From: Pieter Lexis <pieter.lexis@powerdns.com>
Date: Mon, 30 Oct 2017 15:50:34 +0000 (+0100)
Subject: pdnsutil: Warn if records in a zone are eclipsed
X-Git-Tag: auth-4.1.0-rc3~11^2~1
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6056b9c85ee5671804858b16971f6bd44ac329ae;p=pdns

pdnsutil: Warn if records in a zone are eclipsed

Fixes #3059
---

diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index 50e7d7600..ebbc5fae5 100644
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -266,7 +266,8 @@ int checkZone(DNSSECKeeper &dk, UeberBackend &B, const DNSName& zone, const vect
 
 
   bool hasNsAtApex = false;
-  set<DNSName> tlsas, cnames, noncnames, glue, checkglue;
+  set<DNSName> tlsas, cnames, noncnames, glue, checkglue, nsrecords;
+  set<pair<DNSName, QType> > recs;
   set<string> recordcontents;
   map<string, unsigned int> ttl;
 
@@ -386,11 +387,18 @@ int checkZone(DNSSECKeeper &dk, UeberBackend &B, const DNSName& zone, const vect
       } else if (rr.qtype.getCode() == QType::DNSKEY) {
         cout<<"[Warning] DNSKEY record not at apex '"<<rr.qname<<" IN "<<rr.qtype.getName()<<" "<<rr.content<<"' in zone '"<<zone<<"', should not be here."<<endl;
         numwarnings++;
-      } else if (rr.qtype.getCode() == QType::NS && DNSName(rr.content).isPartOf(rr.qname)) {
-        checkglue.insert(DNSName(toLower(rr.content)));
+      } else if (rr.qtype.getCode() == QType::NS) {
+        if (DNSName(rr.content).isPartOf(rr.qname)) {
+          checkglue.insert(DNSName(toLower(rr.content)));
+        }
+        nsrecords.insert(rr.qname);
       } else if (rr.qtype.getCode() == QType::A || rr.qtype.getCode() == QType::AAAA) {
         glue.insert(rr.qname);
       }
+
+      if (rr.qtype != QType::NS && rr.qtype != QType::DS) {
+        recs.insert({rr.qname, rr.qtype});
+      }
     }
 
     if((rr.qtype.getCode() == QType::A || rr.qtype.getCode() == QType::AAAA) && !rr.qname.isWildcard() && !rr.qname.isHostname())
@@ -508,6 +516,15 @@ int checkZone(DNSSECKeeper &dk, UeberBackend &B, const DNSName& zone, const vect
     }
   }
 
+  for(const auto &nsrecord : nsrecords) {
+    for (const auto &q : recs) {
+      if (q.first.isPartOf(nsrecord)) {
+        cout<<"[Warning] '"<<q.first<<"|"<<q.second.getName()<<"' in zone '"<<zone<<"' is eclipsed by the zone-cut at '"<<nsrecord<<"'"<<endl;
+        numwarnings++;
+      }
+    }
+  }
+
   cout<<"Checked "<<numrecords<<" records of '"<<zone<<"', "<<numerrors<<" errors, "<<numwarnings<<" warnings."<<endl;
   if(!numerrors)
     return 0;