[FR] distinguish Do53, DoT and DoH in the logs

the Problem is discussed in the list archive: https://lists.nlnetlabs.nl/pipermail/unbound-users/2023-November/008188.html

Yorgos suggested to open a FR ticket here. I like his idea to simply log the destination port and
suggest to append that information to the current log. for example here:

unbound/util/data/msgreply.c

Line 919 in 15a9b0f

log_reply_info(enum verbosity_value v, struct query_info *qinf,

while "my" use-case would be solved by logging a destination port, other users may see benefits if the destination address is logged. It may make sense to log both if an new option log-destaddr: yes is set (or split in log-destaddr and log-destport)

It would also be useful to log the protocol (TCP/UDP).
In the end, we have 53 udp or tcp. 853 tcp for DoT and 853 udp for DoQ. 443 tcp for DoH.

I have found by mistake unbound supports also DTLS on port 853, not necessary reserved for DoQ. Socket stream/datagram indication should be present, but I think indication of protocol used to receive query would be the best. You can still configure to accept DoT on port 443, at least dnssec-trigger uses that.

The option log-destaddr: yes can be used print the destination address, port and type, for the log-replies output. It is implemented in the commit to the repository.

The fix adds this type of output to the log replies: 127.0.0.1 localhost. A IN NOERROR 0.000000 1 54 on tcp 127.0.0.1 53.

- Fix NLnetLabs#969: [FR] distinguish Do53, DoT and DoH in the logs.

Hello Wouter, looks like the commit didn't found a way into release 1.19.1. Was this intentional?

The 1.19.1 release is a security release, and contains the security fixes only. The code is there waiting for a next release, in the code repository.

Is the log-destaddr: attribute supposed to be available in 1.19.2? I can't use it from the Unbound package provided in Ubuntu Server 24.04.1

root@DNS:/etc/unbound# unbound-checkconf unbound.conf
/etc/unbound/unbound.conf:32: error: unknown keyword 'log-destaddr'
/etc/unbound/unbound.conf:32: error: stray ':'
/etc/unbound/unbound.conf:32: error: stray '"'
/etc/unbound/unbound.conf:32: error: unknown keyword 'yes'
/etc/unbound/unbound.conf:32: error: stray '"'
read unbound.conf failed: 5 errors in configuration file
root@DNS:/etc/unbound# unbound -V
Version 1.19.2

Configure line: --build=aarch64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=${prefix}/lib/aarch64-linux-gnu --runstatedir=/run --disable-maintainer-mode --disable-dependency-tracking --with-pythonmodule --with-pyunbound --enable-subnet --enable-dnstap --enable-systemd --enable-cachedb --with-libhiredis --with-libnghttp2 --with-chroot-dir= --with-dnstap-socket-path=/run/dnstap.sock --disable-rpath --with-pidfile=/run/unbound.pid --with-libevent --enable-tfo-client --with-rootkey-file=/usr/share/dns/root.key --disable-flto --enable-tfo-server
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.0.13 30 Jan 2024
Linked modules: dns64 python cachedb subnetcache respip validator iterator
TCP Fastopen feature available

BSD licensed, see LICENSE in source package for details.
Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues

1.19.2 was also a security release. The option made its way in the 1.19.3 release.

Navigation Menu

Repository navigation

[FR] distinguish Do53, DoT and DoH in the logs #969

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[FR] distinguish Do53, DoT and DoH in the logs #969

Description

Activity

andreasschulze commented on Nov 25, 2023

renaudallard commented on Nov 25, 2023

pemensik commented on Nov 29, 2023

wcawijngaards commented on Dec 5, 2023

andreasschulze commented on Feb 21, 2024

wcawijngaards commented on Feb 22, 2024

sunbearc22 commented on Oct 31, 2024

gthess commented on Oct 31, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions