ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Also process NSID and DNS COOKIE when returning BADVERS

Browse Source 
This will help identify the broken server if we happen to break
EDNS version negotiation.  It will also help protect the client
from spoofed BADVERSION responses.
This commit is contained in:
Mark Andrews
2025-03-11 11:37:20 +11:00
parent 7a815de384
commit d6a6f0b13d
1 changed files with 23 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/ns/client.c
+23 -11
View File
@@ -1550,17 +1550,6 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
* XXXRTH need library support for this!
*/
client->ednsversion = (opt->ttl & 0x00FF0000) >> 16;
if (client->ednsversion > DNS_EDNS_VERSION) {
ns_stats_increment(client->manager->sctx->nsstats,
ns_statscounter_badednsver);
result = ns_client_addopt(client, client->message,
&client->opt);
if (result == ISC_R_SUCCESS) {
result = DNS_R_BADVERS;
}
ns_client_error(client, result);
return result;
}
/* Check for NSID request */
result = dns_rdataset_first(opt);
@@ -1572,6 +1561,17 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
while (isc_buffer_remaininglength(&optbuf) >= 4) {
optcode = isc_buffer_getuint16(&optbuf);
optlen = isc_buffer_getuint16(&optbuf);
/*
* Only process DNS_OPT_NSID or DNS_OPT_COOKIE when
* returning BADVERSION.
*/
if (client->ednsversion > DNS_EDNS_VERSION &&
optcode != DNS_OPT_NSID &&
optcode != DNS_OPT_COOKIE)
{
isc_buffer_forward(&optbuf, optlen);
continue;
}
switch (optcode) {
case DNS_OPT_NSID:
if (!WANTNSID(client)) {
@@ -1643,6 +1643,18 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
}
}
if (client->ednsversion > DNS_EDNS_VERSION) {
ns_stats_increment(client->manager->sctx->nsstats,
ns_statscounter_badednsver);
result = ns_client_addopt(client, client->message,
&client->opt);
if (result == ISC_R_SUCCESS || result == ISC_R_NOMORE) {
result = DNS_R_BADVERS;
}
ns_client_error(client, result);
return (result);
}
ns_stats_increment(client->manager->sctx->nsstats,
ns_statscounter_edns0in);
client->attributes |= NS_CLIENTATTR_WANTOPT;