dnsruby 1.26 → 1.30

data/lib/Dnsruby/key_cache.rb

@@ -0,0 +1,85 @@
+module Dnsruby
+  class KeyCache #:nodoc: all
+    # Cache includes expiration time for keys
+    # Cache removes expired records
+    def initialize(keys = nil)
+      # Store key tag against [expiry, key]
+      @keys = {}
+      add(keys)
+    end
+    def add_key_with_expiration(k, expiration)
+      priv_add_key(k, expiration)
+    end
+    def add(k)
+      if (k == nil)
+        return false
+      elsif (k.instance_of?RRSet)
+        add_rrset(k)
+      elsif (k.kind_of?KeyCache)
+        kaes = k.keys_and_expirations
+        kaes.keys.each { |keykey|
+          #            priv_add_key(keykey, kaes[keykey])
+          priv_add_key(keykey[1], keykey[0])
+        }
+      else
+        raise ArgumentError.new("Expected an RRSet or KeyCache! Got #{k.class}")
+      end
+      return true
+    end
+
+    def add_rrset(k)
+      # Get expiration from the RRSIG
+      # There can be several RRSIGs here, one for each key which has signed the RRSet
+      # We want to choose the one with the most secure signing algorithm, key length,
+      # and the longest expiration time - not easy!
+      # for now, we simply accept all signed keys
+      k.sigs.each { |sig|
+        if (sig.type_covered = Types.DNSKEY)
+          if (sig.inception <= Time.now.to_i)
+            # Check sig.expiration, sig.algorithm
+            if (sig.expiration > Time.now.to_i)
+              # add the keys to the store
+              k.rrs.each {|rr| priv_add_key(rr, sig.expiration)}
+            end
+          end
+        end
+      }
+    end
+
+    def priv_add_key(k, exp)
+      # Check that the key does not already exist with a longer expiration!
+      if (@keys[k] == nil)
+        @keys[k.key_tag] = [exp,k]
+      elsif ((@keys[k])[0] < exp)
+        @keys[k.key_tag] = [exp,k]
+      end
+    end
+
+    def each
+      # Only offer currently-valid keys here
+      remove_expired_keys
+      @keys.values.each {|v| yield v[1]}
+    end
+    def keys
+      # Only offer currently-valid keys here
+      remove_expired_keys
+      ks = []
+      @keys.values.each {|a| ks.push(a[1])}
+      return ks
+      #        return @keys.keys
+    end
+    def keys_and_expirations
+      remove_expired_keys
+      return keys.values
+    end
+    def remove_expired_keys
+      @keys.delete_if {|k,v|
+        v[0] < Time.now.to_i
+      }
+    end
+    def find_key_for(name)
+      each {|key| return key if key.name == name}
+      return false
+    end
+  end
+end

data/lib/Dnsruby/message.rb

@@ -58,18 +58,50 @@ module Dnsruby
   #
   #      Dnsruby::Message#encode
   #      Dnsruby::Message::decode(data)
+  #
+  #===Additional information
+  #security_level records the current DNSSEC status of this Message.
+  #answerfrom records the server which this Message was received from.
+  #cached records whether this response came from the cache.
+  #
   class Message
+    # The security level (see RFC 4035 section 4.3)
+    class SecurityLevel < CodeMapper
+      INDETERMINATE = -2
+      BOGUS = -1
+      UNCHECKED = 0
+      INSECURE = 1
+      SECURE = 2
+      update()
+    end
+    # If dnssec is set on, then each message will have the security level set
+    # To find the precise error (if any), call Dnsruby::Dnssec::validate(msg) -
+    # the resultant exception will define the error.
+    attr_accessor :security_level
+    # If there was a problem verifying this message with DNSSEC, then securiy_error
+    # will hold a description of the problem. It defaults to ""
+    attr_accessor :security_error
+
+    # If the Message was returned from the cache, the cached flag will be set
+    # true. It will be false otherwise.
+    attr_accessor :cached
+
+
     class Section < Array
+      def initialize(msg = nil)
+        @msg = msg
+        super(0)
+      end
       # Return the rrset of the specified type in this section
-      def rrset(type, klass=Classes::IN)
+      def rrset(name, type=Types.A, klass=Classes::IN)
         rrs = select{|rr| 
-          (type_ok = rr.type==type)
+          type_ok = (rr.type==type)
           if (rr.type == Types.RRSIG)
             type_ok = (rr.type_covered == type)
           end
-          type_ok && rr.klass == klass          
+          type_ok && (rr.klass == klass) && (rr.name.to_s.downcase == name.to_s.downcase)
         }
-        rrset = RRSet.new
+        rrset = RRSet.new()
         rrs.each do |rr|
           rrset.add(rr)
         end
@@ -77,10 +109,32 @@ module Dnsruby
       end
       
       # Return an array of all the rrsets in the section
-      def rrsets
+      def rrsets(type = nil, include_opt = false)
+        if (type && !(Types === type))
+          type = Types.new(type)
+        end
         ret = []
         each do |rr|
-          next if (rr.type == Types.OPT)
+          next if (!include_opt && (rr.type == Types.OPT))
+          #          if (type)
+          #            next if ((rr.type == Types.RRSIG) && (type != Types.RRSIG) && (rr.type_covered != type))
+          #            next if (rr.type != type)
+          #          end
+          if (type)
+            # if this is an rrsig type, then :
+            #    only include it if the type_covered is the type requested,
+            #    OR if the type requested is an RRSIG
+            if (rr.type == Types.RRSIG)
+              if ((rr.type_covered == type) || (type == Types.RRSIG))
+              else
+                next
+              end
+#              next if ((rr.type_covered != type) || (type != Types.RRSIG))
+            elsif (rr.type != type)
+              next
+            end
+          end
+
           found_rrset = false
           ret.each do |rrset|
             found_rrset = rrset.add(rr)
@@ -92,26 +146,60 @@ module Dnsruby
         end
         return ret        
       end
+      def ==(other)
+        return false unless (other.instance_of?Message::Section)
+        return false if (other.rrsets(true).length != self.rrsets(true).length)
+        otherrrsets = other.rrsets(true)
+        self.rrsets(true).each {|rrset|
+          return false unless otherrrsets.include?rrset
+        }
+        return true
+      end
+
+      def remove_rrset(name, type)
+        # Remove all RRs with the name and type from the section.
+        # Need to worry about header counts here - can we get Message to
+        # update the counts itself, rather than the section worrying about it?
+        rrs_to_delete = []
+        each do |rr|
+          next if rr.rr_type == Types.OPT
+          if ((rr.name.to_s.downcase == name.to_s.downcase) &&
+                ((rr.type == type) ||
+                  ((rr.type == Types.RRSIG) && (rr.type_covered == type)) ))
+            rrs_to_delete.push(rr)
+          end
+        end
+        rrs_to_delete.each {|rr|
+          delete(rr)
+        }
+        @msg.update_counts if @msg
+      end
     end
     #Create a new Message. Takes optional name, type and class
-    # 
+    #
     #type defaults to A, and klass defaults to IN
-    # 
+    #
     #*  Dnsruby::Message.new("example.com") # defaults to A, IN
     #*  Dnsruby::Message.new("example.com", 'AAAA')
     #*  Dnsruby::Message.new("example.com", Dnsruby::Types.PTR, "HS")
-    #    
+    #
     def initialize(*args)
       @header = Header.new()
-      @question = Section.new
-      @answer = Section.new
-      @authority = Section.new
-      @additional = Section.new
+      @question = Section.new(self)
+      @answer = Section.new(self)
+      @authority = Section.new(self)
+      @additional = Section.new(self)
       @tsigstate = :Unsigned
       @signing = false
       @tsigkey = nil
       @answerfrom = nil
       @answerip = nil
+      @send_raw = false
+      @do_validation = true
+      @do_caching = true
+      @security_level = SecurityLevel.UNCHECKED
+      @security_error = nil
+      @cached = false
       type = Types.A
       klass = Classes.IN
       if (args.length > 0)
@@ -147,14 +235,14 @@ module Dnsruby
     #If this Message is a response from a server, then answersize contains the size of the response
     attr_accessor :answersize
     
-    #If this message has been verified using a TSIG RR then tsigerror contains 
+    #If this message has been verified using a TSIG RR then tsigerror contains
     #the error code returned by the TSIG verification. The error will be an RCode
     attr_accessor :tsigerror
     
     #Can be
     #* :Unsigned - the default state
     #* :Signed - the outgoing message has been signed
-    #* :Verified - the incoming message has been verified
+    #* :Verified - the incoming message has been verified by TSIG
     #* :Intermediate - the incoming message is an intermediate envelope in a TCP session
     #in which only every 100th envelope must be signed
     #* :Failed - the incoming response failed verification
@@ -163,6 +251,42 @@ module Dnsruby
     #--
     attr_accessor :tsigstart
     #++
+    
+    #Set send_raw if you wish to send and receive the response to this Message
+    #with no additional processing. In other words, if set, then Dnsruby will
+    #not touch the Header of the outgoing Message. This option does not affect
+    #caching or dnssec validation
+    #
+    #This option should not normally be set.
+    attr_accessor :send_raw
+
+    #do_validation is set by default. If you do not wish dnsruby to validate
+    #this message (on a Resolver with @dnssec==true), then set do_validation
+    #to false. This option does not affect caching, or the header options
+    attr_accessor :do_validation
+
+    #do_caching is set by default. If you do not wish dnsruby to inspect the
+    #cache before sending the query, nor cache the result of the query, then
+    #set do_caching to false.
+    attr_accessor :do_caching
+
+    def get_exception
+      exception = nil
+      if (rcode==RCode.NXDOMAIN)
+        exception = NXDomain.new
+      elsif (rcode==RCode.SERVFAIL)
+        exception = ServFail.new
+      elsif (rcode==RCode.FORMERR)
+        exception = FormErr.new
+      elsif (rcode==RCode.NOTIMP)
+        exception = NotImp.new
+      elsif (rcode==RCode.REFUSED)
+        exception = Refused.new
+      elsif (rcode >= RCode.BADSIG && rcode <= RCode.BADALG)
+        return VerifyError.new # @TODO@
+      end
+      return exception
+    end
 
     def ==(other)
       ret = false
@@ -175,39 +299,50 @@ module Dnsruby
       end
       return ret
     end
-    
-    # Return the rrset of the specified type in the  section
-    def rrset(type, klass=Classes::IN)
+
+    # Return the first rrset of the specified attributes in the message
+    def rrset(name, type, klass = Classes::IN)
       [@answer, @authority, @additional].each do |section|
-        if ((rrset = section.rrset(type, klass)).length > 0)
+        if ((rrset = section.rrset(name, type, klass)).length > 0)
           return rrset
         end
       end
-      return nil
+      return RRSet.new
+    end
+    
+    # Return the rrsets of the specified type in the message
+    def rrsets(type, klass=Classes::IN)
+      rrsets = []
+      [@answer, @authority, @additional].each do |section|
+        if ((rrset = section.rrsets(type, klass)).length > 0)
+          rrsets.push(rrset)
+        end
+      end
+      return rrsets
     end
     
     # Return a hash, with the section as key, and the RRSets in that
     # section as the data : {section => section_rrs}
-    def section_rrsets
+    def section_rrsets(type = nil, include_opt = false)
       ret = {}
       ["answer", "authority", "additional"].each do |section|
-        ret[section] = self.send(section).rrsets
-      end  
-      return ret      
+        ret[section] = self.send(section).rrsets(type, include_opt)
+      end
+      return ret
     end
     
-    #Add a new Question to the Message. Takes either a Question, 
+    #Add a new Question to the Message. Takes either a Question,
     #or a name, and an optional type and class.
-    # 
+    #
     #* msg.add_question(Question.new("example.com", 'MX'))
     #* msg.add_question("example.com") # defaults to Types.A, Classes.IN
     #* msg.add_question("example.com", Types.LOC)
     def add_question(question, type=Types.A, klass=Classes.IN)
-      if (!question.kind_of?Question) 
+      if (!question.kind_of?Question)
         question = Question.new(question, type, klass)
       end
       @question << question
-      @header.qdcount = @question.length
+      update_counts
     end
     
     def each_question
@@ -215,12 +350,19 @@ module Dnsruby
         yield rec
       }
     end
+
+    def update_counts # :nodoc:all
+      @header.ancount = @answer.length
+      @header.arcount = @additional.length
+      @header.qdcount = @question.length
+      @header.nscount = @authority.length
+    end
     
     
     def add_answer(rr) #:nodoc: all
       if (!@answer.include?rr)
         @answer << rr
-        @header.ancount = @answer.length
+        update_counts
       end
     end
     
@@ -233,7 +375,7 @@ module Dnsruby
     def add_authority(rr) #:nodoc: all
       if (!@authority.include?rr)
         @authority << rr
-        @header.nscount = @authority.length
+        update_counts
       end
     end
     
@@ -246,7 +388,7 @@ module Dnsruby
     def add_additional(rr) #:nodoc: all
       if (!@additional.include?rr)
         @additional << rr
-        @header.arcount = @additional.length
+        update_counts
       end
     end
     
@@ -267,7 +409,7 @@ module Dnsruby
       each_authority {|rec| yield rec}
       each_additional {|rec| yield rec}
     end
-    
+
     # Returns the TSIG record from the ADDITIONAL section, if one is present.
     def tsig
       if (@additional.last)
@@ -322,11 +464,11 @@ module Dnsruby
       rcode = @header.get_header_rcode
       opt = get_opt
       if (opt != nil)
-        rcode = rcode.code + (opt.xrcode << 4)
+        rcode = rcode.code + (opt.xrcode.code << 4)
         rcode = RCode.new(rcode)
       end
       return rcode;
-    end    
+    end
 
     def to_s
       retval = "";
@@ -334,6 +476,7 @@ module Dnsruby
       if (@answerfrom != nil && @answerfrom != "")
         retval = retval + ";; Answer received from #{@answerfrom} (#{@answersize} bytes)\n;;\n";
       end
+      retval = retval + ";; Security Level : #{@security_level.string}\n"
       
       retval = retval + ";; HEADER SECTION\n"
       # OPT pseudosection? EDNS flags, udpsize
@@ -387,7 +530,7 @@ module Dnsruby
       return retval;
     end
     
-    #Signs the message. If used with no arguments, then the message must have already 
+    #Signs the message. If used with no arguments, then the message must have already
     #been set (set_tsig). Otherwise, the arguments can either be a Dnsruby::RR::TSIG
     #object, or a (name, key) tuple, or a hash which takes
     #Dnsruby::RR::TSIG attributes (e.g. name, key, fudge, etc.)
@@ -401,12 +544,12 @@ module Dnsruby
       else
         if ((@tsigkey) && @tsigstate == :Unsigned)
           @tsigkey.apply(self)
-        end      
+        end
       end
     end
     
     #Return the encoded form of the message
-    # If there is a TSIG record present and the record has not been signed 
+    # If there is a TSIG record present and the record has not been signed
     # then sign it
     def encode
       if ((@tsigkey) && @tsigstate == :Unsigned && !@signing)
@@ -530,7 +673,11 @@ module Dnsruby
     #Query response code
     #deprecated - use Message#rcode
     #    attr_reader :rcode
-    # This new get_header_rcode method is intended for use only by the Message class
+
+    # This new get_header_rcode method is intended for use only by the Message class.
+    # This is because the Message OPT section may contain an extended rcode (see
+    # RFC 2671 section 4.6). Using the header rcode only ignores this extension, and
+    # is not recommended.
     def get_header_rcode
       @rcode
     end
@@ -547,7 +694,7 @@ module Dnsruby
     #The number of records in the additional record section og the message
     attr_accessor :arcount
     
-    def initialize(*args)  
+    def initialize(*args)
       if (args.length == 0)
         @id = rand(MAX_ID)
         @qr = false
@@ -564,7 +711,7 @@ module Dnsruby
         @ancount = 0
         @arcount = 0
       elsif (args.length == 1)
-        decode(args[0])        
+        decode(args[0])
       end
     end
     
@@ -598,7 +745,7 @@ module Dnsruby
         (@tc ? 1:0) << 9 |
         (@rd ? 1:0) << 8 |
         (@ra ? 1:0) << 7 |
-        (@ad ? 1:0) << 5 | 
+        (@ad ? 1:0) << 5 |
         (@cd ? 1:0) << 4 |
         (@rcode.code & 15),
         @qdcount,
@@ -683,22 +830,6 @@ module Dnsruby
       @rcode = RCode.new(flag & 15)
     end
     
-    def get_exception
-      exception = nil
-      if (@rcode==RCode.NXDOMAIN)
-        exception = NXDomain.new
-      elsif (@rcode==RCode.SERVFAIL)
-        exception = ServFail.new
-      elsif (@rcode==RCode.FORMERR)
-        exception = FormErr.new
-      elsif (@rcode==RCode.NOTIMP)
-        exception = NotImp.new
-      elsif (@rcode==RCode.REFUSED)
-        exception = Refused.new
-      end
-      return exception
-    end
-    
     alias zocount qdcount
     alias zocount= qdcount=
     
@@ -770,7 +901,7 @@ module Dnsruby
         when littlec, bigc
           len += 1
         when littleh, bigh
-          len += 1          
+          len += 1
         when littlen
           len += 2
         when bign
@@ -792,7 +923,7 @@ module Dnsruby
       if (len.class == String)
         len = len.getbyte(0)
       end
-      raise DecodeError.new("limit exceeded\nlimit = #{@limit}, index = #{@index}, len = #{len}\n") if @limit < @index + 1 + len
+      raise DecodeError.new("limit exceeded\nlimit = #{@limit}, index = #{@index}, len = #{len}\n") if @limit < @index + 1 + (len ? len:0)
       d = @data[@index + 1, len]
       @index += 1 + len
       return d
@@ -804,7 +935,7 @@ module Dnsruby
         strings << self.get_string
       end
       strings
-    end    
+    end
     
     def get_name
       return Name.new(self.get_labels)
@@ -815,7 +946,7 @@ module Dnsruby
       d = []
       while true
         temp = @data[@index]
-        if (temp.class == String) 
+        if (temp.class == String)
           temp = (temp.getbyte(0))
         end
         case temp # @data[@index]
@@ -840,10 +971,14 @@ module Dnsruby
     end
     
     def get_label
-      label = Name::Label.new(Name::decode(self.get_string))
-      return label
-#         return Name::Label::Str.new(self.get_string)
-     end
+      begin
+        label = Name::Label.new(Name::decode(self.get_string))
+        return label
+        #         return Name::Label::Str.new(self.get_string)
+      rescue ResolvError => e
+        raise DecodeError(e) # Turn it into something more suitable
+      end
+    end
     
     def get_question
       name = self.get_name
@@ -866,7 +1001,7 @@ module Dnsruby
       rec.klass = klass
       return rec
     end
-  end 
+  end
   
   class MessageEncoder #:nodoc: all
     def initialize
@@ -962,12 +1097,12 @@ module Dnsruby
     #
     #If an IPv4 or IPv6 object is used then the type is set to PTR.
     def initialize(*args)
-      if (args.length > 0) 
-        @qtype = Types.A
-        if (args.length > 1) 
+      @qtype = Types.A
+      @qclass = Classes.IN
+      if (args.length > 0)
+        if (args.length > 1)
           @qtype = Types.new(args[1])
-          @qclass = Classes.IN
-          if (args.length > 2) 
+          if (args.length > 2)
             @qclass = Classes.new(args[2])
           end
         end
@@ -1018,7 +1153,7 @@ module Dnsruby
       else
         @qname = Name.create(qname)
       end
-    end  
+    end
     
     #Returns a string representation of the question record.
     def to_s