routinator 0.10.2

An RPKI relying party software.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

//! Utilities for handling rsync and HTTPS URIs.

use std::borrow::Cow;
use std::net::IpAddr;
use std::path::PathBuf;
use std::str::FromStr;
use rpki::uri;
use rpki::repository::crypto::{Digest, DigestAlgorithm};


//------------ UriExt --------------------------------------------------------

/// An extension trait for URI kind of types.
pub trait UriExt {
    fn get_authority(&self) -> &str;
    fn unique_components(&self) -> (Cow<str>, Digest);

    /// Returns whether the URI has a dubious authority.
    ///
    /// A dubious authority is a hostname portion of the URI that definitely
    /// cannot be reached from the public Internet or that shouldn’t be.
    ///
    /// Currently, we filter out the reserved name `localhost`, anything that
    /// uses an IP address as the host name, and anything that specifies an
    /// explicit port.
    fn has_dubious_authority(&self) -> bool {
        let authority = self.get_authority();

        // Filter out "localhost"
        if authority == "localhost" {
            return true;
        }

        // Filter out anything that contains a colon.
        if authority.contains(':') {
            return true
        }

        // Filter out anything that parses as an IP address.
        //
        // Socket addresses have gone via the previous rule already.
        if IpAddr::from_str(authority).is_ok() {
            return true
        }

        false
    }

    /// Returns a unique relative path derived from this URI.
    fn unique_path(
        &self, prefix: &str, extension: &str
    ) -> PathBuf {
        let (authority, digest) = self.unique_components();
        let mut res = String::with_capacity(
            prefix.len()
            + authority.len()
            + digest.as_ref().len() * 2 // two hexdigits per octet
            + extension.len()
            + 2 // up to two slashes.
        );
        if !prefix.is_empty() {
            res.push_str(prefix);
            res.push('/');
        }
        res.push_str(&authority);
        res.push('/');
        crate::utils::str::append_hex(
            digest.as_ref(),
            &mut res
        );
        if !extension.is_empty() {
            res.push_str(extension)
        }
        res.into()
    }
}

impl UriExt for uri::Https {
    fn get_authority(&self) -> &str {
        self.authority()
    }

    fn unique_components(&self) -> (Cow<str>, Digest) {
        let authority = self.canonical_authority();
        let mut digest = DigestAlgorithm::sha256().start();
        digest.update(b"https://");
        digest.update(authority.as_bytes());
        digest.update(b"/");
        digest.update(self.path().as_bytes());
        (authority, digest.finish())
    }
}

impl UriExt for uri::Rsync {
    fn get_authority(&self) -> &str {
        self.authority()
    }

    fn unique_components(&self) -> (Cow<str>, Digest) {
        let authority = self.canonical_authority();
        let mut digest = DigestAlgorithm::sha256().start();
        digest.update(b"rsync://");
        digest.update(authority.as_bytes());
        digest.update(b"/");
        digest.update(self.module_name().as_bytes());
        digest.update(b"/");
        digest.update(self.path().as_bytes());
        (authority, digest.finish())
    }
}