coredns / coredns Goto Github PK

There is a https/acme let's encrypt implementation in the code, the only use would prolly be DNS over TLS; this needs to happen (i.e. implemented)

It should stop the server, it doesn't code server/server.go (ListenAndServe) needs to get better.

More docs, that are place somewhere. A middleware.md is likely to be a good starting point.

Deleting stuff works, but you have to be careful when something is an empty non terminal, because then the node must be kept. Think the right check will soon be in place but I don't fully trust it yet. Needs more tests as well

For looksups in the tree we use a dns.RR, but we only use the name and type wasting the rest of the header. We should just use qname and qtype for all lookups

implement wildcard responses for both DNS and DNSSEC.

Add a middleware that can talk to etcd, just like SkyDNS

Add this as middleware?

Use http://bert-hubert.blogspot.co.uk/2015/10/how-to-do-fast-canonical-ordering-of.html

Haven't tested it, but I am pretty sure graceful restart does work anymore. We need
a) tests if this is the case
b) fix it

Think right now we return SERVFAIL, should be REFUSED if we are non authoritative for that zone.

respond to outgoing axfrs

Diff. than a proxy. A middleware to implements a full recursive (dnssec) resolver.

see parsing_test.go where a bunch a these are tested. We need to probable disallow/ignore this.

• for etcd setup middleware
• for loadbalance middleware
• for rewrite setup middleware

Support NSID (middleware thingy?)

And correctly return an EDNS0 error when we don't understand the OPT RR. Google for some ravings of marka on this subject.

% dig @x64.atoom.net -p 1053 miek.nl A CH                                                                                            ~
;; Warning: Message parser reports malformed message packet.

; <<>> DiG 9.8.3-P1 <<>> @x64.atoom.net -p 1053 miek.nl A CH
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34243
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;miek.nl.           CH  A

;; AUTHORITY SECTION:
miek.nl.        1800    IN  SOA linode.atoom.net. miek.miek.nl. 1459743181 14400 3600 604800 14400

;; Query time: 34 msec
;; SERVER: 2a01:7e00::f03c:91ff:fef1:6735#1053(2a01:7e00::f03c:91ff:fef1:6735)
;; WHEN: Mon Apr  4 11:32:50 2016
;; MSG SIZE  rcvd: 82

Should not answer in the IN class, and dig should not complain about the message...

Figure out how to implement and use a slave zone middleware that retrieves zones over AXFR, IXFR or rsync?

Right now only simple rules are implemented in middleware/rewrite/*, look at complex rules and what they can add.
SimpleRules at the moment only rewrite qtypes.

A simple middleware that export a /health HTTP endpoint that says OK when the server is up and running.

Add an extra parameters: ctx which will be a context.Context{} for communicating between middleware, i.e. a caching middleware reports a cache miss and the prometheus middleware can then report it by examining what's in the context.

Means remaining the current context.go Context to something else.

When doing an xfr it logs:

127.0.0.1 - [28/Mar/2016:16:03:02 +0100] "AXFR miek.nl. tcp" NOERROR 821
127.0.0.1 - [28/Mar/2016:16:03:03 +0100] "AXFR miek.nl. tcp" NOERROR 917

Dig says 917 is the correct number of octets, there is no difference in the dig out. No clue....

With the added param of context.Context in the middleware we can communicate between them. The first use-case for this would be: monitoring.

I.e. middleware proxy sets some vars in the context and the prometheus middleware picks this up from the context and sets the vars. This way we can get middleware monitoring without meddling with prometheus outside of the prometheus middleware.

This needs a key naming policy, i.e. middleware/proxy/counter-name

For fun things like authors, version. etc.

Most of this stuff can be lifted from skydns

Caddy is still mentioned in a gazillion places. This needs cleaning up. README is a good starting point.

Basically do the same thing as in SkyDNS and abstract away the access to the datasource. This will probably mean renaming the file to ... data? or something.

It would be something like this:

type Backend interface {
    Insert(rr dns.RR)
    Delete(rr dns.RR)
    Get(rr dns.RR) *Elem
    Len() int
    Next(rr dns.RR) *Elem // for nsec
    Prev(rr dns.RR) *Elem
// nsec3 foo as well? Or just give up on that?
}

And Elem is defined as:

type Elem struct {
    m map[uint16][]dns.RR
}

And also has some methods on it.

Everywhere here you should really do:
context.WithTimeout(1 * time.Second, g.Ctx)
to make sure that your requests can time out and your code doesn't hang :)

• docs
• tests
• functionality

Fix this and fix the test as well. Also document it.

add testing subdir in middleware and factor out some common test infrastructure, newA and friends, and checking for the returned sections.

Don't think the syntax:

file dbfile origin...

is properly supported. There are also no tests ;-) Both need fixing.

a caching middleware

The middleware in caddy sets the return code to something else than 0 and then the error handler takes over.

With DNS this is more tricky because some responses require state (NXDOMAIN) and cannot be handled by a generic error handler.

Need to clarify when, and when not the middleware has written to the client and how errors middleware can help here.

check for slave zone periodically (obeying the SOA record)

There are few checks (right now) if a name that is used is a proper domain name, i.e. names like
.miek.nl when used in the config will be deemed OK.

Needs fixing.

Look what kubernetes needs and write a middleware for it.

So, a signing middleware could be implemented. Question becomes what about the keys...
Should the middleware also intercept queries for DNSKEY/RRSIG and friends? Proobaaablly 'yes', but I am not sure at this point if that will work.

Filed bug to put ideas in.

A Corefile with:

dnssex.nl:1053 {
       file dnssex.nl.signed
}

Is wrongly parsed

See https://groups.google.com/forum/embed/#!topic/golang-nuts/Usu-B5rcCJs for ip matching, can be used for implementing acl. Maybe such an implementation should just live in the middleware, just like the testing directory.

See https://github.com/mwitkow/go-etcd-harness

Still needs a etcd binary, but hides the hassle of starting the damn thing.

Subject says all, needs fixing

http.FileSystem is half used, half not used. It's a nice abstraction for finding (zone) files, maybe we should just use it.

Something better than list of dns.RRs

Dogfood time! I want to run CoreDNS as my DNS server. For this it needs to be able:

• Server DNS requests from db files (#5)
• Do DNSSEC query resolution
• Be able to slave zones (#8)
• Listen and send notifies, prolly related to (#8)

In SkyDNS I have to dedup message and correct the order, i.e. CNAMEs before A records and other fluff. This can of course be also handled as a middleware.

See #9 for etcd implementation.

First: the simple: notify on start up.

Do like Knot, lowercase it all, only the question section matters in this case.
https://lists.nic.cz/pipermail/knot-dns-users/2016-April/000825.html

if done it already simplifies some code.

Fix proxy to work with all the features.

I'll probable leave adding EDNS0 "headers" out of the picture.