Skip to content

dns: stop recording unknown names in the answering machine - #5136

Open
KernelClint wants to merge 1 commit into
secdev:masterfrom
KernelClint:dns-am-no-unknown-name-cache
Open

dns: stop recording unknown names in the answering machine#5136
KernelClint wants to merge 1 commit into
secdev:masterfrom
KernelClint:dns-am-no-unknown-name-cache

Conversation

@KernelClint

Copy link
Copy Markdown
Contributor

DNS_am answers queries from a match mapping of name to address, falling back to the documented
joker and joker6 values for anything not configured.

That mapping is a defaultdict built at
scapy/layers/dns.py:1677,
and the A and AAAA paths reach the fallback by indexing it (:1811, :1827). Indexing a
defaultdict with a missing key inserts it. Every query for a name the operator never configured
therefore adds an entry, and the mapping grows for as long as the machine runs, driven entirely by
what arrives. LLMNR_am inherits the same behaviour.

The change uses a plain dictionary and handles the missing key without writing to it:

-        self.match = collections.defaultdict(lambda: (joker, joker6))
+        self.match = {}
...
-                    rdata = self.match[rqname][0]
+                    try:
+                        rdata = self.match[rqname][0]
+                    except KeyError:
+                        rdata = self.joker

Configured names resolve as before and both jokers keep their documented behaviour; the only change
is that an unknown name is no longer recorded.

The added regressions cover A and AAAA and assert the mapping is still empty after answering a
series of unknown names. Without the source change they fail.

Performance was measured on one computer, before and after the fix: answering a configured name
took 84.5 ns before and 86.8 ns after, a difference of 2.3 ns. Repeat runs moved by about 2%, which
is the same size as the difference, so the test cannot separate them.

@codecov

codecov Bot commented Sep 1, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.64%. Comparing base (b3bbcc8) to head (96530b9).

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #5136   +/-   ##
=======================================
  Coverage   80.63%   80.64%           
=======================================
  Files         390      390           
  Lines       96936    96941    +5     
=======================================
+ Hits        78168    78177    +9     
+ Misses      18768    18764    -4     
Files with missing lines Coverage Δ
scapy/layers/dns.py 83.95% <100.00%> (+0.09%) ⬆️

... and 3 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant