Join GitHub today
GitHub is home to over 31 million developers working together to host and review code, manage projects, and build software together.Sign up
TXT query with no question causing exception in JSON stat API. #6924
We have recently started receiving an odd DNS request that causes the PowerDNS Recursor JSON stat HTTP API to throw an exception.
Here are the bytes of the DNS query that we are receiving (application layer only). It is ostensibly coming from some Fortinet security product.
Here is an image of the Wireshark details of the request, which may be easier to read.
While this query is in the ring buffer, calls to the JSON API can result in an internal server error:
Looking at the
For the record, the error is raised here in the source code.
Steps to reproduce
I have been using the following Python script to reproduce the DNS query. You must
import udp import socket udp_packet = udp.Packet() udp_packet.sport = 1024; udp_packet.dport = 53; udp_packet.data = '\xa9\xe9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x14\x73\x65\x63\x75\x72\x65\x2d\x64\x6e\x73\x2d\x76\x65\x72\x73\x69\x6f\x6e\x2d\x31\x08\x66\x6f\x72\x74\x69\x6e\x65\x74\x03\x63\x6f\x6d\x00\x00\x10\x00\x01\x00\x00\x00\x00\x00\x35\x34\x46\x42\x36\x34\x30\x51\x6c\x5a\x66\x78\x41\x42\x52\x6b\x64\x55\x4e\x6a\x42\x46\x4e\x46\x45\x78\x4e\x6a\x41\x32\x4d\x54\x4d\x7a\x4e\x41\x41\x48\x41\x41\x51\x41\x41\x41\x41\x49\x41\x41\x45\x41\x41\x67\x42\x34' packet = udp.assemble(udp_packet, 0) sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_UDP) print sock.sendto(packet, ("127.0.0.1", 0))
The script will issue the DNS query in question to
And you will find the cause of the internal server error in
Ideally there would be no exception thrown. Perhaps the 'unset DNS name' gets represented as an empty string. Although that could cause some ambiguity.
Perhaps PowerDNS should respond to this query with
We noticed that this exception was also being raised by our custom
local domain = dq.qname:toStringNoDot()
Which would raise the
local domain = '' if dq.qname:wirelength() > 0 then domain = dq.qname:toStringNoDot() end
I was curious to see how PowerDNS actually responds to the query, so I compared the response from my local Recursor to the response from Google's DNS at
My local Recursor gave a response with flags indicating a server failure, which you can see in this screenshot of the Wireshark details of the response
Google DNS gave a response with flags indicating a format error in the query, which you can see in this screenshot of the Wireshark details of the response.
There are probably a few places that could use
A quick check shows