Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable DNSResolver option #5945

Closed
cpacia opened this issue Jan 25, 2019 · 2 comments
Closed

Disable DNSResolver option #5945

cpacia opened this issue Jan 25, 2019 · 2 comments
Labels
help wanted Seeking public contribution on this issue kind/enhancement A net-new feature or improvement to an existing feature

Comments

@cpacia
Copy link

cpacia commented Jan 25, 2019

Not sure what the best way to handle this is, but the issue is if a user is using Tor, say, the DNSResolver in the name system may leak their IP. As far as I can tell it looks like the resolver does an IsDomain check and exits if it's not a domain name without actually doing the DNS query.

So if they don't try to resolve a domain name it shouldn't leak but if they do then it would leak their IP.

I'm currently gating the Resolve function in my own code with a IsDomain check to make sure it's not allowing domains to be passed in but it might be nice to be more explicit about this as a consumer may inadvertently pass in a domain name while trying to remain private.

Possibly a resolve option to skip the dnsrolver.

I can submit a PR if you guys think that's the way to go.

@magik6k
Copy link
Member

magik6k commented Jan 25, 2019

Other nice way would be to disable dns resolver when namesystem is constructed - e.g. by setting
https://github.com/ipfs/go-ipfs/blob/ca77ecc766cd79f6f57490e0fa10d6a12c1be9ae/namesys/namesys.go#L45
to a dummy resolver which returns a closed channel from resolveOnceAsync

@magik6k magik6k added kind/enhancement A net-new feature or improvement to an existing feature help wanted Seeking public contribution on this issue labels Jan 25, 2019
@lidel lidel mentioned this issue Jul 19, 2019
9 tasks
@lidel
Copy link
Member

lidel commented Jul 19, 2019

I think we should default to DNS over TLS or HTTPS and make it possible for user to set custom DNS server. That way Tor users could make go-ipfs use DNS over Tor (enabling DNS on localhost DNSPort 9053 in /etc/tor/torrc).

See #6532

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
help wanted Seeking public contribution on this issue kind/enhancement A net-new feature or improvement to an existing feature
Projects
None yet
Development

No branches or pull requests

3 participants