Package org.xbill.DNS.dnssec

Class DnsSecVerifier

java.lang.Object

org.xbill.DNS.dnssec.DnsSecVerifier

final class DnsSecVerifier
extends Object

A class for performing basic DNSSEC verification. The DNSJAVA package contains a similar class. This is a reimplementation that allows us to have finer control over the validation process.

Since:

3.5

Field Summary

Fields

Modifier and Type	Field	Description
static final String	MAX_VALIDATE_RRSIGS_PROPERTY
private int	maxValidateRRsigs
private final ValUtils	valUtils

Constructor Summary

Constructors

Constructor	Description
DnsSecVerifier(ValUtils valUtils)

Method Summary

Modifier and Type	Method	Description
private List<DNSKEYRecord>	findKey(RRset dnskeyRrset, RRSIGRecord signature)	Find the matching DNSKEY(s) to an RRSIG within a DNSKEY rrset.
void	init(Properties config)	Initialize the module.
JustifiedSecStatus	verify(SRRset rrset, KeyEntry keyRrset, Instant date)	Verifies an RRset.
JustifiedSecStatus	verify(RRset rrset, DNSKEYRecord dnskey, Instant date)	Verify an RRset against a single DNSKEY.
private JustifiedSecStatus	verifySignature(SRRset rrset, RRSIGRecord sigrec, KeyEntry keyRrset, Instant date)	Verify an RRset against a particular signature.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

MAX_VALIDATE_RRSIGS_PROPERTY

public static final String MAX_VALIDATE_RRSIGS_PROPERTY

See Also:

• Constant Field Values

valUtils

private final ValUtils valUtils

maxValidateRRsigs

private int maxValidateRRsigs

Constructor Details

DnsSecVerifier

public DnsSecVerifier(ValUtils valUtils)

Method Details

init

public void init(Properties config)

Initialize the module. The recognized configuration values are:

• "dnsjava.dnssec.max_validate_rrsigs"

Parameters:

config - The configuration data for this module.

findKey

private List<DNSKEYRecord> findKey(RRset dnskeyRrset,
 RRSIGRecord signature)

Find the matching DNSKEY(s) to an RRSIG within a DNSKEY rrset. Normally this will only return one DNSKEY. It can return more than one, since KeyID/Footprints are not guaranteed to be unique.

Parameters:

dnskeyRrset - The DNSKEY rrset to search.

signature - The RRSIG to match against.

Returns:

A List that contains one or more DNSKEYRecord objects; empty if a matching DNSKEY could not be found.

verifySignature

private JustifiedSecStatus verifySignature(SRRset rrset,
 RRSIGRecord sigrec,
 KeyEntry keyRrset,
 Instant date)

Verify an RRset against a particular signature.

Parameters:

rrset - The RRset to verify.

sigrec - The signature record that signs the RRset.

keyRrset - The keys used to create the signature record.

date - The date against which to verify the signature.

Returns:

SecurityStatus.SECURE if the signature verified, SecurityStatus.BOGUS if it did not verify (for any reason), and SecurityStatus.UNCHECKED if verification could not be completed (usually because the public key was not available).

verify

public JustifiedSecStatus verify(SRRset rrset,
 KeyEntry keyRrset,
 Instant date)

Verifies an RRset. This routine does not modify the RRset. The RRset is presumed to be verifiable, and the correct DNSKEY rrset is presumed to have been found.

Parameters:

rrset - The RRset to verify.

keyRrset - The keys to verify the signatures in the RRset to check.

date - The date against which to verify the rrset.

Returns:

SecurityStatus.SECURE if the RRset verified positively, SecurityStatus.BOGUS otherwise.

verify

public JustifiedSecStatus verify(RRset rrset,
 DNSKEYRecord dnskey,
 Instant date)

Verify an RRset against a single DNSKEY. Use this when you must be certain that an RRset signed and verifies with a particular DNSKEY (as opposed to a particular DNSKEY rrset).

Parameters:

rrset - The rrset to verify.

dnskey - The DNSKEY to verify with.

date - The date against which to verify the rrset.

Returns:

SecurityStatus.SECURE if the RRset verified, SecurityStatus.BOGUS otherwise.