dnsjava-users — The dnsjava mailing list

Re: Bug in SIG(0) signature generation in 2.1.5

[Brian W. <bwe...@xb...>]

On Jul 26, 2013, at 9:56 AM, Tekto <te...@ge...> wrote:

> Hi,
> 
> -- Description --
> 
> SIG0.signMessage in Version 2.1.5 is calculating a wrong signature. Sending
> following update-request to a server will produce a SERVFAIL:
> 
> 	SimpleResolver resolver = new SimpleResolver("somedns.example.invalid.");
> 	Name sig0zoneName = new Name("sig0.invalid.");
> 	Name sig0hostName = new Name("sometext.sig0.invalid.");
> 
> 	KeyFactory keyFactory = KeyFactory.getInstance("RSA");
> 	RSAPrivateKey privKey = getPrivateZoneCrtKey(keyFactory);
> 	RSAPublicKey pubKey = getPublicZoneKey(keyFactory);
> 
> 	KEYRecord keyRecord = new KEYRecord(sig0zoneName, DClass.IN, 0, Flags.HOST, Protocol.DNSSEC, Algorithm.RSASHA1, pubKey);		
> 	TXTRecord txtRecord = new TXTRecord(sig0hostName, DClass.IN, 0, "Hello World!");
> 	Update updateMessage = new Update(sig0zoneName);
> 	updateMessage.add(txtRecord);
> 
> 	SIG0.signMessage(updateMessage, keyRecord, privKey, null);
> 
> 
> -- How to reproduce --
> 
> Use SIG0.verifyMessage and try to verify updateMessage.toWire() which will
> throw a DNSSEC.DNSSECException.
> 
> 	SIG0.verifyMessage(updateMessage, updateMessage.toWire(), keyRecord, null);

I assume there's some missing code between the signMessage and verifyMessage?  Passing the same Message object to both signMessage and verifyMessage doesn't work, since some of the internal Message state needed to verify is only filled in when the Message is parsed from wire format; that is, something like:

SIG0.signMessage(updateMessage, keyRecord, privKey, null);
byte [] wire = msg.toWire();
Message msg = new Message(wire);
SIG0.verifyMessage(msg, msg.toWire(), keyRecord, null);

Without that, the code throws an ArrayIndexOutOfBoundsException, because it's badly handling the fact that the Message doesn't know where the start of the SIG0 record is (I've locally updated the code to throw a more useful NoSignatureException).

With code like that added, I'm seeing the failure, although I'm not sure why I'm not seeing the same failure in the existing SIG0 test code I have.

I'm going to try and adapt this sample code into a unit test, and commit the changes in the next few days.

Thanks!

Brian

Bug in SIG(0) signature generation in 2.1.5

[Tekto <te...@ge...>]

Hi,

-- Description --

SIG0.signMessage in Version 2.1.5 is calculating a wrong signature. Sending
following update-request to a server will produce a SERVFAIL:

	SimpleResolver resolver = new SimpleResolver("somedns.example.invalid.");
	Name sig0zoneName = new Name("sig0.invalid.");
	Name sig0hostName = new Name("sometext.sig0.invalid.");

	KeyFactory keyFactory = KeyFactory.getInstance("RSA");
	RSAPrivateKey privKey = getPrivateZoneCrtKey(keyFactory);
	RSAPublicKey pubKey = getPublicZoneKey(keyFactory);

	KEYRecord keyRecord = new KEYRecord(sig0zoneName, DClass.IN, 0, Flags.HOST, Protocol.DNSSEC, Algorithm.RSASHA1, pubKey);		
	TXTRecord txtRecord = new TXTRecord(sig0hostName, DClass.IN, 0, "Hello World!");
	Update updateMessage = new Update(sig0zoneName);
	updateMessage.add(txtRecord);

	SIG0.signMessage(updateMessage, keyRecord, privKey, null);


-- How to reproduce --

Use SIG0.verifyMessage and try to verify updateMessage.toWire() which will
throw a DNSSEC.DNSSECException.

	SIG0.verifyMessage(updateMessage, updateMessage.toWire(), keyRecord, null);

-- Reason --
	
in DNSSEC.java signMessage(Message message, SIGRecord previous, KEYRecord key,
  PrivateKey privkey, Date inception, Date expiration)
update message is added to the same DNSOutput-Buffer as the introducing SIG-RDATA.
Therefore name compression calculation in update-section will refer to a wrong
offset (Start of to-sign data block instead of the start of the message will be
truly send over the wire. Verification on the server counterpart will fail.
(tested against BIND 9.7.3)

-- How to fix it --

Changing line 955 (in Version 2.1.5) in DNSSEC.java from

	message.toWire(out);

to
	
	out.writeByteArray(message.toWire());

will fix this behaviour since it uses a second, independent DNSOutput-buffer for
calculation.


Regards,
	Adam

Chat with me on imo!

[WP L. <in...@im...>]

Hey dnsjava-users,

Join WP Lum on imo to chat on popular IM networks, make free calls and discover interesting people and content.
Join imo by clicking here: https://imo.im?signup&t=2ybue5a3nirq

This email was sent by imo.im
555 Bryant Street, Palo Alto, CA 94301.

Don't want anymore invite emails?
Click here to unsubscribe: https://imo.im/s/unsubscribe/WWGaBfPrtC3arShFjMYEpHTjFSeCtFb29QYyzvOI1UxeBnPsm9H2bcXd6clBrLRfgW3Icx_lVVUnFEZvZZap0RvgsPY4HQEFAMDsWU68lUqbC4-noPAWCgpF84StVzXwUC4YDQmczMkDS2mfFjagOfuqJGeXtt0AcL6MQmO-il1DbgOz07JO_l42ZKwVrGBh

Re: Developping a new record type in dnsjava

[apple_5 <xy...@gm...>]

Dear Jihane,
I'm an engineering student and I need to develop something based on the
dnsjava. I saw you said that you can run the jnamed server on your computer
which I can't. I'm wondering can you tell me how you configured your
jnamed.conf file.
Thanks a lot,
Xinyu

Jihane wrote:
> 
> Hello Brian,
> 
> I'm a student in an engineering school. As a part of my training, I need
> to develop a new resource record type in dnsjava. Firstly, i have created
> a class which defines this new type. This latter is extends Record class.
> After that, I have run the jnaned server on my computer and registered a
> name and its corresponding information of this new type. Unfortunately,
> when I did a lookup for this type or the AAAA record type, I didn't get an
> answer even if these RRs exist in .db.
> 
> 
> PS: I added in class Type this new type.
> 
> Have you an explanation for this problem?
> 
> If the server does not recorgnize this new type.In which class i need to
> add information about this new type (jnamed for instance)? because it
> doesn't work also for AAAA Record type.
> 
> Thank you in advance,
> 
> Cheers
> 
> 
> Jihane
>  
> 
> 

-- 
View this message in context: http://old.nabble.com/Developping-a-new-record-type-in-dnsjava-tp28040758p35404515.html
Sent from the dnsjava-users mailing list archive at Nabble.com.

how to configure the jnamed

[apple_5 <xy...@gm...>]

Hi,
I met some trouble when I tried to run the jnamed server and I'm appreciate
if you can help me out.
I've created a jnamed.conf in the folder following the example in USAGE. And
I created the corresponding internal.db for primary zone following the
format of "named.conf" in "bind". I didn't change other context such as
second zone and cache.
I got a ZoneTransferException:NOTAUTH after I run jnamed.
I think there may be something wrong with my configuration. Can you give me
some suggestion or examples?
Thanks,
Xinyu
-- 
View this message in context: http://old.nabble.com/how-to-configure-the-jnamed-tp35404494p35404494.html
Sent from the dnsjava-users mailing list archive at Nabble.com.

how to configure the jnamed

[apple_5 <xy...@gm...>]

Hi,
I met some trouble when I tried to run the jnamed server and I'm appreciate
if you can help me out.
I've created a jnamed.conf in the folder following the example in USAGE. And
I created the corresponding internal.db for primary zone following the
format of "named.conf" in "bind". I didn't change other context such as
second zone and cache.
I got a ZoneTransferException:NOTAUTH after I run jnamed.
I think there may be something wrong with my configuration. Can you give me
some suggestion or examples?
Thanks,
Xinyu
-- 
View this message in context: http://old.nabble.com/how-to-configure-the-jnamed-tp35404492p35404492.html
Sent from the dnsjava-users mailing list archive at Nabble.com.

how to configure the jnamed server

[apple_5 <xy...@gm...>]

Hi,
I met some trouble when I tried to run the jnamed server and I'm appreciate
if you can help me out.
I've created a jnamed.conf in the folder following the example in USAGE. And
I created the corresponding internal.db for primary zone following the
format of "named.conf" in "bind". I didn't change other context such as
second zone and cache.
I got a ZoneTransferException:NOTAUTH after I run jnamed.
I think there may be something wrong with my configuration. Can you give me
some suggestion or examples?
Thanks,
Xinyu
-- 
View this message in context: http://old.nabble.com/how-to-configure-the-jnamed-server-tp35404488p35404488.html
Sent from the dnsjava-users mailing list archive at Nabble.com.

how to configure the jnamed

[apple_5 <xy...@gm...>]

Hi,
I've built a new jnamed.conf file for the jnamed server following the
example in USAGE. And I also created a file for my primary zone which is set
as the named.conf in "bind". I didn't change other contexts like second zone
and cache. 
After I running the jnamed, I got a ZoneTransferException:NOTAUTH.
I think there may be something wrong with my configuration file, can you
give me some suggestion or example will be better of the configuration?
Thanks,
Xinyu
-- 
View this message in context: http://old.nabble.com/how-to-configure-the-jnamed-tp35404473p35404473.html
Sent from the dnsjava-users mailing list archive at Nabble.com.

how to configure the jnamed

[apple_5 <xy...@gm...>]

Hi,
I've built a new jnamed.conf file for the jnamed server following the
example in USAGE. And I also created a file for my primary zone which is set
as the named.conf in "bind". I didn't change other contexts like second zone
and cache. 
After I running the jnamed, I got a ZoneTransferException:NOTAUTH.
I think there may be something wrong with my configuration file, can you
give me some suggestion or example will be better of the configuration?
Thanks,
Xinyu
-- 
View this message in context: http://old.nabble.com/how-to-configure-the-jnamed-tp35404470p35404470.html
Sent from the dnsjava-users mailing list archive at Nabble.com.

Re: Name: Constructor copyies too many labels

[Brian W. <bwe...@xb...>]

On May 4, 2013, at 6:49 PM, "Ingo Bauersachs" <in...@ji...> wrote:

> Hey
> 
> The Name(String s, Name origin) constructor copies too many labels when
> origin has been created by stripping a label.
> 
> Example code:
> Name origin = Name.fromString("sub.domain.example.");
> Name strippedOrigin = new Name(origin, 1);
> System.out.println(new Name("prepend", strippedOrigin));
> 
> Actual output:
> prepend.sub.domain.example.
> 
> Expected output:
> prepend.domain.example.
> 
> Patch with new unit-test is attached.

Thanks!

I should probably make sure the same bug doesn't exist in any of the other constructors; if I don't see anything, I'll commit this and push out a new version in the next couple of days.

Brian

Name: Constructor copyies too many labels

[Ingo B. <in...@ji...>]

Hey

The Name(String s, Name origin) constructor copies too many labels when
origin has been created by stripping a label.

Example code:
Name origin = Name.fromString("sub.domain.example.");
Name strippedOrigin = new Name(origin, 1);
System.out.println(new Name("prepend", strippedOrigin));

Actual output:
prepend.sub.domain.example.

Expected output:
prepend.domain.example.

Patch with new unit-test is attached.

Regards,
Ingo

Re: resolve thousands of domain names (NS,AAAA records)

[Alex D. <Al...@no...>]

Hi - 

On 20 Mar 2013, at 13:16, srnec <pet...@gm...> wrote:

> I need some advise. Im working on project where I need to get NS records for
> list of domains (aprox. 280 000) and I need to get AAAA record for those NS
> record (if they had).
> My task is to test those domains if they had IPv6 support (name servers have
> IPv6 address).
> 
> I tried to do it with dnsPython but I had bad results. Speed of that script
> was very impressive, but I had problem getting answers for those records
> after short period of time. (I got mostly timeout exception for every
> record).

Have you tried using dnsjnio? This provides an alternative I/O implementation for dnsjava, using non-blocking I/O to perform queries in just a couple of threads.

Thanks,


Alex.

resolve thousands of domain names (NS,AAAA records)

[srnec <pet...@gm...>]

Hi!
I need some advise. Im working on project where I need to get NS records for
list of domains (aprox. 280 000) and I need to get AAAA record for those NS
record (if they had).
My task is to test those domains if they had IPv6 support (name servers have
IPv6 address).

I tried to do it with dnsPython but I had bad results. Speed of that script
was very impressive, but I had problem getting answers for those records
after short period of time. (I got mostly timeout exception for every
record).

Now im trying to do it in dnsjava.
With my code I have speed aprox. 1min for 100 domains.
Is there any solution to speed it up?

if I am not mistaken, I read that dnsjava use threads for lookups so it
would be bad idea to insert part of the code in another threads to speed it
up?


try {
     Lookup lookup = new Lookup(domain,Type.NS);
     lookup.setCache(null);
     Record[] records = lookup.run();
                    
     for (int i=0; i<records.length; i++) {
          NSRecord ns = (NSRecord) records[i];

          Record[] ip = new Lookup(ns.toString(), Type.AAAA).run();
          try {
               System.out.println(id_domain + " - " + ns.getTarget() + " - "
+ ip[0].rdataToString());
          } catch (NullPointerException ep) {
               System.out.println(id_domain + " - " + ns.getTarget() + " -
N/A");
          }

     }
} catch (TextParseException ex) {
     Logger.getLogger(TestDnsjava.class.getName()).log(Level.SEVERE, null,
ex);}
catch (NullPointerException ep) {
     System.out.println(id_domain + " - " + domain + " - no NS");
}


and finally I apologized for my bad English :)
-- 
View this message in context: http://old.nabble.com/resolve-thousands-of-domain-names-%28NS%2CAAAA-records%29-tp35197068p35197068.html
Sent from the dnsjava-users mailing list archive at Nabble.com.

Re: DNSSEC: DS digest generation not using canonical form

[Brian W. <bwe...@xb...>]

On Mar 18, 2013, at 2:36 PM, "Ingo Bauersachs" <in...@ji...> wrote:

> Hey
> 
> The DS digest generated by DNSSEC.generateDSDigest takes the owner name of
> the DNSKEY as is instead of in canonical form. Canonical form is required by
> RFC 4034 [1]. Patch is attached.

Committed.  Thanks!

Brian

DNSSEC: DS digest generation not using canonical form

[Ingo B. <in...@ji...>]

Hey

The DS digest generated by DNSSEC.generateDSDigest takes the owner name of
the DNSKEY as is instead of in canonical form. Canonical form is required by
RFC 4034 [1]. Patch is attached.

Regards,
Ingo

[1] http://tools.ietf.org/html/rfc4034#section-5.1.4

Re: About DSRecord Constructor Issue

[Brian W. <bwe...@xb...>]

On Mar 4, 2013, at 9:31 PM, shuoleo@126 <sh...@12...> wrote:

> Hi ,
>  
> I'm using dnsjava to add DS record to BIND, but I have met a problem with the constructor of DSRecord.
>  
> String rrdata= "65512-8-2-E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766";
> String[] dsParams = rdata.split("-");
> if(dsParams != null && dsParams.length == 4){
> DSRecord dsRecord = new DSRecord(new Name(hostName), DClass.IN, ttl, Integer.valueOf(dsParams[0]).intValue(), 
> Integer.valueOf(dsParams[1]).intValue(), Integer.valueOf(dsParams[2]).intValue(), dsParams[3].getBytes());
> But I got it from BIND like the follows:
> abc.test. 3600 IN DS 65512 8 2 4532443343393136463644454541433733323934453832363846423538383530343441383333464335343539353838463441393138344346204334314135373636
>  
> which should be looks like:
> abc.test. 3600 IN DS 65512 8 2 8083381765C090E5FB9919FDF3D4473D5FBFC77C
>  
> What should I do to achieve that?
I think the problem is that you're calling the DSRecord constructor with hex-encoded bytes, rather than raw bytes.  It's probably easiest to just replace the dashes in your input and use Record.fromString() instead, but you could also decode the hex bytes before calling the constructor.

Brian

About DSRecord Constructor Issue

[<sh...@12...>]

Hi ,

I'm using dnsjava to add DS record to BIND, but I have met a problem with the constructor of DSRecord.

String rrdata= "65512-8-2-E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766"; 
String[] dsParams = rdata.split("-");
if(dsParams != null && dsParams.length == 4){
DSRecord dsRecord = new DSRecord(new Name(hostName), DClass.IN, ttl, Integer.valueOf(dsParams[0]).intValue(), 
Integer.valueOf(dsParams[1]).intValue(), Integer.valueOf(dsParams[2]).intValue(), dsParams[3].getBytes());
But I got it from BIND like the follows:
abc.test. 3600 IN DS 65512 8 2 4532443343393136463644454541433733323934453832363846423538383530343441383333464335343539353838463441393138344346204334314135373636 

which should be looks like:
abc.test. 3600 IN DS 65512 8 2 8083381765C090E5FB9919FDF3D4473D5FBFC77C 

What should I do to achieve that?




Best regards,
Stuart

Re: Firewall configurations for using DNS java as a lookup client

[Brian W. <bwe...@xb...>]

On Feb 17, 2013, at 4:47 PM, Vaibhav Bhandari <vai...@vi...> wrote:

> Sorry for a repeated questions.
> 
> Are there any best practices for how to configure firewalls to support DNS java as a lookup client (its just try to issue some DNS queries from Java primarily using TCP).
> 
> Would just opening the port 53 be sufficient?

I'm not sure that I understand the question.  Generally "opening port 53" would refer to allowing packets to come into port 53, which is certainly not required for a DNS client.  dnsjava's client will use a random port and connect outbound to port 53 for both UDP and TCP.  This usually doesn't require any firewall configuration.

Brian

Re: Firewall configurations for using DNS java as a lookup client

[Vaibhav B. <vai...@vi...>]

hi Brian --

That helps and answers my questions. I was wondering if the client would
require any firewall work.

Thanks much.

regards,
Vaibhav



On Tue, Feb 19, 2013 at 10:59 AM, Brian Wellington <bwe...@xb...>wrote:

>
> On Feb 17, 2013, at 4:47 PM, Vaibhav Bhandari <vai...@vi...>
> wrote:
>
> > Sorry for a repeated questions.
> >
> > Are there any best practices for how to configure firewalls to support
> DNS java as a lookup client (its just try to issue some DNS queries from
> Java primarily using TCP).
> >
> > Would just opening the port 53 be sufficient?
>
> I'm not sure that I understand the question.  Generally "opening port 53"
> would refer to allowing packets to come into port 53, which is certainly
> not required for a DNS client.  dnsjava's client will use a random port and
> connect outbound to port 53 for both UDP and TCP.  This usually doesn't
> require any firewall configuration.
>
> Brian
>
>


-- 
---
vai...@vi... | 206.605.6326 | http://healthblog.vitraag.com | My
O'Reilly book <http://www.enablingprogrammableself.com> on Enabling
Programmable Self with HealthVault

Firewall configurations for using DNS java as a lookup client

[Vaibhav B. <vai...@vi...>]

Sorry for a repeated questions.

