dns.c: fix input validation fix

[project/mdnsd.git] / dns.c

diff --git a/dns.c b/dns.c
index b19ad17719b7e542a29011e1c68017e2fb0bb146..1d3362f8b4953f86d079e8a61edc6390bbf6dda1 100644 (file)
--- a/dns.c
+++ b/dns.c
@@ -68,7 +68,8 @@ dns_type_string(uint16_t type)
 }
 
 void
-dns_send_question(struct interface *iface, const char *question, int type, int multicast)
+dns_send_question(struct interface *iface, struct sockaddr *to,
+                 const char *question, int type, int multicast)
 {
        static struct dns_header h;
        static struct dns_question q;
@@ -98,7 +99,7 @@ dns_send_question(struct interface *iface, const char *question, int type, int m
        iov[1].iov_len = len;
 
        DBG(1, "Q <- %s %s\n", dns_type_string(type), question);
-       if (interface_send_packet(iface, NULL, iov, ARRAY_SIZE(iov)) < 0)
+       if (interface_send_packet(iface, to, iov, ARRAY_SIZE(iov)) < 0)
                perror("failed to send question");
 }
 
@@ -221,6 +222,7 @@ scan_name(const uint8_t *buffer, int len)
                if (IS_COMPRESSED(l))
                        return offset + 2;
 
+               if (l + 1 > len) return -1;
                len -= l + 1;
                offset += l + 1;
                buffer += l + 1;
@@ -236,16 +238,16 @@ static struct dns_header*
 dns_consume_header(uint8_t **data, int *len)
 {
        struct dns_header *h = (struct dns_header *) *data;
-       uint16_t *swap = (uint16_t *) h;
-       int endianess = 6;
 
        if (*len < sizeof(struct dns_header))
                return NULL;
 
-       while (endianess--) {
-               *swap = be16_to_cpu(*swap);
-               swap++;
-       }
+       h->id = be16_to_cpu(h->id);
+       h->flags = be16_to_cpu(h->flags);
+       h->questions = be16_to_cpu(h->questions);
+       h->answers = be16_to_cpu(h->answers);
+       h->authority = be16_to_cpu(h->authority);
+       h->additional = be16_to_cpu(h->additional);
 
        *len -= sizeof(struct dns_header);
        *data += sizeof(struct dns_header);
@@ -257,16 +259,12 @@ static struct dns_question*
 dns_consume_question(uint8_t **data, int *len)
 {
        struct dns_question *q = (struct dns_question *) *data;
-       uint16_t *swap = (uint16_t *) q;
-       int endianess = 2;
 
        if (*len < sizeof(struct dns_question))
                return NULL;
 
-       while (endianess--) {
-               *swap = be16_to_cpu(*swap);
-               swap++;
-       }
+       q->type = be16_to_cpu(q->type);
+       q->class = be16_to_cpu(q->class);
 
        *len -= sizeof(struct dns_question);
        *data += sizeof(struct dns_question);
@@ -312,14 +310,15 @@ dns_consume_name(const uint8_t *base, int blen, uint8_t **data, int *len)
        return name_buffer;
 }
 
-static int
-parse_answer(struct interface *iface, uint8_t *buffer, int len, uint8_t **b, int *rlen, int cache)
+static int parse_answer(struct interface *iface, struct sockaddr *from,
+                       uint8_t *buffer, int len, uint8_t **b, int *rlen,
+                       int cache)
 {
        char *name = dns_consume_name(buffer, len, b, rlen);
        struct dns_answer *a;
        uint8_t *rdata;
 
-       if (!name) {
+       if (!name || *rlen < 0) {
                fprintf(stderr, "dropping: bad question\n");
                return -1;
        }
@@ -343,7 +342,7 @@ parse_answer(struct interface *iface, uint8_t *buffer, int len, uint8_t **b, int
        *b += a->rdlength;
 
        if (cache)
-               cache_answer(iface, buffer, len, name, a, rdata, a->class & CLASS_FLUSH);
+               cache_answer(iface, from, buffer, len, name, a, rdata, a->class & CLASS_FLUSH);
 
        return 0;
 }
@@ -351,15 +350,14 @@ parse_answer(struct interface *iface, uint8_t *buffer, int len, uint8_t **b, int
 static void
 parse_question(struct interface *iface, struct sockaddr *from, char *name, struct dns_question *q)
 {
-       struct sockaddr *to;
+       struct sockaddr *to = NULL;
        char *host;
 
        /* TODO: Multicast if more than one quarter of TTL has passed */
-       if ((q->class & CLASS_UNICAST) && iface->multicast) {
-               iface = iface->peer;
+       if (q->class & CLASS_UNICAST) {
                to = from;
-       } else {
-               to = NULL;
+               if (iface->multicast)
+                       iface = iface->peer;
        }
 
        DBG(1, "Q -> %s %s\n", dns_type_string(q->type), name);
@@ -368,7 +366,7 @@ parse_question(struct interface *iface, struct sockaddr *from, char *name, struc
        case TYPE_ANY:
                if (!strcmp(name, mdns_hostname_local)) {
                        dns_reply_a(iface, to, announce_ttl);
-                       service_reply(iface, to, NULL, announce_ttl);
+                       service_reply(iface, to, NULL, NULL, announce_ttl);
                }
                break;
 
@@ -377,15 +375,18 @@ parse_question(struct interface *iface, struct sockaddr *from, char *name, struc
                        dns_reply_a(iface, to, announce_ttl);
                        service_announce_services(iface, to, announce_ttl);
                } else {
-                       /* First dot separates instance name from the rest */
-                       char *dot = strchr(name, '.');
-                       /* Length of queried instance */
-                       size_t len = dot ? dot - name : 0;
-
-                       /* Make sure it's query for the instance name we use */
-                       if (len && len == strlen(mdns_hostname) &&
-                           !strncmp(name, mdns_hostname, len))
-                               service_reply(iface, to, dot + 1, announce_ttl);
+                       if (name[0] == '_') {
+                               service_reply(iface, to, NULL, name, announce_ttl);
+                       } else {
+                               /* First dot separates instance name from the rest */
+                               char *dot = strchr(name, '.');
+
+                               if (dot) {
+                                       *dot = '\0';
+                                       service_reply(iface, to, name, dot + 1, announce_ttl);
+                                       *dot = '.';
+                               }
+                       }
                }
                break;
 
@@ -394,14 +395,14 @@ parse_question(struct interface *iface, struct sockaddr *from, char *name, struc
                host = strstr(name, ".local");
                if (host)
                        *host = '\0';
-               if (!strcmp(mdns_hostname, name))
+               if (!strcmp(umdns_host_label, name))
                        dns_reply_a(iface, to, announce_ttl);
                break;
        };
 }
 
 void
-dns_handle_packet(struct interface *iface, struct sockaddr *s, uint16_t port, uint8_t *buffer, int len)
+dns_handle_packet(struct interface *iface, struct sockaddr *from, uint16_t port, uint8_t *buffer, int len)
 {
        struct dns_header *h;
        uint8_t *b = buffer;
@@ -421,7 +422,7 @@ dns_handle_packet(struct interface *iface, struct sockaddr *s, uint16_t port, ui
                char *name = dns_consume_name(buffer, len, &b, &rlen);
                struct dns_question *q;
 
-               if (!name) {
+               if (!name || rlen < 0) {
                        fprintf(stderr, "dropping: bad name\n");
                        return;
                }
@@ -433,22 +434,22 @@ dns_handle_packet(struct interface *iface, struct sockaddr *s, uint16_t port, ui
                }
 
                if (!(h->flags & FLAG_RESPONSE))
-                       parse_question(iface, s, name, q);
+                       parse_question(iface, from, name, q);
        }
 
        if (!(h->flags & FLAG_RESPONSE))
                return;
 
        while (h->answers-- > 0)
-               if (parse_answer(iface, buffer, len, &b, &rlen, 1))
+               if (parse_answer(iface, from, buffer, len, &b, &rlen, 1))
                        return;
 
        while (h->authority-- > 0)
-               if (parse_answer(iface, buffer, len, &b, &rlen, 1))
+               if (parse_answer(iface, from, buffer, len, &b, &rlen, 1))
                        return;
 
        while (h->additional-- > 0)
-               if (parse_answer(iface, buffer, len, &b, &rlen, 1))
+               if (parse_answer(iface, from, buffer, len, &b, &rlen, 1))
                        return;
 
 }