search

PowerDNS / pdns

PowerDNS Authoritative, PowerDNS Recursor, dnsdist
https://www.powerdns.com/
GNU General Public License v2.0
3.72k stars 912 forks source link

dnsdist: add DNSQType GSS-TSIG #14839

Closed tomwijnroks closed 1 week ago

tomwijnroks commented 2 weeks ago

Short description

Add DNSQType for GSS-TSIG so these type of DNS requests can be refused in dnsdist to prevent unnecessary logging.

Usecase

Refuse GSS-TSIG requests to dnsdist when the GSS-TSIG feature was not compiled in PowerDNS. When GSS-TSIG was not compiled in PowerDNS every GSS-TSIG request logs the following message:

Nov 11 15:22:52 ns1 pdns_server[3681960]: GSS-TSIG request but not feature not compiled in

Description

It seems it is already possible to refuse these requests with DNSQType.TKEY, so I'm not sure if a specific DNSQType.GSSTSIG type is really necessary.

I've also caputered some of these requests but the pcap contains sensitive data, which I'm not allowed to upload publicly. If this pcap file can help and there is a way to share it privately, please let me know.

Habbie commented 2 weeks ago

There's no GSS-TSIG qtype in DNS at all. If blocking TKEY does the job for you, I'm not sure there's any work left for us.

tomwijnroks commented 2 weeks ago

I was not really sure about this because the TSIG type also exists, which does not prevent these requests.

Thank you for your fast response, this issue can be closed.

patrickpoortman commented 2 weeks ago

https://github.com/PowerDNS/pdns/blob/98128bb78a44349504592ca6780ad0e4594293f9/pdns/tkey.cc#L74

Is the log level error correct for this case? As the function is not compiled. And anybody can trigger this message.

Habbie commented 2 weeks ago

And anybody can trigger this message.

Agreed, we should log it less, or make it optional.

rgacogne commented 1 week ago

I'm closing this issue since a different one has been opened for the log level, and as far as I can tell there is nothing left to do in dnsdist.