2019-03-11 16:56:48 +00:00
|
|
|
package dns01
|
2018-12-06 21:50:17 +00:00
|
|
|
|
|
|
|
import (
|
2020-02-27 18:14:46 +00:00
|
|
|
"errors"
|
2018-12-06 21:50:17 +00:00
|
|
|
"fmt"
|
|
|
|
"net"
|
2023-07-20 02:37:48 +00:00
|
|
|
"os"
|
2024-02-09 20:55:43 +00:00
|
|
|
"slices"
|
2023-07-20 02:37:48 +00:00
|
|
|
"strconv"
|
2018-12-06 21:50:17 +00:00
|
|
|
"strings"
|
|
|
|
"sync"
|
|
|
|
"time"
|
|
|
|
|
|
|
|
"github.com/miekg/dns"
|
|
|
|
)
|
|
|
|
|
|
|
|
const defaultResolvConf = "/etc/resolv.conf"
|
|
|
|
|
|
|
|
var (
|
2019-10-24 22:58:50 +00:00
|
|
|
fqdnSoaCache = map[string]*soaCacheEntry{}
|
|
|
|
muFqdnSoaCache sync.Mutex
|
2018-12-06 21:50:17 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
var defaultNameservers = []string{
|
|
|
|
"google-public-dns-a.google.com:53",
|
|
|
|
"google-public-dns-b.google.com:53",
|
|
|
|
}
|
|
|
|
|
2020-05-08 17:35:25 +00:00
|
|
|
// recursiveNameservers are used to pre-check DNS propagation.
|
2018-12-06 21:50:17 +00:00
|
|
|
var recursiveNameservers = getNameservers(defaultResolvConf, defaultNameservers)
|
|
|
|
|
2020-05-08 17:35:25 +00:00
|
|
|
// soaCacheEntry holds a cached SOA record (only selected fields).
|
2019-10-24 22:58:50 +00:00
|
|
|
type soaCacheEntry struct {
|
|
|
|
zone string // zone apex (a domain name)
|
|
|
|
primaryNs string // primary nameserver for the zone apex
|
|
|
|
expires time.Time // time when this cache entry should be evicted
|
|
|
|
}
|
|
|
|
|
|
|
|
func newSoaCacheEntry(soa *dns.SOA) *soaCacheEntry {
|
|
|
|
return &soaCacheEntry{
|
|
|
|
zone: soa.Hdr.Name,
|
|
|
|
primaryNs: soa.Ns,
|
|
|
|
expires: time.Now().Add(time.Duration(soa.Refresh) * time.Second),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// isExpired checks whether a cache entry should be considered expired.
|
|
|
|
func (cache *soaCacheEntry) isExpired() bool {
|
|
|
|
return time.Now().After(cache.expires)
|
|
|
|
}
|
|
|
|
|
2018-12-06 21:50:17 +00:00
|
|
|
// ClearFqdnCache clears the cache of fqdn to zone mappings. Primarily used in testing.
|
|
|
|
func ClearFqdnCache() {
|
2019-10-24 22:58:50 +00:00
|
|
|
muFqdnSoaCache.Lock()
|
|
|
|
fqdnSoaCache = map[string]*soaCacheEntry{}
|
|
|
|
muFqdnSoaCache.Unlock()
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func AddDNSTimeout(timeout time.Duration) ChallengeOption {
|
|
|
|
return func(_ *Challenge) error {
|
|
|
|
dnsTimeout = timeout
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func AddRecursiveNameservers(nameservers []string) ChallengeOption {
|
|
|
|
return func(_ *Challenge) error {
|
|
|
|
recursiveNameservers = ParseNameservers(nameservers)
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-05-08 17:35:25 +00:00
|
|
|
// getNameservers attempts to get systems nameservers before falling back to the defaults.
|
2018-12-06 21:50:17 +00:00
|
|
|
func getNameservers(path string, defaults []string) []string {
|
|
|
|
config, err := dns.ClientConfigFromFile(path)
|
|
|
|
if err != nil || len(config.Servers) == 0 {
|
|
|
|
return defaults
|
|
|
|
}
|
|
|
|
|
|
|
|
return ParseNameservers(config.Servers)
|
|
|
|
}
|
|
|
|
|
|
|
|
func ParseNameservers(servers []string) []string {
|
|
|
|
var resolvers []string
|
|
|
|
for _, resolver := range servers {
|
|
|
|
// ensure all servers have a port number
|
|
|
|
if _, _, err := net.SplitHostPort(resolver); err != nil {
|
|
|
|
resolvers = append(resolvers, net.JoinHostPort(resolver, "53"))
|
|
|
|
} else {
|
|
|
|
resolvers = append(resolvers, resolver)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return resolvers
|
|
|
|
}
|
|
|
|
|
|
|
|
// lookupNameservers returns the authoritative nameservers for the given fqdn.
|
|
|
|
func lookupNameservers(fqdn string) ([]string, error) {
|
|
|
|
var authoritativeNss []string
|
|
|
|
|
|
|
|
zone, err := FindZoneByFqdn(fqdn)
|
|
|
|
if err != nil {
|
2024-02-11 13:37:09 +00:00
|
|
|
return nil, fmt.Errorf("could not find zone: %w", err)
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
r, err := dnsQuery(zone, dns.TypeNS, recursiveNameservers, true)
|
|
|
|
if err != nil {
|
2024-02-11 13:37:09 +00:00
|
|
|
return nil, fmt.Errorf("NS call failed: %w", err)
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, rr := range r.Answer {
|
|
|
|
if ns, ok := rr.(*dns.NS); ok {
|
|
|
|
authoritativeNss = append(authoritativeNss, strings.ToLower(ns.Ns))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(authoritativeNss) > 0 {
|
|
|
|
return authoritativeNss, nil
|
|
|
|
}
|
2024-02-11 13:37:09 +00:00
|
|
|
|
|
|
|
return nil, fmt.Errorf("[zone=%s] could not determine authoritative nameservers", zone)
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
|
2019-10-24 22:58:50 +00:00
|
|
|
// FindPrimaryNsByFqdn determines the primary nameserver of the zone apex for the given fqdn
|
|
|
|
// by recursing up the domain labels until the nameserver returns a SOA record in the answer section.
|
|
|
|
func FindPrimaryNsByFqdn(fqdn string) (string, error) {
|
|
|
|
return FindPrimaryNsByFqdnCustom(fqdn, recursiveNameservers)
|
|
|
|
}
|
|
|
|
|
|
|
|
// FindPrimaryNsByFqdnCustom determines the primary nameserver of the zone apex for the given fqdn
|
|
|
|
// by recursing up the domain labels until the nameserver returns a SOA record in the answer section.
|
|
|
|
func FindPrimaryNsByFqdnCustom(fqdn string, nameservers []string) (string, error) {
|
|
|
|
soa, err := lookupSoaByFqdn(fqdn, nameservers)
|
|
|
|
if err != nil {
|
2024-02-11 13:37:09 +00:00
|
|
|
return "", fmt.Errorf("[fqdn=%s] %w", fqdn, err)
|
2019-10-24 22:58:50 +00:00
|
|
|
}
|
|
|
|
return soa.primaryNs, nil
|
|
|
|
}
|
|
|
|
|
2018-12-06 21:50:17 +00:00
|
|
|
// FindZoneByFqdn determines the zone apex for the given fqdn
|
|
|
|
// by recursing up the domain labels until the nameserver returns a SOA record in the answer section.
|
|
|
|
func FindZoneByFqdn(fqdn string) (string, error) {
|
|
|
|
return FindZoneByFqdnCustom(fqdn, recursiveNameservers)
|
|
|
|
}
|
|
|
|
|
|
|
|
// FindZoneByFqdnCustom determines the zone apex for the given fqdn
|
|
|
|
// by recursing up the domain labels until the nameserver returns a SOA record in the answer section.
|
|
|
|
func FindZoneByFqdnCustom(fqdn string, nameservers []string) (string, error) {
|
2019-10-24 22:58:50 +00:00
|
|
|
soa, err := lookupSoaByFqdn(fqdn, nameservers)
|
|
|
|
if err != nil {
|
2024-02-11 13:37:09 +00:00
|
|
|
return "", fmt.Errorf("[fqdn=%s] %w", fqdn, err)
|
2019-10-24 22:58:50 +00:00
|
|
|
}
|
|
|
|
return soa.zone, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func lookupSoaByFqdn(fqdn string, nameservers []string) (*soaCacheEntry, error) {
|
|
|
|
muFqdnSoaCache.Lock()
|
|
|
|
defer muFqdnSoaCache.Unlock()
|
2018-12-06 21:50:17 +00:00
|
|
|
|
2019-10-24 22:58:50 +00:00
|
|
|
// Do we have it cached and is it still fresh?
|
|
|
|
if ent := fqdnSoaCache[fqdn]; ent != nil && !ent.isExpired() {
|
|
|
|
return ent, nil
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
|
2019-10-24 22:58:50 +00:00
|
|
|
ent, err := fetchSoaByFqdn(fqdn, nameservers)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
fqdnSoaCache[fqdn] = ent
|
|
|
|
return ent, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func fetchSoaByFqdn(fqdn string, nameservers []string) (*soaCacheEntry, error) {
|
2018-12-06 21:50:17 +00:00
|
|
|
var err error
|
2024-02-11 13:37:09 +00:00
|
|
|
var r *dns.Msg
|
2018-12-06 21:50:17 +00:00
|
|
|
|
|
|
|
labelIndexes := dns.Split(fqdn)
|
|
|
|
for _, index := range labelIndexes {
|
|
|
|
domain := fqdn[index:]
|
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
r, err = dnsQuery(domain, dns.TypeSOA, nameservers, true)
|
2018-12-06 21:50:17 +00:00
|
|
|
if err != nil {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
if r == nil {
|
2018-12-06 21:50:17 +00:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
switch r.Rcode {
|
2018-12-06 21:50:17 +00:00
|
|
|
case dns.RcodeSuccess:
|
|
|
|
// Check if we got a SOA RR in the answer section
|
2024-02-11 13:37:09 +00:00
|
|
|
if len(r.Answer) == 0 {
|
2018-12-06 21:50:17 +00:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
// CNAME records cannot/should not exist at the root of a zone.
|
|
|
|
// So we skip a domain when a CNAME is found.
|
2024-02-11 13:37:09 +00:00
|
|
|
if dnsMsgContainsCNAME(r) {
|
2018-12-06 21:50:17 +00:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
for _, ans := range r.Answer {
|
2018-12-06 21:50:17 +00:00
|
|
|
if soa, ok := ans.(*dns.SOA); ok {
|
2019-10-24 22:58:50 +00:00
|
|
|
return newSoaCacheEntry(soa), nil
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
case dns.RcodeNameError:
|
|
|
|
// NXDOMAIN
|
|
|
|
default:
|
|
|
|
// Any response code other than NOERROR and NXDOMAIN is treated as error
|
2024-02-11 13:37:09 +00:00
|
|
|
return nil, &DNSError{Message: fmt.Sprintf("unexpected response for '%s'", domain), MsgOut: r}
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
return nil, &DNSError{Message: fmt.Sprintf("could not find the start of authority for '%s'", fqdn), MsgOut: r, Err: err}
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
|
2020-05-08 17:35:25 +00:00
|
|
|
// dnsMsgContainsCNAME checks for a CNAME answer in msg.
|
2018-12-06 21:50:17 +00:00
|
|
|
func dnsMsgContainsCNAME(msg *dns.Msg) bool {
|
2024-02-09 20:55:43 +00:00
|
|
|
return slices.ContainsFunc(msg.Answer, func(rr dns.RR) bool {
|
|
|
|
_, ok := rr.(*dns.CNAME)
|
|
|
|
return ok
|
|
|
|
})
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func dnsQuery(fqdn string, rtype uint16, nameservers []string, recursive bool) (*dns.Msg, error) {
|
|
|
|
m := createDNSMsg(fqdn, rtype, recursive)
|
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
if len(nameservers) == 0 {
|
|
|
|
return nil, &DNSError{Message: "empty list of nameservers"}
|
|
|
|
}
|
|
|
|
|
|
|
|
var r *dns.Msg
|
2018-12-06 21:50:17 +00:00
|
|
|
var err error
|
2024-02-11 13:37:09 +00:00
|
|
|
var errAll error
|
2018-12-06 21:50:17 +00:00
|
|
|
|
|
|
|
for _, ns := range nameservers {
|
2024-02-11 13:37:09 +00:00
|
|
|
r, err = sendDNSQuery(m, ns)
|
|
|
|
if err == nil && len(r.Answer) > 0 {
|
2018-12-06 21:50:17 +00:00
|
|
|
break
|
|
|
|
}
|
2024-02-11 13:37:09 +00:00
|
|
|
|
|
|
|
errAll = errors.Join(errAll, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
return r, errAll
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
2024-02-11 13:37:09 +00:00
|
|
|
|
|
|
|
return r, nil
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func createDNSMsg(fqdn string, rtype uint16, recursive bool) *dns.Msg {
|
|
|
|
m := new(dns.Msg)
|
|
|
|
m.SetQuestion(fqdn, rtype)
|
|
|
|
m.SetEdns0(4096, false)
|
|
|
|
|
|
|
|
if !recursive {
|
|
|
|
m.RecursionDesired = false
|
|
|
|
}
|
|
|
|
|
|
|
|
return m
|
|
|
|
}
|
|
|
|
|
|
|
|
func sendDNSQuery(m *dns.Msg, ns string) (*dns.Msg, error) {
|
2023-07-20 02:37:48 +00:00
|
|
|
if ok, _ := strconv.ParseBool(os.Getenv("LEGO_EXPERIMENTAL_DNS_TCP_ONLY")); ok {
|
|
|
|
tcp := &dns.Client{Net: "tcp", Timeout: dnsTimeout}
|
2024-02-11 13:37:09 +00:00
|
|
|
r, _, err := tcp.Exchange(m, ns)
|
|
|
|
if err != nil {
|
|
|
|
return r, &DNSError{Message: "DNS call error", MsgIn: m, NS: ns, Err: err}
|
|
|
|
}
|
2023-07-20 02:37:48 +00:00
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
return r, nil
|
2023-07-20 02:37:48 +00:00
|
|
|
}
|
|
|
|
|
2018-12-06 21:50:17 +00:00
|
|
|
udp := &dns.Client{Net: "udp", Timeout: dnsTimeout}
|
2024-02-11 13:37:09 +00:00
|
|
|
r, _, err := udp.Exchange(m, ns)
|
2018-12-06 21:50:17 +00:00
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
if r != nil && r.Truncated {
|
2018-12-06 21:50:17 +00:00
|
|
|
tcp := &dns.Client{Net: "tcp", Timeout: dnsTimeout}
|
2023-07-29 10:59:24 +00:00
|
|
|
// If the TCP request succeeds, the "err" will reset to nil
|
2024-02-11 13:37:09 +00:00
|
|
|
r, _, err = tcp.Exchange(m, ns)
|
|
|
|
}
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
return r, &DNSError{Message: "DNS call error", MsgIn: m, NS: ns, Err: err}
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
return r, nil
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
// DNSError error related to DNS calls.
|
|
|
|
type DNSError struct {
|
|
|
|
Message string
|
|
|
|
NS string
|
|
|
|
MsgIn *dns.Msg
|
|
|
|
MsgOut *dns.Msg
|
|
|
|
Err error
|
|
|
|
}
|
2018-12-06 21:50:17 +00:00
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
func (d *DNSError) Error() string {
|
|
|
|
var details []string
|
|
|
|
if d.NS != "" {
|
|
|
|
details = append(details, "ns="+d.NS)
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
if d.MsgIn != nil && len(d.MsgIn.Question) > 0 {
|
|
|
|
details = append(details, fmt.Sprintf("question='%s'", formatQuestions(d.MsgIn.Question)))
|
|
|
|
}
|
|
|
|
|
|
|
|
if d.MsgOut != nil {
|
|
|
|
if d.MsgIn == nil || len(d.MsgIn.Question) == 0 {
|
|
|
|
details = append(details, fmt.Sprintf("question='%s'", formatQuestions(d.MsgOut.Question)))
|
|
|
|
}
|
|
|
|
|
|
|
|
details = append(details, "code="+dns.RcodeToString[d.MsgOut.Rcode])
|
|
|
|
}
|
|
|
|
|
|
|
|
msg := "DNS error"
|
|
|
|
if d.Message != "" {
|
|
|
|
msg = d.Message
|
|
|
|
}
|
|
|
|
|
|
|
|
if d.Err != nil {
|
|
|
|
msg += ": " + d.Err.Error()
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(details) > 0 {
|
|
|
|
msg += " [" + strings.Join(details, ", ") + "]"
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
return msg
|
|
|
|
}
|
|
|
|
|
|
|
|
func (d *DNSError) Unwrap() error {
|
|
|
|
return d.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
func formatQuestions(questions []dns.Question) string {
|
|
|
|
var parts []string
|
|
|
|
for _, question := range questions {
|
|
|
|
parts = append(parts, strings.ReplaceAll(strings.TrimPrefix(question.String(), ";"), "\t", " "))
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|
|
|
|
|
2024-02-11 13:37:09 +00:00
|
|
|
return strings.Join(parts, ";")
|
2018-12-06 21:50:17 +00:00
|
|
|
}
|