zoneverify.c revision 1.1.1.9
1 /* $NetBSD: zoneverify.c,v 1.1.1.9 2023/01/25 20:36:46 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * SPDX-License-Identifier: MPL-2.0 7 * 8 * This Source Code Form is subject to the terms of the Mozilla Public 9 * License, v. 2.0. If a copy of the MPL was not distributed with this 10 * file, you can obtain one at https://mozilla.org/MPL/2.0/. 11 * 12 * See the COPYRIGHT file distributed with this work for additional 13 * information regarding copyright ownership. 14 */ 15 16 /*! \file */ 17 18 #include <inttypes.h> 19 #include <stdarg.h> 20 #include <stdbool.h> 21 #include <stdio.h> 22 #include <string.h> 23 24 #include <isc/base32.h> 25 #include <isc/buffer.h> 26 #include <isc/heap.h> 27 #include <isc/iterated_hash.h> 28 #include <isc/log.h> 29 #include <isc/mem.h> 30 #include <isc/region.h> 31 #include <isc/result.h> 32 #include <isc/types.h> 33 #include <isc/util.h> 34 35 #include <dns/db.h> 36 #include <dns/dbiterator.h> 37 #include <dns/dnssec.h> 38 #include <dns/fixedname.h> 39 #include <dns/keytable.h> 40 #include <dns/keyvalues.h> 41 #include <dns/log.h> 42 #include <dns/name.h> 43 #include <dns/nsec.h> 44 #include <dns/nsec3.h> 45 #include <dns/rdata.h> 46 #include <dns/rdataset.h> 47 #include <dns/rdatasetiter.h> 48 #include <dns/rdatastruct.h> 49 #include <dns/rdatatype.h> 50 #include <dns/result.h> 51 #include <dns/secalg.h> 52 #include <dns/types.h> 53 #include <dns/zone.h> 54 #include <dns/zoneverify.h> 55 56 #include <dst/dst.h> 57 58 typedef struct vctx { 59 isc_mem_t *mctx; 60 dns_zone_t *zone; 61 dns_db_t *db; 62 dns_dbversion_t *ver; 63 dns_name_t *origin; 64 dns_keytable_t *secroots; 65 bool goodksk; 66 bool goodzsk; 67 dns_rdataset_t keyset; 68 dns_rdataset_t keysigs; 69 dns_rdataset_t soaset; 70 dns_rdataset_t soasigs; 71 dns_rdataset_t nsecset; 72 dns_rdataset_t nsecsigs; 73 dns_rdataset_t nsec3paramset; 74 dns_rdataset_t nsec3paramsigs; 75 unsigned char revoked_ksk[256]; 76 unsigned char revoked_zsk[256]; 77 unsigned char standby_ksk[256]; 78 unsigned char standby_zsk[256]; 79 unsigned char ksk_algorithms[256]; 80 unsigned char zsk_algorithms[256]; 81 unsigned char bad_algorithms[256]; 82 unsigned char act_algorithms[256]; 83 isc_heap_t *expected_chains; 84 isc_heap_t *found_chains; 85 } vctx_t; 86 87 struct nsec3_chain_fixed { 88 uint8_t hash; 89 uint8_t salt_length; 90 uint8_t next_length; 91 uint16_t iterations; 92 /* 93 * The following non-fixed-length data is stored in memory after the 94 * fields declared above for each NSEC3 chain element: 95 * 96 * unsigned char salt[salt_length]; 97 * unsigned char owner[next_length]; 98 * unsigned char next[next_length]; 99 */ 100 }; 101 102 /* 103 * Helper function used to calculate length of variable-length 104 * data section in object pointed to by 'chain'. 105 */ 106 static size_t 107 chain_length(struct nsec3_chain_fixed *chain) { 108 return (chain->salt_length + 2 * chain->next_length); 109 } 110 111 /*% 112 * Log a zone verification error described by 'fmt' and the variable arguments 113 * following it. Either use dns_zone_logv() or print to stderr, depending on 114 * whether the function was invoked from within named or by a standalone tool, 115 * respectively. 116 */ 117 static void 118 zoneverify_log_error(const vctx_t *vctx, const char *fmt, ...) { 119 va_list ap; 120 121 va_start(ap, fmt); 122 if (vctx->zone != NULL) { 123 dns_zone_logv(vctx->zone, DNS_LOGCATEGORY_GENERAL, 124 ISC_LOG_ERROR, NULL, fmt, ap); 125 } else { 126 vfprintf(stderr, fmt, ap); 127 fprintf(stderr, "\n"); 128 } 129 va_end(ap); 130 } 131 132 static bool 133 is_delegation(const vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node, 134 uint32_t *ttlp) { 135 dns_rdataset_t nsset; 136 isc_result_t result; 137 138 if (dns_name_equal(name, vctx->origin)) { 139 return (false); 140 } 141 142 dns_rdataset_init(&nsset); 143 result = dns_db_findrdataset(vctx->db, node, vctx->ver, 144 dns_rdatatype_ns, 0, 0, &nsset, NULL); 145 if (dns_rdataset_isassociated(&nsset)) { 146 if (ttlp != NULL) { 147 *ttlp = nsset.ttl; 148 } 149 dns_rdataset_disassociate(&nsset); 150 } 151 152 return ((result == ISC_R_SUCCESS)); 153 } 154 155 /*% 156 * Return true if version 'ver' of database 'db' contains a DNAME RRset at 157 * 'node'; return false otherwise. 158 */ 159 static bool 160 has_dname(const vctx_t *vctx, dns_dbnode_t *node) { 161 dns_rdataset_t dnameset; 162 isc_result_t result; 163 164 dns_rdataset_init(&dnameset); 165 result = dns_db_findrdataset(vctx->db, node, vctx->ver, 166 dns_rdatatype_dname, 0, 0, &dnameset, 167 NULL); 168 if (dns_rdataset_isassociated(&dnameset)) { 169 dns_rdataset_disassociate(&dnameset); 170 } 171 172 return ((result == ISC_R_SUCCESS)); 173 } 174 175 static bool 176 goodsig(const vctx_t *vctx, dns_rdata_t *sigrdata, const dns_name_t *name, 177 dst_key_t **dstkeys, size_t nkeys, dns_rdataset_t *rdataset) { 178 dns_rdata_rrsig_t sig; 179 isc_result_t result; 180 181 result = dns_rdata_tostruct(sigrdata, &sig, NULL); 182 RUNTIME_CHECK(result == ISC_R_SUCCESS); 183 184 for (size_t key = 0; key < nkeys; key++) { 185 if (sig.algorithm != dst_key_alg(dstkeys[key]) || 186 sig.keyid != dst_key_id(dstkeys[key]) || 187 !dns_name_equal(&sig.signer, vctx->origin)) 188 { 189 continue; 190 } 191 result = dns_dnssec_verify(name, rdataset, dstkeys[key], false, 192 0, vctx->mctx, sigrdata, NULL); 193 if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) { 194 return (true); 195 } 196 } 197 return (false); 198 } 199 200 static bool 201 nsec_bitmap_equal(dns_rdata_nsec_t *nsec, dns_rdata_t *rdata) { 202 isc_result_t result; 203 dns_rdata_nsec_t tmpnsec; 204 205 result = dns_rdata_tostruct(rdata, &tmpnsec, NULL); 206 RUNTIME_CHECK(result == ISC_R_SUCCESS); 207 208 if (nsec->len != tmpnsec.len || 209 memcmp(nsec->typebits, tmpnsec.typebits, nsec->len) != 0) 210 { 211 return (false); 212 } 213 return (true); 214 } 215 216 static isc_result_t 217 verifynsec(const vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node, 218 const dns_name_t *nextname, isc_result_t *vresult) { 219 unsigned char buffer[DNS_NSEC_BUFFERSIZE]; 220 char namebuf[DNS_NAME_FORMATSIZE]; 221 char nextbuf[DNS_NAME_FORMATSIZE]; 222 char found[DNS_NAME_FORMATSIZE]; 223 dns_rdataset_t rdataset; 224 dns_rdata_t rdata = DNS_RDATA_INIT; 225 dns_rdata_t tmprdata = DNS_RDATA_INIT; 226 dns_rdata_nsec_t nsec; 227 isc_result_t result; 228 229 dns_rdataset_init(&rdataset); 230 result = dns_db_findrdataset(vctx->db, node, vctx->ver, 231 dns_rdatatype_nsec, 0, 0, &rdataset, NULL); 232 if (result != ISC_R_SUCCESS) { 233 dns_name_format(name, namebuf, sizeof(namebuf)); 234 zoneverify_log_error(vctx, "Missing NSEC record for %s", 235 namebuf); 236 *vresult = ISC_R_FAILURE; 237 result = ISC_R_SUCCESS; 238 goto done; 239 } 240 241 result = dns_rdataset_first(&rdataset); 242 if (result != ISC_R_SUCCESS) { 243 zoneverify_log_error(vctx, "dns_rdataset_first(): %s", 244 isc_result_totext(result)); 245 goto done; 246 } 247 248 dns_rdataset_current(&rdataset, &rdata); 249 result = dns_rdata_tostruct(&rdata, &nsec, NULL); 250 RUNTIME_CHECK(result == ISC_R_SUCCESS); 251 252 /* Check next name is consistent */ 253 if (!dns_name_equal(&nsec.next, nextname)) { 254 dns_name_format(name, namebuf, sizeof(namebuf)); 255 dns_name_format(nextname, nextbuf, sizeof(nextbuf)); 256 dns_name_format(&nsec.next, found, sizeof(found)); 257 zoneverify_log_error(vctx, 258 "Bad NSEC record for %s, next name " 259 "mismatch (expected:%s, found:%s)", 260 namebuf, nextbuf, found); 261 *vresult = ISC_R_FAILURE; 262 goto done; 263 } 264 265 /* Check bit map is consistent */ 266 result = dns_nsec_buildrdata(vctx->db, vctx->ver, node, nextname, 267 buffer, &tmprdata); 268 if (result != ISC_R_SUCCESS) { 269 zoneverify_log_error(vctx, "dns_nsec_buildrdata(): %s", 270 isc_result_totext(result)); 271 goto done; 272 } 273 if (!nsec_bitmap_equal(&nsec, &tmprdata)) { 274 dns_name_format(name, namebuf, sizeof(namebuf)); 275 zoneverify_log_error(vctx, 276 "Bad NSEC record for %s, bit map " 277 "mismatch", 278 namebuf); 279 *vresult = ISC_R_FAILURE; 280 goto done; 281 } 282 283 result = dns_rdataset_next(&rdataset); 284 if (result != ISC_R_NOMORE) { 285 dns_name_format(name, namebuf, sizeof(namebuf)); 286 zoneverify_log_error(vctx, "Multiple NSEC records for %s", 287 namebuf); 288 *vresult = ISC_R_FAILURE; 289 goto done; 290 } 291 292 *vresult = ISC_R_SUCCESS; 293 result = ISC_R_SUCCESS; 294 295 done: 296 if (dns_rdataset_isassociated(&rdataset)) { 297 dns_rdataset_disassociate(&rdataset); 298 } 299 300 return (result); 301 } 302 303 static isc_result_t 304 check_no_rrsig(const vctx_t *vctx, const dns_rdataset_t *rdataset, 305 const dns_name_t *name, dns_dbnode_t *node) { 306 char namebuf[DNS_NAME_FORMATSIZE]; 307 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 308 dns_rdataset_t sigrdataset; 309 dns_rdatasetiter_t *rdsiter = NULL; 310 isc_result_t result; 311 312 dns_rdataset_init(&sigrdataset); 313 result = dns_db_allrdatasets(vctx->db, node, vctx->ver, 0, 0, &rdsiter); 314 if (result != ISC_R_SUCCESS) { 315 zoneverify_log_error(vctx, "dns_db_allrdatasets(): %s", 316 isc_result_totext(result)); 317 return (result); 318 } 319 for (result = dns_rdatasetiter_first(rdsiter); result == ISC_R_SUCCESS; 320 result = dns_rdatasetiter_next(rdsiter)) 321 { 322 dns_rdatasetiter_current(rdsiter, &sigrdataset); 323 if (sigrdataset.type == dns_rdatatype_rrsig && 324 sigrdataset.covers == rdataset->type) 325 { 326 dns_name_format(name, namebuf, sizeof(namebuf)); 327 dns_rdatatype_format(rdataset->type, typebuf, 328 sizeof(typebuf)); 329 zoneverify_log_error( 330 vctx, 331 "Warning: Found unexpected signatures " 332 "for %s/%s", 333 namebuf, typebuf); 334 break; 335 } 336 dns_rdataset_disassociate(&sigrdataset); 337 } 338 if (dns_rdataset_isassociated(&sigrdataset)) { 339 dns_rdataset_disassociate(&sigrdataset); 340 } 341 dns_rdatasetiter_destroy(&rdsiter); 342 343 return (ISC_R_SUCCESS); 344 } 345 346 static bool 347 chain_compare(void *arg1, void *arg2) { 348 struct nsec3_chain_fixed *e1 = arg1, *e2 = arg2; 349 /* 350 * Do each element in turn to get a stable sort. 351 */ 352 if (e1->hash < e2->hash) { 353 return (true); 354 } 355 if (e1->hash > e2->hash) { 356 return (false); 357 } 358 if (e1->iterations < e2->iterations) { 359 return (true); 360 } 361 if (e1->iterations > e2->iterations) { 362 return (false); 363 } 364 if (e1->salt_length < e2->salt_length) { 365 return (true); 366 } 367 if (e1->salt_length > e2->salt_length) { 368 return (false); 369 } 370 if (e1->next_length < e2->next_length) { 371 return (true); 372 } 373 if (e1->next_length > e2->next_length) { 374 return (false); 375 } 376 if (memcmp(e1 + 1, e2 + 1, chain_length(e1)) < 0) { 377 return (true); 378 } 379 return (false); 380 } 381 382 static bool 383 chain_equal(const struct nsec3_chain_fixed *e1, 384 const struct nsec3_chain_fixed *e2, size_t data_length) { 385 if (e1->hash != e2->hash) { 386 return (false); 387 } 388 if (e1->iterations != e2->iterations) { 389 return (false); 390 } 391 if (e1->salt_length != e2->salt_length) { 392 return (false); 393 } 394 if (e1->next_length != e2->next_length) { 395 return (false); 396 } 397 398 return (memcmp(e1 + 1, e2 + 1, data_length) == 0); 399 } 400 401 static void 402 record_nsec3(const vctx_t *vctx, const unsigned char *rawhash, 403 const dns_rdata_nsec3_t *nsec3, isc_heap_t *chains) { 404 struct nsec3_chain_fixed *element = NULL; 405 unsigned char *cp = NULL; 406 size_t len; 407 408 len = sizeof(*element) + nsec3->next_length * 2 + nsec3->salt_length; 409 410 element = isc_mem_get(vctx->mctx, len); 411 memset(element, 0, len); 412 element->hash = nsec3->hash; 413 element->salt_length = nsec3->salt_length; 414 element->next_length = nsec3->next_length; 415 element->iterations = nsec3->iterations; 416 cp = (unsigned char *)(element + 1); 417 memmove(cp, nsec3->salt, nsec3->salt_length); 418 cp += nsec3->salt_length; 419 memmove(cp, rawhash, nsec3->next_length); 420 cp += nsec3->next_length; 421 memmove(cp, nsec3->next, nsec3->next_length); 422 isc_heap_insert(chains, element); 423 } 424 425 /* 426 * Check whether any NSEC3 within 'rdataset' matches the parameters in 427 * 'nsec3param'. 428 */ 429 static isc_result_t 430 find_nsec3_match(const dns_rdata_nsec3param_t *nsec3param, 431 dns_rdataset_t *rdataset, size_t rhsize, 432 dns_rdata_nsec3_t *nsec3_match) { 433 isc_result_t result; 434 435 /* 436 * Find matching NSEC3 record. 437 */ 438 for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS; 439 result = dns_rdataset_next(rdataset)) 440 { 441 dns_rdata_t rdata = DNS_RDATA_INIT; 442 dns_rdataset_current(rdataset, &rdata); 443 result = dns_rdata_tostruct(&rdata, nsec3_match, NULL); 444 RUNTIME_CHECK(result == ISC_R_SUCCESS); 445 if (nsec3_match->hash == nsec3param->hash && 446 nsec3_match->next_length == rhsize && 447 nsec3_match->iterations == nsec3param->iterations && 448 nsec3_match->salt_length == nsec3param->salt_length && 449 memcmp(nsec3_match->salt, nsec3param->salt, 450 nsec3param->salt_length) == 0) 451 { 452 return (ISC_R_SUCCESS); 453 } 454 } 455 456 return (result); 457 } 458 459 static isc_result_t 460 match_nsec3(const vctx_t *vctx, const dns_name_t *name, 461 const dns_rdata_nsec3param_t *nsec3param, dns_rdataset_t *rdataset, 462 const unsigned char types[8192], unsigned int maxtype, 463 const unsigned char *rawhash, size_t rhsize, 464 isc_result_t *vresult) { 465 unsigned char cbm[8244]; 466 char namebuf[DNS_NAME_FORMATSIZE]; 467 dns_rdata_nsec3_t nsec3; 468 isc_result_t result; 469 unsigned int len; 470 471 result = find_nsec3_match(nsec3param, rdataset, rhsize, &nsec3); 472 if (result != ISC_R_SUCCESS) { 473 dns_name_format(name, namebuf, sizeof(namebuf)); 474 zoneverify_log_error(vctx, "Missing NSEC3 record for %s", 475 namebuf); 476 *vresult = result; 477 return (ISC_R_SUCCESS); 478 } 479 480 /* 481 * Check the type list. 482 */ 483 len = dns_nsec_compressbitmap(cbm, types, maxtype); 484 if (nsec3.len != len || memcmp(cbm, nsec3.typebits, len) != 0) { 485 dns_name_format(name, namebuf, sizeof(namebuf)); 486 zoneverify_log_error(vctx, 487 "Bad NSEC3 record for %s, bit map " 488 "mismatch", 489 namebuf); 490 *vresult = ISC_R_FAILURE; 491 return (ISC_R_SUCCESS); 492 } 493 494 /* 495 * Record chain. 496 */ 497 record_nsec3(vctx, rawhash, &nsec3, vctx->expected_chains); 498 499 /* 500 * Make sure there is only one NSEC3 record with this set of 501 * parameters. 502 */ 503 for (result = dns_rdataset_next(rdataset); result == ISC_R_SUCCESS; 504 result = dns_rdataset_next(rdataset)) 505 { 506 dns_rdata_t rdata = DNS_RDATA_INIT; 507 dns_rdataset_current(rdataset, &rdata); 508 result = dns_rdata_tostruct(&rdata, &nsec3, NULL); 509 RUNTIME_CHECK(result == ISC_R_SUCCESS); 510 if (nsec3.hash == nsec3param->hash && 511 nsec3.iterations == nsec3param->iterations && 512 nsec3.salt_length == nsec3param->salt_length && 513 memcmp(nsec3.salt, nsec3param->salt, nsec3.salt_length) == 514 0) 515 { 516 dns_name_format(name, namebuf, sizeof(namebuf)); 517 zoneverify_log_error(vctx, 518 "Multiple NSEC3 records with the " 519 "same parameter set for %s", 520 namebuf); 521 *vresult = DNS_R_DUPLICATE; 522 return (ISC_R_SUCCESS); 523 } 524 } 525 if (result != ISC_R_NOMORE) { 526 return (result); 527 } 528 529 *vresult = ISC_R_SUCCESS; 530 531 return (ISC_R_SUCCESS); 532 } 533 534 static bool 535 innsec3params(const dns_rdata_nsec3_t *nsec3, dns_rdataset_t *nsec3paramset) { 536 dns_rdata_nsec3param_t nsec3param; 537 isc_result_t result; 538 539 for (result = dns_rdataset_first(nsec3paramset); 540 result == ISC_R_SUCCESS; result = dns_rdataset_next(nsec3paramset)) 541 { 542 dns_rdata_t rdata = DNS_RDATA_INIT; 543 544 dns_rdataset_current(nsec3paramset, &rdata); 545 result = dns_rdata_tostruct(&rdata, &nsec3param, NULL); 546 RUNTIME_CHECK(result == ISC_R_SUCCESS); 547 if (nsec3param.flags == 0 && nsec3param.hash == nsec3->hash && 548 nsec3param.iterations == nsec3->iterations && 549 nsec3param.salt_length == nsec3->salt_length && 550 memcmp(nsec3param.salt, nsec3->salt, nsec3->salt_length) == 551 0) 552 { 553 return (true); 554 } 555 } 556 return (false); 557 } 558 559 static isc_result_t 560 record_found(const vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node, 561 dns_rdataset_t *nsec3paramset) { 562 unsigned char owner[NSEC3_MAX_HASH_LENGTH]; 563 dns_rdata_nsec3_t nsec3; 564 dns_rdataset_t rdataset; 565 dns_label_t hashlabel; 566 isc_buffer_t b; 567 isc_result_t result; 568 569 if (nsec3paramset == NULL || !dns_rdataset_isassociated(nsec3paramset)) 570 { 571 return (ISC_R_SUCCESS); 572 } 573 574 dns_rdataset_init(&rdataset); 575 result = dns_db_findrdataset(vctx->db, node, vctx->ver, 576 dns_rdatatype_nsec3, 0, 0, &rdataset, 577 NULL); 578 if (result != ISC_R_SUCCESS) { 579 return (ISC_R_SUCCESS); 580 } 581 582 dns_name_getlabel(name, 0, &hashlabel); 583 isc_region_consume(&hashlabel, 1); 584 isc_buffer_init(&b, owner, sizeof(owner)); 585 result = isc_base32hex_decoderegion(&hashlabel, &b); 586 if (result != ISC_R_SUCCESS) { 587 result = ISC_R_SUCCESS; 588 goto cleanup; 589 } 590 591 for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS; 592 result = dns_rdataset_next(&rdataset)) 593 { 594 dns_rdata_t rdata = DNS_RDATA_INIT; 595 dns_rdataset_current(&rdataset, &rdata); 596 result = dns_rdata_tostruct(&rdata, &nsec3, NULL); 597 RUNTIME_CHECK(result == ISC_R_SUCCESS); 598 if (nsec3.next_length != isc_buffer_usedlength(&b)) { 599 continue; 600 } 601 602 /* 603 * We only care about NSEC3 records that match a NSEC3PARAM 604 * record. 605 */ 606 if (!innsec3params(&nsec3, nsec3paramset)) { 607 continue; 608 } 609 610 /* 611 * Record chain. 612 */ 613 record_nsec3(vctx, owner, &nsec3, vctx->found_chains); 614 } 615 result = ISC_R_SUCCESS; 616 617 cleanup: 618 dns_rdataset_disassociate(&rdataset); 619 return (result); 620 } 621 622 static isc_result_t 623 isoptout(const vctx_t *vctx, const dns_rdata_nsec3param_t *nsec3param, 624 bool *optout) { 625 dns_rdataset_t rdataset; 626 dns_rdata_t rdata = DNS_RDATA_INIT; 627 dns_rdata_nsec3_t nsec3; 628 dns_fixedname_t fixed; 629 dns_name_t *hashname; 630 isc_result_t result; 631 dns_dbnode_t *node = NULL; 632 unsigned char rawhash[NSEC3_MAX_HASH_LENGTH]; 633 size_t rhsize = sizeof(rawhash); 634 635 dns_fixedname_init(&fixed); 636 result = dns_nsec3_hashname(&fixed, rawhash, &rhsize, vctx->origin, 637 vctx->origin, nsec3param->hash, 638 nsec3param->iterations, nsec3param->salt, 639 nsec3param->salt_length); 640 if (result != ISC_R_SUCCESS) { 641 zoneverify_log_error(vctx, "dns_nsec3_hashname(): %s", 642 isc_result_totext(result)); 643 return (result); 644 } 645 646 dns_rdataset_init(&rdataset); 647 hashname = dns_fixedname_name(&fixed); 648 result = dns_db_findnsec3node(vctx->db, hashname, false, &node); 649 if (result == ISC_R_SUCCESS) { 650 result = dns_db_findrdataset(vctx->db, node, vctx->ver, 651 dns_rdatatype_nsec3, 0, 0, 652 &rdataset, NULL); 653 } 654 if (result != ISC_R_SUCCESS) { 655 *optout = false; 656 result = ISC_R_SUCCESS; 657 goto done; 658 } 659 660 result = dns_rdataset_first(&rdataset); 661 if (result != ISC_R_SUCCESS) { 662 zoneverify_log_error(vctx, "dns_rdataset_first(): %s", 663 isc_result_totext(result)); 664 goto done; 665 } 666 667 dns_rdataset_current(&rdataset, &rdata); 668 669 result = dns_rdata_tostruct(&rdata, &nsec3, NULL); 670 RUNTIME_CHECK(result == ISC_R_SUCCESS); 671 *optout = ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) != 0); 672 673 done: 674 if (dns_rdataset_isassociated(&rdataset)) { 675 dns_rdataset_disassociate(&rdataset); 676 } 677 if (node != NULL) { 678 dns_db_detachnode(vctx->db, &node); 679 } 680 681 return (result); 682 } 683 684 static isc_result_t 685 verifynsec3(const vctx_t *vctx, const dns_name_t *name, 686 const dns_rdata_t *rdata, bool delegation, bool empty, 687 const unsigned char types[8192], unsigned int maxtype, 688 isc_result_t *vresult) { 689 char namebuf[DNS_NAME_FORMATSIZE]; 690 char hashbuf[DNS_NAME_FORMATSIZE]; 691 dns_rdataset_t rdataset; 692 dns_rdata_nsec3param_t nsec3param; 693 dns_fixedname_t fixed; 694 dns_name_t *hashname; 695 isc_result_t result, tvresult = ISC_R_UNSET; 696 dns_dbnode_t *node = NULL; 697 unsigned char rawhash[NSEC3_MAX_HASH_LENGTH]; 698 size_t rhsize = sizeof(rawhash); 699 bool optout = false; 700 701 result = dns_rdata_tostruct(rdata, &nsec3param, NULL); 702 RUNTIME_CHECK(result == ISC_R_SUCCESS); 703 704 if (nsec3param.flags != 0) { 705 return (ISC_R_SUCCESS); 706 } 707 708 if (!dns_nsec3_supportedhash(nsec3param.hash)) { 709 return (ISC_R_SUCCESS); 710 } 711 712 if (nsec3param.iterations > DNS_NSEC3_MAXITERATIONS) { 713 result = DNS_R_NSEC3ITERRANGE; 714 zoneverify_log_error(vctx, "verifynsec3: %s", 715 isc_result_totext(result)); 716 return (result); 717 } 718 719 result = isoptout(vctx, &nsec3param, &optout); 720 if (result != ISC_R_SUCCESS) { 721 return (result); 722 } 723 724 dns_fixedname_init(&fixed); 725 result = dns_nsec3_hashname( 726 &fixed, rawhash, &rhsize, name, vctx->origin, nsec3param.hash, 727 nsec3param.iterations, nsec3param.salt, nsec3param.salt_length); 728 if (result != ISC_R_SUCCESS) { 729 zoneverify_log_error(vctx, "dns_nsec3_hashname(): %s", 730 isc_result_totext(result)); 731 return (result); 732 } 733 734 /* 735 * We don't use dns_db_find() here as it works with the chosen 736 * nsec3 chain and we may also be called with uncommitted data 737 * from dnssec-signzone so the secure status of the zone may not 738 * be up to date. 739 */ 740 dns_rdataset_init(&rdataset); 741 hashname = dns_fixedname_name(&fixed); 742 result = dns_db_findnsec3node(vctx->db, hashname, false, &node); 743 if (result == ISC_R_SUCCESS) { 744 result = dns_db_findrdataset(vctx->db, node, vctx->ver, 745 dns_rdatatype_nsec3, 0, 0, 746 &rdataset, NULL); 747 } 748 if (result != ISC_R_SUCCESS && 749 (!delegation || (empty && !optout) || 750 (!empty && dns_nsec_isset(types, dns_rdatatype_ds)))) 751 { 752 dns_name_format(name, namebuf, sizeof(namebuf)); 753 dns_name_format(hashname, hashbuf, sizeof(hashbuf)); 754 zoneverify_log_error(vctx, "Missing NSEC3 record for %s (%s)", 755 namebuf, hashbuf); 756 } else if (result == ISC_R_NOTFOUND && delegation && (!empty || optout)) 757 { 758 result = ISC_R_SUCCESS; 759 } else if (result == ISC_R_SUCCESS) { 760 result = match_nsec3(vctx, name, &nsec3param, &rdataset, types, 761 maxtype, rawhash, rhsize, &tvresult); 762 if (result != ISC_R_SUCCESS) { 763 goto done; 764 } 765 result = tvresult; 766 } 767 768 *vresult = result; 769 result = ISC_R_SUCCESS; 770 771 done: 772 if (dns_rdataset_isassociated(&rdataset)) { 773 dns_rdataset_disassociate(&rdataset); 774 } 775 if (node != NULL) { 776 dns_db_detachnode(vctx->db, &node); 777 } 778 779 return (result); 780 } 781 782 static isc_result_t 783 verifynsec3s(const vctx_t *vctx, const dns_name_t *name, 784 dns_rdataset_t *nsec3paramset, bool delegation, bool empty, 785 const unsigned char types[8192], unsigned int maxtype, 786 isc_result_t *vresult) { 787 isc_result_t result; 788 789 for (result = dns_rdataset_first(nsec3paramset); 790 result == ISC_R_SUCCESS; result = dns_rdataset_next(nsec3paramset)) 791 { 792 dns_rdata_t rdata = DNS_RDATA_INIT; 793 794 dns_rdataset_current(nsec3paramset, &rdata); 795 result = verifynsec3(vctx, name, &rdata, delegation, empty, 796 types, maxtype, vresult); 797 if (result != ISC_R_SUCCESS) { 798 return (result); 799 } 800 if (*vresult != ISC_R_SUCCESS) { 801 break; 802 } 803 } 804 if (result == ISC_R_NOMORE) { 805 result = ISC_R_SUCCESS; 806 } 807 return (result); 808 } 809 810 static isc_result_t 811 verifyset(vctx_t *vctx, dns_rdataset_t *rdataset, const dns_name_t *name, 812 dns_dbnode_t *node, dst_key_t **dstkeys, size_t nkeys) { 813 unsigned char set_algorithms[256] = { 0 }; 814 char namebuf[DNS_NAME_FORMATSIZE]; 815 char algbuf[DNS_SECALG_FORMATSIZE]; 816 char typebuf[DNS_RDATATYPE_FORMATSIZE]; 817 dns_rdataset_t sigrdataset; 818 dns_rdatasetiter_t *rdsiter = NULL; 819 isc_result_t result; 820 821 dns_rdataset_init(&sigrdataset); 822 result = dns_db_allrdatasets(vctx->db, node, vctx->ver, 0, 0, &rdsiter); 823 if (result != ISC_R_SUCCESS) { 824 zoneverify_log_error(vctx, "dns_db_allrdatasets(): %s", 825 isc_result_totext(result)); 826 return (result); 827 } 828 for (result = dns_rdatasetiter_first(rdsiter); result == ISC_R_SUCCESS; 829 result = dns_rdatasetiter_next(rdsiter)) 830 { 831 dns_rdatasetiter_current(rdsiter, &sigrdataset); 832 if (sigrdataset.type == dns_rdatatype_rrsig && 833 sigrdataset.covers == rdataset->type) 834 { 835 break; 836 } 837 dns_rdataset_disassociate(&sigrdataset); 838 } 839 if (result != ISC_R_SUCCESS) { 840 dns_name_format(name, namebuf, sizeof(namebuf)); 841 dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf)); 842 zoneverify_log_error(vctx, "No signatures for %s/%s", namebuf, 843 typebuf); 844 for (size_t i = 0; i < ARRAY_SIZE(set_algorithms); i++) { 845 if (vctx->act_algorithms[i] != 0) { 846 vctx->bad_algorithms[i] = 1; 847 } 848 } 849 result = ISC_R_SUCCESS; 850 goto done; 851 } 852 853 for (result = dns_rdataset_first(&sigrdataset); result == ISC_R_SUCCESS; 854 result = dns_rdataset_next(&sigrdataset)) 855 { 856 dns_rdata_t rdata = DNS_RDATA_INIT; 857 dns_rdata_rrsig_t sig; 858 859 dns_rdataset_current(&sigrdataset, &rdata); 860 result = dns_rdata_tostruct(&rdata, &sig, NULL); 861 RUNTIME_CHECK(result == ISC_R_SUCCESS); 862 if (rdataset->ttl != sig.originalttl) { 863 dns_name_format(name, namebuf, sizeof(namebuf)); 864 dns_rdatatype_format(rdataset->type, typebuf, 865 sizeof(typebuf)); 866 zoneverify_log_error(vctx, 867 "TTL mismatch for " 868 "%s %s keytag %u", 869 namebuf, typebuf, sig.keyid); 870 continue; 871 } 872 if ((set_algorithms[sig.algorithm] != 0) || 873 (vctx->act_algorithms[sig.algorithm] == 0)) 874 { 875 continue; 876 } 877 if (goodsig(vctx, &rdata, name, dstkeys, nkeys, rdataset)) { 878 dns_rdataset_settrust(rdataset, dns_trust_secure); 879 dns_rdataset_settrust(&sigrdataset, dns_trust_secure); 880 set_algorithms[sig.algorithm] = 1; 881 } 882 } 883 result = ISC_R_SUCCESS; 884 885 if (memcmp(set_algorithms, vctx->act_algorithms, 886 sizeof(set_algorithms)) != 0) 887 { 888 dns_name_format(name, namebuf, sizeof(namebuf)); 889 dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf)); 890 for (size_t i = 0; i < ARRAY_SIZE(set_algorithms); i++) { 891 if ((vctx->act_algorithms[i] != 0) && 892 (set_algorithms[i] == 0)) 893 { 894 dns_secalg_format(i, algbuf, sizeof(algbuf)); 895 zoneverify_log_error(vctx, 896 "No correct %s signature " 897 "for %s %s", 898 algbuf, namebuf, typebuf); 899 vctx->bad_algorithms[i] = 1; 900 } 901 } 902 } 903 904 done: 905 if (dns_rdataset_isassociated(&sigrdataset)) { 906 dns_rdataset_disassociate(&sigrdataset); 907 } 908 dns_rdatasetiter_destroy(&rdsiter); 909 910 return (result); 911 } 912 913 static isc_result_t 914 verifynode(vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node, 915 bool delegation, dst_key_t **dstkeys, size_t nkeys, 916 dns_rdataset_t *nsecset, dns_rdataset_t *nsec3paramset, 917 const dns_name_t *nextname, isc_result_t *vresult) { 918 unsigned char types[8192] = { 0 }; 919 unsigned int maxtype = 0; 920 dns_rdataset_t rdataset; 921 dns_rdatasetiter_t *rdsiter = NULL; 922 isc_result_t result, tvresult = ISC_R_UNSET; 923 924 REQUIRE(vresult != NULL || (nsecset == NULL && nsec3paramset == NULL)); 925 926 result = dns_db_allrdatasets(vctx->db, node, vctx->ver, 0, 0, &rdsiter); 927 if (result != ISC_R_SUCCESS) { 928 zoneverify_log_error(vctx, "dns_db_allrdatasets(): %s", 929 isc_result_totext(result)); 930 return (result); 931 } 932 933 result = dns_rdatasetiter_first(rdsiter); 934 dns_rdataset_init(&rdataset); 935 while (result == ISC_R_SUCCESS) { 936 dns_rdatasetiter_current(rdsiter, &rdataset); 937 /* 938 * If we are not at a delegation then everything should be 939 * signed. If we are at a delegation then only the DS set 940 * is signed. The NS set is not signed at a delegation but 941 * its existence is recorded in the bit map. Anything else 942 * other than NSEC and DS is not signed at a delegation. 943 */ 944 if (rdataset.type != dns_rdatatype_rrsig && 945 rdataset.type != dns_rdatatype_dnskey && 946 (!delegation || rdataset.type == dns_rdatatype_ds || 947 rdataset.type == dns_rdatatype_nsec)) 948 { 949 result = verifyset(vctx, &rdataset, name, node, dstkeys, 950 nkeys); 951 if (result != ISC_R_SUCCESS) { 952 dns_rdataset_disassociate(&rdataset); 953 dns_rdatasetiter_destroy(&rdsiter); 954 return (result); 955 } 956 dns_nsec_setbit(types, rdataset.type, 1); 957 if (rdataset.type > maxtype) { 958 maxtype = rdataset.type; 959 } 960 } else if (rdataset.type != dns_rdatatype_rrsig && 961 rdataset.type != dns_rdatatype_dnskey) 962 { 963 if (rdataset.type == dns_rdatatype_ns) { 964 dns_nsec_setbit(types, rdataset.type, 1); 965 } 966 result = check_no_rrsig(vctx, &rdataset, name, node); 967 if (result != ISC_R_SUCCESS) { 968 dns_rdataset_disassociate(&rdataset); 969 dns_rdatasetiter_destroy(&rdsiter); 970 return (result); 971 } 972 } else { 973 dns_nsec_setbit(types, rdataset.type, 1); 974 } 975 dns_rdataset_disassociate(&rdataset); 976 result = dns_rdatasetiter_next(rdsiter); 977 } 978 dns_rdatasetiter_destroy(&rdsiter); 979 if (result != ISC_R_NOMORE) { 980 zoneverify_log_error(vctx, "rdataset iteration failed: %s", 981 isc_result_totext(result)); 982 return (result); 983 } 984 985 if (vresult == NULL) { 986 return (ISC_R_SUCCESS); 987 } 988 989 *vresult = ISC_R_SUCCESS; 990 991 if (nsecset != NULL && dns_rdataset_isassociated(nsecset)) { 992 result = verifynsec(vctx, name, node, nextname, &tvresult); 993 if (result != ISC_R_SUCCESS) { 994 return (result); 995 } 996 *vresult = tvresult; 997 } 998 999 if (nsec3paramset != NULL && dns_rdataset_isassociated(nsec3paramset)) { 1000 result = verifynsec3s(vctx, name, nsec3paramset, delegation, 1001 false, types, maxtype, &tvresult); 1002 if (result != ISC_R_SUCCESS) { 1003 return (result); 1004 } 1005 if (*vresult == ISC_R_SUCCESS) { 1006 *vresult = tvresult; 1007 } 1008 } 1009 1010 return (ISC_R_SUCCESS); 1011 } 1012 1013 static isc_result_t 1014 is_empty(const vctx_t *vctx, dns_dbnode_t *node, bool *empty) { 1015 dns_rdatasetiter_t *rdsiter = NULL; 1016 isc_result_t result; 1017 1018 result = dns_db_allrdatasets(vctx->db, node, vctx->ver, 0, 0, &rdsiter); 1019 if (result != ISC_R_SUCCESS) { 1020 zoneverify_log_error(vctx, "dns_db_allrdatasets(): %s", 1021 isc_result_totext(result)); 1022 return (result); 1023 } 1024 result = dns_rdatasetiter_first(rdsiter); 1025 dns_rdatasetiter_destroy(&rdsiter); 1026 1027 *empty = (result == ISC_R_NOMORE); 1028 1029 return (ISC_R_SUCCESS); 1030 } 1031 1032 static isc_result_t 1033 check_no_nsec(const vctx_t *vctx, const dns_name_t *name, dns_dbnode_t *node) { 1034 bool nsec_exists = false; 1035 dns_rdataset_t rdataset; 1036 isc_result_t result; 1037 1038 dns_rdataset_init(&rdataset); 1039 result = dns_db_findrdataset(vctx->db, node, vctx->ver, 1040 dns_rdatatype_nsec, 0, 0, &rdataset, NULL); 1041 if (result != ISC_R_NOTFOUND) { 1042 char namebuf[DNS_NAME_FORMATSIZE]; 1043 dns_name_format(name, namebuf, sizeof(namebuf)); 1044 zoneverify_log_error(vctx, "unexpected NSEC RRset at %s", 1045 namebuf); 1046 nsec_exists = true; 1047 } 1048 1049 if (dns_rdataset_isassociated(&rdataset)) { 1050 dns_rdataset_disassociate(&rdataset); 1051 } 1052 1053 return (nsec_exists ? ISC_R_FAILURE : ISC_R_SUCCESS); 1054 } 1055 1056 static void 1057 free_element(isc_mem_t *mctx, struct nsec3_chain_fixed *e) { 1058 size_t len; 1059 1060 len = sizeof(*e) + e->salt_length + 2 * e->next_length; 1061 isc_mem_put(mctx, e, len); 1062 } 1063 1064 static void 1065 free_element_heap(void *element, void *uap) { 1066 struct nsec3_chain_fixed *e = (struct nsec3_chain_fixed *)element; 1067 isc_mem_t *mctx = (isc_mem_t *)uap; 1068 1069 free_element(mctx, e); 1070 } 1071 1072 static bool 1073 _checknext(const vctx_t *vctx, const struct nsec3_chain_fixed *first, 1074 const struct nsec3_chain_fixed *e) { 1075 char buf[512]; 1076 const unsigned char *d1 = (const unsigned char *)(first + 1); 1077 const unsigned char *d2 = (const unsigned char *)(e + 1); 1078 isc_buffer_t b; 1079 isc_region_t sr; 1080 1081 d1 += first->salt_length + first->next_length; 1082 d2 += e->salt_length; 1083 1084 if (memcmp(d1, d2, first->next_length) == 0) { 1085 return (true); 1086 } 1087 1088 DE_CONST(d1 - first->next_length, sr.base); 1089 sr.length = first->next_length; 1090 isc_buffer_init(&b, buf, sizeof(buf)); 1091 isc_base32hex_totext(&sr, 1, "", &b); 1092 zoneverify_log_error(vctx, "Break in NSEC3 chain at: %.*s", 1093 (int)isc_buffer_usedlength(&b), buf); 1094 1095 DE_CONST(d1, sr.base); 1096 sr.length = first->next_length; 1097 isc_buffer_init(&b, buf, sizeof(buf)); 1098 isc_base32hex_totext(&sr, 1, "", &b); 1099 zoneverify_log_error(vctx, "Expected: %.*s", 1100 (int)isc_buffer_usedlength(&b), buf); 1101 1102 DE_CONST(d2, sr.base); 1103 sr.length = first->next_length; 1104 isc_buffer_init(&b, buf, sizeof(buf)); 1105 isc_base32hex_totext(&sr, 1, "", &b); 1106 zoneverify_log_error(vctx, "Found: %.*s", 1107 (int)isc_buffer_usedlength(&b), buf); 1108 1109 return (false); 1110 } 1111 1112 static bool 1113 checknext(isc_mem_t *mctx, const vctx_t *vctx, 1114 const struct nsec3_chain_fixed *first, struct nsec3_chain_fixed *prev, 1115 const struct nsec3_chain_fixed *cur) { 1116 bool result = _checknext(vctx, prev, cur); 1117 1118 if (prev != first) { 1119 free_element(mctx, prev); 1120 } 1121 1122 return (result); 1123 } 1124 1125 static bool 1126 checklast(isc_mem_t *mctx, const vctx_t *vctx, struct nsec3_chain_fixed *first, 1127 struct nsec3_chain_fixed *prev) { 1128 bool result = _checknext(vctx, prev, first); 1129 if (prev != first) { 1130 free_element(mctx, prev); 1131 } 1132 free_element(mctx, first); 1133 1134 return (result); 1135 } 1136 1137 static isc_result_t 1138 verify_nsec3_chains(const vctx_t *vctx, isc_mem_t *mctx) { 1139 isc_result_t result = ISC_R_SUCCESS; 1140 struct nsec3_chain_fixed *e, *f = NULL; 1141 struct nsec3_chain_fixed *first = NULL, *prev = NULL; 1142 1143 while ((e = isc_heap_element(vctx->expected_chains, 1)) != NULL) { 1144 isc_heap_delete(vctx->expected_chains, 1); 1145 if (f == NULL) { 1146 f = isc_heap_element(vctx->found_chains, 1); 1147 } 1148 if (f != NULL) { 1149 isc_heap_delete(vctx->found_chains, 1); 1150 1151 /* 1152 * Check that they match. 1153 */ 1154 if (chain_equal(e, f, chain_length(e))) { 1155 free_element(mctx, f); 1156 f = NULL; 1157 } else { 1158 if (result == ISC_R_SUCCESS) { 1159 zoneverify_log_error(vctx, "Expected " 1160 "and found " 1161 "NSEC3 " 1162 "chains not " 1163 "equal"); 1164 } 1165 result = ISC_R_FAILURE; 1166 /* 1167 * Attempt to resync found_chain. 1168 */ 1169 while (f != NULL && !chain_compare(e, f)) { 1170 free_element(mctx, f); 1171 f = isc_heap_element(vctx->found_chains, 1172 1); 1173 if (f != NULL) { 1174 isc_heap_delete( 1175 vctx->found_chains, 1); 1176 } 1177 if (f != NULL && 1178 chain_equal(e, f, chain_length(e))) 1179 { 1180 free_element(mctx, f); 1181 f = NULL; 1182 break; 1183 } 1184 } 1185 } 1186 } else if (result == ISC_R_SUCCESS) { 1187 zoneverify_log_error(vctx, "Expected and found NSEC3 " 1188 "chains " 1189 "not equal"); 1190 result = ISC_R_FAILURE; 1191 } 1192 1193 if (first == NULL) { 1194 prev = first = e; 1195 } else if (!chain_equal(first, e, first->salt_length)) { 1196 if (!checklast(mctx, vctx, first, prev)) { 1197 result = ISC_R_FAILURE; 1198 } 1199 1200 prev = first = e; 1201 } else { 1202 if (!checknext(mctx, vctx, first, prev, e)) { 1203 result = ISC_R_FAILURE; 1204 } 1205 1206 prev = e; 1207 } 1208 } 1209 if (prev != NULL) { 1210 if (!checklast(mctx, vctx, first, prev)) { 1211 result = ISC_R_FAILURE; 1212 } 1213 } 1214 do { 1215 if (f != NULL) { 1216 if (result == ISC_R_SUCCESS) { 1217 zoneverify_log_error(vctx, "Expected and found " 1218 "NSEC3 chains not " 1219 "equal"); 1220 result = ISC_R_FAILURE; 1221 } 1222 free_element(mctx, f); 1223 } 1224 f = isc_heap_element(vctx->found_chains, 1); 1225 if (f != NULL) { 1226 isc_heap_delete(vctx->found_chains, 1); 1227 } 1228 } while (f != NULL); 1229 1230 return (result); 1231 } 1232 1233 static isc_result_t 1234 verifyemptynodes(const vctx_t *vctx, const dns_name_t *name, 1235 const dns_name_t *prevname, bool isdelegation, 1236 dns_rdataset_t *nsec3paramset, isc_result_t *vresult) { 1237 dns_namereln_t reln; 1238 int order; 1239 unsigned int labels, nlabels, i; 1240 dns_name_t suffix; 1241 isc_result_t result, tvresult = ISC_R_UNSET; 1242 1243 *vresult = ISC_R_SUCCESS; 1244 1245 reln = dns_name_fullcompare(prevname, name, &order, &labels); 1246 if (order >= 0) { 1247 return (ISC_R_SUCCESS); 1248 } 1249 1250 nlabels = dns_name_countlabels(name); 1251 1252 if (reln == dns_namereln_commonancestor || 1253 reln == dns_namereln_contains) 1254 { 1255 dns_name_init(&suffix, NULL); 1256 for (i = labels + 1; i < nlabels; i++) { 1257 dns_name_getlabelsequence(name, nlabels - i, i, 1258 &suffix); 1259 if (nsec3paramset != NULL && 1260 dns_rdataset_isassociated(nsec3paramset)) 1261 { 1262 result = verifynsec3s( 1263 vctx, &suffix, nsec3paramset, 1264 isdelegation, true, NULL, 0, &tvresult); 1265 if (result != ISC_R_SUCCESS) { 1266 return (result); 1267 } 1268 if (*vresult == ISC_R_SUCCESS) { 1269 *vresult = tvresult; 1270 } 1271 } 1272 } 1273 } 1274 1275 return (ISC_R_SUCCESS); 1276 } 1277 1278 static void 1279 vctx_init(vctx_t *vctx, isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, 1280 dns_dbversion_t *ver, dns_name_t *origin, dns_keytable_t *secroots) { 1281 memset(vctx, 0, sizeof(*vctx)); 1282 1283 vctx->mctx = mctx; 1284 vctx->zone = zone; 1285 vctx->db = db; 1286 vctx->ver = ver; 1287 vctx->origin = origin; 1288 vctx->secroots = secroots; 1289 vctx->goodksk = false; 1290 vctx->goodzsk = false; 1291 1292 dns_rdataset_init(&vctx->keyset); 1293 dns_rdataset_init(&vctx->keysigs); 1294 dns_rdataset_init(&vctx->soaset); 1295 dns_rdataset_init(&vctx->soasigs); 1296 dns_rdataset_init(&vctx->nsecset); 1297 dns_rdataset_init(&vctx->nsecsigs); 1298 dns_rdataset_init(&vctx->nsec3paramset); 1299 dns_rdataset_init(&vctx->nsec3paramsigs); 1300 1301 vctx->expected_chains = NULL; 1302 isc_heap_create(mctx, chain_compare, NULL, 1024, 1303 &vctx->expected_chains); 1304 1305 vctx->found_chains = NULL; 1306 isc_heap_create(mctx, chain_compare, NULL, 1024, &vctx->found_chains); 1307 } 1308 1309 static void 1310 vctx_destroy(vctx_t *vctx) { 1311 if (dns_rdataset_isassociated(&vctx->keyset)) { 1312 dns_rdataset_disassociate(&vctx->keyset); 1313 } 1314 if (dns_rdataset_isassociated(&vctx->keysigs)) { 1315 dns_rdataset_disassociate(&vctx->keysigs); 1316 } 1317 if (dns_rdataset_isassociated(&vctx->soaset)) { 1318 dns_rdataset_disassociate(&vctx->soaset); 1319 } 1320 if (dns_rdataset_isassociated(&vctx->soasigs)) { 1321 dns_rdataset_disassociate(&vctx->soasigs); 1322 } 1323 if (dns_rdataset_isassociated(&vctx->nsecset)) { 1324 dns_rdataset_disassociate(&vctx->nsecset); 1325 } 1326 if (dns_rdataset_isassociated(&vctx->nsecsigs)) { 1327 dns_rdataset_disassociate(&vctx->nsecsigs); 1328 } 1329 if (dns_rdataset_isassociated(&vctx->nsec3paramset)) { 1330 dns_rdataset_disassociate(&vctx->nsec3paramset); 1331 } 1332 if (dns_rdataset_isassociated(&vctx->nsec3paramsigs)) { 1333 dns_rdataset_disassociate(&vctx->nsec3paramsigs); 1334 } 1335 isc_heap_foreach(vctx->expected_chains, free_element_heap, vctx->mctx); 1336 isc_heap_destroy(&vctx->expected_chains); 1337 isc_heap_foreach(vctx->found_chains, free_element_heap, vctx->mctx); 1338 isc_heap_destroy(&vctx->found_chains); 1339 } 1340 1341 static isc_result_t 1342 check_apex_rrsets(vctx_t *vctx) { 1343 dns_dbnode_t *node = NULL; 1344 isc_result_t result; 1345 1346 result = dns_db_findnode(vctx->db, vctx->origin, false, &node); 1347 if (result != ISC_R_SUCCESS) { 1348 zoneverify_log_error(vctx, 1349 "failed to find the zone's origin: %s", 1350 isc_result_totext(result)); 1351 return (result); 1352 } 1353 1354 result = dns_db_findrdataset(vctx->db, node, vctx->ver, 1355 dns_rdatatype_dnskey, 0, 0, &vctx->keyset, 1356 &vctx->keysigs); 1357 if (result != ISC_R_SUCCESS) { 1358 zoneverify_log_error(vctx, "Zone contains no DNSSEC keys"); 1359 goto done; 1360 } 1361 1362 result = dns_db_findrdataset(vctx->db, node, vctx->ver, 1363 dns_rdatatype_soa, 0, 0, &vctx->soaset, 1364 &vctx->soasigs); 1365 if (result != ISC_R_SUCCESS) { 1366 zoneverify_log_error(vctx, "Zone contains no SOA record"); 1367 goto done; 1368 } 1369 1370 result = dns_db_findrdataset(vctx->db, node, vctx->ver, 1371 dns_rdatatype_nsec, 0, 0, &vctx->nsecset, 1372 &vctx->nsecsigs); 1373 if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) { 1374 zoneverify_log_error(vctx, "NSEC lookup failed"); 1375 goto done; 1376 } 1377 1378 result = dns_db_findrdataset( 1379 vctx->db, node, vctx->ver, dns_rdatatype_nsec3param, 0, 0, 1380 &vctx->nsec3paramset, &vctx->nsec3paramsigs); 1381 if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) { 1382 zoneverify_log_error(vctx, "NSEC3PARAM lookup failed"); 1383 goto done; 1384 } 1385 1386 if (!dns_rdataset_isassociated(&vctx->keysigs)) { 1387 zoneverify_log_error(vctx, "DNSKEY is not signed " 1388 "(keys offline or inactive?)"); 1389 result = ISC_R_FAILURE; 1390 goto done; 1391 } 1392 1393 if (!dns_rdataset_isassociated(&vctx->soasigs)) { 1394 zoneverify_log_error(vctx, "SOA is not signed " 1395 "(keys offline or inactive?)"); 1396 result = ISC_R_FAILURE; 1397 goto done; 1398 } 1399 1400 if (dns_rdataset_isassociated(&vctx->nsecset) && 1401 !dns_rdataset_isassociated(&vctx->nsecsigs)) 1402 { 1403 zoneverify_log_error(vctx, "NSEC is not signed " 1404 "(keys offline or inactive?)"); 1405 result = ISC_R_FAILURE; 1406 goto done; 1407 } 1408 1409 if (dns_rdataset_isassociated(&vctx->nsec3paramset) && 1410 !dns_rdataset_isassociated(&vctx->nsec3paramsigs)) 1411 { 1412 zoneverify_log_error(vctx, "NSEC3PARAM is not signed " 1413 "(keys offline or inactive?)"); 1414 result = ISC_R_FAILURE; 1415 goto done; 1416 } 1417 1418 if (!dns_rdataset_isassociated(&vctx->nsecset) && 1419 !dns_rdataset_isassociated(&vctx->nsec3paramset)) 1420 { 1421 zoneverify_log_error(vctx, "No valid NSEC/NSEC3 chain for " 1422 "testing"); 1423 result = ISC_R_FAILURE; 1424 goto done; 1425 } 1426 1427 result = ISC_R_SUCCESS; 1428 1429 done: 1430 dns_db_detachnode(vctx->db, &node); 1431 1432 return (result); 1433 } 1434 1435 /*% 1436 * Update 'vctx' tables tracking active and standby key algorithms used in the 1437 * verified zone based on the signatures made using 'dnskey' (prepared from 1438 * 'rdata') found at zone apex. Set 'vctx->goodksk' or 'vctx->goodzsk' to true 1439 * if 'dnskey' correctly signs the DNSKEY RRset at zone apex and either 1440 * 'vctx->secroots' is NULL or 'dnskey' is present in 'vctx->secroots'. 1441 * 1442 * The variables to update are chosen based on 'is_ksk', which is true when 1443 * 'dnskey' is a KSK and false otherwise. 1444 */ 1445 static void 1446 check_dnskey_sigs(vctx_t *vctx, const dns_rdata_dnskey_t *dnskey, 1447 dns_rdata_t *keyrdata, bool is_ksk) { 1448 unsigned char *active_keys = NULL, *standby_keys = NULL; 1449 dns_keynode_t *keynode = NULL; 1450 bool *goodkey = NULL; 1451 dst_key_t *key = NULL; 1452 isc_result_t result; 1453 dns_rdataset_t dsset; 1454 1455 active_keys = (is_ksk ? vctx->ksk_algorithms : vctx->zsk_algorithms); 1456 standby_keys = (is_ksk ? vctx->standby_ksk : vctx->standby_zsk); 1457 goodkey = (is_ksk ? &vctx->goodksk : &vctx->goodzsk); 1458 1459 /* 1460 * First, does this key sign the DNSKEY rrset? 1461 */ 1462 if (!dns_dnssec_selfsigns(keyrdata, vctx->origin, &vctx->keyset, 1463 &vctx->keysigs, false, vctx->mctx)) 1464 { 1465 if (!is_ksk && 1466 dns_dnssec_signs(keyrdata, vctx->origin, &vctx->soaset, 1467 &vctx->soasigs, false, vctx->mctx)) 1468 { 1469 if (active_keys[dnskey->algorithm] != DNS_KEYALG_MAX) { 1470 active_keys[dnskey->algorithm]++; 1471 } 1472 } else { 1473 if (standby_keys[dnskey->algorithm] != DNS_KEYALG_MAX) { 1474 standby_keys[dnskey->algorithm]++; 1475 } 1476 } 1477 return; 1478 } 1479 1480 if (active_keys[dnskey->algorithm] != DNS_KEYALG_MAX) { 1481 active_keys[dnskey->algorithm]++; 1482 } 1483 1484 /* 1485 * If a trust anchor table was not supplied, a correctly self-signed 1486 * DNSKEY RRset is good enough. 1487 */ 1488 if (vctx->secroots == NULL) { 1489 *goodkey = true; 1490 return; 1491 } 1492 1493 /* 1494 * Convert the supplied key rdata to dst_key_t. (If this 1495 * fails we can't go further.) 1496 */ 1497 result = dns_dnssec_keyfromrdata(vctx->origin, keyrdata, vctx->mctx, 1498 &key); 1499 RUNTIME_CHECK(result == ISC_R_SUCCESS); 1500 1501 /* 1502 * Look up the supplied key in the trust anchor table. 