buglwIP - A Lightweight TCP/IP stack - Bugs: bug #47459, Unexpected DNS responses make the...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #47459: Unexpected DNS responses make the resolution fail

Submitted by:  Florent Matignon <fmatignon>
Submitted on:  Fri 18 Mar 2016 07:45:53 PM UTC  
 
Category: DNSSeverity: 3 - Normal
Item Group: Faulty BehaviourStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: git head

Tue 22 Mar 2016 06:22:55 AM UTC, comment #1:

Fixed, thanks for reporting.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Fri 18 Mar 2016 07:45:53 PM UTC, original submission:

dns_recv() is not resilient to unexpected, malformed or forged DNS responses.

While parsing the response, the function ends with a 'goto responseerr' when an inconsistency is detected and finally calls dns_call_found() with NULL, hence notifies the caller of a resolution error.

For example, when a DNS response coming from an unexpected IP address is received, the following check will fail:
/* Check whether response comes from the same network address to which the
question was sent. (RFC 5452) */
if (!ip_addr_cmp(addr, &dns_servers[entry->server_idx])) {
/* call callback to indicate error, clean up memory and return */
goto responseerr;
}
and the user will be notified of a DNS resolution error.
This probably applies to the other checks performed in dns_recv().

When an inconsistency is detected, the packet should be ignored, but it should not trigger a resolution error: I think a 'goto memerr' is more appropriate.

A possible approach to solve this would be:
- first, ensure the packets is coming from a 'good looking' DNS server (as explained in RFC 5452) ; silently drop erroneous packets ('goto memerr')
- then, check the answer content to determine the resolution status and notify the user of success or failure

I'm not a DNS expert, so I'm not sure which check should trigger a packet drop or a resolution error.

For the record, I spotted this when two DNS servers are configured and DNS_MAX_RETRIES = 1 :
- the query is sent to the 1st server
- timeout occurs while no answer has been received; the query is sent to the 2nd server
- the answer from the 1st server is finally received and triggers the error described above

I attach the patch related to this specific issue, but I think it could be generalized.

Florent Matignon <fmatignon>

 

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by fmatignon (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 22 Mar 2016 06:22:55 AM UTCgoldsimonStatusNone=>Fixed
      Assigned toNone=>goldsimon
      Open/ClosedOpen=>Closed
    Fri 18 Mar 2016 07:45:53 PM UTCfmatignonAttached File-=>Added unexpected-dns-responses-make-the-resolution-fail.patch, #36690

    Back to the top


    Powered by Savane 3.1-cleanup1