[dnsdist] Spoof a query reply based on original reply content

[gjherbiet]

Hello,

I am trying to change (spoof) the reply of a DNS query based on the content of the reply.
E.g. if the reply contains any of the IPv4 of example.com, I'd like to change those values to an IPv4 of my choice.

This is where I am at so far:

-- Spoof replies containing one of the `example.com` IPs
-- for the specific subnet to host redirect pages on another server
setVerbose(true)

-- Allow a query to be restarted later by keeping
-- a copy of it
-- see: https://www.dnsdist.org/reference/dq.html#DNSResponse:restart
function makeQueryRestartable(dq)
	print("Making query restartable")
	dq:setRestartable()
	return DNSAction.None
end

-- see: https://www.dnsdist.org/reference/dnsparser.html
-- see: https://www.dnsdist.org/reference/comboaddress.html
-- see: https://github.com/PowerDNS/pdns/issues/6759
local parsers = {};
local recordTypes = {[1] = 'A', [28] = 'AAAA'};
local exampleHosts = newNMG()
exampleHosts:addMask("96.7.128.175/32")
exampleHosts:addMask("96.7.128.198/32")
exampleHosts:addMask("23.192.228.80/32")
exampleHosts:addMask("23.192.228.84/32")
exampleHosts:addMask("23.215.0.136/32")
exampleHosts:addMask("23.215.0.138/32")

-- Parse A records as IPv4
function parsers.A(packet, pos, contentLength)
	if contentLength == 4 then
		return newCAFromRaw(packet:sub(pos, pos+3))
	end
end
-- Parse AAAA records as IPv6
function parsers.AAAA(packet, pos, contentLength)
	if contentLength == 16 then
		local ca6 = newCAFromRaw(packet:sub(pos, pos+15))
		if ca6:isMappedIPv4() then
			return ca6:mapToIPv4()
		end
		return ca6
	end
end

-- Test is reply is "spoofable" (i.e. contains one of the IPs of `example.com`)
function isReplySpoofable(dr)
	local packet = dr:getContent()
	local overlay = newDNSPacketOverlay(packet)
	local count = overlay:getRecordsCountInSection(DNSSection.Answer)
	for idx=0, count-1 do
		local record = overlay:getRecord(idx)
		local parser = parsers[recordTypes[record.type]]
		if parser then
			local ca = parser(packet, record.contentOffset+1, record.contentLength)
			print("Record "..idx.." value: "..ca:tostring())
			if exampleHosts:match(ca) then
				return true
			end
		end
	end
	return false
end

-- Restart spoofable queries with the "spoofed" tag set
function restartSpoofableQuery(dr)
	print("Testing if query shall be spoofed")
	if (dr:getTag("spoofed") == "" and isReplySpoofable(dr)) then
		print("Reply shall be spoofed")
		dr:setTag("spoofed", "true")
		dr:restart()
	end
	return DNSAction.None
end

-- Print if a query is spoofed
function printSpoofedQuery(dq)
	print("Query has been spoofed")
	return DNSAction.None
end

-- Make "spoofable" queries restartable
addAction(
	AndRule({
		OrRule({QTypeRule(DNSQType.A), QTypeRule(DNSQType.AAAA)}),
		NotRule(TagRule("spoofed")),
	}),
	LuaAction(makeQueryRestartable)
)

-- Spoof restarted queries with the "spoofed" tag set
addAction(TagRule("spoofed"), LuaAction(printSpoofedQuery))
addAction(TagRule("spoofed"), SpoofAction({"192.0.2.42", "2001:db8::42"}))

-- Check if query shall be restarted to be spoofed
addResponseAction(
	OrRule({QTypeRule(DNSQType.A), QTypeRule(DNSQType.AAAA)}),
	LuaResponseAction(restartSpoofableQuery)
)

From logs in verbose mode I can see that:

• queries are made restartable
• replies are correctly tested to be spoofed

dnsdist[97811]: Got query for example.com|A from [...]:61937, relayed to XXX ([...]:53)
dnsdist[97811]: Testing if query shall be spoofed
dnsdist[97811]: Record 0 value: 96.7.128.175
dnsdist[97811]: Reply shall be spoofed
dnsdist[97811]: Got answer from [...]:53, relayed to [...]:61937 (UDP), took 30403.6 us

However, it seems the "restarted" queries (normally tagged with "spoofed") are not catched by the two addAction(TagRule("spoofed"), ...) rules.

What am I missing/doing wrong?

[rgacogne]

This looks very similar to #14795, and what happens is that restarted queries do not go through the "query" rules again.

[gjherbiet]

You are indeed right. Sorry for not finding the related issue myself.

As I don’t want to add actual caching at the dnsdist level, any recommendation on how to add a "dummy" cache (enough to be able to call addCacheMissAction on the current pool but not actually caching anything)?

[gjherbiet]

I defined the packet cache as such:

pc = newPacketCache(20, {maxTTL=0})
getPool(''):setCache(pc)

Setting a cache with size 0 raises an error and with values lower than 20 I had a message about the number of "shards" being reduced.

With maxTTL=0, I suppose no record will ever be cached...

Using:

addCacheMissAction(TagRule("spoofed"), LuaAction(printSpoofedQuery))
addCacheMissAction(TagRule("spoofed"), SpoofAction({"192.0.2.42", "2001:db8::42"}))

and placing those calls above all others add*Action calls (especially the addAction one having the PoolAction rule action), I have the expected result.

As I am on Debian, I just edited my source.list to use bookworm-dnsdist-20 and updated dnsdist to the 2.0.0-alpha1 version (this is a test server).

I even elaborated on the code so that restartSpoofableQuery sets the tag value based on dr.remoteaddr and added multiple addCacheMissAction(TagRule("spoofed", value), SpoofAction(...)) to be able to reply with different spoofed values based on the request source IP.

[rgacogne]

It's really a terrible workaround, sorry about that.. I think the correct solution would be to implement the ability to "spoof" from a response, which does not seem hard. I'll open a feature request so we don't forget, but of course that doesn't help you today.

[rgacogne]

#15494