bf43fdafa3bff9e84cb03f1a19aca74514d2516eBob Halley

9c3531d72aeaad6c5f01efe6a1c82023e1379e4dDavid Lawrence

e419f613d8591885df608cb73065921be07dd12eBob Halley#include <config.h>

e419f613d8591885df608cb73065921be07dd12eBob Halley

1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence#include <isc/mem.h>

fca5f81ad69098ea8abba130c7f841c951ef91c2Bob Halley#include <isc/print.h>

e419f613d8591885df608cb73065921be07dd12eBob Halley#include <isc/task.h>

e419f613d8591885df608cb73065921be07dd12eBob Halley#include <isc/util.h>

9695ae1c24b168996e3a267855dc754971ccb32cBob Halley

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley#include <dns/db.h>

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews#include <dns/ds.h>

1c776a2909632bc755f3fddd3b53addd792ab4d0Brian Wellington#include <dns/dnssec.h>

e419f613d8591885df608cb73065921be07dd12eBob Halley#include <dns/events.h>

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley#include <dns/keytable.h>

1b1e1fda4638334b484aa38c15f53a131c0b0fdfAndreas Gustafsson#include <dns/log.h>

e83cae7fa837e4757c687035d6f6c0900f152749Brian Wellington#include <dns/message.h>

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews#include <dns/ncache.h>

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews#include <dns/nsec.h>

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley#include <dns/rdata.h>

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington#include <dns/rdatastruct.h>

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley#include <dns/rdataset.h>

09f22ac5b09e70bc526015f37168ba33e21ea91fDavid Lawrence#include <dns/rdatatype.h>

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington#include <dns/resolver.h>

09f22ac5b09e70bc526015f37168ba33e21ea91fDavid Lawrence#include <dns/result.h>

09f22ac5b09e70bc526015f37168ba33e21ea91fDavid Lawrence#include <dns/validator.h>

e419f613d8591885df608cb73065921be07dd12eBob Halley#include <dns/view.h>

e419f613d8591885df608cb73065921be07dd12eBob Halley

92ef1a9b9dbd48ecb507b42ac62c15afefdaf838David Lawrence#define VALIDATOR_MAGIC ISC_MAGIC('V', 'a', 'l', '?')

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews#define VALID_VALIDATOR(v) ISC_MAGIC_VALID(v, VALIDATOR_MAGIC)

bf43fdafa3bff9e84cb03f1a19aca74514d2516eBob Halley

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley#define VALATTR_SHUTDOWN 0x01

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington#define VALATTR_FOUNDNONEXISTENCE 0x02

6bc1a645619a14707da68b130dafe41721fd2f25Brian Wellington#define VALATTR_TRIEDVERIFY 0x04

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews#define VALATTR_NEGATIVE 0x08

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews#define VALATTR_INSECURITY 0x10

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley#define SHUTDOWN(v) (((v)->attributes & VALATTR_SHUTDOWN) != 0)

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrencestatic void

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsdestroy(dns_validator_t *val);

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrence

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic isc_result_t

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrewsget_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrence dns_rdataset_t *rdataset);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic isc_result_t

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrencevalidate(dns_validator_t *val, isc_boolean_t resume);

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrence

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic isc_result_t

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsvalidatezonekey(dns_validator_t *val, isc_boolean_t resume);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic isc_result_t

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrewsnsecvalidate(dns_validator_t *val, isc_boolean_t resume);

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrence

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic isc_result_t

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrenceproveunsecure(dns_validator_t *val, isc_boolean_t resume);

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrence

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic void

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonvalidator_logv(dns_validator_t *val, isc_logcategory_t *category,

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington isc_logmodule_t *module, int level, const char *fmt, va_list ap)

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington ISC_FORMAT_PRINTF(5, 0);

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington

ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrencestatic void

76c8294c81fb48b1da6e1fc5b83322a4cedb8e58Andreas Gustafssonvalidator_log(dns_validator_t *val, int level, const char *fmt, ...)

76c8294c81fb48b1da6e1fc5b83322a4cedb8e58Andreas Gustafsson ISC_FORMAT_PRINTF(3, 4);

1b1e1fda4638334b484aa38c15f53a131c0b0fdfAndreas Gustafsson

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic void

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsvalidator_logcreate(dns_validator_t *val,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_name_t *name, dns_rdatatype_t type,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews const char *caller, const char *operation);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halleystatic void

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halleyvalidator_done(dns_validator_t *val, isc_result_t result) {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley isc_task_t *task;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington if (val->event == NULL)

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington return;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley /*

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington val->event->result = result;

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff task = val->event->ev_sender;

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff val->event->ev_sender = val;

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff val->event->ev_type = DNS_EVENT_VALIDATORDONE;

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff val->event->ev_action = val->action;

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff val->event->ev_arg = val->arg;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley isc_task_sendanddetach(&task, (isc_event_t **)&val->event);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley}

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic inline isc_boolean_t

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsexit_check(dns_validator_t *val) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (!SHUTDOWN(val))

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (ISC_FALSE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews INSIST(val->event == NULL);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (val->fetch != NULL || val->subvalidator != NULL)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (ISC_FALSE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews}

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellingtonstatic void

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellingtonauth_nonpending(dns_message_t *message) {

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington isc_result_t result;

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington dns_name_t *name;

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington dns_rdataset_t *rdataset;

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington for (result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington result == ISC_R_SUCCESS;

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington result = dns_message_nextname(message, DNS_SECTION_AUTHORITY))

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington {

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington name = NULL;

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington for (rdataset = ISC_LIST_HEAD(name->list);

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington rdataset != NULL;

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington rdataset = ISC_LIST_NEXT(rdataset, link))

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington {

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington if (rdataset->trust == dns_trust_pending)

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington rdataset->trust = dns_trust_authauthority;

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington }

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington }

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington}

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrewsstatic isc_boolean_t

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrewsisdelegation(dns_name_t *name, dns_rdataset_t *rdataset,

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_result_t dbresult)

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews{

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dns_rdataset_t set;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dns_rdata_t rdata = DNS_RDATA_INIT;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_boolean_t found;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_result_t result;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews REQUIRE(dbresult == DNS_R_NXRRSET || dbresult == DNS_R_NCACHENXRRSET);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dns_rdataset_init(&set);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (dbresult == DNS_R_NXRRSET)

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dns_rdataset_clone(rdataset, &set);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews else {

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews result = dns_ncache_getrdataset(rdataset, name,

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdatatype_nsec, &set);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (result != ISC_R_SUCCESS)

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (ISC_FALSE);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews }

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews INSIST(set.type == dns_rdatatype_nsec);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews found = ISC_FALSE;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews result = dns_rdataset_first(&set);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (result == ISC_R_SUCCESS) {

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dns_rdataset_current(&set, &rdata);

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews found = dns_nsec_typepresent(&rdata, dns_rdatatype_ns);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews }

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dns_rdataset_disassociate(&set);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews return (found);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews}

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellingtonstatic void

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellingtonfetch_callback_validator(isc_task_t *task, isc_event_t *event) {

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington dns_fetchevent_t *devent;

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington dns_validator_t *val;

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington dns_rdataset_t *rdataset;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_boolean_t want_destroy;

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington isc_result_t result;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington isc_result_t eresult;

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington UNUSED(task);

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff INSIST(event->ev_type == DNS_EVENT_FETCHDONE);

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington devent = (dns_fetchevent_t *)event;

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff val = devent->ev_arg;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington rdataset = &val->frdataset;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington eresult = devent->result;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington isc_event_free(&event);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington dns_resolver_destroyfetch(&val->fetch);

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington INSIST(val->event != NULL);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3), "in fetch_callback_validator");

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington LOCK(&val->lock);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (eresult == ISC_R_SUCCESS) {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington "keyset with trust %d", rdataset->trust);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington /*

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (rdataset->trust >= dns_trust_secure) {

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington result = get_dst_key(val, val->siginfo, rdataset);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (result == ISC_R_SUCCESS)

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington val->keyset = &val->frdataset;

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington }

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington result = validate(val, ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result != DNS_R_WAIT)

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington validator_done(val, result);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington } else {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

1b1e1fda4638334b484aa38c15f53a131c0b0fdfAndreas Gustafsson "fetch_callback_validator: got %s",

18b7133679efa8f60fd4e396c628576f3f416b3eBrian Wellington isc_result_totext(eresult));

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington if (eresult == ISC_R_CANCELED)

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington validator_done(val, eresult);

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington else

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington validator_done(val, DNS_R_NOVALIDKEY);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews want_destroy = exit_check(val);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington UNLOCK(&val->lock);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (want_destroy)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews destroy(val);

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington}

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellingtonstatic void

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsdsfetched(isc_task_t *task, isc_event_t *event) {

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington dns_fetchevent_t *devent;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington dns_validator_t *val;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_t *rdataset;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_boolean_t want_destroy;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington isc_result_t result;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington isc_result_t eresult;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington UNUSED(task);

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington INSIST(event->ev_type == DNS_EVENT_FETCHDONE);

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington devent = (dns_fetchevent_t *)event;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington val = devent->ev_arg;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington rdataset = &val->frdataset;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington eresult = devent->result;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_event_free(&event);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington dns_resolver_destroyfetch(&val->fetch);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington INSIST(val->event != NULL);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3), "in dsfetched");

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington LOCK(&val->lock);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (eresult == ISC_R_SUCCESS) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "dsset with trust %d", rdataset->trust);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->dsset = &val->frdataset;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = validatezonekey(val, ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result != DNS_R_WAIT)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_done(val, result);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews } else if (eresult == DNS_R_NXRRSET ||

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews eresult == DNS_R_NCACHENXRRSET)

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "falling back to insecurity proof");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->attributes |= VALATTR_INSECURITY;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = proveunsecure(val, ISC_FALSE);

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington if (result != DNS_R_WAIT)

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington validator_done(val, result);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington } else {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "dsfetched: got %s",

18b7133679efa8f60fd4e396c628576f3f416b3eBrian Wellington isc_result_totext(eresult));

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington if (eresult == ISC_R_CANCELED)

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington validator_done(val, eresult);

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington else

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_done(val, DNS_R_NOVALIDDS);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews want_destroy = exit_check(val);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington UNLOCK(&val->lock);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (want_destroy)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews destroy(val);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews}

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic void

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsdsfetched2(isc_task_t *task, isc_event_t *event) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_fetchevent_t *devent;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validator_t *val;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_t *rdataset;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews dns_name_t *tname;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_boolean_t want_destroy;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_result_t result;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_result_t eresult;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews UNUSED(task);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews INSIST(event->ev_type == DNS_EVENT_FETCHDONE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews devent = (dns_fetchevent_t *)event;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val = devent->ev_arg;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews rdataset = &val->frdataset;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews eresult = devent->result;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_resolver_destroyfetch(&val->fetch);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews INSIST(val->event != NULL);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3), "in dsfetched2");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews LOCK(&val->lock);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (eresult == DNS_R_NXRRSET || eresult == DNS_R_NCACHENXRRSET) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews tname = dns_fixedname_name(&devent->foundname);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (isdelegation(tname, &val->frdataset, eresult)) {

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews val->event->rdataset->trust = dns_trust_answer;

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews validator_done(val, ISC_R_SUCCESS);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews } else {

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews result = proveunsecure(val, ISC_TRUE);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews if (result != DNS_R_WAIT)

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews validator_done(val, result);

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews } else if (eresult == ISC_R_SUCCESS ||

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews eresult == DNS_R_NXDOMAIN ||

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews eresult == DNS_R_NCACHENXDOMAIN)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = proveunsecure(val, ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result != DNS_R_WAIT)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_done(val, result);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews } else {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (eresult == ISC_R_CANCELED)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_done(val, eresult);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews else

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_done(val, DNS_R_NOVALIDDS);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

ff30cdeb783ca7ffe69b222c56197828e882c229Mark Andrews isc_event_free(&event);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews want_destroy = exit_check(val);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews UNLOCK(&val->lock);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (want_destroy)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews destroy(val);

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington}

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellingtonstatic void

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellingtonkeyvalidated(isc_task_t *task, isc_event_t *event) {

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington dns_validatorevent_t *devent;

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington dns_validator_t *val;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_boolean_t want_destroy;

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington isc_result_t result;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington isc_result_t eresult;

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington UNUSED(task);

e44487bfc23599b6b240e09d83d1c862fecfcc82Michael Graff INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington devent = (dns_validatorevent_t *)event;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington val = devent->ev_arg;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington eresult = devent->result;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington isc_event_free(&event);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validator_destroy(&val->subvalidator);

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington INSIST(val->event != NULL);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3), "in keyvalidated");

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington LOCK(&val->lock);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (eresult == ISC_R_SUCCESS) {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

76c8294c81fb48b1da6e1fc5b83322a4cedb8e58Andreas Gustafsson "keyset with trust %d", val->frdataset.trust);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington /*

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (val->frdataset.trust >= dns_trust_secure)

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington (void) get_dst_key(val, val->siginfo, &val->frdataset);

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington result = validate(val, ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result != DNS_R_WAIT)

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington validator_done(val, result);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington } else {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

1b1e1fda4638334b484aa38c15f53a131c0b0fdfAndreas Gustafsson "keyvalidated: got %s",

18b7133679efa8f60fd4e396c628576f3f416b3eBrian Wellington isc_result_totext(eresult));

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington validator_done(val, eresult);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews want_destroy = exit_check(val);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews UNLOCK(&val->lock);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (want_destroy)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews destroy(val);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews}

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic void

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsdsvalidated(isc_task_t *task, isc_event_t *event) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validatorevent_t *devent;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validator_t *val;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_boolean_t want_destroy;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_result_t result;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_result_t eresult;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews UNUSED(task);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews devent = (dns_validatorevent_t *)event;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val = devent->ev_arg;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews eresult = devent->result;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_event_free(&event);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validator_destroy(&val->subvalidator);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews INSIST(val->event != NULL);

17a3fcecd069130a5f318685493b0db5639a77c9Brian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3), "in dsvalidated");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews LOCK(&val->lock);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (eresult == ISC_R_SUCCESS) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "dsset with trust %d", val->frdataset.trust);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if ((val->attributes & VALATTR_INSECURITY) != 0)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = proveunsecure(val, ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews else

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = validatezonekey(val, ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result != DNS_R_WAIT)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_done(val, result);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews } else {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "dsvalidated: got %s",

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_result_totext(eresult));

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_done(val, eresult);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews want_destroy = exit_check(val);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington UNLOCK(&val->lock);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (want_destroy)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews destroy(val);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington}

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellingtonstatic isc_boolean_t

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrewsnsecprovesnonexistence(dns_validator_t *val, dns_name_t *nsecname,

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdataset_t *nsecset)

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington{

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington int order;

c03bb27f0675a6e60ceea66b451548e8481bc05cMark Andrews dns_rdata_t rdata = DNS_RDATA_INIT;

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews isc_boolean_t isnxdomain;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington isc_result_t result;

421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews dns_namereln_t relation;

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews unsigned int olabels, nlabels, labels, bits;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews INSIST(DNS_MESSAGE_VALID(val->event->message));

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews if (val->event->message->rcode == dns_rcode_nxdomain)

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews isnxdomain = ISC_TRUE;

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews else

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews isnxdomain = ISC_FALSE;

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews result = dns_rdataset_first(nsecset);

c70908209ee26c51a8e7242a56fdb73847249728Brian Wellington if (result != ISC_R_SUCCESS) {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews "failure processing NSEC set");

c70908209ee26c51a8e7242a56fdb73847249728Brian Wellington return (ISC_FALSE);

c70908209ee26c51a8e7242a56fdb73847249728Brian Wellington }

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdataset_current(nsecset, &rdata);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews validator_log(val, ISC_LOG_DEBUG(3), "looking for relevant nsec");

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews relation = dns_name_fullcompare(val->event->name, nsecname,

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews &order, &olabels, &bits);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (order == 0) {

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington /*

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews if (isnxdomain) {

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews "NSEC record seen at nonexistent name");

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews return (ISC_FALSE);

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews }

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (val->event->type >= 128) {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3), "invalid type %d",

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson val->event->type);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington return (ISC_FALSE);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington }

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews if (dns_nsec_typepresent(&rdata, val->event->type)) {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington "type should not be present");

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington return (ISC_FALSE);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington }

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews validator_log(val, ISC_LOG_DEBUG(3), "nsec bitmask ok");

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington } else if (order > 0) {

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdata_nsec_t nsec;

d1cbf714097e900ed1703529584d3e1a50e8a4a8Brian Wellington

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington /*

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews if (!isnxdomain) {

421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews /*

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews result = dns_rdata_tostruct(&rdata, &nsec, NULL);

421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews RUNTIME_CHECK(result == ISC_R_SUCCESS);

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews relation = dns_name_fullcompare(&nsec.next,

421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews val->event->name,

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews &order, &nlabels,

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews &bits);

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews if (order > 0 && relation == dns_namereln_subdomain) {

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdata_freestruct(&nsec);

421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews "nsec proves empty node, ok");

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews return (ISC_TRUE);

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews }

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews /*

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews labels = dns_name_countlabels(&nsec.next);

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews if (nlabels >= olabels && nlabels + 1 < labels) {

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews dns_name_t wild;

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews dns_name_init(&wild, NULL);

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_name_getlabelsequence(&nsec.next,

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews labels - 1 - nlabels,

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews nlabels + 1,

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews &wild);

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews if (dns_name_iswildcard(&wild)) {

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdata_freestruct(&nsec);

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews validator_log(val, ISC_LOG_DEBUG(3),

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews "nsec proves empty wildcard, ok");

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews return (ISC_TRUE);

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews }

421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews }

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews /*

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdata_freestruct(&nsec);

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews "missing NSEC record at name");

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews return (ISC_FALSE);

c99d9017ba00099bfa89e1ed53e63a5cb07d28d5Mark Andrews }

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews if (dns_name_issubdomain(val->event->name, nsecname) &&

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_nsec_typepresent(&rdata, dns_rdatatype_ns) &&

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews !dns_nsec_typepresent(&rdata, dns_rdatatype_soa))

638fe804a524ee0c028863c0301b999c79de7651Mark Andrews {

638fe804a524ee0c028863c0301b999c79de7651Mark Andrews /*

638fe804a524ee0c028863c0301b999c79de7651Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews "ignoring parent nsec");

638fe804a524ee0c028863c0301b999c79de7651Mark Andrews return (ISC_FALSE);

638fe804a524ee0c028863c0301b999c79de7651Mark Andrews }

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews result = dns_rdata_tostruct(&rdata, &nsec, NULL);

c70908209ee26c51a8e7242a56fdb73847249728Brian Wellington if (result != ISC_R_SUCCESS)

c70908209ee26c51a8e7242a56fdb73847249728Brian Wellington return (ISC_FALSE);

368b37b616234fce3d23099eb180f1dd38e1fb62Mark Andrews dns_rdata_reset(&rdata);

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews relation = dns_name_fullcompare(&nsec.next, val->event->name,

8b5de9701428e2b5eb50aba96af23dc1186124ddMark Andrews &order, &nlabels, &bits);

421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews if (order <= 0) {

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington /*

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews if (!dns_name_equal(val->soaname, &nsec.next)) {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington "next name is not greater");

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdata_freestruct(&nsec);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington return (ISC_FALSE);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington }

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews "nsec points to zone apex, ok");

421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews } else if (relation == dns_namereln_subdomain) {

421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews "nsec proves empty node, bad");

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdata_freestruct(&nsec);

421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews return (ISC_FALSE);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington }

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdata_freestruct(&nsec);

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews validator_log(val, ISC_LOG_DEBUG(3), "nsec range ok");

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington } else {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews "nsec owner name is not less");

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington /*

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington return (ISC_FALSE);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington }

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington return (ISC_TRUE);

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington}

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellingtonstatic void

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellingtonauthvalidated(isc_task_t *task, isc_event_t *event) {

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington dns_validatorevent_t *devent;

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington dns_validator_t *val;

e27021ee1f37185ab839a7a3b6bc078c24255e62Brian Wellington dns_rdataset_t *rdataset, *sigrdataset;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_boolean_t want_destroy;

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington isc_result_t result;

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington UNUSED(task);

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington devent = (dns_validatorevent_t *)event;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington rdataset = devent->rdataset;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington sigrdataset = devent->sigrdataset;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington val = devent->ev_arg;

b0d31c78bc24080d4c470a8bd98862375f6e3055Mark Andrews result = devent->result;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validator_destroy(&val->subvalidator);

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington INSIST(val->event != NULL);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3), "in authvalidated");

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington LOCK(&val->lock);

b0d31c78bc24080d4c470a8bd98862375f6e3055Mark Andrews if (result != ISC_R_SUCCESS) {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington "authvalidated: got %s",

b0d31c78bc24080d4c470a8bd98862375f6e3055Mark Andrews isc_result_totext(result));

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result == ISC_R_CANCELED)

f15af68028adc665d3bdddf955fc52bad83f0514Brian Wellington validator_done(val, result);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews else {

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews result = nsecvalidate(val, ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result != DNS_R_WAIT)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_done(val, result);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington } else {

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews if (val->soaname != NULL && val->nsecset != NULL &&

86f6b92e35c7bdb5fc1fd1021af75b981863313eMark Andrews (val->attributes & VALATTR_FOUNDNONEXISTENCE) == 0 &&

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews nsecprovesnonexistence(val, devent->name, rdataset))

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington val->attributes |= VALATTR_FOUNDNONEXISTENCE;

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews result = nsecvalidate(val, ISC_TRUE);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (result != DNS_R_WAIT)

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington validator_done(val, result);

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews want_destroy = exit_check(val);

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington UNLOCK(&val->lock);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (want_destroy)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews destroy(val);

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington

94766449d6125cd5870891b70d46573e5deaceb4Brian Wellington /*

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington isc_event_free(&event);

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington}

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellingtonstatic void

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellingtonnegauthvalidated(isc_task_t *task, isc_event_t *event) {

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington dns_validatorevent_t *devent;

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington dns_validator_t *val;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_boolean_t want_destroy;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington isc_result_t eresult;

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington UNUSED(task);

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington devent = (dns_validatorevent_t *)event;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington val = devent->ev_arg;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington eresult = devent->result;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington isc_event_free(&event);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validator_destroy(&val->subvalidator);

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington

8839b6acbf816fedc15b8e9e1c71fd606a9cd8eaBrian Wellington INSIST(val->event != NULL);

9cd6710f91bdffef5aed68ab02533e398f6134d7Brian Wellington

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3), "in negauthvalidated");

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington LOCK(&val->lock);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (eresult == ISC_R_SUCCESS) {

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington val->attributes |= VALATTR_FOUNDNONEXISTENCE;

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington "nonexistence proof found");

98d010a24a9f1b4b45ce9791845941ef90426d0cBrian Wellington auth_nonpending(val->event->message);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington validator_done(val, ISC_R_SUCCESS);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington } else {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington "negauthvalidated: got %s",

18b7133679efa8f60fd4e396c628576f3f416b3eBrian Wellington isc_result_totext(eresult));

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington validator_done(val, eresult);

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews want_destroy = exit_check(val);

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington UNLOCK(&val->lock);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (want_destroy)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews destroy(val);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews}

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic inline isc_result_t

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsview_find(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) {

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (dns_rdataset_isassociated(&val->frdataset))

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington dns_rdataset_disassociate(&val->frdataset);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (dns_rdataset_isassociated(&val->fsigrdataset))

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_disassociate(&val->fsigrdataset);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (val->view->zonetable == NULL)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (ISC_R_CANCELED);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (dns_view_simplefind(val->view, name, type, 0,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews DNS_DBFIND_PENDINGOK, ISC_FALSE,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &val->frdataset, &val->fsigrdataset));

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews}

613efcd8fbd0d1ce0d0afd1ac85d95cf85bffc27Brian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic inline isc_boolean_t

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewscheck_deadlock(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validator_t *parent;

6f071989da905bb5ab2c6dfd01a71ee5ecea5918Brian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews for (parent = val->parent; parent != NULL; parent = parent->parent) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (parent->event != NULL &&

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews parent->event->type == type &&

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_name_equal(parent->event->name, name))

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "continuing validation would lead to "

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "deadlock: aborting validation");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

613efcd8fbd0d1ce0d0afd1ac85d95cf85bffc27Brian Wellington }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (ISC_FALSE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews}

613efcd8fbd0d1ce0d0afd1ac85d95cf85bffc27Brian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic inline isc_result_t

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewscreate_fetch(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_taskaction_t callback, const char *caller)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews{

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (dns_rdataset_isassociated(&val->frdataset))

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington dns_rdataset_disassociate(&val->frdataset);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (dns_rdataset_isassociated(&val->fsigrdataset))

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington dns_rdataset_disassociate(&val->fsigrdataset);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (check_deadlock(val, name, type))

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (DNS_R_NOVALIDSIG);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_logcreate(val, name, type, caller, "fetch");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (dns_resolver_createfetch(val->view->resolver, name, type,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews NULL, NULL, NULL, 0,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->event->ev_sender,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews callback, val,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &val->frdataset,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &val->fsigrdataset,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &val->fetch));

613efcd8fbd0d1ce0d0afd1ac85d95cf85bffc27Brian Wellington}

613efcd8fbd0d1ce0d0afd1ac85d95cf85bffc27Brian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic inline isc_result_t

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewscreate_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_taskaction_t action, const char *caller)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews{

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington isc_result_t result;

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (check_deadlock(val, name, type))

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (DNS_R_NOVALIDSIG);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_logcreate(val, name, type, caller, "validator");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = dns_validator_create(val->view, name, type,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews rdataset, sigrdataset, NULL, 0,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->task, action, val,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &val->subvalidator);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result == ISC_R_SUCCESS)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->subvalidator->parent = val;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (result);

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington}

48ed268b3378a8b729a0037bc4ae2ed73647a96aBrian Wellington

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic isc_result_t

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrewsget_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley dns_rdataset_t *rdataset)

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley{

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley isc_result_t result;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley isc_buffer_t b;

c03bb27f0675a6e60ceea66b451548e8481bc05cMark Andrews dns_rdata_t rdata = DNS_RDATA_INIT;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington dst_key_t *oldkey = val->key;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington isc_boolean_t foundold;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington if (oldkey == NULL)

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington foundold = ISC_TRUE;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington else {

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington foundold = ISC_FALSE;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington val->key = NULL;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington }

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley result = dns_rdataset_first(rdataset);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley if (result != ISC_R_SUCCESS)

feb40fc5f911d0b2050fb9fd34950a52930b981dBrian Wellington goto failure;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley do {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley dns_rdataset_current(rdataset, &rdata);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

6e49e91bd08778d7eae45a2229dcf41ed97cc636David Lawrence isc_buffer_init(&b, rdata.data, rdata.length);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley isc_buffer_add(&b, rdata.length);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley INSIST(val->key == NULL);

5c29047792191d6141f69b2684314d0b762fedebBrian Wellington result = dst_key_fromdns(&siginfo->signer, rdata.rdclass, &b,

5c29047792191d6141f69b2684314d0b762fedebBrian Wellington val->view->mctx, &val->key);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley if (result != ISC_R_SUCCESS)

feb40fc5f911d0b2050fb9fd34950a52930b981dBrian Wellington goto failure;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley if (siginfo->algorithm ==

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley (dns_secalg_t)dst_key_alg(val->key) &&

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington siginfo->keyid ==

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley (dns_keytag_t)dst_key_id(val->key) &&

63bf060be4ff2a7ade02fd86abb98694a5afc250Brian Wellington dst_key_iszonekey(val->key))

63bf060be4ff2a7ade02fd86abb98694a5afc250Brian Wellington {

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington if (foundold)

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington /*

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington return (ISC_R_SUCCESS);

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington else if (dst_key_compare(oldkey, val->key) == ISC_TRUE)

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington {

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington foundold = ISC_TRUE;

c50936eb40263b65ebf6afe4e6556e2dc67c10e4Brian Wellington dst_key_free(&oldkey);

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington }

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley }

c50936eb40263b65ebf6afe4e6556e2dc67c10e4Brian Wellington dst_key_free(&val->key);

368b37b616234fce3d23099eb180f1dd38e1fb62Mark Andrews dns_rdata_reset(&rdata);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley result = dns_rdataset_next(rdataset);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley } while (result == ISC_R_SUCCESS);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley if (result == ISC_R_NOMORE)

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley result = ISC_R_NOTFOUND;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

feb40fc5f911d0b2050fb9fd34950a52930b981dBrian Wellington failure:

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington if (oldkey != NULL)

c50936eb40263b65ebf6afe4e6556e2dc67c10e4Brian Wellington dst_key_free(&oldkey);

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley return (result);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley}

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic isc_result_t

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrewsget_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo) {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley isc_result_t result;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley unsigned int nbits, nlabels;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley int order;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley dns_namereln_t namereln;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley /*

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington namereln = dns_name_fullcompare(val->event->name, &siginfo->signer,

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley &order, &nlabels, &nbits);

a9ba7e65644c50e1549b38150ba8d4787e1fe643Brian Wellington if (namereln != dns_namereln_subdomain &&

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington namereln != dns_namereln_equal)

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley return (DNS_R_CONTINUE);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (namereln == dns_namereln_equal) {

78951552dccf0d0004d61072bbc71fa4b1aab30fAndreas Gustafsson /*

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews if (val->event->rdataset->type == dns_rdatatype_dnskey)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (DNS_R_CONTINUE);

78951552dccf0d0004d61072bbc71fa4b1aab30fAndreas Gustafsson

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (dns_rdatatype_atparent(val->event->rdataset->type))

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (DNS_R_CONTINUE);

a9ba7e65644c50e1549b38150ba8d4787e1fe643Brian Wellington }

a9ba7e65644c50e1549b38150ba8d4787e1fe643Brian Wellington

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley /*

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews result = view_find(val, &siginfo->signer, dns_rdatatype_dnskey);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley if (result == ISC_R_SUCCESS) {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley /*

77c67dfb2607618f5e7940486daebafd42a502abBrian Wellington val->keyset = &val->frdataset;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (val->frdataset.trust == dns_trust_pending &&

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington dns_rdataset_isassociated(&val->fsigrdataset))

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley /*

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = create_validator(val, &siginfo->signer,

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdatatype_dnskey,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &val->frdataset,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &val->fsigrdataset,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews keyvalidated,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "get_key");

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington if (result != ISC_R_SUCCESS)

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington return (result);

3676eeb6ca95c66aae1256f37af8c990d9f25eb4Brian Wellington return (DNS_R_WAIT);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington } else if (val->frdataset.trust == dns_trust_pending) {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley /*

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington result = DNS_R_CONTINUE;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington } else if (val->frdataset.trust < dns_trust_secure) {

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington /*

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington val->key = NULL;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington result = ISC_R_SUCCESS;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington } else {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley /*

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington "keyset with trust %d",

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington val->frdataset.trust);

77c67dfb2607618f5e7940486daebafd42a502abBrian Wellington result = get_dst_key(val, siginfo, val->keyset);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley if (result != ISC_R_SUCCESS) {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley /*

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley result = DNS_R_CONTINUE;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley }

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley }

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley } else if (result == ISC_R_NOTFOUND) {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley /*

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews result = create_fetch(val, &siginfo->signer, dns_rdatatype_dnskey,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews fetch_callback_validator, "get_key");

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington if (result != ISC_R_SUCCESS)

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington return (result);

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington return (DNS_R_WAIT);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley } else if (result == DNS_R_NCACHENXDOMAIN ||

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley result == DNS_R_NCACHENXRRSET ||

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley result == DNS_R_NXDOMAIN ||

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington result == DNS_R_NXRRSET)

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley /*

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley result = DNS_R_CONTINUE;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley }

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

77c67dfb2607618f5e7940486daebafd42a502abBrian Wellington if (dns_rdataset_isassociated(&val->frdataset) &&

77c67dfb2607618f5e7940486daebafd42a502abBrian Wellington val->keyset != &val->frdataset)

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington dns_rdataset_disassociate(&val->frdataset);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (dns_rdataset_isassociated(&val->fsigrdataset))

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington dns_rdataset_disassociate(&val->fsigrdataset);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley return (result);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley}

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic dns_keytag_t

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrewscompute_keytag(dns_rdata_t *rdata, dns_rdata_dnskey_t *key) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_region_t r;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdata_toregion(rdata, &r);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (dst_region_computeid(&r, key->algorithm));

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews}

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

25496cebadd170fd5fae2aabf0469eef551259aaBrian Wellingtonstatic isc_boolean_t

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsisselfsigned(dns_validator_t *val) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_t *rdataset, *sigrdataset;

c03bb27f0675a6e60ceea66b451548e8481bc05cMark Andrews dns_rdata_t rdata = DNS_RDATA_INIT;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdata_t sigrdata = DNS_RDATA_INIT;

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdata_dnskey_t key;

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdata_rrsig_t sig;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_keytag_t keytag;

25496cebadd170fd5fae2aabf0469eef551259aaBrian Wellington isc_result_t result;

25496cebadd170fd5fae2aabf0469eef551259aaBrian Wellington

25496cebadd170fd5fae2aabf0469eef551259aaBrian Wellington rdataset = val->event->rdataset;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews sigrdataset = val->event->sigrdataset;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews INSIST(rdataset->type == dns_rdatatype_dnskey);

25496cebadd170fd5fae2aabf0469eef551259aaBrian Wellington

25496cebadd170fd5fae2aabf0469eef551259aaBrian Wellington for (result = dns_rdataset_first(rdataset);

25496cebadd170fd5fae2aabf0469eef551259aaBrian Wellington result == ISC_R_SUCCESS;

25496cebadd170fd5fae2aabf0469eef551259aaBrian Wellington result = dns_rdataset_next(rdataset))

25496cebadd170fd5fae2aabf0469eef551259aaBrian Wellington {

368b37b616234fce3d23099eb180f1dd38e1fb62Mark Andrews dns_rdata_reset(&rdata);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_current(rdataset, &rdata);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews (void)dns_rdata_tostruct(&rdata, &key, NULL);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews keytag = compute_keytag(&rdata, &key);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews for (result = dns_rdataset_first(sigrdataset);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result == ISC_R_SUCCESS;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = dns_rdataset_next(sigrdataset))

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdata_reset(&sigrdata);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_current(sigrdataset, &sigrdata);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews (void)dns_rdata_tostruct(&sigrdata, &sig, NULL);

25496cebadd170fd5fae2aabf0469eef551259aaBrian Wellington

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (sig.algorithm == key.algorithm &&

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews sig.keyid == keytag)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (ISC_TRUE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

25496cebadd170fd5fae2aabf0469eef551259aaBrian Wellington }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (ISC_FALSE);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews}

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic isc_result_t

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsverify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_result_t result;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->attributes |= VALATTR_TRIEDVERIFY;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = dns_dnssec_verify(val->event->name, val->event->rdataset,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews key, ISC_FALSE, val->view->mctx, rdata);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "verify rdataset: %s",

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_result_totext(result));

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (result);

25496cebadd170fd5fae2aabf0469eef551259aaBrian Wellington}

25496cebadd170fd5fae2aabf0469eef551259aaBrian Wellington

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellingtonstatic isc_result_t

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halleyvalidate(dns_validator_t *val, isc_boolean_t resume) {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley isc_result_t result;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley dns_validatorevent_t *event;

c03bb27f0675a6e60ceea66b451548e8481bc05cMark Andrews dns_rdata_t rdata = DNS_RDATA_INIT;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley /*

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley event = val->event;

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

93c786e0924aeca2c258e32355349e6ae60a0f72Andreas Gustafsson if (resume) {

1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence /*

93c786e0924aeca2c258e32355349e6ae60a0f72Andreas Gustafsson result = ISC_R_SUCCESS;

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3), "resuming validate");

93c786e0924aeca2c258e32355349e6ae60a0f72Andreas Gustafsson } else {

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley result = dns_rdataset_first(event->sigrdataset);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley }

93c786e0924aeca2c258e32355349e6ae60a0f72Andreas Gustafsson

93c786e0924aeca2c258e32355349e6ae60a0f72Andreas Gustafsson for (;

93c786e0924aeca2c258e32355349e6ae60a0f72Andreas Gustafsson result == ISC_R_SUCCESS;

93c786e0924aeca2c258e32355349e6ae60a0f72Andreas Gustafsson result = dns_rdataset_next(event->sigrdataset))

93c786e0924aeca2c258e32355349e6ae60a0f72Andreas Gustafsson {

368b37b616234fce3d23099eb180f1dd38e1fb62Mark Andrews dns_rdata_reset(&rdata);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley dns_rdataset_current(event->sigrdataset, &rdata);

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington if (val->siginfo == NULL) {

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington val->siginfo = isc_mem_get(val->view->mctx,

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington sizeof(*val->siginfo));

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington if (val->siginfo == NULL)

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington return (ISC_R_NOMEMORY);

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington }

1f1d36a87b65186d9f89aac7f456ab1fd2a39ef6Andreas Gustafsson result = dns_rdata_tostruct(&rdata, val->siginfo, NULL);

1f1d36a87b65186d9f89aac7f456ab1fd2a39ef6Andreas Gustafsson if (result != ISC_R_SUCCESS)

1f1d36a87b65186d9f89aac7f456ab1fd2a39ef6Andreas Gustafsson return (result);

40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley /*

40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley if (!resume) {

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington result = get_key(val, val->siginfo);

93c786e0924aeca2c258e32355349e6ae60a0f72Andreas Gustafsson if (result == DNS_R_CONTINUE)

93c786e0924aeca2c258e32355349e6ae60a0f72Andreas Gustafsson continue; /* Try the next SIG RR. */

0a3e2e1d590dac7fb011e72bd3a4982c179d8e68Brian Wellington if (result != ISC_R_SUCCESS)

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley return (result);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley }

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

23e4260821eefa5019808e18e14e2b366461aad7Brian Wellington /*

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington if (val->key == NULL) {

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington event->rdataset->trust = dns_trust_answer;

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington event->sigrdataset->trust = dns_trust_answer;

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington "marking as answer");

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington return (ISC_R_SUCCESS);

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington }

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington

ba393f380e4cd93029f6a7291d6c2d14f9022b3cBrian Wellington do {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = verify(val, val->key, &rdata);

ba393f380e4cd93029f6a7291d6c2d14f9022b3cBrian Wellington if (result == ISC_R_SUCCESS)

ba393f380e4cd93029f6a7291d6c2d14f9022b3cBrian Wellington break;

ba393f380e4cd93029f6a7291d6c2d14f9022b3cBrian Wellington if (val->keynode != NULL) {

e49c834de8cdf92d4b85ef0fbf1d9dc59620a342Brian Wellington dns_keynode_t *nextnode = NULL;

e49c834de8cdf92d4b85ef0fbf1d9dc59620a342Brian Wellington result = dns_keytable_findnextkeynode(

e49c834de8cdf92d4b85ef0fbf1d9dc59620a342Brian Wellington val->keytable,

e49c834de8cdf92d4b85ef0fbf1d9dc59620a342Brian Wellington val->keynode,

e49c834de8cdf92d4b85ef0fbf1d9dc59620a342Brian Wellington &nextnode);

e49c834de8cdf92d4b85ef0fbf1d9dc59620a342Brian Wellington dns_keytable_detachkeynode(val->keytable,

e49c834de8cdf92d4b85ef0fbf1d9dc59620a342Brian Wellington &val->keynode);

e49c834de8cdf92d4b85ef0fbf1d9dc59620a342Brian Wellington val->keynode = nextnode;

e49c834de8cdf92d4b85ef0fbf1d9dc59620a342Brian Wellington if (result != ISC_R_SUCCESS) {

e49c834de8cdf92d4b85ef0fbf1d9dc59620a342Brian Wellington val->key = NULL;

ba393f380e4cd93029f6a7291d6c2d14f9022b3cBrian Wellington break;

e49c834de8cdf92d4b85ef0fbf1d9dc59620a342Brian Wellington }

ba393f380e4cd93029f6a7291d6c2d14f9022b3cBrian Wellington val->key = dns_keynode_key(val->keynode);

feb40fc5f911d0b2050fb9fd34950a52930b981dBrian Wellington } else {

feb40fc5f911d0b2050fb9fd34950a52930b981dBrian Wellington if (get_dst_key(val, val->siginfo, val->keyset)

ba393f380e4cd93029f6a7291d6c2d14f9022b3cBrian Wellington != ISC_R_SUCCESS)

ba393f380e4cd93029f6a7291d6c2d14f9022b3cBrian Wellington break;

feb40fc5f911d0b2050fb9fd34950a52930b981dBrian Wellington }

ba393f380e4cd93029f6a7291d6c2d14f9022b3cBrian Wellington } while (1);

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington if (result != ISC_R_SUCCESS)

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

d6643ef587324e40d8bda63e9f80be8141e101edBrian Wellington "failed to verify rdataset");

75f6c57d9544aa77a3b1a04587b4702c07343c90Brian Wellington else {

75f6c57d9544aa77a3b1a04587b4702c07343c90Brian Wellington isc_uint32_t ttl;

75f6c57d9544aa77a3b1a04587b4702c07343c90Brian Wellington isc_stdtime_t now;

75f6c57d9544aa77a3b1a04587b4702c07343c90Brian Wellington

75f6c57d9544aa77a3b1a04587b4702c07343c90Brian Wellington isc_stdtime_get(&now);

75f6c57d9544aa77a3b1a04587b4702c07343c90Brian Wellington ttl = ISC_MIN(event->rdataset->ttl,

75f6c57d9544aa77a3b1a04587b4702c07343c90Brian Wellington val->siginfo->timeexpire - now);

75f6c57d9544aa77a3b1a04587b4702c07343c90Brian Wellington if (val->keyset != NULL)

75f6c57d9544aa77a3b1a04587b4702c07343c90Brian Wellington ttl = ISC_MIN(ttl, val->keyset->ttl);

75f6c57d9544aa77a3b1a04587b4702c07343c90Brian Wellington event->rdataset->ttl = ttl;

75f6c57d9544aa77a3b1a04587b4702c07343c90Brian Wellington event->sigrdataset->ttl = ttl;

75f6c57d9544aa77a3b1a04587b4702c07343c90Brian Wellington }

75f6c57d9544aa77a3b1a04587b4702c07343c90Brian Wellington

e83cae7fa837e4757c687035d6f6c0900f152749Brian Wellington if (val->keynode != NULL)

e83cae7fa837e4757c687035d6f6c0900f152749Brian Wellington dns_keytable_detachkeynode(val->keytable,

e83cae7fa837e4757c687035d6f6c0900f152749Brian Wellington &val->keynode);

feb40fc5f911d0b2050fb9fd34950a52930b981dBrian Wellington else {

feb40fc5f911d0b2050fb9fd34950a52930b981dBrian Wellington if (val->key != NULL)

feb40fc5f911d0b2050fb9fd34950a52930b981dBrian Wellington dst_key_free(&val->key);

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington if (val->keyset != NULL) {

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington dns_rdataset_disassociate(val->keyset);

feb40fc5f911d0b2050fb9fd34950a52930b981dBrian Wellington val->keyset = NULL;

ca9af3aaf798f98624fc1dc69d8c7d51bf01334dBrian Wellington }

feb40fc5f911d0b2050fb9fd34950a52930b981dBrian Wellington }

187604c1adfe841d909d4a8453b6900e652f7f6dBrian Wellington val->key = NULL;

b5debbe212097d1c573a2ba3bd9a3d526d86b0aeBrian Wellington if (result == ISC_R_SUCCESS) {

538fea1c91c68c0a5569c7b8552c8fd0490055efBrian Wellington event->rdataset->trust = dns_trust_secure;

538fea1c91c68c0a5569c7b8552c8fd0490055efBrian Wellington event->sigrdataset->trust = dns_trust_secure;

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

5c6117688525d0e8d247f50c63364f66bd8d4185Brian Wellington "marking as secure");

538fea1c91c68c0a5569c7b8552c8fd0490055efBrian Wellington return (result);

25276bd1ecb372b82c9235648e5defab0655dcd5Mark Andrews } else {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

777ac454c0cdec27dc11d80b9b2a8d7239d833a8Brian Wellington "verify failure: %s",

e49c834de8cdf92d4b85ef0fbf1d9dc59620a342Brian Wellington isc_result_totext(result));

25276bd1ecb372b82c9235648e5defab0655dcd5Mark Andrews resume = ISC_FALSE;

25276bd1ecb372b82c9235648e5defab0655dcd5Mark Andrews }

93c786e0924aeca2c258e32355349e6ae60a0f72Andreas Gustafsson }

c70908209ee26c51a8e7242a56fdb73847249728Brian Wellington if (result != ISC_R_NOMORE) {

34aa7909371f13b4bc0ba6d155cfc38bfa1e3c5cAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),

c70908209ee26c51a8e7242a56fdb73847249728Brian Wellington "failed to iterate signatures: %s",

c70908209ee26c51a8e7242a56fdb73847249728Brian Wellington isc_result_totext(result));

c70908209ee26c51a8e7242a56fdb73847249728Brian Wellington return (result);

c70908209ee26c51a8e7242a56fdb73847249728Brian Wellington }

e1f16346db02486f751c6db683fffe53c866c186Andreas Gustafsson

e1f16346db02486f751c6db683fffe53c866c186Andreas Gustafsson validator_log(val, ISC_LOG_INFO, "no valid signature found");

e1f16346db02486f751c6db683fffe53c866c186Andreas Gustafsson return (DNS_R_NOVALIDSIG);

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley}

0ec4b862c9abd11c82c88ed62438f0cf06fed25dBob Halley

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsstatic isc_result_t

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrewsvalidatezonekey(dns_validator_t *val, isc_boolean_t resume) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews isc_result_t result;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_validatorevent_t *event;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_t trdataset;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdata_t dsrdata = DNS_RDATA_INIT;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdata_t newdsrdata = DNS_RDATA_INIT;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdata_t keyrdata = DNS_RDATA_INIT;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdata_t sigrdata = DNS_RDATA_INIT;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews unsigned char dsbuf[DNS_DS_BUFFERSIZE];

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_keytag_t keytag;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdata_ds_t ds;

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdata_dnskey_t key;

93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews dns_rdata_rrsig_t sig;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dst_key_t *dstkey;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews UNUSED(resume);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews event = val->event;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (val->dsset == NULL) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews for (result = dns_rdataset_first(val->event->sigrdataset);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result == ISC_R_SUCCESS;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = dns_rdataset_next(val->event->sigrdataset))

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_keynode_t *keynode = NULL, *nextnode = NULL;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdata_reset(&sigrdata);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_current(val->event->sigrdataset,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &sigrdata);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews (void)dns_rdata_tostruct(&sigrdata, &sig, NULL);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = dns_keytable_findkeynode(val->keytable,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->event->name,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews sig.algorithm,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews sig.keyid,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &keynode);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews while (result == ISC_R_SUCCESS) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dstkey = dns_keynode_key(keynode);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = verify(val, dstkey, &sigrdata);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result == ISC_R_SUCCESS) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_keytable_detachkeynode(val->keytable,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &keynode);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews break;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = dns_keytable_findnextkeynode(

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->keytable,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews keynode,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &nextnode);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_keytable_detachkeynode(val->keytable,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &keynode);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews keynode = nextnode;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result == ISC_R_SUCCESS) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews event->rdataset->trust = dns_trust_secure;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews event->sigrdataset->trust = dns_trust_secure;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "signed by trusted key; "

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "marking as secure");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (result);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (dns_name_equal(event->name, dns_rootname)) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if ((val->attributes & VALATTR_TRIEDVERIFY) != 0)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (DNS_R_NOVALIDSIG);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews else

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (DNS_R_NOVALIDDS);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews }

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = view_find(val, val->event->name, dns_rdatatype_ds);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result == ISC_R_SUCCESS) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->dsset = &val->frdataset;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (val->frdataset.trust == dns_trust_pending &&

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_isassociated(&val->fsigrdataset))

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = create_validator(val,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews val->event->name,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdatatype_ds,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &val->frdataset,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews &val->fsigrdataset,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dsvalidated,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "validatezonekey");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result != ISC_R_SUCCESS)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (result);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (DNS_R_WAIT);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews } else if (val->frdataset.trust == dns_trust_pending) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdataset_disassociate(&val->frdataset);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews validator_log(val, ISC_LOG_DEBUG(2),

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "unsigned DS record");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (DNS_R_NOVALIDSIG);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews } else

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = ISC_R_SUCCESS;

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews } else if (result == ISC_R_NOTFOUND) {

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews /*

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result = create_fetch(val, val->event->name,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews dns_rdatatype_ds, dsfetched,

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews "validatezonekey");

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews if (result != ISC_R_SUCCESS)

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (result);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews return (DNS_R_WAIT);

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews } else if (result == DNS_R_NCACHENXDOMAIN ||

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result == DNS_R_NCACHENXRRSET ||

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result == DNS_R_NXDOMAIN ||

0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews result == DNS_R_NXRRSET)