@nictool/dns-resource-record 1.4.0 → 1.6.0

package/rr/smimea.js

@@ -58,6 +58,10 @@ export default class SMIMEA extends RR {
     return 'S/MIME cert association'
   }
 
+  getTags() {
+    return ['security']
+  }
+
   getRdataFields(arg) {
     return ['certificate usage', 'selector', 'matching type', 'certificate association data']
   }
@@ -70,15 +74,28 @@ export default class SMIMEA extends RR {
     return 53
   }
 
+  getCanonical() {
+    return {
+      owner: '_443._tcp.www.example.com.',
+      ttl: 3600,
+      class: 'IN',
+      type: 'SMIMEA',
+      'certificate usage': 0,
+      selector: 0,
+      'matching type': 1,
+      'certificate association data': 'ABCDEF...',
+    }
+  }
+
   getQuotedFields() {
     return []
   }
 
   /******  IMPORTERS   *******/
 
-  fromBind(opts) {
+  fromBind({ bindline }) {
     // test.example.com  3600  IN  SMIMEA, usage, selector, match, data
-    const [owner, ttl, c, type, usage, selector, match] = opts.bindline.split(/\s+/)
+    const [owner, ttl, c, type, usage, selector, match] = bindline.split(/\s+/)
     return new SMIMEA({
       owner,
       ttl: parseInt(ttl, 10),
@@ -87,12 +104,12 @@ export default class SMIMEA extends RR {
       'certificate usage': parseInt(usage, 10),
       selector: parseInt(selector, 10),
       'matching type': parseInt(match, 10),
-      'certificate association data': opts.bindline.split(/\s+/).slice(7).join(' ').trim(),
+      'certificate association data': bindline.split(/\s+/).slice(7).join(' ').trim(),
     })
   }
 
-  fromTinydns(opts) {
-    const [owner, _typeId, rdata, ttl, ts, loc] = opts.tinyline.substring(1).split(':')
+  fromTinydns({ tinyline }) {
+    const [owner, _typeId, rdata, ttl, ts, loc] = tinyline.slice(1).split(':')
     const binaryRdata = Buffer.from(TINYDNS.octalToChar(rdata), 'binary')
 
     return new SMIMEA({
@@ -104,7 +121,7 @@ export default class SMIMEA extends RR {
       'matching type': binaryRdata.readUInt8(2),
       'certificate association data': binaryRdata.slice(3).toString(),
       timestamp: ts,
-      location: loc !== '' && loc !== '\n' ? loc : '',
+      location: loc?.trim() ?? '',
     })
   }
 

package/rr/soa.js

@@ -83,11 +83,27 @@ export default class SOA extends RR {
     return 6
   }
 
+  getCanonical() {
+    return {
+      owner: 'example.com.',
+      ttl: 3600,
+      class: 'IN',
+      type: 'SOA',
+      mname: 'ns1.example.com.',
+      rname: 'admin.example.com.',
+      serial: 2023051001,
+      refresh: 7200,
+      retry: 3600,
+      expire: 1209600,
+      minimum: 3600,
+    }
+  }
+
   /******  IMPORTERS   *******/
-  fromBind(opts) {
+  fromBind({ bindline }) {
     // example.com TTL IN  SOA mname rname serial refresh retry expire minimum
     const [owner, ttl, c, type, mname, rname, serial, refresh, retry, expire, minimum] =
-      opts.bindline.split(/[\s+]/)
+      bindline.split(/[\s+]/)
 
     return new SOA({
       owner,
@@ -104,9 +120,9 @@ export default class SOA extends RR {
     })
   }
 
-  fromTinydns(opts) {
+  fromTinydns({ tinyline }) {
     // Zfqdn:mname:rname:ser:ref:ret:exp:min:ttl:time:lo
-    const [fqdn, mname, rname, ser, ref, ret, exp, min, ttl, ts, loc] = opts.tinyline.substring(1).split(':')
+    const [fqdn, mname, rname, ser, ref, ret, exp, min, ttl, ts, loc] = tinyline.slice(1).split(':')
 
     return new SOA({
       owner: this.fullyQualify(fqdn),
@@ -114,13 +130,13 @@ export default class SOA extends RR {
       type: 'SOA',
       mname: this.fullyQualify(mname),
       rname: this.fullyQualify(rname),
-      serial: parseInt(ser || opts.default?.serial, 10),
+      serial: parseInt(ser ?? this.default?.serial, 10),
       refresh: parseInt(ref, 10) || 16384,
       retry: parseInt(ret, 10) || 2048,
       expire: parseInt(exp, 10) || 1048576,
       minimum: parseInt(min, 10) || 2560,
       timestamp: parseInt(ts) || '',
-      location: loc !== '' && loc !== '\n' ? loc : '',
+      location: loc?.trim() ?? '',
     })
   }
 
@@ -136,6 +152,20 @@ export default class SOA extends RR {
       .join('\t')} ~\n`
   }
 
+  getWireRdata() {
+    const nums = Buffer.alloc(20)
+    nums.writeUInt32BE(this.get('serial'), 0)
+    nums.writeUInt32BE(this.get('refresh'), 4)
+    nums.writeUInt32BE(this.get('retry'), 8)
+    nums.writeUInt32BE(this.get('expire'), 12)
+    nums.writeUInt32BE(this.get('minimum'), 16)
+    return Buffer.concat([
+      this.wirePackDomain(this.get('mname')),
+      this.wirePackDomain(this.get('rname')),
+      nums,
+    ])
+  }
+
   toTinydns() {
     return `Z${this.getTinyFQDN('owner')}:${this.getTinyFQDN('mname')}:${this.getTinyFQDN('rname')}:${this.getEmpty('serial')}:${this.getEmpty('refresh')}:${this.getEmpty('retry')}:${this.getEmpty('expire')}:${this.getEmpty('minimum')}:${this.getTinydnsPostamble()}\n`
   }

package/rr/spf.js

@@ -18,6 +18,10 @@ export default class SPF extends TXT {
     return 'Sender Policy Framework'
   }
 
+  getTags() {
+    return ['deprecated']
+  }
+
   getRdataFields(arg) {
     return ['data']
   }
@@ -30,10 +34,20 @@ export default class SPF extends TXT {
     return 99
   }
 
+  getCanonical() {
+    return {
+      owner: 'example.com.',
+      ttl: 3600,
+      class: 'IN',
+      type: 'SPF',
+      data: 'v=spf1 mx -all',
+    }
+  }
+
   /******  IMPORTERS   *******/
-  fromTinydns(opts) {
+  fromTinydns({ tinyline }) {
     // SPF via generic, :fqdn:n:rdata:ttl:timestamp:lo
-    const [fqdn, n, rdata, ttl, ts, loc] = opts.tinyline.substring(1).split(':')
+    const [fqdn, n, rdata, ttl, ts, loc] = tinyline.slice(1).split(':')
     if (n != 99) this.throwHelp('SPF fromTinydns, invalid n')
 
     return new SPF({
@@ -42,7 +56,7 @@ export default class SPF extends TXT {
       data: TINYDNS.octalToChar(rdata),
       ttl: parseInt(ttl, 10),
       timestamp: ts,
-      location: loc !== '' && loc !== '\n' ? loc : '',
+      location: loc?.trim() ?? '',
     })
   }
 

package/rr/srv.js

@@ -41,6 +41,10 @@ export default class SRV extends RR {
     return 'Service'
   }
 
+  getTags() {
+    return ['common']
+  }
+
   getRdataFields(arg) {
     return ['priority', 'weight', 'port', 'target']
   }
@@ -53,23 +57,36 @@ export default class SRV extends RR {
     return 33
   }
 
+  getCanonical() {
+    return {
+      owner: '_imaps._tcp.example.com.',
+      ttl: 3600,
+      class: 'IN',
+      type: 'SRV',
+      priority: 10,
+      weight: 10,
+      port: 993,
+      target: 'mail.example.com.',
+    }
+  }
+
   /******  IMPORTERS   *******/
-  fromTinydns(opts) {
-    const str = opts.tinyline
+  fromTinydns({ tinyline }) {
+    const str = tinyline
     let fqdn, addr, port, pri, weight, ttl, ts, loc, n, rdata
 
     if (str[0] === 'S') {
       // patched tinydns with S records
-      ;[fqdn, addr, port, pri, weight, ttl, ts, loc] = str.substring(1).split(':')
+      ;[fqdn, addr, port, pri, weight, ttl, ts, loc] = str.slice(1).split(':')
     } else {
       // tinydns generic record format
-      ;[fqdn, n, rdata, ttl, ts, loc] = str.substring(1).split(':')
+      ;[fqdn, n, rdata, ttl, ts, loc] = str.slice(1).split(':')
       if (n != 33) this.throwHelp('SRV fromTinydns: invalid n')
 
-      pri = TINYDNS.octalToUInt16(rdata.substring(0, 8))
-      weight = TINYDNS.octalToUInt16(rdata.substring(8, 16))
-      port = TINYDNS.octalToUInt16(rdata.substring(16, 24))
-      addr = TINYDNS.unpackDomainName(rdata.substring(24))[0]
+      pri = TINYDNS.octalToUInt16(rdata.slice(0, 8))
+      weight = TINYDNS.octalToUInt16(rdata.slice(8, 16))
+      port = TINYDNS.octalToUInt16(rdata.slice(16, 24))
+      addr = TINYDNS.unpackDomainName(rdata.slice(24))[0]
     }
 
     return new SRV({
@@ -81,13 +98,13 @@ export default class SRV extends RR {
       port: parseInt(port, 10),
       target: this.fullyQualify(addr),
       timestamp: ts,
-      location: loc !== '' && loc !== '\n' ? loc : '',
+      location: loc?.trim() ?? '',
     })
   }
 
-  fromBind(opts) {
+  fromBind({ bindline }) {
     // test.example.com  3600  IN  SRV Priority Weight Port Target
-    const [owner, ttl, c, type, pri, weight, port, target] = opts.bindline.split(/\s+/)
+    const [owner, ttl, c, type, pri, weight, port, target] = bindline.split(/\s+/)
     return new SRV({
       owner: owner,
       ttl: parseInt(ttl, 10),

package/rr/sshfp.js

@@ -46,6 +46,10 @@ export default class SSHFP extends RR {
     return 'Secure Shell Key Fingerprints'
   }
 
+  getTags() {
+    return ['security']
+  }
+
   getRdataFields() {
     return ['algorithm', 'fptype', 'fingerprint']
   }
@@ -58,27 +62,39 @@ export default class SSHFP extends RR {
     return 44
   }
 
+  getCanonical() {
+    return {
+      owner: 'mail.example.com.',
+      ttl: 3600,
+      class: 'IN',
+      type: 'SSHFP',
+      algorithm: 2,
+      fptype: 1,
+      fingerprint: '123456789abcdef6789abcdf6789abdf6789abcd',
+    }
+  }
+
   /******  IMPORTERS   *******/
-  fromTinydns(opts) {
+  fromTinydns({ tinyline }) {
     // SSHFP via generic, :fqdn:n:rdata:ttl:timestamp:lo
-    const [fqdn, n, rdata, ttl, ts, loc] = opts.tinyline.substring(1).split(':')
+    const [fqdn, n, rdata, ttl, ts, loc] = tinyline.slice(1).split(':')
     if (n != 44) this.throwHelp('SSHFP fromTinydns, invalid n')
 
     return new SSHFP({
       owner: this.fullyQualify(fqdn),
       ttl: parseInt(ttl, 10),
       type: 'SSHFP',
-      algorithm: TINYDNS.octalToUInt8(rdata.substring(0, 4)),
-      fptype: TINYDNS.octalToUInt8(rdata.substring(4, 8)),
-      fingerprint: TINYDNS.octalToHex(rdata.substring(8)),
+      algorithm: TINYDNS.octalToUInt8(rdata.slice(0, 4)),
+      fptype: TINYDNS.octalToUInt8(rdata.slice(4, 8)),
+      fingerprint: TINYDNS.octalToHex(rdata.slice(8)),
       timestamp: ts,
-      location: loc !== '' && loc !== '\n' ? loc : '',
+      location: loc?.trim() ?? '',
     })
   }
 
-  fromBind(opts) {
+  fromBind({ bindline }) {
     // test.example.com  3600  IN  SSHFP  algo fptype fp
-    const [owner, ttl, c, type, algo, fptype, fp] = opts.bindline.split(/\s+/)
+    const [owner, ttl, c, type, algo, fptype, fp] = bindline.split(/\s+/)
     return new SSHFP({
       owner,
       ttl: parseInt(ttl, 10),

package/rr/svcb.js

@@ -44,13 +44,25 @@ export default class SVCB extends RR {
     return 64
   }
 
+  getCanonical() {
+    return {
+      owner: '_8443._foo.api.example.com.',
+      ttl: 3600,
+      class: 'IN',
+      type: 'SVCB',
+      priority: 1,
+      'target name': 'svc4.example.net.',
+      params: 'alpn="h2,h3"',
+    }
+  }
+
   /******  IMPORTERS   *******/
 
-  fromBind(opts) {
+  fromBind({ bindline }) {
     // test.example.com  3600  IN  SVCB Priority TargetName Params
     // _8443._foo.api.example.com. 7200 IN SVCB 0 svc4.example.net.
     // svc4.example.net.  7200  IN SVCB 3 svc4.example.net. ( alpn="bar" port="8004" )
-    const [owner, ttl, c, type, pri, fqdn] = opts.bindline.split(/\s+/)
+    const [owner, ttl, c, type, pri, fqdn] = bindline.split(/\s+/)
     return new SVCB({
       owner,
       ttl: parseInt(ttl, 10),
@@ -58,22 +70,35 @@ export default class SVCB extends RR {
       type,
       priority: parseInt(pri, 10),
       'target name': fqdn,
-      params: opts.bindline.split(/\s+/).slice(6).join(' ').trim(),
+      params: bindline.split(/\s+/).slice(6).join(' ').trim(),
     })
   }
 
-  fromTinydns({ rd, owner, ttl }) {
+  fromTinydns({ tinyline }) {
+    const [owner, _typeId, rd, ttl, ts, loc] = tinyline.slice(1).split(':')
+
     if (rd.length < 6) {
       this.throwHelp(`SVCB: RDATA too short: ${rd}`)
     }
 
-    const priority = TINYDNS.octalToUInt16(rd.substring(0, 6))
-    const remainingRdata = rd.slice(6)
+    // Convert escaped octal RDATA into a binary buffer for reliable parsing
+    const binary = Buffer.from(TINYDNS.octalToChar(rd), 'binary')
 
-    const [targetName, consumedLength] = TINYDNS.unpackDomainName(remainingRdata)
+    const priority = binary.readUInt16BE(0)
 
-    const params = remainingRdata.slice(consumedLength)
-    const unescapedParams = TINYDNS.unescapeOctal(params)
+    // parse domain name from binary starting at offset 2
+    let pos = 2
+    const labels = []
+    while (true) {
+      const len = binary.readUInt8(pos)
+      pos += 1
+      if (len === 0) break
+      labels.push(binary.slice(pos, pos + len).toString())
+      pos += len
+    }
+    const targetName = `${labels.join('.')}.`
+    // remaining params are ASCII text after the domain
+    const params = binary.slice(pos).toString()
 
     return new SVCB({
       owner: this.fullyQualify(owner),
@@ -81,7 +106,9 @@ export default class SVCB extends RR {
       type: 'SVCB',
       priority: priority,
       'target name': targetName,
-      params: unescapedParams,
+      params: params,
+      timestamp: ts,
+      location: loc?.trim() ?? '',
     })
   }
 

package/rr/tlsa.js

@@ -58,30 +58,47 @@ export default class TLSA extends RR {
     return 'TLSA certificate association'
   }
 
+  getTags() {
+    return ['security']
+  }
+
   getRdataFields(arg) {
     return ['certificate usage', 'selector', 'matching type', 'certificate association data']
   }
 
   getRFCs() {
-    return [6698]
+    return [6698, 7671]
   }
 
   getTypeId() {
     return 52
   }
 
+  getCanonical() {
+    return {
+      owner: '_443._tcp.www.example.com.',
+      ttl: 3600,
+      class: 'IN',
+      type: 'TLSA',
+      'certificate usage': 3,
+      selector: 1,
+      'matching type': 1,
+      'certificate association data': 'ABCDEF...',
+    }
+  }
+
   getQuotedFields() {
     return []
   }
 
   /******  IMPORTERS   *******/
 
-  fromBind(opts) {
+  fromBind({ bindline }) {
     // test.example.com  3600  IN  TLSA, usage, selector, match, data
     const regex =
-      /^(?<owner>\S+)\s+(?<ttl>\d{1,10})\s+(?<cls>IN)\s+(?<type>TLSA)\s+(?<usage>\d+)\s+(?<selector>\d+)\s+(?<matchtype>\d+)\s+(?<cad>.+)$/i
-    const match = opts.bindline.trim().match(regex)
-    if (!match) this.throwHelp(`unable to parse TLSA: ${opts.bindline}`)
+      /^(?<owner>\S+)\s+(?<ttl>\d{1,10})\s+(?<cls>IN)\s+(?<type>TLSA)\s+(?<usage>\d+)\s+(?<selector>\d+)\s+(?<matchtype>\d+)\s+(?<cad>\S.*)$/i
+    const match = bindline.trim().match(regex)
+    if (!match) this.throwHelp(`unable to parse TLSA: ${bindline}`)
     const { owner, ttl, cls, type, usage, selector, matchtype, cad } = match.groups
 
     return new TLSA({
@@ -92,12 +109,12 @@ export default class TLSA extends RR {
       'certificate usage': parseInt(usage, 10),
       selector: parseInt(selector, 10),
       'matching type': parseInt(matchtype, 10),
-      'certificate association data': cad,
+      'certificate association data': cad.trim(),
     })
   }
 
-  fromTinydns(opts) {
-    const [fqdn, n, rdata, ttl, ts, loc] = opts.tinyline.substring(1).split(':')
+  fromTinydns({ tinyline }) {
+    const [fqdn, n, rdata, ttl, ts, loc] = tinyline.slice(1).split(':')
     if (n != 52) this.throwHelp('TLSA fromTinydns, invalid n')
 
     const bytes = Buffer.from(TINYDNS.octalToChar(rdata), 'binary')
@@ -111,7 +128,7 @@ export default class TLSA extends RR {
       'matching type': bytes.readUInt8(2),
       'certificate association data': bytes.slice(3).toString(),
       timestamp: ts,
-      location: loc.trim() || '',
+      location: loc?.trim() ?? '',
     })
   }
 

package/rr/tsig.js

@@ -1,4 +1,5 @@
 import RR from '../rr.js'
+import * as TINYDNS from '../lib/tinydns.js'
 
 export default class TSIG extends RR {
   constructor(opts) {
@@ -17,32 +18,173 @@ export default class TSIG extends RR {
   }
 
   getRFCs() {
-    return [2845]
+    return [2845, 8945]
   }
 
   getTypeId() {
     return 250
   }
 
+  getCanonical() {
+    return {
+      owner: 'test.example.',
+      ttl: 0,
+      class: 'ANY',
+      type: 'TSIG',
+      'algorithm name': 'hmac-sha256.',
+      'time signed': 1620650000,
+      fudge: 300,
+      mac: 'ABCDEF...',
+      'original id': 12345,
+      error: 0,
+      other: '',
+    }
+  }
+
+  setClass(t) {
+    if (t !== 'ANY') this.throwHelp('TSIG: Class is required to be ANY')
+    this.set('class', t)
+  }
+
+  setTtl(t) {
+    if (t !== 0) this.throwHelp('TSIG: TTL is required to be 0')
+    this.set('ttl', t)
+  }
+
+  setAlgorithmName(val) {
+    if (!val) this.throwHelp(`TSIG: 'algorithm name' is required`)
+    this.set('algorithm name', val)
+  }
+
+  setTimeSigned(val) {
+    // a 48-bit unsigned integer, as seconds since the UNIX epoch
+    if (val === undefined) this.throwHelp(`TSIG: 'time signed' is required`)
+    this.set('time signed', val)
+  }
+
+  setFudge(val) {
+    // 16-bit unsigned
+    this.is16bitInt('TSIG', 'fudge', val)
+    this.set('fudge', val)
+  }
+
+  setMac(val) {
+    this.set('mac', val ?? '')
+  }
+
+  setOriginalId(val) {
+    this.is16bitInt('TSIG', 'original id', val)
+    this.set('original id', val)
+  }
+
+  setError(val) {
+    this.is16bitInt('TSIG', 'error', val)
+    this.set('error', val)
+  }
+
+  setOther(val) {
+    this.set('other', val ?? '')
+  }
+
   /******  IMPORTERS   *******/
 
-  fromBind(opts) {
-    // test.example.com  3600  IN  TSIG SAMPLE-ALG.EXAMPLE. 853804800 300 0 0 0
-    const [owner, ttl, c, type, algorithm] = opts.bindline.split(/\s+/)
+  fromBind({ bindline }) {
+    // owner ttl ANY TSIG alg time fudge mac_size mac original_id error other_len
+    const parts = bindline.trimEnd().split('\t')
+    const [owner, ttl, cls, type, alg, time, fudge, , mac, origId, error] = parts
+
     return new TSIG({
       owner,
       ttl: parseInt(ttl, 10),
-      class: c,
-      type: type,
-      algorithm: algorithm,
-      // 'time signed': opts.bindline,
-      // fudge
-      // mac
-      // original id
-      // error
-      // other
+      class: cls,
+      type: type.toUpperCase(),
+      'algorithm name': alg,
+      'time signed': parseInt(time, 10),
+      fudge: parseInt(fudge, 10),
+      mac: mac || '',
+      'original id': parseInt(origId, 10),
+      error: parseInt(error, 10),
+      other: '',
+    })
+  }
+
+  fromTinydns({ tinyline }) {
+    const [owner, _typeId, rdata, ttl, ts, loc] = tinyline.slice(1).split(':')
+
+    const algUnpacked = TINYDNS.unpackDomainName(rdata)
+    const algBinaryLen = algUnpacked[2]
+
+    const bytes = Buffer.from(TINYDNS.octalToChar(rdata), 'binary')
+    let bpos = algBinaryLen
+
+    const timeSigned = bytes.readUInt32BE(bpos)
+    bpos += 4
+    const fudge = bytes.readUInt16BE(bpos)
+    bpos += 2
+    const macSize = bytes.readUInt16BE(bpos)
+    bpos += 2
+    const mac = macSize > 0 ? bytes.slice(bpos, bpos + macSize).toString('hex') : ''
+    bpos += macSize
+    const originalId = bytes.readUInt16BE(bpos)
+    bpos += 2
+    const error = bytes.readUInt16BE(bpos)
+    bpos += 2
+    const other = bpos < bytes.length ? bytes.slice(bpos).toString() : ''
+
+    return new TSIG({
+      owner: this.fullyQualify(owner),
+      ttl: parseInt(ttl, 10),
+      class: 'ANY',
+      type: 'TSIG',
+      'algorithm name': algUnpacked[0],
+      'time signed': timeSigned,
+      fudge,
+      mac,
+      'original id': originalId,
+      error,
+      other,
+      timestamp: ts,
+      location: loc?.trim() ?? '',
     })
   }
 
   /******  EXPORTERS   *******/
+  toBind(zone_opts) {
+    const mac = this.get('mac') ?? ''
+    const macSize = mac.length > 0 ? mac.length : ''
+    const other = this.get('other') ?? ''
+    const otherLen = other.length > 0 ? other.length : 0
+    return (
+      [
+        this.getFQDN('owner', zone_opts),
+        this.get('ttl'),
+        this.get('class'),
+        this.get('type'),
+        this.get('algorithm name'),
+        this.get('time signed'),
+        this.get('fudge'),
+        macSize,
+        mac,
+        this.get('original id'),
+        this.get('error'),
+        otherLen,
+      ].join('\t') + '\n'
+    )
+  }
+
+  toTinydns() {
+    const dataRe = new RegExp(/[\r\n\t:\\/]/, 'g')
+    const alg = this.get('algorithm name') || ''
+
+    return this.getTinydnsGeneric(
+      TINYDNS.packDomainName(alg) +
+        TINYDNS.UInt32toOctal(this.get('time signed') ?? 0) +
+        TINYDNS.UInt16toOctal(this.get('fudge')) +
+        TINYDNS.UInt16toOctal(this.get('mac size') ?? 0) +
+        (this.get('mac size') > 0 ? TINYDNS.escapeOctal(dataRe, this.get('mac')) : '') +
+        TINYDNS.UInt16toOctal(this.get('original id') ?? 0) +
+        TINYDNS.UInt16toOctal(this.get('error') ?? 0) +
+        (this.get('other').length > 0 ? TINYDNS.escapeOctal(dataRe, this.get('other')) : ''),
+    )
+  }
 }