Class DnsQueryProtection

java.lang.Object

io.netty.resolver.dns.DnsQueryProtection

final class DnsQueryProtection
extends Object

Defences that make it harder for an off-path attacker to spoof the response of a UDP DNS query on top of the query id and the source port, as recommended by RFC 5452:

• "0x20" randomization of the case of the name in the question (draft-vixie-dnsext-dns0x20)
• client cookies as defined in RFC 7873

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
(package private) static enum	DnsQueryProtection.CookieStatus	The result of checking the cookie in a response.

Field Summary

Fields

Modifier and Type	Field	Description
private static final String	ACE_PREFIX
private final boolean	caseRandomization
private final Set<InetSocketAddress>	cookieServers
private static final int	MAX_COOKIE_SERVERS	Upper bound for the number of nameservers we remember to support cookies.
private final SecureRandom	random

Constructor Summary

Constructors

Constructor	Description
DnsQueryProtection(boolean caseRandomization, boolean cookies)

Method Summary

Modifier and Type	Method	Description
private static DnsQueryProtection.CookieStatus	checkCookie(ByteBuf rdata, byte[] clientCookie)
(package private) static DnsQueryProtection.CookieStatus	checkCookie(DnsResponse response, byte[] clientCookie)	Inspect the COOKIE option of the OPT record of the response.
(package private) void	cookieReceived(InetSocketAddress nameServerAddr)
(package private) boolean	isCaseRandomizationEnabled()
(package private) boolean	isCookieExpected(InetSocketAddress nameServerAddr)	Returns true if the given nameserver has returned a valid cookie before, and so is expected to do so for every response.
(package private) boolean	isCookiesEnabled()
(package private) byte[]	newClientCookie()
(package private) DnsQuestion	randomizeCase(DnsQuestion question)	Returns a copy of the given DnsQuestion in which the case of every ASCII letter was picked at random.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

MAX_COOKIE_SERVERS

private static final int MAX_COOKIE_SERVERS

Upper bound for the number of nameservers we remember to support cookies. Once reached we stop remembering new ones, which means that responses from those will not be rejected if they omit the cookie.

See Also:

• Constant Field Values

ACE_PREFIX

private static final String ACE_PREFIX

See Also:

• Constant Field Values

random

private final SecureRandom random

caseRandomization

private final boolean caseRandomization

cookieServers

private final Set<InetSocketAddress> cookieServers

Constructor Details

DnsQueryProtection

DnsQueryProtection(boolean caseRandomization,
 boolean cookies)

Method Details

isCaseRandomizationEnabled

boolean isCaseRandomizationEnabled()

isCookiesEnabled

boolean isCookiesEnabled()

randomizeCase

DnsQuestion randomizeCase(DnsQuestion question)

Returns a copy of the given DnsQuestion in which the case of every ASCII letter was picked at random.

newClientCookie

byte[] newClientCookie()

isCookieExpected

boolean isCookieExpected(InetSocketAddress nameServerAddr)

Returns true if the given nameserver has returned a valid cookie before, and so is expected to do so for every response.

cookieReceived

void cookieReceived(InetSocketAddress nameServerAddr)

checkCookie

static DnsQueryProtection.CookieStatus checkCookie(DnsResponse response,
 byte[] clientCookie)

Inspect the COOKIE option of the OPT record of the response.

checkCookie

private static DnsQueryProtection.CookieStatus checkCookie(ByteBuf rdata,
 byte[] clientCookie)