summaryrefslogtreecommitdiff
path: root/src/resolve/resolved-dns-transaction.h
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2016-01-04 22:35:54 +0100
committerLennart Poettering <lennart@poettering.net>2016-01-04 22:42:10 +0100
commitb2b796b8ab5565fbe60b544d2579e2bfca31bf6a (patch)
treeb06a7484dcc2fb4cfa0de22880fe048a9104c5ba /src/resolve/resolved-dns-transaction.h
parenta761c1ca851a9397b5a207ef600e077d0f7f4534 (diff)
resolved: explicitly handle case when the trust anchor is empty
Since we honour RFC5011 revoked keys it might happen we end up with an empty trust anchor, or one where there's no entry for the root left. With this patch the logic is changed what to do in this case. Before this patch we'd end up requesting the root DS, which returns with NODATA but a signed NSEC we cannot verify, since the trust anchor is empty after all. Thus we'd return a DNSSEC result of "missing-key", as we lack a verified version of the key. With this patch in place, look-ups for the root DS are explicitly recognized, and not passed on to the DNS servers. Instead, if downgrade-ok mode is on an unsigned NODATA response is synthesized, so that the validator code continues under the assumption the root zone was unsigned. If downgrade-ok mode is off a new transaction failure is generated, that makes this case recognizable.
Diffstat (limited to 'src/resolve/resolved-dns-transaction.h')
-rw-r--r--src/resolve/resolved-dns-transaction.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/src/resolve/resolved-dns-transaction.h b/src/resolve/resolved-dns-transaction.h
index 21e453218a..e0f29d95e7 100644
--- a/src/resolve/resolved-dns-transaction.h
+++ b/src/resolve/resolved-dns-transaction.h
@@ -39,6 +39,7 @@ enum DnsTransactionState {
DNS_TRANSACTION_CONNECTION_FAILURE,
DNS_TRANSACTION_ABORTED,
DNS_TRANSACTION_DNSSEC_FAILED,
+ DNS_TRANSACTION_NO_TRUST_ANCHOR,
_DNS_TRANSACTION_STATE_MAX,
_DNS_TRANSACTION_STATE_INVALID = -1
};