Are there any best practices for how to configure firewalls to support DNS
java as a lookup client (its just try to issue some DNS queries from Java
primarily using TCP).

Would just opening the port 53 be sufficient?

regards,
Vaibhav

-- 
---
vai...@vi... | 206.605.6326 | http://healthblog.vitraag.com | My
O'Reilly book <http://www.enablingprogrammableself.com> on Enabling
Programmable Self with HealthVault

Re: UDP responses on Mac OS 10.7/java 1.6

[Norman M. <nor...@go...>]

I'm using dnsjnio in production and can really recommend it if you need an async way of using dnsjava :)


Am 07.08.2012 um 09:44 schrieb Alex Dalitz <Al...@no...>:

> On 7 Aug 2012, at 00:11, Brian Wellington wrote:
> 
>> There's no way that I know of to replace dnsjava's underlying socket code with something that doesn't use Channels, so I don't think there's a good way to work around this.
> 
> It's worth noting that dnsjnio replaces the dnsjava socket implementation with an nio implementation. This does still use Channels, and I haven't tested it against this issue. However, it might still be worth a look.
> 
> Thanks,
> 
> 
> Alex.
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> dnsjava-users mailing list
> dns...@li...
> https://lists.sourceforge.net/lists/listinfo/dnsjava-users

Re: UDP responses on Mac OS 10.7/java 1.6

[Alex D. <Al...@no...>]

On 7 Aug 2012, at 00:11, Brian Wellington wrote:

> There's no way that I know of to replace dnsjava's underlying socket code with something that doesn't use Channels, so I don't think there's a good way to work around this.

It's worth noting that dnsjnio replaces the dnsjava socket implementation with an nio implementation. This does still use Channels, and I haven't tested it against this issue. However, it might still be worth a look.

Thanks,


Alex.

Re: UDP responses on Mac OS 10.7/java 1.6

[Casey D. <ca...@de...>]

On Mon, Aug 6, 2012 at 2:50 PM, Brian Wellington <bwe...@xb...> wrote:

>
> On Aug 6, 2012, at 2:46 PM, Casey Deccio <ca...@de...> wrote:
>
> I'm curious why UDP responses for dnsjava are looked at as "incoming
> connections", whereas UDP responses for ISC's dig, for example, don't have
> this problem.
>
>
> I don't know.  Both should be doing similar operations, but there's
> obviously some difference (unless there's something else giving dig extra
> permissions, but I don't see it).
>
>
Hmm, this is indeed an issue.  I can see now why "java" shows up my
firewall list at all.  I am running another app that listens (i.e., as a
server), and when I first launched it (weeks ago), OS X asked me if I waned
to allow incoming connections, to which I responded "no".  Of course, this
is precisely why adding "java" to a firewall whitelist isn't the right
solution at all--really that could be anything.  I tried removing the rule
altogether, but that didn't help either at this point; apparently there is
a "default deny" policy.  Did you have "java" listed under your firewall
rules with an explicit "allow"?

Of course, this doesn't help solve the issue of why a UDP response (from
java anyway) looks like a new connection and is thus blocked, instead of
seeing it as the response to an outgoing "connection".

> Would a simple UDP client/server test work with DatagramPacket?  I assume
> using the lower level interfaces in dnsjava is to obtain source port
> randomization?  Is it possible that makes it behave differently, in terms
> of state?
>
>
> It's using the interfaces it does because of source port randomization,
> but opening a UDP socket by address and port shouldn't be any different,
> security wise, from opening a UDP socket with a given address and the
> wildcard port.
>
>
I tested a sample Client/Server example [1] for kicks to see the results,
and the firewall didn't seem to impede this client from getting responses
with the same configuration that had blocked the responses for dnsjava.

For the app I'm writing, I certainly could try to detect this behavior and
fail gracefully, but it would be great to try to nail down this issue for
clients that might be in my predicament.

By the way, thanks for your work on such an elegant, featured DNS library
in java!

Casey

[1] http://systembash.com/content/a-simple-java-udp-server-and-udp-client/

Re: UDP responses on Mac OS 10.7/java 1.6

[Casey D. <ca...@de...>]

On Mon, Aug 6, 2012 at 4:03 PM, Casey Deccio <ca...@de...> wrote:

> I tested a sample Client/Server example [1] for kicks to see the results,
> and the firewall didn't seem to impede this client from getting responses
> with the same configuration that had blocked the responses for dnsjava.
>
>
> [1] http://systembash.com/content/a-simple-java-udp-server-and-udp-client/
>

I forgot to mention that I modified the code, such that it was using a
remote host and not localhost, as responses from localhost aren't impeded
by the firewall apparently.

Casey

Re: UDP responses on Mac OS 10.7/java 1.6

[Brian W. <bwe...@xb...>]

On Aug 6, 2012, at 4:03 PM, Casey Deccio <ca...@de...> wrote:

> On Mon, Aug 6, 2012 at 2:50 PM, Brian Wellington <bwe...@xb...> wrote:
> 
> On Aug 6, 2012, at 2:46 PM, Casey Deccio <ca...@de...> wrote:
> 
>> I'm curious why UDP responses for dnsjava are looked at as "incoming connections", whereas UDP responses for ISC's dig, for example, don't have this problem.
> 
> I don't know.  Both should be doing similar operations, but there's obviously some difference (unless there's something else giving dig extra permissions, but I don't see it).
> 
>  
> Hmm, this is indeed an issue.  I can see now why "java" shows up my firewall list at all.  I am running another app that listens (i.e., as a server), and when I first launched it (weeks ago), OS X asked me if I waned to allow incoming connections, to which I responded "no".  Of course, this is precisely why adding "java" to a firewall whitelist isn't the right solution at all--really that could be anything.  I tried removing the rule altogether, but that didn't help either at this point; apparently there is a "default deny" policy.  Did you have "java" listed under your firewall rules with an explicit "allow"?

I do have java set to allow; it didn't work otherwise.   I agree that having a firewall rule based on "java" is stupid, but I don't think that can be fixed.

> Of course, this doesn't help solve the issue of why a UDP response (from java anyway) looks like a new connection and is thus blocked, instead of seeing it as the response to an outgoing "connection".
>> Would a simple UDP client/server test work with DatagramPacket?  I assume using the lower level interfaces in dnsjava is to obtain source port randomization?  Is it possible that makes it behave differently, in terms of state?
> 
> It's using the interfaces it does because of source port randomization, but opening a UDP socket by address and port shouldn't be any different, security wise, from opening a UDP socket with a given address and the wildcard port.
> 
> 
> I tested a sample Client/Server example [1] for kicks to see the results, and the firewall didn't seem to impede this client from getting responses with the same configuration that had blocked the responses for dnsjava.

I suspect that the problem is the fact that dnsjava is using Channels (which probably map to select() or kqueue), while that example is just using sendto/recvfrom.  Channels are used because there more flexible, and allow better handling of timeouts.

> For the app I'm writing, I certainly could try to detect this behavior and fail gracefully, but it would be great to try to nail down this issue for clients that might be in my predicament.

There's no way that I know of to replace dnsjava's underlying socket code with something that doesn't use Channels, so I don't think there's a good way to work around this.

> By the way, thanks for your work on such an elegant, featured DNS library in java!

Thanks!  I'm glad you're finding it useful.

Brian