Compare commits
No commits in common. "c8-beta" and "c8" have entirely different histories.
46
SOURCES/bind-9.11-CVE-2023-2828-fixup.patch
Normal file
46
SOURCES/bind-9.11-CVE-2023-2828-fixup.patch
Normal file
@ -0,0 +1,46 @@
|
||||
From 6c26ede8edcb700caca12c501c6c129801989526 Mon Sep 17 00:00:00 2001
|
||||
From: Mark Andrews <marka@isc.org>
|
||||
Date: Fri, 23 Feb 2024 10:12:47 +1100
|
||||
Subject: [PATCH] Do not use header_prev in expire_lru_headers
|
||||
|
||||
dns__cacherbt_expireheader can unlink / free header_prev underneath
|
||||
it. Use ISC_LIST_TAIL after calling dns__cacherbt_expireheader
|
||||
instead to get the next pointer to be processed.
|
||||
|
||||
(cherry picked from commit 7ce2e86024f022decb2678963538515ca39ab4ab)
|
||||
(cherry picked from commit f88f21b7d890eb80097f4bd434fedb29c2f9ff63)
|
||||
---
|
||||
lib/dns/rbtdb.c | 8 ++++----
|
||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
|
||||
index cc40eaec60..ee59c1b18b 100644
|
||||
--- a/lib/dns/rbtdb.c
|
||||
+++ b/lib/dns/rbtdb.c
|
||||
@@ -10667,19 +10667,19 @@ update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
|
||||
static size_t
|
||||
expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, size_t purgesize,
|
||||
bool tree_locked) {
|
||||
- rdatasetheader_t *header, *header_prev;
|
||||
+ rdatasetheader_t *header;
|
||||
size_t purged = 0;
|
||||
|
||||
for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
|
||||
- header != NULL && purged <= purgesize; header = header_prev)
|
||||
+ header != NULL && purged <= purgesize;
|
||||
+ header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]))
|
||||
{
|
||||
- header_prev = ISC_LIST_PREV(header, link);
|
||||
/*
|
||||
* Unlink the entry at this point to avoid checking it
|
||||
* again even if it's currently used someone else and
|
||||
* cannot be purged at this moment. This entry won't be
|
||||
* referenced any more (so unlinking is safe) since the
|
||||
- * TTL was reset to 0.
|
||||
+ * TTL will be reset to 0.
|
||||
*/
|
||||
ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header, link);
|
||||
size_t header_size = rdataset_size(header);
|
||||
--
|
||||
2.43.2
|
||||
|
193
SOURCES/bind-9.11-CVE-2023-2828.patch
Normal file
193
SOURCES/bind-9.11-CVE-2023-2828.patch
Normal file
@ -0,0 +1,193 @@
|
||||
From f3aa755ba5ae5148dd0567357f8c538072e2eabc Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
|
||||
Date: Tue, 30 May 2023 08:46:17 +0200
|
||||
Subject: [PATCH] Improve RBT overmem cache cleaning
|
||||
|
||||
When cache memory usage is over the configured cache size (overmem) and
|
||||
we are cleaning unused entries, it might not be enough to clean just two
|
||||
entries if the entries to be expired are smaller than the newly added
|
||||
rdata. This could be abused by an attacker to cause a remote Denial of
|
||||
Service by possibly running out of the operating system memory.
|
||||
|
||||
Currently, the addrdataset() tries to do a single TTL-based cleaning
|
||||
considering the serve-stale TTL and then optionally moves to overmem
|
||||
cleaning if we are in that condition. Then the overmem_purge() tries to
|
||||
do another single TTL based cleaning from the TTL heap and then continue
|
||||
with LRU-based cleaning up to 2 entries cleaned.
|
||||
|
||||
Squash the TTL-cleaning mechanism into single call from addrdataset(),
|
||||
but ignore the serve-stale TTL if we are currently overmem.
|
||||
|
||||
Then instead of having a fixed number of entries to clean, pass the size
|
||||
of newly added rdatasetheader to the overmem_purge() function and
|
||||
cleanup at least the size of the newly added data. This prevents the
|
||||
cache going over the configured memory limit (`max-cache-size`).
|
||||
|
||||
Additionally, refactor the overmem_purge() function to reduce for-loop
|
||||
nesting for readability.
|
||||
---
|
||||
lib/dns/rbtdb.c | 109 +++++++++++++++++++++++++++++-------------------
|
||||
1 file changed, 67 insertions(+), 42 deletions(-)
|
||||
|
||||
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
|
||||
index 11203e4..cc40eae 100644
|
||||
--- a/lib/dns/rbtdb.c
|
||||
+++ b/lib/dns/rbtdb.c
|
||||
@@ -834,7 +834,7 @@ static void update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
|
||||
static void expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
|
||||
bool tree_locked, expire_t reason);
|
||||
static void overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start,
|
||||
- isc_stdtime_t now, bool tree_locked);
|
||||
+ size_t purgesize, bool tree_locked);
|
||||
static isc_result_t resign_insert(dns_rbtdb_t *rbtdb, int idx,
|
||||
rdatasetheader_t *newheader);
|
||||
static void resign_delete(dns_rbtdb_t *rbtdb, rbtdb_version_t *version,
|
||||
@@ -6937,6 +6937,16 @@ addclosest(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
|
||||
|
||||
static dns_dbmethods_t zone_methods;
|
||||
|
||||
+static size_t
|
||||
+rdataset_size(rdatasetheader_t *header) {
|
||||
+ if (!NONEXISTENT(header)) {
|
||||
+ return (dns_rdataslab_size((unsigned char *)header,
|
||||
+ sizeof(*header)));
|
||||
+ }
|
||||
+
|
||||
+ return (sizeof(*header));
|
||||
+}
|
||||
+
|
||||
static isc_result_t
|
||||
addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
|
||||
isc_stdtime_t now, dns_rdataset_t *rdataset, unsigned int options,
|
||||
@@ -7091,7 +7101,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
|
||||
}
|
||||
|
||||
if (cache_is_overmem)
|
||||
- overmem_purge(rbtdb, rbtnode->locknum, now, tree_locked);
|
||||
+ overmem_purge(rbtdb, rbtnode->locknum, rdataset_size(newheader),
|
||||
+ tree_locked);
|
||||
|
||||
NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
|
||||
isc_rwlocktype_write);
|
||||
@@ -7106,9 +7117,19 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
|
||||
cleanup_dead_nodes(rbtdb, rbtnode->locknum);
|
||||
|
||||
header = isc_heap_element(rbtdb->heaps[rbtnode->locknum], 1);
|
||||
- if (header && header->rdh_ttl < now - RBTDB_VIRTUAL)
|
||||
- expire_header(rbtdb, header, tree_locked,
|
||||
- expire_ttl);
|
||||
+ if (header != NULL) {
|
||||
+ dns_ttl_t rdh_ttl = header->rdh_ttl;
|
||||
+
|
||||
+ /* Only account for stale TTL if cache is not overmem */
|
||||
+ if (!cache_is_overmem) {
|
||||
+ rdh_ttl += rbtdb->serve_stale_ttl;
|
||||
+ }
|
||||
+
|
||||
+ if (rdh_ttl < now - RBTDB_VIRTUAL) {
|
||||
+ expire_header(rbtdb, header, tree_locked,
|
||||
+ expire_ttl);
|
||||
+ }
|
||||
+ }
|
||||
|
||||
/*
|
||||
* If we've been holding a write lock on the tree just for
|
||||
@@ -10643,54 +10664,58 @@ update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
|
||||
ISC_LIST_PREPEND(rbtdb->rdatasets[header->node->locknum], header, link);
|
||||
}
|
||||
|
||||
+static size_t
|
||||
+expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, size_t purgesize,
|
||||
+ bool tree_locked) {
|
||||
+ rdatasetheader_t *header, *header_prev;
|
||||
+ size_t purged = 0;
|
||||
+
|
||||
+ for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
|
||||
+ header != NULL && purged <= purgesize; header = header_prev)
|
||||
+ {
|
||||
+ header_prev = ISC_LIST_PREV(header, link);
|
||||
+ /*
|
||||
+ * Unlink the entry at this point to avoid checking it
|
||||
+ * again even if it's currently used someone else and
|
||||
+ * cannot be purged at this moment. This entry won't be
|
||||
+ * referenced any more (so unlinking is safe) since the
|
||||
+ * TTL was reset to 0.
|
||||
+ */
|
||||
+ ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header, link);
|
||||
+ size_t header_size = rdataset_size(header);
|
||||
+ expire_header(rbtdb, header, tree_locked, expire_lru);
|
||||
+ purged += header_size;
|
||||
+ }
|
||||
+
|
||||
+ return (purged);
|
||||
+}
|
||||
+
|
||||
/*%
|
||||
- * Purge some expired and/or stale (i.e. unused for some period) cache entries
|
||||
- * under an overmem condition. To recover from this condition quickly, up to
|
||||
- * 2 entries will be purged. This process is triggered while adding a new
|
||||
- * entry, and we specifically avoid purging entries in the same LRU bucket as
|
||||
- * the one to which the new entry will belong. Otherwise, we might purge
|
||||
- * entries of the same name of different RR types while adding RRsets from a
|
||||
- * single response (consider the case where we're adding A and AAAA glue records
|
||||
- * of the same NS name).
|
||||
+ * Purge some stale (i.e. unused for some period - LRU based cleaning) cache
|
||||
+ * entries under the overmem condition. To recover from this condition quickly,
|
||||
+ * we cleanup entries up to the size of newly added rdata (passed as purgesize).
|
||||
+ *
|
||||
+ * This process is triggered while adding a new entry, and we specifically avoid
|
||||
+ * purging entries in the same LRU bucket as the one to which the new entry will
|
||||
+ * belong. Otherwise, we might purge entries of the same name of different RR
|
||||
+ * types while adding RRsets from a single response (consider the case where
|
||||
+ * we're adding A and AAAA glue records of the same NS name).
|
||||
*/
|
||||
static void
|
||||
-overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start,
|
||||
- isc_stdtime_t now, bool tree_locked)
|
||||
+overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start, size_t purgesize,
|
||||
+ bool tree_locked)
|
||||
{
|
||||
- rdatasetheader_t *header, *header_prev;
|
||||
unsigned int locknum;
|
||||
- int purgecount = 2;
|
||||
+ size_t purged = 0;
|
||||
|
||||
for (locknum = (locknum_start + 1) % rbtdb->node_lock_count;
|
||||
- locknum != locknum_start && purgecount > 0;
|
||||
+ locknum != locknum_start && purged <= purgesize;
|
||||
locknum = (locknum + 1) % rbtdb->node_lock_count) {
|
||||
NODE_LOCK(&rbtdb->node_locks[locknum].lock,
|
||||
isc_rwlocktype_write);
|
||||
|
||||
- header = isc_heap_element(rbtdb->heaps[locknum], 1);
|
||||
- if (header && header->rdh_ttl < now - RBTDB_VIRTUAL) {
|
||||
- expire_header(rbtdb, header, tree_locked,
|
||||
- expire_ttl);
|
||||
- purgecount--;
|
||||
- }
|
||||
-
|
||||
- for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
|
||||
- header != NULL && purgecount > 0;
|
||||
- header = header_prev) {
|
||||
- header_prev = ISC_LIST_PREV(header, link);
|
||||
- /*
|
||||
- * Unlink the entry at this point to avoid checking it
|
||||
- * again even if it's currently used someone else and
|
||||
- * cannot be purged at this moment. This entry won't be
|
||||
- * referenced any more (so unlinking is safe) since the
|
||||
- * TTL was reset to 0.
|
||||
- */
|
||||
- ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header,
|
||||
- link);
|
||||
- expire_header(rbtdb, header, tree_locked,
|
||||
- expire_lru);
|
||||
- purgecount--;
|
||||
- }
|
||||
+ purged += expire_lru_headers(rbtdb, locknum, purgesize - purged,
|
||||
+ tree_locked);
|
||||
|
||||
NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
|
||||
isc_rwlocktype_write);
|
||||
--
|
||||
2.40.1
|
||||
|
3154
SOURCES/bind-9.11-CVE-2023-4408.patch
Normal file
3154
SOURCES/bind-9.11-CVE-2023-4408.patch
Normal file
File diff suppressed because it is too large
Load Diff
64
SOURCES/bind-9.11-CVE-2023-50387-fixup.patch
Normal file
64
SOURCES/bind-9.11-CVE-2023-50387-fixup.patch
Normal file
@ -0,0 +1,64 @@
|
||||
From f0fc9d7999a94da3d471c4e0a35b1f447f25eea6 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||||
Date: Mon, 26 Feb 2024 21:08:42 +0100
|
||||
Subject: [PATCH] Add normal task queue also to non-thread version
|
||||
|
||||
Non-thread builds are used by us for dhcp package. Make it working
|
||||
again.
|
||||
|
||||
Related to [GL #4424] and [GL #4459].
|
||||
---
|
||||
lib/isc/task.c | 14 ++++++++------
|
||||
1 file changed, 8 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/lib/isc/task.c b/lib/isc/task.c
|
||||
index cc83269..5315b51 100644
|
||||
--- a/lib/isc/task.c
|
||||
+++ b/lib/isc/task.c
|
||||
@@ -1115,7 +1115,7 @@ dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
|
||||
}
|
||||
#else /* USE_WORKER_THREADS */
|
||||
if (total_dispatch_count >= DEFAULT_TASKMGR_QUANTUM ||
|
||||
- empty_readyq(manager))
|
||||
+ empty_readyq(manager, qid))
|
||||
break;
|
||||
#endif /* USE_WORKER_THREADS */
|
||||
XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_TASK,
|
||||
@@ -1318,11 +1318,11 @@ dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
|
||||
}
|
||||
|
||||
#ifndef USE_WORKER_THREADS
|
||||
- ISC_LIST_APPENDLIST(manager->ready_tasks, new_ready_tasks, ready_link);
|
||||
- ISC_LIST_APPENDLIST(manager->ready_priority_tasks, new_priority_tasks,
|
||||
+ ISC_LIST_APPENDLIST(manager->ready_tasks[qid], new_ready_tasks, ready_link);
|
||||
+ ISC_LIST_APPENDLIST(manager->ready_priority_tasks[qid], new_priority_tasks,
|
||||
ready_priority_link);
|
||||
manager->tasks_ready += tasks_ready;
|
||||
- if (empty_readyq(manager))
|
||||
+ if (empty_readyq(manager, qid))
|
||||
manager->mode = isc_taskmgrmode_normal;
|
||||
#endif
|
||||
|
||||
@@ -1713,7 +1713,8 @@ isc__taskmgr_ready(isc_taskmgr_t *manager0) {
|
||||
return (false);
|
||||
|
||||
LOCK(&manager->lock);
|
||||
- is_ready = !empty_readyq(manager);
|
||||
+ is_ready = !empty_readyq(manager, isc_taskqueue_normal) ||
|
||||
+ !empty_readyq(manager, isc_taskqueue_slow);
|
||||
UNLOCK(&manager->lock);
|
||||
|
||||
return (is_ready);
|
||||
@@ -1730,7 +1731,8 @@ isc__taskmgr_dispatch(isc_taskmgr_t *manager0) {
|
||||
if (manager == NULL)
|
||||
return (ISC_R_NOTFOUND);
|
||||
|
||||
- dispatch(manager);
|
||||
+ dispatch(manager, isc_taskqueue_normal);
|
||||
+ dispatch(manager, isc_taskqueue_slow);
|
||||
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
--
|
||||
2.43.2
|
||||
|
737
SOURCES/bind-9.11-CVE-2023-50387.patch
Normal file
737
SOURCES/bind-9.11-CVE-2023-50387.patch
Normal file
@ -0,0 +1,737 @@
|
||||
From 4c20ab54ec503f65d8ee0b863cbf41103d95130a Mon Sep 17 00:00:00 2001
|
||||
From: Mark Andrews <marka@isc.org>
|
||||
Date: Wed, 22 Nov 2023 16:59:03 +1100
|
||||
Subject: [PATCH] Fail the DNSSEC validation on the first failure
|
||||
|
||||
Be more strict when encountering DNSSEC validation failures - fail on
|
||||
the first failure. This will break domains that have DNSSEC signing
|
||||
keys with duplicate key ids, but this is something that's much easier
|
||||
to fix on the authoritative side, so we are just going to be strict
|
||||
on the resolver side where it is causing performance problems.
|
||||
|
||||
(cherry picked from commit 8b7ecba9885e163c07c2dd3e1ceab79b2ba89e34)
|
||||
|
||||
Add normal and slow task queues
|
||||
|
||||
Split the task manager queues into normal and slow task queues, so we
|
||||
can move the tasks that blocks processing for a long time (like DNSSEC
|
||||
validation) into the slow queue which doesn't block fast
|
||||
operations (like responding from the cache). This mitigates the whole
|
||||
class of KeyTrap-like issues.
|
||||
|
||||
(cherry picked from commit db083a21726300916fa0b9fd8a433a796fedf636)
|
||||
|
||||
Don't iterate from start every time we select new signing key
|
||||
|
||||
Improve the selecting of the new signing key by remembering where
|
||||
we stopped the iteration and just continue from that place instead
|
||||
of iterating from the start over and over again each time.
|
||||
|
||||
(cherry picked from commit 75faeefcab47e4f1e12b358525190b4be90f97de)
|
||||
|
||||
Optimize selecting the signing key
|
||||
|
||||
Don't parse the crypto data before parsing and matching the id and the
|
||||
algorithm.
|
||||
|
||||
(cherry picked from commit b38552cca7200a72658e482f8407f57516efc5db)
|
||||
|
||||
6322. [security] Specific DNS answers could cause a denial-of-service
|
||||
condition due to DNS validation taking a long time.
|
||||
(CVE-2023-50387) [GL #4424]
|
||||
|
||||
The same code change also addresses another problem:
|
||||
preparing NSEC3 closest encloser proofs could exhaust
|
||||
available CPU resources. (CVE-2023-50868) [GL #4459]
|
||||
---
|
||||
lib/dns/dst_api.c | 25 ++++--
|
||||
lib/dns/include/dns/validator.h | 1 +
|
||||
lib/dns/include/dst/dst.h | 4 +
|
||||
lib/dns/resolver.c | 2 +-
|
||||
lib/dns/validator.c | 97 +++++++++-----------
|
||||
lib/dns/win32/libdns.def.in | 1 +
|
||||
lib/isc/include/isc/task.h | 11 ++-
|
||||
lib/isc/task.c | 153 ++++++++++++++++++++++----------
|
||||
8 files changed, 186 insertions(+), 108 deletions(-)
|
||||
|
||||
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
|
||||
index 2156384ec1..6bcd99796c 100644
|
||||
--- a/lib/dns/dst_api.c
|
||||
+++ b/lib/dns/dst_api.c
|
||||
@@ -105,6 +105,7 @@ static isc_result_t frombuffer(dns_name_t *name,
|
||||
dns_rdataclass_t rdclass,
|
||||
isc_buffer_t *source,
|
||||
isc_mem_t *mctx,
|
||||
+ bool no_rdata,
|
||||
dst_key_t **keyp);
|
||||
|
||||
static isc_result_t algorithm_status(unsigned int alg);
|
||||
@@ -764,6 +765,13 @@ isc_result_t
|
||||
dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
|
||||
isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
|
||||
{
|
||||
+ return (dst_key_fromdns_ex(name, rdclass, source, mctx, false, keyp));
|
||||
+}
|
||||
+
|
||||
+isc_result_t
|
||||
+dst_key_fromdns_ex(dns_name_t *name, dns_rdataclass_t rdclass,
|
||||
+ isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
|
||||
+ dst_key_t **keyp) {
|
||||
uint8_t alg, proto;
|
||||
uint32_t flags, extflags;
|
||||
dst_key_t *key = NULL;
|
||||
@@ -792,7 +800,7 @@ dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
|
||||
}
|
||||
|
||||
result = frombuffer(name, alg, flags, proto, rdclass, source,
|
||||
- mctx, &key);
|
||||
+ mctx, no_rdata, &key);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
return (result);
|
||||
key->key_id = id;
|
||||
@@ -814,7 +822,7 @@ dst_key_frombuffer(dns_name_t *name, unsigned int alg,
|
||||
REQUIRE(dst_initialized);
|
||||
|
||||
result = frombuffer(name, alg, flags, protocol, rdclass, source,
|
||||
- mctx, &key);
|
||||
+ mctx, false, &key);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
return (result);
|
||||
|
||||
@@ -1915,7 +1923,8 @@ computeid(dst_key_t *key) {
|
||||
static isc_result_t
|
||||
frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
|
||||
unsigned int protocol, dns_rdataclass_t rdclass,
|
||||
- isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
|
||||
+ isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
|
||||
+ dst_key_t **keyp)
|
||||
{
|
||||
dst_key_t *key;
|
||||
isc_result_t ret;
|
||||
@@ -1940,10 +1949,12 @@ frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
|
||||
return (DST_R_UNSUPPORTEDALG);
|
||||
}
|
||||
|
||||
- ret = key->func->fromdns(key, source);
|
||||
- if (ret != ISC_R_SUCCESS) {
|
||||
- dst_key_free(&key);
|
||||
- return (ret);
|
||||
+ if (!no_rdata) {
|
||||
+ ret = key->func->fromdns(key, source);
|
||||
+ if (ret != ISC_R_SUCCESS) {
|
||||
+ dst_key_free(&key);
|
||||
+ return (ret);
|
||||
+ }
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/lib/dns/include/dns/validator.h b/lib/dns/include/dns/validator.h
|
||||
index cc4478d6d4..b4bf8f29db 100644
|
||||
--- a/lib/dns/include/dns/validator.h
|
||||
+++ b/lib/dns/include/dns/validator.h
|
||||
@@ -160,6 +160,7 @@ struct dns_validator {
|
||||
unsigned int depth;
|
||||
unsigned int authcount;
|
||||
unsigned int authfail;
|
||||
+ bool failed;
|
||||
isc_stdtime_t start;
|
||||
};
|
||||
|
||||
diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
|
||||
index 180c841307..a8be2daf67 100644
|
||||
--- a/lib/dns/include/dst/dst.h
|
||||
+++ b/lib/dns/include/dst/dst.h
|
||||
@@ -435,6 +435,10 @@ dst_key_tofile(const dst_key_t *key, int type, const char *directory);
|
||||
*/
|
||||
|
||||
isc_result_t
|
||||
+dst_key_fromdns_ex(dns_name_t *name, dns_rdataclass_t rdclass,
|
||||
+ isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
|
||||
+ dst_key_t **keyp);
|
||||
+isc_result_t
|
||||
dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
|
||||
isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);
|
||||
/*%<
|
||||
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
|
||||
index 4f71f48039..487107614c 100644
|
||||
--- a/lib/dns/resolver.c
|
||||
+++ b/lib/dns/resolver.c
|
||||
@@ -9267,7 +9267,7 @@ dns_resolver_create(dns_view_t *view,
|
||||
if (result != ISC_R_SUCCESS)
|
||||
goto cleanup_buckets;
|
||||
res->buckets[i].task = NULL;
|
||||
- result = isc_task_create(taskmgr, 0, &res->buckets[i].task);
|
||||
+ result = isc_task_create(taskmgr, ISC_TASK_QUANTUM_SLOW, &res->buckets[i].task);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
DESTROYLOCK(&res->buckets[i].lock);
|
||||
goto cleanup_buckets;
|
||||
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
|
||||
index 2a5c3caa6a..0b257fe874 100644
|
||||
--- a/lib/dns/validator.c
|
||||
+++ b/lib/dns/validator.c
|
||||
@@ -1207,6 +1207,12 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
|
||||
* val->key at it.
|
||||
*
|
||||
* If val->key is non-NULL, this returns the next matching key.
|
||||
+ * If val->key is already non-NULL, start searching from the next position in
|
||||
+ * 'rdataset' to find the *next* key that could have signed 'siginfo', then
|
||||
+ * set val->key to that.
|
||||
+ *
|
||||
+ * Returns ISC_R_SUCCESS if a possible matching key has been found,
|
||||
+ * ISC_R_NOTFOUND if not. Any other value indicates error.
|
||||
*/
|
||||
static isc_result_t
|
||||
get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
|
||||
@@ -1216,54 +1222,59 @@ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
|
||||
isc_buffer_t b;
|
||||
dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||
dst_key_t *oldkey = val->key;
|
||||
- bool foundold;
|
||||
+ bool no_rdata = false;
|
||||
|
||||
- if (oldkey == NULL)
|
||||
- foundold = true;
|
||||
- else {
|
||||
- foundold = false;
|
||||
+ if (oldkey == NULL) {
|
||||
+ result = dns_rdataset_first(rdataset);
|
||||
+ } else {
|
||||
+ dst_key_free(&oldkey);
|
||||
val->key = NULL;
|
||||
+ result = dns_rdataset_next(rdataset);
|
||||
+ }
|
||||
+
|
||||
+ if (result != ISC_R_SUCCESS) {
|
||||
+ goto done;
|
||||
}
|
||||
|
||||
- result = dns_rdataset_first(rdataset);
|
||||
- if (result != ISC_R_SUCCESS)
|
||||
- goto failure;
|
||||
do {
|
||||
dns_rdataset_current(rdataset, &rdata);
|
||||
|
||||
isc_buffer_init(&b, rdata.data, rdata.length);
|
||||
isc_buffer_add(&b, rdata.length);
|
||||
INSIST(val->key == NULL);
|
||||
- result = dst_key_fromdns(&siginfo->signer, rdata.rdclass, &b,
|
||||
- val->view->mctx, &val->key);
|
||||
+ result = dst_key_fromdns_ex(&siginfo->signer, rdata.rdclass, &b,
|
||||
+ val->view->mctx, no_rdata,
|
||||
+ &val->key);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
if (siginfo->algorithm ==
|
||||
(dns_secalg_t)dst_key_alg(val->key) &&
|
||||
siginfo->keyid ==
|
||||
(dns_keytag_t)dst_key_id(val->key) &&
|
||||
+ (dst_key_flags(val->key) & DNS_KEYFLAG_REVOKE) ==
|
||||
+ 0 &&
|
||||
dst_key_iszonekey(val->key))
|
||||
{
|
||||
- if (foundold) {
|
||||
- /*
|
||||
- * This is the key we're looking for.
|
||||
- */
|
||||
- return (ISC_R_SUCCESS);
|
||||
- } else if (dst_key_compare(oldkey, val->key)) {
|
||||
- foundold = true;
|
||||
- dst_key_free(&oldkey);
|
||||
+ if (no_rdata) {
|
||||
+ /* Retry with full key */
|
||||
+ dns_rdata_reset(&rdata);
|
||||
+ dst_key_free(&val->key);
|
||||
+ no_rdata = false;
|
||||
+ continue;
|
||||
}
|
||||
+ /* This is the key we're looking for. */
|
||||
+ goto done;
|
||||
}
|
||||
dst_key_free(&val->key);
|
||||
}
|
||||
dns_rdata_reset(&rdata);
|
||||
result = dns_rdataset_next(rdataset);
|
||||
+ no_rdata = true;
|
||||
} while (result == ISC_R_SUCCESS);
|
||||
- if (result == ISC_R_NOMORE)
|
||||
- result = ISC_R_NOTFOUND;
|
||||
|
||||
- failure:
|
||||
- if (oldkey != NULL)
|
||||
- dst_key_free(&oldkey);
|
||||
+done:
|
||||
+ if (result == ISC_R_NOMORE) {
|
||||
+ result = ISC_R_NOTFOUND;
|
||||
+ }
|
||||
|
||||
return (result);
|
||||
}
|
||||
@@ -1633,37 +1644,13 @@ validate(dns_validator_t *val, bool resume) {
|
||||
continue;
|
||||
}
|
||||
|
||||
- do {
|
||||
- vresult = verify(val, val->key, &rdata,
|
||||
- val->siginfo->keyid);
|
||||
- if (vresult == ISC_R_SUCCESS)
|
||||
- break;
|
||||
- if (val->keynode != NULL) {
|
||||
- dns_keynode_t *nextnode = NULL;
|
||||
- result = dns_keytable_findnextkeynode(
|
||||
- val->keytable,
|
||||
- val->keynode,
|
||||
- &nextnode);
|
||||
- dns_keytable_detachkeynode(val->keytable,
|
||||
- &val->keynode);
|
||||
- val->keynode = nextnode;
|
||||
- if (result != ISC_R_SUCCESS) {
|
||||
- val->key = NULL;
|
||||
- break;
|
||||
- }
|
||||
- val->key = dns_keynode_key(val->keynode);
|
||||
- if (val->key == NULL)
|
||||
- break;
|
||||
- } else {
|
||||
- if (get_dst_key(val, val->siginfo, val->keyset)
|
||||
- != ISC_R_SUCCESS)
|
||||
- break;
|
||||
- }
|
||||
- } while (1);
|
||||
- if (vresult != ISC_R_SUCCESS)
|
||||
+ vresult = verify(val, val->key, &rdata,
|
||||
+ val->siginfo->keyid);
|
||||
+ if (vresult != ISC_R_SUCCESS) {
|
||||
+ val->failed = true;
|
||||
validator_log(val, ISC_LOG_DEBUG(3),
|
||||
"failed to verify rdataset");
|
||||
- else {
|
||||
+ } else {
|
||||
dns_rdataset_trimttl(event->rdataset,
|
||||
event->sigrdataset,
|
||||
val->siginfo, val->start,
|
||||
@@ -1700,9 +1687,13 @@ validate(dns_validator_t *val, bool resume) {
|
||||
} else {
|
||||
validator_log(val, ISC_LOG_DEBUG(3),
|
||||
"verify failure: %s",
|
||||
- isc_result_totext(result));
|
||||
+ isc_result_totext(vresult));
|
||||
resume = false;
|
||||
}
|
||||
+ if (val->failed) {
|
||||
+ result = ISC_R_NOMORE;
|
||||
+ break;
|
||||
+ }
|
||||
}
|
||||
if (result != ISC_R_NOMORE) {
|
||||
validator_log(val, ISC_LOG_DEBUG(3),
|
||||
diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
|
||||
index f597049493..7320653439 100644
|
||||
--- a/lib/dns/win32/libdns.def.in
|
||||
+++ b/lib/dns/win32/libdns.def.in
|
||||
@@ -1439,6 +1439,7 @@ dst_key_format
|
||||
dst_key_free
|
||||
dst_key_frombuffer
|
||||
dst_key_fromdns
|
||||
+dst_key_fromdns_ex
|
||||
dst_key_fromfile
|
||||
dst_key_fromgssapi
|
||||
dst_key_fromlabel
|
||||
diff --git a/lib/isc/include/isc/task.h b/lib/isc/include/isc/task.h
|
||||
index 28e5e25fc6..42f7763869 100644
|
||||
--- a/lib/isc/include/isc/task.h
|
||||
+++ b/lib/isc/include/isc/task.h
|
||||
@@ -98,8 +98,15 @@ ISC_LANG_BEGINDECLS
|
||||
***/
|
||||
|
||||
typedef enum {
|
||||
- isc_taskmgrmode_normal = 0,
|
||||
- isc_taskmgrmode_privileged
|
||||
+ isc_taskqueue_normal = 0,
|
||||
+ isc_taskqueue_slow = 1,
|
||||
+} isc_taskqueue_t;
|
||||
+
|
||||
+#define ISC_TASK_QUANTUM_SLOW 1024
|
||||
+
|
||||
+typedef enum {
|
||||
+ isc_taskmgrmode_normal = 0,
|
||||
+ isc_taskmgrmode_privileged
|
||||
} isc_taskmgrmode_t;
|
||||
|
||||
/*% Task and task manager methods */
|
||||
diff --git a/lib/isc/task.c b/lib/isc/task.c
|
||||
index 048639350b..cc83269df2 100644
|
||||
--- a/lib/isc/task.c
|
||||
+++ b/lib/isc/task.c
|
||||
@@ -107,6 +107,7 @@ struct isc__task {
|
||||
isc_eventlist_t on_shutdown;
|
||||
unsigned int nevents;
|
||||
unsigned int quantum;
|
||||
+ unsigned int qid;
|
||||
unsigned int flags;
|
||||
isc_stdtime_t now;
|
||||
isc_time_t tnow;
|
||||
@@ -141,11 +142,11 @@ struct isc__taskmgr {
|
||||
/* Locked by task manager lock. */
|
||||
unsigned int default_quantum;
|
||||
LIST(isc__task_t) tasks;
|
||||
- isc__tasklist_t ready_tasks;
|
||||
- isc__tasklist_t ready_priority_tasks;
|
||||
+ isc__tasklist_t ready_tasks[2];
|
||||
+ isc__tasklist_t ready_priority_tasks[2];
|
||||
isc_taskmgrmode_t mode;
|
||||
#ifdef ISC_PLATFORM_USETHREADS
|
||||
- isc_condition_t work_available;
|
||||
+ isc_condition_t work_available[2];
|
||||
isc_condition_t exclusive_granted;
|
||||
isc_condition_t paused;
|
||||
#endif /* ISC_PLATFORM_USETHREADS */
|
||||
@@ -247,13 +248,13 @@ isc_taskmgrmode_t
|
||||
isc__taskmgr_mode(isc_taskmgr_t *manager0);
|
||||
|
||||
static inline bool
|
||||
-empty_readyq(isc__taskmgr_t *manager);
|
||||
+empty_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid);
|
||||
|
||||
static inline isc__task_t *
|
||||
-pop_readyq(isc__taskmgr_t *manager);
|
||||
+pop_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid);
|
||||
|
||||
static inline void
|
||||
-push_readyq(isc__taskmgr_t *manager, isc__task_t *task);
|
||||
+push_readyq(isc__taskmgr_t *manager, isc__task_t *task, isc_taskqueue_t qid);
|
||||
|
||||
static struct isc__taskmethods {
|
||||
isc_taskmethods_t methods;
|
||||
@@ -324,7 +325,8 @@ task_finished(isc__task_t *task) {
|
||||
* any idle worker threads so they
|
||||
* can exit.
|
||||
*/
|
||||
- BROADCAST(&manager->work_available);
|
||||
+ BROADCAST(&manager->work_available[isc_taskqueue_normal]);
|
||||
+ BROADCAST(&manager->work_available[isc_taskqueue_slow]);
|
||||
}
|
||||
#endif /* USE_WORKER_THREADS */
|
||||
UNLOCK(&manager->lock);
|
||||
@@ -364,7 +366,13 @@ isc__task_create(isc_taskmgr_t *manager0, unsigned int quantum,
|
||||
INIT_LIST(task->events);
|
||||
INIT_LIST(task->on_shutdown);
|
||||
task->nevents = 0;
|
||||
- task->quantum = quantum;
|
||||
+ if (quantum >= ISC_TASK_QUANTUM_SLOW) {
|
||||
+ task->qid = isc_taskqueue_slow;
|
||||
+ task->quantum = quantum - ISC_TASK_QUANTUM_SLOW;
|
||||
+ } else {
|
||||
+ task->qid = isc_taskqueue_normal;
|
||||
+ task->quantum = quantum;
|
||||
+ }
|
||||
task->flags = 0;
|
||||
task->now = 0;
|
||||
isc_time_settoepoch(&task->tnow);
|
||||
@@ -476,11 +484,11 @@ task_ready(isc__task_t *task) {
|
||||
|
||||
LOCK(&manager->lock);
|
||||
LOCK(&task->lock);
|
||||
- push_readyq(manager, task);
|
||||
+ push_readyq(manager, task, task->qid);
|
||||
UNLOCK(&task->lock);
|
||||
#ifdef USE_WORKER_THREADS
|
||||
if (manager->mode == isc_taskmgrmode_normal || has_privilege)
|
||||
- SIGNAL(&manager->work_available);
|
||||
+ SIGNAL(&manager->work_available[task->qid]);
|
||||
#endif /* USE_WORKER_THREADS */
|
||||
UNLOCK(&manager->lock);
|
||||
}
|
||||
@@ -961,13 +969,13 @@ isc__task_getcurrenttimex(isc_task_t *task0, isc_time_t *t) {
|
||||
* Caller must hold the task manager lock.
|
||||
*/
|
||||
static inline bool
|
||||
-empty_readyq(isc__taskmgr_t *manager) {
|
||||
+empty_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
|
||||
isc__tasklist_t queue;
|
||||
|
||||
if (manager->mode == isc_taskmgrmode_normal)
|
||||
- queue = manager->ready_tasks;
|
||||
+ queue = manager->ready_tasks[qid];
|
||||
else
|
||||
- queue = manager->ready_priority_tasks;
|
||||
+ queue = manager->ready_priority_tasks[qid];
|
||||
|
||||
return (EMPTY(queue));
|
||||
}
|
||||
@@ -981,18 +989,18 @@ empty_readyq(isc__taskmgr_t *manager) {
|
||||
* Caller must hold the task manager lock.
|
||||
*/
|
||||
static inline isc__task_t *
|
||||
-pop_readyq(isc__taskmgr_t *manager) {
|
||||
+pop_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
|
||||
isc__task_t *task;
|
||||
|
||||
if (manager->mode == isc_taskmgrmode_normal)
|
||||
- task = HEAD(manager->ready_tasks);
|
||||
+ task = HEAD(manager->ready_tasks[qid]);
|
||||
else
|
||||
- task = HEAD(manager->ready_priority_tasks);
|
||||
+ task = HEAD(manager->ready_priority_tasks[qid]);
|
||||
|
||||
if (task != NULL) {
|
||||
- DEQUEUE(manager->ready_tasks, task, ready_link);
|
||||
+ DEQUEUE(manager->ready_tasks[qid], task, ready_link);
|
||||
if (ISC_LINK_LINKED(task, ready_priority_link))
|
||||
- DEQUEUE(manager->ready_priority_tasks, task,
|
||||
+ DEQUEUE(manager->ready_priority_tasks[qid], task,
|
||||
ready_priority_link);
|
||||
}
|
||||
|
||||
@@ -1006,16 +1014,16 @@ pop_readyq(isc__taskmgr_t *manager) {
|
||||
* Caller must hold the task manager lock.
|
||||
*/
|
||||
static inline void
|
||||
-push_readyq(isc__taskmgr_t *manager, isc__task_t *task) {
|
||||
- ENQUEUE(manager->ready_tasks, task, ready_link);
|
||||
+push_readyq(isc__taskmgr_t *manager, isc__task_t *task, isc_taskqueue_t qid) {
|
||||
+ ENQUEUE(manager->ready_tasks[qid], task, ready_link);
|
||||
if ((task->flags & TASK_F_PRIVILEGED) != 0)
|
||||
- ENQUEUE(manager->ready_priority_tasks, task,
|
||||
+ ENQUEUE(manager->ready_priority_tasks[qid], task,
|
||||
ready_priority_link);
|
||||
manager->tasks_ready++;
|
||||
}
|
||||
|
||||
static void
|
||||
-dispatch(isc__taskmgr_t *manager) {
|
||||
+dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
|
||||
isc__task_t *task;
|
||||
#ifndef USE_WORKER_THREADS
|
||||
unsigned int total_dispatch_count = 0;
|
||||
@@ -1094,13 +1102,13 @@ dispatch(isc__taskmgr_t *manager) {
|
||||
* If a pause has been requested, don't do any work
|
||||
* until it's been released.
|
||||
*/
|
||||
- while ((empty_readyq(manager) || manager->pause_requested ||
|
||||
+ while ((empty_readyq(manager, qid) || manager->pause_requested ||
|
||||
manager->exclusive_requested) && !FINISHED(manager))
|
||||
{
|
||||
XTHREADTRACE(isc_msgcat_get(isc_msgcat,
|
||||
ISC_MSGSET_GENERAL,
|
||||
ISC_MSG_WAIT, "wait"));
|
||||
- WAIT(&manager->work_available, &manager->lock);
|
||||
+ WAIT(&manager->work_available[qid], &manager->lock);
|
||||
XTHREADTRACE(isc_msgcat_get(isc_msgcat,
|
||||
ISC_MSGSET_TASK,
|
||||
ISC_MSG_AWAKE, "awake"));
|
||||
@@ -1113,7 +1121,7 @@ dispatch(isc__taskmgr_t *manager) {
|
||||
XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_TASK,
|
||||
ISC_MSG_WORKING, "working"));
|
||||
|
||||
- task = pop_readyq(manager);
|
||||
+ task = pop_readyq(manager, qid);
|
||||
if (task != NULL) {
|
||||
unsigned int dispatch_count = 0;
|
||||
bool done = false;
|
||||
@@ -1278,7 +1286,7 @@ dispatch(isc__taskmgr_t *manager) {
|
||||
*/
|
||||
#ifdef USE_WORKER_THREADS
|
||||
LOCK(&task->lock);
|
||||
- push_readyq(manager, task);
|
||||
+ push_readyq(manager, task, qid);
|
||||
UNLOCK(&task->lock);
|
||||
#else
|
||||
ENQUEUE(new_ready_tasks, task, ready_link);
|
||||
@@ -1297,10 +1305,14 @@ dispatch(isc__taskmgr_t *manager) {
|
||||
* we're stuck. Automatically drop privileges at that
|
||||
* point and continue with the regular ready queue.
