Codebase list dnsviz / 8f4080c
Allow prohibited algorithms to be considered with command-line option Casey Deccio 3 years ago
7 changed file(s) with 45 addition(s) and 4 deletion(s). Raw diff Collapse all Expand all
+6
-1
dnsviz/analysis/offline.py less more
842842 self._populate_ds_status(dns.rdatatype.DLV, supported_algs, supported_digest_algs)
843843 self._populate_dnskey_status(trusted_keys)
844844
845 def populate_status(self, trusted_keys, supported_algs=None, supported_digest_algs=None, is_dlv=False, follow_mx=True):
845 def populate_status(self, trusted_keys, supported_algs=None, supported_digest_algs=None, is_dlv=False, follow_mx=True, validate_prohibited_algs=False):
846846 # identify supported algorithms as intersection of explicitly supported
847847 # and software supported
848848 if supported_algs is not None:
853853 supported_digest_algs.intersection_update(crypto._supported_digest_algs)
854854 else:
855855 supported_digest_algs = copy.copy(crypto._supported_digest_algs)
856
857 # unless we are overriding, mark prohibited algorithms as not supported
858 if not validate_prohibited_algs:
859 supported_algs.difference_update(Status.DNSKEY_ALGS_MUST_NOT_VALIDATE)
860 supported_digest_algs.difference_update(Status.DS_DIGEST_ALGS_MUST_NOT_VALIDATE)
856861
857862 self._populate_status(trusted_keys, supported_algs, supported_digest_algs, is_dlv, None, follow_mx)
858863
+5
-1
dnsviz/commands/graph.py less more
197197 type=self.comma_separated_ints_set,
198198 action='store', metavar='<digest_alg>,[<digest_alg>...]',
199199 help='Support only the specified DNSSEC digest algorithm(s)')
200 self.parser.add_argument('-b', '--validate-prohibited-algs',
201 const=True, default=False,
202 action='store_const',
203 help='Validate algorithms for which validation is otherwise prohibited')
200204 self.parser.add_argument('-C', '--enforce-cookies',
201205 const=True, default=False,
202206 action='store_const',
456460
457461 G = DNSAuthGraph()
458462 for name_obj in name_objs:
459 name_obj.populate_status(arghelper.trusted_keys, supported_algs=arghelper.args.algorithms, supported_digest_algs=arghelper.args.digest_algorithms)
463 name_obj.populate_status(arghelper.trusted_keys, supported_algs=arghelper.args.algorithms, supported_digest_algs=arghelper.args.digest_algorithms, validate_prohibited_algs=arghelper.args.validate_prohibited_algs)
460464 for qname, rdtype in name_obj.queries:
461465 if arghelper.args.rr_types is None:
462466 # if rdtypes was not specified, then graph all, with some
+5
-1
dnsviz/commands/grok.py less more
220220 type=self.comma_separated_ints_set,
221221 action='store', metavar='<digest_alg>,[<digest_alg>...]',
222222 help='Support only the specified DNSSEC digest algorithm(s)')
223 self.parser.add_argument('-b', '--validate-prohibited-algs',
224 const=True, default=False,
225 action='store_const',
226 help='Validate algorithms for which validation is otherwise prohibited')
223227 self.parser.add_argument('-C', '--enforce-cookies',
224228 const=True, default=False,
225229 action='store_const',
453457
454458 d = OrderedDict()
455459 for name_obj in name_objs:
456 name_obj.populate_status(arghelper.trusted_keys, supported_algs=arghelper.args.algorithms, supported_digest_algs=arghelper.args.digest_algorithms)
460 name_obj.populate_status(arghelper.trusted_keys, supported_algs=arghelper.args.algorithms, supported_digest_algs=arghelper.args.digest_algorithms, validate_prohibited_algs=arghelper.args.validate_prohibited_algs)
457461
458462 if arghelper.trusted_keys:
459463 G = DNSAuthGraph()
+5
-1
dnsviz/commands/print.py less more
355355 type=self.comma_separated_ints_set,
356356 action='store', metavar='<digest_alg>,[<digest_alg>...]',
357357 help='Support only the specified DNSSEC digest algorithm(s)')
358 self.parser.add_argument('-b', '--validate-prohibited-algs',
359 const=True, default=False,
360 action='store_const',
361 help='Validate algorithms for which validation is otherwise prohibited')
358362 self.parser.add_argument('-C', '--enforce-cookies',
359363 const=True, default=False,
360364 action='store_const',
589593
590594 G = DNSAuthGraph()
591595 for name_obj in name_objs:
592 name_obj.populate_status(arghelper.trusted_keys, supported_algs=arghelper.args.algorithms, supported_digest_algs=arghelper.args.digest_algorithms)
596 name_obj.populate_status(arghelper.trusted_keys, supported_algs=arghelper.args.algorithms, supported_digest_algs=arghelper.args.digest_algorithms, validate_prohibited_algs=arghelper.args.validate_prohibited_algs)
593597 for qname, rdtype in name_obj.queries:
594598 if arghelper.args.rr_types is None:
595599 # if rdtypes was not specified, then graph all, with some
+8
-0
doc/man/dnsviz-graph.1 less more
9191 unknown. Additionally, when a zone has only DS records with unsupported digest
9292 algorithms, the zone is treated as "insecure", assuming the DS records are
9393 properly authenticated.
94 .TP
95 .B -b, --validate-prohibited-algs
96 Validate algorithms for which validation is otherwise prohibited. Current
97 DNSSEC specification prohibits validators from validating older, weaker
98 algorithms associated with DNSKEY and DS records (see RFC 8624). If this
99 option is used, then a warning will be still be issued for DNSSEC records that
100 use these older algorithms, but the code will still assess their cryptographic
101 status, rather than ignoring them.
94102 .TP
95103 .B -C, --enforce-cookies
96104 Enforce DNS cookies strictly. Require a server to return a "BADCOOKIE" response
+8
-0
doc/man/dnsviz-grok.1 less more
8888 algorithms, the zone is treated as "insecure", assuming the DS records are
8989 properly authenticated.
9090 .TP
91 .B -b, --validate-prohibited-algs
92 Validate algorithms for which validation is otherwise prohibited. Current
93 DNSSEC specification prohibits validators from validating older, weaker
94 algorithms associated with DNSKEY and DS records (see RFC 8624). If this
95 option is used, then a warning will be still be issued for DNSSEC records that
96 use these older algorithms, but the code will still assess their cryptographic
97 status, rather than ignoring them.
98 .TP
9199 .B -C, --enforce-cookies
92100 Enforce DNS cookies strictly. Require a server to return a "BADCOOKIE" response
93101 when a query contains a COOKIE option with no server cookie or with an invalid
+8
-0
doc/man/dnsviz-print.1 less more
9191 unknown. Additionally, when a zone has only DS records with unsupported digest
9292 algorithms, the zone is treated as "insecure", assuming the DS records are
9393 properly authenticated.
94 .TP
95 .B -b, --validate-prohibited-algs
96 Validate algorithms for which validation is otherwise prohibited. Current
97 DNSSEC specification prohibits validators from validating older, weaker
98 algorithms associated with DNSKEY and DS records (see RFC 8624). If this
99 option is used, then a warning will be still be issued for DNSSEC records that
100 use these older algorithms, but the code will still assess their cryptographic
101 status, rather than ignoring them.
94102 .TP
95103 .B -C, --enforce-cookies
96104 Enforce DNS cookies strictly. Require a server to return a "BADCOOKIE" response