Mikaela
/
shell-things
mirror of https://gitea.blesmrt.net/mikaela/shell-things.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

resolv: increase timeout to 2 (match unbound/RFC 8767), decrease attempts to 2, rotate

This commit is contained in:
Aminda Suomalainen 2024-05-01 09:54:07 +03:00
parent 447385fdb8
commit ba298f94a5
Signed by: Mikaela
SSH Key Fingerprint: SHA256:CXLULpqNBdUKB6E6fLA1b/4SzG0HvKD19PbIePU175Q
7 changed files with 17 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
etc/resolv.conf
View File

@ -28,9 +28,17 @@ nameserver 127.0.0.53
# edns0 = extended DNS
# trust-ad = trust DNSSEC authenticated data
# timeout:1 = nameserver timeout 1 s (default 5, max 30), then next
# attempts:5 = if all nameservers fail, attempt again 5 times (def 2, max 5)
options edns0 trust-ad timeout:1 attempts:5
# timeout:2 = nameserver timeout 2 s (default 5, max 30), then next
# attempts:2 = if all nameservers fail, attempt again 2 times (def 2, max 5)
# rotate = instead of trying the nameservers in the order specified, randomize
# the order in round-robin fashion. They are all theoretically the same,
# except that NordVPN disables IPv6 so ::1 will fail and occassionally only
# systemd-resolved works and I am under impression that some apps are aware of
# systemd-resolved and will use it directly bypassing resolv.conf
options edns0 trust-ad timeout:2 attempts:2 rotate
# AMINDA! Remember, you are specifying these here, a couple of bash scripts
# in this directory, see the comment on top, ../rc/{bash,zsh}rc
# ($RES_OPTIONS) and systemd/system/service.d/resolv.conf !
# no sending local domain to upstream whenever NXDOMAIN happens
search .

2
etc/resolv.conf-generate.bash
View File

@ -17,7 +17,7 @@ rm -v /etc/resolv.conf
# Actual resolv.conf creation. OK, this could read resolv.conf in this
# directory, but I like this being self-contained.
# tee -p = operate in a more appropriate MODE with pipes.
printf 'nameserver ::1\nnameserver 127.0.0.1\nnameserver 127.0.0.53\noptions edns0 trust-ad timeout:1 attempts:5\nsearch .\n' | tee -p /etc/resolv.conf
printf 'nameserver ::1\nnameserver 127.0.0.1\nnameserver 127.0.0.53\noptions edns0 trust-ad timeout:2 attempts:2 rotate\nsearch .\n' | tee -p /etc/resolv.conf
# Remove all other permissions than everyone reading resolv.conf
chmod -v a=r /etc/resolv.conf

2
etc/systemd-resolv.conf-generate.bash
View File

@ -29,7 +29,7 @@ chmod -v +w /etc/resolv.conf
rm -v /etc/resolv.conf
# tee -p = operate in a more appropriate MODE with pipes.
printf 'nameserver 127.0.0.53\nnameserver 127.0.0.53\nnameserver 127.0.0.53\noptions edns0 trust-ad timeout:1 attempts:5\nsearch .\n' | tee -p /etc/resolv.conf
printf 'nameserver 127.0.0.53\nnameserver 127.0.0.53\nnameserver 127.0.0.53\noptions edns0 trust-ad timeout:2 attempts:2 rotate\nsearch .\n' | tee -p /etc/resolv.conf
# Remove all other permissions than everyone reading resolv.conf
chmod -v a=r /etc/resolv.conf

2
etc/systemd/system/service.d/resolv.conf
View File

@ -5,6 +5,6 @@
# note that this is possible.
[Service]
Environment=LOCALDOMAIN=.
Environment=RES_OPTIONS="edns0 trust-ad timeout:1 attempts:5"
Environment=RES_OPTIONS="edns0 trust-ad timeout:2 attempts:2 rotate"
# vim: filetype=systemd

5
etc/unbound/unbound.conf.d/expired-stale-serving-rfc8767.conf
View File

@ -13,10 +13,7 @@ server:
serve-expired-reply-ttl: 30
# Serve expired data to client if there is no answer in 1.8 seconds as per
# common timeout 2 seconds according to the RFC 8767
#serve-expired-client-timeout: 1800
# However my /etc/resolv.conf timeout is 1 second since all my nameservers
# are localhost, so let's wait 0.8 seconds instead.
serve-expired-client-timeout: 800
serve-expired-client-timeout: 1800
# Human readable DNSSEC errors for expired records
ede-serve-expired: yes

2
rc/bashrc
View File

@ -258,7 +258,7 @@ export LSCOLORS=gxBxhxDxfxhxhxhxhxcxcx
export LOCALDOMAIN=.
# Secureish resolv.conf options (except trust-ad, but systemd also sets it
# regardless of whether DNSSEC=true or not.
export RES_OPTIONS="edns0 trust-ad timeout:1 attempts:5"
export RES_OPTIONS="edns0 trust-ad timeout:2 attempts:2 rotate"
##### Aliases RJ706I #####

2
rc/zshrc
View File

@ -217,7 +217,7 @@ export LSCOLORS=gxBxhxDxfxhxhxhxhxcxcx
export LOCALDOMAIN=.
# Secureish resolv.conf options (except trust-ad, but systemd also sets it
# regardless of whether DNSSEC=true or not.
export RES_OPTIONS="edns0 trust-ad timeout:1 attempts:5"
export RES_OPTIONS="edns0 trust-ad timeout:2 attempts:2 rotate"
##### Aliases RJ706I #####