mirror of https://github.com/hashicorp/consul
Browse Source
We've already replaced this dependency in `main` and `release/1.18`. Given bumping it is non-trivial on older versions of Consul, instead we can remove the single use of its `dnsutil` package by backporting a portion of the replacing changes. Resolves CVE-2024-0874.zalimeni/net-9229-remove-coredns-1.16
Michael Zalimeni
7 months ago
5 changed files with 118 additions and 5 deletions
@ -0,0 +1,55 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
package dnsutil |
||||
|
||||
import ( |
||||
"net" |
||||
"slices" |
||||
"strings" |
||||
|
||||
"github.com/miekg/dns" |
||||
) |
||||
|
||||
type TranslateAddressAccept int |
||||
|
||||
const ( |
||||
arpaLabel = "arpa" |
||||
arpaIPV4Label = "in-addr" |
||||
arpaIPV6Label = "ip6" |
||||
) |
||||
|
||||
// IPFromARPA returns the net.IP address from a fully-qualified ARPA PTR domain name.
|
||||
// If the address is an invalid format, it returns nil.
|
||||
func IPFromARPA(arpa string) net.IP { |
||||
labels := dns.SplitDomainName(arpa) |
||||
if len(labels) != 6 && len(labels) != 34 { |
||||
return nil |
||||
} |
||||
|
||||
// The last two labels should be "in-addr" or "ip6" and "arpa"
|
||||
if labels[len(labels)-1] != arpaLabel { |
||||
return nil |
||||
} |
||||
|
||||
var ip net.IP |
||||
switch labels[len(labels)-2] { |
||||
case arpaIPV4Label: |
||||
parts := labels[:len(labels)-2] |
||||
slices.Reverse(parts) |
||||
ip = net.ParseIP(strings.Join(parts, ".")) |
||||
case arpaIPV6Label: |
||||
parts := labels[:len(labels)-2] |
||||
slices.Reverse(parts) |
||||
|
||||
// Condense the different words of the address
|
||||
address := strings.Join(parts[0:4], "") |
||||
for i := 4; i <= len(parts)-4; i = i + 4 { |
||||
word := parts[i : i+4] |
||||
address = address + ":" + strings.Join(word, "") |
||||
} |
||||
ip = net.ParseIP(address) |
||||
// default: fallthrough
|
||||
} |
||||
return ip |
||||
} |
||||
@ -0,0 +1,57 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
package dnsutil |
||||
|
||||
import ( |
||||
"net" |
||||
"testing" |
||||
|
||||
"github.com/stretchr/testify/require" |
||||
) |
||||
|
||||
func Test_IPFromARPA(t *testing.T) { |
||||
testCases := []struct { |
||||
name string |
||||
input string |
||||
expected net.IP |
||||
}{ |
||||
{ |
||||
name: "valid ipv4", |
||||
input: "4.3.2.1.in-addr.arpa.", |
||||
expected: net.ParseIP("1.2.3.4"), |
||||
}, |
||||
{ |
||||
name: "valid ipv6", |
||||
input: "b.a.9.8.7.6.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa", |
||||
expected: net.ParseIP("2001:db8::567:89ab"), |
||||
}, |
||||
{ |
||||
name: "invalid subdomain", |
||||
input: "4.3.2.1.addressplz.arpa", |
||||
}, |
||||
{ |
||||
name: "invalid ipv4 - invalid octet", |
||||
input: "277.3.2.1.in-addr.arpa", |
||||
}, |
||||
{ |
||||
name: "invalid ipv4 - too short", |
||||
input: "3.2.1.in-addr.arpa", |
||||
}, |
||||
{ |
||||
name: "invalid ipv6 - invalid hex char", |
||||
input: "x.a.9.8.7.6.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa", |
||||
}, |
||||
{ |
||||
name: "invalid ipv6 - too long", |
||||
input: "d.b.a.9.8.7.6.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa", |
||||
}, |
||||
} |
||||
|
||||
for _, tc := range testCases { |
||||
t.Run(tc.name, func(t *testing.T) { |
||||
actual := IPFromARPA(tc.input) |
||||
require.Equal(t, tc.expected, actual) |
||||
}) |
||||
} |
||||
} |
||||
Loading…
Reference in new issue