On Wed Dec 17 05:18:02 2008, Ray.Bellis@nominet.org.uk wrote:
Show quoted text> > How do you use the method? You build a packet and then use the
> > Resolver to send or do you do your own socket managing?
>
> My code looks like this:
>
> --8<--8<--
> $request = $resolver->make_query_packet(@baseline);
> $packet = send_udp($request);
>
> sub send_udp($)
> {
> my $request = shift;
> $request->header->id($id++);
> my $response = $resolver->send_udp($request, $request->data);
> return undef if ($response->answerfrom ne $server);
> return $response;
> }
> --8<--8<--
>
> where I've done this to ensure that for the purposes of my router testing
> that I *do* get sequential Query IDs, so that it's easy to correlate
> tcpdumps with the transmitted packets, and also to work around the way
> that the current version of Net::DNS doesn't do source IP validation (and
> therefore doesn't reject response packets sent from the wrong address).
>
> kind regards,
>
> Ray
There are two parts to the justification for this, neither of which appears to hold water.
1) Arbitrary modification of header content (specifically id, but generally applicable)
my $resolver = Net::DNS::Resolver->new( nameserver => 'a.iana-servers.net' );
my $query = new Net::DNS::Packet( 'www.example.com', 'A' );
$query->header->id(1234);
my $reply = $resolver->send($query); # calls make_query_packet
$reply->print;
;; Answer received from 199.43.135.53 (97 bytes)
;; HEADER SECTION
;; id = 1234
;; qr = 1 aa = 1 tc = 0 rd = 1 opcode = QUERY
;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR
;; qdcount = 1 ancount = 1 nscount = 2 arcount = 0
;; do = 0
;; QUESTION SECTION (1 record)
;; www.example.com. IN A
;; ANSWER SECTION (1 record)
www.example.com. 86400 IN A 93.184.216.34
;; AUTHORITY SECTION (2 records)
example.com. 86400 IN NS a.iana-servers.net.
example.com. 86400 IN NS b.iana-servers.net.
;; ADDITIONAL SECTION (0 records)
Note the specified id
2) Source IP validation
return undef if ($response->answerfrom ne $server);
Unacheivable using Perl's socket implementation as it now stands.
$response->answerfrom comes from $socket->peerhost which does *not* come from the IP packet header.
