Class: Dnsruby::Dnssec

Inherits:
Object
  • Object
show all
Defined in:
lib/Dnsruby/dnssec.rb

Overview

RFC4033, section 7

"There is one more step that a security-aware stub resolver can take
if, for whatever reason, it is not able to establish a useful trust
relationship with the recursive name servers that it uses: it can
perform its own signature validation by setting the Checking Disabled
(CD) bit in its query messages.  A validating stub resolver is thus
able to treat the DNSSEC signatures as trust relationships between
the zone administrators and the stub resolver itself. "

Dnsruby is configured to validate responses by default. However, it is not configured with any trusted keys by default. Applications may use the verify() method to perform verification with of RRSets of Messages with given keys. Alternatively, trusted keys may be added to this class (either directly, or by loading the IANA TAR or the DLV ISC ZSK). Validation will then be performed from these keys (or the DLV registry, if configured). Negative and positive responses are validation.

Messages are tagged with the current security_level (Message::SecurityLevel). UNCHECKED means Dnsruby has not attempted to validate the response. BOGUS means the response has been checked, and is bogus. INSECURE means the response has been validated to be insecure (e.g. in an unsigned zone) SECURE means that the response has been verfied to be correct.

Several validators are provided, with each maintaining its own cache of trusted keys. If validators are added or removed, the caches of the other validators are not affected.

Defined Under Namespace

Classes: ValidationPolicy

Constant Summary collapse

@@validation_policy = 
ValidationPolicy::LOCAL_ANCHORS_THEN_ROOT
@@root_verifier = 
SingleVerifier.new(SingleVerifier::VerifierType::ROOT)
@@dlv_verifier = 
SingleVerifier.new(SingleVerifier::VerifierType::DLV)
@@anchor_verifier =

@TODO@ Could add a new one of these for each anchor.

SingleVerifier.new(SingleVerifier::VerifierType::ANCHOR)
@@do_validation_with_recursor =

Many nameservers don’t handle DNSSEC correctly yet

true
@@default_resolver = 
nil

Class Method Summary collapse

Class Method Details

.add_dlv_key(dlv_key) ⇒ Object

Add a trusted Key Signing Key for the ISC DLV registry.



88
89
90
 
# File 'lib/Dnsruby/dnssec.rb', line 88

def Dnssec.add_dlv_key(dlv_key)
  @@dlv_verifier.add_dlv_key(dlv_key)
end

.add_trust_anchor(t) ⇒ Object

Add a new trust anchor



92
93
94
95
 
# File 'lib/Dnsruby/dnssec.rb', line 92

def Dnssec.add_trust_anchor(t)
  # @TODO@ Create a new verifier?
  @@anchor_verifier.add_trust_anchor(t)
end

.add_trust_anchor_with_expiration(k, expiration) ⇒ Object

Add the trusted key with the given expiration time



97
98
99
100
 
# File 'lib/Dnsruby/dnssec.rb', line 97

def self.add_trust_anchor_with_expiration(k, expiration)
  # Create a new verifier?
  @@anchor_verifier.add_trust_anchor_with_expiration(k, expiration)
end

.anchor_verifier ⇒ Object 



290
291
292
 
# File 'lib/Dnsruby/dnssec.rb', line 290

def self.anchor_verifier
  return @@anchor_verifier
end

.clear_trust_anchors ⇒ Object

Wipes the cache of trusted keys



106
107
108
 
# File 'lib/Dnsruby/dnssec.rb', line 106

def self.clear_trust_anchors
  @@anchor_verifier.clear_trust_anchors
end

.clear_trusted_keys ⇒ Object 



114
115
116
117
118
 
# File 'lib/Dnsruby/dnssec.rb', line 114

def self.clear_trusted_keys
  [@@anchor_verifier, @@root_verifier, @@dlv_verifier].each {|v|
    v.clear_trusted_keys
  }
end

.default_resolver ⇒ Object 



170
171
172
 
# File 'lib/Dnsruby/dnssec.rb', line 170

def self.default_resolver
  return @@default_resolver
end

.default_resolver=(res) ⇒ Object

This method overrides the system default resolver configuration for validation If default_resolver is set, then it will be used to follow the chain of trust. If it is not, then the default system resolver will be used (unless do_validation_with_recursor is set.



167
168
169
 
# File 'lib/Dnsruby/dnssec.rb', line 167

def self.default_resolver=(res)
  @@default_resolver = res
end

.dlv_verifier ⇒ Object 



293
294
295
 
# File 'lib/Dnsruby/dnssec.rb', line 293

def self.dlv_verifier
  return @@dlv_verifier
end

.do_validation_with_recursor(on) ⇒ Object

This method defines the choice of Resolver or Recursor, when the validator is checking responses. If set to true, then a Recursor will be used to query for the DNSSEC records. Otherwise, the default system resolver will be used.



157
158
159
 
# File 'lib/Dnsruby/dnssec.rb', line 157

def self.do_validation_with_recursor(on)
  @@do_validation_with_recursor = on
end

.do_validation_with_recursor? ⇒ Boolean

Returns:

  • (Boolean) 


160
161
162
 
# File 'lib/Dnsruby/dnssec.rb', line 160

def self.do_validation_with_recursor?
  return @@do_validation_with_recursor
end

.load_itar ⇒ Object

Load the IANA TAR. THIS METHOD IS NOT SECURE!!!



121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
 
# File 'lib/Dnsruby/dnssec.rb', line 121

def self.load_itar
  # @TODO@ THIS IS VERY INSECURE!! WRITE THIS PROPERLY!!
  # Should really check the signatures here to make sure the keys are good!
  Net::FTP::open("ftp.iana.org") { |ftp|
    ftp.("anonymous")
    ftp.passive = true
    ftp.chdir("/itar")
    lastname=nil
    ftp.gettextfile("anchors.mf") {|line|
      next if (line.strip.length == 0)
      first = line[0]
      if (first.class == String)
        first = first.getbyte(0) # Ruby 1.9
      end
#            print "Reading ITAR : #{line}, first : #{first}\n"
      next if (first==59) # ";")
      if (line.strip=~(/^DS /) || line.strip=~(/^DNSKEY /))
        line = lastname.to_s + ((lastname.absolute?)?".":"") + " " + line
      end
      ds = RR.create(line)
      if ((ds.type == Types.DS) || (ds.type == Types.DNSKEY))
        #            assert(ds.name.absolute?)
        Dnssec.add_trust_anchor(ds)
      end
      lastname = ds.name
    }
  }
end

.remove_trust_anchor(t) ⇒ Object

Remove the trusted key



102
103
104
 
# File 'lib/Dnsruby/dnssec.rb', line 102

def Dnssec.remove_trust_anchor(t)
  @@anchor_verifier.remove_trust_anchor(t)
end

.root_verifier ⇒ Object 



296
297
298
 
# File 'lib/Dnsruby/dnssec.rb', line 296

def self.root_verifier
  return @@root_verifier
end

.trust_anchors ⇒ Object 



110
111
112
 
# File 'lib/Dnsruby/dnssec.rb', line 110

def self.trust_anchors
  return @@anchor_verifier.trust_anchors
end

.try_validation(last_level, last_error, last_error_level, proc, msg, query) ⇒ Object

:nodoc:



253
254
255
256
257
258
259
260
261
262
263
264
 
# File 'lib/Dnsruby/dnssec.rb', line 253

def self.try_validation(last_level, last_error, last_error_level, proc, msg, query)   # :nodoc:
  begin
    proc.call(msg, query)
    last_level = Message::SecurityLevel.new([msg.security_level.code, last_level].max)
  rescue VerifyError => e
    if (last_error_level < last_level)
      last_error = e.to_s
      last_error_level = last_level
    end
  end
  return last_level, last_error, last_error_level
end

.validate(msg) ⇒ Object

Returns true for secure/insecure, false otherwise This method will set the security_level on msg to the appropriate value. Could be : secure, insecure, bogus or indeterminate If an error is encountered during verification, then the thrown exception will define the error.



179
180
181
182
183
 
# File 'lib/Dnsruby/dnssec.rb', line 179

def self.validate(msg)
  query = Message.new()
  query.header.cd=true
  return self.validate_with_query(query, msg)
end

.validate_with_anchors(msg, query) ⇒ Object 



266
267
268
 
# File 'lib/Dnsruby/dnssec.rb', line 266

def self.validate_with_anchors(msg, query)
  return @@anchor_verifier.validate(msg, query)
end

.validate_with_dlv(msg, query) ⇒ Object 



274
275
276
 
# File 'lib/Dnsruby/dnssec.rb', line 274

def self.validate_with_dlv(msg, query)
  return @@dlv_verifier.validate(msg, query)
end

.validate_with_query(query, msg) ⇒ Object 



185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
 
# File 'lib/Dnsruby/dnssec.rb', line 185

def self.validate_with_query(query, msg)
  if (!msg)
    return false
  end
  # First, just check there is something to validate!
  found_sigs = false
  msg.each_resource {|rr|
    if (rr.type == Types.RRSIG)
      found_sigs = true
    end
  }
  if (found_sigs)
    begin
      if (verify(msg))
        msg.security_level = Message::SecurityLevel.SECURE
        return true
      end
    rescue VerifyError
    end
  end

  # SHOULD ALWAYS VERIFY DNSSEC-SIGNED RESPONSES?
  # Yes - if a trust anchor is configured. Otherwise, act on CD bit (in query)
  TheLog.debug("Checking whether to validate, query.cd = #{query.header.cd}")
  if (((@@validation_policy > ValidationPolicy::ALWAYS_ROOT_ONLY) && (self.trust_anchors().length > 0)) ||
        # Check query here, and validate if CD is true
      (query.header.cd == true))
    TheLog.debug("Starting validation")

    # Validate!
    # Need to think about trapping/storing exceptions and security_levels here
    last_error = ""
    last_level = Message::SecurityLevel.BOGUS
    last_error_level = Message::SecurityLevel.BOGUS
    if (@@validation_policy == ValidationPolicy::ALWAYS_LOCAL_ANCHORS_ONLY)
      last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level,
        Proc.new{|m, q| validate_with_anchors(m, q)}, msg, query)
    elsif (@@validation_policy == ValidationPolicy::ALWAYS_ROOT_ONLY)
      last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level,
        Proc.new{|m, q| validate_with_root(m, q)}, msg, query)
    elsif (@@validation_policy == ValidationPolicy::LOCAL_ANCHORS_THEN_ROOT)
      last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level, 
        Proc.new{|m, q| validate_with_anchors(m, q)}, msg, query)
      if (last_level != Message::SecurityLevel.SECURE)
        last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level,
          Proc.new{|m, q| validate_with_root(m, q)}, msg, query)
      end
    elsif (@@validation_policy == ValidationPolicy::ROOT_THEN_LOCAL_ANCHORS)
      last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level,
        Proc.new{|m, q| validate_with_root(m, q)}, msg, query)
      if (last_level != Message::SecurityLevel.SECURE)
        last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level,
          Proc.new{|m, q| validate_with_anchors(m, q)}, msg, query)
      end
    end
    if (last_level != Message::SecurityLevel.SECURE)
      last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level, 
        Proc.new{|m, q| validate_with_dlv(m, q)}, msg, query)
    end
    # Set the message security level!
    msg.security_level = last_level
    raise VerifyError.new(last_error) if (last_level < 0)
    return (msg.security_level.code > Message::SecurityLevel::UNCHECKED)
  end
  msg.security_level = Message::SecurityLevel.UNCHECKED
  return true
end

.validate_with_root(msg, query) ⇒ Object 



270
271
272
 
# File 'lib/Dnsruby/dnssec.rb', line 270

def self.validate_with_root(msg, query)
  return @@root_verifier.validate(msg, query)
end

.validation_policy ⇒ Object 



74
75
76
 
# File 'lib/Dnsruby/dnssec.rb', line 74

def Dnssec.validation_policy
  @@validation_policy
end

.validation_policy=(p) ⇒ Object 



68
69
70
71
72
73
 
# File 'lib/Dnsruby/dnssec.rb', line 68

def Dnssec.validation_policy=(p)
  if ((p >= ALWAYS_ROOT_ONY) && (p <= ALWAYS_LOCAL_ANCHORS))
    @@validation_policy = p
    # @TODO@ Should we be clearing the trusted keys now?
  end
end

.verify(msg) ⇒ Object 



278
279
280
281
282
283
284
285
286
287
288
 
# File 'lib/Dnsruby/dnssec.rb', line 278

def self.verify(msg)
  begin
    return true if @@anchor_verifier.verify(msg)
  rescue VerifyError
    begin
      return true if @@root_verifier.verify(msg)
    rescue VerifyError
      return true if @@dlv_verifier.verify(msg) # Will carry error to client
    end
  end
end

.verify_rrset(rrset, keys = nil) ⇒ Object 



303
304
305
306
307
 
# File 'lib/Dnsruby/dnssec.rb', line 303

def self.verify_rrset(rrset, keys = nil)
  return ((@@anchor_verifier.verify_rrset(rrset, keys) ||
        @@root_verifier.verify_rrset(rrset, keys) ||
        @@dlv_verifier.verify_rrset(rrset, keys)))
end