admin/gluetun
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added DOT_PRIVATE_ADDRESS environment variable

Browse Source
This commit is contained in:
Quentin McGaw (desktop)
2020-02-08 21:28:33 +00:00
parent 0264f8726a
commit a76aa5276d
5 changed files with 13 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Dockerfile
View File

@@ -36,6 +36,7 @@ ENV USER= \
REGION="CA Montreal" \ REGION="CA Montreal" \
DOT=on \ DOT=on \
DOT_PROVIDERS=cloudflare \ DOT_PROVIDERS=cloudflare \
DOT_PRIVATE_ADDRESS=127.0.0.1/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,::1/128,fc00::/7,fe80::/10,::ffff:0:0/96 \
DOT_VERBOSITY=1 \ DOT_VERBOSITY=1 \
DOT_VERBOSITY_DETAILS=0 \ DOT_VERBOSITY_DETAILS=0 \
DOT_VALIDATION_LOGLEVEL=0 \ DOT_VALIDATION_LOGLEVEL=0 \

1
README.md
View File

@@ -129,6 +129,7 @@ docker run --rm --network=container:pia alpine:3.10 wget -qO- https://ipinfo.io
| `DOT` | `on` | `on` or `off`, to activate DNS over TLS to 1.1.1.1 | | `DOT` | `on` | `on` or `off`, to activate DNS over TLS to 1.1.1.1 |
| `DOT_PROVIDERS` | `cloudflare` | Comma delimited list of DNS over TLS providers from `cloudflare`, `google`, `quad9`, `quadrant`, `cleanbrowsing`, `securedns`, `libredns` | | `DOT_PROVIDERS` | `cloudflare` | Comma delimited list of DNS over TLS providers from `cloudflare`, `google`, `quad9`, `quadrant`, `cleanbrowsing`, `securedns`, `libredns` |
| `DOT_CACHING` | `on` | Unbound caching feature, `on` or `off` | | `DOT_CACHING` | `on` | Unbound caching feature, `on` or `off` |
| `DOT_PRIVATE_ADDRESS` | `127.0.0.1/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,::1/128,fc00::/7,fe80::/10,::ffff:0:0/96` | Prevent hostnames to resolve to these IP addresses, to prevent DNS rebinding attacks |
| `DOT_VERBOSITY` | `1` | Unbound verbosity level from `0` to `5` (full debug) | | `DOT_VERBOSITY` | `1` | Unbound verbosity level from `0` to `5` (full debug) |
| `DOT_VERBOSITY_DETAILS` | `0` | Unbound details verbosity level from `0` to `4` | | `DOT_VERBOSITY_DETAILS` | `0` | Unbound details verbosity level from `0` to `4` |
| `DOT_VALIDATION_LOGLEVEL` | `0` | Unbound validation log level from `0` to `2` | | `DOT_VALIDATION_LOGLEVEL` | `0` | Unbound validation log level from `0` to `2` |

9
internal/params/dns.go
View File

@@ -107,3 +107,12 @@ func (p *paramsReader) GetDNSOverTLSCaching() (caching bool, err error) {
return p.envParams.GetOnOff("DOT_CACHING") return p.envParams.GetOnOff("DOT_CACHING")
} }
// GetDNSOverTLSPrivateAddresses obtains if Unbound caching should be enable or not
// from the environment variable DOT_PRIVATE_ADDRESS
func (p *paramsReader) GetDNSOverTLSPrivateAddresses() (privateAddresses []string) {
s, _ := p.envParams.GetEnv("DOT_PRIVATE_ADDRESS")
for _, s := range strings.Split(s, ",") {
privateAddresses = append(privateAddresses, s)
}
return privateAddresses
}

1
internal/params/params.go
View File

@@ -23,6 +23,7 @@ type ParamsReader interface {
GetDNSSurveillanceBlocking() (blocking bool, err error) GetDNSSurveillanceBlocking() (blocking bool, err error)
GetDNSAdsBlocking() (blocking bool, err error) GetDNSAdsBlocking() (blocking bool, err error)
GetDNSUnblockedHostnames() (hostnames []string, err error) GetDNSUnblockedHostnames() (hostnames []string, err error)
GetDNSOverTLSPrivateAddresses() (privateAddresses []string)
// Firewall getters // Firewall getters
GetExtraSubnets() (extraSubnets []net.IPNet, err error) GetExtraSubnets() (extraSubnets []net.IPNet, err error)

12
internal/settings/dns.go
View File

@@ -102,16 +102,6 @@ func GetDNSSettings(params params.ParamsReader) (settings DNS, err error) {
if err != nil { if err != nil {
return settings, err return settings, err
} }
settings.PrivateAddresses = []string{ // TODO make env variable settings.PrivateAddresses = params.GetDNSOverTLSPrivateAddresses()
"127.0.0.1/8",
"10.0.0.0/8",
"172.16.0.0/12",
"192.168.0.0/16",
"169.254.0.0/16",
"::1/128",
"fc00::/7",
"fe80::/10",
"::ffff:0:0/96",
}
return settings, nil return settings, nil
} }