DNSSEC validation improvements.

Use DS signature inception time as the DNSSEC validation time.
Validate input data a bit more.
Set TTL in DS to "Original TTL" of RRSIG (this time for real).

1 files changed, 16 insertions, 10 deletions

diff --git a/src/v1.erl b/src/v1.erl
index 72d0112..c1b07e6 100644
--- a/src/v1.erl
+++ b/src/v1.erl
@@ -157,17 +157,23 @@ add_rr_chain(Input) ->
                 {'EXIT', _} ->
                     err400("add-rr-chain: invalid base64-encoding:", B64);
                 Data ->
-                    case dnssecport:validate(Data) of
-                        {ok, [DS | Chain]} ->
-                            lager:debug("succesful DNSSEC validation"),
-                            success(catlfish:add_chain(DS, Chain, normal));
-                        {error, ErrorCode} ->
-                            err400(io_lib:format(
-                                     "add-rr-chain: invalid DS record: ~p",
-                                     [ErrorCode]),
-                                   Data)
-                    end
+                    add_chain_helper(Data)
             end;
         _ ->
             err400("add-rr-chain: missing input: chain", Input)
     end.
+
+add_chain_helper(Data) ->
+    case dnssecport:validate(Data) of
+        {valid, [DS | Chain]} ->
+            lager:debug("succesful DNSSEC validation"),
+            success(catlfish:add_chain(DS, Chain, normal));
+        {invalid, Reason} ->
+            lager:debug("DNSSEC validation failed with ~p", [Reason]),
+            err400(io_lib:format("add-rr-chain: invalid DS record: ~p",
+                                 [Reason]), Data);
+        {error, Reason} ->
+            lager:debug("DNSSEC validation error: ~p", [Reason]),
+            err400(io_lib:format("add-rr-chain: unable to validate record: ~p",
+                                 [Reason]), Data)
+    end.