Python代理-> dansguardian：如何发送原始源ip？

Question

I have a python proxy for DNS. When I get a DNS request I need to pass an http request to dansguardian on behalf of the original source, let it to decide what happens to the request, get the result and redirect client to elsewhere based on the response from dansguardian.

The network skeleton is like this:

Client -> DNS Proxy -> DG -> Privoxy -> Web.

Client requests A , DNS Proxy intercepts, asks DG on behalf of the client, get's answer: 1. If DG filtered it, proxy send a local ip address instead of actual IP for A question. 2. If DG didn't filter, DNS proxy let's the client's net to flow naturally.

Here is the sample python code that I've tried:

        data,addr = sock.recvfrom(1024)
        OriginalDNSPacket = data
        # I get OriginalDNSPacket from a socket
        # to which iptables redirected all port 53 packets
        UDPanswer = sendQues(OriginalDNSPacket, '8.8.8.8') 
        proxies = {'http': 'http://127.0.0.1:8080'} # DG Port
        s = requests.Session()

        d = DNSRecord.parse(UDPanswer)
        print d
        ques_domain = str(d.questions[0].get_qname())[:-1]
        ques_tld = tldextract.extract(ques_domain)
        ques_tld = "{}.{}".format(ques_tld.domain, ques_tld.suffix)
        print ques_tld
        for rr in d.rr:
            try:
                s.mount("http://"+ques_tld, SourceAddressAdapter(addr[0])) # This was a silly try, I know.
                s.proxies.update(proxies)
                response = s.get("http://"+ques_tld)
                print dir(response.content)
                print response.content
                if "Access Denied" in response.content:
                    d.rr = []
                    d.add_answer(*RR.fromZone(ques_domain + " A " + SERVER_IP))
                    d.add_answer(*RR.fromZone(ques_domain + " AAAA  fe80::a00:27ff:fe4a:c8ec"))
                    print d
                    socket.sendto(d.pack(), addr)
                    return
                else:
                    socket.sendto(UDPanswer, addr)
                    return
            except Exception, e:
                print e
                pass

The question is how can I send the request to DG, and fool it, like, the req comes from a client?

Answer 1

In dansguardian.conf, usexforwardedfor is needed to enabled.

So the conf now looks like this:

...
# if on it adds an X-Forwarded-For: <clientip> to the HTTP request
# header.  This may help solve some problem sites that need to know the
# source ip. on | off
forwardedfor = on


# if on it uses the X-Forwarded-For: <clientip> to determine the client
# IP. This is for when you have squid between the clients and DansGuardian.
# Warning - headers are easily spoofed. on | off
usexforwardedfor = on
...

And on proxy server I just needed to add the following, which I tried before but because of the DG conf it didn't work:

response = s.get("http://"+ques_tld, headers={'X-Forwarded-For': addr[0]})

It worked like a charm.

Thanks @boardrider.