<html><body><font face="times new roman, serif">Hello:</font><div><font face="times new roman, serif"><br></font></div><div dir="ltr"><font face="times new roman, serif">We use dnsmasq as a local caching resolver (binding to ::1) and are currently upgrading some systems to EL8 (Rocky Linux 8 specifically, which is a rebuild of Red Hat 8). We've noticed that a fairly significant fraction of name resolutions fail when `</font><code style="border:1px solid rgb(206,206,206);background-color:rgb(244,244,244);padding:0px 2px;border-radius:2px">option edns0</code><font face="times new roman, serif">` is enabled in /etc/resolv.conf and dnsmasq is being used; that is to say, when resolv.conf looks like</font></div><div dir="ltr"><font face="times new roman, serif"><br></font></div><div dir="ltr"><code style="border:1px solid rgb(206,206,206);background-color:rgb(244,244,244);padding:0px 2px;border-radius:2px">option edns0<br>nameserver ::1</code><br></div><div dir="ltr"><br></div><div dir="ltr"><font face="times new roman, serif">These failures manifest for queries issued very close to a TTL expiry (that is to say, if you request a name X with a TTL of 300 seconds, then wait 299.99 seconds, then request X again, it will fail about ½ of the time).</font></div><div dir="ltr"><font face="times new roman, serif"><br></font></div><div dir="ltr"><span style="font-family:"times new roman",serif">I've tried backporting dnsmasq 2.86, but it shows the same behavior.</span><font face="times new roman, serif"><br></font></div><div dir="ltr"><font face="times new roman, serif"><br></font></div><div dir="ltr"><font face="times new roman, serif">I used tcpdump to capture the actual request issued and the Wireshark protocol analyzer says that dnsmasq is emitting malformed DNS queries.</font></div><div dir="ltr"><font face="times new roman, serif"><br></font></div><div dir="ltr"><font face="times new roman, serif">The query from libc to dnsmasq looks correct and the "additional records" portion of the packet contains the following bytes:</font></div><div dir="ltr"><font face="times new roman, serif"><br></font></div><div dir="ltr"><font face="menlo, monospace">00 00 29 04 b0 00 00 00 00 00 00</font></div><div dir="ltr"><div style="font-family:"times new roman",serif"><br></div><div dir="ltr" style="font-family:"times new roman",serif">Based on my reading of EDNS0, this looks right (domain name is 0 bytes long and is the root domain; packet type is 0x29 == 41).</div><div dir="ltr" style="font-family:"times new roman",serif"><br></div><div dir="ltr" style="font-family:"times new roman",serif">However, on failed requests, the packet sent from dnsmasq to the upstream DNS server ends with the following "additional records" section:</div><div dir="ltr" style="font-family:"times new roman",serif"><br></div><div dir="ltr"><div dir="ltr"><font face="menlo, monospace">c0 0c 00 05 00 01 00 00 0c e4 00</font></div><div style="font-family:"times new roman",serif"><br></div></div></div><div dir="ltr"><font face="times new roman, serif">This looks like a compressed label, since it starts with 0xc...? Which doesn't make any sense to put in the OPT section?</font></div><div dir="ltr"><font face="times new roman, serif"><br></font></div><div dir="ltr"><font face="times new roman, serif">The rest of the query looks fine.</font></div><div dir="ltr"><font face="times new roman, serif"><br></font></div><div dir="ltr"><font face="times new roman, serif">Neither add-mac nor add-subnet is set, and edns-packet-max is set to 4096.</font></div><div dir="ltr"><font face="times new roman, serif"><br></font></div><div dir="ltr"><font face="times new roman, serif">If I turn off dnsmasq and send queries directly to the upstream nameserver, I don't ever see any of these "c00c" packets emitted, so I<span style="font-style:normal"> am pretty confident that these bad bytes are coming from dnsmasq itself.</span></font></div><div dir="ltr"><font face="times new roman, serif"><span style="font-style:normal"><br></span></font></div><div dir="ltr"><font face="times new roman, serif"><span style="font-style:normal">Has anyone ever seen anything like this? I'm glad to privately share pcaps if that would help.</span></font></div><div dir="ltr"><font face="times new roman, serif"><br></font></div><div dir="ltr"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><span style="font-family:times new roman,serif">James Brown</span></div><div dir="ltr"><div><span style="font-family:times new roman,serif">Infrastructure Architect</span></div></div></div></div></div></div></div></body></html>