Phase 2b: refactor to file-backed storage; UPDATE writes zones/*.zone
Major architectural pivot per the user's "RFC 2136 mechanism for the existing zonefiles, not a new in-memory thing" framing. The plugin no longer maintains its own in-memory state OR serves any queries -- both of those are now the auto plugin's job, reading the same zone files. The plugin's sole responsibility is now: receive TSIG-authed UPDATE messages, edit the matching zones/<zone>.zone file, bump the SOA serial in CalVer (YYYYMMDDNN) form, and optionally auto-commit to git. What changed: - DELETED: store.go (in-memory recordStore), store_test.go (12 tests), plugin_test.go (10 ServeDNS query tests), old update_test.go. - NEW: zonefile.go -- file-backed authority for one zone. loadRRs via miekg/dns zone parser; mutation helpers (lookupIn/nameExistsIn/ removeRRsetFrom/removeRRFrom/removeNameFrom/addRRTo) on []dns.RR slices; bumpSerial with CalVer semantics + NN exhaustion handling; writeAtomic via temp-file rename; commit shells to `git add && git commit` with configurable author. - NEW: zonefile_test.go -- 17 tests covering load/lookup/mutate/bump/ write paths. - REWRITTEN: plugin.go -- ServeDNS is now thin: UPDATE → TSIG → handler; everything else → Next. No synthetic SOA/NS, no query serving. - REWRITTEN: update.go -- handleUpdate now opens the zoneFile, loads, applies (with prereq checks against the loaded RRs), bumps serial, writes, commits. Detects no-op updates to avoid spurious file writes. - REWRITTEN: setup.go -- new directives: `zones-dir` (required), `auto-commit` (default true), `git-author <name> <email>`. Dropped `nameserver` and `persist`. Validates each declared zone has a file on disk via os.Stat before CoreDNS finishes starting. - REWRITTEN: setup_test.go -- 17 cases for the new grammar. - REWRITTEN: update_test.go -- 11 cases using real temp zone files via t.TempDir(). Total: 30 tests passing, 0 failures. Next: Phase 2c (custom CoreDNS image, deploy, smoke test with nsupdate).
This commit is contained in:
parent
1d2d919728
commit
0f28127284
10 changed files with 1223 additions and 1109 deletions
196
plugin.go
196
plugin.go
|
|
@ -1,61 +1,67 @@
|
|||
// Package rfc2136 implements a CoreDNS plugin that accepts dynamic DNS
|
||||
// updates per RFC 2136 (UPDATE opcode), authenticated via TSIG. The
|
||||
// primary use case is self-hosted ACME DNS-01 cert automation: an ACME
|
||||
// client (e.g. Caddy via caddy-dns/rfc2136) injects _acme-challenge TXT
|
||||
// records into a delegated sub-zone that this plugin serves.
|
||||
// Package rfc2136 is a CoreDNS plugin that accepts dynamic DNS updates
|
||||
// per RFC 2136 (UPDATE opcode), authenticated via TSIG, and applies
|
||||
// them to on-disk zone files. This is the right shape for stacks where
|
||||
// the operator wants to keep zones in flat files (perhaps under git,
|
||||
// with HE pulling AXFR), but also wants programmatic updates from
|
||||
// clients like Caddy's caddy-dns/rfc2136 module.
|
||||
//
|
||||
// Phase 1.3 status: store + query dispatch. ServeDNS now answers
|
||||
// authoritatively for the configured zone(s) from the in-memory store
|
||||
// (plus synthetic SOA/NS at apex). UPDATE handling still rejected —
|
||||
// that lands in Phase 1.4. See plan at
|
||||
// The plugin does NOT serve any queries — that's the job of the
|
||||
// `auto`/`file` plugin running alongside it. This plugin's only
|
||||
// responsibility is the UPDATE opcode path: verify TSIG, dissect the
|
||||
// UPDATE, write the zone file, bump the SOA serial, optionally
|
||||
// auto-commit to git. CoreDNS's auto plugin notices the mtime change
|
||||
// and re-serves the zone within its reload interval.
|
||||
//
|
||||
// ~/.claude/plans/dood-does-coredns-offer-enumerated-piglet.md
|
||||
// See the plan at
|
||||
// ~/.claude/plans/dood-does-coredns-offer-enumerated-piglet.md
|
||||
// for the architectural rationale.
|
||||
package rfc2136
|
||||
|
||||
import (
|
||||
"context"
|
||||
"strings"
|
||||
|
||||
"github.com/coredns/coredns/plugin"
|
||||
"github.com/miekg/dns"
|
||||
)
|
||||
|
||||
// DefaultTTL is the TTL applied to dynamically-added records when the
|
||||
// Corefile doesn't specify one. 60s matches the short-lived nature of
|
||||
// ACME challenge TXT records and keeps stale answers from lingering in
|
||||
// DefaultTTL is applied to dynamically-added records whose UPDATE
|
||||
// messages carry TTL=0. 60s matches the short-lived nature of ACME
|
||||
// challenge records and keeps stale answers from lingering in
|
||||
// resolver caches.
|
||||
const DefaultTTL uint32 = 60
|
||||
|
||||
// RFC2136 is the plugin handler. One instance per Corefile server block.
|
||||
type RFC2136 struct {
|
||||
// Next is the downstream plugin in the chain.
|
||||
// Next is the downstream plugin in the chain — queries always
|
||||
// pass through; only UPDATE opcode is intercepted.
|
||||
Next plugin.Handler
|
||||
|
||||
// Zones is the set of canonical (dot-terminated, lowercase) zone
|
||||
// names this instance is authoritative for. Queries outside these
|
||||
// zones pass through to Next.
|
||||
// names this instance accepts UPDATEs for. UPDATEs for any other
|
||||
// zone are rejected with NOTAUTH.
|
||||
Zones []string
|
||||
|
||||
// TSIGKeys is keyed by canonical key name (lowercased, trailing
|
||||
// dot). Empty means TSIG is disabled — UPDATEs without TSIG are
|
||||
// rejected unconditionally in Phase 1.4.
|
||||
// dot). Empty means TSIG is disabled — UPDATEs are refused
|
||||
// unconditionally as a safety default.
|
||||
TSIGKeys map[string]tsigKey
|
||||
|
||||
// TTL is applied to dynamically-injected records that don't carry
|
||||
// an explicit TTL in the UPDATE message.
|
||||
TTL uint32
|
||||
|
||||
// PersistPath, when non-empty, names a file the plugin writes a
|
||||
// JSON snapshot of its in-memory store to on a periodic schedule.
|
||||
// Empty means in-memory only (acceptable for ACME challenges).
|
||||
PersistPath string
|
||||
// ZonesDir is the directory where <zone>.zone files live (matching
|
||||
// the mount path inside the CoreDNS container). The plugin reads
|
||||
// and writes files at <ZonesDir>/<zone>.zone.
|
||||
ZonesDir string
|
||||
|
||||
// Nameserver is the host returned in synthetic NS records and as
|
||||
// the SOA's MNAME. Defaults (set in setup) to the first zone apex.
|
||||
Nameserver string
|
||||
// AutoCommit governs whether the plugin auto-commits zone-file
|
||||
// changes to git after every successful UPDATE.
|
||||
AutoCommit bool
|
||||
|
||||
// store holds the dynamic records. Always non-nil after setup.
|
||||
store *recordStore
|
||||
// zones holds per-zone file handlers, keyed by canonical zone name.
|
||||
// Populated in setup; mutexes live inside each zoneFile.
|
||||
zones map[string]*zoneFile
|
||||
}
|
||||
|
||||
// Name implements plugin.Handler.
|
||||
|
|
@ -65,19 +71,11 @@ func (p *RFC2136) Name() string { return "rfc2136" }
|
|||
//
|
||||
// Dispatch:
|
||||
//
|
||||
// UPDATE opcode → rejected with REFUSED (Phase 1.4 implements properly).
|
||||
// Query opcode:
|
||||
// - Not in our zones → pass to Next.
|
||||
// - Apex SOA → synthetic SOA.
|
||||
// - Apex NS → synthetic NS.
|
||||
// - Match in store → return RRset.
|
||||
// - Name exists, wrong type → NODATA (NOERROR + SOA in authority).
|
||||
// - Name doesn't exist → NXDOMAIN (NameError + SOA in authority).
|
||||
// UPDATE opcode → verify TSIG, then apply via the UPDATE handler.
|
||||
// Anything else → pass through to Next (the auto plugin handles
|
||||
// queries against the zone files we maintain).
|
||||
func (p *RFC2136) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) {
|
||||
if r.Opcode == dns.OpcodeUpdate {
|
||||
// TSIG verification was performed by the underlying dns.Server
|
||||
// (because setup.go populated dnsserver.Config.TsigSecret). We
|
||||
// just need to check the result here.
|
||||
if err := p.checkTSIG(w, r); err != nil {
|
||||
log.Warningf("UPDATE rejected: %v", err)
|
||||
resp := new(dns.Msg)
|
||||
|
|
@ -87,123 +85,5 @@ func (p *RFC2136) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg
|
|||
}
|
||||
return p.handleUpdate(w, r)
|
||||
}
|
||||
|
||||
if len(r.Question) == 0 {
|
||||
return plugin.NextOrFailure(p.Name(), p.Next, ctx, w, r)
|
||||
}
|
||||
|
||||
q := r.Question[0]
|
||||
zone := p.findZone(q.Name)
|
||||
if zone == "" {
|
||||
return plugin.NextOrFailure(p.Name(), p.Next, ctx, w, r)
|
||||
}
|
||||
|
||||
// We're authoritative for this name. Build a reply.
|
||||
msg := new(dns.Msg)
|
||||
msg.SetReply(r)
|
||||
msg.Authoritative = true
|
||||
|
||||
qname := strings.ToLower(dns.Fqdn(q.Name))
|
||||
isApex := qname == zone
|
||||
|
||||
// Apex SOA / NS are synthetic.
|
||||
if isApex {
|
||||
switch q.Qtype {
|
||||
case dns.TypeSOA:
|
||||
msg.Answer = []dns.RR{p.syntheticSOA(zone)}
|
||||
_ = w.WriteMsg(msg)
|
||||
return dns.RcodeSuccess, nil
|
||||
case dns.TypeNS:
|
||||
msg.Answer = p.syntheticNS(zone)
|
||||
_ = w.WriteMsg(msg)
|
||||
return dns.RcodeSuccess, nil
|
||||
}
|
||||
}
|
||||
|
||||
// Look up the asked type in the store.
|
||||
if rrs := p.store.Lookup(qname, q.Qtype); rrs != nil {
|
||||
msg.Answer = rrs
|
||||
_ = w.WriteMsg(msg)
|
||||
return dns.RcodeSuccess, nil
|
||||
}
|
||||
|
||||
// Special case: ANY at the apex isn't in the store but we have
|
||||
// synthetic SOA + NS. Return them rather than NODATA.
|
||||
if isApex && q.Qtype == dns.TypeANY {
|
||||
msg.Answer = append(msg.Answer, p.syntheticSOA(zone))
|
||||
msg.Answer = append(msg.Answer, p.syntheticNS(zone)...)
|
||||
_ = w.WriteMsg(msg)
|
||||
return dns.RcodeSuccess, nil
|
||||
}
|
||||
|
||||
// Distinguish NODATA from NXDOMAIN.
|
||||
if p.store.NameExists(qname) || isApex {
|
||||
// NODATA: name exists, but not with this type.
|
||||
msg.Ns = []dns.RR{p.syntheticSOA(zone)}
|
||||
_ = w.WriteMsg(msg)
|
||||
return dns.RcodeSuccess, nil
|
||||
}
|
||||
|
||||
// NXDOMAIN: name doesn't exist anywhere in this zone.
|
||||
msg.Rcode = dns.RcodeNameError
|
||||
msg.Ns = []dns.RR{p.syntheticSOA(zone)}
|
||||
_ = w.WriteMsg(msg)
|
||||
return dns.RcodeNameError, nil
|
||||
}
|
||||
|
||||
// findZone returns the longest matching zone for qname, or "" if qname
|
||||
// is outside all configured zones. The returned zone is in canonical
|
||||
// form (lowercase, trailing dot).
|
||||
func (p *RFC2136) findZone(qname string) string {
|
||||
qname = strings.ToLower(dns.Fqdn(qname))
|
||||
// Longest-suffix wins so nested zones work correctly.
|
||||
var best string
|
||||
for _, z := range p.Zones {
|
||||
if qname == z || strings.HasSuffix(qname, "."+z) {
|
||||
if len(z) > len(best) {
|
||||
best = z
|
||||
}
|
||||
}
|
||||
}
|
||||
return best
|
||||
}
|
||||
|
||||
// syntheticSOA returns the SOA RR for a zone. Serial is derived from
|
||||
// the store's monotonic generation counter — every UPDATE bumps it,
|
||||
// so downstream observers can detect "something changed" without
|
||||
// having to AXFR.
|
||||
func (p *RFC2136) syntheticSOA(zone string) *dns.SOA {
|
||||
return &dns.SOA{
|
||||
Hdr: dns.RR_Header{
|
||||
Name: zone,
|
||||
Rrtype: dns.TypeSOA,
|
||||
Class: dns.ClassINET,
|
||||
Ttl: p.TTL,
|
||||
},
|
||||
Ns: p.Nameserver,
|
||||
Mbox: "admin." + zone,
|
||||
Serial: uint32(p.store.generation()),
|
||||
Refresh: 3600, // 1 hour
|
||||
Retry: 600, // 10 min
|
||||
Expire: 604800, // 1 week
|
||||
Minttl: 60, // negative-cache TTL
|
||||
}
|
||||
}
|
||||
|
||||
// syntheticNS returns the NS RRset for a zone. Currently a single NS
|
||||
// pointing at p.Nameserver (the host that runs this plugin). For
|
||||
// resiliency, future versions could accept multiple `nameserver`
|
||||
// directives.
|
||||
func (p *RFC2136) syntheticNS(zone string) []dns.RR {
|
||||
return []dns.RR{
|
||||
&dns.NS{
|
||||
Hdr: dns.RR_Header{
|
||||
Name: zone,
|
||||
Rrtype: dns.TypeNS,
|
||||
Class: dns.ClassINET,
|
||||
Ttl: p.TTL,
|
||||
},
|
||||
Ns: p.Nameserver,
|
||||
},
|
||||
}
|
||||
return plugin.NextOrFailure(p.Name(), p.Next, ctx, w, r)
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue