1 /* 2 * securechasetrace.c 3 * Where all the hard work concerning secure tracing is done 4 * 5 * (c) 2005, 2006 NLnet Labs 6 * 7 * See the file LICENSE for the license 8 * 9 */ 10 11 #include "drill.h" 12 #include <ldns/ldns.h> 13 14 #define SELF "[S]" /* self sig ok */ 15 #define TRUST "[T]" /* chain from parent */ 16 #define BOGUS "[B]" /* bogus */ 17 #define UNSIGNED "[U]" /* no relevant dnssec data found */ 18 19 #if 0 20 /* See if there is a key/ds in trusted that matches 21 * a ds in *ds. 22 */ 23 static ldns_rr_list * 24 ds_key_match(ldns_rr_list *ds, ldns_rr_list *trusted) 25 { 26 size_t i, j; 27 bool match; 28 ldns_rr *rr_i, *rr_j; 29 ldns_rr_list *keys; 30 31 if (!trusted || !ds) { 32 return NULL; 33 } 34 35 match = false; 36 keys = ldns_rr_list_new(); 37 if (!keys) { 38 return NULL; 39 } 40 41 if (!ds || !trusted) { 42 return NULL; 43 } 44 45 for (i = 0; i < ldns_rr_list_rr_count(trusted); i++) { 46 rr_i = ldns_rr_list_rr(trusted, i); 47 for (j = 0; j < ldns_rr_list_rr_count(ds); j++) { 48 49 rr_j = ldns_rr_list_rr(ds, j); 50 if (ldns_rr_compare_ds(rr_i, rr_j)) { 51 match = true; 52 /* only allow unique RRs to match */ 53 ldns_rr_set_push_rr(keys, rr_i); 54 } 55 } 56 } 57 if (match) { 58 return keys; 59 } else { 60 return NULL; 61 } 62 } 63 #endif 64 65 ldns_pkt * 66 get_dnssec_pkt(ldns_resolver *r, ldns_rdf *name, ldns_rr_type t) 67 { 68 ldns_pkt *p = NULL; 69 p = ldns_resolver_query(r, name, t, LDNS_RR_CLASS_IN, 0); 70 if (!p) { 71 return NULL; 72 } else { 73 if (verbosity >= 5) { 74 ldns_pkt_print(stdout, p); 75 } 76 return p; 77 } 78 } 79 80 #ifdef HAVE_SSL 81 /* 82 * retrieve keys for this zone 83 */ 84 static ldns_pkt_type 85 get_key(ldns_pkt *p, ldns_rdf *apexname, ldns_rr_list **rrlist, ldns_rr_list **opt_sig) 86 { 87 return get_dnssec_rr(p, apexname, LDNS_RR_TYPE_DNSKEY, rrlist, opt_sig); 88 } 89 90 /* 91 * check to see if we can find a DS rrset here which we can then follow 92 */ 93 static ldns_pkt_type 94 get_ds(ldns_pkt *p, ldns_rdf *ownername, ldns_rr_list **rrlist, ldns_rr_list **opt_sig) 95 { 96 return get_dnssec_rr(p, ownername, LDNS_RR_TYPE_DS, rrlist, opt_sig); 97 } 98 #endif /* HAVE_SSL */ 99 100 void 101 remove_resolver_nameservers(ldns_resolver *res) 102 { 103 ldns_rdf *pop; 104 105 /* remove the old nameserver from the resolver */ 106 while((pop = ldns_resolver_pop_nameserver(res))) { 107 ldns_rdf_deep_free(pop); 108 } 109 110 } 111 112 void 113 show_current_nameservers(FILE *out, ldns_resolver *res) 114 { 115 size_t i; 116 fprintf(out, "Current nameservers for resolver object:\n"); 117 for (i = 0; i < ldns_resolver_nameserver_count(res); i++) { 118 ldns_rdf_print(out, ldns_resolver_nameservers(res)[i]); 119 fprintf(out, "\n"); 120 } 121 } 122 123 /*ldns_pkt **/ 124 #ifdef HAVE_SSL 125 int 126 do_secure_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t, 127 ldns_rr_class c, ldns_rr_list *trusted_keys, ldns_rdf *start_name 128 ) 129 { 130 ldns_resolver *res; 131 ldns_pkt *p, *local_p; 132 ldns_rr_list *new_nss; 133 ldns_rr_list *ns_addr; 134 ldns_rdf *pop; 135 ldns_rdf **labels = NULL; 136 ldns_status status, st; 137 ssize_t i; 138 size_t j; 139 size_t k; 140 size_t l; 141 uint8_t labels_count = 0; 142 143 /* dnssec */ 144 ldns_rr_list *key_list; 145 ldns_rr_list *key_sig_list; 146 ldns_rr_list *ds_list; 147 ldns_rr_list *ds_sig_list; 148 ldns_rr_list *correct_key_list; 149 ldns_rr_list *trusted_ds_rrs; 150 bool new_keys_trusted = false; 151 ldns_rr_list *current_correct_keys; 152 ldns_rr_list *dataset; 153 154 ldns_rr_list *nsec_rrs = NULL; 155 ldns_rr_list *nsec_rr_sigs = NULL; 156 157 /* empty non-terminal check */ 158 bool ent; 159 ldns_rr *nsecrr; /* The nsec that proofs the non-terminal */ 160 ldns_rdf *hashed_name; /* The query hashed with nsec3 params */ 161 ldns_rdf *label0; /* The first label of an nsec3 owner name */ 162 163 /* glue handling */ 164 ldns_rr_list *new_ns_addr; 165 ldns_rr_list *old_ns_addr; 166 ldns_rr *ns_rr; 167 168 int result = 0; 169 170 /* printing niceness */ 171 const ldns_rr_descriptor *descriptor; 172 173 descriptor = ldns_rr_descript(t); 174 175 new_nss = NULL; 176 ns_addr = NULL; 177 key_list = NULL; 178 ds_list = NULL; 179 180 p = NULL; 181 local_p = NULL; 182 res = ldns_resolver_new(); 183 key_sig_list = NULL; 184 ds_sig_list = NULL; 185 186 if (!res) { 187 error("Memory allocation failed"); 188 result = -1; 189 return result; 190 } 191 192 correct_key_list = ldns_rr_list_new(); 193 if (!correct_key_list) { 194 error("Memory allocation failed"); 195 result = -1; 196 return result; 197 } 198 199 trusted_ds_rrs = ldns_rr_list_new(); 200 if (!trusted_ds_rrs) { 201 error("Memory allocation failed"); 202 result = -1; 203 return result; 204 } 205 /* Add all preset trusted DS signatures to the list of trusted DS RRs. */ 206 for (j = 0; j < ldns_rr_list_rr_count(trusted_keys); j++) { 207 ldns_rr* one_rr = ldns_rr_list_rr(trusted_keys, j); 208 if (ldns_rr_get_type(one_rr) == LDNS_RR_TYPE_DS) { 209 ldns_rr_list_push_rr(trusted_ds_rrs, ldns_rr_clone(one_rr)); 210 } 211 } 212 213 /* transfer some properties of local_res to res */ 214 ldns_resolver_set_ip6(res, 215 ldns_resolver_ip6(local_res)); 216 ldns_resolver_set_port(res, 217 ldns_resolver_port(local_res)); 218 ldns_resolver_set_debug(res, 219 ldns_resolver_debug(local_res)); 220 ldns_resolver_set_fail(res, 221 ldns_resolver_fail(local_res)); 222 ldns_resolver_set_usevc(res, 223 ldns_resolver_usevc(local_res)); 224 ldns_resolver_set_random(res, 225 ldns_resolver_random(local_res)); 226 ldns_resolver_set_source(res, 227 ldns_resolver_source(local_res)); 228 ldns_resolver_set_recursive(local_res, true); 229 230 ldns_resolver_set_recursive(res, false); 231 ldns_resolver_set_dnssec_cd(res, false); 232 ldns_resolver_set_dnssec(res, true); 233 234 /* setup the root nameserver in the new resolver */ 235 status = ldns_resolver_push_nameserver_rr_list(res, global_dns_root); 236 if (status != LDNS_STATUS_OK) { 237 printf("ERRRRR: %s\n", ldns_get_errorstr_by_id(status)); 238 ldns_rr_list_print(stdout, global_dns_root); 239 result = status; 240 goto done; 241 } 242 labels_count = ldns_dname_label_count(name); 243 if (start_name) { 244 if (ldns_dname_is_subdomain(name, start_name)) { 245 labels_count -= ldns_dname_label_count(start_name); 246 } else { 247 fprintf(stderr, "Error; "); 248 ldns_rdf_print(stderr, name); 249 fprintf(stderr, " is not a subdomain of "); 250 ldns_rdf_print(stderr, start_name); 251 fprintf(stderr, "\n"); 252 goto done; 253 } 254 } 255 labels = LDNS_XMALLOC(ldns_rdf*, labels_count + 2); 256 if (!labels) { 257 goto done; 258 } 259 labels[0] = ldns_dname_new_frm_str(LDNS_ROOT_LABEL_STR); 260 labels[1] = ldns_rdf_clone(name); 261 for(i = 2 ; i < (ssize_t)labels_count + 2; i++) { 262 labels[i] = ldns_dname_left_chop(labels[i - 1]); 263 } 264 265 /* get the nameserver for the label 266 * ask: dnskey and ds for the label 267 */ 268 for(i = (ssize_t)labels_count + 1; i > 0; i--) { 269 status = ldns_resolver_send(&local_p, res, labels[i], LDNS_RR_TYPE_NS, c, 0); 270 271 if (verbosity >= 5) { 272 ldns_pkt_print(stdout, local_p); 273 } 274 275 new_nss = ldns_pkt_rr_list_by_type(local_p, 276 LDNS_RR_TYPE_NS, LDNS_SECTION_ANSWER); 277 if (!new_nss) { 278 /* if it's a delegation, servers put them in the auth section */ 279 new_nss = ldns_pkt_rr_list_by_type(local_p, 280 LDNS_RR_TYPE_NS, LDNS_SECTION_AUTHORITY); 281 } 282 283 /* if this is the final step there might not be nameserver records 284 of course if the data is in the apex, there are, so cover both 285 cases */ 286 if (new_nss || i > 1) { 287 for(j = 0; j < ldns_rr_list_rr_count(new_nss); j++) { 288 ns_rr = ldns_rr_list_rr(new_nss, j); 289 pop = ldns_rr_rdf(ns_rr, 0); 290 if (!pop) { 291 printf("nopo\n"); 292 break; 293 } 294 /* retrieve it's addresses */ 295 /* trust glue? */ 296 new_ns_addr = NULL; 297 if (ldns_dname_is_subdomain(pop, labels[i])) { 298 new_ns_addr = ldns_pkt_rr_list_by_name_and_type(local_p, pop, LDNS_RR_TYPE_A, LDNS_SECTION_ADDITIONAL); 299 } 300 if (!new_ns_addr || ldns_rr_list_rr_count(new_ns_addr) == 0) { 301 new_ns_addr = ldns_get_rr_list_addr_by_name(res, pop, c, 0); 302 } 303 if (!new_ns_addr || ldns_rr_list_rr_count(new_ns_addr) == 0) { 304 new_ns_addr = ldns_get_rr_list_addr_by_name(local_res, pop, c, 0); 305 } 306 307 if (new_ns_addr) { 308 old_ns_addr = ns_addr; 309 ns_addr = ldns_rr_list_cat_clone(ns_addr, new_ns_addr); 310 ldns_rr_list_deep_free(old_ns_addr); 311 } 312 ldns_rr_list_deep_free(new_ns_addr); 313 } 314 ldns_rr_list_deep_free(new_nss); 315 316 if (ns_addr) { 317 remove_resolver_nameservers(res); 318 319 if (ldns_resolver_push_nameserver_rr_list(res, ns_addr) != 