Making a DNS query in Ruby from scratch

https://jvns.ca/blog/2022/11/06/making-a-dns-query-in-ruby-from-scratch/

by guiambros • 4 years ago

184 59 4 years ago

faraaz982• 4 years ago

Great post! I feel like Ruby can make a comeback if a lot more people use it for more than just Rails

teddyh9• 4 years ago

With Python being so much more common, Ruby would have to have something really remarkable in order to do that. Does it?

faraaz982• 4 years ago

Unfortunately no. There's been a sight increase in interest ever since Ruby 3 but something else is needed for a spark

brightball3• 4 years ago

Ruby is the closest thing to Aspect Oriented Programming that I’ve seen. Primary driver of the reason the Gem ecosystem is so good.

alwillis• 4 years ago

Don’t call it a comeback—Ruby hasn’t gone anywhere.

I get it that the hype around Ruby and Rails has—thankfully—subsided but Ruby is even better today than it was then.

byroot• 4 years ago

It's much better today.

Sure when it was hype a decade ago you'd get lots of flashy tools and library every other days, but a large part of it was really wonky.

Now that the dust settled, the tools that remain largely used are much higher quality.

jaimex22• 4 years ago

That and it's still by far the language backing the most startups that made it big.

Ruby gets results.

Mikeb85• 4 years ago

Ruby never went away. It just used to have an extreme amount of hype and now is a mature and, dare I say, slightly "boring" language.

philsnow2• 4 years ago

I really, really like Ruby-the-language, and prefer it over python. I don't love that it's joined at the hip with Rails.

compared to Python, Ruby has:

  - first-class symbols (yes python has sys.intern but it would take a PEP giving them a pithy syntax to make them usable, plus python has 25 years of stdlib and libraries using "strings" or enums for constants instead of :symbols)
  - procs/blocks and better-than-python lambdas
  - "open classes" / monkey-patching of builtins (for better or for worse)
  - trivial metaprogramming with method_missing (for better or for worse)

some of these make fun one-off projects easier or faster, some of them would be less welcome in large, mature codebases.

inferiorhuman3• 4 years ago

So I'm a Ruby fan and I largely agree with you. I started dicking around with Stable Diffusion recently and was almost immediately reminded of so many things I dislike about Python.

But just to be a bit contrary:

- I don't see a huge value in symbols. In Ruby they are literally just static strings which means they use memory you'll never get back – potentially important if you're e.g. parsing something large into a hash and symbolizing the keys. If you have to put a non-alphanumeric character in a symbol you still need to use quotes.

- Procs, blocks, and lambdas – yes.

- Metaprogramming and monkey patching? dfjasdjldfjkdfjlkfdjldfoh4houfhufl. A double edged sword at best and 100% not something I'd want to see in a larger codebase. Javascript folks largely learned this lesson with the shift from Prototype to jQuery. You can do some really neat-o things but they're almost always unintuitive to the uninitiated.

googlryas• 4 years ago

The ruby proc passing style seems so ergonomic in curly paren style languages that I just can't understand my I haven't seen it anywhere else.

est• 4 years ago

Haven't used Ruby in years, the one thing I miss in Ruby is decorators.

chillfox5• 4 years ago

See, Rails is the one thing that I have never actually used Ruby for despite using it for a decade. Ruby is a fantastic language for systems automation, gluing things together and CLI apps.

theonealtair• 4 years ago

I love that Ruby’s main goal is developer happiness. I feel like Matz has really delivered on that promise, even after 30 years.

teddyh9• 4 years ago

Note: While educational, making a DNS query without DNSSEC verification in 2022 is like making a HTTP query without certificate verification (or without HTTPS support).

tptacek3• 4 years ago

This is so wildly untrue I'm wondering if you wrote it just to prod someone to jump in here and start the DNSSEC argument. Less than 4% of North American names are signed. Virtually nobody uses DNSSEC.

Further, this code implements a stub resolver querying 8.8.8.8 --- in that scenario, there is no DNSSEC verification, as you know. For stub resolvers, the kind your browser or OS uses, DNSSEC condenses down to a single bit in the header that the server uses to say "trust me, I did DNSSEC".

teddyh9• 4 years ago

(I don’t need to prod you to comment on DNSSEC; you seem to be able to find any and all mentions of DNSSEC here quite well on your own.)

Further, this code implements a stub resolver

Fair enough, but…

DNSSEC condenses down to a single bit in the header that the server uses to say "trust me, I did DNSSEC".

…they did not ask (in the query) for DNSSEC verification, nor did they check the bit in the response.

chillfox5• 4 years ago

I don't know much about DNSSEC, it's something I enable to get a green tick in whatever tool I use on the day to check that I configured DNS correctly.

But HTTP without HTTPS is useful if you need to go really fast, same goes for taking DNS out of the loop and going straight to the IP.

The way I see it, it's all about your threat model. Who/what are you defending against.

teddyh9• 4 years ago

In a stub resolver like this, it’s setting a bit and checking a bit. Not worth arguing about threat models; just do it.

ericpauley• 4 years ago

"If you wish to make an apple pie from scratch you must first invent the universe.”

-Carl Sagan

With that said, it was cool to see a lower-level explanation than just calling a library.

js2• 4 years ago

Making an ICMP echo query in Python from scratch:

https://github.com/jaysoffian/eap_proxy/blob/78a058ffe67c253...

The dnspython package is pure python and it's a lot of code, but it supports pretty much everything related to DNS:

https://github.com/rthalley/dnspython

endorphine• 4 years ago

Off-topic, but am I the only one that's annoyed by the lack of publish dates in blogs?

inopinatus• 4 years ago

It's in the URL: https://jvns.ca/blog/2022/11/06/making-a-dns-query-in-ruby-f...

and the HTML source also includes a machine-readable element:

    <p class="meta">
      <time datetime="2022-11-06T08:31:53" pubdate="" data-updated="true"></time>
    </p>

For my own journal, I tuck human-readable metadata inside a <details> block (which defaults to hidden), with the title in the nested <summary> (which defaults to visible). Thus, it's available, if visitors activate the title to reveal it.

speedgoose• 4 years ago

You can blame SEO. Old content is not ranked as well as new content so it’s better to remove the date and pretend the articles are recent.

The world may be a better place without SEO.

chillfox5• 4 years ago

It's only an issue because search engines use date as a proxy for if the page is still relevant instead of judging it by the content.

remram• 4 years ago

The search engine can't tell it already has it in its index? Also a sibling pointed out that it's in the source. That doesn't seem right.

Lammy• 4 years ago

I'm the opposite and am annoyed at the obsession with dates causing people to ignore anything written more than a year or two ago. Wait until you find out how old DNS is!

fweimer2• 4 years ago

I can't really ready Ruby, but it seems to me that the code fragment for implementing domain name compression does not handle compression loops.

fanf2• 4 years ago

Yes, avoiding loops in DNS name decompression is the first thing I check in new DNS code. I think Julia updated this post after publication with a caveat about compression loops and other potential problems. (I think the only other missing thing is checking the name is not too long.) So from my point of view this tutorial passes with flying colours because it clearly says that name compression is the worst part of the DNS wire format, and that there are lurking dangers if you are writing something more serious than experimental code for learning.

1vuio0pswjnm7• 4 years ago

Making multiple DoH requests in shell script from a list of domainnames.

  DOH_SERVER=eu1.lavate.ch
  (echo example.net;echo example.org;echo example.com) > 1.txt
  yy048 < 1.txt|yy049|yy050|sed "s,.*,https://$DOH_SERVER?dns-query?dns=&," \
  |yy025|openssl s_client -connect $DOH_SERVER:443 -ign_eof

This uses HTTP/1.1 pipelining and only a single TCP connection. Good netiquette.

Instead of openssl one can use, e.g., stunnel, or an https proxy, plus netcat.

The sources for yy025, yy048, yy049 and yy050 are just short text files compiled with flex. If preferred, yy025 can be replaced a little more shell script and tr(1).

No Ruby, no Python, no Go, or other large languages. Just shell utilities.

Parsing catenated responses can be done with ldns, e.g., drill.

manv1• 4 years ago

One thing that always drives me crazy about these is that it's not really a great example of how to actually write a query. "Copy values from wireshark" makes a bunch of assumptions, the main one being "the query you saw is the kind of query you want."

Just blindly copying flags off of a packet isn't really a good practice for software development. What if the packet was not recursive? I'm sure 99.99% of the people reading that have no idea that non-recursive packets were possible, or even what it means.

Instead, read RFC 4.1.1 and figure out what the flags mean and why you'd use one or the other.

https://www.rfc-editor.org/rfc/rfc1035

And by reading the actual format document you can start looking for vulnerabilities. For example, what happens when the various COUNT numbers aren't correct in a response? What if you get an error response code but there is response data? What if the implementor used signed instead of unsigned numbers for COUNT?

This is a bit better than SO, but not by much. You're not writing a DNS query, you're hacking someone else's DNS query and sending it over the wire.

CoolCold• 4 years ago

Useful article - thanks for writing.

A bit of rant - what annoys me on similar "examples" like articles - those have none to 0 error handling and not even assuming things may go bad. Doing bind() with hope it will always succeed, connect without timeout - for me as a newbie such things are important to be provided in examples as well.

Making a DNS query in Ruby from scratch

Related Stories