8187466686

Committed 07 Mar 2024 11:36AM UTC coverage: 58.225% (-1.0%) from 59.195%

Build # 8187466686

Build Type

push

github

Committed by

web-flow

Commit Message

Merge pull request #13866 from omoerbeek/rec-ztc-wildcard

rec: Don't enter wildcard qnames into the cache in the ZoneToCache function

Run Details

31966 of 88096 branches covered (36.29%)

Branch coverage included in aggregate %.

1 of 3 new or added lines in 1 file covered. (33.33%)

1820 existing lines in 31 files now uncovered.

111647 of 158554 relevant lines covered (70.42%)

3002396.3 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

50.19

/pdns/recursordist/rec-zonetocache.cc

/*
 * This file is part of PowerDNS or dnsdist.
 * Copyright -- PowerDNS.COM B.V. and its contributors
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
 * published by the Free Software Foundation.
 *
 * In addition, for the avoidance of any doubt, permission is granted to
 * link this program with OpenSSL and to (re)distribute the binaries
 * produced as the result of such linking.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */

#include "rec-zonetocache.hh"

#include "syncres.hh"
#include "zoneparser-tng.hh"
#include "query-local-address.hh"
#include "axfr-retriever.hh"
#include "validate-recursor.hh"
#include "logging.hh"
#include "rec-lua-conf.hh"
#include "zonemd.hh"
#include "validate.hh"

#ifdef HAVE_LIBCURL
#include "minicurl.hh"
#endif

#include <fstream>

struct ZoneData
{
  ZoneData(const std::shared_ptr<Logr::Logger>& log, const std::string& zone) :
    d_log(log),
    d_zone(zone),
    d_now(time(nullptr)) {}

  // Potentially the two fields below could be merged into a single map. ATM it is not clear to me
  // if that would make the code easier to read.
  std::map<pair<DNSName, QType>, vector<DNSRecord>> d_all;
  std::map<pair<DNSName, QType>, vector<shared_ptr<const RRSIGRecordContent>>> d_sigs;

  // Maybe use a SuffixMatchTree?
  std::set<DNSName> d_delegations;

  std::shared_ptr<Logr::Logger> d_log;
  DNSName d_zone;
  time_t d_now;

  [[nodiscard]] bool isRRSetAuth(const DNSName& qname, QType qtype) const;
  void parseDRForCache(DNSRecord& resourceRecord);
  pdns::ZoneMD::Result getByAXFR(const RecZoneToCache::Config& config, pdns::ZoneMD& zonemd);
  pdns::ZoneMD::Result processLines(const std::vector<std::string>& lines, const RecZoneToCache::Config& config, pdns::ZoneMD& zonemd);
  void ZoneToCache(const RecZoneToCache::Config& config);
  vState dnssecValidate(pdns::ZoneMD& zonemd, size_t& zonemdCount) const;
};

bool ZoneData::isRRSetAuth(const DNSName& qname, QType qtype) const
{
  DNSName delegatedZone(qname);
  if (qtype == QType::DS) {
    delegatedZone.chopOff();
  }
  bool isDelegated = false;
  for (;;) {
    if (d_delegations.count(delegatedZone) > 0) {
      isDelegated = true;
      break;
    }
    delegatedZone.chopOff();
    if (delegatedZone == g_rootdnsname || delegatedZone == d_zone) {
      break;
    }
  }
  return !isDelegated;
}

void ZoneData::parseDRForCache(DNSRecord& dnsRecord)
{
  if (dnsRecord.d_class != QClass::IN) {
    return;
  }
  const auto key = pair(dnsRecord.d_name, dnsRecord.d_type);

  dnsRecord.d_ttl += d_now;

  switch (dnsRecord.d_type) {
  case QType::NSEC:
  case QType::NSEC3:
    break;
  case QType::RRSIG: {
    const auto rrsig = getRR<RRSIGRecordContent>(dnsRecord);
    if (rrsig == nullptr) {
      break;
    }
    const auto sigkey = pair(key.first, rrsig->d_type);
    auto found = d_sigs.find(sigkey);
    if (found != d_sigs.end()) {
      found->second.push_back(rrsig);
    }
    else {
      vector<shared_ptr<const RRSIGRecordContent>> sigsrr;
      sigsrr.push_back(rrsig);
      d_sigs.insert({sigkey, sigsrr});
    }
    break;
  }
  case QType::NS:
    if (dnsRecord.d_name != d_zone) {
      d_delegations.insert(dnsRecord.d_name);
    }
    break;
  default:
    break;
  }

  auto found = d_all.find(key);
  if (found != d_all.end()) {
    found->second.push_back(dnsRecord);
  }
  else {
    vector<DNSRecord> dnsRecords;
    dnsRecords.push_back(dnsRecord);
    d_all.insert({key, dnsRecords});
  }
}

pdns::ZoneMD::Result ZoneData::getByAXFR(const RecZoneToCache::Config& config, pdns::ZoneMD& zonemd)
{
  ComboAddress primary = ComboAddress(config.d_sources.at(0), 53);
  uint16_t axfrTimeout = config.d_timeout;
  size_t maxReceivedBytes = config.d_maxReceivedBytes;
  const TSIGTriplet tsigTriplet = config.d_tt;
  ComboAddress local = config.d_local;
  if (local == ComboAddress()) {
    local = pdns::getQueryLocalAddress(primary.sin4.sin_family, 0);
  }

  AXFRRetriever axfr(primary, d_zone, tsigTriplet, &local, maxReceivedBytes, axfrTimeout);
  Resolver::res_t nop;
  vector<DNSRecord> chunk;
  time_t axfrStart = time(nullptr);
  time_t axfrNow = time(nullptr);

  // coverity[store_truncates_time_t]
  while (axfr.getChunk(nop, &chunk, (axfrStart + axfrTimeout - axfrNow)) != 0) {
    for (auto& dnsRecord : chunk) {
      if (config.d_zonemd != pdns::ZoneMD::Config::Ignore) {
        zonemd.readRecord(dnsRecord);
      }
      parseDRForCache(dnsRecord);
    }
    axfrNow = time(nullptr);
    if (axfrNow < axfrStart || axfrNow - axfrStart > axfrTimeout) {
      throw std::runtime_error("Total AXFR time for zoneToCache exceeded!");
    }
  }
  if (config.d_zonemd != pdns::ZoneMD::Config::Ignore) {
    bool validationDone = false;
    bool validationSuccess = false;
    zonemd.verify(validationDone, validationSuccess);
    d_log->info(Logr::Info, "ZONEMD digest validation", "validationDone", Logging::Loggable(validationDone),
                "validationSuccess", Logging::Loggable(validationSuccess));
    if (!validationDone) {
      return pdns::ZoneMD::Result::NoValidationDone;
    }
    if (!validationSuccess) {
      return pdns::ZoneMD::Result::ValidationFailure;
    }
  }
  return pdns::ZoneMD::Result::OK;
}

static std::vector<std::string> getLinesFromFile(const std::string& file)
{

  std::vector<std::string> lines;
  std::ifstream stream(file);
  if (!stream) {
    throw std::runtime_error("Cannot read file: " + file);
  }
  std::string line;
  while (std::getline(stream, line)) {
    lines.push_back(line);
  }
  return lines;
}

static std::vector<std::string> getURL(const RecZoneToCache::Config& config)
{
  std::vector<std::string> lines;
#ifdef HAVE_LIBCURL
  MiniCurl miniCurl;
  ComboAddress local = config.d_local;
  std::string reply = miniCurl.getURL(config.d_sources.at(0), nullptr, local == ComboAddress() ? nullptr : &local, static_cast<int>(config.d_timeout), false, true);
  if (config.d_maxReceivedBytes > 0 && reply.size() > config.d_maxReceivedBytes) {
    // We should actually detect this *during* the GET
    throw std::runtime_error("Retrieved data exceeds maxReceivedBytes");
  }
  std::istringstream stream(reply);
  string line;
  while (std::getline(stream, line)) {
    lines.push_back(line);
  }
#else
  throw std::runtime_error("url method configured but libcurl not compiled in");
#endif
  return lines;
}

pdns::ZoneMD::Result ZoneData::processLines(const vector<string>& lines, const RecZoneToCache::Config& config, pdns::ZoneMD& zonemd)
{
  DNSResourceRecord drr;
  ZoneParserTNG zpt(lines, d_zone, true);
  zpt.setMaxGenerateSteps(1);
  zpt.setMaxIncludes(0);

  while (zpt.get(drr)) {
    DNSRecord dnsRecord(drr);
    if (config.d_zonemd != pdns::ZoneMD::Config::Ignore) {
      zonemd.readRecord(dnsRecord);
    }
    parseDRForCache(dnsRecord);
  }
  if (config.d_zonemd != pdns::ZoneMD::Config::Ignore) {
    bool validationDone = false;
    bool validationSuccess = false;
    zonemd.verify(validationDone, validationSuccess);
    d_log->info(Logr::Info, "ZONEMD digest validation", "validationDone", Logging::Loggable(validationDone),
                "validationSuccess", Logging::Loggable(validationSuccess));
    if (!validationDone) {
      return pdns::ZoneMD::Result::NoValidationDone;
    }
    if (!validationSuccess) {
      return pdns::ZoneMD::Result::ValidationFailure;
    }
  }
  return pdns::ZoneMD::Result::OK;
}

vState ZoneData::dnssecValidate(pdns::ZoneMD& zonemd, size_t& zonemdCount) const
{
  pdns::validation::ValidationContext validationContext;
  validationContext.d_nsec3IterationsRemainingQuota = std::numeric_limits<decltype(validationContext.d_nsec3IterationsRemainingQuota)>::max();
  zonemdCount = 0;

  SyncRes resolver({d_now, 0});
  resolver.setDoDNSSEC(true);
  resolver.setDNSSECValidationRequested(true);

  dsmap_t dsmap; // Actually a set
  vState dsState = resolver.getDSRecords(d_zone, dsmap, false, 0, "");
  if (dsState != vState::Secure) {
    return dsState;
  }

  skeyset_t dnsKeys;
  sortedRecords_t records;
  if (zonemd.getDNSKEYs().empty()) {
    return vState::BogusUnableToGetDNSKEYs;
  }
  for (const auto& key : zonemd.getDNSKEYs()) {
    dnsKeys.emplace(key);
    records.emplace(key);
  }

  skeyset_t validKeys;
  vState dnsKeyState = validateDNSKeysAgainstDS(d_now, d_zone, dsmap, dnsKeys, records, zonemd.getRRSIGs(QType::DNSKEY), validKeys, std::nullopt, validationContext);
  if (dnsKeyState != vState::Secure) {
    return dnsKeyState;
  }

  if (validKeys.empty()) {
    return vState::BogusNoValidDNSKEY;
  }

  auto zonemdRecords = zonemd.getZONEMDs();
  zonemdCount = zonemdRecords.size();

  // De we need to do a denial validation?
  if (zonemdCount == 0) {
    const auto& nsecs = zonemd.getNSECs();
    const auto& nsec3s = zonemd.getNSEC3s();
    cspmap_t csp;

    vState nsecValidationStatus = vState::Indeterminate;

    if (!nsecs.records.empty() && !nsecs.signatures.empty()) {
      // Valdidate the NSEC
      nsecValidationStatus = validateWithKeySet(d_now, d_zone, nsecs.records, nsecs.signatures, validKeys, std::nullopt, validationContext);
      csp.emplace(std::pair(d_zone, QType::NSEC), nsecs);
    }
    else if (!nsec3s.records.empty() && !nsec3s.signatures.empty()) {
      // Validate NSEC3PARAMS
      records.clear();
      for (const auto& rec : zonemd.getNSEC3Params()) {
        records.emplace(rec);
      }
      nsecValidationStatus = validateWithKeySet(d_now, d_zone, records, zonemd.getRRSIGs(QType::NSEC3PARAM), validKeys, std::nullopt, validationContext);
      if (nsecValidationStatus != vState::Secure) {
        d_log->info(Logr::Warning, "NSEC3PARAMS records did not validate");
        return nsecValidationStatus;
      }
      // Valdidate the NSEC3
      nsecValidationStatus = validateWithKeySet(d_now, zonemd.getNSEC3Label(), nsec3s.records, nsec3s.signatures, validKeys, std::nullopt, validationContext);
      csp.emplace(std::pair(zonemd.getNSEC3Label(), QType::NSEC3), nsec3s);
    }
    else {
      d_log->info(Logr::Warning, "No NSEC(3) records and/or RRSIGS found to deny ZONEMD");
      return vState::BogusInvalidDenial;
    }

    if (nsecValidationStatus != vState::Secure) {
      d_log->info(Logr::Warning, "zone NSEC(3) record does not validate");
      return nsecValidationStatus;
    }

    auto denial = getDenial(csp, d_zone, QType::ZONEMD, false, false, validationContext, std::nullopt, true);
    if (denial == dState::NXQTYPE) {
      d_log->info(Logr::Info, "Validated denial of existence of ZONEMD record");
      return vState::Secure;
    }
    d_log->info(Logr::Warning, "No ZONEMD record, but NSEC(3) record does not deny it");
    return vState::BogusInvalidDenial;
  }

  // Collect the ZONEMD records and validate them using the validated DNSSKEYs
  records.clear();
  for (const auto& rec : zonemdRecords) {
    records.emplace(rec);
  }
  return validateWithKeySet(d_now, d_zone, records, zonemd.getRRSIGs(QType::ZONEMD), validKeys, std::nullopt, validationContext);
}

void ZoneData::ZoneToCache(const RecZoneToCache::Config& config)
{
  if (config.d_sources.size() > 1) {
    d_log->info(Logr::Warning, "Multiple sources not yet supported, using first");
  }

  if (config.d_dnssec == pdns::ZoneMD::Config::Require && (g_dnssecmode == DNSSECMode::Off || g_dnssecmode == DNSSECMode::ProcessNoValidate)) {
    throw PDNSException("ZONEMD DNSSEC validation failure: DNSSEC validation is switched off but required by ZoneToCache");
  }

  // First scan all records collecting info about delegations and sigs
  // A this moment, we ignore NSEC and NSEC3 records. It is not clear to me yet under which conditions
  // they could be entered in into the (neg)cache.

  auto zonemd = pdns::ZoneMD(DNSName(config.d_zone));
  pdns::ZoneMD::Result result = pdns::ZoneMD::Result::OK;
  if (config.d_method == "axfr") {
    d_log->info(Logr::Info, "Getting zone by AXFR");
    result = getByAXFR(config, zonemd);
  }
  else {
    vector<string> lines;
    if (config.d_method == "url") {
      d_log->info(Logr::Info, "Getting zone by URL");
      lines = getURL(config);
    }
    else if (config.d_method == "file") {
      d_log->info(Logr::Info, "Getting zone from file");
      lines = getLinesFromFile(config.d_sources.at(0));
    }
    result = processLines(lines, config, zonemd);
  }

  // Validate DNSKEYs and ZONEMD, rest of records are validated on-demand by SyncRes
  if (config.d_dnssec == pdns::ZoneMD::Config::Require || (g_dnssecmode != DNSSECMode::Off && g_dnssecmode != DNSSECMode::ProcessNoValidate && config.d_dnssec != pdns::ZoneMD::Config::Ignore)) {
    size_t zonemdCount = 0;
    auto validationStatus = dnssecValidate(zonemd, zonemdCount);
    d_log->info(Logr::Info, "ZONEMD record related DNSSEC validation", "validationStatus", Logging::Loggable(validationStatus),
                "zonemdCount", Logging::Loggable(zonemdCount));
    if (config.d_dnssec == pdns::ZoneMD::Config::Require && validationStatus != vState::Secure) {
      throw PDNSException("ZONEMD required DNSSEC validation failed");
    }
    if (validationStatus != vState::Secure && validationStatus != vState::Insecure) {
      throw PDNSException("ZONEMD record DNSSEC validation failed");
    }
  }

  if (config.d_zonemd == pdns::ZoneMD::Config::Require && result != pdns::ZoneMD::Result::OK) {
    // We do not accept NoValidationDone in this case
    throw PDNSException("ZONEMD digest validation failure");
    return;
  }
  if (config.d_zonemd == pdns::ZoneMD::Config::Validate && result == pdns::ZoneMD::Result::ValidationFailure) {
    throw PDNSException("ZONEMD digest validation failure");
    return;
  }

  // Rerun, now inserting the rrsets into the cache with associated sigs
  d_now = time(nullptr);
  for (const auto& [key, v] : d_all) {
    const auto& [qname, qtype] = key;
    if (qname.isWildcard()) {
      continue;
    }
    switch (qtype) {
    case QType::NSEC:
    case QType::NSEC3:
    case QType::RRSIG:
      break;
    default: {
      vector<shared_ptr<const RRSIGRecordContent>> sigsrr;
      auto iter = d_sigs.find(key);
      if (iter != d_sigs.end()) {
        sigsrr = iter->second;
      }
      bool auth = isRRSetAuth(qname, qtype);
      // Same decision as updateCacheFromRecords() (we do not test for NSEC since we skip those completely)
      if (auth || (qtype == QType::NS || qtype == QType::A || qtype == QType::AAAA || qtype == QType::DS)) {
        g_recCache->replace(d_now, qname, qtype, v, sigsrr,
                            std::vector<std::shared_ptr<DNSRecord>>(), auth, d_zone);
      }
      break;
    }
    }
  }
}

void RecZoneToCache::maintainStates(const map<DNSName, Config>& configs, map<DNSName, State>& states, uint64_t mygeneration)
{
  // Delete states that have no config
  for (auto it = states.begin(); it != states.end();) {
    if (configs.find(it->first) == configs.end()) {
      it = states.erase(it);
    }
    else {
      it = ++it;
    }
  }
  // Reset states for which the config generation changed and create new states for new configs
  for (const auto& config : configs) {
    auto state = states.find(config.first);
    if (state != states.end()) {
      if (state->second.d_generation != mygeneration) {
        state->second = {0, 0, mygeneration};
      }
    }
    else {
      states.emplace(config.first, State{0, 0, mygeneration});
    }
  }
}

void RecZoneToCache::ZoneToCache(const RecZoneToCache::Config& config, RecZoneToCache::State& state)
{
  if (state.d_waittime == 0 && state.d_lastrun > 0) {
    // single shot
    return;
  }
  if (state.d_lastrun > 0 && state.d_lastrun + state.d_waittime > time(nullptr)) {
    return;
  }
  auto log = g_slog->withName("ztc")->withValues("zone", Logging::Loggable(config.d_zone));

  state.d_waittime = config.d_retryOnError;
  try {
    ZoneData data(log, config.d_zone);
    data.ZoneToCache(config);
    state.d_waittime = config.d_refreshPeriod;
    log->info(Logr::Info, "Loaded zone into cache", "refresh", Logging::Loggable(state.d_waittime));
  }
  catch (const PDNSException& e) {
    log->error(Logr::Error, e.reason, "Unable to load zone into cache, will retry", "exception", Logging::Loggable("PDNSException"), "refresh", Logging::Loggable(state.d_waittime));
  }
  catch (const std::runtime_error& e) {
    log->error(Logr::Error, e.what(), "Unable to load zone into cache, will retry", "exception", Logging::Loggable("std::runtime_error"), "refresh", Logging::Loggable(state.d_waittime));
  }
  catch (...) {
    log->info(Logr::Error, "Unable to load zone into cache, will retry", "refresh", Logging::Loggable(state.d_waittime));
  }
  state.d_lastrun = time(nullptr);
}

1	/*
2	* This file is part of PowerDNS or dnsdist.
3	* Copyright -- PowerDNS.COM B.V. and its contributors
4	*
5	* This program is free software; you can redistribute it and/or modify
6	* it under the terms of version 2 of the GNU General Public License as
7	* published by the Free Software Foundation.
8	*
9	* In addition, for the avoidance of any doubt, permission is granted to
10	* link this program with OpenSSL and to (re)distribute the binaries
11	* produced as the result of such linking.
12	*
13	* This program is distributed in the hope that it will be useful,
14	* but WITHOUT ANY WARRANTY; without even the implied warranty of
15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16	* GNU General Public License for more details.
17	*
18	* You should have received a copy of the GNU General Public License
19	* along with this program; if not, write to the Free Software
20	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21	*/
22
23	#include "rec-zonetocache.hh"
24
25	#include "syncres.hh"
26	#include "zoneparser-tng.hh"
27	#include "query-local-address.hh"
28	#include "axfr-retriever.hh"
29	#include "validate-recursor.hh"
30	#include "logging.hh"
31	#include "rec-lua-conf.hh"
32	#include "zonemd.hh"
33	#include "validate.hh"
34
35	#ifdef HAVE_LIBCURL
36	#include "minicurl.hh"
37	#endif
38
39	#include <fstream>
40
41	struct ZoneData
42	{
43	ZoneData(const std::shared_ptr<Logr::Logger>& log, const std::string& zone) :
44	d_log(log),
45	d_zone(zone),
46	d_now(time(nullptr)) {}	14✔
47
48	// Potentially the two fields below could be merged into a single map. ATM it is not clear to me
49	// if that would make the code easier to read.
50	std::map<pair<DNSName, QType>, vector<DNSRecord>> d_all;
51	std::map<pair<DNSName, QType>, vector<shared_ptr<const RRSIGRecordContent>>> d_sigs;
52
53	// Maybe use a SuffixMatchTree?
54	std::set<DNSName> d_delegations;
55
56	std::shared_ptr<Logr::Logger> d_log;
57	DNSName d_zone;
58	time_t d_now;
59
60	[[nodiscard]] bool isRRSetAuth(const DNSName& qname, QType qtype) const;
61	void parseDRForCache(DNSRecord& resourceRecord);
62	pdns::ZoneMD::Result getByAXFR(const RecZoneToCache::Config& config, pdns::ZoneMD& zonemd);
63	pdns::ZoneMD::Result processLines(const std::vector<std::string>& lines, const RecZoneToCache::Config& config, pdns::ZoneMD& zonemd);
64	void ZoneToCache(const RecZoneToCache::Config& config);
65	vState dnssecValidate(pdns::ZoneMD& zonemd, size_t& zonemdCount) const;
66	};
67
68	bool ZoneData::isRRSetAuth(const DNSName& qname, QType qtype) const
69	{	110✔
70	DNSName delegatedZone(qname);	110✔
71	if (qtype == QType::DS) {	110✔
72	delegatedZone.chopOff();	6✔
73	}	6✔
74	bool isDelegated = false;	110✔
75	for (;;) {	326✔
76	if (d_delegations.count(delegatedZone) > 0) {	326✔
77	isDelegated = true;	78✔
78	break;	78✔
79	}	78✔
80	delegatedZone.chopOff();	248✔
81	if (delegatedZone == g_rootdnsname \|\| delegatedZone == d_zone) {	248✔
82	break;	32✔
83	}	32✔
84	}	248✔
85	return !isDelegated;	110✔
86	}	110✔
87
88	void ZoneData::parseDRForCache(DNSRecord& dnsRecord)
89	{	472✔
90	if (dnsRecord.d_class != QClass::IN) {	472!
91	return;	×
92	}	×
93	const auto key = pair(dnsRecord.d_name, dnsRecord.d_type);	472✔
94
95	dnsRecord.d_ttl += d_now;	472✔
96
97	switch (dnsRecord.d_type) {	472✔
98	case QType::NSEC:	24✔
99	case QType::NSEC3:	24!
100	break;	24✔
101	case QType::RRSIG: {	×
102	const auto rrsig = getRR<RRSIGRecordContent>(dnsRecord);	×
103	if (rrsig == nullptr) {	×
104	break;	×
105	}	×
106	const auto sigkey = pair(key.first, rrsig->d_type);	×
107	auto found = d_sigs.find(sigkey);	×
108	if (found != d_sigs.end()) {	×
109	found->second.push_back(rrsig);	×
110	}	×
111	else {	×
112	vector<shared_ptr<const RRSIGRecordContent>> sigsrr;	×
113	sigsrr.push_back(rrsig);	×
114	d_sigs.insert({sigkey, sigsrr});	×
115	}	×
116	break;	×
117	}	×
118	case QType::NS:	230✔
119	if (dnsRecord.d_name != d_zone) {	230✔
120	d_delegations.insert(dnsRecord.d_name);	72✔
121	}	72✔
122	break;	230✔
123	default:	218✔
124	break;	218✔
125	}	472✔
126
127	auto found = d_all.find(key);	472✔
128	if (found != d_all.end()) {	472✔
129	found->second.push_back(dnsRecord);	228✔
130	}	228✔
131	else {	244✔
132	vector<DNSRecord> dnsRecords;	244✔
133	dnsRecords.push_back(dnsRecord);	244✔
134	d_all.insert({key, dnsRecords});	244✔
135	}	244✔
136	}	472✔
137
138	pdns::ZoneMD::Result ZoneData::getByAXFR(const RecZoneToCache::Config& config, pdns::ZoneMD& zonemd)
139	{	×
140	ComboAddress primary = ComboAddress(config.d_sources.at(0), 53);	×
141	uint16_t axfrTimeout = config.d_timeout;	×
142	size_t maxReceivedBytes = config.d_maxReceivedBytes;	×
143	const TSIGTriplet tsigTriplet = config.d_tt;	×
144	ComboAddress local = config.d_local;	×
145	if (local == ComboAddress()) {	×
146	local = pdns::getQueryLocalAddress(primary.sin4.sin_family, 0);	×
147	}	×
148
149	AXFRRetriever axfr(primary, d_zone, tsigTriplet, &local, maxReceivedBytes, axfrTimeout);	×
150	Resolver::res_t nop;	×
151	vector<DNSRecord> chunk;	×
152	time_t axfrStart = time(nullptr);	×
153	time_t axfrNow = time(nullptr);	×
154
155	// coverity[store_truncates_time_t]
156	while (axfr.getChunk(nop, &chunk, (axfrStart + axfrTimeout - axfrNow)) != 0) {	×
157	for (auto& dnsRecord : chunk) {	×
158	if (config.d_zonemd != pdns::ZoneMD::Config::Ignore) {	×
159	zonemd.readRecord(dnsRecord);	×
160	}	×
161	parseDRForCache(dnsRecord);	×
162	}	×
163	axfrNow = time(nullptr);	×
164	if (axfrNow < axfrStart \|\| axfrNow - axfrStart > axfrTimeout) {	×
165	throw std::runtime_error("Total AXFR time for zoneToCache exceeded!");	×
166	}	×
167	}	×
168	if (config.d_zonemd != pdns::ZoneMD::Config::Ignore) {	×
169	bool validationDone = false;	×
170	bool validationSuccess = false;	×
171	zonemd.verify(validationDone, validationSuccess);	×
172	d_log->info(Logr::Info, "ZONEMD digest validation", "validationDone", Logging::Loggable(validationDone),	×
173	"validationSuccess", Logging::Loggable(validationSuccess));	×
174	if (!validationDone) {	×
175	return pdns::ZoneMD::Result::NoValidationDone;	×
176	}	×
177	if (!validationSuccess) {	×
178	return pdns::ZoneMD::Result::ValidationFailure;	×
179	}	×
180	}	×
181	return pdns::ZoneMD::Result::OK;	×
182	}	×
183
184	static std::vector<std::string> getLinesFromFile(const std::string& file)
185	{	14✔
186
187	std::vector<std::string> lines;	14✔
188	std::ifstream stream(file);	14✔
189	if (!stream) {	14!
190	throw std::runtime_error("Cannot read file: " + file);	×
191	}	×
192	std::string line;	14✔
193	while (std::getline(stream, line)) {	486✔
194	lines.push_back(line);	472✔
195	}	472✔
196	return lines;	14✔
197	}	14✔
198
199	static std::vector<std::string> getURL(const RecZoneToCache::Config& config)
200	{	×
201	std::vector<std::string> lines;	×
202	#ifdef HAVE_LIBCURL	×
203	MiniCurl miniCurl;	×
204	ComboAddress local = config.d_local;	×
205	std::string reply = miniCurl.getURL(config.d_sources.at(0), nullptr, local == ComboAddress() ? nullptr : &local, static_cast<int>(config.d_timeout), false, true);	×
206	if (config.d_maxReceivedBytes > 0 && reply.size() > config.d_maxReceivedBytes) {	×
207	// We should actually detect this during the GET
208	throw std::runtime_error("Retrieved data exceeds maxReceivedBytes");	×
209	}	×
210	std::istringstream stream(reply);	×
211	string line;	×
212	while (std::getline(stream, line)) {	×
213	lines.push_back(line);	×
214	}	×
215	#else
216	throw std::runtime_error("url method configured but libcurl not compiled in");
217	#endif
218	return lines;	×
219	}	×
220
221	pdns::ZoneMD::Result ZoneData::processLines(const vector<string>& lines, const RecZoneToCache::Config& config, pdns::ZoneMD& zonemd)
222	{	14✔
223	DNSResourceRecord drr;	14✔
224	ZoneParserTNG zpt(lines, d_zone, true);	14✔
225	zpt.setMaxGenerateSteps(1);	14✔
226	zpt.setMaxIncludes(0);	14✔
227
228	while (zpt.get(drr)) {	486✔
229	DNSRecord dnsRecord(drr);	472✔
230	if (config.d_zonemd != pdns::ZoneMD::Config::Ignore) {	472✔
231	zonemd.readRecord(dnsRecord);	279✔
232	}	279✔
233	parseDRForCache(dnsRecord);	472✔
234	}	472✔
235	if (config.d_zonemd != pdns::ZoneMD::Config::Ignore) {	14✔
236	bool validationDone = false;	9✔
237	bool validationSuccess = false;	9✔
238	zonemd.verify(validationDone, validationSuccess);	9✔
239	d_log->info(Logr::Info, "ZONEMD digest validation", "validationDone", Logging::Loggable(validationDone),	9✔
240	"validationSuccess", Logging::Loggable(validationSuccess));	9✔
241	if (!validationDone) {	9✔
242	return pdns::ZoneMD::Result::NoValidationDone;	3✔
243	}	3✔
244	if (!validationSuccess) {	6✔
245	return pdns::ZoneMD::Result::ValidationFailure;	2✔
246	}	2✔
247	}	6✔
248	return pdns::ZoneMD::Result::OK;	9✔
249	}	14✔
250
251	vState ZoneData::dnssecValidate(pdns::ZoneMD& zonemd, size_t& zonemdCount) const
252	{	3✔
253	pdns::validation::ValidationContext validationContext;	3✔
254	validationContext.d_nsec3IterationsRemainingQuota = std::numeric_limits<decltype(validationContext.d_nsec3IterationsRemainingQuota)>::max();	3✔
255	zonemdCount = 0;	3✔
256
257	SyncRes resolver({d_now, 0});	3✔
258	resolver.setDoDNSSEC(true);	3✔
259	resolver.setDNSSECValidationRequested(true);	3✔
260
261	dsmap_t dsmap; // Actually a set	3✔
262	vState dsState = resolver.getDSRecords(d_zone, dsmap, false, 0, "");	3✔
263	if (dsState != vState::Secure) {	3!
264	return dsState;	×
265	}	×
266
267	skeyset_t dnsKeys;	3✔
268	sortedRecords_t records;	3✔
269	if (zonemd.getDNSKEYs().empty()) {	3✔
270	return vState::BogusUnableToGetDNSKEYs;	2✔
271	}	2✔
272	for (const auto& key : zonemd.getDNSKEYs()) {	2✔
273	dnsKeys.emplace(key);	2✔
274	records.emplace(key);	2✔
275	}	2✔
276
277	skeyset_t validKeys;	1✔
278	vState dnsKeyState = validateDNSKeysAgainstDS(d_now, d_zone, dsmap, dnsKeys, records, zonemd.getRRSIGs(QType::DNSKEY), validKeys, std::nullopt, validationContext);	1✔
279	if (dnsKeyState != vState::Secure) {	1!
280	return dnsKeyState;	1✔
281	}	1✔
282
283	if (validKeys.empty()) {	×
284	return vState::BogusNoValidDNSKEY;	×
285	}	×
286
287	auto zonemdRecords = zonemd.getZONEMDs();	×
288	zonemdCount = zonemdRecords.size();	×
289
290	// De we need to do a denial validation?
291	if (zonemdCount == 0) {	×
292	const auto& nsecs = zonemd.getNSECs();	×
293	const auto& nsec3s = zonemd.getNSEC3s();	×
294	cspmap_t csp;	×
295
296	vState nsecValidationStatus = vState::Indeterminate;	×
297
298	if (!nsecs.records.empty() && !nsecs.signatures.empty()) {	×
299	// Valdidate the NSEC
300	nsecValidationStatus = validateWithKeySet(d_now, d_zone, nsecs.records, nsecs.signatures, validKeys, std::nullopt, validationContext);	×
301	csp.emplace(std::pair(d_zone, QType::NSEC), nsecs);	×
302	}	×
303	else if (!nsec3s.records.empty() && !nsec3s.signatures.empty()) {	×
304	// Validate NSEC3PARAMS
305	records.clear();	×
306	for (const auto& rec : zonemd.getNSEC3Params()) {	×
307	records.emplace(rec);	×
308	}	×
309	nsecValidationStatus = validateWithKeySet(d_now, d_zone, records, zonemd.getRRSIGs(QType::NSEC3PARAM), validKeys, std::nullopt, validationContext);	×
310	if (nsecValidationStatus != vState::Secure) {	×
311	d_log->info(Logr::Warning, "NSEC3PARAMS records did not validate");	×
312	return nsecValidationStatus;	×
313	}	×
314	// Valdidate the NSEC3
315	nsecValidationStatus = validateWithKeySet(d_now, zonemd.getNSEC3Label(), nsec3s.records, nsec3s.signatures, validKeys, std::nullopt, validationContext);	×
316	csp.emplace(std::pair(zonemd.getNSEC3Label(), QType::NSEC3), nsec3s);	×
317	}	×
318	else {	×
319	d_log->info(Logr::Warning, "No NSEC(3) records and/or RRSIGS found to deny ZONEMD");	×
320	return vState::BogusInvalidDenial;	×
321	}	×
322
323	if (nsecValidationStatus != vState::Secure) {	×
324	d_log->info(Logr::Warning, "zone NSEC(3) record does not validate");	×
325	return nsecValidationStatus;	×
326	}	×
327
328	auto denial = getDenial(csp, d_zone, QType::ZONEMD, false, false, validationContext, std::nullopt, true);	×
329	if (denial == dState::NXQTYPE) {	×
330	d_log->info(Logr::Info, "Validated denial of existence of ZONEMD record");	×
331	return vState::Secure;	×
332	}	×
333	d_log->info(Logr::Warning, "No ZONEMD record, but NSEC(3) record does not deny it");	×
334	return vState::BogusInvalidDenial;	×
335	}	×
336
337	// Collect the ZONEMD records and validate them using the validated DNSSKEYs
338	records.clear();	×
339	for (const auto& rec : zonemdRecords) {	×
340	records.emplace(rec);	×
341	}	×
342	return validateWithKeySet(d_now, d_zone, records, zonemd.getRRSIGs(QType::ZONEMD), validKeys, std::nullopt, validationContext);	×
343	}	×
344
345	void ZoneData::ZoneToCache(const RecZoneToCache::Config& config)
346	{	14✔
347	if (config.d_sources.size() > 1) {	14!
348	d_log->info(Logr::Warning, "Multiple sources not yet supported, using first");	×
349	}	×
350
351	if (config.d_dnssec == pdns::ZoneMD::Config::Require && (g_dnssecmode == DNSSECMode::Off \|\| g_dnssecmode == DNSSECMode::ProcessNoValidate)) {	14!
352	throw PDNSException("ZONEMD DNSSEC validation failure: DNSSEC validation is switched off but required by ZoneToCache");	×
353	}	×
354
355	// First scan all records collecting info about delegations and sigs
356	// A this moment, we ignore NSEC and NSEC3 records. It is not clear to me yet under which conditions
357	// they could be entered in into the (neg)cache.
358
359	auto zonemd = pdns::ZoneMD(DNSName(config.d_zone));	14✔
360	pdns::ZoneMD::Result result = pdns::ZoneMD::Result::OK;	14✔
361	if (config.d_method == "axfr") {	14!
362	d_log->info(Logr::Info, "Getting zone by AXFR");	×
363	result = getByAXFR(config, zonemd);	×
364	}	×
365	else {	14✔
366	vector<string> lines;	14✔
367	if (config.d_method == "url") {	14!
368	d_log->info(Logr::Info, "Getting zone by URL");	×
369	lines = getURL(config);	×
370	}	×
371	else if (config.d_method == "file") {	14!
372	d_log->info(Logr::Info, "Getting zone from file");	14✔
373	lines = getLinesFromFile(config.d_sources.at(0));	14✔
374	}	14✔
375	result = processLines(lines, config, zonemd);	14✔
376	}	14✔
377
378	// Validate DNSKEYs and ZONEMD, rest of records are validated on-demand by SyncRes
379	if (config.d_dnssec == pdns::ZoneMD::Config::Require \|\| (g_dnssecmode != DNSSECMode::Off && g_dnssecmode != DNSSECMode::ProcessNoValidate && config.d_dnssec != pdns::ZoneMD::Config::Ignore)) {	14!
380	size_t zonemdCount = 0;	3✔
381	auto validationStatus = dnssecValidate(zonemd, zonemdCount);	3✔
382	d_log->info(Logr::Info, "ZONEMD record related DNSSEC validation", "validationStatus", Logging::Loggable(validationStatus),	3✔
383	"zonemdCount", Logging::Loggable(zonemdCount));	3✔
384	if (config.d_dnssec == pdns::ZoneMD::Config::Require && validationStatus != vState::Secure) {	3!
385	throw PDNSException("ZONEMD required DNSSEC validation failed");	1✔
386	}	1✔
387	if (validationStatus != vState::Secure && validationStatus != vState::Insecure) {	2!
388	throw PDNSException("ZONEMD record DNSSEC validation failed");	2✔
389	}	2✔
390	}	2✔
391
392	if (config.d_zonemd == pdns::ZoneMD::Config::Require && result != pdns::ZoneMD::Result::OK) {	11✔
393	// We do not accept NoValidationDone in this case
394	throw PDNSException("ZONEMD digest validation failure");	3✔
395	return;	×
396	}	3✔
397	if (config.d_zonemd == pdns::ZoneMD::Config::Validate && result == pdns::ZoneMD::Result::ValidationFailure) {	8✔
398	throw PDNSException("ZONEMD digest validation failure");	1✔
399	return;	×
400	}	1✔
401
402	// Rerun, now inserting the rrsets into the cache with associated sigs
403	d_now = time(nullptr);	7✔
404	for (const auto& [key, v] : d_all) {	122✔
405	const auto& [qname, qtype] = key;	122✔
406	if (qname.isWildcard()) {	122!
NEW 407	continue;	×
NEW 408	}	×
409	switch (qtype) {	122✔
410	case QType::NSEC:	12✔
411	case QType::NSEC3:	12!
412	case QType::RRSIG:	12!
413	break;	12✔
414	default: {	110✔
415	vector<shared_ptr<const RRSIGRecordContent>> sigsrr;	110✔
416	auto iter = d_sigs.find(key);	110✔
417	if (iter != d_sigs.end()) {	110!
418	sigsrr = iter->second;	×
419	}	×
420	bool auth = isRRSetAuth(qname, qtype);	110✔
421	// Same decision as updateCacheFromRecords() (we do not test for NSEC since we skip those completely)
422	if (auth \|\| (qtype == QType::NS \|\| qtype == QType::A \|\| qtype == QType::AAAA \|\| qtype == QType::DS)) {	110!
423	g_recCache->replace(d_now, qname, qtype, v, sigsrr,	110✔
424	std::vector<std::shared_ptr<DNSRecord>>(), auth, d_zone);	110✔
425	}	110✔
426	break;	110✔
427	}	12✔
428	}	122✔
429	}	122✔
430	}	7✔
431
432	void RecZoneToCache::maintainStates(const map<DNSName, Config>& configs, map<DNSName, State>& states, uint64_t mygeneration)
433	{	×
434	// Delete states that have no config
435	for (auto it = states.begin(); it != states.end();) {	×
436	if (configs.find(it->first) == configs.end()) {	×
437	it = states.erase(it);	×
438	}	×
439	else {	×
440	it = ++it;	×
441	}	×
442	}	×
443	// Reset states for which the config generation changed and create new states for new configs
444	for (const auto& config : configs) {	×
445	auto state = states.find(config.first);	×
446	if (state != states.end()) {	×
447	if (state->second.d_generation != mygeneration) {	×
448	state->second = {0, 0, mygeneration};	×
449	}	×
450	}	×
451	else {	×
452	states.emplace(config.first, State{0, 0, mygeneration});	×
453	}	×
454	}	×
455	}	×
456
457	void RecZoneToCache::ZoneToCache(const RecZoneToCache::Config& config, RecZoneToCache::State& state)
458	{	14✔
459	if (state.d_waittime == 0 && state.d_lastrun > 0) {	14!
460	// single shot
461	return;	×
462	}	×
463	if (state.d_lastrun > 0 && state.d_lastrun + state.d_waittime > time(nullptr)) {	14!
464	return;	×
465	}	×
466	auto log = g_slog->withName("ztc")->withValues("zone", Logging::Loggable(config.d_zone));	14✔
467
468	state.d_waittime = config.d_retryOnError;	14✔
469	try {	14✔
470	ZoneData data(log, config.d_zone);	14✔
471	data.ZoneToCache(config);	14✔
472	state.d_waittime = config.d_refreshPeriod;	14✔
473	log->info(Logr::Info, "Loaded zone into cache", "refresh", Logging::Loggable(state.d_waittime));	14✔
474	}	14✔
475	catch (const PDNSException& e) {	14✔
476	log->error(Logr::Error, e.reason, "Unable to load zone into cache, will retry", "exception", Logging::Loggable("PDNSException"), "refresh", Logging::Loggable(state.d_waittime));	7✔
477	}	7✔
478	catch (const std::runtime_error& e) {	14✔
479	log->error(Logr::Error, e.what(), "Unable to load zone into cache, will retry", "exception", Logging::Loggable("std::runtime_error"), "refresh", Logging::Loggable(state.d_waittime));	×
480	}	×
481	catch (...) {	14✔
482	log->info(Logr::Error, "Unable to load zone into cache, will retry", "refresh", Logging::Loggable(state.d_waittime));	×
483	}	×
484	state.d_lastrun = time(nullptr);	14✔
485	}	14✔

PowerDNS / pdns / 8187466686

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous