-/* $OpenBSD: parse.y,v 1.26 2021/07/25 08:34:43 florian Exp $ */
+/* $OpenBSD: parse.y,v 1.27 2021/08/31 20:18:03 kn Exp $ */
/*
* Copyright (c) 2018 Florian Obser <florian@openbsd.org>
%}
%token INCLUDE ERROR
-%token FORWARDER DOT PORT ODOT_FORWARDER ODOT_DHCP
-%token AUTHENTICATION NAME PREFERENCE RECURSOR DHCP STUB
+%token FORWARDER DOT PORT ODOT_FORWARDER ODOT_AUTOCONF ODOT_DHCP
+%token AUTHENTICATION NAME PREFERENCE RECURSOR AUTOCONF DHCP STUB
%token BLOCK LIST LOG FORCE ACCEPT BOGUS
%token <v.string> STRING
| FORWARDER { $$ = UW_RES_FORWARDER; }
| ODOT_FORWARDER { $$ = UW_RES_ODOT_FORWARDER; }
| RECURSOR { $$ = UW_RES_RECURSOR; }
- | DHCP { $$ = UW_RES_DHCP; }
- | ODOT_DHCP { $$ = UW_RES_ODOT_DHCP; }
+ | AUTOCONF { $$ = UW_RES_AUTOCONF; }
+ | DHCP { $$ = UW_RES_AUTOCONF; }
+ | ODOT_AUTOCONF { $$ = UW_RES_ODOT_AUTOCONF; }
+ | ODOT_DHCP { $$ = UW_RES_ODOT_AUTOCONF; }
| STUB { $$ = UW_RES_ASR; }
;
{"DoT", DOT},
{"accept", ACCEPT},
{"authentication", AUTHENTICATION},
+ {"autoconf", AUTOCONF},
{"block", BLOCK},
{"bogus", BOGUS},
{"dhcp", DHCP},
{"list", LIST},
{"log", LOG},
{"name", NAME},
+ {"oDoT-autoconf", ODOT_AUTOCONF},
{"oDoT-dhcp", ODOT_DHCP},
{"oDoT-forwarder", ODOT_FORWARDER},
{"port", PORT},
-/* $OpenBSD: resolver.c,v 1.148 2021/08/30 11:09:58 kn Exp $ */
+/* $OpenBSD: resolver.c,v 1.149 2021/08/31 20:18:03 kn Exp $ */
/*
* Copyright (c) 2018 Florian Obser <florian@openbsd.org>
}
break;
case UW_RES_RECURSOR:
- case UW_RES_DHCP:
- case UW_RES_ODOT_DHCP:
+ case UW_RES_AUTOCONF:
+ case UW_RES_ODOT_AUTOCONF:
case UW_RES_FORWARDER:
case UW_RES_ODOT_FORWARDER:
case UW_RES_DOT:
switch (type) {
case UW_RES_ASR:
- case UW_RES_DHCP:
- case UW_RES_ODOT_DHCP:
+ case UW_RES_AUTOCONF:
+ case UW_RES_ODOT_AUTOCONF:
if (TAILQ_EMPTY(&autoconf_forwarder_list))
return;
break;
switch (type) {
case UW_RES_RECURSOR:
- case UW_RES_DHCP:
- case UW_RES_ODOT_DHCP:
+ case UW_RES_AUTOCONF:
+ case UW_RES_ODOT_AUTOCONF:
case UW_RES_FORWARDER:
case UW_RES_ODOT_FORWARDER:
case UW_RES_DOT:
free(resolv_conf);
break;
case UW_RES_RECURSOR:
- case UW_RES_DHCP:
- case UW_RES_ODOT_DHCP:
+ case UW_RES_AUTOCONF:
+ case UW_RES_ODOT_AUTOCONF:
case UW_RES_FORWARDER:
case UW_RES_ODOT_FORWARDER:
case UW_RES_DOT:
break;
case UW_RES_RECURSOR:
break;
- case UW_RES_DHCP:
+ case UW_RES_AUTOCONF:
set_forwarders(res, &autoconf_forwarder_list, 0);
break;
- case UW_RES_ODOT_DHCP:
+ case UW_RES_ODOT_AUTOCONF:
set_forwarders(res, &autoconf_forwarder_list, 853);
ub_ctx_set_option(res->ctx, "tls-cert-bundle:",
TLS_DEFAULT_CA_CERT_FILE);
/* for the forwarder cases allow AS112 zones */
switch(res->type) {
- case UW_RES_DHCP:
- case UW_RES_ODOT_DHCP:
+ case UW_RES_AUTOCONF:
+ case UW_RES_ODOT_AUTOCONF:
case UW_RES_FORWARDER:
case UW_RES_ODOT_FORWARDER:
case UW_RES_DOT:
}
if (sec == SECURE) {
- if (dns64_present && (res->type == UW_RES_DHCP ||
