lib/dns/validator.c
/*%
 * Look for NODATA at the wildcard and NOWILDCARD proofs in the
 * previously validated NSEC records.  As these proofs are mutually
 * exclusive we stop when one is found.
 *
 * Returns
 * \li	ISC_R_SUCCESS
 */
%
Look for NODATA at the wildcard and NOWILDCARD proofs in the
previously validated NSEC records.  As these proofs are mutually
exclusive we stop when one is found.


% Look for NODATA at the wildcard and NOWILDCARD proofs in the previously validated NSEC records . As these proofs are mutually exclusive we stop when one is found .
static isc_result_t
checkwildcard(dns_validator_t *val, dns_rdatatype_t type, dns_name_t *zonename)
{
	dns_name_t *name, *wild, tname;
	isc_result_t result;
	isc_boolean_t exists, data;
	char namebuf[DNS_NAME_FORMATSIZE];
	dns_rdataset_t *rdataset, trdataset;
	dns_name_init(&tname, NULL);
	dns_rdataset_init(&trdataset);
	wild = dns_fixedname_name(&val->wild);
	if (dns_name_countlabels(wild) == 0) {
		validator_log(val, ISC_LOG_DEBUG(3),
			      "in checkwildcard: no wildcard to check");
		return (ISC_R_SUCCESS);
	}
	dns_name_format(wild, namebuf, sizeof(namebuf));
	validator_log(val, ISC_LOG_DEBUG(3), "in checkwildcard: %s", namebuf);
	if (val->event->message == NULL) {
		name = &tname;
		rdataset = &trdataset;
	} else {
		name = NULL;
		rdataset = NULL;
	}
	for (result = val_rdataset_first(val, &name, &rdataset);
	     result == ISC_R_SUCCESS;
	     result = val_rdataset_next(val, &name, &rdataset))
	{
		if (rdataset->type != type ||
		    rdataset->trust != dns_trust_secure)
			continue;
		if (rdataset->type == dns_rdatatype_nsec &&
		    (NEEDNODATA(val) || NEEDNOWILDCARD(val)) &&
		    !FOUNDNODATA(val) && !FOUNDNOWILDCARD(val) &&
		    nsecnoexistnodata(val, wild, name, rdataset,
				      &exists, &data, NULL)
				       == ISC_R_SUCCESS)
		{
			dns_name_t **proofs = val->event->proofs;
			if (exists && !data)
				val->attributes |= VALATTR_FOUNDNODATA;
			if (exists && !data && NEEDNODATA(val))
				proofs[DNS_VALIDATOR_NODATAPROOF] =
						 name;
			if (!exists)
				val->attributes |=
					 VALATTR_FOUNDNOWILDCARD;
			if (!exists && NEEDNOQNAME(val))
				proofs[DNS_VALIDATOR_NOWILDCARDPROOF] =
						 name;
			if (dns_rdataset_isassociated(&trdataset))
				dns_rdataset_disassociate(&trdataset);
			return (ISC_R_SUCCESS);
		}
		if (rdataset->type == dns_rdatatype_nsec3 &&
		    (NEEDNODATA(val) || NEEDNOWILDCARD(val)) &&
		    !FOUNDNODATA(val) && !FOUNDNOWILDCARD(val) &&
		    nsec3noexistnodata(val, wild, name, rdataset,
				       zonename, &exists, &data,
				       NULL, NULL, NULL, NULL, NULL,
				       NULL) == ISC_R_SUCCESS)
		{
			dns_name_t **proofs = val->event->proofs;
			if (exists && !data)
				val->attributes |= VALATTR_FOUNDNODATA;
			if (exists && !data && NEEDNODATA(val))
				proofs[DNS_VALIDATOR_NODATAPROOF] =
						 name;
			if (!exists)
				val->attributes |=
					 VALATTR_FOUNDNOWILDCARD;
			if (!exists && NEEDNOQNAME(val))
				proofs[DNS_VALIDATOR_NOWILDCARDPROOF] =
						 name;
			if (dns_rdataset_isassociated(&trdataset))
				dns_rdataset_disassociate(&trdataset);
			return (ISC_R_SUCCESS);
		}
	}
	if (result == ISC_R_NOMORE)
		result = ISC_R_SUCCESS;
	if (dns_rdataset_isassociated(&trdataset))
		dns_rdataset_disassociate(&trdataset);
	return (result);
}
static isc_result_t checkwildcard ( dns_validator_t * val , dns_rdatatype_t type , dns_name_t * zonename ) { dns_name_t * name , * wild , tname ; isc_result_t result ; isc_boolean_t exists , data ; char namebuf [ DNS_NAME_FORMATSIZE ] ; dns_rdataset_t * rdataset , trdataset ; dns_name_init ( & tname , NULL ) ; dns_rdataset_init ( & trdataset ) ; wild = dns_fixedname_name ( & val -> wild ) ; if ( dns_name_countlabels ( wild ) == 0 ) { validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " ) ; return ( ISC_R_SUCCESS ) ; } dns_name_format ( wild , namebuf , sizeof ( namebuf ) ) ; validator_log ( val , ISC_LOG_DEBUG ( 3 ) , " " , namebuf ) ; if ( val -> event -> message == NULL ) { name = & tname ; rdataset = & trdataset ; } else { name = NULL ; rdataset = NULL ; } for ( result = val_rdataset_first ( val , & name , & rdataset ) ; result == ISC_R_SUCCESS ; result = val_rdataset_next ( val , & name , & rdataset ) ) { if ( rdataset -> type != type || rdataset -> trust != dns_trust_secure ) continue ; if ( rdataset -> type == dns_rdatatype_nsec && ( NEEDNODATA ( val ) || NEEDNOWILDCARD ( val ) ) && ! FOUNDNODATA ( val ) && ! FOUNDNOWILDCARD ( val ) && nsecnoexistnodata ( val , wild , name , rdataset , & exists , & data , NULL ) == ISC_R_SUCCESS ) { dns_name_t * * proofs = val -> event -> proofs ; if ( exists && ! data ) val -> attributes |= VALATTR_FOUNDNODATA ; if ( exists && ! data && NEEDNODATA ( val ) ) proofs [ DNS_VALIDATOR_NODATAPROOF ] = name ; if ( ! exists ) val -> attributes |= VALATTR_FOUNDNOWILDCARD ; if ( ! exists && NEEDNOQNAME ( val ) ) proofs [ DNS_VALIDATOR_NOWILDCARDPROOF ] = name ; if ( dns_rdataset_isassociated ( & trdataset ) ) dns_rdataset_disassociate ( & trdataset ) ; return ( ISC_R_SUCCESS ) ; } if ( rdataset -> type == dns_rdatatype_nsec3 && ( NEEDNODATA ( val ) || NEEDNOWILDCARD ( val ) ) && ! FOUNDNODATA ( val ) && ! FOUNDNOWILDCARD ( val ) && nsec3noexistnodata ( val , wild , name , rdataset , zonename , & exists , & data , NULL , NULL , NULL , NULL , NULL , NULL ) == ISC_R_SUCCESS ) { dns_name_t * * proofs = val -> event -> proofs ; if ( exists && ! data ) val -> attributes |= VALATTR_FOUNDNODATA ; if ( exists && ! data && NEEDNODATA ( val ) ) proofs [ DNS_VALIDATOR_NODATAPROOF ] = name ; if ( ! exists ) val -> attributes |= VALATTR_FOUNDNOWILDCARD ; if ( ! exists && NEEDNOQNAME ( val ) ) proofs [ DNS_VALIDATOR_NOWILDCARDPROOF ] = name ; if ( dns_rdataset_isassociated ( & trdataset ) ) dns_rdataset_disassociate ( & trdataset ) ; return ( ISC_R_SUCCESS ) ; } } if ( result == ISC_R_NOMORE ) result = ISC_R_SUCCESS ; if ( dns_rdataset_isassociated ( & trdataset ) ) dns_rdataset_disassociate ( & trdataset ) ; return ( result ) ; }
%
 Look for NODATA at the wildcard and NOWILDCARD proofs in the
 previously validated NSEC records.
% Look for NODATA at the wildcard and NOWILDCARD proofs in the previously validated NSEC records .