Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-10-19 00:35:42 -04:00
Code Issues Packages Projects Releases Wiki Activity

plugin/file: reject SOA owners that do not match the zone (#8555)

Browse Source 
Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>
This commit is contained in:
houyuwushang
2026-09-17 08:49:58 +08:00
committed by GitHub
parent 73198897ef
commit 84a93a0b89
10 changed files with 302 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

69
plugin/file/file_test.go
View File

@@ -1,6 +1,7 @@
package file
import (
"fmt"
"strings"
"testing"
)
@@ -21,6 +22,74 @@ func TestParseNoSOA(t *testing.T) {
}
}
func TestParseSOAOrigin(t *testing.T) {
tests := []struct {
name, origin, prefix, owner string
wantErr bool
}{
{name: "at", origin: "example.org.", owner: "@"},
{name: "absolute", origin: "example.org.", owner: "example.org."},
{name: "mixed case", origin: "example.org.", owner: "ExAmPlE.OrG."},
{name: "mixed case origin", origin: "ExAmPlE.OrG.", owner: "example.org."},
{name: "origin without final dot", origin: "example.org", owner: "@"},
{name: "relative to parent", origin: "example.org.", prefix: "$ORIGIN org.\n", owner: "example"},
{name: "decimal escape", origin: "example.org.", owner: `\101xample.org.`},
{name: "escaped dot", origin: `has\.dot.example.`, owner: `has\046dot.example.`},
{name: "root", origin: ".", owner: "@"},
{name: "relative owner", origin: "test", owner: "test", wantErr: true},
{name: "child", origin: "example.org.", owner: "child.example.org.", wantErr: true},
{name: "parent", origin: "example.org.", owner: "org.", wantErr: true},
{name: "unrelated", origin: "example.org.", owner: "example.net.", wantErr: true},
{name: "different ORIGIN", origin: "example.org.", prefix: "$ORIGIN example.net.\n", owner: "@", wantErr: true},
{name: "not root", origin: ".", owner: "example.org.", wantErr: true},
}
for _, tc := range tests {
for _, serial := range []int64{-1, 2, 3} {
t.Run(fmt.Sprintf("%s/serial=%d", tc.name, serial), func(t *testing.T) {
zone := tc.prefix + tc.owner + " 500 IN SOA ns.example. hostmaster.example. 3 3600 600 86400 300\n"
z, err := Parse(strings.NewReader(zone), tc.origin, "db.test", serial)
if tc.wantErr {
if err == nil {
t.Fatalf("accepted SOA owner %q for origin %q", z.SOA.Hdr.Name, tc.origin)
}
if !strings.Contains(err.Error(), "SOA owner") || !strings.Contains(err.Error(), "db.test") {
t.Fatalf("expected SOA owner error with file name, got %v", err)
}
if z != nil {
t.Fatal("invalid zone must not be returned")
}
return
}
if serial == 3 {
if _, ok := err.(*serialErr); !ok {
t.Fatalf("expected unchanged serial error, got %v", err)
}
return
}
if err != nil {
t.Fatal(err)
}
if z.SOA == nil {
t.Fatal("missing apex SOA")
}
})
}
}
}
func TestParseLaterSOAOrigin(t *testing.T) {
zone := `@ 500 IN SOA ns.example. hostmaster.example. 3 3600 600 86400 300
child 500 IN SOA ns.example. hostmaster.example. 4 3600 600 86400 300
`
z, err := Parse(strings.NewReader(zone), "example.org.", "db.test", -1)
if err == nil {
t.Fatalf("replaced apex SOA with %q", z.SOA.Hdr.Name)
}
if !strings.Contains(err.Error(), "SOA owner") {
t.Fatalf("expected SOA owner error, got %v", err)
}
}
const dbNoSOA = `
$TTL 1M
$ORIGIN example.org.