Repository navigation
Harden DNS Relay #1816
Description
We need to follow up #1689 (comment) to make sure the new DNS relay is hardened. There's been a first pass at this but once we merge and exercise it more + ship the rest of #1266 we'll probably find more issues.
Activity
BenTheElder commentedon Oct 1, 2026
Bowei Du (@bowei) are you still taking this one [assign yourself] or should I work on it?
x-ref #2075
bowei commentedon Oct 5, 2026
I have a list of things -- but did you have specific items that you already are thinking of?
BenTheElder commentedon Oct 5, 2026
It seems obviously exhaustable by a bad actor (hah!) currently, ... otherwise generally red-teaming and hardening.
destijl commentedon Oct 19, 2026
🤖 One hardening item for the list, from a recent audit pass at
a30a0a68: the relay picks upstream transaction IDs by starting atuint16(rand.Uint32())frommath/rand/v2and then taking the first free ID (internal/atunnel/dns/pendingreq.go#L116-L118), so concurrent queries get adjacent IDs. Impact is low, because the relay doesn't cache and an off-path spoofer still has to race the upstream answer. If we want to harden it anyway: usecrypto/randfor each ID (retrying on collision) and randomize the source port for each upstream query.Use crypto/rand for upstream DNS transaction IDs (agent-substrate#3020)