Package org.xbill.DNS.dnssec

Class NSEC3ValUtils

java.lang.Object
org.xbill.DNS.dnssec.NSEC3ValUtils
final class NSEC3ValUtils extends Object
NSEC3 non-existence proof utilities.
Since:
3.5

  • Field Details

    • NSEC3_MAX_ITERATIONS_PROPERTY_PREFIX

      public static final String NSEC3_MAX_ITERATIONS_PROPERTY_PREFIX
      See Also:

    • ASTERISK_LABEL

      private static final Name ASTERISK_LABEL

    • MAX_ITERATION_COUNT

      private static final int MAX_ITERATION_COUNT
      See Also:

    • MAX_NSEC3_CALCULATIONS

      private static final int MAX_NSEC3_CALCULATIONS
      Max number of NSEC3 calculations at once. 8 is low enough and allows for cases where multiple proofs are needed.
      See Also:

    • MAX_NSEC3_ERRORS

      private static final int MAX_NSEC3_ERRORS
      When all allowed NSEC3 calculations at once resulted in error treat as bogus. NSEC3 hash errors are not cached and this helps breaks loops with erroneous data.
      See Also:

    • maxIterations

      private final TreeMap<Integer,Integer> maxIterations

  • Constructor Details

    • NSEC3ValUtils

      NSEC3ValUtils()
      Creates a new instance of this class.

  • Method Details

    • init

      void init(Properties config)
      Loads the configuration data. Supported properties are:
      Parameters:
      config - The configuration data.

    • supportsHashAlgorithm

      private boolean supportsHashAlgorithm(int alg)

    • stripUnknownAlgNSEC3s

      public void stripUnknownAlgNSEC3s(List<SRRset> nsec3s)
      Remove all records whose algorithm is unknown.
      Parameters:
      nsec3s - List of NSEC3 records to check. The list is modified by this method.

    • ceWildcard

      private Name ceWildcard(Name closestEncloser)
      Given the name of a closest encloser, return the name *.closest_encloser.
      Parameters:
      closestEncloser - The name to start with.
      Returns:
      The wildcard name.

    • nextClosest

      private Name nextClosest(Name qname, Name closestEncloser)
      Given a qname and its proven closest encloser, calculate the "next closest" name. Basically, this is the name that is one label longer than the closest encloser that is still a subdomain of qname.
      Parameters:
      qname - The qname.
      closestEncloser - The closest encloser name.
      Returns:
      The next closer name.

    • findMatchingNSEC3

      private NSEC3Record findMatchingNSEC3(Name name, Name zonename, List<SRRset> nsec3s, Nsec3ValidationState state)
      Find the NSEC3Record that matches a hash of a name.
      Parameters:
      name - The name to find.
      zonename - The name of the zone that the NSEC3s are from.
      nsec3s - A list of NSEC3Records from a given message.
      state - State to keep track of NSEC3 hashes and calculation count.
      Returns:
      The matching NSEC3Record if one is present, null otherwise.

    • nsec3Covers

      private boolean nsec3Covers(NSEC3Record nsec3, Name zonename, byte[] hash)
      Given a hash and a candidate NSEC3Record, determine if that NSEC3Record covers the hash. Covers specifically means that the hash is in between the owner and next hashes and does not equal either.
      Parameters:
      nsec3 - The candidate NSEC3Record.
      zonename - The zone name.
      hash - The precalculated hash.
      Returns:
      True if the NSEC3Record covers the hash.

    • findCoveringNSEC3

      private NSEC3Record findCoveringNSEC3(Name name, Name zonename, List<SRRset> nsec3s, Nsec3ValidationState state)
      Given a pre-hashed name, find a covering NSEC3 from among a list of NSEC3s.
      Parameters:
      name - The name to consider.
      zonename - The name of the zone.
      nsec3s - The list of NSEC3s present in a message.
      state - State to keep track of NSEC3 hashes and calculation count.
      Returns:
      A covering NSEC3 if one is present, null otherwise.

    • findClosestEncloser

      private NSEC3ValUtils.CEResponse findClosestEncloser(Name name, Name zonename, List<SRRset> nsec3s, Nsec3ValidationState state)
      Given a name and a list of NSEC3s, find the candidate closest encloser. This will be the first ancestor of 'name' (including itself) to have a matching NSEC3 RR.
      Parameters:
      name - The name the start with.
      zonename - The name of the zone that the NSEC3s came from.
      nsec3s - The list of NSEC3s.
      state - State to keep track of NSEC3 hashes and calculation count.
      Returns:
      A CEResponse containing the closest encloser name and the NSEC3 RR that matched it, or null if there wasn't one.

    • proveClosestEncloser

      private NSEC3ValUtils.CEResponse proveClosestEncloser(Name qname, Name zonename, List<SRRset> nsec3s, Nsec3ValidationState state)
      Given a List of nsec3 RRs, find and prove the closest encloser to qname.
      Parameters:
      qname - The qname in question.
      zonename - The name of the zone that the NSEC3 RRs come from.
      nsec3s - The list of NSEC3s found the this response (already verified).
      state - State to keep track of NSEC3 hashes and calculation count.
      Returns:
      A CEResponse object which contains the closest encloser name and the NSEC3 that matches it.

    • validIterations

      private boolean validIterations(SRRset nsec, KeyCache keyCache)

    • allNSEC3sIgnorable

      public boolean allNSEC3sIgnorable(List<SRRset> nsec3s, KeyCache dnskeyRrset)
      Determine if all of the NSEC3s in a response are legally ignoreable (i.e., their presence should lead to an INSECURE result). Currently, this is solely based on iterations.
      Parameters:
      nsec3s - The list of NSEC3s. If there is more than one set of NSEC3 parameters present, this test will not be performed.
      dnskeyRrset - The set of validating DNSKEYs.
      Returns:
      true if all NSEC3s can be legally ignored, false if not.

    • proveNameError

      public SecurityStatus proveNameError(List<SRRset> nsec3s, Name qname, Name zonename, Nsec3ValidationState state)
      Determine if the set of NSEC3 records provided with a response prove NAME ERROR. This means that the NSEC3s prove a) the closest encloser exists, b) the direct child of the closest encloser towards qname doesn't exist, and c) *.closest encloser does not exist.
      Parameters:
      nsec3s - The list of NSEC3s.
      qname - The query name to check against.
      zonename - This is the name of the zone that the NSEC3s belong to. This may be discovered in any number of ways. A good one is to use the signerName from the NSEC3 record's RRSIG.
      state - State to keep track of NSEC3 hashes and calculation count.
      Returns:
      SecurityStatus.SECURE of the Name Error is proven by the NSEC3 RRs, SecurityStatus.BOGUS if not, SecurityStatus.INSECURE if all of the NSEC3s could be validly ignored.

    • proveNodata

      public JustifiedSecStatus proveNodata(List<SRRset> nsec3s, Name qname, int qtype, Name zonename, Nsec3ValidationState state)
      Determine if the NSEC3s provided in a response prove the NOERROR/NODATA status. There are a number of different variants to this:

      1) Normal NODATA -- qname is matched to an NSEC3 record, type is not present.

      2) ENT NODATA -- because there must be NSEC3 record for empty-non-terminals, this is the same as #1.

      3) NSEC3 ownername NODATA -- qname matched an existing, lone NSEC3 ownername, but qtype was not NSEC3. NOTE: as of nsec-05, this case no longer exists.

      4) Wildcard NODATA -- A wildcard matched the name, but not the type.

      5) Opt-In DS NODATA -- the qname is covered by an opt-in span and qtype == DS. (or maybe some future record with the same parent-side-only property)

      Parameters:
      nsec3s - The NSEC3Records to consider.
      qname - The qname in question.
      qtype - The qtype in question.
      zonename - The name of the zone that the NSEC3s came from.
      state - State to keep track of NSEC3 hashes and calculation count.
      Returns:
      SecurityStatus.SECURE if the NSEC3s prove the proposition, SecurityStatus.INSECURE if qname is under opt-out, SecurityStatus.BOGUS otherwise.

    • proveWildcard

      public SecurityStatus proveWildcard(List<SRRset> nsec3s, Name qname, Name zonename, Name wildcard, Nsec3ValidationState state)
      Prove that a positive wildcard match was appropriate (no direct match RRset).
      Parameters:
      nsec3s - The NSEC3 records to work with.
      qname - The qname that was matched to the wildard
      zonename - The name of the zone that the NSEC3s come from.
      wildcard - The purported wildcard that matched.
      state - State to keep track of NSEC3 hashes and calculation count.
      Returns:
      SecurityStatus.SECURE if the NSEC3 records prove this case.

    • proveNoDS

      public SecurityStatus proveNoDS(List<SRRset> nsec3s, Name qname, Name zonename, Nsec3ValidationState state)
      Prove that a DS response either had no DS, or wasn't a delegation point.

      Fundamentally there are two cases here: normal NODATA and Opt-In NODATA.

      Parameters:
      nsec3s - The NSEC3 RRs to examine.
      qname - The name of the DS in question.
      zonename - The name of the zone that the NSEC3 RRs come from.
      state - State to keep track of NSEC3 hashes and calculation count.
      Returns:
      SecurityStatus.SECURE if it was proven that there is no DS in a secure (i.e., not opt-in) way, SecurityStatus.INSECURE if there was no DS in an insecure (i.e., opt-in) way, SecurityStatus.INDETERMINATE if it was clear that this wasn't a delegation point, and SecurityStatus.BOGUS if the proofs don't work out.