ead84e1fa8
Both block and filter actions write responses to the client based upon the source IP address of the UDP packet containing the query. An attacker spoofing the source IP address to that of their target, can elicit a response to be sent to the victim host, known as DNS Reflection. If an attacker is able to elicit a large response from a relatively small query, with a spoofed source IP address, they are able to increase the amount of data sent to the victim, known as DNS Amplification. Scaling this from one to many queries allows an attacker to perform an effective Denial of Service (DoS) attack against their target. Adding the drop action enables CoreDNS to ignore queries of a given type or network range from being processed and a response written, where an operator knows ahead of time, should not originate or be destined to. Signed-off-by: rsclarke <hey@rsclarke.dev> Signed-off-by: rsclarke <hey@rsclarke.dev>
39 lines
1.4 KiB
Go
39 lines
1.4 KiB
Go
package acl
|
|
|
|
import (
|
|
"github.com/coredns/coredns/plugin"
|
|
|
|
"github.com/prometheus/client_golang/prometheus"
|
|
"github.com/prometheus/client_golang/prometheus/promauto"
|
|
)
|
|
|
|
var (
|
|
// RequestBlockCount is the number of DNS requests being blocked.
|
|
RequestBlockCount = promauto.NewCounterVec(prometheus.CounterOpts{
|
|
Namespace: plugin.Namespace,
|
|
Subsystem: pluginName,
|
|
Name: "blocked_requests_total",
|
|
Help: "Counter of DNS requests being blocked.",
|
|
}, []string{"server", "zone", "view"})
|
|
// RequestFilterCount is the number of DNS requests being filtered.
|
|
RequestFilterCount = promauto.NewCounterVec(prometheus.CounterOpts{
|
|
Namespace: plugin.Namespace,
|
|
Subsystem: pluginName,
|
|
Name: "filtered_requests_total",
|
|
Help: "Counter of DNS requests being filtered.",
|
|
}, []string{"server", "zone", "view"})
|
|
// RequestAllowCount is the number of DNS requests being Allowed.
|
|
RequestAllowCount = promauto.NewCounterVec(prometheus.CounterOpts{
|
|
Namespace: plugin.Namespace,
|
|
Subsystem: pluginName,
|
|
Name: "allowed_requests_total",
|
|
Help: "Counter of DNS requests being allowed.",
|
|
}, []string{"server", "view"})
|
|
// RequestDropCount is the number of DNS requests being dropped.
|
|
RequestDropCount = promauto.NewCounterVec(prometheus.CounterOpts{
|
|
Namespace: plugin.Namespace,
|
|
Subsystem: pluginName,
|
|
Name: "dropped_requests_total",
|
|
Help: "Counter of DNS requests being dropped.",
|
|
}, []string{"server", "zone", "view"})
|
|
)
|