bind/bind-9.11-CVE-2024-1737-runtime-env.patch

From 0a7909045f9e1bf74c1f0fd561a8ef5f55481e8f Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Mon, 29 Jul 2024 16:20:50 +0200
Subject: [PATCH] Allow global runtime definition by DNS_RBTDB_MAX_RTYPES

Modify rbtdb to not set it only at runtime, but allow setting that also
in runtime via environment variable. It is still possible to modify
default during the build define. In addition to it allows runtime change
also. Can be positive number to set limit, 0 disabled the check.

Similarly add also DNS_RDATASET_MAX_RECORDS to set maximum number of
records for a single name. This must be positive number, 0 is no accepted.

These replaces max-records-per-type and max-types-per-name in later
versions. But can be configured only by environment and can be
configured only globally, not in each view or zone.
---
 lib/dns/rbtdb.c     | 21 +++++++++++++++++++--
 lib/dns/rdataslab.c | 24 ++++++++++++++++++++++--
 2 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index a3cb8dc871..0104c3ee36 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -6320,15 +6320,29 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
 #define DNS_RBTDB_MAX_RTYPES 100
 #endif /* DNS_RBTDB_MAX_RTYPES */
 
+static uint32_t dns_g_rbtdb_max_rtypes = DNS_RBTDB_MAX_RTYPES;
+
+static void
+init_max_rtypes(void) {
+	/* Red Hat change, allow setting different max value by environment. */
+	const char *max = getenv("DNS_RBTDB_MAX_RTYPES");
+	if (max) {
+		char *endp = NULL;
+		long l = strtol(max, &endp, 10);
+		if (max != endp && endp && !*endp && l >= 0)
+			dns_g_rbtdb_max_rtypes = l;
+	}
+}
+
 static bool
 overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
 	UNUSED(rbtdb);
 
-	if (DNS_RBTDB_MAX_RTYPES == 0) {
+	if (dns_g_rbtdb_max_rtypes == 0) {
 		return (false);
 	}
 
-	return (ntypes >= DNS_RBTDB_MAX_RTYPES);
+	return (ntypes >= dns_g_rbtdb_max_rtypes);
 }
 
 static bool
@@ -8831,6 +8845,8 @@ static dns_dbmethods_t cache_methods = {
 	getservestalettl
 };
 
+static isc_once_t once_db = ISC_ONCE_INIT;
+
 isc_result_t
 #ifdef DNS_RBTDB_VERSION64
 dns_rbtdb64_create
@@ -8850,6 +8866,7 @@ dns_rbtdb_create
 
 	/* Keep the compiler happy. */
 	UNUSED(driverarg);
+	RUNTIME_CHECK(isc_once_do(&once_db, init_max_rtypes) == ISC_R_SUCCESS);
 
 	rbtdb = isc_mem_get(mctx, sizeof(*rbtdb));
 	if (rbtdb == NULL)
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
index 347b7d2ce8..9566f79671 100644
--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
@@ -17,6 +17,7 @@
 #include <stdlib.h>
 
 #include <isc/mem.h>
+#include <isc/once.h>
 #include <isc/region.h>
 #include <isc/string.h>		/* Required for HP/UX (and others?) */
 #include <isc/util.h>
@@ -119,6 +120,23 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
 #define DNS_RDATASET_MAX_RECORDS 100
 #endif /* DNS_RDATASET_MAX_RECORDS */
 
+static unsigned int dns_g_rdataset_max_records = DNS_RDATASET_MAX_RECORDS;
+static isc_once_t once = ISC_ONCE_INIT;
+
+static void
+init_max_records(void) {
+	/* Red Hat change, allow setting different max value by environment. */
+	const char *max = getenv("DNS_RDATASET_MAX_RECORDS");
+	if (max) {
+		char *endp = NULL;
+		long l = strtol(max, &endp, 10);
+		if (max != endp && endp && !*endp && l > 0)
+			dns_g_rdataset_max_records = l;
+	}
+}
+
+
+
 isc_result_t
 dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 			   isc_region_t *region, unsigned int reservelen)
@@ -165,7 +183,9 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 		return (ISC_R_SUCCESS);
 	}
 
-	if (nitems > DNS_RDATASET_MAX_RECORDS) {
+	RUNTIME_CHECK(isc_once_do(&once, init_max_records) == ISC_R_SUCCESS);
+
+	if (nitems > dns_g_rdataset_max_records) {
 		return (DNS_R_TOOMANYRECORDS);
 	}
 
@@ -662,7 +682,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 #endif
 	INSIST(ocount > 0 && ncount > 0);
 
-	if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
+	if (ocount + ncount > dns_g_rdataset_max_records) {
 		return (DNS_R_TOOMANYRECORDS);
 	}
 
-- 
2.45.2