From: Pieter Lexis Date: Mon, 2 Oct 2017 11:20:38 +0000 (+0200) Subject: rec: support trustanchor.server CH TXT queries X-Git-Tag: dnsdist-1.4.0-rc1~108^2~9 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c1d92d739bf6bfb543ec78dfe3e8eaa628836766;p=thirdparty%2Fpdns.git rec: support trustanchor.server CH TXT queries --- diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc index 9be6586872..671307dad4 100644 --- a/pdns/pdns_recursor.cc +++ b/pdns/pdns_recursor.cc @@ -3305,6 +3305,7 @@ int main(int argc, char **argv) ::arg().set("single-socket", "If set, only use a single socket for outgoing queries")="off"; ::arg().set("auth-zones", "Zones for which we have authoritative data, comma separated domain=file pairs ")=""; ::arg().set("lua-config-file", "More powerful configuration options")=""; + ::arg().setSwitch("allow-trust-anchor-query", "Allow queries for trustanchor.server CH TXT")="yes"; ::arg().set("forward-zones", "Zones for which we forward queries, comma separated domain=ip pairs")=""; ::arg().set("forward-zones-recurse", "Zones for which we forward queries with recursion bit, comma separated domain=ip pairs")=""; diff --git a/pdns/recursordist/docs/dnssec.rst b/pdns/recursordist/docs/dnssec.rst index 110a820413..028cdaaee0 100644 --- a/pdns/recursordist/docs/dnssec.rst +++ b/pdns/recursordist/docs/dnssec.rst @@ -74,6 +74,9 @@ Trust Anchor Management In the PowerDNS Recursor, both positive and negative trust anchors can be configured during startup (from a persistent configuration file) and at runtime (which is volatile). However, all trust anchors are configurable. +Current trust anchors can be queried from the recursor by sending a query for "trustanchor.server CH TXT". +This query will (if :ref:`setting-allow-trust-anchor-query` is enabled) return a TXT record per trust-anchor in the format ``"DOMAIN KEYTAG [KEYTAG]..."``. + Trust Anchors ^^^^^^^^^^^^^ The PowerDNS Recursor ships with the DNSSEC Root key built-in. diff --git a/pdns/recursordist/docs/settings.rst b/pdns/recursordist/docs/settings.rst index 1ae0d71c1f..5a9aeac718 100644 --- a/pdns/recursordist/docs/settings.rst +++ b/pdns/recursordist/docs/settings.rst @@ -54,6 +54,17 @@ Overrides the `allow-from`_ setting. To use this feature, supply one netmask per Answer questions for the ANY type on UDP with a truncated packet that refers the remote server to TCP. Useful for mitigating ANY reflection attacks. +.. _setting-allow-trust-anchor-query: + +``allow-trust-anchor-query`` +---------------------------- +.. versionadded:: 4.1.0 + +- Boolean +- Default: yes + +Allow ``trustanchor.server CH TXT`` queries to view the configured :doc:`DNSSEC ` trust anchors. + .. _setting-api-config-dir: ``api-config-dir`` diff --git a/pdns/syncres.cc b/pdns/syncres.cc index c75c21901f..6888ec9041 100644 --- a/pdns/syncres.cc +++ b/pdns/syncres.cc @@ -159,11 +159,12 @@ int SyncRes::beginResolve(const DNSName &qname, const QType &qtype, uint16_t qcl * - version.bind. CH TXT * - version.pdns. CH TXT * - id.server. CH TXT + * - trustanchor.server CH TXT */ bool SyncRes::doSpecialNamesResolve(const DNSName &qname, const QType &qtype, const uint16_t qclass, vector &ret) { static const DNSName arpa("1.0.0.127.in-addr.arpa."), ip6_arpa("1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa."), - localhost("localhost."), versionbind("version.bind."), idserver("id.server."), versionpdns("version.pdns."); + localhost("localhost."), versionbind("version.bind."), idserver("id.server."), versionpdns("version.pdns."), trustanchorserver("trustanchor.server."); bool handled = false; vector > answers; @@ -195,6 +196,25 @@ bool SyncRes::doSpecialNamesResolve(const DNSName &qname, const QType &qtype, co } } + if (qname == trustanchorserver && qclass == QClass::CHAOS && + ::arg().mustDo("allow-trust-anchor-query")) { + handled = true; + if (qtype == QType::TXT || qtype == QType::ANY) { + auto luaLocal = g_luaconfs.getLocal(); + for (auto const &dsAnchor : luaLocal->dsAnchors) { + ostringstream ans; + ans<<"\""; + ans<