Improve support for DNS-SD and fall back to cached data for non-ICANN queries

network/netutils/dns.go

@@ -4,21 +4,38 @@ import (
 	"fmt"
 	"net"
 	"regexp"
+	"strings"
 
 	"github.com/miekg/dns"
 )
 
-var cleanDomainRegex = regexp.MustCompile(
-	`^` + // match beginning
-		`(` + // start subdomain group
-		`(xn--)?` + // idn prefix
-		`[a-z0-9_-]{1,63}` + // main chunk
-		`\.` + // ending with a dot
-		`)*` + // end subdomain group, allow any number of subdomains
-		`(xn--)?` + // TLD idn prefix
-		`[a-z0-9_-]{2,63}` + // TLD main chunk with at least two characters
-		`\.` + // ending with a dot
-		`$`, // match end
+var (
+	cleanDomainRegex = regexp.MustCompile(
+		`^` + // match beginning
+			`(` + // start subdomain group
+			`(xn--)?` + // idn prefix
+			`[a-z0-9_-]{1,63}` + // main chunk
+			`\.` + // ending with a dot
+			`)*` + // end subdomain group, allow any number of subdomains
+			`(xn--)?` + // TLD idn prefix
+			`[a-z0-9_-]{2,63}` + // TLD main chunk with at least two characters
+			`\.` + // ending with a dot
+			`$`, // match end
+	)
+
+	// dnsSDDomainRegex is a lot more lax to better suit the allowed characters in DNS-SD.
+	// Not all characters have been allowed - some special characters were
+	// removed to reduce the general attack surface.
+	dnsSDDomainRegex = regexp.MustCompile(
+		// Start of charset selection.
+		`^[` +
+			// Printable ASCII (character code 32-127), excluding some special characters.
+			` !#$%&()*+,\-\./0-9:;=?@A-Z[\\\]^_\a-z{|}~` +
+			// Only latin characters from extended ASCII (character code 128-255).
+			`ŠŒŽšœžŸ¡¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõöøùúûüýþÿ` +
+			// End of charset selection.
+			`]*$`,
+	)
 )
 
 // IsValidFqdn returns whether the given string is a valid fqdn.
@@ -33,15 +50,18 @@ func IsValidFqdn(fqdn string) bool {
 		return false
 	}
 
-	// check with regex
-	if !cleanDomainRegex.MatchString(fqdn) {
+	// IsFqdn checks if a domain name is fully qualified.
+	if !dns.IsFqdn(fqdn) {
 		return false
 	}
 
-	// check with miegk/dns
+	// Use special check for .local domains to support DNS-SD.
+	if strings.HasSuffix(fqdn, ".local.") {
+		return dnsSDDomainRegex.MatchString(fqdn)
+	}
 
-	// IsFqdn checks if a domain name is fully qualified.
-	if !dns.IsFqdn(fqdn) {
+	// check with regex
+	if !cleanDomainRegex.MatchString(fqdn) {
 		return false
 	}