Debian Bug report logs - #860564
openresolv is less crippled than debian-resolvconf for security-focused configurations

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

To: submit@bugs.debian.org

Subject: openresolv is less crippled than debian-resolvconf for security-focused configurations

Date: Tue, 18 Apr 2017 19:36:07 +0200

Package: resolvconf

Debian has its own "resolvconf" which is vastly inferior and makes it
impossible to securely set up DNS servers for ephemeral secure tunnel
interfaces.

Specifically, Debian's "resolvconf" relies on a hard coded list of
interface templates. For virtual interfaces or renamed interfaces --
such as those used for creating secure tunnels -- the DNS entries will
be lowest priority. This means it's not possible to override the
current DNS with a DNS bound to particular arbitrarily-named
interface. In other words, Debian's "resolvconf" explicitly ties
interface naming templates to interface metrics. Openresolv has the
`-m` option for this. Using `-m 0` will give an interface's DNS
servers top priority.

Secondly, and importantly, Debian's "resolvconf" does not support the
`-x` option, which specifies that a DNS servers of an interface should
be the _exclusive_ servers in use. This option is necessary to prevent
leaking DNS queries over another interface. Even with the
aforementioned `-m 0` option, an attacker could DoS the top priority
DNS server in order to leak queries to the second priority DNS server.
Openresolv's `-x` option fixes this, by allowing marking an interface
as having "exclusive" control over DNS.

Therefore, I'd suggest that either:
a) Debian switch to using Openresolv by default instead of its own
"resolvconf". The openresolv package already "Provides: openresolv",
so it should be a drop-in replacement; or
b) Debian's "resolvconf" backport these useful and necessary features
from Openresolv.

Message #10 received at 860564@bugs.debian.org (full text, mbox, reply):

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

To: 860564@bugs.debian.org

Date: Tue, 18 Apr 2017 19:46:16 +0200

Sorry, a small typo:

The openresolv package already "Provides: resolvconf", so it should be
a drop-in replacement.

Send a report that this bug log contains spam.