Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-07-18 13:40:12 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
DoH, DoQ, and DNS-over-gRPC unpack messages without the acceptance
checks used by UDP and TCP. An unauthenticated request with a large
QDCOUNT can therefore force excessive allocations while names are
decoded and exhaust server memory.

Enforce the same request policy across all server transports.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
This commit is contained in:
Ville Vesilehto
2026-07-16 03:54:46 +03:00
committed by GitHub
parent d5e54040ff
commit 530b0a5ff2
5 changed files with 66 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/dnsserver/server_quic.go
View File

@@ -11,6 +11,7 @@ import (
"time"
"github.com/coredns/coredns/plugin/metrics/vars"
"github.com/coredns/coredns/plugin/pkg/dnsutil"
clog "github.com/coredns/coredns/plugin/pkg/log"
cproxyproto "github.com/coredns/coredns/plugin/pkg/proxyproto"
"github.com/coredns/coredns/plugin/pkg/reuseport"
@@ -211,8 +212,7 @@ func (s *ServerQUIC) serveQUICStream(stream *quic.Stream, conn *quic.Conn) {
return
}
req := &dns.Msg{}
err = req.Unpack(buf)
req, err := dnsutil.UnpackRequest(buf)
if err != nil {
clog.Debugf("unpacking quic packet: %s", err)
s.closeQUICConn(conn, DoQCodeProtocolError)