initial commit

2026-07-12 10:17:17 -04:00
commit dab5a4ebc6
1424 changed files with 330463 additions and 0 deletions
@@ -0,0 +1,51 @@
+# Deep CNAME Inspection False-Positive Evidence
+
+## Reproduction (2026-06-03, Pi-hole v6.4.2 + v6.6.2 FTL)
+
+### Test: domains caught by CNAME chain propagation
+
+When `CNAMEdeepInspect = true`, Pi-hole follows CNAME chains and blocks the ENTIRE
+chain if ANY intermediate domain is in a blocklist. The blocklist (StevenBlack
+hosts) includes specific Google ad subdomains like `pagead.l.google.com` and
+`ssl-google-analytics.l.google.com`, but deep CNAME inspection propagates the
+block to the PARENT domains that many essential services depend on.
+
+### Confirmed: parent domains in blocklist (via pihole -q)
+
+```
+gstatic.com       → IN BLOCKLIST (subdomains: various ad-related)
+l.google.com      → IN BLOCKLIST (subdomains: pagead, ssl-google-analytics, etc.)
+googlehosted.com  → IN BLOCKLIST
+1e100.net         → IN BLOCKLIST
+```
+
+### Domains getting false-positive status 14 (cached-as-blocked)
+
+| Domain | Status 14 count | What it breaks |
+|---|---|---|
+| dns.msftncsi.com | 514 | Windows internet connectivity check |
+| ps5.np.playstation.net | 313 | PlayStation Network |
+| api.weather.com | 303 | Weather apps/widgets |
+| connectivitycheck.gstatic.com | 83 | Android TV connectivity check |
+| google.com | 121 | Basic connectivity |
+| ota.nvidia.com | 64 | Shield TV system updates |
+| api.ring.com | 143 | Ring doorbell |
+| graph.facebook.com | 80 | Facebook/Instagram |
+
+### The connectivity kill chain
+
+1. Android TV queries `connectivitycheck.gstatic.com`
+2. Pi-hole follows CNAME → `some-host.l.google.com`
+3. `l.google.com` matches blocklist (subdomain entries)
+4. Deep CNAME inspection: entire chain → blocked
+5. Pi-hole caches status 14 (blocked)
+6. Android TV: "No internet" → disables network features
+7. Device stops making DNS queries entirely (confirmed via FTL DB: Shield TV .24 went silent after status 14 on connectivitycheck.gstatic.com)
+
+### Confirming the Shield TV case
+
+Shield TV at 192.168.50.24, Ethernet-connected:
+- Last DNS queries at 19:27 (connectivitycheck.gstatic.com = RETRIED, ota.nvidia.com = status 14)
+- Ping: 100% packet loss (IP stack unresponsive)
+- ARP: REACHABLE (Ethernet hardware alive)
+- Android TV's strict connectivity check: one failed DNS → "no internet" → gives up