dnsruby 1.73.1 → 2.0.0

data/test/tc_dnssec_denial_proofs.rb

@@ -0,0 +1,285 @@
+require_relative 'tc_key_cache_identity'
+
+class DnssecDenialProofsTest < Minitest::Test
+  def setup
+    @private_key = OpenSSL::PKey::EC.new(KeyCacheIdentityTest::PRIVATE_KEYS.first)
+    @zone = 'collision.invalid.'
+    public_bytes = @private_key.public_key.to_octet_string(:uncompressed).byteslice(1, 64)
+    @key = Dnsruby::RR.create("#{@zone} 300 IN DNSKEY 257 3 13 #{Base64.strict_encode64(public_bytes)}")
+    @verifier = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::ANCHOR)
+    @verifier.add_trust_anchor(@key)
+  end
+
+  def test_cname_nodata_checks_final_target_with_nsec
+    message = response('alias.collision.invalid.', 'AAAA')
+    add_signed(message.answer, 'alias.collision.invalid. 300 IN CNAME target.collision.invalid.')
+    add_signed(message.authority, 'target.collision.invalid. 300 IN NSEC z.collision.invalid. TXT NSEC RRSIG')
+    assert(@verifier.verify(message))
+    remove_set(message.authority, 'target.collision.invalid.', Dnsruby::Types.NSEC)
+    add_signed(message.authority, 'target.collision.invalid. 300 IN NSEC z.collision.invalid. TXT AAAA NSEC RRSIG')
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+  end
+
+  def test_partial_cname_response_and_positive_terminal_answer
+    message = Dnsruby::Message.new('alias.collision.invalid.', 'AAAA')
+    add_signed(message.answer, 'alias.collision.invalid. 300 IN CNAME target.collision.invalid.')
+    assert(@verifier.verify(message))
+    add_signed(message.answer, 'target.collision.invalid. 300 IN AAAA 2001:db8::1')
+    assert(@verifier.verify(message))
+  end
+
+  def test_partial_answer_requires_a_cname_from_the_question
+    message = Dnsruby::Message.new('alias.collision.invalid.', 'AAAA')
+    add_signed(message.answer, 'target.collision.invalid. 300 IN AAAA 2001:db8::1')
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+  end
+
+  def test_any_nodata_requires_an_empty_name_but_positive_answers_can_be_subsets
+    message = response('target.collision.invalid.', 'ANY')
+    add_chain(message)
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+
+    message = response('empty.collision.invalid.', 'ANY')
+    add_chain(message)
+    assert(@verifier.verify(message))
+
+    message = response('missing.wild.collision.invalid.', 'ANY')
+    add_chain(message)
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+
+    message = Dnsruby::Message.new('target.collision.invalid.', 'ANY')
+    add_signed(message.answer, 'target.collision.invalid. 300 IN TXT "one RRset"')
+    assert(@verifier.verify(message))
+  end
+
+  def test_signed_ds_referral_does_not_require_a_signature_on_parent_side_ns
+    child = @key.clone
+    child.name = 'child.collision.invalid.'
+    message = Dnsruby::Message.new('www.child.collision.invalid.', 'A')
+    message.add_authority(Dnsruby::RR.create('child.collision.invalid. 300 IN NS ns.child.collision.invalid.'))
+    signed(Dnsruby::RR::DS.from_key(child, 2)).each { |rr| message.add_authority(rr) }
+    assert(@verifier.verify(message))
+  end
+
+  def test_nsec_consistency_accepts_normal_circular_chain_and_partial_proofs
+    message = response('a.collision.invalid.', 'AAAA')
+    add_signed(message.authority, 'collision.invalid. 300 IN NSEC a.collision.invalid. SOA NS NSEC RRSIG')
+    add_signed(message.authority, 'a.collision.invalid. 300 IN NSEC z.collision.invalid. A NSEC RRSIG')
+    add_signed(message.authority, 'z.collision.invalid. 300 IN NSEC collision.invalid. TXT NSEC RRSIG')
+    assert(@verifier.verify(message))
+    remove_set(message.authority, @zone, Dnsruby::Types.NSEC)
+    assert(@verifier.verify(message))
+  end
+
+  def test_signed_negative_soa_requires_denial
+    message = response('target.collision.invalid.', 'AAAA')
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+    add_chain(message)
+    assert(@verifier.verify(message))
+  end
+
+  def test_nsec3_exact_nodata_and_empty_nonterminal
+    ['target.collision.invalid.', 'empty.collision.invalid.'].each do |name|
+      message = response(name, 'AAAA')
+      add_chain(message)
+      assert(@verifier.verify(message))
+    end
+    ['AAAA', 'CNAME'].each do |present|
+      message = response('target.collision.invalid.', 'AAAA')
+      add_chain(message, entries: zone_entries.merge('target.collision.invalid.' => present))
+      assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+    end
+  end
+
+  def test_nsec3_nxdomain_after_cname_uses_target_and_complete_closest_encloser
+    message = response('alias.collision.invalid.', 'AAAA', nxdomain: true)
+    add_signed(message.answer, 'alias.collision.invalid. 300 IN CNAME missing.collision.invalid.')
+    add_chain(message)
+    assert(@verifier.verify(message))
+    remove_set(message.authority, "#{hash_name(@zone)}.#{@zone}", Dnsruby::Types.NSEC3)
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+  end
+
+  def test_nsec3_wildcard_nodata_and_nxdomain_are_distinct
+    message = response('missing.wild.collision.invalid.', 'AAAA')
+    add_chain(message)
+    assert(@verifier.verify(message))
+    message.header.rcode = Dnsruby::RCode.NXDOMAIN
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+
+    message = response('missing.wild.collision.invalid.', 'MX')
+    add_chain(message)
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+  end
+
+  def test_nsec3_nxdomain_and_ds_opt_out_are_insecure
+    message = response('missing.collision.invalid.', 'AAAA', nxdomain: true)
+    add_chain(message, flags: 1)
+    assert_equal(:insecure, @verifier.verify_result(message))
+    message = response('child.collision.invalid.', 'DS')
+    add_chain(message, flags: 1)
+    assert_equal(:insecure, @verifier.verify_result(message))
+
+    message = response('child.collision.invalid.', 'DS')
+    add_chain(message)
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+  end
+
+  def test_nsec3_exact_ds_denial_and_referral
+    message = response('child.collision.invalid.', 'DS')
+    add_chain(message, entries: zone_entries.merge('child.collision.invalid.' => 'NS'))
+    assert(@verifier.verify(message))
+
+    message = Dnsruby::Message.new('www.child.collision.invalid.', 'A')
+    message.add_authority(Dnsruby::RR.create('child.collision.invalid. 300 IN NS ns.child.collision.invalid.'))
+    add_chain(message, entries: zone_entries.merge('child.collision.invalid.' => 'NS'))
+    assert_equal(:insecure, @verifier.verify_result(message))
+
+    message = response(@zone, 'DS')
+    add_chain(message)
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+  end
+
+  def test_cname_to_unsigned_referral_validates_ds_denial_at_terminal_delegation
+    message = Dnsruby::Message.new('alias.collision.invalid.', 'A')
+    add_signed(message.answer, 'alias.collision.invalid. 300 IN CNAME www.child.collision.invalid.')
+    message.add_authority(Dnsruby::RR.create('child.collision.invalid. 300 IN NS ns.child.collision.invalid.'))
+    add_chain(message, entries: zone_entries.merge('child.collision.invalid.' => 'NS'))
+    assert_equal(:insecure, @verifier.verify_result(message))
+  end
+
+  def test_nsec3_wrong_zone_and_mixed_parameters_cannot_form_denial
+    foreign_key = @key.clone
+    foreign_key.name = 'other.invalid.'
+    @verifier.add_trust_anchor(foreign_key)
+    message = response('target.collision.invalid.', 'AAAA')
+    add_chain(message, key: foreign_key)
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+
+    message = response('target.collision.invalid.', 'AAAA')
+    add_chain(message)
+    add_chain(message, salt: 'abcd')
+    assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+  end
+
+  def test_nsec3_closest_encloser_cannot_be_dname_or_unsigned_delegation
+    ['DNAME', 'NS'].each do |types|
+      message = response('missing.wild.collision.invalid.', 'AAAA')
+      add_chain(message, entries: zone_entries.merge('wild.collision.invalid.' => types))
+      assert_raises(Dnsruby::VerifyError) { @verifier.verify(message) }
+    end
+  end
+
+  def test_nsec3_hash_interval_excludes_endpoints_and_supports_wire_empty_salt
+    message = response('target.collision.invalid.', 'AAAA')
+    records = add_chain(message)
+    first = records.first
+    refute(first.check_name_in_range(zone_entries.keys.find { |name| hash_name(name) == first.owner_hash }))
+    decoded = Dnsruby::Message.decode(message.encode)
+    assert(@verifier.verify(decoded))
+    assert(records.any? { |record| record.check_name_in_range('missing.collision.invalid.') })
+  end
+
+  def test_nsec_and_its_signature_exist_independently_of_their_bitmap_bits
+    [[], %w[NSEC], %w[RRSIG], %w[NSEC RRSIG]].each do |bits|
+      record = Dnsruby::RR.create("target.collision.invalid. 300 IN NSEC z.collision.invalid. TXT #{bits.join(' ')}")
+      [Dnsruby::Types.NSEC, Dnsruby::Types.RRSIG].each do |type|
+        refute(@verifier.send(:denial_bitmap?, record, type))
+      end
+      assert(@verifier.send(:denial_bitmap?, record, Dnsruby::Types.AAAA))
+    end
+  end
+
+  def test_nsec3_future_flags_do_not_hide_the_supported_denial_chain
+    message = response('target.collision.invalid.', 'AAAA')
+    supported = add_chain(message)
+    add_chain(message, flags: 2, salt: 'abcd')
+    decoded = Dnsruby::Message.decode(message.encode)
+    assert(@verifier.verify(decoded))
+    remaining = decoded.authority.select { |record| record.type == Dnsruby::Types.NSEC3 }
+    assert_equal(supported.length, remaining.length)
+    assert(remaining.all? { |record| record.flags == 0 })
+    assert_equal(decoded.authority.length, decoded.header.nscount)
+  end
+
+  def test_nsec3_mixed_future_flags_keep_the_complete_signed_rrset
+    message = response('target.collision.invalid.', 'AAAA')
+    records = add_chain(message)
+    record = records.find { |rr| rr.owner_hash == hash_name('target.collision.invalid.') }
+    remove_set(message.authority, record.name.to_s, Dnsruby::Types.NSEC3)
+    future = record.clone
+    future.flags = 2
+    mixed = Dnsruby::RRSet.new([record, future])
+    signature = signed(record).sigs.first
+    bytes = @verifier.send(:canonical_rrset_data, mixed, signature, {})
+    der = @private_key.dsa_sign_asn1(OpenSSL::Digest::SHA256.digest(signature.sig_data + bytes))
+    signature.signature = OpenSSL::ASN1.decode(der).value.map { |n| n.value.to_s(2).rjust(32, "\0") }.join
+    mixed.add(signature)
+    mixed.each { |rr| message.add_authority(rr) }
+    assert(@verifier.verify(message))
+    assert_equal([0, 2], message.authority.select { |rr| rr.type == Dnsruby::Types.NSEC3 && rr.name == record.name }.map(&:flags))
+  end
+
+  def test_dnskey_message_authenticates_each_rrset_once
+    message = Dnsruby::Message.new(@zone, 'DNSKEY')
+    signed(@key).each { |record| message.add_answer(record) }
+    calls = 0
+    original = @verifier.method(:verify_rrset_with_key)
+    @verifier.stub(:verify_rrset_with_key, lambda { |*args| calls += 1; original.call(*args) }) do
+      assert(@verifier.verify(message))
+    end
+    assert_equal(1, calls)
+  end
+
+  private
+
+  def remove_set(section, name, type)
+    name = Dnsruby::Name.create(name)
+    section.delete_if { |rr| rr.name == name && (rr.type == type || (rr.type == Dnsruby::Types.RRSIG && rr.type_covered == type)) }
+  end
+
+  def response(name, type, nxdomain: false)
+    Dnsruby::Message.new(name, type).tap do |message|
+      message.header.qr = true
+      message.header.rcode = Dnsruby::RCode.NXDOMAIN if nxdomain
+      add_signed(message.authority, "#{@zone} 300 IN SOA ns.#{@zone} hostmaster.#{@zone} 1 3600 600 86400 300")
+    end
+  end
+
+  def zone_entries
+    { @zone => 'SOA NS DNSKEY', 'alias.collision.invalid.' => 'CNAME',
+      'target.collision.invalid.' => 'TXT', 'empty.collision.invalid.' => '',
+      'wild.collision.invalid.' => 'TXT', '*.wild.collision.invalid.' => 'MX' }
+  end
+
+  def hash_name(name, salt = '-')
+    Dnsruby::RR::NSEC3.calculate_hash(name, 0, Dnsruby::RR::NSEC3.decode_salt(salt), 1)
+  end
+
+  # Build the ordinary sorted NSEC3 chain for a small complete test zone.
+  def add_chain(message, entries: zone_entries, flags: 0, salt: '-', key: @key)
+    owners = entries.map { |name, types| [hash_name(name, salt), types] }.sort
+    owners.each_with_index.map do |(owner, types), index|
+      following = owners[(index + 1) % owners.length].first
+      record = Dnsruby::RR.create("#{owner}.#{@zone} 300 IN NSEC3 1 #{flags} 0 #{salt} #{following} #{types}")
+      signed(record, key: key).each { |rr| message.add_authority(rr) }
+      record
+    end
+  end
+
+  def add_signed(section, text)
+    signed(Dnsruby::RR.create(text)).each { |record| section << record }
+  end
+
+  def signed(record, key: @key)
+    signature = Dnsruby::RR.create(name: record.name, type: 'RRSIG', ttl: record.ttl,
+      type_covered: record.type, algorithm: 13,
+      labels: record.name.labels.length - (record.name.wild? ? 1 : 0),
+      original_ttl: record.ttl, expiration: Time.now.to_i + 3600, inception: Time.now.to_i - 60,
+      key_tag: key.key_tag, signers_name: key.name)
+    bytes = Dnsruby::MessageEncoder.new { |encoder| encoder.put_rr(record, true) }.to_s
+    der = @private_key.dsa_sign_asn1(OpenSSL::Digest::SHA256.digest(signature.sig_data + bytes))
+    signature.signature = OpenSSL::ASN1.decode(der).value.map { |n| n.value.to_s(2).rjust(32, "\0") }.join
+    Dnsruby::RRSet.new([record, signature])
+  end
+end

data/test/tc_dnssec_recursion_limits.rb

@@ -0,0 +1,186 @@
+require_relative 'spec_helper'
+require 'minitest/mock'
+
+# Discovery and completion boundaries use ordinary query metadata and resolver
+# doubles. No sockets or DNS traffic are needed to check terminal limit errors.
+class DnssecRecursionLimitsTest < Minitest::Test
+  def setup
+    @verifier = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::ANCHOR)
+    @zone = Dnsruby::Name.create('example.')
+    @child = Dnsruby::Name.create('child.example.')
+    @anchor = metadata_double(name: @zone, klass: Dnsruby::Classes.IN, type: Dnsruby::Types.DNSKEY)
+    @limit = Dnsruby::RecursionLimitError.new('Recursive lookup work limit exceeded')
+    @queries = []
+    @saved_recursor = Dnsruby::Dnssec.do_validation_with_recursor?
+    Dnsruby::Dnssec.do_validation_with_recursor(false)
+  end
+
+  def teardown
+    Dnsruby::Dnssec.do_validation_with_recursor(@saved_recursor)
+  end
+
+  def test_ds_discovery_preserves_the_limit_without_caching_a_question_failure
+    resolver = exhausted_resolver
+    @verifier.stub(:get_nameservers_for, ->(*) { flunk('DS exhaustion must stop child discovery') }) do
+      error = assert_raises(Dnsruby::RecursionLimitError) do
+        @verifier.get_anchor_for(@child, @zone, @anchor, resolver)
+      end
+      assert_same(@limit, error)
+      assert_uncached_limit(error)
+    end
+    assert_equal([[@child, Dnsruby::Types.DS]], @queries)
+  end
+
+  def test_dnskey_discovery_preserves_the_limit_without_trying_another_key
+    resolver = exhausted_resolver
+    @verifier.stub(:get_nameservers_for, resolver) do
+      @verifier.stub(:verify, ->(*) { flunk('DNSKEY exhaustion must stop key fallback') }) do
+        error = assert_raises(Dnsruby::RecursionLimitError) do
+          @verifier.get_anchor_for(@zone, @zone, @anchor, resolver)
+        end
+        assert_same(@limit, error)
+        assert_uncached_limit(error)
+      end
+    end
+    assert_equal([[@zone, Dnsruby::Types.DNSKEY]], @queries)
+  end
+
+  def test_dlv_registry_key_discovery_preserves_the_limit
+    verifier = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::DLV)
+    verifier.stub(:get_dlv_resolver, exhausted_resolver) do
+      verifier.stub(:verify, ->(*) { flunk('An exhausted DLV lookup must not verify keys') }) do
+        error = assert_raises(Dnsruby::RecursionLimitError) { verifier.get_dlv_key(@anchor) }
+        assert_same(@limit, error)
+        assert_empty(verifier.trusted_keys)
+      end
+    end
+    assert_equal([[Dnsruby::Name.create('dlv.isc.org.'), Dnsruby::Types.DNSKEY]], @queries)
+  end
+
+  def test_dlv_zone_key_discovery_preserves_the_limit
+    verifier = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::DLV)
+    verifier.stub(:get_nameservers_for, exhausted_resolver) do
+      verifier.stub(:verify, ->(*) { flunk('An exhausted zone lookup must not verify keys') }) do
+        error = assert_raises(Dnsruby::RecursionLimitError) do
+          verifier.get_zone_key_from_dlv_rrset(metadata_double(type: Dnsruby::Types.DLV), @child)
+        end
+        assert_same(@limit, error)
+        assert_empty(verifier.trusted_keys)
+      end
+    end
+    assert_equal([[@child, Dnsruby::Types.DNSKEY]], @queries)
+  end
+
+  def test_dlv_record_discovery_stops_before_trying_the_next_ancestor
+    verifier = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::DLV)
+    verifier.stub(:get_dlv_resolver, exhausted_resolver) do
+      verifier.stub(:get_zone_key_from_dlv_rrset, ->(*) { flunk('Exhaustion must stop DLV discovery') }) do
+        error = assert_raises(Dnsruby::RecursionLimitError) { verifier.find_closest_dlv_anchor_for(@child) }
+        assert_same(@limit, error)
+      end
+    end
+    assert_equal([[Dnsruby::Name.create('child.example.dlv.isc.org.'), Dnsruby::Types.DLV]], @queries)
+  end
+
+  def test_exhausted_discovery_stops_validation_policy_fallbacks
+    previous_policy = Dnsruby::Dnssec.validation_policy
+    query = Dnsruby::Message.new(@child, 'A')
+    query.header.cd = true
+    resolver = exhausted_resolver
+    discover = ->(*) { @verifier.get_anchor_for(@child, @zone, @anchor, resolver) }
+    fallback = ->(*) { flunk('Aggregate exhaustion must not try another validation policy') }
+    policies = Dnsruby::Dnssec::ValidationPolicy
+    [[policies::LOCAL_ANCHORS_THEN_ROOT, :validate_with_anchors, :validate_with_root],
+      [policies::ROOT_THEN_LOCAL_ANCHORS, :validate_with_root, :validate_with_anchors]].each do |policy, first, second|
+      @queries.clear
+      Dnsruby::Dnssec.validation_policy = policy
+      Dnsruby::Dnssec.stub(first, discover) do
+        Dnsruby::Dnssec.stub(second, fallback) do
+          Dnsruby::Dnssec.stub(:validate_with_dlv, fallback) do
+            error = assert_raises(Dnsruby::RecursionLimitError) do
+              Dnsruby::Dnssec.validate_with_query(query, positive_response)
+            end
+            assert_same(@limit, error)
+          end
+        end
+      end
+      assert_equal([[@child, Dnsruby::Types.DS]], @queries)
+    end
+  ensure
+    Dnsruby::Dnssec.validation_policy = previous_policy
+  end
+
+  def test_async_validator_completion_preserves_the_limit_and_avoids_both_caches
+    worker = nil
+    query = Dnsruby::Message.new(@child, 'A')
+    query.do_validation = true
+    response = positive_response
+    completions, registrations, removals, positive_cache_calls = [], [], [], []
+    cache = Dnsruby::Cache::ResolutionCache.new
+    selector = Object.new
+    selector.define_singleton_method(:register_validation) { |*args| registrations << args; true }
+    selector.define_singleton_method(:unregister_validation) { |*args| removals << args }
+    selector.define_singleton_method(:push_validation_response_to_select) do |*args|
+      completions << args
+      cache.add(args[4], :test_scope, args[2], args[3])
+    end
+    resolver = metadata_double(dnssec: true)
+    validator = Dnsruby::ValidatorThread.new(:client, Queue.new, response, nil, query, selector, resolver)
+    Dnsruby::Dnssec.stub(:validate_with_query, ->(*) { raise @limit }) do
+      Dnsruby::PacketSender.stub(:cache, ->(*args) { positive_cache_calls << args }) do
+        worker = Thread.new { validator.do_validate }
+        assert(worker.join(2), 'Validator completion did not finish')
+      end
+    end
+    assert_equal(1, completions.length)
+    assert_same(@limit, completions.first[3])
+    assert_same(@limit, response.security_error)
+    assert_equal(Dnsruby::Message::SecurityLevel.BOGUS, response.security_level)
+    assert_empty(positive_cache_calls)
+    assert_nil(cache.find(query, :test_scope))
+    assert_equal(1, registrations.length)
+    assert_equal(registrations, removals)
+    assert_nil(worker[:dnsruby_validation_budget])
+    assert_nil(worker[:dnsruby_query_control])
+  ensure
+    worker&.kill if worker&.alive?
+    worker&.join
+  end
+
+  private
+
+  def exhausted_resolver
+    queries, error = @queries, @limit
+    Object.new.tap do |resolver|
+      resolver.define_singleton_method(:dnssec=) { |_| }
+      resolver.define_singleton_method(:query_no_validation_or_recursion) do |name, type|
+        queries << [Dnsruby::Name.create(name).tap { |owner| owner.absolute = true }, type]
+        raise error
+      end
+    end
+  end
+
+  def positive_response
+    Dnsruby::Message.new(@child, 'A').tap do |message|
+      message.header.qr = true
+      message.add_answer(Dnsruby::RR.create('child.example. 60 IN A 192.0.2.1'))
+    end
+  end
+
+  def assert_uncached_limit(error)
+    query = Dnsruby::Message.new(@child, 'A')
+    [nil, positive_response].each do |response|
+      cache = Dnsruby::Cache::ResolutionCache.new
+      cache.add(query, :test_scope, response, error)
+      assert_nil(cache.find(query, :test_scope))
+    end
+    assert_nil(Dnsruby::ValidationBudget.current)
+    assert_nil(Dnsruby::QueryControl.current)
+  end
+
+  def metadata_double(**attributes)
+    Object.new.tap do |object|
+      attributes.each { |name, value| object.define_singleton_method(name) { value } }
+    end
+  end
+end