From a615413640a1e9ded6e181bc2cfdef59efcede3a Mon Sep 17 00:00:00 2001 From: Matt Corallo Date: Mon, 26 Feb 2024 03:04:52 +0000 Subject: [PATCH] Add de/serialization and structs for NSec and NSec3 records --- src/rr.rs | 158 +++++++++++++++++++++++++++++++++++++++++++++++++++++ src/ser.rs | 50 +++++++++++++++++ 2 files changed, 208 insertions(+) diff --git a/src/rr.rs b/src/rr.rs index c464462..253c412 100644 --- a/src/rr.rs +++ b/src/rr.rs @@ -101,6 +101,10 @@ pub enum RR { DS(DS), /// A Resource Record Signature record RRSig(RRSig), + /// A Next Secure Record record + NSec(NSec), + /// A Next Secure Record version 3 record + NSec3(NSec3), } impl RR { /// Gets the name this record refers to. @@ -116,6 +120,8 @@ impl RR { RR::DnsKey(rr) => &rr.name, RR::DS(rr) => &rr.name, RR::RRSig(rr) => &rr.name, + RR::NSec(rr) => &rr.name, + RR::NSec3(rr) => &rr.name, } } /// Gets a JSON encoding of this record @@ -131,6 +137,8 @@ impl RR { RR::DnsKey(rr) => StaticRecord::json(rr), RR::DS(rr) => StaticRecord::json(rr), RR::RRSig(rr) => StaticRecord::json(rr), + RR::NSec(rr) => StaticRecord::json(rr), + RR::NSec3(rr) => StaticRecord::json(rr), } } fn ty(&self) -> u16 { @@ -145,6 +153,8 @@ impl RR { RR::DnsKey(_) => DnsKey::TYPE, RR::DS(_) => DS::TYPE, RR::RRSig(_) => RRSig::TYPE, + RR::NSec(_) => NSec::TYPE, + RR::NSec3(_) => NSec3::TYPE, } } fn write_u16_len_prefixed_data(&self, out: &mut Vec) { @@ -159,6 +169,8 @@ impl RR { RR::DnsKey(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::DS(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::RRSig(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), + RR::NSec(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), + RR::NSec3(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), } } fn ty_to_rr_name(ty: u16) -> Option<&'static str> { @@ -189,6 +201,8 @@ impl From for RR { fn from(tlsa: TLSA) -> RR { RR::TLSA(tlsa) } } impl From for RR { fn from(dnskey: DnsKey) -> RR { RR::DnsKey(dnskey) } } impl From for RR { fn from(ds: DS) -> RR { RR::DS(ds) } } impl From for RR { fn from(rrsig: RRSig) -> RR { RR::RRSig(rrsig) } } +impl From for RR { fn from(nsec: NSec) -> RR { RR::NSec(nsec) } } +impl From for RR { fn from(nsec3: NSec3) -> RR { RR::NSec3(nsec3) } } pub(crate) trait StaticRecord : Ord + Sized { // http://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4 @@ -611,6 +625,150 @@ impl StaticRecord for RRSig { } } +#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] +/// A mask used in [`NSec`] and [`NSec3`] records which indicates the resource record types which +/// exist at the (hash of the) name described in [`Record::name`]. +pub struct NSecTypeMask([u8; 8192]); +impl NSecTypeMask { + /// Constructs a new, empty, type mask. + pub fn new() -> Self { Self([0; 8192]) } + /// Checks if the given type (from [`Record::ty`]) is set, indicating a record of this type + /// exists. + pub fn contains_type(&self, ty: u16) -> bool { + let f = self.0[(ty >> 3) as usize]; + // DNSSEC's bit fields are in wire order, so the high bit is type 0, etc. + f & (1 << (7 - (ty & 3))) != 0 + } + fn write_json(&self, s: &mut String) { + *s += "["; + let mut have_written = false; + for (idx, mask) in self.0.iter().enumerate() { + if *mask == 0 { continue; } + for b in 0..8 { + if *mask & (1 << b) != 0 { + if have_written { + *s += ","; + } + have_written = true; + let ty = ((idx as u16) << 3) | (7 - b); + match RR::ty_to_rr_name(ty) { + Some(name) => write!(s, "\"{}\"", name).expect("Writes to a string shouldn't fail"), + _ => write!(s, "{}", ty).expect("Writes to a string shouldn't fail"), + } + } + } + } + *s += "]"; + } +} + +#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] +/// A Next Secure Record resource record. This indicates a range of possible names for which there +/// is no such record. +pub struct NSec { + /// The name this record is at. + pub name: Name, + /// The next name which contains a record. There are no names between `name` and + /// [`Self::next_name`]. + pub next_name: Name, + /// The set of record types which exist at `name`. Any other record types do not exist at + /// `name`. + pub types: NSecTypeMask, +} +impl StaticRecord for NSec { + const TYPE: u16 = 47; + fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + let mut out = String::with_capacity(256 + self.next_name.len()); + write!(&mut out, + "{{\"type\":\"nsec\",\"name\":\"{}\",\"next_name\":\"{}\",\"types\":", + self.name.0, self.next_name.0, + ).expect("Write to a String shouldn't fail"); + self.types.write_json(&mut out); + out += "}"; + out + } + fn read_from_data(name: Name, mut data: &[u8], wire_packet: &[u8]) -> Result { + let res = NSec { + name, next_name: read_wire_packet_name(&mut data, wire_packet)?, + types: NSecTypeMask(read_nsec_types_bitmap(&mut data)?), + }; + debug_assert!(data.is_empty()); + Ok(res) + } + fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + let len = name_len(&self.next_name) + nsec_types_bitmap_len(&self.types.0); + out.extend_from_slice(&len.to_be_bytes()); + write_name(out, &self.next_name); + write_nsec_types_bitmap(out, &self.types.0); + } +} + +#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] +/// A Next Secure Record resource record. This indicates a range of possible names for which there +/// is no such record. +pub struct NSec3 { + /// The name this record is at. + pub name: Name, + /// The hash algorithm used to hash the `name` and [`Self::next_name_hash`]. Currently only 1 + /// (SHA-1) is defined. + pub hash_algo: u8, + /// Flags for this record. Currently only bit 0 (the "opt-out" bit) is defined. + pub flags: u8, + /// The number of hash iterations required. + /// + /// As of RFC 9276 this MUST be set to 0, but sadly is often still set higher in the wild. A + /// hard cap is applied in validation. + pub hash_iterations: u16, + /// The salt included in the hash. + /// + /// As of RFC 9276 this SHOULD be empty, but often isn't in the wild. + pub salt: Vec, + /// The hash of the next name which contains a record. There are no records who's name's hash + /// lies between `name` and [`Self::next_name_hash`]. + pub next_name_hash: Vec, + /// The set of record types which exist at `name`. Any other record types do not exist at + /// `name`. + pub types: NSecTypeMask, +} +impl StaticRecord for NSec3 { + const TYPE: u16 = 50; + fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + let mut out = String::with_capacity(256); + write!(&mut out, + "{{\"type\":\"nsec3\",\"name\":\"{}\",\"hash_algo\":{},\"flags\":{},\"hash_iterations\":{},\"salt\":{:?},\"next_name_hash\":{:?},\"types\":", + self.name.0, self.hash_algo, self.flags, self.hash_iterations, &self.salt[..], &self.next_name_hash[..] + ).expect("Write to a String shouldn't fail"); + self.types.write_json(&mut out); + out += "}"; + out + } + fn read_from_data(name: Name, mut data: &[u8], _wire_packet: &[u8]) -> Result { + let res = NSec3 { + name, hash_algo: read_u8(&mut data)?, flags: read_u8(&mut data)?, + hash_iterations: read_u16(&mut data)?, salt: read_u8_len_prefixed_bytes(&mut data)?, + next_name_hash: read_u8_len_prefixed_bytes(&mut data)?, + types: NSecTypeMask(read_nsec_types_bitmap(&mut data)?), + }; + debug_assert!(data.is_empty()); + Ok(res) + } + fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + let len = 4 + 2 + self.salt.len() as u16 + self.next_name_hash.len() as u16 + + nsec_types_bitmap_len(&self.types.0); + out.extend_from_slice(&len.to_be_bytes()); + out.extend_from_slice(&self.hash_algo.to_be_bytes()); + out.extend_from_slice(&self.flags.to_be_bytes()); + out.extend_from_slice(&self.hash_iterations.to_be_bytes()); + out.extend_from_slice(&(self.salt.len() as u8).to_be_bytes()); + out.extend_from_slice(&self.salt); + out.extend_from_slice(&(self.next_name_hash.len() as u8).to_be_bytes()); + out.extend_from_slice(&self.next_name_hash); + write_nsec_types_bitmap(out, &self.types.0); + } +} + #[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] /// An IPv4 Address resource record pub struct A { diff --git a/src/ser.rs b/src/ser.rs index 779bcec..6063ba9 100644 --- a/src/ser.rs +++ b/src/ser.rs @@ -26,6 +26,54 @@ pub(crate) fn read_u32(inp: &mut &[u8]) -> Result { Ok(u32::from_be_bytes(bytes)) } +pub(crate) fn read_u8_len_prefixed_bytes(inp: &mut &[u8]) -> Result, ()> { + let len = *inp.get(0).ok_or(())?; + *inp = &inp[1..]; + if inp.len() < len.into() { return Err(()); } + let mut res = Vec::with_capacity(len.into()); + res.extend_from_slice(&inp[..len.into()]); + *inp = &inp[len.into()..]; + Ok(res) +} + +pub(crate) fn write_nsec_types_bitmap(out: &mut W, types: &[u8; 8192]) { + for (idx, flags) in types.chunks(32).enumerate() { + debug_assert_eq!(flags.len(), 32); + if flags != &[0; 32] { + let last_nonzero_idx = flags.iter().rposition(|flag| *flag != 0) + .unwrap_or_else(|| { debug_assert!(false); 0 }); + out.write(&(idx as u8).to_be_bytes()); + out.write(&(last_nonzero_idx as u8 + 1).to_be_bytes()); + out.write(&flags[..last_nonzero_idx + 1]); + } + } +} +pub(crate) fn nsec_types_bitmap_len(types: &[u8; 8192]) -> u16 { + let mut total_len = 0; + for flags in types.chunks(32) { + debug_assert_eq!(flags.len(), 32); + if flags != &[0; 32] { + total_len += 3 + flags.iter().rposition(|flag| *flag != 0) + .unwrap_or_else(|| { debug_assert!(false); 0 }) as u16; + } + } + total_len +} + +pub(crate) fn read_nsec_types_bitmap(inp: &mut &[u8]) -> Result<[u8; 8192], ()> { + let mut res = [0; 8192]; + while !inp.is_empty() { + let block = *inp.get(0).ok_or(())?; + let len = *inp.get(1).ok_or(())?; + *inp = &inp[2..]; + if inp.len() < len as usize { return Err(()); } + res[block as usize * 32..block as usize * 32 + len as usize] + .copy_from_slice(&inp[..len as usize]); + *inp = &inp[len as usize..]; + } + Ok(res) +} + fn do_read_wire_packet_labels(inp: &mut &[u8], wire_packet: &[u8], name: &mut String, recursion_limit: usize) -> Result<(), ()> { loop { let len = read_u8(inp)? as usize; @@ -107,6 +155,8 @@ pub(crate) fn parse_wire_packet_rr(inp: &mut &[u8], wire_packet: &[u8]) -> Resul DnsKey::TYPE => RR::DnsKey(DnsKey::read_from_data(name, data, wire_packet)?), DS::TYPE => RR::DS(DS::read_from_data(name, data, wire_packet)?), RRSig::TYPE => RR::RRSig(RRSig::read_from_data(name, data, wire_packet)?), + NSec::TYPE => RR::NSec(NSec::read_from_data(name, data, wire_packet)?), + NSec3::TYPE => RR::NSec3(NSec3::read_from_data(name, data, wire_packet)?), _ => return Err(()), }; Ok((rr, ttl)) -- 2.39.5