dnsruby 1.73.1 → 2.0.0

data/test/tc_svcb_signed_target.rb

@@ -0,0 +1,145 @@
+require_relative 'spec_helper'
+require 'openssl'
+require 'base64'
+require 'stringio'
+require 'tempfile'
+
+class SvcbSignedTargetTest < Minitest::Test
+  MIXED_CASE_RDATA = ['000103466f6f074578616d706c6503434f4d00'].pack('H*').freeze
+
+  def setup
+    @rsa = OpenSSL::PKey::RSA.generate(2048)
+    exponent = @rsa.e.to_s(2)
+    key_bytes = [exponent.bytesize].pack('C') + exponent + @rsa.n.to_s(2)
+    @key = Dnsruby::RR.create("example. 300 IN DNSKEY 256 3 8 #{Base64.strict_encode64(key_bytes)}")
+    @verifier = Dnsruby::SingleVerifier.new(Dnsruby::SingleVerifier::VerifierType::ANCHOR)
+    @verifier.add_trust_anchor(@key)
+  end
+
+  def test_signed_text_roundtrip_preserves_target_case
+    [64, 65].each do |type|
+      original, signature = signed_record(type)
+      assert_signed_copy(original, Dnsruby::RR.create(original.to_s), signature)
+    end
+  end
+
+  def test_case_distinct_targets_remain_separate_in_signed_rrsets
+    [64, 65].each do |type|
+      records = ['Foo.Example.COM.', 'foo.example.com.'].map do |target|
+        Dnsruby::RR.create(name: 'example.', type: type, ttl: 300,
+          priority: 1, target: target)
+      end
+      refute_equal(records.first, records.last)
+      refute(records.first.eql?(records.last))
+      assert_equal(2, records.to_h { |record| [record, true] }.length)
+
+      same_record = records.first.clone
+      same_record.ttl = 60
+      assert_equal(records.first, same_record, 'TTL must remain irrelevant to RR equality')
+      assert(records.first.eql?(same_record))
+      assert_equal(records.first.hash, same_record.hash)
+
+      # Sign both original records before any RRSet or Message can deduplicate
+      # them. The signature must cover both case-distinct RDATA byte strings.
+      signature = signature_for(records)
+      rrset = Dnsruby::RRSet.new(records + [signature])
+      assert_equal(2, rrset.rrs.length)
+      assert(@verifier.verify(rrset))
+
+      message = Dnsruby::Message.new('example.', type)
+      (records + [signature]).each { |record| message.add_answer(record) }
+      decoded = Dnsruby::Message.decode(message.encode)
+      assert_equal(3, decoded.answer.length)
+      assert(@verifier.verify(Dnsruby::RRSet.new(decoded.answer.to_a)))
+    end
+  end
+
+  def test_signed_hash_constructor_preserves_string_and_name_targets
+    [64, 65].each do |type|
+      original, signature = signed_record(type)
+      ['Foo.Example.COM.', original.target].each do |target|
+        copy = Dnsruby::RR.create(name: original.name, type: type, ttl: 300,
+          priority: 1, target: target)
+        assert_signed_copy(original, copy, signature)
+      end
+    end
+  end
+
+  def test_signed_saved_zone_roundtrip_preserves_target_case
+    [64, 65].each do |type|
+      original, signature = signed_record(type)
+      Tempfile.create(['dnsruby-signed-target', '.zone']) do |zone|
+        zone.write("#{original}\n#{signature}\n")
+        zone.flush
+        records = Dnsruby::ZoneReader.new('example.').process_file(zone.path)
+        assert_signed_copy(original, records.first, records.last)
+      end
+    end
+  end
+
+  def test_signed_relative_zone_target_preserves_target_and_origin_case
+    [64, 65].each do |type|
+      original, signature = signed_record(type)
+      text = "example. 300 IN TYPE#{type} 1 Foo\n#{signature}\n"
+      records = Dnsruby::ZoneReader.new('Example.COM.').process_file(StringIO.new(text))
+      assert_signed_copy(original, records.first, records.last)
+    end
+  end
+
+  def test_ascii_escaped_target_preserves_wire_octets
+    [64, 65].each do |type|
+      target = 'F\\111o\\.Bar.\\255.Example.COM.'
+      expected = [1].pack('n') + "\x07Foo.Bar\x01\xff\x07Example\x03COM\0".b
+      string = Dnsruby::RR.create("example. IN TYPE#{type} 1 #{target}")
+      hash = Dnsruby::RR.create(name: 'example.', type: type, priority: 1, target: target)
+      [string, hash, Dnsruby::RR.create(string.to_s)].each do |record|
+        assert_equal(expected, record.rdata)
+      end
+    end
+  end
+
+  def test_unicode_targets_retain_idna_conversion
+    [64, 65].each do |type|
+      target = 'フガフガ。hogehoge.エグザンプル.JP.'
+      string = Dnsruby::RR.create("example. IN TYPE#{type} 1 #{target}")
+      hash = Dnsruby::RR.create(name: 'example.', type: type, priority: 1, target: target)
+      [string, hash].each do |record|
+        assert_equal('xn--mcka5jb.hogehoge.xn--ickqs6k2dyb.jp.', record.target.to_s(true))
+      end
+
+      text = "example. IN TYPE#{type} 1 Foo\n"
+      record = Dnsruby::ZoneReader.new('møllerriis.com.').process_file(StringIO.new(text)).first
+      assert_equal('Foo.xn--mllerriis-l8a.com.', record.target.to_s(true))
+    end
+  end
+
+  private
+
+  def signed_record(type)
+    record = Dnsruby::RR.new_from_data('example.', type, Dnsruby::Classes::IN, 300,
+      MIXED_CASE_RDATA.bytesize, MIXED_CASE_RDATA, 0)
+    signature = signature_for([record])
+    assert(@verifier.verify(Dnsruby::RRSet.new([record, signature])), 'original wire record must verify')
+    [record, signature]
+  end
+
+  def signature_for(records)
+    record = records.first
+    now = Time.now.to_i
+    signature = Dnsruby::RR.create(name: record.name, type: 'RRSIG', ttl: 300,
+      type_covered: record.type, algorithm: 8, labels: 1, original_ttl: 300,
+      expiration: now + 3600, inception: now - 60, key_tag: @key.key_tag,
+      signers_name: 'example.')
+    canonical = records.sort_by(&:rdata).map do |rr|
+      Dnsruby::MessageEncoder.new { |encoder| encoder.put_rr(rr, true) }.to_s
+    end.join
+    signature.signature = @rsa.sign(OpenSSL::Digest::SHA256.new, signature.sig_data + canonical)
+    signature
+  end
+
+  def assert_signed_copy(original, copy, signature)
+    assert_equal(original.rdata, copy.rdata)
+    assert_equal('Foo.Example.COM.', copy.target.to_s(true))
+    assert(@verifier.verify(Dnsruby::RRSet.new([copy, signature])), 'reconstructed record must retain its signature')
+  end
+end

data/test/tc_svcb_transport.rb

@@ -0,0 +1,120 @@
+require_relative 'spec_helper'
+require_relative 'socket_helpers'
+require 'socket'
+require 'timeout'
+
+class TestSVCBTransport < Minitest::Test
+  RDATA = ['0001000003000201bb'].pack('H*').freeze
+
+  def test_every_truncated_svcb_and_https_rdata_boundary_retries_over_tcp
+    truncated = ->(query) { response(query, truncated_at: query.question.first.qname.to_s[/\Acut(\d+)/, 1].to_i) }
+    with_server(truncated, ->(query) { response(query) }) do |port, events|
+      resolver = resolver_for(port)
+      begin
+        [64, 65].each do |type|
+          RDATA.bytesize.times do |length|
+            answer = Timeout.timeout(3) { resolver.query("cut#{length}.example.", type) }.answer.first
+            assert_equal(type, answer.type.code)
+            assert_equal(RDATA, answer.data)
+            assert_equal('443', answer.params_to_hash['port'])
+            assert_equal(:udp, events.pop(true))
+            assert_equal(:tcp, events.pop(true))
+          end
+        end
+        assert(events.empty?)
+      ensure
+        resolver.close
+      end
+    end
+  end
+
+  def test_malformed_svcb_does_not_bypass_transport_policy_or_retry_tcp
+    truncated = ->(query) { response(query, truncated_at: 3) }
+    malformed = ->(query) { response(query, data: ['0001000003000301bb'].pack('H*')) }
+    [
+      [{no_tcp: true}, truncated, :udp],
+      [{ignore_truncation: true}, truncated, :udp],
+      [{no_tcp: true, ignore_truncation: true}, truncated, :udp],
+      [{use_tcp: true}, truncated, :tcp],
+      [{}, malformed, :udp],
+    ].each do |options, reply, expected_transport|
+      with_server(reply, reply) do |port, events|
+        resolver = resolver_for(port, options)
+        begin
+          assert_raises(Dnsruby::DecodeError, options.inspect) do
+            Timeout.timeout(3) { resolver.query('invalid.example.', 65) }
+          end
+          assert_equal(expected_transport, events.pop(true))
+          assert(events.empty?, 'terminal malformed response must not start another attempt')
+        ensure
+          resolver.close
+        end
+      end
+    end
+  end
+
+  private
+
+  def resolver_for(port, options = {})
+    Dnsruby::Resolver.new({nameserver: '127.0.0.1', port: port,
+      dnssec: false, do_validation: false, do_caching: false,
+      packet_timeout: 1, query_timeout: 2, retry_times: 1}.merge(options))
+  end
+
+  # The answer's declared length always describes the complete RDATA, even
+  # when the UDP packet ends early. Build that length independently of the
+  # production RR encoder so the regression cannot repair its own fixture.
+  def response(query, truncated_at: nil, data: RDATA)
+    question = query.question.first
+    encoded_question = Dnsruby::MessageEncoder.new do |encoder|
+      encoder.put_name(question.qname)
+      encoder.put_pack('nn', question.qtype.code, question.qclass.code)
+    end.to_s
+    flags = truncated_at ? 0x8380 : 0x8180
+    header = [query.header.id, flags, 1, 1, 0, 0].pack('n6')
+    rr = "\xc0\x0c".b + [question.qtype.code, 1, 60, data.bytesize].pack('nnNn')
+    header + encoded_question + rr + (truncated_at ? data.byteslice(0, truncated_at) : data)
+  end
+
+  def with_server(udp_reply, tcp_reply)
+    udp, tcp = TestSockets.udp_tcp_pair
+    events, errors = Queue.new, Queue.new
+    running = true
+    workers = [[udp, :udp, udp_reply], [tcp, :tcp, tcp_reply]].map do |listener, transport, reply|
+      Thread.new do
+        while running
+          next unless IO.select([listener], nil, nil, 0.05)
+          events << transport
+          if transport == :udp
+            bytes, peer = listener.recvfrom(4096)
+            listener.send(reply.call(Dnsruby::Message.decode(bytes)), 0, peer[3], peer[1])
+          else
+            socket = listener.accept
+            begin
+              Timeout.timeout(2) do
+                length = socket.read(2).unpack1('n')
+                bytes = reply.call(Dnsruby::Message.decode(socket.read(length)))
+                socket.write([bytes.bytesize].pack('n') + bytes)
+              end
+            ensure
+              socket.close
+            end
+          end
+        end
+      rescue StandardError => error
+        errors << error
+      end
+    end
+    yield udp.addr[1], events
+    assert(errors.empty?, errors.empty? ? nil : errors.pop.full_message)
+  ensure
+    running = false
+    (workers || []).each do |worker|
+      worker.join(0.2)
+      worker.kill if worker.alive?
+      worker.join
+    end
+    tcp.close if tcp && !tcp.closed?
+    udp.close if udp && !udp.closed?
+  end
+end

data/test/tc_tcp.rb

@@ -15,56 +15,80 @@
 # ++
 
 require_relative 'spec_helper'
+require_relative 'local_dns_server'
 
 require 'socket'
 class TestTcp < Minitest::Test
+  include LocalDnsServer
+
   def test_TCP
-    res = Dnsruby::Resolver.new()
-    res.use_tcp = true
-    ret=res.query("example.com")
-    assert(ret.is_a?(Dnsruby::Message))
+    with_local_dns_server(:tcp, answer: 'example.com 60 IN A 192.0.2.1') do |resolver|
+      response = resolver.query('example.com')
+      assert_kind_of(Dnsruby::Message, response)
+      assert_equal(Dnsruby::RCode.NOERROR, response.rcode)
+      assert_equal(['192.0.2.1'], response.answer.map { |rr| rr.address.to_s })
+    end
   end
   def test_TCP_port
-    #  Need a test server so we can tell what port this message was actually sent on!
-    port = nil
-    src_port = 57923
-    Dnsruby::PacketSender.clear_caches
-    received_port = nil
-    server_thread = Thread.new {
-      ts = TCPServer.new(0)
-      port = ts.addr[1]
-        t = ts.accept
-      #  Check that the source port was src_port
-      received_port = t.peeraddr()[1]
-      packet = t.recvfrom(2)[0]
-
-      len = (packet[0]<<8)+packet[1]
-      if (RUBY_VERSION >= "1.9")
-        len = (packet[0].getbyte(0)<<8)+packet[1].getbyte(0)# Ruby 1.9
+    3.times do |attempt|
+      listener = reservation = server = resolver = nil
+      begin
+        listener = TCPServer.new('127.0.0.1', 0)
+        # OS-selected ephemeral ports can be below the resolver's permitted
+        # source-port range. Reserve an allowed port without SO_REUSEADDR.
+        reservation = Socket.new(Socket::AF_INET, Socket::SOCK_STREAM, 0)
+        src_port = (50_000..65_535).to_a.shuffle.find do |port|
+          begin
+            reservation.bind(Socket.sockaddr_in(port, '127.0.0.1'))
+            true
+          rescue Errno::EADDRINUSE
+            false
+          end
+        end
+        raise IOError, 'No available resolver source port' unless src_port
+        server = Thread.new do
+          begin
+            client = listener.accept
+            received_port = client.peeraddr[1]
+            length = client.read(2).unpack1('n')
+            response = Dnsruby::Message.decode(client.read(length))
+            response.header.qr = true
+            wire = response.encode
+            client.write([wire.bytesize].pack('n') + wire)
+            received_port
+          rescue StandardError => error
+            error
+          ensure
+            client.close if client && !client.closed?
+          end
+        end
+        resolver = Dnsruby::SingleResolver.new(
+          server: '127.0.0.1', port: listener.addr[1], use_tcp: true,
+          src_address: '127.0.0.1', src_port: src_port, do_caching: false,
+          dnssec: false, packet_timeout: 2
+        )
+        assert_equal(src_port, resolver.src_port)
+        Timeout.timeout(5) do
+          reservation.close
+          response = resolver.query('example.com')
+          received_port = server.value
+          raise received_port if received_port.is_a?(StandardError)
+          assert_equal(src_port, received_port)
+          assert_kind_of(Dnsruby::Message, response)
+        end
+        return
+      rescue IOError => error
+        # Another process can claim the port between release and bind.
+        # PacketSender wraps that specific bind failure in IOError.
+        port_in_use = error.message.match?(/\Adnsruby can't connect to [^,\n]+, use_tcp=true, exception = Errno::EADDRINUSE,/)
+        raise unless attempt < 2 && port_in_use
+      ensure
+        resolver.close if resolver
+        server.kill.join if server
+        reservation.close if reservation && !reservation.closed?
+        listener.close if listener && !listener.closed?
       end
-      packet = t.recvfrom(len)[0]
-      tcpPacket = Dnsruby::Message.decode(packet)
-      tcpPacket.header.tc = true
-      lenmsg = [tcpPacket.encode.length].pack('n')
-      t.send(lenmsg, 0)
-      t.write(tcpPacket.encode)
-      t.close
-      ts.close
-    }
-    ret = nil
-    sleep(1)
-    client_thread = Thread.new {
-#      res = Dnsruby::SingleResolver.new("127.0.0.1")
-      res = Dnsruby::SingleResolver.new("localhost")
-       res.port = port
-      res.use_tcp = true
-      res.src_port=src_port
-      ret=res.query("example.com")
-    }
-    server_thread.join
-    client_thread.join
-    assert(received_port == src_port)
-      assert(ret.is_a?(Dnsruby::Message))
+    end
   end
 
 #  def test_no_tcp
@@ -140,6 +164,7 @@ class TestTcp < Minitest::Test
       received_query = s[0]
       socket.connect(s[1][2], s[1][1])
       ans = HackMessage.decode(received_query)
+      ans.header.qr = true
       ans.wipe_additional
       100.times {|i|
         ans.add_additional(Dnsruby::RR.create("example.com 3600 IN A 1.2.3.#{i}"))
@@ -160,6 +185,7 @@ class TestTcp < Minitest::Test
       end
       packet = t.recvfrom(len)[0]
       tcpPacket = HackMessage.decode(packet)
+      tcpPacket.header.qr = true
             tcpPacket.wipe_additional
       110.times {|i|
       tcpPacket.add_additional(Dnsruby::RR.create("example.com 3600 IN A 1.2.3.#{i}"))