storm/minidlna
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

upnphttp: Improve DNS rebinding attack protection

Browse Source 
Detect invalid IP addresses in the Host field and reject as needed.
This commit is contained in:
Justin Maggard 2022-08-29 22:36:08 -07:00
parent f35304a5d2
commit f140859351
1 changed files with 20 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
upnphttp.c
View File

@ -915,15 +915,29 @@ ProcessHttpQuery_upnphttp(struct upnphttp * h)
DPRINTF(E_DEBUG, L_HTTP, "HTTP REQUEST: %.*s\n", h->req_buflen, h->req_buf);
if(h->req_Host && h->req_HostLen > 0) {
const char *ptr = h->req_Host;
const char *port = memchr(h->req_Host, ':', h->req_HostLen);
size_t ip_sz = port ? (port - h->req_Host) : h->req_HostLen;
struct in_addr addr;
char ip_buf[16];
DPRINTF(E_MAXDEBUG, L_HTTP, "Host: %.*s\n", h->req_HostLen, h->req_Host);
for(i = 0; i < h->req_HostLen; i++) {
if(*ptr != ':' && *ptr != '.' && (*ptr > '9' || *ptr < '0')) {
DPRINTF(E_ERROR, L_HTTP, "DNS rebinding attack suspected (Host: %.*s)", h->req_HostLen, h->req_Host);
Send404(h);/* 403 */
if (port) {
const char *ptr = port + 1;
for (i = ip_sz + 2; i < h->req_HostLen; i++) {
if (*ptr > '9' || *ptr < '0')
break;
ptr++;
}
if (i != h->req_HostLen || atoi(port + 1) > 65535) {
DPRINTF(E_ERROR, L_HTTP, "DNS rebinding attack suspected (Host: %.*s)\n", h->req_HostLen, h->req_Host);
Send400(h);
return;
}
ptr++;
}
strncpyt(ip_buf, h->req_Host, MIN(ip_sz + 1, sizeof(ip_buf)));
if (ip_sz >= sizeof(ip_buf) || inet_pton(AF_INET, ip_buf, &addr) <= 0 || !addr.s_addr) {
DPRINTF(E_ERROR, L_HTTP, "DNS rebinding attack suspected (Host: %.*s)\n", h->req_HostLen, h->req_Host);
Send400(h);
return;
}
}
if(strcmp("POST", HttpCommand) == 0)