Struct trust_dns_proto::rr::dnssec::rdata::nsec3::NSEC3

source · [−]

pub struct NSEC3 { /* private fields */ }

This is supported on crate feature dnssec only.

Expand description

RFC 5155, NSEC3, March 2008

3.  The NSEC3 Resource Record

   The NSEC3 Resource Record (RR) provides authenticated denial of
   existence for DNS Resource Record Sets.

   The NSEC3 RR lists RR types present at the original owner name of the
   NSEC3 RR.  It includes the next hashed owner name in the hash order
   of the zone.  The complete set of NSEC3 RRs in a zone indicates which
   RRSets exist for the original owner name of the RR and form a chain
   of hashed owner names in the zone.  This information is used to
   provide authenticated denial of existence for DNS data.  To provide
   protection against zone enumeration, the owner names used in the
   NSEC3 RR are cryptographic hashes of the original owner name
   prepended as a single label to the name of the zone.  The NSEC3 RR
   indicates which hash function is used to construct the hash, which
   salt is used, and how many iterations of the hash function are
   performed over the original owner name.  The hashing technique is
   described fully in Section 5.

   Hashed owner names of unsigned delegations may be excluded from the
   chain.  An NSEC3 RR whose span covers the hash of an owner name or
   "next closer" name of an unsigned delegation is referred to as an
   Opt-Out NSEC3 RR and is indicated by the presence of a flag.

   The owner name for the NSEC3 RR is the base32 encoding of the hashed
   owner name prepended as a single label to the name of the zone.

   The type value for the NSEC3 RR is 50.

   The NSEC3 RR RDATA format is class independent and is described
   below.

   The class MUST be the same as the class of the original owner name.

   The NSEC3 RR SHOULD have the same TTL value as the SOA minimum TTL
   field.  This is in the spirit of negative caching [RFC2308].

3.2.  NSEC3 RDATA Wire Format

 The RDATA of the NSEC3 RR is as shown below:

                      1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |   Hash Alg.   |     Flags     |          Iterations           |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |  Salt Length  |                     Salt                      /
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |  Hash Length  |             Next Hashed Owner Name            /
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 /                         Type Bit Maps                         /
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 Hash Algorithm is a single octet.

 Flags field is a single octet, the Opt-Out flag is the least
 significant bit, as shown below:

  0 1 2 3 4 5 6 7
 +-+-+-+-+-+-+-+-+
 |             |O|
 +-+-+-+-+-+-+-+-+

 Iterations is represented as a 16-bit unsigned integer, with the most
 significant bit first.

 Salt Length is represented as an unsigned octet.  Salt Length
 represents the length of the Salt field in octets.  If the value is
 zero, the following Salt field is omitted.

 Salt, if present, is encoded as a sequence of binary octets.  The
 length of this field is determined by the preceding Salt Length
 field.

 Hash Length is represented as an unsigned octet.  Hash Length
 represents the length of the Next Hashed Owner Name field in octets.

 The next hashed owner name is not base32 encoded, unlike the owner
 name of the NSEC3 RR.  It is the unmodified binary hash value.  It
 does not include the name of the containing zone.  The length of this
 field is determined by the preceding Hash Length field.

Implementations

source

impl NSEC3

source

pub fn new(
 hash_algorithm: Nsec3HashAlgorithm,
 opt_out: bool,
 iterations: u16,
 salt: Vec<u8>,
 next_hashed_owner_name: Vec<u8>,
 type_bit_maps: Vec<RecordType>
) -> Self

Constructs a new NSEC3 record

source

pub fn hash_algorithm(&self) -> Nsec3HashAlgorithm

RFC 5155, NSEC3, March 2008

3.1.1.  Hash Algorithm

   The Hash Algorithm field identifies the cryptographic hash algorithm
   used to construct the hash-value.

   The values for this field are defined in the NSEC3 hash algorithm
   registry defined in Section 11.

source

pub fn opt_out(&self) -> bool

RFC 5155, NSEC3, March 2008

3.1.2.  Flags

   The Flags field contains 8 one-bit flags that can be used to indicate
   different processing.  All undefined flags must be zero.  The only
   flag defined by this specification is the Opt-Out flag.

3.1.2.1.  Opt-Out Flag

   If the Opt-Out flag is set, the NSEC3 record covers zero or more
   unsigned delegations.

   If the Opt-Out flag is clear, the NSEC3 record covers zero unsigned
   delegations.

   The Opt-Out Flag indicates whether this NSEC3 RR may cover unsigned
   delegations.  It is the least significant bit in the Flags field.
   See Section 6 for details about the use of this flag.

source

pub fn iterations(&self) -> u16

RFC 5155, NSEC3, March 2008

3.1.3.  Iterations

   The Iterations field defines the number of additional times the hash
   function has been performed.  More iterations result in greater
   resiliency of the hash value against dictionary attacks, but at a
   higher computational cost for both the server and resolver.  See
   Section 5 for details of the use of this field, and Section 10.3 for
   limitations on the value.

source

pub fn salt(&self) -> &[u8 ]ⓘNotable traits for &'_ mut [u8 ]`impl<'_> Write for &'_ mut [u8]impl<'_> Read for &'_ [u8]`

RFC 5155, NSEC3, March 2008

3.1.5.  Salt

   The Salt field is appended to the original owner name before hashing
   in order to defend against pre-calculated dictionary attacks.  See
   Section 5 for details on how the salt is used.

source

pub fn next_hashed_owner_name(&self) -> &[u8 ]ⓘNotable traits for &'_ mut [u8 ]`impl<'_> Write for &'_ mut [u8]impl<'_> Read for &'_ [u8]`

RFC 5155, NSEC3, March 2008

3.1.7.  Next Hashed Owner Name

 The Next Hashed Owner Name field contains the next hashed owner name
 in hash order.  This value is in binary format.  Given the ordered
 set of all hashed owner names, the Next Hashed Owner Name field
 contains the hash of an owner name that immediately follows the owner
 name of the given NSEC3 RR.  The value of the Next Hashed Owner Name
 field in the last NSEC3 RR in the zone is the same as the hashed
 owner name of the first NSEC3 RR in the zone in hash order.  Note
 that, unlike the owner name of the NSEC3 RR, the value of this field
 does not contain the appended zone name.

source

pub fn type_bit_maps(&self) -> &[RecordType ]

RFC 5155, NSEC3, March 2008

3.1.8.  Type Bit Maps

 The Type Bit Maps field identifies the RRSet types that exist at the
 original owner name of the NSEC3 RR.

source

pub fn flags(&self) -> u8

Flags for encoding

Trait Implementations

source

impl Clone for NSEC3

source

fn clone(&self) -> NSEC3

Returns a copy of the value. Read more

1.0.0 · source

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source. Read more

source

impl Debug for NSEC3

source

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter. Read more

source

impl<'de> Deserialize<'de> for NSEC3

source

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error> where
__D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer. Read more

source

impl Display for NSEC3

RFC 5155, NSEC3, March 2008

3.3.  Presentation Format

   The presentation format of the RDATA portion is as follows:

   o  The Hash Algorithm field is represented as an unsigned decimal
      integer.  The value has a maximum of 255.

   o  The Flags field is represented as an unsigned decimal integer.
      The value has a maximum of 255.

   o  The Iterations field is represented as an unsigned decimal
      integer.  The value is between 0 and 65535, inclusive.

   o  The Salt Length field is not represented.

   o  The Salt field is represented as a sequence of case-insensitive
      hexadecimal digits.  Whitespace is not allowed within the
      sequence.  The Salt field is represented as "-" (without the
      quotes) when the Salt Length field has a value of 0.

   o  The Hash Length field is not represented.

   o  The Next Hashed Owner Name field is represented as an unpadded
      sequence of case-insensitive base32 digits, without whitespace.

   o  The Type Bit Maps field is represented as a sequence of RR type
      mnemonics.  When the mnemonic is not known, the TYPE
      representation as described in Section 5 of [RFC3597] MUST be
      used.

source