<commit_before>package dns

// A structure for handling zone data

import (
	"math/rand"
	"runtime"
	"sort"
	"strings"
	"sync"
	"time"
)

// TODO(mg): the memory footprint could be reduced when we would chop off the
// the zone's origin from every RR. However they are given to us as pointers
// and as such require copies when we fiddle with them...

// Zone represents a DNS zone. It's safe for concurrent use by
// multilpe goroutines.
type Zone struct {
	Origin       string               // Origin of the zone
	olen         int                  // Origin length
	olabels      []string             // Origin cut up in labels, just to speed up the isSubDomain method
	expired      bool                 // Slave zone is expired
	ModTime      time.Time            // When is the zone last modified
	Names        map[string]*ZoneData // Zone data, indexed by owner name
	*sortedNames                      // Sorted names for either NSEC or NSEC3
	*sync.RWMutex
	// The zone's security status, supported values are TypeNone for no DNSSEC,
	// TypeNSEC for an NSEC type zone and TypeNSEC3 for an NSEC3 signed zone.
	Security int
	// If not nil, this function is called after each modification.
	NotifyFunc func(inserted, deleted RR)
}

type sortedNames struct {
	// A sorted list of all names in the zone.
	nsecNames []string
	// A sorted list of all hashed names in the zone, the hash parameters are taken from the NSEC3PARAM
	// record located in the zone's apex.
	nsec3Names []string
}

// Used for nsec(3) bitmap sorting
type uint16Slice []uint16

func (p uint16Slice) Len() int           { return len(p) }
func (p uint16Slice) Less(i, j int) bool { return p[i] < p[j] }
func (p uint16Slice) Swap(i, j int)      { p[i], p[j] = p[j], p[i] }

// SignatureConfig holds the parameters for zone (re)signing. This
// is copied from OpenDNSSEC. See:
// https://wiki.opendnssec.org/display/DOCS/kasp.xml
type SignatureConfig struct {
	// Validity period of the signatures, typically 2 to 4 weeks.
	Validity time.Duration
	// When the end of the validity approaches, how much time should remain
	// before we start to resign. Typical value is 3 days.
	Refresh time.Duration
	// Jitter is an random amount of time added or subtracted from the
	// expiration time to ensure not all signatures expire a the same time.
	// Typical value is 12 hours, which means the actual jitter value is
	// between -12..0..+12.
	Jitter time.Duration
	// InceptionOffset is subtracted from the inception time to ensure badly
	// calibrated clocks on the internet can still validate a signature.
	// Typical value is 300 seconds.
	InceptionOffset time.Duration
	// HonorSepFlag is a boolean which when try instructs the signer to use
	// a KSK/ZSK split and only sign the keyset with the KSK(s). If not
	// set all records are signed with all keys. If this flag is true and
	// a single KSK is used for signing, only the keyset is signed.
	HonorSepFlag bool
	// SignerRoutines specifies the number of signing goroutines, if not
	// set runtime.NumCPU() + 1 is used as the value.
	SignerRoutines int
	// SOA Minttl value must be used as the ttl on NSEC/NSEC3 records.
	Minttl uint32
}

func newSignatureConfig() *SignatureConfig {
	return &SignatureConfig{time.Duration(4*7*24) * time.Hour, time.Duration(3*24) * time.Hour, time.Duration(12) * time.Hour, time.Duration(300) * time.Second, true, runtime.NumCPU() + 1, 0}
}

// DefaultSignaturePolicy has the following values. Validity is 4 weeks,
// Refresh is set to 3 days, Jitter to 12 hours and InceptionOffset to 300 seconds.
// HonorSepFlag is set to true, SignerRoutines is set to runtime.NumCPU() + 1. The<commit_msg>documentation<commit_after>package dns

// A structure for handling zone data

import (
	"math/rand"
	"runtime"
	"sort"
	"strings"
	"sync"
	"time"
)

// TODO(mg): the memory footprint could be reduced when we would chop off the
// the zone's origin from every RR. However they are given to us as pointers
// and as such require copies when we fiddle with them...

// Zone represents a DNS zone. It's safe for concurrent use by
// multilpe goroutines.
type Zone struct {
	Origin       string               // Origin of the zone
	olen         int                  // Origin length
	olabels      []string             // Origin cut up in labels, just to speed up the isSubDomain method
	expired      bool                 // Slave zone is expired
	ModTime      time.Time            // When is the zone last modified
	Names        map[string]*ZoneData // Zone data, indexed by owner name
	*sortedNames                      // Sorted names for either NSEC or NSEC3
	*sync.RWMutex
	// The zone's security status, supported values are TypeNone for no DNSSEC,
	// TypeNSEC for an NSEC type zone and TypeNSEC3 for an NSEC3 signed zone.
	Security int
	// If not nil, this function is called after each modification.
	NotifyFunc func(inserted, deleted RR)
}

type sortedNames struct {
	// A sorted list of all names in the zone.
	nsecNames []string
	// A sorted list of all hashed names in the zone, the hash parameters are taken from the NSEC3PARAM
	// record located in the zone's apex.
	nsec3Names []string
}

// Used for nsec(3) bitmap sorting
type uint16Slice []uint16

func (p uint16Slice) Len() int           { return len(p) }
func (p uint16Slice) Less(i, j int) bool { return p[i] < p[j] }
func (p uint16Slice) Swap(i, j int)      { p[i], p[j] = p[j], p[i] }

// SignatureConfig holds the parameters for zone (re)signing. This
// is copied from OpenDNSSEC. See:
// https://wiki.opendnssec.org/display/DOCS/kasp.xml
type SignatureConfig struct {
	// Validity period of the signatures, typically 2 to 4 weeks.
	Validity time.Duration
	// When the end of the validity approaches, how much time should remain
	// before we start to resign. Typical value is 3 days.
	Refresh time.Duration
	// Jitter is an random amount of time added or subtracted from the
	// expiration time to ensure not all signatures expire a the same time.
	// Typical value is 12 hours, which means the actual jitter value is
	// between -12..0..+12.
	Jitter time.Duration
	// InceptionOffset is subtracted from the inception time to ensure badly
	// calibrated clocks on the internet can still validate a signature.
	// Typical value is 300 seconds.
	InceptionOffset time.Duration
	// HonorSepFlag is a boolean which when try instructs the signer to use
	// a KSK/ZSK split and only sign the keyset with the KSK(s). If not
	// set all records are signed with all keys. If this flag is true and
	// a single KSK is used for signing, only the keyset is signed.
	HonorSepFlag bool
	// SignerRoutines specifies the number of signing goroutines, if not
	// set runtime.NumCPU() + 1 is used as the value.
	SignerRoutines int
	// The zone's SOA Minttl value must be used as the ttl on NSEC/NSEC3 records.
	Minttl uint32
}

func newSignatureConfig() *SignatureConfig {
	return &SignatureConfig{time.Duration(4*7*24) * time.Hour, time.Duration(3*24) * time.Hour, time.Duration(12) * time.Hour, time.Duration(300) * time.Second, true, runtime.NumCPU() + 1, 0}
}

// DefaultSignaturePolicy has the following values. Validity is 4 weeks,
// Refresh is set to 3 days, Jitter to 12 hours and InceptionOffset to 300 seconds.
// HonorSepFlag is set to true, SignerRoutines is set to runtime.NumCPU() + 1. The
{'fraction_non_alphanumeric': 0.07983020676434342, 'fraction_numerical': 0.015062303163083664, 'mean_word_length': 3.006582556226001, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1702993', 'n_tokens_mistral': 2272, 'n_tokens_neox': 2117, 'n_words': 993}