k3s/vendor/github.com/miekg/dns/nsecx.go

96 lines
2.4 KiB
Go
Raw Normal View History

2019-01-12 04:58:27 +00:00
package dns
import (
"crypto/sha1"
2019-09-27 21:51:53 +00:00
"encoding/hex"
2019-01-12 04:58:27 +00:00
"strings"
)
// HashName hashes a string (label) according to RFC 5155. It returns the hashed string in uppercase.
func HashName(label string, ha uint8, iter uint16, salt string) string {
2019-09-27 21:51:53 +00:00
if ha != SHA1 {
return ""
}
wireSalt := make([]byte, hex.DecodedLen(len(salt)))
n, err := packStringHex(salt, wireSalt, 0)
2019-01-12 04:58:27 +00:00
if err != nil {
return ""
}
2019-09-27 21:51:53 +00:00
wireSalt = wireSalt[:n]
2019-01-12 04:58:27 +00:00
name := make([]byte, 255)
off, err := PackDomainName(strings.ToLower(label), name, 0, nil, false)
if err != nil {
return ""
}
name = name[:off]
2019-09-27 21:51:53 +00:00
s := sha1.New()
2019-01-12 04:58:27 +00:00
// k = 0
2019-09-27 21:51:53 +00:00
s.Write(name)
s.Write(wireSalt)
2019-01-12 04:58:27 +00:00
nsec3 := s.Sum(nil)
2019-09-27 21:51:53 +00:00
2019-01-12 04:58:27 +00:00
// k > 0
for k := uint16(0); k < iter; k++ {
s.Reset()
2019-09-27 21:51:53 +00:00
s.Write(nsec3)
s.Write(wireSalt)
nsec3 = s.Sum(nsec3[:0])
2019-01-12 04:58:27 +00:00
}
2019-09-27 21:51:53 +00:00
return toBase32(nsec3)
2019-01-12 04:58:27 +00:00
}
2019-09-27 21:51:53 +00:00
// Cover returns true if a name is covered by the NSEC3 record
2019-01-12 04:58:27 +00:00
func (rr *NSEC3) Cover(name string) bool {
2019-09-27 21:51:53 +00:00
nameHash := HashName(name, rr.Hash, rr.Iterations, rr.Salt)
owner := strings.ToUpper(rr.Hdr.Name)
labelIndices := Split(owner)
if len(labelIndices) < 2 {
2019-01-12 04:58:27 +00:00
return false
}
2019-09-27 21:51:53 +00:00
ownerHash := owner[:labelIndices[1]-1]
ownerZone := owner[labelIndices[1]:]
if !IsSubDomain(ownerZone, strings.ToUpper(name)) { // name is outside owner zone
return false
2019-01-12 04:58:27 +00:00
}
2019-09-27 21:51:53 +00:00
nextHash := rr.NextDomain
// if empty interval found, try cover wildcard hashes so nameHash shouldn't match with ownerHash
if ownerHash == nextHash && nameHash != ownerHash { // empty interval
return true
2019-01-12 04:58:27 +00:00
}
2019-09-27 21:51:53 +00:00
if ownerHash > nextHash { // end of zone
if nameHash > ownerHash { // covered since there is nothing after ownerHash
return true
}
return nameHash < nextHash // if nameHash is before beginning of zone it is covered
2019-01-12 04:58:27 +00:00
}
2019-09-27 21:51:53 +00:00
if nameHash < ownerHash { // nameHash is before ownerHash, not covered
2019-01-12 04:58:27 +00:00
return false
}
2019-09-27 21:51:53 +00:00
return nameHash < nextHash // if nameHash is before nextHash is it covered (between ownerHash and nextHash)
2019-01-12 04:58:27 +00:00
}
2019-09-27 21:51:53 +00:00
// Match returns true if a name matches the NSEC3 record
2019-01-12 04:58:27 +00:00
func (rr *NSEC3) Match(name string) bool {
2019-09-27 21:51:53 +00:00
nameHash := HashName(name, rr.Hash, rr.Iterations, rr.Salt)
owner := strings.ToUpper(rr.Hdr.Name)
labelIndices := Split(owner)
if len(labelIndices) < 2 {
2019-01-12 04:58:27 +00:00
return false
}
2019-09-27 21:51:53 +00:00
ownerHash := owner[:labelIndices[1]-1]
ownerZone := owner[labelIndices[1]:]
if !IsSubDomain(ownerZone, strings.ToUpper(name)) { // name is outside owner zone
return false
}
if ownerHash == nameHash {
2019-01-12 04:58:27 +00:00
return true
}
return false
}