8685871088

Committed 15 Apr 2024 08:25AM UTC coverage: 59.5% (+0.01%) from 59.487%

Build # 8685871088

Build Type

push

github

Committed by

web-flow

Commit Message

Merge pull request #14041 from rgacogne/ddist-fix-crash-tcp-downstream

dnsdist: Fix a crash in the Downstream TCP handler

Run Details

32617 of 87272 branches covered (37.37%)

Branch coverage included in aggregate %.

9 of 12 new or added lines in 4 files covered. (75.0%)

34 existing lines in 7 files now uncovered.

114091 of 159297 relevant lines covered (71.62%)

3713409.29 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

77.22

/pdns/tsigverifier.cc


#include "tsigverifier.hh"
#include "dnssecinfra.hh"
#include "gss_context.hh"

bool TSIGTCPVerifier::check(const string& data, const MOADNSParser& mdp)
{
  if(d_tt.name.empty()) { // TSIG verify message
    return true;
  }

  string theirMac;
  bool checkTSIG = false;
  // If we have multiple messages, we need to concatenate them together. We also need to make sure we know the location of
  // the TSIG record so we can remove it in makeTSIGMessageFromTSIGPacket
  d_signData.append(data);
  if (mdp.getTSIGPos() == 0) {
    d_tsigPos += data.size();
  }
  else {
    d_tsigPos += mdp.getTSIGPos();
  }

  for(const auto& answer :  mdp.d_answers) {
    if (answer.first.d_type == QType::SOA) {
      // A SOA is either the first or the last record. We need to check TSIG if that's the case.
      checkTSIG = true;
    }

    if(answer.first.d_type == QType::TSIG) {
      auto trc = getRR<TSIGRecordContent>(answer.first);
      if(trc) {
        theirMac = trc->d_mac;
        d_trc.d_time = trc->d_time;
        d_trc.d_fudge = trc->d_fudge;
        d_trc.d_eRcode = trc->d_eRcode;
        d_trc.d_origID = trc->d_origID;
        checkTSIG = true;
      }
    }
  }

  if(!checkTSIG && d_nonSignedMessages > 99) { // We're allowed to get 100 digest without a TSIG.
    throw std::runtime_error("No TSIG message received in last 100 messages of AXFR transfer.");
  }

  if (checkTSIG) {
    if (theirMac.empty()) {
      throw std::runtime_error("No TSIG on AXFR response from "+d_remote.toStringWithPort()+" , should be signed with TSIG key '"+d_tt.name.toLogString()+"'");
    }

    try {
      if (!d_prevMac.empty()) {
        validateTSIG(d_signData, d_tsigPos, d_tt, d_trc, d_prevMac, theirMac, true, d_signData.size()-data.size());
      }
      else {
        validateTSIG(d_signData, d_tsigPos, d_tt, d_trc, d_trc.d_mac, theirMac, false);
      }
    }
    catch(const std::runtime_error& err) {
      throw std::runtime_error("Error while validating TSIG signature on AXFR response from "+d_remote.toStringWithPort()+":"+err.what());
    }

    // Reset and store some values for the next chunks.
    d_prevMac = std::move(theirMac);
    d_nonSignedMessages = 0;
    d_signData.clear();
    d_tsigPos = 0;
  }
  else {
    d_nonSignedMessages++;
  }

  return true;
}

1
2	#include "tsigverifier.hh"
3	#include "dnssecinfra.hh"
4	#include "gss_context.hh"
5
6	bool TSIGTCPVerifier::check(const string& data, const MOADNSParser& mdp)
7	{	19,261✔
8	if(d_tt.name.empty()) { // TSIG verify message	19,261✔
9	return true;	19,192✔
10	}	19,192✔
11
12	string theirMac;	69✔
13	bool checkTSIG = false;	69✔
14	// If we have multiple messages, we need to concatenate them together. We also need to make sure we know the location of
15	// the TSIG record so we can remove it in makeTSIGMessageFromTSIGPacket
16	d_signData.append(data);	69✔
17	if (mdp.getTSIGPos() == 0) {	69!
18	d_tsigPos += data.size();	×
19	}	×
20	else {	69✔
21	d_tsigPos += mdp.getTSIGPos();	69✔
22	}	69✔
23
24	for(const auto& answer : mdp.d_answers) {	287✔
25	if (answer.first.d_type == QType::SOA) {	287✔
26	// A SOA is either the first or the last record. We need to check TSIG if that's the case.
27	checkTSIG = true;	46✔
28	}	46✔
29
30	if(answer.first.d_type == QType::TSIG) {	287✔
31	auto trc = getRR<TSIGRecordContent>(answer.first);	69✔
32	if(trc) {	69!
33	theirMac = trc->d_mac;	69✔
34	d_trc.d_time = trc->d_time;	69✔
35	d_trc.d_fudge = trc->d_fudge;	69✔
36	d_trc.d_eRcode = trc->d_eRcode;	69✔
37	d_trc.d_origID = trc->d_origID;	69✔
38	checkTSIG = true;	69✔
39	}	69✔
40	}	69✔
41	}	287✔
42
43	if(!checkTSIG && d_nonSignedMessages > 99) { // We're allowed to get 100 digest without a TSIG.	69!
44	throw std::runtime_error("No TSIG message received in last 100 messages of AXFR transfer.");	×
45	}	×
46
47	if (checkTSIG) {	69!
48	if (theirMac.empty()) {	69!
49	throw std::runtime_error("No TSIG on AXFR response from "+d_remote.toStringWithPort()+" , should be signed with TSIG key '"+d_tt.name.toLogString()+"'");	×
50	}	×
51
52	try {	69✔
53	if (!d_prevMac.empty()) {	69✔
54	validateTSIG(d_signData, d_tsigPos, d_tt, d_trc, d_prevMac, theirMac, true, d_signData.size()-data.size());	46✔
55	}	46✔
56	else {	23✔
57	validateTSIG(d_signData, d_tsigPos, d_tt, d_trc, d_trc.d_mac, theirMac, false);	23✔
58	}	23✔
59	}	69✔
60	catch(const std::runtime_error& err) {	69✔
61	throw std::runtime_error("Error while validating TSIG signature on AXFR response from "+d_remote.toStringWithPort()+":"+err.what());	×
62	}	×
63
64	// Reset and store some values for the next chunks.
65	d_prevMac = std::move(theirMac);	69✔
66	d_nonSignedMessages = 0;	69✔
67	d_signData.clear();	69✔
68	d_tsigPos = 0;	69✔
69	}	69✔
UNCOV 70	else {	×
UNCOV 71	d_nonSignedMessages++;	×
UNCOV 72	}	×
73
74	return true;	69✔
75	}	69✔

PowerDNS / pdns / 8685871088

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous