UlricE / pen

Pen
Other
250 stars 41 forks source link

UDP issue - queries with udp port 53 / dns #52

Open nuttysquirrel opened 5 years ago

nuttysquirrel commented 5 years ago

hi all, I'm running into issues with UDP based DNS resolution (getting consistent but 'random' timeouts). I'm using pen from github / compiled source (it says "pen 0.35.0").

I've added basic packet captures. It represents 3 concurrent "nslookup www.cname.myserver.guy" attempts, nothing fancy - just start the pen process and try three times. the first two work fine, the last does not.

In the first transaction, the source port of the udp request 46590 matches in the return packet. The nslookup works fine.

17:52:51.692302 IP dnssource.myserver.guy.46590 > resolver.myserver.guy.domain:  25463+ A? www.cname.myserver.guy. (36)
17:52:51.693977 IP resolver.myserver.guy.domain > dnssource.myserver.guy.46590:  25463* 1/2/2 A www.myserver.guy (120)

The same for the second transaction, the source port 35253 matches in the return packet, and the nslookup works fine..

17:52:57.551415 IP dnssource.myserver.guy.35253 > resolver.myserver.guy.domain:  22653+ A? www.cname.myserver.guy. (36)
17:52:57.552963 IP resolver.myserver.guy.domain > dnssource.myserver.guy.35253:  22653* 1/2/2 A www.myserver.guy (120)

however! in the third request, the source port is 39939 but the return packet has the port of the previous packet 35253. This packet never gets back to the nslookup and so fails with a timeout.

17:53:00.740266 IP dnssource.myserver.guy.39939 > resolver.myserver.guy.domain:  4360+ A? www.cname.myserver.guy. (36)
17:53:00.741555 IP resolver.myserver.guy.domain > dnssource.myserver.guy.35253:  4360* 1/2/2 A www.myserver.guy (120)

For what it's worth... if I change the config to use TCP for DNS requests, it all works wonderfully!

oh, another interesting point is that the exact same configuration with pen 0.25.1 also works with no issues.

ergo70 commented 5 years ago

I can confirm that described behavior with UDP packets and pen 0.35. I can also confirm that it does not happen with 0.25.1. I have not checked every subsequent version to find where it broke, though.

ergo70 commented 5 years ago

It also happens with 0.34.1. Unfortunately, I could not track it further down the versions because of compilation errors with OpenSSL...