sync with external work, part 2: this adds an error list, and fixes a major NSEC3...

[captive-validator.git] / src / com / versign / tat / dnssec / CaptiveValidator.java

diff --git a/src/com/versign/tat/dnssec/CaptiveValidator.java b/src/com/versign/tat/dnssec/CaptiveValidator.java
index 9bfba09..be3c15b 100644 (file)
--- a/src/com/versign/tat/dnssec/CaptiveValidator.java
+++ b/src/com/versign/tat/dnssec/CaptiveValidator.java
@@ -50,10 +50,13 @@ public class CaptiveValidator {
     private DnsSecVerifier mVerifier;
     private Logger         log = Logger.getLogger(this.getClass());
 
+    private List<String>   mErrorList;
+
     public CaptiveValidator() {
         mVerifier        = new DnsSecVerifier();
         mValUtils        = new ValUtils(mVerifier);
         mTrustedKeys     = new TrustAnchorStore();
+        mErrorList       = new ArrayList<String>();
     }
 
     // ---------------- Module Initialization -------------------
@@ -208,7 +211,7 @@ public class CaptiveValidator {
             // Follow the CNAME chain.
             if (type == Type.CNAME) {
                 if (rrset.size() > 1) {
-                    log.debug("Found CNAME rrset with size > 1: " + rrset);
+                    mErrorList.add("Found CNAME rrset with size > 1: " + rrset);
                     m.setStatus(SecurityStatus.INVALID);
 
                     return m;
@@ -366,8 +369,8 @@ public class CaptiveValidator {
             // If the (answer) rrset failed to validate, then this message is
             // BAD.
             if (status != SecurityStatus.SECURE) {
-                log.debug("Positive response has failed ANSWER rrset: " +
-                    rrsets[i]);
+                mErrorList.add("Positive response has failed ANSWER rrset: " +
+                         rrsets[i]);
                 m.setStatus(SecurityStatus.BOGUS);
 
                 return;
@@ -392,11 +395,10 @@ public class CaptiveValidator {
             int status = mValUtils.verifySRRset(rrsets[i], key_rrset);
 
             // If anything in the authority section fails to be secure, we have
-            // a
-            // bad message.
+            // a bad message.
             if (status != SecurityStatus.SECURE) {
-                log.debug("Positive response has failed AUTHORITY rrset: " +
-                    rrsets[i]);
+                mErrorList.add("Positive response has failed AUTHORITY rrset: " +
+                         rrsets[i]);
                 m.setStatus(SecurityStatus.BOGUS);
 
                 return;
@@ -413,8 +415,7 @@ public class CaptiveValidator {
                     Name nsec_wc = ValUtils.nsecWildcard(qname, nsec);
 
                     if (!wc.equals(nsec_wc)) {
-                        // log.debug("Positive wildcard response wasn't generated "
-                        // + "by the correct wildcard");
+                        mErrorList.add("Positive wildcard response wasn't generated by the correct wildcard");
                         m.setStatus(SecurityStatus.BOGUS);
 
                         return;
@@ -440,7 +441,7 @@ public class CaptiveValidator {
         // records.
         if ((wc != null) && !wcNSEC_ok && (nsec3s != null)) {
             if (NSEC3ValUtils.proveWildcard(nsec3s, qname, key_rrset.getName(),
-                        wc)) {
+                        wc, mErrorList)) {
                 wcNSEC_ok = true;
             }
         }
@@ -492,8 +493,8 @@ public class CaptiveValidator {
                 // have
                 // a bad message.
                 if (status != SecurityStatus.SECURE) {
-                    log.debug("Positive response has failed AUTHORITY rrset: " +
-                        rrsets[i]);
+                    mErrorList.add("Positive response has failed AUTHORITY rrset: " +
+                             rrsets[i]);
                     m.setStatus(SecurityStatus.BOGUS);
 
                     return;
@@ -542,6 +543,7 @@ public class CaptiveValidator {
         // Now to check to see if we have a valid combination of things.
         if (delegation == null) {
             // somehow we have a referral without an NS rrset.
+            mErrorList.add("Apparent referral does not contain NS RRset");
             m.setStatus(SecurityStatus.BOGUS);
 
             return;
@@ -550,6 +552,7 @@ public class CaptiveValidator {
         if (secure_delegation) {
             if ((nsec != null) || ((nsec3s != null) && (nsec3s.size() > 0))) {
                 // we found both a DS rrset *and* NSEC/NSEC3 rrsets!
+                mErrorList.add("Referral contains both DS and NSEC/NSEC3 RRsets");
                 m.setStatus(SecurityStatus.BOGUS);
 
                 return;
@@ -568,6 +571,7 @@ public class CaptiveValidator {
             if (status != SecurityStatus.SECURE) {
                 // The NSEC *must* prove that there was no DS record. The
                 // INSECURE state here is still bogus.
+                mErrorList.add("Referral does not contain a NSEC record proving no DS");
                 m.setStatus(SecurityStatus.BOGUS);
 
                 return;
@@ -579,11 +583,12 @@ public class CaptiveValidator {
         }
 
         if (nsec3s.size() > 0) {
-            byte status = NSEC3ValUtils.proveNoDS(nsec3s, delegation, nsec3zone);
+            byte status = NSEC3ValUtils.proveNoDS(nsec3s, delegation, nsec3zone, mErrorList);
 
             if (status != SecurityStatus.SECURE) {
                 // the NSEC3 RRs MUST prove no DS, so the INDETERMINATE state is
                 // actually bogus
+                mErrorList.add("Referral does not contain NSEC3 record(s) proving no DS");
                 m.setStatus(SecurityStatus.BOGUS);
 
                 return;
@@ -595,9 +600,11 @@ public class CaptiveValidator {
         }
 
         // failed to find proof either way.
+        mErrorList.add("Referral does not contain proof of no DS");
         m.setStatus(SecurityStatus.BOGUS);
     }
 
+    // FIXME: write CNAME validation code.
     private void validateCNAMEResponse(SMessage message, SRRset key_rrset) {}
 
     /**
@@ -642,8 +649,8 @@ public class CaptiveValidator {
             // If the (answer) rrset failed to validate, then this message is
             // BAD.
             if (status != SecurityStatus.SECURE) {
-                log.debug("Positive response has failed ANSWER rrset: " +
-                    rrsets[i]);
+                mErrorList.add("Positive response has failed ANSWER rrset: " +
+                         rrsets[i]);
                 m.setStatus(SecurityStatus.BOGUS);
 
                 return;
@@ -658,11 +665,10 @@ public class CaptiveValidator {
             int status = mValUtils.verifySRRset(rrsets[i], key_rrset);
 
             // If anything in the authority section fails to be secure, we have
-            // a
-            // bad message.
+            // a bad message.
             if (status != SecurityStatus.SECURE) {
-                log.debug("Positive response has failed AUTHORITY rrset: " +
-                    rrsets[i]);
+                mErrorList.add("Positive response has failed AUTHORITY rrset: " +
+                         rrsets[i]);
                 m.setStatus(SecurityStatus.BOGUS);
 
                 return;
@@ -691,7 +697,7 @@ public class CaptiveValidator {
      * @param key_rrset
      *            The trusted DNSKEY rrset that signs this response.
      */
-    private void validateNodataResponse(SMessage message, SRRset key_rrset) {
+    private void validateNodataResponse(SMessage message, SRRset key_rrset, List<String> errorList) {
         Name     qname = message.getQName();
         int      qtype = message.getQType();
 
@@ -724,8 +730,8 @@ public class CaptiveValidator {
             int status = mValUtils.verifySRRset(rrsets[i], key_rrset);
 
             if (status != SecurityStatus.SECURE) {
-                log.debug("NODATA response has failed AUTHORITY rrset: " +
-                    rrsets[i]);
+                mErrorList.add("NODATA response has failed AUTHORITY rrset: " +
+                         rrsets[i]);
                 m.setStatus(SecurityStatus.BOGUS);
 
                 return;
@@ -781,13 +787,14 @@ public class CaptiveValidator {
         if (!hasValidNSEC && (nsec3s != null) && (nsec3s.size() > 0)) {
             // try to prove NODATA with our NSEC3 record(s)
             hasValidNSEC = NSEC3ValUtils.proveNodata(nsec3s, qname, qtype,
-                    nsec3Signer);
+                    nsec3Signer, errorList);
         }
 
         if (!hasValidNSEC) {
             log.debug("NODATA response failed to prove NODATA " +
                 "status with NSEC/NSEC3");
             log.trace("Failed NODATA:\n" + m);
+            mErrorList.add("NODATA response failed to prove NODATA status with NSEC/NSEC3");
             m.setStatus(SecurityStatus.BOGUS);
 
             return;
@@ -821,7 +828,8 @@ public class CaptiveValidator {
 
         if (message.getCount(Section.ANSWER) > 0) {
             log.warn(
-                "NAME ERROR response contained records in the ANSWER SECTION");
+                "NameError response contained records in the ANSWER SECTION");
+            mErrorList.add("NameError response contained records in the ANSWER SECTION");
             message.setStatus(SecurityStatus.INVALID);
 
             return;
@@ -840,8 +848,8 @@ public class CaptiveValidator {
             int status = mValUtils.verifySRRset(rrsets[i], key_rrset);
 
             if (status != SecurityStatus.SECURE) {
-                log.debug("NameError response has failed AUTHORITY rrset: " +
-                    rrsets[i]);
+                mErrorList.add("NameError response has failed AUTHORITY rrset: " +
+                         rrsets[i]);
                 m.setStatus(SecurityStatus.BOGUS);
 
                 return;
@@ -885,7 +893,7 @@ public class CaptiveValidator {
             }
 
             hasValidNSEC       = NSEC3ValUtils.proveNameError(nsec3s, qname,
-                    nsec3Signer);
+                    nsec3Signer, mErrorList);
 
             // Note that we assume that the NSEC3ValUtils proofs encompass the
             // wildcard part of the proof.
@@ -894,16 +902,14 @@ public class CaptiveValidator {
 
         // If the message fails to prove either condition, it is bogus.
         if (!hasValidNSEC) {
-            log.debug("NameError response has failed to prove: " +
-                "qname does not exist");
+            mErrorList.add("NameError response has failed to prove qname does not exist");
             m.setStatus(SecurityStatus.BOGUS);
 
             return;
         }
 
         if (!hasValidWCNSEC) {
-            log.debug("NameError response has failed to prove: " +
-                "covering wildcard does not exist");
+            mErrorList.add("NameError response has failed to prove covering wildcard does not exist");
             m.setStatus(SecurityStatus.BOGUS);
 
             return;
@@ -915,6 +921,7 @@ public class CaptiveValidator {
     }
 
     public byte validateMessage(SMessage message, Name zone) {
+        mErrorList.clear();
         if (!zone.isAbsolute()) {
             try {
                 zone = Name.concatenate(zone, Name.root);
@@ -936,6 +943,7 @@ public class CaptiveValidator {
         SRRset key_rrset = findKeys(message);
 
         if (key_rrset == null) {
+            mErrorList.add("Failed to find matching DNSKEYs for the response");
             return SecurityStatus.BOGUS;
         }
 
@@ -955,7 +963,7 @@ public class CaptiveValidator {
 
             case NODATA:
                 log.trace("Validating a NODATA response");
-                validateNodataResponse(message, key_rrset);
+                validateNodataResponse(message, key_rrset, mErrorList);
 
                 break;
 
@@ -995,4 +1003,8 @@ public class CaptiveValidator {
     public List<String> listTrustedKeys() {
         return mTrustedKeys.listTrustAnchors();
     }
-}
+
+    public List<String> getErrorList() {
+        return mErrorList;
+    }
+ }