jenkins的active directory plugin之DNS查询

为什么在jenkins上Active Directory 插件那里的Domain Name只配置个 company.com 就行了呢?

DNS查询,通过udp通信查询到公司的所有的DC(domain controller)地址,然后进行AD域认证。
其实是通过一个查询获取到了具体的dns服务器的IP,返回的是好几个ip,
这个根据公司配置了几个DC(domain controller)服务器有关系的。

DNS报文格式,不论是请求报文,还是DNS服务器返回的应答报文,都使用统一的格式。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
DNS format

+--+--+--+--+--+--+--+
| Header |
+--+--+--+--+--+--+--+
| Question |
+--+--+--+--+--+--+--+
| Answer |
+--+--+--+--+--+--+--+
| Authority |
+--+--+--+--+--+--+--+
| Additional |
+--+--+--+--+--+--+--+



下面是整理的一次查询发送报文

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
首先是头部区域
Header format

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| ID |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|QR| opcode |AA|TC|RD|RA| Z | RCODE |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| QDCOUNT |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| ANCOUNT |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| NSCOUNT |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| ARCOUNT |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
0~1字节, 最前面的2个字节表示会话表示,也就是报文ID。ID: 2个字节(16bit),标识字段,
客户端会解析服务器返回的DNS应答报文,获取ID值与请求报文设置的ID值做比较,如果相同,则认为是同一个DNS会话。
0 = 0x8C 演示例子给个 35935 -> 1000 1100 0101 1111 = 0x8C5F -> 右移8位,得到高8位的 0x8C
1 = 0x5F 35935的低8位存放到这里。

2~3字节表示falg,标识。16位,2个字节表示。 QR(1bit),0为查询,1为响应。
opcode(4bit),通常值为0(标准查询),其他值为1(反向查询)和2(服务器状态请求),[3,15]保留值。
AA(1bit),表示授权回答。TC(1bit)表示可截断。RD(1bit)表示期望递归。RA(1bit)表示可用递归。
rcode(4bit)表示返回码,0表示没有错误,其他表示错误,[6,15] : 保留值,暂未使用。
2 = 0x01 0000 0001
3 = 0x00 0000 0000

4~11字节,8个字节数量字段
4 = 0x0 问题数
5 = 0x1
6 = 0x0 回答资源记录数
7 = 0x0
8 = 0x0 授权资源记录数
9 = 0x0
10 = 0x0 附加资源记录数
11 = 0x0
到此是header头部结束。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
 
下面是Question区域了
Question format

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| ... |
| QNAME |
| ... |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| QTYPE |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| QCLASS |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

qname这一段比较长,也就是存放的我们的域名地址了,格式是 len+data,最后是个0.

12 = 0x03 十进制3 后面放了3个byte, 字符串是 "_gc"
13 = 0x5F
14 = 0x67
15 = 0x63

16 = 0x04 十进制4 后面放了4个byte, 字符串是"_tcp"
17 = 0x5F
18 = 0x74
19 = 0x63
20 = 0x70

21 = 0x0A 十进制10 后面10个byte,字符串 "company"
22 = 0x62
23 = 0x6C
24 = 0x61
25 = 0x63
26 = 0x6B
27 = 0x73
28 = 0x68
29 = 0x61
30 = 0x72
31 = 0x6B

32 = 0x03 十进制3 后面放了3个byte,后面3个byte,存放的是 字符串 "com"
33 = 0x63 字母 c
34 = 0x6F 字母 o
35 = 0x6D 字母 m

36 = 0x00 十进制 0, qname最后放的0

37 = 0x00
38 = 0x21 qtype=33 十进制的33, 无符号16bit整数表示查询的协议类型.question type。这里的33表示SRV。

39 = 0x00
40 = 0x01 qtclass=1 十进制1,无符号16bit整数表示查询的类,比如,IN代表Internet. question class

这个例子采用了byte数组,长度41个byte,下标是0~40。这个例子没有后面的3个区域。

java代码,部分代码摘抄自jenkins的active directory plugin源代码。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
package com.mage.demo;

import com.sun.jndi.dns.DnsName;

import org.junit.After;
import org.junit.Before;
import org.junit.Test;

import java.net.DatagramPacket;
import java.net.DatagramSocket;
import java.net.InetAddress;

/**
* Ldap Tester.
*
* @author <Authors name>
* @version 1.0
* @since <pre>二月 15, 2019</pre>
*/
public class LdapTest {
// DNS packet header field offsets
private static final int IDENT_OFFSET = 0;
private static final int FLAGS_OFFSET = 2;
private static final int NUMQ_OFFSET = 4;
private static final int NUMANS_OFFSET = 6;
private static final int NUMAUTH_OFFSET = 8;
private static final int NUMADD_OFFSET = 10;
private static final int DNS_HDR_SIZE = 12;
private static final int DEFAULT_PORT = 53;

@Before
public void before() throws Exception {
}

@After
public void after() throws Exception {
}

// Builds a query name in pkt according to the RFC spec.
private void makeQueryName(DnsName fqdn, Packet pkt, int off) {

// Loop through labels, least-significant first.
for (int i = fqdn.size() - 1; i >= 0; i--) {
String label = fqdn.get(i);
int len = label.length();

pkt.putByte(len, off++);
for (int j = 0; j < len; j++) {
pkt.putByte(label.charAt(j), off++);
}
}
if (!(!fqdn.isEmpty() && fqdn.get(0).equals(""))) {
pkt.putByte(0, off);
}
}

@Test
public void testObtainLDAPServer() throws Exception {
Packet pkt = new Packet(41);
DnsName fqdn = new DnsName("_gc._tcp.company.com.");
int qnameLen = fqdn.getOctets();

int xid = 35935;
pkt.putShort(xid, IDENT_OFFSET);
int flags = 256;
pkt.putShort(flags, FLAGS_OFFSET);

pkt.putShort(1, NUMQ_OFFSET);
pkt.putShort(0, NUMANS_OFFSET);
pkt.putInt(0, NUMAUTH_OFFSET);

makeQueryName(fqdn, pkt, DNS_HDR_SIZE);

int qtype = 33;
pkt.putShort(qtype, DNS_HDR_SIZE + qnameLen);

int qclass = 1;
pkt.putShort(qclass, DNS_HDR_SIZE + qnameLen + 2);

DatagramSocket socket = new DatagramSocket();

InetAddress server = InetAddress.getByName("127.0.0.53");//这里为什么是这个IP地址呢????
int port = DEFAULT_PORT; //port is 53
DatagramPacket opkt = new DatagramPacket(pkt.getData(), pkt.length(), server, port);
DatagramPacket ipkt = new DatagramPacket(new byte[8000], 8000);

socket.connect(server, port);

socket.send(opkt);

socket.receive(ipkt);
byte[] data = ipkt.getData();

System.out.println(data);

}

}

响应报文

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
首先是头部区域
Header format

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| ID |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|QR| opcode |AA|TC|RD|RA| Z | RCODE |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| QDCOUNT |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| ANCOUNT |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| NSCOUNT |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| ARCOUNT |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
0 = 0x8c
1 = 0x5f

2 = 0x81
3 = 0x80

4 = 0x00
5 = 0x01
6 = 0x00
7 = 0x04
8 = 0x00
9 = 0x00
10 = 0x00
11 = 0x00

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
 
下面是Question区域了
Question format

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| ... |
| QNAME |
| ... |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| QTYPE |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| QCLASS |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

qname这一段比较长,也就是存放的我们的域名地址了,格式是 len+data,最后是个0.
12 = 0x03 十进制3 后面放了3个byte, 字符串是 "_gc"
13 = 0x5f
14 = 0x67
15 = 0x63

16 = 0x04 十进制4 后面放了4个byte, 字符串是"_tcp"
17 = 0x5f
18 = 0x74
19 = 0x63
20 = 0x70

21 = 0x0a 十进制10 后面10个byte,字符串 "company"
22 = 0x62
23 = 0x6c
24 = 0x61
25 = 0x63
26 = 0x6b
27 = 0x73
28 = 0x68
29 = 0x61
30 = 0x72
31 = 0x6b

32 = 0x03 十进制3 后面放了3个byte,后面3个byte,存放的是 字符串 "com"
33 = 0x63
34 = 0x6f
35 = 0x6d

36 = 0x00 十进制 0, qname最后放的0

37 = 0x00
38 = 0x21 qtype=33 十进制的33, 无符号16bit整数表示查询的协议类型.question type。这里的33表示SRV。

39 = 0x00
40 = 0x01 qtclass=1 十进制1,无符号16bit整数表示查询的类,比如,IN代表Internet. question class。

这个就是上面那个查询报文的响应报文,这里对应的question 区域都是一样的
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
Answer/Authority/Additional
Answer/Authority/Additional format

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| NAME |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| TYPE |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| CLASS |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| TTL |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| RDLENGTH |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| RDATA |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+


NAME 资源记录包含的域名.
TYPE 表示DNS协议的类型.
CLASS 表示RDATA的类.
TTL 4字节无符号整数表示资源记录可以缓存的时间。0代表只能被传输,但是不能被缓存。
RDLENGTH 2个字节无符号整数表示RDATA的长度
RDATA 不定长字符串来表示记录,格式根TYPE和CLASS有关。比如,TYPE是A,CLASS 是 IN,那么RDATA就是一个4个字节的ARPA网络地址。


41 = 0xc0 NAME 资源记录包含的域名. 1100 0000 0000 1100
42 = 0x0c

43 = 0x00 TYPE 表示DNS协议的类型. 0x21表示 A SRV record(s) for the domain name
44 = 0x21

45 = 0x00 CLASS 表示RDATA的类.
46 = 0x01

47 = 0x00 TTL 4字节, 十进制数字600
48 = 0x00
49 = 0x02
50 = 0x58

51 = 0x00 RDLENGTH 2个字节,十进制12
52 = 0x0d

53 = 0x00 十进制 0 priority
54 = 0x00

55 = 0x00 十进制 100 weight
56 = 0x64

57 = 0x0c 十进制3268 port
58 = 0xc4

59 = 0x04 十进制 4,后面4个字节,字符串"dc02"
60 = 0x64 字母d
61 = 0x63 字母c
62 = 0x30 数字0
63 = 0x32 数字2

64 = 0xc0 二进制的 11000000,十进制192,后面不可能跟上192字节长度,所以这里表示name compression
65 = 0x15 十进制21,这里表示跳转到21字节,21字节后面10个字符,字符串 "company"

66 = 0xc0
67 = 0x0c

68 = 0x00

69 = 0x21
70 = 0x00
71 = 0x01
72 = 0x00
73 = 0x00
74 = 0x02
75 = 0x58
76 = 0x00

77 = 0x0d
78 = 0x00
79 = 0x00
80 = 0x00
81 = 0x64
82 = 0x0c
83 = 0xc4

84 = 0x04 十进制4,后面4个字节,字符串"szdc"
85 = 0x73 s
86 = 0x7a z
87 = 0x64 d
88 = 0x63 c

89 = 0xc0 二进制的 11000000,十进制192,后面不可能跟上192字节长度,所以这里表示name compression
90 = 0x15 十进制21,这里表示跳转到21字节,21字节后面10个字符,字符串 "company"

91 = 0xc0
92 = 0x0c 十进制12,表示第12个字节了,字符串是 "_gc"

93 = 0x00

94 = 0x21
95 = 0x00
96 = 0x01
97 = 0x00
98 = 0x00
99 = 0x02
100 = 0x58
101 = 0x00
102 = 0x0c
103 = 0x00
104 = 0x00
105 = 0x00
106 = 0x64
107 = 0x0c
108 = 0xc4

109 = 0x03 十进制3,字符串是"dc1"
110 = 0x64 字母d
111 = 0x63 字母c
112 = 0x31 数字1

113 = 0xc0
114 = 0x15 十进制21 跳转到第21个字节

115 = 0xc0
116 = 0x0c 十进制12,跳转到第12个字节

117 = 0x00

118 = 0x21
119 = 0x00
120 = 0x01
121 = 0x00
122 = 0x00
123 = 0x02
124 = 0x58
125 = 0x00
126 = 0x0d
127 = 0x00
128 = 0x00
129 = 0x00
130 = 0x64
131 = 0x0c
132 = 0xc4
133 = 0x04
134 = 0x64
135 = 0x63
136 = 0x30
137 = 0x31
138 = 0xc0
139 = 0x15
140 = 0x00
141 = 0x00
142 = 0x00
143 = 0x00
144 = 0x00
145 = 0x00
146 = 0x00
147 = 0x00
148 = 0x00
149 = 0x00
150 = 0x00
151 = 0x00
152 = 0x00
153 = 0x00
154 = 0x00
155 = 0x00
156 = 0x00
157 = 0x00
158 = 0x00
159 = 0x00
160 = 0x00
161 = 0x00
162 = 0x00
163 = 0x00
164 = 0x00
165 = 0x00
166 = 0x00
167 = 0x00

下面是网上查询到的一些qtype的值,表示DNS协议的类型,我们的例子中用的是33.SRV这个值。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

A 1 a host address [RFC1035]
NS 2 an authoritative name server [RFC1035]
MD 3 a mail destination (OBSOLETE - use MX) [RFC1035]
MF 4 a mail forwarder (OBSOLETE - use MX) [RFC1035]
CNAME 5 the canonical name for an alias [RFC1035]
SOA 6 marks the start of a zone of authority [RFC1035]
MB 7 a mailbox domain name (EXPERIMENTAL) [RFC1035]
MG 8 a mail group member (EXPERIMENTAL) [RFC1035]
MR 9 a mail rename domain name (EXPERIMENTAL) [RFC1035]
NULL 10 a null RR (EXPERIMENTAL) [RFC1035]
WKS 11 a well known service description [RFC1035]
PTR 12 a domain name pointer [RFC1035]
HINFO 13 host information [RFC1035]
MINFO 14 mailbox or mail list information [RFC1035]
MX 15 mail exchange [RFC1035]
TXT 16 text strings [RFC1035]
RP 17 for Responsible Person [RFC1183]
AFSDB 18 for AFS Data Base location [RFC1183][RFC5864]
X25 19 for X.25 PSDN address [RFC1183]
ISDN 20 for ISDN address [RFC1183]
RT 21 for Route Through [RFC1183]
NSAP 22 for NSAP address, NSAP style A record [RFC1706]
NSAP-PTR 23 for domain name pointer, NSAP style [RFC1348][RFC1637][RFC1706]
SIG 24 for security signature [RFC4034][RFC3755][RFC2535][RFC2536][RFC2537][RFC2931][RFC3110][RFC3008]
KEY 25 for security key [RFC4034][RFC3755][RFC2535][RFC2536][RFC2537][RFC2539][RFC3008][RFC3110]
PX 26 X.400 mail mapping information [RFC2163]
GPOS 27 Geographical Position [RFC1712]
AAAA 28 IP6 Address [RFC3596]
LOC 29 Location Information [RFC1876]
NXT 30 Next Domain (OBSOLETE) [RFC3755][RFC2535]
EID 31 Endpoint Identifier [Michael_Patton][http://ana-3.lcs.mit.edu/~jnc/nimrod/dns.txt] 1995-06
NIMLOC 32 Nimrod Locator [1][Michael_Patton][http://ana-3.lcs.mit.edu/~jnc/nimrod/dns.txt] 1995-06
SRV 33 Server Selection [1][RFC2782]
ATMA 34 ATM Address [ ATM Forum Technical Committee, "ATM Name System, V2.0", Doc ID: AF-DANS-0152.000, July 2000. Available from and held in escrow by IANA.]
NAPTR 35 Naming Authority Pointer [RFC2915][RFC2168][RFC3403]
KX 36 Key Exchanger [RFC2230]
CERT 37 CERT [RFC4398]
A6 38 A6 (OBSOLETE - use AAAA) [RFC3226][RFC2874][RFC6563]
DNAME 39 DNAME [RFC6672]
SINK 40 SINK [Donald_E_Eastlake][http://tools.ietf.org/html/draft-eastlake-kitchen-sink] 1997-11
OPT 41 OPT [RFC6891][RFC3225]
APL 42 APL [RFC3123]
DS 43 Delegation Signer [RFC4034][RFC3658]
SSHFP 44 SSH Key Fingerprint [RFC4255]
IPSECKEY 45 IPSECKEY [RFC4025]
RRSIG 46 RRSIG [RFC4034][RFC3755]
NSEC 47 NSEC [RFC4034][RFC3755]
DNSKEY 48 DNSKEY [RFC4034][RFC3755]
DHCID 49 DHCID [RFC4701]
NSEC3 50 NSEC3 [RFC5155]
NSEC3PARAM 51 NSEC3PARAM [RFC5155]
TLSA 52 TLSA [RFC6698]
SMIMEA 53 S/MIME cert association [RFC8162] SMIMEA/smimea-completed-template 2015-12-01
Unassigned 54
HIP 55 Host Identity Protocol [RFC8005]
NINFO 56 NINFO [Jim_Reid] NINFO/ninfo-completed-template 2008-01-21
RKEY 57 RKEY [Jim_Reid] RKEY/rkey-completed-template 2008-01-21
TALINK 58 Trust Anchor LINK [Wouter_Wijngaards] TALINK/talink-completed-template 2010-02-17
CDS 59 Child DS [RFC7344] CDS/cds-completed-template 2011-06-06
CDNSKEY 60 DNSKEY(s) the Child wants reflected in DS [RFC7344] 2014-06-16
OPENPGPKEY 61 OpenPGP Key [RFC7929] OPENPGPKEY/openpgpkey-completed-template 2014-08-12
CSYNC 62 Child-To-Parent Synchronization [RFC7477] 2015-01-27
ZONEMD 63 message digest for DNS zone [draft-wessels-dns-zone-digest] ZONEMD/zonemd-completed-template 2018-12-12
Unassigned 64-98
SPF 99 [RFC7208]
UINFO 100 [IANA-Reserved]
UID 101 [IANA-Reserved]
GID 102 [IANA-Reserved]
UNSPEC 103 [IANA-Reserved]
NID 104 [RFC6742] ILNP/nid-completed-template
L32 105 [RFC6742] ILNP/l32-completed-template
L64 106 [RFC6742] ILNP/l64-completed-template
LP 107 [RFC6742] ILNP/lp-completed-template
EUI48 108 an EUI-48 address [RFC7043] EUI48/eui48-completed-template 2013-03-27
EUI64 109 an EUI-64 address [RFC7043] EUI64/eui64-completed-template 2013-03-27
Unassigned 110-248
TKEY 249 Transaction Key [RFC2930]
TSIG 250 Transaction Signature [RFC2845]
IXFR 251 incremental transfer [RFC1995]
AXFR 252 transfer of an entire zone [RFC1035][RFC5936]
MAILB 253 mailbox-related RRs (MB, MG or MR) [RFC1035]
MAILA 254 mail agent RRs (OBSOLETE - see MX) [RFC1035]
* 255 A request for some or all records the server has available [RFC1035][RFC6895][RFC8482]
URI 256 URI [RFC7553] URI/uri-completed-template 2011-02-22
CAA 257 Certification Authority Restriction [RFC6844] CAA/caa-completed-template 2011-04-07
AVC 258 Application Visibility and Control [Wolfgang_Riedel] AVC/avc-completed-template 2016-02-26
DOA 259 Digital Object Architecture [draft-durand-doa-over-dns] DOA/doa-completed-template 2017-08-30
AMTRELAY 260 Automatic Multicast Tunneling Relay [draft-ietf-mboned-driad-amt-discovery] AMTRELAY/amtrelay-completed-template 2019-02-06
Unassigned 261-32767
TA 32768 DNSSEC Trust Authorities [Sam_Weiler][http://cameo.library.cmu.edu/][ Deploying DNSSEC Without a Signed Root. Technical Report 1999-19, Information Networking Institute, Carnegie Mellon University, April 2004.] 2005-12-13
DLV 32769 DNSSEC Lookaside Validation [RFC4431]
Unassigned 32770-65279
Private use 65280-65534
Reserved 65535

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175

0 = 0x8C
1 = 0x5F
2 = 0x81
3 = 0x80
4 = 0x0
5 = 0x1
6 = 0x0
7 = 0x4
8 = 0x0
9 = 0x0
10 = 0x0
11 = 0x0

12 = 0x3 3个长度,字符串是 _gc
13 = 0x5F
14 = 0x67
15 = 0x63

16 = 0x4 4个长度,字符串是 _tcp
17 = 0x5F
18 = 0x74
19 = 0x63
20 = 0x70

21 = 0xA 10个长度, company
22 = 0x62
23 = 0x6C
24 = 0x61
25 = 0x63
26 = 0x6B
27 = 0x73
28 = 0x68
29 = 0x61
30 = 0x72
31 = 0x6B

32 = 0x3 3个长度,com
33 = 0x63
34 = 0x6F
35 = 0x6D

36 = 0x0 0个长度,域名后面会添加个 点
上面的12~36首先解析出来了 DnsName的值"_gc._tcp.company.com."

37 = 0x0
38 = 0x21

39 = 0x0
40 = 0x1

41 = 0xC0
42 = 0xC
43 = 0x0
44 = 0x21
45 = 0x0
46 = 0x1
47 = 0x0
48 = 0x0
49 = 0x2
50 = 0x58
51 = 0x0
52 = 0xC
53 = 0x0
54 = 0x0
55 = 0x0
56 = 0x64
57 = 0xC
58 = 0xC4

59 = 0x3 3个字符,"dc1",长度是0表示结尾,会在域名后加个点。长度在63之内的是后续几个字节。
60 = 0x64
61 = 0x63
62 = 0x31

63 = 0xC0 十进制192,表明后续一个byte是跳转到哪个字节的。长度是0xC0表示跳转的。
64 = 0x15 十进制21,跳转到21字节处,"company" "com",到此解析出来了,0 100 3268 dc1.company.com.

65 = 0xC0
66 = 0xC
67 = 0x0
68 = 0x21
69 = 0x0
70 = 0x1
71 = 0x0
72 = 0x0
73 = 0x2
74 = 0x58
75 = 0x0
76 = 0xD
77 = 0x0
78 = 0x0
79 = 0x0
80 = 0x64
81 = 0xC
82 = 0xC4

83 = 0x4
84 = 0x64
85 = 0x63
86 = 0x30
87 = 0x31

88 = 0xC0
89 = 0x15

90 = 0xC0
91 = 0xC
92 = 0x0
93 = 0x21
94 = 0x0
95 = 0x1
96 = 0x0
97 = 0x0
98 = 0x2
99 = 0x58
100 = 0x0
101 = 0xD
102 = 0x0
103 = 0x0
104 = 0x0
105 = 0x64
106 = 0xC
107 = 0xC4

108 = 0x4 dc02.company.com
109 = 0x64
110 = 0x63
111 = 0x30
112 = 0x32

113 = 0xC0
114 = 0x15

115 = 0xC0
116 = 0xC

117 = 0x0
118 = 0x21

119 = 0x0
120 = 0x1
121 = 0x0
122 = 0x0
123 = 0x2
124 = 0x58
125 = 0x0
126 = 0xD

127 = 0x0
128 = 0x0
129 = 0x0
130 = 0x64
131 = 0xC
132 = 0xC4

133 = 0x4 "szdc.company.com."
134 = 0x73
135 = 0x7A
136 = 0x64
137 = 0x63

138 = 0xC0
139 = 0x15

140 = 0x0
141 = 0x0
142 = 0x0
143 = 0x0
144 = 0x0
145 = 0x0
146 = 0x0
147 = 0x0
148 = 0x0
149 = 0x0