dnsdist did not respect

[dtouzeau]

We use in dnsdist configuration

setECSOverride(true)
setECSSourcePrefixV4(32)
setECSSourcePrefixV6(128)

newServer({address="8.8.8.8:53", useClientSubnet=false, name="dns1", pool="defaults",healthCheckMode='lazy',checkInterval=2,lazyHealthCheckFailedInterval=15,rise=2,maxCheckFailures=3,checkTimeout=3000,lazyHealthCheckThreshold=30,lazyHealthCheckSampleSize=100,lazyHealthCheckMinSampleCount=10,lazyHealthCheckMode='TimeoutOnly'})
newServer({address="8.8.4.4:53", useClientSubnet=false, name="dns2", pool="defaults",healthCheckMode='lazy',checkInterval=2,lazyHealthCheckFailedInterval=15,rise=2,maxCheckFailures=3,checkTimeout=3000,lazyHealthCheckThreshold=30,lazyHealthCheckSampleSize=100,lazyHealthCheckMinSampleCount=10,lazyHealthCheckMode='TimeoutOnly'})
newServer({dohPath="/dns-query",validateCertificates=true,useClientSubnet=false,name="dns.google",pool="defaults",address="8.8.8.8:443",tls="openssl",subjectName="dns.google",healthCheckMode='lazy',checkInterval=2,lazyHealthCheckFailedInterval=15,rise=2,maxCheckFailures=3,checkTimeout=3000,lazyHealthCheckThreshold=30,lazyHealthCheckSampleSize=100,lazyHealthCheckMinSampleCount=10,lazyHealthCheckMode='TimeoutOnly'})

setServerPolicy(leastOutstanding)
DSTDOMDEFAULT = newSuffixMatchNode()
selectorDefault = OrRule{ selectorDefault, SuffixMatchNodeRule(DSTDOMDEFAULT) }
rl = newRemoteLogger("127.0.0.1:4897")
addAction(AllRule(),RemoteLogAction(rl, nil, {serverID="dnsdist"}))
addResponseAction(AllRule(),RemoteLogResponseAction(rl, nil, true, {serverID="dnsdist"}))
addCacheHitResponseAction(AllRule(), RemoteLogResponseAction(rl, nil, true, {serverID="dnsdist"}))

mylogaction=LogAction("/var/log/dnsdist-service.log",false, true, false, false, true)
addAction(AllRule(), mylogaction)
mylogaction:reload()

addAction(selectorDefault, LuaAction(LogRule0) )
addAction(selectorDefault, PoolAction("defaults"),{name="rule_default",uuid="b34468b8-5334-e4f4-a273-5444988e1652"})
addAction(PoolAvailableRule(""), PoolAction("defaults"))

althoug useClientSubnet=false we see that DNSDIST transmits eDNS information to the upstream server

Is this the expected behavior?

Is there a way to prevent eDNS transmission to upstream servers ?

[Habbie]

can you show what's happening?

[dtouzeau]

ok, you set
setECSSourcePrefixV4(32)

because you need to create rule precisely for specific clients.
You define a forwarder like google. ( like the example above ) and you did not want eDNS information sent to google
So adding useClientSubnet=false should make the job

but in this case it worst because google claim

dig +subnet=192.168.1.20/32 @192.168.90.154 www.microsoft.it

; <<>> DiG 9.11.5-P4-5.1+deb10u11-Debian <<>> +subnet=192.168.1.20/32 @192.168.90.154 www.microsoft.it
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 24138
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
; OPT=15: c0 00 50 72 6f 76 69 64 65 64 20 45 43 53 20 69 6e 63 6c 75 64 65 73 20 33 32 20 62 69 74 73 2c 20 62 75 74 20 6e 6f 20
 6d 6f 72 65 20 74 68 61 6e 20 32 34 20 61 72 65 20 61 6c 6c 6f 77 65 64 2e 20 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72
 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 70 65 65 64 2f 70 75 62 6c 69 63 2d 64 6e 73 2f 64 6f 63 73 2f 65 63 73 
("..Provided ECS includes 32 bits, but no more than 24 are allowed. https://developers.google.com/speed/public-dns/docs/ecs")
; CLIENT-SUBNET: 192.168.1.20/32/0
;; QUESTION SECTION:
;www.microsoft.it.              IN      A

;; Query time: 12 msec
;; SERVER: 192.168.90.154#53(192.168.90.154)
;; WHEN: mar. mars 18 22:08:05 CET 2025
;; MSG SIZE  rcvd: 182

[omoerbeek]

I think useClientSubnet=false will not add an ECS, but if the query already contains an ECS, it will not remove it. I don't know if dnsdist is able to remove an ECS from a query.

[rgacogne]

No, it doesn't at the moment. We have a feature request for it, and I would not mind having it in 2.0, but as far as I know it's not being worked on yet.

[rgacogne]

#14920