upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-11 10:10:00 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

If a positive validation fails and it looks like the reason is that there

Browse source 
are no material DNSSEC signatures, try an insecurity proof.
This commit is contained in:
Brian Wellington 2000-07-13 23:52:04 +00:00
parent 0840ae769a
commit 6bc1a64561
1 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
lib/dns/validator.c
View file

@ -15,7 +15,7 @@
* SOFTWARE.
*/
/* $Id: validator.c,v 1.64 2000/07/07 00:44:01 bwelling Exp $ */
/* $Id: validator.c,v 1.65 2000/07/13 23:52:04 bwelling Exp $ */
#include <config.h>
@ -72,6 +72,7 @@ struct dns_validator {
#define VALATTR_SHUTDOWN 0x01
#define VALATTR_FOUNDNONEXISTENCE 0x02
#define VALATTR_TRIEDVERIFY 0x04
#define SHUTDOWN(v) (((v)->attributes & VALATTR_SHUTDOWN) != 0)
static void
@ -922,6 +923,7 @@ validate(dns_validator_t *val, isc_boolean_t resume) {
}
do {
val->attributes |= VALATTR_TRIEDVERIFY;
result = dns_dnssec_verify(event->name,
event->rdataset,
val->key, ISC_FALSE,
@ -1278,6 +1280,13 @@ validator_start(isc_task_t *task, isc_event_t *event) {
"attempting positive response validation");
result = validate(val, ISC_FALSE);
if (result == DNS_R_NOVALIDSIG &&
(val->attributes & VALATTR_TRIEDVERIFY) == 0)
{
validator_log(val, ISC_LOG_DEBUG(3),
"falling back to insecurity proof");
result = proveunsecure(val, ISC_FALSE);
}
} else if (val->event->rdataset != NULL) {
/*
* This is either an unsecure subdomain or a response from