Txt(Txt),
/// A TLS Certificate Association resource record
TLSA(TLSA),
+ /// A Canonical Name record
+ CName(CName),
/// A DNS (Public) Key resource record
DnsKey(DnsKey),
/// A Delegated Signer resource record
pub fn name(&self) -> &Name {
match self {
RR::Txt(rr) => &rr.name,
+ RR::CName(rr) => &rr.name,
RR::TLSA(rr) => &rr.name,
RR::DnsKey(rr) => &rr.name,
RR::DS(rr) => &rr.name,
fn ty(&self) -> u16 {
match self {
RR::Txt(_) => Txt::TYPE,
+ RR::CName(_) => CName::TYPE,
RR::TLSA(_) => TLSA::TYPE,
RR::DnsKey(_) => DnsKey::TYPE,
RR::DS(_) => DS::TYPE,
fn write_u16_len_prefixed_data(&self, out: &mut Vec<u8>) {
match self {
RR::Txt(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out),
+ RR::CName(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out),
RR::TLSA(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out),
RR::DnsKey(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out),
RR::DS(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out),
}
}
impl From<Txt> for RR { fn from(txt: Txt) -> RR { RR::Txt(txt) } }
+impl From<CName> for RR { fn from(cname: CName) -> RR { RR::CName(cname) } }
impl From<TLSA> for RR { fn from(tlsa: TLSA) -> RR { RR::TLSA(tlsa) } }
impl From<DnsKey> for RR { fn from(dnskey: DnsKey) -> RR { RR::DnsKey(dnskey) } }
impl From<DS> for RR { fn from(ds: DS) -> RR { RR::DS(ds) } }
}
Ok(RR::Txt(Txt { name, data: parsed_data }))
}
+ CName::TYPE => {
+ Ok(RR::CName(CName { name, canonical_name: read_name(&mut data)? }))
+ }
TLSA::TYPE => {
if data_len <= 3 { return Err(()); }
Ok(RR::TLSA(TLSA {
}
}
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
+/// A Canonical Name resource record, referring all queries for this name to another name.
+pub struct CName {
+ /// The name this record is at.
+ pub name: Name,
+ /// The canonical name.
+ ///
+ /// A resolver should use this name when looking up any further records for [`Self::name`].
+ pub canonical_name: Name,
+}
+impl StaticRecord for CName {
+ const TYPE: u16 = 5;
+ fn name(&self) -> &Name { &self.name }
+ fn write_u16_len_prefixed_data(&self, out: &mut Vec<u8>) {
+ let len: u16 = name_len(&self.canonical_name);
+ out.extend_from_slice(&len.to_be_bytes());
+ write_name(out, &self.canonical_name);
+ }
+}
+
#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
/// A public key resource record which can be used to validate [`RRSig`]s.
pub struct DnsKey {
records.sort();
for record in records.iter() {
- // TODO: Handle wildcards
- write_name(&mut signed_data, record.name());
+ let periods = record.name().0.chars().filter(|c| *c == '.').count();
+ let labels = sig.labels.into();
+ if periods != 1 && periods != labels {
+ if periods < labels { return Err(ValidationError::Invalid); }
+ let signed_name = record.name().0.splitn(periods - labels + 1, ".").last();
+ debug_assert!(signed_name.is_some());
+ if let Some(name) = signed_name {
+ signed_data.extend_from_slice(b"\x01*");
+ write_name(&mut signed_data, name);
+ } else { return Err(ValidationError::Invalid); }
+ } else {
+ write_name(&mut signed_data, record.name());
+ }
signed_data.extend_from_slice(&record.ty().to_be_bytes());
signed_data.extend_from_slice(&1u16.to_be_bytes()); // The INternet class
signed_data.extend_from_slice(&sig.orig_ttl.to_be_bytes());
(txt_resp, txt_rrsig)
}
+ fn matcorallo_cname_record() -> (CName, RRSig) {
+ let cname_resp = CName {
+ name: "cname_test.matcorallo.com.".try_into().unwrap(),
+ canonical_name: "txt_test.matcorallo.com.".try_into().unwrap(),
+ };
+ let cname_rrsig = RRSig {
+ name: "cname_test.matcorallo.com.".try_into().unwrap(),
+ ty: CName::TYPE, alg: 13, labels: 3, orig_ttl: 30, expiration: 1708319203,
+ inception: 1707104203, key_tag: 34530, key_name: "matcorallo.com.".try_into().unwrap(),
+ signature: base64::decode("5HIrmEotbVb95umE6SX3NrPboKsthdcY8b7DdaYQZzm0Nj5m2VgcfOmEPJYS8o1xE4GvGGF4sdfSy3Uw7TibBg==").unwrap(),
+ };
+ (cname_resp, cname_rrsig)
+ }
+
+ fn matcorallo_wildcard_record() -> (Txt, RRSig) {
+ let txt_resp = Txt {
+ name: "test.wildcard_test.matcorallo.com.".try_into().unwrap(),
+ data: "wildcard_test".to_owned().into_bytes(),
+ };
+ let txt_rrsig = RRSig {
+ name: "test.wildcard_test.matcorallo.com.".try_into().unwrap(),
+ ty: Txt::TYPE, alg: 13, labels: 3, orig_ttl: 30, expiration: 1708321778,
+ inception: 1707106778, key_tag: 34530, key_name: "matcorallo.com.".try_into().unwrap(),
+ signature: base64::decode("vdnXunPY4CnbW/BL8VOOR9o33+dqyKA/4h+u5VM7NjB30Shp8L8gL5UwE0k7TKRNgHC8j3TqEPEmNMIHz87Z4Q==").unwrap(),
+ };
+ (txt_resp, txt_rrsig)
+ }
+
+ fn matcorallo_cname_wildcard_record() -> (CName, RRSig, Txt, RRSig) {
+ let cname_resp = CName {
+ name: "test.cname_wildcard_test.matcorallo.com.".try_into().unwrap(),
+ canonical_name: "cname.wildcard_test.matcorallo.com.".try_into().unwrap(),
+ };
+ let txt_resp = Txt {
+ name: "cname.wildcard_test.matcorallo.com.".try_into().unwrap(),
+ data: "wildcard_test".to_owned().into_bytes(),
+ };
+ let cname_rrsig = RRSig {
+ name: "test.cname_wildcard_test.matcorallo.com.".try_into().unwrap(),
+ ty: CName::TYPE, alg: 13, labels: 3, orig_ttl: 30, expiration: 1708322050,
+ inception: 1707107050, key_tag: 34530, key_name: "matcorallo.com.".try_into().unwrap(),
+ signature: base64::decode("JfJuSemF5dtQYxEw6eKL4IRP8BaDt6FtbtdpZ6HjODTDflhKQRhBEbwT7kwceKPAq18q5sWHFV1bMTqE/F3WLw==").unwrap(),
+ };
+ let txt_rrsig = RRSig {
+ name: "cname.wildcard_test.matcorallo.com.".try_into().unwrap(),
+ ty: Txt::TYPE, alg: 13, labels: 3, orig_ttl: 30, expiration: 1708321778,
+ inception: 1707106778, key_tag: 34530, key_name: "matcorallo.com.".try_into().unwrap(),
+ signature: base64::decode("vdnXunPY4CnbW/BL8VOOR9o33+dqyKA/4h+u5VM7NjB30Shp8L8gL5UwE0k7TKRNgHC8j3TqEPEmNMIHz87Z4Q==").unwrap(),
+ };
+ (cname_resp, cname_rrsig, txt_resp, txt_rrsig)
+ }
+
#[test]
fn check_txt_record_a() {
let dnskeys = mattcorallo_dnskey().0;
}
#[test]
- fn check_double_txt_proof() {
+ fn check_cname_record() {
+ let dnskeys = matcorallo_dnskey().0;
+ let (cname, cname_rrsig) = matcorallo_cname_record();
+ let cname_resp = [cname];
+ verify_rrsig(&cname_rrsig, &dnskeys, cname_resp.iter().collect()).unwrap();
+ }
+
+ #[test]
+ fn check_multi_zone_proof() {
let mut rr_stream = Vec::new();
for rr in root_dnskey().1 { write_rr(&rr, 1, &mut rr_stream); }
for rr in com_dnskey().1 { write_rr(&rr, 1, &mut rr_stream); }
for rr in matcorallo_dnskey().1 { write_rr(&rr, 1, &mut rr_stream); }
let (txt, txt_rrsig) = matcorallo_txt_record();
for rr in [RR::Txt(txt), RR::RRSig(txt_rrsig)] { write_rr(&rr, 1, &mut rr_stream); }
+ let (cname, cname_rrsig) = matcorallo_cname_record();
+ for rr in [RR::CName(cname), RR::RRSig(cname_rrsig)] { write_rr(&rr, 1, &mut rr_stream); }
let mut rrs = parse_rr_stream(&rr_stream).unwrap();
rrs.shuffle(&mut rand::rngs::OsRng);
let mut verified_rrs = verify_rr_stream(&rrs).unwrap();
verified_rrs.sort();
- assert_eq!(verified_rrs.len(), 2);
+ assert_eq!(verified_rrs.len(), 3);
if let RR::Txt(txt) = &verified_rrs[0] {
assert_eq!(txt.name.0, "matt.user._bitcoin-payment.mattcorallo.com.");
assert_eq!(txt.data, b"bitcoin:?b12=lno1qsgqmqvgm96frzdg8m0gc6nzeqffvzsqzrxqy32afmr3jn9ggkwg3egfwch2hy0l6jut6vfd8vpsc3h89l6u3dm4q2d6nuamav3w27xvdmv3lpgklhg7l5teypqz9l53hj7zvuaenh34xqsz2sa967yzqkylfu9xtcd5ymcmfp32h083e805y7jfd236w9afhavqqvl8uyma7x77yun4ehe9pnhu2gekjguexmxpqjcr2j822xr7q34p078gzslf9wpwz5y57alxu99s0z2ql0kfqvwhzycqq45ehh58xnfpuek80hw6spvwrvttjrrq9pphh0dpydh06qqspp5uq4gpyt6n9mwexde44qv7lstzzq60nr40ff38u27un6y53aypmx0p4qruk2tf9mjwqlhxak4znvna5y");
assert_eq!(txt.name.0, "txt_test.matcorallo.com.");
assert_eq!(txt.data, b"dnssec_prover_test");
} else { panic!(); }
+ if let RR::CName(cname) = &verified_rrs[2] {
+ assert_eq!(cname.name.0, "cname_test.matcorallo.com.");
+ assert_eq!(cname.canonical_name.0, "txt_test.matcorallo.com.");
+ } else { panic!(); }
+ }
+
+ #[test]
+ fn check_wildcard_record() {
+ let dnskeys = matcorallo_dnskey().0;
+ let (txt, txt_rrsig) = matcorallo_wildcard_record();
+ let txt_resp = [txt];
+ verify_rrsig(&txt_rrsig, &dnskeys, txt_resp.iter().collect()).unwrap();
+ }
+
+ #[test]
+ fn check_wildcard_proof() {
+ let mut rr_stream = Vec::new();
+ for rr in root_dnskey().1 { write_rr(&rr, 1, &mut rr_stream); }
+ for rr in com_dnskey().1 { write_rr(&rr, 1, &mut rr_stream); }
+ for rr in matcorallo_dnskey().1 { write_rr(&rr, 1, &mut rr_stream); }
+ let (cname, cname_rrsig, txt, txt_rrsig) = matcorallo_cname_wildcard_record();
+ for rr in [RR::CName(cname), RR::RRSig(cname_rrsig)] { write_rr(&rr, 1, &mut rr_stream); }
+ for rr in [RR::Txt(txt), RR::RRSig(txt_rrsig)] { write_rr(&rr, 1, &mut rr_stream); }
+
+ let mut rrs = parse_rr_stream(&rr_stream).unwrap();
+ rrs.shuffle(&mut rand::rngs::OsRng);
+ let mut verified_rrs = verify_rr_stream(&rrs).unwrap();
+ verified_rrs.sort();
+ assert_eq!(verified_rrs.len(), 2);
+ if let RR::Txt(txt) = &verified_rrs[0] {
+ assert_eq!(txt.name.0, "cname.wildcard_test.matcorallo.com.");
+ assert_eq!(txt.data, b"wildcard_test");
+ } else { panic!(); }
+ if let RR::CName(cname) = &verified_rrs[1] {
+ assert_eq!(cname.name.0, "test.cname_wildcard_test.matcorallo.com.");
+ assert_eq!(cname.canonical_name.0, "cname.wildcard_test.matcorallo.com.");
+ } else { panic!(); }
}
#[test]
projects / dnssec-prover / blobdiff