mirror/stackexchange-dnscontrol
1
0
Fork 0
mirror of https://github.com/StackExchange/dnscontrol.git synced 2024-05-11 05:55:12 +00:00
Code Issues Releases Activity

New validation check: Labels should not be FQDNs (#264)

Browse Source
This commit is contained in:
Craig Peterson
2017-11-14 23:13:50 -05:00
committed by Tom Limoncelli
parent 9a44e785ac
commit 2ef1fc42f8
2 changed files with 35 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
pkg/normalize/validate.go
View File

@ -90,7 +90,7 @@ var labelUnderscores = []string{"_domainkey", "_dmarc", "_amazonses", "_acme-cha
//these record types may contain underscores //these record types may contain underscores
var rTypeUnderscores = []string{"SRV", "TLSA", "TXT"} var rTypeUnderscores = []string{"SRV", "TLSA", "TXT"}
func checkLabel(label string, rType string, domain string) error { func checkLabel(label string, rType string, domain string, meta map[string]string) error {
if label == "@" { if label == "@" {
return nil return nil
} }
@ -100,6 +100,12 @@ func checkLabel(label string, rType string, domain string) error {
if label[len(label)-1] == '.' { if label[len(label)-1] == '.' {
return fmt.Errorf("label %s.%s ends with a (.)", label, domain) return fmt.Errorf("label %s.%s ends with a (.)", label, domain)
} }
if strings.HasSuffix(label, domain) {
if m := meta["skip_fqdn_check"]; m != "true" {
return fmt.Errorf(`label %s ends with domain name %s. Record names should not be fully qualified. Add {skip_fqdn_check:"true"} to this record if you really want to make %s.%s`, label, domain, label, domain)
}
}
// check for underscores last
for _, ex := range rTypeUnderscores { for _, ex := range rTypeUnderscores {
if rType == ex { if rType == ex {
return nil return nil
@ -114,6 +120,7 @@ func checkLabel(label string, rType string, domain string) error {
if strings.ContainsRune(label, '_') { if strings.ContainsRune(label, '_') {
return Warning{fmt.Errorf("label %s.%s contains an underscore", label, domain)} return Warning{fmt.Errorf("label %s.%s contains an underscore", label, domain)}
} }
return nil return nil
} }
@ -274,7 +281,7 @@ func NormalizeAndValidateConfig(config *models.DNSConfig) (errs []error) {
if err := validateRecordTypes(rec, domain.Name, pTypes); err != nil { if err := validateRecordTypes(rec, domain.Name, pTypes); err != nil {
errs = append(errs, err) errs = append(errs, err)
} }
if err := checkLabel(rec.Name, rec.Type, domain.Name); err != nil { if err := checkLabel(rec.Name, rec.Type, domain.Name, rec.Metadata); err != nil {
errs = append(errs, err) errs = append(errs, err)
} }
if errs2 := checkTargets(rec, domain.Name); errs2 != nil { if errs2 := checkTargets(rec, domain.Name); errs2 != nil {

40
pkg/normalize/validate_test.go
View File

@ -10,24 +10,36 @@ import (
func TestCheckLabel(t *testing.T) { func TestCheckLabel(t *testing.T) {
var tests = []struct { var tests = []struct {
label string label string
rType string rType string
target string isError bool
isError bool hasSkipMeta bool
}{ }{
{"@", "A", "0.0.0.0", false}, {"@", "A", false, false},
{"@", "A", "foo.tld", true}, {"foo.bar", "A", false, false},
{"foo.bar", "A", "0.0.0.0", false}, {"_foo", "A", true, false},
{"_foo", "SRV", "foo.tld", false}, {"_foo", "SRV", false, false},
{"_foo", "TLSA", "foo.tld", false}, {"_foo", "TLSA", false, false},
{"_foo", "TXT", "foo.tld", false}, {"_foo", "TXT", false, false},
{"test.foo.tld", "A", true, false},
{"test.foo.tld", "A", false, true},
} }
for _, test := range tests { for _, test := range tests {
err := checkLabel(test.label, test.rType, test.target) t.Run(fmt.Sprintf("%s %s", test.label, test.rType), func(t *testing.T) {
if err != nil && test.isError { meta := map[string]string{}
t.Errorf("%v: Expected error but got none \n", "TestCheckLabel") if test.hasSkipMeta {
} meta["skip_fqdn_check"] = "true"
}
err := checkLabel(test.label, test.rType, "foo.tld", meta)
if err != nil && !test.isError {
t.Errorf(" Expected no error but got %s", err)
}
if err == nil && test.isError {
t.Errorf(" Expected error but got none")
}
})
} }
} }