Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2025-11-01 18:53:43 -04:00
Code Issues Packages Projects Releases Wiki Activity

plugin/sign: fix signing of authoritative data (#3479)

Browse Source 
Don't sign data we are not authoritative for. This adds an AuthWalk
which skips names we should not authoritative for. Adds a few tests to
check this is the case. Generates zones have been compared to
dnssec-signzone.

A number of changes have been made:

* don't add DS records to the apex
* NSEC TTL is the SOA's minttl value (copying bind9)
* Various cleanups
* signer struct was cleaned up: doesn't need ttl, nor expiration or
  inception.
* plugin/sign: remove apex stuff from names()
  This is never used because we will always have other types in the
  apex, because we *ADD* them ourselves, before we sign (DNSKEY, CDS and
  CDNSKEY).

Signed-off-by: Miek Gieben <miek@miek.nl>
Co-Authored-By: Chris O'Haver <cohaver@infoblox.com>
This commit is contained in:
Miek Gieben
2019-12-06 19:54:31 +00:00
committed by GitHub
parent 799dce4bff
commit a53321d9d6
9 changed files with 235 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
plugin/sign/nsec.go
View File

@@ -9,24 +9,19 @@ import (
"github.com/miekg/dns"
)
// names returns the elements of the zone in nsec order. If the returned boolean is true there were
// no other apex records than SOA and NS, which are stored separately.
func names(origin string, z *file.Zone) ([]string, bool) {
// if there are no apex records other than NS and SOA we'll miss the origin
// in this list. Check the first element and if not origin prepend it.
// names returns the elements of the zone in nsec order.
func names(origin string, z *file.Zone) []string {
// There will also be apex records other than NS and SOA (who are kept separate), as we
// are adding DNSKEY and CDS/CDNSKEY records in the apex *before* we sign.
n := []string{}
z.Walk(func(e *tree.Elem, _ map[uint16][]dns.RR) error {
z.AuthWalk(func(e *tree.Elem, _ map[uint16][]dns.RR, auth bool) error {
if !auth {
return nil
}
n = append(n, e.Name())
return nil
})
if len(n) == 0 {
return nil, false
}
if n[0] != origin {
n = append([]string{origin}, n...)
return n, true
}
return n, false
return n
}
// NSEC returns an NSEC record according to name, next, ttl and bitmap. Note that the bitmap is sorted before use.