|
112421c8
|
2024-12-29T18:49:06
|
|
Fix potential NULL dereference in evdns_cache_lookup()
evutil_new_addrinfo_() returns NULL in some cases, and its return value is always checked for NULL.
|
|
d6dbd7f8
|
2024-11-03T01:26:59
|
|
Windows platform supports reading IPv6 addresses for DNS server. (#1701)
When using libevent on the Windows platform in an IPv6 environment, I found that libevent could not read the DNS server address for IPv6 addresses during DNS initialization, resulting in constant DNS resolution failures. Then, on MSDN, I discovered that the GetNetworkParams interface does not support obtaining IPv6 addresses, and they provided another interface, GetAdaptersAddresses, to obtain both IPv4 and IPv6 addresses. Therefore, I replaced the GetNetworkParams interface with the GetAdaptersAddresses interface. Please review whether this modification can be merged into the master branch.
Reference MSDN documentation:
https://learn.microsoft.com/en-us/windows/win32/api/iphlpapi/nf-iphlpapi-getnetworkparams
https://learn.microsoft.com/en-us/windows/win32/api/iphlpapi/nf-iphlpapi-getadaptersaddresses
Co-authored-by: alphacheng <alphacheng@tencent.com>
Co-authored-by: Azat Khuzhin <azat@libevent.org>
Co-authored-by: Azat Khuzhin <a3at.mail@gmail.com>
|
|
e219dd4a
|
2024-11-02T00:53:31
|
|
return EAI_ADDRFAMILY instead of NULL (propagate to caller)
Signed-off-by: Kirill Rodriguez <theoden8@gmail.com>
|
|
23839cb0
|
2024-11-01T00:25:02
|
|
mm_strdup instead of strdup
Signed-off-by: Kirill Rodriguez <theoden8@gmail.com>
|
|
f84896d3
|
2024-10-28T20:50:29
|
|
dns: Return DNS query type on error (#1220)
When calling the user callback after a DNS resolution on error, make
sure to send back the query type (A, AAAA, PTR).
Closes #1219
Signed-off-by: David Goulet <dgoulet@torproject.org>
Signed-off-by: David Goulet <dgoulet@ev0ke.net>
Co-authored-by: Azat Khuzhin <azat@libevent.org>
|
|
|
e30b215f
|
2024-10-24T06:28:53
|
|
Add caching for evdns (#1717)
No evdns will do caching by default (with respect to TTL), to disable this set EVDNS_BASE_NO_CACHE
There are also helpers for manually manage the cache:
- evdns_cache_write()
- evdns_cache_lookup()
Initial PR: #571
Fixes: #1715
Co-authored-by: Greg Hazel <ghazel@gmail.com>
Co-authored-by: Keith Moore <kmoore@clostra.com>
|
|
eec47a67
|
2024-04-30T15:59:58
|
|
Fix typos (#1634)
|
|
23685cfb
|
2023-09-28T11:18:10
|
|
Fix some typos (#1515)
|
|
227510d5
|
2023-07-13T22:20:33
|
|
Fix EVDNS_BASE_DISABLE_WHEN_INACTIVE (#1493)
I faced with strange problem: event loop doesn't exit after dns resolving with
`EVDNS_BASE_DISABLE_WHEN_INACTIVE`.
Stand:
- Ubuntu 22;
- libevent release-2.1.12-stable
- `resolve.conf` contains 2 nameservers;
- I use `evdns_base_new` with `EVDNS_BASE_DISABLE_WHEN_INACTIVE | EVDNS_BASE_INITIALIZE_NAMESERVERS` to avoid OS specific code.
After small investigation, look like events related with dns sockets added to
event_base before `evdns->disable_when_inactive` was initialized. `libevent`
did epoll_ctl(DEL) after resolving completed on the first socket, but the
second socket remained in the `epoll` interest list.
|
|
|
e96e98ae
|
2023-03-02T13:43:54
|
|
evdns: fix "Branch condition evaluates to a garbage value" in reply_parse
|
|
ebd7e8d7
|
2023-01-27T08:44:41
|
|
Allow evdns_base_new to succeed with no nameservers configured
If resolv.conf has no nameservers, evdns_base_new can still succeed with
the default of using the name server from localhost matching the man
page documentation for resolv.conf.
|
|
|
a7fffb5c
|
2023-01-17T23:02:56
|
|
Replace magic numbers with consts for evdns_base_resolv_conf_parse() errors
|
|
8800b17a
|
2022-11-01T14:26:11
|
|
evdns: integrate deferred_response_callback into evdns_request
the allocation of the struct deferred_reply_callback can fail. If that
happens a program waiting for a callback never gets a callback. The
program would asume that it either gets an error or a callback when e.g.
calling evdns_base_resolve_ipv6.
I did an analysis of the evdns.c code and concluded that struct
evdns_request would live until the callback is executed. Based on that
conclusion I removed the struct deferred_reply_callback and moved the
neccessary fields for data which should be copied from struct request
into struct evdns_request.
The fields evdns_callback_type user_callback and void *user_pointer are
moved into struct evdns_request as it is a more natural place for them
to live than struct request.
|
|
b19af675
|
2022-08-28T15:27:04
|
|
Fix non-std printf %p arguments (#1327)
* Fix non-std printf %p arguments when running with -Werror -pedantic-errors
Co-authored-by: Mareks Malnacs <mareks.malnacs>
|
|
7d0836c2
|
2022-08-14T14:02:48
|
|
handle empty answers as EAI_ADDRFAMILY
Signed-off-by: Kirill Rodriguez <theoden8@gmail.com>
|
|
5ff98dc1
|
2022-07-10T17:33:15
|
|
evdns: accept domains up to 254 long (previosly only 63 long was accepted)
Previously evdns was using HOST_NAME_MAX, and define it to 255 *only* if
it not set, however it does set on linux:
$ egrep -r define.*HOST_NAME_MAX /usr/include/bits
/usr/include/bits/local_lim.h:#define HOST_NAME_MAX 64
/usr/include/bits/posix1_lim.h:#define _POSIX_HOST_NAME_MAX 255
/usr/include/bits/confname.h:#define _SC_HOST_NAME_MAX _SC_HOST_NAME_MAX
But 64 should be the limit of the host component, not for the whole
hostname, as also noted by @ploxiln
So use our own EVDNS_NAME_MAX const, which is set to 255.
Fixes: #1280
|
|
|
822502d7
|
2022-03-31T15:29:32
|
|
evdns fix NULL res clearing the cache entry
Signed-off-by: Kirill Rodriguez <theoden8@tutamail.com>
Signed-off-by: Kirill Rodriguez <theoden8@gmail.com>
|
|
cd6a41ec
|
2021-12-10T11:05:13
|
|
feat: add `evdns_base_get_nameserver_fd` method
To get underlying udp socket fd.
|
|
|
d076d2df
|
2021-11-30T22:41:05
|
|
Revert "evdns: do not check server_req twice"
That was wrong assumption.
This reverts commit 991f0ed3d86ffca0c017ab83cd239289912bdaad.
Fixes: #1231
|
|
5c0e75c3
|
2021-07-06T17:40:58
|
|
Properly initialize sockaddr length on systems with sin_len.
|
|
19b3fd0b
|
2021-04-07T20:39:18
|
|
evdns: add ability to get CNAME
Add new flag (DNS_CNAME_CALLBACK) for
evdns_base_resolve_ipv4()/evdns_base_resolve_ipv6().
If set, you will get one more callback with type == DNS_CNAME and CNAME
in addrs argument.
|
|
01beec2f
|
2021-04-03T12:55:32
|
|
dns: remove evdns_set_transaction_id_fn
|
|
|
39d68053
|
2021-04-03T12:55:11
|
|
dns: remove evdns_set_random_bytes_fn
|
|
|
617ba838
|
2021-01-09T17:19:27
|
|
evdns: add max-probe-timeout/probe-backoff-factor settings
I recently found that when the network status changed when calling
bufferevent_socket_connect_hostname (e.g. switching between several
WIFIs), all DNS servers would fail, and the timeout of probe would be
very long if there were many DNS requests. I want libevent to support
manual setting of MAX_PROBE_TIMEOUT and TIMEOUT_BACKOFF_FACTOR
So move hardcoded MAX_PROBE_TIMEOUT and TIMEOUT_BACKOFF_FACTOR into
struct, and allow changing them.
|
|
c5e4391b
|
2020-12-26T09:07:07
|
|
doc: remove dead link
The link is dead and an archived page cannot be found in the
web.archive.org.
|
|
|
c424594b
|
2020-06-25T10:18:43
|
|
evdns: do not pass NULL to memcpy() in evdns_server_request_format_response()
In case of OPT pseudo-RR `class` field is treated as a requestor's UDP
payload size, and class will have 512 (DNS_MAX_UDP_SIZE), and data is
NULL:
(gdb) p *item
$4 = {
next = 0x0,
name = 0x602000000130 "",
type = 41,
class = 512,
ttl = 0,
is_name = 0 '\000',
datalen = 0,
data = 0x0
}
And UBSAN will reports:
../evdns.c:2493:5: runtime error: null pointer passed as argument 2, which is declared to never be null
#0 0x7ffff70b65bb in evdns_server_request_format_response ../evdns.c:2493
#1 0x7ffff70b706b in evdns_server_request_respond ../evdns.c:2529
#2 0x5555557975ab in regress_dns_server_cb ../test/regress_testutils.c:263
#3 0x7ffff70a8489 in request_parse ../evdns.c:1576
#4 0x7ffff70aa445 in server_udp_port_read ../evdns.c:1726
#5 0x7ffff70ac5cc in server_port_ready_callback ../evdns.c:1849
#6 0x7ffff6d3054c in event_persist_closure ../event.c:1645
#7 0x7ffff6d311cd in event_process_active_single_queue ../event.c:1704
#8 0x7ffff6d33258 in event_process_active ../event.c:1805
#9 0x7ffff6d361b5 in event_base_loop ../event.c:2047
#10 0x7ffff6d334ac in event_base_dispatch ../event.c:1839
#11 0x555555739df2 in test_edns ../test/regress_dns.c:2639
#12 0x5555557b9e96 in testcase_run_bare_ ../test/tinytest.c:173
#13 0x5555557ba8f0 in testcase_run_one ../test/tinytest.c:333
#14 0x5555557bc9a0 in tinytest_main ../test/tinytest.c:527
#15 0x555555787faa in main ../test/regress_main.c:528
#16 0x7ffff606c001 in __libc_start_main (/usr/lib/libc.so.6+0x27001)
#17 0x55555569436d in _start (/src/le/libevent/.cmake-debug/bin/regress+0x14036d)
|
|
efbe563b
|
2020-05-28T17:32:05
|
|
recreate socket when udp failed
|
|
83c58d49
|
2020-05-31T19:59:49
|
|
evdns: Add support for setting maximum UDP DNS message size.
Added new option `edns-udp-size` for evdns_base which allows
to control maximum allowed size of UDP DNS messages. This
maximum size is passed to the DNS server via edns mechanism.
|
|
|
2c2248ea
|
2020-05-25T03:06:43
|
|
evdns: fix coding style issues
|
|
|
1cab3c05
|
2020-05-25T02:55:38
|
|
evdns: fix trailing whitespaces
|
|
|
1cf24f04
|
2020-05-25T02:35:55
|
|
evdns: bufferevent_setcb before bufferevent_free is redundant
|
|
0f6ee89a
|
2020-05-21T12:46:20
|
|
evdns: Implement dns requests via tcp
|
|
|
8fe35c76
|
2020-05-18T14:10:28
|
|
evdns: Add additional validation for values of dns options
|
|
|
4da9f87c
|
2020-02-27T16:59:45
|
|
evdns: fix a crash when evdns_base with waiting requests is freed
Fix undefined behaviour and application crash that might take
place in some rare cases after calling evdns_base_free when
there are requests in the waiting queue.
Current cleanup procedure in evdns_base_free_and_unlock
function includes 2 steps:
1. Finish all inflight requests.
2. Finish all waiting requests.
During the first step we iterate over each list in req_heads
structure and finish all requests in these lists. With current
logic finishing an inflight request (function request_finished)
removes it from the inflight requests container and forces
a wating connection to be sent (by calling
evdns_requests_pump_waiting_queue). When these new requests are
sent it is possible that they will be inserted to the list in
req_heads that we've already cleaned.
So in some cases container of the inflight requests is not empty
after this procedure and some requests are not finished and
deleted. When timeouts for these requests expire
evdns_request_timeout_callback is called but corresponding
evdns_base has been already deleted which causes undefined
behaviour and possible applicaton crash.
It is interesting to note that in old versions of libevent such
situation was not possible. This bug was introduced by the commit
14f84bbdc77d90b1d936076661443cdbf516c593. Before this commit
nameservers were deleted before finishing the requests. Therefore
it was not possible that requests from the waiting queue be sent
while we finish the inflight requests.
|
|
|
c3f35345
|
2019-09-05T23:31:19
|
|
Fix checking return value of the evdns_base_resolv_conf_parse()
Reported-by: Maxim Gorbachyov <maxim.gorbachyov@gmail.com>
|
|
7806f3ec
|
2019-07-03T00:27:22
|
|
Missing <winerror.h> on win7/MinGW(MINGW32_NT-6.1)/MSYS
|
|
|
538141eb
|
2019-06-15T23:18:05
|
|
evdns: add new options -- so-rcvbuf/so-sndbuf
This will allow to customize SO_RCVBUF/SO_SNDBUF for nameservers in this
evdns_base, you may want to adjust them if the kernel starts dropping
udp packages.
|
|
8701d0d3
|
2019-05-06T11:37:02
|
|
evdns: fix lock/unlock mismatch in evdns_close_server_port()
Closes: #809 (cherry-picked)
|
|
|
991f0ed3
|
2019-04-01T02:41:17
|
|
evdns: do not check server_req twice
Reported by µchex:
"In evdns.c, pointer server_req is null checked on line 1289 after it
is dereferenced above. Since server_req was already null checked above
on line 1243, there is no risk of crashing and the only bug is the
redundant null check (and indentation) on line 1289.
"
|
|
|
e5b8f4c1
|
2019-04-01T01:47:00
|
|
evdns: add DNS_OPTION_NAMESERVERS_NO_DEFAULT/EVDNS_BASE_NAMESERVERS_NO_DEFAULT
- DNS_OPTION_NAMESERVERS_NO_DEFAULT
Do not "default" nameserver (i.e. "127.0.0.1:53") if there is no nameservers
in resolv.conf, (iff DNS_OPTION_NAMESERVERS is set)
- EVDNS_BASE_NAMESERVERS_NO_DEFAULT
If EVDNS_BASE_INITIALIZE_NAMESERVERS isset, do not add default
nameserver if there are no nameservers in resolv.conf (just set
DNS_OPTION_NAMESERVERS_NO_DEFAULT internally)
Fixes: #569
|
|
fb134939
|
2019-02-07T11:43:14
|
|
Added DNS header mask definitions.
Currently, we do a lot of data munging with manual hex. This is ugly
and can lead to bugs. I defined the following:
_QR_MASK 0x8000U
_OP_MASK 0x7800U
_AA_MASK 0x0400U
_TC_MASK 0x0200U
_RD_MASK 0x0100U
_RA_MASK 0x0080U
_Z_MASK 0x0040U
_AD_MASK 0x0020U
_CD_MASK 0x0010U
_RCODE_MASK 0x000fU
So that we can more easily twiddle flags.
v2: make evdns flag masks unsigned literal
Closes: #756 (cherry-picked)
|
|
3e6553a1
|
2018-08-09T13:04:52
|
|
evdns: handle NULL filename explicitly
Otherwise we will try to open NULL filename and got EFAULT and anyway
will got the same return code from evdns_base_resolv_conf_parse_impl()
Closes: #680 (cherry-picked)
|
|
b59525ec
|
2018-08-02T00:35:28
|
|
evdns: fix race condition in evdns_getaddrinfo()
evdns_getaddrinfo() starts two parallel requests for A and AAAA record.
But if request is created from thread different from dns_base's, request of A record is
started immediately and may result in calling free_getaddrinfo_request() from
evdns_getaddrinfo_gotresolve() because `other_req' doesn't exist yet.
After that, request of AAAA record starts and finishes, and evdns_getaddrinfo_gotresolve()
is called again for structure that is already freed.
This commits adds locking into evdns_getaddrinfo() function.
|
|
|
8572c273
|
2018-06-24T13:33:44
|
|
use mm_ allocators
Signed-off-by: Kirill Rodriguez <theoden8@tutamail.com>
Signed-off-by: Kirill Rodriguez <theoden8@gmail.com>
|
|
94e7dceb
|
2017-01-29T17:23:14
|
|
Fix -Werror=implicit-fallthrough (fixes gcc-7)
Fixes: #447
|
|
|
ec65c420
|
2016-03-25T00:33:47
|
|
evdns: fix searching empty hostnames
From #332:
Here follows a bug report by **Guido Vranken** via the _Tor bug bounty program_. Please credit Guido accordingly.
## Bug report
The DNS code of Libevent contains this rather obvious OOB read:
```c
static char *
search_make_new(const struct search_state *const state, int n, const char *const base_name) {
const size_t base_len = strlen(base_name);
const char need_to_append_dot = base_name[base_len - 1] == '.' ? 0 : 1;
```
If the length of ```base_name``` is 0, then line 3125 reads 1 byte before the buffer. This will trigger a crash on ASAN-protected builds.
To reproduce:
Build libevent with ASAN:
```
$ CFLAGS='-fomit-frame-pointer -fsanitize=address' ./configure && make -j4
```
Put the attached ```resolv.conf``` and ```poc.c``` in the source directory and then do:
```
$ gcc -fsanitize=address -fomit-frame-pointer poc.c .libs/libevent.a
$ ./a.out
=================================================================
==22201== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60060000efdf at pc 0x4429da bp 0x7ffe1ed47300 sp 0x7ffe1ed472f8
READ of size 1 at 0x60060000efdf thread T0
```
P.S. we can add a check earlier, but since this is very uncommon, I didn't add it.
Fixes: #332
|
|
|
4db15e09
|
2016-03-24T12:49:47
|
|
evdns: avoid double-free in evdns_base_free() for probing requests
http/cancel_by_host_no_ns:
OK ../test/regress_http.c:1384: assert(regress_dnsserver(data->base, &portnum, search_table))
OK ../test/regress_http.c:1387: assert(dns_base)
OK ../test/regress_http.c:1423: assert(evcon)
OK ../test/regress_http.c:1444: assert(evhttp_make_request(evcon, req, EVHTTP_REQ_GET, "/delay") != -1): 0 vs -1
OK ../test/regress_http.c:1455: assert(test_ok == 2): 2 vs 2
OK ../test/regress_http.c:1480: assert(evhttp_make_request(evcon, req, EVHTTP_REQ_GET, "/test") != -1): 0 vs -1[msg] Nameserver 127.0.0.1:55948 has failed: request timed out.
[msg] All nameservers have failed
OK ../test/regress_http.c:1274: assert(!req)
OK ../test/regress_http.c:1505: assert(evhttp_make_request(evcon, req, EVHTTP_REQ_GET, "/test") != -1): 0 vs -1
OK ../test/regress_http.c:1274: assert(!req)==19199== Invalid read of size 8
==19199== at 0x4CC285: evdns_cancel_request (evdns.c:2849)
==19199== by 0x4CEDB2: evdns_nameserver_free (evdns.c:4018)
==19199== by 0x4CEF5B: evdns_base_free_and_unlock (evdns.c:4052)
==19199== by 0x4CF13B: evdns_base_free (evdns.c:4088)
==19199== by 0x4617A3: http_cancel_test (regress_http.c:1518)
==19199== by 0x490A78: testcase_run_bare_ (tinytest.c:105)
==19199== by 0x490D5A: testcase_run_one (tinytest.c:252)
==19199== by 0x491699: tinytest_main (tinytest.c:434)
==19199== by 0x47E0E0: main (regress_main.c:461)
==19199== Address 0x61e56d0 is 0 bytes inside a block of size 48 free'd
==19199== at 0x4C2AE6B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==19199== by 0x4AAFFF: event_mm_free_ (event.c:3516)
==19199== by 0x4C5ADD: request_finished (evdns.c:693)
==19199== by 0x4CEE95: evdns_base_free_and_unlock (evdns.c:4040)
==19199== by 0x4CF13B: evdns_base_free (evdns.c:4088)
==19199== by 0x4617A3: http_cancel_test (regress_http.c:1518)
==19199== by 0x490A78: testcase_run_bare_ (tinytest.c:105)
==19199== by 0x490D5A: testcase_run_one (tinytest.c:252)
==19199== by 0x491699: tinytest_main (tinytest.c:434)
==19199== by 0x47E0E0: main (regress_main.c:461)
==19199== Block was alloc'd at
==19199== at 0x4C2BBD5: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==19199== by 0x4AAEB2: event_mm_calloc_ (event.c:3459)
==19199== by 0x4CAAA2: nameserver_send_probe (evdns.c:2327)
==19199== by 0x4C50FF: nameserver_prod_callback (evdns.c:494)
==19199== by 0x4A564C: event_process_active_single_queue (event.c:1646)
==19199== by 0x4A5B95: event_process_active (event.c:1738)
==19199== by 0x4A6296: event_base_loop (event.c:1961)
==19199== by 0x4A5C1D: event_base_dispatch (event.c:1772)
==19199== by 0x46172C: http_cancel_test (regress_http.c:1507)
==19199== by 0x490A78: testcase_run_bare_ (tinytest.c:105)
==19199== by 0x490D5A: testcase_run_one (tinytest.c:252)
==19199== by 0x491699: tinytest_main (tinytest.c:434)
==19199==
|
|
|
8cbe65d5
|
2016-03-21T17:08:34
|
|
evdns: export cancel via callbacks in util (like async lib core/extra issues)
|
|
|
96f64a02
|
2016-02-01T17:32:09
|
|
evdns: name_parse(): fix remote stack overread
@asn-the-goblin-slayer:
"the name_parse() function in libevent's DNS code is vulnerable to a buffer overread.
971 if (cp != name_out) {
972 if (cp + 1 >= end) return -1;
973 *cp++ = '.';
974 }
975 if (cp + label_len >= end) return -1;
976 memcpy(cp, packet + j, label_len);
977 cp += label_len;
978 j += label_len;
No check is made against length before the memcpy occurs.
This was found through the Tor bug bounty program and the discovery should be credited to 'Guido Vranken'."
Reproducer for gdb (https://gist.github.com/azat/e4fcf540e9b89ab86d02):
set $PROT_NONE=0x0
set $PROT_READ=0x1
set $PROT_WRITE=0x2
set $MAP_ANONYMOUS=0x20
set $MAP_SHARED=0x01
set $MAP_FIXED=0x10
set $MAP_32BIT=0x40
start
set $length=202
# overread
set $length=2
# allocate with mmap to have a seg fault on page boundary
set $l=(1<<20)*2
p mmap(0, $l, $PROT_READ|$PROT_WRITE, $MAP_ANONYMOUS|$MAP_SHARED|$MAP_32BIT, -1, 0)
set $packet=(char *)$1+$l-$length
# hack the packet
set $packet[0]=63
set $packet[1]='/'
p malloc(sizeof(int))
set $idx=(int *)$2
set $idx[0]=0
set $name_out_len=202
p malloc($name_out_len)
set $name_out=$3
# have WRITE only mapping to fail on read
set $end=$1+$l
p (void *)mmap($end, 1<<12, $PROT_NONE, $MAP_ANONYMOUS|$MAP_SHARED|$MAP_FIXED|$MAP_32BIT, -1, 0)
set $m=$4
p name_parse($packet, $length, $idx, $name_out, $name_out_len)
x/2s (char *)$name_out
Before this patch:
$ gdb -ex 'source gdb' dns-example
$1 = 1073741824
$2 = (void *) 0x633010
$3 = (void *) 0x633030
$4 = (void *) 0x40200000
Program received signal SIGSEGV, Segmentation fault.
__memcpy_sse2_unaligned () at memcpy-sse2-unaligned.S:33
After this patch:
$ gdb -ex 'source gdb' dns-example
$1 = 1073741824
$2 = (void *) 0x633010
$3 = (void *) 0x633030
$4 = (void *) 0x40200000
$5 = -1
0x633030: "/"
0x633032: ""
(gdb) p $m
$6 = (void *) 0x40200000
(gdb) p $1
$7 = 1073741824
(gdb) p/x $1
$8 = 0x40000000
(gdb) quit
P.S. plus drop one condition duplicate.
Fixes: #317
|
|
|
00313c50
|
2015-11-23T15:05:19
|
|
evdns: evdns_base_free(): fix UAF of evdns_base with @fail_requests
If you call evdns_base_free() with @fail_requests == 1, then it will defer
callback with DNS_ERR_SHUTDOWN, but that callback (internal) uses
data->evdns_base, but we already freed that evdns base, so we can't do
this, fix this by checking @result to DNS_ERR_SHUTDOWN.
Fixes: regress dns/client_fail_requests_getaddrinfo
Fixes: #269
|
|
|
14f84bbd
|
2015-11-23T15:36:30
|
|
evdns: evdns_base_free(): free requests before namservers
Otherwise we will trigger next UAF:
$ valgrind --vgdb-error=1 regress --no-fork +dns/client_fail_requests
==24733== Memcheck, a memory error detector
==24733== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==24733== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==24733== Command: regress --no-fork +dns/client_fail_requests
==24733==
==24733==
==24733== TO DEBUG THIS PROCESS USING GDB: start GDB like this
==24733== /path/to/gdb regress
==24733== and then give GDB the following command
==24733== target remote | /usr/lib/valgrind/../../bin/vgdb --pid=24733
==24733== --pid is optional if only one valgrind process is running
==24733==
dns/client_fail_requests: ==24733== Invalid read of size 4
==24733== at 0x4C3352: request_finished (evdns.c:662)
==24733== by 0x4CC8B7: evdns_base_free_and_unlock (evdns.c:4048)
==24733== by 0x4CCAFD: evdns_base_free (evdns.c:4088)
==24733== by 0x458E95: dns_client_fail_requests_test (regress_dns.c:2039)
==24733== by 0x48EA5D: testcase_run_bare_ (tinytest.c:105)
==24733== by 0x48ED3F: testcase_run_one (tinytest.c:252)
==24733== by 0x48F67E: tinytest_main (tinytest.c:434)
==24733== by 0x47C0DA: main (regress_main.c:461)
==24733== Address 0x61e6f70 is 448 bytes inside a block of size 456 free'd
==24733== at 0x4C29EAB: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==24733== by 0x4A8F4D: event_mm_free_ (event.c:3512)
==24733== by 0x4CC7A1: evdns_nameserver_free (evdns.c:4021)
==24733== by 0x4CC7DC: evdns_base_free_and_unlock (evdns.c:4037)
==24733== by 0x4CCAFD: evdns_base_free (evdns.c:4088)
==24733== by 0x458E95: dns_client_fail_requests_test (regress_dns.c:2039)
==24733== by 0x48EA5D: testcase_run_bare_ (tinytest.c:105)
==24733== by 0x48ED3F: testcase_run_one (tinytest.c:252)
==24733== by 0x48F67E: tinytest_main (tinytest.c:434)
==24733== by 0x47C0DA: main (regress_main.c:461)
==24733== Block was alloc'd at
==24733== at 0x4C28C4F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==24733== by 0x4A8D5A: event_mm_malloc_ (event.c:3437)
==24733== by 0x4C8B96: evdns_nameserver_add_impl_ (evdns.c:2505)
==24733== by 0x4C916D: evdns_base_nameserver_ip_add (evdns.c:2629)
==24733== by 0x458DA3: dns_client_fail_requests_test (regress_dns.c:2031)
==24733== by 0x48EA5D: testcase_run_bare_ (tinytest.c:105)
==24733== by 0x48ED3F: testcase_run_one (tinytest.c:252)
==24733== by 0x48F67E: tinytest_main (tinytest.c:434)
==24733== by 0x47C0DA: main (regress_main.c:461)
==24733==
==24733== (action on error) vgdb me ...
Fixes: regress dns/client_fail_requests
Fixes: #269
|
|
|
9c238deb
|
2015-10-09T01:13:08
|
|
evdns: fix randomize-case by make case-insensitive as required
Interesting that this wasn't found by regression tests since they respond with
that SoME-rAndDom-CaSe domains, and no case-insensitive mode is required during
comparing response from the server and request.
Fixes #288
Covered-by: regress dns/search_lower
|
|
|
0c615f4e
|
2015-10-09T00:03:47
|
|
evnds: inline TEST_NAME macro to make debuggin easier
|
|
4472ec68
|
2015-02-03T15:57:31
|
|
Merge pull request #212 from xbao/master
changed strtotimeval signature to avoid conflict with Android NDK sys/time.h header (#211)
|
|
537177d3
|
2015-02-02T13:57:22
|
|
New function to get address for nameserver.
|
|
bdbc823f
|
2015-01-28T17:17:02
|
|
changed strtotimeval signature as per #211
|
|
8afbdbc4
|
2014-12-08T10:21:00
|
|
Fix mixed declarations and code (forbidden by ISO C90)
|
|
|
61262a0f
|
2014-11-12T20:16:18
|
|
evdns: avoid read-after-free in evdns_request_timeout_callback()
In evdns_request_timeout_callback() in case we a giving up, we call
request_finished() which will free() req structure, however we ns from
it to fail it, so save pointer to ns to call nameserver_failed() on
them.
Founded with valgrind:
$ valgrind regress dns/retry
==10497== Memcheck, a memory error detector
==10497== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==10497== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info
==10497== Command: regress dns/retry
==10497==
dns/retry: [forking] ==10498== Invalid read of size 8
==10498== at 0x4C309D: evdns_request_timeout_callback (evdns.c:2179)
==10498== by 0x49EA95: event_process_active_single_queue (event.c:1576)
==10498== by 0x49EFDD: event_process_active (event.c:1668)
==10498== by 0x49F6DD: event_base_loop (event.c:1891)
==10498== by 0x49F063: event_base_dispatch (event.c:1702)
==10498== by 0x44C7F1: dns_retry_test_impl (regress_dns.c:724)
==10498== by 0x44CF60: dns_retry_test (regress_dns.c:749)
==10498== by 0x48A8A1: testcase_run_bare_ (tinytest.c:105)
==10498== by 0x48A94E: testcase_run_forked_ (tinytest.c:189)
==10498== by 0x48AB73: testcase_run_one (tinytest.c:247)
==10498== by 0x48B4C2: tinytest_main (tinytest.c:434)
==10498== by 0x477FC7: main (regress_main.c:459)
==10498== Address 0x6176ef8 is 40 bytes inside a block of size 342 free'd
==10498== at 0x4C29E90: free (vg_replace_malloc.c:473)
==10498== by 0x4A4411: event_mm_free_ (event.c:3443)
==10498== by 0x4BE8C5: request_finished (evdns.c:702)
==10498== by 0x4C3098: evdns_request_timeout_callback (evdns.c:2178)
==10498== by 0x49EA95: event_process_active_single_queue (event.c:1576)
==10498== by 0x49EFDD: event_process_active (event.c:1668)
==10498== by 0x49F6DD: event_base_loop (event.c:1891)
==10498== by 0x49F063: event_base_dispatch (event.c:1702)
==10498== by 0x44C7F1: dns_retry_test_impl (regress_dns.c:724)
==10498== by 0x44CF60: dns_retry_test (regress_dns.c:749)
==10498== by 0x48A8A1: testcase_run_bare_ (tinytest.c:105)
==10498== by 0x48A94E: testcase_run_forked_ (tinytest.c:189)
==10498==
==10498==
==10498== HEAP SUMMARY:
==10498== in use at exit: 0 bytes in 0 blocks
==10498== total heap usage: 83 allocs, 83 frees, 10,020 bytes allocated
==10498==
==10498== All heap blocks were freed -- no leaks are possible
==10498==
==10498== For counts of detected and suppressed errors, rerun with: -v
==10498== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
OK
1 tests ok. (0 skipped)
==10497==
==10497== HEAP SUMMARY:
==10497== in use at exit: 0 bytes in 0 blocks
==10497== total heap usage: 3 allocs, 3 frees, 96 bytes allocated
==10497==
==10497== All heap blocks were freed -- no leaks are possible
==10497==
==10497== For counts of detected and suppressed errors, rerun with: -v
==10497== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Bug was introduced in 97c750d6602517f22a1100f16592b421c38f2a45 ("evdns:
fail ns after we are failing/retrasmitting request").
|
|
|
97c750d6
|
2014-09-30T01:34:04
|
|
evdns: fail ns after we are failing/retrasmitting request
In case we are failing request (evdns_request_timeout_callback()), we
delete timeout_event in request_finished(), while just before calling
request_finished() (for failing request) there was a call to
nameserver_failed(), that add event for timeout_event, IOW we must fail
ns after request because otherwise we will not have timeout_event
actived, and we will waiting forever.
Before this patch the dns/retry_disable_when_inactive will wait forever,
after - OK.
|
|
|
74d0eee8
|
2014-04-10T19:30:47
|
|
evdns: fix EVDNS_BASE_DISABLE_WHEN_INACTIVE in case retransmit/retry
|
|
|
c8c7fa3a
|
2014-09-18T11:41:18
|
|
Merge pull request #119 from ldx/winhosts
Fix hosts file use on Windows.
|
|
|
a7d5dabf
|
2014-09-18T11:24:56
|
|
Merge pull request #129 from azat/disable-probing-with-disable-when-inactive-v2
evdns: disable probing with EVDNS_BASE_DISABLE_WHEN_INACTIVE
|
|
3a4d249c
|
2014-09-03T10:55:27
|
|
[Bugfix] fix grammer error
|
|
|
6a53d153
|
2014-08-29T15:26:56
|
|
Correctly handle allocation failures in evdns_getaddrinfo
Kuldeep Gupta appears to have used some kind of automated tool to
find this and generate a patch for half the issue as #149.
|
|
|
d83b3371
|
2014-04-10T19:45:31
|
|
evdns: we don't need to add retry timer in transmit_to it will be done on fail
|
|
|
610410b5
|
2014-03-21T17:04:58
|
|
evdns: disable probing with EVDNS_BASE_DISABLE_WHEN_INACTIVE
When user install EVDNS_BASE_DISABLE_WHEN_INACTIVE flag for evdns base,
we must remove the timer that is used for probing, if current dns server
failed, otherwise it won't break the loop.
|
|
|
b163fdaa
|
2014-03-26T11:10:16
|
|
Merge remote-tracking branch 'origin/patches-2.0'
|
|
|
e8fe749d
|
2014-03-21T14:08:17
|
|
Fix a crash in evdns related to shutting down evdns
(Improved version to deal correctly with probe requests)
Patch from YASUOKA Masahiko; fix for libevent github issue #113.
|
|
|
86665a58
|
2014-03-21T14:09:54
|
|
Merge remote-tracking branch 'origin/patches-2.0'
|
|
|
9f39c887
|
2014-03-21T14:08:17
|
|
Fix a crash in evdns related to shutting down evdns
Patch from YASUOKA Masahiko; fix for libevent github issue #113.
|
|
d0dc861b
|
2014-03-21T14:38:11
|
|
Don't truncate hosts file path on Windows.
Since evutil_snprintf() (actually evutil_vsnprintf() called by it) will
make sure the buffer is null-terminated by placing a null byte at
len_out - 1, we need to pass the full length of the buffer; otherwise
the path will end in "\\host" instead of "\\hosts".
|
|
|
a0b247cd
|
2014-03-21T14:36:15
|
|
Load hosts file on Windows.
Hosts files are not loaded in evdns_base_config_windows_nameservers() if
load_nameservers_with_getnetworkparams() succeeds on Windows. Parse and
load it first before setting up nameservers.
|
|
|
254c04ec
|
2013-12-24T15:01:34
|
|
Fix needless bufferevent includes in evdns.c
|
|
62f596b7
|
2013-05-09T06:50:52
|
|
fix for ServFail from RIPE Atlas release
|
|
3d105414
|
2013-12-09T16:58:16
|
|
Fix non-C89 variable declaration.
Microsofts C compiler does not support the C99 standard, so variables has
to be declared at the start of a scope.
|
|
|
e6b2a267
|
2013-12-09T16:54:57
|
|
Fix non-C89 variable declaration.
Microsofts C compiler does not support the C99 standard, so variables has
to be declared at the start of a scope.
|
|
|
45eba6ff
|
2013-12-06T10:50:17
|
|
Rename flush_outdated_host_addresses to clear_host_addresses
"flush" can imply writing something out to a file or connection before
clearing it; "clear" always means "remove". It's also potentially
misleading to say "outdated" here, since the function removes _all_
addresses regardless, not just certain outdated ones.
Also, don't free the lock in this function. Also reindent the function.
|
|
954d2f94
|
2013-12-06T16:53:16
|
|
bug fix for issues #293 evdns_base_load_hosts doesn't remove outdated adresses
As mentioned at https://sourceforge.net/p/levent/bugs/293/
created a small function "evdns_base_flush_outdated_host_addresses" which removes all the previous requests of hosts , if user wants to clean up the list of hosts can call and use this function.
Requires function declaration to be added in include/event2/dns.h
Adding it in another patch for the same bug.
|
|
|
363388a0
|
2013-05-29T14:19:14
|
|
restore the comment
|
|
|
f8d7df85
|
2013-05-11T03:53:11
|
|
Fix SEGFAULT after evdns_base_resume if no nameservers installed.
If there is no nameservers installed, using
evdns_base_nameserver_ip_add(), than evdns_base_resume() will SEGFAULT,
because of NULL dereference in evdns_requests_pump_waiting_queue()
Conflicts:
evdns.c
|
|
|
e1766a1b
|
2013-05-29T16:26:50
|
|
Actually use the log facility for reporting evdns problems.
Fixes issue #63. Also refactors the evdns logging and log backend a
bit, so that it wastes a little less code.
|
|
|
14971a83
|
2013-05-11T03:53:11
|
|
Fix SEGFAULT after evdns_base_resume if no nameservers installed.
If there is no nameservers installed, using
evdns_base_nameserver_ip_add(), than evdns_base_resume() will SEGFAULT,
because of NULL dereference in evdns_requests_pump_waiting_queue()
|
|
|
ef820dbf
|
2013-05-07T10:03:28
|
|
Merge remote-tracking branch 'origin/patches-2.0'
|
|
5c710c03
|
2013-05-06T18:15:03
|
|
Checking request nameserver for NULL, before using it.
|
|
|
6b7fa620
|
2013-03-27T20:15:46
|
|
evdns: New flag to make evdns not prevent the event loop from exiting
Here is the brief description of problem:
When you are use evdns to resolve domains to IP adresses (see
./sample/dns-example) you loop never returns from event_base_dispatch(),
and because of this the program will never terminated.
Because existing programs may be depending on the old behavior, we
only apply the fix when evdns_base_new() is created with a new flag -
EVDNS_BASE_DISABLE_WHEN_INACTIVE.
(Commit message edited by Nick while squashing the branch.)
|
|
|
8827dbc3
|
2012-09-12T20:19:22
|
|
Merge remote-tracking branch 'origin/patches-2.0'
|
|
f2bff75e
|
2012-09-12T20:12:03
|
|
FIx another memleak on OOM in evdns
|
|
|
73e85dd0
|
2012-09-12T20:11:12
|
|
Avoid a memory-leak on OOM in evdns.
|
|
|
9be8624b
|
2012-07-30T17:08:44
|
|
Merge remote-tracking branch 'origin/patches-2.0'
|
|
|
dc320776
|
2012-07-30T16:52:55
|
|
Avoid segfault on weird timeout during name lookup.
If an evdns_getaddrinfo timeout happens while pending_cb is set, and
a callback is about to run, but we get a call to
evdns_getaddrinfo_gotresolve before it finishes.
Github issue #60. Thanks to Greg Hazel for patch and patience.
|
|
|
9852107f
|
2012-07-26T10:43:13
|
|
Merge remote-tracking branch 'origin/patches-2.0'
Conflicts:
buffer.c
http.c
|
|
|
a1a0e675
|
2012-07-26T10:38:29
|
|
memset sockaddr_in before using it. Found by coverity.
|
|
|
c0e425ab
|
2012-05-09T11:06:06
|
|
Restore our priority-inversion-prevention code with deferreds
Back when deferred_cb stuff had its own queue, the queue was always
executed, but we never ran more than 16 callbacks per iteration.
That made for two problems:
1: Because deferred_cb stuff would always run, and had no priority,
it could cause priority inversion.
2: It doesn't respect the max_dispatch_interval code.
Then, when I refactored deferred_cb to be a special case of
event_callback, that solved the above issues, but made for two more
issues:
3: Because deferred_cb stuff would always get the default priority,
it could could low-priority bufferevents to get too much priority.
4: With code like bufferevent_pair, it's easy to get into a
situation where two deferreds keep adding one another, preventing
the event loop from ever actually scanning for more events.
This commit fixes the above by giving deferreds a better notion of
priorities, and by limiting the number of deferreds that can be
added to the _current_ loop iteration's active queues. (Extra
deferreds are put into the active_later state.)
That isn't an all-purpose priority inversion solution, of course: for
that, you may need to mess around with max_dispatch_interval.
|
|
|
a4079aa8
|
2012-04-06T11:05:35
|
|
Replace more deferred_cb names with event_callback
|
|
|
ae2b84b2
|
2012-04-06T04:33:19
|
|
Replace deferred_cbs with event_callback-based implementation.
|
|
|
4b70286e
|
2012-05-02T17:12:23
|
|
Merge remote-tracking branch 'origin/patches-2.0'
Conflicts:
ChangeLog
README
evdns.c
sample/dns-example.c
|
|
|
265e6779
|
2012-05-02T16:52:27
|
|
Fix evdns build with threads disabled
The last evdns change apparently broke it, by using a "base"
variable that we were only declaring with threads turned on.
|
|
|
3d9e52ac
|
2012-05-01T19:52:55
|
|
When retransmitting a timed-out DNS request, pick a fresh nameserver.
Otherwise, requests initially sent to a failing nameserver would
stay there indefinitely, even if other nameservers would work.
Fix for sourceforge bug 3518439
|
|
|
d873d678
|
2012-05-01T19:52:49
|
|
Make some evdns.c debug logs more verbose
|
|
|
3f659e5a
|
2012-04-19T11:14:58
|
|
Merge remote-tracking branch 'origin/patches-2.0'
|