4158. [protocol] Support the printing of EDNS COOKIE options.

                        [RT #39928]

diff --git a/CHANGES b/CHANGES
index 795a7c1a5d8c43e5e4ff1cbc220296b278cb55fa..1cfbc162579c6bbf789c6f78552f8e56d105cba5 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4158.  [protocol]      Support the printing of EDNS COOKIE options.
+                       [RT #39928]
+
 4154.  [bug]           A OPT record should be included with the FORMERR
                        response when there is a malformed EDNS option.
                        [RT #39647]

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 7e00b02af9c508a48e5bb4100cedd3bb9c3ba536..d7b67a9d5715165a514fcb34cd0616aa28d27349 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -44,10 +44,10 @@
          assertion failure could be triggered on answers from
          a specially configured server.
        </para>
-        <para>
+       <para>
          This flaw was discovered by Breno Silveira Soares, and is
          disclosed in CVE-2015-4620. [RT #39795]
-        </para>
+       </para>
       </listitem> 
     </itemizedlist>
   </sect2>
@@ -66,6 +66,12 @@
          debugging.
        </para>
       </listitem>
+      <listitem>
+       <para>
+         EDNS COOKIE options content is now displayed as
+         "COOKIE: &lt;hexvalue&gt;".
+       </para>
+      </listitem>
     </itemizedlist>
   </sect2>
   <sect2 id="relnotes_changes">
@@ -99,7 +105,7 @@
          Asynchronous zone loads were not handled correctly when the
          zone load was already in progress; this could trigger a crash
          in zt.c. [RT #37573]
-       </para>
+       </para>
        </listitem>
       <listitem>
        <para>
@@ -120,7 +126,7 @@
     <para>
       The BIND 9.9 (Extended Support Version) will be supported until June, 2017.
       <ulink url="https://www.isc.org/downloads/software-support-policy/"
-        >https://www.isc.org/downloads/software-support-policy/</ulink>
+       >https://www.isc.org/downloads/software-support-policy/</ulink>
     </para>
   </sect2>
   <sect2 id="relnotes_thanks">

diff --git a/lib/dns/include/dns/message.h b/lib/dns/include/dns/message.h
index 95383600500145f7971d7378f05493c7cc25f9e2..76f78bfdfb80dd360ef003d5be9feca38b880bb6 100644 (file)
--- a/lib/dns/include/dns/message.h
+++ b/lib/dns/include/dns/message.h
@@ -107,9 +107,10 @@
 #define DNS_OPT_NSID           0x0003          /*%< NSID opt code */
 #define DNS_OPT_CLIENT_SUBNET  0x0008          /*%< client subnet opt code */
 #define DNS_OPT_EXPIRE         0x0009          /*%< EXPIRE opt code */
+#define DNS_OPT_COOKIE         0x000a          /*%< COOKIE opt code */
 
 /*%< The number of EDNS options we know about. */
-#define DNS_EDNSOPTIONS        3
+#define DNS_EDNSOPTIONS        4
 
 #define DNS_MESSAGE_REPLYPRESERVE      (DNS_MESSAGEFLAG_RD|DNS_MESSAGEFLAG_CD)
 #define DNS_MESSAGEEXTFLAG_REPLYPRESERVE (DNS_MESSAGEEXTFLAG_DO)

diff --git a/lib/dns/message.c b/lib/dns/message.c
index 44682e2f71b8f09a7b96883eb8723262b417a050..4685ba345a9f4e0c504465c897e4cec4bea54b4f 100644 (file)
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -42,6 +42,7 @@
 #include <dns/rdatastruct.h>
 #include <dns/result.h>
 #include <dns/tsig.h>
+#include <dns/ttl.h>
 #include <dns/view.h>
 
 #ifdef SKAN_MSG_DEBUG
@@ -3279,6 +3280,21 @@ dns_message_pseudosectiontotext(dns_message_t *msg,
 
                        if (optcode == DNS_OPT_NSID) {
                                ADD_STRING(target, "; NSID");
+                       } else if (optcode == DNS_OPT_COOKIE) {
+                               ADD_STRING(target, "; COOKIE");
+                       } else if (optcode == DNS_OPT_EXPIRE) {
+                               if (optlen == 4) {
+                                       isc_uint32_t secs;
+                                       secs = isc_buffer_getuint32(&optbuf);
+                                       ADD_STRING(target, "; EXPIRE: ");
+                                       snprintf(buf, sizeof(buf), "%u", secs);
+                                       ADD_STRING(target, buf);
+                                       ADD_STRING(target, " (");
+                                       dns_ttl_totext(secs, ISC_TRUE, target);
+                                       ADD_STRING(target, ")\n");
+                                       continue;
+                               }
+                               ADD_STRING(target, "; EXPIRE");
                        } else {
                                ADD_STRING(target, "; OPT=");
                                snprintf(buf, sizeof(buf), "%u", optcode);
@@ -3291,23 +3307,43 @@ dns_message_pseudosectiontotext(dns_message_t *msg,
 
                                optdata = isc_buffer_current(&optbuf);
                                for (i = 0; i < optlen; i++) {
-                                       sprintf(buf, "%02x ", optdata[i]);
+                                       const char *sep;
+                                       switch (optcode) {
+                                       case DNS_OPT_COOKIE:
+                                               sep = "";
+                                               break;
+                                       default:
+                                               sep = " ";
+                                               break;
+                                       }
+                                       snprintf(buf, sizeof(buf), "%02x%s",
+                                                optdata[i], sep);
                                        ADD_STRING(target, buf);
                                }
 
+                               isc_buffer_forward(&optbuf, optlen);
+
+                               if (optcode == DNS_OPT_COOKIE) {
+                                       ADD_STRING(target, "\n");
+                                       continue;
+                               }
+
+                               /*
+                                * For non-COOKIE options, add a printable
+                                * version
+                                */
+                               ADD_STRING(target, "(\"");
+                               if (isc_buffer_availablelength(target) < optlen)
+                                       return (ISC_R_NOSPACE);
                                for (i = 0; i < optlen; i++) {
-                                       ADD_STRING(target, " (");
-                                       if (!isc_buffer_availablelength(target))
-                                               return (ISC_R_NOSPACE);
                                        if (isprint(optdata[i]))
                                                isc_buffer_putmem(target,
                                                                  &optdata[i],
                                                                  1);
                                        else
                                                isc_buffer_putstr(target, ".");
-                                       ADD_STRING(target, ")");
                                }
-                               isc_buffer_forward(&optbuf, optlen);
+                               ADD_STRING(target, "\")");
                        }
                        ADD_STRING(target, "\n");
                }

diff --git a/lib/dns/rdata/generic/opt_41.c b/lib/dns/rdata/generic/opt_41.c
index cc391c32e2a415d3fb60b8516b5264415890822f..853bfbb39aa13f22144c170c4eca8117ad21aaca 100644 (file)
--- a/lib/dns/rdata/generic/opt_41.c
+++ b/lib/dns/rdata/generic/opt_41.c
@@ -144,6 +144,8 @@ fromwire_opt(ARGS_FROMWIRE) {
                                if (addrlen > 128U || scope > 128U)
                                        return (DNS_R_OPTERR);
                                break;
+                       default:
+                               return (DNS_R_OPTERR);
                        }
                        addrbytes = (addrlen + 7) / 8;
                        if (addrbytes + 4 != length)
@@ -166,6 +168,11 @@ fromwire_opt(ARGS_FROMWIRE) {
                                return (DNS_R_OPTERR);
                        isc_region_consume(&sregion, length);
                        break;
+               case DNS_OPT_COOKIE:
+                       if (length != 8 && (length < 16 || length > 40))
+                               return (DNS_R_OPTERR);
+                       isc_region_consume(&sregion, length);
+                       break;
                default:
                        isc_region_consume(&sregion, length);
                        break;