fix: auto-detect system DNS, add forward cache with TTL to resolver#43
Merged
fix: auto-detect system DNS, add forward cache with TTL to resolver#43
Conversation
- Remove hardcoded 1.1.1.1:53 from greyproxy.yml; DNS proxy forwarder is now injected at startup from the host's system resolver. If the user already has a forwarder configured it is left untouched. Falls back to 1.1.1.1:53 only when detection fails. - Detect system DNS on Linux/macOS via /etc/resolv.conf with a fallback to /run/systemd/resolve/resolv.conf when only the systemd-resolved stub (127.0.0.53) is present (handles container environments). Windows reads from the registry. - Add TTL-aware forward DNS cache to the Resolver plugin using miekg/dns to query the system resolver directly. Cache TTL is clamped between 10s and 5m to handle both aggressive CDN records and overly long provider TTLs. Falls back to net.DefaultResolver with a 30s TTL when the raw query fails. - Add static localhost mappings (127.0.0.1, ::1) to hosts-0 so gost never triggers a DNS lookup for localhost under load.
3 tasks
tito
added a commit
that referenced
this pull request
Apr 14, 2026
## Summary - Stop bypassing systemd-resolved in `linuxMacDNSServers()`: read `/etc/resolv.conf` verbatim instead of swapping the stub out for the raw upstreams in `/run/systemd/resolve/resolv.conf`. - Fall back to `/run/systemd/resolve/stub-resolv.conf` only when `/etc/resolv.conf` is absent (minimal images). The raw upstream file is never read. - Add `sysdns_test.go` covering the 127.0.0.53 regression, multi-nameserver order, IPv6 bracketing, malformed lines, and missing files. ## Why 0.4.1 (#43) replaced 127.0.0.53 with the raw Mullvad upstream from `/run/systemd/resolve/resolv.conf`, so greyproxy tried plain UDP/53 to an upstream that systemd-resolved had been reaching over DoT. On hosts configured with `DNSOverTLS=opportunistic` (matclab's setup in #47) the direct UDP path is unreachable and every lookup times out. Letting queries flow through 127.0.0.53 keeps DoT, DNSSEC, and split-DNS intact. The container concern the original code cited (127.x.x.x being container-local) doesn't apply: greyproxy runs on the host, and the sandboxed client connects to it via the host's loopback, so 127.0.0.53 is reachable. Fixes #47 ## Test plan - [x] `go test ./cmd/greyproxy/ -run TestResolvConf -v` - [x] `go build ./...` - [x] `go vet ./cmd/greyproxy/`
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes GreyhavenHQ/greywall#52
Problem
Under sustained load, greyproxy was performing a live DNS lookup on every new upstream connection via
net.DefaultResolver.LookupIP(). With large payloads creating many concurrent in-flight connections, the system resolver would saturate, causing timeouts and NXDOMAIN failures that cascaded into broken connections.Additionally, the DNS proxy forwarder had
1.1.1.1:53hardcoded, which could get rate-limited under benchmark load.Changes
Auto-detect system DNS upstream
1.1.1.1:53fromgreyproxy.yml; the DNS proxy forwarder is now injected at startup from the host's system resolver/etc/resolv.conf, with a fallback to/run/systemd/resolve/resolv.confwhen only the systemd-resolved stub (127.0.0.53) is present (handles container environments)1.1.1.1:53only when detection fails entirelyTTL-aware forward DNS cache in the resolver plugin
net.DefaultResolver.LookupIP()to a directmiekg/dnsquery against the detected system resolver, which returns the actual record TTLnet.DefaultResolverwith a 30s TTL when the raw query fails (mDNS, split-horizon DNS, etc.)Static localhost mappings
127.0.0.1and::1as static entries forlocalhostinhosts-0so gost never triggers a DNS lookup for localhost under loadBehaviour
1.1.1.1:53Startup logs two lines confirming which DNS server is active for both the forwarder and the resolver plugin.