<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>I Confirm it is broken, even in v2.87test4 release.<br>
</p>
<p>The wrong use case is special domain, which provides internal VPN
only name for kerberos.<br>
</p>
<p>It seems it forwards correctly to domain-specific forwarder. But
during that the case of original query is lowered, according to
log-queries. Then response is truncated from domain-specific
forwarder.</p>
<p>Interesting enough query is then forwarded to resolvers without a
domain. This time response is accepted. But because it was a VPN
forwarding site-specific domain to internal-only servers, it only
responds with NXDOMAIN.</p>
<p>This bug was reported in our bugzilla too [1]. Found it happens
because our VPN has quite long list of SRV records for kerberos.
So much it makes truncated reply and re-requests it via TCP.
However TCP is for some reason a bit different.<br>
</p>
<p>There is one important issue:</p>
<p>a) query search does not end on domain-specific resolvers, but
continues to general resolvers without domain.</p>
<p>One less important issue too:</p>
<p>b) response does not keep original case of the query</p>
<pre class="bz_comment_text" id="comment_text_9">Found simple way to reproduce it:
dnsmasq -d --conf-file=/dev/null --port 2053 --server=127.0.0.1 --no-resolv --server='/test/::1' --log-queries &
dig +tcp @localhost -p 2053 srv _tcp.TEST
dig @localhost -p 2053 srv _udp.TEST
Results in log:
dnsmasq: started, version 2.87test4-11-g80fae3c cachesize 150
dnsmasq: compile time options: IPv6 GNU-getopt DBus no-UBus no-i18n IDN2 DHCP DHCPv6 no-Lua TFTP no-conntrack ipset no-nftset auth cryptohash DNSSEC loop-detect inotify dumpfile
dnsmasq: using nameserver 127.0.0.1#53
dnsmasq: using nameserver ::1#53 for domain test
dnsmasq: read /etc/hosts - 16 addresses
dnsmasq: query[SRV] _udp.TEST from ::1
dnsmasq: forwarded _udp.test to ::1
dnsmasq: reply _udp.TEST is NXDOMAIN
dnsmasq: query[SRV] _tcp.TEST from ::1
dnsmasq: forwarded _tcp.TEST to ::1
dnsmasq: reply _tcp.TEST is NXDOMAIN
Note forwarded name differs in case, UDP is forwarded lowercase. But TCP query is forwarded as received without modified case. It then requires case insensitive comparison strcasecmp in order() function in domain-match.c, where strcmp is used now.
Without a patch, previous version would forward it to 127.0.0.1.
It seems strange to lowercase forwarded UDP queries. I think they should remain as received on client.
If there is a good reason for it, it should be applied to TCP queries similar way.
Proposed change attached. Though I remember code in dnsmasq mentions it does not like changes in
locale and does case comparison custom way in few places. Would it make issues here?
I guess it would be safe for all encodings containing ASCII subset. Are other encodings still in use?
Cheers,
Petr
</pre>
<p>1. <a class="moz-txt-link-freetext" href="https://bugzilla.redhat.com/show_bug.cgi?id=2014019">https://bugzilla.redhat.com/show_bug.cgi?id=2014019</a><br>
</p>
<div class="moz-cite-prefix">On 10/13/21 21:58, Aleksandar
Kostadinov wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAH9M6r+0NUMvFjr=M-r_e-N1VT5XETYBVz1F7AKwWKo045FwMQ@mail.gmail.com">
<pre class="moz-quote-pre" wrap="">Hi,
I observe a very strange occasion in a split dns setup. It seems like
between 2.85 and 2.86 the match for domain name became case sensitive
or something. After upgrade to 2.86 I still see in log:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">using nameserver 10.8.5.26#53 for domain example.com
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
then this DNS query returns no results:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">dig srv _kerberos._tcp.EXAMPLE.COM
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
But these two queries return proper results:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">dig srv _kerberos._tcp.example.com
dig srv _kerberos._tcp.EXAMPLE.COM @10.8.5.26
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
With 2.85 all queries are returning the records.
Any idea what's going on?
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Petr Menšík
Software Engineer
Red Hat, <a class="moz-txt-link-freetext" href="http://www.redhat.com/">http://www.redhat.com/</a>
email: <a class="moz-txt-link-abbreviated" href="mailto:pemensik@redhat.com">pemensik@redhat.com</a>
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB</pre>
</body>
</html>