lib/dns/validator.c
/*%
 * We have been asked to look for a key.
 * If found resume the validation process.
 * If not found fail the validation process.
 */
%
We have been asked to look for a key.
If found resume the validation process.
If not found fail the validation process.
% We have been asked to look for a key . If found resume the validation process . If not found fail the validation process .
static void
fetch_callback_validator(isc_task_t *task, isc_event_t *event) {
	dns_fetchevent_t *devent;
	dns_validator_t *val;
	dns_rdataset_t *rdataset;
	isc_boolean_t want_destroy;
	isc_result_t result;
	isc_result_t eresult;
	isc_result_t saved_result;
	UNUSED(task);
	INSIST(event->ev_type == DNS_EVENT_FETCHDONE);
	devent = (dns_fetchevent_t *)event;
	val = devent->ev_arg;
	rdataset = &val->frdataset;
	eresult = devent->result;
	if (devent->node != NULL)
		dns_db_detachnode(devent->db, &devent->node);
	if (devent->db != NULL)
		dns_db_detach(&devent->db);
	if (dns_rdataset_isassociated(&val->fsigrdataset))
		dns_rdataset_disassociate(&val->fsigrdataset);
	isc_event_free(&event);
	dns_resolver_destroyfetch(&val->fetch);
	INSIST(val->event != NULL);
	validator_log(val, ISC_LOG_DEBUG(3), "in fetch_callback_validator");
	LOCK(&val->lock);
	if (CANCELED(val)) {
		validator_done(val, ISC_R_CANCELED);
	} else if (eresult == ISC_R_SUCCESS) {
		validator_log(val, ISC_LOG_DEBUG(3),
			      "keyset with trust %s",
			      dns_trust_totext(rdataset->trust));
		if (rdataset->trust >= dns_trust_secure) {
			result = get_dst_key(val, val->siginfo, rdataset);
			if (result == ISC_R_SUCCESS)
				val->keyset = &val->frdataset;
		}
		result = validate(val, ISC_TRUE);
		if (result == DNS_R_NOVALIDSIG &&
		    (val->attributes & VALATTR_TRIEDVERIFY) == 0)
		{
			saved_result = result;
			validator_log(val, ISC_LOG_DEBUG(3),
				      "falling back to insecurity proof");
			val->attributes |= VALATTR_INSECURITY;
			result = proveunsecure(val, ISC_FALSE, ISC_FALSE);
			if (result == DNS_R_NOTINSECURE)
				result = saved_result;
		}
		if (result != DNS_R_WAIT)
			validator_done(val, result);
	} else {
		validator_log(val, ISC_LOG_DEBUG(3),
			      "fetch_callback_validator: got %s",
			      isc_result_totext(eresult));
		if (eresult == ISC_R_CANCELED)
			validator_done(val, eresult);
		else
			validator_done(val, DNS_R_BROKENCHAIN);
	}
	want_destroy = exit_check(val);
	UNLOCK(&val->lock);
	if (want_destroy)
		destroy(val);
}
static void fetch_callback_validator ( isc_task_t * task , isc_event_t * event ) { dns_fetchevent_t * devent ; dns_validator_t * val ; dns_rdataset_t * rdataset ; isc_boolean_t want_destroy ; isc_result_t result ; isc_result_t eresult ; isc_result_t saved_result ; UNUSED ( task ) ; INSIST ( event -> ev_type == DNS_EVENT_FETCHDONE ) ; devent = ( dns_fetchevent_t * ) event ; val = devent -> ev_arg ; rdataset = & val -> frdataset ; eresult = devent -> result ; if ( devent -> node != NULL ) dns_db_detachnode ( devent -> db , & devent -> node ) ; if ( devent -> db != NULL ) dns_db_detach ( & devent -> db ) ; if ( dns_rdataset_isassociated ( & val -> fsigrdataset ) ) dns_rdataset_disassociate ( & val -> fsigrdataset ) ; isc_event_free ( & event ) ; dns_resolver_destroyfetch ( & val -> fetch ) ; INSIST ( val -> event != NULL ) ; validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " ) ; LOCK ( & val -> lock ) ; if ( CANCELED ( val ) ) { validator_done ( val , ISC_R_CANCELED ) ; } else if ( eresult == ISC_R_SUCCESS ) { validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " , dns_trust_totext ( rdataset -> trust ) ) ; if ( rdataset -> trust >= dns_trust_secure ) { result = get_dst_key ( val , val -> siginfo , rdataset ) ; if ( result == ISC_R_SUCCESS ) val -> keyset = & val -> frdataset ; } result = validate ( val , ISC_TRUE ) ; if ( result == DNS_R_NOVALIDSIG && ( val -> attributes & VALATTR_TRIEDVERIFY ) == 0 ) { saved_result = result ; validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " ) ; val -> attributes |= VALATTR_INSECURITY ; result = proveunsecure ( val , ISC_FALSE , ISC_FALSE ) ; if ( result == DNS_R_NOTINSECURE ) result = saved_result ; } if ( result != DNS_R_WAIT ) validator_done ( val , result ) ; } else { validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " , isc_result_totext ( eresult ) ) ; if ( eresult == ISC_R_CANCELED ) validator_done ( val , eresult ) ; else validator_done ( val , DNS_R_BROKENCHAIN ) ; } want_destroy = exit_check ( val ) ; UNLOCK ( & val -> lock ) ; if ( want_destroy ) destroy ( val ) ; }
%
 We have been asked to look for a key.
% We have been asked to look for a key .
/* Free resources which are not of interest. */ /*
		 * Only extract the dst key if the keyset is secure.
		 */