Trust-DNS Resolver 0.10 and Client/Server 0.15 released

announcements
1

This is a bigger release than usual, I wanted to try and make the pain of upgrading a one-time cost. To attempt to make this more gentle path for upgrading, this release was the first where initial alpha's had been published to try and help anyone who wanted to see the new APIs as they developed. I liked this as a method of getting things out there early, so am thinking about doing something similar in the future. Any feedback on this would be great. Now onto the new features:

DNS-over-HTTPS, DoH, is now supported. In additional to the DNS-over-TLS, DoT, support, this is a new option for an encypted and private channel that can be used by the Resolver, Client and Server. This should be considered experimental in the Server, as to the Client and Resolver, it appears to be fairly stable at this point. This can be enabled with the feature dns-over-https-rustls. The implementation uses the wonderful H2 library (thank you @carllerche, @seanmonstar, @olix0r, and everyone else whose contributed to it). Currently the only supported TLS library with HTTPS is Rustls. I've been considering dropping OpenSSL as an option for the library in general, if anyone has feedback on requiring that as an option, it would be good to me know. One of the reasons this release took so long is that DNS is a multiplexed protocol built over UDP and TCP, HTTP/2 introduced an underlying transport that was already multiplexed, unlike UDP and TCP. A bunch of internal interfaces had to be updated to support this, which of course makes Rust shine in the ability to refactor substantial portions of code confidently, fearlessly.

In addition to this, @hawkw identified and helped fix many issues in the library as a whole. Coming from Java as my most recent language that I'm deeply familiar with, I made a mistake in many of the Future implementations in the library, the crux being that Futures "should do no work unless polled" as well as looping issues while Futures were running. We worked to make all Futures lazy in the library, which also cleaned up the library and made it much more compatible with the expectations of Futures in Rust. This work represents most of the breaking API changes in the release, and is what people upgrading should pay most attention to. The biggest change is that when constructing Clients or Resolvers, there is a foreground handle and a background worker. The background worker must be run on a Tokio executor prior to the foreground handle being functional. Thank you @hawkw for all the work here!

While all of this refactoring was going on, @oherrala decided to see how many different ways the library could be broken. See the past announcement in regards to the Rustsec advisory. While we worked through all the issues, the discoveries gave me some pause about how untrusted data is treated by the library during processing of streams. To make sure this class of issues wouldn't occur again, the data stream is now tainted with a wrapper type called Restrict. Eventually this type might make it into public APIs, but at present really only exists in the trust-dns-proto library. @oherrala was very helpful in this process and deserves a huge amount of gratitude in helping track down these issues and helping fix that.

Thank you to everyone who contributed PRs to this release, the changelogs are below:

0.10 Resolver

Fixed

  • Fix two separate integer overflows from substractions #585 (@oherrala)
  • strictly enforce name and label lengths during label parsing #584
  • enforce that only prior labels are used in label expansion, decompression #578 (@oherrala)
  • CAA now properly performs case-incesitive compares #587 (@oherrala)
  • overhauled rdata parsers with Restrict type to reduce potential of overflowing operations #586
  • Propagate TTLs for NXDOMAIN responses #485 (@hawkw)
  • LookupIpFuture implementation to be proper in regards to loop control #480 (@hawkw)
  • max query depth tracking in Resolver #469

Changed

  • Wrap types in Restrict and force validation before usage from streams #586
  • Delays all connections until actual use #566
  • Relax parsing rules for CAA issuer keys and values #517
  • ResolverFuture renamed to AsyncResolver #487 (@hawkw)
  • breaking AsyncResolver::new returns a tuple of an AsyncResolver and a future that drives DNS lookups in the background #487 (@hawkw)
  • breaking All AsyncResolver lookup methods return BackgroundLookup<T> rather than T #487 (@hawkw)
  • breaking Migrated from error_chain to Failure #474 (@silwol)
  • improve truncation to always return records #497

Added

  • updated root trust-anchor to include new 20326 RSA root ksk
  • DNS over HTTPS support #520

0.15.0 Client/Server

Fixed

  • Fix two separate integer overflows from substractions #585 (@oherrala)
  • strictly enforce name and label lengths during label parsing #584
  • enforce that only prior labels are used in label expansion, decompression #578 (@oherrala)
  • CAA now properly performs case-incesitive compares #587 (@oherrala)
  • overhauled rdata parsers with Restrict type to reduce potential of overflowing operations #586

Added

  • feature dns-over-rustls to trust-dns-server (server) and trust-dns (client)
  • feature dns-over-https-rustls experimental #557
  • new configuration options for tls, see server/tests/named_test_configs/dns_over_tls_rustls_and_openssl.toml
  • new utility for querying root key-signing-keys, util/get-root-ksks
  • updated root trust-anchor to include new 20326 RSA root ksk

Changed

  • Make trust_dns_server::server::ResponseHandler Send #593 (sticnarf)
  • Wrap types in Restrict and force validation before usage from streams #586
  • breaking Overhauled all ClientFuture implementations to align with new DnsExchange and DnsMultiplexer components in proto.
  • breaking ClientFuture after construction, now returns a "background" ClientFuture and a "foreground" BasicClientHandle
  • breaking Client has more type parameters, these match with the same types returned by the *ClientConnection constructors
  • breaking all default features, removed: "dns-over-openssl", "dnssec-openssl". Use --features=dns-over-openssl,dnssec-openssl to enable
  • breaking named configuration now has AXFR disabled by default.
  • breaking Migrated from error_chain to Failure #474 (@silwol)
  • feature tls renamed to dns-over-openssl
  • upgraded native-tls and tokio-tls to 0.2
  • upgraded rusqlite to 0.15
12 Likes