Hey Simon,

during our automated CI testing, we discovered two regressions of the recent TCP buffer use optimization: https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=729c16a8ace49d472bc29cc37f87ca39ade920b6

The first one may be reproduced easily in the following way:

1. Start dnsmasq like:

dnsmasq -d --log-queries=proto --server=127.0.0.1#5000 --no-resolv

Note that the configured server does intentionally NOT exist.

2. Initiate a zone transfer to produce a non-query (an exemplary python script doing this is attached)

3. See the following log lines:

dnsmasq: TCP 1 127.0.0.1/41420 non-query opcode 5 from 127.0.0.1
dnsmasq: TCP 1 127.0.0.1/41420 config error is REFUSED (EDE: network error)

We see an exception in the python script:

>>> dns.query.BadResponse: A DNS query response does not respond to the question asked.

The reason is that the reply ID is 0 instead of being the same as the request ID. You may also check recording.pcap handy to see the effect.

I also found another, related issue when running the same script this time with an existing upstream server. We get the following log lines:

dnsmasq: TCP 1 127.0.0.1/36338 non-query opcode 5 from 127.0.0.1
dnsmasq: TCP 1 127.0.0.1/36338 forwarded example.com to 127.0.0.1#5555
dnsmasq: TCP 1 127.0.0.1/36338 reply error is not implemented

We get again the python exception. This time, we observe that the ID is correct, however, while query has opcode 5 (update), the reply has opcode 0 (query), which obviously doesn't match. Looking into recording2.pcap, we see that it is actually the upstream server which is changing the opcode and dnsmasq just passing this along. Previous versions of dnsmasq (pre-v2.93test2 to be precise) did not bother forwarding such non-queries at all and replied with the same opcode . I think this behavior should be restored.

Best,
Dominik

#!/bin/python3
# Pi-hole: A black hole for Internet advertisements
# (c) 2023 Pi-hole, LLC (https://pi-hole.net)
# Network-wide ad blocking via your own hardware.
#
# FTL Engine - auxiliary files
# Send a dynamic update to the DNS server to update the a zone
#
# This file is copyright under the latest version of the EUPL.
# Please see LICENSE file for your rights under this license.

import sys
import dns.query
import dns.update
import dns.rcode

# Usage: python3 zone_update.py [proto] [port] [server]

# Get the protocol, server, and port from command line arguments or use defaults
proto = sys.argv[1] if len(sys.argv) > 1 else 'tcp'
port = int(sys.argv[2]) if len(sys.argv) > 2 else 5300
server = sys.argv[3] if len(sys.argv) > 3 else '127.0.0.1'

# Create a new update object
update = dns.update.Update('example.com')

# Add a new A record
update.add('www.example.com', 300, 'A', server)

# Send the update to the DNS server and print the response
if proto == 'udp':
	response = dns.query.udp(update, server, port = port)
	print("UDP response: " + dns.rcode.to_text(response.rcode()))
elif proto == 'tcp':
	response = dns.query.tcp(update, server, port = port)
	print("TCP response: " + dns.rcode.to_text(response.rcode()))

recording2.pcap
Description: application/vnd.tcpdump.pcap

recording.pcap
Description: application/vnd.tcpdump.pcap

_______________________________________________
Dnsmasq-discuss mailing list
[email protected]
https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss