X-Git-Url: http://git.bitcoin.ninja/index.cgi?a=blobdiff_plain;f=src%2Frr.rs;h=0733dd2fa2897d79836a5632e4d5c9d33d7df93b;hb=HEAD;hp=145f0b43fa723f32a769817d01d3595968d841cd;hpb=821d8fdb9880a306ff870c45a9268c0dfff1056e;p=dnssec-prover diff --git a/src/rr.rs b/src/rr.rs index 145f0b4..0733dd2 100644 --- a/src/rr.rs +++ b/src/rr.rs @@ -6,6 +6,11 @@ use alloc::vec::Vec; use alloc::string::String; use alloc::borrow::ToOwned; +use alloc::format; + +use core::cmp::{self, Ordering}; +use core::fmt; +use core::fmt::Write; use crate::ser::*; @@ -18,23 +23,49 @@ pub struct Name(String); impl Name { /// Gets the underlying human-readable domain name pub fn as_str(&self) -> &str { &self.0 } + /// Gets the number of labels in this name + pub fn labels(&self) -> u8 { + if self.as_str() == "." { + 0 + } else { + self.as_str().chars().filter(|c| *c == '.').count() as u8 + } + } + /// Gets a string containing the last `n` labels in this [`Name`] (which is also a valid name). + pub fn trailing_n_labels(&self, n: u8) -> Option<&str> { + let labels = self.labels(); + if n > labels { + None + } else if n == labels { + Some(self.as_str()) + } else if n == 0 { + Some(".") + } else { + self.as_str().splitn(labels as usize - n as usize + 1, '.').last() + } + } } impl core::ops::Deref for Name { type Target = str; fn deref(&self) -> &str { &self.0 } } +impl fmt::Display for Name { + fn fmt(&self, f: &mut fmt::Formatter) -> Result<(), fmt::Error> { + self.0.fmt(f) + } +} impl TryFrom for Name { type Error = (); fn try_from(s: String) -> Result { if s.is_empty() { return Err(()); } if *s.as_bytes().last().unwrap_or(&0) != b"."[0] { return Err(()); } if s.len() > 255 { return Err(()); } - if s.chars().any(|c| !c.is_ascii_graphic() && c != '.' && c != '-') { return Err(()); } - for label in s.split(".") { + if s.chars().any(|c| !c.is_ascii_graphic() || c == '"') { return Err(()); } + for label in s.split('.') { if label.len() > 63 { return Err(()); } } - Ok(Name(s)) + Ok(Name(s.to_ascii_lowercase())) } } impl TryFrom<&str> for Name { @@ -62,12 +93,18 @@ pub enum RR { TLSA(TLSA), /// A Canonical Name record CName(CName), + /// A Delegation Name record + DName(DName), /// A DNS (Public) Key resource record DnsKey(DnsKey), /// A Delegated Signer resource record DS(DS), /// A Resource Record Signature record RRSig(RRSig), + /// A Next Secure Record record + NSec(NSec), + /// A Next Secure Record version 3 record + NSec3(NSec3), } impl RR { /// Gets the name this record refers to. @@ -78,10 +115,30 @@ impl RR { RR::NS(rr) => &rr.name, RR::Txt(rr) => &rr.name, RR::CName(rr) => &rr.name, + RR::DName(rr) => &rr.name, RR::TLSA(rr) => &rr.name, RR::DnsKey(rr) => &rr.name, RR::DS(rr) => &rr.name, RR::RRSig(rr) => &rr.name, + RR::NSec(rr) => &rr.name, + RR::NSec3(rr) => &rr.name, + } + } + /// Gets a JSON encoding of this record + pub fn json(&self) -> String { + match self { + RR::A(rr) => StaticRecord::json(rr), + RR::AAAA(rr) => StaticRecord::json(rr), + RR::NS(rr) => StaticRecord::json(rr), + RR::Txt(rr) => StaticRecord::json(rr), + RR::CName(rr) => StaticRecord::json(rr), + RR::DName(rr) => StaticRecord::json(rr), + RR::TLSA(rr) => StaticRecord::json(rr), + RR::DnsKey(rr) => StaticRecord::json(rr), + RR::DS(rr) => StaticRecord::json(rr), + RR::RRSig(rr) => StaticRecord::json(rr), + RR::NSec(rr) => StaticRecord::json(rr), + RR::NSec3(rr) => StaticRecord::json(rr), } } fn ty(&self) -> u16 { @@ -91,23 +148,46 @@ impl RR { RR::NS(_) => NS::TYPE, RR::Txt(_) => Txt::TYPE, RR::CName(_) => CName::TYPE, + RR::DName(_) => DName::TYPE, RR::TLSA(_) => TLSA::TYPE, RR::DnsKey(_) => DnsKey::TYPE, RR::DS(_) => DS::TYPE, RR::RRSig(_) => RRSig::TYPE, + RR::NSec(_) => NSec::TYPE, + RR::NSec3(_) => NSec3::TYPE, } } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { match self { RR::A(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::AAAA(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::NS(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::Txt(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::CName(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), + RR::DName(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::TLSA(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::DnsKey(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::DS(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::RRSig(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), + RR::NSec(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), + RR::NSec3(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), + } + } + fn ty_to_rr_name(ty: u16) -> Option<&'static str> { + match ty { + A::TYPE => Some("A"), + AAAA::TYPE => Some("AAAA"), + NS::TYPE => Some("NS"), + Txt::TYPE => Some("TXT"), + CName::TYPE => Some("CNAME"), + DName::TYPE => Some("DNAME"), + TLSA::TYPE => Some("TLSA"), + DnsKey::TYPE => Some("DNSKEY"), + DS::TYPE => Some("DS"), + RRSig::TYPE => Some("RRSIG"), + NSec::TYPE => Some("NSEC"), + NSec3::TYPE => Some("NSEC3"), + _ => None, } } } @@ -116,18 +196,38 @@ impl From for RR { fn from(aaaa: AAAA) -> RR { RR::AAAA(aaaa) } } impl From for RR { fn from(ns: NS) -> RR { RR::NS(ns) } } impl From for RR { fn from(txt: Txt) -> RR { RR::Txt(txt) } } impl From for RR { fn from(cname: CName) -> RR { RR::CName(cname) } } +impl From for RR { fn from(cname: DName) -> RR { RR::DName(cname) } } impl From for RR { fn from(tlsa: TLSA) -> RR { RR::TLSA(tlsa) } } impl From for RR { fn from(dnskey: DnsKey) -> RR { RR::DnsKey(dnskey) } } impl From for RR { fn from(ds: DS) -> RR { RR::DS(ds) } } impl From for RR { fn from(rrsig: RRSig) -> RR { RR::RRSig(rrsig) } } +impl From for RR { fn from(nsec: NSec) -> RR { RR::NSec(nsec) } } +impl From for RR { fn from(nsec3: NSec3) -> RR { RR::NSec3(nsec3) } } pub(crate) trait StaticRecord : Ord + Sized { // http://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4 const TYPE: u16; fn name(&self) -> &Name; - fn write_u16_len_prefixed_data(&self, out: &mut Vec); + fn json(&self) -> String; + fn write_u16_len_prefixed_data(&self, out: &mut W); fn read_from_data(name: Name, data: &[u8], wire_packet: &[u8]) -> Result; } + +/// A record that can be written to a generic [`Writer`] +pub(crate) trait WriteableRecord : Record { + fn serialize_u16_len_prefixed(&self, out: &mut W); +} +impl WriteableRecord for RR { + fn serialize_u16_len_prefixed(&self, out: &mut W) { + RR::write_u16_len_prefixed_data(self, out) + } +} +impl WriteableRecord for RR { + fn serialize_u16_len_prefixed(&self, out: &mut W) { + RR::write_u16_len_prefixed_data(self, out) + } +} + /// A trait describing a resource record (including the [`RR`] enum). pub trait Record : Ord { /// The resource record type, as maintained by IANA. @@ -137,12 +237,15 @@ pub trait Record : Ord { fn ty(&self) -> u16; /// The name this record is at. fn name(&self) -> &Name; + /// Gets a JSON encoding of this record. + fn json(&self) -> String; /// Writes the data of this record, prefixed by a u16 length, to the given `Vec`. fn write_u16_len_prefixed_data(&self, out: &mut Vec); } impl Record for RR { fn ty(&self) -> u16 { RR::TYPE } fn name(&self) -> &Name { RR::name(self) } + fn json(&self) -> String { RR::json(self) } fn write_u16_len_prefixed_data(&self, out: &mut Vec) { RR::write_u16_len_prefixed_data(self, out) } @@ -150,12 +253,13 @@ impl Record for RR { impl Record for RR { fn ty(&self) -> u16 { self.ty() } fn name(&self) -> &Name { self.name() } + fn json(&self) -> String { self.json() } fn write_u16_len_prefixed_data(&self, out: &mut Vec) { self.write_u16_len_prefixed_data(out) } } -#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] // TODO: ord is wrong cause need to consider len first, maybe +#[derive(Debug, Clone, PartialEq, Eq)] /// A text resource record, containing arbitrary text data pub struct Txt { /// The name this record is at. @@ -166,31 +270,62 @@ pub struct Txt { /// is an arbitrary series of bytes here. pub data: Vec, } +/// The wire type for TXT records +pub const TXT_TYPE: u16 = 16; +impl Ord for Txt { + fn cmp(&self, o: &Txt) -> Ordering { + self.name.cmp(&o.name) + .then_with(|| { + // Compare in wire encoding form, i.e. compare in 255-byte chunks + for i in 1..(self.data.len() / 255) + 2 { + let start = (i - 1)*255; + let self_len = cmp::min(i * 255, self.data.len()); + let o_len = cmp::min(i * 255, o.data.len()); + let slice_cmp = self_len.cmp(&o_len) + .then_with(|| self.data[start..self_len].cmp(&o.data[start..o_len])); + if !slice_cmp.is_eq() { return slice_cmp; } + } + Ordering::Equal + }) + } +} +impl PartialOrd for Txt { + fn partial_cmp(&self, o: &Txt) -> Option { Some(self.cmp(o)) } +} impl StaticRecord for Txt { - const TYPE: u16 = 16; + const TYPE: u16 = TXT_TYPE; fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + if let Ok(s) = core::str::from_utf8(&self.data) { + if s.chars().all(|c| !c.is_control() && c != '"' && c != '\\') { + return format!("{{\"type\":\"txt\",\"name\":\"{}\",\"contents\":\"{}\"}}", self.name.0, s); + } + } + format!("{{\"type\":\"txt\",\"name\":\"{}\",\"contents\":{:?}}}", self.name.0, &self.data[..]) + } fn read_from_data(name: Name, mut data: &[u8], _wire_packet: &[u8]) -> Result { - let mut parsed_data = Vec::with_capacity(data.len() - 1); + let mut parsed_data = Vec::with_capacity(data.len().saturating_sub(1)); while !data.is_empty() { let len = read_u8(&mut data)? as usize; if data.len() < len { return Err(()); } parsed_data.extend_from_slice(&data[..len]); data = &data[len..]; } + debug_assert!(data.is_empty()); Ok(Txt { name, data: parsed_data }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { - let len = (self.data.len() + self.data.len() / 255 + 1) as u16; - out.extend_from_slice(&len.to_be_bytes()); + fn write_u16_len_prefixed_data(&self, out: &mut W) { + let len = (self.data.len() + (self.data.len() + 254) / 255) as u16; + out.write(&len.to_be_bytes()); let mut data_write = &self.data[..]; - out.extend_from_slice(&[data_write.len().try_into().unwrap_or(255)]); + out.write(&[data_write.len().try_into().unwrap_or(255)]); while !data_write.is_empty() { let split_pos = core::cmp::min(255, data_write.len()); - out.extend_from_slice(&data_write[..split_pos]); + out.write(&data_write[..split_pos]); data_write = &data_write[split_pos..]; if !data_write.is_empty() { - out.extend_from_slice(&[data_write.len().try_into().unwrap_or(255)]); + out.write(&[data_write.len().try_into().unwrap_or(255)]); } } } @@ -215,20 +350,35 @@ pub struct TLSA { /// The certificate data or hash of the certificate data itself. pub data: Vec, } +/// The wire type for TLSA records +pub const TLSA_TYPE: u16 = 52; impl StaticRecord for TLSA { - const TYPE: u16 = 52; + const TYPE: u16 = TLSA_TYPE; fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + let mut out = String::with_capacity(128+self.data.len()*2); + write!(&mut out, + "{{\"type\":\"tlsa\",\"name\":\"{}\",\"usage\":{},\"selector\":{},\"data_ty\":{},\"data\":\"", + self.name.0, self.cert_usage, self.selector, self.data_ty + ).expect("Write to a String shouldn't fail"); + for c in self.data.iter() { + write!(&mut out, "{:02X}", c) + .expect("Write to a String shouldn't fail"); + } + out += "\"}"; + out + } fn read_from_data(name: Name, mut data: &[u8], _wire_packet: &[u8]) -> Result { Ok(TLSA { name, cert_usage: read_u8(&mut data)?, selector: read_u8(&mut data)?, data_ty: read_u8(&mut data)?, data: data.to_vec(), }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { let len = 3 + self.data.len(); - out.extend_from_slice(&(len as u16).to_be_bytes()); - out.extend_from_slice(&[self.cert_usage, self.selector, self.data_ty]); - out.extend_from_slice(&self.data); + out.write(&(len as u16).to_be_bytes()); + out.write(&[self.cert_usage, self.selector, self.data_ty]); + out.write(&self.data); } } @@ -239,22 +389,60 @@ pub struct CName { pub name: Name, /// The canonical name. /// - /// A resolver should use this name when looking up any further records for [`Self::name`]. + /// A resolver should use this name when looking up any further records for [`self.name`]. pub canonical_name: Name, } impl StaticRecord for CName { const TYPE: u16 = 5; fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + format!("{{\"type\":\"cname\",\"name\":\"{}\",\"canonical_name\":\"{}\"}}", + self.name.0, self.canonical_name.0) + } fn read_from_data(name: Name, mut data: &[u8], wire_packet: &[u8]) -> Result { - Ok(CName { name, canonical_name: read_wire_packet_name(&mut data, wire_packet)? }) + let res = CName { name, canonical_name: read_wire_packet_name(&mut data, wire_packet)? }; + debug_assert!(data.is_empty()); + Ok(res) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { let len: u16 = name_len(&self.canonical_name); - out.extend_from_slice(&len.to_be_bytes()); + out.write(&len.to_be_bytes()); write_name(out, &self.canonical_name); } } +#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] +/// A Delegation Name resource record, referring all queries for subdomains of this name to another +/// subtree of the DNS. +pub struct DName { + /// The name this record is at. + pub name: Name, + /// The delegation name. + /// + /// A resolver should use this domain name tree when looking up any further records for + /// subdomains of [`self.name`]. + pub delegation_name: Name, +} +impl StaticRecord for DName { + const TYPE: u16 = 39; + fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + format!("{{\"type\":\"dname\",\"name\":\"{}\",\"delegation_name\":\"{}\"}}", + self.name.0, self.delegation_name.0) + } + fn read_from_data(name: Name, mut data: &[u8], wire_packet: &[u8]) -> Result { + let res = DName { name, delegation_name: read_wire_packet_name(&mut data, wire_packet)? }; + debug_assert!(data.is_empty()); + Ok(res) + } + fn write_u16_len_prefixed_data(&self, out: &mut W) { + let len: u16 = name_len(&self.delegation_name); + out.write(&len.to_be_bytes()); + write_name(out, &self.delegation_name); + } +} + + #[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] /// A public key resource record which can be used to validate [`RRSig`]s. pub struct DnsKey { @@ -272,19 +460,32 @@ pub struct DnsKey { impl StaticRecord for DnsKey { const TYPE: u16 = 48; fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + let mut out = String::with_capacity(128+self.pubkey.len()*2); + write!(&mut out, + "{{\"type\":\"dnskey\",\"name\":\"{}\",\"flags\":{},\"protocol\":{},\"alg\":{},\"pubkey\":\"", + self.name.0, self.flags, self.protocol, self.alg + ).expect("Write to a String shouldn't fail"); + for c in self.pubkey.iter() { + write!(&mut out, "{:02X}", c) + .expect("Write to a String shouldn't fail"); + } + out += "\"}"; + out + } fn read_from_data(name: Name, mut data: &[u8], _wire_packet: &[u8]) -> Result { Ok(DnsKey { name, flags: read_u16(&mut data)?, protocol: read_u8(&mut data)?, alg: read_u8(&mut data)?, pubkey: data.to_vec(), }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { let len = 2 + 1 + 1 + self.pubkey.len(); - out.extend_from_slice(&(len as u16).to_be_bytes()); - out.extend_from_slice(&self.flags.to_be_bytes()); - out.extend_from_slice(&self.protocol.to_be_bytes()); - out.extend_from_slice(&self.alg.to_be_bytes()); - out.extend_from_slice(&self.pubkey); + out.write(&(len as u16).to_be_bytes()); + out.write(&self.flags.to_be_bytes()); + out.write(&self.protocol.to_be_bytes()); + out.write(&self.alg.to_be_bytes()); + out.write(&self.pubkey); } } impl DnsKey { @@ -307,7 +508,7 @@ impl DnsKey { #[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] /// A Delegation Signer resource record which indicates that some alternative [`DnsKey`] can sign -/// for records in the zone which matches [`DS::name`]. +/// for records in the zone which matches [`self.name`]. pub struct DS { /// The name this record is at. /// @@ -330,19 +531,32 @@ pub struct DS { impl StaticRecord for DS { const TYPE: u16 = 43; fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + let mut out = String::with_capacity(128+self.digest.len()*2); + write!(&mut out, + "{{\"type\":\"ds\",\"name\":\"{}\",\"key_tag\":{},\"alg\":{},\"digest_type\":{},\"digest\":\"", + self.name.0, self.key_tag, self.alg, self.digest_type + ).expect("Write to a String shouldn't fail"); + for c in self.digest.iter() { + write!(&mut out, "{:02X}", c) + .expect("Write to a String shouldn't fail"); + } + out += "\"}"; + out + } fn read_from_data(name: Name, mut data: &[u8], _wire_packet: &[u8]) -> Result { Ok(DS { name, key_tag: read_u16(&mut data)?, alg: read_u8(&mut data)?, digest_type: read_u8(&mut data)?, digest: data.to_vec(), }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { let len = 2 + 1 + 1 + self.digest.len(); - out.extend_from_slice(&(len as u16).to_be_bytes()); - out.extend_from_slice(&self.key_tag.to_be_bytes()); - out.extend_from_slice(&self.alg.to_be_bytes()); - out.extend_from_slice(&self.digest_type.to_be_bytes()); - out.extend_from_slice(&self.digest); + out.write(&(len as u16).to_be_bytes()); + out.write(&self.key_tag.to_be_bytes()); + out.write(&self.alg.to_be_bytes()); + out.write(&self.digest_type.to_be_bytes()); + out.write(&self.digest); } } @@ -356,7 +570,7 @@ pub struct RRSig { pub name: Name, /// The resource record type which this [`RRSig`] is signing. /// - /// All resources records of this type at the same name as [`Self::name`] must be signed by + /// All resources records of this type at the same name as [`self.name`] must be signed by /// this [`RRSig`]. pub ty: u16, /// The algorithm which is being used to sign. @@ -364,7 +578,9 @@ pub struct RRSig { /// This must match the [`DnsKey::alg`] field in the [`DnsKey`] being used to sign. pub alg: u8, /// The number of labels in the name of the records that this signature is signing. - // TODO: Describe this better in terms of wildcards + /// + /// If this is less than the number of labels in [`self.name`], this signature is covering a + /// wildcard entry. pub labels: u8, /// The TTL of the records which this [`RRSig`] is signing. pub orig_ttl: u32, @@ -378,7 +594,11 @@ pub struct RRSig { pub key_tag: u16, /// The [`DnsKey::name`] in the [`DnsKey`] which created this signature. /// - /// This must be a parent of the [`Self::name`]. + /// This must be a parent of [`self.name`]. + /// + /// [`DnsKey::name`]: Record::name + // We'd like to just link to the `DnsKey` member variable called `name`, but there doesn't + // appear to be a way to actually do that, so instead we have to link to the trait method. pub key_name: Name, /// The signature itself. pub signature: Vec, @@ -386,6 +606,19 @@ pub struct RRSig { impl StaticRecord for RRSig { const TYPE: u16 = 46; fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + let mut out = String::with_capacity(256 + self.signature.len()*2); + write!