pdnssec: Check if records exist for TLSA hosts

When a record _443._tcp.www.example.com.|TLSA exists and no record for
www.example.com., we emit a warning. Similarly, when
*.example.com. _does_ exist, we emit a warning, as
www.example.com. becomes an empty non-terminal at that point.

diff --git a/pdns/pdnssec.cc b/pdns/pdnssec.cc
index 030296284bf2a02cdc1308ccda9a860a24279b18..758ef2d28a3d8fb17b1dac362fb7fcd97e6c984d 100644 (file)
--- a/pdns/pdnssec.cc
+++ b/pdns/pdnssec.cc
@@ -439,7 +439,7 @@ int checkZone(DNSSECKeeper &dk, UeberBackend &B, const DNSName& zone)
 
 
   bool hasNsAtApex = false;
-  set<DNSName> cnames, noncnames, glue, checkglue;
+  set<DNSName> tlsas, cnames, noncnames, glue, checkglue;
   set<string> records;
   map<string, unsigned int> ttl;
 
@@ -454,6 +454,8 @@ int checkZone(DNSSECKeeper &dk, UeberBackend &B, const DNSName& zone)
 
     numrecords++;
 
+    if(rr.qtype.getCode() == QType::TLSA)
+      tlsas.insert(rr.qname);
     if(rr.qtype.getCode() == QType::SOA) {
       vector<string>parts;
       stringtok(parts, rr.content);
@@ -618,6 +620,26 @@ int checkZone(DNSSECKeeper &dk, UeberBackend &B, const DNSName& zone)
     }
   }
 
+  for(const auto &i: tlsas) {
+    DNSName name = DNSName(i);
+    name.trimToLabels(name.getRawLabels().size()-2);
+    if (cnames.find(name) == cnames.end() && noncnames.find(name) == noncnames.end()) {
+      // No specific record for the name in the TLSA record exists, this
+      // is already worth emitting a warning. Let's see if a wildcard exist.
+      cout<<"[Warning] ";
+      DNSName wcname(name);
+      wcname.chopOff();
+      wcname.prependRawLabel("*");
+      if (cnames.find(wcname) != cnames.end() || noncnames.find(wcname) != noncnames.end()) {
+        cout<<"A wildcard record exist for '"<<wcname.toString()<<"' and a TLSA record for '"<<i.toString()<<"'.";
+      } else {
+        cout<<"No record for '"<<name.toString()<<"' exists, but a TLSA record for '"<<i.toString()<<"' does.";
+      }
+      numwarnings++;
+      cout<<" A query for '"<<name.toString()<<"' will yield an empty response. This is most likely a mistake, please create records for '"<<name.toString()<<"'."<<endl;
+    }
+  }
+
   if(!hasNsAtApex) {
     cout<<"[Error] No NS record at zone apex in zone '"<<zone.toString()<<"'"<<endl;
     numerrors++;