Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a proper --all-nameservers implementation #485

Merged
merged 29 commits into from
Dec 18, 2024
Merged

Conversation

phillip-stephens
Copy link
Contributor

@phillip-stephens phillip-stephens commented Dec 16, 2024

Resolves #352 , #302, and #362

Overview

image
  1. Starting with the set of all root nameservers, query all nameservers with an NS query and collect their responses.
  2. From these responses, gather the next layer's unique nameservers
  3. Query the next layer's nameservers. Repeat steps 1-3 until we no longer get any new new servers (are at the leaf nodes)
  4. Do one final query with the caller's query type to the set of leaf nameservers

This allows us to handle cases where the leaf nameservers store additional nameservers for the given domain, as was pointed out in #352 with dumalinao.gov.ph.

Limitations

  • Cannot handle CNAMEs where the names point to by the CNAME is in a different zone. In this way, we'd be similar to dig +trace
$ dig -t A cname-chain-10.zdns-testing.com +trace +nodnssec  

; <<>> DiG 9.10.6 <<>> -t A cname-chain-10.zdns-testing.com +trace +nodnssec
;; global options: +cmd
.                       506109  IN      NS      f.root-servers.net.
.                       506109  IN      NS      j.root-servers.net.
.                       506109  IN      NS      b.root-servers.net.
.                       506109  IN      NS      c.root-servers.net.
.                       506109  IN      NS      g.root-servers.net.
.                       506109  IN      NS      a.root-servers.net.
.                       506109  IN      NS      k.root-servers.net.
.                       506109  IN      NS      d.root-servers.net.
.                       506109  IN      NS      h.root-servers.net.
.                       506109  IN      NS      i.root-servers.net.
.                       506109  IN      NS      m.root-servers.net.
.                       506109  IN      NS      l.root-servers.net.
.                       506109  IN      NS      e.root-servers.net.
;; Received 823 bytes from 192.168.254.254#53(192.168.254.254) in 24 ms

com.                    172800  IN      NS      f.gtld-servers.net.
com.                    172800  IN      NS      k.gtld-servers.net.
com.                    172800  IN      NS      c.gtld-servers.net.
com.                    172800  IN      NS      i.gtld-servers.net.
com.                    172800  IN      NS      e.gtld-servers.net.
com.                    172800  IN      NS      g.gtld-servers.net.
com.                    172800  IN      NS      h.gtld-servers.net.
com.                    172800  IN      NS      b.gtld-servers.net.
com.                    172800  IN      NS      d.gtld-servers.net.
com.                    172800  IN      NS      a.gtld-servers.net.
com.                    172800  IN      NS      j.gtld-servers.net.
com.                    172800  IN      NS      m.gtld-servers.net.
com.                    172800  IN      NS      l.gtld-servers.net.
;; Received 859 bytes from 202.12.27.33#53(m.root-servers.net) in 81 ms

zdns-testing.com.       172800  IN      NS      ns-cloud-c1.googledomains.com.
zdns-testing.com.       172800  IN      NS      ns-cloud-c2.googledomains.com.
zdns-testing.com.       172800  IN      NS      ns-cloud-c3.googledomains.com.
zdns-testing.com.       172800  IN      NS      ns-cloud-c4.googledomains.com.
;; Received 354 bytes from 192.42.93.30#53(g.gtld-servers.net) in 42 ms

cname-chain-10.zdns-testing.com. 300 IN CNAME   cname-chain-11.esrg.stanford.edu.
;; Received 106 bytes from 216.239.36.108#53(ns-cloud-c3.googledomains.com) in 34 ms

We don't currently have the CNAME following as you would have with the normal --iterative mode

$ dig -t A cname-chain-10.zdns-testing.com +nodnssec  

;; ANSWER SECTION:
cname-chain-10.zdns-testing.com. 187 IN CNAME   cname-chain-11.esrg.stanford.edu.
cname-chain-11.esrg.stanford.edu. 83935 IN CNAME cname-chain-12.zdns-testing.com.
cname-chain-12.zdns-testing.com. 187 IN A       1.2.3.4

Testing

Sanity-checked with test domains - example.com, google.com, zdns-testing.com, and dumalinao.gov.ph (per #352)

Ran larger scan with decent success rate -

00h:02m:01s; Scan Complete; 1000 names scanned; 8.25 names/sec; 91.9% success rate; NOERROR: 919, ERROR: 45, TIMEOUT: 36

Github Gist for example.com

@phillip-stephens phillip-stephens linked an issue Dec 18, 2024 that may be closed by this pull request
@phillip-stephens phillip-stephens marked this pull request as ready for review December 18, 2024 18:47
@phillip-stephens phillip-stephens requested a review from a team as a code owner December 18, 2024 18:47
@zakird zakird merged commit bf4aac1 into main Dec 18, 2024
3 checks passed
@zakird zakird deleted the phillip/362-all-nameservers branch December 18, 2024 19:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants