feat(forward): add source_address directive (#8011)

* fix(dnssec): avoid caching empty signing results (#7996) Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * save only Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * do #8008 Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * Fix Address used if tcp Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * Fix bad using of dialer type Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * core: Add full TSIG verification in gRPC transport (#8006) * core: Add full TSIG verification in gRPC transport This PR add full TSIG verification in gRPC using dns.TsigVerify() so invalid signatures and timestamps are correctly detected instead of only checking key presence. Signed-off-by: Yong Tang <yong.tang.github@outlook.com> * Fix Signed-off-by: Yong Tang <yong.tang.github@outlook.com> * Fix Signed-off-by: Yong Tang <yong.tang.github@outlook.com> --------- Signed-off-by: Yong Tang <yong.tang.github@outlook.com> Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * core: Add full TSIG verification in QUIC transport (#8007) * core: Add full TSIG verification in QUIC transport This PR add full TSIG verification in QUIC using dns.TsigVerify() Signed-off-by: Yong Tang <yong.tang.github@outlook.com> * Fix Signed-off-by: Yong Tang <yong.tang.github@outlook.com> --------- Signed-off-by: Yong Tang <yong.tang.github@outlook.com> Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * fix(test): deduplicate TSIG test helpers (#8009) Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * fix(dnssec): return nil sigs on sign error (#7999) Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * fix(dnssec): return nil from ParseKeyFile on error (#8000) Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * fix(dnsserver): allow view server blocks in any declaration order (#8001) When using the view plugin, filtered and unfiltered server blocks can share the same zone and port. The zone overlap validation rejected this configuration when the unfiltered block was not declared last, because filtered configs treated an already-registered zone as an error. Skip the 'already defined' check for configs that have filter functions, since they are expected to coexist with an unfiltered catch-all block on the same zone/port. Fixes #7733 Signed-off-by: umut-polat <52835619+umut-polat@users.noreply.github.com> Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * fix(doh): use per-connection local address for PROXY protocol (#8005) Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * fix(transfer): batch AXFR records by message size instead of count (#8002) Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * fix(tls): use temp dir for keylog test path (#8010) Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * Rename local_address option to source_address Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * Rename local_address also in readme Add test Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * Resolve change request in pr Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * fix ci lint Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * Improve doc on source_address routing needs Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * Remove added timeout Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * add use of source address also for health check query Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * remove untrailing newline from health_test.go Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * fix file format Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * Update plugin/forward/setup_test.go Co-authored-by: Ville Vesilehto <ville@vesilehto.fi> Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * Remove dead code in TestHealthLocalAddress Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * Fix misspelling Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * Try to set default timeout Signed-off-by: Filippo <filippo.ferrazini@gmail.com> * fix format in health.go Signed-off-by: Filippo <filippo.ferrazini@gmail.com> --------- Signed-off-by: Filippo <filippo.ferrazini@gmail.com> Signed-off-by: Yong Tang <yong.tang.github@outlook.com> Signed-off-by: umut-polat <52835619+umut-polat@users.noreply.github.com> Co-authored-by: Ville Vesilehto <ville@vesilehto.fi> Co-authored-by: Yong Tang <yong.tang.github@outlook.com> Co-authored-by: Umut Polat <52835619+umut-polat@users.noreply.github.com> Co-authored-by: Cedric Wang <wangzongqi@msn.com>
2026-07-10 17:50:12 -04:00 · 2026-07-10 02:38:22 +02:00
parent adba3b3703
commit e4990abfa3
9 changed files with 197 additions and 7 deletions
--- a/plugin/pkg/proxy/connect.go
+++ b/plugin/pkg/proxy/connect.go
@@ -97,12 +97,21 @@ func (t *Transport) Dial(proto string) (*persistConn, bool, error) {

 	reqTime := time.Now()
 	timeout := t.dialTimeout()
-	if proto == "tcp-tls" {
-		conn, err := dns.DialTimeoutWithTLS("tcp", t.addr, t.tlsConfig, timeout)
-		t.updateDialTimeout(time.Since(reqTime))
-		return &persistConn{c: conn, created: time.Now()}, false, err
+	dialer := &net.Dialer{Timeout: timeout}
+
+	if t.localAddress != nil {
+		if proto == "udp" {
+			dialer.LocalAddr = &net.UDPAddr{IP: t.localAddress}
+		} else {
+			dialer.LocalAddr = &net.TCPAddr{IP: t.localAddress}
+		}
 	}
-	conn, err := dns.DialTimeout(proto, t.addr, timeout)
+
+	// pass nil tlsConfig to use system default
+	client := dns.Client{Net: proto, Dialer: dialer, TLSConfig: t.tlsConfig}
+
+	conn, err := client.Dial(t.addr)
+
 	t.updateDialTimeout(time.Since(reqTime))
 	return &persistConn{c: conn, created: time.Now()}, false, err
 }
--- a/plugin/pkg/proxy/health.go
+++ b/plugin/pkg/proxy/health.go
@@ -3,6 +3,7 @@ package proxy
 import (
 	"context"
 	"crypto/tls"
+	"net"
 	"net/http"
 	"sync/atomic"
 	"time"
@@ -28,6 +29,8 @@ type HealthChecker interface {
 	SetReadTimeout(time.Duration)
 	GetWriteTimeout() time.Duration
 	SetWriteTimeout(time.Duration)
+	SetLocalAddress(net.IP)
+	GetLocalAddress() net.IP
 }

 // dnsHc is a health checker for a DNS endpoint (DNS, and DoT).
@@ -37,6 +40,8 @@ type dnsHc struct {
 	domain           string

 	proxyName string
+
+	localAddress net.IP
 }

 const defaultTimeout = 1 * time.Second
@@ -47,8 +52,7 @@ func NewHealthChecker(proxyName, protocol string, recursionDesired bool, domain
 	case transport.DNS, transport.TLS:
 		c := new(dns.Client)
 		c.Net = "udp"
-		c.ReadTimeout = defaultTimeout
-		c.WriteTimeout = defaultTimeout
+		setDefaultTimeout(c)

 		return &dnsHc{
 			c:                c,
@@ -78,6 +82,8 @@ func NewHealthChecker(proxyName, protocol string, recursionDesired bool, domain
 func (h *dnsHc) SetTLSConfig(cfg *tls.Config) {
 	h.c.Net = "tcp-tls"
 	h.c.TLSConfig = cfg
+	// update the dialer accordingly with the protocol changed
+	h.setDialer()
 }

 func (h *dnsHc) GetTLSConfig() *tls.Config {
@@ -100,6 +106,8 @@ func (h *dnsHc) GetDomain() string {

 func (h *dnsHc) SetTCPTransport() {
 	h.c.Net = "tcp"
+	// update the dialer accordingly with the protocol changed
+	h.setDialer()
 }

 func (h *dnsHc) GetReadTimeout() time.Duration {
@@ -151,12 +159,49 @@ func (h *dnsHc) send(addr string) error {
 	return err
 }

+// SetLocalAddress sets the local address in transport.
+func (h *dnsHc) SetLocalAddress(localAddr net.IP) {
+	h.localAddress = localAddr
+	h.setDialer()
+}
+
+// GetLocalAddress returns the local address in transport.
+func (h *dnsHc) GetLocalAddress() net.IP {
+	return h.localAddress
+}
+
+// setDialer sets the local address in the underlying dialer
+func (h *dnsHc) setDialer() {
+	if h.localAddress == nil {
+		if h.c.Dialer != nil {
+			h.c.Dialer.LocalAddr = nil
+		}
+		return
+	}
+	if h.c.Dialer == nil {
+		h.c.Dialer = new(net.Dialer)
+		setDefaultTimeout(h.c)
+	}
+	if h.c.Net == "udp" {
+		h.c.Dialer.LocalAddr = &net.UDPAddr{IP: h.localAddress}
+	} else {
+		h.c.Dialer.LocalAddr = &net.TCPAddr{IP: h.localAddress}
+	}
+}
+
+// setDefaultTimeout sets the default read and write timeout values for the DNS client to 1 second.
+func setDefaultTimeout(c *dns.Client) {
+	c.ReadTimeout = 1 * time.Second
+	c.WriteTimeout = 1 * time.Second
+}
+
 // dohHc is a health checker for a DNS-over-HTTPS (DoH) endpoint.
 type dohHc struct {
 	client           *http.Client
 	recursionDesired bool
 	domain           string
 	proxyName        string
+	localAddress     net.IP
 }

 func (h *dohHc) Check(p *Proxy) error {
@@ -244,3 +289,18 @@ func (h *dohHc) GetWriteTimeout() time.Duration {
 func (h *dohHc) SetWriteTimeout(t time.Duration) {
 	h.client.Timeout = t
 }
+
+func (h *dohHc) SetLocalAddress(localAddr net.IP) {
+	h.localAddress = localAddr
+	httpTransport := h.client.Transport.(*http.Transport)
+	if localAddr == nil {
+		httpTransport.DialContext = nil
+		return
+	}
+	dialer := &net.Dialer{LocalAddr: &net.TCPAddr{IP: localAddr}}
+	httpTransport.DialContext = dialer.DialContext
+}
+
+func (h *dohHc) GetLocalAddress() net.IP {
+	return h.localAddress
+}
--- a/plugin/pkg/proxy/health_test.go
+++ b/plugin/pkg/proxy/health_test.go
@@ -1,6 +1,8 @@
 package proxy

 import (
+	"crypto/tls"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"sync/atomic"
@@ -200,3 +202,44 @@ func TestHealthDomain(t *testing.T) {
 		t.Errorf("Expected number of health checks with Domain==%s to be %d, got %d", hcDomain, 1, i1)
 	}
 }
+
+func TestHealthLocalAddress(t *testing.T) {
+	hc := NewHealthChecker("TestHealthLocalAddress", transport.DNS, true, ".")
+	hc.SetReadTimeout(10 * time.Millisecond)
+	hc.SetWriteTimeout(10 * time.Millisecond)
+	currLocalAddress := hc.GetLocalAddress()
+	if currLocalAddress != nil {
+		t.Errorf("Expected local address to be nil, got %s", currLocalAddress.String())
+	}
+
+	hc.SetLocalAddress(net.ParseIP("127.0.0.1"))
+	dnsClient := hc.(*dnsHc).c
+	if dnsClient.Dialer.LocalAddr.String() != "127.0.0.1:0" {
+		t.Errorf("Expected local address to be 127.0.0.1:0, got %s", dnsClient.Dialer.LocalAddr.String())
+	}
+
+	// check type of underlying transport
+	_, ok := dnsClient.Dialer.LocalAddr.(*net.UDPAddr)
+	if !ok {
+		t.Error("Expected local address to be udp")
+	}
+
+	// set TCP transport
+	hc.SetTCPTransport()
+
+	// check update of underlying transport
+	_, ok = dnsClient.Dialer.LocalAddr.(*net.TCPAddr)
+	if !ok {
+		t.Error("Expected local address to be tcp")
+	}
+
+	tlsConfig := new(tls.Config)
+	// set TLS transport
+	hc.SetTLSConfig(tlsConfig)
+
+	// check update of underlying transport
+	_, ok = dnsClient.Dialer.LocalAddr.(*net.TCPAddr)
+	if !ok {
+		t.Error("Expected local address to be tcp")
+	}
+}
--- a/plugin/pkg/proxy/persistent.go
+++ b/plugin/pkg/proxy/persistent.go
@@ -2,6 +2,7 @@ package proxy

 import (
 	"crypto/tls"
+	"net"
 	"net/http"
 	"sort"
 	"sync"
@@ -28,6 +29,7 @@ type Transport struct {
 	tlsConfig    *tls.Config
 	httpClient   *http.Client
 	proxyName    string
+	localAddress net.IP

 	mu   sync.Mutex
 	stop chan struct{}
@@ -171,6 +173,11 @@ func (t *Transport) SetTLSConfig(cfg *tls.Config) { t.tlsConfig = cfg }
 // GetTLSConfig returns the TLS config in transport.
 func (t *Transport) GetTLSConfig() *tls.Config { return t.tlsConfig }

+// SetLocalAddress sets the local address in transport.
+func (t *Transport) SetLocalAddress(addr net.IP) {
+	t.localAddress = addr
+}
+
 const (
 	defaultExpire  = 10 * time.Second
 	minDialTimeout = 1 * time.Second
--- a/plugin/pkg/proxy/proxy.go
+++ b/plugin/pkg/proxy/proxy.go
@@ -2,6 +2,7 @@ package proxy

 import (
 	"crypto/tls"
+	"net"
 	"net/http"
 	"runtime"
 	"sync/atomic"
@@ -135,6 +136,20 @@ func (p *Proxy) incrementFails() {
 	atomic.AddUint32(&p.fails, 1)
 }

+// SetLocalAddress sets the local address for the proxy, used as the source address for outbound connections.
+func (p *Proxy) SetLocalAddress(addr net.IP) {
+	p.transport.SetLocalAddress(addr)
+	if p.transport.httpClient != nil {
+		httpTransport := p.transport.httpClient.Transport.(*http.Transport)
+		if addr == nil {
+			httpTransport.DialContext = nil
+			return
+		}
+		dialer := &net.Dialer{LocalAddr: &net.TCPAddr{IP: addr}}
+		httpTransport.DialContext = dialer.DialContext
+	}
+}
+
 const (
 	maxTimeout = 2 * time.Second
 )