* plugin/shed: add UDP overload protection plugin
UDP responses written back through one listener socket serialize on the
Go runtime's internal fdMutex, which allows at most 2^20-1 concurrent
operations per file descriptor and panics the process when exceeded.
CoreDNS serves UDP with one goroutine per query, all writing through the
shared packet connection, so a sustained overload parks every excess
in-flight query in that wait queue until the process dies with
"too many concurrent operations on a single file or socket". Observed
in production: ~2.8M goroutines and 60GiB RSS before the panic.
The shed plugin makes the panic structurally unreachable. It installs,
via Config.UDPDecorateWriterFunc, a per-socket bounded evict-oldest
stack drained newest-first by a single writer goroutine, so the fd
never sees more than one writer and residual capacity under overload
always goes to the freshest response. While a socket's stack is full,
arriving queries are dropped before any plugin runs. Drops are silent
(the client's resolver retries elsewhere) and counted in
coredns_shed_dropped_total{server, reason}.
plugin/shed/fdmutex_test.go demonstrates the failure and the fix with
one shared flood harness. Two subprocess tests reproduce the exact
runtime panic without the plugin's write discipline - one deterministic
(a held write plus >2^20 queued writers), one with nothing held or
mocked; both exercise the Go runtime rather than the plugin, so they
are gated behind SHED_FLOOD_TEST=1. The counterfactual - the same load
through the plugin's stack, completing with every response accounted
for as written or dropped - runs in every test invocation, including
-race, at 50k responders, and at the full 1.5M with SHED_FLOOD_TEST=1:
SHED_FLOOD_TEST=1 go test ./plugin/shed/
Signed-off-by: Ryan Brewster <rpb@anthropic.com>
* test: add shed e2e test
Query a shed-enabled server over UDP (the plugin's deferred
single-writer path) and TCP (which shed passes through), and check
that coredns_shed_dropped_total is exported with its reason label.
No-Verification-Needed: test-only change
Signed-off-by: Ryan Brewster <rpb@anthropic.com>
---------
Signed-off-by: Ryan Brewster <rpb@anthropic.com>
This fix prevents CoreDNS `autopath` from bypassing `acl` checks
when it rewrites an allowed query into a name within an ACL-protected zone.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
This PR fixes plugin ordering so ACL checks run before cache lookups,
preventing blocked clients from receiving cached DNS answers populated by allowed clients
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Add configurable resource limits to prevent potential DoS vectors
via connection/stream exhaustion on gRPC, HTTPS, and HTTPS/3 servers.
New configuration plugins:
- grpc_server: configure max_streams, max_connections
- https: configure max_connections
- https3: configure max_streams
Changes:
- Use netutil.LimitListener for connection limiting
- Use gRPC MaxConcurrentStreams and message size limits
- Add QUIC MaxIncomingStreams for HTTPS/3 stream limiting
- Set secure defaults: 256 max streams, 200 max connections
- Setting any limit to 0 means unbounded/fallback to previous impl
Defaults are applied automatically when plugins are omitted from
config.
Includes tests and integration tests.
Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
* introduce new interface "dnsserver.Viewer", that allows a plugin implementing it to decide if a query should be routed into its server block.
* add new plugin "view", that uses the new interface to enable a user to define expression based conditions that must be met for a query to be routed to its server block.
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* Add forwardcrd plugin README.md
Co-authored-by: Aidan Obley <aobley@vmware.com>
Signed-off-by: Christian Ang <angc@vmware.com>
* Create forwardcrd plugin
- Place forwardcrd before forward plugin in plugin list. This will avoid
forward from preventing the forwardcrd plugin from handling any queries
in the case of having a default upstream forwarder in a server block (as
is the case in the default kubernetes Corefile).
Co-authored-by: Aidan Obley <aobley@vmware.com>
Signed-off-by: Christian Ang <angc@vmware.com>
* Add Forward CRD
Signed-off-by: Christian Ang <angc@vmware.com>
* Add NewWithConfig to forward plugin
- allows external packages to instanciate forward plugins
Co-authored-by: Aidan Obley <aobley@vmware.com>
Signed-off-by: Christian Ang <angc@vmware.com>
* ForwardCRD plugin handles requests for Forward CRs
- add a Kubernetes controller that can read Forward CRs
- instances of the forward plugin are created based on Forward CRs from
the Kubernetes controller
- DNS requests are handled by calling matching Forward plugin instances
based on zone name
- Defaults to the kube-system namespace to align with Corefile RBAC
Signed-off-by: Christian Ang <angc@vmware.com>
Use klog v2 in forwardcrd plugin
* Refactor forward setup to use NewWithConfig
Co-authored-by: Christian Ang <angc@vmware.com>
Signed-off-by: Edwin Xie <exie@vmware.com>
* Use ParseInt instead of Atoi
- to ensure that the bitsize is 32 for later casting to uint32
Signed-off-by: Christian Ang <angc@vmware.com>
* Add @christianang to CODEOWNERS for forwardcrd
Signed-off-by: Christian Ang <angc@vmware.com>
Co-authored-by: Edwin Xie <exie@vmware.com>
* plugin/header: run go gen and small doc updates
Run go gen to enable the new plugin, this should fix the CI failures.
Small tweaks to the docs.
Signed-off-by: Miek Gieben <miek@miek.nl>
* another typo
Signed-off-by: Miek Gieben <miek@miek.nl>
* gofmt
Signed-off-by: Miek Gieben <miek@miek.nl>
* Add dns64 plugin
Add external plugin to core in-tree.
* Pull code from upstream: https://github.com/serverwentdown/dns64
* Update docs.
Signed-off-by: Ben Kochie <superq@gmail.com>
* Make dns64 consistent.
Signed-off-by: Ben Kochie <superq@gmail.com>
* Cleanup README
Signed-off-by: Ben Kochie <superq@gmail.com>
* Cleanup minor issues.
Signed-off-by: Ben Kochie <superq@gmail.com>
* Remove proxy method.
Signed-off-by: Ben Kochie <superq@gmail.com>
* dns64: big cleanup
* Make the code a bit more idiomatic
* Add tests
* use proper Upstream API
Signed-off-by: Casey Callendrello <c1@caseyc.net>
Signed-off-by: Ben Kochie <superq@gmail.com>
* A little more clenaup
* Fix some docs.
* Use the correct plugin register method.
* Cleanup some review items.
Signed-off-by: Ben Kochie <superq@gmail.com>
* Add metrics counter for DNS64 translations
Add a basic counter of how many DNS64 translations have been completed.
Signed-off-by: Ben Kochie <superq@gmail.com>
* Add DNSSEC bug link
Signed-off-by: Ben Kochie <superq@gmail.com>
* Test cleanup
Signed-off-by: Ben Kochie <superq@gmail.com>
* dns64: more test cleanup
Signed-off-by: Casey Callendrello <c1@caseyc.net>
Co-authored-by: Casey Callendrello <c1@caseyc.net>
* Add plugin ACL for source ip filtering
Signed-off-by: An Xiao <hac@zju.edu.cn>
* Allow all arguments to be optional and support multiple qtypes in a single policy
Signed-off-by: An Xiao <hac@zju.edu.cn>
* Add newline before third party imports
Signed-off-by: An Xiao <hac@zju.edu.cn>
* Use camel instead of underscore in method name
Signed-off-by: An Xiao <hac@zju.edu.cn>
* Start with an upper case letter in t.Errorf()
Signed-off-by: An Xiao <hac@zju.edu.cn>
* Use the qtype parse logic in miekg/dns
Signed-off-by: An Xiao <hac@zju.edu.cn>
* Use third party trie implementation as the ip filter
Signed-off-by: An Xiao <hac@zju.edu.cn>
* Update based on rdrozhdzh's comment
Signed-off-by: An Xiao <hac@zju.edu.cn>
* Change the type of action to int
Signed-off-by: An Xiao <hac@zju.edu.cn>
* Add IPv6 support
Signed-off-by: An Xiao <hac@zju.edu.cn>
* Update plugin.cfg
Signed-off-by: An Xiao <hac@zju.edu.cn>
* Remove file functionality
Signed-off-by: An Xiao <hac@zju.edu.cn>
* Update
Signed-off-by: Xiao An <hac@zju.edu.cn>
* Update README
Signed-off-by: Xiao An <hac@zju.edu.cn>
* remove comments
Signed-off-by: Xiao An <hac@zju.edu.cn>
* update
Signed-off-by: Xiao An <hac@zju.edu.cn>
* Update dependency
Signed-off-by: Xiao An <hac@zju.edu.cn>
* Update
Signed-off-by: Xiao An <hac@zju.edu.cn>
* Update test
Signed-off-by: Xiao An <hac@zju.edu.cn>
* Add OWNERS
Signed-off-by: Xiao An <hac@zju.edu.cn>
* Refactor shouldBlock and skip useless check
Signed-off-by: Xiao An <hac@zju.edu.cn>
* Introduce ActionNone
Signed-off-by: Xiao An <hac@zju.edu.cn>
* Update label name
Signed-off-by: Xiao An <hac@zju.edu.cn>
* Avoid capitalizing private types
Signed-off-by: Xiao An <hac@zju.edu.cn>
* plugin/sign: a plugin that signs zones
Sign is a plugin that signs zone data (on disk). The README.md details
what exactly happens to should be accurate related to the code.
Signs are signed with a CSK, resigning and first time signing is all
handled by *sign* plugin.
Logging with a test zone looks something like this:
~~~ txt
[INFO] plugin/sign: Signing "miek.nl." because open plugin/sign/testdata/db.miek.nl.signed: no such file or directory
[INFO] plugin/sign: Signed "miek.nl." with key tags "59725" in 11.670985ms, saved in "plugin/sign/testdata/db.miek.nl.signed". Next: 2019-07-20T15:49:06.560Z
[INFO] plugin/file: Successfully reloaded zone "miek.nl." in "plugin/sign/testdata/db.miek.nl.signed" with serial 1563636548
[INFO] plugin/sign: Signing "miek.nl." because resign was: 10m0s ago
[INFO] plugin/sign: Signed "miek.nl." with key tags "59725" in 2.055895ms, saved in "plugin/sign/testdata/db.miek.nl.signed". Next: 2019-07-20T16:09:06.560Z
[INFO] plugin/file: Successfully reloaded zone "miek.nl." in "plugin/sign/testdata/db.miek.nl.signed" with serial 1563637748
~~~
Signed-off-by: Miek Gieben <miek@miek.nl>
* Adjust readme and remove timestamps
Signed-off-by: Miek Gieben <miek@miek.nl>
* Comment on the newline
Signed-off-by: Miek Gieben <miek@miek.nl>
* Update plugin/sign/README.md
Co-Authored-By: Michael Grosser <development@stp-ip.net>
* Add plugin for Azure DNS
Signed-off-by: darshanime <deathbullet@gmail.com>
* Rename AzureDNS plugin to Azure
Signed-off-by: darshanime <deathbullet@gmail.com>
* remove upstream from azure syntax
Signed-off-by: darshanime <deathbullet@gmail.com>
* Rename azure plugin block keynames
Signed-off-by: darshanime <deathbullet@gmail.com>
* Normalize zone name before lookup in zones
Signed-off-by: darshanime <deathbullet@gmail.com>
* Update import path for caddy
Signed-off-by: darshanime <deathbullet@gmail.com>
* normalize azure zone name only if required
Signed-off-by: darshanime <deathbullet@gmail.com>
* Add support for MX, SRV, TXT, records
Signed-off-by: darshanime <deathbullet@gmail.com>
* Add specs for new record types
Signed-off-by: darshanime <deathbullet@gmail.com>
* Use sequential updates for zones
Signed-off-by: darshanime <deathbullet@gmail.com>
* Add OWNERS file for azure plugin
Signed-off-by: darshanime <deathbullet@gmail.com>
* Rename imports for third party packages
Signed-off-by: darshanime <deathbullet@gmail.com>
* Capitalize values in README
Signed-off-by: darshanime <deathbullet@gmail.com>
* Shorten keys for azure plugin config
Signed-off-by: darshanime <deathbullet@gmail.com>
* Fixup readme for azure plugin
Signed-off-by: darshanime <deathbullet@gmail.com>
* Add any plugin
This adds the any plugin, a plain copy of coredns/any documented here
https://coredns.io/explugins/any/ as an external plugin.
Fixes: #2785
Signed-off-by: Miek Gieben <miek@miek.nl>
* Stickler bot nit
Signed-off-by: Miek Gieben <miek@miek.nl>
* plugin/cancel: add context cancelation plugin
Per review comments on #2704, move this into a plugin that gets called.
Add the most minimal plugin, tests and documenation.
Signed-off-by: Miek Gieben <miek@miek.nl>
* plugin/cache: add timeout option
review feedback: add option to set custom timeout.
Signed-off-by: Miek Gieben <miek@miek.nl>
* spelling
Signed-off-by: Miek Gieben <miek@miek.nl>
* plugin/grpc: New gRPC plugin
* some changes after the first review:
- remove healthcheck. gRPC already has this implicitly implemented
- some naming and stetic changes
- fix some comments
- other minor fixes
* plugin/grpc: New gRPC plugin
* some changes after the first review:
- remove healthcheck. gRPC already has this implicitly implemented
- some naming and stetic changes
- fix some comments
- other minor fixes
* add OWNERS file and change plugin order
* remove Rcode checker
Add a ready plugin that allows plugin to signal when they are ready.
Once a plugin is ready it is not queried again.
This uses same mechanism as the health plugin: each plugin needs to
implement an interface.
Implement readines for the *erratic* plugin to aid in testing.
Add README.md and tests moduled after the health plugin; which will be
relegated to just providing process health. In similar vein to health
this is a process wide setting.
With this Corefile:
~~~
. {
erratic
whoami
ready
}
bla {
erratic
whoami
}
~~~
ready will lead to:
~~~ sh
% curl localhost:8181/ready
% dig @localhost -p 1053 mx example.org
% curl localhost:8181/ready
OK%
~~~
Meanwhile CoreDNS logs:
~~~
.:1053
bla.:1053
2019-02-26T20:59:07.137Z [INFO] CoreDNS-1.3.1
2019-02-26T20:59:07.137Z [INFO] linux/amd64, go1.11.4,
CoreDNS-1.3.1
linux/amd64, go1.11.4,
2019-02-26T20:59:11.415Z [INFO] plugin/ready: Still waiting on: "erratic"
2019-02-26T20:59:13.510Z [INFO] plugin/ready: Still waiting on: "erratic"
~~~
*ready* can be used in multiple server blocks and will do the right
thing; query all those plugins from all server blocks for readiness.
This does a similar thing to the prometheus plugin.
Signed-off-by: Miek Gieben <miek@miek.nl>
* Add new plugin: external
This plugin works in conjunction with the kubernetes plugin and exports
ingress and LB addresses as DNS records. It bypasses backend.go and
backend_lookup.go flow because it is not needed.
README, tests are implemented. The tests only exercise the unit tests,
this has not been tested in any ci.
Signed-off-by: Miek Gieben <miek@miek.nl>
* Rename to k8s_external
Signed-off-by: Miek Gieben <miek@miek.nl>
* go gen
Signed-off-by: Miek Gieben <miek@miek.nl>
* New plugin: loop
Add a plugin that detects loops. It does this by sending an unique query
to our selves. If we see the query more than twice we stop the process.
If there isn't a loop, the plugin disables it self and becomes a noop
plugin.
Signed-off-by: Miek Gieben <miek@miek.nl>
This revert 17d807f0 and re-adds the metadata plugin as a plugin that
just sets a label to a value function.
Add package documentation on how to use the metadata package. Make it
clear that any caching is up to the Func implemented.
There are now - no in tree users. We could add the request metadata by
default under names that copy request.Request, i.e
request/ip - remote IP
request/port - remote port
Variables.go has been deleted.
Signed-off-by: Miek Gieben <miek@miek.nl>
Reloading should work (kill -TERM reload the coredns process), but a lot
of plugins can't handle it proper. Disable to reload plugin until we fix
(most) of the plugins
* Update vendor
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
* Add route53 plugin
This fix adds route53 plugin so that it is possible to
query route53 record through CoreDNS.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
This fix expose directives in dnsserver package, so that external
plugin developers could easily build customerized coredns+plugin
without changing the code base tree of coredns.
The following is an example that could bundle coredns+example,
in one simple file without modifying coredns codebase:
```
package main
import (
_ "github.com/coredns/example"
"github.com/coredns/coredns/coremain"
"github.com/coredns/coredns/core/dnsserver"
)
var directives = []string{
"example",
"log",
"errors",
...
...
...
"whoami",
"startup",
"shutdown",
}
func init() {
dnsserver.Directives = directives
}
func main() {
coremain.Run()
}
```
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
