dns-groot / groot Goto Github PK

View Code? Open in Web Editor NEW

75.0 3.0 9.0 1.49 MB

Static verification tool for DNS zone files

License: MIT License

C++ 95.91% CMake 1.52% Dockerfile 0.23% Shell 0.56% Python 1.79%

dns zone-files verification static-analyzer dns-zone-files

groot's People

Contributors

Stargazers

Watchers

Forkers

cjwu shuyangliu erickim78 ajis01 gilshein jauderho jupitereight miaofasheng bingbuliang

groot's Issues

json boilerplate

There appears to be a lot of repetitive json boilerplate (e.g., in properties.cpp), where the json is being constructed manually. This manual conversion is also what caused the bug in the structural delegation property.

Could we create specific classes for the result of each property check and then a superclass for "violation" that contains the common data (property name, etc.)? Then we could use the json library's simple method for converting classes to json:

https://github.com/nlohmann/json#basic-usage

WIN10+VS2022 can not complie groot

I followed the Installation for Windows section in README.md. However, there is a problem compiling the libgroot project with the following error message:

1>------ Build started: Project: libgroot, Configuration: Debug x64 ------
1>driver.cpp
1>C:\Users\DELL\Desktop\dns\groot\src\resource-record.h(53,25): warning C4267: '=': conversion from 'size_t' to 'int', possible loss of data
1>C:\Users\DELL\Desktop\dns\groot\concurrentqueue\concurrentqueue.h(431,2): warning C4554: '<<': check operator precedence for possible error; use parentheses to clarify precedence
1>C:\Users\DELL\Desktop\dns\groot\concurrentqueue\concurrentqueue.h(1682,20): message : see reference to function template instantiation 'bool moodycamel::details::circular_less_than<unsigned __int64>(T,T)' being compiled
1>        with
1>        [
1>            T=unsigned __int64
1>        ]
1>C:\Users\DELL\Desktop\dns\groot\concurrentqueue\concurrentqueue.h(1678,17): message : while compiling class template member function 'unsigned __int64 moodycamel::ConcurrentQueue<std::unique_ptr<Task,std::default_delete<Task>>,moodycamel::ConcurrentQueueDefaultTraits>::ProducerBase::size_approx(void) const'
1>C:\Users\DELL\Desktop\dns\groot\concurrentqueue\concurrentqueue.h(1269,9): message : see the first reference to 'moodycamel::ConcurrentQueue<std::unique_ptr<Task,std::default_delete<Task>>,moodycamel::ConcurrentQueueDefaultTraits>::ProducerBase::size_approx' in 'moodycamel::ConcurrentQueue<std::unique_ptr<Task,std::default_delete<Task>>,moodycamel::ConcurrentQueueDefaultTraits>::size_approx'
1>C:\Users\DELL\Desktop\dns\groot\src\driver.cpp(13,5): message : see the first reference to 'moodycamel::ConcurrentQueue<std::unique_ptr<Task,std::default_delete<Task>>,moodycamel::ConcurrentQueueDefaultTraits>::size_approx' in 'Driver::GenerateECsAndCheckProperties'
1>C:\Users\DELL\Desktop\dns\groot\concurrentqueue\concurrentqueue.h(1268,85): message : see reference to class template instantiation 'moodycamel::ConcurrentQueue<std::unique_ptr<Task,std::default_delete<Task>>,moodycamel::ConcurrentQueueDefaultTraits>::ProducerBase' being compiled
1>C:\Users\DELL\Desktop\dns\groot\concurrentqueue\concurrentqueue.h(1265,9): message : while compiling class template member function 'unsigned __int64 moodycamel::ConcurrentQueue<std::unique_ptr<Task,std::default_delete<Task>>,moodycamel::ConcurrentQueueDefaultTraits>::size_approx(void) const'
1>C:\Users\DELL\Desktop\dns\groot\src\driver.cpp(13,5): message : see the first reference to 'moodycamel::ConcurrentQueue<std::unique_ptr<Task,std::default_delete<Task>>,moodycamel::ConcurrentQueueDefaultTraits>::size_approx' in 'Driver::GenerateECsAndCheckProperties'
1>C:\Users\DELL\Desktop\dns\groot\src\job.h(16,51): message : see reference to class template instantiation 'moodycamel::ConcurrentQueue<std::unique_ptr<Task,std::default_delete<Task>>,moodycamel::ConcurrentQueueDefaultTraits>' being compiled
1>C:\Program Files\vcpkg\installed\x64-windows\include\fmt\core.h(1580,7): error C2338: static_assert failed: 'Cannot format an argument. To make type T formattable provide a formatter<T> specialization: https://fmt.dev/latest/api.html#udt'
1>C:\Program Files\vcpkg\installed\x64-windows\include\fmt\core.h(1808,23): message : see reference to function template instantiation 'fmt::v10::detail::value<Context> fmt::v10::detail::make_arg<true,Context,std::atomic<long>,0>(T &)' being compiled
1>        with
1>        [
1>            Context=fmt::v10::format_context,
1>            T=std::atomic<long>
1>        ]
1>C:\Program Files\vcpkg\installed\x64-windows\include\fmt\core.h(1826,11): message : see reference to function template instantiation 'fmt::v10::format_arg_store<fmt::v10::format_context,std::atomic<long>>::format_arg_store<std::atomic<long>>(std::atomic<long> &)' being compiled
1>C:\Program Files\vcpkg\installed\x64-windows\include\fmt\core.h(2788,28): message : see reference to function template instantiation 'fmt::v10::format_arg_store<fmt::v10::format_context,std::atomic<long>> fmt::v10::make_format_args<fmt::v10::format_context,std::atomic<long>>(std::atomic<long> &)' being compiled
1>C:\Users\DELL\Desktop\dns\groot\src\driver.cpp(432,23): message : see reference to function template instantiation 'std::string fmt::v10::format<std::atomic<long>&>(fmt::v10::basic_format_string<char,std::atomic<long> &>,std::atomic<long> &)' being compiled
1>C:\Program Files\vcpkg\installed\x64-windows\include\fmt\core.h(1576,63): error C2079: '_' uses undefined struct 'fmt::v10::detail::type_is_unformattable_for<std::atomic<long>,char>'
1>zone-graph.cpp
1>C:\Users\DELL\Desktop\dns\groot\src\resource-record.h(53,25): warning C4267: '=': conversion from 'size_t' to 'int', possible loss of data
1>Generating Code...
1>Done building project "libgroot.vcxproj" -- FAILED.
2>------ Build started: Project: groot, Configuration: Debug x64 ------

Could you tell me how to fix it?

Clarification regarding empty non-terminals (RFC 8020)

Hi,

I was reading your paper "GRooT: Proactive Verification of DNS Configurations" and have a question how the presented RRLookup would react to encountering empty non-terminals (ENTs) (see RFC7719 and RFC 8020).
If this is not a suitable place to discuss this I am happy to discuss this over e-mail too. I searched in the paper and in the repository and couldn't find an answer so far.

Here is in short why I think the paper does not properly model ENTs. I try to expand on each of the points a bit. Aa ENT is a domain name which exists, but has no resource records attached to it. An example might be _tcp.example.com. assuming that _jabber._tcp.example.com. exists and has an SRV record.

The RRLookup as given in Figure 3 does not seem to account for ENTs as the ExactMatch rule does not apply, since there is no exact match. The other rules also do not apply, as a zone can have ENTs without having wildcards, DNAMEs or delegations.
A resource records cannot model an ENT as a record always needs to have a type assigned so there is no way to model an empty record. From the paper:

We model a resource record r ∈ record = ⟨d, t, c, τ, a, b⟩ as a tuple with six components: [...] (2) a record type t ∈ type = {A, AAAA, MX, NS, DNAME, CNAME, SOA, . . .} representing the kind of data the record holds (e.g., AAAA for an IPv6 address)
A well-formed zone (Appendix A) is allowed to have ENTs. No rule prohibits it.

Longer Explanation

Let's assume we have a simple zone like this. I omitted the TTL as it is not important. The parts abbreviated with ... do not matter, except that they should be a valid record of course.

example.com. IN SOA ...
example.com. IN NS ns1.dns.net.
example.com. IN NS ns2.dns.net.

