Robert Edmonds authored 2 years ago and Daniel Salzman committed 2 years ago

Some DNS queries are malformed and generate a FORMERR response from
knot, but when those broken queries are encapsulated with a PROXY v2
header they are simply dropped with no response. This doesn't seem
correct; knot shouldn't be changing its behavior (response vs. no
response) when a PROXY v2 header is added to the query.

Previously, proxyv2_header_strip() was throwing away the knot_pkt_t
result of calling knot_pkt_parse() on the inner, decapsulated query
packet. It looks like this was what was causing the non-response issue,
because the caller couldn't distinguish between the failure of the
proxyv2_header_strip() function (e.g., PROXY v2 signature was wrong) vs.
the knot_pkt_parse() on the inner packet failing.

This commit instead makes sure that the knot_pkt_t result of
knot_pkt_parse() is returned to the caller regardless of the return code
from that function. This causes knot to respond to some kinds of broken
queries that are encapsulated with PROXY v2 in the same way when the
same query is sent as an unencapsulated, bare DNS query packet.

fixes #817

Robert Edmonds authored 2 years ago and Daniel Salzman committed 2 years ago

Previously, sizeof() was being called with a pointer-to-struct type
parameter when checking if the packet was large enough to contain the
PROXY v2 address block structs. This is not correct, since the correct
operand to use in these checks is the size of the structure itself.

fixes #816