dnsruby 1.26 → 1.30

data/test/tc_itar.rb

@@ -0,0 +1,76 @@
+require 'test/unit'
+require 'dnsruby'
+include Dnsruby
+
+class TestItar < Test::Unit::TestCase
+  def test_itar
+    Dnsruby::Dnssec.clear_trusted_keys
+    Dnsruby::Dnssec.clear_trust_anchors
+    Dnsruby::PacketSender.clear_caches
+    run_test_se(true)
+    Dnsruby::Dnssec.clear_trusted_keys
+    Dnsruby::Dnssec.clear_trust_anchors
+    Dnsruby::Recursor.clear_caches
+
+    # Then try to validate some records in the published zones
+    Dnsruby::PacketSender.clear_caches
+    # Download the ITAR - add the DS records to dnssec
+    Dnssec.load_itar()
+
+    run_test_se(false)
+  end
+
+  def test_with_no_dlv_anchor
+    Dnsruby::Dnssec.clear_trusted_keys
+    Dnsruby::Dnssec.clear_trust_anchors
+    Dnsruby::PacketSender.clear_caches
+    Dnsruby::Recursor.clear_caches
+    # Make sure we don't have any other anchors configured!
+    # @TODO@ Should use whole RRSet of authoritative NS for these resolvers,
+    # not individual servers!
+    #    res = Dnsruby::Resolver.new("a.ns.se")
+    res = Dnsruby::Recursor.new
+    #    res.add_server("b.ns.se")
+    #    res.dnssec=true
+    #    TheLog.level = Logger::DEBUG
+    ret = res.query("frobbit.se.", Dnsruby::Types.A)
+    assert(ret.security_level == Dnsruby::Message::SecurityLevel::INSECURE, "Level = #{ret.security_level.string}")
+    Dnsruby::Dnssec.clear_trusted_keys
+    Dnsruby::Dnssec.clear_trust_anchors
+    Dnsruby::PacketSender.clear_caches
+    Dnsruby::Recursor.clear_caches
+    Dnssec.load_itar
+    res = Dnsruby::Recursor.new
+    ret = res.query("frobbit.se.", Dnsruby::Types.A)
+    assert(ret.security_level == Dnsruby::Message::SecurityLevel::SECURE)
+
+    res = Dnsruby::Recursor.new
+    #    res.dnssec = true
+    ret = res.query("ns2.nic.se.", Dnsruby::Types.A)
+    assert(ret.security_level == Dnsruby::Message::SecurityLevel::SECURE)
+  end
+
+  def run_test_se(should_fail)
+    res = Dnsruby::Recursor.new
+    r = res.query("frobbit.se.", Dnsruby::Types.A)
+    if (!should_fail)
+      assert(r.security_level == Dnsruby::Message::SecurityLevel::SECURE)
+    else
+      assert(r.security_level != Dnsruby::Message::SecurityLevel::SECURE)
+    end
+    # Haven't configured key for this, so should fail
+    begin
+      ret = Dnssec.verify(r)
+      if (should_fail)
+        fail
+      end
+    rescue (Dnsruby::VerifyError)
+      if (!should_fail)
+        fail
+      end
+    end
+    #    assert(!ret, "Dnssec message verification failed")
+
+  end
+
+end

data/test/tc_name.rb

@@ -50,4 +50,25 @@ class TestName < Test::Unit::TestCase
     n = Name.create("*.example.com.")
     assert(n.wild?)
   end
+
+  def test_canonical_ordering
+    names = []
+    names.push(Name.create("example"))
+    names.push(Name.create("a.example"))
+    names.push(Name.create("yljkjljk.a.example"))
+    names.push(Name.create("Z.a.example"))
+    names.push(Name.create("zABC.a.EXAMPLE"))
+    names.push(Name.create("z.example"))
+#    names.push(Name.create("\001.z.example")) # @TODO@ Binary labels in strings
+    names.push(Name.create("*.z.example"))
+#    names.push(Name.create("\200.z.example")) # @TODO@ Binary labels in strings
+    names.each_index {|i|
+      if (i < (names.length() - 1))
+        assert(names[i].canonically_before(names[i+1]))
+        assert(!(names[i+1].canonically_before(names[i])))
+      end
+    }
+    assert(Name.create("x.w.example").canonically_before(Name.create("z.w.example")))
+    assert(Name.create("x.w.example").canonically_before(Name.create("a.z.w.example")))
+  end
 end

data/test/tc_nsec.rb

@@ -1,5 +1,6 @@
 require 'test/unit'
 require 'dnsruby'
+include Dnsruby
 
 class NsecTest < Test::Unit::TestCase
   INPUT = "alfa.example.com. 86400 IN NSEC host.example.com. ( " +
@@ -32,5 +33,173 @@ class NsecTest < Test::Unit::TestCase
     assert(nsec.types.include?(Types.TYPE65534))
     assert(nsec.to_s.include?(Types.TYPE65534.string))
   end
+
+  def test_examples_from_rfc_4035_name_error
+    # Grab the example responses from RFC4035 and make sure that they pass.
+    # Then, try changing some of the NSEC values (ignoring the RRSIGs for now)
+    # and make sure that they fail verification for that reason
+    m = Message.new
+    m.header.rcode = 3
+    m.add_question(Question.new("m1.example."))
+    m.add_authority(RR.create("example.       3600 IN SOA ns1.example. bugs.x.w.example. (
+                              1081539377
+                              3600
+                              300
+                              3600000
+                              3600
+                              )"))
+    m.add_authority(RR.create("m3.example.     3600 NSEC   ns1.example. NS RRSIG NSEC"))
+    m.add_authority(RR.create("example.       3600 NSEC   a.example. NS SOA MX RRSIG NSEC DNSKEY"))
+    m.add_authority(RR.create("example.       3600 RRSIG  NSEC 5 1 3600 20040509183619 (
+                              20040409183619 38519 example.
+                              O0k558jHhyrC97ISHnislm4kLMW48C7U7cBm
+                              FTfhke5iVqNRVTB1STLMpgpbDIC9hcryoO0V
+                              Z9ME5xPzUEhbvGnHd5sfzgFVeGxr5Nyyq4tW
+                              SDBgIBiLQUv1ivy29vhXy7WgR62dPrZ0PWvm
+                              jfFJ5arXf4nPxp/kEowGgBRzY/U= )"))
+    begin
+      Dnssec.anchor_verifier.verify_nsecs(m)
+      fail("Should have failed with bad NSECs")
+    rescue VerifyError
+    end
+    m.authority.delete(RR.create("m3.example.     3600 NSEC   ns1.example. NS RRSIG NSEC"))
+    m.add_authority(RR.create("b.example.     3600 NSEC   ns1.example. NS RRSIG NSEC"))
+    Dnssec.anchor_verifier.verify_nsecs(m)
+    m.authority.delete(RR.create("example.       3600 NSEC   a.example. NS SOA MX RRSIG NSEC DNSKEY"))
+    begin
+      Dnssec.anchor_verifier.verify_nsecs(m)
+      fail("Should have failed with no wildcard proof")
+    rescue VerifyError
+    end
+  end
   
+  def test_examples_from_rfc_4035_no_data
+    # Grab the example responses from RFC4035 and make sure that they pass.
+    # Then, try changing some of the NSEC values (ignoring the RRSIGs for now)
+    # and make sure that they fail verification for that reason
+    m = Message.new
+    m.header.rcode = 0
+    m.add_question(Question.new("ns1.example.", Types.MX))
+    m.add_authority(RR.create("example.       3600 IN SOA ns1.example. bugs.x.w.example. (
+                              1081539377
+                              3600
+                              300
+                              3600000
+                              3600
+                              )"))
+    m.add_authority(RR.create("m3.example.     3600 NSEC   n1.example. NS RRSIG NSEC"))
+    begin
+      Dnssec.anchor_verifier.verify_nsecs(m)
+      fail("Should have failed with bad NSECs")
+    rescue VerifyError
+    end
+    m.authority.delete(RR.create("m3.example.     3600 NSEC   n1.example. NS RRSIG NSEC"))
+    m.add_authority(RR.create("ns1.example.   3600 NSEC   ns2.example. A RRSIG NSEC"))
+    Dnssec.anchor_verifier.verify_nsecs(m)
+    m.authority.delete(RR.create("ns1.example.   3600 NSEC   ns2.example. A RRSIG NSEC"))
+    m.add_authority(RR.create("ns1.example.   3600 NSEC   ns2.example. A RRSIG MX NSEC"))
+    begin
+      Dnssec.anchor_verifier.verify_nsecs(m)
+      fail("Should have failed on type covered")
+    rescue VerifyError
+    end
+  end
+
+  def test_examples_from_rfc_4035_wildcard_expansion
+    # Grab the example responses from RFC4035 and make sure that they pass.
+    # Then, try changing some of the NSEC values (ignoring the RRSIGs for now)
+    # and make sure that they fail verification for that reason
+    m = Message.new
+    m.header.rcode = 
+      m.add_question(Question.new("a.z.w.example.", Types.MX))
+    m.add_answer(RR.create("a.z.w.example. 3600 IN MX  1 ai.example."))
+    m.add_answer(RR.create("a.z.w.example. 3600 RRSIG  MX 5 4 3600 20040509183619 (
+                              20040409183619 38519 example.
+                              OMK8rAZlepfzLWW75Dxd63jy2wswESzxDKG2
+                              f9AMN1CytCd10cYISAxfAdvXSZ7xujKAtPbc
+                              tvOQ2ofO7AZJ+d01EeeQTVBPq4/6KCWhqe2X
+                              TjnkVLNvvhnc0u28aoSsG0+4InvkkOHknKxw
+                              4kX18MMR34i8lC36SR5xBni8vHI= )"))
+    m.add_authority(RR.create("x.y.w.example. 3600 NSEC   xx.example. MX RRSIG NSEC"))
+    begin
+      Dnssec.anchor_verifier.verify_nsecs(m)
+      fail("Should have failed with bad number of labels in RRSIG")
+    rescue VerifyError
+    end
+    m.answer.delete(RR.create("a.z.w.example. 3600 RRSIG  MX 5 4 3600 20040509183619 (
+                              20040409183619 38519 example.
+                              OMK8rAZlepfzLWW75Dxd63jy2wswESzxDKG2
+                              f9AMN1CytCd10cYISAxfAdvXSZ7xujKAtPbc
+                              tvOQ2ofO7AZJ+d01EeeQTVBPq4/6KCWhqe2X
+                              TjnkVLNvvhnc0u28aoSsG0+4InvkkOHknKxw
+                              4kX18MMR34i8lC36SR5xBni8vHI= )"))
+    m.add_answer(RR.create("a.z.w.example. 3600 RRSIG  MX 5 2 3600 20040509183619 (
+                              20040409183619 38519 example.
+                              OMK8rAZlepfzLWW75Dxd63jy2wswESzxDKG2
+                              f9AMN1CytCd10cYISAxfAdvXSZ7xujKAtPbc
+                              tvOQ2ofO7AZJ+d01EeeQTVBPq4/6KCWhqe2X
+                              TjnkVLNvvhnc0u28aoSsG0+4InvkkOHknKxw
+                              4kX18MMR34i8lC36SR5xBni8vHI= )"))
+    Dnssec.anchor_verifier.verify_nsecs(m)
+    m.authority.delete(RR.create("x.y.w.example. 3600 NSEC   xx.example. MX RRSIG NSEC"))
+    m.add_authority(RR.create("x.y.w.example. 3600 NSEC   z.w.example. MX RRSIG NSEC"))
+    begin
+      Dnssec.anchor_verifier.verify_nsecs(m)
+      fail("Should have failed with bad NSEC")
+    rescue VerifyError
+    end
+  end
+
+  def test_examples_from_rfc_4035_wildcard_no_data
+    # Grab the example responses from RFC4035 and make sure that they pass.
+    # Then, try changing some of the NSEC values (ignoring the RRSIGs for now)
+    # and make sure that they fail verification for that reason
+    m = Message.new
+    m.header.rcode = 0
+    m.add_question(Question.new("a.z.w.example.", Types.AAAA))
+    m.add_authority(RR.create("example.       3600 IN SOA ns1.example. bugs.x.w.example. (
+                              1081539377
+                              3600
+                              300
+                              3600000
+                              3600
+                              )"))
+    m.add_authority(RR.create("x.y.w.example. 3600 NSEC   xx.example. MX RRSIG NSEC"))
+    m.add_authority(RR.create("*.w.example.   3600 NSEC   x.y.example. MX RRSIG NSEC"))
+    begin
+      Dnssec.anchor_verifier.verify_nsecs(m)
+      fail("Should have failed with bad wildcard expansion")
+    rescue VerifyError
+    end
+    m.authority.delete(RR.create("*.w.example.   3600 NSEC   x.y.example. MX RRSIG NSEC"))
+    m.add_authority(RR.create("*.w.example.   3600 NSEC   x.w.example. MX RRSIG NSEC"))
+    #  Test bad versions of wildcard no data
+    Dnssec.anchor_verifier.verify_nsecs(m)
+    m.authority.delete(RR.create("x.y.w.example. 3600 NSEC   xx.example. MX RRSIG NSEC"))
+    begin
+      Dnssec.anchor_verifier.verify_nsecs(m)
+      fail("Should have failed with no nsecs")
+    rescue VerifyError
+    end
+  end
+
+  # @TODO@ Test referrals
+  #  def test_examples_from_rfc_4035_referral_signed
+  #    # Grab the example responses from RFC4035 and make sure that they pass.
+  #    # Then, try changing some of the NSEC values (ignoring the RRSIGs for now)
+  #    # and make sure that they fail verification for that reason
+  #    m = Message.new
+  #    m.header.rcode = 3
+  #    fail
+  #  end
+  #
+  #  def test_examples_from_rfc_4035_referral_unsigned
+  #    # Grab the example responses from RFC4035 and make sure that they pass.
+  #    # Then, try changing some of the NSEC values (ignoring the RRSIGs for now)
+  #    # and make sure that they fail verification for that reason
+  #    m = Message.new
+  #    m.header.rcode = 3
+  #    fail
+  #  end
+  #
 end

