-
Notifications
You must be signed in to change notification settings - Fork 264
Expand file tree
/
Copy pathNSEC3Record.java
More file actions
275 lines (236 loc) · 6.99 KB
/
Copy pathNSEC3Record.java
File metadata and controls
275 lines (236 loc) · 6.99 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
// SPDX-License-Identifier: BSD-3-Clause
// Copyright (c) 1999-2004 Brian Wellington (bwelling@xbill.org)
package org.xbill.DNS;
import java.io.IOException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import org.xbill.DNS.utils.base16;
import org.xbill.DNS.utils.base32;
/**
* Next SECure name 3 - this record contains the next hashed name in an ordered list of hashed names
* in the zone, and a set of types for which records exist for this name. The presence of this
* record in a response signifies a negative response from a DNSSEC-signed zone.
*
* <p>This replaces the NSEC and NXT records, when used.
*
* @author Brian Wellington
* @author David Blacka
* @see <a href="https://datatracker.ietf.org/doc/html/rfc5155">RFC 5155: DNS Security (DNSSEC)
* Hashed Authenticated Denial of Existence</a>
*/
public class NSEC3Record extends Record {
public static class Flags {
/** NSEC3 flags identifiers. */
private Flags() {}
/** Unsigned delegation are not included in the NSEC3 chain. */
public static final int OPT_OUT = 0x01;
}
public static class Digest {
private Digest() {}
private static final Mnemonic digests =
new Mnemonic("DNSSEC NSEC3 Hash Algorithms", Mnemonic.CASE_SENSITIVE);
static {
digests.add(1, "SHA-1");
}
/** Converts an algorithm into its textual representation */
public static String string(int alg) {
return digests.getText(alg);
}
/**
* Converts a textual representation of an algorithm into its numeric code. Integers in the
* range 0..255 are also accepted.
*
* @param s The textual representation of the algorithm
* @return The algorithm code, or -1 on error.
*/
public static int value(String s) {
return digests.getValue(s);
}
/** SHA-1 */
public static final int SHA1 = 1;
}
public static final int SHA1_DIGEST_ID = Digest.SHA1;
private int hashAlg;
private int flags;
private int iterations;
private byte[] salt;
private byte[] next;
private TypeBitmap types;
private static final base32 b32 = new base32(base32.Alphabet.BASE32HEX, false, false);
NSEC3Record() {}
/**
* Creates an NSEC3 record from the given data.
*
* @param name The ownername of the NSEC3 record (base32'd hash plus zonename).
* @param dclass The class.
* @param ttl The TTL.
* @param hashAlg The hash algorithm.
* @param flags The value of the flags field.
* @param iterations The number of hash iterations.
* @param salt The salt to use (may be null).
* @param next The next hash (may not be null).
* @param types The types present at the original ownername.
*/
public NSEC3Record(
Name name,
int dclass,
long ttl,
int hashAlg,
int flags,
int iterations,
byte[] salt,
byte[] next,
int[] types) {
super(name, Type.NSEC3, dclass, ttl);
this.hashAlg = checkU8("hashAlg", hashAlg);
this.flags = checkU8("flags", flags);
this.iterations = checkU16("iterations", iterations);
if (salt != null) {
if (salt.length > 255) {
throw new IllegalArgumentException("Invalid salt");
}
if (salt.length > 0) {
this.salt = new byte[salt.length];
System.arraycopy(salt, 0, this.salt, 0, salt.length);
}
}
if (next.length > 255) {
throw new IllegalArgumentException("Invalid next hash");
}
this.next = new byte[next.length];
System.arraycopy(next, 0, this.next, 0, next.length);
this.types = new TypeBitmap(types);
}
@Override
protected void rrFromWire(DNSInput in) throws IOException {
hashAlg = in.readU8();
flags = in.readU8();
iterations = in.readU16();
int saltLength = in.readU8();
if (saltLength > 0) {
salt = in.readByteArray(saltLength);
} else {
salt = null;
}
int nextLength = in.readU8();
next = in.readByteArray(nextLength);
types = new TypeBitmap(in);
}
@Override
protected void rrToWire(DNSOutput out, Compression c, boolean canonical) {
out.writeU8(hashAlg);
out.writeU8(flags);
out.writeU16(iterations);
if (salt != null) {
out.writeU8(salt.length);
out.writeByteArray(salt);
} else {
out.writeU8(0);
}
out.writeU8(next.length);
out.writeByteArray(next);
types.toWire(out);
}
@Override
protected void rdataFromString(Tokenizer st, Name origin) throws IOException {
hashAlg = st.getUInt8();
flags = st.getUInt8();
iterations = st.getUInt16();
String s = st.getString();
if (s.equals("-")) {
salt = null;
} else {
st.unget();
salt = st.getHexString();
if (salt.length > 255) {
throw st.exception("salt value too long");
}
}
next = st.getBase32String(b32);
types = new TypeBitmap(st);
}
/** Converts rdata to a String */
@Override
protected String rrToString() {
StringBuilder sb = new StringBuilder();
sb.append(hashAlg);
sb.append(' ');
sb.append(flags);
sb.append(' ');
sb.append(iterations);
sb.append(' ');
if (salt == null) {
sb.append('-');
} else {
sb.append(base16.toString(salt));
}
sb.append(' ');
sb.append(b32.toString(next));
if (!types.empty()) {
sb.append(' ');
sb.append(types.toString());
}
return sb.toString();
}
/** Returns the hash algorithm */
public int getHashAlgorithm() {
return hashAlg;
}
/** Returns the flags */
public int getFlags() {
return flags;
}
/** Returns the number of iterations */
public int getIterations() {
return iterations;
}
/** Returns the salt */
public byte[] getSalt() {
return salt;
}
/** Returns the next hash */
public byte[] getNext() {
return next;
}
/** Returns the set of types defined for this name */
public int[] getTypes() {
return types.toArray();
}
/** Returns whether a specific type is in the set of types. */
public boolean hasType(int type) {
return types.contains(type);
}
static byte[] hashName(Name name, int hashAlg, int iterations, byte[] salt)
throws NoSuchAlgorithmException {
MessageDigest digest;
if (hashAlg == Digest.SHA1) {
digest = MessageDigest.getInstance("sha-1");
} else {
throw new NoSuchAlgorithmException("Unknown NSEC3 algorithm identifier: " + hashAlg);
}
byte[] hash = null;
for (int i = 0; i <= iterations; i++) {
digest.reset();
if (i == 0) {
digest.update(name.toWireCanonical());
} else {
digest.update(hash);
}
if (salt != null) {
digest.update(salt);
}
hash = digest.digest();
}
return hash;
}
/**
* Hashes a name with the parameters of this NSEC3 record.
*
* @param name The name to hash
* @return The hashed version of the name
* @throws NoSuchAlgorithmException The hash algorithm is unknown.
*/
public byte[] hashName(Name name) throws NoSuchAlgorithmException {
return hashName(name, hashAlg, iterations, salt);
}
}