1 /*
2 * This file is part of PowerDNS or dnsdist.
3 * Copyright -- PowerDNS.COM B.V. and its contributors
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of version 2 of the GNU General Public License as
7 * published by the Free Software Foundation.
8 *
9 * In addition, for the avoidance of any doubt, permission is granted to
10 * link this program with OpenSSL and to (re)distribute the binaries
11 * produced as the result of such linking.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 */
22
23 #include "dnsdist-proxy-protocol.hh"
24 #include "dolog.hh"
25
26 NetmaskGroup g_proxyProtocolACL;
27 size_t g_proxyProtocolMaximumSize = 512;
28 bool g_applyACLToProxiedClients = false;
29
getProxyProtocolPayload(const DNSQuestion & dq)30 std::string getProxyProtocolPayload(const DNSQuestion& dq)
31 {
32 return makeProxyHeader(dq.tcp, *dq.remote, *dq.local, dq.proxyProtocolValues ? *dq.proxyProtocolValues : std::vector<ProxyProtocolValue>());
33 }
34
addProxyProtocol(DNSQuestion & dq,const std::string & payload)35 bool addProxyProtocol(DNSQuestion& dq, const std::string& payload)
36 {
37 if (!dq.hasRoomFor(payload.size())) {
38 return false;
39 }
40
41 return addProxyProtocol(dq.getMutableData(), payload);
42 }
43
addProxyProtocol(DNSQuestion & dq)44 bool addProxyProtocol(DNSQuestion& dq)
45 {
46 auto payload = getProxyProtocolPayload(dq);
47 return addProxyProtocol(dq, payload);
48 }
49
addProxyProtocol(PacketBuffer & buffer,const std::string & payload)50 bool addProxyProtocol(PacketBuffer& buffer, const std::string& payload)
51 {
52 auto previousSize = buffer.size();
53 if (payload.size() > (std::numeric_limits<size_t>::max() - previousSize)) {
54 return false;
55 }
56
57 buffer.insert(buffer.begin(), payload.begin(), payload.end());
58
59 return true;
60 }
61
addProxyProtocol(PacketBuffer & buffer,bool tcp,const ComboAddress & source,const ComboAddress & destination,const std::vector<ProxyProtocolValue> & values)62 bool addProxyProtocol(PacketBuffer& buffer, bool tcp, const ComboAddress& source, const ComboAddress& destination, const std::vector<ProxyProtocolValue>& values)
63 {
64 auto payload = makeProxyHeader(tcp, source, destination, values);
65 return addProxyProtocol(buffer, payload);
66 }
67
expectProxyProtocolFrom(const ComboAddress & remote)68 bool expectProxyProtocolFrom(const ComboAddress& remote)
69 {
70 return g_proxyProtocolACL.match(remote);
71 }
72
handleProxyProtocol(const ComboAddress & remote,bool isTCP,const NetmaskGroup & acl,PacketBuffer & query,ComboAddress & realRemote,ComboAddress & realDestination,std::vector<ProxyProtocolValue> & values)73 bool handleProxyProtocol(const ComboAddress& remote, bool isTCP, const NetmaskGroup& acl, PacketBuffer& query, ComboAddress& realRemote, ComboAddress& realDestination, std::vector<ProxyProtocolValue>& values)
74 {
75 bool tcp;
76 bool proxyProto;
77
78 ssize_t used = parseProxyHeader(query, proxyProto, realRemote, realDestination, tcp, values);
79 if (used <= 0) {
80 ++g_stats.proxyProtocolInvalid;
81 vinfolog("Ignoring invalid proxy protocol (%d, %d) query over %s from %s", query.size(), used, (isTCP ? "TCP" : "UDP"), remote.toStringWithPort());
82 return false;
83 }
84 else if (static_cast<size_t>(used) > g_proxyProtocolMaximumSize) {
85 vinfolog("Proxy protocol header in %s packet from %s is larger than proxy-protocol-maximum-size (%d), dropping", (isTCP ? "TCP" : "UDP"), remote.toStringWithPort(), used);
86 ++g_stats.proxyProtocolInvalid;
87 return false;
88 }
89
90 query.erase(query.begin(), query.begin() + used);
91
92 /* on TCP we have not read the actual query yet */
93 if (!isTCP && query.size() < sizeof(struct dnsheader)) {
94 ++g_stats.nonCompliantQueries;
95 return false;
96 }
97
98 if (proxyProto && g_applyACLToProxiedClients) {
99 if (!acl.match(realRemote)) {
100 vinfolog("Query from %s dropped because of ACL", realRemote.toStringWithPort());
101 ++g_stats.aclDrops;
102 return false;
103 }
104 }
105
106 return true;
107 }
108