* plugin/edns: remove truncating of question section on bad EDNS version
EDNS requests of "Unknown Version" removed the query section altogether.
Not sure why since this is not require (see [link](https://kb.isc.org/docs/edns-compatibility-dig-queries)
This cause issues with DNS solutions that uses this information (initial queried name, type and class) in order to route the response to the right client (e.g. PDNS).
The change here is to keep the inital query section as is.
Signed-off-by: Ben Kaplan <ben.kaplan@redis.com>
* adding tests for edns0 version check
Signed-off-by: Ben Kaplan <ben.kaplan@redis.com>
* adding tests for non-edns0 version check
Signed-off-by: Ben Kaplan <ben.kaplan@redis.com>
Signed-off-by: Ben Kaplan <ben.kaplan@redis.com>
* introduce new interface "dnsserver.Viewer", that allows a plugin implementing it to decide if a query should be routed into its server block.
* add new plugin "view", that uses the new interface to enable a user to define expression based conditions that must be met for a query to be routed to its server block.
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
Previously we use io.LimitReader to limit the number of bytes
from http request. However, there is a subtle difference between
io.LimitReader and io.ReadAll as io.LimitReader will return
a Reader, not a ReadCloser. As such the behavior will actually
be difference in case of error handling (and when to close).
This PR changes io.LimitReader to http.MaxBytesReader
so that the behavior can be preserved (except the number of bytes).
See https://stackoverflow.com/a/52699702
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
* Update to avoid pseudo-random number
This PR update the usage of rand so that non-global seed is used.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
* Add concurrency-safe random source
See https://stackoverflow.com/questions/48958886/how-to-create-a-thread-safe-rand-source
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
This PR adds limit to ioutil.ReadAll for DoH request body
so that it will not be subject to large requests.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
PR 2938 hardens tls though there are other places that uses TLS
as well and setTLSDefaults are not invoked in other paths.
This PR hardens tls on all places.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
While performing security scans there were several
issue raised as G304 (CWE-22): Potential file inclusion via variable.
As some files path are taken from user input, it is possible the
filepath passed by user may have unintended effect if not properly formed.
This fix add Clean to remove the security warning and address some
potential issue.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
* upstream lookups are done with original EDNS options
Signed-off-by: Ondřej Benkovský <ondrej.benkovsky@jamf.com>
* fixup! upstream lookups are done with original EDNS options
Signed-off-by: Ondřej Benkovský <ondrej.benkovsky@jamf.com>
* fix ipv6 case for cidr.Class
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* add check and test case for invalid ipv6 cidr
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* net package is bad at detecting ipv6/ipv4
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* rename Class -> Split
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* deprecate normalize and mustnormalize
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* add runtime warning
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* elaborate runtime warning
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* include caller info
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
Make normalize return multiple "hosts" (= reverse zones) when a
non-octet boundary cidr is given.
Added pkg/cidr package that holds the cidr calculation routines; felt
they didn't really fit dnsutil.
This change means the IPNet return parameter isn't needed, the hosts are
all correct. The tests that tests this is also removed: TestSplitHostPortReverse
The fallout was that zoneAddr _also_ doesn't need the IPNet member, that
in turn make it visible that zoneAddr in address.go duplicated a bunch
of stuff from register.go; removed/refactored that too.
Created a plugin.OriginsFromArgsOrServerBlock to help plugins do the
right things, by consuming ZONE arguments; this now expands reverse
zones correctly. This is mostly mechanical.
Remove the reverse test in plugin/kubernetes which is a copy-paste from
a core test (which has since been fixed).
Remove MustNormalize as it has no plugin users.
This change is not backwards compatible to plugins that have a ZONE
argument that they parse in the setup util.
All in-tree plugins have been updated.
Signed-off-by: Miek Gieben <miek@miek.nl>
* plugin/dnssec: use entire RRset as key input
This uses the entire rrset as input for the hash key; this is to detect
differences in the RRset and generate the correct signature.
As this would then lead to unbounded growth, we periodically (every 8h)
prune the cache of old entries. In theory we could rely on the random
eviction, but it seems nicer to do this in a maintannce loop so that we
remove the unused ones. This required adding a Walk function to the
plugin/pkg/cache.
Signed-off-by: Miek Gieben <miek@miek.nl>
* Update plugin/dnssec/cache.go
Co-authored-by: Chris O'Haver <cohaver@infoblox.com>
Co-authored-by: Chris O'Haver <cohaver@infoblox.com>
To combat label cardinality explosions remove the type from metrics.
This was most severe in the histogram for request duration, remove it
there.
It's also highlighted difference between grpc and forward code, where
forward did use type and grpc didn't; getting rid of all that "fixes"
that discrepancy
Move monitor.go back into the vars directory and make it private again.
Also name it slightly better
Fixes: #4507
Signed-off-by: Miek Gieben <miek@miek.nl>
* plugin/forward Add rcode and rtype to request_duration_seconds metric
Signed-off-by: Maxime Ginters <maxime.ginters@shopify.com>
* Control the cardinality of query type
Signed-off-by: Maxime Ginters <maxime.ginters@shopify.com>
* For caddy v1 in our org
This RP changes all imports for caddyserver/caddy to coredns/caddy. This
is the v1 code of caddy.
For the coredns/caddy repo the following changes have been made:
* anything not needed by us is deleted
* all `telemetry` stuff is deleted
* all its import paths are also changed to point to coredns/caddy
* the v1 branch has been moved to the master branch
* a v1.1.0 tag has been added to signal the latest release
Signed-off-by: Miek Gieben <miek@miek.nl>
* Fix imports
Signed-off-by: Miek Gieben <miek@miek.nl>
* Group coredns/caddy with out plugins
Signed-off-by: Miek Gieben <miek@miek.nl>
* remove this file
Signed-off-by: Miek Gieben <miek@miek.nl>
* Relax import ordering
github.com/coredns is now also a coredns dep, this makes
github.com/coredns/caddy fit more natural in the list.
Signed-off-by: Miek Gieben <miek@miek.nl>
* Fix final import
Signed-off-by: Miek Gieben <miek@miek.nl>
* revert de-dup
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* unit test
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* use roundrobin policy in test
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* parse.HostPortorFile: return error when 0 found
Return an error when we haven't found any nameservers. This is the
alternative considered in #3735. It's also slighly less code to be
changing.
Replaces: #3741Closes: #3741#3735
Signed-off-by: Miek Gieben <miek@miek.nl>
* Add extra test case here as well
Signed-off-by: Miek Gieben <miek@miek.nl>
Currently, when we access github.com with HTTP, it is redirected to HTTPS automatically. So this commit aims to replace http://github.com by https://github.com for security.
Signed-off-by: Kim Bao Long <longkb@vn.fujitsu.com>
* plugin/pkg/up: make default intervals shorter
I think 15 min is too high, make this lower to react faster.
Signed-off-by: Miek Gieben <miek@miek.nl>
* Update README
Signed-off-by: Miek Gieben <miek@miek.nl>
Move exponential backoff initialization to Start()
Signed-off-by: RickyRajinder <singh.sangh@gmail.com>
Move comment
Increase max interval and update README
Remove trailing whitespace
Change Start() param name back to interval
Add a test for this as well as it's annoying to point out in every code
review.
Fix all the import paths that are flagged by this new test.
Fixes: #3634
Signed-off-by: Miek Gieben <miek@miek.nl>
1. The HostPortOrFile tests don't have any IPv6 tests. This adds some.
2. The HostPortOrFile breaks if any of the addresses have IPv6 zone
defined. ParseIP does not handle %zone anymore.
Signed-off-by: Brad P. Crochet <brad@redhat.com>
