/usr/src/usr.sbin/nsd/nsec3.c

Bug Summary

File:	src/usr.sbin/nsd/nsec3.c
Warning:	line 983, column 7 Access to field 'nsec3' results in a dereference of a null pointer (loaded from variable 'par')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name nsec3.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/nsd/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I . -I /usr/src/usr.sbin/nsd -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/nsd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.sbin/nsd/nsec3.c
1/*
* nsec3.c -- nsec3 handling.
*
* Copyright (c) 2001-2006, NLnet Labs. All rights reserved.
*
* See LICENSE for the license.
*
*/
9#include "config.h"
10#ifdef NSEC3
11#include <stdio.h>
12#include <stdlib.h>

14#include "nsec3.h"
15#include "iterated_hash.h"
16#include "namedb.h"
17#include "nsd.h"
18#include "answer.h"
19#include "options.h"

21#define NSEC3_RDATA_BITMAP5 5

23/* compare nsec3 hashes in nsec3 tree */
24static int
25cmp_hash_tree(const void* x, const void* y)
26{
const domain_type* a = (const domain_type*)x;
const domain_type* b = (const domain_type*)y;
if(!a->nsec3) return (b->nsec3?-1:0);
if(!b->nsec3) return 1;
if(!a->nsec3->hash_wc) return (b->nsec3->hash_wc?-1:0);
if(!b->nsec3->hash_wc) return 1;
return memcmp(a->nsec3->hash_wc->hash.hash,
b->nsec3->hash_wc->hash.hash, NSEC3_HASH_LEN20);
35}

37/* compare nsec3 hashes in nsec3 wc tree */
38static int
39cmp_wchash_tree(const void* x, const void* y)
40{
const domain_type* a = (const domain_type*)x;
const domain_type* b = (const domain_type*)y;
if(!a->nsec3) return (b->nsec3?-1:0);
if(!b->nsec3) return 1;
if(!a->nsec3->hash_wc) return (b->nsec3->hash_wc?-1:0);
if(!b->nsec3->hash_wc) return 1;
return memcmp(a->nsec3->hash_wc->wc.hash,
b->nsec3->hash_wc->wc.hash, NSEC3_HASH_LEN20);
49}

51/* compare nsec3 hashes in nsec3 ds tree */
52static int
53cmp_dshash_tree(const void* x, const void* y)
54{
const domain_type* a = (const domain_type*)x;
const domain_type* b = (const domain_type*)y;
if(!a->nsec3) return (b->nsec3?-1:0);
if(!b->nsec3) return 1;
if(!a->nsec3->ds_parent_hash) return (b->nsec3->ds_parent_hash?-1:0);
if(!b->nsec3->ds_parent_hash) return 1;
return memcmp(a->nsec3->ds_parent_hash->hash,
b->nsec3->ds_parent_hash->hash, NSEC3_HASH_LEN20);
63}

65/* compare base32-encoded nsec3 hashes in nsec3 rr tree, they are
* stored in the domain name of the node */
67static int
68cmp_nsec3_tree(const void* x, const void* y)
69{
const domain_type* a = (const domain_type*)x;
const domain_type* b = (const domain_type*)y;
/* labelcount + 32long label */
assert(dname_name(domain_dname_const(a))[0] == 32)((void)0);
assert(dname_name(domain_dname_const(b))[0] == 32)((void)0);
return memcmp(dname_name(domain_dname_const(a)), dname_name(domain_dname_const(b)), 33);
76}

78void nsec3_zone_trees_create(struct region* region, zone_type* zone)
79{
if(!zone->nsec3tree)
zone->nsec3tree = rbtree_create(region, cmp_nsec3_tree);
if(!zone->hashtree)
zone->hashtree = rbtree_create(region, cmp_hash_tree);
if(!zone->wchashtree)
zone->wchashtree = rbtree_create(region, cmp_wchash_tree);
if(!zone->dshashtree)
zone->dshashtree = rbtree_create(region, cmp_dshash_tree);
88}

90static void
91detect_nsec3_params(rr_type* nsec3_apex,
const unsigned char** salt, int* salt_len, int* iter)
93{
assert(salt && salt_len && iter)((void)0);
assert(nsec3_apex)((void)0);
*salt_len = rdata_atom_data(nsec3_apex->rdatas[3])[0];
*salt = (unsigned char*)(rdata_atom_data(nsec3_apex->rdatas[3])+1);
*iter = read_uint16(rdata_atom_data(nsec3_apex->rdatas[2]));
99}

101const dname_type *
102nsec3_b32_create(region_type* region, zone_type* zone, unsigned char* hash)
103{
const dname_type* dname;
char b32[SHA_DIGEST_LENGTH20*2+1];
b32_ntop(hash, SHA_DIGEST_LENGTH20, b32, sizeof(b32));
dname=dname_parse(region, b32);
dname=dname_concatenate(region, dname, domain_dname(zone->apex));
return dname;
110}

112void
113nsec3_hash_and_store(zone_type* zone, const dname_type* dname, uint8_t* store)
114{
const unsigned char* nsec3_salt = NULL((void *)0);
int nsec3_saltlength = 0;
int nsec3_iterations = 0;

detect_nsec3_params(zone->nsec3_param, &nsec3_salt,
&nsec3_saltlength, &nsec3_iterations);
assert(nsec3_iterations >= 0 && nsec3_iterations <= 65536)((void)0);
iterated_hash((unsigned char*)store, nsec3_salt, nsec3_saltlength,
dname_name(dname), dname->name_size, nsec3_iterations);
124}

126#define STORE_HASH(x,y)memmove(domain->nsec3->x,y,20); domain->nsec3->have_x
 =1; memmove(domain->nsec3->x,y,NSEC3_HASH_LEN20); domain->nsec3->have_##x =1;

