Commits on Sep 9, 2024

1. dnsdist: Fix handling of proxy protocol payload outside of TLS for DoT …

   After reading the proxy protocol payload from the I/O buffer
   we were clearing the buffer but failed to properly reset the
   position, leading to an exception when trying to read the DNS
   payload after processing the TLS handshake:
   
   ```
   Got an exception while handling (reading) TCP query from 127.0.0.1:59426: Calling tryRead() with a too small buffer (2) for a read of 18446744073709551566 bytes starting at 52
   ```
   
   The huge value comes from the fact that the position (52 here)
   is larger than the size of the buffer (2 at this point to read
   the size of the incoming DNS payload), leading to an unsigned
   underflow. The code is properly detecting that the value makes
   no sense in this context, but the connection is then dropped
   because we cannot recover.
   
   It turns out we had a end-to-end test for the "proxy protocol
   outside of TLS" case but only over incoming DoH, and the DoH
   case avoids this specific issue because the buffer is always
   properly resized, and the position updated.

   

   rgacogne committed Sep 9, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 4931fb2
   • Browse repository at this point

   Copy the full SHA

   4931fb2 View commit details

   Browse the repository at this point in the history