Avoid Go 1.20 test error by not attempting to close the testing temp
file unless there was an error in Read().
* Use a CreateTemp() to create unique test files.
* Defer the deletion of the temp file.
Woarkaround for: https://github.com/golang/go/issues/59938
Signed-off-by: SuperQ <superq@gmail.com>
* forward: continue waiting after malformed responses
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* add test
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* fix test
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* clean up
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* clean up
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* move test to /test/. Add build tag.
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* install libpcap-dev for e2e tests
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* sudo the test
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* remove stray err check
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* disable the test
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* use -exec flag to run test binary as root
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* run new test by itself in a new workflow
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* fix test name
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* only for udp
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* remove libpcap test workflow action
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* remove test, since it cant run in ci
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* and remove gopacket package
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
---------
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* When returning NS for delegation point, we sign any DS Record or if not
found we generate a NSEC proving absence of DS. This follow behaviour
describe in rfc4035 (Section 3.1.4)
* DS request at apex behave as before.
* Fix edge case of requesting NSEC which prove that NSEC does not exist.
Signed-off-by: Jeremiejig <me@jeremiejig.fr>
defaulting to localhost makes things explicit in CoreDNS code, and will give us valid URIs in
the logs
Signed-off-by: W. Trevor King <wking@tremily.us>
* plugin/forward: Move Proxy into pkg/plugin/proxy, to allow forward.Proxy to be used outside of forward plugin.
Signed-off-by: Patrick Downey <patrick.downey@dioadconsulting.com>
* Add fallthrough option to k8s_external plugin to allow transitioning control to the next plugin if the domain is not found
* Exit on start up if required plugin is not present.
Signed-off-by: vanceli <vanceli@tencent.com>
---------
Signed-off-by: vanceli <vanceli@tencent.com>
Co-authored-by: vanceli <vanceli@tencent.com>
* Drop obsolete client-go auth plugins
The OpenStack plugin is no longer available, even in version 0.24.4 of
client-go; see
https://github.com/kubernetes/client-go/blob/v0.24.4/plugin/pkg/client/auth/openstack/openstack_stub.go
It is replaced by the client-keystone-auth credential plugin. The
plugin has been entirely removed in client-go 0.26.0, which breaks the
build when any other dependency pulls in client-go 0.26.0 or later.
The GCP plugin is deprecated in K8s 1.22+ and unavailable in 1.26+
(although it is still stubbed in client-go 0.26.0). Is it replaced by
the gke-gcloud-auth-plugin credential plugin.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
* Update plugin/kubernetes/setup.go
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Co-authored-by: Chris O'Haver <cohaver@infoblox.com>
* plugin/edns: remove truncating of question section on bad EDNS version
EDNS requests of "Unknown Version" removed the query section altogether.
Not sure why since this is not require (see [link](https://kb.isc.org/docs/edns-compatibility-dig-queries)
This cause issues with DNS solutions that uses this information (initial queried name, type and class) in order to route the response to the right client (e.g. PDNS).
The change here is to keep the inital query section as is.
Signed-off-by: Ben Kaplan <ben.kaplan@redis.com>
* adding tests for edns0 version check
Signed-off-by: Ben Kaplan <ben.kaplan@redis.com>
* adding tests for non-edns0 version check
Signed-off-by: Ben Kaplan <ben.kaplan@redis.com>
Signed-off-by: Ben Kaplan <ben.kaplan@redis.com>
Both block and filter actions write responses to the client based upon
the source IP address of the UDP packet containing the query. An
attacker spoofing the source IP address to that of their target, can
elicit a response to be sent to the victim host, known as DNS
Reflection. If an attacker is able to elicit a large response from a
relatively small query, with a spoofed source IP address, they are able
to increase the amount of data sent to the victim, known as DNS
Amplification. Scaling this from one to many queries allows an attacker
to perform an effective Denial of Service (DoS) attack against their
target.
Adding the drop action enables CoreDNS to ignore queries of a given
type or network range from being processed and a response written,
where an operator knows ahead of time, should not originate or be
destined to.
Signed-off-by: rsclarke <hey@rsclarke.dev>
Signed-off-by: rsclarke <hey@rsclarke.dev>
* introduce new interface "dnsserver.Viewer", that allows a plugin implementing it to decide if a query should be routed into its server block.
* add new plugin "view", that uses the new interface to enable a user to define expression based conditions that must be met for a query to be routed to its server block.
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
