robur-coop / udns Goto Github PK

[deprecated, developmeht moved to https://github.com/mirage/ocaml-dns] µDNS - an opinionated Domain Name System (DNS) library

License: BSD 2-Clause "Simplified" License

OCaml 100.00%

ocaml dns dns-server mirageos unikernel tsig robur

udns's Introduction

µDNS - an opinionated Domain Name System (DNS) library

%%VERSION%%

µDNS supports most of the domain name system used in the wild. It adheres to strict conventions. Failing early and hard. It is mostly implemented in the pure fragment of OCaml (no mutation, isolated IO, no exceptions).

It all started out as an experiment to run a recursive resolver, but after initial prototypes it turned out that every configurable recursive resolver needs a fully-fledged authoritative nameserver as well (for overriding various zones such as .localhost and reverse lookups of RFC 1918 IP ranges).

Legacy resource record types are not dealt with, and there is no plan to support ISDN, MAILA, MAILB, WKS, MB, NULL, HINFO, ... . AXFR, IXFR, and UPDATE is only handled via TCP connections. The only resource class supported is IN (the Internet). In a similar vein, wildcard records are not supported, and it is unlikely they'll ever be in this library. Truncated hmac in TSIG are not supported (always the full length of the hash algorithm is used).

Please read the blog article for a more detailed overview.

The µDNS library is published under the 2 clause BSD license.

Supported RFCs

RFC 1034 Domain Names - Concepts and Facilities
RFC 1035 Domain Names - Implementation and Specification
RFC 1912 Common DNS Operational and Configuration Errors
RFC 1995 Incremental Zone Transfer in DNS
RFC 1996 A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY)
RFC 2136 Dynamic Updates in the domain name system (DNS UPDATE)
RFC 2181 Clarifications to the DNS Specification
RFC 2308 Negative Caching of DNS Queries (DNS NCACHE)
RFC 2782 A DNS RR for specifying the location of services (DNS SRV)
RFC 2845 Secret Key Transaction Authentication for DNS (TSIG)
RFC 3596 DNS Extensions to Support IP Version 6
RFC 4034 Resource Records for the DNS Security Extensions
RFC 4255 Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints
RFC 4343 Domain Name System (DNS) Case Insensitivity Clarification
RFC 4635 HMAC SHA TSIG Algorithm Identifiers
* RFC 5001 DNS Name Server Identifier (NSID) Option
RFC 5358 Preventing Use of Recursive Nameservers in Reflector Attacks
RFC 5452 Measures for Making DNS More Resilient against Forged Answers
RFC 5936 DNS Zone Transfer Protocol (AXFR)
RFC 6594 Use of the SHA-256 Algorithm with RSA, Digital Signature Algorithm (DSA), and Elliptic Curve DSA (ECDSA) in SSHFP Resource Records
RFC 6698 The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA
RFC 6761 Special-Use Domain Names
* RFC 6762 Multicast DNS
RFC 6844 DNS Certification Authority Authorization (CAA) Resource Record
RFC 6890 Special-Purpose IP Address Registries
RFC 6891 Extension Mechanisms for DNS (EDNS(0))
RFC 6895 Domain Name System (DNS) IANA Considerations (BCP 42)
RFC 7479 Using Ed25519 in SSHFP Resource Records
RFC 7626 DNS Privacy Considerations
RFC 7766 DNS Transport over TCP - Implementation Requirements
RFC 7816 DNS Query Name Minimisation to Improve Privacy
* RFC 7828 The edns-tcp-keepalive EDNS0 Option
* RFC 7830 The EDNS(0) Padding Option
* RFC 7873 Domain Name System (DNS) Cookies
RFC 8109 Initializing a DNS Resolver with Priming Queries
draft-ietf-dnsop-let-localhost-be-localhost-02 Let 'localhost' be localhost.

*: Please note that the RFCs marked with * are only partially implemented (i.e. only wire format, but no logic handling the feature).

Installation

You first need to install OCaml (at least 4.04.0) and opam, the OCaml package manager (at least 2.0.0) on your machine (you can use opam to install an up-to-date OCaml (opam switch 4.07.1)).

You may want to follow the mirage installation instructions to get mirage installed on your computer.

To lower the amount of run-time dependencies for each individual functionality, the library is split across a number of opam packages.

µDNS is not released yet, but you can install it and its dependencies via opam, see Development.

Now the µDNS library is installed, and you can try out the examples. Find some examples at the unikernel repository.

Documentation

API documentation is available online.

Development

To work with the opam packages provided when developing modifications to µDNS, or when pinning a specific version, you will have to pin the same version for all of them:

: csh syntax
set version=2.0.0

set repo=git+https://github.com/roburio/udns.git

# the -y parameter means "force" or
# "do go ahead and register a new package"

# the -n parameter means
# "just register the pin, don't actually install it yet"

foreach pkg ( dns dns-{certify,cli,client{,-lwt,-unix}} \
              dns-mirage{,-certify,-client,-resolver,-server} \
              dns-{resolver,server,tsig,zone} )
  opam pin add -y -n $pkg.$version --dev $repo
end

: bash syntax
version=2.0.0
repo=git+https://github.com/roburio/udns.git

for pkg in dns dns-{certify,cli,client{,-lwt,-unix}} \
           dns-mirage{,-certify,-client,-resolver,-server} \
           dns-{resolver,server,tsig,zone}
do
  opam pin add -y -n $pkg.$version --dev $repo
done

Now you can install the packages you need, for instance:

opam install dns-client-lwt

opam install dns-resolver

udns's People

Contributors

Stargazers

Watchers

Forkers

avsm davidalphafox cfcs dinosaure jeremy505

udns's Issues

Client dns packet id uses Random.int

I took a shortcut here: https://github.com/roburio/udns/blob/master/client/udns_client.ml#L20

Leaving this issue here so we don't forget about it.

EDIT: Also it's off by one (should be 0x10000):

Random.int bound returns a random integer between 0 (inclusive)
and bound (exclusive). bound must be greater than 0 and less than 2^30.

online testing facilities

server side: https://ednscomp.isc.org/ednscomp https://dnscheck.ripe.net/ https://zonemaster.net/
resolver: https://cmdns.dev.dns-oarc.net/

server has atm good results :)

CNAME wildcards?

See https://groups.google.com/forum/#!topic/public-dns-discuss/M982l7Lz9uA

$ dig -t TLSA  _443._tcp.www.bartschnet.de

; <<>> DiG 9.11.5-P1-2-Debian <<>> -t TLSA _443._tcp.www.bartschnet.de
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16652
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;_443._tcp.www.bartschnet.de.	IN	TLSA

;; ANSWER SECTION:
_443._tcp.www.bartschnet.de. 3599 IN	CNAME	*._tcp.bartschnet.de.
*._tcp.bartschnet.de.	3599	IN	TLSA	1 1 1 23ECDA1BAFF3350ADE5752800A79DAC0D91A121FCE40ED0D997B123D 2863D453

;; AUTHORITY SECTION:
bartschnet.de.		21599	IN	NS	ns2.core-networks.eu.
bartschnet.de.		21599	IN	NS	ns3.core-networks.com.
bartschnet.de.		21599	IN	NS	ns1.core-networks.de.

;; Query time: 191 msec
;; SERVER: 10.137.2.1#53(10.137.2.1)
;; WHEN: Sat Mar 09 19:09:08 CET 2019
;; MSG SIZE  rcvd: 225

$ odns.exe tlsa _443._tcp.www.bartschnet.de
odns.exe: [ERROR] Failed to lookup _443._tcp.www.bartschnet.de: err: Error parsing response: bad content *._tcp.bartschnet.de

Is this something we want to handle?

Query with a huge question section can lead to crash

After trying to fuzz the primary server from the example folder with big inputs, I found some packets that could crash main.native. In this example, the culprit is a query of size 3451 that consists of many questions (https://pastebin.com/tnV0JUbR for a hexadecimal and byte representation of that packet) :

2018-07-05 16:21:20 +01:00: INF [tcpip-stack-socket] Manager: connect
2018-07-05 16:21:20 +01:00: INF [tcpip-stack-socket] Manager: configuring
2018-07-05 16:21:20 +01:00: WRN [application] no secondaries keys found (err not found  TTL 300 soa SOA foo._key-management foo._key-management 0 16384 2048 1048576 300)
2018-07-05 16:21:20 +01:00: INF [application] loaded zone: mirage.	2560	SOA	ns.mirage.hostmaster.mirage.	1	10	5	60	2560
mirage.	2560	NS	ns.mirage.
charrua.mirage.	2560	A	10.0.42.3
ns.mirage.	2560	A	10.0.42.2
resolver.mirage.	2560	A	10.0.42.5
router.mirage.	2560	A	10.0.42.1
secondary.mirage.	2560	A	10.0.42.4
www.mirage.	2560	CNAME	router.mirage.

2018-07-05 16:21:20 +01:00: INF [dns_mirage_server] DNS server listening on UDP port 53
2018-07-05 16:21:20 +01:00: INF [dns_mirage_server] DNS server listening on TCP port 53
2018-07-05 16:21:26 +01:00: INF [dns_mirage_server] udp frame from 127.0.0.1:33525
2018-07-05 16:21:26 +01:00: ERR [dns_server] 181 questions foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?, foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, foo.my.domain A?,
foo.my.domain A?, bailing
Fatal error: exception (Invalid_argument
  "invalid bounds in Cstruct.BE.set_uint16 [0,450](450) off=449 len=2")
Raised at file "format.ml" (inlined), line 242, characters 35-52
Called from file "format.ml", line 469, characters 8-33
Called from file "format.ml", line 484, characters 6-24

TL;DR : The packet is faulty according to the uDNS primary server handle function because the question section contains more than one question. The server tries to reply with an answer containing the same question section (I think it must be done for security purposes), but it creates a buffer with a shorter length, that's why that error is raised and crashes the application.

Now for a more detailed explanation (took me a really long time to figure out !). If I understood correctly :

The server allows any frame which size is under 4096 (otherwise it says ERR [dns_server] partial frame (length 4096)), so the packet goes through
UDns_server.Primary.handle is called at one point
In that call, UDns_server.Primary.handle_inner is called, which calls itself UDns_server.handle_frame
As the frame is a query-type packet, it calls UDns_server.handle_query
UDns_server.handle_query checks the question section and sees that there is more than one question, therefore it returns the rcode FormErr to UDns_server.handle_inner
UDns_server.handle_inner, seeing that it got an rcode error, calls UDns_server.err, which calls Dns_packet.error to create a reply with the same content but with the rcode set to FormErr
Dns_packet.error creates a buffer of size Dns_packet.max_reply_udp (= 450 !!) and tries to copy the initial packet into that buffer through Dns_packet.encode_query
Dns_packet.encode_query calls List.fold_left using Dns_packet.encode_question as the folding function, which shifts the offset value in the reply buffer
As 3451 is greater than 450, the final error invalid bounds is raised.

Maybe a solution would be to rise max_udp_size to 4096 ?

Queries with opcode set to Notify can crash the resolver

As the primary server seems to handle fuzz testing without any bug, I tried to fuzz the resolver, and managed to crash it (https://pastebin.com/x3UB87Mf for an example). Here is the resolver log :

2018-07-12 14:11:54 +01:00: INF [application] reacting to (from 127.0.0.1:59757) 0001 query operation Notify rcode NoError flags: : example.com A?
2018-07-12 14:11:54 +01:00: ERR [dns_server] ignoring unsolicited request
2018-07-12 14:11:54 +01:00: ERR [application] answer from authoritative is none, shouldn't happen
Fatal error: exception "Assert_failure resolver/uDns_resolver.ml:239:12"
Raised at file "string.ml", line 118, characters 19-34
Called from file "src0/sexp.ml", line 93, characters 13-47
wt269@eagle:/auto/homes/wt269/OCaml/udns/mirage/examples/resolver$

TL;DR : Queries sent with opcode set to Notify are ignored by the primary server that responds with None, to which the resolver raises an error because it doesn't expect a None answer.

For a more detailed debug, which was simpler to find than the other issue :

The resolver receives a query with the opcode set to Notify and the query flag set to true
It calls the function UDns_resolver.handle which parses correctly the packet
The packet is sent by an user so it is considered as a query by the resolver, which is coherent with the flag in the header : UDns_resolver.handle_primary is then called, which calls itself UDns_server.Primary.handle_frame
As a primary server shouldn't receive a notify+query packet, it ignores it and returns None
UDns_resovler.handle_primary, seeing that is is a None packet, calls assert false
There is no try ... with block to catch the error so the resolver crashes.

Difficulty pinning packages in development

After this was introduced in 8ad2bcc I'm struggling to pin local development branches.
Here's what I tried:

$ opam pin add -n dns --dev -k git git+https://github.com/roburio/udns.git
# ...
$ opam pin add -n dns-client --dev -k git git+https://github.com/roburio/udns.git
# ...
$ opam install dns

<><> Synchronising pinned packages ><><><><><><><><><><><><><><><><><><><><><><>
[dns.1.1.1] no changes from git+https://github.com/roburio/udns.git

[NOTE] Package dns is already installed (current version is 1.1.1).
$ opam install dns-client.1.1.1
[ERROR] Package dns-client has no version 1.1.1.
$ opam install dns-client

<><> Synchronising pinned packages ><><><><><><><><><><><><><><><><><><><><><><>
[dns-client.~dev] no changes from git+https://github.com/roburio/udns.git

Sorry, no solution found: there seems to be a problem with your request.

No solution found, exiting

My local workaround was:

$ sed -i 's/"dns"/#&/' dns-client.opam
$ opam pin add -n dns-client --dev '.'
$ opam install --working-dir dns-client

Is there a more ergonomic way to work with a development version?

ping @hannesm