Harden DNS egress policy against bypass vectors

- Fail-closed on unparseable DNS queries instead of forwarding them
- Reject multi-question DNS queries to prevent policy piggyback bypass
- Validate DNS response source IP matches gateway before snooping
- Create both TCP+UDP dynamic rules when protocol is unspecified

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: JAORMX

net/egress/dns.go

@@ -20,6 +20,9 @@ func ParseDNSQuery(payload []byte) (txnID uint16, qname string, qtype uint16, er
 	if len(msg.Question) == 0 {
 		return 0, "", 0, fmt.Errorf("DNS query has no question section")
 	}
+	if len(msg.Question) > 1 {
+		return 0, "", 0, fmt.Errorf("DNS query has %d questions, expected 1", len(msg.Question))
+	}
 	return msg.Id, msg.Question[0].Name, msg.Question[0].Qtype, nil
 }
 

net/egress/dns_test.go

@@ -49,6 +49,24 @@ func TestParseDNSQuery_NoQuestion(t *testing.T) {
 	assert.Error(t, err)
 }
 
+func TestParseDNSQuery_MultipleQuestions(t *testing.T) {
+	t.Parallel()
+
+	msg := &dns.Msg{
+		MsgHdr: dns.MsgHdr{Id: 1},
+		Question: []dns.Question{
+			{Name: "a.com.", Qtype: dns.TypeA, Qclass: dns.ClassINET},
+			{Name: "b.com.", Qtype: dns.TypeA, Qclass: dns.ClassINET},
+		},
+	}
+	payload, err := msg.Pack()
+	require.NoError(t, err)
+
+	_, _, _, err = ParseDNSQuery(payload)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "2 questions")
+}
+
 func TestBuildNXDOMAIN(t *testing.T) {
 	t.Parallel()
 

net/egress/interceptor.go

@@ -25,16 +25,20 @@ type DNSInterceptor struct {
 	policy       *Policy
 	dynamicRules *firewall.DynamicRules
 	minTTL       time.Duration
+	gatewayIP    [4]byte
 }
 
-// NewDNSInterceptor creates an interceptor with the given policy and dynamic
-// rule set. Dynamic rules created from DNS responses will have at least
-// minTTL duration (use 0 for the default of 60 seconds).
-func NewDNSInterceptor(policy *Policy, dr *firewall.DynamicRules) *DNSInterceptor {
+// NewDNSInterceptor creates an interceptor with the given policy, dynamic
+// rule set, and gateway IP. Only DNS responses from the gateway are
+// snooped to prevent spoofed responses from creating dynamic rules.
+// Dynamic rules created from DNS responses will have at least minTTL
+// duration (use 0 for the default of 60 seconds).
+func NewDNSInterceptor(policy *Policy, dr *firewall.DynamicRules, gatewayIP [4]byte) *DNSInterceptor {
 	return &DNSInterceptor{
 		policy:       policy,
 		dynamicRules: dr,
 		minTTL:       defaultMinTTL,
+		gatewayIP:    gatewayIP,
 	}
 }
 
@@ -44,14 +48,14 @@ func NewDNSInterceptor(policy *Policy, dr *firewall.DynamicRules) *DNSIntercepto
 func (d *DNSInterceptor) HandleEgress(frame []byte, hdr *firewall.PacketHeader) firewall.InterceptResult {
 	payload, err := ExtractUDPPayload(frame)
 	if err != nil {
-		slog.Debug("egress: failed to extract UDP payload", "error", err)
-		return firewall.InterceptResult{Action: firewall.InterceptForward}
+		slog.Debug("egress: dropping unparseable UDP frame", "error", err)
+		return firewall.InterceptResult{Action: firewall.InterceptDrop}
 	}
 
 	txnID, qname, qtype, err := ParseDNSQuery(payload)
 	if err != nil {
-		slog.Debug("egress: failed to parse DNS query", "error", err)
-		return firewall.InterceptResult{Action: firewall.InterceptForward}
+		slog.Debug("egress: dropping unparseable DNS query", "error", err)
+		return firewall.InterceptResult{Action: firewall.InterceptDrop}
 	}
 
 	if d.policy.IsAllowed(qname) {
@@ -81,8 +85,16 @@ func (d *DNSInterceptor) HandleEgress(frame []byte, hdr *firewall.PacketHeader)
 
 // HandleIngress snoops an inbound DNS response to learn IP mappings for
 // allowed hostnames. For each A record in the response, a dynamic
-// firewall rule is created with the TTL from the DNS record.
-func (d *DNSInterceptor) HandleIngress(frame []byte, _ *firewall.PacketHeader) {
+// firewall rule is created with the TTL from the DNS record. Only
+// responses from the gateway IP are processed to prevent spoofed
+// responses from injecting dynamic rules.
+func (d *DNSInterceptor) HandleIngress(frame []byte, hdr *firewall.PacketHeader) {
+	if hdr == nil || hdr.SrcIP != d.gatewayIP {
+		slog.Debug("ingress: ignoring DNS response from non-gateway source",
+			"src_ip", hdr.SrcIP)
+		return
+	}
+
 	payload, err := ExtractUDPPayload(frame)
 	if err != nil {
 		slog.Debug("ingress: failed to extract UDP payload", "error", err)
@@ -109,10 +121,14 @@ func (d *DNSInterceptor) HandleIngress(frame []byte, _ *firewall.PacketHeader) {
 
 	ports, proto := d.policy.HostPorts(qname)
 
-	// Default to TCP when protocol is unspecified.
-	ruleProto := proto
-	if ruleProto == 0 {
-		ruleProto = 6
+	// When protocol is unspecified, create rules for both TCP and UDP
+	// so that callers who omit the protocol field get full connectivity
+	// to the resolved IPs rather than TCP-only.
+	var ruleProtos []uint8
+	if proto == 0 {
+		ruleProtos = []uint8{6, 17} // TCP + UDP
+	} else {
+		ruleProtos = []uint8{proto}
 	}
 
 	for _, ip := range ips {
@@ -126,33 +142,35 @@ func (d *DNSInterceptor) HandleIngress(frame []byte, _ *firewall.PacketHeader) {
 			Mask: net.CIDRMask(32, 32),
 		}
 
-		if len(ports) == 0 {
-			d.dynamicRules.Add(firewall.Rule{
-				Direction: firewall.Egress,
-				Action:    firewall.Allow,
-				Protocol:  ruleProto,
-				DstCIDR:   cidr,
-			}, ttl)
-			slog.Debug("egress: dynamic rule added",
-				"ip", ip4.String(),
-				"proto", ruleProto,
-				"ttl", ttl,
-			)
-		} else {
-			for _, port := range ports {
+		for _, ruleProto := range ruleProtos {
+			if len(ports) == 0 {
 				d.dynamicRules.Add(firewall.Rule{
 					Direction: firewall.Egress,
 					Action:    firewall.Allow,
 					Protocol:  ruleProto,
 					DstCIDR:   cidr,
-					DstPort:   port,
 				}, ttl)
 				slog.Debug("egress: dynamic rule added",
 					"ip", ip4.String(),
-					"port", port,
 					"proto", ruleProto,
 					"ttl", ttl,
 				)
+			} else {
+				for _, port := range ports {
+					d.dynamicRules.Add(firewall.Rule{
+						Direction: firewall.Egress,
+						Action:    firewall.Allow,
+						Protocol:  ruleProto,
+						DstCIDR:   cidr,
+						DstPort:   port,
+					}, ttl)
+					slog.Debug("egress: dynamic rule added",
+						"ip", ip4.String(),
+						"port", port,
+						"proto", ruleProto,
+						"ttl", ttl,
+					)
+				}
 			}
 		}
 	}

net/egress/interceptor_test.go

@@ -57,7 +57,7 @@ func TestDNSInterceptor_AllowedQuery(t *testing.T) {
 
 	policy := NewPolicy([]HostSpec{{Name: "api.github.com"}})
 	dr := firewall.NewDynamicRules()
-	interceptor := NewDNSInterceptor(policy, dr)
+	interceptor := NewDNSInterceptor(policy, dr, testDstIP)
 
 	frame := buildDNSQueryFrame(testSrcMAC, testDstMAC, testSrcIP, testDstIP, 12345, "api.github.com")
 	hdr := firewall.ParseHeaders(frame)
@@ -71,7 +71,7 @@ func TestDNSInterceptor_BlockedQuery(t *testing.T) {
 
 	policy := NewPolicy([]HostSpec{{Name: "api.github.com"}})
 	dr := firewall.NewDynamicRules()
-	interceptor := NewDNSInterceptor(policy, dr)
+	interceptor := NewDNSInterceptor(policy, dr, testDstIP)
 
 	frame := buildDNSQueryFrame(testSrcMAC, testDstMAC, testSrcIP, testDstIP, 12345, "evil.com")
 	hdr := firewall.ParseHeaders(frame)
@@ -95,7 +95,7 @@ func TestDNSInterceptor_WildcardAllowed(t *testing.T) {
 
 	policy := NewPolicy([]HostSpec{{Name: "*.docker.io"}})
 	dr := firewall.NewDynamicRules()
-	interceptor := NewDNSInterceptor(policy, dr)
+	interceptor := NewDNSInterceptor(policy, dr, testDstIP)
 
 	frame := buildDNSQueryFrame(testSrcMAC, testDstMAC, testSrcIP, testDstIP, 12345, "registry-1.docker.io")
 	hdr := firewall.ParseHeaders(frame)
@@ -109,18 +109,18 @@ func TestDNSInterceptor_ResponseSnooping(t *testing.T) {
 
 	policy := NewPolicy([]HostSpec{{Name: "api.github.com", Ports: []uint16{443}}})
 	dr := firewall.NewDynamicRules()
-	interceptor := NewDNSInterceptor(policy, dr)
+	interceptor := NewDNSInterceptor(policy, dr, testDstIP)
 
 	ips := []net.IP{net.ParseIP("140.82.121.5"), net.ParseIP("140.82.121.6")}
 	frame := buildDNSResponseFrame(testDstMAC, testSrcMAC, testDstIP, testSrcIP, 12345, "api.github.com", ips, 300)
 	hdr := firewall.ParseHeaders(frame)
 
 	interceptor.HandleIngress(frame, hdr)
 
-	// Should have created dynamic rules for both IPs.
-	assert.Equal(t, 2, dr.Len())
+	// Protocol unset → TCP+UDP per IP. 2 IPs × 2 protocols = 4 rules.
+	assert.Equal(t, 4, dr.Len())
 
-	// Verify that the rules match egress traffic to the IPs.
+	// Verify that the rules match TCP egress traffic to the IPs.
 	hdr1 := &firewall.PacketHeader{
 		DstIP:    [4]byte{140, 82, 121, 5},
 		Protocol: 6,
@@ -130,6 +130,16 @@ func TestDNSInterceptor_ResponseSnooping(t *testing.T) {
 	require.True(t, ok)
 	assert.Equal(t, firewall.Allow, action)
 
+	// UDP to the same port should also match.
+	hdr1udp := &firewall.PacketHeader{
+		DstIP:    [4]byte{140, 82, 121, 5},
+		Protocol: 17,
+		DstPort:  443,
+	}
+	action, ok = dr.Match(firewall.Egress, hdr1udp)
+	require.True(t, ok)
+	assert.Equal(t, firewall.Allow, action)
+
 	// Wrong port should not match.
 	hdr2 := &firewall.PacketHeader{
 		DstIP:    [4]byte{140, 82, 121, 5},
@@ -145,14 +155,17 @@ func TestDNSInterceptor_ResponseSnooping_AllPorts(t *testing.T) {
 
 	policy := NewPolicy([]HostSpec{{Name: "example.com"}})
 	dr := firewall.NewDynamicRules()
-	interceptor := NewDNSInterceptor(policy, dr)
+	interceptor := NewDNSInterceptor(policy, dr, testDstIP)
 
 	ips := []net.IP{net.ParseIP("93.184.216.34")}
 	frame := buildDNSResponseFrame(testDstMAC, testSrcMAC, testDstIP, testSrcIP, 12345, "example.com", ips, 60)
 	hdr := firewall.ParseHeaders(frame)
 
 	interceptor.HandleIngress(frame, hdr)
 
+	// Protocol unset → TCP+UDP. 1 IP × 2 protocols = 2 rules.
+	assert.Equal(t, 2, dr.Len())
+
 	// Rule should match any port for TCP.
 	hdr1 := &firewall.PacketHeader{
 		DstIP:    [4]byte{93, 184, 216, 34},
@@ -162,14 +175,24 @@ func TestDNSInterceptor_ResponseSnooping_AllPorts(t *testing.T) {
 	action, ok := dr.Match(firewall.Egress, hdr1)
 	require.True(t, ok)
 	assert.Equal(t, firewall.Allow, action)
+
+	// Rule should also match UDP.
+	hdr1udp := &firewall.PacketHeader{
+		DstIP:    [4]byte{93, 184, 216, 34},
+		Protocol: 17,
+		DstPort:  443,
+	}
+	action, ok = dr.Match(firewall.Egress, hdr1udp)
+	require.True(t, ok)
+	assert.Equal(t, firewall.Allow, action)
 }
 
 func TestDNSInterceptor_ResponseSnooping_NotAllowed(t *testing.T) {
 	t.Parallel()
 
 	policy := NewPolicy([]HostSpec{{Name: "allowed.com"}})
 	dr := firewall.NewDynamicRules()
-	interceptor := NewDNSInterceptor(policy, dr)
+	interceptor := NewDNSInterceptor(policy, dr, testDstIP)
 
 	// Response for a host not in the policy — should be ignored.
 	ips := []net.IP{net.ParseIP("1.2.3.4")}
@@ -186,7 +209,7 @@ func TestDNSInterceptor_ResponseNXDOMAINFrameFormat(t *testing.T) {
 
 	policy := NewPolicy([]HostSpec{{Name: "allowed.com"}})
 	dr := firewall.NewDynamicRules()
-	interceptor := NewDNSInterceptor(policy, dr)
+	interceptor := NewDNSInterceptor(policy, dr, testDstIP)
 
 	frame := buildDNSQueryFrame(testSrcMAC, testDstMAC, testSrcIP, testDstIP, 54321, "blocked.com")
 	hdr := firewall.ParseHeaders(frame)
@@ -220,3 +243,94 @@ func TestDNSInterceptor_ResponseNXDOMAINFrameFormat(t *testing.T) {
 	expectedIPLen := uint16(ihl + 8 + len(result.ResponseFrame) - (ipStart + ihl + 8))
 	assert.Equal(t, expectedIPLen, ipTotalLen)
 }
+
+func TestDNSInterceptor_UnparseableQuery_Dropped(t *testing.T) {
+	t.Parallel()
+
+	policy := NewPolicy([]HostSpec{{Name: "allowed.com"}})
+	dr := firewall.NewDynamicRules()
+	interceptor := NewDNSInterceptor(policy, dr, testDstIP)
+
+	// Build a frame with valid Ethernet+IP+UDP headers but garbage DNS payload.
+	frame := buildTestUDPFrame(testSrcMAC, testDstMAC, testSrcIP, testDstIP, 12345, 53, []byte{0xDE, 0xAD})
+	hdr := firewall.ParseHeaders(frame)
+
+	result := interceptor.HandleEgress(frame, hdr)
+	assert.Equal(t, firewall.InterceptDrop, result.Action,
+		"unparseable DNS queries must be dropped, not forwarded")
+}
+
+func TestDNSInterceptor_MultipleQuestions_Dropped(t *testing.T) {
+	t.Parallel()
+
+	policy := NewPolicy([]HostSpec{{Name: "allowed.com"}})
+	dr := firewall.NewDynamicRules()
+	interceptor := NewDNSInterceptor(policy, dr, testDstIP)
+
+	// Build a DNS query with two questions.
+	msg := &mdns.Msg{
+		MsgHdr: mdns.MsgHdr{Id: 0x5678, RecursionDesired: true},
+		Question: []mdns.Question{
+			{Name: mdns.Fqdn("allowed.com"), Qtype: mdns.TypeA, Qclass: mdns.ClassINET},
+			{Name: mdns.Fqdn("evil.com"), Qtype: mdns.TypeA, Qclass: mdns.ClassINET},
+		},
+	}
+	payload, _ := msg.Pack()
+	frame := buildTestUDPFrame(testSrcMAC, testDstMAC, testSrcIP, testDstIP, 12345, 53, payload)
+	hdr := firewall.ParseHeaders(frame)
+
+	result := interceptor.HandleEgress(frame, hdr)
+	assert.Equal(t, firewall.InterceptDrop, result.Action,
+		"queries with multiple questions must be dropped")
+}
+
+func TestDNSInterceptor_ResponseFromNonGateway_Ignored(t *testing.T) {
+	t.Parallel()
+
+	policy := NewPolicy([]HostSpec{{Name: "allowed.com"}})
+	dr := firewall.NewDynamicRules()
+	gatewayIP := [4]byte{192, 168, 127, 1}
+	interceptor := NewDNSInterceptor(policy, dr, gatewayIP)
+
+	// Build a response that looks like it comes from a non-gateway source.
+	nonGatewayIP := [4]byte{10, 0, 0, 99}
+	ips := []net.IP{net.ParseIP("1.2.3.4")}
+	frame := buildDNSResponseFrame(testDstMAC, testSrcMAC, nonGatewayIP, testSrcIP, 12345, "allowed.com", ips, 300)
+	hdr := firewall.ParseHeaders(frame)
+
+	interceptor.HandleIngress(frame, hdr)
+
+	assert.Equal(t, 0, dr.Len(),
+		"DNS responses from non-gateway sources must not create dynamic rules")
+}
+
+func TestDNSInterceptor_ExplicitProtocol_SingleRule(t *testing.T) {
+	t.Parallel()
+
+	// When Protocol is explicitly TCP, only TCP rules should be created.
+	policy := NewPolicy([]HostSpec{{Name: "example.com", Ports: []uint16{443}, Protocol: 6}})
+	dr := firewall.NewDynamicRules()
+	interceptor := NewDNSInterceptor(policy, dr, testDstIP)
+
+	ips := []net.IP{net.ParseIP("93.184.216.34")}
+	frame := buildDNSResponseFrame(testDstMAC, testSrcMAC, testDstIP, testSrcIP, 12345, "example.com", ips, 60)
+	hdr := firewall.ParseHeaders(frame)
+
+	interceptor.HandleIngress(frame, hdr)
+
+	// Explicit TCP → 1 rule per IP.
+	assert.Equal(t, 1, dr.Len())
+
+	// TCP should match.
+	action, ok := dr.Match(firewall.Egress, &firewall.PacketHeader{
+		DstIP: [4]byte{93, 184, 216, 34}, Protocol: 6, DstPort: 443,
+	})
+	require.True(t, ok)
+	assert.Equal(t, firewall.Allow, action)
+
+	// UDP should not match.
+	_, ok = dr.Match(firewall.Egress, &firewall.PacketHeader{
+		DstIP: [4]byte{93, 184, 216, 34}, Protocol: 17, DstPort: 443,
+	})
+	assert.False(t, ok)
+}

net/egress/policy.go

@@ -24,7 +24,7 @@ type hostEntry struct {
 type HostSpec struct {
 	Name     string   // "api.github.com" or "*.docker.io"
 	Ports    []uint16 // empty = all ports
-	Protocol uint8    // 0 = default (TCP), 6 = TCP, 17 = UDP
+	Protocol uint8    // 0 = both TCP+UDP, 6 = TCP only, 17 = UDP only
 }
 
 // NewPolicy creates a policy from the given host specifications.