unbound/validator/val_nsec3.c

75  * Closest encloser (ce) proof results
76  * Contains the ce and the next-closer (nc) proof.
80 	uint8_t* ce;
81 	/** length of ce */
83 	/** NSEC3 record that proved ce. rrset */
85 	/** NSEC3 record that proved ce. rr number */
867  * @param ce: closest encloser information is returned in here.
872 	rbtree_t* ct, struct query_info* qinfo, struct ce_response* ce)
888 			&ce->ce_rrset, &ce->ce_rr)) {
889 			ce->ce = nm;
890 			ce->ce_len = nmlen;
905  * @param ce: closest encloser
910 next_closer(uint8_t* qname, size_t qnamelen, uint8_t* ce,
913 	int strip = dname_count_labels(qname) - dname_count_labels(ce) -1;
930  * 	certain that the ce.nc_rrset and ce.nc_rr are set properly.
931  * @param ce: closest encloser information is returned in here.
933  * 	secure if a closest encloser could be proven, ce is set.
940 	struct ce_response* ce)
944 	/* robust: clean out ce, in case it gets abused later */
945 	memset(ce, 0, sizeof(*ce));
947 	if(!nsec3_find_closest_encloser(env, flt, ct, qinfo, ce)) {
952 	log_nametypeclass(VERB_ALGO, "ce candidate", ce->ce, 0, 0);
954 	if(query_dname_compare(ce->ce, qinfo->qname) == 0) {
968 	if(nsec3_has_type(ce->ce_rrset, ce->ce_rr, LDNS_RR_TYPE_NS) &&
969 		!nsec3_has_type(ce->ce_rrset, ce->ce_rr, LDNS_RR_TYPE_SOA)) {
970 		if(!nsec3_has_type(ce->ce_rrset, ce->ce_rr, LDNS_RR_TYPE_DS)) {
979 	if(nsec3_has_type(ce->ce_rrset, ce->ce_rr, LDNS_RR_TYPE_DNAME)) {
986 	next_closer(qinfo->qname, qinfo->qname_len, ce->ce, &nc, &nc_len);
988 		&ce->nc_rrset, &ce->nc_rr)) {
998 nsec3_ce_wildcard(struct regional* region, uint8_t* ce, size_t celen,
1011 	memmove(nm+2, ce, celen);
1021 	struct ce_response ce;
1031 	sec = nsec3_prove_closest_encloser(env, flt, ct, qinfo, 1, &ce);
1040 	log_nametypeclass(VERB_ALGO, "nsec3 namerror: proven ce=", ce.ce,0,0);
1044 	log_assert(ce.ce);
1045 	wc = nsec3_ce_wildcard(env->scratch, ce.ce, ce.ce_len, &wclen);
1053 	if(ce.nc_rrset && nsec3_has_optout(ce.nc_rrset, ce.nc_rr)) {
1091 	struct ce_response ce;
1147 	sec = nsec3_prove_closest_encloser(env, flt, ct, qinfo, 1, &ce);
1161 	log_assert(ce.ce);
1162 	wc = nsec3_ce_wildcard(env->scratch, ce.ce, ce.ce_len, &wclen);
1187 		if(ce.nc_rrset && nsec3_has_optout(ce.nc_rrset, ce.nc_rr)) {
1199 	if(!ce.nc_rrset) {
1205 	log_assert(ce.nc_rrset);
1206 	if(!nsec3_has_optout(ce.nc_rrset, ce.nc_rr)) {
1245 	struct ce_response ce;
1264 	memset(&ce, 0, sizeof(ce));
1265 	ce.ce = wc;
1266 	ce.ce_len = wclen;
1270 	next_closer(qinfo->qname, qinfo->qname_len, ce.ce, &nc, &nc_len);
1272 		&ce.nc_rrset, &ce.nc_rr)) {
1277 	if(ce.nc_rrset && nsec3_has_optout(ce.nc_rrset, ce.nc_rr)) {
1319 	struct ce_response ce;
1367 	if(nsec3_prove_closest_encloser(env, &flt, &ct, qinfo, 1, &ce)
1378 	if(!ce.nc_rrset) {
1388 	log_assert(ce.nc_rrset);
1389 	if(!nsec3_has_optout(ce.nc_rrset, ce.nc_rr)) {