dnsgt/groot

Installation for Windows

1. Install vcpkg package manager to install dependecies.
2. Install the C++ libraries (64 bit versions) using:
   • .\vcpkg.exe install boost-serialization:x64-windows boost-flyweight:x64-windows boost-dynamic-bitset:x64-windows boost-graph:x64-windows boost-accumulators:x64-windows docopt:x64-windows nlohmann-json:x64-windows spdlog:x64-windows
   • .\vcpkg.exe integrate install
3. Clone the repository (with --recurse-submodules) and open the solution (groot.sln) using Visual studio. Set the platform to x64 and mode to Release.
4. Configure the project properties to use ISO C++17 Standard (std:c++17) for C++ language standard.
5. Set groot as Set as Startup Project using the solution explorer in the Visual Studio. Build the project using visual studio to generate the executable. The executable would be located at ~\groot\x64\Release\.

Installation for Ubuntu 18.04 or later

1. Follow the instructions mentioned in the DockerFile to natively install in Ubuntu 18.04 or later.
2. The executable would be located at ~/groot/build/bin/.

json5
{  
  "TopNameServers" : ["us.illinois.net."],  //List of top name servers as strings
  "ZoneFiles" : [
      {
         "FileName": "cc.il.us..txt", //cc.il.us. zone file from us.illinois.net. name server
         "NameServer": "us.illinois.net."
      },
      {
         "FileName": "richland.cc.il.us..txt", //richland.cc.il.us. zone file from ns1.richland.cc.il.us. name server
         "NameServer": "ns1.richland.cc.il.us.",
         "Origin": "richland.cc.il.us." // optional field to indicate the origin of the input zone file.
      },
      {
         "FileName": "child.richland.cc.il.us..txt", //child.richland.cc.il.us. zone file from ns1.child.richland.cc.il.us. name server
         "NameServer": "ns1.child.richland.cc.il.us."
      },
      {
         "FileName": "child.richland.cc.il.us.-2.txt", //child.richland.cc.il.us. zone file from ns2.child.richland.cc.il.us. name server 
         "NameServer": "ns2.child.richland.cc.il.us." //for same domain (child.richland.cc.il.us.) as the last one but from a different name server
      }
  ]
}

json5
[
   {
      "Domain": "cc.il.us." // Name of the domain to check
      "SubDomain": true, //Whether to check the properties on all the subdomains also
      "Properties":[ 
         {
            "PropertyName": "QueryRewrite",
            "Value": ["illinois.net." , "cc.il.us."]
         },
         {
            "PropertyName": "Rewrites",
            "Value": 1
         },
         {
            "PropertyName": "RewriteBlackholing"
         }
      ]
   }
]

The parent and child zone files should have the same set of NS and glue A records for delegation. Input json format:

json5
      {
         "PropertyName": "DelegationConsistency"
      }

Input json format:

json5
      {
         "PropertyName": "AllAliases",
         "Value": ["gw1.richland.cc.il.us."] //List of canonical names
      }

A name server that is authoritative for a zone should provide authoritative answers, otherwise it is a lame delegation. Input json format:

json5
      {
         "PropertyName": "LameDelegation"
      }

The query should not contact any name server that is not a subdomain of the allowed set of domains for any execution in the DNS. Input json format:

json5
      {
         "PropertyName": "NameserverContact",
         "Value": ["edu.", "net.", "cc.il.us."] //List of allowed domain suffixes
      }

The query should not go through more than X number of hops for any execution in the DNS. Input json format:

json5
      {
         "PropertyName": "Hops",
         "Value": 2
      }

The query should not be rewritten more than X number of time for any execution in the DNS. Input json format:

json5
      {
         "PropertyName": "Rewrites",
         "Value": 3
      }

The query should not be rewritten to any domain that is not a subdomain of the allowed set of domains for any execution in the DNS. Input json format:

json5
      {
         "PropertyName": "QueryRewrite",
         "Value": ["illinois.net." , "cc.il.us."] //List of allowed domain suffixes
      }

Input json format:

json5
      {
         "PropertyName": "ResponseConsistency",
         "Types": ["A", "MX"] //Checks the consistency for only these types
      }

Input json format:

json5
      {
         "PropertyName": "ResponseReturned",
         "Types": ["CNAME", "A"] //Checks that some non-empty response is returned for these types
      }

Input json format:

json5
      {
         "PropertyName": "ResponseValue",
         "Types": ["A"],
         "Value": ["64.107.104.4"] //The expected response
         
      }

If the query is rewritten for any execution in the DNS, then the new query's domain name should have at least one resource record.

Input json format:

json5
      {
         "PropertyName": "RewriteBlackholing"
      }

The parent and child zone files should have the same set of NS and glue A records for delegation irrespective of whether the name server hosting the child zone is reachable from the top name servers.

Input json format:

json5
      {
         "PropertyName": "StructuralDelegationConsistency"
      }

The query should not return a resource record with zero TTL for the given types.
Input json format:

json5
      {
         "PropertyName": "ZeroTTL",
         "Types": ["A"]
      }

The query should not overflow the legal size for a domain name after DNAME rewrite. Records with CNAME target domain overflowing the legal size are ignored by the tool and are reported as issues during parsing itself.
Input json format:

json5
      {
         "PropertyName": "DNAMESubstitutionCheck"
      }