From 9ba32868bb4278ab1c984e09642e17e40e20d40d Mon Sep 17 00:00:00 2001 From: Remi Gacogne Date: Wed, 15 May 2019 15:23:05 +0200 Subject: [PATCH] dnsdist: Add documentation, completion and tests for our HTTP rules --- pdns/dnsdist-console.cc | 2 + pdns/dnsdistdist/docs/rules-actions.rst | 15 +++++ regression-tests.dnsdist/test_DOH.py | 86 ++++++++++++++++++++++++- 3 files changed, 101 insertions(+), 2 deletions(-) diff --git a/pdns/dnsdist-console.cc b/pdns/dnsdist-console.cc index 98bd43c9c..aa60c82e0 100644 --- a/pdns/dnsdist-console.cc +++ b/pdns/dnsdist-console.cc @@ -397,6 +397,8 @@ const std::vector g_consoleKeywords{ { "getServers", true, "", "returns a table with all defined servers" }, { "getTLSContext", true, "n", "returns the TLS context with index n" }, { "getTLSFrontend", true, "n", "returns the TLS frontend with index n" }, + { "HTTPHeaderRule", true, "name, regex", "matches DoH queries with a HTTP header 'name' whose content matches the regular expression 'regex'"}, + { "HTTPPathRule", true, "path", "matches DoH queries whose HTTP path is an exact match to 'path'"}, { "inClientStartup", true, "", "returns true during console client parsing of configuration" }, { "grepq", true, "Netmask|DNS Name|100ms|{\"::1\", \"powerdns.com\", \"100ms\"} [, n]", "shows the last n queries and responses matching the specified client address or range (Netmask), or the specified DNS Name, or slower than 100ms" }, { "leastOutstanding", false, "", "Send traffic to downstream server with least outstanding queries, with the lowest 'order', and within that the lowest recent latency"}, diff --git a/pdns/dnsdistdist/docs/rules-actions.rst b/pdns/dnsdistdist/docs/rules-actions.rst index a0d1e38b5..4bb6957a9 100644 --- a/pdns/dnsdistdist/docs/rules-actions.rst +++ b/pdns/dnsdistdist/docs/rules-actions.rst @@ -585,6 +585,21 @@ These ``DNSRule``\ s be one of the following items: :param int rcode: The RCODE to match on +.. function:: HTTPHeaderRule(name, regex) + .. versionadded:: 1.4.0 + + Matches DNS over HTTPS queries with a HTTP header ``name`` whose content matches the regular expression ``regex``. + + :param str name: The case-insensitive name of the HTTP header to match on + :param str regex: A regular expression to match the content of the specified header + +.. function:: HTTPPathRule(path) + .. versionadded:: 1.4.0 + + Matches DNS over HTTPS queries with a HTTP path of ``path``. For example, if the query has been sent to the https://192.0.2.1:443/PowerDNS?dns=... URL, the path would be '/PowerDNS'. + + :param str path: The exact HTTP path to match on + .. function:: MaxQPSIPRule(qps[, v4Mask[, v6Mask[, burst[, expiration[, cleanupDelay[, scanFraction]]]]]]) .. versionchanged:: 1.3.1 Added the optional parameters ``expiration``, ``cleanupDelay`` and ``scanFraction``. diff --git a/regression-tests.dnsdist/test_DOH.py b/regression-tests.dnsdist/test_DOH.py index dead5b024..4943c96ec 100644 --- a/regression-tests.dnsdist/test_DOH.py +++ b/regression-tests.dnsdist/test_DOH.py @@ -30,7 +30,7 @@ class DNSDistDOHTest(DNSDistTest): return conn @classmethod - def sendDOHQuery(cls, port, servername, baseurl, query, response=None, timeout=2.0, caFile=None, useQueue=True, rawQuery=False): + def sendDOHQuery(cls, port, servername, baseurl, query, response=None, timeout=2.0, caFile=None, useQueue=True, rawQuery=False, customHeaders=[]): url = cls.getDOHGetURL(baseurl, query, rawQuery) conn = cls.openDOHConnection(port, caFile=caFile, timeout=timeout) #conn.setopt(pycurl.VERBOSE, True) @@ -38,6 +38,7 @@ class DNSDistDOHTest(DNSDistTest): conn.setopt(pycurl.RESOLVE, ["%s:%d:127.0.0.1" % (servername, port)]) conn.setopt(pycurl.SSL_VERIFYPEER, 1) conn.setopt(pycurl.SSL_VERIFYHOST, 2) + conn.setopt(pycurl.HTTPHEADER, customHeaders) if caFile: conn.setopt(pycurl.CAINFO, caFile) @@ -136,6 +137,8 @@ class TestDOH(DNSDistDOHTest): addAction("drop.doh.tests.powerdns.com.", DropAction()) addAction("refused.doh.tests.powerdns.com.", RCodeAction(DNSRCode.REFUSED)) addAction("spoof.doh.tests.powerdns.com.", SpoofAction("1.2.3.4")) + addAction(HTTPHeaderRule("X-PowerDNS", "^[a]{5}$"), SpoofAction("2.3.4.5")) + addAction(HTTPPathRule("/PowerDNS"), SpoofAction("3.4.5.6")) """ _config_params = ['_testServerPort', '_dohServerPort', '_serverCert', '_serverKey'] @@ -247,7 +250,6 @@ class TestDOH(DNSDistDOHTest): name = 'drop.doh.tests.powerdns.com.' query = dns.message.make_query(name, 'A', 'IN') (_, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, caFile=self._caCert, query=query, response=None, useQueue=False) - print(receivedResponse) self.assertEquals(receivedResponse, None) def testRefused(self): @@ -360,6 +362,86 @@ class TestDOH(DNSDistDOHTest): self.checkQueryEDNSWithoutECS(expectedQuery, receivedQuery) self.assertEquals(response, receivedResponse) + def testHeaderRule(self): + """ + DOH: HeaderRule + """ + name = 'header-rule.doh.tests.powerdns.com.' + query = dns.message.make_query(name, 'A', 'IN') + query.id = 0 + query.flags &= ~dns.flags.RD + expectedResponse = dns.message.make_response(query) + rrset = dns.rrset.from_text(name, + 3600, + dns.rdataclass.IN, + dns.rdatatype.A, + '2.3.4.5') + expectedResponse.answer.append(rrset) + + # this header should match + (_, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, caFile=self._caCert, query=query, response=None, useQueue=False, customHeaders=['x-powerdnS: aaaaa']) + self.assertEquals(receivedResponse, expectedResponse) + + expectedQuery = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=4096) + expectedQuery.flags &= ~dns.flags.RD + expectedQuery.id = 0 + response = dns.message.make_response(query) + rrset = dns.rrset.from_text(name, + 3600, + dns.rdataclass.IN, + dns.rdatatype.A, + '127.0.0.1') + response.answer.append(rrset) + + # this content of the header should NOT match + (receivedQuery, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL, query, response=response, caFile=self._caCert, customHeaders=['x-powerdnS: bbbbb']) + self.assertTrue(receivedQuery) + self.assertTrue(receivedResponse) + receivedQuery.id = expectedQuery.id + self.assertEquals(expectedQuery, receivedQuery) + self.checkQueryEDNSWithoutECS(expectedQuery, receivedQuery) + self.assertEquals(response, receivedResponse) + + def testHTTPPath(self): + """ + DOH: HTTPPath + """ + name = 'http-path.doh.tests.powerdns.com.' + query = dns.message.make_query(name, 'A', 'IN') + query.id = 0 + query.flags &= ~dns.flags.RD + expectedResponse = dns.message.make_response(query) + rrset = dns.rrset.from_text(name, + 3600, + dns.rdataclass.IN, + dns.rdatatype.A, + '3.4.5.6') + expectedResponse.answer.append(rrset) + + # this path should match + (_, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL + 'PowerDNS', caFile=self._caCert, query=query, response=None, useQueue=False) + self.assertEquals(receivedResponse, expectedResponse) + + expectedQuery = dns.message.make_query(name, 'A', 'IN', use_edns=True, payload=4096) + expectedQuery.id = 0 + expectedQuery.flags &= ~dns.flags.RD + response = dns.message.make_response(query) + rrset = dns.rrset.from_text(name, + 3600, + dns.rdataclass.IN, + dns.rdatatype.A, + '127.0.0.1') + response.answer.append(rrset) + + # this path should NOT match + (receivedQuery, receivedResponse) = self.sendDOHQuery(self._dohServerPort, self._serverName, self._dohBaseURL + "PowerDNS2", query, response=response, caFile=self._caCert) + self.assertTrue(receivedQuery) + self.assertTrue(receivedResponse) + receivedQuery.id = expectedQuery.id + self.assertEquals(expectedQuery, receivedQuery) + self.checkQueryEDNSWithoutECS(expectedQuery, receivedQuery) + self.assertEquals(response, receivedResponse) + class TestDOHAddingECS(DNSDistDOHTest): _serverKey = 'server.key' -- 2.40.0