dnsruby 1.74.0 → 2.0.0

data/lib/dnsruby/key_cache.rb

@@ -14,28 +14,40 @@
 # limitations under the License.
 # ++
 
+require 'dnsruby/serial_time'
+
 module Dnsruby
   class KeyCache #:nodoc: all
     #  Cache includes expiration time for keys
     #  Cache removes expired records
-    def initialize(keys = nil)
-      #  Store key tag against [expiry, key]
+    def initialize(keys = nil, max_keys: nil)
+      # Store DNSKEY identity against [expiry, key]. A 16-bit key tag can collide.
       @keys = {}
+      @candidate_index = {}
+      @key_candidates = {}
+      @name_index = {}
+      raise ArgumentError, 'max_keys must be a positive integer' if max_keys && (!max_keys.is_a?(Integer) || max_keys <= 0)
+      @max_keys = max_keys
       add(keys)
     end
+
+    # TTL and cached OpenSSL objects are not part of a DNSKEY's identity.
+    # Copy mutable fields so later changes cannot corrupt the hash index.
+    def self.key_identity(key)
+      [key.name.canonical.freeze, key.klass.code, key.type.code,
+       key.flags, key.protocol, key.algorithm.code, key.key.dup.freeze].freeze
+    end
     def add_key_with_expiration(k, expiration)
       priv_add_key(k, expiration)
     end
-    def add(k)
+    def add(k, expiration = nil)
       if (k == nil)
         return false
       elsif (k.instance_of?RRSet)
-        add_rrset(k)
+        add_rrset(k, expiration)
       elsif (k.kind_of?KeyCache)
-        kaes = k.keys_and_expirations
-        kaes.keys.each { |keykey|
-          #             priv_add_key(keykey, kaes[keykey])
-          priv_add_key(keykey[1], keykey[0])
+        k.keys_and_expirations.each { |expiration, key|
+          priv_add_key(key, expiration)
         }
       else
         raise ArgumentError.new("Expected an RRSet or KeyCache! Got #{k.class}")
@@ -43,39 +55,98 @@ module Dnsruby
       return true
     end
 
-    def add_rrset(k)
-      #  Get expiration from the RRSIG
-      #  There can be several RRSIGs here, one for each key which has signed the RRSet
-      #  We want to choose the one with the most secure signing algorithm, key length,
-      #  and the longest expiration time - not easy!
-      #  for now, we simply accept all signed keys
-      k.sigs.each { |sig|
-        if (sig.type_covered = Types.DNSKEY)
-          if (sig.inception <= Time.now.to_i)
-            #  Check sig.expiration, sig.algorithm
-            if (sig.expiration > Time.now.to_i)
-              #  add the keys to the store
-              k.rrs.each {|rr| priv_add_key(rr, sig.expiration)}
-            end
-          end
-        end
-      }
+    def add_rrset(k, expiration = nil)
+      return unless k.type == Types.DNSKEY
+      now = Time.now.to_i
+      # Verification supplies an absolute deadline derived from the signature
+      # that actually verified. Never extend it using other supplied RRSIGs.
+      # Explicit callers without that deadline get a conservative TTL bound.
+      unless expiration
+        signatures = k.sigs.select { |sig| SerialTime.valid?(sig.inception, sig.expiration, now) }
+        return if signatures.empty?
+        expiration = ([now + k.ttl] + signatures.map { |sig| SerialTime.absolute(sig.expiration, now) }).min
+      end
+      return if expiration <= now
+      k.rrs.each { |rr| priv_add_key(rr, expiration) }
+    end
+
+    # A tag identifies a bucket, not a unique key. Keep every colliding key.
+    def self.candidate_identity(name, klass, algorithm, tag)
+      [name.canonical.freeze, klass.code, algorithm.code, tag].freeze
     end
 
     def priv_add_key(k, exp)
-      #  Check that the key does not already exist with a longer expiration!
-      if (@keys[k] == nil)
-        @keys[k.key_tag] = [exp,k]
-      elsif ((@keys[k])[0] < exp)
-        @keys[k.key_tag] = [exp,k]
+      identity = self.class.key_identity(k)
+      previous = @keys[identity]
+      return if previous && previous[0] >= exp
+      if @max_keys && !previous && @keys.length >= @max_keys
+        remove_expired_keys
+        delete_identity(@keys.each_key.first) while @keys.length >= @max_keys
+      end
+      @keys[identity] = [exp, k]
+      candidate = self.class.candidate_identity(k.name, k.klass, k.algorithm, k.key_tag)
+      (@candidate_index[candidate] ||= {})[identity] = true
+      @key_candidates[identity] = candidate
+      (@name_index[identity.first] ||= {})[identity] = true
+    end
+
+    def matching_keys(signatures)
+      identities = signatures.flat_map do |sig|
+        candidate = self.class.candidate_identity(sig.signers_name, sig.klass, sig.algorithm, sig.key_tag)
+        (@candidate_index[candidate] || {}).keys
+      end.uniq
+      now = Time.now.to_i
+      identities.filter_map do |identity|
+        expiration, key = @keys.fetch(identity)
+        if expiration <= now
+          delete_identity(identity)
+          nil
+        else
+          key
+        end
+      end
+    end
+
+    def keys_for_name(name)
+      now = Time.now.to_i
+      (@name_index[name.canonical] || {}).keys.filter_map do |identity|
+        expiration, key = @keys.fetch(identity)
+        if expiration <= now
+          delete_identity(identity)
+          nil
+        else
+          key
+        end
       end
     end
 
+    def include_identity?(identity)
+      @keys.key?(identity)
+    end
+
     def each
       #  Only offer currently-valid keys here
       remove_expired_keys
       @keys.values.each {|v| yield v[1]}
     end
+    def delete(key)
+      delete_identity(self.class.key_identity(key))
+    end
+    def delete_identity(identity)
+      cached = @keys.delete(identity)
+      return unless cached
+      key = cached[1]
+      names = @name_index.fetch(identity.first)
+      names.delete(identity)
+      @name_index.delete(identity.first) if names.empty?
+      candidate = @key_candidates.delete(identity)
+      bucket = @candidate_index[candidate]
+      if bucket
+        bucket.delete(identity)
+        @candidate_index.delete(candidate) if bucket.empty?
+      end
+      key
+    end
     def keys
       #  Only offer currently-valid keys here
       remove_expired_keys
@@ -86,16 +157,112 @@ module Dnsruby
     end
     def keys_and_expirations
       remove_expired_keys
-      return keys.values
+      @keys.values.map(&:dup)
     end
     def remove_expired_keys
-      @keys.delete_if {|k,v|
-        v[0] < Time.now.to_i
-      }
+      now = Time.now.to_i
+      @keys.each { |identity, (expiration, _key)| delete_identity(identity) if expiration <= now }
     end
     def find_key_for(name)
       each {|key| return key if key.name == name}
       return false
     end
   end
-end
+
+  # Learned DS/DLV RRsets are evicted as a whole. The record limit bounds both
+  # retained records and index entries, even when an RRset contains many DSes.
+  class DSCache # :nodoc: all
+    def initialize(max_records:)
+      if max_records && (!max_records.is_a?(Integer) || max_records <= 0)
+        raise ArgumentError, 'max_records must be a positive integer'
+      end
+      @max_records = max_records
+      @record_count = 0
+      @sets = {}
+      @candidate_index = {}
+      @name_index = {}
+    end
+
+    def self.set_identity(rrset)
+      [rrset.name.canonical.freeze, rrset.klass.code, rrset.type.code].freeze
+    end
+
+    def self.candidate_identity(record)
+      # DLV owners belong to a lookaside registry, not the DNSKEY's zone.
+      [record.type == Types.DLV ? nil : record.name.canonical.freeze,
+        record.klass.code, record.algorithm.code, record.key_tag].freeze
+    end
+
+    def add(rrset, expiration)
+      identity = self.class.set_identity(rrset)
+      delete(identity)
+      count = rrset.rrs.length + rrset.sigs.length
+      return if expiration <= Time.now.to_i || (@max_records && count > @max_records)
+      remove_expired if @max_records && @record_count + count > @max_records
+      delete(@sets.each_key.first) while @max_records && @record_count + count > @max_records
+      candidates = rrset.rrs.map { |record| self.class.candidate_identity(record) }.uniq
+      @sets[identity] = [expiration, rrset, count, candidates]
+      @record_count += count
+      (@name_index[identity.first] ||= {})[identity] = true
+      candidates.each { |candidate| (@candidate_index[candidate] ||= {})[identity] = true }
+    end
+
+    def matching_rrsets(keys)
+      identities = keys.flat_map do |key|
+        [key.name.canonical, nil].flat_map do |owner|
+          (@candidate_index[[owner, key.klass.code, key.algorithm.code, key.key_tag]] || {}).keys
+        end
+      end.uniq
+      now = Time.now.to_i
+      identities.filter_map do |identity|
+        expiration, rrset = @sets.fetch(identity)
+        if expiration <= now
+          delete(identity)
+          nil
+        else
+          rrset
+        end
+      end
+    end
+
+    def rrsets_for_name(name)
+      now = Time.now.to_i
+      (@name_index[name.canonical] || {}).keys.filter_map do |identity|
+        expiration, rrset = @sets.fetch(identity)
+        if expiration <= now
+          delete(identity)
+          nil
+        else
+          rrset
+        end
+      end
+    end
+
+    def rrsets
+      remove_expired
+      @sets.values.map { |entry| entry[1] }
+    end
+
+    private
+
+    def remove_expired
+      now = Time.now.to_i
+      @sets.each { |identity, entry| delete(identity) if entry[0] <= now }
+    end
+
+    def delete(identity)
+      entry = @sets.delete(identity)
+      return unless entry
+      @record_count -= entry[2]
+      names = @name_index.fetch(identity.first)
+      names.delete(identity)
+      @name_index.delete(identity.first) if names.empty?
+      entry[3].each do |candidate|
+        bucket = @candidate_index.fetch(candidate)
+        bucket.delete(identity)
+        @candidate_index.delete(candidate) if bucket.empty?
+      end
+    end
+  end
+
+end

data/lib/dnsruby/message/decoder.rb

@@ -17,6 +17,9 @@ class MessageDecoder #:nodoc: all
     @data = data
     @index = 0
     @limit = data.length
+    # Compression addresses have 14 bits. Cache only validated suffixes at
+    # addressable offsets, so repeated names do not repeat pointer traversal.
+    @name_suffixes = {}
     yield self if block_given?
   end
 
@@ -36,19 +39,28 @@ class MessageDecoder #:nodoc: all
   # Gets the byte value at the specified position
   def get_byte_at(position)
     assert_buffer_position_valid(position)
-    return nil if @data[position].nil?
-    @data[position].getbyte(0)
+    # Wire strings have byte offsets. Avoid allocating a one-character
+    # String for every label octet, retaining historical character indexing
+    # for direct callers that supply a multibyte text encoding.
+    if @data.encoding == Encoding::BINARY || @data.ascii_only?
+      @data.getbyte(position)
+    else
+      @data[position]&.getbyte(0)
+    end
   end
 
   # Gets a 16-bit length field from the binary string and yields to the block.
   # This will be the length of the next item to parse in the binary string.
   # Returns the object returned from that block.
   #
-  # When this method returns, @index will point to the byte after the
-  # 16-bit length field.
+  # When this method returns, @index will point just after the parsed item.
   def get_length16
-    len, = self.get_unpack('n')
     save_limit = @limit
+    len, = self.get_unpack('n')
+    # A nested length may narrow its enclosing buffer, never extend it. In
+    # particular, truncated UDP RDATA must raise DecodeError before a typed
+    # decoder reads beyond the physical packet and raises an unrelated error.
+    assert_buffer_position_valid(@index + len)
     @limit = @index + len
     parsed_data = yield(len)
     if @index < @limit
@@ -56,8 +68,9 @@ class MessageDecoder #:nodoc: all
       raise DecodeError.new(message)
     end
     assert_buffer_position_valid(@index)
-    @limit = save_limit
     parsed_data
+  ensure
+    @limit = save_limit
   end
 
   # Returns the specified number of bytes from the binary string.
@@ -118,29 +131,68 @@ class MessageDecoder #:nodoc: all
   def get_labels(limit = nil)
     limit = @index if limit.nil? || (@index < limit)
     labels = []
-    while true
+    return_index = nil
+    expanded_length = 1 # The terminating root label.
+    path = []
+    suffix_end = 0
+
+    loop do
+      raise DecodeError, 'Truncated DNS name' unless has_remaining?
+      if return_index && (suffix = @name_suffixes[@index])
+        # Previously decoded suffixes must also fit the current RDATA bound.
+        # The pointer's own two octets were checked before this lookup.
+        assert_buffer_position_valid(suffix[2])
+        expanded_length += suffix[1] - 1
+        raise DecodeError, "DNS name exceeds #{Name::MaxNameLength} octets" if expanded_length > Name::MaxNameLength
+        labels.concat(suffix[0])
+        suffix_end = suffix[2]
+        break
+      end
+      offset = @index
+      label_index = labels.length
       temp = get_byte_at(@index)
       case temp
         when 0
           @index += 1
-          return labels
+          path << [offset, label_index, @index]
+          break
         when 192..255
           idx = get_unpack('n')[0] & 0x3fff
           if limit <= idx
             raise DecodeError.new('non-backward name pointer')
           end
-          save_index = @index
+          return_index ||= @index
+          path << [offset, label_index, @index]
           @index = idx
-          labels += self.get_labels(limit)
-          @index = save_index
-          return labels
-        when nil
-          return labels
+          # Each target is below the preceding target (or original name).
+          # The 14-bit pointer address therefore bounds traversal without
+          # recursion, an arbitrary hop limit, or a growing visited set.
+          limit = idx
+        when 1..63
+          expanded_length += 1 + temp
+          if expanded_length > Name::MaxNameLength
+            raise DecodeError, "DNS name exceeds #{Name::MaxNameLength} octets"
+          end
+          labels << get_label.string.dup.freeze
+          path << [offset, label_index, @index]
         else
-          labels << self.get_label
+          raise DecodeError, 'Reserved or invalid DNS label type'
       end
     end
-    labels
+    # Pointer-only aliases share one immutable array. Label suffix arrays are
+    # bounded by the 255-octet expanded name limit, not by packet record count.
+    previous_index = previous_suffix = nil
+    path.reverse_each do |offset, label_index, wire_end|
+      suffix_end = [suffix_end, wire_end].max
+      next if offset >= 0x4000
+      value = label_index == previous_index ? previous_suffix : labels[label_index..-1].freeze
+      @name_suffixes[offset] ||= [value, 1 + value.sum { |label| label.bytesize + 1 }, suffix_end].freeze
+      previous_index, previous_suffix = label_index, value
+    end
+    @index = return_index if return_index
+    # Name and Label expose mutable strings; cached data must never be shared
+    # with callers or between separately decoded names.
+    labels.map { |label| Name::Label.new(label.dup) }
   end
 
   # Gets a single label.
@@ -161,18 +213,32 @@ class MessageDecoder #:nodoc: all
   end
 
   # Gets a resource record.
-  def get_rr
+  def get_rr(update_section: nil)
     name = get_name
     type, klass, ttl = get_unpack('nnN')
+    if type == Types::TSIG && (klass != Classes::ANY || ttl != 0)
+      raise DecodeError.new('TSIG requires class ANY and TTL zero (RFC 8945 section 4.2)')
+    end
     klass = Classes.new(klass)
     typeclass = RR.get_class(type, klass)
     #  @TODO@ Trap decode errors here, and somehow mark the record as bad.
     #  Need some way to represent raw data only
-    record = get_length16 { typeclass.decode_rdata(self) }
+    record = get_length16 do |length|
+      marker_context = ttl == 0 && (update_section.nil? ||
+        (update_section == :prerequisite ||
+          (update_section == :update && klass == Classes::ANY)))
+      if length == 0 && marker_context && RR.empty_update_type?(type, klass)
+        RR.empty_update_record(name, type, klass)
+      else
+        typeclass.decode_rdata(self)
+      end
+    end
     record.name = name
-    record.ttl = ttl
+    # OPT overloads this field with EDNS flags and the extended RCODE.
+    record.ttl = type != Types::OPT && ttl >= 0x80000000 ? 0 : ttl
     record.type = type
     record.klass = klass
+    record.validate_decoded_rdata
     record
   end
 end

data/lib/dnsruby/message/encoder.rb

@@ -1,7 +1,7 @@
 module Dnsruby
 class MessageEncoder #:nodoc: all
   def initialize
-    @data = +''
+    @data = ''.b
     @names = {}
     yield self if block_given?
   end
@@ -11,7 +11,7 @@ class MessageEncoder #:nodoc: all
   end
 
   def put_bytes(d)
-    @data << d
+    @data << d.b
   end
 
   def put_pack(template, *d)
@@ -25,19 +25,20 @@ class MessageEncoder #:nodoc: all
   def put_length16
     length_index = @data.length
     @data << "\0\0"
-    data_start = @data.length
+    data_start = @data.bytesize
     yield
-    data_end = @data.length
-    @data[length_index, 2] = [data_end - data_start].pack("n")
+    data_end = @data.bytesize
+    length = data_end - data_start
+    if length > 0xffff
+      raise EncodeError.new("Length-prefixed data exceeds 65535 octets: #{length}")
+    end
+    @data[length_index, 2] = [length].pack("n")
   end
 
   def put_string(d)
-    begin
-      self.put_pack("C", d.length)
-      @data << d
-    rescue Encoding::CompatibilityError
-      raise Dnsruby::EncodeError.new("IDN support currently requires punycode string")
-    end
+    raise EncodeError, "Character-string exceeds 255 octets: #{d.bytesize}" if d.bytesize > 255
+    self.put_pack("C", d.bytesize)
+    @data << d.b
   end
 
   def put_string_list(ds)
@@ -59,13 +60,23 @@ class MessageEncoder #:nodoc: all
   end
 
   def put_labels(d, do_canonical)
+    if do_canonical
+      d.each { |label| put_label(label) }
+      @data << "\0"
+      return
+    end
+    # Snapshot each label once. Suffix keys share these immutable strings,
+    # while retaining label boundaries and case for lossless compression.
+    labels = d.map { |label| label.string.b.freeze }
     d.each_index do |i|
-      domain = d[i..-1].join('.')
-      if !do_canonical && (idx = @names[domain])
+      domain = labels[i..-1].freeze
+      if (idx = @names[domain]) && idx < 0x4000
         self.put_pack('n', 0xc000 | idx)
         return
       else
-        @names[domain] = @data.length
+        # Compression pointers have only 14 bits for the target offset.
+        # Later names can still use an earlier eligible suffix.
+        @names[domain] ||= @data.bytesize if @data.bytesize < 0x4000
         self.put_label(d[i])
       end
     end
@@ -76,8 +87,8 @@ class MessageEncoder #:nodoc: all
   def put_label(d)
     #       s, = Name.encode(d)
     s = d
-    raise RuntimeError, "length of #{s} is #{s.string.length} (larger than 63 octets)" if s.string.length > 63
+    raise EncodeError, "Label exceeds 63 octets: #{s.string.bytesize}" if s.string.bytesize > 63
     self.put_string(s.string)
   end
 end
-end
+end

data/lib/dnsruby/message/header.rb

@@ -1,3 +1,5 @@
+require 'securerandom'
+
 module Dnsruby
 
 # The header portion of a DNS packet
@@ -60,7 +62,7 @@ class Header
 
   def initialize(*args)
     if (args.length == 0)
-      @id = rand(MAX_ID)
+      @id = SecureRandom.random_number(MAX_ID + 1)
       @qr = false
       @opcode = OpCode.Query
       @aa = false
@@ -88,9 +90,7 @@ class Header
   end
 
   def Header.new_from_data(data)
-    header = Header.new
-    MessageDecoder.new(data) { |msg| header.decode(msg) }
-    header
+    Header.new(MessageDecoder.new(data))
   end
 
   def data
@@ -116,14 +116,10 @@ class Header
   end
 
   def Header.decrement_arcount_encoded(bytes)
-    header = Header.new
-    header_end = 0
-    MessageDecoder.new(bytes) do |msg|
-      header.decode(msg)
-      header_end = msg.index
-    end
+    decoder = MessageDecoder.new(bytes)
+    header = Header.new(decoder)
     header.arcount -= 1
-    bytes[0, header_end] = MessageEncoder.new { |msg| header.encode(msg) }.to_s
+    bytes[0, decoder.index] = MessageEncoder.new { |msg| header.encode(msg) }.to_s
     bytes
   end
 
@@ -243,4 +239,4 @@ class Header
   alias adcount= arcount=
 
 end
-end
+end