Details
=======

*Test Name*: DNS Consistency (Ex DNS Tamper)

*Current version*: 0.4

*NetTest*: DNS Consistency Test (https://gitweb.torproject.org/ooni-probe.git/blob/HEAD:/nettests/blocking/dns_consistency.py)

*Test Helper*: DNS Test Helper (https://gitweb.torproject.org/oonib.git/blob/HEAD:/oonib/testhelpers/dns_helpers.py)

*Test Type*: Content Blocking

*Requires Root*: No

Description
===========

This test performs A queries to a set of test resolvers and a known good
control resolver. If the two results do not match it will perform a reverse DNS
lookup on the first A record address of both sets and check if they both
resolve to the same name.

NOTE: This test frequently results in false positives due to GeoIP-based
load balancing on major global sites such as Google, Facebook, and
Youtube, etc.

How to run the test
===================

`ooniprobe blocking/dns_consistency [-t <test resolvers>|-T <test resolver file>-f <input file> -b IP:PORT`

*test resolvers* is a single test resolver (IP address)

*test resolvers file* is a file containing the IP addresses of the resolvers to test for censorship, one per line.

*input file* is a file containing hostnames or urls to check for tampering.

*IP:PORT* is the address of the known good "control" resolver.

Sample report
=============

From running:
`ooniprobe blocking/dns_consistency -T test_inputs/dns_tamper_test_resolvers.txt -f test_inputs/http_host_file.txt`

::

    ###########################################
    # OONI Probe Report for DNS tamper test
    # Thu Nov 29 12:17:19 2012
    ###########################################
    ---
    options:
      collector: null
      help: 0
      logfile: null
      pcapfile: null
      reportfile: null
      resume: 0
      subargs: [-t, 8.8.8.8, -f, test_inputs/dns_tamper_file.txt]
      test: nettests/blocking/dns_consistency.py
    probe_asn: null
    probe_cc: null
    probe_ip: 127.0.0.1
    software_name: ooniprobe
    software_version: 0.0.7.1-alpha
    start_time: 1354184239.0
    test_name: DNS tamper
    test_version: '0.4'
    ...
    ---
    input: torproject.org
    report:
      control_resolver: &id001 [8.8.8.8, 53]
      queries:
      - addrs: [86.59.30.40, 38.229.72.14, 38.229.72.16, 82.195.75.101]
        answers:
        - [<RR name=torproject.org type=A class=IN ttl=91s auth=False>, <A address=86.59.30.40
            ttl=91>]
        - [<RR name=torproject.org type=A class=IN ttl=91s auth=False>, <A address=38.229.72.14
            ttl=91>]
        - [<RR name=torproject.org type=A class=IN ttl=91s auth=False>, <A address=38.229.72.16
            ttl=91>]
        - [<RR name=torproject.org type=A class=IN ttl=91s auth=False>, <A address=82.195.75.101
            ttl=91>]
        query: '[Query(''torproject.org'', 1, 1)]'
        query_type: A
        resolver: *id001
      - addrs: [86.59.30.40, 38.229.72.14, 38.229.72.16, 82.195.75.101]
        answers:
        - [<RR name=torproject.org type=A class=IN ttl=91s auth=False>, <A address=86.59.30.40
            ttl=91>]
        - [<RR name=torproject.org type=A class=IN ttl=91s auth=False>, <A address=38.229.72.14
            ttl=91>]
        - [<RR name=torproject.org type=A class=IN ttl=91s auth=False>, <A address=38.229.72.16
            ttl=91>]
        - [<RR name=torproject.org type=A class=IN ttl=91s auth=False>, <A address=82.195.75.101
            ttl=91>]
        query: '[Query(''torproject.org'', 1, 1)]'
        query_type: A
        resolver: [8.8.8.8, 53]
      tampering: {8.8.8.8: false}
    test_name: test_a_lookup
    test_runtime: 0.0733950138092041
    test_started: 1354187839.508863
    ...
    ---
    input: google.com
    report:
      control_resolver: &id001 [8.8.8.8, 53]
      queries:
      - addrs: [173.194.69.100, 173.194.69.139, 173.194.69.113, 173.194.69.101, 173.194.69.138,
          173.194.69.102]
        answers:
        - [<RR name=google.com type=A class=IN ttl=54s auth=False>, <A address=173.194.69.100
            ttl=54>]
        - [<RR name=google.com type=A class=IN ttl=54s auth=False>, <A address=173.194.69.139
            ttl=54>]
        - [<RR name=google.com type=A class=IN ttl=54s auth=False>, <A address=173.194.69.113
            ttl=54>]
        - [<RR name=google.com type=A class=IN ttl=54s auth=False>, <A address=173.194.69.101
            ttl=54>]
        - [<RR name=google.com type=A class=IN ttl=54s auth=False>, <A address=173.194.69.138
            ttl=54>]
        - [<RR name=google.com type=A class=IN ttl=54s auth=False>, <A address=173.194.69.102
            ttl=54>]
        query: '[Query(''google.com'', 1, 1)]'
        query_type: A
        resolver: *id001
      - addrs: [173.194.69.100, 173.194.69.139, 173.194.69.113, 173.194.69.101, 173.194.69.138,
          173.194.69.102]
        answers:
        - [<RR name=google.com type=A class=IN ttl=54s auth=False>, <A address=173.194.69.100
            ttl=54>]
        - [<RR name=google.com type=A class=IN ttl=54s auth=False>, <A address=173.194.69.139
            ttl=54>]
        - [<RR name=google.com type=A class=IN ttl=54s auth=False>, <A address=173.194.69.113
            ttl=54>]
        - [<RR name=google.com type=A class=IN ttl=54s auth=False>, <A address=173.194.69.101
            ttl=54>]
        - [<RR name=google.com type=A class=IN ttl=54s auth=False>, <A address=173.194.69.138
            ttl=54>]
        - [<RR name=google.com type=A class=IN ttl=54s auth=False>, <A address=173.194.69.102
            ttl=54>]
        query: '[Query(''google.com'', 1, 1)]'
        query_type: A
        resolver: [8.8.8.8, 53]
      tampering: {8.8.8.8: false}
    test_name: test_a_lookup
    test_runtime: 0.08325004577636719
    test_started: 1354187839.51091
    ...
    ---
    input: measurementlab.net
    report:
      control_resolver: &id001 [8.8.8.8, 53]
      queries:
      - addrs: [72.249.86.184]
        answers:
        - [<RR name=measurementlab.net type=A class=IN ttl=600s auth=False>, <A address=72.249.86.184
            ttl=600>]
        query: '[Query(''measurementlab.net'', 1, 1)]'
        query_type: A
        resolver: *id001
      - addrs: [72.249.86.184]
        answers:
        - [<RR name=measurementlab.net type=A class=IN ttl=600s auth=False>, <A address=72.249.86.184
            ttl=600>]
        query: '[Query(''measurementlab.net'', 1, 1)]'
        query_type: A
        resolver: [8.8.8.8, 53]
      tampering: {8.8.8.8: false}
    test_name: test_a_lookup
    test_runtime: 0.2565779685974121
    test_started: 1354187839.512434
    ...

Notes: Query is the string representation of :class:twisted.names.dns.Query