@nictool/dns-resource-record 1.7.0 → 1.8.0

package/lib/bind.js

@@ -61,15 +61,17 @@ export function fromBind(rrInstance, opts) {
   }
 
   const fields = rrInstance.getFields('rdata')
+  const rdataDefs = rrInstance.constructor.rdataFields ?? []
   for (let i = 0; i < fields.length; i++) {
     const isLastField = i === fields.length - 1
     if (isLastField && rrInstance.isQuotedField(fields[i])) {
       // Collect all remaining tokens for TXT/etc
-      const val = rdata
-        .slice(i)
-        .map((s) => s.replace(/^"|"$/g, ''))
-        .join('')
-      result[fields[i]] = val
+      const tokens = rdata.slice(i).map((s) => s.replace(/^"|"$/g, ''))
+      // For `charstrs` (TXT), preserve multi-string boundaries (RFC 1035 §3.3.14).
+      // For `qstr`/`qcharstr` (single character-string), join into one string.
+      const def = rdataDefs[i]
+      const fieldType = Array.isArray(def) ? def[1] : null
+      result[fields[i]] = fieldType === 'charstrs' && tokens.length > 1 ? tokens : tokens.join('')
       break
     }
 

package/lib/wire.js

@@ -15,29 +15,59 @@ export function encodeName(name) {
 /**
  * Read a (possibly pointer-compressed) DNS name from a packet.
  * Returns { bytes: Buffer (uncompressed wire name), end: offset after name }.
+ *
+ * Bounded to defend against malicious or truncated packets:
+ *   - rejects pointer cycles via a visited-offset set
+ *   - caps total pointer dereferences at 128
+ *   - caps the decoded name at 255 bytes (RFC 1035 §3.1)
+ *   - rejects truncated pointers, pointer targets past the packet end,
+ *     truncated labels, and unterminated names
  */
 export function readWireName(packet, offset) {
+  if (offset < 0 || offset >= packet.length) {
+    throw new Error('readWireName: offset out of bounds')
+  }
+
   const labels = []
+  const visited = new Set()
   let pos = offset
   let end = -1
+  let nameLen = 0
+  let terminated = false
 
   while (pos < packet.length) {
     const len = packet[pos]
     if (len === 0) {
       if (end === -1) end = pos + 1
       labels.push(Buffer.from([0]))
+      terminated = true
       break
     }
     if ((len & 0xc0) === 0xc0) {
+      if (pos + 1 >= packet.length) throw new Error('readWireName: truncated pointer')
       if (end === -1) end = pos + 2
-      pos = ((len & 0x3f) << 8) | packet[pos + 1]
+      if (visited.has(pos)) throw new Error('readWireName: pointer cycle detected')
+      visited.add(pos)
+      if (visited.size > 128) throw new Error('readWireName: pointer chain too long')
+      const target = ((len & 0x3f) << 8) | packet[pos + 1]
+      if (target >= packet.length) throw new Error('readWireName: pointer target out of bounds')
+      pos = target
       continue
     }
+    // Top two bits not 00 → reserved (RFC 1035 §4.1.4 / RFC 6891)
+    if ((len & 0xc0) !== 0) throw new Error('readWireName: reserved label type')
+    if (len > 63) throw new Error('readWireName: label exceeds 63 bytes')
+    if (pos + 1 + len > packet.length) throw new Error('readWireName: truncated label')
     const label = packet.slice(pos, pos + 1 + len)
     labels.push(label)
+    // RFC 1035 §3.1: octets of the full domain name (labels + length octets +
+    // final zero) MUST NOT exceed 255 — count the root terminator too.
+    nameLen += 1 + len
+    if (nameLen + 1 > 255) throw new Error('readWireName: name exceeds 255 bytes')
     pos += 1 + len
   }
 
+  if (!terminated) throw new Error('readWireName: unterminated name')
   return { bytes: Buffer.concat(labels), end }
 }
 
@@ -207,6 +237,81 @@ export function wirePackDomain(fqdn) {
   return buf
 }
 
+/**
+ * Pack a fully qualified domain name into wire format with RFC 1035 §4.1.4
+ * name compression. `dict` is a `Map<suffix, offset>` shared across all names
+ * emitted into a single outbound message; `currentOffset` is the absolute
+ * offset at which the caller intends to place the returned bytes.
+ *
+ * Walks labels from longest suffix to shortest: when a suffix already has an
+ * offset in `dict`, emits a 2-byte pointer and stops; otherwise emits the label
+ * verbatim and records the new suffix offset for later reuse.
+ */
+export function wirePackDomainCompressed(fqdn, dict, currentOffset) {
+  if (fqdn === '.') return new Uint8Array([0])
+  const enc = new TextEncoder()
+  const labels = fqdn
+    .split('.')
+    .filter((p) => p.length > 0)
+    .map((p) => {
+      const b = enc.encode(p)
+      if (b.length > 63) throw new Error(`DNS label exceeds 63 bytes: ${p}`)
+      return b
+    })
+
+  // Pre-compute the absolute write offset of each label and the suffix it begins.
+  const suffixes = []
+  let prefixBytes = 0
+  for (let i = 0; i < labels.length; i++) {
+    suffixes.push({
+      key:
+        labels
+          .slice(i)
+          .map((b) => new TextDecoder().decode(b))
+          .join('.') + '.',
+      writeOffset: currentOffset + prefixBytes,
+    })
+    prefixBytes += 1 + labels[i].length
+  }
+
+  // Find the longest existing suffix in the dict; everything to its right gets
+  // replaced by a single pointer.
+  let pointerAt = labels.length
+  let pointerOffset = -1
+  for (let i = 0; i < suffixes.length; i++) {
+    const hit = dict.get(suffixes[i].key)
+    if (hit !== undefined && hit < 0x4000) {
+      pointerAt = i
+      pointerOffset = hit
+      break
+    }
+  }
+
+  // Compute output size and allocate.
+  let outSize = 0
+  for (let i = 0; i < pointerAt; i++) outSize += 1 + labels[i].length
+  outSize += pointerAt < labels.length ? 2 : 1 // pointer (2 bytes) or root terminator (1)
+  const buf = new Uint8Array(outSize)
+
+  let off = 0
+  for (let i = 0; i < pointerAt; i++) {
+    // Record this suffix for future reuse before writing past it.
+    if (suffixes[i].writeOffset < 0x4000 && !dict.has(suffixes[i].key)) {
+      dict.set(suffixes[i].key, suffixes[i].writeOffset)
+    }
+    buf[off++] = labels[i].length
+    buf.set(labels[i], off)
+    off += labels[i].length
+  }
+  if (pointerAt < labels.length) {
+    buf[off++] = 0xc0 | ((pointerOffset >> 8) & 0x3f)
+    buf[off] = pointerOffset & 0xff
+  } else {
+    buf[off] = 0
+  }
+  return buf
+}
+
 /**
  * Get wire format rdata for an RR instance.
  * Derived classes should override this with direct RFC 1035 wire encoding.
@@ -332,13 +437,18 @@ export function fromWireGeneric(rrInstance, { owner, cls, ttl, rdata }) {
         break
       }
       case 'charstrs': {
+        // RFC 1035 §3.3.14: each <character-string> on the wire is len-prefixed.
+        // Preserve multi-string boundaries by returning an array when >1.
         const parts = []
         while (pos < rdata.length) {
           const strLen = rdata[pos++]
+          if (pos + strLen > rdata.length) {
+            throw new Error('fromWireGeneric: truncated character-string in rdata')
+          }
           parts.push(new TextDecoder().decode(rdata.subarray(pos, pos + strLen)))
           pos += strLen
         }
-        result[fieldName] = parts.join('')
+        result[fieldName] = parts.length > 1 ? parts : (parts[0] ?? '')
         break
       }
       case 'svcparams':

package/package.json

@@ -1,11 +1,13 @@
 {
   "name": "@nictool/dns-resource-record",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "DNS Resource Records",
   "main": "index.js",
   "exports": {
     ".": {
       "browser": "./dist/dns-rr.min.js",
+      "import": "./index.js",
+      "require": "./dist/dns-rr.cjs",
       "default": "./index.js"
     }
   },
@@ -18,8 +20,9 @@
   ],
   "type": "module",
   "scripts": {
-    "build": "npm run build:browser",
+    "build": "npm run build:browser && npm run build:cjs",
     "build:browser": "npx rollup -i index.js -o dist/dns-rr.js -f es && esbuild dist/dns-rr.js --minify --sourcemap --outfile=dist/dns-rr.min.js && rm dist/dns-rr.js",
+    "build:cjs": "npx rollup -i index.js -o dist/dns-rr.cjs -f cjs --exports named",
     "clean": "rm -rf coverage dist node_modules package-lock.json",
     "format:check": "npm run prettier; npm run lint",
     "format": "npm run prettier -- --write && npm run lint:fix",
@@ -58,7 +61,7 @@
   },
   "homepage": "https://github.com/NicTool/dns-resource-record#readme",
   "engines": {
-    "node": ">=22"
+    "node": ">=20"
   },
   "browserslist": [
     "chrome >= 74",
@@ -68,8 +71,8 @@
   ],
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "eslint": "^10.2.1",
-    "globals": "^17.5.0"
+    "eslint": "^10.4.0",
+    "globals": "^17.6.0"
   },
   "prettier": {
     "printWidth": 110,

package/rr/cert.js

@@ -58,6 +58,14 @@ export default class CERT extends RR {
     this.throwHelp(`CERT: unknown cert type mnemonic: ${val}`)
   }
 
+  setKeyTag(val) {
+    this.setTypedValue('u16', 'key tag', val)
+  }
+
+  setAlgorithm(val) {
+    this.setTypedValue('u8', 'algorithm', val)
+  }
+
   setCertificate(val) {
     // certificate/CRL portion is represented in base 64 [16] and may be
     // divided into any number of white-space-separated substrings

package/rr/cname.js

@@ -12,6 +12,11 @@ export default class CNAME extends RR {
     super(opts)
   }
 
+  /****** Resource record specific setters   *******/
+  setCname(val) {
+    this.setTypedValue('fqdn', 'cname', val)
+  }
+
   getDescription() {
     return 'Canonical Name'
   }

package/rr/dname.js

@@ -11,6 +11,11 @@ export default class DNAME extends RR {
     super(opts)
   }
 
+  /****** Resource record specific setters   *******/
+  setTarget(val) {
+    this.setTypedValue('fqdn', 'target', val)
+  }
+
   getDescription() {
     return 'Delegation Name'
   }

package/rr/ds.js

@@ -15,6 +15,14 @@ export default class DS extends RR {
   }
 
   /****** Resource record specific setters   *******/
+  setKeyTag(val) {
+    this.setTypedValue('u16', 'key tag', val)
+  }
+
+  setDigest(val) {
+    this.setTypedValue('str', 'digest', val)
+  }
+
   setAlgorithm(val) {
     if (!this.getAlgorithmOptions().has(val)) this.throwHelp(`DS: algorithm invalid`)
 
@@ -22,19 +30,30 @@ export default class DS extends RR {
   }
 
   getAlgorithmOptions() {
+    // IANA DNSSEC Algorithm Numbers
+    // https://www.iana.org/assignments/dns-sec-alg-numbers/
     return new Map([
       [1, 'RSA/MD5'],
       [2, 'DH'],
       [3, 'DSA/SHA-1'],
       [4, 'EC'],
       [5, 'RSA/SHA-1'],
+      [6, 'DSA-NSEC3-SHA1'],
+      [7, 'RSASHA1-NSEC3-SHA1'],
+      [8, 'RSA/SHA-256'],
+      [10, 'RSA/SHA-512'],
+      [13, 'ECDSA P-256/SHA-256'],
+      [14, 'ECDSA P-384/SHA-384'],
+      [15, 'Ed25519'],
+      [16, 'Ed448'],
       [253, ''],
       [254, ''],
     ])
   }
 
   setDigestType(val) {
-    if (![1, 2].includes(val)) this.throwHelp(`DS: digest type invalid`)
+    // 1=SHA-1 (RFC 4034), 2=SHA-256 (RFC 4509), 4=SHA-384 (RFC 6605)
+    if (![1, 2, 4].includes(val)) this.throwHelp(`DS: digest type invalid`)
 
     this.set('digest type', val)
   }

package/rr/mx.js

@@ -23,6 +23,10 @@ export default class MX extends RR {
     this.set('preference', val)
   }
 
+  setExchange(val) {
+    this.setTypedValue('fqdn', 'exchange', val)
+  }
+
   getDescription() {
     return 'Mail Exchanger'
   }

package/rr/rrsig.js

@@ -49,13 +49,51 @@ export default class RRSIG extends RR {
     this.set('algorithm', val)
   }
 
+  setLabels(val) {
+    this.setTypedValue('u8', 'labels', val)
+  }
+
+  setOriginalTtl(val) {
+    this.setTypedValue('u32', 'original ttl', val)
+  }
+
+  setSignatureExpiration(val) {
+    this.setTypedValue('u32', 'signature expiration', val)
+  }
+
+  setSignatureInception(val) {
+    this.setTypedValue('u32', 'signature inception', val)
+  }
+
+  setKeyTag(val) {
+    this.setTypedValue('u16', 'key tag', val)
+  }
+
+  setSignersName(val) {
+    this.setTypedValue('fqdn', 'signers name', val)
+  }
+
+  setSignature(val) {
+    this.setTypedValue('str', 'signature', val)
+  }
+
   getAlgorithmOptions() {
+    // IANA DNSSEC Algorithm Numbers
+    // https://www.iana.org/assignments/dns-sec-alg-numbers/
     return new Map([
       [1, 'RSA/MD5'],
       [2, 'DH'],
-      [3, 'RRSIGA/SHA-1'],
+      [3, 'DSA/SHA-1'],
       [4, 'EC'],
       [5, 'RSA/SHA-1'],
+      [6, 'DSA-NSEC3-SHA1'],
+      [7, 'RSASHA1-NSEC3-SHA1'],
+      [8, 'RSA/SHA-256'],
+      [10, 'RSA/SHA-512'],
+      [13, 'ECDSA P-256/SHA-256'],
+      [14, 'ECDSA P-384/SHA-384'],
+      [15, 'Ed25519'],
+      [16, 'Ed448'],
       [253],
       [254],
     ])

package/rr/spf.js

@@ -55,7 +55,11 @@ export default class SPF extends TXT {
   }
 
   toTinydns() {
-    const rdata = TINYDNS.escapeOctal(new RegExp(/[\r\n\t:\\/]/, 'g'), this.get('data'))
+    // `data` may be a string or an array of <character-string>s (RFC 1035 §3.3.14).
+    // tinydns generic format stores rdata as a flat byte stream, so join here.
+    let data = this.get('data')
+    if (Array.isArray(data)) data = data.join('')
+    const rdata = TINYDNS.escapeOctal(new RegExp(/[\r\n\t:\\/]/, 'g'), data)
     return this.getTinydnsGeneric(rdata)
   }
 }

package/rr/srv.js

@@ -17,6 +17,23 @@ export default class SRV extends RR {
     super(opts)
   }
 
+  /****** Resource record specific setters   *******/
+  setPriority(val) {
+    this.setTypedValue('u16', 'priority', val)
+  }
+
+  setWeight(val) {
+    this.setTypedValue('u16', 'weight', val)
+  }
+
+  setPort(val) {
+    this.setTypedValue('u16', 'port', val)
+  }
+
+  setTarget(val) {
+    this.setTypedValue('fqdn', 'target', val)
+  }
+
   getDescription() {
     return 'Service'
   }

package/rr/sshfp.js

@@ -17,6 +17,21 @@ export default class SSHFP extends RR {
     super(opts)
   }
 
+  /****** Resource record specific setters   *******/
+  setAlgorithm(val) {
+    if (!this.getAlgorithmOptions().has(val)) this.throwHelp(`SSHFP: algorithm invalid`)
+    this.setTypedValue('u8', 'algorithm', val)
+  }
+
+  setFptype(val) {
+    if (!this.getFptypeOptions().has(val)) this.throwHelp(`SSHFP: fptype invalid`)
+    this.setTypedValue('u8', 'fptype', val)
+  }
+
+  setFingerprint(val) {
+    this.setTypedValue('hex', 'fingerprint', val)
+  }
+
   getAlgorithmOptions() {
     return new Map([
       [0, 'reserved'],

package/rr/txt.js

@@ -62,15 +62,20 @@ export default class TXT extends RR {
     if (n != 16) this.throwHelp('TXT fromTinydns, invalid n')
 
     rdata = TINYDNS.octalToChar(rdata)
-    let s = ''
-    let len = rdata[0].charCodeAt(0)
-    let pos = 1
+    // Walk RFC 1035 §3.3.14 len-prefixed <character-string> segments.
+    const parts = []
+    let pos = 0
     while (pos < rdata.length) {
-      s += rdata.slice(pos, +(len + pos))
-      pos = len + pos
-      len = rdata.charCodeAt(pos + 1)
+      const len = rdata.charCodeAt(pos)
+      pos += 1
+      if (pos + len > rdata.length) {
+        this.throwHelp('TXT fromTinydnsGeneric: truncated character-string in rdata')
+      }
+      parts.push(rdata.slice(pos, pos + len))
+      pos += len
     }
-    return [fqdn, s, ttl, ts, loc]
+    const data = parts.length > 1 ? parts : (parts[0] ?? '')
+    return [fqdn, data, ttl, ts, loc]
   }
 
   /******  EXPORTERS   *******/
@@ -84,8 +89,31 @@ export default class TXT extends RR {
   }
 
   getWireRdata() {
-    let data = this.get('data')
-    if (Array.isArray(data)) data = data.join('')
+    // RFC 1035 §3.3.14: TXT rdata is one or more <character-string>s, each up
+    // to 255 bytes. An array preserves explicit boundaries between strings;
+    // each element MUST be <= 255 UTF-8 bytes, otherwise we would silently
+    // split it and the boundary the caller asked us to preserve would be lost.
+    // A single string is auto-chunked at 255-byte UTF-8 boundaries.
+    const data = this.get('data')
+    if (Array.isArray(data)) {
+      const enc = new TextEncoder()
+      const buffers = data.map((s, i) => {
+        if (enc.encode(s).length > 255) {
+          this.throwHelp(
+            `TXT: array element ${i} exceeds 255 bytes; split it yourself or pass a single string to auto-chunk`,
+          )
+        }
+        return packStringWire(s)
+      })
+      const total = buffers.reduce((n, b) => n + b.length, 0)
+      const out = new Uint8Array(total)
+      let off = 0
+      for (const b of buffers) {
+        out.set(b, off)
+        off += b.length
+      }
+      return out
+    }
     return packStringWire(data)
   }