|
||||
*/
|
||||
- if (manager->tasks_running == 0 && empty_readyq(manager)) {
|
||||
+ if (manager->tasks_running == 0 && empty_readyq(manager, isc_taskqueue_normal) && empty_readyq(manager, isc_taskqueue_slow)) {
|
||||
manager->mode = isc_taskmgrmode_normal;
|
||||
- if (!empty_readyq(manager))
|
||||
- BROADCAST(&manager->work_available);
|
||||
+ if (!empty_readyq(manager, isc_taskqueue_normal)) {
|
||||
+ BROADCAST(&manager->work_available[isc_taskqueue_normal]);
|
||||
+ }
|
||||
+ if (!empty_readyq(manager, isc_taskqueue_slow)) {
|
||||
+ BROADCAST(&manager->work_available[isc_taskqueue_slow]);
|
||||
+ }
|
||||
}
|
||||
#endif
|
||||
}
|
||||
@@ -1322,13 +1334,37 @@ static isc_threadresult_t
|
||||
#ifdef _WIN32
|
||||
WINAPI
|
||||
#endif
|
||||
-run(void *uap) {
|
||||
+run_normal(void *uap) {
|
||||
isc__taskmgr_t *manager = uap;
|
||||
|
||||
XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
|
||||
ISC_MSG_STARTING, "starting"));
|
||||
|
||||
- dispatch(manager);
|
||||
+ dispatch(manager, isc_taskqueue_normal);
|
||||
+
|
||||
+ XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
|
||||
+ ISC_MSG_EXITING, "exiting"));
|
||||
+
|
||||
+#ifdef OPENSSL_LEAKS
|
||||
+ ERR_remove_state(0);
|
||||
+#endif
|
||||
+
|
||||
+ return ((isc_threadresult_t)0);
|
||||
+}
|
||||
+#endif /* USE_WORKER_THREADS */
|
||||
+
|
||||
+#ifdef USE_WORKER_THREADS
|
||||
+static isc_threadresult_t
|
||||
+#ifdef _WIN32
|
||||
+WINAPI
|
||||
+#endif
|
||||
+run_slow(void *uap) {
|
||||
+ isc__taskmgr_t *manager = uap;
|
||||
+
|
||||
+ XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
|
||||
+ ISC_MSG_STARTING, "starting"));
|
||||
+
|
||||
+ dispatch(manager, isc_taskqueue_slow);
|
||||
|
||||
XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
|
||||
ISC_MSG_EXITING, "exiting"));
|
||||
@@ -1347,7 +1383,8 @@ manager_free(isc__taskmgr_t *manager) {
|
||||
|
||||
#ifdef USE_WORKER_THREADS
|
||||
(void)isc_condition_destroy(&manager->exclusive_granted);
|
||||
- (void)isc_condition_destroy(&manager->work_available);
|
||||
+ (void)isc_condition_destroy(&manager->work_available[isc_taskqueue_normal]);
|
||||
+ (void)isc_condition_destroy(&manager->work_available[isc_taskqueue_slow]);
|
||||
(void)isc_condition_destroy(&manager->paused);
|
||||
isc_mem_free(manager->mctx, manager->threads);
|
||||
#endif /* USE_WORKER_THREADS */
|
||||
@@ -1414,12 +1451,20 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
|
||||
#ifdef USE_WORKER_THREADS
|
||||
manager->workers = 0;
|
||||
manager->threads = isc_mem_allocate(mctx,
|
||||
- workers * sizeof(isc_thread_t));
|
||||
+ 2 * workers * sizeof(isc_thread_t));
|
||||
if (manager->threads == NULL) {
|
||||
result = ISC_R_NOMEMORY;
|
||||
goto cleanup_lock;
|
||||
}
|
||||
- if (isc_condition_init(&manager->work_available) != ISC_R_SUCCESS) {
|
||||
+ if (isc_condition_init(&manager->work_available[isc_taskqueue_normal]) != ISC_R_SUCCESS) {
|
||||
+ UNEXPECTED_ERROR(__FILE__, __LINE__,
|
||||
+ "isc_condition_init() %s",
|
||||
+ isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
|
||||
+ ISC_MSG_FAILED, "failed"));
|
||||
+ result = ISC_R_UNEXPECTED;
|
||||
+ goto cleanup_threads;
|
||||
+ }
|
||||
+ if (isc_condition_init(&manager->work_available[isc_taskqueue_slow]) != ISC_R_SUCCESS) {
|
||||
UNEXPECTED_ERROR(__FILE__, __LINE__,
|
||||
"isc_condition_init() %s",
|
||||
isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
|
||||
@@ -1448,8 +1493,10 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
|
||||
default_quantum = DEFAULT_DEFAULT_QUANTUM;
|
||||
manager->default_quantum = default_quantum;
|
||||
INIT_LIST(manager->tasks);
|
||||
- INIT_LIST(manager->ready_tasks);
|
||||
- INIT_LIST(manager->ready_priority_tasks);
|
||||
+ INIT_LIST(manager->ready_tasks[isc_taskqueue_normal]);
|
||||
+ INIT_LIST(manager->ready_tasks[isc_taskqueue_slow]);
|
||||
+ INIT_LIST(manager->ready_priority_tasks[isc_taskqueue_normal]);
|
||||
+ INIT_LIST(manager->ready_priority_tasks[isc_taskqueue_slow]);
|
||||
manager->tasks_running = 0;
|
||||
manager->tasks_ready = 0;
|
||||
manager->exclusive_requested = false;
|
||||
@@ -1465,7 +1512,19 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
|
||||
* Start workers.
|
||||
*/
|
||||
for (i = 0; i < workers; i++) {
|
||||
- if (isc_thread_create(run, manager,
|
||||
+ if (isc_thread_create(run_normal, manager,
|
||||
+ &manager->threads[manager->workers]) ==
|
||||
+ ISC_R_SUCCESS) {
|
||||
+ char name[21]; /* thread name limit on Linux */
|
||||
+ snprintf(name, sizeof(name), "isc-worker%04u", i);
|
||||
+ isc_thread_setname(manager->threads[manager->workers],
|
||||
+ name);
|
||||
+ manager->workers++;
|
||||
+ started++;
|
||||
+ }
|
||||
+ }
|
||||
+ for (; i < workers * 2; i++) {
|
||||
+ if (isc_thread_create(run_slow, manager,
|
||||
&manager->threads[manager->workers]) ==
|
||||
ISC_R_SUCCESS) {
|
||||
char name[21]; /* thread name limit on Linux */
|
||||
@@ -1482,7 +1541,7 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
|
||||
manager_free(manager);
|
||||
return (ISC_R_NOTHREADS);
|
||||
}
|
||||
- isc_thread_setconcurrency(workers);
|
||||
+ isc_thread_setconcurrency(workers * 2);
|
||||
#endif /* USE_WORKER_THREADS */
|
||||
#ifdef USE_SHARED_MANAGER
|
||||
manager->refs = 1;
|
||||
@@ -1497,7 +1556,8 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
|
||||
cleanup_exclusivegranted:
|
||||
(void)isc_condition_destroy(&manager->exclusive_granted);
|
||||
cleanup_workavailable:
|
||||
- (void)isc_condition_destroy(&manager->work_available);
|
||||
+ (void)isc_condition_destroy(&manager->work_available[isc_taskqueue_slow]);
|
||||
+ (void)isc_condition_destroy(&manager->work_available[isc_taskqueue_normal]);
|
||||
cleanup_threads:
|
||||
isc_mem_free(mctx, manager->threads);
|
||||
cleanup_lock:
|
||||
@@ -1582,7 +1642,7 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) {
|
||||
task = NEXT(task, link)) {
|
||||
LOCK(&task->lock);
|
||||
if (task_shutdown(task))
|
||||
- push_readyq(manager, task);
|
||||
+ push_readyq(manager, task, task->qid);
|
||||
UNLOCK(&task->lock);
|
||||
}
|
||||
#ifdef USE_WORKER_THREADS
|
||||
@@ -1591,7 +1651,8 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) {
|
||||
* there's work left to do, and if there are already no tasks left
|
||||
* it will cause the workers to see manager->exiting.
|
||||
*/
|
||||
- BROADCAST(&manager->work_available);
|
||||
+ BROADCAST(&manager->work_available[isc_taskqueue_normal]);
|
||||
+ BROADCAST(&manager->work_available[isc_taskqueue_slow]);
|
||||
UNLOCK(&manager->lock);
|
||||
|
||||
/*
|
||||
@@ -1693,7 +1754,8 @@ isc__taskmgr_resume(isc_taskmgr_t *manager0) {
|
||||
LOCK(&manager->lock);
|
||||
if (manager->pause_requested) {
|
||||
manager->pause_requested = false;
|
||||
- BROADCAST(&manager->work_available);
|
||||
+ BROADCAST(&manager->work_available[isc_taskqueue_normal]);
|
||||
+ BROADCAST(&manager->work_available[isc_taskqueue_slow]);
|
||||
}
|
||||
UNLOCK(&manager->lock);
|
||||
}
|
||||
@@ -1778,7 +1840,8 @@ isc__task_endexclusive(isc_task_t *task0) {
|
||||
LOCK(&manager->lock);
|
||||
REQUIRE(manager->exclusive_requested);
|
||||
manager->exclusive_requested = false;
|
||||
- BROADCAST(&manager->work_available);
|
||||
+ BROADCAST(&manager->work_available[isc_taskqueue_normal]);
|
||||
+ BROADCAST(&manager->work_available[isc_taskqueue_slow]);
|
||||
UNLOCK(&manager->lock);
|
||||
#else
|
||||
UNUSED(task0);
|
||||
@@ -1804,10 +1867,10 @@ isc__task_setprivilege(isc_task_t *task0, bool priv) {
|
||||
|
||||
LOCK(&manager->lock);
|
||||
if (priv && ISC_LINK_LINKED(task, ready_link))
|
||||
- ENQUEUE(manager->ready_priority_tasks, task,
|
||||
+ ENQUEUE(manager->ready_priority_tasks[task->qid], task,
|
||||
ready_priority_link);
|
||||
else if (!priv && ISC_LINK_LINKED(task, ready_priority_link))
|
||||
- DEQUEUE(manager->ready_priority_tasks, task,
|
||||
+ DEQUEUE(manager->ready_priority_tasks[task->qid], task,
|
||||
ready_priority_link);
|
||||
UNLOCK(&manager->lock);
|
||||
}
|
||||
--
|
||||
2.43.2
|
||||
|
133
SOURCES/bind-9.11-CVE-2024-1737-runtime-env.patch
Normal file
133
SOURCES/bind-9.11-CVE-2024-1737-runtime-env.patch
Normal file
@ -0,0 +1,133 @@
|
||||
From 0a7909045f9e1bf74c1f0fd561a8ef5f55481e8f Mon Sep 17 00:00:00 2001
|
||||
From: Petr Mensik <pemensik@redhat.com>
|
||||
Date: Mon, 29 Jul 2024 16:20:50 +0200
|
||||
Subject: [PATCH] Allow global runtime definition by DNS_RBTDB_MAX_RTYPES
|
||||
|
||||
Modify rbtdb to not set it only at runtime, but allow setting that also
|
||||
in runtime via environment variable. It is still possible to modify
|
||||
default during the build define. In addition to it allows runtime change
|
||||
also. Can be positive number to set limit, 0 disabled the check.
|
||||
|
||||
Similarly add also DNS_RDATASET_MAX_RECORDS to set maximum number of
|
||||
records for a single name. This must be positive number, 0 is no accepted.
|
||||
|
||||
These replaces max-records-per-type and max-types-per-name in later
|
||||
versions. But can be configured only by environment and can be
|
||||
configured only globally, not in each view or zone.
|
||||
---
|
||||
lib/dns/rbtdb.c | 21 +++++++++++++++++++--
|
||||
lib/dns/rdataslab.c | 24 ++++++++++++++++++++++--
|
||||
2 files changed, 41 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
|
||||
index a3cb8dc871..0104c3ee36 100644
|
||||
--- a/lib/dns/rbtdb.c
|
||||
+++ b/lib/dns/rbtdb.c
|
||||
@@ -6320,15 +6320,29 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
|
||||
#define DNS_RBTDB_MAX_RTYPES 100
|
||||
#endif /* DNS_RBTDB_MAX_RTYPES */
|
||||
|
||||
+static uint32_t dns_g_rbtdb_max_rtypes = DNS_RBTDB_MAX_RTYPES;
|
||||
+
|
||||
+static void
|
||||
+init_max_rtypes(void) {
|
||||
+ /* Red Hat change, allow setting different max value by environment. */
|
||||
+ const char *max = getenv("DNS_RBTDB_MAX_RTYPES");
|
||||
+ if (max) {
|
||||
+ char *endp = NULL;
|
||||
+ long l = strtol(max, &endp, 10);
|
||||
+ if (max != endp && endp && !*endp && l >= 0)
|
||||
+ dns_g_rbtdb_max_rtypes = l;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
static bool
|
||||
overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
|
||||
UNUSED(rbtdb);
|
||||
|
||||
- if (DNS_RBTDB_MAX_RTYPES == 0) {
|
||||
+ if (dns_g_rbtdb_max_rtypes == 0) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
- return (ntypes >= DNS_RBTDB_MAX_RTYPES);
|
||||
+ return (ntypes >= dns_g_rbtdb_max_rtypes);
|
||||
}
|
||||
|
||||
static bool
|
||||
@@ -8831,6 +8845,8 @@ static dns_dbmethods_t cache_methods = {
|
||||
getservestalettl
|
||||
};
|
||||
|
||||
+static isc_once_t once_db = ISC_ONCE_INIT;
|
||||
+
|
||||
isc_result_t
|
||||
#ifdef DNS_RBTDB_VERSION64
|
||||
dns_rbtdb64_create
|
||||
@@ -8850,6 +8866,7 @@ dns_rbtdb_create
|
||||
|
||||
/* Keep the compiler happy. */
|
||||
UNUSED(driverarg);
|
||||
+ RUNTIME_CHECK(isc_once_do(&once_db, init_max_rtypes) == ISC_R_SUCCESS);
|
||||
|
||||
rbtdb = isc_mem_get(mctx, sizeof(*rbtdb));
|
||||
if (rbtdb == NULL)
|
||||
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
|
||||
index 347b7d2ce8..9566f79671 100644
|
||||
--- a/lib/dns/rdataslab.c
|
||||
+++ b/lib/dns/rdataslab.c
|
||||
@@ -17,6 +17,7 @@
|
||||
#include <stdlib.h>
|
||||
|
||||
#include <isc/mem.h>
|
||||
+#include <isc/once.h>
|
||||
#include <isc/region.h>
|
||||
#include <isc/string.h> /* Required for HP/UX (and others?) */
|
||||
#include <isc/util.h>
|
||||
@@ -119,6 +120,23 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
|
||||
#define DNS_RDATASET_MAX_RECORDS 100
|
||||
#endif /* DNS_RDATASET_MAX_RECORDS */
|
||||
|
||||
+static unsigned int dns_g_rdataset_max_records = DNS_RDATASET_MAX_RECORDS;
|
||||
+static isc_once_t once = ISC_ONCE_INIT;
|
||||
+
|
||||
+static void
|
||||
+init_max_records(void) {
|
||||
+ /* Red Hat change, allow setting different max value by environment. */
|
||||
+ const char *max = getenv("DNS_RDATASET_MAX_RECORDS");
|
||||
+ if (max) {
|
||||
+ char *endp = NULL;
|
||||
+ long l = strtol(max, &endp, 10);
|
||||
+ if (max != endp && endp && !*endp && l > 0)
|
||||
+ dns_g_rdataset_max_records = l;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+
|
||||
+
|
||||
isc_result_t
|
||||
dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
|
||||
isc_region_t *region, unsigned int reservelen)
|
||||
@@ -165,7 +183,9 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
- if (nitems > DNS_RDATASET_MAX_RECORDS) {
|
||||
+ RUNTIME_CHECK(isc_once_do(&once, init_max_records) == ISC_R_SUCCESS);
|
||||
+
|
||||
+ if (nitems > dns_g_rdataset_max_records) {
|
||||
return (DNS_R_TOOMANYRECORDS);
|
||||
}
|
||||
|
||||
@@ -662,7 +682,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
|
||||
#endif
|
||||
INSIST(ocount > 0 && ncount > 0);
|
||||
|
||||
- if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
|
||||
+ if (ocount + ncount > dns_g_rdataset_max_records) {
|
||||
return (DNS_R_TOOMANYRECORDS);
|
||||
}
|
||||
|
||||
--
|
||||
2.45.2
|
||||
|
317
SOURCES/bind-9.11-CVE-2024-1737.patch
Normal file
317
SOURCES/bind-9.11-CVE-2024-1737.patch
Normal file
@ -0,0 +1,317 @@
|
||||
From 71df06e2bf3da31c5d542fb33dbda67b21537322 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
|
||||
Date: Fri, 1 Mar 2024 08:26:07 +0100
|
||||
Subject: [PATCH] [9.11][CVE-2024-1737] Add a limit to the number of RRs in
|
||||
RRSets
|
||||
|
||||
Add a limit to the number of RRs in RRSets
|
||||
|
||||
Previously, the number of RRs in the RRSets were internally unlimited.
|
||||
As the data structure that holds the RRs is just a linked list, and
|
||||
there are places where we just walk through all of the RRs, adding an
|
||||
RRSet with huge number of RRs inside would slow down processing of said
|
||||
RRSets.
|
||||
|
||||
The fix for end-of-life branches make the limit compile-time only for
|
||||
simplicity and the limit can be changed at the compile time by adding
|
||||
following define to CFLAGS:
|
||||
|
||||
-DDNS_RDATASET_MAX_RECORDS=<limit>
|
||||
|
||||
(cherry picked from commit c5c4d00c38530390c9e1ae4c98b65fbbadfe9e5e)
|
||||
(cherry picked from commit 7f705778af729ada7fec36ac4b456c73329bd996)
|
||||
(cherry picked from commit b9b5485b22c364fb88c27aa04bad4c8f616da3fa)
|
||||
|
||||
Add a limit to the number of RR types for single name
|
||||
|
||||
Previously, the number of RR types for a single owner name was limited
|
||||
only by the maximum number of the types (64k). As the data structure
|
||||
that holds the RR types for the database node is just a linked list, and
|
||||
there are places where we just walk through the whole list (again and
|
||||
again), adding a large number of RR types for a single owner named with
|
||||
would slow down processing of such name (database node).
|
||||
|
||||
Add a hard-coded limit (100) to cap the number of the RR types for a single
|
||||
owner. The limit can be changed at the compile time by adding following
|
||||
define to CFLAGS:
|
||||
|
||||
-DDNS_RBTDB_MAX_RTYPES=<limit>
|
||||
|
||||
(cherry picked from commit 538b843d84f49ba5125ff545e3d0cf1c8434a8f2)
|
||||
(cherry picked from commit 3f10d6eff035702796ba82cd28b9f7cf9836e743)
|
||||
|
||||
Optimize the slabheader placement for certain RRTypes
|
||||
|
||||
Mark the infrastructure RRTypes as "priority" types and place them at
|
||||
the beginning of the rdataslab header data graph. The non-priority
|
||||
types either go right after the priority types (if any).
|
||||
|
||||
(cherry picked from commit 3ac482be7fd058d284e89873021339579fad0615)
|
||||
(cherry picked from commit 23a4652346fb2877d6246b1eebaa967969dbde16)
|
||||
|
||||
[9.11][CVE-2024-1737 (part 2)] Be smarter about refusing to add many RR types to the database
|
||||
|
||||
Expand the list of the priority types
|
||||
|
||||
Add HTTPS, SVCB, SRV, PTR, NAPTR, DNSKEY and TXT records to the list of
|
||||
the priority types that are put at the beginning of the slabheader list
|
||||
for faster access and to avoid eviction when there are more types than
|
||||
the max-types-per-name limit.
|
||||
|
||||
(cherry picked from commit b27c6bcce894786a8e082eafd59eccbf6f2731cb)
|
||||
(cherry picked from commit 3e0a67e4bdb253dae3a03a45c1aa117239a3313d)
|
||||
|
||||
Be smarter about refusing to add many RR types to the database
|
||||
|
||||
Instead of outright refusing to add new RR types to the cache, be a bit
|
||||
smarter:
|
||||
|
||||
1. If the new header type is in our priority list, we always add either
|
||||
positive or negative entry at the beginning of the list.
|
||||
|
||||
2. If the new header type is negative entry, and we are over the limit,
|
||||
we mark it as ancient immediately, so it gets evicted from the cache
|
||||
as soon as possible.
|
||||
|
||||
3. Otherwise add the new header after the priority headers (or at the
|
||||
head of the list).
|
||||
|
||||
4. If we are over the limit, evict the last entry on the normal header
|
||||
list.
|
||||
|
||||
(cherry picked from commit 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120)
|
||||
(cherry picked from commit e4d7ce686bb38428eddc7e33b40057d68eca9a6e)
|
||||
---
|
||||
configure | 2 +-
|
||||
configure.ac | 2 +-
|
||||
lib/dns/rbtdb.c | 114 +++++++++++++++++++++++++++++++++++++++++++-
|
||||
lib/dns/rdataslab.c | 12 +++++
|
||||
4 files changed, 126 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/configure b/configure
|
||||
index e060e9d..6421c9b 100755
|
||||
--- a/configure
|
||||
+++ b/configure
|
||||
@@ -12189,7 +12189,7 @@ fi
|
||||
XTARGETS=
|
||||
case "$enable_developer" in
|
||||
yes)
|
||||
- STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1"
|
||||
+ STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
|
||||
test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
|
||||
test "${enable_querytrace+set}" = set || enable_querytrace=yes
|
||||
test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 83cad4a..1c35ce9 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -100,7 +100,7 @@ AC_ARG_ENABLE(developer,
|
||||
XTARGETS=
|
||||
case "$enable_developer" in
|
||||
yes)
|
||||
- STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1"
|
||||
+ STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
|
||||
test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
|
||||
test "${enable_querytrace+set}" = set || enable_querytrace=yes
|
||||
test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
|
||||
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
|
||||
index ee59c1b..a2b2df7 100644
|
||||
--- a/lib/dns/rbtdb.c
|
||||
+++ b/lib/dns/rbtdb.c
|
||||
@@ -1183,6 +1183,44 @@ set_ttl(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, dns_ttl_t newttl) {
|
||||
isc_heap_decreased(heap, header->heap_index);
|
||||
}
|
||||
|
||||
+static bool
|
||||
+prio_type(rbtdb_rdatatype_t type) {
|
||||
+ switch (type) {
|
||||
+ case dns_rdatatype_soa:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa):
|
||||
+ case dns_rdatatype_a:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_a):
|
||||
+ case dns_rdatatype_mx:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_mx):
|
||||
+ case dns_rdatatype_aaaa:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_aaaa):
|
||||
+ case dns_rdatatype_nsec:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec):
|
||||
+ case dns_rdatatype_nsec3:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec3):
|
||||
+ case dns_rdatatype_ns:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ns):
|
||||
+ case dns_rdatatype_ds:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds):
|
||||
+ case dns_rdatatype_cname:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname):
|
||||
+ case dns_rdatatype_dname:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dname):
|
||||
+ case dns_rdatatype_dnskey:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dnskey):
|
||||
+ case dns_rdatatype_srv:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_srv):
|
||||
+ case dns_rdatatype_txt:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_txt):
|
||||
+ case dns_rdatatype_ptr:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ptr):
|
||||
+ case dns_rdatatype_naptr:
|
||||
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_naptr):
|
||||
+ return (true);
|
||||
+ }
|
||||
+ return (false);
|
||||
+}
|
||||
+
|
||||
/*%
|
||||
* These functions allow the heap code to rank the priority of each
|
||||
* element. It returns true if v1 happens "sooner" than v2.
|
||||
@@ -6278,6 +6316,30 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
|
||||
RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
|
||||
}
|
||||
|
||||
+#ifndef DNS_RBTDB_MAX_RTYPES
|
||||
+#define DNS_RBTDB_MAX_RTYPES 100
|
||||
+#endif /* DNS_RBTDB_MAX_RTYPES */
|
||||
+
|
||||
+static bool
|
||||
+overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
|
||||
+ UNUSED(rbtdb);
|
||||
+
|
||||
+ if (DNS_RBTDB_MAX_RTYPES == 0) {
|
||||
+ return (false);
|
||||
+ }
|
||||
+
|
||||
+ return (ntypes >= DNS_RBTDB_MAX_RTYPES);
|
||||
+}
|
||||
+
|
||||
+static bool
|
||||
+prio_header(rdatasetheader_t *header) {
|
||||
+ if (NEGATIVE(header) && prio_type(RBTDB_RDATATYPE_EXT(header->type))) {
|
||||
+ return (true);
|
||||
+ }
|
||||
+
|
||||
+ return (prio_type(header->type));
|
||||
+}
|
||||
+
|
||||
/*
|
||||
* write lock on rbtnode must be held.
|
||||
*/
|
||||
@@ -6288,6 +6350,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||
{
|
||||
rbtdb_changed_t *changed = NULL;
|
||||
rdatasetheader_t *topheader, *topheader_prev, *header, *sigheader;
|
||||
+ rdatasetheader_t *prioheader = NULL, *expireheader = NULL;
|
||||
unsigned char *merged;
|
||||
isc_result_t result;
|
||||
bool header_nx;
|
||||
@@ -6297,6 +6360,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||
rbtdb_rdatatype_t negtype, sigtype;
|
||||
dns_trust_t trust;
|
||||
int idx;
|
||||
+ uint32_t ntypes = 0;
|
||||
|
||||
/*
|
||||
* Add an rdatasetheader_t to a node.
|
||||
@@ -6429,6 +6493,15 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||
for (topheader = rbtnode->data;
|
||||
topheader != NULL;
|
||||
topheader = topheader->next) {
|
||||
+ if (IS_CACHE(rbtdb) && ACTIVE(topheader, now)) {
|
||||
+ ++ntypes;
|
||||
+ expireheader = topheader;
|
||||
+ } else if (!IS_CACHE(rbtdb)) {
|
||||
+ ++ntypes;
|
||||
+ }
|
||||
+ if (prio_header(topheader)) {
|
||||
+ prioheader = topheader;
|
||||
+ }
|
||||
if (topheader->type == newheader->type ||
|
||||
topheader->type == negtype)
|
||||
break;
|
||||
@@ -6792,9 +6865,46 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||
/*
|
||||
* No rdatasets of the given type exist at the node.
|
||||
*/
|
||||
- newheader->next = rbtnode->data;
|
||||
+ if (!IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
|
||||
+ free_rdataset(rbtdb, rbtdb->common.mctx,
|
||||
+ newheader);
|
||||
+ return (ISC_R_QUOTA);
|
||||
+ }
|
||||
+
|
||||
newheader->down = NULL;
|
||||
- rbtnode->data = newheader;
|
||||
+
|
||||
+ if (prio_header(newheader)) {
|
||||
+ /* This is a priority type, prepend it */
|
||||
+ newheader->next = rbtnode->data;
|
||||
+ rbtnode->data = newheader;
|
||||
+ } else if (prioheader != NULL) {
|
||||
+ /* Append after the priority headers */
|
||||
+ newheader->next = prioheader->next;
|
||||
+ prioheader->next = newheader;
|
||||
+ } else {
|
||||
+ /* There were no priority headers */
|
||||
+ newheader->next = rbtnode->data;
|
||||
+ rbtnode->data = newheader;
|
||||
+ }
|
||||
+
|
||||
+ if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
|
||||
+ if (expireheader == NULL) {
|
||||
+ expireheader = newheader;
|
||||
+ }
|
||||
+ if (NEGATIVE(newheader) &&
|
||||
+ !prio_header(newheader))
|
||||
+ {
|
||||
+ /*
|
||||
+ * Add the new non-priority negative
|
||||
+ * header to the database only
|
||||
+ * temporarily.
|
||||
+ */
|
||||
+ expireheader = newheader;
|
||||
+ }
|
||||
+
|
||||
+ set_ttl(rbtdb, expireheader, 0);
|
||||
+ mark_header_ancient(rbtdb, expireheader);
|
||||
+ }
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
|
||||
index b0f77b1..347b7d2 100644
|
||||
--- a/lib/dns/rdataslab.c
|
||||
+++ b/lib/dns/rdataslab.c
|
||||
@@ -115,6 +115,10 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
|
||||
}
|
||||
#endif
|
||||
|
||||
+#ifndef DNS_RDATASET_MAX_RECORDS
|
||||
+#define DNS_RDATASET_MAX_RECORDS 100
|
||||
+#endif /* DNS_RDATASET_MAX_RECORDS */
|
||||
+
|
||||
isc_result_t
|
||||
dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
|
||||
isc_region_t *region, unsigned int reservelen)
|
||||
@@ -161,6 +165,10 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
+ if (nitems > DNS_RDATASET_MAX_RECORDS) {
|
||||
+ return (DNS_R_TOOMANYRECORDS);
|
||||
+ }
|
||||
+
|
||||
if (nitems > 0xffff)
|
||||
return (ISC_R_NOSPACE);
|
||||
|
||||
@@ -654,6 +662,10 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
|
||||
#endif
|
||||
INSIST(ocount > 0 && ncount > 0);
|
||||
|
||||
+ if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
|
||||
+ return (DNS_R_TOOMANYRECORDS);
|
||||
+ }
|
||||
+
|
||||
#if DNS_RDATASET_FIXED
|
||||
oncount = ncount;
|
||||
#endif
|
||||
--
|
||||
2.45.2
|
||||
|
322
SOURCES/bind-9.11-CVE-2024-1975.patch
Normal file
322
SOURCES/bind-9.11-CVE-2024-1975.patch
Normal file
@ -0,0 +1,322 @@
|
||||
From 5ff88892e43c049659a8a5aef8dfd56c3712daf0 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Mensik <pemensik@redhat.com>
|
||||
Date: Tue, 16 Jul 2024 19:49:09 +0200
|
||||
Subject: [PATCH] Resolve CVE-2024-1975
|
||||
|
||||
6404. [security] Remove SIG(0) support from named as a countermeasure
|
||||
for CVE-2024-1975. [GL #4480]
|
||||
|
||||
Resolves: CVE-2024-1975
|
||||
---
|
||||
bin/named/client.c | 7 +++
|
||||
bin/tests/system/tsiggss/authsock.pl | 5 ++
|
||||
bin/tests/system/tsiggss/tests.sh | 12 ++--
|
||||
bin/tests/system/upforwd/tests.sh | 21 ++++---
|
||||
doc/arm/Bv9ARM-book.xml | 22 +++----
|
||||
lib/dns/message.c | 94 +++-------------------------
|
||||
6 files changed, 49 insertions(+), 112 deletions(-)
|
||||
|
||||
diff --git a/bin/named/client.c b/bin/named/client.c
|
||||
index 368bc94..ea121b3 100644
|
||||
--- a/bin/named/client.c
|
||||
+++ b/bin/named/client.c
|
||||
@@ -3013,6 +3013,13 @@ client_request(isc_task_t *task, isc_event_t *event) {
|
||||
ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
|
||||
NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
|
||||
"request is signed by a nonauthoritative key");
|
||||
+ } else if (result == DNS_R_NOTVERIFIEDYET &&
|
||||
+ client->message->sig0 != NULL)
|
||||
+ {
|
||||
+ ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
|
||||
+ NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
|
||||
+ "request has a SIG(0) signature but its support "
|
||||
+ "was removed (CVE-2024-1975)");
|
||||
} else {
|
||||
char tsigrcode[64];
|
||||
isc_buffer_t b;
|
||||
diff --git a/bin/tests/system/tsiggss/authsock.pl b/bin/tests/system/tsiggss/authsock.pl
|
||||
index ab3833d..0b231ee 100644
|
||||
--- a/bin/tests/system/tsiggss/authsock.pl
|
||||
+++ b/bin/tests/system/tsiggss/authsock.pl
|
||||
@@ -31,6 +31,10 @@ if (!defined($path)) {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
+# Enable output autoflush so that it's not lost when the parent sends TERM.
|
||||
+select STDOUT;
|
||||
+$| = 1;
|
||||
+
|
||||
unlink($path);
|
||||
my $server = IO::Socket::UNIX->new(Local => $path, Type => SOCK_STREAM, Listen => 8) or
|
||||
die "unable to create socket $path";
|
||||
@@ -53,6 +57,7 @@ if ($timeout != 0) {
|
||||
}
|
||||
|
||||
while (my $client = $server->accept()) {
|
||||
+ printf("accept()\n");
|
||||
$client->recv(my $buf, 8, 0);
|
||||
my ($version, $req_len) = unpack('N N', $buf);
|
||||
|
||||
diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
|
||||
index 456ce61..d0db388 100644
|
||||
--- a/bin/tests/system/tsiggss/tests.sh
|
||||
+++ b/bin/tests/system/tsiggss/tests.sh
|
||||
@@ -116,7 +116,7 @@ status=$((status+ret))
|
||||
|
||||
echo_i "testing external update policy (CNAME) with auth sock ($n)"
|
||||
ret=0
|
||||
-$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 > /dev/null 2>&1 &
|
||||
+$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >authsock.log 2>&1 &
|
||||
sleep 1
|
||||
test_update $n testcname.example.nil. CNAME "86400 CNAME testdenied.example.nil" "testdenied" || ret=1
|
||||
n=$((n+1))
|
||||
@@ -130,17 +130,19 @@ n=$((n+1))
|
||||
if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
|
||||
status=$((status+ret))
|
||||
|
||||
-echo_i "testing external policy with SIG(0) key ($n)"
|
||||
+echo_i "testing external policy with unsupported SIG(0) key ($n)"
|
||||
ret=0
|
||||
-$NSUPDATE -R $RANDFILE -k ns1/Kkey.example.nil.*.private <<END > /dev/null 2>&1 || ret=1
|
||||
+$NSUPDATE -R $RANDFILE -k ns1/Kkey.example.nil.*.private <<END >nsupdate.out${n} 2>&1 || true
|
||||
+debug
|
||||
server 10.53.0.1 ${PORT}
|
||||
zone example.nil
|
||||
update add fred.example.nil 120 cname foo.bar.
|
||||
send
|
||||
END
|
||||
+# update must have failed - SIG(0) signer is not supported
|
||||
output=`$DIG $DIGOPTS +short cname fred.example.nil.`
|
||||
-[ -n "$output" ] || ret=1
|
||||
-[ $ret -eq 0 ] || echo_i "failed"
|
||||
+[ -n "$output" ] && ret=1
|
||||
+grep -F "signer=key.example.nil" authsock.log >/dev/null && ret=1
|
||||
n=$((n+1))
|
||||
if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
|
||||
status=$((status+ret))
|
||||
diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
|
||||
index ebc9ded..f5b89d4 100644
|
||||
--- a/bin/tests/system/upforwd/tests.sh
|
||||
+++ b/bin/tests/system/upforwd/tests.sh
|
||||
@@ -181,19 +181,22 @@ n=`expr $n + 1`
|
||||
|
||||
if test -f keyname
|
||||
then
|
||||
- echo_i "checking update forwarding to with sig0 ($n)"
|
||||
+ echo_i "checking update forwarding to with sig0 (expected to fail) ($n)"
|
||||
ret=0
|
||||
keyname=`cat keyname`
|
||||
- $NSUPDATE -k $keyname.private -- - <<EOF
|
||||
- local 10.53.0.1
|
||||
- server 10.53.0.3 ${PORT}
|
||||
- zone example2
|
||||
- update add unsigned.example2. 600 A 10.10.10.1
|
||||
- update add unsigned.example2. 600 TXT Foo
|
||||
- send
|
||||
+ # SIG(0) is removed, update is expected to fail.
|
||||
+ {
|
||||
+ $NSUPDATE -k $keyname.private -- - <<EOF
|
||||
+ local 10.53.0.1
|
||||
+ server 10.53.0.3 ${PORT}
|
||||
+ zone example2
|
||||
+ update add unsigned.example2. 600 A 10.10.10.1
|
||||
+ update add unsigned.example2. 600 TXT Foo
|
||||
+ send
|
||||
EOF
|
||||
+ } >nsupdate.out.$n 2>&1 && ret=1
|
||||
$DIG -p ${PORT} unsigned.example2 A @10.53.0.1 > dig.out.ns1.test$n
|
||||
- grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
|
||||
+ grep "status: NOERROR" dig.out.ns1.test$n >/dev/null && ret=1
|
||||
if [ $ret != 0 ] ; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
n=`expr $n + 1`
|
||||
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
|
||||
index acf772b..563dced 100644
|
||||
--- a/doc/arm/Bv9ARM-book.xml
|
||||
+++ b/doc/arm/Bv9ARM-book.xml
|
||||
@@ -2027,7 +2027,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
|
||||
The TKEY process is initiated by a client or server by sending
|
||||
a query of type TKEY to a TKEY-aware server. The query must include
|
||||
an appropriate KEY record in the additional section, and
|
||||
- must be signed using either TSIG or SIG(0) with a previously
|
||||
+ must be signed using TSIG with a previously
|
||||
established key. The server's response, if successful,
|
||||
contains a TKEY record in its answer section. After this transaction,
|
||||
both participants have enough information to calculate a
|
||||
@@ -2050,24 +2050,24 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
|
||||
<section xml:id="sig0"><info><title>SIG(0)</title></info>
|
||||
|
||||
<para>
|
||||
- <acronym>BIND</acronym> partially supports DNSSEC SIG(0)
|
||||
+ <acronym>BIND</acronym> partially supported DNSSEC SIG(0)
|
||||
transaction signatures as specified in RFC 2535 and RFC 2931.
|
||||
SIG(0) uses public/private keys to authenticate messages. Access control
|
||||
- is performed in the same manner as with TSIG keys; privileges can be
|
||||
+ were performed in the same manner as with TSIG keys; privileges can be
|
||||
granted or denied in ACL directives based on the key name.
|
||||
</para>
|
||||
<para>
|
||||
- When a SIG(0) signed message is received, it is only
|
||||
+ When a SIG(0) signed message were received, it were only
|
||||
verified if the key is known and trusted by the server. The
|
||||
- server does not attempt to recursively fetch or validate the
|
||||
+ server did not attempt to recursively fetch or validate the
|
||||
key.
|
||||
</para>
|
||||
<para>
|
||||
- SIG(0) signing of multiple-message TCP streams is not supported.
|
||||
+ SIG(0) signing of multiple-message TCP streams were not supported.
|
||||
</para>
|
||||
<para>
|
||||
- The only tool shipped with <acronym>BIND</acronym> 9 that
|
||||
- generates SIG(0) signed messages is <command>nsupdate</command>.
|
||||
+ Support for SIG(0) message verification was removed
|
||||
+ as part of the mitigation of CVE-2024-1975.
|
||||
</para>
|
||||
</section>
|
||||
|
||||
@@ -12655,7 +12655,7 @@ example.com. NS ns2.example.net.
|
||||
either grants or denies permission for one or more
|
||||
names in the zone to be updated by one or more
|
||||
identities. Identity is determined by the key that
|
||||
- signed the update request, using either TSIG or SIG(0).
|
||||
+ signed the update request, using TSIG.
|
||||
In most cases, <command>update-policy</command> rules
|
||||
only apply to key-based identities. There is no way
|
||||
to specify update permissions based on client source
|
||||
@@ -12742,7 +12742,7 @@ example.com. NS ns2.example.net.
|
||||
<para>
|
||||
The <command>identity</command> field must be set to
|
||||
a fully qualified domain name. In most cases, this
|
||||
- represents the name of the TSIG or SIG(0) key that must be
|
||||
+ represents the name of the TSIG key that must be
|
||||
used to sign the update request. If the specified name is a
|
||||
wildcard, it is subject to DNS wildcard expansion, and the
|
||||
rule may apply to multiple identities. When a TKEY exchange
|
||||
@@ -15952,7 +15952,7 @@ HOST-127.EXAMPLE. MX 0 .
|
||||
</para>
|
||||
<para>
|
||||
ACLs match clients on the basis of up to three characteristics:
|
||||
- 1) The client's IP address; 2) the TSIG or SIG(0) key that was
|
||||
+ 1) The client's IP address; 2) the TSIG key that was
|
||||
used to sign the request, if any; and 3) an address prefix
|
||||
encoded in an EDNS Client-Subnet option, if any.
|
||||
</para>
|
||||
diff --git a/lib/dns/message.c b/lib/dns/message.c
|
||||
index a44eb2d..9ea2b9e 100644
|
||||
--- a/lib/dns/message.c
|
||||
+++ b/lib/dns/message.c
|
||||
@@ -3373,103 +3373,23 @@ dns_message_dumpsig(dns_message_t *msg, char *txt1) {
|
||||
|
||||
isc_result_t
|
||||
dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
|
||||
- isc_buffer_t b, msgb;
|
||||
+ isc_buffer_t msgb;
|
||||
|
||||
REQUIRE(DNS_MESSAGE_VALID(msg));
|
||||
|
||||
- if (msg->tsigkey == NULL && msg->tsig == NULL && msg->sig0 == NULL)
|
||||
+ if (msg->tsigkey == NULL && msg->tsig == NULL)
|
||||
return (ISC_R_SUCCESS);
|
||||
|
||||
INSIST(msg->saved.base != NULL);
|
||||
isc_buffer_init(&msgb, msg->saved.base, msg->saved.length);
|
||||
isc_buffer_add(&msgb, msg->saved.length);
|
||||
- if (msg->tsigkey != NULL || msg->tsig != NULL) {
|
||||
#ifdef SKAN_MSG_DEBUG
|
||||
- dns_message_dumpsig(msg, "dns_message_checksig#1");
|
||||
+ dns_message_dumpsig(msg, "dns_message_checksig#1");
|
||||
#endif
|
||||
- if (view != NULL)
|
||||
- return (dns_view_checksig(view, &msgb, msg));
|
||||
- else
|
||||
- return (dns_tsig_verify(&msgb, msg, NULL, NULL));
|
||||
- } else {
|
||||
- dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||
- dns_rdata_sig_t sig;
|
||||
- dns_rdataset_t keyset;
|
||||
- isc_result_t result;
|
||||
-
|
||||
- result = dns_rdataset_first(msg->sig0);
|
||||
- INSIST(result == ISC_R_SUCCESS);
|
||||
- dns_rdataset_current(msg->sig0, &rdata);
|
||||
-
|
||||
- /*
|
||||
- * This can occur when the message is a dynamic update, since
|
||||
- * the rdata length checking is relaxed. This should not
|
||||
- * happen in a well-formed message, since the SIG(0) is only
|
||||
- * looked for in the additional section, and the dynamic update
|
||||
- * meta-records are in the prerequisite and update sections.
|
||||
- */
|
||||
- if (rdata.length == 0)
|
||||
- return (ISC_R_UNEXPECTEDEND);
|
||||
-
|
||||
- result = dns_rdata_tostruct(&rdata, &sig, msg->mctx);
|
||||
- if (result != ISC_R_SUCCESS)
|
||||
- return (result);
|
||||
-
|
||||
- dns_rdataset_init(&keyset);
|
||||
- if (view == NULL)
|
||||
- return (DNS_R_KEYUNAUTHORIZED);
|
||||
- result = dns_view_simplefind(view, &sig.signer,
|
||||
- dns_rdatatype_key /* SIG(0) */,
|
||||
- 0, 0, false, &keyset, NULL);
|
||||
-
|
||||
- if (result != ISC_R_SUCCESS) {
|
||||
- /* XXXBEW Should possibly create a fetch here */
|
||||
- result = DNS_R_KEYUNAUTHORIZED;
|
||||
- goto freesig;
|
||||
- } else if (keyset.trust < dns_trust_secure) {
|
||||
- /* XXXBEW Should call a validator here */
|
||||
- result = DNS_R_KEYUNAUTHORIZED;
|
||||
- goto freesig;
|
||||
- }
|
||||
- result = dns_rdataset_first(&keyset);
|
||||
- INSIST(result == ISC_R_SUCCESS);
|
||||
- for (;
|
||||
- result == ISC_R_SUCCESS;
|
||||
- result = dns_rdataset_next(&keyset))
|
||||
- {
|
||||
- dst_key_t *key = NULL;
|
||||
-
|
||||
- dns_rdata_reset(&rdata);
|
||||
- dns_rdataset_current(&keyset, &rdata);
|
||||
- isc_buffer_init(&b, rdata.data, rdata.length);
|
||||
- isc_buffer_add(&b, rdata.length);
|
||||
-
|
||||
- result = dst_key_fromdns(&sig.signer, rdata.rdclass,
|
||||
- &b, view->mctx, &key);
|
||||
- if (result != ISC_R_SUCCESS)
|
||||
- continue;
|
||||
- if (dst_key_alg(key) != sig.algorithm ||
|
||||
- dst_key_id(key) != sig.keyid ||
|
||||
- !(dst_key_proto(key) == DNS_KEYPROTO_DNSSEC ||
|
||||
- dst_key_proto(key) == DNS_KEYPROTO_ANY))
|
||||
- {
|
||||
- dst_key_free(&key);
|
||||
- continue;
|
||||
- }
|
||||
- result = dns_dnssec_verifymessage(&msgb, msg, key);
|
||||
- dst_key_free(&key);
|
||||
- if (result == ISC_R_SUCCESS)
|
||||
- break;
|
||||
- }
|
||||
- if (result == ISC_R_NOMORE)
|
||||
- result = DNS_R_KEYUNAUTHORIZED;
|
||||
-
|
||||
- freesig:
|
||||
- if (dns_rdataset_isassociated(&keyset))
|
||||
- dns_rdataset_disassociate(&keyset);
|
||||
- dns_rdata_freestruct(&sig);
|
||||
- return (result);
|
||||
- }
|
||||
+ if (view != NULL)
|
||||
+ return (dns_view_checksig(view, &msgb, msg));
|
||||
+ else
|
||||
+ return (dns_tsig_verify(&msgb, msg, NULL, NULL));
|
||||
}
|
||||
|
||||
#define INDENT(sp) \
|
||||
--
|
||||
2.45.2
|
||||
|
65
SOURCES/bind-9.11-stale-cache.patch
Normal file
65
SOURCES/bind-9.11-stale-cache.patch
Normal file
@ -0,0 +1,65 @@
|
||||
From 8a7bff93037432fcfe8532752e89f150ea3030a4 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Mensik <pemensik@redhat.com>
|
||||
Date: Mon, 9 Oct 2023 19:00:12 +0200
|
||||
Subject: [PATCH] Do not keep stale records by default
|
||||
|
||||
By default set max-stale-ttl to 0, unless stale-answer-enable yes. This
|
||||
were enabled by mistake when backporting fix for CVE-2023-2828. It
|
||||
causes increased cache usage on servers not wanting to serve stale
|
||||
records. Fix that by setting smart defaults based on stale answers
|
||||
enabled with possible manual tuning.
|
||||
---
|
||||
bin/named/server.c | 25 +++++++++++++++++++------
|
||||
1 file changed, 19 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/bin/named/server.c b/bin/named/server.c
|
||||
index 7af90d0..afdc4fa 100644
|
||||
--- a/bin/named/server.c
|
||||
+++ b/bin/named/server.c
|
||||
@@ -3295,7 +3295,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
|
||||
size_t max_acache_size;
|
||||
size_t max_adb_size;
|
||||
uint32_t lame_ttl, fail_ttl;
|
||||
- uint32_t max_stale_ttl;
|
||||
+ uint32_t max_stale_ttl = 0;
|
||||
dns_tsig_keyring_t *ring = NULL;
|
||||
dns_view_t *pview = NULL; /* Production view */
|
||||
isc_mem_t *cmctx = NULL, *hmctx = NULL;
|
||||
@@ -3739,16 +3739,29 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
|
||||
if (view->maxncachettl > 7 * 24 * 3600)
|
||||
view->maxncachettl = 7 * 24 * 3600;
|
||||
|
||||
- obj = NULL;
|
||||
- result = ns_config_get(maps, "max-stale-ttl", &obj);
|
||||
- INSIST(result == ISC_R_SUCCESS);
|
||||
- max_stale_ttl = cfg_obj_asuint32(obj);
|
||||
-
|
||||
obj = NULL;
|
||||
result = ns_config_get(maps, "stale-answer-enable", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS);
|
||||
view->staleanswersenable = cfg_obj_asboolean(obj);
|
||||
|
||||
+ // RHEL-11785 -- set the stale-ttl to non-zero value only if enabled
|
||||
+ obj = NULL;
|
||||
+ if (view->staleanswersenable) {
|
||||
+ result = ns_config_get(maps, "max-stale-ttl", &obj);
|
||||
+ INSIST(result == ISC_R_SUCCESS);
|
||||
+ max_stale_ttl = cfg_obj_asuint32(obj);
|
||||
+ /*
|
||||
+ * If 'stale-answer-enable' is false, max_stale_ttl is set
|
||||
+ * to 0, meaning keeping stale RRsets in cache is disabled.
|
||||
+ */
|
||||
+ } else {
|
||||
+ /* Do not use default value if stale is disabled,
|
||||
+ * but allow manual overriding, like 'stale-cache-enable' */
|
||||
+ result = ns_config_get(optionmaps, "max-stale-ttl", &obj);
|
||||
+ if (result == ISC_R_SUCCESS)
|
||||
+ max_stale_ttl = cfg_obj_asuint32(obj);
|
||||
+ }
|
||||
+
|
||||
result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
|
||||
view->rdclass, &pview);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
--
|
||||
2.41.0
|
||||
|
166
SOURCES/bind-9.16-CVE-2023-3341.patch
Normal file
166
SOURCES/bind-9.16-CVE-2023-3341.patch
Normal file
@ -0,0 +1,166 @@
|
||||
From 3883ec072e5feed1237dc864854ab95ded7302d6 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Mensik <pemensik@redhat.com>
|
||||
Date: Tue, 19 Sep 2023 13:14:52 +0200
|
||||
Subject: [PATCH] Backport of CVE-2023-3341 fix
|
||||
|
||||
Taken from BIND 9.16.44 change.
|
||||
---
|
||||
lib/isccc/cc.c | 36 +++++++++++++++++++++++---------
|
||||
lib/isccc/include/isccc/result.h | 4 +++-
|
||||
lib/isccc/result.c | 4 +++-
|
||||
3 files changed, 32 insertions(+), 12 deletions(-)
|
||||
|
||||
diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
|
||||
index 463a053..a54e60c 100644
|
||||
--- a/lib/isccc/cc.c
|
||||
+++ b/lib/isccc/cc.c
|
||||
@@ -53,6 +53,10 @@
|
||||
|
||||
#define MAX_TAGS 256
|
||||
#define DUP_LIFETIME 900
|
||||
+#ifndef ISCCC_MAXDEPTH
|
||||
+#define ISCCC_MAXDEPTH \
|
||||
+ 10 /* Big enough for rndc which just sends a string each way. */
|
||||
+#endif
|
||||
|
||||
typedef isccc_sexpr_t *sexpr_ptr;
|
||||
|
||||
@@ -573,19 +577,23 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
|
||||
|
||||
static isc_result_t
|
||||
table_fromwire(isccc_region_t *source, isccc_region_t *secret,
|
||||
- uint32_t algorithm, isccc_sexpr_t **alistp);
|
||||
+ uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp);
|
||||
|
||||
static isc_result_t
|
||||
-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp);
|
||||
+list_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **listp);
|
||||
|
||||
static isc_result_t
|
||||
-value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
|
||||
+value_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **valuep) {
|
||||
unsigned int msgtype;
|
||||
uint32_t len;
|
||||
isccc_sexpr_t *value;
|
||||
isccc_region_t active;
|
||||
isc_result_t result;
|
||||
|
||||
+ if (depth > ISCCC_MAXDEPTH) {
|
||||
+ return (ISCCC_R_MAXDEPTH);
|
||||
+ }
|
||||
+
|
||||
if (REGION_SIZE(*source) < 1 + 4)
|
||||
return (ISC_R_UNEXPECTEDEND);
|
||||
GET8(msgtype, source->rstart);
|
||||
@@ -603,9 +611,9 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
|
||||
} else
|
||||
result = ISC_R_NOMEMORY;
|
||||
} else if (msgtype == ISCCC_CCMSGTYPE_TABLE)
|
||||
- result = table_fromwire(&active, NULL, 0, valuep);
|
||||
+ result = table_fromwire(&active, NULL, 0, depth + 1, valuep);
|
||||
else if (msgtype == ISCCC_CCMSGTYPE_LIST)
|
||||
- result = list_fromwire(&active, valuep);
|
||||
+ result = list_fromwire(&active, depth + 1, valuep);
|
||||
else
|
||||
result = ISCCC_R_SYNTAX;
|
||||
|
||||
@@ -614,7 +622,7 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
|
||||
|
||||
static isc_result_t
|
||||
table_fromwire(isccc_region_t *source, isccc_region_t *secret,
|
||||
- uint32_t algorithm, isccc_sexpr_t **alistp)
|
||||
+ uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp)
|
||||
{
|
||||
char key[256];
|
||||
uint32_t len;
|
||||
@@ -625,6 +633,10 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
|
||||
|
||||
REQUIRE(alistp != NULL && *alistp == NULL);
|
||||
|
||||
+ if (depth > ISCCC_MAXDEPTH) {
|
||||
+ return (ISCCC_R_MAXDEPTH);
|
||||
+ }
|
||||
+
|
||||
checksum_rstart = NULL;
|
||||
first_tag = true;
|
||||
alist = isccc_alist_create();
|
||||
@@ -640,7 +652,7 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
|
||||
GET_MEM(key, len, source->rstart);
|
||||
key[len] = '\0'; /* Ensure NUL termination. */
|
||||
value = NULL;
|
||||
- result = value_fromwire(source, &value);
|
||||
+ result = value_fromwire(source, depth + 1, &value);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
goto bad;
|
||||
if (isccc_alist_define(alist, key, value) == NULL) {
|
||||
@@ -673,14 +685,18 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp) {
|
||||
+list_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **listp) {
|
||||
isccc_sexpr_t *list, *value;
|
||||
isc_result_t result;
|
||||
|
||||
+ if (depth > ISCCC_MAXDEPTH) {
|
||||
+ return (ISCCC_R_MAXDEPTH);
|
||||
+ }
|
||||
+
|
||||
list = NULL;
|
||||
while (!REGION_EMPTY(*source)) {
|
||||
value = NULL;
|
||||
- result = value_fromwire(source, &value);
|
||||
+ result = value_fromwire(source, depth + 1, &value);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
isccc_sexpr_free(&list);
|
||||
return (result);
|
||||
@@ -711,7 +727,7 @@ isccc_cc_fromwire(isccc_region_t *source, isccc_sexpr_t **alistp,
|
||||
if (version != 1)
|
||||
return (ISCCC_R_UNKNOWNVERSION);
|
||||
|
||||
- return (table_fromwire(source, secret, algorithm, alistp));
|
||||
+ return (table_fromwire(source, secret, algorithm, 0, alistp));
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
diff --git a/lib/isccc/include/isccc/result.h b/lib/isccc/include/isccc/result.h
|
||||
index 6c79dd7..b30b08a 100644
|
||||
--- a/lib/isccc/include/isccc/result.h
|
||||
+++ b/lib/isccc/include/isccc/result.h
|
||||
@@ -47,8 +47,10 @@
|
||||
#define ISCCC_R_CLOCKSKEW (ISC_RESULTCLASS_ISCCC + 4)
|
||||
/*% Duplicate */
|
||||
#define ISCCC_R_DUPLICATE (ISC_RESULTCLASS_ISCCC + 5)
|
||||
+/*% Maximum recursion depth */
|
||||
+#define ISCCC_R_MAXDEPTH (ISC_RESULTCLASS_ISCCC + 6)
|
||||
|
||||
-#define ISCCC_R_NRESULTS 6 /*%< Number of results */
|
||||
+#define ISCCC_R_NRESULTS 7 /*%< Number of results */
|
||||
|
||||
ISC_LANG_BEGINDECLS
|
||||
|
||||
diff --git a/lib/isccc/result.c b/lib/isccc/result.c
|
||||
index 8419bbb..a3a3b9a 100644
|
||||
--- a/lib/isccc/result.c
|
||||
+++ b/lib/isccc/result.c
|
||||
@@ -40,7 +40,8 @@ static const char *text[ISCCC_R_NRESULTS] = {
|
||||
"bad auth", /* 3 */
|
||||
"expired", /* 4 */
|
||||
"clock skew", /* 5 */
|
||||
- "duplicate" /* 6 */
|
||||
+ "duplicate", /* 6 */
|
||||
+ "max depth", /* 7 */
|
||||
};
|
||||
|
||||
static const char *ids[ISCCC_R_NRESULTS] = {
|
||||
@@ -50,6 +51,7 @@ static const char *ids[ISCCC_R_NRESULTS] = {
|
||||
"ISCCC_R_EXPIRED",
|
||||
"ISCCC_R_CLOCKSKEW",
|
||||
"ISCCC_R_DUPLICATE",
|
||||
+ "ISCCC_R_MAXDEPTH"
|
||||
};
|
||||
|
||||
#define ISCCC_RESULT_RESULTSET 2
|
||||
--
|
||||
2.41.0
|
||||
|
31
SOURCES/bind-9.16-update-b.root-servers.net.patch
Normal file
31
SOURCES/bind-9.16-update-b.root-servers.net.patch
Normal file
@ -0,0 +1,31 @@
|
||||
From 4e595a6b961e73af43350833109ccba0950119f9 Mon Sep 17 00:00:00 2001
|
||||
From: Mark Andrews <marka@isc.org>
|
||||
Date: Thu, 12 Oct 2023 10:19:38 +1100
|
||||
Subject: [PATCH] Update b.root-servers.net IP addresses
|
||||
|
||||
This covers both root hints and the default primaries for the root
|
||||
zone mirror. The official change date is Nov 27, 2023.
