dnsruby 1.24 → 1.26

data/lib/Dnsruby/message.rb

@@ -176,15 +176,15 @@ module Dnsruby
       return ret
     end
     
-    #    # Return the rrset of the specified type in the  section
-    #    def rrset(type, klass=Classes::IN)
-    #      [@answer, @authority, @additional].each do |section|
-    #        if ((rrset = section.rrset(type, klass)).length > 0)
-    #          return rrset
-    #        end
-    #      end
-    #      return nil
-    #    end
+    # Return the rrset of the specified type in the  section
+    def rrset(type, klass=Classes::IN)
+      [@answer, @authority, @additional].each do |section|
+        if ((rrset = section.rrset(type, klass)).length > 0)
+          return rrset
+        end
+      end
+      return nil
+    end
     
     # Return a hash, with the section as key, and the RRSets in that
     # section as the data : {section => section_rrs}
@@ -319,13 +319,13 @@ module Dnsruby
     end
     
     def rcode
-	rcode = @header.get_header_rcode
-	opt = get_opt
-	if (opt != nil)
-            rcode = rcode.code + (opt.xrcode << 4)
-            rcode = RCode.new(rcode)
-        end
-	return rcode;
+      rcode = @header.get_header_rcode
+      opt = get_opt
+      if (opt != nil)
+        rcode = rcode.code + (opt.xrcode << 4)
+        rcode = RCode.new(rcode)
+      end
+      return rcode;
     end    
 
     def to_s
@@ -529,8 +529,8 @@ module Dnsruby
     
     #Query response code
     #deprecated - use Message#rcode
-#    attr_reader :rcode
-# This new get_header_rcode method is intended for use only by the Message class
+    #    attr_reader :rcode
+    # This new get_header_rcode method is intended for use only by the Message class
     def get_header_rcode
       @rcode
     end
@@ -748,13 +748,13 @@ module Dnsruby
     
     def get_unpack(template)
       len = 0
-        littlec = ?c
-        bigc = ?C
-        littleh = ?h
-        bigh = ?H
-        littlen = ?n
-        bign = ?N
-        star = ?*
+      littlec = ?c
+      bigc = ?C
+      littleh = ?h
+      bigh = ?H
+      littlen = ?n
+      bign = ?N
+      star = ?*
       if (littlec.class != Fixnum)
         # We're using Ruby 1.9 - convert the codes
         littlec = littlec.getbyte(0)
@@ -842,7 +842,8 @@ module Dnsruby
     def get_label
       label = Name::Label.new(Name::decode(self.get_string))
       return label
-    end
+#         return Name::Label::Str.new(self.get_string)
+     end
     
     def get_question
       name = self.get_name
@@ -928,8 +929,7 @@ module Dnsruby
           return
         else
           @names[domain] = @data.length
-          first = d[i]
-          self.put_label(first)
+          self.put_label(d[i])
         end
       }
       @data << "\0"

data/lib/Dnsruby/name.rb

@@ -45,6 +45,12 @@ module Dnsruby
         return arg
       when String
 #        arg.gsub!(/\.$/o, "")
+        if (arg==".")
+          return Name.new([],true)
+        end
+        if (arg=="")
+          return Name.new([],false)
+        end
         return Name.new(split_escaped(arg), /\.\z/ =~ arg ? true : false)
 #        return Name.new(Label.split(arg), /\.\z/ =~ arg ? true : false)
       when Array

data/lib/Dnsruby/resource/DNSKEY.rb

@@ -141,7 +141,7 @@ module Dnsruby
       
       def rdata_to_string #:nodoc: all
         if (@flags!=nil)
-#          return "#{@flags} #{@protocol} #{@algorithm.string} ( #{Base64.encode64(@key.to_s)} )"
+          #          return "#{@flags} #{@protocol} #{@algorithm.string} ( #{Base64.encode64(@key.to_s)} )"
           return "#{@flags} #{@protocol} #{@algorithm.string} ( #{[@key.to_s].pack("m*").gsub("\n", "")} )"
         else
           return ""
@@ -176,15 +176,13 @@ module Dnsruby
         else
           tag = 0
           last = 0
-          0.step(rdata.length-1, 2) {|i|
+          0.step(rdata.length - 1, 2) {|i|
             last = i
             d1 = rdata[i]
-            d2 = rdata[i + 1]
+            d2 = rdata[i + 1] || 0 # odd number of bytes possible
 
-          if (d1.class == String) # Ruby 1.9
-            d1 = d1.getbyte(0)
-            d2 = d2.getbyte(0)
-          end
+            d1 = d1.getbyte(0) if d1.class == String # Ruby 1.9
+            d2 = d2.getbyte(0) if d2.class == String # Ruby 1.9
           
             d1 = d1  & 0xFF
             d2 = d2  & 0xFF
@@ -211,7 +209,7 @@ module Dnsruby
       def key=(key_text)
         key_text.gsub!(/\n/, "")
         key_text.gsub!(/ /, "")
-#        @key=Base64.decode64(key_text)        
+        #        @key=Base64.decode64(key_text)        
         @key=key_text.unpack("m*")[0]
       end
       

data/lib/Dnsruby/resource/RRSIG.rb

@@ -91,8 +91,8 @@ module Dnsruby
         @algorithm=Algorithms.RSASHA1
         @type_covered = Types.A
         @original_ttl = 3600
-        @inception = Time.now
-        @expiration = Time.now
+        @inception = Time.now.to_i
+        @expiration = Time.now.to_i
         @key_tag = 0
         @labels = 0
         self.signers_name="."
@@ -135,8 +135,8 @@ module Dnsruby
       def from_data(data) #:nodoc: all
         type_covered, algorithm, @labels, @original_ttl, expiration, inception, 
           @key_tag, signers_name, @signature = data
-        @expiration = Time.at(expiration)
-        @inception = Time.at(inception)
+        @expiration = expiration
+        @inception = inception
         self.type_covered=(type_covered)
         self.signers_name=(signers_name)
         self.algorithm=(algorithm)
@@ -204,14 +204,14 @@ module Dnsruby
           hour=input[8,2]
           min=input[10,2]
           sec=input[12,2]
-          return Time.mktime(year, mon, day, hour, min, sec)
+          return Time.mktime(year, mon, day, hour, min, sec).to_i
         else
           raise DecodeError.new("RRSIG : Illegal time value #{input} - see RFC 4034 section 3.2")
         end
       end
       
       def format_time(time)
-        return time.strftime("%Y%m%d%H%M%S")
+        return Time.at(time).strftime("%Y%m%d%H%M%S")
       end
       
       def rdata_to_string #:nodoc: all
@@ -243,8 +243,8 @@ module Dnsruby
         signers_name = msg.get_name
         signature  = msg.get_bytes
         return self.new(
-          [type_covered, algorithm, labels, original_ttl, Time.at(expiration),
-            Time.at(inception), key_tag, signers_name, signature])
+          [type_covered, algorithm, labels, original_ttl, expiration,
+            inception, key_tag, signers_name, signature])
       end
       
       def sig_data

data/lib/Dnsruby/resource/resource.rb

@@ -93,35 +93,53 @@ module Dnsruby
       return true
     end
     
-    #Return a new RRset which contains the RRs from this
-    #RRset into canonical order (RFC 4034 section 6)
     def sort_canonical
-      #Make a list, for all the RRs, where each RR contributes 
+      #Make a list, for all the RRs, where each RR contributes
       #the canonical RDATA encoding
-      canonical_rrs = []
+      canonical_rrs = {}
       self.rrs.each do |rr|
         data = MessageEncoder.new {|msg|
-          msg.put_rr(rr, true)
+          rr.encode_rdata(msg, true)
         }.to_s
-        canonical_rrs.push(data)
+        canonical_rrs[data] = rr
       end
-      
-      # Check there are no identical records - if there are duplicated entries
-      # then remove them
-      canonical_rrs.uniq!
-      
-      #Sort it (the absence of an octet sorts before a zero octet.)
-      canonical_rrs.sort!
-      
+
       return_rrs = RRSet.new
-      canonical_rrs.each {|rr|
-        MessageDecoder.new(rr) {|msg|
-          new_rr = msg.get_rr
-          return_rrs.add(new_rr)
-        }
+      canonical_rrs.keys.sort.each { |rdata|
+        return_rrs.add(canonical_rrs[rdata])
       }
       return return_rrs
     end
+
+#    #Return a new RRset which contains the RRs from this
+#    #RRset into canonical order (RFC 4034 section 6)
+#    def sort_canonical
+#      #Make a list, for all the RRs, where each RR contributes 
+#      #the canonical RDATA encoding
+#      canonical_rrs = []
+#      self.rrs.each do |rr|
+#        data = MessageEncoder.new {|msg|
+#          msg.put_rr(rr, true)
+#        }.to_s
+#        canonical_rrs.push(data)
+#      end
+#      
+#      # Check there are no identical records - if there are duplicated entries
+#      # then remove them
+#      canonical_rrs.uniq!
+#      
+#      #Sort it (the absence of an octet sorts before a zero octet.)
+#      canonical_rrs.sort!
+#      
+#      return_rrs = RRSet.new
+#      canonical_rrs.each {|rr|
+#        MessageDecoder.new(rr) {|msg|
+#          new_rr = msg.get_rr
+#          return_rrs.add(new_rr)
+#        }
+#      }
+#      return return_rrs
+#    end
     
     #Delete the RR from this RRSet
     def delete(rr)

data/lib/dnsruby.rb

@@ -359,6 +359,7 @@ module Dnsruby
     DSA        = 3
     ECC        = 4
     RSASHA1    = 5
+#    RSASHA256  = 
     INDIRECT   = 252
     PRIVATEDNS = 253
     PRIVATEOID = 254

data/test/tc_dnssec.rb

@@ -4,14 +4,16 @@ require 'dnsruby'
 class DnssecTest < Test::Unit::TestCase
   def test_follow_chain_of_trust
     Dnsruby::Dnssec.clear_trusted_keys
+    Dnsruby::Dnssec.clear_trust_anchors
     res = Dnsruby::Resolver.new("dnssec.nominet.org.uk")
+    res.udp_size = 5000
     res.dnssec=true
 
     trusted_key = Dnsruby::RR.create({:name => "uk-dnssec.nic.uk.",
         :type => Dnsruby::Types.DNSKEY,
         :key=> "AQPJO6LjrCHhzSF9PIVV7YoQ8iE31FXvghx+14E+jsv4uWJR9jLrxMYm sFOGAKWhiis832ISbPTYtF8sxbNVEotgf9eePruAFPIg6ZixG4yMO9XG LXmcKTQ/cVudqkU00V7M0cUzsYrhc4gPH/NKfQJBC5dbBkbIXJkksPLv Fe8lReKYqocYP6Bng1eBTtkA+N+6mSXzCwSApbNysFnm6yfQwtKlr75p m+pd0/Um+uBkR4nJQGYNt0mPuw4QVBu1TfF5mQYIFoDYASLiDQpvNRN3 US0U5DEG9mARulKSSw448urHvOBwT9Gx5qF2NE4H9ySjOdftjpj62kjb Lmc8/v+z"
       })
-    ret = Dnsruby::Dnssec.add_trusted_key(trusted_key)
+    ret = Dnsruby::Dnssec.add_trust_anchor_with_expiration(trusted_key, Time.now.to_i + 500000)
 
     r = res.query("uk-dnssec.nic.uk", Dnsruby::Types.ANY)
     ret = Dnsruby::Dnssec.verify(r)
@@ -30,29 +32,39 @@ class DnssecTest < Test::Unit::TestCase
     assert(ret, "Dnssec verification failed")
     
     r = res.query("aaa.bigzone.uk-dnssec.nic.uk", Dnsruby::Types.ANY)
-    ret = Dnsruby::Dnssec.verify(r)
-    assert(ret, "Dnssec verification failed")
-        
-    rrset = r.answer.rrset('NSEC')
+
+    rrset = r.authority.rrset('NSEC')
+    assert(rrset.rrs.length > 0)
+    assert(rrset.sigs.length > 0)
     ret = Dnsruby::Dnssec.verify_rrset(rrset)
     assert(ret, "Dnssec verification failed")
+
+    ret = Dnsruby::Dnssec.verify(r) # no DS record for aaa - validate should work
+    assert(ret, "Dnssec verification failed")
+    ret = Dnsruby::Dnssec.validate(r) # no DS record for aaa - validate should work
+    assert(ret, "Dnssec validation failed")
+
   end
   
   def test_se_query
     # Run some queries on the .se zone
     Dnsruby::Dnssec.clear_trusted_keys
+    Dnsruby::Dnssec.clear_trust_anchors
     res = Dnsruby::Resolver.new("a.ns.se")
+    res.dnssec = true
     r = res.query("se", Dnsruby::Types.ANY)    
-    keys = r.answer.rrset('DNSKEY')
-    keys = Dnsruby::Dnssec::KeyCache.new(keys)
+    # See comment below
+    Dnsruby::Dnssec.add_trusted_key(r.answer.rrset('DNSKEY'))
     nss = r.answer.rrset('NS')
-    ret = Dnsruby::Dnssec.verify_rrset(nss, keys)
+    ret = Dnsruby::Dnssec.verify_rrset(nss)
     assert(ret, "Dnssec verification failed")    
   end
     
   def test_verify_message
     Dnsruby::Dnssec.clear_trusted_keys
+    Dnsruby::Dnssec.clear_trust_anchors
     res = Dnsruby::Resolver.new("a.ns.se")
+    res.udp_size = 5000
     r = res.query("se", Dnsruby::Types.ANY)    
     # This shouldn't be in the code - but the key is rotated by the .se registry
     # so we can't keep up with it in the test code.
@@ -62,15 +74,66 @@ class DnssecTest < Test::Unit::TestCase
     assert(ret, "Dnssec message verification failed")    
   end
   
+  def test_verify_message_fails
+    Dnsruby::Dnssec.clear_trusted_keys
+    Dnsruby::Dnssec.clear_trust_anchors
+    res = Dnsruby::Resolver.new("a.ns.se")
+    r = res.query("se", Dnsruby::Types.ANY)    
+    # Haven't configured key for this, so should fail
+    begin
+      ret = Dnsruby::Dnssec.verify(r)
+      fail
+    rescue (Dnsruby::VerifyError)
+    end
+    #    assert(!ret, "Dnssec message verification failed")    
+  end
+  
+  def test_validation
+    Dnsruby::Dnssec.clear_trusted_keys
+    Dnsruby::Dnssec.clear_trust_anchors
+    res = Dnsruby::Resolver.new("dnssec.nominet.org.uk")
+    res.dnssec=true
+
+    trusted_key = Dnsruby::RR.create({:name => "uk-dnssec.nic.uk.",
+        :type => Dnsruby::Types.DNSKEY,
+        :key=> "AQPJO6LjrCHhzSF9PIVV7YoQ8iE31FXvghx+14E+jsv4uWJR9jLrxMYm sFOGAKWhiis832ISbPTYtF8sxbNVEotgf9eePruAFPIg6ZixG4yMO9XG LXmcKTQ/cVudqkU00V7M0cUzsYrhc4gPH/NKfQJBC5dbBkbIXJkksPLv Fe8lReKYqocYP6Bng1eBTtkA+N+6mSXzCwSApbNysFnm6yfQwtKlr75p m+pd0/Um+uBkR4nJQGYNt0mPuw4QVBu1TfF5mQYIFoDYASLiDQpvNRN3 US0U5DEG9mARulKSSw448urHvOBwT9Gx5qF2NE4H9ySjOdftjpj62kjb Lmc8/v+z"
+      })
+    ret = Dnsruby::Dnssec.add_trust_anchor_with_expiration(trusted_key, Time.now.to_i + 5000)
+
+    r = res.query("aaa.bigzone.uk-dnssec.nic.uk", Dnsruby::Types.ANY)
+    ret = Dnsruby::Dnssec.validate(r)
+    assert(ret, "Dnssec validation failed")
+    
+    # @TODO@ Test other validation policies!!
+  end
+
+  def test_resolver_cd_validation_fails
+    res = Dnsruby::Resolver.new("a.ns.se")
+    r = res.query("se", Dnsruby::Types.ANY)
+    # @TODO@ Check the response here
+    #    fail("Implement Resolver validation checking!")
+    print("Implement Resolver validation checking!")
+    # We wanna check with CD on and off, and make sure it fails/works
+    # need to remember to get resolver to validate iff cd on query is true
+  end
+  
   def test_trusted_key
     Dnsruby::Dnssec.clear_trusted_keys
+    Dnsruby::Dnssec.clear_trust_anchors
     res = Dnsruby::Resolver.new("dnssec.nominet.org.uk")
+    res.dnssec = true
     bad_key = Dnsruby::RR.create(
       "uk-dnssec.nic.uk. 86400 IN DNSKEY 257 3 5 "+
         "AwEAAbhThsjZqxZDyZLie1BYP+R/G1YRhmuIFCbmuQiF4NB86gpW8EVR l2s+gvNuQw6yh2YdDdyJBselE4znRP1XQbpOTC5UO5CDwge9NYja/jrX lvrX2N048vhIG8uk8yVxJDosxf6nmptsJBp3GAjF25soJs07Bailcr+5 vdZ7GibH")
+    ret = Dnsruby::Dnssec.add_trust_anchor(bad_key)
     r = res.query("uk-dnssec.nic.uk", Dnsruby::Types.DNSKEY)
-    ret = Dnsruby::Dnssec.verify(r, bad_key)
-    assert(!ret, "Dnssec trusted key message verification should have failed with bad key")    
+    
+    begin
+      ret = Dnsruby::Dnssec.verify(r)
+      fail("Dnssec trusted key message verification should have failed with bad key")    
+    rescue (Dnsruby::VerifyError)
+      #    assert(!ret, "Dnssec trusted key message verification should have failed with bad key")    
+    end
     trusted_key = Dnsruby::RR.create({:name => "uk-dnssec.nic.uk.",
         :type => Dnsruby::Types.DNSKEY,
         :flags => 257,
@@ -78,11 +141,28 @@ class DnssecTest < Test::Unit::TestCase
         :algorithm => 5,
         :key=> "AQPJO6LjrCHhzSF9PIVV7YoQ8iE31FXvghx+14E+jsv4uWJR9jLrxMYm sFOGAKWhiis832ISbPTYtF8sxbNVEotgf9eePruAFPIg6ZixG4yMO9XG LXmcKTQ/cVudqkU00V7M0cUzsYrhc4gPH/NKfQJBC5dbBkbIXJkksPLv Fe8lReKYqocYP6Bng1eBTtkA+N+6mSXzCwSApbNysFnm6yfQwtKlr75p m+pd0/Um+uBkR4nJQGYNt0mPuw4QVBu1TfF5mQYIFoDYASLiDQpvNRN3 US0U5DEG9mARulKSSw448urHvOBwT9Gx5qF2NE4H9ySjOdftjpj62kjb Lmc8/v+z"
       })
-    ret = Dnsruby::Dnssec.verify(r, trusted_key)
+    ret = Dnsruby::Dnssec.add_trust_anchor(trusted_key)
+    ret = Dnsruby::Dnssec.verify(r)
     assert(ret, "Dnssec trusted key message verification failed")    
 
