From fe49776280489a3bb9405f2d7651d1b16e4fe2e6 Mon Sep 17 00:00:00 2001 From: Laurent Bercot Date: Tue, 12 Jan 2021 10:03:51 +0000 Subject: First big batch of fixes, remove dnsfunnel-daemon, etc. --- doc/dnsfunnel-daemon.html | 115 ------------------------------------------- doc/dnsfunnel-translate.html | 6 +-- doc/dnsfunneld.html | 107 ++++++++++++++++++++++++++++------------ doc/index.html | 8 ++- 4 files changed, 81 insertions(+), 155 deletions(-) delete mode 100644 doc/dnsfunnel-daemon.html (limited to 'doc') diff --git a/doc/dnsfunnel-daemon.html b/doc/dnsfunnel-daemon.html deleted file mode 100644 index b779635..0000000 --- a/doc/dnsfunnel-daemon.html +++ /dev/null @@ -1,115 +0,0 @@ - - - - - - dnsfunnel: the dnsfunnel-daemon program - - - - - - -

- -

The `dnsfunnel-daemon` program

- -

-dnsfunnel-daemon binds to a local UDP socket, drops its -privileges, then executes into dnsfunneld. -It is the high-level entry point to invoke in scripts that want to launch -dnsfunneld. - -

- -

Interface

- -

-     dnsfunnel-daemon [ -v verbosity ] [ -d notif ] [ -U | -u uid -g gid ] [ -i ip:port ] [ -R root ] [ -b bufsize ] [ -f cachelist ] [ -T | -t ] [ -N | -n ]
-

- -

dnsfunnel-daemon creates a UDP inet domain socket and binds it -to IPv4 address ip (normally 127.0.0.1) and port port -(normally 53).
Depending on the options it has been given, it may chroot and lose -privileges on its gid and uid.
It execs into dnsfunneld with the -UDP socket as its standard input.

- -

- The point of dnsfunnel-daemon is to separate the administrative -operations of starting a daemon from the actual serving part, which is -handled by dnsfunneld. -

- -

Exit codes

- -

100: wrong usage
111: system call failed
126: failed to exec dnsfunneld
127: could not find the dnsfunneld executable

- -

Options

- -

-v verbosity : verbosity of the -dnsfunneld program. This option is passed as is -to dnsfunneld. Default is 1. 0 suppresses warning -messages. Higher values may give more informational messages.
-d notif : readiness notification. This option -is passed as is to dnsfunneld, which will print a -newline to descriptor notif when it is ready. Default is no readiness -notification.
-U : read an uid in the UID environment variable and a gid -in the GID environment variable, and drop privileges to that uid/gid.
-u uid : drop privileges to numerical uid -uid.
-g gid : drop privileges to numerical gid -gid.
-i ip:port : bind the socket to -IPv4 ip and port port. Default for ip is -127.0.0.1; default for port is 53.
-R root : chroot to root. Note that -this option only increases security if you also drop privileges.
-b bufsize : try and reserve a kernel buffer -size of bufsize bytes for the socket. Default is 131072. If the given -bufsize is 0, then dnsfunnel-daemon will use whatever the -default is for your kernel.
-f cachelist : Use cachelist as the -file that dnsfunneld reads its cache addresses -from. Default is /run/dnsfunnel-caches, or file -if the --with-cachelist=file option has been given to the -configure script at build time.

- -

- The other options control the activation or deactivation of various -dnsfunneld features: -

-T : Do not activate truncation of responses. This is -the default.

-t : If a DNS response is bigger than 510 bytes, -truncate its last resource records until it fits into 510 bytes and can -be sent in a UDP packet.

-N : Do not activate nxdomain workaround. This is the -default.

-n : Activate nxdomain workaround. When receiving an A -(resp. AAAA) query to forward, also make an AAAA (resp. A) query, and adjust -the response accordingly. Some DNS servers incorrectly answer NXDOMAIN when -they should just answer NODATA, and querying for another, existing, record -type for the same domain allows dnsfunneld to tell the difference between a -real NXDOMAIN (in which case that response is forwarded to the client) and -an incorrect one (in which case NODATA is answered to the client instead).

Other options may be added in the future.

- - - - diff --git a/doc/dnsfunnel-translate.html b/doc/dnsfunnel-translate.html index 9dde27d..112a615 100644 --- a/doc/dnsfunnel-translate.html +++ b/doc/dnsfunnel-translate.html @@ -56,14 +56,12 @@ get printed to outputfile

-i inputfile : process inputfile. Default is /etc/resolv.conf.

-o outputfile : write the result to -outputfile. Default is /run/dnsfunnel-caches, or file -if the --with-cachelist=file option has been given to the -configure script at build time.

+outputfile. Default is /run/dnsfunnel/root/caches.

-x ignoredip : ignore the ignoredip IPv4 address if it shows up as a nameserver in inputfile. Default is 127.0.0.1. The point of this option is to avoid copying to outputfile the IPv4 address that the -dnsfunnel-daemon daemon will be bound to.

+dnsfunneld daemon will be bound to. diff --git a/doc/dnsfunneld.html b/doc/dnsfunneld.html index 006a6d6..5181db1 100644 --- a/doc/dnsfunneld.html +++ b/doc/dnsfunneld.html @@ -3,9 +3,9 @@ - dnsfunnel: the dnsfunnel-daemon program - - + dnsfunnel: the dnsfunneld program + + @@ -29,19 +29,25 @@ queries, the responses, or both.

Interface

-     dnsfunneld [ -v verbosity ] [ -d notif ] [ -o ops ] cachelist
+     dnsfunneld [ -v verbosity ] [ -1 ] [ -U | -u uid -g gid ] [ -i ip:port ] [ -R root ] [ -b bufsize ] [ -T | -t ] [ -N | -n ]

dnsfunneld reads the cachelist file, expecting to find +
dnsfunneld creates a UDP inet domain socket and binds it +to IPv4 address ip (normally 127.0.0.1) and port port +(normally 53).
Depending on the options it has been given, it may chroot and lose +privileges on its gid and uid.
It reads the caches file (relative to its current +directory, which is either the directory it has been run from or, if +requested, the one it has chrooted into), expecting to find a list of IP (v4 or v6) addresses, one per line. These addresses are the DNS caches it will forward the queries to.
dnsfunneld expects to have a bound UDP inet domain socket as -its standard input. It expects to receive packets no more than 512 +
dnsfunneld expects to receive packets no more than 512 bytes long, only containing DNS normal queries (QUERY) for the IN -class.
Depending on ops, dnsfunneld may send additional queries -to the caches listed in cachelist. It handles the answers +class, on its socket.
Depending on options, dnsfunneld may send additional queries +to the caches listed in caches. It handles the answers internally: the additional queries are invisible to clients.
dnsfunneld is a long-lived process.

@@ -49,7 +55,7 @@ internally: the additional queries are invisible to clients.

Signals

SIGHUP: read the cachelist file again, updating its +
SIGHUP: read the caches file again, updating its in-memory cache list. In-flight queries are still handled by the old list; the new list will only apply for queries arriving after the SIGHUP.
SIGTERM: enter lame-duck mode, do not accept any more queries. When @@ -70,20 +76,51 @@ all in-flight queries have been answered, exit 0.
-v verbosity : verbosity. Default is 1. 0 suppresses warning messages. Higher values may give more informational messages in the future.
-d notif : readiness notification. When -dnsfunneld is ready to process queries, write a newline to file descriptor -notif. notif must be 3 or greater. Default is no notification -at all.
-o ops : perform various operations on -queries. ops is a decimal integer that is treated as a bitfield. -Default is 0. Operations are listed below.
-1 : readiness notification. When +dnsfunneld is ready to process queries, write a newline to stdout, then +close it. Default is no notification at all.
-U : read an uid in the UID environment variable and a gid +in the GID environment variable, and drop privileges to that uid/gid.
-u uid : drop privileges to numerical uid +uid.
-g gid : drop privileges to numerical gid +gid.
-i ip:port : bind the socket to +IPv4 ip and port port. Default for ip is +127.0.0.1; default for port is 53.
-R root : chroot to root. Default +is /run/dnsfunnel/root. Note that chrooting only increases security +if privileges are also dropped via the -U or -u and -g +options. Chrooting is only supported on platforms that have the chroot() +primitive. You can also disable it by passing an empty string as the argument +to -R.
-b bufsize : try and reserve a kernel buffer +size of bufsize bytes for the socket. The default is whatever the +default is for your kernel.

+ +

+ The other options control the activation or deactivation of various +features. See below for the detail of operations. +

+ +

-T : Do not activate truncation of responses. This is +the default.
-t : If a DNS response is bigger than 510 bytes, +truncate its last resource records until it fits into 510 bytes and can +be sent in a UDP packet.
-N : Do not activate NXDOMAIN workaround. This is the +default.
-n : Activate NXDOMAIN workaround.
Other options may be added in the future.

DNS forwarding behaviour

When it receives a query, dnsfunneld forwards it to the first DNS cache -in the list it has read from the cachelist file.

caches

If it receives a response with the TC bit, it resends the query over TCP.
If it receives a suitable response within a given time frame, it forwards it to the client.

dnsfunneld operations

- ops is an integer used as a bitfield. Depending on which bits are set, -various operations are performed on queries or answers, slightly modifying the -behaviour described above. + Depending on the options it has been given, dnsfunneld may perform the +following operations on the queries or responses it receives:

bit 0: activate truncation. If a DNS response is more than 510 bytes +
Truncation
+ +
+ If a DNS response is more than 510 bytes long, dnsfunneld will truncate the last resource records in the response, until it fits into 510 bytes and can be given to the client in a UDP packet. The structure of a DNS packet makes it so the RRs are listed in order of decreasing importance, so keeping as many RRs as will fit in 510 bytes -without reordering them is the natural way of truncating a response.
bit 1: activate workaround for some servers that incorrectly report -NXDOMAIN when they're asked for an AAAA record, and no such record exists -for the domain but an A record exists. When that bit is set in ops, -for every A or AAAA query dnsfunneld receives and forwards, it also sends +without reordering them is the natural way of truncating a response. +
+ +
NXDOMAIN workaround
+ +
+ Some DNS servers incorrectly answer NXDOMAIN when +they should just answer NODATA, and querying for another, existing, record +type for the same domain allows dnsfunneld to tell the difference between a +real NXDOMAIN. + When that operation is requested, for every A or AAAA query dnsfunneld +receives and forwards, it also sends an additional AAAA or A query for the same domain. If the main query returns NXDOMAIN, dnsfunneld waits for the response to the auxiliary query: if this response is not NXDOMAIN, then dnsfunneld answers NODATA to the client instead of NXDOMAIN. Be aware that activating this workaround can practically double the number of queries sent to the DNS caches, and may cause additional delays -before the clients get their answers.

Notes

Requirements

A POSIX-compliant system with a standard C development environment. -The system must also support chroot()
A POSIX-compliant system with a standard C development environment.
GNU make, version 3.81 or later
skalibs version 2.10.0.0 or later. It's a build-time requirement. It's also a run-time requirement if you link against the shared version of the skalibs library.
s6-dns version -2.3.3.0 or later. It's a build-time requirement. It's also a run-time +2.3.4.0 or later. It's a build-time requirement. It's also a run-time requirement if you link against the shared version of the s6dns library.

The current released version of dnsfunnel is -0.0.1.0. +0.0.1.0. (This is a lie. dnsfunnel is in alpha development at the moment, and only available through git.)

The dnsfunnel-daemon program

Interface

Exit codes

Options

Interface

Signals

DNS forwarding behaviour

dnsfunneld operations

Truncation

NXDOMAIN workaround

Notes

Requirements

Commands

The `dnsfunnel-daemon` program