unbound: validator/autotrust.c File Reference

unbound 0.1

Macros | Functions
autotrust.c File Reference

Contains autotrust implementation. More...

`#include "config.h"`
`#include "validator/autotrust.h"`
`#include "validator/val_anchor.h"`
`#include "validator/val_utils.h"`
`#include "validator/val_sigcrypt.h"`
`#include "util/data/dname.h"`
`#include "util/data/packed_rrset.h"`
`#include "util/log.h"`
`#include "util/module.h"`
`#include "util/net_help.h"`
`#include "util/config_file.h"`
`#include "util/regional.h"`
`#include "util/random.h"`
`#include "util/data/msgparse.h"`
`#include "services/mesh.h"`
`#include "services/cache/rrset.h"`
`#include "validator/val_kcache.h"`
`#include "sldns/sbuffer.h"`
`#include "sldns/wire2str.h"`
`#include "sldns/str2wire.h"`
`#include "sldns/keyraw.h"`
`#include "sldns/rrdef.h"`
`#include <stdarg.h>`
`#include <ctype.h>`

## Macros
#define | MIN_PENDINGCOUNT 2
| number of times a key must be seen before it can become valid

## Functions
static void | do_revoked (struct module_env *env, struct autr_ta *anchor, int *c)
| Event: Revoked.
struct autr_global_data * | autr_global_create (void)
| Create new global 5011 data structure.
void | autr_global_delete (struct autr_global_data *global)
| Delete global 5011 data structure.
int | probetree_cmp (const void *x, const void *y)
| probe tree compare function
size_t | autr_get_num_anchors (struct val_anchors *anchors)
| See if autotrust anchors are configured and how many.
static int | position_in_string (char *str, const char *sub)
| Position in string.
static void | verbose_key (struct autr_ta *ta, enum verbosity_value level, const char *format,...) ATTR_FORMAT(printf
| Debug routine to print pretty key information.
static int | parse_comments (char *str, struct autr_ta *ta)
| Parse comments.
static int | str_contains_data (char *str, char comment)
| Check if a line contains data (besides comments)
static int | dnskey_flags (uint16_t t, uint8_t *rdata, size_t len)
| Get DNSKEY flags rdata without rdatalen in front of it.
static int | rr_is_dnskey_sep (uint16_t t, uint8_t *rdata, size_t len)
| Check if KSK DNSKEY.
static int | ta_is_dnskey_sep (struct autr_ta *ta)
| Check if TA is KSK DNSKEY.
static int | rr_is_dnskey_revoked (uint16_t t, uint8_t *rdata, size_t len)
| Check if REVOKED DNSKEY pass rdata without rdatalen in front of it.
static struct autr_ta * | autr_ta_create (uint8_t *rr, size_t rr_len, size_t dname_len)
| create ta
static struct trust_anchor * | autr_tp_create (struct val_anchors *anchors, uint8_t *own, size_t own_len, uint16_t dc)
| create tp
static void | autr_rrset_delete (struct ub_packed_rrset_key *r)
| delete assembled rrsets
void | autr_point_delete (struct trust_anchor *tp)
| Delete autr anchor, deletes the autr data but does not do unlinking from trees, caller does that.
static struct trust_anchor * | find_add_tp (struct val_anchors *anchors, uint8_t *rr, size_t rr_len, size_t dname_len)
| find or add a new trust point for autotrust
static struct autr_ta * | add_trustanchor_frm_rr (struct val_anchors *anchors, uint8_t *rr, size_t rr_len, size_t dname_len, struct trust_anchor **tp)
| Add trust anchor from RR.
static struct autr_ta * | add_trustanchor_frm_str (struct val_anchors *anchors, char *str, struct trust_anchor **tp, uint8_t *origin, size_t origin_len, uint8_t **prev, size_t *prev_len, int *skip)
| Add new trust anchor from a string in file.
static struct trust_anchor * | load_trustanchor (struct val_anchors *anchors, char *str, const char *fname, uint8_t *origin, size_t origin_len, uint8_t **prev, size_t *prev_len, int *skip)
| Load single anchor.
static int | assemble_iterate_ds (struct autr_ta **list, uint8_t **rr, size_t *rr_len, size_t *dname_len)
| iterator for DSes from keylist.
static int | assemble_iterate_dnskey (struct autr_ta **list, uint8_t **rr, size_t *rr_len, size_t *dname_len)
| iterator for DNSKEYs from keylist.
static int | assemble_iterate_hasfirst (int iter(struct autr_ta **, uint8_t **, size_t *, size_t *), struct autr_ta *list)
| see if iterator-list has any elements in it, or it is empty
static size_t | assemble_iterate_count (int iter(struct autr_ta **, uint8_t **, size_t *, size_t *), struct autr_ta *list)
| number of elements in iterator list
static struct ub_packed_rrset_key * | ub_packed_rrset_heap_key (int iter(struct autr_ta **, uint8_t **, size_t *, size_t *), struct autr_ta *list)
| Create a ub_packed_rrset_key allocated on the heap.
static struct packed_rrset_data * | packed_rrset_heap_data (int iter(struct autr_ta **, uint8_t **, size_t *, size_t *), struct autr_ta *list)
| Create packed_rrset data on the heap.
static int | autr_assemble (struct trust_anchor *tp)
| Assemble the trust anchors into DS and DNSKEY packed rrsets.
static unsigned int | parse_int (char *line, int *ret)
| parse integer
static struct trust_anchor * | parse_id (struct val_anchors *anchors, char *line)
| parse id sequence for anchor
static int | parse_var_line (char *line, struct val_anchors *anchors, struct trust_anchor **anchor)
| Parse variable from trustanchor header.
static int | handle_origin (char *line, uint8_t **origin, size_t *origin_len)
| handle origin lines
static int | read_multiline (char *buf, size_t len, FILE *in, int *linenr)
| Read one line and put multiline RRs onto one line string.
int | autr_read_file (struct val_anchors *anchors, const char *nm)
| Read autotrust file.
static const char * | trustanchor_state2str (autr_state_type s)
| string for a trustanchor state
static char * | autr_ctime_r (time_t *t, char *s)
| ctime r for autotrust
static int | print_id (FILE *out, char *fname, uint8_t *nm, size_t nmlen, uint16_t dclass)
| print ID to file
static int | autr_write_contents (FILE *out, char *fn, struct trust_anchor *tp)
void | autr_write_file (struct module_env *env, struct trust_anchor *tp)
| Write autotrust file.
static int | verify_dnskey (struct module_env *env, struct val_env *ve, struct trust_anchor *tp, struct ub_packed_rrset_key *rrset, struct module_qstate *qstate)
| Verify if dnskey works for trust point.
static int32_t | rrsig_get_expiry (uint8_t *d, size_t len)
static time_t | min_expiry (struct module_env *env, struct packed_rrset_data *dd)
| Find minimum expiration interval from signatures.
static int | rr_is_selfsigned_revoked (struct module_env *env, struct val_env *ve, struct ub_packed_rrset_key *dnskey_rrset, size_t i, struct module_qstate *qstate)
| Is rr self-signed revoked key.
static void | seen_trustanchor (struct autr_ta *ta, uint8_t seen)
| Set fetched value.
static void | seen_revoked_trustanchor (struct autr_ta *ta, uint8_t revoked)
| set revoked value
static void | revoke_dnskey (struct autr_ta *ta, int off)
| revoke a trust anchor
static int | dnskey_compare_skip_revbit (uint8_t *a, size_t a_len, uint8_t *b, size_t b_len)
| Compare two RRs skipping the REVOKED bit.
static int | ta_compare (struct autr_ta *a, uint16_t t, uint8_t *b, size_t b_len)
| compare trust anchor with rdata, 0 if equal.
static int | find_key (struct trust_anchor *tp, uint16_t t, uint8_t *rdata, size_t rdata_len, struct autr_ta **result)
| Find key.
static struct autr_ta * | add_key (struct trust_anchor *tp, uint32_t ttl, uint8_t *rdata, size_t rdata_len)
| add key and clone RR and tp already locked.
static time_t | key_ttl (struct ub_packed_rrset_key *k)
| get TTL from DNSKEY rrset
static void | set_tp_times (struct trust_anchor *tp, time_t rrsig_exp_interval, time_t origttl, int *changed)
| update the time values for the trustpoint
static void | init_events (struct trust_anchor *tp)
| init events to zero
static void | check_contains_revoked (struct module_env *env, struct val_env *ve, struct trust_anchor *tp, struct ub_packed_rrset_key *dnskey_rrset, int *changed, struct module_qstate *qstate)
| check for revoked keys without trusting any other information
static int | key_matches_a_ds (struct module_env *env, struct val_env *ve, struct ub_packed_rrset_key *dnskey_rrset, size_t key_idx, struct ub_packed_rrset_key *ds_rrset)
| See if a DNSKEY is verified by one of the DSes.
static int | update_events (struct module_env *env, struct val_env *ve, struct trust_anchor *tp, struct ub_packed_rrset_key *dnskey_rrset, int *changed)
| Set update events.
static time_t | check_holddown (struct module_env *env, struct autr_ta *ta, unsigned int holddown)
| Check if the holddown time has already exceeded setting: add-holddown: add holddown timer setting: del-holddown: del holddown timer.
static void | reset_holddown (struct module_env *env, struct autr_ta *ta, int *changed)
| Set last_change to now.
static void | set_trustanchor_state (struct module_env *env, struct autr_ta *ta, int *changed, autr_state_type s)
| Set the state for this trust anchor.
static void | do_newkey (struct module_env *env, struct autr_ta *anchor, int *c)
| Event: NewKey.
static void | do_addtime (struct module_env *env, struct autr_ta *anchor, int *c)
| Event: AddTime.
static void | do_remtime (struct module_env *env, struct autr_ta *anchor, int *c)
| Event: RemTime.
static void | do_keyrem (struct module_env *env, struct autr_ta *anchor, int *c)
| Event: KeyRem.
static void | do_keypres (struct module_env *env, struct autr_ta *anchor, int *c)
| Event: KeyPres.
static void | anchor_state_update (struct module_env *env, struct autr_ta *anchor, int *c)
| Do statestable transition matrix for anchor.
static int | init_zsk_to_ksk (struct module_env *env, struct trust_anchor *tp, int *changed)
| if ZSK init then trust KSKs
static void | remove_missing_trustanchors (struct module_env *env, struct trust_anchor *tp, int *changed)
| Remove missing trustanchors so the list does not grow forever.
static int | do_statetable (struct module_env *env, struct trust_anchor *tp, int *changed)
| Do the statetable from RFC5011 transition matrix.
static void | autr_holddown_exceed (struct module_env *env, struct trust_anchor *tp, int *c)
| See if time alone makes ADDPEND to VALID transition.
static void | autr_cleanup_keys (struct trust_anchor *tp)
| cleanup key list
static time_t | calc_next_probe (struct module_env *env, time_t wait)
| calculate next probe time
static time_t | wait_probe_time (struct val_anchors *anchors)
| what is first probe time (anchors must be locked)
static void | reset_worker_timer (struct module_env *env)
| reset worker timer
static int | set_next_probe (struct module_env *env, struct trust_anchor *tp, struct ub_packed_rrset_key *dnskey_rrset)
| set next probe for trust anchor
static void | autr_tp_remove (struct module_env *env, struct trust_anchor *tp, struct ub_packed_rrset_key *dnskey_rrset)
| Revoke and Delete a trust point.
int | autr_process_prime (struct module_env *env, struct val_env *ve, struct trust_anchor *tp, struct ub_packed_rrset_key *dnskey_rrset, struct module_qstate *qstate)
| Perform autotrust processing.
static void | autr_debug_print_ta (struct autr_ta *ta)
| debug print a trust anchor key
static void | autr_debug_print_tp (struct trust_anchor *tp)
| debug print a trust point
void | autr_debug_print (struct val_anchors *anchors)
| Debug printout of rfc5011 tracked anchors.
void | probe_answer_cb (void *arg, int ATTR_UNUSED(rcode), sldns_buffer *ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(sec), char *ATTR_UNUSED(why_bogus), int ATTR_UNUSED(was_ratelimited))
static void | probe_anchor (struct module_env *env, struct trust_anchor *tp)
| probe a trust anchor DNSKEY and unlocks tp
static struct trust_anchor * | todo_probe (struct module_env *env, time_t *next)
| fetch first to-probe trust-anchor and lock it and set retrytime
time_t | autr_probe_timer (struct module_env *env)
| Process probe timer.

## Detailed Description

Contains autotrust implementation.

The implementation was taken from the autotrust daemon (BSD licensed), written by Matthijs Mekking. It was modified to fit into unbound. The state table process is the same.

## Function Documentation

## ◆ autr_global_create()

struct autr_global_data * autr_global_create | ( | void |  | ) |

Create new global 5011 data structure.

Returns
  new structure or NULL on malloc failure.

References autr_global_data::probe, probetree_cmp(), and rbtree_init().

Referenced by anchors_create().

## ◆ autr_global_delete()

void autr_global_delete | ( | struct autr_global_data * | global | ) |

Delete global 5011 data structure.

Parameters

  global | global autotrust state to delete.

Referenced by anchors_delete().

## ◆ autr_get_num_anchors()

size_t autr_get_num_anchors | ( | struct val_anchors * | anchors | ) |

See if autotrust anchors are configured and how many.

Parameters

  anchors | the trust anchors structure.

Returns
  number of autotrust trust anchors

References val_anchors::autr, rbtree_type::count, val_anchors::lock, and autr_global_data::probe.

Referenced by worker_init().

## ◆ verbose_key()

static void static void verbose_key | ( | struct autr_ta * | ta,
|  | enum verbosity_value | level,
|  | const char * | format,
|  |  | ... )
| static

Debug routine to print pretty key information.

Implementation of debug pretty key print.

Parameters

  ta | trust anchor key with DNSKEY data.
  level | verbosity level to print at.
  format | printf style format string.

References autr_ta::rr, autr_ta::rr_len, sldns_calc_keytag_raw(), sldns_wire2str_dname(), sldns_wirerr_get_rdata(), sldns_wirerr_get_rdatalen(), verbose(), and verbosity.

Referenced by anchor_state_update(), check_contains_revoked(), check_holddown(), do_addtime(), do_remtime(), do_revoked(), init_zsk_to_ksk(), parse_comments(), remove_missing_trustanchors(), set_trustanchor_state(), and update_events().

## ◆ parse_comments()

static int parse_comments | ( | char * | str,
|  | struct autr_ta * | ta )
| static

Parse comments.

Parameters

  str | to parse
  ta | trust key autotrust metadata

Returns
  false on failure.

References autr_ta::last_change, log_err(), autr_ta::pending_count, position_in_string(), autr_ta::s, VERB_OPS, and verbose_key().

Referenced by load_trustanchor().

## ◆ rr_is_dnskey_sep()

static int rr_is_dnskey_sep | ( | uint16_t | t,
|  | uint8_t * | rdata,
|  | size_t | len )
| static

Check if KSK DNSKEY.

pass rdata without rdatalen in front of it

References DNSKEY_BIT_SEP, and dnskey_flags().

Referenced by check_contains_revoked(), and update_events().

## ◆ autr_point_delete()

void autr_point_delete | ( | struct trust_anchor * | tp | ) |

Delete autr anchor, deletes the autr data but does not do unlinking from trees, caller does that.

Parameters

  tp | trust point to delete.

References trust_anchor::autr, autr_rrset_delete(), trust_anchor::dnskey_rrset, trust_anchor::ds_rrset, autr_point_data::file, autr_point_data::keys, trust_anchor::lock, trust_anchor::name, autr_ta::next, and autr_ta::rr.

Referenced by anchors_delfunc(), and autr_tp_remove().

## ◆ add_trustanchor_frm_str()

static struct autr_ta * add_trustanchor_frm_str | ( | struct val_anchors * | anchors,
|  | char * | str,
|  | struct trust_anchor ** | tp,
|  | uint8_t * | origin,
|  | size_t | origin_len,
|  | uint8_t ** | prev,
|  | size_t * | prev_len,
|  | int * | skip )
| static

Add new trust anchor from a string in file.

Parameters

  anchors | all anchors
  str | string with anchor and comments, if any comments.
  tp | trust point returned.
  origin | what to use for @
  origin_len | length of origin
  prev | previous rr name
  prev_len | length of prev
  skip | if true, the result is NULL, but not an error, skip it.

Returns
  new key in trust point.

References add_trustanchor_frm_rr(), LDNS_RR_BUF_SIZE, LDNS_RR_TYPE_DS, log_err(), memdup(), autr_ta::rr, autr_ta::rr_len, sldns_get_errorstr_parse(), sldns_str2wire_rr_buf(), sldns_wirerr_get_type(), and str_contains_data().

Referenced by load_trustanchor().

## ◆ load_trustanchor()

static struct trust_anchor * load_trustanchor | ( | struct val_anchors * | anchors,
|  | char * | str,
|  | const char * | fname,
|  | uint8_t * | origin,
|  | size_t | origin_len,
|  | uint8_t ** | prev,
|  | size_t * | prev_len,
|  | int * | skip )
| static

Load single anchor.

Parameters

  anchors | all points.
  str | comments line
  fname | filename
  origin | the $ORIGIN.
  origin_len | length of origin
  prev | passed to ldns.
  prev_len | length of prev
  skip | if true, the result is NULL, but not an error, skip it.

Returns
  false on failure, otherwise the tp read.

References add_trustanchor_frm_str(), trust_anchor::autr, autr_point_data::file, trust_anchor::lock, log_err(), and parse_comments().

Referenced by autr_read_file().

## ◆ assemble_iterate_ds()

static int assemble_iterate_ds | ( | struct autr_ta ** | list,
|  | uint8_t ** | rr,
|  | size_t * | rr_len,
|  | size_t * | dname_len )
| static

iterator for DSes from keylist.

return true if a next element exists

References LDNS_RR_TYPE_DS, autr_ta::next, and sldns_wirerr_get_type().

Referenced by autr_assemble().

## ◆ assemble_iterate_dnskey()

static int assemble_iterate_dnskey | ( | struct autr_ta ** | list,
|  | uint8_t ** | rr,
|  | size_t * | rr_len,
|  | size_t * | dname_len )
| static

iterator for DNSKEYs from keylist.

return true if a next element exists

References LDNS_RR_TYPE_DS, autr_ta::next, and sldns_wirerr_get_type().

Referenced by autr_assemble().

## ◆ ub_packed_rrset_heap_key()

static struct ub_packed_rrset_key * ub_packed_rrset_heap_key | ( | int | iterstruct autr_ta **, uint8_t **, size_t *, size_t *,
|  | struct autr_ta * | list )
| static

Create a ub_packed_rrset_key allocated on the heap.

It therefore does not have the correct ID value, and cannot be used inside the cache. It can be used in storage outside of the cache. Keys for the cache have to be obtained from alloc.h .

Parameters

  iter | iterator over the elements in the list. It filters elements.
  list | the list.

Returns
  key allocated or NULL on failure.

References packed_rrset_key::dname, packed_rrset_key::dname_len, memdup(), ub_packed_rrset_key::rk, packed_rrset_key::rrset_class, sldns_wirerr_get_class(), sldns_wirerr_get_type(), and packed_rrset_key::type.

Referenced by autr_assemble().

## ◆ packed_rrset_heap_data()

static struct packed_rrset_data * packed_rrset_heap_data | ( | int | iterstruct autr_ta **, uint8_t **, size_t *, size_t *,
|  | struct autr_ta * | list )
| static

Create packed_rrset data on the heap.

Parameters

  iter | iterator over the elements in the list. It filters elements.
  list | the list.

Returns
  data allocated or NULL on failure.

References packed_rrset_data::count, LDNS_RR_TYPE_RRSIG, log_assert, autr_ta::rr, packed_rrset_data::rr_data, autr_ta::rr_len, packed_rrset_data::rr_len, packed_rrset_data::rr_ttl, packed_rrset_data::rrsig_count, sldns_wirerr_get_rdatalen(), sldns_wirerr_get_rdatawl(), sldns_wirerr_get_ttl(), sldns_wirerr_get_type(), and packed_rrset_data::ttl.

Referenced by autr_assemble().

## ◆ autr_assemble()

static int autr_assemble | ( | struct trust_anchor * | tp | ) |
| static

Assemble the trust anchors into DS and DNSKEY packed rrsets.

Uses only VALID and MISSING DNSKEYs. Read the sldns_rrs and builds packed rrsets

Parameters

  tp | the trust point. Must be locked.

Returns
  false on malloc failure.

References assemble_iterate_count(), assemble_iterate_dnskey(), assemble_iterate_ds(), assemble_iterate_hasfirst(), trust_anchor::autr, autr_rrset_delete(), lruhash_entry::data, trust_anchor::dnskey_rrset, trust_anchor::ds_rrset, ub_packed_rrset_key::entry, autr_point_data::keys, trust_anchor::numDNSKEY, trust_anchor::numDS, packed_rrset_heap_data(), and ub_packed_rrset_heap_key().

Referenced by autr_process_prime(), and autr_read_file().

## ◆ parse_var_line()

static int parse_var_line | ( | char * | line,
|  | struct val_anchors * | anchors,
|  | struct trust_anchor ** | anchor )
| static

Parse variable from trustanchor header.

Parameters

  line | to parse
  anchors | the anchor is added to this, if "id:" is seen.
  anchor | the anchor as result value or previously returned anchor value to read the variable lines into.

Returns
  : 0 no match, -1 failed syntax error, +1 success line read. +2 revoked trust anchor file.

References trust_anchor::autr, val_anchors::autr, autr_point_data::last_queried, autr_point_data::last_success, trust_anchor::lock, val_anchors::lock, log_err(), autr_point_data::next_probe_time, parse_id(), parse_int(), autr_point_data::pnode, autr_global_data::probe, autr_point_data::query_failed, autr_point_data::query_interval, rbtree_delete(), rbtree_insert(), and autr_point_data::retry_time.

Referenced by autr_read_file().

## ◆ autr_read_file()

int autr_read_file | ( | struct val_anchors * | anchors,
|  | const char * | nm )

Read autotrust file.

Parameters

  anchors | the anchors structure.
  nm | name of the file (copied).

Returns
  false on failure.

References autr_assemble(), handle_origin(), load_trustanchor(), trust_anchor::lock, log_err(), log_warn(), parse_var_line(), read_multiline(), str_contains_data(), VERB_ALGO, and verbose().

Referenced by anchors_apply_cfg().

## ◆ autr_write_file()

void autr_write_file | ( | struct module_env * | env,
|  | struct trust_anchor * | tp )

Write autotrust file.

Parameters

  env | environment with scratch space.
  tp | trust point to write.

References trust_anchor::autr, fatal_exit(), autr_point_data::file, log_assert, log_err(), VERB_ALGO, verbose(), and module_env::worker.

Referenced by autr_process_prime(), and autr_tp_remove().

## ◆ verify_dnskey()

static int verify_dnskey | ( | struct module_env * | env,
|  | struct val_env * | ve,
|  | struct trust_anchor * | tp,
|  | struct ub_packed_rrset_key * | rrset,
|  | struct module_qstate * | qstate )
| static

Verify if dnskey works for trust point.

Parameters

  env | environment (with time) for verification
  ve | validator environment (with options) for verification.
  tp | trust point to verify with
  rrset | DNSKEY rrset to verify.
  qstate | qstate with region.

Returns
  false on failure, true if verification successful.

References ALGO_NEEDS_MAX, module_env::cfg, trust_anchor::dnskey_rrset, trust_anchor::ds_rrset, config_file::harden_algo_downgrade, sec_status_secure, sec_status_to_string(), val_verify_DNSKEY_with_TA(), VERB_ALGO, and verbose().

Referenced by autr_process_prime().

## ◆ dnskey_compare_skip_revbit()

static int dnskey_compare_skip_revbit | ( | uint8_t * | a,
|  | size_t | a_len,
|  | uint8_t * | b,
|  | size_t | b_len )
| static

Compare two RRs skipping the REVOKED bit.

Pass rdata(no len)

Referenced by ta_compare().

## ◆ ta_compare()

static int ta_compare | ( | struct autr_ta * | a,
|  | uint16_t | t,
|  | uint8_t * | b,
|  | size_t | b_len )
| static

compare trust anchor with rdata, 0 if equal.

Pass rdata(no len)

References dnskey_compare_skip_revbit(), LDNS_RR_TYPE_DS, autr_ta::rr, autr_ta::rr_len, sldns_wirerr_get_rdata(), sldns_wirerr_get_rdatalen(), and sldns_wirerr_get_type().

Referenced by find_key().

## ◆ find_key()

static int find_key | ( | struct trust_anchor * | tp,
|  | uint16_t | t,
|  | uint8_t * | rdata,
|  | size_t | rdata_len,
|  | struct autr_ta ** | result )
| static

Find key.

Parameters

  tp | to search in
  t | rr type of the rdata.
  rdata | to look for (no rdatalen in it)
  rdata_len | length of rdata
  result | returns NULL or the ta key looked for.

Returns
  false on malloc failure during search. if true examine result.

References trust_anchor::autr, autr_point_data::keys, autr_ta::next, and ta_compare().

Referenced by check_contains_revoked(), and update_events().

## ◆ add_key()

static struct autr_ta * add_key | ( | struct trust_anchor * | tp,
|  | uint32_t | ttl,
|  | uint8_t * | rdata,
|  | size_t | rdata_len )
| static

add key and clone RR and tp already locked.

rdata without rdlen.

References trust_anchor::autr, autr_ta_create(), autr_point_data::keys, LDNS_RR_CLASS_IN, trust_anchor::name, trust_anchor::namelen, autr_ta::next, autr_ta::rr, and autr_ta::rr_len.

Referenced by update_events().

## ◆ check_holddown()

static time_t check_holddown | ( | struct module_env * | env,
|  | struct autr_ta * | ta,
|  | unsigned int | holddown )
| static

Check if the holddown time has already exceeded setting: add-holddown: add holddown timer setting: del-holddown: del holddown timer.

Parameters

  env | environment with current time
  ta | trust anchor to check for.
  holddown | the timer value

Returns
  number of seconds the holddown has passed.

References autr_ta::last_change, log_warn(), module_env::now, VERB_ALGO, and verbose_key().

Referenced by do_addtime(), do_remtime(), and remove_missing_trustanchors().

## ◆ autr_process_prime()

int autr_process_prime | ( | struct module_env * | env,
|  | struct val_env * | ve,
|  | struct trust_anchor * | tp,
|  | struct ub_packed_rrset_key * | dnskey_rrset,
|  | struct module_qstate * | qstate )

Perform autotrust processing.

Parameters

  env | qstate environment with the anchors structure.
  ve | validator environment for verification of rrsigs.
  tp | trust anchor to process.
  dnskey_rrset | DNSKEY rrset probed (can be NULL if bad prime result). allocated in a region. Has not been validated yet.
  qstate | qstate with region.

Returns
  false if trust anchor was revoked completely. Otherwise logs errors to log, does not change return value. On errors, likely the trust point has been unchanged.

References trust_anchor::autr, autr_assemble(), autr_cleanup_keys(), autr_holddown_exceed(), autr_tp_remove(), autr_write_file(), check_contains_revoked(), trust_anchor::dclass, trust_anchor::dnskey_rrset, do_statetable(), trust_anchor::ds_rrset, autr_point_data::last_queried, autr_point_data::last_success, trust_anchor::lock, log_assert, log_err(), log_nametypeclass(), trust_anchor::name, module_env::now, autr_point_data::query_failed, autr_point_data::revoked, set_next_probe(), update_events(), VERB_ALGO, verbose(), and verify_dnskey().

Referenced by process_prime_response().

## ◆ autr_debug_print()

void autr_debug_print | ( | struct val_anchors * | anchors | ) |

Debug printout of rfc5011 tracked anchors.

Parameters

  anchors | all the anchors.

References autr_debug_print_tp(), trust_anchor::lock, val_anchors::lock, RBTREE_FOR, and val_anchors::tree.

Referenced by anchors_apply_cfg().

## ◆ autr_probe_timer()

time_t autr_probe_timer | ( | struct module_env * | env | ) |

Process probe timer.

Add new probes if needed.

Parameters

  env | module environment with time, with anchors and with the mesh.

Returns
  time of next probe (in seconds from now). If 0, then there is no next probe anymore (trust points deleted).

References autr_permit_small_holddown, probe_anchor(), regional_free_all(), module_env::scratch, todo_probe(), VERB_ALGO, and verbose().

Referenced by worker_probe_timer_cb().