87c9f00c83
* readme: more tests Add dnssec and file plugin to the test readme. This requires creating a bunch of files with the right content. Doing so already unconvered an unconditional type assertion in DNSSEC. This PR will include the fix for that as well. Also extended the snippets in the file plugin README, so that they are whole Corefile - showing more value and checking all corefile snippets. Create outliner right now is the kubernetes plugin, because even setting the right env vars will result in: open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory": Which we can't create for a test. * lint
78 lines
1.7 KiB
Go
78 lines
1.7 KiB
Go
package dnssec
|
|
|
|
import (
|
|
"crypto"
|
|
"crypto/ecdsa"
|
|
"crypto/rsa"
|
|
"errors"
|
|
"os"
|
|
"time"
|
|
|
|
"github.com/coredns/coredns/request"
|
|
|
|
"github.com/miekg/dns"
|
|
)
|
|
|
|
// DNSKEY holds a DNSSEC public and private key used for on-the-fly signing.
|
|
type DNSKEY struct {
|
|
K *dns.DNSKEY
|
|
D *dns.DS
|
|
s crypto.Signer
|
|
tag uint16
|
|
}
|
|
|
|
// ParseKeyFile read a DNSSEC keyfile as generated by dnssec-keygen or other
|
|
// utilities. It adds ".key" for the public key and ".private" for the private key.
|
|
func ParseKeyFile(pubFile, privFile string) (*DNSKEY, error) {
|
|
f, e := os.Open(pubFile)
|
|
if e != nil {
|
|
return nil, e
|
|
}
|
|
k, e := dns.ReadRR(f, pubFile)
|
|
if e != nil {
|
|
return nil, e
|
|
}
|
|
|
|
f, e = os.Open(privFile)
|
|
if e != nil {
|
|
return nil, e
|
|
}
|
|
|
|
dk, ok := k.(*dns.DNSKEY)
|
|
if !ok {
|
|
return nil, errors.New("no public key found")
|
|
}
|
|
p, e := dk.ReadPrivateKey(f, privFile)
|
|
if e != nil {
|
|
return nil, e
|
|
}
|
|
|
|
if s, ok := p.(*rsa.PrivateKey); ok {
|
|
return &DNSKEY{K: dk, D: dk.ToDS(dns.SHA256), s: s, tag: dk.KeyTag()}, nil
|
|
}
|
|
if s, ok := p.(*ecdsa.PrivateKey); ok {
|
|
return &DNSKEY{K: dk, D: dk.ToDS(dns.SHA256), s: s, tag: dk.KeyTag()}, nil
|
|
}
|
|
return &DNSKEY{K: dk, D: dk.ToDS(dns.SHA256), s: nil, tag: 0}, errors.New("no private key found")
|
|
}
|
|
|
|
// getDNSKEY returns the correct DNSKEY to the client. Signatures are added when do is true.
|
|
func (d Dnssec) getDNSKEY(state request.Request, zone string, do bool) *dns.Msg {
|
|
keys := make([]dns.RR, len(d.keys))
|
|
for i, k := range d.keys {
|
|
keys[i] = dns.Copy(k.K)
|
|
keys[i].Header().Name = zone
|
|
}
|
|
m := new(dns.Msg)
|
|
m.SetReply(state.Req)
|
|
m.Answer = keys
|
|
if !do {
|
|
return m
|
|
}
|
|
|
|
incep, expir := incepExpir(time.Now().UTC())
|
|
if sigs, err := d.sign(keys, zone, 3600, incep, expir); err == nil {
|
|
m.Answer = append(m.Answer, sigs...)
|
|
}
|
|
return m
|
|
}
|