1 /*	$NetBSD: ns_name.c,v 1.9 2012/03/13 21:13:39 christos Exp $	*/
2 
3 /*
4  * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
5  * Copyright (c) 1996,1999 by Internet Software Consortium.
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
17  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 #include <sys/cdefs.h>
21 #ifndef lint
22 #ifdef notdef
23 static const char rcsid[] = "Id: ns_name.c,v 1.11 2009/01/23 19:59:16 each Exp";
24 #else
25 __RCSID("$NetBSD: ns_name.c,v 1.9 2012/03/13 21:13:39 christos Exp $");
26 #endif
27 #endif
28 
29 #include <sys/types.h>
30 
31 #include <netinet/in.h>
32 #include <arpa/nameser.h>
33 
34 #include <assert.h>
35 #include <errno.h>
36 #ifdef ANDROID_CHANGES
37 #include "resolv_private.h"
38 #else
39 #include <resolv.h>
40 #endif
41 #include <string.h>
42 #include <ctype.h>
43 #include <stdlib.h>
44 #include <limits.h>
45 
46 #define NS_TYPE_ELT			0x40 /* EDNS0 extended label type */
47 #define DNS_LABELTYPE_BITSTRING		0x41
48 
49 /* Data. */
50 
51 static const char	digits[] = "0123456789";
52 
53 static const char digitvalue[256] = {
54 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,	/*16*/
55 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*32*/
56 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*48*/
57 	 0,  1,  2,  3,  4,  5,  6,  7,  8,  9, -1, -1, -1, -1, -1, -1, /*64*/
58 	-1, 10, 11, 12, 13, 14, 15, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*80*/
59 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*96*/
60 	-1, 10, 11, 12, 13, 14, 15, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*112*/
61 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*128*/
62 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
63 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
64 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
65 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
66 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
67 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
68 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
69 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, /*256*/
70 };
71 
72 /* Forward. */
73 
74 static int		special(int);
75 static int		printable(int);
76 static int		dn_find(const u_char *, const u_char *,
77 				const u_char * const *,
78 				const u_char * const *);
79 static int		encode_bitsring(const char **, const char *,
80 					unsigned char **, unsigned char **,
81 					unsigned const char *);
82 static int		labellen(const u_char *);
83 static int		decode_bitstring(const unsigned char **,
84 					 char *, const char *);
85 
86 /* Public. */
87 
88 /*
89  *	Convert an encoded domain name to printable ascii as per RFC1035.
90  * return:
91  *	Number of bytes written to buffer, or -1 (with errno set)
92  *
93  * notes:
94  *	The root is returned as "."
95  *	All other domains are returned in non absolute form
96  */
97 int
ns_name_ntop(const u_char * src,char * dst,size_t dstsiz)98 ns_name_ntop(const u_char *src, char *dst, size_t dstsiz)
99 {
100 	const u_char *cp;
101 	char *dn, *eom;
102 	u_char c;
103 	u_int n;
104 	int l;
105 
106 	cp = src;
107 	dn = dst;
108 	eom = dst + dstsiz;
109 
110 	while ((n = *cp++) != 0) {
111 		if ((n & NS_CMPRSFLGS) == NS_CMPRSFLGS) {
112 			/* Some kind of compression pointer. */
113 			errno = EMSGSIZE;
114 			return (-1);
115 		}
116 		if (dn != dst) {
117 			if (dn >= eom) {
118 				errno = EMSGSIZE;
119 				return (-1);
120 			}
121 			*dn++ = '.';
122 		}
123 		if ((l = labellen(cp - 1)) < 0) {
124 			errno = EMSGSIZE; /* XXX */
125 			return(-1);
126 		}
127 		if (dn + l >= eom) {
128 			errno = EMSGSIZE;
129 			return (-1);
130 		}
131 		if ((n & NS_CMPRSFLGS) == NS_TYPE_ELT) {
132 			int m;
133 
134 			if (n != DNS_LABELTYPE_BITSTRING) {
135 				/* XXX: labellen should reject this case */
136 				errno = EINVAL;
137 				return(-1);
138 			}
139 			if ((m = decode_bitstring(&cp, dn, eom)) < 0)
140 			{
141 				errno = EMSGSIZE;
142 				return(-1);
143 			}
144 			dn += m;
145 			continue;
146 		}
147 		for (; l > 0; l--) {
148 			c = *cp++;
149 			if (special(c)) {
150 				if (dn + 1 >= eom) {
151 					errno = EMSGSIZE;
152 					return (-1);
153 				}
154 				*dn++ = '\\';
155 				*dn++ = (char)c;
156 			} else if (!printable(c)) {
157 				if (dn + 3 >= eom) {
158 					errno = EMSGSIZE;
159 					return (-1);
160 				}
161 				*dn++ = '\\';
162 				*dn++ = digits[c / 100];
163 				*dn++ = digits[(c % 100) / 10];
164 				*dn++ = digits[c % 10];
165 			} else {
166 				if (dn >= eom) {
167 					errno = EMSGSIZE;
168 					return (-1);
169 				}
170 				*dn++ = (char)c;
171 			}
172 		}
173 	}
174 	if (dn == dst) {
175 		if (dn >= eom) {
176 			errno = EMSGSIZE;
177 			return (-1);
178 		}
179 		*dn++ = '.';
180 	}
181 	if (dn >= eom) {
182 		errno = EMSGSIZE;
183 		return (-1);
184 	}
185 	*dn++ = '\0';
186 	_DIAGASSERT(__type_fit(int, dn - dst));
187 	return (int)(dn - dst);
188 }
189 
190 /*
191  *	Convert a ascii string into an encoded domain name as per RFC1035.
192  *
193  * return:
194  *
195  *	-1 if it fails
196  *	1 if string was fully qualified
197  *	0 is string was not fully qualified
198  *
199  * notes:
200  *	Enforces label and domain length limits.
201  */
202 int
ns_name_pton(const char * src,u_char * dst,size_t dstsiz)203 ns_name_pton(const char *src, u_char *dst, size_t dstsiz) {
204 	return (ns_name_pton2(src, dst, dstsiz, NULL));
205 }
206 
207 /*
208  * ns_name_pton2(src, dst, dstsiz, *dstlen)
209  *	Convert a ascii string into an encoded domain name as per RFC1035.
210  * return:
211  *	-1 if it fails
212  *	1 if string was fully qualified
213  *	0 is string was not fully qualified
214  * side effects:
215  *	fills in *dstlen (if non-NULL)
216  * notes:
217  *	Enforces label and domain length limits.
218  */
219 
220 int
ns_name_pton2(const char * src,u_char * dst,size_t dstsiz,size_t * dstlen)221 ns_name_pton2(const char *src, u_char *dst, size_t dstsiz, size_t *dstlen) {
222 	u_char *label, *bp, *eom;
223 	int c, n, escaped, e = 0;
224 	char *cp;
225 
226 	escaped = 0;
227 	bp = dst;
228 	eom = dst + dstsiz;
229 	label = bp++;
230 
231 	while ((c = *src++) != 0) {
232 		if (escaped) {
233 			if (c == '[') { /* start a bit string label */
234 				if ((cp = strchr(src, ']')) == NULL) {
235 					errno = EINVAL; /* ??? */
236 					return(-1);
237 				}
238 				if ((e = encode_bitsring(&src, cp + 2,
239 							 &label, &bp, eom))
240 				    != 0) {
241 					errno = e;
242 					return(-1);
243 				}
244 				escaped = 0;
245 				label = bp++;
246 				if ((c = *src++) == 0)
247 					goto done;
248 				else if (c != '.') {
249 					errno = EINVAL;
250 					return(-1);
251 				}
252 				continue;
253 			}
254 			else if ((cp = strchr(digits, c)) != NULL) {
255 				n = (int)(cp - digits) * 100;
256 				if ((c = *src++) == 0 ||
257 				    (cp = strchr(digits, c)) == NULL) {
258 					errno = EMSGSIZE;
259 					return (-1);
260 				}
261 				n += (int)(cp - digits) * 10;
262 				if ((c = *src++) == 0 ||
263 				    (cp = strchr(digits, c)) == NULL) {
264 					errno = EMSGSIZE;
265 					return (-1);
266 				}
267 				n += (int)(cp - digits);
268 				if (n > 255) {
269 					errno = EMSGSIZE;
270 					return (-1);
271 				}
272 				c = n;
273 			}
274 			escaped = 0;
275 		} else if (c == '\\') {
276 			escaped = 1;
277 			continue;
278 		} else if (c == '.') {
279 			c = (int)(bp - label - 1);
280 			if ((c & NS_CMPRSFLGS) != 0) {	/* Label too big. */
281 				errno = EMSGSIZE;
282 				return (-1);
283 			}
284 			if (label >= eom) {
285 				errno = EMSGSIZE;
286 				return (-1);
287 			}
288 			*label = c;
289 			/* Fully qualified ? */
290 			if (*src == '\0') {
291 				if (c != 0) {
292 					if (bp >= eom) {
293 						errno = EMSGSIZE;
294 						return (-1);
295 					}
296 					*bp++ = '\0';
297 				}
298 				if ((bp - dst) > MAXCDNAME) {
299 					errno = EMSGSIZE;
300 					return (-1);
301 				}
302 				if (dstlen != NULL)
303 					*dstlen = (bp - dst);
304 				return (1);
305 			}
306 			if (c == 0 || *src == '.') {
307 				errno = EMSGSIZE;
308 				return (-1);
309 			}
310 			label = bp++;
311 			continue;
312 		}
313 		if (bp >= eom) {
314 			errno = EMSGSIZE;
315 			return (-1);
316 		}
317 		*bp++ = (u_char)c;
318 	}
319 	c = (int)(bp - label - 1);
320 	if ((c & NS_CMPRSFLGS) != 0) {		/* Label too big. */
321 		errno = EMSGSIZE;
322 		return (-1);
323 	}
324   done:
325 	if (label >= eom) {
326 		errno = EMSGSIZE;
327 		return (-1);
328 	}
329 	*label = c;
330 	if (c != 0) {
331 		if (bp >= eom) {
332 			errno = EMSGSIZE;
333 			return (-1);
334 		}
335 		*bp++ = 0;
336 	}
337 	if ((bp - dst) > MAXCDNAME) {	/* src too big */
338 		errno = EMSGSIZE;
339 		return (-1);
340 	}
341 	if (dstlen != NULL)
342 		*dstlen = (bp - dst);
343 	return (0);
344 }
345 
346 /*
347  *	Convert a network strings labels into all lowercase.
348  *
349  * return:
350  *	Number of bytes written to buffer, or -1 (with errno set)
351  *
352  * notes:
353  *	Enforces label and domain length limits.
354  */
355 
356 int
ns_name_ntol(const u_char * src,u_char * dst,size_t dstsiz)357 ns_name_ntol(const u_char *src, u_char *dst, size_t dstsiz)
358 {
359 	const u_char *cp;
360 	u_char *dn, *eom;
361 	u_char c;
362 	u_int n;
363 	int l;
364 
365 	cp = src;
366 	dn = dst;
367 	eom = dst + dstsiz;
368 
369 	if (dn >= eom) {
370 		errno = EMSGSIZE;
371 		return (-1);
372 	}
373 	while ((n = *cp++) != 0) {
374 		if ((n & NS_CMPRSFLGS) == NS_CMPRSFLGS) {
375 			/* Some kind of compression pointer. */
376 			errno = EMSGSIZE;
377 			return (-1);
378 		}
379 		*dn++ = n;
380 		if ((l = labellen(cp - 1)) < 0) {
381 			errno = EMSGSIZE;
382 			return (-1);
383 		}
384 		if (dn + l >= eom) {
385 			errno = EMSGSIZE;
386 			return (-1);
387 		}
388 		for (; l > 0; l--) {
389 			c = *cp++;
390 			if (isascii(c) && isupper(c))
391 				*dn++ = tolower(c);
392 			else
393 				*dn++ = c;
394 		}
395 	}
396 	*dn++ = '\0';
397 	_DIAGASSERT(__type_fit(int, dn - dst));
398 	return (int)(dn - dst);
399 }
400 
401 /*
402  *	Unpack a domain name from a message, source may be compressed.
403  *
404  * return:
405  *	-1 if it fails, or consumed octets if it succeeds.
406  */
407 int
ns_name_unpack(const u_char * msg,const u_char * eom,const u_char * src,u_char * dst,size_t dstsiz)408 ns_name_unpack(const u_char *msg, const u_char *eom, const u_char *src,
409 	       u_char *dst, size_t dstsiz)
410 {
411 	return (ns_name_unpack2(msg, eom, src, dst, dstsiz, NULL));
412 }
413 
414 /*
415  * ns_name_unpack2(msg, eom, src, dst, dstsiz, *dstlen)
416  *	Unpack a domain name from a message, source may be compressed.
417  * return:
418  *	-1 if it fails, or consumed octets if it succeeds.
419  * side effect:
420  *	fills in *dstlen (if non-NULL).
421  */
422 int
ns_name_unpack2(const u_char * msg,const u_char * eom,const u_char * src,u_char * dst,size_t dstsiz,size_t * dstlen)423 ns_name_unpack2(const u_char *msg, const u_char *eom, const u_char *src,
424 		u_char *dst, size_t dstsiz, size_t *dstlen)
425 {
426 	const u_char *srcp, *dstlim;
427 	u_char *dstp;
428 	int n, len, checked, l;
429 
430 	len = -1;
431 	checked = 0;
432 	dstp = dst;
433 	srcp = src;
434 	dstlim = dst + dstsiz;
435 	if (srcp < msg || srcp >= eom) {
436 		errno = EMSGSIZE;
437 		return (-1);
438 	}
439 	/* Fetch next label in domain name. */
440 	while ((n = *srcp++) != 0) {
441 		/* Check for indirection. */
442 		switch (n & NS_CMPRSFLGS) {
443 		case 0:
444 		case NS_TYPE_ELT:
445 			/* Limit checks. */
446 			if ((l = labellen(srcp - 1)) < 0) {
447 				errno = EMSGSIZE;
448 				return(-1);
449 			}
450 			if (dstp + l + 1 >= dstlim || srcp + l >= eom) {
451 				errno = EMSGSIZE;
452 				return (-1);
453 			}
454 			checked += l + 1;
455 			*dstp++ = n;
456 			memcpy(dstp, srcp, (size_t)l);
457 			dstp += l;
458 			srcp += l;
459 			break;
460 
461 		case NS_CMPRSFLGS:
462 			if (srcp >= eom) {
463 				errno = EMSGSIZE;
464 				return (-1);
465 			}
466 			if (len < 0) {
467 				_DIAGASSERT(__type_fit(int, srcp - src + 1));
468 				len = (int)(srcp - src + 1);
469 			}
470 			// BEGIN android-changed: safer pointer overflow check
471 			l = (((n & 0x3f) << 8) | (*srcp & 0xff));
472 			if (l >= eom - msg) {  /* Out of range. */
473 				errno = EMSGSIZE;
474 				return (-1);
475 			}
476 			srcp = msg + l;
477 			// END android-changed
478 			checked += 2;
479 			/*
480 			 * Check for loops in the compressed name;
481 			 * if we've looked at the whole message,
482 			 * there must be a loop.
