chiark / gitweb /
SECURITY: Do not hang, eating CPU, if we encounter a compression pointer loop
[adns.git] / src / parse.c
1 /*
2  * parse.c
3  * - parsing assistance functions (mainly for domains inside datagrams)
4  */
5 /*
6  *  This file is part of adns, which is
7  *    Copyright (C) 1997-2000,2003,2006,2014-2016  Ian Jackson
8  *    Copyright (C) 2014  Mark Wooding
9  *    Copyright (C) 1999-2000,2003,2006  Tony Finch
10  *    Copyright (C) 1991 Massachusetts Institute of Technology
11  *  (See the file INSTALL for full details.)
12  *  
13  *  This program is free software; you can redistribute it and/or modify
14  *  it under the terms of the GNU General Public License as published by
15  *  the Free Software Foundation; either version 3, or (at your option)
16  *  any later version.
17  *  
18  *  This program is distributed in the hope that it will be useful,
19  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
20  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
21  *  GNU General Public License for more details.
22  *  
23  *  You should have received a copy of the GNU General Public License
24  *  along with this program; if not, write to the Free Software Foundation.
25  */
26
27 #include "internal.h"
28
29 static int vbuf_append_quoted1035(vbuf *vb, const byte *buf, int len) {
30   char qbuf[10];
31   int i, ch;
32   
33   while (len) {
34     qbuf[0]= 0;
35     for (i=0; i<len; i++) {
36       ch= buf[i];
37       if (ch <= ' ' || ch >= 127) {
38         sprintf(qbuf,"\\%03o",ch);
39         break;
40       } else if (!ctype_domainunquoted(ch)) {
41         sprintf(qbuf,"\\%c",ch);
42         break;
43       }
44     }
45     if (!adns__vbuf_append(vb,buf,i) ||
46         !adns__vbuf_append(vb,qbuf,strlen(qbuf)))
47       return 0;
48     if (i<len) i++;
49     buf+= i;
50     len-= i;
51   }
52   return 1;
53 }
54
55 void adns__findlabel_start(findlabel_state *fls, adns_state ads,
56                            int serv, adns_query qu,
57                            const byte *dgram, int dglen, int max,
58                            int dmbegin, int *dmend_rlater) {
59   fls->ads= ads;
60   fls->qu= qu;
61   fls->serv= serv;
62   fls->dgram= dgram;
63   fls->dglen= dglen;
64   fls->max= max;
65   fls->cbyte= dmbegin;
66   fls->namelen= 0;
67   fls->dmend_r= dmend_rlater;
68 }
69
70 adns_status adns__findlabel_next(findlabel_state *fls,
71                                  int *lablen_r, int *labstart_r) {
72   int lablen, jumpto;
73   const char *dgram;
74   int had_pointer= 0;
75
76   dgram= fls->dgram;
77   for (;;) {
78     if (fls->cbyte >= fls->dglen) goto x_truncated;
79     if (fls->cbyte >= fls->max) goto x_badresponse;
80     GET_B(fls->cbyte,lablen);
81     if (!(lablen & 0x0c0)) break;
82     if ((lablen & 0x0c0) != 0x0c0) return adns_s_unknownformat;
83     if (fls->cbyte >= fls->dglen) goto x_truncated;
84     if (fls->cbyte >= fls->max) goto x_badresponse;
85     if (had_pointer++ >= 2) goto x_loop;
86     GET_B(fls->cbyte,jumpto);
87     jumpto |= (lablen&0x3f)<<8;
88     if (fls->dmend_r) *(fls->dmend_r)= fls->cbyte;
89     fls->cbyte= jumpto;
90     fls->dmend_r= 0; fls->max= fls->dglen+1;
91   }
92   if (labstart_r) *labstart_r= fls->cbyte;
93   if (lablen) {
94     if (fls->namelen) fls->namelen++;
95     fls->namelen+= lablen;
96     if (fls->namelen > DNS_MAXDOMAIN) return adns_s_answerdomaintoolong;
97     fls->cbyte+= lablen;
98     if (fls->cbyte > fls->dglen) goto x_truncated;
99     if (fls->cbyte > fls->max) goto x_badresponse;
100   } else {
101     if (fls->dmend_r) *(fls->dmend_r)= fls->cbyte;
102   }
103   *lablen_r= lablen;
104   return adns_s_ok;
105
106  x_truncated:
107   *lablen_r= -1;
108   return adns_s_ok;
109
110  x_badresponse: 
111   adns__diag(fls->ads,fls->serv,fls->qu,
112              "label in domain runs beyond end of domain");
113   return adns_s_invalidresponse;
114
115  x_loop: 
116   adns__diag(fls->ads,fls->serv,fls->qu,
117              "compressed label pointer chain");
118   return adns_s_invalidresponse;
119 }
120
121 adns_status adns__parse_domain(adns_state ads, int serv, adns_query qu,
122                                vbuf *vb, parsedomain_flags flags,
123                                const byte *dgram, int dglen, int *cbyte_io,
124                                int max) {
125   findlabel_state fls;
126   
127   adns__findlabel_start(&fls,ads, serv,qu, dgram,dglen,max,
128                         *cbyte_io,cbyte_io);
129   vb->used= 0;
130   return adns__parse_domain_more(&fls,ads,qu, vb,flags,dgram);
131 }
132
133 adns_status adns__parse_domain_more(findlabel_state *fls, adns_state ads,
134                                     adns_query qu, vbuf *vb,
135                                     parsedomain_flags flags,
136                                     const byte *dgram) {
137   int lablen, labstart, i, ch, first;
138   adns_status st;
139
140   first= 1;
141   for (;;) {
142     st= adns__findlabel_next(fls,&lablen,&labstart);
143     if (st) return st;
144     if (lablen<0) { vb->used=0; return adns_s_ok; }
145     if (!lablen) break;
146     if (first) {
147       first= 0;
148     } else {
149       if (!adns__vbuf_append(vb,".",1)) return adns_s_nomemory;
150     }
151     if (flags & pdf_quoteok) {
152       if (!vbuf_append_quoted1035(vb,dgram+labstart,lablen))
153         return adns_s_nomemory;
154     } else {
155       ch= dgram[labstart];
156       if (!ctype_alpha(ch) && !ctype_digit(ch))
157         return adns_s_answerdomaininvalid;
158       for (i= labstart+1; i<labstart+lablen; i++) {
159         ch= dgram[i];
160         if (ch != '-' && !ctype_alpha(ch) && !ctype_digit(ch))
161           return adns_s_answerdomaininvalid;
162       }
163       if (!adns__vbuf_append(vb,dgram+labstart,lablen))
164         return adns_s_nomemory;
165     }
166   }
167   if (!adns__vbuf_append(vb,"",1)) return adns_s_nomemory;
168   return adns_s_ok;
169 }
170
171 bool adns__labels_equal(const byte *a, int al, const byte *b, int bl) {
172   if (al != bl) return 0;
173   while (al-- > 0) {
174     int ac= ctype_toupper(*a++);
175     int bc= ctype_toupper(*b++);
176     if (ac != bc) return 0;
177   }
178   return 1;
179 }
180
181 adns_status adns__findrr_anychk(adns_query qu, int serv,
182                                 const byte *dgram, int dglen, int *cbyte_io,
183                                 int *type_r, int *class_r,
184                                 unsigned long *ttl_r,
185                                 int *rdlen_r, int *rdstart_r,
186                                 const byte *eo_dgram, int eo_dglen,
187                                 int eo_cbyte, int *eo_matched_r) {
188   findlabel_state fls, eo_fls_buf;
189   findlabel_state *eo_fls; /* 0 iff we know it's not matching eo_... */
190   int cbyte;
191   
192   int tmp, rdlen;
193   unsigned long ttl;
194   int lablen, labstart;
195   int eo_lablen, eo_labstart;
196   adns_status st;
197
198   cbyte= *cbyte_io;
199
200   adns__findlabel_start(&fls,qu->ads, serv,qu, dgram,dglen,dglen,cbyte,&cbyte);
201   if (eo_dgram) {
202     eo_fls= &eo_fls_buf;
203     adns__findlabel_start(eo_fls,qu->ads, -1,0,
204                           eo_dgram,eo_dglen,eo_dglen,eo_cbyte,0);
205   } else {
206     eo_fls= 0;
207   }
208   
209   for (;;) {
210     st= adns__findlabel_next(&fls,&lablen,&labstart);
211     if (st) return st;
212     if (lablen<0) goto x_truncated;
213
214     if (eo_fls) {
215       st= adns__findlabel_next(eo_fls,&eo_lablen,&eo_labstart);
216       assert(!st); assert(eo_lablen>=0);
217       if (!adns__labels_equal(dgram+labstart, lablen,
218                               eo_dgram+eo_labstart, eo_lablen))
219         eo_fls= 0;
220     }
221     if (!lablen) break;
222   }
223   if (eo_matched_r) *eo_matched_r= !!eo_fls;
224    
225   if (cbyte+10>dglen) goto x_truncated;
226   GET_W(cbyte,tmp); *type_r= tmp;
227   GET_W(cbyte,tmp); *class_r= tmp;
228
229   GET_L(cbyte,ttl);
230   if (ttl > MAXTTLBELIEVE) ttl= MAXTTLBELIEVE;
231   *ttl_r= ttl;
232   
233   GET_W(cbyte,rdlen); if (rdlen_r) *rdlen_r= rdlen;
234   if (rdstart_r) *rdstart_r= cbyte;
235   cbyte+= rdlen;
236   if (cbyte>dglen) goto x_truncated;
237   *cbyte_io= cbyte;
238   return adns_s_ok;
239
240  x_truncated:
241   *type_r= -1;
242   return 0;
243 }
244
245 adns_status adns__findrr(adns_query qu, int serv,
246                          const byte *dgram, int dglen, int *cbyte_io,
247                          int *type_r, int *class_r, unsigned long *ttl_r,
248                          int *rdlen_r, int *rdstart_r,
249                          int *ownermatchedquery_r) {
250   if (!ownermatchedquery_r) {
251     return adns__findrr_anychk(qu,serv,
252                                dgram,dglen,cbyte_io,
253                                type_r,class_r,ttl_r,rdlen_r,rdstart_r,
254                                0,0,0, 0);
255   } else if (!qu->cname_dgram) {
256     return adns__findrr_anychk(qu,serv,
257                                dgram,dglen,cbyte_io,
258                                type_r,class_r,ttl_r,rdlen_r,rdstart_r,
259                                qu->query_dgram,qu->query_dglen,DNS_HDRSIZE,
260                                ownermatchedquery_r);
261   } else {
262     return adns__findrr_anychk(qu,serv,
263                                dgram,dglen,cbyte_io,
264                                type_r,class_r,ttl_r,rdlen_r,rdstart_r,
265                                qu->cname_dgram,qu->cname_dglen,qu->cname_begin,
266                                ownermatchedquery_r);
267   }
268 }