Bug ID 556560: DNS messages may become malformed if the Additional section contains an OPT record followed by multiple records.

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP GTM(all modules)

Known Affected Versions:
11.6.0, 12.0.0, 12.0.0 HF1, 12.1.0 HF1, 12.0.0 HF2, 12.1.0 HF2, 12.1.1 HF1, 12.1.1 HF2, 12.1.2 HF1, 12.1.2 HF2

Fixed In:
12.1.0, 12.0.0 HF3, 11.6.1, 11.5.4 HF2

Opened: Nov 06, 2015

Severity: 3-Major

Related Article: K80741043

Symptoms

A DNS message may become malformed when its Additional records section contains an OPT record followed by multiple other DNS records. As a result of this issue, you may encounter the following symptom: The BIG-IP system receives properly formed DNS packets but after processing them sends them as malformed DNS packets.

Impact

This issue impacts all DNS messages that contain an OPT record followed by more than one record. The DNS handling code expects a message containing an OPT record to have 0 or 1 TSIG record following the OPT record in the additional record section of a message. The RFCs permit the OPT record to be placed anywhere in the additional record section of a DNS message, with the exception of a TSIG record. If a TSIG record is present, it must always be last. If no TSIG record is present, then an OPT record can be last. The RFCs do not restrict a query from containing records in the additional record section of the message. When a DNS query or response is passed through the TMM DNS message handler, and that message contains an OPT record followed by more than one record, and those records that follow the OPT record contain compression pointers to other records that also follow the OPT record, then the message becomes mangled.

Conditions

This issue occurs when all of the following conditions are met: -- Your BIG-IP configuration contains a virtual server with an associated DNS profile. -- The BIG-IP system receives a DNS message that contains an OPT record. -- The DNS message's Additional records section contains multiple other DNS records.

Workaround

Disable DNS compression on the resolver, or configure the resolver to place OPT records at the end of the additional section (except TSIG records which must always be last).

Fix Information

DNS messages which contain a record other than TSIG following an OPT record in the additional record section will be transformed in the message handler and the message inspection will be restarted. The transformation involves safely moving the OPT record to be last or second-to-last (in the presence of a TSIG record) position of the additional record section. 'Safely' means updating the relevant compression pointers. The subsequent code paths which depend on the OPT record's position now work as expected.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips