[Dnsmasq-discuss] dnsmasq v2.87 --nftset and DNS reply race condition

[Simon Kelley]

On 05/02/2022 23:16, Alain Ducharme wrote:

> 
> Another problem appears to be software like apt doing SRV queries,
> effectively resolving CNAMES themselves.
> Can't see a fix for that...
> 
> $ apt uddate
> Err:1 http://deb.debian.org/debian bullseye InRelease
>    Could not connect to debian.map.fastlydns.net:80 (151.101.126.132). - connect (111: Connection refused) Unable to connect to deb.debian.org:http:
> Err:2 http://deb.debian.org/debian bullseye-updates InRelease
>    Unable to connect to deb.debian.org:http:
> 
> ...because query #3 is not in my nftset:
> 
> Feb  5 17:29:07 dnsmasq[8068]: 1 127.0.0.1/41766 query[SRV] _http._tcp.security.debian.org from 127.0.0.1
> Feb  5 17:29:07 dnsmasq[8068]: 1 127.0.0.1/41766 forwarded _http._tcp.security.debian.org to 192.168.1.1
> Feb  5 17:29:07 dnsmasq[8068]: 2 127.0.0.1/60606 query[SRV] _http._tcp.deb.debian.org from 127.0.0.1
> Feb  5 17:29:07 dnsmasq[8068]: 2 127.0.0.1/60606 forwarded _http._tcp.deb.debian.org to 192.168.1.1
> Feb  5 17:29:07 dnsmasq[8068]: 1 127.0.0.1/41766 reply _http._tcp.security.debian.org is <SRV>
> Feb  5 17:29:07 dnsmasq[8068]: 3 127.0.0.1/49100 query[A] debian.map.fastlydns.net from 127.0.0.1
> Feb  5 17:29:07 dnsmasq[8068]: 3 127.0.0.1/49100 forwarded debian.map.fastlydns.net to 192.168.1.1
> Feb  5 17:29:07 dnsmasq[8068]: 2 127.0.0.1/60606 reply _http._tcp.deb.debian.org is <SRV>
> Feb  5 17:29:07 dnsmasq[8068]: 4 127.0.0.1/52591 query[A] debian.map.fastlydns.net from 127.0.0.1
> Feb  5 17:29:07 dnsmasq[8068]: 3 127.0.0.1/49100 reply debian.map.fastlydns.net is 151.101.126.132
> Feb  5 17:29:07 dnsmasq[8068]: 4 127.0.0.1/52591 reply query is duplicate
> Feb  5 17:29:07 dnsmasq[8068]: 5 127.0.0.1/37265 query[A] security.debian.org from 127.0.0.1
> Feb  5 17:29:07 dnsmasq[8068]: 5 127.0.0.1/37265 forwarded security.debian.org to 192.168.1.1
> Feb  5 17:29:07 dnsmasq[8068]: 6 127.0.0.1/58615 query[A] deb.debian.org from 127.0.0.1
> Feb  5 17:29:07 dnsmasq[8068]: 6 127.0.0.1/58615 forwarded deb.debian.org to 192.168.1.1
> Feb  5 17:29:07 dnsmasq[8068]: 5 127.0.0.1/37265 nftset add 4 inet filter _apt_4 151.101.130.132 security.debian.org
> Feb  5 17:29:07 dnsmasq[8068]: 5 127.0.0.1/37265 reply security.debian.org is 151.101.130.132
> Feb  5 17:29:07 dnsmasq[8068]: 5 127.0.0.1/37265 nftset add 4 inet filter _apt_4 151.101.194.132 security.debian.org
> Feb  5 17:29:07 dnsmasq[8068]: 5 127.0.0.1/37265 reply security.debian.org is 151.101.194.132
> Feb  5 17:29:07 dnsmasq[8068]: 5 127.0.0.1/37265 nftset add 4 inet filter _apt_4 151.101.2.132 security.debian.org
> Feb  5 17:29:07 dnsmasq[8068]: 5 127.0.0.1/37265 reply security.debian.org is 151.101.2.132
> Feb  5 17:29:07 dnsmasq[8068]: 5 127.0.0.1/37265 nftset add 4 inet filter _apt_4 151.101.66.132 security.debian.org
> Feb  5 17:29:07 dnsmasq[8068]: 5 127.0.0.1/37265 reply security.debian.org is 151.101.66.132
> Feb  5 17:29:07 dnsmasq[8068]: 6 127.0.0.1/58615 reply deb.debian.org is <CNAME>
> Feb  5 17:29:07 dnsmasq[8068]: 6 127.0.0.1/58615 nftset add 4 inet filter _apt_4 151.101.126.132 deb.debian.org
> Feb  5 17:29:07 dnsmasq[8068]: 6 127.0.0.1/58615 reply debian.map.fastlydns.net is 151.101.126.132
> 

Note that we cache SRV records, so they are detected and decoded in 
extract_addresses() which is the function that calls add_to_nftset(). 
I'm not sure that helps though: the result of the SRV query is 
debian.map.fastlydns.net and I can't see a mechanism to  associate the 
debian.org SRV query with the subsequent A query.


Cheers,

Simon.



> Thanks for your time, much appreciated!
> 
> _______________________________________________
> Dnsmasq-discuss mailing list
> Dnsmasq-discuss at lists.thekelleys.org.uk
> https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss
>