[regression] CNAME with _ is parsed as invalid response

[AdamMajer]

With a CNAME setup test -> _test, ares_parse_a_reply is rejecting the response as invalid. The problem seems to be with PR: #406 where the assumption is made that hostname restrictions apply to domain names. With domain names like

_ldap._tcp.<server>

this assumption seems to be invalid.

This is already reported in Node
nodejs/node#39780

[AdamMajer]

https://datatracker.ietf.org/doc/html/rfc2181#section-11

[bradh352]

rfc2181 section 11 says not to do any validation, but that applies to servers not clients according to the spec.

We had a security report that PR #406 addressed, so we must balance full compliance with security, and in today's world, security MUST win.

I will agree however, that this needs to be loosened to include _ since SRV records explicitly use this an CNAMEs could reference them. The security researcher that originally reported the issue has said that _ should be acceptable as it doesn't have any malicious use-case.

[AdamMajer]

Thank you for the quick fix and clarification. This poorly defined area of what constitutes a valid or invalid entry in a DNS record is like a minefield.