pfBlockerNG: Fix empty response for blacklists #1304
Closed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Some of the improvements above are either non-intrusive or were useful to diagnose the issue in the first place, so I decided to keep them.
Ticket description copied below for clarity:
In Python mode, when a domain is blacklisted, the result gets cached in the dnsblDB dictionary for caching and faster retrieval in future requests.
If found there, the response is assembled from the stored data. Currently, that includes the IP address included in the response.
That works ok if the first query comes for an a given record type, and that one gets repeated, but it results in an empty response if the recorded IP address is incompatible with the expected response (e.g. the cached result for an A record will contain 10.10.10.1, but the current query is for an AAAA record, thus failing to respond with the proper AAAA address, or vice-versa if the AAAA record is queried first.
Steps to reproduce:
In order to test it the other way around, just restart the DNS Resolver service or Update DNSBL again.
Example: