We use xdp-loader to load dnsdist_xdp.bpf.o for dnsdist running
AF_XDP:
xdp-loader load green0 -P 90 -p /sys/fs/bpf/dnsdist -n xdp_dns_filter /usr/lib/bpf/dnsdist_xdp.bpf.o
so the xsk v4/v6 destination map would be:
/sys/fs/bpf/dnsdist/xskDestinationsV4
/sys/fs/bpf/dnsdist/xskDestinationsV6
but dnsdist-xsk.cc has:
static std::string getDestinationMap(bool isV6)
{
return !isV6 ? "/sys/fs/bpf/dnsdist/xsk-destinations-v4" : "/sys/fs/bpf/dnsdist/xsk-destinations-v6";
}
we can't use xsk-destinations-v4/v6 in dnsdist_xdp.bpf.o because bpf map
could not use '-' in map definition, '-' would result in compiling
error.
so we patch dnsdist-xsk.cc to use xskDestinationsV4/V6 that matches the
map name in dnsdist_xdp.bpf.o
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
- Update from version 1.9.4 to 1.9.6
- Tested building on riscv64 and it built without issues and rootfile is sam as for
x86_64 & aarch64. So supported architectures has been removed and dnsdist is available
on all three architectures.
- Update of rootfile not required
- Changelog
1.9.6
New Features
Add support for a callback when a new tickets key is added
References: pull request 14449
Improvements
Make the logging functions available to all Lua environments
References: pull request 14438
Handle Quiche >= 0.22.0
References: pull request 14450
Don’t include openssl/engine.h if it’s not going to be used (Sander Hoentjen)
References: pull request 14452
Bug Fixes
Dedup Prometheus help and type lines for custom metrics with labels¶
References: #14395, pull request 14439
Fix a race in the XSK/AF_XDP backend handling code
References: pull request 14436
dns.cc: use pdns::views::UnsignedCharView
References: pull request 14437
1.9.5
New Features
Add a Lua FFI function to set proxy protocol values
References: pull request 14338
Add Lua FFI bindings to generate SVC responses
References: pull request 14339
Bug Fixes
Use the correct source IP for outgoing QUIC datagrams
References: pull request 14166
Reply to HTTP/2 PING frames immediately
References: pull request 14163
Log the correct amount of bytes sent for DoH w/ nghttp2
References: pull request 14332
Prevent a race when calling registerWebHandler at runtime
References: pull request 14170
Enforce a maximum number of HTTP request fields and a maximum HTTP request line size
References: pull request 14333
Fix a race condition with custom Lua web handlers
References: pull request 14342
Syslog should be enabled by default
References: pull request 14331
Fix a warning when compiling the unit tests without XSK¶
References: pull request 14334
autoconf: allow prerelease systemd versions (Chris Hofstaedtler)
References: pull request 14335
Edit the systemd unit file, CAP_BPF is no longer enough
References: #14279, pull request 14336
Fix ‘Error creating TCP worker’ error message
References: pull request 14337
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This release fixes CVE-2024-25581, a denial of service security issue affecting versions 1.9.0, 1.9.1, 1.9.2 and 1.9.3 only. Earlier versions are not affected.
When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer (AXFR or IXFR) over DNS over HTTPS, causing the process to stop and thus leading to a Denial of Service.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
dnsdist build on my builder fine but it fails on the buildserver
via qemu-user.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
There are no functional changes in these files, but they are however
linked against OpenSSL 1.1.1 and need to be re-shipped before we remove
the legacy library.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Since we have extended services.cgi that it reads the Services field
from the Pakfire metadata, we will need to make sure that that metadata
is going to be on those systems.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Historically, the MD5 checksums in our LFS files serve as a protection
against broken downloads, or accidentally corrupted source files.
While the sources are nowadays downloaded via HTTPS, it make sense to
beef up integrity protection for them, since transparently intercepting
TLS is believed to be feasible for more powerful actors, and the state
of the public PKI ecosystem is clearly not helping.
Therefore, this patch switches from MD5 to BLAKE2, updating all LFS
files as well as make.sh to deal with this checksum algorithm. BLAKE2 is
notably faster (and more secure) than SHA2, so the performance penalty
introduced by this patch is negligible, if noticeable at all.
In preparation of this patch, the toolchain files currently used have
been supplied with BLAKE2 checksums as well on
https://source.ipfire.org/.
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremeripfire.org>
Bumping across one of our scripts with very long trailing whitespaces, I
thought it might be a good idea to clean these up. Doing so, some
missing or inconsistent licence headers were fixed.
There is no need in shipping all these files en bloc, as their
functionality won't change.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
* Add a Summary and Services field to all pak lfs files
* Replace occurances of INSTALL_INITSCRIPT with new INSTALL_INITSCRIPTS
macro in all pak lfs files.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
This patch makes this package available for aarch64. There are no
reasons why it shouldn't be.
Compiling has become more resource-hungry which is why the memory
consumption per process has been upped to 3GiB.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
start, restart and reload will now be prohibited if the configuration
file has an incorrect syntax. This avoids killing a running daemon and
is showing an indication to the user instead of having the daemon dying
silently in the background.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- lua library update had a sobump and therefore linked packages require
to have that updated
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Not sure why this has ever been there. This simply makes it
nicer to read and edit because we can have line-breaks now.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This patch updates dnsdist to the latest release.
Additionally it includes /etc/sysconfig/dnsdist in the backup
and enables DNS-over-TLS.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
dnsdist might need to open large number of connections
and therefore the default limit of 1024 needs to be
raised.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Most of these files still used old dates and/or domain names for contact
mail addresses. This is now replaced by an up-to-date copyright line.
Just some housekeeping... :-)
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
There seem to be some serious C++ issues in this so that
it won't build on ARM.
At the moment I do not have any resources to look further
into this, so I just disable building this package for
all ARM architectures.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
