summaryrefslogtreecommitdiffstats
path: root/sbin/unwind (follow)
Commit message (Collapse)AuthorAgeFilesLines
* sync to unbound 1.13.1; heavy lifting by sthenflorian2021-03-1636-2951/+3596
|
* Path #defines are traditionally prefixed with _PATH.florian2021-02-273-8/+8
| | | | Pointed out by deraadt
* We need to track the pid of the connecting control connection to beflorian2021-02-241-4/+6
| | | | | | | | | | | | | able to send answers back to the correct client in case two are connecting at the same time. We also need to pass the pid around to the resolver process so that it can hand it back to us. Debugged by deraadt and dlg who noticed that answers would always arrive on the first control connection. deraadt@ points out that tracking the pid is not the best choice in case one process wants to hold open two connections but at least this brings us in line with all the other privsep daemons with control tools. If we change this we should change it in all daemons.
* zap unneccessary .Pp;jmc2021-02-201-4/+2
|
* Add an EXAMPLES sectionsolene2021-02-191-2/+26
| | | | | rewording by jmc@ ok jmc@
* Only probe for DNS64 presence when we know that we can talk to the slaacdflorian2021-02-071-2/+3
| | | | | | | | | provided nameservers, i.e. the stub resolver check succeeded. Previously we would only probe DNS64 on network change but would not reschedule when it failed. Sometimes (most of the time?) this failes because our address is still tentative or a default route has not yet been installed. OK phessler
* Revert delayed opening of trust anchor file. The code was somewhatflorian2021-02-063-62/+16
| | | | | | ugly and the underlying problem (dhclient and unwind playing well together) should be solved differently. Final straw was jca reporting that it breaks his setup.
* Make progress when stepping through rdns proposals even when skippingflorian2021-01-311-3/+3
| | | | localhost.
* Re-try to open DNSSEC trust anchor file if /var is not mounted yet.florian2021-01-303-16/+62
| | | | | | This is a step towards starting unwind earlier, before the network is up and partitions are mounted. OK kn
* Some libunbound configuration changes can change the quality of aflorian2021-01-291-11/+17
| | | | | resolver so we have to schedule a re-check. OK kn
* Don't filter by address family on the route socket.florian2021-01-291-4/+4
| | | | While here also set SOCK_NONBLOCK on the frontend routesock.
* A new resolver can be created while we currently run a check with theflorian2021-01-281-3/+7
| | | | | | | | | old configuration. We will then request another check that runs in parallel to the old check. If the new check finishes earlier, the current check result will be overwritten by an outdated check result which is likely wrong. While here fix some whitespace. OK phessler
* Determine available address families (and monitor when this changes)florian2021-01-275-14/+126
| | | | | | | to configure libunbound accordingly. This way it no longer tries to talk to IPv6 nameservers when only IPv4 is available and vice versa. input deraadt OK kn
* Some config changes require a restart of all resolvers even DEAD ones;florian2021-01-261-4/+2
| | | | | handle them like UNKNOWN. Found the hard way by kn.
* Revert local diff now that we no longer use syslog logging inflorian2021-01-251-4/+0
| | | | | libunbound. OK phessler
* Disable logging to syslog for libunbound. We are not getting anythingflorian2021-01-252-6/+9
| | | | | | | useful for us out of it and it can be quite noisy when we are missing IPv4 or IPv6 addresses. It is still available when logging to stderr when running with -d. OK phessler
* Implement DNS64 synthesis.florian2021-01-247-15/+738
| | | | | | | | | | | | | | | When unwind(8) learns new autoconf resolvers (from dhcp or router advertisements) it checks if a DNS64 is present in this network location and tries to recover the IPv6 prefix used according to RFC7050. The learned autoconf resolvers are then prevented from upgrading to the validating state since DNS64 breaks DNSSEC. unwind(8) can now perform its own synthesis. If a query for a AAAA record results in no answer we re-send the query for A and if that leads to an answer we synthesize an AAAA answer using the learned prefixes. Testing & OK kn
* Move resolv_conf string generation for ASR to function; makesflorian2021-01-231-14/+25
| | | | upcomming DNS64 diff simpler.
* Don't just blindly upgrade to VALIDATING if we see a SECURE answer.florian2021-01-231-3/+3
| | | | | | Let's go through the check_resolver() / new_resolver() code path which will also hook up the resovler to the shared cache. This means also one less special case for upcomming DNS64 support.
* Make imsg event structs static to fix -fno-common.florian2021-01-193-18/+15
| | | | | Follows claudio's lead in ospfd et al. Problem reported by mortimer.
* Move control_state and ctl_conns to control.c, it's not neededflorian2021-01-194-26/+24
| | | | | | elsewhere and unbreaks -fno-common. Inspired by claudio Problem reported by mortimer
* Prevent more yacc clashes; fixes -fno-common.florian2021-01-191-0/+6
| | | | Problem reported by mortimer.
* Reduce scope of routesock unbreaking -fno-common.florian2021-01-191-3/+6
| | | | Problem reported by mortimer.
* No need for a global uw_process; unbreaks -fno-common.florian2021-01-194-26/+17
| | | | Problem reported by mortimer
* Remove c++ comment that snuck in and remove useless debug output.florian2021-01-181-3/+2
|
* Implement listening on 53/TCPflorian2021-01-123-11/+313
| | | | | | | | | | | Since we are only serving localhost we could get away with doing serving over UDP only because we have a huge MTU on lo0, it's still not correct behavior. This also enables sending truncated answers with TC set if the answer does not fit into the edns announced udp size. Testing at least by matthieu, jca, otto, phessler OK phessler
* Rewrite query parsing and answer formatting using libunbound providedflorian2021-01-121-168/+218
| | | | | | | | | | | functions. With this we can filter out DNSSEC RRsets if the client did not ask for them. We will also be able to send truncated answers to indicate to the client to switch to tcp. This will be enabled in the next commit. Testing at least by matthieu, jca, otto, phessler OK phessler
* do not call log_addr() when the address is NULLanton2021-01-061-2/+3
| | | | ok florian@
* Update default preference listkn2020-12-261-3/+3
| | | | OK florian
* Otto hit an impossible situation: an answer bigger than 64k.florian2020-12-262-4/+11
| | | | | | | Log the query and answer SERVFAIL instead of exiting fataly. That way we can at least figure out where libunbound goes off the rail. OK otto
* Introduce query_imsg2str() to simplify printing "qname class type".florian2020-12-111-18/+24
| | | | OK kn some time ago
* The recent fix to handle large answers in unwind (errata #5 for 6.8)florian2020-12-113-83/+81
| | | | | | | | | | has the downside to always copy the maximum IMSG size (about 16k) between the resolver and frontend process for DNS answers because we had to keep it as simple as possible. We can now rearange things in -current to be less wasteful. This copies only the usually small DNS answer. In the unusual case that a DNS answer is larger than the maximum IMSG size fragment the message and send multiple IMSGs.
* Warning: arithmetic on a pointer to void is a GNU extension; mergedflorian2020-12-111-1/+1
| | | | upstream.
* Sprinkle in some static to prevent missing prototype warnings; mergedflorian2020-12-111-3/+3
| | | | upstream.
* sync to libunbound 1.13.0florian2020-12-1133-3217/+4712
| | | | | Support for channel reuse of TCP and TLS (DoT) streams should improve latency when the DoT strategy is used in unwind.
* Use RB_FOREACH_SAFE instead of handrolling ittb2020-11-093-12/+7
| | | | | | No binary change on amd64. ok florian
* Check for and handle duplicates on RB_INSERTtb2020-11-093-6/+17
| | | | | | | | | | If the configuration contains duplicate domains in the block list file or a force list, the nodes would leak in the frontend process each time the config is reloaded. Also add a check when copying the force list over imsg and fatal if a duplicate is encountered. This should never happen. ok florian
* Don't leak domain when freeing block list nodestb2020-11-091-1/+2
| | | | | | | | Domains contained in the block list file were not correctly freed. This would grow the frontend process by the size of the blocklist file on each config reload. ok florian
* Handle DNS answers that are larger than the maximum imsg size (aboutflorian2020-11-054-25/+77
| | | | | | | | | | | | 16k) by splitting them up. Previously unwind would send meta-data about the finished query from the resolver process to the frontend process and then silently fail to send the actual answer because it was too big for imsg. When receiving the meta-data for the next query the frontend process would then exit via fatal() because it was still expecting an answer. This likely fixes rare crashes observed by Leo Unglaub. Note that even with DNSSEC signatures, answers this big are very rare. OK tb, benno
* Add some documentation about the cachingsolene2020-10-292-4/+12
| | | | | | | done in unwind. Inputs from jmc@ florian@ ok jmc@ florian@
* Update to libunbound 1.12.0; heavy lifting by sthenflorian2020-10-2841-3922/+5457
|
* Plug leak of 'str': at the end of the strsep() loop it is NULL, sootto2020-10-021-2/+2
| | | | | freeing it is a no-op. Leak detected by my experimental malloc leak detector. ok florian@
* When an interface disapears we need to forget the learned autoconfflorian2020-09-123-8/+25
| | | | | resolvers. OK kn
* Use SO_REUSEADDR on the listening socketsjca2020-08-291-1/+8
| | | | | Lets unwind(8) run when another name server listens on the wildcard address. Conflict with unbound(8) spotted by sthen@, ok florian@ deraadt@
* Missing prototype for a currently unused function.florian2020-08-291-0/+1
| | | | Reported upstream.
* sync to libunbound-1.11.0florian2020-08-2937-3423/+4480
| | | | | all heavy lifting done by sthen in unbound testing benno
* Do not log "startup" to syslog.florian2020-05-251-3/+1
| | | | | | | | | | | | slaacd and unwind start very early in the boot process and syslog is not fully available yet so these messages tend to get lost. But they are also not particularly useful. Prompted by a report by Jason Mader on bugs@ OK deraadt, claudio, bluhm Note that this code has been copied around to all our privsep daemons and also lives in usr.sbin. Leave it alone there because multiple people said they find it useful for those daemons.
* sync libunbound fixes from unbound, ok florian@sthen2020-05-199-72/+246
|
* sockaddr_rtdns does not guarantee alignment of the buffer. So firstotto2020-05-101-5/+10
| | | | | | memcpy the address into a local var before comparing it with code that reads ints using int *. at least sparc64 and landisk suffer from this. with and ok jca@
* Use a union to ensure cmsg buffer is properly alignedjca2020-05-081-4/+10
| | | | | Fixes a crash on landisk (strict alignement arch) reported by otto@ ok deraadt@ otto@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.