320 LDNS_STATUS_OK) { 321 error("Error adding new nameservers"); 322 ldns_pkt_free(local_p); 323 goto done; 324 } 325 ldns_rr_list_deep_free(ns_addr); 326 } else { 327 status = ldns_verify_denial(local_p, labels[i], LDNS_RR_TYPE_NS, &nsec_rrs, &nsec_rr_sigs); 328 329 /* verify the nsec3 themselves*/ 330 if (verbosity >= 4) { 331 printf("NSEC(3) Records to verify:\n"); 332 ldns_rr_list_print(stdout, nsec_rrs); 333 printf("With signatures:\n"); 334 ldns_rr_list_print(stdout, nsec_rr_sigs); 335 printf("correct keys:\n"); 336 ldns_rr_list_print(stdout, correct_key_list); 337 } 338 339 if (status == LDNS_STATUS_OK) { 340 if ((st = ldns_verify(nsec_rrs, nsec_rr_sigs, trusted_keys, NULL)) == LDNS_STATUS_OK) { 341 fprintf(stdout, "%s ", TRUST); 342 fprintf(stdout, "Existence denied: "); 343 ldns_rdf_print(stdout, labels[i]); 344 /* 345 if (descriptor && descriptor->_name) { 346 printf(" %s", descriptor->_name); 347 } else { 348 printf(" TYPE%u", t); 349 } 350 */ fprintf(stdout, " NS\n"); 351 } else if ((st = ldns_verify(nsec_rrs, nsec_rr_sigs, correct_key_list, NULL)) == LDNS_STATUS_OK) { 352 fprintf(stdout, "%s ", SELF); 353 fprintf(stdout, "Existence denied: "); 354 ldns_rdf_print(stdout, labels[i]); 355 /* 356 if (descriptor && descriptor->_name) { 357 printf(" %s", descriptor->_name); 358 } else { 359 printf(" TYPE%u", t); 360 } 361 */ 362 fprintf(stdout, " NS\n"); 363 } else { 364 fprintf(stdout, "%s ", BOGUS); 365 result = 1; 366 printf(";; Error verifying denial of existence for name "); 367 ldns_rdf_print(stdout, labels[i]); 368 /* 369 printf(" type "); 370 if (descriptor && descriptor->_name) { 371 printf("%s", descriptor->_name); 372 } else { 373 printf("TYPE%u", t); 374 } 375 */ printf("NS: %s\n", ldns_get_errorstr_by_id(st)); 376 } 377 } else { 378 fprintf(stdout, "%s ", BOGUS); 379 result = 1; 380 printf(";; Error verifying denial of existence for name "); 381 ldns_rdf_print(stdout, labels[i]); 382 printf("NS: %s\n", ldns_get_errorstr_by_id(status)); 383 } 384 385 /* there might be an empty non-terminal, in which case we need to continue */ 386 ent = false; 387 for (j = 0; j < ldns_rr_list_rr_count(nsec_rrs); j++) { 388 nsecrr = ldns_rr_list_rr(nsec_rrs, j); 389 /* For NSEC when the next name is a subdomain of the question */ 390 if (ldns_rr_get_type(nsecrr) == LDNS_RR_TYPE_NSEC && 391 ldns_dname_is_subdomain(ldns_rr_rdf(nsecrr, 0), labels[i])) { 392 ent = true; 393 394 /* For NSEC3, the hash matches the name and the type bitmap is empty*/ 395 } else if (ldns_rr_get_type(nsecrr) == LDNS_RR_TYPE_NSEC3) { 396 hashed_name = ldns_nsec3_hash_name_frm_nsec3(nsecrr, labels[i]); 397 label0 = ldns_dname_label(ldns_rr_owner(nsecrr), 0); 398 if (hashed_name && label0 && 399 ldns_dname_compare(hashed_name, label0) == 0 && 400 ldns_nsec3_bitmap(nsecrr) == NULL) { 401 ent = true; 402 } 403 if (label0) { 404 LDNS_FREE(label0); 405 } 406 if (hashed_name) { 407 LDNS_FREE(hashed_name); 408 } 409 } 410 } 411 if (!ent) { 412 ldns_rr_list_deep_free(nsec_rrs); 413 ldns_rr_list_deep_free(nsec_rr_sigs); 414 ldns_pkt_free(local_p); 415 goto done; 416 } else { 417 printf(";; There is an empty non-terminal here, continue\n"); 418 continue; 419 } 420 } 421 422 if (ldns_resolver_nameserver_count(res) == 0) { 423 error("No nameservers found for this node"); 424 goto done; 425 } 426 } 427 ldns_pkt_free(local_p); 428 429 fprintf(stdout, ";; Domain: "); 430 ldns_rdf_print(stdout, labels[i]); 431 fprintf(stdout, "\n"); 432 433 /* retrieve keys for current domain, and verify them 434 if they match an already trusted DS, or if one of the 435 keys used to sign these is trusted, add the keys to 436 the trusted list */ 437 p = get_dnssec_pkt(res, labels[i], LDNS_RR_TYPE_DNSKEY); 438 (void) get_key(p, labels[i], &key_list, &key_sig_list); 439 if (key_sig_list) { 440 if (key_list) { 441 current_correct_keys = ldns_rr_list_new(); 442 if ((st = ldns_verify(key_list, key_sig_list, key_list, current_correct_keys)) == 443 LDNS_STATUS_OK) { 444 /* add all signed keys (don't just add current_correct, you'd miss 445 * the zsk's then */ 446 for (j = 0; j < ldns_rr_list_rr_count(key_list); j++) { 447 ldns_rr_list_push_rr(correct_key_list, ldns_rr_clone(ldns_rr_list_rr(key_list, j))); 448 } 449 450 /* check whether these keys were signed 451 * by a trusted keys. if so, these 452 * keys are also trusted */ 453 new_keys_trusted = false; 454 for (k = 0; k < ldns_rr_list_rr_count(current_correct_keys); k++) { 455 for (j = 0; j < ldns_rr_list_rr_count(trusted_ds_rrs); j++) { 456 if (ldns_rr_compare_ds(ldns_rr_list_rr(current_correct_keys, k), 457 ldns_rr_list_rr(trusted_ds_rrs, j))) { 458 new_keys_trusted = true; 459 } 460 } 461 } 462 463 /* also all keys are trusted if one of the current correct keys is trusted */ 464 for (k = 0; k < ldns_rr_list_rr_count(current_correct_keys); k++) { 465 for (j = 0; j < ldns_rr_list_rr_count(trusted_keys); j++) { 466 if (ldns_rr_compare(ldns_rr_list_rr(current_correct_keys, k), 467 ldns_rr_list_rr(trusted_keys, j)) == 0) { 468 new_keys_trusted = true; 469 } 470 } 471 } 472 473 474 if (new_keys_trusted) { 475 ldns_rr_list_push_rr_list(trusted_keys, key_list); 476 print_rr_list_abbr(stdout, key_list, TRUST); 477 ldns_rr_list_free(key_list); 478 key_list = NULL; 479 } else { 480 if (verbosity >= 2) { 481 printf(";; Signature ok but no chain to a trusted key or ds record\n"); 482 } 483 print_rr_list_abbr(stdout, key_list, SELF); 484 ldns_rr_list_deep_free(key_list); 485 key_list = NULL; 486 } 487 } else { 488 print_rr_list_abbr(stdout, key_list, BOGUS); 489 result = 2; 490 ldns_rr_list_deep_free(key_list); 491 key_list = NULL; 492 } 493 ldns_rr_list_free(current_correct_keys); 494 current_correct_keys = NULL; 495 } else { 496 printf(";; No DNSKEY record found for "); 497 ldns_rdf_print(stdout, labels[i]); 498 printf("\n"); 499 } 500 } 501 502 ldns_pkt_free(p); 503 ldns_rr_list_deep_free(key_sig_list); 504 key_sig_list = NULL; 505 506 /* check the DS records for the next child domain */ 507 if (i > 1) { 508 p = get_dnssec_pkt(res, labels[i-1], LDNS_RR_TYPE_DS); 509 (void) get_ds(p, labels[i-1], &ds_list, &ds_sig_list); 510 if (!ds_list) { 511 ldns_pkt_free(p); 512 if (ds_sig_list) { 513 ldns_rr_list_deep_free(ds_sig_list); 514 } 515 p = get_dnssec_pkt(res, name, LDNS_RR_TYPE_DNSKEY); 516 (void) get_ds(p, NULL, &ds_list, &ds_sig_list); 517 } 518 if (ds_sig_list) { 519 if (ds_list) { 520 if (verbosity >= 4) { 521 printf("VERIFYING:\n"); 522 printf("DS LIST:\n"); 523 ldns_rr_list_print(stdout, ds_list); 524 printf("SIGS:\n"); 525 ldns_rr_list_print(stdout, ds_sig_list); 526 printf("KEYS:\n"); 527 ldns_rr_list_print(stdout, correct_key_list); 528 } 529 530 current_correct_keys = ldns_rr_list_new(); 531 532 if ((st = ldns_verify(ds_list, ds_sig_list, correct_key_list, current_correct_keys)) == 533 LDNS_STATUS_OK) { 534 /* if the ds is signed by a trusted key and a key from correct keys 535 matches that ds, add that key to the trusted keys */ 536 new_keys_trusted = false; 537 if (verbosity >= 2) { 538 printf("Checking if signing key is trusted:\n"); 539 } 540 for (j = 0; j < ldns_rr_list_rr_count(current_correct_keys); j++) { 541 if (verbosity >= 2) { 542 printf("New key: "); 543 ldns_rr_print(stdout, ldns_rr_list_rr(current_correct_keys, j)); 544 } 545 for (k = 0; k < ldns_rr_list_rr_count(trusted_keys); k++) { 546 if (verbosity >= 2) { 547 printf("\tTrusted key: "); 548 ldns_rr_print(stdout, ldns_rr_list_rr(trusted_keys, k)); 549 } 550 if (ldns_rr_compare(ldns_rr_list_rr(current_correct_keys, j), 551 ldns_rr_list_rr(trusted_keys, k)) == 0) { 552 if (verbosity >= 2) { 553 printf("Key is now trusted!\n"); 554 } 555 for (l = 0; l < ldns_rr_list_rr_count(ds_list); l++) { 556 ldns_rr_list_push_rr(trusted_ds_rrs, ldns_rr_clone(ldns_rr_list_rr(ds_list, l))); 557 new_keys_trusted = true; 558 } 559 } 560 } 561 } 562 if (new_keys_trusted) { 563 print_rr_list_abbr(stdout, ds_list, TRUST); 564 } else { 565 print_rr_list_abbr(stdout, ds_list, SELF); 566 } 567 } else { 568 result = 3; 569 print_rr_list_abbr(stdout, ds_list, BOGUS); 570 } 571 572 ldns_rr_list_free(current_correct_keys); 573 current_correct_keys = NULL; 574 } else { 575 /* wait apparently there were no keys either, go back to the ds packet */ 576 ldns_pkt_free(p); 577 ldns_rr_list_deep_free(ds_sig_list); 578 p = get_dnssec_pkt(res, labels[i-1], LDNS_RR_TYPE_DS); 579 (void) get_ds(p, labels[i-1], &ds_list, &ds_sig_list); 580 581 status = ldns_verify_denial(p, labels[i-1], LDNS_RR_TYPE_DS, &nsec_rrs, &nsec_rr_sigs); 582 583 if (verbosity >= 4) { 584 printf("NSEC(3) Records to verify:\n"); 585 ldns_rr_list_print(stdout, nsec_rrs); 586 printf("With signatures:\n"); 587 ldns_rr_list_print(stdout, nsec_rr_sigs); 588 printf("correct keys:\n"); 589 ldns_rr_list_print(stdout, correct_key_list); 590 } 591 592 if (status == LDNS_STATUS_OK) { 593 if ((st = ldns_verify(nsec_rrs, nsec_rr_sigs, trusted_keys, NULL)) == LDNS_STATUS_OK) { 594 fprintf(stdout, "%s ", TRUST); 595 fprintf(stdout, "Existence denied: "); 596 ldns_rdf_print(stdout, labels[i-1]); 597 printf(" DS"); 598 fprintf(stdout, "\n"); 599 } else if ((st = ldns_verify(nsec_rrs, nsec_rr_sigs, correct_key_list, NULL)) == LDNS_STATUS_OK) { 600 fprintf(stdout, "%s ", SELF); 601 fprintf(stdout, "Existence denied: "); 602 ldns_rdf_print(stdout, labels[i-1]); 603 printf(" DS"); 604 fprintf(stdout, "\n"); 605 } else { 606 result = 4; 607 fprintf(stdout, "%s ", BOGUS); 608 printf("Error verifying denial of existence for "); 609 ldns_rdf_print(stdout, labels[i-1]); 610 printf(" DS"); 611 printf(": %s\n", ldns_get_errorstr_by_id(st)); 612 } 613 614 615 } else { 616 if (status == LDNS_STATUS_CRYPTO_NO_RRSIG) { 617 printf(";; No DS for "); 618 ldns_rdf_print(stdout, labels[i - 1]); 619 } else { 620 printf("[B] Unable to verify denial of existence for "); 621 ldns_rdf_print(stdout, labels[i - 1]); 622 printf(" DS: %s\n", ldns_get_errorstr_by_id(status)); 623 } 624 } 625 if (verbosity >= 2) { 626 printf(";; No ds record for delegation\n"); 627 } 628 } 629 } 630 ldns_rr_list_deep_free(ds_list); 631 ldns_pkt_free(p); 632 } else { 633 /* if this is the last label, just verify the data and stop */ 634 p = get_dnssec_pkt(res, labels[i], t); 635 (void) get_dnssec_rr(p, labels[i], t, &dataset, &key_sig_list); 636 if (dataset && ldns_rr_list_rr_count(dataset) > 0) { 637 if (key_sig_list && ldns_rr_list_rr_count(key_sig_list) > 0) { 638 639 /* If this is a wildcard, you must be able to deny exact match */ 640 if ((st = ldns_verify(dataset, key_sig_list, trusted_keys, NULL)) == LDNS_STATUS_OK) { 641 fprintf(stdout, "%s ", TRUST); 642 ldns_rr_list_print(stdout, dataset); 643 } else if ((st = ldns_verify(dataset, key_sig_list, correct_key_list, NULL)) == LDNS_STATUS_OK) { 644 fprintf(stdout, "%s ", SELF); 645 ldns_rr_list_print(stdout, dataset); 646 } else { 647 result = 5; 648 fprintf(stdout, "%s ", BOGUS); 649 ldns_rr_list_print(stdout, dataset); 650 printf(";; Error: %s\n", ldns_get_errorstr_by_id(st)); 651 } 652 } else { 653 fprintf(stdout, "%s ", UNSIGNED); 654 ldns_rr_list_print(stdout, dataset); 655 } 656 ldns_rr_list_deep_free(dataset); 657 } else { 658 status = ldns_verify_denial(p, name, t, &nsec_rrs, &nsec_rr_sigs); 659 if (status == LDNS_STATUS_OK) { 660 /* verify the nsec3 themselves*/ 661 if (verbosity >= 5) { 662 printf("NSEC(3) Records to verify:\n"); 663 ldns_rr_list_print(stdout, nsec_rrs); 664 printf("With signatures:\n"); 665 ldns_rr_list_print(stdout, nsec_rr_sigs); 666 printf("correct keys:\n"); 667 ldns_rr_list_print(stdout, correct_key_list); 668 /* 669 printf("trusted keys at %p:\n", trusted_keys); 670 ldns_rr_list_print(stdout, trusted_keys); 671 */ } 672 673 if ((st = ldns_verify(nsec_rrs, nsec_rr_sigs, trusted_keys, NULL)) == LDNS_STATUS_OK) { 674 fprintf(stdout, "%s ", TRUST); 675 fprintf(stdout, "Existence denied: "); 676 ldns_rdf_print(stdout, name); 677 if (descriptor && descriptor->_name) { 678 printf(" %s", descriptor->_name); 679 } else { 680 printf(" TYPE%u", t); 681 } 682 fprintf(stdout, "\n"); 683 } else if ((st = ldns_verify(nsec_rrs, nsec_rr_sigs, correct_key_list, NULL)) == LDNS_STATUS_OK) { 684 fprintf(stdout, "%s ", SELF); 685 fprintf(stdout, "Existence denied: "); 686 ldns_rdf_print(stdout, name); 687 if (descriptor && descriptor->_name) { 688 printf(" %s", descriptor->_name); 689 } else { 690 printf(" TYPE%u", t); 691 } 692 fprintf(stdout, "\n"); 693 } else { 694 result = 6; 695 fprintf(stdout, "%s ", BOGUS); 696 printf("Error verifying denial of existence for "); 697 ldns_rdf_print(stdout, name); 698 printf(" type "); 699 if (descriptor && descriptor->_name) { 700 printf("%s", descriptor->_name); 701 } else { 702 printf("TYPE%u", t); 703 } 704 printf(": %s\n", ldns_get_errorstr_by_id(st)); 705 } 706 707 ldns_rr_list_deep_free(nsec_rrs); 708 ldns_rr_list_deep_free(nsec_rr_sigs); 709 } else { 710 /* 711 */ 712 if (status == LDNS_STATUS_CRYPTO_NO_RRSIG) { 713 printf("%s ", UNSIGNED); 714 printf("No data found for: "); 715 ldns_rdf_print(stdout, name); 716 printf(" type "); 717 if (descriptor && descriptor->_name) { 718 printf("%s", descriptor->_name); 719 } else { 720 printf("TYPE%u", t); 721 } 722 printf("\n"); 723 } else { 724 printf("[B] Unable to verify denial of existence for "); 725 ldns_rdf_print(stdout, name); 726 printf(" type "); 727 if (descriptor && descriptor->_name) { 728 printf("%s", descriptor->_name); 729 } else { 730 printf("TYPE%u", t); 731 } 732 printf("\n"); 733 } 734 735 } 736 } 737 ldns_pkt_free(p); 738 } 739 740 new_nss = NULL; 741 ns_addr = NULL; 742 ldns_rr_list_deep_free(key_list); 743 key_list = NULL; 744 ldns_rr_list_deep_free(key_sig_list); 745 key_sig_list = NULL; 746 ds_list = NULL; 747 ldns_rr_list_deep_free(ds_sig_list); 748 ds_sig_list = NULL; 749 } 750 printf(";;" SELF " self sig OK; " BOGUS " bogus; " TRUST " trusted\n"); 751 /* verbose mode? 752 printf("Trusted keys:\n"); 753 ldns_rr_list_print(stdout, trusted_keys); 754 printf("trusted dss:\n"); 755 ldns_rr_list_print(stdout, trusted_ds_rrs); 756 */ 757 758 done: 759 ldns_rr_list_deep_free(trusted_ds_rrs); 760 ldns_rr_list_deep_free(correct_key_list); 761 ldns_resolver_deep_free(res); 762 if (labels) { 763 for(i = 0 ; i < (ssize_t)labels_count + 2; i++) { 764 ldns_rdf_deep_free(labels[i]); 765 } 766 LDNS_FREE(labels); 767 } 768 return result; 769 } 770 #endif /* HAVE_SSL */ 771