81 releases
0.23.2 | Oct 23, 2023 |
---|---|
0.23.0 | Aug 22, 2023 |
0.23.0-alpha.4 | Jun 11, 2023 |
0.22.0 | Sep 2, 2022 |
0.4.0 | Nov 9, 2015 |
#2265 in Network programming
515 downloads per month
Used in 14 crates
(11 directly)
2.5MB
38K
SLoC
NOTICE This project has been rebranded to Hickory DNS and has been moved to the https://github.com/hickory-dns/hickory-dns organization and repo, this crate/binary has been moved to hickory-dns, from 0.24
Overview
Trust-DNS provides a binary for hosting or forwarding DNS zones.
This a named implementation for DNS zone hosting. It is capable of performing signing all records in the zone for server DNSSEC RRSIG records associated with all records in a zone. There is also a trust-dns
binary that can be generated from the library with cargo install trust-dns
. Dynamic updates are supported via SIG0
(an mTLS authentication method is under development).
Features
- Dynamic Update with sqlite journaling backend (SIG0)
- DNSSEC online signing (NSEC not NSEC3)
- DNS over TLS (DoT)
- DNS over HTTPS (DoH)
- Forwarding stub resolver
- ANAME resolution, for zone mapping aliass to A and AAAA records
- Additionals section generation for aliasing record types
DNS-over-TLS and DNS-over-HTTPS
Support of TLS on the Server is managed through a pkcs12 der file. The documentation is captured in the example test config file, example.toml. A registered certificate to the server can be pinned to the Client with the add_ca()
method. Alternatively, as the client uses the rust-native-tls library, it should work with certificate signed by any standard CA.
DoT and DoH are supported. This is accomplished through the use of one of native-tls
, openssl
, or rustls
(only rustls
is currently supported for DoH). The Resolver requires only requires valid DoT or DoH resolvers being registered in order to be used.
To use with the Client
, the TlsClientConnection
or HttpsClientConnection
should be used. Similarly, to use with the tokio AsyncClient
the TlsClientStream
or HttpsClientStream
should be used. ClientAuth, mTLS, is currently not supported, there are some issues still being worked on. TLS is useful for Server authentication and connection privacy.
To enable DoT one of the features dns-over-native-tls
, dns-over-openssl
, or dns-over-rustls
must be enabled, dns-over-https-rustls
is used for DoH.
DNSSEC status
Currently the root key is hardcoded into the system. This gives validation of DNSKEY and DS records back to the root. NSEC is implemented, but not NSEC3. Because caching is not yet enabled, it has been noticed that some DNS servers appear to rate limit the connections, validating RRSIG records back to the root can require a significant number of additional queries for those records.
Zones will be automatically resigned on any record updates via dynamic DNS. To enable DNSSEC, one of the features dnssec-openssl
or dnssec-ring
must be enabled.
Future goals
- Distributed dynamic DNS updates, with consensus
- mTLS based authorization for Dynamic Updates
- Online NSEC creation for queries
- Full hint based resolving
- Maybe NSEC3 and/or NSEC5 support
Minimum Rust Version
The current minimum rustc version for this project is 1.64
Versioning
Trust-DNS does it's best job to follow semver. Trust-DNS will be promoted to 1.0 upon stabilization of the publicly exposed APIs. This does not mean that Trust-DNS will necessarily break on upgrades between 0.x updates. Whenever possible, old APIs will be deprecated with notes on what replaced those deprecations. Trust-DNS will make a best effort to never break software which depends on it due to API changes, though this can not be guaranteed. Deprecated interfaces will be maintained for at minimum one major release after that in which they were deprecated (where possible), with the exception of the upgrade to 1.0 where all deprecated interfaces will be planned to be removed.
Dependencies
~14–32MB
~491K SLoC