1503 * If we don't find an exact match, or if the keynode data 1504 * is NULL, then we have neither a DNSKEY nor a DS format 1505 * trust anchor, and can give up. 1506 */ 1507 result = dns_keytable_find(vctx->secroots, vctx->origin, &keynode); 1508 if (result != ISC_R_SUCCESS) { 1509 /* No such trust anchor */ 1510 goto cleanup; 1511 } 1512 1513 /* 1514 * If the keynode has any DS format trust anchors, that means 1515 * it doesn't have any DNSKEY ones. So, we can check for a DS 1516 * match and then stop. 1517 */ 1518 dns_rdataset_init(&dsset); 1519 if (dns_keynode_dsset(keynode, &dsset)) { 1520 for (result = dns_rdataset_first(&dsset); 1521 result == ISC_R_SUCCESS; 1522 result = dns_rdataset_next(&dsset)) 1523 { 1524 dns_rdata_t dsrdata = DNS_RDATA_INIT; 1525 dns_rdata_t newdsrdata = DNS_RDATA_INIT; 1526 unsigned char buf[DNS_DS_BUFFERSIZE]; 1527 dns_rdata_ds_t ds; 1528 1529 dns_rdata_reset(&dsrdata); 1530 dns_rdataset_current(&dsset, &dsrdata); 1531 result = dns_rdata_tostruct(&dsrdata, &ds, NULL); 1532 RUNTIME_CHECK(result == ISC_R_SUCCESS); 1533 1534 if (ds.key_tag != dst_key_id(key) || 1535 ds.algorithm != dst_key_alg(key)) 1536 { 1537 continue; 1538 } 1539 1540 result = dns_ds_buildrdata(vctx->origin, keyrdata, 1541 ds.digest_type, buf, 1542 &newdsrdata); 1543 if (result != ISC_R_SUCCESS) { 1544 continue; 1545 } 1546 1547 if (dns_rdata_compare(&dsrdata, &newdsrdata) == 0) { 1548 dns_rdataset_settrust(&vctx->keyset, 1549 dns_trust_secure); 1550 dns_rdataset_settrust(&vctx->keysigs, 1551 dns_trust_secure); 1552 *goodkey = true; 1553 break; 1554 } 1555 } 1556 dns_rdataset_disassociate(&dsset); 1557 1558 goto cleanup; 1559 } 1560 1561 cleanup: 1562 if (keynode != NULL) { 1563 dns_keytable_detachkeynode(vctx->secroots, &keynode); 1564 } 1565 if (key != NULL) { 1566 dst_key_free(&key); 1567 } 1568 } 1569 1570 /*% 1571 * Check that the DNSKEY RR has at least one self signing KSK and one ZSK per 1572 * algorithm in it (or, if -x was used, one self-signing KSK). 1573 */ 1574 static isc_result_t 1575 check_dnskey(vctx_t *vctx) { 1576 dns_rdata_t rdata = DNS_RDATA_INIT; 1577 dns_rdata_dnskey_t dnskey; 1578 isc_result_t result; 1579 bool is_ksk; 1580 1581 for (result = dns_rdataset_first(&vctx->keyset); 1582 result == ISC_R_SUCCESS; result = dns_rdataset_next(&vctx->keyset)) 1583 { 1584 dns_rdataset_current(&vctx->keyset, &rdata); 1585 result = dns_rdata_tostruct(&rdata, &dnskey, NULL); 1586 RUNTIME_CHECK(result == ISC_R_SUCCESS); 1587 is_ksk = ((dnskey.flags & DNS_KEYFLAG_KSK) != 0); 1588 1589 if ((dnskey.flags & DNS_KEYOWNER_ZONE) != 0 && 1590 (dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) 1591 { 1592 if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 && 1593 !dns_dnssec_selfsigns(&rdata, vctx->origin, 1594 &vctx->keyset, &vctx->keysigs, 1595 false, vctx->mctx)) 1596 { 1597 char namebuf[DNS_NAME_FORMATSIZE]; 1598 char buffer[1024]; 1599 isc_buffer_t buf; 1600 1601 dns_name_format(vctx->origin, namebuf, 1602 sizeof(namebuf)); 1603 isc_buffer_init(&buf, buffer, sizeof(buffer)); 1604 result = dns_rdata_totext(&rdata, NULL, &buf); 1605 if (result != ISC_R_SUCCESS) { 1606 zoneverify_log_error( 1607 vctx, "dns_rdata_totext: %s", 1608 isc_result_totext(result)); 1609 return (ISC_R_FAILURE); 1610 } 1611 zoneverify_log_error( 1612 vctx, 1613 "revoked KSK is not self signed:\n" 1614 "%s DNSKEY %.*s", 1615 namebuf, 1616 (int)isc_buffer_usedlength(&buf), 1617 buffer); 1618 return (ISC_R_FAILURE); 1619 } 1620 if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 && 1621 vctx->revoked_ksk[dnskey.algorithm] != 1622 DNS_KEYALG_MAX) 1623 { 1624 vctx->revoked_ksk[dnskey.algorithm]++; 1625 } else if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 && 1626 vctx->revoked_zsk[dnskey.algorithm] != 1627 DNS_KEYALG_MAX) 1628 { 1629 vctx->revoked_zsk[dnskey.algorithm]++; 1630 } 1631 } else { 1632 check_dnskey_sigs(vctx, &dnskey, &rdata, is_ksk); 1633 } 1634 dns_rdata_freestruct(&dnskey); 1635 dns_rdata_reset(&rdata); 1636 } 1637 1638 return (ISC_R_SUCCESS); 1639 } 1640 1641 static void 1642 determine_active_algorithms(vctx_t *vctx, bool ignore_kskflag, 1643 bool keyset_kskonly, 1644 void (*report)(const char *, ...)) { 1645 char algbuf[DNS_SECALG_FORMATSIZE]; 1646 1647 report("Verifying the zone using the following algorithms:"); 1648 1649 for (size_t i = 0; i < ARRAY_SIZE(vctx->act_algorithms); i++) { 1650 if (ignore_kskflag) { 1651 vctx->act_algorithms[i] = (vctx->ksk_algorithms[i] != 1652 0 || 1653 vctx->zsk_algorithms[i] != 0) 1654 ? 1 1655 : 0; 1656 } else { 1657 vctx->act_algorithms[i] = vctx->ksk_algorithms[i] != 0 1658 ? 1 1659 : 0; 1660 } 1661 if (vctx->act_algorithms[i] != 0) { 1662 dns_secalg_format(i, algbuf, sizeof(algbuf)); 1663 report("- %s", algbuf); 1664 } 1665 } 1666 1667 if (ignore_kskflag || keyset_kskonly) { 1668 return; 1669 } 1670 1671 for (size_t i = 0; i < ARRAY_SIZE(vctx->ksk_algorithms); i++) { 1672 /* 1673 * The counts should both be zero or both be non-zero. Mark 1674 * the algorithm as bad if this is not met. 1675 */ 1676 if ((vctx->ksk_algorithms[i] != 0) == 1677 (vctx->zsk_algorithms[i] != 0)) 1678 { 1679 continue; 1680 } 1681 dns_secalg_format(i, algbuf, sizeof(algbuf)); 1682 zoneverify_log_error(vctx, "Missing %s for algorithm %s", 1683 (vctx->ksk_algorithms[i] != 0) ? "ZSK" 1684 : "self-" 1685 "signed " 1686 "KSK", 1687 algbuf); 1688 vctx->bad_algorithms[i] = 1; 1689 } 1690 } 1691 1692 /*% 1693 * Check that all the records not yet verified were signed by keys that are 1694 * present in the DNSKEY RRset. 1695 */ 1696 static isc_result_t 1697 verify_nodes(vctx_t *vctx, isc_result_t *vresult) { 1698 dns_fixedname_t fname, fnextname, fprevname, fzonecut; 1699 dns_name_t *name, *nextname, *prevname, *zonecut; 1700 dns_dbnode_t *node = NULL, *nextnode; 1701 dns_dbiterator_t *dbiter = NULL; 1702 dst_key_t **dstkeys; 1703 size_t count, nkeys = 0; 1704 bool done = false; 1705 isc_result_t tvresult = ISC_R_UNSET; 1706 isc_result_t result; 1707 1708 name = dns_fixedname_initname(&fname); 1709 nextname = dns_fixedname_initname(&fnextname); 1710 dns_fixedname_init(&fprevname); 1711 prevname = NULL; 1712 dns_fixedname_init(&fzonecut); 1713 zonecut = NULL; 1714 1715 count = dns_rdataset_count(&vctx->keyset); 1716 dstkeys = isc_mem_get(vctx->mctx, sizeof(*dstkeys) * count); 1717 1718 for (result = dns_rdataset_first(&vctx->keyset); 1719 result == ISC_R_SUCCESS; result = dns_rdataset_next(&vctx->keyset)) 1720 { 1721 dns_rdata_t rdata = DNS_RDATA_INIT; 1722 dns_rdataset_current(&vctx->keyset, &rdata); 1723 dstkeys[nkeys] = NULL; 1724 result = dns_dnssec_keyfromrdata(vctx->origin, &rdata, 1725 vctx->mctx, &dstkeys[nkeys]); 1726 if (result == ISC_R_SUCCESS) { 1727 nkeys++; 1728 } 1729 } 1730 1731 result = dns_db_createiterator(vctx->db, DNS_DB_NONSEC3, &dbiter); 1732 if (result != ISC_R_SUCCESS) { 1733 zoneverify_log_error(vctx, "dns_db_createiterator(): %s", 1734 isc_result_totext(result)); 1735 goto done; 1736 } 1737 1738 result = dns_dbiterator_first(dbiter); 1739 if (result != ISC_R_SUCCESS) { 1740 zoneverify_log_error(vctx, "dns_dbiterator_first(): %s", 1741 isc_result_totext(result)); 1742 goto done; 1743 } 1744 1745 while (!done) { 1746 bool isdelegation = false; 1747 1748 result = dns_dbiterator_current(dbiter, &node, name); 1749 if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) { 1750 zoneverify_log_error(vctx, 1751 "dns_dbiterator_current(): %s", 1752 isc_result_totext(result)); 1753 goto done; 1754 } 1755 if (!dns_name_issubdomain(name, vctx->origin)) { 1756 result = check_no_nsec(vctx, name, node); 1757 if (result != ISC_R_SUCCESS) { 1758 dns_db_detachnode(vctx->db, &node); 1759 goto done; 1760 } 1761 dns_db_detachnode(vctx->db, &node); 1762 result = dns_dbiterator_next(dbiter); 1763 if (result == ISC_R_NOMORE) { 1764 done = true; 1765 } else if (result != ISC_R_SUCCESS) { 1766 zoneverify_log_error(vctx, 1767 "dns_dbiterator_next(): " 1768 "%s", 1769 isc_result_totext(result)); 1770 goto done; 1771 } 1772 continue; 1773 } 1774 if (is_delegation(vctx, name, node, NULL)) { 1775 zonecut = dns_fixedname_name(&fzonecut); 1776 dns_name_copynf(name, zonecut); 