dns: T5113: Support custom port for name-server forwarders #1914
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
vyosbot
requested review from
a team and
dmbaturin
and removed request for
a team
sever-sever
requested changes
Mar 27, 2023
sever-sever
reviewed
Mar 27, 2023
indrajitr
force-pushed
the
pdns-port
branch
3 times, most recently
from
d7d9533
to
ac27c18
Compare
sever-sever
approved these changes
Mar 27, 2023
Support custom port for name-server forwarders that would allow using custom ports in name server forwarders to enable forwarding to alternative name servers (unbound, stubby, dnscrypt-proxy etc.) operating on non-default port. This would also allow using DNS Over TLS in PowerDNS Recursor 4.6 onwards (pdns doesn't support certificate check for validity yet) by enabling 'dot-to-port-853'. This is set by default if compiled in with DoT support. See: https://doc.powerdns.com/recursor/settings.html#dot-to-port-853 This also partially implements T921, T2195 (DoT without certificate check). Implementation details: - In 'dns/forwarding' configuration, 'name-server' now allows optional 'port' (defaults to 53). - Instead of modifying 'name-server-ipv4-ipv6.xml.i' to add optional 'port', a new file 'name-server-ipv4-ipv6-port.xml.i' has been used to avoid impacting other places where it is reused because not all of them honor ports (mostly VPN related). - The `host:port` entries to be used by PowerDNS recursor config are normalized eagerly at the point of loading VyOS `Config` instead of doing them lazily while rendering the Jinja2 template to keep the implementation less intrusive. The alternative would entail making quite a bit of change in how 'vyos-hostsd' processes 'static' 'name_servers' entries or persists their runtime states.
Smoketest update for T5113 with optional port for name-server forwarders.
c-po
approved these changes
Mar 27, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Change Summary
Support custom port for name-server forwarders that would allow using custom ports in name server forwarders to enable forwarding to alternative name servers (unbound, stubby, dnscrypt-proxy etc.) operating on non-default port.
This would also allow using DNS Over TLS in PowerDNS Recursor 4.6 onwards (pdns doesn't support certificate check for validity yet) by enabling
dot-to-port-853. This is set by default if compiled in with DoT support.See: https://doc.powerdns.com/recursor/settings.html#dot-to-port-853
This also partially implements T921, T2195 (DoT without certificate check).
Types of changes
Related Task(s)
Component(s) name
dns forwarding
Implementation details
port(defaults to 53).name-server-ipv4-ipv6.xml.ito add optionalport, a new filename-server-ipv4-ipv6-port.xml.ihas been used to avoid impacting other places where it is reused because not all of them honor ports (mostly VPN related).host:portentries to be used by PowerDNS recursor config are normalized eagerly at the point of loading VyOSConfiginstead of doing them lazily while rendering the Jinja2 template to keep the implementation less intrusive. The alternative would entail making quite a bit of change in howvyos-hostsdprocessesstaticname_serversentries or persists their runtime states. (I am open to suggestion/recommendation with the approach here.)How to test
/run/powerdns/recursor.forward-zones.conflike so:1.1.1.11.0.0.1:853[2606:4700::1111]:853Checklist: