/src/bind9/lib/dns/rootns.c

Source
/*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * SPDX-License-Identifier: MPL-2.0
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */

/*! \file */

#include <stdbool.h>

#include <isc/buffer.h>
#include <isc/log.h>
#include <isc/result.h>
#include <isc/string.h>
#include <isc/util.h>

#include <dns/callbacks.h>
#include <dns/db.h>
#include <dns/dbiterator.h>
#include <dns/fixedname.h>
#include <dns/master.h>
#include <dns/rdata.h>
#include <dns/rdataset.h>
#include <dns/rdatasetiter.h>
#include <dns/rdatastruct.h>
#include <dns/rdatatype.h>
#include <dns/rootns.h>
#include <dns/view.h>

/*
 * Also update 'upcoming' when updating 'root_ns'.
 */
static char root_ns[] =
  ";\n"
  "; Internet Root Nameservers\n"
  ";\n"
  "$TTL 518400\n"
  ".                       518400  IN      NS      A.ROOT-SERVERS.NET.\n"
  ".                       518400  IN      NS      B.ROOT-SERVERS.NET.\n"
  ".                       518400  IN      NS      C.ROOT-SERVERS.NET.\n"
  ".                       518400  IN      NS      D.ROOT-SERVERS.NET.\n"
  ".                       518400  IN      NS      E.ROOT-SERVERS.NET.\n"
  ".                       518400  IN      NS      F.ROOT-SERVERS.NET.\n"
  ".                       518400  IN      NS      G.ROOT-SERVERS.NET.\n"
  ".                       518400  IN      NS      H.ROOT-SERVERS.NET.\n"
  ".                       518400  IN      NS      I.ROOT-SERVERS.NET.\n"
  ".                       518400  IN      NS      J.ROOT-SERVERS.NET.\n"
  ".                       518400  IN      NS      K.ROOT-SERVERS.NET.\n"
  ".                       518400  IN      NS      L.ROOT-SERVERS.NET.\n"
  ".                       518400  IN      NS      M.ROOT-SERVERS.NET.\n"
  "A.ROOT-SERVERS.NET.     3600000 IN      A       198.41.0.4\n"
  "A.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:503:BA3E::2:30\n"
  "B.ROOT-SERVERS.NET.     3600000 IN      A       170.247.170.2\n"
  "B.ROOT-SERVERS.NET.     3600000 IN      AAAA    2801:1b8:10::b\n"
  "C.ROOT-SERVERS.NET.     3600000 IN      A       192.33.4.12\n"
  "C.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:2::c\n"
  "D.ROOT-SERVERS.NET.     3600000 IN      A       199.7.91.13\n"
  "D.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:2d::d\n"
  "E.ROOT-SERVERS.NET.     3600000 IN      A       192.203.230.10\n"
  "E.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:a8::e\n"
  "F.ROOT-SERVERS.NET.     3600000 IN      A       192.5.5.241\n"
  "F.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:2F::F\n"
  "G.ROOT-SERVERS.NET.     3600000 IN      A       192.112.36.4\n"
  "G.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:12::d0d\n"
  "H.ROOT-SERVERS.NET.     3600000 IN      A       198.97.190.53\n"
  "H.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:1::53\n"
  "I.ROOT-SERVERS.NET.     3600000 IN      A       192.36.148.17\n"
  "I.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:7fe::53\n"
  "J.ROOT-SERVERS.NET.     3600000 IN      A       192.58.128.30\n"
  "J.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:503:C27::2:30\n"
  "K.ROOT-SERVERS.NET.     3600000 IN      A       193.0.14.129\n"
  "K.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:7FD::1\n"
  "L.ROOT-SERVERS.NET.     3600000 IN      A       199.7.83.42\n"
  "L.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:9f::42\n"
  "M.ROOT-SERVERS.NET.     3600000 IN      A       202.12.27.33\n"
  "M.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:DC3::35\n";

static unsigned char b_data[] = "\001b\014root-servers\003net";

static struct upcoming {
  const dns_name_t name;
  dns_rdatatype_t type;
  isc_stdtime_t time;
} upcoming[] = { {
       .name = DNS_NAME_INITABSOLUTE(b_data),
       .type = dns_rdatatype_a,
       .time = 1701086400 /* November 27 2023, 12:00 UTC */
     },
     {
       .name = DNS_NAME_INITABSOLUTE(b_data),
       .type = dns_rdatatype_aaaa,
       .time = 1701086400 /* November 27 2023, 12:00 UTC */
     } };

static isc_result_t
in_rootns(dns_rdataset_t *rootns, dns_name_t *name) {
  dns_rdata_ns_t ns;

  if (!dns_rdataset_isassociated(rootns)) {
    return ISC_R_NOTFOUND;
  }

  DNS_RDATASET_FOREACH(rootns) {
    dns_rdata_t rdata = DNS_RDATA_INIT;
    dns_rdataset_current(rootns, &rdata);
    RETERR(dns_rdata_tostruct(&rdata, &ns, NULL));
    if (dns_name_compare(name, &ns.name) == 0) {
      return ISC_R_SUCCESS;
    }
  }
  return ISC_R_NOTFOUND;
}

static isc_result_t
check_node(dns_rdataset_t *rootns, dns_name_t *name,
     dns_rdatasetiter_t *rdsiter) {
  DNS_RDATASETITER_FOREACH(rdsiter) {
    dns_rdataset_t rdataset = DNS_RDATASET_INIT;
    dns_rdatasetiter_current(rdsiter, &rdataset);
    dns_rdatatype_t type = rdataset.type;
    dns_rdataset_disassociate(&rdataset);

    switch (type) {
    case dns_rdatatype_a:
    case dns_rdatatype_aaaa:
      return in_rootns(rootns, name);
    case dns_rdatatype_ns:
      if (dns_name_compare(name, dns_rootname) == 0) {
        return ISC_R_SUCCESS;
      }
      FALLTHROUGH;
    default:
      return ISC_R_FAILURE;
    }
  }

  return ISC_R_SUCCESS;
}

static isc_result_t
check_hints(dns_db_t *db) {
  isc_result_t result;
  dns_rdataset_t rootns;
  dns_dbiterator_t *dbiter = NULL;
  dns_dbnode_t *node = NULL;
  isc_stdtime_t now = isc_stdtime_now();
  dns_fixedname_t fixname;
  dns_name_t *name;
  dns_rdatasetiter_t *rdsiter = NULL;

  name = dns_fixedname_initname(&fixname);

  dns_rdataset_init(&rootns);
  (void)dns_db_find(db, dns_rootname, NULL, dns_rdatatype_ns, 0, now,
        NULL, name, &rootns, NULL);
  CHECK(dns_db_createiterator(db, 0, &dbiter));
  DNS_DBITERATOR_FOREACH(dbiter) {
    CHECK(dns_dbiterator_current(dbiter, &node, name));
    CHECK(dns_db_allrdatasets(db, node, NULL, 0, now, &rdsiter));
    CHECK(check_node(&rootns, name, rdsiter));
    dns_rdatasetiter_destroy(&rdsiter);
    dns_db_detachnode(&node);
  }

cleanup:
  if (dns_rdataset_isassociated(&rootns)) {
    dns_rdataset_disassociate(&rootns);
  }
  if (rdsiter != NULL) {
    dns_rdatasetiter_destroy(&rdsiter);
  }
  if (node != NULL) {
    dns_db_detachnode(&node);
  }
  if (dbiter != NULL) {
    dns_dbiterator_destroy(&dbiter);
  }
  return result;
}

isc_result_t
dns_rootns_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
      const char *filename, dns_db_t **target) {
  isc_result_t result, eresult;
  isc_buffer_t source;
  unsigned int len;
  dns_rdatacallbacks_t callbacks;
  dns_db_t *db = NULL;

  REQUIRE(target != NULL && *target == NULL);

  CHECK(dns_db_create(mctx, ZONEDB_DEFAULT, dns_rootname, dns_dbtype_zone,
          rdclass, 0, NULL, &db));

  len = strlen(root_ns);
  isc_buffer_init(&source, root_ns, len);
  isc_buffer_add(&source, len);

  dns_rdatacallbacks_init(&callbacks);
  CHECK(dns_db_beginload(db, &callbacks));
  if (filename != NULL) {
    /*
     * Load the hints from the specified filename.
     */
    result = dns_master_loadfile(filename, &db->origin, &db->origin,
               db->rdclass, DNS_MASTER_HINT, 0,
               &callbacks, NULL, NULL, db->mctx,
               dns_masterformat_text, 0);
  } else if (rdclass == dns_rdataclass_in) {
    /*
     * Default to using the Internet root servers.
     */
    result = dns_master_loadbuffer(
      &source, &db->origin, &db->origin, db->rdclass,
      DNS_MASTER_HINT, &callbacks, db->mctx);
  } else {
    result = ISC_R_NOTFOUND;
  }
  eresult = dns_db_endload(db, &callbacks);
  if (result == ISC_R_SUCCESS || result == DNS_R_SEENINCLUDE) {
    result = eresult;
  }
  if (result != DNS_R_SEENINCLUDE) {
    CHECK(result);
  }
  if (check_hints(db) != ISC_R_SUCCESS) {
    isc_log_write(DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_HINTS,
            ISC_LOG_WARNING, "extra data in root hints '%s'",
            (filename != NULL) ? filename : "<BUILT-IN>");
  }
  *target = db;
  return ISC_R_SUCCESS;

cleanup:
  isc_log_write(DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_HINTS,
          ISC_LOG_ERROR,
          "could not configure root hints from "
          "'%s': %s",
          (filename != NULL) ? filename : "<BUILT-IN>",
          isc_result_totext(result));

  if (db != NULL) {
    dns_db_detach(&db);
  }

  return result;
}

static void
report(dns_view_t *view, dns_name_t *name, bool missing, dns_rdata_t *rdata) {
  const char *viewname = "", *sep = "";
  char namebuf[DNS_NAME_FORMATSIZE];
  char typebuf[DNS_RDATATYPE_FORMATSIZE];
  char databuf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:123.123.123.123")];
  isc_buffer_t buffer;
  isc_result_t result;

  if (strcmp(view->name, "_bind") != 0 &&
      strcmp(view->name, "_default") != 0)
  {
    viewname = view->name;
    sep = ": view ";
  }

  dns_name_format(name, namebuf, sizeof(namebuf));
  dns_rdatatype_format(rdata->type, typebuf, sizeof(typebuf));
  isc_buffer_init(&buffer, databuf, sizeof(databuf) - 1);
  result = dns_rdata_totext(rdata, NULL, &buffer);
  RUNTIME_CHECK(result == ISC_R_SUCCESS);
  databuf[isc_buffer_usedlength(&buffer)] = '\0';

  if (missing) {
    isc_log_write(DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_HINTS,
            ISC_LOG_WARNING,
            "checkhints%s%s: %s/%s (%s) missing from hints",
            sep, viewname, namebuf, typebuf, databuf);
  } else {
    isc_log_write(DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_HINTS,
            ISC_LOG_WARNING,
            "checkhints%s%s: %s/%s (%s) extra record "
            "in hints",
            sep, viewname, namebuf, typebuf, databuf);
  }
}

static bool
inrrset(dns_rdataset_t *rrset, dns_rdata_t *rdata) {
  DNS_RDATASET_FOREACH(rrset) {
    dns_rdata_t current = DNS_RDATA_INIT;
    dns_rdataset_current(rrset, &current);
    if (dns_rdata_compare(rdata, &current) == 0) {
      return true;
    }
  }
  return false;
}

static bool
changing(const dns_name_t *name, dns_rdatatype_t type, isc_stdtime_t now) {
  for (size_t i = 0; i < ARRAY_SIZE(upcoming); i++) {
    if (upcoming[i].time > now && upcoming[i].type == type &&
        dns_name_equal(&upcoming[i].name, name))
    {
      return true;
    }
  }
  return false;
}

/*
 * Check that the address RRsets match.
 *
 * Note we don't complain about missing glue records.
 */

static void
check_address_records(dns_view_t *view, dns_db_t *hints, dns_db_t *db,
          dns_name_t *name, isc_stdtime_t now) {
  isc_result_t hresult, rresult;
  dns_rdataset_t hintrrset, rootrrset;
  dns_name_t *foundname;
  dns_fixedname_t fixed;

  dns_rdataset_init(&hintrrset);
  dns_rdataset_init(&rootrrset);
  foundname = dns_fixedname_initname(&fixed);

  hresult = dns_db_find(hints, name, NULL, dns_rdatatype_a, 0, now, NULL,
            foundname, &hintrrset, NULL);
  rresult = dns_db_find(db, name, NULL, dns_rdatatype_a,
            DNS_DBFIND_GLUEOK, now, NULL, foundname,
            &rootrrset, NULL);
  if (hresult == ISC_R_SUCCESS &&
      (rresult == ISC_R_SUCCESS || rresult == DNS_R_GLUE))
  {
    DNS_RDATASET_FOREACH(&rootrrset) {
      dns_rdata_t rdata = DNS_RDATA_INIT;
      dns_rdataset_current(&rootrrset, &rdata);
      if (!inrrset(&hintrrset, &rdata) &&
          !changing(name, dns_rdatatype_a, now))
      {
        report(view, name, true, &rdata);
      }
    }
    DNS_RDATASET_FOREACH(&hintrrset) {
      dns_rdata_t rdata = DNS_RDATA_INIT;
      dns_rdataset_current(&hintrrset, &rdata);
      if (!inrrset(&rootrrset, &rdata) &&
          !changing(name, dns_rdatatype_a, now))
      {
        report(view, name, false, &rdata);
      }
    }
  }
  if (hresult == ISC_R_NOTFOUND &&
      (rresult == ISC_R_SUCCESS || rresult == DNS_R_GLUE))
  {
    DNS_RDATASET_FOREACH(&rootrrset) {
      dns_rdata_t rdata = DNS_RDATA_INIT;
      dns_rdataset_current(&rootrrset, &rdata);
      report(view, name, true, &rdata);
    }
  }
  if (dns_rdataset_isassociated(&rootrrset)) {
    dns_rdataset_disassociate(&rootrrset);
  }
  if (dns_rdataset_isassociated(&hintrrset)) {
    dns_rdataset_disassociate(&hintrrset);
  }

  /*
   * Check AAAA records.
   */
  hresult = dns_db_find(hints, name, NULL, dns_rdatatype_aaaa, 0, now,
            NULL, foundname, &hintrrset, NULL);
  rresult = dns_db_find(db, name, NULL, dns_rdatatype_aaaa,
            DNS_DBFIND_GLUEOK, now, NULL, foundname,
            &rootrrset, NULL);
  if (hresult == ISC_R_SUCCESS &&
      (rresult == ISC_R_SUCCESS || rresult == DNS_R_GLUE))
  {
    DNS_RDATASET_FOREACH(&rootrrset) {
      dns_rdata_t rdata = DNS_RDATA_INIT;
      dns_rdataset_current(&rootrrset, &rdata);
      if (!inrrset(&hintrrset, &rdata) &&
          !changing(name, dns_rdatatype_aaaa, now))
      {
        report(view, name, true, &rdata);
      }
    }
    DNS_RDATASET_FOREACH(&hintrrset) {
      dns_rdata_t rdata = DNS_RDATA_INIT;
      dns_rdataset_current(&hintrrset, &rdata);
      if (!inrrset(&rootrrset, &rdata) &&
          !changing(name, dns_rdatatype_aaaa, now))
      {
        report(view, name, false, &rdata);
      }
    }
  }
  if (hresult == ISC_R_NOTFOUND &&
      (rresult == ISC_R_SUCCESS || rresult == DNS_R_GLUE))
  {
    DNS_RDATASET_FOREACH(&rootrrset) {
      dns_rdata_t rdata = DNS_RDATA_INIT;
      dns_rdataset_current(&rootrrset, &rdata);
      report(view, name, true, &rdata);
    }
  }
  if (dns_rdataset_isassociated(&rootrrset)) {
    dns_rdataset_disassociate(&rootrrset);
  }
  if (dns_rdataset_isassociated(&hintrrset)) {
    dns_rdataset_disassociate(&hintrrset);
  }
}

void
dns_root_checkhints(dns_view_t *view, dns_db_t *hints, dns_db_t *db) {
  isc_result_t result;
  dns_rdata_ns_t ns;
  dns_rdataset_t hintns, rootns;
  const char *viewname = "", *sep = "";
  isc_stdtime_t now = isc_stdtime_now();
  dns_name_t *name;
  dns_fixedname_t fixed;

  REQUIRE(hints != NULL);
  REQUIRE(db != NULL);
  REQUIRE(view != NULL);

  if (strcmp(view->name, "_bind") != 0 &&
      strcmp(view->name, "_default") != 0)
  {
    viewname = view->name;
    sep = ": view ";
  }

  dns_rdataset_init(&hintns);
  dns_rdataset_init(&rootns);
  name = dns_fixedname_initname(&fixed);

  result = dns_db_find(hints, dns_rootname, NULL, dns_rdatatype_ns, 0,
           now, NULL, name, &hintns, NULL);
  if (result != ISC_R_SUCCESS) {
    isc_log_write(DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_HINTS,
            ISC_LOG_WARNING,
            "checkhints%s%s: unable to get root NS rrset "
            "from hints: %s",
            sep, viewname, isc_result_totext(result));
    goto cleanup;
  }

  result = dns_db_find(db, dns_rootname, NULL, dns_rdatatype_ns, 0, now,
           NULL, name, &rootns, NULL);
  if (result != ISC_R_SUCCESS) {
    isc_log_write(DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_HINTS,
            ISC_LOG_WARNING,
            "checkhints%s%s: unable to get root NS rrset "
            "from cache: %s",
            sep, viewname, isc_result_totext(result));
    goto cleanup;
  }

  /*
   * Look for missing root NS names.
   */
  DNS_RDATASET_FOREACH(&rootns) {
    dns_rdata_t rdata = DNS_RDATA_INIT;
    dns_rdataset_current(&rootns, &rdata);
    result = dns_rdata_tostruct(&rdata, &ns, NULL);
    RUNTIME_CHECK(result == ISC_R_SUCCESS);
    result = in_rootns(&hintns, &ns.name);
    if (result != ISC_R_SUCCESS) {
      char namebuf[DNS_NAME_FORMATSIZE];
      /* missing from hints */
      dns_name_format(&ns.name, namebuf, sizeof(namebuf));
      isc_log_write(DNS_LOGCATEGORY_GENERAL,
              DNS_LOGMODULE_HINTS, ISC_LOG_WARNING,
              "checkhints%s%s: unable to find root "
              "NS '%s' in hints",
              sep, viewname, namebuf);
    } else {
      check_address_records(view, hints, db, &ns.name, now);
    }
  }

  /*
   * Look for extra root NS names.
   */
  DNS_RDATASET_FOREACH(&hintns) {
    dns_rdata_t rdata = DNS_RDATA_INIT;
    dns_rdataset_current(&hintns, &rdata);
    result = dns_rdata_tostruct(&rdata, &ns, NULL);
    RUNTIME_CHECK(result == ISC_R_SUCCESS);
    result = in_rootns(&rootns, &ns.name);
    if (result != ISC_R_SUCCESS) {
      char namebuf[DNS_NAME_FORMATSIZE];
      /* extra entry in hints */
      dns_name_format(&ns.name, namebuf, sizeof(namebuf));
      isc_log_write(DNS_LOGCATEGORY_GENERAL,
              DNS_LOGMODULE_HINTS, ISC_LOG_WARNING,
              "checkhints%s%s: extra NS '%s' in hints",
              sep, viewname, namebuf);
    }
  }

cleanup:
  if (dns_rdataset_isassociated(&rootns)) {
    dns_rdataset_disassociate(&rootns);
  }
  if (dns_rdataset_isassociated(&hintns)) {
    dns_rdataset_disassociate(&hintns);
  }
}

Coverage Report

Created: 2025-12-12 06:30

Line	Count	Source
1		/*
2		* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
3		*
4		* SPDX-License-Identifier: MPL-2.0
5		*
6		* This Source Code Form is subject to the terms of the Mozilla Public
7		* License, v. 2.0. If a copy of the MPL was not distributed with this
8		* file, you can obtain one at https://mozilla.org/MPL/2.0/.
9		*
10		* See the COPYRIGHT file distributed with this work for additional
11		* information regarding copyright ownership.
12		*/
13
14		/! \file /
15
16		#include <stdbool.h>
17
18		#include <isc/buffer.h>
19		#include <isc/log.h>
20		#include <isc/result.h>
21		#include <isc/string.h>
22		#include <isc/util.h>
23
24		#include <dns/callbacks.h>
25		#include <dns/db.h>
26		#include <dns/dbiterator.h>
27		#include <dns/fixedname.h>
28		#include <dns/master.h>
29		#include <dns/rdata.h>
30		#include <dns/rdataset.h>
31		#include <dns/rdatasetiter.h>
32		#include <dns/rdatastruct.h>
33		#include <dns/rdatatype.h>
34		#include <dns/rootns.h>
35		#include <dns/view.h>
36
37		/*
38		* Also update 'upcoming' when updating 'root_ns'.
39		*/
40		static char root_ns[] =
41		";\n"
42		"; Internet Root Nameservers\n"
43		";\n"
44		"$TTL 518400\n"
45		". 518400 IN NS A.ROOT-SERVERS.NET.\n"
46		". 518400 IN NS B.ROOT-SERVERS.NET.\n"
47		". 518400 IN NS C.ROOT-SERVERS.NET.\n"
48		". 518400 IN NS D.ROOT-SERVERS.NET.\n"
49		". 518400 IN NS E.ROOT-SERVERS.NET.\n"
50		". 518400 IN NS F.ROOT-SERVERS.NET.\n"
51		". 518400 IN NS G.ROOT-SERVERS.NET.\n"
52		". 518400 IN NS H.ROOT-SERVERS.NET.\n"
53		". 518400 IN NS I.ROOT-SERVERS.NET.\n"
54		". 518400 IN NS J.ROOT-SERVERS.NET.\n"
55		". 518400 IN NS K.ROOT-SERVERS.NET.\n"
56		". 518400 IN NS L.ROOT-SERVERS.NET.\n"
57		". 518400 IN NS M.ROOT-SERVERS.NET.\n"
58		"A.ROOT-SERVERS.NET. 3600000 IN A 198.41.0.4\n"
59		"A.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:503:BA3E::2:30\n"
60		"B.ROOT-SERVERS.NET. 3600000 IN A 170.247.170.2\n"
61		"B.ROOT-SERVERS.NET. 3600000 IN AAAA 2801:1b8:10::b\n"
62		"C.ROOT-SERVERS.NET. 3600000 IN A 192.33.4.12\n"
63		"C.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:2::c\n"
64		"D.ROOT-SERVERS.NET. 3600000 IN A 199.7.91.13\n"
65		"D.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:2d::d\n"
66		"E.ROOT-SERVERS.NET. 3600000 IN A 192.203.230.10\n"
67		"E.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:a8::e\n"
68		"F.ROOT-SERVERS.NET. 3600000 IN A 192.5.5.241\n"
69		"F.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:2F::F\n"
70		"G.ROOT-SERVERS.NET. 3600000 IN A 192.112.36.4\n"
71		"G.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:12::d0d\n"
72		"H.ROOT-SERVERS.NET. 3600000 IN A 198.97.190.53\n"
73		"H.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:1::53\n"
74		"I.ROOT-SERVERS.NET. 3600000 IN A 192.36.148.17\n"
75		"I.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:7fe::53\n"
76		"J.ROOT-SERVERS.NET. 3600000 IN A 192.58.128.30\n"
77		"J.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:503:C27::2:30\n"
78		"K.ROOT-SERVERS.NET. 3600000 IN A 193.0.14.129\n"
79		"K.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:7FD::1\n"
80		"L.ROOT-SERVERS.NET. 3600000 IN A 199.7.83.42\n"
81		"L.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:9f::42\n"
82		"M.ROOT-SERVERS.NET. 3600000 IN A 202.12.27.33\n"
83		"M.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:DC3::35\n";
84
85		static unsigned char b_data[] = "\001b\014root-servers\003net";
86
87		static struct upcoming {
88		const dns_name_t name;
89		dns_rdatatype_t type;
90		isc_stdtime_t time;
91		} upcoming[] = { {
92		.name = DNS_NAME_INITABSOLUTE(b_data),
93		.type = dns_rdatatype_a,
94		.time = 1701086400 /* November 27 2023, 12:00 UTC */
95		},
96		{
97		.name = DNS_NAME_INITABSOLUTE(b_data),
98		.type = dns_rdatatype_aaaa,
99		.time = 1701086400 /* November 27 2023, 12:00 UTC */
100		} };
101
102		static isc_result_t
103	0	in_rootns(dns_rdataset_t rootns, dns_name_t name) {
104	0	dns_rdata_ns_t ns;
105
106	0	if (!dns_rdataset_isassociated(rootns)) {
107	0	return ISC_R_NOTFOUND;
108	0	}
109
110	0	DNS_RDATASET_FOREACH(rootns) {
111	0	dns_rdata_t rdata = DNS_RDATA_INIT;
112	0	dns_rdataset_current(rootns, &rdata);
113	0	RETERR(dns_rdata_tostruct(&rdata, &ns, NULL));
114	0	if (dns_name_compare(name, &ns.name) == 0) {
115	0	return ISC_R_SUCCESS;
116	0	}
117	0	}
118	0	return ISC_R_NOTFOUND;
119	0	}
120
121		static isc_result_t
122		check_node(dns_rdataset_t rootns, dns_name_t name,
123	0	dns_rdatasetiter_t *rdsiter) {
124	0	DNS_RDATASETITER_FOREACH(rdsiter) {
125	0	dns_rdataset_t rdataset = DNS_RDATASET_INIT;
126	0	dns_rdatasetiter_current(rdsiter, &rdataset);
127	0	dns_rdatatype_t type = rdataset.type;
128	0	dns_rdataset_disassociate(&rdataset);
129
130	0	switch (type) {
131	0	case dns_rdatatype_a:
132	0	case dns_rdatatype_aaaa:
133	0	return in_rootns(rootns, name);
134	0	case dns_rdatatype_ns:
135	0	if (dns_name_compare(name, dns_rootname) == 0) {
136	0	return ISC_R_SUCCESS;
137	0	}
138	0	FALLTHROUGH;
139	0	default:
140	0	return ISC_R_FAILURE;
141	0	}
142	0	}
143
144	0	return ISC_R_SUCCESS;
145	0	}
146
147		static isc_result_t
148	0	check_hints(dns_db_t *db) {
149	0	isc_result_t result;
150	0	dns_rdataset_t rootns;
151	0	dns_dbiterator_t *dbiter = NULL;
152	0	dns_dbnode_t *node = NULL;
153	0	isc_stdtime_t now = isc_stdtime_now();
154	0	dns_fixedname_t fixname;
155	0	dns_name_t *name;
156	0	dns_rdatasetiter_t *rdsiter = NULL;
157
158	0	name = dns_fixedname_initname(&fixname);
159
160	0	dns_rdataset_init(&rootns);
161	0	(void)dns_db_find(db, dns_rootname, NULL, dns_rdatatype_ns, 0, now,
162	0	NULL, name, &rootns, NULL);
163	0	CHECK(dns_db_createiterator(db, 0, &dbiter));
164	0	DNS_DBITERATOR_FOREACH(dbiter) {
165	0	CHECK(dns_dbiterator_current(dbiter, &node, name));
166	0	CHECK(dns_db_allrdatasets(db, node, NULL, 0, now, &rdsiter));
167	0	CHECK(check_node(&rootns, name, rdsiter));
168	0	dns_rdatasetiter_destroy(&rdsiter);
169	0	dns_db_detachnode(&node);
170	0	}
171
172	0	cleanup:
173	0	if (dns_rdataset_isassociated(&rootns)) {
174	0	dns_rdataset_disassociate(&rootns);
175	0	}
176	0	if (rdsiter != NULL) {
177	0	dns_rdatasetiter_destroy(&rdsiter);
178	0	}
179	0	if (node != NULL) {
180	0	dns_db_detachnode(&node);
181	0	}
182	0	if (dbiter != NULL) {
183	0	dns_dbiterator_destroy(&dbiter);
184	0	}
185	0	return result;
186	0	}
187
188		isc_result_t
189		dns_rootns_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
190	0	const char filename, dns_db_t *target) {
191	0	isc_result_t result, eresult;
192	0	isc_buffer_t source;
193	0	unsigned int len;
194	0	dns_rdatacallbacks_t callbacks;
195	0	dns_db_t *db = NULL;
196
197	0	REQUIRE(target != NULL && *target == NULL);
198
199	0	CHECK(dns_db_create(mctx, ZONEDB_DEFAULT, dns_rootname, dns_dbtype_zone,
200	0	rdclass, 0, NULL, &db));
201
202	0	len = strlen(root_ns);
203	0	isc_buffer_init(&source, root_ns, len);
204	0	isc_buffer_add(&source, len);
205
206	0	dns_rdatacallbacks_init(&callbacks);
207	0	CHECK(dns_db_beginload(db, &callbacks));
208	0	if (filename != NULL) {
209		/*
210		* Load the hints from the specified filename.
211		*/
212	0	result = dns_master_loadfile(filename, &db->origin, &db->origin,
213	0	db->rdclass, DNS_MASTER_HINT, 0,
214	0	&callbacks, NULL, NULL, db->mctx,
215	0	dns_masterformat_text, 0);
216	0	} else if (rdclass == dns_rdataclass_in) {
217		/*
218		* Default to using the Internet root servers.
219		*/
220	0	result = dns_master_loadbuffer(
221	0	&source, &db->origin, &db->origin, db->rdclass,
222	0	DNS_MASTER_HINT, &callbacks, db->mctx);
223	0	} else {
224	0	result = ISC_R_NOTFOUND;
225	0	}
226	0	eresult = dns_db_endload(db, &callbacks);
227	0	if (result == ISC_R_SUCCESS \|\| result == DNS_R_SEENINCLUDE) {
228	0	result = eresult;
229	0	}
230	0	if (result != DNS_R_SEENINCLUDE) {
231	0	CHECK(result);
232	0	}
233	0	if (check_hints(db) != ISC_R_SUCCESS) {
234	0	isc_log_write(DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_HINTS,
235	0	ISC_LOG_WARNING, "extra data in root hints '%s'",
236	0	(filename != NULL) ? filename : "<BUILT-IN>");
237	0	}
238	0	*target = db;
239	0	return ISC_R_SUCCESS;
240
241	0	cleanup:
242	0	isc_log_write(DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_HINTS,
243	0	ISC_LOG_ERROR,
244	0	"could not configure root hints from "
245	0	"'%s': %s",
246	0	(filename != NULL) ? filename : "<BUILT-IN>",
247	0	isc_result_totext(result));
248
249	0	if (db != NULL) {
250	0	dns_db_detach(&db);
251	0	}
252
253	0	return result;
254	0	}
255
256		static void
257	0	report(dns_view_t view, dns_name_t name, bool missing, dns_rdata_t *rdata) {
258	0	const char viewname = "", sep = "";
259	0	char namebuf[DNS_NAME_FORMATSIZE];
260	0	char typebuf[DNS_RDATATYPE_FORMATSIZE];
261	0	char databuf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:123.123.123.123")];
262	0	isc_buffer_t buffer;
263	0	isc_result_t result;
264
265	0	if (strcmp(view->name, "_bind") != 0 &&
266	0	strcmp(view->name, "_default") != 0)
267	0	{
268	0	viewname = view->name;
269	0	sep = ": view ";
270	0	}
271
272	0	dns_name_format(name, namebuf, sizeof(namebuf));
273	0	dns_rdatatype_format(rdata->type, typebuf, sizeof(typebuf));
274	0	isc_buffer_init(&buffer, databuf, sizeof(databuf) - 1);
275	0	result = dns_rdata_totext(rdata, NULL, &buffer);
276	0	RUNTIME_CHECK(result == ISC_R_SUCCESS);
277	0	databuf[isc_buffer_usedlength(&buffer)] = '\0';
278
279	0	if (missing) {
280	0	isc_log_write(DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_HINTS,
281	0	ISC_LOG_WARNING,
282	0	"checkhints%s%s: %s/%s (%s) missing from hints",
283	0	sep, viewname, namebuf, typebuf, databuf);
284	0	} else {
285	0	isc_log_write(DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_HINTS,
286	0	ISC_LOG_WARNING,
287	0	"checkhints%s%s: %s/%s (%s) extra record "
288	0	"in hints",
289	0	sep, viewname, namebuf, typebuf, databuf);
290	0	}
291	0	}
292
293		static bool
294	0	inrrset(dns_rdataset_t rrset, dns_rdata_t rdata) {
295	0	DNS_RDATASET_FOREACH(rrset) {
296	0	dns_rdata_t current = DNS_RDATA_INIT;
297	0	dns_rdataset_current(rrset, &current);
298	0	if (dns_rdata_compare(rdata, &current) == 0) {
299	0	return true;
300	0	}
301	0	}
302	0	return false;
303	0	}
304
305		static bool
306	0	changing(const dns_name_t *name, dns_rdatatype_t type, isc_stdtime_t now) {
307	0	for (size_t i = 0; i < ARRAY_SIZE(upcoming); i++) {
308	0	if (upcoming[i].time > now && upcoming[i].type == type &&
309	0	dns_name_equal(&upcoming[i].name, name))
310	0	{
311	0	return true;
312	0	}
313	0	}
314	0	return false;
315	0	}
316
317		/*
318		* Check that the address RRsets match.
319		*
320		* Note we don't complain about missing glue records.
321		*/
322
323		static void
324		check_address_records(dns_view_t view, dns_db_t hints, dns_db_t *db,
325	0	dns_name_t *name, isc_stdtime_t now) {
326	0	isc_result_t hresult, rresult;
327	0	dns_rdataset_t hintrrset, rootrrset;
328	0	dns_name_t *foundname;
329	0	dns_fixedname_t fixed;
330
331	0	dns_rdataset_init(&hintrrset);
332	0	dns_rdataset_init(&rootrrset);
333	0	foundname = dns_fixedname_initname(&fixed);
334
335	0	hresult = dns_db_find(hints, name, NULL, dns_rdatatype_a, 0, now, NULL,
336	0	foundname, &hintrrset, NULL);
337	0	rresult = dns_db_find(db, name, NULL, dns_rdatatype_a,
338	0	DNS_DBFIND_GLUEOK, now, NULL, foundname,
339	0	&rootrrset, NULL);
340	0	if (hresult == ISC_R_SUCCESS &&
341	0	(rresult == ISC_R_SUCCESS \|\| rresult == DNS_R_GLUE))
342	0	{
343	0	DNS_RDATASET_FOREACH(&rootrrset) {
344	0	dns_rdata_t rdata = DNS_RDATA_INIT;
345	0	dns_rdataset_current(&rootrrset, &rdata);
346	0	if (!inrrset(&hintrrset, &rdata) &&
347	0	!changing(name, dns_rdatatype_a, now))
348	0	{
349	0	report(view, name, true, &rdata);
350	0	}
351	0	}
352	0	DNS_RDATASET_FOREACH(&hintrrset) {
353	0	dns_rdata_t rdata = DNS_RDATA_INIT;
354	0	dns_rdataset_current(&hintrrset, &rdata);
355	0	if (!inrrset(&rootrrset, &rdata) &&
356	0	!changing(name, dns_rdatatype_a, now))
357	0	{
358	0	report(view, name, false, &rdata);
359	0	}
360	0	}
361	0	}
362	0	if (hresult == ISC_R_NOTFOUND &&
363	0	(rresult == ISC_R_SUCCESS \|\| rresult == DNS_R_GLUE))
364	0	{
365	0	DNS_RDATASET_FOREACH(&rootrrset) {
366	0	dns_rdata_t rdata = DNS_RDATA_INIT;
367	0	dns_rdataset_current(&rootrrset, &rdata);
368	0	report(view, name, true, &rdata);
369	0	}
370	0	}
371	0	if (dns_rdataset_isassociated(&rootrrset)) {
372	0	dns_rdataset_disassociate(&rootrrset);
373	0	}
374	0	if (dns_rdataset_isassociated(&hintrrset)) {
375	0	dns_rdataset_disassociate(&hintrrset);
376	0	}
377
378		/*
379		* Check AAAA records.
380		*/
381	0	hresult = dns_db_find(hints, name, NULL, dns_rdatatype_aaaa, 0, now,
382	0	NULL, foundname, &hintrrset, NULL);
383	0	rresult = dns_db_find(db, name, NULL, dns_rdatatype_aaaa,
384	0	DNS_DBFIND_GLUEOK, now, NULL, foundname,
385	0	&rootrrset, NULL);
386	0	if (hresult == ISC_R_SUCCESS &&
387	0	(rresult == ISC_R_SUCCESS \|\| rresult == DNS_R_GLUE))
388	0	{
389	0	DNS_RDATASET_FOREACH(&rootrrset) {
390	0	dns_rdata_t rdata = DNS_RDATA_INIT;
391	0	dns_rdataset_current(&rootrrset, &rdata);
392	0	if (!inrrset(&hintrrset, &rdata) &&
393	0	!changing(name, dns_rdatatype_aaaa, now))
394	0	{
395	0	report(view, name, true, &rdata);
396	0	}
397	0	}
398	0	DNS_RDATASET_FOREACH(&hintrrset) {
399	0	dns_rdata_t rdata = DNS_RDATA_INIT;
400	0	dns_rdataset_current(&hintrrset, &rdata);
401	0	if (!inrrset(&rootrrset, &rdata) &&
402	0	!changing(name, dns_rdatatype_aaaa, now))
403	0	{
404	0	report(view, name, false, &rdata);
405	0	}
406	0	}
407	0	}
408	0	if (hresult == ISC_R_NOTFOUND &&
409	0	(rresult == ISC_R_SUCCESS \|\| rresult == DNS_R_GLUE))
410	0	{
411	0	DNS_RDATASET_FOREACH(&rootrrset) {
412	0	dns_rdata_t rdata = DNS_RDATA_INIT;
413	0	dns_rdataset_current(&rootrrset, &rdata);
414	0	report(view, name, true, &rdata);
415	0	}
416	0	}
417	0	if (dns_rdataset_isassociated(&rootrrset)) {
418	0	dns_rdataset_disassociate(&rootrrset);
419	0	}
420	0	if (dns_rdataset_isassociated(&hintrrset)) {
421	0	dns_rdataset_disassociate(&hintrrset);
422	0	}
423	0	}
424
425		void
426	0	dns_root_checkhints(dns_view_t view, dns_db_t hints, dns_db_t *db) {
427	0	isc_result_t result;
428	0	dns_rdata_ns_t ns;
429	0	dns_rdataset_t hintns, rootns;
430	0	const char viewname = "", sep = "";
431	0	isc_stdtime_t now = isc_stdtime_now();
432	0	dns_name_t *name;
433	0	dns_fixedname_t fixed;
434
435	0	REQUIRE(hints != NULL);
436	0	REQUIRE(db != NULL);
437	0	REQUIRE(view != NULL);
438
439	0	if (strcmp(view->name, "_bind") != 0 &&
440	0	strcmp(view->name, "_default") != 0)
441	0	{
442	0	viewname = view->name;
443	0	sep = ": view ";
444	0	}
445
446	0	dns_rdataset_init(&hintns);
447	0	dns_rdataset_init(&rootns);
448	0	name = dns_fixedname_initname(&fixed);
449
450	0	result = dns_db_find(hints, dns_rootname, NULL, dns_rdatatype_ns, 0,
451	0	now, NULL, name, &hintns, NULL);
452	0	if (result != ISC_R_SUCCESS) {
453	0	isc_log_write(DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_HINTS,
454	0	ISC_LOG_WARNING,
455	0	"checkhints%s%s: unable to get root NS rrset "
456	0	"from hints: %s",
457	0	sep, viewname, isc_result_totext(result));
458	0	goto cleanup;
459	0	}
460
461	0	result = dns_db_find(db, dns_rootname, NULL, dns_rdatatype_ns, 0, now,
462	0	NULL, name, &rootns, NULL);
463	0	if (result != ISC_R_SUCCESS) {
464	0	isc_log_write(DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_HINTS,
465	0	ISC_LOG_WARNING,
466	0	"checkhints%s%s: unable to get root NS rrset "
467	0	"from cache: %s",
468	0	sep, viewname, isc_result_totext(result));
469	0	goto cleanup;
470	0	}
471
472		/*
473		* Look for missing root NS names.
474		*/
475	0	DNS_RDATASET_FOREACH(&rootns) {
476	0	dns_rdata_t rdata = DNS_RDATA_INIT;
477	0	dns_rdataset_current(&rootns, &rdata);
478	0	result = dns_rdata_tostruct(&rdata, &ns, NULL);
479	0	RUNTIME_CHECK(result == ISC_R_SUCCESS);
480	0	result = in_rootns(&hintns, &ns.name);
481	0	if (result != ISC_R_SUCCESS) {
482	0	char namebuf[DNS_NAME_FORMATSIZE];
483		/* missing from hints */
484	0	dns_name_format(&ns.name, namebuf, sizeof(namebuf));
485	0	isc_log_write(DNS_LOGCATEGORY_GENERAL,
486	0	DNS_LOGMODULE_HINTS, ISC_LOG_WARNING,
487	0	"checkhints%s%s: unable to find root "
488	0	"NS '%s' in hints",
489	0	sep, viewname, namebuf);
490	0	} else {
491	0	check_address_records(view, hints, db, &ns.name, now);
492	0	}
493	0	}
494
495		/*
496		* Look for extra root NS names.
497		*/
498	0	DNS_RDATASET_FOREACH(&hintns) {
499	0	dns_rdata_t rdata = DNS_RDATA_INIT;
500	0	dns_rdataset_current(&hintns, &rdata);
501	0	result = dns_rdata_tostruct(&rdata, &ns, NULL);
502	0	RUNTIME_CHECK(result == ISC_R_SUCCESS);
503	0	result = in_rootns(&rootns, &ns.name);
504	0	if (result != ISC_R_SUCCESS) {
505	0	char namebuf[DNS_NAME_FORMATSIZE];
506		/* extra entry in hints */
507	0	dns_name_format(&ns.name, namebuf, sizeof(namebuf));
508	0	isc_log_write(DNS_LOGCATEGORY_GENERAL,
509	0	DNS_LOGMODULE_HINTS, ISC_LOG_WARNING,
510	0	"checkhints%s%s: extra NS '%s' in hints",
511	0	sep, viewname, namebuf);
512	0	}
513	0	}
514
515	0	cleanup:
516	0	if (dns_rdataset_isassociated(&rootns)) {
517	0	dns_rdataset_disassociate(&rootns);
518	0	}
519	0	if (dns_rdataset_isassociated(&hintns)) {
520	0	dns_rdataset_disassociate(&hintns);
521	0	}
522	0	}