search

jonathanio / update-systemd-resolved

Helper script for OpenVPN to directly update the DNS settings of a link through systemd-resolved via DBus.
Other
765 stars 94 forks source link

fix: run dnssec options before domain options #101

Closed ekristen closed 2 years ago

ekristen commented 2 years ago

systemd-resolved has a bug with DNSSEC. If domains are added prior to setting or changing the DNSSEC setting, the domains use the previous setting, it also seems that it requires a restart of systemd to reset their DNSSEC settings to what they should be.

By moving the DNSSEC stanza this ensures that the DNSSEC setting is applied before any domains are added to resolved which ensures they have the appropriate DNSSEC setting.

To reproduce this you can use a DNS server that doesn't support DNSSEC and then set DOMAIN and DOMAN-ROUTE for a domain you want to resolve, without this change queries will fail, if you restart resolved they will start working.

To validate this works, restart your system, put this change in place and connect to the VPN, queries will work immediately.

ekristen commented 2 years ago

@jonathanio does the above description make sense? Do I need to provide any additional information? Thanks.

jonathanio commented 2 years ago

I've had a look at the code, and that's fine. I needed to re-remember if the options were processed in order of the configuration, not in an order defined in the script, and this will work. I thought there should be a test for this change, but none of the other tests explicitly depend on the order of the calls, so I'll just merge.