WIP: custom DoH request validation

Signed-off-by: Johnny Bergström <johnny@klaudify.se>

core/dnsserver/config.go

@@ -3,6 +3,7 @@ package dnsserver
 import (
 	"crypto/tls"
 	"fmt"
+	"net/http"
 
 	"github.com/coredns/caddy"
 	"github.com/coredns/coredns/plugin"
@@ -31,6 +32,10 @@ type Config struct {
 	// DNS-over-TLS or DNS-over-gRPC.
 	Transport string
 
+	// If this function is not nil it will be used to inspect and validate
+	// HTTP requests.
+	HTTPRequestValidateFunc func(*http.Request) bool
+
 	// If this function is not nil it will be used to further filter access
 	// to this handler. The primary use is to limit access to a reverse zone
 	// on a non-octet boundary, i.e. /17

core/dnsserver/server_https.go

@@ -20,9 +20,10 @@ import (
 // ServerHTTPS represents an instance of a DNS-over-HTTPS server.
 type ServerHTTPS struct {
 	*Server
-	httpsServer *http.Server
-	listenAddr  net.Addr
-	tlsConfig   *tls.Config
+	httpsServer  *http.Server
+	listenAddr   net.Addr
+	tlsConfig    *tls.Config
+	validRequest func(*http.Request) bool
 }
 
 // NewServerHTTPS returns a new CoreDNS GRPC server and compiles all plugins in to it.
@@ -45,12 +46,23 @@ func NewServerHTTPS(addr string, group []*Config) (*ServerHTTPS, error) {
 	// or the upgrade won't happen.
 	tlsConfig.NextProtos = []string{"h2", "http/1.1"}
 
+	// Use a custom request validation func or use the standard DoH path check.
+	var validator func(*http.Request) bool
+	for _, conf := range s.zones {
+		validator = conf.HTTPRequestValidateFunc
+	}
+	if validator == nil {
+		validator = func(r *http.Request) bool { return r.URL.Path == doh.Path }
+	}
+
 	srv := &http.Server{
 		ReadTimeout:  5 * time.Second,
 		WriteTimeout: 10 * time.Second,
 		IdleTimeout:  120 * time.Second,
 	}
-	sh := &ServerHTTPS{Server: s, tlsConfig: tlsConfig, httpsServer: srv}
+	sh := &ServerHTTPS{
+		Server: s, tlsConfig: tlsConfig, httpsServer: srv, validRequest: validator,
+	}
 	sh.httpsServer.Handler = sh
 
 	return sh, nil
@@ -114,7 +126,7 @@ func (s *ServerHTTPS) Stop() error {
 // chain, converts it back and write it to the client.
 func (s *ServerHTTPS) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
-	if r.URL.Path != doh.Path {
+	if !s.validRequest(r) {
 		http.Error(w, "", http.StatusNotFound)
 		return
 	}