Hi,
for some time now I have a problem running kresd on my raspberry pi.
I am running pihole and use kresd as resolver behind pihole. Everything
works fine until some day where kresd "decides" to crash. It is always
the same error message (please see below).
I then have to manually stop the garbage collector, remove all cache
files and restart kresd (which automatically starts the garbage collector).
My pi is pxe boot and the root partition is on an nfs mounted volume.
The volume has several terra byte of space left.
After a restart it will run flawless for tow or three weeks just to
crash with the same error again.
Any idea how this happens?
/Ulrich
root@pi-hole1:~# systemctl status kresd
● kresd.service - Knot Resolver daemon
Loaded: loaded (/lib/systemd/system/kresd.service; enabled; vendor
preset: enabled)
Active: failed (Result: exit-code) since Fri 2024-04-05 02:31:47
CEST; 6h ago
Docs: man:kresd.systemd(7)
man:kresd(8)
Process: 5106 ExecStart=/usr/sbin/kresd -c
/usr/lib/arm-linux-gnueabihf/knot-resolver/distro-preconfig.lua -c
/etc/knot-resolver/kresd.conf -n (code=exited, status=1/FAILURE)
Process: 5110 ExecStopPost=/usr/bin/env rm -f
/run/knot-resolver/control/ (code=exited, status=1/FAILURE)
Main PID: 5106 (code=exited, status=1/FAILURE)
CPU: 648ms
Apr 05 02:31:45 pi-hole1 kresd[5106]: [C]: at 0x0001b2d8
Apr 05 02:31:45 pi-hole1 kresd[5106]: [C]: in function 'pcall'
Apr 05 02:31:45 pi-hole1 kresd[5106]:
...b/arm-linux-gnueabihf/knot-resolver/distro-preconfig.lua:9: in main chunk
Apr 05 02:31:45 pi-hole1 kresd[5106]: ERROR: net.listen() failed to bind
Apr 05 02:31:46 pi-hole1 kresd[5106]: [system] error while loading
config: /usr/lib/arm-linux-gnueabihf/knot-resolver/sandbox.lua:402:
can't open cache path '/var/cache/knot-resolver'; working directory
'/var/lib/knot-resolver'; No space left on device (workdir
'/var/lib/knot-resolver')
Apr 05 02:31:47 pi-hole1 systemd[1]: kresd.service: Main process exited,
code=exited, status=1/FAILURE
Apr 05 02:31:47 pi-hole1 env[5110]: rm: cannot remove
'/run/knot-resolver/control/': Is a directory
Apr 05 02:31:47 pi-hole1 systemd[1]: kresd.service: Control process
exited, code=exited, status=1/FAILURE
Apr 05 02:31:47 pi-hole1 systemd[1]: kresd.service: Failed with result
'exit-code'.
Apr 05 02:31:47 pi-hole1 systemd[1]: Failed to start Knot Resolver daemon.
root@pi-hole1:~# ps aux Op | grep kres
knot-re+ 569 0.1 0.1 114480 4140 ? Ss Apr02 5:15
/usr/sbin/kres-cache-gc -c /var/cache/knot-resolver -d 1000
root 23835 0.0 0.0 10292 504 pts/0 S+ 09:00 0:00 grep kres
root@pi-hole1:~# systemctl status | grep kres
│ └─23861 grep kres
├─system-kresd.slice
│ └─kres-cache-gc.service
│ └─569 /usr/sbin/kres-cache-gc -c
/var/cache/knot-resolver -d 1000
root@pi-hole1:~# systemctl stop kres-cache-gc
Dear Knot Resolver users,
Knot Resolver versions 5.7.2 (stable) and 6.0.7 (early-access) have been
released! Both fix running on 32-bit systems with 64-bit time; 6.0.7
additionally brings fixes to RPZ, cache clearing via kresctl, and more.
---
Knot Resolver 5.7.2:
Bugfixes:
- fix on 32-bit systems with 64-bit time_t (!1510)
Full changelog:
https://gitlab.nic.cz/knot/knot-resolver/raw/v5.7.2/NEWS
Sources:
https://secure.nic.cz/files/knot-resolver/knot-resolver-5.7.2.tar.xz
GPG signature:
https://secure.nic.cz/files/knot-resolver/knot-resolver-5.7.2.tar.xz.asc
Documentation:
https://www.knot-resolver.cz/documentation/artifacts/1056229/index.html
---
Knot Resolver 6.0.7:
Improvements:
- manager: clear the cache via management HTTP API (#876, !1491)
- manager: added support for Python 3.12 and removed for 3.7 (!1502)
- manager: use build-time install prefix to execute `kresd` instead of
PATH (!1511)
- docs: documentation is now separated into user and developer parts (!1514)
- daemon: ignore UDP requests from ports < 1024 (!1507)
- manager: increase startup timeout for processes (!1518, !1520)
- local-data: increase default DB size to 2G on 64-bit platforms (!1518)
Bugfixes:
- fix listening by interface name containing dashes (#900, !1500)
- fix kresctl http request timeout (!1505)
- fix RPZ if it contains apex NS record (!1516)
- fix RPZ if SOA is repated, as usual in AXFR output (!1521)
- avoid RPZ overriding the root SOA (!1521)
- fix on 32-bit systems with 64-bit time_t (!1510)
- fix paths to knot-dns libs if exec_prefix != prefix (!1503)
- manager: add missing early check that neither a custom port nor TLS is
set for authoritative server forwarding (#902, !1505)
Full changelog:
https://gitlab.nic.cz/knot/knot-resolver/raw/v6.0.7/NEWS
Documentation:
https://www.knot-resolver.cz/documentation/artifacts/1056245/index.html
--
Oto Šťáva | Knot Resolver team leader | CZ.NIC z.s.p.o.
PGP: 6DC2 B0CB 5935 EA7A 3961 4AA7 32B2 2D20 C9B4 E680
Hi,
I am in the process to migrate from unbound to knot-resolver.
This is on FreeBSD 14-STABLE, knot-resolver 5.7.1, and on a very small instance serving a handful users, around 100 mails a day and such.
The resolver is up and running, but I still have some questions left I cannot answer myself after reading the documentation et al.
1) I managed to run 'kres-cache-gc -c /var/run/kresd' but I am unsure whether I do need the garbage collector at all?
I read that after filling up of '/var/run/kresd/data.mdb' that file would become reset to 0 bytes, correct?
FYI: After 3 days '/var/run/kresd/data.mdb' uses less than 1 MB currently.
2) Does knot-resolver automatically update 'root.hints' and 'root.keys', or do I have to install a script in crontab doing the updates instead?
FYI: I didn't unload the modules 'ta_signal_query' and 'ta_sentinel‘
3) I am still struggeling to understand, how to get access to the statistics produced by the module 'stats'?
FYI: If I do try to use knotc (I know, it's experimental), I'll get:
|dns> kresc /var/run/kresd/control/17158
|Warning! kresc is highly experimental, use at own risk.
|Please tell authors what features you expect from client utility.
|
FYI: There is no 'kresd>' prompt …
I tried to modify that socket's privileges but to no avail.
4) If that socket is the way to get hold on all statistics information, how can one name that socket file? Currently, it is just the PID of kresd.
Thanks in advance and regards,
Michael
Dear Knot Resolver users,
DNS Shotgun v20240219, our high-performance realistic benchmarking tool
for DNS resolvers, has been released.
This new release, amongst a variety of other improvements, brings
support for testing DNS-over-QUIC.
Incompatible changes:
- CMake is now being used to build dnssim instead of Autotools
- GnuTLS 3.7.5+ is now required
Improvements:
- pcap/extract-clients: always reset UDP port numbers to 53 (!56)
- pcap/extract-clients: ability to write to stdout (!62)
- pcap/filter-dnsq: skip 'special' queries for *.dotnxdomain.net (!58)
- pcap/split-clients: new tool to split larger PCAPs into smaller ones (!61)
- pcap/merge-chunks: allow disabling randomization (!67)
- tools/plot-latency: ability to diversify lines with linestyles (!69)
- tools/plot-response-rate: estimate worst-case drop caused by discarded
packets (!74)
- tools/plot-packet-rate: handle incomplete last sampling period (!71)
- tools/plot-response-rate: ability to ignore RCODEs with small response
rate (!73)
- pcap/filter-dnsq: ability to log malformed queries (!72)
- pcap/generate-const-qps: new tool to generate constant QPS (!33)
- tools: allow customizing plot charts with `SHOTGUN_MPLSTYLES` (!65)
- replay: `--preload` argument, mainly for dnssim debugging with
sanitizers (!76)
- tools/plot-latency: use fractional values for humans in charts (!78)
- pcap/extract-clients: warn if some input packets were skipped (!80)
- dnssim: replace Autotools with CMake (!77, !86)
- configs: DoH configs with exclusively GET/POST methods (!82)
- tools/plot-response-rate: avoid division by zero (!89)
- tools/plot-latency: denser labels to improve logarithmic scale
readability (!90)
- pcap/extract-clients: allow query rewriting - anonymization (!91)
- Support for DNS-over-QUIC (!75)
Bugfixes:
- tools/plot-response-rate: avoid white lines on white background (!55)
- tools/plot-client-distribution: properly handle file limit (!59)
- pcap: proper PCAP write error handling (!60)
- tools/plot-connections: set axis limits properly (!66)
- tools/plot-packet-rate: trim chart whitespace (!79)
- replay: do not exit silently when dnssim returns non-zero (!87)
Full changelog:
https://gitlab.nic.cz/knot/shotgun/-/releases/v20240219
Sources:
https://gitlab.nic.cz/knot/shotgun/-/archive/v20240219/shotgun-v20240219.ta…
Documentation:
https://dns-shotgun.readthedocs.io/en/v20240219/
Oto Šťáva
Knot Resolver
CZ.NIC z.s.p.o.
Hello,
I am trying to figure out why some domain names are not resolving on my
instance of Knot resolver over DoH with some clients. I was able to
reproduce this issue with [doh](https://github.com/curl/doh) client built
on libcurl. The problem never manifests with kdig (neither with DoH, nor
DoT nor Do53).
During this, I noticed something strange. For domain name github.com (which
sometimes returns no A record), I always receive an answer with TTL set to
60. It seems like this name does not get cached at all. See the test output
below.
Interestingly, if I delete cache files and restart the resolver, the TTL
starts decreasing as expected. Is this a sign that something was wrong with
the cache before? Or is this some sort of cache optimization for low TTL
records?
Here is the test output:
$ for i in `seq 1 5`; do ./doh github.comhttps://nscache.mtg.ripe.net/dns-query ; echo "----"; kdig +https +noadflag
+nocookie +noall +answer github.com A @nscache.mtg.ripe.net ; echo "====";
sleep 1; done
[github.com]
TTL: 60 seconds
AAAA: 0064:ff9b:0000:0000:0000:0000:8c52:7903
----
github.com. 60 IN A 140.82.121.3
====
[github.com]
TTL: 60 seconds
A: 140.82.121.3
AAAA: 0064:ff9b:0000:0000:0000:0000:8c52:7904
----
github.com. 60 IN A 140.82.121.4
====
[github.com]
TTL: 60 seconds
A: 140.82.121.4
AAAA: 0064:ff9b:0000:0000:0000:0000:8c52:7904
----
github.com. 60 IN A 140.82.121.4
====
[github.com]
TTL: 60 seconds
A: 140.82.121.4
AAAA: 0064:ff9b:0000:0000:0000:0000:8c52:7903
----
github.com. 60 IN A 140.82.121.4
====
[github.com]
TTL: 60 seconds
A: 140.82.121.3
AAAA: 0064:ff9b:0000:0000:0000:0000:8c52:7904
----
github.com. 60 IN A 140.82.121.3
====
--
Best regards,
Ondřej Caletka
Komentator -Liga Champions✔️✔️ Owen Hargreaves mengatakan bahwa “semua orang akan terpukul” oleh penampilan buruk Bayern Munich baru-baru ini, kali ini setelah kalah dari Lazio di leg pertama babak 16 besar Liga Champions.
Situs web: https://svipbola.com/liga/liga-champions
Pertandingan Liga Champions“Mereka perlu menemukan cara untuk mempercepat permainan dan menjadi sedikit lebih cepat. Mereka melewati fase ini di bawah asuhan Pep dan memainkan sepakbola terindah. Hari ini mereka bahkan tidak memainkan sepakbola indah.”
Jadwal Liga Champions - dengan meningkatnya perhatian media terhadap manajer dan pemain, mantan gelandang Manchester United dan pemenang Liga Champions Hargreaves tidak berharap tim tamu mendapat ulasan positif atas penampilan seperti itu.
Liga Champions 2023⭐“Ketika Anda bermain untuk tim papan atas, saya tahu orang-orang tidak ingin mendengarnya, namun ketika Anda bermain seperti itu, Anda akan dikritik. Saya pikir akan ada banyak rasa frustrasi di dalam dan di sekitar Bayern saat ini.”
Address: Jl Gondosuli 8 Yk Jawa Tengah Indonesia
#Liga Champions
#pertandingan liga champions
#jadwal liga champions
#klasemen liga champions
#liga champions uefa
#liga champions 2023
#hasil liga champions
#liga champions 2022
Dear Knot Resolver users,
Knot Resolver versions 5.7.1 (stable) and 6.0.6 (early-access) have been
released!
These releases include important security fixes, an update is strongly
advised!
Security:
- CVE-2023-50868: NSEC3 closest encloser proof can exhaust CPU
* validator: lower the NSEC3 iteration limit (150 -> 50)
* validator: similarly also limit excessive NSEC3 salt length
* cache: limit the amount of work on SHA1 in NSEC3 aggressive cache
* validator: limit the amount of work on SHA1 in NSEC3 proofs
* validator: refuse to validate answers with more than 8 NSEC3 records
- CVE-2023-50387 "KeyTrap": DNSSEC verification complexity
could be exploited to exhaust CPU resources and stall DNS resolvers.
Solution boils down mainly to limiting crypto-validations per packet.
We would like to thank Elias Heftrig, Haya Schulmann, Niklas Vogel
and Michael Waidner
from the German National Research Center for Applied Cybersecurity ATHENE
for bringing this vulnerability to our attention.
Improvements:
- update addresses of B.root-servers.net (!1478)
Bugfixes:
- fix potential SERVFAIL deadlocks if net.ipv6 = false (#880)
The update affects how some cached records are being treated, which may
trip up some sanity checking mechanisms in Knot Resolver if you have
advanced debugging options enabled (disabled by default),
"debugging.assertion_abort" for version 5 (Lua) and
"logging/debugging/assertation-abort" for version 6 (YAML). In case you
encounter any issues, please try clearing the cache first.
Full changelog:
https://gitlab.nic.cz/knot/knot-resolver/raw/v5.7.1/NEWS
Sources:
https://secure.nic.cz/files/knot-resolver/knot-resolver-5.7.1.tar.xz
GPG signature:
https://secure.nic.cz/files/knot-resolver/knot-resolver-5.7.1.tar.xz.asc
Documentation:
https://knot-resolver.readthedocs.io/en/v5.7.1/
--
Ales Mrazek
PGP: 3057 EE9A 448F 362D 7420 5A77 9AB1 20DA 0A76 F6DE
Dear Knot Resolver users,
last week a long-lasting bug in our mailing system has been discovered,
which, over the past two years, blocked quite a few e-mails from being
delivered to the list <knot-resolver-users(a)lists.nic.cz> and a few
others (namely the <knot-dns-users(a)lists.nic.cz>, whose subscriber Juha
Suhonen initially brought our attention to the issue - a thank you to
Juha is in order!).
This week the issue has been resolved and the blocked e-mails came
through. Some of these were our own, namely the Knot Resolver 5.5.0
release announcement, which is obviously outdated, as the current stable
version is Knot Resolver 5.7.0. We apologize for any confusion this
situation may have caused. Some others are still awaiting additional
approval, so after we manually identify, which are still relevant, and
which are spam, they will also come through during the following weeks.
Furthermore, later today we are planning to release new versions of the
stable Knot Resolver 5 and the early-access Knot Resolver 6. These
important updates will mitigate a few newfound DoS issues, the details
of which will soon be revealed globally. We are fully aware that this
unfortunate timing may cause further confusion, so we opted to inform
you, the subscribers, beforehand, that this next release e-mail is
indeed relevant.
We once again apologize for the confusion.
Best regards
Oto Šťáva
Knot Resolver team
CZ.NIC z.s.p.o.
On 2/12/24 01:34, Vladimír Čunát wrote:
> On 28/01/2024 02.52, Mike Wright wrote:
>> [system] error while loading config:
>> ...b/x86_64-linux-gnu/knot-resolver/kres_modules/policy.lua:378: bad
>> argument #1 to 'create' (table expected, got nil) (workdir
>> '/var/lib/knot-resolver')
>
> You don't define the `internalDomain` variable. That's correct in lua
> and evaluates as nil.
>
> (and as I already posted, please use the correct mailing-list next time)
OK, figured out my mistake.
internalDomains MUST APPEAR BEFORE any reference to it.
Thanks for your time,
Mike Wright
