unbound/validator/val_neg.c

191  * Delete a zone element from the negative cache.
192  * May delete other zone elements to keep tree coherent, or
195  * @param z: zone element to delete.
231 	z = el->zone;
259 	/* check if the zone is now unused */
298  * @param zone: negative zone
304 static struct val_neg_data* neg_find_data(struct val_neg_zone* zone,
315 		rbtree_search(&zone->tree, lookfor.node.key);
345  * Calculate space needed for zone and all its parents
346  * @param d: name of zone
362  * Find closest existing parent zone of the given name.
368  * @return the zone or NULL if none found.
404  * @param zone: to look in.
411 	struct val_neg_zone* zone, uint8_t* nm, size_t nm_len, int labs)
420 	if(rbtree_find_less_equal(&zone->tree, &key, &res)) {
442  * Create a single zone node
443  * @param nm: name for zone (copied)
446  * @param dclass: class of zone, host order.
447  * @return new zone or NULL on failure
452 	struct val_neg_zone* zone =
453 		(struct val_neg_zone*)calloc(1, sizeof(*zone));
454 	if(!zone) {
457 	zone->node.key = zone;
458 	zone->name = memdup(nm, nm_len);
459 	if(!zone->name) {
460 		free(zone);
463 	zone->len = nm_len;
464 	zone->labs = labs;
465 	zone->dclass = dclass;
467 	rbtree_init(&zone->tree, &val_neg_data_compare);
468 	return zone;
477  * @param dclass: class of zone.
479  * @return zone; a chain of zones and their parents up to the parent.
488 	struct val_neg_zone* zone, *prev = NULL, *first = NULL;
494 		zone = neg_setup_zone_node(nm, nm_len, i, dclass);
495 		if(!zone) {
507 			first = zone;
509 			prev->parent = zone;
512 		prev = zone;
518 void val_neg_zone_take_inuse(struct val_neg_zone* zone)
520 	if(!zone->in_use) {
522 		zone->in_use = 1;
524 		for(p=zone; p; p = p->parent) {
533 	struct val_neg_zone* zone;
538 	/* find closest enclosing parent zone that (still) exists */
544 	zone = neg_zone_chain(nm, nm_len, labs, dclass, parent);
545 	if(!zone) {
550 	p = zone;
562 	return zone;
565 /** find zone name of message, returns the SOA record */
669  * @param zone: the zone
673 static void wipeout(struct val_neg_cache* neg, struct val_neg_zone* zone,
699 	/* sanity check, both owner and end must be below the zone apex */
700 	if(!dname_subdomain_c(el->name, zone->name) ||
701 		!dname_subdomain_c(end, zone->name))
704 	/* detect end of zone NSEC ; wipe until the end of zone */
705 	if(query_dname_compare(end, zone->name) == 0) {
735 		 * entire zone. However, if that happens, this is done
737 		 * and maybe also the entire zone if it is empty.
740 		 * it cannot get deleted, the zone cannot get empty.
741 		 * If the next==NULL, then zone can be empty. */
749 	struct val_neg_zone* zone, struct ub_packed_rrset_key* nsec)
767 	parent = neg_closest_data_parent(zone, nm, nm_len, labs);
793 			p->zone = zone;
794 			(void)rbtree_insert(&zone->tree, &p->node);
824 			(h != zone->nsec3_hash || it != zone->nsec3_iter ||
825 			slen != zone->nsec3_saltlen ||
826 			memcmp(zone->nsec3_salt, s, slen) != 0)) {
831 					free(zone->nsec3_salt);
832 					zone->nsec3_salt = sa;
833 					zone->nsec3_saltlen = slen;
834 					zone->nsec3_iter = it;
835 					zone->nsec3_hash = h;
838 				free(zone->nsec3_salt);
839 				zone->nsec3_salt = NULL;
840 				zone->nsec3_saltlen = 0;
841 				zone->nsec3_iter = it;
842 				zone->nsec3_hash = h;
848 	wipeout(neg, zone, el, nsec);
885 	struct val_neg_zone* zone;
889 	/* find the zone name in message */
902 	log_nametypeclass(VERB_ALGO, "negcache insert for zone",
911 	/* find or create the zone entry */
912 	zone = neg_find_zone(neg, dname, dname_len, rrset_class);
913 	if(!zone) {
914 		if(!(zone = neg_create_zone(neg, dname, dname_len,
917 			log_err("out of memory adding negative zone");
921 	val_neg_zone_take_inuse(zone);
928 			zone->name)) continue;
929 		/* insert NSEC into this zone's tree */
930 		neg_insert_data(neg, zone, rep->rrsets[i]);
932 	if(zone->tree.count == 0) {
933 		/* remove empty zone if inserts failed */
934 		neg_delete_zone(neg, zone);
941  * @param zone: zone to look in
948 static int neg_closest_data(struct val_neg_zone* zone,
957 	if(rbtree_find_less_equal(&zone->tree, &key, &r)) {
975 	struct val_neg_zone* zone;
994 	/* find or create the zone entry */
995 	zone = neg_find_zone(neg, signer, signer_len, dclass);
996 	if(!zone) {
997 		if(!(zone = neg_create_zone(neg, signer, signer_len,
1000 			log_err("out of memory adding negative zone");
1004 	val_neg_zone_take_inuse(zone);
1012 			zone->name)) continue;
1013 		/* insert NSEC into this zone's tree */
1014 		neg_insert_data(neg, zone, rep->rrsets[i]);
1016 	if(zone->tree.count == 0) {
1017 		/* remove empty zone if inserts failed */
1018 		neg_delete_zone(neg, zone);
1114 	struct val_neg_zone* zone;
1120 	zone = neg_closest_zone_parent(neg_cache, qname, qname_len, labs,
1122 	while(zone && !zone->in_use)
1123 		zone = zone->parent;
1124 	if(!zone) {
1130 	if(zone->nsec3_hash) {
1136 	(void)neg_closest_data(zone, qname, qname_len, labs, &data);
1153 	if(query_dname_compare(data->name, zone->name) == 0)
1157 		zone->dclass, flags, region, 0, 0, now);
1164 neg_find_nsec3_ce(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
1176 			zone->nsec3_hash, zone->nsec3_iter, zone->nsec3_salt,
1177 			zone->nsec3_saltlen, hashce, sizeof(hashce))))
1179 		if(!(b32len=nsec3_hash_to_b32(hashce, celen, zone->name,
1180 			zone->len, b32, sizeof(b32))))
1184 		data = neg_find_data(zone, b32, b32len, zone->labs+1);
1198 /** check nsec3 parameters on nsec3 rrset with current zone values */
1200 neg_params_ok(struct val_neg_zone* zone, struct ub_packed_rrset_key* rrset)
1207 	return (h == zone->nsec3_hash && it == zone->nsec3_iter &&
1208 		slen == zone->nsec3_saltlen &&
1209 		memcmp(zone->nsec3_salt, s, slen) == 0);
1214 neg_nsec3_getnc(struct val_neg_zone* zone, uint8_t* hashnc, size_t nclen,
1222 	if(!(b32len=nsec3_hash_to_b32(hashnc, nclen, zone->name,
1223 		zone->len, b32, maxb32)))
1225 	(void)neg_closest_data(zone, b32, b32len, zone->labs+1, &data);
1226 	if(!data && zone->tree.count != 0) {
1229 		data = (struct val_neg_data*)rbtree_last(&zone->tree);
1237 		LDNS_RR_TYPE_NSEC3, zone->dclass, 0, region, 0, 0, now);
1240 	if(!neg_params_ok(zone, nc_rrset))
1247 neg_nsec3_proof_ds(struct val_neg_zone* zone, uint8_t* qname, size_t qname_len,
1267 	if(!zone->nsec3_hash)
1268 		return NULL; /* not nsec3 zone */
1270 	if(!(data=neg_find_nsec3_ce(zone, qname, qname_len, qlabs, buf,
1277 		LDNS_RR_TYPE_NSEC3, zone->dclass, 0, region, 1,
1281 	if(!neg_params_ok(zone, ce_rrset))
1292 			LDNS_RR_TYPE_DS, zone->dclass, region, 1)))
1307 	nc_rrset = neg_nsec3_getnc(zone, hashnc, nclen, rrset_cache,
1311 	if(!neg_params_ok(zone, nc_rrset))
1319 	if(nsec3_covers(zone->name, &c, nc_rrset, 0, buf)) {
1326 			LDNS_RR_TYPE_DS, zone->dclass, region, 3)))
1344  * @param zone: val_neg_zone if we have one.
1348 	struct regional* region, struct dns_msg* msg, struct val_neg_zone* zone)
1354 	if(zone) {
1355 		nm = zone->name;
1356 		nmlen = zone->len;
1357 		dclass = zone->dclass;
1359 		/* Assumes the signer is the zone SOA to add */
1396 	struct val_neg_zone* zone;
1523 	/* need to look one zone higher for DS type */
1529 	/* lookup closest zone */
1531 	zone = neg_closest_zone_parent(neg, zname, zname_len, zname_labs,
1533 	while(zone && !zone->in_use)
1534 		zone = zone->parent;
1535 	/* check that the zone is not too high up so that we do not pick data
1536 	 * out of a zone that is above the last-seen key (or trust-anchor). */
1537 	if(zone && topname) {
1538 		if(!dname_subdomain_c(zone->name, topname))
1539 			zone = NULL;
1541 	if(!zone) {
1546 	msg = neg_nsec3_proof_ds(zone, qinfo->qname, qinfo->qname_len,
1548 	if(msg && addsoa && !add_soa(rrset_cache, now, region, msg, zone)) {