validator.c revision 115635379a2baf2100695018109ad39e0dac349d
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt/*
699f790c49d03a9ef3c3234a72d272bb469203e8Evan Hunt * Copyright (C) 2000 Internet Software Consortium.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt *
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews * Permission to use, copy, modify, and distribute this software for any
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews * purpose with or without fee is hereby granted, provided that the above
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews * copyright notice and this permission notice appear in all copies.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt *
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
699f790c49d03a9ef3c3234a72d272bb469203e8Evan Hunt * SOFTWARE.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <config.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <isc/mem.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <isc/print.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <isc/task.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <isc/util.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <dns/db.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <dns/dnssec.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <dns/events.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <dns/keytable.h>
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt#include <dns/log.h>
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt#include <dns/message.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <dns/nxt.h>
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt#include <dns/rdata.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <dns/rdataset.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <dns/rdatatype.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <dns/resolver.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <dns/result.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <dns/validator.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#include <dns/view.h>
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt/*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * We don't use the SIG RR's _tostruct routine because it copies things.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunttypedef struct dns_siginfo {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdatatype_t covers;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_secalg_t algorithm;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_uint8_t labels;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_ttl_t original_ttl;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_stdtime_t expiration;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_stdtime_t inception;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_keytag_t tag;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_name_t signer;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_region_t signature;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt} dns_siginfo_t;
e20788e1216ed720aefa84f3295f7899d9f28c22Mark Andrews
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstruct dns_validator {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /* Unlocked. */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt unsigned int magic;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mutex_t lock;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_view_t * view;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /* Locked by lock. */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt unsigned int options;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt unsigned int attributes;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validatorevent_t * event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_fetch_t * fetch;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validator_t * keyvalidator;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validator_t * authvalidator;
80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews dns_keytable_t * keytable;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_keynode_t * keynode;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst_key_t * key;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_siginfo_t * siginfo;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_task_t * task;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_taskaction_t action;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt void * arg;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt unsigned int labels;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_t * currentset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_boolean_t seensig;
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt dns_rdataset_t * keyset;
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt};
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#define VALIDATOR_MAGIC 0x56616c3fU /* Val?. */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#define VALID_VALIDATOR(v) ISC_MAGIC_VALID(v, VALIDATOR_MAGIC)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#define VALATTR_SHUTDOWN 0x01
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#define VALATTR_FOUNDNONEXISTENCE 0x02
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt#define SHUTDOWN(v) (((v)->attributes & VALATTR_SHUTDOWN) != 0)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic void
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntnullkeyvalidated(isc_task_t *task, isc_event_t *event);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic inline isc_boolean_t
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntcontainsnullkey(dns_validator_t *val, dns_rdataset_t *rdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic inline isc_result_t
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntget_dst_key(dns_validator_t *val, dns_siginfo_t *siginfo,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_t *rdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic inline isc_result_t
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntvalidate(dns_validator_t *val, isc_boolean_t resume);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic inline isc_result_t
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntnxtvalidate(dns_validator_t *val, isc_boolean_t resume);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic inline isc_result_t
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntproveunsecure(dns_validator_t *val, isc_boolean_t resume);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic void
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntvalidator_log(dns_validator_t *val, int level, const char *fmt, ...);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic void
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntrdata_to_siginfo(dns_rdata_t *rdata, dns_siginfo_t *siginfo) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_t b;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_region_t r;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt REQUIRE(rdata->type == 24);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_init(&b, rdata->data, rdata->length);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_add(&b, rdata->length);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt siginfo->covers = (dns_rdatatype_t)isc_buffer_getuint16(&b);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt siginfo->algorithm = (dns_secalg_t)isc_buffer_getuint8(&b);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt siginfo->labels = isc_buffer_getuint8(&b);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt siginfo->original_ttl = (dns_ttl_t)isc_buffer_getuint32(&b);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt siginfo->expiration = (isc_stdtime_t)isc_buffer_getuint32(&b);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt siginfo->inception = (isc_stdtime_t)isc_buffer_getuint32(&b);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt siginfo->tag = (dns_keytag_t)isc_buffer_getuint16(&b);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_name_init(&siginfo->signer, NULL);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_remainingregion(&b, &r);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_name_fromregion(&siginfo->signer, &r);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_forward(&b, siginfo->signer.length);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_remainingregion(&b, &siginfo->signature);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic void
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntvalidator_done(dns_validator_t *val, isc_result_t result) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_task_t *task;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt REQUIRE(val->event != NULL);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * Caller must be holding the lock.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->event->result = result;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt task = val->event->ev_sender;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->event->ev_sender = val;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->event->ev_type = DNS_EVENT_VALIDATORDONE;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->event->ev_action = val->action;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->event->ev_arg = val->arg;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_task_sendanddetach(&task, (isc_event_t **)&val->event);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic void
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntfetch_callback_validator(isc_task_t *task, isc_event_t *event) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_fetchevent_t *devent;
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt dns_validator_t *val;
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt dns_rdataset_t *rdataset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t result;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNUSED(task);
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt INSIST(event->ev_type == DNS_EVENT_FETCHDONE);
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt devent = (dns_fetchevent_t *)event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val = devent->ev_arg;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt rdataset = devent->rdataset;
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3), "in fetch_callback_validator");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (devent->result == ISC_R_SUCCESS) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt LOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "keyset with trust %d", rdataset->trust);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = get_dst_key(val, val->siginfo, rdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != ISC_R_SUCCESS) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * No matching key.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNLOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto free_event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->keyset = devent->rdataset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt devent->rdataset = NULL;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = validate(val, ISC_TRUE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != DNS_R_WAIT) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNLOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto free_event;
1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt }
1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt UNLOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "fetch_callback_validator: got %s",
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_result_totext(devent->result));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, devent->result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt free_event:
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_resolver_destroyfetch(&val->fetch);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * Free stuff from the event.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (devent->rdataset != NULL)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(val->view->mctx, devent->rdataset,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt sizeof(dns_rdataset_t));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (devent->sigrdataset != NULL)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(val->view->mctx, devent->sigrdataset,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt sizeof(dns_rdataset_t));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_event_free(&event);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic void
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntfetch_callback_nullkey(isc_task_t *task, isc_event_t *event) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_fetchevent_t *devent;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validator_t *val;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_t *rdataset, *sigrdataset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_fetch_t *fetch;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t result;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNUSED(task);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(event->ev_type == DNS_EVENT_FETCHDONE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt devent = (dns_fetchevent_t *)event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val = devent->ev_arg;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt rdataset = devent->rdataset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt sigrdataset = devent->sigrdataset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3), "in fetch_callback_nullkey");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt fetch = val->fetch;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->fetch = NULL;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (devent->result == ISC_R_SUCCESS) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt LOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (!containsnullkey(val, rdataset)) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * No null key.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "found a keyset, no null key");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = proveunsecure(val, ISC_TRUE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != DNS_R_WAIT)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "found a keyset with a null key");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (rdataset->trust >= dns_trust_secure) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "insecurity proof succeeded");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->event->rdataset->trust = dns_trust_answer;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, ISC_R_SUCCESS);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else if (!dns_rdataset_isassociated(sigrdataset)) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "insecurity proof failed");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, DNS_R_NOTINSECURE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_name_t *tname;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt tname = dns_fixedname_name(&devent->foundname);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dns_validator_create(val->view, tname,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdatatype_key,
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt rdataset,
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt sigrdataset, NULL,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt 0, val->task,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt nullkeyvalidated,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val,
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt &val->keyvalidator);
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt if (result != ISC_R_SUCCESS)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt * Don't free these, since they'll be
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt * freed in nullkeyvalidated.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt devent->rdataset = NULL;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt devent->sigrdataset = NULL;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNLOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else if (devent->result == DNS_R_NCACHENXDOMAIN ||
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt devent->result == DNS_R_NCACHENXRRSET ||
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt devent->result == DNS_R_NXDOMAIN ||
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt devent->result == DNS_R_NXRRSET)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * No keys.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "no keys found");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt LOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = proveunsecure(val, ISC_TRUE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != DNS_R_WAIT)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, result);
1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt UNLOCK(&val->lock);
1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt } else {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "fetch_callback_nullkey: got %s",
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_result_totext(devent->result));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, devent->result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_resolver_destroyfetch(&fetch);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * Free stuff from the event.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (devent->rdataset != NULL)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(val->view->mctx, devent->rdataset,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt sizeof(dns_rdataset_t));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (devent->sigrdataset != NULL)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(val->view->mctx, devent->sigrdataset,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt sizeof(dns_rdataset_t));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_event_free(&event);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic void
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntkeyvalidated(isc_task_t *task, isc_event_t *event) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validatorevent_t *devent;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validator_t *val;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_t *rdataset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t result;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNUSED(task);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt devent = (dns_validatorevent_t *)event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt rdataset = devent->rdataset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val = devent->ev_arg;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3), "in keyvalidated");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (devent->result == ISC_R_SUCCESS) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt LOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "keyset with trust %d", rdataset->trust);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = get_dst_key(val, val->siginfo, rdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != ISC_R_SUCCESS) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * No matching key.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNLOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto free_event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = validate(val, ISC_TRUE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != DNS_R_WAIT) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNLOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto free_event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNLOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "keyvalidated: got %s",
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_result_totext(devent->result));
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt validator_done(val, devent->result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt free_event:
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validator_destroy(&val->keyvalidator);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * free stuff from the event.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(val->view->mctx, devent->rdataset, sizeof(dns_rdataset_t));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(val->view->mctx, devent->sigrdataset,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt sizeof(dns_rdataset_t));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_event_free(&event);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic void
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntauthvalidated(isc_task_t *task, isc_event_t *event) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validatorevent_t *devent;
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt dns_validator_t *val;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_t *rdataset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t result;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNUSED(task);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt devent = (dns_validatorevent_t *)event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt rdataset = devent->rdataset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val = devent->ev_arg;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3), "in authvalidated");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (devent->result != ISC_R_SUCCESS) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "authvalidated: got %s",
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_result_totext(devent->result));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, devent->result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto free_event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (rdataset->type == dns_rdatatype_nxt) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt int order;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdata_t rdata;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_region_t r;
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt dns_name_t nextname;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "authvalidated looking for relevant nxt");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt order = dns_name_compare(val->event->name, devent->name);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (order == 0) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (val->event->type >= 128) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "invalid type %d",
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->event->type);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto out;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dns_rdataset_first(devent->rdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(result == ISC_R_SUCCESS);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_current(devent->rdataset, &rdata);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (dns_nxt_typepresent(&rdata, val->event->type)) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "type should not be present");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto out;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "nxt bitmask ok");
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt } else if (order > 0) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dns_rdataset_first(devent->rdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(result == ISC_R_SUCCESS);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_current(devent->rdataset, &rdata);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdata_toregion(&rdata, &r);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_name_init(&nextname, NULL);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_name_fromregion(&nextname, &r);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt order = dns_name_compare(val->event->name, &nextname);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (order >= 0) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_siginfo_t *siginfo;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt siginfo = devent->validator->siginfo;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (!dns_name_equal(&siginfo->signer,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &nextname))
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "next name is not greater");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto out;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "nxt points to zone apex, ok");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "nxt range ok");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "nxt owner name is not less");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto out;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->attributes |= VALATTR_FOUNDNONEXISTENCE;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt out: ;
420a43c8d8028992a4e9c170022f97bfac689025Evan Hunt }
420a43c8d8028992a4e9c170022f97bfac689025Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_event_free(&event);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validator_destroy(&val->authvalidator);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt LOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = nxtvalidate(val, ISC_TRUE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != DNS_R_WAIT)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNLOCK(&val->lock);
420a43c8d8028992a4e9c170022f97bfac689025Evan Hunt return;
420a43c8d8028992a4e9c170022f97bfac689025Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt free_event:
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * free stuff from the event.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_event_free(&event);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validator_destroy(&val->authvalidator);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic void
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntnegauthvalidated(isc_task_t *task, isc_event_t *event) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validatorevent_t *devent;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validator_t *val;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_t *rdataset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNUSED(task);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt devent = (dns_validatorevent_t *)event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt rdataset = devent->rdataset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val = devent->ev_arg;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3), "in negauthvalidated");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (devent->result != ISC_R_SUCCESS) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "negauthvalidated: got %s",
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_result_totext(devent->result));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, devent->result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto free_event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(val->view->mctx, rdataset, sizeof *rdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_event_free(&event);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validator_destroy(&val->authvalidator);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt LOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->attributes |= VALATTR_FOUNDNONEXISTENCE;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3), "nonexistence proof found");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, ISC_R_SUCCESS);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNLOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt free_event:
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * free stuff from the event.
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt */
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt isc_mem_put(val->view->mctx, rdataset, sizeof *rdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_event_free(&event);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validator_destroy(&val->authvalidator);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic void
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Huntnullkeyvalidated(isc_task_t *task, isc_event_t *event) {
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt dns_validatorevent_t *devent;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validator_t *val;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t result;
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt
acbb301e648b82fcc38b876a44403cf0fe539cc9Evan Hunt UNUSED(task);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt devent = (dns_validatorevent_t *)event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val = devent->ev_arg;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3), "in nullkeyvalidated");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (devent->result == ISC_R_SUCCESS) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "proved that name is in an unsecure domain");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt LOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_done(val, ISC_R_SUCCESS);
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt UNLOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt LOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = proveunsecure(val, ISC_TRUE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != DNS_R_WAIT)
80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews validator_done(val, result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt UNLOCK(&val->lock);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validator_destroy(&val->keyvalidator);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * free stuff from the event.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(val->view->mctx, devent->rdataset, sizeof(dns_rdataset_t));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(val->view->mctx, devent->sigrdataset,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt sizeof(dns_rdataset_t));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_name_free(devent->name, val->view->mctx);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(val->view->mctx, devent->name, sizeof(dns_name_t));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_event_free(&event);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt/*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * Try to find a null zone key among those in 'rdataset'. If found, build
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * a dst_key_t for it and point val->key at it.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic inline isc_boolean_t
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntcontainsnullkey(dns_validator_t *val, dns_rdataset_t *rdataset) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t result;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst_key_t *key = NULL;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_t b;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdata_t rdata;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_boolean_t found = ISC_FALSE;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dns_rdataset_first(rdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != ISC_R_SUCCESS)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_FALSE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt while (result == ISC_R_SUCCESS && !found) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_current(rdataset, &rdata);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_init(&b, rdata.data, rdata.length);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_add(&b, rdata.length);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt key = NULL;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * The key name is unimportant, so we can avoid any name/text
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * conversion.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dst_key_fromdns(dns_rootname, &b, val->view->mctx,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &key);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != ISC_R_SUCCESS)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt continue;
e20788e1216ed720aefa84f3295f7899d9f28c22Mark Andrews if (dst_key_isnullkey(key))
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt found = ISC_TRUE;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst_key_free(&key);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dns_rdataset_next(rdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (found);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt/*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * Try to find a key that could have signed 'siginfo' among those
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * in 'rdataset'. If found, build a dst_key_t for it and point
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * val->key at it.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt *
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * If val->key is non-NULL, this returns the next matching key.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic inline isc_result_t
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Huntget_dst_key(dns_validator_t *val, dns_siginfo_t *siginfo,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_t *rdataset)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt{
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t result;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_t b;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdata_t rdata;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst_key_t *oldkey = val->key;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_boolean_t foundold;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (oldkey == NULL)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt foundold = ISC_TRUE;
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt else {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt foundold = ISC_FALSE;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->key = NULL;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dns_rdataset_first(rdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != ISC_R_SUCCESS)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto failure;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt do {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_current(rdataset, &rdata);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_init(&b, rdata.data, rdata.length);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_buffer_add(&b, rdata.length);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(val->key == NULL);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dst_key_fromdns(&siginfo->signer, &b, val->view->mctx,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &val->key);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != ISC_R_SUCCESS)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt goto failure;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (siginfo->algorithm ==
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (dns_secalg_t)dst_key_alg(val->key) &&
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt siginfo->tag ==
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt (dns_keytag_t)dst_key_id(val->key) &&
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst_key_iszonekey(val->key))
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (foundold)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * This is the key we're looking for.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_SUCCESS);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt else if (dst_key_compare(oldkey, val->key) == ISC_TRUE)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt foundold = ISC_TRUE;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst_key_free(&oldkey);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt dst_key_free(&val->key);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dns_rdataset_next(rdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } while (result == ISC_R_SUCCESS);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result == ISC_R_NOMORE)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = ISC_R_NOTFOUND;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt failure:
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (oldkey != NULL)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst_key_free(&oldkey);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt}
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Huntstatic inline isc_result_t
1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Huntget_key(dns_validator_t *val, dns_siginfo_t *siginfo) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_t result;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_validatorevent_t *event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt unsigned int nbits, nlabels;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt int order;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_namereln_t namereln;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_t rdataset, sigrdataset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt event = val->event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * Is the key name appropriate for this signature?
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt namereln = dns_name_fullcompare(event->name, &siginfo->signer,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &order, &nlabels, &nbits);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (event->rdataset->type == dns_rdatatype_key &&
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt namereln != dns_namereln_subdomain) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt * We don't want a KEY RR to authenticate
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * itself, so we ignore the signature if it
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * was not made by an ancestor of the KEY.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (DNS_R_CONTINUE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else if (namereln != dns_namereln_subdomain &&
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt namereln != dns_namereln_equal) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * The key name is not at the same level
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * as 'rdataset', nor is it closer to the
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * DNS root.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (DNS_R_CONTINUE);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * Is the key used for the signature a security root?
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt INSIST(val->keynode == NULL);
80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews val->keytable = val->view->secroots;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dns_keytable_findkeynode(val->view->secroots,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &siginfo->signer,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt siginfo->algorithm, siginfo->tag,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &val->keynode);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result == ISC_R_SUCCESS) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * The key is a security root.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->key = dns_keynode_key(val->keynode);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_SUCCESS);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * Do we know about this key?
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_init(&rdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_init(&sigrdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dns_view_simplefind(val->view, &siginfo->signer,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdatatype_key, 0,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt DNS_DBFIND_PENDINGOK, ISC_FALSE,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &rdataset, &sigrdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result == ISC_R_SUCCESS) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * We have an rrset for the given keyname.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (rdataset.trust == dns_trust_pending &&
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_isassociated(&sigrdataset))
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt {
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt /*
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt * We know the key but haven't validated it yet.
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt */
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt dns_rdataset_t *frdataset, *fsigrdataset;
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt frdataset = isc_mem_get(val->view->mctx,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt sizeof *frdataset);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt if (frdataset == NULL)
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt return (ISC_R_NOMEMORY);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt fsigrdataset = isc_mem_get(val->view->mctx,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt sizeof *fsigrdataset);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt if (fsigrdataset == NULL) {
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt isc_mem_put(val->view->mctx, frdataset,
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt sizeof *frdataset);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt return (ISC_R_NOMEMORY);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt }
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt dns_rdataset_init(frdataset);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt dns_rdataset_init(fsigrdataset);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt dns_rdataset_clone(&rdataset, frdataset);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt dns_rdataset_clone(&sigrdataset, fsigrdataset);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt result = dns_validator_create(val->view,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt &siginfo->signer,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt dns_rdatatype_key,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt frdataset,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt fsigrdataset,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt NULL,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt 0,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt val->task,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt keyvalidated,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt val,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt &val->keyvalidator);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt if (result != ISC_R_SUCCESS)
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt return (result);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt return (DNS_R_WAIT);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt } else if (rdataset.trust == dns_trust_pending) {
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt /*
1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt * Having a pending key with no signature means that
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt * something is broken.
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt */
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt result = DNS_R_CONTINUE;
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt } else if (rdataset.trust < dns_trust_secure) {
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt /*
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt * The key is legitimately insecure. There's no
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt * point in even attempting verification.
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt */
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt val->key = NULL;
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt result = ISC_R_SUCCESS;
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt } else {
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt /*
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt * See if we've got the key used in the signature.
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt */
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt "keyset with trust %d", rdataset.trust);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt result = get_dst_key(val, siginfo, &rdataset);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt if (result != ISC_R_SUCCESS) {
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt /*
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt * Either the key we're looking for is not
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt * in the rrset, or something bad happened.
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt * Give up.
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt */
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt result = DNS_R_CONTINUE;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else if (result == ISC_R_NOTFOUND) {
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * We don't know anything about this key.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_t *frdataset, *fsigrdataset;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt frdataset = isc_mem_get(val->view->mctx, sizeof *frdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (frdataset == NULL)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_NOMEMORY);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt fsigrdataset = isc_mem_get(val->view->mctx,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt sizeof *fsigrdataset);
6972eaffdbb7bb83c1b8565adfc6778430f80c8cFrancis Dupont if (fsigrdataset == NULL) {
6972eaffdbb7bb83c1b8565adfc6778430f80c8cFrancis Dupont isc_mem_put(val->view->mctx, frdataset,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt sizeof *frdataset);
6972eaffdbb7bb83c1b8565adfc6778430f80c8cFrancis Dupont return (ISC_R_NOMEMORY);
6972eaffdbb7bb83c1b8565adfc6778430f80c8cFrancis Dupont }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_init(frdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_init(fsigrdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->fetch = NULL;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dns_resolver_createfetch(val->view->resolver,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &siginfo->signer,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdatatype_key,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt NULL, NULL, NULL, 0,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->event->ev_sender,
1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt fetch_callback_validator,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt frdataset,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt fsigrdataset,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt &val->fetch);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != ISC_R_SUCCESS)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (DNS_R_WAIT);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else if (result == DNS_R_NCACHENXDOMAIN ||
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result == DNS_R_NCACHENXRRSET ||
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result == DNS_R_NXDOMAIN ||
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result == DNS_R_NXRRSET)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * This key doesn't exist.
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = DNS_R_CONTINUE;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (dns_rdataset_isassociated(&rdataset))
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_disassociate(&rdataset);
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt if (dns_rdataset_isassociated(&sigrdataset))
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_rdataset_disassociate(&sigrdataset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (result);
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt}
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt/*
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * Attempts positive response validation.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt *
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * Returns:
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * ISC_R_SUCCESS Validation completed successfully
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * DNS_R_WAIT Validation has started but is waiting
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt * for an event.
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt * Other return codes are possible and all indicate failure.
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt */
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Huntstatic inline isc_result_t
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Huntvalidate(dns_validator_t *val, isc_boolean_t resume) {
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt isc_result_t result;
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt dns_validatorevent_t *event;
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt dns_rdata_t rdata;
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt /*
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt * Caller must be holding the validator lock.
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt */
3249da26fc28297265d444a1f3647f1e6700a2a0Evan Hunt
6972eaffdbb7bb83c1b8565adfc6778430f80c8cFrancis Dupont event = val->event;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt if (resume) {
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt /*
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt * We already have a sigrdataset.
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt */
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt result = ISC_R_SUCCESS;
1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt validator_log(val, ISC_LOG_DEBUG(3), "resuming validate");
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt } else {
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt result = dns_rdataset_first(event->sigrdataset);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt }
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt for (;
420a43c8d8028992a4e9c170022f97bfac689025Evan Hunt result == ISC_R_SUCCESS;
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt result = dns_rdataset_next(event->sigrdataset))
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt {
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt dns_rdataset_current(event->sigrdataset, &rdata);
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt if (val->siginfo != NULL)
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt isc_mem_put(val->view->mctx, val->siginfo,
12bf5d4796505b4c20680531da96a31e6c2c1144Evan Hunt sizeof *val->siginfo);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->siginfo = isc_mem_get(val->view->mctx,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt sizeof *val->siginfo);
