Page MenuHomeVyOS Platform
Create Task
Maniphest T9492

DNS forwarding: render the pdns-recursor configuration as YAML (needed for 5.x and Debian trixie)
Open, LowPublic
Actions

Description

Debian trixie ships pdns-recursor 5.2.13, and 5.x does not accept the old key=value recursor.conf that VyOS generates any more. The service stops at start with:

Old-style settings syntax not supported by default anymore
Convert to YAML settings. If not feasible use --enable-old-settings on the command line.
This option will be removed in a future release.

Debian's NEWS for 5.2.0-4 says the same ("The configuration file syntax has changed from the old key=value format to YAML. You must manually migrate, otherwise the service fails to (re-)start."). --enable-old-settings is only a stopgap.

A second change comes with the same package: /usr/share/pdns-recursor/lua-config/rootkeys.lua is not shipped any more (it was a Debian-specific file with the line readTrustAnchorsFromFile("/usr/share/dns/root.key")). recursor.conf.lua.j2 loads it with dofile(...), so the Lua configuration fails. The recursor has the DNSSEC root key built in, and dnssec.trustanchorfile can point at /usr/share/dns/root.key to keep following the key of dns-root-data.

Why this matters beyond the base change: pdns-recursor 4.8.8 in bookworm is end of life upstream, and 5.2.13 in trixie already contains the /etc/hosts fix of T9489 and fixes for most of the CVEs that are open for 4.8.8 in the Debian tracker.

Scope

  • data/templates/dns-forwarding/recursor.conf.j2: render YAML (recursor.yml) instead of key=value.
  • data/templates/dns-forwarding/recursor.conf.lua.j2: drop the rootkeys.lua line, use dnssec.trustanchorfile or the built-in key.
  • recursor.forward-zones.conf.j2 and vyos-hostsd: the forward zones file written by vyos-hostsd, and the Lua file with the names from DHCP and static-host-mapping.
  • src/conf_mode/service_dns_forwarding.py: file names and the systemd override (--config-dir).
  • smoketest/scripts/cli/test_service_dns_forwarding.py: it reads lines of the generated configuration today.

rec_control show-yaml --config-dir=/run/pdns-recursor converts the current generated files without errors on 5.4.7. That gives the mapping, for example allow-from to incoming.allow_from, local-address to incoming.listen, dnssec=validate to dnssec.validation, max-cache-entries to recordcache.max_entries, query-local-address to outgoing.source_address, forward-zones-file to recursor.forward_zones_file.

Constraint

YAML settings exist only in 5.x. The change can only be merged together with the Debian trixie base (or with a version check that renders the old format for 4.x). I would prefer the first, so the old format can go away.

Test plan

Develop and test against 5.4.7 on a VM, and against 5.2.13 once the trixie image is available. The smoketest has to pass on both.

Details

Version
rolling
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Unspecified (please specify)

Related Objects
Search...

Event Timeline

rherold created this task.Tue, Oct 20, 11:19 AM
rherold created this object in space S1 VyOS Public.
rherold added a parent task: T7557: Use Debian trixie as a build base for Docker and the VyOS image.
rherold added a comment.Tue, Oct 20, 11:51 AM

I prepared this as a draft PR so that someone else can continue if needed: https://github.com/vyos/vyos-1x/pull/5585

One correction to the description: dnssec.trustanchorfile can not be used. pdns-recursor 5.x refuses to start when the YAML settings contain values that used to live in Lua (it is one of them) and also sets recursor.lua_config_file:

YAML settings include values originally in Lua but also sets `recursor.lua_config_file`. This is unsupported

The Lua configuration file is still needed for the names of vyos-hostsd (addNTA) and ZoneToCache, so the draft keeps it and reads the root keys there with readTrustAnchorsFromFile("/usr/share/dns/root.key"), the line that Debian's rootkeys.lua contained. The behavior is the same as before. Moving the hostsd names and ZoneToCache to YAML as well would remove the Lua file, that is a possible follow-up.

What the draft changes:

  • recursor.yml.j2 replaces recursor.conf.j2. The generated file is converted with rec_control show-yaml the same way as PowerDNS converts the old settings, so the keys are the ones the recursor writes itself.
  • vyos-hostsd writes the forward zones as a YAML list (recursor.forward-zones.yml), the Lua file for the names is unchanged.
  • dont-query+= has no equivalent. A YAML list replaces the default list of the recursor, so the template repeats the 19 default entries of 5.4.7 and appends the configured ones. If PowerDNS changes its defaults this list has to follow.
  • The smoketest reads the generated YAML instead of matching lines.

Tested on a VM with the official packages for bookworm, with a clean boot for each run:

  • pdns-recursor 5.4.7: test_service_dns_forwarding.py, 22 of 22 pass.
  • pdns-recursor 5.2.13 (the version of Debian trixie): 22 of 22 pass.
  • With 5.4.7 a name with an IPv4 address from vyos-hostsd (DHCP tag) and an IPv6 address from static-host-mapping answers A and AAAA (T9489), the authoritative zone answers, the root key is loaded, the NTAs from vyos-hostsd are present, and the forward zones are read from the YAML file (count=2, also after rec_control reload-zones).

Not tested: the Debian trixie image itself (I used the same upstream version from the PowerDNS repository on bookworm), forwarding to a real resolver (the forwarders in my test were documentation addresses), and an upgrade from 4.x with a running DNS forwarding. The change is not read by 4.x, so it can only be merged together with the trixie base (T7557).

matthew subscribed.Tue, Oct 20, 7:33 PM
matthew unsubscribed.Tue, Oct 20, 7:35 PM