Re: [DNSOP] Clarification question: compression pointers always to names earlier in the packet?

Tony Finch <dot@dotat.at> Wed, 24 October 2018 17:29 UTC

Return-Path: <dot@dotat.at>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B7CC129619 for <dnsop@ietfa.amsl.com>; Wed, 24 Oct 2018 10:29:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Level:
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FXdcf-bkINd2 for <dnsop@ietfa.amsl.com>; Wed, 24 Oct 2018 10:29:55 -0700 (PDT)
Received: from ppsw-33.csi.cam.ac.uk (ppsw-33.csi.cam.ac.uk [131.111.8.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D0181288BD for <dnsop@ietf.org>; Wed, 24 Oct 2018 10:29:54 -0700 (PDT)
X-Cam-AntiVirus: no malware found
X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus
Received: from grey.csi.cam.ac.uk ([131.111.57.57]:40084) by ppsw-33.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.139]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1gFMye-000MMK-im (Exim 4.91) for dnsop@ietf.org (return-path <dot@dotat.at>); Wed, 24 Oct 2018 18:29:52 +0100
Date: Wed, 24 Oct 2018 18:29:52 +0100
From: Tony Finch <dot@dotat.at>
To: dnsop <dnsop@ietf.org>
In-Reply-To: <20181024165452.GM983@straasha.imrryr.org>
Message-ID: <alpine.DEB.2.20.1810241802090.24450@grey.csi.cam.ac.uk>
References: <BC2CDF40-4FF0-4111-88B7-04969491D2E0@dukhovni.org> <CAJhMdTONFZ=DRvLscUdiUF6e1ZfUM2DsuRjpWLt+9wUL+4MOSQ@mail.gmail.com> <20181024165452.GM983@straasha.imrryr.org>
User-Agent: Alpine 2.20 (DEB 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/Du3AyZT8YuJ3-g9dN-ELQfeIwOI>
Subject: Re: [DNSOP] Clarification question: compression pointers always to names earlier in the packet?
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 24 Oct 2018 17:29:57 -0000

Viktor Dukhovni <ietf-dane@dukhovni.org> wrote:
>
>     c.  The most recent pointer expands to a domain that moves
>         past the location of the pointer, without arriving at that
>         pointer, because it is just part of the data of some label.
>         For example:
>
>            ... 10 05 l a r r y 10 m o e  NNN MMM     c u r l y [...]
>               | initial length 10 label |ptr 10 back|
>                  |len 5 label |len 10 pointer-skipping label |
>
>         yielding the domain name:
>
> 		\005larry\010moe.larry.moe\NNN\MMMcurly.[...]

That's disgusting :-)

The high-water-mark algorithm forbids it, though, because the "ptr 10
back" does not go back before the HWM, which is the initial octet
with value 10. (BIND and Net::DNS use the HWM algorithm, for example.)

But you can pull a similar overlap trick if you reach back a little
further, like this:

	#!/usr/bin/perl
	use Net::DNS;
	my $buffer = "\x06\x03foo\xc0\x00\x03bar\x00";
	my $dn = decode Net::DNS::DomainName (\$buffer, 1);
	printf "%s\n", $dn->string;

output is:

	foo.\003foo\192\000.bar.

Tony.
-- 
f.anthony.n.finch  <dot@dotat.at>  http://dotat.at/
Humber: West or northwest 4 or 5, occasionally 6 until later. Moderate or
rough. Mainly fair. Moderate or good.