483 			 */
484 			if (checked >= eom - msg) {
485 				errno = EMSGSIZE;
486 				return (-1);
487 			}
488 			break;
489 
490 		default:
491 			errno = EMSGSIZE;
492 			return (-1);			/* flag error */
493 		}
494 	}
495 	*dstp++ = 0;
496 	if (dstlen != NULL)
497 		*dstlen = dstp - dst;
498 	if (len < 0) {
499 		_DIAGASSERT(__type_fit(int, srcp - src));
500 		len = (int)(srcp - src);
501 	}
502 	return len;
503 }
504 
505 /*
506  *	Pack domain name 'domain' into 'comp_dn'.
507  *
508  * return:
509  *	Size of the compressed name, or -1.
510  *
511  * notes:
512  *	'dnptrs' is an array of pointers to previous compressed names.
513  *	dnptrs[0] is a pointer to the beginning of the message. The array
514  *	ends with NULL.
515  *	'lastdnptr' is a pointer to the end of the array pointed to
516  *	by 'dnptrs'.
517  *
518  * Side effects:
519  *	The list of pointers in dnptrs is updated for labels inserted into
520  *	the message as we compress the name.  If 'dnptr' is NULL, we don't
521  *	try to compress names. If 'lastdnptr' is NULL, we don't update the
522  *	list.
523  */
524 int
ns_name_pack(const u_char * src,u_char * dst,int dstsiz,const u_char ** dnptrs,const u_char ** lastdnptr)525 ns_name_pack(const u_char *src, u_char *dst, int dstsiz,
526 	     const u_char **dnptrs, const u_char **lastdnptr)
527 {
528 	u_char *dstp;
529 	const u_char **cpp, **lpp, *eob, *msg;
530 	const u_char *srcp;
531 	int n, l, first = 1;
532 
533 	srcp = src;
534 	dstp = dst;
535 	eob = dstp + dstsiz;
536 	lpp = cpp = NULL;
537 	if (dnptrs != NULL) {
538 		if ((msg = *dnptrs++) != NULL) {
539 			for (cpp = dnptrs; *cpp != NULL; cpp++)
540 				continue;
541 			lpp = cpp;	/* end of list to search */
542 		}
543 	} else
544 		msg = NULL;
545 
546 	/* make sure the domain we are about to add is legal */
547 	l = 0;
548 	do {
549 		int l0;
550 
551 		n = *srcp;
552 		if ((n & NS_CMPRSFLGS) == NS_CMPRSFLGS) {
553 			errno = EMSGSIZE;
554 			return (-1);
555 		}
556 		if ((l0 = labellen(srcp)) < 0) {
557 			errno = EINVAL;
558 			return(-1);
559 		}
560 		l += l0 + 1;
561 		if (l > MAXCDNAME) {
562 			errno = EMSGSIZE;
563 			return (-1);
564 		}
565 		srcp += l0 + 1;
566 	} while (n != 0);
567 
568 	/* from here on we need to reset compression pointer array on error */
569 	srcp = src;
570 	do {
571 		/* Look to see if we can use pointers. */
572 		n = *srcp;
573 		if (n != 0 && msg != NULL) {
574 			l = dn_find(srcp, msg, (const u_char * const *)dnptrs,
575 				    (const u_char * const *)lpp);
576 			if (l >= 0) {
577 				if (dstp + 1 >= eob) {
578 					goto cleanup;
579 				}
580 				*dstp++ = ((u_int32_t)l >> 8) | NS_CMPRSFLGS;
581 				*dstp++ = l % 256;
582 				_DIAGASSERT(__type_fit(int, dstp - dst));
583 				return (int)(dstp - dst);
584 			}
585 			/* Not found, save it. */
586 			if (lastdnptr != NULL && cpp < lastdnptr - 1 &&
587 			    (dstp - msg) < 0x4000 && first) {
588 				*cpp++ = dstp;
589 				*cpp = NULL;
590 				first = 0;
591 			}
592 		}
593 		/* copy label to buffer */
594 		if ((n & NS_CMPRSFLGS) == NS_CMPRSFLGS) {
595 			/* Should not happen. */
596 			goto cleanup;
597 		}
598 		n = labellen(srcp);
599 		if (dstp + 1 + n >= eob) {
600 			goto cleanup;
601 		}
602 		memcpy(dstp, srcp, (size_t)(n + 1));
603 		srcp += n + 1;
604 		dstp += n + 1;
605 	} while (n != 0);
606 
607 	if (dstp > eob) {
608 cleanup:
609 		if (msg != NULL)
610 			*lpp = NULL;
611 		errno = EMSGSIZE;
612 		return (-1);
613 	}
614 	_DIAGASSERT(__type_fit(int, dstp - dst));
615 	return (int)(dstp - dst);
616 }
617 
618 /*
619  *	Expand compressed domain name to presentation format.
620  *
621  * return:
622  *	Number of bytes read out of `src', or -1 (with errno set).
623  *
624  * note:
625  *	Root domain returns as "." not "".
626  */
627 int
ns_name_uncompress(const u_char * msg,const u_char * eom,const u_char * src,char * dst,size_t dstsiz)628 ns_name_uncompress(const u_char *msg, const u_char *eom, const u_char *src,
629 		   char *dst, size_t dstsiz)
630 {
631 	u_char tmp[NS_MAXCDNAME];
632 	int n;
633 
634 	if ((n = ns_name_unpack(msg, eom, src, tmp, sizeof tmp)) == -1)
635 		return (-1);
636 	if (ns_name_ntop(tmp, dst, dstsiz) == -1)
637 		return (-1);
638 	return (n);
639 }
640 
641 /*
642  *	Compress a domain name into wire format, using compression pointers.
643  *
644  * return:
645  *	Number of bytes consumed in `dst' or -1 (with errno set).
646  *
647  * notes:
648  *	'dnptrs' is an array of pointers to previous compressed names.
649  *	dnptrs[0] is a pointer to the beginning of the message.
650  *	The list ends with NULL.  'lastdnptr' is a pointer to the end of the
651  *	array pointed to by 'dnptrs'. Side effect is to update the list of
652  *	pointers for labels inserted into the message as we compress the name.
653  *	If 'dnptr' is NULL, we don't try to compress names. If 'lastdnptr'
654  *	is NULL, we don't update the list.
655  */
656 int
ns_name_compress(const char * src,u_char * dst,size_t dstsiz,const u_char ** dnptrs,const u_char ** lastdnptr)657 ns_name_compress(const char *src, u_char *dst, size_t dstsiz,
658 		 const u_char **dnptrs, const u_char **lastdnptr)
659 {
660 	u_char tmp[NS_MAXCDNAME];
661 
662 	if (ns_name_pton(src, tmp, sizeof tmp) == -1)
663 		return (-1);
664 	return (ns_name_pack(tmp, dst, (int)dstsiz, dnptrs, lastdnptr));
665 }
666 
667 /*
668  * Reset dnptrs so that there are no active references to pointers at or
669  * after src.
670  */
671 void
ns_name_rollback(const u_char * src,const u_char ** dnptrs,const u_char ** lastdnptr)672 ns_name_rollback(const u_char *src, const u_char **dnptrs,
673 		 const u_char **lastdnptr)
674 {
675 	while (dnptrs < lastdnptr && *dnptrs != NULL) {
676 		if (*dnptrs >= src) {
677 			*dnptrs = NULL;
678 			break;
679 		}
680 		dnptrs++;
681 	}
682 }
683 
684 /*
685  *	Advance *ptrptr to skip over the compressed name it points at.
686  *
687  * return:
688  *	0 on success, -1 (with errno set) on failure.
689  */
690 int
ns_name_skip(const u_char ** ptrptr,const u_char * eom)691 ns_name_skip(const u_char **ptrptr, const u_char *eom)
692 {
693 	const u_char *cp;
694 	u_int n;
695 	int l;
696 
697 	cp = *ptrptr;
698 	while (cp < eom && (n = *cp++) != 0) {
699 		/* Check for indirection. */
700 		switch (n & NS_CMPRSFLGS) {
701 		case 0:			/* normal case, n == len */
702 			cp += n;
703 			continue;
704 		case NS_TYPE_ELT: /* EDNS0 extended label */
705 			if ((l = labellen(cp - 1)) < 0) {
706 				errno = EMSGSIZE; /* XXX */
707 				return(-1);
708 			}
709 			cp += l;
710 			continue;
711 		case NS_CMPRSFLGS:	/* indirection */
712 			cp++;
713 			break;
714 		default:		/* illegal type */
715 			errno = EMSGSIZE;
716 			return (-1);
717 		}
718 		break;
719 	}
720 	if (cp > eom) {
721 		errno = EMSGSIZE;
722 		return (-1);
723 	}
724 	*ptrptr = cp;
725 	return (0);
726 }
727 
728 /* Find the number of octets an nname takes up, including the root label.
729  * (This is basically ns_name_skip() without compression-pointer support.)
730  * ((NOTE: can only return zero if passed-in namesiz argument is zero.))
731  */
732 ssize_t
ns_name_length(ns_nname_ct nname,size_t namesiz)733 ns_name_length(ns_nname_ct nname, size_t namesiz) {
734 	ns_nname_ct orig = nname;
735 	u_int n;
736 
737 	while (namesiz-- > 0 && (n = *nname++) != 0) {
738 		if ((n & NS_CMPRSFLGS) != 0) {
739 			errno = EISDIR;
740 			return (-1);
741 		}
742 		if (n > namesiz) {
743 			errno = EMSGSIZE;
744 			return (-1);
745 		}
746 		nname += n;
747 		namesiz -= n;
748 	}
749 	return (nname - orig);
750 }
751 
752 /* Compare two nname's for equality.  Return -1 on error (setting errno).
753  */
754 int
ns_name_eq(ns_nname_ct a,size_t as,ns_nname_ct b,size_t bs)755 ns_name_eq(ns_nname_ct a, size_t as, ns_nname_ct b, size_t bs) {
756 	ns_nname_ct ae = a + as, be = b + bs;
757 	int ac, bc;
758 
759 	while (ac = *a, bc = *b, ac != 0 && bc != 0) {
760 		if ((ac & NS_CMPRSFLGS) != 0 || (bc & NS_CMPRSFLGS) != 0) {
761 			errno = EISDIR;
762 			return (-1);
763 		}
764 		if (a + ac >= ae || b + bc >= be) {
765 			errno = EMSGSIZE;
766 			return (-1);
767 		}
768 		if (ac != bc || strncasecmp((const char *) ++a,
769 					    (const char *) ++b,
770 					    (size_t)ac) != 0)
771 			return (0);
772 		a += ac, b += bc;
773 	}
774 	return (ac == 0 && bc == 0);
775 }
776 
777 /* Is domain "A" owned by (at or below) domain "B"?
778  */
779 int
ns_name_owned(ns_namemap_ct a,int an,ns_namemap_ct b,int bn)780 ns_name_owned(ns_namemap_ct a, int an, ns_namemap_ct b, int bn) {
781 	/* If A is shorter, it cannot be owned by B. */
782 	if (an < bn)
783 		return (0);
784 
785 	/* If they are unequal before the length of the shorter, A cannot... */
786 	while (bn > 0) {
787 		if (a->len != b->len ||
788 		    strncasecmp((const char *) a->base,
789 				(const char *) b->base, (size_t)a->len) != 0)
790 			return (0);
791 		a++, an--;
792 		b++, bn--;
793 	}
794 
795 	/* A might be longer or not, but either way, B owns it. */
796 	return (1);
797 }
798 
799 /* Build an array of <base,len> tuples from an nname, top-down order.
800  * Return the number of tuples (labels) thus discovered.
801  */
802 int
ns_name_map(ns_nname_ct nname,size_t namelen,ns_namemap_t map,int mapsize)803 ns_name_map(ns_nname_ct nname, size_t namelen, ns_namemap_t map, int mapsize) {
804 	u_int n;
805 	int l;
806 
807 	n = *nname++;
808 	namelen--;
809 
810 	/* Root zone? */
811 	if (n == 0) {
812 		/* Extra data follows name? */
813 		if (namelen > 0) {
814 			errno = EMSGSIZE;
815 			return (-1);
816 		}
817 		return (0);
818 	}
819 
820 	/* Compression pointer? */
821 	if ((n & NS_CMPRSFLGS) != 0) {
822 		errno = EISDIR;
823 		return (-1);
824 	}
825 
826 	/* Label too long? */
827 	if (n > namelen) {
828 		errno = EMSGSIZE;
829 		return (-1);
830 	}
831 
832 	/* Recurse to get rest of name done first. */
833 	l = ns_name_map(nname + n, namelen - n, map, mapsize);
834 	if (l < 0)
835 		return (-1);
836 
837 	/* Too many labels? */
838 	if (l >= mapsize) {
839 		errno = ENAMETOOLONG;
840 		return (-1);
841 	}
842 
843 	/* We're on our way back up-stack, store current map data. */
844 	map[l].base = nname;
845 	map[l].len = n;
846 	return (l + 1);
847 }
848 
849 /* Count the labels in a domain name.  Root counts, so COM. has two.  This
850  * is to make the result comparable to the result of ns_name_map().
851  */
852 int
ns_name_labels(ns_nname_ct nname,size_t namesiz)853 ns_name_labels(ns_nname_ct nname, size_t namesiz) {
854 	int ret = 0;
855 	u_int n;
856 
857 	while (namesiz-- > 0 && (n = *nname++) != 0) {
858 		if ((n & NS_CMPRSFLGS) != 0) {
859 			errno = EISDIR;
860 			return (-1);
861 		}
862 		if (n > namesiz) {
863 			errno = EMSGSIZE;
864 			return (-1);
865 		}
866 		nname += n;
867 		namesiz -= n;
868 		ret++;
869 	}
870 	return (ret + 1);
871 }
872 /* Private. */
873 
874 /*
875  *	Thinking in noninternationalized USASCII (per the DNS spec),
876  *	is this characted special ("in need of quoting") ?
877  *
878  * return:
879  *	boolean.
880  */
881 static int
special(int ch)882 special(int ch) {
883 	switch (ch) {
884 	case 0x22: /* '"' */
885 	case 0x2E: /* '.' */
886 	case 0x3B: /* ';' */
887 	case 0x5C: /* '\\' */
888 	case 0x28: /* '(' */
889 	case 0x29: /* ')' */
890 	/* Special modifiers in zone files. */
891 	case 0x40: /* '@' */
892 	case 0x24: /* '$' */
893 		return (1);
894 	default:
895 		return (0);
896 	}
897 }
898 
899 /*
900  *	Thinking in noninternationalized USASCII (per the DNS spec),
901  *	is this character visible and not a space when printed ?
902  *
903  * return:
904  *	boolean.
905  */
906 static int
printable(int ch)907 printable(int ch) {
908 	return (ch > 0x20 && ch < 0x7f);
909 }
910 
911 /*
912  *	Thinking in noninternationalized USASCII (per the DNS spec),
913  *	convert this character to lower case if it's upper case.
914  */
915 static int
mklower(int ch)916 mklower(int ch) {
917 	if (ch >= 0x41 && ch <= 0x5A)
918 		return (ch + 0x20);
919 	return (ch);
920 }
921 
922 /*
923  *	Search for the counted-label name in an array of compressed names.
924  *
925  * return:
926  *	offset from msg if found, or -1.
927  *
928  * notes:
929  *	dnptrs is the pointer to the first name on the list,
930  *	not the pointer to the start of the message.
931  */
932 static int
dn_find(const u_char * domain,const u_char * msg,const u_char * const * dnptrs,const u_char * const * lastdnptr)933 dn_find(const u_char *domain, const u_char *msg,
934 	const u_char * const *dnptrs,
935 	const u_char * const *lastdnptr)
936 {
937 	const u_char *dn, *cp, *sp;
938 	const u_char * const *cpp;
939 	u_int n;
940 
941 	for (cpp = dnptrs; cpp < lastdnptr; cpp++) {
942 		sp = *cpp;
943 		/*
944 		 * terminate search on:
945 		 * root label
946 		 * compression pointer
947 		 * unusable offset
948 		 */
949 		while (*sp != 0 && (*sp & NS_CMPRSFLGS) == 0 &&
950 		       (sp - msg) < 0x4000) {
951 			dn = domain;
952 			cp = sp;
953 			while ((n = *cp++) != 0) {
954 				/*
955 				 * check for indirection
956 				 */
957 				switch (n & NS_CMPRSFLGS) {
958 				case 0:		/* normal case, n == len */
959 					n = labellen(cp - 1); /* XXX */
960 
961 					if (n != *dn++)
962 						goto next;
963 
964 					for (; n > 0; n--)
965 						if (mklower(*dn++) !=
966 						    mklower(*cp++))
967 							goto next;
968 					/* Is next root for both ? */
969 					if (*dn == '\0' && *cp == '\0') {
970 						_DIAGASSERT(__type_fit(int,
971 						    sp - msg));
972 						return (int)(sp - msg);
973 					}
974 					if (*dn)
975 						continue;
976 					goto next;
977 				case NS_CMPRSFLGS:	/* indirection */
978 					cp = msg + (((n & 0x3f) << 8) | *cp);
979 					break;
980 
981 				default:	/* illegal type */
982 					errno = EMSGSIZE;
983 					return (-1);
984 				}
985 			}
986  next: ;
987 			sp += *sp + 1;
988 		}
989 	}
990 	errno = ENOENT;
991 	return (-1);
992 }
993 
994 static int
decode_bitstring(const unsigned char ** cpp,char * dn,const char * eom)995 decode_bitstring(const unsigned char **cpp, char *dn, const char *eom)
996 {
997 	const unsigned char *cp = *cpp;
998 	char *beg = dn, tc;
999 	int b, blen, plen, i;
1000 
1001 	if ((blen = (*cp & 0xff)) == 0)
1002 		blen = 256;
1003 	plen = (blen + 3) / 4;
1004 	plen += (int)sizeof("\\[x/]") + (blen > 99 ? 3 : (blen > 9) ? 2 : 1);
1005 	if (dn + plen >= eom)
1006 		return(-1);
1007 
1008 	cp++;
1009 	i = snprintf(dn, eom - dn, "\\[x");
1010 	if (i < 0)
1011 		return (-1);
1012 	dn += i;
1013 	for (b = blen; b > 7; b -= 8, cp++) {
1014 		i = snprintf(dn, eom - dn, "%02x", *cp & 0xff);
1015 		if (i < 0)
1016 			return (-1);
1017 		dn += i;
1018 	}
1019 	if (b > 4) {
1020 		tc = *cp++;
1021 		i = snprintf(dn, eom - dn, "%02x", tc & (0xff << (8 - b)));
1022 		if (i < 0)
1023 			return (-1);
1024 		dn += i;
1025 	} else if (b > 0) {
1026 		tc = *cp++;
1027 		i = snprintf(dn, eom - dn, "%1x",
1028 			       (((u_int32_t)tc >> 4) & 0x0f) & (0x0f << (4 - b)));
1029 		if (i < 0)
1030 			return (-1);
1031 		dn += i;
1032 	}
1033 	i = snprintf(dn, eom - dn, "/%d]", blen);
1034 	if (i < 0)
1035 		return (-1);
1036 	dn += i;
1037 
1038 	*cpp = cp;
1039 	_DIAGASSERT(__type_fit(int, dn - beg));
1040 	return (int)(dn - beg);
1041 }
1042 
1043 static int
encode_bitsring(const char ** bp,const char * end,unsigned char ** labelp,unsigned char ** dst,unsigned const char * eom)1044 encode_bitsring(const char **bp, const char *end, unsigned char **labelp,
1045 	        unsigned char ** dst, unsigned const char *eom)
1046 {
1047 	int afterslash = 0;
1048 	const char *cp = *bp;
1049 	unsigned char *tp;
1050 	char c;
1051 	const char *beg_blen;
1052 	char *end_blen = NULL;
1053 	int value = 0, count = 0, tbcount = 0, blen = 0;
1054 
1055 	beg_blen = end_blen = NULL;
1056 
1057 	/* a bitstring must contain at least 2 characters */
1058 	if (end - cp < 2)
1059 		return(EINVAL);
1060 
1061 	/* XXX: currently, only hex strings are supported */
1062 	if (*cp++ != 'x')
1063 		return(EINVAL);
1064 	if (!isxdigit((*cp) & 0xff)) /* reject '\[x/BLEN]' */
1065 		return(EINVAL);
1066 
1067 	for (tp = *dst + 1; cp < end && tp < eom; cp++) {
1068 		switch((c = *cp)) {
1069 		case ']':	/* end of the bitstring */
1070 			if (afterslash) {
1071 				if (beg_blen == NULL)
1072 					return(EINVAL);
1073 				blen = (int)strtol(beg_blen, &end_blen, 10);
1074 				if (*end_blen != ']')
1075 					return(EINVAL);
1076 			}
1077 			if (count)
1078 				*tp++ = ((value << 4) & 0xff);
1079 			cp++;	/* skip ']' */
1080 			goto done;
1081 		case '/':
1082 			afterslash = 1;
1083 			break;
1084 		default:
1085 			if (afterslash) {
1086 				if (!isdigit(c&0xff))
1087 					return(EINVAL);
1088 				if (beg_blen == NULL) {
1089 
1090 					if (c == '0') {
1091 						/* blen never begings with 0 */
1092 						return(EINVAL);
1093 					}
1094 					beg_blen = cp;
1095 				}
1096 			} else {
1097 				if (!isxdigit(c&0xff))
1098 					return(EINVAL);
1099 				value <<= 4;
1100 				value += digitvalue[(int)c];
1101 				count += 4;
1102 				tbcount += 4;
1103 				if (tbcount > 256)
1104 					return(EINVAL);
1105 				if (count == 8) {
1106 					*tp++ = value;
1107 					count = 0;
1108 				}
1109 			}
1110 			break;
1111 		}
1112 	}
1113   done:
1114 	if (cp >= end || tp >= eom)
1115 		return(EMSGSIZE);
1116 
1117 	/*
1118 	 * bit length validation:
1119 	 * If a <length> is present, the number of digits in the <bit-data>
1120 	 * MUST be just sufficient to contain the number of bits specified
1121 	 * by the <length>. If there are insignificant bits in a final
1122 	 * hexadecimal or octal digit, they MUST be zero.
1123 	 * RFC 2673, Section 3.2.
1124 	 */
1125 	if (blen > 0) {
1126 		int traillen;
1127 
1128 		if (((blen + 3) & ~3) != tbcount)
1129 			return(EINVAL);
1130 		traillen = tbcount - blen; /* between 0 and 3 */
1131 		if (((value << (8 - traillen)) & 0xff) != 0)
1132 			return(EINVAL);
1133 	}
1134 	else
1135 		blen = tbcount;
1136 	if (blen == 256)
1137 		blen = 0;
1138 
1139 	/* encode the type and the significant bit fields */
1140 	**labelp = DNS_LABELTYPE_BITSTRING;
1141 	**dst = blen;
1142 
1143 	*bp = cp;
1144 	*dst = tp;
1145 
1146 	return(0);
1147 }
1148 
1149 static int
labellen(const u_char * lp)1150 labellen(const u_char *lp)
1151 {
1152 	int bitlen;
1153 	u_char l = *lp;
1154 
1155 	if ((l & NS_CMPRSFLGS) == NS_CMPRSFLGS) {
1156 		/* should be avoided by the caller */
1157 		return(-1);
1158 	}
1159 
1160 	if ((l & NS_CMPRSFLGS) == NS_TYPE_ELT) {
1161 		if (l == DNS_LABELTYPE_BITSTRING) {
1162 			if ((bitlen = *(lp + 1)) == 0)
1163 				bitlen = 256;
1164 			return((bitlen + 7 ) / 8 + 1);
1165 		}
1166 		return(-1);	/* unknwon ELT */
1167 	}
1168 	return(l);
1169 }
1170