1 /*
2 * securechasetrace.c
3 * Where all the hard work concerning secure tracing is done
4 *
5 * (c) 2005, 2006 NLnet Labs
6 *
7 * See the file LICENSE for the license
8 *
9 */
10
11 #include "drill.h"
12 #include <ldns/ldns.h>
13
14 #define SELF "[S]" /* self sig ok */
15 #define TRUST "[T]" /* chain from parent */
16 #define BOGUS "[B]" /* bogus */
17 #define UNSIGNED "[U]" /* no relevant dnssec data found */
18
19 #if 0
20 /* See if there is a key/ds in trusted that matches
21 * a ds in *ds.
22 */
23 static ldns_rr_list *
24 ds_key_match(ldns_rr_list *ds, ldns_rr_list *trusted)
25 {
26 size_t i, j;
27 bool match;
28 ldns_rr *rr_i, *rr_j;
29 ldns_rr_list *keys;
30
31 if (!trusted || !ds) {
32 return NULL;
33 }
34
35 match = false;
36 keys = ldns_rr_list_new();
37 if (!keys) {
38 return NULL;
39 }
40
41 if (!ds || !trusted) {
42 return NULL;
43 }
44
45 for (i = 0; i < ldns_rr_list_rr_count(trusted); i++) {
46 rr_i = ldns_rr_list_rr(trusted, i);
47 for (j = 0; j < ldns_rr_list_rr_count(ds); j++) {
48
49 rr_j = ldns_rr_list_rr(ds, j);
50 if (ldns_rr_compare_ds(rr_i, rr_j)) {
51 match = true;
52 /* only allow unique RRs to match */
53 ldns_rr_set_push_rr(keys, rr_i);
54 }
55 }
56 }
57 if (match) {
58 return keys;
59 } else {
60 return NULL;
61 }
62 }
63 #endif
64
65 static ldns_pkt *
get_dnssec_pkt(ldns_resolver * r,ldns_rdf * name,ldns_rr_type t)66 get_dnssec_pkt(ldns_resolver *r, ldns_rdf *name, ldns_rr_type t)
67 {
68 ldns_pkt *p = NULL;
69 p = ldns_resolver_query(r, name, t, LDNS_RR_CLASS_IN, 0);
70 if (!p) {
71 return NULL;
72 } else {
73 if (verbosity >= 5) {
74 ldns_pkt_print(stdout, p);
75 }
76 return p;
77 }
78 }
79
80 #ifdef HAVE_SSL
81 /*
82 * retrieve keys for this zone
83 */
84 static ldns_pkt_type
get_key(ldns_pkt * p,ldns_rdf * apexname,ldns_rr_list ** rrlist,ldns_rr_list ** opt_sig)85 get_key(ldns_pkt *p, ldns_rdf *apexname, ldns_rr_list **rrlist, ldns_rr_list **opt_sig)
86 {
87 return get_dnssec_rr(p, apexname, LDNS_RR_TYPE_DNSKEY, rrlist, opt_sig);
88 }
89
90 /*
91 * check to see if we can find a DS rrset here which we can then follow
92 */
93 static ldns_pkt_type
get_ds(ldns_pkt * p,ldns_rdf * ownername,ldns_rr_list ** rrlist,ldns_rr_list ** opt_sig)94 get_ds(ldns_pkt *p, ldns_rdf *ownername, ldns_rr_list **rrlist, ldns_rr_list **opt_sig)
95 {
96 return get_dnssec_rr(p, ownername, LDNS_RR_TYPE_DS, rrlist, opt_sig);
97 }
98 #endif /* HAVE_SSL */
99
100 static void
remove_resolver_nameservers(ldns_resolver * res)101 remove_resolver_nameservers(ldns_resolver *res)
102 {
103 ldns_rdf *pop;
104
105 /* remove the old nameserver from the resolver */
106 while((pop = ldns_resolver_pop_nameserver(res))) {
107 ldns_rdf_deep_free(pop);
108 }
109
110 }
111
112 /*ldns_pkt **/
113 #ifdef HAVE_SSL
114 int
do_secure_trace(ldns_resolver * local_res,ldns_rdf * name,ldns_rr_type t,ldns_rr_class c,ldns_rr_list * trusted_keys,ldns_rdf * start_name)115 do_secure_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
116 ldns_rr_class c, ldns_rr_list *trusted_keys, ldns_rdf *start_name
117 )
118 {
119 ldns_resolver *res;
120 ldns_pkt *p, *local_p;
121 ldns_rr_list *new_nss;
122 ldns_rr_list *ns_addr;
123 ldns_rdf *pop;
124 ldns_rdf **labels = NULL;
125 ldns_status status, st;
126 ssize_t i;
127 size_t j;
128 size_t k;
129 size_t l;
130 uint8_t labels_count = 0;
131
132 /* dnssec */
133 ldns_rr_list *key_list;
134 ldns_rr_list *key_sig_list;
135 ldns_rr_list *ds_list;
136 ldns_rr_list *ds_sig_list;
137 ldns_rr_list *correct_key_list;
138 ldns_rr_list *trusted_ds_rrs;
139 bool new_keys_trusted = false;
140 ldns_rr_list *current_correct_keys = NULL;
141 ldns_rr_list *dataset;
142
143 ldns_rr_list *nsec_rrs = NULL;
144 ldns_rr_list *nsec_rr_sigs = NULL;
145
146 /* empty non-terminal check */
147 bool ent;
148 ldns_rr *nsecrr; /* The nsec that proofs the non-terminal */
149 ldns_rdf *hashed_name; /* The query hashed with nsec3 params */
150 ldns_rdf *label0; /* The first label of an nsec3 owner name */
151
152 /* glue handling */
153 ldns_rr_list *new_ns_addr;
154 ldns_rr_list *old_ns_addr;
155 ldns_rr *ns_rr;
156
157 int result = 0;
158
159 /* printing niceness */
160 const ldns_rr_descriptor *descriptor;
161
162 descriptor = ldns_rr_descript(t);
163
164 new_nss = NULL;
165 ns_addr = NULL;
166 key_list = NULL;
167 ds_list = NULL;
168
169 p = NULL;
170 local_p = NULL;
171 res = ldns_resolver_new();
172 key_sig_list = NULL;
173 ds_sig_list = NULL;
174
175 if (!res) {
176 error("Memory allocation failed");
177 result = -1;
178 return result;
179 }
180
181 correct_key_list = ldns_rr_list_new();
182 if (!correct_key_list) {
183 error("Memory allocation failed");
184 result = -1;
185 return result;
186 }
187
188 trusted_ds_rrs = ldns_rr_list_new();
189 if (!trusted_ds_rrs) {
190 error("Memory allocation failed");
191 result = -1;
192 return result;
193 }
194 /* Add all preset trusted DS signatures to the list of trusted DS RRs. */
195 for (j = 0; j < ldns_rr_list_rr_count(trusted_keys); j++) {
196 ldns_rr* one_rr = ldns_rr_list_rr(trusted_keys, j);
197 if (ldns_rr_get_type(one_rr) == LDNS_RR_TYPE_DS) {
198 ldns_rr_list_push_rr(trusted_ds_rrs, ldns_rr_clone(one_rr));
199 }
200 }
201
202 /* transfer some properties of local_res to res */
203 ldns_resolver_set_ip6(res,
204 ldns_resolver_ip6(local_res));
205 ldns_resolver_set_port(res,
206 ldns_resolver_port(local_res));
207 ldns_resolver_set_debug(res,
208 ldns_resolver_debug(local_res));
209 ldns_resolver_set_fail(res,
210 ldns_resolver_fail(local_res));
211 ldns_resolver_set_usevc(res,
212 ldns_resolver_usevc(local_res));
213 ldns_resolver_set_random(res,
214 ldns_resolver_random(local_res));
215 ldns_resolver_set_source(res,
216 ldns_resolver_source(local_res));
217 ldns_resolver_set_recursive(local_res, true);
218
219 ldns_resolver_set_recursive(res, false);
220 ldns_resolver_set_dnssec_cd(res, false);
221 ldns_resolver_set_dnssec(res, true);
222
223 /* setup the root nameserver in the new resolver */
224 status = ldns_resolver_push_nameserver_rr_list(res, global_dns_root);
225 if (status != LDNS_STATUS_OK) {
226 printf("ERRRRR: %s\n", ldns_get_errorstr_by_id(status));
227 ldns_rr_list_print(stdout, global_dns_root);
228 result = status;
229 goto done;
230 }
231 labels_count = ldns_dname_label_count(name);
232 if (start_name) {
233 if (ldns_dname_is_subdomain(name, start_name)) {
234 labels_count -= ldns_dname_label_count(start_name);
235 } else {
236 fprintf(stderr, "Error; ");
237 ldns_rdf_print(stderr, name);
238 fprintf(stderr, " is not a subdomain of ");
239 ldns_rdf_print(stderr, start_name);
240 fprintf(stderr, "\n");
241 goto done;
242 }
243 }
244 labels = LDNS_CALLOC(ldns_rdf*, labels_count + 2);
245 if (!labels) {
246 goto done;
247 }
248 labels[0] = ldns_dname_new_frm_str(LDNS_ROOT_LABEL_STR);
249 labels[1] = ldns_rdf_clone(name);
250 for(i = 2 ; i < (ssize_t)labels_count + 2; i++) {
251 labels[i] = ldns_dname_left_chop(labels[i - 1]);
252 }
253
254 /* get the nameserver for the label
255 * ask: dnskey and ds for the label
256 */
257 for(i = (ssize_t)labels_count + 1; i > 0; i--) {
258 status = ldns_resolver_send(&local_p, res, labels[i], LDNS_RR_TYPE_NS, c, 0);
259 if (status != LDNS_STATUS_OK) {
260 fprintf(stderr, "Error sending query: %s\n", ldns_get_errorstr_by_id(status));
261 result = status;
262 goto done;
263 }
264
265 /* TODO: handle status */
266
267 if (verbosity >= 5) {
268 ldns_pkt_print(stdout, local_p);
269 }
270
271 new_nss = ldns_pkt_rr_list_by_type(local_p,
272 LDNS_RR_TYPE_NS, LDNS_SECTION_ANSWER);
273 if (!new_nss) {
274 /* if it's a delegation, servers put them in the auth section */
275 new_nss = ldns_pkt_rr_list_by_type(local_p,
276 LDNS_RR_TYPE_NS, LDNS_SECTION_AUTHORITY);
277 }
278
279 /* if this is the final step there might not be nameserver records
280 of course if the data is in the apex, there are, so cover both
281 cases */
282 if (new_nss || i > 1) {
283 for(j = 0; j < ldns_rr_list_rr_count(new_nss); j++) {
284 ns_rr = ldns_rr_list_rr(new_nss, j);
285 pop = ldns_rr_rdf(ns_rr, 0);
286 if (!pop) {
287 printf("nopo\n");
288 break;
289 }
290 /* retrieve it's addresses */
291 /* trust glue? */
292 new_ns_addr = NULL;
293 if (ldns_dname_is_subdomain(pop, labels[i])) {
294 if (ldns_resolver_ip6(res) == LDNS_RESOLV_INET6) {
295 new_ns_addr = ldns_pkt_rr_list_by_name_and_type(local_p, pop, LDNS_RR_TYPE_AAAA, LDNS_SECTION_ADDITIONAL);
296 } else {
297 /* If IPv4 is specified, or no IP version is specified, default to A record and use IPv4 */
298 new_ns_addr = ldns_pkt_rr_list_by_name_and_type(local_p, pop, LDNS_RR_TYPE_A, LDNS_SECTION_ADDITIONAL);
299 }
300 }
301 if (!new_ns_addr || ldns_rr_list_rr_count(new_ns_addr) == 0) {
302 new_ns_addr = ldns_get_rr_list_addr_by_name(res, pop, c, 0);
303 }
304 if (!new_ns_addr || ldns_rr_list_rr_count(new_ns_addr) == 0) {
305 new_ns_addr = ldns_get_rr_list_addr_by_name(local_res, pop, c, 0);
306 }
307
308 if (new_ns_addr) {
309 old_ns_addr = ns_addr;
310 ns_addr = ldns_rr_list_cat_clone(ns_addr, new_ns_addr);
311 ldns_rr_list_deep_free(old_ns_addr);
312 }
313 ldns_rr_list_deep_free(new_ns_addr);
314 }
315 ldns_rr_list_deep_free(new_nss);
316
317 if (ns_addr) {
318 remove_resolver_nameservers(res);
319
320 if (ldns_resolver_push_nameserver_rr_list(res, ns_addr) !=
321 LDNS_STATUS_OK) {
322 error("Error adding new nameservers");
323 ldns_pkt_free(local_p);
324 goto done;
325 }
326 ldns_rr_list_deep_free(ns_addr);
327 } else {
328 status = ldns_verify_denial(local_p, labels[i], LDNS_RR_TYPE_NS, &nsec_rrs, &nsec_rr_sigs);
329
330 /* verify the nsec3 themselves*/
331 if (verbosity >= 4) {
332 printf("NSEC(3) Records to verify:\n");
333 ldns_rr_list_print(stdout, nsec_rrs);
334 printf("With signatures:\n");
335 ldns_rr_list_print(stdout, nsec_rr_sigs);
336 printf("correct keys:\n");
337 ldns_rr_list_print(stdout, correct_key_list);
338 }
339
340 if (status == LDNS_STATUS_OK) {
341 if ((st = ldns_verify(nsec_rrs, nsec_rr_sigs, trusted_keys, NULL)) == LDNS_STATUS_OK) {
342 fprintf(stdout, "%s ", TRUST);
343 fprintf(stdout, "Existence denied: ");
344 ldns_rdf_print(stdout, labels[i]);
345 /*
346 if (descriptor && descriptor->_name) {
347 printf(" %s", descriptor->_name);
348 } else {
349 printf(" TYPE%u", t);
350 }
351 */ fprintf(stdout, " NS\n");
352 } else if ((st = ldns_verify(nsec_rrs, nsec_rr_sigs, correct_key_list, NULL)) == LDNS_STATUS_OK) {
353 fprintf(stdout, "%s ", SELF);
354 fprintf(stdout, "Existence denied: ");
355 ldns_rdf_print(stdout, labels[i]);
356 /*
357 if (descriptor && descriptor->_name) {
358 printf(" %s", descriptor->_name);
359 } else {
360 printf(" TYPE%u", t);
361 }
362 */
363 fprintf(stdout, " NS\n");
364 } else {
365 fprintf(stdout, "%s ", BOGUS);
366 result = 1;
367 printf(";; Error verifying denial of existence for name ");
368 ldns_rdf_print(stdout, labels[i]);
369 /*
370 printf(" type ");
371 if (descriptor && descriptor->_name) {
372 printf("%s", descriptor->_name);
373 } else {
374 printf("TYPE%u", t);
375 }
376 */ printf("NS: %s\n", ldns_get_errorstr_by_id(st));
377 }
378 } else {
379 fprintf(stdout, "%s ", BOGUS);
380 result = 1;
381 printf(";; Error verifying denial of existence for name ");
382 ldns_rdf_print(stdout, labels[i]);
383 printf("NS: %s\n", ldns_get_errorstr_by_id(status));
384 }
385
386 /* there might be an empty non-terminal, in which case we need to continue */
387 ent = false;
388 for (j = 0; j < ldns_rr_list_rr_count(nsec_rrs); j++) {
389 nsecrr = ldns_rr_list_rr(nsec_rrs, j);
390 /* For NSEC when the next name is a subdomain of the question */
391 if (ldns_rr_get_type(nsecrr) == LDNS_RR_TYPE_NSEC &&
392 ldns_dname_is_subdomain(ldns_rr_rdf(nsecrr, 0), labels[i])) {
393 ent = true;
394
395 /* For NSEC3, the hash matches the name and the type bitmap is empty*/
396 } else if (ldns_rr_get_type(nsecrr) == LDNS_RR_TYPE_NSEC3) {
397 hashed_name = ldns_nsec3_hash_name_frm_nsec3(nsecrr, labels[i]);
398 label0 = ldns_dname_label(ldns_rr_owner(nsecrr), 0);
399 if (hashed_name && label0 &&
400 ldns_dname_compare(hashed_name, label0) == 0 &&
401 ldns_nsec3_bitmap(nsecrr) == NULL) {
402 ent = true;
403 }
404 if (label0) {
405 LDNS_FREE(label0);
406 }
407 if (hashed_name) {
408 LDNS_FREE(hashed_name);
409 }
410 }
411 }
412 if (!ent) {
413 ldns_rr_list_deep_free(nsec_rrs);
414 ldns_rr_list_deep_free(nsec_rr_sigs);
415 ldns_pkt_free(local_p);
416 goto done;
417 } else {
418 printf(";; There is an empty non-terminal here, continue\n");
419 continue;
420 }
421 }
422
423 if (ldns_resolver_nameserver_count(res) == 0) {
424 error("No nameservers found for this node");
425 goto done;
426 }
427 }
428 ldns_pkt_free(local_p);
429
430 fprintf(stdout, ";; Domain: ");
431 ldns_rdf_print(stdout, labels[i]);
432 fprintf(stdout, "\n");
433
434 /* retrieve keys for current domain, and verify them
435 if they match an already trusted DS, or if one of the
436 keys used to sign these is trusted, add the keys to
437 the trusted list */
438 p = get_dnssec_pkt(res, labels[i], LDNS_RR_TYPE_DNSKEY);
439 (void) get_key(p, labels[i], &key_list, &key_sig_list);
440 if (key_sig_list) {
441 if (key_list) {
442 current_correct_keys = ldns_rr_list_new();
443 if ((st = ldns_verify(key_list, key_sig_list, key_list, current_correct_keys)) ==
444 LDNS_STATUS_OK) {
445 /* add all signed keys (don't just add current_correct, you'd miss
446 * the zsk's then */
447 for (j = 0; j < ldns_rr_list_rr_count(key_list); j++) {
448 ldns_rr_list_push_rr(correct_key_list, ldns_rr_clone(ldns_rr_list_rr(key_list, j)));
449 }
450
451 /* check whether these keys were signed
452 * by a trusted keys. if so, these
453 * keys are also trusted */
454 new_keys_trusted = false;
455 for (k = 0; k < ldns_rr_list_rr_count(current_correct_keys); k++) {
456 for (j = 0; j < ldns_rr_list_rr_count(trusted_ds_rrs); j++) {
457 if (ldns_rr_compare_ds(ldns_rr_list_rr(current_correct_keys, k),
458 ldns_rr_list_rr(trusted_ds_rrs, j))) {
459 new_keys_trusted = true;
460 }
461 }
462 }
463
464 /* also all keys are trusted if one of the current correct keys is trusted */
465 for (k = 0; k < ldns_rr_list_rr_count(current_correct_keys); k++) {
466 for (j = 0; j < ldns_rr_list_rr_count(trusted_keys); j++) {
467 if (ldns_rr_compare(ldns_rr_list_rr(current_correct_keys, k),
468 ldns_rr_list_rr(trusted_keys, j)) == 0) {
469 new_keys_trusted = true;
470 }
471 }
472 }
473
474
475 if (new_keys_trusted) {
476 ldns_rr_list_push_rr_list(trusted_keys, key_list);
477 print_rr_list_abbr(stdout, key_list, TRUST);
478 ldns_rr_list_free(key_list);
479 key_list = NULL;
480 } else {
481 if (verbosity >= 2) {
482 printf(";; Signature ok but no chain to a trusted key or ds record\n");
483 }
484 print_rr_list_abbr(stdout, key_list, SELF);
485 ldns_rr_list_deep_free(key_list);
486 key_list = NULL;
487 }
488 } else {
489 print_rr_list_abbr(stdout, key_list, BOGUS);
490 result = 2;
491 ldns_rr_list_deep_free(key_list);
492 key_list = NULL;
493 }
494 ldns_rr_list_free(current_correct_keys);
495 current_correct_keys = NULL;
496 } else {
497 printf(";; No DNSKEY record found for ");
498 ldns_rdf_print(stdout, labels[i]);
499 printf("\n");
500 }
501 }
502
503 ldns_pkt_free(p);
504 ldns_rr_list_deep_free(key_sig_list);
505 key_sig_list = NULL;
506
507 /* check the DS records for the next child domain */
508 if (i > 1) {
509 p = get_dnssec_pkt(res, labels[i-1], LDNS_RR_TYPE_DS);
510 (void) get_ds(p, labels[i-1], &ds_list, &ds_sig_list);
511 if (!ds_list) {
512 ldns_rr_list_deep_free(ds_sig_list);
513 (void) get_dnssec_rr( p, labels[i-1]
514 , LDNS_RR_TYPE_CNAME
515 , &ds_list, &ds_sig_list);
516 if (ds_list) {
517 st = ldns_verify( ds_list, ds_sig_list
518 , correct_key_list
519 , current_correct_keys);
520
521 if (st == LDNS_STATUS_OK) {
522 printf(";; No DS record found "
523 "for ");
524 ldns_rdf_print(stdout,
525 labels[i-1]);
526 printf(", but valid CNAME");
527 } else {
528 printf(BOGUS " Unable to verify "
529 "denial of existence for ");
530 ldns_rdf_print(stdout,
531 labels[i-1]);
532 printf(", because of BOGUS CNAME");
533 }
534 printf("\n");
535 ldns_rr_list_deep_free(ds_sig_list);
536 ldns_pkt_free(p);
537 ldns_rr_list_deep_free(ds_list);
538 ds_list = NULL;
539 ds_sig_list = NULL;
540 p = NULL;
541 } else {
542 ldns_rr_list_deep_free(ds_sig_list);
543 ldns_pkt_free(p);
544 p = get_dnssec_pkt(res, name,
545 LDNS_RR_TYPE_DNSKEY);
546 (void) get_ds(p, NULL
547 , &ds_list, &ds_sig_list);
548 }
549 }
550 if (ds_sig_list) {
551 if (ds_list) {
552 if (verbosity >= 4) {
553 printf("VERIFYING:\n");
554 printf("DS LIST:\n");
555 ldns_rr_list_print(stdout, ds_list);
556 printf("SIGS:\n");
557 ldns_rr_list_print(stdout, ds_sig_list);
558 printf("KEYS:\n");
559 ldns_rr_list_print(stdout, correct_key_list);
560 }
561
562 current_correct_keys = ldns_rr_list_new();
563
564 if ((st = ldns_verify(ds_list, ds_sig_list, correct_key_list, current_correct_keys)) ==
565 LDNS_STATUS_OK) {
566 /* if the ds is signed by a trusted key and a key from correct keys
567 matches that ds, add that key to the trusted keys */
568 new_keys_trusted = false;
569 if (verbosity >= 2) {
570 printf("Checking if signing key is trusted:\n");
571 }
572 for (j = 0; j < ldns_rr_list_rr_count(current_correct_keys); j++) {
573 if (verbosity >= 2) {
574 printf("New key: ");
575 ldns_rr_print(stdout, ldns_rr_list_rr(current_correct_keys, j));
576 }
577 for (k = 0; k < ldns_rr_list_rr_count(trusted_keys); k++) {
578 if (verbosity >= 2) {
579 printf("\tTrusted key: ");
580 ldns_rr_print(stdout, ldns_rr_list_rr(trusted_keys, k));
581 }
582 if (ldns_rr_compare(ldns_rr_list_rr(current_correct_keys, j),
583 ldns_rr_list_rr(trusted_keys, k)) == 0) {
584 if (verbosity >= 2) {
585 printf("Key is now trusted!\n");
586 }
587 for (l = 0; l < ldns_rr_list_rr_count(ds_list); l++) {
588 ldns_rr_list_push_rr(trusted_ds_rrs, ldns_rr_clone(ldns_rr_list_rr(ds_list, l)));
589 new_keys_trusted = true;
590 }
591 }
592 }
593 }
594 if (new_keys_trusted) {
595 print_rr_list_abbr(stdout, ds_list, TRUST);
596 } else {
597 print_rr_list_abbr(stdout, ds_list, SELF);
598 }
599 } else {
600 result = 3;
601 print_rr_list_abbr(stdout, ds_list, BOGUS);
602 }
603
604 ldns_rr_list_free(current_correct_keys);
605 current_correct_keys = NULL;
606 } else {
607 /* wait apparently there were no keys either, go back to the ds packet */
608 ldns_pkt_free(p);
609 ldns_rr_list_deep_free(ds_sig_list);
610 p = get_dnssec_pkt(res, labels[i-1], LDNS_RR_TYPE_DS);
611 (void) get_ds(p, labels[i-1], &ds_list, &ds_sig_list);
612
613 status = ldns_verify_denial(p, labels[i-1], LDNS_RR_TYPE_DS, &nsec_rrs, &nsec_rr_sigs);
614
615 if (verbosity >= 4) {
616 printf("NSEC(3) Records to verify:\n");
617 ldns_rr_list_print(stdout, nsec_rrs);
618 printf("With signatures:\n");
619 ldns_rr_list_print(stdout, nsec_rr_sigs);
620 printf("correct keys:\n");
621 ldns_rr_list_print(stdout, correct_key_list);
622 }
623
624 if (status == LDNS_STATUS_OK) {
625 if ((st = ldns_verify(nsec_rrs, nsec_rr_sigs, trusted_keys, NULL)) == LDNS_STATUS_OK) {
626 fprintf(stdout, "%s ", TRUST);
627 fprintf(stdout, "Existence denied: ");
628 ldns_rdf_print(stdout, labels[i-1]);
629 printf(" DS");
630 fprintf(stdout, "\n");
631 } else if ((st = ldns_verify(nsec_rrs, nsec_rr_sigs, correct_key_list, NULL)) == LDNS_STATUS_OK) {
632 fprintf(stdout, "%s ", SELF);
633 fprintf(stdout, "Existence denied: ");
634 ldns_rdf_print(stdout, labels[i-1]);
635 printf(" DS");
636 fprintf(stdout, "\n");
637 } else {
638 result = 4;
639 fprintf(stdout, "%s ", BOGUS);
640 printf("Error verifying denial of existence for ");
641 ldns_rdf_print(stdout, labels[i-1]);
642 printf(" DS");
643 printf(": %s\n", ldns_get_errorstr_by_id(st));
644 }
645
646
647 } else {
648 if (status == LDNS_STATUS_CRYPTO_NO_RRSIG) {
649 printf(";; No DS for ");
650 ldns_rdf_print(stdout, labels[i - 1]);
651 } else {
652 printf(BOGUS " Unable to verify denial of existence for ");
653 ldns_rdf_print(stdout, labels[i - 1]);
654 printf(" DS: %s\n", ldns_get_errorstr_by_id(status));
655 }
656 }
657 if (verbosity >= 2) {
658 printf(";; No ds record for delegation\n");
659 }
660 }
661 }
662 ldns_rr_list_deep_free(ds_list);
663 ldns_pkt_free(p);
664 } else {
665 /* if this is the last label, just verify the data and stop */
666 p = get_dnssec_pkt(res, labels[i], t);
667 (void) get_dnssec_rr(p, labels[i], t, &dataset, &key_sig_list);
668 if (dataset && ldns_rr_list_rr_count(dataset) > 0) {
669 if (key_sig_list && ldns_rr_list_rr_count(key_sig_list) > 0) {
670
671 /* If this is a wildcard, you must be able to deny exact match */
672 if ((st = ldns_verify(dataset, key_sig_list, trusted_keys, NULL)) == LDNS_STATUS_OK) {
673 fprintf(stdout, "%s ", TRUST);
674 ldns_rr_list_print(stdout, dataset);
675 } else if ((st = ldns_verify(dataset, key_sig_list, correct_key_list, NULL)) == LDNS_STATUS_OK) {
676 fprintf(stdout, "%s ", SELF);
677 ldns_rr_list_print(stdout, dataset);
678 } else {
679 result = 5;
680 fprintf(stdout, "%s ", BOGUS);
681 ldns_rr_list_print(stdout, dataset);
682 printf(";; Error: %s\n", ldns_get_errorstr_by_id(st));
683 }
684 } else {
685 fprintf(stdout, "%s ", UNSIGNED);
686 ldns_rr_list_print(stdout, dataset);
687 }
688 ldns_rr_list_deep_free(dataset);
689 } else {
690 status = ldns_verify_denial(p, name, t, &nsec_rrs, &nsec_rr_sigs);
691 if (status == LDNS_STATUS_OK) {
692 /* verify the nsec3 themselves*/
693 if (verbosity >= 5) {
694 printf("NSEC(3) Records to verify:\n");
695 ldns_rr_list_print(stdout, nsec_rrs);
696 printf("With signatures:\n");
697 ldns_rr_list_print(stdout, nsec_rr_sigs);
698 printf("correct keys:\n");
699 ldns_rr_list_print(stdout, correct_key_list);
700 /*
701 printf("trusted keys at %p:\n", trusted_keys);
702 ldns_rr_list_print(stdout, trusted_keys);
703 */ }
704
705 if ((st = ldns_verify(nsec_rrs, nsec_rr_sigs, trusted_keys, NULL)) == LDNS_STATUS_OK) {
706 fprintf(stdout, "%s ", TRUST);
707 fprintf(stdout, "Existence denied: ");
708 ldns_rdf_print(stdout, name);
709 if (descriptor && descriptor->_name) {
710 printf(" %s", descriptor->_name);
711 } else {
712 printf(" TYPE%u", t);
713 }
714 fprintf(stdout, "\n");
715 } else if ((st = ldns_verify(nsec_rrs, nsec_rr_sigs, correct_key_list, NULL)) == LDNS_STATUS_OK) {
716 fprintf(stdout, "%s ", SELF);
717 fprintf(stdout, "Existence denied: ");
718 ldns_rdf_print(stdout, name);
719 if (descriptor && descriptor->_name) {
720 printf(" %s", descriptor->_name);
721 } else {
722 printf(" TYPE%u", t);
723 }
724 fprintf(stdout, "\n");
725 } else {
726 result = 6;
727 fprintf(stdout, "%s ", BOGUS);
728 printf("Error verifying denial of existence for ");
729 ldns_rdf_print(stdout, name);
730 printf(" type ");
731 if (descriptor && descriptor->_name) {
732 printf("%s", descriptor->_name);
733 } else {
734 printf("TYPE%u", t);
735 }
736 printf(": %s\n", ldns_get_errorstr_by_id(st));
737 }
738
739 ldns_rr_list_deep_free(nsec_rrs);
740 ldns_rr_list_deep_free(nsec_rr_sigs);
741 } else {
742 /*
743 */
744 if (status == LDNS_STATUS_CRYPTO_NO_RRSIG) {
745 printf("%s ", UNSIGNED);
746 printf("No data found for: ");
747 ldns_rdf_print(stdout, name);
748 printf(" type ");
749 if (descriptor && descriptor->_name) {
750 printf("%s", descriptor->_name);
751 } else {
752 printf("TYPE%u", t);
753 }
754 printf("\n");
755 } else {
756 printf(BOGUS " Unable to verify denial of existence for ");
757 ldns_rdf_print(stdout, name);
758 printf(" type ");
759 if (descriptor && descriptor->_name) {
760 printf("%s", descriptor->_name);
761 } else {
762 printf("TYPE%u", t);
763 }
764 printf("\n");
765 }
766
767 }
768 }
769 ldns_pkt_free(p);
770 }
771
772 new_nss = NULL;
773 ns_addr = NULL;
774 ldns_rr_list_deep_free(key_list);
775 key_list = NULL;
776 ldns_rr_list_deep_free(key_sig_list);
777 key_sig_list = NULL;
778 ds_list = NULL;
779 ldns_rr_list_deep_free(ds_sig_list);
780 ds_sig_list = NULL;
781 }
782 printf(";;" SELF " self sig OK; " BOGUS " bogus; " TRUST " trusted; " UNSIGNED " unsigned\n");
783 /* verbose mode?
784 printf("Trusted keys:\n");
785 ldns_rr_list_print(stdout, trusted_keys);
786 printf("trusted dss:\n");
787 ldns_rr_list_print(stdout, trusted_ds_rrs);
788 */
789
790 done:
791 ldns_rr_list_deep_free(trusted_ds_rrs);
792 ldns_rr_list_deep_free(correct_key_list);
793 ldns_resolver_deep_free(res);
794 if (labels) {
795 for(i = 0 ; i < (ssize_t)labels_count + 2; i++) {
796 ldns_rdf_deep_free(labels[i]);
797 }
798 LDNS_FREE(labels);
799 }
800 return result;
801 }
802 #endif /* HAVE_SSL */
803