final class NSEC3ValUtils
extends java.lang.Object
Modifier and Type | Class and Description |
---|---|
private static class |
NSEC3ValUtils.CEResponse
This is just a simple class to encapsulate the response to a closest encloser proof.
|
Modifier and Type | Field and Description |
---|---|
private static Name |
ASTERISK_LABEL |
private static int |
MAX_ITERATION_COUNT |
private java.util.TreeMap<java.lang.Integer,java.lang.Integer> |
maxIterations |
Constructor and Description |
---|
NSEC3ValUtils()
Creates a new instance of this class.
|
Modifier and Type | Method and Description |
---|---|
boolean |
allNSEC3sIgnoreable(java.util.List<SRRset> nsec3s,
KeyCache dnskeyRrset)
Determine if all of the NSEC3s in a response are legally ignoreable (i.e., their presence
should lead to an INSECURE result).
|
private Name |
ceWildcard(Name closestEncloser)
Given the name of a closest encloser, return the name *.closest_encloser.
|
private NSEC3ValUtils.CEResponse |
findClosestEncloser(Name name,
Name zonename,
java.util.List<SRRset> nsec3s)
Given a name and a list of NSEC3s, find the candidate closest encloser.
|
private NSEC3Record |
findCoveringNSEC3(Name name,
Name zonename,
java.util.List<SRRset> nsec3s)
Given a pre-hashed name, find a covering NSEC3 from among a list of NSEC3s.
|
private NSEC3Record |
findMatchingNSEC3(Name name,
Name zonename,
java.util.List<SRRset> nsec3s)
Find the NSEC3Record that matches a hash of a name.
|
(package private) void |
init(java.util.Properties config)
Loads the configuration data.
|
private Name |
nextClosest(Name qname,
Name closestEncloser)
Given a qname and its proven closest encloser, calculate the "next closest" name.
|
private boolean |
nsec3Covers(NSEC3Record nsec3,
Name zonename,
byte[] hash)
Given a hash and a candidate NSEC3Record, determine if that NSEC3Record covers the hash.
|
private NSEC3ValUtils.CEResponse |
proveClosestEncloser(Name qname,
Name zonename,
java.util.List<SRRset> nsec3s)
Given a List of nsec3 RRs, find and prove the closest encloser to qname.
|
SecurityStatus |
proveNameError(java.util.List<SRRset> nsec3s,
Name qname,
Name zonename)
Determine if the set of NSEC3 records provided with a response prove NAME ERROR.
|
JustifiedSecStatus |
proveNodata(java.util.List<SRRset> nsec3s,
Name qname,
int qtype,
Name zonename)
Determine if the NSEC3s provided in a response prove the NOERROR/NODATA status.
|
SecurityStatus |
proveNoDS(java.util.List<SRRset> nsec3s,
Name qname,
Name zonename)
Prove that a DS response either had no DS, or wasn't a delegation point.
|
SecurityStatus |
proveWildcard(java.util.List<SRRset> nsec3s,
Name qname,
Name zonename,
Name wildcard)
Prove that a positive wildcard match was appropriate (no direct match RRset).
|
void |
stripUnknownAlgNSEC3s(java.util.List<SRRset> nsec3s)
Remove all records whose algorithm is unknown.
|
private boolean |
supportsHashAlgorithm(int alg) |
private boolean |
validIterations(SRRset nsec,
KeyCache keyCache) |
private static final Name ASTERISK_LABEL
private static final int MAX_ITERATION_COUNT
private final java.util.TreeMap<java.lang.Integer,java.lang.Integer> maxIterations
void init(java.util.Properties config)
config
- The configuration data.private boolean supportsHashAlgorithm(int alg)
public void stripUnknownAlgNSEC3s(java.util.List<SRRset> nsec3s)
nsec3s
- List of NSEC3 records to check. The list is modified by this method.private Name ceWildcard(Name closestEncloser)
closestEncloser
- The name to start with.private Name nextClosest(Name qname, Name closestEncloser)
qname
- The qname.closestEncloser
- The closest encloser name.private NSEC3Record findMatchingNSEC3(Name name, Name zonename, java.util.List<SRRset> nsec3s)
name
- The name to find.zonename
- The name of the zone that the NSEC3s are from.nsec3s
- A list of NSEC3Records from a given message.private boolean nsec3Covers(NSEC3Record nsec3, Name zonename, byte[] hash)
nsec3
- The candidate NSEC3Record.zonename
- The zone name.hash
- The precalculated hash.private NSEC3Record findCoveringNSEC3(Name name, Name zonename, java.util.List<SRRset> nsec3s)
name
- The name to consider.zonename
- The name of the zone.nsec3s
- The list of NSEC3s present in a message.private NSEC3ValUtils.CEResponse findClosestEncloser(Name name, Name zonename, java.util.List<SRRset> nsec3s)
name
- The name the start with.zonename
- The name of the zone that the NSEC3s came from.nsec3s
- The list of NSEC3s.private NSEC3ValUtils.CEResponse proveClosestEncloser(Name qname, Name zonename, java.util.List<SRRset> nsec3s)
qname
- The qname in question.zonename
- The name of the zone that the NSEC3 RRs come from.nsec3s
- The list of NSEC3s found the this response (already verified).public boolean allNSEC3sIgnoreable(java.util.List<SRRset> nsec3s, KeyCache dnskeyRrset)
nsec3s
- The list of NSEC3s. If there is more than one set of NSEC3 parameters present,
this test will not be performed.dnskeyRrset
- The set of validating DNSKEYs.public SecurityStatus proveNameError(java.util.List<SRRset> nsec3s, Name qname, Name zonename)
nsec3s
- The list of NSEC3s.qname
- The query name to check against.zonename
- This is the name of the zone that the NSEC3s belong to. This may be discovered
in any number of ways. A good one is to use the signerName from the NSEC3 record's RRSIG.SecurityStatus.SECURE
of the Name Error is proven by the NSEC3 RRs, SecurityStatus.BOGUS
if not, SecurityStatus.INSECURE
if all of the NSEC3s could be
validly ignored.public JustifiedSecStatus proveNodata(java.util.List<SRRset> nsec3s, Name qname, int qtype, Name zonename)
1) Normal NODATA -- qname is matched to an NSEC3 record, type is not present.
2) ENT NODATA -- because there must be NSEC3 record for empty-non-terminals, this is the same as #1.
3) NSEC3 ownername NODATA -- qname matched an existing, lone NSEC3 ownername, but qtype was not NSEC3. NOTE: as of nsec-05, this case no longer exists.
4) Wildcard NODATA -- A wildcard matched the name, but not the type.
5) Opt-In DS NODATA -- the qname is covered by an opt-in span and qtype == DS. (or maybe some future record with the same parent-side-only property)
nsec3s
- The NSEC3Records to consider.qname
- The qname in question.qtype
- The qtype in question.zonename
- The name of the zone that the NSEC3s came from.SecurityStatus.SECURE
if the NSEC3s prove the proposition, SecurityStatus.INSECURE
if qname is under opt-out, SecurityStatus.BOGUS
otherwise.public SecurityStatus proveWildcard(java.util.List<SRRset> nsec3s, Name qname, Name zonename, Name wildcard)
nsec3s
- The NSEC3 records to work with.qname
- The qname that was matched to the wildardzonename
- The name of the zone that the NSEC3s come from.wildcard
- The purported wildcard that matched.public SecurityStatus proveNoDS(java.util.List<SRRset> nsec3s, Name qname, Name zonename)
Fundamentally there are two cases here: normal NODATA and Opt-In NODATA.
nsec3s
- The NSEC3 RRs to examine.qname
- The name of the DS in question.zonename
- The name of the zone that the NSEC3 RRs come from.