Package | Description |
---|---|
org.xbill.DNS.dnssec |
Modifier and Type | Class and Description |
---|---|
(package private) class |
KeyEntry
DNSKEY cache entry for a given
Name , with or without actual keys. |
Modifier and Type | Field and Description |
---|---|
(package private) SRRset |
FindKeyState.dsRRset
The (initial) DS RRset for the following DNSKEY search and validate phase.
|
Modifier and Type | Field and Description |
---|---|
private java.util.Map<java.lang.String,SRRset> |
TrustAnchorStore.map |
Modifier and Type | Method and Description |
---|---|
SRRset |
TrustAnchorStore.find(Name name,
int dclass)
Gets the closest trusted key for the given name or
null if no match is found. |
SRRset |
SMessage.findAnswerRRset(Name qname,
int qtype,
int qclass)
Find an "answer" RRset.
|
SRRset |
SMessage.findRRset(Name name,
int type,
int dclass,
int section)
Find a specific (S)RRset in a given section.
|
private SRRset |
TrustAnchorStore.lookup(java.lang.String key) |
Modifier and Type | Method and Description |
---|---|
java.util.List<SRRset> |
SMessage.getSectionRRsets(int section)
Gets signed RRsets for the queried section.
|
java.util.List<SRRset> |
SMessage.getSectionRRsets(int section,
int qtype)
Gets signed RRsets for the queried section.
|
java.util.Collection<SRRset> |
TrustAnchorStore.items()
Gets all trust anchors currently in use.
|
Modifier and Type | Method and Description |
---|---|
private void |
SMessage.addRRset(SRRset srrset,
int section) |
private KeyEntry |
ValidatingResolver.dsReponseToKeForNodata(SMessage response,
Message request,
SRRset keyRrset)
Given a DS response, the DS request, and the current key rrset, validate the DS response for
the NODATA case, returning a KeyEntry.
|
private KeyEntry |
ValidatingResolver.dsResponseToKE(SMessage response,
Message request,
SRRset keyRrset)
Given a DS response, the DS request, and the current key rrset, validate the DS response,
returning a KeyEntry.
|
(package private) int |
ValUtils.favoriteDSDigestID(SRRset dsset)
Gets the digest ID for the favorite (best) algorithm that is support in a given DS set.
|
private KeyEntry |
ValUtils.getKeyEntry(SRRset dnskeyRrset,
java.time.Instant date,
DSRecord ds,
DNSKEYRecord dnskey) |
static KeyEntry |
KeyEntry.newKeyEntry(SRRset rrset)
Creates a new key entry from actual DNSKEYs.
|
static boolean |
ValUtils.nsecProvesNameError(SRRset set,
NSECRecord nsec,
Name qname)
Determine if the given NSEC proves a NameError (NXDOMAIN) for a given qname.
|
static ValUtils.NsecProvesNodataResponse |
ValUtils.nsecProvesNodata(SRRset set,
NSECRecord nsec,
Name qname,
int qtype)
Determine if a NSEC proves the NOERROR/NODATA conditions.
|
JustifiedSecStatus |
ValUtils.nsecProvesNodataDsReply(Message request,
SMessage response,
SRRset keyRrset,
java.time.Instant date)
Check DS absence.
|
static boolean |
ValUtils.nsecProvesNoWC(SRRset set,
NSECRecord nsec,
Name qname)
Determine if a NSEC record proves the non-existence of a wildcard that could have produced
qname.
|
static Name |
ValUtils.nsecWildcard(Name domain,
SRRset set,
NSECRecord nsec)
Gets the closest encloser of
domain prepended with a wildcard label. |
private java.util.concurrent.CompletionStage<KeyEntry> |
ValidatingResolver.prepareFindKey(SRRset rrset) |
static void |
ValUtils.setCanonicalNsecOwner(SRRset set,
RRSIGRecord sig)
Set the owner name of NSEC RRsets to the canonical name, i.e.
|
void |
TrustAnchorStore.store(SRRset rrset)
Stores the given RRset as known trusted keys.
|
private boolean |
NSEC3ValUtils.validIterations(SRRset nsec,
KeyCache keyCache) |
JustifiedSecStatus |
DnsSecVerifier.verify(SRRset rrset,
RRset keyRrset,
java.time.Instant date)
Verifies an RRset.
|
KeyEntry |
ValUtils.verifyNewDNSKEYs(SRRset dnskeyRrset,
SRRset dsRrset,
long badKeyTTL,
java.time.Instant date)
Given a DS rrset and a DNSKEY rrset, match the DS to a DNSKEY and verify the DNSKEY rrset with
that key.
|
private JustifiedSecStatus |
DnsSecVerifier.verifySignature(SRRset rrset,
RRSIGRecord sigrec,
RRset keyRrset,
java.time.Instant date)
Verify an RRset against a particular signature.
|
JustifiedSecStatus |
ValUtils.verifySRRset(SRRset rrset,
SRRset keyRrset,
java.time.Instant date)
Given an SRRset that is signed by a DNSKEY found in the key_rrset, verify it.
|
Modifier and Type | Method and Description |
---|---|
boolean |
NSEC3ValUtils.allNSEC3sIgnoreable(java.util.List<SRRset> nsec3s,
KeyCache dnskeyRrset)
Determine if all of the NSEC3s in a response are legally ignoreable (i.e., their presence
should lead to an INSECURE result).
|
private NSEC3ValUtils.CEResponse |
NSEC3ValUtils.findClosestEncloser(Name name,
Name zonename,
java.util.List<SRRset> nsec3s)
Given a name and a list of NSEC3s, find the candidate closest encloser.
|
private NSEC3Record |
NSEC3ValUtils.findCoveringNSEC3(Name name,
Name zonename,
java.util.List<SRRset> nsec3s)
Given a pre-hashed name, find a covering NSEC3 from among a list of NSEC3s.
|
private NSEC3Record |
NSEC3ValUtils.findMatchingNSEC3(Name name,
Name zonename,
java.util.List<SRRset> nsec3s)
Find the NSEC3Record that matches a hash of a name.
|
private NSEC3ValUtils.CEResponse |
NSEC3ValUtils.proveClosestEncloser(Name qname,
Name zonename,
java.util.List<SRRset> nsec3s)
Given a List of nsec3 RRs, find and prove the closest encloser to qname.
|
SecurityStatus |
NSEC3ValUtils.proveNameError(java.util.List<SRRset> nsec3s,
Name qname,
Name zonename)
Determine if the set of NSEC3 records provided with a response prove NAME ERROR.
|
JustifiedSecStatus |
NSEC3ValUtils.proveNodata(java.util.List<SRRset> nsec3s,
Name qname,
int qtype,
Name zonename)
Determine if the NSEC3s provided in a response prove the NOERROR/NODATA status.
|
SecurityStatus |
NSEC3ValUtils.proveNoDS(java.util.List<SRRset> nsec3s,
Name qname,
Name zonename)
Prove that a DS response either had no DS, or wasn't a delegation point.
|
SecurityStatus |
NSEC3ValUtils.proveWildcard(java.util.List<SRRset> nsec3s,
Name qname,
Name zonename,
Name wildcard)
Prove that a positive wildcard match was appropriate (no direct match RRset).
|
void |
NSEC3ValUtils.stripUnknownAlgNSEC3s(java.util.List<SRRset> nsec3s)
Remove all records whose algorithm is unknown.
|
private java.util.concurrent.CompletionStage<java.lang.Boolean> |
ValidatingResolver.validatePositiveResponseRecursive(SMessage response,
java.util.Map<Name,Name> wcs,
java.util.List<SRRset> nsec3s,
java.util.List<SRRset> nsecs,
int[] sections,
java.util.concurrent.atomic.AtomicInteger sectionIndex,
java.util.concurrent.atomic.AtomicInteger setIndex) |
private java.util.concurrent.CompletionStage<java.lang.Boolean> |
ValidatingResolver.validatePositiveResponseRecursive(SMessage response,
java.util.Map<Name,Name> wcs,
java.util.List<SRRset> nsec3s,
java.util.List<SRRset> nsecs,
int[] sections,
java.util.concurrent.atomic.AtomicInteger sectionIndex,
java.util.concurrent.atomic.AtomicInteger setIndex) |
Constructor and Description |
---|
KeyEntry(SRRset rrset)
Create a new, positive key entry.
|
SRRset(SRRset r)
Create a new SRRset from an existing SRRset.
|