feat(dnsdist): Allow RemoteLog(Response)Action to use global Server ID

Author: pieterlexis

pdns/dnsdistdist/dnsdist-actions-definitions.yml

@@ -278,7 +278,11 @@ The function will be invoked in a per-thread Lua state, without access to the gl
     - name: "server_id"
       type: "String"
       default: ""
-      description: "Set the Server Identity field"
+      description: "Set the value for the Server Identity field"
+    - name: "use_server_id"
+      type: "bool"
+      default: "false"
+      description: "Use the value of general.server_id for the Server Identity field. Overrides the value set with server_id"
     - name: "ip_encrypt_key"
       type: "String"
       default: ""

pdns/dnsdistdist/dnsdist-actions-factory.cc

@@ -28,6 +28,7 @@
 #include "dnsdist-actions-factory.hh"
 
 #include "config.h"
+#include "dnsdist-configuration.hh"
 #include "dnsdist.hh"
 #include "dnsdist-async.hh"
 #include "dnsdist-dnsparser.hh"
@@ -1607,7 +1608,7 @@ class RemoteLogAction : public DNSAction, public boost::noncopyable
 public:
   // this action does not stop the processing
   RemoteLogAction(RemoteLogActionConfiguration& config) :
-    d_tagsToExport(std::move(config.tagsToExport)), d_metas(std::move(config.metas)), d_logger(config.logger), d_alterFunc(std::move(config.alterQueryFunc)), d_serverID(config.serverID), d_ipEncryptKey(config.ipEncryptKey), d_ipEncryptMethod(config.ipEncryptMethod)
+    d_tagsToExport(std::move(config.tagsToExport)), d_metas(std::move(config.metas)), d_logger(config.logger), d_alterFunc(std::move(config.alterQueryFunc)), d_serverID(config.serverID), d_ipEncryptKey(config.ipEncryptKey), d_ipEncryptMethod(config.ipEncryptMethod), d_useServerID(config.useServerID)
   {
     if (!d_ipEncryptKey.empty() && d_ipEncryptMethod == "ipcrypt-pfx") {
       d_ipcrypt2 = pdns::ipcrypt2::IPCrypt2(pdns::ipcrypt2::IPCryptMethod::pfx, d_ipEncryptKey);
@@ -1625,7 +1626,9 @@ class RemoteLogAction : public DNSAction, public boost::noncopyable
     }
 
     DNSDistProtoBufMessage message(*dnsquestion);
-    if (!d_serverID.empty()) {
+    if (d_useServerID) {
+      message.setServerIdentity(dnsdist::configuration::getCurrentRuntimeConfiguration().d_server_id);
+    } else if (!d_serverID.empty()) {
       message.setServerIdentity(d_serverID);
     }
 
@@ -1675,6 +1678,7 @@ class RemoteLogAction : public DNSAction, public boost::noncopyable
   std::string d_ipEncryptKey;
   std::string d_ipEncryptMethod;
   std::optional<pdns::ipcrypt2::IPCrypt2> d_ipcrypt2{std::nullopt};
+  bool d_useServerID;
 };
 #endif /* DISABLE_PROTOBUF */
 
@@ -1873,7 +1877,7 @@ class RemoteLogResponseAction : public DNSResponseAction, public boost::noncopya
 public:
   // this action does not stop the processing
   RemoteLogResponseAction(RemoteLogActionConfiguration& config) :
-    d_tagsToExport(std::move(config.tagsToExport)), d_metas(std::move(config.metas)), d_logger(config.logger), d_alterFunc(std::move(config.alterResponseFunc)), d_serverID(config.serverID), d_ipEncryptKey(config.ipEncryptKey), d_ipEncryptMethod(config.ipEncryptMethod), d_exportExtendedErrorsToMeta(std::move(config.exportExtendedErrorsToMeta)), d_includeCNAME(config.includeCNAME), d_delay(config.delay)
+    d_tagsToExport(std::move(config.tagsToExport)), d_metas(std::move(config.metas)), d_logger(config.logger), d_alterFunc(std::move(config.alterResponseFunc)), d_serverID(config.serverID), d_ipEncryptKey(config.ipEncryptKey), d_ipEncryptMethod(config.ipEncryptMethod), d_exportExtendedErrorsToMeta(std::move(config.exportExtendedErrorsToMeta)), d_includeCNAME(config.includeCNAME), d_useServerID(config.useServerID), d_delay(config.delay)
   {
     if (!d_ipEncryptKey.empty() && d_ipEncryptMethod == "ipcrypt-pfx") {
       d_ipcrypt2 = pdns::ipcrypt2::IPCrypt2(pdns::ipcrypt2::IPCryptMethod::pfx, d_ipEncryptKey);
@@ -1890,7 +1894,9 @@ class RemoteLogResponseAction : public DNSResponseAction, public boost::noncopya
     }
 
     DNSDistProtoBufMessage message(*response, d_includeCNAME);
-    if (!d_serverID.empty()) {
+    if (d_useServerID) {
+      message.setServerIdentity(dnsdist::configuration::getCurrentRuntimeConfiguration().d_server_id);
+    } else if (!d_serverID.empty()) {
       message.setServerIdentity(d_serverID);
     }
 
@@ -1953,6 +1959,7 @@ class RemoteLogResponseAction : public DNSResponseAction, public boost::noncopya
   std::optional<pdns::ipcrypt2::IPCrypt2> d_ipcrypt2{std::nullopt};
   std::optional<std::string> d_exportExtendedErrorsToMeta{std::nullopt};
   bool d_includeCNAME;
+  bool d_useServerID{false};
   bool d_delay{false};
 };
 

pdns/dnsdistdist/dnsdist-actions-factory.hh

@@ -117,6 +117,7 @@ struct RemoteLogActionConfiguration
   std::optional<std::string> exportExtendedErrorsToMeta{std::nullopt};
   bool includeCNAME{false};
   bool delay{false};
+  bool useServerID{false};
 };
 std::shared_ptr<DNSAction> getRemoteLogAction(RemoteLogActionConfiguration& config);
 std::shared_ptr<DNSResponseAction> getRemoteLogResponseAction(RemoteLogActionConfiguration& config);

pdns/dnsdistdist/dnsdist-configuration-yaml.cc

@@ -1776,6 +1776,7 @@ std::shared_ptr<DNSActionWrapper> getRemoteLogAction(const RemoteLogActionConfig
   if (dnsdist::configuration::yaml::getLuaFunctionFromConfiguration(alterFunc, config.alter_function_name, config.alter_function_code, config.alter_function_file, "remote log action")) {
     actionConfig.alterQueryFunc = std::move(alterFunc);
   }
+  actionConfig.useServerID = config.use_server_id;
   auto action = dnsdist::actions::getRemoteLogAction(actionConfig);
   return newDNSActionWrapper(std::move(action), config.name);
 #endif
@@ -1813,6 +1814,7 @@ std::shared_ptr<DNSResponseActionWrapper> getRemoteLogResponseAction(const Remot
     actionConfig.alterResponseFunc = std::move(alterFunc);
   }
   actionConfig.delay = config.delay;
+  actionConfig.useServerID = config.use_server_id;
   auto action = dnsdist::actions::getRemoteLogResponseAction(actionConfig);
   return newDNSResponseActionWrapper(std::move(action), config.name);
 #endif

pdns/dnsdistdist/dnsdist-lua-actions.cc

@@ -28,6 +28,7 @@
 #include "dnsdist-protobuf.hh"
 #include "dnsdist-rule-chains.hh"
 #include "dnstap.hh"
+#include "dolog.hh"
 #include "remote_logger.hh"
 #include <memory>
 #include <optional>
@@ -267,7 +268,7 @@ void setupLuaActions(LuaContext& luaCtx)
   // Used for both RemoteLogAction and RemoteLogResponseAction
   static const std::array<std::string, 2> s_validIpEncryptMethods = {"legacy", "ipcrypt-pfx"};
 
