Fix signature checking for NSEC3 records in do_secure_trace.

See bug #372

diff --git a/dnssec_verify.c b/dnssec_verify.c
index 352e44066b15eb40feecb9e87f21498a297e181d..e1c75d56c7182174f132de8fbdad1d29f644718c 100644 (file)
--- a/dnssec_verify.c
+++ b/dnssec_verify.c
@@ -1398,12 +1398,13 @@ ldns_dnssec_verify_denial(ldns_rr *rr,
 
 #ifdef HAVE_SSL
 ldns_status
-ldns_dnssec_verify_denial_nsec3(ldns_rr *rr,
+ldns_dnssec_verify_denial_nsec3_match(ldns_rr *rr,
                                                  ldns_rr_list *nsecs,
                                                  ldns_rr_list *rrsigs,
                                                  ldns_pkt_rcode packet_rcode,
                                                  ldns_rr_type packet_qtype,
-                                                 bool packet_nodata)
+                                                 bool packet_nodata,
+                                                 ldns_rr **match)
 {
        ldns_rdf *closest_encloser;
        ldns_rdf *wildcard;
@@ -1416,6 +1417,10 @@ ldns_dnssec_verify_denial_nsec3(ldns_rr *rr,
 
        rrsigs = rrsigs;
 
+       if (match) {
+               *match = NULL;
+       }
+
        zone_name = ldns_dname_left_chop(ldns_rr_owner(ldns_rr_list_rr(nsecs,0)));
 
        /* section 8.4 */
@@ -1442,6 +1447,9 @@ ldns_dnssec_verify_denial_nsec3(ldns_rr *rr,
                        if (ldns_nsec_covers_name(ldns_rr_list_rr(nsecs, i),
                                                                 hashed_wildcard_name)) {
                                wildcard_covered = true;
+                               if (match) {
+                                       *match = ldns_rr_list_rr(nsecs, i);
+                               }
                        }
                        ldns_rdf_deep_free(hashed_wildcard_name);
                }
@@ -1474,6 +1482,9 @@ ldns_dnssec_verify_denial_nsec3(ldns_rr *rr,
                                            ldns_nsec3_bitmap(ldns_rr_list_rr(nsecs, i)),
                                            LDNS_RR_TYPE_CNAME)) {
                                        result = LDNS_STATUS_OK;
+                                       if (match) {
+                                               *match = ldns_rr_list_rr(nsecs, i);
+                                       }
                                        goto done;
                                }
                        }
@@ -1500,6 +1511,9 @@ ldns_dnssec_verify_denial_nsec3(ldns_rr *rr,
                                            ldns_nsec3_bitmap(ldns_rr_list_rr(nsecs, i)),
                                            LDNS_RR_TYPE_CNAME)) {
                                        result = LDNS_STATUS_OK;
+                                       if (match) {
+                                               *match = ldns_rr_list_rr(nsecs, i);
+                                       }
                                        goto done;
                                }
                        }
@@ -1513,6 +1527,22 @@ ldns_dnssec_verify_denial_nsec3(ldns_rr *rr,
        ldns_rdf_deep_free(zone_name);
        return result;
 }
+
+ldns_status
+ldns_dnssec_verify_denial_nsec3(ldns_rr *rr,
+                                                 ldns_rr_list *nsecs,
+                                                 ldns_rr_list *rrsigs,
+                                                 ldns_pkt_rcode packet_rcode,
+                                                 ldns_rr_type packet_qtype,
+                                                 bool packet_nodata)
+{
+       return ldns_dnssec_verify_denial_nsec3_match(
+                               rr, nsecs, rrsigs, packet_rcode,
+                               packet_qtype, packet_nodata, NULL
+              );
+}
+
+
 #endif /* HAVE_SSL */
 
 #ifdef USE_GOST

diff --git a/drill/dnssec.c b/drill/dnssec.c
index 930ac7ce13188ec7229c7c0ba8989b53b859dcdb..030aa3bb73f529a2829256d5ca1fadb134f90783 100644 (file)
--- a/drill/dnssec.c
+++ b/drill/dnssec.c
@@ -215,6 +215,7 @@ ldns_verify_denial(ldns_pkt *pkt, ldns_rdf *name, ldns_rr_type type, ldns_rr_lis
        } else if( (nsecs = ldns_pkt_rr_list_by_type(pkt, LDNS_RR_TYPE_NSEC3, LDNS_SECTION_ANY_NOQUESTION)) ) {
                 ldns_rr_list* sigs = ldns_pkt_rr_list_by_type(pkt, LDNS_RR_TYPE_RRSIG, LDNS_SECTION_ANY_NOQUESTION);
                 ldns_rr* q = ldns_rr_new();
+               ldns_rr* match = NULL;
                 if(!sigs) return LDNS_STATUS_MEM_ERR;
                 if(!q) return LDNS_STATUS_MEM_ERR;
                 ldns_rr_set_question(q, 1);
@@ -223,7 +224,11 @@ ldns_verify_denial(ldns_pkt *pkt, ldns_rdf *name, ldns_rr_type type, ldns_rr_lis
                 if(!ldns_rr_owner(q)) return LDNS_STATUS_MEM_ERR;
                 ldns_rr_set_type(q, type);
                 
-                result = ldns_dnssec_verify_denial_nsec3(q, nsecs, sigs, ldns_pkt_get_rcode(pkt), type, ldns_pkt_ancount(pkt) == 0);
+                /* result = ldns_dnssec_verify_denial_nsec3(q, nsecs, sigs, ldns_pkt_get_rcode(pkt), type, ldns_pkt_ancount(pkt) == 0); */
+                result = ldns_dnssec_verify_denial_nsec3_match(q, nsecs, sigs, ldns_pkt_get_rcode(pkt), type, ldns_pkt_ancount(pkt) == 0, &match);
+               if (result == LDNS_STATUS_OK && match && nsec_rrs && nsec_rr_sigs) {
+                       (void) get_dnssec_rr(pkt, ldns_rr_owner(match), LDNS_RR_TYPE_NSEC3, nsec_rrs, nsec_rr_sigs);
+               }
                 ldns_rr_free(q);
                ldns_rr_list_deep_free(nsecs);
                ldns_rr_list_deep_free(sigs);

diff --git a/ldns/dnssec_verify.h b/ldns/dnssec_verify.h
index 8d380f9ceed41a4576b7701053e386b7572bf773..91b5b6d3ec86fd98dff82b6291d6b888ff157cec 100644 (file)
--- a/ldns/dnssec_verify.h
+++ b/ldns/dnssec_verify.h
@@ -399,6 +399,26 @@ ldns_status ldns_dnssec_verify_denial_nsec3(ldns_rr *rr,
  * \param[in] algo Signing algorithm
  * \return status LDNS_STATUS_OK if the data verifies. Error if not.
  */
+ldns_status ldns_dnssec_verify_denial_nsec3_match(ldns_rr *rr,
+                                                                   ldns_rr_list *nsecs,
+                                                                   ldns_rr_list *rrsigs,
+                                                                   ldns_pkt_rcode packet_rcode,
+                                                                   ldns_rr_type packet_qtype,
+                                                                   bool packet_nodata,
+                                                                   ldns_rr **match);
+/**
+ * Same as ldns_status ldns_dnssec_verify_denial_nsec3 but also returns
+ * the nsec rr that matched.
+ * This function should probably not be used directly.
+ *
+ * \param[in] rawsig_buf Buffer containing signature data to use
+ * \param[in] verify_buf Buffer containing data to verify
+ * \param[in] key_buf Buffer containing key data to use
+ * \param[in] algo Signing algorithm
+ * \return status LDNS_STATUS_OK if the data verifies. Error if not.
+ */
+
+
 ldns_status ldns_verify_rrsig_buffers(ldns_buffer *rawsig_buf,
                                                           ldns_buffer *verify_buf,
                                                           ldns_buffer *key_buf,