mirrors/nebula
1
Fork 0
mirror of https://github.com/slackhq/nebula.git synced 2025-12-06 02:30:57 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge 70dfb71b6c into 584c2668b3

Browse source
This commit is contained in:
Jack Doan 2025-11-19 00:39:46 -08:00 • committed by GitHub
commit 2ef2eafbb1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 100 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

34
dns_server.go
View file

@ -184,11 +184,41 @@ func getDnsServerAddr(c *config.C) string {
if dnsHost == "[::]" {
dnsHost = "::"
}
return dnsHost
}
func getDnsServerAddrPort(c *config.C) string {
dnsHost := getDnsServerAddr(c)
return net.JoinHostPort(dnsHost, strconv.Itoa(c.GetInt("lighthouse.dns.port", 53)))
}
func shouldServeDns(c *config.C) (bool, error) {
if !c.GetBool("lighthouse.serve_dns", false) {
return false, nil
}
dnsHostStr := getDnsServerAddr(c)
if dnsHostStr == "" { //setting an ip address is required
return false, fmt.Errorf("no DNS server IP address set")
}
if c.GetBool("lighthouse.am_lighthouse", false) {
return true, nil
}
dnsHost, err := netip.ParseAddr(dnsHostStr)
if err != nil {
return false, fmt.Errorf("failed to parse lighthouse.dns.host(%s) %v", dnsHostStr, err)
}
if !dnsHost.IsLoopback() {
return false, fmt.Errorf("lighthouse.dns.host(%s) must be loopback on non-lighthouses", dnsHostStr)
}
return true, nil
}
func startDns(l *logrus.Logger, c *config.C) {
dnsAddr = getDnsServerAddr(c)
dnsAddr = getDnsServerAddrPort(c)
dnsServer = &dns.Server{Addr: dnsAddr, Net: "udp"}
l.WithField("dnsListener", dnsAddr).Info("Starting DNS responder")
err := dnsServer.ListenAndServe()
@ -199,7 +229,7 @@ func startDns(l *logrus.Logger, c *config.C) {
}
func reloadDns(l *logrus.Logger, c *config.C) {
if dnsAddr == getDnsServerAddr(c) {
if dnsAddr == getDnsServerAddrPort(c) {
l.Debug("No DNS server config change detected")
return
}

69
dns_server_test.go
View file

@ -35,7 +35,7 @@ func TestParsequery(t *testing.T) {
assert.Equal(t, "fd01::24", m.Answer[0].(*dns.AAAA).AAAA.String())
}
func Test_getDnsServerAddr(t *testing.T) {
func Test_getDnsServerAddrPort(t *testing.T) {
c := config.NewC(nil)
c.Settings["lighthouse"] = map[string]any{
@ -44,7 +44,7 @@ func Test_getDnsServerAddr(t *testing.T) {
"port": "1",
},
}
assert.Equal(t, "0.0.0.0:1", getDnsServerAddr(c))
assert.Equal(t, "0.0.0.0:1", getDnsServerAddrPort(c))
c.Settings["lighthouse"] = map[string]any{
"dns": map[string]any{
@ -52,7 +52,7 @@ func Test_getDnsServerAddr(t *testing.T) {
"port": "1",
},
}
assert.Equal(t, "[::]:1", getDnsServerAddr(c))
assert.Equal(t, "[::]:1", getDnsServerAddrPort(c))
c.Settings["lighthouse"] = map[string]any{
"dns": map[string]any{
@ -60,7 +60,7 @@ func Test_getDnsServerAddr(t *testing.T) {
"port": "1",
},
}
assert.Equal(t, "[::]:1", getDnsServerAddr(c))
assert.Equal(t, "[::]:1", getDnsServerAddrPort(c))
// Make sure whitespace doesn't mess us up
c.Settings["lighthouse"] = map[string]any{
@ -69,5 +69,64 @@ func Test_getDnsServerAddr(t *testing.T) {
"port": "1",
},
}
assert.Equal(t, "[::]:1", getDnsServerAddr(c))
assert.Equal(t, "[::]:1", getDnsServerAddrPort(c))
}
func Test_shouldServeDns(t *testing.T) {
c := config.NewC(nil)
notLoopback := map[interface{}]interface{}{"host": "0.0.0.0", "port": "1"}
yesLoopbackv4 := map[interface{}]interface{}{"host": "127.0.0.2", "port": "1"}
yesLoopbackv6 := map[interface{}]interface{}{"host": "::1", "port": "1"}
c.Settings["lighthouse"] = map[interface{}]interface{}{
"serve_dns": false,
}
serveDns, err := shouldServeDns(c)
assert.NoError(t, err)
assert.False(t, serveDns)
c.Settings["lighthouse"] = map[interface{}]interface{}{
"am_lighthouse": true,
"serve_dns": true,
}
serveDns, err = shouldServeDns(c)
assert.Error(t, err)
assert.False(t, serveDns)
c.Settings["lighthouse"] = map[interface{}]interface{}{
"am_lighthouse": true,
"serve_dns": true,
"dns": notLoopback,
}
serveDns, err = shouldServeDns(c)
assert.NoError(t, err)
assert.True(t, serveDns)
//non-lighthouses must do DNS on loopback
c.Settings["lighthouse"] = map[interface{}]interface{}{
"am_lighthouse": false,
"serve_dns": true,
"dns": notLoopback,
}
serveDns, err = shouldServeDns(c)
assert.Error(t, err)
assert.False(t, serveDns)
c.Settings["lighthouse"] = map[interface{}]interface{}{
"am_lighthouse": false,
"serve_dns": true,
"dns": yesLoopbackv4,
}
serveDns, err = shouldServeDns(c)
assert.NoError(t, err)
assert.True(t, serveDns)
c.Settings["lighthouse"] = map[interface{}]interface{}{
"am_lighthouse": false,
"serve_dns": true,
"dns": yesLoopbackv6,
}
serveDns, err = shouldServeDns(c)
assert.NoError(t, err)
assert.True(t, serveDns)
}

12
main.go
View file

@ -219,13 +219,9 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
handshakeManager := NewHandshakeManager(l, hostMap, lightHouse, udpConns[0], handshakeConfig)
lightHouse.handshakeTrigger = handshakeManager.trigger
serveDns := false
if c.GetBool("lighthouse.serve_dns", false) {
if c.GetBool("lighthouse.am_lighthouse", false) {
serveDns = true
} else {
l.Warn("DNS server refusing to run because this host is not a lighthouse.")
}
serveDns, dnsErr := shouldServeDns(c)
if dnsErr != nil {
l.Warnf("failed to configure DNS server: %v", dnsErr)
}
ifConfig := &InterfaceConfig{
@ -285,7 +281,7 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
// Start DNS server last to allow using the nebula IP as lighthouse.dns.host
var dnsStart func()
if lightHouse.amLighthouse && serveDns {
if serveDns {
l.Debugln("Starting dns server")
dnsStart = dnsMain(l, pki.getCertState(), hostMap, c)
}