Skip to content

fix(dns): discard mismatched UDP responses - #960

Merged
ryanfowler merged 1 commit into
mainfrom
fix/dns-udp-response-matching
Aug 8, 2026
Merged

fix(dns): discard mismatched UDP responses#960
ryanfowler merged 1 commit into
mainfrom
fix/dns-udp-response-matching

Conversation

@ryanfowler

Copy link
Copy Markdown
Owner

Summary

  • validate UDP DNS response source, transaction ID, opcode, and question
  • discard stale, spoofed, and mismatched datagrams until the query deadline
  • update ECH failure fixtures to return matching SERVFAIL responses

Validation

  • cargo fmt --check
  • cargo clippy --locked --all-targets --all-features -- -D warnings
  • cargo test --locked --all-features --lib --bins
  • cargo test --locked --all-features --test cli --test formatting --test grpc --test har --test http --test install --test network --test terminal --test update --test websocket -- --test-threads=2

Keep receiving until a response matches the query transaction, question, and resolver source. This prevents stale or spoofed datagrams from failing or satisfying a later lookup.
@ryanfowler
ryanfowler enabled auto-merge (squash) August 8, 2026 06:57
@ryanfowler
ryanfowler merged commit 3064423 into main Aug 8, 2026
16 of 20 checks passed
@ryanfowler
ryanfowler deleted the fix/dns-udp-response-matching branch August 8, 2026 07:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant