Class: Dnsruby::RR::NSEC3

### Home Classes Methods

### In Files

- lib/Dnsruby/resource/NSEC3.rb

### Parent

Dnsruby::RR

### Methods

- ::calculate_hash
- ::decode_next_hashed
- ::decode_salt
- ::encode_next_hashed
- ::encode_salt
- #add_type
- #calculate_hash
- #check_name_in_range
- #check_name_in_wildcard_range
- #decode_next_hashed
- #encode_next_hashed
- #flags=
- #from_string
- #hash_alg=
- #hash_length=
- #opt_out?
- #salt
- #salt=
- #types=

### Files

- DNSSEC
- EVENTMACHINE
- EXAMPLES
- README

### Class/Module Index

Quicksearch

- Dnsruby
- Dnsruby::Algorithms
- Dnsruby::Classes
- Dnsruby::CodeMapper
- Dnsruby::Config
- Dnsruby::DNS
- Dnsruby::DecodeError
- Dnsruby::Dnssec
- Dnsruby::Dnssec::ValidationPolicy
- Dnsruby::EncodeError
- Dnsruby::ExtendedRCode
- Dnsruby::FormErr
- Dnsruby::Header
- Dnsruby::Hosts
- Dnsruby::IPv4
- Dnsruby::IPv6
- Dnsruby::Message
- Dnsruby::Message::Section
- Dnsruby::Message::SecurityLevel
- Dnsruby::MetaTypes
- Dnsruby::Modes
- Dnsruby::NXDomain
- Dnsruby::NXRRSet
- Dnsruby::Name
- Dnsruby::Name::Label
- Dnsruby::NotAuth
- Dnsruby::NotImp
- Dnsruby::NotZone
- Dnsruby::Nsec3HashAlgorithms
- Dnsruby::OpCode
- Dnsruby::OtherResolvError
- Dnsruby::QTypes
- Dnsruby::Question
- Dnsruby::RCode
- Dnsruby::RR
- Dnsruby::RR::ANY
- Dnsruby::RR::CERT
- Dnsruby::RR::CERT::CertificateTypes
- Dnsruby::RR::CNAME
- Dnsruby::RR::DHCID
- Dnsruby::RR::DLV
- Dnsruby::RR::DNAME
- Dnsruby::RR::DNSKEY
- Dnsruby::RR::DS
- Dnsruby::RR::DS::DigestTypes
- Dnsruby::RR::DomainName
- Dnsruby::RR::Generic
- Dnsruby::RR::HINFO
- Dnsruby::RR::HIP
- Dnsruby::RR::IN
- Dnsruby::RR::IN::A
- Dnsruby::RR::IN::AAAA
- Dnsruby::RR::IN::AFSDB
- Dnsruby::RR::IN::PX
- Dnsruby::RR::IN::SRV
- Dnsruby::RR::IN::WKS
- Dnsruby::RR::IPSECKEY
- Dnsruby::RR::ISDN
- Dnsruby::RR::KX
- Dnsruby::RR::LOC
- Dnsruby::RR::MB
- Dnsruby::RR::MG
- Dnsruby::RR::MINFO
- Dnsruby::RR::MR
- Dnsruby::RR::MX
- Dnsruby::RR::NAPTR
- Dnsruby::RR::NS
- Dnsruby::RR::NSAP
- Dnsruby::RR::NSEC
- Dnsruby::RR::NSEC3
- Dnsruby::RR::NSEC3PARAM
- Dnsruby::RR::OPT
- Dnsruby::RR::PTR
- Dnsruby::RR::RP
- Dnsruby::RR::RRSIG
- Dnsruby::RR::RT
- Dnsruby::RR::SOA
- Dnsruby::RR::SPF
- Dnsruby::RR::SSHFP
- Dnsruby::RR::SSHFP::Algorithms
- Dnsruby::RR::SSHFP::FpTypes
- Dnsruby::RR::TKEY
- Dnsruby::RR::TSIG
- Dnsruby::RR::TXT
- Dnsruby::RR::X25
- Dnsruby::RRSet
- Dnsruby::Recursor
- Dnsruby::Refused
- Dnsruby::Resolv
- Dnsruby::ResolvError
- Dnsruby::ResolvTimeout
- Dnsruby::Resolver
- Dnsruby::Resolver::EventType
- Dnsruby::SelectThread
- Dnsruby::ServFail
- Dnsruby::SingleResolver
- Dnsruby::TheLog
- Dnsruby::TsigError
- Dnsruby::TsigNotSignedResponseError
- Dnsruby::Types
- Dnsruby::Update
- Dnsruby::VerifyError
- Dnsruby::YXDomain
- Dnsruby::YXRRSet
- Dnsruby::ZoneReader
- Dnsruby::ZoneReader::ParseException
- Dnsruby::ZoneSerialError
- Dnsruby::ZoneTransfer
- Dnsruby::ZoneTransfer::Delta
- Base32

No matching classes.

# Dnsruby::RR::NSEC3

The NSEC3 Resource Record (RR) provides authenticated denial of existence for DNS Resource Record Sets.

The NSEC3 RR lists RR types present at the original owner name of the NSEC3 RR. It includes the next hashed owner name in the hash order of the zone. The complete set of NSEC3 RRs in a zone indicates which RRSets exist for the original owner name of the RR and form a chain of hashed owner names in the zone. This information is used to provide authenticated denial of existence for DNS data. To provide protection against zone enumeration, the owner names used in the NSEC3 RR are cryptographic hashes of the original owner name prepended as a single label to the name of the zone. The NSEC3 RR indicates which hash function is used to construct the hash, which salt is used, and how many iterations of the hash function are performed over the original owner name.

### Constants

OPT_OUT

### Attributes

flags[R]

The Flags field contains 8 one-bit flags that can be used to indicate different processing. All undefined flags must be zero. The only flag defined by the NSEC3 specification is the Opt-Out flag.

hash_alg[R]

The Hash Algorithm field identifies the cryptographic hash algorithm used to construct the hash-value.

hash_length[R]

The Hash Length field defines the length of the Next Hashed Owner Name field, ranging in value from 1 to 255 octets.

iterations[RW]

The Iterations field defines the number of additional times the hash function has been performed.

next_hashed[RW]

The Next Hashed Owner Name field contains the next hashed owner name in hash order.

salt_length[R]

The Salt Length field defines the length of the Salt field in octets, ranging in value from 0 to 255.

types[R]

The Type Bit Maps field identifies the RRset types that exist at the NSEC RR's owner name

### Public Class Methods

calculate_hash(name, iterations, salt, hash_alg) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 101
    def NSEC3.calculate_hash(name, iterations, salt, hash_alg)
      # RFC5155

      #5.  Calculation of the Hash

      #   Define H(x) to be the hash of x using the Hash Algorithm selected by

      #   the NSEC3 RR, k to be the number of Iterations, and || to indicate

      #   concatenation.  Then define:

      #

      #      IH(salt, x, 0) = H(x || salt), and

      #

      #      IH(salt, x, k) = H(IH(salt, x, k-1) || salt), if k > 0

      #

      #   Then the calculated hash of an owner name is

      #

      #      IH(salt, owner name, iterations),

      #

      #   where the owner name is in the canonical form, defined as:

      #

      #   The wire format of the owner name where:

      #

      #   1.  The owner name is fully expanded (no DNS name compression) and

      #       fully qualified;

      #   2.  All uppercase US-ASCII letters are replaced by the corresponding

      #       lowercase US-ASCII letters;

      #   3.  If the owner name is a wildcard name, the owner name is in its

      #       original unexpanded form, including the "*" label (no wildcard

      #       substitution);

      #

      #   This form is as defined in Section 6.2 of [RFC 4034].

      #

      n = Name.create(name)
      out = n.canonical
      begin
      (0..iterations).each  {
        out =NSEC3.h(out + salt, hash_alg);
      }
      return Base32.encode32hex(out).downcase
      rescue ArgumentError
      TheLog.error("Unknown hash algorithm #{hash_alg} used for NSEC3 hash")
      return "Unknown NSEC3 hash algorithm"
      end
    end

decode_next_hashed(input) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 253
    def NSEC3.decode_next_hashed(input)
      return Base32.decode32hex(input)
    end

decode_salt(input) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 235
    def NSEC3.decode_salt(input)
      if (input == "-")
        return ""
      end
      return [input].pack("H*")
    end

encode_next_hashed(n) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 261
    def NSEC3.encode_next_hashed(n)
      return Base32.encode32hex(n).downcase
    end

encode_salt(s) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 242
    def NSEC3.encode_salt(s)
      if (!s || s.length == 0)
        return "-"
      end
      return s.unpack("H*")[0]
    end

### Public Instance Methods

add_type(t) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 178
    def add_type(t)
      self.types=(@types + [t])
    end

calculate_hash() click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 97
    def calculate_hash
      return NSEC3.calculate_hash(@name, @iterations, @salt, @hash_alg)
    end

check_name_in_range(name) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 87
    def check_name_in_range(name)
      # @TODO@ Check if the name is covered by this record

      return false
    end

check_name_in_wildcard_range(name) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 92
    def check_name_in_wildcard_range(name)
      # @TODO@ Check if the name is covered by this record

      return false
    end

decode_next_hashed(input) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 249
    def decode_next_hashed(input)
      @next_hashed = NSEC3.decode_next_hashed(input)
      end

encode_next_hashed(n) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 257
    def encode_next_hashed(n)
      return NSEC3.encode_next_hashed(n)
    end

flags=(f) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 183
    def flags=(f)
      if (f==0 || f==OPT_OUT)
        @flags=f
      else
        raise DecodeError.new("Unknown NSEC3 flags field - #{f}")
      end
    end

from_string(input) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 265
    def from_string(input)
      if (input.length > 0)
        data = input.split
        self.hash_alg=(data[0]).to_i
        self.flags=(data[1]).to_i
        self.iterations=(data[2]).to_i
        self.salt=(data[3])

        len = data[0].length + data[1].length + data[2].length + data[3].length + 4
        # There may or may not be brackets around next_hashed

        if (data[4] == "(")
          len = len + data[4].length + 1
        end
        next_hashed_and_types = (input[len, input.length-len])
        data2 = next_hashed_and_types.split()

        self.next_hashed=decode_next_hashed(data2[0])
        self.hash_length=(@next_hashed.length)
        len2 = data2[0].length + 1
        self.types = next_hashed_and_types[len2, next_hashed_and_types.length - len2]
        #          self.types=data2[1]

        #          #          len = data[0].length + data[1].length + data[2].length + data[3].length + data[5].length + 7

        #          #          self.types=(input[len, input.length-len])

      end
    end

hash_alg=(a) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 156
    def hash_alg=(a)
      if (a.instance_of?String)
        if (a.length == 1)
          a = a.to_i
        end
      end
      begin
        alg = Nsec3HashAlgorithms.new(a)
        @hash_alg = alg
      rescue ArgumentError => e
        raise DecodeError.new(e)
      end
    end

hash_length=(l) click to toggle source

def salt_length=(l)

    if ((l < 0) || (l > 255))
      raise DecodeError.new("NSEC3 salt length must be between 0 and 255")
    end
    @salt_length = l

end

    # File lib/Dnsruby/resource/NSEC3.rb, line 204
    def hash_length=(l)
      if ((l < 0) || (l > 255))
        raise DecodeError.new("NSEC3 hash length must be between 0 and 255")
      end
      @hash_length = l
    end

opt_out?() click to toggle source

If the Opt-Out flag is set, the NSEC3 record covers zero or more unsigned delegations.

    # File lib/Dnsruby/resource/NSEC3.rb, line 193
    def opt_out?
      return (@flags==OPT_OUT)
    end

salt() click to toggle source

The Salt field is appended to the original owner name before hashing in order to defend against pre-calculated dictionary attacks.

    # File lib/Dnsruby/resource/NSEC3.rb, line 226
    def salt
      return NSEC3.encode_salt(@salt)
    end

salt=(s) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 230
    def salt=(s)
      @salt = NSEC3.decode_salt(s)
      @salt_length = @salt.length
    end

types=(t) click to toggle source

    # File lib/Dnsruby/resource/NSEC3.rb, line 170
    def types=(t)
      if (t && t.length > 0)
      @types = NSEC.get_types(t)
      else
        @types = []
      end
    end

[Validate]

Generated with the Darkfish Rdoc Generator 2.