Skip to content

C
Coredns
Commit 9ba31ceb authored by Miek Gieben's avatar Miek Gieben
Browse files
Options

Think about wildcards

parent ec69798c
Hide whitespace changes
Inline Side-by-side
Showing with 230 additions and 150 deletions
middleware/file/lookup.go
View file @ 9ba31ceb
...@@ -35,8 +35,9 @@ func (z *Zone) Lookup(qname string, qtype uint16, do bool) ([]dns.RR, []dns.RR, ...@@ -35,8 +35,9 @@ func (z *Zone) Lookup(qname string, qtype uint16, do bool) ([]dns.RR, []dns.RR,
elem := z.Tree.Get(rr) elem := z.Tree.Get(rr)
if elem == nil { if elem == nil {
// wildcard lookup if elem == nil {
return z.nameError(elem, rr, do) return z.nameError(elem, rr, do)
}
} }
rrs := elem.Types(dns.TypeCNAME) rrs := elem.Types(dns.TypeCNAME)
...@@ -71,10 +72,7 @@ func (z *Zone) nameError(elem *tree.Elem, rr dns.RR, do bool) ([]dns.RR, []dns.R ...@@ -71,10 +72,7 @@ func (z *Zone) nameError(elem *tree.Elem, rr dns.RR, do bool) ([]dns.RR, []dns.R
if do { if do {
ret = append(ret, z.SIG...) ret = append(ret, z.SIG...)
// Now we need two NSEC, one to deny the wildcard and one to deny the name. // Now we need two NSEC, one to deny the wildcard and one to deny the name.
elem := z.Tree.Prev(rr) // Needs closest encloser!!
ret = append(ret, z.lookupNSEC(elem, do))
elem = z.Tree.Prev(wildcard(rr))
ret = append(ret, z.lookupNSEC(elem, do))
} }
return nil, ret, nil, NameError return nil, ret, nil, NameError
} }
...@@ -142,12 +140,3 @@ func signatureForSubType(rrs []dns.RR, subtype uint16) []dns.RR { ...@@ -142,12 +140,3 @@ func signatureForSubType(rrs []dns.RR, subtype uint16) []dns.RR {
} }
return sigs return sigs
} }
// wildcard returns rr with the first label exchanged for a wildcard '*'.
func wildcard(rr dns.RR) dns.RR {
// root label, TODO(miek)
s := rr.Header().Name
i, _ := dns.NextLabel(s, 0)
rr.Header().Name = "*" + s[i:]
return rr
}
middleware/file/lookup_test.go
View file @ 9ba31ceb
...@@ -60,7 +60,10 @@ var dnsTestCases = []coretest.Case{ ...@@ -60,7 +60,10 @@ var dnsTestCases = []coretest.Case{
}, },
} }
const testzone = "miek.nl." const (
testzone = "miek.nl."
testzone1 = "dnssex.nl."
)
func TestLookup(t *testing.T) { func TestLookup(t *testing.T) {
zone, err := Parse(strings.NewReader(dbMiekNL), testzone, "stdin") zone, err := Parse(strings.NewReader(dbMiekNL), testzone, "stdin")
......
middleware/file/wildcard.test.go deleted 100644 → 0
View file @ ec69798c
package file
import (
"sort"
"strings"
"testing"
"github.com/miekg/coredns/middleware"
coretest "github.com/miekg/coredns/middleware/testing"
"github.com/miekg/dns"
"golang.org/x/net/context"
)
var dnssecWildcardTestCases = []coretest.Case{
{
Qname: "miek.nl.", Qtype: dns.TypeSOA, Do: true,
Answer: []dns.RR{
// because we sort, this look fishy, but it is OK.
coretest.RRSIG("miek.nl. 1800 IN RRSIG SOA 8 2 1800 20160426031301 20160327031301 12051 miek.nl. FIrzy07acBbtyQczy1dc="),
coretest.SOA("miek.nl. 1800 IN SOA linode.atoom.net. miek.miek.nl. 1282630057 14400 3600 604800 14400"),
},
},
{
Qname: "miek.nl.", Qtype: dns.TypeAAAA, Do: true,
Answer: []dns.RR{
coretest.AAAA("miek.nl. 1800 IN AAAA 2a01:7e00::f03c:91ff:fef1:6735"),
coretest.RRSIG("miek.nl. 1800 IN RRSIG AAAA 8 2 1800 20160426031301 20160327031301 12051 miek.nl. SsRT="),
},
},
{
Qname: "miek.nl.", Qtype: dns.TypeMX, Do: true,
Answer: []dns.RR{
coretest.MX("miek.nl. 1800 IN MX 1 aspmx.l.google.com."),
coretest.MX("miek.nl. 1800 IN MX 10 aspmx2.googlemail.com."),
coretest.MX("miek.nl. 1800 IN MX 10 aspmx3.googlemail.com."),
coretest.MX("miek.nl. 1800 IN MX 5 alt1.aspmx.l.google.com."),
coretest.MX("miek.nl. 1800 IN MX 5 alt2.aspmx.l.google.com."),
coretest.RRSIG("miek.nl. 1800 IN RRSIG MX 8 2 1800 20160426031301 20160327031301 12051 miek.nl. kLqG+iOr="),
},
},
{
Qname: "www.miek.nl.", Qtype: dns.TypeA, Do: true,
Answer: []dns.RR{
coretest.CNAME("www.miek.nl. 1800 IN CNAME a.miek.nl."),
},
Extra: []dns.RR{
coretest.A("a.miek.nl. 1800 IN A 139.162.196.78"),
coretest.RRSIG("a.miek.nl. 1800 IN RRSIG A 8 3 1800 20160426031301 20160327031301 12051 miek.nl. lxLotCjWZ3kihTxk="),
},
},
{
// NoData
Qname: "a.miek.nl.", Qtype: dns.TypeSRV, Do: true,
Ns: []dns.RR{
coretest.NSEC("a.miek.nl. 14400 IN NSEC archive.miek.nl. A AAAA RRSIG NSEC"),
coretest.RRSIG("a.miek.nl. 14400 IN RRSIG NSEC 8 3 14400 20160426031301 20160327031301 12051 miek.nl. GqnF6cutipmSHEao="),
coretest.RRSIG("miek.nl. 1800 IN RRSIG SOA 8 2 1800 20160426031301 20160327031301 12051 miek.nl. FIrzy07acBbtyQczy1dc="),
coretest.SOA("miek.nl. 1800 IN SOA linode.atoom.net. miek.miek.nl. 1282630057 14400 3600 604800 14400"),
},
},
/* HAHA nsec... shit.
// disprove *.miek.nl and that b.miek.nl does not exist
{
Qname: "b.miek.nl.", Qtype: dns.TypeA,
Rcode: dns.RcodeNameError,
Ns: []dns.RR{
coretest.SOA("miek.nl. 1800 IN SOA linode.atoom.net. miek.miek.nl. 1282630057 14400 3600 604800 14400"),
},
},
*/
}
func testLookupDNSSECWildcard(t *testing.T) {
zone, err := Parse(strings.NewReader(dbMiekNL_signed), testzone, "stdin")
if err != nil {
t.Fatalf("expect no error when reading zone, got %q", err)
}
fm := File{Next: coretest.ErrorHandler(), Zones: Zones{Z: map[string]*Zone{testzone: zone}, Names: []string{testzone}}}
ctx := context.TODO()
for _, tc := range dnssecWildcardTestCases {
m := tc.Msg()
rec := middleware.NewResponseRecorder(&middleware.TestResponseWriter{})
_, err := fm.ServeDNS(ctx, rec, m)
if err != nil {
t.Errorf("expected no error, got %v\n", err)
return
}
resp := rec.Msg()
sort.Sort(coretest.RRSet(resp.Answer))
sort.Sort(coretest.RRSet(resp.Ns))
sort.Sort(coretest.RRSet(resp.Extra))
if resp.Rcode != tc.Rcode {
t.Errorf("rcode is %q, expected %q", dns.RcodeToString[resp.Rcode], dns.RcodeToString[tc.Rcode])
t.Logf("%v\n", resp)
continue
}
if len(resp.Answer) != len(tc.Answer) {
t.Errorf("answer for %q contained %d results, %d expected", tc.Qname, len(resp.Answer), len(tc.Answer))
t.Logf("%v\n", resp)
continue
}
if len(resp.Ns) != len(tc.Ns) {
t.Errorf("authority for %q contained %d results, %d expected", tc.Qname, len(resp.Ns), len(tc.Ns))
t.Logf("%v\n", resp)
continue
}
if len(resp.Extra) != len(tc.Extra) {
t.Errorf("additional for %q contained %d results, %d expected", tc.Qname, len(resp.Extra), len(tc.Extra))
t.Logf("%v\n", resp)
continue
}
if !coretest.CheckSection(t, tc, coretest.Answer, resp.Answer) {
t.Logf("%v\n", resp)
}
if !coretest.CheckSection(t, tc, coretest.Ns, resp.Ns) {
t.Logf("%v\n", resp)
}
if !coretest.CheckSection(t, tc, coretest.Extra, resp.Extra) {
t.Logf("%v\n", resp)
}
}
}
const dbMiekNL_wildcard_signed = `§`
middleware/file/wildcard_test.go 0 → 100644
View file @ 9ba31ceb
package file
import (
"sort"
"strings"
"testing"
"github.com/miekg/coredns/middleware"
coretest "github.com/miekg/coredns/middleware/testing"
"github.com/miekg/dns"
"golang.org/x/net/context"
)
var dnssecWildcardTestCases = []coretest.Case{
{
Qname: "blaat.dnssex.nl.", Qtype: dns.TypeTXT, Do: true,
Answer: []dns.RR{},
},
}
func testLookupDNSSECWildcard(t *testing.T) {
zone, err := Parse(strings.NewReader(dbMiekNL_signed), testzone1, "stdin")
if err != nil {
t.Fatalf("expect no error when reading zone, got %q", err)
}
fm := File{Next: coretest.ErrorHandler(), Zones: Zones{Z: map[string]*Zone{testzone1: zone}, Names: []string{testzone1}}}
ctx := context.TODO()
for _, tc := range dnssecWildcardTestCases {
m := tc.Msg()
rec := middleware.NewResponseRecorder(&middleware.TestResponseWriter{})
_, err := fm.ServeDNS(ctx, rec, m)
if err != nil {
t.Errorf("expected no error, got %v\n", err)
return
}
resp := rec.Msg()
sort.Sort(coretest.RRSet(resp.Answer))
sort.Sort(coretest.RRSet(resp.Ns))
sort.Sort(coretest.RRSet(resp.Extra))
if resp.Rcode != tc.Rcode {
t.Errorf("rcode is %q, expected %q", dns.RcodeToString[resp.Rcode], dns.RcodeToString[tc.Rcode])
t.Logf("%v\n", resp)
continue
}
if len(resp.Answer) != len(tc.Answer) {
t.Errorf("answer for %q contained %d results, %d expected", tc.Qname, len(resp.Answer), len(tc.Answer))
t.Logf("%v\n", resp)
continue
}
if len(resp.Ns) != len(tc.Ns) {
t.Errorf("authority for %q contained %d results, %d expected", tc.Qname, len(resp.Ns), len(tc.Ns))
t.Logf("%v\n", resp)
continue
}
if len(resp.Extra) != len(tc.Extra) {
t.Errorf("additional for %q contained %d results, %d expected", tc.Qname, len(resp.Extra), len(tc.Extra))
t.Logf("%v\n", resp)
continue
}
if !coretest.CheckSection(t, tc, coretest.Answer, resp.Answer) {
t.Logf("%v\n", resp)
}
if !coretest.CheckSection(t, tc, coretest.Ns, resp.Ns) {
t.Logf("%v\n", resp)
}
if !coretest.CheckSection(t, tc, coretest.Extra, resp.Extra) {
t.Logf("%v\n", resp)
}
}
}
const dbMiekNL_wildcard_signed = `
; File written on Tue Mar 29 21:02:24 2016
; dnssec_signzone version 9.10.3-P4-Ubuntu
dnssex.nl. 1800 IN SOA linode.atoom.net. miek.miek.nl. (
1459281744 ; serial
14400 ; refresh (4 hours)
3600 ; retry (1 hour)
604800 ; expire (1 week)
14400 ; minimum (4 hours)
)
1800 RRSIG SOA 8 2 1800 (
20160428190224 20160329190224 14460 dnssex.nl.
CA/Y3m9hCOiKC/8ieSOv8SeP964BUdG/8MC3
WtKljUosK9Z9bBGrVizDjjqgq++lyH8BZJcT
aabAsERs4xj5PRtcxicwQXZACX5VYjXHQeZm
CyytFU5wq2gcXSmvUH86zZzftx3RGPvn1aOo
TlcvoC3iF8fYUCpROlUS0YR8Cdw= )
1800 NS omval.tednet.nl.
1800 NS linode.atoom.net.
1800 NS ns-ext.nlnetlabs.nl.
1800 RRSIG NS 8 2 1800 (
20160428190224 20160329190224 14460 dnssex.nl.
dLIeEvP86jj5nd3orv9bH7hTvkblF4Na0sbl
k6fJA6ha+FPN1d6Pig3NNEEVQ/+wlOp/JTs2
v07L7roEEUCbBprI8gMSld2gFDwNLW3DAB4M
WD/oayYdAnumekcLzhgvWixTABjWAGRTGQsP
sVDFXsGMf9TGGC9FEomgkCVeNC0= )
1800 A 139.162.196.78
1800 RRSIG A 8 2 1800 (
20160428190224 20160329190224 14460 dnssex.nl.
LKJKLzPiSEDWOLAag2YpfD5EJCuDcEAJu+FZ
Xy+4VyOv9YvRHCTL4vbrevOo5+XymY2RxU1q
j+6leR/Fe7nlreSj2wzAAk2bIYn4m6r7hqeO
aKZsUFfpX8cNcFtGEywfHndCPELbRxFeEziP
utqHFLPNMX5nYCpS28w4oJ5sAnM= )
1800 TXT "Doing It Safe Is Better"
1800 RRSIG TXT 8 2 1800 (
20160428190224 20160329190224 14460 dnssex.nl.
f6S+DUfJK1UYdOb3AHgUXzFTTtu+yLp/Fv7S
Hv0CAGhXAVw+nBbK719igFvBtObS33WKwzxD
1pQNMaJcS6zeevtD+4PKB1KDC4fyJffeEZT6
E30jGR8Y29/xA+Fa4lqDNnj9zP3b8TiABCle
ascY5abkgWCALLocFAzFJQ/27YQ= )
1800 AAAA 2a01:7e00::f03c:91ff:fef1:6735
1800 RRSIG AAAA 8 2 1800 (
20160428190224 20160329190224 14460 dnssex.nl.
PWcPSawEUBAfCuv0liEOQ8RYe7tfNW4rubIJ
LE+dbrub1DUer3cWrDoCYFtOufvcbkYJQ2CQ
AGjJmAQ5J2aqYDOPMrKa615V0KT3ifbZJcGC
gkIic4U/EXjaQpRoLdDzR9MyVXOmbA6sKYzj
ju1cNkLqM8D7Uunjl4pIr6rdSFo= )
14400 NSEC *.dnssex.nl. A NS SOA TXT AAAA RRSIG NSEC DNSKEY
14400 RRSIG NSEC 8 2 14400 (
20160428190224 20160329190224 14460 dnssex.nl.
oIvM6JZIlNc1aNKGTxv58ApSnDr1nDPPgnD9
9oJZRIn7eb5WnpeDz2H3z5+x6Bhlp5hJJaUp
KJ3Ss6Jg/IDnrmIvKmgq6L6gHj1Y1IiHmmU8
VeZTRzdTsDx/27OsN23roIvsytjveNSEMfIm
iLZ23x5kg1kBdJ9p3xjYHm5lR+8= )
1800 DNSKEY 256 3 8 (
AwEAAazSO6uvLPEVknDA8yxjFe8nnAMU7txp
wb19k55hQ81WV3G4bpBM1NdN6sbYHrkXaTNx
2bQWAkvX6pz0XFx3z/MPhW+vkakIWFYpyQ7R
AT5LIJfToVfiCDiyhhF0zVobKBInO9eoGjd9
BAW3TUt+LmNAO/Ak5D5BX7R3CuA7v9k7
) ; ZSK; alg = RSASHA256; key id = 14460
1800 DNSKEY 257 3 8 (
AwEAAbyeaV9zg0IqdtgYoqK5jJ239anzwG2i
gvH1DxSazLyaoNvEkCIvPgMLW/JWfy7Z1mQp
SMy9DtzL5pzRyQgw7kIeXLbi6jufUFd9pxN+
xnzKLf9mY5AcnGToTrbSL+jnMT67wG+c34+Q
PeVfucHNUePBxsbz2+4xbXiViSQyCQGv
) ; KSK; alg = RSASHA256; key id = 18772
1800 RRSIG DNSKEY 8 2 1800 (
20160428190224 20160329190224 14460 dnssex.nl.
cFSFtJE+DBGNxb52AweFaVHBe5Ue5MDpqNdC
TIneUnEhP2m+vK4zJ/TraK0WdQFpsX63pod8
PZ9y03vHUfewivyonCCBD3DcNdoU9subhN22
tez9Ct8Z5/9E4RAz7orXal4M1VUEhRcXSEH8
SJW20mfVsqJAiKqqNeGB/pAj23I= )
1800 RRSIG DNSKEY 8 2 1800 (
20160428190224 20160329190224 18772 dnssex.nl.
oiiwo/7NYacePqohEp50261elhm6Dieh4j2S
VZGAHU5gqLIQeW9CxKJKtSCkBVgUo4cvO4Rn
2tzArAuclDvBrMXRIoct8u7f96moeFE+x5FI
DYqICiV6k449ljj9o4t/5G7q2CRsEfxZKpTI
A/L0+uDk0RwVVzL45+TnilcsmZs= )
*.dnssex.nl. 1800 IN TXT "Doing It Safe Is Better"
1800 RRSIG TXT 8 2 1800 (
20160428190224 20160329190224 14460 dnssex.nl.
FUZSTyvZfeuuOpCmNzVKOfITRHJ6/ygjmnnb
XGBxVUyQjoLuYXwD5XqZWGw4iKH6QeSDfGCx
4MPqA4qQmW7Wwth7mat9yMfA4+p2sO84bysl
7/BG9+W2G+q1uQiM9bX9V42P2X/XuW5Y/t9Y
8u1sljQ7D8WwS6naH/vbaJxnDBw= )
14400 NSEC a.dnssex.nl. TXT RRSIG NSEC
14400 RRSIG NSEC 8 2 14400 (
20160428190224 20160329190224 14460 dnssex.nl.
os6INm6q2eXknD5z8TpfbK00uxVbQefMvHcR
/RNX/kh0xXvzAaaDOV+Ge/Ko+2dXnKP+J1LY
G9ffXNpdbaQy5ygzH5F041GJst4566GdG/jt
7Z7vLHYxEBTpZfxo+PLsXQXH3VTemZyuWyDf
qJzafXJVH1F0nDrcXmMlR6jlBHA= )
www.dnssex.nl. 1800 IN CNAME a.dnssex.nl.
1800 RRSIG CNAME 8 3 1800 (
20160428190224 20160329190224 14460 dnssex.nl.
Omv42q/uVvdNsWQoSrQ6m6w6U7r7Abga7uF4
25b3gZlse0C+WyMyGFMGUbapQm7azvBpreeo
uKJHjzd+ufoG+Oul6vU9vyoj+ejgHzGLGbJQ
HftfP+UqP5SWvAaipP/LULTWKPuiBcLDLiBI
PGTfsq0DB6R+qCDTV0fNnkgxEBQ= )
14400 NSEC dnssex.nl. CNAME RRSIG NSEC
14400 RRSIG NSEC 8 3 14400 (
20160428190224 20160329190224 14460 dnssex.nl.
TBN3ddfZW+kC84/g3QlNNJMeLZoyCalPQylt
KXXLPGuxfGpl3RYRY8KaHbP+5a8MnHjqjuMB
Lofb7yKMFxpSzMh8E36vnOqry1mvkSakNj9y
9jM8PwDjcpYUwn/ql76MsmNgEV5CLeQ7lyH4
AOrL79yOSQVI3JHJIjKSiz88iSw= )
a.dnssex.nl. 1800 IN A 139.162.196.78
1800 RRSIG A 8 3 1800 (
20160428190224 20160329190224 14460 dnssex.nl.
OXHpFj9nSpKi5yA/ULH7MOpGAWfyJ2yC/2xa
Pw0fqSY4QvcRt+V3adcFA4H9+P1b32GpxEjB
lXmCJID+H4lYkhUR4r4IOZBVtKG2SJEBZXip
pH00UkOIBiXxbGzfX8VL04v2G/YxUgLW57kA
aknaeTOkJsO20Y+8wmR9EtzaRFI= )
1800 AAAA 2a01:7e00::f03c:91ff:fef1:6735
1800 RRSIG AAAA 8 3 1800 (
20160428190224 20160329190224 14460 dnssex.nl.
jrepc/VnRzJypnrG0WDEqaAr3HMjWrPxJNX0
86gbFjZG07QxBmrA1rj0jM9YEWTjjyWb2tT7
lQhzKDYX/0XdOVUeeOM4FoSks80V+pWR8fvj
AZ5HmX69g36tLosMDKNR4lXcrpv89QovG4Hr
/r58fxEKEFJqrLDjMo6aOrg+uKA= )
14400 NSEC www.dnssex.nl. A AAAA RRSIG NSEC
14400 RRSIG NSEC 8 3 14400 (
20160428190224 20160329190224 14460 dnssex.nl.
S+UM62wXRNNFN3QDWK5YFWUbHBXC4aqaqinZ
A2ZDeC+IQgyw7vazPz7cLI5T0YXXks0HTMlr
soEjKnnRZsqSO9EuUavPNE1hh11Jjm0fB+5+
+Uro0EmA5Dhgc0Z2VpbXVQEhNDf/pI1gem15
RffN2tBYNykZn4Has2ySgRaaRYQ= )`
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment