lib/dns/validator.c
/*%
 * Prove a negative answer is good or that there is a NOQNAME when the
 * answer is from a wildcard.
 *
 * Loop through the authority section looking for NODATA, NOWILDCARD
 * and NOQNAME proofs in the NSEC records by calling authvalidated().
 *
 * If the required proofs are found we are done.
 *
 * If the proofs are not found attempt to prove this is a unsecure
 * response.
 */
%
Prove a negative answer is good or that there is a NOQNAME when the
answer is from a wildcard.

Loop through the authority section looking for NODATA, NOWILDCARD
and NOQNAME proofs in the NSEC records by calling authvalidated().

If the required proofs are found we are done.

If the proofs are not found attempt to prove this is a unsecure
response.
% Prove a negative answer is good or that there is a NOQNAME when the answer is from a wildcard . Loop through the authority section looking for NODATA NOWILDCARD and NOQNAME proofs in the NSEC records by calling authvalidated () . If the required proofs are found we are done . If the proofs are not found attempt to prove this is a unsecure response .
static isc_result_t
nsecvalidate(dns_validator_t *val, isc_boolean_t resume) {
	isc_result_t result;
	if (resume)
		validator_log(val, ISC_LOG_DEBUG(3), "resuming nsecvalidate");
	if (val->event->message == NULL)
		result = validate_ncache(val, resume);
	else
		result = validate_authority(val, resume);
	if (result != ISC_R_SUCCESS)
		return (result);
	if (!NEEDNODATA(val) && !NEEDNOWILDCARD(val) && NEEDNOQNAME(val)) {
		if (!FOUNDNOQNAME(val))
			findnsec3proofs(val);
		if (FOUNDNOQNAME(val) && FOUNDCLOSEST(val)) {
			validator_log(val, ISC_LOG_DEBUG(3),
				      "marking as secure, noqname proof found");
			marksecure(val->event);
			return (ISC_R_SUCCESS);
		} else if (FOUNDOPTOUT(val) &&
			   dns_name_countlabels(dns_fixedname_name(&val->wild))
					 != 0) {
			validator_log(val, ISC_LOG_DEBUG(3),
				      "optout proof found");
			val->event->optout = ISC_TRUE;
			markanswer(val, "nsecvalidate (1)");
			return (ISC_R_SUCCESS);
		} else if ((val->attributes & VALATTR_FOUNDUNKNOWN) != 0) {
			validator_log(val, ISC_LOG_DEBUG(3),
				      "unknown NSEC3 hash algorithm found");
			markanswer(val, "nsecvalidate (2)");
			return (ISC_R_SUCCESS);
		}
		validator_log(val, ISC_LOG_DEBUG(3),
			      "noqname proof not found");
		return (DNS_R_NOVALIDNSEC);
	}
	if (!FOUNDNOQNAME(val) && !FOUNDNODATA(val))
		findnsec3proofs(val);
	if (FOUNDNOQNAME(val) && FOUNDCLOSEST(val) &&
	    ((NEEDNODATA(val) && !FOUNDNODATA(val)) || NEEDNOWILDCARD(val))) {
		result = checkwildcard(val, dns_rdatatype_nsec, NULL);
		if (result != ISC_R_SUCCESS)
			return (result);
	}
	if ((NEEDNODATA(val) && (FOUNDNODATA(val) || FOUNDOPTOUT(val))) ||
	    (NEEDNOQNAME(val) && FOUNDNOQNAME(val) &&
	     NEEDNOWILDCARD(val) && FOUNDNOWILDCARD(val) &&
	     FOUNDCLOSEST(val))) {
		if ((val->attributes & VALATTR_FOUNDOPTOUT) != 0)
			val->event->optout = ISC_TRUE;
		validator_log(val, ISC_LOG_DEBUG(3),
			      "nonexistence proof(s) found");
		if (val->event->message == NULL)
			marksecure(val->event);
		return (ISC_R_SUCCESS);
	}
	if (val->authfail != 0 && val->authcount == val->authfail)
		return (DNS_R_BROKENCHAIN);
	validator_log(val, ISC_LOG_DEBUG(3),
		      "nonexistence proof(s) not found");
	val->attributes |= VALATTR_INSECURITY;
	return (proveunsecure(val, ISC_FALSE, ISC_FALSE));
}
static isc_result_t nsecvalidate ( dns_validator_t * val , isc_boolean_t resume ) { isc_result_t result ; if ( resume ) validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " ) ; if ( val -> event -> message == NULL ) result = validate_ncache ( val , resume ) ; else result = validate_authority ( val , resume ) ; if ( result != ISC_R_SUCCESS ) return ( result ) ; if ( ! NEEDNODATA ( val ) && ! NEEDNOWILDCARD ( val ) && NEEDNOQNAME ( val ) ) { if ( ! FOUNDNOQNAME ( val ) ) findnsec3proofs ( val ) ; if ( FOUNDNOQNAME ( val ) && FOUNDCLOSEST ( val ) ) { validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " ) ; marksecure ( val -> event ) ; return ( ISC_R_SUCCESS ) ; } else if ( FOUNDOPTOUT ( val ) && dns_name_countlabels ( dns_fixedname_name ( & val -> wild ) ) != 0 ) { validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " ) ; val -> event -> optout = ISC_TRUE ; markanswer ( val , " " ) ; return ( ISC_R_SUCCESS ) ; } else if ( ( val -> attributes & VALATTR_FOUNDUNKNOWN ) != 0 ) { validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " ) ; markanswer ( val , " " ) ; return ( ISC_R_SUCCESS ) ; } validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " ) ; return ( DNS_R_NOVALIDNSEC ) ; } if ( ! FOUNDNOQNAME ( val ) && ! FOUNDNODATA ( val ) ) findnsec3proofs ( val ) ; if ( FOUNDNOQNAME ( val ) && FOUNDCLOSEST ( val ) && ( ( NEEDNODATA ( val ) && ! FOUNDNODATA ( val ) ) || NEEDNOWILDCARD ( val ) ) ) { result = checkwildcard ( val , dns_rdatatype_nsec , NULL ) ; if ( result != ISC_R_SUCCESS ) return ( result ) ; } if ( ( NEEDNODATA ( val ) && ( FOUNDNODATA ( val ) || FOUNDOPTOUT ( val ) ) ) || ( NEEDNOQNAME ( val ) && FOUNDNOQNAME ( val ) && NEEDNOWILDCARD ( val ) && FOUNDNOWILDCARD ( val ) && FOUNDCLOSEST ( val ) ) ) { if ( ( val -> attributes & VALATTR_FOUNDOPTOUT ) != 0 ) val -> event -> optout = ISC_TRUE ; validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " ) ; if ( val -> event -> message == NULL ) marksecure ( val -> event ) ; return ( ISC_R_SUCCESS ) ; } if ( val -> authfail != 0 && val -> authcount == val -> authfail ) return ( DNS_R_BROKENCHAIN ) ; validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " ) ; val -> attributes |= VALATTR_INSECURITY ; return ( proveunsecure ( val , ISC_FALSE , ISC_FALSE ) ) ; }
%
 Prove a negative answer is good or that there is a NOQNAME when the
 answer is from a wildcard.
% Prove a negative answer is good or that there is a NOQNAME when the answer is from a wildcard .
/*
	 * Do we only need to check for NOQNAME?  To get here we must have
	 * had a secure wildcard answer.
	 */ /*
	 * Do we need to check for the wildcard?
	 */