<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 06/01/2021 18:33, Darac Marjal via
dnsdist wrote:<br>
</div>
<blockquote type="cite"
cite="mid:3447be4b-f23e-4427-256e-6ff949f4d317@darac.org.uk">
<pre class="moz-quote-pre" wrap="">
On 06/01/2021 16:43, Remi Gacogne via dnsdist wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Hi Darac,
On 1/6/21 5:35 PM, Darac Marjal via dnsdist wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Watching messages on the webserver, I can see that the "DNSOpcode.Update
-> auth" rule is applied, but then the number of "Drops" on the auth
server increments. On the pdns webmonitor "Remote hosts sending corrupt
packets" also increments. After a few seconds, the nsupdate times out.
Can anyone spot something I've done wrong, or suggest how I can go about
debugging this further (I can't seem to figure out, for example, why
pdns thinks the packet is corrupt).
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
This indeed suggests that dnsdist might be corrupting the packet
somehow, perhaps by adding the EDNS Client Subnet payload. Is there
any chance you could have a look at the packet sent from dnsdist to
the Authoritative Server, using for example tcpdump?
I am not aware of any issue of that type in 1.5.1 but we have had bugs
in that area before, so perhaps one remains?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
It looks like it might be something EDNS related. I can see, in
Wireshark, that the update is forwarded on with additional records. I've
attached a PCAP showing the update coming it and being forwarded on.</pre>
</blockquote>
<p><br>
</p>
<p>And, if I turn off useClientSubnet in the server definition, it
works again. Looks like I need to do a bit more reading up about
EDNS, then. Thanks for the hint :)<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:3447be4b-f23e-4427-256e-6ff949f4d317@darac.org.uk">
<pre class="moz-quote-pre" wrap="">
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">
Best regards,
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
dnsdist mailing list
<a class="moz-txt-link-abbreviated" href="mailto:dnsdist@mailman.powerdns.com">dnsdist@mailman.powerdns.com</a>
<a class="moz-txt-link-freetext" href="https://mailman.powerdns.com/mailman/listinfo/dnsdist">https://mailman.powerdns.com/mailman/listinfo/dnsdist</a>
</pre>
</blockquote>
</blockquote>
</body>
</html>