dns.c: improve input validation
[oweals/mdnsd.git] / dns.c
1 /*
2  * Copyright (C) 2014 John Crispin <blogic@openwrt.org>
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU Lesser General Public License version 2.1
6  * as published by the Free Software Foundation
7  *
8  * This program is distributed in the hope that it will be useful,
9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
11  * GNU General Public License for more details.
12  */
13
14 #include <sys/types.h>
15 #include <sys/stat.h>
16
17 #include <fcntl.h>
18 #include <ifaddrs.h>
19 #include <time.h>
20 #include <stdio.h>
21 #include <unistd.h>
22 #include <sys/types.h>
23 #include <sys/socket.h>
24 #include <netinet/in.h>
25 #include <arpa/inet.h>
26 #include <arpa/nameser.h>
27 #include <resolv.h>
28 #include <stdlib.h>
29 #include <string.h>
30
31 #include <libubox/uloop.h>
32 #include <libubox/usock.h>
33 #include <libubox/utils.h>
34
35 #include "announce.h"
36 #include "util.h"
37 #include "dns.h"
38 #include "cache.h"
39 #include "service.h"
40 #include "interface.h"
41
42 static char name_buffer[MAX_NAME_LEN + 1];
43 static char dns_buffer[MAX_NAME_LEN];
44 static struct blob_buf ans_buf;
45
46 const char*
47 dns_type_string(uint16_t type)
48 {
49         static const struct {
50                 uint16_t type;
51                 char str[5];
52         } type_str[] = {
53                 { TYPE_A, "A" },
54                 { TYPE_AAAA, "AAAA" },
55                 { TYPE_PTR, "PTR" },
56                 { TYPE_TXT, "TXT" },
57                 { TYPE_SRV, "SRV" },
58                 { TYPE_ANY, "ANY" },
59         };
60         int i;
61
62         for (i = 0; i < ARRAY_SIZE(type_str); i++) {
63                 if (type == type_str[i].type)
64                         return type_str[i].str;
65         }
66
67         return "N/A";
68 }
69
70 void
71 dns_send_question(struct interface *iface, struct sockaddr *to,
72                   const char *question, int type, int multicast)
73 {
74         static struct dns_header h;
75         static struct dns_question q;
76         static struct iovec iov[] = {
77                 {
78                         .iov_base = &h,
79                         .iov_len = sizeof(h),
80                 },
81                 {
82                         .iov_base = dns_buffer,
83                 },
84                 {
85                         .iov_base = &q,
86                         .iov_len = sizeof(q),
87                 }
88         };
89         int len;
90
91         h.questions = cpu_to_be16(1);
92         q.class = cpu_to_be16((multicast ? 0 : CLASS_UNICAST) | 1);
93         q.type = cpu_to_be16(type);
94
95         len = dn_comp(question, (void *) dns_buffer, sizeof(dns_buffer), NULL, NULL);
96         if (len < 1)
97                 return;
98
99         iov[1].iov_len = len;
100
101         DBG(1, "Q <- %s %s\n", dns_type_string(type), question);
102         if (interface_send_packet(iface, to, iov, ARRAY_SIZE(iov)) < 0)
103                 perror("failed to send question");
104 }
105
106
107 struct dns_reply {
108         int type;
109         struct dns_answer a;
110         uint16_t rdlength;
111         uint8_t *rdata;
112         char *buffer;
113 };
114
115 static int dns_answer_cnt;
116
117 void
118 dns_init_answer(void)
119 {
120         dns_answer_cnt = 0;
121         blob_buf_init(&ans_buf, 0);
122 }
123
124 void
125 dns_add_answer(int type, const uint8_t *rdata, uint16_t rdlength, int ttl)
126 {
127         struct blob_attr *attr;
128         struct dns_answer *a;
129
130         attr = blob_new(&ans_buf, 0, sizeof(*a) + rdlength);
131         a = blob_data(attr);
132         a->type = cpu_to_be16(type);
133         a->class = cpu_to_be16(1);
134         a->ttl = cpu_to_be32(ttl);
135         a->rdlength = cpu_to_be16(rdlength);
136         memcpy(a + 1, rdata, rdlength);
137
138         dns_answer_cnt++;
139 }
140
141 void
142 dns_send_answer(struct interface *iface, struct sockaddr *to, const char *answer)
143 {
144         uint8_t buffer[256];
145         struct blob_attr *attr;
146         struct dns_header h = { 0 };
147         struct iovec *iov;
148         int answer_len, rem;
149         int n_iov = 0;
150
151         if (!dns_answer_cnt)
152                 return;
153
154         h.answers = cpu_to_be16(dns_answer_cnt);
155         h.flags = cpu_to_be16(0x8400);
156
157         iov = alloca(sizeof(struct iovec) * ((dns_answer_cnt * 2) + 1));
158
159         iov[n_iov].iov_base = &h;
160         iov[n_iov].iov_len = sizeof(struct dns_header);
161         n_iov++;
162
163         answer_len = dn_comp(answer, buffer, sizeof(buffer), NULL, NULL);
164         if (answer_len < 1)
165                 return;
166
167         blob_for_each_attr(attr, ans_buf.head, rem) {
168                 struct dns_answer *a = blob_data(attr);
169
170                 iov[n_iov].iov_base = buffer;
171                 iov[n_iov].iov_len = answer_len;
172                 n_iov++;
173
174                 iov[n_iov].iov_base = blob_data(attr);
175                 iov[n_iov].iov_len = blob_len(attr);
176                 n_iov++;
177
178                 DBG(1, "A <- %s %s\n", dns_type_string(be16_to_cpu(a->type)), answer);
179         }
180
181         if (interface_send_packet(iface, to, iov, n_iov) < 0)
182                 perror("failed to send answer");
183 }
184
185 void
186 dns_reply_a(struct interface *iface, struct sockaddr *to, int ttl)
187 {
188         struct ifaddrs *ifap, *ifa;
189         struct sockaddr_in *sa;
190         struct sockaddr_in6 *sa6;
191
192         getifaddrs(&ifap);
193
194         dns_init_answer();
195         for (ifa = ifap; ifa; ifa = ifa->ifa_next) {
196                 if (strcmp(ifa->ifa_name, iface->name))
197                         continue;
198                 if (ifa->ifa_addr->sa_family == AF_INET) {
199                         sa = (struct sockaddr_in *) ifa->ifa_addr;
200                         dns_add_answer(TYPE_A, (uint8_t *) &sa->sin_addr, 4, ttl);
201                 }
202                 if (ifa->ifa_addr->sa_family == AF_INET6) {
203                         uint8_t ll_prefix[] = {0xfe, 0x80 };
204                         sa6 = (struct sockaddr_in6 *) ifa->ifa_addr;
205                         if (!memcmp(&sa6->sin6_addr, &ll_prefix, 2))
206                                 dns_add_answer(TYPE_AAAA, (uint8_t *) &sa6->sin6_addr, 16, ttl);
207                 }
208         }
209         dns_send_answer(iface, to, mdns_hostname_local);
210
211         freeifaddrs(ifap);
212 }
213
214 static int
215 scan_name(const uint8_t *buffer, int len)
216 {
217         int offset = 0;
218
219         while (len && (*buffer != '\0')) {
220                 int l = *buffer;
221
222                 if (IS_COMPRESSED(l))
223                         return offset + 2;
224
225                 if (l + 1 > len) return -1;
226                 len -= l + 1;
227                 offset += l + 1;
228                 buffer += l + 1;
229         }
230
231         if (!len || !offset || (*buffer != '\0'))
232                 return -1;
233
234         return offset + 1;
235 }
236
237 static struct dns_header*
238 dns_consume_header(uint8_t **data, int *len)
239 {
240         struct dns_header *h = (struct dns_header *) *data;
241
242         if (*len < sizeof(struct dns_header))
243                 return NULL;
244
245         h->id = be16_to_cpu(h->id);
246         h->flags = be16_to_cpu(h->flags);
247         h->questions = be16_to_cpu(h->questions);
248         h->answers = be16_to_cpu(h->answers);
249         h->authority = be16_to_cpu(h->authority);
250         h->additional = be16_to_cpu(h->additional);
251
252         *len -= sizeof(struct dns_header);
253         *data += sizeof(struct dns_header);
254
255         return h;
256 }
257
258 static struct dns_question*
259 dns_consume_question(uint8_t **data, int *len)
260 {
261         struct dns_question *q = (struct dns_question *) *data;
262
263         if (*len < sizeof(struct dns_question))
264                 return NULL;
265
266         q->type = be16_to_cpu(q->type);
267         q->class = be16_to_cpu(q->class);
268
269         *len -= sizeof(struct dns_question);
270         *data += sizeof(struct dns_question);
271
272         return q;
273 }
274
275 static struct dns_answer*
276 dns_consume_answer(uint8_t **data, int *len)
277 {
278         struct dns_answer *a = (struct dns_answer *) *data;
279
280         if (*len < sizeof(struct dns_answer))
281                 return NULL;
282
283         a->type = be16_to_cpu(a->type);
284         a->class = be16_to_cpu(a->class);
285         a->ttl = be32_to_cpu(a->ttl);
286         a->rdlength = be16_to_cpu(a->rdlength);
287
288         *len -= sizeof(struct dns_answer);
289         *data += sizeof(struct dns_answer);
290
291         return a;
292 }
293
294 static char *
295 dns_consume_name(const uint8_t *base, int blen, uint8_t **data, int *len)
296 {
297         int nlen = scan_name(*data, *len);
298
299         if (nlen < 1)
300                 return NULL;
301
302         if (dn_expand(base, base + blen, *data, name_buffer, MAX_NAME_LEN) < 0) {
303                 perror("dns_consume_name/dn_expand");
304                 return NULL;
305         }
306
307         *len -= nlen;
308         *data += nlen;
309
310         return name_buffer;
311 }
312
313 static int parse_answer(struct interface *iface, struct sockaddr *from,
314                         uint8_t *buffer, int len, uint8_t **b, int *rlen,
315                         int cache)
316 {
317         char *name = dns_consume_name(buffer, len, b, rlen);
318         struct dns_answer *a;
319         uint8_t *rdata;
320
321         if (!name || rlen < 0) {
322                 fprintf(stderr, "dropping: bad question\n");
323                 return -1;
324         }
325
326         a = dns_consume_answer(b, rlen);
327         if (!a) {
328                 fprintf(stderr, "dropping: bad question\n");
329                 return -1;
330         }
331
332         if ((a->class & ~CLASS_FLUSH) != CLASS_IN)
333                 return -1;
334
335         rdata = *b;
336         if (a->rdlength > *rlen) {
337                 fprintf(stderr, "dropping: bad question\n");
338                 return -1;
339         }
340
341         *rlen -= a->rdlength;
342         *b += a->rdlength;
343
344         if (cache)
345                 cache_answer(iface, from, buffer, len, name, a, rdata, a->class & CLASS_FLUSH);
346
347         return 0;
348 }
349
350 static void
351 parse_question(struct interface *iface, struct sockaddr *from, char *name, struct dns_question *q)
352 {
353         struct sockaddr *to = NULL;
354         char *host;
355
356         /* TODO: Multicast if more than one quarter of TTL has passed */
357         if (q->class & CLASS_UNICAST) {
358                 to = from;
359                 if (iface->multicast)
360                         iface = iface->peer;
361         }
362
363         DBG(1, "Q -> %s %s\n", dns_type_string(q->type), name);
364
365         switch (q->type) {
366         case TYPE_ANY:
367                 if (!strcmp(name, mdns_hostname_local)) {
368                         dns_reply_a(iface, to, announce_ttl);
369                         service_reply(iface, to, NULL, NULL, announce_ttl);
370                 }
371                 break;
372
373         case TYPE_PTR:
374                 if (!strcmp(name, C_DNS_SD)) {
375                         dns_reply_a(iface, to, announce_ttl);
376                         service_announce_services(iface, to, announce_ttl);
377                 } else {
378                         if (name[0] == '_') {
379                                 service_reply(iface, to, NULL, name, announce_ttl);
380                         } else {
381                                 /* First dot separates instance name from the rest */
382                                 char *dot = strchr(name, '.');
383
384                                 if (dot) {
385                                         *dot = '\0';
386                                         service_reply(iface, to, name, dot + 1, announce_ttl);
387                                         *dot = '.';
388                                 }
389                         }
390                 }
391                 break;
392
393         case TYPE_AAAA:
394         case TYPE_A:
395                 host = strstr(name, ".local");
396                 if (host)
397                         *host = '\0';
398                 if (!strcmp(umdns_host_label, name))
399                         dns_reply_a(iface, to, announce_ttl);
400                 break;
401         };
402 }
403
404 void
405 dns_handle_packet(struct interface *iface, struct sockaddr *from, uint16_t port, uint8_t *buffer, int len)
406 {
407         struct dns_header *h;
408         uint8_t *b = buffer;
409         int rlen = len;
410
411         h = dns_consume_header(&b, &rlen);
412         if (!h) {
413                 fprintf(stderr, "dropping: bad header\n");
414                 return;
415         }
416
417         if (h->questions && !iface->multicast && port != MCAST_PORT)
418                 /* silently drop unicast questions that dont originate from port 5353 */
419                 return;
420
421         while (h->questions-- > 0) {
422                 char *name = dns_consume_name(buffer, len, &b, &rlen);
423                 struct dns_question *q;
424
425                 if (!name || rlen < 0) {
426                         fprintf(stderr, "dropping: bad name\n");
427                         return;
428                 }
429
430                 q = dns_consume_question(&b, &rlen);
431                 if (!q) {
432                         fprintf(stderr, "dropping: bad question\n");
433                         return;
434                 }
435
436                 if (!(h->flags & FLAG_RESPONSE))
437                         parse_question(iface, from, name, q);
438         }
439
440         if (!(h->flags & FLAG_RESPONSE))
441                 return;
442
443         while (h->answers-- > 0)
444                 if (parse_answer(iface, from, buffer, len, &b, &rlen, 1))
445                         return;
446
447         while (h->authority-- > 0)
448                 if (parse_answer(iface, from, buffer, len, &b, &rlen, 1))
449                         return;
450
451         while (h->additional-- > 0)
452                 if (parse_answer(iface, from, buffer, len, &b, &rlen, 1))
453                         return;
454
455 }