分类目录归档：DNS

DNS glue record 胶水记录

发表评论

glue record 胶水记录 , 是登记在域名服务商的核心记录, 如果你的域名需要由自己的NS来解析的话

检查的办法很简单, 先查出对应的根服务器

#dig NS com

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.7 <<>> NS com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61412
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 12

;; QUESTION SECTION:
;com. IN NS

;; ANSWER SECTION:
com. 82334 IN NS b.gtld-servers.net.
com. 82334 IN NS j.gtld-servers.net.
com. 82334 IN NS m.gtld-servers.net.
com. 82334 IN NS i.gtld-servers.net.
com. 82334 IN NS f.gtld-servers.net.
com. 82334 IN NS a.gtld-servers.net.
com. 82334 IN NS g.gtld-servers.net.
com. 82334 IN NS h.gtld-servers.net.
com. 82334 IN NS l.gtld-servers.net.
com. 82334 IN NS k.gtld-servers.net.
com. 82334 IN NS c.gtld-servers.net.
com. 82334 IN NS d.gtld-servers.net.
com. 82334 IN NS e.gtld-servers.net.

;; ADDITIONAL SECTION:
b.gtld-servers.net. 23540 IN A 192.33.14.30
b.gtld-servers.net. 46911 IN AAAA 2001:503:231d::2:30
j.gtld-servers.net. 23540 IN A 192.48.79.30
j.gtld-servers.net. 46911 IN AAAA 2001:502:7094::30
m.gtld-servers.net. 85907 IN A 192.55.83.30
m.gtld-servers.net. 46911 IN AAAA 2001:501:b1f9::30
i.gtld-servers.net. 44730 IN A 192.43.172.30
i.gtld-servers.net. 46911 IN AAAA 2001:503:39c1::30
f.gtld-servers.net. 23540 IN A 192.35.51.30
f.gtld-servers.net. 46911 IN AAAA 2001:503:d414::30
a.gtld-servers.net. 55315 IN A 192.5.6.30
a.gtld-servers.net. 46911 IN AAAA 2001:503:a83e::2:30

;; Query time: 1 msec
;; SERVER: 10.4.1.1#53(10.4.1.1)
;; WHEN: Tue Aug 24 11:46:33 2021
;; MSG SIZE rcvd: 509

从里边的结果中挑出一个NS即可

#dig NS iqiyi.com @d.gtld-servers.net.

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.7 <<>> NS iqiyi.com @d.gtld-servers.net.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59595
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;iqiyi.com. IN NS

;; AUTHORITY SECTION:
iqiyi.com. 172800 IN NS ns1.iqiyi.com.
iqiyi.com. 172800 IN NS ns2.iqiyi.com.
iqiyi.com. 172800 IN NS ns3.iqiyi.com.
iqiyi.com. 172800 IN NS ns4.iqiyi.com.

;; ADDITIONAL SECTION:
ns1.iqiyi.com. 172800 IN A 43.225.84.1
ns2.iqiyi.com. 172800 IN A 43.225.85.1
ns3.iqiyi.com. 172800 IN A 43.225.84.1
ns4.iqiyi.com. 172800 IN A 43.225.85.1

以上additional section就是胶水记录了

也可以用这个网站查询并做一些相关检查:

http://www.webdnstools.com/dnstools/check-domain-results

bind 筛选记录query_log

发表评论

这边有个需求, 让bind 的query_log 只记录ipv4的A记录请求

解决办法:

修改代码query.c 里边记录query_log的部分, 增加一个 客户端query.qtype的判断

--- bind-9.11.14/bin/named/query.c      2019-12-12 13:17:55.000000000 +0800
 +++ bind-9.11.14.mod/bin/named/query.c  2020-03-05 16:57:31.766000000 +0800
 @@ -9548,8 +9548,6 @@
                 return;
         }
 if (ns_g_server->log_queries)
 log_query(client, saved_flags, saved_extflags);
 /*  * Check for meta-queries like IXFR and AXFR.
 @@ -9559,6 +9557,10 @@
     client->query.qtype = qtype = rdataset->type;
     dns_rdatatypestats_increment(ns_g_server->rcvquerystats, qtype);
 if ( (ns_g_server->log_queries) && (client->query.qtype == dns_rdatatype_a) ){
 log_query(client, saved_flags, saved_extflags);
 }
 +
     log_tat(client);
 if (dns_rdatatype_ismeta(qtype)) {

