unbound/validator/val_nsec.c

204 		rep, qinfo->qname, qinfo->qname_len, LDNS_RR_TYPE_NSEC,
239 	/* Otherwise, there is no NSEC at qname. This could be an ENT.
261 		if(val_nsec_proves_name_error(rep->rrsets[i], qinfo->qname)) {
262 			ce = nsec_closest_encloser(qinfo->qname,
293 	if(query_dname_compare(nsec->rk.dname, qinfo->qname) != 0) {
301 		/* If the nsec is proving that qname is an ENT, the nsec owner
302 		 * will be less than qname, and the next name will be a child
303 		 * domain of the qname. */
306 		if(dname_strict_subdomain_c(nm, qinfo->qname) &&
308 				qinfo->qname) < 0) {
315 		 * possible to have generated qname from the wildcard and
325 			/* The qname must be a strict subdomain of the
328 			if(dname_strict_subdomain_c(qinfo->qname, ce)) {
329 				/* here we have a matching NSEC for the qname,
350 				/* wildcard does not apply if qname below
352 				if (dname_subdomain_c(qinfo->qname, nm))
354 				/* but if it is a wildcard and qname is below
361 					if(dname_strict_subdomain_c(qinfo->qname, ce)) {
396 		!dname_is_root(qinfo->qname)) {
404 val_nsec_proves_name_error(struct ub_packed_rrset_key* nsec, uint8_t* qname)
412 	/* If NSEC owner == qname, then this NSEC proves that qname exists. */
413 	if(query_dname_compare(qname, owner) == 0) {
417 	/* If NSEC is a parent of qname, we need to check the type map
420 	if(dname_subdomain_c(qname, owner) &&
432 		if(dname_strict_subdomain_c(qname, next))
439 		 * but the qname must be a subdomain of the zone name(next). */
440 		if(dname_canonical_compare(owner, qname) < 0 &&
441 			dname_strict_subdomain_c(qname, next))
445 		if(dname_canonical_compare(owner, qname) < 0 &&
446 		   dname_canonical_compare(qname, next) < 0) {
461 			/* if type is DS and qname is equal to nsec, then it
463 			if(dname_strict_subdomain_c(qinfo->qname,
467 			if(dname_subdomain_c(qinfo->qname, nsec->rk.dname))
475 nsec_closest_encloser(uint8_t* qname, struct ub_packed_rrset_key* nsec)
483 	common1 = dname_get_shared_topdomain(nsec->rk.dname, qname);
484 	common2 = dname_get_shared_topdomain(next, qname);
494 	/*  1) prove that qname doesn't exist and
497 	if(!val_nsec_proves_name_error(nsec, qinf->qname))
500 	ce = nsec_closest_encloser(qinf->qname, nsec);
510 val_nsec_proves_no_wc(struct ub_packed_rrset_key* nsec, uint8_t* qname,
514 	 * wildcard that could have produced qname. */
516 	uint8_t* ce = nsec_closest_encloser(qname, nsec);
526 	labs = dname_count_labels(qname) - dname_count_labels(ce);
529 		/* i is number of labels to strip off qname, prepend * wild */
530 		strip = qname;