1 //! A simple tokio-based HTTP server which serves DNSSEC proofs in RFC 9102 format.
5 // const_slice_from_raw_parts was stabilized in 1.64, however we support building on 1.63 as well.
6 // Luckily, it seems to work fine in 1.63 with the feature flag (and RUSTC_BOOTSTRAP=1) enabled.
7 #![cfg_attr(all(feature = "validation", rust_1_63), feature(const_slice_from_raw_parts))]
9 #![allow(clippy::new_without_default)] // why is this even a lint
10 #![allow(clippy::result_unit_err)] // Why in the hell is this a lint?
11 #![allow(clippy::get_first)] // Sometimes this improves readability
12 #![allow(clippy::needless_lifetimes)] // lifetimes improve readability
13 #![allow(clippy::needless_borrow)] // borrows indicate read-only/non-move
14 #![allow(clippy::too_many_arguments)] // sometimes we don't have an option
15 #![allow(clippy::identity_op)] // sometimes identities improve readability for repeated actions
16 #![allow(clippy::erasing_op)] // sometimes identities improve readability for repeated actions
24 #[cfg(feature = "validation")]
26 #[cfg(feature = "validation")]
28 #[cfg(feature = "validation")]
31 #[cfg(any(feature = "build_server", all(feature = "tokio", feature = "validation")))]
32 use tokio_crate as tokio;
34 #[cfg(feature = "build_server")]
37 let resolver_sockaddr = std::env::var("RESOLVER")
38 .expect("Please set the RESOLVER env variable to the TCP socket of a recursive DNS resolver")
39 .parse().expect("RESOLVER was not a valid socket address");
40 let bind_addr = std::env::var("BIND")
41 .expect("Please set the BIND env variable to a socket address to listen on");
43 let listener = tokio::net::TcpListener::bind(bind_addr).await
44 .expect("Failed to bind to socket");
45 imp::run_server(listener, resolver_sockaddr).await;
48 #[cfg(not(feature = "build_server"))]
49 fn main() { panic!("You need to enable the `build_server` feature to use the built-in server"); }
51 #[cfg(any(feature = "build_server", all(feature = "tokio", feature = "validation")))]
58 use std::net::SocketAddr;
60 use tokio::net::TcpListener;
61 use tokio::io::{AsyncReadExt, AsyncWriteExt};
63 pub(super) async fn run_server(listener: TcpListener, resolver_sockaddr: SocketAddr) {
65 let (mut socket, _) = listener.accept().await.expect("Failed to accept new TCP connection");
66 tokio::spawn(async move {
67 let mut response = ("400 Bad Request", "Bad Request");
68 'ret_err: loop { // goto label
69 let mut buf = [0; 4096];
72 if buf_pos == buf.len() { response.1 = "Request Too Large"; break 'ret_err; }
73 let read_res = { socket.read(&mut buf[buf_pos..]).await };
78 for window in buf[..buf_pos].windows(2) {
79 if window == b"\r\n" { break 'read_req; }
82 Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => {},
87 if let Ok(s) = std::str::from_utf8(&buf[..buf_pos]) {
88 if let Some((r, _)) = s.split_once("\r\n") {
98 let mut parts = request.split(" ");
99 let (verb, path, http_vers);
100 if let Some(v) = parts.next() { verb = v; } else { break 'ret_err; }
101 if let Some(p) = parts.next() { path = p; } else { break 'ret_err; }
102 if let Some(v) = parts.next() { http_vers = v; } else { break 'ret_err; }
103 if parts.next().is_some() { break; }
104 if verb != "GET" { break; }
105 if http_vers != "HTTP/1.1" && http_vers != "HTTP/1.0" { break 'ret_err; }
107 const PATH_PFX: &'static str = "/dnssecproof?";
108 if !path.starts_with(PATH_PFX) {
109 response = ("404 Not Found", "Not Found");
113 let (mut d, mut t) = ("", "");
114 for arg in path[PATH_PFX.len()..].split("&") {
115 if let Some((k, v)) = arg.split_once("=") {
121 } else { break 'ret_err; }
124 if d == "" || t == "" {
125 response.1 = "Missing d or t URI parameters";
128 let query_name = if let Ok(domain) = Name::try_from(d) { domain } else {
129 response.1 = "Failed to parse domain, make sure it ends with .";
132 let proof_res = match t.to_ascii_uppercase().as_str() {
133 "TXT" => build_txt_proof_async(resolver_sockaddr, &query_name).await,
134 "TLSA" => build_tlsa_proof_async(resolver_sockaddr, &query_name).await,
135 "A" => build_a_proof_async(resolver_sockaddr, &query_name).await,
136 "AAAA" => build_aaaa_proof_async(resolver_sockaddr, &query_name).await,
139 let (proof, cache_ttl) = if let Ok(proof) = proof_res { proof } else {
140 response = ("404 Not Found", "Failed to generate proof for given domain");
144 let _ = socket.write_all(
146 "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nContent-Type: application/octet-stream\r\nCache-Control: public, max-age={}, s-maxage={}\r\nAccess-Control-Allow-Origin: *\r\n\r\n",
147 proof.len(), cache_ttl, cache_ttl
150 let _ = socket.write_all(&proof).await;
153 let _ = socket.write_all(format!(
154 "HTTP/1.1 {}\r\nContent-Length: {}\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\n\r\n{}",
155 response.0, response.1.len(), response.1,
162 #[cfg(all(feature = "tokio", feature = "validation", test))]
166 use crate::ser::parse_rr_stream;
167 use crate::validation::verify_rr_stream;
171 #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
172 async fn test_lookup() {
173 let ns = "8.8.8.8:53".parse().unwrap();
174 let listener = tokio::net::TcpListener::bind("127.0.0.1:17492").await
175 .expect("Failed to bind to socket");
176 tokio::spawn(imp::run_server(listener, ns));
177 let resp = minreq::get(
178 "http://127.0.0.1:17492/dnssecproof?d=matt.user._bitcoin-payment.mattcorallo.com.&t=tXt"
181 assert_eq!(resp.status_code, 200);
182 let rrs = parse_rr_stream(resp.as_bytes()).unwrap();
183 let verified_rrs = verify_rr_stream(&rrs).unwrap();
184 assert_eq!(verified_rrs.verified_rrs.len(), 1);
187 #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
188 async fn test_lookup_a() {
189 let ns = "9.9.9.9:53".parse().unwrap();
190 let listener = tokio::net::TcpListener::bind("127.0.0.1:17493").await
191 .expect("Failed to bind to socket");
192 tokio::spawn(imp::run_server(listener, ns));
193 let resp = minreq::get(
194 "http://127.0.0.1:17493/dnssecproof?d=cloudflare.com.&t=a"
197 assert_eq!(resp.status_code, 200);
198 let rrs = parse_rr_stream(resp.as_bytes()).unwrap();
199 let verified_rrs = verify_rr_stream(&rrs).unwrap();
200 assert!(verified_rrs.verified_rrs.len() >= 1);
203 #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
204 async fn test_lookup_tlsa() {
205 let ns = "1.1.1.1:53".parse().unwrap();
206 let listener = tokio::net::TcpListener::bind("127.0.0.1:17494").await
207 .expect("Failed to bind to socket");
208 tokio::spawn(imp::run_server(listener, ns));
209 let resp = minreq::get(
210 "http://127.0.0.1:17494/dnssecproof?d=_25._tcp.mail.as397444.net.&t=TLSA"
213 assert_eq!(resp.status_code, 200);
214 let rrs = parse_rr_stream(resp.as_bytes()).unwrap();
215 let verified_rrs = verify_rr_stream(&rrs).unwrap();
216 assert_eq!(verified_rrs.verified_rrs.len(), 1);