Skip to contentSkip to conversation

Correct note about DNS randomization in openvpn.8

PATCH In review Gert Doering 2 participants 7 messages May 23, 2015 – May 24, 2015

lore
Share & tools
lore

Gert Doering

author
#0 lore raw

PATCH 1/1 Correct note about DNS randomization in openvpn.8

Commit 4880739c17b502d00a removed DNS randomization, but this fact never made it into the man page.

Trac #411

Signed-off-by Gert Doering <[email protected]...>
---
 doc/openvpn.8 | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
doc/openvpn.8 +3 -3
index 56e7e80..f6e910c 100644
@@ -265,9 +265,9 @@ not match
 If
 .B host
 is a DNS name which resolves to multiple IP addresses,
-one will be randomly
-chosen, providing a sort of basic load-balancing and
-failover capability.
+the first address returned by the system getaddrinfo() function 
+will be used (no DNS randomization inside OpenVPN 2.3.x, and 
+it will not try multiple addresses).
 .\"*********************************************************
 .TP
 .B \-\-remote\-random\-hostname
Signature · 1 line
2.3.6
author
#1 lore raw

PATCH 1/1 Correct note about DNS randomization in openvpn.8

Commit 4880739c17b502d00a removed DNS randomization, and the dual-stack patches for 2.4 completely changed the getaddrinfo() result handling again, but neither fact ever made it into the man page.

Trac #411

Signed-off-by Gert Doering <[email protected]...>
---
 doc/openvpn.8 | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)
doc/openvpn.8 +10 -3
index 67e6ddd..d2b6359 100644
@@ -268,9 +268,16 @@ not match
 If
 .B host
 is a DNS name which resolves to multiple IP addresses,
-one will be randomly
-chosen, providing a sort of basic load-balancing and
-failover capability.
+OpenVPN will try them in the order that the system getaddrinfo()
+presents them, so priorization and DNS randomization is done
+by the system library.  Unless an IP version is forced by the
+protocol specification (4/6 suffix), OpenVPN will try both IPv4
+and IPv6 addresses, in the order getaddrinfo() returns them.
+(Internally, multiple addresses are mutated into individual
+.B <connection>
+blocks, so
+.B \-\-remote\-random
+will randomize the order across all hosts and addresses)
 .\"*********************************************************
 .TP
 .B \-\-remote\-random\-hostname
Signature · 1 line
2.3.6
author
#2 lore raw

PATCH v2 1/1 Correct note about DNS randomization in openvpn.8

Commit 4880739c17b502d00a removed DNS randomization, and the dual-stack patches for 2.4 completely changed the getaddrinfo() result handling again, but neither fact ever made it into the man page.

Trac #411

Signed-off-by Gert Doering <[email protected]...>
---
 doc/openvpn.8 | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
doc/openvpn.8 +5 -3
index 67e6ddd..07219c3 100644
@@ -268,9 +268,11 @@ not match
 If
 .B host
 is a DNS name which resolves to multiple IP addresses,
-one will be randomly
-chosen, providing a sort of basic load-balancing and
-failover capability.
+OpenVPN will try them in the order that the system getaddrinfo()
+presents them, so priorization and DNS randomization is done
+by the system library.  Unless an IP version is forced by the
+protocol specification (4/6 suffix), OpenVPN will try both IPv4
+and IPv6 addresses, in the order getaddrinfo() returns them.
 .\"*********************************************************
 .TP
 .B \-\-remote\-random\-hostname
Signature · 1 line
2.3.6
#3 lore raw

Am 24.05.15 um 09:56 schrieb Gert Doering:

Quoted 5 lines

Commit 4880739c17b502d00a removed DNS randomization, and the dual-stack patches for 2.4 completely changed the getaddrinfo() result handling again, but neither fact ever made it into the man page.

ACK.

Arne

author
#4 lore raw
In reply to Gert Doering

Your patch has been applied to the master branch.

commit 0322510375b5c54f63f5302b9088972d58b32b76

Author: Gert Doering
Date:   Sun May 24 09:56:12 2015 +0200
     Correct note about DNS randomization in openvpn.8

     Signed-off-by: Gert Doering <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/9730

--
kind regards,

Gert Doering

#5 lore raw
In reply to Gert Doering

Am 23.05.15 um 22:47 schrieb Gert Doering:

Quoted 4 lines

Commit 4880739c17b502d00a removed DNS randomization, but this fact never made it into the man page.

ACK

author
#6 lore raw
In reply to Gert Doering

Patch has been applied to the release/2.3 branch.

commit 1f5668671992dced602e89634e1890711877fdc4

Author: Gert Doering
Date:   Sat May 23 22:47:27 2015 +0200
     Correct note about DNS randomization in openvpn.8

     Signed-off-by: Gert Doering <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/9726

--
kind regards,

Gert Doering