pinewall is translating Anatomy of a Linux DNS Lookup – Part III ============================================================ In [Anatomy of a Linux DNS Lookup – Part I][1] I covered: * `nsswitch` * `/etc/hosts` * `/etc/resolv.conf` * `ping` vs `host` style lookups and in [Anatomy of a Linux DNS Lookup – Part II][2] I covered: * `systemd` and its `networking` service * `ifup` and `ifdown` * `dhclient` * `resolvconf` and ended up here: * * * ![linux-dns-2 (2)](https://zwischenzugs.files.wordpress.com/2018/06/linux-dns-2-2.png?w=525) _A (roughly) accurate map of what’s going on_ Unfortunately, that’s not the end of the story. There’s still more things that can get involved. In Part III, I’m going to cover NetworkManager and dnsmasq and briefly show how they play a part. * * * # 1) NetworkManager As mentioned in Part II, we are now well away from POSIX standards and into Linux distribution-specific areas of DNS resolution management. In my preferred distribution (Ubuntu), there is a service that’s available and often installed for me as a dependency of some other package I install called [NetworkManager][3]. It’s actually a service developed by RedHat in 2004 to help manage network interfaces for you. What does this have to do with DNS? Install it to find out: ``` $ apt-get install -y network-manager ``` In my distribution, I get a config file. ``` $ cat /etc/NetworkManager/NetworkManager.conf [main] plugins=ifupdown,keyfile,ofono dns=dnsmasq [ifupdown] managed=false ``` See that `dns=dnsmasq` there? That means that NetworkManager will use `dnsmasq` to manage DNS on the host. * * * # 2) dnsmasq The dnsmasq program is that now-familiar thing: yet another level of indirection for `/etc/resolv.conf`. Technically, dnsmasq can do a few things, but is primarily it acts as a DNS server that can cache requests to other DNS servers. It runs on port 53 (the standard DNS port), on all local network interfaces. So where is `dnsmasq` running? NetworkManager is running: ``` $ ps -ef | grep NetworkManager root     15048     1  0 16:39 ?        00:00:00 /usr/sbin/NetworkManager --no-daemon ``` But no `dnsmasq` process exists: ``` $ ps -ef | grep dnsmasq $ ``` Although it’s configured to be used, confusingly it’s not actually installed! So you’re going to install it. Before you install it though, let’s check the state of `/etc/resolv.conf`. ``` $ cat /etc/resolv.conf # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) #     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN nameserver 10.0.2.2 search home ``` It’s not been changed by NetworkManager. If `dnsmasq` is installed: ``` $ apt-get install -y dnsmasq ``` Then `dnsmasq` is up and running: ``` $ ps -ef | grep dnsmasq dnsmasq  15286     1  0 16:54 ?        00:00:00 /usr/sbin/dnsmasq -x /var/run/dnsmasq/dnsmasq.pid -u dnsmasq -r /var/run/dnsmasq/resolv.conf -7 /etc/dnsmasq.d,.dpkg-dist,.dpkg-old,.dpkg-new --local-service --trust-anchor=.,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5 ``` And `/etc/resolv.conf` has changed again! ``` root@linuxdns1:~# cat /etc/resolv.conf # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) #     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN nameserver 127.0.0.1 search home ``` And `netstat` shows `dnsmasq` is serving on all interfaces at port 53: ``` $ netstat -nlp4 Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address     Foreign Address State   PID/Program name tcp        0      0 127.0.0.1:53      0.0.0.0:*       LISTEN  15286/dnsmasq  tcp        0      0 10.0.2.15:53      0.0.0.0:*       LISTEN  15286/dnsmasq tcp        0      0 172.28.128.11:53  0.0.0.0:*       LISTEN  15286/dnsmasq tcp        0      0 0.0.0.0:22        0.0.0.0:*       LISTEN  1237/sshd udp        0      0 127.0.0.1:53      0.0.0.0:*         15286/dnsmasq udp        0      0 10.0.2.15:53      0.0.0.0:*               15286/dnsmasq   udp        0      0 172.28.128.11:53  0.0.0.0:*               15286/dnsmasq   udp        0      0 0.0.0.0:68        0.0.0.0:*               10758/dhclient udp        0      0 0.0.0.0:68        0.0.0.0:*               10530/dhclient udp        0      0 0.0.0.0:68        0.0.0.0:*               10185/dhclient ``` * * * # 3) Unpicking dnsmasq Now we are in a situation where all DNS queries are going to `127.0.0.1:53` and from there what happens? We can get a clue from looking again at the `/var/run` folder. The `resolv.conf` in `resolvconf` has been changed to point to where `dnsmasq` is being served: ``` $ cat /var/run/resolvconf/resolv.conf # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) #     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN nameserver 127.0.0.1 search home ``` while there’s a new `dnsmasq` folder with its own `resolv.conf`. ``` $ cat /run/dnsmasq/resolv.conf nameserver 10.0.2.2 ``` which has the nameserver given to us by `DHCP`. We can reason about this without looking too deeply, but what if we really want to know what’s going on? * * * # 4) Debugging Dnsmasq Frequently I’ve found myself wondering what dnsmasq’s state is. Fortunately, you can get a good amount of information out of it if you set change this line in `/etc/dnsmasq.conf`: ``` #log-queries ``` to: ``` log-queries ``` and restart ​`dnsmasq` Now, if you do a simple: ``` $ ping -c1 bbc.co.uk ``` you will see something like this in `/var/log/syslog` (the `[...]` indicates that the line’s start is the same as the previous one): ``` Jul  3 19:56:07 ubuntu-xenial dnsmasq[15372]: query[A] bbc.co.uk from 127.0.0.1 [...] forwarded bbc.co.uk to 10.0.2.2 [...] reply bbc.co.uk is 151.101.192.81 [...] reply bbc.co.uk is 151.101.0.81 [...] reply bbc.co.uk is 151.101.64.81 [...] reply bbc.co.uk is 151.101.128.81 [...] query[PTR] 81.192.101.151.in-addr.arpa from 127.0.0.1 [...] forwarded 81.192.101.151.in-addr.arpa to 10.0.2.2 [...] reply 151.101.192.81 is NXDOMAIN ``` which shows what `dnsmasq` received, where the query was forwarded to, and what reply was received. If the query is returned from the cache (or, more exactly, the local ‘time-to-live’ for the query has not expired), then it looks like this in the logs: ``` [...] query[A] bbc.co.uk from 127.0.0.1 [...] cached bbc.co.uk is 151.101.64.81 [...] cached bbc.co.uk is 151.101.128.81 [...] cached bbc.co.uk is 151.101.192.81 [...] cached bbc.co.uk is 151.101.0.81 [...] query[PTR] 81.64.101.151.in-addr.arpa from 127.0.0.1 ``` and if you ever want to know what’s in your cache, you can provoke dnsmasq into sending it to the same log file by sending the `USR1` signal to the dnsmasq process id: ``` $ kill -SIGUSR1 <(cat /run/dnsmasq/dnsmasq.pid) ``` and the output of the dump looks like this: ``` Jul  3 15:08:08 ubuntu-xenial dnsmasq[15697]: time 1530630488                                                                                                                                  [...] cache size 150, 0/5 cache insertions re-used unexpired cache entries.                                                                            [...] queries forwarded 2, queries answered locally 0                                                                                                  [...] queries for authoritative zones 0                                                                                                                [...] server 10.0.2.2#53: queries sent 2, retried or failed 0                                                                                          [...] Host           Address        Flags      Expires                             [...] linuxdns1      172.28.128.8   4FRI   H                                                                 [...] ip6-localhost  ::1            6FRI   H                                                                 [...] ip6-allhosts   ff02::3         6FRI   H                                                                 [...] ip6-localnet     fe00::         6FRI   H                                                                 [...] ip6-mcastprefix  ff00::         6FRI   H                                                                 [...] ip6-loopback     :               6F I   H                                                                 [...] ip6-allnodes    ff02:           6FRI   H                                                                 [...] bbc.co.uk        151.101.64.81  4F         Tue Jul  3 15:11:41 2018                                      [...] bbc.co.uk        151.101.192.81 4F         Tue Jul  3 15:11:41 2018                                      [...] bbc.co.uk        151.101.0.81    4F         Tue Jul  3 15:11:41 2018                                      [...] bbc.co.uk        151.101.128.81 4F         Tue Jul  3 15:11:41 2018                                      [...]                  151.101.64.81  4 R  NX    Tue Jul  3 15:34:17 2018                                      [...] localhost        127.0.0.1      4FRI   H                                                                 [...]           19036   8   2  SF I                                                                     [...] ip6-allrouters   ff02::2        6FRI   H         ``` In the above output, I believe (but don’t know, and ‘?’ indicates a relatively wild guess on my part) that: * ‘4’ means IPv4 * ‘6’ means IPv6 * ‘H’ means address was read from an `/etc/hosts` file * ‘I’ ? ‘Immortal’ DNS value? (ie no time-to-live value?) * ‘F’ ? * ‘R’ ? * ‘S’? * ‘N’? * ‘X’ #### Alternatives to dnsmasq `dnsmasq` is not the only option that can be passed to dns in NetworkManager. There’s `none` which does nothing to `/etc/resolv,conf`, `default`, which claims to ‘update `resolv.conf`  to reflect currently active connections’, and `unbound`, which communicates with the `unbound` service and `dnssec-triggerd`, which is concerned with DNS security and is not covered here. * * * ### End of Part III That’s the end of Part III, where we covered the NetworkManager service, and its `dns=dnsmasq` setting. Let’s briefly list some of the things we’ve come across so far: * `nsswitch` * `/etc/hosts` * `/etc/resolv.conf` * `/run/resolvconf/resolv.conf` * `systemd` and its `networking` service * `ifup` and `ifdown` * `dhclient` * `resolvconf` * `NetworkManager` * `dnsmasq` -------------------------------------------------------------------------------- via: https://zwischenzugs.com/2018/07/06/anatomy-of-a-linux-dns-lookup-part-iii/ 作者：[ZWISCHENZUGS][a] 译者：[译者ID](https://github.com/译者ID) 校对：[校对者ID](https://github.com/校对者ID) 本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出 [a]:https://zwischenzugs.com/ [1]:https://zwischenzugs.com/2018/06/08/anatomy-of-a-linux-dns-lookup-part-i/ [2]:https://zwischenzugs.com/2018/06/18/anatomy-of-a-linux-dns-lookup-part-ii/ [3]:https://en.wikipedia.org/wiki/NetworkManager