| /src/external/bsd/nsd/dist/ |
| iterated_hash.h | 2 * iterated_hash.h -- nsec3 hash calculation.
13 #ifdef NSEC3
22 #endif /* NSEC3 */
|
| iterated_hash.c | 2 * iterated_hash.c -- nsec3 hash calculation.
11 #ifdef NSEC3
28 #if defined(NSEC3) && defined(HAVE_SSL)
80 #endif /* NSEC3 */
|
| namedb.h | 49 #ifdef NSEC3
52 #endif /* NSEC3 */
55 #ifdef NSEC3
71 /* (if nsec3 chain complete) always the covering nsec3 record */
73 /* the nsec3 that covers the wildcard child of this domain. */
77 /* NSEC3 domains to prehash, prev and next on the list or cleared */
88 /* if the domain has an NSEC3 for it, use cover ptr to get it. */
93 #endif /* NSEC3 */
106 #ifdef NSEC3
107 struct nsec3_domain_data* nsec3; member in struct:domain
[all...] |
| dbaccess.c | 28 #include "nsec3.h"
67 #ifdef NSEC3
125 /* RRs and UDB and NSEC3 and so on must be already deleted */
155 #ifdef NSEC3
312 #ifdef NSEC3
325 #ifdef NSEC3
362 #ifdef NSEC3
|
| nsec3.h | 2 * nsec3.h -- nsec3 handling.
12 #ifdef NSEC3
33 * finds nsec3 that covers the given domain hash.
40 * _answer_ Routines used to add the correct nsec3 record to a query answer.
51 * add NSEC3 to provide domain name but not rrset exists,
52 * this could be a query for a DS or NSEC3 type
58 * add NSEC3 for a delegation (optout stuff)
63 * add NSEC3 for authoritative answers.
71 * True if domain is a NSEC3 (+RRSIG) data only variety
[all...] |
| namedb.c | 21 #include "nsec3.h"
47 #ifdef NSEC3
48 result->nsec3 = NULL;
63 #ifdef NSEC3
67 if(result->nsec3)
69 result->nsec3 = (struct nsec3_domain_data*) region_alloc(table->region,
71 result->nsec3->nsec3_cover = NULL;
72 result->nsec3->nsec3_wcard_child_cover = NULL;
73 result->nsec3->nsec3_ds_parent_cover = NULL;
74 result->nsec3->nsec3_is_exact = 0
[all...] |
| query.c | 37 #include "nsec3.h"
244 * o wildcard expansion domain_type (7*ptr+u32+2bytes)+(5*ptr nsec3)
246 * o nsec3 hashed name(s) (3 dnames for a nonexist_proof,
988 #ifdef NSEC3
1029 #ifdef NSEC3
1076 #ifdef NSEC3
1117 #ifdef NSEC3
1186 #ifdef NSEC3
1192 #endif /* NSEC3 */
1278 #ifdef NSEC3
[all...] |
| difffile.c | 23 #include "nsec3.h"
514 #ifdef NSEC3
515 /* see if nsec3 deletion triggers need action */
522 /* see if the domain was an NSEC3-domain in the chain, but no longer */
523 if(rr->type == TYPE_NSEC3 && rr->owner->nsec3 &&
524 rr->owner->nsec3->nsec3_node.key &&
528 /* remove from prehash because no longer an NSEC3 domain */
536 &rr->owner->nsec3->nsec3_node);
537 /* add previous NSEC3 to the prehash list */
549 /* if no more NSEC3, done *
[all...] |
| /src/external/mpl/bind/dist/bin/tests/system/chain/ |
| tests.sh | 127 NSEC3) start_index=10 ;;
228 # Relevant NSEC3 hashes:
232 # $ nsec3hash - 1 0 wildcard-nsec3.example.
234 # $ nsec3hash - 1 0 cname.wildcard-nsec3.example.
236 # $ nsec3hash - 1 0 delegation.wildcard-nsec3.example.
238 # $ nsec3hash - 1 0 *.wildcard-nsec3.example.
243 # $ nsec3hash - 1 0 a-nonexistent-name.wildcard-nsec3.example.
245 # $ nsec3hash - 1 0 z-nonexistent-name.wildcard-nsec3.example.
249 echo_i "checking insecure delegation prepared using CNAME chaining, NSEC3 ($n)"
252 # single NSEC3 record proving nonexistence of a DS RRset at the zone cut
[all...] |
| /src/external/mpl/bind/dist/bin/tests/system/dnssec_py/ans4/ |
| rrsig_labels_signer_ans.py | 22 <hash-1>.attacker.rrsig-labels-signer. NSEC3 ... (covers
52 import dns.rdtypes.ANY.NSEC3
70 """Base32hex-encode bytes, lowercase, no padding (NSEC3 owner-name form)."""
75 """SHA-1 NSEC3 hash of name (0 iterations, empty salt)."""
100 """Build NSEC / NSEC3 type bitmap bytes (window 0, types 0–255)."""
171 # NSEC3 covering hash(attacker.rrsig-labels-signer.) for the
178 nsec3_rdata = dns.rdtypes.ANY.NSEC3.NSEC3(
180 rdtype=dns.rdatatype.NSEC3,
189 owner_name, dns.rdataclass.IN, dns.rdatatype.NSEC3
[all...] |
| /src/external/mpl/bind/dist/bin/tests/system/wildcard/ |
| tests_nonterminal_wildcard.py | 15 The NSEC3-signed zone entwild.test has an apex wildcard together with a deeper
26 with NODATA and an NSEC3 proof.
46 "ns1/nsec3.db",
49 "ns1/private.nsec3.conf",
50 "ns1/private.nsec3.db",
75 # The NSEC3 empty-non-terminal proof is the code path that used to crash.
77 rrset.rdtype == dns.rdatatype.NSEC3 for rrset in response.authority
|
| /src/external/mpl/bind/dist/bin/tests/system/dnssec_py/ |
| tests_nsec3_answer.py | 31 import dns.rdtypes.ANY.NSEC3
49 "nsec3-answer",
56 isctest.log.info(f"NSEC3 salt for this hour: {salt_hex}")
66 SUFFIX = dns.name.from_text("nsec3-answer.")
71 Path(os.environ["srcdir"]) / "dnssec_py/ns2/zones/nsec3-answer.db",
129 # DS RR does not exist so we must prove it by having NSEC3 with QNAME
325 dns.rdataclass.IN, dns.rdatatype.NSEC3, dns.rdatatype.NONE
326 ), f"unexpected NSEC3 RR in ANSWER section:\n{response}"
329 dns.rdataclass.IN, dns.rdatatype.NSEC3, dns.rdatatype.NONE
330 ), f"unexpected NSEC3 RR in ADDITIONAL section:\n{response}
[all...] |
| tests_findnoqname_mismatch.py | 110 # Has NSEC3
111 assert _rrset(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC3)
118 covers=dns.rdatatype.NSEC3,
|
| /src/external/mpl/bind/dist/bin/tests/system/dnssec_nsec3/ |
| tests_dnssec_nsec3_delegation.py | 101 if rrset.rdtype != dns.rdatatype.NSEC3:
109 covers=dns.rdatatype.NSEC3,
124 # Baseline (proves the trust anchor and NSEC3 chain validate)
130 # Control (identical DS NODATA without the forged NSEC3)
136 # Attack (DS NODATA carries the forged Opt-Out NSEC3)
|
| tests_nsec3_wrong_zone.py | 97 if rrset.rdtype != dns.rdatatype.NSEC3:
104 covers=dns.rdatatype.NSEC3,
143 # Send query eligble for wildcard expansion (1-label expansion + correct own-zone NSEC3):
|
| /src/external/mpl/bind/dist/bin/tests/system/nsec3_impersonation/ |
| tests_nsec3_impersonation.py | 124 nsec3 = response.get_rrset(
128 dns.rdatatype.NSEC3,
135 covers=dns.rdatatype.NSEC3,
138 assert nsec3 is not None, response
146 F-006 DNSSEC Validation Bypass NSEC3 Apex Hash Label Parent Impersonation
|
| /src/external/mpl/bind/dist/bin/tests/system/nsec3/ans7/ |
| ans.py | 14 Crafted authoritative DNS proxy for BIND9 NSEC3 OOB read PoC.
16 Simulates a malicious authoritative server that crafts NSEC3 responses
20 1. Resolver queries xxx.evil.test A -> proxy modifies NSEC3 in A response
21 (breaks the NSEC3 proof, forcing proveunsecure() fallback)
22 2. Resolver fetches DS for xxx.evil.test -> proxy injects crafted NSEC3
24 3. DS validation succeeds via unmodified NSEC3 (opt-out coverage)
61 # NSEC3 params: alg=1(SHA1), flags=1(opt-out), iterations=10, salt=DEADBEEF
78 Auto-discover NSEC3 owner names and next hashes from the signed zone.
88 if parts[3] == "NSEC3":
91 idx = parts.index("NSEC3")
[all...] |
| /src/external/mpl/bind/dist/bin/tests/system/autosign/ns3/ |
| named.conf.j2 | 52 # NSEC3
53 dnssec-policy "nsec3" {
62 # NSEC3 opt-out
85 # Jitter, NSEC3
86 dnssec-policy "jitter-nsec3" {
147 zone "nsec3.example" {
149 file "nsec3.example.db";
152 dnssec-policy nsec3;
160 dnssec-policy nsec3;
163 zone "optout.nsec3.example"
[all...] |
| /src/external/mpl/bind/dist/bin/tests/system/dnssec_cname_response/ans2/ |
| ans.py | 28 # 'example.' answers DNSKEY/NSEC/NSEC3/RRSIG queries with a CNAME (the
39 # contain every NSEC3 RRset in the zone to exercise negative-proof filtering.
159 """Answer NXDOMAIN with every NSEC3 RRset from a signed zone."""
177 rdset = node.get_rdataset(self.zone.rdclass, dns.rdatatype.NSEC3)
185 dns.rdatatype.NSEC3,
228 dns.rdatatype.NSEC3,
|
| /src/external/mpl/bind/dist/bin/tests/system/verify/ |
| tests_verify.py | 75 def gen_and_sign(name, nsec3=False):
98 # This generates an NSEC3 record for the apex, so that we can
100 if nsec3:
107 rdtype=dns.rdatatype.NSEC3,
113 rdclass=dns.rdataclass.IN, rdtype=dns.rdatatype.NSEC3, create=True
130 covers=dns.rdatatype.NSEC3,
157 "ksk-only.nsec3",
159 "ksk+zsk.nsec3.apex-dname",
160 "ksk+zsk.nsec3",
164 "zsk-only.nsec3",
[all...] |
| /src/external/mpl/bind/dist/bin/tests/system/formerr/ |
| tests_formerr.py | 22 import dns.rdtypes.ANY.NSEC3
160 dns.rdatatype.RdataType.NSEC3,
162 rdata=dns.rdtypes.ANY.NSEC3.NSEC3(
164 dns.rdatatype.RdataType.NSEC3,
376 # Bad NSEC3 owner: X. is not in the base32hex alphabet.
|
| /src/external/mpl/bind/dist/bin/tests/system/dnssec_nsec3/ans1/ |
| common.py | 111 return rrset(f"{owner_hash}.{zone}", dns.rdatatype.NSEC3, rdata)
|
| /src/external/mpl/bind/dist/bin/tests/system/nsec3/ |
| common.py | 52 "nsec-to-nsec3.kasp": NSEC3Saltlen(initial=None, reconfig=0),
54 "nsec3-xfr-inline.kasp": NSEC3Saltlen(initial=None, reconfig=None),
55 "nsec3-dynamic-update-inline.kasp": NSEC3Saltlen(initial=None, reconfig=None),
56 "nsec3.kasp": NSEC3Saltlen(initial=0, reconfig=0),
57 "nsec3-dynamic.kasp": NSEC3Saltlen(initial=0, reconfig=0),
58 "nsec3-change.kasp": NSEC3Saltlen(initial=0, reconfig=8),
59 "nsec3-dynamic-change.kasp": NSEC3Saltlen(initial=0, reconfig=8),
60 "nsec3-dynamic-to-inline.kasp": NSEC3Saltlen(initial=0, reconfig=0),
61 "nsec3-inline-to-dynamic.kasp": NSEC3Saltlen(initial=0, reconfig=0),
62 "nsec3-to-nsec.kasp": NSEC3Saltlen(initial=0, reconfig=None)
[all...] |
| /src/external/bsd/nsd/include/ |
| config.h | 582 /* Define this to enable NSEC3 support. */
583 #define NSEC3 /**/
|
| /src/external/mpl/bind/dist/bin/tests/system/dnssec/ns3/ |
| sign.sh | 159 # NSEC3/NSEC test zone
161 zone=secure.nsec3.example.
162 infile=secure.nsec3.example.db.in
163 zonefile=secure.nsec3.example.db
172 # NSEC3/NSEC3 test zone
174 zone=nsec3.nsec3.example.
175 infile=nsec3.nsec3.example.db.i
[all...] |
