feat: expose more SOA fields found by dns01.FindZoneByFqdn (#980)

This commit is contained in:
Dominik Menke 2019-10-25 00:58:50 +02:00 committed by Ludovic Fernandez
parent aab54da9a2
commit 8afde164a1
3 changed files with 155 additions and 78 deletions

View file

@ -57,7 +57,10 @@
text = "`(tlsFeatureExtensionOID|ocspMustStapleFeature)` is a global variable" text = "`(tlsFeatureExtensionOID|ocspMustStapleFeature)` is a global variable"
[[issues.exclude-rules]] [[issues.exclude-rules]]
path = "challenge/dns01/nameserver.go" path = "challenge/dns01/nameserver.go"
text = "`(defaultNameservers|recursiveNameservers|dnsTimeout|fqdnToZone|muFqdnToZone)` is a global variable" text = "`(defaultNameservers|recursiveNameservers|dnsTimeout|fqdnSoaCache|muFqdnSoaCache)` is a global variable"
[[issues.exclude-rules]]
path = "challenge/dns01/nameserver_test.go"
text = "`findXByFqdnTestCases` is a global variable"
[[issues.exclude-rules]] [[issues.exclude-rules]]
path = "challenge/http01/domain_matcher.go" path = "challenge/http01/domain_matcher.go"
text = "string `Host` has \\d occurrences, make it a constant" text = "string `Host` has \\d occurrences, make it a constant"

View file

@ -16,8 +16,8 @@ const defaultResolvConf = "/etc/resolv.conf"
var dnsTimeout = 10 * time.Second var dnsTimeout = 10 * time.Second
var ( var (
fqdnToZone = map[string]string{} fqdnSoaCache = map[string]*soaCacheEntry{}
muFqdnToZone sync.Mutex muFqdnSoaCache sync.Mutex
) )
var defaultNameservers = []string{ var defaultNameservers = []string{
@ -28,11 +28,31 @@ var defaultNameservers = []string{
// recursiveNameservers are used to pre-check DNS propagation // recursiveNameservers are used to pre-check DNS propagation
var recursiveNameservers = getNameservers(defaultResolvConf, defaultNameservers) var recursiveNameservers = getNameservers(defaultResolvConf, defaultNameservers)
// soaCacheEntry holds a cached SOA record (only selected fields)
type soaCacheEntry struct {
zone string // zone apex (a domain name)
primaryNs string // primary nameserver for the zone apex
expires time.Time // time when this cache entry should be evicted
}
func newSoaCacheEntry(soa *dns.SOA) *soaCacheEntry {
return &soaCacheEntry{
zone: soa.Hdr.Name,
primaryNs: soa.Ns,
expires: time.Now().Add(time.Duration(soa.Refresh) * time.Second),
}
}
// isExpired checks whether a cache entry should be considered expired.
func (cache *soaCacheEntry) isExpired() bool {
return time.Now().After(cache.expires)
}
// ClearFqdnCache clears the cache of fqdn to zone mappings. Primarily used in testing. // ClearFqdnCache clears the cache of fqdn to zone mappings. Primarily used in testing.
func ClearFqdnCache() { func ClearFqdnCache() {
muFqdnToZone.Lock() muFqdnSoaCache.Lock()
fqdnToZone = map[string]string{} fqdnSoaCache = map[string]*soaCacheEntry{}
muFqdnToZone.Unlock() muFqdnSoaCache.Unlock()
} }
func AddDNSTimeout(timeout time.Duration) ChallengeOption { func AddDNSTimeout(timeout time.Duration) ChallengeOption {
@ -98,6 +118,22 @@ func lookupNameservers(fqdn string) ([]string, error) {
return nil, fmt.Errorf("could not determine authoritative nameservers") return nil, fmt.Errorf("could not determine authoritative nameservers")
} }
// FindPrimaryNsByFqdn determines the primary nameserver of the zone apex for the given fqdn
// by recursing up the domain labels until the nameserver returns a SOA record in the answer section.
func FindPrimaryNsByFqdn(fqdn string) (string, error) {
return FindPrimaryNsByFqdnCustom(fqdn, recursiveNameservers)
}
// FindPrimaryNsByFqdnCustom determines the primary nameserver of the zone apex for the given fqdn
// by recursing up the domain labels until the nameserver returns a SOA record in the answer section.
func FindPrimaryNsByFqdnCustom(fqdn string, nameservers []string) (string, error) {
soa, err := lookupSoaByFqdn(fqdn, nameservers)
if err != nil {
return "", err
}
return soa.primaryNs, nil
}
// FindZoneByFqdn determines the zone apex for the given fqdn // FindZoneByFqdn determines the zone apex for the given fqdn
// by recursing up the domain labels until the nameserver returns a SOA record in the answer section. // by recursing up the domain labels until the nameserver returns a SOA record in the answer section.
func FindZoneByFqdn(fqdn string) (string, error) { func FindZoneByFqdn(fqdn string) (string, error) {
@ -107,14 +143,32 @@ func FindZoneByFqdn(fqdn string) (string, error) {
// FindZoneByFqdnCustom determines the zone apex for the given fqdn // FindZoneByFqdnCustom determines the zone apex for the given fqdn
// by recursing up the domain labels until the nameserver returns a SOA record in the answer section. // by recursing up the domain labels until the nameserver returns a SOA record in the answer section.
func FindZoneByFqdnCustom(fqdn string, nameservers []string) (string, error) { func FindZoneByFqdnCustom(fqdn string, nameservers []string) (string, error) {
muFqdnToZone.Lock() soa, err := lookupSoaByFqdn(fqdn, nameservers)
defer muFqdnToZone.Unlock() if err != nil {
return "", err
}
return soa.zone, nil
}
// Do we have it cached? func lookupSoaByFqdn(fqdn string, nameservers []string) (*soaCacheEntry, error) {
if zone, ok := fqdnToZone[fqdn]; ok { muFqdnSoaCache.Lock()
return zone, nil defer muFqdnSoaCache.Unlock()
// Do we have it cached and is it still fresh?
if ent := fqdnSoaCache[fqdn]; ent != nil && !ent.isExpired() {
return ent, nil
} }
ent, err := fetchSoaByFqdn(fqdn, nameservers)
if err != nil {
return nil, err
}
fqdnSoaCache[fqdn] = ent
return ent, nil
}
func fetchSoaByFqdn(fqdn string, nameservers []string) (*soaCacheEntry, error) {
var err error var err error
var in *dns.Msg var in *dns.Msg
@ -134,7 +188,6 @@ func FindZoneByFqdnCustom(fqdn string, nameservers []string) (string, error) {
switch in.Rcode { switch in.Rcode {
case dns.RcodeSuccess: case dns.RcodeSuccess:
// Check if we got a SOA RR in the answer section // Check if we got a SOA RR in the answer section
if len(in.Answer) == 0 { if len(in.Answer) == 0 {
continue continue
} }
@ -147,20 +200,18 @@ func FindZoneByFqdnCustom(fqdn string, nameservers []string) (string, error) {
for _, ans := range in.Answer { for _, ans := range in.Answer {
if soa, ok := ans.(*dns.SOA); ok { if soa, ok := ans.(*dns.SOA); ok {
zone := soa.Hdr.Name return newSoaCacheEntry(soa), nil
fqdnToZone[fqdn] = zone
return zone, nil
} }
} }
case dns.RcodeNameError: case dns.RcodeNameError:
// NXDOMAIN // NXDOMAIN
default: default:
// Any response code other than NOERROR and NXDOMAIN is treated as error // Any response code other than NOERROR and NXDOMAIN is treated as error
return "", fmt.Errorf("unexpected response code '%s' for %s", dns.RcodeToString[in.Rcode], domain) return nil, fmt.Errorf("unexpected response code '%s' for %s", dns.RcodeToString[in.Rcode], domain)
} }
} }
return "", fmt.Errorf("could not find the start of authority for %s%s", fqdn, formatDNSError(in, err)) return nil, fmt.Errorf("could not find the start of authority for %s%s", fqdn, formatDNSError(in, err))
} }
// dnsMsgContainsCNAME checks for a CNAME answer in msg // dnsMsgContainsCNAME checks for a CNAME answer in msg

View file

@ -68,68 +68,74 @@ func TestLookupNameserversErr(t *testing.T) {
} }
} }
func TestFindZoneByFqdnCustom(t *testing.T) { var findXByFqdnTestCases = []struct {
testCases := []struct { desc string
desc string fqdn string
fqdn string zone string
zone string primaryNs string
nameservers []string nameservers []string
expectedError string expectedError string
}{ }{
{ {
desc: "domain is a CNAME", desc: "domain is a CNAME",
fqdn: "mail.google.com.", fqdn: "mail.google.com.",
zone: "google.com.", zone: "google.com.",
nameservers: recursiveNameservers, primaryNs: "ns1.google.com.",
}, nameservers: recursiveNameservers,
{ },
desc: "domain is a non-existent subdomain", {
fqdn: "foo.google.com.", desc: "domain is a non-existent subdomain",
zone: "google.com.", fqdn: "foo.google.com.",
nameservers: recursiveNameservers, zone: "google.com.",
}, primaryNs: "ns1.google.com.",
{ nameservers: recursiveNameservers,
desc: "domain is a eTLD", },
fqdn: "example.com.ac.", {
zone: "ac.", desc: "domain is a eTLD",
nameservers: recursiveNameservers, fqdn: "example.com.ac.",
}, zone: "ac.",
{ primaryNs: "a0.nic.ac.",
desc: "domain is a cross-zone CNAME", nameservers: recursiveNameservers,
fqdn: "cross-zone-example.assets.sh.", },
zone: "assets.sh.", {
nameservers: recursiveNameservers, desc: "domain is a cross-zone CNAME",
}, fqdn: "cross-zone-example.assets.sh.",
{ zone: "assets.sh.",
desc: "NXDOMAIN", primaryNs: "gina.ns.cloudflare.com.",
fqdn: "test.loho.jkl.", nameservers: recursiveNameservers,
zone: "loho.jkl.", },
nameservers: []string{"1.1.1.1:53"}, {
expectedError: "could not find the start of authority for test.loho.jkl.: NXDOMAIN", desc: "NXDOMAIN",
}, fqdn: "test.loho.jkl.",
{ zone: "loho.jkl.",
desc: "several non existent nameservers", nameservers: []string{"1.1.1.1:53"},
fqdn: "mail.google.com.", expectedError: "could not find the start of authority for test.loho.jkl.: NXDOMAIN",
zone: "google.com.", },
nameservers: []string{":7053", ":8053", "1.1.1.1:53"}, {
}, desc: "several non existent nameservers",
{ fqdn: "mail.google.com.",
desc: "only non existent nameservers", zone: "google.com.",
fqdn: "mail.google.com.", primaryNs: "ns1.google.com.",
zone: "google.com.", nameservers: []string{":7053", ":8053", "1.1.1.1:53"},
nameservers: []string{":7053", ":8053", ":9053"}, },
expectedError: "could not find the start of authority for mail.google.com.: read udp", {
}, desc: "only non existent nameservers",
{ fqdn: "mail.google.com.",
desc: "no nameservers", zone: "google.com.",
fqdn: "test.ldez.com.", nameservers: []string{":7053", ":8053", ":9053"},
zone: "ldez.com.", expectedError: "could not find the start of authority for mail.google.com.: read udp",
nameservers: []string{}, },
expectedError: "could not find the start of authority for test.ldez.com.", {
}, desc: "no nameservers",
} fqdn: "test.ldez.com.",
zone: "ldez.com.",
nameservers: []string{},
expectedError: "could not find the start of authority for test.ldez.com.",
},
}
for _, test := range testCases { func TestFindZoneByFqdnCustom(t *testing.T) {
for _, test := range findXByFqdnTestCases {
t.Run(test.desc, func(t *testing.T) { t.Run(test.desc, func(t *testing.T) {
ClearFqdnCache() ClearFqdnCache()
@ -145,6 +151,23 @@ func TestFindZoneByFqdnCustom(t *testing.T) {
} }
} }
func TestFindPrimayNsByFqdnCustom(t *testing.T) {
for _, test := range findXByFqdnTestCases {
t.Run(test.desc, func(t *testing.T) {
ClearFqdnCache()
ns, err := FindPrimaryNsByFqdnCustom(test.fqdn, test.nameservers)
if test.expectedError != "" {
require.Error(t, err)
assert.Contains(t, err.Error(), test.expectedError)
} else {
require.NoError(t, err)
assert.Equal(t, test.primaryNs, ns)
}
})
}
}
func TestResolveConfServers(t *testing.T) { func TestResolveConfServers(t *testing.T) {
var testCases = []struct { var testCases = []struct {
fixture string fixture string