diff options
| author |  George Shammas <georgyo@gmail.com>
| 2021-02-01 09:52:23 -0500 |
|---|---|---|
| committer |  GitHub <noreply@github.com>
| 2021-02-01 06:52:23 -0800 |
| commit | 117a389e40832cdbee69bd9daa04ca35611082ff (patch) | |
| tree | 93303c8a557e3118aa529a5742053a1a9a47cb05 /plugin/acl/acl_test.go | |
| parent | d289b4ea2623dcd0dd13ab7ed88ab764a7408f91 (diff) | |
| download | coredns-117a389e40832cdbee69bd9daa04ca35611082ff.tar.gz coredns-117a389e40832cdbee69bd9daa04ca35611082ff.tar.zst coredns-117a389e40832cdbee69bd9daa04ca35611082ff.zip | |
plugin/acl: add the ability to filter records (#4389)
Currently ACLs only allow for allow and block, however it isn't
always desirable to set the status code to REFUSED. Often times
you want to completely hide the fact that those records even exist.
Adding the ability to acl to filter results makes it significantly
harder for a third party to know that the records are being masked.
Signed-off-by: George Shammas <george@shamm.as>
Diffstat (limited to 'plugin/acl/acl_test.go')
| -rw-r--r-- | plugin/acl/acl_test.go | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/plugin/acl/acl_test.go b/plugin/acl/acl_test.go index bf0c6f6f7..4c6df95e5 100644 --- a/plugin/acl/acl_test.go +++ b/plugin/acl/acl_test.go @@ -146,6 +146,34 @@ func TestACLServeDNS(t *testing.T) { false, }, { + "Filter 1 FILTERED", + `acl example.org { + filter type A net 192.168.0.0/16 + }`, + []string{}, + args{ + "www.example.org.", + "192.168.0.2", + dns.TypeA, + }, + dns.RcodeSuccess, + false, + }, + { + "Filter 1 ALLOWED", + `acl example.org { + filter type A net 192.168.0.0/16 + }`, + []string{}, + args{ + "www.example.org.", + "192.167.0.2", + dns.TypeA, + }, + dns.RcodeSuccess, + false, + }, + { "Whitelist 1 ALLOWED", `acl example.org { allow net 192.168.0.0/16 |