openziti / edge

Application-embedded connectivity and zero-trust components
Apache License 2.0
75 stars 19 forks source link

domain name resolver is case-sensitive #275

Closed qrkourier closed 3 years ago

qrkourier commented 4 years ago

Domain names are not case-sensitive, and popular tools like HTTPie squash case which will surface the case-sensitivity of the built-in resolver in ziti-tunnel for Linux v0.15.2.

Only the case-sensitive query is answered affirmatively.

❯ dig kbSvc_MDk4MTAx.netfoundry

; <<>> DiG 9.16.1-Ubuntu <<>> kbSvc_MDk4MTAx.netfoundry
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65459
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;kbSvc_MDk4MTAx.netfoundry.     IN      A

;; ANSWER SECTION:
kbSvc_MDk4MTAx.netfoundry. 60   IN      A       169.254.1.51

;; Query time: 0 msec
;; SERVER: 127.0.0.123#53(127.0.0.123)
;; WHEN: Tue Aug 11 10:23:15 EDT 2020
;; MSG SIZE  rcvd: 84

❯ dig kbsvc_mdk4mtax.netfoundry

; <<>> DiG 9.16.1-Ubuntu <<>> kbsvc_mdk4mtax.netfoundry
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 56812
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;kbsvc_mdk4mtax.netfoundry.     IN      A

;; Query time: 0 msec
;; SERVER: 127.0.0.123#53(127.0.0.123)
;; WHEN: Tue Aug 11 10:23:22 EDT 2020
;; MSG SIZE  rcvd: 43
qrkourier commented 4 years ago

Reproduced in 0.15.3

andrewpmartinez commented 3 years ago

@scareything can you review this and determine if this should remain open? Either comment or close.

scareything commented 3 years ago

This is still an issue. https://github.com/openziti/edge/tree/tunnel.dns.tolower should fix but I have not tested.

qrkourier commented 3 years ago

Should built-in nameservers also ignore case?

scareything commented 3 years ago

@qrkourier I'm probably missing the point of your question, but I think the answer is "yes". The branch that I linked above changes ziti-tunnel's built-in name server to always deal with lower-case names.

qrkourier commented 3 years ago

FYI I am able to reproduce case-sensitive domain names in 0.20.2.