Add sinkhole IP address

Author: varunsh-coder

dnsproxy.go

@@ -39,6 +39,8 @@ type Answer struct {
 	Data string `json:"data"`
 }
 
+const StepSecuritySinkHoleIPAddress = "54.185.253.63"
+
 func (proxy *DNSProxy) getResponse(requestMsg *dns.Msg) (*dns.Msg, error) {
 
 	responseMsg := new(dns.Msg)
@@ -98,7 +100,12 @@ func (proxy *DNSProxy) getIPByDomain(domain string) (string, error) {
 		if !proxy.isAllowedDomain(domain) {
 			go WriteLog(fmt.Sprintf("domain not allowed: %s", domain))
 			go WriteAnnotation(fmt.Sprintf("DNS resolution for domain %s was blocked", domain))
-			return "", fmt.Errorf("domain not allowed %s", domain)
+
+			// return an ip address, so calling process calls the ip address
+			// the call will be blocked by the firewall
+			proxy.Cache.Set(domain, StepSecuritySinkHoleIPAddress)
+
+			return StepSecuritySinkHoleIPAddress, nil
 		}
 	}
 

dnsproxy_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"fmt"
 	"net/http"
 	"reflect"
 	"testing"
@@ -21,6 +22,7 @@ func TestDNSProxy_getResponse(t *testing.T) {
 	Cache := InitCache(60 * 1000000000)
 	rrDnsGoogle, _ := dns.NewRR("dns.google. IN A 8.8.8.8")
 	rrDnsTest, _ := dns.NewRR("test.com. IN A 67.225.146.248")
+	rrDnsNotAllowed, _ := dns.NewRR(fmt.Sprintf("notallowed.com. IN A %s", StepSecuritySinkHoleIPAddress))
 	rrDnsAllowed, _ := dns.NewRR("allowed.com. IN A 67.225.146.248")
 
 	apiclient := &ApiClient{Client: &http.Client{}, APIURL: agentApiBaseUrl}
@@ -61,8 +63,8 @@ func TestDNSProxy_getResponse(t *testing.T) {
 		{name: "type A notallowed.com",
 			fields:  fields{Cache: &Cache, EgressPolicy: EgressPolicyBlock, AllowedEndpoints: []Endpoint{{domainName: "allowed.com"}}},
 			args:    args{requestMsg: &dns.Msg{Question: []dns.Question{{Name: "notallowed.com.", Qtype: dns.TypeA}}}},
-			want:    &dns.Msg{},
-			wantErr: true,
+			want:    &dns.Msg{Answer: []dns.RR{rrDnsNotAllowed}},
+			wantErr: false,
 		},
 		{name: "type A test.com egress policy cached",
 			fields:  fields{Cache: &Cache, EgressPolicy: EgressPolicyBlock, AllowedEndpoints: []Endpoint{{domainName: "test.com"}}},