Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pfBlockerNG: Fix empty response for blacklists #1304

Conversation

andrebrait
Copy link

  • Fix empty responses for multiple query types for blacklisted domains
  • Reused cached result for logging, remove unnecessary parameters
  • Add universal exception logger for external Unbound functions
  • Fixes Redmine issue #14853

Some of the improvements above are either non-intrusive or were useful to diagnose the issue in the first place, so I decided to keep them.

Ticket description copied below for clarity:


In Python mode, when a domain is blacklisted, the result gets cached in the dnsblDB dictionary for caching and faster retrieval in future requests.

If found there, the response is assembled from the stored data. Currently, that includes the IP address included in the response.

That works ok if the first query comes for an a given record type, and that one gets repeated, but it results in an empty response if the recorded IP address is incompatible with the expected response (e.g. the cached result for an A record will contain 10.10.10.1, but the current query is for an AAAA record, thus failing to respond with the proper AAAA address, or vice-versa if the AAAA record is queried first.

Steps to reproduce:

  1. Switch to Python mode with DNSBL Blocking turned ON
  2. Add a domain to the blacklist through the Feeds
  3. Query the AAAA (or A) record for that domain. It should contain a valid IP address.
  4. Query the A (or AAAA, if the first one was A) record for that domain
  5. The last response will contain no IP address

In order to test it the other way around, just restart the DNS Resolver service or Update DNSBL again.

Example:

$ dig AAAA www.top-daily-profit.com

; <<>> DiG 9.17.15 <<>> AAAA www.top-daily-profit.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35220
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1432
;; QUESTION SECTION:
;www.top-daily-profit.com.      IN      AAAA

;; ANSWER SECTION:
www.top-daily-profit.com. 60    IN      AAAA    ::10.10.10.1

;; Query time: 27 msec
;; SERVER: 10.0.0.1#53(10.0.0.1) (UDP)
;; WHEN: Sat Oct 07 21:23:58 Romance Summer Time 2023
;; MSG SIZE  rcvd: 81


$ dig A www.top-daily-profit.com

; <<>> DiG 9.17.15 <<>> A www.top-daily-profit.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 9356
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1432
;; QUESTION SECTION:
;www.top-daily-profit.com.      IN      A

;; Query time: 11 msec
;; SERVER: 10.0.0.1#53(10.0.0.1) (UDP)
;; WHEN: Sat Oct 07 21:24:02 Romance Summer Time 2023
;; MSG SIZE  rcvd: 53

@andrebrait andrebrait force-pushed the bugfix/pfBlockerNG-address-type-caching branch from 94bc40b to fa461ab Compare October 7, 2023 19:47
@andrebrait andrebrait force-pushed the bugfix/pfBlockerNG-address-type-caching branch 2 times, most recently from 1f9e724 to 3d1df33 Compare October 12, 2023 23:12
* Fix empty responses for multiple query types for blacklisted domains
* Reused cached result for logging, remove unnecessary parameters
* Add universal exception logger for external Unbound functions
* Fixes Redmine issue #14853
@andrebrait
Copy link
Author

Superseded by #1343

@andrebrait andrebrait closed this Feb 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant