Package org.microproxy.dns

Class DnssecHostResolver

java.lang.Object

org.microproxy.dns.DnssecHostResolver

All Implemented Interfaces:

HostResolver

public final class DnssecHostResolver
extends Object
implements HostResolver

A HostResolver that validates answers with DNSSEC, the replacement for LittleProxy's dnssec4j-based DnsSecServerResolver.

Queries go to a recursive resolver (by default those in /etc/resolv.conf) with the DO and CD bits set; every answer is validated locally against the root zone trust anchors (KSK-2017 and KSK-2024). With the default DnssecHostResolver.Policy.REJECT_BOGUS, names in signed zones resolve only with valid signatures, names in provably unsigned zones resolve normally, and anything else fails with DnssecValidationException. Network failures also fail resolution: there is no silent fallback to unvalidated lookups.

IP literals and localhost are returned without a lookup. Answers, zone keys and delegation facts are cached for their TTL, up to an hour.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	DnssecHostResolver.Builder	Configures a DnssecHostResolver.
static enum	DnssecHostResolver.Policy	What to accept.
static final record	DnssecHostResolver.Resolution	The result of a lookup.

Field Summary

Fields

Modifier and Type	Field	Description
static final List<String>	ROOT_TRUST_ANCHORS	IANA root zone trust anchors (https://data.iana.org/root-anchors/root-anchors.xml).

Constructor Summary

Constructors

Constructor	Description
DnssecHostResolver()	Uses the system's resolvers, the IANA root anchors and DnssecHostResolver.Policy.REJECT_BOGUS.

Method Summary

Modifier and Type	Method	Description
static DnssecHostResolver.Builder	builder()	Starts a builder with the default settings.
DnssecHostResolver.Resolution	lookup(String host)	Resolves host to its IPv4 addresses, or IPv6 addresses if it has none.
InetSocketAddress	resolve(String host, int port)	Resolves a host name and associates it with the requested port.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

ROOT_TRUST_ANCHORS

public static final List<String> ROOT_TRUST_ANCHORS

IANA root zone trust anchors (https://data.iana.org/root-anchors/root-anchors.xml).

Constructor Details

DnssecHostResolver

public DnssecHostResolver()

Uses the system's resolvers, the IANA root anchors and DnssecHostResolver.Policy.REJECT_BOGUS.

Method Details

builder

public static DnssecHostResolver.Builder builder()

Starts a builder with the default settings.

Returns:

a new builder with default settings

resolve

public InetSocketAddress resolve(String host,
 int port)
                          throws UnknownHostException

Description copied from interface: HostResolver

Resolves a host name and associates it with the requested port.

Specified by:

resolve in interface HostResolver

Parameters:

host - the destination host name

port - the destination port

Returns:

the resolved destination socket address

Throws:

UnknownHostException - if the host cannot be resolved

lookup

public DnssecHostResolver.Resolution lookup(String host)
                                     throws UnknownHostException

Resolves host to its IPv4 addresses, or IPv6 addresses if it has none.

Parameters:

host - the destination host name

Returns:

the resolved addresses and their DNSSEC security state

Throws:

DnssecValidationException - if the answer is bogus, or insecure under DnssecHostResolver.Policy.REQUIRE_SECURE

UnknownHostException - if the name does not exist or DNS cannot be reached