Initial commit

checker/dns.go

@@ -0,0 +1,207 @@
+package checker
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/miekg/dns"
+)
+
+const dnsTimeout = 5 * time.Second
+
+// FallbackResolver is the resolver used when /etc/resolv.conf is missing or
+// empty. It can be overridden at startup (e.g. via a CLI flag) so operators
+// don't silently leak lookups to a third party.
+var FallbackResolver = net.JoinHostPort("1.1.1.1", "53")
+
+// dnsExchange sends a single query. proto="" uses UDP and retries over TCP on
+// truncation; recursion controls the RD flag.
+func dnsExchange(ctx context.Context, proto, server string, q dns.Question, recursion bool) (*dns.Msg, error) {
+	client := dns.Client{Net: proto, Timeout: dnsTimeout}
+
+	m := new(dns.Msg)
+	m.Id = dns.Id()
+	m.Question = []dns.Question{q}
+	m.RecursionDesired = recursion
+	m.SetEdns0(4096, true)
+
+	if deadline, ok := ctx.Deadline(); ok {
+		if d := time.Until(deadline); d > 0 && d < client.Timeout {
+			client.Timeout = d
+		}
+	}
+
+	r, _, err := client.Exchange(m, server)
+	if err != nil {
+		return nil, err
+	}
+	if r == nil {
+		return nil, fmt.Errorf("nil response from %s", server)
+	}
+	if r.Truncated && proto == "" {
+		tcpClient := dns.Client{Net: "tcp", Timeout: client.Timeout}
+		if r2, _, err2 := tcpClient.Exchange(m, server); err2 == nil && r2 != nil {
+			return r2, nil
+		}
+	}
+	return r, nil
+}
+
+// systemResolver returns the first configured resolver of the local system.
+func systemResolver() string {
+	cfg, err := dns.ClientConfigFromFile("/etc/resolv.conf")
+	if err != nil || len(cfg.Servers) == 0 {
+		return FallbackResolver
+	}
+	return net.JoinHostPort(cfg.Servers[0], cfg.Port)
+}
+
+// hostPort returns "host:port", correctly bracketing IPv6 literals.
+func hostPort(host, port string) string {
+	host = strings.TrimSuffix(host, ".")
+	return net.JoinHostPort(host, port)
+}
+
+// findReverseZone walks up the labels of fqdn until it finds a zone cut
+// (SOA). Returns the apex FQDN and the list of "host:53" authoritative
+// servers. The walk stops at the reverse-arpa apex (in-addr.arpa or
+// ip6.arpa) so we never accept a non-reverse zone (or the root) as a match.
+func findReverseZone(ctx context.Context, fqdn string) (apex string, servers []string, err error) {
+	resolver := systemResolver()
+	labels := dns.SplitDomainName(fqdn)
+	for i := range labels {
+		candidate := dns.Fqdn(strings.Join(labels[i:], "."))
+		if !isReverseArpa(candidate) {
+			break
+		}
+		q := dns.Question{Name: candidate, Qtype: dns.TypeSOA, Qclass: dns.ClassINET}
+		r, rerr := dnsExchange(ctx, "", resolver, q, true)
+		if rerr != nil {
+			continue
+		}
+		if r.Rcode != dns.RcodeSuccess {
+			continue
+		}
+		hasSOA := false
+		for _, rr := range r.Answer {
+			if _, ok := rr.(*dns.SOA); ok {
+				hasSOA = true
+				break
+			}
+		}
+		if !hasSOA {
+			continue
+		}
+		apex = candidate
+		// NS resolution failures are non-fatal: we still located the zone,
+		// and queryPTR will fall back to the system resolver. Returning an
+		// error here would make reverseZoneRule wrongly report "zone not
+		// found".
+		servers, _ := resolveZoneNSAddrs(ctx, apex)
+		return apex, servers, nil
+	}
+	return "", nil, fmt.Errorf("could not locate reverse zone of %s", fqdn)
+}
+
+// resolveZoneNSAddrs returns "host:53" entries for every NS of the zone.
+func resolveZoneNSAddrs(ctx context.Context, zone string) ([]string, error) {
+	var resolver net.Resolver
+	nss, err := resolver.LookupNS(ctx, strings.TrimSuffix(zone, "."))
+	if err != nil {
+		return nil, err
+	}
+	var out []string
+	for _, ns := range nss {
+		addrs, err := resolver.LookupHost(ctx, strings.TrimSuffix(ns.Host, "."))
+		if err != nil || len(addrs) == 0 {
+			continue
+		}
+		for _, a := range addrs {
+			out = append(out, hostPort(a, "53"))
+		}
+	}
+	return out, nil
+}
+
+// queryAtAuth sends q to the first reachable server of the list.
+func queryAtAuth(ctx context.Context, servers []string, q dns.Question) (*dns.Msg, string, error) {
+	var lastErr error
+	for _, s := range servers {
+		r, err := dnsExchange(ctx, "", s, q, false)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		return r, s, nil
+	}
+	if lastErr == nil {
+		lastErr = fmt.Errorf("no servers provided")
+	}
+	return nil, "", lastErr
+}
+
+// rcodeText returns the textual name of an rcode or a fallback string.
+func rcodeText(r int) string {
+	if s, ok := dns.RcodeToString[r]; ok {
+		return s
+	}
+	return fmt.Sprintf("RCODE(%d)", r)
+}
+
+// lowerFQDN returns the canonical lowercase FQDN form of name.
+func lowerFQDN(name string) string {
+	return strings.ToLower(dns.Fqdn(name))
+}
+
+// reverseNameToIP decodes a reverse-arpa name back to a net.IP. It accepts
+// both in-addr.arpa (IPv4) and ip6.arpa (IPv6). Returns nil if the name is
+// malformed.
+func reverseNameToIP(name string) net.IP {
+	n := strings.ToLower(strings.TrimSuffix(dns.Fqdn(name), "."))
+
+	switch {
+	case strings.HasSuffix(n, ".in-addr.arpa"):
+		labels := strings.Split(strings.TrimSuffix(n, ".in-addr.arpa"), ".")
+		if len(labels) != 4 {
+			return nil
+		}
+		// Reverse: "4.3.2.1" -> "1.2.3.4"
+		out := make([]string, 4)
+		for i, l := range labels {
+			if _, err := strconv.Atoi(l); err != nil {
+				return nil
+			}
+			out[3-i] = l
+		}
+		return net.ParseIP(strings.Join(out, "."))
+
+	case strings.HasSuffix(n, ".ip6.arpa"):
+		labels := strings.Split(strings.TrimSuffix(n, ".ip6.arpa"), ".")
+		if len(labels) != 32 {
+			return nil
+		}
+		// Reverse the nibbles and regroup into 8 × 4-hex blocks.
+		var sb strings.Builder
+		for i := len(labels) - 1; i >= 0; i-- {
+			if len(labels[i]) != 1 {
+				return nil
+			}
+			sb.WriteString(labels[i])
+			if i > 0 && (len(labels)-i)%4 == 0 {
+				sb.WriteByte(':')
+			}
+		}
+		return net.ParseIP(sb.String())
+	}
+	return nil
+}
+
+// isReverseArpa reports whether name lies inside in-addr.arpa or ip6.arpa.
+func isReverseArpa(name string) bool {
+	n := lowerFQDN(name)
+	return strings.HasSuffix(n, ".in-addr.arpa.") || strings.HasSuffix(n, ".ip6.arpa.")
+}