-  luaCtx.writeFunction("RemoteLogAction", [](std::shared_ptr<RemoteLoggerInterface> logger, std::optional<dnsdist::actions::ProtobufAlterFunction> alterFunc, std::optional<LuaAssociativeTable<std::string>> vars, std::optional<LuaAssociativeTable<std::string>> metas) {
+  luaCtx.writeFunction("RemoteLogAction", [](std::shared_ptr<RemoteLoggerInterface> logger, std::optional<dnsdist::actions::ProtobufAlterFunction> alterFunc, std::optional<LuaAssociativeTable<boost::variant<std::string,bool>>> vars, std::optional<LuaAssociativeTable<std::string>> metas) {
     if (logger) {
       // avoids potentially-evaluated-expression warning with clang.
       RemoteLoggerInterface& remoteLoggerRef = *logger;
@@ -283,10 +284,25 @@ void setupLuaActions(LuaContext& luaCtx)
     if (alterFunc) {
       config.alterQueryFunc = std::move(*alterFunc);
     }
-    getOptionalValue<std::string>(vars, "serverID", config.serverID);
-    getOptionalValue<std::string>(vars, "ipEncryptKey", config.ipEncryptKey);
-    getOptionalValue<std::string>(vars, "ipEncryptMethod", config.ipEncryptMethod);
-    getOptionalValue<std::string>(vars, "exportTags", tags);
+    if (getOptionalValue<std::string>(vars, "serverID", config.serverID) < 0) {
+      throw std::runtime_error("serverID in RemoteLogAction is not a string");
+    }
+    if (getOptionalValue<std::string>(vars, "ipEncryptKey", config.ipEncryptKey) < 0) {
+      throw std::runtime_error("ipEncryptKey in RemoteLogAction is not a string");
+    }
+    if (getOptionalValue<std::string>(vars, "ipEncryptMethod", config.ipEncryptMethod) < 0) {
+      throw std::runtime_error("ipEncryptMethod in RemoteLogAction is not a string");
+    }
+    if (getOptionalValue<std::string>(vars, "exportTags", tags) < 0) {
+      throw std::runtime_error("exportTags in RemoteLogAction is not a string");
+    }
+    if (getOptionalValue<bool>(vars, "useServerID", config.useServerID) < 0) {
+      throw std::runtime_error("useServerID in RemoteLogAction is not a string");
+    }
+
+    if (config.useServerID && !config.serverID.empty()) {
+      warnlog("useServerID and serverID set in RemoteLogAction configuration. value for serverID will not be used");
+    }
 
     if (metas) {
       for (const auto& [key, value] : *metas) {
@@ -314,7 +330,7 @@ void setupLuaActions(LuaContext& luaCtx)
     return dnsdist::actions::getRemoteLogAction(config);
   });
 