1777 isdelegation = true; 1778 } else if (has_dname(vctx, node)) { 1779 zonecut = dns_fixedname_name(&fzonecut); 1780 dns_name_copynf(name, zonecut); 1781 } 1782 nextnode = NULL; 1783 result = dns_dbiterator_next(dbiter); 1784 while (result == ISC_R_SUCCESS) { 1785 bool empty; 1786 result = dns_dbiterator_current(dbiter, &nextnode, 1787 nextname); 1788 if (result != ISC_R_SUCCESS && 1789 result != DNS_R_NEWORIGIN) 1790 { 1791 zoneverify_log_error(vctx, 1792 "dns_dbiterator_current():" 1793 " %s", 1794 isc_result_totext(result)); 1795 dns_db_detachnode(vctx->db, &node); 1796 goto done; 1797 } 1798 if (!dns_name_issubdomain(nextname, vctx->origin) || 1799 (zonecut != NULL && 1800 dns_name_issubdomain(nextname, zonecut))) 1801 { 1802 result = check_no_nsec(vctx, nextname, 1803 nextnode); 1804 if (result != ISC_R_SUCCESS) { 1805 dns_db_detachnode(vctx->db, &node); 1806 dns_db_detachnode(vctx->db, &nextnode); 1807 goto done; 1808 } 1809 dns_db_detachnode(vctx->db, &nextnode); 1810 result = dns_dbiterator_next(dbiter); 1811 continue; 1812 } 1813 result = is_empty(vctx, nextnode, &empty); 1814 dns_db_detachnode(vctx->db, &nextnode); 1815 if (result != ISC_R_SUCCESS) { 1816 dns_db_detachnode(vctx->db, &node); 1817 goto done; 1818 } 1819 if (empty) { 1820 result = dns_dbiterator_next(dbiter); 1821 continue; 1822 } 1823 break; 1824 } 1825 if (result == ISC_R_NOMORE) { 1826 done = true; 1827 nextname = vctx->origin; 1828 } else if (result != ISC_R_SUCCESS) { 1829 zoneverify_log_error(vctx, 1830 "iterating through the database " 1831 "failed: %s", 1832 isc_result_totext(result)); 1833 dns_db_detachnode(vctx->db, &node); 1834 goto done; 1835 } 1836 result = verifynode(vctx, name, node, isdelegation, dstkeys, 1837 nkeys, &vctx->nsecset, &vctx->nsec3paramset, 1838 nextname, &tvresult); 1839 if (result != ISC_R_SUCCESS) { 1840 dns_db_detachnode(vctx->db, &node); 1841 goto done; 1842 } 1843 if (*vresult == ISC_R_UNSET) { 1844 *vresult = ISC_R_SUCCESS; 1845 } 1846 if (*vresult == ISC_R_SUCCESS) { 1847 *vresult = tvresult; 1848 } 1849 if (prevname != NULL) { 1850 result = verifyemptynodes( 1851 vctx, name, prevname, isdelegation, 1852 &vctx->nsec3paramset, &tvresult); 1853 if (result != ISC_R_SUCCESS) { 1854 dns_db_detachnode(vctx->db, &node); 1855 goto done; 1856 } 1857 } else { 1858 prevname = dns_fixedname_name(&fprevname); 1859 } 1860 dns_name_copynf(name, prevname); 1861 if (*vresult == ISC_R_SUCCESS) { 1862 *vresult = tvresult; 1863 } 1864 dns_db_detachnode(vctx->db, &node); 1865 } 1866 1867 dns_dbiterator_destroy(&dbiter); 1868 1869 result = dns_db_createiterator(vctx->db, DNS_DB_NSEC3ONLY, &dbiter); 1870 if (result != ISC_R_SUCCESS) { 1871 zoneverify_log_error(vctx, "dns_db_createiterator(): %s", 1872 isc_result_totext(result)); 1873 return (result); 1874 } 1875 1876 for (result = dns_dbiterator_first(dbiter); result == ISC_R_SUCCESS; 1877 result = dns_dbiterator_next(dbiter)) 1878 { 1879 result = dns_dbiterator_current(dbiter, &node, name); 1880 if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) { 1881 zoneverify_log_error(vctx, 1882 "dns_dbiterator_current(): %s", 1883 isc_result_totext(result)); 1884 goto done; 1885 } 1886 result = verifynode(vctx, name, node, false, dstkeys, nkeys, 1887 NULL, NULL, NULL, NULL); 1888 if (result != ISC_R_SUCCESS) { 1889 zoneverify_log_error(vctx, "verifynode: %s", 1890 isc_result_totext(result)); 1891 dns_db_detachnode(vctx->db, &node); 1892 goto done; 1893 } 1894 result = record_found(vctx, name, node, &vctx->nsec3paramset); 1895 dns_db_detachnode(vctx->db, &node); 1896 if (result != ISC_R_SUCCESS) { 1897 goto done; 1898 } 1899 } 1900 1901 result = ISC_R_SUCCESS; 1902 1903 done: 1904 while (nkeys-- > 0U) { 1905 dst_key_free(&dstkeys[nkeys]); 1906 } 1907 isc_mem_put(vctx->mctx, dstkeys, sizeof(*dstkeys) * count); 1908 if (dbiter != NULL) { 1909 dns_dbiterator_destroy(&dbiter); 1910 } 1911 1912 return (result); 1913 } 1914 1915 static isc_result_t 1916 check_bad_algorithms(const vctx_t *vctx, void (*report)(const char *, ...)) { 1917 char algbuf[DNS_SECALG_FORMATSIZE]; 1918 bool first = true; 1919 1920 for (size_t i = 0; i < ARRAY_SIZE(vctx->bad_algorithms); i++) { 1921 if (vctx->bad_algorithms[i] == 0) { 1922 continue; 1923 } 1924 if (first) { 1925 report("The zone is not fully signed " 1926 "for the following algorithms:"); 1927 } 1928 dns_secalg_format(i, algbuf, sizeof(algbuf)); 1929 report(" %s", algbuf); 1930 first = false; 1931 } 1932 1933 if (!first) { 1934 report("."); 1935 } 1936 1937 return (first ? ISC_R_SUCCESS : ISC_R_FAILURE); 1938 } 1939 1940 static void 1941 print_summary(const vctx_t *vctx, bool keyset_kskonly, 1942 void (*report)(const char *, ...)) { 1943 char algbuf[DNS_SECALG_FORMATSIZE]; 1944 1945 report("Zone fully signed:"); 1946 for (size_t i = 0; i < ARRAY_SIZE(vctx->ksk_algorithms); i++) { 1947 if ((vctx->ksk_algorithms[i] == 0) && 1948 (vctx->standby_ksk[i] == 0) && 1949 (vctx->revoked_ksk[i] == 0) && 1950 (vctx->zsk_algorithms[i] == 0) && 1951 (vctx->standby_zsk[i] == 0) && (vctx->revoked_zsk[i] == 0)) 1952 { 1953 continue; 1954 } 1955 dns_secalg_format(i, algbuf, sizeof(algbuf)); 1956 report("Algorithm: %s: KSKs: " 1957 "%u active, %u stand-by, %u revoked", 1958 algbuf, vctx->ksk_algorithms[i], vctx->standby_ksk[i], 1959 vctx->revoked_ksk[i]); 1960 report("%*sZSKs: " 1961 "%u active, %u %s, %u revoked", 1962 (int)strlen(algbuf) + 13, "", vctx->zsk_algorithms[i], 1963 vctx->standby_zsk[i], 1964 keyset_kskonly ? "present" : "stand-by", 1965 vctx->revoked_zsk[i]); 1966 } 1967 } 1968 1969 isc_result_t 1970 dns_zoneverify_dnssec(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, 1971 dns_name_t *origin, dns_keytable_t *secroots, 1972 isc_mem_t *mctx, bool ignore_kskflag, bool keyset_kskonly, 1973 void (*report)(const char *, ...)) { 1974 const char *keydesc = (secroots == NULL ? "self-signed" : "trusted"); 1975 isc_result_t result, vresult = ISC_R_UNSET; 1976 vctx_t vctx; 1977 1978 vctx_init(&vctx, mctx, zone, db, ver, origin, secroots); 1979 1980 result = check_apex_rrsets(&vctx); 1981 if (result != ISC_R_SUCCESS) { 1982 goto done; 1983 } 1984 1985 result = check_dnskey(&vctx); 1986 if (result != ISC_R_SUCCESS) { 1987 goto done; 1988 } 1989 1990 if (ignore_kskflag) { 1991 if (!vctx.goodksk && !vctx.goodzsk) { 1992 zoneverify_log_error(&vctx, "No %s DNSKEY found", 1993 keydesc); 1994 result = ISC_R_FAILURE; 1995 goto done; 1996 } 1997 } else if (!vctx.goodksk) { 1998 zoneverify_log_error(&vctx, "No %s KSK DNSKEY found", keydesc); 1999 result = ISC_R_FAILURE; 2000 goto done; 2001 } 2002 2003 determine_active_algorithms(&vctx, ignore_kskflag, keyset_kskonly, 2004 report); 2005 2006 result = verify_nodes(&vctx, &vresult); 2007 if (result != ISC_R_SUCCESS) { 2008 goto done; 2009 } 2010 2011 result = verify_nsec3_chains(&vctx, mctx); 2012 if (vresult == ISC_R_UNSET) { 2013 vresult = ISC_R_SUCCESS; 2014 } 2015 if (result != ISC_R_SUCCESS && vresult == ISC_R_SUCCESS) { 2016 vresult = result; 2017 } 2018 2019 result = check_bad_algorithms(&vctx, report); 2020 if (result != ISC_R_SUCCESS) { 2021 report("DNSSEC completeness test failed."); 2022 goto done; 2023 } 2024 2025 result = vresult; 2026 if (result != ISC_R_SUCCESS) { 2027 report("DNSSEC completeness test failed (%s).", 2028 dns_result_totext(result)); 2029 goto done; 2030 } 2031 2032 if (vctx.goodksk || ignore_kskflag) { 2033 print_summary(&vctx, keyset_kskonly, report); 2034 } 2035 2036 done: 2037 vctx_destroy(&vctx); 2038 2039 return (result); 2040 } 2041
Indexes created Sun Mar 01 05:31:48 UTC 2026