Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

node-local-dns: cache polluted by EDNS0 client subnet #650

Open
mchtech opened this issue Oct 21, 2024 · 0 comments
Open

node-local-dns: cache polluted by EDNS0 client subnet #650

mchtech opened this issue Oct 21, 2024 · 0 comments

Comments

@mchtech
Copy link

mchtech commented Oct 21, 2024

coredns support EDNS0 client subnet (ECS) to forward dns requests with "real" client ip. But its cache module does not support it: coredns/coredns#1628

In a same node, pod A resolves domain with ECS (for test or cache pollution attack or other reasons) and other pods send DNS requests without ECS (normal scenario). The cache of node-local-dns will be polluted by pod A.

As a node-level "local" dns caching service, EDNS0 client subnet should be disabled, before coredns implements per-CIDR cache or supports caching for ECS.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant