TrueCloudLab/coredns
16
0
Fork 2
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

plugin/acl: adding ability to drop queries (#5722)

Browse source 
Both block and filter actions write responses to the client based upon
the source IP address of the UDP packet containing the query.  An
attacker spoofing the source IP address to that of their target, can
elicit a response to be sent to the victim host, known as DNS
Reflection.  If an attacker is able to elicit a large response from a
relatively small query, with a spoofed source IP address, they are able
to increase the amount of data sent to the victim, known as DNS
Amplification.  Scaling this from one to many queries allows an attacker
to perform an effective Denial of Service (DoS) attack against their
target.

Adding the drop action enables CoreDNS to ignore queries of a given
type or network range from being processed and a response written,
where an operator knows ahead of time, should not originate or be
destined to.

Signed-off-by: rsclarke <hey@rsclarke.dev>

Signed-off-by: rsclarke <hey@rsclarke.dev>
This commit is contained in:
rsclarke 2022-11-01 17:16:55 +08:00 • committed by GitHub
parent faaf2b446e
commit ead84e1fa8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 194 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

150
plugin/acl/acl_test.go
View file

@ -51,6 +51,7 @@ func TestACLServeDNS(t *testing.T) {
wantRcode int
wantErr bool
wantExtendedErrorCode uint16
expectNoResponse bool
}{
// IPv4 tests.
{
@ -205,6 +206,79 @@ func TestACLServeDNS(t *testing.T) {
wantRcode: dns.RcodeRefused,
wantExtendedErrorCode: dns.ExtendedErrorCodeBlocked,
},
{
name: "Drop 1 DROPPED",
config: `acl example.org {
drop net 192.168.0.0/16
}`,
zones: []string{},
args: args{
domain: "www.example.org.",
sourceIP: "192.168.0.2",
qtype: dns.TypeA,
},
wantRcode: dns.RcodeSuccess,
expectNoResponse: true,
},
{
name: "Subnet-Order 1 REFUSED",
config: `acl example.org {
block net 192.168.1.0/24
drop net 192.168.0.0/16
}`,
zones: []string{},
args: args{
domain: "www.example.org.",
sourceIP: "192.168.1.2",
qtype: dns.TypeA,
},
wantRcode: dns.RcodeRefused,
wantExtendedErrorCode: dns.ExtendedErrorCodeBlocked,
},
{
name: "Subnet-Order 2 DROPPED",
config: `acl example.org {
drop net 192.168.0.0/16
block net 192.168.1.0/24
}`,
zones: []string{},
args: args{
domain: "www.example.org.",
sourceIP: "192.168.1.1",
qtype: dns.TypeA,
},
wantRcode: dns.RcodeSuccess,
expectNoResponse: true,
},
{
name: "Drop-Type 1 DROPPED",
config: `acl example.org {
drop type A
allow net 192.168.0.0/16
}`,
zones: []string{},
args: args{
domain: "www.example.org.",
sourceIP: "192.168.1.1",
qtype: dns.TypeA,
},
wantRcode: dns.RcodeSuccess,
expectNoResponse: true,
},
{
name: "Drop-Type 2 ALLOWED",
config: `acl example.org {
drop type A
allow net 192.168.0.0/16
}`,
zones: []string{},
args: args{
domain: "www.example.org.",
sourceIP: "192.168.1.1",
qtype: dns.TypeAAAA,
},
wantRcode: dns.RcodeSuccess,
},
{
name: "Fine-Grained 1 REFUSED",
config: `acl a.example.org {
@ -402,6 +476,79 @@ func TestACLServeDNS(t *testing.T) {
wantRcode: dns.RcodeRefused,
wantExtendedErrorCode: dns.ExtendedErrorCodeBlocked,
},
{
name: "Drop 1 DROPPED IPV6",
config: `acl example.org {
drop net 2001:0db8:85a3:0000:0000:8a2e:0370:7334
}`,
zones: []string{},
args: args{
domain: "www.example.org.",
sourceIP: "2001:0db8:85a3:0000:0000:8a2e:0370:7334",
qtype: dns.TypeAAAA,
},
wantRcode: dns.RcodeSuccess,
expectNoResponse: true,
},
{
name: "Subnet-Order 1 REFUSED IPv6",
config: `acl example.org {
block net 2001:db8:abcd:0012:8000::/66
drop net 2001:db8:abcd:0012::0/64
}`,
zones: []string{},
args: args{
domain: "www.example.org.",
sourceIP: "2001:db8:abcd:0012:8000::1",
qtype: dns.TypeAAAA,
},
wantRcode: dns.RcodeRefused,
wantExtendedErrorCode: dns.ExtendedErrorCodeBlocked,
},
{
name: "Subnet-Order 2 DROPPED IPv6",
config: `acl example.org {
drop net 2001:db8:abcd:0012::0/64
block net 2001:db8:abcd:0012:8000::/66
}`,
zones: []string{},
args: args{
domain: "www.example.org.",
sourceIP: "2001:db8:abcd:0012:8000::1",
qtype: dns.TypeAAAA,
},
wantRcode: dns.RcodeSuccess,
expectNoResponse: true,
},
{
name: "Drop-Type 1 DROPPED IPv6",
config: `acl example.org {
drop type A
allow net 2001:db8:85a3:0000::0/64
}`,
zones: []string{},
args: args{
domain: "www.example.org.",
sourceIP: "2001:0db8:85a3:0000:0000:8a2e:0370:7334",
qtype: dns.TypeA,
},
wantRcode: dns.RcodeSuccess,
expectNoResponse: true,
},
{
name: "Drop-Type 2 ALLOWED IPv6",
config: `acl example.org {
drop type A
allow net 2001:db8:85a3:0000::0/64
}`,
zones: []string{},
args: args{
domain: "www.example.org.",
sourceIP: "2001:0db8:85a3:0000:0000:8a2e:0370:7334",
qtype: dns.TypeAAAA,
},
wantRcode: dns.RcodeSuccess,
},
}
ctx := context.Background()
@ -430,6 +577,9 @@ func TestACLServeDNS(t *testing.T) {
if w.Rcode != tt.wantRcode {
t.Errorf("Error: acl.ServeDNS() Rcode = %v, want %v", w.Rcode, tt.wantRcode)
}
if tt.expectNoResponse && w.Msg != nil {
t.Errorf("Error: acl.ServeDNS() responded to client when not expected")
}
if tt.wantExtendedErrorCode != 0 {
matched := false
for _, opt := range w.Msg.IsEdns0().Option {