SCALE: Automatically Finding RFC Compliance Bugs in DNS Nameservers
Talkat 19th USENIX Symposium on Networked Systems Design and Implementation (NSDI '22) · 2022-04-04..04-06·
summary
SCALE uses an executable RFC model to jointly generate zone files and queries and Ferret runs those tests against real servers. The pipeline uses the Zen modeling tool to symbolically enumerate resolution paths under a small-scope bound (domain length and ≤4 records) and produced ~13K tests. Running those tests on 8 open-source servers including Bind, PowerDNS, Knot and Nsd yields 62% disagreements, identifies 30 unique bugs (20 fixed) and exposes a critical Bind crashable DoS.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:47Many DNS Implementations
- 0:57DNS Software needs to be absolutely
- 1:50How the Domain Name System Wo
- 2:43DNS is way more complex than people
- 5:26BIND Crash Remote Exploitation
- 6:31BIND Crash Disclosure
- 7:24Standard Automated Testers are insufficie
- 8:54Our Approach
- 10:05FERRET: Tool based on SCALE for DN
- 10:59Test Generation Module
- 12:15Challenge - Generating Valid Zone
- 13:38Exhaustive Model Coverage with Test Ge
- 14:19Bugs Found and Confirmed in Ope source DNS Implementations
- 15:36Summary
related talks
16mIceberg: Automated Verification of DNS Authoritative Engines via Just-in-Time...
40mScaling DNS
01h 27mDNS at 30
10mLet’s implement DNS to learn history!
34mUsing DNS as a layer of defense
37mPerformance Testing of DNS Servers
16mAttacking with Something That Does Not Exist: 'Proof of Non-Existence' Can Exhaust DNS...
15mYou Depend on DNS, This Is How It Works and You Won't...