java.lang.Object
org.minidns.record.Data
org.minidns.record.NSEC3
public class NSEC3extends Data
DNS NSEC3 (Next Secure 3) record payload for DNSSEC.
Provides authenticated denial of existence with hashed names to prevent zone enumeration attacks.

  • Field Details

    • FLAG_OPT_OUT

      public static final byte FLAG_OPT_OUT
      This Flag indicates whether this NSEC3 RR may cover unsigned delegations.
      See Also:

    • hashAlgorithm

      public final NSEC3.HashAlgorithm hashAlgorithm
      The cryptographic hash algorithm used. If MiniDNS isn't aware of the hash algorithm, then this field will be null.
      See Also:

    • hashAlgorithmByte

      public final byte hashAlgorithmByte
      The byte value of the cryptographic hash algorithm used.

    • flags

      public final byte flags
      Bitmap of flags: FLAG_OPT_OUT.

    • iterations

      public final int iterations
      The number of iterations the hash algorithm is applied.

    • types

      public final List<Record.TYPE> types
      The RR types existing at the original owner name.

  • Constructor Details

    • NSEC3

      public NSEC3(byte hashAlgorithm, byte flags, int iterations, byte[] salt, byte[] nextHashed, List<Record.TYPE> types)
      Create an NSEC3 record from its fields.
      Parameters:
      hashAlgorithm - the hash algorithm byte as it appears in the record
      flags - the flag bitmap, see FLAG_OPT_OUT
      iterations - the number of extra hash iterations, 0 to 65535
      salt - the salt prepended to the owner name before hashing
      nextHashed - the next existing owner name in hash order
      types - the RR types present at the original owner name

    • NSEC3

      public NSEC3(byte hashAlgorithm, byte flags, int iterations, byte[] salt, byte[] nextHashed, Record.TYPE... types)
      Create an NSEC3 record from its fields.
      Parameters:
      hashAlgorithm - the hash algorithm byte as it appears in the record
      flags - the flag bitmap, see FLAG_OPT_OUT
      iterations - the number of extra hash iterations, 0 to 65535
      salt - the salt prepended to the owner name before hashing
      nextHashed - the next existing owner name in hash order
      types - the RR types present at the original owner name

  • Method Details

    • parse

      public static NSEC3 parse(DataInputStream dis, int length) throws IOException
      Parse an NSEC3 record payload from a stream.
      Parameters:
      dis - the stream positioned at the start of the record
      length - the total length of the record in the stream, used to size the type bitmap
      Returns:
      the parsed record
      Throws:
      IOException - if the stream ends inside a field or the declared lengths do not add up to the record length

    • getType

      public Record.TYPE getType()
      The DNS RR type of this record, always TYPE.NSEC3.
      Specified by:
      getType in class Data
      Returns:
      the NSEC3 record type

    • serialize

      public void serialize(DataOutputStream dos) throws IOException
      Write this record's payload to a stream.
      Specified by:
      serialize in class Data
      Parameters:
      dos - the stream to write the record fields to
      Throws:
      IOException - if the stream rejects the write

    • toString

      public String toString()
      Render the record in the dig-style presentation format.
      Overrides:
      toString in class Object
      Returns:
      the algorithm, flags, iteration count, salt, next hashed name and types

    • getSalt

      public byte[] getSalt()
      Returns a defensive copy of the salt prepended to the owner name.
      Returns:
      a copy of the salt prepended to the owner name before hashing

    • getSaltLength

      public int getSaltLength()
      Returns the number of salt bytes carried by this record.
      Returns:
      the number of salt bytes, from 0 to 255

    • getNextHashed

      public byte[] getNextHashed()
      Returns a defensive copy of the next owner name in hash order.
      Returns:
      a copy of the next existing owner name in hash order

    • getNextHashedBase32

      public String getNextHashedBase32()
      getNextHashedBase32.
      Returns:
      the next hashed owner name, Base32 encoded and cached after the first call

    • getNextHashedDnsLabel

      public DnsLabel getNextHashedDnsLabel()
      Returns the next hashed owner name as a DNS label, decoding the cached Base32 form.
      Returns:
      the next hashed owner name as a DNS label, cached after the first call

    • copySaltInto

      public void copySaltInto(byte[] dest, int destPos)
      Copy the salt into a caller-supplied buffer.
      Parameters:
      dest - buffer that receives the salt bytes
      destPos - offset in dest at which to write the salt