resolv/tst-resolv-network.c

   1 /* Test getnetbyname and getnetbyaddr.
   2    Copyright (C) 2016-2017 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, see
  17    <http://www.gnu.org/licenses/>.  */
  18
  19 #include <netdb.h>
  20 #include <stdlib.h>
  21 #include <string.h>
  22 #include <support/check.h>
  23 #include <support/check_nss.h>
  24 #include <support/resolv_test.h>
  25 #include <support/support.h>
  26 #include <support/xmemstream.h>
  27
  28 static void
  29 send_ptr (struct resolv_response_builder *b,
  30           const char *qname, uint16_t qclass, uint16_t qtype,
  31           const char *alias)
  32 {
  33   resolv_response_init (b, (struct resolv_response_flags) {});
  34   resolv_response_add_question (b, qname, qclass, qtype);
  35   resolv_response_section (b, ns_s_an);
  36   resolv_response_open_record (b, qname, qclass, T_PTR, 0);
  37   resolv_response_add_name (b, alias);
  38   resolv_response_close_record (b);
  39 }
  40
  41 static void
  42 handle_code (const struct resolv_response_context *ctx,
  43              struct resolv_response_builder *b,
  44              const char *qname, uint16_t qclass, uint16_t qtype,
  45              int code)
  46 {
  47   switch (code)
  48     {
  49     case 1:
  50       send_ptr (b, qname, qclass, qtype, "1.in-addr.arpa");
  51       break;
  52     case 2:
  53       send_ptr (b, qname, qclass, qtype, "2.1.in-addr.arpa");
  54       break;
  55     case 3:
  56       send_ptr (b, qname, qclass, qtype, "3.2.1.in-addr.arpa");
  57       break;
  58     case 4:
  59       send_ptr (b, qname, qclass, qtype, "4.3.2.1.in-addr.arpa");
  60       break;
  61     case 5:
  62       /* Test multiple PTR records.  */
  63       resolv_response_init (b, (struct resolv_response_flags) {});
  64       resolv_response_add_question (b, qname, qclass, qtype);
  65       resolv_response_section (b, ns_s_an);
  66       resolv_response_open_record (b, qname, qclass, T_PTR, 0);
  67       resolv_response_add_name (b, "127.in-addr.arpa");
  68       resolv_response_close_record (b);
  69       resolv_response_open_record (b, qname, qclass, T_PTR, 0);
  70       resolv_response_add_name (b, "0.in-addr.arpa");
  71       resolv_response_close_record (b);
  72       break;
  73     case 6:
  74       /* Test skipping of RRSIG record.  */
  75       resolv_response_init (b, (struct resolv_response_flags) { });
  76       resolv_response_add_question (b, qname, qclass, qtype);
  77       resolv_response_section (b, ns_s_an);
  78
  79       resolv_response_open_record (b, qname, qclass, T_PTR, 0);
  80       resolv_response_add_name (b, "127.in-addr.arpa");
  81       resolv_response_close_record (b);
  82
  83       resolv_response_open_record (b, qname, qclass, 46 /* RRSIG */, 0);
  84       {
  85         char buf[500];
  86         memset (buf, 0x3f, sizeof (buf));
  87         resolv_response_add_data (b, buf, sizeof (buf));
  88       }
  89       resolv_response_close_record (b);
  90
  91       resolv_response_open_record (b, qname, qclass, T_PTR, 0);
  92       resolv_response_add_name (b, "0.in-addr.arpa");
  93       resolv_response_close_record (b);
  94       break;
  95     case 7:
  96       /* Test CNAME handling.  */
  97       resolv_response_init (b, (struct resolv_response_flags) { });
  98       resolv_response_add_question (b, qname, qclass, qtype);
  99       resolv_response_section (b, ns_s_an);
 100       resolv_response_open_record (b, qname, qclass, T_CNAME, 0);
 101       resolv_response_add_name (b, "cname.example");
 102       resolv_response_close_record (b);
 103       resolv_response_open_record (b, "cname.example", qclass, T_PTR, 0);
 104       resolv_response_add_name (b, "4.3.2.1.in-addr.arpa");
 105       resolv_response_close_record (b);
 106       break;
 107
 108     case 100:
 109       resolv_response_init (b, (struct resolv_response_flags) { .rcode = 0, });
 110       resolv_response_add_question (b, qname, qclass, qtype);
 111       break;
 112     case 101:
 113       resolv_response_init (b, (struct resolv_response_flags)
 114                             { .rcode = NXDOMAIN, });
 115       resolv_response_add_question (b, qname, qclass, qtype);
 116       break;
 117     case 102:
 118       resolv_response_init (b, (struct resolv_response_flags) {.rcode = SERVFAIL});
 119       resolv_response_add_question (b, qname, qclass, qtype);
 120       break;
 121     case 103:
 122       /* Check response length matching.  */
 123       if (!ctx->tcp)
 124         {
 125           resolv_response_init (b, (struct resolv_response_flags) {.tc = true});
 126           resolv_response_add_question (b, qname, qclass, qtype);
 127         }
 128       else
 129         {
 130           resolv_response_init (b, (struct resolv_response_flags) {.ancount = 1});
 131           resolv_response_add_question (b, qname, qclass, qtype);
 132           resolv_response_section (b, ns_s_an);
 133           resolv_response_open_record (b, qname, qclass, T_PTR, 0);
 134           resolv_response_add_name (b, "127.in-addr.arpa");
 135           resolv_response_close_record (b);
 136           resolv_response_open_record (b, qname, qclass, T_PTR, 0);
 137           resolv_response_add_name (b, "example");
 138           resolv_response_close_record (b);
 139
 140           resolv_response_open_record (b, qname, qclass, T_PTR, 0);
 141           size_t to_fill = 65535 - resolv_response_length (b)
 142             - 2 /* length, "n" */ - 2 /* compression reference */
 143             - 2 /* RR type */;
 144           for (size_t i = 0; i < to_fill; ++i)
 145             resolv_response_add_data (b, "", 1);
 146           resolv_response_close_record (b);
 147           resolv_response_add_name (b, "n.example");
 148           uint16_t rrtype = htons (T_PTR);
 149           resolv_response_add_data (b, &rrtype, sizeof (rrtype));
 150         }
 151       break;
 152     default:
 153       FAIL_EXIT1 ("invalid QNAME: %s (code %d)", qname, code);
 154     }
 155 }
 156
 157 static void
 158 response (const struct resolv_response_context *ctx,
 159           struct resolv_response_builder *b,
 160           const char *qname, uint16_t qclass, uint16_t qtype)
 161 {
 162   int code;
 163   if (strstr (qname, "in-addr.arpa") == NULL)
 164     {
 165       char *tail;
 166       if (sscanf (qname, "code%d.%ms", &code, &tail) != 2
 167           || strcmp (tail, "example") != 0)
 168         FAIL_EXIT1 ("invalid QNAME: %s", qname);
 169       free (tail);
 170       handle_code (ctx, b, qname, qclass, qtype, code);
 171     }
 172   else
 173     {
 174       /* Reverse lookup.  */
 175       int components[4];
 176       char *tail;
 177       if (sscanf (qname, "%d.%d.%d.%d.%ms",
 178                   components, components + 1, components + 2, components + 3,
 179                   &tail) != 5
 180           || strcmp (tail, "in-addr.arpa") != 0)
 181         FAIL_EXIT1 ("invalid QNAME: %s", qname);
 182       free (tail);
 183       handle_code (ctx, b, qname, qclass, qtype, components[3]);
 184     }
 185 }
 186
 187 static void
 188 check_reverse (int code, const char *expected)
 189 {
 190   char *query = xasprintf ("code=%d", code);
 191   check_netent (query, getnetbyaddr (code, AF_INET), expected);
 192   free (query);
 193 }
 194
 195 /* Test for CVE-2016-3075.  */
 196 static void
 197 check_long_name (void)
 198 {
 199   struct xmemstream mem;
 200   xopen_memstream (&mem);
 201
 202   char label[65];
 203   memset (label, 'x', 63);
 204   label[63] = '.';
 205   label[64] = '\0';
 206   for (unsigned i = 0; i < 64 * 1024 * 1024 / strlen (label); ++i)
 207     fprintf (mem.out, "%s", label);
 208
 209   xfclose_memstream (&mem);
 210
 211   check_netent ("long name", getnetbyname (mem.buffer),
 212                 "error: NO_RECOVERY\n");
 213
 214   free (mem.buffer);
 215 }
 216
 217 static int
 218 do_test (void)
 219 {
 220   struct resolv_test *obj = resolv_test_start
 221     ((struct resolv_redirect_config)
 222      {
 223        .response_callback = response
 224      });
 225
 226   /* Lookup by name, success cases.  */
 227   check_netent ("code1.example", getnetbyname ("code1.example"),
 228                 "alias: 1.in-addr.arpa\n"
 229                 "net: 0x00000001\n");
 230   check_netent ("code2.example", getnetbyname ("code2.example"),
 231                 "alias: 2.1.in-addr.arpa\n"
 232                 "net: 0x00000102\n");
 233   check_netent ("code3.example", getnetbyname ("code3.example"),
 234                 "alias: 3.2.1.in-addr.arpa\n"
 235                 "net: 0x00010203\n");
 236   check_netent ("code4.example", getnetbyname ("code4.example"),
 237                 "alias: 4.3.2.1.in-addr.arpa\n"
 238                 "net: 0x01020304\n");
 239   check_netent ("code5.example", getnetbyname ("code5.example"),
 240                 "alias: 127.in-addr.arpa\n"
 241                 "alias: 0.in-addr.arpa\n"
 242                 "net: 0x0000007f\n");
 243   check_netent ("code6.example", getnetbyname ("code6.example"),
 244                 "alias: 127.in-addr.arpa\n"
 245                 "alias: 0.in-addr.arpa\n"
 246                 "net: 0x0000007f\n");
 247   check_netent ("code7.example", getnetbyname ("code7.example"),
 248                 "alias: 4.3.2.1.in-addr.arpa\n"
 249                 "net: 0x01020304\n");
 250
 251   /* Lookup by name, failure cases.  */
 252   check_netent ("code100.example", getnetbyname ("code100.example"),
 253                 "error: NO_ADDRESS\n");
 254   check_netent ("code101.example", getnetbyname ("code101.example"),
 255                 "error: HOST_NOT_FOUND\n");
 256   check_netent ("code102.example", getnetbyname ("code102.example"),
 257                 "error: TRY_AGAIN\n");
 258   check_netent ("code103.example", getnetbyname ("code103.example"),
 259                 "error: NO_RECOVERY\n");
 260
 261   /* Lookup by address, success cases.  */
 262   check_reverse (1,
 263                  "name: 1.in-addr.arpa\n"
 264                  "net: 0x00000001\n");
 265   check_reverse (2,
 266                  "name: 2.1.in-addr.arpa\n"
 267                  "net: 0x00000002\n");
 268   check_reverse (3,
 269                  "name: 3.2.1.in-addr.arpa\n"
 270                  "net: 0x00000003\n");
 271   check_reverse (4,
 272                  "name: 4.3.2.1.in-addr.arpa\n"
 273                  "net: 0x00000004\n");
 274   check_reverse (5,
 275                  "name: 127.in-addr.arpa\n"
 276                  "alias: 0.in-addr.arpa\n"
 277                  "net: 0x00000005\n");
 278   check_reverse (6,
 279                  "name: 127.in-addr.arpa\n"
 280                  "alias: 0.in-addr.arpa\n"
 281                  "net: 0x00000006\n");
 282   check_reverse (7,
 283                  "name: 4.3.2.1.in-addr.arpa\n"
 284                  "net: 0x00000007\n");
 285
 286   /* Lookup by address, failure cases.  */
 287   check_reverse (100,
 288                  "error: NO_ADDRESS\n");
 289   check_reverse (101,
 290                  "error: HOST_NOT_FOUND\n");
 291   check_reverse (102,
 292                  "error: TRY_AGAIN\n");
 293   check_reverse (103,
 294                  "error: NO_RECOVERY\n");
 295
 296   check_long_name ();
 297
 298   resolv_test_end (obj);
 299
 300   return 0;
 301 }
 302
 303 #include <support/test-driver.c>