c-ares / c-ares / #1139

92%

Build Type

push

travis-ci

Committed by web-flow

Commit Message

DNS 0x20 implementation (#800)

This PR enables DNS 0x20 as per
https://datatracker.ietf.org/doc/html/draft-vixie-dnsext-dns0x20-00 .
DNS 0x20 adds additional entropy to the request by randomly altering the
case of the DNS question to help prevent cache poisoning attacks.

Google DNS has implemented this support as of 2023, even though this is
a proposed and expired standard from 2008:
https://groups.google.com/g/public-dns-discuss/c/KxIDPOydA5M

There have been documented cases of name server and caching server
non-conformance, though it is expected to become more rare, especially
since Google has started using this.

This can be enabled via the `ARES_FLAG_DNS0x20` flag, which is currently
disabled by default. The test cases do however enable this flag to
validate this feature.

Implementors using this flag will notice that responses will retain the
mixed case, but since DNS names are case-insensitive, any proper
implementation should not be impacted.

There is currently no fallback mechanism implemented as it isn't
immediately clear how this may affect a stub resolver like c-ares where
we aren't querying the authoritative name server, but instead an
intermediate recursive resolver where some domains may return invalid
results while others return valid results, all while querying the same
nameserver. Likely using DNS cookies as suggested by #620 is a better
mechanism to fight cache poisoning attacks for stub resolvers.

TCP queries do not use this feature even if the `ARES_FLAG_DNS0x20` flag
is specified since they are not subject to cache poisoning attacks.

Fixes Issue: #795 
Fix By: Brad House (@bradh352)

Run Details

83 of 97 new or added lines in 5 files covered. (85.57%)

5 existing lines in 3 files now uncovered.

9137 of 10262 relevant lines covered (89.04%)

4539.92 hits per line