Merge #85: Support tlsrestrictnsssync

524d09d Travis: mark gosec static analyzer as non-critical (JeremyRand)
9bcdd25 (WIP) Support tlsrestrictnsssync. (JeremyRand)

Pull request description:

  This PR adds the ability to automatically re-apply name constraints whenever an NSS application such as Firefox is updated.  Depends on https://github.com/namecoin/tlsrestrictnss/pull/14 .

Tree-SHA512: 9d7055ef493236b8bf1dd75487984bb80827c64e602a0745da522974462c5a7bb389dd4d7c06dec06bce9b3814e8337afc30f703e9efb63d5699d8ec86d04b06

.travis/script

@@ -32,6 +32,7 @@ gometalinter.v2 --enable-all \
 --disable=gocyclo \
 --disable=gofmt \
 --disable=golint \
+--disable=gosec \
 --disable=ineffassign \
 --disable=lll \
 --disable=maligned \

backend/backend.go

@@ -7,6 +7,7 @@ import "github.com/namecoin/ncdns/namecoin"
 import "github.com/namecoin/ncdns/util"
 import "github.com/namecoin/ncdns/ncdomain"
 import "github.com/namecoin/ncdns/tlshook"
+import "github.com/namecoin/tlsrestrictnss/tlsrestrictnsssync"
 import "github.com/hlandau/xlog"
 import "sync"
 import "fmt"
@@ -107,6 +108,11 @@ func convertEmail(email string) (string, error) {
 // Do low-level queries against an abstract zone file. This is the per-query
 // entrypoint from madns.
 func (b *Backend) Lookup(qname string) (rrs []dns.RR, err error) {
+	if !tlsrestrictnsssync.IsReady() {
+		err = fmt.Errorf("tlsrestrictnss not ready")
+		return
+	}
+
 	btx := &btx{}
 	btx.b = b
 	btx.qname = qname

server/server.go

@@ -15,6 +15,7 @@ import (
 	"github.com/namecoin/ncdns/backend"
 	"github.com/namecoin/ncdns/namecoin"
 	"github.com/namecoin/ncdns/tlsoverridefirefox/tlsoverridefirefoxsync"
+	"github.com/namecoin/tlsrestrictnss/tlsrestrictnsssync"
 	"gopkg.in/hlandau/madns.v1"
 )
 
@@ -220,6 +221,11 @@ func (s *Server) Start() error {
 		return fmt.Errorf("Couldn't start Firefox override sync: %s", err)
 	}
 
+	err = tlsrestrictnsssync.Start()
+	if err != nil {
+		return fmt.Errorf("Couldn't start tlsrestrictnss sync: %s", err)
+	}
+
 	return nil
 }