vendor/bundle/ruby/2.7.0/gems/dnsruby-1.61.5/lib/dnsruby/single_verifier.rb
#  Verify the specified message (or RRSet) using the set of trusted keys.
#  If keys is a DNSKEY, or an Array or RRSet of DNSKEYs, then keys
#  is added to the set of trusted keys before the message (or RRSet) is
#  verified.
# 
#  If msg is a Dnsruby::Message, then any signed DNSKEY or DS RRSets are
#  processed first, and any new keys are added to the trusted key set
#  before the other RRSets are checked.
# 
#  msg can be a Dnsruby::Message or Dnsruby::RRSet.
#  keys may be nil, or a KeyCache or an RRSet of Dnsruby::RR::DNSKEY
# 
#  Returns true if the message verifies OK, and false otherwise.
Verify the specified message (or RRSet) using the set of trusted keys.
If keys is a DNSKEY, or an Array or RRSet of DNSKEYs, then keys
is added to the set of trusted keys before the message (or RRSet) is
verified.

If msg is a Dnsruby::Message, then any signed DNSKEY or DS RRSets are
processed first, and any new keys are added to the trusted key set
before the other RRSets are checked.

msg can be a Dnsruby::Message or Dnsruby::RRSet.
keys may be nil, or a KeyCache or an RRSet of Dnsruby::RR::DNSKEY

Returns true if the message verifies OK, and false otherwise.
Verify the specified message ( or RRSet ) using the set of trusted keys . If keys is a DNSKEY or an Array or RRSet of DNSKEYs then keys is added to the set of trusted keys before the message ( or RRSet ) is verified . If msg is a Dnsruby :: Message then any signed DNSKEY or DS RRSets are processed first and any new keys are added to the trusted key set before the other RRSets are checked . msg can be a Dnsruby :: Message or Dnsruby :: RRSet . keys may be nil or a KeyCache or an RRSet of Dnsruby :: RR :: DNSKEY Returns true if the message verifies OK and false otherwise .
def verify(msg, keys = nil)
      if (msg.kind_of?RRSet)
        if (msg.type == Types.DNSKEY)
          return verify_key_rrset(msg, keys)
        end
        if ((msg.type == Types.DS) || (msg.type == Types.DLV))
          return verify_ds_rrset(msg, keys)
        end
        return verify_rrset(msg, keys)
      end
      msg.each_section do |section|
        ds_rrsets = section.rrsets(Types.DS)
        if ((!ds_rrsets || ds_rrsets.length == 0) && (@verifier_type == VerifierType::DLV))
          ds_rrsets = section.rrsets(Types.DLV)
        end
        ds_rrsets.each {|ds_rrset|
          if ((ds_rrset && ds_rrset.rrs.length > 0) && !verify_ds_rrset(ds_rrset, keys, msg))
            raise VerifyError.new("Failed to verify DS RRSet")
          end
        }
        key_rrsets = section.rrsets(Types.DNSKEY)
        key_rrsets.each {|key_rrset|
          if ((key_rrset && key_rrset.rrs.length > 0) && !verify_key_rrset(key_rrset, keys))
            raise VerifyError.new("Failed to verify DNSKEY RRSet")
          end
        }
      end
      verify_nsecs(msg)
      msg.section_rrsets.each do |section, rrsets|
        rrsets.each do |rrset|
          if ((section == "authority") && (rrset.type == Types.NS))
            dsrrset = msg.authority.rrsets('DS')[0]
            if ((msg.answer.size == 0) && (!dsrrset) && (rrset.type == Types.NS)) 
              nsec = msg.authority.rrsets('NSEC')[0]
              if (!nsec || (nsec.length == 0))
                nsec = msg.authority.rrsets('NSEC3')[0]
              end
              if (nsec && (nsec.rrs.length > 0))
                if (!(nsec.rrs()[0].types.include?'DS') || !(nsec.rrs()[0].types.include?'SOA'))
                  next 
                end
              end
            end
            if (rrset.type == Types.NS)
              if ((rrset.name.canonical == msg.question()[0].qname.canonical) && (rrset.sigs.length == 0))
                next
              end
            end
          end
          if (section == "additional")
            if (msg.additional.size > 0)
              arec = msg.additional.rrsets('A')[0]
              if (!arec || arec.rrs.length == 0)
                arec = msg.additional.rrsets('AAAA')[0]
              end
              ns_rrsets = msg.additional.rrsets('NS')
              ns_rrsets.each {|ns_rrset|
                if (ns_rrset.length > 0)
                  nsname = ns_rrset.rrs()[0].name
                  if (arec && arec.rrs().length > 0)
                    aname = arec.rrs()[0].name
                    if (nsname.subdomain_of?aname)
                      next
                    end
                  end
                end
              }
            end
          end
          if ((section == "additional") && (rrset.sigs.length == 0))
            next
          end
          if (!verify_rrset(rrset, keys))
            TheLog.debug("Failed to verify rrset")
            return false
          end
        end
      end
      return true
    end
def verify ( msg , keys = nil ) if ( msg . kind_of? RRSet ) if ( msg . type == Types . DNSKEY ) return verify_key_rrset ( msg , keys ) end if ( ( msg . type == Types . DS ) || ( msg . type == Types . DLV ) ) return verify_ds_rrset ( msg , keys ) end return verify_rrset ( msg , keys ) end msg . each_section do | section | ds_rrsets = section . rrsets ( Types . DS ) if ( ( ! ds_rrsets || ds_rrsets . length == 0 ) && ( @verifier_type == VerifierType :: DLV ) ) ds_rrsets = section . rrsets ( Types . DLV ) end ds_rrsets . each { | ds_rrset | if ( ( ds_rrset && ds_rrset . rrs . length > 0 ) && ! verify_ds_rrset ( ds_rrset , keys , msg ) ) raise VerifyError . new ( "Failed to verify DS RRSet" ) end } key_rrsets = section . rrsets ( Types . DNSKEY ) key_rrsets . each { | key_rrset | if ( ( key_rrset && key_rrset . rrs . length > 0 ) && ! verify_key_rrset ( key_rrset , keys ) ) raise VerifyError . new ( "Failed to verify DNSKEY RRSet" ) end } end verify_nsecs ( msg ) msg . section_rrsets . each do | section , rrsets | rrsets . each do | rrset | if ( ( section == "authority" ) && ( rrset . type == Types . NS ) ) dsrrset = msg . authority . rrsets ( 'DS' ) [ 0 ] if ( ( msg . answer . size == 0 ) && ( ! dsrrset ) && ( rrset . type == Types . NS ) ) nsec = msg . authority . rrsets ( 'NSEC' ) [ 0 ] if ( ! nsec || ( nsec . length == 0 ) ) nsec = msg . authority . rrsets ( 'NSEC3' ) [ 0 ] end if ( nsec && ( nsec . rrs . length > 0 ) ) if ( ! ( nsec . rrs ( ) [ 0 ] . types . include? 'DS' ) || ! ( nsec . rrs ( ) [ 0 ] . types . include? 'SOA' ) ) next end end end if ( rrset . type == Types . NS ) if ( ( rrset . name . canonical == msg . question ( ) [ 0 ] . qname . canonical ) && ( rrset . sigs . length == 0 ) ) next end end end if ( section == "additional" ) if ( msg . additional . size > 0 ) arec = msg . additional . rrsets ( 'A' ) [ 0 ] if ( ! arec || arec . rrs . length == 0 ) arec = msg . additional . rrsets ( 'AAAA' ) [ 0 ] end ns_rrsets = msg . additional . rrsets ( 'NS' ) ns_rrsets . each { | ns_rrset | if ( ns_rrset . length > 0 ) nsname = ns_rrset . rrs ( ) [ 0 ] . name if ( arec && arec . rrs ( ) . length > 0 ) aname = arec . rrs ( ) [ 0 ] . name if ( nsname . subdomain_of? aname ) next end end end } end end if ( ( section == "additional" ) && ( rrset . sigs . length == 0 ) ) next end if ( ! verify_rrset ( rrset , keys ) ) TheLog . debug ( "Failed to verify rrset" ) return false end end end return true end
Verify the specified message (or RRSet) using the set of trusted keys.
Verify the specified message ( or RRSet ) using the set of trusted keys .
#  Use the set of trusted keys to check any RRSets we can, ideally #  those of other DNSKEY RRSets first. Then, see if we can use any of the #  new total set of keys to check the rest of the rrsets. #  Return true if we can verify the whole message. #         print "Checking section : #{section}\n" #             return false #             return false #  Then, look through all the remaining RRSets, and verify them all (unless not necessary). #  If delegation NS or glue AAAA/A, then don't expect RRSIG. #  Otherwise, expect RRSIG and fail verification if RRSIG is not present #  Check for delegation # (isDelegation) #  Now check NSEC(3) records for absence of DS and SOA # delegation which we expect to be unsigned - so don't verify it! #  If NS records delegate the name to the child's nameservers, then they MUST NOT be signed #               all_delegate = true #               rrset.rrs.each {|rr| #                 name = Name.create(rr.nsdname) #                 name.absolute = true #                 if (!(name.subdomain_of?(rr.name))) #                   all_delegate = false #                 end #               } #               if (all_delegate && rrset.sigs.length == 0) #                 next #               end #  check for glue #  if the ownername (in the addtional section) of the glue address is the same or longer as the ownername of the NS record, it is glue #  If records are in additional, and no RRSIG, that's Ok - just don't use them! #  @TODO@ Make sure that we don't cache these records! #  else verify RRSet #           print "About to verify #{rrset.name}, #{rrset.type}\n" #             print "FAILED TO VERIFY RRSET #{rrset.name}, #{rrset.type}\n"
msg
<not_specific>
keys
<not_specific>