Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-07-18 05:30:13 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
DoH, DoQ, and DNS-over-gRPC unpack messages without the acceptance
checks used by UDP and TCP. An unauthenticated request with a large
QDCOUNT can therefore force excessive allocations while names are
decoded and exhaust server memory.

Enforce the same request policy across all server transports.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
This commit is contained in:
Ville Vesilehto
2026-07-16 03:54:46 +03:00
committed by GitHub
parent d5e54040ff
commit 530b0a5ff2
5 changed files with 66 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/dnsserver/server_grpc.go
View File

@@ -9,6 +9,7 @@ import (
"github.com/coredns/caddy"
"github.com/coredns/coredns/pb"
"github.com/coredns/coredns/plugin/pkg/dnsutil"
"github.com/coredns/coredns/plugin/pkg/reuseport"
"github.com/coredns/coredns/plugin/pkg/transport"
@@ -177,8 +178,7 @@ func (s *ServergRPC) Query(ctx context.Context, in *pb.DnsPacket) (*pb.DnsPacket
if len(in.GetMsg()) > dns.MaxMsgSize {
return nil, fmt.Errorf("dns message exceeds size limit: %d", len(in.GetMsg()))
}
msg := new(dns.Msg)
err := msg.Unpack(in.GetMsg())
msg, err := dnsutil.UnpackRequest(in.GetMsg())
if err != nil {
return nil, err
}