| dnsop | B. Dickson |
| Internet-Draft | |
| Expires: April 18, 2015 | October 15, 2014 |
A Language to Describe the DNS Wire Format
draft-dickson-dnsop-spartacus-lang-00
As part of the SPARTACUS DNS gateway system, building a full DNS parser was necessary. Parsing DNS packets is the only way to avoid propogating packets which are not correctly formatted DNS packets.
In order to facilitate building a new parser from scratch, the author chose to build a parser-builder which takes as input, a description of the DNS wire format.
This document describes the language created to facilitate this description, and includes the resulting DNS wire format description in this language.
Intended Status: Informational.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on April 18, 2015.
Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
DNS (The Domain Name System) has been around a long, long time. Over that time, the original Resource Record types have in some cases been made officially obsolete. Other, new Resource Records have been added. New definitions of bits in the header have arisen.
There have even been extensions added, which are intended to be backward compatible. The OPT pseudo-resource record, in particular, overloads some of the standard field definitions in order to achieve its goals.
The end result is a wire format which is potentially difficult to parse.
In the interests of assisting future DNS endeavors, a complete description of the DNS wire format has been produced, and a comparitively simple language for facilitating this description has been created.
Re-inventing the wheel, figuratively speaking, is frowned upon. By providing a description of the DNS wire format, and a language to accomplish this description, the author hopes that future work in the DNS arena might be made easier, at least in some cases.
The project which motivated this work, SPARTACUS (Secure, Private Aparatus for Resolution Transported Across Constraining and/or Unmaintained Systems), is intended to have multiple implementations in a variety of languages and environments. Creating a standard description of the DNS wire format, is intended to facilitate both an easier implementation effort, and a greater likelihood of compatible, interoprable implementations.
The SPARTACUS project is intended to create bidirectional DNS gateways for transporting DNS over other protocols and encodings, such as JSON over HTTP(S). This is intended to create "bridges" between DNS speakers. THe goal is to transport DNS messages from any DNS client implementation to any DNS server implementation. Each gateway needs to be liberal in what it accepts (any valid DNS message conforming to the relevant RFCs) and conservative in what it sends (only packets which parse correctly).
A secondary objective of the encoding in JSON is the use of the same names for data elements and structures as in the DNS RFCs. The idea is to provide human-readable JSON encodings, for easier diagnostics during development, and when investigating operational issues.
A variety of other work exists, and provided inspiration for the SPARTACUS work. This includes web/JSON DNS portals, for providing DNS query responses in JSON format, often with a "looking glass" functionality.
There has been at least one previous effort to develop code for a DNS-JSON encoding, which appears to have been abandoned after one-way encoding was done, circa 2009. The project focused on presenting results to DNS queries in JSON format, with an intention to create a client gateway, which never materialized. The project can be found in two places ([JPF_jsondns] and [jsondns.org]). One major difference is that DNS query response status is converted to HTTP error codes, rather than being embedded in the JSON answer. This makes it unsuitable for bidirectional use. Only a few DNS type codes were implemented.
Another DNS JSON tool [fileformat.info], similarly focuses only on answers, with a limited number of type codes.
Yet another tool for looking up DNS via HTTP with JSON responses is the "dnsrest" [restdns.net]. It too focuses only on answer values, and is similarly not able to fully produce results that can be turned back into DNS answer packets.
The "DNS Looking Glass" [bortzmeyer.org], is primarily designed for returning DNS answer data. As such, it lacks encoding suitable for a bidirectional scheme. It is primarily focused on XML output, with JSON output organized around DNS resolution meta-data, plus answer data in a generic schema. (The schema itself is described in [draft-bortzmeyer-dns-json].)
The "Multilocation DNS Looking Glass" [dns-lg.com], uses a RESTful query mechanism of "node/qname/qtypename" to request the looking glass (LG) to perform a DNS lookup for the qname and qtype, and returns the response in a JSON format. The JSON format is generic, encapsulating all types as string data in presentation format, with a generic label of "rdata". This does not facilitate decoding easily, as the JSON scheme provides no information for parsing the rdata field. The type (qtype for the query, or type for answer/authority/additional) is in string (symbolic) form, and the elements are objects and thus in unordered lists. The JSON scheme is fine for one-way encoding for human readability, but not suitable for two-way conversion back into DNS.
DNSSEC-trigger[trigger] can only be used in environments that use NLnetlabs' Unbound resolver, or where Unbound can be deployed as a replacement for existing recursive resolvers and/or stub resolvers.
A variety of other web lookup tools exist, predominantly producing DNS validation (zone structure and hierarchy), maps, meta-data, or literal output from the 'dig' tool, in formats as varied as the purposes of the tools. Dig output, while being reasonably deterministic, is not sufficiently well-formed as to facilitate "screen scraping" as a parsing method.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
The syntax for the language is largely derived from only the abstract element types required to express data types and structures in DNS. In particular, the language has been kept as familiar and a simple as possible. Design choices were made to avoid over-abstracting elements which are by nature "difficult". Some objects have their size defined by other objects' values, or arithmetic expressions of values and literals. This includes array dimensions, and lengths of strings.
The general syntactic style uses braces ("{" and "}"), similar to the config files for BIND, for structural items.
Some familiarity with the DNS protocol is assumed.
The name space of this language is tailored to the specific environment. Names need only be unique within their specific scope.
Since DNS messages are processed as "first in, first out" objects, the references to arrays have been simplified. Rather than keeping track of the index to an array, e.g. "a.b[3].c", the index is omitted, resulting in "a.b.c".
Relative object naming works the same as DNS search-list processing, depth-first. For example, while parsing "a.b.c.d", the name "foo" would refer the first of the following that exists: "a.b.c.foo", "a.b.foo", "a.foo".
The syntactic elements of the language are base data types, structural elements, and preprocessing constructs. Additional elements provide the ability to annotate objects, and to define mnemonics for values.
TSIG (RFC 2845) {
Algorithm:fqdn
TimeSigned:int48
Fudge:int16
MACsize:int16
MAC:base64@MACsize
OriginalID:int16
Error:int16
OtherSize:int16
OtherData:base64@OtherSize
}
Base data types are encoded as "name:type", for a small number of predefined types and appropriate presentation formats:
Example of a base64 object named "MAC" whose size is specified by "MACsize", in context:
NSID (RFC 5001) {
NSIDContent:hex-string@*Len
}
When processing an NSID, the JSON string would be:
"NSID (RFC 5001)"
instead of
"NSID"
enum classes {
1:IN
3:CH
254:NONE
255:ANY
}
CLASS:int16 of classes
"CLASS" : [ "IN" : 1 ] instead of "CLASS" : 1
The remainder of the elements of the language exist to permit annotation of well-known values (such as "NXDOMAIN" for RCODE=3), and for providing human-friendly RFC references. These are:
Example of RFC:
HFlags {
QR:bit1
Opcode:bit4
AA:bit1
TC:bit1
RD:bit1
RA:bit1
Z:bit1
AD:bit1
CD:bit1
RCODE:bit4
}
LIST_LENGTH:int16
DAU_TYPES: array[LIST_LENGTH] DAU_TYPE {
ALG_CODE:int8
}
TYPE:int16 of rrtype
Field3: switch TYPE {
case 41: UDPSIZEFIELD {
UDPSIZE:int16
}
case *: CLASSFIELD {
CLASS:int16
}
}
There are two structural elements:
Example of simple structure:
Example of an array DAU_TYPES, in context:
Example of switch Field3 based on object TYPE, and corresponding cases ("case *" is equivalent to "default" in C):
Input file before preprocessor:
define RDATATYPE {
case 1: A {
Address:dotquad
}
... (lots of lines omitted for clarity)
case 256: URI {
GENERIC_RDATA:hex-string@RDLENGTH
}
}
Answer {
RR_LIST: array[HEADER.ANCOUNT] RR {
NAME:fqdn
TYPE:int16 of rrtype
CLASS:int16 of classes
TTL:int32
RDLENGTH:int16
RDATA: switch TYPE {
reference RDATATYPE
}
}
}
Authority {
RR_LIST: array[HEADER.NSCOUNT] RR {
NAME:fqdn
TYPE:int16 of rrtype
CLASS:int16 of classes
TTL:int32
RDLENGTH:int16
RDATA: switch TYPE {
reference RDATATYPE
}
}
}
Result of preprocessing:
Answer {
RR_LIST: array[HEADER.ANCOUNT] RR {
NAME:fqdn
TYPE:int16 of rrtype
CLASS:int16 of classes
TTL:int32
RDLENGTH:int16
RDATA: switch TYPE {
case 1: A {
Address:dotquad
}
... (lots of lines omitted for clarity)
case 256: URI {
GENERIC_RDATA:hex-string@RDLENGTH
}
}
}
}
Authority {
RR_LIST: array[HEADER.NSCOUNT] RR {
NAME:fqdn
TYPE:int16 of rrtype
CLASS:int16 of classes
TTL:int32
RDLENGTH:int16
RDATA: switch TYPE {
case 1: A {
Address:dotquad
}
... (lots of lines omitted for clarity)
case 256: URI {
GENERIC_RDATA:hex-string@RDLENGTH
}
}
}
}
There are two elements which provide preprocessing capabilities:
Example of one define and two references to RDATATYPE. Note that an object named RDLENGTH must be present in an ancestor of both parent objects:
This operates much like "#define" does in the C language. By doing this, identical structures and object types which occur in different places can be maintained in one section of the file. In partucular, the Resource Records from all three sections can be defined once.
None per se.
This document contains no IANA-specific material.
To be added later.
| [RFC2119] | Bradner, S., Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. |
| [JPF_jsondns] | DNS over HTTP", . | , "
| [jsondns.org] | Franusic, J., "Query DNS via REST", . |
| [fileformat.info] | Marcuse, A., DNS in client-side JavaScript", . |
| [restdns.net] | REST-DNS", . | , "
| [bortzmeyer.org] | Bortzmeyer, S., "DNS Looking Glass", . |
| [draft-bortzmeyer-dns-json] | Bortzmeyer, S., "DNS in JSON", . |
| [dns-lg.com] | Cambus, F., "Multilocation DNS Looking Glass", . |
| [trigger] | NLnet Labs, "Dnssec-Trigger", . |
The entire encoding of the DNS message format follows.
# opcodes
enum opcodes {
0:Query
2:Status
4:Notify
5:Update
}
# classes
enum classes {
1:IN
3:CH
254:NONE
255:ANY
}
enum ednstype {
3:NSID
5:DAU
6:DHU
7:N3U
}
enum rrtype {
1:A
28:AAAA
15:MX
2:NS
12:PTR
5:CNAME
39:DNAME
6:SOA
37:CERT
48:DNSKEY
43:DS
32769:DLV
47:NSEC
50:NSEC3
51:NSEC3PARAM
46:RRSIG
24:SIG
52:TLSA
44:SSHFP
249:TKEY
250:TSIG
35:NAPTR
33:SRV
99:SPF
16:TXT
18:AFSDB
19:X25
17:RP
21:RT
20:ISDN
29:LOC
27:GPOS
104:NID
105:L32
106:L64
107:LP
251:IXFR
252:AXFR
253:MAILB
254:MAILA
255:*
256:URI
257:CAA
32768:TA
41:OPT
}
#
# EDNS Option-codes follow
define EDNSTYPE {
case 3: NSID (RFC 5001) {
NSIDContent:hex-string@*Len
}
case 5: DAU (RFC 6975) {
LIST_LENGTH:int16
DAU_TYPES: array[LIST_LENGTH] DAU_TYPE {
ALG_CODE:int8
}
}
case 6: DHU (RFC 6975) {
LIST_LENGTH:int16
DHU_TYPES: array[LIST_LENGTH] DHU_TYPE {
ALG_CODE:int8
}
}
case 7: N3U (RFC 6975) {
LIST_LENGTH:int16
N3U_TYPES: array[LIST_LENGTH] NSU_TYPE {
ALG_CODE:int8
}
}
}
define RDATATYPE {
case 1: A {
Address:dotquad
}
case 28: AAAA {
Address:quadhex8
}
case 15: MX {
Preference:int16
MailExchanger:fqdn
}
case 2: NS {
Target:fqdn
}
case 12: PTR {
Target:fqdn
}
case 5: CNAME {
Target:fqdn
}
case 39: DNAME {
Target:fqdn
}
case 6: SOA {
MasterServerName:fqdn
MaintainerName:mbox
Serial:int32
Refresh:int32
Retry:int32
Expire:int32
NegativeTtl:int32
}
case 37: CERT (RFC 4398) {
Type:int16
KeyTag:int16
Algorithm:int8
Data:base64@RDLENGTH-5
}
case 48: DNSKEY (RFC 4034) {
Flags:int16
protocol:int8=3
Algorithm:int8
data:base64@RDLENGTH-4
#Tag:int16=%#(derived/calculated/optional?)
}
case 43: DS (RFC 4034) {
Keytag:int16
Algorithm:int8
DigestType:int8
DelegationKey:hex-string@RDLENGTH-4
}
case 32769: DLV {
Keytag:int16
Algorithm:int8
DigestType:int8
DelegationKey:hex-string@RDLENGTH-4
}
case 47: NSEC (RFC 4034) {
NextName:fqdn
FlagBits:hex-string@*RDLENGTH
}
case 50: NSEC3 (RFC 5155) {
Algorithm:int8
Flags {
ResvBits:bit7
OptOut:bit1
}
Iterations:int16
SaltLength:int8
Salt:hex-string@SaltLength
HashLength:int8
NextHash:hex-string@HashLength
FlagBits:hex-string@RDLENGTH-6-SaltLength-HashLength
}
case 51: NSEC3PARAM (RFC 5155) {
Algorithm:int8
Flags:int8
Iterations:int16
SaltLength:int8
Salt:hex-string@SaltLength
}
case 46: RRSIG (RFC 4034) {
Type:int16
Algorithm:int8
Labels:int8
OTTL:int32
SigExp:int32
SigInc:int32
Tag:int16
Signer:fqdn
Sig:base64@*RDLENGTH
}
case 24: SIG (RFC 2931) {
Type:int16
Algorithm:int8
Labels:int8
OTTL:int32
SigExp:int32
SigInc:int32
Tag:int16
Signer:fqdn
Sig:base64@*RDLENGTH
}
case 52: TLSA (RFC 6698) {
CertUsage:int8
Selector:int8
MatchType:int8
Data:hex-string@RDLENGTH-3
}
case 44: SSHFP (RFC 4255) {
Algorithm:int8
DigestType:int8
Fingerprint:hex-string@RDLENGTH-2
}
case 249: TKEY (RFC 2930) {
Algorithm:fqdn
Incep:int32
Exp:int32
Mode:int16
Error:int16
KeySize:int16
KeyData:hex-string@KeySize
OtherSize:int16
OtherData:hex-string@OtherSize
}
case 250: TSIG (RFC 2845) {
Algorithm:fqdn
TimeSigned:int48
Fudge:int16
MACsize:int16
MAC:base64@MACsize
OriginalID:int16
Error:int16
OtherSize:int16
OtherData:base64@OtherSize
}
case 35: NAPTR (RFC 3403) {
Order:int16
Preference:int16
Flags:string
Services:string
Regexp:string
Replacement:fqdn
}
case 33: SRV (RFC 2782) {
Port:int16
Priority:int16
Weight:int16
Server:fqdn
}
case 99: SPF (RFC 4408) {
Text:string@*RDLENGTH
}
case 16: TXT {
Text:string@*RDLENGTH
}
case 41: OPT (RFC 6891) {
TLV_LIST: array[*RDLENGTH] TLV {
TYPE:int16 of ednstype
Len:int16
Data: switch TYPE {
reference EDNSTYPE
}
}
}
###
### Obsolete Stuff Begins
###
## AFS & X25 stuff Begins
case 18: AFSDB (RFC 1183) {
SubType:int16
Hostname:fqdn
}
case 19: X25 (RFC 1183) {
PSDN:string
}
case 17: RP (RFC 1183) {
Who:mbox
What:fqdn
}
case 21: RT (RFC 1183) {
Preference:int16
Via:fqdn
}
case 20: ISDN (RFC 1183) {
Number:string
SA:string?@*RDLENGTH
}
## X25 Stuff Ends
## Other Obsolete Stuff
case 29: LOC (RFC 1876) {
Version:int8
Size:int8
HorPrec:int8
VertPrec:int8
Longitude:int32
Latitude:int32
Altitude:int32
}
case 27: GPOS (RFC 1712) {
Long:string
Lat:string
Alt:string
}
###
### ILNP Stuff
###
case 104: NID (RFC 6742) {
Pref:int16
Node:quadhex4
}
case 105: L32 (RFC 6742) {
Pref:int16
ID:dotquad
}
case 106: L64 (RFC 6742) {
Pref:int16
ID:quadhex4
}
case 107: LP (RFC 6742) {
Pref:int16
Target:fqdn
}
##
## Basically unsupported types follow
case 251: IXFR {
GENERIC_RDATA:hex-string@RDLENGTH
}
case 252: AXFR {
GENERIC_RDATA:hex-string@RDLENGTH
}
case 253: MAILB {
GENERIC_RDATA:hex-string@RDLENGTH
}
case 254: MAILA {
GENERIC_RDATA:hex-string@RDLENGTH
}
case 255: * {
GENERIC_RDATA:hex-string@RDLENGTH
}
case 256: URI {
GENERIC_RDATA:hex-string@RDLENGTH
}
case 257: CAA {
GENERIC_RDATA:hex-string@RDLENGTH
}
case 32768: TA {
GENERIC_RDATA:hex-string@RDLENGTH
}
}
# Draft JSON typenames and element names/types
PACKET (RFC 1035) {
Header {
ID:int16
HFlags {
QR:bit1
Opcode:bit4 of opcodes
AA:bit1
TC:bit1
RD:bit1
RA:bit1
Z:bit1=0
AD:bit1
CD:bit1
RCODE:bit4
}
QDCOUNT:int16
ANCOUNT:int16
NSCOUNT:int16
ARCOUNT:int16
}
Question {
QContinuum: switch PACKET.Header.HFlags.Opcode {
case 0: QUESTION (RFC 1035) {
QNAME:fqdn
QTYPE:int16
QCLASS:int16 of classes
}
case 4: NOTIFY (RFC 1996) {
QNAME:fqdn
QTYPE:int16=SOA
QCLASS:int16 of classes
}
# NB:
# Opcode=UPDATE: Redefines Names & Semantics of sections as follows:
# ZONE
# Prerequisite
# Update
# Additional_Data
# (All sections may have data, even though QR=0)
#
case 5: ZONE (RFC 2136) {
ZNAME:fqdn
ZTYPE:int16=SOA
ZCLASS:int16 of classes
}
}
}
Answer {
RR_LIST: array[HEADER.ANCOUNT] RR {
NAME:fqdn
TYPE:int16 of rrtype
CLASS:int16 of classes
TTL:int32
RDLENGTH:int16
RDATA: switch TYPE {
reference RDATATYPE
}
}
}
Authority {
RR_LIST: array[HEADER.NSCOUNT] RR {
NAME:fqdn
TYPE:int16 of rrtype
CLASS:int16 of classes
TTL:int32
RDLENGTH:int16
RDATA: switch TYPE {
reference RDATATYPE
}
}
}
Additional {
RR_LIST: array[HEADER.ARCOUNT] RR {
NAME:fqdn
TYPE:int16 of rrtype
# do overload on CLASS and TTL for TYPE=41 (OPT)
Field3: switch TYPE {
case 41: UDPSIZEFIELD {
UDPSIZE:int16
}
case *: CLASSFIELD {
CLASS:int16 of classes
}
}
Field4: switch TYPE {
case 41: Extended_RCode_Flags {
RCode:bit8
Version:bit8
DO:bit1
Resv:bit15
}
case *: TTLFIELD {
TTL:int32
}
}
RDLENGTH:int16
RDATA: switch TYPE {
reference RDATATYPE
}
}
}
}