How to hand-write DNS messages

How to hand-write DNS messages(routley.io)

106 points by jmlr 8 years ago | 10 comments

arpa 8 years ago |

Oh how many fun things have been skipped! For example, errors in message header are a nibble. There is compression of sorts, and labels referenced by an offset. There is an unique notation of emails in the SOA records; and some domains and nameservers are just plain magic. If you set out to implement a complete DNS resolver, you are IN for a fun, fun, fun time with printouts of quite a few RFCs dating back to 1987 IIRC. But the most fun part is reading these documents and seeing a story - of networks that never came to be, of dawn of the internet, of very much constrained computers and networking equipment and the genius of the thing that still is the root of the internet as we know it even some 30 years later.

bemmu 8 years ago | |

I recently wrote a simple nonrecursive one in Python to see how many domains I could resolve per second. You quickly hit a limit when you try to use something like Google's 8.8.8.8 server too fast. If you do it recursively starting from root servers, can you go as fast as your bandwidth allows?

rosstex 8 years ago | | |

I don't think you can give a recursive query to a root server.

userbinator 8 years ago |

Writing a simple DNS resolver is a common assignment in networking courses, and I do recommend it --- keeping in mind that the protocol was designed to work on machines with a fraction of the memory and CPU power as those today, helps understanding some of the otherwise odd design decisions; for example, requests and replies have the same format and header to allow the same buffer to be reused for both receiving the request and sending the reply. The QCLASS is another field from a time when people thought DNS would be used for networks other than the Internet.

A minor correction: DNS deals only with the hostname or authority component of the URL, so any mention of "URL encoding" doesn't make sense in this context.

tcprst 8 years ago | |

I'd say any mention of URL should be avoided for the sake of confusion.

I can't count the number of times I've been asked by a developer running a web server on a random port to "make sure to include the port" on the A record I'm adding.

feelin_googley 8 years ago | |

"The QCLASS is another field from a time when people thought DNS would be used for networks other than the Internet."

Depending on how one reads the RFC, it appears that the "sophomoric"1 compression scheme, which has been the source of numerous exploits/vulnerabilities in DNS software, also related to this thought about other classes besides Internet (IN). In the section on compression, RFC 1035 says that "pointers can be used where the format of the RR is not class specific."

1 https://news.ycombinator.com/item?id=503120

But in practice, are the RRs in todays DNS packets class nonspecific? Other than IN and CH (sometimes used for testing), are there other classes that todays DNS software can be expected to handle? Do todays queries almost always fall into the same type (IN)? How many query classes are there?2

2 https://www.iana.org/assignments/dns-parameters/dns-paramete...

Note even support for the "ANY" class has been the source of controversy.

Compression is what makes writing DNS software more difficult than it needs to be. However, according to one authors reading of the RFC, compression is only "required" in recursive DNS servers, not authoritative ones.3

3 https://cr.yp.to/djbdns/notes.html

"DNS, however, was not designed by experienced programmers."

This is another reason I prefer using local and remote authoritative servers versus open shared resolvers/recursive caches, such as the ones run by third parties such as Google, Cisco or various ISPs.

No (sophomoric) compression needed. Whatever the reason was for having a method of compression in DNS packets4, I personally do not need it.

4 The blog post: "QDCOUNT: An unsigned 16 bit integer specifying the number of entries in the question section. We'll be sending 1 question."

Take a guess what would happen if he sent more than one question. The RFC just says the qdcount is "usually" one.

RFC 1035 is written for a future that never happened. (For better or worse.)

jsjohnst 8 years ago | |

I was going to post complaining about that very point. Any discussion of URL is irrelevant and misleading in the context of raw DNS queries for beginners. I think the author incorrectly assumes domain name is interchangeable with URL for some reason.