[1577] Validate the findNSEC3 input

We check the name comes from inside the zone.

diff --git a/src/lib/datasrc/database.cc b/src/lib/datasrc/database.cc
index 08c7b26b312ab274922ba7069f7a6a0ef7071679..a21546a75631b3905b01d6811df66e0596ba90b2 100644 (file)
--- a/src/lib/datasrc/database.cc
+++ b/src/lib/datasrc/database.cc
@@ -911,7 +911,17 @@ DatabaseClient::Finder::findInternal(const Name& name, const RRType& type,
 }
 
 ZoneFinder::FindNSEC3Result
-DatabaseClient::Finder::findNSEC3(const Name&, bool) {
+DatabaseClient::Finder::findNSEC3(const Name& name, bool) {
+    // TODO: Some logging.
+
+    // First, validate the input
+    const NameComparisonResult cmp_result(name.compare(getOrigin()));
+    if (cmp_result.getRelation() != NameComparisonResult::EQUAL &&
+        cmp_result.getRelation() != NameComparisonResult::SUBDOMAIN) {
+        isc_throw(OutOfZone, "findNSEC3 attempt for out-of-zone name: " <<
+                  name << ", zone: " << getOrigin() << "/" << getClass());
+    }
+
     isc_throw(NotImplemented, "findNSEC3 is not yet implemented for database "
               "data source");
 }