Skip to content

Commit 75449b0

Browse files
sebassimoessebassimoes
committed
feat(teams_rules): support internal dns settings
With this commit, it's possible to create DNS resolver rules configured to forward DNS queries to the internal DNS service with the given internal DNS view identifier.
1 parent 43c3b8a commit 75449b0

File tree

3 files changed

+219
-57
lines changed

3 files changed

+219
-57
lines changed

‎.changelog/3779.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
teams_rules: add support for `resolve_dns_internally` settings on dns_resolver rules
3+
```

‎teams_rules.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,8 @@ type TeamsRuleSettings struct {
6767
// Resolver policy settings.
6868
DnsResolverSettings *TeamsDnsResolverSettings `json:"dns_resolvers,omitempty"`
6969

70+
ResolveDnsInternallySettings *TeamsResolveDnsInternallySettings `json:"resolve_dns_internally,omitempty"`
71+
7072
NotificationSettings *TeamsNotificationSettings `json:"notification_settings"`
7173
Quarantine *TeamsQuarantine `json:"quarantine,omitempty"`
7274
ForensicCopySettings *TeamsForensicCopySettings `json:"forensic_copy,omitempty"`
@@ -150,6 +152,18 @@ type (
150152
VnetID string `json:"vnet_id,omitempty"`
151153
RouteThroughPrivateNetwork *bool `json:"route_through_private_network,omitempty"`
152154
}
155+
156+
TeamsResolveDnsInternallySettings struct {
157+
ViewID string `json:"view_id"`
158+
Fallback TeamsResolveDnsInternallyFallbackStrategy `json:"fallback"`
159+
}
160+
161+
TeamsResolveDnsInternallyFallbackStrategy string
162+
)
163+
164+
const (
165+
None TeamsResolveDnsInternallyFallbackStrategy = "none"
166+
PublicDns TeamsResolveDnsInternallyFallbackStrategy = "public_dns"
153167
)
154168

155169
type TeamsDlpPayloadLogSettings struct {

‎teams_rules_test.go‎

Lines changed: 202 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,40 @@ func TestTeamsRules(t *testing.T) {
106106
},
107107
"resolve_dns_through_cloudflare": true
108108
}
109+
},
110+
{
111+
"id": "7559a944-3dd7-41bf-b183-360a814a8caa",
112+
"name": "rule3",
113+
"description": "internal dns",
114+
"precedence": 3000,
115+
"enabled": true,
116+
"action": "resolve",
117+
"filters": [
118+
"dns_resolver"
119+
],
120+
"created_at": "2014-01-01T05:20:00.12345Z",
121+
"updated_at": "2014-01-01T05:20:00.12345Z",
122+
"deleted_at": null,
123+
"traffic": "dns.domain == \"example.com\"",
124+
"identity": "",
125+
"version": 1,
126+
"rule_settings": {
127+
"block_page_enabled": false,
128+
"block_reason": "",
129+
"override_ips": null,
130+
"override_host": "",
131+
"l4override": null,
132+
"biso_admin_controls": null,
133+
"add_headers": null,
134+
"check_session": null,
135+
"insecure_disable_dnssec_validation": false,
136+
"resolve_dns_through_cloudflare": false,
137+
"dns_resolvers": null,
138+
"resolve_dns_internally": {
139+
"view_id": "fake_view_id",
140+
"fallback": "public_dns"
141+
}
142+
}
109143
}
110144
]
111145
}
@@ -115,69 +149,70 @@ func TestTeamsRules(t *testing.T) {
115149
createdAt, _ := time.Parse(time.RFC3339, "2014-01-01T05:20:00.12345Z")
116150
updatedAt, _ := time.Parse(time.RFC3339, "2014-01-01T05:20:00.12345Z")
117151

118-
want := []TeamsRule{{
119-
ID: "7559a944-3dd7-41bf-b183-360a814a8c36",
120-
Name: "rule1",
121-
Description: "rule description",
122-
Precedence: 1000,
123-
Enabled: false,
124-
Action: Isolate,
125-
Filters: []TeamsFilterType{HttpFilter},
126-
Traffic: `http.host == "example.com"`,
127-
DevicePosture: "",
128-
Identity: "",
129-
Version: 1,
130-
RuleSettings: TeamsRuleSettings{
131-
BlockPageEnabled: false,
132-
BlockReason: "",
133-
OverrideIPs: nil,
134-
OverrideHost: "",
135-
L4Override: nil,
136-
AddHeaders: nil,
137-
BISOAdminControls: nil,
138-
CheckSession: &TeamsCheckSessionSettings{
139-
Enforce: true,
140-
Duration: Duration{900 * time.Second},
141-
},
142-
InsecureDisableDNSSECValidation: false,
143-
UntrustedCertSettings: &UntrustedCertSettings{
144-
Action: UntrustedCertError,
145-
},
146-
IgnoreCNAMECategoryMatches: BoolPtr(true),
147-
DnsResolverSettings: &TeamsDnsResolverSettings{
148-
V4Resolvers: []TeamsDnsResolverAddressV4{
149-
{
150-
TeamsDnsResolverAddress{
151-
IP: "10.0.0.2",
152-
Port: IntPtr(5053),
152+
want := []TeamsRule{
153+
{
154+
ID: "7559a944-3dd7-41bf-b183-360a814a8c36",
155+
Name: "rule1",
156+
Description: "rule description",
157+
Precedence: 1000,
158+
Enabled: false,
159+
Action: Isolate,
160+
Filters: []TeamsFilterType{HttpFilter},
161+
Traffic: `http.host == "example.com"`,
162+
DevicePosture: "",
163+
Identity: "",
164+
Version: 1,
165+
RuleSettings: TeamsRuleSettings{
166+
BlockPageEnabled: false,
167+
BlockReason: "",
168+
OverrideIPs: nil,
169+
OverrideHost: "",
170+
L4Override: nil,
171+
AddHeaders: nil,
172+
BISOAdminControls: nil,
173+
CheckSession: &TeamsCheckSessionSettings{
174+
Enforce: true,
175+
Duration: Duration{900 * time.Second},
176+
},
177+
InsecureDisableDNSSECValidation: false,
178+
UntrustedCertSettings: &UntrustedCertSettings{
179+
Action: UntrustedCertError,
180+
},
181+
IgnoreCNAMECategoryMatches: BoolPtr(true),
182+
DnsResolverSettings: &TeamsDnsResolverSettings{
183+
V4Resolvers: []TeamsDnsResolverAddressV4{
184+
{
185+
TeamsDnsResolverAddress{
186+
IP: "10.0.0.2",
187+
Port: IntPtr(5053),
188+
},
153189
},
154-
},
155-
{
156-
TeamsDnsResolverAddress{
157-
IP: "192.168.0.2",
158-
VnetID: "16fd7a32-11f0-4687-a0bb-7031d241e184",
159-
RouteThroughPrivateNetwork: BoolPtr(true),
190+
{
191+
TeamsDnsResolverAddress{
192+
IP: "192.168.0.2",
193+
VnetID: "16fd7a32-11f0-4687-a0bb-7031d241e184",
194+
RouteThroughPrivateNetwork: BoolPtr(true),
195+
},
160196
},
161197
},
162-
},
163-
V6Resolvers: []TeamsDnsResolverAddressV6{
164-
{
165-
TeamsDnsResolverAddress{
166-
IP: "2460::1",
198+
V6Resolvers: []TeamsDnsResolverAddressV6{
199+
{
200+
TeamsDnsResolverAddress{
201+
IP: "2460::1",
202+
},
167203
},
168204
},
169205
},
206+
NotificationSettings: &TeamsNotificationSettings{
207+
Enabled: BoolPtr(true),
208+
Message: "message",
209+
SupportURL: "https://hello.com",
210+
},
170211
},
171-
NotificationSettings: &TeamsNotificationSettings{
172-
Enabled: BoolPtr(true),
173-
Message: "message",
174-
SupportURL: "https://hello.com",
175-
},
212+
CreatedAt: &createdAt,
213+
UpdatedAt: &updatedAt,
214+
DeletedAt: nil,
176215
},
177-
CreatedAt: &createdAt,
178-
UpdatedAt: &updatedAt,
179-
DeletedAt: nil,
180-
},
181216
{
182217
ID: "9ae57318-f32e-46b3-b889-48dd6dcc49af",
183218
Name: "rule2",
@@ -209,7 +244,42 @@ func TestTeamsRules(t *testing.T) {
209244
CreatedAt: &createdAt,
210245
UpdatedAt: &updatedAt,
211246
DeletedAt: nil,
212-
}}
247+
},
248+
{
249+
ID: "7559a944-3dd7-41bf-b183-360a814a8caa",
250+
Name: "rule3",
251+
Description: "internal dns",
252+
Precedence: 3000,
253+
Enabled: true,
254+
Action: Resolve,
255+
Filters: []TeamsFilterType{DnsResolverFilter},
256+
Traffic: `dns.domain == "example.com"`,
257+
Identity: "",
258+
DevicePosture: "",
259+
Version: 1,
260+
RuleSettings: TeamsRuleSettings{
261+
BlockPageEnabled: false,
262+
BlockReason: "",
263+
OverrideIPs: nil,
264+
OverrideHost: "",
265+
L4Override: nil,
266+
AddHeaders: nil,
267+
BISOAdminControls: nil,
268+
CheckSession: nil,
269+
InsecureDisableDNSSECValidation: false,
270+
UntrustedCertSettings: nil,
271+
ResolveDnsInternallySettings: &TeamsResolveDnsInternallySettings{
272+
ViewID: "fake_view_id",
273+
Fallback: PublicDns,
274+
},
275+
ResolveDnsThroughCloudflare: BoolPtr(false),
276+
DnsResolverSettings: nil,
277+
},
278+
CreatedAt: &createdAt,
279+
UpdatedAt: &updatedAt,
280+
DeletedAt: nil,
281+
},
282+
}
213283

214284
mux.HandleFunc("/accounts/"+testAccountID+"/gateway/rules", handler)
215285

@@ -534,7 +604,7 @@ func TestTeamsCreateL4Rule(t *testing.T) {
534604
}
535605
}
536606

537-
func TestTeamsCreateResolverPolicy(t *testing.T) {
607+
func TestTeamsCreateResolverPolicyWithResolveDnsThroughCloudlare(t *testing.T) {
538608
setup()
539609
defer teardown()
540610

@@ -603,6 +673,81 @@ func TestTeamsCreateResolverPolicy(t *testing.T) {
603673
}
604674
}
605675

676+
func TestTeamsCreateResolverPolicyWithResolveDnsInternally(t *testing.T) {
677+
setup()
678+
defer teardown()
679+
680+
handler := func(w http.ResponseWriter, r *http.Request) {
681+
assert.Equal(t, http.MethodPost, r.Method, "Expected method 'POST', got %s", r.Method)
682+
w.Header().Set("content-type", "application/json")
683+
fmt.Fprintf(w, `{
684+
"success": true,
685+
"errors": [],
686+
"messages": [],
687+
"result": {
688+
"name": "resolve 4.4.4.4",
689+
"description": "rule description",
690+
"precedence": 1000,
691+
"enabled": true,
692+
"action": "resolve",
693+
"filters": [
694+
"dns_resolver"
695+
],
696+
"traffic": "any(dns.domains[*] == \"scottstots.com\")",
697+
"identity": "",
698+
"rule_settings": {
699+
"resolve_dns_through_cloudflare": false,
700+
"dns_resolvers": null,
701+
"resolve_dns_internally": {
702+
"view_id": "fake_view_id",
703+
"fallback": "none"
704+
}
705+
}
706+
}
707+
}
708+
`)
709+
}
710+
711+
want := TeamsRule{
712+
Name: "resolve 4.4.4.4",
713+
Description: "rule description",
714+
Precedence: 1000,
715+
Enabled: true,
716+
Action: Resolve,
717+
Filters: []TeamsFilterType{DnsResolverFilter},
718+
Traffic: `any(dns.domains[*] == "scottstots.com")`,
719+
Identity: "",
720+
DevicePosture: "",
721+
RuleSettings: TeamsRuleSettings{
722+
BlockPageEnabled: false,
723+
BlockReason: "",
724+
OverrideIPs: nil,
725+
OverrideHost: "",
726+
L4Override: nil,
727+
AddHeaders: nil,
728+
BISOAdminControls: nil,
729+
CheckSession: nil,
730+
InsecureDisableDNSSECValidation: false,
731+
EgressSettings: nil,
732+
ResolveDnsThroughCloudflare: BoolPtr(false),
733+
DnsResolverSettings: nil,
734+
ResolveDnsInternallySettings: &TeamsResolveDnsInternallySettings{
735+
ViewID: "fake_view_id",
736+
Fallback: None,
737+
},
738+
},
739+
DeletedAt: nil,
740+
}
741+
742+
mux.HandleFunc("/accounts/"+testAccountID+"/gateway/rules", handler)
743+
744+
actual, err := client.TeamsCreateRule(context.Background(), testAccountID, want)
745+
746+
if assert.NoError(t, err) {
747+
assert.Equal(t, want, actual)
748+
}
749+
}
750+
606751
func TestTeamsUpdateRule(t *testing.T) {
607752
setup()
608753
defer teardown()

0 commit comments

Comments
 (0)