From ccac9c30479e37464f02676b55a4521de13b2e67 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 22 Sep 2021 13:28:53 +0200 Subject: [PATCH] testing: Allow DNS via TCP in net2net-dnscert scenario New versions of Bind limit the maximum UDP message size to 1232 bytes, which is the same that newer versions of libunbound propose as maximum via EDNS in requests, so increasing the limit on the server wouldn't help. Instead we allow DNS via TCP so the client can switch after receiving the truncated UDP response. --- .../tests/ikev2/net2net-dnscert/hosts/moon/etc/iptables.rules | 4 ++++ .../tests/ikev2/net2net-dnscert/hosts/sun/etc/iptables.rules | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/testing/tests/ikev2/net2net-dnscert/hosts/moon/etc/iptables.rules b/testing/tests/ikev2/net2net-dnscert/hosts/moon/etc/iptables.rules index b2c425289..7d1bea971 100644 --- a/testing/tests/ikev2/net2net-dnscert/hosts/moon/etc/iptables.rules +++ b/testing/tests/ikev2/net2net-dnscert/hosts/moon/etc/iptables.rules @@ -25,4 +25,8 @@ -A INPUT -i eth0 -p udp --sport 53 -s PH_IP_WINNETOU -j ACCEPT -A OUTPUT -o eth0 -p udp --dport 53 -d PH_IP_WINNETOU -j ACCEPT +# allow DNSSEC fetch from winnetou via TCP +-A INPUT -i eth0 -p tcp --sport 53 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 53 -d PH_IP_WINNETOU -j ACCEPT + COMMIT diff --git a/testing/tests/ikev2/net2net-dnscert/hosts/sun/etc/iptables.rules b/testing/tests/ikev2/net2net-dnscert/hosts/sun/etc/iptables.rules index b2c425289..7d1bea971 100644 --- a/testing/tests/ikev2/net2net-dnscert/hosts/sun/etc/iptables.rules +++ b/testing/tests/ikev2/net2net-dnscert/hosts/sun/etc/iptables.rules @@ -25,4 +25,8 @@ -A INPUT -i eth0 -p udp --sport 53 -s PH_IP_WINNETOU -j ACCEPT -A OUTPUT -o eth0 -p udp --dport 53 -d PH_IP_WINNETOU -j ACCEPT +# allow DNSSEC fetch from winnetou via TCP +-A INPUT -i eth0 -p tcp --sport 53 -s PH_IP_WINNETOU -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 53 -d PH_IP_WINNETOU -j ACCEPT + COMMIT