Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

createReverse6() generating names that might be interpreted as illegal IDN names #7524

Open
Eihrister opened this issue Feb 27, 2019 · 1 comment · May be fixed by #14975
Open

createReverse6() generating names that might be interpreted as illegal IDN names #7524

Eihrister opened this issue Feb 27, 2019 · 1 comment · May be fixed by #14975
Labels
auth defect
Milestone
auth-helpneeded

Comments

@Eihrister
Copy link

  • Program: Authoritative
  • Issue type: Bug report/Feature request (you pick, not entire sure)

Short description

createReverse6() generates addresses that end in --.

Environment

  • Operating system: Ubuntu 18.10 (cosmic)
  • Software version: 4.2.0~alpha1-1pdns.cosmic
  • Software source: PowerDNS repository

Steps to reproduce

Following the examples on https://doc.powerdns.com/authoritative/lua-records/functions.html#createReverse6 :

  1. Create a *.1.0.0.2.ip6.arpa IN LUA PTR "createReverse6('%33%.static6.example.com')".
  2. Query it with dig +short -x 2001:db8:: @ns1.example.com (note the IP ending in a valid ::).

Expected behaviour

I expect this to generate a record that will not be seen by software as an illegal IDN record.

Actual behaviour

Currently, dig for example is really unhappy about the resulting record:

dig: '2001-db8--.static6.example.com' is not a legal IDN name (string start/ends with forbidden hyphen), use +noidnin

Suggestion

I would suggest making something that is IP 0 of a range (xxx::) end in --0 instead of --.
@rgacogne rgacogne added this to the auth-4.2.0-beta1 milestone Feb 27, 2019
@Habbie Habbie modified the milestones: auth-4.2.0-rc2, auth-4.3.0 May 14, 2019
@mnordhoff
Copy link
Contributor

mnordhoff commented Jun 6, 2019 •
edited
Loading

I believe there are two kinds of problematic names:

  • Hostnames cannot start or end with -, affecting addresses like ::1 or 2001:db8::.

  • I think IDN subsumes all labels that have - in the third and fourth positions, affecting unusual addresses like 00ff:0000:0000:0000:0000:0000:0000:0001.

And dig's IDN mode rejects both unless you pass +noidnin and/or +noidnout:

$ dig aa--a.example.com
dig: 'aa--a.example.com' is not a legal IDNA2008 name (string contains forbidden two hyphens pattern), use +noidnin
$ dig +noidnin aa--a.example.com
dig: 'aa--a.example.com' is not a legal IDNA2008 name (string contains forbidden two hyphens pattern), use +noidnout

And, as shown by the first post:

$ dig a-.example.com
dig: 'a-.example.com' is not a legal IDNA2008 name (string start/ends with forbidden hyphen), use +noidnin

@Habbie Habbie modified the milestones: auth-4.3.0, auth-helpneeded Jan 23, 2020
BozhanL added a commit to BozhanL/pdns that referenced this issue Dec 14, 2024
@BozhanL
auth: prevent createReverse6 from generating illegal IDN record
27f4f93 
Closes PowerDNS#7524
BozhanL added a commit to BozhanL/pdns that referenced this issue Dec 14, 2024
@BozhanL
auth: prevent createReverse6 from generating illegal IDN record
deb6dd4 
Closes PowerDNS#7524
BozhanL added a commit to BozhanL/pdns that referenced this issue Dec 14, 2024
@BozhanL
auth: prevent createReverse6 from generating illegal IDN record
d1d66d6 
Closes PowerDNS#7524
BozhanL added a commit to BozhanL/pdns that referenced this issue Dec 14, 2024
@BozhanL
auth: prevent createReverse6 from generating illegal IDN record
600d6fb 
Closes PowerDNS#7524
BozhanL added a commit to BozhanL/pdns that referenced this issue Dec 14, 2024
@BozhanL
auth: prevent createReverse6 from generating illegal IDN record
6de9762 
Closes PowerDNS#7524
BozhanL added a commit to BozhanL/pdns that referenced this issue Dec 16, 2024
@BozhanL
auth: prevent createReverse6 from generating illegal IDN record
a2fba57 
Closes PowerDNS#7524
@BozhanL BozhanL linked a pull request Dec 16, 2024 that will close this issue
Open
8 tasks
BozhanL added a commit to BozhanL/pdns that referenced this issue Dec 17, 2024
@BozhanL
auth: prevent createReverse6 from generating illegal IDN record
96f4bca 
Closes PowerDNS#7524
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
auth defect
Projects
None yet
Milestone
auth-helpneeded
Development

Successfully merging a pull request may close this issue.

auth: prevent createReverse6 from generating illegal IDN record BozhanL/pdns
5 participants
@aerique @Habbie @mnordhoff @rgacogne @Eihrister