qtype 分以下种类

enum {
	dns_rdatatype_none = 0,
	dns_rdatatype_a = 1,
	dns_rdatatype_ns = 2,
	dns_rdatatype_md = 3,
	dns_rdatatype_mf = 4,
	dns_rdatatype_cname = 5,
	dns_rdatatype_soa = 6,
	dns_rdatatype_mb = 7,
	dns_rdatatype_mg = 8,
	dns_rdatatype_mr = 9,
	dns_rdatatype_null = 10,
	dns_rdatatype_wks = 11,
	dns_rdatatype_ptr = 12,
	dns_rdatatype_hinfo = 13,
	dns_rdatatype_minfo = 14,
	dns_rdatatype_mx = 15,
	dns_rdatatype_txt = 16,
	dns_rdatatype_rp = 17,
	dns_rdatatype_afsdb = 18,
	dns_rdatatype_x25 = 19,
	dns_rdatatype_isdn = 20,
	dns_rdatatype_rt = 21,
	dns_rdatatype_nsap = 22,
	dns_rdatatype_nsap_ptr = 23,
	dns_rdatatype_sig = 24,
	dns_rdatatype_key = 25,
	dns_rdatatype_px = 26,
	dns_rdatatype_gpos = 27,
	dns_rdatatype_aaaa = 28,
	dns_rdatatype_loc = 29,
	dns_rdatatype_nxt = 30,
	dns_rdatatype_srv = 33,
	dns_rdatatype_naptr = 35,
	dns_rdatatype_kx = 36,
	dns_rdatatype_cert = 37,
	dns_rdatatype_a6 = 38,
	dns_rdatatype_dname = 39,
	dns_rdatatype_opt = 41,
	dns_rdatatype_apl = 42,
	dns_rdatatype_ds = 43,
	dns_rdatatype_sshfp = 44,
	dns_rdatatype_ipseckey = 45,
	dns_rdatatype_rrsig = 46,
	dns_rdatatype_nsec = 47,
	dns_rdatatype_dnskey = 48,
	dns_rdatatype_dhcid = 49,
	dns_rdatatype_nsec3 = 50,
	dns_rdatatype_nsec3param = 51,
	dns_rdatatype_hip = 55,
	dns_rdatatype_spf = 99,
	dns_rdatatype_unspec = 103,
	dns_rdatatype_tkey = 249,
	dns_rdatatype_tsig = 250,
	dns_rdatatype_dlv = 32769,
	dns_rdatatype_keydata = 65533,
	dns_rdatatype_ixfr = 251,
	dns_rdatatype_axfr = 252,
	dns_rdatatype_mailb = 253,
	dns_rdatatype_maila = 254,
	dns_rdatatype_any = 255
};

参考文档:

https://users.isc.org/~each/doxygen/bind9/structns__query.html

https://ri.co.cr/training/dccom/bind-9.8.2/lib/dns/include/dns/enumtype.h

edns 与 8.8.8.8 DNS Cache

发表评论

测试bind-9.8.1-P1 的edns的时候发现,google DNS解析的结果一直在跳,有时候在电信区,有时候在us区

于是给它打了第一个patch,让query log 支持edns的client subnet显示,便于排查

筛选下日志,发现很多edns请求不在我们的ecs ACL范围内,最终落到了google DNS IP 所在的us区域,推测应该是这个造成了google DNS 的错误缓存

于是,把ecs的default区域加入拦截

view "default_ecs" {
match-clients { ecs 0.0.0.0/0; ecs ::/0;};
... ...
};

这样一来,的确是响应了edns请求,结果却是更多的出现了default 区的结果(热数据),或者在client所属区域和default区结果之间跳动(冷数据)

听包,发现google DNS发送过来的请求Scope Netmask 都是0,如果ecs ACL拦截不成功到了default_ecs区域,最终被ecs 0.0.0.0/0; ecs ::/0; 拦截成功,导致返回的Scope Netmask变成了0

Scope Netmask 变为0意味着什么? 意味着这个结果集有效并且范围最大,从而污染所有的subnet client结果集

目前来看,只能给它打个patch

让client subnet 到了default区域的结果集Scope Netmask 为起address netmask长度,控制结果集的有效范围

测试下,把某个网段故意从ecs ACL挪走,让default ecs拦截看看响应是否是我们期待的

正常网段的请求,返回我们ecs ACL的Netmask

上线测试,目前服务正常

 

附上edns 文档,非常重要:
https://tools.ietf.org/html/draft-vandergaast-edns-client-subnet-01
http://noops.me/?p=653

以上的显示EDNS 的代码存在bug, 需要初始化

char edbuf[ISC_NETADDR_FORMATSIZE] = { 0 };

这里需要特别解释下 为什么char数组初始化使用 {0}, 这里有个解释

it’s a C-style cast. That is, it converts 0 (which is a literal of type int) to char (the \0 character). That cast could have been avoided entirely by simply using the ‘\0’ literal.

测试char = 0; 的时候打印出来直接是null, 从stackoverflow的解释看是这么回事

https://stackoverflow.com/questions/10004297/what-does-char0-mean-in-c