mirror of
https://github.com/coredns/coredns.git
synced 2026-07-17 21:20:11 -04:00
530b0a5ff2
DoH, DoQ, and DNS-over-gRPC unpack messages without the acceptance checks used by UDP and TCP. An unauthenticated request with a large QDCOUNT can therefore force excessive allocations while names are decoded and exhaust server memory. Enforce the same request policy across all server transports. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
25 lines
565 B
Go
25 lines
565 B
Go
package dnsutil
|
|
|
|
import (
|
|
"encoding/binary"
|
|
"errors"
|
|
|
|
"github.com/miekg/dns"
|
|
)
|
|
|
|
var errRequestRejected = errors.New("dns request rejected")
|
|
|
|
// UnpackRequest unpacks a request after applying the default miekg/dns request policy.
|
|
func UnpackRequest(msg []byte) (*dns.Msg, error) {
|
|
var header dns.Header
|
|
if _, err := binary.Decode(msg, binary.BigEndian, &header); err != nil {
|
|
return nil, dns.ErrBuf
|
|
}
|
|
if dns.DefaultMsgAcceptFunc(header) != dns.MsgAccept {
|
|
return nil, errRequestRejected
|
|
}
|
|
|
|
request := new(dns.Msg)
|
|
return request, request.Unpack(msg)
|
|
}
|