Todo #16905: Encode Dynamic DNS credentials when passed as URL parameters - pfSense - pfSense bugtracker

Actions

Copy link

Todo #16905

closed

Encode Dynamic DNS credentials when passed as URL parameters

Added by Walter Holm 25 days ago. Updated 16 days ago.

Status:

Resolved

Priority:

Normal

Assignee:

Marcos M

Category:

Dynamic DNS

Target version:

2.9.0

Start date:

Due date:

% Done:

100%

Estimated time:

Plus Target Version:

26.07

Release Notes:

Default

Description

Environment:
- pfSense CE 2.8.1
- Dynamic DNS Provider: DNS Made Easy

Issue:
Dynamic DNS updates fail when the Dynamic DNS password contains URL-reserved characters such as '&'.

The Dynamic DNS record is configured correctly and exists on the DNS Made Easy side.

Observed behavior:
pfSense reports authentication failures and the DDNS client status remains failed.

Example response:

Response Data: error-auth
phpDynDNS (<record-id>): (Error) Invalid username or password

Reproduction:

1. Create a Dynamic DNS-enabled A record in DNS Made Easy.
2. Set a Dynamic DNS password containing '&' or other URL-reserved characters.
3. Configure the record in pfSense Dynamic DNS using:
- DNS Made Easy provider
- Record ID
- Dynamic DNS password
4. Force update.

Result:
Update fails with error-auth.

Verification:
Using the same Record ID and Dynamic DNS password outside of pfSense succeeds when the password is URL-encoded.

Example:

curl -G \
--data-urlencode "id=<record-id>" \
--data-urlencode "password=<password>" \
--data-urlencode "ip=<address>" \
https://cp.dnsmadeeasy.com/servlet/updateip

The update succeeds immediately.

Expected:
pfSense should URL-encode Dynamic DNS credentials before constructing the update request.

Actual:
The password appears to be passed without proper URL encoding, causing authentication failures when reserved characters are present.

Workaround:
Use a password containing only URL-safe characters or update the record using an external script that URL-encodes parameters.

Actions

Copy link

Updated by Marcos M 23 days ago

Tracker changed from Bug to Todo
Subject changed from DNS Made Easy Dynamic DNS updates fail when Dynamic DNS password contains URL-reserved characters to Encode Dynamic DNS credentials when passed as URL parameters
Status changed from New to Feedback
Assignee set to Marcos M
Target version set to 2.9.0
% Done changed from 0 to 100
Plus Target Version set to 26.07
Affected Version deleted (~~2.8.1~~)
Affected Architecture deleted (~~amd64~~)

Applied with 8977417fd32b0c5175c1d6c7ca6a898d16c86c2b. Patch: Show Hide

diff --git a/src/etc/inc/dyndns.class b/src/etc/inc/dyndns.class
index 400da73756..5fd732f96d 100644
--- a/src/etc/inc/dyndns.class
+++ b/src/etc/inc/dyndns.class
@@ -800,7 +800,7 @@
                     if ($this->_dnsPort) {
                         $port = ":" . $this->_dnsPort;
                     }
-                    curl_setopt($ch, CURLOPT_URL, $server . $port . '?username=' . urlencode($this->_dnsUser) . '&password=' . $this->_dnsPass . '&host=' . $this->_dnsHost);
+                    curl_setopt($ch, CURLOPT_URL, $server . $port . '?username=' . rawurlencode($this->_dnsUser) . '&password=' . rawurlencode($this->_dnsPass) . '&host=' . $this->_dnsHost);
                     break;
                 case 'ods':
                     $needsIP = FALSE;
@@ -845,19 +845,19 @@
                 case 'freedns':
                 case 'freedns-v6':
                     $needIP = TRUE;
-                    curl_setopt($ch, CURLOPT_URL, 'https://freedns.afraid.org/dynamic/update.php?' . $this->_dnsPass . '&address=' . $this->_dnsIP);
+                    curl_setopt($ch, CURLOPT_URL, 'https://freedns.afraid.org/dynamic/update.php?' . rawurlencode($this->_dnsPass) . '&address=' . $this->_dnsIP);
                     break;
                 case 'freedns2':
                     $needIP = TRUE;
-                    curl_setopt($ch, CURLOPT_URL, 'https://sync.afraid.org/u/' . $this->_dnsPass . '/?hostname=' . $this->_dnsHost . '&myip=' . $this->_dnsIP);
+                    curl_setopt($ch, CURLOPT_URL, 'https://sync.afraid.org/u/' . rawurlencode($this->_dnsPass) . '/?hostname=' . $this->_dnsHost . '&myip=' . $this->_dnsIP);
                     break;
                 case 'freedns2-v6':
                     $needIP = TRUE;
-                    curl_setopt($ch, CURLOPT_URL, 'https://v6.sync.afraid.org/u/' . $this->_dnsPass . '/?hostname=' . $this->_dnsHost . '&myip=' . $this->_dnsIP);
+                    curl_setopt($ch, CURLOPT_URL, 'https://v6.sync.afraid.org/u/' . rawurlencode($this->_dnsPass) . '/?hostname=' . $this->_dnsHost . '&myip=' . $this->_dnsIP);
                     break;
                 case 'dnsexit':
                     $needsIP = TRUE;
-                    curl_setopt($ch, CURLOPT_URL, 'https://api.dnsexit.com/dns/ud/?apikey=' . $this->_dnsPass . '&host=' . $this->_dnsHost . '&ip=' . $this->_dnsIP);
+                    curl_setopt($ch, CURLOPT_URL, 'https://api.dnsexit.com/dns/ud/?apikey=' . rawurlencode($this->_dnsPass) . '&host=' . $this->_dnsHost . '&ip=' . $this->_dnsIP);
                     break;
                 case 'loopia':
                     $needsIP = TRUE;
@@ -886,7 +886,7 @@

                 case 'staticcling':
                     $needsIP = FALSE;
-                    curl_setopt($ch, CURLOPT_URL, 'https://www.staticcling.org/update.html?login=' . $this->_dnsUser . '&pass=' . $this->_dnsPass);
+                    curl_setopt($ch, CURLOPT_URL, 'https://www.staticcling.org/update.html?login=' . rawurlencode($this->_dnsUser) . '&pass=' . urlencode($this->_dnsPass));
                     break;
                 case 'dnsomatic':
                     /* Example syntax
@@ -988,7 +988,7 @@
                         https://dynamicdns.park-your-domain.com/update?host=[host_name]&domain=[domain.com]&password=[domain_password]&ip=[your_ip]
                     */
                     $needsIP = FALSE;
-                    $dnspass = trim($this->_dnsPass);
+                    $dnspass = rawurlencode(trim($this->_dnsPass));
                     $server = "https://dynamicdns.park-your-domain.com/update?host={$this->_dnsHost}&domain={$this->_dnsDomain}&password={$dnspass}&ip={$this->_dnsIP}";
                     curl_setopt($ch, CURLOPT_URL, $server);
                     break;
@@ -1129,7 +1129,7 @@
                     $needsIP = FALSE;
                     $server = "https://dyn.dns.he.net/nic/update?";
                     curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
-                    curl_setopt($ch, CURLOPT_URL, $server . 'hostname=' . $this->_dnsHost . '&password=' . $this->_dnsPass . '&myip=' . $this->_dnsIP);
+                    curl_setopt($ch, CURLOPT_URL, $server . 'hostname=' . $this->_dnsHost . '&password=' . rawurlencode($this->_dnsPass) . '&myip=' . $this->_dnsIP);
                     break;
                 case 'he-net-tunnelbroker':
                     $needsIP = FALSE;
@@ -1268,7 +1268,7 @@
                 case 'gratisdns':
                     $needsIP = TRUE;
                     $server = "https://ssl.gratisdns.dk/ddns.phtml";
-                    curl_setopt($ch, CURLOPT_URL, $server . '?u=' . $this->_dnsUser . '&p=' . $this->_dnsPass . '&h=' . $this->_dnsHost . '&d=' . $this->_dnsDomain . '&i=' . $this->_dnsIP);
+                    curl_setopt($ch, CURLOPT_URL, $server . '?u=' . rawurlencode($this->_dnsUser) . '&p=' . rawurlencode($this->_dnsPass) . '&h=' . $this->_dnsHost . '&d=' . $this->_dnsDomain . '&i=' . $this->_dnsIP);
                     break;
                 case 'ovh-dynhost':
                     $needsIP = FALSE;
@@ -1349,7 +1349,7 @@
                     $needsIP = TRUE;
                     $server = "https://cp.dnsmadeeasy.com/servlet/updateip";
                     $username = empty($this->_dnsUser) ? "" : "&username={$this->_dnsUser}";
-                    curl_setopt($ch, CURLOPT_URL, $server . '?password=' . $this->_dnsPass . '&id=' . $this->_dnsHost . '&ip=' . $this->_dnsIP . $username);
+                    curl_setopt($ch, CURLOPT_URL, $server . '?password=' . rawurlencode($this->_dnsPass) . '&id=' . $this->_dnsHost . '&ip=' . $this->_dnsIP . $username);
                     break;
                 case 'spdyn':
                 case 'spdyn-v6':
@@ -1798,11 +1798,11 @@
                     break;
                 case 'dynv6':
                     $needIP = TRUE;
-                    curl_setopt($ch, CURLOPT_URL, 'https://dynv6.com/api/update?ipv4=' . $this->_dnsIP . '&hostname=' . $this->_dnsHost . '&token=' . $this->_dnsPass);
+                    curl_setopt($ch, CURLOPT_URL, 'https://dynv6.com/api/update?ipv4=' . $this->_dnsIP . '&hostname=' . $this->_dnsHost . '&token=' . rawurlencode($this->_dnsPass));
                     break;
                 case 'dynv6-v6':
                     $needIP = TRUE;
-                    curl_setopt($ch, CURLOPT_URL, 'https://dynv6.com/api/update?ipv6=' . $this->_dnsIP . '&hostname=' . $this->_dnsHost . '&token=' . $this->_dnsPass);
+                    curl_setopt($ch, CURLOPT_URL, 'https://dynv6.com/api/update?ipv6=' . $this->_dnsIP . '&hostname=' . $this->_dnsHost . '&token=' . rawurlencode($this->_dnsPass));
                     break;
                 case 'gandi-livedns':
                 case 'gandi-livedns-v6':