hestiacp/func/internal/dns_record_validator.php

<?php

declare(strict_types=1);

if (!isset($argv[1], $argv[2], $argv[3])) {
	$error_json = [
		"valid" => false,
		"error_message" => "record, rtype, and priority arguments are required",
	];
	echo json_encode(
		$error_json,
		JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR,
	);
	exit(1);
}

$record = $argv[1];
$rtype = $argv[2];
$priority = $argv[3];
$known_types = [
	"A",
	"AAAA",
	"NS",
	"CNAME",
	"MX",
	"TXT",
	"SRV",
	"DNSKEY",
	"KEY",
	"IPSECKEY",
	"PTR",
	"SPF",
	"TLSA",
	"CAA",
	"DS",
];
$valid = true;
$error_message = null;
$cleaned_record = null;
$new_priority = null;

$validateInt = static function ($value, $min, $max) {
	return filter_var($value, FILTER_VALIDATE_INT, [
		"options" => ["min_range" => $min, "max_range" => $max],
	]);
};
$validateDomain = static function ($value) {
	return filter_var(rtrim($value, "."), FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME);
};
$validateHex = static function ($value) {
	return preg_match('/^[A-Fa-f0-9]+$/', $value) === 1;
};
$validateBase64 = static function ($value) {
	if ($value === "" || preg_match("/[^A-Za-z0-9+\/=]/", $value)) {
		return false;
	}
	return base64_decode($value, true) !== false;
};
$validatePrintableAscii = static function ($value) {
	return !preg_match('/[^\x20-\x7E]/', $value);
};
$validateSrvTarget = static function ($value) use ($validateDomain) {
	return $value === "." || $validateDomain($value);
};

if (!in_array($rtype, $known_types, true)) {
	$valid = false;
	$error_message = "unknown record type for validation: $rtype";
} elseif ($rtype === "A") {
	$valid = filter_var($record, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4);
	if (!$valid) {
		$error_message = "invalid A record format";
	}
} elseif ($rtype === "AAAA") {
	$valid = filter_var($record, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6);
	if (!$valid) {
		$error_message = "invalid AAAA record format";
	}
} elseif ($rtype === "NS" || $rtype === "CNAME" || $rtype === "PTR") {
	$valid = $validateDomain($record);
	if (!$valid) {
		$error_message = "invalid $rtype record format";
	}
} elseif ($rtype === "MX") {
	$valid = $validateDomain($record);
	if (!$valid) {
		$error_message = "invalid MX record format";
	} else {
		if ($priority === "") {
			$valid = false;
			$error_message = "MX record priority is required";
		} else {
			$valid = $validateInt($priority, 0, 65535);
			if ($valid === false) {
				$error_message = "invalid MX record priority format (must be between 0 and 65535)";
			}
		}
	}
} elseif ($rtype === "SRV") {
	$parts = preg_split("/\s+/", trim($record));
	$parts_count = count($parts);
	$target = null;
	$port = null;
	$weight = null;
	$priority_to_use = $priority;

	if ($parts_count === 4) {
		[$priority_from_value, $weight, $port, $target] = $parts;
		$priority_to_use = $priority_from_value;
	} elseif ($parts_count === 3) {
		if ($validateSrvTarget($parts[0])) {
			[$target, $port, $weight] = $parts;
		} elseif ($validateSrvTarget($parts[2])) {
			[$weight, $port, $target] = $parts;
		} else {
			$valid = false;
			$error_message = "invalid SRV record format (expected target with port and weight)";
		}
	} else {
		$valid = false;
		$error_message =
			"invalid SRV record format (must contain priority weight port target or target port weight)";
	}

	if ($valid !== false) {
		$priority_validated = $validateInt($priority_to_use, 0, 65535);
		$weight_validated = $validateInt($weight, 0, 65535);
		$port_validated = $validateInt($port, 0, 65535);
		$target_validated = $validateSrvTarget($target ?? "");

		if ($priority_validated === false) {
			$valid = false;
			$error_message = "invalid SRV record priority format (must be between 0 and 65535)";
		} elseif ($weight_validated === false) {
			$valid = false;
			$error_message = "invalid SRV record weight format (must be between 0 and 65535)";
		} elseif ($port_validated === false) {
			$valid = false;
			$error_message = "invalid SRV record port format (must be between 0 and 65535)";
		} elseif (!$target_validated) {
			$valid = false;
			$error_message = "invalid SRV record target format";
		} else {
			$new_priority = $priority_validated;
			$cleaned_record = $weight_validated . " " . $port_validated . " " . $target;
		}
	}
} elseif ($rtype === "TXT" || $rtype === "SPF") {
	if ($record === "") {
		$valid = false;
		$error_message = "$rtype record cannot be empty";
	} elseif (strlen($record) > 65535) {
		$valid = false;
		$error_message = "$rtype record exceeds maximum length";
	} elseif (!$validatePrintableAscii($record)) {
		$valid = false;
		$error_message = "$rtype record contains non-ASCII characters";
	}
} elseif ($rtype === "DNSKEY" || $rtype === "KEY") {
	$parts = preg_split("/\s+/", trim($record));
	if (count($parts) < 3) {
		$valid = false;
		$error_message = "invalid $rtype record format (expected flags protocol algorithm [public-key])";
	} else {
		[$flags, $protocol, $algorithm] = array_slice($parts, 0, 3);
		$public_key = implode(" ", array_slice($parts, 3));
		$flags_valid = $validateInt($flags, 0, 65535);
		$protocol_valid = $validateInt($protocol, 0, 255);
		$algorithm_valid = $validateInt($algorithm, 0, 255);
		if ($rtype === "DNSKEY" && $protocol !== "3") {
			$protocol_valid = false;
		}
		if ($flags_valid === false || $protocol_valid === false || $algorithm_valid === false) {
			$valid = false;
			$error_message = "invalid $rtype numeric fields";
		} elseif ($rtype === "KEY" && $algorithm === "0") {
			if ($public_key !== "") {
				$valid = false;
				$error_message = "invalid KEY public key for algorithm 0 (must be empty)";
			}
		} elseif ($public_key === "" || !$validateBase64($public_key)) {
			$valid = false;
			$error_message = "invalid $rtype public key (must be base64)";
		}
	}
} elseif ($rtype === "IPSECKEY") {
	$parts = preg_split("/\s+/", trim($record));
	if (count($parts) < 4) {
		$valid = false;
		$error_message =
			"invalid IPSECKEY record format (expected precedence gateway-type algorithm gateway [public-key])";
	} else {
		[$precedence, $gateway_type, $algorithm, $gateway] = array_slice($parts, 0, 4);
		$public_key = implode(" ", array_slice($parts, 4));
		$precedence_valid = $validateInt($precedence, 0, 255);
		$gateway_type_valid = $validateInt($gateway_type, 0, 3);
		$algorithm_valid = $validateInt($algorithm, 0, 255);
		if (
			$precedence_valid === false ||
			$gateway_type_valid === false ||
			$algorithm_valid === false
		) {
			$valid = false;
			$error_message = "invalid IPSECKEY numeric fields";
		} else {
			if ($gateway_type === "0") {
				if ($gateway !== "." && $gateway !== "") {
					$valid = false;
					$error_message = "invalid IPSECKEY gateway for type 0";
				}
			} elseif ($gateway_type === "1") {
				if (!filter_var($gateway, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
					$valid = false;
					$error_message = "invalid IPSECKEY IPv4 gateway";
				}
			} elseif ($gateway_type === "2") {
				if (!filter_var($gateway, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
					$valid = false;
					$error_message = "invalid IPSECKEY IPv6 gateway";
				}
			} else {
				if (!$validateDomain($gateway)) {
					$valid = false;
					$error_message = "invalid IPSECKEY domain gateway";
				}
			}
			if ($valid !== false) {
				if ($algorithm === "0") {
					if ($public_key !== "") {
						$valid = false;
						$error_message =
							"invalid IPSECKEY public key for algorithm 0 (must be empty)";
					}
				} elseif ($public_key === "" || !$validateBase64($public_key)) {
					$valid = false;
					$error_message = "invalid IPSECKEY public key (must be base64)";
				}
			}
		}
	}
} elseif ($rtype === "TLSA") {
	$parts = preg_split("/\s+/", trim($record));
	if (count($parts) < 4) {
		$valid = false;
		$error_message = "invalid TLSA record format (expected usage selector matching-type data)";
	} else {
		[$usage, $selector, $matching_type] = array_slice($parts, 0, 3);
		$data = implode(" ", array_slice($parts, 3));
		$usage_valid = $validateInt($usage, 0, 3);
		$selector_valid = $validateInt($selector, 0, 1);
		$matching_valid = $validateInt($matching_type, 0, 2);
		$data_length = strlen($data);
		if ($usage_valid === false || $selector_valid === false || $matching_valid === false) {
			$valid = false;
			$error_message = "invalid TLSA numeric fields";
		} elseif ($data === "" || !$validateHex($data) || $data_length % 2 !== 0) {
			$valid = false;
			$error_message = "invalid TLSA data";
		} elseif ($matching_valid === 1 && $data_length !== 64) {
			$valid = false;
			$error_message = "invalid TLSA data length for matching type 1";
		} elseif ($matching_valid === 2 && $data_length !== 128) {
			$valid = false;
			$error_message = "invalid TLSA data length for matching type 2";
		}
	}
} elseif ($rtype === "CAA") {
	$parts = preg_split("/\s+/", trim($record), 3);
	if (count($parts) < 3) {
		$valid = false;
		$error_message = "invalid CAA record format (expected flag tag value)";
	} else {
		[$flag, $tag, $value] = $parts;
		$flag_valid = $validateInt($flag, 0, 255);
		$tag_valid = preg_match('/^[A-Za-z0-9-]{1,63}$/', $tag);
		if ($flag_valid === false || $tag_valid === 0) {
			$valid = false;
			$error_message = "invalid CAA flag or tag";
		} elseif ($value === "") {
			$valid = false;
			$error_message = "invalid CAA value";
		}
	}
} elseif ($rtype === "DS") {
	$parts = preg_split("/\s+/", trim($record));
	if (count($parts) < 4) {
		$valid = false;
		$error_message = "invalid DS record format (expected keytag algorithm digest-type digest)";
	} else {
		[$key_tag, $algorithm, $digest_type] = array_slice($parts, 0, 3);
		$digest = implode(" ", array_slice($parts, 3));
		$key_tag_valid = $validateInt($key_tag, 0, 65535);
		$algorithm_valid = $validateInt($algorithm, 0, 255);
		$digest_type_valid = $validateInt($digest_type, 0, 255);
		$digest_lengths = [1 => 40, 2 => 64, 3 => 64, 4 => 96];
		$digest_length = strlen($digest);
		if (
			$key_tag_valid === false ||
			$algorithm_valid === false ||
			$digest_type_valid === false
		) {
			$valid = false;
			$error_message = "invalid DS numeric fields";
		} elseif ($digest === "" || !$validateHex($digest) || $digest_length % 2 !== 0) {
			$valid = false;
			$error_message = "invalid DS digest";
		} elseif (
			array_key_exists((int) $digest_type, $digest_lengths) &&
			$digest_length !== $digest_lengths[(int) $digest_type]
		) {
			$valid = false;
			$error_message = "invalid DS digest length for type $digest_type";
		}
	}
} else {
	$valid = false;
	$error_message = "validation not implemented for record type: $rtype";
}

$json = ["valid" => $valid !== false];
if ($error_message !== null) {
	$json["error_message"] = $error_message;
}
if ($cleaned_record !== null) {
	$json["cleaned_record"] = $cleaned_record;
}
if ($new_priority !== null) {
	$json["new_priority"] = $new_priority;
}
echo json_encode($json, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR);