-
Notifications
You must be signed in to change notification settings - Fork 2
Dummy DNS Server #164
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Dummy DNS Server #164
Conversation
8e0d244 to
ca5d760
Compare
| } | ||
|
|
||
| // Shutdown stops the servers. | ||
| func (s *Server) Shutdown() { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Did you mean to call this somewhere?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it would be nice to call it in boundary-child process, after target process is finished, but it requires some refactoring.
| } | ||
| m.Answer = append(m.Answer, rr) | ||
| default: | ||
| m.Rcode = dns.RcodeSuccess |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this default case is redundant because m.SetReply() does exactly this internally
Closes: #108
Inspired by https://coder.github.io/httpjail/advanced/dns-exfiltration.html, but with necessary adjustments to avoid requiring
CAP_SYS_ADMINpermissionsImplement dummy DNS server inside network namespace to prevent DNS exfiltration
Summary
This PR implements a dummy DNS server that runs inside the network namespace to prevent DNS exfiltration. All DNS queries (UDP/TCP port 53) are redirected to a local dummy server that responds with dummy IP addresses, ensuring that no real DNS resolution occurs and preventing information leakage through DNS queries.
Why a dummy DNS server is safe
Boundary’s allow/deny decisions do not use the IP address that DNS returns. The proxy evaluates rules using the Host header (and path, method) from the HTTP/HTTPS request. Flow:
api.example.com) and gets a dummy IP (e.g.6.6.6.6) from our dummy server.Host: api.example.com.So returning a dummy IP for every DNS query is safe: applications still connect and send the correct Host header, and boundary continues to enforce rules correctly. The dummy DNS server only blocks real DNS resolution (and thus DNS exfiltration); it does not change how HTTP/HTTPS traffic is allowed or blocked.
Changes
New Features
Dummy DNS Server (
dnsdummypackage): A minimal DNS server that responds to all queries with dummy IPs:6.6.6.62001:db8::1DNS Redirection: All DNS traffic (port 53) is redirected via iptables DNAT to the dummy server listening on
127.0.0.1:5353--use-real-dnsflag: New CLI flag to opt-out of dummy DNS and use real DNS resolution (allows DNS exfiltration)Removed
--configure-dns-for-local-stub-resolverflag: Removed this deprecated option and its associated code path (local_stub_resolver.go)Implementation Details
net.ipv4.conf.all.route_localnet=1sysctl is set best-effort (errors ignored) to allow DNAT to127.0.0.1;"*"as ignoreErr pattern to ignore any errorBehavior
Default (dummy DNS enabled):
With
--use-real-dns:Related
Fixes DNS exfiltration vulnerability where processes inside the network namespace could leak information through DNS queries.