any-to-tcp now feature complete & documented

diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc
index 6cb90fd941e247fe71dde051d7df2ca07a1c09b5..bed9191302360b296f4197d50c590b0cc5111920 100644 (file)
--- a/pdns/common_startup.cc
+++ b/pdns/common_startup.cc
@@ -16,7 +16,7 @@
     Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 */
 #include "common_startup.hh"
-
+bool g_anyToTcp;
 typedef Distributor<DNSPacket,DNSPacket,PacketHandler> DNSDistributor;
 
 
@@ -30,7 +30,7 @@ UDPNameserver *N;
 int avg_latency;
 TCPNameserver *TN;
 
-bool g_anyToTCP;
+
 
 ArgvMap &arg()
 {
@@ -102,6 +102,7 @@ void declareArguments()
   ::arg().setSwitch("webserver","Start a webserver for monitoring")="no"; 
   ::arg().setSwitch("webserver-print-arguments","If the webserver should print arguments")="no"; 
   ::arg().setSwitch("edns-subnet-processing","If we should act on EDNS Subnet options")="no"; 
+  ::arg().setSwitch("any-to-tcp","Answer ANY queries with tc=1, shunting to TCP")="no"; 
   ::arg().set("edns-subnet-option-number","EDNS option number to use")="20730"; 
   ::arg().set("webserver-address","IP Address of webserver to listen on")="127.0.0.1";
   ::arg().set("webserver-port","Port of webserver to listen on")="8081";
@@ -331,12 +332,11 @@ void mainthread()
    int newuid=0;      
    if(!::arg()["setuid"].empty())        
      newuid=Utility::makeUidNumeric(::arg()["setuid"]); 
-     
    
+   g_anyToTcp = ::arg().mustDo("any-to-tcp");
    DNSPacket::s_doEDNSSubnetProcessing = ::arg().mustDo("edns-subnet-processing");
-     
+   
 #ifndef WIN32
-
    if(!::arg()["chroot"].empty()) {  
      if(::arg().mustDo("master") || ::arg().mustDo("slave"))
         gethostbyname("a.root-servers.net"); // this forces all lookup libraries to be loaded
@@ -348,6 +348,7 @@ void mainthread()
        L<<Logger::Error<<"Chrooted to '"<<::arg()["chroot"]<<"'"<<endl;      
    }  
 #endif
+
   StatWebServer sws;
   Utility::dropPrivs(newuid, newgid);
 

diff --git a/pdns/common_startup.hh b/pdns/common_startup.hh
index 6fcf28f0a2d0afe9584f762c7523c6cdc52505df..7138849417a5e1524551afe4cce3f6b469819ddb 100644 (file)
--- a/pdns/common_startup.hh
+++ b/pdns/common_startup.hh
@@ -43,12 +43,12 @@ extern CommunicatorClass Communicator;
 extern UDPNameserver *N;
 extern int avg_latency;
 extern TCPNameserver *TN;
-
-
 extern ArgvMap & arg( void );
 extern void declareArguments();
 extern void declareStats();
 extern void mainthread();
 extern int isGuarded( char ** );
 
+extern bool g_anyToTcp;
+
 #endif // COMMON_STARTUP_HH

diff --git a/pdns/docs/pdns.xml b/pdns/docs/pdns.xml
index 598fef7b311f81383dda314ede2e4ba0932054a0..42ee10a783062ac778059713c921726f6a1f7c7d 100644 (file)
--- a/pdns/docs/pdns.xml
+++ b/pdns/docs/pdns.xml
@@ -14547,6 +14547,11 @@ To enable a Lua script for a particular slave zone, determine the domain_id for
              recursion from everywhere. Example: <command>allow-recursion=192.168.0.0/24, 10.0.0.0/8, 1.2.3.4</command>.
            </para>
          </listitem></varlistentry>
+         <varlistentry><term>any-to-tcp | any-to-tcp=yes | any-to-tcp=no</term>
+           <listitem><para>
+               Answer questions for the ANY type on UDP with a truncated packet that refers the 
+               remote server to TCP. Useful for mitigating ANY reflection attacks. Defaults to off. Available since 3.3.
+             </para></listitem></varlistentry>
          <varlistentry><term>cache-ttl=...</term>
            <listitem><para>
                Seconds to store packets in the PacketCache. See <xref linkend="packetcache"/>.

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 8f8d1ef4e664aadb78e5091615be7e9b3c324c2c..ba5165768596be59875f1666d2e4d1f852253318 100644 (file)
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -38,17 +38,13 @@
 #include "communicator.hh"
 #include "dnsproxy.hh"
 #include "version.hh"
+#include "common_startup.hh"
 
 #if 0
 #undef DLOG
 #define DLOG(x) x
 #endif 
-
-extern StatBag S;
-extern PacketCache PC;  
-extern CommunicatorClass Communicator;
-extern DNSProxy *DP;
-
+ 
 AtomicCounter PacketHandler::s_count;
 extern string s_programname;
 
@@ -1165,7 +1161,7 @@ DNSPacket *PacketHandler::questionOrRecurse(DNSPacket *p, bool *shouldRecurse)
       return r; 
     }
 
-    L<<Logger::Warning<<"Query for '"<<p->qdomain<<"' "<<p->qtype.getName()<<" from "<<p->getRemote()<<endl;
+    // L<<Logger::Warning<<"Query for '"<<p->qdomain<<"' "<<p->qtype.getName()<<" from "<<p->getRemote()<< " (tcp="<<p->d_tcp<<")"<<endl;
     
     r->d.ra = (p->d.rd && d_doRecursion && DP->recurseFor(p));  // make sure we set ra if rd was set, and we'll do it
 
@@ -1185,8 +1181,7 @@ DNSPacket *PacketHandler::questionOrRecurse(DNSPacket *p, bool *shouldRecurse)
     if(doVersionRequest(p,r,target)) // catch version.bind requests
       goto sendit;
 
-    if(p->qtype.getCode() == QType::ANY) {
-      cerr<<"Shunted it to TCP.."<<endl;
+    if(p->qtype.getCode() == QType::ANY && !p->d_tcp && g_anyToTcp) {
       r->d.tc = 1;
       r->commitD();
       return r;

diff --git a/pdns/pdns.conf-dist b/pdns/pdns.conf-dist
index 1da5da19a5015b6c9e853d5a9b386bd63b9b2485..a3e10c0c53e4179a5894dd3017c7f3451e11cb36 100644 (file)
--- a/pdns/pdns.conf-dist
+++ b/pdns/pdns.conf-dist
@@ -9,6 +9,11 @@
 #
 # allow-recursion=0.0.0.0/0
 
+#################################
+# any-to-tcp   Answer ANY queries with tc=1, shunting to TCP
+#
+# any-to-tcp=no
+
 #################################
 # cache-ttl    Seconds to store packets in the PacketCache
 #