Skip to content

Feat/dnsscan#847

Open
hellais wants to merge 3 commits intomasterfrom
feat/dnsscan
Open

Feat/dnsscan#847
hellais wants to merge 3 commits intomasterfrom
feat/dnsscan

Conversation

@hellais
Copy link
Copy Markdown
Member

@hellais hellais commented Aug 2, 2022

Added an experiment for scanning open DNS resolvers to detect blocking.

Currently experimental and as such doesn't have a spec for it yet.

Here is a sample of the output of a test run:

{
  "annotations": {
    "architecture": "amd64",
    "engine_name": "ooniprobe-engine",
Add dnsscan to allexperiments
    "engine_version": "3.16.0-alpha",
    "platform": "macos"
  },
  "data_format_version": "0.2.0",
  "input": "ooni.org",
  "measurement_start_time": "2022-08-02 11:22:37",
  "options": [
    "Resolver=udp://9.9.9.9:53"
  ],
  "probe_asn": "AS30722",
  "probe_cc": "IT",
  "probe_ip": "127.0.0.1",
  "probe_network_name": "Vodafone Italia S.p.A.",
  "report_id": "",
  "resolver_asn": "AS30722",
  "resolver_ip": "91.81.132.35",
  "resolver_network_name": "Vodafone Italia S.p.A.",
  "software_name": "miniooni",
  "software_version": "3.16.0-alpha",
  "test_keys": {
    "queries": [
      {
        "answers": [
          {
            "asn": 16509,
            "as_org_name": "Amazon.com, Inc.",
            "answer_type": "A",
            "ipv4": "75.2.60.5",
            "ttl": null
          },
          {
            "asn": 16509,
            "as_org_name": "Amazon.com, Inc.",
            "answer_type": "A",
            "ipv4": "99.83.231.61",
            "ttl": null
          }
        ],
        "engine": "udp",
        "failure": null,
        "hostname": "ooni.org",
        "query_type": "A",
        "resolver_hostname": null,
        "resolver_port": null,
        "resolver_address": "9.9.9.9:53",
        "t": 0.132053
      },
      {
        "answers": null,
        "engine": "udp",
        "failure": "dns_no_answer",
        "hostname": "ooni.org",
        "query_type": "AAAA",
        "resolver_hostname": null,
        "resolver_port": null,
        "resolver_address": "9.9.9.9:53",
        "t": 0.102853
      }
    ],
    "target_resolver": "udp://9.9.9.9:53"
  },
  "test_name": "dnsscan",
  "test_runtime": 0.132149438,
  "test_start_time": "2022-08-02 11:22:37",
  "test_version": "0.1.0"
}

@hellais hellais requested a review from bassosimone as a code owner August 2, 2022 11:25
@hellais
Copy link
Copy Markdown
Member Author

hellais commented Aug 2, 2022

One doubt that this test makes me think of is that we are writing to the resolver_* top level keys several bits of information that are not accurate to this test.

If somebody is to interpret this test as they would any other one, they would mistakenly attribute the results of the queries object to those listed inside of these keys, while the ought to instead be looking at the resolver_address inside of the queries.

Perhaps it's worth adding some additional information to our spec to make it explicit and clear that top level resolver_* keys are only relevant to a system type engine and when you are faced with any other engine you should instead be looking at the resolver_address.
Speaking of which, in these cases it might be beneficial to enrich the data with metadata about the resolver, similarly to what we do with the resolver_ip.

if resolverIP == nil {
return fmt.Errorf("%w: invalid IP address", errInvalidResolver)
}
resolverAddress := fmt.Sprintf("%s:%s", resolverIP, parsedResolver.Port())
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
resolverAddress := fmt.Sprintf("%s:%s", resolverIP, parsedResolver.Port())
resolverAddress := parsedResolver.Host

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or, net.JoinHostPort(resolverIP, parsedResolver.Port()) but you already have this value, so it's better to just use it from the URL rather than reconstructing it.

// is an IPv6 address
if resolverIP.To4() == nil {
resolverAddress = fmt.Sprintf("[%s]:%s", resolverIP, parsedResolver.Port())
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

unnecessary if you rely on URL parsing as mentioned here: https://github.com/ooni/probe-cli/pull/847/files#r935489263

// dnsRoundTrip performs a round trip and returns the results to the caller.
func (m *Measurer) dnsRoundTrip(ctx context.Context, zeroTime time.Time,
logger model.Logger, address string, domain string, tk *TestKeys) {
fmt.Printf("Measuing %s %s", domain, address)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
fmt.Printf("Measuing %s %s", domain, address)
fmt.Printf("Measuring %s %s", domain, address)

defer cancel()
trace := measurexlite.NewTrace(0, zeroTime)
ol := measurexlite.NewOperationLogger(logger, "DNSScan %s %s", address, domain)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

@hellais hellais requested a review from bassosimone August 2, 2022 13:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants