Permit to communicate with the resolver using a unix socket

[madragana]

Hi guys,
it would be great if on the doh-proxy we could set something like this
--upstream-resolver=unix:/tmp/whathever

This way we could communicate with a local dns resolver without rewriting the source IP of the original dns query. Otherwise the log of the dns resolver will report always 127.0.0.1 as source IP or whatever IP was set on the doh-proxy.
In other words it would be great to transform doh-proxy in a transparent proxy.

Any suggestion?

thx!

[chantra]

Hi @madragana,

which recursive resolver supports this? https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.AbstractEventLoop.create_unix_connection could be used, but you would still need to re-create the L3/L4 headers in order to get them though the other side of the socket.

I don't see of any stock usage on top of my head, but if it could be useful, e.g providing it works with some recursors, a PR is welcomed :)

[madragana]

Hi @chantra,

I am playing with PowerDNS https://doc.powerdns.com/md/authoritative/backend-remote/
It has modules to support unix:/ socket and other I/O methods.
My idea dates back to the times in which I was using postfix filters that used communication via a socket

If there is any other idea to avoid a customer IP being rewritten just let me know.
Thanks for the support!

[chantra]

On Mon, May 21, 2018 at 2:32 PM madragana ***@***.***> wrote: Hi @chantra <https://github.com/chantra>, I am playing with PowerDNS https://doc.powerdns.com/md/authoritative/backend-remote/ It has modules to support unix:/ socket and other I/O methods.

So looking at https://doc.powerdns.com/md/authoritative/backend-remote/#lookup They use their own api to pass on the query. This is not just passing the packet over a Unix socket, but supporting a different protocol. If you want to implement this, you may be able to add support by overriding the dns resolver class.

…

My idea dates back to the times in which I was using postfix filters that used communication via a socket If there is any other idea to avoid a customer IP being rewritten just let me know. Thanks for the support! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#40 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABf_FcUBjqCXMaf6TXVLnYCxRxHV3Jbks5t0zJcgaJpZM4UHlhq> .

[chantra]

Hi @madragana

I am going to close this task. The request is pretty vendor specific, so I don't think it makes sense to add this in.
If you find a way to cleanly be able to swap the upstream protocol use within doh-proxy, I will happily take it as a PR.