services

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 18, 2026 License: Apache-2.0 Imports: 23 Imported by: 0

Documentation

Overview

Package services implements the core business logic for cloudDNS.

Package services implements the core business logic for cloudDNS.

Index

Constants

View Source 
const (
	EDECodeOther                   uint16 = 0  // Other Error
	EDECodeUnsupportedDNSKEYAlgo   uint16 = 1  // Unsupported DNSKEY Algorithm
	EDECodeUnsupportedDSDigest     uint16 = 2  // Unsupported DS Digest Type (reused for signature errors)
	EDECodeStaleAnswer             uint16 = 3  // Stale Answer
	EDECodeForgedAnswer            uint16 = 4  // Forged Answer
	EDECodeIndeterminate           uint16 = 5  // DNSSEC Indeterminate
	EDECodeBogus                   uint16 = 6  // DNSSEC Bogus (also used for dnskey-missing)
	EDECodeSignatureExpired        uint16 = 7  // Signature Expired
	EDECodeSignatureNotYetValid    uint16 = 8  // Signature Not Yet Valid
	EDECodeDNSKEYMissing           uint16 = 9  // DNSKEY Missing
	EDECodeDSMissing               uint16 = 10 // DS Missing
	EDECodeNoZoneKeyBitSet         uint16 = 11 // No Zone Key Bit Set
	EDECodeSignatureUnsupported    uint16 = 12 // Signature Unsupported Algorithm
	EDECodeDNSKEYNotAnchor         uint16 = 13 // DNSKEY Not Anchor
	EDECodeTrustAnchorUnknown      uint16 = 17 // Trust Anchor Unknown
	EDECodeExpectedAnswerAfterDNL  uint16 = 18 // Expected Answer After DNL
	EDECodeDelegationNotServed     uint16 = 20 // Delegation Not Served
	EDECodeTTLMismatch             uint16 = 21 // TTL Mismatch
	EDECodeCachedValidatedResponse uint16 = 22 // Cached Validated Response
	// NSEC3-specific (not defined in RFC 8914, using high values to avoid future conflicts)
	EDECodeNSEC3HashAlgoUnsupported uint16 = 23 // NSEC3 hash algorithm not supported
	EDECodeNSEC3InvalidProof        uint16 = 24 // NSEC3 proof does not cover name
	EDECodeNSEC3ChainBroken         uint16 = 25 // NSEC3 hash chain is broken
	EDECodeNSEC3NoMatchingName      uint16 = 26 // NSEC3 owner name hash doesn't match
)

EDECodes defines RFC 8914 Extended DNS Error Codes used in DNS responses. Error codes cover the full set of DNSSEC validation failure reasons.

Variables

This section is empty.

Functions

func NewDNSService 

func NewDNSService(repo ports.DNSRepository, cache ports.CacheInvalidator) ports.DNSService

NewDNSService creates a new DNS service with the given repository and cache.

Types

type AnycastManager 

type AnycastManager struct {
	// contains filtered or unexported fields
}

AnycastManager manages anycast VIP assignment and BGP routing.

func NewAnycastManager 

func NewAnycastManager(
	dnsSvc ports.DNSService,
	routing ports.RoutingEngine,
	vipManager ports.VIPManager,
	vip string,
	iface string,
	logger *slog.Logger,
	debounceDuration time.Duration,
) *AnycastManager

NewAnycastManager creates a new AnycastManager for the given VIP and routing engine. debounceDuration sets the minimum time a health state must be stable before acting on the transition, preventing VIP flapping under unstable health checks.

func (*AnycastManager) Start 

func (m *AnycastManager) Start(ctx context.Context)

Start begins the anycast manager background worker.

func (*AnycastManager) TriggerCheck 

func (m *AnycastManager) TriggerCheck(ctx context.Context)

TriggerCheck performs an immediate health check and updates announcement state. State transitions are debounced to prevent VIP flapping under unstable health. 

type ChainLink struct {
	Zone     string             // Zone name (e.g., "example.com.")
	DNSKEYs  []packet.DNSRecord // DNSKEYs for this zone
	DS       packet.DNSRecord   // DS record in parent (empty for trust anchor zone)
	RRSIGsDS []packet.DNSRecord // RRSIG records signing the DS RRset
}

ChainLink represents a single step in the DNSSEC validation chain.

type DNSSECService 

type DNSSECService struct {
	// contains filtered or unexported fields
}

DNSSECService provides functionality for managing DNSSEC keys and signing RRsets.

func NewDNSSECService 

func NewDNSSECService(repo ports.DNSRepository) *DNSSECService

NewDNSSECService creates and returns a new DNSSECService instance.

func (*DNSSECService) AutomateLifecycle 

func (s *DNSSECService) AutomateLifecycle(ctx context.Context, zoneID string) error

AutomateLifecycle is a background-friendly method to ensure a zone is correctly signed It implements Automated Key Rollover using a Double-Signature orchestration pattern.

func (*DNSSECService) CollectKeyStats 

func (s *DNSSECService) CollectKeyStats(ctx context.Context) ([]KeyStats, error)

CollectKeyStats returns statistics for all active DNSSEC keys. Used by the metrics collector to update DNSSEC key age metrics.

func (*DNSSECService) GenerateKey 

func (s *DNSSECService) GenerateKey(ctx context.Context, zoneID string, keyType string) (*domain.DNSSECKey, error)

GenerateKey creates a new ECDSA P-256 key pair for a zone

func (*DNSSECService) GetActiveKeys 

func (s *DNSSECService) GetActiveKeys(ctx context.Context, zoneID string, keyType string) ([]domain.DNSSECKey, error)

GetActiveKeys returns all currently active keys of a specific type for a zone

func (*DNSSECService) SignRRSet 

func (s *DNSSECService) SignRRSet(ctx context.Context, zoneName string, zoneID string, records []packet.DNSRecord) ([]packet.DNSRecord, error)

SignRRSet signs a list of packet records using all active ZSKs for the zone

type DNSSECValidator 

type DNSSECValidator struct {
	// contains filtered or unexported fields
}

DNSSECValidator validates DNSSEC signatures and trust chains.

func NewDNSSECValidator 

func NewDNSSECValidator(trustAnchors map[string]packet.DNSRecord) *DNSSECValidator

NewDNSSECValidator creates a new DNSSECValidator with the given trust anchors.

func (*DNSSECValidator) GetTrustAnchor 

func (v *DNSSECValidator) GetTrustAnchor(zone string) *packet.DNSRecord

GetTrustAnchor returns the trust anchor (DNSKEY) for the given zone.

func (*DNSSECValidator) ValidateChain 

func (v *DNSSECValidator) ValidateChain(chain []ChainLink, now uint32) error

ValidateChain validates the full DNSSEC trust chain from a leaf zone to a trust anchor. It verifies that each zone's DNSKEY is valid according to its DS record, and that DS records are properly signed up the chain to the trust anchor.

func (*DNSSECValidator) ValidateDNSKEYChain 

func (v *DNSSECValidator) ValidateDNSKEYChain(dnskeys []packet.DNSRecord, ds, _ packet.DNSRecord) error

ValidateDNSKEYChain validates the DNSSEC trust chain from DNSKEY to parent. It verifies that the DNSKEY matches the DS record.

func (*DNSSECValidator) ValidateRRSet 

func (v *DNSSECValidator) ValidateRRSet(rrset, rrsigs, dnskeys []packet.DNSRecord, now uint32) ValidationResult

ValidateRRSet validates an RRset with its RRSIGs and DNSKEYs. Returns whether the RRset is valid, the AD bit value, and an EDE if applicable.

func (*DNSSECValidator) ValidateWithTrustAnchor 

func (v *DNSSECValidator) ValidateWithTrustAnchor(zone string, rrset, rrsigs, dnskeys []packet.DNSRecord, now uint32) ValidationResult

ValidateWithTrustAnchor validates an RRset using trust anchors. It checks if any of the DNSKEYs is a trust anchor for the zone.

type EDE 

type EDE struct {
	Code uint16
	Info string
}

EDE represents an Extended DNS Error (RFC 8914).

func (*EDE) String 

func (e *EDE) String() string

String returns a human-readable description of the EDE code per RFC 8914.

type HealthMonitor 

type HealthMonitor struct {
	// contains filtered or unexported fields
}

HealthMonitor manages background health checks for DNS records.

func NewHealthMonitor 

func NewHealthMonitor(repo ports.DNSRepository, logger *slog.Logger, opts *HealthMonitorOptions) *HealthMonitor

NewHealthMonitor creates a new HealthMonitor with a default HTTP client.

func (*HealthMonitor) Start 

func (m *HealthMonitor) Start(ctx context.Context, interval time.Duration)

Start runs the health monitoring loop at the specified interval until the context is canceled.

type HealthMonitorOptions 

type HealthMonitorOptions struct {
	InsecureSkipVerify bool
}

HealthMonitorOptions configures optional health monitor behavior.

type KeyStats 

type KeyStats struct {
	ZoneID     string
	ZoneName   string
	KeyType    string
	Algorithm  int
	AgeSeconds float64
}

KeyStats holds DNSSEC key statistics for metrics.

type ValidationResult 

type ValidationResult struct {
	Valid bool
	ADBit bool
	EDE   *EDE
}

ValidationResult contains the result of DNSSEC validation.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.