Fix a crash on unexpected incoming DNS message during XoT xfer

This commit fixes a peculiar corner case in the client-side DoT code
because of which a crash could occur during a zone transfer. A junk
DNS message should be sent at the end of a zone transfer via TLS to
trigger the crash (abort).

This commit, hopefully, fixes that.

Also, this commit adds similar changes to the TCP DNS code, as it
shares the same origin and most of the logic.

diff --git a/lib/isc/netmgr/tcpdns.c b/lib/isc/netmgr/tcpdns.c
index fb8308d6db4ec9a9cccd83b5ecf25f74c727b44e..5fed46018f1f8d37287af72d98a84c36e1ba3698 100644 (file)
--- a/lib/isc/netmgr/tcpdns.c
+++ b/lib/isc/netmgr/tcpdns.c
@@ -774,6 +774,23 @@ isc__nm_tcpdns_processbuffer(isc_nmsocket_t *sock) {
                return (ISC_R_NOMORE);
        }
 
+       if (sock->recv_cb == NULL) {
+               /*
+                * recv_cb has been cleared - there is
+                * nothing to do
+                */
+               return (ISC_R_CANCELED);
+       } else if (sock->statichandle == NULL &&
+                  atomic_load(&sock->connected) &&
+                  !atomic_load(&sock->connecting))
+       {
+               /*
+                * It seems that some unexpected data (a DNS message) has
+                * arrived while we are wrapping up.
+                */
+               return (ISC_R_CANCELED);
+       }
+
        req = isc__nm_get_read_req(sock, NULL);
        REQUIRE(VALID_UVREQ(req));
 

diff --git a/lib/isc/netmgr/tlsdns.c b/lib/isc/netmgr/tlsdns.c
index 27895aa716470213e5edda1e7f0f8798fa4126ed..700874d28e9e9d45cebf6e5ae01b255190351389 100644 (file)
--- a/lib/isc/netmgr/tlsdns.c
+++ b/lib/isc/netmgr/tlsdns.c
@@ -937,8 +937,20 @@ isc__nm_tlsdns_processbuffer(isc_nmsocket_t *sock) {
        }
 
        if (sock->recv_cb == NULL) {
-               /* recv_cb has been cleared - there is
-                * nothing to do */
+               /*
+                * recv_cb has been cleared - there is
+                * nothing to do
+                */
+               return (ISC_R_CANCELED);
+       } else if (sock->statichandle == NULL &&
+                  sock->tls.state == TLS_STATE_IO &&
+                  atomic_load(&sock->connected) &&
+                  !atomic_load(&sock->connecting))
+       {
+               /*
+                * It seems that some unexpected data (a DNS message) has
+                * arrived while we are wrapping up.
+                */
                return (ISC_R_CANCELED);
        }