[{"_1":2,"_189":-5,"_190":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_164":165},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":17},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":85,"_106":107,"_155":-5,"_156":11,"_157":17,"_158":11,"_159":-5,"_160":11,"_161":-5,"_162":163},"canonicalUrl","https://hub.docker.com/r/dnsgt/groot/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","dnsgt","reponame","groot","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":70,"_75":11,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2020-04-08T21:30:20.028735Z","description","Static Verification tool for DNS zone files","is_private","last_updated","2022-08-06T22:04:35.229482Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.container.image.v1+json","name","pull_count",1295,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","GRoot \n==========\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg?style=popout)](https://opensource.org/licenses/MIT)\n \n[![](https://img.shields.io/github/actions/workflow/status/dns-groot/groot/dockerimage.yml?logo=docker&style=popout&label=docker+image)](https://github.com/dns-groot/groot/actions?query=workflow%3A%22Codecov+and+Docker+Image+CI%22)\n \n

\n \n[![codecov](https://codecov.io/gh/dns-groot/groot/branch/master/graph/badge.svg?style=popout)](https://codecov.io/gh/dns-groot/groot)\n\n\n\nGroot is a static verification tool for DNS. Groot consumes a collection of zone files along with a collection of user-defined properties and systematically checks if any input to DNS can lead to violation of the properties.\n\n## Installation\n\n### Using `docker` (recommended)\n\n_**Note:** The docker image may consume ~ 1.2 GB of disk space._\n\nWe recommend running Groot within a docker container,\nsince they have negligible performance overhead.\n(See [this report](http://domino.research.ibm.com/library/cyberdig.nsf/papers/0929052195DD819C85257D2300681E7B/$File/rc25482.pdf))\n\n0. [Get `docker` for your OS](https://docs.docker.com/install).\n1. Pull our docker image^[#](#note_1): `docker pull dnsgt/groot`.\n2. Run a container over the image: `docker run -it dnsgt/groot`.
\n This would give you a `bash` shell within groot directory.\n\n^# Alternatively, you could also build the Docker image locally:\n\n```bash\ndocker build -t dnsgt/groot github.com/dns-groot/groot\n```\nDocker containers are isolated from the host system.\nTherefore, to run Groot on zones files residing on the host system,\nyou must first [bind mount] them while running the container:\n\n```bash\ndocker run -v ~/data:/home/groot/groot/shared -it dnsgt/groot\n```\n\nThe `~/data` on the host system would then be accessible within the container at `~/groot/shared` (with read+write permissions). The executable would be located at `~/groot/build/bin/`.\n\n### Manual Installation\n\n

\n\n

CLICK to reveal instructions

\n\n#### Installation for Windows\n1. Install [`vcpkg`](https://docs.microsoft.com/en-us/cpp/build/vcpkg?view=vs-2019) package manager to install dependecies. \n2. Install the C++ libraries (64 bit versions) using:\n - .\\vcpkg.exe install boost-serialization:x64-windows boost-flyweight:x64-windows boost-dynamic-bitset:x64-windows boost-graph:x64-windows boost-accumulators:x64-windows docopt:x64-windows nlohmann-json:x64-windows spdlog:x64-windows\n - .\\vcpkg.exe integrate install \n3. Clone the repository (with `--recurse-submodules`) and open the solution (groot.sln) using Visual studio. Set the platform to x64 and mode to Release.\n4. Configure the project properties to use ISO C++17 Standard (std:c++17) for C++ language standard.\n5. Set `groot` as `Set as Startup Project` using the solution explorer in the Visual Studio. Build the project using visual studio to generate the executable. The executable would be located at `~\\groot\\x64\\Release\\`.\n\n#### Installation for Ubuntu 18.04 or later\n1. Follow the instructions mentioned in the `DockerFile` to natively install in Ubuntu 18.04 or later.\n2. The executable would be located at `~/groot/build/bin/`.\n\n

\n\n## Property Verification\nCheck for any violations of the input properties by invoking Groot as:\n\nFor docker (Ubuntu):\n```bash\n$ .~/groot/build/bin/groot ~/groot/test/TestFiles/cc.il.us/zone_files --jobs=~/groot/test/TestFiles/cc.il.us/jobs.json --output=output.json\n```\nFor Windows:\n```bash\n$ .~\\groot\\x64\\Release\\groot.exe ~\\groot\\test\\TestFiles\\cc.il.us\\zone_files --jobs=~\\groot\\test\\TestFiles\\cc.il.us\\jobs.json --output=output.json\n```\nGroot outputs any violations to the `output.json` file. \n\n### Flags\nUser can log debugging messages to `log.txt` using `-l` and use `-v` flag to log more detailed information. Use `-s` flag to display the statistics of the zone files parsed and the execution time. To log zone file issues (missing glue records, multiple CNAME/DNAME records, duplicate records) separately in `lint.json`, use the `--lint` flag. \n\n### Packaging zone files data\nGroot expects all the required zone files to be available in the input directory along with a special file `metadata.json`. The `metadata.json` file has to be created by the user and has to list the file name and the name server from which that zone file was obtained. If the zone files for a domain are obtained from multiple name servers, make sure to give the files a distinct name and fill the metadata accordingly. The user also has to provide the root (top) name servers for his domain in the `metadata.json`. \n\n

\n\n

CLICK to reveal an examplemetadata.json

\n\n```json5\n{ \n \"TopNameServers\" : [\"us.illinois.net.\"], //List of top name servers as strings\n \"ZoneFiles\" : [\n {\n \"FileName\": \"cc.il.us..txt\", //cc.il.us. zone file from us.illinois.net. name server\n \"NameServer\": \"us.illinois.net.\"\n },\n {\n \"FileName\": \"richland.cc.il.us..txt\", //richland.cc.il.us. zone file from ns1.richland.cc.il.us. name server\n \"NameServer\": \"ns1.richland.cc.il.us.\",\n \"Origin\": \"richland.cc.il.us.\" // optional field to indicate the origin of the input zone file.\n },\n {\n \"FileName\": \"child.richland.cc.il.us..txt\", //child.richland.cc.il.us. zone file from ns1.child.richland.cc.il.us. name server\n \"NameServer\": \"ns1.child.richland.cc.il.us.\"\n },\n {\n \"FileName\": \"child.richland.cc.il.us.-2.txt\", //child.richland.cc.il.us. zone file from ns2.child.richland.cc.il.us. name server \n \"NameServer\": \"ns2.child.richland.cc.il.us.\" //for same domain (child.richland.cc.il.us.) as the last one but from a different name server\n }\n ]\n}\n```\n

\n\n### Inputting Jobs\nGroot can currently verify properties shown below on the zone files and expects the input list in a `json` file format. A **job** verifies properties on a domain and optionally on all its subdomains. The input `json` file can have a list of jobs. Groot verifies a default set of properties if no input file is provided.\n\n

CLICK to reveal an example job

\n\n```json5\n[\n {\n \"Domain\": \"cc.il.us.\" // Name of the domain to check\n \"SubDomain\": true, //Whether to check the properties on all the subdomains also\n \"Properties\":[ \n {\n \"PropertyName\": \"QueryRewrite\",\n \"Value\": [\"illinois.net.\" , \"cc.il.us.\"]\n },\n {\n \"PropertyName\": \"Rewrites\",\n \"Value\": 1\n },\n {\n \"PropertyName\": \"RewriteBlackholing\"\n }\n ]\n }\n]\n```\n

\n\n#### Available Properties\n

Delegation Consistency

\n \nThe parent and child zone files should have the same set of _NS_ and glue _A_ records for delegation.\nInput `json` format:\n```json5\n {\n \"PropertyName\": \"DelegationConsistency\"\n }\n```\n

\n\n

Finding all aliases

\nLists all the input query names (aliases) that are eventually rewritten to one of the canonical names. \n\nInput `json` format:\n```json5\n {\n \"PropertyName\": \"AllAliases\",\n \"Value\": [\"gw1.richland.cc.il.us.\"] //List of canonical names\n }\n```\n

\n\n

Lame Delegation

\n \nA name server that is authoritative for a zone should provide authoritative answers, otherwise it is a lame delegation.\nInput `json` format:\n```json5\n {\n \"PropertyName\": \"LameDelegation\"\n }\n```\n

\n\n

Nameserver Contact

\n \nThe query should not contact any name server that is not a subdomain of the allowed set of domains for any execution in the DNS.\nInput `json` format:\n```json5\n {\n \"PropertyName\": \"NameserverContact\",\n \"Value\": [\"edu.\", \"net.\", \"cc.il.us.\"] //List of allowed domain suffixes\n }\n```\n

\n\n

Number of Hops

\n \nThe query should not go through more than _X_ number of hops for any execution in the DNS.\nInput `json` format:\n```json5\n {\n \"PropertyName\": \"Hops\",\n \"Value\": 2\n }\n```\n

\n\n

Number of Rewrites

\n \nThe query should not be rewritten more than _X_ number of time for any execution in the DNS.\nInput `json` format:\n```json5\n {\n \"PropertyName\": \"Rewrites\",\n \"Value\": 3\n }\n```\n

\n\n

Query Rewritting

\n \nThe query should not be rewritten to any domain that is not a subdomain of the allowed set of domains for any execution in the DNS.\nInput `json` format:\n```json5\n {\n \"PropertyName\": \"QueryRewrite\",\n \"Value\": [\"illinois.net.\" , \"cc.il.us.\"] //List of allowed domain suffixes\n }\n```\n

\n\n

Response Consistency

\nDifferent executions in DNS that might happen due to multiple name servers should result in the same answers.\n \nInput `json` format:\n```json5\n {\n \"PropertyName\": \"ResponseConsistency\",\n \"Types\": [\"A\", \"MX\"] //Checks the consistency for only these types\n }\n```\n

\n\n

Response Returned

\nDifferent executions in DNS that might happen due to multiple name servers should result in some non-empty response.\n \nInput `json` format:\n```json5\n {\n \"PropertyName\": \"ResponseReturned\",\n \"Types\": [\"CNAME\", \"A\"] //Checks that some non-empty response is returned for these types\n }\n```\n

\n\n

Response Value

\nEvery execution in DNS should return an answer that matches the user input answer.\n\nInput `json` format:\n```json5\n {\n \"PropertyName\": \"ResponseValue\",\n \"Types\": [\"A\"],\n \"Value\": [\"64.107.104.4\"] //The expected response\n \n }\n```\n

\n\n

Rewrite Blackholing

\n \nIf the query is rewritten for any execution in the DNS, then the new query's domain name should have at least one resource record.\n\nInput `json` format:\n```json5\n {\n \"PropertyName\": \"RewriteBlackholing\"\n }\n```\n

\n\n

Structural Delegation Consistency

\n \nThe parent and child zone files should have the same set of _NS_ and glue _A_ records for delegation irrespective of whether the name server hosting the child zone is reachable from the top name servers. \n\nInput `json` format:\n```json5\n {\n \"PropertyName\": \"StructuralDelegationConsistency\"\n }\n```\n

\n\n

Zero Time To Live

\n \nThe query should not return a resource record with zero TTL for the given types. \nInput `json` format:\n```json5\n {\n \"PropertyName\": \"ZeroTTL\",\n \"Types\": [\"A\"]\n }\n```\n

\n\n

DNAME Substitution Check

\n \nThe query should not overflow the legal size for a domain name after DNAME rewrite. Records with CNAME target domain overflowing the legal size are ignored by the tool and are reported as issues during parsing itself. \nInput `json` format:\n```json5\n {\n \"PropertyName\": \"DNAMESubstitutionCheck\"\n }\n```\n

\n\nGroot, by default, checks for cyclic zone dependency and other loops while verifying any of the above properties. \n\n[docker-hub]: https://hub.docker.com/r/sivakesava/groot\n[bind mount]: https://docs.docker.com/storage/bind-mounts\n","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",40100205106,"orgData",{"_86":87,"_88":89,"_90":91,"_92":29,"_93":94,"_95":96,"_97":98,"_99":96,"_100":101,"_102":96,"_103":96,"_104":96,"_105":17},"id","09110f852ad5418b91e9d644c5c34ac3","uuid","09110f85-2ad5-418b-91e9-d644c5c34ac3","type","organization","orgname","full_name","DNS Groot","location","","company","UCLA","profile_url","date_joined","2020-04-08T21:28:51.551696Z","gravatar_url","gravatar_email","badge","is_active","recentTags",[108,145],{"_109":40,"_110":111,"_112":113,"_114":115,"_86":116,"_117":118,"_46":133,"_134":111,"_135":136,"_137":52,"_53":138,"_139":140,"_141":124,"_142":133,"_143":62,"_144":17},"content_type","creator",9625333,"digest","sha256:877c91a5b3d63bcd31cf5af3b2c68858fe53a9af476f74170b884ab81c149cae","full_size",551393536,94766648,"images",[119],{"_120":121,"_112":113,"_122":96,"_123":124,"_125":126,"_127":128,"_129":96,"_130":-5,"_131":115,"_59":62,"_132":-5},"architecture","amd64","features","last_pulled","2026-09-22T23:16:42.351715493Z","last_pushed","2022-08-06T22:04:36Z","os","linux","os_features","os_version","size","variant","2022-08-06T22:04:35.079508Z","last_updater","last_updater_username","sivakesava","media_type","latest","repository",8798715,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_109":40,"_110":111,"_114":146,"_86":147,"_117":148,"_46":153,"_134":111,"_135":136,"_137":52,"_53":154,"_139":140,"_141":151,"_142":153,"_143":62,"_144":17},476341563,103857170,[149],{"_120":121,"_112":150,"_122":96,"_123":151,"_125":152,"_127":128,"_129":96,"_130":-5,"_131":146,"_59":62,"_132":-5},"sha256:26eb8c7f2d7371b278d186e41c9d8b326e288fe9ec4458eeb95422b53874fe72","2026-09-08T20:52:40.069087349Z","2020-06-23T07:28:07Z","2020-06-23T07:28:06.769005Z","SIGCOMM_AE","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":166,"_173":174,"_162":187,"_188":11},{"_36":167,"_38":168,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":169,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":170,"_75":11,"_76":172,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":171},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_175":176,"_177":-5,"_178":-5,"_179":180},"count",2,"next","previous","results",[181,184],{"_109":40,"_110":111,"_112":113,"_114":115,"_86":116,"_117":182,"_46":133,"_134":111,"_135":136,"_137":52,"_53":138,"_139":140,"_141":124,"_142":133,"_143":62,"_144":17},[183],{"_120":121,"_112":113,"_122":96,"_123":124,"_125":126,"_127":128,"_129":96,"_130":-5,"_131":115,"_59":62,"_132":-5},{"_109":40,"_110":111,"_114":146,"_86":147,"_117":185,"_46":153,"_134":111,"_135":136,"_137":52,"_53":154,"_139":140,"_141":151,"_142":153,"_143":62,"_144":17},[186],{"_120":121,"_112":150,"_122":96,"_123":151,"_125":152,"_127":128,"_129":96,"_130":-5,"_131":146,"_59":62,"_132":-5},[],"canDeleteTags","actionData","errors"]

dnsgt/groot

Tags for dnsgt/groot