Class DnsQueryProtection

java.lang.Object
io.netty.resolver.dns.DnsQueryProtection
final class DnsQueryProtection extends java.lang.Object
Defences that make it harder for an off-path attacker to spoof the response of a UDP DNS query on top of the query id and the source port, as recommended by RFC 5452:

  • Nested Class Summary

    Nested Classes
    Modifier and Type
    Class
    Description
    (package private) static enum 
    DnsQueryProtection.CookieStatus
    The result of checking the cookie in a response.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private static final java.lang.String
    ACE_PREFIX
     
    private final boolean
    caseRandomization
     
    private final java.util.Set<java.net.InetSocketAddress>
    cookieServers
     
    private static final int
    MAX_COOKIE_SERVERS
    Upper bound for the number of nameservers we remember to support cookies.
    private final java.security.SecureRandom
    random
     

  • Constructor Summary

    Constructors
    Constructor
    Description
    DnsQueryProtection(boolean caseRandomization, boolean cookies)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    private static DnsQueryProtection.CookieStatus
    checkCookie(ByteBuf rdata, byte[] clientCookie)
     
    (package private) static DnsQueryProtection.CookieStatus
    checkCookie(DnsResponse response, byte[] clientCookie)
    Inspect the COOKIE option of the OPT record of the response.
    (package private) void
    cookieReceived(java.net.InetSocketAddress nameServerAddr)
     
    (package private) boolean
    isCaseRandomizationEnabled()
     
    (package private) boolean
    isCookieExpected(java.net.InetSocketAddress nameServerAddr)
    Returns true if the given nameserver has returned a valid cookie before, and so is expected to do so for every response.
    (package private) boolean
    isCookiesEnabled()
     
    (package private) byte[]
    newClientCookie()
     
    (package private) DnsQuestion
    randomizeCase(DnsQuestion question)
    Returns a copy of the given DnsQuestion in which the case of every ASCII letter was picked at random.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • ACE_PREFIX

      private static final java.lang.String ACE_PREFIX
      See Also:

    • random

      private final java.security.SecureRandom random

    • caseRandomization

      private final boolean caseRandomization

    • cookieServers

      private final java.util.Set<java.net.InetSocketAddress> cookieServers

  • Constructor Details

    • DnsQueryProtection

      DnsQueryProtection(boolean caseRandomization, boolean cookies)

  • Method Details

    • isCaseRandomizationEnabled

      boolean isCaseRandomizationEnabled()

    • isCookiesEnabled

      boolean isCookiesEnabled()

    • randomizeCase

      DnsQuestion randomizeCase(DnsQuestion question)
      Returns a copy of the given DnsQuestion in which the case of every ASCII letter was picked at random.

    • newClientCookie

      byte[] newClientCookie()

    • isCookieExpected

      boolean isCookieExpected(java.net.InetSocketAddress nameServerAddr)
      Returns true if the given nameserver has returned a valid cookie before, and so is expected to do so for every response.

    • cookieReceived

      void cookieReceived(java.net.InetSocketAddress nameServerAddr)

    • checkCookie

      static DnsQueryProtection.CookieStatus checkCookie(DnsResponse response, byte[] clientCookie)
      Inspect the COOKIE option of the OPT record of the response.

    • checkCookie

      private static DnsQueryProtection.CookieStatus checkCookie(ByteBuf rdata, byte[] clientCookie)