xref: /openbsd-src/usr.sbin/nsd/query.c (revision 24bb5fcea3ed904bc467217bdaadb5dfc618d5bf)
1 /*
2  * query.c -- nsd(8) the resolver.
3  *
4  * Copyright (c) 2001-2006, NLnet Labs. All rights reserved.
5  *
6  * See LICENSE for the license.
7  *
8  */
9 
10 #include "config.h"
11 
12 #include <sys/types.h>
13 #include <sys/socket.h>
14 #include <netinet/in.h>
15 #include <arpa/inet.h>
16 #include <assert.h>
17 #include <ctype.h>
18 #include <errno.h>
19 #include <limits.h>
20 #include <stddef.h>
21 #include <stdio.h>
22 #include <stdlib.h>
23 #include <string.h>
24 #include <time.h>
25 #include <unistd.h>
26 #include <netdb.h>
27 
28 #include "answer.h"
29 #include "axfr.h"
30 #include "dns.h"
31 #include "dname.h"
32 #include "nsd.h"
33 #include "namedb.h"
34 #include "query.h"
35 #include "util.h"
36 #include "options.h"
37 #include "nsec3.h"
38 #include "tsig.h"
39 
40 /* [Bug #253] Adding unnecessary NS RRset may lead to undesired truncation.
41  * This function determines if the final response packet needs the NS RRset
42  * included. Currently, it will only return negative if QTYPE == DNSKEY|DS.
43  * This way, resolvers won't fallback to TCP unnecessarily when priming
44  * trust anchors.
45  */
46 static int answer_needs_ns(struct query  *query);
47 
48 static int add_rrset(struct query  *query,
49 		     answer_type    *answer,
50 		     rr_section_type section,
51 		     domain_type    *owner,
52 		     rrset_type     *rrset);
53 
54 static void answer_authoritative(struct nsd	  *nsd,
55 				 struct query     *q,
56 				 answer_type      *answer,
57 				 size_t            domain_number,
58 				 int               exact,
59 				 domain_type      *closest_match,
60 				 domain_type      *closest_encloser,
61 				 const dname_type *qname);
62 
63 static void answer_lookup_zone(struct nsd *nsd, struct query *q,
64 			       answer_type *answer, size_t domain_number,
65 			       int exact, domain_type *closest_match,
66 			       domain_type *closest_encloser,
67 			       const dname_type *qname);
68 
69 void
70 query_put_dname_offset(struct query *q, domain_type *domain, uint16_t offset)
71 {
72 	assert(q);
73 	assert(domain);
74 	assert(domain->number > 0);
75 
76 	if (offset > MAX_COMPRESSION_OFFSET)
77 		return;
78 	if (q->compressed_dname_count >= MAX_COMPRESSED_DNAMES)
79 		return;
80 
81 	q->compressed_dname_offsets[domain->number] = offset;
82 	q->compressed_dnames[q->compressed_dname_count] = domain;
83 	++q->compressed_dname_count;
84 }
85 
86 void
87 query_clear_dname_offsets(struct query *q, size_t max_offset)
88 {
89 	while (q->compressed_dname_count > 0
90 	       && (q->compressed_dname_offsets[q->compressed_dnames[q->compressed_dname_count - 1]->number]
91 		   >= max_offset))
92 	{
93 		q->compressed_dname_offsets[q->compressed_dnames[q->compressed_dname_count - 1]->number] = 0;
94 		--q->compressed_dname_count;
95 	}
96 }
97 
98 void
99 query_clear_compression_tables(struct query *q)
100 {
101 	uint16_t i;
102 
103 	for (i = 0; i < q->compressed_dname_count; ++i) {
104 		assert(q->compressed_dnames);
105 		q->compressed_dname_offsets[q->compressed_dnames[i]->number] = 0;
106 	}
107 	q->compressed_dname_count = 0;
108 }
109 
110 void
111 query_add_compression_domain(struct query *q, domain_type *domain, uint16_t offset)
112 {
113 	while (domain->parent) {
114 		DEBUG(DEBUG_NAME_COMPRESSION, 2,
115 		      (LOG_INFO, "query dname: %s, number: %lu, offset: %u\n",
116 		       domain_to_string(domain),
117 		       (unsigned long) domain->number,
118 		       offset));
119 		query_put_dname_offset(q, domain, offset);
120 		offset += label_length(dname_name(domain_dname(domain))) + 1;
121 		domain = domain->parent;
122 	}
123 }
124 
125 /*
126  * Generate an error response with the specified RCODE.
127  */
128 query_state_type
129 query_error (struct query *q, nsd_rc_type rcode)
130 {
131 	if (rcode == NSD_RC_DISCARD) {
132 		return QUERY_DISCARDED;
133 	}
134 
135 	buffer_clear(q->packet);
136 
137 	QR_SET(q->packet);	   /* This is an answer.  */
138 	AD_CLR(q->packet);
139 	RCODE_SET(q->packet, (int) rcode); /* Error code.  */
140 
141 	/* Truncate the question as well... */
142 	QDCOUNT_SET(q->packet, 0);
143 	ANCOUNT_SET(q->packet, 0);
144 	NSCOUNT_SET(q->packet, 0);
145 	ARCOUNT_SET(q->packet, 0);
146 	buffer_set_position(q->packet, QHEADERSZ);
147 	return QUERY_PROCESSED;
148 }
149 
150 static int
151 query_ratelimit_err(nsd_type* nsd)
152 {
153 	time_t now = time(NULL);
154 	if(nsd->err_limit_time == now) {
155 		/* see if limit is exceeded for this second */
156 		if(nsd->err_limit_count++ > ERROR_RATELIMIT)
157 			return 1;
158 	} else {
159 		/* new second, new limits */
160 		nsd->err_limit_time = now;
161 		nsd->err_limit_count = 1;
162 	}
163 	return 0;
164 }
165 
166 static query_state_type
167 query_formerr (struct query *query, nsd_type* nsd)
168 {
169 	int opcode = OPCODE(query->packet);
170 	if(query_ratelimit_err(nsd))
171 		return QUERY_DISCARDED;
172 	FLAGS_SET(query->packet, FLAGS(query->packet) & 0x0100U);
173 			/* Preserve the RD flag. Clear the rest. */
174 	OPCODE_SET(query->packet, opcode);
175 	return query_error(query, NSD_RC_FORMAT);
176 }
177 
178 static void
179 query_cleanup(void *data)
180 {
181 	query_type *query = (query_type *) data;
182 	region_destroy(query->region);
183 }
184 
185 query_type *
186 query_create(region_type *region, uint16_t *compressed_dname_offsets,
187 	size_t compressed_dname_size, domain_type **compressed_dnames)
188 {
189 	query_type *query
190 		= (query_type *) region_alloc_zero(region, sizeof(query_type));
191 	/* create region with large block size, because the initial chunk
192 	   saves many mallocs in the server */
193 	query->region = region_create_custom(xalloc, free, 16384, 16384/8, 32, 0);
194 	query->compressed_dname_offsets = compressed_dname_offsets;
195 	query->compressed_dnames = compressed_dnames;
196 	query->packet = buffer_create(region, QIOBUFSZ);
197 	region_add_cleanup(region, query_cleanup, query);
198 	query->compressed_dname_offsets_size = compressed_dname_size;
199 	tsig_create_record(&query->tsig, region);
200 	query->tsig_prepare_it = 1;
201 	query->tsig_update_it = 1;
202 	query->tsig_sign_it = 1;
203 	return query;
204 }
205 
206 void
207 query_reset(query_type *q, size_t maxlen, int is_tcp)
208 {
209 	/*
210 	 * As long as less than 4Kb (region block size) has been used,
211 	 * this call to free_all is free, the block is saved for re-use,
212 	 * so no malloc() or free() calls are done.
213 	 * at present use of the region is for:
214 	 *   o query qname dname_type (255 max).
215 	 *   o wildcard expansion domain_type (7*ptr+u32+2bytes)+(5*ptr nsec3)
216 	 *   o wildcard expansion for additional section domain_type.
217 	 *   o nsec3 hashed name(s) (3 dnames for a nonexist_proof,
218 	 *     one proof per wildcard and for nx domain).
219 	 */
220 	region_free_all(q->region);
221 	q->addrlen = sizeof(q->addr);
222 	q->maxlen = maxlen;
223 	q->reserved_space = 0;
224 	buffer_clear(q->packet);
225 	edns_init_record(&q->edns);
226 	tsig_init_record(&q->tsig, NULL, NULL);
227 	q->tsig_prepare_it = 1;
228 	q->tsig_update_it = 1;
229 	q->tsig_sign_it = 1;
230 	q->tcp = is_tcp;
231 	q->qname = NULL;
232 	q->qtype = 0;
233 	q->qclass = 0;
234 	q->zone = NULL;
235 	q->opcode = 0;
236 	q->cname_count = 0;
237 	q->delegation_domain = NULL;
238 	q->delegation_rrset = NULL;
239 	q->compressed_dname_count = 0;
240 	q->number_temporary_domains = 0;
241 
242 	q->axfr_is_done = 0;
243 	q->axfr_zone = NULL;
244 	q->axfr_current_domain = NULL;
245 	q->axfr_current_rrset = NULL;
246 	q->axfr_current_rr = 0;
247 
248 #ifdef RATELIMIT
249 	q->wildcard_domain = NULL;
250 #endif
251 }
252 
253 /* get a temporary domain number (or 0=failure) */
254 static domain_type*
255 query_get_tempdomain(struct query *q)
256 {
257 	static domain_type d[EXTRA_DOMAIN_NUMBERS];
258 	if(q->number_temporary_domains >= EXTRA_DOMAIN_NUMBERS)
259 		return 0;
260 	q->number_temporary_domains ++;
261 	memset(&d[q->number_temporary_domains-1], 0, sizeof(domain_type));
262 	d[q->number_temporary_domains-1].number = q->compressed_dname_offsets_size +
263 		q->number_temporary_domains - 1;
264 	return &d[q->number_temporary_domains-1];
265 }
266 
267 static void
268 query_addtxt(struct query  *q,
269 	     const uint8_t *dname,
270 	     uint16_t       klass,
271 	     uint32_t       ttl,
272 	     const char    *txt)
273 {
274 	size_t txt_length = strlen(txt);
275 	uint8_t len = (uint8_t) txt_length;
276 
277 	assert(txt_length <= UCHAR_MAX);
278 
279 	/* Add the dname */
280 	if (dname >= buffer_begin(q->packet)
281 	    && dname <= buffer_current(q->packet))
282 	{
283 		buffer_write_u16(q->packet,
284 				 0xc000 | (dname - buffer_begin(q->packet)));
285 	} else {
286 		buffer_write(q->packet, dname + 1, *dname);
287 	}
288 
289 	buffer_write_u16(q->packet, TYPE_TXT);
290 	buffer_write_u16(q->packet, klass);
291 	buffer_write_u32(q->packet, ttl);
292 	buffer_write_u16(q->packet, len + 1);
293 	buffer_write_u8(q->packet, len);
294 	buffer_write(q->packet, txt, len);
295 }
296 
297 /*
298  * Parse the question section of a query.  The normalized query name
299  * is stored in QUERY->name, the class in QUERY->klass, and the type
300  * in QUERY->type.
301  */
302 static int
303 process_query_section(query_type *query)
304 {
305 	uint8_t qnamebuf[MAXDOMAINLEN];
306 
307 	buffer_set_position(query->packet, QHEADERSZ);
308 	/* Lets parse the query name and convert it to lower case.  */
309 	if(!packet_read_query_section(query->packet, qnamebuf,
310 		&query->qtype, &query->qclass))
311 		return 0;
312 	query->qname = dname_make(query->region, qnamebuf, 1);
313 	return 1;
314 }
315 
316 
317 /*
318  * Process an optional EDNS OPT record.  Sets QUERY->EDNS to 0 if
319  * there was no EDNS record, to -1 if there was an invalid or
320  * unsupported EDNS record, and to 1 otherwise.  Updates QUERY->MAXLEN
321  * if the EDNS record specifies a maximum supported response length.
322  *
323  * Return NSD_RC_FORMAT on failure, NSD_RC_OK on success.
324  */
325 static nsd_rc_type
326 process_edns(nsd_type* nsd, struct query *q)
327 {
328 	if (q->edns.status == EDNS_ERROR) {
329 		/* The only error is VERSION not implemented */
330 		return NSD_RC_FORMAT;
331 	}
332 
333 	if (q->edns.status == EDNS_OK) {
334 		/* Only care about UDP size larger than normal... */
335 		if (!q->tcp && q->edns.maxlen > UDP_MAX_MESSAGE_LEN) {
336 			size_t edns_size;
337 #if defined(INET6)
338 			if (q->addr.ss_family == AF_INET6) {
339 				edns_size = nsd->ipv6_edns_size;
340 			} else
341 #endif
342 			edns_size = nsd->ipv4_edns_size;
343 
344 			if (q->edns.maxlen < edns_size) {
345 				q->maxlen = q->edns.maxlen;
346 			} else {
347 				q->maxlen = edns_size;
348 			}
349 
350 #if defined(INET6) && !defined(IPV6_USE_MIN_MTU) && !defined(IPV6_MTU)
351 			/*
352 			 * Use IPv6 minimum MTU to avoid sending
353 			 * packets that are too large for some links.
354 			 * IPv6 will not automatically fragment in
355 			 * this case (unlike IPv4).
356 			 */
357 			if (q->addr.ss_family == AF_INET6
358 			    && q->maxlen > IPV6_MIN_MTU)
359 			{
360 				q->maxlen = IPV6_MIN_MTU;
361 			}
362 #endif
363 		}
364 
365 		/* Strip the OPT resource record off... */
366 		buffer_set_position(q->packet, q->edns.position);
367 		buffer_set_limit(q->packet, q->edns.position);
368 		ARCOUNT_SET(q->packet, ARCOUNT(q->packet) - 1);
369 	}
370 	return NSD_RC_OK;
371 }
372 
373 /*
374  * Processes TSIG.
375  * Sets error when tsig does not verify on the query.
376  */
377 static nsd_rc_type
378 process_tsig(struct query* q)
379 {
380 	if(q->tsig.status == TSIG_ERROR)
381 		return NSD_RC_FORMAT;
382 	if(q->tsig.status == TSIG_OK) {
383 		if(!tsig_from_query(&q->tsig)) {
384 			char a[128];
385 			addr2str(&q->addr, a, sizeof(a));
386 			log_msg(LOG_ERR, "query: bad tsig (%s) for key %s from %s",
387 				tsig_error(q->tsig.error_code),
388 				dname_to_string(q->tsig.key_name, NULL), a);
389 			return NSD_RC_NOTAUTH;
390 		}
391 		buffer_set_limit(q->packet, q->tsig.position);
392 		ARCOUNT_SET(q->packet, ARCOUNT(q->packet) - 1);
393 		tsig_prepare(&q->tsig);
394 		tsig_update(&q->tsig, q->packet, buffer_limit(q->packet));
395 		if(!tsig_verify(&q->tsig)) {
396 			char a[128];
397 			addr2str(&q->addr, a, sizeof(a));
398 			log_msg(LOG_ERR, "query: bad tsig signature for key %s from %s",
399 				dname_to_string(q->tsig.key->name, NULL), a);
400 			return NSD_RC_NOTAUTH;
401 		}
402 		DEBUG(DEBUG_XFRD,1, (LOG_INFO, "query good tsig signature for %s",
403 			dname_to_string(q->tsig.key->name, NULL)));
404 	}
405 	return NSD_RC_OK;
406 }
407 
408 /*
409  * Check notify acl and forward to xfrd (or return an error).
410  */
411 static query_state_type
412 answer_notify(struct nsd* nsd, struct query *query)
413 {
414 	int acl_num, acl_num_xfr;
415 	struct acl_options *why;
416 	nsd_rc_type rc;
417 
418 	struct zone_options* zone_opt;
419 	DEBUG(DEBUG_XFRD,1, (LOG_INFO, "got notify %s processing acl",
420 		dname_to_string(query->qname, NULL)));
421 
422 	zone_opt = zone_options_find(nsd->options, query->qname);
423 	if(!zone_opt)
424 		return query_error(query, NSD_RC_NXDOMAIN);
425 
426 	if(!nsd->this_child) /* we are in debug mode or something */
427 		return query_error(query, NSD_RC_SERVFAIL);
428 
429 	if(!tsig_find_rr(&query->tsig, query->packet)) {
430 		DEBUG(DEBUG_XFRD,2, (LOG_ERR, "bad tsig RR format"));
431 		return query_error(query, NSD_RC_FORMAT);
432 	}
433 	rc = process_tsig(query);
434 	if(rc != NSD_RC_OK)
435 		return query_error(query, rc);
436 
437 	/* check if it passes acl */
438 	if((acl_num = acl_check_incoming(zone_opt->pattern->allow_notify, query,
439 		&why)) != -1)
440 	{
441 		sig_atomic_t mode = NSD_PASS_TO_XFRD;
442 		int s = nsd->this_child->parent_fd;
443 		uint16_t sz;
444 		uint32_t acl_send = htonl(acl_num);
445 		uint32_t acl_xfr;
446 		size_t pos;
447 
448 		/* Find priority candidate for request XFR. -1 if no match */
449 		acl_num_xfr = acl_check_incoming(
450 			zone_opt->pattern->request_xfr, query, NULL);
451 
452 		acl_xfr = htonl(acl_num_xfr);
453 
454 		assert(why);
455 		DEBUG(DEBUG_XFRD,1, (LOG_INFO, "got notify %s passed acl %s %s",
456 			dname_to_string(query->qname, NULL),
457 			why->ip_address_spec,
458 			why->nokey?"NOKEY":
459 			(why->blocked?"BLOCKED":why->key_name)));
460 		sz = buffer_limit(query->packet);
461 		if(buffer_limit(query->packet) > MAX_PACKET_SIZE)
462 			return query_error(query, NSD_RC_SERVFAIL);
463 		/* forward to xfrd for processing
464 		   Note. Blocking IPC I/O, but acl is OK. */
465 		sz = htons(sz);
466 		if(!write_socket(s, &mode, sizeof(mode)) ||
467 			!write_socket(s, &sz, sizeof(sz)) ||
468 			!write_socket(s, buffer_begin(query->packet),
469 				buffer_limit(query->packet)) ||
470 			!write_socket(s, &acl_send, sizeof(acl_send)) ||
471 			!write_socket(s, &acl_xfr, sizeof(acl_xfr))) {
472 			log_msg(LOG_ERR, "error in IPC notify server2main, %s",
473 				strerror(errno));
474 			return query_error(query, NSD_RC_SERVFAIL);
475 		}
476 		if(verbosity >= 1) {
477 			uint32_t serial = 0;
478 			char address[128];
479 			addr2str(&query->addr, address, sizeof(address));
480 			if(packet_find_notify_serial(query->packet, &serial))
481 			  VERBOSITY(1, (LOG_INFO, "notify for %s from %s serial %u",
482 				dname_to_string(query->qname, NULL), address,
483 				(unsigned)serial));
484 			else
485 			  VERBOSITY(1, (LOG_INFO, "notify for %s from %s",
486 				dname_to_string(query->qname, NULL), address));
487 		}
488 
489 		/* create notify reply - keep same query contents */
490 		QR_SET(query->packet);         /* This is an answer.  */
491 		AA_SET(query->packet);	   /* we are authoritative. */
492 		ANCOUNT_SET(query->packet, 0);
493 		NSCOUNT_SET(query->packet, 0);
494 		ARCOUNT_SET(query->packet, 0);
495 		RCODE_SET(query->packet, RCODE_OK); /* Error code.  */
496 		/* position is right after the query */
497 		pos = buffer_position(query->packet);
498 		buffer_clear(query->packet);
499 		buffer_set_position(query->packet, pos);
500 		/* tsig is added in add_additional later (if needed) */
501 		return QUERY_PROCESSED;
502 	}
503 
504 	if (verbosity >= 2) {
505 		char address[128];
506 		addr2str(&query->addr, address, sizeof(address));
507 		VERBOSITY(2, (LOG_INFO, "notify for %s from %s refused, %s%s",
508 			dname_to_string(query->qname, NULL),
509 			address,
510 			why?why->key_name:"no acl matches",
511 			why?why->ip_address_spec:"."));
512 	}
513 
514 	return query_error(query, NSD_RC_REFUSE);
515 }
516 
517 
518 /*
519  * Answer a query in the CHAOS class.
520  */
521 static query_state_type
522 answer_chaos(struct nsd *nsd, query_type *q)
523 {
524 	AA_CLR(q->packet);
525 	switch (q->qtype) {
526 	case TYPE_ANY:
527 	case TYPE_TXT:
528 		if ((q->qname->name_size == 11
529 		     && memcmp(dname_name(q->qname), "\002id\006server", 11) == 0) ||
530 		    (q->qname->name_size ==  15
531 		     && memcmp(dname_name(q->qname), "\010hostname\004bind", 15) == 0))
532 		{
533 			if(!nsd->options->hide_identity) {
534 				/* Add ID */
535 				query_addtxt(q,
536 				     buffer_begin(q->packet) + QHEADERSZ,
537 				     CLASS_CH,
538 				     0,
539 				     nsd->identity);
540 				ANCOUNT_SET(q->packet, ANCOUNT(q->packet) + 1);
541 			} else {
542 				RCODE_SET(q->packet, RCODE_REFUSE);
543 				/* RFC8914 - Extended DNS Errors
544 				 * 4.19. Extended DNS Error Code 18 - Prohibited */
545 				q->edns.ede = EDE_PROHIBITED;
546 			}
547 		} else if ((q->qname->name_size == 16
548 			    && memcmp(dname_name(q->qname), "\007version\006server", 16) == 0) ||
549 			   (q->qname->name_size == 14
550 			    && memcmp(dname_name(q->qname), "\007version\004bind", 14) == 0))
551 		{
552 			if(!nsd->options->hide_version) {
553 				/* Add version */
554 				query_addtxt(q,
555 				     buffer_begin(q->packet) + QHEADERSZ,
556 				     CLASS_CH,
557 				     0,
558 				     nsd->version);
559 				ANCOUNT_SET(q->packet, ANCOUNT(q->packet) + 1);
560 			} else {
561 				RCODE_SET(q->packet, RCODE_REFUSE);
562 				/* RFC8914 - Extended DNS Errors
563 				 * 4.19. Extended DNS Error Code 18 - Prohibited */
564 				q->edns.ede = EDE_PROHIBITED;
565 			}
566 		} else {
567 			RCODE_SET(q->packet, RCODE_REFUSE);
568 			/* RFC8914 - Extended DNS Errors
569 			 * 4.22. Extended DNS Error Code 21 - Not Supported */
570 			q->edns.ede = EDE_NOT_SUPPORTED;
571 
572 		}
573 		break;
574 	default:
575 		RCODE_SET(q->packet, RCODE_REFUSE);
576 		/* RFC8914 - Extended DNS Errors
577 		 * 4.22. Extended DNS Error Code 21 - Not Supported */
578 		q->edns.ede = EDE_NOT_SUPPORTED;
579 		break;
580 	}
581 
582 	return QUERY_PROCESSED;
583 }
584 
585 
586 /*
587  * Find the covering NSEC for a non-existent domain name.  Normally
588  * the NSEC will be located at CLOSEST_MATCH, except when it is an
589  * empty non-terminal.  In this case the NSEC may be located at the
590  * previous domain name (in canonical ordering).
591  */
592 static domain_type *
593 find_covering_nsec(domain_type *closest_match,
594 		   zone_type   *zone,
595 		   rrset_type **nsec_rrset)
596 {
597 	assert(closest_match);
598 	assert(nsec_rrset);
599 
600 	/* loop away temporary created domains. For real ones it is &RBTREE_NULL */
601 #ifdef USE_RADIX_TREE
602 	while (closest_match->rnode == NULL)
603 #else
604 	while (closest_match->node.parent == NULL)
605 #endif
606 		closest_match = closest_match->parent;
607 	while (closest_match) {
608 		*nsec_rrset = domain_find_rrset(closest_match, zone, TYPE_NSEC);
609 		if (*nsec_rrset) {
610 			return closest_match;
611 		}
612 		if (closest_match == zone->apex) {
613 			/* Don't look outside the current zone.  */
614 			return NULL;
615 		}
616 		closest_match = domain_previous(closest_match);
617 	}
618 	return NULL;
619 }
620 
621 
622 struct additional_rr_types
623 {
624 	uint16_t        rr_type;
625 	rr_section_type rr_section;
626 };
627 
628 struct additional_rr_types default_additional_rr_types[] = {
629 	{ TYPE_A, ADDITIONAL_A_SECTION },
630 	{ TYPE_AAAA, ADDITIONAL_AAAA_SECTION },
631 	{ 0, (rr_section_type) 0 }
632 };
633 
634 struct additional_rr_types swap_aaaa_additional_rr_types[] = {
635 	{ TYPE_AAAA, ADDITIONAL_A_SECTION },
636 	{ TYPE_A, ADDITIONAL_AAAA_SECTION },
637 	{ 0, (rr_section_type) 0 }
638 };
639 
640 struct additional_rr_types rt_additional_rr_types[] = {
641 	{ TYPE_A, ADDITIONAL_A_SECTION },
642 	{ TYPE_AAAA, ADDITIONAL_AAAA_SECTION },
643 	{ TYPE_X25, ADDITIONAL_OTHER_SECTION },
644 	{ TYPE_ISDN, ADDITIONAL_OTHER_SECTION },
645 	{ 0, (rr_section_type) 0 }
646 };
647 
648 static void
649 add_additional_rrsets(struct query *query, answer_type *answer,
650 		      rrset_type *master_rrset, size_t rdata_index,
651 		      int allow_glue, struct additional_rr_types types[])
652 {
653 	size_t i;
654 
655 	assert(query);
656 	assert(answer);
657 	assert(master_rrset);
658 	assert(rdata_atom_is_domain(rrset_rrtype(master_rrset), rdata_index));
659 
660 	for (i = 0; i < master_rrset->rr_count; ++i) {
661 		int j;
662 		domain_type *additional = rdata_atom_domain(master_rrset->rrs[i].rdatas[rdata_index]);
663 		domain_type *match = additional;
664 
665 		assert(additional);
666 
667 		if (!allow_glue && domain_is_glue(match, query->zone))
668 			continue;
669 
670 		/*
671 		 * Check to see if we need to generate the dependent
672 		 * based on a wildcard domain.
673 		 */
674 		while (!match->is_existing) {
675 			match = match->parent;
676 		}
677 		if (additional != match && domain_wildcard_child(match)) {
678 			domain_type *wildcard_child = domain_wildcard_child(match);
679 			domain_type *temp = (domain_type *) region_alloc(
680 				query->region, sizeof(domain_type));
681 #ifdef USE_RADIX_TREE
682 			temp->rnode = NULL;
683 			temp->dname = additional->dname;
684 #else
685 			memcpy(&temp->node, &additional->node, sizeof(rbnode_type));
686 			temp->node.parent = NULL;
687 #endif
688 			temp->number = additional->number;
689 			temp->parent = match;
690 			temp->wildcard_child_closest_match = temp;
691 			temp->rrsets = wildcard_child->rrsets;
692 			temp->is_existing = wildcard_child->is_existing;
693 			additional = temp;
694 		}
695 
696 		for (j = 0; types[j].rr_type != 0; ++j) {
697 			rrset_type *rrset = domain_find_rrset(
698 				additional, query->zone, types[j].rr_type);
699 			if (rrset) {
700 				answer_add_rrset(answer, types[j].rr_section,
701 						 additional, rrset);
702 			}
703 		}
704 	}
705 }
706 
707 static int
708 answer_needs_ns(struct query* query)
709 {
710 	assert(query);
711 	/* Currently, only troublesome for DNSKEY and DS,
712          * cuz their RRSETs are quite large. */
713 	return (query->qtype != TYPE_DNSKEY && query->qtype != TYPE_DS
714 		&& query->qtype != TYPE_ANY);
715 }
716 
717 static int
718 add_rrset(struct query   *query,
719 	  answer_type    *answer,
720 	  rr_section_type section,
721 	  domain_type    *owner,
722 	  rrset_type     *rrset)
723 {
724 	int result;
725 
726 	assert(query);
727 	assert(answer);
728 	assert(owner);
729 	assert(rrset);
730 	assert(rrset_rrclass(rrset) == CLASS_IN);
731 
732 	result = answer_add_rrset(answer, section, owner, rrset);
733 	if(minimal_responses && section != AUTHORITY_SECTION &&
734 		query->qtype != TYPE_NS)
735 		return result;
736 	switch (rrset_rrtype(rrset)) {
737 	case TYPE_NS:
738 #if defined(INET6)
739 		/* if query over IPv6, swap A and AAAA; put AAAA first */
740 		add_additional_rrsets(query, answer, rrset, 0, 1,
741 			(query->addr.ss_family == AF_INET6)?
742 			swap_aaaa_additional_rr_types:
743 			default_additional_rr_types);
744 #else
745 		add_additional_rrsets(query, answer, rrset, 0, 1,
746 				      default_additional_rr_types);
747 #endif
748 		break;
749 	case TYPE_MB:
750 		add_additional_rrsets(query, answer, rrset, 0, 0,
751 				      default_additional_rr_types);
752 		break;
753 	case TYPE_MX:
754 	case TYPE_KX:
755 		add_additional_rrsets(query, answer, rrset, 1, 0,
756 				      default_additional_rr_types);
757 		break;
758 	case TYPE_RT:
759 		add_additional_rrsets(query, answer, rrset, 1, 0,
760 				      rt_additional_rr_types);
761 		break;
762 	case TYPE_SRV:
763 		add_additional_rrsets(query, answer, rrset, 3, 0,
764 				      default_additional_rr_types);
765 		break;
766 	default:
767 		break;
768 	}
769 
770 	return result;
771 }
772 
773 
774 /* returns 0 on error, or the domain number for to_name.
775    from_name is changes to to_name by the DNAME rr.
776    DNAME rr is from src to dest.
777    closest encloser encloses the to_name. */
778 static size_t
779 query_synthesize_cname(struct query* q, struct answer* answer, const dname_type* from_name,
780 	const dname_type* to_name, domain_type* src, domain_type* to_closest_encloser,
781 	domain_type** to_closest_match, uint32_t ttl)
782 {
783 	/* add temporary domains for from_name and to_name and all
784 	   their (not allocated yet) parents */
785 	/* any domains below src are not_existing (because of DNAME at src) */
786 	int i;
787 	size_t j;
788 	domain_type* cname_domain;
789 	domain_type* cname_dest;
790 	rrset_type* rrset;
791 
792 	domain_type* lastparent = src;
793 	assert(q && answer && from_name && to_name && src && to_closest_encloser);
794 	assert(to_closest_match);
795 
796 	/* check for loop by duplicate CNAME rrset synthesized */
797 	for(j=0; j<answer->rrset_count; ++j) {
798 		if(answer->section[j] == ANSWER_SECTION &&
799 			answer->rrsets[j]->rr_count == 1 &&
800 			answer->rrsets[j]->rrs[0].type == TYPE_CNAME &&
801 			dname_compare(domain_dname(answer->rrsets[j]->rrs[0].owner), from_name) == 0 &&
802 			answer->rrsets[j]->rrs[0].rdata_count == 1 &&
803 			dname_compare(domain_dname(answer->rrsets[j]->rrs[0].rdatas->domain), to_name) == 0) {
804 			DEBUG(DEBUG_QUERY,2, (LOG_INFO, "loop for synthesized CNAME rrset for query %s", dname_to_string(q->qname, NULL)));
805 			return 0;
806 		}
807 	}
808 
809 	/* allocate source part */
810 	for(i=0; i < from_name->label_count - domain_dname(src)->label_count; i++)
811 	{
812 		domain_type* newdom = query_get_tempdomain(q);
813 		if(!newdom)
814 			return 0;
815 		newdom->is_existing = 1;
816 		newdom->parent = lastparent;
817 #ifdef USE_RADIX_TREE
818 		newdom->dname
819 #else
820 		newdom->node.key
821 #endif
822 			= dname_partial_copy(q->region,
823 			from_name, domain_dname(src)->label_count + i + 1);
824 		if(dname_compare(domain_dname(newdom), q->qname) == 0) {
825 			/* 0 good for query name, otherwise new number */
826 			newdom->number = 0;
827 		}
828 		DEBUG(DEBUG_QUERY,2, (LOG_INFO, "created temp domain src %d. %s nr %d", i,
829 			domain_to_string(newdom), (int)newdom->number));
830 		lastparent = newdom;
831 	}
832 	cname_domain = lastparent;
833 
834 	/* allocate dest part */
835 	lastparent = to_closest_encloser;
836 	for(i=0; i < to_name->label_count - domain_dname(to_closest_encloser)->label_count;
837 		i++)
838 	{
839 		domain_type* newdom = query_get_tempdomain(q);
840 		if(!newdom)
841 			return 0;
842 		newdom->is_existing = 0;
843 		newdom->parent = lastparent;
844 #ifdef USE_RADIX_TREE
845 		newdom->dname
846 #else
847 		newdom->node.key
848 #endif
849 			= dname_partial_copy(q->region,
850 			to_name, domain_dname(to_closest_encloser)->label_count + i + 1);
851 		DEBUG(DEBUG_QUERY,2, (LOG_INFO, "created temp domain dest %d. %s nr %d", i,
852 			domain_to_string(newdom), (int)newdom->number));
853 		lastparent = newdom;
854 	}
855 	cname_dest = lastparent;
856 	*to_closest_match = cname_dest;
857 
858 	/* allocate the CNAME RR */
859 	rrset = (rrset_type*) region_alloc(q->region, sizeof(rrset_type));
860 	memset(rrset, 0, sizeof(rrset_type));
861 	rrset->zone = q->zone;
862 	rrset->rr_count = 1;
863 	rrset->rrs = (rr_type*) region_alloc(q->region, sizeof(rr_type));
864 	memset(rrset->rrs, 0, sizeof(rr_type));
865 	rrset->rrs->owner = cname_domain;
866 	rrset->rrs->ttl = ttl;
867 	rrset->rrs->type = TYPE_CNAME;
868 	rrset->rrs->klass = CLASS_IN;
869 	rrset->rrs->rdata_count = 1;
870 	rrset->rrs->rdatas = (rdata_atom_type*)region_alloc(q->region,
871 		sizeof(rdata_atom_type));
872 	rrset->rrs->rdatas->domain = cname_dest;
873 
874 	if(!add_rrset(q, answer, ANSWER_SECTION, cname_domain, rrset)) {
875 		DEBUG(DEBUG_QUERY,2, (LOG_INFO, "could not add synthesized CNAME rrset to packet for query %s", dname_to_string(q->qname, NULL)));
876 		/* failure to add CNAME; likely is a loop, the same twice */
877 		return 0;
878 	}
879 
880 	return cname_dest->number;
881 }
882 
883 /*
884  * Answer delegation information.
885  *
886  * DNSSEC: Include the DS RRset if present.  Otherwise include an NSEC
887  * record proving the DS RRset does not exist.
888  */
889 static void
890 answer_delegation(query_type *query, answer_type *answer)
891 {
892 	assert(answer);
893 	assert(query->delegation_domain);
894 	assert(query->delegation_rrset);
895 
896 	if (query->cname_count == 0) {
897 		AA_CLR(query->packet);
898 	} else {
899 		AA_SET(query->packet);
900 	}
901 
902 	add_rrset(query,
903 		  answer,
904 		  AUTHORITY_SECTION,
905 		  query->delegation_domain,
906 		  query->delegation_rrset);
907 	if (query->edns.dnssec_ok && zone_is_secure(query->zone)) {
908 		rrset_type *rrset;
909 		if ((rrset = domain_find_rrset(query->delegation_domain, query->zone, TYPE_DS))) {
910 			add_rrset(query, answer, AUTHORITY_SECTION,
911 				  query->delegation_domain, rrset);
912 #ifdef NSEC3
913 		} else if (query->zone->nsec3_param) {
914 			nsec3_answer_delegation(query, answer);
915 #endif
916 		} else if ((rrset = domain_find_rrset(query->delegation_domain, query->zone, TYPE_NSEC))) {
917 			add_rrset(query, answer, AUTHORITY_SECTION,
918 				  query->delegation_domain, rrset);
919 		}
920 	}
921 }
922 
923 
924 /*
925  * Answer SOA information.
926  */
927 static void
928 answer_soa(struct query *query, answer_type *answer)
929 {
930 	if (query->qclass != CLASS_ANY) {
931 		add_rrset(query, answer,
932 			  AUTHORITY_SECTION,
933 			  query->zone->apex,
934 			  query->zone->soa_nx_rrset);
935 	}
936 }
937 
938 
939 /*
940  * Answer that the domain name exists but there is no RRset with the
941  * requested type.
942  *
943  * DNSSEC: Include the correct NSEC record proving that the type does
944  * not exist.  In the wildcard no data (3.1.3.4) case the wildcard IS
945  * NOT expanded, so the ORIGINAL parameter must point to the original
946  * wildcard entry, not to the generated entry.
947  */
948 static void
949 answer_nodata(struct query *query, answer_type *answer, domain_type *original)
950 {
951 	answer_soa(query, answer);
952 
953 #ifdef NSEC3
954 	if (query->edns.dnssec_ok && query->zone->nsec3_param) {
955 		nsec3_answer_nodata(query, answer, original);
956 	} else
957 #endif
958 	if (query->edns.dnssec_ok && zone_is_secure(query->zone)) {
959 		domain_type *nsec_domain;
960 		rrset_type *nsec_rrset;
961 
962 		nsec_domain = find_covering_nsec(original, query->zone, &nsec_rrset);
963 		if (nsec_domain) {
964 			add_rrset(query, answer, AUTHORITY_SECTION, nsec_domain, nsec_rrset);
965 		}
966 	}
967 }
968 
969 static void
970 answer_nxdomain(query_type *query, answer_type *answer)
971 {
972 	RCODE_SET(query->packet, RCODE_NXDOMAIN);
973 	answer_soa(query, answer);
974 }
975 
976 
977 /*
978  * Answer domain information (or SOA if we do not have an RRset for
979  * the type specified by the query).
980  */
981 static void
982 answer_domain(struct nsd* nsd, struct query *q, answer_type *answer,
983 	      domain_type *domain, domain_type *original)
984 {
985 	rrset_type *rrset;
986 
987 	if (q->qtype == TYPE_ANY) {
988 		rrset_type *preferred_rrset = NULL;
989 		rrset_type *normal_rrset = NULL;
990 		rrset_type *non_preferred_rrset = NULL;
991 
992 		/*
993 		 * Minimize response size for ANY, with one RRset
994 		 * according to RFC 8482(4.1).
995 		 * Prefers popular and not large rtypes (A,AAAA,...)
996 		 * lowering large ones (DNSKEY,RRSIG,...).
997 		 */
998 		for (rrset = domain_find_any_rrset(domain, q->zone); rrset; rrset = rrset->next) {
999 			if (rrset->zone == q->zone
1000 #ifdef NSEC3
1001 				&& rrset_rrtype(rrset) != TYPE_NSEC3
1002 #endif
1003 			    /*
1004 			     * Don't include the RRSIG RRset when
1005 			     * DNSSEC is used, because it is added
1006 			     * automatically on an per-RRset basis.
1007 			     */
1008 			    && !(q->edns.dnssec_ok
1009 				 && zone_is_secure(q->zone)
1010 				 && rrset_rrtype(rrset) == TYPE_RRSIG))
1011 			{
1012 				switch(rrset_rrtype(rrset)) {
1013 					case TYPE_A:
1014 					case TYPE_AAAA:
1015 					case TYPE_SOA:
1016 					case TYPE_MX:
1017 					case TYPE_PTR:
1018 						preferred_rrset = rrset;
1019 						break;
1020 					case TYPE_DNSKEY:
1021 					case TYPE_RRSIG:
1022 					case TYPE_NSEC:
1023 						non_preferred_rrset = rrset;
1024 						break;
1025 					default:
1026 						normal_rrset = rrset;
1027 				}
1028 				if (preferred_rrset) break;
1029 			}
1030 		}
1031 		if (preferred_rrset) {
1032 			add_rrset(q, answer, ANSWER_SECTION, domain, preferred_rrset);
1033 		} else if (normal_rrset) {
1034 			add_rrset(q, answer, ANSWER_SECTION, domain, normal_rrset);
1035 		} else if (non_preferred_rrset) {
1036 			add_rrset(q, answer, ANSWER_SECTION, domain, non_preferred_rrset);
1037 		} else {
1038 			answer_nodata(q, answer, original);
1039 			return;
1040 		}
1041 #ifdef NSEC3
1042 	} else if (q->qtype == TYPE_NSEC3) {
1043 		answer_nodata(q, answer, original);
1044 		return;
1045 #endif
1046 	} else if ((rrset = domain_find_rrset(domain, q->zone, q->qtype))) {
1047 		add_rrset(q, answer, ANSWER_SECTION, domain, rrset);
1048 	} else if ((rrset = domain_find_rrset(domain, q->zone, TYPE_CNAME))) {
1049 		int added;
1050 
1051 		/*
1052 		 * If the CNAME is not added it is already in the
1053 		 * answer, so we have a CNAME loop.  Don't follow the
1054 		 * CNAME target in this case.
1055 		 */
1056 		added = add_rrset(q, answer, ANSWER_SECTION, domain, rrset);
1057 		assert(rrset->rr_count > 0);
1058 		if (added) {
1059 			/* only process first CNAME record */
1060 			domain_type *closest_match = rdata_atom_domain(rrset->rrs[0].rdatas[0]);
1061 			domain_type *closest_encloser = closest_match;
1062 			zone_type* origzone = q->zone;
1063 			++q->cname_count;
1064 
1065 			answer_lookup_zone(nsd, q, answer, closest_match->number,
1066 					     closest_match == closest_encloser,
1067 					     closest_match, closest_encloser,
1068 					     domain_dname(closest_match));
1069 			q->zone = origzone;
1070 		}
1071 		return;
1072 	} else {
1073 		answer_nodata(q, answer, original);
1074 		return;
1075 	}
1076 
1077 	if (q->qclass != CLASS_ANY && q->zone->ns_rrset && answer_needs_ns(q)
1078 		&& !minimal_responses) {
1079 		add_rrset(q, answer, OPTIONAL_AUTHORITY_SECTION, q->zone->apex,
1080 			  q->zone->ns_rrset);
1081 	}
1082 }
1083 
1084 
1085 /*
1086  * Answer with authoritative data.  If a wildcard is matched the owner
1087  * name will be expanded to the domain name specified by
1088  * DOMAIN_NUMBER.  DOMAIN_NUMBER 0 (zero) is reserved for the original
1089  * query name.
1090  *
1091  * DNSSEC: Include the necessary NSEC records in case the request
1092  * domain name does not exist and/or a wildcard match does not exist.
1093  */
1094 static void
1095 answer_authoritative(struct nsd   *nsd,
1096 		     struct query *q,
1097 		     answer_type  *answer,
1098 		     size_t        domain_number,
1099 		     int           exact,
1100 		     domain_type  *closest_match,
1101 		     domain_type  *closest_encloser,
1102 		     const dname_type *qname)
1103 {
1104 	domain_type *match;
1105 	domain_type *original = closest_match;
1106 	domain_type *dname_ce;
1107 	domain_type *wildcard_child;
1108 	rrset_type *rrset;
1109 
1110 #ifdef NSEC3
1111 	if(exact && domain_has_only_NSEC3(closest_match, q->zone)) {
1112 		exact = 0; /* pretend it does not exist */
1113 		if(closest_encloser->parent)
1114 			closest_encloser = closest_encloser->parent;
1115 	}
1116 #endif /* NSEC3 */
1117 	if((dname_ce = find_dname_above(closest_encloser, q->zone)) != NULL) {
1118 		/* occlude the found data, the DNAME is closest_encloser */
1119 		closest_encloser = dname_ce;
1120 		exact = 0;
1121 	}
1122 
1123 	if (exact) {
1124 		match = closest_match;
1125 	} else if ((rrset=domain_find_rrset(closest_encloser, q->zone, TYPE_DNAME))) {
1126 		/* process DNAME */
1127 		const dname_type* name = qname;
1128 		domain_type* src = closest_encloser;
1129 		domain_type *dest = rdata_atom_domain(rrset->rrs[0].rdatas[0]);
1130 		const dname_type* newname;
1131 		size_t newnum = 0;
1132 		zone_type* origzone = q->zone;
1133 		assert(rrset->rr_count > 0);
1134 		if(domain_number != 0) /* we followed CNAMEs or DNAMEs */
1135 			name = domain_dname(closest_match);
1136 		DEBUG(DEBUG_QUERY,2, (LOG_INFO, "expanding DNAME for q=%s", dname_to_string(name, NULL)));
1137 		DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->src is %s",
1138 			domain_to_string(closest_encloser)));
1139 		DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->dest is %s",
1140 			domain_to_string(dest)));
1141 		if(!add_rrset(q, answer, ANSWER_SECTION, closest_encloser, rrset)) {
1142 			/* stop if DNAME loops, when added second time */
1143 			if(dname_is_subdomain(domain_dname(dest), domain_dname(src))) {
1144 				return;
1145 			}
1146 		}
1147 		newname = dname_replace(q->region, name,
1148 			domain_dname(src), domain_dname(dest));
1149 		++q->cname_count;
1150 		if(!newname) { /* newname too long */
1151 			RCODE_SET(q->packet, RCODE_YXDOMAIN);
1152 			/* RFC 8914 - Extended DNS Errors
1153 			 * 4.21. Extended DNS Error Code 0 - Other */
1154 			ASSIGN_EDE_CODE_AND_STRING_LITERAL(q->edns.ede,
1155 				EDE_OTHER, "DNAME expansion became too large");
1156 			return;
1157 		}
1158 		DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->result is %s", dname_to_string(newname, NULL)));
1159 		/* follow the DNAME */
1160 		(void)namedb_lookup(nsd->db, newname, &closest_match, &closest_encloser);
1161 		/* synthesize CNAME record */
1162 		newnum = query_synthesize_cname(q, answer, name, newname,
1163 			src, closest_encloser, &closest_match, rrset->rrs[0].ttl);
1164 		if(!newnum) {
1165 			/* could not synthesize the CNAME. */
1166 			/* return previous CNAMEs to make resolver recurse for us */
1167 			return;
1168 		}
1169 		if(q->qtype == TYPE_CNAME) {
1170 			/* The synthesized CNAME is the answer to
1171 			 * that query, same as BIND does for query
1172 			 * of type CNAME */
1173 			return;
1174 		}
1175 
1176 		answer_lookup_zone(nsd, q, answer, newnum,
1177 			closest_match == closest_encloser,
1178 			closest_match, closest_encloser, newname);
1179 		q->zone = origzone;
1180 		return;
1181 	} else if ((wildcard_child=domain_wildcard_child(closest_encloser))!=NULL &&
1182 		wildcard_child->is_existing) {
1183 		/* Generate the domain from the wildcard.  */
1184 #ifdef RATELIMIT
1185 		q->wildcard_domain = wildcard_child;
1186 #endif
1187 
1188 		match = (domain_type *) region_alloc(q->region,
1189 						     sizeof(domain_type));
1190 #ifdef USE_RADIX_TREE
1191 		match->rnode = NULL;
1192 		match->dname = wildcard_child->dname;
1193 #else
1194 		memcpy(&match->node, &wildcard_child->node, sizeof(rbnode_type));
1195 		match->node.parent = NULL;
1196 #endif
1197 		match->parent = closest_encloser;
1198 		match->wildcard_child_closest_match = match;
1199 		match->number = domain_number;
1200 		match->rrsets = wildcard_child->rrsets;
1201 		match->is_existing = wildcard_child->is_existing;
1202 #ifdef NSEC3
1203 		match->nsec3 = wildcard_child->nsec3;
1204 		/* copy over these entries:
1205 		match->nsec3_is_exact = wildcard_child->nsec3_is_exact;
1206 		match->nsec3_cover = wildcard_child->nsec3_cover;
1207 		match->nsec3_wcard_child_cover = wildcard_child->nsec3_wcard_child_cover;
1208 		match->nsec3_ds_parent_is_exact = wildcard_child->nsec3_ds_parent_is_exact;
1209 		match->nsec3_ds_parent_cover = wildcard_child->nsec3_ds_parent_cover;
1210 		*/
1211 
1212 		if (q->edns.dnssec_ok && q->zone->nsec3_param) {
1213 			/* Only add nsec3 wildcard data when do bit is set */
1214 			nsec3_answer_wildcard(q, answer, wildcard_child, qname);
1215 		}
1216 #endif
1217 
1218 		/*
1219 		 * Remember the original domain in case a Wildcard No
1220 		 * Data (3.1.3.4) response needs to be generated.  In
1221 		 * this particular case the wildcard IS NOT
1222 		 * expanded.
1223 		 */
1224 		original = wildcard_child;
1225 	} else {
1226 		match = NULL;
1227 	}
1228 
1229 	/* Authoritative zone.  */
1230 #ifdef NSEC3
1231 	if (q->edns.dnssec_ok && q->zone->nsec3_param) {
1232 		nsec3_answer_authoritative(&match, q, answer,
1233 			closest_encloser, qname);
1234 	} else
1235 #endif
1236 	if (q->edns.dnssec_ok && zone_is_secure(q->zone)) {
1237 		if (match != closest_encloser) {
1238 			domain_type *nsec_domain;
1239 			rrset_type *nsec_rrset;
1240 
1241 			/*
1242 			 * No match found or generated from wildcard,
1243 			 * include NSEC record.
1244 			 */
1245 			nsec_domain = find_covering_nsec(closest_match, q->zone, &nsec_rrset);
1246 			if (nsec_domain) {
1247 				add_rrset(q, answer, AUTHORITY_SECTION, nsec_domain, nsec_rrset);
1248 			}
1249 		}
1250 		if (!match) {
1251 			domain_type *nsec_domain;
1252 			rrset_type *nsec_rrset;
1253 
1254 			/*
1255 			 * No match and no wildcard.  Include NSEC
1256 			 * proving there is no wildcard.
1257 			 */
1258 			if(closest_encloser && (nsec_domain =
1259 				find_covering_nsec(closest_encloser->
1260 					wildcard_child_closest_match, q->zone,
1261 					&nsec_rrset)) != NULL) {
1262 				add_rrset(q, answer, AUTHORITY_SECTION, nsec_domain, nsec_rrset);
1263 			}
1264 		}
1265 	}
1266 
1267 #ifdef NSEC3
1268 	if (RCODE(q->packet)!=RCODE_OK) {
1269 		return; /* nsec3 collision failure */
1270 	}
1271 #endif
1272 	if (match) {
1273 		answer_domain(nsd, q, answer, match, original);
1274 	} else {
1275 		answer_nxdomain(q, answer);
1276 	}
1277 }
1278 
1279 /*
1280  * qname may be different after CNAMEs have been followed from query->qname.
1281  */
1282 static void
1283 answer_lookup_zone(struct nsd *nsd, struct query *q, answer_type *answer,
1284 	size_t domain_number, int exact, domain_type *closest_match,
1285 	domain_type *closest_encloser, const dname_type *qname)
1286 {
1287 	zone_type* origzone = q->zone;
1288 	q->zone = domain_find_zone(nsd->db, closest_encloser);
1289 	if (!q->zone) {
1290 		/* no zone for this */
1291 		if(q->cname_count == 0) {
1292 			RCODE_SET(q->packet, RCODE_REFUSE);
1293 			/* RFC 8914 - Extended DNS Errors
1294 			 * 4.21. Extended DNS Error Code 20 - Not Authoritative */
1295 			q->edns.ede = EDE_NOT_AUTHORITATIVE;
1296 		}
1297 		return;
1298 	}
1299 	assert(closest_encloser); /* otherwise, no q->zone would be found */
1300 	if(q->zone->opts && q->zone->opts->pattern
1301 	&& q->zone->opts->pattern->allow_query) {
1302 		struct acl_options *why = NULL;
1303 
1304 		/* check if it passes acl */
1305 		if(acl_check_incoming(
1306 		   q->zone->opts->pattern->allow_query, q, &why) != -1) {
1307 			assert(why);
1308 			DEBUG(DEBUG_QUERY,1, (LOG_INFO, "query %s passed acl %s %s",
1309 				dname_to_string(q->qname, NULL),
1310 				why->ip_address_spec,
1311 				why->nokey?"NOKEY":
1312 				(why->blocked?"BLOCKED":why->key_name)));
1313 		} else {
1314 			if (verbosity >= 2) {
1315 				char address[128];
1316 				addr2str(&q->addr, address, sizeof(address));
1317 				VERBOSITY(2, (LOG_INFO, "query %s from %s refused, %s %s",
1318 					dname_to_string(q->qname, NULL),
1319 					address,
1320 					why ? ( why->nokey    ? "NOKEY"
1321 					      : why->blocked  ? "BLOCKED"
1322 					      : why->key_name )
1323 					    : "no acl matches",
1324 					why?why->ip_address_spec:"."));
1325 			}
1326 			/* no zone for this */
1327 			if(q->cname_count == 0) {
1328 				RCODE_SET(q->packet, RCODE_REFUSE);
1329 				/* RFC8914 - Extended DNS Errors
1330 				 * 4.19. Extended DNS Error Code 18 - Prohibited */
1331 				q->edns.ede = EDE_PROHIBITED;
1332 			}
1333 			return;
1334 		}
1335 	}
1336 	if(!q->zone->apex || !q->zone->soa_rrset) {
1337 		/* zone is configured but not loaded */
1338 		if(q->cname_count == 0) {
1339 			RCODE_SET(q->packet, RCODE_SERVFAIL);
1340 			/* RFC 8914 - Extended DNS Errors
1341 			 * 4.15. Extended DNS Error Code 14 - Not Ready */
1342 			q->edns.ede = EDE_NOT_READY;
1343 			ASSIGN_EDE_CODE_AND_STRING_LITERAL(q->edns.ede,
1344 			    EDE_NOT_READY, "Zone is configured but not loaded");
1345 		}
1346 		return;
1347 	}
1348 
1349 	/*
1350 	 * If confine-to-zone is set to yes do not return additional
1351 	 * information for a zone with a different apex from the query zone.
1352 	*/
1353 	if (nsd->options->confine_to_zone &&
1354 	   (origzone != NULL && dname_compare(domain_dname(origzone->apex), domain_dname(q->zone->apex)) != 0)) {
1355 		return;
1356 	}
1357 
1358 	/* now move up the closest encloser until it exists, previous
1359 	 * (possibly empty) closest encloser was useful to finding the zone
1360 	 * (for empty zones too), but now we want actual data nodes */
1361 	if (closest_encloser && !closest_encloser->is_existing) {
1362 		exact = 0;
1363 		while (closest_encloser != NULL && !closest_encloser->is_existing)
1364 			closest_encloser = closest_encloser->parent;
1365 	}
1366 
1367 	/*
1368 	 * See RFC 4035 (DNSSEC protocol) section 3.1.4.1 Responding
1369 	 * to Queries for DS RRs.
1370 	 */
1371 	if (exact && q->qtype == TYPE_DS && closest_encloser == q->zone->apex) {
1372 		/*
1373 		 * Type DS query at a zone cut, use the responsible
1374 		 * parent zone to generate the answer if we are
1375 		 * authoritative for the parent zone.
1376 		 */
1377 		zone_type *zone = domain_find_parent_zone(nsd->db, q->zone);
1378 		if (zone) {
1379 			q->zone = zone;
1380 			if(!q->zone->apex || !q->zone->soa_rrset) {
1381 				/* zone is configured but not loaded */
1382 				if(q->cname_count == 0) {
1383 					RCODE_SET(q->packet, RCODE_SERVFAIL);
1384 					/* RFC 8914 - Extended DNS Errors
1385 					 * 4.15. Extended DNS Error Code 14 - Not Ready */
1386 					ASSIGN_EDE_CODE_AND_STRING_LITERAL(
1387 					   q->edns.ede, EDE_NOT_READY,
1388 					   "Zone is configured but not loaded");
1389 				}
1390 				return;
1391 			}
1392 		}
1393 	}
1394 
1395 	/* see if the zone has expired (for secondary zones) */
1396 	if(q->zone && q->zone->opts && q->zone->opts->pattern &&
1397 		q->zone->opts->pattern->request_xfr != 0 && !q->zone->is_ok) {
1398 		if(q->cname_count == 0) {
1399 			RCODE_SET(q->packet, RCODE_SERVFAIL);
1400 			/* RFC 8914 - Extended DNS Errors
1401 			 * 4.25. Extended DNS Error Code 24 - Invalid Data */
1402 			ASSIGN_EDE_CODE_AND_STRING_LITERAL(q->edns.ede,
1403 				EDE_INVALID_DATA, "Zone has expired");
1404 		}
1405 		return;
1406 	}
1407 
1408 	if (exact && q->qtype == TYPE_DS && closest_encloser == q->zone->apex) {
1409 		/*
1410 		 * Type DS query at the zone apex (and the server is
1411 		 * not authoritative for the parent zone).
1412 		 */
1413 		if (q->qclass == CLASS_ANY) {
1414 			AA_CLR(q->packet);
1415 		} else {
1416 			AA_SET(q->packet);
1417 		}
1418 		answer_nodata(q, answer, closest_encloser);
1419 	} else {
1420 		q->delegation_domain = domain_find_ns_rrsets(
1421 			closest_encloser, q->zone, &q->delegation_rrset);
1422 		if(q->delegation_domain && find_dname_above(q->delegation_domain, q->zone)) {
1423 			q->delegation_domain = NULL; /* use higher DNAME */
1424 		}
1425 
1426 		if (!q->delegation_domain
1427 		    || (exact && q->qtype == TYPE_DS && closest_encloser == q->delegation_domain))
1428 		{
1429 			if (q->qclass == CLASS_ANY) {
1430 				AA_CLR(q->packet);
1431 			} else {
1432 				AA_SET(q->packet);
1433 			}
1434 			answer_authoritative(nsd, q, answer, domain_number, exact,
1435 					     closest_match, closest_encloser, qname);
1436 		}
1437 		else {
1438 			answer_delegation(q, answer);
1439 		}
1440 	}
1441 }
1442 
1443 static void
1444 answer_query(struct nsd *nsd, struct query *q)
1445 {
1446 	domain_type *closest_match;
1447 	domain_type *closest_encloser;
1448 	int exact;
1449 	uint16_t offset;
1450 	answer_type answer;
1451 
1452 	answer_init(&answer);
1453 
1454 	exact = namedb_lookup(nsd->db, q->qname, &closest_match, &closest_encloser);
1455 
1456 	answer_lookup_zone(nsd, q, &answer, 0, exact, closest_match,
1457 		closest_encloser, q->qname);
1458 	ZTATUP2(nsd, q->zone, opcode, q->opcode);
1459 	ZTATUP2(nsd, q->zone, qtype, q->qtype);
1460 	ZTATUP2(nsd, q->zone, qclass, q->qclass);
1461 
1462 	offset = dname_label_offsets(q->qname)[domain_dname(closest_encloser)->label_count - 1] + QHEADERSZ;
1463 	query_add_compression_domain(q, closest_encloser, offset);
1464 	encode_answer(q, &answer);
1465 	query_clear_compression_tables(q);
1466 }
1467 
1468 void
1469 query_prepare_response(query_type *q)
1470 {
1471 	uint16_t flags;
1472 
1473 	/*
1474 	 * Preserve the data up-to the current packet's limit.
1475 	 */
1476 	buffer_set_position(q->packet, buffer_limit(q->packet));
1477 	buffer_set_limit(q->packet, buffer_capacity(q->packet));
1478 
1479 	/*
1480 	 * Reserve space for the EDNS records if required.
1481 	 */
1482 	q->reserved_space = edns_reserved_space(&q->edns);
1483 	q->reserved_space += tsig_reserved_space(&q->tsig);
1484 
1485 	/* Update the flags.  */
1486 	flags = FLAGS(q->packet);
1487 	flags &= 0x0100U;	/* Preserve the RD flag.  */
1488 				/* CD flag must be cleared for auth answers */
1489 	flags |= 0x8000U;	/* Set the QR flag.  */
1490 	FLAGS_SET(q->packet, flags);
1491 }
1492 
1493 /*
1494  * Processes the query.
1495  *
1496  */
1497 query_state_type
1498 query_process(query_type *q, nsd_type *nsd)
1499 {
1500 	/* The query... */
1501 	nsd_rc_type rc;
1502 	query_state_type query_state;
1503 	uint16_t arcount;
1504 
1505 	/* Sanity checks */
1506 	if (buffer_limit(q->packet) < QHEADERSZ) {
1507 		/* packet too small to contain DNS header.
1508 		Now packet investigation macros will work without problems. */
1509 		return QUERY_DISCARDED;
1510 	}
1511 	if (QR(q->packet)) {
1512 		/* Not a query? Drop it on the floor. */
1513 		return QUERY_DISCARDED;
1514 	}
1515 
1516 	/* check opcode early on, because new opcodes may have different
1517 	 * specification of the meaning of the rest of the packet */
1518 	q->opcode = OPCODE(q->packet);
1519 	if(q->opcode != OPCODE_QUERY && q->opcode != OPCODE_NOTIFY) {
1520 		if(query_ratelimit_err(nsd))
1521 			return QUERY_DISCARDED;
1522 		if(nsd->options->drop_updates && q->opcode == OPCODE_UPDATE)
1523 			return QUERY_DISCARDED;
1524 		return query_error(q, NSD_RC_IMPL);
1525 	}
1526 
1527 	if (RCODE(q->packet) != RCODE_OK || !process_query_section(q)) {
1528 		return query_formerr(q, nsd);
1529 	}
1530 
1531 	/* Update statistics.  */
1532 	STATUP2(nsd, opcode, q->opcode);
1533 	STATUP2(nsd, qtype, q->qtype);
1534 	STATUP2(nsd, qclass, q->qclass);
1535 
1536 	if (q->opcode != OPCODE_QUERY) {
1537 		if (q->opcode == OPCODE_NOTIFY) {
1538 			return answer_notify(nsd, q);
1539 		} else {
1540 			if(query_ratelimit_err(nsd))
1541 				return QUERY_DISCARDED;
1542 			return query_error(q, NSD_RC_IMPL);
1543 		}
1544 	}
1545 
1546 	/* Dont bother to answer more than one question at once... */
1547 	if (QDCOUNT(q->packet) != 1) {
1548 		if(QDCOUNT(q->packet) == 0 && ANCOUNT(q->packet) == 0 &&
1549 			NSCOUNT(q->packet) == 0 && ARCOUNT(q->packet) == 1 &&
1550 			buffer_limit(q->packet) >= QHEADERSZ+OPT_LEN+
1551 			OPT_RDATA) {
1552 			/* add edns section to answer */
1553 			buffer_set_position(q->packet, QHEADERSZ);
1554 			if (edns_parse_record(&q->edns, q->packet, q, nsd)) {
1555 				if(process_edns(nsd, q) == NSD_RC_OK) {
1556 					int opcode = OPCODE(q->packet);
1557 					(void)query_error(q, NSD_RC_FORMAT);
1558 					query_add_optional(q, nsd);
1559 					FLAGS_SET(q->packet, FLAGS(q->packet) & 0x0100U);
1560 						/* Preserve the RD flag. Clear the rest. */
1561 					OPCODE_SET(q->packet, opcode);
1562 					QR_SET(q->packet);
1563 					return QUERY_PROCESSED;
1564 				}
1565 			}
1566 		}
1567 		FLAGS_SET(q->packet, 0);
1568 		return query_formerr(q, nsd);
1569 	}
1570 	/* Ignore settings of flags */
1571 
1572 	/* Dont allow any records in the answer or authority section...
1573 	   except for IXFR queries. */
1574 	if (ANCOUNT(q->packet) != 0 ||
1575 		(q->qtype!=TYPE_IXFR && NSCOUNT(q->packet) != 0)) {
1576 		return query_formerr(q, nsd);
1577 	}
1578 	if(q->qtype==TYPE_IXFR && NSCOUNT(q->packet) > 0) {
1579 		unsigned int i; /* skip ixfr soa information data here */
1580 		unsigned int nscount = (unsigned)NSCOUNT(q->packet);
1581 		/* define a bound on the number of extraneous records allowed,
1582 		 * we expect 1, a SOA serial record, and no more.
1583 		 * perhaps RRSIGs (but not needed), otherwise we do not
1584 		 * understand what this means.  We do not want too many
1585 		 * because the high iteration counts slow down. */
1586 		if(nscount > 64) return query_formerr(q, nsd);
1587 		for(i=0; i< nscount; i++)
1588 			if(!packet_skip_rr(q->packet, 0))
1589 				return query_formerr(q, nsd);
1590 	}
1591 
1592 	arcount = ARCOUNT(q->packet);
1593 	/* A TSIG RR is not allowed before the EDNS OPT RR.
1594 	 * In RFC6891 (about EDNS) it says:
1595 	 * "The placement flexibility for the OPT RR does not
1596 	 * override the need for the TSIG or SIG(0) RRs to be
1597 	 * the last in the additional section whenever they are
1598 	 * present."
1599 	 * And in RFC8945 (about TSIG) it says:
1600 	 * "If multiple TSIG records are detected or a TSIG record is
1601 	 * present in any other position, the DNS message is dropped
1602 	 * and a response with RCODE 1 (FORMERR) MUST be returned."
1603 	 */
1604 	/* See if there is an OPT RR. */
1605 	if (arcount > 0) {
1606 		if (edns_parse_record(&q->edns, q->packet, q, nsd))
1607 			--arcount;
1608 	}
1609 	/* See if there is a TSIG RR. */
1610 	if (arcount > 0 && q->tsig.status == TSIG_NOT_PRESENT) {
1611 		/* see if tsig is after the edns record */
1612 		if (!tsig_parse_rr(&q->tsig, q->packet))
1613 			return query_formerr(q, nsd);
1614 		if(q->tsig.status != TSIG_NOT_PRESENT)
1615 			--arcount;
1616 	}
1617 	/* If more RRs left in Add. Section, FORMERR. */
1618 	if (arcount > 0) {
1619 		return query_formerr(q, nsd);
1620 	}
1621 
1622 	/* Do we have any trailing garbage? */
1623 #ifdef	STRICT_MESSAGE_PARSE
1624 	if (buffer_remaining(q->packet) > 0) {
1625 		/* If we're strict.... */
1626 		return query_formerr(q, nsd);
1627 	}
1628 #endif
1629 	/* Remove trailing garbage.  */
1630 	buffer_set_limit(q->packet, buffer_position(q->packet));
1631 
1632 	rc = process_tsig(q);
1633 	if (rc != NSD_RC_OK) {
1634 		return query_error(q, rc);
1635 	}
1636 	rc = process_edns(nsd, q);
1637 	if (rc != NSD_RC_OK) {
1638 		/* We should not return FORMERR, but BADVERS (=16).
1639 		 * BADVERS is created with Ext. RCODE, followed by RCODE.
1640 		 * Ext. RCODE is set to 1, RCODE must be 0 (getting 0x10 = 16).
1641 		 * Thus RCODE = NOERROR = NSD_RC_OK. */
1642 		RCODE_SET(q->packet, NSD_RC_OK);
1643 		buffer_clear(q->packet);
1644 		buffer_set_position(q->packet,
1645 			QHEADERSZ + 4 + q->qname->name_size);
1646 		QR_SET(q->packet);
1647 		AD_CLR(q->packet);
1648 		QDCOUNT_SET(q->packet, 1);
1649 		ANCOUNT_SET(q->packet, 0);
1650 		NSCOUNT_SET(q->packet, 0);
1651 		ARCOUNT_SET(q->packet, 0);
1652 		return QUERY_PROCESSED;
1653 	}
1654 
1655 	query_prepare_response(q);
1656 
1657 	if (q->qclass != CLASS_IN && q->qclass != CLASS_ANY) {
1658 		if (q->qclass == CLASS_CH) {
1659 			return answer_chaos(nsd, q);
1660 		} else {
1661 			/* RFC8914 - Extended DNS Errors
1662 			 * 4.22. Extended DNS Error Code 21 - Not Supported */
1663 			q->edns.ede = EDE_NOT_SUPPORTED;
1664 			return query_error(q, RCODE_REFUSE);
1665 		}
1666 	}
1667 	query_state = answer_axfr_ixfr(nsd, q);
1668 	if (query_state == QUERY_PROCESSED || query_state == QUERY_IN_AXFR) {
1669 		return query_state;
1670 	}
1671 	if(q->qtype == TYPE_ANY && nsd->options->refuse_any && !q->tcp) {
1672 		TC_SET(q->packet);
1673 		return query_error(q, NSD_RC_OK);
1674 	}
1675 
1676 	answer_query(nsd, q);
1677 
1678 	return QUERY_PROCESSED;
1679 }
1680 
1681 void
1682 query_add_optional(query_type *q, nsd_type *nsd)
1683 {
1684 	struct edns_data *edns = &nsd->edns_ipv4;
1685 #if defined(INET6)
1686 	if (q->addr.ss_family == AF_INET6) {
1687 		edns = &nsd->edns_ipv6;
1688 	}
1689 #endif
1690 	if (RCODE(q->packet) == RCODE_FORMAT) {
1691 		return;
1692 	}
1693 	switch (q->edns.status) {
1694 	case EDNS_NOT_PRESENT:
1695 		break;
1696 	case EDNS_OK:
1697 		if (q->edns.dnssec_ok)	edns->ok[7] = 0x80;
1698 		else			edns->ok[7] = 0x00;
1699 		buffer_write(q->packet, edns->ok, OPT_LEN);
1700 
1701 		/* Add Extended DNS Error (RFC8914)
1702 		 * to verify that we stay in bounds */
1703 		if (q->edns.ede >= 0)
1704 			q->edns.opt_reserved_space +=
1705 				6 + ( q->edns.ede_text_len
1706 			            ? q->edns.ede_text_len : 0);
1707 
1708 		if(q->edns.opt_reserved_space == 0 || !buffer_available(
1709 			q->packet, 2+q->edns.opt_reserved_space)) {
1710 			/* fill with NULLs */
1711 			buffer_write(q->packet, edns->rdata_none, OPT_RDATA);
1712 		} else {
1713 			/* rdata length */
1714 			buffer_write_u16(q->packet, q->edns.opt_reserved_space);
1715 			/* edns options */
1716 			if(q->edns.nsid) {
1717 				/* nsid opt header */
1718 				buffer_write(q->packet, edns->nsid, OPT_HDR);
1719 				/* nsid payload */
1720 				buffer_write(q->packet, nsd->nsid, nsd->nsid_len);
1721 			}
1722 			/* Append Extended DNS Error (RFC8914) option if needed */
1723 			if (q->edns.ede >= 0) { /* < 0 means no EDE */
1724 				/* OPTION-CODE */
1725 				buffer_write_u16(q->packet, EDE_CODE);
1726 				/* OPTION-LENGTH */
1727 				buffer_write_u16(q->packet,
1728 					2 + ( q->edns.ede_text_len
1729 					    ? q->edns.ede_text_len : 0));
1730 				/* INFO-CODE */
1731 				buffer_write_u16(q->packet, q->edns.ede);
1732 				/* EXTRA-TEXT */
1733 				if (q->edns.ede_text_len)
1734 					buffer_write(q->packet,
1735 							q->edns.ede_text,
1736 							q->edns.ede_text_len);
1737 			}
1738 		}
1739 		ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1);
1740 		STATUP(nsd, edns);
1741 		ZTATUP(nsd, q->zone, edns);
1742 		break;
1743 	case EDNS_ERROR:
1744 		if (q->edns.dnssec_ok)	edns->error[7] = 0x80;
1745 		else			edns->error[7] = 0x00;
1746 		buffer_write(q->packet, edns->error, OPT_LEN);
1747 		buffer_write(q->packet, edns->rdata_none, OPT_RDATA);
1748 		ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1);
1749 		STATUP(nsd, ednserr);
1750 		ZTATUP(nsd, q->zone, ednserr);
1751 		break;
1752 	}
1753 
1754 	if (q->tsig.status != TSIG_NOT_PRESENT) {
1755 		if (q->tsig.status == TSIG_ERROR ||
1756 			q->tsig.error_code != TSIG_ERROR_NOERROR) {
1757 			tsig_error_reply(&q->tsig);
1758 			tsig_append_rr(&q->tsig, q->packet);
1759 			ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1);
1760 		} else if(q->tsig.status == TSIG_OK &&
1761 			q->tsig.error_code == TSIG_ERROR_NOERROR)
1762 		{
1763 			if(q->tsig_prepare_it)
1764 				tsig_prepare(&q->tsig);
1765 			if(q->tsig_update_it)
1766 				tsig_update(&q->tsig, q->packet, buffer_position(q->packet));
1767 			if(q->tsig_sign_it) {
1768 				tsig_sign(&q->tsig);
1769 				tsig_append_rr(&q->tsig, q->packet);
1770 				ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1);
1771 			}
1772 		}
1773 	}
1774 }
1775