I have a newly installed FreeBSD-12.0 system, with dnsdist installed
from the FreeBSD package system, and all the dependencies:
New packages to be INSTALLED:
dnsdist: 1.3.3_6
libsodium: 1.0.16
gnutls: 3.6.7
trousers: 0.3.14_2
tpm-emulator: 0.7.4_2
gmp: 6.1.2_1
indexinfo: 0.3.1
p11-kit: 0.23.15
libtasn1: 4.13_1
ca_root_nss: 3.44.1
libffi: 3.2.1_3
nettle: 3.4.1_1
libidn2: 2.1.1
libunistring: 0.9.10_1
gettext-runtime: 0.19.8.1_2
lua52: 5.2.4
libedit: 3.1.20181209_2,1
re2: 20190301
protobuf: 3.7.1,1
boost-libs: 1.69.0_2
icu: 64.2,1
The dnsdist version claims it supports crypto:
# dnsdist -V
dnsdist 1.3.3 (Lua 5.2.4)
Enabled features: dns-over-tls(gnutls openssl) dnscrypt libsodium protobuf re2
recvmmsg/sendmmsg
If I start this dnsdist with a config file containing one line:
newServer("193.75.75.75")
should I expect the testCrypto() function to work? Because it doesn't:
----------------------------------------------------------------------
# dnsdist -C /usr/local/etc/dnsdist.conf
Added downstream server 193.75.75.75:53
Listening on 127.0.0.1:53
dnsdist 1.3.3 comes with ABSOLUTELY NO WARRANTY. This is free software, and you
are welcome to redistribute it according to the terms of the GPL version 2
ACL allowing queries from: 127.0.0.0/8, 100.64.0.0/10, 10.0.0.0/8,
169.254.0.0/16, 192.168.0.0/16, 172.16.0.0/12, ::1/128, fc00::/7, fe80::/10
Console ACL allowing connections from: ::1/128, 127.0.0.1/8
Marking downstream 193.75.75.75:53 as 'up'
> Polled security status of version 1.3.3 at startup, no known issues reported:
> OK
> testCrypto()
Crypto failed..
----------------------------------------------------------------------
Oh yeah, I can verify using tcpdump that it is indeed polling the
DNS server at 193.75.75.75 and getting replies.
The reason for asking about the testCrypto() function is that I'm
trying to get DoT working, so far without success.
Steinar Haug, AS2116
_______________________________________________
Pdns-users mailing list
Pdns-users@mailman.powerdns.com
https://mailman.powerdns.com/mailman/listinfo/pdns-users