-    # Check that keys have been added to trusted key cache
-    ret = Dnsruby::Dnssec.verify(r)
-    assert(ret, "Dnssec trusted key cache failed")    
+    #    # Check that keys have been added to trusted key cache
+    #    ret = Dnsruby::Dnssec.verify(r)
+    #    assert(ret, "Dnssec trusted key cache failed")    
+  end
+  
+  def test_expired_keys
+    # Add some keys with an expiration of 1 second.
+    # Then wait a second or two, and check they are not available any more.
+    Dnsruby::Dnssec.clear_trusted_keys
+    Dnsruby::Dnssec.clear_trust_anchors
+    assert(Dnsruby::Dnssec.trusted_keys.length==0)
+    trusted_key = Dnsruby::RR.create({:name => "uk-dnssec.nic.uk.",
+        :type => Dnsruby::Types.DNSKEY,
+        :key=> "AQPJO6LjrCHhzSF9PIVV7YoQ8iE31FXvghx+14E+jsv4uWJR9jLrxMYm sFOGAKWhiis832ISbPTYtF8sxbNVEotgf9eePruAFPIg6ZixG4yMO9XG LXmcKTQ/cVudqkU00V7M0cUzsYrhc4gPH/NKfQJBC5dbBkbIXJkksPLv Fe8lReKYqocYP6Bng1eBTtkA+N+6mSXzCwSApbNysFnm6yfQwtKlr75p m+pd0/Um+uBkR4nJQGYNt0mPuw4QVBu1TfF5mQYIFoDYASLiDQpvNRN3 US0U5DEG9mARulKSSw448urHvOBwT9Gx5qF2NE4H9ySjOdftjpj62kjb Lmc8/v+z"
+      })
+    Dnsruby::Dnssec.add_trust_anchor_with_expiration(trusted_key, Time.now.to_i + 1)
+    assert(Dnsruby::Dnssec.trust_anchors.length==1)
+    sleep(2)
+    assert(Dnsruby::Dnssec.trust_anchors.length==0)
   end
 end

data/test/tc_packet.rb

@@ -51,11 +51,17 @@ class TestPacket < Test::Unit::TestCase
     assert_equal(1, packet.header.ancount, 'First push into answer section worked');      #10
       
       
+    ret = packet.answer.rrset('NSEC')
+    assert_equal(ret.rrs.length, 0, "#{ret.rrs.length}")
+    ret = packet.answer.rrset('A')
+    assert_equal(ret.rrs.length, 1, "#{ret.rrs.length}")
+    ret = packet.answer.rrsets()
+    assert_equal(ret.length, 1, "#{ret.length}")
+    
     packet.add_answer(RR.create({:name    => "a2.example.com",
           :type    => "A", :address => "10.0.0.2"}));
     assert_equal(packet.header.ancount, 2, 'Second push into answer section worked');     #11
-      
-      
+          
     packet.add_authority(RR.create({:name    => "a3.example.com",
           :type    => "A",
           :address => "10.0.0.3"}));