Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When trying to debug some code with 'dig' I noticed that the code would return a SERVFAIL (or other configured error code) because of the EDNS in the additional section. I rewrote the code to be able to answer queries with EDNS on. Makes troubleshooting with dig much easier.
Also, reply packet handling was such that a SERFVAIL would return a few extra bytes in the packet (easy to observe with wireshark).
The code would return an A resource record also when the QTYPE was not A. I fixed that for other QTYPE SERVAIL is now returned.
Finally the domain name parsing might not terminate if the question domain name in the packet is crafted to have no nul-byte terminating it, potentially leading to DOS.
All this was fixed with rewriting some of the internal and private functions.
Fix: reply with malformed SERVFAIL packets, i.e. with an additional couple of bytes in the packet. Now: clean DNS packet boundary.
Fix: code would reply with A record also for other QTYPES. Now: will answer only A type queries,
Fix: code would return SERVAIL when EDNS was set on request (and copy all its content as extraneous packet content). Now: cleanly ignores EDNS0
Fix: Added check on parsing of QNAME to prevent potential problems with corrupt QNAMES