dnscache endless resolving loop

[Alex Efros <powerman@powerman.name>]

[-- Attachment #1: Type: text/plain, Size: 2113 bytes --]

Hi!

Probably this isn't a right maillist to ask, but I think this will be
interesting to people here.

On one of my server I permanently have issue with dnscache, which looks
like this:

  PID  PPID    TIME+  %CPU %MEM  PR  NI S  VIRT SWAP  RES  UID COMMAND         
 3301   507  49:42.59 16.6  0.4  15   0 R  4148 2200 1948 1000 dnscache         
11519   507 602:44.67  3.3  0.2  15   0 R  2860 2052  808 1001 svlogd           
15610 26870   0:00.20  0.3  0.3  15   0 R  3588 1884 1704    0 top              

i.e. dnscache permanently use ~15% CPU (TIME+ column show less time for
dnscache than for it svlogd just because I restarted dnscache some time
ago). This server isn't very powerful (Celeron 2GHz, 512RAM), so this
issue slowdown server significantly. Of course I can disable svlogd for
dnscache (because writing huge amount of logd to disk also slowdown it),
but I need logs to find out what's wrong.

Restarting dnscache solve this issue for about a hour, and then it arise
again (probably it initiated by some spammer who connect to my qmail from
this IP, and tcpserver trying to resolve it).

According to logs, dnscache again and again trying to resolve PTR
124.240.91.30, and every time got negative result (which it doesn't cache,
AFAIK).

I spend enough time trying to find out WHO is sending these PTR requests
to dnscache (is anybody knows how to find out process which own UDP port?
things like netstat can't answer to question "who is asking my DNS
server")... dnscache run on 127.0.0.1 so it isn't remote attack.

After all I got an Idea: maybe it's dnscache is the one who asking
dnscache? :) I did strace, and, yes, it looks like dnscache send PTR
requests to itself in endless loop. Look:

http://powerman.name/tmp/dnscache_bug/log (1MB)
http://powerman.name/tmp/dnscache_bug/strace (6.5MB)
http://powerman.name/tmp/dnscache_bug/strace.filtered (2MB, only network I/O)

About djbdns patches. I use Gentoo's net-dns/djbdns-1.05-r21 package.
It apply several patches, but they all looks 100% harmless, and no one
touch C code (except errno problem) - I'll attach them.

-- 
			WBR, Alex.

[-- Attachment #2: 1.05-errno.patch --]
[-- Type: application/x-patch, Size: 249 bytes --]

[-- Attachment #3: dnsroots.patch --]
[-- Type: application/x-patch, Size: 367 bytes --]

[-- Attachment #4: dnstracesort.patch --]
[-- Type: application/x-patch, Size: 338 bytes --]

[-- Attachment #5: headtail.patch --]
[-- Type: application/x-patch, Size: 1848 bytes --]