Introduce generic basis for DNSSEC signing.

Cargo.toml

@@ -17,7 +17,7 @@ name = "domain"
 path = "src/lib.rs"
 
 [dependencies]
-octseq         = "0.2"
+octseq         = { git = "https://github.com/nlnetlabs/octseq.git" }
 time           = "0.3.1"
 
 rand           = { version = "0.8", optional = true }

src/base/rdata.rs

@@ -55,7 +55,7 @@ impl<'a, T: RecordData> RecordData for &'a T {
 //----------- ComposeRecordData ----------------------------------------------
 
 /// A type of record data that can be composed.
-pub trait ComposeRecordData: RecordData {
+pub trait ComposeRecordData {
     /// Returns the length of the record data if available.
     ///
     /// The method should return `None`, if the length is not known or is not

src/base/record.rs

@@ -436,7 +436,7 @@ impl<'a, T: ComposeRecord> ComposeRecord for &'a T {
 impl<Name, Data> ComposeRecord for Record<Name, Data>
 where
     Name: ToDname,
-    Data: ComposeRecordData,
+    Data: RecordData + ComposeRecordData,
 {
     fn compose_record<Target: Composer + ?Sized>(
         &self,
@@ -449,7 +449,7 @@ where
 impl<Name, Data> ComposeRecord for (Name, Class, u32, Data)
 where
     Name: ToDname,
-    Data: ComposeRecordData,
+    Data: RecordData + ComposeRecordData,
 {
     fn compose_record<Target: Composer + ?Sized>(
         &self,
@@ -463,7 +463,7 @@ where
 impl<Name, Data> ComposeRecord for (Name, Class, Ttl, Data)
 where
     Name: ToDname,
-    Data: ComposeRecordData,
+    Data: RecordData + ComposeRecordData,
 {
     fn compose_record<Target: Composer + ?Sized>(
         &self,
@@ -476,7 +476,7 @@ where
 impl<Name, Data> ComposeRecord for (Name, u32, Data)
 where
     Name: ToDname,
-    Data: ComposeRecordData,
+    Data: RecordData + ComposeRecordData,
 {
     fn compose_record<Target: Composer + ?Sized>(
         &self,
@@ -490,7 +490,7 @@ where
 impl<Name, Data> ComposeRecord for (Name, Ttl, Data)
 where
     Name: ToDname,
-    Data: ComposeRecordData,
+    Data: RecordData + ComposeRecordData,
 {
     fn compose_record<Target: Composer + ?Sized>(
         &self,

src/lib.rs

@@ -109,7 +109,7 @@
 #![allow(clippy::uninlined_format_args)]
 #![cfg_attr(docsrs, feature(doc_cfg))]
 
-#[cfg(any(feature = "std"))]
+#[cfg(feature = "std")]
 #[allow(unused_imports)] // Import macros even if unused.
 #[macro_use]
 extern crate std;

src/sign/generic.rs

@@ -0,0 +1,140 @@
+use octseq::builder::{
+    BuilderAppendError, EmptyBuilder, FromBuilder, Truncate,
+};
+use crate::base::iana::{Class, Rtype};
+use crate::base::name::ToDname;
+use crate::base::record::{Record, Ttl};
+use crate::base::rdata::ComposeRecordData;
+use crate::base::serial::Serial;
+use crate::rdata::dnssec::{Ds, Dnskey, Nsec, ProtoRrsig, Rrsig, RtypeBitmap};
+use super::key::SigningKey;
+
+
+pub trait Rrset {
+    type Owner: ToDname;
+    type RecordData<'a>: ComposeRecordData where Self: 'a;
+    type Iter<'a>: Iterator<Item = Self::RecordData<'a>> where Self: 'a;
+
+    fn owner(&self) -> &Self::Owner;
+    fn class(&self) -> Class;
+    fn rtype(&self) -> Rtype;
+    fn ttl(&self) -> Ttl;
+    fn iter(&self) -> Self::Iter<'_>;
+
+    fn sign<Octs, Name, Key>(
+        &self,
+        apex: Name,
+        expiration: Serial,
+        inception: Serial,
+        key: Key,
+    ) -> Result<Rrsig<Octs, Name>, Key::Error>
+    where
+        Octs: From<<Key as SigningKey>::Signature> + AsRef<[u8]>,
+        Name: ToDname,
+        Key: SigningKey,
+    {
+        let rrsig = ProtoRrsig::new(
+            self.rtype(),
+            key.algorithm()?,
+            self.owner().rrsig_label_count(),
+            self.ttl(),
+            expiration,
+            inception,
+            key.key_tag()?,
+            apex,
+        );
+        let sig = key.sign(|buf| {
+            rrsig.compose_canonical(buf)?;
+            for item in self.iter() {
+                // We can’t use Record because it wants its rtype in the Data
+                // type. Luckily, composing a record is straighforward:
+                self.owner().compose_canonical(buf)?;
+                self.rtype().compose(buf)?;
+                self.class().compose(buf)?;
+                self.ttl().compose(buf)?;
+                item.compose_canonical_len_rdata(buf)?;
+            }
+            Ok(())
+        })?;
+        Ok(rrsig.into_rrsig(Octs::from(sig)).expect("long signature"))
+    }
+}
+
+pub trait Rrfamily {
+    type Owner: ToDname;
+    type Rrset<'a>: Rrset where Self: 'a;
+    type Iter<'a>: Iterator<Item = Self::Rrset<'a>> where Self: 'a;
+
+    fn owner(&self) -> &Self::Owner;
+    fn class(&self) -> Class;
+    fn iter(&self) -> Self::Iter<'_>;
+
+
+    //--- Things to do at the zone apex
+
+    fn dnskey<K: SigningKey, Octets: From<K::Octets>>(
+        &self,
+        ttl: Ttl,
+        key: K
+    ) -> Result<Record<Self::Owner, Dnskey<Octets>>, K::Error>
+    where
+        Self::Owner: Clone
+    {
+        key.dnskey().map(|data| {
+            self.to_record(ttl, data.convert())
+        })
+    }
+
+    #[allow(clippy::type_complexity)]
+    fn ds<K: SigningKey>(
+        &self,
+        ttl: Ttl,
+        key: K,
+    ) -> Result<Record<Self::Owner, Ds<K::Octets>>, K::Error>
+    where
+        Self::Owner: ToDname + Clone,
+    {
+        key.ds(self.owner()).map(|ds| {
+            self.to_record(ttl, ds)
+        })
+    }
+
+
+    //--- Things to do everywhere
+
+    fn to_record<D>(&self, ttl: Ttl, data: D) -> Record<Self::Owner, D>
+    where
+        Self::Owner: Clone
+    {
+        Record::new(self.owner().clone(), self.class(), ttl, data)
+    }
+
+    fn rtype_bitmap<Octs>(
+        &self
+    ) -> Result<RtypeBitmap<Octs>, BuilderAppendError<Octs>>
+    where
+        Octs: FromBuilder,
+        <Octs as FromBuilder>::Builder:
+            EmptyBuilder + Truncate + AsRef<[u8]> + AsMut<[u8]>,
+    {
+        let mut bitmap = RtypeBitmap::<Octs>::builder();
+        // Assume there’s going to be an RRSIG.
+        bitmap.add(Rtype::Rrsig)?;
+        for rrset in self.iter() {
+            bitmap.add(rrset.rtype())?;
+        }
+        Ok(bitmap.finalize())
+    }
+
+    fn nsec<Octs, Name>(
+        &self, next_name: Name
+    ) -> Result<Nsec<Octs, Name>, BuilderAppendError<Octs>>
+    where
+        Octs: FromBuilder,
+        <Octs as FromBuilder>::Builder:
+            EmptyBuilder + Truncate + AsRef<[u8]> + AsMut<[u8]>,
+    {
+        Ok(Nsec::new(next_name, self.rtype_bitmap()?))
+    }
+}
+

src/sign/key.rs

@@ -1,9 +1,13 @@
+use octseq::OctetsBuilder;
 use crate::base::iana::SecAlg;
 use crate::base::name::ToDname;
+use crate::base::wire::Composer;
 use crate::rdata::{Dnskey, Ds};
 
+
 pub trait SigningKey {
     type Octets: AsRef<[u8]>;
+    type Signer: Composer;
     type Signature: AsRef<[u8]>;
     type Error;
 
@@ -21,11 +25,16 @@ pub trait SigningKey {
         self.dnskey().map(|dnskey| dnskey.key_tag())
     }
 
-    fn sign(&self, data: &[u8]) -> Result<Self::Signature, Self::Error>;
+    fn sign<F>(&self, op: F) -> Result<Self::Signature, Self::Error>
+    where
+        F: FnOnce(
+            &mut Self::Signer
+        ) -> Result<(), <Self::Signer as OctetsBuilder>::AppendError>;
 }
 
 impl<'a, K: SigningKey> SigningKey for &'a K {
     type Octets = K::Octets;
+    type Signer = K::Signer;
     type Signature = K::Signature;
     type Error = K::Error;
 
@@ -47,7 +56,13 @@ impl<'a, K: SigningKey> SigningKey for &'a K {
         (*self).key_tag()
     }
 
-    fn sign(&self, data: &[u8]) -> Result<Self::Signature, Self::Error> {
-        (*self).sign(data)
+    fn sign<F>(&self, op: F) -> Result<Self::Signature, Self::Error>
+    where
+        F: FnOnce(
+            &mut Self::Signer
+        ) -> Result<(), <Self::Signer as OctetsBuilder>::AppendError>
+    {
+        (*self).sign(op)
     }
 }
+

src/sign/mod.rs

@@ -8,3 +8,5 @@ pub mod key;
 //pub mod openssl;
 pub mod records;
 pub mod ring;
+
+pub mod generic;