Ticket #21 (closed defect: fixed)

Opened 3 years ago

Last modified 3 weeks ago

Avahi daemon dies on certain hostnames

Reported by: IvanSanchez Assigned to: lennart
Priority: major Milestone: Avahi 0.6.10
Component: avahi-core Version:
Keywords: Cc:

Description

If a (un)intentionally malformed mDNS response packet is received by avahi-daemon, it will die. Such a mDNS response packet contains a domain name with "strange" characters (for example, "fóobar.local" - notice the acute in "ó"). See attached ethereal capture for an example.

How to reproduce: set up a device in the local network that identifies itself as "fóobar.local", then run "avahi-browse -at". An example of devices that allow such names are the Axis IP cameras, that can be configured via HTTP to do so ("wget http://{camera_ip_address}/axis-cgi/admin/param.cgi?action=update&Network.Bonjour.FriendlyName=fóobar").

Symptoms: "avahi-browse -at" dies with the following error message if there are no more devices in the local network: Client failure, exiting: Daemon connection failed 17956: arguments to dbus_connection_get_is_connected() were incorrect, assertion "connection != NULL" failed in file dbus-connection.c line 1984. This is normally a bug in some application using the D-BUS library. Or with this error message if there are more devices: avahi_service_browser_new() failed: Daemon not running

In either case, the avahi-daemon processes die (the dbus-daemon remains alive), and the following line gets into the syslog: Mar 21 18:17:45 localhost avahi-daemon[17964]: Disconnnected from D-BUS, terminating...

In the same scenario, Bonjour seems to ignore those "strange" characters in the domain name (i.e. "fóobar.local" becomes "fobar.local"). It's worth noting that blank spaces in the domain name remain intact.

Related discussion on the mailing list: http://lists.freedesktop.org/archives/avahi/2006-March/000586.html

Attachments

ethereal_capture.png (10.0 kB) - added by IvanSanchez on 03/21/06 18:36:29.
ethereal capture of "killer" mDNS response
avahi-daemon_strace.txt (2.7 kB) - added by IvanSanchez on 03/21/06 18:37:12.
strace of avahi-daemon before dying
ethereal_capture_mac.png (30.2 kB) - added by IvanSanchez on 04/07/06 13:14:45.
An iBook named "fóobar" mDNS response, does not kill avahi

Change History

03/21/06 18:36:29 changed by IvanSanchez

  • attachment ethereal_capture.png added.

ethereal capture of "killer" mDNS response

03/21/06 18:37:12 changed by IvanSanchez

  • attachment avahi-daemon_strace.txt added.

strace of avahi-daemon before dying

03/22/06 12:54:48 changed by anonymous

  • milestone set to Avahi 0.6.10.

04/01/06 00:47:34 changed by lennart

  • status changed from new to assigned.

Actually Avahi never does any UTF8 validity checks. Hence, if some other host registers a service with broken UTF8 and avahi passes info about this service over DBUS avahi will die. That opens avahi for easy DoS attacks. Humm. That sucks. DBUS shouldn't make UTF8 validity tests like that.

I will investigate this futher.

04/07/06 13:14:45 changed by IvanSanchez

  • attachment ethereal_capture_mac.png added.

An iBook named "fóobar" mDNS response, does not kill avahi

04/23/06 15:43:53 changed by lennart

  • component changed from avahi-daemon to avahi-core.

04/24/06 02:32:28 changed by lennart

(In [1194]) strip characters that are not in the set [a-zA-Z0-9-] from the local host name before using it in mDNS. (see #21)

04/24/06 23:52:35 changed by lennart

(In [1202]) add an utf8 check when unescaping domains - essentially this means that all domain related functions will now consider strings with invalid utf8 as invalid (see #21)

04/25/06 00:02:25 changed by lennart

Ivan, could you please test current SVN of Avahi if it detects the invalid UTF8 hostnames properly now? It should simply print a message to syslog and ignore the records. I would like to close this bug now.

04/30/06 01:49:44 changed by lennart

Ivan, any updates on this?

05/03/06 11:50:30 changed by IvanSanchez

  • status changed from assigned to closed.
  • resolution set to fixed.

Lennart,

Recent SVN versions (2006-04-25) of avahi work as expected. Avahi-daemon doesn't die, and hosts with invalid hostnames are ignored.

And yes: avahi-daemon prints the "server.c: Packet too short or invalid while reading response record. (Maybe an UTF8 problem?)" error message.