package sign import ( "fmt" "io" "os" "path/filepath" "time" "github.com/coredns/coredns/plugin/file" "github.com/coredns/coredns/plugin/file/tree" clog "github.com/coredns/coredns/plugin/pkg/log" "github.com/miekg/dns" ) var log = clog.NewWithPlugin("sign") // Signer holds the data needed to sign a zone file. type Signer struct { keys []Pair origin string dbfile string directory string jitterIncep time.Duration jitterExpir time.Duration signedfile string stop chan struct{} } // Sign signs a zone file according to the parameters in s. func (s *Signer) Sign(now time.Time) (*file.Zone, error) { rd, err := os.Open(s.dbfile) if err != nil { return nil, err } z, err := Parse(rd, s.origin, s.dbfile) if err != nil { return nil, err } mttl := z.Apex.SOA.Minttl ttl := z.Apex.SOA.Header().Ttl inception, expiration := lifetime(now, s.jitterIncep, s.jitterExpir) z.Apex.SOA.Serial = uint32(now.Unix()) for _, pair := range s.keys { pair.Public.Header().Ttl = ttl // set TTL on key so it matches the RRSIG. z.Insert(pair.Public) z.Insert(pair.Public.ToDS(dns.SHA1).ToCDS()) z.Insert(pair.Public.ToDS(dns.SHA256).ToCDS()) z.Insert(pair.Public.ToCDNSKEY()) } names := names(s.origin, z) ln := len(names) for _, pair := range s.keys { rrsig, err := pair.signRRs([]dns.RR{z.Apex.SOA}, s.origin, ttl, inception, expiration) if err != nil { return nil, err } z.Insert(rrsig) // NS apex may not be set if RR's have been discarded because the origin doesn't match. if len(z.Apex.NS) > 0 { rrsig, err = pair.signRRs(z.Apex.NS, s.origin, ttl, inception, expiration) if err != nil { return nil, err } z.Insert(rrsig) } } // We are walking the tree in the same direction, so names[] can be used here to indicated the next element. i := 1 err = z.AuthWalk(func(e *tree.Elem, zrrs map[uint16][]dns.RR, auth bool) error { if !auth { return nil } if e.Name() == s.origin { nsec := NSEC(e.Name(), names[(ln+i)%ln], mttl, append(e.Types(), dns.TypeNS, dns.TypeSOA, dns.TypeRRSIG, dns.TypeNSEC)) z.Insert(nsec) } else { nsec := NSEC(e.Name(), names[(ln+i)%ln], mttl, append(e.Types(), dns.TypeRRSIG, dns.TypeNSEC)) z.Insert(nsec) } for t, rrs := range zrrs { // RRSIGs are not signed and NS records are not signed because we are never authoratiative for them. // The zone's apex nameservers records are not kept in this tree and are signed separately. if t == dns.TypeRRSIG || t == dns.TypeNS { continue } for _, pair := range s.keys { rrsig, err := pair.signRRs(rrs, s.origin, rrs[0].Header().Ttl, inception, expiration) if err != nil { return err } e.Insert(rrsig) } } i++ return nil }) return z, err } // resign checks if the signed zone exists, or needs resigning. func (s *Signer) resign() error { signedfile := filepath.Join(s.directory, s.signedfile) rd, err := os.Open(signedfile) if err != nil && os.IsNotExist(err) { return err } now := time.Now().UTC() return resign(rd, now) } // resign will scan rd and check the signature on the SOA record. We will resign on the basis // of 2 conditions: // * either the inception is more than 6 days ago, or // * we only have 1 week left on the signature // // All SOA signatures will be checked. If the SOA isn't found in the first 100 // records, we will resign the zone. func resign(rd io.Reader, now time.Time) (why error) { zp := dns.NewZoneParser(rd, ".", "resign") zp.SetIncludeAllowed(true) i := 0 for rr, ok := zp.Next(); ok; rr, ok = zp.Next() { if err := zp.Err(); err != nil { return err } switch x := rr.(type) { case *dns.RRSIG: if x.TypeCovered != dns.TypeSOA { continue } incep, _ := time.Parse("20060102150405", dns.TimeToString(x.Inception)) // If too long ago, resign. if now.Sub(incep) >= 0 && now.Sub(incep) > durationResignDays { return fmt.Errorf("inception %q was more than: %s ago from %s: %s", incep.Format(timeFmt), durationResignDays, now.Format(timeFmt), now.Sub(incep)) } // Inception hasn't even start yet. if now.Sub(incep) < 0 { return fmt.Errorf("inception %q date is in the future: %s", incep.Format(timeFmt), now.Sub(incep)) } expire, _ := time.Parse("20060102150405", dns.TimeToString(x.Expiration)) if expire.Sub(now) < durationExpireDays { return fmt.Errorf("expiration %q is less than: %s away from %s: %s", expire.Format(timeFmt), durationExpireDays, now.Format(timeFmt), expire.Sub(now)) } } i++ if i > 100 { // 100 is a random number. A SOA record should be the first in the zonefile, but RFC 1035 doesn't actually mandate this. So it could // be 3rd or even later. The number 100 looks crazy high enough that it will catch all weird zones, but not high enough to keep the CPU // busy with parsing all the time. return fmt.Errorf("no SOA RRSIG found in first 100 records") } } return nil } func signAndLog(s *Signer, why error) { now := time.Now().UTC() z, err := s.Sign(now) log.Infof("Signing %q because %s", s.origin, why) if err != nil { log.Warningf("Error signing %q with key tags %q in %s: %s, next: %s", s.origin, keyTag(s.keys), time.Since(now), err, now.Add(durationRefreshHours).Format(timeFmt)) return } if err := s.write(z); err != nil { log.Warningf("Error signing %q: failed to move zone file into place: %s", s.origin, err) return } log.Infof("Successfully signed zone %q in %q with key tags %q and %d SOA serial, elapsed %f, next: %s", s.origin, filepath.Join(s.directory, s.signedfile), keyTag(s.keys), z.Apex.SOA.Serial, time.Since(now).Seconds(), now.Add(durationRefreshHours).Format(timeFmt)) } // refresh checks every val if some zones need to be resigned. func (s *Signer) refresh(val time.Duration) { tick := time.NewTicker(val) defer tick.Stop() for { select { case <-s.stop: return case <-tick.C: why := s.resign() if why == nil { continue } signAndLog(s, why) } } } func lifetime(now time.Time, jitterInception, jitterExpiration time.Duration) (uint32, uint32) { incep := uint32(now.Add(durationSignatureInceptionHours).Add(jitterInception).Unix()) expir := uint32(now.Add(durationSignatureExpireDays).Add(jitterExpiration).Unix()) return incep, expir } Unnamed repository; edit this file 'description' to name the repository.
aboutsummaryrefslogtreecommitdiff
path: root/integration/bunjs-only-snippets/readdir.js (unfollow)
AgeCommit message (Expand)AuthorFilesLines
2022-03-17[bun.js] Implement `import.meta.resolve`Gravatar Jarred Sumner 7-31/+198
2022-03-17[bun.js] Add some of the fs constantsGravatar Jarred Sumner 1-0/+8
2022-03-17Ensure we handle unicode correctly when returning strings for node fsGravatar Jarred Sumner 1-2/+7
2022-03-17[JS Transpiler] Always print escape unicode identifiers, for nowGravatar Jarred Sumner 1-6/+5
2022-03-17Update lockfile.zigGravatar Jarred Sumner 1-0/+16
2022-03-17Move `Bun` to JSC.APIGravatar Jarred Sumner 8-1420/+1667
2022-03-17lil helper methodGravatar Jarred Sumner 1-0/+8
2022-03-17Update build-idGravatar Jarred Sumner 1-1/+1
2022-03-17only check oncebun-v0.0.73Gravatar Jarred Sumner 1-42/+33
2022-03-17Add test coverage for emoji in blobsGravatar Jarred Sumner 1-84/+133
2022-03-17Prevent segfaultGravatar Jarred Sumner 1-0/+4
2022-03-17move some code aroundGravatar Jarred Sumner 3-189/+9
2022-03-17Update build-idGravatar Jarred Sumner 1-1/+1
2022-03-17optimize blob.text()Gravatar Jarred Sumner 1-83/+185
2022-03-17query_string_map -> urlGravatar Jarred Sumner 30-28/+405
2022-03-16Fix crash from checking if something is an object when it is undefinedbun-v0.0.72Gravatar Jarred Sumner 4-12/+12
2022-03-16Fix setTimeout on LinuxGravatar Jarred SUmner 1-5/+12
2022-03-16Increase from 4ms -> 40ms for timeoutGravatar Jarred SUmner 1-1/+1
2022-03-16Update README.mdGravatar Jarred Sumner 1-0/+1
2022-03-16llvm-stirp not workingGravatar Jarred Sumner 1-1/+0
2022-03-16Update MakefileGravatar Jarred Sumner 1-1/+1
2022-03-16Update Dockerfile.baseGravatar Jarred Sumner 1-0/+1
2022-03-16Update MakefileGravatar Jarred Sumner 1-2/+23
2022-03-16cleanup error printingGravatar Jarred Sumner 7-105/+193
2022-03-16Revert "Unlimited arguments in process.nextTick"Gravatar Jarred Sumner 1-38/+48
2022-03-16bun.lockbGravatar Jarred Sumner 3-0/+0
2022-03-16Update feature_flags.zigGravatar Jarred Sumner 1-0/+1
2022-03-16[bun.js] Bun.unsafe test should check the gcGravatar Jarred Sumner 1-4/+14
2022-03-16Update work_pool.zigGravatar Jarred Sumner 1-21/+28
2022-03-16Add a way to run serial tasks on a different threadGravatar Jarred Sumner 1-3/+65
2022-03-16fix crash when SyntaxError is thrown and we did not receive an ErrorInstance?Gravatar Jarred Sumner 1-18/+25
2022-03-16[bun.js] Fix release-mode test failures in HeadersGravatar Jarred Sumner 1-47/+42
2022-03-16Update ref_count.zigGravatar Jarred Sumner 1-2/+0
2022-03-15file is too bigjarred/replGravatar Jarred Sumner 1-113827/+0
2022-03-15Update Dockerfile.baseGravatar Jarred Sumner 1-1/+1
2022-03-15Add rust and lolhtml to dockerfileGravatar Jarred Sumner 2-0/+20
2022-03-15bump webkitGravatar Jarred Sumner 1-1/+1
2022-03-15Update WebKitGravatar Jarred Sumner 1-0/+0
2022-03-15:camera:Gravatar Jarred Sumner 60-799/+859
2022-03-15Fix test failureGravatar Jarred Sumner 1-15/+17
2022-03-15[bun:error] handle errors without a name or messageGravatar Jarred Sumner 1-6/+11
2022-03-15Update pool.zigGravatar Jarred Sumner 1-0/+1
2022-03-15Load .env by defaultGravatar Jarred Sumner 2-0/+8
2022-03-15mimalloc interpose is buggyGravatar Jarred Sumner 1-2/+25
2022-03-15higher max http requests for bun.jsGravatar Jarred Sumner 1-0/+29
2022-03-15zero copyGravatar Jarred Sumner 1-21/+15
2022-03-15Update javascript.zigGravatar Jarred Sumner 1-2/+0
2022-03-15[bun.js] utf8 console.{time, count, timeEnd, profile, profileEnd, count, cou...Gravatar Jarred Sumner 1-16/+16