]> git.ipfire.org Git - thirdparty/pdns.git/commit
dnsdist: Fix a crash when X-Forwarded-For overrides the initial source IP
authorRemi Gacogne <remi.gacogne@powerdns.com>
Mon, 3 Jul 2023 12:06:05 +0000 (14:06 +0200)
committerRemi Gacogne <remi.gacogne@powerdns.com>
Mon, 3 Jul 2023 12:06:05 +0000 (14:06 +0200)
commit9b703b51ca25838eeec19449a1c49cb926aef52a
treefb02b16ad437351ec0f2c857969be4f5e809d13d
parent9b37dfa9caf3d26e50bc478f2a3e3c9a43284451
dnsdist: Fix a crash when X-Forwarded-For overrides the initial source IP

When both the processing of X-Forwarded-For DNS-over-https headers
(`trustForwardedForHeader=true`) and a maximum number of concurrent
TCP connections per client (`setMaxTCPConnectionsPerClient()`) are
enabled, dnsdist could crash because of an uncaught exception:
```
dnsdist[X]: terminate called after throwing an instance of 'std::runtime_error'
dnsdist[X]:   what():  DOH thread failed to launch: map::at
```
This was caused by the TCP connection being first accounted for with the
initial source IP (from the upstream HTTP proxy) but later released using
the IP extracted from the X-Forwarded-For header, leading to an unexpected
failure to locate the corresponding entry in the map.

We might not actually want to enforce the maximum number of concurrent
TCP connections per client when X-Forwarded-For processing is enabled,
though, because we usually want to rate limit the actual client and
not the HTTP proxy, but X-Forwarded-For being set per HTTP query, instead
of per-connection, makes that pretty much impossible at our level since
the same connection from the HTTP proxy can be reused for several clients.
The proxy protocol would be a better option to enforce that limit.
pdns/dnsdistdist/doh.cc
regression-tests.dnsdist/test_DOH.py