mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-22 07:48:26 +00:00
ed312ac6f2
On Ubuntu 22 (systemd 249), systemd-resolved applies interface-scoped routing to per-link DNS servers. Configuring `resolvectl dns fips0 127.0.0.1:5354` caused resolved to attempt reaching 127.0.0.1 through fips0 (a TUN with only fd00::/8 routes), silently failing. The DNS responder never received queries. Newer systemd versions (250+) have explicit handling for loopback servers on non-loopback interfaces. Changes: - DNS responder default bind_addr changed from "127.0.0.1" to "::" so it listens on all interfaces, including fips0. Bind logic in lifecycle.rs now parses bind_addr as IpAddr and constructs a SocketAddr, handling IPv6 literal formatting. Factored into Node::bind_dns_socket with explicit IPV6_V6ONLY=0 via socket2, so IPv4 clients on 127.0.0.1:5354 still reach the responder regardless of the kernel's net.ipv6.bindv6only sysctl. - fips-dns-setup resolvectl backend now waits for fips0 to have a global IPv6 address, then configures resolved with [<fips0-addr>]:5354. That address is locally delivered by the kernel regardless of which interface resolved tries to route through. The dnsmasq and NetworkManager backends still use 127.0.0.1 (they don't have the interface-scoping issue). - Dropped hardcoded `bind_addr: "127.0.0.1"` from the packaged fips.yaml (Debian + OpenWrt). The shipped config was overriding the new default. - DNS queries are only accepted from the localhost. Verified end-to-end in a privileged Ubuntu 22.04 systemd container: dig @127.0.0.53 AAAA <npub>.fips resolves cleanly through systemd-resolved. The dns-delegate backend (systemd 258+) still uses 127.0.0.1; it has not been verified whether that backend has the same routing issue.
78 lines
2.0 KiB
YAML
78 lines
2.0 KiB
YAML
# FIPS Node Configuration
|
|
|
|
node:
|
|
identity:
|
|
# By default, a new ephemeral keypair is generated on each start.
|
|
# Uncomment persistent to keep the same identity across restarts;
|
|
# on first start a keypair is saved to fips.key/fips.pub next to
|
|
# this config file (mode 0600/0644).
|
|
# persistent: true
|
|
#
|
|
# Or set an explicit key (overrides persistent):
|
|
# nsec: "nsec1..."
|
|
|
|
tun:
|
|
enabled: true
|
|
name: fips0
|
|
mtu: 1280
|
|
|
|
dns:
|
|
enabled: true
|
|
# bind_addr defaults to "::" (all interfaces, dual-stack). Required so
|
|
# systemd-resolved can reach the responder via fips0 when resolvectl
|
|
# configures per-interface DNS forwarding.
|
|
# bind_addr: "::"
|
|
port: 5354
|
|
|
|
transports:
|
|
udp:
|
|
bind_addr: "0.0.0.0:2121"
|
|
|
|
tcp:
|
|
# Accepts inbound connections. No static outbound peers.
|
|
bind_addr: "0.0.0.0:8443"
|
|
|
|
# Ethernet transport — uncomment and set your interface name.
|
|
# ethernet:
|
|
# interface: "eth0"
|
|
# discovery: true
|
|
# announce: true
|
|
# auto_connect: true
|
|
# accept_connections: true
|
|
|
|
# Bluetooth Low Energy transport — requires BlueZ and the 'ble' feature.
|
|
# ble:
|
|
# adapter: "hci0"
|
|
# mtu: 2048
|
|
# advertise: true
|
|
# scan: true
|
|
# auto_connect: true
|
|
# accept_connections: true
|
|
|
|
# Outbound LAN gateway. Allows non-FIPS hosts on the LAN to reach
|
|
# mesh destinations via DNS-allocated virtual IPs and kernel NAT.
|
|
# Requires: IPv6 forwarding enabled, fips daemon running with DNS.
|
|
# gateway:
|
|
# enabled: true
|
|
# pool: "fd01::/112"
|
|
# lan_interface: "eth0"
|
|
# dns:
|
|
# listen: "[::]:53"
|
|
# upstream: "127.0.0.1:5354"
|
|
# ttl: 60
|
|
# pool_grace_period: 60
|
|
# conntrack:
|
|
# tcp_established: 432000
|
|
# udp_timeout: 30
|
|
# udp_assured: 180
|
|
# icmp_timeout: 30
|
|
|
|
peers: []
|
|
# Static peers for bootstrapping (UDP or TCP):
|
|
# - npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98"
|
|
# alias: "gateway"
|
|
# addresses:
|
|
# - transport: udp
|
|
# addr: "217.77.8.91:2121" # IP or hostname (e.g., "peer.example.com:2121")
|
|
# connect_policy: auto_connect
|