Resolve trusted proxy host names to all available A/AAAA records

extensions/vertx-http/deployment/pom.xml

@@ -12,6 +12,10 @@
     <artifactId>quarkus-vertx-http-deployment</artifactId>
     <name>Quarkus - Vert.x - HTTP - Deployment</name>
 
+    <properties>
+        <apacheds-protocol-dns.version>2.0.0-M23</apacheds-protocol-dns.version>
+    </properties>
+
     <dependencies>
         <dependency>
             <groupId>io.quarkus</groupId>
@@ -139,6 +143,12 @@
             <artifactId>smallrye-certificate-generator-junit5</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.apache.directory.server</groupId>
+            <artifactId>apacheds-protocol-dns</artifactId>
+            <version>${apacheds-protocol-dns.version}</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>

extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/proxy/TrustedForwarderDnsResolveTest.java

@@ -0,0 +1,55 @@
+package io.quarkus.vertx.http.proxy;
+
+import org.hamcrest.Matchers;
+import org.jboss.shrinkwrap.api.asset.StringAsset;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+
+import io.quarkus.test.QuarkusUnitTest;
+import io.quarkus.vertx.http.ForwardedHandlerInitializer;
+import io.quarkus.vertx.http.proxy.fakedns.DnameRecordEncoder;
+import io.quarkus.vertx.http.proxy.fakedns.DnsMessageEncoder;
+import io.quarkus.vertx.http.proxy.fakedns.FakeDNSServer;
+import io.restassured.RestAssured;
+
+public class TrustedForwarderDnsResolveTest {
+
+    private FakeDNSServer dnsServer;
+
+    @RegisterExtension
+    static final QuarkusUnitTest config = new QuarkusUnitTest()
+            .withApplicationRoot((jar) -> jar
+                    .addClasses(ForwardedHandlerInitializer.class, DnameRecordEncoder.class, DnsMessageEncoder.class,
+                            FakeDNSServer.class)
+                    .addAsResource(new StringAsset("quarkus.http.proxy.proxy-address-forwarding=true\n" +
+                            "quarkus.http.proxy.allow-forwarded=true\n" +
+                            "quarkus.http.proxy.enable-forwarded-host=true\n" +
+                            "quarkus.http.proxy.enable-forwarded-prefix=true\n" +
+                            "quarkus.vertx.resolver.servers=127.0.0.1:53530\n" +
+                            "quarkus.http.proxy.trusted-proxies=trusted.example.com"),
+                            "application.properties"));
+
+    @BeforeEach
+    public void setUp() throws Exception {
+        dnsServer = new FakeDNSServer();
+        dnsServer.start();
+    }
+
+    @AfterEach
+    public void tearDown() {
+        dnsServer.stop();
+    }
+
+    @Test
+    public void testTrustedProxyResolved() {
+        dnsServer.addRecordsToStore("trusted.example.com", "127.0.0.3", "127.0.0.2", "127.0.0.1");
+        RestAssured.given()
+                .header("Forwarded", "proto=http;for=backend2:5555;host=somehost2")
+                .get("/path")
+                .then()
+                .body(Matchers.equalTo("http|somehost2|backend2:5555|/path|http://somehost2/path"));
+    }
+
+}

extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/proxy/fakedns/DnameRecordEncoder.java

@@ -0,0 +1,14 @@
+package io.quarkus.vertx.http.proxy.fakedns;
+
+import org.apache.directory.server.dns.io.encoder.ResourceRecordEncoder;
+import org.apache.directory.server.dns.messages.ResourceRecord;
+import org.apache.directory.server.dns.store.DnsAttribute;
+import org.apache.mina.core.buffer.IoBuffer;
+
+public class DnameRecordEncoder extends ResourceRecordEncoder {
+
+    protected void putResourceRecordData(IoBuffer byteBuffer, ResourceRecord record) {
+        String domainName = record.get(DnsAttribute.DOMAIN_NAME);
+        putDomainName(byteBuffer, domainName);
+    }
+}

extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/proxy/fakedns/DnsMessageEncoder.java

@@ -0,0 +1,198 @@
+package io.quarkus.vertx.http.proxy.fakedns;
+
+import java.io.IOException;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ *
+ */
+import org.apache.directory.server.dns.io.encoder.*;
+import org.apache.directory.server.dns.messages.DnsMessage;
+import org.apache.directory.server.dns.messages.MessageType;
+import org.apache.directory.server.dns.messages.OpCode;
+import org.apache.directory.server.dns.messages.QuestionRecord;
+import org.apache.directory.server.dns.messages.RecordType;
+import org.apache.directory.server.dns.messages.ResourceRecord;
+import org.apache.directory.server.dns.messages.ResponseCode;
+import org.apache.directory.server.i18n.I18n;
+import org.apache.mina.core.buffer.IoBuffer;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * An encoder for DNS messages. The primary usage of the DnsMessageEncoder is
+ * to call the <code>encode(ByteBuffer, DnsMessage)</code> method which will
+ * write the message to the outgoing ByteBuffer according to the DnsMessage
+ * encoding in RFC-1035.
+ *
+ * @author <a href="mailto:[email protected]">Apache Directory Project</a>
+ * @version $Rev$, $Date$
+ */
+public class DnsMessageEncoder {
+    /** the log for this class */
+    private static final Logger log = LoggerFactory.getLogger(DnsMessageEncoder.class);
+
+    /**
+     * A Hashed Adapter mapping record types to their encoders.
+     */
+    private static final Map<RecordType, RecordEncoder> DEFAULT_ENCODERS;
+
+    static {
+        Map<RecordType, RecordEncoder> map = new HashMap<RecordType, RecordEncoder>();
+
+        map.put(RecordType.SOA, new StartOfAuthorityRecordEncoder());
+        map.put(RecordType.A, new AddressRecordEncoder());
+        map.put(RecordType.NS, new NameServerRecordEncoder());
+        map.put(RecordType.CNAME, new CanonicalNameRecordEncoder());
+        map.put(RecordType.PTR, new PointerRecordEncoder());
+        map.put(RecordType.MX, new MailExchangeRecordEncoder());
+        map.put(RecordType.SRV, new ServerSelectionRecordEncoder());
+        map.put(RecordType.TXT, new TextRecordEncoder());
+        map.put(RecordType.DNAME, new DnameRecordEncoder());
+
+        DEFAULT_ENCODERS = Collections.unmodifiableMap(map);
+    }
+
+    /**
+     * Encodes the {@link DnsMessage} into the {@link IoBuffer}.
+     *
+     * @param byteBuffer
+     * @param message
+     */
+    public void encode(IoBuffer byteBuffer, DnsMessage message) {
+        byteBuffer.putShort((short) message.getTransactionId());
+
+        byte header = (byte) 0x00;
+        header |= encodeMessageType(message.getMessageType());
+        header |= encodeOpCode(message.getOpCode());
+        header |= encodeAuthoritativeAnswer(message.isAuthoritativeAnswer());
+        header |= encodeTruncated(message.isTruncated());
+        header |= encodeRecursionDesired(message.isRecursionDesired());
+        byteBuffer.put(header);
+
+        header = (byte) 0x00;
+        header |= encodeRecursionAvailable(message.isRecursionAvailable());
+        header |= encodeResponseCode(message.getResponseCode());
+        byteBuffer.put(header);
+
+        byteBuffer
+                .putShort((short) (message.getQuestionRecords() != null ? message.getQuestionRecords().size() : 0));
+        byteBuffer.putShort((short) (message.getAnswerRecords() != null ? message.getAnswerRecords().size() : 0));
+        byteBuffer.putShort((short) (message.getAuthorityRecords() != null ? message.getAuthorityRecords().size()
+                : 0));
+        byteBuffer.putShort((short) (message.getAdditionalRecords() != null ? message.getAdditionalRecords().size()
+                : 0));
+
+        putQuestionRecords(byteBuffer, message.getQuestionRecords());
+        putResourceRecords(byteBuffer, message.getAnswerRecords());
+        putResourceRecords(byteBuffer, message.getAuthorityRecords());
+        putResourceRecords(byteBuffer, message.getAdditionalRecords());
+    }
+
+    private void putQuestionRecords(IoBuffer byteBuffer, List<QuestionRecord> questions) {
+        if (questions == null) {
+            return;
+        }
+
+        QuestionRecordEncoder encoder = new QuestionRecordEncoder();
+
+        Iterator<QuestionRecord> it = questions.iterator();
+
+        while (it.hasNext()) {
+            QuestionRecord question = it.next();
+            encoder.put(byteBuffer, question);
+        }
+    }
+
+    private void putResourceRecords(IoBuffer byteBuffer, List<ResourceRecord> records) {
+        if (records == null) {
+            return;
+        }
+
+        Iterator<ResourceRecord> it = records.iterator();
+
+        while (it.hasNext()) {
+            ResourceRecord record = it.next();
+
+            try {
+                put(byteBuffer, record);
+            } catch (IOException ioe) {
+                log.error(ioe.getLocalizedMessage(), ioe);
+            }
+        }
+    }
+
+    private void put(IoBuffer byteBuffer, ResourceRecord record) throws IOException {
+        RecordType type = record.getRecordType();
+
+        RecordEncoder encoder = DEFAULT_ENCODERS.get(type);
+
+        if (encoder == null) {
+            throw new IOException(I18n.err(I18n.ERR_597, type));
+        }
+
+        encoder.put(byteBuffer, record);
+    }
+
+    private byte encodeMessageType(MessageType messageType) {
+        byte oneBit = (byte) (messageType.convert() & 0x01);
+        return (byte) (oneBit << 7);
+    }
+
+    private byte encodeOpCode(OpCode opCode) {
+        byte fourBits = (byte) (opCode.convert() & 0x0F);
+        return (byte) (fourBits << 3);
+    }
+
+    private byte encodeAuthoritativeAnswer(boolean authoritative) {
+        if (authoritative) {
+            return (byte) ((byte) 0x01 << 2);
+        }
+        return (byte) 0;
+    }
+
+    private byte encodeTruncated(boolean truncated) {
+        if (truncated) {
+            return (byte) ((byte) 0x01 << 1);
+        }
+        return 0;
+    }
+
+    private byte encodeRecursionDesired(boolean recursionDesired) {
+        if (recursionDesired) {
+            return (byte) 0x01;
+        }
+        return 0;
+    }
+
+    private byte encodeRecursionAvailable(boolean recursionAvailable) {
+        if (recursionAvailable) {
+            return (byte) ((byte) 0x01 << 7);
+        }
+        return 0;
+    }
+
+    private byte encodeResponseCode(ResponseCode responseCode) {
+        return (byte) (responseCode.convert() & 0x0F);
+    }
+}