{ "showVersion", true, "", "show the current version" },
{ "shutdown", true, "", "shut down `dnsdist`" },
{ "SkipCacheAction", true, "", "Don’t lookup the cache for this query, don’t store the answer" },
+ { "SNIRule", true, "name", "Create a rule which matches on the incoming TLS SNI value, if any (DoT or DoH)" },
{ "snmpAgent", true, "enableTraps [, masterSocket]", "enable `SNMP` support. `enableTraps` is a boolean indicating whether traps should be sent and `masterSocket` an optional string specifying how to connect to the master agent"},
{ "SNMPTrapAction", true, "[reason]", "send an SNMP trap, adding the optional `reason` string as the query description"},
{ "SNMPTrapResponseAction", true, "[reason]", "send an SNMP trap, adding the optional `reason` string as the response description"},
});
#endif
+ g_lua.writeFunction("SNIRule", [](const std::string& name) {
+ return std::shared_ptr<DNSRule>(new SNIRule(name));
+ });
+
g_lua.writeFunction("SuffixMatchNodeRule", [](const SuffixMatchNode& smn, boost::optional<bool> quiet) {
return std::shared_ptr<DNSRule>(new SuffixMatchNodeRule(smn, quiet ? *quiet : false));
});
DNSName qname(query, state->d_querySize, sizeof(dnsheader), false, &qtype, &qclass, &consumed);
DNSQuestion dq(&qname, qtype, qclass, consumed, &state->d_ids.origDest, &state->d_ci.remote, reinterpret_cast<dnsheader*>(query), state->d_buffer.size(), state->d_querySize, true, &queryRealTime);
dq.dnsCryptQuery = std::move(dnsCryptQuery);
+ dq.sni = state->d_handler.getServerNameIndication();
state->d_isXFR = (dq.qtype == QType::AXFR || dq.qtype == QType::IXFR);
if (state->d_isXFR) {
#endif
Netmask ecs;
boost::optional<Netmask> subnet;
+ std::string sni; /* Server Name Indication, if any (DoT or DoH) */
const DNSName* qname{nullptr};
const ComboAddress* local{nullptr};
const ComboAddress* remote{nullptr};
};
#endif
+class SNIRule : public DNSRule
+{
+public:
+ SNIRule(const std::string& name) : d_sni(name)
+ {
+ }
+ bool matches(const DNSQuestion* dq) const override
+ {
+ return dq->sni == d_sni;
+ }
+ string toString() const override
+ {
+ return "SNI == " + d_sni;
+ }
+private:
+ std::string d_sni;
+};
+
class SuffixMatchNodeRule : public DNSRule
{
public:
:param str regex: The regular expression to match the QNAME.
+.. function:: SNIRule(name)
+ .. versionadded:: 1.4.0
+
+ Matches against the TLS Server Name Indication value sent by the client, if any. Only makes
+ sense for DoT or DoH, and for that last one matching on the HTTP Host header might provide
+ more consistent results.
+
+ :param str name: The exact SNI name to match.
+
.. function:: SuffixMatchNodeRule(smn[, quiet])
Matches based on a group of domain suffixes for rapid testing of membership.
return got;
}
+
void close() override
{
if (d_conn) {
}
}
+ std::string getServerNameIndication()
+ {
+ if (d_conn) {
+ const char* value = SSL_get_servername(d_conn.get(), TLSEXT_NAMETYPE_host_name);
+ if (value) {
+ return std::string(value);
+ }
+ }
+ return std::string();
+ }
+
private:
std::unique_ptr<SSL, void(*)(SSL*)> d_conn;
unsigned int d_timeout;
return got;
}
+ std::string getServerNameIndication()
+ {
+ if (d_conn) {
+ unsigned int type;
+ size_t name_len = 256;
+ std::string sni;
+ sni.resize(name_len);
+
+ int res = gnutls_server_name_get(d_conn.get(), const_cast<char*>(sni.c_str()), &name_len, &type, 0);
+ if (res == GNUTLS_E_SUCCESS) {
+ sni.resize(name_len);
+ return sni;
+ }
+ }
+ return std::string();
+ }
+
void close() override
{
if (d_conn) {
virtual size_t write(const void* buffer, size_t bufferSize, unsigned int writeTimeout) = 0;
virtual IOState tryWrite(std::vector<uint8_t>& buffer, size_t& pos, size_t toWrite) = 0;
virtual IOState tryRead(std::vector<uint8_t>& buffer, size_t& pos, size_t toRead) = 0;
+ virtual std::string getServerNameIndication() = 0;
virtual void close() = 0;
protected:
}
}
+ std::string getServerNameIndication()
+ {
+ if (d_conn) {
+ return d_conn->getServerNameIndication();
+ }
+ return std::string();
+ }
+
private:
std::unique_ptr<TLSConnection> d_conn{nullptr};
int d_socket{-1};
[custom_extensions]
basicConstraints = CA:true
keyUsage = cRLSign, keyCertSign
+
+[CA_default]
+copy_extensions = copy
encrypt_key = no
prompt = no
distinguished_name = server_distinguished_name
+req_extensions = v3_req
[server_distinguished_name]
CN = tls.tests.dnsdist.org
OU = PowerDNS.com BV
countryName = NL
+[v3_req]
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = tls.tests.dnsdist.org
+DNS.2 = powerdns.com
# Generate a new server certificate request
openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr -config configServer.conf
# Sign the server cert
-openssl x509 -req -days 1 -CA ca.pem -CAkey ca.key -CAcreateserial -in server.csr -out server.pem
+openssl x509 -req -days 1 -CA ca.pem -CAkey ca.key -CAcreateserial -in server.csr -out server.pem -extfile configServer.conf -extensions v3_req
# Generate a chain
cat server.pem ca.pem > server.chain
_config_template = """
newServer{address="127.0.0.1:%s"}
addTLSLocal("127.0.0.1:%s", "%s", "%s")
+ addAction(SNIRule("powerdns.com"), SpoofAction("1.2.3.4"))
"""
_config_params = ['_testServerPort', '_tlsServerPort', '_serverCert', '_serverKey']
receivedQuery.id = query.id
self.assertEquals(query, receivedQuery)
self.assertEquals(response, receivedResponse)
+
+ def testTLSSNIRouting(self):
+ """
+ TLS: SNI Routing
+ """
+ name = 'sni.tls.tests.powerdns.com.'
+ query = dns.message.make_query(name, 'A', 'IN', use_edns=False)
+ query.flags &= ~dns.flags.RD
+ response = dns.message.make_response(query)
+ rrset = dns.rrset.from_text(name,
+ 3600,
+ dns.rdataclass.IN,
+ dns.rdatatype.A,
+ '127.0.0.1')
+ response.answer.append(rrset)
+ expectedResponse = dns.message.make_response(query)
+ rrset = dns.rrset.from_text(name,
+ 3600,
+ dns.rdataclass.IN,
+ dns.rdatatype.A,
+ '1.2.3.4')
+ expectedResponse.answer.append(rrset)
+
+ # this SNI should match so we should get a spoofed answer
+ conn = self.openTLSConnection(self._tlsServerPort, 'powerdns.com', self._caCert)
+
+ self.sendTCPQueryOverConnection(conn, query, response=None)
+ receivedResponse = self.recvTCPResponseOverConnection(conn, useQueue=False)
+ self.assertTrue(receivedResponse)
+ self.assertEquals(expectedResponse, receivedResponse)
+
+ # this one should not
+ conn = self.openTLSConnection(self._tlsServerPort, self._serverName, self._caCert)
+
+ self.sendTCPQueryOverConnection(conn, query, response=response)
+ (receivedQuery, receivedResponse) = self.recvTCPResponseOverConnection(conn, useQueue=True)
+ self.assertTrue(receivedQuery)
+ self.assertTrue(receivedResponse)
+ receivedQuery.id = query.id
+ self.assertEquals(query, receivedQuery)
+ self.assertEquals(response, receivedResponse)
projects / thirdparty / pdns.git / commitdiff
