xref: /openbsd-src/usr.sbin/unbound/iterator/iterator.c (revision d59bb9942320b767f2a19aaa7690c8c6e30b724c)
1 /*
2  * iterator/iterator.c - iterative resolver DNS query response module
3  *
4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * This file contains a module that performs recusive iterative DNS query
40  * processing.
41  */
42 
43 #include "config.h"
44 #include "iterator/iterator.h"
45 #include "iterator/iter_utils.h"
46 #include "iterator/iter_hints.h"
47 #include "iterator/iter_fwd.h"
48 #include "iterator/iter_donotq.h"
49 #include "iterator/iter_delegpt.h"
50 #include "iterator/iter_resptype.h"
51 #include "iterator/iter_scrub.h"
52 #include "iterator/iter_priv.h"
53 #include "validator/val_neg.h"
54 #include "services/cache/dns.h"
55 #include "services/cache/infra.h"
56 #include "util/module.h"
57 #include "util/netevent.h"
58 #include "util/net_help.h"
59 #include "util/regional.h"
60 #include "util/data/dname.h"
61 #include "util/data/msgencode.h"
62 #include "util/fptr_wlist.h"
63 #include "util/config_file.h"
64 #include "util/random.h"
65 #include "sldns/rrdef.h"
66 #include "sldns/wire2str.h"
67 #include "sldns/str2wire.h"
68 #include "sldns/parseutil.h"
69 #include "sldns/sbuffer.h"
70 
71 int
72 iter_init(struct module_env* env, int id)
73 {
74 	struct iter_env* iter_env = (struct iter_env*)calloc(1,
75 		sizeof(struct iter_env));
76 	if(!iter_env) {
77 		log_err("malloc failure");
78 		return 0;
79 	}
80 	env->modinfo[id] = (void*)iter_env;
81 	if(!iter_apply_cfg(iter_env, env->cfg)) {
82 		log_err("iterator: could not apply configuration settings.");
83 		return 0;
84 	}
85 
86 	return 1;
87 }
88 
89 /** delete caps_whitelist element */
90 static void
91 caps_free(struct rbnode_type* n, void* ATTR_UNUSED(d))
92 {
93 	if(n) {
94 		free(((struct name_tree_node*)n)->name);
95 		free(n);
96 	}
97 }
98 
99 void
100 iter_deinit(struct module_env* env, int id)
101 {
102 	struct iter_env* iter_env;
103 	if(!env || !env->modinfo[id])
104 		return;
105 	iter_env = (struct iter_env*)env->modinfo[id];
106 	free(iter_env->target_fetch_policy);
107 	priv_delete(iter_env->priv);
108 	donotq_delete(iter_env->donotq);
109 	if(iter_env->caps_white) {
110 		traverse_postorder(iter_env->caps_white, caps_free, NULL);
111 		free(iter_env->caps_white);
112 	}
113 	free(iter_env);
114 	env->modinfo[id] = NULL;
115 }
116 
117 /** new query for iterator */
118 static int
119 iter_new(struct module_qstate* qstate, int id)
120 {
121 	struct iter_qstate* iq = (struct iter_qstate*)regional_alloc(
122 		qstate->region, sizeof(struct iter_qstate));
123 	qstate->minfo[id] = iq;
124 	if(!iq)
125 		return 0;
126 	memset(iq, 0, sizeof(*iq));
127 	iq->state = INIT_REQUEST_STATE;
128 	iq->final_state = FINISHED_STATE;
129 	iq->an_prepend_list = NULL;
130 	iq->an_prepend_last = NULL;
131 	iq->ns_prepend_list = NULL;
132 	iq->ns_prepend_last = NULL;
133 	iq->dp = NULL;
134 	iq->depth = 0;
135 	iq->num_target_queries = 0;
136 	iq->num_current_queries = 0;
137 	iq->query_restart_count = 0;
138 	iq->referral_count = 0;
139 	iq->sent_count = 0;
140 	iq->ratelimit_ok = 0;
141 	iq->target_count = NULL;
142 	iq->wait_priming_stub = 0;
143 	iq->refetch_glue = 0;
144 	iq->dnssec_expected = 0;
145 	iq->dnssec_lame_query = 0;
146 	iq->chase_flags = qstate->query_flags;
147 	/* Start with the (current) qname. */
148 	iq->qchase = qstate->qinfo;
149 	outbound_list_init(&iq->outlist);
150 	iq->minimise_count = 0;
151 	iq->minimise_timeout_count = 0;
152 	if (qstate->env->cfg->qname_minimisation)
153 		iq->minimisation_state = INIT_MINIMISE_STATE;
154 	else
155 		iq->minimisation_state = DONOT_MINIMISE_STATE;
156 
157 	memset(&iq->qinfo_out, 0, sizeof(struct query_info));
158 	return 1;
159 }
160 
161 /**
162  * Transition to the next state. This can be used to advance a currently
163  * processing event. It cannot be used to reactivate a forEvent.
164  *
165  * @param iq: iterator query state
166  * @param nextstate The state to transition to.
167  * @return true. This is so this can be called as the return value for the
168  *         actual process*State() methods. (Transitioning to the next state
169  *         implies further processing).
170  */
171 static int
172 next_state(struct iter_qstate* iq, enum iter_state nextstate)
173 {
174 	/* If transitioning to a "response" state, make sure that there is a
175 	 * response */
176 	if(iter_state_is_responsestate(nextstate)) {
177 		if(iq->response == NULL) {
178 			log_err("transitioning to response state sans "
179 				"response.");
180 		}
181 	}
182 	iq->state = nextstate;
183 	return 1;
184 }
185 
186 /**
187  * Transition an event to its final state. Final states always either return
188  * a result up the module chain, or reactivate a dependent event. Which
189  * final state to transition to is set in the module state for the event when
190  * it was created, and depends on the original purpose of the event.
191  *
192  * The response is stored in the qstate->buf buffer.
193  *
194  * @param iq: iterator query state
195  * @return false. This is so this method can be used as the return value for
196  *         the processState methods. (Transitioning to the final state
197  */
198 static int
199 final_state(struct iter_qstate* iq)
200 {
201 	return next_state(iq, iq->final_state);
202 }
203 
204 /**
205  * Callback routine to handle errors in parent query states
206  * @param qstate: query state that failed.
207  * @param id: module id.
208  * @param super: super state.
209  */
210 static void
211 error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
212 {
213 	struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id];
214 
215 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
216 		qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA) {
217 		/* mark address as failed. */
218 		struct delegpt_ns* dpns = NULL;
219 		super_iq->num_target_queries--;
220 		if(super_iq->dp)
221 			dpns = delegpt_find_ns(super_iq->dp,
222 				qstate->qinfo.qname, qstate->qinfo.qname_len);
223 		if(!dpns) {
224 			/* not interested */
225 			verbose(VERB_ALGO, "subq error, but not interested");
226 			log_query_info(VERB_ALGO, "superq", &super->qinfo);
227 			if(super_iq->dp)
228 				delegpt_log(VERB_ALGO, super_iq->dp);
229 			log_assert(0);
230 			return;
231 		} else {
232 			/* see if the failure did get (parent-lame) info */
233 			if(!cache_fill_missing(super->env, super_iq->qchase.qclass,
234 				super->region, super_iq->dp))
235 				log_err("out of memory adding missing");
236 		}
237 		dpns->resolved = 1; /* mark as failed */
238 	}
239 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS) {
240 		/* prime failed to get delegation */
241 		super_iq->dp = NULL;
242 	}
243 	/* evaluate targets again */
244 	super_iq->state = QUERYTARGETS_STATE;
245 	/* super becomes runnable, and will process this change */
246 }
247 
248 /**
249  * Return an error to the client
250  * @param qstate: our query state
251  * @param id: module id
252  * @param rcode: error code (DNS errcode).
253  * @return: 0 for use by caller, to make notation easy, like:
254  * 	return error_response(..).
255  */
256 static int
257 error_response(struct module_qstate* qstate, int id, int rcode)
258 {
259 	verbose(VERB_QUERY, "return error response %s",
260 		sldns_lookup_by_id(sldns_rcodes, rcode)?
261 		sldns_lookup_by_id(sldns_rcodes, rcode)->name:"??");
262 	qstate->return_rcode = rcode;
263 	qstate->return_msg = NULL;
264 	qstate->ext_state[id] = module_finished;
265 	return 0;
266 }
267 
268 /**
269  * Return an error to the client and cache the error code in the
270  * message cache (so per qname, qtype, qclass).
271  * @param qstate: our query state
272  * @param id: module id
273  * @param rcode: error code (DNS errcode).
274  * @return: 0 for use by caller, to make notation easy, like:
275  * 	return error_response(..).
276  */
277 static int
278 error_response_cache(struct module_qstate* qstate, int id, int rcode)
279 {
280 	if(!qstate->no_cache_store) {
281 		/* store in cache */
282 		struct reply_info err;
283 		if(qstate->prefetch_leeway > NORR_TTL) {
284 			verbose(VERB_ALGO, "error response for prefetch in cache");
285 			/* attempt to adjust the cache entry prefetch */
286 			if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo,
287 				NORR_TTL, qstate->query_flags))
288 				return error_response(qstate, id, rcode);
289 			/* if that fails (not in cache), fall through to store err */
290 		}
291 		memset(&err, 0, sizeof(err));
292 		err.flags = (uint16_t)(BIT_QR | BIT_RA);
293 		FLAGS_SET_RCODE(err.flags, rcode);
294 		err.qdcount = 1;
295 		err.ttl = NORR_TTL;
296 		err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl);
297 		/* do not waste time trying to validate this servfail */
298 		err.security = sec_status_indeterminate;
299 		verbose(VERB_ALGO, "store error response in message cache");
300 		iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL,
301 			qstate->query_flags);
302 	}
303 	return error_response(qstate, id, rcode);
304 }
305 
306 /** check if prepend item is duplicate item */
307 static int
308 prepend_is_duplicate(struct ub_packed_rrset_key** sets, size_t to,
309 	struct ub_packed_rrset_key* dup)
310 {
311 	size_t i;
312 	for(i=0; i<to; i++) {
313 		if(sets[i]->rk.type == dup->rk.type &&
314 			sets[i]->rk.rrset_class == dup->rk.rrset_class &&
315 			sets[i]->rk.dname_len == dup->rk.dname_len &&
316 			query_dname_compare(sets[i]->rk.dname, dup->rk.dname)
317 			== 0)
318 			return 1;
319 	}
320 	return 0;
321 }
322 
323 /** prepend the prepend list in the answer and authority section of dns_msg */
324 static int
325 iter_prepend(struct iter_qstate* iq, struct dns_msg* msg,
326 	struct regional* region)
327 {
328 	struct iter_prep_list* p;
329 	struct ub_packed_rrset_key** sets;
330 	size_t num_an = 0, num_ns = 0;;
331 	for(p = iq->an_prepend_list; p; p = p->next)
332 		num_an++;
333 	for(p = iq->ns_prepend_list; p; p = p->next)
334 		num_ns++;
335 	if(num_an + num_ns == 0)
336 		return 1;
337 	verbose(VERB_ALGO, "prepending %d rrsets", (int)num_an + (int)num_ns);
338 	if(num_an > RR_COUNT_MAX || num_ns > RR_COUNT_MAX ||
339 		msg->rep->rrset_count > RR_COUNT_MAX) return 0; /* overflow */
340 	sets = regional_alloc(region, (num_an+num_ns+msg->rep->rrset_count) *
341 		sizeof(struct ub_packed_rrset_key*));
342 	if(!sets)
343 		return 0;
344 	/* ANSWER section */
345 	num_an = 0;
346 	for(p = iq->an_prepend_list; p; p = p->next) {
347 		sets[num_an++] = p->rrset;
348 	}
349 	memcpy(sets+num_an, msg->rep->rrsets, msg->rep->an_numrrsets *
350 		sizeof(struct ub_packed_rrset_key*));
351 	/* AUTH section */
352 	num_ns = 0;
353 	for(p = iq->ns_prepend_list; p; p = p->next) {
354 		if(prepend_is_duplicate(sets+msg->rep->an_numrrsets+num_an,
355 			num_ns, p->rrset) || prepend_is_duplicate(
356 			msg->rep->rrsets+msg->rep->an_numrrsets,
357 			msg->rep->ns_numrrsets, p->rrset))
358 			continue;
359 		sets[msg->rep->an_numrrsets + num_an + num_ns++] = p->rrset;
360 	}
361 	memcpy(sets + num_an + msg->rep->an_numrrsets + num_ns,
362 		msg->rep->rrsets + msg->rep->an_numrrsets,
363 		(msg->rep->ns_numrrsets + msg->rep->ar_numrrsets) *
364 		sizeof(struct ub_packed_rrset_key*));
365 
366 	/* NXDOMAIN rcode can stay if we prepended DNAME/CNAMEs, because
367 	 * this is what recursors should give. */
368 	msg->rep->rrset_count += num_an + num_ns;
369 	msg->rep->an_numrrsets += num_an;
370 	msg->rep->ns_numrrsets += num_ns;
371 	msg->rep->rrsets = sets;
372 	return 1;
373 }
374 
375 /**
376  * Add rrset to ANSWER prepend list
377  * @param qstate: query state.
378  * @param iq: iterator query state.
379  * @param rrset: rrset to add.
380  * @return false on failure (malloc).
381  */
382 static int
383 iter_add_prepend_answer(struct module_qstate* qstate, struct iter_qstate* iq,
384 	struct ub_packed_rrset_key* rrset)
385 {
386 	struct iter_prep_list* p = (struct iter_prep_list*)regional_alloc(
387 		qstate->region, sizeof(struct iter_prep_list));
388 	if(!p)
389 		return 0;
390 	p->rrset = rrset;
391 	p->next = NULL;
392 	/* add at end */
393 	if(iq->an_prepend_last)
394 		iq->an_prepend_last->next = p;
395 	else	iq->an_prepend_list = p;
396 	iq->an_prepend_last = p;
397 	return 1;
398 }
399 
400 /**
401  * Add rrset to AUTHORITY prepend list
402  * @param qstate: query state.
403  * @param iq: iterator query state.
404  * @param rrset: rrset to add.
405  * @return false on failure (malloc).
406  */
407 static int
408 iter_add_prepend_auth(struct module_qstate* qstate, struct iter_qstate* iq,
409 	struct ub_packed_rrset_key* rrset)
410 {
411 	struct iter_prep_list* p = (struct iter_prep_list*)regional_alloc(
412 		qstate->region, sizeof(struct iter_prep_list));
413 	if(!p)
414 		return 0;
415 	p->rrset = rrset;
416 	p->next = NULL;
417 	/* add at end */
418 	if(iq->ns_prepend_last)
419 		iq->ns_prepend_last->next = p;
420 	else	iq->ns_prepend_list = p;
421 	iq->ns_prepend_last = p;
422 	return 1;
423 }
424 
425 /**
426  * Given a CNAME response (defined as a response containing a CNAME or DNAME
427  * that does not answer the request), process the response, modifying the
428  * state as necessary. This follows the CNAME/DNAME chain and returns the
429  * final query name.
430  *
431  * sets the new query name, after following the CNAME/DNAME chain.
432  * @param qstate: query state.
433  * @param iq: iterator query state.
434  * @param msg: the response.
435  * @param mname: returned target new query name.
436  * @param mname_len: length of mname.
437  * @return false on (malloc) error.
438  */
439 static int
440 handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq,
441         struct dns_msg* msg, uint8_t** mname, size_t* mname_len)
442 {
443 	size_t i;
444 	/* Start with the (current) qname. */
445 	*mname = iq->qchase.qname;
446 	*mname_len = iq->qchase.qname_len;
447 
448 	/* Iterate over the ANSWER rrsets in order, looking for CNAMEs and
449 	 * DNAMES. */
450 	for(i=0; i<msg->rep->an_numrrsets; i++) {
451 		struct ub_packed_rrset_key* r = msg->rep->rrsets[i];
452 		/* If there is a (relevant) DNAME, add it to the list.
453 		 * We always expect there to be CNAME that was generated
454 		 * by this DNAME following, so we don't process the DNAME
455 		 * directly.  */
456 		if(ntohs(r->rk.type) == LDNS_RR_TYPE_DNAME &&
457 			dname_strict_subdomain_c(*mname, r->rk.dname)) {
458 			if(!iter_add_prepend_answer(qstate, iq, r))
459 				return 0;
460 			continue;
461 		}
462 
463 		if(ntohs(r->rk.type) == LDNS_RR_TYPE_CNAME &&
464 			query_dname_compare(*mname, r->rk.dname) == 0) {
465 			/* Add this relevant CNAME rrset to the prepend list.*/
466 			if(!iter_add_prepend_answer(qstate, iq, r))
467 				return 0;
468 			get_cname_target(r, mname, mname_len);
469 		}
470 
471 		/* Other rrsets in the section are ignored. */
472 	}
473 	/* add authority rrsets to authority prepend, for wildcarded CNAMEs */
474 	for(i=msg->rep->an_numrrsets; i<msg->rep->an_numrrsets +
475 		msg->rep->ns_numrrsets; i++) {
476 		struct ub_packed_rrset_key* r = msg->rep->rrsets[i];
477 		/* only add NSEC/NSEC3, as they may be needed for validation */
478 		if(ntohs(r->rk.type) == LDNS_RR_TYPE_NSEC ||
479 			ntohs(r->rk.type) == LDNS_RR_TYPE_NSEC3) {
480 			if(!iter_add_prepend_auth(qstate, iq, r))
481 				return 0;
482 		}
483 	}
484 	return 1;
485 }
486 
487 /** see if target name is caps-for-id whitelisted */
488 static int
489 is_caps_whitelisted(struct iter_env* ie, struct iter_qstate* iq)
490 {
491 	if(!ie->caps_white) return 0; /* no whitelist, or no capsforid */
492 	return name_tree_lookup(ie->caps_white, iq->qchase.qname,
493 		iq->qchase.qname_len, dname_count_labels(iq->qchase.qname),
494 		iq->qchase.qclass) != NULL;
495 }
496 
497 /** create target count structure for this query */
498 static void
499 target_count_create(struct iter_qstate* iq)
500 {
501 	if(!iq->target_count) {
502 		iq->target_count = (int*)calloc(2, sizeof(int));
503 		/* if calloc fails we simply do not track this number */
504 		if(iq->target_count)
505 			iq->target_count[0] = 1;
506 	}
507 }
508 
509 static void
510 target_count_increase(struct iter_qstate* iq, int num)
511 {
512 	target_count_create(iq);
513 	if(iq->target_count)
514 		iq->target_count[1] += num;
515 }
516 
517 /**
518  * Generate a subrequest.
519  * Generate a local request event. Local events are tied to this module, and
520  * have a corresponding (first tier) event that is waiting for this event to
521  * resolve to continue.
522  *
523  * @param qname The query name for this request.
524  * @param qnamelen length of qname
525  * @param qtype The query type for this request.
526  * @param qclass The query class for this request.
527  * @param qstate The event that is generating this event.
528  * @param id: module id.
529  * @param iq: The iterator state that is generating this event.
530  * @param initial_state The initial response state (normally this
531  *          is QUERY_RESP_STATE, unless it is known that the request won't
532  *          need iterative processing
533  * @param finalstate The final state for the response to this request.
534  * @param subq_ret: if newly allocated, the subquerystate, or NULL if it does
535  * 	not need initialisation.
536  * @param v: if true, validation is done on the subquery.
537  * @return false on error (malloc).
538  */
539 static int
540 generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
541 	uint16_t qclass, struct module_qstate* qstate, int id,
542 	struct iter_qstate* iq, enum iter_state initial_state,
543 	enum iter_state finalstate, struct module_qstate** subq_ret, int v)
544 {
545 	struct module_qstate* subq = NULL;
546 	struct iter_qstate* subiq = NULL;
547 	uint16_t qflags = 0; /* OPCODE QUERY, no flags */
548 	struct query_info qinf;
549 	int prime = (finalstate == PRIME_RESP_STATE)?1:0;
550 	int valrec = 0;
551 	qinf.qname = qname;
552 	qinf.qname_len = qnamelen;
553 	qinf.qtype = qtype;
554 	qinf.qclass = qclass;
555 	qinf.local_alias = NULL;
556 
557 	/* RD should be set only when sending the query back through the INIT
558 	 * state. */
559 	if(initial_state == INIT_REQUEST_STATE)
560 		qflags |= BIT_RD;
561 	/* We set the CD flag so we can send this through the "head" of
562 	 * the resolution chain, which might have a validator. We are
563 	 * uninterested in validating things not on the direct resolution
564 	 * path.  */
565 	if(!v) {
566 		qflags |= BIT_CD;
567 		valrec = 1;
568 	}
569 
570 	/* attach subquery, lookup existing or make a new one */
571 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
572 	if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, valrec,
573 		&subq)) {
574 		return 0;
575 	}
576 	*subq_ret = subq;
577 	if(subq) {
578 		/* initialise the new subquery */
579 		subq->curmod = id;
580 		subq->ext_state[id] = module_state_initial;
581 		subq->minfo[id] = regional_alloc(subq->region,
582 			sizeof(struct iter_qstate));
583 		if(!subq->minfo[id]) {
584 			log_err("init subq: out of memory");
585 			fptr_ok(fptr_whitelist_modenv_kill_sub(
586 				qstate->env->kill_sub));
587 			(*qstate->env->kill_sub)(subq);
588 			return 0;
589 		}
590 		subiq = (struct iter_qstate*)subq->minfo[id];
591 		memset(subiq, 0, sizeof(*subiq));
592 		subiq->num_target_queries = 0;
593 		target_count_create(iq);
594 		subiq->target_count = iq->target_count;
595 		if(iq->target_count)
596 			iq->target_count[0] ++; /* extra reference */
597 		subiq->num_current_queries = 0;
598 		subiq->depth = iq->depth+1;
599 		outbound_list_init(&subiq->outlist);
600 		subiq->state = initial_state;
601 		subiq->final_state = finalstate;
602 		subiq->qchase = subq->qinfo;
603 		subiq->chase_flags = subq->query_flags;
604 		subiq->refetch_glue = 0;
605 		if(qstate->env->cfg->qname_minimisation)
606 			subiq->minimisation_state = INIT_MINIMISE_STATE;
607 		else
608 			subiq->minimisation_state = DONOT_MINIMISE_STATE;
609 		memset(&subiq->qinfo_out, 0, sizeof(struct query_info));
610 	}
611 	return 1;
612 }
613 
614 /**
615  * Generate and send a root priming request.
616  * @param qstate: the qtstate that triggered the need to prime.
617  * @param iq: iterator query state.
618  * @param id: module id.
619  * @param qclass: the class to prime.
620  * @return 0 on failure
621  */
622 static int
623 prime_root(struct module_qstate* qstate, struct iter_qstate* iq, int id,
624 	uint16_t qclass)
625 {
626 	struct delegpt* dp;
627 	struct module_qstate* subq;
628 	verbose(VERB_DETAIL, "priming . %s NS",
629 		sldns_lookup_by_id(sldns_rr_classes, (int)qclass)?
630 		sldns_lookup_by_id(sldns_rr_classes, (int)qclass)->name:"??");
631 	dp = hints_lookup_root(qstate->env->hints, qclass);
632 	if(!dp) {
633 		verbose(VERB_ALGO, "Cannot prime due to lack of hints");
634 		return 0;
635 	}
636 	/* Priming requests start at the QUERYTARGETS state, skipping
637 	 * the normal INIT state logic (which would cause an infloop). */
638 	if(!generate_sub_request((uint8_t*)"\000", 1, LDNS_RR_TYPE_NS,
639 		qclass, qstate, id, iq, QUERYTARGETS_STATE, PRIME_RESP_STATE,
640 		&subq, 0)) {
641 		verbose(VERB_ALGO, "could not prime root");
642 		return 0;
643 	}
644 	if(subq) {
645 		struct iter_qstate* subiq =
646 			(struct iter_qstate*)subq->minfo[id];
647 		/* Set the initial delegation point to the hint.
648 		 * copy dp, it is now part of the root prime query.
649 		 * dp was part of in the fixed hints structure. */
650 		subiq->dp = delegpt_copy(dp, subq->region);
651 		if(!subiq->dp) {
652 			log_err("out of memory priming root, copydp");
653 			fptr_ok(fptr_whitelist_modenv_kill_sub(
654 				qstate->env->kill_sub));
655 			(*qstate->env->kill_sub)(subq);
656 			return 0;
657 		}
658 		/* there should not be any target queries. */
659 		subiq->num_target_queries = 0;
660 		subiq->dnssec_expected = iter_indicates_dnssec(
661 			qstate->env, subiq->dp, NULL, subq->qinfo.qclass);
662 	}
663 
664 	/* this module stops, our submodule starts, and does the query. */
665 	qstate->ext_state[id] = module_wait_subquery;
666 	return 1;
667 }
668 
669 /**
670  * Generate and process a stub priming request. This method tests for the
671  * need to prime a stub zone, so it is safe to call for every request.
672  *
673  * @param qstate: the qtstate that triggered the need to prime.
674  * @param iq: iterator query state.
675  * @param id: module id.
676  * @param qname: request name.
677  * @param qclass: request class.
678  * @return true if a priming subrequest was made, false if not. The will only
679  *         issue a priming request if it detects an unprimed stub.
680  *         Uses value of 2 to signal during stub-prime in root-prime situation
681  *         that a noprime-stub is available and resolution can continue.
682  */
683 static int
684 prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, int id,
685 	uint8_t* qname, uint16_t qclass)
686 {
687 	/* Lookup the stub hint. This will return null if the stub doesn't
688 	 * need to be re-primed. */
689 	struct iter_hints_stub* stub;
690 	struct delegpt* stub_dp;
691 	struct module_qstate* subq;
692 
693 	if(!qname) return 0;
694 	stub = hints_lookup_stub(qstate->env->hints, qname, qclass, iq->dp);
695 	/* The stub (if there is one) does not need priming. */
696 	if(!stub)
697 		return 0;
698 	stub_dp = stub->dp;
699 
700 	/* is it a noprime stub (always use) */
701 	if(stub->noprime) {
702 		int r = 0;
703 		if(iq->dp == NULL) r = 2;
704 		/* copy the dp out of the fixed hints structure, so that
705 		 * it can be changed when servicing this query */
706 		iq->dp = delegpt_copy(stub_dp, qstate->region);
707 		if(!iq->dp) {
708 			log_err("out of memory priming stub");
709 			(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
710 			return 1; /* return 1 to make module stop, with error */
711 		}
712 		log_nametypeclass(VERB_DETAIL, "use stub", stub_dp->name,
713 			LDNS_RR_TYPE_NS, qclass);
714 		return r;
715 	}
716 
717 	/* Otherwise, we need to (re)prime the stub. */
718 	log_nametypeclass(VERB_DETAIL, "priming stub", stub_dp->name,
719 		LDNS_RR_TYPE_NS, qclass);
720 
721 	/* Stub priming events start at the QUERYTARGETS state to avoid the
722 	 * redundant INIT state processing. */
723 	if(!generate_sub_request(stub_dp->name, stub_dp->namelen,
724 		LDNS_RR_TYPE_NS, qclass, qstate, id, iq,
725 		QUERYTARGETS_STATE, PRIME_RESP_STATE, &subq, 0)) {
726 		verbose(VERB_ALGO, "could not prime stub");
727 		(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
728 		return 1; /* return 1 to make module stop, with error */
729 	}
730 	if(subq) {
731 		struct iter_qstate* subiq =
732 			(struct iter_qstate*)subq->minfo[id];
733 
734 		/* Set the initial delegation point to the hint. */
735 		/* make copy to avoid use of stub dp by different qs/threads */
736 		subiq->dp = delegpt_copy(stub_dp, subq->region);
737 		if(!subiq->dp) {
738 			log_err("out of memory priming stub, copydp");
739 			fptr_ok(fptr_whitelist_modenv_kill_sub(
740 				qstate->env->kill_sub));
741 			(*qstate->env->kill_sub)(subq);
742 			(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
743 			return 1; /* return 1 to make module stop, with error */
744 		}
745 		/* there should not be any target queries -- although there
746 		 * wouldn't be anyway, since stub hints never have
747 		 * missing targets. */
748 		subiq->num_target_queries = 0;
749 		subiq->wait_priming_stub = 1;
750 		subiq->dnssec_expected = iter_indicates_dnssec(
751 			qstate->env, subiq->dp, NULL, subq->qinfo.qclass);
752 	}
753 
754 	/* this module stops, our submodule starts, and does the query. */
755 	qstate->ext_state[id] = module_wait_subquery;
756 	return 1;
757 }
758 
759 /**
760  * Generate A and AAAA checks for glue that is in-zone for the referral
761  * we just got to obtain authoritative information on the adresses.
762  *
763  * @param qstate: the qtstate that triggered the need to prime.
764  * @param iq: iterator query state.
765  * @param id: module id.
766  */
767 static void
768 generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq,
769 	int id)
770 {
771 	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
772 	struct module_qstate* subq;
773 	size_t i;
774 	struct reply_info* rep = iq->response->rep;
775 	struct ub_packed_rrset_key* s;
776 	log_assert(iq->dp);
777 
778 	if(iq->depth == ie->max_dependency_depth)
779 		return;
780 	/* walk through additional, and check if in-zone,
781 	 * only relevant A, AAAA are left after scrub anyway */
782 	for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) {
783 		s = rep->rrsets[i];
784 		/* check *ALL* addresses that are transmitted in additional*/
785 		/* is it an address ? */
786 		if( !(ntohs(s->rk.type)==LDNS_RR_TYPE_A ||
787 			ntohs(s->rk.type)==LDNS_RR_TYPE_AAAA)) {
788 			continue;
789 		}
790 		/* is this query the same as the A/AAAA check for it */
791 		if(qstate->qinfo.qtype == ntohs(s->rk.type) &&
792 			qstate->qinfo.qclass == ntohs(s->rk.rrset_class) &&
793 			query_dname_compare(qstate->qinfo.qname,
794 				s->rk.dname)==0 &&
795 			(qstate->query_flags&BIT_RD) &&
796 			!(qstate->query_flags&BIT_CD))
797 			continue;
798 
799 		/* generate subrequest for it */
800 		log_nametypeclass(VERB_ALGO, "schedule addr fetch",
801 			s->rk.dname, ntohs(s->rk.type),
802 			ntohs(s->rk.rrset_class));
803 		if(!generate_sub_request(s->rk.dname, s->rk.dname_len,
804 			ntohs(s->rk.type), ntohs(s->rk.rrset_class),
805 			qstate, id, iq,
806 			INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) {
807 			verbose(VERB_ALGO, "could not generate addr check");
808 			return;
809 		}
810 		/* ignore subq - not need for more init */
811 	}
812 }
813 
814 /**
815  * Generate a NS check request to obtain authoritative information
816  * on an NS rrset.
817  *
818  * @param qstate: the qtstate that triggered the need to prime.
819  * @param iq: iterator query state.
820  * @param id: module id.
821  */
822 static void
823 generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id)
824 {
825 	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
826 	struct module_qstate* subq;
827 	log_assert(iq->dp);
828 
829 	if(iq->depth == ie->max_dependency_depth)
830 		return;
831 	/* is this query the same as the nscheck? */
832 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS &&
833 		query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 &&
834 		(qstate->query_flags&BIT_RD) && !(qstate->query_flags&BIT_CD)){
835 		/* spawn off A, AAAA queries for in-zone glue to check */
836 		generate_a_aaaa_check(qstate, iq, id);
837 		return;
838 	}
839 
840 	log_nametypeclass(VERB_ALGO, "schedule ns fetch",
841 		iq->dp->name, LDNS_RR_TYPE_NS, iq->qchase.qclass);
842 	if(!generate_sub_request(iq->dp->name, iq->dp->namelen,
843 		LDNS_RR_TYPE_NS, iq->qchase.qclass, qstate, id, iq,
844 		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) {
845 		verbose(VERB_ALGO, "could not generate ns check");
846 		return;
847 	}
848 	if(subq) {
849 		struct iter_qstate* subiq =
850 			(struct iter_qstate*)subq->minfo[id];
851 
852 		/* make copy to avoid use of stub dp by different qs/threads */
853 		/* refetch glue to start higher up the tree */
854 		subiq->refetch_glue = 1;
855 		subiq->dp = delegpt_copy(iq->dp, subq->region);
856 		if(!subiq->dp) {
857 			log_err("out of memory generating ns check, copydp");
858 			fptr_ok(fptr_whitelist_modenv_kill_sub(
859 				qstate->env->kill_sub));
860 			(*qstate->env->kill_sub)(subq);
861 			return;
862 		}
863 	}
864 }
865 
866 /**
867  * Generate a DNSKEY prefetch query to get the DNSKEY for the DS record we
868  * just got in a referral (where we have dnssec_expected, thus have trust
869  * anchors above it).  Note that right after calling this routine the
870  * iterator detached subqueries (because of following the referral), and thus
871  * the DNSKEY query becomes detached, its return stored in the cache for
872  * later lookup by the validator.  This cache lookup by the validator avoids
873  * the roundtrip incurred by the DNSKEY query.  The DNSKEY query is now
874  * performed at about the same time the original query is sent to the domain,
875  * thus the two answers are likely to be returned at about the same time,
876  * saving a roundtrip from the validated lookup.
877  *
878  * @param qstate: the qtstate that triggered the need to prime.
879  * @param iq: iterator query state.
880  * @param id: module id.
881  */
882 static void
883 generate_dnskey_prefetch(struct module_qstate* qstate,
884 	struct iter_qstate* iq, int id)
885 {
886 	struct module_qstate* subq;
887 	log_assert(iq->dp);
888 
889 	/* is this query the same as the prefetch? */
890 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY &&
891 		query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 &&
892 		(qstate->query_flags&BIT_RD) && !(qstate->query_flags&BIT_CD)){
893 		return;
894 	}
895 
896 	/* if the DNSKEY is in the cache this lookup will stop quickly */
897 	log_nametypeclass(VERB_ALGO, "schedule dnskey prefetch",
898 		iq->dp->name, LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass);
899 	if(!generate_sub_request(iq->dp->name, iq->dp->namelen,
900 		LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass, qstate, id, iq,
901 		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0)) {
902 		/* we'll be slower, but it'll work */
903 		verbose(VERB_ALGO, "could not generate dnskey prefetch");
904 		return;
905 	}
906 	if(subq) {
907 		struct iter_qstate* subiq =
908 			(struct iter_qstate*)subq->minfo[id];
909 		/* this qstate has the right delegation for the dnskey lookup*/
910 		/* make copy to avoid use of stub dp by different qs/threads */
911 		subiq->dp = delegpt_copy(iq->dp, subq->region);
912 		/* if !subiq->dp, it'll start from the cache, no problem */
913 	}
914 }
915 
916 /**
917  * See if the query needs forwarding.
918  *
919  * @param qstate: query state.
920  * @param iq: iterator query state.
921  * @return true if the request is forwarded, false if not.
922  * 	If returns true but, iq->dp is NULL then a malloc failure occurred.
923  */
924 static int
925 forward_request(struct module_qstate* qstate, struct iter_qstate* iq)
926 {
927 	struct delegpt* dp;
928 	uint8_t* delname = iq->qchase.qname;
929 	size_t delnamelen = iq->qchase.qname_len;
930 	if(iq->refetch_glue) {
931 		delname = iq->dp->name;
932 		delnamelen = iq->dp->namelen;
933 	}
934 	/* strip one label off of DS query to lookup higher for it */
935 	if( (iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue)
936 		&& !dname_is_root(iq->qchase.qname))
937 		dname_remove_label(&delname, &delnamelen);
938 	dp = forwards_lookup(qstate->env->fwds, delname, iq->qchase.qclass);
939 	if(!dp)
940 		return 0;
941 	/* send recursion desired to forward addr */
942 	iq->chase_flags |= BIT_RD;
943 	iq->dp = delegpt_copy(dp, qstate->region);
944 	/* iq->dp checked by caller */
945 	verbose(VERB_ALGO, "forwarding request");
946 	return 1;
947 }
948 
949 /**
950  * Process the initial part of the request handling. This state roughly
951  * corresponds to resolver algorithms steps 1 (find answer in cache) and 2
952  * (find the best servers to ask).
953  *
954  * Note that all requests start here, and query restarts revisit this state.
955  *
956  * This state either generates: 1) a response, from cache or error, 2) a
957  * priming event, or 3) forwards the request to the next state (init2,
958  * generally).
959  *
960  * @param qstate: query state.
961  * @param iq: iterator query state.
962  * @param ie: iterator shared global environment.
963  * @param id: module id.
964  * @return true if the event needs more request processing immediately,
965  *         false if not.
966  */
967 static int
968 processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
969 	struct iter_env* ie, int id)
970 {
971 	uint8_t* delname;
972 	size_t delnamelen;
973 	struct dns_msg* msg = NULL;
974 
975 	log_query_info(VERB_DETAIL, "resolving", &qstate->qinfo);
976 	/* check effort */
977 
978 	/* We enforce a maximum number of query restarts. This is primarily a
979 	 * cheap way to prevent CNAME loops. */
980 	if(iq->query_restart_count > MAX_RESTART_COUNT) {
981 		verbose(VERB_QUERY, "request has exceeded the maximum number"
982 			" of query restarts with %d", iq->query_restart_count);
983 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
984 	}
985 
986 	/* We enforce a maximum recursion/dependency depth -- in general,
987 	 * this is unnecessary for dependency loops (although it will
988 	 * catch those), but it provides a sensible limit to the amount
989 	 * of work required to answer a given query. */
990 	verbose(VERB_ALGO, "request has dependency depth of %d", iq->depth);
991 	if(iq->depth > ie->max_dependency_depth) {
992 		verbose(VERB_QUERY, "request has exceeded the maximum "
993 			"dependency depth with depth of %d", iq->depth);
994 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
995 	}
996 
997 	/* If the request is qclass=ANY, setup to generate each class */
998 	if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) {
999 		iq->qchase.qclass = 0;
1000 		return next_state(iq, COLLECT_CLASS_STATE);
1001 	}
1002 
1003 	/* Resolver Algorithm Step 1 -- Look for the answer in local data. */
1004 
1005 	/* This either results in a query restart (CNAME cache response), a
1006 	 * terminating response (ANSWER), or a cache miss (null). */
1007 
1008 	if(qstate->blacklist) {
1009 		/* if cache, or anything else, was blacklisted then
1010 		 * getting older results from cache is a bad idea, no cache */
1011 		verbose(VERB_ALGO, "cache blacklisted, going to the network");
1012 		msg = NULL;
1013 	} else if(!qstate->no_cache_lookup) {
1014 		msg = dns_cache_lookup(qstate->env, iq->qchase.qname,
1015 			iq->qchase.qname_len, iq->qchase.qtype,
1016 			iq->qchase.qclass, qstate->query_flags,
1017 			qstate->region, qstate->env->scratch);
1018 		if(!msg && qstate->env->neg_cache) {
1019 			/* lookup in negative cache; may result in
1020 			 * NOERROR/NODATA or NXDOMAIN answers that need validation */
1021 			msg = val_neg_getmsg(qstate->env->neg_cache, &iq->qchase,
1022 				qstate->region, qstate->env->rrset_cache,
1023 				qstate->env->scratch_buffer,
1024 				*qstate->env->now, 1/*add SOA*/, NULL);
1025 		}
1026 		/* item taken from cache does not match our query name, thus
1027 		 * security needs to be re-examined later */
1028 		if(msg && query_dname_compare(qstate->qinfo.qname,
1029 			iq->qchase.qname) != 0)
1030 			msg->rep->security = sec_status_unchecked;
1031 	}
1032 	if(msg) {
1033 		/* handle positive cache response */
1034 		enum response_type type = response_type_from_cache(msg,
1035 			&iq->qchase);
1036 		if(verbosity >= VERB_ALGO) {
1037 			log_dns_msg("msg from cache lookup", &msg->qinfo,
1038 				msg->rep);
1039 			verbose(VERB_ALGO, "msg ttl is %d, prefetch ttl %d",
1040 				(int)msg->rep->ttl,
1041 				(int)msg->rep->prefetch_ttl);
1042 		}
1043 
1044 		if(type == RESPONSE_TYPE_CNAME) {
1045 			uint8_t* sname = 0;
1046 			size_t slen = 0;
1047 			verbose(VERB_ALGO, "returning CNAME response from "
1048 				"cache");
1049 			if(!handle_cname_response(qstate, iq, msg,
1050 				&sname, &slen))
1051 				return error_response(qstate, id,
1052 					LDNS_RCODE_SERVFAIL);
1053 			iq->qchase.qname = sname;
1054 			iq->qchase.qname_len = slen;
1055 			/* This *is* a query restart, even if it is a cheap
1056 			 * one. */
1057 			iq->dp = NULL;
1058 			iq->refetch_glue = 0;
1059 			iq->query_restart_count++;
1060 			iq->sent_count = 0;
1061 			sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
1062 			if(qstate->env->cfg->qname_minimisation)
1063 				iq->minimisation_state = INIT_MINIMISE_STATE;
1064 			return next_state(iq, INIT_REQUEST_STATE);
1065 		}
1066 
1067 		/* if from cache, NULL, else insert 'cache IP' len=0 */
1068 		if(qstate->reply_origin)
1069 			sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
1070 		/* it is an answer, response, to final state */
1071 		verbose(VERB_ALGO, "returning answer from cache.");
1072 		iq->response = msg;
1073 		return final_state(iq);
1074 	}
1075 
1076 	/* attempt to forward the request */
1077 	if(forward_request(qstate, iq))
1078 	{
1079 		if(!iq->dp) {
1080 			log_err("alloc failure for forward dp");
1081 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
1082 		}
1083 		iq->refetch_glue = 0;
1084 		iq->minimisation_state = DONOT_MINIMISE_STATE;
1085 		/* the request has been forwarded.
1086 		 * forwarded requests need to be immediately sent to the
1087 		 * next state, QUERYTARGETS. */
1088 		return next_state(iq, QUERYTARGETS_STATE);
1089 	}
1090 
1091 	/* Resolver Algorithm Step 2 -- find the "best" servers. */
1092 
1093 	/* first, adjust for DS queries. To avoid the grandparent problem,
1094 	 * we just look for the closest set of server to the parent of qname.
1095 	 * When re-fetching glue we also need to ask the parent.
1096 	 */
1097 	if(iq->refetch_glue) {
1098 		if(!iq->dp) {
1099 			log_err("internal or malloc fail: no dp for refetch");
1100 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
1101 		}
1102 		delname = iq->dp->name;
1103 		delnamelen = iq->dp->namelen;
1104 	} else {
1105 		delname = iq->qchase.qname;
1106 		delnamelen = iq->qchase.qname_len;
1107 	}
1108 	if(iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue ||
1109 	   (iq->qchase.qtype == LDNS_RR_TYPE_NS && qstate->prefetch_leeway)) {
1110 		/* remove first label from delname, root goes to hints,
1111 		 * but only to fetch glue, not for qtype=DS. */
1112 		/* also when prefetching an NS record, fetch it again from
1113 		 * its parent, just as if it expired, so that you do not
1114 		 * get stuck on an older nameserver that gives old NSrecords */
1115 		if(dname_is_root(delname) && (iq->refetch_glue ||
1116 			(iq->qchase.qtype == LDNS_RR_TYPE_NS &&
1117 			qstate->prefetch_leeway)))
1118 			delname = NULL; /* go to root priming */
1119 		else 	dname_remove_label(&delname, &delnamelen);
1120 	}
1121 	/* delname is the name to lookup a delegation for. If NULL rootprime */
1122 	while(1) {
1123 
1124 		/* Lookup the delegation in the cache. If null, then the
1125 		 * cache needs to be primed for the qclass. */
1126 		if(delname)
1127 		     iq->dp = dns_cache_find_delegation(qstate->env, delname,
1128 			delnamelen, iq->qchase.qtype, iq->qchase.qclass,
1129 			qstate->region, &iq->deleg_msg,
1130 			*qstate->env->now+qstate->prefetch_leeway);
1131 		else iq->dp = NULL;
1132 
1133 		/* If the cache has returned nothing, then we have a
1134 		 * root priming situation. */
1135 		if(iq->dp == NULL) {
1136 			/* if there is a stub, then no root prime needed */
1137 			int r = prime_stub(qstate, iq, id, delname,
1138 				iq->qchase.qclass);
1139 			if(r == 2)
1140 				break; /* got noprime-stub-zone, continue */
1141 			else if(r)
1142 				return 0; /* stub prime request made */
1143 			if(forwards_lookup_root(qstate->env->fwds,
1144 				iq->qchase.qclass)) {
1145 				/* forward zone root, no root prime needed */
1146 				/* fill in some dp - safety belt */
1147 				iq->dp = hints_lookup_root(qstate->env->hints,
1148 					iq->qchase.qclass);
1149 				if(!iq->dp) {
1150 					log_err("internal error: no hints dp");
1151 					return error_response(qstate, id,
1152 						LDNS_RCODE_SERVFAIL);
1153 				}
1154 				iq->dp = delegpt_copy(iq->dp, qstate->region);
1155 				if(!iq->dp) {
1156 					log_err("out of memory in safety belt");
1157 					return error_response(qstate, id,
1158 						LDNS_RCODE_SERVFAIL);
1159 				}
1160 				return next_state(iq, INIT_REQUEST_2_STATE);
1161 			}
1162 			/* Note that the result of this will set a new
1163 			 * DelegationPoint based on the result of priming. */
1164 			if(!prime_root(qstate, iq, id, iq->qchase.qclass))
1165 				return error_response(qstate, id,
1166 					LDNS_RCODE_REFUSED);
1167 
1168 			/* priming creates and sends a subordinate query, with
1169 			 * this query as the parent. So further processing for
1170 			 * this event will stop until reactivated by the
1171 			 * results of priming. */
1172 			return 0;
1173 		}
1174 		if(!iq->ratelimit_ok && qstate->prefetch_leeway)
1175 			iq->ratelimit_ok = 1; /* allow prefetches, this keeps
1176 			otherwise valid data in the cache */
1177 		if(!iq->ratelimit_ok && infra_ratelimit_exceeded(
1178 			qstate->env->infra_cache, iq->dp->name,
1179 			iq->dp->namelen, *qstate->env->now)) {
1180 			/* and increment the rate, so that the rate for time
1181 			 * now will also exceed the rate, keeping cache fresh */
1182 			(void)infra_ratelimit_inc(qstate->env->infra_cache,
1183 				iq->dp->name, iq->dp->namelen,
1184 				*qstate->env->now);
1185 			/* see if we are passed through with slip factor */
1186 			if(qstate->env->cfg->ratelimit_factor != 0 &&
1187 				ub_random_max(qstate->env->rnd,
1188 				    qstate->env->cfg->ratelimit_factor) == 1) {
1189 				iq->ratelimit_ok = 1;
1190 				log_nametypeclass(VERB_ALGO, "ratelimit allowed through for "
1191 					"delegation point", iq->dp->name,
1192 					LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
1193 			} else {
1194 				log_nametypeclass(VERB_ALGO, "ratelimit exceeded with "
1195 					"delegation point", iq->dp->name,
1196 					LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
1197 				return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
1198 			}
1199 		}
1200 
1201 		/* see if this dp not useless.
1202 		 * It is useless if:
1203 		 *	o all NS items are required glue.
1204 		 *	  or the query is for NS item that is required glue.
1205 		 *	o no addresses are provided.
1206 		 *	o RD qflag is on.
1207 		 * Instead, go up one level, and try to get even further
1208 		 * If the root was useless, use safety belt information.
1209 		 * Only check cache returns, because replies for servers
1210 		 * could be useless but lead to loops (bumping into the
1211 		 * same server reply) if useless-checked.
1212 		 */
1213 		if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags,
1214 			iq->dp)) {
1215 			if(dname_is_root(iq->dp->name)) {
1216 				/* use safety belt */
1217 				verbose(VERB_QUERY, "Cache has root NS but "
1218 				"no addresses. Fallback to the safety belt.");
1219 				iq->dp = hints_lookup_root(qstate->env->hints,
1220 					iq->qchase.qclass);
1221 				/* note deleg_msg is from previous lookup,
1222 				 * but RD is on, so it is not used */
1223 				if(!iq->dp) {
1224 					log_err("internal error: no hints dp");
1225 					return error_response(qstate, id,
1226 						LDNS_RCODE_REFUSED);
1227 				}
1228 				iq->dp = delegpt_copy(iq->dp, qstate->region);
1229 				if(!iq->dp) {
1230 					log_err("out of memory in safety belt");
1231 					return error_response(qstate, id,
1232 						LDNS_RCODE_SERVFAIL);
1233 				}
1234 				break;
1235 			} else {
1236 				verbose(VERB_ALGO,
1237 					"cache delegation was useless:");
1238 				delegpt_log(VERB_ALGO, iq->dp);
1239 				/* go up */
1240 				delname = iq->dp->name;
1241 				delnamelen = iq->dp->namelen;
1242 				dname_remove_label(&delname, &delnamelen);
1243 			}
1244 		} else break;
1245 	}
1246 
1247 	verbose(VERB_ALGO, "cache delegation returns delegpt");
1248 	delegpt_log(VERB_ALGO, iq->dp);
1249 
1250 	/* Otherwise, set the current delegation point and move on to the
1251 	 * next state. */
1252 	return next_state(iq, INIT_REQUEST_2_STATE);
1253 }
1254 
1255 /**
1256  * Process the second part of the initial request handling. This state
1257  * basically exists so that queries that generate root priming events have
1258  * the same init processing as ones that do not. Request events that reach
1259  * this state must have a valid currentDelegationPoint set.
1260  *
1261  * This part is primarly handling stub zone priming. Events that reach this
1262  * state must have a current delegation point.
1263  *
1264  * @param qstate: query state.
1265  * @param iq: iterator query state.
1266  * @param id: module id.
1267  * @return true if the event needs more request processing immediately,
1268  *         false if not.
1269  */
1270 static int
1271 processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq,
1272 	int id)
1273 {
1274 	uint8_t* delname;
1275 	size_t delnamelen;
1276 	log_query_info(VERB_QUERY, "resolving (init part 2): ",
1277 		&qstate->qinfo);
1278 
1279 	if(iq->refetch_glue) {
1280 		if(!iq->dp) {
1281 			log_err("internal or malloc fail: no dp for refetch");
1282 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
1283 		}
1284 		delname = iq->dp->name;
1285 		delnamelen = iq->dp->namelen;
1286 	} else {
1287 		delname = iq->qchase.qname;
1288 		delnamelen = iq->qchase.qname_len;
1289 	}
1290 	if(iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue) {
1291 		if(!dname_is_root(delname))
1292 			dname_remove_label(&delname, &delnamelen);
1293 		iq->refetch_glue = 0; /* if CNAME causes restart, no refetch */
1294 	}
1295 	/* Check to see if we need to prime a stub zone. */
1296 	if(prime_stub(qstate, iq, id, delname, iq->qchase.qclass)) {
1297 		/* A priming sub request was made */
1298 		return 0;
1299 	}
1300 
1301 	/* most events just get forwarded to the next state. */
1302 	return next_state(iq, INIT_REQUEST_3_STATE);
1303 }
1304 
1305 /**
1306  * Process the third part of the initial request handling. This state exists
1307  * as a separate state so that queries that generate stub priming events
1308  * will get the tail end of the init process but not repeat the stub priming
1309  * check.
1310  *
1311  * @param qstate: query state.
1312  * @param iq: iterator query state.
1313  * @param id: module id.
1314  * @return true, advancing the event to the QUERYTARGETS_STATE.
1315  */
1316 static int
1317 processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq,
1318 	int id)
1319 {
1320 	log_query_info(VERB_QUERY, "resolving (init part 3): ",
1321 		&qstate->qinfo);
1322 	/* if the cache reply dp equals a validation anchor or msg has DS,
1323 	 * then DNSSEC RRSIGs are expected in the reply */
1324 	iq->dnssec_expected = iter_indicates_dnssec(qstate->env, iq->dp,
1325 		iq->deleg_msg, iq->qchase.qclass);
1326 
1327 	/* If the RD flag wasn't set, then we just finish with the
1328 	 * cached referral as the response. */
1329 	if(!(qstate->query_flags & BIT_RD)) {
1330 		iq->response = iq->deleg_msg;
1331 		if(verbosity >= VERB_ALGO && iq->response)
1332 			log_dns_msg("no RD requested, using delegation msg",
1333 				&iq->response->qinfo, iq->response->rep);
1334 		if(qstate->reply_origin)
1335 			sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
1336 		return final_state(iq);
1337 	}
1338 	/* After this point, unset the RD flag -- this query is going to
1339 	 * be sent to an auth. server. */
1340 	iq->chase_flags &= ~BIT_RD;
1341 
1342 	/* if dnssec expected, fetch key for the trust-anchor or cached-DS */
1343 	if(iq->dnssec_expected && qstate->env->cfg->prefetch_key &&
1344 		!(qstate->query_flags&BIT_CD)) {
1345 		generate_dnskey_prefetch(qstate, iq, id);
1346 		fptr_ok(fptr_whitelist_modenv_detach_subs(
1347 			qstate->env->detach_subs));
1348 		(*qstate->env->detach_subs)(qstate);
1349 	}
1350 
1351 	/* Jump to the next state. */
1352 	return next_state(iq, QUERYTARGETS_STATE);
1353 }
1354 
1355 /**
1356  * Given a basic query, generate a parent-side "target" query.
1357  * These are subordinate queries for missing delegation point target addresses,
1358  * for which only the parent of the delegation provides correct IP addresses.
1359  *
1360  * @param qstate: query state.
1361  * @param iq: iterator query state.
1362  * @param id: module id.
1363  * @param name: target qname.
1364  * @param namelen: target qname length.
1365  * @param qtype: target qtype (either A or AAAA).
1366  * @param qclass: target qclass.
1367  * @return true on success, false on failure.
1368  */
1369 static int
1370 generate_parentside_target_query(struct module_qstate* qstate,
1371 	struct iter_qstate* iq, int id, uint8_t* name, size_t namelen,
1372 	uint16_t qtype, uint16_t qclass)
1373 {
1374 	struct module_qstate* subq;
1375 	if(!generate_sub_request(name, namelen, qtype, qclass, qstate,
1376 		id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0))
1377 		return 0;
1378 	if(subq) {
1379 		struct iter_qstate* subiq =
1380 			(struct iter_qstate*)subq->minfo[id];
1381 		/* blacklist the cache - we want to fetch parent stuff */
1382 		sock_list_insert(&subq->blacklist, NULL, 0, subq->region);
1383 		subiq->query_for_pside_glue = 1;
1384 		if(dname_subdomain_c(name, iq->dp->name)) {
1385 			subiq->dp = delegpt_copy(iq->dp, subq->region);
1386 			subiq->dnssec_expected = iter_indicates_dnssec(
1387 				qstate->env, subiq->dp, NULL,
1388 				subq->qinfo.qclass);
1389 			subiq->refetch_glue = 1;
1390 		} else {
1391 			subiq->dp = dns_cache_find_delegation(qstate->env,
1392 				name, namelen, qtype, qclass, subq->region,
1393 				&subiq->deleg_msg,
1394 				*qstate->env->now+subq->prefetch_leeway);
1395 			/* if no dp, then it's from root, refetch unneeded */
1396 			if(subiq->dp) {
1397 				subiq->dnssec_expected = iter_indicates_dnssec(
1398 					qstate->env, subiq->dp, NULL,
1399 					subq->qinfo.qclass);
1400 				subiq->refetch_glue = 1;
1401 			}
1402 		}
1403 	}
1404 	log_nametypeclass(VERB_QUERY, "new pside target", name, qtype, qclass);
1405 	return 1;
1406 }
1407 
1408 /**
1409  * Given a basic query, generate a "target" query. These are subordinate
1410  * queries for missing delegation point target addresses.
1411  *
1412  * @param qstate: query state.
1413  * @param iq: iterator query state.
1414  * @param id: module id.
1415  * @param name: target qname.
1416  * @param namelen: target qname length.
1417  * @param qtype: target qtype (either A or AAAA).
1418  * @param qclass: target qclass.
1419  * @return true on success, false on failure.
1420  */
1421 static int
1422 generate_target_query(struct module_qstate* qstate, struct iter_qstate* iq,
1423         int id, uint8_t* name, size_t namelen, uint16_t qtype, uint16_t qclass)
1424 {
1425 	struct module_qstate* subq;
1426 	if(!generate_sub_request(name, namelen, qtype, qclass, qstate,
1427 		id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0))
1428 		return 0;
1429 	log_nametypeclass(VERB_QUERY, "new target", name, qtype, qclass);
1430 	return 1;
1431 }
1432 
1433 /**
1434  * Given an event at a certain state, generate zero or more target queries
1435  * for it's current delegation point.
1436  *
1437  * @param qstate: query state.
1438  * @param iq: iterator query state.
1439  * @param ie: iterator shared global environment.
1440  * @param id: module id.
1441  * @param maxtargets: The maximum number of targets to query for.
1442  *	if it is negative, there is no maximum number of targets.
1443  * @param num: returns the number of queries generated and processed,
1444  *	which may be zero if there were no missing targets.
1445  * @return false on error.
1446  */
1447 static int
1448 query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
1449         struct iter_env* ie, int id, int maxtargets, int* num)
1450 {
1451 	int query_count = 0;
1452 	struct delegpt_ns* ns;
1453 	int missing;
1454 	int toget = 0;
1455 
1456 	if(iq->depth == ie->max_dependency_depth)
1457 		return 0;
1458 	if(iq->depth > 0 && iq->target_count &&
1459 		iq->target_count[1] > MAX_TARGET_COUNT) {
1460 		char s[LDNS_MAX_DOMAINLEN+1];
1461 		dname_str(qstate->qinfo.qname, s);
1462 		verbose(VERB_QUERY, "request %s has exceeded the maximum "
1463 			"number of glue fetches %d", s, iq->target_count[1]);
1464 		return 0;
1465 	}
1466 
1467 	iter_mark_cycle_targets(qstate, iq->dp);
1468 	missing = (int)delegpt_count_missing_targets(iq->dp);
1469 	log_assert(maxtargets != 0); /* that would not be useful */
1470 
1471 	/* Generate target requests. Basically, any missing targets
1472 	 * are queried for here, regardless if it is necessary to do
1473 	 * so to continue processing. */
1474 	if(maxtargets < 0 || maxtargets > missing)
1475 		toget = missing;
1476 	else	toget = maxtargets;
1477 	if(toget == 0) {
1478 		*num = 0;
1479 		return 1;
1480 	}
1481 	/* select 'toget' items from the total of 'missing' items */
1482 	log_assert(toget <= missing);
1483 
1484 	/* loop over missing targets */
1485 	for(ns = iq->dp->nslist; ns; ns = ns->next) {
1486 		if(ns->resolved)
1487 			continue;
1488 
1489 		/* randomly select this item with probability toget/missing */
1490 		if(!iter_ns_probability(qstate->env->rnd, toget, missing)) {
1491 			/* do not select this one, next; select toget number
1492 			 * of items from a list one less in size */
1493 			missing --;
1494 			continue;
1495 		}
1496 
1497 		if(ie->supports_ipv6 && !ns->got6) {
1498 			/* Send the AAAA request. */
1499 			if(!generate_target_query(qstate, iq, id,
1500 				ns->name, ns->namelen,
1501 				LDNS_RR_TYPE_AAAA, iq->qchase.qclass)) {
1502 				*num = query_count;
1503 				if(query_count > 0)
1504 					qstate->ext_state[id] = module_wait_subquery;
1505 				return 0;
1506 			}
1507 			query_count++;
1508 		}
1509 		/* Send the A request. */
1510 		if(ie->supports_ipv4 && !ns->got4) {
1511 			if(!generate_target_query(qstate, iq, id,
1512 				ns->name, ns->namelen,
1513 				LDNS_RR_TYPE_A, iq->qchase.qclass)) {
1514 				*num = query_count;
1515 				if(query_count > 0)
1516 					qstate->ext_state[id] = module_wait_subquery;
1517 				return 0;
1518 			}
1519 			query_count++;
1520 		}
1521 
1522 		/* mark this target as in progress. */
1523 		ns->resolved = 1;
1524 		missing--;
1525 		toget--;
1526 		if(toget == 0)
1527 			break;
1528 	}
1529 	*num = query_count;
1530 	if(query_count > 0)
1531 		qstate->ext_state[id] = module_wait_subquery;
1532 
1533 	return 1;
1534 }
1535 
1536 /** see if last resort is possible - does config allow queries to parent */
1537 static int
1538 can_have_last_resort(struct module_env* env, struct delegpt* dp,
1539 	struct iter_qstate* iq)
1540 {
1541 	struct delegpt* fwddp;
1542 	struct iter_hints_stub* stub;
1543 	/* do not process a last resort (the parent side) if a stub
1544 	 * or forward is configured, because we do not want to go 'above'
1545 	 * the configured servers */
1546 	if(!dname_is_root(dp->name) && (stub = (struct iter_hints_stub*)
1547 		name_tree_find(&env->hints->tree, dp->name, dp->namelen,
1548 		dp->namelabs, iq->qchase.qclass)) &&
1549 		/* has_parent side is turned off for stub_first, where we
1550 		 * are allowed to go to the parent */
1551 		stub->dp->has_parent_side_NS) {
1552 		verbose(VERB_QUERY, "configured stub servers failed -- returning SERVFAIL");
1553 		return 0;
1554 	}
1555 	if((fwddp = forwards_find(env->fwds, dp->name, iq->qchase.qclass)) &&
1556 		/* has_parent_side is turned off for forward_first, where
1557 		 * we are allowed to go to the parent */
1558 		fwddp->has_parent_side_NS) {
1559 		verbose(VERB_QUERY, "configured forward servers failed -- returning SERVFAIL");
1560 		return 0;
1561 	}
1562 	return 1;
1563 }
1564 
1565 /**
1566  * Called by processQueryTargets when it would like extra targets to query
1567  * but it seems to be out of options.  At last resort some less appealing
1568  * options are explored.  If there are no more options, the result is SERVFAIL
1569  *
1570  * @param qstate: query state.
1571  * @param iq: iterator query state.
1572  * @param ie: iterator shared global environment.
1573  * @param id: module id.
1574  * @return true if the event requires more request processing immediately,
1575  *         false if not.
1576  */
1577 static int
1578 processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
1579 	struct iter_env* ie, int id)
1580 {
1581 	struct delegpt_ns* ns;
1582 	int query_count = 0;
1583 	verbose(VERB_ALGO, "No more query targets, attempting last resort");
1584 	log_assert(iq->dp);
1585 
1586 	if(!can_have_last_resort(qstate->env, iq->dp, iq)) {
1587 		/* fail -- no more targets, no more hope of targets, no hope
1588 		 * of a response. */
1589 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
1590 	}
1591 	if(!iq->dp->has_parent_side_NS && dname_is_root(iq->dp->name)) {
1592 		struct delegpt* p = hints_lookup_root(qstate->env->hints,
1593 			iq->qchase.qclass);
1594 		if(p) {
1595 			struct delegpt_ns* ns;
1596 			struct delegpt_addr* a;
1597 			iq->chase_flags &= ~BIT_RD; /* go to authorities */
1598 			for(ns = p->nslist; ns; ns=ns->next) {
1599 				(void)delegpt_add_ns(iq->dp, qstate->region,
1600 					ns->name, ns->lame);
1601 			}
1602 			for(a = p->target_list; a; a=a->next_target) {
1603 				(void)delegpt_add_addr(iq->dp, qstate->region,
1604 					&a->addr, a->addrlen, a->bogus,
1605 					a->lame);
1606 			}
1607 		}
1608 		iq->dp->has_parent_side_NS = 1;
1609 	} else if(!iq->dp->has_parent_side_NS) {
1610 		if(!iter_lookup_parent_NS_from_cache(qstate->env, iq->dp,
1611 			qstate->region, &qstate->qinfo)
1612 			|| !iq->dp->has_parent_side_NS) {
1613 			/* if: malloc failure in lookup go up to try */
1614 			/* if: no parent NS in cache - go up one level */
1615 			verbose(VERB_ALGO, "try to grab parent NS");
1616 			iq->store_parent_NS = iq->dp;
1617 			iq->chase_flags &= ~BIT_RD; /* go to authorities */
1618 			iq->deleg_msg = NULL;
1619 			iq->refetch_glue = 1;
1620 			iq->query_restart_count++;
1621 			iq->sent_count = 0;
1622 			if(qstate->env->cfg->qname_minimisation)
1623 				iq->minimisation_state = INIT_MINIMISE_STATE;
1624 			return next_state(iq, INIT_REQUEST_STATE);
1625 		}
1626 	}
1627 	/* see if that makes new names available */
1628 	if(!cache_fill_missing(qstate->env, iq->qchase.qclass,
1629 		qstate->region, iq->dp))
1630 		log_err("out of memory in cache_fill_missing");
1631 	if(iq->dp->usable_list) {
1632 		verbose(VERB_ALGO, "try parent-side-name, w. glue from cache");
1633 		return next_state(iq, QUERYTARGETS_STATE);
1634 	}
1635 	/* try to fill out parent glue from cache */
1636 	if(iter_lookup_parent_glue_from_cache(qstate->env, iq->dp,
1637 		qstate->region, &qstate->qinfo)) {
1638 		/* got parent stuff from cache, see if we can continue */
1639 		verbose(VERB_ALGO, "try parent-side glue from cache");
1640 		return next_state(iq, QUERYTARGETS_STATE);
1641 	}
1642 	/* query for an extra name added by the parent-NS record */
1643 	if(delegpt_count_missing_targets(iq->dp) > 0) {
1644 		int qs = 0;
1645 		verbose(VERB_ALGO, "try parent-side target name");
1646 		if(!query_for_targets(qstate, iq, ie, id, 1, &qs)) {
1647 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
1648 		}
1649 		iq->num_target_queries += qs;
1650 		target_count_increase(iq, qs);
1651 		if(qs != 0) {
1652 			qstate->ext_state[id] = module_wait_subquery;
1653 			return 0; /* and wait for them */
1654 		}
1655 	}
1656 	if(iq->depth == ie->max_dependency_depth) {
1657 		verbose(VERB_QUERY, "maxdepth and need more nameservers, fail");
1658 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
1659 	}
1660 	if(iq->depth > 0 && iq->target_count &&
1661 		iq->target_count[1] > MAX_TARGET_COUNT) {
1662 		char s[LDNS_MAX_DOMAINLEN+1];
1663 		dname_str(qstate->qinfo.qname, s);
1664 		verbose(VERB_QUERY, "request %s has exceeded the maximum "
1665 			"number of glue fetches %d", s, iq->target_count[1]);
1666 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
1667 	}
1668 	/* mark cycle targets for parent-side lookups */
1669 	iter_mark_pside_cycle_targets(qstate, iq->dp);
1670 	/* see if we can issue queries to get nameserver addresses */
1671 	/* this lookup is not randomized, but sequential. */
1672 	for(ns = iq->dp->nslist; ns; ns = ns->next) {
1673 		/* query for parent-side A and AAAA for nameservers */
1674 		if(ie->supports_ipv6 && !ns->done_pside6) {
1675 			/* Send the AAAA request. */
1676 			if(!generate_parentside_target_query(qstate, iq, id,
1677 				ns->name, ns->namelen,
1678 				LDNS_RR_TYPE_AAAA, iq->qchase.qclass))
1679 				return error_response(qstate, id,
1680 					LDNS_RCODE_SERVFAIL);
1681 			ns->done_pside6 = 1;
1682 			query_count++;
1683 		}
1684 		if(ie->supports_ipv4 && !ns->done_pside4) {
1685 			/* Send the A request. */
1686 			if(!generate_parentside_target_query(qstate, iq, id,
1687 				ns->name, ns->namelen,
1688 				LDNS_RR_TYPE_A, iq->qchase.qclass))
1689 				return error_response(qstate, id,
1690 					LDNS_RCODE_SERVFAIL);
1691 			ns->done_pside4 = 1;
1692 			query_count++;
1693 		}
1694 		if(query_count != 0) { /* suspend to await results */
1695 			verbose(VERB_ALGO, "try parent-side glue lookup");
1696 			iq->num_target_queries += query_count;
1697 			target_count_increase(iq, query_count);
1698 			qstate->ext_state[id] = module_wait_subquery;
1699 			return 0;
1700 		}
1701 	}
1702 
1703 	/* if this was a parent-side glue query itself, then store that
1704 	 * failure in cache. */
1705 	if(!qstate->no_cache_store && iq->query_for_pside_glue
1706 		&& !iq->pside_glue)
1707 			iter_store_parentside_neg(qstate->env, &qstate->qinfo,
1708 				iq->deleg_msg?iq->deleg_msg->rep:
1709 				(iq->response?iq->response->rep:NULL));
1710 
1711 	verbose(VERB_QUERY, "out of query targets -- returning SERVFAIL");
1712 	/* fail -- no more targets, no more hope of targets, no hope
1713 	 * of a response. */
1714 	return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
1715 }
1716 
1717 /**
1718  * Try to find the NS record set that will resolve a qtype DS query. Due
1719  * to grandparent/grandchild reasons we did not get a proper lookup right
1720  * away.  We need to create type NS queries until we get the right parent
1721  * for this lookup.  We remove labels from the query to find the right point.
1722  * If we end up at the old dp name, then there is no solution.
1723  *
1724  * @param qstate: query state.
1725  * @param iq: iterator query state.
1726  * @param id: module id.
1727  * @return true if the event requires more immediate processing, false if
1728  *         not. This is generally only true when forwarding the request to
1729  *         the final state (i.e., on answer).
1730  */
1731 static int
1732 processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id)
1733 {
1734 	struct module_qstate* subq = NULL;
1735 	verbose(VERB_ALGO, "processDSNSFind");
1736 
1737 	if(!iq->dsns_point) {
1738 		/* initialize */
1739 		iq->dsns_point = iq->qchase.qname;
1740 		iq->dsns_point_len = iq->qchase.qname_len;
1741 	}
1742 	/* robustcheck for internal error: we are not underneath the dp */
1743 	if(!dname_subdomain_c(iq->dsns_point, iq->dp->name)) {
1744 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
1745 	}
1746 
1747 	/* go up one (more) step, until we hit the dp, if so, end */
1748 	dname_remove_label(&iq->dsns_point, &iq->dsns_point_len);
1749 	if(query_dname_compare(iq->dsns_point, iq->dp->name) == 0) {
1750 		/* there was no inbetween nameserver, use the old delegation
1751 		 * point again.  And this time, because dsns_point is nonNULL
1752 		 * we are going to accept the (bad) result */
1753 		iq->state = QUERYTARGETS_STATE;
1754 		return 1;
1755 	}
1756 	iq->state = DSNS_FIND_STATE;
1757 
1758 	/* spawn NS lookup (validation not needed, this is for DS lookup) */
1759 	log_nametypeclass(VERB_ALGO, "fetch nameservers",
1760 		iq->dsns_point, LDNS_RR_TYPE_NS, iq->qchase.qclass);
1761 	if(!generate_sub_request(iq->dsns_point, iq->dsns_point_len,
1762 		LDNS_RR_TYPE_NS, iq->qchase.qclass, qstate, id, iq,
1763 		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0)) {
1764 		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
1765 	}
1766 
1767 	return 0;
1768 }
1769 
1770 /**
1771  * This is the request event state where the request will be sent to one of
1772  * its current query targets. This state also handles issuing target lookup
1773  * queries for missing target IP addresses. Queries typically iterate on
1774  * this state, both when they are just trying different targets for a given
1775  * delegation point, and when they change delegation points. This state
1776  * roughly corresponds to RFC 1034 algorithm steps 3 and 4.
1777  *
1778  * @param qstate: query state.
1779  * @param iq: iterator query state.
1780  * @param ie: iterator shared global environment.
1781  * @param id: module id.
1782  * @return true if the event requires more request processing immediately,
1783  *         false if not. This state only returns true when it is generating
1784  *         a SERVFAIL response because the query has hit a dead end.
1785  */
1786 static int
1787 processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
1788 	struct iter_env* ie, int id)
1789 {
1790 	int tf_policy;
1791 	struct delegpt_addr* target;
1792 	struct outbound_entry* outq;
1793 
1794 	/* NOTE: a request will encounter this state for each target it
1795 	 * needs to send a query to. That is, at least one per referral,
1796 	 * more if some targets timeout or return throwaway answers. */
1797 
1798 	log_query_info(VERB_QUERY, "processQueryTargets:", &qstate->qinfo);
1799 	verbose(VERB_ALGO, "processQueryTargets: targetqueries %d, "
1800 		"currentqueries %d sentcount %d", iq->num_target_queries,
1801 		iq->num_current_queries, iq->sent_count);
1802 
1803 	/* Make sure that we haven't run away */
1804 	/* FIXME: is this check even necessary? */
1805 	if(iq->referral_count > MAX_REFERRAL_COUNT) {
1806 		verbose(VERB_QUERY, "request has exceeded the maximum "
1807 			"number of referrrals with %d", iq->referral_count);
1808 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
1809 	}
1810 	if(iq->sent_count > MAX_SENT_COUNT) {
1811 		verbose(VERB_QUERY, "request has exceeded the maximum "
1812 			"number of sends with %d", iq->sent_count);
1813 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
1814 	}
1815 
1816 	/* Make sure we have a delegation point, otherwise priming failed
1817 	 * or another failure occurred */
1818 	if(!iq->dp) {
1819 		verbose(VERB_QUERY, "Failed to get a delegation, giving up");
1820 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
1821 	}
1822 	if(!ie->supports_ipv6)
1823 		delegpt_no_ipv6(iq->dp);
1824 	if(!ie->supports_ipv4)
1825 		delegpt_no_ipv4(iq->dp);
1826 	delegpt_log(VERB_ALGO, iq->dp);
1827 
1828 	if(iq->num_current_queries>0) {
1829 		/* already busy answering a query, this restart is because
1830 		 * more delegpt addrs became available, wait for existing
1831 		 * query. */
1832 		verbose(VERB_ALGO, "woke up, but wait for outstanding query");
1833 		qstate->ext_state[id] = module_wait_reply;
1834 		return 0;
1835 	}
1836 
1837 	tf_policy = 0;
1838 	/* < not <=, because although the array is large enough for <=, the
1839 	 * generated query will immediately be discarded due to depth and
1840 	 * that servfail is cached, which is not good as opportunism goes. */
1841 	if(iq->depth < ie->max_dependency_depth
1842 		&& iq->sent_count < TARGET_FETCH_STOP) {
1843 		tf_policy = ie->target_fetch_policy[iq->depth];
1844 	}
1845 
1846 	/* if in 0x20 fallback get as many targets as possible */
1847 	if(iq->caps_fallback) {
1848 		int extra = 0;
1849 		size_t naddr, nres, navail;
1850 		if(!query_for_targets(qstate, iq, ie, id, -1, &extra)) {
1851 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
1852 		}
1853 		iq->num_target_queries += extra;
1854 		target_count_increase(iq, extra);
1855 		if(iq->num_target_queries > 0) {
1856 			/* wait to get all targets, we want to try em */
1857 			verbose(VERB_ALGO, "wait for all targets for fallback");
1858 			qstate->ext_state[id] = module_wait_reply;
1859 			return 0;
1860 		}
1861 		/* did we do enough fallback queries already? */
1862 		delegpt_count_addr(iq->dp, &naddr, &nres, &navail);
1863 		/* the current caps_server is the number of fallbacks sent.
1864 		 * the original query is one that matched too, so we have
1865 		 * caps_server+1 number of matching queries now */
1866 		if(iq->caps_server+1 >= naddr*3 ||
1867 			iq->caps_server*2+2 >= MAX_SENT_COUNT) {
1868 			/* *2 on sentcount check because ipv6 may fail */
1869 			/* we're done, process the response */
1870 			verbose(VERB_ALGO, "0x20 fallback had %d responses "
1871 				"match for %d wanted, done.",
1872 				(int)iq->caps_server+1, (int)naddr*3);
1873 			iq->response = iq->caps_response;
1874 			iq->caps_fallback = 0;
1875 			iter_dec_attempts(iq->dp, 3); /* space for fallback */
1876 			iq->num_current_queries++; /* RespState decrements it*/
1877 			iq->referral_count++; /* make sure we don't loop */
1878 			iq->sent_count = 0;
1879 			iq->state = QUERY_RESP_STATE;
1880 			return 1;
1881 		}
1882 		verbose(VERB_ALGO, "0x20 fallback number %d",
1883 			(int)iq->caps_server);
1884 
1885 	/* if there is a policy to fetch missing targets
1886 	 * opportunistically, do it. we rely on the fact that once a
1887 	 * query (or queries) for a missing name have been issued,
1888 	 * they will not show up again. */
1889 	} else if(tf_policy != 0) {
1890 		int extra = 0;
1891 		verbose(VERB_ALGO, "attempt to get extra %d targets",
1892 			tf_policy);
1893 		(void)query_for_targets(qstate, iq, ie, id, tf_policy, &extra);
1894 		/* errors ignored, these targets are not strictly necessary for
1895 		 * this result, we do not have to reply with SERVFAIL */
1896 		iq->num_target_queries += extra;
1897 		target_count_increase(iq, extra);
1898 	}
1899 
1900 	/* Add the current set of unused targets to our queue. */
1901 	delegpt_add_unused_targets(iq->dp);
1902 
1903 	/* Select the next usable target, filtering out unsuitable targets. */
1904 	target = iter_server_selection(ie, qstate->env, iq->dp,
1905 		iq->dp->name, iq->dp->namelen, iq->qchase.qtype,
1906 		&iq->dnssec_lame_query, &iq->chase_to_rd,
1907 		iq->num_target_queries, qstate->blacklist);
1908 
1909 	/* If no usable target was selected... */
1910 	if(!target) {
1911 		/* Here we distinguish between three states: generate a new
1912 		 * target query, just wait, or quit (with a SERVFAIL).
1913 		 * We have the following information: number of active
1914 		 * target queries, number of active current queries,
1915 		 * the presence of missing targets at this delegation
1916 		 * point, and the given query target policy. */
1917 
1918 		/* Check for the wait condition. If this is true, then
1919 		 * an action must be taken. */
1920 		if(iq->num_target_queries==0 && iq->num_current_queries==0) {
1921 			/* If there is nothing to wait for, then we need
1922 			 * to distinguish between generating (a) new target
1923 			 * query, or failing. */
1924 			if(delegpt_count_missing_targets(iq->dp) > 0) {
1925 				int qs = 0;
1926 				verbose(VERB_ALGO, "querying for next "
1927 					"missing target");
1928 				if(!query_for_targets(qstate, iq, ie, id,
1929 					1, &qs)) {
1930 					return error_response(qstate, id,
1931 						LDNS_RCODE_SERVFAIL);
1932 				}
1933 				if(qs == 0 &&
1934 				   delegpt_count_missing_targets(iq->dp) == 0){
1935 					/* it looked like there were missing
1936 					 * targets, but they did not turn up.
1937 					 * Try the bad choices again (if any),
1938 					 * when we get back here missing==0,
1939 					 * so this is not a loop. */
1940 					return 1;
1941 				}
1942 				iq->num_target_queries += qs;
1943 				target_count_increase(iq, qs);
1944 			}
1945 			/* Since a target query might have been made, we
1946 			 * need to check again. */
1947 			if(iq->num_target_queries == 0) {
1948 				/* if in capsforid fallback, instead of last
1949 				 * resort, we agree with the current reply
1950 				 * we have (if any) (our count of addrs bad)*/
1951 				if(iq->caps_fallback && iq->caps_reply) {
1952 					/* we're done, process the response */
1953 					verbose(VERB_ALGO, "0x20 fallback had %d responses, "
1954 						"but no more servers except "
1955 						"last resort, done.",
1956 						(int)iq->caps_server+1);
1957 					iq->response = iq->caps_response;
1958 					iq->caps_fallback = 0;
1959 					iter_dec_attempts(iq->dp, 3); /* space for fallback */
1960 					iq->num_current_queries++; /* RespState decrements it*/
1961 					iq->referral_count++; /* make sure we don't loop */
1962 					iq->sent_count = 0;
1963 					iq->state = QUERY_RESP_STATE;
1964 					return 1;
1965 				}
1966 				return processLastResort(qstate, iq, ie, id);
1967 			}
1968 		}
1969 
1970 		/* otherwise, we have no current targets, so submerge
1971 		 * until one of the target or direct queries return. */
1972 		if(iq->num_target_queries>0 && iq->num_current_queries>0) {
1973 			verbose(VERB_ALGO, "no current targets -- waiting "
1974 				"for %d targets to resolve or %d outstanding"
1975 				" queries to respond", iq->num_target_queries,
1976 				iq->num_current_queries);
1977 			qstate->ext_state[id] = module_wait_reply;
1978 		} else if(iq->num_target_queries>0) {
1979 			verbose(VERB_ALGO, "no current targets -- waiting "
1980 				"for %d targets to resolve.",
1981 				iq->num_target_queries);
1982 			qstate->ext_state[id] = module_wait_subquery;
1983 		} else {
1984 			verbose(VERB_ALGO, "no current targets -- waiting "
1985 				"for %d outstanding queries to respond.",
1986 				iq->num_current_queries);
1987 			qstate->ext_state[id] = module_wait_reply;
1988 		}
1989 		return 0;
1990 	}
1991 
1992 	/* if not forwarding, check ratelimits per delegationpoint name */
1993 	if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) {
1994 		if(!infra_ratelimit_inc(qstate->env->infra_cache, iq->dp->name,
1995 			iq->dp->namelen, *qstate->env->now)) {
1996 			verbose(VERB_ALGO, "query exceeded ratelimits");
1997 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
1998 		}
1999 	}
2000 
2001 	if(iq->minimisation_state == INIT_MINIMISE_STATE) {
2002 		/* (Re)set qinfo_out to (new) delegation point, except when
2003 		 * qinfo_out is already a subdomain of dp. This happens when
2004 		 * increasing by more than one label at once (QNAMEs with more
2005 		 * than MAX_MINIMISE_COUNT labels). */
2006 		if(!(iq->qinfo_out.qname_len
2007 			&& dname_subdomain_c(iq->qchase.qname,
2008 				iq->qinfo_out.qname)
2009 			&& dname_subdomain_c(iq->qinfo_out.qname,
2010 				iq->dp->name))) {
2011 			iq->qinfo_out.qname = iq->dp->name;
2012 			iq->qinfo_out.qname_len = iq->dp->namelen;
2013 			iq->qinfo_out.qtype = LDNS_RR_TYPE_A;
2014 			iq->qinfo_out.qclass = iq->qchase.qclass;
2015 			iq->qinfo_out.local_alias = NULL;
2016 			iq->minimise_count = 0;
2017 		}
2018 
2019 		iq->minimisation_state = MINIMISE_STATE;
2020 	}
2021 	if(iq->minimisation_state == MINIMISE_STATE) {
2022 		int qchaselabs = dname_count_labels(iq->qchase.qname);
2023 		int labdiff = qchaselabs -
2024 			dname_count_labels(iq->qinfo_out.qname);
2025 
2026 		iq->qinfo_out.qname = iq->qchase.qname;
2027 		iq->qinfo_out.qname_len = iq->qchase.qname_len;
2028 		iq->minimise_count++;
2029 		iq->minimise_timeout_count = 0;
2030 
2031 		iter_dec_attempts(iq->dp, 1);
2032 
2033 		/* Limit number of iterations for QNAMEs with more
2034 		 * than MAX_MINIMISE_COUNT labels. Send first MINIMISE_ONE_LAB
2035 		 * labels of QNAME always individually.
2036 		 */
2037 		if(qchaselabs > MAX_MINIMISE_COUNT && labdiff > 1 &&
2038 			iq->minimise_count > MINIMISE_ONE_LAB) {
2039 			if(iq->minimise_count < MAX_MINIMISE_COUNT) {
2040 				int multilabs = qchaselabs - 1 -
2041 					MINIMISE_ONE_LAB;
2042 				int extralabs = multilabs /
2043 					MINIMISE_MULTIPLE_LABS;
2044 
2045 				if (MAX_MINIMISE_COUNT - iq->minimise_count >=
2046 					multilabs % MINIMISE_MULTIPLE_LABS)
2047 					/* Default behaviour is to add 1 label
2048 					 * every iteration. Therefore, decrement
2049 					 * the extralabs by 1 */
2050 					extralabs--;
2051 				if (extralabs < labdiff)
2052 					labdiff -= extralabs;
2053 				else
2054 					labdiff = 1;
2055 			}
2056 			/* Last minimised iteration, send all labels with
2057 			 * QTYPE=NS */
2058 			else
2059 				labdiff = 1;
2060 		}
2061 
2062 		if(labdiff > 1) {
2063 			verbose(VERB_QUERY, "removing %d labels", labdiff-1);
2064 			dname_remove_labels(&iq->qinfo_out.qname,
2065 				&iq->qinfo_out.qname_len,
2066 				labdiff-1);
2067 		}
2068 		if(labdiff < 1 || (labdiff < 2
2069 			&& (iq->qchase.qtype == LDNS_RR_TYPE_DS
2070 			|| iq->qchase.qtype == LDNS_RR_TYPE_A)))
2071 			/* Stop minimising this query, resolve "as usual" */
2072 			iq->minimisation_state = DONOT_MINIMISE_STATE;
2073 		else if(!qstate->no_cache_lookup) {
2074 			struct dns_msg* msg = dns_cache_lookup(qstate->env,
2075 				iq->qinfo_out.qname, iq->qinfo_out.qname_len,
2076 				iq->qinfo_out.qtype, iq->qinfo_out.qclass,
2077 				qstate->query_flags, qstate->region,
2078 				qstate->env->scratch);
2079 			if(msg && msg->rep->an_numrrsets == 0
2080 				&& FLAGS_GET_RCODE(msg->rep->flags) ==
2081 				LDNS_RCODE_NOERROR)
2082 				/* no need to send query if it is already
2083 				 * cached as NOERROR/NODATA */
2084 				return 1;
2085 		}
2086 	}
2087 	if(iq->minimisation_state == SKIP_MINIMISE_STATE) {
2088 		iq->minimise_timeout_count++;
2089 		if(iq->minimise_timeout_count < MAX_MINIMISE_TIMEOUT_COUNT)
2090 			/* Do not increment qname, continue incrementing next
2091 			 * iteration */
2092 			iq->minimisation_state = MINIMISE_STATE;
2093 		else if(!qstate->env->cfg->qname_minimisation_strict)
2094 			/* Too many time-outs detected for this QNAME and QTYPE.
2095 			 * We give up, disable QNAME minimisation. */
2096 			iq->minimisation_state = DONOT_MINIMISE_STATE;
2097 	}
2098 	if(iq->minimisation_state == DONOT_MINIMISE_STATE)
2099 		iq->qinfo_out = iq->qchase;
2100 
2101 	/* We have a valid target. */
2102 	if(verbosity >= VERB_QUERY) {
2103 		log_query_info(VERB_QUERY, "sending query:", &iq->qinfo_out);
2104 		log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name,
2105 			&target->addr, target->addrlen);
2106 		verbose(VERB_ALGO, "dnssec status: %s%s",
2107 			iq->dnssec_expected?"expected": "not expected",
2108 			iq->dnssec_lame_query?" but lame_query anyway": "");
2109 	}
2110 	fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
2111 	outq = (*qstate->env->send_query)(&iq->qinfo_out,
2112 		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0),
2113 		/* unset CD if to forwarder(RD set) and not dnssec retry
2114 		 * (blacklist nonempty) and no trust-anchors are configured
2115 		 * above the qname or on the first attempt when dnssec is on */
2116 		EDNS_DO| ((iq->chase_to_rd||(iq->chase_flags&BIT_RD)!=0)&&
2117 		!qstate->blacklist&&(!iter_indicates_dnssec_fwd(qstate->env,
2118 		&iq->qinfo_out)||target->attempts==1)?0:BIT_CD),
2119 		iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted(
2120 		ie, iq), &target->addr, target->addrlen,
2121 		iq->dp->name, iq->dp->namelen,
2122 		(iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream), qstate);
2123 	if(!outq) {
2124 		log_addr(VERB_DETAIL, "error sending query to auth server",
2125 			&target->addr, target->addrlen);
2126 		if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok)
2127 		    infra_ratelimit_dec(qstate->env->infra_cache, iq->dp->name,
2128 			iq->dp->namelen, *qstate->env->now);
2129 		return next_state(iq, QUERYTARGETS_STATE);
2130 	}
2131 	outbound_list_insert(&iq->outlist, outq);
2132 	iq->num_current_queries++;
2133 	iq->sent_count++;
2134 	qstate->ext_state[id] = module_wait_reply;
2135 
2136 	return 0;
2137 }
2138 
2139 /** find NS rrset in given list */
2140 static struct ub_packed_rrset_key*
2141 find_NS(struct reply_info* rep, size_t from, size_t to)
2142 {
2143 	size_t i;
2144 	for(i=from; i<to; i++) {
2145 		if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS)
2146 			return rep->rrsets[i];
2147 	}
2148 	return NULL;
2149 }
2150 
2151 
2152 /**
2153  * Process the query response. All queries end up at this state first. This
2154  * process generally consists of analyzing the response and routing the
2155  * event to the next state (either bouncing it back to a request state, or
2156  * terminating the processing for this event).
2157  *
2158  * @param qstate: query state.
2159  * @param iq: iterator query state.
2160  * @param id: module id.
2161  * @return true if the event requires more immediate processing, false if
2162  *         not. This is generally only true when forwarding the request to
2163  *         the final state (i.e., on answer).
2164  */
2165 static int
2166 processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
2167 	int id)
2168 {
2169 	int dnsseclame = 0;
2170 	enum response_type type;
2171 	iq->num_current_queries--;
2172 	if(iq->response == NULL) {
2173 		/* Don't increment qname when QNAME minimisation is enabled */
2174 		if(qstate->env->cfg->qname_minimisation)
2175 			iq->minimisation_state = SKIP_MINIMISE_STATE;
2176 		iq->chase_to_rd = 0;
2177 		iq->dnssec_lame_query = 0;
2178 		verbose(VERB_ALGO, "query response was timeout");
2179 		return next_state(iq, QUERYTARGETS_STATE);
2180 	}
2181 	type = response_type_from_server(
2182 		(int)((iq->chase_flags&BIT_RD) || iq->chase_to_rd),
2183 		iq->response, &iq->qchase, iq->dp);
2184 	iq->chase_to_rd = 0;
2185 	if(type == RESPONSE_TYPE_REFERRAL && (iq->chase_flags&BIT_RD)) {
2186 		/* When forwarding (RD bit is set), we handle referrals
2187 		 * differently. No queries should be sent elsewhere */
2188 		type = RESPONSE_TYPE_ANSWER;
2189 	}
2190 	if(!qstate->env->cfg->disable_dnssec_lame_check && iq->dnssec_expected
2191                 && !iq->dnssec_lame_query &&
2192 		!(iq->chase_flags&BIT_RD)
2193 		&& iq->sent_count < DNSSEC_LAME_DETECT_COUNT
2194 		&& type != RESPONSE_TYPE_LAME
2195 		&& type != RESPONSE_TYPE_REC_LAME
2196 		&& type != RESPONSE_TYPE_THROWAWAY
2197 		&& type != RESPONSE_TYPE_UNTYPED) {
2198 		/* a possible answer, see if it is missing DNSSEC */
2199 		/* but not when forwarding, so we dont mark fwder lame */
2200 		if(!iter_msg_has_dnssec(iq->response)) {
2201 			/* Mark this address as dnsseclame in this dp,
2202 			 * because that will make serverselection disprefer
2203 			 * it, but also, once it is the only final option,
2204 			 * use dnssec-lame-bypass if it needs to query there.*/
2205 			if(qstate->reply) {
2206 				struct delegpt_addr* a = delegpt_find_addr(
2207 					iq->dp, &qstate->reply->addr,
2208 					qstate->reply->addrlen);
2209 				if(a) a->dnsseclame = 1;
2210 			}
2211 			/* test the answer is from the zone we expected,
2212 		 	 * otherwise, (due to parent,child on same server), we
2213 		 	 * might mark the server,zone lame inappropriately */
2214 			if(!iter_msg_from_zone(iq->response, iq->dp, type,
2215 				iq->qchase.qclass))
2216 				qstate->reply = NULL;
2217 			type = RESPONSE_TYPE_LAME;
2218 			dnsseclame = 1;
2219 		}
2220 	} else iq->dnssec_lame_query = 0;
2221 	/* see if referral brings us close to the target */
2222 	if(type == RESPONSE_TYPE_REFERRAL) {
2223 		struct ub_packed_rrset_key* ns = find_NS(
2224 			iq->response->rep, iq->response->rep->an_numrrsets,
2225 			iq->response->rep->an_numrrsets
2226 			+ iq->response->rep->ns_numrrsets);
2227 		if(!ns) ns = find_NS(iq->response->rep, 0,
2228 				iq->response->rep->an_numrrsets);
2229 		if(!ns || !dname_strict_subdomain_c(ns->rk.dname, iq->dp->name)
2230 			|| !dname_subdomain_c(iq->qchase.qname, ns->rk.dname)){
2231 			verbose(VERB_ALGO, "bad referral, throwaway");
2232 			type = RESPONSE_TYPE_THROWAWAY;
2233 		} else
2234 			iter_scrub_ds(iq->response, ns, iq->dp->name);
2235 	} else iter_scrub_ds(iq->response, NULL, NULL);
2236 
2237 	/* handle each of the type cases */
2238 	if(type == RESPONSE_TYPE_ANSWER) {
2239 		/* ANSWER type responses terminate the query algorithm,
2240 		 * so they sent on their */
2241 		if(verbosity >= VERB_DETAIL) {
2242 			verbose(VERB_DETAIL, "query response was %s",
2243 				FLAGS_GET_RCODE(iq->response->rep->flags)
2244 				==LDNS_RCODE_NXDOMAIN?"NXDOMAIN ANSWER":
2245 				(iq->response->rep->an_numrrsets?"ANSWER":
2246 				"nodata ANSWER"));
2247 		}
2248 		/* if qtype is DS, check we have the right level of answer,
2249 		 * like grandchild answer but we need the middle, reject it */
2250 		if(iq->qchase.qtype == LDNS_RR_TYPE_DS && !iq->dsns_point
2251 			&& !(iq->chase_flags&BIT_RD)
2252 			&& iter_ds_toolow(iq->response, iq->dp)
2253 			&& iter_dp_cangodown(&iq->qchase, iq->dp)) {
2254 			/* close down outstanding requests to be discarded */
2255 			outbound_list_clear(&iq->outlist);
2256 			iq->num_current_queries = 0;
2257 			fptr_ok(fptr_whitelist_modenv_detach_subs(
2258 				qstate->env->detach_subs));
2259 			(*qstate->env->detach_subs)(qstate);
2260 			iq->num_target_queries = 0;
2261 			return processDSNSFind(qstate, iq, id);
2262 		}
2263 		if(!qstate->no_cache_store)
2264 			iter_dns_store(qstate->env, &iq->response->qinfo,
2265 				iq->response->rep, 0, qstate->prefetch_leeway,
2266 				iq->dp&&iq->dp->has_parent_side_NS,
2267 				qstate->region, qstate->query_flags);
2268 		/* close down outstanding requests to be discarded */
2269 		outbound_list_clear(&iq->outlist);
2270 		iq->num_current_queries = 0;
2271 		fptr_ok(fptr_whitelist_modenv_detach_subs(
2272 			qstate->env->detach_subs));
2273 		(*qstate->env->detach_subs)(qstate);
2274 		iq->num_target_queries = 0;
2275 		if(qstate->reply)
2276 			sock_list_insert(&qstate->reply_origin,
2277 				&qstate->reply->addr, qstate->reply->addrlen,
2278 				qstate->region);
2279 		if(iq->minimisation_state != DONOT_MINIMISE_STATE) {
2280 			if(FLAGS_GET_RCODE(iq->response->rep->flags) !=
2281 				LDNS_RCODE_NOERROR) {
2282 				if(qstate->env->cfg->qname_minimisation_strict)
2283 					return final_state(iq);
2284 				/* Best effort qname-minimisation.
2285 				 * Stop minimising and send full query when
2286 				 * RCODE is not NOERROR. */
2287 				iq->minimisation_state = DONOT_MINIMISE_STATE;
2288 			}
2289 			if(FLAGS_GET_RCODE(iq->response->rep->flags) ==
2290 				LDNS_RCODE_NXDOMAIN) {
2291 				/* Stop resolving when NXDOMAIN is DNSSEC
2292 				 * signed. Based on assumption that namservers
2293 				 * serving signed zones do not return NXDOMAIN
2294 				 * for empty-non-terminals. */
2295 				if(iq->dnssec_expected)
2296 					return final_state(iq);
2297 				/* Make subrequest to validate intermediate
2298 				 * NXDOMAIN if harden-below-nxdomain is
2299 				 * enabled. */
2300 				if(qstate->env->cfg->harden_below_nxdomain) {
2301 					struct module_qstate* subq = NULL;
2302 					log_query_info(VERB_QUERY,
2303 						"schedule NXDOMAIN validation:",
2304 						&iq->response->qinfo);
2305 					if(!generate_sub_request(
2306 						iq->response->qinfo.qname,
2307 						iq->response->qinfo.qname_len,
2308 						iq->response->qinfo.qtype,
2309 						iq->response->qinfo.qclass,
2310 						qstate, id, iq,
2311 						INIT_REQUEST_STATE,
2312 						FINISHED_STATE, &subq, 1))
2313 						verbose(VERB_ALGO,
2314 						"could not validate NXDOMAIN "
2315 						"response");
2316 				}
2317 			}
2318 			return next_state(iq, QUERYTARGETS_STATE);
2319 		}
2320 		return final_state(iq);
2321 	} else if(type == RESPONSE_TYPE_REFERRAL) {
2322 		/* REFERRAL type responses get a reset of the
2323 		 * delegation point, and back to the QUERYTARGETS_STATE. */
2324 		verbose(VERB_DETAIL, "query response was REFERRAL");
2325 
2326 		if(!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok) {
2327 			/* we have a referral, no ratelimit, we can send
2328 			 * our queries to the given name */
2329 			infra_ratelimit_dec(qstate->env->infra_cache,
2330 				iq->dp->name, iq->dp->namelen,
2331 				*qstate->env->now);
2332 		}
2333 
2334 		/* if hardened, only store referral if we asked for it */
2335 		if(!qstate->no_cache_store &&
2336 		(!qstate->env->cfg->harden_referral_path ||
2337 		    (  qstate->qinfo.qtype == LDNS_RR_TYPE_NS
2338 			&& (qstate->query_flags&BIT_RD)
2339 			&& !(qstate->query_flags&BIT_CD)
2340 			   /* we know that all other NS rrsets are scrubbed
2341 			    * away, thus on referral only one is left.
2342 			    * see if that equals the query name... */
2343 			&& ( /* auth section, but sometimes in answer section*/
2344 			  reply_find_rrset_section_ns(iq->response->rep,
2345 				iq->qchase.qname, iq->qchase.qname_len,
2346 				LDNS_RR_TYPE_NS, iq->qchase.qclass)
2347 			  || reply_find_rrset_section_an(iq->response->rep,
2348 				iq->qchase.qname, iq->qchase.qname_len,
2349 				LDNS_RR_TYPE_NS, iq->qchase.qclass)
2350 			  )
2351 		    ))) {
2352 			/* Store the referral under the current query */
2353 			/* no prefetch-leeway, since its not the answer */
2354 			iter_dns_store(qstate->env, &iq->response->qinfo,
2355 				iq->response->rep, 1, 0, 0, NULL, 0);
2356 			if(iq->store_parent_NS)
2357 				iter_store_parentside_NS(qstate->env,
2358 					iq->response->rep);
2359 			if(qstate->env->neg_cache)
2360 				val_neg_addreferral(qstate->env->neg_cache,
2361 					iq->response->rep, iq->dp->name);
2362 		}
2363 		/* store parent-side-in-zone-glue, if directly queried for */
2364 		if(!qstate->no_cache_store && iq->query_for_pside_glue
2365 			&& !iq->pside_glue) {
2366 				iq->pside_glue = reply_find_rrset(iq->response->rep,
2367 					iq->qchase.qname, iq->qchase.qname_len,
2368 					iq->qchase.qtype, iq->qchase.qclass);
2369 				if(iq->pside_glue) {
2370 					log_rrset_key(VERB_ALGO, "found parent-side "
2371 						"glue", iq->pside_glue);
2372 					iter_store_parentside_rrset(qstate->env,
2373 						iq->pside_glue);
2374 				}
2375 		}
2376 
2377 		/* Reset the event state, setting the current delegation
2378 		 * point to the referral. */
2379 		iq->deleg_msg = iq->response;
2380 		iq->dp = delegpt_from_message(iq->response, qstate->region);
2381 		if (qstate->env->cfg->qname_minimisation)
2382 			iq->minimisation_state = INIT_MINIMISE_STATE;
2383 		if(!iq->dp)
2384 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
2385 		if(!cache_fill_missing(qstate->env, iq->qchase.qclass,
2386 			qstate->region, iq->dp))
2387 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
2388 		if(iq->store_parent_NS && query_dname_compare(iq->dp->name,
2389 			iq->store_parent_NS->name) == 0)
2390 			iter_merge_retry_counts(iq->dp, iq->store_parent_NS);
2391 		delegpt_log(VERB_ALGO, iq->dp);
2392 		/* Count this as a referral. */
2393 		iq->referral_count++;
2394 		iq->sent_count = 0;
2395 		/* see if the next dp is a trust anchor, or a DS was sent
2396 		 * along, indicating dnssec is expected for next zone */
2397 		iq->dnssec_expected = iter_indicates_dnssec(qstate->env,
2398 			iq->dp, iq->response, iq->qchase.qclass);
2399 		/* if dnssec, validating then also fetch the key for the DS */
2400 		if(iq->dnssec_expected && qstate->env->cfg->prefetch_key &&
2401 			!(qstate->query_flags&BIT_CD))
2402 			generate_dnskey_prefetch(qstate, iq, id);
2403 
2404 		/* spawn off NS and addr to auth servers for the NS we just
2405 		 * got in the referral. This gets authoritative answer
2406 		 * (answer section trust level) rrset.
2407 		 * right after, we detach the subs, answer goes to cache. */
2408 		if(qstate->env->cfg->harden_referral_path)
2409 			generate_ns_check(qstate, iq, id);
2410 
2411 		/* stop current outstanding queries.
2412 		 * FIXME: should the outstanding queries be waited for and
2413 		 * handled? Say by a subquery that inherits the outbound_entry.
2414 		 */
2415 		outbound_list_clear(&iq->outlist);
2416 		iq->num_current_queries = 0;
2417 		fptr_ok(fptr_whitelist_modenv_detach_subs(
2418 			qstate->env->detach_subs));
2419 		(*qstate->env->detach_subs)(qstate);
2420 		iq->num_target_queries = 0;
2421 		verbose(VERB_ALGO, "cleared outbound list for next round");
2422 		return next_state(iq, QUERYTARGETS_STATE);
2423 	} else if(type == RESPONSE_TYPE_CNAME) {
2424 		uint8_t* sname = NULL;
2425 		size_t snamelen = 0;
2426 		/* CNAME type responses get a query restart (i.e., get a
2427 		 * reset of the query state and go back to INIT_REQUEST_STATE).
2428 		 */
2429 		verbose(VERB_DETAIL, "query response was CNAME");
2430 		if(verbosity >= VERB_ALGO)
2431 			log_dns_msg("cname msg", &iq->response->qinfo,
2432 				iq->response->rep);
2433 		/* if qtype is DS, check we have the right level of answer,
2434 		 * like grandchild answer but we need the middle, reject it */
2435 		if(iq->qchase.qtype == LDNS_RR_TYPE_DS && !iq->dsns_point
2436 			&& !(iq->chase_flags&BIT_RD)
2437 			&& iter_ds_toolow(iq->response, iq->dp)
2438 			&& iter_dp_cangodown(&iq->qchase, iq->dp)) {
2439 			outbound_list_clear(&iq->outlist);
2440 			iq->num_current_queries = 0;
2441 			fptr_ok(fptr_whitelist_modenv_detach_subs(
2442 				qstate->env->detach_subs));
2443 			(*qstate->env->detach_subs)(qstate);
2444 			iq->num_target_queries = 0;
2445 			return processDSNSFind(qstate, iq, id);
2446 		}
2447 		/* Process the CNAME response. */
2448 		if(!handle_cname_response(qstate, iq, iq->response,
2449 			&sname, &snamelen))
2450 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
2451 		/* cache the CNAME response under the current query */
2452 		/* NOTE : set referral=1, so that rrsets get stored but not
2453 		 * the partial query answer (CNAME only). */
2454 		/* prefetchleeway applied because this updates answer parts */
2455 		if(!qstate->no_cache_store)
2456 			iter_dns_store(qstate->env, &iq->response->qinfo,
2457 				iq->response->rep, 1, qstate->prefetch_leeway,
2458 				iq->dp&&iq->dp->has_parent_side_NS, NULL,
2459 				qstate->query_flags);
2460 		/* set the current request's qname to the new value. */
2461 		iq->qchase.qname = sname;
2462 		iq->qchase.qname_len = snamelen;
2463 		if (qstate->env->cfg->qname_minimisation)
2464 			iq->minimisation_state = INIT_MINIMISE_STATE;
2465 		/* Clear the query state, since this is a query restart. */
2466 		iq->deleg_msg = NULL;
2467 		iq->dp = NULL;
2468 		iq->dsns_point = NULL;
2469 		/* Note the query restart. */
2470 		iq->query_restart_count++;
2471 		iq->sent_count = 0;
2472 
2473 		/* stop current outstanding queries.
2474 		 * FIXME: should the outstanding queries be waited for and
2475 		 * handled? Say by a subquery that inherits the outbound_entry.
2476 		 */
2477 		outbound_list_clear(&iq->outlist);
2478 		iq->num_current_queries = 0;
2479 		fptr_ok(fptr_whitelist_modenv_detach_subs(
2480 			qstate->env->detach_subs));
2481 		(*qstate->env->detach_subs)(qstate);
2482 		iq->num_target_queries = 0;
2483 		if(qstate->reply)
2484 			sock_list_insert(&qstate->reply_origin,
2485 				&qstate->reply->addr, qstate->reply->addrlen,
2486 				qstate->region);
2487 		verbose(VERB_ALGO, "cleared outbound list for query restart");
2488 		/* go to INIT_REQUEST_STATE for new qname. */
2489 		return next_state(iq, INIT_REQUEST_STATE);
2490 	} else if(type == RESPONSE_TYPE_LAME) {
2491 		/* Cache the LAMEness. */
2492 		verbose(VERB_DETAIL, "query response was %sLAME",
2493 			dnsseclame?"DNSSEC ":"");
2494 		if(!dname_subdomain_c(iq->qchase.qname, iq->dp->name)) {
2495 			log_err("mark lame: mismatch in qname and dpname");
2496 			/* throwaway this reply below */
2497 		} else if(qstate->reply) {
2498 			/* need addr for lameness cache, but we may have
2499 			 * gotten this from cache, so test to be sure */
2500 			if(!infra_set_lame(qstate->env->infra_cache,
2501 				&qstate->reply->addr, qstate->reply->addrlen,
2502 				iq->dp->name, iq->dp->namelen,
2503 				*qstate->env->now, dnsseclame, 0,
2504 				iq->qchase.qtype))
2505 				log_err("mark host lame: out of memory");
2506 		}
2507 	} else if(type == RESPONSE_TYPE_REC_LAME) {
2508 		/* Cache the LAMEness. */
2509 		verbose(VERB_DETAIL, "query response REC_LAME: "
2510 			"recursive but not authoritative server");
2511 		if(!dname_subdomain_c(iq->qchase.qname, iq->dp->name)) {
2512 			log_err("mark rec_lame: mismatch in qname and dpname");
2513 			/* throwaway this reply below */
2514 		} else if(qstate->reply) {
2515 			/* need addr for lameness cache, but we may have
2516 			 * gotten this from cache, so test to be sure */
2517 			verbose(VERB_DETAIL, "mark as REC_LAME");
2518 			if(!infra_set_lame(qstate->env->infra_cache,
2519 				&qstate->reply->addr, qstate->reply->addrlen,
2520 				iq->dp->name, iq->dp->namelen,
2521 				*qstate->env->now, 0, 1, iq->qchase.qtype))
2522 				log_err("mark host lame: out of memory");
2523 		}
2524 	} else if(type == RESPONSE_TYPE_THROWAWAY) {
2525 		/* LAME and THROWAWAY responses are handled the same way.
2526 		 * In this case, the event is just sent directly back to
2527 		 * the QUERYTARGETS_STATE without resetting anything,
2528 		 * because, clearly, the next target must be tried. */
2529 		verbose(VERB_DETAIL, "query response was THROWAWAY");
2530 	} else {
2531 		log_warn("A query response came back with an unknown type: %d",
2532 			(int)type);
2533 	}
2534 
2535 	/* LAME, THROWAWAY and "unknown" all end up here.
2536 	 * Recycle to the QUERYTARGETS state to hopefully try a
2537 	 * different target. */
2538 	if (qstate->env->cfg->qname_minimisation &&
2539 		!qstate->env->cfg->qname_minimisation_strict)
2540 		iq->minimisation_state = DONOT_MINIMISE_STATE;
2541 	return next_state(iq, QUERYTARGETS_STATE);
2542 }
2543 
2544 /**
2545  * Return priming query results to interested super querystates.
2546  *
2547  * Sets the delegation point and delegation message (not nonRD queries).
2548  * This is a callback from walk_supers.
2549  *
2550  * @param qstate: priming query state that finished.
2551  * @param id: module id.
2552  * @param forq: the qstate for which priming has been done.
2553  */
2554 static void
2555 prime_supers(struct module_qstate* qstate, int id, struct module_qstate* forq)
2556 {
2557 	struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id];
2558 	struct delegpt* dp = NULL;
2559 
2560 	log_assert(qstate->is_priming || foriq->wait_priming_stub);
2561 	log_assert(qstate->return_rcode == LDNS_RCODE_NOERROR);
2562 	/* Convert our response to a delegation point */
2563 	dp = delegpt_from_message(qstate->return_msg, forq->region);
2564 	if(!dp) {
2565 		/* if there is no convertable delegation point, then
2566 		 * the ANSWER type was (presumably) a negative answer. */
2567 		verbose(VERB_ALGO, "prime response was not a positive "
2568 			"ANSWER; failing");
2569 		foriq->dp = NULL;
2570 		foriq->state = QUERYTARGETS_STATE;
2571 		return;
2572 	}
2573 
2574 	log_query_info(VERB_DETAIL, "priming successful for", &qstate->qinfo);
2575 	delegpt_log(VERB_ALGO, dp);
2576 	foriq->dp = dp;
2577 	foriq->deleg_msg = dns_copy_msg(qstate->return_msg, forq->region);
2578 	if(!foriq->deleg_msg) {
2579 		log_err("copy prime response: out of memory");
2580 		foriq->dp = NULL;
2581 		foriq->state = QUERYTARGETS_STATE;
2582 		return;
2583 	}
2584 
2585 	/* root priming responses go to init stage 2, priming stub
2586 	 * responses to to stage 3. */
2587 	if(foriq->wait_priming_stub) {
2588 		foriq->state = INIT_REQUEST_3_STATE;
2589 		foriq->wait_priming_stub = 0;
2590 	} else	foriq->state = INIT_REQUEST_2_STATE;
2591 	/* because we are finished, the parent will be reactivated */
2592 }
2593 
2594 /**
2595  * This handles the response to a priming query. This is used to handle both
2596  * root and stub priming responses. This is basically the equivalent of the
2597  * QUERY_RESP_STATE, but will not handle CNAME responses and will treat
2598  * REFERRALs as ANSWERS. It will also update and reactivate the originating
2599  * event.
2600  *
2601  * @param qstate: query state.
2602  * @param id: module id.
2603  * @return true if the event needs more immediate processing, false if not.
2604  *         This state always returns false.
2605  */
2606 static int
2607 processPrimeResponse(struct module_qstate* qstate, int id)
2608 {
2609 	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
2610 	enum response_type type;
2611 	iq->response->rep->flags &= ~(BIT_RD|BIT_RA); /* ignore rec-lame */
2612 	type = response_type_from_server(
2613 		(int)((iq->chase_flags&BIT_RD) || iq->chase_to_rd),
2614 		iq->response, &iq->qchase, iq->dp);
2615 	if(type == RESPONSE_TYPE_ANSWER) {
2616 		qstate->return_rcode = LDNS_RCODE_NOERROR;
2617 		qstate->return_msg = iq->response;
2618 	} else {
2619 		qstate->return_rcode = LDNS_RCODE_SERVFAIL;
2620 		qstate->return_msg = NULL;
2621 	}
2622 
2623 	/* validate the root or stub after priming (if enabled).
2624 	 * This is the same query as the prime query, but with validation.
2625 	 * Now that we are primed, the additional queries that validation
2626 	 * may need can be resolved, such as DLV. */
2627 	if(qstate->env->cfg->harden_referral_path) {
2628 		struct module_qstate* subq = NULL;
2629 		log_nametypeclass(VERB_ALGO, "schedule prime validation",
2630 			qstate->qinfo.qname, qstate->qinfo.qtype,
2631 			qstate->qinfo.qclass);
2632 		if(!generate_sub_request(qstate->qinfo.qname,
2633 			qstate->qinfo.qname_len, qstate->qinfo.qtype,
2634 			qstate->qinfo.qclass, qstate, id, iq,
2635 			INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) {
2636 			verbose(VERB_ALGO, "could not generate prime check");
2637 		}
2638 		generate_a_aaaa_check(qstate, iq, id);
2639 	}
2640 
2641 	/* This event is finished. */
2642 	qstate->ext_state[id] = module_finished;
2643 	return 0;
2644 }
2645 
2646 /**
2647  * Do final processing on responses to target queries. Events reach this
2648  * state after the iterative resolution algorithm terminates. This state is
2649  * responsible for reactiving the original event, and housekeeping related
2650  * to received target responses (caching, updating the current delegation
2651  * point, etc).
2652  * Callback from walk_supers for every super state that is interested in
2653  * the results from this query.
2654  *
2655  * @param qstate: query state.
2656  * @param id: module id.
2657  * @param forq: super query state.
2658  */
2659 static void
2660 processTargetResponse(struct module_qstate* qstate, int id,
2661 	struct module_qstate* forq)
2662 {
2663 	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
2664 	struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id];
2665 	struct ub_packed_rrset_key* rrset;
2666 	struct delegpt_ns* dpns;
2667 	log_assert(qstate->return_rcode == LDNS_RCODE_NOERROR);
2668 
2669 	foriq->state = QUERYTARGETS_STATE;
2670 	log_query_info(VERB_ALGO, "processTargetResponse", &qstate->qinfo);
2671 	log_query_info(VERB_ALGO, "processTargetResponse super", &forq->qinfo);
2672 
2673 	/* Tell the originating event that this target query has finished
2674 	 * (regardless if it succeeded or not). */
2675 	foriq->num_target_queries--;
2676 
2677 	/* check to see if parent event is still interested (in orig name).  */
2678 	if(!foriq->dp) {
2679 		verbose(VERB_ALGO, "subq: parent not interested, was reset");
2680 		return; /* not interested anymore */
2681 	}
2682 	dpns = delegpt_find_ns(foriq->dp, qstate->qinfo.qname,
2683 			qstate->qinfo.qname_len);
2684 	if(!dpns) {
2685 		/* If not interested, just stop processing this event */
2686 		verbose(VERB_ALGO, "subq: parent not interested anymore");
2687 		/* could be because parent was jostled out of the cache,
2688 		   and a new identical query arrived, that does not want it*/
2689 		return;
2690 	}
2691 
2692 	/* if iq->query_for_pside_glue then add the pside_glue (marked lame) */
2693 	if(iq->pside_glue) {
2694 		/* if the pside_glue is NULL, then it could not be found,
2695 		 * the done_pside is already set when created and a cache
2696 		 * entry created in processFinished so nothing to do here */
2697 		log_rrset_key(VERB_ALGO, "add parentside glue to dp",
2698 			iq->pside_glue);
2699 		if(!delegpt_add_rrset(foriq->dp, forq->region,
2700 			iq->pside_glue, 1))
2701 			log_err("out of memory adding pside glue");
2702 	}
2703 
2704 	/* This response is relevant to the current query, so we
2705 	 * add (attempt to add, anyway) this target(s) and reactivate
2706 	 * the original event.
2707 	 * NOTE: we could only look for the AnswerRRset if the
2708 	 * response type was ANSWER. */
2709 	rrset = reply_find_answer_rrset(&iq->qchase, qstate->return_msg->rep);
2710 	if(rrset) {
2711 		/* if CNAMEs have been followed - add new NS to delegpt. */
2712 		/* BTW. RFC 1918 says NS should not have got CNAMEs. Robust. */
2713 		if(!delegpt_find_ns(foriq->dp, rrset->rk.dname,
2714 			rrset->rk.dname_len)) {
2715 			/* if dpns->lame then set newcname ns lame too */
2716 			if(!delegpt_add_ns(foriq->dp, forq->region,
2717 				rrset->rk.dname, dpns->lame))
2718 				log_err("out of memory adding cnamed-ns");
2719 		}
2720 		/* if dpns->lame then set the address(es) lame too */
2721 		if(!delegpt_add_rrset(foriq->dp, forq->region, rrset,
2722 			dpns->lame))
2723 			log_err("out of memory adding targets");
2724 		verbose(VERB_ALGO, "added target response");
2725 		delegpt_log(VERB_ALGO, foriq->dp);
2726 	} else {
2727 		verbose(VERB_ALGO, "iterator TargetResponse failed");
2728 		dpns->resolved = 1; /* fail the target */
2729 	}
2730 }
2731 
2732 /**
2733  * Process response for DS NS Find queries, that attempt to find the delegation
2734  * point where we ask the DS query from.
2735  *
2736  * @param qstate: query state.
2737  * @param id: module id.
2738  * @param forq: super query state.
2739  */
2740 static void
2741 processDSNSResponse(struct module_qstate* qstate, int id,
2742 	struct module_qstate* forq)
2743 {
2744 	struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id];
2745 
2746 	/* if the finished (iq->response) query has no NS set: continue
2747 	 * up to look for the right dp; nothing to change, do DPNSstate */
2748 	if(qstate->return_rcode != LDNS_RCODE_NOERROR)
2749 		return; /* seek further */
2750 	/* find the NS RRset (without allowing CNAMEs) */
2751 	if(!reply_find_rrset(qstate->return_msg->rep, qstate->qinfo.qname,
2752 		qstate->qinfo.qname_len, LDNS_RR_TYPE_NS,
2753 		qstate->qinfo.qclass)){
2754 		return; /* seek further */
2755 	}
2756 
2757 	/* else, store as DP and continue at querytargets */
2758 	foriq->state = QUERYTARGETS_STATE;
2759 	foriq->dp = delegpt_from_message(qstate->return_msg, forq->region);
2760 	if(!foriq->dp) {
2761 		log_err("out of memory in dsns dp alloc");
2762 		return; /* dp==NULL in QUERYTARGETS makes SERVFAIL */
2763 	}
2764 	/* success, go query the querytargets in the new dp (and go down) */
2765 }
2766 
2767 /**
2768  * Process response for qclass=ANY queries for a particular class.
2769  * Append to result or error-exit.
2770  *
2771  * @param qstate: query state.
2772  * @param id: module id.
2773  * @param forq: super query state.
2774  */
2775 static void
2776 processClassResponse(struct module_qstate* qstate, int id,
2777 	struct module_qstate* forq)
2778 {
2779 	struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id];
2780 	struct dns_msg* from = qstate->return_msg;
2781 	log_query_info(VERB_ALGO, "processClassResponse", &qstate->qinfo);
2782 	log_query_info(VERB_ALGO, "processClassResponse super", &forq->qinfo);
2783 	if(qstate->return_rcode != LDNS_RCODE_NOERROR) {
2784 		/* cause servfail for qclass ANY query */
2785 		foriq->response = NULL;
2786 		foriq->state = FINISHED_STATE;
2787 		return;
2788 	}
2789 	/* append result */
2790 	if(!foriq->response) {
2791 		/* allocate the response: copy RCODE, sec_state */
2792 		foriq->response = dns_copy_msg(from, forq->region);
2793 		if(!foriq->response) {
2794 			log_err("malloc failed for qclass ANY response");
2795 			foriq->state = FINISHED_STATE;
2796 			return;
2797 		}
2798 		foriq->response->qinfo.qclass = forq->qinfo.qclass;
2799 		/* qclass ANY does not receive the AA flag on replies */
2800 		foriq->response->rep->authoritative = 0;
2801 	} else {
2802 		struct dns_msg* to = foriq->response;
2803 		/* add _from_ this response _to_ existing collection */
2804 		/* if there are records, copy RCODE */
2805 		/* lower sec_state if this message is lower */
2806 		if(from->rep->rrset_count != 0) {
2807 			size_t n = from->rep->rrset_count+to->rep->rrset_count;
2808 			struct ub_packed_rrset_key** dest, **d;
2809 			/* copy appropriate rcode */
2810 			to->rep->flags = from->rep->flags;
2811 			/* copy rrsets */
2812 			if(from->rep->rrset_count > RR_COUNT_MAX ||
2813 				to->rep->rrset_count > RR_COUNT_MAX) {
2814 				log_err("malloc failed (too many rrsets) in collect ANY");
2815 				foriq->state = FINISHED_STATE;
2816 				return; /* integer overflow protection */
2817 			}
2818 			dest = regional_alloc(forq->region, sizeof(dest[0])*n);
2819 			if(!dest) {
2820 				log_err("malloc failed in collect ANY");
2821 				foriq->state = FINISHED_STATE;
2822 				return;
2823 			}
2824 			d = dest;
2825 			/* copy AN */
2826 			memcpy(dest, to->rep->rrsets, to->rep->an_numrrsets
2827 				* sizeof(dest[0]));
2828 			dest += to->rep->an_numrrsets;
2829 			memcpy(dest, from->rep->rrsets, from->rep->an_numrrsets
2830 				* sizeof(dest[0]));
2831 			dest += from->rep->an_numrrsets;
2832 			/* copy NS */
2833 			memcpy(dest, to->rep->rrsets+to->rep->an_numrrsets,
2834 				to->rep->ns_numrrsets * sizeof(dest[0]));
2835 			dest += to->rep->ns_numrrsets;
2836 			memcpy(dest, from->rep->rrsets+from->rep->an_numrrsets,
2837 				from->rep->ns_numrrsets * sizeof(dest[0]));
2838 			dest += from->rep->ns_numrrsets;
2839 			/* copy AR */
2840 			memcpy(dest, to->rep->rrsets+to->rep->an_numrrsets+
2841 				to->rep->ns_numrrsets,
2842 				to->rep->ar_numrrsets * sizeof(dest[0]));
2843 			dest += to->rep->ar_numrrsets;
2844 			memcpy(dest, from->rep->rrsets+from->rep->an_numrrsets+
2845 				from->rep->ns_numrrsets,
2846 				from->rep->ar_numrrsets * sizeof(dest[0]));
2847 			/* update counts */
2848 			to->rep->rrsets = d;
2849 			to->rep->an_numrrsets += from->rep->an_numrrsets;
2850 			to->rep->ns_numrrsets += from->rep->ns_numrrsets;
2851 			to->rep->ar_numrrsets += from->rep->ar_numrrsets;
2852 			to->rep->rrset_count = n;
2853 		}
2854 		if(from->rep->security < to->rep->security) /* lowest sec */
2855 			to->rep->security = from->rep->security;
2856 		if(from->rep->qdcount != 0) /* insert qd if appropriate */
2857 			to->rep->qdcount = from->rep->qdcount;
2858 		if(from->rep->ttl < to->rep->ttl) /* use smallest TTL */
2859 			to->rep->ttl = from->rep->ttl;
2860 		if(from->rep->prefetch_ttl < to->rep->prefetch_ttl)
2861 			to->rep->prefetch_ttl = from->rep->prefetch_ttl;
2862 	}
2863 	/* are we done? */
2864 	foriq->num_current_queries --;
2865 	if(foriq->num_current_queries == 0)
2866 		foriq->state = FINISHED_STATE;
2867 }
2868 
2869 /**
2870  * Collect class ANY responses and make them into one response.  This
2871  * state is started and it creates queries for all classes (that have
2872  * root hints).  The answers are then collected.
2873  *
2874  * @param qstate: query state.
2875  * @param id: module id.
2876  * @return true if the event needs more immediate processing, false if not.
2877  */
2878 static int
2879 processCollectClass(struct module_qstate* qstate, int id)
2880 {
2881 	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
2882 	struct module_qstate* subq;
2883 	/* If qchase.qclass == 0 then send out queries for all classes.
2884 	 * Otherwise, do nothing (wait for all answers to arrive and the
2885 	 * processClassResponse to put them together, and that moves us
2886 	 * towards the Finished state when done. */
2887 	if(iq->qchase.qclass == 0) {
2888 		uint16_t c = 0;
2889 		iq->qchase.qclass = LDNS_RR_CLASS_ANY;
2890 		while(iter_get_next_root(qstate->env->hints,
2891 			qstate->env->fwds, &c)) {
2892 			/* generate query for this class */
2893 			log_nametypeclass(VERB_ALGO, "spawn collect query",
2894 				qstate->qinfo.qname, qstate->qinfo.qtype, c);
2895 			if(!generate_sub_request(qstate->qinfo.qname,
2896 				qstate->qinfo.qname_len, qstate->qinfo.qtype,
2897 				c, qstate, id, iq, INIT_REQUEST_STATE,
2898 				FINISHED_STATE, &subq,
2899 				(int)!(qstate->query_flags&BIT_CD))) {
2900 				return error_response(qstate, id,
2901 					LDNS_RCODE_SERVFAIL);
2902 			}
2903 			/* ignore subq, no special init required */
2904 			iq->num_current_queries ++;
2905 			if(c == 0xffff)
2906 				break;
2907 			else c++;
2908 		}
2909 		/* if no roots are configured at all, return */
2910 		if(iq->num_current_queries == 0) {
2911 			verbose(VERB_ALGO, "No root hints or fwds, giving up "
2912 				"on qclass ANY");
2913 			return error_response(qstate, id, LDNS_RCODE_REFUSED);
2914 		}
2915 		/* return false, wait for queries to return */
2916 	}
2917 	/* if woke up here because of an answer, wait for more answers */
2918 	return 0;
2919 }
2920 
2921 /**
2922  * This handles the final state for first-tier responses (i.e., responses to
2923  * externally generated queries).
2924  *
2925  * @param qstate: query state.
2926  * @param iq: iterator query state.
2927  * @param id: module id.
2928  * @return true if the event needs more processing, false if not. Since this
2929  *         is the final state for an event, it always returns false.
2930  */
2931 static int
2932 processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
2933 	int id)
2934 {
2935 	log_query_info(VERB_QUERY, "finishing processing for",
2936 		&qstate->qinfo);
2937 
2938 	/* store negative cache element for parent side glue. */
2939 	if(!qstate->no_cache_store && iq->query_for_pside_glue
2940 		&& !iq->pside_glue)
2941 			iter_store_parentside_neg(qstate->env, &qstate->qinfo,
2942 				iq->deleg_msg?iq->deleg_msg->rep:
2943 				(iq->response?iq->response->rep:NULL));
2944 	if(!iq->response) {
2945 		verbose(VERB_ALGO, "No response is set, servfail");
2946 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
2947 	}
2948 
2949 	/* Make sure that the RA flag is set (since the presence of
2950 	 * this module means that recursion is available) */
2951 	iq->response->rep->flags |= BIT_RA;
2952 
2953 	/* Clear the AA flag */
2954 	/* FIXME: does this action go here or in some other module? */
2955 	iq->response->rep->flags &= ~BIT_AA;
2956 
2957 	/* make sure QR flag is on */
2958 	iq->response->rep->flags |= BIT_QR;
2959 
2960 	/* we have finished processing this query */
2961 	qstate->ext_state[id] = module_finished;
2962 
2963 	/* TODO:  we are using a private TTL, trim the response. */
2964 	/* if (mPrivateTTL > 0){IterUtils.setPrivateTTL(resp, mPrivateTTL); } */
2965 
2966 	/* prepend any items we have accumulated */
2967 	if(iq->an_prepend_list || iq->ns_prepend_list) {
2968 		if(!iter_prepend(iq, iq->response, qstate->region)) {
2969 			log_err("prepend rrsets: out of memory");
2970 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
2971 		}
2972 		/* reset the query name back */
2973 		iq->response->qinfo = qstate->qinfo;
2974 		/* the security state depends on the combination */
2975 		iq->response->rep->security = sec_status_unchecked;
2976 		/* store message with the finished prepended items,
2977 		 * but only if we did recursion. The nonrecursion referral
2978 		 * from cache does not need to be stored in the msg cache. */
2979 		if(!qstate->no_cache_store && qstate->query_flags&BIT_RD) {
2980 			iter_dns_store(qstate->env, &qstate->qinfo,
2981 				iq->response->rep, 0, qstate->prefetch_leeway,
2982 				iq->dp&&iq->dp->has_parent_side_NS,
2983 				qstate->region, qstate->query_flags);
2984 		}
2985 	}
2986 	qstate->return_rcode = LDNS_RCODE_NOERROR;
2987 	qstate->return_msg = iq->response;
2988 	return 0;
2989 }
2990 
2991 /*
2992  * Return priming query results to interestes super querystates.
2993  *
2994  * Sets the delegation point and delegation message (not nonRD queries).
2995  * This is a callback from walk_supers.
2996  *
2997  * @param qstate: query state that finished.
2998  * @param id: module id.
2999  * @param super: the qstate to inform.
3000  */
3001 void
3002 iter_inform_super(struct module_qstate* qstate, int id,
3003 	struct module_qstate* super)
3004 {
3005 	if(!qstate->is_priming && super->qinfo.qclass == LDNS_RR_CLASS_ANY)
3006 		processClassResponse(qstate, id, super);
3007 	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
3008 		super->minfo[id])->state == DSNS_FIND_STATE)
3009 		processDSNSResponse(qstate, id, super);
3010 	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
3011 		error_supers(qstate, id, super);
3012 	else if(qstate->is_priming)
3013 		prime_supers(qstate, id, super);
3014 	else	processTargetResponse(qstate, id, super);
3015 }
3016 
3017 /**
3018  * Handle iterator state.
3019  * Handle events. This is the real processing loop for events, responsible
3020  * for moving events through the various states. If a processing method
3021  * returns true, then it will be advanced to the next state. If false, then
3022  * processing will stop.
3023  *
3024  * @param qstate: query state.
3025  * @param ie: iterator shared global environment.
3026  * @param iq: iterator query state.
3027  * @param id: module id.
3028  */
3029 static void
3030 iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
3031 	struct iter_env* ie, int id)
3032 {
3033 	int cont = 1;
3034 	while(cont) {
3035 		verbose(VERB_ALGO, "iter_handle processing q with state %s",
3036 			iter_state_to_string(iq->state));
3037 		switch(iq->state) {
3038 			case INIT_REQUEST_STATE:
3039 				cont = processInitRequest(qstate, iq, ie, id);
3040 				break;
3041 			case INIT_REQUEST_2_STATE:
3042 				cont = processInitRequest2(qstate, iq, id);
3043 				break;
3044 			case INIT_REQUEST_3_STATE:
3045 				cont = processInitRequest3(qstate, iq, id);
3046 				break;
3047 			case QUERYTARGETS_STATE:
3048 				cont = processQueryTargets(qstate, iq, ie, id);
3049 				break;
3050 			case QUERY_RESP_STATE:
3051 				cont = processQueryResponse(qstate, iq, id);
3052 				break;
3053 			case PRIME_RESP_STATE:
3054 				cont = processPrimeResponse(qstate, id);
3055 				break;
3056 			case COLLECT_CLASS_STATE:
3057 				cont = processCollectClass(qstate, id);
3058 				break;
3059 			case DSNS_FIND_STATE:
3060 				cont = processDSNSFind(qstate, iq, id);
3061 				break;
3062 			case FINISHED_STATE:
3063 				cont = processFinished(qstate, iq, id);
3064 				break;
3065 			default:
3066 				log_warn("iterator: invalid state: %d",
3067 					iq->state);
3068 				cont = 0;
3069 				break;
3070 		}
3071 	}
3072 }
3073 
3074 /**
3075  * This is the primary entry point for processing request events. Note that
3076  * this method should only be used by external modules.
3077  * @param qstate: query state.
3078  * @param ie: iterator shared global environment.
3079  * @param iq: iterator query state.
3080  * @param id: module id.
3081  */
3082 static void
3083 process_request(struct module_qstate* qstate, struct iter_qstate* iq,
3084 	struct iter_env* ie, int id)
3085 {
3086 	/* external requests start in the INIT state, and finish using the
3087 	 * FINISHED state. */
3088 	iq->state = INIT_REQUEST_STATE;
3089 	iq->final_state = FINISHED_STATE;
3090 	verbose(VERB_ALGO, "process_request: new external request event");
3091 	iter_handle(qstate, iq, ie, id);
3092 }
3093 
3094 /** process authoritative server reply */
3095 static void
3096 process_response(struct module_qstate* qstate, struct iter_qstate* iq,
3097 	struct iter_env* ie, int id, struct outbound_entry* outbound,
3098 	enum module_ev event)
3099 {
3100 	struct msg_parse* prs;
3101 	struct edns_data edns;
3102 	sldns_buffer* pkt;
3103 
3104 	verbose(VERB_ALGO, "process_response: new external response event");
3105 	iq->response = NULL;
3106 	iq->state = QUERY_RESP_STATE;
3107 	if(event == module_event_noreply || event == module_event_error) {
3108 		if(event == module_event_noreply && iq->sent_count >= 3 &&
3109 			qstate->env->cfg->use_caps_bits_for_id &&
3110 			!iq->caps_fallback) {
3111 			/* start fallback */
3112 			iq->caps_fallback = 1;
3113 			iq->caps_server = 0;
3114 			iq->caps_reply = NULL;
3115 			iq->caps_response = NULL;
3116 			iq->state = QUERYTARGETS_STATE;
3117 			iq->num_current_queries--;
3118 			/* need fresh attempts for the 0x20 fallback, if
3119 			 * that was the cause for the failure */
3120 			iter_dec_attempts(iq->dp, 3);
3121 			verbose(VERB_DETAIL, "Capsforid: timeouts, starting fallback");
3122 			goto handle_it;
3123 		}
3124 		goto handle_it;
3125 	}
3126 	if( (event != module_event_reply && event != module_event_capsfail)
3127 		|| !qstate->reply) {
3128 		log_err("Bad event combined with response");
3129 		outbound_list_remove(&iq->outlist, outbound);
3130 		(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
3131 		return;
3132 	}
3133 
3134 	/* parse message */
3135 	prs = (struct msg_parse*)regional_alloc(qstate->env->scratch,
3136 		sizeof(struct msg_parse));
3137 	if(!prs) {
3138 		log_err("out of memory on incoming message");
3139 		/* like packet got dropped */
3140 		goto handle_it;
3141 	}
3142 	memset(prs, 0, sizeof(*prs));
3143 	memset(&edns, 0, sizeof(edns));
3144 	pkt = qstate->reply->c->buffer;
3145 	sldns_buffer_set_position(pkt, 0);
3146 	if(parse_packet(pkt, prs, qstate->env->scratch) != LDNS_RCODE_NOERROR) {
3147 		verbose(VERB_ALGO, "parse error on reply packet");
3148 		goto handle_it;
3149 	}
3150 	/* edns is not examined, but removed from message to help cache */
3151 	if(parse_extract_edns(prs, &edns, qstate->env->scratch) !=
3152 		LDNS_RCODE_NOERROR)
3153 		goto handle_it;
3154 
3155 	/* Copy the edns options we may got from the back end */
3156 	if(edns.opt_list) {
3157 		qstate->edns_opts_back_in = edns_opt_copy_region(edns.opt_list,
3158 			qstate->region);
3159 		if(!qstate->edns_opts_back_in) {
3160 			log_err("out of memory on incoming message");
3161 			/* like packet got dropped */
3162 			goto handle_it;
3163 		}
3164 	}
3165 
3166 	/* remove CD-bit, we asked for in case we handle validation ourself */
3167 	prs->flags &= ~BIT_CD;
3168 
3169 	/* normalize and sanitize: easy to delete items from linked lists */
3170 	if(!scrub_message(pkt, prs, &iq->qinfo_out, iq->dp->name,
3171 		qstate->env->scratch, qstate->env, ie)) {
3172 		/* if 0x20 enabled, start fallback, but we have no message */
3173 		if(event == module_event_capsfail && !iq->caps_fallback) {
3174 			iq->caps_fallback = 1;
3175 			iq->caps_server = 0;
3176 			iq->caps_reply = NULL;
3177 			iq->caps_response = NULL;
3178 			iq->state = QUERYTARGETS_STATE;
3179 			iq->num_current_queries--;
3180 			verbose(VERB_DETAIL, "Capsforid: scrub failed, starting fallback with no response");
3181 		}
3182 		goto handle_it;
3183 	}
3184 
3185 	/* allocate response dns_msg in region */
3186 	iq->response = dns_alloc_msg(pkt, prs, qstate->region);
3187 	if(!iq->response)
3188 		goto handle_it;
3189 	log_query_info(VERB_DETAIL, "response for", &qstate->qinfo);
3190 	log_name_addr(VERB_DETAIL, "reply from", iq->dp->name,
3191 		&qstate->reply->addr, qstate->reply->addrlen);
3192 	if(verbosity >= VERB_ALGO)
3193 		log_dns_msg("incoming scrubbed packet:", &iq->response->qinfo,
3194 			iq->response->rep);
3195 
3196 	if(event == module_event_capsfail || iq->caps_fallback) {
3197 		/* for fallback we care about main answer, not additionals */
3198 		/* removing that makes comparison more likely to succeed */
3199 		caps_strip_reply(iq->response->rep);
3200 		if(!iq->caps_fallback) {
3201 			/* start fallback */
3202 			iq->caps_fallback = 1;
3203 			iq->caps_server = 0;
3204 			iq->caps_reply = iq->response->rep;
3205 			iq->caps_response = iq->response;
3206 			iq->state = QUERYTARGETS_STATE;
3207 			iq->num_current_queries--;
3208 			verbose(VERB_DETAIL, "Capsforid: starting fallback");
3209 			goto handle_it;
3210 		} else {
3211 			/* check if reply is the same, otherwise, fail */
3212 			if(!iq->caps_reply) {
3213 				iq->caps_reply = iq->response->rep;
3214 				iq->caps_response = iq->response;
3215 				iq->caps_server = -1; /*become zero at ++,
3216 				so that we start the full set of trials */
3217 			} else if(caps_failed_rcode(iq->caps_reply) &&
3218 				!caps_failed_rcode(iq->response->rep)) {
3219 				/* prefer to upgrade to non-SERVFAIL */
3220 				iq->caps_reply = iq->response->rep;
3221 				iq->caps_response = iq->response;
3222 			} else if(!caps_failed_rcode(iq->caps_reply) &&
3223 				caps_failed_rcode(iq->response->rep)) {
3224 				/* if we have non-SERVFAIL as answer then
3225 				 * we can ignore SERVFAILs for the equality
3226 				 * comparison */
3227 				/* no instructions here, skip other else */
3228 			} else if(caps_failed_rcode(iq->caps_reply) &&
3229 				caps_failed_rcode(iq->response->rep)) {
3230 				/* failure is same as other failure in fallbk*/
3231 				/* no instructions here, skip other else */
3232 			} else if(!reply_equal(iq->response->rep, iq->caps_reply,
3233 				qstate->env->scratch)) {
3234 				verbose(VERB_DETAIL, "Capsforid fallback: "
3235 					"getting different replies, failed");
3236 				outbound_list_remove(&iq->outlist, outbound);
3237 				(void)error_response(qstate, id,
3238 					LDNS_RCODE_SERVFAIL);
3239 				return;
3240 			}
3241 			/* continue the fallback procedure at next server */
3242 			iq->caps_server++;
3243 			iq->state = QUERYTARGETS_STATE;
3244 			iq->num_current_queries--;
3245 			verbose(VERB_DETAIL, "Capsforid: reply is equal. "
3246 				"go to next fallback");
3247 			goto handle_it;
3248 		}
3249 	}
3250 	iq->caps_fallback = 0; /* if we were in fallback, 0x20 is OK now */
3251 
3252 handle_it:
3253 	outbound_list_remove(&iq->outlist, outbound);
3254 	iter_handle(qstate, iq, ie, id);
3255 }
3256 
3257 void
3258 iter_operate(struct module_qstate* qstate, enum module_ev event, int id,
3259 	struct outbound_entry* outbound)
3260 {
3261 	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
3262 	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
3263 	verbose(VERB_QUERY, "iterator[module %d] operate: extstate:%s event:%s",
3264 		id, strextstate(qstate->ext_state[id]), strmodulevent(event));
3265 	if(iq) log_query_info(VERB_QUERY, "iterator operate: query",
3266 		&qstate->qinfo);
3267 	if(iq && qstate->qinfo.qname != iq->qchase.qname)
3268 		log_query_info(VERB_QUERY, "iterator operate: chased to",
3269 			&iq->qchase);
3270 
3271 	/* perform iterator state machine */
3272 	if((event == module_event_new || event == module_event_pass) &&
3273 		iq == NULL) {
3274 		if(!iter_new(qstate, id)) {
3275 			(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
3276 			return;
3277 		}
3278 		iq = (struct iter_qstate*)qstate->minfo[id];
3279 		process_request(qstate, iq, ie, id);
3280 		return;
3281 	}
3282 	if(iq && event == module_event_pass) {
3283 		iter_handle(qstate, iq, ie, id);
3284 		return;
3285 	}
3286 	if(iq && outbound) {
3287 		process_response(qstate, iq, ie, id, outbound, event);
3288 		return;
3289 	}
3290 	if(event == module_event_error) {
3291 		verbose(VERB_ALGO, "got called with event error, giving up");
3292 		(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
3293 		return;
3294 	}
3295 
3296 	log_err("bad event for iterator");
3297 	(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
3298 }
3299 
3300 void
3301 iter_clear(struct module_qstate* qstate, int id)
3302 {
3303 	struct iter_qstate* iq;
3304 	if(!qstate)
3305 		return;
3306 	iq = (struct iter_qstate*)qstate->minfo[id];
3307 	if(iq) {
3308 		outbound_list_clear(&iq->outlist);
3309 		if(iq->target_count && --iq->target_count[0] == 0)
3310 			free(iq->target_count);
3311 		iq->num_current_queries = 0;
3312 	}
3313 	qstate->minfo[id] = NULL;
3314 }
3315 
3316 size_t
3317 iter_get_mem(struct module_env* env, int id)
3318 {
3319 	struct iter_env* ie = (struct iter_env*)env->modinfo[id];
3320 	if(!ie)
3321 		return 0;
3322 	return sizeof(*ie) + sizeof(int)*((size_t)ie->max_dependency_depth+1)
3323 		+ donotq_get_mem(ie->donotq) + priv_get_mem(ie->priv);
3324 }
3325 
3326 /**
3327  * The iterator function block
3328  */
3329 static struct module_func_block iter_block = {
3330 	"iterator",
3331 	&iter_init, &iter_deinit, &iter_operate, &iter_inform_super,
3332 	&iter_clear, &iter_get_mem
3333 };
3334 
3335 struct module_func_block*
3336 iter_get_funcblock(void)
3337 {
3338 	return &iter_block;
3339 }
3340 
3341 const char*
3342 iter_state_to_string(enum iter_state state)
3343 {
3344 	switch (state)
3345 	{
3346 	case INIT_REQUEST_STATE :
3347 		return "INIT REQUEST STATE";
3348 	case INIT_REQUEST_2_STATE :
3349 		return "INIT REQUEST STATE (stage 2)";
3350 	case INIT_REQUEST_3_STATE:
3351 		return "INIT REQUEST STATE (stage 3)";
3352 	case QUERYTARGETS_STATE :
3353 		return "QUERY TARGETS STATE";
3354 	case PRIME_RESP_STATE :
3355 		return "PRIME RESPONSE STATE";
3356 	case COLLECT_CLASS_STATE :
3357 		return "COLLECT CLASS STATE";
3358 	case DSNS_FIND_STATE :
3359 		return "DSNS FIND STATE";
3360 	case QUERY_RESP_STATE :
3361 		return "QUERY RESPONSE STATE";
3362 	case FINISHED_STATE :
3363 		return "FINISHED RESPONSE STATE";
3364 	default :
3365 		return "UNKNOWN ITER STATE";
3366 	}
3367 }
3368 
3369 int
3370 iter_state_is_responsestate(enum iter_state s)
3371 {
3372 	switch(s) {
3373 		case INIT_REQUEST_STATE :
3374 		case INIT_REQUEST_2_STATE :
3375 		case INIT_REQUEST_3_STATE :
3376 		case QUERYTARGETS_STATE :
3377 		case COLLECT_CLASS_STATE :
3378 			return 0;
3379 		default:
3380 			break;
3381 	}
3382 	return 1;
3383 }
3384