News for hackers. Stuff that matters.
Re:A toy DNS resolver by charcircuit on Tuesday February 01, 2022 @05:52PM (#30170746)
So what happens when there is a cycle in the graph? Does it just DoS the resolver?
Re:A toy DNS resolver by tptacek on Tuesday February 01, 2022 @07:30PM (#30171873)
I think a more typically structured recursive resolver is built around a read-through cache structure. Each step of the query asks the cache for more records, which you may or may not already have fetched; if you have, they're just served from the cache.
Re:A toy DNS resolver by Groxx on Tuesday February 01, 2022 @10:21PM (#30173270)
That's describing how a cache hit stops the cycle, not how a cache miss doesn't encounter one.
Re:A toy DNS resolver by atomicnumber3 on Wednesday February 02, 2022 @12:38AM (#30174152)
The standards tell you specifically to handle not going into infinite resolving loops and such.
Re:A toy DNS resolver by Groxx on Wednesday February 02, 2022 @02:25PM (#30182678)
So "Q: how do you handle resolver loops?" is "A: you handle them."?

I mean, probably true and accurate for many things. But if so that's not really a standard for how to handle it. It just means that, to be compliant, you need to figure it out and doing something about it.

Re:A toy DNS resolver by tptacek on Tuesday February 01, 2022 @11:11PM (#30173622)
It's why a cycle doesn't just DOS the server.
Re:A toy DNS resolver by Groxx on Wednesday February 02, 2022 @12:03AM (#30173932)
Er. Not with that explanation. The cache won't be hit until a result is found, instead each request produces another request back to through the cycle to try to get that request. Hence DoS.
Re:A toy DNS resolver by zamadatix on Tuesday February 01, 2022 @06:43PM (#30171417)
In this implementation yes, in a full implementation the standards expect the client to handle multiple different scenarios that can result in loops as an error.
Re:A toy DNS resolver by hngpt2 on Wednesday February 02, 2022 @05:20AM (#30175793)
A query on a localhost name server is processed in a matter of milliseconds, so it's really not going to cause a DoS. When you put your name server on the public internet, it becomes a network address, which you can only get from an authoritative source. But even then, the response is going to be processed by a DNS query processor before it is handed over to your application layer, so you're going to see that it's processed before it is presented to the end user.