dns-flags always "false"

[BBQigniter]

Hi,

we now have enabled on our PowerDNS dnsdist-servers (v1.7.3) to forward the query-logs to a dnscollector (v0.29), and it works very well. But I wonder if the dns.flags are working/interpreted correctly. No matter what flags I set with dig-queries, they are always showing with value false. As I'm not very familiar with PowerDNS I wonder if anyone else has similar problems or if this is actually normal.

Thanks, for any hints in advance :)

And thanks for this marvelous piece of software :)

[dmachard]

Can you share more details? I am not sure to properly understand. Are you using the Protobuf PoweDNS or DNStap logging ?

[BBQigniter]

sure :), we enabled log-forwarding via following lines in the dnsdist.config

-- REMOTE-LOGGING OPTIONS START
rl = newRemoteLogger("LOG-SERVER:6000")

-- available in future version (v1.8.x)
-- local metadata = { pool='pool', agent='doh-header:user-agent'   }
--addAction(AllRule(),RemoteLogAction(rl, nil, {serverID="DNSDIST-SERVER-NAME"}, metadata))

addAction(AllRule(),RemoteLogAction(rl, nil, {serverID="DNSDIST-SERVER-NAME"}))
addResponseAction(AllRule(),RemoteLogResponseAction(rl, nil, true, {serverID="DNSDIST-SERVER-NAME"}))
addCacheHitResponseAction(AllRule(), RemoteLogResponseAction(rl, nil, true, {serverID="DNSDIST-SERVER-NAME"}))
-- REMOTE-LOGGING OPTIONS END

As far as I read in the dnsdist-config this is forwarding the logs via protobuf

The dns-collector then creates JSON-output like this - I marked the dns-flags lines with comments

{
  "suspicious": {
    "slow-domain": false,
    "unallowed-chars": false,
    "malformed-pkt": false,
    "excessive-number-labels": false,
    "large-pkt": false,
    "long-domain": false,
    "score": 0,
    "uncommon-qtypes": false
  },
  "port": 36692,
  "edns": {
    "dnssec-ok": 0,
    "options": [],
    "udp-size": 0,
    "rcode": 0,
    "version": 0
  },
  "powerdns": {
    "applied-policy": "",
    "metadata": {},
    "original-request-subnet": "",
    "tags": []
  },
  "@version": "1",
  "@timestamp": "2023-04-03T05:31:44.407913940Z",
  "host": "192.168.2.117",
  "in_date": "2023-04-03",
  "network": {
    "query-ip": "192.168.45.25",
    "query-port": "58109",
    "family": "INET",
    "response-ip": "10.123.1.22",
    "protocol": "UDP",
    "response-port": "53"
  },
  "dns": {
    "malformed-packet": false,
    "flags": {      # not matter what I try - all always false    
      "aa": false,  # not matter what I try - always false
      "tc": false,  # not matter what I try - always false
      "qr": false,  # not matter what I try - always false
      "ra": false,  # not matter what I try - always false
      "ad": false   # not matter what I try - always false
    },
    "qname": "some.record.example",
    "resource-records": {
      "ns": [],
      "an": [
        {
          "ttl": 134,
          "rdata": "10.123.123.20",
          "name": "some.record.example",
          "rdatatype": "A"
        }
      ],
      "ar": []
    },
    "length": 97,
    "qtype": "A",
    "opcode": 0,
    "rcode": "NOERROR"
  },
  "dnstap": {
    "timestamp-rfc3339ns": "2023-04-03T05:31:30.00011606Z",
    "latency": "0.000027",
    "identity": "DNSDIST-SERVER-NAME",
    "operation": "CLIENT_RESPONSE",
    "version": "-"
  }
}

[dmachard]

Thanks for details, after some checks, DNS flags are not available with PowerDNS collector (no flags in protobuf message).

Perhaps you can use the tag metadata feature to add it as workaround.

[BBQigniter]

Ok, thanks for checking, all clear to me now :) - I'll try around with the next versions as metadata-stuff is only available after v1.8, it was released a few days ago, but we haven't yet updated the dnsdist.