_ Git - dnssec-prover/blob - src/http.rs

   1 //! A simple tokio-based HTTP server which serves DNSSEC proofs in RFC 9102 format.
   2
   3 #![deny(missing_docs)]
   4
   5 // const_slice_from_raw_parts was stabilized in 1.64, however we support building on 1.63 as well.
   6 // Luckily, it seems to work fine in 1.63 with the feature flag (and RUSTC_BOOTSTRAP=1) enabled.
   7 #![cfg_attr(all(feature = "validation", rust_1_63), feature(const_slice_from_raw_parts))]
   8
   9 #![allow(clippy::new_without_default)] // why is this even a lint
  10 #![allow(clippy::result_unit_err)] // Why in the hell is this a lint?
  11 #![allow(clippy::get_first)] // Sometimes this improves readability
  12 #![allow(clippy::needless_lifetimes)] // lifetimes improve readability
  13 #![allow(clippy::needless_borrow)] // borrows indicate read-only/non-move
  14 #![allow(clippy::too_many_arguments)] // sometimes we don't have an option
  15 #![allow(clippy::identity_op)] // sometimes identities improve readability for repeated actions
  16 #![allow(clippy::erasing_op)] // sometimes identities improve readability for repeated actions
  17
  18 extern crate alloc;
  19
  20 pub mod rr;
  21 pub mod ser;
  22 pub mod query;
  23
  24 #[cfg(feature = "validation")]
  25 mod base32;
  26 #[cfg(feature = "validation")]
  27 mod crypto;
  28 #[cfg(feature = "validation")]
  29 pub mod validation;
  30
  31 #[cfg(any(feature = "build_server", all(feature = "tokio", feature = "validation")))]
  32 use tokio_crate as tokio;
  33
  34 #[cfg(feature = "build_server")]
  35 #[tokio::main]
  36 async fn main() {
  37         let resolver_sockaddr = std::env::var("RESOLVER")
  38                 .expect("Please set the RESOLVER env variable to the TCP socket of a recursive DNS resolver")
  39                 .parse().expect("RESOLVER was not a valid socket address");
  40         let bind_addr = std::env::var("BIND")
  41                 .expect("Please set the BIND env variable to a socket address to listen on");
  42
  43         let listener = tokio::net::TcpListener::bind(bind_addr).await
  44                 .expect("Failed to bind to socket");
  45         imp::run_server(listener, resolver_sockaddr).await;
  46 }
  47
  48 #[cfg(any(feature = "build_server", all(feature = "tokio", feature = "validation")))]
  49 mod imp {
  50         use super::*;
  51
  52         use rr::Name;
  53         use query::*;
  54
  55         use std::net::SocketAddr;
  56
  57         use tokio::net::TcpListener;
  58         use tokio::io::{AsyncReadExt, AsyncWriteExt};
  59
  60         pub(super) async fn run_server(listener: TcpListener, resolver_sockaddr: SocketAddr) {
  61                 loop {
  62                         let (mut socket, _) = listener.accept().await.expect("Failed to accept new TCP connection");
  63                         tokio::spawn(async move {
  64                                 let mut response = ("400 Bad Request", "Bad Request");
  65                                 'ret_err: loop { // goto label
  66                                         let mut buf = [0; 4096];
  67                                         let mut buf_pos = 0;
  68                                         'read_req: loop {
  69                                                 if buf_pos == buf.len() { response.1 = "Request Too Large"; break 'ret_err; }
  70                                                 let read_res = { socket.read(&mut buf[buf_pos..]).await };
  71                                                 match read_res {
  72                                                         Ok(0) => return,
  73                                                         Ok(len) => {
  74                                                                 buf_pos += len;
  75                                                                 for window in buf[..buf_pos].windows(2) {
  76                                                                         if window == b"\r\n" { break 'read_req; }
  77                                                                 }
  78                                                         }
  79                                                         Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => {},
  80                                                         Err(_) => return,
  81                                                 }
  82                                         }
  83                                         let request;
  84                                         if let Ok(s) = std::str::from_utf8(&buf[..buf_pos]) {
  85                                                 if let Some((r, _)) = s.split_once("\r\n") {
  86                                                         request = r;
  87                                                 } else {
  88                                                         debug_assert!(false);
  89                                                         break 'ret_err;
  90                                                 }
  91                                         } else {
  92                                                 break 'ret_err;
  93                                         }
  94
  95                                         let mut parts = request.split(" ");
  96                                         let (verb, path, http_vers);
  97                                         if let Some(v) = parts.next() { verb = v; } else { break 'ret_err; }
  98                                         if let Some(p) = parts.next() { path = p; } else { break 'ret_err; }
  99                                         if let Some(v) = parts.next() { http_vers = v; } else { break 'ret_err; }
 100                                         if parts.next().is_some() { break; }
 101                                         if verb != "GET" { break; }
 102                                         if http_vers != "HTTP/1.1" && http_vers != "HTTP/1.0" { break 'ret_err; }
 103
 104                                         const PATH_PFX: &'static str = "/dnssecproof?";
 105                                         if !path.starts_with(PATH_PFX) {
 106                                                 response = ("404 Not Found", "Not Found");
 107                                                 break 'ret_err;
 108                                         }
 109
 110                                         let (mut d, mut t) = ("", "");
 111                                         for arg in path[PATH_PFX.len()..].split("&") {
 112                                                 if let Some((k, v)) = arg.split_once("=") {
 113                                                         if k == "d" {
 114                                                                 d = v;
 115                                                         } else if k == "t" {
 116                                                                 t = v;
 117                                                         }
 118                                                 } else { break 'ret_err; }
 119                                         }
 120
 121                                         if d == "" || t == "" {
 122                                                 response.1 = "Missing d or t URI parameters";
 123                                                 break 'ret_err;
 124                                         }
 125                                         let query_name = if let Ok(domain) = Name::try_from(d) { domain } else {
 126                                                 response.1 = "Failed to parse domain, make sure it ends with .";
 127                                                 break 'ret_err;
 128                                         };
 129                                         let proof_res = match t.to_ascii_uppercase().as_str() {
 130                                                 "TXT" => build_txt_proof_async(resolver_sockaddr, &query_name).await,
 131                                                 "TLSA" => build_tlsa_proof_async(resolver_sockaddr, &query_name).await,
 132                                                 "A" => build_a_proof_async(resolver_sockaddr, &query_name).await,
 133                                                 "AAAA" => build_aaaa_proof_async(resolver_sockaddr, &query_name).await,
 134                                                 _ => break 'ret_err,
 135                                         };
 136                                         let (proof, cache_ttl) = if let Ok(proof) = proof_res { proof } else {
 137                                                 response = ("404 Not Found", "Failed to generate proof for given domain");
 138                                                 break 'ret_err;
 139                                         };
 140
 141                                         let _ = socket.write_all(
 142                                                 format!(
 143                                                         "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nContent-Type: application/octet-stream\r\nCache-Control: public, max-age={}, s-maxage={}\r\nAccess-Control-Allow-Origin: *\r\n\r\n",
 144                                                         proof.len(), cache_ttl, cache_ttl
 145                                                 ).as_bytes()
 146                                         ).await;
 147                                         let _ = socket.write_all(&proof).await;
 148                                         return;
 149                                 }
 150                                 let _ = socket.write_all(format!(
 151                                         "HTTP/1.1 {}\r\nContent-Length: {}\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\n\r\n{}",
 152                                         response.0, response.1.len(), response.1,
 153                                 ).as_bytes()).await;
 154                         });
 155                 }
 156         }
 157 }
 158
 159 #[cfg(all(feature = "tokio", feature = "validation", test))]
 160 mod test {
 161         use super::*;
 162
 163         use crate::ser::parse_rr_stream;
 164         use crate::validation::verify_rr_stream;
 165
 166         use minreq;
 167
 168         #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
 169         async fn test_lookup() {
 170                 let ns = "8.8.8.8:53".parse().unwrap();
 171                 let listener = tokio::net::TcpListener::bind("127.0.0.1:17492").await
 172                         .expect("Failed to bind to socket");
 173                 tokio::spawn(imp::run_server(listener, ns));
 174                 let resp = minreq::get(
 175                         "http://127.0.0.1:17492/dnssecproof?d=matt.user._bitcoin-payment.mattcorallo.com.&t=tXt"
 176                 ).send().unwrap();
 177
 178                 assert_eq!(resp.status_code, 200);
 179                 let rrs = parse_rr_stream(resp.as_bytes()).unwrap();
 180                 let verified_rrs = verify_rr_stream(&rrs).unwrap();
 181                 assert_eq!(verified_rrs.verified_rrs.len(), 1);
 182         }
 183
 184         #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
 185         async fn test_lookup_a() {
 186                 let ns = "9.9.9.9:53".parse().unwrap();
 187                 let listener = tokio::net::TcpListener::bind("127.0.0.1:17493").await
 188                         .expect("Failed to bind to socket");
 189                 tokio::spawn(imp::run_server(listener, ns));
 190                 let resp = minreq::get(
 191                         "http://127.0.0.1:17493/dnssecproof?d=cloudflare.com.&t=a"
 192                 ).send().unwrap();
 193
 194                 assert_eq!(resp.status_code, 200);
 195                 let rrs = parse_rr_stream(resp.as_bytes()).unwrap();
 196                 let verified_rrs = verify_rr_stream(&rrs).unwrap();
 197                 assert!(verified_rrs.verified_rrs.len() >= 1);
 198         }
 199
 200         #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
 201         async fn test_lookup_tlsa() {
 202                 let ns = "1.1.1.1:53".parse().unwrap();
 203                 let listener = tokio::net::TcpListener::bind("127.0.0.1:17494").await
 204                         .expect("Failed to bind to socket");
 205                 tokio::spawn(imp::run_server(listener, ns));
 206                 let resp = minreq::get(
 207                         "http://127.0.0.1:17494/dnssecproof?d=_25._tcp.mail.as397444.net.&t=TLSA"
 208                 ).send().unwrap();
 209
 210                 assert_eq!(resp.status_code, 200);
 211                 let rrs = parse_rr_stream(resp.as_bytes()).unwrap();
 212                 let verified_rrs = verify_rr_stream(&rrs).unwrap();
 213                 assert_eq!(verified_rrs.verified_rrs.len(), 1);
 214         }
 215 }