scapy icon indicating copy to clipboard operation
scapy copied to clipboard

DNS answering machines throw `AttributeError` when they receive malformed queries

Open evverx opened this issue 1 year ago • 0 comments

Brief description

Malformed DNS queries like

>>> DNS(b'q\xa04\x00\x00\xa0\x01\x00\xf3\x00\x01\x04\x01y').qd
INFO: DNS RR prematured end (ofs=2, len=2)
[<Raw  load=b'\x01y' |>]

cause DNS/LLMNR answering machines to throw AttributeError.

Scapy version

a8d2bb7d1ad68b3442533fecb0510b3c02316950

Python version

Python 3.11.4

Operating system

Linux version 6.4.7-100.fc37.x86_64

Additional environment information

No response

How to reproduce

The issue can be reproduced by launching DNS/LLMNR answering machines and sending the malformed queries but it can be reduced to the following unit test:

DNS_am().make_reply(Ether()/IP()/UDP()/DNS(b'q\xa04\x00\x00\xa0\x01\x00\xf3\x00\x01\x04\x01y'))

Actual result

Traceback (most recent call last):                                                                                                                                                
    am()                                                                                                                                                                          
  File "scapy/ansmachine.py", line 211, in __call__                                                                                                         
    self.sniff()                                                                                                                                                                  
  File "scapy/ansmachine.py", line 217, in sniff                                                                                                            
    sniff(**self.optsniff)
  File "scapy/sendrecv.py", line 1311, in sniff 
    sniffer._run(*args, **kwargs)
  File "scapy/sendrecv.py", line 1254, in _run
    session.on_packet_received(p)                                                        
  File "scapy/sessions.py", line 109, in on_packet_received
    result = self.prn(pkt)
             ^^^^^^^^^^^^^                                                               
  File "scapy/ansmachine.py", line 173, in reply
    reply = self.make_reply(pkt)
            ^^^^^^^^^^^^^^^^^^^^
  File "scapy/layers/dns.py", line 1268, in make_reply
    if rq.qtype in [1, 28]:
       ^^^^^^^^
  File "scapy/packet.py", line 469, in __getattr__
    return self.payload.__getattr__(attr)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "scapy/packet.py", line 467, in __getattr__
    fld, v = self.getfield_and_val(attr)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "scapy/packet.py", line 1793, in getfield_and_val
    raise AttributeError(attr)
AttributeError: qtype

Expected result

I think queries like that should probably be ignored.

Related resources

No response

evverx avatar Aug 08 '23 07:08 evverx