1 #if !defined(lint) && !defined(SABER)
2 static const char rcsid[] = "$Id: res_findzonecut.c,v 1.10 2005/10/11 00:10:16 marka Exp $";
3 #endif /* not lint */
4 
5 /*
6  * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
7  * Copyright (c) 1999 by Internet Software Consortium.
8  *
9  * Permission to use, copy, modify, and distribute this software for any
10  * purpose with or without fee is hereby granted, provided that the above
11  * copyright notice and this permission notice appear in all copies.
12  *
13  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
14  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
15  * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
16  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
17  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
19  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20  */
21 
22 /* Import. */
23 
24 #include "port_before.h"
25 
26 #include <sys/param.h>
27 #include <sys/socket.h>
28 #include <sys/time.h>
29 
30 #include <netinet/in.h>
31 #include <arpa/inet.h>
32 #include <arpa/nameser.h>
33 
34 #include <errno.h>
35 #include <limits.h>
36 #include <netdb.h>
37 #include <stdarg.h>
38 #include <stdio.h>
39 #include <stdlib.h>
40 #include <string.h>
41 
42 #include <isc/list.h>
43 
44 #include "port_after.h"
45 
46 #include <resolv.h>
47 
48 /* Data structures. */
49 
50 typedef struct rr_a {
51 	LINK(struct rr_a)	link;
52 	union res_sockaddr_union addr;
53 } rr_a;
54 typedef LIST(rr_a) rrset_a;
55 
56 typedef struct rr_ns {
57 	LINK(struct rr_ns)	link;
58 	const char *		name;
59 	unsigned int		flags;
60 	rrset_a			addrs;
61 } rr_ns;
62 typedef LIST(rr_ns) rrset_ns;
63 
64 #define	RR_NS_HAVE_V4		0x01
65 #define	RR_NS_HAVE_V6		0x02
66 
67 /* Forward. */
68 
69 static int	satisfy(res_state, const char *, rrset_ns *,
70 			union res_sockaddr_union *, int);
71 static int	add_addrs(res_state, rr_ns *,
72 			  union res_sockaddr_union *, int);
73 static int	get_soa(res_state, const char *, ns_class, int,
74 			char *, size_t, char *, size_t,
75 			rrset_ns *);
76 static int	get_ns(res_state, const char *, ns_class, int, rrset_ns *);
77 static int	get_glue(res_state, ns_class, int, rrset_ns *);
78 static int	save_ns(res_state, ns_msg *, ns_sect,
79 			const char *, ns_class, int, rrset_ns *);
80 static int	save_a(res_state, ns_msg *, ns_sect,
81 		       const char *, ns_class, int, rr_ns *);
82 static void	free_nsrrset(rrset_ns *);
83 static void	free_nsrr(rrset_ns *, rr_ns *);
84 static rr_ns *	find_ns(rrset_ns *, const char *);
85 static int	do_query(res_state, const char *, ns_class, ns_type,
86 			 u_char *, ns_msg *);
87 static void	res_dprintf(const char *, ...) ISC_FORMAT_PRINTF(1, 2);
88 
89 /* Macros. */
90 
91 #define DPRINTF(x) do {\
92 		int save_errno = errno; \
93 		if ((statp->options & RES_DEBUG) != 0U) res_dprintf x; \
94 		errno = save_errno; \
95 	} while (0)
96 
97 /* Public. */
98 
99 /*%
100  *	find enclosing zone for a <dname,class>, and some server addresses
101  *
102  * parameters:
103  *\li	res - resolver context to work within (is modified)
104  *\li	dname - domain name whose enclosing zone is desired
105  *\li	class - class of dname (and its enclosing zone)
106  *\li	zname - found zone name
107  *\li	zsize - allocated size of zname
108  *\li	addrs - found server addresses
109  *\li	naddrs - max number of addrs
110  *
111  * return values:
112  *\li	< 0 - an error occurred (check errno)
113  *\li	= 0 - zname is now valid, but addrs[] wasn't changed
114  *\li	> 0 - zname is now valid, and return value is number of addrs[] found
115  *
116  * notes:
117  *\li	this function calls res_nsend() which means it depends on correctly
118  *	functioning recursive nameservers (usually defined in /etc/resolv.conf
119  *	or its local equivilent).
120  *
121  *\li	we start by asking for an SOA<dname,class>.  if we get one as an
122  *	answer, that just means <dname,class> is a zone top, which is fine.
123  *	more than likely we'll be told to go pound sand, in the form of a
124  *	negative answer.
125  *
126  *\li	note that we are not prepared to deal with referrals since that would
127  *	only come from authority servers and our correctly functioning local
128  *	recursive server would have followed the referral and got us something
129  *	more definite.
130  *
131  *\li	if the authority section contains an SOA, this SOA should also be the
132  *	closest enclosing zone, since any intermediary zone cuts would've been
133  *	returned as referrals and dealt with by our correctly functioning local
134  *	recursive name server.  but an SOA in the authority section should NOT
135  *	match our dname (since that would have been returned in the answer
136  *	section).  an authority section SOA has to be "above" our dname.
137  *
138  *\li	however, since authority section SOA's were once optional, it's
139  *	possible that we'll have to go hunting for the enclosing SOA by
140  *	ripping labels off the front of our dname -- this is known as "doing
141  *	it the hard way."
142  *
143  *\li	ultimately we want some server addresses, which are ideally the ones
144  *	pertaining to the SOA.MNAME, but only if there is a matching NS RR.
145  *	so the second phase (after we find an SOA) is to go looking for the
146  *	NS RRset for that SOA's zone.
147  *
148  *\li	no answer section processed by this code is allowed to contain CNAME
149  *	or DNAME RR's.  for the SOA query this means we strip a label and
150  *	keep going.  for the NS and A queries this means we just give up.
151  */
152 
153 int
154 res_findzonecut(res_state statp, const char *dname, ns_class class, int opts,
155 		char *zname, size_t zsize, struct in_addr *addrs, int naddrs)
156 {
157 	int result, i;
158 	union res_sockaddr_union *u;
159 
160 
161 	opts |= RES_IPV4ONLY;
162 	opts &= ~RES_IPV6ONLY;
163 
164 	u = calloc(naddrs, sizeof(*u));
165 	if (u == NULL)
166 		return(-1);
167 
168 	result = res_findzonecut2(statp, dname, class, opts, zname, zsize,
169 				  u, naddrs);
170 
171 	for (i = 0; i < result; i++) {
172 		addrs[i] = u[i].sin.sin_addr;
173 	}
174 	free(u);
175 	return (result);
176 }
177 
178 int
179 res_findzonecut2(res_state statp, const char *dname, ns_class class, int opts,
180 		 char *zname, size_t zsize, union res_sockaddr_union *addrs,
181 		 int naddrs)
182 {
183 	char mname[NS_MAXDNAME];
184 	u_long save_pfcode;
185 	rrset_ns nsrrs;
186 	int n;
187 
188 	DPRINTF(("START dname='%s' class=%s, zsize=%ld, naddrs=%d",
189 		 dname, p_class(class), (long)zsize, naddrs));
190 	save_pfcode = statp->pfcode;
191 	statp->pfcode |= RES_PRF_HEAD2 | RES_PRF_HEAD1 | RES_PRF_HEADX |
192 			 RES_PRF_QUES | RES_PRF_ANS |
193 			 RES_PRF_AUTH | RES_PRF_ADD;
194 	INIT_LIST(nsrrs);
195 
196 	DPRINTF(("get the soa, and see if it has enough glue"));
197 	if ((n = get_soa(statp, dname, class, opts, zname, zsize,
198 			 mname, sizeof mname, &nsrrs)) < 0 ||
199 	    ((opts & RES_EXHAUSTIVE) == 0 &&
200 	     (n = satisfy(statp, mname, &nsrrs, addrs, naddrs)) > 0))
201 		goto done;
202 
203 	DPRINTF(("get the ns rrset and see if it has enough glue"));
204 	if ((n = get_ns(statp, zname, class, opts, &nsrrs)) < 0 ||
205 	    ((opts & RES_EXHAUSTIVE) == 0 &&
206 	     (n = satisfy(statp, mname, &nsrrs, addrs, naddrs)) > 0))
207 		goto done;
208 
209 	DPRINTF(("get the missing glue and see if it's finally enough"));
210 	if ((n = get_glue(statp, class, opts, &nsrrs)) >= 0)
211 		n = satisfy(statp, mname, &nsrrs, addrs, naddrs);
212 
213  done:
214 	DPRINTF(("FINISH n=%d (%s)", n, (n < 0) ? strerror(errno) : "OK"));
215 	free_nsrrset(&nsrrs);
216 	statp->pfcode = save_pfcode;
217 	return (n);
218 }
219 
220 /* Private. */
221 
222 static int
223 satisfy(res_state statp, const char *mname, rrset_ns *nsrrsp,
224 	union res_sockaddr_union *addrs, int naddrs)
225 {
226 	rr_ns *nsrr;
227 	int n, x;
228 
229 	n = 0;
230 	nsrr = find_ns(nsrrsp, mname);
231 	if (nsrr != NULL) {
232 		x = add_addrs(statp, nsrr, addrs, naddrs);
233 		addrs += x;
234 		naddrs -= x;
235 		n += x;
236 	}
237 	for (nsrr = HEAD(*nsrrsp);
238 	     nsrr != NULL && naddrs > 0;
239 	     nsrr = NEXT(nsrr, link))
240 		if (ns_samename(nsrr->name, mname) != 1) {
241 			x = add_addrs(statp, nsrr, addrs, naddrs);
242 			addrs += x;
243 			naddrs -= x;
244 			n += x;
245 		}
246 	DPRINTF(("satisfy(%s): %d", mname, n));
247 	return (n);
248 }
249 
250 static int
251 add_addrs(res_state statp, rr_ns *nsrr,
252 	  union res_sockaddr_union *addrs, int naddrs)
253 {
254 	rr_a *arr;
255 	int n = 0;
256 
257 	for (arr = HEAD(nsrr->addrs); arr != NULL; arr = NEXT(arr, link)) {
258 		if (naddrs <= 0)
259 			return (0);
260 		*addrs++ = arr->addr;
261 		naddrs--;
262 		n++;
263 	}
264 	DPRINTF(("add_addrs: %d", n));
265 	return (n);
266 }
267 
268 static int
269 get_soa(res_state statp, const char *dname, ns_class class, int opts,
270 	char *zname, size_t zsize, char *mname, size_t msize,
271 	rrset_ns *nsrrsp)
272 {
273 	char tname[NS_MAXDNAME];
274 	u_char *resp = NULL;
275 	int n, i, ancount, nscount;
276 	ns_sect sect;
277 	ns_msg msg;
278 	u_int rcode;
279 
280 	/*
281 	 * Find closest enclosing SOA, even if it's for the root zone.
282 	 */
283 
284 	/* First canonicalize dname (exactly one unescaped trailing "."). */
285 	if (ns_makecanon(dname, tname, sizeof tname) < 0)
286 		goto cleanup;
287 	dname = tname;
288 
289 	resp = malloc(NS_MAXMSG);
290 	if (resp == NULL)
291 		goto cleanup;
292 
293 	/* Now grovel the subdomains, hunting for an SOA answer or auth. */
294 	for (;;) {
295 		/* Leading or inter-label '.' are skipped here. */
296 		while (*dname == '.')
297 			dname++;
298 
299 		/* Is there an SOA? */
300 		n = do_query(statp, dname, class, ns_t_soa, resp, &msg);
301 		if (n < 0) {
302 			DPRINTF(("get_soa: do_query('%s', %s) failed (%d)",
303 				 dname, p_class(class), n));
304 			goto cleanup;
305 		}
306 		if (n > 0) {
307 			DPRINTF(("get_soa: CNAME or DNAME found"));
308 			sect = ns_s_max, n = 0;
309 		} else {
310 			rcode = ns_msg_getflag(msg, ns_f_rcode);
311 			ancount = ns_msg_count(msg, ns_s_an);
312 			nscount = ns_msg_count(msg, ns_s_ns);
313 			if (ancount > 0 && rcode == ns_r_noerror)
314 				sect = ns_s_an, n = ancount;
315 			else if (nscount > 0)
316 				sect = ns_s_ns, n = nscount;
317 			else
318 				sect = ns_s_max, n = 0;
319 		}
320 		for (i = 0; i < n; i++) {
321 			const char *t;
322 			const u_char *rdata;
323 			ns_rr rr;
324 
325 			if (ns_parserr(&msg, sect, i, &rr) < 0) {
326 				DPRINTF(("get_soa: ns_parserr(%s, %d) failed",
327 					 p_section(sect, ns_o_query), i));
328 				goto cleanup;
329 			}
330 			if (ns_rr_type(rr) == ns_t_cname ||
331 			    ns_rr_type(rr) == ns_t_dname)
332 				break;
333 			if (ns_rr_type(rr) != ns_t_soa ||
334 			    ns_rr_class(rr) != class)
335 				continue;
336 			t = ns_rr_name(rr);
337 			switch (sect) {
338 			case ns_s_an:
339 				if (ns_samedomain(dname, t) == 0) {
340 					DPRINTF(
341 				    ("get_soa: ns_samedomain('%s', '%s') == 0",
342 						dname, t)
343 						);
344 					errno = EPROTOTYPE;
345 					goto cleanup;
346 				}
347 				break;
348 			case ns_s_ns:
349 				if (ns_samename(dname, t) == 1 ||
350 				    ns_samedomain(dname, t) == 0) {
351 					DPRINTF(
352 		       ("get_soa: ns_samename() || !ns_samedomain('%s', '%s')",
353 						dname, t)
354 						);
355 					errno = EPROTOTYPE;
356 					goto cleanup;
357 				}
358 				break;
359 			default:
360 				abort();
361 			}
362 			if (strlen(t) + 1 > zsize) {
363 				DPRINTF(("get_soa: zname(%lu) too small (%lu)",
364 					 (unsigned long)zsize,
365 					 (unsigned long)strlen(t) + 1));
366 				errno = EMSGSIZE;
367 				goto cleanup;
368 			}
369 			strcpy(zname, t);
370 			rdata = ns_rr_rdata(rr);
371 			if (ns_name_uncompress(resp, ns_msg_end(msg), rdata,
372 					       mname, msize) < 0) {
373 				DPRINTF(("get_soa: ns_name_uncompress failed")
374 					);
375 				goto cleanup;
376 			}
377 			if (save_ns(statp, &msg, ns_s_ns,
378 				    zname, class, opts, nsrrsp) < 0) {
379 				DPRINTF(("get_soa: save_ns failed"));
380 				goto cleanup;
381 			}
382 			free(resp);
383 			return (0);
384 		}
385 
386 		/* If we're out of labels, then not even "." has an SOA! */
387 		if (*dname == '\0')
388 			break;
389 
390 		/* Find label-terminating "."; top of loop will skip it. */
391 		while (*dname != '.') {
392 			if (*dname == '\\')
393 				if (*++dname == '\0') {
394 					errno = EMSGSIZE;
395 					goto cleanup;
396 				}
397 			dname++;
398 		}
399 	}
400 	DPRINTF(("get_soa: out of labels"));
401 	errno = EDESTADDRREQ;
402  cleanup:
403 	if (resp != NULL)
404 		free(resp);
405 	return (-1);
406 }
407 
408 static int
409 get_ns(res_state statp, const char *zname, ns_class class, int opts,
410       rrset_ns *nsrrsp)
411 {
412 	u_char *resp;
413 	ns_msg msg;
414 	int n;
415 
416 	resp = malloc(NS_MAXMSG);
417 	if (resp == NULL)
418 		return (-1);
419 
420 	/* Go and get the NS RRs for this zone. */
421 	n = do_query(statp, zname, class, ns_t_ns, resp, &msg);
422 	if (n != 0) {
423 		DPRINTF(("get_ns: do_query('%s', %s) failed (%d)",
424 			 zname, p_class(class), n));
425 		free(resp);
426 		return (-1);
427 	}
428 
429 	/* Remember the NS RRs and associated A RRs that came back. */
430 	if (save_ns(statp, &msg, ns_s_an, zname, class, opts, nsrrsp) < 0) {
431 		DPRINTF(("get_ns save_ns('%s', %s) failed",
432 			 zname, p_class(class)));
433 		free(resp);
434 		return (-1);
435 	}
436 
437 	free(resp);
438 	return (0);
439 }
440 
441 static int
442 get_glue(res_state statp, ns_class class, int opts, rrset_ns *nsrrsp) {
443 	rr_ns *nsrr, *nsrr_n;
444 	u_char *resp;
445 
446 	resp = malloc(NS_MAXMSG);
447 	if (resp == NULL)
448 		return(-1);
449 
450 	/* Go and get the A RRs for each empty NS RR on our list. */
451 	for (nsrr = HEAD(*nsrrsp); nsrr != NULL; nsrr = nsrr_n) {
452 		ns_msg msg;
453 		int n;
454 
455 		nsrr_n = NEXT(nsrr, link);
456 
457 		if ((nsrr->flags & RR_NS_HAVE_V4) == 0) {
458 			n = do_query(statp, nsrr->name, class, ns_t_a,
459 				     resp, &msg);
460 			if (n < 0) {
461 				DPRINTF(
462 				       ("get_glue: do_query('%s', %s') failed",
463 					nsrr->name, p_class(class)));
464 				goto cleanup;
465 			}
466 			if (n > 0) {
467 				DPRINTF((
468 			"get_glue: do_query('%s', %s') CNAME or DNAME found",
469 					 nsrr->name, p_class(class)));
470 			}
471 			if (save_a(statp, &msg, ns_s_an, nsrr->name, class,
472 				   opts, nsrr) < 0) {
473 				DPRINTF(("get_glue: save_r('%s', %s) failed",
474 					 nsrr->name, p_class(class)));
475 				goto cleanup;
476 			}
477 		}
478 
479 		if ((nsrr->flags & RR_NS_HAVE_V6) == 0) {
480 			n = do_query(statp, nsrr->name, class, ns_t_aaaa,
481 				     resp, &msg);
482 			if (n < 0) {
483 				DPRINTF(
484 				       ("get_glue: do_query('%s', %s') failed",
485 					nsrr->name, p_class(class)));
486 				goto cleanup;
487 			}
488 			if (n > 0) {
489 				DPRINTF((
490 			"get_glue: do_query('%s', %s') CNAME or DNAME found",
491 					 nsrr->name, p_class(class)));
492 			}
493 			if (save_a(statp, &msg, ns_s_an, nsrr->name, class,
494 				   opts, nsrr) < 0) {
495 				DPRINTF(("get_glue: save_r('%s', %s) failed",
496 					 nsrr->name, p_class(class)));
497 				goto cleanup;
498 			}
499 		}
500 
501 		/* If it's still empty, it's just chaff. */
502 		if (EMPTY(nsrr->addrs)) {
503 			DPRINTF(("get_glue: removing empty '%s' NS",
504 				 nsrr->name));
505 			free_nsrr(nsrrsp, nsrr);
506 		}
507 	}
508 	free(resp);
509 	return (0);
510 
511  cleanup:
512 	free(resp);
513 	return (-1);
514 }
515 
516 static int
517 save_ns(res_state statp, ns_msg *msg, ns_sect sect,
518 	const char *owner, ns_class class, int opts,
519 	rrset_ns *nsrrsp)
520 {
521 	int i;
522 
523 	for (i = 0; i < ns_msg_count(*msg, sect); i++) {
524 		char tname[MAXDNAME];
525 		const u_char *rdata;
526 		rr_ns *nsrr;
527 		ns_rr rr;
528 
529 		if (ns_parserr(msg, sect, i, &rr) < 0) {
530 			DPRINTF(("save_ns: ns_parserr(%s, %d) failed",
531 				 p_section(sect, ns_o_query), i));
532 			return (-1);
533 		}
534 		if (ns_rr_type(rr) != ns_t_ns ||
535 		    ns_rr_class(rr) != class ||
536 		    ns_samename(ns_rr_name(rr), owner) != 1)
537 			continue;
538 		nsrr = find_ns(nsrrsp, ns_rr_name(rr));
539 		if (nsrr == NULL) {
540 			nsrr = malloc(sizeof *nsrr);
541 			if (nsrr == NULL) {
542 				DPRINTF(("save_ns: malloc failed"));
543 				return (-1);
544 			}
545 			rdata = ns_rr_rdata(rr);
546 			if (ns_name_uncompress(ns_msg_base(*msg),
547 					       ns_msg_end(*msg), rdata,
548 					       tname, sizeof tname) < 0) {
549 				DPRINTF(("save_ns: ns_name_uncompress failed")
550 					);
551 				free(nsrr);
552 				return (-1);
553 			}
554 			nsrr->name = strdup(tname);
555 			if (nsrr->name == NULL) {
556 				DPRINTF(("save_ns: strdup failed"));
557 				free(nsrr);
558 				return (-1);
559 			}
560 			INIT_LINK(nsrr, link);
561 			INIT_LIST(nsrr->addrs);
562 			nsrr->flags = 0;
563 			APPEND(*nsrrsp, nsrr, link);
564 		}
565 		if (save_a(statp, msg, ns_s_ar,
566 			   nsrr->name, class, opts, nsrr) < 0) {
567 			DPRINTF(("save_ns: save_r('%s', %s) failed",
568 				 nsrr->name, p_class(class)));
569 			return (-1);
570 		}
571 	}
572 	return (0);
573 }
574 
575 static int
576 save_a(res_state statp, ns_msg *msg, ns_sect sect,
577        const char *owner, ns_class class, int opts,
578        rr_ns *nsrr)
579 {
580 	int i;
581 
582 	for (i = 0; i < ns_msg_count(*msg, sect); i++) {
583 		ns_rr rr;
584 		rr_a *arr;
585 
586 		if (ns_parserr(msg, sect, i, &rr) < 0) {
587 			DPRINTF(("save_a: ns_parserr(%s, %d) failed",
588 				 p_section(sect, ns_o_query), i));
589 			return (-1);
590 		}
591 		if ((ns_rr_type(rr) != ns_t_a &&
592 		     ns_rr_type(rr) != ns_t_aaaa) ||
593 		    ns_rr_class(rr) != class ||
594 		    ns_samename(ns_rr_name(rr), owner) != 1 ||
595 		    ns_rr_rdlen(rr) != NS_INADDRSZ)
596 			continue;
597 		if ((opts & RES_IPV6ONLY) != 0 && ns_rr_type(rr) != ns_t_aaaa)
598 			continue;
599 		if ((opts & RES_IPV4ONLY) != 0 && ns_rr_type(rr) != ns_t_a)
600 			continue;
601 		arr = malloc(sizeof *arr);
602 		if (arr == NULL) {
603 			DPRINTF(("save_a: malloc failed"));
604 			return (-1);
605 		}
606 		INIT_LINK(arr, link);
607 		memset(&arr->addr, 0, sizeof(arr->addr));
608 		switch (ns_rr_type(rr)) {
609 		case ns_t_a:
610 			arr->addr.sin.sin_family = AF_INET;
611 #ifdef HAVE_SA_LEN
612 			arr->addr.sin.sin_len = sizeof(arr->addr.sin);
613 #endif
614 			memcpy(&arr->addr.sin.sin_addr, ns_rr_rdata(rr),
615 			       NS_INADDRSZ);
616 			arr->addr.sin.sin_port = htons(NAMESERVER_PORT);
617 			nsrr->flags |= RR_NS_HAVE_V4;
618 			break;
619 		case ns_t_aaaa:
620 			arr->addr.sin6.sin6_family = AF_INET6;
621 #ifdef HAVE_SA_LEN
622 			arr->addr.sin6.sin6_len = sizeof(arr->addr.sin6);
623 #endif
624 			memcpy(&arr->addr.sin6.sin6_addr, ns_rr_rdata(rr), 16);
625 			arr->addr.sin.sin_port = htons(NAMESERVER_PORT);
626 			nsrr->flags |= RR_NS_HAVE_V6;
627 			break;
628 		default:
629 			abort();
630 		}
631 		APPEND(nsrr->addrs, arr, link);
632 	}
633 	return (0);
634 }
635 
636 static void
637 free_nsrrset(rrset_ns *nsrrsp) {
638 	rr_ns *nsrr;
639 
640 	while ((nsrr = HEAD(*nsrrsp)) != NULL)
641 		free_nsrr(nsrrsp, nsrr);
642 }
643 
644 static void
645 free_nsrr(rrset_ns *nsrrsp, rr_ns *nsrr) {
646 	rr_a *arr;
647 	char *tmp;
648 
649 	while ((arr = HEAD(nsrr->addrs)) != NULL) {
650 		UNLINK(nsrr->addrs, arr, link);
651 		free(arr);
652 	}
653 	DE_CONST(nsrr->name, tmp);
654 	free(tmp);
655 	UNLINK(*nsrrsp, nsrr, link);
656 	free(nsrr);
657 }
658 
659 static rr_ns *
660 find_ns(rrset_ns *nsrrsp, const char *dname) {
661 	rr_ns *nsrr;
662 
663 	for (nsrr = HEAD(*nsrrsp); nsrr != NULL; nsrr = NEXT(nsrr, link))
664 		if (ns_samename(nsrr->name, dname) == 1)
665 			return (nsrr);
666 	return (NULL);
667 }
668 
669 static int
670 do_query(res_state statp, const char *dname, ns_class class, ns_type qtype,
671 	 u_char *resp, ns_msg *msg)
672 {
673 	u_char req[NS_PACKETSZ];
674 	int i, n;
675 
676 	n = res_nmkquery(statp, ns_o_query, dname, class, qtype,
677 			 NULL, 0, NULL, req, NS_PACKETSZ);
678 	if (n < 0) {
679 		DPRINTF(("do_query: res_nmkquery failed"));
680 		return (-1);
681 	}
682 	n = res_nsend(statp, req, n, resp, NS_MAXMSG);
683 	if (n < 0) {
684 		DPRINTF(("do_query: res_nsend failed"));
685 		return (-1);
686 	}
687 	if (n == 0) {
688 		DPRINTF(("do_query: res_nsend returned 0"));
689 		errno = EMSGSIZE;
690 		return (-1);
691 	}
692 	if (ns_initparse(resp, n, msg) < 0) {
693 		DPRINTF(("do_query: ns_initparse failed"));
694 		return (-1);
695 	}
696 	n = 0;
697 	for (i = 0; i < ns_msg_count(*msg, ns_s_an); i++) {
698 		ns_rr rr;
699 
700 		if (ns_parserr(msg, ns_s_an, i, &rr) < 0) {
701 			DPRINTF(("do_query: ns_parserr failed"));
702 			return (-1);
703 		}
704 		n += (ns_rr_class(rr) == class &&
705 		      (ns_rr_type(rr) == ns_t_cname ||
706 		       ns_rr_type(rr) == ns_t_dname));
707 	}
708 	return (n);
709 }
710 
711 static void
712 res_dprintf(const char *fmt, ...) {
713 	va_list ap;
714 
715 	va_start(ap, fmt);
716 	fputs(";; res_findzonecut: ", stderr);
717 	vfprintf(stderr, fmt, ap);
718 	fputc('\n', stderr);
719 	va_end(ap);
720 }
721 
722 /*! \file */
723