* Strip null bytes from qname and answer fields before PostgreSQL insert
DNS query data can contain null bytes (0x00) from malformed or adversarial
packets. PostgreSQL rejects these in text/varchar columns, causing batch
insert failures with Npgsql.PostgresException (22021).
Sanitize by calling .Replace("\0", "") on qname and answer values in
BulkInsertLogsAsync before passing them as Npgsql parameters.
* Strip null bytes from string fields in MySQL, SQL Server, and SQLite query log apps
Same fix applied to the remaining database logger apps for consistency.
All four apps (PostgreSQL, MySQL, SQL Server, SQLite) now sanitize
null bytes from qname and answer fields before insertion.
* Revert "Strip null bytes from string fields in MySQL, SQL Server, and SQLite query log apps"
This reverts commit 17f25e3a83.
* Remove unnecessary qname sanitization
QNAME cannot contain null bytes per DNS wire format. Only the answer
field (from TXT record RDATA) is affected.
When a client hits the block page, the Block Page App makes a secondary
DNS query to retrieve the EDE blocking info to display (group name,
blocklist URL, etc.). This query went through DirectQueryAsync which
hardcodes IPENDPOINT_ANY_0 (0.0.0.0) as the remote endpoint.
The Advanced Blocking App's networkGroupMap matched 0.0.0.0 against the
catch-all entry, so the blocking info re-query always returned the
catch-all group's response - meaning the group name displayed on the
block page was wrong even though the original block was applied correctly
against the right group.
Added IDnsServer.DirectQueryAsync(DnsDatagram, IPEndPoint, ...) so callers
can supply the real client endpoint. Updated BlockPageApp to pass the
HTTP connection's remote endpoint for the blocking info re-query, so the
correct group is reflected on the page.
* BlockPageApp: fix three bugs in Online Certificate Signing
Pass CA cert as additional cert in SslStreamCertificateContext so the
full chain is included in the TLS handshake for per-domain certs.
Previously null was passed, causing chain validation failures on
clients that did not already have the CA cached.
Clamp certNotBefore to the CA cert NotBefore. The code backdates
per-domain certs by 30 minutes for clock skew tolerance, but if the CA
was created within the last 30 minutes this fell before the CA own
NotBefore and threw ArgumentException, silently falling back to
serving the CA cert as the server cert for up to 30 minutes.
Use X509SignatureGenerator overload of CertificateRequest.Create so
that ECC and ECDSA CA certs are supported. The previous overload
required the CA and CSR to use the same key algorithm, so any ECC CA
failed with ArgumentException.
* BlockPageApp: support {BLOCKING-INFO} substitution when serving from wwwroot
When serveBlockPageFromWebServerRoot is enabled, requests to / and /index.html
were served directly by the static files middleware, bypassing ServeDefaultPageAsync
entirely so {BLOCKING-INFO} was never substituted and the raw placeholder appeared
in the page.
Fix: an interceptor middleware registered before UseStaticFiles catches GET requests
to / and /index.html and routes them through ServeDefaultPageAsync, which now reads
the content from the wwwroot index.html file on disk before performing the substitution.
The default wwwroot/index.html example is updated to include {BLOCKING-INFO} so users
customising the block page can see how to use it.
Shreyas Zare