Make the resolver better able to handle unexpected record types. Also check for

wrong response IPs before searching the pending list instead of after.

git-svn-id: file:///home/klmitch/undernet-ircu/undernet-ircu-svn/ircu2/trunk@1430 c9e4aea6-c8fd-4c43-8297-357d70d61c8c

diff --git a/ChangeLog b/ChangeLog
index 772912d7774389b58386c8bf57847bf1f9b76a9e..b0d90ffca1e4bb2a6336bc9d0878ce6e19f91d69 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2005-06-19  Andrew Miller  <a1kmm@amxl.com>
+
+       * ircd/ircd_res.c (proc_answer): Deal with unexpected record types more
+       gracefully.
+
+       * ircd/ircd_res.c (res_readreply): Check res_ourserver before walking
+       the pending request list, to make DoS attacks harder.
+
 2005-06-18  Michael Poole <mdpoole@troilus.org>
 
        * ircd/s_debug.c (count_memory): Consolidate several lines; make

diff --git a/ircd/ircd_res.c b/ircd/ircd_res.c
index f91fdc5933c8b74cb65a10e9075b58428c5f538a..ee9c2699c0b1d10b9af935f9f5b4fdd3027f438d 100644 (file)
--- a/ircd/ircd_res.c
+++ b/ircd/ircd_res.c
@@ -1,6 +1,6 @@
 /*
- * A rewrite of Darren Reeds original res.c As there is nothing
- * left of Darrens original code, this is now licensed by the hybrid group.
+ * A rewrite of Darren Reed's original res.c As there is nothing
+ * left of Darren's original code, this is now licensed by the hybrid group.
  * (Well, some of the function names are the same, and bits of the structs..)
  * You can use it where it is useful, free even. Buy us a beer and stuff.
  *
@@ -727,7 +727,13 @@ proc_answer(struct reslist *request, HEADER* header, char* buf, char* eob)
          * but its possible its just a broken nameserver with still
          * valid answers. But lets do some rudimentary logging for now...
          */
-          log_write(LS_RESOLVER, L_ERROR, 0, "irc_res.c bogus type %d", type);
+        log_write(LS_RESOLVER, L_ERROR, 0, "irc_res.c bogus type %d", type);
+
+        if ((char*)current + rd_length >= (char*)current)
+          current += rd_length;
+        else
+          return(0);
+
         break;
     }
   }
@@ -757,6 +763,12 @@ res_readreply(struct Event *ev)
       || (rc <= sizeof(HEADER)))
     return;
 
+  /*
+   * check against possibly fake replies
+   */
+  if (!res_ourserver(&lsin))
+    return;
+
   /*
    * convert DNS reply reader from Network byte order to CPU byte order.
    */
@@ -773,12 +785,6 @@ res_readreply(struct Event *ev)
   if (0 == (request = find_id(header->id)))
     return;
 
-  /*
-   * check against possibly fake replies
-   */
-  if (!res_ourserver(&lsin))
-    return;
-
   if ((header->rcode != NO_ERRORS) || (header->ancount == 0))
   {
     if (SERVFAIL == header->rcode)