Hi Remy, thanks a lot! As always, fast and efficient. Yes you're right, I forgot to mention that qdcount is 0 also.
I'll open a request and by now will try to manage it using iptables. Saludos! nico On Thu, Nov 16, 2023 at 9:10 AM Remi Gacogne via dnsdist < dnsdist@mailman.powerdns.com> wrote: > Hi, > > On 16/11/2023 04:37, Nicolas Baumgarten via dnsdist wrote: > > Queries with opcode 1 (DNSOpcode.IQuery) are being ignored (droped?) on > 1.4 > > But 1.6.1 answers NOT implemented. > > My guess is that these queries have a query records count (qdcount) of 0 > and you are seeing the effect of [1], implemented in 1.6.0-alpha1, > because it was needed to conform to rfc8906's tests. > > > We don't know which is the reason for this queries, but in the not > > implemented scenario these queries are retried for a couple of minutes, > > hundreds or thousands per second by some devices. > > That's awful, and of course the device should be fixed, but > unfortunately not unheard of. > > > Trying to stop this, we created a rule to drop them but it's not > working: > > addAction(OpcodeRule(DNSOpcode.IQuery),DropAction()) > > the same with opcode Query works. > > > > # Name Matches Rule > > Action > > 0 0 opcode==1 > > no op > > 1 191722 opcode==0 > > no op > > > > There is some preprocessing before the rules which answers not > implemented? > > Correct, this check occurs very early, if only because several rules > assume that all queries have a qname which is not true when qdcount == 0. > > There is any option to solve this? If not, we will try with iptables. > > Not at the moment, no. We could make the qdcount==0 behaviour > configurable, to allow dropping or sending a custom response code > (Refused? No Error?) instead of Not Implemented. Opening a feature > request would go a long way to make it happen :) > > [1]: https://github.com/PowerDNS/pdns/pull/9991 > > Best regards, > -- > Remi Gacogne > PowerDNS.COM BV - https://www.powerdns.com/ > > _______________________________________________ > dnsdist mailing list > dnsdist@mailman.powerdns.com > https://mailman.powerdns.com/mailman/listinfo/dnsdist >
_______________________________________________ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist
