Count DNSSEC stats for some names in a different set of counters

diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc
index 440e898167b011db0fc53b9bf6948629ada32420..4a3953514396a358cabd455912314bb244bcb31e 100644 (file)
--- a/pdns/pdns_recursor.cc
+++ b/pdns/pdns_recursor.cc
@@ -254,6 +254,8 @@ unsigned int g_numThreads;
 uint16_t g_outgoingEDNSBufsize;
 bool g_logRPZChanges{false};
 
+// Used in Syncres to counts DNSSEC stats for names in a different "universe"
+GlobalStateHolder<SuffixMatchNode> g_xdnssec;
 // Used in the Syncres to not throttle certain servers
 GlobalStateHolder<SuffixMatchNode> g_dontThrottleNames;
 GlobalStateHolder<NetmaskGroup> g_dontThrottleNetmasks;
@@ -4749,6 +4751,16 @@ static int serviceMain(int argc, char*argv[])
     g_dontThrottleNetmasks.setState(std::move(dontThrottleNetmasks));
   }
 
+  {
+    SuffixMatchNode xdnssecNames;
+    vector<string> parts;
+    stringtok(parts, ::arg()["x-dnssec-names"], " ,");
+    for (const auto &p : parts) {
+      xdnssecNames.add(DNSName(p));
+    }
+    g_xdnssec.setState(std::move(xdnssecNames));
+  }
+
   s_balancingFactor = ::arg().asDouble("distribution-load-factor");
   if (s_balancingFactor != 0.0 && s_balancingFactor < 1.0) {
     s_balancingFactor = 0.0;
@@ -5476,6 +5488,8 @@ int main(int argc, char **argv)
     ::arg().set("record-cache-shards", "Number of shards in the record cache")="1024";
     ::arg().set("refresh-on-ttl-perc", "If a record is requested from the cache and only this % of original TTL remains, refetch") = "0";
 
+    ::arg().set("x-dnssec-names", "Collect DNSSEC statistics for names or suffixes in this list in separate x-dnssec counters")="";
+
 #ifdef NOD_ENABLED
     ::arg().set("new-domain-tracking", "Track newly observed domains (i.e. never seen before).")="no";
     ::arg().set("new-domain-log", "Log newly observed domains.")="yes";

diff --git a/pdns/rec_channel_rec.cc b/pdns/rec_channel_rec.cc
index 0bcc47238eb868c6db0cd04edf132837a426626d..56e5517fec8456c1e722c22b52289d70baed541a 100644 (file)
--- a/pdns/rec_channel_rec.cc
+++ b/pdns/rec_channel_rec.cc
@@ -1198,6 +1198,14 @@ static void registerAllStats1()
     }
     return total;
   });
+  addGetStat("x-dnssec-result-bogus", []() {
+    static std::set<vState> const bogusStates = { vState::BogusNoValidDNSKEY, vState::BogusInvalidDenial, vState::BogusUnableToGetDSs, vState::BogusUnableToGetDNSKEYs, vState::BogusSelfSignedDS, vState::BogusNoRRSIG, vState::BogusNoValidRRSIG, vState::BogusMissingNegativeIndication, vState::BogusSignatureNotYetValid, vState::BogusSignatureExpired, vState::BogusUnsupportedDNSKEYAlgo, vState::BogusUnsupportedDSDigestType, vState::BogusNoZoneKeyBitSet, vState::BogusRevokedDNSKEY, vState::BogusInvalidDNSKEYProtocol };
+    uint64_t total = 0;
+    for (const auto& state : bogusStates) {
+      total += g_stats.xdnssecResults[state];
+    }
+    return total;
+  });
   addGetStat("dnssec-result-bogus-no-valid-dnskey", &g_stats.dnssecResults[vState::BogusNoValidDNSKEY]);
   addGetStat("dnssec-result-bogus-invalid-denial", &g_stats.dnssecResults[vState::BogusInvalidDenial]);
   addGetStat("dnssec-result-bogus-unable-to-get-dss", &g_stats.dnssecResults[vState::BogusUnableToGetDSs]);
@@ -1216,6 +1224,25 @@ static void registerAllStats1()
   addGetStat("dnssec-result-indeterminate", &g_stats.dnssecResults[vState::Indeterminate]);
   addGetStat("dnssec-result-nta", &g_stats.dnssecResults[vState::NTA]);
 
+  addGetStat("x-dnssec-result-bogus-no-valid-dnskey", &g_stats.xdnssecResults[vState::BogusNoValidDNSKEY]);
+  addGetStat("x-dnssec-result-bogus-invalid-denial", &g_stats.xdnssecResults[vState::BogusInvalidDenial]);
+  addGetStat("x-dnssec-result-bogus-unable-to-get-dss", &g_stats.xdnssecResults[vState::BogusUnableToGetDSs]);
+  addGetStat("x-dnssec-result-bogus-unable-to-get-dnskeys", &g_stats.xdnssecResults[vState::BogusUnableToGetDNSKEYs]);
+  addGetStat("x-dnssec-result-bogus-self-signed-ds", &g_stats.xdnssecResults[vState::BogusSelfSignedDS]);
+  addGetStat("x-dnssec-result-bogus-no-rrsig", &g_stats.xdnssecResults[vState::BogusNoRRSIG]);
+  addGetStat("x-dnssec-result-bogus-no-valid-rrsig", &g_stats.xdnssecResults[vState::BogusNoValidRRSIG]);
+  addGetStat("x-dnssec-result-bogus-missing-negative-indication", &g_stats.xdnssecResults[vState::BogusMissingNegativeIndication]);
+  addGetStat("x-dnssec-result-bogus-signature-not-yet-valid", &g_stats.xdnssecResults[vState::BogusSignatureNotYetValid]);
+  addGetStat("x-dnssec-result-bogus-signature-expired", &g_stats.xdnssecResults[vState::BogusSignatureExpired]);
+  addGetStat("x-dnssec-result-bogus-unsupported-dnskey-algo", &g_stats.xdnssecResults[vState::BogusUnsupportedDNSKEYAlgo]);
+  addGetStat("x-dnssec-result-bogus-unsupported-ds-digest-type", &g_stats.xdnssecResults[vState::BogusUnsupportedDSDigestType]);
+  addGetStat("x-dnssec-result-bogus-no-zone-key-bit-set", &g_stats.xdnssecResults[vState::BogusNoZoneKeyBitSet]);
+  addGetStat("x-dnssec-result-bogus-revoked-dnskey", &g_stats.xdnssecResults[vState::BogusRevokedDNSKEY]);
+  addGetStat("x-dnssec-result-bogus-invalid-dnskey-protocol", &g_stats.xdnssecResults[vState::BogusInvalidDNSKEYProtocol]);
+  addGetStat("x-dnssec-result-indeterminate", &g_stats.xdnssecResults[vState::Indeterminate]);
+  addGetStat("x-dnssec-result-nta", &g_stats.xdnssecResults[vState::NTA]);
+
+  
   addGetStat("policy-result-noaction", &g_stats.policyResults[DNSFilterEngine::PolicyKind::NoAction]);
   addGetStat("policy-result-drop", &g_stats.policyResults[DNSFilterEngine::PolicyKind::Drop]);
   addGetStat("policy-result-nxdomain", &g_stats.policyResults[DNSFilterEngine::PolicyKind::NXDOMAIN]);

diff --git a/pdns/recursordist/test-syncres_cc.cc b/pdns/recursordist/test-syncres_cc.cc
index 4ac5bb96797f7c2429478062b540c5fb14918538..58597e71f5e3a1da62b1720455aa59d9c42ad5dc 100644 (file)
--- a/pdns/recursordist/test-syncres_cc.cc
+++ b/pdns/recursordist/test-syncres_cc.cc
@@ -9,6 +9,7 @@
 
 RecursorStats g_stats;
 GlobalStateHolder<LuaConfigItems> g_luaconfs;
+GlobalStateHolder<SuffixMatchNode> g_xdnssec;
 GlobalStateHolder<SuffixMatchNode> g_dontThrottleNames;
 GlobalStateHolder<NetmaskGroup> g_dontThrottleNetmasks;
 std::unique_ptr<MemRecursorCache> g_recCache{nullptr};

diff --git a/pdns/syncres.cc b/pdns/syncres.cc
index b9b12c218ec2343babbad59937b65107b2f76636..af48cf9372dd55a3fce60dcf781dc34be6b68c64 100644 (file)
--- a/pdns/syncres.cc
+++ b/pdns/syncres.cc
@@ -167,7 +167,12 @@ int SyncRes::beginResolve(const DNSName &qname, const QType qtype, uint16_t qcla
     if (d_queryValidationState != vState::Indeterminate) {
       g_stats.dnssecValidations++;
     }
-    increaseDNSSECStateCounter(d_queryValidationState);
+    auto xdnssec = g_xdnssec.getLocal();
+    if (xdnssec->check(qname)) {
+      increaseXDNSSECStateCounter(d_queryValidationState);
+    } else {
+      increaseDNSSECStateCounter(d_queryValidationState);
+    }
   }
 
   return res;

diff --git a/pdns/syncres.hh b/pdns/syncres.hh
index abf4eaf8bf1b96a39b1dc2f8b90bf79c97e27525..937c84980630fbe581cdba44679a41a6ed8be1d7 100644 (file)
--- a/pdns/syncres.hh
+++ b/pdns/syncres.hh
@@ -61,6 +61,7 @@
 #include "fstrm_logger.hh"
 #endif /* HAVE_FSTRM */
 
+extern GlobalStateHolder<SuffixMatchNode> g_xdnssec;
 extern GlobalStateHolder<SuffixMatchNode> g_dontThrottleNames;
 extern GlobalStateHolder<NetmaskGroup> g_dontThrottleNetmasks;
 
@@ -1017,6 +1018,7 @@ struct RecursorStats
   unsigned int maxMThreadStackUsage;
   std::atomic<uint64_t> dnssecValidations; // should be the sum of all dnssecResult* stats
   std::map<vState, std::atomic<uint64_t> > dnssecResults;
+  std::map<vState, std::atomic<uint64_t> > xdnssecResults;
   std::map<DNSFilterEngine::PolicyKind, std::atomic<uint64_t> > policyResults;
   std::atomic<uint64_t> rebalancedQueries{0};
   std::atomic<uint64_t> proxyProtocolInvalidCount{0};

diff --git a/pdns/validate-recursor.cc b/pdns/validate-recursor.cc
index 41adc3da483d1c321c557640a03df2e71df5884f..c430d3d19e4b1c6672703bba2710bfba32994072 100644 (file)
--- a/pdns/validate-recursor.cc
+++ b/pdns/validate-recursor.cc
@@ -29,6 +29,12 @@ vState increaseDNSSECStateCounter(const vState& state)
   return state;
 }
 
+vState increaseXDNSSECStateCounter(const vState& state)
+{
+  g_stats.xdnssecResults[state]++;
+  return state;
+}
+
 // Returns true if dsAnchors were modified
 bool updateTrustAnchorsFromFile(const std::string &fname, map<DNSName, dsmap_t> &dsAnchors) {
   map<DNSName,dsmap_t> newDSAnchors;

diff --git a/pdns/validate-recursor.hh b/pdns/validate-recursor.hh
index 88ed15e66c0832c04bfeeb73bbc8a331586e7d73..f5e7a413732de167cb3321b1307d10c293be8ee6 100644 (file)
--- a/pdns/validate-recursor.hh
+++ b/pdns/validate-recursor.hh
@@ -38,4 +38,5 @@ extern bool g_dnssecLogBogus;
 bool checkDNSSECDisabled();
 bool warnIfDNSSECDisabled(const string& msg);
 vState increaseDNSSECStateCounter(const vState& state);
+vState increaseXDNSSECStateCounter(const vState& state);
 bool updateTrustAnchorsFromFile(const std::string &fname, map<DNSName, dsmap_t> &dsAnchors);