Bug 278721 - ldns uses nameserver commented out in resolv.conf (host, drill)
Summary: ldns uses nameserver commented out in resolv.conf (host, drill)
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 13.3-RELEASE
Hardware: Any Any
: --- Affects Many People
Assignee: Dag-Erling Smørgrav
URL: https://github.com/NLnetLabs/ldns/iss...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-05-03 16:07 UTC by Michael Gmelin
Modified: 2024-07-22 18:52 UTC (History)
6 users (show)

See Also:
des: mfc-stable14+
des: mfc-stable13+
des: needs_errata? (secteam)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Gmelin freebsd_committer freebsd_triage 2024-05-03 16:07:30 UTC 
Given this innocent /etc/resolv.conf:

  # Generated by resolvconf
  # nameserver 192.168.1.1
  
  # nameserver 8.8.8.8
  nameserver 127.0.0.1
  options edns0

(the third line needs to be empty)

ldns actually sends requests to google DNS.

Stripped down example:

  cat >/etc/resolv.conf <<EOF
  # g
  
  # nameserver 8.8.8.8
  EOF
  drill www.google.com
  host www.google.com

(there is no resolver running on localhost)

This problem can lead to information leakage and (which hit me) break our setup, where local_unbound is serving a private zone, but google was contacted instead.

Filed upstream, more details (and suggested solutions) can be found here:
https://github.com/NLnetLabs/ldns/issues/237

CCed des and emaste, as they did the last import of ldns in 13.3
Comment 1 Michael Gmelin freebsd_committer freebsd_triage 2024-05-04 10:21:28 UTC 
This also affects 14.0-RELEASE, 14.1-BETA1 and CURRENT
Comment 2 Michael Gmelin freebsd_committer freebsd_triage 2024-05-10 07:40:35 UTC 
There is an upstream fix available now (not merged yet):
https://github.com/NLnetLabs/ldns/pull/238
Comment 3 commit-hook freebsd_committer freebsd_triage 2024-05-15 11:57:32 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=3b092e4936c433889cc668ea9563c8fd437d1a3e

commit 3b092e4936c433889cc668ea9563c8fd437d1a3e
Merge: 154ad8e0f88f 4891157c57cc
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2024-05-15 10:16:24 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2024-05-15 10:20:15 +0000

    ldns: Ignore commented-out lines in resolv.conf.

    This merges upstream PR 238 + an additional bug fix.

    PR:             278721
    MFC after:      1 week

 contrib/ldns/ldns/parse.h |  2 ++
 contrib/ldns/parse.c      | 35 +++++++++++++++++++++++++++----
 contrib/ldns/resolver.c   | 53 ++++++++---------------------------------------
 3 files changed, 42 insertions(+), 48 deletions(-)
Comment 4 Michael Gmelin freebsd_committer freebsd_triage 2024-05-16 06:21:53 UTC 
Upstream merged the commit.
Comment 5 commit-hook freebsd_committer freebsd_triage 2024-05-20 09:08:43 UTC 
A commit in branch stable/14 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=7daf36028411c3a9c73e0c75732f9cbcbf66362e

commit 7daf36028411c3a9c73e0c75732f9cbcbf66362e
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2024-05-15 10:16:24 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2024-05-20 09:04:54 +0000

    ldns: Ignore commented-out lines in resolv.conf.

    This merges upstream PR 238 + an additional bug fix.

    PR:             278721
    MFC after:      1 week

    (cherry picked from commit 3b092e4936c433889cc668ea9563c8fd437d1a3e)

 contrib/ldns/ldns/parse.h |  2 ++
 contrib/ldns/parse.c      | 35 +++++++++++++++++++++++++++----
 contrib/ldns/resolver.c   | 53 ++++++++---------------------------------------
 3 files changed, 42 insertions(+), 48 deletions(-)
Comment 6 commit-hook freebsd_committer freebsd_triage 2024-05-20 09:35:47 UTC 
A commit in branch stable/13 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=e95e16191f63240971687634a23c2defed64d713

commit e95e16191f63240971687634a23c2defed64d713
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2024-05-15 10:16:24 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2024-05-20 09:04:59 +0000

    ldns: Ignore commented-out lines in resolv.conf.

    This merges upstream PR 238 + an additional bug fix.

    PR:             278721
    MFC after:      1 week

    (cherry picked from commit 3b092e4936c433889cc668ea9563c8fd437d1a3e)

 contrib/ldns/ldns/parse.h |  2 ++
 contrib/ldns/parse.c      | 35 +++++++++++++++++++++++++++----
 contrib/ldns/resolver.c   | 53 ++++++++---------------------------------------
 3 files changed, 42 insertions(+), 48 deletions(-)
Comment 7 commit-hook freebsd_committer freebsd_triage 2024-05-20 20:39:14 UTC 
A commit in branch releng/14.1 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=5df49242be716cd8736fd10086dc6b31af1eafbd

commit 5df49242be716cd8736fd10086dc6b31af1eafbd
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2024-05-15 10:16:24 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2024-05-20 20:37:46 +0000

    ldns: Ignore commented-out lines in resolv.conf.

    This merges upstream PR 238 + an additional bug fix.

    PR:             278721
    MFC after:      1 week

    (cherry picked from commit 3b092e4936c433889cc668ea9563c8fd437d1a3e)
    (cherry picked from commit 7daf36028411c3a9c73e0c75732f9cbcbf66362e)

    Approved by:    re (cperciva)

 contrib/ldns/ldns/parse.h |  2 ++
 contrib/ldns/parse.c      | 35 +++++++++++++++++++++++++++----
 contrib/ldns/resolver.c   | 53 ++++++++---------------------------------------
 3 files changed, 42 insertions(+), 48 deletions(-)
Comment 8 commit-hook freebsd_committer freebsd_triage 2024-06-19 20:37:22 UTC 
A commit in branch releng/14.0 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=bdf75e830a77a16ec0baf1c9367f64c6b96c5e02

commit bdf75e830a77a16ec0baf1c9367f64c6b96c5e02
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2024-05-15 10:16:24 +0000
Commit:     Gordon Tetlow <gordon@FreeBSD.org>
CommitDate: 2024-06-18 17:32:56 +0000

    ldns: Ignore commented-out lines in resolv.conf.

    This merges upstream PR 238 + an additional bug fix.

    PR:             278721
    Approved by:    so
    Security:       FreeBSD-EN-24:11.ldns

    (cherry picked from commit 3b092e4936c433889cc668ea9563c8fd437d1a3e)
    (cherry picked from commit 7daf36028411c3a9c73e0c75732f9cbcbf66362e)

 contrib/ldns/ldns/parse.h |  2 ++
 contrib/ldns/parse.c      | 35 +++++++++++++++++++++++++++----
 contrib/ldns/resolver.c   | 53 ++++++++---------------------------------------
 3 files changed, 42 insertions(+), 48 deletions(-)
Comment 9 commit-hook freebsd_committer freebsd_triage 2024-06-19 20:37:24 UTC 
A commit in branch releng/13.3 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=d45cf1d2f1249d5b30c9fa0d35476dc9b9ee0321

commit d45cf1d2f1249d5b30c9fa0d35476dc9b9ee0321
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2024-05-15 10:16:24 +0000
Commit:     Gordon Tetlow <gordon@FreeBSD.org>
CommitDate: 2024-06-18 17:25:37 +0000

    ldns: Ignore commented-out lines in resolv.conf.

    This merges upstream PR 238 + an additional bug fix.

    PR:             278721
    Approved by:    so
    Security:       FreeBSD-EN-24:11.ldns

    (cherry picked from commit 3b092e4936c433889cc668ea9563c8fd437d1a3e)
    (cherry picked from commit e95e16191f63240971687634a23c2defed64d713)

 contrib/ldns/ldns/parse.h |  2 ++
 contrib/ldns/parse.c      | 35 +++++++++++++++++++++++++++----
 contrib/ldns/resolver.c   | 53 ++++++++---------------------------------------
 3 files changed, 42 insertions(+), 48 deletions(-)
Comment 10 commit-hook freebsd_committer freebsd_triage 2024-07-22 18:48:16 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=7fe9f4303fad76f1d2a9f709a3feb89093bce80c

commit 7fe9f4303fad76f1d2a9f709a3feb89093bce80c
Author:     Jaap Akkerhuis <jaap@NLnetLabs.nl>
AuthorDate: 2024-07-22 18:39:53 +0000
Commit:     Vladimir Druzenko <vvd@FreeBSD.org>
CommitDate: 2024-07-22 18:39:53 +0000

    dns/{,py}ldns, dns/p5-DNS-Ldns: update 1.8.3 → 1.8.4

    The most prominent fix is for the bug where ldns would, under certain
    conditions, use a commented out resolver in /etc/resolv.conf:
    https://github.com/NLnetLabs/ldns/issues/237

    Changelog:
    https://github.com/NLnetLabs/ldns/blob/1.8.4/Changelog

    PR:     280404 278721
    MFH:    2024Q3

 dns/ldns/Makefile                |  8 ++---
 dns/ldns/distinfo                |  6 ++--
 dns/ldns/files/patch-swig (gone) | 64 ----------------------------------------
 dns/ldns/pkg-plist               |  2 +-
 dns/py-ldns/pkg-plist            |  6 ++--
 5 files changed, 10 insertions(+), 76 deletions(-)
Comment 11 commit-hook freebsd_committer freebsd_triage 2024-07-22 18:52:22 UTC 
A commit in branch 2024Q3 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=9be587b5da8d7dea89b60c4f2a6a529d11bcce2e

commit 9be587b5da8d7dea89b60c4f2a6a529d11bcce2e
Author:     Jaap Akkerhuis <jaap@NLnetLabs.nl>
AuthorDate: 2024-07-22 18:39:53 +0000
Commit:     Vladimir Druzenko <vvd@FreeBSD.org>
CommitDate: 2024-07-22 18:49:37 +0000

    dns/{,py}ldns, dns/p5-DNS-Ldns: update 1.8.3 → 1.8.4

    The most prominent fix is for the bug where ldns would, under certain
    conditions, use a commented out resolver in /etc/resolv.conf:
    https://github.com/NLnetLabs/ldns/issues/237

    Changelog:
    https://github.com/NLnetLabs/ldns/blob/1.8.4/Changelog

    PR:     280404 278721
    MFH:    2024Q3
    (cherry picked from commit 7fe9f4303fad76f1d2a9f709a3feb89093bce80c)

 dns/ldns/Makefile                |  8 ++---
 dns/ldns/distinfo                |  6 ++--
 dns/ldns/files/patch-swig (gone) | 64 ----------------------------------------
 dns/ldns/pkg-plist               |  2 +-
 dns/py-ldns/pkg-plist            |  6 ++--
 5 files changed, 10 insertions(+), 76 deletions(-)