Extended DNS Errors a la RFC8914

daemon/worker.c

@@ -485,6 +485,8 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 				msg->rep, LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
 				worker->env.now_tv))
 					return 0;
+			EDNS_OPT_APPEND_EDE(edns, worker->scratchpad,
+				LDNS_EDE_DNSSEC_BOGUS, "");
 			error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
 				&msg->qinfo, id, flags, edns);
 			if(worker->stats.extended) {
@@ -659,6 +661,8 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 			LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad,
 			worker->env.now_tv))
 			goto bail_out;
+		EDNS_OPT_APPEND_EDE(edns, worker->scratchpad,
+			LDNS_EDE_DNSSEC_BOGUS, "");
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL,
 			qinfo, id, flags, edns);
 		rrset_array_unlock_touch(worker->env.rrset_cache,
@@ -1290,6 +1294,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				edns.udp_size = EDNS_ADVERTISED_SIZE;
 				edns.bits &= EDNS_DO;
 				edns.opt_list = NULL;
+				EDNS_OPT_APPEND_EDE(&edns, worker->scratchpad,
+					LDNS_EDE_OTHER, "query with bad edns keepalive");
 				verbose(VERB_ALGO, "query with bad edns keepalive.");
 				log_addr(VERB_CLIENT,"from",&repinfo->addr, repinfo->addrlen);
 				error_encode(c->buffer, LDNS_RCODE_FORMERR, &qinfo,
@@ -1402,12 +1408,23 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	 * ACLs allow the snooping. */
 	if(!(LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) &&
 		acl != acl_allow_snoop ) {
+
+
+
+		// @TODO ADD Error Code 20 - Not Authoritative
+		// @TODO add EDNS record
+
+		EDNS_OPT_APPEND_EDE(&edns, worker->scratchpad,
+			LDNS_EDE_NOT_AUTHORITATIVE, "Not Authoritative");
+
+
 		error_encode(c->buffer, LDNS_RCODE_REFUSED, &qinfo,
 			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
-			sldns_buffer_read_u16_at(c->buffer, 2), NULL);
+			sldns_buffer_read_u16_at(c->buffer, 2), &edns);
 		regional_free_all(worker->scratchpad);
 		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
 			&repinfo->addr, repinfo->addrlen);
+
 		goto send_reply;
 	}
 
@@ -1480,10 +1497,23 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 						< *worker->env.now)
 						leeway = 0;
 					lock_rw_unlock(&e->lock);
+
+					// // stale answer? 
+					// if (worker->env.cfg->serve_expired &&
+					// 	*worker->env.now >= ((struct reply_info*)e->data)->ttl) {
+					// 	// EDE Error Code 3 - Stale Answer
+					// 	EDNS_OPT_APPEND_EDE(&edns, worker->scratchpad,
+					// LDNS_EDE_STALE_ANSWER, "");
+					// }
+
+					// add EDNS struct?
 					reply_and_prefetch(worker, lookup_qinfo,
 						sldns_buffer_read_u16_at(c->buffer, 2),
 						repinfo, leeway,
 						(partial_rep || need_drop));
+
+
+
 					if(!partial_rep) {
 						rc = 0;
 						regional_free_all(worker->scratchpad);
@@ -1520,6 +1550,9 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			verbose(VERB_ALGO, "answer from the cache failed");
 			lock_rw_unlock(&e->lock);
 		}
+
+		// @TODO Extended DNS Error Code 13 - Cached Error? place not clear
+
 		if(!LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) {
 			if(answer_norec_from_cache(worker, &qinfo,
 				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer), 

services/mesh.c

@@ -1271,6 +1271,20 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 				&r->edns, &r->query_reply, m->s.region, &r->start_time))
 					r->edns.opt_list = NULL;
 		}
+		/* Send along EDE BOGUS EDNS0 option when answer is bogus */
+		if(rcode == LDNS_RCODE_SERVFAIL &&
+			m->s.env->need_to_validate && (!(r->qflags&BIT_CD) ||
+			m->s.env->cfg->ignore_cd) && rep &&
+			(rep->security <= sec_status_bogus ||
+			rep->security == sec_status_secure_sentinel_fail)) {
+
+			char *reason = m->s.env->cfg->val_log_level >= 2
+			             ? errinf_to_str_bogus(&m->s) : NULL;
+
+			edns_opt_append_ede(&r->edns, m->s.region,
+					LDNS_EDE_DNSSEC_BOGUS, reason);
+			free(reason);
+		}
 		error_encode(r_buffer, rcode, &m->s.qinfo, r->qid,
 			r->qflags, &r->edns);
 		m->reply_list = NULL;

services/rpz.c

@@ -1037,6 +1037,8 @@ rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env,
 		return 0;
 	}
 
+
+	// @TODO: Find out if it's local answer of blocked; if blocked then EDE: blocked
 	if(lzt == local_zone_redirect && local_data_answer(z, env, qinfo,
 		edns, repinfo, buf, temp, dname_count_labels(qinfo->qname),
 		&ld, lzt, -1, NULL, 0, NULL, 0)) {

sldns/rrdef.h

@@ -428,10 +428,41 @@ enum sldns_enum_edns_option
 	LDNS_EDNS_CLIENT_SUBNET = 8, /* RFC7871 */
 	LDNS_EDNS_KEEPALIVE = 11, /* draft-ietf-dnsop-edns-tcp-keepalive*/
 	LDNS_EDNS_PADDING = 12, /* RFC7830 */
+	LDNS_EDNS_EDE = 15, /* RFC8914 */
 	LDNS_EDNS_CLIENT_TAG = 16 /* draft-bellis-dnsop-edns-tags-01 */
 };
 typedef enum sldns_enum_edns_option sldns_edns_option;
 
+enum sldns_enum_ede_code
+{
+	LDNS_EDE_OTHER = 0,
+	LDNS_EDE_UNSUPPORTED_DNSKEY_ALG = 1,
+	LDNS_EDE_UNSUPPORTED_DS_DIGEST = 2,
+	LDNS_EDE_STALE_ANSWER = 3,
+	LDNS_EDE_FORGED_ANSWER = 4,
+	LDNS_EDE_DNSSEC_INDETERMINATE = 5,
+	LDNS_EDE_DNSSEC_BOGUS = 6,
+	LDNS_EDE_SIGNATURE_EXPIRED = 7,
+	LDNS_EDE_SIGNATURE_NOT_YET_VALID = 8,
+	LDNS_EDE_DNSKEY_MISSING = 9,
+	LDNS_EDE_RRSIGS_MISSING = 10,
+	LDNS_EDE_NO_ZONE_KEY_BIT_SET = 11,
+	LDNS_EDE_NSEC_MISSING = 12,
+	LDNS_EDE_CACHED_ERROR = 13,
+	LDNS_EDE_NOT_READY = 14,
+	LDNS_EDE_BLOCKED = 15,
+	LDNS_EDE_CENSORED = 16,
+	LDNS_EDE_FILTERED = 17,
+	LDNS_EDE_PROHIBITED = 18,
+	LDNS_EDE_STALE_NXDOMAIN_ANSWER = 19,
+	LDNS_EDE_NOT_AUTHORITATIVE = 20,
+	LDNS_EDE_NOT_SUPPORTED = 21,
+	LDNS_EDE_NO_REACHABLE_AUTHORITY = 22,
+	LDNS_EDE_NETWORK_ERROR = 23,
+	LDNS_EDE_INVALID_DATA = 24
+};
+typedef enum sldns_enum_ede_code sldns_ede_code;
+
 #define LDNS_EDNS_MASK_DO_BIT 0x8000
 
 /** TSIG and TKEY extended rcodes (16bit), 0-15 are the normal rcodes. */

util/data/msgreply.c

@@ -988,6 +988,35 @@ int edns_opt_append(struct edns_data* edns, struct regional* region,
 	return 1;
 }
 
+int edns_opt_append_ede(struct edns_data* edns, struct regional* region,
+	sldns_ede_code code, const char *txt)
+{
+	struct edns_option** prevp;
+	struct edns_option* opt;
+	size_t txt_len = txt ? strlen(txt) : 0;
+
+	/* allocate new element */
+	opt = (struct edns_option*)regional_alloc(region, sizeof(*opt));
+	if(!opt)
+		return 0;
+	opt->next = NULL;
+	opt->opt_code = LDNS_EDNS_EDE;
+	opt->opt_len = txt_len + sizeof(uint16_t);
+	opt->opt_data = regional_alloc(region, txt_len + sizeof(uint16_t));
+	if(!opt->opt_data)
+		return 0;
+	sldns_write_uint16(opt->opt_data, (uint16_t)code);
+	if (txt_len)
+		strncpy(opt->opt_data + 2, txt, txt_len);
+
+	/* append at end of list */
+	prevp = &edns->opt_list;
+	while(*prevp != NULL)
+		prevp = &((*prevp)->next);
+	*prevp = opt;
+	return 1;
+}
+
 int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
 	uint8_t* data, struct regional* region)
 {

util/data/msgreply.h

@@ -43,6 +43,7 @@
 #define UTIL_DATA_MSGREPLY_H
 #include "util/storage/lruhash.h"
 #include "util/data/packed_rrset.h"
+#include "sldns/rrdef.h"
 struct sldns_buffer;
 struct comm_reply;
 struct alloc_cache;
@@ -515,6 +516,35 @@ void log_query_info(enum verbosity_value v, const char* str,
 int edns_opt_append(struct edns_data* edns, struct regional* region,
 	uint16_t code, size_t len, uint8_t* data);
 
+/**
+ * Append edns EDE option to edns options list
+ * @param EDNS: the edns data structure to append the edns option to.
+ * @param REGION: region to allocate the new edns option.
+ * @param CODE: the EDE code.
+ * @param TXT: Additional text for the option
+ */
+#define EDNS_OPT_APPEND_EDE(EDNS, REGION, CODE, TXT) 			\
+	do {								\
+		struct {						\
+			uint16_t code;					\
+			char text[sizeof(TXT) - 1];			\
+		} ede = { htons(CODE), TXT };				\
+		edns_opt_append((EDNS), (REGION), LDNS_EDNS_EDE, 	\
+			sizeof(uint16_t) + sizeof(TXT) - 1,		\
+			(void *)&ede);					\
+	} while(0)
+
+/**
+ * Append edns EDE option to edns options list
+ * @param edns: the edns data structure to append the edns option to.
+ * @param region: region to allocate the new edns option.
+ * @param code: the EDE code.
+ * @param txt: Additional text for the option
+ * @return false on failure.
+ */
+int edns_opt_append_ede(struct edns_data* edns, struct regional* region,
+	sldns_ede_code code, const char *txt);
+
 /**
  * Append edns option to edns option list
  * @param list: the edns option list to append the edns option to.