validator.c revision 60783293cc27f74a84ec93c95c5d46edd30bd8e0
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley/*
a7038d1a0513c8e804937ebc95fc9cb3a46c04f5Mark Andrews * Copyright (C) 2000 Internet Software Consortium.
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence *
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * Permission to use, copy, modify, and distribute this software for any
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * purpose with or without fee is hereby granted, provided that the above
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * copyright notice and this permission notice appear in all copies.
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence *
15a44745412679c30a6d022733925af70a38b715David Lawrence * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
15a44745412679c30a6d022733925af70a38b715David Lawrence * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
15a44745412679c30a6d022733925af70a38b715David Lawrence * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
15a44745412679c30a6d022733925af70a38b715David Lawrence * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
15a44745412679c30a6d022733925af70a38b715David Lawrence * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
15a44745412679c30a6d022733925af70a38b715David Lawrence * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
15a44745412679c30a6d022733925af70a38b715David Lawrence * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
15a44745412679c30a6d022733925af70a38b715David Lawrence * SOFTWARE.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
80b782f356f0692c11b4e52e8dd46ec41704e5a2Mark Andrews/* $Id: validator.c,v 1.66 2000/07/25 01:24:18 bwelling Exp $ */
9c3531d72aeaad6c5f01efe6a1c82023e1379e4dDavid Lawrence
110d1702731f42dd620879c1d765ebe91f3920ceMichael Graff#include <config.h>
110d1702731f42dd620879c1d765ebe91f3920ceMichael Graff
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley#include <isc/mem.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <isc/print.h>
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence#include <isc/task.h>
def8e47c688e2480a4539d69c3d1a0a28a7c0550Mark Andrews#include <isc/util.h>
364a82f7c25b62967678027043425201a5e5171aBob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <dns/db.h>
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence#include <dns/dnssec.h>
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley#include <dns/events.h>
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley#include <dns/keytable.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <dns/log.h>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews#include <dns/message.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <dns/nxt.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <dns/rdata.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <dns/rdatastruct.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <dns/rdataset.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <dns/rdatatype.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <dns/resolver.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <dns/result.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <dns/validator.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#include <dns/view.h>
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
078d49b63324f01d98301ee21671abee0c41fcdeBob Halleystruct dns_validator {
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley /* Unlocked. */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley unsigned int magic;
904a5734375869ffb504ed8cde6b68cafadb6d64Bob Halley isc_mutex_t lock;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley dns_view_t * view;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley /* Locked by lock. */
ca67883a666bdf314d3da958d5195e7215b1f797Bob Halley unsigned int options;
732e0731dec1922747bb3b3147cf2c3d16b22eaaBob Halley unsigned int attributes;
b12f0228b32775ee688ed21ddbf3a116c1adfb43Michael Graff dns_validatorevent_t * event;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley dns_fetch_t * fetch;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley dns_validator_t * keyvalidator;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley dns_validator_t * authvalidator;
80b782f356f0692c11b4e52e8dd46ec41704e5a2Mark Andrews dns_keytable_t * keytable;
e496615043400500492fa7b891c515c8e7cb7d08Bob Halley dns_keynode_t * keynode;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley dst_key_t * key;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley dns_rdata_sig_t * siginfo;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley isc_task_t * task;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley isc_taskaction_t action;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley void * arg;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley unsigned int labels;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley dns_rdataset_t * currentset;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley isc_boolean_t seensig;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley dns_rdataset_t * keyset;
078d49b63324f01d98301ee21671abee0c41fcdeBob Halley dns_rdataset_t frdataset;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley dns_rdataset_t fsigrdataset;
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence};
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#define VALIDATOR_MAGIC 0x56616c3fU /* Val?. */
904a5734375869ffb504ed8cde6b68cafadb6d64Bob Halley#define VALID_VALIDATOR(v) ISC_MAGIC_VALID(v, VALIDATOR_MAGIC)
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley#define VALATTR_SHUTDOWN 0x01
ca67883a666bdf314d3da958d5195e7215b1f797Bob Halley#define VALATTR_FOUNDNONEXISTENCE 0x02
732e0731dec1922747bb3b3147cf2c3d16b22eaaBob Halley#define VALATTR_TRIEDVERIFY 0x04
b12f0228b32775ee688ed21ddbf3a116c1adfb43Michael Graff#define SHUTDOWN(v) (((v)->attributes & VALATTR_SHUTDOWN) != 0)
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleystatic void
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleynullkeyvalidated(isc_task_t *task, isc_event_t *event);
80b782f356f0692c11b4e52e8dd46ec41704e5a2Mark Andrews
e496615043400500492fa7b891c515c8e7cb7d08Bob Halleystatic inline isc_boolean_t
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleycontainsnullkey(dns_validator_t *val, dns_rdataset_t *rdataset);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleystatic inline isc_result_t
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleyget_dst_key(dns_validator_t *val, dns_rdata_sig_t *siginfo,
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley dns_rdataset_t *rdataset);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
2cd0c38115b1efb043ed3104c0d08e51ceade0d7Bob Halleystatic inline isc_result_t
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleyvalidate(dns_validator_t *val, isc_boolean_t resume);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
078d49b63324f01d98301ee21671abee0c41fcdeBob Halleystatic inline isc_result_t
0180ccf72c79b98eb8ee5abbb7331aec6951dd9fBob Halleynxtvalidate(dns_validator_t *val, isc_boolean_t resume);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleystatic inline isc_result_t
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleyproveunsecure(dns_validator_t *val, isc_boolean_t resume);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
904a5734375869ffb504ed8cde6b68cafadb6d64Bob Halleystatic void
5619558151f1aa4249b3ead979e76876e29278b6Bob Halleyvalidator_log(dns_validator_t *val, int level, const char *fmt, ...);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
ca67883a666bdf314d3da958d5195e7215b1f797Bob Halleystatic void
732e0731dec1922747bb3b3147cf2c3d16b22eaaBob Halleyvalidator_done(dns_validator_t *val, isc_result_t result) {
b12f0228b32775ee688ed21ddbf3a116c1adfb43Michael Graff isc_task_t *task;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley REQUIRE(val->event != NULL);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
80b782f356f0692c11b4e52e8dd46ec41704e5a2Mark Andrews /*
e496615043400500492fa7b891c515c8e7cb7d08Bob Halley * Caller must be holding the lock.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
28640d1da26d561f4137122fe64e9e8cc08bf11eBob Halley val->event->result = result;
28640d1da26d561f4137122fe64e9e8cc08bf11eBob Halley task = val->event->ev_sender;
28640d1da26d561f4137122fe64e9e8cc08bf11eBob Halley val->event->ev_sender = val;
28640d1da26d561f4137122fe64e9e8cc08bf11eBob Halley val->event->ev_type = DNS_EVENT_VALIDATORDONE;
28640d1da26d561f4137122fe64e9e8cc08bf11eBob Halley val->event->ev_action = val->action;
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence val->event->ev_arg = val->arg;
28640d1da26d561f4137122fe64e9e8cc08bf11eBob Halley isc_task_sendanddetach(&task, (isc_event_t **)&val->event);
28640d1da26d561f4137122fe64e9e8cc08bf11eBob Halley
28640d1da26d561f4137122fe64e9e8cc08bf11eBob Halley}
28640d1da26d561f4137122fe64e9e8cc08bf11eBob Halley
28640d1da26d561f4137122fe64e9e8cc08bf11eBob Halleystatic void
28640d1da26d561f4137122fe64e9e8cc08bf11eBob Halleyfetch_callback_validator(isc_task_t *task, isc_event_t *event) {
28640d1da26d561f4137122fe64e9e8cc08bf11eBob Halley dns_fetchevent_t *devent;
28640d1da26d561f4137122fe64e9e8cc08bf11eBob Halley dns_validator_t *val;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley dns_rdataset_t *rdataset;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley isc_result_t result;
e02884167b7c969b56413f76c48c3802c4dca14dAndreas Gustafsson isc_result_t eresult;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley UNUSED(task);
3ddd814a97de1d152ba0913c592d6e6dc83d38a6Michael Graff INSIST(event->ev_type == DNS_EVENT_FETCHDONE);
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley devent = (dns_fetchevent_t *)event;
e02884167b7c969b56413f76c48c3802c4dca14dAndreas Gustafsson val = devent->ev_arg;
e02884167b7c969b56413f76c48c3802c4dca14dAndreas Gustafsson rdataset = &val->frdataset;
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff eresult = devent->result;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley isc_event_free(&event);
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley dns_resolver_destroyfetch(&val->fetch);
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley validator_log(val, ISC_LOG_DEBUG(3), "in fetch_callback_validator");
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley LOCK(&val->lock);
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley if (eresult == ISC_R_SUCCESS) {
e02884167b7c969b56413f76c48c3802c4dca14dAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),
e02884167b7c969b56413f76c48c3802c4dca14dAndreas Gustafsson "keyset with trust %d", rdataset->trust);
e02884167b7c969b56413f76c48c3802c4dca14dAndreas Gustafsson /*
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley * Only extract the dst key if the keyset is secure.
