Do not validate with revoked keys.

git-svn-id: file:///svn/unbound/trunk@1471 be551aaa-1e26-0410-a405-d3ace91eadb9

doc/Changelog

@@ -1,3 +1,7 @@
+10 February 2009: Wouter
+	- keys with rfc5011 REVOKE flag are skipped and not considered when
+	  validating data.
+
 6 February 2009: Wouter
 	- contrib contains specfile for fedora 1.2.1 (from Paul Wouters).
 	- iana portlist updated.

doc/TODO

@@ -56,8 +56,7 @@ o on windows version, implement that OS ancillary data capabilities for
   interface-automatic. IPPKTINFO, IP6PKTINFO for WSARecvMsg, WSASendMsg.
 o local-zone directive with authority service, full authority server 
   is a non-goal.
- 
-o make so revoke bit keys cannot verify signatures
+o remote control read ssl information while priviledged.
  
 o infra and lame cache: easier size config (in Mb), show usage in graphs.
 o #226: unbound_control dump_requestlist
@@ -67,4 +66,4 @@ o unbound_control forward [addr {addr}] | [off]
 o config entry to denote that a zone is to be treated as unsigned (even if 
   a DS exists to higher trust anchor).
 o see if we can include the python bindings (contrib).
-o remote control read ssl information while priviledged.
+o include cacti setup (contrib)

testcode/unitverify.c

@@ -482,6 +482,7 @@ verify_test()
 	verifytest_file("testdata/test_signatures.10", "20070829144150");
 #endif
 	verifytest_file("testdata/test_signatures.12", "20090107100022");
+	verifytest_file("testdata/test_signatures.13", "20080414005004");
 	dstest_file("testdata/test_ds_sig.1");
 	nsectest();
 	nsec3_hash_test("testdata/test_nsec3_hash.1");

testdata/test_signatures.13

@@ -0,0 +1,24 @@
+; Signature test file
+
+; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
+; later entries are verified with it.
+
+
+; DNSKEY is revoked.
+ENTRY_BEGIN
+SECTION QUESTION
+example.com.                 IN      DNSKEY
+SECTION ANSWER
+example.com.	3600	IN	DNSKEY	384 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 31027 (zsk), size = 512b}
+ENTRY_END
+
+; entry to test
+ENTRY_BEGIN
+SECTION QUESTION
+bogus.example.com.       IN      SOA
+SECTION ANSWER
+example.com.  43200   IN      SOA     home.kuroiwa.eng.br. hostmaster.cesar.sec3.br. 2008040903 86400 86400 8640000 600
+example.com.	43200	IN	RRSIG	SOA 5 2 43200 20081010000000 20080410122550 31027 example.com. af7nqRak6cEeQLytqLHMIUKPsOECA4Cu/Zpm7vdnKSh2q2+/8ZwIxwHLyCEGdiu/mTYffZEHTZytJyzxnB0oxA== ;{id = 31027}
+ENTRY_END
+
+

validator/val_sigcrypt.c

@@ -523,8 +523,11 @@ dnskeyset_verify_rrset_sig(struct module_env* env, struct val_env* ve,
 		if(algo != dnskey_get_algo(dnskey, i) ||
 			tag != dnskey_calc_keytag(dnskey, i))
 			continue;
-
 		numchecked ++;
+		/* skip revoked keys */
+		if(dnskey_get_flags(dnskey, i) & LDNS_KEY_REVOKE_KEY)
+			continue;
+
 		/* see if key verifies */
 		sec = dnskey_verify_rrset_sig(env->scratch, 
 			env->scratch_buffer, ve, now, rrset, dnskey, i,