128/** find hash or create it and store it */
129static void
130nsec3_lookup_hash_and_wc(region_type* region, zone_type* zone,
const dname_type* dname, domain_type* domain, region_type* tmpregion)
132{
const dname_type* wcard;
if(domain->nsec3->hash_wc) {
return;
}
/* lookup failed; disk failure or so */
domain->nsec3->hash_wc = (nsec3_hash_wc_node_type *)
region_alloc(region, sizeof(nsec3_hash_wc_node_type));
domain->nsec3->hash_wc->hash.node.key = NULL((void *)0);
domain->nsec3->hash_wc->wc.node.key = NULL((void *)0);
nsec3_hash_and_store(zone, dname, domain->nsec3->hash_wc->hash.hash);
wcard = dname_parse(tmpregion, "*");
wcard = dname_concatenate(tmpregion, wcard, dname);
nsec3_hash_and_store(zone, wcard, domain->nsec3->hash_wc->wc.hash);
146}

148static void
149nsec3_lookup_hash_ds(region_type* region, zone_type* zone,
const dname_type* dname, domain_type* domain)
151{
if(domain->nsec3->ds_parent_hash) {
return;
}
/* lookup failed; disk failure or so */
domain->nsec3->ds_parent_hash = (nsec3_hash_node_type *)
region_alloc(region, sizeof(nsec3_hash_node_type));
domain->nsec3->ds_parent_hash->node.key = NULL((void *)0);
nsec3_hash_and_store(zone, dname, domain->nsec3->ds_parent_hash->hash);
160}

162static int
163nsec3_has_soa(rr_type* rr)
164{
if(rdata_atom_size(rr->rdatas[NSEC3_RDATA_BITMAP5]) >= 3 && /* has types in bitmap */
rdata_atom_data(rr->rdatas[NSEC3_RDATA_BITMAP5])[0] == 0 && /* first window = 0, */
/* [1]: bitmap length must be >= 1 */
/* [2]: bit[6] = SOA, thus mask first bitmap octet with 0x02 */
rdata_atom_data(rr->rdatas[NSEC3_RDATA_BITMAP5])[2]&0x02) { /* SOA bit set */
return 1;
}
return 0;
173}

175static rr_type*
176check_apex_soa(namedb_type* namedb, zone_type *zone, int nolog)
177{
uint8_t h[NSEC3_HASH_LEN20];
domain_type* domain;
const dname_type* hashed_apex, *dname = domain_dname(zone->apex);
unsigned j;
rrset_type* nsec3_rrset;
region_type* tmpregion;

nsec3_hash_and_store(zone, dname, h);
tmpregion = region_create(xalloc, free);
hashed_apex = nsec3_b32_create(tmpregion, zone, h);
domain = domain_table_find(namedb->domains, hashed_apex);
if(!domain) {
if(!nolog) {
	log_msg(LOG_ERR3, "%s NSEC3PARAM entry has no hash(apex).",
		domain_to_string(zone->apex));
	log_msg(LOG_ERR3, "hash(apex)= %s",
		dname_to_string(hashed_apex, NULL((void *)0)));
}
region_destroy(tmpregion);
return NULL((void *)0);
}
nsec3_rrset = domain_find_rrset(domain, zone, TYPE_NSEC350);
if(!nsec3_rrset) {
if(!nolog) {
	log_msg(LOG_ERR3, "%s NSEC3PARAM entry: hash(apex) has no NSEC3 RRset.",
		domain_to_string(zone->apex));
	log_msg(LOG_ERR3, "hash(apex)= %s",
		dname_to_string(hashed_apex, NULL((void *)0)));
}
region_destroy(tmpregion);
return NULL((void *)0);
}
for(j=0; j<nsec3_rrset->rr_count; j++) {
if(nsec3_has_soa(&nsec3_rrset->rrs[j])) {
	region_destroy(tmpregion);
	return &nsec3_rrset->rrs[j];
}
}
if(!nolog) {
log_msg(LOG_ERR3, "%s NSEC3PARAM entry: hash(apex) NSEC3 has no SOA flag.",
	domain_to_string(zone->apex));
log_msg(LOG_ERR3, "hash(apex)= %s",
	dname_to_string(hashed_apex, NULL((void *)0)));
}
region_destroy(tmpregion);
return NULL((void *)0);
224}

226static void
227nsec3param_to_str(struct rr* rr, char* str, size_t buflen)
228{
rdata_atom_type* rd = rr->rdatas;
size_t len;
len = snprintf(str, buflen, "%u %u %u ",
(unsigned)rdata_atom_data(rd[0])[0],
(unsigned)rdata_atom_data(rd[1])[0],
(unsigned)read_uint16(rdata_atom_data(rd[2])));
if(rdata_atom_data(rd[3])[0] == 0) {
if(buflen > len + 2)
	str[len++] = '-';
} else {
len += hex_ntop(rdata_atom_data(rd[3])+1,
	rdata_atom_data(rd[3])[0], str+len, buflen-len-1);
}
if(buflen > len + 1)
str[len] = 0;
244}

246static struct rr*
247db_find_nsec3param(struct namedb* db, struct zone* z, struct rr* avoid_rr,
int checkchain)
249{
unsigned i;
rrset_type* rrset = domain_find_rrset(z->apex, z, TYPE_NSEC3PARAM51);
if(!rrset) /* no NSEC3PARAM in mem */
return NULL((void *)0);
/* find first nsec3param we can support (SHA1, no flags) */
for(i=0; i<rrset->rr_count; i++) {
rdata_atom_type* rd = rrset->rrs[i].rdatas;
/* do not use the RR that is going to be deleted (in IXFR) */
if(&rrset->rrs[i] == avoid_rr) continue;
if(rrset->rrs[i].rdata_count < 4) continue;
if(rdata_atom_data(rd[0])[0] == NSEC3_SHA1_HASH1 &&
	rdata_atom_data(rd[1])[0] == 0) {
	if(checkchain) {
		z->nsec3_param = &rrset->rrs[i];
		if(!check_apex_soa(db, z, 1)) {
			char str[MAX_RDLENGTH65535*2+16];
			nsec3param_to_str(z->nsec3_param,
				str, sizeof(str));
			VERBOSITY(1, (LOG_WARNING, "zone %s NSEC3PARAM %s has broken chain, ignoring", domain_to_string(z->apex), str))do { if ((1) <= verbosity) { log_msg (4, "zone %s NSEC3PARAM %s has broken chain, ignoring"
, domain_to_string(z->apex), str) ; } } while (0);
			continue; /* don't use broken chain */
		}
	}
	if(2 <= verbosity) {
		char str[MAX_RDLENGTH65535*2+16];
		nsec3param_to_str(&rrset->rrs[i], str,
			sizeof(str));
		VERBOSITY(2, (LOG_INFO, "rehash of zone %s with parameters %s",do { if ((2) <= verbosity) { log_msg (6, "rehash of zone %s with parameters %s"
, domain_to_string(z->apex), str) ; } } while (0)
			domain_to_string(z->apex), str))do { if ((2) <= verbosity) { log_msg (6, "rehash of zone %s with parameters %s"
, domain_to_string(z->apex), str) ; } } while (0);
	}
	return &rrset->rrs[i];
}
}
return NULL((void *)0);
283}

285void
286nsec3_find_zone_param(struct namedb* db, struct zone* zone,
struct rr* avoid_rr, int checkchain)
288{
/* avoid using the rr that is going to be deleted, avoid_rr */
zone->nsec3_param = db_find_nsec3param(db, zone, avoid_rr, checkchain);
291}

293/* check params ok for one RR */
294static int
295nsec3_rdata_params_ok(rdata_atom_type* prd, rdata_atom_type* rd)
296{
return (rdata_atom_data(rd[0])[0] ==
rdata_atom_data(prd[0])[0] && /* hash algo */
  rdata_atom_data(rd[2])[0] ==
rdata_atom_data(prd[2])[0] && /* iterations 0 */
  rdata_atom_data(rd[2])[1] ==
rdata_atom_data(prd[2])[1] && /* iterations 1 */
  rdata_atom_data(rd[3])[0] ==
rdata_atom_data(prd[3])[0] && /* salt length */
  memcmp(rdata_atom_data(rd[3])+1,
rdata_atom_data(prd[3])+1, rdata_atom_data(rd[3])[0])
== 0 );
308}

310int
311nsec3_rr_uses_params(rr_type* rr, zone_type* zone)
312{
if(!rr || rr->rdata_count < 4)
return 0;
return nsec3_rdata_params_ok(zone->nsec3_param->rdatas, rr->rdatas);
316}

318int
319nsec3_in_chain_count(domain_type* domain, zone_type* zone)
320{
rrset_type* rrset = domain_find_rrset(domain, zone, TYPE_NSEC350);
unsigned i;
int count = 0;
if(!rrset || !zone->nsec3_param)
return 0; /* no NSEC3s, none in the chain */
for(i=0; i<rrset->rr_count; i++) {
if(nsec3_rr_uses_params(&rrset->rrs[i], zone))
	count++;
}
return count;
331}

333struct domain*
334nsec3_chain_find_prev(struct zone* zone, struct domain* domain)
335{
if(domain->nsec3 && domain->nsec3->nsec3_node.key) {
/* see if there is a prev */
rbnode_type* r = rbtree_previous(&domain->nsec3->nsec3_node);
if(r != RBTREE_NULL&rbtree_null_node) {
	/* found a previous, which is not the root-node in
	 * the prehash tree (and thus points to the tree) */
	return (domain_type*)r->key;
}
}
if(zone->nsec3_last && zone->nsec3_last != domain)
return zone->nsec3_last;
return NULL((void *)0);
348}


351/** clear hash tree. Called from nsec3_clear_precompile() only. */
352static void
353hash_tree_clear(rbtree_type* tree)
354{
if(!tree) return;

/* Previously (before commit 4ca61188b3f7a0e077476875810d18a5d439871f
* and/or svn commit 4776) prehashes and corresponding rbtree nodes
* were part of struct nsec3_domain_data. Clearing the hash_tree would
* then mean setting the key value of the nodes to NULL to indicate
* absence of the prehash.
* But since prehash structs are separatly allocated, this is no longer
* necessary as currently the prehash structs are simply recycled and 
* NULLed.
*
* rbnode_type* n;
* for(n=rbtree_first(tree); n!=RBTREE_NULL; n=rbtree_next(n)) {
*	n->key = NULL;
* }
*/
tree->count = 0;
tree->root = RBTREE_NULL&rbtree_null_node;
373}

375void
376nsec3_clear_precompile(struct namedb* db, zone_type* zone)
377{
domain_type* walk;
/* clear prehash items (there must not be items for other zones) */
prehash_clear(db->domains);
/* clear trees */
hash_tree_clear(zone->nsec3tree);
hash_tree_clear(zone->hashtree);
hash_tree_clear(zone->wchashtree);
hash_tree_clear(zone->dshashtree);
/* wipe hashes */

/* wipe precompile */
walk = zone->apex;
while(walk && domain_is_subdomain(walk, zone->apex)) {
if(walk->nsec3) {
	if(nsec3_condition_hash(walk, zone)) {
		walk->nsec3->nsec3_node.key = NULL((void *)0);
		walk->nsec3->nsec3_cover = NULL((void *)0);
		walk->nsec3->nsec3_wcard_child_cover = NULL((void *)0);
		walk->nsec3->nsec3_is_exact = 0;
		if (walk->nsec3->hash_wc) {
			region_recycle(db->domains->region,
				walk->nsec3->hash_wc,
				sizeof(nsec3_hash_wc_node_type));
			walk->nsec3->hash_wc = NULL((void *)0);
		}
	}
	if(nsec3_condition_dshash(walk, zone)) {
		walk->nsec3->nsec3_ds_parent_cover = NULL((void *)0);
		walk->nsec3->nsec3_ds_parent_is_exact = 0;
		if (walk->nsec3->ds_parent_hash) {
			region_recycle(db->domains->region,
				walk->nsec3->ds_parent_hash,
				sizeof(nsec3_hash_node_type));
			walk->nsec3->ds_parent_hash = NULL((void *)0);
		}
	}
}
walk = domain_next(walk);
}
zone->nsec3_last = NULL((void *)0);
418}

420/* see if domain name is part of (existing names in) the nsec3 zone */
421int
422nsec3_domain_part_of_zone(domain_type* d, zone_type* z)
423{
while(d) {
if(d->is_apex)
	return (z->apex == d); /* zonecut, if right zone*/
d = d->parent;
}
return 0;
430}

432/* condition when a domain is precompiled */
433int
434nsec3_condition_hash(domain_type* d, zone_type* z)
435{
return d->is_existing && !domain_has_only_NSEC3(d, z) &&
nsec3_domain_part_of_zone(d, z) && !domain_is_glue(d, z);
438}

440/* condition when a domain is ds precompiled */
441int
442nsec3_condition_dshash(domain_type* d, zone_type* z)
443{
return d->is_existing && !domain_has_only_NSEC3(d, z) &&
(domain_find_rrset(d, z, TYPE_DS43) ||
domain_find_rrset(d, z, TYPE_NS2)) && d != z->apex
&& nsec3_domain_part_of_zone(d->parent, z);
448}

450zone_type*
451nsec3_tree_zone(namedb_type* db, domain_type* d)
452{
/* see nsec3_domain_part_of_zone; domains part of zone that has
* apex above them */
/* this does not use the rrset->zone pointer because there may be
* no rrsets left at apex (no SOA), e.g. during IXFR */
while(d) {
if(d->is_apex) {
	/* we can try a SOA if its present (faster than tree)*/
	/* DNSKEY and NSEC3PARAM are also good indicators */
	rrset_type *rrset;
	for (rrset = d->rrsets; rrset; rrset = rrset->next)
		if (rrset_rrtype(rrset) == TYPE_SOA6 ||
			rrset_rrtype(rrset) == TYPE_DNSKEY48 ||
			rrset_rrtype(rrset) == TYPE_NSEC3PARAM51)
			return rrset->zone;
	return namedb_find_zone(db, domain_dname(d));
}
d = d->parent;
}
return NULL((void *)0);
472}

474zone_type*
475nsec3_tree_dszone(namedb_type* db, domain_type* d)
476{
/* the DStree does not contain nodes with d==z->apex */
if(d->is_apex)
d = d->parent;
return nsec3_tree_zone(db, d);
481}

483int
484nsec3_find_cover(zone_type* zone, uint8_t* hash, size_t hashlen,
domain_type** result)
486{
rbnode_type* r = NULL((void *)0);
int exact;
domain_type d;
uint8_t n[48];

/* nsec3tree is sorted by b32 encoded domain name of the NSEC3 */
b32_ntop(hash, hashlen, (char*)(n+5), sizeof(n)-5);
494#ifdef USE_RADIX_TREE
d.dname = (dname_type*)n;
496#else
d.node.key = n;
498#endif
n[0] = 34; /* name_size */
n[1] = 2; /* label_count */
n[2] = 0; /* label_offset[0] */
n[3] = 0; /* label_offset[1] */
n[4] = 32; /* label-size[0] */

assert(result)((void)0);
assert(zone->nsec3_param && zone->nsec3tree)((void)0);

exact = rbtree_find_less_equal(zone->nsec3tree, &d, &r);
if(r) {
*result = (domain_type*)r->key;
} else {
*result = zone->nsec3_last;
}
return exact;
515}

517void
518nsec3_precompile_domain(struct namedb* db, struct domain* domain,
struct zone* zone, region_type* tmpregion)
520{
domain_type* result = 0;
int exact;
allocate_domain_nsec3(db->domains, domain);

/* hash it */
nsec3_lookup_hash_and_wc(db->region,
zone, domain_dname(domain), domain, tmpregion);

/* add into tree */
zone_add_domain_in_hash_tree(db->region, &zone->hashtree,
cmp_hash_tree, domain, &domain->nsec3->hash_wc->hash.node);
zone_add_domain_in_hash_tree(db->region, &zone->wchashtree,
cmp_wchash_tree, domain, &domain->nsec3->hash_wc->wc.node);

/* lookup in tree cover ptr (or exact) */
exact = nsec3_find_cover(zone, domain->nsec3->hash_wc->hash.hash,
sizeof(domain->nsec3->hash_wc->hash.hash), &result);
domain->nsec3->nsec3_cover = result;
if(exact)
domain->nsec3->nsec3_is_exact = 1;
else	domain->nsec3->nsec3_is_exact = 0;

/* find cover for *.domain for wildcard denial */
(void)nsec3_find_cover(zone, domain->nsec3->hash_wc->wc.hash,
sizeof(domain->nsec3->hash_wc->wc.hash), &result);
domain->nsec3->nsec3_wcard_child_cover = result;
547}

549void
550nsec3_precompile_domain_ds(struct namedb* db, struct domain* domain,
struct zone* zone)
552{
domain_type* result = 0;
int exact;
allocate_domain_nsec3(db->domains, domain);

/* hash it : it could have different hash parameters then the
  other hash for this domain name */
nsec3_lookup_hash_ds(db->region, zone, domain_dname(domain), domain);
/* lookup in tree cover ptr (or exact) */
exact = nsec3_find_cover(zone, domain->nsec3->ds_parent_hash->hash,
sizeof(domain->nsec3->ds_parent_hash->hash), &result);
if(exact)
domain->nsec3->nsec3_ds_parent_is_exact = 1;
else 	domain->nsec3->nsec3_ds_parent_is_exact = 0;
domain->nsec3->nsec3_ds_parent_cover = result;
/* add into tree */
zone_add_domain_in_hash_tree(db->region, &zone->dshashtree,
cmp_dshash_tree, domain, &domain->nsec3->ds_parent_hash->node);
570}

572static void
573parse_nsec3_name(const dname_type* dname, uint8_t* hash, size_t buflen)
574{
/* first label must be the match, */
size_t lablen = (buflen-1) * 8 / 5;
const uint8_t* wire = dname_name(dname);
assert(lablen == 32 && buflen == NSEC3_HASH_LEN+1)((void)0);
/* labels of length 32 for SHA1, and must have space+1 for convert */
if(wire[0] != lablen) {
/* not NSEC3 */
memset(hash, 0, buflen);
return;
}
(void)b32_pton((char*)wire+1, hash, buflen);
586}

588void
589nsec3_precompile_nsec3rr(namedb_type* db, struct domain* domain,
struct zone* zone)
591{
allocate_domain_nsec3(db->domains, domain);
/* add into nsec3tree */
zone_add_domain_in_hash_tree(db->region, &zone->nsec3tree,
cmp_nsec3_tree, domain, &domain->nsec3->nsec3_node);
/* fixup the last in the zone */
if(rbtree_last(zone->nsec3tree)->key == domain) {
zone->nsec3_last = domain;
}
600}

602void
603nsec3_precompile_newparam(namedb_type* db, zone_type* zone)
604{
region_type* tmpregion = region_create(xalloc, free);
domain_type* walk;
time_t s = time(NULL((void *)0));
unsigned long n = 0, c = 0;

/* add nsec3s of chain to nsec3tree */
for(walk=zone->apex; walk && domain_is_subdomain(walk, zone->apex);
walk = domain_next(walk)) {
n++;
if(nsec3_in_chain_count(walk, zone) != 0) {
	nsec3_precompile_nsec3rr(db, walk, zone);
}
}
/* hash and precompile zone */
for(walk=zone->apex; walk && domain_is_subdomain(walk, zone->apex);
walk = domain_next(walk)) {
if(nsec3_condition_hash(walk, zone)) {
	nsec3_precompile_domain(db, walk, zone, tmpregion);
	region_free_all(tmpregion);
}
if(nsec3_condition_dshash(walk, zone))
	nsec3_precompile_domain_ds(db, walk, zone);
if(++c % ZONEC_PCT_COUNT100000 == 0 && time(NULL((void *)0)) > s + ZONEC_PCT_TIME5) {
	s = time(NULL((void *)0));
	VERBOSITY(1, (LOG_INFO, "nsec3 %s %d %%",do { if ((1) <= verbosity) { log_msg (6, "nsec3 %s %d %%",
 zone->opts->name, (n==0)?0:(int)(c*((unsigned long)100
)/n)) ; } } while (0)
		zone->opts->name,do { if ((1) <= verbosity) { log_msg (6, "nsec3 %s %d %%",
 zone->opts->name, (n==0)?0:(int)(c*((unsigned long)100
)/n)) ; } } while (0)
		(n==0)?0:(int)(c*((unsigned long)100)/n)))do { if ((1) <= verbosity) { log_msg (6, "nsec3 %s %d %%",
 zone->opts->name, (n==0)?0:(int)(c*((unsigned long)100
)/n)) ; } } while (0);
}
}
region_destroy(tmpregion);
635}

637void
638prehash_zone_complete(struct namedb* db, struct zone* zone)
639{
/* robust clear it */
nsec3_clear_precompile(db, zone);
/* find zone settings */

assert(db && zone)((void)0);
nsec3_find_zone_param(db, zone, NULL((void *)0), 1);
if(!zone->nsec3_param || !check_apex_soa(db, zone, 0)) {
zone->nsec3_param = NULL((void *)0);
zone->nsec3_last = NULL((void *)0);
return;
}
nsec3_precompile_newparam(db, zone);
652}

654static void
655init_lookup_key_hash_tree(domain_type* d, uint8_t* hash)
656{ memcpy(d->nsec3->hash_wc->hash.hash, hash, NSEC3_HASH_LEN20); }

658static void
659init_lookup_key_wc_tree(domain_type* d, uint8_t* hash)
660{ memcpy(d->nsec3->hash_wc->wc.hash, hash, NSEC3_HASH_LEN20); }

662static void
663init_lookup_key_ds_tree(domain_type* d, uint8_t* hash)
664{ memcpy(d->nsec3->ds_parent_hash->hash, hash, NSEC3_HASH_LEN20); }

666/* find first in the tree and true if the first to process it */
667static int
668process_first(rbtree_type* tree, uint8_t* hash, rbnode_type** p,
void (*init)(domain_type*, uint8_t*))
670{
domain_type d;
struct nsec3_domain_data n;
nsec3_hash_wc_node_type hash_wc;
nsec3_hash_node_type ds_parent_hash;

if(!tree) {
*p = RBTREE_NULL&rbtree_null_node;
return 0;
}
hash_wc.hash.node.key = NULL((void *)0);
hash_wc.wc.node.key = NULL((void *)0);
n.hash_wc = &hash_wc;
ds_parent_hash.node.key = NULL((void *)0);
n.ds_parent_hash = &ds_parent_hash;
d.nsec3 = &n;
init(&d, hash);
if(rbtree_find_less_equal(tree, &d, p)) {
/* found an exact match */
return 1;
}
if(!*p) /* before first, go from first */
*p = rbtree_first(tree);
/* the inexact, smaller, match we found, does not itself need to
* be edited */
else
*p = rbtree_next(*p); /* if this becomes NULL, nothing to do */
return 0;
698}

700/* set end pointer if possible */
701static void
702process_end(rbtree_type* tree, uint8_t* hash, rbnode_type** p,
void (*init)(domain_type*, uint8_t*))
704{
domain_type d;
struct nsec3_domain_data n;
nsec3_hash_wc_node_type hash_wc;
nsec3_hash_node_type ds_parent_hash;

if(!tree) {
*p = RBTREE_NULL&rbtree_null_node;
return;
}
hash_wc.hash.node.key = NULL((void *)0);
hash_wc.wc.node.key = NULL((void *)0);
n.hash_wc = &hash_wc;
ds_parent_hash.node.key = NULL((void *)0);
n.ds_parent_hash = &ds_parent_hash;
d.nsec3 = &n;
init(&d, hash);
if(rbtree_find_less_equal(tree, &d, p)) {
/* an exact match, fine, because this one does not get
 * processed */
return;
}
/* inexact element, but if NULL, until first element in tree */
if(!*p) {
*p = rbtree_first(tree);
return;
}
/* inexact match, use next element, if possible, the smaller
* element is part of the range */
*p = rbtree_next(*p);
/* if next returns null, we go until the end of the tree */
735}

737/* prehash domains in hash range start to end */
738static void
739process_range(zone_type* zone, domain_type* start,
domain_type* end, domain_type* nsec3)
741{
/* start NULL means from first in tree */
/* end NULL means to last in tree */
rbnode_type *p = RBTREE_NULL&rbtree_null_node, *pwc = RBTREE_NULL&rbtree_null_node, *pds = RBTREE_NULL&rbtree_null_node;
rbnode_type *p_end = RBTREE_NULL&rbtree_null_node, *pwc_end = RBTREE_NULL&rbtree_null_node, *pds_end = RBTREE_NULL&rbtree_null_node;
/* because the nodes are on the prehashlist, the domain->nsec3 is
* already allocated, and we need not allocate it here */
/* set start */
if(start) {
uint8_t hash[NSEC3_HASH_LEN20+1];
parse_nsec3_name(domain_dname(start), hash, sizeof(hash));
/* if exact match on first, set is_exact */
if(process_first(zone->hashtree, hash, &p, init_lookup_key_hash_tree)) {
	((domain_type*)(p->key))->nsec3->nsec3_cover = nsec3;
	((domain_type*)(p->key))->nsec3->nsec3_is_exact = 1;
	p = rbtree_next(p);
}
(void)process_first(zone->wchashtree, hash, &pwc, init_lookup_key_wc_tree);
if(process_first(zone->dshashtree, hash, &pds, init_lookup_key_ds_tree)){
	((domain_type*)(pds->key))->nsec3->
		nsec3_ds_parent_cover = nsec3;
	((domain_type*)(pds->key))->nsec3->
		nsec3_ds_parent_is_exact = 1;
	pds = rbtree_next(pds);
}
} else {
if(zone->hashtree)
	p = rbtree_first(zone->hashtree);
if(zone->wchashtree)
	pwc = rbtree_first(zone->wchashtree);
if(zone->dshashtree)
	pds = rbtree_first(zone->dshashtree);
}
/* set end */
if(end) {
uint8_t hash[NSEC3_HASH_LEN20+1];
parse_nsec3_name(domain_dname(end), hash, sizeof(hash));
process_end(zone->hashtree, hash, &p_end, init_lookup_key_hash_tree);
process_end(zone->wchashtree, hash, &pwc_end, init_lookup_key_wc_tree);
process_end(zone->dshashtree, hash, &pds_end, init_lookup_key_ds_tree);
}

/* precompile */
while(p != RBTREE_NULL&rbtree_null_node && p != p_end) {
((domain_type*)(p->key))->nsec3->nsec3_cover = nsec3;
((domain_type*)(p->key))->nsec3->nsec3_is_exact = 0;
p = rbtree_next(p);
}
while(pwc != RBTREE_NULL&rbtree_null_node && pwc != pwc_end) {
((domain_type*)(pwc->key))->nsec3->
	nsec3_wcard_child_cover = nsec3;
pwc = rbtree_next(pwc);
}
while(pds != RBTREE_NULL&rbtree_null_node && pds != pds_end) {
((domain_type*)(pds->key))->nsec3->
	nsec3_ds_parent_cover = nsec3;
((domain_type*)(pds->key))->nsec3->
	nsec3_ds_parent_is_exact = 0;
pds = rbtree_next(pds);
}
801}

803/* prehash a domain from the prehash list */
804static void
805process_prehash_domain(domain_type* domain, zone_type* zone)
806{
/* in the hashtree, wchashtree, dshashtree walk through to next NSEC3
* and set precompile pointers to point to this domain (or is_exact),
* the first domain can be is_exact. If it is the last NSEC3, also
* process the initial part (before the first) */
rbnode_type* nx;

/* this domain is part of the prehash list and therefore the
* domain->nsec3 is allocated and need not be allocated here */
assert(domain->nsec3 && domain->nsec3->nsec3_node.key)((void)0);
nx = rbtree_next(&domain->nsec3->nsec3_node);
if(nx != RBTREE_NULL&rbtree_null_node) {
/* process until next nsec3 */
domain_type* end = (domain_type*)nx->key;
process_range(zone, domain, end, domain);
} else {
/* first is root, but then comes the first nsec3 */
domain_type* first = (domain_type*)(rbtree_first(
	zone->nsec3tree)->key);
/* last in zone */
process_range(zone, domain, NULL((void *)0), domain);
/* also process before first in zone */
process_range(zone, NULL((void *)0), first, domain);
}
830}

832void prehash_zone(struct namedb* db, struct zone* zone)
833{
domain_type* d;
if(!zone->nsec3_param) {
prehash_clear(db->domains);
return;
}
if(!check_apex_soa(db, zone, 1)) {
/* the zone fails apex soa check, prehash complete may
 * detect other valid chains */
prehash_clear(db->domains);
prehash_zone_complete(db, zone);
return;
}
/* process prehash list */
for(d = db->domains->prehash_list; d; d = d->nsec3->prehash_next) {
process_prehash_domain(d, zone);
}
/* clear prehash list */
prehash_clear(db->domains);

if(!check_apex_soa(db, zone, 0)) {
zone->nsec3_param = NULL((void *)0);
zone->nsec3_last = NULL((void *)0);
}
857}

859/* add the NSEC3 rrset to the query answer at the given domain */
860static void
861nsec3_add_rrset(struct query* query, struct answer* answer,
rr_section_type section, struct domain* domain)
863{
if(domain) {
rrset_type* rrset = domain_find_rrset(domain, query->zone, TYPE_NSEC350);
if(rrset)
	answer_add_rrset(answer, section, domain, rrset);
}
869}

871/* this routine does hashing at query-time. slow. */
872static void
873nsec3_add_nonexist_proof(struct query* query, struct answer* answer,
      struct domain* encloser, const dname_type* qname)
875{
uint8_t hash[NSEC3_HASH_LEN20];
const dname_type* to_prove;
domain_type* cover=0;
assert(encloser)((void)0);
/* if query=a.b.c.d encloser=c.d. then proof needed for b.c.d. */
/* if query=a.b.c.d encloser=*.c.d. then proof needed for b.c.d. */
to_prove = dname_partial_copy(query->region, qname,
dname_label_match_count(qname, domain_dname(encloser))+1);
/* generate proof that one label below closest encloser does not exist */
nsec3_hash_and_store(query->zone, to_prove, hash);
if(nsec3_find_cover(query->zone, hash, sizeof(hash), &cover))
{
/* exact match, hash collision */
domain_type* walk;
char hashbuf[512];
char reversebuf[512];
(void)b32_ntop(hash, sizeof(hash), hashbuf, sizeof(hashbuf));
snprintf(reversebuf, sizeof(reversebuf), "(no name in the zone hashes to this nsec3 record)");
walk = query->zone->apex;
while(walk) {
	if(walk->nsec3 && walk->nsec3->nsec3_cover == cover) {
		snprintf(reversebuf, sizeof(reversebuf),
			"%s %s", domain_to_string(walk),
			walk->nsec3->nsec3_is_exact?"exact":"no_exact_hash_match");
		if(walk->nsec3->nsec3_is_exact)
			break;
	}
	if(walk->nsec3 && walk->nsec3->nsec3_ds_parent_cover == cover) {
		snprintf(reversebuf, sizeof(reversebuf),
			"%s %s", domain_to_string(walk),
			walk->nsec3->nsec3_ds_parent_is_exact?"exact":"no_exact_hash_match");
		if(walk->nsec3->nsec3_ds_parent_is_exact)
			break;
	}
	walk = domain_next(walk);
}


/* the hashed name of the query corresponds to an existing name. */
VERBOSITY(3, (LOG_ERR, "nsec3 hash collision for name=%s hash=%s reverse=%s",do { if ((3) <= verbosity) { log_msg (3, "nsec3 hash collision for name=%s hash=%s reverse=%s"
, dname_to_string(to_prove, ((void *)0)), hashbuf, reversebuf
) ; } } while (0)
	dname_to_string(to_prove, NULL), hashbuf, reversebuf))do { if ((3) <= verbosity) { log_msg (3, "nsec3 hash collision for name=%s hash=%s reverse=%s"
, dname_to_string(to_prove, ((void *)0)), hashbuf, reversebuf
) ; } } while (0);
RCODE_SET(query->packet, RCODE_SERVFAIL)(*buffer_at((query->packet), 3) = (*buffer_at((query->packet
), 3) & ~0x0fU) | (2));
/* RFC 8914 - Extended DNS Errors
 * 4.21. Extended DNS Error Code 0 - Other */
ASSIGN_EDE_CODE_AND_STRING_LITERAL(query->edns.ede,do { query->edns.ede = (0); query->edns.ede_text = ("NSEC3 hash collision"
 ""); query->edns.ede_text_len = sizeof("NSEC3 hash collision"
) - 1; } while (0)
	EDE_OTHER, "NSEC3 hash collision")do { query->edns.ede = (0); query->edns.ede_text = ("NSEC3 hash collision"
 ""); query->edns.ede_text_len = sizeof("NSEC3 hash collision"
) - 1; } while (0);
return;
}
else
{
/* cover proves the qname does not exist */
nsec3_add_rrset(query, answer, AUTHORITY_SECTION, cover);
}
929}

931static void
932nsec3_add_closest_encloser_proof(
struct query* query, struct answer* answer,
struct domain* closest_encloser, const dname_type* qname)
935{
if(!closest_encloser)
return;
/* prove that below closest encloser nothing exists */
nsec3_add_nonexist_proof(query, answer, closest_encloser, qname);
/* proof that closest encloser exists */
if(closest_encloser->nsec3 && closest_encloser->nsec3->nsec3_is_exact)
nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
	closest_encloser->nsec3->nsec3_cover);
944}

946void
947nsec3_answer_wildcard(struct query *query, struct answer *answer,
      struct domain *wildcard, const dname_type* qname)
949{
if(!wildcard)
return;
if(!query->zone->nsec3_param)
return;
nsec3_add_nonexist_proof(query, answer, wildcard, qname);
955}

957static void
958nsec3_add_ds_proof(struct query *query, struct answer *answer,
struct domain *domain, int delegpt)
960{
/* assert we are above the zone cut */
assert(domain != query->zone->apex)((void)0);
if(domain->nsec3 && domain->nsec3->nsec3_ds_parent_is_exact) {
16
←
Assuming field 'nsec3' is null→
/* use NSEC3 record from above the zone cut. */
nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
	domain->nsec3->nsec3_ds_parent_cover);
} else if (!delegpt16.1
'delegpt' is 0
 && domain->nsec316.2
Field 'nsec3' is null
 && domain->nsec3->nsec3_is_exact
&& nsec3_domain_part_of_zone(domain->nsec3->nsec3_cover,
query->zone)) {
nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
	domain->nsec3->nsec3_cover);
} else {
/* prove closest provable encloser */
domain_type* par = domain->parent;
17
←
'par' initialized here→
domain_type* prev_par = 0;

while(par && (!par->nsec3 || !par->nsec3->nsec3_is_exact))
18
←
Assuming 'par' is null→
{
	prev_par = par;
	par = par->parent;
}
assert(par)((void)0); /* parent zone apex must be provable, thus this ends */
if(!par->nsec3) return;
19
←
Access to field 'nsec3' results in a dereference of a null pointer (loaded from variable 'par')
nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
	par->nsec3->nsec3_cover);
/* we took several steps to go to the provable parent, so
   the one below it has no exact nsec3, disprove it.
   disprove is easy, it has a prehashed cover ptr. */
if(prev_par && prev_par->nsec3) {
	assert(prev_par != domain &&((void)0)
		!prev_par->nsec3->nsec3_is_exact)((void)0);
	nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
		prev_par->nsec3->nsec3_cover);
} else {
	/* the exact case was handled earlier, so this is
	 * with a closest-encloser proof, if in the part
	 * before the else the closest encloser proof is done,
	 * then we do not need to add a DS here because
	 * the optout proof is already complete. If not,
	 * we add the nsec3 here to complete the closest
	 * encloser proof with a next closer */
	/* add optout range from parent zone */
	/* note: no check of optout bit, resolver checks it */
	if(domain->nsec3) {
		nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
			domain->nsec3->nsec3_ds_parent_cover);
	}
}
}
1010}

1012void
1013nsec3_answer_nodata(struct query* query, struct answer* answer,
struct domain* original)
1015{
if(!query->zone->nsec3_param)
9
←
Assuming field 'nsec3_param' is non-null→
10
←
Taking false branch→
return;
/* nodata when asking for secure delegation */
if(query->qtype == TYPE_DS43)
11
←
Assuming field 'qtype' is equal to TYPE_DS→
12
←
Taking true branch→
{
if(original == query->zone->apex) {
13
←
Assuming 'original' is not equal to field 'apex'→
14
←
Taking false branch→
	/* DS at zone apex, but server not authoritative for parent zone */
	/* so answer at the child zone level */
	if(original->nsec3 && original->nsec3->nsec3_is_exact)
		nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
			original->nsec3->nsec3_cover);
	return;
}
/* query->zone must be the parent zone */
nsec3_add_ds_proof(query, answer, original, 0);
15
←
Calling 'nsec3_add_ds_proof'→
/* if the DS is from a wildcard match */
if (original==original->wildcard_child_closest_match
	&& label_is_wildcard(dname_name(domain_dname(original)))) {
	/* denial for wildcard is already there */
	/* add parent proof to have a closest encloser proof for wildcard parent */
	/* in other words: nsec3 matching closest encloser */
	if(original->parent && original->parent->nsec3 &&
		original->parent->nsec3->nsec3_is_exact)
		nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
			original->parent->nsec3->nsec3_cover);
}
}
/* the nodata is result from a wildcard match */
else if (original==original->wildcard_child_closest_match
&& label_is_wildcard(dname_name(domain_dname(original)))) {
/* denial for wildcard is already there */

/* add parent proof to have a closest encloser proof for wildcard parent */
/* in other words: nsec3 matching closest encloser */
if(original->parent && original->parent->nsec3 &&
	original->parent->nsec3->nsec3_is_exact)
	nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
		original->parent->nsec3->nsec3_cover);
/* proof for wildcard itself */
/* in other words: nsec3 matching source of synthesis */
if(original->nsec3)
	nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
		original->nsec3->nsec3_cover);
}
else {	/* add nsec3 to prove rrset does not exist */
if(original->nsec3) {
	if(!original->nsec3->nsec3_is_exact) {
		/* go up to an existing parent */
		while(original->parent && original->parent->nsec3 && !original->parent->nsec3->nsec3_is_exact)
			original = original->parent;
	}
	nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
		original->nsec3->nsec3_cover);
	if(!original->nsec3->nsec3_is_exact) {
		if(original->parent && original->parent->nsec3 && original->parent->nsec3->nsec3_is_exact)
		    nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
			original->parent->nsec3->nsec3_cover);

	}
}
}
1077}

1079void
1080nsec3_answer_delegation(struct query *query, struct answer *answer)
1081{
if(!query->zone->nsec3_param)
return;
nsec3_add_ds_proof(query, answer, query->delegation_domain, 1);
1085}

1087int
1088domain_has_only_NSEC3(struct domain* domain, struct zone* zone)
1089{
/* check for only NSEC3/RRSIG */
rrset_type* rrset = domain->rrsets;
int nsec3_seen = 0;
while(rrset)
{
if(!zone || rrset->zone == zone)
{
	if(rrset->rrs[0].type == TYPE_NSEC350)
		nsec3_seen = 1;
	else if(rrset->rrs[0].type != TYPE_RRSIG46)
		return 0;
}
rrset = rrset->next;
}
return nsec3_seen;
1105}

1107void
1108nsec3_answer_authoritative(struct domain** match, struct query *query,
struct answer *answer, struct domain* closest_encloser,
const dname_type* qname)
1111{
if(!query->zone->nsec3_param)
1
Assuming field 'nsec3_param' is non-null→
2
←
Taking false branch→
return;
assert(match)((void)0);
/* there is a match, this has 1 RRset, which is NSEC3, but qtype is not. */
      /* !is_existing: no RR types exist at the QNAME, nor at any descendant of QNAME */
if(*match && !(*match)->is_existing &&
3
←
Assuming the condition is true→
4
←
Assuming field 'is_existing' is not equal to 0→
1118#if 0
query->qtype != TYPE_NSEC350 &&
1120#endif
domain_has_only_NSEC3(*match, query->zone))
{
/* act as if the NSEC3 domain did not exist, name error */
*match = 0;
/* all nsec3s are directly below the apex, that is closest encloser */
if(query->zone->apex->nsec3 &&
	query->zone->apex->nsec3->nsec3_is_exact)
	nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
		query->zone->apex->nsec3->nsec3_cover);
/* disprove the nsec3 record. */
if(closest_encloser->nsec3)
	nsec3_add_rrset(query, answer, AUTHORITY_SECTION, closest_encloser->nsec3->nsec3_cover);
/* disprove a wildcard */
if(query->zone->apex->nsec3)
	nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
		query->zone->apex->nsec3->nsec3_wcard_child_cover);
if (domain_wildcard_child(query->zone->apex)) {
	/* wildcard exists below the domain */
	/* wildcard and nsec3 domain clash. server failure. */
	RCODE_SET(query->packet, RCODE_SERVFAIL)(*buffer_at((query->packet), 3) = (*buffer_at((query->packet
), 3) & ~0x0fU) | (2));
	/* RFC 8914 - Extended DNS Errors
	 * 4.21. Extended DNS Error Code 0 - Other */
	ASSIGN_EDE_CODE_AND_STRING_LITERAL(query->edns.ede,do { query->edns.ede = (0); query->edns.ede_text = ("Wildcard and NSEC3 domain clash"
 ""); query->edns.ede_text_len = sizeof("Wildcard and NSEC3 domain clash"
) - 1; } while (0)
		EDE_OTHER, "Wildcard and NSEC3 domain clash")do { query->edns.ede = (0); query->edns.ede_text = ("Wildcard and NSEC3 domain clash"
 ""); query->edns.ede_text_len = sizeof("Wildcard and NSEC3 domain clash"
) - 1; } while (0);
}
return;
}
else if(*match && (*match)->is_existing4.1
Field 'is_existing' is not equal to 0
 &&
7
←
Taking true branch→
1149#if 0
query->qtype != TYPE_NSEC350 &&
1151#endif
(domain_has_only_NSEC3(*match, query->zone) ||
!domain_find_any_rrset(*match, query->zone)))
5
←
Value assigned to field 'parent'→
6
←
Assuming the condition is true→
{
/* this looks like a NSEC3 domain, but is actually an empty non-terminal. */
nsec3_answer_nodata(query, answer, *match);
8
←
Calling 'nsec3_answer_nodata'→
return;
}
if(!*match) {
/* name error, domain does not exist */
nsec3_add_closest_encloser_proof(query, answer, closest_encloser,
	qname);
if(closest_encloser->nsec3)
	nsec3_add_rrset(query, answer, AUTHORITY_SECTION,
		closest_encloser->nsec3->nsec3_wcard_child_cover);
}
1167}

1169#endif /* NSEC3 */