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley */
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley if (rdataset->trust >= dns_trust_secure) {
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley result = get_dst_key(val, val->siginfo, rdataset);
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley if (result == ISC_R_SUCCESS)
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley val->keyset = &val->frdataset;
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley }
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley result = validate(val, ISC_TRUE);
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley if (result != DNS_R_WAIT) {
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley validator_done(val, result);
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley goto out;
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley }
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley } else {
e02884167b7c969b56413f76c48c3802c4dca14dAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley "fetch_callback_validator: got %s",
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley dns_result_totext(eresult));
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley validator_done(val, eresult);
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley }
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley out:
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley UNLOCK(&val->lock);
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley /*
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley * Free stuff from the event.
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley */
732e0731dec1922747bb3b3147cf2c3d16b22eaaBob Halley if (dns_rdataset_isassociated(&val->frdataset) &&
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley val->keyset != &val->frdataset)
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley dns_rdataset_disassociate(&val->frdataset);
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley if (dns_rdataset_isassociated(&val->fsigrdataset))
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley dns_rdataset_disassociate(&val->fsigrdataset);
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley}
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halleystatic void
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halleyfetch_callback_nullkey(isc_task_t *task, isc_event_t *event) {
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley dns_fetchevent_t *devent;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley dns_validator_t *val;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley dns_rdataset_t *rdataset, *sigrdataset;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley dns_fetch_t *fetch;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley isc_result_t result;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley isc_result_t eresult;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley UNUSED(task);
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley INSIST(event->ev_type == DNS_EVENT_FETCHDONE);
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley devent = (dns_fetchevent_t *)event;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley val = devent->ev_arg;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley rdataset = &val->frdataset;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley sigrdataset = &val->fsigrdataset;
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley eresult = devent->result;
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley validator_log(val, ISC_LOG_DEBUG(3), "in fetch_callback_nullkey");
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley fetch = val->fetch;
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley val->fetch = NULL;
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley LOCK(&val->lock);
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley if (eresult == ISC_R_SUCCESS) {
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley if (!containsnullkey(val, rdataset)) {
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley /*
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley * No null key.
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley */
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley validator_log(val, ISC_LOG_DEBUG(3),
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley "found a keyset, no null key");
7837d146219db7a85a4b444a9cdf6602254a4f75Bob Halley result = proveunsecure(val, ISC_TRUE);
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley if (result != DNS_R_WAIT)
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley validator_done(val, result);
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley } else {
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley validator_log(val, ISC_LOG_DEBUG(3),
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley "found a keyset with a null key");
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley if (rdataset->trust >= dns_trust_secure) {
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley validator_log(val, ISC_LOG_DEBUG(3),
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley "insecurity proof succeeded");
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley val->event->rdataset->trust = dns_trust_answer;
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley validator_done(val, ISC_R_SUCCESS);
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley } else if (!dns_rdataset_isassociated(sigrdataset)) {
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence validator_log(val, ISC_LOG_DEBUG(3),
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley "insecurity proof failed");
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley validator_done(val, DNS_R_NOTINSECURE);
1c724c986de1449e3b2f1eeae4c724dc0d97603cBob Halley } else {
3ddd814a97de1d152ba0913c592d6e6dc83d38a6Michael Graff dns_name_t *tname;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley tname = dns_fixedname_name(&devent->foundname);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley result = dns_validator_create(val->view, tname,
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley dns_rdatatype_key,
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley rdataset,
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley sigrdataset, NULL,
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley 0, val->task,
078d49b63324f01d98301ee21671abee0c41fcdeBob Halley nullkeyvalidated,
0180ccf72c79b98eb8ee5abbb7331aec6951dd9fBob Halley val,
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley &val->keyvalidator);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley if (result != ISC_R_SUCCESS)
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley validator_done(val, result);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley /*
3ddd814a97de1d152ba0913c592d6e6dc83d38a6Michael Graff * Don't free these, since they'll be
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * freed in nullkeyvalidated.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley dns_resolver_destroyfetch(&fetch);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley isc_event_free(&event);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley UNLOCK(&val->lock);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley return;
078d49b63324f01d98301ee21671abee0c41fcdeBob Halley }
0180ccf72c79b98eb8ee5abbb7331aec6951dd9fBob Halley }
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley } else if (eresult == DNS_R_NCACHENXDOMAIN ||
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley eresult == DNS_R_NCACHENXRRSET ||
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley eresult == DNS_R_NXDOMAIN ||
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley eresult == DNS_R_NXRRSET)
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley {
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley /*
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * No keys.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley validator_log(val, ISC_LOG_DEBUG(3),
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley "no keys found");
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley result = proveunsecure(val, ISC_TRUE);
078d49b63324f01d98301ee21671abee0c41fcdeBob Halley if (result != DNS_R_WAIT)
0180ccf72c79b98eb8ee5abbb7331aec6951dd9fBob Halley validator_done(val, result);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley } else {
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley validator_log(val, ISC_LOG_DEBUG(3),
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley "fetch_callback_nullkey: got %s",
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley dns_result_totext(eresult));
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley validator_done(val, eresult);
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley }
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews UNLOCK(&val->lock);
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson dns_resolver_destroyfetch(&fetch);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson /*
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson * Free stuff from the event.
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson */
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson if (dns_rdataset_isassociated(&val->frdataset))
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson dns_rdataset_disassociate(&val->frdataset);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson if (dns_rdataset_isassociated(&val->fsigrdataset))
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson dns_rdataset_disassociate(&val->fsigrdataset);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson isc_event_free(&event);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson}
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrewsstatic void
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrewskeyvalidated(isc_task_t *task, isc_event_t *event) {
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews dns_validatorevent_t *devent;
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews dns_validator_t *val;
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington isc_result_t result;
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington isc_result_t eresult;
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley
88a6fef4944a00d8350ffd8b64ef58c694b8335eMark Andrews UNUSED(task);
76883e8cee593f45c65b0936e5d6e8f778d6e3efMichael Graff INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
3ddd814a97de1d152ba0913c592d6e6dc83d38a6Michael Graff devent = (dns_validatorevent_t *)event;
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews val = devent->ev_arg;
8af4b7042d84e0699f7c1de306526098030b74a9Mark Andrews eresult = devent->result;
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley isc_event_free(&event);
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley validator_log(val, ISC_LOG_DEBUG(3), "in keyvalidated");
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson LOCK(&val->lock);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley if (eresult == ISC_R_SUCCESS) {
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews "keyset with trust %d", &val->frdataset.trust);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley /*
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley * Only extract the dst key if the keyset is secure.
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley */
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley if (val->frdataset.trust >= dns_trust_secure)
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley (void) get_dst_key(val, val->siginfo, &val->frdataset);
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley result = validate(val, ISC_TRUE);
ccbfddc70ef38263daca312d29bb8c5077e24785Bob Halley if (result != DNS_R_WAIT) {
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson validator_done(val, result);
54f959d12b5a1f9315fbf6a776c6d349316e9686Bob Halley goto out;
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley }
89d8adb6663b13435ff9ae1eb53e45da7fa79275Bob Halley } else {
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley validator_log(val, ISC_LOG_DEBUG(3),
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley "keyvalidated: got %s",
89d8adb6663b13435ff9ae1eb53e45da7fa79275Bob Halley dns_result_totext(eresult));
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff validator_done(val, eresult);
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley }
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley out:
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley UNLOCK(&val->lock);
b2ca6fd3a8293440b4d263723525396059cf2400Brian Wellington dns_validator_destroy(&val->keyvalidator);
b2ca6fd3a8293440b4d263723525396059cf2400Brian Wellington /*
b2ca6fd3a8293440b4d263723525396059cf2400Brian Wellington * Free stuff from the event.
b2ca6fd3a8293440b4d263723525396059cf2400Brian Wellington */
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington if (dns_rdataset_isassociated(&val->frdataset))
89d8adb6663b13435ff9ae1eb53e45da7fa79275Bob Halley dns_rdataset_disassociate(&val->frdataset);
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley if (dns_rdataset_isassociated(&val->fsigrdataset))
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley dns_rdataset_disassociate(&val->fsigrdataset);
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff}
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graffstatic isc_boolean_t
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halleynxtprovesnonexistence(dns_validator_t *val, dns_name_t *nxtname,
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley dns_rdataset_t *nxtset, dns_rdataset_t *signxtset)
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley{
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson int order;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson dns_rdata_t rdata;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson isc_region_t r;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson dns_name_t nextname;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson isc_result_t result;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson result = dns_rdataset_first(nxtset);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson INSIST(result == ISC_R_SUCCESS);
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews dns_rdataset_current(nxtset, &rdata);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson "looking for relevant nxt");
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson order = dns_name_compare(val->event->name, nxtname);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson if (order == 0) {
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson /*
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson * The names are the same, so look for the type present bit.
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson */
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson if (val->event->type >= 128) {
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3), "invalid type %d",
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson val->event->type);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson return (ISC_FALSE);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson }
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson if (dns_nxt_typepresent(&rdata, val->event->type)) {
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson "type should not be present");
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson return (ISC_FALSE);
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews }
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley validator_log(val, ISC_LOG_DEBUG(3), "nxt bitmask ok");
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson } else if (order > 0) {
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley /*
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews * The NXT owner name is less than the nonexistent name.
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley */
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews dns_rdata_toregion(&rdata, &r);
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley dns_name_init(&nextname, NULL);
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews dns_name_fromregion(&nextname, &r);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson order = dns_name_compare(val->event->name, &nextname);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson if (order >= 0) {
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson /*
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson * The NXT next name is less than the nonexistent
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson * name. This is only ok if the next name is the zone
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews * name.
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews */
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews dns_rdata_sig_t siginfo;
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews result = dns_rdataset_first(signxtset);
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews INSIST (result == ISC_R_SUCCESS);
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews dns_rdataset_current(signxtset, &rdata);
def8e47c688e2480a4539d69c3d1a0a28a7c0550Mark Andrews result = dns_rdata_tostruct(&rdata, &siginfo, NULL);
def8e47c688e2480a4539d69c3d1a0a28a7c0550Mark Andrews INSIST (result == ISC_R_SUCCESS);
def8e47c688e2480a4539d69c3d1a0a28a7c0550Mark Andrews if (!dns_name_equal(&siginfo.signer, &nextname)) {
def8e47c688e2480a4539d69c3d1a0a28a7c0550Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews "next name is not greater");
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews return (ISC_FALSE);
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews }
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews validator_log(val, ISC_LOG_DEBUG(3),
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews "nxt points to zone apex, ok");
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews }
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews validator_log(val, ISC_LOG_DEBUG(3),
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews "nxt range ok");
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews } else {
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews validator_log(val, ISC_LOG_DEBUG(3),
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson "nxt owner name is not less");
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley /*
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson * The NXT owner name is greater than the supposedly
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley * nonexistent name. This NXT is irrelevant.
def8e47c688e2480a4539d69c3d1a0a28a7c0550Mark Andrews */
def8e47c688e2480a4539d69c3d1a0a28a7c0550Mark Andrews return (ISC_FALSE);
def8e47c688e2480a4539d69c3d1a0a28a7c0550Mark Andrews }
def8e47c688e2480a4539d69c3d1a0a28a7c0550Mark Andrews return (ISC_TRUE);
def8e47c688e2480a4539d69c3d1a0a28a7c0550Mark Andrews}
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrewsstatic void
abc93ada82b37282122f8162f48761eb99736571Mark Andrewsauthvalidated(isc_task_t *task, isc_event_t *event) {
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews dns_validatorevent_t *devent;
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews dns_validator_t *val;
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews dns_rdataset_t *rdataset, *sigrdataset;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson isc_result_t result;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson isc_result_t eresult;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson UNUSED(task);
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley devent = (dns_validatorevent_t *)event;
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews rdataset = devent->rdataset;
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews sigrdataset = devent->sigrdataset;
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews val = devent->ev_arg;
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews eresult = devent->result;
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews dns_validator_destroy(&val->authvalidator);
2dd99c098ca162f985b7ef3c8142a964ad8281aeMark Andrews
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley validator_log(val, ISC_LOG_DEBUG(3), "in authvalidated");
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley LOCK(&val->lock);
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley if (eresult != ISC_R_SUCCESS) {
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3),
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews "authvalidated: got %s",
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley dns_result_totext(eresult));
76883e8cee593f45c65b0936e5d6e8f778d6e3efMichael Graff validator_done(val, eresult);
76883e8cee593f45c65b0936e5d6e8f778d6e3efMichael Graff } else {
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence if (rdataset->type == dns_rdatatype_nxt &&
76883e8cee593f45c65b0936e5d6e8f778d6e3efMichael Graff nxtprovesnonexistence(val, devent->name, rdataset,
8af4b7042d84e0699f7c1de306526098030b74a9Mark Andrews sigrdataset))
8af4b7042d84e0699f7c1de306526098030b74a9Mark Andrews val->attributes |= VALATTR_FOUNDNONEXISTENCE;
94a08e09db3dc844b6ee4841c368a2d7074a9c3fAndreas Gustafsson
76883e8cee593f45c65b0936e5d6e8f778d6e3efMichael Graff result = nxtvalidate(val, ISC_TRUE);
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff if (result != DNS_R_WAIT)
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley validator_done(val, result);
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff }
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley UNLOCK(&val->lock);
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff /*
6e49e91bd08778d7eae45a2229dcf41ed97cc636David Lawrence * Free stuff from the event.
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff */
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley isc_event_free(&event);
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley}
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews
22f735acbce7ffe95af20bb58bb8929b6f1d674fMichael Graffstatic void
904a5734375869ffb504ed8cde6b68cafadb6d64Bob Halleynegauthvalidated(isc_task_t *task, isc_event_t *event) {
bf345589ce0b0b64533d4566e4992a0e63aac6f5Bob Halley dns_validatorevent_t *devent;
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff dns_validator_t *val;
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff isc_result_t eresult;
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff UNUSED(task);
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff devent = (dns_validatorevent_t *)event;
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff val = devent->ev_arg;
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff eresult = devent->result;
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence isc_event_free(&event);
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff dns_validator_destroy(&val->authvalidator);
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson validator_log(val, ISC_LOG_DEBUG(3), "in negauthvalidated");
c03bb27f0675a6e60ceea66b451548e8481bc05cMark Andrews LOCK(&val->lock);
43b8fb75704f290a48fc96461140b42b2488348dMark Andrews if (eresult == ISC_R_SUCCESS) {
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley val->attributes |= VALATTR_FOUNDNONEXISTENCE;
c03bb27f0675a6e60ceea66b451548e8481bc05cMark Andrews validator_log(val, ISC_LOG_DEBUG(3),
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff "nonexistence proof found");
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff validator_done(val, ISC_R_SUCCESS);
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley } else {
13eaef2df27683658868c3828c18880d7419a16aDavid Lawrence validator_log(val, ISC_LOG_DEBUG(3),
13eaef2df27683658868c3828c18880d7419a16aDavid Lawrence "negauthvalidated: got %s",
69be7837c920fac5c71a73e8fad586f9a2711e96Michael Graff dns_result_totext(eresult));
13eaef2df27683658868c3828c18880d7419a16aDavid Lawrence validator_done(val, eresult);
13eaef2df27683658868c3828c18880d7419a16aDavid Lawrence }
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews UNLOCK(&val->lock);
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews
76883e8cee593f45c65b0936e5d6e8f778d6e3efMichael Graff /*
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley * Free stuff from the event.
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley */
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley if (dns_rdataset_isassociated(&val->frdataset))
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff dns_rdataset_disassociate(&val->frdataset);
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley}
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafssonstatic void
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halleynullkeyvalidated(isc_task_t *task, isc_event_t *event) {
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson dns_validatorevent_t *devent;
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff dns_validator_t *val;
76883e8cee593f45c65b0936e5d6e8f778d6e3efMichael Graff isc_result_t result;
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff isc_result_t eresult;
c3b708aaf1bb0a118e0e11befa1b732acfb1d079Bob Halley
76883e8cee593f45c65b0936e5d6e8f778d6e3efMichael Graff UNUSED(task);
ccbfddc70ef38263daca312d29bb8c5077e24785Bob Halley INSIST(event->ev_type == DNS_EVENT_VALIDATORDONE);
ccbfddc70ef38263daca312d29bb8c5077e24785Bob Halley devent = (dns_validatorevent_t *)event;
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff val = devent->ev_arg;
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley eresult = devent->result;
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews dns_name_free(devent->name, val->view->mctx);
8af4b7042d84e0699f7c1de306526098030b74a9Mark Andrews isc_mem_put(val->view->mctx, devent->name, sizeof(dns_name_t));
8af4b7042d84e0699f7c1de306526098030b74a9Mark Andrews isc_event_free(&event);
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews
92296c744ef9ef36de499eb10b3e27800d8b24a5Mark Andrews validator_log(val, ISC_LOG_DEBUG(3), "in nullkeyvalidated");
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews if (eresult == ISC_R_SUCCESS) {
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews validator_log(val, ISC_LOG_DEBUG(3),
13eaef2df27683658868c3828c18880d7419a16aDavid Lawrence "proved that name is in an unsecure domain");
13eaef2df27683658868c3828c18880d7419a16aDavid Lawrence LOCK(&val->lock);
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley validator_done(val, ISC_R_SUCCESS);
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley UNLOCK(&val->lock);
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley } else {
8dfa9caeec8e68db0c937e347a3d6629e7627d54Bob Halley LOCK(&val->lock);
5619558151f1aa4249b3ead979e76876e29278b6Bob Halley result = proveunsecure(val, ISC_TRUE);
d981ca645597116d227a48bf37cc5edc061c854dBob Halley if (result != DNS_R_WAIT)
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews validator_done(val, result);
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews UNLOCK(&val->lock);
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews }
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews dns_validator_destroy(&val->keyvalidator);
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews /*
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington * Free stuff from the event.
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews */
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews if (dns_rdataset_isassociated(&val->frdataset))
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews dns_rdataset_disassociate(&val->frdataset);
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington if (dns_rdataset_isassociated(&val->fsigrdataset))
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington dns_rdataset_disassociate(&val->fsigrdataset);
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews}
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews/*
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews * Try to find a null zone key among those in 'rdataset'. If found, build
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews * a dst_key_t for it and point val->key at it.
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews */
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrewsstatic inline isc_boolean_t
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrewscontainsnullkey(dns_validator_t *val, dns_rdataset_t *rdataset) {
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews isc_result_t result;
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington dst_key_t *key = NULL;
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews isc_buffer_t b;
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews dns_rdata_t rdata;
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews isc_boolean_t found = ISC_FALSE;
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews result = dns_rdataset_first(rdataset);
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington if (result != ISC_R_SUCCESS)
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington return (ISC_FALSE);
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews while (result == ISC_R_SUCCESS && !found) {
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews dns_rdataset_current(rdataset, &rdata);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson isc_buffer_init(&b, rdata.data, rdata.length);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson isc_buffer_add(&b, rdata.length);
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson key = NULL;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson /*
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson * The key name is unimportant, so we can avoid any name/text
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington * conversion.
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson */
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson result = dst_key_fromdns(dns_rootname, &b, val->view->mctx,
03f91269f5453bcbd924910ef85a8f8496cf2661Mark Andrews &key);
84185d19c7a9ef1ac23cc6236c8773697d4efeb1Brian Wellington if (result != ISC_R_SUCCESS)
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson continue;
febaa091847ab004f40500cc475a819f2c73fcddAndreas Gustafsson if (dst_key_isnullkey(key))
3ddd814a97de1d152ba0913c592d6e6dc83d38a6Michael Graff found = ISC_TRUE;
d981ca645597116d227a48bf37cc5edc061c854dBob Halley dst_key_free(&key);
d981ca645597116d227a48bf37cc5edc061c854dBob Halley result = dns_rdataset_next(rdataset);
d981ca645597116d227a48bf37cc5edc061c854dBob Halley }
88a6fef4944a00d8350ffd8b64ef58c694b8335eMark Andrews return (found);
3ddd814a97de1d152ba0913c592d6e6dc83d38a6Michael Graff}
d981ca645597116d227a48bf37cc5edc061c854dBob Halley
d981ca645597116d227a48bf37cc5edc061c854dBob Halley/*
d981ca645597116d227a48bf37cc5edc061c854dBob Halley * Try to find a key that could have signed 'siginfo' among those
d981ca645597116d227a48bf37cc5edc061c854dBob Halley * in 'rdataset'. If found, build a dst_key_t for it and point
d981ca645597116d227a48bf37cc5edc061c854dBob Halley * val->key at it.
d981ca645597116d227a48bf37cc5edc061c854dBob Halley *
d981ca645597116d227a48bf37cc5edc061c854dBob Halley * If val->key is non-NULL, this returns the next matching key.
d981ca645597116d227a48bf37cc5edc061c854dBob Halley */
d981ca645597116d227a48bf37cc5edc061c854dBob Halleystatic inline isc_result_t
d981ca645597116d227a48bf37cc5edc061c854dBob Halleyget_dst_key(dns_validator_t *val, dns_rdata_sig_t *siginfo,
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff dns_rdataset_t *rdataset)
d981ca645597116d227a48bf37cc5edc061c854dBob Halley{
d981ca645597116d227a48bf37cc5edc061c854dBob Halley isc_result_t result;
d981ca645597116d227a48bf37cc5edc061c854dBob Halley isc_buffer_t b;
d981ca645597116d227a48bf37cc5edc061c854dBob Halley dns_rdata_t rdata;
d981ca645597116d227a48bf37cc5edc061c854dBob Halley dst_key_t *oldkey = val->key;
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff isc_boolean_t foundold;
d981ca645597116d227a48bf37cc5edc061c854dBob Halley
43b8fb75704f290a48fc96461140b42b2488348dMark Andrews if (oldkey == NULL)
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff foundold = ISC_TRUE;
d981ca645597116d227a48bf37cc5edc061c854dBob Halley else {
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff foundold = ISC_FALSE;
d981ca645597116d227a48bf37cc5edc061c854dBob Halley val->key = NULL;
d981ca645597116d227a48bf37cc5edc061c854dBob Halley }
419590499823ce15b5d2ad4fe71eaf04bd5a86c0Michael Graff
d981ca645597116d227a48bf37cc5edc061c854dBob Halley result = dns_rdataset_first(rdataset);
dc570b92f6cc60def4207733c7a194fbb69a4399Michael Sawyer if (result != ISC_R_SUCCESS)
goto failure;
do {
dns_rdataset_current(rdataset, &rdata);
isc_buffer_init(&b, rdata.data, rdata.length);
isc_buffer_add(&b, rdata.length);
INSIST(val->key == NULL);
result = dst_key_fromdns(&siginfo->signer, &b, val->view->mctx,
&val->key);
if (result != ISC_R_SUCCESS)
goto failure;
if (siginfo->algorithm ==
(dns_secalg_t)dst_key_alg(val->key) &&
siginfo->keyid ==
(dns_keytag_t)dst_key_id(val->key) &&
dst_key_iszonekey(val->key))
{
if (foundold)
/*
* This is the key we're looking for.
*/
return (ISC_R_SUCCESS);
else if (dst_key_compare(oldkey, val->key) == ISC_TRUE)
{
foundold = ISC_TRUE;
dst_key_free(&oldkey);
}
}
dst_key_free(&val->key);
result = dns_rdataset_next(rdataset);
} while (result == ISC_R_SUCCESS);
if (result == ISC_R_NOMORE)
result = ISC_R_NOTFOUND;
failure:
if (oldkey != NULL)
dst_key_free(&oldkey);
return (result);
}
static inline isc_result_t
get_key(dns_validator_t *val, dns_rdata_sig_t *siginfo) {
isc_result_t result;
dns_validatorevent_t *event;
unsigned int nbits, nlabels;
int order;
dns_namereln_t namereln;
event = val->event;
/*
* Is the key name appropriate for this signature?
*/
namereln = dns_name_fullcompare(event->name, &siginfo->signer,
&order, &nlabels, &nbits);
if (event->rdataset->type == dns_rdatatype_key &&
namereln != dns_namereln_subdomain) {
/*
* We don't want a KEY RR to authenticate
* itself, so we ignore the signature if it
* was not made by an ancestor of the KEY.
*/
return (DNS_R_CONTINUE);
} else if (namereln != dns_namereln_subdomain &&
namereln != dns_namereln_equal) {
/*
* The key name is not at the same level
* as 'rdataset', nor is it closer to the
* DNS root.
*/
return (DNS_R_CONTINUE);
}
/*
* Is the key used for the signature a security root?
*/
INSIST(val->keynode == NULL);
val->keytable = val->view->secroots;
result = dns_keytable_findkeynode(val->view->secroots,
&siginfo->signer,
siginfo->algorithm, siginfo->keyid,
&val->keynode);
if (result == ISC_R_SUCCESS) {
/*
* The key is a security root.
*/
val->key = dns_keynode_key(val->keynode);
return (ISC_R_SUCCESS);
}
/*
* Do we know about this key?
*/
if (dns_rdataset_isassociated(&val->frdataset))
dns_rdataset_disassociate(&val->frdataset);
if (dns_rdataset_isassociated(&val->fsigrdataset))
dns_rdataset_disassociate(&val->fsigrdataset);
result = dns_view_simplefind(val->view, &siginfo->signer,
dns_rdatatype_key, 0,
DNS_DBFIND_PENDINGOK, ISC_FALSE,
&val->frdataset, &val->fsigrdataset);
if (result == ISC_R_SUCCESS) {
/*
* We have an rrset for the given keyname.
*/
val->keyset = &val->frdataset;
if (val->frdataset.trust == dns_trust_pending &&
dns_rdataset_isassociated(&val->fsigrdataset))
{
/*
* We know the key but haven't validated it yet.
*/
result = dns_validator_create(val->view,
&siginfo->signer,
dns_rdatatype_key,
&val->frdataset,
&val->fsigrdataset,
NULL,
0,
val->task,
keyvalidated,
val,
&val->keyvalidator);
if (result != ISC_R_SUCCESS)
return (result);
return (DNS_R_WAIT);
} else if (val->frdataset.trust == dns_trust_pending) {
/*
* Having a pending key with no signature means that
* something is broken.
*/
result = DNS_R_CONTINUE;
} else if (val->frdataset.trust < dns_trust_secure) {
/*
* The key is legitimately insecure. There's no
* point in even attempting verification.
*/
val->key = NULL;
result = ISC_R_SUCCESS;
} else {
/*
* See if we've got the key used in the signature.
*/
validator_log(val, ISC_LOG_DEBUG(3),
"keyset with trust %d",
val->frdataset.trust);
result = get_dst_key(val, siginfo, val->keyset);
if (result != ISC_R_SUCCESS) {
/*
* Either the key we're looking for is not
* in the rrset, or something bad happened.
* Give up.
*/
result = DNS_R_CONTINUE;
}
}
} else if (result == ISC_R_NOTFOUND) {
/*
* We don't know anything about this key.
*/
val->fetch = NULL;
result = dns_resolver_createfetch(val->view->resolver,
&siginfo->signer,
dns_rdatatype_key,
NULL, NULL, NULL, 0,
val->event->ev_sender,
fetch_callback_validator,
val,
&val->frdataset,
&val->fsigrdataset,
&val->fetch);
if (result != ISC_R_SUCCESS)
return (result);
return (DNS_R_WAIT);
} else if (result == DNS_R_NCACHENXDOMAIN ||
result == DNS_R_NCACHENXRRSET ||
result == DNS_R_NXDOMAIN ||
result == DNS_R_NXRRSET)
{
/*
* This key doesn't exist.
*/
result = DNS_R_CONTINUE;
}
if (dns_rdataset_isassociated(&val->frdataset) &&
val->keyset != &val->frdataset)
dns_rdataset_disassociate(&val->frdataset);
if (dns_rdataset_isassociated(&val->fsigrdataset))
dns_rdataset_disassociate(&val->fsigrdataset);
return (result);
}
/*
* If the rdataset being validated is a key set, is each key a security root?
*/
static isc_boolean_t
issecurityroot(dns_validator_t *val) {
dns_name_t *name;
dns_rdataset_t *rdataset;
isc_mem_t *mctx;
dns_keytable_t *secroots;
dns_rdata_t rdata;
isc_result_t result;
dns_keynode_t *keynode, *nextnode;
dst_key_t *key, *secrootkey;
isc_boolean_t match = ISC_FALSE;
name = val->event->name;
rdataset = val->event->rdataset;
mctx = val->view->mctx;
secroots = val->view->secroots;
for (result = dns_rdataset_first(rdataset);
result == ISC_R_SUCCESS;
result = dns_rdataset_next(rdataset))
{
dns_rdataset_current(rdataset, &rdata);
key = NULL;
result = dns_dnssec_keyfromrdata(name, &rdata, mctx, &key);
if (result != ISC_R_SUCCESS)
continue;
keynode = NULL;
result = dns_keytable_findkeynode(secroots, name,
dst_key_alg(key),
dst_key_id(key),
&keynode);
match = ISC_FALSE;
while (result == ISC_R_SUCCESS) {
secrootkey = dns_keynode_key(keynode);
if (dst_key_compare(key, secrootkey)) {
match = ISC_TRUE;
dns_keytable_detachkeynode(secroots, &keynode);
break;
}
nextnode = NULL;
result = dns_keytable_findnextkeynode(secroots,
keynode,
&nextnode);
dns_keytable_detachkeynode(secroots, &keynode);
}
dst_key_free(&key);
if (!match)
return (ISC_FALSE);
}
return (match);
}
/*
* Attempts positive response validation.
*
* Returns:
* ISC_R_SUCCESS Validation completed successfully
* DNS_R_WAIT Validation has started but is waiting
* for an event.
* Other return codes are possible and all indicate failure.
*/
static inline isc_result_t
validate(dns_validator_t *val, isc_boolean_t resume) {
isc_result_t result;
dns_validatorevent_t *event;
dns_rdata_t rdata;
/*
* Caller must be holding the validator lock.
*/
event = val->event;
/*
* If this is a security root, it's ok.
*/
if (!resume) {
dns_fixedname_t fsecroot;
dns_name_t *secroot;
dns_fixedname_init(&fsecroot);
secroot = dns_fixedname_name(&fsecroot);
result = dns_keytable_finddeepestmatch(val->view->secroots,
val->event->name,
secroot);
if (result == ISC_R_SUCCESS &&
val->event->type == dns_rdatatype_key &&
dns_name_equal(val->event->name, secroot) &&
issecurityroot(val))
{
val->event->rdataset->trust = dns_trust_secure;
return (ISC_R_SUCCESS);
}
}
if (resume) {
/*
* We already have a sigrdataset.
*/
result = ISC_R_SUCCESS;
validator_log(val, ISC_LOG_DEBUG(3), "resuming validate");
} else {
result = dns_rdataset_first(event->sigrdataset);
}
for (;
result == ISC_R_SUCCESS;
result = dns_rdataset_next(event->sigrdataset))
{
dns_rdataset_current(event->sigrdataset, &rdata);
if (val->siginfo != NULL)
isc_mem_put(val->view->mctx, val->siginfo,
sizeof *val->siginfo);
val->siginfo = isc_mem_get(val->view->mctx,
sizeof *val->siginfo);
if (val->siginfo == NULL)
return (ISC_R_NOMEMORY);
dns_rdata_tostruct(&rdata, val->siginfo, NULL);
/*
* At this point we could check that the signature algorithm
* was known and "sufficiently good". For now, any algorithm
* is acceptable.
*/
if (!resume) {
result = get_key(val, val->siginfo);
if (result == DNS_R_CONTINUE)
continue; /* Try the next SIG RR. */
if (result != ISC_R_SUCCESS)
return (result);
}
if (val->key == NULL) {
event->rdataset->trust = dns_trust_answer;
event->sigrdataset->trust = dns_trust_answer;
validator_log(val, ISC_LOG_DEBUG(3),
"marking as answer");
return (ISC_R_SUCCESS);
}
do {
val->attributes |= VALATTR_TRIEDVERIFY;
result = dns_dnssec_verify(event->name,
event->rdataset,
val->key, ISC_FALSE,
val->view->mctx, &rdata);
validator_log(val, ISC_LOG_DEBUG(3),
"verify rdataset: %s",
isc_result_totext(result));
if (result == ISC_R_SUCCESS)
break;
if (val->keynode != NULL) {
dns_keynode_t *nextnode = NULL;
result = dns_keytable_findnextkeynode(
val->keytable,
val->keynode,
&nextnode);
dns_keytable_detachkeynode(val->keytable,
&val->keynode);
val->keynode = nextnode;
if (result != ISC_R_SUCCESS) {
val->key = NULL;
break;
}
val->key = dns_keynode_key(val->keynode);
} else {
if (get_dst_key(val, val->siginfo, val->keyset)
!= ISC_R_SUCCESS)
break;
}
} while (1);
if (result != ISC_R_SUCCESS)
validator_log(val, ISC_LOG_DEBUG(3),
"failed to verify rdataset");
else {
isc_uint32_t ttl;
isc_stdtime_t now;
isc_stdtime_get(&now);
ttl = ISC_MIN(event->rdataset->ttl,
val->siginfo->timeexpire - now);
if (val->keyset != NULL)
ttl = ISC_MIN(ttl, val->keyset->ttl);
event->rdataset->ttl = ttl;
event->sigrdataset->ttl = ttl;
}
if (val->keynode != NULL)
dns_keytable_detachkeynode(val->keytable,
&val->keynode);
else {
if (val->key != NULL)
dst_key_free(&val->key);
if (val->keyset != NULL) {
dns_rdataset_disassociate(val->keyset);
val->keyset = NULL;
}
}
val->key = NULL;
if (result == ISC_R_SUCCESS) {
event->rdataset->trust = dns_trust_secure;
event->sigrdataset->trust = dns_trust_secure;
validator_log(val, ISC_LOG_DEBUG(3),
"marking as secure");
return (result);
}
else
validator_log(val, ISC_LOG_DEBUG(3),
"verify failure: %s",
isc_result_totext(result));
}
INSIST(result == ISC_R_NOMORE);
validator_log(val, ISC_LOG_INFO, "no valid signature found");
return (DNS_R_NOVALIDSIG);
}
static inline isc_result_t
nxtvalidate(dns_validator_t *val, isc_boolean_t resume) {
dns_name_t *name;
dns_message_t *message = val->event->message;
isc_result_t result;
if (!resume) {
result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
if (result != ISC_R_SUCCESS)
validator_done(val, ISC_R_NOTFOUND);
} else {
result = ISC_R_SUCCESS;
validator_log(val, ISC_LOG_DEBUG(3), "resuming nxtvalidate");
}
for (;
result == ISC_R_SUCCESS;
result = dns_message_nextname(message, DNS_SECTION_AUTHORITY))
{
dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
name = NULL;
dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
if (resume) {
rdataset = ISC_LIST_NEXT(val->currentset, link);
val->currentset = NULL;
resume = ISC_FALSE;
}
else {
for (rdataset = ISC_LIST_HEAD(name->list);
rdataset != NULL;
rdataset = ISC_LIST_NEXT(rdataset, link))
rdataset->trust = dns_trust_pending;
rdataset = ISC_LIST_HEAD(name->list);
}
for (;
rdataset != NULL;
rdataset = ISC_LIST_NEXT(rdataset, link))
{
if (rdataset->type == dns_rdatatype_sig)
continue;
for (sigrdataset = ISC_LIST_HEAD(name->list);
sigrdataset != NULL;
sigrdataset = ISC_LIST_NEXT(sigrdataset,
link))
{
if (sigrdataset->type == dns_rdatatype_sig &&
sigrdataset->covers == rdataset->type)
break;
}
if (sigrdataset == NULL)
continue;
val->seensig = ISC_TRUE;
val->authvalidator = NULL;
val->currentset = rdataset;
result = dns_validator_create(val->view, name,
rdataset->type,
rdataset,
sigrdataset,
NULL, 0,
val->task,
authvalidated,
val,
&val->authvalidator);
if (result != ISC_R_SUCCESS)
return (result);
return (DNS_R_WAIT);
}
}
if (result == ISC_R_NOMORE)
result = ISC_R_SUCCESS;
if (result != ISC_R_SUCCESS)
validator_done(val, result);
if ((val->attributes & VALATTR_FOUNDNONEXISTENCE) == 0) {
if (!val->seensig) {
result = dns_validator_create(val->view, name,
dns_rdatatype_soa,
&val->frdataset,
NULL, NULL, 0,
val->task,
negauthvalidated,
val,
&val->authvalidator);
if (result != ISC_R_SUCCESS)
return (result);
return (DNS_R_WAIT);
}
validator_log(val, ISC_LOG_DEBUG(3),
"nonexistence proof not found");
return (DNS_R_NOVALIDNXT);
} else {
validator_log(val, ISC_LOG_DEBUG(3),
"nonexistence proof found");
return (ISC_R_SUCCESS);
}
}
static inline isc_result_t
proveunsecure(dns_validator_t *val, isc_boolean_t resume) {
isc_result_t result;
dns_fixedname_t secroot, tfname;
dns_name_t *tname;
dns_fixedname_init(&secroot);
dns_fixedname_init(&tfname);
result = dns_keytable_finddeepestmatch(val->view->secroots,
val->event->name,
dns_fixedname_name(&secroot));
/*
* If the name is not under a security root, it must be insecure.
*/
if (result == ISC_R_NOTFOUND)
return (ISC_R_SUCCESS);
else if (result != ISC_R_SUCCESS)
return (result);
/*
* If this is a security root, it's ok.
*/
if (val->event->type == dns_rdatatype_key &&
dns_name_equal(val->event->name, dns_fixedname_name(&secroot)) &&
issecurityroot(val))
{
val->event->rdataset->trust = dns_trust_secure;
return (ISC_R_SUCCESS);
}
if (!resume)
val->labels = dns_name_depth(dns_fixedname_name(&secroot)) + 1;
else {
validator_log(val, ISC_LOG_DEBUG(3), "resuming proveunsecure");
val->labels++;
}
for (;
val->labels <= dns_name_depth(val->event->name);
val->labels++)
{
char namebuf[1024];
if (val->labels == dns_name_depth(val->event->name)) {
if (val->event->type == dns_rdatatype_key)
break;
tname = val->event->name;
} else {
tname = dns_fixedname_name(&tfname);
result = dns_name_splitatdepth(val->event->name,
val->labels,
NULL, tname);
if (result != ISC_R_SUCCESS)
return (result);
}
dns_name_format(tname, namebuf, sizeof(namebuf));
validator_log(val, ISC_LOG_DEBUG(3),
"looking for null keyset at '%s'",
namebuf);
if (dns_rdataset_isassociated(&val->frdataset))
dns_rdataset_disassociate(&val->frdataset);
if (dns_rdataset_isassociated(&val->fsigrdataset))
dns_rdataset_disassociate(&val->fsigrdataset);
result = dns_view_simplefind(val->view, tname,
dns_rdatatype_key, 0,
DNS_DBFIND_PENDINGOK, ISC_FALSE,
&val->frdataset,
&val->fsigrdataset);
if (result == ISC_R_SUCCESS) {
dns_name_t *fname = NULL;
if (!dns_rdataset_isassociated(&val->fsigrdataset)) {
result = DNS_R_NOTINSECURE;
goto out;
}
validator_log(val, ISC_LOG_DEBUG(3),
"found keyset, looking for null key");
if (!containsnullkey(val, &val->frdataset))
continue;
if (val->frdataset.trust >= dns_trust_secure) {
validator_log(val, ISC_LOG_DEBUG(3),
"insecurity proof succeeded");
val->event->rdataset->trust = dns_trust_answer;
result = ISC_R_SUCCESS;
goto out;
}
fname = isc_mem_get(val->view->mctx, sizeof *fname);
if (fname == NULL)
return (ISC_R_NOMEMORY);
dns_name_init(fname, NULL);
result = dns_name_dup(tname, val->view->mctx, fname);
if (result != ISC_R_SUCCESS) {
isc_mem_put(val->view->mctx, fname,
sizeof *fname);
result = ISC_R_NOMEMORY;
goto out;
}
result = dns_validator_create(val->view,
fname,
dns_rdatatype_key,
&val->frdataset,
&val->fsigrdataset,
NULL,
0,
val->task,
nullkeyvalidated,
val,
&val->keyvalidator);
if (result != ISC_R_SUCCESS)
goto out;
return (DNS_R_WAIT);
} else if (result == ISC_R_NOTFOUND) {
val->fetch = NULL;
result = dns_resolver_createfetch(val->view->resolver,
tname,
dns_rdatatype_key,
NULL, NULL, NULL, 0,
val->event->ev_sender,
fetch_callback_nullkey,
val,
&val->frdataset,
&val->fsigrdataset,
&val->fetch);
if (result != ISC_R_SUCCESS)
goto out;
return (DNS_R_WAIT);
} else if (result == DNS_R_NCACHENXDOMAIN ||
result == DNS_R_NCACHENXRRSET ||
result == DNS_R_NXDOMAIN ||
result == DNS_R_NXRRSET)
{
continue;
} else
goto out;
}
validator_log(val, ISC_LOG_DEBUG(3), "insecurity proof failed");
return (DNS_R_NOTINSECURE); /* Didn't find a null key */
out:
if (dns_rdataset_isassociated(&val->frdataset))
dns_rdataset_disassociate(&val->frdataset);
if (dns_rdataset_isassociated(&val->fsigrdataset))
dns_rdataset_disassociate(&val->fsigrdataset);
return (result);
}
static void
validator_start(isc_task_t *task, isc_event_t *event) {
dns_validator_t *val;
dns_validatorevent_t *vevent;
isc_result_t result = ISC_R_FAILURE;
UNUSED(task);
REQUIRE(event->ev_type == DNS_EVENT_VALIDATORSTART);
vevent = (dns_validatorevent_t *)event;
val = vevent->validator;
validator_log(val, ISC_LOG_DEBUG(3), "starting");
LOCK(&val->lock);
if (val->event->rdataset != NULL && val->event->sigrdataset != NULL) {
isc_result_t saved_result;
/*
* This looks like a simple validation. We say "looks like"
* because we don't know if wildcards are involved yet so it
* could still get complicated.
*/
validator_log(val, ISC_LOG_DEBUG(3),
"attempting positive response validation");
result = validate(val, ISC_FALSE);
if (result == DNS_R_NOVALIDSIG &&
(val->attributes & VALATTR_TRIEDVERIFY) == 0)
{
saved_result = result;
validator_log(val, ISC_LOG_DEBUG(3),
"falling back to insecurity proof");
result = proveunsecure(val, ISC_FALSE);
if (result == DNS_R_NOTINSECURE)
result = saved_result;
}
} else if (val->event->rdataset != NULL) {
/*
* This is either an unsecure subdomain or a response from
* a broken server.
*/
validator_log(val, ISC_LOG_DEBUG(3),
"attempting insecurity proof");
result = proveunsecure(val, ISC_FALSE);
} else if (val->event->rdataset == NULL &&
val->event->sigrdataset == NULL)
{
/*
* This is a nonexistence validation.
*/
validator_log(val, ISC_LOG_DEBUG(3),
"attempting negative response validation");
result = nxtvalidate(val, ISC_FALSE);
} else {
/*
* This shouldn't happen.
*/
INSIST(0);
}
if (result != DNS_R_WAIT)
validator_done(val, result);
UNLOCK(&val->lock);
}
isc_result_t
dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
dns_message_t *message, unsigned int options,
isc_task_t *task, isc_taskaction_t action, void *arg,
dns_validator_t **validatorp)
{
isc_result_t result;
dns_validator_t *val;
isc_task_t *tclone;
dns_validatorevent_t *event;
REQUIRE(name != NULL);
REQUIRE(type != 0);
REQUIRE(rdataset != NULL ||
(rdataset == NULL && sigrdataset == NULL && message != NULL));
REQUIRE(options == 0);
REQUIRE(validatorp != NULL && *validatorp == NULL);
tclone = NULL;
result = ISC_R_FAILURE;
val = isc_mem_get(view->mctx, sizeof *val);
if (val == NULL)
return (ISC_R_NOMEMORY);
val->view = NULL;
dns_view_attach(view, &val->view);
event = (dns_validatorevent_t *)
isc_event_allocate(view->mctx, task,
DNS_EVENT_VALIDATORSTART,
validator_start, NULL,
sizeof (dns_validatorevent_t));
if (event == NULL) {
result = ISC_R_NOMEMORY;
goto cleanup_val;
}
isc_task_attach(task, &tclone);
event->validator = val;
event->result = ISC_R_FAILURE;
event->name = name;
event->type = type;
event->rdataset = rdataset;
event->sigrdataset = sigrdataset;
event->message = message;
result = isc_mutex_init(&val->lock);
if (result != ISC_R_SUCCESS)
goto cleanup_event;
val->event = event;
val->options = options;
val->attributes = 0;
val->fetch = NULL;
val->keyvalidator = NULL;
val->authvalidator = NULL;
val->keynode = NULL;
val->key = NULL;
val->siginfo = NULL;
val->task = task;
val->action = action;
val->arg = arg;
val->labels = 0;
val->currentset = NULL;
val->keyset = NULL;
val->seensig = ISC_FALSE;
dns_rdataset_init(&val->frdataset);
dns_rdataset_init(&val->fsigrdataset);
val->magic = VALIDATOR_MAGIC;
isc_task_send(task, (isc_event_t **)&event);
*validatorp = val;
return (ISC_R_SUCCESS);
cleanup_event:
isc_task_detach(&tclone);
isc_event_free((isc_event_t **)&val->event);
cleanup_val:
dns_view_detach(&val->view);
isc_mem_put(view->mctx, val, sizeof *val);
return (result);
}
void
dns_validator_cancel(dns_validator_t *validator) {
isc_task_t *task;
REQUIRE(VALID_VALIDATOR(validator));
LOCK(&validator->lock);
if (validator->event != NULL) {
validator->event->result = ISC_R_CANCELED;
task = validator->event->ev_sender;
validator->event->ev_sender = validator;
isc_task_sendanddetach(&task,
(isc_event_t **)&validator->event);
if (validator->fetch != NULL)
dns_resolver_cancelfetch(validator->fetch);
if (validator->keyvalidator != NULL)
dns_validator_cancel(validator->keyvalidator);
}
UNLOCK(&validator->lock);
}
static void
destroy(dns_validator_t *val) {
isc_mem_t *mctx;
REQUIRE(SHUTDOWN(val));
REQUIRE(val->event == NULL);
REQUIRE(val->fetch == NULL);
#if 0
REQUIRE(val->currentset == NULL);
#endif
if (val->keynode != NULL)
dns_keytable_detachkeynode(val->keytable, &val->keynode);
else if (val->key != NULL)
dst_key_free(&val->key);
if (val->keyvalidator != NULL)
dns_validator_destroy(&val->keyvalidator);
if (val->authvalidator != NULL)
dns_validator_destroy(&val->authvalidator);
mctx = val->view->mctx;
if (val->siginfo != NULL)
isc_mem_put(mctx, val->siginfo, sizeof *val->siginfo);
isc_mutex_destroy(&val->lock);
dns_view_detach(&val->view);
val->magic = 0;
isc_mem_put(mctx, val, sizeof *val);
}
void
dns_validator_destroy(dns_validator_t **validatorp) {
dns_validator_t *val;
isc_boolean_t want_destroy = ISC_FALSE;
REQUIRE(validatorp != NULL);
val = *validatorp;
REQUIRE(VALID_VALIDATOR(val));
LOCK(&val->lock);
REQUIRE(val->event == NULL);
val->attributes |= VALATTR_SHUTDOWN;
if (val->fetch == NULL)
want_destroy = ISC_TRUE;
UNLOCK(&val->lock);
if (want_destroy)
destroy(val);
*validatorp = NULL;
}
static void
validator_logv(dns_validator_t *val, isc_logcategory_t *category,
isc_logmodule_t *module, int level, const char *fmt, va_list ap)
{
char msgbuf[2048];
vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
if (val->event != NULL && val->event->name != NULL) {
char namebuf[1024];
char typebuf[256];
isc_buffer_t b;
isc_region_t r;
dns_name_format(val->event->name, namebuf, sizeof(namebuf));
isc_buffer_init(&b, (unsigned char *)typebuf, sizeof(typebuf));
if (dns_rdatatype_totext(val->event->type, &b)
!= ISC_R_SUCCESS)
{
isc_buffer_clear(&b);
isc_buffer_putstr(&b, "<bad type>");
}
isc_buffer_usedregion(&b, &r);
isc_log_write(dns_lctx, category, module, level,
"validating %s %.*s: %s", namebuf,
(int)r.length, (char *)r.base, msgbuf);
} else {
isc_log_write(dns_lctx, category, module, level,
"validator @%p: %s", val, msgbuf);
}
}
static void
validator_log(dns_validator_t *val, int level, const char *fmt, ...)
{
va_list ap;
va_start(ap, fmt);
validator_logv(val, DNS_LOGCATEGORY_DNSSEC,
DNS_LOGMODULE_VALIDATOR, level, fmt, ap);
va_end(ap);
}