summaryrefslogtreecommitdiff
path: root/man/resolved.conf.xml
Commit message (Collapse)AuthorAgeFilesLines
* man: explain route-only domains a bit moreZbigniew Jędrzejewski-Szmek2023-03-071-9/+15
| | | | | | | | | | | | | The details discussion of how search and route-only domains work is in systemd-resolved.service(8). But users are more likely to look at resolved.conf(5), because that's where Domains= is described. So let's add a reference to the other man page there, and also strengthen the text a bit. In particular, in systemd-resolved.service(8) we say "route-only", which makes the distinction with search domains clearer. Let's use the same in the other man page too. This is based on feedback from Lukáš Nykrýn that the man page is not clear enough.
* resolve: drop remaining references for Monitor=Yu Watanabe2022-10-031-9/+0
| | | | Follow-up for b25d819aee10b79a1c972d25be81a238448134dd.
* Implement DNS notifications from resolved via varlinkSuraj Krishnan2022-09-091-0/+9
| | | | | | | | | | | | | | | | | | | | * The new varlink interface exposes a method to subscribe to DNS resolutions on the system. The socket permissions are open for owner and group only. * Notifications are sent to subscriber(s), if any, after successful resolution of A and AAAA records. This feature could be used by applications for auditing/logging services downstream of the resolver. It could also be used to asynchronously update the firewall. For example, a system that has a tightly configured firewall could open up connections selectively to known good hosts based on a known allow-list of hostnames. Of course, updating the firewall asynchronously will require other design considerations (such as queueing packets in the user space while a verdict is made). See also: https://lists.freedesktop.org/archives/systemd-devel/2022-August/048202.html https://lists.freedesktop.org/archives/systemd-devel/2022-February/047441.html
* man: correctly document default for DNSSEC= and DNSoverTLS=Zbigniew Jędrzejewski-Szmek2021-12-201-3/+6
| | | | https://bugzilla.redhat.com/show_bug.cgi?id=1926323
* resolved: add "proxy-only" stub on 127.0.0.54Lennart Poettering2021-11-221-5/+7
| | | | | | | | | | | | | | | | | | | | This beefs up the DNS stub logic to listen on two IP addresses: 127.0.0.53 (as before) + 127.0.0.54 (new). When the latter is contact our stub will operate in "bypass" mode only, i.e we'll try to pass DNS requests as unmodified upstream as we can (and not do mDNS/LLMNR and such, also no DNSSEC validation – but we'll still do DNS-over-TLS wrapping). This is supposed to be useful for container environments or tethering: this stub could be exposed (via NAT redirect) to clients of this system and we'll try to stay out of the way with doing too much DNS magic ourselves, but still expose whatever the current DNS server is from upstream under a stable address/port. How to use this: # iptables -t nat -I PREROUTING -p udp -i <interface> --dport 53 -j DNAT --to 127.0.0.54:53 # echo 1 > /proc/sys/net/ipv4/conf/<interface>/route_localnet
* man: remove unintentionally repetitive wordsml2021-11-111-1/+1
|
* resolved: Fix link to resolv.conf manpageRaul Tambre2021-06-291-1/+1
| | | Seems to typically located in volume 5 these days on Linux systems that systemd targets.
* resolved: allow cache responses from local DNS serversPavel Sapezhko2020-11-271-2/+10
|
* man: suffix settings name with = and enclose in <varname>Lennart Poettering2020-11-191-6/+4
|
* man: add missing full stopLennart Poettering2020-11-161-1/+1
|
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* man: fix typo in resolved.confGeorge Rawlinson2020-09-051-1/+1
|
* man: update DNSStubListenerExtra=Yu Watanabe2020-09-041-21/+21
|
* resolve: allow configurable bind addressSusant Sahani2020-09-031-0/+25
|
* man: update explanation about the format to specify DNS serversYu Watanabe2020-07-211-4/+9
|
* tree-wide: drop quotes from around [section]Zbigniew Jędrzejewski-Szmek2020-07-061-1/+1
| | | | | | | For users, the square brackets already serve as markup and clearly delineate the section name from surrounding text. Putting additional markup around that only adds clutter. Also, we were very inconsistent in using the quotes. Let's just drop them altogether.
* tree-wide: spellcheck fixesFrantisek Sumsal2020-06-261-1/+1
| | | | Most of them were reported by Fossies.org
* man: document the new optionZbigniew Jędrzejewski-Szmek2020-06-181-3/+20
| | | | Also correct "stub resolver" → "systemd-resolved" in one other option.
* man: rework description of Domains=Zbigniew Jędrzejewski-Szmek2020-06-181-14/+22
| | | | | | | We said that ~domains "do not define a search path", which is mighty confusing, because this is exactly what they do. So let's try to make this a bit easier for the reader: start by saying that there are two things going on here, and describe each one from user's POV.
* tree-wide: use "hostname" spelling everywhereZbigniew Jędrzejewski-Szmek2020-04-211-1/+1
| | | | | | | | It's not that I think that "hostname" is vastly superior to "host name". Quite the opposite — the difference is small, and in some context the two-word version does fit better. But in the tree, there are ~200 occurrences of the first, and >1600 of the other, and consistent spelling is more important than any particular spelling choice.
* man: fix formatting in resolved.conf(5)Zbigniew Jędrzejewski-Szmek2020-04-201-5/+5
|
* systemd-resolved: use hostname for certificate validation in DoTJörg Thalheim2020-03-071-8/+11
| | | | | | | Widely accepted certificates for IP addresses are expensive and only affordable for larger organizations. Therefore if the user provides the hostname in the DNS= option, we should use it instead of the IP address.
* Implement SNI when using DNS-over-TLSGuilhem Lettron2019-12-041-0/+3
| | | | | | | | | Some DNS providers need SNI to identify client. This can be used by adding #name to a DNS. Example: [Resolve] DNS=192.168.1.1#example.com
* Be more specific in resolved.conf man page with regard to DNSOverTLSRiccardo Schirone2019-11-131-2/+3
| | | | | | | | | | | DNSOverTLS in strict mode (value yes) does check the server, as it is said in the first few lines of the option documentation. The check is not performed in "opportunistic" mode, however, as that is allowed by RFC 7858, section "4.1. Opportunistic Privacy Profile". > With such a discovered DNS server, the client might or might not validate the > resolver. These choices maximize availability and performance, but they leave > the client vulnerable to on-path attacks that remove privacy.
* resolved: switch cache option to a tri-state option (systemd#5552).Jorge Niedbalski2019-07-171-1/+2
| | | | | | | | | | | | | Change the resolved.conf Cache option to a tri-state "no, no-negative, yes" values. If a lookup returns SERVFAIL systemd-resolved will cache the result for 30s (See 201d995), however, there are several use cases on which this condition is not acceptable (See systemd#5552 comments) and the only workaround would be to disable cache entirely or flush it , which isn't optimal. This change adds the 'no-negative' option when set it avoids putting in cache negative answers but still works the same heuristics for positive answers. Signed-off-by: Jorge Niedbalski <jnr@metaklass.org>
* resolved: add strict mode for DNS-over-TLSIwan Timmer2019-06-191-2/+5
| | | | Add strict mode for DNS-over-TLS, which will require TLS support from the server. Closes #10755
* man: use same header for all filesZbigniew Jędrzejewski-Szmek2019-03-141-1/+1
| | | | | | | The "include" files had type "book" for some raeason. I don't think this is meaningful. Let's just use the same everywhere. $ perl -i -0pe 's^..DOCTYPE (book|refentry) PUBLIC "-//OASIS//DTD DocBook XML V4.[25]//EN"\s+"http^<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"\n "http^gms' man/*.xml
* man: standarize on one-line license headerZbigniew Jędrzejewski-Szmek2019-03-141-4/+1
| | | | | | No need to waste space, and uniformity is good. $ perl -i -0pe 's|\n+<!--\s*SPDX-License-Identifier: LGPL-2.1..\s*-->|\n<!-- SPDX-License-Identifier: LGPL-2.1+ -->|gms' man/*.xml
* resolved: have the stub resolver listen on both TCP and UDP by defaultSam Morris2018-12-121-2/+2
| | | | | | | | RFC7766 section 4 states that in the absence of EDNS0, a response that is too large for a 512-byte UDP packet will have the 'truncated' bit set. The client is expected to retry the query over TCP. Fixes #10264.
