Class: Dnsruby::RR::NSEC3

Inherits:
RR
  • Object
show all
Defined in:
lib/dnsruby/resource/NSEC3.rb

Overview

The NSEC3 Resource Record (RR) provides authenticated denial of existence for DNS Resource Record Sets.

The NSEC3 RR lists RR types present at the original owner name of the NSEC3 RR. It includes the next hashed owner name in the hash order of the zone. The complete set of NSEC3 RRs in a zone indicates which RRSets exist for the original owner name of the RR and form a chain of hashed owner names in the zone. This information is used to provide authenticated denial of existence for DNS data. To provide protection against zone enumeration, the owner names used in the NSEC3 RR are cryptographic hashes of the original owner name prepended as a single label to the name of the zone. The NSEC3 RR indicates which hash function is used to construct the hash, which salt is used, and how many iterations of the hash function are performed over the original owner name.

Constant Summary collapse

ClassValue =

:nodoc: all

nil
TypeValue =

:nodoc: all

Types::NSEC3
OPT_OUT = 
1

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#flags ⇒ Object

The Flags field contains 8 one-bit flags that can be used to indicate different processing. All undefined flags must be zero. The only flag defined by the NSEC3 specification is the Opt-Out flag.



71
72
73
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 71

def flags
  @flags
end

#hash_alg ⇒ Object

The Hash Algorithm field identifies the cryptographic hash algorithm used to construct the hash-value.



66
67
68
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 66

def hash_alg
  @hash_alg
end

#hash_length ⇒ Object

The Hash Length field defines the length of the Next Hashed Owner Name field, ranging in value from 1 to 255 octets.



83
84
85
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 83

def hash_length
  @hash_length
end

#iterations ⇒ Object

The Iterations field defines the number of additional times the hash function has been performed.



75
76
77
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 75

def iterations
  @iterations
end

#next_hashed ⇒ Object

The Next Hashed Owner Name field contains the next hashed owner name in hash order.



87
88
89
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 87

def next_hashed
  @next_hashed
end

#salt_length ⇒ Object (readonly)

The Salt Length field defines the length of the Salt field in octets, ranging in value from 0 to 255.



79
80
81
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 79

def salt_length
  @salt_length
end

#types ⇒ Object

The Type Bit Maps field identifies the RRset types that exist at the NSEC RR's owner name



91
92
93
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 91

def types
  @types
end

Class Method Details

.decode_rdata(msg) ⇒ Object

:nodoc: all



317
318
319
320
321
322
323
324
325
326
327
328
329
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 317

def self.decode_rdata(msg) #:nodoc: all
  hash_alg, flags, iterations, salt_length = msg.get_unpack('ccnc')
  #  Salt may be omitted
  salt = []
  if salt_length > 0
    salt = msg.get_bytes(salt_length)
  end
  hash_length, = msg.get_unpack('c')
  next_hashed = msg.get_bytes(hash_length)
  types = NSEC.decode_types(msg.get_bytes)
  return self.new(
    [hash_alg, flags, iterations, salt_length, salt, hash_length, next_hashed, types])
end

Instance Method Details

#add_type(t) ⇒ Object 



178
179
180
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 178

def add_type(t)
  self.types = (@types + [t])
end

#calculate_hash ⇒ Object 



103
104
105
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 103

def calculate_hash
  NSEC3.calculate_hash(@name, @iterations, @salt, @hash_alg)
end

#check_name_in_range(_name) ⇒ Object 



93
94
95
96
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 93

def check_name_in_range(_name)
  #  @TODO@ Check if the name is covered by this record
  false
end

#check_name_in_wildcard_range(_name) ⇒ Object 



98
99
100
101
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 98

def check_name_in_wildcard_range(_name)
  #  @TODO@ Check if the name is covered by this record
  false
end

#decode_next_hashed(input) ⇒ Object 



243
244
245
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 243

def decode_next_hashed(input)
  @next_hashed = NSEC3.decode_next_hashed(input)
end

#encode_next_hashed(n) ⇒ Object 



251
252
253
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 251

def encode_next_hashed(n)
  return NSEC3.encode_next_hashed(n)
end

#encode_rdata(msg, canonical = false) ⇒ Object

:nodoc: all



300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 300

def encode_rdata(msg, canonical=false) #:nodoc: all
#        s = salt()
  s = @salt
  sl = s.length
  if s == '-'
    sl = 0
  end
  msg.put_pack('ccnc', @hash_alg.code, @flags, @iterations, sl)
  if sl > 0
    msg.put_bytes(s)
  end
  msg.put_pack('c', @hash_length)
  msg.put_bytes(@next_hashed)
  types = NSEC.encode_types(self)
  msg.put_bytes(types)
end

#from_data(data) ⇒ Object

:nodoc: all



211
212
213
214
215
216
217
218
219
220
221
222
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 211

def from_data(data) #:nodoc: all
  hash_alg, flags, iterations, _salt_length, salt, hash_length, next_hashed, types = data
  self.hash_alg = hash_alg
  self.flags = flags
  self.iterations = iterations
#        self.salt_length=(salt_length)
#        self.salt=(salt)
  @salt = salt
  self.hash_length = hash_length
  self.next_hashed = next_hashed
  self.types = types
end

#from_string(input) ⇒ Object 



259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 259

def from_string(input)
  if input.length > 0
    data = input.split
    self.hash_alg = (data[0]).to_i
    self.flags = (data[1]).to_i
    self.iterations = (data[2]).to_i
    self.salt = (data[3])

    len = data[0].length + data[1].length + data[2].length + data[3].length + 4
    #  There may or may not be brackets around next_hashed
    if data[4] == '('
      len += data[4].length + 1
    end
    next_hashed_and_types = (input[len, input.length-len])
    data2 = next_hashed_and_types.split()


    self.next_hashed = decode_next_hashed(data2[0])
    self.hash_length = @next_hashed.length
    len2 = data2[0].length + 1
    self.types = next_hashed_and_types[len2, next_hashed_and_types.length - len2]
    #           self.types=data2[1]
    #           #          len = data[0].length + data[1].length + data[2].length + data[3].length + data[5].length + 7
    #           #          self.types=(input[len, input.length-len])
  end
end

#h(x) ⇒ Object

:nodoc: all



149
150
151
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 149

def h(x) # :nodoc: all
  NSEC3.h(x, @hash_alg)
end

#opt_out? ⇒ Boolean

If the Opt-Out flag is set, the NSEC3 record covers zero or more unsigned delegations.

Returns:

  • (Boolean) 


193
194
195
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 193

def opt_out?
  @flags == OPT_OUT
end

#rdata_to_string ⇒ Object

:nodoc: all



286
287
288
289
290
291
292
293
294
295
296
297
298
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 286

def rdata_to_string #:nodoc: all
  if @next_hashed
    type_strings = []
    @types.each { |t| type_strings << t.string }
    #           salt = NSEC3.encode_salt(@salt)
    salt = salt()  # TODO: Remove this?
    next_hashed = encode_next_hashed(@next_hashed)
    types = type_strings.join(' ')
    "#{@hash_alg.code} #{@flags} #{@iterations} #{salt} ( #{next_hashed} #{types} )"
  else
    ''
  end
end

#salt ⇒ Object

The Salt field is appended to the original owner name before hashing in order to defend against pre-calculated dictionary attacks.



226
227
228
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 226

def salt
  return NSEC3.encode_salt(@salt)
end

#salt=(s) ⇒ Object 



230
231
232
233
 
# File 'lib/dnsruby/resource/NSEC3.rb', line 230

def salt=(s)
  @salt = NSEC3.decode_salt(s)
  @salt_length = @salt.length
end