Add backups, token expiry warnings and name server checks
- Daily database backups: jarl-backup.timer runs 'jarld backup', which writes jarl-<UTC time>.db into backup.dir, checks it before naming it, and prunes by the time in the name while always keeping the newest keep_at_least. New backup: section in jarl.yaml; the dashboard and 'jarl status' show the newest backup and warn when it is stale or failed. The Debian package enables the timer. - 'jarld restore [FILE | latest]': checks the backup, shows it next to the current database, keeps the current one aside and records the restore. 'jarld serve' holds a database lock, so a restore can't run under a live jarld and two jarlds can't share a database. - Token expiry warnings from 14 days ahead: dashboard, token lists, a daily log line, and a CLI warning via the Jarl-Token-Expires header; 'jarl token list --expiring'. - 'jarl zone serials' and the zone page's Name servers tab: compare the serial on a primary zone's secondaries (NS records, also-notify) or a secondary zone's primaries with this server's. - 'jarl zone delegation': for zones on the internet, check the parent's delegation and glue against the zone; an undelegated zone gets a note. - Server: Jarl/<version> header; CLI exit code 2 for failed checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
abrown38andClaude Opus 5.5 committed
1 parent
1afed741bf
commit
293e6ddd33
47 files changed
+3717
-95
No files matched your search
@@ -0,0 +1,269 @@
|
||||
package server
|
||||
|
||||
// Name server checks (internal/nscheck): GET /zones/{zone}/serials and
|
||||
// GET /zones/{zone}/delegation. Both only run when asked for (the zone
|
||||
// page's Name servers tab, 'jarl zone serials' and 'jarl zone
|
||||
// delegation'); nothing checks in the background.
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/netip"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"jarl/internal/api"
|
||||
"jarl/internal/auth"
|
||||
"jarl/internal/dnsname"
|
||||
"jarl/internal/model"
|
||||
"jarl/internal/namedconf"
|
||||
"jarl/internal/nscheck"
|
||||
)
|
||||
|
||||
// checker is the nscheck.Checker the handlers use (tests replace it).
|
||||
func (s *Server) checker() *nscheck.Checker {
|
||||
if s.nsChecker != nil {
|
||||
c := *s.nsChecker
|
||||
return &c
|
||||
}
|
||||
return &nscheck.Checker{}
|
||||
}
|
||||
|
||||
func (s *Server) zoneSerials(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
|
||||
st, err := s.state(r)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
z, err := s.zoneByPath(r, st, p)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
resp := api.SerialsResponse{Zone: z.Name, View: st.ViewName(z), Type: z.Type, Servers: []nscheck.Result{}, Notes: []string{}}
|
||||
var targets []nscheck.Target
|
||||
switch z.Type {
|
||||
case model.ZonePrimary:
|
||||
targets = append(targets, nsTargets(st, z)...)
|
||||
an, notes := remoteTargets(st, inheritedOption(st, z, "also-notify"), "also-notify")
|
||||
targets = append(targets, an...)
|
||||
resp.Notes = append(resp.Notes, notes...)
|
||||
case model.ZoneSecondary, model.ZoneMirror:
|
||||
pr, notes := remoteTargets(st, st.FindOption(model.ScopeZone, z.ID, "primaries"), "primaries")
|
||||
targets = append(targets, pr...)
|
||||
resp.Notes = append(resp.Notes, notes...)
|
||||
default:
|
||||
return badRequest("only primary, secondary and mirror zones have serials to compare (this is a %s zone)", z.Type)
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second)
|
||||
defer cancel()
|
||||
resp.Serial, resp.SerialSource, err = s.localSerial(ctx, st, z)
|
||||
if err != nil {
|
||||
resp.Notes = append(resp.Notes, "named on this server didn't report the zone's serial: "+err.Error())
|
||||
}
|
||||
if len(targets) == 0 {
|
||||
if z.Type == model.ZonePrimary {
|
||||
resp.Notes = append(resp.Notes, "The zone has no NS records or also-notify targets to check.")
|
||||
} else {
|
||||
resp.Notes = append(resp.Notes, "The zone has no primaries to check.")
|
||||
}
|
||||
}
|
||||
if resp.View != "" {
|
||||
resp.Notes = append(resp.Notes, fmt.Sprintf("The zone is in view %s. Other servers answer from the view that matches this server's address (or key), as they do for its zone transfers and NOTIFYs.", resp.View))
|
||||
}
|
||||
resp.Servers = s.checker().Serials(ctx, z.Name, resp.Serial, targets)
|
||||
if len(resp.Servers) > 0 && !hasOther(resp.Servers) {
|
||||
resp.Notes = append(resp.Notes, "Only this server is listed, so there is nothing to compare with.")
|
||||
}
|
||||
resp.CheckedAt = time.Now()
|
||||
writeJSON(w, http.StatusOK, resp)
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *Server) zoneDelegation(w http.ResponseWriter, r *http.Request, p *auth.Principal) error {
|
||||
st, err := s.state(r)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
z, err := s.zoneByPath(r, st, p)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if z.Type != model.ZonePrimary {
|
||||
return badRequest("the delegation check compares the parent's delegation with the zone's NS records, so it needs a primary zone (this is a %s zone; check it where its primary is)", z.Type)
|
||||
}
|
||||
c := s.checker()
|
||||
if v := r.URL.Query().Get("resolver"); v != "" {
|
||||
// An address only, always port 53: this is a DNS resolver.
|
||||
a, err := netip.ParseAddr(v)
|
||||
if err != nil {
|
||||
return badRequest("resolver must be an IP address, e.g. 1.1.1.1 or 9.9.9.9")
|
||||
}
|
||||
c.Resolver = net.JoinHostPort(a.String(), "53")
|
||||
}
|
||||
var ns []string
|
||||
for _, rec := range st.ZoneRecords(z.ID) {
|
||||
if rec.Type == "NS" && rec.Name == z.Name {
|
||||
ns = append(ns, rec.Data)
|
||||
}
|
||||
}
|
||||
addrs := map[string][]string{}
|
||||
for _, n := range ns {
|
||||
if a := jarlAddresses(st, z.ViewID, dnsname.Fqdn(n)); len(a) > 0 {
|
||||
addrs[dnsname.Fqdn(n)] = a
|
||||
}
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
|
||||
defer cancel()
|
||||
ref, _, _ := s.localSerial(ctx, st, z)
|
||||
resp := api.DelegationResponse{DelegationReport: c.Delegation(ctx, z.Name, ns, addrs, ref), View: st.ViewName(z), Notes: []string{}, CheckedAt: time.Now()}
|
||||
if resp.View != "" {
|
||||
resp.Notes = append(resp.Notes, fmt.Sprintf("Compared with the zone in view %s. Resolvers on the internet get the view that matches their address; make sure that's this one.", resp.View))
|
||||
}
|
||||
writeJSON(w, http.StatusOK, resp)
|
||||
return nil
|
||||
}
|
||||
|
||||
// localSerial is the serial this server serves for z: named's, or for a
|
||||
// primary zone Jarl's when named isn't asked.
|
||||
func (s *Server) localSerial(ctx context.Context, st *model.State, z *model.Zone) (*uint32, string, error) {
|
||||
serial, ok, err := s.eng.LoadedSerial(ctx, st, z)
|
||||
if ok {
|
||||
return &serial, "named", nil
|
||||
}
|
||||
if z.Type == model.ZonePrimary {
|
||||
v := z.SOA.Serial
|
||||
return &v, "jarl", err
|
||||
}
|
||||
return nil, "", err
|
||||
}
|
||||
|
||||
// nsTargets are the name servers in the zone's apex NS records, with the
|
||||
// addresses Jarl has for them in the same view (or nil, to be looked up).
|
||||
func nsTargets(st *model.State, z *model.Zone) []nscheck.Target {
|
||||
var out []nscheck.Target
|
||||
for _, rec := range st.ZoneRecords(z.ID) {
|
||||
if rec.Type != "NS" || rec.Name != z.Name {
|
||||
continue
|
||||
}
|
||||
name := dnsname.Fqdn(rec.Data)
|
||||
out = append(out, nscheck.Target{Name: name, Addresses: jarlAddresses(st, z.ViewID, name), Source: "NS record"})
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// jarlAddresses returns the A and AAAA records for name in the primary
|
||||
// zones of a view (nil when Jarl has none).
|
||||
func jarlAddresses(st *model.State, viewID int64, name string) []string {
|
||||
var out []string
|
||||
for _, z := range st.ZonesInView(viewID) {
|
||||
if !z.HasRecords() || !dnsname.IsSubdomain(name, z.Name) {
|
||||
continue
|
||||
}
|
||||
for _, rec := range st.ZoneRecords(z.ID) {
|
||||
if rec.Name == name && (rec.Type == "A" || rec.Type == "AAAA") {
|
||||
out = append(out, rec.Data)
|
||||
}
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// inheritedOption finds an option for z as named does: the zone's own,
|
||||
// else its view's, else the server's.
|
||||
func inheritedOption(st *model.State, z *model.Zone, name string) *model.Option {
|
||||
if o := st.FindOption(model.ScopeZone, z.ID, name); o != nil {
|
||||
return o
|
||||
}
|
||||
if z.ViewID != 0 {
|
||||
if o := st.FindOption(model.ScopeView, z.ViewID, name); o != nil {
|
||||
return o
|
||||
}
|
||||
}
|
||||
return st.FindOption(model.ScopeOptions, 0, name)
|
||||
}
|
||||
|
||||
// remoteTargets turns an also-notify or primaries option into targets:
|
||||
// addresses with their port and key, following named remote-servers
|
||||
// lists.
|
||||
func remoteTargets(st *model.State, o *model.Option, source string) ([]nscheck.Target, []string) {
|
||||
if o == nil {
|
||||
return nil, nil
|
||||
}
|
||||
var out []nscheck.Target
|
||||
var notes []string
|
||||
var walk func(name, value string, port string, depth int)
|
||||
walk = func(name, value, port string, depth int) {
|
||||
stmt, err := namedconf.ParseOptionValue(name, value)
|
||||
if err != nil {
|
||||
notes = append(notes, fmt.Sprintf("couldn't read %s: %v", name, err))
|
||||
return
|
||||
}
|
||||
vals := stmt.Values()
|
||||
for i := 0; i+1 < len(vals); i++ {
|
||||
if strings.EqualFold(vals[i], "port") {
|
||||
port = vals[i+1]
|
||||
}
|
||||
}
|
||||
blk := stmt.FirstBlock()
|
||||
if blk == nil {
|
||||
return
|
||||
}
|
||||
for _, el := range blk.Stmts {
|
||||
if len(el.Items) == 0 || el.Items[0].Value == nil {
|
||||
continue
|
||||
}
|
||||
first := el.Items[0].Value.Text
|
||||
t := nscheck.Target{Source: source, Port: port}
|
||||
words := el.Values()
|
||||
for i := 0; i+1 < len(words); i++ {
|
||||
switch strings.ToLower(words[i]) {
|
||||
case "port":
|
||||
t.Port = words[i+1]
|
||||
case "key":
|
||||
if k := st.KeyByName(words[i+1]); k != nil {
|
||||
t.Key = &nscheck.Key{Name: k.Name, Algorithm: k.Algorithm, Secret: k.Secret}
|
||||
}
|
||||
}
|
||||
}
|
||||
if a, err := netip.ParseAddr(first); err == nil {
|
||||
t.Addresses = []string{a.String()}
|
||||
out = append(out, t)
|
||||
continue
|
||||
}
|
||||
// A named list of servers.
|
||||
if depth >= 5 {
|
||||
continue
|
||||
}
|
||||
if lo := remoteList(st, first); lo != nil {
|
||||
walk(lo.Name, lo.Value, port, depth+1)
|
||||
} else {
|
||||
notes = append(notes, fmt.Sprintf("%s refers to %q, which isn't an address or a server list Jarl knows", source, first))
|
||||
}
|
||||
}
|
||||
}
|
||||
walk(o.Name, o.Value, "", 0)
|
||||
return out, notes
|
||||
}
|
||||
|
||||
// remoteList finds a top-level remote-servers (or primaries) list.
|
||||
func remoteList(st *model.State, name string) *model.Option {
|
||||
for _, o := range st.ScopedOptions(model.ScopeTopLevel, 0) {
|
||||
switch o.Name {
|
||||
case "remote-servers", "primaries", "masters":
|
||||
if f := strings.Fields(o.Value); len(f) > 0 && strings.Trim(f[0], `"`) == name {
|
||||
return o
|
||||
}
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func hasOther(rs []nscheck.Result) bool {
|
||||
for _, r := range rs {
|
||||
if r.Status != "self" {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
Reference in new issue
Block a user