policy.TLS_FORWARD: refusal when configuring with multiple IPs

Fixes https://gitlab.labs.nic.cz/knot/knot-resolver/issues/306

diff --git a/NEWS b/NEWS
index 90056c18a09cdd81dc475f163e99ef84d99f528b..9549b7aa43fbc44f97805124e2a4eb3c49699292 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,11 @@
+Knot Resolver 2.X.Y (2018-0M-DD)
+================================
 
+Bugfixes
+--------
 - detect_time_jump module: don't clear cache on suspend-resume (#284)
 - stats module: fix stats.list() returning nothing, regressed in 2.0.0
+- policy.TLS_FORWARD: refusal when configuring with multiple IPs (#306)
 
 
 Knot Resolver 2.0.0 (2018-01-31)

diff --git a/daemon/lua/kres-gen.lua b/daemon/lua/kres-gen.lua
index 8fdd010aca79f7471dd83f81d9ce42a8f20a8b85..11d176dec41388cda7b2a6f3b852442ad141cb12 100644 (file)
--- a/daemon/lua/kres-gen.lua
+++ b/daemon/lua/kres-gen.lua
@@ -276,6 +276,7 @@ int kr_pkt_clear_payload(knot_pkt_t *);
 const char *kr_inaddr(const struct sockaddr *);
 int kr_inaddr_family(const struct sockaddr *);
 int kr_inaddr_len(const struct sockaddr *);
+int kr_sockaddr_len(const struct sockaddr *);
 uint16_t kr_inaddr_port(const struct sockaddr *);
 int kr_straddr_family(const char *);
 int kr_straddr_subnet(void *, const char *);

diff --git a/daemon/lua/kres-gen.sh b/daemon/lua/kres-gen.sh
index 59fafce76e9b736ae1177f5fcf42408370026816..caf4383cda83e058bbccbdf13fd59b4476a40d0f 100755 (executable)
--- a/daemon/lua/kres-gen.sh
+++ b/daemon/lua/kres-gen.sh
@@ -143,6 +143,7 @@ EOF
        kr_inaddr
        kr_inaddr_family
        kr_inaddr_len
+       kr_sockaddr_len
        kr_inaddr_port
        kr_straddr_family
        kr_straddr_subnet

diff --git a/lib/utils.c b/lib/utils.c
index 6b1c2eac5743aa35c1265f2a917e2827a99f3866..9438fd474a8157ef2fa91d8aaca6fcd1825c0155 100644 (file)
--- a/lib/utils.c
+++ b/lib/utils.c
@@ -337,6 +337,18 @@ int kr_inaddr_len(const struct sockaddr *addr)
        return kr_family_len(addr->sa_family);
 }
 
+int kr_sockaddr_len(const struct sockaddr *addr)
+{
+       if (!addr) {
+               return kr_error(EINVAL);
+       }
+       switch (addr->sa_family) {
+       case AF_INET:  return sizeof(struct sockaddr_in);
+       case AF_INET6: return sizeof(struct sockaddr_in6);
+       default:       return kr_error(EINVAL);
+       }
+}
+
 uint16_t kr_inaddr_port(const struct sockaddr *addr)
 {
        if (!addr) {
@@ -972,4 +984,4 @@ finish:
        *d = 0; /* the final zero */
        ++d;
        return d - dst;
-}
\ No newline at end of file
+}

diff --git a/lib/utils.h b/lib/utils.h
index 8d210728a3d7c3bdc9f2f4d1f7ce62b6b25fb123..dba71d6646056f9e29f61ee885acc8ccbe35a3f2 100644 (file)
--- a/lib/utils.h
+++ b/lib/utils.h
@@ -216,9 +216,12 @@ const char *kr_inaddr(const struct sockaddr *addr);
 /** Address family. */
 KR_EXPORT KR_PURE
 int kr_inaddr_family(const struct sockaddr *addr);
-/** Address length for given family. */
+/** Address length for given family, i.e. sizeof(struct in*_addr). */
 KR_EXPORT KR_PURE
 int kr_inaddr_len(const struct sockaddr *addr);
+/** Sockaddr length for given family, i.e. sizeof(struct sockaddr_in*). */
+KR_EXPORT KR_PURE
+int kr_sockaddr_len(const struct sockaddr *addr);
 /** Port. */
 KR_EXPORT KR_PURE
 uint16_t kr_inaddr_port(const struct sockaddr *addr);

diff --git a/modules/policy/policy.lua b/modules/policy/policy.lua
index 21209b88af8ebd3003bf1c9a2425fc7f3fbf40c9..954b53347179c41098f7511ef54d84a864a400dc 100644 (file)
--- a/modules/policy/policy.lua
+++ b/modules/policy/policy.lua
@@ -209,7 +209,7 @@ function policy.TLS_FORWARD(target)
                local auth_type = tls_forward_target_authtype(idx, upstream_list_entry)
                local string_addr = upstream_list_entry[1]
                local sockaddr_c = addr2sock(string_addr, 853)
-               local sockaddr_lua = ffi.string(sockaddr_c, ffi.C.kr_inaddr_len(sockaddr_c))
+               local sockaddr_lua = ffi.string(sockaddr_c, ffi.C.kr_sockaddr_len(sockaddr_c))
                if sockaddr_config[sockaddr_lua] then
                        error('TLS_FORWARD configuration cannot declare two configs for IP address ' .. string_addr)
                end