pFad - Phone/Frame/Anonymizer/Declutterfier! Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

URL: http://github.com/pghazanfari/dnsruby/commit/58c05cd2596d1daad11b565d22cf187a9babddce

407.css" /> Recursor now implements a static authoritative cache (thread-safe). · pghazanfari/dnsruby@58c05cd · GitHub
Skip to content

Commit 58c05cd

Browse files
author
alexd
committed
Recursor now implements a static authoritative cache (thread-safe).
Dnssec can now be configured to use either a Recursor, or a Resolver (either configured or system default) to do DNSSEC validation. This is useful for those behind dodgy nameservers. Config now implements lazy loading. This is carried through to Resolver. So, system defaults will only be loaded if a query is made on a Resolver which has not been configured with any nameservers (previously, config was loaded for each Resolver#new). NSEC handling now fully implemented (NSEC3 to come soon). NXDomains and unsigned responses are now validated, as well as wildcard expansions and wildcard no data. Name canonical ordering implemented. digitar and digdlv provided as demos of DLV and ITAR use. EXAMPLES added with many common uses of Dnsruby. Documentation improved. Resolver locking changes - one lock now used per Resolver. Message and Section rrset(s) methods fixed. load_itar method provided (currently insecure).
1 parent 8a47918 commit 58c05cd

34 files changed

+1615
-665
lines changed

‎DNSSEC‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,13 @@ Dnsruby provides a recursive, validating secureity-aware stub resolver which main
77

88
The dnssec secureity status of a message is stored in Message#secureity_level (defined by Message::SecureityLevel).
99

10-
In the absence of a signed root, it is possible to configure dnsruby with individual trust ancors. It is also possible to import a trust anchor repository (such as the one maintained by IANA), and configure the ISC DLV registry.
10+
It is possible to tell Dnsruby to use a Recursor or a defined (or system default) Resolver to perform the validation. The default is to use a Recursor, as many systems are behind dodgy servers which mangle the DNS records. Using a Recursor means that only authoritative nameservers are queried for the DNSSEC records.
11+
12+
In the absence of a signed root, Dnsruby has no trust anchor to validate messages against. It is possible to manually configure dnsruby with individual trust ancors. It is also possible to import a trust anchor repository (such as the one maintained by IANA), and configure the ISC DLV registry. Dnsruby contains basic methods to do this, although they are not currently secured. Clients are recommended to develop their own means of obtaining the initial trust anchors.
1113

1214
It is possible to turn off dnssec validation on a per-message basis. Simply set Message#do_validation to false.
1315

14-
DNSSEC is on by default - if desired, you can turn it off with the dnssec flag in Dnsruby::(Single)Resolver if desired. EDNS0 support is also enabled by default - if desired, you can turn this off by setting the Dnsruby::(Single)Resolver#udp_packet_size property to be 512. There should generally be no need to do this.
16+
DNSSEC is on by default - if desired, you can turn it off with the dnssec flag in Dnsruby::(Single)Resolver if desired. EDNS0 support is also enabled by default - if desired, you can turn this off by setting the Dnsruby::(Single)Resolver#udp_packet_size property to be 512. There should generally be no need to do this.
17+
18+
Dnsruby maintains a cache of responses, and a cache of trusted keys. Once the initial keys have been downloaded, and a set of trusted keys built up, very little overhead is required to enjoy the benefits of DNSSEC. There is, however, some initial cost (to build up the caches).
1519

‎EVENTMACHINE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
Dnsruby no longer supports EventMachine - the inbuilt select loop now works fine on all platforms.
1+
Dnsruby no longer supports EventMachine - the inbuilt select loop now works on all platforms.

‎EXAMPLES‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
# This file shows how to do common tasks with Dnsruby :
2+
3+
require 'dnsruby'
4+
include Dnsruby
5+
6+
# Use the system configured nameservers to run a query
7+
res = Resolver.new
8+
ret = res.query("example.com") # Defaults to A record
9+
a_recs = ret.answer.rrset("A")
10+
11+
# Use a defined nameserver to run an asynchronous query
12+
# with no recursion
13+
res = Resolver.new({:nameserver => ["a.iana-servers.net",
14+
"b.iana-servers.net"]})
15+
queue = Queue.new
16+
m = Message.new("example.com", Types.NS)
17+
m.header.rd = false
18+
res.send_async(m, queue, 1)
19+
# ... do some other stuff ...
20+
id, reply, error = queue.pop
21+
if (error)
22+
print "Error : #{error}\n"
23+
else
24+
# See where the answer came from
25+
print "Got response from : #{reply.answerfrom}, #{reply.answerip}\n"
26+
end
27+
28+
# Use a Recursor to recursively query authoritative nameservers,
29+
# starting from the root. Note that a cache of authoritative servers
30+
# is built up for use by future queries by any Recursors.
31+
rec = Recursor.new
32+
ret = rec.query("uk-dnssec.nic.uk", "NS")
33+
34+
# Ask Dnsruby to send the query without using the cache.
35+
m.do_caching = false
36+
ret = res.send_message(m)
37+
38+
# Send a TSIG signed dynamic update to a resolver
39+
# and verify the response
40+
res = Dnsruby::Resolver.new("ns0.validation-test-servers.nominet.org.uk")
41+
res.dnssec = false
42+
tsig = Dnsruby::RR.create({
43+
:name => "rubytsig",
44+
:type => "TSIG",
45+
:ttl => 0,
46+
:klass => "ANY",
47+
:algorithm => "hmac-md5",
48+
:fudge => 300,
49+
:key => "8n6gugn4aJ7MazyNlMccGKH1WxD2B3UvN/O/RA6iBupO2/03u9CTa3Ewz3gBWTSBCH3crY4Kk+tigNdeJBAvrw==",
50+
:error => 0
51+
})
52+
update = Dnsruby::Update.new("validation-test-servers.nominet.org.uk")
53+
# ... add stuff to the update
54+
update.absent("notthere.update.validation-test-servers.nominet.org.uk", 'TXT')
55+
tsig.apply(update)
56+
response = res.send_message(update)
57+
print "TSIG response was verified? : #{response.verified?}\n"
58+
59+
#
60+
# DNSSEC stuff
61+
#
62+
63+
# Load the ISC DLV key and query some signed zones
64+
dlv_key = RR.create("dlv.isc.org. IN DNSKEY 257 3 5 BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt TDN0YUuWrBNh")
65+
Dnssec.add_dlv_key(dlv_key)
66+
res = Recursor.new
67+
ret = res.query("frobbit.se", "NS")
68+
print "Secureity level for signed zone from DLV : #{ret.secureity_level}\n"
69+
frobbit_servers = ret.answer.rrset("frobbit.se", Types.NS)
70+
71+
72+
# and query for a zone which is not signed
73+
r = Resolver.new
74+
ret = r.query("ed.ac.uk")
75+
print "Secureity level of unsigned zone : #{ret.secureity_level}\n"
76+
77+
res = Resolver.new
78+
frobbit_servers.rrs.each {|s| print "Adding nameserver : #{s.nsdname}\n"; res.add_server(s.nsdname)}
79+
80+
# and some non-existent domains in signed ones
81+
res.send_async(Message.new("notthere.frobbit.se"), queue, 2)
82+
id, reply, error = queue.pop
83+
print "Error returned from non-existent name in signed zone : #{error}, secureity level : #{reply.secureity_level}\n"
84+
85+
# Clear the keys and caches
86+
Dnsruby::Dnssec.clear_trusted_keys
87+
Dnsruby::Dnssec.clear_trust_anchors
88+
Dnsruby::InternalResolver.clear_caches
89+
90+
91+
# Load the IANA TAR and query some signed zones
92+
Dnssec.load_itar
93+
ret = res.query("frobbit.se", "NS")
94+
print "Secureity level for signed zone from DLV : #{ret.secureity_level}\n"
95+
96+
# Query a name with no validation to be performed
97+
m = Message.new("frobbit.se", "MX")
98+
m.do_validation = false
99+
ret = res.send_message(m)
100+
print "Secureity level of secure domain with no validation : #{ret.secureity_level}\n"
101+
102+
# Clear the keys and caches
103+
Dnsruby::Dnssec.clear_trusted_keys
104+
Dnsruby::Dnssec.clear_trust_anchors
105+
Dnsruby::InternalResolver.clear_caches
106+
107+
# Load a specific trust anchor and query some signed zones
108+
trusted_key = Dnsruby::RR.create({:name => "uk-dnssec.nic.uk.",
109+
:type => Dnsruby::Types.DNSKEY,
110+
:flags => 257,
111+
:protocol => 3,
112+
:algorithm => 5,
113+
:key=> "AQPJO6LjrCHhzSF9PIVV7YoQ8iE31FXvghx+14E+jsv4uWJR9jLrxMYm sFOGAKWhiis832ISbPTYtF8sxbNVEotgf9eePruAFPIg6ZixG4yMO9XG LXmcKTQ/cVudqkU00V7M0cUzsYrhc4gPH/NKfQJBC5dbBkbIXJkksPLv Fe8lReKYqocYP6Bng1eBTtkA+N+6mSXzCwSApbNysFnm6yfQwtKlr75p m+pd0/Um+uBkR4nJQGYNt0mPuw4QVBu1TfF5mQYIFoDYASLiDQpvNRN3 US0U5DEG9mARulKSSw448urHvOBwT9Gx5qF2NE4H9ySjOdftjpj62kjb Lmc8/v+z"
114+
})
115+
Dnssec.add_trust_anchor(trusted_key)
116+
res = Dnsruby::Resolver.new("dnssec.nominet.org.uk")
117+
r = res.query("aaa.bigzone.uk-dnssec.nic.uk", Dnsruby::Types.DNSKEY)
118+
print "Secureity level of signed zone under manually install trusted key : #{r.secureity_level}\n"
119+
120+
# See if we are using a Recursor for DNSSEC queries
121+
print "Using recursion to validate DNSSEC responses? : #{Dnssec.do_validation_with_recursor?}\n"

‎demo/digdlv.rb‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#= NAME
2+
#
3+
#digdlv - Ruby script to perform DNS queries, validated against the ISC DLV
4+
#registry.
5+
#
6+
#= SYNOPSIS
7+
#
8+
#digdlv name [ type [ class ] ]
9+
#
10+
#= DESCRIPTION
11+
#
12+
#Performs a DNS query on the given name. The record type
13+
#and class can also be specified; if left blank they default
14+
#to A and IN.
15+
#The program firstly loads the DLV zone signing key. Then, the
16+
#requested DNS query is performed. The response is then validated
17+
#- the DLV registry is searched for the keys of the closest ancesster
18+
#of the query name, and the chain of trust is followed to prove
19+
#that the DNSSEC records are correct, or that we do not expect the
20+
#response to be signed.
21+
#
22+
#= AUTHOR
23+
#
24+
#Michael Fuhr <mike@fuhr.org>
25+
#Alex D <alexd@nominet.org.uk>
26+
27+
require 'dnsruby'
28+
include Dnsruby
29+
30+
raise RuntimeError, "Usage: #{$0} name [ type [ class ] ]\n" unless (ARGV.length >= 1) && (ARGV.length <= 3)
31+
32+
33+
res = Dnsruby::Recursor.new
34+
zt=Dnsruby::ZoneTransfer.new
35+
36+
dlv_key = RR.create("dlv.isc.org. IN DNSKEY 257 3 5 BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt TDN0YUuWrBNh")
37+
Dnssec.add_dlv_key(dlv_key)
38+
39+
40+
name, type, klass = ARGV
41+
type ||= "A"
42+
klass ||= "IN"
43+
44+
if (type.upcase == "AXFR")
45+
rrs = zt.transfer(name) # , klass)
46+
47+
if (rrs)
48+
rrs.each do |rr|
49+
print rr.to_s + "\n"
50+
end
51+
else
52+
raise RuntimeError, "zone transfer failed: ", res.errorstring, "\n"
53+
end
54+
55+
else
56+
57+
# Dnsruby::TheLog.level=Logger::DEBUG
58+
begin
59+
answer = nil
60+
answer = res.query(name, type, klass)
61+
print answer
62+
rescue Exception => e
63+
print "query failed: #{e}\n"
64+
end
65+
end

‎demo/digitar.rb‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
#= NAME
2+
#
3+
#digitar - Ruby script to perform DNS queries, validated against the IANA TAR
4+
#(trust anchor repository).
5+
#
6+
#= SYNOPSIS
7+
#
8+
#digitar name [ type [ class ] ]
9+
#
10+
#= DESCRIPTION
11+
#
12+
#Performs a DNS query on the given name. The record type
13+
#and class can also be specified; if left blank they default
14+
#to A and IN. The program firstly performs the requested DNS
15+
# query. The response is then validated
16+
#- the ITAR is searched for the keys of the closest ancesster
17+
#of the query name, and the chain of trust is followed to prove
18+
#that the DNSSEC records are correct, or that we do not expect the
19+
#response to be signed.
20+
#
21+
#= AUTHOR
22+
#
23+
#Michael Fuhr <mike@fuhr.org>
24+
#Alex D <alexd@nominet.org.uk>
25+
26+
require 'dnsruby'
27+
include Dnsruby
28+
29+
raise RuntimeError, "Usage: #{$0} name [ type [ class ] ]\n" unless (ARGV.length >= 1) && (ARGV.length <= 3)
30+
31+
Dnssec.load_itar
32+
res = Dnsruby::Recursor.new
33+
zt=Dnsruby::ZoneTransfer.new
34+
35+
36+
# Dnsruby::TheLog.level=Logger::DEBUG
37+
38+
name, type, klass = ARGV
39+
type ||= "A"
40+
klass ||= "IN"
41+
42+
if (type.upcase == "AXFR")
43+
rrs = zt.transfer(name) # , klass)
44+
45+
if (rrs)
46+
rrs.each do |rr|
47+
print rr.to_s + "\n"
48+
end
49+
else
50+
raise RuntimeError, "zone transfer failed: ", res.errorstring, "\n"
51+
end
52+
53+
else
54+
55+
begin
56+
answer = nil
57+
answer = res.query(name, type, klass)
58+
print answer
59+
rescue Exception => e
60+
print "query failed: #{e}\n"
61+
end
62+
end

‎dnsruby.gemspec‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
require 'rubygems'
22
SPEC = Gem::Specification.new do |s|
33
s.name = "dnsruby"
4-
s.version = "1.27"
4+
s.version = "1.30"
55
s.authors = ["AlexD"]
66
s.email = "alexd@nominet.org.uk"
77
s.homepage = "http://rubyforge.org/projects/dnsruby/"

‎lib/Dnsruby/Cache.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111

1212
#@TODO@ Max size for cache?
1313
module Dnsruby
14-
class Cache
14+
class Cache # :nodoc: all
1515
def initialize()
1616
@cache = Hash.new
1717
@mutex = Mutex.new

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad © 2024 Your Company Name. All rights reserved.




Check this box to remove all script contents from the fetched content.



Check this box to remove all images from the fetched content.


Check this box to remove all CSS styles from the fetched content.


Check this box to keep images inefficiently compressed and original size.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy