Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dnsdist: Fix handling of proxy protocol payload outside of TLS for DoT #14636

Merged

Conversation

rgacogne
Copy link
Member

@rgacogne rgacogne commented Sep 9, 2024

Short description

After reading the proxy protocol payload from the I/O buffer we were clearing the buffer but failed to properly reset the position, leading to an exception when trying to read the DNS payload after processing the TLS handshake:

Got an exception while handling (reading) TCP query from 127.0.0.1:59426: Calling tryRead() with a too small buffer (2) for a read of 18446744073709551566 bytes starting at 52

The huge value comes from the fact that the position (52 here) is larger than the size of the buffer (2 at this point to read the size of the incoming DNS payload), leading to an unsigned underflow. The code is properly detecting that the value makes no sense in this context, but the connection is then dropped because we cannot recover.

It turns out we had a end-to-end test for the "proxy protocol outside of TLS" case but only over incoming DoH, and the DoH case avoids this specific issue because the buffer is always properly resized, and the position updated. This PR adds a test for the DoT case as well.

Fixes #14631.

Checklist

I have:

  • read the CONTRIBUTING.md document
  • compiled this code
  • tested this code
  • included documentation (including possible behaviour changes)
  • documented the code
  • added or modified regression test(s)
  • added or modified unit test(s)

After reading the proxy protocol payload from the I/O buffer
we were clearing the buffer but failed to properly reset the
position, leading to an exception when trying to read the DNS
payload after processing the TLS handshake:

```
Got an exception while handling (reading) TCP query from 127.0.0.1:59426: Calling tryRead() with a too small buffer (2) for a read of 18446744073709551566 bytes starting at 52
```

The huge value comes from the fact that the position (52 here)
is larger than the size of the buffer (2 at this point to read
the size of the incoming DNS payload), leading to an unsigned
underflow. The code is properly detecting that the value makes
no sense in this context, but the connection is then dropped
because we cannot recover.

It turns out we had a end-to-end test for the "proxy protocol
outside of TLS" case but only over incoming DoH, and the DoH
case avoids this specific issue because the buffer is always
properly resized, and the position updated.
@coveralls
Copy link

Pull Request Test Coverage Report for Build 10773196061

Details

  • 4 of 4 (100.0%) changed or added relevant lines in 1 file are covered.
  • 59 unchanged lines in 13 files lost coverage.
  • Overall coverage decreased (-0.01%) to 64.646%

Files with Coverage Reduction New Missed Lines %
pdns/dnsdistdist/dnsdist-tcp.cc 1 75.79%
pdns/pollmplexer.cc 1 83.66%
pdns/backends/gsql/gsqlbackend.hh 2 97.71%
pdns/iputils.cc 3 55.45%
pdns/fstrm_logger.cc 3 44.08%
pdns/recursordist/recpacketcache.hh 3 89.55%
pdns/iputils.hh 3 78.34%
pdns/shuffle.cc 4 39.71%
modules/godbcbackend/sodbc.cc 4 70.8%
pdns/recursordist/rec-tcpout.cc 6 50.79%
Totals Coverage Status
Change from base Build 10768211128: -0.01%
Covered Lines: 124641
Relevant Lines: 162101

💛 - Coveralls

@rgacogne rgacogne merged commit 3d6d059 into PowerDNS:master Sep 10, 2024
79 checks passed
@rgacogne rgacogne deleted the ddist-fix-proxy-protocol-outside-tls-dot branch September 10, 2024 07:30
rgacogne added a commit that referenced this pull request Sep 10, 2024
dnsdist-1.9.x: Backport #14636 - Fix handling of proxy protocol payload outside of TLS for DoT
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants