package/network/services/dnsmasq/patches/030-fix-arcount-edns0-behaviour.patch

   1 From a3303e196e5d304ec955c4d63afb923ade66c6e8 Mon Sep 17 00:00:00 2001
   2 From: Simon Kelley <simon@thekelleys.org.uk>
   3 Date: Thu, 7 Sep 2017 20:45:00 +0100
   4 Subject: [PATCH] Don't return arcount=1 if EDNS0 RR won't fit in the packet.
   5
   6 Omitting the EDNS0 RR but setting arcount gives a malformed packet.
   7 Also, don't accept UDP packet size less than 512 in recieved EDNS0.
   8 ---
   9  src/edns0.c   |    5 ++++-
  10  src/forward.c |    2 ++
  11  2 files changed, 6 insertions(+), 1 deletion(-)
  12
  13 diff --git a/src/edns0.c b/src/edns0.c
  14 index 3fde17f..f5b798c 100644
  15 --- a/src/edns0.c
  16 +++ b/src/edns0.c
  17 @@ -208,7 +208,10 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
  18           free(buff);
  19           p += rdlen;
  20         }
  21 -      header->arcount = htons(ntohs(header->arcount) + 1);
  22 +
  23 +      /* Only bump arcount if RR is going to fit */
  24 +      if (((ssize_t)optlen) <= (limit - (p + 4)))
  25 +       header->arcount = htons(ntohs(header->arcount) + 1);
  26      }
  27
  28    if (((ssize_t)optlen) > (limit - (p + 4)))
  29 diff --git a/src/forward.c b/src/forward.c
  30 index e3fa94b..942b02d 100644
  31 --- a/src/forward.c
  32 +++ b/src/forward.c
  33 @@ -1412,6 +1412,8 @@ void receive_query(struct listener *listen, time_t now)
  34          defaults to 512 */
  35        if (udp_size > daemon->edns_pktsz)
  36         udp_size = daemon->edns_pktsz;
  37 +      else if (udp_size < PACKETSZ)
  38 +       udp_size = PACKETSZ; /* Sanity check - can't reduce below default. RFC 6891 6.2.3 */
  39      }
  40
  41  #ifdef HAVE_AUTH
  42 --
  43 1.7.10.4
  44