dnsruby 1.73.1 → 2.0.0

data/lib/dnsruby/message/message.rb

@@ -20,7 +20,7 @@ require 'dnsruby/resource/resource'
 module Dnsruby
   #  ===Defines a DNS packet.
   # 
-  #  RFC 1035 Section 4.1, RFC 2136 Section 2, RFC 2845
+  #  RFC 1035 Section 4.1, RFC 2136 Section 2, RFC 8945
   # 
   #  ===Sections
   #  Message objects have five sections:
@@ -102,7 +102,23 @@ module Dnsruby
     # *  Dnsruby::Message.new('example.com', Dnsruby::Types.PTR, 'HS')
     # 
     def initialize(*args)
-      @header = Header.new()
+      initialize_fields(Header.new)
+      type = Types::A
+      klass = Classes::IN
+      if (args.length > 0)
+        name = args[0]
+        if (args.length > 1)
+          type = Types.new(args[1])
+          if (args.length > 2)
+            klass = Classes.new(args[2])
+          end
+        end
+        add_question(name, type, klass)
+      end
+    end
+
+    private def initialize_fields(header)
+      @header = header
       #       @question = Section.new(self)
       @question = []
       @answer = Section.new(self)
@@ -119,18 +135,6 @@ module Dnsruby
       @security_level = SecurityLevel.UNCHECKED
       @security_error = nil
       @cached = false
-      type = Types::A
-      klass = Classes::IN
-      if (args.length > 0)
-        name = args[0]
-        if (args.length > 1)
-          type = Types.new(args[1])
-          if (args.length > 2)
-            klass = Classes.new(args[2])
-          end
-        end
-        add_question(name, type, klass)
-      end
     end
 
     # The question section, an array of Dnsruby::Question objects.
@@ -365,6 +369,8 @@ module Dnsruby
     #  Sets the TSIG to sign this message with. Can either be a Dnsruby::RR::TSIG
     #  object, or it can be a (name, key) tuple, or it can be a hash which takes
     #  Dnsruby::RR::TSIG attributes (e.g. name, key, fudge, etc.)
+    #  Defaults to hmac-sha256; the algorithm must match the server's key.
+    #  You can select hmac-md5 for legacy servers, which logs a warning.
     def set_tsig(*args)
       if args.length == 1
         if args[0].instance_of?(RR::TSIG)
@@ -541,8 +547,11 @@ module Dnsruby
     def encode(canonical=false)
       if @tsigkey && (@tsigstate == :Unsigned) && !@signing
         @signing = true
-        sign!
-        @signing = false
+        begin
+          sign!
+        ensure
+          @signing = false
+        end
       end
 
       return MessageEncoder.new { |msg|
@@ -562,28 +571,41 @@ module Dnsruby
 
     #  Decode the encoded message
     def Message.decode(m)
-      o = Message.new()
+      # Incoming packets already contain an ID; do not allocate and randomize
+      # a query header only to replace it with the decoded response header.
+      o = Message.allocate
+      o.send(:initialize_fields, nil)
+      received_at = Time.now.to_i
       begin
         MessageDecoder.new(m) {|msg|
           o.header = Header.new(msg)
+          update = o.header.opcode == OpCode.Update
           o.header.qdcount.times {
             question = msg.get_question
             o.question << question
           }
           o.header.ancount.times {
-            rr = msg.get_rr
+            rr = msg.get_rr(update_section: update ? :prerequisite : false)
+            rr.instance_variable_set(:@dnsruby_received_at, received_at)
+            if rr.type == Types::TSIG
+              raise DecodeError.new('TSIG must be the last record in the additional section')
+            end
             o.answer << rr
           }
           o.header.nscount.times {
-            rr = msg.get_rr
+            rr = msg.get_rr(update_section: update ? :update : false)
+            rr.instance_variable_set(:@dnsruby_received_at, received_at)
+            if rr.type == Types::TSIG
+              raise DecodeError.new('TSIG must be the last record in the additional section')
+            end
             o.authority << rr
           }
           o.header.arcount.times { |count|
             start = msg.index
-            rr = msg.get_rr
+            rr = msg.get_rr(update_section: false)
+            rr.instance_variable_set(:@dnsruby_received_at, received_at)
             if rr.type == Types::TSIG
               if count != o.header.arcount-1
-                Dnsruby.log.Error('Incoming message has TSIG record before last record')
                 raise DecodeError.new('TSIG record present before last record')
               end
               o.tsigstart = start # needed for TSIG verification
@@ -595,6 +617,7 @@ module Dnsruby
         #  So we got a decode error
         #  However, we might have been able to fill in many parts of the message
         #  So let's raise the DecodeError, but add the partially completed message
+        o.header ||= Header.new
         e.partial_message = o
         raise e
       end
@@ -602,7 +625,15 @@ module Dnsruby
     end
 
     def clone
-      Message.decode(self.encode)
+      copy = Message.decode(self.encode)
+      [answer, authority, additional].zip([copy.answer, copy.authority, copy.additional]) do |original, cloned|
+        original.zip(cloned) do |record, clone|
+          [:@dnsruby_received_at, :@dnsruby_authenticated_expiration, :@dnsruby_learned_trust].each do |field|
+            clone.instance_variable_set(field, record.instance_variable_get(field)) if record.instance_variable_defined?(field)
+          end
+        end
+      end
+      copy
     end
 
     #  In dynamic update packets, the question section is known as zone and

data/lib/dnsruby/message/section.rb

@@ -18,11 +18,7 @@ class Section < Array
       end
       type_ok && (rr.klass == klass) && (rr.name.to_s(true).downcase == name.to_s().downcase)
     }
-    rrset = RRSet.new()
-    rrs.each do |rr|
-      rrset.add(rr)
-    end
-    rrset
+    RRSet.new(rrs)
   end
 
   #  Return an array of all the rrsets in the section
@@ -30,38 +26,20 @@ class Section < Array
     if type && !(Types === type)
       type = Types.new(type)
     end
-    ret = []
+    groups = {}
+    budget = ValidationBudget.current if defined?(ValidationBudget)
     each do |rr|
-      next if (!include_opt && (rr.type == Types::OPT))
-      #           if (type)
-      #             next if ((rr.type == Types.RRSIG) && (type != Types.RRSIG) && (rr.type_covered != type))
-      #             next if (rr.type != type)
-      #           end
-      if (type)
-        #  if this is an rrsig type, then :
-        #     only include it if the type_covered is the type requested,
-        #     OR if the type requested is an RRSIG
-        if rr.type == Types::RRSIG
-          if (rr.type_covered == type) || (type == Types::RRSIG)
-          else
-            next
-          end
-          #               next if ((rr.type_covered != type) || (type != Types.RRSIG))
-        elsif rr.type != type
-          next
-        end
-      end
+      budget&.check!(1)
+      next if !include_opt && rr.type == Types::OPT
+      covered_type = rr.type == Types::RRSIG ? rr.type_covered : rr.type
+      next if type && rr.type != type && covered_type != type
 
-      found_rrset = false
-      ret.each do |rrset|
-        found_rrset = rrset.add(rr)
-        break if found_rrset
-      end
-      unless found_rrset
-        ret.push(RRSet.new(rr))
-      end
+      # Hash insertion order preserves the section's first occurrence of each
+      # set. A signature joins the set it covers even when it appears first.
+      key = [rr.name.canonical, rr.klass.code, covered_type.code]
+      (groups[key] ||= []) << rr
     end
-    ret
+    groups.values.map { |records| RRSet.new(records) }
   end
 
   def ==(other)

data/lib/dnsruby/name.rb

@@ -54,7 +54,7 @@ module Dnsruby
           return Name.new([],false)
         end
         arg = punycode(arg)
-        return Name.new(split_escaped(arg), /\.\z/ =~ arg ? true : false)
+        return Name.new(split_escaped(arg), /(?<!\\)(?:\\\\)*\.\z/.match?(arg))
         #         return Name.new(Label.split(arg), /\.\z/ =~ arg ? true : false)
       when Array
         return Name.new(arg, /\.\z/ =~ (arg.last ? ((arg.last.kind_of?String)?arg.last : arg.last.string) : arg.last) ? true : false)
@@ -93,7 +93,10 @@ module Dnsruby
     # This method should only be called internally.
     # Use Name::create to create a new Name
     def initialize(labels, absolute=true) #:nodoc: all
-      total_length=labels.length-1
+      # The 255-octet limit (RFC 1035 section 2.3.4, RFC 2181 section 11) is
+      # on the wire form, so count each label's length octet, plus the root's
+      # zero octet.
+      total_length=labels.length+1
       labels.each do |l|
         if (!l.kind_of?Label)
           raise ArgumentError.new("Name::new called with non-labels. Use Name::create instead?")