diff --git a/go.mod b/go.mod
index 7a750cb73b3d794f593f3b77581bfeb8d901e985..9b08ade879566fa86b9459b884948b6bcaad5a7c 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
github.com/google/subcommands v1.2.0
github.com/jmcvetta/randutil v0.0.0-20150817122601-2bb1b664bcff
github.com/lpar/gzipped v1.1.1-0.20190413023519-5d9a18ea7f47
- github.com/miekg/dns v1.1.41
+ github.com/miekg/dns v1.1.42
github.com/prometheus/client_golang v1.10.0
github.com/prometheus/common v0.23.0
go.etcd.io/etcd v0.5.0-alpha.5.0.20190401205724-a621d807f061
diff --git a/go.sum b/go.sum
index 205ec17a26e34cba703c04fda62b2eefeaafea0e..8c1cbd23782a63731b9e149f4ae91e4db2b0099f 100644
--- a/go.sum
+++ b/go.sum
@@ -213,6 +213,8 @@ github.com/miekg/dns v1.1.40 h1:pyyPFfGMnciYUk/mXpKkVmeMQjfXqt3FAJ2hy7tPiLA=
github.com/miekg/dns v1.1.40/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
github.com/miekg/dns v1.1.41 h1:WMszZWJG0XmzbK9FEmzH2TVcqYzFesusSIB41b8KHxY=
github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
+github.com/miekg/dns v1.1.42 h1:gWGe42RGaIqXQZ+r3WUGEKBEtvPHY2SXo4dqixDNxuY=
+github.com/miekg/dns v1.1.42/go.mod h1:+evo5L0630/F6ca/Z9+GAqzhjGyn8/c+TBaOyfEl0V4=
github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
diff --git a/vendor/github.com/miekg/dns/README.md b/vendor/github.com/miekg/dns/README.md
index 3594492b7cd13217b483f0886c8d8cf9902107a0..d5b78ef41b891f8da03f1139576069d25150a744 100644
--- a/vendor/github.com/miekg/dns/README.md
+++ b/vendor/github.com/miekg/dns/README.md
@@ -171,6 +171,7 @@ Example programs can be found in the `github.com/miekg/exdns` repository.
* 8080 - EdDSA for DNSSEC
* 8499 - DNS Terminology
* 8659 - DNS Certification Authority Authorization (CAA) Resource Record
+* 8914 - Extended DNS Errors
* 8976 - Message Digest for DNS Zones (ZONEMD RR)
## Loosely Based Upon
diff --git a/vendor/github.com/miekg/dns/dnssec.go b/vendor/github.com/miekg/dns/dnssec.go
index 80d2be5a89c305ff3176dfbb3f46883a4f6b23b0..7880d7a8267abaac5ed9ef1aa0d77756530362bd 100644
--- a/vendor/github.com/miekg/dns/dnssec.go
+++ b/vendor/github.com/miekg/dns/dnssec.go
@@ -372,6 +372,8 @@ func sign(k crypto.Signer, hashed []byte, hash crypto.Hash, alg uint8) ([]byte,
// Verify validates an RRSet with the signature and key. This is only the
// cryptographic test, the signature validity period must be checked separately.
// This function copies the rdata of some RRs (to lowercase domain names) for the validation to work.
+// It also checks that the Zone Key bit (RFC 4034 2.1.1) is set on the DNSKEY
+// and that the Protocol field is set to 3 (RFC 4034 2.1.2).
func (rr *RRSIG) Verify(k *DNSKEY, rrset []RR) error {
// First the easy checks
if !IsRRset(rrset) {
@@ -392,6 +394,12 @@ func (rr *RRSIG) Verify(k *DNSKEY, rrset []RR) error {
if k.Protocol != 3 {
return ErrKey
}
+ // RFC 4034 2.1.1 If bit 7 has value 0, then the DNSKEY record holds some
+ // other type of DNS public key and MUST NOT be used to verify RRSIGs that
+ // cover RRsets.
+ if k.Flags&ZONE == 0 {
+ return ErrKey
+ }
// IsRRset checked that we have at least one RR and that the RRs in
// the set have consistent type, class, and name. Also check that type and
diff --git a/vendor/github.com/miekg/dns/doc.go b/vendor/github.com/miekg/dns/doc.go
index f7629ec3fff34cc5b88b81aeedd6bf7661b1f5a0..5c83f82e49d47404519177a927c3c3514d4522d0 100644
--- a/vendor/github.com/miekg/dns/doc.go
+++ b/vendor/github.com/miekg/dns/doc.go
@@ -159,7 +159,7 @@ shows the options you have and what functions to call.
TRANSACTION SIGNATURE
An TSIG or transaction signature adds a HMAC TSIG record to each message sent.
-The supported algorithms include: HmacMD5, HmacSHA1, HmacSHA256 and HmacSHA512.
+The supported algorithms include: HmacSHA1, HmacSHA256 and HmacSHA512.
Basic use pattern when querying with a TSIG name "axfr." (note that these key names
must be fully qualified - as they are domain names) and the base64 secret
@@ -174,7 +174,7 @@ changes to the RRset after calling SetTsig() the signature will be incorrect.
c.TsigSecret = map[string]string{"axfr.": "so6ZGir4GPAqINNh9U5c3A=="}
m := new(dns.Msg)
m.SetQuestion("miek.nl.", dns.TypeMX)
- m.SetTsig("axfr.", dns.HmacMD5, 300, time.Now().Unix())
+ m.SetTsig("axfr.", dns.HmacSHA256, 300, time.Now().Unix())
...
// When sending the TSIG RR is calculated and filled in before sending
@@ -187,7 +187,7 @@ request an AXFR for miek.nl. with TSIG key named "axfr." and secret
m := new(dns.Msg)
t.TsigSecret = map[string]string{"axfr.": "so6ZGir4GPAqINNh9U5c3A=="}
m.SetAxfr("miek.nl.")
- m.SetTsig("axfr.", dns.HmacMD5, 300, time.Now().Unix())
+ m.SetTsig("axfr.", dns.HmacSHA256, 300, time.Now().Unix())
c, err := t.In(m, "176.58.119.54:53")
for r := range c { ... }
@@ -214,7 +214,7 @@ client must be configured with an implementation of the TsigProvider interface:
c.TsigProvider = new(Provider)
m := new(dns.Msg)
m.SetQuestion("miek.nl.", dns.TypeMX)
- m.SetTsig(keyname, dns.HmacSHA1, 300, time.Now().Unix())
+ m.SetTsig(keyname, dns.HmacSHA256, 300, time.Now().Unix())
...
// TSIG RR is calculated by calling your Generate method
@@ -231,7 +231,7 @@ Basic use pattern validating and replying to a message that has TSIG set.
if r.IsTsig() != nil {
if w.TsigStatus() == nil {
// *Msg r has an TSIG record and it was validated
- m.SetTsig("axfr.", dns.HmacMD5, 300, time.Now().Unix())
+ m.SetTsig("axfr.", dns.HmacSHA256, 300, time.Now().Unix())
} else {
// *Msg r has an TSIG records and it was not validated
}
diff --git a/vendor/github.com/miekg/dns/edns.go b/vendor/github.com/miekg/dns/edns.go
index 1a87f4cb930a75e3d7d8653823a34fb0541e9588..844cf92b8c633e355ececf3f5126a2386bc14eb6 100644
--- a/vendor/github.com/miekg/dns/edns.go
+++ b/vendor/github.com/miekg/dns/edns.go
@@ -22,6 +22,7 @@ const (
EDNS0COOKIE = 0xa // EDNS0 Cookie
EDNS0TCPKEEPALIVE = 0xb // EDNS0 tcp keep alive (See RFC 7828)
EDNS0PADDING = 0xc // EDNS0 padding (See RFC 7830)
+ EDNS0EDE = 0xf // EDNS0 extended DNS errors (See RFC 8914)
EDNS0LOCALSTART = 0xFDE9 // Beginning of range reserved for local/experimental use (See RFC 6891)
EDNS0LOCALEND = 0xFFFE // End of range reserved for local/experimental use (See RFC 6891)
_DO = 1 << 15 // DNSSEC OK
@@ -73,6 +74,8 @@ func (rr *OPT) String() string {
s += "\n; LOCAL OPT: " + o.String()
case *EDNS0_PADDING:
s += "\n; PADDING: " + o.String()
+ case *EDNS0_EDE:
+ s += "\n; EDE: " + o.String()
}
}
return s
@@ -148,6 +151,16 @@ func (rr *OPT) SetDo(do ...bool) {
}
}
+// Z returns the Z part of the OPT RR as a uint16 with only the 15 least significant bits used.
+func (rr *OPT) Z() uint16 {
+ return uint16(rr.Hdr.Ttl & 0x7FFF)
+}
+
+// SetZ sets the Z part of the OPT RR, note only the 15 least significant bits of z are used.
+func (rr *OPT) SetZ(z uint16) {
+ rr.Hdr.Ttl = rr.Hdr.Ttl&^0x7FFF | uint32(z&0x7FFF)
+}
+
// EDNS0 defines an EDNS0 Option. An OPT RR can have multiple options appended to it.
type EDNS0 interface {
// Option returns the option code for the option.
@@ -673,3 +686,101 @@ func (e *EDNS0_PADDING) copy() EDNS0 {
copy(b, e.Padding)
return &EDNS0_PADDING{b}
}
+
+// Extended DNS Error Codes (RFC 8914).
+const (
+ ExtendedErrorCodeOther uint16 = iota
+ ExtendedErrorCodeUnsupportedDNSKEYAlgorithm
+ ExtendedErrorCodeUnsupportedDSDigestType
+ ExtendedErrorCodeStaleAnswer
+ ExtendedErrorCodeForgedAnswer
+ ExtendedErrorCodeDNSSECIndeterminate
+ ExtendedErrorCodeDNSBogus
+ ExtendedErrorCodeSignatureExpired
+ ExtendedErrorCodeSignatureNotYetValid
+ ExtendedErrorCodeDNSKEYMissing
+ ExtendedErrorCodeRRSIGsMissing
+ ExtendedErrorCodeNoZoneKeyBitSet
+ ExtendedErrorCodeNSECMissing
+ ExtendedErrorCodeCachedError
+ ExtendedErrorCodeNotReady
+ ExtendedErrorCodeBlocked
+ ExtendedErrorCodeCensored
+ ExtendedErrorCodeFiltered
+ ExtendedErrorCodeProhibited
+ ExtendedErrorCodeStaleNXDOMAINAnswer
+ ExtendedErrorCodeNotAuthoritative
+ ExtendedErrorCodeNotSupported
+ ExtendedErrorCodeNoReachableAuthority
+ ExtendedErrorCodeNetworkError
+ ExtendedErrorCodeInvalidData
+)
+
+// ExtendedErrorCodeToString maps extended error info codes to a human readable
+// description.
+var ExtendedErrorCodeToString = map[uint16]string{
+ ExtendedErrorCodeOther: "Other",
+ ExtendedErrorCodeUnsupportedDNSKEYAlgorithm: "Unsupported DNSKEY Algorithm",
+ ExtendedErrorCodeUnsupportedDSDigestType: "Unsupported DS Digest Type",
+ ExtendedErrorCodeStaleAnswer: "Stale Answer",
+ ExtendedErrorCodeForgedAnswer: "Forged Answer",
+ ExtendedErrorCodeDNSSECIndeterminate: "DNSSEC Indeterminate",
+ ExtendedErrorCodeDNSBogus: "DNSSEC Bogus",
+ ExtendedErrorCodeSignatureExpired: "Signature Expired",
+ ExtendedErrorCodeSignatureNotYetValid: "Signature Not Yet Valid",
+ ExtendedErrorCodeDNSKEYMissing: "DNSKEY Missing",
+ ExtendedErrorCodeRRSIGsMissing: "RRSIGs Missing",
+ ExtendedErrorCodeNoZoneKeyBitSet: "No Zone Key Bit Set",
+ ExtendedErrorCodeNSECMissing: "NSEC Missing",
+ ExtendedErrorCodeCachedError: "Cached Error",
+ ExtendedErrorCodeNotReady: "Not Ready",
+ ExtendedErrorCodeBlocked: "Blocked",
+ ExtendedErrorCodeCensored: "Censored",
+ ExtendedErrorCodeFiltered: "Filtered",
+ ExtendedErrorCodeProhibited: "Prohibited",
+ ExtendedErrorCodeStaleNXDOMAINAnswer: "Stale NXDOMAIN Answer",
+ ExtendedErrorCodeNotAuthoritative: "Not Authoritative",
+ ExtendedErrorCodeNotSupported: "Not Supported",
+ ExtendedErrorCodeNoReachableAuthority: "No Reachable Authority",
+ ExtendedErrorCodeNetworkError: "Network Error",
+ ExtendedErrorCodeInvalidData: "Invalid Data",
+}
+
+// StringToExtendedErrorCode is a map from human readable descriptions to
+// extended error info codes.
+var StringToExtendedErrorCode = reverseInt16(ExtendedErrorCodeToString)
+
+// EDNS0_EDE option is used to return additional information about the cause of
+// DNS errors.
+type EDNS0_EDE struct {
+ InfoCode uint16
+ ExtraText string
+}
+
+// Option implements the EDNS0 interface.
+func (e *EDNS0_EDE) Option() uint16 { return EDNS0EDE }
+func (e *EDNS0_EDE) copy() EDNS0 { return &EDNS0_EDE{e.InfoCode, e.ExtraText} }
+
+func (e *EDNS0_EDE) String() string {
+ info := strconv.FormatUint(uint64(e.InfoCode), 10)
+ if s, ok := ExtendedErrorCodeToString[e.InfoCode]; ok {
+ info += fmt.Sprintf(" (%s)", s)
+ }
+ return fmt.Sprintf("%s: (%s)", info, e.ExtraText)
+}
+
+func (e *EDNS0_EDE) pack() ([]byte, error) {
+ b := make([]byte, 2+len(e.ExtraText))
+ binary.BigEndian.PutUint16(b[0:], e.InfoCode)
+ copy(b[2:], []byte(e.ExtraText))
+ return b, nil
+}
+
+func (e *EDNS0_EDE) unpack(b []byte) error {
+ if len(b) < 2 {
+ return ErrBuf
+ }
+ e.InfoCode = binary.BigEndian.Uint16(b[0:])
+ e.ExtraText = string(b[2:])
+ return nil
+}
diff --git a/vendor/github.com/miekg/dns/go.mod b/vendor/github.com/miekg/dns/go.mod
index 51619b7842b369d50bc91ebd02357fdd3beb212b..aff65114de26e6cf87fb47dc74b6b28828986030 100644
--- a/vendor/github.com/miekg/dns/go.mod
+++ b/vendor/github.com/miekg/dns/go.mod
@@ -1,6 +1,6 @@
module github.com/miekg/dns
-go 1.13
+go 1.14
require (
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110
diff --git a/vendor/github.com/miekg/dns/listen_go_not111.go b/vendor/github.com/miekg/dns/listen_no_reuseport.go
similarity index 100%
rename from vendor/github.com/miekg/dns/listen_go_not111.go
rename to vendor/github.com/miekg/dns/listen_no_reuseport.go
diff --git a/vendor/github.com/miekg/dns/listen_go111.go b/vendor/github.com/miekg/dns/listen_reuseport.go
similarity index 100%
rename from vendor/github.com/miekg/dns/listen_go111.go
rename to vendor/github.com/miekg/dns/listen_reuseport.go
diff --git a/vendor/github.com/miekg/dns/msg_helpers.go b/vendor/github.com/miekg/dns/msg_helpers.go
index 47625ed0902d627c2311539a226652a5777e2a9f..472ada5d19b6e9856ea81d7245879b7dbb010429 100644
--- a/vendor/github.com/miekg/dns/msg_helpers.go
+++ b/vendor/github.com/miekg/dns/msg_helpers.go
@@ -460,6 +460,8 @@ func makeDataOpt(code uint16) EDNS0 {
return new(EDNS0_N3U)
case EDNS0PADDING:
return new(EDNS0_PADDING)
+ case EDNS0EDE:
+ return new(EDNS0_EDE)
default:
e := new(EDNS0_LOCAL)
e.Code = code
diff --git a/vendor/github.com/miekg/dns/scan.go b/vendor/github.com/miekg/dns/scan.go
index 39055bde314721f54f3b970a4f17caba1fcacc59..57be98827722249d38f716ba13552bd062fef46d 100644
--- a/vendor/github.com/miekg/dns/scan.go
+++ b/vendor/github.com/miekg/dns/scan.go
@@ -150,6 +150,9 @@ func ReadRR(r io.Reader, file string) (RR, error) {
// The text "; this is comment" is returned from Comment. Comments inside
// the RR are returned concatenated along with the RR. Comments on a line
// by themselves are discarded.
+//
+// Callers should not assume all returned data in an Resource Record is
+// syntactically correct, e.g. illegal base64 in RRSIGs will be returned as-is.
type ZoneParser struct {
c *zlexer
diff --git a/vendor/github.com/miekg/dns/svcb.go b/vendor/github.com/miekg/dns/svcb.go
index ec0a76f4cfe2181fbbb31372b44865f102a1963f..64800daa6dc8555845f92df77bd42212b73e38a2 100644
--- a/vendor/github.com/miekg/dns/svcb.go
+++ b/vendor/github.com/miekg/dns/svcb.go
@@ -511,8 +511,13 @@ func (s *SVCBIPv4Hint) parse(b string) error {
}
func (s *SVCBIPv4Hint) copy() SVCBKeyValue {
+ hint := make([]net.IP, len(s.Hint))
+ for i, ip := range s.Hint {
+ hint[i] = copyIP(ip)
+ }
+
return &SVCBIPv4Hint{
- append([]net.IP(nil), s.Hint...),
+ Hint: hint,
}
}
@@ -629,8 +634,13 @@ func (s *SVCBIPv6Hint) parse(b string) error {
}
func (s *SVCBIPv6Hint) copy() SVCBKeyValue {
+ hint := make([]net.IP, len(s.Hint))
+ for i, ip := range s.Hint {
+ hint[i] = copyIP(ip)
+ }
+
return &SVCBIPv6Hint{
- append([]net.IP(nil), s.Hint...),
+ Hint: hint,
}
}
diff --git a/vendor/github.com/miekg/dns/version.go b/vendor/github.com/miekg/dns/version.go
index 5a358acc9463192c5b395e6f5d1678918f7ca7d9..695d1e8b485363368ca4dbf3778f1fc633e4d049 100644
--- a/vendor/github.com/miekg/dns/version.go
+++ b/vendor/github.com/miekg/dns/version.go
@@ -3,7 +3,7 @@ package dns
import "fmt"
// Version is current version of this library.
-var Version = v{1, 1, 41}
+var Version = v{1, 1, 42}
// v holds the version of this library.
type v struct {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index b231c619c2d1939797ad5edc7eeb50d4000cb7e7..73ae2bc14994895f58044ce13e49e12a65e53bfc 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -72,7 +72,7 @@ github.com/konsorten/go-windows-terminal-sequences
github.com/lpar/gzipped
# github.com/matttproud/golang_protobuf_extensions v1.0.1
github.com/matttproud/golang_protobuf_extensions/pbutil
-# github.com/miekg/dns v1.1.41
+# github.com/miekg/dns v1.1.42
## explicit
github.com/miekg/dns
# github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd