This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".
The branch, next has been updated via b2f96a94e3535a7fccbfd6b7dd18370718d5804b (commit) via 8f3034d0db0addd98d2d287697db0135fe7c9f09 (commit) from b26b242a9c5f9bc5b0a941782b2d57465dc69565 (commit)
Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.
- Log ----------------------------------------------------------------- commit b2f96a94e3535a7fccbfd6b7dd18370718d5804b Author: Michael Tremer michael.tremer@ipfire.org Date: Wed Dec 14 12:51:46 2016 +0000
unbound: EDNS buffer size defaults to 4096
If this is changed, a warning will be shown.
Signed-off-by: Michael Tremer michael.tremer@ipfire.org
commit 8f3034d0db0addd98d2d287697db0135fe7c9f09 Author: Michael Tremer michael.tremer@ipfire.org Date: Wed Dec 14 12:45:07 2016 +0000
unbound: Test for working EDNS buffer size and adjust accordingly
Some networks have equipment that fails to forward DNS queries with EDNS and the DO bit set. They might even lose the replies.
This patch will adjust unbound so that it will not try to receive too large replies and falls back to TCP earlier. This creates some higher load on the DNS servers but at least gives us working DNS.
Signed-off-by: Michael Tremer michael.tremer@ipfire.org
-----------------------------------------------------------------------
Summary of changes: src/initscripts/init.d/unbound | 72 +++++++++++++++++++++++++++++++++++++----- 1 file changed, 64 insertions(+), 8 deletions(-)
Difference in files: diff --git a/src/initscripts/init.d/unbound b/src/initscripts/init.d/unbound index 6c7be6c..8802781 100644 --- a/src/initscripts/init.d/unbound +++ b/src/initscripts/init.d/unbound @@ -18,6 +18,9 @@ USE_FORWARDERS=1 # Cache any local zones for 60 seconds LOCAL_TTL=60
+# EDNS buffer size +EDNS_DEFAULT_BUFFER_SIZE=4096 + # Load optional configuration [ -e "/etc/sysconfig/unbound" ] && . /etc/sysconfig/unbound
@@ -86,6 +89,25 @@ update_forwarders() { esac done
+ # Determine EDNS buffer size + local new_edns_buffer_size=${EDNS_DEFAULT_BUFFER_SIZE} + + for ns in ${forwarders}; do + local edns_buffer_size=$(ns_determine_edns_buffer_size ${ns}) + if [ -n "${edns_buffer_size}" ]; then + if [ ${edns_buffer_size} -lt ${new_edns_buffer_size} ]; then + new_edns_buffer_size=${edns_buffer_size} + fi + fi + done + + if [ ${new_edns_buffer_size} -lt ${EDNS_DEFAULT_BUFFER_SIZE} ]; then + boot_mesg "EDNS buffer size reduced to ${new_edns_buffer_size}" ${WARNING} + echo_warning + + unbound-control -q set_option edns-buffer-size: ${new_edns_buffer_size} + fi + # Show warning for any broken upstream name servers if [ -n "${broken_forwarders}" ]; then boot_mesg "Ignoring broken upstream name server(s): ${broken_forwarders:1}" ${WARNING} @@ -249,6 +271,7 @@ get_memory_amount() {
test_name_server() { local ns=${1} + local args
# Return codes: # 0 DNSSEC validating @@ -259,9 +282,15 @@ test_name_server() { # Exit when the server is not reachable ns_is_online ${ns} || return 1
+ # Determine the maximum edns buffer size that works + local edns_buffer_size=$(ns_determine_edns_buffer_size ${ns}) + if [ -n "${edns_buffer_size}" ]; then + args="${args} +bufsize=${edns_buffer_size}" + fi + local errors for rr in DNSKEY DS RRSIG; do - if ! ns_forwards_${rr} ${ns}; then + if ! ns_forwards_${rr} ${ns} ${args}; then errors="${errors} ${rr}" fi done @@ -271,7 +300,7 @@ test_name_server() { return 3 fi
- if ns_is_validating ${ns}; then + if ns_is_validating ${ns} ${args}; then # Return 0 if validating return 0 else @@ -283,41 +312,62 @@ test_name_server() { # Sends an A query to the nameserver w/o DNSSEC ns_is_online() { local ns=${1} + shift
- dig @${ns} +nodnssec A ${TEST_DOMAIN} >/dev/null + dig @${ns} +nodnssec A ${TEST_DOMAIN} $@ >/dev/null }
# Resolving ${TEST_DOMAIN_FAIL} will fail if the nameserver is validating ns_is_validating() { local ns=${1} + shift
- dig @${ns} A ${TEST_DOMAIN_FAIL} | grep -q SERVFAIL + dig @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL }
# Checks if we can retrieve the DNSKEY for this domain. # dig will print the SOA if nothing was found ns_forwards_DNSKEY() { local ns=${1} + shift
- dig @${ns} DNSKEY ${TEST_DOMAIN} | grep -qv SOA + dig @${ns} DNSKEY ${TEST_DOMAIN} $@ | grep -qv SOA }
ns_forwards_DS() { local ns=${1} + shift
- dig @${ns} DS ${TEST_DOMAIN} | grep -qv SOA + dig @${ns} DS ${TEST_DOMAIN} $@ | grep -qv SOA }
ns_forwards_RRSIG() { local ns=${1} + shift
- dig @${ns} +dnssec A ${TEST_DOMAIN} | grep -q RRSIG + dig @${ns} +dnssec A ${TEST_DOMAIN} $@ | grep -q RRSIG }
ns_supports_tcp() { local ns=${1} + shift
- dig @${ns} +tcp A ${TEST_DOMAIN} >/dev/null || return 1 + dig @${ns} +tcp A ${TEST_DOMAIN} $@ >/dev/null || return 1 +} + +ns_determine_edns_buffer_size() { + local ns=${1} + shift + + local b + for b in 4096 2048 1500 1480 1464 1400 1280 512; do + if dig @${ns} +dnssec +bufsize=${b} A ${TEST_DOMAIN} $@ >/dev/null; then + echo "${b}" + return 0 + fi + done + + return 1 }
case "$1" in @@ -394,6 +444,7 @@ case "$1" in ;; *) echo "Test failed for an unknown reason" + exit ${ret} ;; esac
@@ -403,6 +454,11 @@ case "$1" in echo "${ns} does not support TCP fallback" fi
+ edns_buffer_size=$(ns_determine_edns_buffer_size ${ns}) + if [ -n "${edns_buffer_size}" ]; then + echo "EDNS buffer size for ${ns}: ${edns_buffer_size}" + fi + exit ${ret} ;;
hooks/post-receive -- IPFire 2.x development tree