dbb012765c735ee0d82dedb116cdc7cf18957814Evan Hunt if (val->siginfo == NULL)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_NOMEMORY);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt rdata_to_siginfo(&rdata, val->siginfo);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt /*
80169c379dd4e0a6e164b7cac4bf5fa013c91138Mark Andrews * At this point we could check that the signature algorithm
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * was known and "sufficiently good". For now, any algorithm
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt * is acceptable.
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (!resume) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = get_key(val, val->siginfo);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result == DNS_R_CONTINUE)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt continue; /* Try the next SIG RR. */
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != ISC_R_SUCCESS)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (val->key == NULL) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt event->rdataset->trust = dns_trust_answer;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt event->sigrdataset->trust = dns_trust_answer;
1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "marking as answer");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (ISC_R_SUCCESS);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt do {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dns_dnssec_verify(event->name,
1b255a0c4eaccf0feff70328a8c108a22abfbf3cEvan Hunt event->rdataset,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->key, ISC_FALSE,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->view->mctx, &rdata);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "verify rdataset: %s",
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_totext(result));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result == ISC_R_SUCCESS)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt break;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (val->keynode != NULL) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_keynode_t *nextnode = NULL;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt result = dns_keytable_findnextkeynode(
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->keytable,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->keynode,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &nextnode);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_keytable_detachkeynode(val->keytable,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &val->keynode);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->keynode = nextnode;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != ISC_R_SUCCESS) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->key = NULL;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt break;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->key = dns_keynode_key(val->keynode);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } else {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (get_dst_key(val, val->siginfo, val->keyset)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt != ISC_R_SUCCESS)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt break;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt } while (1);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result != ISC_R_SUCCESS)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "failed to verify rdataset");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (val->keynode != NULL)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dns_keytable_detachkeynode(val->keytable,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt &val->keynode);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt else {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (val->key != NULL)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt dst_key_free(&val->key);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (val->keyset != NULL)
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_mem_put(val->view->mctx, val->keyset,
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt sizeof *val->keyset);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->keyset = NULL;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt val->key = NULL;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt if (result == ISC_R_SUCCESS) {
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt event->rdataset->trust = dns_trust_secure;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt event->sigrdataset->trust = dns_trust_secure;
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "marking as secure");
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt return (result);
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt else
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt validator_log(val, ISC_LOG_DEBUG(3),
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt "verify failure: %s",
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt isc_result_totext(result));
ba751492fcc4f161a18b983d4f018a1a52938cb9Evan Hunt }
INSIST(result == ISC_R_NOMORE);
validator_log(val, ISC_LOG_INFO, "no valid signature found");
return (DNS_R_NOVALIDSIG);
}
static inline isc_result_t
nxtvalidate(dns_validator_t *val, isc_boolean_t resume) {
dns_name_t *name;
dns_message_t *message = val->event->message;
isc_result_t result;
if (!resume) {
result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
if (result != ISC_R_SUCCESS)
validator_done(val, ISC_R_NOTFOUND);
} else {
result = ISC_R_SUCCESS;
validator_log(val, ISC_LOG_DEBUG(3), "resuming nxtvalidate");
}
for (;
result == ISC_R_SUCCESS;
result = dns_message_nextname(message, DNS_SECTION_AUTHORITY))
{
dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
name = NULL;
dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
if (resume) {
rdataset = ISC_LIST_NEXT(val->currentset, link);
val->currentset = NULL;
resume = ISC_FALSE;
}
else {
for (rdataset = ISC_LIST_HEAD(name->list);
rdataset != NULL;
rdataset = ISC_LIST_NEXT(rdataset, link))
rdataset->trust = dns_trust_pending;
rdataset = ISC_LIST_HEAD(name->list);
}
for (;
rdataset != NULL;
rdataset = ISC_LIST_NEXT(rdataset, link))
{
if (rdataset->type == dns_rdatatype_sig)
continue;
for (sigrdataset = ISC_LIST_HEAD(name->list);
sigrdataset != NULL;
sigrdataset = ISC_LIST_NEXT(sigrdataset,
link))
{
if (sigrdataset->type == dns_rdatatype_sig &&
sigrdataset->covers == rdataset->type)
break;
}
if (sigrdataset == NULL)
continue;
val->seensig = ISC_TRUE;
val->authvalidator = NULL;
val->currentset = rdataset;
result = dns_validator_create(val->view, name,
rdataset->type,
rdataset,
sigrdataset,
NULL, 0,
val->task,
authvalidated,
val,
&val->authvalidator);
if (result != ISC_R_SUCCESS)
return (result);
return (DNS_R_WAIT);
}
}
if (result == ISC_R_NOMORE)
result = ISC_R_SUCCESS;
if (result != ISC_R_SUCCESS)
validator_done(val, result);
if ((val->attributes & VALATTR_FOUNDNONEXISTENCE) == 0) {
if (!val->seensig) {
dns_rdataset_t *rdataset;
rdataset = isc_mem_get(val->view->mctx,
sizeof(dns_rdataset_t));
if (rdataset == NULL)
return (ISC_R_NOMEMORY);
dns_rdataset_init(rdataset);
result = dns_validator_create(val->view, name,
dns_rdatatype_soa,
rdataset,
NULL, NULL, 0,
val->task,
negauthvalidated,
val,
&val->authvalidator);
if (result != ISC_R_SUCCESS)
return (result);
return (DNS_R_WAIT);
}
validator_log(val, ISC_LOG_DEBUG(3),
"nonexistence proof not found");
return (DNS_R_NOVALIDNXT);
} else {
validator_log(val, ISC_LOG_DEBUG(3),
"nonexistence proof found");
return (ISC_R_SUCCESS);
}
}
static inline isc_result_t
proveunsecure(dns_validator_t *val, isc_boolean_t resume) {
isc_result_t result;
dns_fixedname_t secroot, tfname;
dns_name_t *tname;
dns_fixedname_init(&secroot);
dns_fixedname_init(&tfname);
result = dns_keytable_finddeepestmatch(val->view->secroots,
val->event->name,
dns_fixedname_name(&secroot));
if (result != ISC_R_SUCCESS)
return (result);
if (!resume)
val->labels = dns_name_depth(dns_fixedname_name(&secroot)) + 1;
else {
validator_log(val, ISC_LOG_DEBUG(3), "resuming proveunsecure");
val->labels++;
}
for (;
val->labels <= dns_name_depth(val->event->name);
val->labels++)
{
dns_rdataset_t rdataset, sigrdataset;
if (val->labels == dns_name_depth(val->event->name)) {
if (val->event->type == dns_rdatatype_key)
break;
tname = val->event->name;
} else {
tname = dns_fixedname_name(&tfname);
result = dns_name_splitatdepth(val->event->name,
val->labels,
NULL, tname);
if (result != ISC_R_SUCCESS)
return (result);
}
dns_rdataset_init(&rdataset);
dns_rdataset_init(&sigrdataset);
result = dns_view_simplefind(val->view, tname,
dns_rdatatype_key, 0,
DNS_DBFIND_PENDINGOK, ISC_FALSE,
&rdataset, &sigrdataset);
if (result == ISC_R_SUCCESS) {
dns_rdataset_t *frdataset = NULL, *fsigrdataset = NULL;
dns_name_t *fname = NULL;
if (!dns_rdataset_isassociated(&sigrdataset))
return (DNS_R_NOTINSECURE);
validator_log(val, ISC_LOG_DEBUG(3),
"found keyset, looking for null key");
if (!containsnullkey(val, &rdataset))
continue;
if (rdataset.trust >= dns_trust_secure) {
validator_log(val, ISC_LOG_DEBUG(3),
"insecurity proof succeeded");
val->event->rdataset->trust = dns_trust_answer;
return (ISC_R_SUCCESS);
}
frdataset = isc_mem_get(val->view->mctx,
sizeof *frdataset);
if (frdataset == NULL)
return (ISC_R_NOMEMORY);
fsigrdataset = isc_mem_get(val->view->mctx,
sizeof *fsigrdataset);
if (fsigrdataset == NULL) {
isc_mem_put(val->view->mctx, frdataset,
sizeof *frdataset);
return (ISC_R_NOMEMORY);
}
fname = isc_mem_get(val->view->mctx, sizeof *fname);
if (fname == NULL) {
isc_mem_put(val->view->mctx, fsigrdataset,
sizeof *frdataset);
isc_mem_put(val->view->mctx, frdataset,
sizeof *fsigrdataset);
return (ISC_R_NOMEMORY);
}
dns_name_init(fname, NULL);
result = dns_name_dup(tname, val->view->mctx, fname);
if (result != ISC_R_SUCCESS) {
isc_mem_put(val->view->mctx, fsigrdataset,
sizeof *frdataset);
isc_mem_put(val->view->mctx, frdataset,
sizeof *fsigrdataset);
isc_mem_put(val->view->mctx, fname,
sizeof *fname);
return (ISC_R_NOMEMORY);
}
dns_rdataset_init(frdataset);
dns_rdataset_init(fsigrdataset);
dns_rdataset_clone(&rdataset, frdataset);
dns_rdataset_clone(&sigrdataset, fsigrdataset);
result = dns_validator_create(val->view,
fname,
dns_rdatatype_key,
frdataset,
fsigrdataset,
NULL,
0,
val->task,
nullkeyvalidated,
val,
&val->keyvalidator);
return (DNS_R_WAIT);
} else if (result == ISC_R_NOTFOUND) {
dns_rdataset_t *frdataset = NULL, *fsigrdataset = NULL;
frdataset = isc_mem_get(val->view->mctx,
sizeof *frdataset);
if (frdataset == NULL)
return (ISC_R_NOMEMORY);
fsigrdataset = isc_mem_get(val->view->mctx,
sizeof *fsigrdataset);
if (fsigrdataset == NULL) {
isc_mem_put(val->view->mctx, frdataset,
sizeof *frdataset);
return (ISC_R_NOMEMORY);
}
dns_rdataset_init(frdataset);
dns_rdataset_init(fsigrdataset);
val->fetch = NULL;
result = dns_resolver_createfetch(val->view->resolver,
tname,
dns_rdatatype_key,
NULL, NULL, NULL, 0,
val->event->ev_sender,
fetch_callback_nullkey,
val, frdataset,
fsigrdataset,
&val->fetch);
if (result != ISC_R_SUCCESS)
return (result);
return (DNS_R_WAIT);
} else if (result == DNS_R_NCACHENXDOMAIN ||
result == DNS_R_NCACHENXRRSET ||
result == DNS_R_NXDOMAIN ||
result == DNS_R_NXRRSET)
{
continue;
} else
return (result);
}
validator_log(val, ISC_LOG_DEBUG(3), "insecurity proof failed");
return (DNS_R_NOTINSECURE); /* Didn't find a null key */
}
static void
validator_start(isc_task_t *task, isc_event_t *event) {
dns_validator_t *val;
dns_validatorevent_t *vevent;
isc_result_t result = ISC_R_FAILURE;
UNUSED(task);
REQUIRE(event->ev_type == DNS_EVENT_VALIDATORSTART);
vevent = (dns_validatorevent_t *)event;
val = vevent->validator;
validator_log(val, ISC_LOG_DEBUG(3), "starting");
LOCK(&val->lock);
if (val->event->rdataset != NULL && val->event->sigrdataset != NULL) {
/*
* This looks like a simple validation. We say "looks like"
* because we don't know if wildcards are involved yet so it
* could still get complicated.
*/
validator_log(val, ISC_LOG_DEBUG(3),
"attempting positive response validation");
result = validate(val, ISC_FALSE);
} else if (val->event->rdataset != NULL) {
/*
* This is either an unsecure subdomain or a response from
* a broken server.
*/
validator_log(val, ISC_LOG_DEBUG(3),
"attempting insecurity proof");
result = proveunsecure(val, ISC_FALSE);
} else if (val->event->rdataset == NULL &&
val->event->sigrdataset == NULL)
{
/*
* This is a nonexistence validation.
*/
validator_log(val, ISC_LOG_DEBUG(3),
"attempting negative response validation");
result = nxtvalidate(val, ISC_FALSE);
} else {
/*
* This shouldn't happen.
*/
INSIST(0);
}
if (result != DNS_R_WAIT)
validator_done(val, result);
UNLOCK(&val->lock);
}
isc_result_t
dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
dns_message_t *message, unsigned int options,
isc_task_t *task, isc_taskaction_t action, void *arg,
dns_validator_t **validatorp)
{
isc_result_t result;
dns_validator_t *val;
isc_task_t *tclone;
dns_validatorevent_t *event;
REQUIRE(name != NULL);
REQUIRE(type != 0);
REQUIRE(rdataset != NULL ||
(rdataset == NULL && sigrdataset == NULL && message != NULL));
REQUIRE(options == 0);
REQUIRE(validatorp != NULL && *validatorp == NULL);
tclone = NULL;
result = ISC_R_FAILURE;
val = isc_mem_get(view->mctx, sizeof *val);
if (val == NULL)
return (ISC_R_NOMEMORY);
val->view = NULL;
dns_view_attach(view, &val->view);
event = (dns_validatorevent_t *)
isc_event_allocate(view->mctx, task,
DNS_EVENT_VALIDATORSTART,
validator_start, NULL,
sizeof (dns_validatorevent_t));
if (event == NULL) {
result = ISC_R_NOMEMORY;
goto cleanup_val;
}
isc_task_attach(task, &tclone);
event->validator = val;
event->result = ISC_R_FAILURE;
event->name = name;
event->type = type;
event->rdataset = rdataset;
event->sigrdataset = sigrdataset;
event->message = message;
result = isc_mutex_init(&val->lock);
if (result != ISC_R_SUCCESS)
goto cleanup_event;
val->event = event;
val->options = options;
val->attributes = 0;
val->fetch = NULL;
val->keyvalidator = NULL;
val->authvalidator = NULL;
val->keynode = NULL;
val->key = NULL;
val->siginfo = NULL;
val->task = task;
val->action = action;
val->arg = arg;
val->labels = 0;
val->currentset = NULL;
val->keyset = NULL;
val->seensig = ISC_FALSE;
val->magic = VALIDATOR_MAGIC;
isc_task_send(task, (isc_event_t **)&event);
*validatorp = val;
return (ISC_R_SUCCESS);
cleanup_event:
isc_task_detach(&tclone);
isc_event_free((isc_event_t **)&val->event);
cleanup_val:
dns_view_detach(&val->view);
isc_mem_put(view->mctx, val, sizeof *val);
return (result);
}
void
dns_validator_cancel(dns_validator_t *validator) {
isc_task_t *task;
REQUIRE(VALID_VALIDATOR(validator));
LOCK(&validator->lock);
if (validator->event != NULL) {
validator->event->result = ISC_R_CANCELED;
task = validator->event->ev_sender;
validator->event->ev_sender = validator;
isc_task_sendanddetach(&task,
(isc_event_t **)&validator->event);
if (validator->fetch != NULL)
dns_resolver_cancelfetch(validator->fetch);
if (validator->keyvalidator != NULL)
dns_validator_cancel(validator->keyvalidator);
}
UNLOCK(&validator->lock);
}
static void
destroy(dns_validator_t *val) {
isc_mem_t *mctx;
REQUIRE(SHUTDOWN(val));
REQUIRE(val->event == NULL);
REQUIRE(val->fetch == NULL);
#if 0
REQUIRE(val->currentset == NULL);
#endif
if (val->keynode != NULL)
dns_keytable_detachkeynode(val->keytable, &val->keynode);
else if (val->key != NULL)
dst_key_free(&val->key);
if (val->keyvalidator != NULL)
dns_validator_destroy(&val->keyvalidator);
mctx = val->view->mctx;
if (val->siginfo != NULL)
isc_mem_put(mctx, val->siginfo, sizeof *val->siginfo);
isc_mutex_destroy(&val->lock);
dns_view_detach(&val->view);
val->magic = 0;
isc_mem_put(mctx, val, sizeof *val);
}
void
dns_validator_destroy(dns_validator_t **validatorp) {
dns_validator_t *val;
isc_boolean_t want_destroy = ISC_FALSE;
REQUIRE(validatorp != NULL);
val = *validatorp;
REQUIRE(VALID_VALIDATOR(val));
LOCK(&val->lock);
REQUIRE(val->event == NULL);
val->attributes |= VALATTR_SHUTDOWN;
if (val->fetch == NULL)
want_destroy = ISC_TRUE;
UNLOCK(&val->lock);
if (want_destroy)
destroy(val);
*validatorp = NULL;
}
static void
validator_logv(dns_validator_t *val, isc_logcategory_t *category,
isc_logmodule_t *module, int level, const char *fmt, va_list ap)
{
char msgbuf[2048];
vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
if (val->event != NULL && val->event->name != NULL) {
char namebuf[1024];
char typebuf[256];
isc_buffer_t b;
isc_region_t r;
dns_name_format(val->event->name, namebuf, sizeof(namebuf));
isc_buffer_init(&b, (unsigned char *)typebuf, sizeof(typebuf));
if (dns_rdatatype_totext(val->event->type, &b)
!= ISC_R_SUCCESS)
{
isc_buffer_clear(&b);
isc_buffer_putstr(&b, "<bad type>");
}
isc_buffer_usedregion(&b, &r);
isc_log_write(dns_lctx, category, module, level,
"validating %s %.*s: %s", namebuf,
(int)r.length, (char *)r.base, msgbuf);
} else {
isc_log_write(dns_lctx, category, module, level,
"validator @%p: %s", val, msgbuf);
}
}
static void
validator_log(dns_validator_t *val, int level, const char *fmt, ...)
{
va_list ap;
va_start(ap, fmt);
validator_logv(val, DNS_LOGCATEGORY_DNSSEC,
DNS_LOGMODULE_VALIDATOR, level, fmt, ap);
va_end(ap);
}