Skip to content

Commit

Permalink
ldns-blocking: fix another corner case with suffix matching
Browse files Browse the repository at this point in the history
Ruleset:
```
*.example.com
ru.example.com
```

A query for `xru.example.com` would find `ru.example.com` as the longest
suffix. The expression didn't match since this is neither an exact match
nor a match that stops at a label.

However, this was ignoring the fact that there a different, shorter rule
could match.

This is pretty annoying, as keeping our promise to log the longest match
means that we need at least yet another lookup in that specific case.
Alternatively, the fpst lookup function could be specialized to stop at
labels, but that would defeat the point of this example plugin. So,
perform an extra lookup after striping the first (last, once the name is
reversed) label.
  • Loading branch information
jedisct1 committed Jan 28, 2017
1 parent 502f965 commit e3d43d1
Showing 1 changed file with 18 additions and 0 deletions.
18 changes: 18 additions & 0 deletions src/plugins/example-ldns-blocking/example-ldns-blocking.c
Original file line number Diff line number Diff line change
Expand Up @@ -618,6 +618,24 @@ apply_block_domains(DCPluginDNSPacket *dcp_packet, Blocking * const blocking,
block = 1;
break;
}
if (found_key_len < owner_str_len) {
size_t owner_part_len = owner_str_len;

while (owner_part_len > 0U && rev[owner_part_len] != '.') {
owner_part_len--;
}
rev[owner_part_len] = 0;
if (owner_part_len > 0U && fpst_starts_with_existing_key
(blocking->domains_rev, rev, owner_part_len,
&found_key, &found_block_type)) {
const size_t found_key_len = strlen(found_key);
if (found_key_len <= owner_part_len &&
(rev[found_key_len] == 0 || rev[found_key_len] == '.')) {
block = 1;
break;
}
}
}
}
if (fpst_starts_with_existing_key(blocking->domains,
owner_str, owner_str_len,
Expand Down

0 comments on commit e3d43d1

Please sign in to comment.