fix: implement RFC 5155 closest-encloser + next-closer NSEC3 chain validation#148
fix: implement RFC 5155 closest-encloser + next-closer NSEC3 chain validation#148
Conversation
…lidation ValidateNSEC3Proof now implements the full RFC 5155 Section 7.2.1 NXDOMAIN proof chain instead of just checking hash coverage: - Find closest-encloser by walking query labels longest→shortest - Find next-closer NSEC3 (smallest hash > closest-encloser) - Verify next-closer range covers the query hash - Verify no wildcard exists at (closest-encloser + 1 label) - No-data responses checked via exact-name NSEC3 type bitmap Also adds ErrNSEC3NoClosestEncloser and ErrNSEC3NoNextCloser error types, and helper functions: findClosestEncloserNSEC3, nextCloserNSEC3, wildcardName, nsec3HashLessThan. Fixes: #102
|
Warning Rate limit exceeded
To continue reviewing without waiting, purchase usage credits in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
ValidateNSEC3Proofwith full RFC 5155 Section 7.2.1 NXDOMAIN proof chain:ErrNSEC3NoClosestEncloser,ErrNSEC3NoNextCloserfindClosestEncloserNSEC3,nextCloserNSEC3,wildcardName,nsec3HashLessThanFixes: #102