Package io.confluent.kafka.clients.plugins.auth.oauth

Class FilteringDnsResolver

java.lang.Object

io.confluent.kafka.clients.plugins.auth.oauth.FilteringDnsResolver

All Implemented Interfaces:

org.apache.hc.client5.http.DnsResolver

public class FilteringDnsResolver
extends Object
implements org.apache.hc.client5.http.DnsResolver

A custom DNS resolver which filters out resolved IP addresses based on the following rules (in order):

1. If the IP address is in allowCidrRanges, allow it
2. If filterLocalAddresses is true and the IP address is a local IP, disallow it
3. If filterPrivateAddresses is true and the IP address is a private IP, disallow it
4. If filterClassEAddresses is true and the IP address is a class E IP, disallow it
5. If the IP address is in disallowCidrRanges, disallow it

An exception is thrown if there are 0 IP addresses remaining after filtering. This code is copied from https://github.com/confluentinc/connect-oauth/blob/master/src/main/java/io/confluent/connect/oauth/FilteringDnsResolver.java to do DNS filtering in CCloud to avoid having attackers be able to exploit internal services.

Constructor Summary

Constructors

Constructor	Description
FilteringDnsResolver(boolean filterLocalAddresses, boolean filterPrivateAddresses, boolean filterClassEAddresses, List<String> disallowCidrRanges, List<String> allowCidrRanges)

Method Summary

Modifier and Type	Method	Description
boolean	hasViolatingIpAddress(String host)
InetAddress[]	resolve(String host)
String	resolveCanonicalHostname(String host)

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

FilteringDnsResolver

public FilteringDnsResolver(boolean filterLocalAddresses,
 boolean filterPrivateAddresses,
 boolean filterClassEAddresses,
 List<String> disallowCidrRanges,
 List<String> allowCidrRanges)

Method Details

resolve

public InetAddress[] resolve(String host)
                      throws UnknownHostException

Specified by:

resolve in interface org.apache.hc.client5.http.DnsResolver

Throws:

UnknownHostException

resolveCanonicalHostname

public String resolveCanonicalHostname(String host)
                                throws UnknownHostException

Specified by:

resolveCanonicalHostname in interface org.apache.hc.client5.http.DnsResolver

Throws:

UnknownHostException

hasViolatingIpAddress

public boolean hasViolatingIpAddress(String host)
                              throws UnknownHostException

Throws:

UnknownHostException