search

cunnie / sslip.io

Golang-based DNS server which maps DNS records with embedded IP addresses to those addresses.
Apache License 2.0
646 stars 77 forks source link

Illegal domain name #30

Closed asdfjkluiop closed 1 year ago

asdfjkluiop commented 1 year ago

I noticed when looking up a PTR for 2001:db8:: I get an error from dig saying illegal IDNA2008 name because it starts/ends with a -. I'm not sure how much of a problem this is in the real world or if it's just dig that cares but a potential solution would be appending a 0 to the end so the return is 2001-db8--0.sslip.io. This would make the name legal while not changing its meaning. A similar problem is present with ::1 although at the start rather than the end.

cunnie commented 1 year ago

Could you please show the exact commands you typed and the exact output you got? I'm not quite sure I understand what you're seeing.

asdfjkluiop commented 1 year ago

dig -x 2001:db8:: @ns-aws.sslip.io or dig -x ::1 @ns-aws.sslip.io. Anything that starts or ends with a ::. I get the following output

; <<>> DiG 9.18.16-1-Debian <<>> -x 2001:db8:: @ns-aws.sslip.io
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34434
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
dig: '2001-db8--.sslip.io.' is not a legal IDNA2008 name (string start/ends with forbidden hyphen), use +noidnout
cunnie commented 1 year ago

Yup, dig is right, '2001-db8--.sslip.io.' is not a legal name. Thanks for pointing that out. Maybe prefixing/postfixing a 0 is the best way. I'll think about it. In the meantime, I'm gonna close this ticket.

cunnie commented 1 year ago

You know what's weird? dig's behavior, at least on Fedora 38, which fails when run on my terminal, but not when run with its output redirected, which makes the failure hard to surface in my integration tests. tl;dr I turns out all I had to was read the dig man page:

+idnout, +noidnout
   This  option  converts  [or  does  not convert] puny code on output. This requires IDN SUPPORT to have been enabled at compile
   time.

   The default is to process puny code on output **when standard output is a tty**. The puny code processing on  output  is  disabled
   when dig output is redirected to files, pipes, and other non-tty file descriptors.

The following command will exit 10 and return an error message:

dig @ns.sslip.io -x :: +short
  /usr/bin/dig: '--.sslip.io.' is not a legal IDNA2008 name (string start/ends with forbidden hyphen), use +noidnout

But if you pipe it to cat, its behavior changes: it will exit 0 and return the name being looked up:

dig @ns.sslip.io -x :: +short | cat
--.sslip.io.

This presents a challenge to me because I use integration tests, and i can't get dig to fail.

asdfjkluiop commented 1 year ago

...oh...interesting. That's...an odd behavior dig has there...well that makes sense why it was never caught