dnsruby 1.26 → 1.30

data/lib/Dnsruby/name.rb

@@ -42,9 +42,9 @@ module Dnsruby
     def self.create(arg)
       case arg
       when Name
-        return arg
+        return Name.new(arg.labels, arg.absolute?)
       when String
-#        arg.gsub!(/\.$/o, "")
+        #        arg.gsub!(/\.$/o, "")
         if (arg==".")
           return Name.new([],true)
         end
@@ -52,7 +52,7 @@ module Dnsruby
           return Name.new([],false)
         end
         return Name.new(split_escaped(arg), /\.\z/ =~ arg ? true : false)
-#        return Name.new(Label.split(arg), /\.\z/ =~ arg ? true : false)
+        #        return Name.new(Label.split(arg), /\.\z/ =~ arg ? true : false)
       when Array
         return Name.new(arg, /\.\z/ =~ ((arg.last.kind_of?String)?arg.last : arg.last.string) ? true : false)
       else        
@@ -98,6 +98,15 @@ module Dnsruby
     def absolute?
       return @absolute
     end
+
+    def absolute=(on) # :nodoc:
+      @absolute = on
+    end
+
+    def strip_label # :nodoc:
+      n = Name.new(self.labels()[1, self.labels.length-1], self.absolute?)
+      return n
+    end
     
     #Is this name a wildcard?
     def wild?
@@ -106,6 +115,36 @@ module Dnsruby
       end
       return (labels[0].string == '*')
     end
+
+    def canonically_before(n)
+      if (!(Name === n))
+        n = Name.create(n)
+      end
+      # @TODO@ Work out whether this name is canonically before the passed Name
+      # RFC 4034 section 6.1
+      # For the purposes of DNS security, owner names are ordered by treating
+      #individual labels as unsigned left-justified octet strings.  The
+      #absence of a octet sorts before a zero value octet, and uppercase
+      #US-ASCII letters are treated as if they were lowercase US-ASCII
+      #letters.
+      #To compute the canonical ordering of a set of DNS names, start by
+      #sorting the names according to their most significant (rightmost)
+      #labels.  For names in which the most significant label is identical,
+      #continue sorting according to their next most significant label, and
+      #so forth.
+
+      # Get the list of labels for both names, and then swap them
+      my_labels = @labels.reverse
+      other_labels = n.labels.reverse
+      my_labels.each_index {|i|
+        if (!other_labels[i])
+          return false
+        end
+        next if (other_labels[i].downcase == my_labels[i].downcase)
+        return (my_labels[i].downcase < other_labels[i].downcase)
+      }
+      return true
+    end
     
     def ==(other) # :nodoc:
       return false unless Name === other
@@ -123,7 +162,6 @@ module Dnsruby
     #   p Resolv::Name.create("z").subdomain_of?(domain) #=> false
     #   p Resolv::Name.create("x.y.z.").subdomain_of?(domain) #=> false
     #   p Resolv::Name.create("w.z").subdomain_of?(domain) #=> false
-    #
     def subdomain_of?(other)
       raise ArgumentError, "not a domain name: #{other.inspect}" unless Name === other
       return false if @absolute != other.absolute?

data/lib/Dnsruby/resource/CERT.rb

@@ -64,7 +64,7 @@ module Dnsruby
         if (input != "")
           names = input.split(" ")
           @certtype = CertificateTypes::new(names[0])
-          @keytag = names[1]
+          @keytag = names[1].to_i
           @alg = Dnsruby::Algorithms.new(names[2])
           @cert = names[3]
         end

data/lib/Dnsruby/resource/DNSKEY.rb

@@ -28,6 +28,9 @@ module Dnsruby
       ClassValue = nil #:nodoc: all
       TypeValue = Types::DNSKEY #:nodoc: all
       
+      #Key is revoked
+      REVOKED_KEY = 0x80
+      
       #Key is a zone key
       ZONE_KEY = 0x100
 
@@ -35,7 +38,7 @@ module Dnsruby
       SEP_KEY = 0x1
 
       #The flags for the DNSKEY RR
-      attr_accessor :flags
+      attr_reader :flags
       #The protocol for this DNSKEY RR.
       #MUST be 3.
       attr_reader :protocol
@@ -72,6 +75,19 @@ module Dnsruby
         end        
       end
       
+      def revoked=(on)
+        print "setting revoke"
+        if (on)
+          @flags |= REVOKED_KEY
+        else
+          @flags &= (~REVOKED_KEY)
+        end
+      end
+      
+      def revoked?
+        return ((@flags & REVOKED_KEY) > 0)
+      end
+
       def zone_key=(on)
         if (on)
           @flags |= ZONE_KEY
@@ -81,7 +97,7 @@ module Dnsruby
       end
       
       def zone_key?
-        return @flags & ZONE_KEY
+        return ((@flags & ZONE_KEY) > 0)
       end
       
       def sep_key=(on)
@@ -93,21 +109,29 @@ module Dnsruby
       end
       
       def sep_key?
-        return @flags & SEP_KEY
+        return ((@flags & SEP_KEY) > 0)
       end
       
       def flags=(f)
-        # Only two values allowed - 
+        # Only three values allowed - 
         # Zone Key flag (bit 7)
         # Secure Entry Point flag (bit 15)
-        if ((f & ~ZONE_KEY & ~SEP_KEY) > 0)
-          raise DecodeError.new("Only zone key and secure entry point flags allowed for DNSKEY" +
-              " (RFC4034 section 2.1.1)")
-        else
-          @flags = f
+        # Revoked bit (bit 8) - RFC 5011
+        if ((f & ~ZONE_KEY & ~SEP_KEY & ~REVOKED_KEY) > 0)
+          TheLog.info("DNSKEY: Only zone key, secure entry point and revoked flags allowed for DNSKEY" +
+              " (RFC4034 section 2.1.1) : #{f} entered as input")
         end
+
+        @flags = f
       end
       
+      #      def bad_flags?
+      #        if ((@flags & ~ZONE_KEY & ~SEP_KEY) > 0)
+      #          return true
+      #        end
+      #        return false
+      #      end
+      #
       def from_data(data) #:nodoc: all
         flags, protocol, algorithm, @key = data
         self.flags=(flags)
@@ -214,9 +238,13 @@ module Dnsruby
       end
       
       def public_key
-        if (@public_key==nil)
-          if (@algorithm == Algorithms.RSASHA1)
+        if (@public_key.nil?)
+          if [Algorithms.RSASHA1,
+              Algorithms.RSASHA1_NSEC3_SHA1].include?(@algorithm)
             @public_key = rsa_key
+          elsif [Algorithms.DSA,
+              Algorithms.DSA_NSEC3_SHA1].include?(@algorithm)
+            @public_key = dsa_key
           end
         end
         # @TODO@ Support other key encodings!
@@ -237,25 +265,38 @@ module Dnsruby
           exponentLength = (key1<<8) + key1
           pos += 2
         end
-        exponent = get_num(@key[pos, exponentLength])
+        exponent = RR::get_num(@key[pos, exponentLength])
         pos += exponentLength
 
-        modulus = get_num(@key[pos, @key.length])
+        modulus = RR::get_num(@key[pos, @key.length])
 
-        key = OpenSSL::PKey::RSA.new
-        key.e = exponent
-        key.n = modulus
-        return key 
+        pkey = OpenSSL::PKey::RSA.new
+        pkey.e = exponent
+        pkey.n = modulus
+        return pkey 
       end
       
-      def get_num(bytes)
-        ret = 0
-        shift = (bytes.length-1) * 8
-        bytes.each_byte {|byte|
-          ret += byte.to_i << shift
-          shift -= 8
-        }
-        return ret
+      def dsa_key
+        t = @key[0]
+        t = t.getbyte(0) if t.class == String
+        pgy_len = t * 8 + 64
+        pos = 1
+        q = RR::get_num(@key[pos, 20])
+        pos += 20
+        p = RR::get_num(@key[pos, pgy_len])
+        pos += pgy_len
+        g = RR::get_num(@key[pos, pgy_len])
+        pos += pgy_len
+        y = RR::get_num(@key[pos, pgy_len])
+        pos += pgy_len
+        
+        pkey = OpenSSL::PKey::DSA.new
+        pkey.p = p
+        pkey.q = q
+        pkey.g = g
+        pkey.pub_key = y
+        
+        pkey
       end
     end 
   end

data/lib/Dnsruby/resource/DS.rb

@@ -14,6 +14,11 @@
 #limitations under the License.
 #++
 require 'base64'
+begin
+require 'Digest/sha2'
+rescue LoadError
+  require 'digest/sha2'
+end
 module Dnsruby
   class RR
     #RFC4034, section 4
@@ -118,7 +123,7 @@ module Dnsruby
             digestbin = OpenSSL::Digest::SHA1.digest(data)
             return digestbin
         elsif (digest_type.code == 2) 
-            digestbin = OpenSSL::Digest::SHA256.digest(data)
+            digestbin = Digest::SHA256.digest(data)
             return digestbin
         end
 
@@ -126,7 +131,7 @@ module Dnsruby
       
       # Check if the key's digest is the same as that stored in the DS record      
       def check_key(key)
-        if (key.key_tag == @key_tag)
+        if ((key.key_tag == @key_tag) && (key.algorithm == @algorithm))
           
           digestbin = digest_key(key)
           if (@digestbin == digestbin)

data/lib/Dnsruby/resource/NAPTR.rb

@@ -50,8 +50,8 @@ module Dnsruby
       def from_string(input) #:nodoc: all
         if (input.length > 0)
           values = input.split(" ")
-          @order = values [0]
-          @preference = values [1]
+          @order = values [0].to_i
+          @preference = values [1].to_i
           @flags = values [2]
           @service = values [3]
           @regexp = values [4]

data/lib/Dnsruby/resource/NSEC.rb

@@ -41,7 +41,30 @@ module Dnsruby
         nxt = Name.create(n)
         @next_domain = nxt
       end
+
+      def check_name_in_range(n)
+        # Check if the name is covered by this record
+        if (@name.wild?)
+          return check_name_in_wildcard_range(n)
+        end
+        if (name.canonically_before(n) && (n.canonically_before(next_domain)))
+          return true
+        end
+        return false
+      end
       
+      def check_name_in_wildcard_range(n)
+        #  Check if the name is covered by this record
+        return false if !@name.wild?
+        return false if @next_domain.canonically_before(n)
+        # Now just check that the wildcard is *before* the name
+        # Strip the first label ("*") and then compare
+        n2 = Name.create(@name)
+        n2.labels.delete_at(0)
+        return false if n.canonically_before(n2)
+        return true
+      end
+
       def types=(t)
         @types = NSEC.get_types(t)
       end
@@ -200,7 +223,7 @@ module Dnsruby
               bitmap.length.times do |i|
                 output[start+2+i] = bitmap[i]
               end
-           end
+            end
           end
           window += 1
           
@@ -210,6 +233,9 @@ module Dnsruby
             break
           end
         }
+        if (output[0].class == String)
+          output = output.force_encoding("ascii-8bit")
+        end
         return output
       end
 
@@ -223,7 +249,10 @@ module Dnsruby
         if (input.length > 0)
           data = input.split(" ")
           self.next_domain=(data[0])
-          len = data[0].length + data[1].length + 1
+          len = data[0].length+ 1
+          if (data[1] == "(")
+            len = len + data[1].length
+          end
           self.types=(input[len, input.length-len])
         end
       end

data/lib/Dnsruby/resource/NSEC3.rb

@@ -13,6 +13,32 @@
 #See the License for the specific language governing permissions and 
 #limitations under the License.
 #++
+module Base32
+  module_function
+  def encode32hex(str)
+    str.gsub(/\G(.{5})|(.{1,4}\z)/mn) do
+      full = $1; frag = $2
+      n, c = (full || frag.ljust(5, "\0")).unpack("NC")
+      full = ((n << 8) | c).to_s(32).rjust(8, "0")
+      if frag
+        full[0, (frag.length*8+4).div(5)].ljust(8, "=").upcase
+      else
+        full.upcase
+      end
+    end
+  end
+
+  HEX = '[0-9a-v]'
+  def decode32hex(str)
+    str.gsub(/\G\s*(#{HEX}{8}|#{HEX}{7}=|#{HEX}{5}={3}|#{HEX}{4}={4}|#{HEX}{2}={6}|(\S))/imno) do
+      raise "invalid base32" if $2
+      s = $1
+      s.tr("=", "0").to_i(32).divmod(256).pack("NC")[0,
+        (s.count("^=")*5).div(8)]
+    end
+  end
+end
+
 module Dnsruby
   class RR
     #The NSEC3 Resource Record (RR) provides authenticated denial of
@@ -60,6 +86,16 @@ module Dnsruby
       #NSEC RR's owner name
       attr_reader :types
       
+      def check_name_in_range(name)
+        # @TODO@ Check if the name is covered by this record
+        return false
+      end
+
+      def check_name_in_wildcard_range(name)
+        # @TODO@ Check if the name is covered by this record
+        return false
+      end
+
       def hash_alg=(a)
         if (a.instance_of?String)
           if (a.length == 1)
@@ -121,6 +157,29 @@ module Dnsruby
         self.next_hashed=(next_hashed)
         self.types=(types)
       end
+
+      def decode_salt(input)
+        if (input == "-")
+          @salt = []
+        end
+        # @TODO@
+          @salt = input
+      end
+
+      def encode_salt(s)
+        if (s.length == 0)
+          return "-"
+        end
+        return s
+      end
+
+      def decode_next_hashed(input)
+        @next_hashed = Base32.decode32hex(input)
+      end
+
+      def encode_next_hashed(n)
+        return Base32.encode32hex(n)
+      end
       
       def from_string(input)
         if (input.length > 0)
@@ -128,12 +187,25 @@ module Dnsruby
           self.hash_alg=(data[0]).to_i
           self.flags=(data[1]).to_i
           self.iterations=(data[2]).to_i
-          self.salt=(data[3])
-          self.salt_length=(data[3].length)
-          self.next_hashed=(data[5])
-          self.hash_length=(data[5].length)
-          len = data[0].length + data[1].length + data[2].length + data[3].length + data[5].length + 7
-          self.types=(input[len, input.length-len])
+          self.salt=decode_salt(data[3])
+          self.salt_length=(@salt.length)
+
+          len = data[0].length + data[1].length + data[2].length + data[3].length + 4
+          # There may or may not be brackets around next_hashed
+          if (data[4] == "(")
+            len = len + data[4].length + 1
+          end
+          next_hashed_and_types = (input[len, input.length-len])
+          data2 = next_hashed_and_types.split()
+
+
+          self.next_hashed=decode_next_hashed(data2[0])
+          self.hash_length=(@next_hashed.length)
+          len2 = data2[0].length + 1
+          self.types = next_hashed_and_types[len2, next_hashed_and_types.length - len2]
+#          self.types=data2[1]
+#          #          len = data[0].length + data[1].length + data[2].length + data[3].length + data[5].length + 7
+#          #          self.types=(input[len, input.length-len])
         end
       end
       
@@ -143,8 +215,10 @@ module Dnsruby
           @types.each do |t|
             type_strings.push(t.string)
           end
+          salt = encode_salt(@salt)
+          next_hashed = encode_next_hashed(@next_hashed)
           types = type_strings.join(" ")
-          return "#{@hash_alg.code} #{@flags} #{@iterations} #{@salt} ( #{@next_hashed} #{types} )"
+          return "#{@hash_alg.code} #{@flags} #{@iterations} #{salt} ( #{next_hashed} #{types} )"
         else
           return ""
         end
@@ -161,7 +235,11 @@ module Dnsruby
       
       def self.decode_rdata(msg) #:nodoc: all
         hash_alg, flags, iterations, salt_length = msg.get_unpack("ccnc")
-        salt = msg.get_bytes(salt_length)
+        # Salt may be omitted
+        salt = []
+        if (salt_length > 0)
+          salt = msg.get_bytes(salt_length)
+        end
         hash_length, = msg.get_unpack("c")
         next_hashed = msg.get_bytes(hash_length)
         types = NSEC.decode_types(msg.get_bytes)