Do not mark additional section items bogus.

git-svn-id: file:///svn/unbound/trunk@1222 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/doc/Changelog b/doc/Changelog
index 61645438f558c7514b487137f80e5fc640c64d40..3b6690ef75e612a1a6a3bdc63b51fb41d8783c85 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,8 @@
 2 September 2008: Wouter
        - DoS protection features. Queries are jostled out to make room.
        - testbound can pass time, increasing the internal timer.
+       - do not mark unsigned additionals bogus, leave unchecked, which
+         is removed too.
 
 1 September 2008: Wouter
        - disallow nonrecursive queries for cache snooping by default.

diff --git a/doc/plan b/doc/plan
index f7aae9057dcf9c130ebb95358d70d1da203b66b9..ef105118fca5359525d903d571de1dca143b1346 100644 (file)
--- a/doc/plan
+++ b/doc/plan
@@ -34,9 +34,9 @@ total 6 of 8 weeks; 2 weeks for maintenance activities.
 + DoS vector, flush more.
        50% of max is for run-to-completion
        50% rest is for lifo queue with 100-200 msec timeout.
-* records in the additional section should not be marked bogus
-if they have no signer or a different signed. Validate if you can,
-otherwise leave unchecked.
++ records in the additional section should not be marked bogus
+  if they have no signer or a different signed. Validate if you can,
+  otherwise leave unchecked.
 * block DNS rebinding attacks, block all A records from 1918 IP blocks,
 like dnswall does.  Allow certain subdomains to do it, config options.
        one option that controls on/off of all private space.

diff --git a/validator/val_utils.c b/validator/val_utils.c
index 1432a715c3b8be20b63aa78509d52aaecd3103f0..f982034f2867ee2ead5cedef5da3e2138a9826fb 100644 (file)
--- a/validator/val_utils.c
+++ b/validator/val_utils.c
@@ -150,13 +150,7 @@ rrsig_get_signer(uint8_t* data, size_t len, uint8_t** sname, size_t* slen)
        *sname = data;
 }
 
-/**
- * Find the signer name for an RRset.
- * @param rrset: the rrset.
- * @param sname: signer name is returned or NULL if not signed.
- * @param slen: length of sname (or 0).
- */
-static void 
+void 
 val_find_rrset_signer(struct ub_packed_rrset_key* rrset, uint8_t** sname,
        size_t* slen)
 {

diff --git a/validator/val_utils.h b/validator/val_utils.h
index e56ecb9c2d5b7cd73b8d955413a8894b95f6c4b7..c85f503925fcabec61ca0b3fb0db225fd2385631 100644 (file)
--- a/validator/val_utils.h
+++ b/validator/val_utils.h
@@ -257,6 +257,15 @@ void val_mark_insecure(struct reply_info* rep, struct key_entry_key* kkey,
  */
 size_t val_next_unchecked(struct reply_info* rep, size_t skip);
 
+/**
+ * Find the signer name for an RRset.
+ * @param rrset: the rrset.
+ * @param sname: signer name is returned or NULL if not signed.
+ * @param slen: length of sname (or 0).
+ */
+void val_find_rrset_signer(struct ub_packed_rrset_key* rrset, uint8_t** sname,
+       size_t* slen);
+
 /**
  * Get string to denote the classification result.
  * @param subtype: from classification function.

diff --git a/validator/validator.c b/validator/validator.c
index 90770312b7f69ae1f7ca569977e0d7f635d6afbe..ec7f1241add75034f20ef5f9d0061c1d8de3860a 100644 (file)
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -373,7 +373,8 @@ validate_msg_signatures(struct module_env* env, struct val_env* ve,
        struct query_info* qchase, struct reply_info* chase_reply, 
        struct key_entry_key* key_entry)
 {
-       size_t i;
+       uint8_t* sname;
+       size_t i, slen;
        struct ub_packed_rrset_key* s;
        enum sec_status sec;
        int dname_seen = 0;
@@ -438,7 +439,11 @@ validate_msg_signatures(struct module_env* env, struct val_env* ve,
        for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets; 
                i<chase_reply->rrset_count; i++) {
                s = chase_reply->rrsets[i];
-               (void)val_verify_rrset_entry(env, ve, s, key_entry);
+               /* only validate rrs that have signatures with the key */
+               /* leave others unchecked, those get removed later on too */
+               val_find_rrset_signer(s, &sname, &slen);
+               if(sname && query_dname_compare(sname, key_entry->name)==0)
+                       (void)val_verify_rrset_entry(env, ve, s, key_entry);
                /* the additional section can fail to be secure, 
                 * it is optional, check signature in case we need
                 * to clean the additional section later. */