| Age | Commit message (Collapse) | Author |
|---|
|
Problem reported by Kirill A. Korinsky
OK kn
|
|
Since the latest libunbound update the frontend process would segfault
about once a day on one of my MX servers with what looks like a
use-after-free deep inside of libunbound.
Maybe we are poking too much at internals and the shared cache is too
much of a hack. #ifdef for now to ease investigation, but it is
possible that this code just has to go.
|
|
heavy lifting by sthen
|
|
partly checked by millert@
|
|
(lib)unbound might mark many servers down in case of a network issue.
This is something that can easily happen for unwind(8).
Problem pointed out by Kirill A. Korinsky in unbound(8).
https://github.com/NLnetLabs/unbound/issues/362
OK sthen
|
|
Add missing error checks to all calls under sbin/
Input kettenis, millert
OK millert
|
|
Add missing error checks to all calls under sbin/
Input & OK millert
|
|
heavy lifting by & OK sthen
|
|
Problem spotted and diff from Einfach Jemand (rru.142 at gmail),
thanks!
OK phessler, jca
|
|
Both can be used to cause high CPU load and potentially denial of
service with specifically crafted DNSSEC responses.
This is a sync with unbound(8).
|
|
Go ahead florian@ OK tb@
|
|
This cherry-picks upstream git commit
0ee44ef384593ed0382d1ce6048d5a9c9440b45c.
Issue reported by landry@, which could be traced back to a buggy WiFi
driver that would constantly return ENOBUFS. This in turn lead
unwind(8) enter a tight loop through poll / sendto without making any
progress and burning 100% cpu.
OK sthen
I missed to commit this file when commiting to unbound.
Pointed out by tb, thanks!
|
|
|
|
confirmed by florian
|
|
This cherry-picks upstream git commit
0ee44ef384593ed0382d1ce6048d5a9c9440b45c.
Issue reported by landry@, which could be traced back to a buggy WiFi
driver that would constantly return ENOBUFS. This in turn lead
unwind(8) enter a tight loop through poll / sendto without making any
progress and burning 100% cpu.
OK sthen
|
|
Already commited upstream.
|
|
https://github.com/NLnetLabs/unbound/pull/931
|
|
The api changed to handle cookies and extended error codes.
Passing in NULL for config_file disables cookie handling so we do not
need to pass a valid comm_reply, NULL will do.
|
|
|
|
ok florian@
|
|
This pulls the check for rcode up, before we check if the answer
packet has sensible length. Since we are not touching the packet at
all, we don't care about the size and don't need to log if the size is
wrong from a DNS perspective.
With asr error reporting improved in the previous commit, this
probably gets rid of all "bad packet: too short" messages.
OK semarie
|
|
When an upstream nameserver is not available asr is not synthesizing a
SERVFAIL rcode (duh), but sets ar_errno. When we need SERVFAIL further
down,we need to set the rcode ourselves.
While here, don't complain about a too short packet when asr already
told us that resolving did not work out in check_dns64_done.
OK semarie
|
|
unwind.8: point to resolvd(8) for autoconf sources
unwind.conf.5: order preferred list by order of preference
resolvd.8: reformat to read better
route.8: no need to discuss unwind in the nameserver command
umb.4 + sppp.4: note the sending of nameserver proposals
the umb/sppp text is from claudio
tobhe confirmed iked sending proposals when configured to do so
much assistance and ok: florian claudio
|
|
Luckily routesock would never be <= 2 so shutdown would always failing
with EINVAL and not shutting down random other sockets.
The kernel was just uselessly piling up route messages that we were
never reading.
This mistake first showed up in slaacd(8) and then was copied to the
other daemons.
Reported & fixed by Josiah Frentsos (jfrent at tilde.team), thanks!
OK kn
|
|
Silences -Wstrict-prototype warnings seen with clang 15 on amd64 and arm64.
ok florian
|
|
Let it through to forwarders like we do with AS112 domains because
home.arpa might be useful in the local network.
Issue reported by Ryan Kavanagh (rak at rak.ac), thanks!
Input & OK tb
|
|
|
|
Since we no longer use that specific resolver there is also no need
to re-check it.
tb pointed out that prev_state might be used uninitialized in this
case.
OK tb
|
|
ok florian
|
|
ok florian
|
|
indicated.
Found by kn with amap.
Input bluhm.
OK deraadt, tb, otto, kn
from florian@
|
|
|
|
|
|
|
|
|
|
resolvd, slaacd, unwind.
The mitigation story is way better: syscalls are in a randomly located
libc, and every syscall stub is randomly located inside that due to
random relinking. As opposed to fixed offset inside a release binary.
There is one known consequence: /usr nfs mounting must use statically
configured IP addresses.
ok kettenis florian, others
|
|
|
|
helper functions from unbound(8).
Delete unused shared memory functions that the unbound(8) daemon uses
for statistics gathering. While here get rid of daemon.h which is
unused, too.
With this we can remove the hack in config.h to pretend we don't have
shmget to prevent linker errors which makes syncing with unbound(8)
easier.
|
|
jmc@ dislikes a comma before "then" in a conditional, so leave those
untouched.
ok jmc@
|
|
queries. There is no need to do all this work just to get access to
the query id and flags.
OK bket, sthen
|
|
search domains and retry.
|
|
|
|
Upstream renamed parse_edns_from_pkt to parse_edns_from_query_pkt and
added two arguments (config_file and comm_point) that we don't use,
adjust callers in frontend accordingly.
|
|
parse_extract_edns_from_response_msg and parse_edns_from_pkt to
parse_edns_from_query_pkt in libunbound 1.14.0.
Both funktions work equally well for us but it would look weird to use
the "from_response_msg" function on the query so switch to
parse_edns_from_pkt in preparation for the libunbound update.
testing & OK sthen
|
|
Use the OpenSSL 1.1 codepath using accessors that have been available
since LibreSSL 2.7 instead of reaching into the structs.
ok sthen
|
|
Instead of repairing potential garbage ensure that we receive proper C
strings. Inspired by a similar diff by deraadt@ for ldapd.
|
|
macro-build a replacement for sccsid, and was done without any concern
for namespace damage. Unfortunately this practice started infecting
other code as others were unaware they didn't need the file.
ok millert guenther
|
|
link-local addresses. With this dns proposals from slaacd with
link-local addresses from slaacd(8) are wroking.
Requested by & OK kn
|
|
The resolver is the actual consumer and shouldn't trust the frontend.
Fold the IPv4/IPv6 specific checks thanks to the previous commit.
Idea from florian
OK florian
|
|
Reduce duplicate code and use getnameinfo(3) for IPv4 as well.
This commit is the equivalent of sbin/resolvd/resolvd.c revision 1.21
"Simplify address family handling, ditch inet_ntop(3)".
OK florian
|
