19 Pro
2025
19 Pro
'25
18:01
Hello,
it seems vanilla kresd (5.7.6-cznic.1~bookworm), when receives NODATA response (NOERROR,
all RRs: 0) from remote authoritative server, stores record in cache with TTL=32768.
Where is this value coming from/how can we alter it?
(Seems hardcoded, not derived from SOA expiry or TTL.)
Impact:
may get negative ~9h cache for domains delegated to a server randomly returning NODATA
Workaround:
sacrifice cache hit ratio with cache.max_ttl(low_value)
Reproduction:
// wait 5-30 minutes
while true; do echo 'cache.clear("mr-z01.tm-azurefd.net")' | socat -
UNIX-CONNECT:/run/knot-resolver/control/1 >/dev/null; sleep 1; host -vvvvt a
mr-z01.tm-azurefd.net 127.0.0.1; curl -s
http://localhost:8451/trace/mr-z01.tm-azurefd.net; echo DONE; done 2>&1 | tee -a
issue.log
Watch log:
// captured with cache.min_ttl(77), irrelevant here
[cache ][65604.03] => satisfied by exact CNAME: rank 030, new TTL 16
[cache ][65604.05] => satisfied by exact RRset: rank 030, new TTL 16
[cache ][65605.01] => satisfied by exact packet: rank 030, new TTL 32768 <------
auth server return NODATA response (reason unknown)
[cache ][65606.01] => satisfied by exact packet: rank 030, new TTL 32768
[cache ][65607.01] => satisfied by exact RRset: rank 030, new TTL 77
[cache ][65608.01] => satisfied by exact RRset: rank 030, new TTL 77
[cache ][65609.01] => satisfied by exact CNAME: rank 030, new TTL 77
[cache ][65609.03] => satisfied by exact CNAME: rank 030, new TTL 11
[cache ][65609.05] => satisfied by exact RRset: rank 030, new TTL 11
[cache ][65610.01] => satisfied by exact CNAME: rank 030, new TTL 77
[cache ][65610.03] => satisfied by exact CNAME: rank 030, new TTL 10
[cache ][65610.05] => satisfied by exact RRset: rank 030, new TTL 10
[cache ][65611.01] => satisfied by exact CNAME: rank 030, new TTL 77
[cache ][65611.03] => satisfied by exact CNAME: rank 030, new TTL 9
[cache ][65611.05] => satisfied by exact RRset: rank 030, new TTL 9
[cache ][65612.01] => satisfied by exact packet: rank 030, new TTL 32768
[cache ][65613.01] => satisfied by exact RRset: rank 030, new TTL 77
[cache ][65614.01] => satisfied by exact RRset: rank 030, new TTL 77
// host
Trying "mr-z01.tm-azurefd.net"
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62752
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;mr-z01.tm-azurefd.net. IN A
Received 39 bytes from 127.0.0.1#53 in 4 ms
// kresd trace
[iterat][65612.00] 'mr-z01.tm-azurefd.net.' type 'A' new uid was
assigned .01, parent uid .00
[cache ][65612.01] => satisfied by exact packet: rank 030, new TTL 32768
[iterat][65612.01] <= answer received:
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 43459
;; Flags: qr aa QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 1
;; EDNS PSEUDOSECTION:
;; Version: 0; flags: do; UDP size: 1232 B; ext-rcode: Unused
;; QUESTION SECTION
mr-z01.tm-azurefd.net. A
;; ADDITIONAL SECTION
[iterat][65612.01] <= rcode: NOERROR
[resolv][65612.01] AD: request NOT classified as SECURE
[resolv][65612.01] finished in state: 4, queries: 1, mempool: 81952 B
// cache miss trace
[iterat][65637.03] <= rcode: NOERROR
[cache ][65637.03] => stashed tm2.dns-tm.com. A, rank 030, 20 B total, incl. 0
RRSIGs
[iterat][65637.01] 'mr-z01.tm-azurefd.net.' type 'A' new uid was
assigned .04, parent uid .00
[select][65637.04] => id: '43668' choosing from addresses: 1 v4 + 0 v6; names
to resolve: 2 v4 + 3 v6; force_resolve: 0; NO6: IPv6 is KO
[select][65637.04] => id: '43668' choosing:
'tm2.dns-tm.com.'(a)'150.171.16.240#00053' with timeout 22 ms zone cut:
'tm-azurefd.net.'
[resolv][65637.04] => id: '43668' querying:
'tm2.dns-tm.com.'(a)'150.171.16.240#00053' zone cut:
'tm-azurefd.net.' qname: 'mr-z01.tm-azurefd.net.' qtype: 'A'
proto: 'udp'
[select][65637.04] => id: '43668' updating:
'tm2.dns-tm.com.'(a)'150.171.16.240#00053' zone cut:
'tm-azurefd.net.' with rtt 4 to srtt: 2 and variance: 1
[iterat][65637.04] <= answer received:
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 43668
;; Flags: qr aa QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 1
;; EDNS PSEUDOSECTION:
;; Version: 0; flags: do; UDP size: 1232 B; ext-rcode: Unused
;; QUESTION SECTION
mr-z01.tm-azurefd.net. A
;; ADDITIONAL SECTION
[iterat][65637.04] <= rcode: NOERROR
[cache ][65637.04] => stashed packet: rank 030, TTL 32768, A mr-z01.tm-azurefd.net.
(62 B)
[resolv][65637.04] AD: request NOT classified as SECURE
[resolv][65637.04] finished in state: 4, queries: 2, mempool: 81952 B
;; selected from ANSWER sections:
; ranked rrset to_wire false, rank 030 (auth insecure), cached true, qry_uid 3,
revalidations 0
tm2.dns-tm.com. 300 A 150.171.16.240