mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-29 05:28:00 +00:00
Code Issues Releases Wiki Activity

Return BADCOOKIE on validly formed bad SERVER COOKIES

Browse Source 
The server was previously tolerant of out-of-date or otherwise bad
DNS SERVER COOKIES that where well formed unless require-cookie was
set.  BADCOOKIE is now return for these conditions.
This commit is contained in:
Mark Andrews 2023-07-06 16:58:53 +10:00
parent 4990f8ae34
commit 3969e2c5f7
3 changed files with 21 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
lib/ns/client.c
View File

@ -1147,15 +1147,10 @@ static void
compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce, compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
const unsigned char *secret, isc_buffer_t *buf) { const unsigned char *secret, isc_buffer_t *buf) {
unsigned char digest[ISC_MAX_MD_SIZE] ISC_NONSTRING = { 0 }; unsigned char digest[ISC_MAX_MD_SIZE] ISC_NONSTRING = { 0 };
STATIC_ASSERT(ISC_MAX_MD_SIZE >= ISC_SIPHASH24_TAG_LENGTH, "You need " STATIC_ASSERT(ISC_MAX_MD_SIZE >= ISC_SIPHASH24_TAG_LENGTH,
"to " "You need to increase the digest buffer.");
"increase " STATIC_ASSERT(ISC_MAX_MD_SIZE >= ISC_AES_BLOCK_LENGTH,
"the digest " "You need to increase the digest buffer.");
"buffer.");
STATIC_ASSERT(ISC_MAX_MD_SIZE >= ISC_AES_BLOCK_LENGTH, "You need to "
"increase the "
"digest "
"buffer.");
switch (client->manager->sctx->cookiealg) { switch (client->manager->sctx->cookiealg) {
case ns_cookiealg_siphash24: { case ns_cookiealg_siphash24: {
@ -1278,6 +1273,7 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
} else { } else {
ns_stats_increment(client->manager->sctx->nsstats, ns_stats_increment(client->manager->sctx->nsstats,
ns_statscounter_cookiebadsize); ns_statscounter_cookiebadsize);
client->attributes |= NS_CLIENTATTR_BADCOOKIE;
} }
return; return;
} }
@ -1297,9 +1293,10 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
* Only accept COOKIE if we have talked to the client in the last hour. * Only accept COOKIE if we have talked to the client in the last hour.
*/ */
now = isc_stdtime_now(); now = isc_stdtime_now();
if (isc_serial_gt(when, (now + 300)) || /* In the future. */ if (isc_serial_gt(when, (now + 300)) /* In the future. */ ||
isc_serial_lt(when, (now - 3600))) isc_serial_lt(when, (now - 3600)) /* In the past. */)
{ /* In the past. */ {
client->attributes |= NS_CLIENTATTR_BADCOOKIE;
ns_stats_increment(client->manager->sctx->nsstats, ns_stats_increment(client->manager->sctx->nsstats,
ns_statscounter_cookiebadtime); ns_statscounter_cookiebadtime);
return; return;
@ -1328,6 +1325,7 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
} }
} }
client->attributes |= NS_CLIENTATTR_BADCOOKIE;
ns_stats_increment(client->manager->sctx->nsstats, ns_stats_increment(client->manager->sctx->nsstats,
ns_statscounter_cookienomatch); ns_statscounter_cookienomatch);
} }

3
lib/ns/include/ns/client.h
View File

@ -234,7 +234,8 @@ struct ns_client {
#define NS_CLIENTATTR_MULTICAST 0x00008 /*%< recv'd from multicast */ #define NS_CLIENTATTR_MULTICAST 0x00008 /*%< recv'd from multicast */
#define NS_CLIENTATTR_WANTDNSSEC 0x00010 /*%< include dnssec records */ #define NS_CLIENTATTR_WANTDNSSEC 0x00010 /*%< include dnssec records */
#define NS_CLIENTATTR_WANTNSID 0x00020 /*%< include nameserver ID */ #define NS_CLIENTATTR_WANTNSID 0x00020 /*%< include nameserver ID */
/* Obsolete: NS_CLIENTATTR_FILTER_AAAA 0x00040 */ #define NS_CLIENTATTR_BADCOOKIE \
0x00040 /*%< Presented cookie is bad/out-of-date */
/* Obsolete: NS_CLIENTATTR_FILTER_AAAA_RC 0x00080 */ /* Obsolete: NS_CLIENTATTR_FILTER_AAAA_RC 0x00080 */
#define NS_CLIENTATTR_WANTAD 0x00100 /*%< want AD in response if possible */ #define NS_CLIENTATTR_WANTAD 0x00100 /*%< want AD in response if possible */
#define NS_CLIENTATTR_WANTCOOKIE 0x00200 /*%< return a COOKIE */ #define NS_CLIENTATTR_WANTCOOKIE 0x00200 /*%< return a COOKIE */

13
lib/ns/query.c
View File

@ -115,6 +115,8 @@
#define WANTDNSSEC(c) (((c)->attributes & NS_CLIENTATTR_WANTDNSSEC) != 0) #define WANTDNSSEC(c) (((c)->attributes & NS_CLIENTATTR_WANTDNSSEC) != 0)
/*% Want WANTAD? */ /*% Want WANTAD? */
#define WANTAD(c) (((c)->attributes & NS_CLIENTATTR_WANTAD) != 0) #define WANTAD(c) (((c)->attributes & NS_CLIENTATTR_WANTAD) != 0)
/*% Client presented a bad COOKIE. */
#define BADCOOKIE(c) (((c)->attributes & NS_CLIENTATTR_BADCOOKIE) != 0)
/*% Client presented a valid COOKIE. */ /*% Client presented a valid COOKIE. */
#define HAVECOOKIE(c) (((c)->attributes & NS_CLIENTATTR_HAVECOOKIE) != 0) #define HAVECOOKIE(c) (((c)->attributes & NS_CLIENTATTR_HAVECOOKIE) != 0)
/*% Client presented a COOKIE. */ /*% Client presented a COOKIE. */
@ -5619,11 +5621,14 @@ ns__query_start(query_ctx_t *qctx) {
CALL_HOOK(NS_QUERY_START_BEGIN, qctx); CALL_HOOK(NS_QUERY_START_BEGIN, qctx);
/* /*
* If we require a server cookie then send back BADCOOKIE * If we require a server cookie or the presented server
* before we have done too much work. * cookie was bad then send back BADCOOKIE before we have
* done too much work.
*/ */
if (!TCP(qctx->client) && qctx->view->requireservercookie && if (!TCP(qctx->client) &&
WANTCOOKIE(qctx->client) && !HAVECOOKIE(qctx->client)) (BADCOOKIE(qctx->client) ||
(qctx->view->requireservercookie && WANTCOOKIE(qctx->client) &&
!HAVECOOKIE(qctx->client))))
{ {
qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AA; qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AA;
qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AD; qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AD;