Pdns: dnsdist: Support proxy protocol for outgoing queries toward backends

Created on 10 Oct 2019 · 5Comments · Source: PowerDNS/pdns

Program: dnsdist
Issue type: Feature request

Short description

Using EDNS Client Subnet to forward the original source IP address to the backend causes several issues:

we can't forward the existing ECS information, if any ;
we need to parse the existing query to determine if there was already an EDNS record, and whether the ECS option was in use. In some cases we need to rewrite it ;
we can only forward the original source address, not the port, or the original destination address / port, and even less arbitrary data ;
altering the initial payload break TSIG signature, and might cause some issues with regard to compression if the EDNS record was not the last one in the DNS packet.

XPF fixes a few of these issues but still require some parsing and editing of the packet, and does not provide any way to forward arbitrary data.

Using a custom EDNS option would be possible but would still require doing some parsing, with the same issue with regard to compression, TSIG and so on.

The proxy protocol [1] has a very simple design, pre-pending some header to the existing data but leaving it untouched otherwise. The second version is very efficient in term of generation and parsing, and allows for arbitrary data to be passed using the optional TLVs mechanism.

It would be nice if dnsdist could support pre-pending such a header to the UDP or TCP payload before sending it to the backend.

dnsdist feature request

Source

rgacogne

👍4

Most helpful comment

I suspect we do not care much about what is currently deployed in other products because no-one supports it over UDP, but I might be wrong.
Still for now my humble opinion is that we should only support version 2.

rgacogne on 10 Oct 2019

👍3

All 5 comments

It would be nice to support version 2 of the proxy protocol because it is more flexible. I suspect version 1 is more widely deployed however. We might need to support both.