pullup: multiple validator bug fixes

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 57e82f8fa88497d25b3f5653f3641a12b5830a1e..b7274b4c1342a38bb863d66f5c986e91507a2816 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -5,17 +5,17 @@
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  * 
- * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
- * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
- * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
- * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
- * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
- * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
- * SOFTWARE.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.63.2.2 2000/07/27 21:39:44 gson Exp $ */
+/* $Id: validator.c,v 1.63.2.3 2000/07/27 22:50:02 gson Exp $ */
 
 #include <config.h>
 
@@ -72,6 +72,7 @@ struct dns_validator {
 
 #define VALATTR_SHUTDOWN               0x01
 #define VALATTR_FOUNDNONEXISTENCE      0x02
+#define VALATTR_TRIEDVERIFY            0x04
 #define SHUTDOWN(v)            (((v)->attributes & VALATTR_SHUTDOWN) != 0)
 
 static void
@@ -116,6 +117,28 @@ validator_done(dns_validator_t *val, isc_result_t result) {
        
 }
 
+static void
+auth_nonpending(dns_message_t *message) {
+       isc_result_t result;
+       dns_name_t *name;
+       dns_rdataset_t *rdataset;
+
+       for (result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
+            result == ISC_R_SUCCESS;
+            result = dns_message_nextname(message, DNS_SECTION_AUTHORITY))
+       {
+               name = NULL;
+               dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
+               for (rdataset = ISC_LIST_HEAD(name->list);
+                    rdataset != NULL;
+                    rdataset = ISC_LIST_NEXT(rdataset, link))
+               {
+                       if (rdataset->trust == dns_trust_pending)
+                               rdataset->trust = dns_trust_authauthority;
+               }
+       }
+}
+
 static void
 fetch_callback_validator(isc_task_t *task, isc_event_t *event) {
        dns_fetchevent_t *devent;
@@ -460,6 +483,7 @@ negauthvalidated(isc_task_t *task, isc_event_t *event) {
                val->attributes |= VALATTR_FOUNDNONEXISTENCE;
                validator_log(val, ISC_LOG_DEBUG(3),
                              "nonexistence proof found");
+               auth_nonpending(val->event->message);
                validator_done(val, ISC_R_SUCCESS);
        } else {
                validator_log(val, ISC_LOG_DEBUG(3), 
@@ -924,6 +948,7 @@ validate(dns_validator_t *val, isc_boolean_t resume) {
                }
 
                do {
+                       val->attributes |= VALATTR_TRIEDVERIFY;
                        result = dns_dnssec_verify(event->name,
                                                   event->rdataset,
                                                   val->key, ISC_FALSE,
@@ -1265,6 +1290,8 @@ validator_start(isc_task_t *task, isc_event_t *event) {
        LOCK(&val->lock);
 
        if (val->event->rdataset != NULL && val->event->sigrdataset != NULL) {
+               isc_result_t saved_result;
+
                /*
                 * This looks like a simple validation.  We say "looks like"
                 * because we don't know if wildcards are involved yet so it
@@ -1274,6 +1301,16 @@ validator_start(isc_task_t *task, isc_event_t *event) {
                              "attempting positive response validation");
        
                result = validate(val, ISC_FALSE);
+               if (result == DNS_R_NOVALIDSIG &&
+                   (val->attributes & VALATTR_TRIEDVERIFY) == 0)
+               {
+                       saved_result = result;
+                       validator_log(val, ISC_LOG_DEBUG(3),
+                                     "falling back to insecurity proof");
+                       result = proveunsecure(val, ISC_FALSE);
+                       if (result == DNS_R_NOTINSECURE)
+                               result = saved_result;
+               }
        } else if (val->event->rdataset != NULL) {
                /*
                 * This is either an unsecure subdomain or a response from
@@ -1507,6 +1544,7 @@ static void
 validator_log(dns_validator_t *val, int level, const char *fmt, ...)
 {
         va_list ap;
+
        va_start(ap, fmt);
        validator_logv(val, DNS_LOGCATEGORY_DNSSEC,
                       DNS_LOGMODULE_VALIDATOR, level, fmt, ap);