* fix ipv6 case for cidr.Class
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* add check and test case for invalid ipv6 cidr
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* net package is bad at detecting ipv6/ipv4
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* rename Class -> Split
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
The health endpoint histogram has a large amount of cardinality for a
simple endpoint. Introduce a new "Slim" set of buckets for `/health` to
reduce the metrics load on large deployments. Especially those that have
per-node DNS caching services.
Add a metric to count internal health check failures rather than use the
timeout value as side effect monitor of the check error. This avoids
incorrectly recording the timeout value if there is an error that is not
a timeout (ex. refused)
Signed-off-by: SuperQ <superq@gmail.com>
* deprecate normalize and mustnormalize
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* add runtime warning
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* elaborate runtime warning
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* include caller info
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* trap unsupported FROM cidr notations
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* make is a warning
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
This was found by fuzzing.
We need to make this a fully qualified domain name to catch all errors
in dnsserver/register.go and not later when plugin.Normalize() is called again on these
strings, with the prime difference being that the domain name is fully
qualified. This was found by fuzzing where "ȶ" is deemed OK, but "ȶ." is
not (might be a bug in miekg/dns actually). But here we were checking ȶ,
which is OK, and later we barf in ȶ. leading to "index out of range".
Added a tests and check manually if it would crash with the current code
(yes), and fail with an error in this PR (yes).
Signed-off-by: Miek Gieben <miek@miek.nl>
* plugin/file: Fix in wrong answers returned when wildcard and concrete records exist
Signed-off-by: Jason Du <xdu@infoblox.com>
* Remove superfluous change
Signed-off-by: Jason Du <xdu@infoblox.com>
* Re-implementation and new test case
If the domain's terminal is neither the matching wildcard, nor a domian directly
under the wildcard, return NXDOMAIN
Signed-off-by: Jason Du <xdu@infoblox.com>
* Fix empty non-terminal & add test case
Signed-off-by: Jason Du <xdu@infoblox.com>
* Cleanup
Signed-off-by: Jason Du <xdu@infoblox.com>
* Fix case on domain name with character before * and add more test cases
Signed-off-by: Jason Du <xdu@infoblox.com>
* Use different IPs for records in cornerCasesWildcard zone file
Signed-off-by: Jason Du <xdu@infoblox.com>
Make normalize return multiple "hosts" (= reverse zones) when a
non-octet boundary cidr is given.
Added pkg/cidr package that holds the cidr calculation routines; felt
they didn't really fit dnsutil.
This change means the IPNet return parameter isn't needed, the hosts are
all correct. The tests that tests this is also removed: TestSplitHostPortReverse
The fallout was that zoneAddr _also_ doesn't need the IPNet member, that
in turn make it visible that zoneAddr in address.go duplicated a bunch
of stuff from register.go; removed/refactored that too.
Created a plugin.OriginsFromArgsOrServerBlock to help plugins do the
right things, by consuming ZONE arguments; this now expands reverse
zones correctly. This is mostly mechanical.
Remove the reverse test in plugin/kubernetes which is a copy-paste from
a core test (which has since been fixed).
Remove MustNormalize as it has no plugin users.
This change is not backwards compatible to plugins that have a ZONE
argument that they parse in the setup util.
All in-tree plugins have been updated.
Signed-off-by: Miek Gieben <miek@miek.nl>
* support v1 and v1beta1 endpointslice
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* update comments
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* fix SOA response for non-apex queries
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* handle mixed case
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* do full string compare
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* plugin/rewrite: streamline the ResponseRule handling.
The functionality of a response rule is now completely encapsulated behind
a `ResponseRule` interface. This significantly simplifies the complete
processing flow, it enables more flexible response handling and it is possible
to eliminate lots of state flags, ifs and switches.
Based on the new flexibility the pull request also enables to support a
response name rewrite for all name rewrite types.
To be compatible, an explicit `answer auto` option is added to support
a best effort response rewrite (name and value).
Additionally now all name rewrite rules support additional name and value
reponse rewrite options.
Using this feature it is also possible now to rewrite a complete sub domain
hierarchy to a single domain name combined with a correct rewrite (#2389).
Signed-off-by: Uwe Krueger <uwe.krueger@sap.com>
* revert policy
Signed-off-by: Uwe Krueger <uwe.krueger@sap.com>
Co-authored-by: Miek Gieben <miek@miek.nl>
* plugin/dnssec: use entire RRset as key input
This uses the entire rrset as input for the hash key; this is to detect
differences in the RRset and generate the correct signature.
As this would then lead to unbounded growth, we periodically (every 8h)
prune the cache of old entries. In theory we could rely on the random
eviction, but it seems nicer to do this in a maintannce loop so that we
remove the unused ones. This required adding a Walk function to the
plugin/pkg/cache.
Signed-off-by: Miek Gieben <miek@miek.nl>
* Update plugin/dnssec/cache.go
Co-authored-by: Chris O'Haver <cohaver@infoblox.com>
Co-authored-by: Chris O'Haver <cohaver@infoblox.com>
* plugin/bind: exclude interface or ip address
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* fix README.md
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* Apply suggestions, Fix test
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* Apply suggestions, move errs to setup
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
To combat label cardinality explosions remove the type from metrics.
This was most severe in the histogram for request duration, remove it
there.
It's also highlighted difference between grpc and forward code, where
forward did use type and grpc didn't; getting rid of all that "fixes"
that discrepancy
Move monitor.go back into the vars directory and make it private again.
Also name it slightly better
Fixes: #4507
Signed-off-by: Miek Gieben <miek@miek.nl>
When the interface doesn't exist you get:
plugin/bind: not a valid IP address: eth0
Fix the wording that this can also be interface name. Also %q the
argument in the error mesg.
Signed-off-by: Miek Gieben <miek@miek.nl>
* Discard link-local addresses on binding
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* Update plugin/bind: README.md
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* Except for IPv6 link-local only
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* auto make -f Makefile.doc
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* Bind by interface name
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* README.md: Interface with multiple address
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* auto make -f Makefile.doc
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* auto make -f Makefile.doc
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* Elaborate more on the behaviour in README.md, revert man/*, fix tests
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* auto make -f Makefile.doc
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* --sign-off
Revert man/* to fix DCO check
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
* auto make -f Makefile.doc
* Revert man/* to fix DCO check
Signed-off-by: Mohammad Yosefpor <myusefpur@gmail.com>
Co-authored-by: coredns-auto-go-mod-tidy[bot] <coredns-auto-go-mod-tidy[bot]@users.noreply.github.com>
* transfer: reply with refused
When the *transfer* plugin is not loaded and of the handlers will still
see the AXFR/IXFR request because it is not intercepted.
They need to reply with REFUSED in that case. Update file, auto and k8s
to do this. Add testcase in the file plugin.
Ideally *erratic* should be moved over as well, but maybe that's
*erratic*
This is a bug fix.
Signed-off-by: Miek Gieben <miek@miek.nl>
* import path
Signed-off-by: Miek Gieben <miek@miek.nl>
When err=nil try to determine the version of the k8s cluster and disable
endpoint slices. Don't return from connecting to the cluster.
In the future we should just default to true, and delete all this code.
Signed-off-by: Miek Gieben <miek@miek.nl>
* Rewrite plugin - rewrite SRV targets and names in response answer and additional records
Signed-off-by: Nic Colledge <nic@njcolledge.net>
* Added README content to describe new behaviour
Signed-off-by: Nic Colledge <nic@njcolledge.net>
* Added more record types to rewrite handling based on PR/Issue feedback
Signed-off-by: Nic Colledge <nic@njcolledge.net>
* Updated README.md for plugin
Signed-off-by: Nic Colledge <nic@njcolledge.net>
* Updated unit tests.
Small refactor of getTarget... function.
Signed-off-by: Nic Colledge <nic@njcolledge.net>
* Refactor to add response value rewrite as answer value option
Signed-off-by: Nic Colledge <nic@njcolledge.net>
* Removed TODO comment, added test for NAPTR record.
Signed-off-by: Nic Colledge <nic@njcolledge.net>
* plugin/sign: track zone file's mtime
Resign if the original zone's mtime is change in some way.
Closes#4407
Signed-off-by: Miek Gieben <miek@miek.nl>
* Update plugin/sign/README.md
Co-authored-by: Chris O'Haver <cohaver@infoblox.com>
Co-authored-by: Yong Tang <yong.tang.github@outlook.com>
Co-authored-by: Chris O'Haver <cohaver@infoblox.com>
