Drop-in DNS replacement for node.js to resolve names over the handshake network.
const dns = ;console;
The API is nearly identical to node.js, aside from it being promised based.
That said, we do have some extra goodies now that HNS+DNS+DNSSEC can be used as a means for provability.
Verifying TLS certs
const dns = ;const tlsa = await dns;if tlsalength > 0consoledirtlsa;// Passing a raw ASN1 certificate buffer:if dnsconsole;
The above will return all matching TLSA records with their respective usages, selectors, matching types, and fingerprints.
The call will throw an error if the DNSSEC trust chain was broken, or if a SIG(0) verification fails. If the TLSA record is directly on the blockchain itself, the only thing relevant is the SIG(0) record, which is only necessary when the user is not running a local SPV node.
If TLS certs were verified via an external server and verified with SIG(0), this should be the equivalent of a "grey lock" icon. If the DNS response came from a local handshake SPV resolver, it should be the equivalent to the "green lock" icon. The rationale here is that keys used for SIG(0) need to be kept hot and are much more susceptible to compromise. With a local SPV node, the only signatures being validated are for DNSSEC. DNSSEC keys are much more secure in that they can be stored offline.
Verifying SSH fingerprints
const dns = ;const sshfp = await dns;if sshfplength > 0consoledirsshfp;// Passing a raw ssh key buffer:if dnsconsole;
The above will return all matching SSHFP records with their respective algorithms and fingerprints.
Like TLSA, this will throw on any sort of security failure.
Handshake specifies a new OS configuration file known as
file is nearly identical to resolv.conf except that it allows for nameserver
public keys and nameserver ports. An example might be:
$ cat /etc/hns.confnameserver firstname.lastname@example.org:5359
IP addresses associated with ECDSA keys are prefixed with a base32-encoded secp256k1 key (compressed). If no key is placed before the IP address, SIG(0) validation will be not be performed.
Usage in Node.js
TCP and UDP sockets in node.js usually allow you to pass a custom
function for DNS resolution. This includes the HTTP module.
This module provides a compatibility lookup function called
legacy, which is
basically a callback wrapper around
const dns = ;const http = ;http;
HDNS comes with a dig-like tool called
$ hdig.js @email@example.com -p 53 www.ietf.org +dnssec; <<>> hdig.js 0.0.0 <<>> @firstname.lastname@example.org -p 53 www.ietf.org +dnssec; (1 server found);; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20186;; flags: qr rd ra ad, QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2;; OPT PSEUDOSECTION:; EDNS: version: 0, flags: do, udp: 4096;; QUESTION SECTION:;www.ietf.org. IN A;; ANSWER SECTION:www.ietf.org. 1800 IN CNAME www.ietf.org.cdn.cloudflare.net.www.ietf.org.cdn.cloudflare.net. 300 IN A 126.96.36.199www.ietf.org.cdn.cloudflare.net. 300 IN A 188.8.131.52;; SIG0 PSEUDOSECTION:. 0 ANY SIG 0 253 0 0 20180321132604 20180321131404 0 . h+SGk9niEFUeAkwQdQnuP8Tyvk2sMGLSF/FwHCEQnhghPZHwnKALtuu3 NIjFm8krfX/6TWsixnm0ZbyTDAZtRQ== ; alg = PRIVATEDNS;; Query time: 1066 msec;; SERVER: 127.0.0.1#53(127.0.0.1);; WHEN: Wed Mar 21 06:20:04 PDT 2018;; MSG SIZE rcvd: 286
This is a query to our local SPV node. Note the SIG(0) signature in the additional section: this isn't technically necessary for local SPV nodes, but it's nice to have for remote servers.
Contribution and License Agreement
If you contribute code to this project, you are implicitly allowing your code
to be distributed under the MIT license. You are also implicitly verifying that
all code is your original work.
- Copyright (c) 2018, Christopher Jeffrey (MIT License).
See LICENSE for more info.