buglwIP - A Lightweight TCP/IP stack - Bugs: bug #45004, dns response without answer might...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #45004: dns response without answer might be discarded

Submitter:  Sandra <blindcarboncopy>
Submitted:  Sun 03 May 2015 05:37:33 PM UTC
   
 
Category:  DNS Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.4.1

Wed 19 Aug 2015 08:33:57 AM UTC, comment #2: 

Fixed, thanks for reporting.

Simon Goldschmidt <goldsimon>
Group administrator
Mon 04 May 2015 08:42:19 AM UTC, comment #1: 

From reading the code, this problem still exists in git master.

> I did the follwing change. Then it works with my DNS Server also:
> if (p->tot_len < (SIZEOF_DNS_HDR + SIZEOF_DNS_QUERY )) {


I'm not sure this is enough. There seem to be missing some further length checks, e.g. when copying the qurey to a local buffer...

Simon Goldschmidt <goldsimon>
Group administrator
Sun 03 May 2015 05:37:33 PM UTC, original submission:  

Hallo,

the following check is done:
  /* is the dns message big enough ? */
  if (p->tot_len < (SIZEOF_DNS_HDR + SIZEOF_DNS_QUERY + SIZEOF_DNS_ANSWER   )) {
    LWIP_DEBUGF(DNS_DEBUG, ("dns_recv: pbuf too small\n"));
    /* free pbuf and return */
    goto memerr;
  }

This works with the standard DNS Server set in dns_init.
But when I select my DNS server it doesn't work as soon as a domain name can not be resolved. This is because the selected  DNS-server does only send 24byte (tot_len) when there is no valid server found. In my opinion this is standard conform since ANCOUNT in the DNS message is 0.

Since the message is discarded without setting pEntry->state = DNS_STATE_UNUSED (memerr), all entries in dns_table are soon in DNS_STATE_ASKING. No more DNS queries are giong out.

Here's the response of the DNS-Server (it is the address of my Cisco router):
ID = 0x0001
FLAGS = 0x8183
QDCOUNT = 0x0001
ANCOUNT = 0x0000
..

I did the follwing change. Then it works with my DNS Server also:
  if (p->tot_len < (SIZEOF_DNS_HDR + SIZEOF_DNS_QUERY    )) {

Hope this makes sense.

Best regards,
Sandra

Sandra <blindcarboncopy>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by blindcarboncopy (Submitted the item)
  • -email is unavailable- added by blindcarboncopy
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-08-19 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
        Summaryvalid messages are handled as invalid in dns_recv dns response without answer might be discarded
    2015-05-03 blindcarboncopy Carbon-Copy- Added blindcarboncopy

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code