The oots SvcParam (draft-johani-dnsop-svcb-oots-00)

dns.h

@@ -197,6 +197,7 @@ typedef enum nsd_rc nsd_rc_type;
 #define SVCB_KEY_TLS_SUPPORTED_GROUPS	9
 #define SVCB_KEY_DOCPATH		10
 #define SVCB_KEY_PVD			11
+#define SVCB_KEY_OOTS			12
 
 #define MAXLABELLEN	63
 #define MAXDOMAINLEN	255

rdata.c

@@ -109,6 +109,10 @@ static int print_svcparam_tls_supported_groups(struct buffer *output,
 static int print_svcparam_docpath(struct buffer *output,
 	uint16_t svcparamkey, const uint8_t* data, uint16_t datalen);
 
+/* Print svcparam oots */
+static int print_svcparam_oots(struct buffer *output,
+	uint16_t svcparamkey, const uint8_t* data, uint16_t datalen);
+
 static const nsd_svcparam_descriptor_type svcparams[] = {
 	{ SVCB_KEY_MANDATORY, "mandatory", print_svcparam_mandatory },
 	{ SVCB_KEY_ALPN, "alpn", print_svcparam_alpn },
@@ -124,6 +128,7 @@ static const nsd_svcparam_descriptor_type svcparams[] = {
 		print_svcparam_tls_supported_groups },
 	{ SVCB_KEY_DOCPATH, "docpath", print_svcparam_docpath},
 	{ SVCB_KEY_PVD, "pvd", print_svcparam_no_value },
+	{ SVCB_KEY_OOTS, "oots", print_svcparam_oots},
 };
 
 /*
@@ -689,6 +694,7 @@ svcparam_must_have_value(uint16_t svcparamkey)
 	case SVCB_KEY_MANDATORY:
 	case SVCB_KEY_DOHPATH:
 	case SVCB_KEY_TLS_SUPPORTED_GROUPS:
+	case SVCB_KEY_OOTS:
 		return 1;
 	default:
 		break;
@@ -703,6 +709,7 @@ svcparam_must_not_have_value(uint16_t svcparamkey)
 	switch (svcparamkey) {
 	case SVCB_KEY_NO_DEFAULT_ALPN:
 	case SVCB_KEY_OHTTP:
+	case SVCB_KEY_PVD:
 		return 1;
 	default:
 		break;
@@ -967,6 +974,42 @@ print_svcparam_docpath(struct buffer *output, uint16_t svcparamkey,
 	return 1;
 }
 
+static int
+print_svcparam_oots(struct buffer *output, uint16_t svcparamkey,
+		const uint8_t* data, uint16_t datalen)
+{
+	assert(datalen > 0); /* Guaranteed by svcparam_print */
+
+	buffer_print_svcparamkey(output, svcparamkey);
+	buffer_printf(output, "=\"");
+	while(*data + 2 <= datalen) {
+		size_t transport_len = *data;
+		uint8_t percentage = data[transport_len + 1];
+		size_t i;
+
+		if(!transport_len || percentage > 100)
+			return 0;
+
+		for(i=0; i < transport_len; i++) {
+			char ch = data[i + 1];
+			if(!isgraph(ch)
+			|| ch == '"' || ch == '\\' || ch == ',' || ch == ':')
+				return 0;
+
+			buffer_write_u8(output, ch);
+		}
+		buffer_printf(output, ":%d", percentage);
+		data += transport_len + 2;
+		datalen -= transport_len + 2;
+		if(datalen)
+			buffer_write_u8(output, ',');
+	}
+	if(datalen)
+		return 0;
+	buffer_printf(output, "\"");
+	return 1;
+}
+
 /*
  * Print svcparam.
  * @param output: the string is output here.

tpkg/svcb.tdir/svcb.failure-cases-27

@@ -0,0 +1,7 @@
+$ORIGIN failure-cases.
+$TTL 3600
+
+@       SOA     primary admin 0 0 0 0 0
+
+pvd-f1 3600 IN HTTPS 1 . alpn="h3,h2" pvd="something"
+

tpkg/svcb.tdir/svcb.failure-cases-28

@@ -0,0 +1,8 @@
+$ORIGIN failure-cases.
+$TTL 3600
+
+@       SOA     primary admin 0 0 0 0 0
+
+; Missing percentage
+oots-f1 300 IN SVCB 1 . oots="do53:100,dot"
+

