Bug 278721 - ldns uses nameserver commented out in resolv.conf (host, drill)
Summary: ldns uses nameserver commented out in resolv.conf (host, drill)
Status: In Progress
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 13.3-RELEASE
Hardware: Any Any
: --- Affects Many People
Assignee: Dag-Erling Smørgrav
URL: https://github.com/NLnetLabs/ldns/iss...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-05-03 16:07 UTC by Michael Gmelin
Modified: 2024-05-16 06:21 UTC (History)
5 users (show)

See Also:
des: mfc-stable14?
des: mfc-stable13?
des: needs_errata?

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Gmelin freebsd_committer freebsd_triage 2024-05-03 16:07:30 UTC 
Given this innocent /etc/resolv.conf:

  # Generated by resolvconf
  # nameserver 192.168.1.1
  
  # nameserver 8.8.8.8
  nameserver 127.0.0.1
  options edns0

(the third line needs to be empty)

ldns actually sends requests to google DNS.

Stripped down example:

  cat >/etc/resolv.conf <<EOF
  # g
  
  # nameserver 8.8.8.8
  EOF
  drill www.google.com
  host www.google.com

(there is no resolver running on localhost)

This problem can lead to information leakage and (which hit me) break our setup, where local_unbound is serving a private zone, but google was contacted instead.

Filed upstream, more details (and suggested solutions) can be found here:
https://github.com/NLnetLabs/ldns/issues/237

CCed des and emaste, as they did the last import of ldns in 13.3
Comment 1 Michael Gmelin freebsd_committer freebsd_triage 2024-05-04 10:21:28 UTC 
This also affects 14.0-RELEASE, 14.1-BETA1 and CURRENT
Comment 2 Michael Gmelin freebsd_committer freebsd_triage 2024-05-10 07:40:35 UTC 
There is an upstream fix available now (not merged yet):
https://github.com/NLnetLabs/ldns/pull/238
Comment 3 commit-hook freebsd_committer freebsd_triage 2024-05-15 11:57:32 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=3b092e4936c433889cc668ea9563c8fd437d1a3e

commit 3b092e4936c433889cc668ea9563c8fd437d1a3e
Merge: 154ad8e0f88f 4891157c57cc
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2024-05-15 10:16:24 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2024-05-15 10:20:15 +0000

    ldns: Ignore commented-out lines in resolv.conf.

    This merges upstream PR 238 + an additional bug fix.

    PR:             278721
    MFC after:      1 week

 contrib/ldns/ldns/parse.h |  2 ++
 contrib/ldns/parse.c      | 35 +++++++++++++++++++++++++++----
 contrib/ldns/resolver.c   | 53 ++++++++---------------------------------------
 3 files changed, 42 insertions(+), 48 deletions(-)
Comment 4 Michael Gmelin freebsd_committer freebsd_triage 2024-05-16 06:21:53 UTC 
Upstream merged the commit.