Bug 10360 - EDNS0: res_nopt truncates buffer size incorrectly
Summary: EDNS0: res_nopt truncates buffer size incorrectly
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: 2.10
: P3 minor
Target Milestone: ---
Assignee: Ulrich Drepper
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-07-03 15:26 UTC by Hauke Lampe
Modified: 2014-07-01 07:52 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments
cap anslen in res_nopt() at 0xffff. assert() inserted because I'm not sure if negative values could be passed to res_nopt() (282 bytes, patch)
2009-07-03 15:28 UTC, Hauke Lampe
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Hauke Lampe 2009-07-03 15:26:40 UTC
Resolver functions allow buffer sizes > 65535 bytes. If RES_USE_EDNS0 is set,
res_nopt() truncates this value to 16 bit, resulting in an incorrect buffer size
advertised in EDNS query headers.

portable OpenSSH triggers this behaviour, as described here:
http://marc.info/?l=openssh-unix-dev&m=124625332427704&w=2

openbsd-compat/getrrsetbyname() sets a buffer size of 65536 bytes. In the glibc
stub-resolver, it is eventually passed on as "anslen" to __res_nopt() in
resolv/res_mkquery.c:
[...]
        NS_PUT16(anslen & 0xffff, cp); /* CLASS = UDP payload size */

and sent out to the recursor (UDPsize: 0xf0000 & 0xffff == 0)

| IP 127.0.0.1.44138 > 127.0.0.1.53: 31454+ [1au] SSHFP?
orbit.attraktor.org. ar: . OPT UDPsize=0 (48)
| IP 127.0.0.1.53 > 127.0.0.1.44138: 31454 ServFail-| [0q] 0/0/0 (12)
Comment 1 Hauke Lampe 2009-07-03 15:28:00 UTC
Created attachment 4035 [details]
cap anslen in res_nopt() at 0xffff. assert() inserted because I'm not sure if negative values could be passed to res_nopt()

cap anslen in res_nopt() at 0xffff

assert() inserted because I'm not sure if negative values could be passed to
res_nopt()
Comment 2 Ulrich Drepper 2009-07-17 06:44:36 UTC
The code comes from bind upstream.  I've checked in a similar patch.