Stubby dns over tls using dnsmasq-full for dnssec & caching

Just an update, I figured out that the browsers were unreliable for testing DNSSEC in that they would always pass even if DNSSEC was not set up on router. The only time they would fail would be if stubby was set up to do DNSSEC but wasn't working (e.g. due to being unable to store certificates). If I turned off DNSSEC in stubby and didn't activate it in dnsmasq then all browser tests would still pass DNSSEC testing. I'm not sure if it was the browsers or OS doing that.
The most reliable way to see if DNSSEC is working seems to be to use dig on the router itself. That told me definitively that it wasn't working (when I had turned it off in stubby and hadn't yet set it up in dnsmasq), despite the fact that all browsers in both linux & windows were passing all DNSSEC tests.
I've now switched to doing DNSSEC with dnsmasq as the certificates issue proved too flakey in stubby, where as dnsmasq just works out of the box.
My setup is pretty much along the lines of here:
https://candrews.integralblue.com/2018/08/dnssec-on-openwrt-18-06/
https://candrews.integralblue.com/2018/08/dns-over-tls-on-openwrt-18-06/

In the version 18 and later builds of OpenWRT step 9A should be modified as follows to keep from having two IPv6 DHCP servers running:

A - opkg install dnsmasq-full --download-only && opkg remove odhcpd-ipv6only && opkg remove dnsmasq && opkg install dnsmasq-full --cache . && rm *.ipk

Dear Jbrossard,
Hello and I hope that you are well. I changed the step 9A as you informed everyone. Thanks for the heads up.
Peace

directnupe

@All
@ directnupe Thank you for your time&effort to write this comprehensive tutorial.

I am using OpenWRT 18.06.2 and a logread shows nasty warnings from dnsmasq:

daemon.warn dnsmasq[13761]: possible DNS-rebind attack detected: cmp.faktor.mgr.consensu.org
daemon.warn dnsmasq[13761]: reducing DNS packet size for nameserver 127.0.0.1 to 1280
daemon.warn dnsmasq[13761]: possible DNS-rebind attack detected: cmp.faktor.mgr.consensu.org
daemon.warn dnsmasq[13761]: Insecure DS reply received, do upstream DNS servers support DNSSEC?

I did a netstat -pln on my router:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:5453          0.0.0.0:*               LISTEN      13821/stubby
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1250/uhttpd
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      13761/dnsmasq
tcp        0      0 192.168.1.1:53          0.0.0.0:*               LISTEN      13761/dnsmasq
tcp        0      0 192.168.8.100:53        0.0.0.0:*               LISTEN      13761/dnsmasq
tcp        0      0 192.168.2.250:53        0.0.0.0:*               LISTEN      13761/dnsmasq
tcp        0      0 0.0.0.0:2008            0.0.0.0:*               LISTEN      678/dropbear
tcp        0      0 :::12865                :::*                    LISTEN      845/netserver
tcp        0      0 ::1:5453                :::*                    LISTEN      13821/stubby
tcp        0      0 :::80                   :::*                    LISTEN      1250/uhttpd
tcp        0      0 ::1:53                  :::*                    LISTEN      13761/dnsmasq
tcp        0      0 fe80::7ad2:94ff:fea8:2829:53 :::*                    LISTEN      13761/dnsmasq
tcp        0      0 fe80::7ad2:94ff:fea8:2828:53 :::*                    LISTEN      13761/dnsmasq
tcp        0      0 fe80::7ad2:94ff:fea8:2828:53 :::*                    LISTEN      13761/dnsmasq
tcp        0      0 fe80::7ad2:94ff:fea8:2829:53 :::*                    LISTEN      13761/dnsmasq
tcp        0      0 fe80::7ad2:94ff:fea8:282b:53 :::*                    LISTEN      13761/dnsmasq
tcp        0      0 fe80::506e:54ff:feb9:66b9:53 :::*                    LISTEN      13761/dnsmasq
tcp        0      0 fe80::7ad2:94ff:fea8:282a:53 :::*                    LISTEN      13761/dnsmasq
udp        0      0 127.0.0.1:53            0.0.0.0:*                           13761/dnsmasq
udp        0      0 192.168.1.1:53          0.0.0.0:*                           13761/dnsmasq
udp        0      0 192.168.8.100:53        0.0.0.0:*                           13761/dnsmasq
udp        0      0 192.168.2.250:53        0.0.0.0:*                           13761/dnsmasq
udp        0      0 0.0.0.0:67              0.0.0.0:*                           13761/dnsmasq
udp        0      0 127.0.0.1:5453          0.0.0.0:*                           13821/stubby
udp        0      0 0.0.0.0:1234            0.0.0.0:*                           -
udp        0      0 :::546                  :::*                                1443/odhcp6c
udp        0      0 ::1:53                  :::*                                13761/dnsmasq

udp        0      0 ::1:5453                :::*                                13821/stubby

It looks like dnsmasq is opening port 53, 67 on my router. Is this expected behaviour?

This means your client is looking up a host name that provides a RFC1918 IP as its response.

You fix this by disabling rebind protection:

Screenshot%20from%202019-05-20%2011-49-27

Yes, 53 is the DNS Forwarder, 67 is the DHCP service.

In the future, you may wish to make a new thread for your issue.

okay thx. But one more thing I noticed and might be a good fit for this thread.
My static leases stop working after some time.
I tried to delete all host/domain entries in /etc/config/dhcp and repopulate them.
Typing i.e. NAS.lan my browser throws an error. It does not open my NAS-webinterface. But I can reach my NAS-webinterface by typing plain IP address.
Any thoughts?

UPDATE: It is working now, unfortunately I don't know why

Hi, I've tried this guide three times from scratch, with no success. After redirecting dnsmasq to stubby, all my DNS queries fail with the following in the logs:

Thu Jun 20 10:25:28 2019 daemon.err stubby[12020]: [09:25:28.296857] STUBBY: Read config from file /var/etc/stubby/stubby.yml
Thu Jun 20 10:25:28 2019 daemon.err stubby[12020]: [09:25:28.304487] STUBBY: DNSSEC Validation is OFF
Thu Jun 20 10:25:28 2019 daemon.err stubby[12020]: [09:25:28.304673] STUBBY: Transport list is:
Thu Jun 20 10:25:28 2019 daemon.err stubby[12020]: [09:25:28.304821] STUBBY:   - TLS
Thu Jun 20 10:25:28 2019 daemon.err stubby[12020]: [09:25:28.304965] STUBBY: Privacy Usage Profile is Strict (Authentication required)
Thu Jun 20 10:25:28 2019 daemon.err stubby[12020]: [09:25:28.305115] STUBBY: (NOTE a Strict Profile only applies when TLS is the ONLY transport!!)
Thu Jun 20 10:25:28 2019 daemon.err stubby[12020]: [09:25:28.305266] STUBBY: Starting DAEMON....
Thu Jun 20 10:25:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:42 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:42 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:42 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:42 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:42 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:42 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:42 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:42 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:42 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:42 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:44 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:44 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:46 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:46 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:46 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:46 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:46 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:46 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:46 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:46 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:46 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:46 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:47 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:47 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:48 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:48 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:48 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:48 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:52 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:52 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:54 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:54 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:54 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:54 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:54 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:54 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:54 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:54 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:55 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:55 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:56 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:56 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:57 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:57 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:58 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:25:58 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:00 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:00 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:02 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:02 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:02 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:04 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:04 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:06 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:06 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:06 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:06 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:08 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:08 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:10 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:12 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:12 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:12 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:12 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:12 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:12 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:12 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:12 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:12 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:12 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:12 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:16 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:18 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:18 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:18 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:18 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:22 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:22 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:22 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:22 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:24 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:24 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:24 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:24 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:24 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:24 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:24 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:24 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:24 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:24 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:24 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:24 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:25 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:25 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:25 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:25 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:27 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:27 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:27 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:27 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:30 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:30 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:30 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:30 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:31 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:31 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:31 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:31 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:33 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:37 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:39 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:40 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:45 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.
Thu Jun 20 10:26:45 2019 daemon.err stubby[12020]: Could not schedule query: The library did not have the requested API feature implemented.

My best guess is this is an openssl library problem? I ran opkg upgrade libopenssl and it upgraded to libopenssl - 1.0.2s-1, however I still got the above errors after redirecting DNS to stubby.

Is a higher version required for Stubby/TLS1.3?

1 Like

Well, I changed the option in /etc/stubby/stubby.yml to make min TLS version 1.2 and it still does not work.

What is the exact library dependency for this setup?

Ok, my bad. You also have to delete the last line of the config to get it working on TLS1.2.

So some more weirdness, I now get 'rebind attack' warnings for seemingly benign domains:

Thu Jun 20 11:40:53 2019 daemon.warn dnsmasq[27666]: possible DNS-rebind attack detected: onecollector.cloudapp.aria.akadns.net
Thu Jun 20 11:42:41 2019 daemon.warn dnsmasq[27666]: possible DNS-rebind attack detected: metrics.icloud.com
Thu Jun 20 12:18:23 2019 daemon.warn dnsmasq[31663]: possible DNS-rebind attack detected: pagead46.l.doubleclick.net
Thu Jun 20 12:18:39 2019 daemon.warn dnsmasq[31663]: possible DNS-rebind attack detected: adservice.google.co.uk
Thu Jun 20 12:18:39 2019 daemon.warn dnsmasq[31663]: possible DNS-rebind attack detected: clarium.global.ssl.fastly.net
Thu Jun 20 12:18:45 2019 daemon.warn dnsmasq[31663]: possible DNS-rebind attack detected: s0.2mdn.net
Thu Jun 20 12:18:45 2019 daemon.warn dnsmasq[31663]: possible DNS-rebind attack detected: googleads4.g.doubleclick.net
Thu Jun 20 12:18:48 2019 daemon.warn dnsmasq[31663]: possible DNS-rebind attack detected: sync.colossusssp.com
Thu Jun 20 12:18:48 2019 daemon.warn dnsmasq[31663]: possible DNS-rebind attack detected: ads.yahoo.com
Thu Jun 20 12:18:48 2019 daemon.warn dnsmasq[31663]: possible DNS-rebind attack detected: a.tribalfusion.com
Thu Jun 20 12:18:50 2019 daemon.warn dnsmasq[31663]: possible DNS-rebind attack detected: ps.eyeota.net
Thu Jun 20 12:19:41 2019 daemon.warn dnsmasq[31663]: possible DNS-rebind attack detected: stats.g.doubleclick.net

Why does this happen (I understand about it returning an RFC1918 IP, but why would it do that?
Is disabling re-bind protection safe?

Also, this set up is failing the qname minimisation test mentioned in the guide. Reading through it again, there is no step to enable this on dnsmasq (I think some parts of this guide have been copy/pasted from the unbound guide).

Is QNAME minimisation possible with dnsmasq?

New thread:

Someone updated the wiki it's pretty comprehensive and clean now

https://openwrt.org/docs/guide-user/services/dns/dot_dnsmasq_stubby

Check it out

The truth is that I did not like the guide very much since it is very messy and is not well understood.

I checked below Server with https://www.immuniweb.com/ssl/?id=piFCAr0d and the result does not look good.
Why is it recommended?
It is a F btw.

## 12 - The Rubyfish Internet Tech DNS TLS Server A+ ( CHN )
  - address_data: 115.159.131.230
    tls_auth_name: "dns.rubyfish.cn

PS.: Tested a few more Servers from the list provided by directnupe. I am not sure I want to use this list.

Dear zkzkzk2015,
Hello and I hope that you are well and safe. First of all - regarding the entry below

## 12 - The Rubyfish Internet Tech DNS TLS Server A+ ( CHN )
  - address_data: 115.159.131.230
    tls_auth_name: "dns.rubyfish.cn"
    tls_port: 853
    tls_pubkey_pinset:
      - digest: "sha256"
        value: DBDigty3zDS7TN/zbQOmnjZ0qW+qbRVzlsDKSsTwSxo=

it should be entered exactly as it is listed above. Also - the entry which is to be tested on https://www.immuniweb.com/ssl/? is always the tls hostname - not the ip address. I only included this provider as it is officially listed by DNSPRIVACY. In addition, I just tested this dns.rubyfish.cn:853
and this DNSPRIVACY Provider has an A+ Rating on April 18 2020 - Lastly it has this important feature : The server supports the most recent and secure TLS protocol version of TLS 1.3
I do not not purport that one use ALL ( or any ) of the servers I list - use as many or as few as you wish. However - do not put out false information if you do not know how to test properly. I am including screen shots for tls_auth_name: "dns.rubyfish.cn"
Peace and God Bless

Great directnupe, thank you very much for your quick answer and commenting.
It is true, I did not know how to test and I only tested with IP, obviously.

Probably a good idea to hint how to test it correctly. Anyway I am glad you showed us how it works.

Dear zkzkzk2015,
Hello and I appreciate your reply and understanding of the process as I described. However, ( and I really wanted to let this go ) - but your advice " Probably a good idea to hint how to test it correctly." I take some exception to that . I say that because if you click on the link I provide in the tutorial ( see Below ) :
https://www.immuniweb.com/ssl/?id=Su8SeUQ4 - this is what pops up in the new browser page see screen shot :

So, I have had tens of thousands of folks use my tutorials - I also have written Pfsense - OPNsense tutorials DNS OVER TLS - OpenWRT using UNBOUND - and you are the first and only to enter the IP address - the example is there from the link I provide ( dot.seby.io:853 ) to be specific. So, - just stick to the script - Further - your link in your original post - https://www.immuniweb.com/ssl/?id=piFCAr0d
renders this ( see below ) :

So you see not only did you not enter the tls hostname you wanted to test ( dns.rubyfish.cn ) but you also did not test the ip address with a tls port defined. You must always specify a tls port to test no matter what. This is what you would have gotten if you had tested 115.159.131.230:853 ( the ip with port )
see the screen shot below :

So, in closing - I am a retired teacher - and I hope that you have learned something - you see with the port added to the ip address - you still get The server supports the most recent and secure TLS protocol version of TLS 1.3. However, a B instead of the A+ you get if you would properly test the tls_auth_name: "dns.rubyfish.cn" as is the correct method. This is because you connect to the remote tls server using the tls_auth_name - not the ip - you can also check the Server certificate by scrolling down the page through the last section ( CERTIFICATE CHAIN ) and the final entry - in this case it will be - Server certificate dns.rubyfish.cn the PIN is there and it Expires in 44 days

Peace and I am out

2 Likes

I'm trying to figure out how to get stubby working with TLS 1.3.
My setup is Openwrt 19.07.4 with latest versions of all packages.
I followed https://openwrt.org/docs/guide-user/services/dns/dot_dnsmasq_stubby and everything is working right now.
But how to get TLS 1.3 working with this setup ?

I found the following in this guide:

In order for TLSv1.3 protocol to work properly ( read at all ) in your Stubby
instance, OpenWrt must have OpenSSL 1.1.1 active and configured in the kernel.

Maybe its the default kernel thats the problem ? ?

Dear der_Kief,
Hello and I hope that you are safe and well. Read this :

The issue has been long standing and well documented in the article and elsewhere. I hope this helps.
Peace and Stay Well

1 Like

Thanks for the link.
So that means just wait and see :slight_smile:

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.