nsecx.go

Documentation: github.com/miekg/dns

     1  package dns
     2  
     3  import (
     4  	"crypto/sha1"
     5  	"encoding/hex"
     6  	"strings"
     7  )
     8  
     9  // HashName hashes a string (label) according to RFC 5155. It returns the hashed string in uppercase.
    10  func HashName(label string, ha uint8, iter uint16, salt string) string {
    11  	if ha != SHA1 {
    12  		return ""
    13  	}
    14  
    15  	wireSalt := make([]byte, hex.DecodedLen(len(salt)))
    16  	n, err := packStringHex(salt, wireSalt, 0)
    17  	if err != nil {
    18  		return ""
    19  	}
    20  	wireSalt = wireSalt[:n]
    21  
    22  	name := make([]byte, 255)
    23  	off, err := PackDomainName(strings.ToLower(label), name, 0, nil, false)
    24  	if err != nil {
    25  		return ""
    26  	}
    27  	name = name[:off]
    28  
    29  	s := sha1.New()
    30  	// k = 0
    31  	s.Write(name)
    32  	s.Write(wireSalt)
    33  	nsec3 := s.Sum(nil)
    34  
    35  	// k > 0
    36  	for k := uint16(0); k < iter; k++ {
    37  		s.Reset()
    38  		s.Write(nsec3)
    39  		s.Write(wireSalt)
    40  		nsec3 = s.Sum(nsec3[:0])
    41  	}
    42  
    43  	return toBase32(nsec3)
    44  }
    45  
    46  // Cover returns true if a name is covered by the NSEC3 record.
    47  func (rr *NSEC3) Cover(name string) bool {
    48  	nameHash := HashName(name, rr.Hash, rr.Iterations, rr.Salt)
    49  	owner := strings.ToUpper(rr.Hdr.Name)
    50  	labelIndices := Split(owner)
    51  	if len(labelIndices) < 2 {
    52  		return false
    53  	}
    54  	ownerHash := owner[:labelIndices[1]-1]
    55  	ownerZone := owner[labelIndices[1]:]
    56  	if !IsSubDomain(ownerZone, strings.ToUpper(name)) { // name is outside owner zone
    57  		return false
    58  	}
    59  
    60  	nextHash := rr.NextDomain
    61  
    62  	// if empty interval found, try cover wildcard hashes so nameHash shouldn't match with ownerHash
    63  	if ownerHash == nextHash && nameHash != ownerHash { // empty interval
    64  		return true
    65  	}
    66  	if ownerHash > nextHash { // end of zone
    67  		if nameHash > ownerHash { // covered since there is nothing after ownerHash
    68  			return true
    69  		}
    70  		return nameHash < nextHash // if nameHash is before beginning of zone it is covered
    71  	}
    72  	if nameHash < ownerHash { // nameHash is before ownerHash, not covered
    73  		return false
    74  	}
    75  	return nameHash < nextHash // if nameHash is before nextHash is it covered (between ownerHash and nextHash)
    76  }
    77  
    78  // Match returns true if a name matches the NSEC3 record
    79  func (rr *NSEC3) Match(name string) bool {
    80  	nameHash := HashName(name, rr.Hash, rr.Iterations, rr.Salt)
    81  	owner := strings.ToUpper(rr.Hdr.Name)
    82  	labelIndices := Split(owner)
    83  	if len(labelIndices) < 2 {
    84  		return false
    85  	}
    86  	ownerHash := owner[:labelIndices[1]-1]
    87  	ownerZone := owner[labelIndices[1]:]
    88  	if !IsSubDomain(ownerZone, strings.ToUpper(name)) { // name is outside owner zone
    89  		return false
    90  	}
    91  	if ownerHash == nameHash {
    92  		return true
    93  	}
    94  	return false
    95  }
    96
View as plain text