diff options
| author | Beniamino Galvani <bgalvani@redhat.com> | 2020-10-01 09:54:30 +0200 |
|---|---|---|
| committer | Beniamino Galvani <bgalvani@redhat.com> | 2020-10-09 10:17:11 +0200 |
| commit | b11c36bb21f0c9810cbfdb9630181d10f34a01d5 (patch) | |
| tree | 861a066765f2340a545955f10d97b5f1cf645cdb /libnm-core/nm-setting-ip-config.c | |
| parent | 762f515e0f3d936570ac021caae25fdcaef91e76 (diff) | |
| download | NetworkManager-b11c36bb21f0c9810cbfdb9630181d10f34a01d5.tar.gz | |
dns: change default DNS priority of VPNs to -50bg/dns-vpn
Change the default DNS priority of VPNs to -50, to avoid leaking
queries out of full-tunnel VPNs.
This is a change in behavior. In particular:
- when using dns=default (i.e. no split-dns) before this patch both
VPN and the local name server were added (in this order) to
resolv.conf; the result was that depending on resolv.conf options
and resolver implementation, the name servers were tried in a
certain manner which does not prevent DNS leaks.
With this change, only the VPN name server is added to resolv.conf.
- When using a split-dns plugin (systemd-resolved or dnsmasq), before
this patch the full-tunnel VPN would get all queries except those
ending in a local domain, that would instead be directed to the
local server.
After this patch, the VPN gets all queries.
To revert to the old behavior, set the DNS priority to 50 in the
connection profile.
Diffstat (limited to 'libnm-core/nm-setting-ip-config.c')
| -rw-r--r-- | libnm-core/nm-setting-ip-config.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libnm-core/nm-setting-ip-config.c b/libnm-core/nm-setting-ip-config.c index 7b6624d82f..e884066f85 100644 --- a/libnm-core/nm-setting-ip-config.c +++ b/libnm-core/nm-setting-ip-config.c @@ -5913,7 +5913,7 @@ nm_setting_ip_config_class_init(NMSettingIPConfigClass *klass) * to the most negative value of all active connections profiles. * * Zero selects a globally configured default value. If the latter is missing - * or zero too, it defaults to 50 for VPNs (including WireGuard) and 100 for + * or zero too, it defaults to -50 for VPNs (including WireGuard) and 100 for * other connections. * * Note that the priority is to order DNS settings for multiple active |