Read DNS message header bytes first when receiving a TCP message.

[ximon18]

Raised originally at NLnetLabs/cascade#581.

With a HTTP client that accidentally tries to query the TCP port of a domain::net::server TCP nameserver this can cause the client to hang as the server awaits bytes that will never be sent.

One solution could be to read only the DNS header message bytes first, not await the entire message.

[Philip-NLnetLabs]

Why not add a timer to the TCP part of the nameserver? This was discussed before but never implemented. A timer also protects against malicious parties who keep server resources allocated.

[ximon18]

Why not add a timer to the TCP part of the nameserver? This was discussed before but never implemented. A timer also protects against malicious parties who keep server resources allocated.

Even with a timer it would wait till the timer expires, so maybe we need both?

[Philip-NLnetLabs]

Why? This complexity is worth it only if we expect this to be common. For production DNS servers, it is very rare to see an HTTP client accidentally connecting to port 53 or 853. In the case of Cascade, I assume that resource use is not a big issue. A timer would solve the original problem that the request seems to hang.

[ximon18]

I was thinking it's fairly standard to sanity check the input to defend the server against garbage requests.

[Philip-NLnetLabs]

It is. The problem is that it is surprisingly tricky to generate a good DNS error reply. In general is it not smart to try to generate a reply with just the header.

[ximon18]

It is. The problem is that it is surprisingly tricky to generate a good DNS error reply. In general is it not smart to try to generate a reply with just the header.

Ah! I hadn't considered that.

[ximon18]

So what would you do when the timeout expires, what response would you return or just disconnect the client?

[Philip-NLnetLabs]

Ideally a FORMERR. But if it is too hard, then just a disconnect is fine as well.

[gthess]

How do you return FORMERR for an HTTP request? Unless I am reading something wrong here.

[Philip-NLnetLabs]

The DNS code doesn't know it is an HTTP request. It could be NOTIMPL, FORMERR, etc. The opcode is in the 5th character of the request.