Merge branch 'dnssec' into dnssec-develop

Cargo.toml

@@ -16,6 +16,11 @@ tokio-stream = "0.1"
 thiserror = "1.0.20"
 futures-util = "0.3.28"
 async-trait = "0.1.77"
+sha2 = "0.10.2"
+hmac = "0.12.1"
+rust-crypto = "0.2"
+base64 = "0.22.1"
+
 lru = "0.12.3"
 
 [lib]

src/dnssec.rs

@@ -0,0 +1,91 @@
+pub mod dnssec_encryption;
+pub mod dnssec_decryption;
+
+
+use std::str::FromStr;
+use crate::domain_name::DomainName;
+use crate::message::class_qclass::Qclass;
+use crate::message::class_rclass::Rclass;
+use crate::message::DnsMessage;
+use crate::message::rdata::opt_rdata::OptRdata;
+use crate::message::rdata::Rdata;
+use crate::message::resource_record::{FromBytes, ResourceRecord, ToBytes};
+use crate::message::type_qtype::Qtype;
+use crate::message::rcode;
+use crate::message::rcode::Rcode;
+
+const EDNS_VERSION: u8 = 0;
+const REQUESTED_UDP_LEN: u16 = 4096;
+/*
+The mechanism chosen for the explicit notification of the ability of
+the client to accept (if not understand) DNSSEC security RRs is using
+the most significant bit of the Z field on the EDNS0 OPT header in
+the query.  This bit is referred to as the "DNSSEC OK" (DO) bit.  In
+the context of the EDNS0 OPT meta-RR, the DO bit is the first bit of
+the third and fourth bytes of the "extended RCODE and flags" portion
+of the EDNS0 OPT meta-RR, structured as follows:
+
+            +0 (MSB)                +1 (LSB)
+     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+  0: |   EXTENDED-RCODE      |       VERSION         |
+     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+  2: |DO|                    Z                       |
+     +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+*/
+fn create_opt_rr(capacity: u16 ,e_rcode :u8, version: u8, do_bit: bool) -> ResourceRecord {
+    let opt_rdata = OptRdata::new();
+    let rdata = Rdata::OPT(opt_rdata);
+    let mut rr = ResourceRecord::new(rdata);
+
+    let do_val: u16 = if do_bit {0x8000} else {0x0};
+    let ttl: u32 = (e_rcode as u32) << 24 | (version as u32) << 16| (do_val as u32);
+    rr.set_ttl(ttl);
+    rr.set_rclass(Rclass::UNKNOWN(capacity));
+    println!("EL ttl es: {:#05x?}", ttl);
+    rr
+}
+
+fn read_opt_rr(opt_rr: ResourceRecord) -> String {
+    let requested_udp_len = Rclass::from_rclass_to_int(opt_rr.get_rclass());
+    let data = opt_rr.get_ttl().to_be_bytes();
+    let (e_rcode, version) = (data[0], data[1]);
+    let z = u16::from_be_bytes([data[2], data[3]]);
+
+    let do_bit = ((z & 0x8000) > 0) as u8 ;
+    format!("OPT PSEUDO-RR\n\trequested_udp_len: {requested_udp_len}\n\terror code: {e_rcode}\n\tversion: EDNS{version}\n\tuse dnssec: {do_bit}")
+}
+
+/*
+   A security-aware resolver MUST include an EDNS ([RFC2671]) OPT
+   pseudo-RR with the DO ([RFC3225]) bit set when sending queries.
+*/
+fn create_dns_message_with_dnssec(mut msg: DnsMessage) -> DnsMessage {
+    // We create a opt rr with the do bit set to 1
+    // with NOERR as rcode and EDNS0
+    let rr = create_opt_rr(REQUESTED_UDP_LEN,
+                            rcode::Rcode::from_rcode_to_int(Rcode::NOERROR),
+                            EDNS_VERSION,
+                            true);
+
+    let vec = vec![rr];
+    msg.add_additionals(vec);
+    msg
+}
+
+#[test]
+fn see_dnssec_message() {
+    let query = DnsMessage::new_query_message(
+        DomainName::new_from_str("example.com"),
+        Qtype::A,
+        Qclass::UNKNOWN(4096),
+        1,
+        true,
+        2000
+    );
+    let query= create_dns_message_with_dnssec(query);
+    assert_eq!(String::from_str
+                   ("OPT PSEUDO-RR\n\trequested_udp_len: 4096\n\terror code: 0\n\tversion: EDNS0\n\tuse dnssec: 1")
+                   .expect("Not a utf8 str"),
+               read_opt_rr(query.get_additional().pop().expect("No OPT Record!"))
+    )
+}

src/dnssec/dnssec.rs

@@ -0,0 +1,17 @@
+use crate::message::{DnsMessage, Rdata, ResourceRecord};
+use crate::dnssec_message_processing::extract_dnssec_records;
+use crate::rrset_signature::{verify_rrsig, verify_ds};
+use crate::message::rdata::DnskeyRdata;
+use crate::client::client_error::ClientError;
+
+pub async fn fetch_dnskey_records(dns_response: &DnsMessage) -> Result<Vec<DnskeyRdata>, ClientError> {
+    let mut dnskey_records = Vec::new();
+
+    for record in dns_response.get_answer() {
+        if let Rdata::DNSKEY(dnskey) = &record.get_rdata() {
+            dnskey_records.push(dnskey.clone());
+        }
+    }
+
+    Ok(dnskey_records)
+}

src/dnssec/dnssec_message_processing.rs

@@ -0,0 +1,19 @@
+use crate::message::{DnsMessage, Rdata, ResourceRecord};
+
+pub fn extract_dnssec_records(dns_response: &DnsMessage) -> (Vec<ResourceRecord>, Vec<ResourceRecord>) {
+    let answers = dns_response.get_answer();
+    let additionals = dns_response.get_additional();
+
+    let mut dnskey_records = Vec::new();
+    let mut rrsig_records = Vec::new();
+
+    for record in answers.iter().chain(additionals.iter()) {
+        match record.get_rdata() {
+            Rdata::DNSKEY(_) => dnskey_records.push(record.clone()),
+            Rdata::RRSIG(_) => rrsig_records.push(record.clone()),
+            _ => {}
+        }
+    }
+
+    (dnskey_records, rrsig_records)
+}

src/dnssec/rrset_signature.rs

@@ -0,0 +1,69 @@
+use sha2::{Sha256, Digest};
+use rust_crypto::digest::Digest as RustDigest;
+use rust_crypto::sha1::Sha1;
+use base64::encode;
+use crate::message::rdata::{DnskeyRdata, RrsigRdata, Rdata};
+use crate::message::resource_record::ResourceRecord;
+use crate::client::client_error::ClientError;
+
+pub fn verify_rrsig(rrsig: &RrsigRdata, dnskey: &DnskeyRdata, rrset: &[ResourceRecord]) -> Result<bool, ClientError> {
+    let mut rrsig_data = Vec::new();
+    rrsig_data.extend_from_slice(&rrsig.type_covered.to_be_bytes());
+    rrsig_data.push(rrsig.algorithm);
+    rrsig_data.push(rrsig.labels);
+    rrsig_data.extend_from_slice(&rrsig.original_ttl.to_be_bytes());
+    rrsig_data.extend_from_slice(&rrsig.expiration.to_be_bytes());
+    rrsig_data.extend_from_slice(&rrsig.inception.to_be_bytes());
+    rrsig_data.extend_from_slice(&rrsig.key_tag.to_be_bytes());
+    rrsig_data.extend_from_slice(rrsig.signer_name.to_bytes()?);
+
+    let mut rrset_sorted = rrset.to_vec();
+    rrset_sorted.sort_by(|a, b| a.name.cmp(&b.name));
+
+    for rr in rrset_sorted.iter() {
+        rrsig_data.extend_from_slice(rr.name.to_bytes()?);
+        rrsig_data.extend_from_slice(&rr.ttl.to_be_bytes());
+        rrsig_data.extend_from_slice(&(rr.rdata.to_bytes().len() as u16).to_be_bytes());
+        rrsig_data.extend_from_slice(&rr.rdata.to_bytes()?);
+    }
+
+    let signature = rrsig.signature.clone();
+    let hashed = Sha256::digest(&rrsig_data);
+
+    match dnskey.algorithm {
+        3 | 5 => {
+            // (DSA/RSA)/SHA1
+            let mut sha1 = Sha1::new();
+            sha1.input(&rrsig_data);
+            let digest = sha1.result_str();
+            Ok(digest == encode(&signature))
+        },
+        8 => {
+            // RSA/SHA256
+            Ok(encode(&hashed) == encode(&signature))
+        },
+        _ => Err(ClientError::new("Unknown DNSKEY algorithm")),
+    }
+}
+
+pub fn verify_ds(ds_record: &ResourceRecord, dnskey: &DnskeyRdata) -> Result<bool, ClientError> {
+    if let Rdata::DS(ds_rdata) = &ds_record.get_rdata() {
+        let dnskey_bytes = dnskey.to_bytes()?;
+        let hashed_key = match ds_rdata.algorithm {
+            1 => {
+                let mut hasher = Sha1::new();
+                hasher.input(&dnskey_bytes);
+                hasher.result_str()
+            },
+            2 => {
+                let hashed = Sha256::digest(&dnskey_bytes);
+                encode(&hashed)
+            },
+            _ => return Err(ClientError::new("Unknown DS algorithm")),
+        };
+
+        Ok(ds_rdata.digest == hashed_key)
+    } else {
+        Err(ClientError::new("Provided record is not a DS record"))
+    }
+}

src/lib.rs

@@ -5,7 +5,5 @@ pub mod domain_name;
 pub mod message;
 pub mod async_resolver;
 pub mod truncated_dns_message;
-
-
-
-
+pub mod tsig;
+pub mod dnssec;

src/message.rs

@@ -615,6 +615,7 @@ impl DnsMessage {
         let mut msg_answers = self.get_answer();
 
         msg_answers.append(&mut answers);
+        self.header.set_ancount(msg_answers.len() as u16);
         self.set_answer(msg_answers);
     }
 
@@ -640,6 +641,7 @@ impl DnsMessage {
         let mut msg_authorities = self.get_authority();
 
         msg_authorities.append(&mut authorities);
+        self.header.set_nscount(msg_authorities.len() as u16);
         self.set_answer(msg_authorities);
     }
 
@@ -656,6 +658,7 @@ impl DnsMessage {
         let mut msg_additionals = self.get_additional();
 
         msg_additionals.append(&mut additionals);
+        self.header.set_arcount(msg_additionals.len() as u16);
         self.set_additional(msg_additionals);
     }
 
@@ -984,7 +987,7 @@ mod message_test {
         */
         let bytes: [u8; 50] = [
             //test passes with this one
-            0b00100100, 0b10010101, 0b10010010, 0b00000000, 0, 1, 0b00000000, 1, 0, 0, 0, 0, 4, 116,
+            0b00100100, 0b10010101, 0b10010010, 0b00100000, 0, 1, 0b00000000, 1, 0, 0, 0, 0, 4, 116,
             101, 115, 116, 3, 99, 111, 109, 0, 0, 16, 0, 1, 3, 100, 99, 99, 2, 99, 108, 0, 0, 16, 0,
             1, 0, 0, 0b00010110, 0b00001010, 0, 6, 5, 104, 101, 108, 108, 111,
         ];
@@ -1002,7 +1005,10 @@ mod message_test {
         assert_eq!(header.get_qr(), true);
         assert_eq!(header.get_op_code(), 2);
         assert_eq!(header.get_tc(), true);
+
+        assert_eq!(header.get_ad(), true);
         assert_eq!(header.get_rcode(), Rcode::NOERROR);
+
         assert_eq!(header.get_ancount(), 1);
 
         // Question
@@ -1041,7 +1047,10 @@ mod message_test {
         header.set_qr(true);
         header.set_op_code(2);
         header.set_tc(true);
+
+        header.set_ad(true);
         header.set_rcode(Rcode::UNKNOWN(8));
+
         header.set_ancount(0b0000000000000001);
         header.set_qdcount(1);
 
@@ -1081,7 +1090,7 @@ mod message_test {
         let msg_bytes = &dns_msg.to_bytes();
 
         let real_bytes: [u8; 50] = [
-            0b00100100, 0b10010101, 0b10010010, 0b00001000, 0, 1, 0b00000000, 0b00000001, 0, 0, 0,
+            0b00100100, 0b10010101, 0b10010010, 0b00101000, 0, 1, 0b00000000, 0b00000001, 0, 0, 0,
             0, 4, 116, 101, 115, 116, 3, 99, 111, 109, 0, 0, 5, 0, 2, 3, 100, 99, 99, 2, 99, 108,
             0, 0, 16, 0, 1, 0, 0, 0b00010110, 0b00001010, 0, 6, 5, 104, 101, 108, 108, 111,
         ];