Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reverse Lookup fails on uppercase "IN-ADDR.ARPA" #37

Open
PhaedrusTheGreek opened this issue Dec 28, 2017 · 0 comments
Open

Reverse Lookup fails on uppercase "IN-ADDR.ARPA" #37

PhaedrusTheGreek opened this issue Dec 28, 2017 · 0 comments

Comments

@PhaedrusTheGreek
Copy link
Contributor

PhaedrusTheGreek commented Dec 28, 2017

Under Logstash 5.6.5, reverse lookups will fail when the case of the in-addr.arpa zone name is in anything other than lower case. This was not reproducible under Win2k16 or Bind 9.9.4 (default CentOS 7), but was reproducible under a custom bind 9.10.6 installation that has since changed behaviour to preserve case sensitivity.

A zone configured like this would pass:

zone "1.168.192.in-addr.arpa" IN {
        type master;
        file "1.168.192.IN-ADDR.ARPA";
        allow-update { none; };
};

But the slightest difference in case in the zone name would case a failure:

zone "1.168.192.IN-addr.arpa" IN {
        type master;
        file "1.168.192.IN-ADDR.ARPA";
        allow-update { none; };
};

Some extra debugging reveals this error:

 DNS: couldn't resolve the address. {:field=>"message", :value=>"192.168.1.10", :message=>"no name for 192.168.1.10"}

Which (as best as I could tell) traces back to Ruby's Resolv::DNS.getaddresses failing to be case insensitive as it should be , according to RFC 4343.

OK now the good news - The bug tested fixed as of Logstash 6.0.0! So, problem solved!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant