Skip to content

Commit

Permalink
Add option to do a zone transfer via TLS (#1533)
Browse files Browse the repository at this point in the history
* New func InTLS

Perform zone transfer via TLS

* Test xfr via TLS

* New field TLS, used to transfer via TLS

---------

Co-authored-by: Cesar Kuroiwa <cesar@registro.br>
  • Loading branch information
cesarkuroiwa and Cesar Kuroiwa authored Feb 14, 2024
1 parent 982d149 commit 57dcd27
Show file tree
Hide file tree
Showing 2 changed files with 61 additions and 1 deletion.
8 changes: 7 additions & 1 deletion xfr.go
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package dns

import (
"crypto/tls"
"fmt"
"time"
)
Expand All @@ -20,6 +21,7 @@ type Transfer struct {
TsigProvider TsigProvider // An implementation of the TsigProvider interface. If defined it replaces TsigSecret and is used for all TSIG operations.
TsigSecret map[string]string // Secret(s) for Tsig map[<zonename>]<base64 secret>, zonename must be in canonical form (lowercase, fqdn, see RFC 4034 Section 6.2)
tsigTimersOnly bool
TLS *tls.Config // TLS config. If Xfr over TLS will be attempted
}

func (t *Transfer) tsigProvider() TsigProvider {
Expand Down Expand Up @@ -57,7 +59,11 @@ func (t *Transfer) In(q *Msg, a string) (env chan *Envelope, err error) {
}

if t.Conn == nil {
t.Conn, err = DialTimeout("tcp", a, timeout)
if t.TLS != nil {
t.Conn, err = DialTimeoutWithTLS("tcp-tls", a, t.TLS, timeout)
} else {
t.Conn, err = DialTimeout("tcp", a, timeout)
}
if err != nil {
return nil, err
}
Expand Down
54 changes: 54 additions & 0 deletions xfr_test.go
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package dns

import (
"crypto/tls"
"testing"
"time"
)
Expand Down Expand Up @@ -87,6 +88,27 @@ func TestSingleEnvelopeXfr(t *testing.T) {
axfrTestingSuite(t, addrstr)
}

func TestSingleEnvelopeXfrTLS(t *testing.T) {
HandleFunc("miek.nl.", SingleEnvelopeXfrServer)
defer HandleRemove("miek.nl.")

cert, err := tls.X509KeyPair(CertPEMBlock, KeyPEMBlock)
if err != nil {
t.Fatalf("unable to build certificate: %v", err)
}

tlsConfig := tls.Config{
Certificates: []tls.Certificate{cert},
}
s, addrstr, _, err := RunLocalTLSServer(":0", &tlsConfig)
if err != nil {
t.Fatalf("unable to run test server: %s", err)
}
defer s.Shutdown()

axfrTestingSuiteTLS(t, addrstr)
}

func TestMultiEnvelopeXfr(t *testing.T) {
HandleFunc("miek.nl.", MultipleEnvelopeXfrServer)
defer HandleRemove("miek.nl.")
Expand Down Expand Up @@ -131,6 +153,38 @@ func axfrTestingSuite(t *testing.T, addrstr string) {
}
}

func axfrTestingSuiteTLS(t *testing.T, addrstr string) {
tr := new(Transfer)
m := new(Msg)
m.SetAxfr("miek.nl.")

tr.TLS = &tls.Config{
InsecureSkipVerify: true,
}
c, err := tr.In(m, addrstr)
if err != nil {
t.Fatal("failed to zone transfer in", err)
}

var records []RR
for msg := range c {
if msg.Error != nil {
t.Fatal(msg.Error)
}
records = append(records, msg.RR...)
}

if len(records) != len(xfrTestData) {
t.Fatalf("bad axfr: expected %v, got %v", records, xfrTestData)
}

for i, rr := range records {
if !IsDuplicate(rr, xfrTestData[i]) {
t.Fatalf("bad axfr: expected %v, got %v", records, xfrTestData)
}
}
}

func axfrTestingSuiteWithCustomTsig(t *testing.T, addrstr string, provider TsigProvider) {
tr := new(Transfer)
m := new(Msg)
Expand Down

0 comments on commit 57dcd27

Please sign in to comment.