This is a little disturbing; nsd is kind of a big deal, and afl on zone files is a pretty basic test to run. Kudos to the author for doing it, but why haven't the authors of nsd done it already, and what else haven't they done?
There is really no good reason for DNS servers to be written in C anymore.
We still need an AXFR, IXFR, or replication solution.
Also, I haven’t had time to fuzz the zone parsers, so I can’t guarantee we’re resilient to the above yet, but the packet parsers are getting pretty widely used across multiple Rust projects now through the trust-dns-resolver library.
Nothing. Depends on the mode of operation we want to support. I want to support that, but we need to add some signal handling (or similar mechanism) to properly reload configs after an raunchy is done.
I fuzzed a few zone file parsers several years ago, but to find the differences between implementations rather than crashes.
The problem is the format is really poorly specified, has been refined over about 10 RFCs, and still riddled with ambiguities. Every implementation out there handles things slightly differently.
I'll just dump some notes I wrote at the time, containing a list of RFCs and some findings, to gist:
8 comments
[ 3.4 ms ] story [ 23.6 ms ] threadThere is really no good reason for DNS servers to be written in C anymore.
I’m a little behind on docs, but we have a pretty decent start on one in Rust: https://github.com/bluejekyll/trust-dns
We still need an AXFR, IXFR, or replication solution.
Also, I haven’t had time to fuzz the zone parsers, so I can’t guarantee we’re resilient to the above yet, but the packet parsers are getting pretty widely used across multiple Rust projects now through the trust-dns-resolver library.
Right now a restart would be required.
I fuzzed a few zone file parsers several years ago, but to find the differences between implementations rather than crashes.
The problem is the format is really poorly specified, has been refined over about 10 RFCs, and still riddled with ambiguities. Every implementation out there handles things slightly differently.
I'll just dump some notes I wrote at the time, containing a list of RFCs and some findings, to gist:
https://gist.github.com/nlyan/2a958fa476182e1b07955a945f0d70...