_jabber._tcp.example.com. IN SRV ...

A query like _tcp.example.com. IN SRV should return NOERROR and no data (i.e., ⟨Ans, ∅⟩).
(Btw. you can test this with google.com, which has a _jabber._tcp and _tcp is also an ENT.)

The zone is well-formed according to Appendix A. Rules (1)-(3) hold for the example. (4)-(9),(11) are not applicable since there is neither a CNAME nor a DNAME record. (10) also holds, as the only NS records also have an SOA record.

A zone is a set of records. It does not cover the fact that some domain names exist but have no records.

It is also not possible to create a record which only exists for the domain name, but without associated types or answer, as would be necessary for an ENT. This is a direct result of the definition of a record = ⟨d, t, c, τ, a, b⟩.

The ZoneLookup function will call RRLookup with a set of records. The records for example.com. have a higher rank than the record for _jabber._tcp.example.com., since 𝓘 (Match(r, q) is true for the former, but not the latter. Thus, the maximum lexicographical ordering will result in the records for example.com..

Now only the fallback rule for RRLookup applies. It is no exact match since _tcp.example.com. != example.com., there are no wildcards which could match, no DNAME rewrite, nor any delegations. Thus, RRLookup will return NXDOMAIN.

The NXDOMAIN is a violation of RFC 8020 "NXDOMAIN: There Really Is Nothing Underneath". NXDOMAIN means that the name and everything underneath does not exist. However, _jabber._tcp.example.com. exists and is underneath _tcp.example.com..

ZoneLookup / RRLookup will find the correct answer when presented with a query for _jabber._tcp.example.com.. That is not how all resolvers work though. RFC 7816: QNAME Minimization describes how resolvers instead can query label by label. Thus, such a QNAME minimization resolver would conclude that the answer to _jabber._tcp.example.com. is NXDOMAIN.

I hope my reasoning is clear from the description above and I didn't make a mistake with the formalism.

README Example not working?

I run the latest docker image () on my computer and copied the example from the README:

docker run -it dnsgt/groot

# First try with literally what I copied from GitHub
groot@177a7eb9e05c:~/groot$ .~/groot/build/bin/groot ~/groot/test/TestFiles/cc.il.us/zone_files --jobs=~/groot/test/TestFiles/cc.il.us/jobs.json --output=output.json
bash: .~/groot/build/bin/groot: No such file or directory

# First attempt at fixing
groot@177a7eb9e05c:~/groot$ . ~/groot/build/bin/groot ~/groot/test/TestFiles/cc.il.us/zone_files --jobs=~/groot/test/TestFiles/cc.il.us/jobs.json --output=output.json
bash: .: /home/groot/groot/build/bin/groot: cannot execute binary file

# Second attempt at fixing
groot@177a7eb9e05c:~/groot$ ~/groot/build/bin/groot ~/groot/test/TestFiles/cc.il.us/zone_files --jobs=~/groot/test/TestFiles/cc.il.us/jobs.json --output=output.json
Exception:- [json.exception.parse_error.101] parse error at line 1, column 1: syntax error while parsing value - unexpected end of input; expected '[', '{', or a literal

Sorry if I'm overlooking something obvious!

Groot itself seems to be working:

groot@177a7eb9e05c:~/groot$ ./build/bin/groot 
Arguments did not match expected patterns
groot 1.0
[...]

Also, the JSON seems to check out:

groot@177a7eb9e05c:~/groot$ python3
Python 3.8.10 (default, Sep 28 2021, 16:10:42) 
[GCC 9.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import json
>>> json.load(open("/home/groot/groot/test/TestFiles/cc.il.us/jobs.json"))
[{'Domain': 'child.richland.cc.il.us.', [...]

dns-groot / groot Goto Github PK

groot's People

Contributors

Stargazers

Watchers

Forkers

groot's Issues

json boilerplate

WIN10+VS2022 can not complie groot

Clarification regarding empty non-terminals (RFC 8020)

Longer Explanation

README Example not working?

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent