#dnspython — Public Fediverse posts

Anyone of you #Python #developers works with #dnspython? The documentation says there is a timeout field implemented. I am working with v2.8.0, and my interpreter complains that there is no argument called timeout. Same holds for the lifetime argument.

Solved it, by adding it to the Resolver.resolve() function. But I still expected it to be in the actual code.

Is this a bug, and the docs differ from the code?

#AskFedi #AskMastodon #DNS

Anyone of you #Python #developers works with #dnspython? The documentation says there is a timeout field implemented. I am working with v2.8.0, and my interpreter complains that there is no argument called timeout. Same holds for the lifetime argument.

Solved it, by adding it to the Resolver.resolve() function. But I still expected it to be in the actual code.

Is this a bug, and the docs differ from the code?

#AskFedi #AskMastodon #DNS

I decided to add #DoQ support to my check_soa script (because it's easy to add as #dnspython supports it pretty much out of the box) so I'm looking for #DNS zones using authoritative nameservers accessible with DoQ. Does anyone knows any?

I know a few recursive servers using #QUIC but I haven't found authoritative servers yet :/

(I'd love to have some myself (my NS can be already be queried using #DoT) but I use #NSD (which has no QUIC support yet) and Debian so...)

I decided to add #DoQ support to my check_soa script (because it's easy to add as #dnspython supports it pretty much out of the box) so I'm looking for #DNS zones using authoritative nameservers accessible with DoQ. Does anyone knows any?

I know a few recursive servers using #QUIC but I haven't found authoritative servers yet :/

(I'd love to have some myself (my NS can be already be queried using #DoT) but I use #NSD (which has no QUIC support yet) and Debian so...)

Oops, the recently released #dnspython 2.6.0 added support for the EDNS NSID option, thus breaking my check_soa scripts. Need to add temporary dnspython version check

(And I should move these scripts in a proper repo)

https://framagit.org/Shaft/dns-tools

Oops, the recently released #dnspython 2.6.0 added support for the EDNS NSID option, thus breaking my check_soa scripts. Need to add temporary dnspython version check

(And I should move these scripts in a proper repo)

https://framagit.org/Shaft/dns-tools

Grumph, une erreur dans la doc de #dnspython :

Le 'target' ici n'est pas un dns.name.Name, mais un bête tas d'octets (bytes donc)

https://dnspython.readthedocs.io/en/stable/rdata-subclasses.html#dns.rdtypes.ANY.URI.URI

Grumph, une erreur dans la doc de #dnspython :

Le 'target' ici n'est pas un dns.name.Name, mais un bête tas d'octets (bytes donc)

https://dnspython.readthedocs.io/en/stable/rdata-subclasses.html#dns.rdtypes.ANY.URI.URI

Kolejny ciekawy problem z #musl libc: `getaddrinfo()` wypełnia pole `.ai_canonname`, nawet jeśli `flags` nie zawiera `AI_CANONNAME`. Niby to nic wielkiego, ale wystarcza, żeby popsuć testy #DNSPython. Technicznie rzecz biorąc, może to być też niezgodne z #POSIX, ale nie mam pewności.

https://www.openwall.com/lists/musl/2024/01/27/5
https://github.com/rthalley/dnspython/issues/1035
https://bugs.gentoo.org/923004

#Python #Gentoo

Another curious #musl libc issue: `getaddrinfo()` fills `.ai_canonname` even if `AI_CANONNAME` is not passed in `flags`. Apparently not a big deal, except that it breaks the tests of #DNSPython when present unexpectedly. Technically, it may also not comply to #POSIX, though I'm not sure.

https://www.openwall.com/lists/musl/2024/01/27/5
https://github.com/rthalley/dnspython/issues/1035
https://bugs.gentoo.org/923004

#Python #Gentoo

Another curious #musl libc issue: `getaddrinfo()` fills `.ai_canonname` even if `AI_CANONNAME` is not passed in `flags`. Apparently not a big deal, except that it breaks the tests of #DNSPython when present unexpectedly. Technically, it may also not comply to #POSIX, though I'm not sure.

https://www.openwall.com/lists/musl/2024/01/27/5
https://github.com/rthalley/dnspython/issues/1035
https://bugs.gentoo.org/923004

#Python #Gentoo

#dnspython 2.5 released

Among the changes, still no options to generate #NSEC3 signatures when using the zone signing function, but it seems it's coming : "[t]he NSEC3 class now has a next_name() method for retrieving the next name as a dns.name.Name"

#DNS #Python #DNSSEC

https://dnspython.readthedocs.io/en/stable/whatsnew.html#id1

#dnspython 2.5 released

Among the changes, still no options to generate #NSEC3 signatures when using the zone signing function, but it seems it's coming : "[t]he NSEC3 class now has a next_name() method for retrieving the next name as a dns.name.Name"

#DNS #Python #DNSSEC

https://dnspython.readthedocs.io/en/stable/whatsnew.html#id1

With #dnspython 2.4.0+, @DNSresolver can be configured to use a DoH resolver without changes in the current code.

DoQ and DoT requires minimal changes

🤔

With #dnspython 2.4.0+, @DNSresolver can be configured to use a DoH resolver without changes in the current code.

DoQ and DoT requires minimal changes

🤔

De l'intérêt de RTFM : il y a une fonction dans le module resolver de #dnspython pour récupérer le A et AAAA d'un nom d'un coup. Ce qui ne diminue bien sûr pas le nombre de requêtes à faire mais allège le code quand on cherche les deux

De l'intérêt de RTFM : il y a une fonction dans le module resolver de #dnspython pour récupérer le A et AAAA d'un nom d'un coup. Ce qui ne diminue bien sûr pas le nombre de requêtes à faire mais allège le code quand on cherche les deux

Je m'ennuie au taf, donc je regarde comment faire de la validation #DNSSEC avec #dnspython. Et peut-être implémenter la chose dans mon check_soa 🤔

Je m'ennuie au taf, donc je regarde comment faire de la validation #DNSSEC avec #dnspython. Et peut-être implémenter la chose dans mon check_soa 🤔

Just added EDNS(0) Padding when using #DNS over #TLS in my check_soa scripts 🥰

(Thanks once again to the great #dnspython toolkit ❤)

https://framagit.org/Shaft/dns-tools

Just added EDNS(0) Padding when using #DNS over #TLS in my check_soa scripts 🥰

(Thanks once again to the great #dnspython toolkit ❤)

https://framagit.org/Shaft/dns-tools

So in my check_soa_multi script (multi-process check_soa using multiprocessing.Pool) is broken when using #dnspython 2.4.0+, if I set payload to whatever value but 0, it crashes the starmap func I use in the Pool 🤔 #Python

Knowing that payload is either an int or None (None doesn't work)

https://framagit.org/Shaft/dns-tools/-/issues/1

So in my check_soa_multi script (multi-process check_soa using multiprocessing.Pool) is broken when using #dnspython 2.4.0+, if I set payload to whatever value but 0, it crashes the starmap func I use in the Pool 🤔 #Python

Knowing that payload is either an int or None (None doesn't work)

https://framagit.org/Shaft/dns-tools/-/issues/1

Any #dnspython devs out there?

Found a minor bug and I do not have a Github account or a Google account (to write to the mailing lists)

Any #dnspython devs out there?

Found a minor bug and I do not have a Github account or a Google account (to write to the mailing lists)

Thanks to #dnspython, I have a tool to easily “deduplicate” my adblock list. I remove any domain for which the parent zone is present in the list (eg. if there is ads.example.com and tracker.ads.example.com, the latter will be removed. I use my adblock list such as if a domain is blocked, the whole subtree is blocked)

The list is divided by 2: from 186950 to 98610 domain.

The deduplication is quite CPU intensive though

Thanks to #dnspython, I have a tool to easily “deduplicate” my adblock list. I remove any domain for which the parent zone is present in the list (eg. if there is ads.example.com and tracker.ads.example.com, the latter will be removed. I use my adblock list such as if a domain is blocked, the whole subtree is blocked)

The list is divided by 2: from 186950 to 98610 domain.

The deduplication is quite CPU intensive though

RFC 4034, Appendix B:

“The key tag is the same for all DNSKEY algorithm types except algorithm 1 [...]. The key tag algorithm is the sum of the wire format of the DNSKEY RDATA broken into 2 octet groups. First, the RDATA (in wire format) is treated as a series of 2 octet groups. These groups are then added together, ignoring any carry bits.”

Ok #DNSSEC, you win. I will rely on #dnspython function to find a key tag and will not try to implement that myself ^^'

RFC 4034, Appendix B:

“The key tag is the same for all DNSKEY algorithm types except algorithm 1 [...]. The key tag algorithm is the sum of the wire format of the DNSKEY RDATA broken into 2 octet groups. First, the RDATA (in wire format) is treated as a series of 2 octet groups. These groups are then added together, ignoring any carry bits.”

Ok #DNSSEC, you win. I will rely on #dnspython function to find a key tag and will not try to implement that myself ^^'

Trying to test #dnspython 2.3.0 #DNSSEC signing function

Private keys need to be a cryptography.hazmat.primitives.asymmetric private key class

Have not find a way, if any, to import in that format my ldns-genereated private key

Cryptography doc states:

"This is a “Hazardous Materials” module. You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing because this module is full of land mines, dragons, and dinosaurs with laser guns."

Don't want to mess with that!

Trying to test #dnspython 2.3.0 #DNSSEC signing function

Private keys need to be a cryptography.hazmat.primitives.asymmetric private key class

Have not find a way, if any, to import in that format my ldns-genereated private key

Cryptography doc states:

"This is a “Hazardous Materials” module. You should ONLY use it if you’re 100% absolutely sure that you know what you’re doing because this module is full of land mines, dragons, and dinosaurs with laser guns."

Don't want to mess with that!

Et... #dnspython 2.3.0 arrive aussi dans Debian Testing \o/

Et... #dnspython 2.3.0 arrive aussi dans Debian Testing \o/