Transfer (AXFR) response example with tsig validate

[SkySai1]

Hello everyone! Today i finished to work about making some function for AXFR queries reply.
And now it can send zones to another DNS servers with tsig verification compatibility (tested on Bind9). Here an example:

     # -- Dict with TSIG keys --
     keys = dns.tsigkeyring.from_text({
          "mykey": "oUHtrekkN1RJ3MNjplEeO6Yxax46Qs7pR++NPpcH/4g="
    })
 

     # -- Up socket for geting quires --
     TCP = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     TCP.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
     TCP.bind(('127.0.0.2', 53))
     TCP.listen(3)
     conn, addr = TCP.accept()

     q,_ = dns.query.receive_tcp(conn, keyring=keys)

     # -- Making a dns.zone.Zone object by question name --
     qname = q.question[0].name
     zone = zonemaker(qname.to_text()) # <- Here return a zone object of dns.zone.Zone class

     
     r = dns.message.make_response(q) # <-- Forming reply
     
     # --At first send message with single SOA record
     soa = zone.get_soa()
     rrsoa = dns.rrset.from_rdata(zone.origin,soa.minimum, soa)
     tsig_ctx = None
     r.answer = [rrsoa]
     data = r.to_wire(multi=True, tsig_ctx=tsig_ctx)
     dns.query.send_tcp(conn,data,addr)

     # --Then sequence of messages with single rrset
     for data in zone.iterate_rdatasets():
          if data[1].rdtype is not dns.rdatatype.SOA:

               rrset = dns.rrset.from_rdata_list(data[0], data[1].ttl, data[1])
               r.answer = [rrset]

               data = r.to_wire(multi=True,tsig_ctx=r.tsig_ctx)
               dns.query.send_tcp(conn,data,addr)

     # --And finalize with SOA message again
     r.answer = [rrsoa]
     data = r.to_wire(multi=True,tsig_ctx=r.tsig_ctx)
     dns.query.send_tcp(conn,data,addr)

     conn.close()

How do you like it?

[rthalley]

This looks like it would generate a valid TCP AXFR response. A few things to consider:

• the AA flag should be set on the response, as the server is authoritative
• generally you pack AXFR responses into as few messages as possible instead of one message per RRset
• the question section is usually empty in messages other than the first message
• you should probably check that the query you got has an opcode of QUERY, a question type of AXFR or IXFR, and a class of IN, or pass the class info to zonemaker()

Also, please note that outbound zone transfer code is not currently in scope for dnspython PRs.

[SkySai1]

Thanks for your advices!

About 2nd point, yeah, you are right, it will generate many messages - one for each RRset, but i really have not ideas how to pre check message's size for avoiding "TooBig exception's" by an elegant method. I have a few zones with about 4k records with DNSSEC signing.

In other points, i will make edits in according to your advices.

[rthalley]

Re prechecking size, there's no good way to do that when working with the Message object. You could, however, use the lower level dns.renderer.Renderer class for this purpose, as it throws a TooBig exception and does a rollback when you try to write something that doesn't fit. See dns.message.Message.to_wire() for how you use the Renderer.