X-Git-Url: http://git.bitcoin.ninja/index.cgi?a=blobdiff_plain;f=src%2Frr.rs;h=0733dd2fa2897d79836a5632e4d5c9d33d7df93b;hb=HEAD;hp=33fdb188f26f0be2fb3be95e50a9a16797315b16;hpb=61f8c4b0f0c6c81bd5acf541d7f9a53b392c863f;p=dnssec-prover diff --git a/src/rr.rs b/src/rr.rs index 33fdb18..0733dd2 100644 --- a/src/rr.rs +++ b/src/rr.rs @@ -41,7 +41,7 @@ impl Name { } else if n == 0 { Some(".") } else { - self.as_str().splitn(labels as usize - n as usize + 1, ".").last() + self.as_str().splitn(labels as usize - n as usize + 1, '.').last() } } } @@ -61,7 +61,7 @@ impl TryFrom for Name { if *s.as_bytes().last().unwrap_or(&0) != b"."[0] { return Err(()); } if s.len() > 255 { return Err(()); } if s.chars().any(|c| !c.is_ascii_graphic() || c == '"') { return Err(()); } - for label in s.split(".") { + for label in s.split('.') { if label.len() > 63 { return Err(()); } } @@ -101,6 +101,10 @@ pub enum RR { DS(DS), /// A Resource Record Signature record RRSig(RRSig), + /// A Next Secure Record record + NSec(NSec), + /// A Next Secure Record version 3 record + NSec3(NSec3), } impl RR { /// Gets the name this record refers to. @@ -116,6 +120,8 @@ impl RR { RR::DnsKey(rr) => &rr.name, RR::DS(rr) => &rr.name, RR::RRSig(rr) => &rr.name, + RR::NSec(rr) => &rr.name, + RR::NSec3(rr) => &rr.name, } } /// Gets a JSON encoding of this record @@ -131,6 +137,8 @@ impl RR { RR::DnsKey(rr) => StaticRecord::json(rr), RR::DS(rr) => StaticRecord::json(rr), RR::RRSig(rr) => StaticRecord::json(rr), + RR::NSec(rr) => StaticRecord::json(rr), + RR::NSec3(rr) => StaticRecord::json(rr), } } fn ty(&self) -> u16 { @@ -145,9 +153,11 @@ impl RR { RR::DnsKey(_) => DnsKey::TYPE, RR::DS(_) => DS::TYPE, RR::RRSig(_) => RRSig::TYPE, + RR::NSec(_) => NSec::TYPE, + RR::NSec3(_) => NSec3::TYPE, } } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { match self { RR::A(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::AAAA(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), @@ -159,6 +169,25 @@ impl RR { RR::DnsKey(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::DS(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), RR::RRSig(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), + RR::NSec(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), + RR::NSec3(rr) => StaticRecord::write_u16_len_prefixed_data(rr, out), + } + } + fn ty_to_rr_name(ty: u16) -> Option<&'static str> { + match ty { + A::TYPE => Some("A"), + AAAA::TYPE => Some("AAAA"), + NS::TYPE => Some("NS"), + Txt::TYPE => Some("TXT"), + CName::TYPE => Some("CNAME"), + DName::TYPE => Some("DNAME"), + TLSA::TYPE => Some("TLSA"), + DnsKey::TYPE => Some("DNSKEY"), + DS::TYPE => Some("DS"), + RRSig::TYPE => Some("RRSIG"), + NSec::TYPE => Some("NSEC"), + NSec3::TYPE => Some("NSEC3"), + _ => None, } } } @@ -172,15 +201,33 @@ impl From for RR { fn from(tlsa: TLSA) -> RR { RR::TLSA(tlsa) } } impl From for RR { fn from(dnskey: DnsKey) -> RR { RR::DnsKey(dnskey) } } impl From for RR { fn from(ds: DS) -> RR { RR::DS(ds) } } impl From for RR { fn from(rrsig: RRSig) -> RR { RR::RRSig(rrsig) } } +impl From for RR { fn from(nsec: NSec) -> RR { RR::NSec(nsec) } } +impl From for RR { fn from(nsec3: NSec3) -> RR { RR::NSec3(nsec3) } } pub(crate) trait StaticRecord : Ord + Sized { // http://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4 const TYPE: u16; fn name(&self) -> &Name; fn json(&self) -> String; - fn write_u16_len_prefixed_data(&self, out: &mut Vec); + fn write_u16_len_prefixed_data(&self, out: &mut W); fn read_from_data(name: Name, data: &[u8], wire_packet: &[u8]) -> Result; } + +/// A record that can be written to a generic [`Writer`] +pub(crate) trait WriteableRecord : Record { + fn serialize_u16_len_prefixed(&self, out: &mut W); +} +impl WriteableRecord for RR { + fn serialize_u16_len_prefixed(&self, out: &mut W) { + RR::write_u16_len_prefixed_data(self, out) + } +} +impl WriteableRecord for RR { + fn serialize_u16_len_prefixed(&self, out: &mut W) { + RR::write_u16_len_prefixed_data(self, out) + } +} + /// A trait describing a resource record (including the [`RR`] enum). pub trait Record : Ord { /// The resource record type, as maintained by IANA. @@ -212,7 +259,7 @@ impl Record for RR { } } -#[derive(Debug, Clone, PartialEq, Eq, Ord)] +#[derive(Debug, Clone, PartialEq, Eq)] /// A text resource record, containing arbitrary text data pub struct Txt { /// The name this record is at. @@ -225,9 +272,9 @@ pub struct Txt { } /// The wire type for TXT records pub const TXT_TYPE: u16 = 16; -impl PartialOrd for Txt { - fn partial_cmp(&self, o: &Txt) -> Option { - Some(self.name.cmp(&o.name) +impl Ord for Txt { + fn cmp(&self, o: &Txt) -> Ordering { + self.name.cmp(&o.name) .then_with(|| { // Compare in wire encoding form, i.e. compare in 255-byte chunks for i in 1..(self.data.len() / 255) + 2 { @@ -239,9 +286,12 @@ impl PartialOrd for Txt { if !slice_cmp.is_eq() { return slice_cmp; } } Ordering::Equal - })) + }) } } +impl PartialOrd for Txt { + fn partial_cmp(&self, o: &Txt) -> Option { Some(self.cmp(o)) } +} impl StaticRecord for Txt { const TYPE: u16 = TXT_TYPE; fn name(&self) -> &Name { &self.name } @@ -264,18 +314,18 @@ impl StaticRecord for Txt { debug_assert!(data.is_empty()); Ok(Txt { name, data: parsed_data }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { let len = (self.data.len() + (self.data.len() + 254) / 255) as u16; - out.extend_from_slice(&len.to_be_bytes()); + out.write(&len.to_be_bytes()); let mut data_write = &self.data[..]; - out.extend_from_slice(&[data_write.len().try_into().unwrap_or(255)]); + out.write(&[data_write.len().try_into().unwrap_or(255)]); while !data_write.is_empty() { let split_pos = core::cmp::min(255, data_write.len()); - out.extend_from_slice(&data_write[..split_pos]); + out.write(&data_write[..split_pos]); data_write = &data_write[split_pos..]; if !data_write.is_empty() { - out.extend_from_slice(&[data_write.len().try_into().unwrap_or(255)]); + out.write(&[data_write.len().try_into().unwrap_or(255)]); } } } @@ -324,11 +374,11 @@ impl StaticRecord for TLSA { data_ty: read_u8(&mut data)?, data: data.to_vec(), }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { let len = 3 + self.data.len(); - out.extend_from_slice(&(len as u16).to_be_bytes()); - out.extend_from_slice(&[self.cert_usage, self.selector, self.data_ty]); - out.extend_from_slice(&self.data); + out.write(&(len as u16).to_be_bytes()); + out.write(&[self.cert_usage, self.selector, self.data_ty]); + out.write(&self.data); } } @@ -354,9 +404,9 @@ impl StaticRecord for CName { debug_assert!(data.is_empty()); Ok(res) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { let len: u16 = name_len(&self.canonical_name); - out.extend_from_slice(&len.to_be_bytes()); + out.write(&len.to_be_bytes()); write_name(out, &self.canonical_name); } } @@ -385,9 +435,9 @@ impl StaticRecord for DName { debug_assert!(data.is_empty()); Ok(res) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { let len: u16 = name_len(&self.delegation_name); - out.extend_from_slice(&len.to_be_bytes()); + out.write(&len.to_be_bytes()); write_name(out, &self.delegation_name); } } @@ -429,13 +479,13 @@ impl StaticRecord for DnsKey { alg: read_u8(&mut data)?, pubkey: data.to_vec(), }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { let len = 2 + 1 + 1 + self.pubkey.len(); - out.extend_from_slice(&(len as u16).to_be_bytes()); - out.extend_from_slice(&self.flags.to_be_bytes()); - out.extend_from_slice(&self.protocol.to_be_bytes()); - out.extend_from_slice(&self.alg.to_be_bytes()); - out.extend_from_slice(&self.pubkey); + out.write(&(len as u16).to_be_bytes()); + out.write(&self.flags.to_be_bytes()); + out.write(&self.protocol.to_be_bytes()); + out.write(&self.alg.to_be_bytes()); + out.write(&self.pubkey); } } impl DnsKey { @@ -500,13 +550,13 @@ impl StaticRecord for DS { digest_type: read_u8(&mut data)?, digest: data.to_vec(), }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { let len = 2 + 1 + 1 + self.digest.len(); - out.extend_from_slice(&(len as u16).to_be_bytes()); - out.extend_from_slice(&self.key_tag.to_be_bytes()); - out.extend_from_slice(&self.alg.to_be_bytes()); - out.extend_from_slice(&self.digest_type.to_be_bytes()); - out.extend_from_slice(&self.digest); + out.write(&(len as u16).to_be_bytes()); + out.write(&self.key_tag.to_be_bytes()); + out.write(&self.alg.to_be_bytes()); + out.write(&self.digest_type.to_be_bytes()); + out.write(&self.digest); } } @@ -579,18 +629,174 @@ impl StaticRecord for RRSig { signature: data.to_vec(), }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { + fn write_u16_len_prefixed_data(&self, out: &mut W) { let len = 2 + 1 + 1 + 4*3 + 2 + name_len(&self.key_name) + self.signature.len() as u16; - out.extend_from_slice(&len.to_be_bytes()); - out.extend_from_slice(&self.ty.to_be_bytes()); - out.extend_from_slice(&self.alg.to_be_bytes()); - out.extend_from_slice(&self.labels.to_be_bytes()); - out.extend_from_slice(&self.orig_ttl.to_be_bytes()); - out.extend_from_slice(&self.expiration.to_be_bytes()); - out.extend_from_slice(&self.inception.to_be_bytes()); - out.extend_from_slice(&self.key_tag.to_be_bytes()); + out.write(&len.to_be_bytes()); + out.write(&self.ty.to_be_bytes()); + out.write(&self.alg.to_be_bytes()); + out.write(&self.labels.to_be_bytes()); + out.write(&self.orig_ttl.to_be_bytes()); + out.write(&self.expiration.to_be_bytes()); + out.write(&self.inception.to_be_bytes()); + out.write(&self.key_tag.to_be_bytes()); write_name(out, &self.key_name); - out.extend_from_slice(&self.signature); + out.write(&self.signature); + } +} + +#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] +/// A mask used in [`NSec`] and [`NSec3`] records which indicates the resource record types which +/// exist at the (hash of the) name described in [`Record::name`]. +pub struct NSecTypeMask([u8; 8192]); +impl NSecTypeMask { + /// Constructs a new, empty, type mask. + pub fn new() -> Self { Self([0; 8192]) } + /// Builds a new type mask with the given types set + pub fn from_types(types: &[u16]) -> Self { + let mut flags = [0; 8192]; + for t in types { + flags[*t as usize >> 3] |= 1 << (7 - (*t as usize % 8)); + } + let res = Self(flags); + for t in types { + debug_assert!(res.contains_type(*t)); + } + res + } + /// Checks if the given type (from [`Record::ty`]) is set, indicating a record of this type + /// exists. + pub fn contains_type(&self, ty: u16) -> bool { + let f = self.0[(ty >> 3) as usize]; + // DNSSEC's bit fields are in wire order, so the high bit is type 0, etc. + f & (1 << (7 - (ty % 8))) != 0 + } + fn write_json(&self, s: &mut String) { + *s += "["; + let mut have_written = false; + for (idx, mask) in self.0.iter().enumerate() { + if *mask == 0 { continue; } + for b in 0..8 { + if *mask & (1 << b) != 0 { + if have_written { + *s += ","; + } + have_written = true; + let ty = ((idx as u16) << 3) | (7 - b); + match RR::ty_to_rr_name(ty) { + Some(name) => write!(s, "\"{}\"", name).expect("Writes to a string shouldn't fail"), + _ => write!(s, "{}", ty).expect("Writes to a string shouldn't fail"), + } + } + } + } + *s += "]"; + } +} + +#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] +/// A Next Secure Record resource record. This indicates a range of possible names for which there +/// is no such record. +pub struct NSec { + /// The name this record is at. + pub name: Name, + /// The next name which contains a record. There are no names between `name` and + /// [`Self::next_name`]. + pub next_name: Name, + /// The set of record types which exist at `name`. Any other record types do not exist at + /// `name`. + pub types: NSecTypeMask, +} +impl StaticRecord for NSec { + const TYPE: u16 = 47; + fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + let mut out = String::with_capacity(256 + self.next_name.len()); + write!(&mut out, + "{{\"type\":\"nsec\",\"name\":\"{}\",\"next_name\":\"{}\",\"types\":", + self.name.0, self.next_name.0, + ).expect("Write to a String shouldn't fail"); + self.types.write_json(&mut out); + out += "}"; + out + } + fn read_from_data(name: Name, mut data: &[u8], wire_packet: &[u8]) -> Result { + let res = NSec { + name, next_name: read_wire_packet_name(&mut data, wire_packet)?, + types: NSecTypeMask(read_nsec_types_bitmap(&mut data)?), + }; + debug_assert!(data.is_empty()); + Ok(res) + } + fn write_u16_len_prefixed_data(&self, out: &mut W) { + let len = name_len(&self.next_name) + nsec_types_bitmap_len(&self.types.0); + out.write(&len.to_be_bytes()); + write_name(out, &self.next_name); + write_nsec_types_bitmap(out, &self.types.0); + } +} + +#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)] +/// A Next Secure Record resource record. This indicates a range of possible names for which there +/// is no such record. +pub struct NSec3 { + /// The name this record is at. + pub name: Name, + /// The hash algorithm used to hash the `name` and [`Self::next_name_hash`]. Currently only 1 + /// (SHA-1) is defined. + pub hash_algo: u8, + /// Flags for this record. Currently only bit 0 (the "opt-out" bit) is defined. + pub flags: u8, + /// The number of hash iterations required. + /// + /// As of RFC 9276 this MUST be set to 0, but sadly is often still set higher in the wild. A + /// hard cap is applied in validation. + pub hash_iterations: u16, + /// The salt included in the hash. + /// + /// As of RFC 9276 this SHOULD be empty, but often isn't in the wild. + pub salt: Vec, + /// The hash of the next name which contains a record. There are no records who's name's hash + /// lies between `name` and [`Self::next_name_hash`]. + pub next_name_hash: Vec, + /// The set of record types which exist at `name`. Any other record types do not exist at + /// `name`. + pub types: NSecTypeMask, +} +impl StaticRecord for NSec3 { + const TYPE: u16 = 50; + fn name(&self) -> &Name { &self.name } + fn json(&self) -> String { + let mut out = String::with_capacity(256); + write!(&mut out, + "{{\"type\":\"nsec3\",\"name\":\"{}\",\"hash_algo\":{},\"flags\":{},\"hash_iterations\":{},\"salt\":{:?},\"next_name_hash\":{:?},\"types\":", + self.name.0, self.hash_algo, self.flags, self.hash_iterations, &self.salt[..], &self.next_name_hash[..] + ).expect("Write to a String shouldn't fail"); + self.types.write_json(&mut out); + out += "}"; + out + } + fn read_from_data(name: Name, mut data: &[u8], _wire_packet: &[u8]) -> Result { + let res = NSec3 { + name, hash_algo: read_u8(&mut data)?, flags: read_u8(&mut data)?, + hash_iterations: read_u16(&mut data)?, salt: read_u8_len_prefixed_bytes(&mut data)?, + next_name_hash: read_u8_len_prefixed_bytes(&mut data)?, + types: NSecTypeMask(read_nsec_types_bitmap(&mut data)?), + }; + debug_assert!(data.is_empty()); + Ok(res) + } + fn write_u16_len_prefixed_data(&self, out: &mut W) { + let len = 4 + 2 + self.salt.len() as u16 + self.next_name_hash.len() as u16 + + nsec_types_bitmap_len(&self.types.0); + out.write(&len.to_be_bytes()); + out.write(&self.hash_algo.to_be_bytes()); + out.write(&self.flags.to_be_bytes()); + out.write(&self.hash_iterations.to_be_bytes()); + out.write(&(self.salt.len() as u8).to_be_bytes()); + out.write(&self.salt); + out.write(&(self.next_name_hash.len() as u8).to_be_bytes()); + out.write(&self.next_name_hash); + write_nsec_types_bitmap(out, &self.types.0); } } @@ -613,12 +819,12 @@ impl StaticRecord for A { fn read_from_data(name: Name, data: &[u8], _wire_packet: &[u8]) -> Result { if data.len() != 4 { return Err(()); } let mut address = [0; 4]; - address.copy_from_slice(&data); + address.copy_from_slice(data); Ok(A { name, address }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { - out.extend_from_slice(&4u16.to_be_bytes()); - out.extend_from_slice(&self.address); + fn write_u16_len_prefixed_data(&self, out: &mut W) { + out.write(&4u16.to_be_bytes()); + out.write(&self.address); } } @@ -641,12 +847,12 @@ impl StaticRecord for AAAA { fn read_from_data(name: Name, data: &[u8], _wire_packet: &[u8]) -> Result { if data.len() != 16 { return Err(()); } let mut address = [0; 16]; - address.copy_from_slice(&data); + address.copy_from_slice(data); Ok(AAAA { name, address }) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { - out.extend_from_slice(&16u16.to_be_bytes()); - out.extend_from_slice(&self.address); + fn write_u16_len_prefixed_data(&self, out: &mut W) { + out.write(&16u16.to_be_bytes()); + out.write(&self.address); } } @@ -674,8 +880,8 @@ impl StaticRecord for NS { debug_assert!(data.is_empty()); Ok(res) } - fn write_u16_len_prefixed_data(&self, out: &mut Vec) { - out.extend_from_slice(&name_len(&self.name_server).to_be_bytes()); + fn write_u16_len_prefixed_data(&self, out: &mut W) { + out.write(&name_len(&self.name_server).to_be_bytes()); write_name(out, &self.name_server); } }