|
||||
|
||||
(cherry picked from commit 2ca2f7e9852a3d6e93f065c01ea4679f723688f7)
|
||||
---
|
||||
lib/dns/rootns.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/lib/dns/rootns.c b/lib/dns/rootns.c
|
||||
index 9653f3b..d6ff76e 100644
|
||||
--- a/lib/dns/rootns.c
|
||||
+++ b/lib/dns/rootns.c
|
||||
@@ -56,8 +56,8 @@ static char root_ns[] =
|
||||
". 518400 IN NS M.ROOT-SERVERS.NET.\n"
|
||||
"A.ROOT-SERVERS.NET. 3600000 IN A 198.41.0.4\n"
|
||||
"A.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:503:BA3E::2:30\n"
|
||||
-"B.ROOT-SERVERS.NET. 3600000 IN A 199.9.14.201\n"
|
||||
-"B.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:200::b\n"
|
||||
+"B.ROOT-SERVERS.NET. 3600000 IN A 170.247.170.2\n"
|
||||
+"B.ROOT-SERVERS.NET. 3600000 IN AAAA 2801:1b8:10::b\n"
|
||||
"C.ROOT-SERVERS.NET. 3600000 IN A 192.33.4.12\n"
|
||||
"C.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:2::c\n"
|
||||
"D.ROOT-SERVERS.NET. 3600000 IN A 199.7.91.13\n"
|
||||
--
|
||||
2.43.0
|
||||
|
0
SOURCES/generate-rndc-key.sh
Executable file → Normal file
0
SOURCES/generate-rndc-key.sh
Executable file → Normal file
@ -1,13 +1,13 @@
|
||||
|
||||
; <<>> DiG 9.11.3-RedHat-9.11.3-3.fc27 <<>> +bufsize=1200 +norec @a.root-servers.net
|
||||
; (2 servers found)
|
||||
; <<>> DiG 9.18.20 <<>> -4 +tcp +norec +nostats @d.root-servers.net
|
||||
; (1 server found)
|
||||
;; global options: +cmd
|
||||
;; Got answer:
|
||||
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46900
|
||||
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47286
|
||||
;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 27
|
||||
|
||||
;; OPT PSEUDOSECTION:
|
||||
; EDNS: version: 0, flags:; udp: 1472
|
||||
; EDNS: version: 0, flags:; udp: 1450
|
||||
;; QUESTION SECTION:
|
||||
;. IN NS
|
||||
|
||||
@ -28,7 +28,7 @@
|
||||
|
||||
;; ADDITIONAL SECTION:
|
||||
a.root-servers.net. 518400 IN A 198.41.0.4
|
||||
b.root-servers.net. 518400 IN A 199.9.14.201
|
||||
b.root-servers.net. 518400 IN A 170.247.170.2
|
||||
c.root-servers.net. 518400 IN A 192.33.4.12
|
||||
d.root-servers.net. 518400 IN A 199.7.91.13
|
||||
e.root-servers.net. 518400 IN A 192.203.230.10
|
||||
@ -41,7 +41,7 @@ k.root-servers.net. 518400 IN A 193.0.14.129
|
||||
l.root-servers.net. 518400 IN A 199.7.83.42
|
||||
m.root-servers.net. 518400 IN A 202.12.27.33
|
||||
a.root-servers.net. 518400 IN AAAA 2001:503:ba3e::2:30
|
||||
b.root-servers.net. 518400 IN AAAA 2001:500:200::b
|
||||
b.root-servers.net. 518400 IN AAAA 2801:1b8:10::b
|
||||
c.root-servers.net. 518400 IN AAAA 2001:500:2::c
|
||||
d.root-servers.net. 518400 IN AAAA 2001:500:2d::d
|
||||
e.root-servers.net. 518400 IN AAAA 2001:500:a8::e
|
||||
@ -54,8 +54,3 @@ k.root-servers.net. 518400 IN AAAA 2001:7fd::1
|
||||
l.root-servers.net. 518400 IN AAAA 2001:500:9f::42
|
||||
m.root-servers.net. 518400 IN AAAA 2001:dc3::35
|
||||
|
||||
;; Query time: 24 msec
|
||||
;; SERVER: 198.41.0.4#53(198.41.0.4)
|
||||
;; WHEN: Thu Apr 05 15:57:34 CEST 2018
|
||||
;; MSG SIZE rcvd: 811
|
||||
|
||||
|
0
SOURCES/setup-named-chroot.sh
Executable file → Normal file
0
SOURCES/setup-named-chroot.sh
Executable file → Normal file
0
SOURCES/setup-named-softhsm.sh
Executable file → Normal file
0
SOURCES/setup-named-softhsm.sh
Executable file → Normal file
@ -68,7 +68,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
|
||||
Name: bind
|
||||
License: MPLv2.0
|
||||
Version: 9.11.36
|
||||
Release: 9%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
|
||||
Release: 16%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.2
|
||||
Epoch: 32
|
||||
Url: https://www.isc.org/downloads/bind/
|
||||
#
|
||||
@ -172,6 +172,31 @@ Patch193: bind-9.16-CVE-2022-3094-1.patch
|
||||
Patch194: bind-9.16-CVE-2022-3094-2.patch
|
||||
Patch195: bind-9.16-CVE-2022-3094-3.patch
|
||||
Patch196: bind-9.16-CVE-2022-3094-test.patch
|
||||
# https://gitlab.isc.org/isc-projects/bind9/commit/f1d9e9ee3859976f403914d20ad2a10855343702
|
||||
Patch197: bind-9.11-CVE-2023-2828.patch
|
||||
Patch198: bind-9.16-CVE-2023-3341.patch
|
||||
# https://issues.redhat.com/browse/RHEL-11785, downstream
|
||||
Patch199: bind-9.11-stale-cache.patch
|
||||
# https://gitlab.isc.org/isc-projects/bind9/commit/8924adca613ca9daea63786563cce6fdbd742c56
|
||||
Patch200: bind-9.16-update-b.root-servers.net.patch
|
||||
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8768
|
||||
Patch201: bind-9.11-CVE-2023-4408.patch
|
||||
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8769
|
||||
Patch202: bind-9.11-CVE-2023-50387.patch
|
||||
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8778
|
||||
Patch203: bind-9.11-CVE-2023-2828-fixup.patch
|
||||
# addition to patch 200
|
||||
Patch204: bind-9.11-CVE-2023-50387-fixup.patch
|
||||
# https://gitlab.isc.org/isc-projects/bind9/commit/225f2861920b8f8d42a0ea6c34dd1faa93aa8726
|
||||
Patch205: bind-9.11-CVE-2024-1975.patch
|
||||
# https://gitlab.isc.org/isc-projects/bind9/commit/3e0a67e4bdb253dae3a03a45c1aa117239a3313d
|
||||
# https://gitlab.isc.org/isc-projects/bind9/commit/e4d7ce686bb38428eddc7e33b40057d68eca9a6e
|
||||
# https://gitlab.isc.org/isc-projects/bind9/commit/b9b5485b22c364fb88c27aa04bad4c8f616da3fa
|
||||
# https://gitlab.isc.org/isc-projects/bind9/commit/3f10d6eff035702796ba82cd28b9f7cf9836e743
|
||||
# https://gitlab.isc.org/isc-projects/bind9/commit/23a4652346fb2877d6246b1eebaa967969dbde16
|
||||
Patch206: bind-9.11-CVE-2024-1737.patch
|
||||
# RH downstream, allow changing by environment
|
||||
Patch208: bind-9.11-CVE-2024-1737-runtime-env.patch
|
||||
|
||||
# SDB patches
|
||||
Patch11: bind-9.3.2b2-sdbsrc.patch
|
||||
@ -197,6 +222,12 @@ Obsoletes: caching-nameserver < 31:9.4.1-7.fc8
|
||||
Provides: caching-nameserver = 31:9.4.1-7.fc8
|
||||
Obsoletes: dnssec-conf < 1.27-2
|
||||
Provides: dnssec-conf = 1.27-2
|
||||
# Fixes of CVE-2023-50387 and CVE-2023-50868 caused ABI change
|
||||
# Enforce updated rebuild is accepted only
|
||||
Conflicts: bind-dyndb-ldap < 11.6-5
|
||||
Conflicts: dhcp-client < 12:4.3.6-50
|
||||
Conflicts: dhcp-server < 12:4.3.6-50
|
||||
Conflicts: dhcp-relay < 12:4.3.6-50
|
||||
BuildRequires: gcc, make
|
||||
BuildRequires: openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
|
||||
BuildRequires: libidn2-devel, libxml2-devel
|
||||
@ -578,7 +609,17 @@ are used for building ISC DHCP.
|
||||
%patch194 -p1 -b .CVE-2022-3094
|
||||
%patch195 -p1 -b .CVE-2022-3094
|
||||
%patch196 -p1 -b .CVE-2022-3094-test
|
||||
|
||||
%patch197 -p1 -b .CVE-2023-2828
|
||||
%patch198 -p1 -b .CVE-2023-3341
|
||||
%patch199 -p1 -b .RHEL-11785
|
||||
%patch200 -p1 -b .b.root-servers.net
|
||||
%patch201 -p1 -b .CVE-2023-4408
|
||||
%patch202 -p1 -b .CVE-2023-50387+50868
|
||||
%patch203 -p1 -b .CVE-2023-2828-fixup
|
||||
%patch204 -p1 -b .CVE-2023-50387-fixup
|
||||
%patch205 -p1 -b .CVE-2024-1975
|
||||
%patch206 -p1 -b .CVE-2024-1737
|
||||
%patch208 -p1 -b .CVE-2024-1737-env
|
||||
|
||||
mkdir lib/dns/tests/testdata/dstrandom
|
||||
cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
|
||||
@ -1631,6 +1672,37 @@ rm -rf ${RPM_BUILD_ROOT}
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Tue Aug 06 2024 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-16.2
|
||||
- Rebuild after CI change
|
||||
|
||||
* Thu Jul 18 2024 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-16.1
|
||||
- Resolve CVE-2024-1975
|
||||
- Resolve CVE-2024-1737
|
||||
- Add ability to change runtime limits for max types and records per name
|
||||
|
||||
* Mon Apr 15 2024 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-16
|
||||
- Ensure incompatible dhcp is not accepted
|
||||
|
||||
* Fri Apr 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-15
|
||||
- Ensure incompatible bind-dyndb-ldap is not accepted
|
||||
|
||||
* Mon Feb 26 2024 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-14
|
||||
- Speed up parsing of DNS messages with many different names (CVE-2023-4408)
|
||||
- Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387 CVE-2023-50868)
|
||||
- Do not use header_prev in expire_lru_headers
|
||||
|
||||
* Thu Dec 07 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-13
|
||||
- Update addresses of b.root-servers.net (RHEL-18449)
|
||||
|
||||
* Mon Oct 09 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-12
|
||||
- Disable caching of stale records by default (RHEL-11785)
|
||||
|
||||
* Tue Sep 19 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-11
|
||||
- Prevent exahustion of memory from control channel (CVE-2023-3341)
|
||||
|
||||
* Thu Jun 22 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-10
|
||||
- Prevent the cache going over the configured limit (CVE-2023-2828)
|
||||
|
||||
* Wed Feb 08 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-9
|
||||
- Prevent flooding with UPDATE requests (CVE-2022-3094)
|
||||
- include upstream test for that change
|
||||
|
Loading…
Reference in New Issue
Block a user