sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-13 18:29:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Anonymize single-label DNS zones in debug bundles

Browse Source
This commit is contained in:
Viktor Liu
2026-09-04 07:10:57 +02:00
parent 798e4a0546
commit 70d16d7987
6 changed files with 259 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/internal/debug/debug.go
+5 -4
View File
@@ -1551,7 +1551,7 @@ func anonymizeRoute(route *mgmProto.Route, anonymizer *anonymize.Anonymizer) {
}
for i, domain := range route.Domains {
route.Domains[i] = anonymizer.AnonymizeDomain(domain)
route.Domains[i] = anonymizer.AnonymizeDomainName(domain)
}
route.NetID = anonymizer.AnonymizeString(route.NetID)
@@ -1583,20 +1583,21 @@ func anonymizeBundleGenerators(servers []*mgmProto.NameServer, anonymizer *anony
func anonymizeDomains(domains []string, anonymizer *anonymize.Anonymizer) {
for i, domain := range domains {
domains[i] = anonymizer.AnonymizeDomain(domain)
domains[i] = anonymizer.AnonymizeDomainName(domain)
}
}
func anonymizeCustomZones(zones []*mgmProto.CustomZone, anonymizer *anonymize.Anonymizer) {
for _, zone := range zones {
zone.Domain = anonymizer.AnonymizeDomain(zone.Domain)
// The zone goes first: its records are then keyed on it.
zone.Domain = anonymizer.AnonymizeDomainName(zone.Domain)
anonymizeRecords(zone.Records, anonymizer)
}
}
func anonymizeRecords(records []*mgmProto.SimpleRecord, anonymizer *anonymize.Anonymizer) {
for _, record := range records {
record.Name = anonymizer.AnonymizeDomain(record.Name)
record.Name = anonymizer.AnonymizeDomainName(record.Name)
anonymizeRData(record, anonymizer)
}
}
client/internal/debug/debug_test.go
+46
View File
@@ -447,6 +447,52 @@ func TestAnonymizeNetworkMap(t *testing.T) {
}
}
// TestAnonymizeNetworkMap_SingleLabelZone covers the shape a real bundle
// carried: a custom zone named by a single label, alongside a nameserver group
// whose match domain is an ordinary two-label domain. The single-label zone
// used to pass through in the clear while its own records were anonymized.
func TestAnonymizeNetworkMap_SingleLabelZone(t *testing.T) {
networkMap := &mgmProto.NetworkMap{
DNSConfig: &mgmProto.DNSConfig{
NameServerGroups: []*mgmProto.NameServerGroup{
{
NameServers: []*mgmProto.NameServer{{IP: "203.0.113.53"}},
Domains: []string{"example.net"},
},
},
CustomZones: []*mgmProto.CustomZone{
{
Domain: "corp.",
Records: []*mgmProto.SimpleRecord{
{Name: "test.corp.", Type: 1, RData: "203.0.113.10"},
{Name: "app.corp.", Type: 1, RData: "203.0.113.10"},
},
},
},
},
Routes: []*mgmProto.Route{
{Network: "203.0.113.0/24", Domains: []string{"corp"}, NetID: "net-1"},
},
}
anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
require.NoError(t, anonymizeNetworkMap(networkMap, anonymizer), "anonymize the network map")
zone := networkMap.DNSConfig.CustomZones[0]
assert.NotContains(t, zone.Domain, "corp", "the single-label zone name should not survive")
assert.Regexp(t, `^anon-[a-zA-Z0-9]+\.domain\.$`, zone.Domain, "the zone should be replaced by an anon domain, trailing dot kept")
for _, record := range zone.Records {
assert.NotContains(t, record.Name, "corp", "a record name should not carry the original zone")
assert.True(t, strings.HasSuffix(record.Name, "."+zone.Domain),
"record %q should sit under the anonymized zone %q", record.Name, zone.Domain)
}
assert.NotContains(t, networkMap.DNSConfig.NameServerGroups[0].Domains[0], "example",
"the nameserver match domain should not survive")
assert.NotContains(t, networkMap.Routes[0].Domains[0], "corp", "a route domain should not survive")
}
func TestIsSensitiveEnvVar(t *testing.T) {
tests := []struct {
key string