Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add multiple addresses support for DNS modifier #138

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

eddc005
Copy link
Contributor

@eddc005 eddc005 commented Jun 2, 2024

Completes #137 . The DNS modifier now takes a list of addresses. One of the addresses is picked by the hash of the DNS query.

This PR forces a change to the rule.yaml file. Existing rule file will break as following:

2000-01-01T00:00:00+00:00       FATAL   failed to load rules    {"error": "yaml: unmarshal errors:\n  line 22: cannot unmarshal  !!str `1.1.1.1` into []interface {}"}

An example new modifier file

- name: v2ex dns poisoning
  action: modify
  modifier:
    name: dns
    args:
      a:
      - "192.0.2.1"
      - "192.0.2.2"
      - "192.0.2.3"
      - "198.51.100.1"
      - "198.51.100.2"
      aaaa: 
      - "2001:db8::1234:5678"
      - "2001:db8::abcd:ef12"

  expr: dns != nil && dns.qr && any(dns.questions, {.name endsWith "v2ex.com"})

@tobyxdd tobyxdd self-requested a review June 3, 2024 02:41
@tobyxdd tobyxdd self-assigned this Jun 3, 2024
@tobyxdd tobyxdd added the enhancement New feature or request label Jun 3, 2024
@haruue
Copy link
Collaborator

haruue commented Jun 3, 2024

Loading the list from an external file might be better.

And I think it is possible to determine the IP family when parsing, so splitting the options to "a" and "aaaa" would not be necessary.

- name: ...
  action: modify
  modifier:
    name: dns
    args:
      a: "192.0.2.33"
      aaaa: "2001:db8::abc:123"
      file: "./ipslist.txt"
      list:
        - "192.0.2.66"
        - "192.0.2.67"
        - "2001:db8::ccc:ddd"
        - "2001:db8::abcd:1234"
  expr: ...

@eddc005
Copy link
Contributor Author

eddc005 commented Jun 3, 2024

Hi @haruue ! I've updated the PR to support exactly this format. Let me know what do you think about this :)

- name: ...
  action: modify
  modifier:
    name: dns
    args:
      a: "192.0.2.33"
      aaaa: "2001:db8::abc:123"
      file: "./ipslist.txt"
      list:
        - "192.0.2.66"
        - "192.0.2.67"
        - "2001:db8::ccc:ddd"
        - "2001:db8::abcd:1234"
  expr: ...

Added a and aaaa back for backward compat.

@haruue haruue self-requested a review June 4, 2024 01:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants