Future enhancement: Add DNS proxy
davidhadas opened this issue · comments
- Analyze the List of Names resolved - behavior change, tunneling
- Analyze data transferred on Req and Resp (tunneling attacks)
POC for adding dns proxy shows:
- Serving changes are needed to allow queue-proxy to open port 53 - there seem to be 2 options to do that:
- Run setcap cap_net_bind_service+ep - can only be done with Dockerfile - not with ko
- Use pod level sysctl net.ipv4.ip_unprivileged_port_start=53
- Serving changes are needed to ensure podSpec include:
- dnsPolicy: None
- dnsConfig: nameservers: - 127.0.0.1
- Serving need to set env variable to provide queue-proxy with the cluster nameserver ip address(es)
Potential Value:
- Identify unexpected DNS query to names not in criteria
- Ignore alerts to IPs received from DNS to approved names
- Identify dns protocol anomalies (attempts at DNS tunneling from an already approved DNS server)
- The basis for future control over egress
This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.
/remove-lifecycle stale
This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.
It is left for future to extend Guard for DNS support.
A POC was created but has not reached maturity and therefore not merged.
/remove-lifecycle stale
This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.
/remove-lifecycle stale
This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.