pfSense Support Subscription

Author Topic: Periodic since 2.2 pages load blank, certs invalid  (Read 14748 times)

0 Members and 1 Guest are viewing this topic.

Offline kejianshi

  • Hero Member
  • *****
  • Posts: 4902
  • Karma: +194/-40
  • Debugging...
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #105 on: February 10, 2015, 04:12:53 am »
Does that mean you have already made all the suggested changes?

Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8553
  • Karma: +956/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #106 on: February 10, 2015, 04:19:13 am »
Does that mean you have already made all the suggested changes?

Apparently not.

Quote
Update for our situation (only dns active, harden glue settings not (yet) updated).

People, by all means feel free to experiment if its your network. However, mind that if there are any unsuspecting users behind your router using your resolver, this is not the best idea around. Noone likes getting their boxes infected via malicious pages served via the subverted DNS, getting their banking info compromised etc.!
Do NOT PM for help!

Offline swix

  • Jr. Member
  • **
  • Posts: 26
  • Karma: +1/-0
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #107 on: February 10, 2015, 04:25:26 am »
Does that mean you have already made all the suggested changes?

(if the question is for me) : no, as we would first would like to find out what/who is triggering this phenomena.  But we'll change the setup then (today before the evening) and report again.

Offline kejianshi

  • Hero Member
  • *****
  • Posts: 4902
  • Karma: +194/-40
  • Debugging...
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #108 on: February 10, 2015, 04:29:30 am »
Yeah - Please do find out.  Its a mystery for me.

Offline swix

  • Jr. Member
  • **
  • Posts: 26
  • Karma: +1/-0
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #109 on: February 10, 2015, 07:00:24 am »
Activating following settings (as suggested previously in this thread) seems to solve the issue for now, at least for the last 3 hours :

Code: [Select]
harden-glue: yes
harden-dnssec-stripped: yes

In the mean time I have a 500 MB resolver.log in "verbose=5" mode to analyze.   



Offline swix

  • Jr. Member
  • **
  • Posts: 26
  • Karma: +1/-0
    • View Profile
[SOLVED] Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #110 on: February 10, 2015, 09:17:42 am »
With the great support of Wouter Wijngaards from the Unbound-Dev-Team this issue can be considered as closed, at least on our side.
Activating "harden-glue: yes" and "harden-dnssec-stripped: yes" was the solution, or a patch can be applied to fix this situation without enabling these options.

Quote from: Wouter Wijngaards
Hi Martin, Olivier,

I have found the issue, it is in unbound.  You have turned off
harden-glue in config and this disabled the poison checks (that is its
purpose) and caused the poisoning.  The domain is not an attack domain
I think but a domain-reseller.

Turn on harden-glue: yes in unbound.conf

Also this patch may solve the problem (and you can continue to use
harden-glue: no).  Note that harden-glue no allows people (not this
specific attack) to poison nameserver glue records and then poison
your cache as well, also with the patch.


Index: iterator/iter_scrub.c
===================================================================
--- iterator/iter_scrub.c       (revision 3329)
+++ iterator/iter_scrub.c       (working copy)
@@ -680,7 +680,9 @@
                                 * (we dont want its glue that was approved
                                 * during the normalize action) */
                                del_addi = 1;
-                       } else if(!env->cfg->harden_glue) {
+                       } else if(!env->cfg->harden_glue && (
+                               rrset->type == LDNS_RR_TYPE_A ||
+                               rrset->type == LDNS_RR_TYPE_AAAA)) {
                                /* store in cache! Since it is relevant
                                 * (from normalize) it will be picked up
                                 * from the cache to be used later */


Why was harden-glue turned off?  And perhaps I should change
documentation or implementation of this misfeature?

Best regards,
   Wouter


More information from the Unbound-Users mailing list : https://unbound.nlnetlabs.nl/pipermail/unbound-users/2015-February/003768.html

Suggestion for pfSense 2.2.1 : apply this patch to unbound and/or activate the harden-options by default.  I'll check later if there is anything in redmine about this issue or will create a new one accordingly.

Thanks again for your fast and helpful answers on this forum & I hope it will remain stable this way !  Now I can get back to my IPSEC issues :-)
Kind regards.

PS: about the trigger :

Code: [Select]

> (...) could you see which host/device caused this issue ?

Yes, the offending query was for ns2.transitionalprotocol.net A.
The logs are missing lines (the logger seems to skip lines when
presented at a high rate).  That query was made to resolve another
query for 105.73.246.46.in-addr.arpa. PTR.
And this was requested by
Feb 10 11:48:15 pf unbound: [68609:0] debug: udp request from ip4
192.168.1.150 port 62403 (len 16)

The query for that reverse address seems innocent.

Offline dgcom

  • Full Member
  • ***
  • Posts: 137
  • Karma: +7/-2
    • View Profile
Re: [SOLVED] Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #111 on: February 10, 2015, 09:57:05 am »
Quote from: Wouter Wijngaards
Why was harden-glue turned off?

Indeed, this is a good question, keeping in mind that unbound is enabled by default in all new 2.2 installations, I wonder how many unsuspecting people are being affected by this.
I feel that it warrants an official announcement by pfSense team with specific suggestions on how to remedy the issue...
DG

Offline Trel

  • Sr. Member
  • ****
  • Posts: 368
  • Karma: +11/-1
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #112 on: February 10, 2015, 10:14:04 am »
I'd say applying that patch AND enabling harden glue by default would probably be the safest option considering the havoc this was able to cause.

In the mean time, even with harden glue on, I'm going to keep my 0.0.0.0 overrides ;)
« Last Edit: February 10, 2015, 10:24:03 am by Trel »

Offline swix

  • Jr. Member
  • **
  • Posts: 26
  • Karma: +1/-0
    • View Profile
Re: [SOLVED] Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #113 on: February 10, 2015, 11:08:29 am »
Suggestion for pfSense 2.2.1 : apply this patch to unbound and/or activate the harden-options by default.  I'll check later if there is anything in redmine about this issue or will create a new one accordingly.

Voilą : https://redmine.pfsense.org/issues/4402

Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8553
  • Karma: +956/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #114 on: February 10, 2015, 11:19:22 am »
harden-glue is already on by default in RELENG_2_2:

https://redmine.pfsense.org/projects/pfsense/repository/revisions/ef120e878558f84ed14369a484c0938ccd1b6db5

(The iter_scrub.c patch still useful though...)
Do NOT PM for help!

Offline 0x10C

  • Jr. Member
  • **
  • Posts: 31
  • Karma: +1/-0
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #115 on: February 10, 2015, 01:21:35 pm »
I just started getting this problem today for the first time since I installed the 2.2-RELEASE.

I was also using the 8.8.8.8 and 8.8.4.4 DNS from Google. I've changed to using OpenDNS now which seems to have stopped the problem?

The thread is really long I read the first few pages, should I activate the Harden Glue feature? - Just a worried noobie.

Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8553
  • Karma: +956/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #116 on: February 10, 2015, 01:24:35 pm »
Harden Glue - yes, that definitely should be enabled. Otherwise, OpenDNS does not support DNSSEC at all, so all those other DNSSEC-related hardening features are kinda useless till you switch back to Google, or just disable the forwarding altogether.
Do NOT PM for help!

Offline 0x10C

  • Jr. Member
  • **
  • Posts: 31
  • Karma: +1/-0
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #117 on: February 10, 2015, 01:35:20 pm »
Ok so I've turned Hardened Glue on, what else should I enable?

Online heper

  • Hero Member
  • *****
  • Posts: 2687
  • Karma: +253/-11
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #118 on: February 10, 2015, 01:38:31 pm »
Have you tried checking:

Harden Glue

Harden DNSSEC data

These two in particular, if you don't have them enabled, enable them. I changed things to enable both those by default, and we'll add config upgrade code to turn those on for anyone who doesn't have them enabled upon upgrade to 2.2.1.

Offline 0x10C

  • Jr. Member
  • **
  • Posts: 31
  • Karma: +1/-0
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #119 on: February 10, 2015, 01:40:46 pm »
Have you tried checking:

Harden Glue

Harden DNSSEC data

These two in particular, if you don't have them enabled, enable them. I changed things to enable both those by default, and we'll add config upgrade code to turn those on for anyone who doesn't have them enabled upon upgrade to 2.2.1.

Okay I've enabled both of those. They will work okay with OpenDNS? - Thanks :)