dnsruby 1.74.0 → 2.0.0

data/lib/dnsruby/transport_clock.rb

@@ -0,0 +1,9 @@
+module Dnsruby
+  # Packet, query, retry, and I/O deadlines share one clock unaffected by wall
+  # clock corrections. DNS TTLs and signatures continue to use civil time.
+  module TransportClock #:nodoc:
+    def self.now
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+  end
+end

data/lib/dnsruby/update.rb

@@ -149,7 +149,11 @@ module Dnsruby
           klass = Classes.new(zone()[0].zclass)
           rdata=args[2]
         end
-        rec = RR.create("#{name} #{ttl} #{klass} #{type} #{rdata}")
+        rec = if args.length > 2
+          RR.create("#{name} #{ttl} #{klass} #{type} #{rdata}")
+        else
+          RR.empty_update_record(name, type, klass)
+        end
         add_pre(rec)
         return rec
       else
@@ -172,8 +176,6 @@ module Dnsruby
     #           (in the zone and class denoted by the Zone Section) can exist.
     #
     def absent(*args)
-      ttl = 0
-      rdata = ""
       klass = Classes.NONE
       if (args.length>=1) # domain (RFC2136, Section 2.4.5)
         name = args[0]
@@ -181,7 +183,7 @@ module Dnsruby
         if (args.length==2) # RRSET (RFC2136, Section 2.4.3)
           type = args[1]
         end
-        rec = RR.create("#{name} #{ttl} #{klass} #{type} #{rdata}")
+        rec = RR.empty_update_record(name, type, klass)
         add_pre(rec)
         return rec
       else
@@ -262,10 +264,10 @@ module Dnsruby
       resource = nil
       case args.length
       when 1 # name
-        resource = RR.create("#{args[0]} #{ttl} #{klass} #{Types.ANY} #{rdata}")
+        resource = RR.empty_update_record(args[0], Types.ANY, klass)
         add_update(resource)
       when 2 # name, type
-        resource = RR.create("#{args[0]} #{ttl} #{klass} #{args[1]} #{rdata}")
+        resource = RR.empty_update_record(args[0], args[1], klass)
         add_update(resource)
       when 3 # name, type, rdata
         name = args[0]

data/lib/dnsruby/validation_budget.rb

@@ -0,0 +1,143 @@
+require 'dnsruby/query_control'
+
+module Dnsruby
+  # Resource limits are verification failures, never evidence that a zone is
+  # insecure. Keep this distinction through trust-anchor and algorithm fallbacks.
+  class ValidationLimitError < VerifyError; end
+  class ValidationCancelled < ValidationLimitError; end
+
+  # One budget counts DNSSEC work across nested validation calls. Supporting
+  # lookups share its deadline and cancellation signal through QueryControl.
+  class ValidationBudget # :nodoc: all
+    # Ordinary verification and lookup failures can select another key or
+    # anchor. Exhaustion must cross those fallbacks unchanged, then become the
+    # public verification error when the outermost validation returns.
+    class Abort < StandardError
+      attr_reader :public_error
+
+      def initialize(public_error)
+        @public_error = public_error
+        super(public_error.message)
+      end
+    end
+    private_constant :Abort
+
+    DEFAULT_LIMITS = {
+      max_signature_verifications: 64,
+      max_work: 100_000,
+      timeout: 5.0
+    }.freeze
+
+    attr_reader :control, :transaction
+
+    def self.current
+      Thread.current[:dnsruby_validation_budget]
+    end
+
+    # Supporting lookup configuration has legacy catch-all fallbacks. None
+    # may convert an enclosing operation's exhaustion into an ordinary failure.
+    def self.abort?(error)
+      error.is_a?(Abort) || error.is_a?(ValidationLimitError) ||
+        error.is_a?(QueryControl::Stopped) || error.is_a?(RecursionLimitError)
+    end
+
+    def self.with(budget = nil)
+      previous = current
+      budget = previous || budget || new
+      Thread.current[:dnsruby_validation_budget] = budget
+      QueryControl.with(budget.control) do
+        budget.check!
+        result = yield budget
+        budget.check!
+        result
+      end
+    rescue Abort, QueryControl::Stopped => error
+      raise if previous
+      raise public_error(error), cause: error
+    ensure
+      Thread.current[:dnsruby_validation_budget] = previous
+    end
+
+    def initialize(deadline: nil, limits: Dnssec.validation_limits, parent: nil)
+      # A plain token can be retained with learned records without retaining
+      # the budget, resolver control, or the rest of a validation operation.
+      if parent
+        @transaction = parent.transaction
+        @limits = parent.limits
+        @state = parent.state
+        @control = QueryControl.new(deadline: deadline, parent: parent.control)
+      else
+        @transaction = Object.new.freeze
+        @limits = limits
+        deadline = [deadline, TransportClock.now + limits[:timeout]].compact.min
+        @control = QueryControl.new(deadline: deadline, parent: QueryControl.current)
+        @state = { mutex: Mutex.new, signature_verifications: 0, work: 0 }
+      end
+    end
+
+    # A selector cancels its completed hop. Keep that signal local while all
+    # hops and parallel address workers count against the lookup's one budget.
+    def child(deadline: nil)
+      self.class.new(deadline: deadline, parent: self)
+    end
+
+    def deadline
+      @control.deadline
+    end
+
+    def cancel
+      @control.cancel
+    end
+
+    def check!(work = 0)
+      @control.check!
+      @state[:mutex].synchronize do
+        @state[:work] += work
+        check_counts!
+      end
+      true
+    rescue QueryControl::Stopped => error
+      raise if self.class.current
+      raise self.class.public_error(error), cause: error
+    end
+
+    def self.public_error(error)
+      public_error = case error
+      when Abort then error.public_error
+      when QueryControl::Cancelled then ValidationCancelled.new('DNSSEC validation cancelled')
+      else ValidationLimitError.new('DNSSEC validation deadline exceeded')
+      end
+      public_error.set_backtrace(error.backtrace)
+      public_error
+    end
+
+    def fail_with(error_class, message)
+      error = error_class.new(message)
+      raise(self.class.current ? Abort.new(error) : error)
+    end
+    private :fail_with
+
+    def check_counts!
+      if @state[:signature_verifications] > @limits[:max_signature_verifications]
+        fail_with(ValidationLimitError, 'DNSSEC signature verification limit exceeded')
+      end
+      if @state[:work] > @limits[:max_work]
+        fail_with(ValidationLimitError, 'DNSSEC validation work limit exceeded')
+      end
+    end
+    private :check_counts!
+
+    def signature!
+      check!
+      @state[:mutex].synchronize do
+        @state[:signature_verifications] += 1
+        check_counts!
+      end
+      true
+    end
+
+    protected
+
+    attr_reader :limits, :state
+  end
+end

data/lib/dnsruby/validator_thread.rb

@@ -15,67 +15,149 @@
 # ++
 
 module Dnsruby
-  #  Takes care of the validation for the SelectThread. If queries need to be
-  #  made in order to validate the response, then a separate thread is fired up
-  #  to do this.
+  # Runs local DNSSEC validation outside SelectThread, using a bounded pool.
+  # Nested trust discovery shares the original validation budget.
   class ValidatorThread # :nodoc: all
-    #     include Singleton
+    WORKER_COUNT = 4
+    QUEUE_CAPACITY = 64
+    @worker_mutex = Mutex.new
+
+    # Chain discovery performs synchronous queries, so validation must run away
+    # from the selector. Bound both threads and queued responses under load.
+    def self.enqueue(validator)
+      rejected = []
+      accepted = @worker_mutex.synchronize do
+        # Threads do not survive fork. Parent work belongs to the parent, while
+        # the child's first admission must start its own pool.
+        if @worker_pid != Process.pid
+          @worker_pid = Process.pid
+          @work_queue = SizedQueue.new(QUEUE_CAPACITY)
+          @workers = []
+        end
+        @workers.select!(&:alive?)
+        begin
+          (WORKER_COUNT - @workers.length).times do
+            queue = @work_queue
+            @workers << Thread.new do
+              loop do
+                work = queue.pop
+                begin
+                  work.do_validate
+                rescue StandardError => error
+                  Dnsruby.log.error { "DNSSEC validation worker: #{error}" }
+                end
+              end
+            end
+          end
+        rescue ThreadError
+          # A partial pool remains usable and is replenished on later admission.
+          # If no worker could start, fail queued work rather than strand it.
+        end
+        if @workers.empty?
+          begin
+            loop { rejected << @work_queue.pop(true) }
+          rescue ThreadError
+          end
+          false
+        else
+          begin
+            @work_queue.push(validator, true)
+            true
+          rescue ThreadError
+            false
+          end
+        end
+      end
+      rejected.each(&:reject_capacity)
+      accepted
+    end
+
     def initialize(*args)
-      @client_id, @client_queue, @response, @error, @query, @st, @res = args
-      #  Create the validation thread, and a queue to receive validation requests
-      #  Actually, need to have a thread per validator, as they make recursive calls.
-      #       @@mutex = Mutex.new
-      #       @@validation_queue = Queue.new
-      #       @@validator_thread = Thread.new{
-      #         do_validate
-      #       }
+      @client_id, @client_queue, @response, @error, @query, @st, @res, @transmission_budget = args
+      @registered = false
+      prepare_budget if should_validate
     end
+
+    def prepare_budget
+      return @budget if @budget
+      deadline = @st.validation_deadline(@client_queue, @client_id) if @st.respond_to?(:validation_deadline)
+      if !@transmission_budget && @st.respond_to?(:validation_transmission_budget)
+        @transmission_budget = @st.validation_transmission_budget(@client_queue, @client_id)
+      end
+      @transmission_budget ||= SelectThread::TransmissionBudget.current || SelectThread::TransmissionBudget.new
+      lookup_budget = @transmission_budget.context(:validation) { nil }
+      @budget = lookup_budget ? lookup_budget.child(deadline: deadline) : ValidationBudget.new(deadline: deadline)
+    end
+    private :prepare_budget
+
+    def register
+      return true if @registered
+      prepare_budget
+      return false unless @st.register_validation(@client_queue, @res, @budget.control)
+      @registered = true
+    end
+    private :register
+
     def run
-      #  ONLY START THE NEW THREAD IF VALIDATION NEED OCCUR!!
-      if (should_validate)
-        Thread.new{
-          do_validate
-        }
+      if should_validate
+        return unless register
+        unless self.class.enqueue(self)
+          reject_capacity
+        end
       else
         do_validate
       end
     end
 
-
-    #     def add_to_queue(item)
-    #       print "ADding to validator queue\n"
-    # #      @@mutex.synchronize{
-    #         @@validation_queue.push(item)
-    # #      }
-    #     end
     def do_validate
-      #       while (true)
-      #         item = nil
-      #         print "Waiting to pop validation item\n"
-      # #        @@mutex.synchronize{
-      #           item = @@validation_queue.pop
-      # #        }
-      #       print "Popped validation request\n"
-      #         client_id, client_queue, response, err, query, st, res = item
-      validated_ok = validate(@query, @response, @res)
-
-      validated_ok = false if (@error && !(NXDomain === @error))
-
-      cache_if_valid(@query, @response)
-
-      #  Now send the response back to the client...
-      #       print "#{Time.now} : Got result for #{@query.question()[0].qname}, #{@query.question()[0].qtype}\n"
-      if (validated_ok)
-        @st.push_validation_response_to_select(@client_id, @client_queue, @response, nil, @query, @res)
+      needs_validation = should_validate
+      return if needs_validation && !register
+      validated_ok = if needs_validation
+        SelectThread::TransmissionBudget.with(@transmission_budget) do
+          ValidationBudget.with(@budget) { validate(@query, @response, @res) }
+        end
       else
-        @st.push_validation_response_to_select(@client_id, @client_queue, @response,
-          @response.security_error, @query, @res)
+        validate(@query, @response, @res)
+      end
+      validated_ok = false if @error && !@error.is_a?(NXDomain)
+      if @response.security_level == Message::SecurityLevel.BOGUS
+        detail = @response.security_error.to_s
+        raise VerifyError, detail.empty? ? 'DNSSEC validation failed' : detail
       end
+      @budget.check! if needs_validation
+      cache_if_valid(@query, @response) if validated_ok
+      @st.push_validation_response_to_select(@client_id, @client_queue, @response,
+        validated_ok ? nil : @response.security_error, @query, @res)
+    rescue StandardError => error
+      # Resolver observers ignore late completions; direct PacketSender callers
+      # still need a terminal error after cancellation or their sender closing.
+      unless error.is_a?(VerifyError) || error.is_a?(RecursionLimitError)
+        error = VerifyError.new("DNSSEC validation failed: #{error.message}")
+      end
+      finish_error(error)
+    ensure
+      unregister
+    end
 
+    def finish_error(error)
+      @response.security_error = error
+      @response.security_level = Message::SecurityLevel.BOGUS
+      @st.push_validation_response_to_select(@client_id, @client_queue, @response,
+        error, @query, @res)
+    end
+    private :finish_error
 
-      #       end
+    def unregister
+      @st.unregister_validation(@client_queue, @res, @budget.control) if @registered
+      @registered = false
     end
+    private :unregister
 
+    def reject_capacity
+      finish_error(ValidationLimitError.new('DNSSEC validation capacity exceeded'))
+    ensure
+      unregister
+    end
 
     def should_validate
       return ValidatorThread.requires_validation?(@query, @response, @error, @res)
@@ -95,26 +177,25 @@ module Dnsruby
     end
 
     def validate(query, response, res)
-      if (should_validate)
+      return true unless should_validate
+      ValidationBudget.with do
         begin
-          #  So, we really need to be able to take the response out of the select thread, along
-          #  with the responsibility for sending the answer to the client.
-          #  Should we have a validator thread? Or a thread per validation?
-          #  Then, select thread gets response. It performs basic checks here.
-          #  After basic checks, the select-thread punts the response (along with queues, etc.)
-          #  to the validator thread.
-          #  The validator validates it (or just releases it with no validation), and then
-          #  sends the request to the client via the client queue.
-          Dnssec.validate_with_query(query,response)
-          return true
+          validated = Dnssec.validate_with_query(query, response)
+          if !validated || response.security_level == Message::SecurityLevel.BOGUS
+            error = response.security_error
+            error = VerifyError.new(error.to_s.empty? ? 'DNSSEC validation failed' : error.to_s) unless error.is_a?(VerifyError)
+            response.security_error = error
+            response.security_level = Message::SecurityLevel.BOGUS
+            return false
+          end
+          true
         rescue VerifyError => e
           response.security_error = e
           response.security_level = Message::SecurityLevel.BOGUS
           #  Response security_level should already be set
-          return false
+          false
         end
       end
-      return true
     end
 
     def cache_if_valid(query, response)

data/lib/dnsruby/version.rb

@@ -1,3 +1,3 @@
 module Dnsruby
-  VERSION = '1.74.0'
+  VERSION = '2.0.0'
 end