feat: transparent DNS interception via in-namespace server - #56

Closed

ammario wants to merge 52 commits into

mainfrom

feat/dns-transparent-redirect

Commits on Oct 13, 2025

feat: implement transparent DNS redirect in strong jails

authored and
ammar-agent
committed
dec6469
fix: handle localhost DNS with minimal resolv.conf for transparent redirect

ammario
authored and
ammar-agent
committed
43b7bec
chore: remove shell test script per project guidelines

ammario
authored and
ammar-agent
committed
5424314
feat: implement transparent DNS with in-namespace server

authored and
ammar-agent
committed
5cfe465
fix: use anyhow::bail! for consistency

ammario
authored and
ammar-agent
committed
c9508e7
fix: properly handle pipe file descriptor types

ammario
authored and
ammar-agent
committed
7cf01e8
fix: resolve file descriptor handling and scope issues

ammario
authored and
ammar-agent
committed
f2923bc
fix: ensure loopback is up and bind to all interfaces for DNS

ammario
authored and
ammar-agent
committed
23c25ce
docs: add CI machine debugging tips for Linux strong jail

ammario
authored and
ammar-agent
committed
d46dbd9
refactor: remove obsolete fix_systemd_resolved_dns function

ammario
authored and
ammar-agent
committed
f8c9f78
refactor: extract namespace DNS server logic to dedicated module

authored and
ammar-agent
committed
730f5d8
fix: remove duplicative CI debugging section from CLAUDE.md

ammario
authored and
ammar-agent
committed
e305014
fix: update LinuxJail Clone implementation to use dns_server field

ammario
authored and
ammar-agent
committed
f436fb0
fix: handle EINTR in DNS server to prevent spurious failures

ammario
authored and
ammar-agent
committed
cbbf02c
fix: add fork safety measures for tokio runtime compatibility

ammario
authored and
ammar-agent
committed
0f6266f
refactor: rename NamespaceDnsServer to ForkedDnsProcess and use nix crate

ammario
authored and
ammar-agent
committed
bed47c5
refactor: remove redundant parent monitoring loop in ForkedDnsProcess

ammario
authored and
ammar-agent
committed
a349363
docs: update README DNS section with current implementation details

ammario
authored and
ammar-agent
committed
f207212
fix: add comprehensive cleanup for orphaned DNS processes and document cleanup requirements

ammario
authored and
ammar-agent
committed
1744378
refactor: simplify DNS server cleanup and defer orphan process handling

ammario
authored and
ammar-agent
committed
27a7e80
fix: add missing nix crate features for sched, user, and signal modules

ammario
authored and
ammar-agent
committed
a1a160a
fix: pass File reference directly to setns for AsFd trait compatibility

ammario
authored and
ammar-agent
committed
eb9c21b
fix: remove unused AsRawFd import after setns refactor

ammario
authored and
ammar-agent
committed
f359a35
fix: keep DNS server alive in forked process to prevent premature termination

ammario
authored and
ammar-agent
committed
2509b1e
fix: run DNS server directly in child process without threading

ammario
authored and
ammar-agent
committed
2c88a61
fix: ensure child process always exits with proper status code

ammario
authored and
ammar-agent
committed
45df0a9
fix: simplify DNS server to run directly in child process loop

ammario
authored and
ammar-agent
committed
f0fa12d
debug: add logging to DNS server to diagnose timeout issues

ammario
authored and
ammar-agent
committed
f91a528
fix: avoid unsafe operations after fork in multithreaded runtime

ammario
authored and
ammar-agent
committed
6a18914
fix: correct import usage in build_dns_response function

ammario
authored and
ammar-agent
committed
e795be7
fix: add proper simple_dns imports for Linux build

ammario
authored and
ammar-agent
committed
72d02ae
fix: use fully qualified paths for simple_dns types in Linux-only functions

ammario
authored and
ammar-agent
committed
c30482b
refactor: move DNS server code from main.rs to dns.rs

ammario
authored and
ammar-agent
committed
ec05f93
fix: correct import and type comparisons for Linux build

ammario
authored and
ammar-agent
committed
54f27e2
fix: update ResourceRecord constructor for simple_dns 0.7 API changes

ammario
authored and
ammar-agent
committed
51f7170
fix: make dns module public for exec DNS server access

ammario
authored and
ammar-agent
committed
99a4bae
fix: address clippy warnings for Default impl and unnecessary vec allocation

ammario
authored and
ammar-agent
committed
c74c109
fix: use derive(Default) instead of manual implementation per clippy

ammario
authored and
ammar-agent
committed
c530f1d
ci: trigger CI run after local fixes

ammario
authored and
ammar-agent
committed
0de6ecc
fix: use nix::sched::setns instead of libc::setns for namespace entering

ammario
authored and
ammar-agent
committed
42f5d09
fix: remove unused import AsRawFd in dns.rs to fix clippy warning

ammario
authored and
ammar-agent
committed
38da870
fix: add timeout to nft delete commands to prevent hanging

ammario
authored and
ammar-agent
committed
ff3c42f
fix: re-establish PR_SET_PDEATHSIG after dropping privileges to prevent DNS server leaks

ammario
authored and
ammar-agent
committed
0fed182
fix: remove test-with-cleanup workflow and associated scripts

ammario
authored and
ammar-agent
committed
0ebcd33
fix: add timeout to nft delete commands to prevent hanging

ammario
authored and
ammar-agent
committed
7e95bf7
refactor: use tokio's async runtime for command timeouts

ammario
authored and
ammar-agent
committed
3dcb4f4
refactor: replace nested Result with CommandResult enum for cleaner timeout handling

ammario
authored and
ammar-agent
committed
7777430
docs

ammario
authored and
ammar-agent
committed
5ed2a2f
sec: harden DNS server with critical security fixes

authored and
ammar-agent
committed
99fb617
fix(linux/dns): use libc::SYS_close_range for portable close_range fallback
ammar-agent
committed
0ccb206
chore: remove benches and related dev-deps (criterion/pprof) to keep CI fast
ammar-agent
committed
22bc5d2
sec(ipv6): add IPv6 nftables parity in namespace (DNS DNAT to ::1, drop other IPv6 egress)
ammar-agent
committed
5d8acb0