Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[regression] CNAME with _ is parsed as invalid response #424

Closed
AdamMajer opened this issue Sep 8, 2021 · 3 comments
Closed

[regression] CNAME with _ is parsed as invalid response #424

AdamMajer opened this issue Sep 8, 2021 · 3 comments

Comments

@AdamMajer
Copy link
Contributor

With a CNAME setup test -> _test, ares_parse_a_reply is rejecting the response as invalid. The problem seems to be with PR: #406 where the assumption is made that hostname restrictions apply to domain names. With domain names like

_ldap._tcp.<server>

this assumption seems to be invalid.

This is already reported in Node
nodejs/node#39780
@AdamMajer
Copy link
Contributor Author

https://datatracker.ietf.org/doc/html/rfc2181#section-11

@bradh352
Copy link
Member

bradh352 commented Sep 8, 2021 •
edited

rfc2181 section 11 says not to do any validation, but that applies to servers not clients according to the spec.

We had a security report that PR #406 addressed, so we must balance full compliance with security, and in today's world, security MUST win.

I will agree however, that this needs to be loosened to include _ since SRV records explicitly use this an CNAMEs could reference them. The security researcher that originally reported the issue has said that _ should be acceptable as it doesn't have any malicious use-case.

@AdamMajer
Copy link
Contributor Author

Thank you for the quick fix and clarification. This poorly defined area of what constitutes a valid or invalid entry in a DNS record is like a minefield.

@rb-cohen rb-cohen mentioned this issue Mar 2, 2022
Closed
sergepetrenko pushed a commit to tarantool/c-ares that referenced this issue Jul 29, 2022
@bradh352 @sergepetrenko
ares_expand_name should allow underscores (_) as SRV records legitima…
e228960 
…tely use them

c-ares 1.17.2 introduced response validation to prevent a security issue, however
it did not have (_) listed as a valid character for domain name responses which
caused issues when a CNAME referenced a SRV record which contained underscores.

While RFC2181 section 11 does explicitly state not to do validation, that applies
to servers not clients.

Fixes: c-ares#424
Fix By: Brad House (@bradh352)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@AdamMajer @bradh352