Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate Names for NameServer, Zone and Record objects (and support IDNs) #269

Merged
merged 36 commits into from Feb 3, 2023
Merged

Validate Names for NameServer, Zone and Record objects (and support IDNs) #269

merged 36 commits into from Feb 3, 2023

Conversation

peteeckel
Copy link
Contributor

@peteeckel peteeckel commented Dec 21, 2022

fixes #268

This PR provides validation of RR names according to the rules in RFC1035, Section 2.3.1, RFC2181, Section 11 and RFC5891, Section 4.2.3. Formerly, NetBox DNS accepted virtually anything as a record name, which could lead to zone files not being loadable by DNS servers such as BIND.

Note that host names in record values are not validated at the moment. Although this is desirable and may come as a further enhancement, it is a major effort as all RR values need to be parsed for validation and there are a large number of different RR types, many of them with alternative value formats that may or may not contain names that might need validation.

During implementation it became clear that validating names also requires correct handling of IDNs (International Domain Names) which can include Unicode characters. These characters need to be converted to host names in Punycode format, which satisfies the requirements in above RFCs and do not contain anything except alphanumerical characters, hyphens, optionally underscores and dots as label separators.

Therefore NetBox DNS was extended to convert names containing any Unicode characters to Punycode, which is used for storage in the database so the data can directly be processed by name servers. In the GUI, both the Punycode and the Unicode representation are displayed where applicable, and data entry can be done in both formats as required. In pre-populated edit forms, the Unicode representation is used for initial values, page titles etc.

There are three new plugin configuration variables affecting validation:

  • allow_underscores_in_hostnames can be set to allow undercores being used in host names. Normally, underscores are only permitted in certain record types such as SRV, not in normal host names, but Windows does not follow the standard and allows this. The default setting is False.
  • tolerate_leading_underscore_types contains a list of RR types that allow an underscore as the first character in a label. The default setting for this is ['TXT', 'SRV'].
  • tolerate_non_rfc1035_types contains a list of RR types that allow characters outside the set defined in RFC1035 to be used in RR names. Record types in this list are exempt from validation altogether. The default setting is the empty list.

@peteeckel peteeckel marked this pull request as draft December 21, 2022 21:16
@peteeckel peteeckel marked this pull request as ready for review December 29, 2022 22:19
@peteeckel peteeckel marked this pull request as draft December 29, 2022 22:19
@peteeckel peteeckel changed the title Validate Names for NameServer, Zone and Record objects Validate Names for NameServer, Zone and Record objects (and support IDNs) Jan 31, 2023
@peteeckel peteeckel marked this pull request as ready for review January 31, 2023 20:32
@peteeckel peteeckel marked this pull request as draft February 2, 2023 11:15
@peteeckel
Copy link
Contributor Author

I still found some room for performance improvement and code cleanup. Won't take too long.

@peteeckel peteeckel marked this pull request as ready for review February 2, 2023 14:52
@hatsat32 hatsat32 merged commit b810b02 into auroraresearchlab:main Feb 3, 2023
@peteeckel peteeckel deleted the feature/validate-names branch February 3, 2023 08:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Record name and zone name validation for Bind zone file generation
2 participants