Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Backport v2.7-branch] DNS parsing issues #82392

Open
wants to merge 5 commits into
base: v2.7-branch
Choose a base branch
from
+57 −5
Open

[Backport v2.7-branch] DNS parsing issues #82392

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ac87033
net: dns: Check parsing error properly for response
jukkar Nov 26, 2024
b799bdc
tests: net: dns: Add checking of malformed packet
jukkar Nov 26, 2024
eedd1bf
net: dns: Validate source buffer length properly
jukkar Nov 26, 2024
f39e902
net: dns: Check DNS answer properly
jukkar Nov 26, 2024
84936ba
tests: net: dns: Add test for invalid DNS answer parsing
jukkar Nov 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions subsys/net/lib/dns/dns_pack.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,7 +134,7 @@ int dns_unpack_answer(struct dns_msg_t *dns_msg, int dname_ptr, uint32_t *ttl,
*
* See RFC-1035 4.1.3. Resource record format
*/
rem_size = dns_msg->msg_size - dname_len;
rem_size = dns_msg->msg_size - dns_msg->answer_offset - dname_len;
if (rem_size < 2 + 2 + 4 + 2) {
return -EINVAL;
}
Expand Down Expand Up @@ -394,7 +394,7 @@ int dns_copy_qname(uint8_t *buf, uint16_t *len, uint16_t size,
/* validate that the label (i.e. size + elements),
* fits the current msg buffer
*/
if (DNS_LABEL_LEN_SIZE + lb_size > size - *len) {
if (DNS_LABEL_LEN_SIZE + lb_size > MIN(size - *len, msg_size - pos)) {
rc = -ENOMEM;
break;
}
Expand Down
5 changes: 5 additions & 0 deletions subsys/net/lib/dns/resolve.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -525,6 +525,11 @@ int dns_validate_msg(struct dns_resolve_context *ctx,

ret = dns_unpack_response_query(dns_msg);
if (ret < 0) {
if (ret == -ENOMEM) {
ret = DNS_EAI_FAIL;
goto quit;
}

/* Check mDNS like above */
if (*dns_id > 0) {
ret = DNS_EAI_FAIL;
Expand Down
53 changes: 50 additions & 3 deletions tests/net/lib/dns_packet/src/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,13 @@ static uint8_t query_mdns[] = {

static uint16_t tid1 = 0xda0f;

static uint8_t invalid_answer_resp_ipv4[18] = {
/* DNS msg header (12 bytes) */
0x01, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x01, 0x00, 0x01,
};


static int eval_query(const char *dname, uint16_t tid, enum dns_rr_type type,
uint8_t *expected, uint16_t expected_len)
{
Expand Down Expand Up @@ -709,6 +716,24 @@ static uint8_t resp_truncated_response_ipv4_5[] = {
0x00, 0x04,
};

static uint8_t resp_truncated_response_ipv4_6[] = {
/* DNS msg header (12 bytes) */
/* Id (0) */
0x00, 0x00,
/* Flags (response, rcode = 1) */
0x80, 0x01,
/* Number of questions */
0x00, 0x01,
/* Number of answers */
0x00, 0x00,
/* Number of authority RRs */
0x00, 0x00,
/* Number of additional RRs */
0x00, 0x00,

/* Rest of the data is missing */
};

static uint8_t resp_valid_response_ipv4_6[] = {
/* DNS msg header (12 bytes) */
0xb0, 0x41, 0x81, 0x80, 0x00, 0x01, 0x00, 0x01,
Expand Down Expand Up @@ -1093,8 +1118,13 @@ static void run_dns_malformed_response(const char *test_case,

dns_id = dns_unpack_header_id(dns_msg.msg);

setup_dns_context(&dns_ctx, 0, dns_id, query, sizeof(query),
DNS_QUERY_TYPE_A);
/* If the message is longer than 12 bytes, it could be a valid DNS message
* in which case setup the context for the reply.
*/
if (len > 12) {
setup_dns_context(&dns_ctx, 0, dns_id, query, sizeof(query),
DNS_QUERY_TYPE_A);
}

ret = dns_validate_msg(&dns_ctx, &dns_msg, &dns_id, &query_idx,
NULL, &query_hash);
Expand Down Expand Up @@ -1198,6 +1228,7 @@ static void test_dns_malformed_responses(void)
RUN_MALFORMED_TEST(resp_truncated_response_ipv4_3);
RUN_MALFORMED_TEST(resp_truncated_response_ipv4_4);
RUN_MALFORMED_TEST(resp_truncated_response_ipv4_5);
RUN_MALFORMED_TEST(resp_truncated_response_ipv4_6);
}

static void test_dns_id_len(void)
Expand Down Expand Up @@ -1236,6 +1267,21 @@ static void test_dns_flags_len(void)
"DNS message length check failed (%d)", ret);
}

static void test_dns_invalid_answer(void)
{
struct dns_msg_t dns_msg = { 0 };
enum dns_rr_type type;
uint32_t ttl;
int ret;

dns_msg.msg = invalid_answer_resp_ipv4;
dns_msg.msg_size = sizeof(invalid_answer_resp_ipv4);
dns_msg.answer_offset = 12;

ret = dns_unpack_answer(&dns_msg, 0, &ttl, &type);
zassert_equal(ret, -EINVAL, "DNS message answer check succeed (%d)", ret);
}

void test_main(void)
{
ztest_test_suite(dns_tests,
Expand All @@ -1247,7 +1293,8 @@ void test_main(void)
ztest_unit_test(test_dns_id_len),
ztest_unit_test(test_dns_flags_len),
ztest_unit_test(test_dns_malformed_responses),
ztest_unit_test(test_dns_valid_responses)
ztest_unit_test(test_dns_valid_responses),
ztest_unit_test(test_dns_invalid_answer)
);

ztest_run_test_suite(dns_tests);
Expand Down
Loading