ooni / netem / 5170618243

84%

Build Type

push

github

Committed by web-flow

Commit Message

[API CHANGE] feat: implement DNS spoofing (#27)

This diff implements DNS spoofing. To this end, we restructure how RST
injection works first. We drop the `FrameFlagRST` flag, which
implemented RST injection, and we replace it with `FrameFlagSpoof`. We
introduce in `DPIPolicy` and `Frame` the possibility of indicating
spoofed IP packets. A DPI rule that matches and wants to spoof packets
will need to set the `FrameFlagSpoof` and prepare the packets to spoof.
The router will honor the `FrameFlagSpoof` and spoof all indicates
packets before forwarding the `Frame` with the `FrameFlagSpoof` set.

Once we have implemented this change, we write a new DPI rule that
spoofs DNS responses when it sees a query containing an offending domain
name. The implementation just uses `FrameFlagSpoof`.

While testing this diff, we realized that all rules using
`FrameFlagSpoof` require some delay in the router<->server path to
ensure that the spoofed packets arrive earlier. Hence, we updated the
documentation and the integration tests to make sure this need to add
extra delay on the router<->server path is documented and reflected by
tests.

This diff CHANGES THE PREVIOUS API because the `FrameFlagRST` has been
replaced by `FrameFlagSpoof`.

Run Details

122 of 144 new or added lines in 7 files covered. (84.72%)

6 existing lines in 3 files now uncovered.

2048 of 2505 relevant lines covered (81.76%)

0.86 hits per line