richardschneider / net-udns Goto Github PK

View Code? Open in Web Editor NEW

14.0 2.0 5.0 749 KB

Clients for unicast DNS servers

License: MIT License

C# 100.00%

dns-client dns-over-htttps dns-over-tls

net-udns's Introduction

net-udns

DNS clients that can fetch more than A and AAAA resource records.

Features

DnsClient for a standard unicast DNS server
- Initially uses UDP
- Fallbacks to TCP if no UDP response or the response is truncated
DohClient for a DNS over HTTPS (DOH) server
DotClient for a DNS over TLS (DOT) server
- Padding of requests
- TCP Keepalive
Supports asynchronous I/O
Supports cancellation
Supports IPv6 and IPv4 platforms
Targets .Net Framework 4.6 an .NET Standard 1.4 and 2.0
CI on Circle (Debian GNU/Linux), Travis (Ubuntu Trusty and OSX) and AppVeyor (Windows Server 2016)

Getting started

Published releases are available on NuGet. To install, run the following command in the Package Manager Console.

PM> Install-Package Makaretu.Dns.Unicast

Usage

Get IP addresses

using Makaretu.Dns;

var dns = new DnsClient();
var addresses = await dns.ResolveAsync("cloudflare-dns.com");
foreach (var a in addresses)
    Console.WriteLine(a.ToString());

Produces the output

104.16.111.25
104.16.112.25
2400:cb00:2048:1::6810:6f19
2400:cb00:2048:1::6810:7019

Get all the TXT strings

using Makaretu.Dns;

var dns = new DnsClient();
var response = await dns.QueryAsync("ipfs.io", DnsType.TXT);
var strings = response.Answers
    .OfType<TXTRecord>()
    .SelectMany(txt => txt.Strings);
foreach (var s in strings)
    Console.WriteLine(s);

Produces the output

dnslink=/ipfs/QmYNQJoKGNHTpPxCBPh9KkDpaExgd2duMa3aF6ytMpHdao

License

The package is licensed under the MIT license. Refer to the LICENSE file for more information.

net-udns's People

Contributors

Stargazers

Watchers

Forkers

blun78 gmariakis sciumo myina wforney

net-udns's Issues

docfx Documentation

Building the documentation on appveyor is complaining with

[18-05-18 01:47:17.697]Warning:MetadataCommand.ExtractMetadataWorkspace failed with:
[Failure] Msbuild failed when processing the file 'C:\projects\net-udns\src\Udns.csproj' with message: C:\Program Files\dotnet\sdk\2.1.200\Sdks\Microsoft.NET.Sdk\build\Microsoft.PackageDependencyResolution.targets: (167, 5):
Assets file 'C:\projects\net-udns\src\obj\project.assets.json' doesn't have a target for '.NETStandard,Version=v2.0'. Ensure that restore has run and that you have included 'netstandard2.0' in the TargetFrameworks for your project.

Query timeout tests

The query timeout tests are sometimes not working. They are currently being ignored.

Countermeasures to DNS Traffic Analysis

From https://tools.ietf.org/html/rfc8310#section-11.1

Countermeasures to DNS Traffic Analysis

This section makes suggestions for measures that can reduce the
ability of attackers to infer information pertaining to encrypted
client queries by other means (e.g., via an analysis of encrypted
traffic size or via monitoring of the unencrypted traffic from a DNS
recursive resolver to an authoritative server).

DNS-over-(D)TLS clients and servers SHOULD implement the following
relevant DNS extensions:

o Extension Mechanisms for DNS (EDNS(0)) padding [RFC7830], which
allows encrypted queries and responses to hide their size, making
analysis of encrypted traffic harder.

Guidance on padding policies for EDNS(0) is provided in
[EDNS0-Pad-Policies].

Cookies

HTTP Cookies SHOULD NOT be accepted by DOH clients unless they are explicitly required by a use case.

Checking PINS

DNS over TLS allows a PIN (and a backup) to be specified for the server. The PIN is the hash of the certificate's SPKI. This check is not implemented because the current open DOT servers do NOT publish nor recommend use of SPKI pins with their servers.

Implementation is a bit hard because C# provides no mechanism to retrieve the SPKI of an X.509 certificate. Will need Bouncy Castle.

The DoH client SHOULD include an HTTP "Accept" request header field
to indicate what type of content can be understood in response.
Irrespective of the value of the Accept request header field, the
client MUST be prepared to process "application/dns-message" (as
described in Section 6) responses but MAY also process other DNS-
related media types it receives.

DOT securedns.eu and unix

Connecting to securedns.eu using DNS over TLS on unix fails with

The remote certificate is invalid according to the validation procedure.