Commit 8c02184d authored by Mike Perry's avatar Mike Perry
Browse files

Prevent WebSocket DNS leak. 

This is due to an improper implementation of the WebSocket spec by Mozilla.

"There MUST be no more than one connection in a CONNECTING state.  If multiple
connections to the same IP address are attempted simultaneously, the client
MUST serialize them so that there is no more than one connection at a time
running through the following steps.

If the client cannot determine the IP address of the remote host (for
example, because all communication is being done through a proxy server that
performs DNS queries itself), then the client MUST assume for the purposes of
this step that each host name refers to a distinct remote host,"

https://tools.ietf.org/html/rfc6455#page-15

They implmented the first paragraph, but not the second...

While we're at it, we also prevent the DNS service from being used to look up
anything other than IP addresses if socks_remote_dns is set to true, so this
bug can't turn up in other components or due to 3rd party addons.
parent 81586439

netwerk/dns/nsDNSService2.cpp

+23 −1
Original line number Diff line number Diff line
@@ -388,6 +388,7 @@ nsDNSService::Init() 
    uint32_t lifetimeGracePeriod = 1;

    bool     disableIPv6      = false;

    bool     disablePrefetch  = false;

    bool     disableDNS       = false;

    int      proxyType        = nsIProtocolProxyService::PROXYCONFIG_DIRECT;

    

    nsAdoptingCString ipv4OnlyDomains;
@@ -412,6 +413,10 @@ nsDNSService::Init() 


        // If a manual proxy is in use, disable prefetch implicitly

        prefs->GetIntPref("network.proxy.type", &proxyType);



        // If the user wants remote DNS, we should fail any lookups that still

        // make it here.

        prefs->GetBoolPref("network.proxy.socks_remote_dns", &disableDNS);

    }



    if (mFirstTime) {
@@ -431,7 +436,7 @@ nsDNSService::Init() 


            // Monitor these to see if there is a change in proxy configuration

            // If a manual proxy is in use, disable prefetch implicitly

            prefs->AddObserver("network.proxy.type", this, false);

            prefs->AddObserver("network.proxy.", this, false);

        }

    }
@@ -456,6 +461,7 @@ nsDNSService::Init() 
        mIDN = idn;

        mIPv4OnlyDomains = ipv4OnlyDomains; // exchanges buffer ownership

        mDisableIPv6 = disableIPv6;

        mDisableDNS = disableDNS;



        // Disable prefetching either by explicit preference or if a manual proxy is configured 

        mDisablePrefetch = disablePrefetch || (proxyType == nsIProtocolProxyService::PROXYCONFIG_MANUAL);
@@ -602,6 +608,14 @@ nsDNSService::AsyncResolve(const nsACString &hostname, 
        if (mDisablePrefetch && (flags & RESOLVE_SPECULATE))

            return NS_ERROR_DNS_LOOKUP_QUEUE_FULL;



        PRNetAddr tempAddr;

        if (mDisableDNS) {

            // Allow IP lookups through, but nothing else.

            if (PR_StringToNetAddr(hostname.BeginReading(), &tempAddr) != PR_SUCCESS) {

                return NS_ERROR_UNKNOWN_PROXY_HOST; // XXX: NS_ERROR_NOT_IMPLEMENTED?

            }

        }



        res = mResolver;

        idn = mIDN;

        localDomain = mLocalDomains.GetEntry(hostname);
@@ -714,6 +728,14 @@ nsDNSService::Resolve(const nsACString &hostname, 
    if (mOffline)

        flags |= RESOLVE_OFFLINE;



    PRNetAddr tempAddr;

    if (mDisableDNS) {

        // Allow IP lookups through, but nothing else.

        if (PR_StringToNetAddr(hostname.BeginReading(), &tempAddr) != PR_SUCCESS) {

            return NS_ERROR_UNKNOWN_PROXY_HOST; // XXX: NS_ERROR_NOT_IMPLEMENTED?

        }

    }



    const nsACString *hostPtr = &hostname;



    if (localDomain) {

netwerk/dns/nsDNSService2.h

+1 −0
Original line number Diff line number Diff line
@@ -44,6 +44,7 @@ private: 
    bool                      mDisableIPv6;

    bool                      mDisablePrefetch;

    bool                      mFirstTime;

    bool                      mDisableDNS;

    bool                      mOffline;

    nsTHashtable<nsCStringHashKey> mLocalDomains;

};

netwerk/protocol/websocket/WebSocketChannel.cpp

+6 −2
Original line number Diff line number Diff line
@@ -2202,8 +2202,12 @@ WebSocketChannel::ApplyForAdmission() 
  LOG(("WebSocketChannel::ApplyForAdmission: checking for concurrent open\n"));

  nsCOMPtr<nsIThread> mainThread;

  NS_GetMainThread(getter_AddRefs(mainThread));

  dns->AsyncResolve(hostName, 0, this, mainThread, getter_AddRefs(mDNSRequest));

  NS_ENSURE_SUCCESS(rv, rv);

  rv = dns->AsyncResolve(hostName, 0, this, mainThread, getter_AddRefs(mDNSRequest));

  if (NS_FAILED(rv)) {

      // Fall back to hostname on dispatch failure

      mDNSRequest = nullptr;

      OnLookupComplete(nullptr, nullptr, rv);

  }



  return NS_OK;

}