summaryrefslogtreecommitdiffstats
path: root/sbin/unwind/resolver.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Only probe for DNS64 presence when we know that we can talk to the slaacdflorian2021-02-071-2/+3
| | | | | | | | | provided nameservers, i.e. the stub resolver check succeeded. Previously we would only probe DNS64 on network change but would not reschedule when it failed. Sometimes (most of the time?) this failes because our address is still tentative or a default route has not yet been installed. OK phessler
* Revert delayed opening of trust anchor file. The code was somewhatflorian2021-02-061-3/+1
| | | | | | ugly and the underlying problem (dhclient and unwind playing well together) should be solved differently. Final straw was jca reporting that it breaks his setup.
* Make progress when stepping through rdns proposals even when skippingflorian2021-01-311-3/+3
| | | | localhost.
* Re-try to open DNSSEC trust anchor file if /var is not mounted yet.florian2021-01-301-1/+3
| | | | | | This is a step towards starting unwind earlier, before the network is up and partitions are mounted. OK kn
* Some libunbound configuration changes can change the quality of aflorian2021-01-291-11/+17
| | | | | resolver so we have to schedule a re-check. OK kn
* A new resolver can be created while we currently run a check with theflorian2021-01-281-3/+7
| | | | | | | | | old configuration. We will then request another check that runs in parallel to the old check. If the new check finishes earlier, the current check result will be overwritten by an outdated check result which is likely wrong. While here fix some whitespace. OK phessler
* Determine available address families (and monitor when this changes)florian2021-01-271-8/+43
| | | | | | | to configure libunbound accordingly. This way it no longer tries to talk to IPv6 nameservers when only IPv4 is available and vice versa. input deraadt OK kn
* Some config changes require a restart of all resolvers even DEAD ones;florian2021-01-261-4/+2
| | | | | handle them like UNKNOWN. Found the hard way by kn.
* Disable logging to syslog for libunbound. We are not getting anythingflorian2021-01-251-4/+5
| | | | | | | useful for us out of it and it can be quite noisy when we are missing IPv4 or IPv6 addresses. It is still available when logging to stderr when running with -d. OK phessler
* Implement DNS64 synthesis.florian2021-01-241-5/+234
| | | | | | | | | | | | | | | When unwind(8) learns new autoconf resolvers (from dhcp or router advertisements) it checks if a DNS64 is present in this network location and tries to recover the IPv6 prefix used according to RFC7050. The learned autoconf resolvers are then prevented from upgrading to the validating state since DNS64 breaks DNSSEC. unwind(8) can now perform its own synthesis. If a query for a AAAA record results in no answer we re-send the query for A and if that leads to an answer we synthesize an AAAA answer using the learned prefixes. Testing & OK kn
* Move resolv_conf string generation for ASR to function; makesflorian2021-01-231-14/+25
| | | | upcomming DNS64 diff simpler.
* Don't just blindly upgrade to VALIDATING if we see a SECURE answer.florian2021-01-231-3/+3
| | | | | | Let's go through the check_resolver() / new_resolver() code path which will also hook up the resovler to the shared cache. This means also one less special case for upcomming DNS64 support.
* Make imsg event structs static to fix -fno-common.florian2021-01-191-3/+3
| | | | | Follows claudio's lead in ospfd et al. Problem reported by mortimer.
* No need for a global uw_process; unbreaks -fno-common.florian2021-01-191-4/+3
| | | | Problem reported by mortimer
* Otto hit an impossible situation: an answer bigger than 64k.florian2020-12-261-2/+9
| | | | | | | Log the query and answer SERVFAIL instead of exiting fataly. That way we can at least figure out where libunbound goes off the rail. OK otto
* Introduce query_imsg2str() to simplify printing "qname class type".florian2020-12-111-18/+24
| | | | OK kn some time ago
* The recent fix to handle large answers in unwind (errata #5 for 6.8)florian2020-12-111-33/+30
| | | | | | | | | | has the downside to always copy the maximum IMSG size (about 16k) between the resolver and frontend process for DNS answers because we had to keep it as simple as possible. We can now rearange things in -current to be less wasteful. This copies only the usually small DNS answer. In the unusual case that a DNS answer is larger than the maximum IMSG size fragment the message and send multiple IMSGs.
* Handle DNS answers that are larger than the maximum imsg size (aboutflorian2020-11-051-7/+28
| | | | | | | | | | | | 16k) by splitting them up. Previously unwind would send meta-data about the finished query from the resolver process to the frontend process and then silently fail to send the actual answer because it was too big for imsg. When receiving the meta-data for the next query the frontend process would then exit via fatal() because it was still expecting an answer. This likely fixes rare crashes observed by Leo Unglaub. Note that even with DNSSEC signatures, answers this big are very rare. OK tb, benno
* When an interface disapears we need to forget the learned autoconfflorian2020-09-121-5/+8
| | | | | resolvers. OK kn
* sockaddr_rtdns does not guarantee alignment of the buffer. So firstotto2020-05-101-5/+10
| | | | | | memcpy the address into a local var before comparing it with code that reads ints using int *. at least sparc64 and landisk suffer from this. with and ok jca@
* Return when create_solver() returns NULL to prevent null pointer dereferencetobhe2020-03-191-2/+4
| | | | | | in 'resolvers[type]->state = state'. ok florian@
* We are not correctly upgrading from "UNKNOWN" to "VALIDATING"florian2020-01-281-8/+4
| | | | | | | | | | | | resulting in a "fatal in resolver: wrong unified cache set on resolver". I believe this happens because we are using an UNKNOWN resolving strategy to resolve queries. Disable the upgrade logic for now and always construct a fresh resolver context and set the unified context on it before any cache gets allocated. This causes a bit of memory churn on startup and when changing networks, but better than a crashing unwind. First observed by deraadt
* sbin/unwind: replace TAILQ concatenation loop with TAILQ_CONCATbket2020-01-281-5/+2
| | | | OK florian@. reads ok benno@
* We can not share a cache between validating and resolving strategies.florian2020-01-201-14/+47
| | | | | | | | The resolving only strategies mess up the negative cache by claiming DNSSEC related records do not exist which confuses the validating strategies. Found the hard way by kn@ and analysed by otto@ OK kn@
* Ralph Dolmans from nlnetlabs points out that libunbound usesflorian2019-12-231-5/+1
| | | | | | ub_event_pluggable.c instead of ub_event.c. ( https://github.com/NLnetLabs/unbound/issues/99 ) We have been the odd one out, so switch to ub_event_pluggable, too.
* Workaround unbound github issue #99.florian2019-12-181-1/+6
| | | | | | | https://github.com/NLnetLabs/unbound/issues/99 ub_ctx_delete would free the passed in event_base leading to use-after-free since libunbound never allocated the memory and unwind expects to continue using the event_base.
* Implement unwindctl status memory to show chache memory usage.florian2019-12-181-1/+27
| | | | testing by otto & pamela as part of a larger diff
* Rework unified cache handling to be able to unify key and neg caches.florian2019-12-181-27/+82
| | | | testing by otto & pamela as part of a larger diff
* Make this fit in 80 cols.florian2019-12-151-3/+5
|
* Allow more outgoing ports, the default 16 is pretty tight for theotto2019-12-151-2/+4
| | | | | | | recursor. Also change strategy to not fetch addresses of nameservers pro-actively, it does not help a lot in typical unwind setups and consumes resources we would like to spend on actual resolving user queries. ok florian@
* Be less aggressive pre-allocating memory; ok florian@otto2019-12-141-1/+3
|
* Simplify resolve_done.florian2019-12-141-62/+49
| | | | | | | | - check if this is an answer to a still running query up front, if not there is nothing more to do - get rid of the retry case, we can now just inline it - reduce indent by always calculating elapsed time for DOUBT_NXDOMAIN_SEC Triggered by, input and OK otto
* No use to create resolvers we know are going to be dead; ok florian@otto2019-12-141-1/+7
|
* Don't try dead resolvers; ok florian@otto2019-12-131-2/+3
|
* print type as type and not as rcodeotto2019-12-131-2/+2
|
* Avoid leaks by using the _buf versions of sldns_wire2str_* functions.otto2019-12-131-5/+11
| | | | Also add some consistentcy checking to detect logic errors. ok @florian
* Only create (and check) resolvers listed in preferences.florian2019-12-121-118/+101
| | | | | Unfortunately this required a fair amount of deck chair shuffling. Input & OK otto
* Plug leaks related to running queue maintenance. ok florian@otto2019-12-111-17/+28
|
* Similar to doubting NXDOMAIN when we just switched networks we alsoflorian2019-12-101-14/+18
| | | | | | | | | | | | | | | need to doubt validation errors as we might find ourselves behind a captive portal. The hotspot at schiphol airport uses login.hotspotschiphol.nl: - it is NXDOMAIN on the public internet - hotspotschiphol.nl is signed and attests that login does not exist. - resolves to 1.1.1.5(!) when asking the dhcp nameservers - the dhcp nameservers pass DNSSEC records so validation works This resulted in unwind doing validation and answering SERVFAIL since the answer is bogus. Input & OK otto
* Limit advertised UDP payload size to 1232 bytes to prevent PMTU /florian2019-12-081-2/+3
| | | | | fragmentation issues. OK otto
* Turn opportunistic DoT into their own strategies.florian2019-12-081-116/+84
| | | | | | | | | | | | This is beneficial since we prefer strategies according to their performance. Previously name servers were upgraded to opportunistic DoT if it was available even if the round trip times went through the roof and there was no way to got back to plain udp/53 DNS. To make up a bit of space in the unwindctl status output, name servers learned via DHCP or SLAAC are printed in a new subcommand. The status output will be further improved shortly. Input & OK otto
* Log why an answer is bogus.florian2019-12-061-2/+4
| | | | OK otto
* Use the middle of the histogram bar in the median computationsotto2019-12-061-4/+7
| | | | instead of the right-hand side; ok florian@
* be less verbose in debug logging; ok florian@otto2019-12-051-4/+4
|
* When we detect that a resolver strategy is not validating because theflorian2019-12-041-3/+14
| | | | | | time is wrong enable a timer to check it again later. ntpd might have corrected the time. input & OK otto
* If we see a validated result, we can (must!) assume the resolver isotto2019-12-041-1/+4
| | | | validating; ok florian@
* Cleanup query logging.florian2019-12-031-11/+17
| | | | | | Debug log level 1 gives us basic query progress, level 2 writes out packages. looks good to otto
* Cleanup check_resolver_done() debug logging.florian2019-12-031-11/+16
| | | | | Log answer packet only at debug level 2. looks good to otto
* Add one more debug level and enable very detailed libunbound loggingflorian2019-12-031-4/+4
| | | | | | | with this. Currently only available as a command line flag (-vvv). With this we now have two debug levels available in unwind proper, to be used shortly. looks good to otto
* No need to store "why_bogus" with the resolver, we are no longerflorian2019-12-031-8/+6
| | | | | | | showing it in unwindctl. But log it with level warn for check_resolver so that one can find out what's wrong with a resolver strategy. looks good to otto
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.