knot-resolver-users Červenec 2019

knot-resolver-users@lists.nic.cz

5 participants
4 discussions

Re: [knot-resolver-users] Specify wildcard subdomain static hints

by Vladimír Čunát

Hello, first note the change to the correct mailing-list. On 7/29/19 10:20 AM, Balakrishnan B wrote: > I am trying to add wildcard static hints to catch all local domains like > below. But does not seem to work. > > hints['nextcloud.local'] = '127.0.0.1' # This works fine > hints['*.local'] = '127.0.0.1' > hints['.local'] = '127.0.0.1' > > DNSMasq supports this like https://stackoverflow.com/a/22551303 > > Is there way to do this in knot? No, I don't think there's a good way currently. The hints module only supports exact names with A and AAAA and corresponding PTR, like in /etc/hosts files. With our [RPZ] you can do wildcards, but there's no support for positive answers (so you need to do NXDOMAIN or similar denials). BTW, note that .local is reserved for [mDNS] protocol, in particular kresd might never get to such requests because it's "only" a DNS server: > 3. Name resolution APIs and libraries SHOULD recognize these names as > special and SHOULD NOT send queries for these names to their > configured (unicast) caching DNS server(s). > [RPZ] https://knot-resolver.readthedocs.io/en/stable/modules.html#c.policy.rpz [mDNS] https://tools.ietf.org/html/rfc6762#section-22.1 --Vladimir

4 roky, 9 měsíců

debian repo: http -> https

by Christoph

The instructions on: https://www.knot-resolver.cz/download/ read: " wget https://secure.nic.cz/files/knot-resolver/knot-resolver-release.deb dpkg -i knot-resolver-release.deb apt update && apt install -y knot-resolver " these instructions result in an http://.. URL in: /etc/apt/sources.list.d/knot-resolver-latest.list I'd suggest to change it to https://..

4 roky, 9 měsíců

Knot Resolver 4.1.0

by Petr Špaček

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Dear Knot Resolver users, Knot Resolver 4.1.0 has been released! This is a minor release with couple improvements and many bugfixes, including security fixes for CVE-2019-10190 and CVE-2019-10191. Packages for supported distributions are now available from https://www.knot-resolver.cz/download/ Highlights ========== - - security fixes, we encourage all users to upgrade as soon as possible - - new garbage collector improves cache utilization on busy machines - - ARM64 (aarch64) is now experimentally supported, please report issues - - compatibility with non-standard DoH clients was improved Full release notes: Knot Resolver 4.1.0 (2019-07-10) ================================ Security - -------- - - fix CVE-2019-10190: do not pass bogus negative answer to client (!827) - - fix CVE-2019-10191: do not cache negative answer with forged QNAME+QTYPE (!839) Improvements - ------------ - - new cache garbage collector is available and enabled by default (#257) This improves cache efficiency on big installations. - - DNS-over-HTTPS: unknown HTTP parameters are ignored to improve compatibility with non-standard clients (!832) - - DNS-over-HTTPS: answers include `access-control-allow-origin: *` which allows JavaScript to use DoH endpoint (!823). - - http module: support named AF_UNIX stream sockets (again) - - aggressive caching is disabled on minimal NSEC* ranges (!826) This improves cache effectivity with DNSSEC black lies and also accidentally works around bug in proofs-of-nonexistence from F5 BIG-IP load-balancers. - - aarch64 support, even kernels with ARM64_VA_BITS >= 48 (#216, !797) This is done by working around a LuaJIT incompatibility. Please report bugs. - - lua tables for C modules are more strict by default, e.g. `nsid.foo` will throw an error instead of returning `nil` (!797) - - systemd: basic watchdog is now available and enabled by default (#275) Bugfixes - -------- - - TCP to upstream: fix unlikely case of sending out wrong message length (!816) - - http module: fix problems around maintenance of ephemeral certs (!819) - - http module: also send intermediate TLS certificate to clients, if available and luaossl >= 20181207 (!819) - - send EDNS with SERVFAILs, e.g. on validation failures (#180, !827) - - prefill module: avoid crash on empty zone file (#474, !840) - - rebinding module: avoid excessive iteration on blocked attempts (!842) - - rebinding module: fix crash caused by race condition (!842) - - rebinding module: log each blocked query only in verbose mode (!842) - - cache: automatically clear stale reader locks (!844) Module API changes - ------------------ - - lua modules may omit casting parameters of layer functions (!797) - -- Petr Špaček @ CZ.NIC -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEvibrucvgWbORDKNbzo3WoaUKIeQFAl0mBC0ACgkQzo3WoaUK IeT3uw/9Fqz2PWYmEtF50nlnFIyM44EAClQFVboM8djVQVffN347nZTo4WPI+rsj exUg5tYKIEC6xrihRLwojbTfFcGVXcEHo0NZsvyv51qIP+lT6yHOVMz+tckmGyPI qG4JxvF7juUz1oLNCLUJfuZX/rOBgcOID2hga6q8ZXmkE5GFkyPsz7giaxjNWCGY Hf+uxzR2oezd4GGaOS2bIpqSjBmQwjaLvN3odG0xGZEHQCm+MkblVIbpiKuyR79e CulWcLNU1KL4V4o/rF5BUXHCnArGP/TM0JoVifPZepZVyB8xMEfBuyew9k1EAuX6 +5oJ9H1JcsftMtBgGUtksltTVK+9Mst9Rc52oiP5RA8ffpc5j0TtQi/lgNSgGnfQ P10t7fnlotseBYsHeQ0dm54TlGKBgsECuk1/wgjlytbUU9AUQMkmop696xZEcw1w gVY7FhAq09ciqtNTKuPJLoNTN/uhIdnyvt496Xf15OA3znZlMxdrI+rdVvf3btX/ SV9/bzNyWtJOhiYoN4hIPUqcvq6rFqxBbZpDA3pX9ks/lsWil7Y8sm96GzOjvaSx EjhDbBaFLBtX4kOPbrREDs8DbCTsxD1rLEruPos+Mp8PfAISEa/RvjyhuI/yyjwE qpNksYdKNHeniYEcycJ1khJBs1cz+9GlBFdCnSdFG2tFFu4nY4g= =pAEs -----END PGP SIGNATURE-----

4 roky, 9 měsíců

Pre-release announcement: 4.1.0 security release on Wednesday 2019-07-10

by Petr Špaček

Hello, this is pre-release announcement. We are going to release Knot Resolver 4.1.0 with two security fixes on Wednesday 2019-07-10. This release includes fixes for CVE-2019-10190 and CVE-2019-10191. We advise all users to upgrade to version 4.1.0 as soon as possible. Version 4.1.0 is fully is compatible with version 4.0.0 and no manual steps are required during upgrade. Pre-built software packages and source code will be made available from https://www.knot-resolver.cz/download/ during Wednesday 2019-07-10. Customers with formal support contracts with CZ.NIC can receive fixes immediatelly. Software packages provided by Linux distributions (i.e. not supplied by CZ.NIC) will follow usual release cycle of respective vendors. CZ.NIC cannot guarantee availability and timeline related to fixes in these packages. Nevertheless, following vendors received security patches in advance: ALT Linux, Amazon Linux AMI, Arch Linux, Chrome OS, CloudLinux, CoreOS, Debian, Gentoo, Openwall, Oracle, Red Hat, Slackware, SUSE, Ubuntu, Wind River. Please send your questions to mailing list knot-resolver-users(a)lists.nic.cz. -- Petr Špaček @ CZ.NIC

4 roky, 9 měsíců

2024

2023

2022

2021

2020

2019

2018

knot-resolver-users Červenec 2019