feat(middlewares/filter): support exempt parent domains for rebinding protection

Author: qdm12

pkg/middlewares/filter/mapfilter/filter.go

@@ -7,15 +7,16 @@ import (
 )
 
 type Filter struct {
-	fqdnHostnames     map[string]struct{}
-	ipv4              map[[4]byte]struct{}
-	ipv6              map[[16]byte]struct{}
-	ipPrefixes        []netip.Prefix
-	privateIPPrefixes []netip.Prefix
-	allowRebindNames  map[string]struct{}
-	metrics           Metrics
-	logger            Logger
-	updateLock        sync.RWMutex
+	fqdnHostnames      map[string]struct{}
+	ipv4               map[[4]byte]struct{}
+	ipv6               map[[16]byte]struct{}
+	ipPrefixes         []netip.Prefix
+	privateIPPrefixes  []netip.Prefix
+	allowRebindNames   map[string]struct{}
+	allowRebindParents map[string]struct{}
+	metrics            Metrics
+	logger             Logger
+	updateLock         sync.RWMutex
 }
 
 func New(settings Settings) (filter *Filter, err error) {

pkg/middlewares/filter/mapfilter/response.go

@@ -3,6 +3,7 @@ package mapfilter
 import (
 	"net"
 	"net/netip"
+	"strings"
 
 	"github.com/miekg/dns"
 	"github.com/qdm12/dns/v2/internal/local"
@@ -19,6 +20,16 @@ func (m *Filter) FilterResponse(response *dns.Msg) (blocked bool) {
 	if len(response.Question) == 1 {
 		nameIsLocal = local.IsFQDNLocal(response.Question[0].Name)
 		_, nameCanBeRebinded = m.allowRebindNames[response.Question[0].Name]
+		if !nameCanBeRebinded && len(m.allowRebindParents) > 0 {
+			labels := dns.SplitDomainName(response.Question[0].Name)
+			for i := len(labels) - 1; i >= 0; i-- {
+				parent := dns.Fqdn(strings.Join(labels[i:], "."))
+				if _, ok := m.allowRebindParents[parent]; ok {
+					nameCanBeRebinded = true
+					break
+				}
+			}
+		}
 	}
 
 	for _, rr := range response.Answer {

pkg/middlewares/filter/mapfilter/update.go

@@ -39,10 +39,15 @@ func (m *Filter) Update(settings update.Settings) (err error) {
 		m.allowRebindNames[name] = struct{}{}
 	}
 
+	m.allowRebindParents = make(map[string]struct{}, len(settings.ParentsExemptFromRebindingProtection))
+	for _, name := range settings.ParentsExemptFromRebindingProtection {
+		m.allowRebindParents[name] = struct{}{}
+	}
+
 	m.metrics.SetBlockedHostnames(len(m.fqdnHostnames))
 	m.metrics.SetBlockedIPs(len(m.ipv4) + len(m.ipv6))
 	m.metrics.SetBlockedIPPrefixes(len(m.ipPrefixes))
-	m.metrics.SetFqdnExemptFromRebindingProtection(len(m.allowRebindNames))
+	m.metrics.SetFqdnExemptFromRebindingProtection(len(m.allowRebindNames) + len(m.allowRebindParents))
 
 	m.logger.Log(fmt.Sprintf("filter updated: %d hostnames, %d IPs, %d IP prefixes blocked",
 		len(m.fqdnHostnames), len(m.ipv4)+len(m.ipv6), len(m.ipPrefixes)))

pkg/middlewares/filter/update/settings.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/netip"
 	"regexp"
+	"strings"
 
 	"github.com/miekg/dns"
 	"github.com/qdm12/gosettings/validate"
@@ -22,6 +23,10 @@ type Settings struct {
 	// FqdnExemptFromRebindingProtection is a list of
 	// fully qualified domain names that are exempt from rebinding protection.
 	FqdnExemptFromRebindingProtection []string
+	// ParentsExemptFromRebindingProtection is a list of fully qualified
+	// domain names for which all their subdomains are exempt from
+	// rebinding protection.
+	ParentsExemptFromRebindingProtection []string
 }
 
 func (s *Settings) SetDefaults() {}
@@ -41,6 +46,11 @@ func (s Settings) Validate() (err error) {
 		return fmt.Errorf("FQDNs exempt from rebinding protection: %w", err)
 	}
 
+	err = validate.AllMatchRegex(s.ParentsExemptFromRebindingProtection, fqdnHostRegex)
+	if err != nil {
+		return fmt.Errorf("parent FQDNs exempt from rebinding protection: %w", err)
+	}
+
 	return nil
 }
 
@@ -54,19 +64,27 @@ func (s *Settings) BlockHostnames(hostnames []string) {
 }
 
 // SetRebindingProtectionExempt transforms the slice of hostnames given to
-// FQDNs and sets these to the settings.
+// FQDNs and sets these to the settings. Parent domains can be exempt by
+// specifying the "*." prefix to the hostname, for example "*.example.com"
+// will exempt all subdomains of example.com from rebinding protection.
+// Note the wildcard cannot be used anywhere else otherwise.
 func (s *Settings) SetRebindingProtectionExempt(hostnames []string) {
-	s.FqdnExemptFromRebindingProtection = make([]string, len(hostnames))
-	for i := range hostnames {
-		s.FqdnExemptFromRebindingProtection[i] = dns.Fqdn(hostnames[i])
+	s.FqdnExemptFromRebindingProtection = make([]string, 0, len(hostnames))
+	for _, hostname := range hostnames {
+		if strings.HasPrefix(hostname, "*.") {
+			parent := hostname[2:]
+			s.ParentsExemptFromRebindingProtection = append(s.ParentsExemptFromRebindingProtection, dns.Fqdn(parent))
+		} else {
+			s.FqdnExemptFromRebindingProtection = append(s.FqdnExemptFromRebindingProtection, dns.Fqdn(hostname))
+		}
 	}
 }
 
 func (s *Settings) String() string {
 	return s.ToLinesNode().String()
 }
 
-func (s *Settings) ToLinesNode() (node *gotree.Node) {
+func (s *Settings) ToLinesNode() (node *gotree.Node) { //nolint:cyclop
 	if len(s.IPs) == 0 && len(s.FqdnHostnames) == 0 &&
 		len(s.IPPrefixes) == 0 {
 		return gotree.New("Filter update: disabled")
@@ -93,5 +111,12 @@ func (s *Settings) ToLinesNode() (node *gotree.Node) {
 		}
 	}
 
+	if len(s.ParentsExemptFromRebindingProtection) > 0 {
+		subNode := node.Appendf("Parent domains exempt from rebinding protection:")
+		for _, fqdn := range s.ParentsExemptFromRebindingProtection {
+			subNode.Appendf("%s", fqdn)
+		}
+	}
+
 	return node
 }