dnsruby 1.73.1 → 2.0.0

data/lib/dnsruby/dnssec.rb

@@ -15,6 +15,7 @@
 # ++
 require 'digest/sha2'
 require 'dnsruby/key_cache'
+require 'dnsruby/validation_budget'
 require 'dnsruby/single_verifier'
 module Dnsruby
 
@@ -27,13 +28,10 @@ module Dnsruby
   #    able to treat the DNSSEC signatures as trust relationships between
   #    the zone administrators and the stub resolver itself. "
   # 
-  #  Dnsruby is configured to validate responses by default. However, it is not
-  #  configured with any trusted keys by default. Applications may use the
-  #  verify() method to perform verification with of RRSets of Messages with
-  #  given keys. Alternatively, trusted keys may be added to this class (either
-  #  directly, or by loading the IANA TAR or the DLV ISC ZSK). Validation will then
-  #  be performed from these keys (or the DLV registry, if configured). Negative
-  #  and positive responses are validation.
+  #  Resolver queries do not validate responses by default; set
+  #  Resolver#do_validation to true to enable validation. Root DS trust anchors
+  #  are configured below. Applications may also use verify() to verify RRSets
+  #  or Messages with given keys, or add their own trust anchors to this class.
   # 
   #  Messages are tagged with the current security_level (Message::SecurityLevel).
   #  UNCHECKED means Dnsruby has not attempted to validate the response.
@@ -44,14 +42,32 @@ module Dnsruby
   #  Several validators are provided, with each maintaining its own cache of trusted keys.
   #  If validators are added or removed, the caches of the other validators are not affected.
   class Dnssec
+    # Limits apply to one complete validation, including trust-chain discovery.
+    # A limit is a VerifyError; it never downgrades a signed answer to insecure.
+    @validation_limits = ValidationBudget::DEFAULT_LIMITS
+    def self.validation_limits
+      @validation_limits
+    end
+
+    def self.validation_limits=(limits)
+      unknown = limits.keys - ValidationBudget::DEFAULT_LIMITS.keys
+      raise ArgumentError, "Unknown DNSSEC validation limits: #{unknown.join(', ')}" unless unknown.empty?
+      merged = ValidationBudget::DEFAULT_LIMITS.merge(limits)
+      merged.each do |key, value|
+        valid = key == :timeout ? value.is_a?(Numeric) && value.finite? && value > 0 : value.is_a?(Integer) && value > 0
+        raise ArgumentError, "Invalid DNSSEC validation limit #{key}" unless valid
+      end
+      @validation_limits = merged.freeze
+    end
     #  A class to cache trusted keys
 
 
     class ValidationPolicy
       #  @TODO@ Could do this by getting client to add verifiers in the order they
       #  want them to be used. Could then dispense with all this logic
-      #  Note that any DLV registries which have been configured will only be tried
-      #  after both the root and any local trust anchors (RFC 5074 section 5)
+      # Configured DLV registries are a final fallback for the two ordered
+      # policies, after root/local anchors, when those paths are not bogus.
+      # The two ONLY policies never consult another source of trust.
 
       # * Always use the root and ignore local trust anchors.
       ALWAYS_ROOT_ONLY = 1
@@ -74,15 +90,16 @@ module Dnsruby
       @@validation_policy
     end
 
-    @@root_verifier = SingleVerifier.new(SingleVerifier::VerifierType::ROOT)
-
     #  #NOTE# You may wish to import these via a secure channel yourself, if
     #  using Dnsruby for validation.
-    @@root_key = RR.create(". IN DS 19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5")
-    @@root_verifier.add_root_ds(@@root_key)
+    #  KSK-2017 and KSK-2024, published at https://data.iana.org/root-anchors/root-anchors.xml
+    ROOT_TRUST_ANCHORS = [
+      ". IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D".freeze,
+      ". IN DS 38696 8 2 683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16".freeze
+    ].freeze
 
-    @@root_key_new = RR.create(". IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D")
-    @@root_verifier.add_root_ds(@@root_key_new)
+    @@root_verifier = SingleVerifier.new(SingleVerifier::VerifierType::ROOT)
+    ROOT_TRUST_ANCHORS.each {|ds| @@root_verifier.add_root_ds(RR.create(ds))}
 
     @@dlv_verifier = SingleVerifier.new(SingleVerifier::VerifierType::DLV)
 
@@ -104,11 +121,12 @@ module Dnsruby
       #  Create a new verifier?
       @@anchor_verifier.add_trust_anchor_with_expiration(k, expiration)
     end
-    #  Remove the trusted key
+    #  Remove a configured trust anchor and clear keys learned from local anchors.
     def Dnssec.remove_trust_anchor(t)
       @@anchor_verifier.remove_trust_anchor(t)
     end
-    #  Wipes the cache of trusted keys
+    #  Remove all local trust anchors and keys learned from them.
+    #  Built-in root anchors are unaffected.
     def self.clear_trust_anchors
       @@anchor_verifier.clear_trust_anchors
     end
@@ -117,6 +135,8 @@ module Dnsruby
       return @@anchor_verifier.trust_anchors
     end
 
+    #  Clear learned keys and all DS/DLV anchors, including the built-in root DS
+    #  anchors. Configured DNSKEY anchors are retained.
     def self.clear_trusted_keys
       [@@anchor_verifier, @@root_verifier, @@dlv_verifier].each {|v|
         v.clear_trusted_keys
@@ -124,10 +144,10 @@ module Dnsruby
     end
 
     def self.reset
+      SingleVerifier.set_recursor_hints(nil)
       @@validation_policy = ValidationPolicy::LOCAL_ANCHORS_THEN_ROOT
       @@root_verifier = SingleVerifier.new(SingleVerifier::VerifierType::ROOT)
-      @@root_verifier.add_root_ds(@@root_key)
-      @@root_verifier.add_root_ds(@@root_key_new)
+      ROOT_TRUST_ANCHORS.each {|ds| @@root_verifier.add_root_ds(RR.create(ds))}
 
       @@dlv_verifier = SingleVerifier.new(SingleVerifier::VerifierType::DLV)
 
@@ -138,8 +158,7 @@ module Dnsruby
     end
 
     def self.set_hints(hints)
-      @@root_verifier.set_hints(hints)
-      @@anchor_verifier.set_hints(hints)
+      SingleVerifier.set_recursor_hints(hints)
     end
 
     def self.no_keys?
@@ -184,10 +203,14 @@ module Dnsruby
     def self.validate(msg)
       query = Message.new()
       query.header.cd=true
-      return self.validate_with_query(query, msg)
+      validate_with_query(query, msg)
     end
 
     def self.validate_with_query(query, msg)
+      ValidationBudget.with { validate_with_query_internal(query, msg) }
+    end
+
+    private_class_method def self.validate_with_query_internal(query, msg)
       if (!msg)
         return false
       end
@@ -200,13 +223,19 @@ module Dnsruby
       }
       if (found_sigs)
         begin
-          if (verify(msg))
+          result = verify_result(msg, nil, operational: true)
+          if result == :secure
             msg.security_level = Message::SecurityLevel.SECURE
+            msg.security_error = ''
             return true
           end
-        rescue VerifyError => e
-          msg.security_error = e
-          msg.security_level = Message::SecurityLevel.BOGUS
+        rescue ValidationLimitError
+          raise
+        rescue VerifyError
+          # Missing cached keys and a failed trusted path both arrive here.
+          # Full validation discovers the applicable anchors and distinguishes
+          # those cases. A cached INSECURE result must go through that policy
+          # too: another applicable anchor may establish SECURE or BOGUS.
         end
       end
 
@@ -244,17 +273,21 @@ module Dnsruby
               Proc.new{|m, q| validate_with_anchors(m, q)}, msg, query)
           end
         end
-        if (last_level != Message::SecurityLevel.SECURE && last_level != Message::SecurityLevel.BOGUS)
+        if (last_level != Message::SecurityLevel.SECURE && last_level != Message::SecurityLevel.BOGUS) &&
+            [ValidationPolicy::LOCAL_ANCHORS_THEN_ROOT, ValidationPolicy::ROOT_THEN_LOCAL_ANCHORS].include?(@@validation_policy)
           last_level, last_error, last_error_level = try_validation(last_level, last_error, last_error_level,
             Proc.new{|m, q| validate_with_dlv(m, q)}, msg, query)
         end
         #  Set the message security level!
+        if last_level == Message::SecurityLevel.SECURE
+          last_error = ''
+        elsif last_error && !last_error.empty?
+          last_level = Message::SecurityLevel.BOGUS
+        end
         msg.security_level = last_level
         msg.security_error = last_error
-        if (last_error && last_error.index("ification error"))
-          msg.security_level = Message::SecurityLevel.BOGUS
-        end
-        raise VerifyError.new(last_error) if (last_level < 0)
+        msg.header.ad = false if msg.security_level == Message::SecurityLevel.INSECURE
+        raise VerifyError.new(last_error) if (msg.security_level < 0)
         return (msg.security_level.code > Message::SecurityLevel::UNCHECKED)
       end
       msg.security_level = Message::SecurityLevel.UNCHECKED
@@ -262,11 +295,33 @@ module Dnsruby
     end
 
     def self.try_validation(last_level, last_error, last_error_level, proc, msg, query)   # :nodoc:
+      ValidationBudget.with do
+        try_validation_internal(last_level, last_error, last_error_level, proc, msg, query)
+      end
+    end
+
+    private_class_method def self.try_validation_internal(last_level, last_error, last_error_level, proc, msg, query)
+      # Keep the lifetime with the successful result. A later unanchored
+      # verifier can return INSECURE without establishing a cacheable proof.
+      previous_expiration = if last_level == Message::SecurityLevel.INSECURE
+        msg.instance_variable_get(:@dnsruby_authenticated_expiration)
+      end
       begin
-        proc.call(msg, query)
+        result = proc.call(msg, query)
+        if !result || msg.security_level == Message::SecurityLevel.BOGUS
+          detail = msg.security_error.to_s
+          raise VerifyError, detail.empty? ? 'DNSSEC validation failed' : detail
+        end
+        if previous_expiration && msg.security_level <= Message::SecurityLevel.INSECURE
+          current_expiration = msg.instance_variable_get(:@dnsruby_authenticated_expiration)
+          msg.instance_variable_set(:@dnsruby_authenticated_expiration,
+            [previous_expiration, current_expiration].compact.min)
+        end
         last_level = Message::SecurityLevel.new([msg.security_level.code, last_level.code].max)
       rescue VerifyError => e
-        if (last_error_level < last_level)
+        # A failed trusted path cannot be erased by a later unanchored or
+        # insecure result. A separately authenticated SECURE path may win.
+        if last_error.to_s.empty? || last_error_level < last_level
           last_error = e.to_s
           last_error_level = last_level
         end
@@ -275,27 +330,62 @@ module Dnsruby
     end
 
     def self.validate_with_anchors(msg, query)
-      return @@anchor_verifier.validate(msg, query)
+      @@anchor_verifier.validate(msg, query)
     end
 
     def self.validate_with_root(msg, query)
-      return @@root_verifier.validate(msg, query)
+      @@root_verifier.validate(msg, query)
     end
 
     def self.validate_with_dlv(msg, query)
-      return @@dlv_verifier.validate(msg, query)
+      @@dlv_verifier.validate(msg, query)
     end
 
     def self.verify(msg, keys=nil)
-      begin
-        return true if @@anchor_verifier.verify(msg, keys)
-      rescue VerifyError
+      verify_result(msg, keys) == :secure
+    end
+
+    # Keep the result separate from mutable Message state: a previous validation
+    # must not turn a newly verified Opt-Out response into a secure response.
+    private_class_method def self.verify_result(msg, keys=nil, operational: false)
+      ValidationBudget.with { verify_internal(msg, keys, operational: operational) }
+    end
+
+    private_class_method def self.verify_internal(msg, keys, operational: false)
+      insecure = false
+      insecure_expiration = nil
+      last_error = nil
+      verifiers = if operational
+        case @@validation_policy
+        when ValidationPolicy::ALWAYS_ROOT_ONLY then [@@root_verifier]
+        when ValidationPolicy::ALWAYS_LOCAL_ANCHORS_ONLY then [@@anchor_verifier]
+        when ValidationPolicy::ROOT_THEN_LOCAL_ANCHORS then [@@root_verifier, @@anchor_verifier]
+        else [@@anchor_verifier, @@root_verifier]
+        end
+      else
+        [@@anchor_verifier, @@root_verifier, @@dlv_verifier]
+      end
+      verifiers.each do |verifier|
         begin
-          return true if @@root_verifier.verify(msg, keys)
-        rescue VerifyError
-          return true if @@dlv_verifier.verify(msg, keys) # Will carry error to client
+          result = operational ? verifier.verify_for_validation(msg) : verifier.verify_result(msg, keys)
+          return :secure if result == :secure
+          if result == :insecure
+            insecure = true
+            expiration = msg.instance_variable_get(:@dnsruby_authenticated_expiration)
+            insecure_expiration = [insecure_expiration, expiration].compact.min
+          end
+        rescue ValidationLimitError
+          raise
+        rescue VerifyError => error
+          last_error = error
         end
       end
+      if insecure
+        msg.instance_variable_set(:@dnsruby_authenticated_expiration, insecure_expiration) if insecure_expiration
+        return :insecure
+      end
+      raise last_error if last_error
+      false
     end
 
     def self.anchor_verifier
@@ -312,9 +402,22 @@ module Dnsruby
 
 
     def self.verify_rrset(rrset, keys = nil)
-      return ((@@anchor_verifier.verify_rrset(rrset, keys) ||
-            @@root_verifier.verify_rrset(rrset, keys) ||
-            @@dlv_verifier.verify_rrset(rrset, keys)))
+      ValidationBudget.with do
+        last_error = nil
+        verified = [@@anchor_verifier, @@root_verifier, @@dlv_verifier].any? do |verifier|
+          ValidationBudget.current.check!
+          begin
+            verifier.verify_rrset(rrset, keys)
+          rescue ValidationLimitError
+            raise
+          rescue VerifyError => error
+            last_error = error
+            false
+          end
+        end
+        raise last_error if !verified && last_error
+        verified
+      end
     end
   end
 end

data/lib/dnsruby/ipv6.rb

@@ -68,6 +68,7 @@ module Dnsruby
           prefix.scan(/[0-9A-Fa-f]+/) {|hex| a1 << [hex.hex].pack('n')}
           suffix.scan(/[0-9A-Fa-f]+/) {|hex| a2 << [hex.hex].pack('n')}
           omitlen = 16 - a1.length - a2.length
+          raise ArgumentError, "not numeric IPv6 address: #{arg}" unless omitlen > 0
           address << a1 << "\0" * omitlen << a2
         elsif Regex_6Hex4Dec =~ arg
           prefix, a, b, c, d = $1, $2.to_i, $3.to_i, $4.to_i, $5.to_i
@@ -85,6 +86,7 @@ module Dnsruby
             prefix.scan(/[0-9A-Fa-f]+/) {|hex| a1 << [hex.hex].pack('n')}
             suffix.scan(/[0-9A-Fa-f]+/) {|hex| a2 << [hex.hex].pack('n')}
             omitlen = 12 - a1.length - a2.length
+            raise ArgumentError, "not numeric IPv6 address: #{arg}" unless omitlen > 0
             address << a1 << "\0" * omitlen << a2 << [a, b, c, d].pack('CCCC')
           else
             raise ArgumentError.new("not numeric IPv6 address: " + arg)
@@ -108,12 +110,50 @@ module Dnsruby
     #  The raw IPv6 address as a String
     attr_reader :address
 
+    # The historical Dnsruby representation, retained for callers that compare
+    # address strings. Use #to_s_canonical for RFC 5952 formatting.
     def to_s
-      address = sprintf("%X:%X:%X:%X:%X:%X:%X:%X", *@address.unpack("nnnnnnnn"))
-      unless address.sub!(/(^|:)0(:0)+(:|$)/, '::')
-        address.sub!(/(^|:)0(:|$)/, '::')
+      text = sprintf("%X:%X:%X:%X:%X:%X:%X:%X", *@address.unpack("n8"))
+      unless text.sub!(/(^|:)0(:0)+(:|$)/, '::')
+        text.sub!(/(^|:)0(:|$)/, '::')
       end
-      return address
+      text
+    end
+
+    # The RFC 5952 canonical text representation of the address, opt-in.
+    def to_s_canonical
+      fields = @address.unpack("n8")
+
+      #  RFC 5952 section 5: an address carrying an embedded IPv4 address
+      #  under the well-known ::ffff:0:0/96 prefix is written in the mixed
+      #  hexadecimal / dotted decimal notation.
+      if fields[0, 5].all?(&:zero?) && fields[5] == 0xffff
+        return "::ffff:" + fields[6, 2].pack("n2").unpack("C4").join(".")
+      end
+
+      #  RFC 5952 section 4.2.3: "::" replaces the longest run of consecutive
+      #  all-zero fields, and the first such run when several are equally long.
+      #  Section 4.2.2: a run of a single all-zero field is never replaced.
+      run_start = nil
+      best_start, best_length = nil, 1
+      fields.each_with_index do |field, i|
+        if field == 0
+          run_start ||= i
+          length = i - run_start + 1
+          best_start, best_length = run_start, length if length > best_length
+        else
+          run_start = nil
+        end
+      end
+
+      #  RFC 5952 sections 4.1 and 4.3: no leading zeros, and lowercase hex
+      strings = fields.map {|field| field.to_s(16)}
+      if best_start
+        strings[best_start, best_length] = ['']
+        strings.unshift('') if best_start == 0
+        strings.push('') if best_start + best_length == fields.length
+      end
+      return strings.join(':')
     end
 
     def inspect #:nodoc:
@@ -141,4 +181,4 @@ module Dnsruby
       return @address.hash
     end
   end
-end
+end