summaryrefslogtreecommitdiff
path: root/src/conf_mode/dns_forwarding.py
AgeCommit message (Collapse)Author
2023-08-07T5319: remove workarounds for defaults in dns_forwarding.pyJohn Estabrook
2023-07-14T5195: vyos.util -> vyos.utils package refactoring (#2093)Christian Breunig
* T5195: move run, cmd, call, rc_cmd helper to vyos.utils.process * T5195: use read_file and write_file implementation from vyos.utils.file Changed code automatically using: find . -type f -not -path '*/\.*' -exec sed -i 's/^from vyos.util import read_file$/from vyos.utils.file import read_file/g' {} + find . -type f -not -path '*/\.*' -exec sed -i 's/^from vyos.util import write_file$/from vyos.utils.file import write_file/g' {} + * T5195: move chmod* helpers to vyos.utils.permission * T5195: use colon_separated_to_dict from vyos.utils.dict * T5195: move is_systemd_service_* to vyos.utils.process * T5195: fix boot issues with missing imports * T5195: move dict_search_* helpers to vyos.utils.dict * T5195: move network helpers to vyos.utils.network * T5195: move commit_* helpers to vyos.utils.commit * T5195: move user I/O helpers to vyos.utils.io
2023-05-04dns-forwarding: T5193: implement NS resource typeChristian Breunig
2023-05-04dns-forwarding: T5193: use f'ormat strings when building messagesChristian Breunig
2023-03-28dns: T5115: Support custom port for name servers for forwarding zones.Indrajit Raychaudhuri
This would allow using custom ports in name server operating on non- default port for forwarding zones. This is a follow-up to T5113 for sake of completeness and having consistent treatment of all name servers configured in PowerDNS recursor. Additionally, migrate `service dns forwarding domain example.com server` to `service dns forwarding domain foo3.com name-server` for consistency and reusability.
2023-03-27dns: T5113: Support custom port for name-server forwardersIndrajit Raychaudhuri
Support custom port for name-server forwarders that would allow using custom ports in name server forwarders to enable forwarding to alternative name servers (unbound, stubby, dnscrypt-proxy etc.) operating on non-default port. This would also allow using DNS Over TLS in PowerDNS Recursor 4.6 onwards (pdns doesn't support certificate check for validity yet) by enabling 'dot-to-port-853'. This is set by default if compiled in with DoT support. See: https://doc.powerdns.com/recursor/settings.html#dot-to-port-853 This also partially implements T921, T2195 (DoT without certificate check). Implementation details: - In 'dns/forwarding' configuration, 'name-server' now allows optional 'port' (defaults to 53). - Instead of modifying 'name-server-ipv4-ipv6.xml.i' to add optional 'port', a new file 'name-server-ipv4-ipv6-port.xml.i' has been used to avoid impacting other places where it is reused because not all of them honor ports (mostly VPN related). - The `host:port` entries to be used by PowerDNS recursor config are normalized eagerly at the point of loading VyOS `Config` instead of doing them lazily while rendering the Jinja2 template to keep the implementation less intrusive. The alternative would entail making quite a bit of change in how 'vyos-hostsd' processes 'static' 'name_servers' entries or persists their runtime states.
2022-07-07dns: T4509: improve 6to4 error messageChristian Poessinger
2022-07-05dns: T4509: Add dns64-prefix optionViacheslav Hletenko
rfc6147: DNS Extensions for Network Address Translation from IPv6 Clients to IPv4 Servers set service dns forwarding dns64-prefix 2001:db8:aabb::/96
2022-07-04dns: T4378: Allow wildcard A AAAA record with option anyViacheslav Hletenko
Ability to set wildcard record for authoritative-domain set authoritative-domain example.com records a any address 192.0.2.11 cat /run/powerdns/zone.example.com.conf * 300 A 192.0.2.11
2022-04-16dns: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-04-06dns: forwarding: T3804: fix warning message about "system name-server"Christian Poessinger
2022-04-05dns: forwarding: T3804: bugfix DHCP name-servers used for recursionChristian Poessinger
Commit 2ecf7a9f9c ('name-server: T3804: merge "system name-servers-dhcp" into "system name-server"') missed out an old dictionary key "system_name_server_dhcp" and thus system nameservers configured via DHCP did not get used for the DNS forwar recursor.
2021-10-12Don't generate NTA when zone is disabledLucas Christian
2021-10-12Fix default valuesLucas Christian
2021-10-12Fix error when no domains are definedLucas Christian
2021-10-12T562: Config syntax for defining DNS forward authoritative zonesLucas Christian
2021-10-02dns: forwarding: T3882: remove deprecated code to work with PowerDNS 4.5Christian Poessinger
(cherry picked from commit 8e6c48563d1612916bd7fcc665d70bfa77ec5667)
2020-11-27vyos.template: T2720: always enable Jinja2 trim_blocks featureChristian Poessinger
2020-11-13vyos.template: provide general is_ip(v4|v6) helpersChristian Poessinger
We had two places were the is_ip, is_ipv4 and is_ipv6 helpers had been defined. All places now have been converged into vyos.template as they are used both in the Jinja2 templates and also in our scripts.
2020-10-28vyos.util: T2995: rename vyos_dict_search() -> dict_search()Christian Poessinger
Renamed using snippet below: ---------------------------- for file in $(find . -name "*.py") do sed -i "s/vyos_dict_search/dict_search/" $file done
2020-10-06pdns_recursor: T2964: Expose query-local-address to dns config.Lucas Christian
In certain split DNS configurations, there is a need for more fine-grained control over the local address DNS forwarding uses to issue queries. The current pdns_recursor configuration allows the recursor to send queries from any available address on the interface the OS selects for the query, with no option to limit queries to a particular address or set of addresses. This commit exposes the `query-local-address` option in `recursor.conf` to users via the `service` `dns` `forwarding` `source-address` config node. If the parameter is unspecified, the default value of 0.0.0.0 (any IPv4 address) and :: (any IPv6 address) are used to match current behavior. Users who want more control can specify one or more IPv4 and IPv6 addresses to issue queries from. Per pdns_recursor docs, the recursor will load balance queries between any available addresses in the pools. Since IPv4 and IPv6 are different pools, note that specifying only one type of address will disable issuing queries for the other address family.
2020-09-25dns: forwarding: T2921: migrate to get_config_dict()Christian Poessinger
2020-09-24dns: forwarding: T2921: template cleanupChristian Poessinger
2020-09-19dns: forwarding: T2900: restore proper Config() level in verify()Christian Poessinger
Despite the fact that running verify on Config() is "bad" and "not as intended" the level of the configuration must match the keys that are checked by exits(). Re-set proper Config() level before querying the system nodes.
2020-06-11dns forwarding: T2486: configure vyos-hostsdJernej Jakob
Removes and adds all required settings.
2020-06-11dns forwarding: T2486: generate recursor conf filesJernej Jakob
- generate recursor.conf, recursor.conf.lua - if recursor.vyos-hostsd.conf.lua and recursor.forward-zones.conf don't exist, create empty ones (they are/will be generated by vyos-hostsd)
2020-06-11dns forwarding: T2486: add warning for no dhcp, system or static nameserversJernej Jakob
Add warning that forwarding will operate as a recursor in case there are no nameservers configured.
2020-06-11dns forwarding: T2486: change internal handling of 'dhcp' nameserversJernej Jakob
Remove the old solution that retrieved dhcp tagged nameservers from hostsd and added it to nameservers, as it didn't work anyway (only once during configuration but it didn't update them later). This is now handled by vyos-hostsd, just retrieve the configured interfaces and send it the list of tags to use.