-  luaCtx.writeFunction("RemoteLogResponseAction", [](std::shared_ptr<RemoteLoggerInterface> logger, std::optional<dnsdist::actions::ProtobufAlterResponseFunction> alterFunc, std::optional<bool> includeCNAME, std::optional<LuaAssociativeTable<std::string>> vars, std::optional<LuaAssociativeTable<std::string>> metas, std::optional<bool> delay) {
+  luaCtx.writeFunction("RemoteLogResponseAction", [](std::shared_ptr<RemoteLoggerInterface> logger, std::optional<dnsdist::actions::ProtobufAlterResponseFunction> alterFunc, std::optional<bool> includeCNAME, std::optional<LuaAssociativeTable<boost::variant<std::string,bool>>> vars, std::optional<LuaAssociativeTable<std::string>> metas, std::optional<bool> delay) {
     if (logger) {
       // avoids potentially-evaluated-expression warning with clang.
       RemoteLoggerInterface& remoteLoggerRef = *logger;
@@ -331,11 +347,28 @@ void setupLuaActions(LuaContext& luaCtx)
       config.alterResponseFunc = std::move(*alterFunc);
     }
     config.includeCNAME = includeCNAME ? *includeCNAME : false;
-    getOptionalValue<std::string>(vars, "serverID", config.serverID);
-    getOptionalValue<std::string>(vars, "ipEncryptKey", config.ipEncryptKey);
-    getOptionalValue<std::string>(vars, "ipEncryptMethod", config.ipEncryptMethod);
-    getOptionalValue<std::string>(vars, "exportTags", tags);
-    getOptionalValue<std::string>(vars, "exportExtendedErrorsToMeta", config.exportExtendedErrorsToMeta);
+    if (getOptionalValue<std::string>(vars, "serverID", config.serverID) < 0) {
+      throw std::runtime_error("serverID in RemoteLogResponseAction is not a string");
+    }
+    if (getOptionalValue<std::string>(vars, "ipEncryptKey", config.ipEncryptKey) < 0) {
+      throw std::runtime_error("ipEncryptKey in RemoteLogResponseAction is not a string");
+    }
+    if (getOptionalValue<std::string>(vars, "ipEncryptMethod", config.ipEncryptMethod) < 0) {
+      throw std::runtime_error("ipEncryptMethod in RemoteLogResponseAction is not a string");
+    }
+    if (getOptionalValue<std::string>(vars, "exportTags", tags) < 0) {
+      throw std::runtime_error("exportTags in RemoteLogResponseAction is not a string");
+    }
+    if (getOptionalValue<std::string>(vars, "exportExtendedErrorsToMeta", config.exportExtendedErrorsToMeta) < 0) {
+      throw std::runtime_error("exportExtendedErrorsToMeta in RemoteLogResponseAction is not a string");
+    }
+    if (getOptionalValue<bool>(vars, "useServerID", config.useServerID) < 0) {
+      throw std::runtime_error("useServerID in RemoteLogResponseAction is not a string");
+    }
+
+    if (config.useServerID && !config.serverID.empty()) {
+      warnlog("useServerID and serverID set in RemoteLogResponseAction configuration. value for serverID will not be used");
+    }
 
     if (metas) {
       for (const auto& [key, value] : *metas) {

pdns/dnsdistdist/dnsdist-response-actions-definitions.yml

@@ -151,7 +151,11 @@ The function will be invoked in a per-thread Lua state, without access to the gl
     - name: "server_id"
       type: "String"
       default: ""
-      description: "Set the Server Identity field"
+      description: "Set the value of the Server Identity field"
+    - name: "use_server_id"
+      type: "bool"
+      default: "false"
+      description: "Use the general.server_id value to set the Server Identity field"
     - name: "ip_encrypt_key"
       type: "String"
       default: ""

regression-tests.dnsdist/test_Protobuf.py

@@ -1473,3 +1473,147 @@ def testProtobuf(self):
 
         self.assertTrue(gotUDP)
         self.assertTrue(gotTCP)
+
+class TestProtobufGlobalServerIDYaml(TestYamlProtobuf):
+    _yaml_config_template = """---
+binds:
+  - listen_address: "127.0.0.1:%d"
+    reuseport: true
+    protocol: Do53
+    threads: 2
+
+backends:
+  - address: "127.0.0.1:%d"
+    protocol: Do53
+
+remote_logging:
+  protobuf_loggers:
+    - name: "my-logger"
+      address: "127.0.0.1:%d"
+      timeout: 1
+
+general:
+  server_id: "%s"
+
+query_rules:
+  - name: "my-rule"
+    selector:
+      type: "All"
+    action:
+      type: "RemoteLog"
+      logger_name: "my-logger"
+      use_server_id: true
+      export_tags:
+        - "tag-1"
+        - "tag-2"
+"""
+
+class TestProtobufGlobalServerIDLua(DNSDistProtobufTest):
+    _config_params = ['_protobufServerID', '_testServerPort', '_protobufServerPort']
+    _config_template = """
+    setServerID("%s")
+    luasmn = newSuffixMatchNode()
+    luasmn:add(newDNSName('lua.protobuf.tests.powerdns.com.'))
+
+    function alterProtobufResponse(dq, protobuf)
+      if luasmn:check(dq.qname) then
+        requestor = newCA(tostring(dq.remoteaddr))		-- called by testLuaProtobuf()
+        if requestor:isIPv4() then
+          requestor:truncate(24)
+        else
+          requestor:truncate(56)
+        end
+        protobuf:setRequestor(requestor)
+
+        local tableTags = {}
+        table.insert(tableTags, "TestLabel1,TestData1")
+        table.insert(tableTags, "TestLabel2,TestData2")
+
+        protobuf:setTagArray(tableTags)
+
+        protobuf:setTag('TestLabel3,TestData3')
+
+        protobuf:setTag("Response,456")
+
+      else
+
+        local tableTags = {} 					-- called by testProtobuf()
+        table.insert(tableTags, "TestLabel1,TestData1")
+        table.insert(tableTags, "TestLabel2,TestData2")
+        protobuf:setTagArray(tableTags)
+
+        protobuf:setTag('TestLabel3,TestData3')
+
+        protobuf:setTag("Response,456")
+
+      end
+    end
+
+    function alterProtobufQuery(dq, protobuf)
+
+      if luasmn:check(dq.qname) then
+        requestor = newCA(tostring(dq.remoteaddr))		-- called by testLuaProtobuf()
+        if requestor:isIPv4() then
+          requestor:truncate(24)
+        else
+          requestor:truncate(56)
+        end
+        protobuf:setRequestor(requestor)
+
+        local tableTags = {}
+        tableTags = dq:getTagArray()				-- get table from DNSQuery
+
+        local tablePB = {}
+          for k, v in pairs( tableTags) do
+          table.insert(tablePB, k .. "," .. v)
+        end
+
+        protobuf:setTagArray(tablePB)				-- store table in protobuf
+        protobuf:setTag("Query,123")				-- add another tag entry in protobuf
+
+        protobuf:setResponseCode(DNSRCode.NXDOMAIN)        	-- set protobuf response code to be NXDOMAIN
+
+        local strReqName = tostring(dq.qname)		  	-- get request dns name
+
+        protobuf:setProtobufResponseType()			-- set protobuf to look like a response and not a query, with 0 default time
+
+        blobData = '\127' .. '\000' .. '\000' .. '\002'		-- 127.0.0.2, note: lua 5.1 can only embed decimal not hex
+
+        protobuf:addResponseRR(strReqName, 1, 1, 123, blobData) -- add a RR to the protobuf
+
+        protobuf:setBytes(65)					-- set the size of the query to confirm in checkProtobufBase
+
+      else
+
+        local tableTags = {}                                    -- called by testProtobuf()
+        table.insert(tableTags, "TestLabel1,TestData1")
+        table.insert(tableTags, "TestLabel2,TestData2")
+
+        protobuf:setTagArray(tableTags)
+        protobuf:setTag('TestLabel3,TestData3')
+        protobuf:setTag("Query,123")
+
+      end
+    end
+
+    function alterLuaFirst(dq)					-- called when dnsdist receives new request
+      local tt = {}
+      tt["TestLabel1"] = "TestData1"
+      tt["TestLabel2"] = "TestData2"
+
+      dq:setTagArray(tt)
+
+      dq:setTag("TestLabel3","TestData3")
+      return DNSAction.None, ""				-- continue to the next rule
+    end
+
+    newServer{address="127.0.0.1:%d", useClientSubnet=true}
+    rl = newRemoteLogger('127.0.0.1:%d')
+
+    addAction(AllRule(), LuaAction(alterLuaFirst))							-- Add tags to DNSQuery first
+
+    addAction(AllRule(), RemoteLogAction(rl, alterProtobufQuery, {useServerID=true}))				-- Send protobuf message before lookup
+
+    addResponseAction(AllRule(), RemoteLogResponseAction(rl, alterProtobufResponse, true, {useServerID=true}))	-- Send protobuf message after lookup
+
+    """