EchoLot/echolot
1
0
Fork 0
Code Pull Requests Actions Packages Projects Releases 31 Wiki Activity

server: canary DNS — authoritative zone with frozen §6.1 reference records
server-release / image (push) Successful in 15s
Details
server-test / test (push) Successful in 26s
Details
server-release / release (push) Successful in 27s
Details

Browse Source 
Stdlib DNS responder (no external deps): parses single-question queries
with EDNS OPT (bufsize, DO, ECS), serves the spec's frozen reference
records (ttl-{5,60,3600,86400} A/AAAA/TXT, many-rr 8×A in order, big-txt
~1800B), and per-query <nonce>.<session>.<zone> answers in 192.0.2.0/24.
UDP truncation sets TC past 512 (or the EDNS bufsize); TCP never
truncates — the EDNS-bufsize / TCP-fallback test. Every query is logged
(qname, resolver, transport, EDNS, ECS, case) and surfaced per session
prefix in GET /v1/sessions/{id}/observations as dns_canary. Profile gains
canary_zone + the canary-dns capability when configured.

Wire format validated against an independent client (correct rcodes,
answer counts, TC behavior, full EDNS response); unit tests cover
references, truncation-vs-EDNS, logging, NXDOMAIN.

Versioning: patch-first convention recorded in CLAUDE.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
mrambossek
2026-07-31 20:08:30 +02:00
co-authored by Claude Opus 5
parent 4f5499198b
commit 35baf70cdb
9 changed files with 882 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/README.md
+11 -3
View File
@@ -36,9 +36,17 @@ All configurable via `ECHOLOT_*_LISTEN`. Plus:
2. **Second IP (optional):** full RFC 5780 NAT-behavior discovery (`stun-5780`) needs an
alternate reply address; without it the profile advertises `stun-basic` and clients degrade
gracefully.
3. **Delegated DNS subzone (optional, later):** the `canary-dns` capability needs port 53 on
some IP + an NS delegation (mind systemd-resolved on 127.0.0.53). Absent → capability simply
not advertised.
3. **Delegated DNS subzone (for `canary-dns`):** set `ECHOLOT_DNS_LISTEN` (udp+tcp/53 on the
service IPs) and `ECHOLOT_CANARY_ZONE` (e.g. `c.echo-lot.app`), then delegate the zone to
this host in your DNS provider:
```
c.echo-lot.app. NS fmr-1.echo-lot.app.
c.echo-lot.app. NS fmr-2.echo-lot.app.
```
The server is authoritative for that zone only, serving the spec §6.1 reference records
(frozen in `internal/canarydns/dns_reference.go`) plus per-query `<nonce>.<session>.<zone>`
lookups it logs. Binding :53 on the public IPs is fine even with systemd-resolved (it only
claims 127.0.0.53). Absent config → capability simply not advertised.
4. **Outbound freedom** for connect-back / delayed-echo actions — no extra inbound ports;
generated traffic goes only to the session's observed source.