Proper EDNS0 (non)support (#188)

* Proper EDNS0 (non)support

* Add changelog entry

* Add EDNS0 tests

README.md

@@ -345,6 +345,9 @@ use for the renewal.
 
 ## Changelog
 
+- v0.8
+   - Changed
+      - Fixed: EDNS0 support
 - v0.7.2
    - Changed
       - Fixed: Regression error of not being able to answer to incoming random-case requests.

dns.go

@@ -82,8 +82,24 @@ func (d *DNSServer) handleRequest(w dns.ResponseWriter, r *dns.Msg) {
 	m := new(dns.Msg)
 	m.SetReply(r)
 
-	if r.Opcode == dns.OpcodeQuery {
-		d.readQuery(m)
+	// handle edns0
+	opt := r.IsEdns0()
+	if opt != nil {
+		if opt.Version() != 0 {
+			// Only EDNS0 is standardized
+			m.MsgHdr.Rcode = dns.RcodeBadVers
+			m.SetEdns0(512, false)
+		} else {
+			// We can safely do this as we know that we're not setting other OPT RRs within acme-dns.
+			m.SetEdns0(512, false)
+			if r.Opcode == dns.OpcodeQuery {
+				d.readQuery(m)
+			}
+		}
+	} else {
+		if r.Opcode == dns.OpcodeQuery {
+			d.readQuery(m)
+		}
 	}
 	w.WriteMsg(m)
 }
@@ -107,7 +123,6 @@ func (d *DNSServer) readQuery(m *dns.Msg) {
 			m.Ns = append(m.Ns, d.SOA)
 		}
 	}
-
 }
 
 func (d *DNSServer) getRecord(q dns.Question) ([]dns.RR, error) {
@@ -169,10 +184,6 @@ func (d *DNSServer) answer(q dns.Question) ([]dns.RR, int, bool, error) {
 		// Make sure that we return NOERROR if there were dynamic records for the domain
 		rcode = dns.RcodeSuccess
 	}
-	// Handle EDNS (no support at the moment)
-	if q.Qtype == dns.TypeOPT {
-		return []dns.RR{}, dns.RcodeFormatError, authoritative, nil
-	}
 	log.WithFields(log.Fields{"qtype": dns.TypeToString[q.Qtype], "domain": q.Name, "rcode": dns.RcodeToString[rcode]}).Debug("Answering question for domain")
 	return r, rcode, authoritative, nil
 }

dns_test.go

@@ -111,8 +111,48 @@ func TestResolveA(t *testing.T) {
 func TestEDNS(t *testing.T) {
 	resolv := resolver{server: "127.0.0.1:15353"}
 	answer, _ := resolv.lookup("auth.example.org", dns.TypeOPT)
-	if answer.Rcode != dns.RcodeFormatError {
-		t.Errorf("Was expecing FORMERR rcode for OPT query, but got [%s] instead.", dns.RcodeToString[answer.Rcode])
+	if answer.Rcode != dns.RcodeSuccess {
+		t.Errorf("Was expecing NOERROR rcode for OPT query, but got [%s] instead.", dns.RcodeToString[answer.Rcode])
+	}
+}
+
+func TestEDNSA(t *testing.T) {
+	msg := new(dns.Msg)
+	msg.Id = dns.Id()
+	msg.Question = make([]dns.Question, 1)
+	msg.Question[0] = dns.Question{Name: dns.Fqdn("auth.example.org"), Qtype: dns.TypeA, Qclass: dns.ClassINET}
+	// Set EDNS0 with DO=1
+	msg.SetEdns0(512, true)
+	in, err := dns.Exchange(msg, "127.0.0.1:15353")
+	if err != nil {
+		t.Errorf("Error querying the server [%v]", err)
+	}
+	if in != nil && in.Rcode != dns.RcodeSuccess {
+		t.Errorf("Received error from the server [%s]", dns.RcodeToString[in.Rcode])
+	}
+	opt := in.IsEdns0()
+	if opt == nil {
+		t.Errorf("Should have got OPT back")
+	}
+}
+
+func TestEDNSBADVERS(t *testing.T) {
+	msg := new(dns.Msg)
+	msg.Id = dns.Id()
+	msg.Question = make([]dns.Question, 1)
+	msg.Question[0] = dns.Question{Name: dns.Fqdn("auth.example.org"), Qtype: dns.TypeA, Qclass: dns.ClassINET}
+	// Set EDNS0 with version 1
+	o := new(dns.OPT)
+	o.SetVersion(1)
+	o.Hdr.Name = "."
+	o.Hdr.Rrtype = dns.TypeOPT
+	msg.Extra = append(msg.Extra, o)
+	in, err := dns.Exchange(msg, "127.0.0.1:15353")
+	if err != nil {
+		t.Errorf("Error querying the server [%v]", err)
+	}
+	if in != nil && in.Rcode != dns.RcodeBadVers {
+		t.Errorf("Received unexpected rcode from the server [%s]", dns.RcodeToString[in.Rcode])
 	}
 }
 
@@ -220,25 +260,25 @@ func TestResolveTXT(t *testing.T) {
 }
 
 func TestCaseInsensitiveResolveA(t *testing.T) {
-  resolv := resolver{server: "127.0.0.1:15353"}
-  answer, err := resolv.lookup("aUtH.eXAmpLe.org", dns.TypeA)
-  if err != nil {
-    t.Errorf("%v", err)
-  }
-
-  if len(answer.Answer) == 0 {
-    t.Error("No answer for DNS query")
-  }
+	resolv := resolver{server: "127.0.0.1:15353"}
+	answer, err := resolv.lookup("aUtH.eXAmpLe.org", dns.TypeA)
+	if err != nil {
+		t.Errorf("%v", err)
+	}
+
+	if len(answer.Answer) == 0 {
+		t.Error("No answer for DNS query")
+	}
 }
 
 func TestCaseInsensitiveResolveSOA(t *testing.T) {
-  resolv := resolver{server: "127.0.0.1:15353"}
-  answer, _ := resolv.lookup("doesnotexist.aUtH.eXAmpLe.org", dns.TypeSOA)
-  if answer.Rcode != dns.RcodeNameError {
-    t.Errorf("Was expecing NXDOMAIN rcode, but got [%s] instead.", dns.RcodeToString[answer.Rcode])
-  }
-
-  if len(answer.Ns) == 0 {
-    t.Error("No SOA answer for DNS query")
-  }
+	resolv := resolver{server: "127.0.0.1:15353"}
+	answer, _ := resolv.lookup("doesnotexist.aUtH.eXAmpLe.org", dns.TypeSOA)
+	if answer.Rcode != dns.RcodeNameError {
+		t.Errorf("Was expecing NXDOMAIN rcode, but got [%s] instead.", dns.RcodeToString[answer.Rcode])
+	}
+
+	if len(answer.Ns) == 0 {
+		t.Error("No SOA answer for DNS query")
+	}
 }