Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2025-10-27 08:14:18 -04:00
Code Issues Packages Projects Releases Wiki Activity

plugin/sign: a plugin that signs zone (#2993)

Browse Source 
* plugin/sign: a plugin that signs zones

Sign is a plugin that signs zone data (on disk). The README.md details
what exactly happens to should be accurate related to the code.

Signs are signed with a CSK, resigning and first time signing is all
handled by *sign* plugin.

Logging with a test zone looks something like this:

~~~ txt
[INFO] plugin/sign: Signing "miek.nl." because open plugin/sign/testdata/db.miek.nl.signed: no such file or directory
[INFO] plugin/sign: Signed "miek.nl." with key tags "59725" in 11.670985ms, saved in "plugin/sign/testdata/db.miek.nl.signed". Next: 2019-07-20T15:49:06.560Z
[INFO] plugin/file: Successfully reloaded zone "miek.nl." in "plugin/sign/testdata/db.miek.nl.signed" with serial 1563636548
[INFO] plugin/sign: Signing "miek.nl." because resign was: 10m0s ago
[INFO] plugin/sign: Signed "miek.nl." with key tags "59725" in 2.055895ms, saved in "plugin/sign/testdata/db.miek.nl.signed". Next: 2019-07-20T16:09:06.560Z
[INFO] plugin/file: Successfully reloaded zone "miek.nl." in "plugin/sign/testdata/db.miek.nl.signed" with serial 1563637748
~~~

Signed-off-by: Miek Gieben <miek@miek.nl>

* Adjust readme and remove timestamps

Signed-off-by: Miek Gieben <miek@miek.nl>

* Comment on the newline

Signed-off-by: Miek Gieben <miek@miek.nl>

* Update plugin/sign/README.md

Co-Authored-By: Michael Grosser <development@stp-ip.net>
This commit is contained in:
Miek Gieben
2019-08-29 15:41:59 +01:00
committed by GitHub
parent eec24cb013
commit b8a0b52a5e
21 changed files with 1114 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
plugin/sign/nsec.go Normal file
View File

@@ -0,0 +1,41 @@
package sign
import (
"sort"
"github.com/coredns/coredns/plugin/file"
"github.com/coredns/coredns/plugin/file/tree"
"github.com/miekg/dns"
)
// names returns the elements of the zone in nsec order. If the returned boolean is true there were
// no other apex records than SOA and NS, which are stored separately.
func names(origin string, z *file.Zone) ([]string, bool) {
// if there are no apex records other than NS and SOA we'll miss the origin
// in this list. Check the first element and if not origin prepend it.
n := []string{}
z.Walk(func(e *tree.Elem, _ map[uint16][]dns.RR) error {
n = append(n, e.Name())
return nil
})
if len(n) == 0 {
return nil, false
}
if n[0] != origin {
n = append([]string{origin}, n...)
return n, true
}
return n, false
}
// NSEC returns an NSEC record according to name, next, ttl and bitmap. Note that the bitmap is sorted before use.
func NSEC(name, next string, ttl uint32, bitmap []uint16) *dns.NSEC {
sort.Slice(bitmap, func(i, j int) bool { return bitmap[i] < bitmap[j] })
return &dns.NSEC{
Hdr: dns.RR_Header{Name: name, Ttl: ttl, Rrtype: dns.TypeNSEC, Class: dns.ClassINET},
NextDomain: next,
TypeBitMap: bitmap,
}
}