load_negative(DnsTrustAnchor *d, const char *path, unsigned line, const char *s) {
377 _cleanup_free___attribute__((cleanup(freep))) char *domain = NULL((void*)0);
378 const char *p = s;
379 int r;
380
381 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 381, __PRETTY_FUNCTION__); } while (0);
382 assert(line)do { if ((__builtin_expect(!!(!(line)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("line"), "../src/resolve/resolved-dns-trust-anchor.c"
, 382, __PRETTY_FUNCTION__); } while (0);
383
384 r = extract_first_word(&p, &domain, NULL((void*)0), EXTRACT_QUOTES);
385 if (r < 0)
386 return log_warning_errno(r, "Unable to parse line %s:%u: %m", path, line)({ int _level = ((4)), _e = ((r)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 386, __func__
, "Unable to parse line %s:%u: %m", path, line) : -abs(_e); }
);
387
388 if (!dns_name_is_valid(domain)) {
389 log_warning("Domain name %s is invalid, at line %s:%u, ignoring line.", domain, path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 389, __func__
, "Domain name %s is invalid, at line %s:%u, ignoring line.",
domain, path, line) : -abs(_e); });
390 return -EINVAL22;
391 }
392
393 if (!isempty(p)) {
394 log_warning("Trailing garbage at line %s:%u, ignoring line.", path, line)({ int _level = (((4))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 394, __func__
, "Trailing garbage at line %s:%u, ignoring line.", path, line
) : -abs(_e); });
395 return -EINVAL22;
396 }
397
398 r = set_ensure_allocated(&d->negative_by_name, &dns_name_hash_ops)internal_set_ensure_allocated(&d->negative_by_name, &
dns_name_hash_ops );
399 if (r < 0)
400 return log_oom()log_oom_internal(LOG_REALM_SYSTEMD, "../src/resolve/resolved-dns-trust-anchor.c"
, 400, __func__);
401
402 r = set_put(d->negative_by_name, domain);
403 if (r < 0)
404 return log_oom()log_oom_internal(LOG_REALM_SYSTEMD, "../src/resolve/resolved-dns-trust-anchor.c"
, 404, __func__);
405 if (r > 0)
406 domain = NULL((void*)0);
407
408 return 0;
409}
410
411static int dns_trust_anchor_load_files(
412 DnsTrustAnchor *d,
413 const char *suffix,
414 int (*loader)(DnsTrustAnchor *d, const char *path, unsigned n, const char *line)) {
415
416 _cleanup_strv_free___attribute__((cleanup(strv_freep))) char **files = NULL((void*)0);
417 char **f;
418 int r;
419
420 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 420, __PRETTY_FUNCTION__); } while (0);
421 assert(suffix)do { if ((__builtin_expect(!!(!(suffix)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("suffix"), "../src/resolve/resolved-dns-trust-anchor.c"
, 421, __PRETTY_FUNCTION__); } while (0);
422 assert(loader)do { if ((__builtin_expect(!!(!(loader)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("loader"), "../src/resolve/resolved-dns-trust-anchor.c"
, 422, __PRETTY_FUNCTION__); } while (0);
423
424 r = conf_files_list_nulstr(&files, suffix, NULL((void*)0), 0, trust_anchor_dirs);
425 if (r < 0)
426 return log_error_errno(r, "Failed to enumerate %s trust anchor files: %m", suffix)({ int _level = ((3)), _e = ((r)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 426, __func__
, "Failed to enumerate %s trust anchor files: %m", suffix) : -
abs(_e); });
427
428 STRV_FOREACH(f, files)for ((f) = (files); (f) && *(f); (f)++) {
429 _cleanup_fclose___attribute__((cleanup(fclosep))) FILE *g = NULL((void*)0);
430 char line[LINE_MAX2048];
431 unsigned n = 0;
432
433 g = fopen(*f, "r");
434 if (!g) {
435 if (errno(*__errno_location ()) == ENOENT2)
436 continue;
437
438 log_warning_errno(errno, "Failed to open %s: %m", *f)({ int _level = ((4)), _e = (((*__errno_location ()))), _realm
= (LOG_REALM_SYSTEMD); (log_get_max_level_realm(_realm) >=
((_level) & 0x07)) ? log_internal_realm(((_realm) <<
10 | (_level)), _e, "../src/resolve/resolved-dns-trust-anchor.c"
, 438, __func__, "Failed to open %s: %m", *f) : -abs(_e); });
439 continue;
440 }
441
442 FOREACH_LINE(line, g, log_warning_errno(errno, "Failed to read %s, ignoring: %m", *f))for (;;) if (!fgets(line, sizeof(line), g)) { if (ferror(g)) {
({ int _level = ((4)), _e = (((*__errno_location ()))), _realm
= (LOG_REALM_SYSTEMD); (log_get_max_level_realm(_realm) >=
((_level) & 0x07)) ? log_internal_realm(((_realm) <<
10 | (_level)), _e, "../src/resolve/resolved-dns-trust-anchor.c"
, 442, __func__, "Failed to read %s, ignoring: %m", *f) : -abs
(_e); }); } break; } else {
443 char *l;
444
445 n++;
446
447 l = strstrip(line);
448 if (isempty(l))
449 continue;
450
451 if (*l == ';')
452 continue;
453
454 (void) loader(d, *f, n, l);
455 }
456 }
457
458 return 0;
459}
460
461static int domain_name_cmp(const void *a, const void *b) {
462 char **x = (char**) a, **y = (char**) b;
463
464 return dns_name_compare_func(*x, *y);
465}
466
467static int dns_trust_anchor_dump(DnsTrustAnchor *d) {
468 DnsAnswer *a;
469 Iterator i;
470
471 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 471, __PRETTY_FUNCTION__); } while (0);
472
473 if (hashmap_isempty(d->positive_by_key))
474 log_info("No positive trust anchors defined.")({ int _level = (((6))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 474, __func__
, "No positive trust anchors defined.") : -abs(_e); });
475 else {
476 log_info("Positive Trust Anchors:")({ int _level = (((6))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 476, __func__
, "Positive Trust Anchors:") : -abs(_e); });
477 HASHMAP_FOREACH(a, d->positive_by_key, i)for ((i) = ((Iterator) { .idx = ((2147483647 *2U +1U) - 1), .
next_key = ((void*)0) }); hashmap_iterate((d->positive_by_key
), &(i), (void**)&(a), ((void*)0)); ) {
478 DnsResourceRecord *rr;
479
480 DNS_ANSWER_FOREACH(rr, a)for (size_t __unique_prefix_i15 = ({ (rr) = ((a) && (
a)->n_rrs > 0) ? (a)->items[0].rr : ((void*)0); 0; }
); (a) && (__unique_prefix_i15 < (a)->n_rrs); __unique_prefix_i15
++, (rr) = (__unique_prefix_i15 < (a)->n_rrs ? (a)->
items[__unique_prefix_i15].rr : ((void*)0)))
481 log_info("%s", dns_resource_record_to_string(rr))({ int _level = (((6))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 481, __func__
, "%s", dns_resource_record_to_string(rr)) : -abs(_e); });
482 }
483 }
484
485 if (set_isempty(d->negative_by_name))
486 log_info("No negative trust anchors defined.")({ int _level = (((6))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 486, __func__
, "No negative trust anchors defined.") : -abs(_e); });
487 else {
488 _cleanup_free___attribute__((cleanup(freep))) char **l = NULL((void*)0), *j = NULL((void*)0);
489
490 l = set_get_strv(d->negative_by_name);
491 if (!l)
492 return log_oom()log_oom_internal(LOG_REALM_SYSTEMD, "../src/resolve/resolved-dns-trust-anchor.c"
, 492, __func__);
493
494 qsort_safe(l, set_size(d->negative_by_name), sizeof(char*), domain_name_cmp);
495
496 j = strv_join(l, " ");
497 if (!j)
498 return log_oom()log_oom_internal(LOG_REALM_SYSTEMD, "../src/resolve/resolved-dns-trust-anchor.c"
, 498, __func__);
499
500 log_info("Negative trust anchors: %s", j)({ int _level = (((6))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 500, __func__
, "Negative trust anchors: %s", j) : -abs(_e); });
501 }
502
503 return 0;
504}
505
506int dns_trust_anchor_load(DnsTrustAnchor *d) {
507 int r;
508
509 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 509, __PRETTY_FUNCTION__); } while (0);
510
511 /* If loading things from disk fails, we don't consider this fatal */
512 (void) dns_trust_anchor_load_files(d, ".positive", dns_trust_anchor_load_positive);
513 (void) dns_trust_anchor_load_files(d, ".negative", dns_trust_anchor_load_negative);
514
515 /* However, if the built-in DS fails, then we have a problem. */
516 r = dns_trust_anchor_add_builtin_positive(d);
517 if (r < 0)
518 return log_error_errno(r, "Failed to add built-in positive trust anchor: %m")({ int _level = ((3)), _e = ((r)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 518, __func__
, "Failed to add built-in positive trust anchor: %m") : -abs(
_e); });
519
520 r = dns_trust_anchor_add_builtin_negative(d);
521 if (r < 0)
522 return log_error_errno(r, "Failed to add built-in negative trust anchor: %m")({ int _level = ((3)), _e = ((r)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-trust-anchor.c", 522, __func__
, "Failed to add built-in negative trust anchor: %m") : -abs(
_e); });
523
524 dns_trust_anchor_dump(d);
525
526 return 0;
527}
528
529void dns_trust_anchor_flush(DnsTrustAnchor *d) {
530 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 530, __PRETTY_FUNCTION__); } while (0);
531
532 d->positive_by_key = hashmap_free_with_destructor(d->positive_by_key, dns_answer_unref)({ ({ void *_item; while ((_item = hashmap_steal_first(d->
positive_by_key))) dns_answer_unref(_item); }); hashmap_free(
d->positive_by_key); });
533 d->revoked_by_rr = set_free_with_destructor(d->revoked_by_rr, dns_resource_record_unref)({ ({ void *_item; while ((_item = set_steal_first(d->revoked_by_rr
))) dns_resource_record_unref(_item); }); set_free(d->revoked_by_rr
); });
534 d->negative_by_name = set_free_free(d->negative_by_name);
535}
536
537int dns_trust_anchor_lookup_positive(DnsTrustAnchor *d, const DnsResourceKey *key, DnsAnswer **ret) {
538 DnsAnswer *a;
539
540 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 540, __PRETTY_FUNCTION__); } while (0);
541 assert(key)do { if ((__builtin_expect(!!(!(key)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("key"), "../src/resolve/resolved-dns-trust-anchor.c"
, 541, __PRETTY_FUNCTION__); } while (0);
542 assert(ret)do { if ((__builtin_expect(!!(!(ret)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("ret"), "../src/resolve/resolved-dns-trust-anchor.c"
, 542, __PRETTY_FUNCTION__); } while (0);
543
544 /* We only serve DS and DNSKEY RRs. */
545 if (!IN_SET(key->type, DNS_TYPE_DS, DNS_TYPE_DNSKEY)({ _Bool _found = 0; static __attribute__ ((unused)) char _static_assert__macros_need_to_be_extended
[20 - sizeof((int[]){DNS_TYPE_DS, DNS_TYPE_DNSKEY})/sizeof(int
)]; switch(key->type) { case DNS_TYPE_DS: case DNS_TYPE_DNSKEY
: _found = 1; break; default: break; } _found; }))
546 return 0;
547
548 a = hashmap_get(d->positive_by_key, key);
549 if (!a)
550 return 0;
551
552 *ret = dns_answer_ref(a);
553 return 1;
554}
555
556int dns_trust_anchor_lookup_negative(DnsTrustAnchor *d, const char *name) {
557 int r;
558
559 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 559, __PRETTY_FUNCTION__); } while (0);
560 assert(name)do { if ((__builtin_expect(!!(!(name)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("name"), "../src/resolve/resolved-dns-trust-anchor.c"
, 560, __PRETTY_FUNCTION__); } while (0);
561
562 for (;;) {
563 /* If the domain is listed as-is in the NTA database, then that counts */
564 if (set_contains(d->negative_by_name, name))
565 return true1;
566
567 /* If the domain isn't listed as NTA, but is listed as positive trust anchor, then that counts. See RFC
568 * 7646, section 1.1 */
569 if (hashmap_contains(d->positive_by_key, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_IN, DNS_TYPE_DS, name)((DnsResourceKey) { .n_ref = (unsigned) -1, .class = DNS_CLASS_IN
, .type = DNS_TYPE_DS, ._name = (char*) name, })))
570 return false0;
571
572 if (hashmap_contains(d->positive_by_key, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_IN, DNS_TYPE_KEY, name)((DnsResourceKey) { .n_ref = (unsigned) -1, .class = DNS_CLASS_IN
, .type = DNS_TYPE_KEY, ._name = (char*) name, })))
573 return false0;
574
575 /* And now, let's look at the parent, and check that too */
576 r = dns_name_parent(&name);
577 if (r < 0)
578 return r;
579 if (r == 0)
580 break;
581 }
582
583 return false0;
584}
585
586static int dns_trust_anchor_revoked_put(DnsTrustAnchor *d, DnsResourceRecord *rr) {
587 int r;
588
589 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 589, __PRETTY_FUNCTION__); } while (0);
590
591 r = set_ensure_allocated(&d->revoked_by_rr, &dns_resource_record_hash_ops)internal_set_ensure_allocated(&d->revoked_by_rr, &
dns_resource_record_hash_ops );
592 if (r < 0)
593 return r;
594
595 r = set_put(d->revoked_by_rr, rr);
596 if (r < 0)
597 return r;
598 if (r > 0)
599 dns_resource_record_ref(rr);
600
601 return r;
602}
603
604static int dns_trust_anchor_remove_revoked(DnsTrustAnchor *d, DnsResourceRecord *rr) {
605 _cleanup_(dns_answer_unrefp)__attribute__((cleanup(dns_answer_unrefp))) DnsAnswer *new_answer = NULL((void*)0);
606 DnsAnswer *old_answer;
607 int r;
608
609 /* Remember that this is a revoked trust anchor RR */
610 r = dns_trust_anchor_revoked_put(d, rr);
611 if (r < 0)
612 return r;
613
614 /* Remove this from the positive trust anchor */
615 old_answer = hashmap_get(d->positive_by_key, rr->key);
616 if (!old_answer)
617 return 0;
618
619 new_answer = dns_answer_ref(old_answer);
620
621 r = dns_answer_remove_by_rr(&new_answer, rr);
622 if (r <= 0)
623 return r;
624
625 /* We found the key! Warn the user */
626 log_struct(LOG_WARNING,log_struct_internal(((LOG_REALM_SYSTEMD) << 10 | (4)), 0
, "../src/resolve/resolved-dns-trust-anchor.c", 631, __func__
, "MESSAGE_ID=" "4d" "44" "08" "cf" "d0" "d1" "44" "85" "91" "84"
"d1" "e6" "5d" "7c" "8a" "65", "MESSAGE=" "DNSSEC trust anchor %s has been revoked.\n"
"Please update the trust anchor, or upgrade your operating system."
, strna(dns_resource_record_to_string(rr)), "TRUST_ANCHOR=%s"
, dns_resource_record_to_string(rr), ((void*)0))
627 "MESSAGE_ID=" SD_MESSAGE_DNSSEC_TRUST_ANCHOR_REVOKED_STR,log_struct_internal(((LOG_REALM_SYSTEMD) << 10 | (4)), 0
, "../src/resolve/resolved-dns-trust-anchor.c", 631, __func__
, "MESSAGE_ID=" "4d" "44" "08" "cf" "d0" "d1" "44" "85" "91" "84"
"d1" "e6" "5d" "7c" "8a" "65", "MESSAGE=" "DNSSEC trust anchor %s has been revoked.\n"
"Please update the trust anchor, or upgrade your operating system."
, strna(dns_resource_record_to_string(rr)), "TRUST_ANCHOR=%s"
, dns_resource_record_to_string(rr), ((void*)0))
628 LOG_MESSAGE("DNSSEC trust anchor %s has been revoked.\n"log_struct_internal(((LOG_REALM_SYSTEMD) << 10 | (4)), 0
, "../src/resolve/resolved-dns-trust-anchor.c", 631, __func__
, "MESSAGE_ID=" "4d" "44" "08" "cf" "d0" "d1" "44" "85" "91" "84"
"d1" "e6" "5d" "7c" "8a" "65", "MESSAGE=" "DNSSEC trust anchor %s has been revoked.\n"
"Please update the trust anchor, or upgrade your operating system."
, strna(dns_resource_record_to_string(rr)), "TRUST_ANCHOR=%s"
, dns_resource_record_to_string(rr), ((void*)0))
629 "Please update the trust anchor, or upgrade your operating system.",log_struct_internal(((LOG_REALM_SYSTEMD) << 10 | (4)), 0
, "../src/resolve/resolved-dns-trust-anchor.c", 631, __func__
, "MESSAGE_ID=" "4d" "44" "08" "cf" "d0" "d1" "44" "85" "91" "84"
"d1" "e6" "5d" "7c" "8a" "65", "MESSAGE=" "DNSSEC trust anchor %s has been revoked.\n"
"Please update the trust anchor, or upgrade your operating system."
, strna(dns_resource_record_to_string(rr)), "TRUST_ANCHOR=%s"
, dns_resource_record_to_string(rr), ((void*)0))
630 strna(dns_resource_record_to_string(rr))),log_struct_internal(((LOG_REALM_SYSTEMD) << 10 | (4)), 0
, "../src/resolve/resolved-dns-trust-anchor.c", 631, __func__
, "MESSAGE_ID=" "4d" "44" "08" "cf" "d0" "d1" "44" "85" "91" "84"
"d1" "e6" "5d" "7c" "8a" "65", "MESSAGE=" "DNSSEC trust anchor %s has been revoked.\n"
"Please update the trust anchor, or upgrade your operating system."
, strna(dns_resource_record_to_string(rr)), "TRUST_ANCHOR=%s"
, dns_resource_record_to_string(rr), ((void*)0))
631 "TRUST_ANCHOR=%s", dns_resource_record_to_string(rr))log_struct_internal(((LOG_REALM_SYSTEMD) << 10 | (4)), 0
, "../src/resolve/resolved-dns-trust-anchor.c", 631, __func__
, "MESSAGE_ID=" "4d" "44" "08" "cf" "d0" "d1" "44" "85" "91" "84"
"d1" "e6" "5d" "7c" "8a" "65", "MESSAGE=" "DNSSEC trust anchor %s has been revoked.\n"
"Please update the trust anchor, or upgrade your operating system."
, strna(dns_resource_record_to_string(rr)), "TRUST_ANCHOR=%s"
, dns_resource_record_to_string(rr), ((void*)0));
632
633 if (dns_answer_size(new_answer) <= 0) {
634 assert_se(hashmap_remove(d->positive_by_key, rr->key) == old_answer)do { if ((__builtin_expect(!!(!(hashmap_remove(d->positive_by_key
, rr->key) == old_answer)),0))) log_assert_failed_realm(LOG_REALM_SYSTEMD
, ("hashmap_remove(d->positive_by_key, rr->key) == old_answer"
), "../src/resolve/resolved-dns-trust-anchor.c", 634, __PRETTY_FUNCTION__
); } while (0);
635 dns_answer_unref(old_answer);
636 return 1;
637 }
638
639 r = hashmap_replace(d->positive_by_key, new_answer->items[0].rr->key, new_answer);
640 if (r < 0)
641 return r;
642
643 new_answer = NULL((void*)0);
644 dns_answer_unref(old_answer);
645 return 1;
646}
647
648static int dns_trust_anchor_check_revoked_one(DnsTrustAnchor *d, DnsResourceRecord *revoked_dnskey) {
649 DnsAnswer *a;
650 int r;
651
652 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 652, __PRETTY_FUNCTION__); } while (0);
653 assert(revoked_dnskey)do { if ((__builtin_expect(!!(!(revoked_dnskey)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("revoked_dnskey"), "../src/resolve/resolved-dns-trust-anchor.c"
, 653, __PRETTY_FUNCTION__); } while (0);
654 assert(revoked_dnskey->key->type == DNS_TYPE_DNSKEY)do { if ((__builtin_expect(!!(!(revoked_dnskey->key->type
== DNS_TYPE_DNSKEY)),0))) log_assert_failed_realm(LOG_REALM_SYSTEMD
, ("revoked_dnskey->key->type == DNS_TYPE_DNSKEY"), "../src/resolve/resolved-dns-trust-anchor.c"
, 654, __PRETTY_FUNCTION__); } while (0);
655 assert(revoked_dnskey->dnskey.flags & DNSKEY_FLAG_REVOKE)do { if ((__builtin_expect(!!(!(revoked_dnskey->dnskey.flags
& (1 << 7))),0))) log_assert_failed_realm(LOG_REALM_SYSTEMD
, ("revoked_dnskey->dnskey.flags & DNSKEY_FLAG_REVOKE"
), "../src/resolve/resolved-dns-trust-anchor.c", 655, __PRETTY_FUNCTION__
); } while (0);
656
657 a = hashmap_get(d->positive_by_key, revoked_dnskey->key);
658 if (a) {
659 DnsResourceRecord *anchor;
660
661 /* First, look for the precise DNSKEY in our trust anchor database */
662
663 DNS_ANSWER_FOREACH(anchor, a)for (size_t __unique_prefix_i16 = ({ (anchor) = ((a) &&
(a)->n_rrs > 0) ? (a)->items[0].rr : ((void*)0); 0;
}); (a) && (__unique_prefix_i16 < (a)->n_rrs);
__unique_prefix_i16++, (anchor) = (__unique_prefix_i16 < (
a)->n_rrs ? (a)->items[__unique_prefix_i16].rr : ((void
*)0))) {
664
665 if (anchor->dnskey.protocol != revoked_dnskey->dnskey.protocol)
666 continue;
667
668 if (anchor->dnskey.algorithm != revoked_dnskey->dnskey.algorithm)
669 continue;
670
671 if (anchor->dnskey.key_size != revoked_dnskey->dnskey.key_size)
672 continue;
673
674 /* Note that we allow the REVOKE bit to be
675 * different! It will be set in the revoked
676 * key, but unset in our version of it */
677 if (((anchor->dnskey.flags ^ revoked_dnskey->dnskey.flags) | DNSKEY_FLAG_REVOKE(1 << 7)) != DNSKEY_FLAG_REVOKE(1 << 7))
678 continue;
679
680 if (memcmp(anchor->dnskey.key, revoked_dnskey->dnskey.key, anchor->dnskey.key_size) != 0)
681 continue;
682
683 dns_trust_anchor_remove_revoked(d, anchor);
684 break;
685 }
686 }
687
688 a = hashmap_get(d->positive_by_key, &DNS_RESOURCE_KEY_CONST(revoked_dnskey->key->class, DNS_TYPE_DS, dns_resource_key_name(revoked_dnskey->key))((DnsResourceKey) { .n_ref = (unsigned) -1, .class = revoked_dnskey
->key->class, .type = DNS_TYPE_DS, ._name = (char*) dns_resource_key_name
(revoked_dnskey->key), }));
689 if (a) {
690 DnsResourceRecord *anchor;
691
692 /* Second, look for DS RRs matching this DNSKEY in our trust anchor database */
693
694 DNS_ANSWER_FOREACH(anchor, a)for (size_t __unique_prefix_i17 = ({ (anchor) = ((a) &&
(a)->n_rrs > 0) ? (a)->items[0].rr : ((void*)0); 0;
}); (a) && (__unique_prefix_i17 < (a)->n_rrs);
__unique_prefix_i17++, (anchor) = (__unique_prefix_i17 < (
a)->n_rrs ? (a)->items[__unique_prefix_i17].rr : ((void
*)0))) {
695
696 /* We set mask_revoke to true here, since our
697 * DS fingerprint will be the one of the
698 * unrevoked DNSKEY, but the one we got passed
