dns.c: fix input validation fix
[project/mdnsd.git] / dns.c
diff --git a/dns.c b/dns.c
index de0c21ade1b79f87244572732ac4ddba580d77f6..1d3362f8b4953f86d079e8a61edc6390bbf6dda1 100644 (file)
--- a/dns.c
+++ b/dns.c
@@ -68,7 +68,8 @@ dns_type_string(uint16_t type)
 }
 
 void
-dns_send_question(struct interface *iface, const char *question, int type, int multicast)
+dns_send_question(struct interface *iface, struct sockaddr *to,
+                 const char *question, int type, int multicast)
 {
        static struct dns_header h;
        static struct dns_question q;
@@ -98,8 +99,8 @@ dns_send_question(struct interface *iface, const char *question, int type, int m
        iov[1].iov_len = len;
 
        DBG(1, "Q <- %s %s\n", dns_type_string(type), question);
-       if (interface_send_packet(iface, iov, ARRAY_SIZE(iov)) < 0)
-               perror("failed to send question :");
+       if (interface_send_packet(iface, to, iov, ARRAY_SIZE(iov)) < 0)
+               perror("failed to send question");
 }
 
 
@@ -138,7 +139,7 @@ dns_add_answer(int type, const uint8_t *rdata, uint16_t rdlength, int ttl)
 }
 
 void
-dns_send_answer(struct interface *iface, const char *answer)
+dns_send_answer(struct interface *iface, struct sockaddr *to, const char *answer)
 {
        uint8_t buffer[256];
        struct blob_attr *attr;
@@ -177,12 +178,12 @@ dns_send_answer(struct interface *iface, const char *answer)
                DBG(1, "A <- %s %s\n", dns_type_string(be16_to_cpu(a->type)), answer);
        }
 
-       if (interface_send_packet(iface, iov, n_iov) < 0)
-               fprintf(stderr, "failed to send question\n");
+       if (interface_send_packet(iface, to, iov, n_iov) < 0)
+               perror("failed to send answer");
 }
 
 void
-dns_reply_a(struct interface *iface, int ttl)
+dns_reply_a(struct interface *iface, struct sockaddr *to, int ttl)
 {
        struct ifaddrs *ifap, *ifa;
        struct sockaddr_in *sa;
@@ -205,7 +206,7 @@ dns_reply_a(struct interface *iface, int ttl)
                                dns_add_answer(TYPE_AAAA, (uint8_t *) &sa6->sin6_addr, 16, ttl);
                }
        }
-       dns_send_answer(iface, mdns_hostname_local);
+       dns_send_answer(iface, to, mdns_hostname_local);
 
        freeifaddrs(ifap);
 }
@@ -221,6 +222,7 @@ scan_name(const uint8_t *buffer, int len)
                if (IS_COMPRESSED(l))
                        return offset + 2;
 
+               if (l + 1 > len) return -1;
                len -= l + 1;
                offset += l + 1;
                buffer += l + 1;
@@ -236,16 +238,16 @@ static struct dns_header*
 dns_consume_header(uint8_t **data, int *len)
 {
        struct dns_header *h = (struct dns_header *) *data;
-       uint16_t *swap = (uint16_t *) h;
-       int endianess = 6;
 
        if (*len < sizeof(struct dns_header))
                return NULL;
 
-       while (endianess--) {
-               *swap = be16_to_cpu(*swap);
-               swap++;
-       }
+       h->id = be16_to_cpu(h->id);
+       h->flags = be16_to_cpu(h->flags);
+       h->questions = be16_to_cpu(h->questions);
+       h->answers = be16_to_cpu(h->answers);
+       h->authority = be16_to_cpu(h->authority);
+       h->additional = be16_to_cpu(h->additional);
 
        *len -= sizeof(struct dns_header);
        *data += sizeof(struct dns_header);
@@ -257,16 +259,12 @@ static struct dns_question*
 dns_consume_question(uint8_t **data, int *len)
 {
        struct dns_question *q = (struct dns_question *) *data;
-       uint16_t *swap = (uint16_t *) q;
-       int endianess = 2;
 
        if (*len < sizeof(struct dns_question))
                return NULL;
 
-       while (endianess--) {
-               *swap = be16_to_cpu(*swap);
-               swap++;
-       }
+       q->type = be16_to_cpu(q->type);
+       q->class = be16_to_cpu(q->class);
 
        *len -= sizeof(struct dns_question);
        *data += sizeof(struct dns_question);
@@ -312,14 +310,15 @@ dns_consume_name(const uint8_t *base, int blen, uint8_t **data, int *len)
        return name_buffer;
 }
 
-static int
-parse_answer(struct interface *iface, uint8_t *buffer, int len, uint8_t **b, int *rlen, int cache)
+static int parse_answer(struct interface *iface, struct sockaddr *from,
+                       uint8_t *buffer, int len, uint8_t **b, int *rlen,
+                       int cache)
 {
        char *name = dns_consume_name(buffer, len, b, rlen);
        struct dns_answer *a;
        uint8_t *rdata;
 
-       if (!name) {
+       if (!name || *rlen < 0) {
                fprintf(stderr, "dropping: bad question\n");
                return -1;
        }
@@ -343,32 +342,52 @@ parse_answer(struct interface *iface, uint8_t *buffer, int len, uint8_t **b, int
        *b += a->rdlength;
 
        if (cache)
-               cache_answer(iface, buffer, len, name, a, rdata, a->class & CLASS_FLUSH);
+               cache_answer(iface, from, buffer, len, name, a, rdata, a->class & CLASS_FLUSH);
 
        return 0;
 }
 
 static void
-parse_question(struct interface *iface, char *name, struct dns_question *q)
+parse_question(struct interface *iface, struct sockaddr *from, char *name, struct dns_question *q)
 {
+       struct sockaddr *to = NULL;
        char *host;
 
-       if ((q->class & CLASS_UNICAST) && iface->multicast)
-               iface = iface->peer;
+       /* TODO: Multicast if more than one quarter of TTL has passed */
+       if (q->class & CLASS_UNICAST) {
+               to = from;
+               if (iface->multicast)
+                       iface = iface->peer;
+       }
 
        DBG(1, "Q -> %s %s\n", dns_type_string(q->type), name);
 
        switch (q->type) {
        case TYPE_ANY:
                if (!strcmp(name, mdns_hostname_local)) {
-                       service_reply(iface, NULL, announce_ttl);
-                       dns_reply_a(iface, announce_ttl);
+                       dns_reply_a(iface, to, announce_ttl);
+                       service_reply(iface, to, NULL, NULL, announce_ttl);
                }
                break;
 
        case TYPE_PTR:
-               service_announce_services(iface, name, announce_ttl);
-               service_reply(iface, name, announce_ttl);
+               if (!strcmp(name, C_DNS_SD)) {
+                       dns_reply_a(iface, to, announce_ttl);
+                       service_announce_services(iface, to, announce_ttl);
+               } else {
+                       if (name[0] == '_') {
+                               service_reply(iface, to, NULL, name, announce_ttl);
+                       } else {
+                               /* First dot separates instance name from the rest */
+                               char *dot = strchr(name, '.');
+
+                               if (dot) {
+                                       *dot = '\0';
+                                       service_reply(iface, to, name, dot + 1, announce_ttl);
+                                       *dot = '.';
+                               }
+                       }
+               }
                break;
 
        case TYPE_AAAA:
@@ -376,14 +395,14 @@ parse_question(struct interface *iface, char *name, struct dns_question *q)
                host = strstr(name, ".local");
                if (host)
                        *host = '\0';
-               if (!strcmp(mdns_hostname, name))
-                       dns_reply_a(iface, announce_ttl);
+               if (!strcmp(umdns_host_label, name))
+                       dns_reply_a(iface, to, announce_ttl);
                break;
        };
 }
 
 void
-dns_handle_packet(struct interface *iface, struct sockaddr *s, uint16_t port, uint8_t *buffer, int len)
+dns_handle_packet(struct interface *iface, struct sockaddr *from, uint16_t port, uint8_t *buffer, int len)
 {
        struct dns_header *h;
        uint8_t *b = buffer;
@@ -395,7 +414,7 @@ dns_handle_packet(struct interface *iface, struct sockaddr *s, uint16_t port, ui
                return;
        }
 
-       if (h->questions && !iface->multicast && port != 5353)
+       if (h->questions && !iface->multicast && port != MCAST_PORT)
                /* silently drop unicast questions that dont originate from port 5353 */
                return;
 
@@ -403,7 +422,7 @@ dns_handle_packet(struct interface *iface, struct sockaddr *s, uint16_t port, ui
                char *name = dns_consume_name(buffer, len, &b, &rlen);
                struct dns_question *q;
 
-               if (!name) {
+               if (!name || rlen < 0) {
                        fprintf(stderr, "dropping: bad name\n");
                        return;
                }
@@ -415,22 +434,22 @@ dns_handle_packet(struct interface *iface, struct sockaddr *s, uint16_t port, ui
                }
 
                if (!(h->flags & FLAG_RESPONSE))
-                       parse_question(iface, name, q);
+                       parse_question(iface, from, name, q);
        }
 
        if (!(h->flags & FLAG_RESPONSE))
                return;
 
        while (h->answers-- > 0)
-               if (parse_answer(iface, buffer, len, &b, &rlen, 1))
+               if (parse_answer(iface, from, buffer, len, &b, &rlen, 1))
                        return;
 
        while (h->authority-- > 0)
-               if (parse_answer(iface, buffer, len, &b, &rlen, 1))
+               if (parse_answer(iface, from, buffer, len, &b, &rlen, 1))
                        return;
 
        while (h->additional-- > 0)
-               if (parse_answer(iface, buffer, len, &b, &rlen, 1))
+               if (parse_answer(iface, from, buffer, len, &b, &rlen, 1))
                        return;
 
 }