PolyculeConnect/polycule-network
4
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix and clean dns

Browse source
This commit is contained in:
chapeau 2024-07-30 14:55:06 +02:00
parent 714eda6d66
commit 06edb7c818
4 changed files with 22 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
dns.py
View file

@ -1,4 +1,5 @@
import time import time
import socket
from ipaddress import IPv4Address, IPv4Network from ipaddress import IPv4Address, IPv4Network
from dnslib import DNSRecord,RCODE,QTYPE from dnslib import DNSRecord,RCODE,QTYPE
from dnslib.server import DNSServer,DNSHandler,BaseResolver,DNSLogger from dnslib.server import DNSServer,DNSHandler,BaseResolver,DNSLogger
@ -16,11 +17,20 @@ class ProxyResolver(BaseResolver):
address = self.default_address address = self.default_address
port = self.default_port port = self.default_port
subnets = [ (net["local_range"], net["local_translated_range"]) for net in self.config.data["network"].values() ] subnets = [
(name, net["local_range"], net["local_translated_range"], net["dns"])
for name, net
in self.config.data["network"].items()
]
qname = DNSLabel(request.q.qname) qname = DNSLabel(request.q.qname)
for dns in self.config.dns_servers: for (net, sub, trans, dns) in subnets:
if dns["domain"] == str(qname)[-len(dns["domain"])-1:-1]: for serv in dns:
address = dns["ip"] if serv["domain"] == str(qname)[-len(serv["domain"])-1:-1]:
if net == self.config.local_network:
address = dns["ip"]
else:
address = translate(serc["ip"], sub, trans)
try: try:
proxy_r = request.send(address, port, timeout=self.timeout) proxy_r = request.send(address, port, timeout=self.timeout)
reply = DNSRecord.parse(proxy_r) reply = DNSRecord.parse(proxy_r)
@ -29,8 +39,8 @@ class ProxyResolver(BaseResolver):
reply.header.rcode = getattr(RCODE, 'NXDOMAIN') reply.header.rcode = getattr(RCODE, 'NXDOMAIN')
if address != self.default_address and address not in self.config.data["network"][self.config.local_network]["dns"].values(): if address != self.default_address and address not in self.config.data["network"][self.config.local_network]["dns"].values():
for rr in reply.rr: for rr in reply.rr:
for (sub, trans) in subnets: for (net, sub, trans, dns) in subnets:
if IPv4Address(rr.rdata) in IPv4Network(sub): if address in dns.values() and netIPv4Address(rr.rdata) in IPv4Network(sub):
rr.rdata.data = IPv4Address(translate(str(rr.rdata), sub, trans)).packed rr.rdata.data = IPv4Address(translate(str(rr.rdata), sub, trans)).packed
reply.set_header_qa() reply.set_header_qa()
return reply return reply

2
docker/entrypoint.sh
View file

@ -1,5 +1,3 @@
#!/bin/sh #!/bin/sh
poetry run python load.py poetry run python load.py
wg-quick up ./wg-pn.conf
sleep infinity

5
load.py
View file

@ -80,7 +80,7 @@ def load_wireguard(config):
peer["endpoint"] = endpoint peer["endpoint"] = endpoint
peer["allowed_ips"] = config.data["network"][net]["local_translated_range"] peer["allowed_ips"] = config.data["network"][net]["local_translated_range"] + ", " + config.data["network"][net]["wireguard_address"]
untranslated_networks = config.data["network"][net].get("untranslated_networks", "") untranslated_networks = config.data["network"][net].get("untranslated_networks", "")
if untranslated_networks != "": if untranslated_networks != "":
peer["allowed_ips"] += ", " + untranslated_networks peer["allowed_ips"] += ", " + untranslated_networks
@ -97,9 +97,10 @@ def load_wireguard(config):
peers=peers peers=peers
)) ))
config = Config("./config/config.toml") config = Config("/config/config.toml")
load_firewall(config) load_firewall(config)
load_wireguard(config) load_wireguard(config)
run("wg-quick up ./wg-pn.conf")
import dns import dns
dns.run(config, port=5353) dns.run(config, port=5353)

6
templates/rules.nft
View file

@ -26,12 +26,12 @@ table ip filter {
chain postrouting { chain postrouting {
type nat hook postrouting priority 100; policy accept; type nat hook postrouting priority 100; policy accept;
ip saddr @local_range ip daddr @remote_range snat to ip saddr map @ip_map_snat ip daddr @remote_range snat to ip saddr map @ip_map_snat
} }
chain prerouting { chain prerouting {
type nat hook prerouting priority 100; policy accept; type nat hook prerouting priority 100; policy accept;
ip saddr @remote_range ip daddr @local_translated_range dnat to ip daddr map @ip_map_dnat ip daddr @local_translated_range dnat to ip daddr map @ip_map_dnat
} }
} }