tpkg/svcb.tdir/svcb.failure-cases-29

@@ -0,0 +1,8 @@
+$ORIGIN failure-cases.
+$TTL 3600
+
+@       SOA     primary admin 0 0 0 0 0
+
+; Missing transport
+oots-f2 300 IN SVCB 1 . oots="do53:100,:25"
+

tpkg/svcb.tdir/svcb.failure-cases-30

@@ -0,0 +1,8 @@
+$ORIGIN failure-cases.
+$TTL 3600
+
+@       SOA     primary admin 0 0 0 0 0
+
+; Invalid percentage
+oots-f3 300 IN SVCB 1 . oots="do53:100,dot:101"
+

tpkg/svcb.tdir/svcb.failure-cases-31

@@ -0,0 +1,8 @@
+$ORIGIN failure-cases.
+$TTL 3600
+
+@       SOA     primary admin 0 0 0 0 0
+
+; Invalid percentage
+oots-f4 300 IN SVCB 1 . oots="do53:100,dot:25%"
+

tpkg/svcb.tdir/svcb.failure-cases-32

@@ -0,0 +1,8 @@
+$ORIGIN failure-cases.
+$TTL 3600
+
+@       SOA     primary admin 0 0 0 0 0
+
+; Duplicate transport
+oots-f5 300 IN SVCB 1 . oots="do53:100,dot:25,dot:10"
+

tpkg/svcb.tdir/svcb.test

@@ -201,11 +201,46 @@ then
 	echo "Failure case 26: A tls-supported-groups list containing duplicates is invalid"
 	echo "Incorrectly succeeded"
 	exit 1
+
+elif $PRE/nsd-checkzone failure-cases svcb.failure-cases-27
+then
+	echo "Failure case 27: A pvd with a value"
+	echo "Incorrectly succeeded"
+	exit 1
+
+elif $PRE/nsd-checkzone failure-cases svcb.failure-cases-28
+then
+	echo "Failure case 28: Missing percentage in oots"
+	echo "Incorrectly succeeded"
+	exit 1
+
+elif $PRE/nsd-checkzone failure-cases svcb.failure-cases-29
+then
+	echo "Failure case 29: Missing transport in oots"
+	echo "Incorrectly succeeded"
+	exit 1
+
+elif $PRE/nsd-checkzone failure-cases svcb.failure-cases-30
+then
+	echo "Failure case 30: Invalid percentage in oots"
+	echo "Incorrectly succeeded"
+	exit 1
+
+elif $PRE/nsd-checkzone failure-cases svcb.failure-cases-31
+then
+	echo "Failure case 31: Invalid percentage in oots"
+	echo "Incorrectly succeeded"
+	exit 1
+
+elif $PRE/nsd-checkzone failure-cases svcb.failure-cases-32
+then
+	echo "Failure case 32: Duplicate transport in oots"
+	echo "Incorrectly succeeded"
+	exit 1
 else
 	echo "All failure cases test successfully"
 fi
 
-
 if ! $PRE/nsd-checkzone -p success-cases svcb.success-cases.zone > svcb.success-cases.zone.out
 then
 	echo "Some particular success cases did not succeed to parse"

tpkg/svcb.tdir/svcb.test-vectors-pf.zone

@@ -110,3 +110,8 @@ docpath-s4   429  IN SVCB 1 dns.example.org. (
 ; Example from draft-ietf-intarea-proxy-config-13 Section-2.1 Discovery via HTTPS/SVCB Records:
 pvd-s1 3600 IN HTTPS 1 . alpn="h3,h2" pvd
 
+; Examples from draft-johani-dnsop-svcb-oots-00 Section-2.2
+oots-s1 300 IN SVCB 1 . oots="do53:100,dot:10"
+oots-s2 300 IN SVCB 1 . oots="do53:100,dot:5,doq:5"
+oots-s3 300 IN SVCB 1 . oots="do53:100,dot:25,doh:10,doq:10"
+

tpkg/svcb.tdir/svcb.test-vectors-wf.zone

@@ -286,3 +286,7 @@ pvd-s1	3600	IN	HTTPS	\# 17 (
  00 01 00 06 02 68 33 02 68 32                      ; alpn=h3,h2
  00 0b 00 00                                        ; pvd
 )
+oots-s1	300	IN	SVCB	\# 18 000100000c000b04646f35336403646f740a
+oots-s2	300	IN	SVCB	\# 23 000100000c001004646f35336403646f740503646f7105
+oots-s3	300	IN	SVCB	\# 28 000100000c001504646f35336403646f741903646f680a03646f710a
+