mirror of
https://github.com/Control-D-Inc/ctrld.git
synced 2026-10-12 01:58:46 +02:00
Alex Paguis
6edce5f94f
The auto-added AD split rules route corp names to upstream.os, but a rule match returned before the LAN-query marking, so osResolver raced the domain controller against 76.76.2.0 and sent every AD lookup (DC hostnames, DC-locator SRV names carrying the machine name, WPAD) there in plaintext. Mark a matched query under the machine's AD domain whose upstreams are the OS resolver alone as a LAN query, which drops 76.76.2.0 for it.
48 lines
1.6 KiB
Go
48 lines
1.6 KiB
Go
package cli
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/Control-D-Inc/ctrld"
|
|
"github.com/Control-D-Inc/ctrld/internal/system"
|
|
)
|
|
|
|
// addExtraSplitDnsRule adds split DNS rule for domain if it's part of active directory.
|
|
func addExtraSplitDnsRule(cfg *ctrld.Config) bool {
|
|
domain, err := system.GetActiveDirectoryDomain()
|
|
if err != nil {
|
|
mainLog.Load().Debug().Msgf("Unable to get active directory domain: %v", err)
|
|
return false
|
|
}
|
|
if domain == "" {
|
|
mainLog.Load().Debug().Msg("No active directory domain found")
|
|
return false
|
|
}
|
|
// Network rules are lowercase during toml config marshaling,
|
|
// lowercase the domain here too for consistency.
|
|
domain = strings.ToLower(domain)
|
|
setActiveDirectoryDomain(domain)
|
|
domainRuleAdded := addSplitDnsRule(cfg, domain)
|
|
wildcardDomainRuleRuleAdded := addSplitDnsRule(cfg, "*."+strings.TrimPrefix(domain, "."))
|
|
return domainRuleAdded || wildcardDomainRuleRuleAdded
|
|
}
|
|
|
|
// addSplitDnsRule adds split-rule for given domain if there's no existed rule.
|
|
// The return value indicates whether the split-rule was added or not.
|
|
func addSplitDnsRule(cfg *ctrld.Config, domain string) bool {
|
|
for n, lc := range cfg.Listener {
|
|
if lc.Policy == nil {
|
|
lc.Policy = &ctrld.ListenerPolicyConfig{}
|
|
}
|
|
for _, rule := range lc.Policy.Rules {
|
|
if _, ok := rule[domain]; ok {
|
|
mainLog.Load().Debug().Msgf("Split-rule %q already existed for listener.%s", domain, n)
|
|
return false
|
|
}
|
|
}
|
|
mainLog.Load().Debug().Msgf("Adding split-rule %q for listener.%s", domain, n)
|
|
lc.Policy.Rules = append(lc.Policy.Rules, ctrld.Rule{domain: []string{}})
|
|
}
|
|
return true
|
|
}
|