mirror of
https://github.com/hanzoai/volume.git
synced 2026-10-01 00:48:00 +00:00
zeekay
b61441f7d7
A fork of Rancher's local-path-provisioner at v0.0.36. The behaviour is unchanged and deliberately so — a directory on the node a pod lands on is the right thing for a disk. What changes is identity. The provisioner answers to hanzo.ai/volume rather than rancher.io/local-path. That is not branding: two provisioners sharing one name race for the same claims, and a stock k3s carries the upstream one, so a cluster running both would settle our storage by chance. Data lives at /var/lib/hanzo/volume, so reading a Hanzo cluster does not mean learning another vendor's directory. Apache-2.0 as published, unaltered, with Rancher's attribution in NOTICE. The README says what this is not: durability. A volume here dies with its node. That is hanzoai/replicate's question, one layer up, and keeping the two apart is what lets the disk stay this simple.
96 lines
2.4 KiB
Go
96 lines
2.4 KiB
Go
package dns
|
|
|
|
import (
|
|
"crypto/sha1"
|
|
"encoding/hex"
|
|
"strings"
|
|
)
|
|
|
|
// HashName hashes a string (label) according to RFC 5155. It returns the hashed string in uppercase.
|
|
func HashName(label string, ha uint8, iter uint16, salt string) string {
|
|
if ha != SHA1 {
|
|
return ""
|
|
}
|
|
|
|
wireSalt := make([]byte, hex.DecodedLen(len(salt)))
|
|
n, err := packStringHex(salt, wireSalt, 0)
|
|
if err != nil {
|
|
return ""
|
|
}
|
|
wireSalt = wireSalt[:n]
|
|
|
|
name := make([]byte, 255)
|
|
off, err := PackDomainName(strings.ToLower(label), name, 0, nil, false)
|
|
if err != nil {
|
|
return ""
|
|
}
|
|
name = name[:off]
|
|
|
|
s := sha1.New()
|
|
// k = 0
|
|
s.Write(name)
|
|
s.Write(wireSalt)
|
|
nsec3 := s.Sum(nil)
|
|
|
|
// k > 0
|
|
for k := uint16(0); k < iter; k++ {
|
|
s.Reset()
|
|
s.Write(nsec3)
|
|
s.Write(wireSalt)
|
|
nsec3 = s.Sum(nsec3[:0])
|
|
}
|
|
|
|
return toBase32(nsec3)
|
|
}
|
|
|
|
// Cover returns true if a name is covered by the NSEC3 record.
|
|
func (rr *NSEC3) Cover(name string) bool {
|
|
nameHash := HashName(name, rr.Hash, rr.Iterations, rr.Salt)
|
|
owner := strings.ToUpper(rr.Hdr.Name)
|
|
labelIndices := Split(owner)
|
|
if len(labelIndices) < 2 {
|
|
return false
|
|
}
|
|
ownerHash := owner[:labelIndices[1]-1]
|
|
ownerZone := owner[labelIndices[1]:]
|
|
if !IsSubDomain(ownerZone, strings.ToUpper(name)) { // name is outside owner zone
|
|
return false
|
|
}
|
|
|
|
nextHash := rr.NextDomain
|
|
|
|
// if empty interval found, try cover wildcard hashes so nameHash shouldn't match with ownerHash
|
|
if ownerHash == nextHash && nameHash != ownerHash { // empty interval
|
|
return true
|
|
}
|
|
if ownerHash > nextHash { // end of zone
|
|
if nameHash > ownerHash { // covered since there is nothing after ownerHash
|
|
return true
|
|
}
|
|
return nameHash < nextHash // if nameHash is before beginning of zone it is covered
|
|
}
|
|
if nameHash < ownerHash { // nameHash is before ownerHash, not covered
|
|
return false
|
|
}
|
|
return nameHash < nextHash // if nameHash is before nextHash is it covered (between ownerHash and nextHash)
|
|
}
|
|
|
|
// Match returns true if a name matches the NSEC3 record
|
|
func (rr *NSEC3) Match(name string) bool {
|
|
nameHash := HashName(name, rr.Hash, rr.Iterations, rr.Salt)
|
|
owner := strings.ToUpper(rr.Hdr.Name)
|
|
labelIndices := Split(owner)
|
|
if len(labelIndices) < 2 {
|
|
return false
|
|
}
|
|
ownerHash := owner[:labelIndices[1]-1]
|
|
ownerZone := owner[labelIndices[1]:]
|
|
if !IsSubDomain(ownerZone, strings.ToUpper(name)) { // name is outside owner zone
|
|
return false
|
|
}
|
|
if ownerHash == nameHash {
|
|
return true
|
|
}
|
|
return false
|
|
}
|