Unbound Unbound 1.12

[zaxcom]

Has unbound for Merlin been updated to 1.12 yet?

 

[dave14305]

Entware is still only publishing 1.11. OpenWRT has pushed 1.12, so Entware should pick it up in the next quarterly update.

 

[SomeWhereOverTheRainBow]

Entware is still only publishing 1.11. OpenWRT has pushed 1.12, so Entware should pick it up in the next quarterly update.

I have been playing with it on my RPI.... It is nice.....

 

[heysoundude]

Entware is still only publishing 1.11. OpenWRT has pushed 1.12, so Entware should pick it up in the next quarterly update.

or someone could ask the devs to prioritize an update on their Telegram...

I have been playing with it on my RPI.... It is nice.....

How so? what does the update bring?

 

[dave14305]

or someone could ask the devs to prioritize an update on their Telegram...


How so? what does the update bring?

I don't think it really warrants an out-of-band release on Entware, personally. 1.12 brings DoH on the client side, so you could theoretically (or academically) have your LAN clients do DoH to Unbound. Only useful if you snoop on yourself on the LAN. Outbound queries to the net is still old-fashioned udp as a recursor, DoT as a forwarder.

 

[juched]

Ya, nothing really stuck out to me. I am glad to see they are updating the flags from DNS flag day though.

 

[SomeWhereOverTheRainBow]

or someone could ask the devs to prioritize an update on their Telegram...


How so? what does the update bring?

here is the change log

This release contains the DNS Flag Day 2020 changes.  This sets the default EDNS buffer size to 1232, that should reduce fragmentation.
https://dnsflagday.net/2020/

There is inclusive language in the configuration.  There is caps-exempt, ipsecmod-allow and primary server options for auth-zones.  The older terms are accepted to keep configuration working.

DNS-over-HTTPS is supported in this release.  The DoH is enabled when Unbound is compiled with the nghttp2 library, with configure --with-libnghttp2.  Then have an interface on the https port, that can be configured with the https-port option.  Also have a cert and key available with the tls-service-key and tls-service-pem options.  Further settings can be configured for the http-endpoint, http-max-streams, http-query-buffer-size, http-response-buffer-size and http-nodelay options.  The max streams sets the maximum concurrent streams, the buffer size options the number of bytes in buffers, and the nodelay option can turn on TCP_NODELAY for DNS-over-HTTPS service.  In the statistics the memory used is reported in mem.http.query_buffer and mem.http.response_buffer.  The number of queries is reported in num.query.https, they are also included in the tcp and tls counts because https uses TLS and TCP.

The DLV options and code to handle DLV lookups have been removed from the code base.  The DLV repository is empty nowadays, it has been decommissioned.

There is a new feature where it is possible to use interface names to bind to the IP addresses on that interface.  It pulls in the addresses at the start of the server, if the addresses change, use the existing freebind and other socket options to register for addresses before they appear, or the interface-automatic option that copies them from queries to answers with ancillary data.

There is a new option for the edns-tag draft specification.  It can be enabled if you need the tentative implementation to add those tags to outgoing messages.

Features
- DNS Flag Day 2020: change edns-buffer-size default to 1232.
- Merge PR #255: DNS-over-HTTPS support.
- Use inclusive language in configuration
- Merge PR #284 and Fix #246: Remove DLV entirely from Unbound.
  The DLV has been decommisioned and in unbound 1.5.4, in 2015, there
  was advise to stop using it.  The current code base does not contain
  DLV code any more.  The use of dlv options displays a warning.
- Similar to NSD PR#113, implement that interface names can be used,
  eg. something like interface: eth0 is resolved at server start and
  uses the IP addresses for that named interface.
- Merge PR #272: Add EDNS client tag functionality.
- Add edns-client-tag-opcode option

Bug Fixes
- Merge PR #270 from cgzones: munin plugin: always exit 0 in autoconf
- Merge PR #269, Fix python module len() implementations, by Torbjörn
  Lönnemark
- Merge PR #268, draft-ietf-dnsop-serve-stale-10 has become RFC 8767 on
  March 2020, by and0x000.
- Fix doxygen comment for no ssl for tls session ticket key callback
  routine.
- Fix mini_event.h on OpenBSD cannot find fd_set.
- Improve error log message when inserting rpz RR.
- Merge PR #280, Make tvOS & watchOS checks verify truthiness as well as
  definedness, by Felipe Gasper.
- contrib/aaaa-filter-iterator.patch file renewed diff content to
  apply cleanly to the current coderepo for the current code version.
- Fix #287: doc typo: "Additionaly".
- Merge (modified) PR #277, use EVP_MAC_CTX_set_params if available,
  by Vítězslav Čížek.
- Create and init edns tags data for libunbound.
- Fix stats double count issue (#289).
- Fix that dnstap reconnects do not spam the log with the repeated
  attempts.  Attempts on the timer are only logged on high verbosity,
  if they produce a connection failure error.
- Fix to apply chroot to dnstap-socket-path, if chroot is enabled.
- Change configure to use EVP_sha256 instead of HMAC_Update for
  openssl-3.0.0.
- Update documentation in python example code.
- Review fix interface, doxygen and assign null in case of error free.
- Merge PR #293: Add missing prototype.  Also refactor to use the new
  shorthand function to clean up the code.
- Refactor to use sock_strerr shorthand function.
- Fix #296: systemd nss-lookup.target is reached before unbound can
  successfully answer queries. Changed contrib/unbound.service.in.
- Fix num.expired statistics output.
- Remove x file mode on ipset/ipset.c and h files.
- Spelling fix.
- Introduce test for statistics.
- Fix that prefer-ip4 and prefer-ip6 can be get and set with
  unbound-control, with libunbound and the unbound-checkconf option
  output function.
- Merge PR #311 by luismerino: Dynlibmod leak.
- Error message is logged for dynlibmod malloc failures.
- iana portlist updated.
- Fix #304: dnstap logging not recovering after dnstap process restarts
- Fix edns-client-tags get_option typo
- Fix #305: dnstap logging significantly affects unbound performance
  (regression in 1.11).
- Fix #305: only wake up thread when threshold reached.
- Fix to ifdef fptr wlist item for dnstap.
- Fix memory leak of edns tags at libunbound context delete.
- Fix double loopexit for unbound-dnstap-socket after sigterm.

 

[SomeWhereOverTheRainBow]

Just to let users know, just because the version supports a DoH as a client options as per mentioned by @dave14305 , it doesn't mean that the entware compiled version will have this. This option only becomes available within unbound once it is compiled using special flags and required components:

DNS-over-HTTPS is supported in this release. The DoH is enabled when Unbound is compiled with the nghttp2 library, with configure --with-libnghttp2. Then have an interface on the https port, that can be configured with the https-port option. Also have a cert and key available with the tls-service-key and tls-service-pem options. Further settings can be configured for the http-endpoint, http-max-streams, http-query-buffer-size, http-response-buffer-size and http-nodelay options. The max streams sets the maximum concurrent streams, the buffer size options the number of bytes in buffers, and the nodelay option can turn on TCP_NODELAY for DNS-over-HTTPS service. In the statistics the memory used is reported in mem.http.query_buffer and mem.http.response_buffer. The number of queries is reported in num.query.https, they are also included in the tcp and tls counts because https uses TLS and TCP.

The part i am interested in is this:

There is a new feature where it is possible to use interface names to bind to the IP addresses on that interface. It pulls in the addresses at the start of the server, if the addresses change, use the existing freebind and other socket options to register for addresses before they appear, or the interface-automatic option that copies them from queries to answers with ancillary data.

 

[dave14305]

1.13.0 is already in release candidate to address SAD vuln and add tcp reuse for upstream servers (e.g. DoT).

Unbound 1.13.0rc1 pre-release

 

[heysoundude]

1.13.0 is already in release candidate to address SAD vuln and add tcp reuse for upstream servers (e.g. DoT).

Unbound 1.13.0rc1 pre-release

I vote to wait for v1.13

 

[Ubimo]

How "safe" is is it to use Unbound? (vs. not using it)
Since there are always new vulnerabilities popping up.

 

[L&LD]

If you trust yourself and, you need to be online, it is as safe as it gets.

 

[Kingp1n]

If you trust yourself and, you need to be online, it is as safe as it gets.

@L&LD ... whats your take on using unbound if you're already using a full time VPN. I currently use PIA and the current built-in DoT with RMerlin firmware. I currently use the quad9 DNS servers.

 

[L&LD]

I don't use a VPN connection except to connect to my network if I'm not home.

 

[glehel]

How "safe" is is it to use Unbound? (vs. not using it)
Since there are always new vulnerabilities popping up.

i tried the dns query in many ways, tested almost every variation. Everyone is recommended a different setting to suit their needs. If the entire network passes the vpn Network and uses an unbound resolver, it also "passes the dnsleak test" and the recursive mode is retained. The ip address provided by the service provider is hidden.
If only a few clients are connected to the vpn network, it is possible to unbound queries through the vpn tunnel, but this will show the dns server as your private ip address.
Currently Unbound I use and the dnscrypt-proxy combined, the unbound monitors 53 ports on the network and forwards, adblock filter and caching server and dnssec validator the Unbound. Stabile. It also allows you to hide your ip on the dns side and works with vpn and lan clients at the same time.