Bug 2209031

Would you mind attaching your /etc/dnsmasq.d/dns-hosts-void.conf compressed by gzip?

I can try to create my own long list of similar addresses, but I cannot guarantee to reproduce it.

Thanks for taking a look. Please try following process to create the list:

# Download raw list
curl -s "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts" | \
  grep -v newrelic.com | grep -v ^"#" | grep -v "27\-\-" | grep ^0.0.0.0 | \
  sort > "${CURRENTDAY}-dns-void-StevenBlack.conf"

# translate to dnsmasq config
  cat "${CURRENTDAY}-dns-void-StevenBlack.conf" | \
  sed "s/0\\.0\\.0\\.0\\ www\\./0\\.0\\.0\\.0\\ /" | \
  awk '{FS=" "}{print $2}' |sed s/^/address=\\// | sed s/$/\\/0.0.0.0/ | \
  sort | uniq > "local-${CURRENTDAY}-dns-void-StevenBlack.conf"

Oh, I confirm that there is a problem with that. dnsmasq has started searching for previous used domain entries. It uses simple linear walk without any optimization. That does not scale well if used domains is a high number. It searches it linearly, which gets slow when there is a lot of them.

It slows down just simple --test mode enough to be visible.

# for I in {1..10000}; do printf "address=/block.%x.%x/0.0.0.0\n" $RANDOM $RANDOM >> block-10k.conf; done
# time dnsmasq --test --conf-file=block-10k.conf 
dnsmasq: syntax check OK.

real	0m0.968s
user	0m0.958s
sys	0m0.005s
# for I in {1..50000}; do printf "address=/block.%x.%x/0.0.0.0\n" $RANDOM $RANDOM >> block-50k.conf; done
# time dnsmasq --test --conf-file=block-50k.conf 
dnsmasq: syntax check OK.

real	0m21.197s
user	0m21.060s
sys	0m0.030s

# for I in {1..100000}; do printf "address=/block.%x.%x/0.0.0.0\n" $RANDOM $RANDOM >> block-100k.conf; done
# time dnsmasq --test --conf-file=block-100k.conf 
dnsmasq: syntax check OK.

real	1m33.076s
user	1m32.534s
sys	0m0.060s

This is exactly problem that larger rewrite solved in version 2.86, but which caused a lot of issues later. The reason why I chose to not just rebase to newer version. I tried to use simpler method to implement similar result, which does not change so much. But I am not sure this can be solved in my downstream changes.

I have avoided introducing sorted array, but I need to save last_server per domain somewhere. That requires searching if that domain already has a record, which leads to exponential complexity.

I would use unbound to create so many blocked domains entries myself. But fixing this would not be simple.

I guess I could use a trick to not search for existing domains for record types like --local=/blocked/ or --address=/blocked/#. Those do not need records stored in struct server_domain, those are relevant just for forwarding to servers having an IP. Similar logic exists in upstream version too.

Prepared a fix candidate. It walks the existing records just for normal servers, not --local or --address=/x/#.

Not yet properly tested.

https://gitlab.com/redhat/centos-stream/rpms/dnsmasq/-/merge_requests/19

Needed a fix for default forwarders, seems okay after basic checks.

Created a simple regression test:
https://src.fedoraproject.org/tests/dnsmasq/c/e54f9dd42fc33e8a7e63d4dc278f631bda34ed49

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: dnsmasq security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:6524