Validate internal PTR UDP responses

Correlate received UDP datagrams with the active PTR request and keep waiting within the original timeout when unrelated responses are received.

Refs #2978

Signed-off-by: Gisle Enåsen <6815997+brealorg@users.noreply.github.com>

Author: brealorg

src/resolve.c

@@ -33,6 +33,8 @@
 #include "regex_r.h"
 // statis_assert()
 #include <assert.h>
+#include <poll.h>
+#include <time.h>
 // TCP_MAX_QUERIES
 #include "dnsmasq/config.h"
 
@@ -285,13 +287,101 @@ int create_socket(bool tcp, struct sockaddr_in *dest)
 // Helper macro to reduce code duplication
 #define log_resolve_info(host, port, tcp) { log_info("Tried to resolve PTR \"%s\" on 127.0.0.1#%u (%s)", host, port, tcp ? "TCP" : "UDP"); }
 
+// Return CLOCK_MONOTONIC in milliseconds for resolver receive deadlines
+static int64_t resolver_monotonic_msec(void)
+{
+	struct timespec now = { 0 };
+	if(clock_gettime(CLOCK_MONOTONIC, &now) != 0)
+		return -1;
+
+	return (int64_t)now.tv_sec * 1000LL + now.tv_nsec / 1000000LL;
+}
+
+// Validate that a UDP DNS response belongs to the active PTR request and
+// return a pointer to the first answer record in the received packet.
+static bool validate_udp_ptr_response(uint8_t *buf, const size_t response_len,
+                                      const uint16_t request_id, const char *host,
+                                      struct DNS_HEADER *dns, uint8_t **answer)
+{
+	if(response_len < sizeof(struct DNS_HEADER))
+	{
+		log_debug(DEBUG_RESOLVER,
+		          "Discarding short UDP DNS reply while resolving PTR \"%s\" (%zu bytes)",
+		          host, response_len);
+		return false;
+	}
+
+	memcpy(dns, buf, sizeof(struct DNS_HEADER));
+
+	if(dns->id != request_id || dns->qr != 1 || dns->opcode != 0 ||
+	   ntohs(dns->q_count) != 1)
+	{
+		log_debug(DEBUG_RESOLVER,
+		          "Discarding unrelated UDP DNS reply while resolving PTR \"%s\" "
+		          "(id %u, expected %u, qr %u, opcode %u, questions %u)",
+		          host, (unsigned int)ntohs(dns->id),
+		          (unsigned int)ntohs(request_id), (unsigned int)dns->qr,
+		          (unsigned int)dns->opcode,
+		          (unsigned int)ntohs(dns->q_count));
+		return false;
+	}
+
+	const unsigned char *bufend = buf + response_len;
+	uint8_t *reader = buf + sizeof(struct DNS_HEADER);
+	uint16_t consumed = 0;
+	unsigned char *question_name = nameFromDNS(reader, buf, bufend, &consumed);
+	if(question_name == NULL)
+	{
+		log_debug(DEBUG_RESOLVER,
+		          "Discarding malformed UDP DNS question while resolving PTR \"%s\"",
+		          host);
+		return false;
+	}
+
+	if(consumed > (size_t)(bufend - reader) ||
+	   sizeof(struct QUESTION) > (size_t)(bufend - reader - consumed))
+	{
+		free(question_name);
+		log_debug(DEBUG_RESOLVER,
+		          "Discarding truncated UDP DNS question while resolving PTR \"%s\"",
+		          host);
+		return false;
+	}
+
+	reader += consumed;
+	struct QUESTION question = { 0 };
+	memcpy(&question, reader, sizeof(question));
+
+	const bool matches =
+	    strcasecmp((const char *)question_name, host) == 0 &&
+	    ntohs(question.qtype) == T_PTR &&
+	    ntohs(question.qclass) == 1;
+
+	if(!matches)
+	{
+		log_debug(DEBUG_RESOLVER,
+		          "Discarding UDP DNS reply with mismatched question while resolving "
+		          "PTR \"%s\" (received \"%s\", type %u, class %u)",
+		          host, (const char *)question_name,
+		          (unsigned int)ntohs(question.qtype),
+		          (unsigned int)ntohs(question.qclass));
+		free(question_name);
+		return false;
+	}
+
+	free(question_name);
+	*answer = reader + sizeof(struct QUESTION);
+	return true;
+}
+
 // Perform a name lookup by sending a packet to ourselves
 static bool ngethostbyname(const int sock, const bool tcp, struct sockaddr_in *dest,
                            char hostn[MAXDOMAINLEN], const char *host, const char *ipaddr, bool *truncated)
 {	
 	// Initialize request DNS header
 	struct DNS_HEADER dns = { 0 };
 	dns.id = (unsigned short) htons(random()); // random query ID
+	const uint16_t request_id = dns.id;
 	dns.qr = 0; // This is a query
 	dns.opcode = 0; // This is a standard query
 	dns.aa = 0; // Not Authoritative
@@ -314,7 +404,7 @@ static bool ngethostbyname(const int sock, const bool tcp, struct sockaddr_in *d
 	if(hname == NULL)
 	{
 		log_err("Unable to allocate memory for hname");
-		return NULL;
+		return false;
 	}
 	strncpy(hname, host, hnamelen);
 	strncat(hname, ".", hnamelen - strlen(hname));
@@ -342,6 +432,9 @@ static bool ngethostbyname(const int sock, const bool tcp, struct sockaddr_in *d
 	log_debug(DEBUG_RESOLVER, "Resolving PTR \"%s\" on 127.0.0.1#%u (%s)",
 	          host, config.dns.port.v.u16, tcp ? "TCP" : "UDP");
 
+	ssize_t response_len = sizeof(buf);
+	uint8_t *reader = NULL;
+
 	// Send the query and receive the answer
 	if(!tcp)
 	{
@@ -352,15 +445,92 @@ static bool ngethostbyname(const int sock, const bool tcp, struct sockaddr_in *d
 		{
 			log_err("Cannot send UDP DNS query: %s", strsockerr(errno));
 			log_resolve_info(host, config.dns.port.v.u16, tcp);
-			return NULL;
+			return false;
 		}
 
-		// Receive the answer
-		if(recvfrom (sock, buf, sizeof(buf), 0, (struct sockaddr*)dest, &addrlen) < 0)
+		// Use one absolute deadline for this request. Mismatched packets are
+		// discarded without extending the original two-second timeout.
+		const int64_t start = resolver_monotonic_msec();
+		if(start < 0)
 		{
-			log_err("Cannot receive UDP DNS reply: %s", strsockerr(errno));
+			log_err("Cannot read resolver monotonic clock: %s", strerror(errno));
 			log_resolve_info(host, config.dns.port.v.u16, tcp);
-			return NULL;
+			return false;
+		}
+		const int64_t deadline = start + 2000;
+
+		while(true)
+		{
+			const int64_t now = resolver_monotonic_msec();
+			if(now < 0)
+			{
+				log_err("Cannot read resolver monotonic clock: %s", strerror(errno));
+				log_resolve_info(host, config.dns.port.v.u16, tcp);
+				return false;
+			}
+
+			const int64_t remaining = deadline - now;
+			if(remaining <= 0)
+			{
+				log_err("Cannot receive UDP DNS reply: %s", strsockerr(EAGAIN));
+				log_resolve_info(host, config.dns.port.v.u16, tcp);
+				return false;
+			}
+
+			struct pollfd pfd = {
+				.fd = sock,
+				.events = POLLIN,
+				.revents = 0,
+			};
+
+			const int ready = poll(&pfd, 1, (int)remaining);
+			if(ready < 0)
+			{
+				if(errno == EINTR)
+					continue;
+
+				log_err("Cannot wait for UDP DNS reply: %s", strsockerr(errno));
+				log_resolve_info(host, config.dns.port.v.u16, tcp);
+				return false;
+			}
+			if(ready == 0)
+			{
+				log_err("Cannot receive UDP DNS reply: %s", strsockerr(EAGAIN));
+				log_resolve_info(host, config.dns.port.v.u16, tcp);
+				return false;
+			}
+
+			struct sockaddr_in source = { 0 };
+			socklen_t source_len = sizeof(source);
+			response_len = recvfrom(sock, buf, sizeof(buf), MSG_DONTWAIT,
+			                        (struct sockaddr *)&source, &source_len);
+			if(response_len < 0)
+			{
+				if(errno == EAGAIN || errno == EINTR)
+					continue;
+
+				log_err("Cannot receive UDP DNS reply: %s", strsockerr(errno));
+				log_resolve_info(host, config.dns.port.v.u16, tcp);
+				return false;
+			}
+
+			if(source_len < sizeof(source) ||
+			   source.sin_family != dest->sin_family ||
+			   source.sin_addr.s_addr != dest->sin_addr.s_addr ||
+			   source.sin_port != dest->sin_port)
+			{
+				log_debug(DEBUG_RESOLVER,
+				          "Discarding UDP DNS reply from unexpected source while "
+				          "resolving PTR \"%s\"",
+				          host);
+				continue;
+			}
+
+			if(!validate_udp_ptr_response(buf, (size_t)response_len,
+			                              request_id, host, &dns, &reader))
+				continue;
+
+			break;
 		}
 	}
 	else
@@ -378,7 +548,7 @@ static bool ngethostbyname(const int sock, const bool tcp, struct sockaddr_in *d
 		{
 			log_err("Cannot send TCP DNS query: %s", strsockerr(errno));
 			log_resolve_info(host, config.dns.port.v.u16, tcp);
-			return NULL;
+			return false;
 		}
 
 		// Receive the answer, first the length of the message ...
@@ -387,7 +557,7 @@ static bool ngethostbyname(const int sock, const bool tcp, struct sockaddr_in *d
 		{
 			log_err("Cannot receive TCP DNS reply (1): %s", strsockerr(errno));
 			log_resolve_info(host, config.dns.port.v.u16, tcp);
-			return NULL;
+			return false;
 		}
 		prefix = ntohs(prefix);
 
@@ -398,22 +568,22 @@ static bool ngethostbyname(const int sock, const bool tcp, struct sockaddr_in *d
 		{
 			log_err("Received TCP DNS reply is too long (%u bytes)", prefix);
 			log_resolve_info(host, config.dns.port.v.u16, tcp);
-			return NULL;
+			return false;
 		}
 		bzero(buf, prefix + 1);
 		// ... then the message itself
 		if(recv(sock, buf, sizeof(buf), 0) < 0)
 		{
 			log_err("Cannot receive TCP DNS reply (2): %s", strsockerr(errno));
 			log_resolve_info(host, config.dns.port.v.u16, tcp);
-			return NULL;
+			return false;
 		}
-	}
 
-	// Parse the reply
-	memcpy(&dns, buf, sizeof(struct DNS_HEADER));
-	// Move ahead of the dns header and the query field
-	uint8_t *reader = &buf[len];
+		// Preserve the existing TCP parser behavior. The PoC hardens the UDP
+		// path where sequential lookups share one datagram socket.
+		memcpy(&dns, buf, sizeof(struct DNS_HEADER));
+		reader = &buf[len];
+	}
 
 	// Log the status of the query
 	log_debug(DEBUG_RESOLVER, "DNS query for PTR \"%s\" returned status %s (%i)",
@@ -425,14 +595,14 @@ static bool ngethostbyname(const int sock, const bool tcp, struct sockaddr_in *d
 		log_debug(DEBUG_RESOLVER, " --> DNS response truncated");
 		if(truncated != NULL)
 			*truncated = true;
-		return NULL;
+		return false;
 	}
 
 	// Start reading answers
 	uint16_t stop = 0;
 	bool have_name = false;
 	struct RES_RECORD answers[20] = { 0 };
-	const unsigned char *bufend = buf + sizeof(buf);
+	const unsigned char *bufend = tcp ? buf + sizeof(buf) : buf + response_len;
 	for(uint16_t i = 0; i < min(ntohs(dns.ans_count), ArraySize(answers)); i++)
 	{
 		// Ensure the read pointer still points within the receive