(&mut out, + "{{\"type\":\"ds\",\"name\":\"{}\",\"signed_record_type\":{},\"alg\":{},\"signed_labels\":{},\"orig_ttl\":{},\"expiration\"{},\"inception\":{},\"key_tag\":{},\"key_name\":\"{}\",\"signature\":\"", + self.name.0, self.ty, self.alg, self.labels, self.orig_ttl, self.expiration, self.inception, self.key_tag, self.key_name.0 + ).expect("Write to a String shouldn't fail"); + for c in self.signature.iter() { + write!(&mut out, "{:02X}", c) + .expect("Write to a String shouldn't fail"); + } + out += "\"}"; + out + } fn read_from_data(name: Name, mut data: &[u8], wire_packet: &[u8]) -> Result { Ok(RRSig { name, ty: read_u16(&mut data)?, alg: read_u8(&mut data)?, @@ -396,18 +629,174 @@ impl StaticRecord for RRSig { signature: data.to_vec(), }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { let len = 2 + 1 + 1 + 4*3 + 2 + name_len(&self.key_name) + self.signature.len() as u16; - out.extend_from_slice(&len.to_be_bytes()); - out.extend_from_slice(&self.ty.to_be_bytes()); - out.extend_from_slice(&self.alg.to_be_bytes()); - out.extend_from_slice(&self.labels.to_be_bytes()); - out.extend_from_slice(&self.orig_ttl.to_be_bytes()); - out.extend_from_slice(&self.expiration.to_be_bytes()); - out.extend_from_slice(&self.inception.to_be_bytes()); - out.extend_from_slice(&self.key_tag.to_be_bytes()); + out.write(&len.to_be_bytes()); + out.write(&self.ty.to_be_bytes()); + out.write(&self.alg.to_be_bytes()); + out.write(&self.labels.to_be_bytes()); + out.write(&self.orig_ttl.to_be_bytes()); + out.write(&self.expiration.to_be_bytes()); + out.write(&self.inception.to_be_bytes()); + out.write(&self.key_tag.to_be_bytes()); write_name(out, &self.key_name); - out.extend_from_slice(&self.signature); + out.write(&self.signature); + } +} + +#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] +/// A mask used in [`NSec`] and [`NSec3`] records which indicates the resource record types which +/// exist at the (hash of the) name described in [`Record::name`]. +pub struct NSecTypeMask([u8; 8192]); +impl NSecTypeMask { + /// Constructs a new, empty, type mask. + pub fn new() -> Self { Self([0; 8192]) } + /// Builds a new type mask with the given types set + pub fn from_types(types: &[u16]) -> Self { + let mut flags = [0; 8192]; + for t in types { + flags[*t as usize >> 3] |= 1 << (7 - (*t as usize % 8)); + } + let res = Self(flags); + for t in types { + debug_assert!(res.contains_type(*t)); + } + res + } + /// Checks if the given type (from [`Record::ty`]) is set, indicating a record of this type + /// exists. + pub fn contains_type(&self, ty: u16) -> bool { + let f = self.0[(ty >> 3) as usize]; + // DNSSEC's bit fields are in wire order, so the high bit is type 0, etc. + f & (1 << (7 - (ty % 8))) != 0 + } + fn write_json(&self, s: &mut String) { + *s += "["; + let mut have_written = false; + for (idx, mask) in self.0.iter().enumerate() { + if *mask == 0 { continue; } + for b in 0..8 { + if *mask & (1 << b) != 0 { + if have_written { + *s += ","; + } + have_written = true; + let ty = ((idx as u16) << 3) | (7 - b); + match RR::ty_to_rr_name(ty) { + Some(name) => write!