Phase 1.3: in-memory store + ServeDNS query dispatch
ServeDNS now answers authoritatively for the configured zone(s): - Apex SOA → synthetic SOA (serial = store generation counter) - Apex NS → synthetic NS pointing at p.Nameserver - In-store lookups for any qtype - NODATA vs NXDOMAIN correctly distinguished (SOA in authority section) - UPDATE opcode → REFUSED (Phase 1.4 implements properly) - Queries outside our zones pass through to Next Added: - store.go: recordStore with sync.RWMutex + atomic generation counter. Operations: Add (de-dupes), RemoveRRset, RemoveRR, RemoveName, Lookup (returns a copy so callers can't corrupt internal state), NameExists. All keyed on canonical lowercase + trailing-dot names. - plugin.go: ServeDNS dispatch, findZone (longest-suffix match), syntheticSOA, syntheticNS. New Nameserver field. - setup.go: nameserver directive. Default Nameserver = first zone apex. Store initialised at parse time. - store_test.go: 12 unit tests covering add/dedupe/remove/lookup/ generation/case-insensitivity/copy-safety. - plugin_test.go: 10 dispatch tests covering pass-through, apex synthetics, in-store lookups, NXDOMAIN/NODATA semantics, UPDATE refusal, findZone longest-suffix-wins and case behavior. - setup_test.go: 3 new cases for the nameserver directive + store init. Total: 38 tests passing. Module: git.supported.systems/rsp2k/coredns-rfc2136
This commit is contained in:
parent
eba6313ec0
commit
1cca9a5aa7
6 changed files with 788 additions and 22 deletions
185
plugin.go
185
plugin.go
|
|
@ -4,26 +4,17 @@
|
|||
// client (e.g. Caddy via caddy-dns/rfc2136) injects _acme-challenge TXT
|
||||
// records into a delegated sub-zone that this plugin serves.
|
||||
//
|
||||
// Scope:
|
||||
// - Handles UPDATE messages (OPCODE=5) for configured zones.
|
||||
// - Verifies TSIG signatures (HMAC-SHA family; algorithm-pluggable).
|
||||
// - Stores records in memory; optional periodic snapshot to disk.
|
||||
// - Serves queries (SOA, NS, A, AAAA, TXT) for the configured zone
|
||||
// from the in-memory store plus a synthetic SOA/NS apex.
|
||||
//
|
||||
// Non-goals:
|
||||
// - General-purpose authoritative DNS (use `auto`/`file` for that).
|
||||
// - DNSSEC signing (add later via the `dnssec` plugin in front).
|
||||
//
|
||||
// Phase 1.2 status: parser fully wires Corefile into typed config.
|
||||
// ServeDNS still passes through to the next plugin — UPDATE handling
|
||||
// and zone-serving land in Phase 1.3/1.4. See plan at
|
||||
// Phase 1.3 status: store + query dispatch. ServeDNS now answers
|
||||
// authoritatively for the configured zone(s) from the in-memory store
|
||||
// (plus synthetic SOA/NS at apex). UPDATE handling still rejected —
|
||||
// that lands in Phase 1.4. See plan at
|
||||
//
|
||||
// ~/.claude/plans/dood-does-coredns-offer-enumerated-piglet.md
|
||||
package rfc2136
|
||||
|
||||
import (
|
||||
"context"
|
||||
"strings"
|
||||
|
||||
"github.com/coredns/coredns/plugin"
|
||||
"github.com/miekg/dns"
|
||||
|
|
@ -46,8 +37,8 @@ type RFC2136 struct {
|
|||
Zones []string
|
||||
|
||||
// TSIGKeys is keyed by canonical key name (lowercased, trailing
|
||||
// dot). Empty means TSIG is disabled — UPDATEs without TSIG would
|
||||
// be rejected unconditionally in Phase 1.4.
|
||||
// dot). Empty means TSIG is disabled — UPDATEs without TSIG are
|
||||
// rejected unconditionally in Phase 1.4.
|
||||
TSIGKeys map[string]tsigKey
|
||||
|
||||
// TTL is applied to dynamically-injected records that don't carry
|
||||
|
|
@ -56,17 +47,167 @@ type RFC2136 struct {
|
|||
|
||||
// PersistPath, when non-empty, names a file the plugin writes a
|
||||
// JSON snapshot of its in-memory store to on a periodic schedule.
|
||||
// Empty means in-memory only (acceptable for ACME challenges,
|
||||
// which are seconds-to-minutes lived and re-issued on restart).
|
||||
// Empty means in-memory only (acceptable for ACME challenges).
|
||||
PersistPath string
|
||||
|
||||
// Nameserver is the host returned in synthetic NS records and as
|
||||
// the SOA's MNAME. Defaults (set in setup) to the first zone apex.
|
||||
Nameserver string
|
||||
|
||||
// store holds the dynamic records. Always non-nil after setup.
|
||||
store *recordStore
|
||||
}
|
||||
|
||||
// Name implements plugin.Handler.
|
||||
func (p *RFC2136) Name() string { return "rfc2136" }
|
||||
|
||||
// ServeDNS implements plugin.Handler. Phase 1.x is a pass-through so
|
||||
// the plugin can register, parse config, and live in the chain without
|
||||
// changing behavior. Phase 1.3 wires UPDATE handling + query serving.
|
||||
// ServeDNS implements plugin.Handler.
|
||||
//
|
||||
// Dispatch:
|
||||
//
|
||||
// UPDATE opcode → rejected with REFUSED (Phase 1.4 implements properly).
|
||||
// Query opcode:
|
||||
// - Not in our zones → pass to Next.
|
||||
// - Apex SOA → synthetic SOA.
|
||||
// - Apex NS → synthetic NS.
|
||||
// - Match in store → return RRset.
|
||||
// - Name exists, wrong type → NODATA (NOERROR + SOA in authority).
|
||||
// - Name doesn't exist → NXDOMAIN (NameError + SOA in authority).
|
||||
func (p *RFC2136) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) {
|
||||
return plugin.NextOrFailure(p.Name(), p.Next, ctx, w, r)
|
||||
if r.Opcode == dns.OpcodeUpdate {
|
||||
// Phase 1.4 will dispatch to update handler. For now, refuse
|
||||
// loudly so clients know the plugin is loaded but not yet
|
||||
// accepting updates.
|
||||
return p.refuseUpdate(w, r)
|
||||
}
|
||||
|
||||
if len(r.Question) == 0 {
|
||||
return plugin.NextOrFailure(p.Name(), p.Next, ctx, w, r)
|
||||
}
|
||||
|
||||
q := r.Question[0]
|
||||
zone := p.findZone(q.Name)
|
||||
if zone == "" {
|
||||
return plugin.NextOrFailure(p.Name(), p.Next, ctx, w, r)
|
||||
}
|
||||
|
||||
// We're authoritative for this name. Build a reply.
|
||||
msg := new(dns.Msg)
|
||||
msg.SetReply(r)
|
||||
msg.Authoritative = true
|
||||
|
||||
qname := strings.ToLower(dns.Fqdn(q.Name))
|
||||
isApex := qname == zone
|
||||
|
||||
// Apex SOA / NS are synthetic.
|
||||
if isApex {
|
||||
switch q.Qtype {
|
||||
case dns.TypeSOA:
|
||||
msg.Answer = []dns.RR{p.syntheticSOA(zone)}
|
||||
_ = w.WriteMsg(msg)
|
||||
return dns.RcodeSuccess, nil
|
||||
case dns.TypeNS:
|
||||
msg.Answer = p.syntheticNS(zone)
|
||||
_ = w.WriteMsg(msg)
|
||||
return dns.RcodeSuccess, nil
|
||||
}
|
||||
}
|
||||
|
||||
// Look up the asked type in the store.
|
||||
if rrs := p.store.Lookup(qname, q.Qtype); rrs != nil {
|
||||
msg.Answer = rrs
|
||||
_ = w.WriteMsg(msg)
|
||||
return dns.RcodeSuccess, nil
|
||||
}
|
||||
|
||||
// Special case: ANY at the apex isn't in the store but we have
|
||||
// synthetic SOA + NS. Return them rather than NODATA.
|
||||
if isApex && q.Qtype == dns.TypeANY {
|
||||
msg.Answer = append(msg.Answer, p.syntheticSOA(zone))
|
||||
msg.Answer = append(msg.Answer, p.syntheticNS(zone)...)
|
||||
_ = w.WriteMsg(msg)
|
||||
return dns.RcodeSuccess, nil
|
||||
}
|
||||
|
||||
// Distinguish NODATA from NXDOMAIN.
|
||||
if p.store.NameExists(qname) || isApex {
|
||||
// NODATA: name exists, but not with this type.
|
||||
msg.Ns = []dns.RR{p.syntheticSOA(zone)}
|
||||
_ = w.WriteMsg(msg)
|
||||
return dns.RcodeSuccess, nil
|
||||
}
|
||||
|
||||
// NXDOMAIN: name doesn't exist anywhere in this zone.
|
||||
msg.Rcode = dns.RcodeNameError
|
||||
msg.Ns = []dns.RR{p.syntheticSOA(zone)}
|
||||
_ = w.WriteMsg(msg)
|
||||
return dns.RcodeNameError, nil
|
||||
}
|
||||
|
||||
// refuseUpdate returns REFUSED for UPDATE messages until Phase 1.4
|
||||
// wires the proper UPDATE handler. We keep a dedicated method so the
|
||||
// "this plugin doesn't yet accept updates" path is searchable in logs.
|
||||
func (p *RFC2136) refuseUpdate(w dns.ResponseWriter, r *dns.Msg) (int, error) {
|
||||
log.Warningf("UPDATE opcode received but Phase 1.4 not yet implemented — refusing")
|
||||
msg := new(dns.Msg)
|
||||
msg.SetRcode(r, dns.RcodeRefused)
|
||||
_ = w.WriteMsg(msg)
|
||||
return dns.RcodeRefused, nil
|
||||
}
|
||||
|
||||
// findZone returns the longest matching zone for qname, or "" if qname
|
||||
// is outside all configured zones. The returned zone is in canonical
|
||||
// form (lowercase, trailing dot).
|
||||
func (p *RFC2136) findZone(qname string) string {
|
||||
qname = strings.ToLower(dns.Fqdn(qname))
|
||||
// Longest-suffix wins so nested zones work correctly.
|
||||
var best string
|
||||
for _, z := range p.Zones {
|
||||
if qname == z || strings.HasSuffix(qname, "."+z) {
|
||||
if len(z) > len(best) {
|
||||
best = z
|
||||
}
|
||||
}
|
||||
}
|
||||
return best
|
||||
}
|
||||
|
||||
// syntheticSOA returns the SOA RR for a zone. Serial is derived from
|
||||
// the store's monotonic generation counter — every UPDATE bumps it,
|
||||
// so downstream observers can detect "something changed" without
|
||||
// having to AXFR.
|
||||
func (p *RFC2136) syntheticSOA(zone string) *dns.SOA {
|
||||
return &dns.SOA{
|
||||
Hdr: dns.RR_Header{
|
||||
Name: zone,
|
||||
Rrtype: dns.TypeSOA,
|
||||
Class: dns.ClassINET,
|
||||
Ttl: p.TTL,
|
||||
},
|
||||
Ns: p.Nameserver,
|
||||
Mbox: "admin." + zone,
|
||||
Serial: uint32(p.store.generation()),
|
||||
Refresh: 3600, // 1 hour
|
||||
Retry: 600, // 10 min
|
||||
Expire: 604800, // 1 week
|
||||
Minttl: 60, // negative-cache TTL
|
||||
}
|
||||
}
|
||||
|
||||
// syntheticNS returns the NS RRset for a zone. Currently a single NS
|
||||
// pointing at p.Nameserver (the host that runs this plugin). For
|
||||
// resiliency, future versions could accept multiple `nameserver`
|
||||
// directives.
|
||||
func (p *RFC2136) syntheticNS(zone string) []dns.RR {
|
||||
return []dns.RR{
|
||||
&dns.NS{
|
||||
Hdr: dns.RR_Header{
|
||||
Name: zone,
|
||||
Rrtype: dns.TypeNS,
|
||||
Class: dns.ClassINET,
|
||||
Ttl: p.TTL,
|
||||
},
|
||||
Ns: p.Nameserver,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue