<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Can you share any of such recorded packets? The existing pcap
file would be useful. isc.org is example of signed name with
TTL=300. If you have names you don't want to share publicly only,
please send them to me. I am RHEL maintainer, but haven't noticed
a behaviour you are describing. It sounds like worth
investigation. I doubt any state of TTL should make requests
different.<br>
</p>
<p>Do I understand it correctly you have enabled a dnssec
validation? If you see those on RHEL derivative, consider please
filling a bug on bugzilla.redhat.com. Even if not using rhel
directly, it should be fixed there.</p>
<p>Have you tried a CentOS 9 version also?<br>
</p>
<div class="moz-cite-prefix">On 08. 07. 22 19:17, James Brown via
Dnsmasq-discuss wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CALgeuKwOiSCkqgY4cjhxaf10iBWe8KhZa=ufHWyCNxaY6iap9A@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<font face="times new roman, serif">Hello:</font>
<div><font face="times new roman, serif"><br>
</font></div>
<div dir="ltr"><font face="times new roman, serif">We use dnsmasq
as a local caching resolver (binding to ::1) and are currently
upgrading some systems to EL8 (Rocky Linux 8 specifically,
which is a rebuild of Red Hat 8). We've noticed that a fairly
significant fraction of name resolutions fail when `</font><code
style="border:1px solid
rgb(206,206,206);background-color:rgb(244,244,244);padding:0px
2px;border-radius:2px">option edns0</code><font face="times
new roman, serif">` is enabled in /etc/resolv.conf and dnsmasq
is being used; that is to say, when resolv.conf looks like</font></div>
<div dir="ltr"><font face="times new roman, serif"><br>
</font></div>
<div dir="ltr"><code style="border:1px solid
rgb(206,206,206);background-color:rgb(244,244,244);padding:0px
2px;border-radius:2px">option edns0<br>
nameserver ::1</code><br>
</div>
<div dir="ltr"><br>
</div>
<div dir="ltr"><font face="times new roman, serif">These failures
manifest for queries issued very close to a TTL expiry (that
is to say, if you request a name X with a TTL of 300 seconds,
then wait 299.99 seconds, then request X again, it will fail
about ½ of the time).</font></div>
<div dir="ltr"><font face="times new roman, serif"><br>
</font></div>
<div dir="ltr"><span style="font-family:"times new
roman",serif">I've tried backporting dnsmasq 2.86, but it
shows the same behavior.</span><font face="times new roman,
serif"><br>
</font></div>
<div dir="ltr"><font face="times new roman, serif"><br>
</font></div>
<div dir="ltr"><font face="times new roman, serif">I used tcpdump
to capture the actual request issued and the Wireshark
protocol analyzer says that dnsmasq is emitting malformed DNS
queries.</font></div>
<div dir="ltr"><font face="times new roman, serif"><br>
</font></div>
<div dir="ltr"><font face="times new roman, serif">The query from
libc to dnsmasq looks correct and the "additional records"
portion of the packet contains the following bytes:</font></div>
<div dir="ltr"><font face="times new roman, serif"><br>
</font></div>
<div dir="ltr"><font face="menlo, monospace">00 00 29 04 b0 00 00
00 00 00 00</font></div>
<div dir="ltr">
<div style="font-family:"times new roman",serif"><br>
</div>
<div dir="ltr" style="font-family:"times new
roman",serif">Based on my reading of EDNS0, this looks
right (domain name is 0 bytes long and is the root domain;
packet type is 0x29 == 41).</div>
<div dir="ltr" style="font-family:"times new
roman",serif"><br>
</div>
<div dir="ltr" style="font-family:"times new
roman",serif">However, on failed requests, the packet
sent from dnsmasq to the upstream DNS server ends with the
following "additional records" section:</div>
<div dir="ltr" style="font-family:"times new
roman",serif"><br>
</div>
<div dir="ltr">
<div dir="ltr"><font face="menlo, monospace">c0 0c 00 05 00 01
00 00 0c e4 00</font></div>
<div style="font-family:"times new roman",serif"><br>
</div>
</div>
</div>
<div dir="ltr"><font face="times new roman, serif">This looks like
a compressed label, since it starts with 0xc...? Which doesn't
make any sense to put in the OPT section?</font></div>
<div dir="ltr"><font face="times new roman, serif"><br>
</font></div>
<div dir="ltr"><font face="times new roman, serif">The rest of the
query looks fine.</font></div>
<div dir="ltr"><font face="times new roman, serif"><br>
</font></div>
<div dir="ltr"><font face="times new roman, serif">Neither add-mac
nor add-subnet is set, and edns-packet-max is set to 4096.</font></div>
<div dir="ltr"><font face="times new roman, serif"><br>
</font></div>
<div dir="ltr"><font face="times new roman, serif">If I turn off
dnsmasq and send queries directly to the upstream nameserver,
I don't ever see any of these "c00c" packets emitted, so I<span
style="font-style:normal"> am pretty confident that these
bad bytes are coming from dnsmasq itself.</span></font></div>
<div dir="ltr"><font face="times new roman, serif"><span
style="font-style:normal"><br>
</span></font></div>
<div dir="ltr"><font face="times new roman, serif"><span
style="font-style:normal">Has anyone ever seen anything like
this? I'm glad to privately share pcaps if that would help.</span></font></div>
<div dir="ltr"><font face="times new roman, serif"><br>
</font></div>
<div dir="ltr">
<div>
<div class="gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr"><span style="font-family:times new
roman,serif">James Brown</span></div>
<div dir="ltr">
<div><span style="font-family:times new roman,serif">Infrastructure
Architect</span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Dnsmasq-discuss mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk">Dnsmasq-discuss@lists.thekelleys.org.uk</a>
<a class="moz-txt-link-freetext" href="https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss">https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss</a>
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Petr Menšík
Software Engineer, RHEL
Red Hat, <a class="moz-txt-link-freetext" href="http://www.redhat.com/">http://www.redhat.com/</a>
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB</pre>
</body>
</html>