
Fuzzing DNS Zone Parsers - fcambus
https://www.cambus.net/fuzzing-dns-zone-parsers/
======
tptacek
This is a little disturbing; nsd is kind of a big deal, and afl on zone files
is a pretty basic test to run. Kudos to the author for doing it, but why
haven't the authors of nsd done it already, and what else haven't they done?

There is really no good reason for DNS servers to be written in C anymore.

~~~
bluejekyll
> There is really no good reason for DNS servers to be written in C anymore.

I’m a little behind on docs, but we have a pretty decent start on one in Rust:
[https://github.com/bluejekyll/trust-dns](https://github.com/bluejekyll/trust-
dns)

We still need an AXFR, IXFR, or replication solution.

Also, I haven’t had time to fuzz the zone parsers, so I can’t guarantee we’re
resilient to the above yet, but the packet parsers are getting pretty widely
used across multiple Rust projects now through the trust-dns-resolver library.

~~~
tptacek
What's wrong with rsync?

~~~
bluejekyll
Nothing. Depends on the mode of operation we want to support. I want to
support that, but we need to add some signal handling (or similar mechanism)
to properly reload configs after an raunchy is done.

Right now a restart would be required.

------
nly
Nobody knows how to parse zone files.

I fuzzed a few zone file parsers several years ago, but to find the
differences between implementations rather than crashes.

The problem is the format is really poorly specified, has been refined over
about 10 RFCs, and still riddled with ambiguities. Every implementation out
there handles things slightly differently.

I'll just dump some notes I wrote at the time, containing a list of RFCs and
some findings, to gist:

[https://gist.github.com/nlyan/2a958fa476182e1b07955a945f0d70...](https://gist.github.com/nlyan/2a958fa476182e1b07955a945f0d7052)

~~~
wipseabusbus
Off topic: Hello from the person who forked synergy a couple of years ago :)

------
ifoundthetao
Excellent! Would you be willing to do a second article on the process you used
when wading through the findings?

