!tCyGickeVqkHsYjWnh:nixos.org

NixOS Networking

903 Members
Declaratively manage your switching, routing, wireless, tunneling and more.263 Servers

Load older messages

SenderMessageTime
10 Jul 2025
@maciel310:matrix.orgmaciel310

And here's the output of a couple commands to show the state, LMK if there are any other commands that would be helpful

$ networkctl
IDX LINK          TYPE     OPERATIONAL SETUP
  1 lo            loopback carrier     unmanaged
  2 enp0s20f0u1u2 ether    carrier     configured
  3 vlan30        vlan     routable    configured

3 links listed.

$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: enp0s20f0u1u2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 1c:bf:ce:a7:84:b8 brd ff:ff:ff:ff:ff:ff
    altname enx1cbfcea784b8
3: vlan30@enp0s20f0u1u2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 1c:bf:ce:a7:84:b8 brd ff:ff:ff:ff:ff:ff
    inet 192.168.30.7/24 brd 192.168.30.255 scope global vlan30
       valid_lft forever preferred_lft forever
    inet6 fe80::1ebf:ceff:fea7:84b8/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever
05:42:58
@hexa:lossy.networkhexalooks good from here12:10:14
@hexa:lossy.networkhexaI'd expect the issue will be on the switchport or the other endpoint12:10:36
@hexa:lossy.networkhexadifferent question â€Ķ what is the least awful way to make sure a consumer of a module I'm providing uses a DNSSEC validating resolver?14:21:04
@hexa:lossy.networkhexagiven that the resolver can be on the local machine (preferable) or not this seems a bit difficult to assert on ðŸĪŠ14:22:50
@emilazy:matrix.orgemilyseems like not really something you can detect before runtime14:23:05
@sandro:supersandro.deSandro 🐧within reason probably not at all14:23:10
@hexa:lossy.networkhexaso I'm wondering what the right approximation would be14:23:11
@sandro:supersandro.deSandro 🐧You could check if kresd is used with dnssec checks on14:23:24
@emilazy:matrix.orgemily I would just do nothing or have services.X.yesIPromiseImUsingDNSSec 14:23:25
@emilazy:matrix.orgemilyespecially for remote it's hopeless, but even locally there can be all kinds of layers between an enabled service and what actually ends up being used for DNS resolution14:23:49
@hexa:lossy.networkhexa so one thing I could do is check for networking.resolvconf.useLocalResolver 14:24:14
@hexa:lossy.networkhexa

the other thing, that I found super awful was

         lib.any (with config; [
          services.bind.enable
          services.dnsmasq.enable
          services.kresd.enable
          services.unbound.enable
          services.pdns-recursor.enable
        ]);
14:25:03
@hexa:lossy.networkhexa *

the other thing, that I found super awful was

        lib.any (with config; [
          services.bind.enable
          services.dnsmasq.enable
          services.kresd.enable
          services.unbound.enable
          services.pdns-recursor.enable
        ]);
14:25:05
@emilazy:matrix.orgemilythat would (sorry) break resolved with DNSSEC14:25:24
@hexa:lossy.networkhexabut then I found people used dnscrypt2-proxy and other weird stuff14:25:28
@emilazy:matrix.orgemily dnscrypt-proxy2 doesn't do DNSSEC validation 14:25:42
@hexa:lossy.networkhexaresolved is fucked for this use case, I don't care 🙂 14:25:47
@emilazy:matrix.orgemilyI think it'll pass on the bit from the upstream resolver and that's all14:25:52
@emilazy:matrix.orgemilyI don't really think asserting on dynamic network conditions is something a module should be doing at all tbh. if the software absolutely needs the DNSSEC validation bit in responses it should be checking for it itself14:26:32
@hexa:lossy.networkhexaoh, it does14:27:32
@hexa:lossy.networkhexathe software is postfix for example14:27:36
@hexa:lossy.networkhexa 
postfix/smtp[2110025]: warning: DNSSEC validation may be unavailable
postfix/smtp[2110025]: warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated
14:28:05
@hexa:lossy.networkhexathat's what you get with resolved fwiw14:28:10
@k900:0upti.meK900Then just let it fail IMO14:28:15
@hexa:lossy.networkhexaRedacted or Malformed Event14:29:59
@emilazy:matrix.orgemilycan't shift everything left :)14:37:18
@k900:0upti.meK900shift everything left :)can't14:42:45
@sandro:supersandro.deSandro 🐧maybe add a systemd unit which watches the log for that message and fails if it appears?14:45:19
@hexa:lossy.networkhexainstructions unclear, multiplied by 214:45:27

Show newer messages

Back to Room ListRoom Version: 6