• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

PowerDNS / pdns / 16524460483

25 Jul 2025 02:29PM UTC coverage: 65.852% (+0.04%) from 65.814%
16524460483

Pull #15874

github

web-flow
Merge a7da19df4 into 9364aba54
Pull Request #15874: dnsdist: Only check the freshness of the configuration when needed

42050 of 92400 branches covered (45.51%)

Branch coverage included in aggregate %.

46 of 56 new or added lines in 18 files covered. (82.14%)

10995 existing lines in 108 files now uncovered.

127879 of 165645 relevant lines covered (77.2%)

6116352.35 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

89.67
/pdns/proxy-protocol.cc
1
/*
2
 * This file is part of PowerDNS or dnsdist.
3
 * Copyright -- PowerDNS.COM B.V. and its contributors
4
 *
5
 * This program is free software; you can redistribute it and/or modify
6
 * it under the terms of version 2 of the GNU General Public License as
7
 * published by the Free Software Foundation.
8
 *
9
 * In addition, for the avoidance of any doubt, permission is granted to
10
 * link this program with OpenSSL and to (re)distribute the binaries
11
 * produced as the result of such linking.
12
 *
13
 * This program is distributed in the hope that it will be useful,
14
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16
 * GNU General Public License for more details.
17
 *
18
 * You should have received a copy of the GNU General Public License
19
 * along with this program; if not, write to the Free Software
20
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21
 */
22

23
#include "proxy-protocol.hh"
24

25
// TODO: maybe use structs instead of explicitly working byte by byte, like https://github.com/dovecot/core/blob/master/src/lib-master/master-service-haproxy.c
26

27
#define PROXYMAGIC "\x0D\x0A\x0D\x0A\x00\x0D\x0A\x51\x55\x49\x54\x0A"
28
#define PROXYMAGICLEN sizeof(PROXYMAGIC)-1
29

30
static const string proxymagic(PROXYMAGIC, PROXYMAGICLEN);
31

32
static void makeSimpleHeader(uint8_t command, uint8_t protocol, uint16_t contentLen, size_t additionalSize, std::string& out)
33
{
154✔
34
  const uint8_t versioncommand = (0x20 | command);
154✔
35
  const size_t totalSize = proxymagic.size() + sizeof(versioncommand) + sizeof(protocol) + sizeof(contentLen) + additionalSize;
154✔
36
  if (out.capacity() < totalSize) {
154!
37
    out.reserve(totalSize);
154✔
38
  }
154✔
39

40
  out.append(proxymagic);
154✔
41

42
  out.append(reinterpret_cast<const char*>(&versioncommand), sizeof(versioncommand));
154✔
43
  out.append(reinterpret_cast<const char*>(&protocol), sizeof(protocol));
154✔
44

45
  out.append(reinterpret_cast<const char*>(&contentLen), sizeof(contentLen));
154✔
46
}
154✔
47

48
std::string makeLocalProxyHeader()
49
{
29✔
50
  std::string out;
29✔
51
  makeSimpleHeader(0x00, 0, 0, 0, out);
29✔
52
  return out;
29✔
53
}
29✔
54

55
std::string makeProxyHeader(bool tcp, const ComboAddress& source, const ComboAddress& destination, const std::vector<ProxyProtocolValue>& values)
56
{
131✔
57
  if (source.sin4.sin_family != destination.sin4.sin_family) {
131✔
UNCOV
58
    throw std::runtime_error("The PROXY destination and source addresses must be of the same family");
3✔
UNCOV
59
  }
3✔
60

61
  const uint8_t command = 0x01;
128✔
62
  const uint8_t protocol = (source.isIPv4() ? 0x10 : 0x20) | (tcp ? 0x01 : 0x02);
128✔
63
  const size_t addrSize = source.isIPv4() ? sizeof(source.sin4.sin_addr.s_addr) : sizeof(source.sin6.sin6_addr.s6_addr);
128✔
64
  const uint16_t sourcePort = source.sin4.sin_port;
128✔
65
  const uint16_t destinationPort = destination.sin4.sin_port;
128✔
66

67
  size_t valuesSize = 0;
128✔
68
  for (const auto& value : values) {
288✔
69
    if (value.content.size() > std::numeric_limits<uint16_t>::max()) {
266✔
70
      throw std::runtime_error("The size of proxy protocol values is limited to " + std::to_string(std::numeric_limits<uint16_t>::max()) + ", trying to add a value of size " + std::to_string(value.content.size()));
3✔
71
    }
3✔
72
    valuesSize += sizeof(uint8_t) + sizeof(uint8_t) * 2 + value.content.size();
263✔
73
    if (valuesSize > std::numeric_limits<uint16_t>::max()) {
263!
74
      throw std::runtime_error("The total size of proxy protocol values is limited to " + std::to_string(std::numeric_limits<uint16_t>::max()));
×
75
    }
×
76
  }
263✔
77

78
  /* size of the data that will come _after_ the minimal proxy protocol header */
79
  size_t additionalDataSize = (addrSize * 2) + sizeof(sourcePort) + sizeof(destinationPort) + valuesSize;
125✔
80
  if (additionalDataSize > std::numeric_limits<uint16_t>::max()) {
125!
81
    throw std::runtime_error("The size of a proxy protocol header is limited to " + std::to_string(std::numeric_limits<uint16_t>::max()) + ", trying to send one of size " + std::to_string(additionalDataSize));
×
82
  }
×
83

84
  const uint16_t contentlen = htons(static_cast<uint16_t>(additionalDataSize));
125✔
85
  std::string ret;
125✔
86
  makeSimpleHeader(command, protocol, contentlen, additionalDataSize, ret);
125✔
87

88
  // We already established source and destination sin_family equivalence
89
  if (source.isIPv4()) {
125✔
90
    assert(addrSize == sizeof(source.sin4.sin_addr.s_addr));
101!
91
    ret.append(reinterpret_cast<const char*>(&source.sin4.sin_addr.s_addr), addrSize);
100✔
92
    assert(addrSize == sizeof(destination.sin4.sin_addr.s_addr));
101!
93
    ret.append(reinterpret_cast<const char*>(&destination.sin4.sin_addr.s_addr), addrSize);
100✔
94
  }
101✔
95
  else {
24✔
96
    assert(addrSize == sizeof(source.sin6.sin6_addr.s6_addr));
24!
97
    ret.append(reinterpret_cast<const char*>(&source.sin6.sin6_addr.s6_addr), addrSize);
19✔
98
    assert(addrSize == sizeof(destination.sin6.sin6_addr.s6_addr));
24!
99
    ret.append(reinterpret_cast<const char*>(&destination.sin6.sin6_addr.s6_addr), addrSize);
19✔
100
  }
24✔
101

102
  ret.append(reinterpret_cast<const char*>(&sourcePort), sizeof(sourcePort));
119✔
103
  ret.append(reinterpret_cast<const char*>(&destinationPort), sizeof(destinationPort));
125✔
104

105
  for (const auto& value : values) {
285✔
106
    uint16_t contentSize = htons(static_cast<uint16_t>(value.content.size()));
263✔
107
    ret.append(reinterpret_cast<const char*>(&value.type), sizeof(value.type));
263✔
108
    ret.append(reinterpret_cast<const char*>(&contentSize), sizeof(contentSize));
263✔
109
    ret.append(reinterpret_cast<const char*>(value.content.data()), value.content.size());
263✔
110
  }
263✔
111

112
  return ret;
125✔
113
}
125✔
114

115
/* returns: number of bytes consumed (positive) after successful parse
116
         or number of bytes missing (negative)
117
         or unfixable parse error (0)*/
118
template<typename Container> ssize_t isProxyHeaderComplete(const Container& header, bool* proxy, bool* tcp, size_t* addrSizeOut, uint8_t* protocolOut)
119
{
268✔
120
  static const size_t addr4Size = sizeof(ComboAddress::sin4.sin_addr.s_addr);
268✔
121
  static const size_t addr6Size = sizeof(ComboAddress::sin6.sin6_addr.s6_addr);
268✔
122
  size_t addrSize = 0;
268✔
123
  uint8_t versioncommand;
268✔
124
  uint8_t protocol;
268✔
125

126
  if (header.size() < s_proxyProtocolMinimumHeaderSize) {
268✔
127
    // this is too short to be a complete proxy header
128
    return -(s_proxyProtocolMinimumHeaderSize - header.size());
35✔
129
  }
35✔
130

131
  if (std::memcmp(&header.at(0), &proxymagic.at(0), proxymagic.size()) != 0) {
233✔
132
    // wrong magic, can not be a proxy header
133
    return 0;
15✔
134
  }
15✔
135

136
  versioncommand = header.at(12);
218✔
137
  /* check version */
138
  if (!(versioncommand & 0x20)) {
218✔
139
    return 0;
3✔
140
  }
3✔
141

142
  /* remove the version to get the command */
143
  uint8_t command = versioncommand & ~0x20;
215✔
144

145
  if (command == 0x01) {
215!
146
    protocol = header.at(13);
203✔
147
    if ((protocol & 0xf) == 1) {
203✔
148
      if (tcp) {
104!
149
        *tcp = true;
23✔
150
      }
23✔
151
    } else if ((protocol & 0xf) == 2) {
111!
152
      if (tcp) {
96!
153
        *tcp = false;
59✔
154
      }
59✔
155
    } else {
96✔
156
      return 0;
3✔
157
    }
3✔
158

159
    protocol = protocol >> 4;
200✔
160

161
    if (protocol == 1) {
200✔
162
      if (protocolOut) {
120!
163
        *protocolOut = 4;
32✔
164
      }
32✔
165
      addrSize = addr4Size; // IPv4
120✔
166
    } else if (protocol == 2) {
137✔
167
      if (protocolOut) {
77!
168
        *protocolOut = 6;
47✔
169
      }
47✔
170
      addrSize = addr6Size; // IPv6
77✔
171
    } else {
77✔
172
      // invalid protocol
173
      return 0;
3✔
174
    }
3✔
175

176
    if (addrSizeOut) {
197✔
177
      *addrSizeOut = addrSize;
79✔
178
    }
79✔
179

180
    if (proxy) {
197!
181
      *proxy = true;
79✔
182
    }
79✔
183
  }
197✔
184
  else if (command == 0x00) {
12✔
185
    if (proxy) {
9!
186
      *proxy = false;
7✔
187
    }
7✔
188
  }
9✔
189
  else {
3✔
190
    /* unsupported command */
191
    return 0;
3✔
192
  }
3✔
193

194
  uint16_t contentlen = (static_cast<uint8_t>(header.at(14)) << 8) + static_cast<uint8_t>(header.at(15));
206✔
195
  uint16_t expectedlen = 0;
206✔
196
  if (command != 0x00) {
206!
197
    expectedlen = (addrSize * 2) + sizeof(ComboAddress::sin4.sin_port) + sizeof(ComboAddress::sin4.sin_port);
197✔
198
  }
197✔
199

200
  if (contentlen < expectedlen) {
206!
201
    return 0;
×
202
  }
×
203

204
  if (header.size() < s_proxyProtocolMinimumHeaderSize + contentlen) {
206✔
205
    return -((s_proxyProtocolMinimumHeaderSize + contentlen) - header.size());
90✔
206
  }
90✔
207

208
  return s_proxyProtocolMinimumHeaderSize + contentlen;
116✔
209
}
206✔
210

211
/* returns: number of bytes consumed (positive) after successful parse
212
         or number of bytes missing (negative)
213
         or unfixable parse error (0)*/
214
template<typename Container> ssize_t parseProxyHeader(const Container& header, bool& proxy, ComboAddress& source, ComboAddress& destination, bool& tcp, std::vector<ProxyProtocolValue>& values)
215
{
109✔
216
  size_t addrSize = 0;
109✔
217
  uint8_t protocol = 0;
109✔
218
  ssize_t got = isProxyHeaderComplete(header, &proxy, &tcp, &addrSize, &protocol);
109✔
219
  if (got <= 0) {
109✔
220
    return got;
29✔
221
  }
29✔
222

223
  size_t pos = s_proxyProtocolMinimumHeaderSize;
80✔
224

225
  if (proxy) {
80!
226
    source = makeComboAddressFromRaw(protocol, reinterpret_cast<const char*>(&header.at(pos)), addrSize);
73✔
227
    pos = pos + addrSize;
73✔
228
    destination = makeComboAddressFromRaw(protocol, reinterpret_cast<const char*>(&header.at(pos)), addrSize);
73✔
229
    pos = pos + addrSize;
73✔
230
    source.setPort((static_cast<uint8_t>(header.at(pos)) << 8) + static_cast<uint8_t>(header.at(pos+1)));
73✔
231
    pos = pos + sizeof(uint16_t);
73✔
232
    destination.setPort((static_cast<uint8_t>(header.at(pos)) << 8) + static_cast<uint8_t>(header.at(pos+1)));
73✔
233
    pos = pos + sizeof(uint16_t);
73✔
234
  }
73✔
235

236
  size_t remaining = got - pos;
80✔
237
  while (remaining >= (sizeof(uint8_t) + sizeof(uint16_t))) {
182✔
238
    /* we still have TLV values to parse */
239
    uint8_t type = static_cast<uint8_t>(header.at(pos));
105✔
240
    pos += sizeof(uint8_t);
105✔
241
    uint16_t len = (static_cast<uint8_t>(header.at(pos)) << 8) + static_cast<uint8_t>(header.at(pos + 1));
105✔
242
    pos += sizeof(uint16_t);
105✔
243

244
    if (len > 0) {
105!
245
      if (len > (got - pos)) {
105!
246
        return 0;
3✔
247
      }
3✔
248

249
      values.push_back({std::string(reinterpret_cast<const char*>(&header.at(pos)), len), type});
102✔
250
      pos += len;
102✔
251
    }
102✔
252
    else {
×
253
      values.push_back({"", type});
×
254
    }
×
255

256
    remaining = got - pos;
102✔
257
  }
102✔
258

259
  return pos;
77✔
260
}
80✔
261

262
#include "noinitvector.hh"
263
template ssize_t isProxyHeaderComplete<std::string>(const std::string& header, bool* proxy, bool* tcp, size_t* addrSizeOut, uint8_t* protocolOut);
264
template ssize_t isProxyHeaderComplete<PacketBuffer>(const PacketBuffer& header, bool* proxy, bool* tcp, size_t* addrSizeOut, uint8_t* protocolOut);
265
template ssize_t parseProxyHeader<std::string>(const std::string& header, bool& proxy, ComboAddress& source, ComboAddress& destination, bool& tcp, std::vector<ProxyProtocolValue>& values);
266
template ssize_t parseProxyHeader<PacketBuffer>(const PacketBuffer& header, bool& proxy, ComboAddress& source, ComboAddress& destination, bool& tcp, std::vector<ProxyProtocolValue>& values);
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc