Package io.netty.resolver.dns

Class DnsQueryProtection

java.lang.Object

io.netty.resolver.dns.DnsQueryProtection

final class DnsQueryProtection
extends java.lang.Object

Defences that make it harder for an off-path attacker to spoof the response of a UDP DNS query on top of the query id and the source port, as recommended by RFC 5452:

• "0x20" randomization of the case of the name in the question (draft-vixie-dnsext-dns0x20)
• client cookies as defined in RFC 7873

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
(package private) static class	DnsQueryProtection.CookieStatus	The result of checking the cookie in a response.

Field Summary

Fields

Modifier and Type	Field	Description
private static java.lang.String	ACE_PREFIX
private boolean	caseRandomization
private java.util.Set<java.net.InetSocketAddress>	cookieServers
private static int	MAX_COOKIE_SERVERS	Upper bound for the number of nameservers we remember to support cookies.
private java.security.SecureRandom	random

Constructor Summary

Constructors

Constructor	Description
DnsQueryProtection(boolean caseRandomization, boolean cookies)

Method Summary

Modifier and Type	Method	Description
private static DnsQueryProtection.CookieStatus	checkCookie(ByteBuf rdata, byte[] clientCookie)
(package private) static DnsQueryProtection.CookieStatus	checkCookie(DnsResponse response, byte[] clientCookie)	Inspect the COOKIE option of the OPT record of the response.
(package private) void	cookieReceived(java.net.InetSocketAddress nameServerAddr)
(package private) boolean	isCaseRandomizationEnabled()
(package private) boolean	isCookieExpected(java.net.InetSocketAddress nameServerAddr)	Returns true if the given nameserver has returned a valid cookie before, and so is expected to do so for every response.
(package private) boolean	isCookiesEnabled()
(package private) byte[]	newClientCookie()
(package private) DnsQuestion	randomizeCase(DnsQuestion question)	Returns a copy of the given DnsQuestion in which the case of every ASCII letter was picked at random.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

MAX_COOKIE_SERVERS

private static final int MAX_COOKIE_SERVERS

Upper bound for the number of nameservers we remember to support cookies. Once reached we stop remembering new ones, which means that responses from those will not be rejected if they omit the cookie.

See Also:

Constant Field Values

ACE_PREFIX

private static final java.lang.String ACE_PREFIX

See Also:

Constant Field Values

random

private final java.security.SecureRandom random

caseRandomization

private final boolean caseRandomization

cookieServers

private final java.util.Set<java.net.InetSocketAddress> cookieServers

Constructor Detail

DnsQueryProtection

DnsQueryProtection(boolean caseRandomization,
                   boolean cookies)

Method Detail

isCaseRandomizationEnabled

boolean isCaseRandomizationEnabled()

isCookiesEnabled

boolean isCookiesEnabled()

randomizeCase

DnsQuestion randomizeCase(DnsQuestion question)

Returns a copy of the given DnsQuestion in which the case of every ASCII letter was picked at random.

newClientCookie

byte[] newClientCookie()

isCookieExpected

boolean isCookieExpected(java.net.InetSocketAddress nameServerAddr)

Returns true if the given nameserver has returned a valid cookie before, and so is expected to do so for every response.

cookieReceived

void cookieReceived(java.net.InetSocketAddress nameServerAddr)

checkCookie

static DnsQueryProtection.CookieStatus checkCookie(DnsResponse response,
                                                   byte[] clientCookie)

Inspect the COOKIE option of the OPT record of the response.

checkCookie

private static DnsQueryProtection.CookieStatus checkCookie(ByteBuf rdata,
                                                           byte[] clientCookie)