Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Skip result of TLSA lookups for bad nameservers #13

Open
buffrr opened this issue Apr 26, 2021 · 0 comments
Open

Skip result of TLSA lookups for bad nameservers #13

buffrr opened this issue Apr 26, 2021 · 0 comments
Labels
enhancement New feature or request

Comments

@buffrr
Copy link
Owner

buffrr commented Apr 26, 2021

Some nameservers timeout or return SERVFAIL for any record type they don't understand

An example of such a server found in the wild (at the time of writing)

dig @dns1.tribpub.com _443._tcp.www.chicagotribune.com tlsa

This nameserver doesn't even understand DNSSEC, but a recursive DNSSEC resolver will return SERVFAIL in this case which is not an acceptable answer for DANE and the website breaks.

A DANE client should not expect that all nameservers will answer reliably for the TLSA record type.

To avoid breaking services that use such nameservers, we should:

  • Determine if either A or AAAA records of the host are in a DNSSEC-signed zone
  • If the zone is unsigned, it's safe to skip result of the TLSA lookup without risking a downgrade attack.

Credits to @vdukhovni for telling me about this idea
@buffrr buffrr added the enhancement New feature or request label Apr 26, 2021
@buffrr buffrr changed the title Skip TLSA lookups for bad nameservers Skip result of TLSA lookups for bad nameservers Apr 26, 2021
buffrr added a commit that referenced this issue May 8, 2021
@buffrr
Update resolver interface
5386654 
* Pass ctx to resolver functions
* Allow specifying network ip, ip4 or ip6 similar to Go's built-in resolver
* Return security status of ip lookups (needed for issue #13)
* Use a common implemenation for lookup ip/tlsa in recursive and stub resolvers
* Use more suitable names
* Add more tests
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@buffrr