2023-05-07 15:06:51 +00:00
|
|
|
use std::error::Error;
|
|
|
|
use std::str::FromStr;
|
|
|
|
|
2023-05-07 16:07:31 +00:00
|
|
|
use mockall::automock;
|
2023-05-07 15:06:51 +00:00
|
|
|
use trust_dns_client::client::{Client, SyncClient};
|
|
|
|
use trust_dns_client::rr::{DNSClass, Name, RData, RecordType};
|
|
|
|
use trust_dns_client::udp::UdpClientConnection;
|
|
|
|
|
2023-05-09 11:44:57 +00:00
|
|
|
#[derive(thiserror::Error, Debug)]
|
2023-05-07 15:06:51 +00:00
|
|
|
pub enum NewDNSCheckerError {
|
2023-05-09 11:44:57 +00:00
|
|
|
#[error("invalid resolver address")]
|
2023-05-07 15:06:51 +00:00
|
|
|
InvalidResolverAddress,
|
2023-05-09 11:44:57 +00:00
|
|
|
|
|
|
|
#[error("invalid target CNAME")]
|
2023-05-07 15:06:51 +00:00
|
|
|
InvalidTargetCNAME,
|
|
|
|
|
2023-05-09 11:44:57 +00:00
|
|
|
#[error(transparent)]
|
|
|
|
Unexpected(Box<dyn Error>),
|
2023-05-07 15:06:51 +00:00
|
|
|
}
|
|
|
|
|
2023-05-09 11:44:57 +00:00
|
|
|
#[derive(thiserror::Error, Debug)]
|
2023-05-07 15:06:51 +00:00
|
|
|
pub enum CheckDomainError {
|
2023-05-09 11:44:57 +00:00
|
|
|
#[error("invalid domain name")]
|
2023-05-07 15:06:51 +00:00
|
|
|
InvalidDomainName,
|
2023-05-09 11:44:57 +00:00
|
|
|
|
|
|
|
#[error("target CNAME not set")]
|
2023-05-07 15:06:51 +00:00
|
|
|
TargetCNAMENotSet,
|
2023-05-09 11:44:57 +00:00
|
|
|
|
|
|
|
#[error("challenge token not set")]
|
2023-05-07 15:06:51 +00:00
|
|
|
ChallengeTokenNotSet,
|
|
|
|
|
2023-05-09 11:44:57 +00:00
|
|
|
#[error(transparent)]
|
|
|
|
Unexpected(Box<dyn Error>),
|
2023-05-07 15:06:51 +00:00
|
|
|
}
|
|
|
|
|
2023-05-07 15:17:04 +00:00
|
|
|
#[automock]
|
2023-05-07 15:06:51 +00:00
|
|
|
pub trait Checker {
|
|
|
|
fn check_domain(&self, domain: &str, challenge_token: &str) -> Result<(), CheckDomainError>;
|
|
|
|
}
|
|
|
|
|
|
|
|
pub struct DNSChecker {
|
|
|
|
target_cname: Name,
|
|
|
|
client: SyncClient<UdpClientConnection>,
|
|
|
|
}
|
|
|
|
|
|
|
|
impl DNSChecker {
|
|
|
|
pub fn new(target_cname: &str, resolver_addr: &str) -> Result<DNSChecker, NewDNSCheckerError> {
|
|
|
|
let target_cname =
|
|
|
|
Name::from_str(target_cname).map_err(|_| NewDNSCheckerError::InvalidTargetCNAME)?;
|
|
|
|
|
|
|
|
let resolver_addr = resolver_addr
|
|
|
|
.parse()
|
|
|
|
.map_err(|_| NewDNSCheckerError::InvalidResolverAddress)?;
|
|
|
|
|
2023-05-09 11:44:57 +00:00
|
|
|
let conn = UdpClientConnection::new(resolver_addr)
|
|
|
|
.map_err(|e| NewDNSCheckerError::Unexpected(Box::from(e)))?;
|
|
|
|
|
2023-05-07 15:06:51 +00:00
|
|
|
let client = SyncClient::new(conn);
|
|
|
|
|
|
|
|
Ok(DNSChecker {
|
|
|
|
target_cname,
|
|
|
|
client,
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
impl Checker for DNSChecker {
|
|
|
|
fn check_domain(&self, domain: &str, challenge_token: &str) -> Result<(), CheckDomainError> {
|
|
|
|
let mut fqdn = Name::from_str(domain).map_err(|_| CheckDomainError::InvalidDomainName)?;
|
|
|
|
fqdn.set_fqdn(true);
|
|
|
|
|
|
|
|
// check that the CNAME is installed correctly on the domain
|
|
|
|
{
|
2023-05-09 11:44:57 +00:00
|
|
|
let response = self
|
|
|
|
.client
|
|
|
|
.query(&fqdn, DNSClass::IN, RecordType::CNAME)
|
|
|
|
.map_err(|e| CheckDomainError::Unexpected(Box::from(e)))?;
|
2023-05-07 15:06:51 +00:00
|
|
|
|
|
|
|
let records = response.answers();
|
|
|
|
|
|
|
|
if records.len() != 1 {
|
|
|
|
return Err(CheckDomainError::TargetCNAMENotSet);
|
|
|
|
}
|
|
|
|
|
|
|
|
// if the single record isn't a CNAME, or it's not the target CNAME, then return
|
|
|
|
// TargetCNAMENotSet
|
|
|
|
match records[0].data() {
|
|
|
|
Some(RData::CNAME(remote_cname)) if remote_cname == &self.target_cname => (),
|
|
|
|
_ => return Err(CheckDomainError::TargetCNAMENotSet),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// check that the TXT record with the challenge token is correctly installed on the domain
|
|
|
|
{
|
2023-05-09 11:44:57 +00:00
|
|
|
let fqdn = Name::from_str("_gateway")
|
|
|
|
.map_err(|e| CheckDomainError::Unexpected(Box::from(e)))?
|
|
|
|
.append_domain(&fqdn)
|
|
|
|
.map_err(|e| CheckDomainError::Unexpected(Box::from(e)))?;
|
2023-05-09 11:52:21 +00:00
|
|
|
|
2023-05-09 11:44:57 +00:00
|
|
|
let response = self
|
|
|
|
.client
|
|
|
|
.query(&fqdn, DNSClass::IN, RecordType::TXT)
|
|
|
|
.map_err(|e| CheckDomainError::Unexpected(Box::from(e)))?;
|
2023-05-07 15:06:51 +00:00
|
|
|
|
|
|
|
let records = response.answers();
|
|
|
|
|
|
|
|
if !records.iter().any(|record| -> bool {
|
|
|
|
match record.data() {
|
|
|
|
Some(RData::TXT(txt)) => txt.to_string().contains(challenge_token),
|
|
|
|
_ => false,
|
|
|
|
}
|
|
|
|
}) {
|
|
|
|
return Err(CheckDomainError::ChallengeTokenNotSet);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
Ok(())
|
|
|
|
}
|
|
|
|
}
|