Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[1.14] Author backport of #28928 (Dns proxy use original source address and port) #29086

Merged
merged 2 commits into from
Nov 9, 2023
Merged

[1.14] Author backport of #28928 (Dns proxy use original source address and port) #29086

merged 2 commits into from
Nov 9, 2023

Commits on Nov 9, 2023

  1. go.mod, vendor: use github.com/cilium/dns fork directly 

    [ upstream commit 95e25bf ]

We have been maintaining and using that fork for a long time and it
looks like the custom changes won't make it upstream any time soon.

There are no other vendored dependencies using miekg/dns, so switching
to the cilium/dns fork shouldn't have any side effects. The fork's
module name was changed to match its import path in
cilium/dns#4.

Let's replace the github.com/miekg/dns import path by
github.com/cilium/dns to get rid of another replace directive in go.mod
and thus make life a tiny bit easier for downstream packages importing
github.com/cilium/cilium.

Signed-off-by: Tobias Klauser <tobias@cilium.io>
    @tklauser @jrajahalme
    tklauser authored and jrajahalme committed Nov 9, 2023
    Configuration menu
    Copy the full SHA
    4742330 View commit details
    Browse the repository at this point in the history

  2. dnsproxy: Use original source address in connections to dns servers 

    [ upstream commit 9d70db8 ]

Set transparent, reuseaddr, and reuseport options and use the original
source address on connections from DNS proxy to DNS servers to allow use
of non-local source address as well as recreate sockets on the same
5-tuple without needing to wait for the TCP TIME_WAIT to finish.

Use the MagicMarkEgress mark on connections to the dns servers instead
the generic MagicMarkIdentity.

Use original source address in connections to dns servers when the source
address is not one of the host IPs. The original source address and port
can not be reused if there is already socket with them to the same
destination on the same networking namespace.

Use new dns.SharedClients to reuse DNS clients between all requests that
originate from the same source address and port. This allows multiple
different requests to be pending at the same time on the same dns Client,
which happens whenever the source pod sends multiple DNS requests from
the same resolver invocation, e.g., for A and AAAA records.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

info: patch template saved to `-`
    @jrajahalme
    jrajahalme committed Nov 9, 2023
    Configuration menu
    Copy the full SHA
    b1b72c1 View commit details
    Browse the repository at this point in the history