romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-09 01:27:16 +03:00
Code Issues Projects Releases Packages Wiki Activity

doh: cap the maximum TTL to 24 hours

Browse source 
To avoid mistakes or abuse to cause problems. Many public DNS providers
cap their cache times to this.

Verify in test 1650

Reported-by: netspacer.research
Closes #22122
This commit is contained in:
Daniel Stenberg 2026-06-21 23:32:09 +02:00
parent 8ed285f06d
commit e8e3af2abb
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 14 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/doh.c
View file

@ -725,7 +725,9 @@ UNITTEST void de_init(struct dohentry *de)
curlx_dyn_init(&de->cname[i], DYN_DOH_CNAME);
}
/* @unittest 1655 */
/* TTL value cap */
#define MAX_DNS_TTL 86400U /* 24 hours */
/* @unittest 1650 */
UNITTEST DOHcode doh_resp_decode(const unsigned char *doh,
size_t dohlen,
DNStype dnstype,
@ -795,6 +797,8 @@ UNITTEST DOHcode doh_resp_decode(const unsigned char *doh,
return DOH_DNS_OUT_OF_RANGE;
ttl = doh_get32bit(doh, index);
if(ttl > MAX_DNS_TTL)
ttl = MAX_DNS_TTL;
if(ttl < d->ttl)
d->ttl = ttl;
index += 4;

17
tests/unit/unit1650.c
View file

@ -102,16 +102,16 @@ static CURLcode test_unit1650(const char *arg)
"\x6c\x04\x63\x75\x72\x6c\x00\x00\x05\x00\x01\xc0\x0c\x00\x05\x00"
"\x01\x00\x00\x00\x37\x00\x11\x08\x61\x6e\x79\x77\x68\x65\x72\x65"
"\x06\x72\x65\x61\x6c\x6c\x79\x00", 56,
CURL_DNS_TYPE_A, DOH_OK, "anywhere.really "},
CURL_DNS_TYPE_A, DOH_OK, "anywhere.really (55)"},
{DNS_FOO_EXAMPLE_COM, 49, CURL_DNS_TYPE_A, DOH_OK, "127.0.0.1 "},
{DNS_FOO_EXAMPLE_COM, 49, CURL_DNS_TYPE_A, DOH_OK, "127.0.0.1 (55)"},
{"\x00\x00\x01\x00\x00\x01\x00\x01\x00\x00\x00\x00\x04\x61\x61\x61"
"\x61\x07\x65\x78\x61\x6d\x70\x6c\x65\x03\x63\x6f\x6d\x00\x00\x1c"
"\x00\x01\xc0\x0c\x00\x1c\x00\x01\x00\x00\x00\x37\x00\x10\x20\x20"
"\x00\x01\xc0\x0c\x00\x1c\x00\x01\x00\x00\x01\x37\x00\x10\x20\x20"
"\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x20", 62,
CURL_DNS_TYPE_AAAA, DOH_OK,
"2020:2020:0000:0000:0000:0000:0000:2020 " },
"2020:2020:0000:0000:0000:0000:0000:2020 (311)" },
{"\x00\x00\x01\x00\x00\x01\x00\x01\x00\x00\x00\x00\x04\x63\x75\x72"
"\x6c\x04\x63\x75\x72\x6c\x00\x00\x05\x00\x01\xc0\x0c\x00\x05\x00"
@ -129,19 +129,19 @@ static CURLcode test_unit1650(const char *arg)
62 + 30,
CURL_DNS_TYPE_AAAA, DOH_OK,
"2020:2020:0000:0000:0000:0000:0000:2020 " },
"2020:2020:0000:0000:0000:0000:0000:2020 (55)" },
/* packet with ARCOUNT == 1 */
/* packet with ARCOUNT == 1, and a capped TTL */
{"\x00\x00\x01\x00\x00\x01\x00\x01\x00\x00\x00\x01\x04\x61\x61\x61"
"\x61\x07\x65\x78\x61\x6d\x70\x6c\x65\x03\x63\x6f\x6d\x00\x00\x1c"
"\x00\x01\xc0\x0c\x00\x1c\x00\x01\x00\x00\x00\x37\x00\x10\x20\x20"
"\x00\x01\xc0\x0c\x00\x1c\x00\x01\x00\xff\xff\x37\x00\x10\x20\x20"
"\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x20"
LABEL_TEST LABEL_HOST LABEL_NAME DNSAAAA_EPILOGUE "\x00\x00\x00\x01"
"\00\x04\x01\x01\x01\x01", /* RDDATA */
62 + 30,
CURL_DNS_TYPE_AAAA, DOH_OK,
"2020:2020:0000:0000:0000:0000:0000:2020 " },
"2020:2020:0000:0000:0000:0000:0000:2020 (86400)" },
};
@ -222,6 +222,7 @@ static CURLcode test_unit1650(const char *arg)
len -= o;
ptr += o;
}
curl_msnprintf(ptr, len, "(%u)", d.ttl);
de_cleanup(&d);
if(resp[i].out && strcmp((const char *)buffer, resp[i].out)) {
curl_mfprintf(stderr, "resp %zu: Expected %s got %s\n", i,