On Mon, Mar 22, 2021, at 2:07 PM, [email protected] wrote: > > On Mon, 22 Mar 2021, Geert Stappers via Dnsmasq-discuss wrote: > > > On Mon, Mar 22, 2021 at 03:19:00AM +0000, [email protected] wrote: > >> > >> Hi, > >> > >> I am trying to do some CNAME filtering but it is not working for me... > >> > >> I'm picking a random domain that has cascading CNAMEs I am going to try to > >> filter for an example here. > >> > >> /etc/hosts > >> 127.0.0.1 blackhole.inv > >> > >> For my DNSMasq config I add (some of this may be redundant) the lines below > >> to kill dnsdelegation.io as an example : > >> > >> cname=*.dnsdelegation.io,blackhole.inv > >> cname=dnsdelegation.io,blackhole.inv > >> local=/.dnsdelegation.io/ > >> > >> In theory one of the above should set dnsdelegation.io to 127.0.0.1 > >> > >> a domain with cascading CNAMEs : > >> > >> jwxbwt.theaffordableartcompany.com.au > >> > >> --- > >> > >> When I do host I get : > >> > >> $ host jwxbwt.theaffordableartcompany.com.au > >> jwxbwt.theaffordableartcompany.com.au is an alias for dnsdelegation.io. > >> dnsdelegation.io is an alias for gum.criteo.com. > >> gum.criteo.com is an alias for gum.va1.vip.prod.criteo.com. > >> gum.va1.vip.prod.criteo.com has address 74.119.119.139 > >> > >> --- > >> > >> In DNSMasq Logs I see : > >> > >> 1 - 192.168.1.3 == DNSMasq request > >> 2 - 192.168.1.7 == forwarded to Upstream DNS > >> 3 - Returned reponse containing 4 Replies in one DNS packet > >> > >> 1 - dnsmasq[26607]: 11 192.168.1.3/57917 query[A] > >> jwxbwt.theaffordableartcompany.com.au from 192.168.1.3 > >> 2 - dnsmasq[26607]: 11 192.168.1.3/57917 forwarded > >> jwxbwt.theaffordableartcompany.com.au to 192.168.1.7 > >> 3 - dnsmasq[26607]: 11 192.168.1.3/57917 reply > >> jwxbwt.theaffordableartcompany.com.au is <CNAME> > >> dnsmasq[26607]: 11 192.168.1.3/57917 reply dnsdelegation.io is <CNAME> > >> dnsmasq[26607]: 11 192.168.1.3/57917 reply gum.criteo.com is <CNAME> > >> dnsmasq[26607]: 11 192.168.1.3/57917 reply gum.va1.vip.prod.criteo.com > >> is 74.119.119.139 > >> > >> --- > >> > >> TCPDump shows upstream DNS returns all replies in 3 above in a single > >> packet > >> > >> IP x.x.x.x.42759 > 192.168.1.7.53: 29157+ A? > >> jwxbwt.theaffordableartcompany.com.au. (55) > >> IP 192.168.1.7.53 > x.x.x.x.42759: 29157 4/0/0 CNAME dnsdelegation.io., > >> CNAME gum.criteo.com., CNAME gum.va1.vip.prod.criteo.com., A > >> 74.119.119.139 (160) > >> > >> --- > >> > >> It looks like the filtering is being bypassed because multiple replies are > >> all within a response from the upstream server so dnsdelegation.io is not > >> seen and filtered ??? > >> > >> Do I need to do something to get DNSMasq to apply the filters to the > >> responses from the upstream to filter them or is this not currently > >> possible > >> ? > >> > >> I expect if regular companies are doing what we see above the next > >> generation of malicious domains will be using this technique also so we > >> want > >> to get the jump on them and have methods to defend against them in place. > >> > >> thanks > >> > >> Matt > >> > > > > I wonder if option > > > > -h, --no-hosts > > Don't read the hostnames in /etc/hosts. > > > > > > is maybe active. > > > > > > And the > >> cname=*.dnsdelegation.io,blackhole.inv > >> cname=dnsdelegation.io,blackhole.inv > >> local=/.dnsdelegation.io/ > > looks odd. Expiriment with removing the `local=` line. > > > > > > Karma points for reporting back. > > > > > > Groeten > > Geert Stappers > > > > > > P.S. > > I would have "CNAME filtering" named "CNAME intercepting" > > -- > > Silence is hard to parse > > > > _______________________________________________ > > Dnsmasq-discuss mailing list > > [email protected] > > https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss > > > > If I use www.bestbuy.com as an example I see > > 8683 192.168.1.3/34112 query[AAAA] www.bestbuy.com from 192.168.1.3 > 8683 192.168.1.3/34112 forwarded www.bestbuy.com to 192.168.1.7 > 8682 192.168.1.3/34112 reply www.bestbuy.com is <CNAME> > 8682 192.168.1.3/34112 reply www.bestbuy.com.edgekey.net is <CNAME> > 8682 192.168.1.3/34112 reply e5816.x.akamaiedge.net is 184.24.144.179 > > the cname wildcard was added in version 2.77 according to changelog > If I add a wildcard cname I see no change in response it still resolves : > > cname=*.bestbuy.com,blackhole.inv > > If I use the direct name www.bestbuy.com > > cname=www.bestbuy.com,blackhole.inv > > then it works and I get : > $ host www.bestbuy.com > www.bestbuy.com is an alias for blackhole.inv. > blackhole.inv has address 127.0.0.1 > > But for this example what I want is to make this replied cname > www.bestbuy.com.edgekey.net goto blackhole.inv and neither the desired > wildcard > version or the full name work. www.bestbuy.com still resolves. > > Tried these variations of what is in the replies to www.bestbuy.com > > cname=*.edgekey.net,blackhole.inv > > cname=www.bestbuy.com.edgekey.net,blackhole.inv > > cname=e5816.x.akamaiedge.net,blackhole.inv > > cname=*.akamaiedge.net,blackhole.inv > > I also tried adding edgekey.net to /etc/hosts and doing > cname=*.edgekey.net,edgekey.net > But this also had not affect on www.bestbuy.com resolving/ > > I'm guessing because these are all in replies that are not looked at ??? > > > Matt
Ah, so this is similar to a question I had some time ago. In your first email, you asked: > It looks like the filtering is being bypassed because multiple replies are > all within a response from the upstream server so dnsdelegation.io is not > seen and filtered ??? > > Do I need to do something to get DNSMasq to apply the filters to the > responses from the upstream to filter them or is this not currently possible > ? That is indeed what is happening, and it's not currently possible, unfortunately. Dnsmasq either responds to a request using local info (e.g. /etc/hosts, configuration entries, DHCP leases) *or* forwards it to the upstream server. There's no half-and-half. As for why "cname=www.bestbuy.com,blackhole.inv" works but "cname=*.bestbuy.com,blackhole.inv" doesn't, that I'm not sure. Regards, Dominick _______________________________________________ Dnsmasq-discuss mailing list [email protected] https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss
