WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-23 16:12:30 +02:00
Code Issues Packages Projects Releases Wiki Activity

add step in rpl to verify the updated server cookie and fix bug with unupdated rdlen

Browse Source
This commit is contained in:
TCY16
2022-06-20 15:41:11 +02:00
parent 303aa68b58
commit aebf1db116
4 changed files with 119 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testcode/testpkts.c
+37 -5
View File
@@ -145,6 +145,9 @@ static void matchline(char* line, struct entry* e)
e->match_ednsdata_raw = 1;
} else if(str_keyword(&parse, "random_client_cookie")) {
e->match_random_client_cookie = 1;
} else if (str_keyword(&parse, "random_complete_cookie_renewed")) {
e->match_random_complete_cookie = 1;
e->match_random_complete_cookie_renewed = 1;
} else if(str_keyword(&parse, "random_complete_cookie")) {
e->match_random_complete_cookie = 1;
} else if(str_keyword(&parse, "UDP")) {
@@ -1544,9 +1547,9 @@ match_random_client_cookie(uint8_t* query, size_t query_len)
}
/** verify that a complete EDNS cookie (client+server) (RFC9018) of length 24
* is in the EDNS data of the query */
* is in the EDNS data of the query and the hardcoded cookie is the same */
static int
match_random_complete_cookie(uint8_t* query, size_t query_len)
match_random_complete_cookie(uint8_t* query, size_t query_len, struct entry* p)
{
uint8_t* walk_query = query;
size_t walk_query_len = query_len;
@@ -1562,15 +1565,40 @@ match_random_complete_cookie(uint8_t* query, size_t query_len)
return 0;
}
if (sldns_read_uint16(walk_query+8) != 10 /* LDNS_EDNS_COOKIE */) {
walk_query += 8;
walk_query_len -= 8;
if (sldns_read_uint16(walk_query) != 10 /* LDNS_EDNS_COOKIE */) {
verbose(3, "EDNS option is not a cookie");
return 0;
}
if (sldns_read_uint16(walk_query+10) != 24) {
if (sldns_read_uint16(walk_query+2) != 24) {
verbose(3, "EDNS cookie is not 24 bytes, so not a correct complete cookie");
return 0;
}
if (p->match_random_complete_cookie_renewed) {
uint8_t renewed_cookie[16];
/* shuffle the hardcoded cookie like adjust_packet() does */
memcpy(renewed_cookie, hardcoded_server_cookie+8, 8);
memcpy(renewed_cookie+8, hardcoded_server_cookie, 8);
/* client_cookie = 8 */
if (!(memcmp(walk_query+8, renewed_cookie, 16))) {
verbose(3, "EDNS server cookie does not match the renewed"
"cookie, so not a correct complete cookie");
return 0;
}
}
/* client_cookie = 8 */
if (!(memcmp(walk_query+8, hardcoded_server_cookie, 16))) {
verbose(3, "EDNS server cookie does not match the hardcoded cookie, "
"so not a correct complete cookie");
return 0;
}
return 1;
}
@@ -1675,7 +1703,7 @@ find_match(struct entry* entries, uint8_t* query_pkt, size_t len,
continue;
}
if (p->match_random_complete_cookie &&
!match_random_complete_cookie(query_pkt, len)) {
!match_random_complete_cookie(query_pkt, len, p)) {
verbose(3, "bad complete cookie match.\n");
continue;
}
@@ -1866,6 +1894,10 @@ adjust_packet(struct entry* match, uint8_t** answer_pkt, size_t *answer_len,
reslen = origlen + 28;
} else if (sldns_read_uint16(walk_query+2) == 24) {
/* update the RDLEN and OPTLEN */
sldns_write_uint16(rdlen_ptr_response, 28);
sldns_write_uint16(walk_response+2, 24);
/* we fake verification of the cookie and send
* it back like it's still valid. We renew the cookie
* if this desired */
testcode/testpkts.h
+3
View File
@@ -219,6 +219,9 @@ struct entry {
/** match an EDNS cookie (RFC7873) of length 24, we call
* this "complete" (RFC9018) */
uint8_t match_random_complete_cookie;
/** match an EDNS compelete cookie (RFC7873) of length 24, which cannot be
* the same as the hardcoded client cookie */
uint8_t match_random_complete_cookie_renewed;
/** match query serial with this value. */
uint32_t ixfr_soa_serial;
/** match on UDP/TCP */