xref: /openbsd-src/usr.sbin/nsd/query.c (revision d13be5d47e4149db2549a9828e244d59dbc43f15)
1 /*
2  * query.c -- nsd(8) the resolver.
3  *
4  * Copyright (c) 2001-2011, NLnet Labs. All rights reserved.
5  *
6  * See LICENSE for the license.
7  *
8  */
9 
10 #include <config.h>
11 
12 #include <sys/types.h>
13 #include <sys/socket.h>
14 #include <netinet/in.h>
15 #include <arpa/inet.h>
16 #include <assert.h>
17 #include <ctype.h>
18 #include <errno.h>
19 #include <limits.h>
20 #include <netdb.h>
21 #include <stddef.h>
22 #include <stdio.h>
23 #include <stdlib.h>
24 #include <string.h>
25 #include <time.h>
26 #include <unistd.h>
27 #include <netdb.h>
28 
29 #include "answer.h"
30 #include "axfr.h"
31 #include "dns.h"
32 #include "dname.h"
33 #include "nsd.h"
34 #include "namedb.h"
35 #include "query.h"
36 #include "util.h"
37 #include "options.h"
38 #include "nsec3.h"
39 #include "tsig.h"
40 
41 /* [Bug #253] Adding unnecessary NS RRset may lead to undesired truncation.
42  * This function determines if the final response packet needs the NS RRset
43  * included. Currently, it will only return negative if QTYPE == DNSKEY|DS.
44  * This way, resolvers won't fallback to TCP unnecessarily when priming
45  * trust anchors.
46  */
47 static int answer_needs_ns(struct query  *query);
48 
49 static int add_rrset(struct query  *query,
50 		     answer_type    *answer,
51 		     rr_section_type section,
52 		     domain_type    *owner,
53 		     rrset_type     *rrset);
54 
55 static void answer_authoritative(struct nsd	  *nsd,
56 				 struct query     *q,
57 				 answer_type      *answer,
58 				 uint32_t          domain_number,
59 				 int               exact,
60 				 domain_type      *closest_match,
61 				 domain_type      *closest_encloser,
62 				 const dname_type *qname);
63 
64 static void answer_lookup_zone(struct nsd *nsd, struct query *q,
65 			       answer_type *answer, uint32_t domain_number,
66 			       int exact, domain_type *closest_match,
67 			       domain_type *closest_encloser,
68 			       const dname_type *qname);
69 
70 void
71 query_put_dname_offset(struct query *q, domain_type *domain, uint16_t offset)
72 {
73 	assert(q);
74 	assert(domain);
75 	assert(domain->number > 0);
76 
77 	if (offset > MAX_COMPRESSION_OFFSET)
78 		return;
79 	if (q->compressed_dname_count >= MAX_COMPRESSED_DNAMES)
80 		return;
81 
82 	q->compressed_dname_offsets[domain->number] = offset;
83 	q->compressed_dnames[q->compressed_dname_count] = domain;
84 	++q->compressed_dname_count;
85 }
86 
87 void
88 query_clear_dname_offsets(struct query *q, size_t max_offset)
89 {
90 	while (q->compressed_dname_count > 0
91 	       && (q->compressed_dname_offsets[q->compressed_dnames[q->compressed_dname_count - 1]->number]
92 		   >= max_offset))
93 	{
94 		q->compressed_dname_offsets[q->compressed_dnames[q->compressed_dname_count - 1]->number] = 0;
95 		--q->compressed_dname_count;
96 	}
97 }
98 
99 void
100 query_clear_compression_tables(struct query *q)
101 {
102 	uint16_t i;
103 
104 	for (i = 0; i < q->compressed_dname_count; ++i) {
105 		assert(q->compressed_dnames);
106 		q->compressed_dname_offsets[q->compressed_dnames[i]->number] = 0;
107 	}
108 	q->compressed_dname_count = 0;
109 }
110 
111 void
112 query_add_compression_domain(struct query *q, domain_type *domain, uint16_t offset)
113 {
114 	while (domain->parent) {
115 		DEBUG(DEBUG_NAME_COMPRESSION, 2,
116 		      (LOG_INFO, "query dname: %s, number: %lu, offset: %u\n",
117 		       dname_to_string(domain_dname(domain), NULL),
118 		       (unsigned long) domain->number,
119 		       offset));
120 		query_put_dname_offset(q, domain, offset);
121 		offset += label_length(dname_name(domain_dname(domain))) + 1;
122 		domain = domain->parent;
123 	}
124 }
125 
126 /*
127  * Generate an error response with the specified RCODE.
128  */
129 query_state_type
130 query_error (struct query *q, nsd_rc_type rcode)
131 {
132 	if (rcode == NSD_RC_DISCARD) {
133 		return QUERY_DISCARDED;
134 	}
135 
136 	buffer_clear(q->packet);
137 
138 	QR_SET(q->packet);	   /* This is an answer.  */
139 	RCODE_SET(q->packet, (int) rcode); /* Error code.  */
140 
141 	/* Truncate the question as well... */
142 	QDCOUNT_SET(q->packet, 0);
143 	ANCOUNT_SET(q->packet, 0);
144 	NSCOUNT_SET(q->packet, 0);
145 	ARCOUNT_SET(q->packet, 0);
146 	buffer_set_position(q->packet, QHEADERSZ);
147 	return QUERY_PROCESSED;
148 }
149 
150 static query_state_type
151 query_formerr (struct query *query)
152 {
153 	int opcode = OPCODE(query->packet);
154 	FLAGS_SET(query->packet, FLAGS(query->packet) & 0x0100U);
155 			/* Preserve the RD flag. Clear the rest. */
156 	OPCODE_SET(query->packet, opcode);
157 	return query_error(query, NSD_RC_FORMAT);
158 }
159 
160 static void
161 query_cleanup(void *data)
162 {
163 	query_type *query = (query_type *) data;
164 	region_destroy(query->region);
165 }
166 
167 query_type *
168 query_create(region_type *region, uint16_t *compressed_dname_offsets,
169 	uint32_t compressed_dname_size)
170 {
171 	query_type *query
172 		= (query_type *) region_alloc_zero(region, sizeof(query_type));
173 	/* create region with large block size, because the initial chunk
174 	   saves many mallocs in the server */
175 	query->region = region_create_custom(xalloc, free, 16384, 16384/8, 32, 0);
176 	query->compressed_dname_offsets = compressed_dname_offsets;
177 	query->packet = buffer_create(region, QIOBUFSZ);
178 	region_add_cleanup(region, query_cleanup, query);
179 	query->compressed_dname_offsets_size = compressed_dname_size;
180 	tsig_create_record(&query->tsig, region);
181 	query->tsig_prepare_it = 1;
182 	query->tsig_update_it = 1;
183 	query->tsig_sign_it = 1;
184 	return query;
185 }
186 
187 void
188 query_reset(query_type *q, size_t maxlen, int is_tcp)
189 {
190 	/*
191 	 * As long as less than 4Kb (region block size) has been used,
192 	 * this call to free_all is free, the block is saved for re-use,
193 	 * so no malloc() or free() calls are done.
194 	 * at present use of the region is for:
195 	 *   o query qname dname_type (255 max).
196 	 *   o wildcard expansion domain_type (7*ptr+u32+2bytes)+(5*ptr nsec3)
197 	 *   o wildcard expansion for additional section domain_type.
198 	 *   o nsec3 hashed name(s) (3 dnames for a nonexist_proof,
199 	 *     one proof per wildcard and for nx domain).
200 	 */
201 	region_free_all(q->region);
202 	q->addrlen = sizeof(q->addr);
203 	q->maxlen = maxlen;
204 	q->reserved_space = 0;
205 	buffer_clear(q->packet);
206 	edns_init_record(&q->edns);
207 	tsig_init_record(&q->tsig, NULL, NULL);
208 	q->tsig_prepare_it = 1;
209 	q->tsig_update_it = 1;
210 	q->tsig_sign_it = 1;
211 	q->tcp = is_tcp;
212 	q->qname = NULL;
213 	q->qtype = 0;
214 	q->qclass = 0;
215 	q->zone = NULL;
216 	q->domain = NULL;
217 	q->opcode = 0;
218 	q->cname_count = 0;
219 	q->delegation_domain = NULL;
220 	q->delegation_rrset = NULL;
221 	q->compressed_dname_count = 0;
222 	q->number_temporary_domains = 0;
223 
224 	q->axfr_is_done = 0;
225 	q->axfr_zone = NULL;
226 	q->axfr_current_domain = NULL;
227 	q->axfr_current_rrset = NULL;
228 	q->axfr_current_rr = 0;
229 }
230 
231 /* get a temporary domain number (or 0=failure) */
232 static domain_type*
233 query_get_tempdomain(struct query *q)
234 {
235 	static domain_type d[EXTRA_DOMAIN_NUMBERS];
236 	if(q->number_temporary_domains >= EXTRA_DOMAIN_NUMBERS)
237 		return 0;
238 	q->number_temporary_domains ++;
239 	memset(&d[q->number_temporary_domains-1], 0, sizeof(domain_type));
240 	d[q->number_temporary_domains-1].number = q->compressed_dname_offsets_size +
241 		q->number_temporary_domains - 1;
242 	return &d[q->number_temporary_domains-1];
243 }
244 
245 static void
246 query_addtxt(struct query  *q,
247 	     const uint8_t *dname,
248 	     uint16_t       klass,
249 	     uint32_t       ttl,
250 	     const char    *txt)
251 {
252 	size_t txt_length = strlen(txt);
253 	uint8_t len = (uint8_t) txt_length;
254 
255 	assert(txt_length <= UCHAR_MAX);
256 
257 	/* Add the dname */
258 	if (dname >= buffer_begin(q->packet)
259 	    && dname <= buffer_current(q->packet))
260 	{
261 		buffer_write_u16(q->packet,
262 				 0xc000 | (dname - buffer_begin(q->packet)));
263 	} else {
264 		buffer_write(q->packet, dname + 1, *dname);
265 	}
266 
267 	buffer_write_u16(q->packet, TYPE_TXT);
268 	buffer_write_u16(q->packet, klass);
269 	buffer_write_u32(q->packet, ttl);
270 	buffer_write_u16(q->packet, len + 1);
271 	buffer_write_u8(q->packet, len);
272 	buffer_write(q->packet, txt, len);
273 }
274 
275 /*
276  * Parse the question section of a query.  The normalized query name
277  * is stored in QUERY->name, the class in QUERY->klass, and the type
278  * in QUERY->type.
279  */
280 static int
281 process_query_section(query_type *query)
282 {
283 	uint8_t qnamebuf[MAXDOMAINLEN];
284 
285 	buffer_set_position(query->packet, QHEADERSZ);
286 	/* Lets parse the query name and convert it to lower case.  */
287 	if(!packet_read_query_section(query->packet, qnamebuf,
288 		&query->qtype, &query->qclass))
289 		return 0;
290 	query->qname = dname_make(query->region, qnamebuf, 1);
291 	query->opcode = OPCODE(query->packet);
292 	return 1;
293 }
294 
295 
296 /*
297  * Process an optional EDNS OPT record.  Sets QUERY->EDNS to 0 if
298  * there was no EDNS record, to -1 if there was an invalid or
299  * unsupported EDNS record, and to 1 otherwise.  Updates QUERY->MAXLEN
300  * if the EDNS record specifies a maximum supported response length.
301  *
302  * Return NSD_RC_FORMAT on failure, NSD_RC_OK on success.
303  */
304 static nsd_rc_type
305 process_edns(nsd_type* nsd, struct query *q)
306 {
307 	if (q->edns.status == EDNS_ERROR) {
308 		return NSD_RC_FORMAT;
309 	}
310 
311 	if (q->edns.status == EDNS_OK) {
312 		/* Only care about UDP size larger than normal... */
313 		if (!q->tcp && q->edns.maxlen > UDP_MAX_MESSAGE_LEN) {
314 			size_t edns_size;
315 #if defined(INET6)
316 			if (q->addr.ss_family == AF_INET6) {
317 				edns_size = nsd->ipv6_edns_size;
318 			} else
319 #endif
320 			edns_size = nsd->ipv4_edns_size;
321 
322 			if (q->edns.maxlen < edns_size) {
323 				q->maxlen = q->edns.maxlen;
324 			} else {
325 				q->maxlen = edns_size;
326 			}
327 
328 #if defined(INET6) && !defined(IPV6_USE_MIN_MTU) && !defined(IPV6_MTU)
329 			/*
330 			 * Use IPv6 minimum MTU to avoid sending
331 			 * packets that are too large for some links.
332 			 * IPv6 will not automatically fragment in
333 			 * this case (unlike IPv4).
334 			 */
335 			if (q->addr.ss_family == AF_INET6
336 			    && q->maxlen > IPV6_MIN_MTU)
337 			{
338 				q->maxlen = IPV6_MIN_MTU;
339 			}
340 #endif
341 		}
342 
343 		/* Strip the OPT resource record off... */
344 		buffer_set_position(q->packet, q->edns.position);
345 		buffer_set_limit(q->packet, q->edns.position);
346 		ARCOUNT_SET(q->packet, ARCOUNT(q->packet) - 1);
347 	}
348 	return NSD_RC_OK;
349 }
350 
351 /*
352  * Processes TSIG.
353  * Sets error when tsig does not verify on the query.
354  */
355 static nsd_rc_type
356 process_tsig(struct query* q)
357 {
358 	if(q->tsig.status == TSIG_ERROR)
359 		return NSD_RC_FORMAT;
360 	if(q->tsig.status == TSIG_OK) {
361 		if(!tsig_from_query(&q->tsig)) {
362 			log_msg(LOG_ERR, "query tsig unknown key/algorithm");
363 			return NSD_RC_REFUSE;
364 		}
365 		buffer_set_limit(q->packet, q->tsig.position);
366 		ARCOUNT_SET(q->packet, ARCOUNT(q->packet) - 1);
367 		tsig_prepare(&q->tsig);
368 		tsig_update(&q->tsig, q->packet, buffer_limit(q->packet));
369 		if(!tsig_verify(&q->tsig)) {
370 			log_msg(LOG_ERR, "query: bad tsig signature for key %s",
371 				dname_to_string(q->tsig.key->name, NULL));
372 			return NSD_RC_REFUSE;
373 		}
374 		DEBUG(DEBUG_XFRD,1, (LOG_INFO, "query good tsig signature for %s",
375 			dname_to_string(q->tsig.key->name, NULL)));
376 	}
377 	return NSD_RC_OK;
378 }
379 
380 /*
381  * Check notify acl and forward to xfrd (or return an error).
382  */
383 static query_state_type
384 answer_notify(struct nsd* nsd, struct query *query)
385 {
386 	int acl_num;
387 	acl_options_t *why;
388 	nsd_rc_type rc;
389 
390 	zone_options_t* zone_opt;
391 	DEBUG(DEBUG_XFRD,1, (LOG_INFO, "got notify %s processing acl",
392 		dname_to_string(query->qname, NULL)));
393 
394 	zone_opt = zone_options_find(nsd->options, query->qname);
395 	if(!zone_opt)
396 		return query_error(query, NSD_RC_NXDOMAIN);
397 
398 	if(!nsd->this_child) /* we are in debug mode or something */
399 		return query_error(query, NSD_RC_SERVFAIL);
400 
401 	if(!tsig_find_rr(&query->tsig, query->packet)) {
402 		DEBUG(DEBUG_XFRD,2, (LOG_ERR, "bad tsig RR format"));
403 		return query_error(query, NSD_RC_FORMAT);
404 	}
405 	rc = process_tsig(query);
406 	if(rc != NSD_RC_OK)
407 		return query_error(query, rc);
408 
409 	/* check if it passes acl */
410 	if((acl_num = acl_check_incoming(zone_opt->allow_notify, query,
411 		&why)) != -1)
412 	{
413 		sig_atomic_t mode = NSD_PASS_TO_XFRD;
414 		int s = nsd->this_child->parent_fd;
415 		uint16_t sz;
416 		uint32_t acl_send = htonl(acl_num);
417 		size_t pos;
418 		assert(why);
419 		DEBUG(DEBUG_XFRD,1, (LOG_INFO, "got notify %s passed acl %s %s",
420 			dname_to_string(query->qname, NULL),
421 			why->ip_address_spec,
422 			why->nokey?"NOKEY":
423 			(why->blocked?"BLOCKED":why->key_name)));
424 		sz = buffer_limit(query->packet);
425 		if(buffer_limit(query->packet) > MAX_PACKET_SIZE)
426 			return query_error(query, NSD_RC_SERVFAIL);
427 		/* forward to xfrd for processing
428 		   Note. Blocking IPC I/O, but acl is OK. */
429 		sz = htons(sz);
430 		if(!write_socket(s, &mode, sizeof(mode)) ||
431 			!write_socket(s, &sz, sizeof(sz)) ||
432 			!write_socket(s, buffer_begin(query->packet),
433 				buffer_limit(query->packet)) ||
434 			!write_socket(s, &acl_send, sizeof(acl_send))) {
435 			log_msg(LOG_ERR, "error in IPC notify server2main, %s",
436 				strerror(errno));
437 			return query_error(query, NSD_RC_SERVFAIL);
438 		}
439 
440 		/* create notify reply - keep same query contents */
441 		QR_SET(query->packet);         /* This is an answer.  */
442 		AA_SET(query->packet);	   /* we are authoritative. */
443 		ANCOUNT_SET(query->packet, 0);
444 		NSCOUNT_SET(query->packet, 0);
445 		ARCOUNT_SET(query->packet, 0);
446 		RCODE_SET(query->packet, RCODE_OK); /* Error code.  */
447 		/* position is right after the query */
448 		pos = buffer_position(query->packet);
449 		buffer_clear(query->packet);
450 		buffer_set_position(query->packet, pos);
451 		VERBOSITY(2, (LOG_INFO, "Notify received and accepted, forward to xfrd"));
452 		/* tsig is added in add_additional later (if needed) */
453 		return QUERY_PROCESSED;
454 	}
455 
456 	if (verbosity > 1) {
457 		char address[128];
458 		if (addr2ip(query->addr, address, sizeof(address))) {
459 			DEBUG(DEBUG_XFRD,1, (LOG_INFO, "addr2ip failed"));
460 			strlcpy(address, "[unknown]", sizeof(address));
461 		}
462 
463 		VERBOSITY(1, (LOG_INFO, "notify for zone %s from client %s refused, %s%s",
464 			dname_to_string(query->qname, NULL),
465 			address,
466 			why?why->key_name:"no acl matches",
467 			why?why->ip_address_spec:"."));
468 	}
469 
470 	return query_error(query, NSD_RC_REFUSE);
471 }
472 
473 
474 /*
475  * Answer a query in the CHAOS class.
476  */
477 static query_state_type
478 answer_chaos(struct nsd *nsd, query_type *q)
479 {
480 	AA_CLR(q->packet);
481 	switch (q->qtype) {
482 	case TYPE_ANY:
483 	case TYPE_TXT:
484 		if ((q->qname->name_size == 11
485 		     && memcmp(dname_name(q->qname), "\002id\006server", 11) == 0) ||
486 		    (q->qname->name_size ==  15
487 		     && memcmp(dname_name(q->qname), "\010hostname\004bind", 15) == 0))
488 		{
489 			/* Add ID */
490 			query_addtxt(q,
491 				     buffer_begin(q->packet) + QHEADERSZ,
492 				     CLASS_CH,
493 				     0,
494 				     nsd->identity);
495 			ANCOUNT_SET(q->packet, ANCOUNT(q->packet) + 1);
496 		} else if ((q->qname->name_size == 16
497 			    && memcmp(dname_name(q->qname), "\007version\006server", 16) == 0) ||
498 			   (q->qname->name_size == 14
499 			    && memcmp(dname_name(q->qname), "\007version\004bind", 14) == 0))
500 		{
501 			if(!nsd->options->hide_version) {
502 				/* Add version */
503 				query_addtxt(q,
504 				     buffer_begin(q->packet) + QHEADERSZ,
505 				     CLASS_CH,
506 				     0,
507 				     nsd->version);
508 				ANCOUNT_SET(q->packet, ANCOUNT(q->packet) + 1);
509 			} else {
510 				RCODE_SET(q->packet, RCODE_REFUSE);
511 			}
512 		}
513 		break;
514 	default:
515 		RCODE_SET(q->packet, RCODE_REFUSE);
516 		break;
517 	}
518 
519 	return QUERY_PROCESSED;
520 }
521 
522 
523 /*
524  * Find the covering NSEC for a non-existent domain name.  Normally
525  * the NSEC will be located at CLOSEST_MATCH, except when it is an
526  * empty non-terminal.  In this case the NSEC may be located at the
527  * previous domain name (in canonical ordering).
528  */
529 static domain_type *
530 find_covering_nsec(domain_type *closest_match,
531 		   zone_type   *zone,
532 		   rrset_type **nsec_rrset)
533 {
534 	assert(closest_match);
535 	assert(nsec_rrset);
536 
537 	/* loop away temporary created domains. For real ones it is &RBTREE_NULL */
538 	while (closest_match->node.parent == NULL)
539 		closest_match = closest_match->parent;
540 	while (closest_match) {
541 		*nsec_rrset = domain_find_rrset(closest_match, zone, TYPE_NSEC);
542 		if (*nsec_rrset) {
543 			return closest_match;
544 		}
545 		if (closest_match == zone->apex) {
546 			/* Don't look outside the current zone.  */
547 			return NULL;
548 		}
549 		closest_match = domain_previous(closest_match);
550 	}
551 	return NULL;
552 }
553 
554 
555 struct additional_rr_types
556 {
557 	uint16_t        rr_type;
558 	rr_section_type rr_section;
559 };
560 
561 struct additional_rr_types default_additional_rr_types[] = {
562 	{ TYPE_A, ADDITIONAL_A_SECTION },
563 	{ TYPE_AAAA, ADDITIONAL_AAAA_SECTION },
564 	{ 0, (rr_section_type) 0 }
565 };
566 
567 struct additional_rr_types rt_additional_rr_types[] = {
568 	{ TYPE_A, ADDITIONAL_A_SECTION },
569 	{ TYPE_AAAA, ADDITIONAL_AAAA_SECTION },
570 	{ TYPE_X25, ADDITIONAL_OTHER_SECTION },
571 	{ TYPE_ISDN, ADDITIONAL_OTHER_SECTION },
572 	{ 0, (rr_section_type) 0 }
573 };
574 
575 static void
576 add_additional_rrsets(struct query *query, answer_type *answer,
577 		      rrset_type *master_rrset, size_t rdata_index,
578 		      int allow_glue, struct additional_rr_types types[])
579 {
580 	size_t i;
581 
582 	assert(query);
583 	assert(answer);
584 	assert(master_rrset);
585 	assert(rdata_atom_is_domain(rrset_rrtype(master_rrset), rdata_index));
586 
587 	for (i = 0; i < master_rrset->rr_count; ++i) {
588 		int j;
589 		domain_type *additional = rdata_atom_domain(master_rrset->rrs[i].rdatas[rdata_index]);
590 		domain_type *match = additional;
591 
592 		assert(additional);
593 
594 		if (!allow_glue && domain_is_glue(match, query->zone))
595 			continue;
596 
597 		/*
598 		 * Check to see if we need to generate the dependent
599 		 * based on a wildcard domain.
600 		 */
601 		while (!match->is_existing) {
602 			match = match->parent;
603 		}
604 		if (additional != match && domain_wildcard_child(match)) {
605 			domain_type *wildcard_child = domain_wildcard_child(match);
606 			domain_type *temp = (domain_type *) region_alloc(
607 				query->region, sizeof(domain_type));
608 			memcpy(&temp->node, &additional->node, sizeof(rbnode_t));
609 			temp->number = additional->number;
610 			temp->parent = match;
611 			temp->wildcard_child_closest_match = temp;
612 			temp->rrsets = wildcard_child->rrsets;
613 			temp->is_existing = wildcard_child->is_existing;
614 			additional = temp;
615 		}
616 
617 		for (j = 0; types[j].rr_type != 0; ++j) {
618 			rrset_type *rrset = domain_find_rrset(
619 				additional, query->zone, types[j].rr_type);
620 			if (rrset) {
621 				answer_add_rrset(answer, types[j].rr_section,
622 						 additional, rrset);
623 			}
624 		}
625 	}
626 }
627 
628 static int
629 answer_needs_ns(struct query* query)
630 {
631 	assert(query);
632 	/* Currently, only troublesome for DNSKEY and DS,
633          * cuz their RRSETs are quite large. */
634 	return (query->qtype != TYPE_DNSKEY && query->qtype != TYPE_DS);
635 }
636 
637 static int
638 add_rrset(struct query   *query,
639 	  answer_type    *answer,
640 	  rr_section_type section,
641 	  domain_type    *owner,
642 	  rrset_type     *rrset)
643 {
644 	int result;
645 
646 	assert(query);
647 	assert(answer);
648 	assert(owner);
649 	assert(rrset);
650 	assert(rrset_rrclass(rrset) == CLASS_IN);
651 
652 	result = answer_add_rrset(answer, section, owner, rrset);
653 	switch (rrset_rrtype(rrset)) {
654 	case TYPE_NS:
655 		add_additional_rrsets(query, answer, rrset, 0, 1,
656 				      default_additional_rr_types);
657 		break;
658 	case TYPE_MB:
659 		add_additional_rrsets(query, answer, rrset, 0, 0,
660 				      default_additional_rr_types);
661 		break;
662 	case TYPE_MX:
663 	case TYPE_KX:
664 		add_additional_rrsets(query, answer, rrset, 1, 0,
665 				      default_additional_rr_types);
666 		break;
667 	case TYPE_RT:
668 		add_additional_rrsets(query, answer, rrset, 1, 0,
669 				      rt_additional_rr_types);
670 		break;
671 	default:
672 		break;
673 	}
674 
675 	return result;
676 }
677 
678 
679 /* returns 0 on error, or the domain number for to_name.
680    from_name is changes to to_name by the DNAME rr.
681    DNAME rr is from src to dest.
682    closest encloser encloses the to_name. */
683 static uint32_t
684 query_synthesize_cname(struct query* q, struct answer* answer, const dname_type* from_name,
685 	const dname_type* to_name, domain_type* src, domain_type* to_closest_encloser,
686 	domain_type** to_closest_match)
687 {
688 	/* add temporary domains for from_name and to_name and all
689 	   their (not allocated yet) parents */
690 	/* any domains below src are not_existing (because of DNAME at src) */
691 	int i;
692 	domain_type* cname_domain;
693 	domain_type* cname_dest;
694 	rrset_type* rrset;
695 
696 	/* allocate source part */
697 	domain_type* lastparent = src;
698 	assert(q && answer && from_name && to_name && src && to_closest_encloser);
699 	assert(to_closest_match);
700 	for(i=0; i < from_name->label_count - domain_dname(src)->label_count; i++)
701 	{
702 		domain_type* newdom = query_get_tempdomain(q);
703 		if(!newdom)
704 			return 0;
705 		newdom->is_existing = 1;
706 		newdom->parent = lastparent;
707 		newdom->node.key = dname_partial_copy(q->region,
708 			from_name, domain_dname(src)->label_count + i + 1);
709 		if(dname_compare(domain_dname(newdom), q->qname) == 0) {
710 			/* 0 good for query name, otherwise new number */
711 			newdom->number = 0;
712 		}
713 		DEBUG(DEBUG_QUERY,2, (LOG_INFO, "created temp domain src %d. %s nr %d", i,
714 			dname_to_string(domain_dname(newdom), NULL),
715 			newdom->number));
716 		lastparent = newdom;
717 	}
718 	cname_domain = lastparent;
719 
720 	/* allocate dest part */
721 	lastparent = to_closest_encloser;
722 	for(i=0; i < to_name->label_count - domain_dname(to_closest_encloser)->label_count;
723 		i++)
724 	{
725 		domain_type* newdom = query_get_tempdomain(q);
726 		if(!newdom)
727 			return 0;
728 		newdom->is_existing = 0;
729 		newdom->parent = lastparent;
730 		newdom->node.key = dname_partial_copy(q->region,
731 			to_name, domain_dname(to_closest_encloser)->label_count + i + 1);
732 		DEBUG(DEBUG_QUERY,2, (LOG_INFO, "created temp domain dest %d. %s nr %d", i,
733 			dname_to_string(domain_dname(newdom), NULL),
734 			newdom->number));
735 		lastparent = newdom;
736 	}
737 	cname_dest = lastparent;
738 	*to_closest_match = cname_dest;
739 
740 	/* allocate the CNAME RR */
741 	rrset = (rrset_type*) region_alloc(q->region, sizeof(rrset_type));
742 	memset(rrset, 0, sizeof(rrset_type));
743 	rrset->zone = q->zone;
744 	rrset->rr_count = 1;
745 	rrset->rrs = (rr_type*) region_alloc(q->region, sizeof(rr_type));
746 	memset(rrset->rrs, 0, sizeof(rr_type));
747 	rrset->rrs->owner = cname_domain;
748 	rrset->rrs->ttl = 0;
749 	rrset->rrs->type = TYPE_CNAME;
750 	rrset->rrs->klass = CLASS_IN;
751 	rrset->rrs->rdata_count = 1;
752 	rrset->rrs->rdatas = (rdata_atom_type*)region_alloc(q->region,
753 		sizeof(rdata_atom_type));
754 	rrset->rrs->rdatas->domain = cname_dest;
755 
756 	if(!add_rrset(q, answer, ANSWER_SECTION, cname_domain, rrset)) {
757 		log_msg(LOG_ERR, "could not add synthesized CNAME rrset to packet");
758 	}
759 
760 	return cname_dest->number;
761 }
762 
763 /*
764  * Answer delegation information.
765  *
766  * DNSSEC: Include the DS RRset if present.  Otherwise include an NSEC
767  * record proving the DS RRset does not exist.
768  */
769 static void
770 answer_delegation(query_type *query, answer_type *answer)
771 {
772 	assert(answer);
773 	assert(query->delegation_domain);
774 	assert(query->delegation_rrset);
775 
776 	AA_CLR(query->packet);
777 	add_rrset(query,
778 		  answer,
779 		  AUTHORITY_SECTION,
780 		  query->delegation_domain,
781 		  query->delegation_rrset);
782 	if (query->edns.dnssec_ok && zone_is_secure(query->zone)) {
783 		rrset_type *rrset;
784 		if ((rrset = domain_find_rrset(query->delegation_domain, query->zone, TYPE_DS))) {
785 			add_rrset(query, answer, AUTHORITY_SECTION,
786 				  query->delegation_domain, rrset);
787 #ifdef NSEC3
788 		} else if (query->zone->nsec3_soa_rr) {
789 			nsec3_answer_delegation(query, answer);
790 #endif
791 		} else if ((rrset = domain_find_rrset(query->delegation_domain, query->zone, TYPE_NSEC))) {
792 			add_rrset(query, answer, AUTHORITY_SECTION,
793 				  query->delegation_domain, rrset);
794 		}
795 	}
796 	query->domain = query->delegation_domain;
797 }
798 
799 
800 /*
801  * Answer SOA information.
802  */
803 static void
804 answer_soa(struct query *query, answer_type *answer)
805 {
806 	query->domain = query->zone->apex;
807 
808 	if (query->qclass != CLASS_ANY) {
809 		add_rrset(query, answer,
810 			  AUTHORITY_SECTION,
811 			  query->zone->apex,
812 			  query->zone->soa_nx_rrset);
813 	}
814 }
815 
816 
817 /*
818  * Answer that the domain name exists but there is no RRset with the
819  * requested type.
820  *
821  * DNSSEC: Include the correct NSEC record proving that the type does
822  * not exist.  In the wildcard no data (3.1.3.4) case the wildcard IS
823  * NOT expanded, so the ORIGINAL parameter must point to the original
824  * wildcard entry, not to the generated entry.
825  */
826 static void
827 answer_nodata(struct query *query, answer_type *answer, domain_type *original)
828 {
829 	if (query->cname_count == 0) {
830 		answer_soa(query, answer);
831 	}
832 
833 #ifdef NSEC3
834 	if (query->edns.dnssec_ok && query->zone->nsec3_soa_rr) {
835 		nsec3_answer_nodata(query, answer, original);
836 	} else
837 #endif
838 	if (query->edns.dnssec_ok && zone_is_secure(query->zone)) {
839 		domain_type *nsec_domain;
840 		rrset_type *nsec_rrset;
841 
842 		nsec_domain = find_covering_nsec(original, query->zone, &nsec_rrset);
843 		if (nsec_domain) {
844 			add_rrset(query, answer, AUTHORITY_SECTION, nsec_domain, nsec_rrset);
845 		}
846 	}
847 }
848 
849 static void
850 answer_nxdomain(query_type *query, answer_type *answer)
851 {
852 	if (query->cname_count == 0) {
853 		RCODE_SET(query->packet, RCODE_NXDOMAIN);
854 		answer_soa(query, answer);
855 	}
856 }
857 
858 
859 /*
860  * Answer domain information (or SOA if we do not have an RRset for
861  * the type specified by the query).
862  */
863 static void
864 answer_domain(struct nsd* nsd, struct query *q, answer_type *answer,
865 	      domain_type *domain, domain_type *original)
866 {
867 	rrset_type *rrset;
868 
869 	if (q->qtype == TYPE_ANY) {
870 		int added = 0;
871 		for (rrset = domain_find_any_rrset(domain, q->zone); rrset; rrset = rrset->next) {
872 			if (rrset->zone == q->zone
873 #ifdef NSEC3
874 				&& rrset_rrtype(rrset) != TYPE_NSEC3
875 #endif
876 			    /*
877 			     * Don't include the RRSIG RRset when
878 			     * DNSSEC is used, because it is added
879 			     * automatically on an per-RRset basis.
880 			     */
881 			    && !(q->edns.dnssec_ok
882 				 && zone_is_secure(q->zone)
883 				 && rrset_rrtype(rrset) == TYPE_RRSIG))
884 			{
885 				add_rrset(q, answer, ANSWER_SECTION, domain, rrset);
886 				++added;
887 			}
888 		}
889 		if (added == 0) {
890 			answer_nodata(q, answer, original);
891 			return;
892 		}
893 #ifdef NSEC3
894 	} else if (q->qtype == TYPE_NSEC3) {
895 		answer_nodata(q, answer, original);
896 		return;
897 #endif
898 	} else if ((rrset = domain_find_rrset(domain, q->zone, q->qtype))) {
899 		add_rrset(q, answer, ANSWER_SECTION, domain, rrset);
900 	} else if ((rrset = domain_find_rrset(domain, q->zone, TYPE_CNAME))) {
901 		int added;
902 
903 		/*
904 		 * If the CNAME is not added it is already in the
905 		 * answer, so we have a CNAME loop.  Don't follow the
906 		 * CNAME target in this case.
907 		 */
908 		added = add_rrset(q, answer, ANSWER_SECTION, domain, rrset);
909 		assert(rrset->rr_count > 0);
910 		if (added) {
911 			/* only process first CNAME record */
912 			domain_type *closest_match = rdata_atom_domain(rrset->rrs[0].rdatas[0]);
913 			domain_type *closest_encloser = closest_match;
914 			zone_type* origzone = q->zone;
915 			++q->cname_count;
916 
917 			while (!closest_encloser->is_existing)
918 				closest_encloser = closest_encloser->parent;
919 
920 			answer_lookup_zone(nsd, q, answer, closest_match->number,
921 					     closest_match == closest_encloser,
922 					     closest_match, closest_encloser,
923 					     domain_dname(closest_match));
924 			q->zone = origzone;
925 		}
926 	} else {
927 		answer_nodata(q, answer, original);
928 		return;
929 	}
930 
931 	q->domain = domain;
932 
933 	if (q->qclass != CLASS_ANY && q->zone->ns_rrset && answer_needs_ns(q)) {
934 		add_rrset(q, answer, AUTHORITY_SECTION, q->zone->apex,
935 			  q->zone->ns_rrset);
936 	}
937 }
938 
939 
940 /*
941  * Answer with authoritative data.  If a wildcard is matched the owner
942  * name will be expanded to the domain name specified by
943  * DOMAIN_NUMBER.  DOMAIN_NUMBER 0 (zero) is reserved for the original
944  * query name.
945  *
946  * DNSSEC: Include the necessary NSEC records in case the request
947  * domain name does not exist and/or a wildcard match does not exist.
948  */
949 static void
950 answer_authoritative(struct nsd   *nsd,
951 		     struct query *q,
952 		     answer_type  *answer,
953 		     uint32_t      domain_number,
954 		     int           exact,
955 		     domain_type  *closest_match,
956 		     domain_type  *closest_encloser,
957 		     const dname_type *qname)
958 {
959 	domain_type *match;
960 	domain_type *original = closest_match;
961 	rrset_type *rrset;
962 
963 #ifdef NSEC3
964 	if(exact && domain_has_only_NSEC3(closest_match, q->zone)) {
965 		exact = 0; /* pretend it does not exist */
966 		if(closest_encloser->parent)
967 			closest_encloser = closest_encloser->parent;
968 	}
969 #endif /* NSEC3 */
970 
971 	if (exact) {
972 		match = closest_match;
973 	} else if ((rrset=domain_find_rrset(closest_encloser, q->zone, TYPE_DNAME))) {
974 		/* process DNAME */
975 		const dname_type* name = qname;
976 		domain_type *dest = rdata_atom_domain(rrset->rrs[0].rdatas[0]);
977 		int added;
978 		assert(rrset->rr_count > 0);
979 		if(domain_number != 0) /* we followed CNAMEs or DNAMEs */
980 			name = domain_dname(closest_match);
981 		DEBUG(DEBUG_QUERY,2, (LOG_INFO, "expanding DNAME for q=%s", dname_to_string(name, NULL)));
982 		DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->src is %s",
983 			dname_to_string(domain_dname(closest_encloser), NULL)));
984 		DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->dest is %s",
985 			dname_to_string(domain_dname(dest), NULL)));
986 		/* if the DNAME set is not added we have a loop, do not follow */
987 		added = add_rrset(q, answer, ANSWER_SECTION, closest_encloser, rrset);
988 		if(added) {
989 			domain_type* src = closest_encloser;
990 			const dname_type* newname = dname_replace(q->region, name,
991 				domain_dname(src), domain_dname(dest));
992 			uint32_t newnum = 0;
993 			zone_type* origzone = q->zone;
994 			++q->cname_count;
995 			if(!newname) { /* newname too long */
996 				RCODE_SET(q->packet, RCODE_YXDOMAIN);
997 				return;
998 			}
999 			DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->result is %s", dname_to_string(newname, NULL)));
1000 			/* follow the DNAME */
1001 			exact = namedb_lookup(nsd->db, newname, &closest_match, &closest_encloser);
1002 			/* synthesize CNAME record */
1003 			newnum = query_synthesize_cname(q, answer, name, newname,
1004 				src, closest_encloser, &closest_match);
1005 			if(!newnum) {
1006 				/* could not synthesize the CNAME. */
1007 				/* return previous CNAMEs to make resolver recurse for us */
1008 				return;
1009 			}
1010 
1011 			while (closest_encloser && !closest_encloser->is_existing)
1012 				closest_encloser = closest_encloser->parent;
1013 			answer_lookup_zone(nsd, q, answer, newnum,
1014 				closest_match == closest_encloser,
1015 				closest_match, closest_encloser, newname);
1016 			q->zone = origzone;
1017 		}
1018 		if(!added)  /* log the error so operator can find looping recursors */
1019 			log_msg(LOG_INFO, "DNAME processing stopped due to loop, qname %s",
1020 				dname_to_string(q->qname, NULL));
1021 		return;
1022 	} else if (domain_wildcard_child(closest_encloser)) {
1023 		/* Generate the domain from the wildcard.  */
1024 		domain_type *wildcard_child = domain_wildcard_child(closest_encloser);
1025 
1026 		match = (domain_type *) region_alloc(q->region,
1027 						     sizeof(domain_type));
1028 		memcpy(&match->node, &wildcard_child->node, sizeof(rbnode_t));
1029 		match->parent = closest_encloser;
1030 		match->wildcard_child_closest_match = match;
1031 		match->number = domain_number;
1032 		match->rrsets = wildcard_child->rrsets;
1033 		match->is_existing = wildcard_child->is_existing;
1034 #ifdef NSEC3
1035 		match->nsec3_is_exact = wildcard_child->nsec3_is_exact;
1036 		match->nsec3_cover = wildcard_child->nsec3_cover;
1037 		match->nsec3_wcard_child_cover = wildcard_child->nsec3_wcard_child_cover;
1038 		match->nsec3_ds_parent_is_exact = wildcard_child->nsec3_ds_parent_is_exact;
1039 		match->nsec3_ds_parent_cover = wildcard_child->nsec3_ds_parent_cover;
1040 
1041 		if (q->edns.dnssec_ok && q->zone->nsec3_soa_rr) {
1042 			/* Only add nsec3 wildcard data when do bit is set */
1043 			nsec3_answer_wildcard(q, answer, wildcard_child, nsd->db, qname);
1044 		}
1045 #endif
1046 
1047 		/*
1048 		 * Remember the original domain in case a Wildcard No
1049 		 * Data (3.1.3.4) response needs to be generated.  In
1050 		 * this particular case the wildcard IS NOT
1051 		 * expanded.
1052 		 */
1053 		original = wildcard_child;
1054 	} else {
1055 		match = NULL;
1056 	}
1057 
1058 	/* Authorative zone.  */
1059 #ifdef NSEC3
1060 	if (q->edns.dnssec_ok && q->zone->nsec3_soa_rr) {
1061 		nsec3_answer_authoritative(&match, q, answer,
1062 			closest_encloser, nsd->db, qname);
1063 	} else
1064 #endif
1065 	if (q->edns.dnssec_ok && zone_is_secure(q->zone)) {
1066 		if (match != closest_encloser) {
1067 			domain_type *nsec_domain;
1068 			rrset_type *nsec_rrset;
1069 
1070 			/*
1071 			 * No match found or generated from wildcard,
1072 			 * include NSEC record.
1073 			 */
1074 			nsec_domain = find_covering_nsec(closest_match, q->zone, &nsec_rrset);
1075 			if (nsec_domain) {
1076 				add_rrset(q, answer, AUTHORITY_SECTION, nsec_domain, nsec_rrset);
1077 			}
1078 		}
1079 		if (!match) {
1080 			domain_type *nsec_domain;
1081 			rrset_type *nsec_rrset;
1082 
1083 			/*
1084 			 * No match and no wildcard.  Include NSEC
1085 			 * proving there is no wildcard.
1086 			 */
1087 			nsec_domain = find_covering_nsec(closest_encloser->wildcard_child_closest_match, q->zone, &nsec_rrset);
1088 			if (nsec_domain) {
1089 				add_rrset(q, answer, AUTHORITY_SECTION, nsec_domain, nsec_rrset);
1090 			}
1091 		}
1092 	}
1093 
1094 #ifdef NSEC3
1095 	if (RCODE(q->packet)!=RCODE_OK) {
1096 		return; /* nsec3 collision failure */
1097 	}
1098 #endif
1099 	if (match) {
1100 		answer_domain(nsd, q, answer, match, original);
1101 	} else {
1102 		answer_nxdomain(q, answer);
1103 	}
1104 }
1105 
1106 /*
1107  * qname may be different after CNAMEs have been followed from query->qname.
1108  */
1109 static void
1110 answer_lookup_zone(struct nsd *nsd, struct query *q, answer_type *answer,
1111 	uint32_t domain_number, int exact, domain_type *closest_match,
1112 	domain_type *closest_encloser, const dname_type *qname)
1113 {
1114 	q->zone = domain_find_zone(closest_encloser);
1115 	if (!q->zone) {
1116 		if(q->cname_count == 0)
1117 			RCODE_SET(q->packet, RCODE_SERVFAIL);
1118 		return;
1119 	}
1120 
1121 	/*
1122 	 * See RFC 4035 (DNSSEC protocol) section 3.1.4.1 Responding
1123 	 * to Queries for DS RRs.
1124 	 */
1125 	if (exact && q->qtype == TYPE_DS && closest_encloser == q->zone->apex) {
1126 		/*
1127 		 * Type DS query at a zone cut, use the responsible
1128 		 * parent zone to generate the answer if we are
1129 		 * authoritative for the parent zone.
1130 		 */
1131 		zone_type *zone = domain_find_parent_zone(q->zone);
1132 		if (zone)
1133 			q->zone = zone;
1134 	}
1135 
1136 	/* see if the zone has expired (for secondary zones) */
1137 	if(q->zone && q->zone->opts && zone_is_slave(q->zone->opts)
1138 		&& !q->zone->is_ok) {
1139 		if(q->cname_count == 0)
1140 			RCODE_SET(q->packet, RCODE_SERVFAIL);
1141 		return;
1142 	}
1143 
1144 	if (exact && q->qtype == TYPE_DS && closest_encloser == q->zone->apex) {
1145 		/*
1146 		 * Type DS query at the zone apex (and the server is
1147 		 * not authoratitive for the parent zone).
1148 		 */
1149 		if (q->qclass == CLASS_ANY) {
1150 			AA_CLR(q->packet);
1151 		} else {
1152 			AA_SET(q->packet);
1153 		}
1154 		answer_nodata(q, answer, closest_encloser);
1155 	} else {
1156 		q->delegation_domain = domain_find_ns_rrsets(
1157 			closest_encloser, q->zone, &q->delegation_rrset);
1158 
1159 		if (!q->delegation_domain
1160 		    || (exact && q->qtype == TYPE_DS && closest_encloser == q->delegation_domain))
1161 		{
1162 			if (q->qclass == CLASS_ANY) {
1163 				AA_CLR(q->packet);
1164 			} else {
1165 				AA_SET(q->packet);
1166 			}
1167 			answer_authoritative(nsd, q, answer, domain_number, exact,
1168 					     closest_match, closest_encloser, qname);
1169 		}
1170 		else {
1171 			answer_delegation(q, answer);
1172 		}
1173 	}
1174 }
1175 
1176 static void
1177 answer_query(struct nsd *nsd, struct query *q)
1178 {
1179 	domain_type *closest_match;
1180 	domain_type *closest_encloser;
1181 	int exact;
1182 	uint16_t offset;
1183 	answer_type answer;
1184 
1185 	answer_init(&answer);
1186 
1187 	exact = namedb_lookup(nsd->db, q->qname, &closest_match, &closest_encloser);
1188 	if (!closest_encloser->is_existing) {
1189 		exact = 0;
1190 		while (closest_encloser != NULL && !closest_encloser->is_existing)
1191 			closest_encloser = closest_encloser->parent;
1192 	}
1193 	if(!closest_encloser) {
1194 		RCODE_SET(q->packet, RCODE_SERVFAIL);
1195 		return;
1196 	}
1197 
1198 	q->domain = closest_encloser;
1199 	answer_lookup_zone(nsd, q, &answer, 0, exact, closest_match,
1200 		closest_encloser, q->qname);
1201 
1202 	offset = dname_label_offsets(q->qname)[domain_dname(closest_encloser)->label_count - 1] + QHEADERSZ;
1203 	query_add_compression_domain(q, closest_encloser, offset);
1204 	encode_answer(q, &answer);
1205 	query_clear_compression_tables(q);
1206 }
1207 
1208 void
1209 query_prepare_response(query_type *q)
1210 {
1211 	uint16_t flags;
1212 
1213 	/*
1214 	 * Preserve the data up-to the current packet's limit.
1215 	 */
1216 	buffer_set_position(q->packet, buffer_limit(q->packet));
1217 	buffer_set_limit(q->packet, buffer_capacity(q->packet));
1218 
1219 	/*
1220 	 * Reserve space for the EDNS records if required.
1221 	 */
1222 	q->reserved_space = edns_reserved_space(&q->edns);
1223 	q->reserved_space += tsig_reserved_space(&q->tsig);
1224 
1225 	/* Update the flags.  */
1226 	flags = FLAGS(q->packet);
1227 	flags &= 0x0100U;	/* Preserve the RD flag.  */
1228 				/* CD flag must be cleared for auth answers */
1229 	flags |= 0x8000U;	/* Set the QR flag.  */
1230 	FLAGS_SET(q->packet, flags);
1231 }
1232 
1233 /*
1234  * Processes the query.
1235  *
1236  */
1237 query_state_type
1238 query_process(query_type *q, nsd_type *nsd)
1239 {
1240 	/* The query... */
1241 	nsd_rc_type rc;
1242 	query_state_type query_state;
1243 	uint16_t arcount;
1244 
1245 	/* Sanity checks */
1246 	if (buffer_limit(q->packet) < QHEADERSZ) {
1247 		/* packet too small to contain DNS header.
1248 		Now packet investigation macros will work without problems. */
1249 		return QUERY_DISCARDED;
1250 	}
1251 	if (QR(q->packet)) {
1252 		/* Not a query? Drop it on the floor. */
1253 		return QUERY_DISCARDED;
1254 	}
1255 
1256 	if(!process_query_section(q)) {
1257 		return query_formerr(q);
1258 	}
1259 
1260 	/* Update statistics.  */
1261 	STATUP2(nsd, opcode, q->opcode);
1262 	STATUP2(nsd, qtype, q->qtype);
1263 	STATUP2(nsd, qclass, q->qclass);
1264 
1265 	if (q->opcode != OPCODE_QUERY) {
1266 		if (q->opcode == OPCODE_NOTIFY) {
1267 			return answer_notify(nsd, q);
1268 		} else {
1269 			return query_error(q, NSD_RC_IMPL);
1270 		}
1271 	}
1272 
1273 	/* Dont bother to answer more than one question at once... */
1274 	if (QDCOUNT(q->packet) != 1 || TC(q->packet)) {
1275 		FLAGS_SET(q->packet, 0);
1276 		return query_formerr(q);
1277 	}
1278 
1279 	/* Dont allow any records in the answer or authority section...
1280 	   except for IXFR queries. */
1281 	if (ANCOUNT(q->packet) != 0 ||
1282 		(q->qtype!=TYPE_IXFR && NSCOUNT(q->packet) != 0)) {
1283 		return query_formerr(q);
1284 	}
1285 	if(q->qtype==TYPE_IXFR && NSCOUNT(q->packet) > 0) {
1286 		int i; /* skip ixfr soa information data here */
1287 		for(i=0; i< NSCOUNT(q->packet); i++)
1288 			if(!packet_skip_rr(q->packet, 0))
1289 				return query_formerr(q);
1290 	}
1291 
1292 	arcount = ARCOUNT(q->packet);
1293 	if (arcount > 0) {
1294 		/* see if tsig is before edns record */
1295 		if (!tsig_parse_rr(&q->tsig, q->packet))
1296 			return query_formerr(q);
1297 		if(q->tsig.status != TSIG_NOT_PRESENT)
1298 			--arcount;
1299 	}
1300 	if (arcount > 0) {
1301 		if (edns_parse_record(&q->edns, q->packet))
1302 			--arcount;
1303 	}
1304 	if (arcount > 0 && q->tsig.status == TSIG_NOT_PRESENT) {
1305 		/* see if tsig is after the edns record */
1306 		if (!tsig_parse_rr(&q->tsig, q->packet))
1307 			return query_formerr(q);
1308 		if(q->tsig.status != TSIG_NOT_PRESENT)
1309 			--arcount;
1310 	}
1311 	if (arcount > 0) {
1312 		return query_formerr(q);
1313 	}
1314 
1315 	/* Do we have any trailing garbage? */
1316 #ifdef	STRICT_MESSAGE_PARSE
1317 	if (buffer_remaining(q->packet) > 0) {
1318 		/* If we're strict.... */
1319 		return query_formerr(q);
1320 	}
1321 #endif
1322 	/* Remove trailing garbage.  */
1323 	buffer_set_limit(q->packet, buffer_position(q->packet));
1324 
1325 	rc = process_tsig(q);
1326 	if (rc != NSD_RC_OK) {
1327 		return query_error(q, rc);
1328 	}
1329 	rc = process_edns(nsd, q);
1330 	if (rc != NSD_RC_OK) {
1331 		/* We should not return FORMERR, but BADVERS (=16).
1332 		 * BADVERS is created with Ext. RCODE, followed by RCODE.
1333 		 * Ext. RCODE is set to 1, RCODE must be 0 (getting 0x10 = 16).
1334 		 * Thus RCODE = NOERROR = NSD_RC_OK. */
1335 		return query_error(q, NSD_RC_OK);
1336 	}
1337 
1338 	query_prepare_response(q);
1339 
1340 	if (q->qclass != CLASS_IN && q->qclass != CLASS_ANY) {
1341 		if (q->qclass == CLASS_CH) {
1342 			return answer_chaos(nsd, q);
1343 		} else {
1344 			return query_error(q, NSD_RC_REFUSE);
1345 		}
1346 	}
1347 
1348 	query_state = answer_axfr_ixfr(nsd, q);
1349 	if (query_state == QUERY_PROCESSED || query_state == QUERY_IN_AXFR) {
1350 		return query_state;
1351 	}
1352 
1353 	answer_query(nsd, q);
1354 
1355 	return QUERY_PROCESSED;
1356 }
1357 
1358 void
1359 query_add_optional(query_type *q, nsd_type *nsd)
1360 {
1361 	struct edns_data *edns = &nsd->edns_ipv4;
1362 #if defined(INET6)
1363 	if (q->addr.ss_family == AF_INET6) {
1364 		edns = &nsd->edns_ipv6;
1365 	}
1366 #endif
1367 	switch (q->edns.status) {
1368 	case EDNS_NOT_PRESENT:
1369 		break;
1370 	case EDNS_OK:
1371 		buffer_write(q->packet, edns->ok, OPT_LEN);
1372 		if (nsd->nsid_len > 0 && q->edns.nsid == 1 &&
1373 				!query_overflow_nsid(q, nsd->nsid_len)) {
1374 			/* rdata length */
1375 			buffer_write(q->packet, edns->rdata_nsid, OPT_RDATA);
1376 			/* nsid opt header */
1377 			buffer_write(q->packet, edns->nsid, OPT_HDR);
1378 			/* nsid payload */
1379 			buffer_write(q->packet, nsd->nsid, nsd->nsid_len);
1380 		}  else {
1381 			/* fill with NULLs */
1382 			buffer_write(q->packet, edns->rdata_none, OPT_RDATA);
1383 		}
1384 		ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1);
1385 		STATUP(nsd, edns);
1386 		break;
1387 	case EDNS_ERROR:
1388 		buffer_write(q->packet, edns->error, OPT_LEN);
1389 		buffer_write(q->packet, edns->rdata_none, OPT_RDATA);
1390 		ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1);
1391 		STATUP(nsd, ednserr);
1392 		break;
1393 	}
1394 
1395 	if (q->tsig.status != TSIG_NOT_PRESENT) {
1396 		if (q->tsig.status == TSIG_ERROR ||
1397 			q->tsig.error_code != TSIG_ERROR_NOERROR) {
1398 			tsig_error_reply(&q->tsig);
1399 			tsig_append_rr(&q->tsig, q->packet);
1400 			ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1);
1401 		} else if(q->tsig.status == TSIG_OK &&
1402 			q->tsig.error_code == TSIG_ERROR_NOERROR)
1403 		{
1404 			if(q->tsig_prepare_it)
1405 				tsig_prepare(&q->tsig);
1406 			if(q->tsig_update_it)
1407 				tsig_update(&q->tsig, q->packet, buffer_position(q->packet));
1408 			if(q->tsig_sign_it) {
1409 				tsig_sign(&q->tsig);
1410 				tsig_append_rr(&q->tsig, q->packet);
1411 				ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1);
1412 			}
1413 		}
1414 	}
1415 }
1416