This also fixes several bugs; the NSEC3 code would properly avoid empty
windows, but the NSEC and CSYNC code did not. Also, none of the wire
parsing routines properly checked to see that the window number was
monotonically increasing.
Bob Halley [Thu, 2 Jul 2020 15:23:52 +0000 (08:23 -0700)]
Rework wire format processing.
Wire format data is now done via a dns.wire.Parser, which does all of the
bookkeeping and also provides convenience routines (e.g. get_uint16() or
get_name()).
If dns.tsigkeyring.from_text() creates dns.tsig.Key objects with the
default algorithm, that causes problems for code that specifies a
different algorithm. There's no good way to handle this, so change
dns.tsigkeyring.from_text() to not create dns.tsig.Key objects unless it
knows the algorithm.
This creates a new class to represent a TSIG key, containing name,
secret, and algorithm.
The keyring format is changed to be {name : key}, and the methods in
dns.tsigkeyring are updated to deal with old and new formats.
The Message class is updated to use dns.tsig.Key, although (to avoid
breaking existing code), it stores them in the keyring field.
Message.use_tsig() can accept either explicit keys, or keyrings; it will
extract and/or create a key.
dns.message.from_wire() can accept either a key or a keyring in the
keyring parameter. If passed a key, it will now raise if the TSIG
record in the message was signed with a different key. If passed a
keyring containing keys (as opposed to bare secrets), it will check that
the TSIG record's algorithm matches that of the key.
Brian Wellington [Tue, 30 Jun 2020 16:27:06 +0000 (09:27 -0700)]
Remove the concept from "first" from TSIG.
The sign() and validate() routines took a "first" parameter, which
indicated that this message was the first in a multi-message sequence.
This isn't needed, as it's identical to "not (ctx and multi)".
Remove the parameter from both, as well as the now-unneeded field in the
message object and message.from_wire() parameter.
Bob Halley [Mon, 29 Jun 2020 01:53:20 +0000 (18:53 -0700)]
Remove no longer needed code to activate EDNS if setting an extended
rcode and EDNS has not previously been activated. The code is no longer
needed as setting ednsflags to a nonzero value will automatically make
an opt RR and enable EDNS.
Brian Wellington [Fri, 26 Jun 2020 20:59:59 +0000 (13:59 -0700)]
Attempt to refactor per-opcode validation.
Instead of validating rrsets and sections after parsing them, check the
class/type for each record before parsing it. This is more generic,
because it moves all of the update logic out of the common code. It's
also more flexible, as it allows the update logic to specify that
meta-records are empty.
Brian Wellington [Fri, 26 Jun 2020 18:30:29 +0000 (11:30 -0700)]
Minor _WireReader refactoring.
Instead of parsing the header to determine which Message subclass to
create and passing that message to _WireReader, make _WireReader create
the Message subclass itself.
Brian Wellington [Thu, 25 Jun 2020 00:04:59 +0000 (17:04 -0700)]
Fix TTL limiting.
The message code would convert negative TTL into 0, but the TTL could
never be negative, as it was read with the '!I' format, which reads
unsigned 32 bit integers. We don't want to change that, since OPT flags
(which are encoded in the TTL) should be treated as unsigned. Instead,
treat all TTLs > (2^31 - 1) as 0.
dependabot[bot] [Wed, 24 Jun 2020 05:43:45 +0000 (05:43 +0000)]
Update mypy requirement from ^0.781 to ^0.782
Updates the requirements on [mypy](https://github.com/python/mypy) to permit the latest version.
- [Release notes](https://github.com/python/mypy/releases)
- [Commits](https://github.com/python/mypy/compare/v0.781...v0.782)
Brian Wellington [Tue, 23 Jun 2020 23:46:48 +0000 (16:46 -0700)]
Add more functionality to nanonameserver.
- When no port is specified, pick the same port for UDP and TCP, so that
TCP fallback can be tested.
- Change handlers to get a single Request object instead of individual
parameters. The Request object contains the message, peer, and
connection_type previously passed, and also adds the local address and
wire format message. Additionally, it provides convenient properties
for accessing the question.