Class: Dnsruby::Dnssec

### Home Classes Methods

### In Files

- lib/dnsruby/dnssec.rb

### Parent

Object

### Namespace

- CLASS Dnsruby::Dnssec::ValidationPolicy

### Methods

- ::add_dlv_key
- ::add_trust_anchor
- ::add_trust_anchor_with_expiration
- ::anchor_verifier
- ::clear_trust_anchors
- ::clear_trusted_keys
- ::default_resolver
- ::default_resolver=
- ::dlv_verifier
- ::do_validation_with_recursor
- ::do_validation_with_recursor?
- ::no_keys?
- ::remove_trust_anchor
- ::reset
- ::root_verifier
- ::set_hints
- ::trust_anchors
- ::validate
- ::validate_with_anchors
- ::validate_with_dlv
- ::validate_with_query
- ::validate_with_root
- ::validation_policy
- ::validation_policy=
- ::verify
- ::verify_rrset

### Files

- DNSSEC
- EVENTMACHINE
- EXAMPLES

### Class/Module Index

Quicksearch

- Dnsruby
- Dnsruby::Algorithms
- Dnsruby::BitMapping
- Dnsruby::Bitmap
- Dnsruby::Classes
- Dnsruby::CodeMapper
- Dnsruby::Config
- Dnsruby::DNS
- Dnsruby::DecodeError
- Dnsruby::Dnssec
- Dnsruby::Dnssec::ValidationPolicy
- Dnsruby::EncodeError
- Dnsruby::ExtendedRCode
- Dnsruby::FormErr
- Dnsruby::Header
- Dnsruby::Hosts
- Dnsruby::IPv4
- Dnsruby::IPv6
- Dnsruby::Message
- Dnsruby::Message::SecurityLevel
- Dnsruby::MetaTypes
- Dnsruby::Modes
- Dnsruby::NXDomain
- Dnsruby::NXRRSet
- Dnsruby::Name
- Dnsruby::Name::Label
- Dnsruby::NotAuth
- Dnsruby::NotImp
- Dnsruby::NotZone
- Dnsruby::Nsec3HashAlgorithms
- Dnsruby::OpCode
- Dnsruby::OtherResolvError
- Dnsruby::QTypes
- Dnsruby::Question
- Dnsruby::RCode
- Dnsruby::RR
- Dnsruby::RR::ANY
- Dnsruby::RR::CERT
- Dnsruby::RR::CERT::CertificateTypes
- Dnsruby::RR::CNAME
- Dnsruby::RR::DHCID
- Dnsruby::RR::DLV
- Dnsruby::RR::DNAME
- Dnsruby::RR::DNSKEY
- Dnsruby::RR::DS
- Dnsruby::RR::DS::DigestTypes
- Dnsruby::RR::DomainName
- Dnsruby::RR::GPOS
- Dnsruby::RR::Generic
- Dnsruby::RR::HINFO
- Dnsruby::RR::HIP
- Dnsruby::RR::IN
- Dnsruby::RR::IN::A
- Dnsruby::RR::IN::AAAA
- Dnsruby::RR::IN::AFSDB
- Dnsruby::RR::IN::PX
- Dnsruby::RR::IN::SRV
- Dnsruby::RR::IN::WKS
- Dnsruby::RR::IPSECKEY
- Dnsruby::RR::ISDN
- Dnsruby::RR::KX
- Dnsruby::RR::LOC
- Dnsruby::RR::MB
- Dnsruby::RR::MG
- Dnsruby::RR::MINFO
- Dnsruby::RR::MR
- Dnsruby::RR::MX
- Dnsruby::RR::NAPTR
- Dnsruby::RR::NS
- Dnsruby::RR::NSAP
- Dnsruby::RR::NSEC
- Dnsruby::RR::NSEC3
- Dnsruby::RR::NSEC3PARAM
- Dnsruby::RR::NXT
- Dnsruby::RR::NXT::NxtTypes
- Dnsruby::RR::NXT::TypeBitmap
- Dnsruby::RR::OPT
- Dnsruby::RR::PTR
- Dnsruby::RR::RP
- Dnsruby::RR::RRSIG
- Dnsruby::RR::RT
- Dnsruby::RR::SOA
- Dnsruby::RR::SPF
- Dnsruby::RR::SSHFP
- Dnsruby::RR::SSHFP::Algorithms
- Dnsruby::RR::SSHFP::FpTypes
- Dnsruby::RR::TKEY
- Dnsruby::RR::TSIG
- Dnsruby::RR::TXT
- Dnsruby::RR::X25
- Dnsruby::RRSet
- Dnsruby::Recursor
- Dnsruby::Refused
- Dnsruby::Resolv
- Dnsruby::ResolvError
- Dnsruby::ResolvTimeout
- Dnsruby::Resolver
- Dnsruby::Resolver::EventType
- Dnsruby::Section
- Dnsruby::SelectThread
- Dnsruby::ServFail
- Dnsruby::SingleResolver
- Dnsruby::SocketEofResolvError
- Dnsruby::TheLog
- Dnsruby::TsigError
- Dnsruby::TsigNotSignedResponseError
- Dnsruby::Types
- Dnsruby::Update
- Dnsruby::VerifyError
- Dnsruby::YXDomain
- Dnsruby::YXRRSet
- Dnsruby::ZoneReader
- Dnsruby::ZoneReader::ParseException
- Dnsruby::ZoneSerialError
- Dnsruby::ZoneTransfer
- Dnsruby::ZoneTransfer::Delta
- Base32
- Object

No matching classes.

# Dnsruby::Dnssec

RFC4033, section 7

    "There is one more step that a security-aware stub resolver can take
    if, for whatever reason, it is not able to establish a useful trust
    relationship with the recursive name servers that it uses: it can
    perform its own signature validation by setting the Checking Disabled
    (CD) bit in its query messages.  A validating stub resolver is thus
    able to treat the DNSSEC signatures as trust relationships between
    the zone administrators and the stub resolver itself. "

Dnsruby is configured to validate responses by default. However, it is not configured with any trusted keys by default. Applications may use the verify() method to perform verification with of RRSets of Messages with given keys. Alternatively, trusted keys may be added to this class (either directly, or by loading the IANA TAR or the DLV ISC ZSK). Validation will then be performed from these keys (or the DLV registry, if configured). Negative and positive responses are validation.

Messages are tagged with the current security_level (Message::SecurityLevel). UNCHECKED means Dnsruby has not attempted to validate the response. BOGUS means the response has been checked, and is bogus. INSECURE means the response has been validated to be insecure (e.g. in an unsigned zone) SECURE means that the response has been verfied to be correct.

Several validators are provided, with each maintaining its own cache of trusted keys. If validators are added or removed, the caches of the other validators are not affected.

### Public Class Methods

add_dlv_key(dlv_key) click to toggle source

Add a trusted Key Signing Key for the ISC DLV registry.

    # File lib/dnsruby/dnssec.rb, line 92
    def Dnssec.add_dlv_key(dlv_key)
      @@dlv_verifier.add_dlv_key(dlv_key)
    end

add_trust_anchor(t) click to toggle source

Add a new trust anchor

    # File lib/dnsruby/dnssec.rb, line 96
    def Dnssec.add_trust_anchor(t)
      #  @TODO@ Create a new verifier?
      @@anchor_verifier.add_trust_anchor(t)
    end

add_trust_anchor_with_expiration(k, expiration) click to toggle source

Add the trusted key with the given expiration time

    # File lib/dnsruby/dnssec.rb, line 101
    def self.add_trust_anchor_with_expiration(k, expiration)
      #  Create a new verifier?
      @@anchor_verifier.add_trust_anchor_with_expiration(k, expiration)
    end

anchor_verifier() click to toggle source

    # File lib/dnsruby/dnssec.rb, line 294
    def self.anchor_verifier
      return @@anchor_verifier
    end

clear_trust_anchors() click to toggle source

Wipes the cache of trusted keys

    # File lib/dnsruby/dnssec.rb, line 110
    def self.clear_trust_anchors
      @@anchor_verifier.clear_trust_anchors
    end

clear_trusted_keys() click to toggle source

    # File lib/dnsruby/dnssec.rb, line 118
    def self.clear_trusted_keys
      [@@anchor_verifier, @@root_verifier, @@dlv_verifier].each {|v|
        v.clear_trusted_keys
      }
    end

default_resolver() click to toggle source

    # File lib/dnsruby/dnssec.rb, line 172
    def self.default_resolver
      return @@default_resolver
    end

default_resolver=(res) click to toggle source

This method overrides the system default resolver configuration for validation If default_resolver is set, then it will be used to follow the chain of trust. If it is not, then the default system resolver will be used (unless do_validation_with_recursor is set.

    # File lib/dnsruby/dnssec.rb, line 169
    def self.default_resolver=(res)
      @@default_resolver = res
    end

dlv_verifier() click to toggle source

    # File lib/dnsruby/dnssec.rb, line 297
    def self.dlv_verifier
      return @@dlv_verifier
    end

do_validation_with_recursor(on) click to toggle source

This method defines the choice of Resolver or Recursor, when the validator is checking responses. If set to true, then a Recursor will be used to query for the DNSSEC records. Otherwise, the default system resolver will be used.

    # File lib/dnsruby/dnssec.rb, line 159
    def self.do_validation_with_recursor(on)
      @@do_validation_with_recursor = on
    end

do_validation_with_recursor?() click to toggle source

    # File lib/dnsruby/dnssec.rb, line 162
    def self.do_validation_with_recursor?
      return @@do_validation_with_recursor
    end

no_keys?() click to toggle source

    # File lib/dnsruby/dnssec.rb, line 142
    def self.no_keys?
      no_keys = true
      [@@anchor_verifier, @@root_verifier, @@dlv_verifier].each {|v|
        if (v.trusted_keys.length() > 0 ||
              v.trust_anchors.length() > 0)
          no_keys = false
        end
      }
      return no_keys
    end

remove_trust_anchor(t) click to toggle source

Remove the trusted key

    # File lib/dnsruby/dnssec.rb, line 106
    def Dnssec.remove_trust_anchor(t)
      @@anchor_verifier.remove_trust_anchor(t)
    end

reset() click to toggle source

    # File lib/dnsruby/dnssec.rb, line 124
    def self.reset
      @@validation_policy = ValidationPolicy::LOCAL_ANCHORS_THEN_ROOT
      @@root_verifier = SingleVerifier.new(SingleVerifier::VerifierType::ROOT)
      @@root_verifier.add_root_ds(@@root_key)

      @@dlv_verifier = SingleVerifier.new(SingleVerifier::VerifierType::DLV)

      #  @TODO@ Could add a new one of these for each anchor.
      @@anchor_verifier = SingleVerifier.new(SingleVerifier::VerifierType::ANCHOR)
      @@do_validation_with_recursor = true # Many nameservers don't handle DNSSEC correctly yet
      @@default_resolver = Resolver.new
    end

root_verifier() click to toggle source

    # File lib/dnsruby/dnssec.rb, line 300
    def self.root_verifier
      return @@root_verifier
    end

set_hints(hints) click to toggle source

    # File lib/dnsruby/dnssec.rb, line 137
    def self.set_hints(hints)
      @@root_verifier.set_hints(hints)
      @@anchor_verifier.set_hints(hints)
    end

trust_anchors() click to toggle source

    # File lib/dnsruby/dnssec.rb, line 114
    def self.trust_anchors
      return @@anchor_verifier.trust_anchors
    end

validate(msg) click to toggle source

Returns true for secure/insecure, false otherwise This method will set the security_level on msg to the appropriate value. Could be : secure, insecure, bogus or indeterminate If an error is encountered during verification, then the thrown exception will define the error.

    # File lib/dnsruby/dnssec.rb, line 181
    def self.validate(msg)
      query = Message.new()
      query.header.cd=true
      return self.validate_with_query(query, msg)
    end

validate_with_anchors(msg, query) click to toggle source

    # File lib/dnsruby/dnssec.rb, line 270
    def self.validate_with_anchors(msg, query)
      return @@anchor_verifier.validate(msg, query)
    end

validate_with_dlv(msg, query) click to toggle source

    # File lib/dnsruby/dnssec.rb, line 278
    def self.validate_with_dlv(msg, query)
      return @@dlv_verifier.validate(msg, query)
    end

validate_with_query(query, msg) click to toggle source

    # File lib/dnsruby/dnssec.rb, line 187
    def self.validate_with_query(query, msg)
      if (!msg)
        return false
      end
      #  First, just check there is something to validate!
      found_sigs = false
      msg.each_resource {|rr|
        if (rr.type == Types::RRSIG)
          found_sigs = true
        end
      }
      if (found_sigs)
        begin
          if (verify(msg))
            msg.security_level = Message::SecurityLevel.SECURE
            return true
          end
        rescue VerifyError => e
          msg.security_error = e
        end
      end

      #  SHOULD ALWAYS VERIFY DNSSEC-SIGNED RESPONSES?
      #  Yes - if a trust anchor is configured. Otherwise, act on CD bit (in query)
      TheLog.debug("Checking whether to validate, query.cd = #{query.header.cd}")
      if (((@@validation_policy > ValidationPolicy::ALWAYS_ROOT_ONLY) && (self.trust_anchors().length > 0)) ||
            #  Check query here, and validate if CD is true
          ((query.header.cd == true))) # && (query.do_validation)))
        TheLog.debug("Starting validation")

        #  Validate!
        #  Need to think about trapping/storing exceptions and security_levels here
        last_error = ""
        last_level = Message::SecurityLevel.BOGUS
        last_error_level = Message::SecurityLevel.BOGUS
        if (@@validation_policy == ValidationPolicy::ALWAYS_LOCAL_ANCHORS_ONLY)
          last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level,
            Proc.new{|m, q| validate_with_anchors(m, q)}, msg, query)
        elsif (@@validation_policy == ValidationPolicy::ALWAYS_ROOT_ONLY)
          last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level,
            Proc.new{|m, q| validate_with_root(m, q)}, msg, query)
        elsif (@@validation_policy == ValidationPolicy::LOCAL_ANCHORS_THEN_ROOT)
          last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level,
            Proc.new{|m, q| validate_with_anchors(m, q)}, msg, query)
          if (last_level != Message::SecurityLevel.SECURE)
            last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level,
              Proc.new{|m, q| validate_with_root(m, q)}, msg, query)
          end
        elsif (@@validation_policy == ValidationPolicy::ROOT_THEN_LOCAL_ANCHORS)
          last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level,
            Proc.new{|m, q| validate_with_root(m, q)}, msg, query)
          if (last_level != Message::SecurityLevel.SECURE)
            last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level,
              Proc.new{|m, q| validate_with_anchors(m, q)}, msg, query)
          end
        end
        if (last_level != Message::SecurityLevel.SECURE)
          last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level,
            Proc.new{|m, q| validate_with_dlv(m, q)}, msg, query)
        end
        #  Set the message security level!
        msg.security_level = last_level
        msg.security_error = last_error
        raise VerifyError.new(last_error) if (last_level < 0)
        return (msg.security_level.code > Message::SecurityLevel::UNCHECKED)
      end
      msg.security_level = Message::SecurityLevel.UNCHECKED
      return true
    end

validate_with_root(msg, query) click to toggle source

    # File lib/dnsruby/dnssec.rb, line 274
    def self.validate_with_root(msg, query)
      return @@root_verifier.validate(msg, query)
    end

validation_policy() click to toggle source

    # File lib/dnsruby/dnssec.rb, line 74
    def Dnssec.validation_policy
      @@validation_policy
    end

validation_policy=(p) click to toggle source

    # File lib/dnsruby/dnssec.rb, line 68
    def Dnssec.validation_policy=(p)
      if ((p >= ALWAYS_ROOT_ONY) && (p <= ALWAYS_LOCAL_ANCHORS))
        @@validation_policy = p
        #  @TODO@ Should we be clearing the trusted keys now?
      end
    end

verify(msg, keys=nil) click to toggle source

    # File lib/dnsruby/dnssec.rb, line 282
    def self.verify(msg, keys=nil)
      begin
        return true if @@anchor_verifier.verify(msg, keys)
      rescue VerifyError
        begin
          return true if @@root_verifier.verify(msg, keys)
        rescue VerifyError
          return true if @@dlv_verifier.verify(msg, keys) # Will carry error to client
        end
      end
    end

verify_rrset(rrset, keys = nil) click to toggle source

    # File lib/dnsruby/dnssec.rb, line 307
    def self.verify_rrset(rrset, keys = nil)
      return ((@@anchor_verifier.verify_rrset(rrset, keys) ||
            @@root_verifier.verify_rrset(rrset, keys) ||
            @@dlv_verifier.verify_rrset(rrset, keys)))
    end

[Validate]

Generated with the Darkfish Rdoc Generator 2.