diladele / dnssafety Goto Github PK

View Code? Open in Web Editor NEW

26.0 26.0 8.0 519 KB

DNS Safety is simple and fast DNS filtering server for your local network

Home Page: https://dnssafety.diladele.com

Shell 100.00%

adblock dns filter forwarder

dnssafety's People

Contributors

Stargazers

Watchers

Forkers

alimp5 serverjoe1 jgitau alfarahat jurius23 gibbon164 apersonintech simhaonline

dnssafety's Issues

Arp resolve timeout is too long by default - shall we redesign to postpone ARP resolve?

Extend format of access log ideally write JSONL file or so

policy matcher by IPv4 address, range, subnet not implemented

Install new build in the test lab

Add Custom DNS 1 forwarder

Implement network listen settings

Note we explicitly does not allow to listen on NICs, just because DNS server runs on a level higher than eithernet (unlike e.g. dnsmasq)

"network" : {
        "listen" : {
            "addresses" : ["tcp://0.0.0.0:53", "udp://0.0.0.0:53" ]
        }
    },

policy matcher by IPv6 address, range, subnet not implemented

Every Request must have timing statistics

like how much time spent selecting processor, scanning in categories database, etc.

Arp resolve is slow for our own public IP

How to reproduce:

restart the dsdnsd
nslookup domain.com our public IP

It hangs! Because it tries to resolve the our public IP address on the network which fails.

Forwarder - on create - check if we have at least ONE upstream configured (fatal error if not)

Implement Norton Safe Web DNS forwarder

Verify access.log is rotated

Build Test Lab

In c++ we use std::equals_range - but in golang we need to reimplement it?

Deploy new build to test lab

Implement minimal docs

Implement caching of DNS responses (use golang cache?)

The cache entry shall be based on the domain name being resolved and type of record?
We should only cache A and AAAA responses?

exclusions - white list by regex is not implemented

We need to have the ability to dump any Request to disk to analyze what went wrong

Implement local /etc/hosts resolver for domain names

verify policy selection based on IPv4 matching works

Implement telemetry upload (anonymized access log or something like this)

Can we get the DNS name of the requester

Better logging (reuse go-logging) and store logs to /opt/websafety-dns/var/logs

We need to have module level logging - othewise it is very hard to debug!

Mimick the inbound DNS requests - if it came in using UDP contact upstreams using UDP

Can we get the MAC addr of the requester

Build PKI for licensing

Deploy new build into the test lab

rules - implement black list by regex

See if DNS Safety Filter is published in Azure marketplace

Arp resolve should ONLY be looking into local ARP table. It is faster and more correct.

Read forwarders from the computer settings (like /etc/resolve.conf)

Re-use updater from web safety to update categories dat

Add Custom DNS 2 forwarder

policy matching by time is not implemented

Note the problem with is - the positive/negative (allowed/blocked) response form DNS server will be cached and thus time matching will not be so precise.

See https://www.itprotoday.com/cloud-computing/how-can-i-configure-how-long-dns-cache-stores-positive-and-negative-responses

Implement CloudFlare DNS forwarder

Implement recategorized domains

Install new build into the Test Lab

Implement categories database (as sqlite?)

Arp resolve is slow for 127.0.0.1

How to reproduce:

restart the dsdnsd
nslookup domain.com 127.0.0.1

It hangs! Because it tries to resolve the 127.0.0.1 address on the network which fails of course.

announce to early adopters

Reuse updater from Web Safety project

Run requests to upstream servers in a single forwarder also in parallel

Optimize storage of categorization database

Check of golang version of categories::hash equals to C++ version of it.

Ensure thread safety and optimization of DNS forwarder

look for parts with

// TODO ensure thread safety