Hello,
After a very confusing ordeal with dnsmasq, I've discovered that it will
cache a negative result when it does not find an acceptable answer in
the reply even if the upstream server does not support recursion. This
is particularly nasty if you're using --server to send some requests to
a server which does not support recursion, since a CNAME response can
then poison (well, somewhere between poison and delete) an arbitrary name.
For example:
# dnsmasq --server=/home/10.0.0.1
$ dig +nostats +nocmd +noquestion lichtenberg.example.com
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46262
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; ANSWER SECTION:
lichtenberg.example.com. 3278 IN A 172.16.0.1
$ dig +nostats +nocmd +noquestion lichtenberg.home
;; The upstream server for .home does not offer recursion to this
;; client, so it does not include any data about the canonical name
;; lichtenberg.example.com. in the response.
;;
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9087
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; ANSWER SECTION:
lichtenberg.home. 3600 IN CNAME lichtenberg.example.com.
$ dig +nostats +nocmd +noquestion lichtenberg.example.com
;; The good data we had cached for lichtenberg.example.com. has been
;; replaced with with an empty response.
;;
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30135
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
The attached patch prevents dnsmasq from adding the negative cache entry
unless the Recursion Available bit is set in the response, which
prevents the cache damage for me. Now I just need to figure out how to
get the behavior I want, since dnsmasq doesn't support recursion...
Cheers,
--
Ben Winslow <[email protected]>
diff --git a/src/rfc1035.c b/src/rfc1035.c
index ea7678b..4c82660 100644
--- a/src/rfc1035.c
+++ b/src/rfc1035.c
@@ -981,7 +981,9 @@ int extract_addresses(struct dns_header *header, size_t qlen, char *name, time_t
}
}
- if (!found && !option_bool(OPT_NO_NEG))
+ /* If recursion was available and we didn't find an answer, add a
+ negative cache entry unless negative caching is disabled. */
+ if (!found && !option_bool(OPT_NO_NEG) && (header->hb4 & HB4_RA))
{
if (!searched_soa)
{
_______________________________________________
Dnsmasq-discuss mailing list
[email protected]
http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
