dnsdist: DoH in reverse proxy: Accept HTTP Header for indicating real client (address)

[krombel]

• Program: dnsdist
• Issue type: Feature request

Short description

Allow passing X-Forwarded-For or X-Real-IP when using DoH behind reverse proxy

Usecase

there are some cases where you want dnsdist to know the correct IP of the requesting party. Might it be the output of topClients() which just has 127.0.0.1 as top Client when doing reverse proxying or when you want to add rules which track or block access from a dedicated subnet (e.g. addAction({'1.2.3.0/24'}, NoneAction()) to monitor access from specific subnets)

Description

For now there is no possibility to make dnsdist see the correct IP when reverse proxying.

I had a short look where it might be appropriate to evaluate such header and came to this positions:

• doh.cc: doh_handler()
  • This would be even before evaluating ACL match which might not do what you want in case you want limit acl to 127.0.0.1 but allow requests from everywhere through reverse proxy
• doh.cc: doh_dispatch_query()
• doh.cc: processDOHQuery()
  • This is the last point where we are in a DoH-only environment. After that point it is handled as "general dns query" internally.

I don't know how configs are/should be passed there but I think that might help as a starting point.

While chatting in #powerdns 2 possible modes where mentioned:

• add and ACL for IPs which are allowed to add such header (in case you just have one listener for all DoH queries)
• have a dedicated listener with a 'trust this header' config which evaluates the header if available.

As I will use a dedicated listener which is listening on a "private" IP with encryption disabled disabled I would go for the second approach. I need no ACL power on that listener.

[zeha]

Updated title because "Origin" has a different meaning in HTTP.