lib/dns/validator.c
/*%
 * We were asked to look for the DS record as part of proving that a
 * name is unsecure.
 *
 * If the DS record doesn't exist and the query name corresponds to
 * a delegation point we are transitioning from a secure zone to a
 * unsecure zone.
 *
 * If the DS record exists it will be secure.  We can continue looking
 * for the break point in the chain of trust.
 */
%
We were asked to look for the DS record as part of proving that a
name is unsecure.

If the DS record doesn't exist and the query name corresponds to
a delegation point we are transitioning from a secure zone to a
unsecure zone.

If the DS record exists it will be secure.  We can continue looking
for the break point in the chain of trust.
% We were asked to look for the DS record as part of proving that a name is unsecure . If the DS record doesn ' t exist and the query name corresponds to a delegation point we are transitioning from a secure zone to a unsecure zone . If the DS record exists it will be secure . We can continue looking for the break point in the chain of trust .
static void
dsfetched2(isc_task_t *task, isc_event_t *event) {
	dns_fetchevent_t *devent;
	dns_validator_t *val;
	dns_name_t *tname;
	isc_boolean_t want_destroy;
	isc_result_t result;
	isc_result_t eresult;
	UNUSED(task);
	INSIST(event->ev_type == DNS_EVENT_FETCHDONE);
	devent = (dns_fetchevent_t *)event;
	val = devent->ev_arg;
	eresult = devent->result;
	if (devent->node != NULL)
		dns_db_detachnode(devent->db, &devent->node);
	if (devent->db != NULL)
		dns_db_detach(&devent->db);
	if (dns_rdataset_isassociated(&val->fsigrdataset))
		dns_rdataset_disassociate(&val->fsigrdataset);
	dns_resolver_destroyfetch(&val->fetch);
	INSIST(val->event != NULL);
	validator_log(val, ISC_LOG_DEBUG(3), "in dsfetched2: %s",
		      dns_result_totext(eresult));
	LOCK(&val->lock);
	if (CANCELED(val)) {
		validator_done(val, ISC_R_CANCELED);
	} else if (eresult == DNS_R_CNAME ||
		   eresult == DNS_R_NXRRSET ||
		   eresult == DNS_R_NCACHENXRRSET)
	{
		tname = dns_fixedname_name(&devent->foundname);
		if (eresult != DNS_R_CNAME &&
		    isdelegation(tname, &val->frdataset, eresult)) {
			if (val->mustbesecure) {
				validator_log(val, ISC_LOG_WARNING,
					      "must be secure failure, no DS"
					      " and this is a delegation");
				validator_done(val, DNS_R_MUSTBESECURE);
			} else if (val->view->dlv == NULL || DLVTRIED(val)) {
				markanswer(val, "dsfetched2");
				validator_done(val, ISC_R_SUCCESS);
			} else {
				result = startfinddlvsep(val, tname);
				if (result != DNS_R_WAIT)
					validator_done(val, result);
			}
		} else {
			result = proveunsecure(val, ISC_FALSE, ISC_TRUE);
			if (result != DNS_R_WAIT)
				validator_done(val, result);
		}
	} else if (eresult == ISC_R_SUCCESS ||
		   eresult == DNS_R_NXDOMAIN ||
		   eresult == DNS_R_NCACHENXDOMAIN)
	{
		result = proveunsecure(val, ISC_TF(eresult == ISC_R_SUCCESS),
				       ISC_TRUE);
		if (result != DNS_R_WAIT)
			validator_done(val, result);
	} else {
		if (eresult == ISC_R_CANCELED)
			validator_done(val, eresult);
		else
			validator_done(val, DNS_R_NOVALIDDS);
	}
	isc_event_free(&event);
	want_destroy = exit_check(val);
	UNLOCK(&val->lock);
	if (want_destroy)
		destroy(val);
}
static void dsfetched2 ( isc_task_t * task , isc_event_t * event ) { dns_fetchevent_t * devent ; dns_validator_t * val ; dns_name_t * tname ; isc_boolean_t want_destroy ; isc_result_t result ; isc_result_t eresult ; UNUSED ( task ) ; INSIST ( event -> ev_type == DNS_EVENT_FETCHDONE ) ; devent = ( dns_fetchevent_t * ) event ; val = devent -> ev_arg ; eresult = devent -> result ; if ( devent -> node != NULL ) dns_db_detachnode ( devent -> db , & devent -> node ) ; if ( devent -> db != NULL ) dns_db_detach ( & devent -> db ) ; if ( dns_rdataset_isassociated ( & val -> fsigrdataset ) ) dns_rdataset_disassociate ( & val -> fsigrdataset ) ; dns_resolver_destroyfetch ( & val -> fetch ) ; INSIST ( val -> event != NULL ) ; validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " , dns_result_totext ( eresult ) ) ; LOCK ( & val -> lock ) ; if ( CANCELED ( val ) ) { validator_done ( val , ISC_R_CANCELED ) ; } else if ( eresult == DNS_R_CNAME || eresult == DNS_R_NXRRSET || eresult == DNS_R_NCACHENXRRSET ) { tname = dns_fixedname_name ( & devent -> foundname ) ; if ( eresult != DNS_R_CNAME && isdelegation ( tname , & val -> frdataset , eresult ) ) { if ( val -> mustbesecure ) { validator_log ( val , ISC_LOG_WARNING , " " " " ) ; validator_done ( val , DNS_R_MUSTBESECURE ) ; } else if ( val -> view -> dlv == NULL || DLVTRIED ( val ) ) { markanswer ( val , " " ) ; validator_done ( val , ISC_R_SUCCESS ) ; } else { result = startfinddlvsep ( val , tname ) ; if ( result != DNS_R_WAIT ) validator_done ( val , result ) ; } } else { result = proveunsecure ( val , ISC_FALSE , ISC_TRUE ) ; if ( result != DNS_R_WAIT ) validator_done ( val , result ) ; } } else if ( eresult == ISC_R_SUCCESS || eresult == DNS_R_NXDOMAIN || eresult == DNS_R_NCACHENXDOMAIN ) { result = proveunsecure ( val , ISC_TF ( eresult == ISC_R_SUCCESS ) , ISC_TRUE ) ; if ( result != DNS_R_WAIT ) validator_done ( val , result ) ; } else { if ( eresult == ISC_R_CANCELED ) validator_done ( val , eresult ) ; else validator_done ( val , DNS_R_NOVALIDDS ) ; } isc_event_free ( & event ) ; want_destroy = exit_check ( val ) ; UNLOCK ( & val -> lock ) ; if ( want_destroy ) destroy ( val ) ; }
%
 We were asked to look for the DS record as part of proving that a
 name is unsecure.
% We were asked to look for the DS record as part of proving that a name is unsecure .
/* Free resources which are not of interest. */ /*
		 * There is no DS.  If this is a delegation, we're done.
		 */ /*
		 * There is a DS which may or may not be a zone cut.
		 * In either case we are still in a secure zone resume
		 * validation.
		 */