[Dnsmasq-discuss] CNAME filtering

Mon Mar 22 18:07:27 UTC 2021

On Mon, 22 Mar 2021, Geert Stappers via Dnsmasq-discuss wrote:

> On Mon, Mar 22, 2021 at 03:19:00AM +0000, dnsmasqlist2021 at rscubed.com wrote:
>>
>> Hi,
>>
>> I am trying to do some CNAME filtering but it is not working for me...
>>
>> I'm picking a random domain that has cascading CNAMEs I am going to try to
>> filter for an example here.
>>
>> /etc/hosts
>> 127.0.0.1 blackhole.inv
>>
>> For my DNSMasq config I add (some of this may be redundant) the lines below
>> to kill dnsdelegation.io as an example :
>>
>> cname=*.dnsdelegation.io,blackhole.inv
>> cname=dnsdelegation.io,blackhole.inv
>> local=/.dnsdelegation.io/
>>
>> In theory one of the above should set dnsdelegation.io to 127.0.0.1
>>
>> a domain with cascading CNAMEs :
>>
>> jwxbwt.theaffordableartcompany.com.au
>>
>> ---
>>
>> When I do host I get :
>>
>> $ host jwxbwt.theaffordableartcompany.com.au
>> jwxbwt.theaffordableartcompany.com.au is an alias for dnsdelegation.io.
>> dnsdelegation.io is an alias for gum.criteo.com.
>> gum.criteo.com is an alias for gum.va1.vip.prod.criteo.com.
>> gum.va1.vip.prod.criteo.com has address 74.119.119.139
>>
>> ---
>>
>> In DNSMasq Logs I see :
>>
>> 1 - 192.168.1.3 == DNSMasq request
>> 2 - 192.168.1.7 == forwarded to Upstream DNS
>> 3 - Returned reponse containing 4 Replies in one DNS packet
>>
>> 1 - dnsmasq[26607]: 11 192.168.1.3/57917 query[A] jwxbwt.theaffordableartcompany.com.au from 192.168.1.3
>> 2 - dnsmasq[26607]: 11 192.168.1.3/57917 forwarded jwxbwt.theaffordableartcompany.com.au to 192.168.1.7
>> 3 - dnsmasq[26607]: 11 192.168.1.3/57917 reply jwxbwt.theaffordableartcompany.com.au is <CNAME>
>>     dnsmasq[26607]: 11 192.168.1.3/57917 reply dnsdelegation.io is <CNAME>
>>     dnsmasq[26607]: 11 192.168.1.3/57917 reply gum.criteo.com is <CNAME>
>>     dnsmasq[26607]: 11 192.168.1.3/57917 reply gum.va1.vip.prod.criteo.com is 74.119.119.139
>>
>> ---
>>
>> TCPDump shows upstream DNS returns all replies in 3 above in a single packet
>>
>> IP x.x.x.x.42759 > 192.168.1.7.53: 29157+ A? jwxbwt.theaffordableartcompany.com.au. (55)
>> IP 192.168.1.7.53 > x.x.x.x.42759: 29157 4/0/0 CNAME dnsdelegation.io., CNAME gum.criteo.com., CNAME gum.va1.vip.prod.criteo.com., A 74.119.119.139 (160)
>>
>> ---
>>
>> It looks like the filtering is being bypassed because multiple replies are
>> all within a response from the upstream server so dnsdelegation.io is not
>> seen and filtered ???
>>
>> Do I need to do something to get DNSMasq to apply the filters to the
>> responses from the upstream to filter them or is this not currently possible
>> ?
>>
>> I expect if regular companies are doing what we see above the next
>> generation of malicious domains will be using this technique also so we want
>> to get the jump on them and have methods to defend against them in place.
>>
>> thanks
>>
>> Matt
>>
>
> I wonder if option
>
>       -h, --no-hosts
>              Don't read the hostnames in /etc/hosts.
>
>
> is maybe active.
>
>
> And the
>> cname=*.dnsdelegation.io,blackhole.inv
>> cname=dnsdelegation.io,blackhole.inv
>> local=/.dnsdelegation.io/
> looks odd.  Expiriment with removing the `local=` line.
>
>
> Karma points for reporting back.
>
>
> Groeten
> Geert Stappers
>
>
> P.S.
> I would have "CNAME filtering" named "CNAME intercepting"
> -- 
> Silence is hard to parse
>
> _______________________________________________
> Dnsmasq-discuss mailing list
> Dnsmasq-discuss at lists.thekelleys.org.uk
> https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss
>

If I use www.bestbuy.com as an example I see

8683 192.168.1.3/34112 query[AAAA] www.bestbuy.com from 192.168.1.3
8683 192.168.1.3/34112 forwarded www.bestbuy.com to 192.168.1.7
8682 192.168.1.3/34112 reply www.bestbuy.com is <CNAME>
8682 192.168.1.3/34112 reply www.bestbuy.com.edgekey.net is <CNAME>
8682 192.168.1.3/34112 reply e5816.x.akamaiedge.net is 184.24.144.179

the cname wildcard was added in version 2.77 according to changelog
If I add a wildcard cname I see no change in response it still resolves :

cname=*.bestbuy.com,blackhole.inv

If I use the direct name www.bestbuy.com

cname=www.bestbuy.com,blackhole.inv

then it works and I get :
$ host www.bestbuy.com
www.bestbuy.com is an alias for blackhole.inv.
blackhole.inv has address 127.0.0.1

But for this example what I want is to make this replied cname 
www.bestbuy.com.edgekey.net goto blackhole.inv and neither the desired wildcard 
version or the full name work. www.bestbuy.com still resolves.

Tried these variations of what is in the replies to www.bestbuy.com

cname=*.edgekey.net,blackhole.inv

cname=www.bestbuy.com.edgekey.net,blackhole.inv

cname=e5816.x.akamaiedge.net,blackhole.inv

cname=*.akamaiedge.net,blackhole.inv

I also tried adding edgekey.net to /etc/hosts and doing
cname=*.edgekey.net,edgekey.net
But this also had not affect on www.bestbuy.com resolving/

I'm guessing because these are all in replies that are not looked at ???

Matt