Fix DNSSEC fail with CNAME replies to DS queries.

A CNAME reply to a DNSSEC query was confusing the validation logic.
It now accepts a signed CNAME reply to a DS query as proof that no DS
exists at the domain. This fixes the DS/zone break detection logic.

CHANGELOG

@@ -1,3 +1,30 @@
+version 2.93
+	Fix a corner-case in DNSSEC validation with wildcards. If we have
+	a wildcard record *.example.com and recieve a query for
+	a.example.com then that's OK, but we have to check that there isn't
+	an actual a.example.com record. The corner case is when we get a
+	query for *.example.com in that case the non-existence check
+	is not required, was being done. Thanks to Jan Breig for
+	spotting this.
+
+	Enable support for inotify on FreeBSD 15.0-RELEASE, which added
+	Linux-compatible inotify support.
+
+	Fix DNSSEC failure with spurious RRSIGs. The presence of wrong
+	RRSIG RRs in replies caused DNSSEC validation to fail even
+	when the RRs do not require validation because the zone is
+	unsigned. Note that, at the time of this commit, Google
+	DNS appears to have the same bug, so if you're using 8.8.8.8
+	or friends as upstream, resolving the broken zones
+	(eg rivcoed.org) will still fail. Thanks to Petr Menšík
+	for the bug report.
+
+	Fix DNSSEC fail with CNAME replies to DS queries. As CNAME reply
+	to a DNSSEC query was confusing the validation logic. It now
+	accepts a signed CNAME reply to a DS query as proof that no DS
+	exists at the domain. This fixes the DS/zone break detection logic.
+
+	
 version 2.92
         Redesign the interaction between DNSSEC validation and per-domain
 	servers, specified as --server=/<domain>/<ip-address>. This should

man/dnsmasq.8

@@ -136,6 +136,8 @@ Log the results of DNS queries handled by dnsmasq. Enable a full cache dump on r
 then the log has extra information at the start of each line.
 This consists of a serial number which ties together the log lines associated with an individual query, and the IP address of the requestor. If the argument "proto" is supplied, this shows everything that "extra" does and also the network protocol used to communicate the queries. Logging of only queries to the authoritative server can be configured with
 .B --log-queries=auth
+and logging only failed replies (Error, NXDOMAIN or NODATA) can be configured with
+.B --log-queries=only_failed
 .TP
 .B \-8, --log-facility=<facility>
 Set the facility to which dnsmasq will send syslog entries, this

src/cache.c

@@ -855,7 +855,7 @@ void cache_end_insert(void)
 #ifdef HAVE_DNSSEC
 void cache_update_hwm(void)
 {
-  /* Sneak out possibly updated crypto HWM values. */
+ /* Sneak out possibly updated crypto HWM values. */
   unsigned char op = PIPE_OP_STATS;
 
   read_write(daemon->pipe_to_parent, &op, sizeof(op), RW_WRITE);
@@ -1000,6 +1000,7 @@ int cache_recv_insert(time_t now, int fd)
       }
       
     case PIPE_OP_RESULT:
+    case PIPE_OP_KILLED:
       {
 	/* UDP validation moved to TCP to avoid truncation. 
 	   Restart UDP validation process with the returned result. */
@@ -1013,11 +1014,14 @@ int cache_recv_insert(time_t now, int fd)
 	    !read_write(fd, (unsigned char *)&ret_len, sizeof(ret_len), RW_READ) ||
 	    !read_write(fd, (unsigned char *)daemon->packet, ret_len, RW_READ) ||
 	    !read_write(fd, (unsigned char *)&forward, sizeof(forward), RW_READ) ||
-	    !read_write(fd, (unsigned char *)&uid, sizeof(uid), RW_READ) ||
-	    !read_write(fd, (unsigned char *)&keycount, sizeof(keycount), RW_READ) ||
-	    !read_write(fd, (unsigned char *)&keycountp, sizeof(keycountp), RW_READ) ||
-	    !read_write(fd, (unsigned char *)&validatecount, sizeof(validatecount), RW_READ) ||
-	    !read_write(fd, (unsigned char *)&validatecountp, sizeof(validatecountp), RW_READ))
+	    !read_write(fd, (unsigned char *)&uid, sizeof(uid), RW_READ))
+	  return 0;
+
+	if (op == PIPE_OP_RESULT && 
+	    (!read_write(fd, (unsigned char *)&keycount, sizeof(keycount), RW_READ) ||
+	     !read_write(fd, (unsigned char *)&keycountp, sizeof(keycountp), RW_READ) ||
+	     !read_write(fd, (unsigned char *)&validatecount, sizeof(validatecount), RW_READ) ||
+	     !read_write(fd, (unsigned char *)&validatecountp, sizeof(validatecountp), RW_READ)))
 	  return 0;
 	
 	/* There's a tiny chance that the frec may have been freed 
@@ -1025,9 +1029,12 @@ int cache_recv_insert(time_t now, int fd)
 	   the uid field which is unique modulo 2^32 for each use. */
 	if (uid == forward->uid)
 	  {
-	    /* repatriate the work counters from the child process. */
-	    *keycountp = keycount;
-	    *validatecountp = validatecount;
+	    if (op == PIPE_OP_RESULT)
+	      {
+		/* repatriate the work counters from the child process. */
+		*keycountp = keycount;
+		*validatecountp = validatecount;
+	      }
 	    
 	    if (!forward->dependent)
 	      return_reply(now, forward, (struct dns_header *)daemon->packet, ret_len, status);
@@ -2243,10 +2250,20 @@ static char *edestr(int ede)
     case EDE_UNS_NS3_ITER:                return "unsupported NSEC3 iterations value";
     case EDE_UNABLE_POLICY:               return "uanble to conform to policy";
     case EDE_SYNTHESIZED:                 return "synthesized";
+    case EDE_US_SERVFAIL:                 return "upstream returned SERVFAIL";
     default:                              return "unknown";
     }
 }
 
+static int error_occured(unsigned int flags) {
+  if (flags & F_RCODE)
+    return 1;
+  else if (flags & F_NEG)
+    return 1;
+  else
+    return 0;
+}
+
 void log_query(unsigned int flags, char *name, union all_addr *addr, char *arg, unsigned short type)
 {
   char *source, *dest;
@@ -2259,6 +2276,9 @@ void log_query(unsigned int flags, char *name, union all_addr *addr, char *arg,
   if (!option_bool(OPT_LOG))
     return;
 
+  if(option_bool(OPT_LOG_ONLY_FAILED) && !error_occured(flags))
+    return;
+
   /* F_NOERR is reused here to indicate logs arrising from auth queries */ 
   if (!(flags & F_NOERR) && option_bool(OPT_AUTH_LOG))
     return;

src/config.h

@@ -142,7 +142,8 @@ HAVE_LOOP
    include functionality to probe for and remove DNS forwarding loops.
 
 HAVE_INOTIFY
-   use the Linux inotify facility to efficiently re-read configuration files.
+   use the Linux and FreeBSD >= 15 inotify facility
+   to efficiently re-read configuration files.
 
 NO_ID
    Don't report *.bind CHAOS info to clients, forward such requests upstream instead.
@@ -375,8 +376,15 @@ HAVE_SOCKADDR_SA_LEN
 #undef HAVE_DUMPFILE
 #endif
 
-#if defined (HAVE_LINUX_NETWORK) && !defined(NO_INOTIFY)
-#define HAVE_INOTIFY
+#if !defined(NO_INOTIFY)
+#  if defined (HAVE_LINUX_NETWORK)
+#    define HAVE_INOTIFY
+#  elif defined (__FreeBSD__) && __FreeBSD__ + 0 >= 15
+#    include <osreldate.h>
+#    if __FreeBSD_version >= 1500068 /* 15.0.0 */
+#      define HAVE_INOTIFY
+#    endif
+#  endif
 #endif
 
 /* This never compiles code, it's only used by the makefile to fingerprint builds. */

src/dns-protocol.h

@@ -86,6 +86,7 @@
 #define EDNS0_OPTION_UMBRELLA       20292 /* Cisco Umbrella temporary assignment */
 
 /* RFC-8914 extended errors, negative values are our definitions */
+#define EDE_US_SERVFAIL    -2  /* SERVFAIL from usptream */
 #define EDE_UNSET          -1  /* No extended DNS error available */
 #define EDE_OTHER           0  /* Other */
 #define EDE_USUPDNSKEY      1  /* Unsupported DNSKEY algo */

src/dnsmasq.c

@@ -1335,11 +1335,42 @@ static void sig_handler(int sig)
       if (sig == SIGTERM || sig == SIGINT)
 	exit(EC_MISC);
     }
-  else if (pid != getpid())
+  else if (daemon->pipe_to_parent != -1)
     {
       /* alarm is used to kill TCP children after a fixed time. */
       if (sig == SIGALRM)
-	_exit(0);
+	{
+#ifdef HAVE_DNSSEC
+	  if (!daemon->forward_to_tcp)
+#endif
+	    _exit(0); /* Normal TCP child */
+#ifdef HAVE_DNSSEC
+	  else
+	    {
+	      /* udp_to_tcp transfer.
+		 If daemon->header_to_tcp is NULL the waiting is over and
+		 we can let things take their course, otherwise, send a failure
+		 return down the pipe to unblock the UDP transaction and kill
+		 the process. */
+	      if (daemon->header_to_tcp)
+		{
+		  unsigned char op = PIPE_OP_KILLED;
+		  int status = STAT_ABANDONED;
+		  
+		  read_write(daemon->pipe_to_parent, &op, sizeof(op), RW_WRITE);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)&status, sizeof(status), RW_WRITE);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)(&daemon->plen_to_tcp), sizeof(daemon->plen_to_tcp), RW_WRITE);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)(daemon->header_to_tcp), daemon->plen_to_tcp, RW_WRITE);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)(&daemon->forward_to_tcp), sizeof(daemon->forward_to_tcp), RW_WRITE);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)(&daemon->forward_to_tcp->uid), sizeof(daemon->forward_to_tcp->uid), RW_WRITE);
+
+		  my_syslog(LOG_INFO, _("TCP process for DNSSEC validation timed out"));
+
+		  _exit(0);
+		}
+	    }
+#endif
+	}
     }
   else
     {
@@ -1941,20 +1972,21 @@ static void check_dns_listeners(time_t now)
 
 static void do_tcp_connection(struct listener *listener, time_t now, int slot)
 {
-  int confd, client_ok = 1;
+  int confd;
   struct irec *iface = NULL;
   pid_t p;
   union mysockaddr tcp_addr;
   socklen_t tcp_len = sizeof(union mysockaddr);
   unsigned char *buff;
   struct server *s; 
-  int flags, auth_dns;
+  int flags, auth_dns = 0;
   struct in_addr netmask;
   int pipefd[2];
 #ifdef HAVE_LINUX_NETWORK
   unsigned char a = 0;
 #endif
-
+  netmask.s_addr = 0;
+  
   while ((confd = accept(listener->tcpfd, NULL, NULL)) == -1 && errno == EINTR);
   
   if (confd == -1)
@@ -1981,58 +2013,63 @@ static void do_tcp_connection(struct listener *listener, time_t now, int slot)
   
   enumerate_interfaces(0);
   
-  if (option_bool(OPT_NOWILD))
-    iface = listener->iface; /* May be NULL */
+  if (option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND))
+    {
+      if ((iface = listener->iface)) 
+	{
+	  netmask = iface->netmask;
+	  auth_dns = iface->dns_auth;
+	}
+    }
   else 
     {
-      int if_index;
+      int if_index, got_index = 0;
       char intr_name[IF_NAMESIZE];
       
-      /* if we can find the arrival interface, check it's one that's allowed */
+      /* if we can find the arrival interface, check it's one that's allowed
+	 tcp_interface() is not implemented on non-Linux platforms */
       if ((if_index = tcp_interface(confd, tcp_addr.sa.sa_family)) != 0 &&
 	  indextoname(listener->tcpfd, if_index, intr_name))
 	{
 	  union all_addr addr;
+
+	  got_index = 1;
 	  
 	  if (tcp_addr.sa.sa_family == AF_INET6)
 	    addr.addr6 = tcp_addr.in6.sin6_addr;
 	  else
 	    addr.addr4 = tcp_addr.in.sin_addr;
 	  
-	  for (iface = daemon->interfaces; iface; iface = iface->next)
-	    if (iface->index == if_index &&
-		iface->addr.sa.sa_family == tcp_addr.sa.sa_family)
-	      break;
-	  
-	  if (!iface && !loopback_exception(listener->tcpfd, tcp_addr.sa.sa_family, &addr, intr_name))
-	    client_ok = 0;
+	  if (!iface_check(tcp_addr.sa.sa_family, &addr, intr_name, &auth_dns) &&
+	      !loopback_exception(listener->tcpfd, tcp_addr.sa.sa_family, &addr, intr_name))
+	    goto closeconandreturn;
 	}
       
-      if (option_bool(OPT_CLEVERBIND))
-	iface = listener->iface; /* May be NULL */
-      else
+      /* When binding the wildcard address, try and get the
+	 netmask of the interface for localisation. */
+      for (iface = daemon->interfaces; iface; iface = iface->next)
+	if (sockaddr_isequal(&iface->addr, &tcp_addr))
+	  {
+	    netmask = iface->netmask;
+	    break;
+	  }
+
+      /* On platforms where tcp_interface() doesn't work, we rely
+	 of the presence of the local address of the connection in the
+	 interface list to check if we're accepting this connection and
+	 for its auth status. */
+      if (!got_index)
 	{
-	  /* Check for allowed interfaces when binding the wildcard address:
-	     we do this by looking for an interface with the same address as 
-	     the local address of the TCP connection, then looking to see if that's
-	     an allowed interface. As a side effect, we get the netmask of the
-	     interface too, for localisation. */
-	  
-	  for (iface = daemon->interfaces; iface; iface = iface->next)
-	    if (sockaddr_isequal(&iface->addr, &tcp_addr))
-	      break;
-	  
 	  if (!iface)
-	    client_ok = 0;
+	    goto closeconandreturn;
+
+	  auth_dns = iface->dns_auth;
 	}
     }
   
-  if (!client_ok)
-    goto closeconandreturn;
-  
   if (!option_bool(OPT_DEBUG))
     {
-      /* The code in edns0.c qthat decorates queries with the source MAC address depends
+      /* The code in edns0.c that decorates queries with the source MAC address depends
 	 on the code in arp.c, which populates a cache with the contents of the ARP table
 	 using netlink. Since the child process can't use netlink, we pre-populate
 	 the cache with the ARP table entry for our source here, including a negative entry
@@ -2100,23 +2137,9 @@ static void do_tcp_connection(struct listener *listener, time_t now, int slot)
 	  
 	  return;
 	}
-    }
-         
-  if (iface)
-    {
-      netmask = iface->netmask;
-      auth_dns = iface->dns_auth;
-    }
-  else
-    {
-      netmask.s_addr = 0;
-      auth_dns = 0;
-    }
-  
-  /* Arrange for SIGALRM after CHILD_LIFETIME seconds to
-     terminate the process. */
-  if (!option_bool(OPT_DEBUG))
-    {
+      
+      /* Arrange for SIGALRM after CHILD_LIFETIME seconds to
+	 terminate the process. */
 #ifdef HAVE_LINUX_NETWORK
       /* See comment above re: netlink socket. */
       close(daemon->netlinkfd);
@@ -2239,8 +2262,12 @@ int swap_to_tcp(struct frec *forward, time_t now, int status, struct dns_header
 	  close(daemon->netlinkfd);
 	  read_write(pipefd[1], &a, 1, RW_WRITE);
 #endif		  
+	  alarm(CHILD_LIFETIME);
 	  close(pipefd[0]); /* close read end in child. */
-	  daemon->pipe_to_parent = pipefd[1];	  
+	  daemon->pipe_to_parent = pipefd[1];
+	  daemon->forward_to_tcp = forward;
+	  daemon->header_to_tcp = header;
+	  daemon->plen_to_tcp = *plen;
 	}
     }
   

src/dnsmasq.h

@@ -289,7 +289,8 @@ struct event_desc {
 #define OPT_DO_0x20        75
 #define OPT_AUTH_LOG       76
 #define OPT_LEASEQUERY     77
-#define OPT_LAST           78
+#define OPT_LOG_ONLY_FAILED  78
+#define OPT_LAST           79
 
 #define OPTION_BITS (sizeof(unsigned int)*8)
 #define OPTION_SIZE ( (OPT_LAST/OPTION_BITS)+((OPT_LAST%OPTION_BITS)!=0) )
@@ -549,6 +550,7 @@ struct crec {
 #define PIPE_OP_STATS   3  /* Update parent's stats */
 #define PIPE_OP_IPSET   4  /* Update IPset */
 #define PIPE_OP_NFTSET  5  /* Update NFTset */
+#define PIPE_OP_KILLED  6  /* child killed by SIGALARM */
 
 /* struct sockaddr is not large enough to hold any address,
    and specifically not big enough to hold an IPv6 address.
@@ -760,10 +762,9 @@ struct dyndir {
 #define STAT_NEED_DS            0x40000
 #define STAT_NEED_KEY           0x50000
 #define STAT_TRUNCATED          0x60000
-#define STAT_SECURE_WILDCARD    0x70000
-#define STAT_OK                 0x80000
-#define STAT_ABANDONED          0x90000
-#define STAT_ASYNC              0xa0000
+#define STAT_OK                 0x70000
+#define STAT_ABANDONED          0x80000
+#define STAT_ASYNC              0x90000
 
