What's Changed
dnsdiag 2.10.1 fixes a code execution issue in dnstraceroute, escapes text from DNS servers and lookups before printing it, and fixes dnseval and dnstraceroute on encrypted transports when the server is given by name. Please upgrade, especially if you use the binary packages, the Docker image or the source tree.
Security
dnstracerouteno longer loadswhois.cache. Since version 2.0.0, when started as a script, it unpickled a file with that name from the current directory on every run, even without-a. Anyone able to put a file in that directory could run code as the user runningdnstraceroute, which is often root. This affects the source tree and the binary packages. It affects the Docker image when the working directory is one that someone else can write to, such as a mounted volume. The console script from a pip install of 2.9.0 or newer does not run this code. AS lookups are now cached for one run only, and any leftoverwhois.cacheis ignored and can be deleted.dnstraceroute -ano longer uses memcached. When python-memcached was installed, cymruwhois used memcached on localhost, and python-memcached unpickles what the server returns.- Text from servers and lookups is now escaped before printing, so it can no longer send terminal escape sequences or forge output lines. This covers EDE, NSID and CHAIN text, AS numbers and owner names from
dnstraceroute -a, and reverse DNS names indnstraceroute. Hostile reverse DNS names got through on musl, which includes the Docker image, while glibc rejected them. macOS and BSD were not tested. - The Docker image and binary packages are rebuilt with a fixed certifi. The 2.10.0 image and packages shipped certifi's emSign roots (GHSA-6q48-6c7w-9gw2), which DoH3 and DoQ use for verification. A pip install already gets the fixed certifi.
Bug Fixes
dnseval(DoT, DoH, DoH3, DoQ) anddnstraceroute(DoH3, DoQ) now send the server name when given a hostname.dnsevalused to fail with servers that need it, such as AdGuard and NextDNS.dnsevalnow also checks the certificate against that name, asdnspingdoes, so a mismatch is an error.dnseval --http3works on IPv6 addresses. Every IPv6 address used to show "Invalid Response".dnsping --dohand--http3with a hostname now honour-4,-6and-p, and no longer look the name up again on each query, which was counted in the reported time.- A non-UTF-8 NSID no longer crashes
dnsping. It is printed as hex. dnspingreports DoH connection failures as "Connection failed". It used to call every failure a refusal, but dnspython does not say why a connection failed.
Known Issues
--tlsfails with a certificate verification error in the macOS binary packages, as it did in 2.10.0, because their bundled OpenSSL looks for CA certificates in a path from the build machine. To work around it, useSSL_CERT_FILE=/etc/ssl/cert.pem dnsping --tls .... DoH, DoH3 and DoQ work, and pip and Docker installs are not affected. The Linux packages look in/usr/lib/ssl, which works on Debian withca-certificatesinstalled. Other distributions may need the same workaround with their own CA file.
Improvements
- Added CleanBrowsing public DNS servers to
public-servers.txtandpublic-v4.txt(#179, thanks to @c4i0b). - dnspython 2.9.2 or newer is required, and the direct requirement on cryptography is gone, since aioquic already requires it.
Testing & CI/CD
- Added offline tests for escaping, server names on encrypted transports, AS lookups and
dnstraceroute's use of the working directory.
Full Changelog: v2.10.0...v2.10.1
Installation
# Using pip
pip install --upgrade dnsdiag
# Using uvx
uvx --from dnsdiag dnsping google.com
# Using pipx
pipx install dnsdiag
# Docker
docker pull farrokhi/dnsdiag:2.10.1Binary packages: Available for Linux (x86_64, aarch64), macOS (Intel, Apple Silicon), and Windows (x86_64) in the release assets below.