dnsruby 1.61.3 → 1.61.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: efa9e31f0e7a6a2b4d9e9e58fc6c3bdefe20791a095e9237b52b4df3f5ea3960
-  data.tar.gz: 4622702939e985576f613073e3a8bcf8b245aaaf6afd3139427e756311755ff8
+  metadata.gz: 0af7c6de9311c48936130f68339d222dc18675d7ad52db92eec7474bae5ee05c
+  data.tar.gz: cc926e5123a7e691b88261d93891b7f28efbc54d01ca549e1fdabc6d9ee62f1a
 SHA512:
-  metadata.gz: 56b5ff00ed1275be32309e5d2389f6f88954a36d94b70f205c9e637658ffb9a341466300306021d27e37daf839bf2e6f2e202ce5371be7cdbed00ed0697c3f87
-  data.tar.gz: 6586cc36e174de3f90ffbb03bdce009c594f532ac26ea05e587ff966fac8eef998f5e42573c191142e4289d8fddcd77a44938b617e682050057a576bdadaba55
+  metadata.gz: c09d09948564591075f2caccc23d0592ec04644d592815400cc78e1664354af47e9185276fce7c64fb81a18ef4fbbfd53520314419e5085a879dd8df0565527f
+  data.tar.gz: 535c00b339938ffe3e1479286477889398dc1154f43a2eae4defcb7e08a0a04d23033b501163f3815e2793af67d9445448170bfbd516d34702a5df93f4a22b4d

data/.travis.yml

@@ -7,8 +7,7 @@ before_install: gem install bundler
 script: "bundle exec rake test"
 
 rvm:
-  - 2.6.3
-  - 2.4.1
-  - 2.3.0
-  - 2.5.1
+  - 2.6.6
+  - 2.5.8
+  - 2.7.1
 

data/.yardopts

@@ -0,0 +1,7 @@
+-
+--main README.md
+LICENSE
+DNSSEC
+EXAMPLES
+EVENTMACHINE
+RELEASE_NOTES.md

data/Gemfile

@@ -1,5 +1,3 @@
 source 'https://rubygems.org'
 
 gemspec
-
-gem "addressable", "~> 2.5"

data/README.md

@@ -93,3 +93,4 @@ Contact/Links
 | Github | https://github.com/alexdalitz/dnsruby |
 | Google Group | https://groups.google.com/forum/#!forum/dnsruby |
 | Rubygems | http://rubygems.org/gems/dnsruby/ |
+| Documentation | https://www.rubydoc.info/gems/dnsruby/ |

data/RELEASE_NOTES.md

@@ -1,6 +1,20 @@
 # Release Notes
 
-##v1.61.2
+## v1.61.4
+
+* Dnsruby::Name : document .punycode
+* gemspec enhancement
+* add yard build file
+* fix create name include url special characters
+* Fix uninitialized constant error when using via Rails
+* Implement ECDSAP256SHA256 (13) / ECDSAP384SHA384 (14) algorithms for DNSKEY
+* Reinitialize all IANA TAR keys with Dnssec.reset
+
+## v1.61.3
+
+* TCP timeout and port changes
+
+## v1.61.2
 
 * Add new root key
 

data/dnsruby.gemspec

@@ -15,6 +15,7 @@ SPEC = Gem::Specification.new do |s|
 stub resolver. It aims to comply with all DNS RFCs, including
 DNSSEC NSEC3 support.'
   s.license = "Apache License, Version 2.0"
+  
   s.files = `git ls-files -z`.split("\x0")
 
   s.post_install_message = \
@@ -25,21 +26,26 @@ DNSSEC NSEC3 support.'
   s.test_file = "test/ts_offline.rb"
   s.extra_rdoc_files = ["DNSSEC", "EXAMPLES", "README.md", "EVENTMACHINE"]
 
-  unless /java/ === RUBY_PLATFORM
-    s.add_development_dependency 'pry', '~> 0.10'
-    s.add_development_dependency 'pry-byebug', '~> 2.0' if RUBY_VERSION >= '2'
-  end
+  s.metadata = {
+    'yard.run'          => 'yard',
+    'bug_tracker_uri'   => 'https://github.com/alexdalitz/dnsruby/issues',
+    'changelog_uri'     => 'https://github.com/alexdalitz/dnsruby/blob/master/RELEASE_NOTES.md',
+    'documentation_uri' => 'https://www.rubydoc.info/gems/dnsruby/',
+    'homepage_uri'      => 'https://github.com/alexdalitz/dnsruby',
+    'source_code_uri'   => 'https://github.com/alexdalitz/dnsruby',
+  }
 
-  s.add_development_dependency 'rake', '~> 10', '>= 10.3.2'
+  s.add_development_dependency 'rake', '>= 12.3.3'
   s.add_development_dependency 'minitest', '~> 5.4'
   s.add_development_dependency 'rubydns', '~> 2.0.1'
   s.add_development_dependency 'nio4r', '~> 2.0'
   s.add_development_dependency 'minitest-display', '>= 0.3.0'
+  s.add_development_dependency('yard', '~> 0.9')
 
   if RUBY_VERSION >= "1.9.3"
     s.add_development_dependency 'coveralls', '~> 0.7'
   end
 
-  s.add_runtime_dependency 'addressable', '~> 2.5'
+  s.add_runtime_dependency 'simpleidn', '~> 0.1'
 end
 

data/lib/dnsruby/dnssec.rb

@@ -128,6 +128,7 @@ module Dnsruby
       @@validation_policy = ValidationPolicy::LOCAL_ANCHORS_THEN_ROOT
       @@root_verifier = SingleVerifier.new(SingleVerifier::VerifierType::ROOT)
       @@root_verifier.add_root_ds(@@root_key)
+      @@root_verifier.add_root_ds(@@root_key_new)
 
       @@dlv_verifier = SingleVerifier.new(SingleVerifier::VerifierType::DLV)
 

data/lib/dnsruby/name.rb

@@ -27,7 +27,7 @@ module Dnsruby
   # * Name#subdomain_of?(other)
   # * Name#labels
   #
-  require 'addressable'
+  require 'simpleidn'
   class Name
     include Comparable
     MaxNameLength=255
@@ -63,20 +63,18 @@ module Dnsruby
       end
     end
 
+    # Convert IDN domain from Unicode UTF-8 to ASCII punycode
+    # @param [Object|String] d Unicode domain with emoji inside
+    # @return [String] ASCII punycode domain
+    # @example
+    #   Dnsruby::Name.punycode('🏳.cf')
+    #   => "xn--en8h.cf"
     def self.punycode(d)
-        begin
-          c = Addressable::URI.parse("http://" + d.to_s)
-          ret = c.normalized_host.sub("http://", "")
-          if (!d.end_with?".")
-            return ret.chomp(".")
-          end
-          if (!ret.end_with?".")
-            return ret + "."
-          end
-          return ret
-        rescue Exception => e
-          return d
-        end
+      begin
+        return SimpleIDN.to_ascii(d)
+      rescue
+        return d
+      end
     end
 
     def self.split_escaped(arg) #:nodoc: all

data/lib/dnsruby/resource/DNSKEY.rb

@@ -313,6 +313,8 @@ module Dnsruby
           elsif [Algorithms.DSA,
               Algorithms.DSA_NSEC3_SHA1].include?(@algorithm)
             @public_key = dsa_key
+          elsif [Algorithms.ECDSAP256SHA256, Algorithms.ECDSAP384SHA384].include?(@algorithm)
+            @public_key = ec_key(Algorithms.ECDSAP256SHA256 == @algorithm ? 'prime256v1' : 'secp384r1')
           end
         end
         #  @TODO@ Support other key encodings!
@@ -377,6 +379,22 @@ module Dnsruby
 
         pkey
       end
+
+      # RFC6605, section 4
+      # ECDSA public keys consist of a single value, called "Q" in FIPS
+      # 186-3.  In DNSSEC keys, Q is a simple bit string that represents the
+      # uncompressed form of a curve point, "x | y".
+      def ec_key(curve = 'prime256v1')
+        group = OpenSSL::PKey::EC::Group.new(curve)
+        pkey = OpenSSL::PKey::EC.new(group)
+
+        # DNSSEC pub does not have first octet that determines whether it's uncompressed
+        # or compressed form, but it's required by OpenSSL to parse EC point correctly
+        point_from_pub = "\x04" + @key.to_s # octet string, \x04 prefix determines uncompressed
+        pkey.public_key = OpenSSL::PKey::EC::Point.new(group, point_from_pub)
+
+        pkey
+      end
     end
   end
 end

data/lib/dnsruby/single_verifier.rb

@@ -800,6 +800,19 @@ module Dnsruby
 
         asn1 = OpenSSL::ASN1::Sequence.new([r_asn1, s_asn1]).to_der
         verified = keyrec.public_key.verify(OpenSSL::Digest::DSS1.new, asn1, sig_data)
+      elsif [Algorithms.ECDSAP256SHA256, Algorithms.ECDSAP384SHA384].include?(sigrec.algorithm)
+        byte_size = (keyrec.public_key.group.degree + 7) / 8
+        sig_bytes = sigrec.signature[0..(byte_size - 1)]
+        sig_char = sigrec.signature[byte_size..-1] || ''
+        asn1 = OpenSSL::ASN1::Sequence.new([sig_bytes, sig_char].map { |int| OpenSSL::ASN1::Integer.new(OpenSSL::BN.new(int, 2)) }).to_der
+
+        digest_obj = if sigrec.algorithm == Algorithms.ECDSAP384SHA384
+                       OpenSSL::Digest::SHA384.new
+                     else
+                       OpenSSL::Digest::SHA256.new
+                     end
+
+        verified = keyrec.public_key.dsa_verify_asn1(digest_obj.digest(sig_data), asn1)
       else
         raise RuntimeError.new("Algorithm #{sigrec.algorithm.code} unsupported by Dnsruby")
       end

data/lib/dnsruby/validator_thread.rb

@@ -1,12 +1,12 @@
 # --
 # Copyright 2007 Nominet UK
-# 
+#
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
-# 
+#
 #     http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -109,7 +109,7 @@ module Dnsruby
           return true
         rescue VerifyError => e
           response.security_error = e
-          response.security_level = BOGUS
+          response.security_level = Message::SecurityLevel.BOGUS
           #  Response security_level should already be set
           return false
         end

data/lib/dnsruby/version.rb

@@ -1,3 +1,3 @@
 module Dnsruby
-  VERSION = '1.61.3'
+  VERSION = '1.61.4'
 end

data/test/tc_caa.rb

@@ -16,7 +16,6 @@
 # ++
 
 require_relative 'spec_helper'
-require 'pry'
 
 class TestCAA < Minitest::Test
 

data/test/tc_dnskey.rb

@@ -85,4 +85,33 @@ class DnskeyTest < Minitest::Test
     dnskey.protocol=3
 
   end
+
+  def test_ecdsa_integrity
+    ecdsa_256_pub = 'example.com. 3600 IN DNSKEY 256 3 13 ( oJMRESz5E4gYzS/q6XD' +
+    'rvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x8fGAa2XhSA== )'
+
+    dnskey = Dnsruby::RR.create(ecdsa_256_pub)
+    assert_equal(3, dnskey.protocol)
+    assert_equal(256, dnskey.flags)
+    assert_equal(Dnsruby::Algorithms::ECDSAP256SHA256, dnskey.algorithm)
+    assert_equal(Dnsruby::RR::DNSKEY::ZONE_KEY, dnskey.flags & Dnsruby::RR::DNSKEY::ZONE_KEY)
+    assert_equal(0, dnskey.flags & Dnsruby::RR::DNSKEY::SEP_KEY)
+
+    dnskey2 = Dnsruby::RR.create(dnskey.to_s)
+    assert(dnskey2.to_s == dnskey.to_s, "#{dnskey} not equal to \n#{dnskey2}")
+
+    ecdsa_384_pub = 'example.com. 3600 IN DNSKEY 256 3 14 ( Bl2HDw98sGin4lNlx7n' +
+    'QX3w98jx6UhAgC73Jq+6LFlD12gnVTMHecM8Z GoTFSh+mV+qEPFZ5s3NbC4qvwUW0kkPb+0ip' +
+    'CuLRwZYhYKk7D+RDb+fX XozI9hhZrsXBcEhss )'
+
+    dnskey = Dnsruby::RR.create(ecdsa_384_pub)
+    assert_equal(3, dnskey.protocol)
+    assert_equal(256, dnskey.flags)
+    assert_equal(Dnsruby::Algorithms::ECDSAP384SHA384, dnskey.algorithm)
+    assert_equal(Dnsruby::RR::DNSKEY::ZONE_KEY, dnskey.flags & Dnsruby::RR::DNSKEY::ZONE_KEY)
+    assert_equal(0, dnskey.flags & Dnsruby::RR::DNSKEY::SEP_KEY)
+
+    dnskey2 = Dnsruby::RR.create(dnskey.to_s)
+    assert(dnskey2.to_s == dnskey.to_s, "#{dnskey} not equal to \n#{dnskey2}")
+  end
 end

data/test/tc_name.rb

@@ -80,4 +80,23 @@ class TestName < Minitest::Test
     n2 = Name.create("nall.all.")
     assert(n1 == n2, n1.to_s)
   end
+
+  def test_punycode
+    [
+      [
+        "møllerriis.com",
+        "xn--mllerriis-l8a.com"
+      ],
+      [
+        "フガフガ。hogehoge.エグザンプル.JP",
+        "xn--mcka5jb.hogehoge.xn--ickqs6k2dyb.jp"
+      ],
+      [
+        "フガ#フガ。hogehoge.エグザンプル.JP",
+        "xn--#-yeub5nc.hogehoge.xn--ickqs6k2dyb.jp"
+      ]
+    ].each do |tc|
+      assert_equal(Dnsruby::Name.create(tc[0]).to_s, tc[1])
+    end
+  end
 end

data/test/tc_verifier.rb

@@ -31,6 +31,7 @@ class VerifierTest < Minitest::Test
       do_test_sha256
       do_test_sha512
       do_test_nsec
+      do_test_ecdsa256
     else
       print "OpenSSL doesn't support SHA2 - disabling SHA256/SHA512 tests. DNSSEC validation will not work with these type of signatures.\n"
     end
@@ -70,6 +71,20 @@ class VerifierTest < Minitest::Test
     verifier.verify_rrset(rrset, key512)
   end
 
+  def do_test_ecdsa256
+    Time.stub :now, Time.parse("Wed, 01 Jul 2020 11:54:04 EEST +03:00") do
+      ecdsa256 = Dnsruby::RR.create("rainiselevi.ee.	3600	IN	DNSKEY	256 3 ECDSAP256SHA256 ( oJMRESz5E
+        4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x8fGAa2XhSA== ) ; key_tag=34505")
+      a = Dnsruby::RR.create("rainiselevi.ee.	3600	IN	A	35.228.30.236")
+      sig = Dnsruby::RR.create("rainiselevi.ee.	3600	IN	RRSIG	A ECDSAP256SHA256 2 300 20200702092142 ( 20200630072142 34505
+         rainiselevi.ee. kf3Fl1mSIso2kB12QOr+aNWYTUXtx9nRC/v+Kn1454u9I/YAFQd6nJQAsFd9vCTsZY+nL4wpj5pV+EsAMIxccA== )")
+      rrset = Dnsruby::RRSet.new(a)
+      rrset.add(sig)
+      verifier = Dnsruby::SingleVerifier.new(nil)
+      assert(verifier.verify_rrset(rrset, ecdsa256))
+    end
+  end
+
   def test_se_query
     #  Run some queries on the .se zone
     Dnsruby::Dnssec.clear_trusted_keys

metadata

@@ -1,63 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: dnsruby
 version: !ruby/object:Gem::Version
-  version: 1.61.3
+  version: 1.61.4
 platform: ruby
 authors:
 - Alex Dalitz
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-08-15 00:00:00.000000000 Z
+date: 2020-08-05 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: pry
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.10'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.10'
-- !ruby/object:Gem::Dependency
-  name: pry-byebug
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '10'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 10.3.2
+        version: 12.3.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '10'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 10.3.2
+        version: 12.3.3
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
@@ -114,6 +80,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.3.0
+- !ruby/object:Gem::Dependency
+  name: yard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
 - !ruby/object:Gem::Dependency
   name: coveralls
   requirement: !ruby/object:Gem::Requirement
@@ -129,19 +109,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0.7'
 - !ruby/object:Gem::Dependency
-  name: addressable
+  name: simpleidn
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.5'
+        version: '0.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.5'
+        version: '0.1'
 description: |-
   Dnsruby is a pure Ruby DNS client library which implements a
   stub resolver. It aims to comply with all DNS RFCs, including
@@ -158,6 +138,7 @@ files:
 - ".coveralls.yml"
 - ".gitignore"
 - ".travis.yml"
+- ".yardopts"
 - DNSSEC
 - EVENTMACHINE
 - EXAMPLES
@@ -329,7 +310,13 @@ files:
 homepage: https://github.com/alexdalitz/dnsruby
 licenses:
 - Apache License, Version 2.0
-metadata: {}
+metadata:
+  yard.run: yard
+  bug_tracker_uri: https://github.com/alexdalitz/dnsruby/issues
+  changelog_uri: https://github.com/alexdalitz/dnsruby/blob/master/RELEASE_NOTES.md
+  documentation_uri: https://www.rubydoc.info/gems/dnsruby/
+  homepage_uri: https://github.com/alexdalitz/dnsruby
+  source_code_uri: https://github.com/alexdalitz/dnsruby
 post_install_message: |-
   Installing dnsruby...
     For issues and source code: https://github.com/alexdalitz/dnsruby
@@ -348,8 +335,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: Ruby DNS(SEC) implementation
 test_files: