<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Aug 5, 2021, at 2:45 PM, Simon Kelley <<a href="mailto:simon@thekelleys.org.uk" class="">simon@thekelleys.org.uk</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><br class=""><br class="">On 05/08/2021 19:24, Wojtek Swiatek wrote:<br class=""><blockquote type="cite" class=""><br class=""><br class="">Le jeu. 5 août 2021 à 19:41, Simon Kelley <<a href="mailto:simon@thekelleys.org.uk" class="">simon@thekelleys.org.uk</a><br class=""><<a href="mailto:simon@thekelleys.org.uk" class="">mailto:simon@thekelleys.org.uk</a>>> a écrit :<br class=""><br class=""> OK. The problem is here: using local addresses only for domain<br class=""> <a href="http://swtk.info" class="">swtk.info</a> <<a href="http://swtk.info" class="">http://swtk.info</a>><br class=""><br class=""> That's an easy spot because I just fixed this particular combination.<br class=""><br class=""> I guess you have something like<br class=""><br class=""> local=/<a href="http://swtk.info/" class="">swtk.info/</a> <<a href="http://swtk.info/" class="">http://swtk.info/</a>><br class=""><br class=""> and dnsmasq is using this to return NXDOMAIN without checking that it<br class=""> has more specific data for the query in other types.<br class=""><br class=""> As a workaround, removing that configuration should make things work, at<br class=""> the expense of extra trips to the upstream servers.<br class=""><br class=""><br class="">Thank you. The problem is that <a href="http://swtk.info" class="">swtk.info</a> <<a href="http://swtk.info" class="">http://swtk.info</a>> is also<br class="">declared on .info so (if I understand local= correctly), it would<br class="">attempt to resolve <a href="http://mqtt.swtk.info" class="">mqtt.swtk.info</a> <<a href="http://mqtt.swtk.info" class="">http://mqtt.swtk.info</a>> on Internet.<br class="">Which would fail.<br class=""></blockquote><br class="">That's fine. <a href="http://mqtt.swtk.info" class="">mqtt.swtk.info</a> resolves to NXDOMAIN (at least it does here)<br class="">and when dnsmasq gets that answer back, it will change it into NODATA.<br class="">because it has an A record for <a href="http://mqtt.swtk.info" class="">mqtt.swtk.info</a> derived from a DHCP<br class="">record. That should be functional in 2.78.<br class=""><blockquote type="cite" class=""><br class="">The local=/<a href="http://swtk.info/" class="">swtk.info/</a> <<a href="http://swtk.info/" class="">http://swtk.info/</a>> and<br class="">address=/<a href="http://swtk.info/192.168.10.2" class="">swtk.info/192.168.10.2</a> <<a href="http://swtk.info/192.168.10.2" class="">http://swtk.info/192.168.10.2</a>> combo<br class="">fixes this.<br class=""> <br class=""><br class=""><br class=""> This should already be fixed in the development code: if it's possible<br class=""> for you to run<br class=""> <a href="https://thekelleys.org.uk/dnsmasq/test-releases/dnsmasq-2.86test6.tar.gz" class="">https://thekelleys.org.uk/dnsmasq/test-releases/dnsmasq-2.86test6.tar.gz</a><br class=""> <<a href="https://thekelleys.org.uk/dnsmasq/test-releases/dnsmasq-2.86test6.tar.gz" class="">https://thekelleys.org.uk/dnsmasq/test-releases/dnsmasq-2.86test6.tar.gz</a>><br class=""> that should fix things, and doing so would be a useful test for me.<br class=""><br class=""><br class="">Unfortunately, since the dnsmasq binary I use is part of a router, I<br class="">have no way to use another version. Which, as I realize now, will be a<br class="">major problem anyway since the issue is not a matter of configuration.<br class=""> <br class=""></blockquote><br class="">This is a major defect in the state of the world. Routers should be<br class="">updated as often and as easily as desktops and laptops, but frequently<br class="">aren't and can't be.<br class=""><br class="">Cheers,<br class=""><br class="">Simon.<br class=""><br class=""><br class="">_______________________________________________<br class="">Dnsmasq-discuss mailing list<br class=""><a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk" class="">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br class="">https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss<br class=""></div></div></blockquote><br class=""></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">UI updates the EdgeRouter firmware quite often, but on the EdgeMAX line of devices they tend to be more conservative about updating the underlying components (due to being billed as carrier grade devices). e.g. they released </span><span style="color: rgb(0, 0, 0); caret-color: rgb(0, 0, 0); white-space: pre-wrap;" class="">v2.0.9-hotfix.2 in June and back ported the fixes for DNSMasq for </span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); white-space: pre-wrap;" class="">CVE-2021-3448.</span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); white-space: pre-wrap;" class=""><br class=""></span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); white-space: pre-wrap;" class="">UI is much more aggressive on the UniFi (consumer) </span><font color="#000000" class=""><span style="white-space: pre-wrap;" class="">side of the house, they’ve upgraded dnsmasq in their firmware much more often and usually to the latest version available (latest firmware on the UDM platform run 2.85).</span></font></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); white-space: pre-wrap;" class=""><br class=""></span></div><div><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0); white-space: pre-wrap;" class="">Just depends on their update strategy for the underlying components. Same with operating systems like RHEL, they tend to favor back porting security fixes to a specific version instead of upgrading to a whole new release of the component.</span></font></div></body></html>