Rpz #73

ralphdolmans · 2019-09-09T15:33:59Z

No description provided.

bring fork up-to-date with upstream

- Fixes for compiler warnings

bring fork up to date

…ature/rpz

- Added RPZ policy apply logging

- Fix memory leak - IANA ports update - merge littlehash ASAN changes

triggers.

- Fix potential memory leak

- Fix rpz memory leak

- Fix memory leak

- use localzone's memory layout when removing rr from rrset

spirillen · 2020-01-16T00:36:32Z

What a shame All checks have failed I'm still hoping you prioritize this MR as it would move you way up to the top of my choice of selection in recursors 😃

wcawijngaards · 2020-01-28T15:17:19Z

smallapp/unbound-control.c

+		if((enum rpz_action)s->svr.rpz_action[i] == RPZ_NO_OVERRIDE_ACTION)
+			continue;


This must be wrong, the value is a statistics counter, it is never assigned to this variable and the enum is a valid value for the statistics counter.

It is also wrong in remote.c, where the same line is copied from.

wcawijngaards · 2020-01-28T15:31:22Z

services/rpz.c

 	if(*dname == 0)
 		return NULL;

 	while(*dname) {
-		dname = dname+*dname+1;
+		dnamelen += ((size_t)*dname)+1;


The if(dnamelen > maxdnamelen) check needs to be before the *dname parts above, in the if(..==0) and while() and in the dnamelen+= statements, you first need to check that the label length byte fits in the maxdnamelen. With an added statement like if(dnamelen+1 > maxdnamelen) return NULL; at the start of the routine. I don't think it is needed at the end of the while loop.

Actually I think it is also needed before the *dname in the != 0 comparison below, an if statement to check if dnamelen+1 > maxdnamelen.

Ack on the check at the start of the routine, in case of a maxdnamelen of 0.

For the second check (in the while) I don't think a new if is needed, changing the existing one from if(dnamelen > maxdnamelen) to if(dnamelen+1 > maxdnamelen) should do the trick.

See ef12073

services/rpz.c

wcawijngaards · 2020-01-28T16:12:33Z

services/localzone.c

+		if(dname_is_wild(ctarget)) {
+			/* synthesize cname target */
+			struct packed_rrset_data* d;
+			uint8_t newtarget[LDNS_MAX_DOMAINLEN];


Other buffers are LDNS_MAX_DOMAINLEN+1. Also for rpz.c:646 wc[LDNS_MAX_DOMAINLEN], the +1 is elsewhere but not here.

The newtarget[] is actually not used at all and removed in a later commit (344f12d)

added +1 for the wc[] in rpz.c (7da16fe)

wcawijngaards · 2020-01-29T12:40:52Z

util/net_help.c

+	len = *dname;
 	lablen = *dname++;


ipdnametoaddr and netblockdnametoaddr also have dnamelen == 0 check needed. And perhaps also check if labellengthbyte fits in dnamelen, and if the label length fits in dnamelen.

Added in 88a706a

Also subtracting the netblock label (incl. length byte) from length passed to ipdnametoaddr.

wcawijngaards

Reviewed (change commits since previous), and it looks good! (I think this comment allows later github diffs to be made as well, hence).

global ignore list

spirillen · 2020-01-30T15:08:52Z

👏 👏 👏 👏 👏

Is there are release date for this? like 1.9.7?

ralphdolmans · 2020-01-30T15:15:59Z

Is there are release date for this? like 1.9.7?

This will be part of the upcoming Unbound 1.10 release, which is scheduled to happen in February.

ralphdolmans added 30 commits April 5, 2019 15:55

Merge pull request #3 from NLnetLabs/master

b43b8d4

bring fork up-to-date with upstream

Initial RPZ commit

9274d26

Initial RPZ commit - now with all files

c66e47c

- Fix locking issue

edcf2dd

- Fixes for compiler warnings

- apply chroot to auth-zone zonefile in unbound-checkconf

74f11b8

Merge pull request #5 from NLnetLabs/master

186c9e8

bring fork up to date

- IXFR/AXFR support for RPZ

ba67920

Merge branch 'feature/rpz' of github.com:ralphdolmans/unbound into fe…

46acf0f

…ature/rpz

- locking issues

83bf2fd

- Don't attempt an RPZ delete for unsupported actions

8dac8c0

- Make IXFR deletion more robust

a7f6886

- Added RPZ action overrides

b0b6932

- Added RPZ policy apply logging

Added RPZ log name and stats

268580f

fix double free issue

bc83e0b

Add RPZ config options to unbound.conf man page.

a77c35e

Only strdup rpz_log_name when configured

3021e32

Procedures to parse RPZ ip address notation.

395d83c

- Added RPZ response IP support

a8d6147

- Fix doxygen issue

9ce7045

- Fix memory leak - IANA ports update - merge littlehash ASAN changes

- Add RPZ response IP override option, logging, and statistics

1c5d081

Add statistics support for disabled (action override) response IP RPZ

0987a82

triggers.

Update RPZ man page and example.conf

abbb5c0

- Added RPZ/QNAME trigger test

4eb7771

- Extend RPZ/QNAME trigger test

401fc15

- Fix potential memory leak

- Add RPZ/QNAME override test

7180284

- Add RPZ respip test

88fce79

- Fix rpz memory leak

- Add RPZ response IP override test

4cbf4f4

- Add RPZ AXFR test

965f16c

- Fix memory leak

Prevent potential double free

a16111d

- add always_deny action, use this one for RPZ

ccb576f

- use localzone's memory layout when removing rr from rrset

ralphdolmans added 6 commits January 15, 2020 23:14

- Fix doxygen issue

1654373

- Fix faulty assert

627285a

Merge branch 'master' of github.com:NLnetLabs/unbound into rpz

9877e52

try to understand travis

53d85f9

attemp to get more info out of travis

fd6456d

- Fix the dname_has_label fix

72c4c6b

ralphdolmans added 4 commits January 16, 2020 01:41

Revert travis verbosity

24131ca

- Add cname target wc synth. to testbound test

b783732

- improve dname_has_label(), add unit test

bda4c4a

- extend rpz_respip.rpl with ipv6 without zz label case

e00ce7e

wcawijngaards reviewed Jan 28, 2020

View reviewed changes

services/rpz.c Outdated Show resolved Hide resolved

wcawijngaards reviewed Jan 28, 2020

View reviewed changes

services/rpz.c Outdated Show resolved Hide resolved

wcawijngaards reviewed Jan 28, 2020

View reviewed changes

ralphdolmans added 4 commits January 28, 2020 18:35

- Address review feedback

9df07b4

- Fix RPZ's get_tld_label maxdnamelen check

ef12073

- Make dname_has_label's dnamelen check work with 0 length

1d91852

- Use consistent dname buffer sizes for RPZ

7da16fe

wcawijngaards reviewed Jan 29, 2020

View reviewed changes

wcawijngaards approved these changes Jan 29, 2020

View reviewed changes

ralphdolmans added 4 commits January 29, 2020 15:16

- Add extra dnamelen checks to ipdnametoaddr and netblockdnametoaddr

88a706a

- Fix RPZ stats RPZ_NO_OVERRIDE_ACTION check

3609287

- Revert addition of cscope.out to project .gitignore, should be in

833c4b1

global ignore list

- Fix RPZ locking issues on error conditions

b9c9fc0

ralphdolmans merged commit b9c9fc0 into master Jan 30, 2020

ralphdolmans deleted the rpz branch January 30, 2020 15:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Rpz #73

Rpz #73

ralphdolmans commented Sep 9, 2019

spirillen commented Jan 16, 2020

wcawijngaards Jan 28, 2020

wcawijngaards Jan 28, 2020

wcawijngaards Jan 28, 2020

wcawijngaards Jan 28, 2020

ralphdolmans Jan 29, 2020

ralphdolmans Jan 29, 2020

wcawijngaards Jan 28, 2020

ralphdolmans Jan 28, 2020

ralphdolmans Jan 29, 2020 •

edited

Loading

wcawijngaards Jan 29, 2020

ralphdolmans Jan 29, 2020

wcawijngaards left a comment

spirillen commented Jan 30, 2020 •

edited

Loading

ralphdolmans commented Jan 30, 2020

		if((enum rpz_action)s->svr.rpz_action[i] == RPZ_NO_OVERRIDE_ACTION)
		continue;

Rpz #73

Rpz #73

Conversation

ralphdolmans commented Sep 9, 2019

spirillen commented Jan 16, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ralphdolmans Jan 29, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wcawijngaards left a comment

Choose a reason for hiding this comment

spirillen commented Jan 30, 2020 • edited Loading

ralphdolmans commented Jan 30, 2020

ralphdolmans Jan 29, 2020 •

edited

Loading

spirillen commented Jan 30, 2020 •

edited

Loading