forked from StalkR/dns-reverse-proxy
/
dns_reverse_proxy.go
151 lines (134 loc) · 3.42 KB
/
dns_reverse_proxy.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
/*
Binary dns_reverse_proxy is a DNS reverse proxy to route queries to DNS servers.
To illustrate, imagine an HTTP reverse proxy but for DNS.
It listens on both TCP/UDP IPv4/IPv6 on specified port.
Since the upstream servers will not see the real client IPs but the proxy,
you can specify a list of IPs allowed to transfer (AXFR/IXFR).
Example usage:
$ go run dns_reverse_proxy.go -address :53 \
-default 8.8.8.8:53 \
-route .example.com.=8.8.4.4:53 \
-allow-transfer 1.2.3.4,::1
A query for example.net or example.com will go to 8.8.8.8:53, the default.
However, a query for subdomain.example.com will go to 8.8.4.4:53.
*/
package main
import (
"flag"
"log"
"net"
"regexp"
"strings"
"github.com/miekg/dns"
)
var (
address = flag.String("address", ":53", "Address to listen to (TCP and UDP)")
defaultServer = flag.String("default", "",
"Default DNS server where to send queries if no route matched (IP:port)")
routeList = flag.String("route", "",
"List of routes where to send queries (subdomain=IP:port)")
routes map[string]string
allowTransfer = flag.String("allow-transfer", "",
"List of IPs allowed to transfer (AXFR/IXFR)")
transferIPs []string
)
func main() {
flag.Parse()
if *defaultServer == "" {
log.Fatal("-default is required")
}
transferIPs = strings.Split(*allowTransfer, ",")
routes = make(map[string]string)
if *routeList != "" {
for _, s := range strings.Split(*routeList, ",") {
s := strings.SplitN(s, "=", 2)
if len(s) != 2 {
log.Fatal("invalid -routes format")
}
if !strings.HasSuffix(s[0], ".") {
s[0] += "."
}
routes[s[0]] = s[1]
}
}
udpServer := &dns.Server{Addr: *address, Net: "udp"}
tcpServer := &dns.Server{Addr: *address, Net: "tcp"}
dns.HandleFunc(".", route)
go func() {
log.Fatal(udpServer.ListenAndServe())
}()
log.Fatal(tcpServer.ListenAndServe())
}
func route(w dns.ResponseWriter, req *dns.Msg) {
if len(req.Question) == 0 || !allowed(w, req) {
dns.HandleFailed(w, req)
return
}
for name, addr := range routes {
if strings.HasSuffix(req.Question[0].Name, name) {
proxy(addr, w, req)
return
}
}
proxy(*defaultServer, w, req)
}
func isTransfer(req *dns.Msg) bool {
for _, q := range req.Question {
switch q.Qtype {
case dns.TypeIXFR, dns.TypeAXFR:
return true
}
}
return false
}
var hostRE = regexp.MustCompile(`^\[?([0-9a-f:.]+)\]?:[0-9]+$`)
// extractHost extract host from host:port in IPv4 (1.2.3.4:1234) or IPv6 ([::1]:1234).
func extractHost(remoteAddr string) string {
m := hostRE.FindStringSubmatch(remoteAddr)
if m == nil {
return ""
}
return m[1]
}
func allowed(w dns.ResponseWriter, req *dns.Msg) bool {
if !isTransfer(req) {
return true
}
remote := extractHost(w.RemoteAddr().String())
for _, ip := range transferIPs {
if ip == remote {
return true
}
}
return false
}
func proxy(addr string, w dns.ResponseWriter, req *dns.Msg) {
transport := "udp"
if _, ok := w.RemoteAddr().(*net.TCPAddr); ok {
transport = "tcp"
}
if isTransfer(req) {
if transport != "tcp" {
dns.HandleFailed(w, req)
return
}
t := new(dns.Transfer)
c, err := t.In(req, addr)
if err != nil {
dns.HandleFailed(w, req)
return
}
if err = t.Out(w, req, c); err != nil {
dns.HandleFailed(w, req)
return
}
return
}
c := &dns.Client{Net: transport}
resp, _, err := c.Exchange(req, addr)
if err != nil {
dns.HandleFailed(w, req)
return
}
w.WriteMsg(resp)
}