README
T
AliasTrace
T
AuditPolicy
T
ChangeImpact
T
DelegationFinding
T
DelegationRollout
T
DelegationState
T
DeploymentCounterexample
T
DeploymentPlan
T
DeploymentPrecedence
T
DeploymentSnapshot
T
Diagnostic
T
DnskeyFingerprint
T
ImpactNote
T
LexResult
T
LookupResult
T
PolicyParse
T
ResourceRecord
T
SerialOrder
T
Statement
T
Token
T
TypeCount
T
Zone
T
ZoneChange
T
ZoneDiff
T
ZoneInventory
T
ZoneRevision
V
absolute_name
V
analyze_delegation_rollout
V
assess_impact
V
canonical_record_line
V
compare_serial
V
compare_zones
V
default_policy
V
dnskey_ds_sha256
V
error_count
V
find_records
V
inspect_zone
V
inventory_zone
V
lookup_zone
V
parse_policy
V
parse_serial
V
parse_ttl
V
parse_zone
V
plan_delegation_rollout
V
render_canonical_zone
V
render_delegation_rollout_json
V
render_delegation_rollout_text
V
render_deployment_plan_json
V
render_deployment_plan_text
V
render_diagnostics_json
V
render_diagnostics_markdown
V
render_diagnostics_text
V
render_diff_json
V
render_diff_text
V
render_impact_json
V
render_impact_text
V
render_inventory_json
V
render_inventory_text
V
render_lookup_json
V
render_lookup_text
V
trace_alias
V
valid_domain_name
V
valid_ipv4
V
valid_ipv6
V
validate_with_policy
V
validate_zone
V
warning_count

moonzoneguard

Bounded DNS delegation and DS/DNSKEY digest rollout analysis

dns

zone

delegation

rollout

Download zip

Author

geniuszby

Version

0.3.0

License

Apache-2.0

Repository

github.com/geniuszby/moonzoneguard

Last updated

5 hours ago

Downloads

Dependencies

moonbitlang/x0.4.49
gmlewis/sha2560.17.32

#geniuszby/moonzoneguard

AliasTrace

source

pub(all) struct AliasTrace {
  path : Array[String]
  terminal : String
  cycle : Bool
} derive(@moonbitlang/core/debug.Debug
Debug)

AuditPolicy

source

pub(all) struct AuditPolicy {
  min_ttl : Int?
  max_ttl : Int?
  min_apex_ns : Int
  require_ipv6_for_mail : Bool
  forbid_types : Array[String]
} derive(@moonbitlang/core/debug.Debug
Debug)

Optional local review policy. Defaults are deliberately permissive.

ChangeImpact

source

pub(all) struct ChangeImpact {
  score : Int
  level : String
  changed_owners : Int
  added : Int
  removed : Int
  ttl_changed : Int
  notes : Array[ImpactNote]
} derive(@moonbitlang/core/debug.Debug
Debug)

DelegationFinding

source

pub(all) struct DelegationFinding {
  code : String
  severity : String
  source : String
  owner : String
  line : Int
  message : String
} derive(@moonbitlang/core/debug.Debug
Debug)

A finding in one parent/child deployment snapshot. source identifies the input file, and line is the original zone-file line.

DelegationRollout

source

pub(all) struct DelegationRollout {
  states : Array[DelegationState]
  preflight : Array[DelegationFinding]
  parent_first : Bool
  child_first : Bool
  recommendation : String
} derive(@moonbitlang/core/debug.Debug
Debug)

The four snapshots assume that each zone file is published atomically. A safe order means no local error was found in its three snapshots.

DelegationState

source

pub(all) struct DelegationState {
  name : String
  parent_version : String
  child_version : String
  blocked : Bool
  findings : Array[DelegationFinding]
} derive(@moonbitlang/core/debug.Debug
Debug)

DeploymentCounterexample

source

pub(all) struct DeploymentCounterexample {
  from_mask : Int
  to_mask : Int
  changed_zone : String
  safe_prefix : Array[String]
  findings : Array[DelegationFinding]
} derive(@moonbitlang/core/debug.Debug
Debug)

One attempted publication step from a reachable state into a blocked state. from_mask = -1 means the baseline itself is blocked.

DeploymentPlan

source

pub(all) struct DeploymentPlan {
  status : String
  zone_order : Array[String]
  order : Array[String]
  snapshots : Array[DeploymentSnapshot]
  preflight : Array[DelegationFinding]
  counterexample : DeploymentCounterexample?
  safe_order_count : Int
  required_precedence : Array[DeploymentPrecedence]
  first_steps : Array[String]
  blocked_state_count : Int
} derive(@moonbitlang/core/debug.Debug
Debug)

A safe order is a path through the Boolean state lattice where each step updates exactly one zone and every visited snapshot passes.

DeploymentPrecedence

source

pub(all) struct DeploymentPrecedence {
  before_origin : String
  after_origin : String
} derive(@moonbitlang/core/debug.Debug
Debug)

A relation shared by every safe complete publication sequence.

DeploymentSnapshot

source

pub(all) struct DeploymentSnapshot {
  mask : Int
  blocked : Bool
  findings : Array[DelegationFinding]
} derive(@moonbitlang/core/debug.Debug
Debug)

Diagnostic

source

pub(all) struct Diagnostic {
  code : String
  severity : String
  message : String
  line : Int
  column : Int
  owner : String
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

A source-linked finding. severity is error, warning, or note.

DnskeyFingerprint

source

pub(all) struct DnskeyFingerprint {
  owner : String
  flags : Int
  algorithm : Int
  key_tag : Int
  sha256_digest : String
} derive(@moonbitlang/core/debug.Debug
Debug)

A digest association, not evidence that the public key or RRSIG is valid.

ImpactNote

source

pub(all) struct ImpactNote {
  severity : String
  category : String
  message : String
  owner : String
  line : Int
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

LexResult

source

type LexResult derive(@moonbitlang/core/debug.Debug
Debug)

LookupResult

source

pub(all) struct LookupResult {
  status : String
  queried_name : String
  queried_type : String
  canonical_name : String
  alias_path : Array[String]
  answers : Array[ResourceRecord]
} derive(@moonbitlang/core/debug.Debug
Debug)

PolicyParse

source

pub(all) struct PolicyParse {
  policy : AuditPolicy
  diagnostics : Array[Diagnostic]
} derive(@moonbitlang/core/debug.Debug
Debug)

ResourceRecord

source

pub(all) struct ResourceRecord {
  owner : String
  origin : String
  ttl : Int
  class_name : String
  record_type : String
  rdata : Array[String]
  line : Int
  column : Int
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

One parsed DNS resource record. Names are canonical absolute names.

SerialOrder

source

pub(all) enum SerialOrder {
  Same
  Forward
  Backward
  Undefined
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

RFC 1982 serial-number arithmetic yields an undefined region at exactly half the space.

Statement

source

type Statement derive(@moonbitlang/core/debug.Debug
Debug)

Token

source

type Token derive(Eq, @moonbitlang/core/debug.Debug
Debug)

TypeCount

source

pub(all) struct TypeCount {
  record_type : String
  count : Int
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Zone

source

pub(all) struct Zone {
  origin : String
  records : Array[ResourceRecord]
  diagnostics : Array[Diagnostic]
} derive(@moonbitlang/core/debug.Debug
Debug)

A parsed zone and its syntax diagnostics.

ZoneChange

source

pub(all) struct ZoneChange {
  kind : String
  owner : String
  record_type : String
  rdata : Array[String]
  before_ttl : Int?
  after_ttl : Int?
  line : Int
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

ZoneDiff

source

pub(all) struct ZoneDiff {
  changes : Array[ZoneChange]
  diagnostics : Array[Diagnostic]
  serial_order : SerialOrder?
} derive(@moonbitlang/core/debug.Debug
Debug)

ZoneInventory

source

pub(all) struct ZoneInventory {
  origin : String
  record_count : Int
  owner_count : Int
  address_count : Int
  alias_count : Int
  min_ttl : Int?
  max_ttl : Int?
  type_counts : Array[TypeCount]
} derive(@moonbitlang/core/debug.Debug
Debug)

ZoneRevision

source

pub(all) struct ZoneRevision {
  origin : String
  before : Zone
  after : Zone
} derive(@moonbitlang/core/debug.Debug
Debug)

One zone's proposed atomic transition. The origin must match both parsed zone documents. At most six revisions can be checked in one plan.

absolute_name

source

fn absolute_name(name : String, origin : String) -> String

Convert a master-file owner or domain-valued RDATA to an absolute DNS name.

analyze_delegation_rollout

source

fn analyze_delegation_rollout(parent_before : Zone, parent_after : Zone, child_before : Zone, child_after : Zone) -> DelegationRollout

Check both publication orders of one parent and one child zone. This is a bounded offline model: it does not simulate DNS caches, live servers, DNSSEC validation, or non-atomic publication.

assess_impact

source

fn assess_impact(diff : ZoneDiff, origin : String) -> ChangeImpact

A transparent review priority score, not a prediction of DNS availability. SOA serial changes alone are ignored in this score.

canonical_record_line

source

fn canonical_record_line(record : ResourceRecord) -> String

Render one record with explicit owner, TTL, class, and type. RDATA names are expanded against the $ORIGIN active at that record.

compare_serial

source

fn compare_serial(before : UInt, after : UInt) -> SerialOrder

compare_zones

source

fn compare_zones(before : Zone, after : Zone) -> ZoneDiff

Compare two versions of one zone as multisets of resource records.

default_policy

source

fn default_policy() -> AuditPolicy

dnskey_ds_sha256

source

fn dnskey_ds_sha256(record : ResourceRecord) -> Result[DnskeyFingerprint, String]

Compute key tag and digest type 2 for a numeric DNSKEY presentation record. RSA/MD5 algorithm 1 is deliberately unsupported because its key tag differs.

error_count

source

fn error_count(diagnostics : Array[Diagnostic]) -> Int

find_records

source

fn find_records(zone : Zone, owner : String, record_type : String) -> Array[ResourceRecord]

Get all exact owner/type matches in source order. * means every type.

inspect_zone

source

fn inspect_zone(input : String, origin : String) -> Array[Diagnostic]

Parse and validate a master file in one call.

inventory_zone

source

fn inventory_zone(zone : Zone) -> ZoneInventory

Summarize a parsed zone without any network lookup.

lookup_zone

source

fn lookup_zone(zone : Zone, name : String, record_type : String) -> LookupResult

Simulate an exact, local lookup with CNAME following. This is not a DNS resolver: it performs no wildcard synthesis, delegation, or network I/O.

parse_policy

source

fn parse_policy(source : String) -> PolicyParse

Parse a small, reviewable policy format: one key value pair per line. Blank lines and lines beginning with # are ignored.

parse_serial

source

fn parse_serial(input : String) -> UInt?

parse_ttl

source

fn parse_ttl(input : String) -> Int?

Parse a TTL written as seconds or a sequence such as 1w2d3h.

parse_zone

source

fn parse_zone(input : String, origin : String) -> Zone

Parse the supported RFC 1035 zone-file subset without filesystem or network access.

plan_delegation_rollout

source

fn plan_delegation_rollout(revisions : Array[ZoneRevision]) -> DeploymentPlan

Enumerate at most 64 before/after combinations, then search for a path from all-before to all-after where one zone changes at each step.

render_canonical_zone

source

fn render_canonical_zone(zone : Zone) -> String

Produce stable, explicit master-file text in source record order.

render_delegation_rollout_json

source

fn render_delegation_rollout_json(result : DelegationRollout) -> String

render_delegation_rollout_text

source

fn render_delegation_rollout_text(result : DelegationRollout) -> String

render_deployment_plan_json

source

fn render_deployment_plan_json(plan : DeploymentPlan) -> String

render_deployment_plan_text

source

fn render_deployment_plan_text(plan : DeploymentPlan) -> String

render_diagnostics_json

source

fn render_diagnostics_json(items : Array[Diagnostic]) -> String

Render a deterministic, parseable JSON diagnostics object.

render_diagnostics_markdown

source

fn render_diagnostics_markdown(items : Array[Diagnostic]) -> String

Render a compact review report suitable for a pull request description.

render_diagnostics_text

source

fn render_diagnostics_text(items : Array[Diagnostic]) -> String

Render diagnostics for terminal display.

render_diff_json

source

fn render_diff_json(diff : ZoneDiff) -> String

render_diff_text

source

fn render_diff_text(diff : ZoneDiff) -> String

render_impact_json

source

fn render_impact_json(impact : ChangeImpact) -> String

render_impact_text

source

fn render_impact_text(impact : ChangeImpact) -> String

render_inventory_json

source

fn render_inventory_json(inventory : ZoneInventory) -> String

render_inventory_text

source

fn render_inventory_text(inventory : ZoneInventory) -> String

render_lookup_json

source

fn render_lookup_json(result : LookupResult) -> String

render_lookup_text

source

fn render_lookup_text(result : LookupResult) -> String

trace_alias

source

fn trace_alias(zone : Zone, owner : String) -> AliasTrace

Walk in-zone CNAME links. A repeated name ends the trace with cycle=true.

valid_domain_name

source

fn valid_domain_name(name : String) -> Bool

Conservative ASCII presentation-name validation. Escaped octets are outside v1 scope.

valid_ipv4

source

fn valid_ipv4(value : String) -> Bool

valid_ipv6

source

fn valid_ipv6(value : String) -> Bool

Check the text form of an IPv6 address without accepting zone identifiers.

validate_with_policy

source

fn validate_with_policy(zone : Zone, policy : AuditPolicy) -> Array[Diagnostic]

Apply optional team policy after the standard DNS validation.

validate_zone

source

fn validate_zone(zone : Zone) -> Array[Diagnostic]

Analyze syntax, record content, and cross-record DNS invariants.

warning_count

source

fn warning_count(diagnostics : Array[Diagnostic]) -> Int

Source Files

Site source Report issue Packages Build queue Skills Statistics

moonzoneguard

#geniuszby/moonzoneguard

#AliasTrace

#AuditPolicy

#ChangeImpact

#DelegationFinding

#DelegationRollout

#DelegationState

#DeploymentCounterexample

#DeploymentPlan

#DeploymentPrecedence

#DeploymentSnapshot

#Diagnostic

#DnskeyFingerprint

#ImpactNote

#LexResult

#LookupResult

#PolicyParse

#ResourceRecord

#SerialOrder

#Statement

#Token

#TypeCount

#Zone

#ZoneChange

#ZoneDiff

#ZoneInventory

#ZoneRevision

#absolute_name

#analyze_delegation_rollout

#assess_impact

#canonical_record_line

#compare_serial

#compare_zones

#default_policy

#dnskey_ds_sha256

#error_count

#find_records

#inspect_zone

#inventory_zone

#lookup_zone

#parse_policy

#parse_serial

#parse_ttl

#parse_zone

#plan_delegation_rollout

#render_canonical_zone

#render_delegation_rollout_json

#render_delegation_rollout_text

#render_deployment_plan_json

#render_deployment_plan_text

#render_diagnostics_json

#render_diagnostics_markdown

#render_diagnostics_text

#render_diff_json

#render_diff_text

#render_impact_json

#render_impact_text

#render_inventory_json

#render_inventory_text

#render_lookup_json

#render_lookup_text

#trace_alias

#valid_domain_name

#valid_ipv4

#valid_ipv6

#validate_with_policy

#validate_zone

#warning_count

Source Files

AliasTrace

AuditPolicy

ChangeImpact

DelegationFinding

DelegationRollout

DelegationState

DeploymentCounterexample

DeploymentPlan

DeploymentPrecedence

DeploymentSnapshot

Diagnostic

DnskeyFingerprint

ImpactNote

LexResult

LookupResult

PolicyParse

ResourceRecord

SerialOrder

Statement

Token

TypeCount

Zone

ZoneChange

ZoneDiff

ZoneInventory

ZoneRevision

absolute_name

analyze_delegation_rollout

assess_impact

canonical_record_line

compare_serial

compare_zones

default_policy

dnskey_ds_sha256

error_count

find_records

inspect_zone

inventory_zone

lookup_zone

parse_policy

parse_serial

parse_ttl

parse_zone

plan_delegation_rollout

render_canonical_zone

render_delegation_rollout_json

render_delegation_rollout_text

render_deployment_plan_json

render_deployment_plan_text

render_diagnostics_json

render_diagnostics_markdown

render_diagnostics_text

render_diff_json

render_diff_text

render_impact_json

render_impact_text

render_inventory_json

render_inventory_text

render_lookup_json

render_lookup_text

trace_alias

valid_domain_name

valid_ipv4

valid_ipv6

validate_with_policy

validate_zone

warning_count