Add new tests to test NSEC validation behavior

[dnssec-prover] / src / query.rs

diff --git a/src/query.rs b/src/query.rs
index 07954b3cb9fccc348803c00a5c229b20be1eca76..1e02e2b1dfd14e742e9d470f8b67e388500b0feb 100644 (file)
--- a/src/query.rs
+++ b/src/query.rs
@@ -138,7 +138,7 @@ fn handle_response(resp: &[u8], proof: &mut Vec<u8>, rrsig_key_names: &mut Vec<N
        if questions != 1 { return Err(()); }
        let answers = read_u16(&mut read)?;
        if answers == 0 { return Err(()); }
-       let _authorities = read_u16(&mut read)?;
+       let authorities = read_u16(&mut read)?;
        let _additional = read_u16(&mut read)?;
 
        for _ in 0..questions {
@@ -147,7 +147,7 @@ fn handle_response(resp: &[u8], proof: &mut Vec<u8>, rrsig_key_names: &mut Vec<N
                read_u16(&mut read)?; // class
        }
 
-       // Only read the answers (skip authorities and additional) as that's all we care about.
+       // Only read the answers and NSEC records in authorities, skipping additional entirely.
        let mut min_ttl = u32::MAX;
        for _ in 0..answers {
                let (rr, ttl) = parse_wire_packet_rr(&mut read, &resp)?;
@@ -155,6 +155,25 @@ fn handle_response(resp: &[u8], proof: &mut Vec<u8>, rrsig_key_names: &mut Vec<N
                min_ttl = cmp::min(min_ttl, ttl);
                if let RR::RRSig(rrsig) = rr { rrsig_key_names.push(rrsig.key_name); }
        }
+
+       for _ in 0..authorities {
+               // Only include records from the authority section if they are NSEC/3 (or signatures
+               // thereover). We don't care about NS records here.
+               let (rr, ttl) = parse_wire_packet_rr(&mut read, &resp)?;
+               match &rr {
+                       RR::RRSig(rrsig) => {
+                               if rrsig.ty != NSec::TYPE && rrsig.ty != NSec3::TYPE {
+                                       continue;
+                               }
+                       },
+                       RR::NSec(_)|RR::NSec3(_) => {},
+                       _ => continue,
+               }
+               write_rr(&rr, ttl, proof);
+               min_ttl = cmp::min(min_ttl, ttl);
+               if let RR::RRSig(rrsig) = rr { rrsig_key_names.push(rrsig.key_name); }
+       }
+
        Ok(min_ttl)
 }
 
@@ -183,6 +202,11 @@ const MAX_REQUESTS: usize = 10;
 /// [`ProofBuilder::process_response`] should be called, and each fresh query returned should be
 /// sent to the resolver. Once [`ProofBuilder::awaiting_responses`] returns false,
 /// [`ProofBuilder::finish_proof`] should be called to fetch the resulting proof.
+///
+/// To build a DNSSEC proof using a DoH server, take each [`QueryBuf`], encode it as base64url, and
+/// make a query to `https://doh-server/endpoint?dns=base64url_encoded_query` with an `Accept`
+/// header of `application/dns-message`. Each response, in raw binary, can be fed directly into
+/// [`ProofBuilder::process_response`].
 pub struct ProofBuilder {
        proof: Vec<u8>,
        min_ttl: u32,
@@ -481,7 +505,7 @@ mod tests {
        fn test_cname_query() {
                for resolver in ["1.1.1.1:53", "8.8.8.8:53", "9.9.9.9:53"] {
                        let sockaddr = resolver.to_socket_addrs().unwrap().next().unwrap();
-                       let query_name = "cname_test.matcorallo.com.".try_into().unwrap();
+                       let query_name = "cname_test.dnssec_proof_tests.bitcoin.ninja.".try_into().unwrap();
                        let (proof, _) = build_txt_proof(sockaddr, &query_name).unwrap();
 
                        let mut rrs = parse_rr_stream(&proof).unwrap();
@@ -496,7 +520,7 @@ mod tests {
                        let resolved_rrs = verified_rrs.resolve_name(&query_name);
                        assert_eq!(resolved_rrs.len(), 1);
                        if let RR::Txt(txt) = &resolved_rrs[0] {
-                               assert_eq!(txt.name.as_str(), "txt_test.matcorallo.com.");
+                               assert_eq!(txt.name.as_str(), "txt_test.dnssec_proof_tests.bitcoin.ninja.");
                                assert_eq!(txt.data, b"dnssec_prover_test");
                        } else { panic!(); }
                }
@@ -527,7 +551,7 @@ mod tests {
        async fn test_cross_domain_cname_query_async() {
                for resolver in ["1.1.1.1:53", "8.8.8.8:53", "9.9.9.9:53"] {
                        let sockaddr = resolver.to_socket_addrs().unwrap().next().unwrap();
-                       let query_name = "wildcard.x_domain_cname_wild.matcorallo.com.".try_into().unwrap();
+                       let query_name = "wildcard.x_domain_cname_wild.dnssec_proof_tests.bitcoin.ninja.".try_into().unwrap();
                        let (proof, _) = build_txt_proof_async(sockaddr, &query_name).await.unwrap();
 
                        let mut rrs = parse_rr_stream(&proof).unwrap();
@@ -547,4 +571,31 @@ mod tests {
                        } else { panic!(); }
                }
        }
+
+       #[cfg(feature = "tokio")]
+       #[tokio::test]
+       async fn test_dname_wildcard_query_async() {
+               for resolver in ["1.1.1.1:53", "8.8.8.8:53", "9.9.9.9:53"] {
+                       let sockaddr = resolver.to_socket_addrs().unwrap().next().unwrap();
+                       let query_name = "wildcard_a.wildcard_b.dname_test.dnssec_proof_tests.bitcoin.ninja.".try_into().unwrap();
+                       let (proof, _) = build_txt_proof_async(sockaddr, &query_name).await.unwrap();
+
+                       let mut rrs = parse_rr_stream(&proof).unwrap();
+                       rrs.shuffle(&mut rand::rngs::OsRng);
+                       let verified_rrs = verify_rr_stream(&rrs).unwrap();
+                       assert_eq!(verified_rrs.verified_rrs.len(), 3);
+
+                       let now = SystemTime::now().duration_since(SystemTime::UNIX_EPOCH).unwrap().as_secs();
+                       assert!(verified_rrs.valid_from < now);
+                       assert!(verified_rrs.expires > now);
+
+                       let resolved_rrs = verified_rrs.resolve_name(&query_name);
+                       assert_eq!(resolved_rrs.len(), 1);
+                       if let RR::Txt(txt) = &resolved_rrs[0] {
+                               assert_eq!(txt.name.as_str(), "cname.wildcard_test.dnssec_proof_tests.bitcoin.ninja.");
+                               assert_eq!(txt.data, b"wildcard_test");
+                       } else { panic!(); }
+               }
+       }
+
 }