Security & Package Modernization

Cargo.toml

@@ -41,58 +41,63 @@ udp = []
 zones = ["pest", "pest_consume", "pest_derive"]
 
 # A private feature for common http dependencies.
-http_deps = ["http", "url", "hyper", "hyper-alpn", "mime"]
+http_deps = ["http", "url", "hyper", "hyper-util", "hyper-rustls", "http-body-util", "mime"]
 
 [dependencies]
 
 # Used for the web clients
-http = { version = "0.2.5", optional = true }
-url = { version = "2.3.1", optional = true }
-hyper = { version = "0.14.16", features = ["client", "runtime", "http1", "http2"], optional = true }
-hyper-alpn = { version = "0.3.0", optional = true }
+http = { version = "1.5.0", optional = true }
+http-body-util = { version = "0.1.5", optional = true }
+url = { version = "2.5.8", optional = true }
+hyper = { version = "1.1", features = ["client", "http1", "http2"], optional = true }
+hyper-util = { version = "0.1.12", features = ["client-legacy", "tokio", "http1", "http2"], optional = true }
+hyper-rustls = { version = "0.27.9", default-features = false, features = ["webpki-tokio", "http1", "http2", "ring"], optional = true }
 mime = { version = "0.3.16", optional = true }
 
 # Needed for DNS over HTTP (DoH)
-base64 = { version = "0.13.0", optional = true }
+base64 = { version = "0.23.1", optional = true }
 
 # Needed for DNS over HTTP Json
 serde = { version = "1.0.132", features = ["derive"], optional = true }
-serde_json = { version = "1.0.74", optional = true }
+serde_json = { version = "1.0.151", optional = true }
 
 # Needed for Zone file parsing
-pest = { version = "2.1.3", optional = true }
+pest = { version = "2.9.0", optional = true }
 pest_consume = { version = "1.1.1", optional = true }
-pest_derive = { version = "2.1.0", optional = true }
+pest_derive = { version = "2.9.0", optional = true }
+
+# Needed for fuzzing
+arbitrary = { version = "1.4", features = ["derive"], optional = true }
 
 # Everything else
-async-trait = "0.1.52"
-chrono = "0.4.19"
-byteorder = "1.4.3"
-bytes = "1.1.0"
-derivative = "2.2.0"
-idna = "0.3.0"
-lazy_static = "1.4.0"
+async-trait = "0.1.92"
+chrono = "0.4.45"
+byteorder = "1.5.0"
+bytes = "1.12.1"
+educe = "0.7.6"
+idna = "1.1.0"
+lazy_static = "1.5.0"
 log = "0.4.14"
-num-derive = "0.3.3"
-num-traits = "0.2.14"
-rand = "0.8.4"
+num-derive = "0.5.1"
+num-traits = "0.2.19"
+rand = "0.10.2"
 regex = "1.5.4"
-strum = "0.23.0"
-strum_macros = "0.23.1"
-thiserror = "1.0.30"
+strum = "0.28.0"
+strum_macros = "0.28.0"
+thiserror = "2.0.20"
 
 ###
 
 [dev-dependencies]
-env_logger = "0.9.0"
+env_logger = "0.11.11"
 hex = "0.4.3"
 pretty_assertions = "1.0.0"
-regex = "1.5.4"
+regex = "1.13.1"
 serde = { version = "1.0.132", features = ["derive"] }
-serde_yaml = "0.8.23"
-json_comments = "0.2.0"
+yaml_serde = "0.10.7"
+json_comments = "0.2.2"
 test-env-log = "0.2.8"
-tokio = { version = "1.15.0", features = ["macros", "rt-multi-thread"] }
+tokio = { version = "1.53.1", features = ["macros", "rt-multi-thread"] }
 
 [package.metadata.cargo-all-features]
 skip_optional_dependencies = true

dig/Cargo.toml

@@ -9,17 +9,17 @@ edition = "2018"
 rustdns = { path = "../", default-features = false, features = ["clients"] }
 
 encoding8 = "0.3.2"    # Used for pretty-printing
-strum = "0.21"         # Simple macros for making Enum better
-strum_macros = "0.21"
-tokio = { version = "1.6.1", features = ["macros", "rt-multi-thread"] }
-clap = "3.0.0-beta.2"  # Command line parsing
-time = "0.2.26"
+strum = "0.28.0"         # Simple macros for making Enum better
+strum_macros = "0.28.0"
+tokio = { version = "1.53.1", features = ["macros", "rt-multi-thread"] }
+clap = "4.6.6"  # Command line parsing
+time = "0.3.55"
 url = "2.2.2"
-http = "0.2.4"
-thiserror = "1.0.30"
+http = "1.5.0"
+thiserror = "2.0.20"
 
 [dev-dependencies]
-pretty_assertions = "0.7.2"
+pretty_assertions = "1.4.1"
 
 [[bin]]
 name = "dig"

fuzz/Cargo.toml

@@ -10,7 +10,7 @@ edition = "2018"
 cargo-fuzz = true
 
 [dependencies]
-libfuzzer-sys = "0.4"
+libfuzzer-sys = "0.4.13"
 
 [dependencies.rustdns]
 path = ".."

generate_tests/Cargo.toml

@@ -7,7 +7,7 @@ edition = "2018"
 
 [dependencies]
 serde = { version = "1.0.126", features = ["derive"] }
-serde_yaml = "0.8.17"
+yaml_serde = "0.10.7"
 hex = "0.4.3"
 rustdns = { path = "../", default-features = false, features = ["udp"] }
 

generate_tests/main.rs

@@ -113,7 +113,7 @@ fn main() -> std::io::Result<()> {
 
     println!("Writing new test data to {}", TEST_DATA_FILENAME);
 
-    match serde_yaml::to_string(&output) {
+    match yaml_serde::to_string(&output) {
         Err(e) => eprintln!("Failed to serialise test results: {:?}", e),
         Ok(s) => fs::write(TEST_DATA_FILENAME, s)?,
     }

src/clients/doh.rs

@@ -1,15 +1,19 @@
 use crate::bail;
 use crate::clients::mime::content_type_equal;
+use crate::clients::stats::StatsBuilder;
 use crate::clients::AsyncExchanger;
 use crate::clients::ToUrls;
 use crate::Message;
-use crate::clients::stats::StatsBuilder;
 use async_trait::async_trait;
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
 use http::header::*;
 use http::{Method, Request};
-use hyper::client::connect::HttpInfo;
-use hyper::{Body, Client as HyperClient};
-use hyper_alpn::AlpnConnector;
+use http_body_util::{BodyExt, Full};
+use hyper::body::Bytes;
+use hyper_rustls::HttpsConnectorBuilder;
+use hyper_util::client::legacy::connect::HttpInfo;
+use hyper_util::client::legacy::Client as HyperClient;
+use hyper_util::rt::TokioExecutor;
 use std::net::IpAddr;
 use std::net::Ipv4Addr;
 use std::net::SocketAddr;
@@ -96,16 +100,17 @@ impl AsyncExchanger for Client {
 
         let p = query.to_vec()?;
 
-        // Create a Alpn client, so our connection will upgrade to HTTP/2.
-        // TODO Move the client into the struct/new()
-        // TODO Change the Connector Connect method to allow us to override the DNS
-        // resolution in the connector!
-        let alpn = AlpnConnector::new();
+        let https = HttpsConnectorBuilder::new()
+            .with_webpki_roots()
+            .https_or_http()
+            .enable_http1()
+            .enable_http2()
+            .build();
 
-        let client = HyperClient::builder()
+        let client: HyperClient<_, Full<Bytes>> = HyperClient::builder(TokioExecutor::new())
             .pool_idle_timeout(Duration::from_secs(30))
             .http2_only(true) // TODO POST stop working when this is false. Figure that out.
-            .build::<_, hyper::Body>(alpn);
+            .build(https);
 
         // Base request common to both GET and POST
         let req = Request::builder()
@@ -116,28 +121,28 @@ impl AsyncExchanger for Client {
             Method::GET => {
                 // Encode the message as a base64 string
                 let mut buf = String::new();
-                base64::encode_config_buf(p, base64::URL_SAFE_NO_PAD, &mut buf);
+                URL_SAFE_NO_PAD.encode_string(p, &mut buf);
 
                 // and add to the query params.
                 let mut url = self.servers[0].clone(); // TODO Support more than one server
                 url.query_pairs_mut().append_pair(DNS_QUERY_PARAM, &buf);
 
                 // We have to do this wierd as_str().parse() thing because the
                 // http::Uri doesn't provide a way to easily mutate or construct it.
-                let uri: hyper::Uri = url.as_str().parse()?;
-                req.uri(uri).body(Body::empty())
+                let uri: http::Uri = url.as_str().parse()?;
+                req.uri(uri).body(Full::new(Bytes::new()))?
             }
             Method::POST => {
                 req.uri(self.servers[0].as_str()) // TODO Support more than one server
                     .header(CONTENT_TYPE, CONTENT_TYPE_APPLICATION_DNS_MESSAGE)
-                    .body(Body::from(p)) // content-length header will be added.
+                    .body(Full::new(Bytes::from(p)))? // content-length header will be added.
             }
             _ => bail!(InvalidInput, "only GET and POST allowed"),
         };
 
         let stats = StatsBuilder::start(0);
 
-        let resp = client.request(req.unwrap()).await?;
+        let resp = client.request(req).await?;
         // TODO This media type restricts the maximum size of the DNS message to 65535 bytes
 
         if let Some(content_type) = resp.headers().get(CONTENT_TYPE) {
@@ -163,7 +168,7 @@ impl AsyncExchanger for Client {
             };
 
             // Read the full body
-            let body = hyper::body::to_bytes(resp.into_body()).await?;
+            let body = resp.into_body().collect().await?.to_bytes();
 
             let mut m = Message::from_slice(&body)?;
             m.stats = Some(stats.end(remote_addr, body.len()));