getdnsapi / stubby

Stubby is the name given to a mode of using getdns which enables it to act as a local DNS Privacy stub resolver (using DNS-over-TLS).
https://dnsprivacy.org/dns_privacy_daemon_-_stubby/
BSD 3-Clause "New" or "Revised" License
1.2k stars 99 forks source link

After changing resolv.conf to "nameserver 127.0.0.1" nothing work any more #336

Closed AmiRMHP closed 1 year ago

AmiRMHP commented 1 year ago

Hi I search in "/issues" but couldn't find a solution to my problem I'm using Stubby 0.3.0 on debian 11 bullseye after changing resolv.conf i can't access any website stubby -i out put is : { "all_context": { "add_warning_for_bad_dns": GETDNS_EXTENSION_FALSE, "appdata_dir": <bindata of "/var/cache/stubby/">, "append_name": GETDNS_APPEND_NAME_TO_SINGLE_LABEL_FIRST, "dns_transport_list": [ GETDNS_TRANSPORT_TLS ], "dnssec": GETDNS_EXTENSION_FALSE, "dnssec_allowed_skew": 0, "dnssec_return_all_statuses": GETDNS_EXTENSION_FALSE, "dnssec_return_full_validation_chain": GETDNS_EXTENSION_FALSE, "dnssec_return_only_secure": GETDNS_EXTENSION_FALSE, "dnssec_return_status": GETDNS_EXTENSION_FALSE, "dnssec_return_validation_chain": GETDNS_EXTENSION_FALSE, "dnssec_roadblock_avoidance": GETDNS_EXTENSION_FALSE, "dnssec_trust_anchors": [ { "class": GETDNS_RRCLASS_IN, "name": <bindata for .>, "rdata": { "algorithm": 8, "flags": 257, "protocol": 3, "public_key": <bindata of 0x03010001acffb409bcc939f831f7a1e5...>, "rdata_raw": <bindata of 0x0101030803010001acffb409bcc939f8...> }, "ttl": 86400, "type": GETDNS_RRTYPE_DNSKEY } ], "edns_client_subnet_private": 1, "edns_cookies": GETDNS_EXTENSION_FALSE, "edns_do_bit": 0, "edns_extended_rcode": 0, "edns_version": 0, "follow_redirects": GETDNS_REDIRECTS_FOLLOW, "hosts": <bindata of "/etc/hosts">, "idle_timeout": 10000, "limit_outstanding_queries": 0, "max_backoff_value": 1000, "namespaces": [ GETDNS_NAMESPACE_LOCALNAMES, GETDNS_NAMESPACE_DNS ], "resolution_type": GETDNS_RESOLUTION_STUB, "resolvconf": <bindata of "/etc/resolv.conf">, "return_both_v4_and_v6": GETDNS_EXTENSION_FALSE, "return_call_reporting": GETDNS_EXTENSION_FALSE, "round_robin_upstreams": 1, "specify_class": 1, "suffix": [], "timeout": 5000, "tls_authentication": GETDNS_AUTHENTICATION_REQUIRED, "tls_backoff_time": 3600, "tls_cipher_list": <bindata of "TLS13-AES-256-GCM-SHA384:TLS13-A"...>, "tls_ciphersuites": <bindata of "TLS_AES_256_GCM_SHA384:TLS_AES_1"...>, "tls_connection_retries": 2, "tls_min_version": GETDNS_TLS1_2, "tls_query_padding_blocksize": 256, "trust_anchors_backoff_time": 2500, "trust_anchors_url": <bindata of "http://data.iana.org/root-anchor"...>, "trust_anchors_verify_CA": <bindata of 0x2d2d2d2d2d424547494e204345525449...>, "trust_anchors_verify_email": <bindata of "dnssec@iana.org">, "upstream_recursive_servers": [ { "address_data": <bindata for 1.1.1.1>, "address_type": <bindata of "IPv4">, "tls_auth_name": <bindata of "cloudflare-dns.com"> }, { "address_data": <bindata for 1.0.0.1>, "address_type": <bindata of "IPv4">, "tls_auth_name": <bindata of "cloudflare-dns.com"> } ] }, "api_version_number": 132058112, "api_version_string": <bindata of "December 2015">, "compilation_comment": <bindata of "getdns 1.6.0 configured on 2020-"...>, "default_hosts_location": <bindata of "/etc/hosts">, "default_resolvconf_location": <bindata of "/etc/resolv.conf">, "default_trust_anchor_location": <bindata of "/usr/share/dns/root.key">, "implementation_string": <bindata of "https://getdnsapi.net">, "listen_addresses": [ <bindata of 0x7f000001>, <bindata of 0x00000000000000000000000000000001> ], "openssl_build_version_number": 269488271, "openssl_built_on": <bindata of "built on: Sun Feb 5 21:23:17 20"...>, "openssl_cflags": <bindata of "compiler: gcc -fPIC -pthread -m6"...>, "openssl_dir": <bindata of "OPENSSLDIR: "/usr/lib/ssl"">, "openssl_engines_dir": <bindata of "ENGINESDIR: "/usr/lib/x86_64-lin"...>, "openssl_platform": <bindata of "platform: debian-amd64">, "openssl_version_number": 269488367, "openssl_version_string": <bindata of "OpenSSL 1.1.1n 15 Mar 2022">, "resolution_type": GETDNS_RESOLUTION_STUB, "version_number": 17170432, "version_string": <bindata of "1.6.0"> } Result: Config file syntax is valid.

saradickinson commented 1 year ago

Sorry for slow response here 1) what do you see in the Stubby logs? 2) If it looks like stubby runs ok - what do you see if you try to dig to 127.0.0.1 when stubby is running?

AmiRMHP commented 1 year ago

o i forgot about this ... i resolved it "tls_pubkey_pinset" had wrong value in stubby.yml and i fixed it with "echo | openssl s_client -connect '' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64"