libnetng : name resolution

[Frédéric Raynal]

Hi,

Attached is a file containing the new API for name resolution. As we
talked earlier with Mike nd Kirby, it is now based on getaddrinfo()
and getnameinfo() because they are supposed to be protocol
independant. So, the functions provided here work with both IPv4 and
IPv6 ... in theory ;-)


Moreover, I have included the structure of addresses defined by Dug
Song in libdnet (once again, thanks to you for that nice libray) That
way, compatibility between the libraries will help in futur
developments.

Important
=========

Performing some tests on Linux (2.6) and Mac OS X (10.3), I noticed
different behavior ... which is quite annoying. I cant say right now
if it comes from a stupid bug I made, or if is a "normal bug".

Hence, I _really_ need you to make tests on your system



Linux Mac OS X
2.6 10.3
./gai -i 1.2.3.4 ok ok
./gai -i 1.2.3.4 -n ok ok
./gai -i 1.2.3.4 -c ok 0:1 ok 0:1
./gai -i 217.12.3.11 -c ok 0:1 ok 0:1

./gai -i google.fr -n [1] ok 1:0
./gai -i google.fr ok 1:0 ok 1:0
./gai -i google.fr -c ok 1:X ok 1:0
./gai -i yahoo.fr -c [2] 1:1 [3] 1:0

./gai -4 1.2.3.4 ok 0:1 [4]
./gai -4 1.2.3.4 -c [6] 0:1 [4]
./gai -4 1.2.3.4 -n ok [4]


[1] unable to resolve (err=-2: Name or service not known)
[2] ascii -> addr: name=yahoo.fr addr=217 12 3 11 (FQDN ok)
[3] ascii -> addr: name=yahoo.fr addr=217 12 3 11
[4] libnet_resolve_addr2ascii(): getnameinfo() failed (Unknown error: 0)

X:Y means X DNS request of type A, and Y of type PTR. When nothing is
speicied, it means there is no DNS request.

On Mac OS X, take care there is a DNS cache so there can be no DNS
request if the request is already cached.

Questions
=========

- these functions need to be tested everywhere they can (Solaris, Win,
and so on).

- why getnameinfo() fails on my iBook ?

- can someone test that with IPv6

- these functions are probably not available on all systems. OpenSSH
made their own portable one (in openbsd/fake-rfc2553.c)
Is there a volunteer to do that ? I promise to offer him a beer.



Thanks for your help

Fred

PS: I'll release an alpha version (ie not all builders and features
from 1.1 API will be available) probably tomorow or monday.

[Kirby Kuehl]

WIN32 code ported without too much trouble. (See changes in attached)
NOTE: I have used the getopt.c and getopt.h included with the current
win32 libnet code.

- - Kirby

C:\cvs\gai\Debug>gai -i 10.25.80.155
ascii -> addr: name=10.25.80.155 addr=10 25 80 4294967195


C:\cvs\gai\Debug>gai -i 10.25.80.155 -n
ascii -> addr: name=10.25.80.155 addr=10 25 80 4294967195


C:\cvs\gai\Debug>gai -i www.google.com
ascii -> addr: name=www.google.com addr=66 102 7 4294967187

C:\cvs\gai\Debug>gai -i www.google.com -c
ascii -> addr: name=www.google.com addr=66 102 7 4294967187 (FQDN
ok)


C:\cvs\gai\Debug>gai -i www.google.com -n
libnet_resolve_ascii2addr(): unable to resolve (err=11001: No such
host is known
. )

- -----Original Message-----
From: Frédéric Raynal [mailto:ipappy-***@security-labs.org]
Sent: Saturday, August 14, 2004 12:47 PM
To: ***@securityfocus.com
Cc: mike schiffman; Kirby Kuehl
Subject: libnetng : name resolution


Hi,

Attached is a file containing the new API for name resolution. As we
talked earlier with Mike nd Kirby, it is now based on getaddrinfo()
and getnameinfo() because they are supposed to be protocol
independant. So, the functions provided here work with both IPv4 and
IPv6 ... in theory ;-)


Moreover, I have included the structure of addresses defined by Dug
Song in libdnet (once again, thanks to you for that nice libray) That
way, compatibility between the libraries will help in futur
developments.

Important
=========

Performing some tests on Linux (2.6) and Mac OS X (10.3), I noticed
different behavior ... which is quite annoying. I cant say right now
if it comes from a stupid bug I made, or if is a "normal bug".

Hence, I _really_ need you to make tests on your system



Linux Mac OS X
2.6 10.3
./gai -i 1.2.3.4 ok ok
./gai -i 1.2.3.4 -n ok ok
./gai -i 1.2.3.4 -c ok 0:1 ok 0:1
./gai -i 217.12.3.11 -c ok 0:1 ok 0:1

./gai -i google.fr -n [1] ok 1:0
./gai -i google.fr ok 1:0 ok 1:0
./gai -i google.fr -c ok 1:X ok 1:0
./gai -i yahoo.fr -c [2] 1:1 [3] 1:0

./gai -4 1.2.3.4 ok 0:1 [4]
./gai -4 1.2.3.4 -c [6] 0:1 [4]
./gai -4 1.2.3.4 -n ok [4]


[1] unable to resolve (err=-2: Name or service not known) [2] ascii
- -> addr: name=yahoo.fr addr=217 12 3 11 (FQDN ok) [3] ascii -> addr:
name=yahoo.fr addr=217 12 3 11 [4] libnet_resolve_addr2ascii():
getnameinfo() failed (Unknown error: 0)

X:Y means X DNS request of type A, and Y of type PTR. When nothing
is speicied, it means there is no DNS request.

On Mac OS X, take care there is a DNS cache so there can be no DNS
request if the request is already cached.

Questions
=========

- - these functions need to be tested everywhere they can (Solaris,
Win,
and so on).

- - why getnameinfo() fails on my iBook ?

- - can someone test that with IPv6

- - these functions are probably not available on all systems. OpenSSH
made their own portable one (in openbsd/fake-rfc2553.c)
Is there a volunteer to do that ? I promise to offer him a beer.



Thanks for your help

Fred

PS: I'll release an alpha version (ie not all builders and features
from 1.1 API will be available) probably tomorow or monday.

[David Barroso]

SunOS 5.8 (sparc) results:

SunOS appserver 5.8 Generic_108528-15 sun4u sparc SUNW,Sun-Blade-100

sh-2.03# ./gai -i 1.2.3.4
ascii -> addr: name=1.2.3.4 addr=1 2 3 4
sh-2.03# ./gai -i 1.2.3.4 -n
ascii -> addr: name=1.2.3.4 addr=1 2 3 4
sh-2.03# ./gai -i 1.2.3.4 -c
ascii -> addr: name=1.2.3.4 addr=1 2 3 4
sh-2.03# ./gai -i 217.12.3.11 -c
ascii -> addr: name=217.12.3.11 addr=217 12 3 11
sh-2.03# ./gai -i google.fr -n
libnet_resolve_ascii2addr(): unable to resolve (err=8: host/servname not
known)
sh-2.03# ./gai -i google.fr
ascii -> addr: name=google.fr addr=216 239 57 104
sh-2.03# ./gai -i google.fr -c
ascii -> addr: name=google.fr addr=216 239 57 104
sh-2.03# ./gai -i yahoo.fr -c
ascii -> addr: name=yahoo.fr addr=217 12 3 11
sh-2.03# ./gai -4 1.2.3.4
addr -> ascii: name=1.2.3.4 addr=1 2 3 4
sh-2.03# ./gai -4 1.2.3.4 -c
libnet_resolve_addr2ascii(): getnameinfo() failed (Error 0)
sh-2.03# ./gai -4 1.2.3.4 -n
addr -> ascii: name=1.2.3.4 addr=1 2 3 4

Regards

[Frédéric Raynal]

Hello,

Here is the uptade table with Kirby's and David's results :


Linux Mac OS X Windows SunOS 5.8
2.6 10.3 "2k"(1) sparc (2)
gai -i 1.2.3.4 ok ok ok ok
gai -i 1.2.3.4 -n ok ok ok ok
gai -i 1.2.3.4 -c ok 0:1 ok 0:1 ok
gai -i 217.12.3.11 -c ok 0:1 ok 0:1 ok

gai -i google.fr -n [1] ok 1:0 [5] [6]
gai -i google.fr ok 1:0 ok 1:0 ok ok
gai -i google.fr -c ok 1:X ok 1:0 ok ok
gai -i yahoo.fr -c [2] 1:1 [3] 1:0 [3]

gai -4 1.2.3.4 ok 0:1 [4] ok
gai -4 1.2.3.4 -c [7] 0:1 [4]
gai -4 1.2.3.4 -n ok [4] ok

(1) Kirby Kuehl: dont have the exact version of Win, and dont have the
stats on DNS queries
(2) David Barroso : SunOS appserver 5.8 Generic_108528-15 sun4u sparc
SUNW,Sun-Blade-100, dont have the stats on DNS queries

[1] unable to resolve (err=-2: Name or service not known)
[2] ascii -> addr: name=yahoo.fr addr=217 12 3 11 (FQDN ok)
[3] ascii -> addr: name=yahoo.fr addr=217 12 3 11
[4] getnameinfo() failed (Unknown error: 0)
[5] unable to resolve (err=11001: No such host is known . )
[6] unable to resolve (err=8: host/servname not known)
[7] getnameinfo() failed (Success)
[8] getnameinfo() failed (Error 0)

X:Y means X DNS request of type A, and Y of type PTR. When nothing is
speicied, it means there is no DNS request.


Note that the "gai" program has been slightly improved and is now
available in the sample directoy. Moreover, you dont have to be root
anymore to do name resolution ;-)

BTW, the new LIBNET_PCAP mode does not require to be root to, very
practical to perform tests.

Fred Raynal