3 ms·

"Let's build a DNS parser that's spec compliant" is something that only insane people would say. I dare to argue it's an impossible task at this point. Having t

"Let's build a DNS parser that's spec compliant" is something that only insane people would say. I dare to argue it's an impossible task at this point. Having to read dozens of RFCs just to find out what's been deprecated and what's been added is really not a good way to implement code and tests :D Especially with the typical problems that come with naive implementations that cannot deal with malformed truncated packets or pointer loops (stack overflows/buffer overflows) in compressed packets. And I am not even scratching DNS cookies or newer DNS record types here, which as you said is another deep rabbit hole.

spc476 2y ago
I wrote a DNS parser [1], and I gave up trying to decode every RR type. I've mostly stuck to the non-crypto records, and while I have support for a number of obsolete and experimental record types, it was easy to parse them as a lot of RRs share the same format. [1] https://github.com/spc476/SPCDNS https://github.com/spc476/SPCDNS
potentialstyx 2y ago
> "Let's build a DNS parser that's spec compliant" is something that only insane people would say. I dare to argue it's an impossible task at this point. Having worked on a toy RFC1035 DNS parser from scratch (I had written a DNS server once before, but I wouldn't even consider it a toy server) over the last few months[0], I can agree that it would be a very hard task to write a fully spec compliant DNS parser, but not that it would be anywhere near impossible. Documentation is scarce, but if you look hard enough it can be found. Finding out whats been deprecated does require reading a lot of RFCs but the IETF Datatracker site makes it easy to find any of those update RFCs and errata. While I didn't implement parsers for that many individual RR types a lot of them could be reused, since many RR types share the same format. Also if you are just writing a recursive resolver then you don't really need to actually parse every kind of RR type, you can just blindly forward most of them. Dealing with malformed/truncated packets is a pain to figure out, but not that hard to do, in my opinion, once you think over all the possible ways a packet could be malformed. Seeing how Ladybird[1] has basically proven the "Building a browser from scratch is impossible" crowd wrong, I'm sure that some project could come around and do the same for DNS. [0] https://github.com/PotentialStyx/dns-server https://github.com/PotentialStyx/dns-server [1] https://ladybird.org/ https://ladybird.org/

spc476 2y ago

I wrote a DNS parser [1], and I gave up trying to decode every RR type. I've mostly stuck to the non-crypto records, and while I have support for a number of obsolete and experimental record types, it was easy to parse them as a lot of RRs share the same format. [1] https://github.com/spc476/SPCDNS https://github.com/spc476/SPCDNS

potentialstyx 2y ago

> "Let's build a DNS parser that's spec compliant" is something that only insane people would say. I dare to argue it's an impossible task at this point. Having worked on a toy RFC1035 DNS parser from scratch (I had written a DNS server once before, but I wouldn't even consider it a toy server) over the last few months[0], I can agree that it would be a very hard task to write a fully spec compliant DNS parser, but not that it would be anywhere near impossible. Documentation is scarce, but if you look hard enough it can be found. Finding out whats been deprecated does require reading a lot of RFCs but the IETF Datatracker site makes it easy to find any of those update RFCs and errata. While I didn't implement parsers for that many individual RR types a lot of them could be reused, since many RR types share the same format. Also if you are just writing a recursive resolver then you don't really need to actually parse every kind of RR type, you can just blindly forward most of them. Dealing with malformed/truncated packets is a pain to figure out, but not that hard to do, in my opinion, once you think over all the possible ways a packet could be malformed. Seeing how Ladybird[1] has basically proven the "Building a browser from scratch is impossible" crowd wrong, I'm sure that some project could come around and do the same for DNS. [0] https://github.com/PotentialStyx/dns-server https://github.com/PotentialStyx/dns-server [1] https://ladybird.org/ https://ladybird.org/