Class Dnsruby::Dnssec
In: lib/Dnsruby/dnssec.rb
Parent: Object

RFC4033, section 7

  "There is one more step that a security-aware stub resolver can take
  if, for whatever reason, it is not able to establish a useful trust
  relationship with the recursive name servers that it uses: it can
  perform its own signature validation by setting the Checking Disabled
  (CD) bit in its query messages.  A validating stub resolver is thus
  able to treat the DNSSEC signatures as trust relationships between
  the zone administrators and the stub resolver itself. "

Dnsruby is configured to validate responses by default. However, it is not configured with any trusted keys by default. Applications may use the verify() method to perform verification with of RRSets of Messages with given keys. Alternatively, trusted keys may be added to this class (either directly, or by loading the IANA TAR or the DLV ISC ZSK). Validation will then be performed from these keys (or the DLV registry, if configured). Negative and positive responses are validation.

Messages are tagged with the current security_level (Message::SecurityLevel). UNCHECKED means Dnsruby has not attempted to validate the response. BOGUS means the response has been checked, and is bogus. INSECURE means the response has been validated to be insecure (e.g. in an unsigned zone) SECURE means that the response has been verfied to be correct.

Several validators are provided, with each maintaining its own cache of trusted keys. If validators are added or removed, the caches of the other validators are not affected.

Methods

Classes and Modules

Class Dnsruby::Dnssec::ValidationPolicy

Public Class methods

Add a trusted Key Signing Key for the ISC DLV registry.

Add a new trust anchor

Add the trusted key with the given expiration time

Wipes the cache of trusted keys

This method overrides the system default resolver configuration for validation If default_resolver is set, then it will be used to follow the chain of trust. If it is not, then the default system resolver will be used (unless do_validation_with_recursor is set.

This method defines the choice of Resolver or Recursor, when the validator is checking responses. If set to true, then a Recursor will be used to query for the DNSSEC records. Otherwise, the default system resolver will be used.

Load the IANA TAR. THIS METHOD IS NOT SECURE!!!

Remove the trusted key

Returns true for secure/insecure, false otherwise This method will set the security_level on msg to the appropriate value. Could be : secure, insecure, bogus or indeterminate If an error is encountered during verification, then the thrown exception will define the error.

[Validate]