ldns_rr_list *new_nss_aaaa;
ldns_rr_list *final_answer;
ldns_rr_list *new_nss;
- ldns_rr_list *hostnames;
ldns_rr_list *ns_addr;
uint16_t loop_count;
ldns_rdf *pop;
return NULL;
}
- hostnames = ldns_get_rr_list_name_by_addr(local_res,
- ldns_pkt_answerfrom(p), 0, 0);
-
new_nss = ldns_pkt_authority(p);
final_answer = ldns_pkt_answer(p);
ldns_status result;
ldns_rr *orig_rr = NULL;
- bool cname_followed = false;
/*
ldns_rr_list *sigs;
ldns_rr *cur_sig;
/* answer might be a cname, chase that first, then chase
cname target? (TODO) */
if (!rrset) {
- cname_followed = true;
rrset = ldns_pkt_rr_list_by_name_and_type(pkt,
name,
LDNS_RR_TYPE_CNAME,
ldns_rr *nsec;
ldns_rr *result = NULL;
- ldns_status status;
-
const ldns_rr_descriptor *descriptor;
ldns_rdf *zone_name;
hashed_sname = ldns_nsec3_hash_name(sname, algorithm, iterations, salt_length, salt);
zone_name = ldns_dname_left_chop(ldns_rr_owner(nsec));
- status = ldns_dname_cat(hashed_sname, zone_name);
+ (void)ldns_dname_cat(hashed_sname, zone_name);
if (verbosity >= 4) {
ldns_rdf_print(stdout, hashed_sname);
uint8_t *salt;
ldns_rdf *sname, *hashed_sname, *tmp;
- ldns_rr *ce;
bool flag;
bool exact_match_found;
bool in_range_found;
- ldns_status status;
ldns_rdf *zone_name;
size_t nsec_i;
sname = ldns_rdf_clone(qname);
- ce = NULL;
flag = false;
zone_name = ldns_dname_left_chop(ldns_rr_owner(nsec));
}
hashed_sname = ldns_nsec3_hash_name(sname, algorithm, iterations, salt_length, salt);
- status = ldns_dname_cat(hashed_sname, zone_name);
+ (void) ldns_dname_cat(hashed_sname, zone_name);
if (verbosity >= 3) {
ldns_rdf_print(stdout, hashed_sname);
/* todo checks from end of 6.2. here or in caller? */
return result;
}
-
-
-/* special case were there was a wildcard expansion match, the exact match must be disproven */
-ldns_status
-ldns_verify_denial_wildcard(ldns_pkt *pkt, ldns_rdf *name, ldns_rr_type type, ldns_rr_list **nsec_rrs, ldns_rr_list **nsec_rr_sigs)
-{
- ldns_rdf *nsec3_ce = NULL;
- ldns_rr *nsec3_ex = NULL;
- ldns_rdf *wildcard_name = NULL;
- ldns_rdf *nsec3_wc_ce = NULL;
- ldns_rr *nsec3_wc_ex = NULL;
- ldns_rdf *chopped_dname = NULL;
- ldns_rr_list *nsecs;
- ldns_status result = LDNS_STATUS_ERR;
-
- nsecs = ldns_pkt_rr_list_by_type(pkt, LDNS_RR_TYPE_NSEC3, LDNS_SECTION_ANY_NOQUESTION);
- if (nsecs) {
- wildcard_name = ldns_dname_new_frm_str("*");
- chopped_dname = ldns_dname_left_chop(name);
- result = ldns_dname_cat(wildcard_name, chopped_dname);
- ldns_rdf_deep_free(chopped_dname);
-
- nsec3_ex = ldns_nsec3_exact_match(name, type, nsecs);
- nsec3_ce = ldns_nsec3_closest_encloser(name, type, nsecs);
- nsec3_wc_ce = ldns_nsec3_closest_encloser(wildcard_name, type, nsecs);
- nsec3_wc_ex = ldns_nsec3_exact_match(wildcard_name, type, nsecs);
-
- if (nsec3_ex) {
- if (verbosity >= 3) {
- printf(";; Error, exact match for for name found, but should not exist (draft -07 section 8.8)\n");
- }
- result = LDNS_STATUS_NSEC3_ERR;
- } else if (!nsec3_ce) {
- if (verbosity >= 3) {
- printf(";; Error, closest encloser for exact match missing in wildcard response (draft -07 section 8.8)\n");
- }
- result = LDNS_STATUS_NSEC3_ERR;
-/*
- } else if (!nsec3_wc_ex) {
- printf(";; Error, no wildcard nsec3 match: ");
- ldns_rdf_print(stdout, wildcard_name);
- printf(" (draft -07 section 8.8)\n");
- result = LDNS_STATUS_NSEC3_ERR;
-*/
-/* } else if (!nsec */
- } else {
- if (verbosity >= 3) {
- printf(";; wilcard expansion proven\n");
- }
- result = LDNS_STATUS_OK;
- }
- } else {
- if (verbosity >= 3) {
- printf(";; Error: no NSEC or NSEC3 records in answer\n");
- }
- result = LDNS_STATUS_CRYPTO_NO_RRSIG;
- }
-
- if (nsecs && nsec_rrs && nsec_rr_sigs) {
- (void) get_dnssec_rr(pkt, ldns_rr_owner(ldns_rr_list_rr(nsecs, 0)), LDNS_RR_TYPE_NSEC3, nsec_rrs, nsec_rr_sigs);
- }
- return result;
-}
-
-
ldns_rr_type type,
ldns_rr_list **nsec_rrs,
ldns_rr_list **nsec_rr_sigs);
-ldns_status ldns_verify_denial_wildcard(ldns_pkt *pkt,
- ldns_rdf *name,
- ldns_rr_type type,
- ldns_rr_list **nsec_rrs,
- ldns_rr_list **nsec_rr_sigs);
ldns_status read_key_file(const char *filename, ldns_rr_list *key_list);
ldns_pkt *read_hex_pkt(char *filename);
{
ldns_resolver *res;
ldns_pkt *p, *local_p;
- ldns_rr_list *new_nss_a;
- ldns_rr_list *new_nss_aaaa;
ldns_rr_list *new_nss;
ldns_rr_list *ns_addr;
- uint16_t loop_count;
ldns_rdf *pop;
ldns_rdf **labels = NULL;
ldns_status status, st;
size_t k;
size_t l;
uint8_t labels_count;
- ldns_pkt_type pt;
/* dnssec */
ldns_rr_list *key_list;
descriptor = ldns_rr_descript(t);
- loop_count = 0;
- new_nss_a = NULL;
- new_nss_aaaa = NULL;
new_nss = NULL;
ns_addr = NULL;
key_list = NULL;
ds_list = NULL;
- pt = LDNS_PACKET_UNKNOWN;
p = NULL;
local_p = NULL;
keys used to sign these is trusted, add the keys to
the trusted list */
p = get_dnssec_pkt(res, labels[i], LDNS_RR_TYPE_DNSKEY);
- pt = get_key(p, labels[i], &key_list, &key_sig_list);
+ (void) get_key(p, labels[i], &key_list, &key_sig_list);
if (key_sig_list) {
if (key_list) {
current_correct_keys = ldns_rr_list_new();
/* check the DS records for the next child domain */
if (i > 1) {
p = get_dnssec_pkt(res, labels[i-1], LDNS_RR_TYPE_DS);
- pt = get_ds(p, labels[i-1], &ds_list, &ds_sig_list);
+ (void) get_ds(p, labels[i-1], &ds_list, &ds_sig_list);
if (!ds_list) {
ldns_pkt_free(p);
if (ds_sig_list) {
ldns_rr_list_deep_free(ds_sig_list);
}
p = get_dnssec_pkt(res, name, LDNS_RR_TYPE_DNSKEY);
- pt = get_ds(p, NULL, &ds_list, &ds_sig_list);
+ (void) get_ds(p, NULL, &ds_list, &ds_sig_list);
}
if (ds_sig_list) {
if (ds_list) {
ldns_pkt_free(p);
ldns_rr_list_deep_free(ds_sig_list);
p = get_dnssec_pkt(res, labels[i-1], LDNS_RR_TYPE_DS);
- pt = get_ds(p, labels[i-1], &ds_list, &ds_sig_list);
+ (void) get_ds(p, labels[i-1], &ds_list, &ds_sig_list);
status = ldns_verify_denial(p, labels[i-1], LDNS_RR_TYPE_DS, &nsec_rrs, &nsec_rr_sigs);
} else {
/* if this is the last label, just verify the data and stop */
p = get_dnssec_pkt(res, labels[i], t);
- pt = get_dnssec_rr(p, labels[i], t, &dataset, &key_sig_list);
+ (void) get_dnssec_rr(p, labels[i], t, &dataset, &key_sig_list);
if (dataset && ldns_rr_list_rr_count(dataset) > 0) {
if (key_sig_list && ldns_rr_list_rr_count(key_sig_list) > 0) {
ldns_pkt_free(p);
}
- new_nss_aaaa = NULL;
- new_nss_a = NULL;
new_nss = NULL;
ns_addr = NULL;
ldns_rr_list_deep_free(key_list);
ldns_pkt *p;
ldns_rr_list *new_nss_a;
ldns_rr_list *new_nss_aaaa;
- ldns_rr_list *final_answer;
ldns_rr_list *new_nss;
ldns_rr_list *ns_addr;
ldns_rr_list *ns_addr2;
new_nss = NULL;
ns_addr = NULL;
ns_addr2 = NULL;
- final_answer = NULL;
p = ldns_pkt_new();
res = ldns_resolver_new();
fprintf(fp, " -e <date>\texpiration date\n");
fprintf(fp, " -f <file>\toutput zone to file (default <name>.signed)\n");
fprintf(fp, " -i <date>\tinception date\n");
- fprintf(fp, " -l\t\tLeave old DNSSEC RRSIGS and NSEC(3) records intact\n");
fprintf(fp, " -o <domain>\torigin for the zone\n");
fprintf(fp, " -v\t\tprint version and exit\n");
fprintf(fp, " -A\t\tsign DNSKEY with all keys instead of minimal\n");
ldns_status s;
size_t i;
ldns_rr_list *added_rrs;
- ldns_status status;
-
- bool leave_old_dnssec_data = false;
char *outputfile_name = NULL;
FILE *outputfile;
inception = (uint32_t) atol(optarg);
}
break;
- case 'l':
- leave_old_dnssec_data = true;
- break;
case 'n':
use_nsec3 = true;
break;
}
/* and, if not unset by -p, find or create the corresponding DNSKEY record */
if (key) {
- status = find_or_create_pubkey(keyfile_name_base,
- key, orig_zone,
- add_keys, ttl);
+ (void) find_or_create_pubkey(keyfile_name_base,
+ key, orig_zone,
+ add_keys, ttl);
}
argi++;
}
service(void)
{
fd_set rset, wset, eset;
- struct timeval timeout;
int count;
int maxfd;
/* service */
count = 0;
- timeout.tv_sec = 0;
- timeout.tv_usec = 0;
while (1) {
#ifndef S_SPLINT_S
FD_ZERO(&rset);
projects / thirdparty / ldns.git / commitdiff
