opnsense / core

OPNsense GUI, API and systems backend
https://opnsense.org/
BSD 2-Clause "Simplified" License
3.31k stars 738 forks source link

KEA DHCP4: Illegal chars in static reservation hostname crashes Unbound. Breaks DNS. #7712

Closed s98330q closed 2 months ago

s98330q commented 2 months ago

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug This was addressed & closed here already :

https://github.com/opnsense/core/issues/7137

Seems like regression

A clear and concise description of what the bug is, including last known working version (if any). With ISC DHCP, certain chars in the reservation hostname are not allowed. When we write reservation hostnames in KEA DHCP, we are not presented with a notice of illegal chars in the hostname when we press save. Thusly we can assume the name as written is a legal name, when reality is this hostname has illegal chars.

Tip: to validate your setup was working with the previous version, use opnsense-revert (https://docs.opnsense.org/manual/opnsense_tools.html#opnsense-revert)

To Reproduce

Whilst setting up static reservation using KEA DHCP, for the hostname I entered: Flippy 5000 Save config and restart KEA Restart Unbound

Log:

Date Severity Process Line  
2024-08-02T18:55:11-06:00 Error unbound Unable to open pipe. This is likely because Unbound isn't running.  
2024-08-02T18:55:01-06:00 Notice unbound Backgrounding unbound logging backend.  
2024-08-02T18:55:00-06:00 Critical unbound [32450:0] fatal error: Could not set up local zones  
2024-08-02T18:55:00-06:00 Error unbound [32450:0] error: Bad local-data RR 25.1.220.10.in-addr.arpa. Flippy PTR 5000._domain redacted  
2024-08-02T18:55:00-06:00 Error unbound [32450:0] error: error parsing local-data at 33 '25.1.220.10.in-addr.arpa. Flippy PTR 5000.d.domain redacted': Syntax error, could not parse the RR's type
2024-08-02T18:55:11-06:00 Error unbound Unable to open pipe. This is likely because Unbound isn't running.
2024-08-02T18:55:01-06:00 Notice unbound Backgrounding unbound logging backend.
2024-08-02T18:55:00-06:00 Critical unbound [32450:0] fatal error: Could not set up local zones
2024-08-02T18:55:00-06:00 Error unbound [32450:0] error: Bad local-data RR 25.1.220.10.in-addr.arpa. Flippy PTR 5000._domain redacted
2024-08-02T18:55:00-06:00 Error unbound [32450:0] error: error parsing local-data at 33 '25.1.220.10.in-addr.arpa. Flippy PTR 5000.domain redacted : Syntax error, could not parse the RR's type

Expected behavior KEA and Unbound accepts the hostname written and life continues as normal.

Describe alternatives you considered Since ISC DHCP is deprecated we have nothing else.

A clear and concise description of any alternative solutions or workaround you considered. Removed the space in the hostname : Flippy5000 And everyone is happy.

Software version used and hardware type if relevant, e.g.:

OPNsense 24.1.10_8-amd64

AdSchellevis commented 2 months ago

It's not a regression in the earlier change (as the name seems to comply with https://datatracker.ietf.org/doc/html/rfc2181), but accepting almost random data might trip the next service in this case.

When it's only whitespaces being problematic, we can filter them out, but other entries might be problematic as well.

https://github.com/opnsense/core/blob/809e3be395a5681480fc5dcb5c67a692613546c1/src/etc/inc/plugins.inc.d/unbound.inc#L596-L598

ronin3510 commented 2 months ago

I've seen this issue on a FW just this week, turned out to be a typo in a reservation showing up in /var/unbound/hosts_entries.conf

The reservation was ending with a dot, which caused a double dot to appear in the FQDN and KEA would fail to start because of it.

hostname. --> hostname..example.com

Simply editing or removing the problematic entry from the hosts_entries.conf file would not work as it is regenerated automatically on startup from KEA

AdSchellevis commented 2 months ago

Just dumping this here, we do exclude everything that looks invalid for dynamic leases from isc as well:

https://github.com/opnsense/core/blob/66c6d2555fd0badb373c4518896eedabac181477/src/opnsense/scripts/dhcp/unbound_watcher.py#L148

Practically supporting extended hostnames in kea is not compatible with unbound, which means we can only suppress them or not offer this feature at all. To limit the scope of the change we should apply a filter in the kea registration part as other registrations don't seem to offer this type of input.

https://github.com/opnsense/core/blob/66c6d2555fd0badb373c4518896eedabac181477/src/etc/inc/plugins.inc.d/kea.inc#L68