summaryrefslogtreecommitdiffstats
path: root/src/knot/server/proxyv2.c
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--src/knot/server/proxyv2.c69
1 files changed, 69 insertions, 0 deletions
diff --git a/src/knot/server/proxyv2.c b/src/knot/server/proxyv2.c
new file mode 100644
index 0000000..ff92263
--- /dev/null
+++ b/src/knot/server/proxyv2.c
@@ -0,0 +1,69 @@
+/* Copyright (C) 2022 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include "knot/server/proxyv2.h"
+
+#include "contrib/proxyv2/proxyv2.h"
+#include "knot/conf/conf.h"
+
+int proxyv2_header_strip(knot_pkt_t **query,
+ const struct sockaddr_storage *remote,
+ struct sockaddr_storage *new_remote)
+{
+ conf_t *pconf = conf();
+ if (!pconf->cache.srv_proxy_enabled) {
+ return KNOT_EDENIED;
+ }
+
+ uint8_t *pkt = (*query)->wire;
+ size_t pkt_len = (*query)->max_size;
+
+ int offset = proxyv2_header_offset(pkt, pkt_len);
+ if (offset <= 0) {
+ return KNOT_EMALF;
+ }
+
+ /*
+ * Check if the query was sent from an IP address authorized to send
+ * proxied DNS traffic.
+ */
+ conf_val_t whitelist_val = conf_get(pconf, C_SRV, C_PROXY_ALLOWLIST);
+ if (!conf_addr_range_match(&whitelist_val, remote)) {
+ return KNOT_EDENIED;
+ }
+
+ /*
+ * Store the provided remote address.
+ */
+ int ret = proxyv2_addr_store(pkt, pkt_len, new_remote);
+ if (ret != KNOT_EOK) {
+ return ret;
+ }
+
+ /*
+ * Re-parse the query message using the data in the
+ * packet following the PROXY v2 payload. And replace the original
+ * query with the decapsulated one.
+ */
+ knot_pkt_t *q = knot_pkt_new(pkt + offset, pkt_len - offset, &(*query)->mm);
+ if (q == NULL) {
+ return KNOT_ENOMEM;
+ }
+ knot_pkt_free(*query);
+ *query = q;
+
+ return knot_pkt_parse(q, 0);
+}