dnsdist: Restrict remote connection to the console via an ACL #6399
Conversation
pdns/dnsdist.cc
Outdated
| @@ -2264,6 +2239,10 @@ try | |||
| g_ACL.setState(acl); | |||
| } | |||
|
|
|||
| auto consoleACL = g_consoleACL.getCopy(); | |||
| consoleACL.addMask("127.0.0.1/8"); | |||
pieterlexis
Mar 27, 2018
Member
For completeness-sake, maybe we should add ::1/128 here as well?
For completeness-sake, maybe we should add ::1/128 here as well?
zeha
Mar 27, 2018
Collaborator
yes please, various things default to ::1 now...
yes please, various things default to ::1 now...
rgacogne
Mar 27, 2018
Author
Member
Makes sense!
Makes sense!
| @@ -205,6 +229,10 @@ Access Control Lists | |||
|
|
|||
| :param {str} netmasks: A table of CIDR netmask, e.g. ``{"192.0.2.0/24", "2001:DB8:14::/56"}``. Without a subnetmask, only the specific address is allowed. | |||
|
|
|||
| .. function:: showACL() | |||
|
|
|||
| Print a list of all allowed netmasks. | |||
zeha
Mar 27, 2018
Collaborator
this should probably say what this ACL is used for...
this should probably say what this ACL is used for...
rgacogne
Mar 27, 2018
Author
Member
Right, I'll write a few words!
Right, I'll write a few words!
|
Added |
|
A test would be nice. e.g. setting the acl to 127.0.0.1 and attempting to connect from 127.0.0.2? |
|
Regression tests added (the second version is even consistent :))! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Short description
This PR adds an ACL to restrict remote connection to the console, only allowing local connections by default. Please note that this is a breaking change from previous versions, where using any non-loopback address allowed remote connections, although the secret key was still required provided that encryption had been enabled.
Closes #4654.
Checklist
I have: