CalvinBackup/ctrld
1
0
Fork 0
mirror of https://github.com/Control-D-Inc/ctrld.git synced 2026-08-10 13:20:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

Follow CNAME chain to find correct target

Browse Source 
To prevent abusive response from some malicious DNS server, ctrld
ignores the response if the target does not match question domain.
However, that would break CNAME chain, which is allowed the mismatch
happens.
This commit is contained in:
Cuong Manh Le
2023-08-09 22:40:51 +07:00
committed by Cuong Manh Le
parent ce35383341
commit e684c7d8c4
1 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
resolver.go
+17 -4
View File
@@ -159,15 +159,27 @@ func lookupIP(domain string, timeout int, withBootstrapDNS bool) (ips []string)
timeoutMs = timeout
}
questionDomain := dns.Fqdn(domain)
ipFromRecord := func(record dns.RR) string {
// Getting the real target domain name from CNAME if presents.
targetDomain := func(answers []dns.RR) string {
for _, a := range answers {
switch ar := a.(type) {
case *dns.CNAME:
return ar.Target
}
}
return questionDomain
}
// Getting ip address from A or AAAA record.
ipFromRecord := func(record dns.RR, target string) string {
switch ar := record.(type) {
case *dns.A:
if ar.Hdr.Name != questionDomain {
if ar.Hdr.Name != target {
return ""
}
return ar.A.String()
case *dns.AAAA:
if ar.Hdr.Name != questionDomain {
if ar.Hdr.Name != target {
return ""
}
return ar.AAAA.String()
@@ -195,8 +207,9 @@ func lookupIP(domain string, timeout int, withBootstrapDNS bool) (ips []string)
ProxyLog.Error().Msg("no answer from OS resolver")
return
}
target := targetDomain(r.Answer)
for _, a := range r.Answer {
if ip := ipFromRecord(a); ip != "" {
if ip := ipFromRecord(a, target); ip != "" {
ips = append(ips, ip)
}
}