From 2434336ead40f2b09b9c9a9e36c64895a78516d1 Mon Sep 17 00:00:00 2001 From: Willem Toorop Date: Thu, 2 Nov 2017 12:42:26 +0100 Subject: [PATCH] Include all RRSIGs in validation chain Because we don't know algorithm support of other validators. But still canonicalize the RRset with the one used to validate just because we can. --- src/dnssec.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/dnssec.c b/src/dnssec.c index a4de8b1c..03e8c326 100644 --- a/src/dnssec.c +++ b/src/dnssec.c @@ -2971,6 +2971,26 @@ static void append_rrset2val_chain_list( _getdns_list_append_this_dict(val_chain_list, rr_dict)) getdns_dict_destroy(rr_dict); + /* Append the other RRSIGs, which were not used for validation too, + * because other validators might not have the same algorithm support. + */ + for ( rrsig = _getdns_rrsig_iter_init(&rrsig_spc, rrset) + ; rrsig + ; rrsig = _getdns_rrsig_iter_next(rrsig)) { + + if (rrsig->rr_i.nxt < rrsig->rr_i.rr_type + 28) + continue; + + if (gldns_read_uint16(rrsig->rr_i.rr_type + 26) + == (signer & 0xFFFF)) + continue; + + orig_ttl = gldns_read_uint32(rrsig->rr_i.rr_type + 14); + if ((rr_dict = _getdns_rr_iter2rr_dict_canonical( + &val_chain_list->mf, &rrsig->rr_i, &orig_ttl)) && + _getdns_list_append_this_dict(val_chain_list, rr_dict)) + getdns_dict_destroy(rr_dict); + } if (val_rrset != val_rrset_spc) GETDNS_FREE(val_chain_list->mf, val_rrset); }