On 11/04/12 06:00, Ben Winslow wrote: > On 04/06/2012 03:33 AM, Simon Kelley wrote: >> On 06/04/12 07:35, Ben Winslow wrote: >>> Hello, >>> >>> After a very confusing ordeal with dnsmasq, I've discovered that it will >>> cache a negative result when it does not find an acceptable answer in >>> the reply even if the upstream server does not support recursion. This >>> is particularly nasty if you're using --server to send some requests to >>> a server which does not support recursion, since a CNAME response can >>> then poison (well, somewhere between poison and delete) an arbitrary >>> name. >>> >> >> The patch looks sensible, thanks. Will apply next week when I'm back >> from holiday. > Thanks! >> Sorry for your ordeal, in our defence we never claimed tp be able to >> talk to non-recursive nameservers, do log a very clear warning when we >> try. > Indeed! I also maintain the upstream server that's refusing to recurse > for me, so I should've noticed sooner, but I missed the log message > because the problem occurred semi-randomly -- the upstream server > frequently has A records for the CNAME targets cached, and bind will > return those cached results even if recursion is disabled. > > I don't want to enable recursion globally on this server, and the client > IPs aren't predictable enough for an acl. Is there any chance dnsmasq > will ever support TSIG signing of the queries it forwards? ;) (...bind > can use signatures to identify a client for acl matching. *I'd* use it, > but I'd surely be the minority.) >> Cheers, >> >> Simon. > > Cheers, >
Patch is in 2.61rc, http://www.thekelleys.org.uk/dnsmasq/release-candidates/dnsmasq-2.61rc2.tar.gz Cheers, Simon. _______________________________________________ Dnsmasq-discuss mailing list [email protected] http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
