Prevent flooding with UPDATE requests

6064. [security] An UPDATE message flood could cause named to exhaust all available memory. This flaw was addressed by adding a new "update-quota" statement that controls the number of simultaneous UPDATE messages that can be processed or forwarded. The default is 100. A stats counter has been added to record events when the update quota is exceeded, and the XML and JSON statistics version numbers have been updated. (CVE-2022-3094) [GL #3523] Resolves: CVE-2022-3094
2023-02-08 18:21:52 +01:00 · 2023-02-08 18:21:52 +01:00 · 1d416c2d77
commit 1d416c2d77
parent ef5514f8cb
4 changed files with 941 additions and 1 deletions
--- a/bind-9.16-CVE-2022-3094-1.patch
+++ b/bind-9.16-CVE-2022-3094-1.patch
@ -0,0 +1,240 @@
 From 128b3b676eb9413b4d25fb29c560895cfbbfa92e Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 1 Sep 2022 16:05:04 -0700
 Subject: [PATCH] add an update quota
 limit the number of simultaneous DNS UPDATE events that can be
 processed by adding a quota for update and update forwarding.
 this quota currently, arbitrarily, defaults to 100.
 also add a statistics counter to record when the update quota
 has been exceeded.
 (cherry picked from commit 7c47254a140c3e9cf383cda73c7b6a55c4782826)
 ---
 bin/named/bind9.xsl              |  2 +-
 bin/named/bind9.xsl.h            |  8 +++++++-
 bin/named/include/named/server.h |  7 ++++++-
 bin/named/server.c               |  3 +++
 bin/named/statschannel.c         |  5 +++--
 bin/named/update.c               | 34 +++++++++++++++++++++++++++++++-
 doc/arm/Bv9ARM-book.xml          | 15 ++++++++++++++
 7 files changed, 68 insertions(+), 6 deletions(-)
 diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl
 index 9a1c6ff..85fd4c4 100644
 --- a/bin/named/bind9.xsl
 +++ b/bin/named/bind9.xsl
@@ -12,7 +12,7 @@
 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
   <xsl:output method="html" indent="yes" version="4.0"/>
 -  <xsl:template match="statistics[@version=&quot;3.8&quot;]">
 +  <xsl:template match="statistics[@version=&quot;3.8.1&quot;]">
     <html>
       <head>
         <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
 diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
 index 9ce8cd7..5e0a892 100644
 --- a/bin/named/bind9.xsl.h
 +++ b/bin/named/bind9.xsl.h
@@ -17,7 +17,13 @@ static char xslmsg[] =
 	"\n"
 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
 -	" <xsl:template match=\"statistics[@version=&quot;3.8&quot;]\">\n"
 +#if 0
 +	" <!-- the version number **below** must match version in "
 +	"bin/named/statschannel.c -->\n"
 +	" <!-- don't forget to update \"/xml/v<STATS_XML_VERSION_MAJOR>\" in "
 +	"the HTTP endpoints listed below -->\n"
 +#endif
 +	" <xsl:template match=\"statistics[@version=&quot;3.8.1&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
 	" <script type=\"text/javascript\" src=\"https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js\"></script>\n"
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
 index 08a02dc..259acc7 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
@@ -137,6 +137,9 @@ struct ns_server {
 	uint16_t		transfer_tcp_message_size;
 	isc_rng_t *		rngctx;
 +
 +/* CVE-2022-3094 */
 +	isc_quota_t		updquota;
 };
 struct ns_altsecret {
@@ -230,7 +233,9 @@ enum {
 	dns_nsstatscounter_trystale = 59,
 	dns_nsstatscounter_usedstale = 60,
 -	dns_nsstatscounter_max = 61
 +	dns_nsstatscounter_updatequota = 61,
 +
 +	dns_nsstatscounter_max = 62
 };
 /*%
 diff --git a/bin/named/server.c b/bin/named/server.c
 index 2d2fa0e..f09b895 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -9143,6 +9143,8 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	result = isc_quota_init(&server->recursionquota, 100);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 +	result = isc_quota_init(&server->updquota, 100);
 +	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	result = dns_aclenv_init(mctx, &server->aclenv);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -9410,6 +9412,7 @@ ns_server_destroy(ns_server_t **serverp) {
 	dns_aclenv_destroy(&server->aclenv);
 +	isc_quota_destroy(&server->updquota);
 	isc_quota_destroy(&server->recursionquota);
 	isc_quota_destroy(&server->tcpquota);
 	isc_quota_destroy(&server->xfroutquota);
 diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
 index 56a9c21..1e8723c 100644
 --- a/bin/named/statschannel.c
 +++ b/bin/named/statschannel.c
@@ -300,6 +300,7 @@ init_desc(void) {
 	SET_NSSTATDESC(reclimitdropped,
 		       "queries dropped due to recursive client limit",
 		       "RecLimitDropped");
 +	SET_NSSTATDESC(updatequota, "Update quota exceeded", "UpdateQuota");
 	SET_NSSTATDESC(trystale,
 		       "attempts to use stale cache data after lookup failure",
 		       "QryTryStale");
@@ -1546,7 +1547,7 @@ generatexml(ns_server_t *server, uint32_t flags,
 			ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\""));
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
 -					 ISC_XMLCHAR "3.8"));
 +					 ISC_XMLCHAR "3.8.1"));
 	/* Set common fields for statistics dump */
 	dumparg.type = isc_statsformat_xml;
@@ -2303,7 +2304,7 @@ generatejson(ns_server_t *server, size_t *msglen,
 	/*
 	 * These statistics are included no matter which URL we use.
 	 */
 -	obj = json_object_new_string("1.2");
 +	obj = json_object_new_string("1.2.1");
 	CHECKMEM(obj);
 	json_object_object_add(bindstats, "json-stats-version", obj);
 diff --git a/bin/named/update.c b/bin/named/update.c
 index 6ad7d27..dccc543 100644
 --- a/bin/named/update.c
 +++ b/bin/named/update.c
@@ -1526,6 +1526,17 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	isc_task_t *zonetask = NULL;
 	ns_client_t *evclient;
 +	result = isc_quota_attach(&ns_g_server->updquota,
 +				  &(isc_quota_t *){ NULL });
 +	if (result != ISC_R_SUCCESS) {
 +		update_log(client, zone, LOGLEVEL_PROTOCOL,
 +			   "update failed: too many DNS UPDATEs queued (%s)",
 +			   isc_result_totext(result));
 +		isc_stats_increment(ns_g_server->nsstats,
 +				    dns_nsstatscounter_updatequota);
 +		CHECK(DNS_R_DROP);
 +	}
 +
 	event = (update_event_t *)
 		isc_event_allocate(client->mctx, client, DNS_EVENT_UPDATE,
 				   update_action, NULL, sizeof(*event));
@@ -1652,7 +1663,12 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
 	 * We are still in the client task context, so we can
 	 * simply give an error response without switching tasks.
 	 */
 -	respond(client, result);
 +	if (result == DNS_R_DROP) {
 +		ns_client_next(client, result);
 +	} else {
 +		respond(client, result);
 +	}
 +
 	if (zone != NULL)
 		dns_zone_detach(&zone);
 }
@@ -3385,6 +3401,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
 		dns_zone_detach(&uev->zone);
 	client->nupdates--;
 	respond(client, uev->result);
 +	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
 	isc_event_free(&event);
 	ns_client_detach(&client);
 }
@@ -3402,6 +3419,8 @@ forward_fail(isc_task_t *task, isc_event_t *event) {
 	INSIST(client->nupdates > 0);
 	client->nupdates--;
 	respond(client, DNS_R_SERVFAIL);
 +
 +	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
 	isc_event_free(&event);
 	ns_client_detach(&client);
 }
@@ -3439,6 +3458,8 @@ forward_done(isc_task_t *task, isc_event_t *event) {
 	client->nupdates--;
 	ns_client_sendraw(client, uev->answer);
 	dns_message_detach(&uev->answer);
 +
 +	isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
 	isc_event_free(&event);
 	ns_client_detach(&client);
 }
@@ -3472,6 +3493,17 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 	isc_task_t *zonetask = NULL;
 	ns_client_t *evclient;
 +	result = isc_quota_attach(&ns_g_server->updquota,
 +				  &(isc_quota_t *){ NULL });
 +	if (result != ISC_R_SUCCESS) {
 +		update_log(client, zone, LOGLEVEL_PROTOCOL,
 +			   "update failed: too many DNS UPDATEs queued (%s)",
 +			   isc_result_totext(result));
 +		isc_stats_increment(ns_g_server->nsstats,
 +				    dns_nsstatscounter_updatequota);
 +		return (DNS_R_DROP);
 +	}
 +
 	/*
 	 * This may take some time so replace this client.
 	 */
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
 index c17f168..9aca6d7 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
@@ -15105,6 +15105,21 @@ HOST-127.EXAMPLE. MX 0 .
 		      </para>
 		    </entry>
 		  </row>
 +		  <row rowsep="0">
 +		    <entry colname="1">
 +		      <para><command>UpdateQuota</command></para>
 +		    </entry>
 +		    <entry colname="2">
 +		      <para><command/></para>
 +		    </entry>
 +		    <entry colname="3">
 +		      <para>
 +			This indicates the number of times a dynamic update or update
 +			forwarding request was rejected because the number of pending
 +			requests exceeded the update quota.
 +		      </para>
 +		    </entry>
 +		  </row>
 		  <row rowsep="0">
 		    <entry colname="1">
 		      <para><command>RateDropped</command></para>
 -- 
 2.39.2
--- a/bind-9.16-CVE-2022-3094-2.patch
+++ b/bind-9.16-CVE-2022-3094-2.patch
@ -0,0 +1,136 @@
 From d9a03233c6ea11f20c2fbeca87b763673859f8b2 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 1 Sep 2022 16:22:46 -0700
 Subject: [PATCH] add a configuration option for the update quota
 add an "update-quota" option to configure the update quota.
 (cherry picked from commit f57758a7303ad0034ff2ff08eaaf2ef899630f19)
 ---
 bin/named/config.c                   |  1 +
 bin/named/named.conf.docbook         |  2 ++
 bin/named/server.c                   |  1 +
 bin/tests/system/checkconf/good.conf |  1 +
 doc/arm/Bv9ARM-book.xml              | 11 +++++++++++
 doc/arm/options.grammar.xml          |  1 +
 doc/misc/options                     |  1 +
 lib/isccfg/namedconf.c               |  1 +
 8 files changed, 19 insertions(+)
 diff --git a/bin/named/config.c b/bin/named/config.c
 index 62d1e88..e3731cf 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
@@ -134,6 +134,7 @@ options {\n\
 	transfers-per-ns 2;\n\
 #	treat-cr-as-space <obsolete>;\n\
 	trust-anchor-telemetry yes;\n\
 +	update-quota 100;\n\
 #	use-id-pool <obsolete>;\n\
 #	use-ixfr <obsolete>;\n\
 \n\
 diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
 index 6565fce..5842cb5 100644
 --- a/bin/named/named.conf.docbook
 +++ b/bin/named/named.conf.docbook
@@ -455,6 +455,7 @@ options {
 	trust-anchor-telemetry <replaceable>boolean</replaceable>; // experimental
 	try-tcp-refresh <replaceable>boolean</replaceable>;
 	update-check-ksk <replaceable>boolean</replaceable>;
 +	update-quota <replaceable>integer</replaceable>;
 	use-alt-transfer-source <replaceable>boolean</replaceable>;
 	use-v4-udp-ports { <replaceable>portrange</replaceable>; ... };
 	use-v6-udp-ports { <replaceable>portrange</replaceable>; ... };
@@ -864,6 +865,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		type ( delegation-only | forward | hint | master | redirect
 		    | slave | static-stub | stub );
 		update-check-ksk <replaceable>boolean</replaceable>;
 +		update-quota <replaceable>integer</replaceable>;
 		update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> (
 		    6to4-self | external | krb5-self | krb5-selfsub |
 		    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
 diff --git a/bin/named/server.c b/bin/named/server.c
 index f09b895..7af90d0 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -7792,6 +7792,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	configure_server_quota(maps, "tcp-clients", &server->tcpquota);
 	configure_server_quota(maps, "recursive-clients",
 			       &server->recursionquota);
 +	configure_server_quota(maps, "update-quota", &server->updquota);
 	if (server->recursionquota.max > 1000) {
 		int margin = ISC_MAX(100, ns_g_cpus + 1);
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
 index 1359cf3..5d9b292 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
@@ -63,6 +63,7 @@ options {
 	serial-queries 10;
 	serial-query-rate 100;
 	server-id none;
 +	update-quota 200;
 	max-cache-size 20000000000000;
 	nta-lifetime 604800;
 	nta-recheck 604800;
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
 index 9aca6d7..acf772b 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
@@ -8599,6 +8599,17 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 	      </listitem>
 	    </varlistentry>
 +	    <varlistentry>
 +	      <term><command>update-quota</command></term>
 +	      <listitem>
 +		<para>
 +		This is the maximum number of simultaneous DNS UPDATE messages that
 +		the server will accept for updating local authoritiative zones or
 +			forwarding to a primary server. The default is <userinput>100</userinput>.
 +		</para>
 +	      </listitem>
 +	    </varlistentry>
 +
 	  </variablelist>
 	</section>
 diff --git a/doc/arm/options.grammar.xml b/doc/arm/options.grammar.xml
 index 793ac0b..1d17ea8 100644
 --- a/doc/arm/options.grammar.xml
 +++ b/doc/arm/options.grammar.xml
@@ -277,6 +277,7 @@
 	<command>trust-anchor-telemetry</command> <replaceable>boolean</replaceable>; // experimental
 	<command>try-tcp-refresh</command> <replaceable>boolean</replaceable>;
 	<command>update-check-ksk</command> <replaceable>boolean</replaceable>;
 +	<command>update-quota</command> <replaceable>integer</replaceable>;
 	<command>use-alt-transfer-source</command> <replaceable>boolean</replaceable>;
 	<command>use-v4-udp-ports</command> { <replaceable>portrange</replaceable>; ... };
 	<command>use-v6-udp-ports</command> { <replaceable>portrange</replaceable>; ... };
 diff --git a/doc/misc/options b/doc/misc/options
 index fde93c7..e6d6ba6 100644
 --- a/doc/misc/options
 +++ b/doc/misc/options
@@ -357,6 +357,7 @@ options {
         trust-anchor-telemetry <boolean>; // experimental
         try-tcp-refresh <boolean>;
         update-check-ksk <boolean>;
 +        update-quota <integer>;
         use-alt-transfer-source <boolean>;
         use-id-pool <boolean>; // obsolete
         use-ixfr <boolean>; // obsolete
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
 index b562f95..667111c 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
@@ -1136,6 +1136,7 @@ options_clauses[] = {
 	{ "transfers-out", &cfg_type_uint32, 0 },
 	{ "transfers-per-ns", &cfg_type_uint32, 0 },
 	{ "treat-cr-as-space", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 +	{ "update-quota", &cfg_type_uint32, 0 },
 	{ "use-id-pool", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "use-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
 -- 
 2.39.2
--- a/bind-9.16-CVE-2022-3094-3.patch
+++ b/bind-9.16-CVE-2022-3094-3.patch
@ -0,0 +1,553 @@
 From cba333b262b7ee0034a66cc93cf27f6c4918eea2 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 8 Nov 2022 17:32:41 -0800
 Subject: [PATCH] move update ACL and update-policy checks before quota
 check allow-update, update-policy, and allow-update-forwarding before
 consuming quota slots, so that unauthorized clients can't fill the
 quota.
 (this moves the access check before the prerequisite check, which
 violates the precise wording of RFC 2136. however, RFC co-author Paul
 Vixie has stated that the RFC is mistaken on this point; it should have
 said that access checking must happen *no later than* the completion of
 prerequisite checks, not that it must happen exactly then.)
 (cherry picked from commit 964f559edb5036880b8e463b8f190b9007ee055d)
 ---
 bin/named/update.c | 440 ++++++++++++++++++++++++++++++---------------
 1 file changed, 298 insertions(+), 142 deletions(-)
 diff --git a/bin/named/update.c b/bin/named/update.c
 index 8853ee7..4d1fe78 100644
 --- a/bin/named/update.c
 +++ b/bin/named/update.c
@@ -251,6 +251,9 @@ static void updatedone_action(isc_task_t *task, isc_event_t *event);
 static isc_result_t send_forward_event(ns_client_t *client, dns_zone_t *zone);
 static void forward_done(isc_task_t *task, isc_event_t *event);
 static isc_result_t add_rr_prepare_action(void *data, rr_t *rr);
 +static isc_result_t
 +rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 +	  const dns_rdata_t *rdata, bool *flag);
 /**************************************************************************/
@@ -328,23 +331,24 @@ checkqueryacl(ns_client_t *client, dns_acl_t *queryacl, dns_name_t *zonename,
 {
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char classbuf[DNS_RDATACLASS_FORMATSIZE];
 -	int level;
 	isc_result_t result;
 +	bool update_possible =
 +		((updateacl != NULL && !dns_acl_isnone(updateacl)) ||
 +		 ssutable != NULL);
 	result = ns_client_checkaclsilent(client, NULL, queryacl, true);
 	if (result != ISC_R_SUCCESS) {
 +		int level = update_possible ? ISC_LOG_ERROR : ISC_LOG_INFO;
 +
 		dns_name_format(zonename, namebuf, sizeof(namebuf));
 		dns_rdataclass_format(client->view->rdclass, classbuf,
 				      sizeof(classbuf));
 -		level = (updateacl == NULL && ssutable == NULL) ?
 -				ISC_LOG_INFO : ISC_LOG_ERROR;
 -
 		ns_client_log(client, NS_LOGCATEGORY_UPDATE_SECURITY,
 			      NS_LOGMODULE_UPDATE, level,
 			      "update '%s/%s' denied due to allow-query",
 			      namebuf, classbuf);
 -	} else if (updateacl == NULL && ssutable == NULL) {
 +	} else if (!update_possible) {
 		dns_name_format(zonename, namebuf, sizeof(namebuf));
 		dns_rdataclass_format(client->view->rdclass, classbuf,
 				      sizeof(classbuf));
@@ -1525,6 +1529,277 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 	ns_client_t *evclient;
 +#if 1
 +	dns_ssutable_t *ssutable = NULL;
 +	dns_message_t *request = client->message;
 +	dns_rdataclass_t zoneclass;
 +	dns_rdatatype_t covers;
 +	dns_name_t *zonename = NULL;
 +	dns_db_t *db = NULL;
 +	dns_dbversion_t *ver = NULL;
 +
 +	CHECK(dns_zone_getdb(zone, &db));
 +	zonename = dns_db_origin(db);
 +	zoneclass = dns_db_class(db);
 +	dns_zone_getssutable(zone, &ssutable);
 +	dns_db_currentversion(db, &ver);
 +
 +	/*
 +	 * Update message processing can leak record existence information
 +	 * so check that we are allowed to query this zone.  Additionally,
 +	 * if we would refuse all updates for this zone, we bail out here.
 +	 */
 +	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone),
 +			    dns_zone_getorigin(zone),
 +			    dns_zone_getupdateacl(zone), ssutable));
 +
 +	/*
 +	 * Check requestor's permissions.
 +	 */
 +	if (ssutable == NULL)
 +		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 +				     "update", zonename, false, false));
 +	else if (client->signer == NULL && !TCPCLIENT(client))
 +		CHECK(checkupdateacl(client, NULL, "update", zonename,
 +				     false, true));
 +
 +	if (dns_zone_getupdatedisabled(zone))
 +		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
 +				     "because the zone is frozen.  Use "
 +				     "'rndc thaw' to re-enable updates.");
 +
 +	/*
 +	 * Perform the Update Section Prescan.
 +	 */
 +
 +	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 +	     result == ISC_R_SUCCESS;
 +	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 +	{
 +		dns_name_t *name = NULL;
 +		dns_rdata_t rdata = DNS_RDATA_INIT;
 +		dns_ttl_t ttl;
 +		dns_rdataclass_t update_class;
 +		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
 +			       &name, &rdata, &covers, &ttl, &update_class);
 +
 +		if (! dns_name_issubdomain(name, zonename))
 +			FAILC(DNS_R_NOTZONE,
 +			      "update RR is outside zone");
 +		if (update_class == zoneclass) {
 +			/*
 +			 * Check for meta-RRs.  The RFC2136 pseudocode says
 +			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
 +			 * "or any other QUERY metatype"
 +			 */
 +			if (dns_rdatatype_ismeta(rdata.type)) {
 +				FAILC(DNS_R_FORMERR,
 +				      "meta-RR in update");
 +			}
 +			result = dns_zone_checknames(zone, name, &rdata);
 +			if (result != ISC_R_SUCCESS)
 +				FAIL(DNS_R_REFUSED);
 +		} else if (update_class == dns_rdataclass_any) {
 +			if (ttl != 0 || rdata.length != 0 ||
 +			    (dns_rdatatype_ismeta(rdata.type) &&
 +			     rdata.type != dns_rdatatype_any))
 +				FAILC(DNS_R_FORMERR,
 +				      "meta-RR in update");
 +		} else if (update_class == dns_rdataclass_none) {
 +			if (ttl != 0 ||
 +			    dns_rdatatype_ismeta(rdata.type))
 +				FAILC(DNS_R_FORMERR,
 +				      "meta-RR in update");
 +		} else {
 +			update_log(client, zone, ISC_LOG_WARNING,
 +				   "update RR has incorrect class %d",
 +				   update_class);
 +			FAIL(DNS_R_FORMERR);
 +		}
 +
 +		/*
 +		 * draft-ietf-dnsind-simple-secure-update-01 says
 +		 * "Unlike traditional dynamic update, the client
 +		 * is forbidden from updating NSEC records."
 +		 */
 +		if (rdata.type == dns_rdatatype_nsec3) {
 +			FAILC(DNS_R_REFUSED,
 +			      "explicit NSEC3 updates are not allowed "
 +			      "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_nsec) {
 +			FAILC(DNS_R_REFUSED,
 +			      "explicit NSEC updates are not allowed "
 +			      "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_rrsig &&
 +			   !dns_name_equal(name, zonename)) {
 +			FAILC(DNS_R_REFUSED,
 +			      "explicit RRSIG updates are currently "
 +			      "not supported in secure zones except "
 +			      "at the apex");
 +		}
 +
 +		if (ssutable != NULL) {
 +			isc_netaddr_t netaddr;
 +			dst_key_t *tsigkey = NULL;
 +			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 +
 +			if (client->message->tsigkey != NULL)
 +				tsigkey = client->message->tsigkey->key;
 +
 +			if (rdata.type != dns_rdatatype_any) {
 +				if (!dns_ssutable_checkrules2
 +				    (ssutable, client->signer, name, &netaddr,
 +				     TCPCLIENT(client),
 +				     &ns_g_server->aclenv,
 +				     rdata.type, tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED,
 +					      "rejected by secure update");
 +				}
 +			} else {
 +				if (!ssu_checkall(db, ver, name, ssutable,
 +						  client->signer,
 +						  &netaddr,
 +						  TCPCLIENT(client),
 +						  tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED,
 +					      "rejected by secure update");
 +				}
 +			}
 +		}
 +	}
 +	if (result != ISC_R_NOMORE)
 +		FAIL(result);
 +
 +	update_log(client, zone, LOGLEVEL_DEBUG,
 +		   "update section prescan OK");
 +#if 0
 +	if (ssutable == NULL) {
 +		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 +						// zonename
 +				     "update", dns_zone_getorigin(zone), false,
 +				     false));
 +	} else if (client->signer == NULL && !TCPCLIENT(client)) {
 +		CHECK(checkupdateacl(client, NULL, "update",
 +				     dns_zone_getorigin(zone), false, true));
 +	}
 +
 +	if (dns_zone_getupdatedisabled(zone)) {
 +		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
 +				     "because the zone is frozen.  Use "
 +				     "'rndc thaw' to re-enable updates.");
 +	}
 +
 +	/*
 +	 * Prescan the update section, checking for updates that
 +	 * are illegal or violate policy.
 +	 */
 +	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 +	     result == ISC_R_SUCCESS;
 +	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 +	{
 +		dns_name_t *name = NULL;
 +		dns_rdata_t rdata = DNS_RDATA_INIT;
 +		dns_ttl_t ttl;
 +		dns_rdataclass_t update_class;
 +
 +		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
 +			       &rdata, &covers, &ttl, &update_class);
 +
 +		if (!dns_name_issubdomain(name, zonename)) {
 +			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
 +		}
 +		if (update_class == zoneclass) {
 +			/*
 +			 * Check for meta-RRs.  The RFC2136 pseudocode says
 +			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
 +			 * "or any other QUERY metatype"
 +			 */
 +			if (dns_rdatatype_ismeta(rdata.type)) {
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +			result = dns_zone_checknames(zone, name, &rdata);
 +			if (result != ISC_R_SUCCESS) {
 +				FAIL(DNS_R_REFUSED);
 +			}
 +		} else if (update_class == dns_rdataclass_any) {
 +			if (ttl != 0 || rdata.length != 0 ||
 +			    (dns_rdatatype_ismeta(rdata.type) &&
 +			     rdata.type != dns_rdatatype_any))
 +			{
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +		} else if (update_class == dns_rdataclass_none) {
 +			if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +		} else {
 +			update_log(client, zone, ISC_LOG_WARNING,
 +				   "update RR has incorrect class %d",
 +				   update_class);
 +			FAIL(DNS_R_FORMERR);
 +		}
 +
 +		/*
 +		 * draft-ietf-dnsind-simple-secure-update-01 says
 +		 * "Unlike traditional dynamic update, the client
 +		 * is forbidden from updating NSEC records."
 +		 */
 +		if (rdata.type == dns_rdatatype_nsec3) {
 +			FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
 +					     "allowed "
 +					     "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_nsec) {
 +			FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
 +					     "allowed "
 +					     "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_rrsig &&
 +			   !dns_name_equal(name, zonename))
 +		{
 +			FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
 +					     "currently "
 +					     "not supported in secure zones "
 +					     "except "
 +					     "at the apex");
 +		}
 +
 +		if (ssutable != NULL) {
 +			isc_netaddr_t netaddr;
 +			dst_key_t *tsigkey = NULL;
 +			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 +
 +			if (client->message->tsigkey != NULL) {
 +				tsigkey = client->message->tsigkey->key;
 +			}
 +
 +			if (rdata.type != dns_rdatatype_any) {
 +				if (!dns_ssutable_checkrules(
 +					    ssutable, client->signer, name,
 +					    &netaddr, TCPCLIENT(client), env,
 +					    rdata.type, tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED, "rejected by "
 +							     "secure update");
 +				}
 +			} else {
 +				if (!ssu_checkall(db, ver, name, ssutable,
 +						  client->signer, &netaddr, env,
 +						  TCPCLIENT(client), tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED, "rejected by "
 +							     "secure update");
 +				}
 +			}
 +		}
 +	}
 +	if (result != ISC_R_NOMORE) {
 +		FAIL(result);
 +	}
 +
 +	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
 +#endif
 +#endif
 	result = isc_quota_attach(&ns_g_server->updquota,
 				  &(isc_quota_t *){ NULL });
@@ -1558,6 +1833,15 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
  failure:
 	if (event != NULL)
 		isc_event_free(ISC_EVENT_PTR(&event));
 +	if (db != NULL) {
 +		dns_db_closeversion(db, &ver, false);
 +		dns_db_detach(&db);
 +	}
 +
 +	if (ssutable != NULL) {
 +		dns_ssutable_detach(&ssutable);
 +	}
 +
 	return (result);
 }
@@ -1644,9 +1928,6 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
 		CHECK(send_update_event(client, zone));
 		break;
 	case dns_zone_slave:
 -		CHECK(checkupdateacl(client, dns_zone_getforwardacl(zone),
 -				     "update forwarding", zonename, true,
 -				     false));
 		CHECK(send_forward_event(client, zone));
 		break;
 	default:
@@ -1656,7 +1937,6 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
  failure:
 	if (result == DNS_R_REFUSED) {
 -		INSIST(dns_zone_gettype(zone) == dns_zone_slave);
 		inc_stats(zone, dns_nsstatscounter_updaterej);
 	}
 	/*
@@ -2520,7 +2800,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	dns_rdatatype_t covers;
 	dns_message_t *request = client->message;
 	dns_rdataclass_t zoneclass;
 -	dns_name_t *zonename;
 +	dns_name_t *zonename = NULL;
 	dns_ssutable_t *ssutable = NULL;
 	dns_fixedname_t tmpnamefixed;
 	dns_name_t *tmpname = NULL;
@@ -2542,14 +2822,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	zonename = dns_db_origin(db);
 	zoneclass = dns_db_class(db);
 	dns_zone_getssutable(zone, &ssutable);
 -
 -	/*
 -	 * Update message processing can leak record existence information
 -	 * so check that we are allowed to query this zone.  Additionally
 -	 * if we would refuse all updates for this zone we bail out here.
 -	 */
 -	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone), zonename,
 -			    dns_zone_getupdateacl(zone), ssutable));
 +	options = dns_zone_getoptions(zone);
 	/*
 	 * Get old and new versions now that queryacl has been checked.
@@ -2673,134 +2946,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	update_log(client, zone, LOGLEVEL_DEBUG,
 		   "prerequisites are OK");
 -	/*
 -	 * Check Requestor's Permissions.  It seems a bit silly to do this
 -	 * only after prerequisite testing, but that is what RFC2136 says.
 -	 */
 -	if (ssutable == NULL)
 -		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 -				     "update", zonename, false, false));
 -	else if (client->signer == NULL && !TCPCLIENT(client))
 -		CHECK(checkupdateacl(client, NULL, "update", zonename,
 -				     false, true));
 -
 -	if (dns_zone_getupdatedisabled(zone))
 -		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
 -				     "because the zone is frozen.  Use "
 -				     "'rndc thaw' to re-enable updates.");
 -
 -	/*
 -	 * Perform the Update Section Prescan.
 -	 */
 -
 -	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 -	     result == ISC_R_SUCCESS;
 -	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 -	{
 -		dns_name_t *name = NULL;
 -		dns_rdata_t rdata = DNS_RDATA_INIT;
 -		dns_ttl_t ttl;
 -		dns_rdataclass_t update_class;
 -		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
 -			       &name, &rdata, &covers, &ttl, &update_class);
 -
 -		if (! dns_name_issubdomain(name, zonename))
 -			FAILC(DNS_R_NOTZONE,
 -			      "update RR is outside zone");
 -		if (update_class == zoneclass) {
 -			/*
 -			 * Check for meta-RRs.  The RFC2136 pseudocode says
 -			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
 -			 * "or any other QUERY metatype"
 -			 */
 -			if (dns_rdatatype_ismeta(rdata.type)) {
 -				FAILC(DNS_R_FORMERR,
 -				      "meta-RR in update");
 -			}
 -			result = dns_zone_checknames(zone, name, &rdata);
 -			if (result != ISC_R_SUCCESS)
 -				FAIL(DNS_R_REFUSED);
 -		} else if (update_class == dns_rdataclass_any) {
 -			if (ttl != 0 || rdata.length != 0 ||
 -			    (dns_rdatatype_ismeta(rdata.type) &&
 -			     rdata.type != dns_rdatatype_any))
 -				FAILC(DNS_R_FORMERR,
 -				      "meta-RR in update");
 -		} else if (update_class == dns_rdataclass_none) {
 -			if (ttl != 0 ||
 -			    dns_rdatatype_ismeta(rdata.type))
 -				FAILC(DNS_R_FORMERR,
 -				      "meta-RR in update");
 -		} else {
 -			update_log(client, zone, ISC_LOG_WARNING,
 -				   "update RR has incorrect class %d",
 -				   update_class);
 -			FAIL(DNS_R_FORMERR);
 -		}
 -
 -		/*
 -		 * draft-ietf-dnsind-simple-secure-update-01 says
 -		 * "Unlike traditional dynamic update, the client
 -		 * is forbidden from updating NSEC records."
 -		 */
 -		if (rdata.type == dns_rdatatype_nsec3) {
 -			FAILC(DNS_R_REFUSED,
 -			      "explicit NSEC3 updates are not allowed "
 -			      "in secure zones");
 -		} else if (rdata.type == dns_rdatatype_nsec) {
 -			FAILC(DNS_R_REFUSED,
 -			      "explicit NSEC updates are not allowed "
 -			      "in secure zones");
 -		} else if (rdata.type == dns_rdatatype_rrsig &&
 -			   !dns_name_equal(name, zonename)) {
 -			FAILC(DNS_R_REFUSED,
 -			      "explicit RRSIG updates are currently "
 -			      "not supported in secure zones except "
 -			      "at the apex");
 -		}
 -
 -		if (ssutable != NULL) {
 -			isc_netaddr_t netaddr;
 -			dst_key_t *tsigkey = NULL;
 -			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 -
 -			if (client->message->tsigkey != NULL)
 -				tsigkey = client->message->tsigkey->key;
 -
 -			if (rdata.type != dns_rdatatype_any) {
 -				if (!dns_ssutable_checkrules2
 -				    (ssutable, client->signer, name, &netaddr,
 -				     TCPCLIENT(client),
 -				     &ns_g_server->aclenv,
 -				     rdata.type, tsigkey))
 -				{
 -					FAILC(DNS_R_REFUSED,
 -					      "rejected by secure update");
 -				}
 -			} else {
 -				if (!ssu_checkall(db, ver, name, ssutable,
 -						  client->signer,
 -						  &netaddr,
 -						  TCPCLIENT(client),
 -						  tsigkey))
 -				{
 -					FAILC(DNS_R_REFUSED,
 -					      "rejected by secure update");
 -				}
 -			}
 -		}
 -	}
 -	if (result != ISC_R_NOMORE)
 -		FAIL(result);
 -
 -	update_log(client, zone, LOGLEVEL_DEBUG,
 -		   "update section prescan OK");
 -
 	/*
 	 * Process the Update Section.
 	 */
 -	options = dns_zone_getoptions(zone);
 	options2 = dns_zone_getoptions2(zone);
 	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 	     result == ISC_R_SUCCESS;
@@ -3494,6 +3643,13 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 	isc_task_t *zonetask = NULL;
 	ns_client_t *evclient;
 +	result = checkupdateacl(client, dns_zone_getforwardacl(zone),
 +				"update forwarding", dns_zone_getorigin(zone),
 +				true, false);
 +	if (result != ISC_R_SUCCESS) {
 +		return (result);
 +	}
 +
 	result = isc_quota_attach(&ns_g_server->updquota,
 				  &(isc_quota_t *){ NULL });
 	if (result != ISC_R_SUCCESS) {
 -- 
 2.39.2
--- a/bind.spec
+++ b/bind.spec
@ -68,7 +68,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.36
-Release:  8%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  9%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@ -167,6 +167,10 @@ Patch190: bind-9.11-rh2101712.patch
 Patch191: bind-9.11-CVE-2022-2795.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7376
 Patch192: bind-9.11-rh2133889.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/82185f4f80d2fa39a4569f6740cb360ffff8f5c4
 Patch193: bind-9.16-CVE-2022-3094-1.patch
 Patch194: bind-9.16-CVE-2022-3094-2.patch
 Patch195: bind-9.16-CVE-2022-3094-3.patch
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@ -569,6 +573,10 @@ are used for building ISC DHCP.
 %patch190 -p1 -b .rh2101712
 %patch191 -p1 -b .CVE-2022-2795
 %patch192 -p1 -b .rh2133889
 %patch193 -p1 -b .CVE-2022-3094
 %patch194 -p1 -b .CVE-2022-3094
 %patch195 -p1 -b .CVE-2022-3094
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@ -1621,6 +1629,9 @@ rm -rf ${RPM_BUILD_ROOT}
 %endif
 %changelog
 * Wed Feb 08 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-9
 - Prevent flooding with UPDATE requests (CVE-2022-3094)
 * Thu Oct 13 2022 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-8
 - Correct regression preventing bind-dyndb-ldap build (#2133889)