Heimdall DNS v1.1.1

Heimdall DNS changelog since v0.1.6

There have been three releases since v0.1.6: 1.0.0 (RFC conformance fixes), 1.1.0 (recursion over IPv6) and 1.1.1 (a fix for the auto-detection added in 1.1.0). You can upgrade directly from v0.1.6 to any of them, and existing configs work unchanged. There's one new optional directive.

Fixes the address-family auto probe, which could report "IPv4 yes" on an IPv6-only host and then pick the wrong families.

The probe did a UDP connect() to a root server. All connect() does is make the kernel choose a route and a source address, so it shows that a route exists, not that the other end can be reached. In a container that makes a real difference. The runtime's default networking gives the namespace a private IPv4 address and a default route through a bridge or tap device. As a result, connect() to a root succeeds even when the host has no IPv4 uplink, and the packet gets dropped one hop later.

The probe now sends an actual . NS query to up to two roots per family. It only counts a family as working if a reply comes back with the matching transaction ID. connect() is still used as a quick negative check: ENETUNREACH means the family is definitely unusable, so it's skipped without waiting for a timeout. In the worst case, a family that has a route but no connectivity adds about 1.6 seconds to startup. A working family replies in tens of milliseconds. The log line now shows how the result was checked:

resolver: outbound IPv4 no, IPv6 yes (address-family auto, verified by live root query)

Only the auto probe changed. An explicit address-family setting was never affected.

Recursion now works on IPv6-only hosts. The root hints used to be IPv4 only. On an IPv6-only machine, every recursive lookup started by timing out against thirteen unreachable addresses. There was a second bug as well. When a delegation arrived without glue, the nameserver's address was looked up as A only, never AAAA, so those delegations couldn't be resolved.

• Root hints for both families. All 13 IANA root servers are compiled in with both IPv4 and IPv6 addresses. They're interleaved so that if one family is down, it can't take up all the first queries.
• New directive: address-family, which takes auto (default), ipv4, ipv6 or both. Existing configs don't need changing. On dual-stack or IPv4-only hosts, auto behaves the same as before.
• Family checks elsewhere. Glue for a family the host can't use is now dropped instead of retried. AAAA glue is preferred on IPv6-only hosts. Nameserver address lookups try each usable family in turn.
• -t output shows which mode was chosen.

Known issue in this release: when running in a container, the auto probe detects IPv6-only hosts as dual-stack. That's exactly the setup this release was for. Either upgrade to 1.1.1 or set address-family ipv6 explicitly. An explicit setting works fine in 1.1.0.

This setting has no effect on authoritative serving. If address-family is wrong, only recursion is affected, and zones are still served normally.

Two protocol conformance fixes, both found while auditing a live server.

• BADVERS for unsupported EDNS versions. A query with an OPT record for an EDNS version the server doesn't implement used to get a normal reply. RFC 6891 §6.1.3 says the server should return BADVERS (extended rcode 16) with an empty answer section and an OPT record giving the highest version it supports. It now does that. EDNS version 0 is unaffected.
• RA is no longer always set. The "recursion available" bit used to be set on every response, including refusals. Clients were told recursion was available and then refused. RA is now set only when recursion is enabled and the client matches allow-recursion. A refused recursive query now comes back with RA clear.

None of these changes affect authoritative answers, caching, DNSSEC handling, cookies or rate limiting.