5 ms·

When I wrote my DNS parser [1], I set a follow limit. I'm not sure how viable it would be to limit the pointers to earlier in the packet would be. [1] https://

by spc476 5y ago

When I wrote my DNS parser [1], I set a follow limit. I'm not sure how viable it would be to limit the pointers to earlier in the packet would be. [1] https://github.com/spc476/SPCDNS https://github.com/spc476/SPCDNS

ate53 5y ago
It's a viable strategy. No legitimate implementation produces compression pointers that go anywhere other than backwards. I track the start of a label sequence and whether I've followed a pointer. If I've just followed a pointer, I must be at a point earlier than the last start, or I consider it a malicious name. I also disallow pointers to pointers but I'm less confident that there's not something out there that does that.
- spc476 5y ago
  So, using () as a marker for the length of a label, and (^name) for a label pointer, how do you handle ()a()b(^b) The pointer goes backwards, but it doesn't go back to the start of a label sequence. So do you track the start of each label? Or just the start of each domain name? Edit: nevermind, I see what you are doing.
acuozzo 5y ago
One thing I noticed while using your code as a reference for a project I worked on several weeks ago is that it doesn't record the state before following the pointer, so unless the pointer you follow eventually leads to another pointer that brings it back to where you were, you can't simulate recursion. I'm referring to lines 1286-1288 in codec.c, FWIW. Obviously, you only need to support jumping back per RFC1035 and your code supports both jumping back AND forward, so I'm just telling you this for idle chitchat and so that you know that your code was helpful and I appreciate you putting it out there. Thanks! Edit: Also, before I forget, this implementation uses recursion even though it's not necessary. https://github.com/google/gopacket/blob/3eaba08943250fd212520e5cff00ed808b8fc60a/layers/dns.go#L538 https://github.com/google/gopacket/blob/3eaba08943250fd21252... Between your code, the one linked to above, and djbdns I was totally confused about what the "right" way is. I eventually read RFC1035 and saw that all of your approaches are correct. Edit 2: Also, DJB has some choice words about the compression scheme. https://github.com/abh/djbdns/blob/0715ca5de14ad5eae2c779c536beee2ef56d07a2/dns_packet.c#L2 https://github.com/abh/djbdns/blob/0715ca5de14ad5eae2c779c53...
- spc476 5y ago
  Thank you. Using recursion didn't even occur to me (and in some places, recursion is verboten, along with memory allocation). As for DJB's comment, while I can agree in general, it seems that the DEFLATE algorithm was documented significantly after DNS (RFC-1950 and RFC-1035).
  - acuozzo 5y ago
    > and in some places, recursion is verboten, along with memory allocation) Indeed. This was the case for my project at work. With that being said, one can always hand-roll recursion with iteration by pushing the state onto their own local stack. I have done this several times on a 6502.

by spc476 5y ago

ate53 5y ago

It's a viable strategy. No legitimate implementation produces compression pointers that go anywhere other than backwards. I track the start of a label sequence and whether I've followed a pointer. If I've just followed a pointer, I must be at a point earlier than the last start, or I consider it a malicious name. I also disallow pointers to pointers but I'm less confident that there's not something out there that does that.

spc476 5y ago
So, using () as a marker for the length of a label, and (^name) for a label pointer, how do you handle ()a()b(^b) The pointer goes backwards, but it doesn't go back to the start of a label sequence. So do you track the start of each label? Or just the start of each domain name? Edit: nevermind, I see what you are doing.

acuozzo 5y ago

One thing I noticed while using your code as a reference for a project I worked on several weeks ago is that it doesn't record the state before following the pointer, so unless the pointer you follow eventually leads to another pointer that brings it back to where you were, you can't simulate recursion. I'm referring to lines 1286-1288 in codec.c, FWIW. Obviously, you only need to support jumping back per RFC1035 and your code supports both jumping back AND forward, so I'm just telling you this for idle chitchat and so that you know that your code was helpful and I appreciate you putting it out there. Thanks! Edit: Also, before I forget, this implementation uses recursion even though it's not necessary. https://github.com/google/gopacket/blob/3eaba08943250fd212520e5cff00ed808b8fc60a/layers/dns.go#L538 https://github.com/google/gopacket/blob/3eaba08943250fd21252... Between your code, the one linked to above, and djbdns I was totally confused about what the "right" way is. I eventually read RFC1035 and saw that all of your approaches are correct. Edit 2: Also, DJB has some choice words about the compression scheme. https://github.com/abh/djbdns/blob/0715ca5de14ad5eae2c779c536beee2ef56d07a2/dns_packet.c#L2 https://github.com/abh/djbdns/blob/0715ca5de14ad5eae2c779c53...

spc476 5y ago
Thank you. Using recursion didn't even occur to me (and in some places, recursion is verboten, along with memory allocation). As for DJB's comment, while I can agree in general, it seems that the DEFLATE algorithm was documented significantly after DNS (RFC-1950 and RFC-1035).
- acuozzo 5y ago
  > and in some places, recursion is verboten, along with memory allocation) Indeed. This was the case for my project at work. With that being said, one can always hand-roll recursion with iteration by pushing the state onto their own local stack. I have done this several times on a 6502.