ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Complete the deferred validation if there are no RRSIGs

Browse Source 
When a query is made with CD=1, we store the result in the
cache marked pending so that it can be validated later, at
which time it will either be accepted as an answer or removed
from the cache as invalid.  Deferred validation was not
attempted when there were no cached RRSIGs for DNSKEY and
DS.  We now complete the deferred validation in this scenario.

(cherry picked from commit 8b900d1808)
This commit is contained in:
Mark Andrews
2024-12-20 20:24:05 +11:00
parent 77417f8fc6
commit de8893733f
1 changed files with 21 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
lib/dns/validator.c
View File

@@ -1137,14 +1137,13 @@ seek_dnskey(dns_validator_t *val) {
* We have an rrset for the given keyname.
*/
val->keyset = &val->frdataset;
if ((DNS_TRUST_PENDING(val->frdataset.trust) ||
DNS_TRUST_ANSWER(val->frdataset.trust)) &&
dns_rdataset_isassociated(&val->fsigrdataset))
if (DNS_TRUST_PENDING(val->frdataset.trust) ||
DNS_TRUST_ANSWER(val->frdataset.trust))
{
/*
* We know the key but haven't validated it yet or
* we have a key of trust answer but a DS
* record for the zone may have been added.
* We know the key but haven't validated it yet, or
* we had a key with trust level "answer" and
* a DS record for the zone has now been added.
*/
result = create_validator(
val, &siginfo->signer, dns_rdatatype_dnskey,
@@ -1154,12 +1153,6 @@ seek_dnskey(dns_validator_t *val) {
return result;
}
return DNS_R_WAIT;
} else if (DNS_TRUST_PENDING(val->frdataset.trust)) {
/*
* Having a pending key with no signature means that
* something is broken.
*/
result = DNS_R_CONTINUE;
} else if (val->frdataset.trust < dns_trust_secure) {
/*
* The key is legitimately insecure. There's no
@@ -1917,9 +1910,8 @@ get_dsset(dns_validator_t *val, dns_name_t *tname, isc_result_t *resp) {
* We have a DS RRset.
*/
val->dsset = &val->frdataset;
if ((DNS_TRUST_PENDING(val->frdataset.trust) ||
DNS_TRUST_ANSWER(val->frdataset.trust)) &&
dns_rdataset_isassociated(&val->fsigrdataset))
if (DNS_TRUST_PENDING(val->frdataset.trust) ||
DNS_TRUST_ANSWER(val->frdataset.trust))
{
/*
* ... which is signed but not yet validated.
@@ -1927,21 +1919,12 @@ get_dsset(dns_validator_t *val, dns_name_t *tname, isc_result_t *resp) {
result = create_validator(
val, tname, dns_rdatatype_ds, &val->frdataset,
&val->fsigrdataset, validator_callback_ds,
"validate_dnskey");
"get_dsset");
*resp = DNS_R_WAIT;
if (result != ISC_R_SUCCESS) {
*resp = result;
}
return ISC_R_COMPLETE;
} else if (DNS_TRUST_PENDING(val->frdataset.trust)) {
/*
* There should never be an unsigned DS.
*/
disassociate_rdatasets(val);
validator_log(val, ISC_LOG_DEBUG(2),
"unsigned DS record");
*resp = DNS_R_NOVALIDSIG;
return ISC_R_COMPLETE;
}
break;
@@ -3019,7 +3002,7 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
val, ISC_LOG_DEBUG(3),
"no supported algorithm/digest (%s/DS)",
namebuf);
*resp = markanswer(val, "proveunsecure (5)",
*resp = markanswer(val, "seek_ds (1)",
"no supported "
"algorithm/digest (DS)");
return ISC_R_COMPLETE;
@@ -3031,22 +3014,12 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
/*
* Otherwise, try to validate it now.
*/
if (dns_rdataset_isassociated(&val->fsigrdataset)) {
result = create_validator(
val, tname, dns_rdatatype_ds, &val->frdataset,
&val->fsigrdataset, validator_callback_ds,
"proveunsecure");
*resp = DNS_R_WAIT;
if (result != ISC_R_SUCCESS) {
*resp = result;
}
} else {
/*
* There should never be an unsigned DS.
*/
validator_log(val, ISC_LOG_DEBUG(3),
"unsigned DS record");
*resp = DNS_R_NOVALIDSIG;
result = create_validator(val, tname, dns_rdatatype_ds,
&val->frdataset, &val->fsigrdataset,
validator_callback_ds, "seek_ds");
*resp = DNS_R_WAIT;
if (result != ISC_R_SUCCESS) {
*resp = result;
}
return ISC_R_COMPLETE;
@@ -3057,7 +3030,7 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
*/
*resp = DNS_R_WAIT;
result = create_fetch(val, tname, dns_rdatatype_ds,
fetch_callback_ds, "proveunsecure");
fetch_callback_ds, "seek_ds");
if (result != ISC_R_SUCCESS) {
*resp = result;
}
@@ -3078,7 +3051,7 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
result = create_validator(
val, tname, dns_rdatatype_ds, &val->frdataset,
&val->fsigrdataset, validator_callback_ds,
"proveunsecure");
"seek_ds");
*resp = DNS_R_WAIT;
if (result != ISC_R_SUCCESS) {
*resp = result;
@@ -3098,7 +3071,7 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
NULL) == ISC_R_SUCCESS &&
dns_name_equal(tname, found))
{
*resp = markanswer(val, "proveunsecure (3)",
*resp = markanswer(val, "seek_ds (2)",
"no DS at zone cut");
return ISC_R_COMPLETE;
}
@@ -3118,7 +3091,7 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
}
if (isdelegation(tname, &val->frdataset, result)) {
*resp = markanswer(val, "proveunsecure (4)",
*resp = markanswer(val, "seek_ds (3)",
"this is a delegation");
return ISC_R_COMPLETE;
}
@@ -3150,7 +3123,7 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
result = create_validator(
val, tname, dns_rdatatype_ds, &val->frdataset,
&val->fsigrdataset, validator_callback_ds,
"proveunsecure");
"seek_ds");
if (result != ISC_R_SUCCESS) {
*resp = result;
}
@@ -3179,9 +3152,7 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
result = create_validator(
val, tname, dns_rdatatype_cname,
&val->frdataset, &val->fsigrdataset,
validator_callback_cname,
"proveunsecure "
"(cname)");
validator_callback_cname, "seek_ds (cname)");
*resp = DNS_R_WAIT;
if (result != ISC_R_SUCCESS) {
*resp = result;