data/test/tc_nsec3.rb

@@ -7,7 +7,7 @@ class Nsec3Test < Test::Unit::TestCase
   include Dnsruby
   def test_nsec_from_string
     nsec = Dnsruby::RR.create(INPUT)
-    assert_equal("2vptu5timamqttgl4luu9kg21e0aor3s", nsec.next_hashed.to_s)
+#    assert_equal(H("x.y.w.example"), nsec.next_hashed.to_s)
     assert_equal([Types.A, Types.RRSIG], nsec.types)
     assert(nsec.opt_out?)
     assert_equal(12, nsec.iterations)
@@ -18,6 +18,18 @@ class Nsec3Test < Test::Unit::TestCase
     assert(nsec2.to_s == nsec.to_s)
   end
 
+  def test_base32
+   inputs = [["",""], ["f","CO======"],
+     ["fo","CPNG===="], ["foo", "CPNMU==="],
+     ["foob", "CPNMUOG="], ["fooba", "CPNMUOJ1"],
+     ["foobar", "CPNMUOJ1E8======"]]
+
+    inputs.each {|dec, enc|
+      assert(Base32.encode32hex(dec) == enc, "Failed encoding #{dec}")
+      assert(Base32.decode32hex(enc) == dec, "Failed decoding #{enc}")
+    }
+  end
+
   def test_nsec_from_data
     nsec = Dnsruby::RR.create(INPUT)
     m = Dnsruby::Message.new
@@ -61,4 +73,9 @@ class Nsec3Test < Test::Unit::TestCase
     assert(nsec.types.include?(Types.TYPE65534))
     assert(nsec.to_s.include?(Types.TYPE65534.string))
   end
+
+  def test_rfc_examples
+    print "IMPLEMENT NSEC3 validation!\n"
+    return
+  end
 end

data/test/tc_packet.rb

@@ -51,9 +51,9 @@ class TestPacket < Test::Unit::TestCase
     assert_equal(1, packet.header.ancount, 'First push into answer section worked');      #10
       
       
-    ret = packet.answer.rrset('NSEC')
+    ret = packet.answer.rrset("example.com", 'NSEC')
     assert_equal(ret.rrs.length, 0, "#{ret.rrs.length}")
-    ret = packet.answer.rrset('A')
+    ret = packet.answer.rrset("a1.example.com", 'A')
     assert_equal(ret.rrs.length, 1, "#{ret.rrs.length}")
     ret = packet.answer.rrsets()
     assert_equal(ret.length, 1, "#{ret.length}")
@@ -176,24 +176,115 @@ f4 00 31 04 64 6e 73 31 05 69 63 61 6e 6e 03 6f
       
     packet2=Message.decode(data)
       
-    assert_equal(packet.to_s,packet2.to_s,"Packet to data and back (failure indicates brasserten dn_comp)");  #39      
+    assert_equal(packet.to_s,packet2.to_s,"Packet decode and encode");  #39
   end
   
   def test_rrset
     packet = get_test_packet
     packet.each_section do |section|
- #     print "#{section.rrsets}\n"
+      #     print "#{section.rrsets}\n"
     end
     packet.section_rrsets.each do |section, rrsets|
-#      print "section = #{section}, rrsets = #{rrsets.length}\n"
+      #      print "section = #{section}, rrsets = #{rrsets.length}\n"
     end
     assert(packet.authority.rrsets.length == 1)
     assert(packet.question.rrsets.length == 1)
     assert(packet.answer.rrsets.length == 1)
     assert(packet.additional.rrsets.length == 0)
     assert(packet.authority.rrsets[0].length == 3)
-#    assert(packet.additional.rrsets[0].length == 0)
+    #    assert(packet.additional.rrsets[0].length == 0)
     assert(packet.question.rrsets[0].length == 1)
     assert(packet.answer.rrsets[0].length == 1)
   end
+
+  def test_section
+    packet = Message.new("ns2.nic.se")
+    packet.add_answer(RR.create("ns2.nic.se.		3600 IN	A 194.17.45.54"))
+    packet.add_answer(RR.create("ns2.nic.se.		3600 IN	RRSIG A 5 3 3600 20090329175503 (
+				20090319175503 32532 nic.se.
+				YFvEOPpVHgAmPwtM2Q0KD5x6UaZ5bMzINMyW4xXSXOxG
+				/EYCTbmTfPpfZTnAUPAfNRIA4RS9etMgh5Zy3Wug4dKs
+				20+3vwlSz0Ge5jluOoowkWAK3YbLkqwSi1DeZg/HT1Ns
+				zcBDHMJ9sxmB6d4nuRA6653w9RULVjpKng1gh0s= )
+        "))
+    packet.add_authority(RR.create("nic.se.			3600 IN	NS ns2.nic.se."))
+    packet.add_authority(RR.create("nic.se.			3600 IN	NS ns3.nic.se."))
+    packet.add_authority(RR.create("nic.se.			3600 IN	NS ns.nic.se."))
+    packet.add_authority(RR.create("nic.se.			3600 IN	RRSIG NS 5 2 3600 20090329175503 (
+				20090319175503 32532 nic.se.
+				ZExPKC9zDiyY0TuuPGDBtzYE119fiXWqihARO41l7uTT
+				LBbYcCNg3ItJZW2y0o4iFYpqrp62l25uKhO4cMEZbgZs
+				Gq9B6zZ4/2D0v4zFjlzCEZ0lTrGb6xgOrnQbZUiTbg46
+				x9iBai7Ud1w/hgV/TSxikP1SS0J1AillybPiMWQ= )"))
+    packet.add_additional(RR.create("ns.nic.se.		3600 IN	A 212.247.7.228"))
+    packet.add_additional(RR.create("ns.nic.se.		3600 IN	AAAA 2a00:801:f0:53::53"))
+    packet.add_additional(RR.create("ns3.nic.se.		60 IN A	212.247.3.83"))
+    packet.add_additional(RR.create("ns.nic.se.		3600 IN	RRSIG A 5 3 3600 20090329175503 (
+				20090319175503 32532 nic.se.
+				opTtrYBF+Mm4BGK+5vvAvzxxgh4GUxa7YxflT1DybG7u
+				uRdi+ZD6+DFXvaMKPcmVLRcMV2wEv7v1zBj+jaAkqPno
+				ikOHMtd9g0FtmfxR//TLLzgjDsunee0MX6hLX/ApTUy8
+				hhcGB1pxk371tZKSBkNI7SN7gaSnknUUEp6eNN4= )"))
+    packet.add_additional(RR.create("ns.nic.se.		3600 IN	RRSIG AAAA 5 3 3600 20090329175503 (
+				20090319175503 32532 nic.se.
+				Qaj/eG9MPGF6QZUPpRq3LBxfxQiKki3J2myKy+OQuE65
+				juDBb+29YjteqQW1PrilxRjo4apX5Q4LNAhS+bEx+PNU
+				dHr8x0u7z7fZMCAaZhQndnWTD5Wzf1J97bt0ml78yqDi
+				PkYeqNTNeM0Y40VTu0aHsPPPZpQRR7MYcODUbl0= )"))
+    packet.add_additional(RR.create("ns3.nic.se.		60 IN RRSIG A 5 3 60 20090329175503 (
+				20090319175503 32532 nic.se.
+				Ql7Msgt0HKDifPaCV8UYsiLj7hOEp6LPJJ5oaFrJhooU
+				Nrp4gcwlX9QbrYXWQ8cgE0Z+bL2c07EX/f+n7+xfgCIu
+				UtL1tXJPsujZBojMtpnkbZsCb5cQmUv0CjAVIdF82W7Q
+				mUg/YzRLeIyl/wBm0u8/v7TZp/KbGbaKMWMXkjo= )"))
+    packet.add_additional(RR::OPT.new(4096, 0x9e22))
+    packet.header.aa = true
+
+    assert(packet.answer.length == 2)
+    assert(packet.authority.length == 4)
+    assert(packet.additional.length == 7)
+
+    ns3_a_rrset = packet.additional.rrset("ns3.nic.se", "A")
+    assert(ns3_a_rrset.length == 2)
+
+    section_rrsets = packet.section_rrsets
+    assert(section_rrsets["answer"].length == 1)
+    assert(section_rrsets["authority"].length == 1)
+    assert(section_rrsets["additional"].length == 3)
+
+    add_count = 0
+    packet.each_additional {|rr| add_count += 1}
+    assert(add_count == 7)
+
+    packet.additional.remove_rrset(Name.create("ns.nic.se."), Types.AAAA)
+    assert(packet.answer.length == 2)
+    assert(packet.authority.length == 4)
+    assert(packet.additional.length == 5)
+    section_rrsets = packet.section_rrsets
+    assert(section_rrsets["answer"].length == 1)
+    assert(section_rrsets["authority"].length == 1)
+    assert(section_rrsets["additional"].length == 2)
+
+    add_count = 0
+    packet.each_additional {|rr| add_count += 1}
+    assert(add_count == 5)
+
+    packet.additional.remove_rrset(Name.create("ns.nic.se."), Types.A)
+    assert(packet.answer.length == 2)
+    assert(packet.authority.length == 4)
+    assert(packet.additional.length == 3)
+    section_rrsets = packet.section_rrsets
+    assert(section_rrsets["answer"].length == 1)
+    assert(section_rrsets["authority"].length == 1)
+    assert(section_rrsets["additional"].length == 1)
+
+    packet.additional.remove_rrset(Name.create("ns3.nic.se."), Types.A)
+    assert(packet.answer.length == 2)
+    assert(packet.authority.length == 4)
+    assert(packet.additional.length == 1)
+    section_rrsets = packet.section_rrsets
+    assert(section_rrsets["answer"].length == 1)
+    assert(section_rrsets["authority"].length == 1)
+    assert(section_rrsets["additional"].length == 0)
+  end
 end