implement & document DNSSEC pool rules

diff --git a/pdns/README-dnsdist.md b/pdns/README-dnsdist.md
index ce1f128b7e4d10dcf51a13e41186622fcbc98651..d001eefbfa8110e9fe2593bf866699e1044b5ece 100644 (file)
--- a/pdns/README-dnsdist.md
+++ b/pdns/README-dnsdist.md
@@ -206,6 +206,19 @@ servers that lack this feature.
 Note that calling `addAnyTCRule()` achieves the same thing, without
 involving Lua.
 
+DNSSEC
+------
+To provide DNSSEC service from a separate pool, try:
+```
+newServer{address="2001:888:2000:1d::2", pool="dnssec"}
+newServer{address="2a01:4f8:110:4389::2", pool="dnssec"}
+setDNSSECPool("dnssec")
+topRule()
+```
+
+This routes all queries with a DNSSEC OK (DO) or CD bit set to on to the "dnssec" pool.
+The final `topRule()` command moves this rule to the top, so it gets evaluated first.
+
 Inspecting live traffic
 -----------------------
 This is still much in flux, but for now, try:
@@ -431,6 +444,9 @@ Here are all functions:
    * `rmRule(n)`: remove rule n
    * `mvRule(from, to)`: move rule 'from' to a position where it is in front of 'to'. 'to' can be one larger than the largest rule,
      in which case the rule will be moved to the last position.
+ * Specialist rule generators
+   * addAnyTCRule(): generate TC=1 answers to ANY queries, moving them to TCP
+   * setDNSSECPool(): move queries requesting DNSSEC processing to this pool
  * Pool related:
    * `addPoolRule(domain, pool)`: send queries to this domain to that pool
    * `addPoolRule({domain, domain}, pool)`: send queries to these domains to that pool

diff --git a/pdns/dnsdist-lua.cc b/pdns/dnsdist-lua.cc
index 74a5ab6dec1cc371554bb551d89e9dfcbfec060f..fa6d926ac7ef6e4adfc39559009ae90227dc656b 100644 (file)
--- a/pdns/dnsdist-lua.cc
+++ b/pdns/dnsdist-lua.cc
@@ -17,7 +17,7 @@ vector<std::function<void(void)>> setupLua(bool client)
                      [client](boost::variant<string,std::unordered_map<std::string, std::string>> pvars, boost::optional<int> qps)
                      { 
                        if(client) {
-                         return shared_ptr<DownstreamState>();
+                         return std::make_shared<DownstreamState>(ComboAddress());
                        }
                        if(auto address = boost::get<string>(&pvars)) {
                          auto ret=std::make_shared<DownstreamState>(ComboAddress(*address, 53));
@@ -97,6 +97,15 @@ vector<std::function<void(void)>> setupLua(bool client)
       g_rulactions.setState(rules);
     });
 
+  g_lua.writeFunction("topRule", []() {
+      auto rules = g_rulactions.getCopy();
+      if(rules.empty())
+       return;
+      auto subject = *rules.rbegin();
+      rules.erase(std::prev(rules.end()));
+      rules.insert(rules.begin(), subject);
+      g_rulactions.setState(rules);
+    });
   g_lua.writeFunction("mvRule", [](unsigned int from, unsigned int to) {
       auto rules = g_rulactions.getCopy();
       if(from >= rules.size() || to > rules.size()) {

diff --git a/pdns/dnsdist.cc b/pdns/dnsdist.cc
index 8de15d2465979639ed115638fe59ec53f57ec96c..ad8498511dc2bf58a0ef73d904c79c4710e50f5a 100644 (file)
--- a/pdns/dnsdist.cc
+++ b/pdns/dnsdist.cc
@@ -980,7 +980,7 @@ char* my_generator(const char* text, int state)
   vector<string> words{"showRules()", "shutdown()", "rmRule(", "mvRule(", "addACL(", "addLocal(", "setServerPolicy(", "setServerPolicyLua(",
       "newServer(", "rmServer(", "showServers()", "show(", "newDNSName(", "newSuffixMatchNode(", "controlSocket(", "topClients(", "showResponseLatency()", 
       "newQPSLimiter(", "makeKey()", "setKey(", "testCrypto()", "addAnyTCRule()", "showServerPolicy()", "setACL(", "showACL()", "addDomainBlock(", 
-      "addPoolRule(", "addQPSLimit(", "topResponses(", "topQueries("};
+      "addPoolRule(", "addQPSLimit(", "topResponses(", "topQueries(", "topRule()", "setDNSSECPool("};
   static int s_counter=0;
   int counter=0;
   if(!state)

diff --git a/pdns/dnsdistconf.lua b/pdns/dnsdistconf.lua
index e844e6ee783ec0a43d72b5f38b00a142bbdae08c..a44484015781fdecdd4f294b399a6187e2eff1cd 100644 (file)
--- a/pdns/dnsdistconf.lua
+++ b/pdns/dnsdistconf.lua
@@ -57,9 +57,9 @@ end
 
 xs=newServer{address="2001:888:2000:1d::2", pool="auth"}
 newServer{address="2a01:4f8:110:4389::2", pool="auth"}
-
 xs:addPool("dnssec")
 setDNSSECPool("dnssec")
+topRule()
 
 function splitSetup(servers, remote, qname, qtype, dh)
         if(dh:getRD() == false)