Bug #127182 for Net-DNS: Incorrect logic can cause DNS search to emit fruitless queries

Sun Sep 23 11:36:09 2018 krenair [...] gmail.com - Ticket created

Subject:

Strange behaviour in Net::DNS::Resolver->search around NOERROR results with no records

Allow me to prefix this by saying that I'm not a Perl programmer so apologise if I've screwed up terminology etc. After a bit of investigation in https://phabricator.wikimedia.org/T153468, I believe the following when Net::DNS::Resolver->search gets a NOERROR result with no records: * if there is no trailing full stop in the domain, it tries adding the search domain(s) to the end, leading to NXDOMAIN. * if there is a trailing full stop in the domain, it returns undef, when it should give a Net::DNS::Packet=HASH with an empty ->answer. Here's some examples. You should be able to get these records from labs-ns0.wikimedia.org while outside our network. krenair@deployment-deploy01:~$ perl -e "require Net::DNS; my \$resolver = new Net::DNS::Resolver; \$resolver->search('deployment-prometheus01.deployment-prep.eqiad.wmflabs', 'A'); print \$resolver->errorstring" NOERROR krenair@deployment-deploy01:~$ perl -e "require Net::DNS; my \$resolver = new Net::DNS::Resolver; \$resolver->search('deployment-prometheus01.deployment-prep.eqiad.wmflabs', 'AAAA'); print \$resolver->errorstring" NXDOMAIN krenair@deployment-deploy01:~$ perl -e "require Net::DNS; my \$resolver = new Net::DNS::Resolver(debug => 1); \$resolver->search('deployment-prometheus01.deployment-prep.eqiad.wmflabs', 'AAAA'); print \$resolver->errorstring" ;; search( deployment-prometheus01.deployment-prep.eqiad.wmflabs AAAA ) [...] ;; ra = 1 z = 0 ad = 0 cd = 0 rcode = NOERROR [...] ;; deployment-prometheus01.deployment-prep.eqiad.wmflabs. IN AAAA ;; ANSWER SECTION (0 records) [...] ;; search( deployment-prometheus01.deployment-prep.eqiad.wmflabs.deployment-prep.eqiad.wmflabs AAAA ) [...] ;; ra = 1 z = 0 ad = 0 cd = 0 rcode = NXDOMAIN [...] ;; deployment-prometheus01.deployment-prep.eqiad.wmflabs.deployment-prep.eqiad.wmflabs. IN AAAA [...] ;; search( deployment-prometheus01.deployment-prep.eqiad.wmflabs.eqiad.wmflabs AAAA ) [...] ;; ra = 1 z = 0 ad = 0 cd = 0 rcode = NXDOMAIN [...] ;; deployment-prometheus01.deployment-prep.eqiad.wmflabs.eqiad.wmflabs. IN AAAA [...] NXDOMAIN krenair@deployment-deploy01:~$ perl -e "require Net::DNS; my \$resolver = new Net::DNS::Resolver(); \$query = \$resolver->search('deployment-prometheus01.deployment-prep.eqiad.wmflabs.', 'A'); print \$query" Net::DNS::Packet=HASH(0x562dad5f1318) krenair@deployment-deploy01:~$ perl -e "require Net::DNS; my \$resolver = new Net::DNS::Resolver(); \$query = \$resolver->search('deployment-prometheus01.deployment-prep.eqiad.wmflabs.', 'AAAA'); print \$resolver->errorstring . \"\n\" . (\$query eq undef)" NOERROR 1 krenair@deployment-deploy01:~$ perl -e "require Net::DNS; my \$resolver = new Net::DNS::Resolver(debug => 1); \$query = \$resolver->search('deployment-prometheus01.deployment-prep.eqiad.wmflabs.', 'AAAA'); print \$resolver->errorstring . \"\n\" . (\$query eq undef)" ;; search( deployment-prometheus01.deployment-prep.eqiad.wmflabs. AAAA ) [...] ;; ra = 1 z = 0 ad = 0 cd = 0 rcode = NOERROR [...] ;; ANSWER SECTION (0 records) [...] NOERROR 1

Sun Sep 23 11:48:18 2018 krenair [...] gmail.com - Correspondence added

I should add: This is libnet-dns-perl 1.07-1 in Debian stretch. Perl v5.24.1.

Sun Sep 23 16:58:57 2018 rwfranks [...] acm.org - Correspondence added

On Sun Sep 23 11:36:09 2018, krenair@gmail.com wrote: Show quoted text

>8

Show quoted text

> ... I believe the following > when Net::DNS::Resolver->search gets a NOERROR result with no records: > * if there is no trailing full stop in the domain, it tries adding the > search domain(s) to the end, leading to NXDOMAIN. > * if there is a trailing full stop in the domain, it returns undef, > when it should give a Net::DNS::Packet=HASH with an empty ->answer.

$resolver->search() returns undef if the answer is empty. This, and the reason why, is explained in the following: <https://metacpan.org/pod/distribution/Net-DNS/lib/Net/DNS/FAQ.pod#Why-does-$resolver-%3Equery()-return-undef-when-the-answer-section-is-empty?> Show quoted text

> Here's some examples. You should be able to get these records from > labs-ns0.wikimedia.org while outside our network.

These are all repeatable using Net::DNS 1.07 and seem to work as expected.

Sun Sep 23 16:58:58 2018 The RT System itself - Status changed from 'new' to 'open'

Sun Sep 23 17:30:27 2018 krenair [...] gmail.com - Correspondence added

On Sun Sep 23 16:58:57 2018, rwfranks@acm.org wrote: Show quoted text

> On Sun Sep 23 11:36:09 2018, krenair@gmail.com wrote:

> > 8

>

> > ... I believe the following > > when Net::DNS::Resolver->search gets a NOERROR result with no > > records: > > * if there is no trailing full stop in the domain, it tries adding > > the > > search domain(s) to the end, leading to NXDOMAIN. > > * if there is a trailing full stop in the domain, it returns undef, > > when it should give a Net::DNS::Packet=HASH with an empty ->answer.

> > $resolver->search() returns undef if the answer is empty. > This, and the reason why, is explained in the following: > > <https://metacpan.org/pod/distribution/Net- > DNS/lib/Net/DNS/FAQ.pod#Why-does-$resolver-%3Equery()-return-undef- > when-the-answer-section-is-empty?>

Alright, so I should try to change the downstream software to be careful about this case? What about the addition of search domains when encountering a NOERROR result with an empty answer section? Is that really expected behaviour from Net::DNS?

Mon Sep 24 13:16:25 2018 rwfranks [...] acm.org - Correspondence added

On Sun Sep 23 17:30:27 2018, krenair@gmail.com wrote: Show quoted text

> Alright, so I should try to change the downstream software to be > careful about this case?

$res->query() and $res->search() return undef if no result is found, for whatever reason. This behaviour has not changed since day one (over 20 years ago) and is well documented. Show quoted text

> What about the addition of search domains when encountering a NOERROR > result with an empty answer section? Is that really expected behaviour > from Net::DNS?

Debatable, but has almost no bearing on the main issue above.

Sat Sep 29 07:20:43 2018 krenair [...] gmail.com - Correspondence added

On Mon Sep 24 13:16:25 2018, rwfranks@acm.org wrote: Show quoted text

> > What about the addition of search domains when encountering a NOERROR > > result with an empty answer section? Is that really expected > > behaviour > > from Net::DNS?

> > Debatable, but has almost no bearing on the main issue above.

Sure. Would you like me to open a separate ticket about that?

Fri Oct 05 16:15:25 2018 rwfranks [...] acm.org - Correspondence added

On Sat Sep 29 07:20:43 2018, krenair@gmail.com wrote: Show quoted text

> On Mon Sep 24 13:16:25 2018, rwfranks@acm.org wrote:

> > > What about the addition of search domains when encountering a NOERROR > > > result with an empty answer section? Is that really expected > > > behaviour > > > from Net::DNS?

> > > > Debatable, but has almost no bearing on the main issue above.

> > Sure. Would you like me to open a separate ticket about that?

Any debate needs to relate to 1.18, not 1.97.

Fri Oct 05 16:16:43 2018 rwfranks [...] acm.org - Correspondence added

On Fri Oct 05 16:15:25 2018, rwfranks@acm.org wrote: Show quoted text

> On Sat Sep 29 07:20:43 2018, krenair@gmail.com wrote:

> > On Mon Sep 24 13:16:25 2018, rwfranks@acm.org wrote:

> > > > What about the addition of search domains when encountering a NOERROR > > > > result with an empty answer section? Is that really expected > > > > behaviour > > > > from Net::DNS?

> > > > > > Debatable, but has almost no bearing on the main issue above.

> > > > Sure. Would you like me to open a separate ticket about that?

> > Any debate needs to relate to 1.18, not 1.97. >

1.07!

Sat Oct 06 08:24:15 2018 krenair [...] gmail.com - Correspondence added

On Fri Oct 05 16:16:43 2018, rwfranks@acm.org wrote: Show quoted text

> On Fri Oct 05 16:15:25 2018, rwfranks@acm.org wrote:

> > On Sat Sep 29 07:20:43 2018, krenair@gmail.com wrote:

> > > On Mon Sep 24 13:16:25 2018, rwfranks@acm.org wrote:

> > > > > What about the addition of search domains when encountering a > > > > > NOERROR > > > > > result with an empty answer section? Is that really expected > > > > > behaviour > > > > > from Net::DNS?

> > > > > > > > Debatable, but has almost no bearing on the main issue above.

> > > > > > Sure. Would you like me to open a separate ticket about that?

> > > > Any debate needs to relate to 1.18, not 1.97. > >

> > 1.07!

Sure, that was just the version that happened to be packaged for the (Debian stable) distribution I was using at the time. I've made a fresh VM, downloaded and installed Net::DNS 1.18 from net-dns.org, and reproduced the addition of search domains in response to empty-answer NOERROR. Would you like a separate ticket for that?

Fri Oct 12 13:13:01 2018 NLNETLABS [...] cpan.org - Subject changed from 'Strange behaviour in Net::DNS::Resolver->search around NOERROR results with no records' to 'Incorrect logic can cause DNS search to emit fruitless queries'

Fri Nov 09 16:35:57 2018 krenair [...] gmail.com - Correspondence added

For the record this appears to be fixed in 1.19. Thanks all!

Thu Nov 15 06:22:14 2018 rwfranks [...] acm.org - Fixed in 1.19 added

Tue Nov 20 05:11:37 2018 NLNETLABS [...] cpan.org - Status changed from 'open' to 'resolved'