Changeset 59203 in vbox

Timestamp:

Dec 21, 2015 5:21:56 PM (9 years ago)

Author:

vboxsync

Message:

NAT: Ignore/drop any authority or additional records in queries to the
host resolver, so that we can process queries with EDNS(0) RFC6891 OPT
RR in additional records section.

File:

• trunk/src/VBox/Devices/Network/slirp/hostres.c (modified) (3 diffs)

trunk/src/VBox/Devices/Network/slirp/hostres.c

@@ -240 +240 @@
     }
 
-    if (RT_UNLIKELY(pHdr->nscount != 0))
-    {
-        LogErr(("NAT: hostres: authority RRs in query\n"));
-        refuse(pData, m, RCode_NotImp);
-        return 1;
-    }
-
-    if (RT_UNLIKELY(pHdr->arcount != 0))
-    {
-        LogErr(("NAT: hostres: additional info RRs in query\n"));
-        refuse(pData, m, RCode_NotImp);
-        return 1;
-    }
-
     if (RT_UNLIKELY(mlen < sizeof(*pHdr)
                              + /* qname  */ 1
@@ -379 +365 @@
      * QTYPE and QCLASS
      */
-    if (RT_UNLIKELY(off + 4 != mlen))
-    {
-        LogErr(("NAT: hostres: question too short / too long\n"));
+    if (RT_UNLIKELY(off + 4 > mlen))
+    {
+        LogErr(("NAT: hostres: question too short\n"));
         return refuse(pData, m, RCode_FormErr);
     }
@@ -408 +394 @@
         return refuse(pData, m, RCode_NotImp);
     }
+
+
+    /**
+     * Check if there's anything after the question.  If query says it
+     * has authority or additional records, ignore and drop them
+     * without parsing.
+     *
+     * We have already rejected queries with answer(s) before.  We
+     * have ensured that qname in the question doesn't contain
+     * pointers, so truncating the buffer is safe.
+     */
+    if (off < mlen)
+    {
+        int trailer = mlen - off;
+
+        LogDbg(("NAT: hostres: question %zu < mlen %zu\n", off, mlen));
+
+        if (pHdr->nscount == 0 && pHdr->arcount == 0)
+        {
+            LogErr(("NAT: hostres: unexpected %d bytes after the question\n", trailer));
+            return refuse(pData, m, RCode_FormErr);
+        }
+
+        LogDbg(("NAT: hostres: ignoring %d bytes of %s%s%s records\n",
+                trailer,
+                pHdr->nscount != 0 ? "authority" : "",
+                pHdr->nscount != 0 && pHdr->arcount != 0 ? " and " : "",
+                pHdr->arcount != 0 ? "additional" : ""));
+
+        m_adj(m, -trailer);
+        mlen -= trailer;
+        res->end = res->qlen = mlen;
+
+        pHdr->nscount = 0;
+        pHdr->arcount = 0;
+    }
+
 
     /*