Fail the DNSSEC validation on the first failure

Be more strict when encountering DNSSEC validation failures - fail on
the first failure.  This will break domains that have DNSSEC signing
keys with duplicate key ids, but this is something that's much easier
to fix on the authoritative side, so we are just going to be strict
on the resolver side where it is causing performance problems.

diff --git a/lib/dns/include/dns/validator.h b/lib/dns/include/dns/validator.h
index cc4478d6d46ccdbd24a27df1893b23bb917c81c2..b4bf8f29db331e488ce8fa559d1dfe56944796e2 100644 (file)
--- a/lib/dns/include/dns/validator.h
+++ b/lib/dns/include/dns/validator.h
@@ -160,6 +160,7 @@ struct dns_validator {
        unsigned int                    depth;
        unsigned int                    authcount;
        unsigned int                    authfail;
+       bool                            failed;
        isc_stdtime_t                   start;
 };
 

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 2a5c3caa6ab51b9d69afd716591eed1341e0c87a..1a1cf00258f1965349389364353c6d2d98b0a9f0 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -1241,6 +1241,8 @@ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
                                    (dns_secalg_t)dst_key_alg(val->key) &&
                            siginfo->keyid ==
                                    (dns_keytag_t)dst_key_id(val->key) &&
+                           (dst_key_flags(val->key) & DNS_KEYFLAG_REVOKE) ==
+                                   0 &&
                            dst_key_iszonekey(val->key))
                        {
                                if (foundold) {
@@ -1633,37 +1635,13 @@ validate(dns_validator_t *val, bool resume) {
                        continue;
                }
 
-               do {
-                       vresult = verify(val, val->key, &rdata,
-                                       val->siginfo->keyid);
-                       if (vresult == ISC_R_SUCCESS)
-                               break;
-                       if (val->keynode != NULL) {
-                               dns_keynode_t *nextnode = NULL;
-                               result = dns_keytable_findnextkeynode(
-                                                       val->keytable,
-                                                       val->keynode,
-                                                       &nextnode);
-                               dns_keytable_detachkeynode(val->keytable,
-                                                          &val->keynode);
-                               val->keynode = nextnode;
-                               if (result != ISC_R_SUCCESS) {
-                                       val->key = NULL;
-                                       break;
-                               }
-                               val->key = dns_keynode_key(val->keynode);
-                               if (val->key == NULL)
-                                       break;
-                       } else {
-                               if (get_dst_key(val, val->siginfo, val->keyset)
-                                   != ISC_R_SUCCESS)
-                                       break;
-                       }
-               } while (1);
-               if (vresult != ISC_R_SUCCESS)
+               vresult = verify(val, val->key, &rdata,
+                               val->siginfo->keyid);
+               if (vresult != ISC_R_SUCCESS) {
+                       val->failed = true;
                        validator_log(val, ISC_LOG_DEBUG(3),
                                      "failed to verify rdataset");
-               else {
+               } else {
                        dns_rdataset_trimttl(event->rdataset,
                                             event->sigrdataset,
                                             val->siginfo, val->start,
@@ -1700,9 +1678,13 @@ validate(dns_validator_t *val, bool resume) {
                } else {
                        validator_log(val, ISC_LOG_DEBUG(3),
                                      "verify failure: %s",
-                                     isc_result_totext(result));
+                                     isc_result_totext(vresult));
                        resume = false;
                }
+               if (val->failed) {
+                       result = ISC_R_NOMORE;
+                       break;
+               }
        }
        if (result != ISC_R_NOMORE) {
                validator_log(val, ISC_LOG_DEBUG(3),