-
-
Notifications
You must be signed in to change notification settings - Fork 346
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Intermittent DNS blocking failure with local-zone and always_nxdomain #1059
Comments
What is the type of the local-zone (tiktok.com in this example)? Also, as a sanity check, is it listed on blocklists-local-zone.txt and unbound-control list_local_zones? |
Type of local-zone is always_nxdomain. Yes it is in the file blocklists-local-zone.txt And also in the 'unbound-control list_local_zones' |
Is www.tiktok.com. maybe part of the above outputs? |
www.tiktok.com is not part of the above outputs during the issue, only when I am using the work around. dig output as requested, which is also the same name server. dig www.tiktok.com ; <<>> DiG 9.16.48 <<>> www.tiktok.com ;; OPT PSEUDOSECTION: ;; ANSWER SECTION: ;; Query time: 0 msec |
Is Unbound listening on 127.0.0.1@53 or are you hitting something in front of Unbound? |
Unbound is on 127.0.0.1@53, talking to it directly. |
That is weird then. Between you deleting and reinserting local zone data, there is a window where all domains are allowed through and that's how www.tiktok.com could sneak in the cache. But after you reload the blocklist zone data, local zones lookup is before the cache lookup and the NXDOMAIN response would come right there before reaching the cache. Are there any other *.tiktok.com. subdomains maybe in the blocklist?
just to be sure? |
unbound-control list_local_zones | grep tiktok |
I guess |
Sorry about that, yes, I added www.tiktok.com to block it again, I will leave it out while troubleshooting with you. |
I believe I can reproduce. I suppose you have |
Correct. server: |
OK, that seems to be the problem but I need to see why. With |
Hi @TheteSigma, I have identified the problem and already working on a solution. But the weird part is that I can only reproduce when One last step if you could try to see that we are reproducing the same issue: when the issue happens, do you get different answers if you keep quering Unbound? Alternating between the expected NXDOMAIN and the resolved result? |
Hi @gthess , Yes, I double checked it is compiled with pthreads, running on Quad i5 Also I can run multiple dig or host queries and consistently get the resolved result. |
Then it seems I identified and I am solving a different issue :) |
I removed all the local-zone that were always_nxdomain and loaded just tiktok.com from file using. dig www.tiktok.com ; <<>> DiG 9.16.48 <<>> www.tiktok.com ;; OPT PSEUDOSECTION: ;; Query time: 0 msec So it works for single entry, maybe it has to do with the size of the list being loaded. |
Can you reproduce with your normal long list and num-threads: 1? |
I changed num-threads to 1, restarted unbound, then cleared and reloaded block list. dig www.tiktok.com ; <<>> DiG 9.16.48 <<>> www.tiktok.com ;; OPT PSEUDOSECTION: ;; ANSWER SECTION: ;; Query time: 169 msec |
Could you share your unbound configuration and the block list? You can also email them to me if you want |
Thanks for the files, I can reproduce the issue. There seems to be a difference when creating the local-zones between configuration and the unbound-control command. I am looking further into it. Can I suggest as a workaround for now to update the included Btw thanks for unintentionally pointing to another issue (not helping in your case) that is now fixed; #1069 :) |
always_nxdomain. Addition of local_zones dynamically via unbound-control was not finding the zone's parent correctly.
Found this problem in the end; the above PR solves that. When unbound-control was used to enter local zones dynamically a different approach to calculate the parent was used and it wasn't completely correct. |
Thanks for digging in and finding the issue. |
- Fix #1059: Intermittent DNS blocking failure with local-zone and always_nxdomain. Addition of local_zones dynamically via unbound-control was not finding the zone's parent correctly.
- Fix #1059: Intermittent DNS blocking failure with local-zone and always_nxdomain. Addition of local_zones dynamically via unbound-control was not finding the zone's parent correctly.
* nlnet/master: (35 commits) - Add unit test for validation of repeated use of a DNAME record. - Fix validation for repeated use of a DNAME record. - Fix typos for 'the the' in text. - Fix memory leak in setup of dsa sig. - Skip unbound-dnstap-socket unit test when not compiled with --enable-debug. - Fix to squelch connection reset by peer errors from log. And fix that the tcp read errors are labeled as initial for the first calls. - Fix memory leak on exit for unbound-dnstap-socket; creates false negatives during testing. - Fix memory leak when reload_keep_cache is used and num-threads changes. - Enable AddressSanitizer error detection in tdir tests. - Fix for NLnetLabs#1079: fix RPZ taglist in iterator callback that no client info is like no taglist intersection. - Fix NLnetLabs#1079: tags from tagged rpz zones are no longer honored after upgrade from 1.19.3 to 1.20.0. Changelog note for NLnetLabs#1078. - Merge NLnetLabs#1078: Only check old pid if no username. Only check old pid if no username - Update patch to remove 'command' shell builtin and update error text. unbound-control-setup: check openssl - Fix unused variable warning on compilation with no thread support. - Fix spelling of tcp-idle-timeout docs, from Michael Tokarev. - Fix to enable that SERVFAIL is cached, for a short period, for more cases. In the cases where limits are exceeded. Changelog entry for NLnetLabs#1059: - Fix NLnetLabs#1059: Intermittent DNS blocking failure with local-zone and always_nxdomain. Addition of local_zones dynamically via unbound-control was not finding the zone's parent correctly. Proper parent identification for dynamically entered local zones (NLnetLabs#1076) ...
Bug when blocking tiktok.com, sometimes www.tiktok.com resolves and other times it does not.
Updating the block list, first remove existing block list.
unbound-control list_local_zones | grep -E 'always_(null|nx)' | awk '{print $1}' > unbound-local-zones.txt
unbound-control local_zones_remove < unbound-local-zones.txt
Then load updated block list:
unbound-control local_zones < blocklists-local-zone.txt
This command should produce this:
host www.tiktok.com
Host www.tiktok.com not found: 3(NXDOMAIN)
instead I get this:
host www.tiktok.com
www.tiktok.com is an alias for www.tiktok.com.edgesuite.net.
www.tiktok.com.edgesuite.net is an alias for a2047.api10.akamai.net.
a2047.api10.akamai.net has address 23.47.52.146
a2047.api10.akamai.net has address 23.47.52.148
a2047.api10.akamai.net has address 23.47.52.147
a2047.api10.akamai.net has address 23.47.52.145
a2047.api10.akamai.net has address 23.47.52.141
a2047.api10.akamai.net has address 23.47.52.142
a2047.api10.akamai.net has address 23.47.52.149
a2047.api10.akamai.net has address 23.47.52.140
a2047.api10.akamai.net has address 23.47.52.143
Work arounds, restarting unbound which loads local-zone blocks or
adding www.tiktok.com to the blocklist.
System
Unbound 1.19.1
Gentoo Linux
Version 1.19.1
Configure line: --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --datarootdir=/usr/share --disable-static --docdir=/usr/share/doc/unbound-1.19.1 --htmldir=/usr/share/doc/unbound-1.19.1/html --with-sysroot=/ --libdir=/usr/lib64 --disable-debug --disable-gost --disable-dnscrypt --disable-dnstap --enable-ecdsa --disable-subnet --enable-cachedb --disable-static --disable-systemd --without-pythonmodule --without-pyunbound --with-pthreads --with-libnghttp2 --enable-tfo-client --enable-tfo-server --disable-flto --disable-rpath --enable-event-api --enable-ipsecmod --with-libevent=/usr --with-libhiredis=/usr --with-pidfile=/run/unbound.pid --with-rootkey-file=/etc/dnssec/root-anchors.txt --with-ssl=/usr --with-libexpat=/usr
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.0.13 30 Jan 2024
Linked modules: dns64 cachedb ipsecmod respip validator iterator
TCP Fastopen feature available
BSD licensed, see LICENSE in source package for details.
Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues
The text was updated successfully, but these errors were encountered: