denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Allow DNS via TCP in net2net-dnscert scenario

Browse Source 
New versions of Bind limit the maximum UDP message size to 1232 bytes,
which is the same that newer versions of libunbound propose as maximum via
EDNS in requests, so increasing the limit on the server wouldn't help.

Instead we allow DNS via TCP so the client can switch after receiving the
truncated UDP response.
This commit is contained in:
Tobias Brunner
2021-10-01 15:05:44 +02:00
parent 5b9c46b988
commit ccac9c3047
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/net2net-dnscert/hosts/moon/etc/iptables.rules
+4
View File
@@ -25,4 +25,8 @@
-A INPUT -i eth0 -p udp --sport 53 -s PH_IP_WINNETOU -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 53 -d PH_IP_WINNETOU -j ACCEPT
# allow DNSSEC fetch from winnetou via TCP
-A INPUT -i eth0 -p tcp --sport 53 -s PH_IP_WINNETOU -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 53 -d PH_IP_WINNETOU -j ACCEPT
COMMIT
testing/tests/ikev2/net2net-dnscert/hosts/sun/etc/iptables.rules
+4
View File
@@ -25,4 +25,8 @@
-A INPUT -i eth0 -p udp --sport 53 -s PH_IP_WINNETOU -j ACCEPT
-A OUTPUT -o eth0 -p udp --dport 53 -d PH_IP_WINNETOU -j ACCEPT
# allow DNSSEC fetch from winnetou via TCP
-A INPUT -i eth0 -p tcp --sport 53 -s PH_IP_WINNETOU -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 53 -d PH_IP_WINNETOU -j ACCEPT
COMMIT