LLT-7052: DNS packet codec by tomasz-grz · Pull Request #1688 · NordSecurity/libtelio

tomasz-grz · 2026-02-20T09:17:21Z

Problem

We want to get rid of all hickory_server dependencies, because it set's up a full blown DNS server, we maintain our own (outdated) fork of, and it was source of a lot of bugs.

As a first step we need to decide if DNS requests are related to .nord zone.
If they are, they should handled by our local resolver, and we need to serve the response packet back.
If not, the request is forwarded and resolved by the upstream nameservers.

Solution

This module incorporates:

a lightweight decoder, that converts DNS request bytes into a DnsPacket<'_> struct, and exposes a helper functions like parse_dns_packet(), find_nord_query() and normalize_qname() to simplify with the correct request handling.
A packet builder specific for the local resolver use case, that converts a ResponseKind enum into appropriate DNS response bytes.

☑️ Definition of Done checklist

Commit history is clean (requirements)
README.md is updated
Functionality is covered by unit or integration tests

crates/telio-dns/src/packet_encoder.rs

stalowyjez

I have mixed feeling for this PR, reducing dependencies is always nice, but it feels a bit like reinventing the wheel. We also have some code in libfirewall which does some DNS parsing, maybe we should create some public DNS helper crate for pnet which would address our needs?

crates/telio-dns/src/packet_decoder.rs

stalowyjez · 2026-02-26T15:23:49Z

crates/telio-dns/src/packet_encoder.rs

+pub struct Soa {
+    mname: &'static str,
+    rname: &'static str,
+    serial: u32,
+    refresh: i32,
+    retry: i32,
+    expire: i32,
+    minimum: u32,


This struct feels more like ttl_to_nord_soa_bytes function with everything written 3 times instead of just once ^^'

Could you elaborate a little bit more?

In essence I wanted all of it to be static, but we do have configurable TTL..

I guess having a const array (created in compile time with come const stuff) and just changing the ttl byte would be fastest, but I guess sth like:

fn create_nord_soa_with_ttl(ttl: u32) -> Result<Vec<u8>, DnsBuildError> { let mut bytes = Vec::new(); encode_name(&mut bytes, "mesh.nordsec.com."); encode_name(&mut bytes, "support.nordsec.com."); bytes.extend_from_slice(&2015082403.to_be_bytes()); bytes.extend_from_slice(&7200.to_be_bytes()); bytes.extend_from_slice([&self.retry.to_be_bytes()](i32::try_from(ttl).map_err(|_| DnsBuildError::SoaTtlOutOfRange)?)); bytes.extend_from_slice(&1209600.to_be_bytes()); bytes.extend_from_slice(&ttl); bytes }

makes sense here. But probably reusing https://docs.rs/domain/0.11.1/domain/rdata/rfc1035/struct.Soa.html#impl-Soa%3CN%3E would also be nice? This would add a dependency on domain, but I think it is also a nice option to use instead of pnet dns stuff?

Ofc, we could add some comments, or wrap stuff in come constants to make it clearer

I wanted to use domain in the beginning but was asked not to add any additional dependencies since we have pnet..

I'll try to see how can I make this part "nicer"

Removed the struct and converted to create_nord_soa_bytes

crates/telio-dns/src/packet_encoder.rs

crates/telio-dns/src/packet_decoder.rs

crates/telio-dns/src/packet_encoder.rs

stalowyjez

Looks good enough, +1

stalowyjez · 2026-03-03T14:04:05Z

crates/telio-dns/src/packet_decoder.rs

+/// Normalize the name, converting to lowercase and trimming trailing dot
+pub fn normalize(name: &str) -> String {
+    name.trim().trim_end_matches('.').to_ascii_lowercase()
+}


Hmm, do we need it as a separate function? And should it be public?

