Replicating some dnsmasq options in dnsdist lua

[karelbilek]

I needed to replicate certain dnsmasq options in dnsdist, because I want to run dnsdist as a local stub resolver

More concretely, I needed to implement (following by dnsmasq documentation):

• stop-dns-rebind

  Reject (and log) addresses from upstream nameservers which are in the private ranges. This blocks an attack where a browser behind a firewall is used to probe machines on the local network. For IPv6, the private range covers the IPv4-mapped addresses in private space plus all link-local (LL) and site-local (ULA) addresses.

• domain-needed

  Tells dnsmasq to never forward A or AAAA queries for plain names, without dots or domain parts, to upstream nameservers. If the name is not known from /etc/hosts or DHCP then a "not found" answer is returned.

• bogus-priv

  Bogus private reverse lookups. All reverse lookups for private IP ranges (ie 192.168.x.x, etc) which are not found in /etc/hosts or the DHCP leases file are answered with "no such domain" rather than being forwarded upstream. The set of prefixes affected is the list given in RFC6303, for IPv4 and IPv6. Enabling this also subtly alters DNSSEC validation for reverse lookups in the private ranges such that a non-secure DS record is accepted as proof that the range is not signed. This works around behaviour by the public DNS services which seem not to return validated proof-of-non-existence for DS records in these domains.

The way I replicated it - through lua functions - in file checks.lua. Note that the behaviour is a little different - the dns query just drops, doesn't return "not found".

checks={}

--- replicating `stop-dns-rebind` dnsmasq option
local parsers = {}
local recordTypes = {[1] = 'A', [28] = 'AAAA'}

function parsers.A(packet, pos, contentLength)
  if contentLength == 4 then
    return newCAFromRaw(packet:sub(pos, pos+3))
  end
end

function parsers.AAAA(packet, pos, contentLength)
  if contentLength == 16 then
    local ca6 = newCAFromRaw(packet:sub(pos, pos+15))
    if ca6:isMappedIPv4() then
      return ca6:mapToIPv4()
    end
    return ca6
  end
end

local privateNets = newNMG()
privateNets:addMask("127.0.0.0/8")         -- Loopback
privateNets:addMask("0.0.0.0/8")           -- Broadcast/"this" network
privateNets:addMask("10.0.0.0/8")          -- Private
privateNets:addMask("172.16.0.0/12")       -- Private
privateNets:addMask("192.168.0.0/16")      -- Private
privateNets:addMask("169.254.0.0/16")      -- Link-local/zeroconf
privateNets:addMask("192.0.2.0/24")        -- TEST-NET-1
privateNets:addMask("198.51.100.0/24")     -- TEST-NET-2
privateNets:addMask("203.0.113.0/24")      -- TEST-NET-3
privateNets:addMask("255.255.255.255/32")  -- Broadcast

privateNets:addMask("::/128")        -- Unspecified
privateNets:addMask("::1/128")       -- Loopback
privateNets:addMask("fe80::/10")     -- Link-local
privateNets:addMask("fd00::/8")      -- Unique local (ULA)
privateNets:addMask("2001:db8::/32") -- Documentation (test network)

local function isPrivateNetResponse(dr)
  local packet = dr:getContent()
  local overlay = newDNSPacketOverlay(packet)
  local count = overlay:getRecordsCountInSection(DNSSection.Answer)
  for i=0, count-1 do
    local record = overlay:getRecord(i)
    local parser = parsers[recordTypes[record.type]]
    if parser then
      local ca = parser(packet, record.contentOffset+1, record.contentLength)
      if ca == nil then
        return false
      end
      -- note: in case of embedded, this will print the IPv4 address
      if privateNets:match(ca) then
        warnlog("Private IP: "..ca:tostring()..", dropping")
        return true
      end
    end
  end
  return false
end

function checks.stopDnsRebind()
  addResponseAction(AndRule{RCodeRule(DNSRCode.NOERROR), LuaRule(isPrivateNetResponse)}, DropResponseAction(), {name = "stop-dns-rebind"})
end

--- replicating `domain-needed` dnsmasq option
function checks.domainNeeded()
  addAction(AndRule{OrRule{QTypeRule(DNSQType.A), QTypeRule(DNSQType.AAAA)}, RE2Rule('[^.]*')}, DropAction(), {name = "domain-needed"})
end

-- replicate `bogus-priv` dnsmasq option
local function reverseIpv4(domain)
  local lower = domain:lower()
  local suffix = "in-addr.arpa."
  local trimmed = domain:sub(1, -(#suffix+1))
  -- we cannot do gmatch with ^$
  local matches = trimmed:match("^(%d+)%.(%d+)%.(%d+)%.(%d+).$")
  if matches == nil then
    return ""
  end
  for a,b,c,d in trimmed:gmatch("(%d+)%.(%d+)%.(%d+)%.(%d+).") do
    return d.."."..c.."."..b.."."..a
  end
  return ""
end

local ip6match = string.rep("%x%.", 32)

local function reverseIpv6(domain)
  local lower = domain:lower()
  local suffix = "ip6.arpa."
  local trimmed = domain:sub(1, -(#suffix+1))
  local s = ""
  local i = 0
  local matches = trimmed:match(ip6match)
  if matches == nil then
    return ""
  end
  for a in trimmed:gmatch("(%x)%.") do
    i = i+1
    s = a..s
    if i==4 then
      i = 0
      s = ":"..s
    end
  end
  s = s:sub(2, -1)
  return s
end

local function isPrivateNetReverseIpv4(dr)
  local rev = reverseIpv4(dr.qname:toString())
  if rev == "" then
    return false
  end
  local ca = newCA(rev)
  if privateNets:match(ca) then
    warnlog("Private reverse IP4: "..ca:tostring()..", dropping")
    return true
  end
  return false
end

local function isPrivateNetReverseIpv6(dr)
  local rev = reverseIpv6(dr.qname:toString())
  if rev == "" then
    return false
  end
  local ca6 = newCA(rev)
  local ca = ca6
  if ca6:isMappedIPv4() then
    ca = ca6:mapToIPv4()
  end
  if privateNets:match(ca) then
    warnlog("Private reverse IP6: "..ca:tostring()..", dropping")
    return true
  end
  return false
end

function checks.bogusPriv()
  addAction(AndRule{QNameSuffixRule("in-addr.arpa."), LuaRule(isPrivateNetReverseIpv4)}, DropAction(), {name = "bogus-priv ipv4"})
  addAction(AndRule{QNameSuffixRule("ip6.arpa."), LuaRule(isPrivateNetReverseIpv6)}, DropAction(), {name = "bogus-priv ipv6"})
end

return checks

The lua is then loaded and run in config

local checks = dofile("<file address here>");

-- replicating dnsmasq options
checks.stopDnsRebind()
checks.domainNeeded()
checks.bogusPriv()

(note that for copyright, I have been looking at dnsmasq code for implementing this and getting some ideas from there, so this can be seen as being derivative of dnsmasq code, I am not a lawyer)

You might want to remove the warnlogs if you run this in production, depending on your setup.

[karelbilek]

I think in 2.1.0, parseARecord should be used instead of the custom parsing code; it's a while since I wrote it.