2020-06-11dns forwarding: T2486: change internal handling of 'system' config nodeJernej Jakob
Remove manual retrieval of 'system name-server' from config and adding it to the name servers list, as this is now handled by simply adding a 'system' tag in vyos-hostsd.
2020-06-11dns forwarding: T2486: remove unnecessary intermediate name_servers variableJernej Jakob
2020-06-11dns forwarding: T2486: change internal representation of 'domain' configJernej Jakob
Change internal representation to the new one expected by vyos-hostsd.
2020-06-11dns forwarding: T2486: move Config() call into mainJernej Jakob
As Config is required in both get_config and verify, init it once and pass it to both functions.
2020-06-11dns forwarding: T2486: remove unneeded --dhclient argumentJernej Jakob
The functionality was moved to vyos-hostsd.
2020-06-11dns forwarding: T2486: add paths to filesJernej Jakob
2020-06-11dns forwarding: T1595: remove references to old listen-on optionJernej Jakob
As part of T1595 listen-on was removed and migrated to listen-address, but some references to it stayed in the variable names and validator error message.
2020-05-29airbag: T2088: explicit enabling of the featureThomas Mangin
airbag must now be explicitly installed. the patch also allow to fully disables the installation of the logging code at setup (and not just installing and doing nothing)
2020-05-17powerdns: T2470: adjust config file permissions for recursor 4.3Christian Poessinger
PowerDNS recursor 4.3 now uns as user pdns and group pdns, thus the generated configuration file and directory need to have the appropriate permissions set.
2020-04-27template: T2388: move mkdir/chmod/chown within render()Thomas Mangin
2020-04-13dns-forwarding: T2185: move configuration files to volatile /run directoryChristian Poessinger
2020-04-13dns-forwarding: T2185: migrate from SysVinit to systemdChristian Poessinger
2020-04-12template: T2230: use render to generate templatesThomas Mangin
convert all call to jinja to use template.render
2020-04-09util: T2226: os.system was wrongly converted to runThomas Mangin
os.system does print the ouput of the command, run() does not. A new function called call() does the printing and return the error code.
2020-04-06util: T2226: covert most calls from os.system to utilThomas Mangin
As little change a possible but the function call The behaviour should be totally unchanged.
2020-04-05dns-forwarding: T2230: move inlined templates to dedicated filesChristian Poessinger
2019-08-26T1598: make dns_forwarding.py retrieve name servers from vyos-hostsd.Daniil Baturin
2019-08-20powerdns: T1595: remove 'listen-on' CLI optionChristian Poessinger
2019-08-20powerdns: T1524: support setting allow-from networkChristian Poessinger
Netmasks (both IPv4 and IPv6) that are allowed to use the server. The default allows access only from RFC 1918 private IP addresses. Due to the aggressive nature of the internet these days, it is highly recommended to not open up the recursor for the entire internet. Questions from IP addresses not listed here are ignored and do not get an answer. https://docs.powerdns.com/recursor/settings.html#allow-from Imagine an ISP network with non RFC1918 IP adresses - they can't make use of PowerDNS recursor. As of now VyOS hat allow-from set to 0.0.0.0/0 and ::/0 which created an open resolver. If there is no allow-from statement a config-migrator will add the appropriate nodes to the configuration, resulting in: service { dns { forwarding { allow-from 0.0.0.0/0 allow-from ::/0 cache-size 0 ignore-hosts-file listen-address 192.0.2.1 } } }
2019-07-14[dns-forwarding] T1333: handle domain forward and general recursion in one ↵Christian Poessinger
configuration line In the past we used the PowerDNS cofniguration option forward-zones and forward-zones-recurse, but only the latter one sets the recursion bit in the DNS query. Thus all recursions have been moved to this config statement.
2019-07-03Merge pull request #78 from qiuchengxuan/currentChristian Poessinger
[pdns-recursor] T1469 - specified dns forwarding not work
2019-07-03T1504: wait for commit lock before trying to update resolv.conf in the out ↵Daniil Baturin
of CLI mode.