PaloAltoNetworks / SafeNetworking

Read only mirror. To contribute or submit issues, please go to the website link --->
https://gitlab.com/panw-gse/as/SafeNetworking/
Apache License 2.0
12 stars 10 forks source link

When getDomainDoc() returns NULL, it never updates the doc so it keeps getting processed #58

Open punisherVX opened 5 years ago

punisherVX commented 5 years ago

When we get the error "Unable to work with domain doc " the system never changes the doc and SFN keeps picking it up. Eventually, if you get enough of these, all the system does it pick up docs that it can't process and continuously tries to pick them up so nothing else ever gets processed.

From @dreshytnik


Looks like something similar to issues I used to have previously:

[ERROR]   : 2018-12-29 06:29:26,391 : dnsutils:getDomainDoc:[515]:140384644908800   : Unable to work with domain doc vlwcmgb48.ecfwg.xyz - 'filetype'
[DEBUG]   : 2018-12-29 06:29:26,391 : dnsutils:getDomainDoc:[518]:140384644908800   : getDomainDoc() returns: NULL
[DEBUG]   : 2018-12-29 06:29:26,392 : runner:searchDomain:[145]:140384644908800     : domainDoc is NULL
[ERROR]   : 2018-12-29 06:29:26,392 : runner:searchDomain:[150]:140384644908800     : Unable to process event pmaM-GcBxraJFJddcjut beacause of problem with domain-doc for vlwcmgb48.ecfwg.xyz
[ERROR]   : 2018-12-29 06:29:26,392 : runner:searchDomain:[151]:140384644908800     : Domain doc for vlwcmgb48.ecfwg.xyz

I think it would make sense to put a check against this type of errors in code and prevent a domain from requesting autofocus response. It just doesn’t allow other domains to be checked :-(.  ```