- disable-edns-do, validator init prints warning when disable-edns-do is

  turned on, but there are trust anchors, and then turns off disable-edns-do.

diff --git a/validator/val_anchor.c b/validator/val_anchor.c
index b1a54e1f0195ffad28ad962079dbf2bdd3f78804..8466a8923eb131649f5a2e0366ee98ff404a81c3 100644 (file)
--- a/validator/val_anchor.c
+++ b/validator/val_anchor.c
@@ -1322,3 +1322,24 @@ anchor_has_keytag(struct val_anchors* anchors, uint8_t* name, int namelabs,
        free(taglist);
        return 0;
 }
+
+struct trust_anchor*
+anchors_find_any_noninsecure(struct val_anchors* anchors)
+{
+       struct trust_anchor* ta, *next;
+       lock_basic_lock(&anchors->lock);
+       ta=(struct trust_anchor*)rbtree_first(anchors->tree);
+       while((rbnode_type*)ta != RBTREE_NULL) {
+               next = (struct trust_anchor*)rbtree_next(&ta->node);
+               lock_basic_lock(&ta->lock);
+               if(ta->numDS != 0 || ta->numDNSKEY != 0) {
+                       /* not an insecurepoint */
+                       lock_basic_unlock(&anchors->lock);
+                       return ta;
+               }
+               lock_basic_unlock(&ta->lock);
+               ta = next;
+       }
+       lock_basic_unlock(&anchors->lock);
+       return NULL;
+}

diff --git a/validator/val_anchor.h b/validator/val_anchor.h
index 1597a7d62fbe3fc277c58b9daf0dc250d2aa2da5..02e7e17b5210c31a5c702cb58cc94bddc4150022 100644 (file)
--- a/validator/val_anchor.h
+++ b/validator/val_anchor.h
@@ -240,4 +240,12 @@ size_t anchor_list_keytags(struct trust_anchor* ta, uint16_t* list, size_t num);
 int anchor_has_keytag(struct val_anchors* anchors, uint8_t* name, int namelabs,
        size_t namelen, uint16_t dclass, uint16_t keytag);
 
+/**
+ * Find an anchor that is not an insecure point, if any, or there are no
+ * DNSSEC verification anchors if none.
+ * @param anchors: anchor storage
+ * @return trust anchor or NULL. It is locked.
+ */
+struct trust_anchor* anchors_find_any_noninsecure(struct val_anchors* anchors);
+
 #endif /* VALIDATOR_VAL_ANCHOR_H */

diff --git a/validator/validator.c b/validator/validator.c
index 9de9d54db27c9f7c974506897fe64a0d398fd87f..e839484924c4864c000815af85d8a17c6312d3b7 100644 (file)
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -200,6 +200,17 @@ val_init(struct module_env* env, int id)
                log_err("validator: could not apply configuration settings.");
                return 0;
        }
+       if(env->cfg->disable_edns_do) {
+               struct trust_anchor* anchor = anchors_find_any_noninsecure(
+                       env->anchors);
+               if(anchor) {
+                       char b[257];
+                       dname_str(anchor->name, b);
+                       log_warn("validator: disable-edns-do is enabled, but there is a trust anchor for '%s'. Since DNSSEC could not work, the disable-edns-do setting is turned off. Continuing without it.", b);
+                       lock_basic_unlock(&anchor->lock);
+                       env->cfg->disable_edns_do = 0;
+               }
+       }
 
        return 1;
 }