Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

options to bypass domain validation? #2009

Open
ibigbug opened this issue Aug 27, 2023 · 3 comments
Open

options to bypass domain validation? #2009

ibigbug opened this issue Aug 27, 2023 · 3 comments

Comments

@ibigbug
Copy link
Contributor

ibigbug commented Aug 27, 2023

I was able to build a "bad name" with rr::Name::from_str_relaxed for example: some_domain.understore

however when I use the client to exchange the message I got this error

proto error: Label contains invalid characters: Err(Errors { invalid_mapping, disallowed_by_std3_ascii_rules })

does it mean the client is validating the domain and failing with invalid char - is there a way to bypass the validation?

@djc
Copy link
Collaborator

djc commented Aug 28, 2023

This looks like an error from the idna crate. I'm not sure why/where that gets invoked, though. Can you provide some sample code for how your Name is passed to the client code you mention?

@ibigbug
Copy link
Contributor Author

ibigbug commented Aug 30, 2023

hi @djc thanks for you response. actually I was being misleading - I had two implementations of my DNS client and the manual crafting with bad names is actually working fine.

and the error was actually returned by the default system client, and the minimum repro is :

      let resolver = TokioAsyncResolver::tokio_from_system_conf().unwrap();
        let response = resolver.lookup_ip("some_under_store.com").await;
        assert!(response.is_err());
        assert_eq!(
            response.unwrap_err().to_string(),
            "proto error: Label contains invalid characters: Err(Errors { invalid_mapping, disallowed_by_std3_ascii_rules })"
        );

and looking at the options here https://docs.rs/trust-dns-resolver/latest/trust_dns_resolver/config/struct.ResolverOpts.html

I also don't see it's able to bypass the validation - any thoughts?

@djc
Copy link
Collaborator

djc commented Aug 31, 2023

So AsyncResolver::lookup_ip() takes an impl IntoName. If you use Name::from_str_relaxed() and then pass the result into lookup_ip(), I think this will work?

See also discussion in #1904, and if you want to help with #1919 that would be great, too!

fabian-z added a commit to fabian-z/mail-auth that referenced this issue Dec 19, 2023
This allows DNS labels used for lookups to contain underscores,
which may not be allowed as host names.

Prevents false TempError result, which masks underlying
"proto error: Label contains invalid characters: Err(Errors
{ invalid_mapping, disallowed_by_std3_ascii_rules })"

See also hickory-dns/hickory-dns#1904
hickory-dns/hickory-dns#2009
fabian-z added a commit to fabian-z/mail-auth that referenced this issue Dec 19, 2023
This allows DNS labels used for lookups to contain underscores,
which may not be allowed as host names.

Prevents false TempError result, which masks underlying
"proto error: Label contains invalid characters: Err(Errors
{ invalid_mapping, disallowed_by_std3_ascii_rules })"

See also hickory-dns/hickory-dns#1904
hickory-dns/hickory-dns#2009
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants