LWN.net Logo

Potential pitfalls in DNS handling

Potential pitfalls in DNS handling

Posted Nov 16, 2012 18:21 UTC (Fri) by hawk (subscriber, #3195)
Parent article: Potential pitfalls in DNS handling

Overall, nicely put together article. However, I think this particular section is problematic:

"Many believe that domain and host names are restricted to certain subsets of characters, but that is not true. As RFC 2181 specifies, the limits are purely length-based (63 octets per component, 255 octets for a domain name)."

The problem with that reasoning is that it implies that RFC2181 defines anything else than what the DNS protocol can carry.

In fact, the RFC goes out of its way pointing out that DNS is general purpose and that different applications will want different rules for what names are acceptable. From the "Name syntax" section (http://tools.ietf.org/html/rfc2181#section-11):

" Occasionally it is assumed that the Domain Name System serves only
the purpose of mapping Internet host names to data, and mapping
Internet addresses to host names. This is not correct, the DNS is a
general (if somewhat limited) hierarchical database, and can store
almost any kind of data, for almost any purpose."

...description of what the DNS protocol can carry...

" Note however, that the various applications that make use of DNS data
can have restrictions imposed on what particular values are
acceptable in their environment. For example, that any binary label
can have an MX record does not imply that any binary name can be used
as the host part of an e-mail address. Clients of the DNS can impose
whatever restrictions are appropriate to their circumstances on the
values they use as keys for DNS lookup requests, and on the values
returned by the DNS. If the client has such restrictions, it is
solely responsible for validating the data from the DNS to ensure
that it conforms before it makes any use of that data."


(Log in to post comments)

Potential pitfalls in DNS handling

Posted Nov 16, 2012 23:50 UTC (Fri) by Comet (subscriber, #11646) [Link]

Yes; so when you perform a reverse DNS lookup, which can return arbitrary data, it is thus your responsibility, as an application using DNS, to enforce restrictions upon that value.

If the reverse DNS for an IP contains \r\n and you emit the IP to your logs, make sure you understand what is escaped where, to ensure that your logs don't have arbitrary records injected via DNS data.

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds