lib/dns/validator.c
/*%
 * Attempt to verify the rdataset using the given key and rdata (RRSIG).
 * The signature was good and from a wildcard record and the QNAME does
 * not match the wildcard we need to look for a NOQNAME proof.
 *
 * Returns:
 * \li	ISC_R_SUCCESS if the verification succeeds.
 * \li	Others if the verification fails.
 */
%
Attempt to verify the rdataset using the given key and rdata (RRSIG).
The signature was good and from a wildcard record and the QNAME does
not match the wildcard we need to look for a NOQNAME proof.

\li  ISC_R_SUCCESS if the verification succeeds.
\li  Others if the verification fails.
% Attempt to verify the rdataset using the given key and rdata ( RRSIG ) . The signature was good and from a wildcard record and the QNAME does not match the wildcard we need to look for a NOQNAME proof . \ li ISC_R_SUCCESS if the verification succeeds . \ li Others if the verification fails .
static isc_result_t
verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
       isc_uint16_t keyid)
{
	isc_result_t result;
	dns_fixedname_t fixed;
	isc_boolean_t ignore = ISC_FALSE;
	val->attributes |= VALATTR_TRIEDVERIFY;
	dns_fixedname_init(&fixed);
 again:
	result = dns_dnssec_verify2(val->event->name, val->event->rdataset,
				    key, ignore, val->view->mctx, rdata,
				    dns_fixedname_name(&fixed));
	if (result == DNS_R_SIGEXPIRED && val->view->acceptexpired) {
		ignore = ISC_TRUE;
		goto again;
	}
	if (ignore && (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD))
		validator_log(val, ISC_LOG_INFO,
			      "accepted expired %sRRSIG (keyid=%u)",
			      (result == DNS_R_FROMWILDCARD) ?
			      "wildcard " : "", keyid);
	else
		validator_log(val, ISC_LOG_DEBUG(3),
			      "verify rdataset (keyid=%u): %s",
			      keyid, isc_result_totext(result));
	if (result == DNS_R_FROMWILDCARD) {
		if (!dns_name_equal(val->event->name,
				    dns_fixedname_name(&fixed)))
			val->attributes |= VALATTR_NEEDNOQNAME;
		result = ISC_R_SUCCESS;
	}
	return (result);
}
static isc_result_t verify ( dns_validator_t * val , dst_key_t * key , dns_rdata_t * rdata , isc_uint16_t keyid ) { isc_result_t result ; dns_fixedname_t fixed ; isc_boolean_t ignore = ISC_FALSE ; val -> attributes |= VALATTR_TRIEDVERIFY ; dns_fixedname_init ( & fixed ) ; again : result = dns_dnssec_verify2 ( val -> event -> name , val -> event -> rdataset , key , ignore , val -> view -> mctx , rdata , dns_fixedname_name ( & fixed ) ) ; if ( result == DNS_R_SIGEXPIRED && val -> view -> acceptexpired ) { ignore = ISC_TRUE ; goto again ; } if ( ignore && ( result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD ) ) validator_log ( val , ISC_LOG_INFO , " " , ( result == DNS_R_FROMWILDCARD ) ? " " : " " , keyid ) ; else validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " , keyid , isc_result_totext ( result ) ) ; if ( result == DNS_R_FROMWILDCARD ) { if ( ! dns_name_equal ( val -> event -> name , dns_fixedname_name ( & fixed ) ) ) val -> attributes |= VALATTR_NEEDNOQNAME ; result = ISC_R_SUCCESS ; } return ( result ) ; }
%
 Attempt to verify the rdataset using the given key and rdata (RRSIG).
% Attempt to verify the rdataset using the given key and rdata ( RRSIG ) .