dnsruby 1.26 → 1.30

data/lib/Dnsruby/validator_thread.rb

@@ -0,0 +1,108 @@
+module Dnsruby
+  # Takes care of the validation for the SelectThread. If queries need to be
+  # made in order to validate the response, then a separate thread is fired up
+  # to do this.
+  class ValidatorThread # :nodoc: all
+    #    include Singleton
+    def initialize(*args)
+      @client_id, @client_queue, @response, @err, @query, @st, @res = args
+      # Create the validation thread, and a queue to receive validation requests
+      # Actually, need to have a thread per validator, as they make recursive calls.
+      #      @@mutex = Mutex.new
+      #      @@validation_queue = Queue.new
+      #      @@validator_thread = Thread.new{
+      #        do_validate
+      #      }
+    end
+    def run
+      # ONLY START THE NEW THREAD IF VALIDATION NEED OCCUR!!
+      if (should_validate)
+        Thread.new{
+          do_validate
+        }
+      else
+        do_validate
+      end
+    end
+
+
+    #    def add_to_queue(item)
+    #      print "ADding to validator queue\n"
+    ##      @@mutex.synchronize{
+    #        @@validation_queue.push(item)
+    ##      }
+    #    end
+    def do_validate
+      #      while (true)
+      #        item = nil
+      #        print "Waiting to pop validation item\n"
+      ##        @@mutex.synchronize{
+      #          item = @@validation_queue.pop
+      ##        }
+      #      print "Popped validation request\n"
+      #        client_id, client_queue, response, err, query, st, res = item
+      validated_ok = validate(@query, @response, @res)
+
+      validated_ok = false if @error
+
+      cache_if_valid(@query, @response)
+
+      # Now send the response back to the client...
+      #      print "#{Time.now} : Got result for #{@query.question()[0].qname}, #{@query.question()[0].qtype}\n"
+      if (validated_ok)
+        @st.push_validation_response_to_select(@client_id, @client_queue, @response, nil, @query, @res)
+      else
+        @st.push_validation_response_to_select(@client_id, @client_queue, @response,
+          @response.security_error, @query, @res)
+      end
+
+
+      #      end
+    end
+
+
+    def should_validate
+      return ValidatorThread.requires_validation?(@query, @response, @error, @res)
+    end
+
+    def ValidatorThread.requires_validation?(query, response, error, res)
+      # @error will be nil for DNS RCODE errors - it will be true for TsigError. really?!
+      if ((!error || (error.instance_of?NXDomain)) && query.do_validation)
+        if (res.dnssec)
+          if (response.security_level != Message::SecurityLevel::SECURE)
+            return true
+          end
+        end
+      end
+      return false
+
+    end
+
+    def validate(query, response, res)
+      if (should_validate)
+        begin
+          # So, we really need to be able to take the response out of the select thread, along
+          # with the responsibility for sending the answer to the client.
+          # Should we have a validator thread? Or a thread per validation?
+          # Then, select thread gets response. It performs basic checks here.
+          # After basic checks, the select-thread punts the response (along with queues, etc.)
+          # to the validator thread.
+          # The validator validates it (or just releases it with no validation), and then
+          # sends the request to the client via the client queue.
+          Dnssec.validate_with_query(query,response)
+          return true
+        rescue VerifyError => e
+          response.security_error = e
+          # Response security_level should already be set
+          return false
+        end
+      end
+      return true
+    end
+
+    def cache_if_valid(query, response)
+      return if @error
+      PacketSender.cache(query, response)
+    end
+  end
+end

data/lib/Dnsruby/zone_transfer.rb

@@ -309,8 +309,8 @@ module Dnsruby
     
     def tcp_read(socket, len) #:nodoc: all
       buf=""
-      while (buf.length < len) do
-        buf += socket.recv(len-buf.length)
+      while (buf.length < len) and not socket.eof? do
+        buf += socket.read(len-buf.length)
       end
       return buf
     end
@@ -318,6 +318,9 @@ module Dnsruby
     def receive_message(socket) #:nodoc: all
       buf = tcp_read(socket, 2)
       answersize = buf.unpack('n')[0]
+      # Some servers (e.g. dnscache) apparently hang up on some connections.
+      # Thanks to Matt Palmer for the fix.
+      raise ResolvError.new("Server did not send a valid answer") if answersize.nil?
       buf = tcp_read(socket, answersize)
       msg = Message.decode(buf)
       if (@tsig)

data/lib/dnsruby.rb

@@ -48,6 +48,10 @@ require 'Dnsruby/TheLog'
 #
 #
 #== example
+#  res = Dnsruby::Resolver.new # System default
+#  ret = res.query("example.com")
+#  print "#{ret.anwer.length} answer records returned, #{ret.answer.rrsets.length} RRSets returned in aswer section\n"
+#
 #  p Dnsruby::Resolv.getaddress("www.ruby-lang.org")
 #  p Dnsruby::Resolv.getname("210.251.121.214")
 #
@@ -76,29 +80,28 @@ require 'Dnsruby/TheLog'
 #  
 #== I/O
 #Dnsruby implements a pure Ruby event loop to perform I/O.
-#Dnsruby can also use EventMachine to perform I/O, if it is available on the 
-#platform - but it must be enabled through the Dnsruby::Resolver class
+#Support for EventMachine has been deprecated.
 #
 #== DNSSEC
-#Dnsruby supports DNSSEC and NSEC3. 
-#DNSSEC support is on by default, but applications which wish to verify
-#responses locally will need to make explicit verification calls.
+#Dnsruby supports DNSSEC and NSEC(3).
+#DNSSEC support is on by default - but no trust anchors are configured by default.
 #See Dnsruby::Dnssec for more details.
 #
 #== Bugs
 #* NIS is not supported.
 #* /etc/nsswitch.conf is not supported.
-#* IPv6 is not supported.
+#* NSEC3 validation still TBD
 module Dnsruby
   
-      @@logger = Logger.new(STDOUT)
-      @@logger.level = Logger::FATAL
-      #Get the log for Dnsruby
-      #Use this to set the log level
-      #e.g. Dnsruby.log.level = Logger::INFO
-      def Dnsruby.log
-        @@logger
-      end
+  @@logger = Logger.new(STDOUT)
+  @@logger.level = Logger::FATAL
+  #Get the log for Dnsruby
+  #Use this to set the log level
+  #e.g. Dnsruby.log.level = Logger::INFO
+  def Dnsruby.log
+    @@logger
+  end
+      
   class OpCode < CodeMapper
     Query = 0        # RFC 1035
     IQuery = 1        # RFC 1035
@@ -122,7 +125,7 @@ module Dnsruby
     NOTAUTH = 9       # RFC 2136
     NOTZONE = 10       # RFC 2136
     
-    BADVERS = 16
+#    BADVERS = 16 # an EDNS ExtendedRCode
     BADSIG = 16
     BADKEY = 17
     BADTIME = 18
@@ -132,6 +135,11 @@ module Dnsruby
     
     update()    
   end
+
+  class ExtendedRCode < CodeMapper
+    BADVERS = 16
+    update()
+  end
   
   class Classes < CodeMapper
     IN        = 1       # RFC 1035
@@ -359,13 +367,15 @@ module Dnsruby
     DSA        = 3
     ECC        = 4
     RSASHA1    = 5
-#    RSASHA256  = 
+    #    RSASHA256  = 
     INDIRECT   = 252
     PRIVATEDNS = 253
     PRIVATEOID = 254
     update()
-    add_pair("DSA-NSEC3-SHA1", 131)
-    add_pair("RSASHA1-NSEC3-SHA1", 133)
+    # Referred to as Algoriths.DSA_NSEC3_SHA1
+    add_pair("DSA-NSEC3-SHA1", 6)
+    # Referred to as Algoriths.RSASHA1_NSEC3_SHA1
+    add_pair("RSASHA1-NSEC3-SHA1", 7)
   end  
   
   #An error raised while querying for a resource
@@ -399,6 +409,10 @@ module Dnsruby
   #Another kind of resolver error has occurred
   class OtherResolvError < ResolvError
   end
+
+  #An error occurred processing the TSIG
+  class TsigError < OtherResolvError
+  end
   
   #Indicates an error in decoding an incoming DNS message
   class DecodeError < ResolvError
@@ -508,6 +522,7 @@ module Dnsruby
     end
     
     
+    require 'Dnsruby/Cache'
     require 'Dnsruby/DNS'
     require 'Dnsruby/Hosts'
     require 'Dnsruby/message'

data/test/tc_cache.rb

@@ -0,0 +1,88 @@
+require 'test/unit'
+require 'dnsruby'
+include Dnsruby
+
+class TestCache < Test::Unit::TestCase
+  def test_cache
+    Dnsruby::PacketSender.clear_caches
+    m1 = Message.new("example.com.", Types.A, Classes.IN)
+    rr1 = RR.create("example.com.		3	IN	A	208.77.188.166")
+    m1.add_answer(rr1)
+    m1.header.aa = true
+    assert(!m1.cached)
+    Cache.add(m1)
+    ret = Cache.find("example.com", "A")
+    assert(ret.cached)
+    assert(ret.answer == m1.answer, "#{m1.answer}end\n#{ret.answer}end" )
+    assert(ret.answer.to_s == m1.answer.to_s, "#{m1.answer.to_s}end\n#{ret.answer.to_s}end" )
+    assert(ret.header.aa == false)
+    assert(ret.answer.rrsets()[0].ttl == 3)
+    sleep(1)
+    ret = Cache.find("example.com", "A")
+    assert(ret.cached)
+    assert((ret.answer.rrsets()[0].ttl == 2) || (ret.answer.rrsets()[0].ttl == 1), "ttl = #{ret.answer.rrsets()[0].ttl}")
+    assert(ret.answer != m1.answer, "ret.answer=#{ret.answer}\nm1.answer=#{m1.answer}" )
+    assert(ret.header.aa == false)
+    sleep(2) # TTL of 3 should have timed out now
+    ret = Cache.find("example.com", "A")
+    assert(!ret)
+    Cache.add(m1)
+    m2 = Message.new("example.com.", Types.A, Classes.IN)
+    rr2 = RR.create("example.com.		200	IN	A	208.77.188.166")
+    m2.add_answer(rr2)
+    m2.header.aa = true
+    Cache.add(m2)
+    ret = Cache.find("example.com", "A")
+    assert(ret.cached)
+    assert(ret.answer.rrsets()[0].ttl == 200)
+  end
+
+  def test_opt_record
+    # Create a very large message, encode it and decode it - there should be an opt record
+    # test getting that in and out the cache
+    # We should be able to do this in the online test by getting back a very big
+    # record from the test zone
+  end
+
+  def test_negative
+
+  end
+
+  def test_online
+    # @TODO@ !!!
+    # Get the records back from the test zone
+    Dnsruby::PacketSender.clear_caches
+    res = SingleResolver.new("ns0.validation-test-servers.nominet.org.uk.")
+    res.udp_size = 4096
+    query = Message.new("overflow.dnsruby.validation-test-servers.nominet.org.uk", Types.TXT)
+    ret = res.send_message(query)
+#    print "#{ret}\n"
+    assert(!ret.cached)
+    assert(ret.rcode == RCode.NoError)
+    assert(ret.header.aa)
+    # Store the ttls
+    first_ttls = ret.answer.rrset(
+      "overflow.dnsruby.validation-test-servers.nominet.org.uk", Types.TXT).ttl
+    # Wait a while
+    sleep(1)
+    # Ask for the same records
+    query = Message.new("overflow.dnsruby.validation-test-servers.nominet.org.uk", Types.TXT)
+    ret = res.send_message(query)
+#    print "#{ret}\n"
+    assert(ret.rcode == RCode.NoError)
+    assert(ret.cached)
+    second_ttls = ret.answer.rrset(
+      "overflow.dnsruby.validation-test-servers.nominet.org.uk", Types.TXT).ttl
+    # make sure the ttl is less the time we waited
+    assert((second_ttls == first_ttls - 1) || (second_ttls == first_ttls - 2),
+            "First ttl = #{first_ttls}, second = #{second_ttls}\n")
+    # make sure the header flags (and ID) are right
+    assert(ret.header.id == query.header.id, "First id = #{query.header.id}, cached response was #{ret.header.id}\n")
+    assert(!ret.header.aa)
+  end
+
+  def test_online_uncached
+    # @TODO@ Check that wildcard queries are not cached
+  end
+
+end

data/test/tc_dlv.rb

@@ -0,0 +1,55 @@
+require 'test/unit'
+require 'dnsruby'
+include Dnsruby
+
+class TestDlv < Test::Unit::TestCase
+  def test_dlv
+    # Enable DLV (only) for validation.
+    # Try to validate some records which can only be done through dlv
+    # OK - if we don't configure trust anchors, and there is no signed root, then this is easy!
+        Dnsruby::Dnssec.clear_trusted_keys
+    Dnsruby::Dnssec.clear_trust_anchors
+    Dnsruby::PacketSender.clear_caches
+#    Dnssec.do_validation_with_recursor(true)
+    # @TODO@ Should use whole RRSet of authoritative NS for these resolvers,
+    # not individual servers!
+    res = Dnsruby::Resolver.new("a.ns.se")
+    res.add_server("b.ns.se")
+    res.dnssec=true
+    ret = res.query("se.", Dnsruby::Types.ANY)
+    assert(ret.security_level == Dnsruby::Message::SecurityLevel::INSECURE)
+
+    res = Dnsruby::Resolver.new("ns3.nic.se")
+    res.add_server("ns2.nic.se")
+    res.dnssec = true
+    ret = res.query("ns2.nic.se", Dnsruby::Types.A)
+    assert(ret.security_level == Dnsruby::Message::SecurityLevel::INSECURE)
+
+    # Load DLV key
+    dlv_key = RR.create("dlv.isc.org. IN DNSKEY 257 3 5 BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt TDN0YUuWrBNh")
+    Dnssec.add_dlv_key(dlv_key)
+    Dnsruby::PacketSender.clear_caches
+
+
+    res = Dnsruby::Recursor.new()
+    ret = res.query("ns2.nic.se", Dnsruby::Types.A)
+    assert(ret.security_level == Dnsruby::Message::SecurityLevel::SECURE)
+
+    ret = res.query("b.ns.nic.cz", Dnsruby::Types.A)
+    assert(ret.security_level == Dnsruby::Message::SecurityLevel::SECURE)
+
+    # Test .gov
+#    Dnsruby::TheLog.level = Logger::DEBUG
+    ret = res.query("nih.gov", "NS")
+    assert(ret.security_level = Dnsruby::Message::SecurityLevel::SECURE)
+  end
+
+  def test_scrub_non_authoritative
+#    Dnssec.do_validation_with_recursor(true)
+    res = Dnsruby::Recursor.new()
+    ret = res.query("frobbit.se")
+      res.prune_rrsets_to_rfc5452(ret, "frobbit.se.")
+      Dnssec.validate(ret)
+    assert(ret.security_level == Dnsruby::Message::SecurityLevel::SECURE)
+  end
+end

