import org.xbill.DNS.RRset; //导入依赖的package包/类
private RRset makeDelegationSignerSet(DomainResource domain) {
  RRset signerSet = new RRset();
  for (DelegationSignerData signerData : domain.getDsData()) {
    DSRecord dsRecord =
        new DSRecord(
            toAbsoluteName(domain.getFullyQualifiedDomainName()),
            DClass.IN,
            dnsDefaultDsTtl.getStandardSeconds(),
            signerData.getKeyTag(),
            signerData.getAlgorithm(),
            signerData.getDigestType(),
            signerData.getDigest());
    signerSet.addRR(dsRecord);
  }
  return signerSet;
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
private Message getCached(Message query) {
	Cache cache = getCache();
	if (cache == null)
		return null;

	Record question = query.getQuestion();
	RRset[] rrsets = cache.findAnyRecords(question.getName(), question.getType());
	if (rrsets == null)
		return null;

	Message msg = new Message();
	for (RRset rrset : rrsets) {
		@SuppressWarnings("unchecked")
		Iterator<Record> recordsIter = rrset.rrs();
		while (recordsIter.hasNext()) {
			msg.addRecord(recordsIter.next(), Section.ANSWER);
		}
	}
	return msg;
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
/**
 * Find the matching DNSKEY(s) to an RRSIG within a DNSKEY rrset. Normally
 * this will only return one DNSKEY. It can return more than one, since
 * KeyID/Footprints are not guaranteed to be unique.
 * 
 * @param dnskeyRrset The DNSKEY rrset to search.
 * @param signature The RRSIG to match against.
 * @return A List contains a one or more DNSKEYRecord objects, or null if a
 *         matching DNSKEY could not be found.
 */
private List<DNSKEYRecord> findKey(RRset dnskeyRrset, RRSIGRecord signature) {
    if (!signature.getSigner().equals(dnskeyRrset.getName())) {
        logger.trace("findKey: could not find appropriate key because incorrect keyset was supplied. Wanted: "
                + signature.getSigner() + ", got: " + dnskeyRrset.getName());
        return null;
    }

    int keyid = signature.getFootprint();
    int alg = signature.getAlgorithm();
    List<DNSKEYRecord> res = new ArrayList<DNSKEYRecord>(dnskeyRrset.size());
    for (Iterator<?> i = dnskeyRrset.rrs(); i.hasNext();) {
        DNSKEYRecord r = (DNSKEYRecord)i.next();
        if (r.getAlgorithm() == alg && r.getFootprint() == keyid) {
            res.add(r);
        }
    }

    if (res.size() == 0) {
        logger.trace("findKey: could not find a key matching the algorithm and footprint in supplied keyset. ");
        return null;
    }

    return res;
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
/**
 * Verifies an RRset. This routine does not modify the RRset. This RRset is
 * presumed to be verifiable, and the correct DNSKEY rrset is presumed to
 * have been found.
 * 
 * @param rrset The RRset to verify.
 * @param keyRrset The keys to verify the signatures in the RRset to check.
 * @return SecurityStatus.SECURE if the rrest verified positively,
 *         SecurityStatus.BOGUS otherwise.
 */
public SecurityStatus verify(RRset rrset, RRset keyRrset) {
    Iterator<?> i = rrset.sigs();
    if (!i.hasNext()) {
        logger.info("RRset failed to verify due to lack of signatures");
        return SecurityStatus.BOGUS;
    }

    while (i.hasNext()) {
        RRSIGRecord sigrec = (RRSIGRecord)i.next();
        SecurityStatus res = this.verifySignature(rrset, sigrec, keyRrset);
        if (res == SecurityStatus.SECURE) {
            return res;
        }
    }

    logger.info("RRset failed to verify: all signatures were BOGUS");
    return SecurityStatus.BOGUS;
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
/**
 * Determines if at least one of the DS records in the RRset has a supported
 * algorithm.
 * 
 * @param dsRRset The RR set to search in.
 * @return True when at least one DS record uses a supported algorithm,
 *         false otherwise.
 */
static boolean atLeastOneSupportedAlgorithm(RRset dsRRset) {
    Iterator<?> it = dsRRset.rrs();
    while (it.hasNext()) {
        Record r = (Record)it.next();
        if (r.getType() == Type.DS) {
            if (isAlgorithmSupported(((DSRecord)r).getAlgorithm())) {
                return true;
            }

            // do nothing, there could be another DS we understand
        }
    }

    return false;
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
/**
 * Determines if at least one of the DS records in the RRset has a supported
 * digest algorithm.
 * 
 * @param dsRRset The RR set to search in.
 * @return True when at least one DS record uses a supported digest
 *         algorithm, false otherwise.
 */
static boolean atLeastOneDigestSupported(RRset dsRRset) {
    Iterator<?> it = dsRRset.rrs();
    while (it.hasNext()) {
        Record r = (Record)it.next();
        if (r.getType() == Type.DS) {
            if (isDigestSupported(((DSRecord)r).getDigestID())) {
                return true;
            }

            // do nothing, there could be another DS we understand
        }
    }

    return false;
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
protected String getReason(Message m) {
    for (RRset set : m.getSectionRRsets(Section.ADDITIONAL)) {
        if (set.getName().equals(Name.root) && set.getType() == Type.TXT && set.getDClass() == ValidatingResolver.VALIDATION_REASON_QCLASS) {
            StringBuilder sb = new StringBuilder();
            @SuppressWarnings("unchecked")
            List<String> strings = (List<String>)((TXTRecord)set.first()).getStrings();
            for (String part : strings){
                sb.append(part);
            }

            return sb.toString();
        }
    }

    return null;
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
public String rrSetsToString(RRset[] rrsets) {
    StringBuffer ansBuffer = new StringBuffer();
    Iterator it;
    int i;

    for (i = 0; i < rrsets.length; i++) {
        RRset rrset = rrsets[i];
        it = rrset.rrs();

        while (it.hasNext()) {
            Record r = (Record) it.next();
            //Log.i(TAG, "rrsetstostring: type=" + r.getType());
            ansBuffer.append(r.toString());
            ansBuffer.append("\n");
        }

        //RRSIGs
        final Iterator<Record> sigIter = rrset.sigs();
        while (sigIter.hasNext()) {
            final Record sigRec = sigIter.next();

            ansBuffer.append(sigRec.toString());
            ansBuffer.append("\n");
        }
    }
    //replace tabs
    String ret = ansBuffer.toString().replace('\t',' ');
    return ret;
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
private RRset makeNameServerSet(DomainResource domain) {
  RRset nameServerSet = new RRset();
  for (String hostName : domain.loadNameserverFullyQualifiedHostNames()) {
    NSRecord record =
        new NSRecord(
            toAbsoluteName(domain.getFullyQualifiedDomainName()),
            DClass.IN,
            dnsDefaultNsTtl.getStandardSeconds(),
            toAbsoluteName(hostName));
    nameServerSet.addRR(record);
  }
  return nameServerSet;
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
private RRset makeAddressSet(HostResource host) {
  RRset addressSet = new RRset();
  for (InetAddress address : host.getInetAddresses()) {
    if (address instanceof Inet4Address) {
      ARecord record =
          new ARecord(
              toAbsoluteName(host.getFullyQualifiedHostName()),
              DClass.IN,
              dnsDefaultATtl.getStandardSeconds(),
              address);
      addressSet.addRR(record);
    }
  }
  return addressSet;
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
private RRset makeV6AddressSet(HostResource host) {
  RRset addressSet = new RRset();
  for (InetAddress address : host.getInetAddresses()) {
    if (address instanceof Inet6Address) {
      AAAARecord record =
          new AAAARecord(
              toAbsoluteName(host.getFullyQualifiedHostName()),
              DClass.IN,
              dnsDefaultATtl.getStandardSeconds(),
              address);
      addressSet.addRR(record);
    }
  }
  return addressSet;
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
private ImmutableList<Record> findUpdateRecords(
    Update update, String resourceName, int recordType) {
  for (RRset set : update.getSectionRRsets(Section.UPDATE)) {
    if (set.getName().toString().equals(resourceName) && set.getType() == recordType) {
      return fixIterator(Record.class, set.rrs());
    }
  }
  assert_().fail(
      "No record set found for resource '%s' type '%s'",
      resourceName, Type.string(recordType));
  throw new AssertionError();
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
/**
 * Verify an RRset against a particular signature.
 * 
 * @param rrset The RRset to verify.
 * @param sigrec The signature record that signs the RRset.
 * @param keyRrset The keys used to create the signature record.
 * 
 * @return {@link SecurityStatus#SECURE} if the signature verified,
 *         {@link SecurityStatus#BOGUS} if it did not verify (for any
 *         reason), and {@link SecurityStatus#UNCHECKED} if verification
 *         could not be completed (usually because the public key was not
 *         available).
 */
private SecurityStatus verifySignature(RRset rrset, RRSIGRecord sigrec,
        RRset keyRrset) {
    List<DNSKEYRecord> keys = this.findKey(keyRrset, sigrec);
    if (keys == null) {
        logger.trace("could not find appropriate key");
        return SecurityStatus.BOGUS;
    }

    SecurityStatus status = SecurityStatus.UNCHECKED;
    for (DNSKEYRecord key : keys) {
        try {
            if (!rrset.getName().subdomain(keyRrset.getName())) {
                logger.debug("signer name is off-tree");
                status = SecurityStatus.BOGUS;
                continue;
            }

            DNSSEC.verify(rrset, sigrec, key);
            return SecurityStatus.SECURE;
        }
        catch (DNSSECException e) {
            logger.error("Failed to validate RRset", e);
            status = SecurityStatus.BOGUS;
        }
    }

    return status;
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
/**
 * Creates a new instance of this class.
 * 
 * @param m The DNS message to wrap.
 */
public SMessage(Message m) {
    this(m.getHeader());
    this.question = m.getQuestion();
    this.oPTRecord = m.getOPT();

    for (int i = Section.ANSWER; i <= Section.ADDITIONAL; i++) {
        RRset[] rrsets = m.getSectionRRsets(i);

        for (int j = 0; j < rrsets.length; j++) {
            this.addRRset(new SRRset(rrsets[j]), i);
        }
    }
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
/**
 * Create a new SRRset from an existing RRset. This SRRset will contain that
 * same internal Record objects as the original RRset.
 * 
 * @param r The RRset to copy.
 */
public SRRset(RRset r) {
    this();

    for (Iterator<?> i = r.rrs(); i.hasNext();) {
        addRR((Record)i.next());
    }

    for (Iterator<?> i = r.sigs(); i.hasNext();) {
        addRR((Record)i.next());
    }
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
private Message stripAdditional(Message m) {
    if (m.getQuestion().getType() == Type.RRSIG) {
        return m;
    }

    Message copy = new Message();
    copy.setHeader(m.getHeader());
    for (int i = 0; i < Section.ADDITIONAL; i++) {
        for (RRset set : m.getSectionRRsets(i)) {
            if (set.getType() == Type.NS && m.getQuestion().getType() != Type.NS) {
                continue;
            }

            Iterator<?> rrs = set.rrs();
            while (rrs.hasNext()) {
                copy.addRecord((Record)rrs.next(), i);
            }

            Iterator<?> sigs = set.sigs();
            while (sigs.hasNext()) {
                copy.addRecord((Record)sigs.next(), i);
            }
        }
    }

    return copy;
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
@Test
public void testDNameDirectQueryIsValid() throws IOException {
    Message response = resolver.send(createMessage("alias.ingotronic.ch./DNAME"));
    assertTrue("AD flag must not set", response.getHeader().getFlag(Flags.AD));
    assertEquals(Rcode.NOERROR, response.getRcode());
    assertNull(getReason(response));
    for (RRset set : response.getSectionRRsets(Section.ANSWER)) {
        if (set.getType() == Type.DNAME) {
            DNAMERecord r = (DNAMERecord)set.first();
            assertEquals(Name.fromString("ingotronic.ch."), r.getTarget());
        }
    }
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
@SuppressWarnings("unchecked")
@Test
public void testDNameInNsecIsUnderstood_Rfc6672_5_3_4_1() throws IOException {
    Message nsecs = resolver.send(createMessage("alias.ingotronic.ch./NS"));
    RRset nsecSet = null;
    for (RRset set : nsecs.getSectionRRsets(Section.AUTHORITY)) {
        if (set.getName().equals(Name.fromString("alias.ingotronic.ch."))) {
            nsecSet = set;
            break;
        }
    }

    Message message = new Message();
    message.getHeader().setRcode(Rcode.NXDOMAIN);
    message.addRecord(Record.newRecord(Name.fromString("www.alias.ingotronic.ch."), Type.A, DClass.IN), Section.QUESTION);
    Iterator<Record> rrs = nsecSet.rrs();
    while (rrs.hasNext()) {
        message.addRecord(rrs.next(), Section.AUTHORITY);
    }
    Iterator<Record> sigs = nsecSet.sigs();
    while (sigs.hasNext()) {
        message.addRecord(sigs.next(), Section.AUTHORITY);
    }

    add("www.alias.ingotronic.ch./A", message);

    Message response = resolver.send(createMessage("www.alias.ingotronic.ch./A"));
    assertFalse("AD flag must not be set", response.getHeader().getFlag(Flags.AD));
    assertEquals(Rcode.SERVFAIL, response.getRcode());
    assertEquals("failed.nxdomain.exists:www.alias.ingotronic.ch.", getReason(response));
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
@Test
@AlwaysOffline
public void testNoDSProofCanExistForRoot() throws IOException {
    // ./DS can exist
    resolver.getTrustAnchors().clear();
    resolver.getTrustAnchors().store(new SRRset(new RRset(toRecord(".           300 IN  DS  16758 7 1 EC88DF5E2902FD4AB9E9C246BEEA9B822BD7BCF7"))));
    Message response = resolver.send(createMessage("./DS"));
    assertTrue("AD flag must be set", response.getHeader().getFlag(Flags.AD));
    assertEquals(Rcode.NOERROR, response.getRcode());
    assertNull(getReason(response));
}
 

import org.xbill.DNS.RRset; //导入依赖的package包/类
@Test
@AlwaysOffline
public void testNodataNsec3ForDSMustNotHaveSOA() throws IOException {
    // bogus./DS cannot coexist with bogus./SOA
    resolver.getTrustAnchors().clear();
    resolver.getTrustAnchors().store(new SRRset(new RRset(toRecord("bogus.           300 IN  DS  16758 7 1 A5D56841416AB42DC39629E42D12C98B0E94232A"))));
    Message response = resolver.send(createMessage("bogus./DS"));
    assertTrue("AD flag must be set", response.getHeader().getFlag(Flags.AD));
    assertEquals(Rcode.NOERROR, response.getRcode());
    assertNull(getReason(response));
}