dyns 0.3.0

DNS discovery and resolver support for DHTTP applications
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

/// HTTP multi-record response wire format shared between server and all clients.
///
/// Wire layout (big-endian, contiguous):
/// ```text
/// +-----------+  (repeated `count` times)
/// | count     |  +-----------+------+-----------+------+
/// | u32 BE    |  | dns_len   | dns  | cert_len  | cert |
/// +-----------+  | u32 BE    | ...  | u32 BE    | ...  |
///                +-----------+------+-----------+------+
/// ```
use bytes::BufMut;
use nom::{IResult, bytes::streaming::take, number::streaming::be_u32};

/// One DNS + certificate pair inside a [`MultiResponse`].
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ResponseRecord {
    /// Serialised DNS packet bytes.
    pub dns: Vec<u8>,
    /// DER-encoded leaf certificate of the publisher, or empty when unavailable.
    pub cert: Vec<u8>,
}

impl ResponseRecord {
    /// SHA-256 fingerprint of the publisher certificate as lowercase hex.
    /// Returns `None` when the cert field is empty.
    pub fn cert_fingerprint_hex(&self) -> Option<String> {
        if self.cert.is_empty() {
            return None;
        }
        use ring::digest::{SHA256, digest};
        let digest = digest(&SHA256, &self.cert);
        Some(digest.as_ref().iter().map(|b| format!("{b:02x}")).collect())
    }
}

/// HTTP response body carrying zero or more DNS records.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct MultiResponse {
    pub records: Vec<ResponseRecord>,
}

impl MultiResponse {
    pub fn new(iter: impl IntoIterator<Item = (Vec<u8>, Vec<u8>)>) -> Self {
        Self {
            records: iter
                .into_iter()
                .map(|(dns, cert)| ResponseRecord { dns, cert })
                .collect(),
        }
    }

    pub fn encoding_size(&self) -> usize {
        4 + self
            .records
            .iter()
            .map(|record| 4 + record.dns.len() + 4 + record.cert.len())
            .sum::<usize>()
    }

    pub fn encode(&self) -> Vec<u8> {
        let mut buf = Vec::with_capacity(self.encoding_size());
        buf.put_multi_response(self);
        buf
    }
}

pub trait WriteMultiResponse {
    fn put_multi_response(&mut self, response: &MultiResponse);
}

impl<B: BufMut> WriteMultiResponse for B {
    fn put_multi_response(&mut self, response: &MultiResponse) {
        self.put_u32(response.records.len() as u32);
        for record in &response.records {
            self.put_u32(record.dns.len() as u32);
            self.put_slice(&record.dns);
            self.put_u32(record.cert.len() as u32);
            self.put_slice(&record.cert);
        }
    }
}

pub fn be_multi_response(input: &[u8]) -> IResult<&[u8], MultiResponse> {
    let (mut input, count) = be_u32(input)?;
    let mut records = Vec::with_capacity(count as usize);
    for _ in 0..count {
        let (rest, dns_len) = be_u32(input)?;
        let (rest, dns) = take(dns_len as usize)(rest)?;
        let (rest, cert_len) = be_u32(rest)?;
        let (rest, cert) = take(cert_len as usize)(rest)?;
        records.push(ResponseRecord {
            dns: dns.to_vec(),
            cert: cert.to_vec(),
        });
        input = rest;
    }
    Ok((input, MultiResponse { records }))
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn multi_response_roundtrips() {
        let response =
            MultiResponse::new([(vec![1, 2, 3], vec![4, 5]), (vec![6, 7, 8, 9], Vec::new())]);
        let encoded = response.encode();
        let (remain, decoded) = be_multi_response(&encoded).unwrap();
        assert!(remain.is_empty());
        assert_eq!(decoded, response);
    }
}