Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update embedded dnsmasq to v2.90 (Pi-hole v5) #1881

Merged
merged 24 commits into from
Feb 13, 2024
Merged

Update embedded dnsmasq to v2.90 (Pi-hole v5) #1881

merged 24 commits into from
Feb 13, 2024

Conversation

DL6ER
Copy link
Member

@DL6ER DL6ER commented Feb 11, 2024

What does this implement/fix?

Backporting #1875

Related issue or feature (if applicable): N/A

Pull request in docs with documentation (if applicable): N/A

By submitting this pull request, I confirm the following:

  1. I have read and understood the contributors guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
  2. I have commented my proposed changes within the code.
  3. I am willing to help maintain this change if there are issues with it later.
  4. It is compatible with the EUPL 1.2 license
  5. I have squashed any insignificant commits. (git rebase)

Checklist:

  • The code change is tested and works locally.
  • I based my code and PRs against the repositories developmental branch.
  • I signed off all commits. Pi-hole enforces the DCO for all contributions
  • I signed all my commits. Pi-hole requires signatures to verify authorship
  • I have read the above and my PR is ready for review.

simonkelley and others added 6 commits February 8, 2024 18:11
@simonkelley @DL6ER
Log truncated DNS replies.
b650631 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@DL6ER
Necessary changed to handle the most recent dnsmasq changes in FTL
d38a0a6 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Behave better when attempting to contact unresponsive TCP servers.
6b48e6d 
By default TCP connect takes minutes to fail when trying to
connect a server which is not responding and for which the
network layer doesn't generate HOSTUNREACH errors.

This is doubled because having failed to connect in FASTOPEN
mode, the code then tries again with a call to connect().

We set TCP_SYNCNT to 2, which make the timeout about 10 seconds.
This in an unportable Linux feature, so it doesn't work on other
platforms.

No longer try connect() if sendmsg in fastopen mode fails with
ETIMEDOUT or EHOSTUNREACH since the story will just be the same.

Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
=/== typo in last commit.
6cc10f7 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@DL6ER
Update changed indentation of known DNSMASQ warning
0a90f07 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@DL6ER
Force-update embedded dnsmasq version. We are loosing the individual …
45c342a 
…dnsmasq history of the ~ last year, however, given the multitude of merge conflicts and the fact that this code will soon(ish) be replaced by development-v6 (where the history is 100% intact), this isn't much of an issue

Signed-off-by: DL6ER <dl6er@dl6er.de>
@DL6ER DL6ER marked this pull request as draft February 11, 2024 05:40
simonkelley and others added 18 commits February 13, 2024 07:18
@simonkelley @DL6ER
Tweak logging and special handling of T_ANY in rr-filter code.
cc98853 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Make --filter-rr=ANY filter the answer to ANY queries.
9091f18 
Thanks to Dominik Derigs for an earlier patch which inspired this.

Signed-off-by: DL6ER <dl6er@dl6er.de>
@DL6ER
Update embedded dnsmasq version to 2.90test4
91b924d 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Protection against pathalogical DNSSEC domains.
108ab67 
An attacker can create DNSSEC signed domains which need a lot of
work to verfify. We limit the number of crypto operations to
avoid DoS attacks by CPU exhaustion.

Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Update header with new EDE values.
bf17dd3 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Update NSEC3 iterations handling to conform with RFC 9276.
70b0431 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Measure cryptographic work done by DNSSEC.
dd11688 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Fix error introduced in 635bc51cac3d5d7dd49ce9e27149cf7e402b7e79
2e0d8ff 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Parameterise work limits for DNSSEC validation.
a133029 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Update EDE code -> text conversion.
8b9c5d3 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Rework validate-by-DS to avoid DoS vuln without arbitrary limits.
0ce9541 
By calculating the hash of a DNSKEY once for each digest algo,
we reduce the hashing work from (no. DS) x (no. DNSKEY) to
(no. DNSKEY) x (no. distinct digests)

The number of distinct digests can never be more than 255 and
it's limited by which hashes we implement, so currently only 4.

Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Overhaul data checking in NSEC code.
c32b467 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Better stats and logging from DNSSEC resource limiting.
a389bcc 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Better allocation code for DS digest cache.
c3bc0f9 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Add --dnssec-limits option.
fbc5713 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@simonkelley @DL6ER
Reverse suppression of ANY query answer logging.
65402b1 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@DL6ER
Update expected dnsmasq warnings
3e32d96 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@DL6ER
Update dnsmasq version to 2.90
3bb1fcf 
Signed-off-by: DL6ER <dl6er@dl6er.de>
@DL6ER DL6ER marked this pull request as ready for review February 13, 2024 16:21
@DL6ER DL6ER requested a review from a team February 13, 2024 16:21
@DL6ER DL6ER merged commit bda4bd5 into development Feb 13, 2024
21 checks passed
@DL6ER DL6ER deleted the update/dnsmasq_v5 branch February 13, 2024 17:10
truecharts-admin referenced this pull request in truecharts/public Feb 21, 2024
@truecharts-admin
chore(deps): update container image pihole/pihole to v2024.02.0@80770…
aa88971 
…53 by renovate (#18430)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [pihole/pihole](https://togithub.com/pi-hole/docker-pi-hole) | minor |
`2024.01.0` -> `2024.02.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pi-hole/docker-pi-hole (pihole/pihole)</summary>

###
[`v2024.02.0`](https://togithub.com/pi-hole/docker-pi-hole/releases/tag/2024.02.0)

[Compare
Source](https://togithub.com/pi-hole/docker-pi-hole/compare/2024.01.0...2024.02.0)

Nothing Docker-specific this time around.

Tagging to include FTL v5.25

See [our recent blog
post](https://pi-hole.net/blog/2024/02/13/fixing-two-new-dnssec-vulnerabilities/)
for details concerning this release.

#### What's Changed (FTL)

- Update embedded dnsmasq to v2.90 (Pi-hole v5) by
[@&#8203;DL6ER](https://togithub.com/DL6ER) in
[https://github.com/pi-hole/FTL/pull/1881](https://togithub.com/pi-hole/FTL/pull/1881)

**Full Changelog**: pi-hole/FTL@v5.24...v5.25

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 10pm on monday" in timezone
Europe/Amsterdam, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://togithub.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xOTguMyIsInVwZGF0ZWRJblZlciI6IjM3LjE5OC4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIn0=-->
This was referenced Apr 30, 2024
Closed
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@PromoFaux PromoFaux PromoFaux approved these changes

Assignees
No one assigned
Labels
dnsmasq update
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@DL6ER @PromoFaux @simonkelley