It's necessary for populating or searching the local "nord" records zone.

stalowyjez · 2026-03-03T15:01:43Z

crates/telio-dns/src/packet_encoder.rs

+pub struct Soa {
+    mname: &'static str,
+    rname: &'static str,
+    serial: u32,
+    refresh: i32,
+    retry: i32,
+    expire: i32,
+    minimum: u32,


I guess having a const array (created in compile time with come const stuff) and just changing the ttl byte would be fastest, but I guess sth like:

fn create_nord_soa_with_ttl(ttl: u32) -> Result<Vec<u8>, DnsBuildError> { let mut bytes = Vec::new(); encode_name(&mut bytes, "mesh.nordsec.com."); encode_name(&mut bytes, "support.nordsec.com."); bytes.extend_from_slice(&2015082403.to_be_bytes()); bytes.extend_from_slice(&7200.to_be_bytes()); bytes.extend_from_slice([&self.retry.to_be_bytes()](i32::try_from(ttl).map_err(|_| DnsBuildError::SoaTtlOutOfRange)?)); bytes.extend_from_slice(&1209600.to_be_bytes()); bytes.extend_from_slice(&ttl); bytes }

makes sense here. But probably reusing https://docs.rs/domain/0.11.1/domain/rdata/rfc1035/struct.Soa.html#impl-Soa%3CN%3E would also be nice? This would add a dependency on domain, but I think it is also a nice option to use instead of pnet dns stuff?

stalowyjez · 2026-03-03T15:02:27Z

crates/telio-dns/src/packet_encoder.rs

+pub struct Soa {
+    mname: &'static str,
+    rname: &'static str,
+    serial: u32,
+    refresh: i32,
+    retry: i32,
+    expire: i32,
+    minimum: u32,


Ofc, we could add some comments, or wrap stuff in come constants to make it clearer

tomaszklak · 2026-03-16T10:49:28Z

I have mixed feeling for this PR, reducing dependencies is always nice, but it feels a bit like reinventing the wheel.

I have the same feeling, and I'm also missing explanation why we want to "get rid of all hickory_server dependencies."

tomaszklak · 2026-03-16T11:00:51Z

If they are, they should handled by our local resolver, and we need to serve the response packet back.

And what if they are not?

tomaszklak · 2026-03-16T13:31:45Z

I feel like there should be our rfc that describes what behavior do we want from magic dns.

crates/telio-dns/src/packet_decoder.rs

crates/telio-dns/src/packet_encoder.rs

tomaszklak · 2026-03-17T09:53:26Z

Please, remember to cleanup (squash?) commits.

tomaszklak · 2026-03-17T15:07:03Z

+1

Jauler · 2026-03-18T08:44:47Z

Next time: It would be really nice to include ticket number in the branch name 🙏 🙏 🙏

Jauler · 2026-03-18T08:51:15Z

crates/telio-dns/src/packet_decoder.rs

+
+/// Normalize the name, converting to lowercase and trimming trailing dot
+pub(crate) fn normalize_qname(name: &str) -> String {
+    name.trim().trim_end_matches('.').to_ascii_lowercase()


why the trailing dot trimming? 🤔 maybe it would be nice to operate with FQDNs?

So that we can operate on domains with trailing dot and or without eg :test.nord and test.nord.

We either need to trim the trailing dot, or append the trailing dot if it's not present.

Updated to operate on FQDNs with trailing dot

Jauler · 2026-03-18T08:53:13Z

crates/telio-dns/src/packet_encoder.rs

+/// Constant values for .nord SOA record
+const SOA_MNAME: &str = "mesh.nordsec.com";
+const SOA_RNAME: &str = "support.nordsec.com";
+const SOA_SERIAL: u32 = 2015082403;


while maybe it is not the most important part, but we probably should bump the serial number.

Jauler · 2026-03-18T08:54:30Z

crates/telio-dns/src/packet_encoder.rs

+///
+/// Trailing dot is optional, it is ignored
+fn encode_name(out: &mut Vec<u8>, name: &str) -> Result<(), DnsBuildError> {
+    let trimmed = name.trim_end_matches('.');


I would recommend to operate on FQDNs internally always, this would not require us to trim the trailing '.' and would reduce the amount of domain representations to support.

crates/telio-dns/src/packet_encoder.rs

Jauler · 2026-03-18T10:22:55Z

crates/telio-dns/src/packet_encoder.rs

+    truncated: &mut bool,
+    record_count: &mut u16,
+) -> Result<(), DnsBuildError> {
+    let rr_len = DNS_HEADER_OFFSET + data.len();


I believe this is incorrect constant being used. I mean, the value of it is correct, but it is coincidental, but my understanding was the this constnat is meant to represent for DNS packet header length, and here we are calculated fixed-data size for resource-record.

Hmm yeah semantically you're right, though are both the same size. I will introduce a separate constant.

Added a separate const

crates/telio-dns/src/packet_encoder.rs

crates/telio-dns/tests/nameserver.rs

Jauler

+1.0

mathiaspeters

+1

This module incorporates: - a lightweight decoder, that converts DNS request bytes into a `DnsPacket<'_>`, and exposes a helper functions like `parse_dns_query_packet()`, `find_nord_query()` and `normalize_qname()` to simplify with the correct request handling. - A packet builder specific for the local resolver use case, that converts a `ResponseKind` enum into appropriate DNS response bytes.

tomasz-grz self-assigned this Feb 20, 2026

tomasz-grz changed the title ~~DNS packet codec~~ LLT-7052: DNS packet codec Feb 20, 2026

tomasz-grz force-pushed the packet_codec branch from 8bc69ea to 50ec209 Compare February 23, 2026 12:03

tomasz-grz temporarily deployed to Internal February 23, 2026 12:04 — with GitHub Actions Inactive

tomasz-grz force-pushed the packet_codec branch from 50ec209 to b87a3d4 Compare February 23, 2026 12:26

tomasz-grz temporarily deployed to Internal February 23, 2026 12:26 — with GitHub Actions Inactive

tomasz-grz force-pushed the packet_codec branch from b87a3d4 to 9bbe892 Compare February 23, 2026 12:50

tomasz-grz temporarily deployed to Internal February 23, 2026 12:51 — with GitHub Actions Inactive

tomasz-grz commented Feb 24, 2026

View reviewed changes

crates/telio-dns/src/packet_encoder.rs Outdated Show resolved Hide resolved

tomasz-grz force-pushed the packet_codec branch from 9bbe892 to 87a56cb Compare February 24, 2026 12:01

tomasz-grz temporarily deployed to Internal February 24, 2026 12:01 — with GitHub Actions Inactive

tomasz-grz marked this pull request as ready for review February 24, 2026 12:01

tomasz-grz requested a review from a team as a code owner February 24, 2026 12:01

tomasz-grz force-pushed the packet_codec branch from 87a56cb to 1f03629 Compare February 24, 2026 13:42

tomasz-grz temporarily deployed to Internal February 24, 2026 13:42 — with GitHub Actions Inactive

stalowyjez reviewed Feb 26, 2026

View reviewed changes

tomasz-grz temporarily deployed to Internal February 27, 2026 12:48 — with GitHub Actions Inactive

stalowyjez reviewed Feb 27, 2026

View reviewed changes

crates/telio-dns/src/packet_decoder.rs Outdated Show resolved Hide resolved

crates/telio-dns/src/packet_encoder.rs Outdated Show resolved Hide resolved

crates/telio-dns/src/packet_encoder.rs Show resolved Hide resolved

tomasz-grz temporarily deployed to Internal March 2, 2026 11:44 — with GitHub Actions Inactive

tomasz-grz temporarily deployed to Internal March 2, 2026 11:57 — with GitHub Actions Inactive

tomasz-grz temporarily deployed to Internal March 2, 2026 12:23 — with GitHub Actions Inactive

tomasz-grz temporarily deployed to Internal March 2, 2026 14:50 — with GitHub Actions Inactive

stalowyjez reviewed Mar 3, 2026

View reviewed changes

tomasz-grz temporarily deployed to Internal March 3, 2026 15:57 — with GitHub Actions Inactive

tomasz-grz temporarily deployed to Internal March 4, 2026 13:24 — with GitHub Actions Inactive

tomasz-grz temporarily deployed to Internal March 4, 2026 13:44 — with GitHub Actions Inactive

tomasz-grz force-pushed the packet_codec branch from d457050 to d2f23c2 Compare March 6, 2026 11:24

tomasz-grz temporarily deployed to Internal March 6, 2026 11:25 — with GitHub Actions Inactive

tomasz-grz temporarily deployed to Internal March 16, 2026 13:50 — with GitHub Actions Inactive

tomasz-grz temporarily deployed to Internal March 16, 2026 13:54 — with GitHub Actions Inactive

tomasz-grz force-pushed the packet_codec branch from ca5d7ae to 408a415 Compare March 16, 2026 17:00

tomasz-grz temporarily deployed to Internal March 16, 2026 17:00 — with GitHub Actions Inactive

tomaszklak reviewed Mar 17, 2026

View reviewed changes

crates/telio-dns/src/packet_decoder.rs Outdated Show resolved Hide resolved

tomaszklak reviewed Mar 17, 2026

View reviewed changes

crates/telio-dns/src/packet_encoder.rs Outdated Show resolved Hide resolved

crates/telio-dns/src/packet_encoder.rs Outdated Show resolved Hide resolved

tomasz-grz force-pushed the packet_codec branch from 408a415 to 327fb7f Compare March 17, 2026 14:47

tomasz-grz temporarily deployed to Internal March 17, 2026 14:47 — with GitHub Actions Inactive

tomasz-grz force-pushed the packet_codec branch from 327fb7f to 8c89718 Compare March 17, 2026 15:09

tomasz-grz temporarily deployed to Internal March 17, 2026 15:09 — with GitHub Actions Inactive

Jauler reviewed Mar 18, 2026

View reviewed changes

crates/telio-dns/src/packet_encoder.rs Outdated Show resolved Hide resolved

Jauler reviewed Mar 18, 2026

View reviewed changes

crates/telio-dns/src/packet_encoder.rs Show resolved Hide resolved

Jauler reviewed Mar 18, 2026

View reviewed changes

crates/telio-dns/tests/nameserver.rs Show resolved Hide resolved

tomasz-grz temporarily deployed to Internal March 18, 2026 13:12 — with GitHub Actions Inactive

Jauler approved these changes Mar 23, 2026

View reviewed changes

mathiaspeters approved these changes Mar 23, 2026

View reviewed changes

tomasz-grz force-pushed the packet_codec branch from 20db861 to e68879a Compare March 23, 2026 09:15

tomasz-grz temporarily deployed to Internal March 23, 2026 09:16 — with GitHub Actions Inactive

mathiaspeters approved these changes Mar 23, 2026

View reviewed changes

tomasz-grz force-pushed the packet_codec branch from e68879a to b6c2f87 Compare March 23, 2026 13:00

tomasz-grz temporarily deployed to Internal March 23, 2026 13:01 — with GitHub Actions Inactive

Conversation

tomasz-grz commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

☑️ Definition of Done checklist

Uh oh!

Uh oh!

stalowyjez left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stalowyjez left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomasz-grz Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomaszklak commented Mar 16, 2026

Uh oh!

tomaszklak commented Mar 16, 2026

Uh oh!

tomaszklak commented Mar 16, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tomaszklak commented Mar 17, 2026

Uh oh!

tomaszklak commented Mar 17, 2026

Uh oh!

Jauler commented Mar 18, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Jauler Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

tomasz-grz commented Feb 20, 2026 •

edited

Loading

tomasz-grz Mar 3, 2026 •

edited

Loading

Jauler Mar 18, 2026 •

edited

Loading