upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-01-05 22:39:35 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- nss check for verification failure.

Browse source 
git-svn-id: file:///svn/unbound/trunk@2695 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2012-06-21 12:00:48 +00:00
parent 97456b8f4c
commit f2da5c6867
2 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
doc/Changelog
View file

@ -1,5 +1,6 @@
21 June 2012: Wouter
- fix error handling of alloc failure during rrsig verification.
- nss check for verification failure.
20 June 2012: Wouter
- work on --with-nss build option (for now, --with-libunbound-only).

14
validator/val_secalgo.c
View file

@ -553,6 +553,7 @@ verify_canonrrset(ldns_buffer* buf, int algo, unsigned char* sigblock,
#include <nss3/sechash.h>
#include <nss3/pk11pub.h>
#include <nss3/keyhi.h>
#include <nss3/secerr.h>
#include <nspr4/prerror.h>
size_t
@ -841,6 +842,7 @@ verify_canonrrset(ldns_buffer* buf, int algo, unsigned char* sigblock,
SECItem secsig = {siBuffer, sigblock, sigblock_len};
SECItem sechash = {siBuffer, hash, 0};
SECStatus res;
int err;
// extern SECKEYPublicKey *SECKEY_DecodeDERPublicKey(SECItem *pubkder);
// SECKEYPublicKey* SECKEY_ImportDERPublicKey(SECItem *derKey, CK_KEY_TYPE type);
@ -874,8 +876,16 @@ verify_canonrrset(ldns_buffer* buf, int algo, unsigned char* sigblock,
if(res == SECSuccess) {
return sec_status_secure;
}
verbose(VERB_QUERY, "verify: signature mismatch %s",
PORT_ErrorToString(PORT_GetError()));
err = PORT_GetError();
if(err != SEC_ERROR_BAD_SIGNATURE) {
/* failed to verify */
verbose(VERB_QUERY, "verify: PK11_Verify failed: %s",
PORT_ErrorToString(err));
SECKEY_DestroyPublicKey(pubkey);
return sec_status_unchecked;
}
verbose(VERB_QUERY, "verify: signature mismatch: %s",
PORT_ErrorToString(err));
*reason = "signature crypto failed";
return sec_status_bogus;
}