From: Michal 'vorner' Vaner <michal.vaner@nic.cz>
Date: Tue, 10 Apr 2012 13:58:33 +0000 (+0200)
Subject: [1577] Validate the findNSEC3 input
X-Git-Tag: trac2351_base~226^2~116^2~34^2^2~8
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7ef140c77fa2ddd4194ffdc344781a55232d68b3;p=thirdparty%2Fkea.git

[1577] Validate the findNSEC3 input

We check the name comes from inside the zone.
---

diff --git a/src/lib/datasrc/database.cc b/src/lib/datasrc/database.cc
index 08c7b26b31..a21546a756 100644
--- a/src/lib/datasrc/database.cc
+++ b/src/lib/datasrc/database.cc
@@ -911,7 +911,17 @@ DatabaseClient::Finder::findInternal(const Name& name, const RRType& type,
 }
 
 ZoneFinder::FindNSEC3Result
-DatabaseClient::Finder::findNSEC3(const Name&, bool) {
+DatabaseClient::Finder::findNSEC3(const Name& name, bool) {
+    // TODO: Some logging.
+
+    // First, validate the input
+    const NameComparisonResult cmp_result(name.compare(getOrigin()));
+    if (cmp_result.getRelation() != NameComparisonResult::EQUAL &&
+        cmp_result.getRelation() != NameComparisonResult::SUBDOMAIN) {
+        isc_throw(OutOfZone, "findNSEC3 attempt for out-of-zone name: " <<
+                  name << ", zone: " << getOrigin() << "/" << getClass());
+    }
+
     isc_throw(NotImplemented, "findNSEC3 is not yet implemented for database "
               "data source");
 }