Skip to content

Parsing ip6.arpa DNS PTR replies throws an exception #551

Description

@pyksy

Platform: GNU/Linux

After constructing a TINS::DNS object with a valid DNS reply packet that contains an ip6.arpa PTR record, DNS::answers() throws a "DNS decompression: pointer loops" exception.

In my testing I used the DNS reply packet created by this dig command:
dig @8.8.8.8 2.2.2.0.4.0.0.0.0.0.0.0.0.0.0.0.5.0.0.0.0.0.0.0.8.0.7.0.1.0.0.2.ip6.arpa ptr
ip6_arpa_dns_reply.pcap.gz

I think the exception gets thrown due to faulty tracking of pointer chains during DNS name decompression. In DNS::compose_name() there is this check

if (pointer_counter++ > 30){
    throw dns_decompression_pointer_loops();
}

which throws the exception on my perfectly valid ip6.arpa PTR reply.

Instead of counting pointers, I think it could be replaced by tracking the visited offsets for duplicates
EDIT: I thought wrong. The pointers cannot be tracked just locally. This is not a working fix.

#include <set>
 
[ ... ]
std::set<const uint8_t*> visited_ptrs;
[ ... ]
if (!visited_ptrs.insert(ptr).second) {
    throw dns_decompression_pointer_loops();
}
[ ... ]

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions