From: JINMEI Tatuya <jinmei@isc.org>
Date: Wed, 25 Jan 2012 20:08:28 +0000 (-0800)
Subject: [1611] added a note about how to identify whether zone is signed with NSEC(3)
X-Git-Tag: trac2351_base~278^2~3^2~1^2~2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=470359f0cfef05cf9a5348b4255fd71208b2a6c2;p=thirdparty%2Fkea.git

[1611] added a note about how to identify whether zone is signed with NSEC(3)
in the database zone finder.  right now it's a TODO and the current
implementation is a kind of workaround.
---

diff --git a/src/lib/datasrc/database.cc b/src/lib/datasrc/database.cc
index 9eaa162bbb..1dc5359c0a 100644
--- a/src/lib/datasrc/database.cc
+++ b/src/lib/datasrc/database.cc
@@ -704,6 +704,9 @@ DatabaseClient::Finder::findOnNameResult(const Name& name,
     // For wildcard case with DNSSEC required, the caller would need to know
     // whether it's NSEC or NSEC3 signed.  So we need to do an additional
     // search here, even though the NSEC RR may not be returned.
+    // TODO: this part should be revised when we support NSEC3; ideally we
+    // should use more effective and efficient way to identify (whether and)
+    // in which way the zone is signed.
     if (wild && (options & FIND_DNSSEC) != 0 &&
         found.second.find(RRType::NSEC()) != found.second.end()) {
         flags = flags | RESULT_NSEC_SIGNED;