* man: fix default value in resolved.conf man page (#10733)Alexander Kurtz2018-11-121-1/+1
| | | See https://github.com/systemd/systemd/blob/v239/meson_options.txt#L190
* man: fix RFC ref in resolved.conf man page (#9976)Todd Walton2018-08-301-1/+1
| | | | This is a simple one-character fix to reference the correct RFC for LLMNR, which is RFC 4795, not RFC 4794.
* man: use literal tagYu Watanabe2018-07-281-4/+4
|
* resolve: add option to toggle reading /etc/hostsYu Watanabe2018-07-281-0/+7
| | | | Workaround for #9718.
* man: drop mode line in file headersZbigniew Jędrzejewski-Szmek2018-07-031-1/+1
| | | | | This is already included in .dir-locals, so we don't need it in the files themselves.
* tree-wide: drop copyright headers from frequent contributorsZbigniew Jędrzejewski-Szmek2018-06-201-2/+0
| | | | | | | | Fixes #9320. for p in Shapovalov Chevalier Rozhkov Sievers Mack Herrmann Schmidt Rudenberg Sahani Landden Andersen Watanabe; do git grep -e 'Copyright.*'$p -l|xargs perl -i -0pe 's|/([*][*])?[*]\s+([*#]\s+)?Copyright[^\n]*'$p'[^\n]*\s*[*]([*][*])?/\n*|\n|gms; s|\s+([*#]\s+)?Copyright[^\n]*'$p'[^\n]*\n*|\n|gms' done
* man: drop unused <authorgroup> tags from man sourcesZbigniew Jędrzejewski-Szmek2018-06-141-9/+0
| | | | | | | | | | | | Docbook styles required those to be present, even though the templates that we use did not show those names anywhere. But something changed semi-recently (I would suspect docbook templates, but there was only a minor version bump in recent years, and the changelog does not suggest anything related), and builds now work without those entries. Let's drop this dead weight. Tested with F26-F29, debian unstable. $ perl -i -0pe 's/\s*<authorgroup>.*<.authorgroup>//gms' man/*xml
* tree-wide: beautify remaining copyright statementsLennart Poettering2018-06-141-1/+1
| | | | | | Let's unify an beautify our remaining copyright statements, with a unicode ©. This means our copyright statements are now always formatted the same way. Yay.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-141-2/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* resolve: rename PrivateDNS to DNSOverTLSIwan Timmer2018-06-141-4/+4
| | | PrivateDNS is not considered a good name for this option, so rename it to DNSOverTLS
* man: document DNS-over-TLS optionsIwan Timmer2018-06-121-0/+32
|
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* Add SPDX license identifiers to man pagesZbigniew Jędrzejewski-Szmek2017-11-191-0/+2
|
* build-sys: s/ENABLE_RESOLVED/ENABLE_RESOLVE/Zbigniew Jędrzejewski-Szmek2017-10-041-1/+1
| | | | | | The configuration option was called -Dresolve, but the internal define was …RESOLVED. This options governs more than just resolved itself, so let's settle on the version without "d".
* resolved: add global config option to control mDNS stackYu Watanabe2017-03-211-0/+15
|
* Merge pull request #4061 from dm0-/coreos-1545Lennart Poettering2016-10-071-0/+12
|\ | | | | resolved: add an option to disable the stub resolver
| * resolved: add an option to control the DNS stub listenerDavid Michael2016-10-071-0/+12
| |
* | man: remove consecutive duplicate words (#4268)Stefan Schweter2016-10-031-1/+1
|/ | | | | | | This PR removes consecutive duplicate words from the man pages of: * `resolved.conf.xml` * `systemd.exec.xml` * `systemd.socket.xml`
* man: rework resolved.conf's Cache= documentationLennart Poettering2016-07-221-13/+7
| | | | | | | | | Let's not mention the supposed security benefit of turning off caching. It is really questionnable, and I#d rather not create the impression that we actually believed turning off caching would be a good idea. Instead, mention that Cache=no is implicit if a DNS server on the local host is used.
* resolved: add option to disable caching (#3592)Martin Pitt2016-06-241-0/+17
| | | | | | In some cases, caching DNS results locally is not desirable, a it makes DNS cache poisoning attacks a tad easier and also allows users on the system to determine whether or not a particular domain got visited by another user. Thus provide a new "Cache" resolved.conf option to disable it.
* Merge pull request #2469 from keszybz/resolved-2Lennart Poettering2016-01-301-3/+3
|\ | | | | Resolved 2
View Lorry Controller Status