X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fdns.cpp;h=63bde0eccb46e5819b213d33f71df21f8d4cf32a;hb=153bd37b598373f4f52024747ee3bc2cbb76f629;hp=abdd0a54cff586f20f81cf5acbc20af30019b48f;hpb=a6a07de0daa353bcd29056a4535a9c4784c113c8;p=user%2Fhenk%2Fcode%2Finspircd.git diff --git a/src/dns.cpp b/src/dns.cpp index abdd0a54c..63bde0ecc 100644 --- a/src/dns.cpp +++ b/src/dns.cpp @@ -1,16 +1,27 @@ -/* +------------------------------------+ - * | Inspire Internet Relay Chat Daemon | - * +------------------------------------+ +/* + * InspIRCd -- Internet Relay Chat Daemon + * + * Copyright (C) 2012 William Pitcock + * Copyright (C) 2009-2010 Daniel De Graaf + * Copyright (C) 2006, 2009 Robin Burchell + * Copyright (C) 2007, 2009 Dennis Friis + * Copyright (C) 2008 Thomas Stagner + * Copyright (C) 2005-2007 Craig Edwards * - * InspIRCd: (C) 2002-2010 InspIRCd Development Team - * See: http://wiki.inspircd.org/Credits + * This file is part of InspIRCd. InspIRCd is free software: you can + * redistribute it and/or modify it under the terms of the GNU General Public + * License as published by the Free Software Foundation, version 2. * - * This program is free but copyrighted software; see - * the file COPYING for details. + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more + * details. * - * --------------------------------------------------- + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . */ + /* $Core */ /* @@ -23,7 +34,7 @@ Please do not assume that firedns works like this, looks like this, walks like this or tastes like this. */ -#ifndef WIN32 +#ifndef _WIN32 #include #include #include @@ -38,6 +49,8 @@ looks like this, walks like this or tastes like this. #include "configreader.h" #include "socket.h" +#define DN_COMP_BITMASK 0xC000 /* highest 6 bits in a DN label header */ + /** Masks to mask off the responses we get from the DNSRequest methods */ enum QueryInfo @@ -98,7 +111,7 @@ class DNSRequest DNSRequest(DNS* dns, int id, const std::string &original); ~DNSRequest(); - DNSInfo ResultIsReady(DNSHeader &h, int length); + DNSInfo ResultIsReady(DNSHeader &h, unsigned length); int SendRequests(const DNSHeader *header, const int length, QueryType qt); }; @@ -161,7 +174,10 @@ int CachedQuery::CalcTTLRemaining() /* Allocate the processing buffer */ DNSRequest::DNSRequest(DNS* dns, int rid, const std::string &original) : dnsobj(dns) { - res = new unsigned char[512]; + /* hardening against overflow here: make our work buffer twice the theoretical + * maximum size so that hostile input doesn't screw us over. + */ + res = new unsigned char[sizeof(DNSHeader) * 2]; *res = 0; orig = original; RequestTimeout* RT = new RequestTimeout(ServerInstance->Config->dns_timeout ? ServerInstance->Config->dns_timeout : 5, this, rid); @@ -242,8 +258,28 @@ DNSRequest* DNS::AddQuery(DNSHeader *header, int &id, const char* original) return NULL; /* Create an id */ + unsigned int tries = 0; do { id = ServerInstance->GenRandomInt(DNS::MAX_REQUEST_ID); + if (++tries == DNS::MAX_REQUEST_ID*5) + { + // If we couldn't find an empty slot this many times, do a sequential scan as a last + // resort. If an empty slot is found that way, go on, otherwise throw an exception + id = -1; + for (int i = 0; i < DNS::MAX_REQUEST_ID; i++) + { + if (!requests[i]) + { + id = i; + break; + } + } + + if (id == -1) + throw ModuleException("DNS: All ids are in use"); + + break; + } } while (requests[id]); DNSRequest* req = new DNSRequest(this, id, original); @@ -355,10 +391,6 @@ DNS::DNS() /* Clear the requests class table */ memset(requests,0,sizeof(requests)); - /* Set the id of the next request to 0 - */ - currid = 0; - /* DNS::Rehash() sets this to a valid ptr */ this->cache = NULL; @@ -580,8 +612,10 @@ DNSResult DNS::GetResult() */ if (from != myserver) { + std::string server1 = from.str(); + std::string server2 = myserver.str(); ServerInstance->Logs->Log("RESOLVER",DEBUG,"Got a result from the wrong server! Bad NAT or DNS forging attempt? '%s' != '%s'", - from.str().c_str(), myserver.str().c_str()); + server1.c_str(), server2.c_str()); return DNSResult(-1,"",0,""); } @@ -688,11 +722,11 @@ DNSResult DNS::GetResult() } /** A result is ready, process it */ -DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, int length) +DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, unsigned length) { - unsigned i = 0; + unsigned i = 0, o; int q = 0; - int curanswer, o; + int curanswer; ResourceRecord rr; unsigned short ptr; @@ -755,7 +789,7 @@ DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, int length) else i += header.payload[i] + 1; /* skip length and label */ } } - if (length - i < 10) + if (static_cast(length - i) < 10) return std::make_pair((unsigned char*)NULL,"Incorrectly sized DNS reply"); /* XXX: We actually initialise 'rr' here including its ttl field */ @@ -790,17 +824,37 @@ DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, int length) switch (rr.type) { + /* + * CNAME and PTR are compressed. We need to decompress them. + */ case DNS_QUERY_CNAME: - /* CNAME and PTR have the same processing code */ case DNS_QUERY_PTR: + { + unsigned short lowest_pos = length; o = 0; q = 0; while (q == 0 && i < length && o + 256 < 1023) { + /* DN label found (byte over 63) */ if (header.payload[i] > 63) { memcpy(&ptr,&header.payload[i],2); - i = ntohs(ptr) - 0xC000 - 12; + + i = ntohs(ptr); + + /* check that highest two bits are set. if not, we've been had */ + if ((i & DN_COMP_BITMASK) != DN_COMP_BITMASK) + return std::make_pair((unsigned char *) NULL, "DN label decompression header is bogus"); + + /* mask away the two highest bits. */ + i &= ~DN_COMP_BITMASK; + + /* and decrease length by 12 bytes. */ + i -= 12; + + if (i >= lowest_pos) + return std::make_pair((unsigned char *) NULL, "Invalid decompression pointer"); + lowest_pos = i; } else { @@ -813,25 +867,35 @@ DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, int length) res[o] = 0; if (o != 0) res[o++] = '.'; - memcpy(&res[o],&header.payload[i + 1],header.payload[i]); + + if (o + header.payload[i] > sizeof(DNSHeader)) + return std::make_pair((unsigned char *) NULL, "DN label decompression is impossible -- malformed/hostile packet?"); + + memcpy(&res[o], &header.payload[i + 1], header.payload[i]); o += header.payload[i]; i += header.payload[i] + 1; } } } res[o] = 0; + } break; case DNS_QUERY_AAAA: + if (rr.rdlength != sizeof(struct in6_addr)) + return std::make_pair((unsigned char *) NULL, "rr.rdlength is larger than 16 bytes for an ipv6 entry -- malformed/hostile packet?"); + memcpy(res,&header.payload[i],rr.rdlength); res[rr.rdlength] = 0; break; case DNS_QUERY_A: + if (rr.rdlength != sizeof(struct in_addr)) + return std::make_pair((unsigned char *) NULL, "rr.rdlength is larger than 4 bytes for an ipv4 entry -- malformed/hostile packet?"); + memcpy(res,&header.payload[i],rr.rdlength); res[rr.rdlength] = 0; break; default: - memcpy(res,&header.payload[i],rr.rdlength); - res[rr.rdlength] = 0; + return std::make_pair((unsigned char *) NULL, "don't know how to handle undefined type (" + ConvToStr(rr.type) + ") -- rejecting"); break; } return std::make_pair(res,"No error"); @@ -1020,20 +1084,13 @@ bool DNS::AddResolverClass(Resolver* r) Classes[r->GetId()] = r; return true; } - else - /* Duplicate id */ - return false; } - else - { - /* Pointer or id not valid. - * Free the item and return - */ - if (r) - delete r; - return false; - } + /* Pointer or id not valid, or duplicate id. + * Free the item and return + */ + delete r; + return false; } void DNS::CleanResolvers(Module* module)