• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 
2 /* Copyright 1998, 2011 by the Massachusetts Institute of Technology.
3  *
4  * Permission to use, copy, modify, and distribute this
5  * software and its documentation for any purpose and without
6  * fee is hereby granted, provided that the above copyright
7  * notice appear in all copies and that both that copyright
8  * notice and this permission notice appear in supporting
9  * documentation, and that the name of M.I.T. not be used in
10  * advertising or publicity pertaining to distribution of the
11  * software without specific, written prior permission.
12  * M.I.T. makes no representations about the suitability of
13  * this software for any purpose.  It is provided "as is"
14  * without express or implied warranty.
15  */
16 
17 #include "ares_setup.h"
18 
19 #ifdef HAVE_NETINET_IN_H
20 #  include <netinet/in.h>
21 #endif
22 #ifdef HAVE_ARPA_NAMESER_H
23 #  include <arpa/nameser.h>
24 #else
25 #  include "nameser.h"
26 #endif
27 #ifdef HAVE_ARPA_NAMESER_COMPAT_H
28 #  include <arpa/nameser_compat.h>
29 #endif
30 
31 #include "ares.h"
32 #include "ares_nowarn.h"
33 #include "ares_private.h" /* for the memdebug */
34 
35 /* Maximum number of indirections allowed for a name */
36 #define MAX_INDIRS 50
37 
38 static int name_length(const unsigned char *encoded, const unsigned char *abuf,
39                        int alen);
40 
41 /* Expand an RFC1035-encoded domain name given by encoded.  The
42  * containing message is given by abuf and alen.  The result given by
43  * *s, which is set to a NUL-terminated allocated buffer.  *enclen is
44  * set to the length of the encoded name (not the length of the
45  * expanded name; the goal is to tell the caller how many bytes to
46  * move forward to get past the encoded name).
47  *
48  * In the simple case, an encoded name is a series of labels, each
49  * composed of a one-byte length (limited to values between 0 and 63
50  * inclusive) followed by the label contents.  The name is terminated
51  * by a zero-length label.
52  *
53  * In the more complicated case, a label may be terminated by an
54  * indirection pointer, specified by two bytes with the high bits of
55  * the first byte (corresponding to INDIR_MASK) set to 11.  With the
56  * two high bits of the first byte stripped off, the indirection
57  * pointer gives an offset from the beginning of the containing
58  * message with more labels to decode.  Indirection can happen an
59  * arbitrary number of times, so we have to detect loops.
60  *
61  * Since the expanded name uses '.' as a label separator, we use
62  * backslashes to escape periods or backslashes in the expanded name.
63  */
64 
ares_expand_name(const unsigned char * encoded,const unsigned char * abuf,int alen,char ** s,long * enclen)65 int ares_expand_name(const unsigned char *encoded, const unsigned char *abuf,
66                      int alen, char **s, long *enclen)
67 {
68   int len, indir = 0;
69   char *q;
70   const unsigned char *p;
71   union {
72     ares_ssize_t sig;
73      size_t uns;
74   } nlen;
75 
76   nlen.sig = name_length(encoded, abuf, alen);
77   if (nlen.sig < 0)
78     return ARES_EBADNAME;
79 
80   *s = ares_malloc(nlen.uns + 1);
81   if (!*s)
82     return ARES_ENOMEM;
83   q = *s;
84 
85   if (nlen.uns == 0) {
86     /* RFC2181 says this should be ".": the root of the DNS tree.
87      * Since this function strips trailing dots though, it becomes ""
88      */
89     q[0] = '\0';
90 
91     /* indirect root label (like 0xc0 0x0c) is 2 bytes long (stupid, but
92        valid) */
93     if ((*encoded & INDIR_MASK) == INDIR_MASK)
94       *enclen = 2L;
95     else
96       *enclen = 1L;  /* the caller should move one byte to get past this */
97 
98     return ARES_SUCCESS;
99   }
100 
101   /* No error-checking necessary; it was all done by name_length(). */
102   p = encoded;
103   while (*p)
104     {
105       if ((*p & INDIR_MASK) == INDIR_MASK)
106         {
107           if (!indir)
108             {
109               *enclen = aresx_uztosl(p + 2U - encoded);
110               indir = 1;
111             }
112           p = abuf + ((*p & ~INDIR_MASK) << 8 | *(p + 1));
113         }
114       else
115         {
116           len = *p;
117           p++;
118           while (len--)
119             {
120               if (*p == '.' || *p == '\\')
121                 *q++ = '\\';
122               *q++ = *p;
123               p++;
124             }
125           *q++ = '.';
126         }
127     }
128   if (!indir)
129     *enclen = aresx_uztosl(p + 1U - encoded);
130 
131   /* Nuke the trailing period if we wrote one. */
132   if (q > *s)
133     *(q - 1) = 0;
134   else
135     *q = 0; /* zero terminate; LCOV_EXCL_LINE: empty names exit above */
136 
137   return ARES_SUCCESS;
138 }
139 
140 /* Return the length of the expansion of an encoded domain name, or
141  * -1 if the encoding is invalid.
142  */
name_length(const unsigned char * encoded,const unsigned char * abuf,int alen)143 static int name_length(const unsigned char *encoded, const unsigned char *abuf,
144                        int alen)
145 {
146   int n = 0, offset, indir = 0, top;
147 
148   /* Allow the caller to pass us abuf + alen and have us check for it. */
149   if (encoded >= abuf + alen)
150     return -1;
151 
152   while (*encoded)
153     {
154       top = (*encoded & INDIR_MASK);
155       if (top == INDIR_MASK)
156         {
157           /* Check the offset and go there. */
158           if (encoded + 1 >= abuf + alen)
159             return -1;
160           offset = (*encoded & ~INDIR_MASK) << 8 | *(encoded + 1);
161           if (offset >= alen)
162             return -1;
163           encoded = abuf + offset;
164 
165           /* If we've seen more indirects than the message length,
166            * then there's a loop.
167            */
168           ++indir;
169           if (indir > alen || indir > MAX_INDIRS)
170             return -1;
171         }
172       else if (top == 0x00)
173         {
174           offset = *encoded;
175           if (encoded + offset + 1 >= abuf + alen)
176             return -1;
177           encoded++;
178           while (offset--)
179             {
180               n += (*encoded == '.' || *encoded == '\\') ? 2 : 1;
181               encoded++;
182             }
183           n++;
184         }
185       else
186         {
187           /* RFC 1035 4.1.4 says other options (01, 10) for top 2
188            * bits are reserved.
189            */
190           return -1;
191         }
192     }
193 
194   /* If there were any labels at all, then the number of dots is one
195    * less than the number of labels, so subtract one.
196    */
197   return (n) ? n - 1 : n;
198 }
199 
200 /* Like ares_expand_name but returns EBADRESP in case of invalid input. */
ares__expand_name_for_response(const unsigned char * encoded,const unsigned char * abuf,int alen,char ** s,long * enclen)201 int ares__expand_name_for_response(const unsigned char *encoded,
202                                    const unsigned char *abuf, int alen,
203                                    char **s, long *enclen)
204 {
205   int status = ares_expand_name(encoded, abuf, alen, s, enclen);
206   if (status == ARES_EBADNAME)
207     status = ARES_EBADRESP;
208   return status;
209 }
210