From d02735041e2d620d333c050d7a6af321faed0919 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Fri, 13 Apr 2018 15:15:40 +0200
Subject: [PATCH] gluon-core: remove DNS cache feature
dnsmasq's caching is severly broken and does not handle all answer records
equally. In particular, its cached answers are missing DNSKEY and DS
records, breaking DNSSEC validation on clients.
Remove the cache for now. It may return if dnsmasq is fixed or we switch to
a different resolver.
---
docs/features/dns-cache.rst | 41 -------------------
docs/features/dns-forwarder.rst | 26 ++++++++++++
docs/index.rst | 2 +-
docs/releases/v2017.1.rst | 2 -
package/gluon-core/check_site.lua | 1 -
.../luasrc/lib/gluon/upgrade/820-dns-config | 6 +--
6 files changed, 28 insertions(+), 50 deletions(-)
delete mode 100644 docs/features/dns-cache.rst
create mode 100644 docs/features/dns-forwarder.rst
diff --git a/docs/features/dns-cache.rst b/docs/features/dns-cache.rst
deleted file mode 100644
index 92be66f69..000000000
--- a/docs/features/dns-cache.rst
+++ /dev/null
@@ -1,41 +0,0 @@
-DNS caching
-===========
-
-User experience may be greatly improved when dns is accelerated. Also, it
-seems like a good idea to keep the number of packages being exchanged
-between node and gateway as small as possible. In order to do this, a
-DNS cache may be used on a node. The dnsmasq instance listening on port
-53 on the node will be reconfigured to answer requests, use a list of
-upstream servers and a specific cache size if the options listed below are
-added to site.conf. Upstream servers are the DNS servers which are normally
-used by the nodes to resolve hostnames (e.g. gateways/supernodes).
-
-There are the following settings:
- servers
- cacheentries
-
-If both options are set the node will cache as much DNS records as set with
-'cacheentries' in RAM. The 'servers' list will be used to resolve the received
-DNS queries if the request cannot be answered from cache.
-If these settings do not exist, the cache is not intialized and RAM usage will not increase.
-
-When next_node.name is set, an A record and an AAAA record for the
-next-node IP address are placed in the dnsmasq configuration. This means that the content
-of next_node.name may be resolved even without upstream connectivity.
-
-::
-
- dns = {
- cacheentries = 5000,
- servers = { '2001:db8::1', },
- },
-
- next_node = {
- name = 'nextnode',
- ip6 = '2001:db8:8::1',
- ip4 = '198.51.100.1',
- }
-
-
-The cache will be initialized during startup.
-Each cache entry will occupy about 90 bytes of RAM.
diff --git a/docs/features/dns-forwarder.rst b/docs/features/dns-forwarder.rst
new file mode 100644
index 000000000..d74f9618f
--- /dev/null
+++ b/docs/features/dns-forwarder.rst
@@ -0,0 +1,26 @@
+DNS forwarder
+=============
+
+A Gluon node can be configured to act as a DNS forwarder. Requests for the
+next-node hostname(s) can be answered locally, without querying the upstream
+resolver.
+
+**Note:** While this reduces answer time and allows to use the next-node
+hostname without upstream connectivity, this feature should not be used for
+next-node hostnames that are FQDN when the zone uses DNSSEC.
+
+One or more upstream resolvers can be configured in the *dns.servers* setting.
+When *next_node.name* is set, A and/or AAAA records for the next-node IP
+addresses are placed in the dnsmasq configuration.
+
+::
+
+ dns = {
+ servers = { '2001:db8::1', },
+ },
+
+ next_node = {
+ name = { 'nextnode.location.community.example.org', 'nextnode', 'nn' },
+ ip6 = '2001:db8:8::1',
+ ip4 = '198.51.100.1',
+ }
diff --git a/docs/index.rst b/docs/index.rst
index 957530d79..6d0de3fa7 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -23,7 +23,7 @@ Several Freifunk communities in Germany use Gluon as the foundation of their Fre
features/wlan-configuration
features/private-wlan
features/wired-mesh
- features/dns-cache
+ features/dns-forwarder
features/monitoring
features/authorized-keys
features/roles
diff --git a/docs/releases/v2017.1.rst b/docs/releases/v2017.1.rst
index 5c5b48bb4..cc445933a 100644
--- a/docs/releases/v2017.1.rst
+++ b/docs/releases/v2017.1.rst
@@ -88,8 +88,6 @@ New features
* Add support for making nodes a DNS cache for clients
(`#1000 <https://github.com/freifunk-gluon/gluon/issues/1000>`_)
- See also: :doc:`../features/dns-cache`
-
* Add L2TP via tunneldigger as an alternative VPN system
(`#978 <https://github.com/freifunk-gluon/gluon/issues/978>`_)
diff --git a/package/gluon-core/check_site.lua b/package/gluon-core/check_site.lua
index d26b16716..90a6752d4 100644
--- a/package/gluon-core/check_site.lua
+++ b/package/gluon-core/check_site.lua
@@ -40,7 +40,6 @@ end
need_boolean('poe_passthrough', false)
if need_table('dns', nil, false) then
- need_number('dns.cacheentries', false)
need_string_array_match('dns.servers', '^[%x:]+$', false)
end
diff --git a/package/gluon-core/luasrc/lib/gluon/upgrade/820-dns-config b/package/gluon-core/luasrc/lib/gluon/upgrade/820-dns-config
index 5b64b413b..37b4b1c69 100755
--- a/package/gluon-core/luasrc/lib/gluon/upgrade/820-dns-config
+++ b/package/gluon-core/luasrc/lib/gluon/upgrade/820-dns-config
@@ -13,11 +13,7 @@ else
uci:delete('dhcp', dnsmasq, 'server')
end
-if site.dns and site.dns.cacheentries then
- uci:set('dhcp', dnsmasq, 'cachesize', site.dns.cacheentries)
-else
- uci:delete('dhcp', dnsmasq, 'cachesize')
-end
+uci:delete('dhcp', dnsmasq, 'cachesize')
if site.next_node and site.next_node.name and site.next_node.ip4 then
uci:section('dhcp','domain','nextnode4',{
--
GitLab