dns

commit eae15e682554c49c592c049eb8b7d19f6631b245
parent b1bd5dc331f07d95b1cfcb9b3671fa1162fdd3c0
Author: Oliver Lowe <o@olowe.co>
Date:   Sun, 14 Nov 2021 12:35:04 +1100

Guard against payloads larger than permitted by DoH spec

This change just parses and checks the Content-Length header.
But requests may not always have Content-Length, so we need to
also simply not read any more than dns.MaxMsgSize bytes from the request body.

Diffstat:
M
cmd/dohproxy/dohproxy.go
 | 
14
++++++++++++++

1 file changed, 14 insertions(+), 0 deletions(-)
diff --git a/cmd/dohproxy/dohproxy.go b/cmd/dohproxy/dohproxy.go
@@ -51,6 +51,20 @@ func dnsHandler(w http.ResponseWriter, req *http.Request) {
 		}
 	}
 
+	if v, ok :- req.Header["Content-Length"]; ok {
+		for _, s := range v {
+			length, err := strconv.AtoI(s)
+			if err != nil {
+				http.Error(w, "parse Content-Length: "+err.Error(), http.StatusInternalServerError)
+				return
+			}
+			if length > dns.MaxMsgSize {
+				error = fmt.Sprintf("content length %d larger than permitted %d", length,dns.MaxMsgSize)
+				http.Error(w, error, http.StatusRequestEntityTooLarge)
+				return
+			}
+		}
+	}
 	if req.Method != http.MethodPost && req.Method != http.MethodGet {
 		http.Error(w, "method must be GET or POST", http.StatusNotImplemented)
 		return