mirror of
https://github.com/superseriousbusiness/gotosocial.git
synced 2025-11-03 18:32:25 -06:00
287 lines
7.4 KiB
Go
287 lines
7.4 KiB
Go
package dns
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"fmt"
|
|
"time"
|
|
)
|
|
|
|
// Envelope is used when doing a zone transfer with a remote server.
|
|
type Envelope struct {
|
|
RR []RR // The set of RRs in the answer section of the xfr reply message.
|
|
Error error // If something went wrong, this contains the error.
|
|
}
|
|
|
|
// A Transfer defines parameters that are used during a zone transfer.
|
|
type Transfer struct {
|
|
*Conn
|
|
DialTimeout time.Duration // net.DialTimeout, defaults to 2 seconds
|
|
ReadTimeout time.Duration // net.Conn.SetReadTimeout value for connections, defaults to 2 seconds
|
|
WriteTimeout time.Duration // net.Conn.SetWriteTimeout value for connections, defaults to 2 seconds
|
|
TsigProvider TsigProvider // An implementation of the TsigProvider interface. If defined it replaces TsigSecret and is used for all TSIG operations.
|
|
TsigSecret map[string]string // Secret(s) for Tsig map[<zonename>]<base64 secret>, zonename must be in canonical form (lowercase, fqdn, see RFC 4034 Section 6.2)
|
|
tsigTimersOnly bool
|
|
TLS *tls.Config // TLS config. If Xfr over TLS will be attempted
|
|
}
|
|
|
|
func (t *Transfer) tsigProvider() TsigProvider {
|
|
if t.TsigProvider != nil {
|
|
return t.TsigProvider
|
|
}
|
|
if t.TsigSecret != nil {
|
|
return tsigSecretProvider(t.TsigSecret)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// TODO: Think we need to away to stop the transfer
|
|
|
|
// In performs an incoming transfer with the server in a.
|
|
// If you would like to set the source IP, or some other attribute
|
|
// of a Dialer for a Transfer, you can do so by specifying the attributes
|
|
// in the Transfer.Conn:
|
|
//
|
|
// d := net.Dialer{LocalAddr: transfer_source}
|
|
// con, err := d.Dial("tcp", master)
|
|
// dnscon := &dns.Conn{Conn:con}
|
|
// transfer = &dns.Transfer{Conn: dnscon}
|
|
// channel, err := transfer.In(message, master)
|
|
func (t *Transfer) In(q *Msg, a string) (env chan *Envelope, err error) {
|
|
switch q.Question[0].Qtype {
|
|
case TypeAXFR, TypeIXFR:
|
|
default:
|
|
return nil, &Error{"unsupported question type"}
|
|
}
|
|
|
|
timeout := dnsTimeout
|
|
if t.DialTimeout != 0 {
|
|
timeout = t.DialTimeout
|
|
}
|
|
|
|
if t.Conn == nil {
|
|
if t.TLS != nil {
|
|
t.Conn, err = DialTimeoutWithTLS("tcp-tls", a, t.TLS, timeout)
|
|
} else {
|
|
t.Conn, err = DialTimeout("tcp", a, timeout)
|
|
}
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
if err := t.WriteMsg(q); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
env = make(chan *Envelope)
|
|
switch q.Question[0].Qtype {
|
|
case TypeAXFR:
|
|
go t.inAxfr(q, env)
|
|
case TypeIXFR:
|
|
go t.inIxfr(q, env)
|
|
}
|
|
|
|
return env, nil
|
|
}
|
|
|
|
func (t *Transfer) inAxfr(q *Msg, c chan *Envelope) {
|
|
first := true
|
|
defer func() {
|
|
// First close the connection, then the channel. This allows functions blocked on
|
|
// the channel to assume that the connection is closed and no further operations are
|
|
// pending when they resume.
|
|
t.Close()
|
|
close(c)
|
|
}()
|
|
timeout := dnsTimeout
|
|
if t.ReadTimeout != 0 {
|
|
timeout = t.ReadTimeout
|
|
}
|
|
for {
|
|
t.Conn.SetReadDeadline(time.Now().Add(timeout))
|
|
in, err := t.ReadMsg()
|
|
if err != nil {
|
|
c <- &Envelope{nil, err}
|
|
return
|
|
}
|
|
if q.Id != in.Id {
|
|
c <- &Envelope{in.Answer, ErrId}
|
|
return
|
|
}
|
|
if first {
|
|
if in.Rcode != RcodeSuccess {
|
|
c <- &Envelope{in.Answer, &Error{err: fmt.Sprintf(errXFR, in.Rcode)}}
|
|
return
|
|
}
|
|
if !isSOAFirst(in) {
|
|
c <- &Envelope{in.Answer, ErrSoa}
|
|
return
|
|
}
|
|
first = !first
|
|
// only one answer that is SOA, receive more
|
|
if len(in.Answer) == 1 {
|
|
t.tsigTimersOnly = true
|
|
c <- &Envelope{in.Answer, nil}
|
|
continue
|
|
}
|
|
}
|
|
|
|
if !first {
|
|
t.tsigTimersOnly = true // Subsequent envelopes use this.
|
|
if isSOALast(in) {
|
|
c <- &Envelope{in.Answer, nil}
|
|
return
|
|
}
|
|
c <- &Envelope{in.Answer, nil}
|
|
}
|
|
}
|
|
}
|
|
|
|
func (t *Transfer) inIxfr(q *Msg, c chan *Envelope) {
|
|
var serial uint32 // The first serial seen is the current server serial
|
|
axfr := true
|
|
n := 0
|
|
qser := q.Ns[0].(*SOA).Serial
|
|
defer func() {
|
|
// First close the connection, then the channel. This allows functions blocked on
|
|
// the channel to assume that the connection is closed and no further operations are
|
|
// pending when they resume.
|
|
t.Close()
|
|
close(c)
|
|
}()
|
|
timeout := dnsTimeout
|
|
if t.ReadTimeout != 0 {
|
|
timeout = t.ReadTimeout
|
|
}
|
|
for {
|
|
t.SetReadDeadline(time.Now().Add(timeout))
|
|
in, err := t.ReadMsg()
|
|
if err != nil {
|
|
c <- &Envelope{nil, err}
|
|
return
|
|
}
|
|
if q.Id != in.Id {
|
|
c <- &Envelope{in.Answer, ErrId}
|
|
return
|
|
}
|
|
if in.Rcode != RcodeSuccess {
|
|
c <- &Envelope{in.Answer, &Error{err: fmt.Sprintf(errXFR, in.Rcode)}}
|
|
return
|
|
}
|
|
if n == 0 {
|
|
// Check if the returned answer is ok
|
|
if !isSOAFirst(in) {
|
|
c <- &Envelope{in.Answer, ErrSoa}
|
|
return
|
|
}
|
|
// This serial is important
|
|
serial = in.Answer[0].(*SOA).Serial
|
|
// Check if there are no changes in zone
|
|
if qser >= serial {
|
|
c <- &Envelope{in.Answer, nil}
|
|
return
|
|
}
|
|
}
|
|
// Now we need to check each message for SOA records, to see what we need to do
|
|
t.tsigTimersOnly = true
|
|
for _, rr := range in.Answer {
|
|
if v, ok := rr.(*SOA); ok {
|
|
if v.Serial == serial {
|
|
n++
|
|
// quit if it's a full axfr or the servers' SOA is repeated the third time
|
|
if axfr && n == 2 || n == 3 {
|
|
c <- &Envelope{in.Answer, nil}
|
|
return
|
|
}
|
|
} else if axfr {
|
|
// it's an ixfr
|
|
axfr = false
|
|
}
|
|
}
|
|
}
|
|
c <- &Envelope{in.Answer, nil}
|
|
}
|
|
}
|
|
|
|
// Out performs an outgoing transfer with the client connecting in w.
|
|
// Basic use pattern:
|
|
//
|
|
// ch := make(chan *dns.Envelope)
|
|
// tr := new(dns.Transfer)
|
|
// var wg sync.WaitGroup
|
|
// wg.Add(1)
|
|
// go func() {
|
|
// tr.Out(w, r, ch)
|
|
// wg.Done()
|
|
// }()
|
|
// ch <- &dns.Envelope{RR: []dns.RR{soa, rr1, rr2, rr3, soa}}
|
|
// close(ch)
|
|
// wg.Wait() // wait until everything is written out
|
|
// w.Close() // close connection
|
|
//
|
|
// The server is responsible for sending the correct sequence of RRs through the channel ch.
|
|
func (t *Transfer) Out(w ResponseWriter, q *Msg, ch chan *Envelope) error {
|
|
for x := range ch {
|
|
r := new(Msg)
|
|
// Compress?
|
|
r.SetReply(q)
|
|
r.Authoritative = true
|
|
// assume it fits TODO(miek): fix
|
|
r.Answer = append(r.Answer, x.RR...)
|
|
if tsig := q.IsTsig(); tsig != nil && w.TsigStatus() == nil {
|
|
r.SetTsig(tsig.Hdr.Name, tsig.Algorithm, tsig.Fudge, time.Now().Unix())
|
|
}
|
|
if err := w.WriteMsg(r); err != nil {
|
|
return err
|
|
}
|
|
w.TsigTimersOnly(true)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// ReadMsg reads a message from the transfer connection t.
|
|
func (t *Transfer) ReadMsg() (*Msg, error) {
|
|
m := new(Msg)
|
|
p := make([]byte, MaxMsgSize)
|
|
n, err := t.Read(p)
|
|
if err != nil && n == 0 {
|
|
return nil, err
|
|
}
|
|
p = p[:n]
|
|
if err := m.Unpack(p); err != nil {
|
|
return nil, err
|
|
}
|
|
if ts, tp := m.IsTsig(), t.tsigProvider(); ts != nil && tp != nil {
|
|
// Need to work on the original message p, as that was used to calculate the tsig.
|
|
err = TsigVerifyWithProvider(p, tp, t.tsigRequestMAC, t.tsigTimersOnly)
|
|
t.tsigRequestMAC = ts.MAC
|
|
}
|
|
return m, err
|
|
}
|
|
|
|
// WriteMsg writes a message through the transfer connection t.
|
|
func (t *Transfer) WriteMsg(m *Msg) (err error) {
|
|
var out []byte
|
|
if ts, tp := m.IsTsig(), t.tsigProvider(); ts != nil && tp != nil {
|
|
out, t.tsigRequestMAC, err = TsigGenerateWithProvider(m, tp, t.tsigRequestMAC, t.tsigTimersOnly)
|
|
} else {
|
|
out, err = m.Pack()
|
|
}
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = t.Write(out)
|
|
return err
|
|
}
|
|
|
|
func isSOAFirst(in *Msg) bool {
|
|
return len(in.Answer) > 0 &&
|
|
in.Answer[0].Header().Rrtype == TypeSOA
|
|
}
|
|
|
|
func isSOALast(in *Msg) bool {
|
|
return len(in.Answer) > 0 &&
|
|
in.Answer[len(in.Answer)-1].Header().Rrtype == TypeSOA
|
|
}
|
|
|
|
const errXFR = "bad xfr rcode: %d"
|