upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-13 01:30:00 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

4154. [bug] A OPT record should be included with the FORMERR

Browse source 
response when there is a malformed EDNS option.
                        [RT #39647]

4153.   [bug]           Check that non significant ECS bits are zero on
                        receipt. [RT #39647]
This commit is contained in:
Mark Andrews 2015-07-06 12:52:37 +10:00
parent 2043cb5835
commit f5386a21a8
8 changed files with 41 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
CHANGES
View file

@ -1,3 +1,10 @@
4154. [bug] A OPT record should be included with the FORMERR
response when there is a malformed EDNS option.
[RT #39647]
4153. [bug] Check that non significant ECS bits are zero on
receipt. [RT #39647]
4151. [bug] 'rndc flush' could cause a deadlock. [RT #39835]
4150. [bug] win32: listen-on-v6 { any; }; was not working. Apply

2
bin/named/client.c
View file

@ -1660,6 +1660,8 @@ client_request(isc_task_t *task, isc_event_t *event) {
* Parsing the request failed. Send a response
* (typically FORMERR or SERVFAIL).
*/
if (result == DNS_R_OPTERR)
(void)client_addopt(client);
ns_client_error(client, result);
goto cleanup;
}

3
bin/tests/system/formerr/badoptoption Normal file
View file

@ -0,0 +1,3 @@
00 00 00 00 00 01 00 00 00 00 00 01
00 00 01 00 02
00 00 29 10 00 00 00 00 00 00 04 00 08 00 00

3
bin/tests/system/formerr/clean.sh
View file

@ -12,6 +12,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
rm -f badoptoption.out
rm -f nametoolong.out
rm -f twoquestions.out
rm -f noquestions.out
rm -f twoquestions.out

8
bin/tests/system/formerr/tests.sh
View file

@ -44,6 +44,14 @@ then
echo "I:failed"; status=`expr $status + 1`;
fi
echo "I:bad OPT option"
$PERL formerr.pl -a 10.53.0.1 -p 5300 badoptoption > badoptoption.out
ans=`grep got: badoptoption.out`
if [ "${ans}" != "got: 00008001000100000000000100000100020000291000000000000000" ];
then
echo "I:failed"; status=`expr $status + 1`;
fi
echo "I:exit status: $status"
exit $status

3
lib/dns/include/dns/result.h
View file

@ -156,8 +156,9 @@
#define DNS_R_NTACOVERED (ISC_RESULTCLASS_DNS + 110)
#define DNS_R_BADCDS (ISC_RESULTCLASS_DNS + 111)
#define DNS_R_BADCDNSKEY (ISC_RESULTCLASS_DNS + 112)
#define DNS_R_OPTERR (ISC_RESULTCLASS_DNS + 113)
#define DNS_R_NRESULTS 113 /*%< Number of results */
#define DNS_R_NRESULTS 114 /*%< Number of results */
/*
* DNS wire format rcodes.

17
lib/dns/rdata/generic/opt_41.c
View file

@ -128,7 +128,7 @@ fromwire_opt(ARGS_FROMWIRE) {
isc_uint8_t addrbytes;
if (length < 4)
return (DNS_R_FORMERR);
return (DNS_R_OPTERR);
family = uint16_fromregion(&sregion);
isc_region_consume(&sregion, 2);
addrlen = uint8_fromregion(&sregion);
@ -138,16 +138,23 @@ fromwire_opt(ARGS_FROMWIRE) {
switch (family) {
case 1:
if (addrlen > 32U || scope > 32U)
return (DNS_R_FORMERR);
return (DNS_R_OPTERR);
break;
case 2:
if (addrlen > 128U || scope > 128U)
return (DNS_R_FORMERR);
return (DNS_R_OPTERR);
break;
}
addrbytes = (addrlen + 7) / 8;
if (addrbytes + 4 != length)
return (DNS_R_FORMERR);
return (DNS_R_OPTERR);
if (addrbytes != 0U && (addrlen % 8) != 0) {
isc_uint8_t bits = ~0 << (8 - (addrlen % 8));
bits &= sregion.base[addrbytes - 1];
if (bits != sregion.base[addrbytes - 1])
return (DNS_R_OPTERR);
}
isc_region_consume(&sregion, addrbytes);
break;
}
@ -156,7 +163,7 @@ fromwire_opt(ARGS_FROMWIRE) {
* Request has zero length. Response is 32 bits.
*/
if (length != 0 && length != 4)
return (DNS_R_FORMERR);
return (DNS_R_OPTERR);
isc_region_consume(&sregion, length);
break;
default:

7
lib/dns/result.c
View file

@ -164,9 +164,10 @@ static const char *text[DNS_R_NRESULTS] = {
"not dynamic", /*%< 108 DNS_R_NOTDYNAMIC */
"bad EUI", /*%< 109 DNS_R_BADEUI */
"covered by negative trust anchor", /*%< 110 DNS_R_NTACOVERED */
"covered by negative trust anchor", /*%< 110 DNS_R_NTACOVERED */
"bad CDS", /*%< 111 DNS_R_BADCSD */
"bad CDNSKEY" /*%< 112 DNS_R_BADCDNSKEY */
"bad CDNSKEY", /*%< 112 DNS_R_BADCDNSKEY */
"malformed OPT option" /*%< 113 DNS_R_OPTERR */
};
static const char *rcode_text[DNS_R_NRCODERESULTS] = {
@ -242,6 +243,7 @@ dns_result_torcode(isc_result_t result) {
*/
return ((dns_rcode_t)((result) & 0xFFF));
}
/*
* Try to supply an appropriate rcode.
*/
@ -271,6 +273,7 @@ dns_result_torcode(isc_result_t result) {
case DNS_R_TSIGERRORSET:
case DNS_R_UNKNOWN:
case DNS_R_NAMETOOLONG:
case DNS_R_OPTERR:
rcode = dns_rcode_formerr;
break;
case DNS_R_DISALLOWED: