dns: simplify @hnw function and additional fixes

dns/client.go

@@ -24,8 +24,11 @@ type ResolveConfig struct {
 	Questions       []Question
 	Additional      []Resource
 	EnableRecursion bool
-	MaxIPs          uint16
-	MaxCNAMEs       uint16
+	// MaxResponseAnswers limits how many answer records are decoded from the
+	// DNS response. If zero it defaults to the number of Questions. Answers
+	// are decoded in wire order regardless of type, so a response resolved
+	// through CNAMEs needs room for the CNAME records as well as the addresses.
+	MaxResponseAnswers uint16
 }
 
 func (sudp *Client) Protocol() uint64 { return uint64(lneto.IPProtoUDP) }
@@ -39,11 +42,10 @@ func (c *Client) StartResolve(localPort, txid uint16, cfg ResolveConfig) error {
 	if nd > math.MaxUint16 || nd == 0 {
 		return lneto.ErrInvalidConfig
 	}
-	maxIPs := cfg.MaxIPs
-	if maxIPs == 0 {
-		maxIPs = uint16(nd)
+	maxAns := cfg.MaxResponseAnswers
+	if maxAns == 0 {
+		maxAns = uint16(nd)
 	}
-	maxAns := maxIPs + cfg.MaxCNAMEs
 	c.reset(localPort, txid, CQueryPending, cfg.EnableRecursion)
 	c.msg.LimitResourceDecoding(uint16(nd), maxAns, 0, 0)
 	c.msg.AddQuestions(cfg.Questions)

dns/definitions.go

@@ -197,6 +197,8 @@ const (
 	TypeALL   Type = 255 // ALL
 )
 
+func (tp Type) IsIPAddr() bool { return tp == TypeA || tp == TypeAAAA }
+
 // A Class is a type of network.
 type Class uint16
 

dns/dns.go

@@ -99,6 +99,12 @@ func NamesEqual(a, b Name) bool {
 	return internal.BytesEqual(a.data, b.data)
 }
 
+// NamesEqualFold reports whether two DNS names are equal under ASCII case
+// folding, which is how DNS labels compare per RFC 1035 section 2.3.3.
+func NamesEqualFold(a, b Name) bool {
+	return internal.BytesEqualFoldASCII(a.data, b.data)
+}
+
 type ZFlags uint16
 
 func NewResource(name Name, typ Type, class Class, ttl uint32, data []byte) Resource {
@@ -299,64 +305,55 @@ func (m *Message) AppendTo(buf []byte, txid uint16, flags HeaderFlags) (_ []byte
 	return buf, nil
 }
 
-// WriteAnswers follows CNAMEs from host among the answers and writes the
-// resulting addresses into dst.
+// WriteAnswers writes the addresses answering host into dst, following the
+// CNAME chain rooted at host. It returns the number of addresses written.
 func (m *Message) WriteAnswers(dst []netip.Addr, host string) (n uint16, err error) {
-	var alias Name
+	// Each round resolves one CNAME, which consumes an answer. Bounding the
+	// walk by the answer count is thus enough to reach the addresses, and
+	// terminates on cyclic chains.
+	var alias Name // Canonical name reached so far; zero means host itself.
 	for range m.Answers {
-		var (
-			next     Name
-			hasAddrs bool
-		)
+		var next Name
 		for i := range m.Answers {
 			ans := &m.Answers[i]
-			hdr := ans.Header()
-			if !hdr.pertainsTo(alias, host) {
+			if !ans.header.ownedBy(alias, host) {
 				continue
 			}
-			switch hdr.Type {
-			case TypeA, TypeAAAA:
-				hasAddrs = true
-			case TypeCNAME:
-				if cname, ok := ans.CNAMEView(); ok && cname.Len() != 0 {
+			switch {
+			case ans.header.Type.IsIPAddr():
+				if int(n) >= len(dst) {
+					return n, lneto.ErrExhausted
+				}
+				addr, ok := netip.AddrFromSlice(ans.RawData())
+				if !ok {
+					err = lneto.ErrInvalidAddr
+					continue
+				}
+				dst[n] = addr
+				n++
+			case ans.header.Type == TypeCNAME:
+				if cname := ans.CNAMEView(); cname.Len() != 0 {
 					next = cname
 				}
 			}
 		}
-		if hasAddrs || next.Len() == 0 {
+		if n > 0 || next.Len() == 0 {
 			break
 		}
 		alias = next
 	}
-
-	for i := range m.Answers {
-		if int(n) >= len(dst) {
-			return n, lneto.ErrExhausted
-		}
-		ans := &m.Answers[i]
-		hdr := ans.Header()
-		isAddr := hdr.Type == TypeA || hdr.Type == TypeAAAA
-		if !isAddr || !hdr.pertainsTo(alias, host) {
-			continue
-		}
-		var ok bool
-		dst[n], ok = netip.AddrFromSlice(ans.RawData())
-		if !ok {
-			err = lneto.ErrInvalidAddr
-		} else {
-			n++
-		}
-	}
 	return n, err
 }
 
-// pertainsTo reports whether the record's owner name is the given name: host
-// or one of the aliases resolved so far.
-func (h *ResourceHeader) pertainsTo(alias Name, host string) bool {
+// ownedBy reports whether the record's owner name is the name being resolved:
+// the alias reached by following CNAMEs, or host at the root of the chain.
+func (h *ResourceHeader) ownedBy(alias Name, host string) bool {
 	if alias.Len() == 0 {
 		return h.Name.EqualString(host)
 	}
-	return NamesEqual(h.Name, alias)
+	// Fold: the server chooses the case of both the CNAME target and the owner
+	// name of the records it aliases, and may randomize it (DNS 0x20).
+	return NamesEqualFold(h.Name, alias)
 }
 
 func (m *Message) Len() uint16 {
@@ -450,11 +447,13 @@ func (r *Resource) RawData() []byte {
 	return r.data[:length]
 }
 
-func (r *Resource) CNAMEView() (Name, bool) {
-	if r.header.Type == TypeCNAME {
-		return Name{data: r.RawData()}, true
+// CNAMEView returns the canonical name held by a CNAME record, aliasing the
+// Resource's buffer. It returns a zero Name for any other record type.
+func (r *Resource) CNAMEView() Name {
+	if r.header.Type != TypeCNAME {
+		return Name{}
 	}
-	return Name{}, false
+	return Name{data: r.RawData()}
 }
 
 func (q *Question) Reset() {
@@ -507,33 +506,20 @@ func (r *Resource) Decode(b []byte, off uint16) (uint16, error) {
 		return off, errResourceLen
 	}
 	end := off + r.header.Length
-	r.data = append(r.data[:0], b[off:end]...)
 	if r.header.Type == TypeCNAME {
-		raw := b[off:end]
-		data, derr := expandName(r.data[:0], b, off)
-		if derr == nil {
-			r.data = data
+		// CNAME data is a name which may use message compression. Expand it now
+		// since r.data is detached from b, leaving pointers unresolvable later.
+		cname := Name{data: r.data[:0]}
+		if _, derr := cname.Decode(b, off); derr == nil {
+			r.data = cname.data
 			r.header.Length = uint16(len(r.data))
-		} else {
-			r.data = append(r.data[:0], raw...)
+			return end, nil
 		}
 	}
+	r.data = append(r.data[:0], b[off:end]...)
 	return end, nil
 }
 
-func expandName(buf []byte, msg []byte, off uint16) ([]byte, error) {
-	appended := 0
-	_, err := visitAllLabels(msg, off, func(label []byte) {
-		buf = append(buf, byte(len(label)))
-		buf = append(buf, label...)
-		appended += 1 + len(label)
-	}, allowCompression)
-	if err != nil {
-		return buf[:len(buf)-appended], err
-	}
-	return append(buf, 0), nil
-}
-
 func (r *Resource) appendTo(buf []byte) (_ []byte, err error) {
 	buf, err = r.header.appendTo(buf)
 	if err != nil {

dns/dns_test.go

@@ -268,9 +268,8 @@ func TestClient_CNAMEResponse(t *testing.T) {
 			Type:  TypeA,
 			Class: ClassINET,
 		}},
-		EnableRecursion: true,
-		MaxIPs:          4,
-		MaxCNAMEs:       2,
+		EnableRecursion:    true,
+		MaxResponseAnswers: 6,
 	})
 	if err != nil {
 		t.Fatal("failed to start DNS resolve:", err)
@@ -342,6 +341,24 @@ func TestMessage_WriteAnswers(t *testing.T) {
 			},
 			want: nil,
 		},
+		{
+			name: "CNAME target case differs from owner name",
+			host: "a.com",
+			// A server picks the case of both the CNAME target and the owner
+			// name of the record it aliases, and may randomize it (DNS 0x20),
+			// so the two must compare under ASCII case folding.
+			response: []byte{
+				// Header: txid 0xabcd, QR|RD|RA, QD=1 AN=2 NS=0 AR=0.
+				0xab, 0xcd, 0x81, 0x80, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
+				// Question: a.com A IN.
+				0x01, 'a', 0x03, 'c', 'o', 'm', 0x00, 0x00, 0x01, 0x00, 0x01,
+				// Answer 1: a.com CNAME B.CoM.
+				0x01, 'a', 0x03, 'c', 'o', 'm', 0x00, 0x00, 0x05, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x07, 0x01, 'B', 0x03, 'C', 'o', 'M', 0x00,
+				// Answer 2: b.com A IN ttl=10 rdlen=4 1.2.3.4.
+				0x01, 'b', 0x03, 'c', 'o', 'm', 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x04, 0x01, 0x02, 0x03, 0x04,
+			},
+			want: []netip.Addr{netip.AddrFrom4([4]byte{1, 2, 3, 4})},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -372,7 +389,7 @@ func TestClient_ReceivesDNSResponse(t *testing.T) {
 	const hostname = "example.com"
 	const txid = uint16(12345)
 	const clientPort = uint16(54321)
-	const maxIPs = 4
+	const maxAnswers = 4
 	allIPs := [5][4]byte{
 		{192, 0, 2, 1},
 		{192, 0, 2, 2},
@@ -387,7 +404,7 @@ func TestClient_ReceivesDNSResponse(t *testing.T) {
 	}{
 		{name: "single_answer", responseIPs: allIPs[:1], wantAnswers: 1},
 		{name: "multiple_answers", responseIPs: allIPs[:4], wantAnswers: 4},
-		{name: "answer_limit", responseIPs: allIPs[:5], wantAnswers: maxIPs},
+		{name: "answer_limit", responseIPs: allIPs[:5], wantAnswers: maxAnswers},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -419,9 +436,8 @@ func TestClient_ReceivesDNSResponse(t *testing.T) {
 					Type:  TypeA,
 					Class: ClassINET,
 				}},
-				EnableRecursion: true,
-				MaxIPs:          maxIPs,
-				MaxCNAMEs:       0, // No CNAME records in this response.
+				EnableRecursion:    true,
+				MaxResponseAnswers: maxAnswers,
 			})
 			if err != nil {
 				t.Fatal("failed to start DNS resolve:", err)
@@ -437,7 +453,7 @@ func TestClient_ReceivesDNSResponse(t *testing.T) {
 				t.Fatal("failed to demux DNS response:", err)
 			}
 
-			var addrs [maxIPs]netip.Addr
+			var addrs [maxAnswers]netip.Addr
 			answers, err := client.ResponseAnswerLookup(addrs[:], hostname)
 			if err != nil {
 				t.Fatal("failed to look up DNS response answers:", err)