Commit graph

18 commits

Author SHA1 Message Date
Yong Tang
c6709d930f
Fix security scans by cleaning up file path (#5185)
While performing security scans there were several
issue raised as G304 (CWE-22): Potential file inclusion via variable.
As some files path are taken from user input, it is possible the
filepath passed by user may have unintended effect if not properly formed.
This fix add Clean to remove the security warning and address some
potential issue.

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
2022-02-14 11:24:21 -05:00
Zou Nengren
5191959bd7
cleanup deprecated package io/ioutil (#4920)
Signed-off-by: zounengren <zouyee1989@gmail.com>
2021-10-13 09:30:31 +02:00
Miek Gieben
5f41d8eb1f
reverse zone: fix Normalize (#4621)
Make normalize return multiple "hosts" (= reverse zones) when a
non-octet boundary cidr is given.

Added pkg/cidr package that holds the cidr calculation routines; felt
they didn't really fit dnsutil.

This change means the IPNet return parameter isn't needed, the hosts are
all correct. The tests that tests this is also removed: TestSplitHostPortReverse
The fallout was that zoneAddr _also_ doesn't need the IPNet member, that
in turn make it visible that zoneAddr in address.go duplicated a bunch
of stuff from register.go; removed/refactored that too.

Created a plugin.OriginsFromArgsOrServerBlock to help plugins do the
right things, by consuming ZONE arguments; this now expands reverse
zones correctly. This is mostly mechanical.

Remove the reverse test in plugin/kubernetes which is a copy-paste from
a core test (which has since been fixed).

Remove MustNormalize as it has no plugin users.

This change is not backwards compatible to plugins that have a ZONE
argument that they parse in the setup util.

All in-tree plugins have been updated.

Signed-off-by: Miek Gieben <miek@miek.nl>
2021-05-17 13:19:54 -07:00
Miek Gieben
064d6cdd0a
Revert "plugin/sign: track zone file's mtime (#4431)" (#4511)
This reverts commit c4720b8ad2.
2021-03-15 15:42:13 +01:00
Miek Gieben
c4720b8ad2
plugin/sign: track zone file's mtime (#4431)
* plugin/sign: track zone file's mtime

Resign if the original zone's mtime is change in some way.

Closes #4407

Signed-off-by: Miek Gieben <miek@miek.nl>

* Update plugin/sign/README.md

Co-authored-by: Chris O'Haver <cohaver@infoblox.com>

Co-authored-by: Yong Tang <yong.tang.github@outlook.com>
Co-authored-by: Chris O'Haver <cohaver@infoblox.com>
2021-02-10 07:56:03 -08:00
Miek Gieben
c840caf1ef
Speed up testing (#4239)
* Speed up testing

* make notification run in the background, this recudes the test_readme
time from 18s to 0.10s
* reduce time for zone reload

* TestServeDNSConcurrent remove entirely. This took a whopping 58s for
  ... ? A few minutes staring didn't reveal wth it is actually testing.
  Making values smaller revealed race conditions in the tests. Remove
  entirely.

* Move many interval values to variables so we can reset them to short
  values for the tests.

* test_large_axfr: make the zone smaller. The number used 64K has no
  rational, make it 64/10 to speed up.
* TestProxyThreeWay: use client with shorter timeout

A few random tidbits in other tests.

Total time saved: 177s (almost 3m) - which makes it worthwhile again to
run the test locally:

this branch:

~~~
ok  	github.com/coredns/coredns/test	10.437s
cd plugin; time go t ./...
5,51s user 7,51s system 11,15s elapsed 744%CPU (
~~~

master:

~~~
ok  	github.com/coredns/coredns/test	35.252s
cd plugin; time go t ./...
157,64s user 15,39s system 50,05s elapsed 345%CPU ()
~~~
tests/ -25s
plugins/ -40s

This brings the total on 20s, and another 10s can be saved by fixing
dnstapio. Moving this to 5s would be even better, but 10s is also nice.

Signed-off-by: Miek Gieben <miek@miek.nl>

* Also 0.01

Signed-off-by: Miek Gieben <miek@miek.nl>
2020-10-30 10:27:04 +01:00
Miek Gieben
c2e4f2f1ab
docs: move Also See to See Also (#4245)
sed -i 's/Also See/See Also/' plugin/**/README.md

Some plugins did already use 'See Also', so it's all consistent now.

Fixes: #4196

Signed-off-by: Miek Gieben <miek@miek.nl>
2020-10-28 10:56:35 -07:00
Miek Gieben
b003d06003
For caddy v1 in our org (#4018)
* For caddy v1 in our org

This RP changes all imports for caddyserver/caddy to coredns/caddy. This
is the v1 code of caddy.

For the coredns/caddy repo the following changes have been made:

* anything not needed by us is deleted
* all `telemetry` stuff is deleted
* all its import paths are also changed to point to coredns/caddy
* the v1 branch has been moved to the master branch
* a v1.1.0 tag has been added to signal the latest release

Signed-off-by: Miek Gieben <miek@miek.nl>

* Fix imports

Signed-off-by: Miek Gieben <miek@miek.nl>

* Group coredns/caddy with out plugins

Signed-off-by: Miek Gieben <miek@miek.nl>

* remove this file

Signed-off-by: Miek Gieben <miek@miek.nl>

* Relax import ordering

github.com/coredns is now also a coredns dep, this makes
github.com/coredns/caddy fit more natural in the list.

Signed-off-by: Miek Gieben <miek@miek.nl>

* Fix final import

Signed-off-by: Miek Gieben <miek@miek.nl>
2020-09-24 18:14:41 +02:00
Zhou Hao
abeba46029
fix misspell (#4081)
Signed-off-by: Zhou Hao <zhouhao@cn.fujitsu.com>
2020-08-20 09:59:35 +02:00
Miek Gieben
2221b6160c sign: add expiration jitter (#3588)
* add expiration jitter

Signed-off-by: Miek Gieben <miek@miek.nl>

* sign: add expiration jitter

This PR adds a expiration jitter to spread out zone re-signing even
more. The max is 5 extra days added when creating the signer for a
specific zone.

Also make the duration* constants private to clean up the godoc for this
plugin.

Signed-off-by: Miek Gieben <miek@miek.nl>
2020-01-12 04:56:57 -08:00
Miek Gieben
fc546cf129
doc: fix generated manual pages (#3571)
Went over all generated manual pages and fixed some markdown issues,
mostly escaping "_" to avoid underlining entire paragraphs.

Some textual fixes in route53 and other cloud DNS plugins.

Regenerated the markdown with mmark.

Signed-off-by: Miek Gieben <miek@miek.nl>
2019-12-29 13:35:17 +01:00
Miek Gieben
a53321d9d6
plugin/sign: fix signing of authoritative data (#3479)
Don't sign data we are not authoritative for. This adds an AuthWalk
which skips names we should not authoritative for. Adds a few tests to
check this is the case. Generates zones have been compared to
dnssec-signzone.

A number of changes have been made:

* don't add DS records to the apex
* NSEC TTL is the SOA's minttl value (copying bind9)
* Various cleanups
* signer struct was cleaned up: doesn't need ttl, nor expiration or
  inception.
* plugin/sign: remove apex stuff from names()
  This is never used because we will always have other types in the
  apex, because we *ADD* them ourselves, before we sign (DNSKEY, CDS and
  CDNSKEY).

Signed-off-by: Miek Gieben <miek@miek.nl>
Co-Authored-By: Chris O'Haver <cohaver@infoblox.com>
2019-12-06 19:54:31 +00:00
Sean Liao
9ccc736f68 plugin/dnssec, plugin/sign: ed25519 support (#3380)
* add ed25519 dnskey support

Signed-off-by: Sean Liao <seankhliao@gmail.com>

* fix ed25519 type assertion

Signed-off-by: Sean Liao <seankhliao@gmail.com>

* clean up whitespace

Signed-off-by: Sean Liao <seankhliao@gmail.com>
2019-10-16 07:32:11 +01:00
yuxiaobo96
bf356e79fc fix spelling mistakes (#3364)
Automatically submitted.
2019-10-09 07:24:18 +00:00
Miek Gieben
65458b2de2
Directive -> plugin (#3363)
Caught my eye, we name things directive still, esp when talking about
the prometheus *plugin*. Rename everything that needs to be plugin to
'plugin'. Also make sure Metrics is a H2 section (not H1).

Signed-off-by: Miek Gieben <miek@miek.nl>
2019-10-08 10:20:48 +01:00
Miek Gieben
004c5fca9d
all: simply registering plugins (#3287)
Abstract the caddy call and make it simpler.

See #3261 for some part of the discussion.

Go from:

~~~ go
func init() {
       caddy.RegisterPlugin("any", caddy.Plugin{
               ServerType: "dns",
               Action:     setup,
       })
}
~~~

To:

~~~ go
func init() { plugin.Register("any", setup) }
~~~

This requires some external documents in coredns.io to be updated as
well; the old way still works, so it's backwards compatible.

Signed-off-by: Miek Gieben <miek@miek.nl>
2019-09-20 08:02:30 +01:00
Cricket Liu
878f906854 Making README consistent with other plugins' READMEs (#3243) 2019-09-08 08:23:07 +01:00
Miek Gieben
b8a0b52a5e
plugin/sign: a plugin that signs zone (#2993)
* plugin/sign: a plugin that signs zones

Sign is a plugin that signs zone data (on disk). The README.md details
what exactly happens to should be accurate related to the code.

Signs are signed with a CSK, resigning and first time signing is all
handled by *sign* plugin.

Logging with a test zone looks something like this:

~~~ txt
[INFO] plugin/sign: Signing "miek.nl." because open plugin/sign/testdata/db.miek.nl.signed: no such file or directory
[INFO] plugin/sign: Signed "miek.nl." with key tags "59725" in 11.670985ms, saved in "plugin/sign/testdata/db.miek.nl.signed". Next: 2019-07-20T15:49:06.560Z
[INFO] plugin/file: Successfully reloaded zone "miek.nl." in "plugin/sign/testdata/db.miek.nl.signed" with serial 1563636548
[INFO] plugin/sign: Signing "miek.nl." because resign was: 10m0s ago
[INFO] plugin/sign: Signed "miek.nl." with key tags "59725" in 2.055895ms, saved in "plugin/sign/testdata/db.miek.nl.signed". Next: 2019-07-20T16:09:06.560Z
[INFO] plugin/file: Successfully reloaded zone "miek.nl." in "plugin/sign/testdata/db.miek.nl.signed" with serial 1563637748
~~~

Signed-off-by: Miek Gieben <miek@miek.nl>

* Adjust readme and remove timestamps

Signed-off-by: Miek Gieben <miek@miek.nl>

* Comment on the newline

Signed-off-by: Miek Gieben <miek@miek.nl>

* Update plugin/sign/README.md

Co-Authored-By: Michael Grosser <development@stp-ip.net>
2019-08-29 15:41:59 +01:00