dnsruby 1.1

data/lib/Dnsruby/resource/CERT.rb

@@ -0,0 +1,89 @@
+#--
+#Copyright 2007 Nominet UK
+#
+#Licensed under the Apache License, Version 2.0 (the "License");
+#you may not use this file except in compliance with the License. 
+#You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0 
+#
+#Unless required by applicable law or agreed to in writing, software 
+#distributed under the License is distributed on an "AS IS" BASIS, 
+#WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 
+#See the License for the specific language governing permissions and 
+#limitations under the License.
+#++
+module Dnsruby
+  class RR
+    #Class for DNS Certificate (CERT) resource records. (see RFC 2538)
+    #
+    #RFC 2782
+    class CERT < RR
+      ClassValue = nil #:nodoc: all
+      TypeValue = Types::CERT #:nodoc: all
+      
+      #Returns the format code for the certificate
+      attr_accessor :certtype
+      #Returns the key tag for the public key in the certificate
+      attr_accessor :keytag
+      #Returns the algorithm used by the certificate
+      attr_accessor :alg
+      #Returns the data comprising the certificate itself (in raw binary form)
+      attr_accessor :cert
+      
+      class CertificateTypes < CodeMapper
+        PKIX = 1 # PKIX (X.509v3)
+        SPKI = 2 # Simple Public Key Infrastructure
+        PGP = 3 # Pretty Good Privacy
+        IPKIX = 4 # URL of an X.509 data object
+        ISPKI = 5 # URL of an SPKI certificate
+        IPGP = 6 # Fingerprint and URL of an OpenPGP packet
+        ACPKIX = 7 # Attribute Certificate 
+        IACPKIX = 8 # URL of an Attribute Certificate       
+        URI = 253 # Certificate format defined by URI         
+        OID = 254 # Certificate format defined by OID
+        
+        update()
+      end
+      
+      def from_data(data) #:nodoc: all
+        @certtype = CertificateTypes::new(data[0])
+        @keytag = data[1]
+        @alg = Dnsruby::Algorithms.new(data[2])
+        @cert= data[3]
+      end
+      
+      def from_hash(hash) #:nodoc: all
+        @certtype = CertificateTypes::new(hash[:certtype])
+        @keytag = hash[:keytag]
+        @alg = Dnsruby::Algorithms.new(hash[:alg])
+        @cert= hash[:cert]
+      end
+      
+      def from_string(input) #:nodoc: all
+        if (input != "")
+          names = input.split(" ")
+          @certtype = CertificateTypes::new(names[0])
+          @keytag = names[1]
+          @alg = Dnsruby::Algorithms.new(names[2])
+          @cert = names[3]
+        end
+      end
+      
+      def rdata_to_string #:nodoc: all
+        return "#{@certtype.string} #{@keytag} #{@alg.string} #{@cert}"
+      end
+      
+      def encode_rdata(msg, canonical=false) #:nodoc: all
+        msg.put_pack('nnn', @certtype.code, @keytag, @alg.code)
+        msg.put_string(@cert)
+      end
+      
+      def self.decode_rdata(msg) #:nodoc: all
+        certtype, keytag, alg = msg.get_unpack('nnn')
+        cert = msg.get_string
+        return self.new([certtype, keytag, alg, cert])
+      end
+    end
+  end
+end	

data/lib/Dnsruby/resource/DNSKEY.rb

@@ -0,0 +1,242 @@
+#--
+#Copyright 2007 Nominet UK
+#
+#Licensed under the Apache License, Version 2.0 (the "License");
+#you may not use this file except in compliance with the License. 
+#You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0 
+#
+#Unless required by applicable law or agreed to in writing, software 
+#distributed under the License is distributed on an "AS IS" BASIS, 
+#WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 
+#See the License for the specific language governing permissions and 
+#limitations under the License.
+#++
+module Dnsruby
+  class RR
+    #RFC4034, section 2
+    #DNSSEC uses public key cryptography to sign and authenticate DNS
+    #resource record sets (RRsets).  The public keys are stored in DNSKEY
+    #resource records and are used in the DNSSEC authentication process
+    #described in [RFC4035]: A zone signs its authoritative RRsets by
+    #using a private key and stores the corresponding public key in a
+    #DNSKEY RR.  A resolver can then use the public key to validate
+    #signatures covering the RRsets in the zone, and thus to authenticate
+    #them.
+    class DNSKEY < RR
+      ClassValue = nil #:nodoc: all
+      TypeValue = Types::DNSKEY #:nodoc: all
+      
+      #Key is a zone key
+      ZONE_KEY = 0x100
+
+      #Key is a secure entry point key
+      SEP_KEY = 0x1
+
+      #The flags for the DNSKEY RR
+      attr_accessor :flags
+      #The protocol for this DNSKEY RR.
+      #MUST be 3.
+      attr_reader :protocol
+      #The algorithm used for this key
+      #See Dnsruby::Algorithms for permitted values
+      attr_reader :algorithm
+      #The public key
+      attr_reader :key
+      
+      def init_defaults
+        self.protocol=3
+        self.flags=ZONE_KEY
+        @algorithm=Algorithms.RSASHA1
+      end
+      
+      def protocol=(p)
+        if (p!=3)
+          raise DecodeError.new("DNSKEY protocol field set to #{p}, contrary to RFC4034 section 2.1.2")
+        else @protocol = p
+        end
+      end
+      
+      def algorithm=(a)
+        if (a.instance_of?String)
+          if (a.length == 1)
+            a = a.to_i
+          end
+        end
+        begin
+          alg = Algorithms.new(a)
+          @algorithm = alg
+        rescue ArgumentError => e
+          raise DecodeError.new(e)
+        end        
+      end
+      
+      def zone_key=(on)
+        if (on)
+          @flags |= ZONE_KEY
+        else
+          @flags &= (~ZONE_KEY)
+        end
+      end
+      
+      def zone_key?
+        return @flags & ZONE_KEY
+      end
+      
+      def sep_key=(on)
+        if (on)
+          @flags |= SEP_KEY
+        else
+          @flags &= (~SEP_KEY)
+        end
+      end
+      
+      def sep_key?
+        return @flags & SEP_KEY
+      end
+      
+      def flags=(f)
+        # Only two values allowed - 
+        # Zone Key flag (bit 7)
+        # Secure Entry Point flag (bit 15)
+        if ((f & ~ZONE_KEY & ~SEP_KEY) > 0)
+          raise DecodeError.new("Only zone key and secure entry point flags allowed for DNSKEY" +
+              " (RFC4034 section 2.1.1)")
+        else
+          @flags = f
+        end
+      end
+      
+      def from_data(data) #:nodoc: all
+        flags, protocol, algorithm, @key = data
+        self.flags=(flags)
+        self.protocol=(protocol)
+        self.algorithm=(algorithm)
+      end
+      
+      def from_string(input)
+        if (input.length > 0)
+          data = input.split(" ")
+          self.flags=(data[0].to_i)
+          self.protocol=(data[1].to_i)
+          self.algorithm=(data[2])
+          # key can include whitespace - include all text
+          # until we come to " )" at the end, and then gsub
+          # the white space out
+          # Also, brackets may or may not be present
+          buf = ""
+          index = 3
+          end_index = data.length - 1
+          if (data[index]=="(")
+            end_index = data.length - 2
+            index = 4
+          end
+          (index..end_index).each {|i|
+            buf += data[i]
+          }
+          self.key=(buf)
+        end
+      end
+      
+      def rdata_to_string #:nodoc: all
+        if (@flags!=nil)
+#          return "#{@flags} #{@protocol} #{@algorithm.string} ( #{Base64.encode64(@key.to_s)} )"
+          return "#{@flags} #{@protocol} #{@algorithm.string} ( #{[@key.to_s].pack("m*")} )"
+        else
+          return ""
+        end
+      end
+      
+      def encode_rdata(msg, canonical=false) #:nodoc: all
+        # 2 octets, then 2 sets of 1 octet
+        msg.put_pack('ncc', @flags, @protocol, @algorithm.to_i)
+        msg.put_bytes(@key)
+      end
+      
+      def self.decode_rdata(msg) #:nodoc: all
+        # 2 octets, then 2 sets of 1 octet
+        flags, protocol, algorithm = msg.get_unpack('ncc')
+        key = msg.get_bytes
+        return self.new(
+          [flags, protocol, algorithm, key])
+      end
+      
+      def key_tag
+        tag=0
+        rdata = MessageEncoder.new {|msg|
+          encode_rdata(msg)
+        }.to_s
+        if (@algorithm == Algorithms.RSAMD5)
+          #The key tag for algorithm 1 (RSA/MD5) is defined differently from the
+          #key tag for all other algorithms, for historical reasons.
+          d1 = rdata[rdata.length - 3] & 0xFF
+          d2 = rdata[rdata.length - 2] & 0xFF
+          tag = (d1 << 8) + d2
+        else
+          tag = 0
+          last = 0
+          0.step(rdata.length-1, 2) {|i|
+            last = i
+            d1 = rdata[i] & 0xFF
+            d2 = rdata[i + 1] & 0xFF
+            tag += ((d1 << 8) + d2)
+          }
+          last+=2
+          if (last < rdata.length)
+            d1 = rdata[last] & 0xFF
+            tag += (d1 << 8)
+          end
+          tag += ((tag >> 16) & 0xFFFF)
+        end
+        tag=tag&0xFFFF
+        return tag
+      end
+      
+      def key=(key_text)
+        key_text.gsub!(/\n/, "")
+        key_text.gsub!(/ /, "")
+#        @key=Base64.decode64(key_text)        
+        @key=key_text.unpack("m*")[0]
+      end
+      
+      def public_key
+        if (@public_key==nil)
+          if (@algorithm == Algorithms.RSASHA1)
+            @public_key = rsa_key
+          end
+        end
+        # @TODO@ Support other key encodings!
+        return @public_key
+      end
+      
+      def rsa_key
+        exponentLength = @key[0]
+        pos = 1
+        if (exponentLength == 0)
+          exponentLength = (@key[1]<<8) + @key[1]
+          pos += 2
+        end
+        exponent = get_num(@key[pos, exponentLength])
+        pos += exponentLength
+
+        modulus = get_num(@key[pos, @key.length])
+
+        key = OpenSSL::PKey::RSA.new
+        key.e = exponent
+        key.n = modulus
+        return key 
+      end
+      
+      def get_num(bytes)
+        ret = 0
+        shift = (bytes.length-1) * 8
+        bytes.each_byte {|byte|
+          ret += byte.to_i << shift
+          shift -= 8
+        }
+        return ret
+      end
+    end 
+  end
+end

data/lib/Dnsruby/resource/DS.rb

@@ -0,0 +1,162 @@
+#--
+#Copyright 2007 Nominet UK
+#
+#Licensed under the Apache License, Version 2.0 (the "License");
+#you may not use this file except in compliance with the License. 
+#You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0 
+#
+#Unless required by applicable law or agreed to in writing, software 
+#distributed under the License is distributed on an "AS IS" BASIS, 
+#WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 
+#See the License for the specific language governing permissions and 
+#limitations under the License.
+#++
+module Dnsruby
+  class RR
+    #RFC4034, section 4
+    #The DS Resource Record refers to a DNSKEY RR and is used in the DNS
+    #DNSKEY authentication process.  A DS RR refers to a DNSKEY RR by
+    #storing the key tag, algorithm number, and a digest of the DNSKEY RR.
+    #Note that while the digest should be sufficient to identify the
+    #public key, storing the key tag and key algorithm helps make the
+    #identification process more efficient.  By authenticating the DS
+    #record, a resolver can authenticate the DNSKEY RR to which the DS
+    #record points.  The key authentication process is described in
+    #[RFC4035].
+
+    class DS < RR
+      ClassValue = nil #:nodoc: all
+      TypeValue = Types::DS #:nodoc: all
+      
+      #The RDATA for a DS RR consists of a 2 octet Key Tag field, a 1 octet
+      #Algorithm field, a 1 octet Digest Type field, and a Digest field.
+      #
+      #                     1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
+      # 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+      #+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      #|           Key Tag             |  Algorithm    |  Digest Type  |
+      #+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      #/                                                               /
+      #/                            Digest                             /
+      #/                                                               /
+      #+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   
+
+      #The Key Tag field lists the key tag of the DNSKEY RR referred to by
+      #the DS record, in network byte order.
+      attr_accessor :key_tag
+      #The algorithm used for this key
+      #See Dnsruby::Algorithms for permitted values
+      attr_reader :algorithm
+      #The DS RR refers to a DNSKEY RR by including a digest of that DNSKEY
+      #RR.  The Digest Type field identifies the algorithm used to construct
+      #the digest.
+      attr_reader :digest_type
+      #The DS record refers to a DNSKEY RR by including a digest of that
+      #DNSKEY RR.
+      attr_accessor :digest
+      
+      def digest_type=(d)
+        if ((d == 1) || (d == "SHA-1") || (d == "1"))
+          @digest_type = 1
+        else
+          raise DecodeError.new("Unsupported DS digest type (#{d})")
+        end
+      end
+      
+      def algorithm=(a)
+        if (a.instance_of?String)
+          if (a.length == 1)
+            a = a.to_i
+          end
+        end
+        begin
+          alg = Algorithms.new(a)
+          @algorithm = alg
+        rescue ArgumentError => e
+          raise DecodeError.new(e)
+        end        
+      end
+      
+      # Return the digest of the specified DNSKEY RR
+      def digest_key(key)
+        data = MessageEncoder.new {|msg|
+          msg.put_rr(key, true)
+        }.to_s
+
+        OpenSSL::Digest::SHA1.new(data)
+        return digest
+
+      end
+
+      # Check if the key's digest is the same as that stored in the DS record      
+      def check_key(key)
+        if (key.key_tag == @key_tag)
+          digest = digest_key(key)
+          if (@digest == digest)
+            if (!key.zone_key?)
+            else
+              return true
+            end
+          else
+          end
+        end
+        return false
+      end
+      
+
+      def from_data(data) #:nodoc: all
+        key_tag, algorithm, digest_type, digest = data
+        self.key_tag=(key_tag)
+        self.algorithm=(algorithm)
+        self.digest_type=(digest_type)
+        self.digest=(digest)
+      end
+      
+      def from_string(input)
+        if (input.length > 0)
+          data = input.split(" ")
+          self.key_tag=(data[0].to_i)
+          self.algorithm=(data[1])
+          self.digest_type=(data[2])
+
+          buf = ""
+          index = 3
+          end_index = data.length - 1
+          if (data[index]=="(")
+            end_index = data.length - 2
+            index = 4
+          end
+          (index..end_index).each {|i|
+            buf += data[i]
+          } 
+#          self.digest=Base64.decode64(buf)
+          self.digest=buf.unpack("m*")[0]
+        end
+      end
+      
+      def rdata_to_string #:nodoc: all
+        if (@key_tag != nil)
+#          return "#{@key_tag.to_i} #{@algorithm.string} #{@digest_type} ( #{Base64.encode64(@digest)} )"
+          return "#{@key_tag.to_i} #{@algorithm.string} #{@digest_type} ( #{[@digest].pack("m*")} )"
+        else
+          return ""
+        end
+      end
+      
+      def encode_rdata(msg, canonical=false) #:nodoc: all
+        msg.put_pack("ncc", @key_tag, @algorithm.code, @digest_type)
+        msg.put_bytes(@digest)
+      end
+      
+      def self.decode_rdata(msg) #:nodoc: all
+        key_tag, algorithm, digest_type = msg.get_unpack("ncc")
+        digest = msg.get_bytes
+        return self.new(
+          [key_tag, algorithm, digest_type, digest])
+      end
+    end 
+  end
+end