 #define DNSSEC_FAIL_NYV         0x0001 /* key not yet valid */
 #define DNSSEC_FAIL_EXP         0x0002 /* key expired */
@@ -777,6 +778,7 @@ struct dyndir {
 #define DNSSEC_FAIL_NSEC3_ITERS 0x0200 /* too many iterations in NSEC3 */
 #define DNSSEC_FAIL_BADPACKET   0x0400 /* bad packet */
 #define DNSSEC_FAIL_WORK        0x0800 /* too much crypto */
+#define DNSSEC_FAIL_UPSTREAM    0x1000 /* SERVFAIL from UPSTREAM */
 
 #define STAT_ISEQUAL(a, b)  (((a) & 0xffff0000) == (b))
 
@@ -1271,6 +1273,9 @@ extern struct daemon {
   int dnssec_no_time_check;
   int back_to_the_future;
   int limit[LIMIT_MAX];
+  struct frec *forward_to_tcp;
+  struct dns_header *header_to_tcp;
+  ssize_t plen_to_tcp;
 #endif
   struct frec *frec_list;
   struct frec_src *free_frec_src;
@@ -1462,7 +1467,7 @@ int dnssec_validate_by_ds(time_t now, struct dns_header *header, size_t plen, ch
 int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char *name,
 		       char *keyname, int class, int *validate_count);
 int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int *class,
-			  int check_unsigned, int *neganswer, int *nons, int *nsec_ttl, int *validate_count);
+			  int check_unsigned, int *neganswer, int *prim_ok, int *nons, int *nsec_ttl, int *validate_count);
 int dnskey_keytag(int alg, int flags, unsigned char *key, int keylen);
 size_t filter_rrsigs(struct dns_header *header, size_t plen);
 int setup_timestamp(void);

src/dnssec.c

@@ -370,45 +370,42 @@ static int explore_rrset(struct dns_header *header, size_t plen, int class, int
 	      
 	      GETSHORT(type_covered, p);
 	      p += 16; /* algo, labels, orig_ttl, sig_expiration, sig_inception, key_tag */
-	      
-	      if (gotkey)
+
+	      if (type_covered == type)
 		{
-		  /* If there's more than one SIG, ensure they all have same keyname */
-		  if (extract_name(header, plen, &p, keyname, EXTR_NAME_COMPARE, 0) != 1)
+		  if (!extract_name(header, plen, &p, daemon->workspacename, EXTR_NAME_EXTRACT, 0))
 		    return 0;
-		}
-	      else
-		{
-		  gotkey = 1;
-		  
-		  if (!extract_name(header, plen, &p, keyname, EXTR_NAME_EXTRACT, 0))
-		    return 0;
-		  
+
 		  /* RFC 4035 5.3.1 says that the Signer's Name field MUST equal
 		     the name of the zone containing the RRset. We can't tell that
 		     for certain, but we can check that  the RRset name is equal to
 		     or encloses the signers name, which should be enough to stop 
 		     an attacker using signatures made with the key of an unrelated 
-		     zone he controls. Note that the root key is always allowed. */
-		  if (*keyname != 0)
+		     zone he controls. Note that the root key is always allowed.
+		     Ignore sigs which aren't valid */
+		  if (*daemon->workspacename == 0 || hostname_issubdomain(name, daemon->workspacename) != 0)
 		    {
-		      char *name_start;
-		      for (name_start = name; !hostname_isequal(name_start, keyname); )
-			if ((name_start = strchr(name_start, '.')))
-			  name_start++; /* chop a label off and try again */
-			else
-			  return 0;
+		      if (gotkey)
+			{
+			  /* If there's more than one valid SIG, they must all have same keyname */
+			  if (!hostname_isequal(keyname, daemon->workspacename))
+			    return 0;
+			}
+		      else
+			{
+			  strcpy(keyname, daemon->workspacename);
+			  gotkey = 1;
+			}
+		      
+		      if (gotkey)
+			{
+			  if (!expand_workspace(&sigs, &sig_sz, sigidx))
+			    return 0; 
+		      
+			  sigs[sigidx++] = pdata;
+			}
 		    }
 		}
-		  
-	      
-	      if (type_covered == type)
-		{
-		  if (!expand_workspace(&sigs, &sig_sz, sigidx))
-		    return 0; 
-		  
-		  sigs[sigidx++] = pdata;
-		} 
 	      
 	      p = pdata + 6; /* restore for ADD_RDLEN */
 	    }
@@ -438,8 +435,6 @@ int dec_counter(int *counter, char *message)
 /* Validate a single RRset (class, type, name) in the supplied DNS reply 
    Return code:
    STAT_SECURE   if it validates.
-   STAT_SECURE_WILDCARD if it validates and is the result of wildcard expansion.
-   (In this case *wildcard_out points to the "body" of the wildcard within name.) 
    STAT_BOGUS    signature is wrong, bad packet.
    STAT_ABANDONED validation abandoned do to excess resource usage.
    STAT_NEED_KEY need DNSKEY to complete validation (name is returned in keyname)
@@ -455,7 +450,7 @@ int dec_counter(int *counter, char *message)
    ttl_out is the floor on TTL, based on TTL and orig_ttl and expiration of sig used to validate.
 */
 static int validate_rrset(time_t now, struct dns_header *header, size_t plen, int class, int type, int sigidx, int rrsetidx, 
-			  char *name, char *keyname, char **wildcard_out, struct blockdata *key, int keylen,
+			  char *name, char *keyname, int *wildcard_offset_out, struct blockdata *key, int keylen,
 			  int algo_in, int keytag_in, unsigned long *ttl_out, int *validate_counter)
 {
   unsigned char *p;
@@ -463,13 +458,15 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
   struct crec *crecp = NULL;
   short *rr_desc = rrfilter_desc(type);
   u32 sig_expiration, sig_inception;
-  int failflags = DNSSEC_FAIL_NOSIG | DNSSEC_FAIL_NYV | DNSSEC_FAIL_EXP | DNSSEC_FAIL_NOKEYSUP;
-  
-  unsigned long curtime = time(0);
+    unsigned long curtime = time(0);
   int time_check = is_check_date(curtime);
+  int failflags = DNSSEC_FAIL_NOSIG;
   
-  if (wildcard_out)
-    *wildcard_out = NULL;
+  if (sigidx != 0)
+    failflags |= DNSSEC_FAIL_NYV | DNSSEC_FAIL_EXP | DNSSEC_FAIL_NOKEYSUP;
+
+  if (wildcard_offset_out)
+    *wildcard_offset_out = 0;
   
   name_labels = count_labels(name); /* For 4035 5.3.2 check */
 
@@ -574,7 +571,9 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
 	  name_start = name;
 	  
 	  /* if more labels than in RRsig name, hash *.<no labels in rrsig labels field>  4035 5.3.2 */
-	  if (labels < name_labels)
+	  /* If the name is already the wildcard, we're not going to change it. */
+	  if (labels < name_labels &&
+	      !(name_labels - labels == 1 && name_start[0] == '*' && name_start[1] == '.'))
 	    {
 	      for (j = name_labels - labels; j != 0; j--)
 		{
@@ -584,11 +583,11 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
 		    name_start++;
 		}
 	      
-	      if (wildcard_out)
-		*wildcard_out = name_start+1;
-
+	      if (wildcard_offset_out)
+		*wildcard_offset_out = name_start - name + 1;
+	      
 	      name_start--;
-	      *name_start = '*';
+	      *name_start = '*';	      
 	    }
 	  
 	  wire_len = to_wire(name_start);
@@ -687,7 +686,7 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
 		  return STAT_ABANDONED;
 		
 		if (verify(crecp->addr.key.keydata, crecp->addr.key.keylen, sig, sig_len, digest, hash->digest_size, algo))
-		  return (labels < name_labels) ? STAT_SECURE_WILDCARD : STAT_SECURE;
+		  return STAT_SECURE;
 		
 		/* An attacker can waste a lot of our CPU by setting up a giant DNSKEY RRSET full of failing
 		   keys, all of which we have to try. Since many failing keys is not likely for
@@ -992,7 +991,7 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
 		       char *keyname, int class, int *validate_counter)
 {
   unsigned char *p = (unsigned char *)(header+1);
-  int qtype, qclass, rc, i, neganswer = 0, nons = 0, servfail = 0, neg_ttl = 0, found_supported = 0;
+  int qtype, qclass, rc, i, neganswer = 0, prim_ok = 0, nons = 0, servfail = 0, neg_ttl = 0, found_supported = 0;
   int aclass, atype, rdlen, flags;
   unsigned long ttl;
   union all_addr a;
@@ -1003,7 +1002,7 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
   if (RCODE(header) == SERVFAIL)
     servfail = neganswer = nons = 1;
   else
-    rc = dnssec_validate_reply(now, header, plen, name, keyname, NULL, 0, &neganswer, &nons, &neg_ttl, validate_counter);
+    rc = dnssec_validate_reply(now, header, plen, name, keyname, NULL, 0, &neganswer, &prim_ok, &nons, &neg_ttl, validate_counter);
   
   p = (unsigned char *)(header+1);
   if (ntohs(header->qdcount) != 1 ||
@@ -1020,27 +1019,32 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
     {
       if (STAT_ISEQUAL(rc, STAT_INSECURE))
 	{
-	  if (option_bool(OPT_BOGUSPRIV) &&
-	      (flags = in_arpa_name_2_addr(name, &a)) &&
-	      ((flags == F_IPV6 && private_net6(&a.addr6, 0)) || (flags == F_IPV4 && private_net(a.addr4, 0))))
+	  /* A INSECURE DS answer is OK if it's negative and there's a CNAME answer to the DS answer which is
+	     signed, since that's enough to prove that the DS record doesn't exist. */
+	  if (!neganswer || !prim_ok)
 	    {
-	      my_syslog(LOG_INFO, _("Insecure reply received for DS %s, assuming that's OK for a RFC-1918 address."), name);
-	      neganswer = 1;
-	      nons = 0; /* If we're faking a DS, fake one with an NS. */
-	      neg_ttl = DNSSEC_ASSUMED_DS_TTL;
-	    }
-	  else if (lookup_domain(name, F_DOMAINSRV, NULL, NULL))
-	    {
-	      my_syslog(LOG_INFO, _("Insecure reply received for DS %s, assuming non-DNSSEC domain-specific server."), name);
-	      neganswer = 1;
-	      nons = 0; /* If we're faking a DS, fake one with an NS. */
-	      neg_ttl = DNSSEC_ASSUMED_DS_TTL;
-	    }
-	  else
-	    {
-	      my_syslog(LOG_WARNING, _("Insecure DS reply received for %s, check domain configuration and upstream DNS server DNSSEC support"), name);
-	      log_query(F_NOEXTRA | F_UPSTREAM, name, NULL, "BOGUS DS - not secure", 0);
-	      return STAT_BOGUS | DNSSEC_FAIL_INDET;
+	      if (option_bool(OPT_BOGUSPRIV) &&
+		  (flags = in_arpa_name_2_addr(name, &a)) &&
+		  ((flags == F_IPV6 && private_net6(&a.addr6, 0)) || (flags == F_IPV4 && private_net(a.addr4, 0))))
+		{
+		  my_syslog(LOG_INFO, _("Insecure reply received for DS %s, assuming that's OK for a RFC-1918 address."), name);
+		  neganswer = 1;
+		  nons = 0; /* If we're faking a DS, fake one with an NS. */
+		  neg_ttl = DNSSEC_ASSUMED_DS_TTL;
+		}
+	      else if (lookup_domain(name, F_DOMAINSRV, NULL, NULL))
+		{
+		  my_syslog(LOG_INFO, _("Insecure reply received for DS %s, assuming non-DNSSEC domain-specific server."), name);
+		  neganswer = 1;
+		  nons = 0; /* If we're faking a DS, fake one with an NS. */
+		  neg_ttl = DNSSEC_ASSUMED_DS_TTL;
+		}
+	      else
+		{
+		  my_syslog(LOG_WARNING, _("Insecure DS reply received for %s, check domain configuration and upstream DNS server DNSSEC support"), name);
+		  log_query(F_NOEXTRA | F_UPSTREAM, name, NULL, "BOGUS DS - not secure", 0);
+		  return STAT_BOGUS | DNSSEC_FAIL_INDET; 
+		}
 	    }
 	}
       else
@@ -1545,7 +1549,7 @@ static int check_nsec3_coverage(struct dns_header *header, size_t plen, int dige
 
 /* returns 0 on success, or DNSSEC_FAIL_* value on failure. */
 static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, unsigned char **nsecs, int nsec_count, char *workspace1,
-				     char *workspace2, char *name, int type, char *wildname, int *nons, int *validate_counter)
+				     char *workspace2, char *name, int type, int wild_offset, int *nons, int *validate_counter)
 {
   unsigned char *salt, *p, *digest;
   int digest_len, i, iterations, salt_len, base32_len, algo = 0;
@@ -1643,9 +1647,9 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns
       if (*closest_encloser == '.')
 	closest_encloser++;
 
-      if (wildname && hostname_isequal(closest_encloser, wildname))
+      if (wild_offset != 0 && name - closest_encloser == wild_offset)
 	break;
-
+      
       if (dec_counter(validate_counter, NULL))
 	return DNSSEC_FAIL_WORK;
       
@@ -1687,7 +1691,7 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns
     return DNSSEC_FAIL_NONSEC;
   
   /* Finally, check that there's no seat of wildcard synthesis */
-  if (!wildname)
+  if (wild_offset == 0)
     {
       if (!(wildcard = strchr(next_closest, '.')) || wildcard == next_closest)
 	return DNSSEC_FAIL_NONSEC;
@@ -1710,7 +1714,7 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns
 
 /* returns 0 on success, or DNSSEC_FAIL_* value on failure. */
 static int prove_non_existence(struct dns_header *header, size_t plen, char *keyname, char *name, int qtype, int qclass,
-			       char *wildname, int *nons, int *nsec_ttl, int *validate_counter)
+			      int wild_offset, int *nons, int *nsec_ttl, int *validate_counter)
 {
   static unsigned char **nsecset = NULL, **rrsig_labels = NULL;
   static int nsecset_sz = 0, rrsig_labels_sz = 0;
@@ -1858,7 +1862,7 @@ static int prove_non_existence(struct dns_header *header, size_t plen, char *key
   if (type_found == T_NSEC)
     return prove_non_existence_nsec(header, plen, nsecset, rrsig_labels, nsecs_found, daemon->workspacename, keyname, name, qtype, nons);
   else if (type_found == T_NSEC3)
-    return prove_non_existence_nsec3(header, plen, nsecset, nsecs_found, daemon->workspacename, keyname, name, qtype, wildname, nons, validate_counter);
+    return prove_non_existence_nsec3(header, plen, nsecset, nsecs_found, daemon->workspacename, keyname, name, qtype, wild_offset, nons, validate_counter);
   else
     return DNSSEC_FAIL_NONSEC;
 }
@@ -1965,7 +1969,7 @@ static int zone_status(char *name, int class, char *keyname, time_t now)
    if the nons argument is non-NULL.
 */
 int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, 
-			  int *class, int check_unsigned, int *neganswer, int *nons, int *nsec_ttl, int *validate_counter)
+			  int *class, int check_unsigned, int *neganswer, int *prim_ok, int *nons, int *nsec_ttl, int *validate_counter)
 {
   static unsigned char **targets = NULL;
   static int target_sz = 0;
@@ -1994,8 +1998,11 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
   
   if (neganswer)
     *neganswer = 0;
+
+  if (RCODE(header) == SERVFAIL)
+    return STAT_BOGUS | DNSSEC_FAIL_UPSTREAM;
   
-  if (RCODE(header) == SERVFAIL || ntohs(header->qdcount) != 1)
+  if (ntohs(header->qdcount) != 1)
     return STAT_BOGUS;
   
   if (RCODE(header) != NXDOMAIN && RCODE(header) != NOERROR)
@@ -2103,8 +2110,8 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
 		       CNAME must be <subdomain>.<dname>
 		       CNAME target must be <subdomain>.<dname_target>
 		       <subdomain>s must match for name and target. */ 
-		    if (hostname_issubdomain(name, daemon->cname) == 1 &&
-			hostname_issubdomain(keyname, daemon->workspacename) == 1 &&
+		    if (hostname_issubdomain(daemon->cname, name) == 1 &&
+			hostname_issubdomain(daemon->workspacename, keyname) == 1 &&
 			name_prefix_len == strlen(daemon->workspacename) - strlen(keyname))
 		      {
 			char save = daemon->cname[name_prefix_len];
@@ -2183,47 +2190,32 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
       else
 	{
 	  /* Not done, validate now */
-	  int sigcnt, rrcnt;
-	  char *wildname;
+	  int sigcnt, rrcnt, wild_offset;
 	  
 	  if (!explore_rrset(header, plen, class1, type1, name, keyname, &sigcnt, &rrcnt))
 	    return STAT_BOGUS;
 	  
-	  /* No signatures for RRset. We can be configured to assume this is OK and return an INSECURE result. */
-	  if (sigcnt == 0)
-	    {
-	      /* NSEC and NSEC3 records must be signed. We make this assumption elsewhere. */
-	      if (type1 == T_NSEC || type1 == T_NSEC3)
-		return STAT_BOGUS | DNSSEC_FAIL_NOSIG;
-	      else if (nons && i >= ntohs(header->ancount))
-		/* If we're validating a DS reply, rather than looking for the value of AD bit,
-		   we only care that NSEC and NSEC3 RRs in the auth section are signed. 
-		   Return SECURE even if others (SOA....) are not. */
-		rc = STAT_SECURE;
-	      else
-		{
-		  /* unsigned RRsets in auth section are not BOGUS, but do make reply insecure. */
-		  if (check_unsigned && i < ntohs(header->ancount))
-		    {
-		      rc = zone_status(name, class1, keyname, now);
-		      if (STAT_ISEQUAL(rc, STAT_SECURE))
-			rc = STAT_BOGUS | DNSSEC_FAIL_NOSIG;
-		      
-		      if (class)
-			*class = class1; /* Class for NEED_DS or NEED_KEY */
-		    }
-		  else 
-		    rc = STAT_INSECURE; 
-		  
-		  if (!STAT_ISEQUAL(rc, STAT_INSECURE))
-		    return rc;
-		}
-	    }
+	  /* NSEC and NSEC3 records must be signed. We make this assumption elsewhere. */
+	  if (sigcnt == 0 && (type1 == T_NSEC || type1 == T_NSEC3))
+	    return STAT_BOGUS | DNSSEC_FAIL_NOSIG;
+	  else if (sigcnt == 0 && nons && i >= ntohs(header->ancount))
+	    /* If we're validating a DS reply, rather than looking for the value of AD bit,
+	       we only care that NSEC and NSEC3 RRs in the auth section are signed. 
+	       Return SECURE even if others (SOA....) are not. */
+	    rc = STAT_SECURE;
+	  else if (sigcnt == 0 && (!check_unsigned || i >= ntohs(header->ancount)))
+	    /* unsigned RRsets in auth section are not BOGUS, but do make reply insecure. */
+	    rc = STAT_INSECURE;
 	  else
 	    {
-	      /* explore_rrset() gives us key name from sigs in keyname.
+	      /* explore_rrset() gives us zone name from sigs in keyname, if
+		 it didn't find a key, use the name we're validating.
 		 Can't overwrite name here. */
-	      strcpy(daemon->workspacename, keyname);
+	      if (sigcnt == 0)
+		strcpy(daemon->workspacename, name);
+	      else
+		strcpy(daemon->workspacename, keyname);
+	      
 	      rc = zone_status(daemon->workspacename, class1, keyname, now);
 	      
 	      if (STAT_ISEQUAL(rc, STAT_BOGUS) || STAT_ISEQUAL(rc, STAT_NEED_KEY) || STAT_ISEQUAL(rc, STAT_NEED_DS))
@@ -2233,12 +2225,12 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
 		  return rc;
 		}
 	      
-	      /* Zone is insecure, don't need to validate RRset */
+	      /* If zone is insecure, don't need to validate RRset, and rc remains as STAT_INSECURE*/
 	      if (STAT_ISEQUAL(rc, STAT_SECURE))
 		{
 		  unsigned long sig_ttl;
 		  rc = validate_rrset(now, header, plen, class1, type1, sigcnt,
-				      rrcnt, name, keyname, &wildname, NULL, 0, 0, 0, &sig_ttl, validate_counter);
+				      rrcnt, name, keyname, &wild_offset, NULL, 0, 0, 0, &sig_ttl, validate_counter);
 		  
 		  if (STAT_ISEQUAL(rc, STAT_BOGUS) || STAT_ISEQUAL(rc, STAT_NEED_KEY) || STAT_ISEQUAL(rc, STAT_NEED_DS) || STAT_ISEQUAL(rc, STAT_ABANDONED))
 		    {
@@ -2247,7 +2239,7 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
 		      return rc;
 		    } 
 		  
-		  /* rc is now STAT_SECURE or STAT_SECURE_WILDCARD */
+		  /* rc is now STAT_SECURE  */
 		  
 		  /* Note that RR is validated */
 		  daemon->rr_status[i] = sig_ttl;
@@ -2273,8 +2265,8 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
 		     Note that we may not yet have validated the NSEC/NSEC3 RRsets. 
 		     That's not a problem since if the RRsets later fail
 		     we'll return BOGUS then. */
-		  if (STAT_ISEQUAL(rc, STAT_SECURE_WILDCARD) &&
-		      ((rc_nsec = prove_non_existence(header, plen, keyname, name, type1, class1, wildname, NULL, NULL, validate_counter))) != 0)
+		  if (wild_offset != 0 &&
+		      ((rc_nsec = prove_non_existence(header, plen, keyname, name, type1, class1, wild_offset, NULL, NULL, validate_counter))) != 0)
 		    return  (rc_nsec & DNSSEC_FAIL_WORK) ? STAT_ABANDONED : (STAT_BOGUS | rc_nsec);
 
 		  rc = STAT_SECURE;
@@ -2286,6 +2278,20 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
 	secure = STAT_INSECURE;
     }
 
+
+  /* For a DS record, we are interested also in if the answer to the DS query was
+     a CNAME RRset which validated. That's proof that the DS doesn't exist,
+     even if it's  a CNAME which is not signed, and therefore we have no proof
+     of what it actually _is_. This return tells us that the answer to
+     primary query is secure, even is the whole answer is insecure, because
+     something down the CNAME list doesn't validate or doesn't exist.
+     Note that prim_ok is only valid when neganswer is true, ie either
+     the answer is the requested record or it's a CNAME that ends
+     in a missing answer or an unsigned zone.
+  */
+  if (prim_ok)
+    *prim_ok = !targets[0];
+    
   /* OK, all the RRsets validate, now see if we have a missing answer or CNAME target. */
   for (j = 0; j <targetidx; j++)
     if ((p2 = targets[j]))
@@ -2296,20 +2302,12 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
 	if (!extract_name(header, plen, &p2, name, EXTR_NAME_EXTRACT, 10))
 	  return STAT_BOGUS; /* bad packet */
 	
-	/* NXDOMAIN or NODATA reply, unanswered question is (name, qclass, qtype) */
-	
-	/* For anything other than a DS record, this situation is OK if either
-	   the answer is in an unsigned zone, or there's NSEC records.
-	   For a DS record, we return INSECURE, which almost always turns
-	   into BOGUS in the caller. */
-	if ((rc_nsec = prove_non_existence(header, plen, keyname, name, qtype, qclass, NULL, nons, nsec_ttl, validate_counter)) != 0)
+	/* NXDOMAIN or NODATA reply, unanswered question is (name, qclass, qtype)
+	   This situation is OK if either the answer is in an unsigned zone, or there's NSEC records. */
+	if ((rc_nsec = prove_non_existence(header, plen, keyname, name, qtype, qclass, 0, nons, nsec_ttl, validate_counter)) != 0)
 	  {
 	    if (rc_nsec & DNSSEC_FAIL_WORK)
 	      return STAT_ABANDONED;
-
-	    /* Empty DS without NSECS */
-	    if (qtype == T_DS)
-	      return STAT_INSECURE;
 	    
 	    if ((rc_nsec & (DNSSEC_FAIL_NONSEC | DNSSEC_FAIL_NSEC3_ITERS)) &&
 		!STAT_ISEQUAL((rc = zone_status(name, qclass, keyname, now)), STAT_SECURE))
@@ -2381,8 +2379,9 @@ int errflags_to_ede(int status)
   /* We can end up with more than one flag set for some errors,
      so this encodes a rough priority so the (eg) No sig is reported
      before no-unexpired-sig. */
-
-  if (status & DNSSEC_FAIL_NYV)
+  if (status & DNSSEC_FAIL_UPSTREAM)
+    return EDE_US_SERVFAIL;
+  else if (status & DNSSEC_FAIL_NYV)
     return EDE_SIG_NYV;
   else if (status & DNSSEC_FAIL_EXP)
     return EDE_SIG_EXP;

src/forward.c

@@ -960,7 +960,7 @@ static void dnssec_validate(struct frec *forward, struct dns_header *header,
 	    status = dnssec_validate_ds(now, header, plen, daemon->namebuff, daemon->keyname, forward->class, &orig->validate_counter);
 	  else
 	    status = dnssec_validate_reply(now, header, plen, daemon->namebuff, daemon->keyname, &forward->class, 
-					   !option_bool(OPT_DNSSEC_IGN_NS), NULL, NULL, NULL, &orig->validate_counter);
+					   !option_bool(OPT_DNSSEC_IGN_NS), NULL, NULL, NULL, NULL, &orig->validate_counter);
 	  
 	  if (STAT_ISEQUAL(status, STAT_ABANDONED))
 	    log_resource = 1;
@@ -1399,6 +1399,9 @@ void return_reply(time_t now, struct frec *forward, struct dns_header *header, s
       
 	  a.log.ede = ede;
 	  log_query(F_SECSTAT, domain, &a, result, 0);
+
+	  if (ede == EDE_US_SERVFAIL)
+	    ede = EDE_DNSSEC_BOGUS;
 	}
     }
   
@@ -2223,7 +2226,7 @@ int tcp_from_udp(time_t now, int status, struct dns_header *header, ssize_t *ple
 	      
 	      if (n >= daemon->edns_pktsz)
 		{
-		  /* still too bIg, strip optional sections and try again. */
+		  /* still too big, strip optional sections and try again. */
 		  new_header->nscount = htons(0);
 		  new_header->arcount = htons(0);
 		  n = resize_packet(new_header, n, NULL, 0);
@@ -2237,6 +2240,10 @@ int tcp_from_udp(time_t now, int status, struct dns_header *header, ssize_t *ple
 		    }
 		}
 	      
+	      /* we have succeeded and are no longer blocked talking
+		 on a TCP connection, so if the watchdog alarm goes off,
+		 ignore it. */
+	      daemon->forward_to_tcp = NULL;
 	      /* return the stripped or truncated reply. */
 	      memcpy(header, new_header, n);
 	      *plenp = n;
@@ -2270,7 +2277,7 @@ static int tcp_key_recurse(time_t now, int status, struct dns_header *header, si
 	new_status = dnssec_validate_ds(now, header, n, name, keyname, class, validatecount);
       else
 	new_status = dnssec_validate_reply(now, header, n, name, keyname, &class,
-					   !option_bool(OPT_DNSSEC_IGN_NS), NULL, NULL, NULL, validatecount);
+					   !option_bool(OPT_DNSSEC_IGN_NS), NULL, NULL, NULL, NULL, validatecount);
       
       if (!STAT_ISEQUAL(new_status, STAT_NEED_DS) && !STAT_ISEQUAL(new_status, STAT_NEED_KEY) && !STAT_ISEQUAL(new_status, STAT_ABANDONED))
 	break;
@@ -2661,6 +2668,8 @@ unsigned char *tcp_request(int confd, time_t now,
 			      
 			      a.log.ede = ede;
 			      log_query(F_SECSTAT, domain, &a, result, 0);
+			      if (ede == EDE_US_SERVFAIL)
+				ede = EDE_DNSSEC_BOGUS;
 			      
 			      if ((daemon->limit[LIMIT_CRYPTO] - validatecount) > (int)daemon->metrics[METRIC_CRYPTO_HWM])
 				daemon->metrics[METRIC_CRYPTO_HWM] = daemon->limit[LIMIT_CRYPTO] - validatecount;

src/option.c

@@ -3463,6 +3463,8 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
 	    }
 	  else if (strcmp(arg, "auth") == 0)
 	    set_option_bool(OPT_AUTH_LOG);
+	  else if (strcmp(arg, "only_failed") == 0)
+	    set_option_bool(OPT_LOG_ONLY_FAILED);
 	}
       break;
 

src/util.c

@@ -443,8 +443,8 @@ int hostname_issubdomain(char *a, char *b)
   for (ap = a; *ap; ap++); 
   for (bp = b; *bp; bp++);
 
-  /* a shorter than b or a empty. */
-  if ((bp - b) < (ap - a) || ap == a)
+  /* a shorter than b */
+  if ((ap - a) < (bp - b))
     return 0;
 
   do
@@ -459,12 +459,12 @@ int hostname_issubdomain(char *a, char *b)
 
        if (c1 != c2)
 	 return 0;
-    } while (ap != a);
+    } while (bp != b);
 
-  if (bp == b)
+  if (ap == a)
     return 2;
 
-  if (*(--bp) == '.')
+  if (*(--ap) == '.')
     return 1;
 
   return 0;