1817692 - Websites with DNAME records would not be accessed if DoH only mode is enabled

Status: VERIFIED FIXED

(Core :: Networking: DNS, defect, P2)

Description

[fantasyfate]

Steps to reproduce:

1. Set network.trr.mode to 3
2. Open https://www3.risc.jku.at/

Actual results:

"Hmm. We’re having trouble finding that site."

Expected results:

This website should be opened.

I speculate that DoH implementation of Firefox might not recognize DNAME records "www3.risc.jku.at" has.

If network.trr.mode is 0 (disabled) or 2 (enabled with fallback), this website would be opened.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Security' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[nicoleta.sibisan]

Attachment: trrmode_troublefindingthesite_2023-02-22.png

Comment 3

[nicoleta.sibisan]

Attachment: trrmode_securityrisk_3options2023-02-22.png

Comment 4

[nicoleta.sibisan]

Attachment: trrmode_securityrisk_3options2023-02-22.png

Comment 5

[nicoleta.sibisan]

Attachment: trrmode_securityrisk_2options_2023-02-22.png

Comment 6

[nicoleta.sibisan]

Hello,
I followed the indicated steps on win 11 and macOS 12.5 and found 3 types of results:

1. with Fx versions 102.8.0esr and 109.0 the issue is reproduced;
2. with Fx versions 110.0 and Nightly 111.0b3, the issue does not reproduce, instead, we get a "Possible security risk" warning and 3 options: "Try again", "Always continue for this site" (which ensures direct acces to the site in the future) and "Change DNS Settings"
3. with FX version 111.0b4 and Nighly 112.0a1 (2023-02-22), we get the security warning, but we have only 2 options: "Try again" and "Change DNS Settings" options

I'm not sure if latest versions behaviour is expected or a bug, I'll set it as new and wait for the developer's input.

Comment 7

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1817692 - Websites with DNAME records would not be accessed if DoH only mode is enabled r=#necko

When encountering an unknown record type in the answers we should be able to ignore it if we don't know how to parse that type.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9d6a3eb520ac
Websites with DNAME records would not be accessed if DoH only mode is enabled r=necko-reviewers,jesup

Comment 9

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/9d6a3eb520ac

Comment 10

[nicoleta.sibisan]

Verified - fixed on MacOs12, Win 11, ubuntu 22 in Fx versions 112.0b8 and latest Nightly 113.0a1 (2023-03-29).