bf43fdafa3bff9e84cb03f1a19aca74514d2516eBob Halley

e419f613d8591885df608cb73065921be07dd12eBob Halley#include <config.h>

e419f613d8591885df608cb73065921be07dd12eBob Halley

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#include <isc/base32.h>

1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence#include <isc/mem.h>

fca5f81ad69098ea8abba130c7f841c951ef91c2Bob Halley#include <isc/print.h>

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#include <isc/sha2.h>

519b239fc4ef1e070e2da182a4ea559ae0152151Mark Andrews#include <isc/string.h>

e419f613d8591885df608cb73065921be07dd12eBob Halley#include <isc/task.h>

e419f613d8591885df608cb73065921be07dd12eBob Halley#include <isc/util.h>

9695ae1c24b168996e3a267855dc754971ccb32cBob Halley

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley#include <dns/db.h>

1c776a2909632bc755f3fddd3b53addd792ab4d0Brian Wellington#include <dns/dnssec.h>

44f175a90a855326725439b2f1178f0dcca8f67dMark Andrews#include <dns/ds.h>

e419f613d8591885df608cb73065921be07dd12eBob Halley#include <dns/events.h>

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley#include <dns/keytable.h>

44f175a90a855326725439b2f1178f0dcca8f67dMark Andrews#include <dns/keyvalues.h>

1b1e1fda4638334b484aa38c15f53a131c0b0fdfAndreas Gustafsson#include <dns/log.h>

e83cae7fa837e4757c687035d6f6c0900f152749Brian Wellington#include <dns/message.h>

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews#include <dns/ncache.h>

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews#include <dns/nsec.h>

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#include <dns/nsec3.h>

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley#include <dns/rdata.h>

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley#include <dns/rdataset.h>

09f22ac5b09e70bc526015f37168ba33e21ea91fDavid Lawrence#include <dns/rdatatype.h>

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington#include <dns/resolver.h>

09f22ac5b09e70bc526015f37168ba33e21ea91fDavid Lawrence#include <dns/result.h>

09f22ac5b09e70bc526015f37168ba33e21ea91fDavid Lawrence#include <dns/validator.h>

e419f613d8591885df608cb73065921be07dd12eBob Halley#include <dns/view.h>

e419f613d8591885df608cb73065921be07dd12eBob Halley

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews

92ef1a9b9dbd48ecb507b42ac62c15afefdaf838David Lawrence#define VALIDATOR_MAGIC ISC_MAGIC('V', 'a', 'l', '?')

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews#define VALID_VALIDATOR(v) ISC_MAGIC_VALID(v, VALIDATOR_MAGIC)

bf43fdafa3bff9e84cb03f1a19aca74514d2516eBob Halley

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews#define VALATTR_SHUTDOWN 0x0001 /*%< Shutting down. */

708383382ff1d3fdd27527e5d63120a3c6c6d3b3Francis Dupont#define VALATTR_CANCELED 0x0002 /*%< Canceled. */

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews#define VALATTR_TRIEDVERIFY 0x0004 /*%< We have found a key and

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews#define VALATTR_INSECURITY 0x0010 /*%< Attempting proveunsecure. */

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews#define VALATTR_DLVTRIED 0x0020 /*%< Looked for a DLV record. */

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#define VALATTR_NEEDNOQNAME 0x00000100

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#define VALATTR_NEEDNOWILDCARD 0x00000200

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#define VALATTR_NEEDNODATA 0x00000400

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#define VALATTR_FOUNDNOQNAME 0x00001000

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#define VALATTR_FOUNDNOWILDCARD 0x00002000

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#define VALATTR_FOUNDNODATA 0x00004000

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#define VALATTR_FOUNDCLOSEST 0x00008000

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#define VALATTR_FOUNDOPTOUT 0x00010000

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews#define VALATTR_FOUNDUNKNOWN 0x00020000

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews#define NEEDNODATA(val) ((val->attributes & VALATTR_NEEDNODATA) != 0)

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews#define NEEDNOQNAME(val) ((val->attributes & VALATTR_NEEDNOQNAME) != 0)

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews#define NEEDNOWILDCARD(val) ((val->attributes & VALATTR_NEEDNOWILDCARD) != 0)

50105afc551903541608b11851d73278b23579a3Mark Andrews#define DLVTRIED(val) ((val->attributes & VALATTR_DLVTRIED) != 0)

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews#define FOUNDNODATA(val) ((val->attributes & VALATTR_FOUNDNODATA) != 0)

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews#define FOUNDNOQNAME(val) ((val->attributes & VALATTR_FOUNDNOQNAME) != 0)

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews#define FOUNDNOWILDCARD(val) ((val->attributes & VALATTR_FOUNDNOWILDCARD) != 0)

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews#define FOUNDCLOSEST(val) ((val->attributes & VALATTR_FOUNDCLOSEST) != 0)

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews#define FOUNDOPTOUT(val) ((val->attributes & VALATTR_FOUNDOPTOUT) != 0)

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley#define SHUTDOWN(v) (((v)->attributes & VALATTR_SHUTDOWN) != 0)

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews#define CANCELED(v) (((v)->attributes & VALATTR_CANCELED) != 0)

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

6de9744cf9c64be2145f663e4051196a4eaa9d45Evan Hunt#define NEGATIVE(r) (((r)->attributes & DNS_RDATASETATTR_NEGATIVE) != 0)

6de9744cf9c64be2145f663e4051196a4eaa9d45Evan Hunt

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrencestatic void

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsdestroy(dns_validator_t *val);

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrence

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic isc_result_t

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrewsget_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrence dns_rdataset_t *rdataset);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic isc_result_t

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrencevalidate(dns_validator_t *val, isc_boolean_t resume);

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrence

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic isc_result_t

50105afc551903541608b11851d73278b23579a3Mark Andrewsvalidatezonekey(dns_validator_t *val);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic isc_result_t

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrewsnsecvalidate(dns_validator_t *val, isc_boolean_t resume);

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrence

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic isc_result_t

664e11f0b14c78cef7cf6b8c70323a1da494e351Mark Andrewsproveunsecure(dns_validator_t *val, isc_boolean_t have_ds,

664e11f0b14c78cef7cf6b8c70323a1da494e351Mark Andrews isc_boolean_t resume);

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrence

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic void

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonvalidator_logv(dns_validator_t *val, isc_logcategory_t *category,

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington isc_logmodule_t *module, int level, const char *fmt, va_list ap)

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington ISC_FORMAT_PRINTF(5, 0);

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrencestatic void

8462dfb880040cde3a60f047ec18808737fd7e85Mark Andrewsvalidator_log(void *val, int level, const char *fmt, ...)

76c8294c81fb48b1da6e1fc5b83322a4cedb8e58Andreas Gustafsson ISC_FORMAT_PRINTF(3, 4);

1b1e1fda4638334b484aa38c15f53a131c0b0fdfAndreas Gustafsson

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic void

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsvalidator_logcreate(dns_validator_t *val,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_name_t *name, dns_rdatatype_t type,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews const char *caller, const char *operation);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

50105afc551903541608b11851d73278b23579a3Mark Andrewsstatic isc_result_t

50105afc551903541608b11851d73278b23579a3Mark Andrewsdlv_validatezonekey(dns_validator_t *val);

50105afc551903541608b11851d73278b23579a3Mark Andrews

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrewsstatic void

5be3685b0e57677c0cc03113099cb8f99f9a070bMark Andrewsdlv_validator_start(dns_validator_t *val);

5be3685b0e57677c0cc03113099cb8f99f9a070bMark Andrews

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrewsstatic isc_result_t

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrewsfinddlvsep(dns_validator_t *val, isc_boolean_t resume);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrewsstatic isc_result_t

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrewsstartfinddlvsep(dns_validator_t *val, dns_name_t *unsecure);

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews

5be3685b0e57677c0cc03113099cb8f99f9a070bMark Andrewsstatic inline void

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrewsmarkanswer(dns_validator_t *val, const char *where) {

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews validator_log(val, ISC_LOG_DEBUG(3), "marking as answer (%s)", where);

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews if (val->event->rdataset != NULL)

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews dns_rdataset_settrust(val->event->rdataset, dns_trust_answer);

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews if (val->event->sigrdataset != NULL)

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews dns_rdataset_settrust(val->event->sigrdataset,

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews dns_trust_answer);

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews}

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews

0cae66577c69c89086cd065bb297690072b471b4Mark Andrewsstatic inline void

0cae66577c69c89086cd065bb297690072b471b4Mark Andrewsmarksecure(dns_validatorevent_t *event) {

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews dns_rdataset_settrust(event->rdataset, dns_trust_secure);

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if (event->sigrdataset != NULL)

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews dns_rdataset_settrust(event->sigrdataset, dns_trust_secure);

48019314431389cca5f8eba7ee9aa5bc08a67f4eMark Andrews event->secure = ISC_TRUE;

5be3685b0e57677c0cc03113099cb8f99f9a070bMark Andrews}

5be3685b0e57677c0cc03113099cb8f99f9a070bMark Andrews

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halleystatic void

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halleyvalidator_done(dns_validator_t *val, isc_result_t result) {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley isc_task_t *task;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington if (val->event == NULL)

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington return;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley /*

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington val->event->result = result;

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff task = val->event->ev_sender;

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff val->event->ev_sender = val;

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff val->event->ev_type = DNS_EVENT_VALIDATORDONE;

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff val->event->ev_action = val->action;

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff val->event->ev_arg = val->arg;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley isc_task_sendanddetach(&task, (isc_event_t **)&val->event);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley}

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic inline isc_boolean_t

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsexit_check(dns_validator_t *val) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (!SHUTDOWN(val))

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (ISC_FALSE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews INSIST(val->event == NULL);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (val->fetch != NULL || val->subvalidator != NULL)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (ISC_FALSE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews}

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrewsstatic inline isc_boolean_t

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrewsdlv_algorithm_supported(dns_validator_t *val) {

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews dns_rdata_t rdata = DNS_RDATA_INIT;

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews dns_rdata_dlv_t dlv;

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews isc_result_t result;

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews for (result = dns_rdataset_first(&val->dlv);

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews result == ISC_R_SUCCESS;

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews result = dns_rdataset_next(&val->dlv)) {

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews dns_rdata_reset(&rdata);

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews dns_rdataset_current(&val->dlv, &rdata);

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews result = dns_rdata_tostruct(&rdata, &dlv, NULL);

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews RUNTIME_CHECK(result == ISC_R_SUCCESS);

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews if (!dns_resolver_algorithm_supported(val->view->resolver,

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews val->event->name,

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews dlv.algorithm))

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews continue;

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews

058e44186b74531402c1f99088eb9dbe4926f8daMark Andrews if (!dns_resolver_ds_digest_supported(val->view->resolver,

058e44186b74531402c1f99088eb9dbe4926f8daMark Andrews val->event->name,

058e44186b74531402c1f99088eb9dbe4926f8daMark Andrews dlv.digest_type))

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews continue;

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews return (ISC_TRUE);

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews }

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews return (ISC_FALSE);

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews}

72dbc7216aae3626a66e6154443be219f5edcaf0Mark Andrews

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrewsstatic isc_boolean_t

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrewsisdelegation(dns_name_t *name, dns_rdataset_t *rdataset,

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_result_t dbresult)

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews{

7d211b458fed36326b9e125b9d74089f9dccc140Mark Andrews dns_fixedname_t fixed;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_label_t hashlabel;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_name_t nsec3name;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_rdata_nsec3_t nsec3;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dns_rdata_t rdata = DNS_RDATA_INIT;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_rdataset_t set;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews int order;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews int scope;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_boolean_t found;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews isc_buffer_t buffer;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_result_t result;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews unsigned char hash[NSEC3_MAX_HASH_LENGTH];

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews unsigned char owner[NSEC3_MAX_HASH_LENGTH];

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews unsigned int length;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews REQUIRE(dbresult == DNS_R_NXRRSET || dbresult == DNS_R_NCACHENXRRSET);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dns_rdataset_init(&set);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (dbresult == DNS_R_NXRRSET)

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dns_rdataset_clone(rdataset, &set);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews else {

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews result = dns_ncache_getrdataset(rdataset, name,

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdatatype_nsec, &set);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (result == ISC_R_NOTFOUND)

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews goto trynsec3;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (result != ISC_R_SUCCESS)

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (ISC_FALSE);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews }

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews INSIST(set.type == dns_rdatatype_nsec);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews found = ISC_FALSE;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews result = dns_rdataset_first(&set);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (result == ISC_R_SUCCESS) {

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dns_rdataset_current(&set, &rdata);

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews found = dns_nsec_typepresent(&rdata, dns_rdatatype_ns);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_rdata_reset(&rdata);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews }

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dns_rdataset_disassociate(&set);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (found);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews trynsec3:

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews /*

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews found = ISC_FALSE;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_name_init(&nsec3name, NULL);

7d211b458fed36326b9e125b9d74089f9dccc140Mark Andrews dns_fixedname_init(&fixed);

7d211b458fed36326b9e125b9d74089f9dccc140Mark Andrews dns_name_downcase(name, dns_fixedname_name(&fixed), NULL);

7d211b458fed36326b9e125b9d74089f9dccc140Mark Andrews name = dns_fixedname_name(&fixed);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews for (result = dns_rdataset_first(rdataset);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews result == ISC_R_SUCCESS;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews result = dns_rdataset_next(rdataset))

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews {

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_ncache_current(rdataset, &nsec3name, &set);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (set.type != dns_rdatatype_nsec3) {

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_rdataset_disassociate(&set);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews continue;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews }

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_name_getlabel(&nsec3name, 0, &hashlabel);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews isc_region_consume(&hashlabel, 1);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews isc_buffer_init(&buffer, owner, sizeof(owner));

36e5ac00333d89001f0c518a7d381d16c38d0402Mark Andrews result = isc_base32hexnp_decoderegion(&hashlabel, &buffer);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (result != ISC_R_SUCCESS) {

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_rdataset_disassociate(&set);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews continue;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews }

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews for (result = dns_rdataset_first(&set);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews result == ISC_R_SUCCESS;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews result = dns_rdataset_next(&set))

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews {

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_rdata_reset(&rdata);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_rdataset_current(&set, &rdata);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews (void)dns_rdata_tostruct(&rdata, &nsec3, NULL);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (nsec3.hash != 1)

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews continue;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews length = isc_iterated_hash(hash, nsec3.hash,

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews nsec3.iterations, nsec3.salt,

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews nsec3.salt_length,

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews name->ndata, name->length);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (length != isc_buffer_usedlength(&buffer))

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews continue;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews order = memcmp(hash, owner, length);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if (order == 0) {

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews found = dns_nsec3_typepresent(&rdata,

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_rdatatype_ns);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_rdataset_disassociate(&set);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (found);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews }

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) == 0)

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews continue;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews /*

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews scope = memcmp(owner, nsec3.next, nsec3.next_length);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews if ((scope < 0 && order > 0 &&

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews memcmp(hash, nsec3.next, length) < 0) ||

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews (scope >= 0 && (order > 0 ||

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews memcmp(hash, nsec3.next, length) < 0)))

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews {

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_rdataset_disassociate(&set);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (ISC_TRUE);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews }

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews }

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_rdataset_disassociate(&set);

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews }

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews return (found);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews}

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellingtonstatic void

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellingtonfetch_callback_validator(isc_task_t *task, isc_event_t *event) {

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington dns_fetchevent_t *devent;

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington dns_validator_t *val;

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington dns_rdataset_t *rdataset;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_boolean_t want_destroy;

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington isc_result_t result;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington isc_result_t eresult;

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews isc_result_t saved_result;

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews dns_fetch_t *fetch;

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington UNUSED(task);

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff INSIST(event->ev_type == DNS_EVENT_FETCHDONE);

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington devent = (dns_fetchevent_t *)event;

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff val = devent->ev_arg;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington rdataset = &val->frdataset;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington eresult = devent->result;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews /* Free resources which are not of interest. */

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews if (devent->node != NULL)

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews dns_db_detachnode(devent->db, &devent->node);

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews if (devent->db != NULL)

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews dns_db_detach(&devent->db);

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews if (dns_rdataset_isassociated(&val->fsigrdataset))

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews dns_rdataset_disassociate(&val->fsigrdataset);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington isc_event_free(&event);

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington INSIST(val->event != NULL);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3), "in fetch_callback_validator");

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington LOCK(&val->lock);

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews fetch = val->fetch;

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews val->fetch = NULL;

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews if (CANCELED(val)) {

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews validator_done(val, ISC_R_CANCELED);

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews } else if (eresult == ISC_R_SUCCESS) {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

ea8278253210df030a24f0c89342b43fe279a127Mark Andrews "keyset with trust %s",

ea8278253210df030a24f0c89342b43fe279a127Mark Andrews dns_trust_totext(rdataset->trust));

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington /*

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (rdataset->trust >= dns_trust_secure) {

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington result = get_dst_key(val, val->siginfo, rdataset);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (result == ISC_R_SUCCESS)

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington val->keyset = &val->frdataset;

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington }

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington result = validate(val, ISC_TRUE);

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews if (result == DNS_R_NOVALIDSIG &&

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews (val->attributes & VALATTR_TRIEDVERIFY) == 0)

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews {

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews saved_result = result;

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews validator_log(val, ISC_LOG_DEBUG(3),

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews "falling back to insecurity proof");

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews val->attributes |= VALATTR_INSECURITY;

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews result = proveunsecure(val, ISC_FALSE, ISC_FALSE);

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews if (result == DNS_R_NOTINSECURE)

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews result = saved_result;

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result != DNS_R_WAIT)

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington validator_done(val, result);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington } else {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

1b1e1fda4638334b484aa38c15f53a131c0b0fdfAndreas Gustafsson "fetch_callback_validator: got %s",

18b7133679efa8f60fd4e396c628576f3f416b3eBrian Wellington isc_result_totext(eresult));

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington if (eresult == ISC_R_CANCELED)

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington validator_done(val, eresult);

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington else

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews validator_done(val, DNS_R_BROKENCHAIN);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews want_destroy = exit_check(val);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington UNLOCK(&val->lock);

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews if (fetch != NULL)

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews dns_resolver_destroyfetch(&fetch);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (want_destroy)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews destroy(val);

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington}

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellingtonstatic void

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsdsfetched(isc_task_t *task, isc_event_t *event) {

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington dns_fetchevent_t *devent;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington dns_validator_t *val;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_t *rdataset;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_boolean_t want_destroy;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington isc_result_t result;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington isc_result_t eresult;

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews dns_fetch_t *fetch;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington UNUSED(task);

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington INSIST(event->ev_type == DNS_EVENT_FETCHDONE);

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington devent = (dns_fetchevent_t *)event;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington val = devent->ev_arg;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington rdataset = &val->frdataset;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington eresult = devent->result;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews /* Free resources which are not of interest. */

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews if (devent->node != NULL)

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews dns_db_detachnode(devent->db, &devent->node);

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews if (devent->db != NULL)

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews dns_db_detach(&devent->db);

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews if (dns_rdataset_isassociated(&val->fsigrdataset))

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews dns_rdataset_disassociate(&val->fsigrdataset);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_event_free(&event);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington INSIST(val->event != NULL);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3), "in dsfetched");

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington LOCK(&val->lock);

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews fetch = val->fetch;

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews val->fetch = NULL;

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews if (CANCELED(val)) {

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews validator_done(val, ISC_R_CANCELED);

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews } else if (eresult == ISC_R_SUCCESS) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

ea8278253210df030a24f0c89342b43fe279a127Mark Andrews "dsset with trust %s",

ea8278253210df030a24f0c89342b43fe279a127Mark Andrews dns_trust_totext(rdataset->trust));

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->dsset = &val->frdataset;

50105afc551903541608b11851d73278b23579a3Mark Andrews result = validatezonekey(val);

50105afc551903541608b11851d73278b23579a3Mark Andrews if (result != DNS_R_WAIT)

50105afc551903541608b11851d73278b23579a3Mark Andrews validator_done(val, result);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews } else if (eresult == DNS_R_CNAME ||

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews eresult == DNS_R_NXRRSET ||

a05f23d07e1b60a1d88119678111a47014480611Mark Andrews eresult == DNS_R_NCACHENXRRSET ||

a05f23d07e1b60a1d88119678111a47014480611Mark Andrews eresult == DNS_R_SERVFAIL) /* RFC 1034 parent? */

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

a05f23d07e1b60a1d88119678111a47014480611Mark Andrews "falling back to insecurity proof (%s)",

a05f23d07e1b60a1d88119678111a47014480611Mark Andrews dns_result_totext(eresult));

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->attributes |= VALATTR_INSECURITY;

664e11f0b14c78cef7cf6b8c70323a1da494e351Mark Andrews result = proveunsecure(val, ISC_FALSE, ISC_FALSE);

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington if (result != DNS_R_WAIT)

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington validator_done(val, result);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington } else {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "dsfetched: got %s",

18b7133679efa8f60fd4e396c628576f3f416b3eBrian Wellington isc_result_totext(eresult));

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington if (eresult == ISC_R_CANCELED)

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington validator_done(val, eresult);

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington else

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews validator_done(val, DNS_R_BROKENCHAIN);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews want_destroy = exit_check(val);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington UNLOCK(&val->lock);

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews if (fetch != NULL)

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews dns_resolver_destroyfetch(&fetch);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (want_destroy)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews destroy(val);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews}

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic void

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsdsfetched2(isc_task_t *task, isc_event_t *event) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_fetchevent_t *devent;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validator_t *val;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dns_name_t *tname;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_boolean_t want_destroy;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_result_t result;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_result_t eresult;

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews dns_fetch_t *fetch;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews UNUSED(task);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews INSIST(event->ev_type == DNS_EVENT_FETCHDONE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews devent = (dns_fetchevent_t *)event;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val = devent->ev_arg;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews eresult = devent->result;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews /* Free resources which are not of interest. */

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews if (devent->node != NULL)

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews dns_db_detachnode(devent->db, &devent->node);

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews if (devent->db != NULL)

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews dns_db_detach(&devent->db);

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews if (dns_rdataset_isassociated(&val->fsigrdataset))

7d116211ec7b063891130f191e3ed437b45dba70Mark Andrews dns_rdataset_disassociate(&val->fsigrdataset);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews INSIST(val->event != NULL);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews validator_log(val, ISC_LOG_DEBUG(3), "in dsfetched2: %s",

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews dns_result_totext(eresult));

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews LOCK(&val->lock);

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews fetch = val->fetch;

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews val->fetch = NULL;

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews if (CANCELED(val)) {

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews validator_done(val, ISC_R_CANCELED);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews } else if (eresult == DNS_R_CNAME ||

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews eresult == DNS_R_NXRRSET ||

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews eresult == DNS_R_NCACHENXRRSET)

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews tname = dns_fixedname_name(&devent->foundname);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews if (eresult != DNS_R_CNAME &&

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews isdelegation(tname, &val->frdataset, eresult)) {

8d414d155953f89a4eff40f16878438a8c9228f3Mark Andrews if (val->mustbesecure) {

8d414d155953f89a4eff40f16878438a8c9228f3Mark Andrews validator_log(val, ISC_LOG_WARNING,

be69d484434e10d920c4d8a8bb735356eb0c2cc8Evan Hunt "must be secure failure, no DS"

be69d484434e10d920c4d8a8bb735356eb0c2cc8Evan Hunt " and this is a delegation");

8d414d155953f89a4eff40f16878438a8c9228f3Mark Andrews validator_done(val, DNS_R_MUSTBESECURE);

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews } else if (val->view->dlv == NULL || DLVTRIED(val)) {

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews markanswer(val, "dsfetched2");

8d414d155953f89a4eff40f16878438a8c9228f3Mark Andrews validator_done(val, ISC_R_SUCCESS);

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews } else {

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews result = startfinddlvsep(val, tname);

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews if (result != DNS_R_WAIT)

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews validator_done(val, result);

8d414d155953f89a4eff40f16878438a8c9228f3Mark Andrews }

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews } else {

664e11f0b14c78cef7cf6b8c70323a1da494e351Mark Andrews result = proveunsecure(val, ISC_FALSE, ISC_TRUE);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (result != DNS_R_WAIT)

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews validator_done(val, result);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews } else if (eresult == ISC_R_SUCCESS ||

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews eresult == DNS_R_NXDOMAIN ||

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews eresult == DNS_R_NCACHENXDOMAIN)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

664e11f0b14c78cef7cf6b8c70323a1da494e351Mark Andrews result = proveunsecure(val, ISC_TF(eresult == ISC_R_SUCCESS),

664e11f0b14c78cef7cf6b8c70323a1da494e351Mark Andrews ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result != DNS_R_WAIT)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_done(val, result);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews } else {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (eresult == ISC_R_CANCELED)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_done(val, eresult);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews else

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_done(val, DNS_R_NOVALIDDS);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_event_free(&event);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews want_destroy = exit_check(val);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews UNLOCK(&val->lock);

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews if (fetch != NULL)

d8fc410cf830606a82c7ca169714d2f489b19d77Mark Andrews dns_resolver_destroyfetch(&fetch);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (want_destroy)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews destroy(val);

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington}

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellingtonstatic void

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellingtonkeyvalidated(isc_task_t *task, isc_event_t *event) {

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington dns_validatorevent_t *devent;

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington dns_validator_t *val;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_boolean_t want_destroy;

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington isc_result_t result;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington isc_result_t eresult;

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews isc_result_t saved_result;

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington UNUSED(task);

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington devent = (dns_validatorevent_t *)event;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington val = devent->ev_arg;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington eresult = devent->result;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington isc_event_free(&event);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validator_destroy(&val->subvalidator);

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington INSIST(val->event != NULL);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3), "in keyvalidated");

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington LOCK(&val->lock);

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews if (CANCELED(val)) {

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews validator_done(val, ISC_R_CANCELED);

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews } else if (eresult == ISC_R_SUCCESS) {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

ea8278253210df030a24f0c89342b43fe279a127Mark Andrews "keyset with trust %s",

ea8278253210df030a24f0c89342b43fe279a127Mark Andrews dns_trust_totext(val->frdataset.trust));

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington /*

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (val->frdataset.trust >= dns_trust_secure)

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington (void) get_dst_key(val, val->siginfo, &val->frdataset);

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington result = validate(val, ISC_TRUE);

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews if (result == DNS_R_NOVALIDSIG &&

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews (val->attributes & VALATTR_TRIEDVERIFY) == 0)

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews {

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews saved_result = result;

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews validator_log(val, ISC_LOG_DEBUG(3),

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews "falling back to insecurity proof");

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews val->attributes |= VALATTR_INSECURITY;

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews result = proveunsecure(val, ISC_FALSE, ISC_FALSE);

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews if (result == DNS_R_NOTINSECURE)

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews result = saved_result;

a27b3757fdd8976ce05e37f391ad9e7ac4638e5dMark Andrews }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result != DNS_R_WAIT)

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington validator_done(val, result);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington } else {

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews if (eresult != DNS_R_BROKENCHAIN) {

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews if (dns_rdataset_isassociated(&val->frdataset))

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews dns_rdataset_expire(&val->frdataset);

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews if (dns_rdataset_isassociated(&val->fsigrdataset))

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews dns_rdataset_expire(&val->fsigrdataset);

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews }

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

1b1e1fda4638334b484aa38c15f53a131c0b0fdfAndreas Gustafsson "keyvalidated: got %s",

18b7133679efa8f60fd4e396c628576f3f416b3eBrian Wellington isc_result_totext(eresult));

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews validator_done(val, DNS_R_BROKENCHAIN);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews want_destroy = exit_check(val);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews UNLOCK(&val->lock);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (want_destroy)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews destroy(val);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews}

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic void

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsdsvalidated(isc_task_t *task, isc_event_t *event) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validatorevent_t *devent;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validator_t *val;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_boolean_t want_destroy;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_result_t result;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_result_t eresult;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews UNUSED(task);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews devent = (dns_validatorevent_t *)event;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val = devent->ev_arg;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews eresult = devent->result;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_event_free(&event);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validator_destroy(&val->subvalidator);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews INSIST(val->event != NULL);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3), "in dsvalidated");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews LOCK(&val->lock);

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews if (CANCELED(val)) {

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews validator_done(val, ISC_R_CANCELED);

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews } else if (eresult == ISC_R_SUCCESS) {

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews isc_boolean_t have_dsset;

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews dns_name_t *name;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

ea8278253210df030a24f0c89342b43fe279a127Mark Andrews "%s with trust %s",

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews val->frdataset.type == dns_rdatatype_ds ?

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews "dsset" : "ds non-existance",

ea8278253210df030a24f0c89342b43fe279a127Mark Andrews dns_trust_totext(val->frdataset.trust));

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews have_dsset = ISC_TF(val->frdataset.type == dns_rdatatype_ds);

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews name = dns_fixedname_name(&val->fname);

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if ((val->attributes & VALATTR_INSECURITY) != 0 &&

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews val->frdataset.covers == dns_rdatatype_ds &&

6de9744cf9c64be2145f663e4051196a4eaa9d45Evan Hunt NEGATIVE(&val->frdataset) &&

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews isdelegation(name, &val->frdataset, DNS_R_NCACHENXRRSET)) {

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews if (val->mustbesecure) {

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews validator_log(val, ISC_LOG_WARNING,

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews "must be secure failure, no DS "

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews "and this is a delegation");

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews result = DNS_R_MUSTBESECURE;

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews } else if (val->view->dlv == NULL || DLVTRIED(val)) {

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews markanswer(val, "dsvalidated");

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews result = ISC_R_SUCCESS;;

515c7f3c43f76d7b439905b18009105364b36100Automatic Updater } else

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews result = startfinddlvsep(val, name);

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews } else if ((val->attributes & VALATTR_INSECURITY) != 0) {

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews result = proveunsecure(val, have_dsset, ISC_TRUE);

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews } else

50105afc551903541608b11851d73278b23579a3Mark Andrews result = validatezonekey(val);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result != DNS_R_WAIT)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_done(val, result);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews } else {

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews if (eresult != DNS_R_BROKENCHAIN) {

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews if (dns_rdataset_isassociated(&val->frdataset))

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews dns_rdataset_expire(&val->frdataset);

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews if (dns_rdataset_isassociated(&val->fsigrdataset))

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews dns_rdataset_expire(&val->fsigrdataset);

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "dsvalidated: got %s",

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_result_totext(eresult));

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews validator_done(val, DNS_R_BROKENCHAIN);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews want_destroy = exit_check(val);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington UNLOCK(&val->lock);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (want_destroy)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews destroy(val);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington}

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrewsstatic void

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrewscnamevalidated(isc_task_t *task, isc_event_t *event) {

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews dns_validatorevent_t *devent;

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews dns_validator_t *val;

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews isc_boolean_t want_destroy;

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews isc_result_t result;

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews isc_result_t eresult;

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews UNUSED(task);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews devent = (dns_validatorevent_t *)event;

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews val = devent->ev_arg;

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews eresult = devent->result;

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews isc_event_free(&event);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews dns_validator_destroy(&val->subvalidator);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews INSIST(val->event != NULL);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews INSIST((val->attributes & VALATTR_INSECURITY) != 0);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews validator_log(val, ISC_LOG_DEBUG(3), "in cnamevalidated");

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews LOCK(&val->lock);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews if (CANCELED(val)) {

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews validator_done(val, ISC_R_CANCELED);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews } else if (eresult == ISC_R_SUCCESS) {

ea8278253210df030a24f0c89342b43fe279a127Mark Andrews validator_log(val, ISC_LOG_DEBUG(3), "cname with trust %s",

ea8278253210df030a24f0c89342b43fe279a127Mark Andrews dns_trust_totext(val->frdataset.trust));

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews result = proveunsecure(val, ISC_FALSE, ISC_TRUE);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews if (result != DNS_R_WAIT)

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews validator_done(val, result);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews } else {

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews if (eresult != DNS_R_BROKENCHAIN) {

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews if (dns_rdataset_isassociated(&val->frdataset))

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews dns_rdataset_expire(&val->frdataset);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews if (dns_rdataset_isassociated(&val->fsigrdataset))

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews dns_rdataset_expire(&val->fsigrdataset);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews }

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews "cnamevalidated: got %s",

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews isc_result_totext(eresult));

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews validator_done(val, DNS_R_BROKENCHAIN);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews }

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews want_destroy = exit_check(val);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews UNLOCK(&val->lock);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews if (want_destroy)

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews destroy(val);

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews}

4b45a8fc5a47dcff7473003ceeac6f6bb3e21e79Mark Andrews

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellingtonstatic void

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellingtonauthvalidated(isc_task_t *task, isc_event_t *event) {

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington dns_validatorevent_t *devent;

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington dns_validator_t *val;

216030f2849b0812910fbc1817ca17208a112663Mark Andrews dns_rdataset_t *rdataset;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_boolean_t want_destroy;

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington isc_result_t result;

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews isc_boolean_t exists, data;

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington UNUSED(task);

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington devent = (dns_validatorevent_t *)event;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington rdataset = devent->rdataset;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington val = devent->ev_arg;

b0d31c78bc24080d4c470a8bd98862375f6e3055Mark Andrews result = devent->result;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validator_destroy(&val->subvalidator);

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington INSIST(val->event != NULL);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3), "in authvalidated");

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington LOCK(&val->lock);

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews if (CANCELED(val)) {

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews validator_done(val, ISC_R_CANCELED);

e2c3f8059e77a8e11c4378d22e5d8e78b423a28fMark Andrews } else if (result != ISC_R_SUCCESS) {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington "authvalidated: got %s",

b0d31c78bc24080d4c470a8bd98862375f6e3055Mark Andrews isc_result_totext(result));

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews if (result == DNS_R_BROKENCHAIN)

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews val->authfail++;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result == ISC_R_CANCELED)

f15af68028adc665d3bdddf955fc52bad83f0514Brian Wellington validator_done(val, result);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews else {

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews result = nsecvalidate(val, ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result != DNS_R_WAIT)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_done(val, result);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington } else {

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews dns_name_t **proofs = val->event->proofs;

1ea2595e1b33cc63ea73ee1d54b580b717d7d155Mark Andrews dns_name_t *wild = dns_fixedname_name(&val->wild);

2f012d936b5ccdf6520c96a4de23721dc58a2221Automatic Updater

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews if (rdataset->trust == dns_trust_secure)

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews val->seensig = ISC_TRUE;

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington

4e259c5a2321e994708fb1fe04cd4da30aa3b612Mark Andrews if (rdataset->type == dns_rdatatype_nsec &&

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews rdataset->trust == dns_trust_secure &&

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews (NEEDNODATA(val) || NEEDNOQNAME(val)) &&

b335299322e50f045f10e4636262cd2f8d407a8bMark Andrews !FOUNDNODATA(val) && !FOUNDNOQNAME(val) &&

8462dfb880040cde3a60f047ec18808737fd7e85Mark Andrews dns_nsec_noexistnodata(val->event->type, val->event->name,

8462dfb880040cde3a60f047ec18808737fd7e85Mark Andrews devent->name, rdataset, &exists,

8462dfb880040cde3a60f047ec18808737fd7e85Mark Andrews &data, wild, validator_log, val)

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews == ISC_R_SUCCESS)

1ea2595e1b33cc63ea73ee1d54b580b717d7d155Mark Andrews {

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews if (exists && !data) {

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews val->attributes |= VALATTR_FOUNDNODATA;

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews if (NEEDNODATA(val))

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews proofs[DNS_VALIDATOR_NODATAPROOF] =

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews devent->name;

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews }

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews if (!exists) {

2fa1fc53324c0fca978c902e883c7cc011210536Mark Andrews dns_name_t *closest;

2fa1fc53324c0fca978c902e883c7cc011210536Mark Andrews unsigned int clabels;

2fa1fc53324c0fca978c902e883c7cc011210536Mark Andrews

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews val->attributes |= VALATTR_FOUNDNOQNAME;

2fa1fc53324c0fca978c902e883c7cc011210536Mark Andrews

2fa1fc53324c0fca978c902e883c7cc011210536Mark Andrews closest = dns_fixedname_name(&val->closest);

2fa1fc53324c0fca978c902e883c7cc011210536Mark Andrews clabels = dns_name_countlabels(closest);

2fa1fc53324c0fca978c902e883c7cc011210536Mark Andrews /*

2fa1fc53324c0fca978c902e883c7cc011210536Mark Andrews if (clabels == 0 ||

2fa1fc53324c0fca978c902e883c7cc011210536Mark Andrews dns_name_countlabels(wild) == clabels + 1)

2fa1fc53324c0fca978c902e883c7cc011210536Mark Andrews val->attributes |= VALATTR_FOUNDCLOSEST;

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews /*

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews if (NEEDNOQNAME(val))

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews proofs[DNS_VALIDATOR_NOQNAMEPROOF] =

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews devent->name;

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews }

35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews }

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews result = nsecvalidate(val, ISC_TRUE);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (result != DNS_R_WAIT)

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington validator_done(val, result);

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews want_destroy = exit_check(val);

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington UNLOCK(&val->lock);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (want_destroy)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews destroy(val);

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington /*

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington isc_event_free(&event);

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington}

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic inline isc_result_t

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsview_find(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) {

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_fixedname_t fixedname;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_name_t *foundname;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_rdata_nsec_t nsec;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_rdata_t rdata = DNS_RDATA_INIT;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews isc_result_t result;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews unsigned int options;

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews isc_time_t now;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews char buf1[DNS_NAME_FORMATSIZE];

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews char buf2[DNS_NAME_FORMATSIZE];

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews char buf3[DNS_NAME_FORMATSIZE];

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews char namebuf[DNS_NAME_FORMATSIZE];

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews char typebuf[DNS_RDATATYPE_FORMATSIZE];

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (dns_rdataset_isassociated(&val->frdataset))

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington dns_rdataset_disassociate(&val->frdataset);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (dns_rdataset_isassociated(&val->fsigrdataset))

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_disassociate(&val->fsigrdataset);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews if (isc_time_now(&now) == ISC_R_SUCCESS &&

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews dns_resolver_getbadcache(val->view->resolver, name, type, &now)) {

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews dns_name_format(name, namebuf, sizeof(namebuf));

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews dns_rdatatype_format(type, typebuf, sizeof(typebuf));

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews validator_log(val, ISC_LOG_INFO, "bad cache hit (%s/%s)",

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews namebuf, typebuf);

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews return (DNS_R_BROKENCHAIN);

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews }

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews options = DNS_DBFIND_PENDINGOK;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (type == dns_rdatatype_dlv)

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews options |= DNS_DBFIND_COVERINGNSEC;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_fixedname_init(&fixedname);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews foundname = dns_fixedname_name(&fixedname);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews result = dns_view_find(val->view, name, type, 0, options,

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews ISC_FALSE, NULL, NULL, foundname,

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews &val->frdataset, &val->fsigrdataset);

0cae66577c69c89086cd065bb297690072b471b4Mark Andrews

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (result == DNS_R_NXDOMAIN) {

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (dns_rdataset_isassociated(&val->frdataset))

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_rdataset_disassociate(&val->frdataset);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (dns_rdataset_isassociated(&val->fsigrdataset))

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_rdataset_disassociate(&val->fsigrdataset);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews } else if (result == DNS_R_COVERINGNSEC) {

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews validator_log(val, ISC_LOG_DEBUG(3), "DNS_R_COVERINGNSEC");

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews /*

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews INSIST(type == dns_rdatatype_dlv);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (val->frdataset.trust != dns_trust_secure) {

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

ea8278253210df030a24f0c89342b43fe279a127Mark Andrews "covering nsec: trust %s",

ea8278253210df030a24f0c89342b43fe279a127Mark Andrews dns_trust_totext(val->frdataset.trust));

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews goto notfound;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews }

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews result = dns_rdataset_first(&val->frdataset);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (result != ISC_R_SUCCESS)

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews goto notfound;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_rdataset_current(&val->frdataset, &rdata);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (dns_nsec_typepresent(&rdata, dns_rdatatype_ns) &&

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews !dns_nsec_typepresent(&rdata, dns_rdatatype_soa)) {

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews /* Parent NSEC record. */

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (dns_name_issubdomain(name, foundname)) {

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews "covering nsec: for parent");

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews goto notfound;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews }

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews }

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews result = dns_rdata_tostruct(&rdata, &nsec, NULL);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (result != ISC_R_SUCCESS)

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews goto notfound;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (dns_name_compare(foundname, &nsec.next) >= 0) {

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews /* End of zone chain. */

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (!dns_name_issubdomain(name, &nsec.next)) {

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews /*

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_rdata_freestruct(&nsec);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews "covering nsec: not in zone");

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews goto notfound;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews }

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews } else if (dns_name_compare(name, &nsec.next) >= 0) {

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews /*

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_rdata_freestruct(&nsec);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews "covering nsec: not in range");

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews goto notfound;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews }

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (isc_log_wouldlog(dns_lctx,ISC_LOG_DEBUG(3))) {

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_name_format(name, buf1, sizeof buf1);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_name_format(foundname, buf2, sizeof buf2);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_name_format(&nsec.next, buf3, sizeof buf3);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews "covering nsec found: '%s' '%s' '%s'",

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews buf1, buf2, buf3);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews }

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (dns_rdataset_isassociated(&val->frdataset))

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_rdataset_disassociate(&val->frdataset);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (dns_rdataset_isassociated(&val->fsigrdataset))

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_rdataset_disassociate(&val->fsigrdataset);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_rdata_freestruct(&nsec);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews result = DNS_R_NCACHENXDOMAIN;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews } else if (result != ISC_R_SUCCESS &&

2f012d936b5ccdf6520c96a4de23721dc58a2221Automatic Updater result != DNS_R_NCACHENXDOMAIN &&

2f012d936b5ccdf6520c96a4de23721dc58a2221Automatic Updater result != DNS_R_NCACHENXRRSET &&

1bfe8851c0a2eb1d7e15556bfa21291cd62ee2bcMark Andrews result != DNS_R_EMPTYNAME &&

2f012d936b5ccdf6520c96a4de23721dc58a2221Automatic Updater result != DNS_R_NXRRSET &&

2f012d936b5ccdf6520c96a4de23721dc58a2221Automatic Updater result != ISC_R_NOTFOUND) {

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews goto notfound;

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews }

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews return (result);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews notfound:

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (dns_rdataset_isassociated(&val->frdataset))

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_rdataset_disassociate(&val->frdataset);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews if (dns_rdataset_isassociated(&val->fsigrdataset))

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews dns_rdataset_disassociate(&val->fsigrdataset);

6fac7ff1f9ec9c3873d3b55c5079fa79aba1f146Mark Andrews return (ISC_R_NOTFOUND);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews}

613efcd8fbd0d1ce0d0afd1ac85d95cf85bffc27Brian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic inline isc_boolean_t

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrewscheck_deadlock(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews{

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validator_t *parent;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington

60ab03125c137c48a6b2ed6df1d2c8657757e09dMark Andrews for (parent = val; parent != NULL; parent = parent->parent) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (parent->event != NULL &&

8d1b3ceb4d491ce32572f1702f37ed585eede993Evan Hunt parent->event->type == type &&

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews dns_name_equal(parent->event->name, name) &&

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews /*

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews (parent->event->type != dns_rdatatype_nsec3 ||

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews rdataset == NULL || sigrdataset == NULL ||

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews parent->event->message == NULL ||

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews parent->event->rdataset != NULL ||

6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews parent->event->sigrdataset != NULL))

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "continuing validation would lead to "

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "deadlock: aborting validation");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

613efcd8fbd0d1ce0d0afd1ac85d95cf85bffc27Brian Wellington }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (ISC_FALSE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews}

613efcd8fbd0d1ce0d0afd1ac85d95cf85bffc27Brian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic inline isc_result_t

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewscreate_fetch(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_taskaction_t callback, const char *caller)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews{

1d761cb453c76353deb8423c78e98d00c5f86ffaEvan Hunt unsigned int fopts = 0;

1d761cb453c76353deb8423c78e98d00c5f86ffaEvan Hunt

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (dns_rdataset_isassociated(&val->frdataset))

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington dns_rdataset_disassociate(&val->frdataset);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (dns_rdataset_isassociated(&val->fsigrdataset))

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington dns_rdataset_disassociate(&val->fsigrdataset);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

7048af0a551f13d2916a06cce21357714939a89bEvan Hunt if (check_deadlock(val, name, type, NULL, NULL)) {

7048af0a551f13d2916a06cce21357714939a89bEvan Hunt validator_log(val, ISC_LOG_DEBUG(3),

7048af0a551f13d2916a06cce21357714939a89bEvan Hunt "deadlock found (create_fetch)");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (DNS_R_NOVALIDSIG);

7048af0a551f13d2916a06cce21357714939a89bEvan Hunt }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

1d761cb453c76353deb8423c78e98d00c5f86ffaEvan Hunt if ((val->options & DNS_VALIDATOR_NOCDFLAG) != 0)

1d761cb453c76353deb8423c78e98d00c5f86ffaEvan Hunt fopts |= DNS_FETCHOPT_NOCDFLAG;

1d761cb453c76353deb8423c78e98d00c5f86ffaEvan Hunt

b8a9632333a92d73a503afe1aaa7990016c8bee9Evan Hunt if ((val->options & DNS_VALIDATOR_NONTA) != 0)

b8a9632333a92d73a503afe1aaa7990016c8bee9Evan Hunt fopts |= DNS_FETCHOPT_NONTA;

b8a9632333a92d73a503afe1aaa7990016c8bee9Evan Hunt

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_logcreate(val, name, type, caller, "fetch");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (dns_resolver_createfetch(val->view->resolver, name, type,

1d761cb453c76353deb8423c78e98d00c5f86ffaEvan Hunt NULL, NULL, NULL, fopts,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->event->ev_sender,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews callback, val,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &val->frdataset,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &val->fsigrdataset,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &val->fetch));

613efcd8fbd0d1ce0d0afd1ac85d95cf85bffc27Brian Wellington}

613efcd8fbd0d1ce0d0afd1ac85d95cf85bffc27Brian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic inline isc_result_t

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewscreate_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_taskaction_t action, const char *caller)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews{

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington isc_result_t result;

1d761cb453c76353deb8423c78e98d00c5f86ffaEvan Hunt unsigned int vopts = 0;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington

7048af0a551f13d2916a06cce21357714939a89bEvan Hunt if (check_deadlock(val, name, type, rdataset, sigrdataset)) {

7048af0a551f13d2916a06cce21357714939a89bEvan Hunt validator_log(val, ISC_LOG_DEBUG(3),

7048af0a551f13d2916a06cce21357714939a89bEvan Hunt "deadlock found (create_validator)");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (DNS_R_NOVALIDSIG);

7048af0a551f13d2916a06cce21357714939a89bEvan Hunt }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

5d63868ad0d3865118ad294081cfa03df51d1de8Mark Andrews /* OK to clear other options, but preserve NOCDFLAG and NONTA. */

5d63868ad0d3865118ad294081cfa03df51d1de8Mark Andrews vopts |= (val->options & (DNS_VALIDATOR_NOCDFLAG|DNS_VALIDATOR_NONTA));

1d761cb453c76353deb8423c78e98d00c5f86ffaEvan Hunt

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_logcreate(val, name, type, caller, "validator");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = dns_validator_create(val->view, name, type,

1d761cb453c76353deb8423c78e98d00c5f86ffaEvan Hunt rdataset, sigrdataset, NULL, vopts,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->task, action, val,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &val->subvalidator);

5be3685b0e57677c0cc03113099cb8f99f9a070bMark Andrews if (result == ISC_R_SUCCESS) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->subvalidator->parent = val;

5be3685b0e57677c0cc03113099cb8f99f9a070bMark Andrews val->subvalidator->depth = val->depth + 1;

5be3685b0e57677c0cc03113099cb8f99f9a070bMark Andrews }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (result);

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington}

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic isc_result_t

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrewsget_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley dns_rdataset_t *rdataset)

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley{

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley isc_result_t result;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley isc_buffer_t b;

c03bb27f0675a6e60ceea66b451548e8481bc05cMark Andrews dns_rdata_t rdata = DNS_RDATA_INIT;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington dst_key_t *oldkey = val->key;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington isc_boolean_t foundold;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington if (oldkey == NULL)

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington foundold = ISC_TRUE;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington else {

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington foundold = ISC_FALSE;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington val->key = NULL;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington }

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley result = dns_rdataset_first(rdataset);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley if (result != ISC_R_SUCCESS)

feb40fc5f911d0b2050fb9fd34950a52930b981dBrian Wellington goto failure;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley do {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley dns_rdataset_current(rdataset, &rdata);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

6e49e91bd08778d7eae45a2229dcf41ed97cc636David Lawrence isc_buffer_init(&b, rdata.data, rdata.length);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley isc_buffer_add(&b, rdata.length);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley INSIST(val->key == NULL);

5c29047792191d6141f69b2684314d0b762fedebBrian Wellington result = dst_key_fromdns(&siginfo->signer, rdata.rdclass, &b,

5c29047792191d6141f69b2684314d0b762fedebBrian Wellington val->view->mctx, &val->key);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley if (result != ISC_R_SUCCESS)

feb40fc5f911d0b2050fb9fd34950a52930b981dBrian Wellington goto failure;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley if (siginfo->algorithm ==

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley (dns_secalg_t)dst_key_alg(val->key) &&

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington siginfo->keyid ==

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley (dns_keytag_t)dst_key_id(val->key) &&

63bf060be4ff2a7ade02fd86abb98694a5afc250Brian Wellington dst_key_iszonekey(val->key))

63bf060be4ff2a7ade02fd86abb98694a5afc250Brian Wellington {

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington if (foundold)