699 * here has the bit set. */
700 r = dnssec_verify_dnskey_by_ds(revoked_dnskey, anchor, true1);
701 if (r < 0)
702 return r;
703 if (r == 0)
704 continue;
705
706 dns_trust_anchor_remove_revoked(d, anchor);
707 break;
708 }
709 }
710
711 return 0;
712}
713
714int dns_trust_anchor_check_revoked(DnsTrustAnchor *d, DnsResourceRecord *dnskey, DnsAnswer *rrs) {
715 DnsResourceRecord *rrsig;
716 int r;
717
718 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 718, __PRETTY_FUNCTION__); } while (0);
719 assert(dnskey)do { if ((__builtin_expect(!!(!(dnskey)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("dnskey"), "../src/resolve/resolved-dns-trust-anchor.c"
, 719, __PRETTY_FUNCTION__); } while (0);
720
721 /* Looks if "dnskey" is a self-signed RR that has been revoked
722 * and matches one of our trust anchor entries. If so, removes
723 * it from the trust anchor and returns > 0. */
724
725 if (dnskey->key->type != DNS_TYPE_DNSKEY)
726 return 0;
727
728 /* Is this DNSKEY revoked? */
729 if ((dnskey->dnskey.flags & DNSKEY_FLAG_REVOKE(1 << 7)) == 0)
730 return 0;
731
732 /* Could this be interesting to us at all? If not,
733 * there's no point in looking for and verifying a
734 * self-signed RRSIG. */
735 if (!dns_trust_anchor_knows_domain_positive(d, dns_resource_key_name(dnskey->key)))
736 return 0;
737
738 /* Look for a self-signed RRSIG in the other rrs belonging to this DNSKEY */
739 DNS_ANSWER_FOREACH(rrsig, rrs)for (size_t __unique_prefix_i18 = ({ (rrsig) = ((rrs) &&
(rrs)->n_rrs > 0) ? (rrs)->items[0].rr : ((void*)0)
; 0; }); (rrs) && (__unique_prefix_i18 < (rrs)->
n_rrs); __unique_prefix_i18++, (rrsig) = (__unique_prefix_i18
< (rrs)->n_rrs ? (rrs)->items[__unique_prefix_i18].
rr : ((void*)0))) {
740 DnssecResult result;
741
742 if (rrsig->key->type != DNS_TYPE_RRSIG)
743 continue;
744
745 r = dnssec_rrsig_match_dnskey(rrsig, dnskey, true1);
746 if (r < 0)
747 return r;
748 if (r == 0)
749 continue;
750
751 r = dnssec_verify_rrset(rrs, dnskey->key, rrsig, dnskey, USEC_INFINITY((usec_t) -1), &result);
752 if (r < 0)
753 return r;
754 if (result != DNSSEC_VALIDATED)
755 continue;
756
757 /* Bingo! This is a revoked self-signed DNSKEY. Let's
758 * see if this precise one exists in our trust anchor
759 * database, too. */
760 r = dns_trust_anchor_check_revoked_one(d, dnskey);
761 if (r < 0)
762 return r;
763
764 return 1;
765 }
766
767 return 0;
768}
769
770int dns_trust_anchor_is_revoked(DnsTrustAnchor *d, DnsResourceRecord *rr) {
771 assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-trust-anchor.c"
, 771, __PRETTY_FUNCTION__); } while (0);
772
773 if (!IN_SET(rr->key->type, DNS_TYPE_DS, DNS_TYPE_DNSKEY)({ _Bool _found = 0; static __attribute__ ((unused)) char _static_assert__macros_need_to_be_extended
[20 - sizeof((int[]){DNS_TYPE_DS, DNS_TYPE_DNSKEY})/sizeof(int
)]; switch(rr->key->type) { case DNS_TYPE_DS: case DNS_TYPE_DNSKEY
: _found = 1; break; default: break; } _found; }))
774 return 0;
775
776 return set_contains(d->revoked_by_rr, rr);
777}