X-Git-Url: http://git.bitcoin.ninja/index.cgi?a=blobdiff_plain;f=src%2Fquery.rs;h=1e02e2b1dfd14e742e9d470f8b67e388500b0feb;hb=ed3b8f57238092b32c9988316320d4d0ed046422;hp=8c478e629274639388773cd5dc05a404672f2fa9;hpb=cff93cd2340cb4e14c3f7e220d7c7bea0dd05e79;p=dnssec-prover diff --git a/src/query.rs b/src/query.rs index 8c478e6..1e02e2b 100644 --- a/src/query.rs +++ b/src/query.rs @@ -93,14 +93,12 @@ impl ops::DerefMut for QueryBuf { } } -// We don't care about transaction IDs as we're only going to accept signed data. Thus, we use -// this constant instead of a random value. -const TXID: u16 = 0x4242; +// We don't care about transaction IDs as we're only going to accept signed data. +// Further, if we're querying over DoH, the RFC says we SHOULD use a transaction ID of 0 here. +const TXID: u16 = 0; fn build_query(domain: &Name, ty: u16) -> QueryBuf { let mut query = QueryBuf::new_zeroed(0); - let query_msg_len: u16 = 2 + 2 + 8 + 2 + 2 + name_len(domain) + 11; - query.extend_from_slice(&query_msg_len.to_be_bytes()); query.extend_from_slice(&TXID.to_be_bytes()); query.extend_from_slice(&[0x01, 0x20]); // Flags: Recursive, Authenticated Data query.extend_from_slice(&[0, 1, 0, 0, 0, 0, 0, 1]); // One question, One additional @@ -140,7 +138,7 @@ fn handle_response(resp: &[u8], proof: &mut Vec, rrsig_key_names: &mut Vec, rrsig_key_names: &mut Vec, rrsig_key_names: &mut Vec { + if rrsig.ty != NSec::TYPE && rrsig.ty != NSec3::TYPE { + continue; + } + }, + RR::NSec(_)|RR::NSec3(_) => {}, + _ => continue, + } + write_rr(&rr, ttl, proof); + min_ttl = cmp::min(min_ttl, ttl); + if let RR::RRSig(rrsig) = rr { rrsig_key_names.push(rrsig.key_name); } + } + Ok(min_ttl) } @@ -185,6 +202,11 @@ const MAX_REQUESTS: usize = 10; /// [`ProofBuilder::process_response`] should be called, and each fresh query returned should be /// sent to the resolver. Once [`ProofBuilder::awaiting_responses`] returns false, /// [`ProofBuilder::finish_proof`] should be called to fetch the resulting proof. +/// +/// To build a DNSSEC proof using a DoH server, take each [`QueryBuf`], encode it as base64url, and +/// make a query to `https://doh-server/endpoint?dns=base64url_encoded_query` with an `Accept` +/// header of `application/dns-message`. Each response, in raw binary, can be fed directly into +/// [`ProofBuilder::process_response`]. pub struct ProofBuilder { proof: Vec, min_ttl: u32, @@ -271,12 +293,14 @@ impl ProofBuilder { #[cfg(feature = "std")] fn send_query(stream: &mut TcpStream, query: &[u8]) -> Result<(), Error> { + stream.write_all(&(query.len() as u16).to_be_bytes())?; stream.write_all(&query)?; Ok(()) } #[cfg(feature = "tokio")] async fn send_query_async(stream: &mut TokioTcpStream, query: &[u8]) -> Result<(), Error> { + stream.write_all(&(query.len() as u16).to_be_bytes()).await?; stream.write_all(&query).await?; Ok(()) } @@ -481,7 +505,7 @@ mod tests { fn test_cname_query() { for resolver in ["1.1.1.1:53", "8.8.8.8:53", "9.9.9.9:53"] { let sockaddr = resolver.to_socket_addrs().unwrap().next().unwrap(); - let query_name = "cname_test.matcorallo.com.".try_into().unwrap(); + let query_name = "cname_test.dnssec_proof_tests.bitcoin.ninja.".try_into().unwrap(); let (proof, _) = build_txt_proof(sockaddr, &query_name).unwrap(); let mut rrs = parse_rr_stream(&proof).unwrap(); @@ -496,7 +520,7 @@ mod tests { let resolved_rrs = verified_rrs.resolve_name(&query_name); assert_eq!(resolved_rrs.len(), 1); if let RR::Txt(txt) = &resolved_rrs[0] { - assert_eq!(txt.name.as_str(), "txt_test.matcorallo.com."); + assert_eq!(txt.name.as_str(), "txt_test.dnssec_proof_tests.bitcoin.ninja."); assert_eq!(txt.data, b"dnssec_prover_test"); } else { panic!(); } } @@ -527,7 +551,7 @@ mod tests { async fn test_cross_domain_cname_query_async() { for resolver in ["1.1.1.1:53", "8.8.8.8:53", "9.9.9.9:53"] { let sockaddr = resolver.to_socket_addrs().unwrap().next().unwrap(); - let query_name = "wildcard.x_domain_cname_wild.matcorallo.com.".try_into().unwrap(); + let query_name = "wildcard.x_domain_cname_wild.dnssec_proof_tests.bitcoin.ninja.".try_into().unwrap(); let (proof, _) = build_txt_proof_async(sockaddr, &query_name).await.unwrap(); let mut rrs = parse_rr_stream(&proof).unwrap(); @@ -547,4 +571,31 @@ mod tests { } else { panic!(); } } } + + #[cfg(feature = "tokio")] + #[tokio::test] + async fn test_dname_wildcard_query_async() { + for resolver in ["1.1.1.1:53", "8.8.8.8:53", "9.9.9.9:53"] { + let sockaddr = resolver.to_socket_addrs().unwrap().next().unwrap(); + let query_name = "wildcard_a.wildcard_b.dname_test.dnssec_proof_tests.bitcoin.ninja.".try_into().unwrap(); + let (proof, _) = build_txt_proof_async(sockaddr, &query_name).await.unwrap(); + + let mut rrs = parse_rr_stream(&proof).unwrap(); + rrs.shuffle(&mut rand::rngs::OsRng); + let verified_rrs = verify_rr_stream(&rrs).unwrap(); + assert_eq!(verified_rrs.verified_rrs.len(), 3); + + let now = SystemTime::now().duration_since(SystemTime::UNIX_EPOCH).unwrap().as_secs(); + assert!(verified_rrs.valid_from < now); + assert!(verified_rrs.expires > now); + + let resolved_rrs = verified_rrs.resolve_name(&query_name); + assert_eq!(resolved_rrs.len(), 1); + if let RR::Txt(txt) = &resolved_rrs[0] { + assert_eq!(txt.name.as_str(), "cname.wildcard_test.dnssec_proof_tests.bitcoin.ninja."); + assert_eq!(txt.data, b"wildcard_test"); + } else { panic!(); } + } + } + }