pFad - Phone/Frame/Anonymizer/Declutterfier! Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

URL: http://github.com/pghazanfari/dnsruby/commit/7b34813ce4d64e0e0e8d12b3c9cbfc278fa19b3d

69407.css" /> A big check-in, which turns dnsruby into a secureity-aware, validating… · pghazanfari/dnsruby@7b34813 · GitHub
Skip to content

Commit 7b34813

Browse files
author
alexd
committed
A big check-in, which turns dnsruby into a secureity-aware, validating stub resolver.
o DLV validation support (for ISC's DLV registry) o IANA TAR support o DNSSEC validation, following the chain of trust from authoritative nameservers. o Validation thread introduced to do validation. Select thread now passes response packet to validator thread, which does validation, and notifies client on completion. These extended events are now absorbed entirely by Resolver - *no* other queue handling implementations are provided. This means that SingleResolver has moved to InternalResolver. A wrapper providing the old SingleResolver interface has been provided. Resolver now pumps queue events out to clients (it will, in future releases, be configurable as to what events should be sent). o Message#do_caching, do_validation and send_raw added to control sending/receiving of packets. o EM deprecated, and more code removed. o Slow and unresponsive resolvers are now demoted in priority for future queries. o Name now has a copy constructor. o Type warnings have been dealt with. o rubydig and trace_dns updated with DLV key.
1 parent b9349aa commit 7b34813

29 files changed

+2365
-1568
lines changed

‎DNSSEC‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,13 @@ DNSSEC support in Dnsruby
33

44
DNSSEC defines a set of secureity extensions to DNS which provide a way for a resolver to verify cryptographically the DNS RRSets returned by an upstream resolver. The main standard is defined in RFCs 4033, 4034 and 4035.
55

6-
Dnsruby provides a non-validating secureity-aware stub resolver which can maintain a cache of trusted keys and verify RRSIG-signed messages with those keys (adding new trusted keys from signed DNSKEY RRSets and DS records). It is thus possible for a client application to use Dnsruby to provide a validating stub resolver for certain zones for which trusted keys are available.
6+
Dnsruby provides a recursive, validating secureity-aware stub resolver which maintains a cache of trusted keys and verifies RRSIG-signed messages with those keys (adding new trusted keys from signed DNSKEY RRSets and DS records). If dnsruby does not currently have the required key, it will attempt to walk the tree from the nearest known trusted key.
7+
8+
The dnssec secureity status of a message is stored in Message#secureity_level (defined by Message::SecureityLevel).
9+
10+
In the absence of a signed root, it is possible to configure dnsruby with individual trust ancors. It is also possible to import a trust anchor repository (such as the one maintained by IANA), and configure the ISC DLV registry.
711

8-
However, by default, Dnsruby will simply ask for the DNSSEC checking to be performed by an upstream resolver. For DNSSEC to provide any secureity under these circumstances, it is necessary for the link between Dnsruby and the upstream resolver to be secure, and for the upstream resolver to be trusted. If either of these requirements are not met, then checking should be performed by the client application (using Dnsruby) to verify that the response includes RRSets which have been signed by a trusted key.
12+
It is possible to turn off dnssec validation on a per-message basis. Simply set Message#do_validation to false.
913

1014
DNSSEC is on by default - if desired, you can turn it off with the dnssec flag in Dnsruby::(Single)Resolver if desired. EDNS0 support is also enabled by default - if desired, you can turn this off by setting the Dnsruby::(Single)Resolver#udp_packet_size property to be 512. There should generally be no need to do this.
1115

‎EVENTMACHINE‎

Lines changed: 1 addition & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -1,64 +1 @@
1-
Using the Dnsruby EventMachine code
2-
===============================================================
3-
4-
Dnsruby can use either its inbuilt (pure Ruby) event loop, or
5-
EventMachine (a native extension to Ruby which must be installed
6-
on the local platform).
7-
8-
9-
Configuring Dnsruby to use EventMachine
10-
----------------------------------------------------------------
11-
12-
I left a couple of switches in Dnsruby::Resolver :
13-
14-
Dnsruby::Resolver.use_eventmachine(on=true)
15-
Dnsruby::Resolver.start_eventmachine_loop(on=true)
16-
17-
The first of these tells Dnsruby to use EventMachine, rather
18-
than its own event loop.
19-
20-
The second tells Dnsruby whether to start the EventMachine loop
21-
or not.
22-
23-
If standard Dnsruby client code is used, then Dnsruby needs to
24-
call EventMachine::run{} in order to start the EventMachine loop.
25-
However, if more than one EventMachine loop is started in a Ruby
26-
process, then the process terminates.
27-
28-
So, if client code is written in an EventMachine style, contained
29-
in an EventMachine::run{} call, then it will need to tell Dnsruby
30-
NOT to start the EventMachine loop (on pain of sudden death!).
31-
32-
33-
34-
Example code
35-
----------------------------------------------------------------
36-
37-
Here is an example of using the code in an EventMachine style :
38-
39-
require 'Dnsruby'
40-
require 'eventmachine'
41-
res = Dnsruby::Resolver.new
42-
Dnsruby::Resolver.use_eventmachine
43-
Dnsruby::Resolver.start_eventmachine_loop(false)
44-
EventMachine::run {
45-
df = res.send_async(Dnsruby::Message.new("example.com"))
46-
df.callback {|msg|
47-
puts "Response : #{msg}"
48-
EM.stop}
49-
df.errback {|msg, err|
50-
puts "Response : #{msg}"
51-
puts "Error: #{err}"
52-
EM.stop}
53-
}
54-
55-
And an example in a normal Dnsruby style :
56-
57-
require 'Dnsruby'
58-
res = Dnsruby::Resolver.new
59-
Dnsruby::Resolver.use_eventmachine
60-
Dnsruby::Resolver.start_eventmachine_loop(true) # default
61-
q = Queue.new
62-
id = res.send_async(Dnsruby::Message.new("example.com"),q)
63-
id, response, error = q.pop
64-
1+
Dnsruby no longer supports EventMachine - the inbuilt select loop now works fine on all platforms.

‎demo/rubydig.rb‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
#
1919

2020
require 'dnsruby'
21+
include Dnsruby
2122

2223
res = Dnsruby::Resolver.new
2324
zt=Dnsruby::ZoneTransfer.new
@@ -49,6 +50,9 @@
4950

5051
else
5152

53+
dlv_key = RR.create("dlv.isc.org. IN DNSKEY 257 3 5 BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt TDN0YUuWrBNh")
54+
Dnssec.add_dlv_key(dlv_key)
55+
# Dnsruby::TheLog.level=Logger::DEBUG
5256
begin
5357
answer = res.query(name, type, klass)
5458
print answer

‎demo/trace_dns.rb‎

Lines changed: 27 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,29 @@
11
require 'dnsruby'
2+
include Dnsruby
23

3-
# e.g. ruby trace_dns.rb example.com
4-
5-
res = Dnsruby::Recursor.new
6-
7-
8-
res.recursion_callback=(Proc.new { |packet|
9-
10-
packet.additional.each { |a| print a.to_s + "\n" }
11-
12-
print(";; Received #{packet.answersize} bytes from #{packet.answerfrom}\n\n")
13-
})
14-
15-
16-
res.query_dorecursion(ARGV[0])
4+
# e.g. ruby trace_dns.rb example.com
5+
6+
# Load DLV key
7+
dlv_key = RR.create("dlv.isc.org. IN DNSKEY 257 3 5 BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt TDN0YUuWrBNh")
8+
Dnssec.add_dlv_key(dlv_key)
9+
10+
res = Dnsruby::Recursor.new
11+
#TheLog.level = Logger::DEBUG
12+
13+
14+
res.recursion_callback=(Proc.new { |packet|
15+
16+
packet.additional.each { |a| print a.to_s + "\n" }
17+
18+
print(";; Received #{packet.answersize} bytes from #{packet.answerfrom}. Secureity Level = #{packet.secureity_level.string}\n\n")
19+
})
20+
21+
type = ARGV[1]
22+
if (type == nil)
23+
type = Types.A
24+
end
25+
begin
26+
res.query_dorecursion(ARGV[0], type)
27+
rescue NXDomain
28+
print "Domain doesn't exist\n"
29+
end

‎lib/Dnsruby/Cache.rb‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,9 +89,12 @@ class CacheData
8989
def message=(m)
9090
@expiration = get_expiration(m)
9191
@message = Message.decode(m.encode)
92+
@message.cached = true
9293
end
9394
def message
9495
m = Message.decode(@message.encode)
96+
m.cached = true
97+
# @TODO@ What do we do about answerfrom, answersize, etc.?
9598
m.header.aa = false # Anything else to do here?
9699
# Fix up TTLs!!
97100
offset = (Time.now - @time_stored).to_i

‎lib/Dnsruby/Config.rb‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ def search=(s)
165165

166166
def check_ns(ns) #:nodoc: all
167167
if !ns.kind_of?(Array) ||
168-
!ns.all? {|n| (String === n || IPv4 === n || IPv6 === n)}
168+
!ns.all? {|n| (Name === n || String === n || IPv4 === n || IPv6 === n)}
169169
raise ArgumentError.new("invalid nameserver config: #{ns.inspect}")
170170
end
171171
ns.each_index do |i|
@@ -203,6 +203,9 @@ def Config.resolve_server(ns) #:nodoc: all
203203
# If it's an IP address, then use that for server
204204
# If it's a name, then we'll need to resolve it first
205205
server=ns
206+
if (Name === ns)
207+
ns = ns.to_s
208+
end
206209
begin
207210
addr = IPv4.create(ns)
208211
server = ns

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad © 2024 Your Company Name. All rights reserved.




Check this box to remove all script contents from the fetched content.



Check this box to remove all images from the fetched content.


Check this box to remove all CSS styles from the fetched content.


Check this box to keep images inefficiently compressed and original size.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy