Invalid A records may DoS updates to a zone
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Designate |
Fix Released
|
Critical
|
Graham Hayes |
Bug Description
The API and OSC client allow to create records containing an IPv4 address with octal integer part, like 10.11.12.01.
openstack recordset create test2.org. srv01.test2.org. --type A --record 10.11.12.01
+------
| Field | Value |
+------
| action | CREATE |
| created_at | 2018-04-
| description | None |
| id | 35a64eaa-
| name | srv01.test2.org. |
| project_id | f935a519f8f24b8
| records | 10.11.12.01 |
| status | PENDING |
| ttl | None |
| type | A |
| updated_at | None |
| version | 1 |
| zone_id | 1ebd4a75-
| zone_name | test2.org. |
+------
However eventlet doesn't allow addresses with leading zeroes, causing this and all subsequent zone updates to fail in mdns:
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
Apr 03 09:55:20 jh-devstack-02 designate-
This situation continues until the "broken" recordset is deleted.
Changed in designate: | |
importance: | Undecided → Critical |
milestone: | none → 7.0.0.0b1 |
no longer affects: | designate/ocata |
no longer affects: | designate/pike |
no longer affects: | designate/queens |
no longer affects: | designate/rocky |
OK - confirmed that both dnspython and eventlet explicitly block leading zeros on octets.
I think this needs to be a 2 part fix:
- one commit to update the designate objects validation to catch the leading zeros (no backport)
- one commit that does one or both of:
- Strips out leading zeros in mdns before passing to dnspython
- Fixes all records in the DB to remove the leading zeros. (probably an extra designate-manage subcommand)
I am going to set this public, as it only affects the project that creates the record, and they have a way to fix it without admin intervention.