Re: [Cerowrt-devel] Had to disable dnssec today

2014-04-26 Thread Dave Taht
On Sat, Apr 26, 2014 at 4:38 AM, Aaron Wood wrote: > Just too many sites aren't working correctly with dnsmasq and using Google's > DNS servers. After 4 days of uptime, I too ended up with a wedged cerowrt 3.10.36-6 on wifi. The symptoms were dissimilar from what has been described here - I was

[Cerowrt-devel] looks like dhcpv4 has sprouted dhcp v4 support

2014-04-26 Thread Dave Taht
And it's not configured right. (This may be an artifact of me trying hnetd out.) Anyone else seen this? # logread Sun Apr 27 00:03:22 2014 daemon.warn odhcpd[22321]: DHCPv4 range out of assigned network Sun Apr 27 00:03:25 2014 daemon.warn odhcpd[22321]: DHCPv4 range out of assigned network Sun

Re: [Cerowrt-devel] [Dnsmasq-discuss] Had to disable dnssec today

2014-04-26 Thread Dave Taht
On Sat, Apr 26, 2014 at 12:44 PM, Simon Kelley wrote: > On 26/04/14 17:20, Aaron Wood wrote: >> David, >> >> With two of them (akamai and cloudflare), I _think_ it's a dnsmasq >> issue with the DS records for proving insecure domains are insecure. >> But Simon Kelley would know that better than I.

Re: [Cerowrt-devel] [Dnsmasq-discuss] Had to disable dnssec today

2014-04-26 Thread Simon Kelley
On 26/04/14 20:44, Simon Kelley wrote: > I plan to see if dnsmasq can be modified to improve this. In the git repo now, the change allows the akamai domain to resolve successfully. Simon. ___ Cerowrt-devel mailing list Cerowrt-devel@lists.bufferbloat

Re: [Cerowrt-devel] [Dnsmasq-discuss] Had to disable dnssec today

2014-04-26 Thread Simon Kelley
On 26/04/14 17:20, Aaron Wood wrote: > David, > > With two of them (akamai and cloudflare), I _think_ it's a dnsmasq > issue with the DS records for proving insecure domains are insecure. > But Simon Kelley would know that better than I. > The result of the analysis of the akamai domain was t

Re: [Cerowrt-devel] test-ipv6.com vs dnssec

2014-04-26 Thread Sebastian Moeller
Hi List, hi Dave, so I had to restart cerowrt 3.10.36-6 today after coming home from a 5 day trip. I had some issues connecting with a macbook and one of 2 nexus 4s. after a reboot of the router both MacBooks connected fine on the 5GHz radio but none of the nexi connected to either the 2.4GHz n

Re: [Cerowrt-devel] Had to disable dnssec today

2014-04-26 Thread Aaron Wood
David, With two of them (akamai and cloudflare), I _think_ it's a dnsmasq issue with the DS records for proving insecure domains are insecure. But Simon Kelley would know that better than I. With BofA, I'm nearly certain it's them, or an issue with one of their partners (since the domain that fa

Re: [Cerowrt-devel] Had to disable dnssec today

2014-04-26 Thread dpreed
Is this just a dnsmasq issue or is the DNSSEC mechanism broken at these sites? If it is the latter, I can get attention from executives at some of these companies (Heartbleed has sensitized all kinds of companies to the need to strengthen security infrastructure). If the former, the change

[Cerowrt-devel] Had to disable dnssec today

2014-04-26 Thread Aaron Wood
Just too many sites aren't working correctly with dnsmasq and using Google's DNS servers. - Bank of America (sso-fi.bankofamerica.com) - Weather Underground (cdnjs.cloudflare.com) - Akamai (e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net) And I'm not getting any traction with reporting the errors