Implement DNS HTTPS RR (RFC 9460) #2484
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Initial commit, saving work - Simple test: just copied get_caa_rrecord Also renamed Just copied get_caa_rr_record to get_caa_rrecord to remove the redundant r
- moved function + output to the very top (still not the right place) - raw_https now should contain the output in any case, binhex parse needs to be completed - fixed bug that CAA records were queried when it was instructed to minimize/skip or use proxy only
drwetter
changed the title
- intro section has now bold keys and plain values - DNS RR is now below rDNS, if servive is HTTP Open: when ASSUME_HTTP is set and no services was detected, this needs to be handled
|
status
|
|
Note to self
|
... probably need to be done later again when we move the entry to protocols
But there's lot of work to do --> push to later
drwetter
added a commit
that referenced
this pull request
Jul 3, 2025
This is an implementation for QUIC (RFC 9000, RFC 9114). It's purely OpenSSL based for now. As some distros support newer (>= 3.2) versions this works on some distros now and will work on more as time goes by. It has been tested with MacOS and Linux. If there's an OpenSSL version in /usr/bin/ it will automagically use that version. A new short sub function named sub_quic() was introduced for handling this as run_protocols() is already "full". It appears below TLS 1.3. A check against HTTPS RR #2484 is planned but not implemented yet. PR #2484 has to be worked on and merged before. New variables were introduces (HAS_QUIC/ +HAS2_QUIC). Also there's QUIC_WAIT as we run the connect in the background and we need a wait time. HAS_UDS2 was renamed to HAS2_UDS as HAS2 should signal this is for OPENSSL2 and UDS2 doesn't make sense. To clarify: - check for a proxy and then don't do the check? - short unit test (t/31_isJSON_valid.t cjecks cloudflare but ...)
13 tasks
(this needs to be re-done)... - add *_HTTPS globals to ensure we can make use of newer DNS binaries - set them appropriately in check_resolver_bins() - parser for those scenarios in get_https_rrecord() (to be tested) - start working on the binary format ~ RFC 3597 as fallback - lots of temporary comments to make it better understandable Worked so far for testssl.net, dev.testssl.sh
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What is your change about?
If it's a code change please check the boxes which are applicable:
help()Open: when ASSUME_HTTP is set and no services was detected, this needs to be handled