1 //! WASM-compatible verification wrappers
3 use dnssec_prover::ser::parse_rr_stream;
4 use dnssec_prover::validation::{verify_rr_stream, ValidationError};
5 use dnssec_prover::query::{ProofBuilder, QueryBuf};
7 use wasm_bindgen::prelude::wasm_bindgen;
10 use alloc::collections::VecDeque;
15 static ALLOC: wee_alloc::WeeAlloc = wee_alloc::WeeAlloc::INIT;
18 pub struct WASMProofBuilder(ProofBuilder, VecDeque<QueryBuf>);
21 /// Builds a proof builder which can generate a proof for records of the given `ty`pe at the given
24 /// After calling this [`get_next_query`] should be called to fetch the initial query.
25 pub fn init_proof_builder(mut name: String, ty: u16) -> Option<WASMProofBuilder> {
26 if !name.ends_with('.') { name.push('.'); }
27 if let Ok(qname) = name.try_into() {
28 let (builder, initial_query) = ProofBuilder::new(&qname, ty);
29 let mut queries = VecDeque::with_capacity(4);
30 queries.push_back(initial_query);
31 Some(WASMProofBuilder(builder, queries))
38 /// Processes a response to a query previously fetched from [`get_next_query`].
40 /// After calling this, [`get_next_query`] should be called until pending queries are exhausted and
41 /// no more pending queries exist, at which point [`get_unverified_proof`] should be called.
42 pub fn process_query_response(proof_builder: &mut WASMProofBuilder, response: Vec<u8>) {
43 if response.len() < u16::MAX as usize {
44 let mut answer = QueryBuf::new_zeroed(response.len() as u16);
45 answer.copy_from_slice(&response);
46 if let Ok(queries) = proof_builder.0.process_response(&answer) {
47 for query in queries {
48 proof_builder.1.push_back(query);
56 /// Gets the next query (if any) that should be sent to the resolver for the given proof builder.
58 /// Once the resolver responds [`process_query_response`] should be called with the response.
59 pub fn get_next_query(proof_builder: &mut WASMProofBuilder) -> Option<Vec<u8>> {
60 if let Some(query) = proof_builder.1.pop_front() {
61 Some(query.into_vec())
68 /// Gets the final, unverified, proof once all queries fetched via [`get_next_query`] have
69 /// completed and their responses passed to [`process_query_response`].
70 pub fn get_unverified_proof(proof_builder: WASMProofBuilder) -> Option<Vec<u8>> {
71 proof_builder.0.finish_proof().ok().map(|(proof, _ttl)| proof)
75 /// Verifies an RFC 9102-formatted proof and returns the [`VerifiedRRStream`] in JSON form.
76 pub fn verify_byte_stream(stream: Vec<u8>) -> String {
77 match do_verify_byte_stream(stream) {
79 Err(e) => format!("{{\"error\":\"{:?}\"}}", e),
83 fn do_verify_byte_stream(stream: Vec<u8>) -> Result<String, ValidationError> {
84 let rrs = parse_rr_stream(&stream).map_err(|()| ValidationError::Invalid)?;
85 let verified_rrs = verify_rr_stream(&rrs)?;
86 let mut resp = String::new();
87 write!(&mut resp, "{}",
88 format_args!("{{\"valid_from\": {}, \"expires\": {}, \"max_cache_ttl\": {}, \"verified_rrs\": [",
89 verified_rrs.valid_from, verified_rrs.expires, verified_rrs.max_cache_ttl)
90 ).expect("Write to a String shouldn't fail");
91 for (idx, rr) in verified_rrs.verified_rrs.iter().enumerate() {
92 write!(&mut resp, "{}{}", if idx != 0 { ", " } else { "" }, rr.json())
93 .expect("Write to a String shouldn't fail");