nRF9160 DNS cache & TTL

[Stephan Walter]

We are using the nRF9160 with a cellular service provider that has quite a strict firewall policy. There are rejected connections and we suspect a problem with cached DNS lookups in the nRF91.

To be more specific, the firewall at the provider does white-listing based on FQDNs. If a mobile device performs a DNS lookup, then a subsequent connection to the IP address in the DNS response will be allowed by the firewall, but only according to the time-to-live. If no lookup is made or the TTL of an earlier lookup has expired, the connection is blocked.

According to the provider's investigation, the nRF91 does not issue another DNS lookup every time we call nrf_getaddrinfo, even if the TTL has elapsed.

This is with modem firmware 1.3.5. The 1.3.6 release notes do not mention anything specific to DNS, so we haven't tried that.

Is it correct that the nRF91 caches DNS responses for longer than the TTL permits?

Is there a way to change this behavior and force it to respect the TTL?

Is there a way to disable, clear, or dump the DNS cache?

[Håkon Alseth]

Hi,

 

I got confirmation from R&D.

Is it correct that the nRF91 caches DNS responses for longer than the TTL permits?

We have a internal test on this, and this is not failing, meaning that we observe that the nRF9160 modem fw is not caching longer than TTL permits.

Is there a way to change this behavior and force it to respect the TTL?

Could you please share a modem trace showing this behavior?

Is there a way to disable, clear, or dump the DNS cache?

Unfortunately, no. There is no way to clear the DNS cache.

 

Kind regards,

Håkon

[Stephan Walter]

Hi Håkon,

Thanks for your help. We have run a test with tracing enabled (NRF_MODEM_LIB_TRACE_LEVEL_IP_ONLY), and it looks like the nRF91 indeed handles the TTL correctly. Still it would be nice to have some way to influence the DNS cache on the nRF91.

We suspect that our provider hasn't implemented the TTL in the firewall correctly.

[Sebastiaan Merckx]

Hi Stephan Walter ,

Which provider are you talking about? I'm facing similar issues with Vodafone.

Did you manage to solve this issue?

Kind regards,

Sebastiaan

[Stephan Walter]

Hi Sebastiaan, our problem was with Vodafone as well. Unfortunately I don't know how the problem ultimately got resolved, if at all. A workaround would be to add the IP addresses to the whitelist instead of the FQDN. Of course that defeats the advantages of a domain name.

[Sebastiaan Merckx]

Okay, good to know, thanks.

What we could also see in pcap captures is that the NRF91 performs an IPV6 DNS request and gets a response with only CNAME record, and it does not perform an IPV4 DNS request. This might be an indication that the modem implementation mixes IPV6 and IPV4 responses, which is wrong.

But we've just done some IPV4-only tests where the same (or similar?) issue occurs - we still need to look at the captures. I haven't activated modem traces yet.