Hosts: Special character in hosts file is causing dnsmasq to malfunction

[ghost]

There's an entry in the hosts file with a special character, that's preventing dnsmasq from working, and therefore, Pi-Hole.

lifehacĸer.com

The "ĸ" is not an actual "k", is a special character.

"systemctl status dnsmasq" returns this error:

bad name at /etc/pihole/gravity.list line 74173

Which is this line:

lifehacĸer.com

Removing the offending simbol from the file solves the issue and make dnsmasq work again. The problem is that when Pi-Hole updates it comes back. Can you remove this entry from the hosts file?

[StevenBlack]

This is an obvious phish, and we'll be seeing lots more of that, I fear.

Is the Pi-hole project aware of this problem? https://github.com/pi-hole/pi-hole/issues

[ghost]

I was going to report to them, but since they use your list, they can't really fix the problem. Also, the issue is not in Pi-Hole, it seems that dnsmasq doesn't accept special characters.

[mitchellkrogza]

This is because special characters need to be converted to a string that your DNS or web server can understand. Luckily Nginx already does this for me.

Take for instance xn--oogle-wmc.com

Put that in a browser and see what it changes to it says "Google.com" but it's not.

Have a look at the list of converted domains on my list that any DNS can understand.
https://github.com/StevenBlack/hosts/pull/248

You can nslookup on any of those funny domain strings and get an answer on them.

[ghost]

When I paste the address in the browser nothing happens.

If I understood correctly, it's possible to avoid the issue by converting the string? If that's the case, it's something that Steven could do?

[mitchellkrogza]

Weird, I can do nslookups on those funny strings from any linux or Mac OS I've tested on or paste them into any of my browsers and it resolves. This is how they show up in Nginx logs.

x.x.x.x - - [15/Sep/2016:17:13:01 +0200] "GET / HTTP/1.1" 301 178 "http://xn----itbkqkfiq.xn--p1ai/6-bari/names-in-englesh.php" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" "-"PORT:80 0.000 - . "GZIP:-"

[mitchellkrogza]

lifehacĸer.com translates to xn--lifehacer-1rb.com

nslookup xn--lifehacer-1rb.com

Non-authoritative answer: xn--lifehacer-1rb.com origin = dns1.yandex.net mail addr = iskalko.yandex.ru serial = 2016120703 refresh = 14400 retry = 900 expire = 1209600 minimum = 14400 xn--lifehacer-1rb.com mail exchanger = 10 mx.yandex.net. Name: xn--lifehacer-1rb.com Address: 78.110.60.230 xn--lifehacer-1rb.com nameserver = dns2.yandex.net. xn--lifehacer-1rb.com text = "v=spf1 redirect=_spf.yandex.net" xn--lifehacer-1rb.com nameserver = dns1.yandex.net.
https://www.charset.org/punycode

[ghost]

Nslookup works for me, but the address doesn't change when I paste it in the browser, and also doesn't resolve.

I'm using Fedora 25.

[mitchellkrogza]

Interesting one this, I think it's a browser problem.

Just did some tests as follows:

Ubuntu:
Firefox and Chrome
Paste address xn--lifehacer-1rb.com without http://
Opens page
nslookup - resolves

MacOS Sierra:
Firefox, Chrome, Safari
Paste address xn--lifehacer-1rb.com without http://
Opens page
nslookup - resolves

Windows XP:
Firefox, Chrome
Paste address xn--lifehacer-1rb.com without http://
Opens page
nslookup - resolves

Linux Mint:
Firefox, Chrome
Paste address xn--lifehacer-1rb.com without http://
Opens page
nslookup - resolves

Android Phone: (here's an issue)
Chrome
See screengrab

Android on Chrome incorrectly translates what I type into the search bar.

[mitchellkrogza]

Update:

Sent an email from my desktop to my android phone with the links in the email. Clicking either one of the links in the email and they both open in chrome on Android.

The fact that all nslookups resolve should be enough to satisfy that the hosts file will also understand the xn--- formats perfectly.

[PromoFaux]

Pi-hole dev chipping in here! @drakofrost I've just updated my gravity.list to include new changes to this list and I'm not hitting the same error with lifehacĸer.com causing dnsmasq to fall over... what version of dnsmasq do you have?

adam@adam-debian:~$ sudo service dnsmasq status
● dnsmasq.service - dnsmasq - A lightweight DHCP and caching DNS server
   Loaded: loaded (/lib/systemd/system/dnsmasq.service; enabled)
  Drop-In: /run/systemd/generator/dnsmasq.service.d
           └─50-dnsmasq-$named.conf, 50-insserv.conf-$named.conf
   Active: active (running) since Thu 2017-02-23 09:34:21 GMT; 3s ago
  Process: 13598 ExecStop=/etc/init.d/dnsmasq systemd-stop-resolvconf (code=exited, status=0/SUCCESS)
  Process: 13591 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS)
  Process: 13642 ExecStartPost=/etc/init.d/dnsmasq systemd-start-resolvconf (code=exited, status=0/SUCCESS)
  Process: 13632 ExecStart=/etc/init.d/dnsmasq systemd-exec (code=exited, status=0/SUCCESS)
  Process: 13631 ExecStartPre=/usr/sbin/dnsmasq --test (code=exited, status=0/SUCCESS)
 Main PID: 13641 (dnsmasq)
   CGroup: /system.slice/dnsmasq.service
           └─13641 /usr/sbin/dnsmasq -x /var/run/dnsmasq/dnsmasq.pid -u dnsmasq -r /var/run/dnsmasq/resolv.conf -7 /etc/dnsmasq.d,.dpkg-dist,.dpkg-o...

Feb 23 09:34:20 adam-debian dnsmasq[13631]: dnsmasq: syntax check OK.
Feb 23 09:34:21 adam-debian systemd[1]: Started dnsmasq - A lightweight DHCP and caching DNS server.
adam@adam-debian:~$ cat /etc/pihole/gravity.list | grep lifehacĸer.com
192.168.216.236 lifehacĸer.com

Interestingly, nslookup expands the special char:

ping: unknown host lifehacĸer.com
adam@adam-debian:~$ ping lifehacĸer.com
ping: unknown host lifehacĸer.com
adam@adam-debian:~$ nslookup lifehacĸer.com
Server:         127.0.0.1
Address:        127.0.0.1#53

** server can't find lifehac\196\184er.com: NXDOMAIN

[PromoFaux]

@mitchellkrogza

lifehacĸer.com translates to xn--lifehacer-1rb.com

I notice you include both xn--lifehacer-1rb.com and lifehacĸer.com in your list. If the latter just redirects to the former, then lifehacĸer.com is superfluous, surely?

[mitchellkrogza]

Thanks, fixed in https://github.com/mitchellkrogza/Badd-Boyz-Hosts/commit/5001714c984350c67671e9c1e6806e73328a3126 occasionally happens, had a lot of problems with my eyes and new glasses the past few months 😬

[StevenBlack]

@mitchellkrogza @PromoFaux @drakofrost thank you, everyone, for your diligence!

I just pushed the latest sources to master.

[ghost]

@mitchellkrogza It may have to do with the fact that I'm running Pi-Hole as a DNS server, maybe Pi-Hole is blocking those addresses.

@PromoFaux dnsmasq version 2.66, I'm running CentOS 7 on DigitalOcean.

Dnsmasq is working fine with the new format, thanks guys.

[PromoFaux]

dnsmasq version 2.66,

@drakofrost Possibly something to do with it. I know debian repositories have version 2.72, and I have no issues with that, even with the special chars.

Latest version is 2.76, which you can compile from source.

[ghost]

@PromoFaux I left the process of compiling stuff in the 90's :)

[Atavic]

Go to Yandex.ru
Search for: lifehacĸer.com
1st result is there.

The ĸ in lifehacĸer is a letter of the Cyrillic script.

[funilrys]

This one should be also fixed by #520 in future updates @StevenBlack :+1:

[StevenBlack]

Thanks @funilrys. Closing.