3
4
Fork
You've already forked validns
5

feat: validate SVCB (TYPE 64) and HTTPS (TYPE 65) records per RFC 9460 #118

Merged
jelu merged 23 commits from tobez/validns:feat-svcb-https-rr into main 2026年05月14日 14:20:14 +02:00
Collaborator
Copy link

Implement SVCB (TYPE 64) and HTTPS (TYPE 65) record types per RFC 9460,
including RFC 9461 dohpath and RFC 9540 ohttp SvcParamKeys. Both
share the same on-wire format; HTTPS reuses the svcb_methods table.

A signed test zone (svcb.zone.signed, RSASHA256/alg 8) exercises
the wire encoder end-to-end via DNSSEC signature verification.

Fixes #79

Implement SVCB (TYPE 64) and HTTPS (TYPE 65) record types per RFC 9460, including RFC 9461 dohpath and RFC 9540 ohttp SvcParamKeys. Both share the same on-wire format; HTTPS reuses the svcb_methods table. A signed test zone (svcb.zone.signed, RSASHA256/alg 8) exercises the wire encoder end-to-end via DNSSEC signature verification. Fixes #79 
Comma-list parsers (parse_alpn, parse_mandatory, parse_ipv4hint,
parse_ipv6hint) used a stack `struct binary_data elems[256]` while
extract_svcparam allows values up to 65535 bytes. Although LINEBUFSZ
(2048) currently keeps the practical worst case at the edge of that
bound, the contract documented by split_unescaped ("sized for the
upper bound, one element per byte of v") was being violated. Replace
the fixed array with getmem_temp(sizeof(*elems) * (v.length + 1)) to
make the sizing match the contract regardless of any future change in
line-buffer size.
Also switch encode_addrs from getmem to getmem_temp so the wire-encoding
path stays in the temporary pool, matching the rest of wirerdata.
chore: bump Anton's copyright end year to 2026 in new svcb.c
Some checks reported errors
test / centos (pull_request) Failing after 1s
test / debian (pull_request) Failing after 1s
test / scan-build (pull_request) Failing after 1s
test / ubuntu (pull_request) Failing after 1s
builds.sr.ht/freebsd Job failed
builds.sr.ht/openbsd Job failed
bcece4a7b0
tobez force-pushed feat-svcb-https-rr from 809f75ca47
Some checks failed
test / centos (pull_request) Failing after 1s
test / scan-build (pull_request) Failing after 1s
test / ubuntu (pull_request) Failing after 1s
test / debian (pull_request) Failing after 1s
builds.sr.ht/freebsd Job completed
builds.sr.ht/openbsd Job completed
to 855fa2adb6
Some checks failed
test / centos (pull_request) Failing after 1s
test / debian (pull_request) Failing after 1s
test / ubuntu (pull_request) Failing after 1s
test / scan-build (pull_request) Failing after 1s
builds.sr.ht/openbsd Job completed
builds.sr.ht/freebsd Job completed
2026年05月14日 12:02:41 +02:00 Compare
src/rr.h Outdated
@ -53,0 +63,4 @@
#define SVCB_KEY_IPV6HINT 6
#define SVCB_KEY_DOHPATH 7
#define SVCB_KEY_OHTTP 8
#define SVCB_KEY_MAX_KNOWN 8
Owner
Copy link

I was gonna move all this to the SVCB structs, so it's not in the middle of the T_ list, but noticed that this max known isn't used, why? remove?

I was gonna move all this to the SVCB structs, so it's not in the middle of the T_ list, but noticed that this max known isn't used, why? remove?
Author
Collaborator
Copy link

Yes please; thank you

Yes please; thank you
jelu marked this conversation as resolved
fix: move SVCB_KEY_ defines to where SVCB structs starts, remove unused MAX_KNOWN
All checks were successful
test / debian (pull_request) Successful in 44s
test / ubuntu (pull_request) Successful in 45s
builds.sr.ht/freebsd Job completed
test / centos (pull_request) Successful in 1m0s
builds.sr.ht/openbsd Job completed
test / scan-build (pull_request) Successful in 1m13s
76eec77d96
Sign in to join this conversation.
No reviewers
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
DNS-OARC/validns!118
Reference in a new issue
DNS-OARC/validns
No description provided.
Delete branch "tobez/validns:feat-svcb-https-rr"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?