(s, "\"{}\"", name).expect("Writes to a string shouldn't fail"), + _ => write!(s, "{}", ty).expect("Writes to a string shouldn't fail"), + } + } + } + } + *s += "]"; + } +} + +#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] +/// A Next Secure Record resource record. This indicates a range of possible names for which there +/// is no such record. +pub struct NSec { + /// The name this record is at. + pub name: Name, + /// The next name which contains a record. There are no names between `name` and + /// [`Self::next_name`]. + pub next_name: Name, + /// The set of record types which exist at `name`. Any other record types do not exist at + /// `name`. + pub types: NSecTypeMask, +} +impl StaticRecord for NSec { + const TYPE: u16 = 47; + fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + let mut out = String::with_capacity(256 + self.next_name.len()); + write!(&mut out, + "{{\"type\":\"nsec\",\"name\":\"{}\",\"next_name\":\"{}\",\"types\":", + self.name.0, self.next_name.0, + ).expect("Write to a String shouldn't fail"); + self.types.write_json(&mut out); + out += "}"; + out + } + fn read_from_data(name: Name, mut data: &[u8], wire_packet: &[u8]) -> Result { + let res = NSec { + name, next_name: read_wire_packet_name(&mut data, wire_packet)?, + types: NSecTypeMask(read_nsec_types_bitmap(&mut data)?), + }; + debug_assert!(data.is_empty()); + Ok(res) + } + fn write_u16_len_prefixed_data(&self, out: &mut W) { + let len = name_len(&self.next_name) + nsec_types_bitmap_len(&self.types.0); + out.write(&len.to_be_bytes()); + write_name(out, &self.next_name); + write_nsec_types_bitmap(out, &self.types.0); + } +} + +#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] +/// A Next Secure Record resource record. This indicates a range of possible names for which there +/// is no such record. +pub struct NSec3 { + /// The name this record is at. + pub name: Name, + /// The hash algorithm used to hash the `name` and [`Self::next_name_hash`]. Currently only 1 + /// (SHA-1) is defined. + pub hash_algo: u8, + /// Flags for this record. Currently only bit 0 (the "opt-out" bit) is defined. + pub flags: u8, + /// The number of hash iterations required. + /// + /// As of RFC 9276 this MUST be set to 0, but sadly is often still set higher in the wild. A + /// hard cap is applied in validation. + pub hash_iterations: u16, + /// The salt included in the hash. + /// + /// As of RFC 9276 this SHOULD be empty, but often isn't in the wild. + pub salt: Vec, + /// The hash of the next name which contains a record. There are no records who's name's hash + /// lies between `name` and [`Self::next_name_hash`]. + pub next_name_hash: Vec, + /// The set of record types which exist at `name`. Any other record types do not exist at + /// `name`. + pub types: NSecTypeMask, +} +impl StaticRecord for NSec3 { + const TYPE: u16 = 50; + fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + let mut out = String::with_capacity(256); + write!(&mut out, + "{{\"type\":\"nsec3\",\"name\":\"{}\",\"hash_algo\":{},\"flags\":{},\"hash_iterations\":{},\"salt\":{:?},\"next_name_hash\":{:?},\"types\":", + self.name.0, self.hash_algo, self.flags, self.hash_iterations, &self.salt[..], &self.next_name_hash[..] + ).expect("Write to a String shouldn't fail"); + self.types.write_json(&mut out); + out += "}"; + out + } + fn read_from_data(name: Name, mut data: &[u8], _wire_packet: &[u8]) -> Result { + let res = NSec3 { + name, hash_algo: read_u8(&mut data)?, flags: read_u8(&mut data)?, + hash_iterations: read_u16(&mut data)?, salt: read_u8_len_prefixed_bytes(&mut data)?, + next_name_hash: read_u8_len_prefixed_bytes(&mut data)?, + types: NSecTypeMask(read_nsec_types_bitmap(&mut data)?), + }; + debug_assert!(data.is_empty()); + Ok(res) + } + fn write_u16_len_prefixed_data(&self, out: &mut W) { + let len = 4 + 2 + self.salt.len() as u16 + self.next_name_hash.len() as u16 + + nsec_types_bitmap_len(&self.types.0); + out.write(&len.to_be_bytes()); + out.write(&self.hash_algo.to_be_bytes()); + out.write(&self.flags.to_be_bytes()); + out.write(&self.hash_iterations.to_be_bytes()); + out.write(&(self.salt.len() as u8).to_be_bytes()); + out.write(&self.salt); + out.write(&(self.next_name_hash.len() as u8).to_be_bytes()); + out.write(&self.next_name_hash); + write_nsec_types_bitmap(out, &self.types.0); } } @@ -419,18 +808,23 @@ pub struct A { /// The bytes of the IPv4 address. pub address: [u8; 4], } +/// The wire type for A records +pub const A_TYPE: u16 = 1; impl StaticRecord for A { - const TYPE: u16 = 1; + const TYPE: u16 = A_TYPE; fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + format!("{{\"type\":\"a\",\"name\":\"{}\",\"address\":{:?}}}", self.name.0, self.address) + } fn read_from_data(name: Name, data: &[u8], _wire_packet: &[u8]) -> Result { if data.len() != 4 { return Err(()); } let mut address = [0; 4]; - address.copy_from_slice(&data); + address.copy_from_slice(data); Ok(A { name, address }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { - out.extend_from_slice(&4u16.to_be_bytes()); - out.extend_from_slice(&self.address); + fn write_u16_len_prefixed_data(&self, out: &mut W) { + out.write(&4u16.to_be_bytes()); + out.write(&self.address); } } @@ -442,18 +836,23 @@ pub struct AAAA { /// The bytes of the IPv6 address. pub address: [u8; 16], } +/// The wire type for AAAA records +pub const AAAA_TYPE: u16 = 28; impl StaticRecord for AAAA { - const TYPE: u16 = 28; + const TYPE: u16 = AAAA_TYPE; fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + format!("{{\"type\":\"aaaa\",\"name\":\"{}\",\"address\":{:?}}}", self.name.0, self.address) + } fn read_from_data(name: Name, data: &[u8], _wire_packet: &[u8]) -> Result { if data.len() != 16 { return Err(()); } let mut address = [0; 16]; - address.copy_from_slice(&data); + address.copy_from_slice(data); Ok(AAAA { name, address }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { - out.extend_from_slice(&16u16.to_be_bytes()); - out.extend_from_slice(&self.address); + fn write_u16_len_prefixed_data(&self, out: &mut W) { + out.write(&16u16.to_be_bytes()); + out.write(&self.address); } } @@ -466,18 +865,23 @@ pub struct NS { /// This is also the zone which the server at [`Self::name_server`] is responsible for handling /// queries for. pub name: Name, - /// The name of the server which is responsible for handling queries for the [`Self::name`] + /// The name of the server which is responsible for handling queries for the [`self.name`] /// zone. pub name_server: Name, } impl StaticRecord for NS { const TYPE: u16 = 2; fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + format!("{{\"type\":\"ns\",\"name\":\"{}\",\"ns\":\"{}\"}}", self.name.0, self.name_server.0) + } fn read_from_data(name: Name, mut data: &[u8], wire_packet: &[u8]) -> Result { - Ok(NS { name, name_server: read_wire_packet_name(&mut data, wire_packet)? }) + let res = NS { name, name_server: read_wire_packet_name(&mut data, wire_packet)? }; + debug_assert!(data.is_empty()); + Ok(res) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { - out.extend_from_slice(&name_len(&self.name_server).to_be_bytes()); + fn write_u16_len_prefixed_data(&self, out: &mut W) { + out.write(&name_len(&self.name_server).to_be_bytes()); write_name(out, &self.name_server); } }