public class ValUtils extends Object
Modifier and Type | Class | Description |
---|---|---|
static class |
ValUtils.NsecProvesNodataResponse |
Container for responses of
nsecProvesNodata(NSECRecord, Name, int) . |
Modifier and Type | Field | Description |
---|---|---|
static String |
DIGEST_PREFERENCE |
Constructor | Description |
---|---|
ValUtils() |
Creates a new instance of this class.
|
Modifier and Type | Method | Description |
---|---|---|
static ResponseClassification |
classifyResponse(SMessage m) |
Given a response, classify ANSWER responses into a subtype.
|
static org.xbill.DNS.Name |
closestEncloser(org.xbill.DNS.Name domain,
org.xbill.DNS.NSECRecord nsec) |
Determines the 'closest encloser' - the name that has the most common
labels between
domain and (Record.getName() or
NSECRecord.getNext() ). |
boolean |
hasSignedNsecs(SMessage message) |
Checks if the authority section of a message contains at least one signed
NSEC or NSEC3 record.
|
void |
init(Properties config) |
Initialize the module.
|
static org.xbill.DNS.Name |
longestCommonName(org.xbill.DNS.Name domain1,
org.xbill.DNS.Name domain2) |
Finds the longest domain name in common with the given name.
|
static boolean |
nsecProvesNameError(org.xbill.DNS.NSECRecord nsec,
org.xbill.DNS.Name qname,
org.xbill.DNS.Name signerName) |
Determine if the given NSEC proves a NameError (NXDOMAIN) for a given
qname.
|
static ValUtils.NsecProvesNodataResponse |
nsecProvesNodata(org.xbill.DNS.NSECRecord nsec,
org.xbill.DNS.Name qname,
int qtype) |
Determine if a NSEC proves the NOERROR/NODATA conditions.
|
org.jitsi.dnssec.validator.JustifiedSecStatus |
nsecProvesNodataDsReply(org.xbill.DNS.Message request,
SMessage response,
SRRset keyRrset) |
Check DS absence.
|
static SecurityStatus |
nsecProvesNoDS(org.xbill.DNS.NSECRecord nsec,
org.xbill.DNS.Name qname) |
Determines whether the given
NSECRecord proves that there is no
DSRecord for qname . |
static boolean |
nsecProvesNoWC(org.xbill.DNS.NSECRecord nsec,
org.xbill.DNS.Name qname,
org.xbill.DNS.Name signerName) |
Determine if a NSEC record proves the non-existence of a wildcard that
could have produced qname.
|
static org.xbill.DNS.Name |
nsecWildcard(org.xbill.DNS.Name domain,
org.xbill.DNS.NSECRecord nsec) |
Gets the closest encloser of
domain prepended with a
wildcard label. |
static org.xbill.DNS.Name |
rrsetWildcard(org.xbill.DNS.RRset rrset) |
Determine by looking at a signed RRset whether or not the RRset name was
the result of a wildcard expansion.
|
static boolean |
strictSubdomain(org.xbill.DNS.Name domain1,
org.xbill.DNS.Name domain2) |
Is the first Name strictly a subdomain of the second name (i.e., below
but not equal to).
|
KeyEntry |
verifyNewDNSKEYs(SRRset dnskeyRrset,
SRRset dsRrset,
long badKeyTTL) |
Given a DS rrset and a DNSKEY rrset, match the DS to a DNSKEY and verify
the DNSKEY rrset with that key.
|
SecurityStatus |
verifySRRset(SRRset rrset,
SRRset keyRrset) |
Given an SRRset that is signed by a DNSKEY found in the key_rrset, verify
it.
|
public static final String DIGEST_PREFERENCE
public void init(Properties config)
DIGEST_PREFERENCE
.config
- The configuration data for this module.public static ResponseClassification classifyResponse(SMessage m)
m
- The response to classify.public KeyEntry verifyNewDNSKEYs(SRRset dnskeyRrset, SRRset dsRrset, long badKeyTTL)
dnskeyRrset
- The DNSKEY rrset to match against. The security status
of this rrset will be updated on a successful verification.dsRrset
- The DS rrset to match with. This rrset must already be
trusted.badKeyTTL
- The TTL [s] for keys determined to be bad.public SecurityStatus verifySRRset(SRRset rrset, SRRset keyRrset)
rrset
- The SRRset to verify.keyRrset
- The set of keys to verify against.public static org.xbill.DNS.Name rrsetWildcard(org.xbill.DNS.RRset rrset)
rrset
- The rrset to chedck.public static org.xbill.DNS.Name longestCommonName(org.xbill.DNS.Name domain1, org.xbill.DNS.Name domain2)
domain1
- The first domain to process.domain2
- The second domain to process.public static boolean strictSubdomain(org.xbill.DNS.Name domain1, org.xbill.DNS.Name domain2)
domain1
- The first domain to process.domain2
- The second domain to process.public static org.xbill.DNS.Name closestEncloser(org.xbill.DNS.Name domain, org.xbill.DNS.NSECRecord nsec)
domain
and (Record.getName()
or
NSECRecord.getNext()
).domain
- The name for which the closest encloser is queried.nsec
- The covering NSECRecord
to check.domain
as defined by
nsec
.public static org.xbill.DNS.Name nsecWildcard(org.xbill.DNS.Name domain, org.xbill.DNS.NSECRecord nsec) throws org.xbill.DNS.NameTooLongException
domain
prepended with a
wildcard label.domain
- The name for which the wildcard closest encloser is
demanded.nsec
- The covering NSEC that defines the encloser.domain
as
defined by nsec
.org.xbill.DNS.NameTooLongException
- If adding the wildcard label to the closest
encloser results in an invalid name.public static boolean nsecProvesNameError(org.xbill.DNS.NSECRecord nsec, org.xbill.DNS.Name qname, org.xbill.DNS.Name signerName)
nsec
- The NSEC to check.qname
- The qname to check against.signerName
- The signer of the NSEC RRset.public static boolean nsecProvesNoWC(org.xbill.DNS.NSECRecord nsec, org.xbill.DNS.Name qname, org.xbill.DNS.Name signerName)
nsec
- The nsec to check.qname
- The qname to check against.signerName
- The signer of the NSEC RRset.public static ValUtils.NsecProvesNodataResponse nsecProvesNodata(org.xbill.DNS.NSECRecord nsec, org.xbill.DNS.Name qname, int qtype)
nsec
- The NSEC to checkqname
- The query name to check against.qtype
- The query type to check against.public org.jitsi.dnssec.validator.JustifiedSecStatus nsecProvesNodataDsReply(org.xbill.DNS.Message request, SMessage response, SRRset keyRrset)
request
- The request that generated this response.response
- The response to validate.keyRrset
- The key that validate the NSECs.public boolean hasSignedNsecs(SMessage message)
message
- The message to inspect.public static SecurityStatus nsecProvesNoDS(org.xbill.DNS.NSECRecord nsec, org.xbill.DNS.Name qname)
NSECRecord
proves that there is no
DSRecord
for qname
.nsec
- The NSEC that should prove the non-existence.qname
- The name for which the prove is made.SecurityStatus.BOGUS
when the NSEC is from the child
domain or indicates that there indeed is a DS record,
SecurityStatus.INSECURE
when there is not even a prove
for a NS record, SecurityStatus.SECURE
when there is no
DS record.Copyright © 2018 jitsi.org. All rights reserved.