data/test/tc_dns.rb

@@ -80,7 +80,9 @@ class TestDNS < Test::Unit::TestCase
     #
     Dnsruby.log.level=Logger::FATAL
     [:nameserver].each do |test|
-      [{}, 'kjghdfkjhase',1,'\1',nil].each do |input|
+#      [{}, 'kjghdfkjhase',1,'\1',nil].each do |input|
+# Config now only checks that an IPv4, IPv6 or Name can be made with each input
+      [{},1,nil].each do |input|
         res=nil
         begin
           res = Dnsruby::DNS.new({test => input})

data/test/tc_dnskey.rb

@@ -9,8 +9,21 @@ class DnskeyTest < Test::Unit::TestCase
     "Mv1LyBUgia7za6ZEzOJBOztyvhjL" + 
     "742iU/TpPSEDhm2SNKLijfUppn1U" +
     "aNvv4w==  )"
+  BADINPUT = "example.com. 86400 IN DNSKEY 384 3 5 ( AQPSKmynfzW4kyBv015MUG2DeIQ3" + 
+    "Cbl+BBZH4b/0PY1kxkmvHjcZc8no" + 
+    "kfzj31GajIQKY+5CptLr3buXA10h" +
+    "WqTkF7H6RfoRqXQeogmMHfpftf6z" +
+    "Mv1LyBUgia7za6ZEzOJBOztyvhjL" + 
+    "742iU/TpPSEDhm2SNKLijfUppn1U" +
+    "aNvv4w==  )"
+  #  def test_bad_flag
+  #    dnskey = Dnsruby::RR.create(BADINPUT)    
+  #    assert_equal(384, dnskey.flags)
+  #    assert(dnskey.bad_flags?)
+  #  end
   def test_dnskey_from_string
     dnskey = Dnsruby::RR.create(INPUT)
+    #    assert(!dnskey.bad_flags?)
     assert_equal(3, dnskey.protocol)
     assert_equal(256, dnskey.flags)
     assert_equal(Dnsruby::Algorithms::RSASHA1, dnskey.algorithm)
@@ -38,14 +51,17 @@ class DnskeyTest < Test::Unit::TestCase
       fail()
     rescue Dnsruby::DecodeError
     end
-    begin
-      dnskey.flags=4
-      fail()
-    rescue Dnsruby::DecodeError
-    end
+    dnskey.flags=4
+    assert_equal(4, dnskey.flags)
+    assert(dnskey.flags == 4, dnskey.flags)
     dnskey.flags=256
+    assert_equal(256, dnskey.flags)
+#    assert(!dnskey.bad_flags?)
     dnskey.flags=257
+    assert_equal(257, dnskey.flags)
+#    assert(!dnskey.bad_flags?)
     dnskey.flags=1
+    assert_equal(1, dnskey.flags)
     dnskey.protocol=3
      
   end

data/test/tc_ds.rb

@@ -1,5 +1,6 @@
 require 'test/unit'
 require 'openssl'
+require 'digest/sha2'
 require 'dnsruby'
 
 class DsTest < Test::Unit::TestCase
@@ -64,13 +65,6 @@ class DsTest < Test::Unit::TestCase
   end
   
   def test_sha2
-    begin
-      s = OpenSSL::Digest::SHA256
-    rescue Exception
-      print "SHA256 not available - skipping that test\n"
-      return
-    end
-      
      # Create a new DS from the DNSKEY, 
      key = Dnsruby::RR.create(DNSKEY)