X-Git-Url: http://git.bitcoin.ninja/index.cgi?a=blobdiff_plain;f=src%2Flib.rs;h=b603f40bad6ac3797232b80426ba7f8c42417a8f;hb=5949966f55b60d346083d336534b978141ebec1b;hp=af11329e15000cb1a6146fedb6d6bd53960ead65;hpb=35efdf3c3b2f2b9fff51e811c00736bbef12fceb;p=dnssec-prover diff --git a/src/lib.rs b/src/lib.rs index af11329..b603f40 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -89,6 +89,8 @@ pub enum RR { Txt(Txt), /// A TLS Certificate Association resource record TLSA(TLSA), + /// A Canonical Name record + CName(CName), /// A DNS (Public) Key resource record DnsKey(DnsKey), /// A Delegated Signer resource record @@ -101,6 +103,7 @@ impl RR { pub fn name(&self) -> &Name { match self { RR::Txt(rr) => &rr.name, + RR::CName(rr) => &rr.name, RR::TLSA(rr) => &rr.name, RR::DnsKey(rr) => &rr.name, RR::DS(rr) => &rr.name, @@ -110,6 +113,7 @@ impl RR { fn ty(&self) -> u16 { match self { RR::Txt(_) => Txt::TYPE, + RR::CName(_) => CName::TYPE, RR::TLSA(_) => TLSA::TYPE, RR::DnsKey(_) => DnsKey::TYPE, RR::DS(_) => DS::TYPE, @@ -119,6 +123,7 @@ impl RR { fn write_u16_len_prefixed_data(&self, out: &mut Vec) { match self { RR::Txt(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), + RR::CName(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::TLSA(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::DnsKey(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::DS(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), @@ -127,6 +132,7 @@ impl RR { } } impl From for RR { fn from(txt: Txt) -> RR { RR::Txt(txt) } } +impl From for RR { fn from(cname: CName) -> RR { RR::CName(cname) } } impl From for RR { fn from(tlsa: TLSA) -> RR { RR::TLSA(tlsa) } } impl From for RR { fn from(dnskey: DnsKey) -> RR { RR::DnsKey(dnskey) } } impl From for RR { fn from(ds: DS) -> RR { RR::DS(ds) } } @@ -250,6 +256,9 @@ fn parse_rr(inp: &mut &[u8]) -> Result { } Ok(RR::Txt(Txt { name, data: parsed_data })) } + CName::TYPE => { + Ok(RR::CName(CName { name, canonical_name: read_name(&mut data)? })) + } TLSA::TYPE => { if data_len <= 3 { return Err(()); } Ok(RR::TLSA(TLSA { @@ -366,6 +375,26 @@ impl StaticRecord for TLSA { } } +#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] +/// A Canonical Name resource record, referring all queries for this name to another name. +pub struct CName { + /// The name this record is at. + pub name: Name, + /// The canonical name. + /// + /// A resolver should use this name when looking up any further records for [`Self::name`]. + pub canonical_name: Name, +} +impl StaticRecord for CName { + const TYPE: u16 = 5; + fn name(&self) -> &Name { &self.name } + fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + let len: u16 = name_len(&self.canonical_name); + out.extend_from_slice(&len.to_be_bytes()); + write_name(out, &self.canonical_name); + } +} + #[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] /// A public key resource record which can be used to validate [`RRSig`]s. pub struct DnsKey { @@ -565,8 +594,19 @@ where Keys: IntoIterator { records.sort(); for record in records.iter() { - // TODO: Handle wildcards - write_name(&mut signed_data, record.name()); + let periods = record.name().0.chars().filter(|c| *c == '.').count(); + let labels = sig.labels.into(); + if periods != 1 && periods != labels { + if periods < labels { return Err(ValidationError::Invalid); } + let signed_name = record.name().0.splitn(periods - labels + 1, ".").last(); + debug_assert!(signed_name.is_some()); + if let Some(name) = signed_name { + signed_data.extend_from_slice(b"\x01*"); + write_name(&mut signed_data, name); + } else { return Err(ValidationError::Invalid); } + } else { + write_name(&mut signed_data, record.name()); + } signed_data.extend_from_slice(&record.ty().to_be_bytes()); signed_data.extend_from_slice(&1u16.to_be_bytes()); // The INternet class signed_data.extend_from_slice(&sig.orig_ttl.to_be_bytes()); @@ -890,6 +930,58 @@ mod tests { (txt_resp, txt_rrsig) } + fn matcorallo_cname_record() -> (CName, RRSig) { + let cname_resp = CName { + name: "cname_test.matcorallo.com.".try_into().unwrap(), + canonical_name: "txt_test.matcorallo.com.".try_into().unwrap(), + }; + let cname_rrsig = RRSig { + name: "cname_test.matcorallo.com.".try_into().unwrap(), + ty: CName::TYPE, alg: 13, labels: 3, orig_ttl: 30, expiration: 1708319203, + inception: 1707104203, key_tag: 34530, key_name: "matcorallo.com.".try_into().unwrap(), + signature: base64::decode("5HIrmEotbVb95umE6SX3NrPboKsthdcY8b7DdaYQZzm0Nj5m2VgcfOmEPJYS8o1xE4GvGGF4sdfSy3Uw7TibBg==").unwrap(), + }; + (cname_resp, cname_rrsig) + } + + fn matcorallo_wildcard_record() -> (Txt, RRSig) { + let txt_resp = Txt { + name: "test.wildcard_test.matcorallo.com.".try_into().unwrap(), + data: "wildcard_test".to_owned().into_bytes(), + }; + let txt_rrsig = RRSig { + name: "test.wildcard_test.matcorallo.com.".try_into().unwrap(), + ty: Txt::TYPE, alg: 13, labels: 3, orig_ttl: 30, expiration: 1708321778, + inception: 1707106778, key_tag: 34530, key_name: "matcorallo.com.".try_into().unwrap(), + signature: base64::decode("vdnXunPY4CnbW/BL8VOOR9o33+dqyKA/4h+u5VM7NjB30Shp8L8gL5UwE0k7TKRNgHC8j3TqEPEmNMIHz87Z4Q==").unwrap(), + }; + (txt_resp, txt_rrsig) + } + + fn matcorallo_cname_wildcard_record() -> (CName, RRSig, Txt, RRSig) { + let cname_resp = CName { + name: "test.cname_wildcard_test.matcorallo.com.".try_into().unwrap(), + canonical_name: "cname.wildcard_test.matcorallo.com.".try_into().unwrap(), + }; + let txt_resp = Txt { + name: "cname.wildcard_test.matcorallo.com.".try_into().unwrap(), + data: "wildcard_test".to_owned().into_bytes(), + }; + let cname_rrsig = RRSig { + name: "test.cname_wildcard_test.matcorallo.com.".try_into().unwrap(), + ty: CName::TYPE, alg: 13, labels: 3, orig_ttl: 30, expiration: 1708322050, + inception: 1707107050, key_tag: 34530, key_name: "matcorallo.com.".try_into().unwrap(), + signature: base64::decode("JfJuSemF5dtQYxEw6eKL4IRP8BaDt6FtbtdpZ6HjODTDflhKQRhBEbwT7kwceKPAq18q5sWHFV1bMTqE/F3WLw==").unwrap(), + }; + let txt_rrsig = RRSig { + name: "cname.wildcard_test.matcorallo.com.".try_into().unwrap(), + ty: Txt::TYPE, alg: 13, labels: 3, orig_ttl: 30, expiration: 1708321778, + inception: 1707106778, key_tag: 34530, key_name: "matcorallo.com.".try_into().unwrap(), + signature: base64::decode("vdnXunPY4CnbW/BL8VOOR9o33+dqyKA/4h+u5VM7NjB30Shp8L8gL5UwE0k7TKRNgHC8j3TqEPEmNMIHz87Z4Q==").unwrap(), + }; + (cname_resp, cname_rrsig, txt_resp, txt_rrsig) + } + #[test] fn check_txt_record_a() { let dnskeys = mattcorallo_dnskey().0; @@ -926,7 +1018,15 @@ mod tests { } #[test] - fn check_double_txt_proof() { + fn check_cname_record() { + let dnskeys = matcorallo_dnskey().0; + let (cname, cname_rrsig) = matcorallo_cname_record(); + let cname_resp = [cname]; + verify_rrsig(&cname_rrsig, &dnskeys, cname_resp.iter().collect()).unwrap(); + } + + #[test] + fn check_multi_zone_proof() { let mut rr_stream = Vec::new(); for rr in root_dnskey().1 { write_rr(&rr, 1, &mut rr_stream); } for rr in com_dnskey().1 { write_rr(&rr, 1, &mut rr_stream); } @@ -936,12 +1036,14 @@ mod tests { for rr in matcorallo_dnskey().1 { write_rr(&rr, 1, &mut rr_stream); } let (txt, txt_rrsig) = matcorallo_txt_record(); for rr in [RR::Txt(txt), RR::RRSig(txt_rrsig)] { write_rr(&rr, 1, &mut rr_stream); } + let (cname, cname_rrsig) = matcorallo_cname_record(); + for rr in [RR::CName(cname), RR::RRSig(cname_rrsig)] { write_rr(&rr, 1, &mut rr_stream); } let mut rrs = parse_rr_stream(&rr_stream).unwrap(); rrs.shuffle(&mut rand::rngs::OsRng); let mut verified_rrs = verify_rr_stream(&rrs).unwrap(); verified_rrs.sort(); - assert_eq!(verified_rrs.len(), 2); + assert_eq!(verified_rrs.len(), 3); if let RR::Txt(txt) = &verified_rrs[0] { assert_eq!(txt.name.0, "matt.user._bitcoin-payment.mattcorallo.com."); assert_eq!(txt.data, b"bitcoin:?b12=lno1qsgqmqvgm96frzdg8m0gc6nzeqffvzsqzrxqy32afmr3jn9ggkwg3egfwch2hy0l6jut6vfd8vpsc3h89l6u3dm4q2d6nuamav3w27xvdmv3lpgklhg7l5teypqz9l53hj7zvuaenh34xqsz2sa967yzqkylfu9xtcd5ymcmfp32h083e805y7jfd236w9afhavqqvl8uyma7x77yun4ehe9pnhu2gekjguexmxpqjcr2j822xr7q34p078gzslf9wpwz5y57alxu99s0z2ql0kfqvwhzycqq45ehh58xnfpuek80hw6spvwrvttjrrq9pphh0dpydh06qqspp5uq4gpyt6n9mwexde44qv7lstzzq60nr40ff38u27un6y53aypmx0p4qruk2tf9mjwqlhxak4znvna5y"); @@ -950,6 +1052,43 @@ mod tests { assert_eq!(txt.name.0, "txt_test.matcorallo.com."); assert_eq!(txt.data, b"dnssec_prover_test"); } else { panic!(); } + if let RR::CName(cname) = &verified_rrs[2] { + assert_eq!(cname.name.0, "cname_test.matcorallo.com."); + assert_eq!(cname.canonical_name.0, "txt_test.matcorallo.com."); + } else { panic!(); } + } + + #[test] + fn check_wildcard_record() { + let dnskeys = matcorallo_dnskey().0; + let (txt, txt_rrsig) = matcorallo_wildcard_record(); + let txt_resp = [txt]; + verify_rrsig(&txt_rrsig, &dnskeys, txt_resp.iter().collect()).unwrap(); + } + + #[test] + fn check_wildcard_proof() { + let mut rr_stream = Vec::new(); + for rr in root_dnskey().1 { write_rr(&rr, 1, &mut rr_stream); } + for rr in com_dnskey().1 { write_rr(&rr, 1, &mut rr_stream); } + for rr in matcorallo_dnskey().1 { write_rr(&rr, 1, &mut rr_stream); } + let (cname, cname_rrsig, txt, txt_rrsig) = matcorallo_cname_wildcard_record(); + for rr in [RR::CName(cname), RR::RRSig(cname_rrsig)] { write_rr(&rr, 1, &mut rr_stream); } + for rr in [RR::Txt(txt), RR::RRSig(txt_rrsig)] { write_rr(&rr, 1, &mut rr_stream); } + + let mut rrs = parse_rr_stream(&rr_stream).unwrap(); + rrs.shuffle(&mut rand::rngs::OsRng); + let mut verified_rrs = verify_rr_stream(&rrs).unwrap(); + verified_rrs.sort(); + assert_eq!(verified_rrs.len(), 2); + if let RR::Txt(txt) = &verified_rrs[0] { + assert_eq!(txt.name.0, "cname.wildcard_test.matcorallo.com."); + assert_eq!(txt.data, b"wildcard_test"); + } else { panic!(); } + if let RR::CName(cname) = &verified_rrs[1] { + assert_eq!(cname.name.0, "test.cname_wildcard_test.matcorallo.com."); + assert_eq!(cname.canonical_name.0, "cname.wildcard_test.matcorallo.com."); + } else { panic!(); } } #[test]