summaryrefslogtreecommitdiff
path: root/sbin/unwind
AgeCommit message (Collapse)Author
2021-08-31Adjust .Bl widthKlemens Nanni
2021-08-31Say autoconf not dhcpKlemens Nanni
Do not abuse "dhcp" to say "DHCP and SLAAC". unwind.conf(5) does so but unwindctl(8) does not; in fact, the latter already has `status autoconf' to Show nameservers learned from dhclient(8), dhcpleased(8) or slaacd(8). Adjust unwind's config manual and internal code accordingly; still accept the old keyword but do not document it. hostname.if(5) already advises for `inet[6] autoconf' instead of `dhcp' and other related daemons don't abuse the word "dhcp" like unwind does. Feedback sthen OK florian
2021-08-30INADDR_LOOPBACK check needs htonl(3) to workKlemens Nanni
Found in resolvd(8) which uses the same code.
2021-08-14Use new val-max-restart: 0 option to stop unwind from trying differentFlorian Obser
authorities when encountering a validation error. This only helps one particular case of validation errors: When authorities are out of sync and some carry old zones. In all other cases this causes a huge amount of work that will just end in a SERVFAIL because the result will still be bogus. OK sthen
2021-08-14Fix "no previous prototype" warningFlorian Obser
OK sthen as part of a larger diff
2021-08-14sync to unbound 1.13.2Florian Obser
OK sthen
2021-07-25Do not doubt a secure (i.e. validated) NXDOMAIN response when we justFlorian Obser
switched networks. We validated it, we can't do better than that! While here reorder the long list of conditions to make it easier to understand when we doubt a response because we might be behind a captive portal. First list all conditions when we do not doubt the response and then the two conditions when we do doubt the response. OK benno
2021-07-25We store a list of resolver strategies in order of their preference inFlorian Obser
the configuration struct. This is also an implicit list of enabled resolver strategies. We have also stored an explict lookup array of enabled strategies outside of the configuration to be able to quickly answer "is this strategy enabled" without traversing the preferences list. Move this table into the configuration so that we don't need to "repair" it on config reload. This fixes a bug where on startup the preferences list and enabled lookup table were not in sync. It didn't matter in practice since we do a config reload and then pass in DNSSEC trustanchors on startup. Both actions combined repaired things. OK benno
2021-07-24Capitalise DNS response code, stub learns from SLAAC, clarify wordingkn
OK florian
2021-07-18Document dhcpleased(8) and slaacd(8) besides dhclient(8) as DNS sourcekn
Zap the obsolete dhclient.conf(5) supersede quirk while here. Feedback OK florian
2021-07-12Change the error reporting pattern throughout the tree when unveilBob Beck
fails to report the path that the failure occured on. Suggested by deraadt@ after some tech discussion. Work done and verified by Ashton Fagg <ashton@fagg.id.au> ok deraadt@ semarie@ claudio@
2021-03-16sync to unbound 1.13.1; heavy lifting by sthenFlorian Obser
2021-02-27Path #defines are traditionally prefixed with _PATH.Florian Obser
Pointed out by deraadt
2021-02-24We need to track the pid of the connecting control connection to beFlorian Obser
able to send answers back to the correct client in case two are connecting at the same time. We also need to pass the pid around to the resolver process so that it can hand it back to us. Debugged by deraadt and dlg who noticed that answers would always arrive on the first control connection. deraadt@ points out that tracking the pid is not the best choice in case one process wants to hold open two connections but at least this brings us in line with all the other privsep daemons with control tools. If we change this we should change it in all daemons.
2021-02-20zap unneccessary .Pp;Jason McIntyre
2021-02-19Add an EXAMPLES sectionsolene
rewording by jmc@ ok jmc@
2021-02-07Only probe for DNS64 presence when we know that we can talk to the slaacdFlorian Obser
provided nameservers, i.e. the stub resolver check succeeded. Previously we would only probe DNS64 on network change but would not reschedule when it failed. Sometimes (most of the time?) this failes because our address is still tentative or a default route has not yet been installed. OK phessler
2021-02-06Revert delayed opening of trust anchor file. The code was somewhatFlorian Obser
ugly and the underlying problem (dhclient and unwind playing well together) should be solved differently. Final straw was jca reporting that it breaks his setup.
2021-01-31Make progress when stepping through rdns proposals even when skippingFlorian Obser
localhost.
2021-01-30Re-try to open DNSSEC trust anchor file if /var is not mounted yet.Florian Obser
This is a step towards starting unwind earlier, before the network is up and partitions are mounted. OK kn
2021-01-29Some libunbound configuration changes can change the quality of aFlorian Obser
resolver so we have to schedule a re-check. OK kn
2021-01-29Don't filter by address family on the route socket.Florian Obser
While here also set SOCK_NONBLOCK on the frontend routesock.
2021-01-28A new resolver can be created while we currently run a check with theFlorian Obser
old configuration. We will then request another check that runs in parallel to the old check. If the new check finishes earlier, the current check result will be overwritten by an outdated check result which is likely wrong. While here fix some whitespace. OK phessler
2021-01-27Determine available address families (and monitor when this changes)Florian Obser
to configure libunbound accordingly. This way it no longer tries to talk to IPv6 nameservers when only IPv4 is available and vice versa. input deraadt OK kn
2021-01-26Some config changes require a restart of all resolvers even DEAD ones;Florian Obser
handle them like UNKNOWN. Found the hard way by kn.
2021-01-25Revert local diff now that we no longer use syslog logging inFlorian Obser
libunbound. OK phessler
2021-01-25Disable logging to syslog for libunbound. We are not getting anythingFlorian Obser
useful for us out of it and it can be quite noisy when we are missing IPv4 or IPv6 addresses. It is still available when logging to stderr when running with -d. OK phessler
2021-01-24Implement DNS64 synthesis.Florian Obser
When unwind(8) learns new autoconf resolvers (from dhcp or router advertisements) it checks if a DNS64 is present in this network location and tries to recover the IPv6 prefix used according to RFC7050. The learned autoconf resolvers are then prevented from upgrading to the validating state since DNS64 breaks DNSSEC. unwind(8) can now perform its own synthesis. If a query for a AAAA record results in no answer we re-send the query for A and if that leads to an answer we synthesize an AAAA answer using the learned prefixes. Testing & OK kn
2021-01-23Move resolv_conf string generation for ASR to function; makesFlorian Obser
upcomming DNS64 diff simpler.
2021-01-23Don't just blindly upgrade to VALIDATING if we see a SECURE answer.Florian Obser
Let's go through the check_resolver() / new_resolver() code path which will also hook up the resovler to the shared cache. This means also one less special case for upcomming DNS64 support.
2021-01-19Make imsg event structs static to fix -fno-common.Florian Obser
Follows claudio's lead in ospfd et al. Problem reported by mortimer.
2021-01-19Move control_state and ctl_conns to control.c, it's not neededFlorian Obser
elsewhere and unbreaks -fno-common. Inspired by claudio Problem reported by mortimer
2021-01-19Prevent more yacc clashes; fixes -fno-common.Florian Obser
Problem reported by mortimer.
2021-01-19Reduce scope of routesock unbreaking -fno-common.Florian Obser
Problem reported by mortimer.
2021-01-19No need for a global uw_process; unbreaks -fno-common.Florian Obser
Problem reported by mortimer
2021-01-18Remove c++ comment that snuck in and remove useless debug output.Florian Obser
2021-01-12Implement listening on 53/TCPFlorian Obser
Since we are only serving localhost we could get away with doing serving over UDP only because we have a huge MTU on lo0, it's still not correct behavior. This also enables sending truncated answers with TC set if the answer does not fit into the edns announced udp size. Testing at least by matthieu, jca, otto, phessler OK phessler
2021-01-12Rewrite query parsing and answer formatting using libunbound providedFlorian Obser
functions. With this we can filter out DNSSEC RRsets if the client did not ask for them. We will also be able to send truncated answers to indicate to the client to switch to tcp. This will be enabled in the next commit. Testing at least by matthieu, jca, otto, phessler OK phessler
2021-01-06do not call log_addr() when the address is NULLanton
ok florian@
2020-12-26Update default preference listkn
OK florian
2020-12-26Otto hit an impossible situation: an answer bigger than 64k.Florian Obser
Log the query and answer SERVFAIL instead of exiting fataly. That way we can at least figure out where libunbound goes off the rail. OK otto
2020-12-11Introduce query_imsg2str() to simplify printing "qname class type".Florian Obser
OK kn some time ago
2020-12-11The recent fix to handle large answers in unwind (errata #5 for 6.8)Florian Obser
has the downside to always copy the maximum IMSG size (about 16k) between the resolver and frontend process for DNS answers because we had to keep it as simple as possible. We can now rearange things in -current to be less wasteful. This copies only the usually small DNS answer. In the unusual case that a DNS answer is larger than the maximum IMSG size fragment the message and send multiple IMSGs.
2020-12-11Warning: arithmetic on a pointer to void is a GNU extension; mergedFlorian Obser
upstream.
2020-12-11Sprinkle in some static to prevent missing prototype warnings; mergedFlorian Obser
upstream.
2020-12-11sync to libunbound 1.13.0Florian Obser
Support for channel reuse of TCP and TLS (DoT) streams should improve latency when the DoT strategy is used in unwind.
2020-11-09Use RB_FOREACH_SAFE instead of handrolling itTheo Buehler
No binary change on amd64. ok florian
2020-11-09Check for and handle duplicates on RB_INSERTTheo Buehler
If the configuration contains duplicate domains in the block list file or a force list, the nodes would leak in the frontend process each time the config is reloaded. Also add a check when copying the force list over imsg and fatal if a duplicate is encountered. This should never happen. ok florian
2020-11-09Don't leak domain when freeing block list nodesTheo Buehler
Domains contained in the block list file were not correctly freed. This would grow the frontend process by the size of the blocklist file on each config reload. ok florian
2020-11-05Handle DNS answers that are larger than the maximum imsg size (aboutFlorian Obser
16k) by splitting them up. Previously unwind would send meta-data about the finished query from the resolver process to the frontend process and then silently fail to send the actual answer because it was too big for imsg. When receiving the meta-data for the next query the frontend process would then exit via fatal() because it was still expecting an answer. This likely fixes rare crashes observed by Leo Unglaub. Note that even with DNSSEC signatures, answers this big are very rare. OK tb, benno
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-26 18:28:07 +0000