Self-DoS/forwarding loop

[da2x]

Output of the following commands:

Version 2.1.1

How do we replicate the issue?

1. echo "localhost 127.0.0.1" >> /etc/dnscrypt-proxy/forwarding.conf
2. echo "nameserver 127.0.0.1" > /etc/resolv.conf
3. Restart dnscrypt-proxy
4. dig localhost @127.0.0.1

Actual behavior (i.e. the problem)

A single DNS request is enough to put dnscrypt-proxy in an infinite forwarding loop to the point where it disrupt services and it can’t answer other queries.

Expected behavior (i.e. solution)

Detect the resolution loop and return a SERVFAIL response.

Other Comments

Since this is a forwarding gone wrong, it’s easier to detect than a normal loop. When n identical queries from the same source match a forwarding rule in a short time interval , send a TXT request to _someuniqueid.forwarding-host to that forwarding server. If that same request is received by the server, then stop all lookups via the affected forwarding chain (or maybe just requests matching the request that triggered the _someuniqueid) for a second or two to break the loop.