miekg Fix EDNS0 compliance (#2357)
* Fix EDNS0 compliance

Do SizeAndDo in the server (ScrubWriter) and remove all uses of this
from the plugins. Also *always* do it. This is to get into compliance
for https://dnsflagday.net/.

The pkg/edns0 now exports the EDNS0 options we understand; this is
exported to allow plugins add things there. The *rewrite* plugin used
this to add custom EDNS0 option codes that the server needs to
understand.

This also needs a new release of miekg/dns because it triggered a
race-condition that was basicly there forever.

See:
* miekg/dns#857
* miekg/dns#859

Running a test instance and pointing the https://ednscomp.isc.org/ednscomp
to it shows the tests are now fixed:

~~~
EDNS Compliance Tester
Checking: 'miek.nl' as at 2018-12-01T17:53:15Z

miek.nl. @147.75.204.203 (drone.coredns.io.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=ok edns1opt=ok do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok
miek.nl. @2604:1380:2002:a000::1 (drone.coredns.io.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=ok edns1opt=ok do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok

All Ok
Codes
ok - test passed.
~~~

Signed-off-by: Miek Gieben <miek@miek.nl>

Signed-off-by: Miek Gieben <miek@miek.nl>

* typos in comments

Signed-off-by: Miek Gieben <miek@miek.nl>
Latest commit fc667b9 Dec 6, 2018
Permalink
Type Name Latest commit message Commit time
..
Failed to load latest commit information.
tree
OWNERS
README.md Update README.md (#2344) Nov 28, 2018
closest.go
closest_test.go presubmit: check for uppercase (#1774) May 7, 2018
cname_test.go plugin/forward: add REFUSED test (#1878) Jun 15, 2018
delegation_test.go Default to scrubbing replies in the server (#2012) Aug 29, 2018
dname.go K8s remove string ops (#2119) Sep 22, 2018
dname_test.go Default to scrubbing replies in the server (#2012) Aug 29, 2018
dnssec_test.go Default to scrubbing replies in the server (#2012) Aug 29, 2018
dnssex_test.go
ds_test.go all: fix plugin import ordering (#1717) Apr 22, 2018
ent_test.go
example_org.go Remove the word middleware (#1067) Sep 14, 2017
file.go Fix EDNS0 compliance (#2357) Dec 6, 2018
file_test.go
fuzz.go fuzz: put fuzzing stuff in own build tag (#1215) Nov 10, 2017
glue_test.go
include_test.go
log_test.go Clean up tests logging (#1979) Jul 19, 2018
lookup.go Configurable zone reload interval in file plugin (#2110) Sep 29, 2018
lookup_test.go
notify.go Use logging (#1718) Apr 22, 2018
nsec3_test.go presubmit: check for uppercase (#1774) May 7, 2018
reload.go
reload_test.go Configurable zone reload interval in file plugin (#2110) Sep 29, 2018
secondary.go Typo fixes (#2031) Aug 14, 2018
secondary_test.go Typo fixes (#2031) Aug 14, 2018
setup.go Use filepath when manipulating file paths (#2221) Oct 21, 2018
setup_test.go plugin/file: shutdown reload goroutine (#1571) Mar 1, 2018
shutdown.go Configurable zone reload interval in file plugin (#2110) Sep 29, 2018
wildcard.go Remove the word middleware (#1067) Sep 14, 2017
wildcard_test.go Default to scrubbing replies in the server (#2012) Aug 29, 2018
xfr.go Typo fixes (#2031) Aug 14, 2018
xfr_test.go
zone.go
zone_test.go Remove the word middleware (#1067) Sep 14, 2017

README.md

file

Name

file - enables serving zone data from an RFC 1035-style master file.

Description

The file plugin is used for an "old-style" DNS server. It serves from a preloaded file that exists on disk. If the zone file contains signatures (i.e., is signed using DNSSEC), correct DNSSEC answers are returned. Only NSEC is supported! If you use this setup you are responsible for re-signing the zonefile.

Syntax

file DBFILE [ZONES...]
  • DBFILE the database file to read and parse. If the path is relative, the path from the root directive will be prepended to it.
  • ZONES zones it should be authoritative for. If empty, the zones from the configuration block are used.

If you want to round-robin A and AAAA responses look at the loadbalance plugin.

file DBFILE [ZONES... ] {
    transfer to ADDRESS...
    reload DURATION
    no_reload
    upstream [ADDRESS...]
}
  • transfer enables zone transfers. It may be specified multiples times. To or from signals the direction. ADDRESS must be denoted in CIDR notation (e.g., 127.0.0.1/32) or just as plain addresses. The special wildcard * means: the entire internet (only valid for 'transfer to'). When an address is specified a notify message will be send whenever the zone is reloaded.
  • reload interval to perform a reload of the zone if the SOA version changes. Default is one minute. Value of 0 means to not scan for changes and reload. For example, 30s checks the zonefile every 30 seconds and reloads the zone when serial changes.
  • no_reload deprecated. Sets reload to 0.
  • upstream defines upstream resolvers to be used resolve external names found (think CNAMEs) pointing to external names. This is only really useful when CoreDNS is configured as a proxy; for normal authoritative serving you don't need or want to use this. ADDRESS can be an IP address, an IP:port or a string pointing to a file that is structured as /etc/resolv.conf. If no ADDRESS is given, CoreDNS will resolve CNAMEs against itself.

Examples

Load the example.org zone from example.org.signed and allow transfers to the internet, but send notifies to 10.240.1.1

example.org {
    file example.org.signed {
        transfer to *
        transfer to 10.240.1.1
    }
}

Or use a single zone file for multiple zones:

. {
    file example.org.signed example.org example.net {
        transfer to *
        transfer to 10.240.1.1
    }
}