- res->type == UW_RES_ODOT_DHCP)) {
+ if (dns64_present && (res->type == UW_RES_AUTOCONF ||
+ res->type == UW_RES_ODOT_AUTOCONF)) {
/* do not upgrade to validating, DNS64 breaks DNSSEC */
if (prev_state != RESOLVING)
new_resolver(checked_resolver->type,
replace_forwarders(&new_forwarder_list,
&autoconf_forwarder_list);
new_resolver(UW_RES_ASR, UNKNOWN);
- new_resolver(UW_RES_DHCP, UNKNOWN);
- new_resolver(UW_RES_ODOT_DHCP, UNKNOWN);
+ new_resolver(UW_RES_AUTOCONF, UNKNOWN);
+ new_resolver(UW_RES_ODOT_AUTOCONF, UNKNOWN);
} else {
while ((tmp = TAILQ_FIRST(&new_forwarder_list)) != NULL) {
TAILQ_REMOVE(&new_forwarder_list, tmp, entry);
}
if (ar->ar_rcode == LDNS_RCODE_NXDOMAIN) {
- /* XXX this means that the dhcp resolver is broken */
+ /* XXX this means that the autoconf resolver is broken */
log_debug("%s: NXDOMAIN", __func__);
goto out;
}
dns64_present = count > 0;
if (dns64_present) {
- /* downgrade DHCP resolvers, DNS64 breaks DNSSEC */
- if (resolvers[UW_RES_DHCP] != NULL &&
- resolvers[UW_RES_DHCP]->state == VALIDATING)
- new_resolver(UW_RES_DHCP, RESOLVING);
- if (resolvers[UW_RES_ODOT_DHCP] != NULL &&
- resolvers[UW_RES_ODOT_DHCP]->state == VALIDATING)
- new_resolver(UW_RES_ODOT_DHCP, RESOLVING);
+ /* downgrade SLAAC resolvers, DNS64 breaks DNSSEC */
+ if (resolvers[UW_RES_AUTOCONF] != NULL &&
+ resolvers[UW_RES_AUTOCONF]->state == VALIDATING)
+ new_resolver(UW_RES_AUTOCONF, RESOLVING);
+ if (resolvers[UW_RES_ODOT_AUTOCONF] != NULL &&
+ resolvers[UW_RES_ODOT_AUTOCONF]->state == VALIDATING)
+ new_resolver(UW_RES_ODOT_AUTOCONF, RESOLVING);
}
resolver_imsg_compose_frontend(IMSG_NEW_DNS64_PREFIXES_START, 0,
-.\" $OpenBSD: unwind.conf.5,v 1.28 2021/07/24 14:15:34 kn Exp $
+.\" $OpenBSD: unwind.conf.5,v 1.29 2021/08/31 20:18:03 kn Exp $
.\"
.\" Copyright (c) 2018 Florian Obser <florian@openbsd.org>
.\" Copyright (c) 2005 Esben Norby <norby@openbsd.org>
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
-.Dd $Mdocdate: July 24 2021 $
+.Dd $Mdocdate: August 31 2021 $
.Dt UNWIND.CONF 5
.Os
.Sh NAME
Will never validate.
Useful when running behind broken middle boxes that do not like edns0.
DNS answers from stub name servers are not cached.
-.It Ic dhcp
+.It Ic autoconf
Name servers learned via DHCP or SLAAC.
-.It Ic oDoT-dhcp
+.It Ic oDoT-autoconf
Name servers learned via DHCP or SLAAC.
.Nm unwind
tries to opportunistically use DNS over TLS.
.El
.Pp
The default preference is
-.Ic DoT oDoT-forwarder forwarder recursor oDoT-dhcp dhcp stub .
+.Ic DoT oDoT-forwarder forwarder recursor oDoT-autoconf autoconf stub .
.It Ic force Oo Cm accept bogus Oc Ar type Brq Ar name ...
Force resolving of
.Ar name
.Xr unwind 8
to use a specific resolver type:
.Bd -literal -offset indent
-force dhcp { domain.local }
+force autoconf { domain.local }
.Ed
.Sh SEE ALSO
.Xr rc.conf.local 8 ,