rpms/bind
7
0
Fork 1
Code Issues Pull Requests Releases Activity

Fix patches after rebase

Browse Source 
zone.c was left broken. Fix it.

Resolves: RHEL-6454
This commit is contained in:
Petr Menšík 2025-11-11 19:23:50 +01:00 committed by Fedor Vorobev
parent fa95441ced
commit 4b8cbe77ba
13 changed files with 732 additions and 6141 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

107
bind-9.16-CVE-2024-1737-records-test.patch
View File

@ -1,4 +1,4 @@
From 460116952fe7f8ad684ca6248fc4d87c11c9d4a0 Mon Sep 17 00:00:00 2001
From 37cb1cc74c954c01b2c06730b17e8cf3db589b7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Thu, 23 May 2024 19:12:40 +0200
Subject: [PATCH] Add test for not-loading and not-transfering huge RRSets
@ -20,7 +20,6 @@ succeed when the cap is disabled.
(cherry picked from commit 8e3efb4e06ba68cc3f9bc5be2bacb2596bd74cb3)
(cherry picked from commit 4a0fe202a906e32d3316d161fff053d3b1737a18)
---
bin/tests/system/conf.sh.common | 1 +
bin/tests/system/limits/ns1/named.conf.in | 1 +
bin/tests/system/masterformat/clean.sh | 2 +
bin/tests/system/masterformat/ns1/compile.sh | 2 +
@ -29,36 +28,24 @@ succeed when the cap is disabled.
bin/tests/system/masterformat/ns1/uber.db.in | 22 +
.../system/masterformat/ns2/named.conf.in | 8 +
bin/tests/system/masterformat/setup.sh | 19 +-
bin/tests/system/masterformat/tests.sh | 64 +-
bin/tests/system/masterformat/tests.sh | 60 +
bin/tests/system/reclimit/ns1/big.db | 2515 +++++++++++++++++
bin/tests/system/reclimit/ns1/named.conf.in | 6 +
bin/tests/system/reclimit/ns1/root.db | 3 +
bin/tests/system/reclimit/ns3/named5.conf.in | 42 +
bin/tests/system/reclimit/tests.sh | 12 +-
bin/tests/system/resolver/tests.sh | 3 +-
16 files changed, 2729 insertions(+), 8 deletions(-)
15 files changed, 2728 insertions(+), 4 deletions(-)
create mode 100644 bin/tests/system/masterformat/ns1/huge.db.in
create mode 100644 bin/tests/system/masterformat/ns1/uber.db.in
create mode 100644 bin/tests/system/reclimit/ns1/big.db
create mode 100644 bin/tests/system/reclimit/ns3/named5.conf.in
diff --git a/bin/tests/system/conf.sh.common b/bin/tests/system/conf.sh.common
index 61edca2d21..9fab00ff5c 100644
--- a/bin/tests/system/conf.sh.common
+++ b/bin/tests/system/conf.sh.common
@@ -710,6 +710,7 @@ copy_setports() {
-e "s/${atsign}ALTERNATIVE_ALGORITHM${atsign}/${ALTERNATIVE_ALGORITHM}/g" \
-e "s/${atsign}ALTERNATIVE_ALGORITHM_NUMBER${atsign}/${ALTERNATIVE_ALGORITHM_NUMBER}/g" \
-e "s/${atsign}ALTERNATIVE_BITS${atsign}/${ALTERNATIVE_BITS}/g" \
+ -e "s/${atsign}DEFAULT_HMAC${atsign}/${DEFAULT_HMAC}/g" \
-e "s/${atsign}DISABLED_ALGORITHM${atsign}/${DISABLED_ALGORITHM}/g" \
-e "s/${atsign}DISABLED_ALGORITHM_NUMBER${atsign}/${DISABLED_ALGORITHM_NUMBER}/g" \
-e "s/${atsign}DISABLED_BITS${atsign}/${DISABLED_BITS}/g" \
diff --git a/bin/tests/system/limits/ns1/named.conf.in b/bin/tests/system/limits/ns1/named.conf.in
index a2724a4d30..59c30b4c37 100644
index 118fdbd..cf0aa78 100644
--- a/bin/tests/system/limits/ns1/named.conf.in
+++ b/bin/tests/system/limits/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
@@ -22,6 +22,7 @@ options {
recursion no;
notify yes;
minimal-responses no;
@ -67,10 +54,10 @@ index a2724a4d30..59c30b4c37 100644
zone "." {
diff --git a/bin/tests/system/masterformat/clean.sh b/bin/tests/system/masterformat/clean.sh
index 82502fc430..a9183af6ff 100755
index c53c7ab..c606c61 100755
--- a/bin/tests/system/masterformat/clean.sh
+++ b/bin/tests/system/masterformat/clean.sh
@@ -14,6 +14,8 @@ rm -f ./ns1/example.db.compat
@@ -16,6 +16,8 @@ rm -f ./ns1/example.db.compat
rm -f ./ns1/example.db.serial.raw
rm -f ./ns1/large.db ./ns1/large.db.raw
rm -f ./ns1/example.db.map ./ns1/signed.db.map
@ -80,21 +67,21 @@ index 82502fc430..a9183af6ff 100755
rm -f ./dig.out.*
rm -f ./dig.out
diff --git a/bin/tests/system/masterformat/ns1/compile.sh b/bin/tests/system/masterformat/ns1/compile.sh
index 7d35986117..9972e51aa4 100755
index ad24bb3..3427954 100755
--- a/bin/tests/system/masterformat/ns1/compile.sh
+++ b/bin/tests/system/masterformat/ns1/compile.sh
@@ -27,6 +27,8 @@ $CHECKZONE -D -F raw -L 3333 -o example.db.serial.raw example \
$CHECKZONE -D -F raw -o large.db.raw large large.db > /dev/null 2>&1
@@ -29,6 +29,8 @@ $CHECKZONE -D -F raw -L 3333 -o example.db.serial.raw example \
$CHECKZONE -D -F raw -o large.db.raw large large.db >/dev/null 2>&1
$CHECKZONE -D -F map -o example.db.map example-map \
example.db > /dev/null 2>&1
example.db >/dev/null 2>&1
+$CHECKZONE -D -F raw -o huge.db.raw huge huge.db >/dev/null 2>&1
+$CHECKZONE -D -F raw -o uber.db.raw uber uber.db >/dev/null 2>&1
$KEYGEN -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK signed > /dev/null 2>&1
$KEYGEN -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" signed > /dev/null 2>&1
$KEYGEN -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK signed >/dev/null 2>&1
$KEYGEN -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" signed >/dev/null 2>&1
diff --git a/bin/tests/system/masterformat/ns1/huge.db.in b/bin/tests/system/masterformat/ns1/huge.db.in
new file mode 100644
index 0000000000..5a818632a8
index 0000000..5a81863
--- /dev/null
+++ b/bin/tests/system/masterformat/ns1/huge.db.in
@@ -0,0 +1,22 @@
@ -121,10 +108,10 @@ index 0000000000..5a818632a8
+ NS ns
+ns A 10.53.0.1
diff --git a/bin/tests/system/masterformat/ns1/named.conf.in b/bin/tests/system/masterformat/ns1/named.conf.in
index 2b7c11c991..4c3614f671 100644
index cc95655..1434ec3 100644
--- a/bin/tests/system/masterformat/ns1/named.conf.in
+++ b/bin/tests/system/masterformat/ns1/named.conf.in
@@ -20,6 +20,7 @@ options {
@@ -22,6 +22,7 @@ options {
notify no;
session-keyfile "session.key";
servfail-ttl 0;
@ -132,7 +119,7 @@ index 2b7c11c991..4c3614f671 100644
};
key rndc_key {
@@ -75,6 +76,20 @@ zone "large" {
@@ -77,6 +78,20 @@ zone "large" {
allow-transfer { any; };
};
@ -155,7 +142,7 @@ index 2b7c11c991..4c3614f671 100644
file "signed.db.map";
diff --git a/bin/tests/system/masterformat/ns1/uber.db.in b/bin/tests/system/masterformat/ns1/uber.db.in
new file mode 100644
index 0000000000..5a818632a8
index 0000000..5a81863
--- /dev/null
+++ b/bin/tests/system/masterformat/ns1/uber.db.in
@@ -0,0 +1,22 @@
@ -182,10 +169,10 @@ index 0000000000..5a818632a8
+ NS ns
+ns A 10.53.0.1
diff --git a/bin/tests/system/masterformat/ns2/named.conf.in b/bin/tests/system/masterformat/ns2/named.conf.in
index 4df1d37990..0468ddd17a 100644
index c0f2987..df778bc 100644
--- a/bin/tests/system/masterformat/ns2/named.conf.in
+++ b/bin/tests/system/masterformat/ns2/named.conf.in
@@ -19,6 +19,7 @@ options {
@@ -21,6 +21,7 @@ options {
recursion no;
notify no;
servfail-ttl 0;
@ -193,7 +180,7 @@ index 4df1d37990..0468ddd17a 100644
};
zone "example" {
@@ -59,3 +60,10 @@ zone "large" {
@@ -61,3 +62,10 @@ zone "large" {
masterfile-format raw;
file "large.bk";
};
@ -205,10 +192,10 @@ index 4df1d37990..0468ddd17a 100644
+ file "huge.bk";
+};
diff --git a/bin/tests/system/masterformat/setup.sh b/bin/tests/system/masterformat/setup.sh
index ffc2b42a84..7af1ad978a 100755
index f304242..57b8a24 100755
--- a/bin/tests/system/masterformat/setup.sh
+++ b/bin/tests/system/masterformat/setup.sh
@@ -22,8 +22,23 @@ cp ns1/example.db ns2/
@@ -24,8 +24,23 @@ cp ns1/example.db ns2/
cp ns2/formerly-text.db.in ns2/formerly-text.db
cp ns1/large.db.in ns1/large.db
awk 'END {
@ -217,7 +204,7 @@ index ffc2b42a84..7af1ad978a 100755
+ for (i = 0; i < 500; i++ ) { print "a TXT", i; }
+ for (i = 0; i < 1000; i++ ) { print "b TXT", i; }
for (i = 0; i < 2000; i++ ) { print "c TXT", i; }
}' < /dev/null >> ns1/large.db
}' </dev/null >>ns1/large.db
+cp ns1/huge.db.in ns1/huge.db
+awk 'END {
+ for (i = 0; i < 500; i++ ) { print "a TXT", i; }
@ -235,17 +222,13 @@ index ffc2b42a84..7af1ad978a 100755
+}' </dev/null >>ns1/uber.db
cd ns1 && $SHELL compile.sh
diff --git a/bin/tests/system/masterformat/tests.sh b/bin/tests/system/masterformat/tests.sh
index bb4e6ec3cd..83ab738faf 100755
index 3a4eb3e..c3be164 100755
--- a/bin/tests/system/masterformat/tests.sh
+++ b/bin/tests/system/masterformat/tests.sh
@@ -188,10 +188,66 @@ echo_i "checking that large rdatasets loaded ($n)"
for i in 0 1 2 3 4 5 6 7 8 9
do
ret=0
-for a in a b c
-do
- $DIG +tcp txt "${a}.large" @10.53.0.2 -p "${PORT}" > "dig.out.ns2.test$n"
- grep "status: NOERROR" "dig.out.ns2.test$n" > /dev/null || ret=1
@@ -190,6 +190,66 @@ for i in 0 1 2 3 4 5 6 7 8 9; do
for a in a b c; do
$DIG +tcp txt "${a}.large" @10.53.0.2 -p "${PORT}" >"dig.out.ns2.test$n"
grep "status: NOERROR" "dig.out.ns2.test$n" >/dev/null || ret=1
+ for a in a b c
+ do
+ $DIG +tcp txt "${a}.large" @10.53.0.1 -p "${PORT}" >"dig.out.ns1.$a.test$n"
@ -306,12 +289,12 @@ index bb4e6ec3cd..83ab738faf 100755
+ for a in a b c d e; do
+ $DIG +tcp txt "${a}.uber" @10.53.0.1 -p "${PORT}" >"dig.out.ns1.$a.test$n"
+ grep "status: SERVFAIL" "dig.out.ns1.$a.test$n" >/dev/null || ret=1
done
[ $ret -eq 0 ] && break
sleep 1
done
[ $ret -eq 0 ] && break
sleep 1
diff --git a/bin/tests/system/reclimit/ns1/big.db b/bin/tests/system/reclimit/ns1/big.db
new file mode 100644
index 0000000000..bddceb76e7
index 0000000..bddceb7
--- /dev/null
+++ b/bin/tests/system/reclimit/ns1/big.db
@@ -0,0 +1,2515 @@
@ -2831,10 +2814,10 @@ index 0000000000..bddceb76e7
+biganswer.big. 60 IN A 10.10.50.49
+biganswer.big. 60 IN A 10.10.50.50
diff --git a/bin/tests/system/reclimit/ns1/named.conf.in b/bin/tests/system/reclimit/ns1/named.conf.in
index 3eb07b7fd3..e6c3c38214 100644
index 63cb706..c56c0db 100644
--- a/bin/tests/system/reclimit/ns1/named.conf.in
+++ b/bin/tests/system/reclimit/ns1/named.conf.in
@@ -20,6 +20,12 @@ options {
@@ -22,6 +22,12 @@ options {
listen-on-v6 { none; };
recursion no;
dnssec-validation no;
@ -2848,10 +2831,10 @@ index 3eb07b7fd3..e6c3c38214 100644
+ file "big.db";
+};
diff --git a/bin/tests/system/reclimit/ns1/root.db b/bin/tests/system/reclimit/ns1/root.db
index 3a6f7880ba..569abd5ee5 100644
index 412715c..30e175b 100644
--- a/bin/tests/system/reclimit/ns1/root.db
+++ b/bin/tests/system/reclimit/ns1/root.db
@@ -17,3 +17,6 @@ example.net. 60 IN NS direct.example.net.
@@ -19,3 +19,6 @@ example.net. 60 IN NS direct.example.net.
direct.example.net. 60 IN A 10.53.0.2
example.com. 60 IN NS direct.example.com.
direct.example.com. 60 IN A 10.53.0.4
@ -2860,7 +2843,7 @@ index 3a6f7880ba..569abd5ee5 100644
+ns.big. 60 IN A 10.53.0.1
diff --git a/bin/tests/system/reclimit/ns3/named5.conf.in b/bin/tests/system/reclimit/ns3/named5.conf.in
new file mode 100644
index 0000000000..56f704a3c0
index 0000000..56f704a
--- /dev/null
+++ b/bin/tests/system/reclimit/ns3/named5.conf.in
@@ -0,0 +1,42 @@
@ -2907,12 +2890,12 @@ index 0000000000..56f704a3c0
+
+zone "." { type hint; file "hints.db"; };
diff --git a/bin/tests/system/reclimit/tests.sh b/bin/tests/system/reclimit/tests.sh
index c7d088af53..f76f955a60 100644
index a203445..b332e38 100644
--- a/bin/tests/system/reclimit/tests.sh
+++ b/bin/tests/system/reclimit/tests.sh
@@ -204,6 +204,16 @@ eval count=`cat dig.out.3.test$n`
@@ -221,6 +221,16 @@ eval count=$(cat dig.out.3.test$n)
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
status=$(expr $status + $ret)
-#grep "duplicate query" ns3/named.run
+n=$((n + 1))
@ -2929,10 +2912,10 @@ index c7d088af53..f76f955a60 100644
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
index bd997a61a4..711ee0537c 100755
index b871972..e2341a6 100755
--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
@@ -566,7 +566,8 @@ $DIG $DIGOPTS @10.53.0.5 fetchall.tld any > dig.out.3.${n} || ret=1
@@ -607,7 +607,8 @@ sleep 1
# because of the order of the records in the cache
$DIG $DIGOPTS @10.53.0.5 fetchall.tld any >dig.out.3.${n} || ret=1
ttl3=$(awk '/^fetchall.tld/ { print $2; exit }' dig.out.3.${n})
@ -2940,8 +2923,8 @@ index bd997a61a4..711ee0537c 100755
+#test "${ttl3:-0}" -gt "${ttl2:-1}" || ret=1
+test "${ttl3:-0}" -gt "${ttl2:-1}" || echo_i "Later TTL is not greater, $ttl3 <= $ttl2"
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
status=$((status + ret))
--
2.45.2
2.51.1

27
bind-9.16-CVE-2024-1737-records-test2.patch
View File

@ -1,27 +0,0 @@
From 7bc5e5abf5a3cd66f11cc649b6ecf4c39c92bd9e Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Fri, 9 Aug 2024 12:32:20 +0200
Subject: [PATCH] fixup! Add test for not-loading and not-transfering huge
RRSets
---
bin/tests/system/conf.sh.common | 3 +++
1 file changed, 3 insertions(+)
diff --git a/bin/tests/system/conf.sh.common b/bin/tests/system/conf.sh.common
index 9fab00f..e617595 100644
--- a/bin/tests/system/conf.sh.common
+++ b/bin/tests/system/conf.sh.common
@@ -301,6 +301,9 @@ DISABLED_ALGORITHM=ECDSAP384SHA384
DISABLED_ALGORITHM_NUMBER=14
DISABLED_BITS=384
+# Default HMAC algorithm.
+export DEFAULT_HMAC=hmac-sha256
+
#
# Useful functions in test scripts
#
--
2.45.2

295
bind-9.16-CVE-2024-1737-records.patch
View File

@ -1,4 +1,4 @@
From 2df11e5a549a71a8f792ac5207254b6a9e09859c Mon Sep 17 00:00:00 2001
From 4ff43d14005c2cafcc950ad726a9a86c25452e5a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Fri, 1 Mar 2024 08:26:07 +0100
Subject: [PATCH] Add a limit to the number of RRs in RRSets
@ -18,42 +18,42 @@ be configured globally, per-view and per-zone.
(cherry picked from commit f63d72fb7e5813585c92d7f92bdcc5885cd04edc)
---
bin/named/config.c | 1 +
bin/named/server.c | 9 ++++
bin/named/server.c | 9 +++++
bin/named/zoneconf.c | 8 ++++
bin/tests/system/dyndb/driver/db.c | 3 +-
doc/arm/reference.rst | 12 +++++
doc/arm/reference.rst | 12 ++++++
doc/misc/master.zoneopt | 2 +
doc/misc/mirror.zoneopt | 2 +
doc/misc/options | 44 +++++++++++-------
doc/misc/options.active | 44 +++++++++++-------
doc/misc/options | 44 +++++++++++++--------
doc/misc/options.active | 27 ++++++++-----
doc/misc/redirect.zoneopt | 2 +
doc/misc/slave.zoneopt | 2 +
doc/misc/static-stub.zoneopt | 2 +
doc/misc/stub.zoneopt | 2 +
lib/dns/cache.c | 13 ++++++
lib/dns/db.c | 9 ++++
lib/dns/cache.c | 13 +++++++
lib/dns/db.c | 9 +++++
lib/dns/dnsrps.c | 3 +-
lib/dns/ecdb.c | 8 +++-
lib/dns/include/dns/cache.h | 6 +++
lib/dns/include/dns/db.h | 8 ++++
lib/dns/include/dns/rdataslab.h | 6 ++-
lib/dns/include/dns/view.h | 7 +++
lib/dns/include/dns/zone.h | 26 +++++++++++
lib/dns/rbtdb.c | 45 ++++++++++++------
lib/dns/rdataslab.c | 10 ++--
lib/dns/include/dns/view.h | 7 ++++
lib/dns/include/dns/zone.h | 26 +++++++++++++
lib/dns/rbtdb.c | 45 +++++++++++++++-------
lib/dns/rdataslab.c | 10 +++--
lib/dns/sdb.c | 3 +-
lib/dns/sdlz.c | 3 +-
lib/dns/view.c | 11 +++++
lib/dns/xfrin.c | 24 ++--------
lib/dns/zone.c | 74 ++++++++++++++++++++++--------
lib/dns/view.c | 11 ++++++
lib/dns/xfrin.c | 24 +++---------
lib/dns/zone.c | 61 +++++++++++++++++++++++++++---
lib/isccfg/namedconf.c | 3 ++
30 files changed, 296 insertions(+), 96 deletions(-)
30 files changed, 286 insertions(+), 76 deletions(-)
diff --git a/bin/named/config.c b/bin/named/config.c
index c37015f3b2..9cba6f588b 100644
index 522798a..72dec1a 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -215,6 +215,7 @@ options {\n\
@@ -226,6 +226,7 @@ options {\n\
ixfr-from-differences false;\n\
max-journal-size default;\n\
max-records 0;\n\
@ -62,10 +62,10 @@ index c37015f3b2..9cba6f588b 100644
max-retry-time 1209600; /* 2 weeks */\n\
max-transfer-idle-in 60;\n\
diff --git a/bin/named/server.c b/bin/named/server.c
index 8fd9ee7e5a..7bf5f2664d 100644
index 098e21d..f550814 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -5418,6 +5418,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
@@ -5452,6 +5452,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
dns_resolver_setclientsperquery(view->resolver, cfg_obj_asuint32(obj),
max_clients_per_query);
@ -82,10 +82,10 @@ index 8fd9ee7e5a..7bf5f2664d 100644
result = named_config_get(maps, "max-recursion-depth", &obj);
INSIST(result == ISC_R_SUCCESS);
diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index 97c2094ca2..ae5cc656ee 100644
index 2e614aa..81f6879 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -1092,6 +1092,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
@@ -1072,6 +1072,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
dns_zone_setmaxrecords(zone, 0);
}
@ -101,10 +101,10 @@ index 97c2094ca2..ae5cc656ee 100644
#define SIGNED ".signed"
size_t signedlen = strlen(filename) + sizeof(SIGNED);
diff --git a/bin/tests/system/dyndb/driver/db.c b/bin/tests/system/dyndb/driver/db.c
index 77d335e2ea..6725a3bacd 100644
index 5f01185..727268f 100644
--- a/bin/tests/system/dyndb/driver/db.c
+++ b/bin/tests/system/dyndb/driver/db.c
@@ -592,7 +592,8 @@ static dns_dbmethods_t sampledb_methods = {
@@ -622,7 +622,8 @@ static dns_dbmethods_t sampledb_methods = {
NULL, /* setservestalerefresh */
NULL, /* getservestalerefresh */
NULL, /* setgluecachestats */
@ -115,10 +115,10 @@ index 77d335e2ea..6725a3bacd 100644
/* Auxiliary driver functions. */
diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index ad7ff2761a..b1983ef30d 100644
index f982e0a..fbd8edb 100644
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -2890,6 +2890,18 @@ system.
@@ -2945,6 +2945,18 @@ system.
This sets the maximum number of records permitted in a zone. The default is
zero, which means the maximum is unlimited.
@ -138,7 +138,7 @@ index ad7ff2761a..b1983ef30d 100644
This sets the maximum number (a "hard quota") of simultaneous recursive lookups
the server performs on behalf of clients. The default is
diff --git a/doc/misc/master.zoneopt b/doc/misc/master.zoneopt
index cc8a33b56f..864a852ef4 100644
index 953e3a2..b2fc2c8 100644
--- a/doc/misc/master.zoneopt
+++ b/doc/misc/master.zoneopt
@@ -38,8 +38,10 @@ zone <string> [ <class> ] {
@ -153,7 +153,7 @@ index cc8a33b56f..864a852ef4 100644
notify ( explicit | master-only | primary-only | <boolean> );
notify-delay <integer>;
diff --git a/doc/misc/mirror.zoneopt b/doc/misc/mirror.zoneopt
index 3d45a3d1e5..701edce540 100644
index 3d45a3d..701edce 100644
--- a/doc/misc/mirror.zoneopt
+++ b/doc/misc/mirror.zoneopt
@@ -19,12 +19,14 @@ zone <string> [ <class> ] {
@ -172,7 +172,7 @@ index 3d45a3d1e5..701edce540 100644
min-retry-time <integer>;
multi-master <boolean>;
diff --git a/doc/misc/options b/doc/misc/options
index 90d07f5a56..ee152b8179 100644
index 0dbcf10..93eb156 100644
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -170,13 +170,16 @@ options {
@ -196,7 +196,7 @@ index 90d07f5a56..ee152b8179 100644
+ unlimited | <integer> ) ] [ suffix ( increment
+ | timestamp ) ]; // not configured
+ dnstap-version ( <quoted_string> | none ); // not configured
dscp <integer>;
dscp <integer>; // deprecated
dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
<integer> ] [ dscp <integer> ] | <ipv4_address> [ port
@@ -200,13 +203,13 @@ options {
@ -236,7 +236,7 @@ index 90d07f5a56..ee152b8179 100644
max-udp-size <integer>;
max-zone-ttl ( unlimited | <duration> );
memstatistics <boolean>;
@@ -569,8 +574,9 @@ view <string> [ <class> ] {
@@ -570,8 +575,9 @@ view <string> [ <class> ] {
dnssec-secure-to-insecure <boolean>;
dnssec-update-mode ( maintain | no-resign );
dnssec-validation ( yes | no | auto );
@ -248,7 +248,7 @@ index 90d07f5a56..ee152b8179 100644
dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
<integer> ] [ dscp <integer> ] | <ipv4_address> [ port
<integer> ] [ dscp <integer> ] | <ipv6_address> [ port
@@ -622,6 +628,7 @@ view <string> [ <class> ] {
@@ -623,6 +629,7 @@ view <string> [ <class> ] {
max-journal-size ( default | unlimited | <sizeval> );
max-ncache-ttl <duration>;
max-records <integer>;
@ -256,7 +256,7 @@ index 90d07f5a56..ee152b8179 100644
max-recursion-depth <integer>;
max-recursion-queries <integer>;
max-refresh-time <integer>;
@@ -631,6 +638,7 @@ view <string> [ <class> ] {
@@ -632,6 +639,7 @@ view <string> [ <class> ] {
max-transfer-idle-out <integer>;
max-transfer-time-in <integer>;
max-transfer-time-out <integer>;
@ -264,7 +264,7 @@ index 90d07f5a56..ee152b8179 100644
max-udp-size <integer>;
max-zone-ttl ( unlimited | <duration> );
message-compression <boolean>;
@@ -854,12 +862,14 @@ view <string> [ <class> ] {
@@ -855,12 +863,14 @@ view <string> [ <class> ] {
max-ixfr-ratio ( unlimited | <percentage> );
max-journal-size ( default | unlimited | <sizeval> );
max-records <integer>;
@ -279,7 +279,7 @@ index 90d07f5a56..ee152b8179 100644
max-zone-ttl ( unlimited | <duration> );
min-refresh-time <integer>;
min-retry-time <integer>;
@@ -971,12 +981,14 @@ zone <string> [ <class> ] {
@@ -972,12 +982,14 @@ zone <string> [ <class> ] {
max-ixfr-ratio ( unlimited | <percentage> );
max-journal-size ( default | unlimited | <sizeval> );
max-records <integer>;
@ -295,34 +295,10 @@ index 90d07f5a56..ee152b8179 100644
min-refresh-time <integer>;
min-retry-time <integer>;
diff --git a/doc/misc/options.active b/doc/misc/options.active
index 0229d8da6d..ad4e29a9ba 100644
index eb75a86..f3ac9e7 100644
--- a/doc/misc/options.active
+++ b/doc/misc/options.active
@@ -156,13 +156,16 @@ options {
dnssec-secure-to-insecure <boolean>;
dnssec-update-mode ( maintain | no-resign );
dnssec-validation ( yes | no | auto );
- dnstap { ( all | auth | client | forwarder | resolver | update ) [
- ( query | response ) ]; ... };
- dnstap-identity ( <quoted_string> | none | hostname );
- dnstap-output ( file | unix ) <quoted_string> [ size ( unlimited |
- <size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix (
- increment | timestamp ) ];
- dnstap-version ( <quoted_string> | none );
+ dnstap { ( all | auth | client | forwarder |
+ resolver | update ) [ ( query | response ) ];
+ ... }; // not configured
+ dnstap-identity ( <quoted_string> | none |
+ hostname ); // not configured
+ dnstap-output ( file | unix ) <quoted_string> [
+ size ( unlimited | <size> ) ] [ versions (
+ unlimited | <integer> ) ] [ suffix ( increment
+ | timestamp ) ]; // not configured
+ dnstap-version ( <quoted_string> | none ); // not configured
dscp <integer>;
dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
<integer> ] [ dscp <integer> ] | <ipv4_address> [ port
@@ -181,13 +184,13 @@ options {
@@ -181,13 +181,13 @@ options {
forward ( first | only );
forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
| <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
@ -343,7 +319,7 @@ index 0229d8da6d..ad4e29a9ba 100644
geoip-directory ( <quoted_string> | none );
glue-cache <boolean>;
heartbeat-interval <integer>;
@@ -217,6 +220,7 @@ options {
@@ -217,6 +217,7 @@ options {
max-journal-size ( default | unlimited | <sizeval> );
max-ncache-ttl <duration>;
max-records <integer>;
@ -351,7 +327,7 @@ index 0229d8da6d..ad4e29a9ba 100644
max-recursion-depth <integer>;
max-recursion-queries <integer>;
max-refresh-time <integer>;
@@ -227,6 +231,7 @@ options {
@@ -227,6 +228,7 @@ options {
max-transfer-idle-out <integer>;
max-transfer-time-in <integer>;
max-transfer-time-out <integer>;
@ -359,7 +335,7 @@ index 0229d8da6d..ad4e29a9ba 100644
max-udp-size <integer>;
max-zone-ttl ( unlimited | <duration> );
memstatistics <boolean>;
@@ -513,8 +518,9 @@ view <string> [ <class> ] {
@@ -514,8 +516,9 @@ view <string> [ <class> ] {
dnssec-secure-to-insecure <boolean>;
dnssec-update-mode ( maintain | no-resign );
dnssec-validation ( yes | no | auto );
@ -371,7 +347,7 @@ index 0229d8da6d..ad4e29a9ba 100644
dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
<integer> ] [ dscp <integer> ] | <ipv4_address> [ port
<integer> ] [ dscp <integer> ] | <ipv6_address> [ port
@@ -559,6 +565,7 @@ view <string> [ <class> ] {
@@ -560,6 +563,7 @@ view <string> [ <class> ] {
max-journal-size ( default | unlimited | <sizeval> );
max-ncache-ttl <duration>;
max-records <integer>;
@ -379,7 +355,7 @@ index 0229d8da6d..ad4e29a9ba 100644
max-recursion-depth <integer>;
max-recursion-queries <integer>;
max-refresh-time <integer>;
@@ -568,6 +575,7 @@ view <string> [ <class> ] {
@@ -569,6 +573,7 @@ view <string> [ <class> ] {
max-transfer-idle-out <integer>;
max-transfer-time-in <integer>;
max-transfer-time-out <integer>;
@ -387,7 +363,7 @@ index 0229d8da6d..ad4e29a9ba 100644
max-udp-size <integer>;
max-zone-ttl ( unlimited | <duration> );
message-compression <boolean>;
@@ -774,12 +782,14 @@ view <string> [ <class> ] {
@@ -775,12 +780,14 @@ view <string> [ <class> ] {
max-ixfr-ratio ( unlimited | <percentage> );
max-journal-size ( default | unlimited | <sizeval> );
max-records <integer>;
@ -402,7 +378,7 @@ index 0229d8da6d..ad4e29a9ba 100644
max-zone-ttl ( unlimited | <duration> );
min-refresh-time <integer>;
min-retry-time <integer>;
@@ -884,12 +894,14 @@ zone <string> [ <class> ] {
@@ -885,12 +892,14 @@ zone <string> [ <class> ] {
max-ixfr-ratio ( unlimited | <percentage> );
max-journal-size ( default | unlimited | <sizeval> );
max-records <integer>;
@ -418,7 +394,7 @@ index 0229d8da6d..ad4e29a9ba 100644
min-refresh-time <integer>;
min-retry-time <integer>;
diff --git a/doc/misc/redirect.zoneopt b/doc/misc/redirect.zoneopt
index 6a5ef660a2..c4ab59ddad 100644
index 6a5ef66..c4ab59d 100644
--- a/doc/misc/redirect.zoneopt
+++ b/doc/misc/redirect.zoneopt
@@ -8,6 +8,8 @@ zone <string> [ <class> ] {
@ -431,7 +407,7 @@ index 6a5ef660a2..c4ab59ddad 100644
primaries [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
zone-statistics ( full | terse | none | <boolean> );
diff --git a/doc/misc/slave.zoneopt b/doc/misc/slave.zoneopt
index 8cb7c3143f..ccd88e5c15 100644
index c46202d..52ce7cf 100644
--- a/doc/misc/slave.zoneopt
+++ b/doc/misc/slave.zoneopt
@@ -31,12 +31,14 @@ zone <string> [ <class> ] {
@ -450,7 +426,7 @@ index 8cb7c3143f..ccd88e5c15 100644
min-retry-time <integer>;
multi-master <boolean>;
diff --git a/doc/misc/static-stub.zoneopt b/doc/misc/static-stub.zoneopt
index f89d46248a..102b980c7a 100644
index f89d462..102b980 100644
--- a/doc/misc/static-stub.zoneopt
+++ b/doc/misc/static-stub.zoneopt
@@ -5,6 +5,8 @@ zone <string> [ <class> ] {
@ -463,7 +439,7 @@ index f89d46248a..102b980c7a 100644
server-names { <string>; ... };
zone-statistics ( full | terse | none | <boolean> );
diff --git a/doc/misc/stub.zoneopt b/doc/misc/stub.zoneopt
index 2db604dae6..ca4bf1ce39 100644
index 2db604d..ca4bf1c 100644
--- a/doc/misc/stub.zoneopt
+++ b/doc/misc/stub.zoneopt
@@ -13,10 +13,12 @@ zone <string> [ <class> ] {
@ -480,10 +456,10 @@ index 2db604dae6..ca4bf1ce39 100644
min-retry-time <integer>;
multi-master <boolean>;
diff --git a/lib/dns/cache.c b/lib/dns/cache.c
index ae173b86ab..9f0412dbe7 100644
index b5d2b09..8cb442b 100644
--- a/lib/dns/cache.c
+++ b/lib/dns/cache.c
@@ -148,6 +148,8 @@ struct dns_cache {
@@ -151,6 +151,8 @@ struct dns_cache {
/* Locked by 'filelock'. */
char *filename;
/* Access to the on-disk cache file is also locked by 'filelock'. */
@ -492,15 +468,15 @@ index ae173b86ab..9f0412dbe7 100644
};
/***
@@ -175,6 +177,7 @@ cache_create_db(dns_cache_t *cache, dns_db_t **db) {
cache->db_argv, db);
if (result == ISC_R_SUCCESS) {
dns_db_setservestalettl(*db, cache->serve_stale_ttl);
+ dns_db_setmaxrrperset(*db, cache->maxrrperset);
@@ -184,6 +186,7 @@ cache_create_db(dns_cache_t *cache, dns_db_t **db) {
}
return (result);
}
@@ -1277,6 +1280,16 @@ dns_cache_updatestats(dns_cache_t *cache, isc_result_t result) {
dns_db_setservestalettl(*db, cache->serve_stale_ttl);
+ dns_db_setmaxrrperset(*db, cache->maxrrperset);
if (cache->taskmgr == NULL) {
return (ISC_R_SUCCESS);
@@ -1316,6 +1319,16 @@ dns_cache_updatestats(dns_cache_t *cache, isc_result_t result) {
}
}
@ -518,10 +494,10 @@ index ae173b86ab..9f0412dbe7 100644
* XXX: Much of the following code has been copied in from statschannel.c.
* We should refactor this into a generic function in stats.c that can be
diff --git a/lib/dns/db.c b/lib/dns/db.c
index ec537486cb..8439265a7f 100644
index f90add1..a575d62 100644
--- a/lib/dns/db.c
+++ b/lib/dns/db.c
@@ -1122,3 +1122,12 @@ dns_db_setgluecachestats(dns_db_t *db, isc_stats_t *stats) {
@@ -1137,3 +1137,12 @@ dns_db_setgluecachestats(dns_db_t *db, isc_stats_t *stats) {
return (ISC_R_NOTIMPLEMENTED);
}
@ -535,10 +511,10 @@ index ec537486cb..8439265a7f 100644
+ }
+}
diff --git a/lib/dns/dnsrps.c b/lib/dns/dnsrps.c
index 0f2ffb5f35..539090d1bd 100644
index 8c04337..f4d9bae 100644
--- a/lib/dns/dnsrps.c
+++ b/lib/dns/dnsrps.c
@@ -970,7 +970,8 @@ static dns_dbmethods_t rpsdb_db_methods = {
@@ -975,7 +975,8 @@ static dns_dbmethods_t rpsdb_db_methods = {
NULL, /* setservestalerefresh */
NULL, /* getservestalerefresh */
NULL, /* setgluecachestats */
@ -549,10 +525,10 @@ index 0f2ffb5f35..539090d1bd 100644
static dns_rdatasetmethods_t rpsdb_rdataset_methods = {
diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c
index 1d9343361d..bab5da5503 100644
index abbb8d9..42a1248 100644
--- a/lib/dns/ecdb.c
+++ b/lib/dns/ecdb.c
@@ -426,7 +426,7 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
@@ -428,7 +428,7 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
}
result = dns_rdataslab_fromrdataset(rdataset, mctx, &r,
@ -561,7 +537,7 @@ index 1d9343361d..bab5da5503 100644
if (result != ISC_R_SUCCESS) {
goto unlock;
}
@@ -556,7 +556,11 @@ static dns_dbmethods_t ecdb_methods = {
@@ -560,7 +560,11 @@ static dns_dbmethods_t ecdb_methods = {
NULL, /* getsize */
NULL, /* setservestalettl */
NULL, /* getservestalettl */
@ -575,10 +551,10 @@ index 1d9343361d..bab5da5503 100644
static isc_result_t
diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h
index 22e94da9d5..3fa2a891e0 100644
index 02dd1ac..34539eb 100644
--- a/lib/dns/include/dns/cache.h
+++ b/lib/dns/include/dns/cache.h
@@ -337,6 +337,12 @@ dns_cache_updatestats(dns_cache_t *cache, isc_result_t result);
@@ -334,6 +334,12 @@ dns_cache_updatestats(dns_cache_t *cache, isc_result_t result);
* Update cache statistics based on result code in 'result'
*/
@ -592,18 +568,18 @@ index 22e94da9d5..3fa2a891e0 100644
int
dns_cache_renderxml(dns_cache_t *cache, void *writer0);
diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
index 90bd7fb112..732bfe473d 100644
index ae27639..e0d17f2 100644
--- a/lib/dns/include/dns/db.h
+++ b/lib/dns/include/dns/db.h
@@ -182,6 +182,7 @@ typedef struct dns_dbmethods {
@@ -184,6 +184,7 @@ typedef struct dns_dbmethods {
isc_result_t (*getservestalerefresh)(dns_db_t *db, uint32_t *interval);
isc_result_t (*setgluecachestats)(dns_db_t *db, isc_stats_t *stats);
isc_result_t (*adjusthashsize)(dns_db_t *db, size_t size);
+ void (*setmaxrrperset)(dns_db_t *db, uint32_t value);
} dns_dbmethods_t;
typedef isc_result_t (*dns_dbcreatefunc_t)(isc_mem_t *mctx,
@@ -1783,6 +1784,13 @@ dns_db_setgluecachestats(dns_db_t *db, isc_stats_t *stats);
typedef isc_result_t (*dns_dbcreatefunc_t)(isc_mem_t *mctx,
@@ -1796,6 +1797,13 @@ dns_db_setgluecachestats(dns_db_t *db, isc_stats_t *stats);
* dns_rdatasetstats_create(); otherwise NULL.
*/
@ -618,10 +594,10 @@ index 90bd7fb112..732bfe473d 100644
#endif /* DNS_DB_H */
diff --git a/lib/dns/include/dns/rdataslab.h b/lib/dns/include/dns/rdataslab.h
index 5a22f099c3..f2f3513a19 100644
index 5a1c30f..89c8fc2 100644
--- a/lib/dns/include/dns/rdataslab.h
+++ b/lib/dns/include/dns/rdataslab.h
@@ -65,7 +65,8 @@ ISC_LANG_BEGINDECLS
@@ -67,7 +67,8 @@ ISC_LANG_BEGINDECLS
isc_result_t
dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
@ -631,7 +607,7 @@ index 5a22f099c3..f2f3513a19 100644
/*%<
* Slabify a rdataset. The slab area will be allocated and returned
* in 'region'.
@@ -121,7 +122,8 @@ isc_result_t
@@ -123,7 +124,8 @@ isc_result_t
dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
unsigned int reservelen, isc_mem_t *mctx,
dns_rdataclass_t rdclass, dns_rdatatype_t type,
@ -642,18 +618,18 @@ index 5a22f099c3..f2f3513a19 100644
* Merge 'oslab' and 'nslab'.
*/
diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
index 2cf7eced16..0d502f4dd2 100644
index d6e7f10..b7cf663 100644
--- a/lib/dns/include/dns/view.h
+++ b/lib/dns/include/dns/view.h
@@ -186,6 +186,7 @@ struct dns_view {
@@ -188,6 +188,7 @@ struct dns_view {
dns_dlzdblist_t dlz_unsearched;
uint32_t fail_ttl;
dns_badcache_t *failcache;
dns_badcache_t *failcache;
+ uint32_t maxrrperset;
/*
* Configurable data for server use only,
@@ -1339,6 +1340,12 @@ dns_view_staleanswerenabled(dns_view_t *view);
@@ -1354,6 +1355,12 @@ dns_view_staleanswerenabled(dns_view_t *view);
*\li 'view' to be valid.
*/
@ -667,10 +643,10 @@ index 2cf7eced16..0d502f4dd2 100644
#endif /* DNS_VIEW_H */
diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index 08e2263c5b..e902043357 100644
index 4bdc936..a98b28f 100644
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -162,6 +162,19 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx);
@@ -164,6 +164,19 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx);
*\li #ISC_R_UNEXPECTED
*/
@ -690,7 +666,7 @@ index 08e2263c5b..e902043357 100644
void
dns_zone_setclass(dns_zone_t *zone, dns_rdataclass_t rdclass);
/*%<
@@ -330,6 +343,19 @@ dns_zone_getmaxrecords(dns_zone_t *zone);
@@ -332,6 +345,19 @@ dns_zone_getmaxrecords(dns_zone_t *zone);
*\li uint32_t maxrecords.
*/
@ -711,10 +687,10 @@ index 08e2263c5b..e902043357 100644
dns_zone_setmaxttl(dns_zone_t *zone, uint32_t maxttl);
/*%<
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index e840c0665d..ca71bb9c03 100644
index d4c1829..e8de346 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -482,6 +482,7 @@ struct dns_rbtdb {
@@ -496,6 +496,7 @@ struct dns_rbtdb {
rbtdb_serial_t current_serial;
rbtdb_serial_t least_serial;
rbtdb_serial_t next_serial;
@ -722,7 +698,7 @@ index e840c0665d..ca71bb9c03 100644
rbtdb_version_t *current_version;
rbtdb_version_t *future_version;
rbtdb_versionlist_t open_versions;
@@ -6495,7 +6496,7 @@ find_header:
@@ -6538,7 +6539,7 @@ find_header:
rbtdb->common.mctx,
rbtdb->common.rdclass,
(dns_rdatatype_t)header->type, flags,
@ -731,16 +707,16 @@ index e840c0665d..ca71bb9c03 100644
}
if (result == ISC_R_SUCCESS) {
/*
@@ -6880,7 +6881,7 @@ delegating_type(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
@@ -6896,7 +6897,7 @@ delegating_type(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
static inline isc_result_t
static isc_result_t
addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
- dns_rdataset_t *rdataset) {
+ uint32_t maxrrperset, dns_rdataset_t *rdataset) {
struct noqname *noqname;
isc_mem_t *mctx = rbtdb->common.mctx;
dns_name_t name;
@@ -6901,12 +6902,12 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
@@ -6917,12 +6918,12 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
noqname->negsig = NULL;
noqname->type = neg.type;
dns_name_dup(&name, mctx, &noqname->name);
@ -755,16 +731,16 @@ index e840c0665d..ca71bb9c03 100644
if (result != ISC_R_SUCCESS) {
goto cleanup;
}
@@ -6925,7 +6926,7 @@ cleanup:
@@ -6941,7 +6942,7 @@ cleanup:
static inline isc_result_t
static isc_result_t
addclosest(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
- dns_rdataset_t *rdataset) {
+ uint32_t maxrrperset, dns_rdataset_t *rdataset) {
struct noqname *closest;
isc_mem_t *mctx = rbtdb->common.mctx;
dns_name_t name;
@@ -6946,12 +6947,12 @@ addclosest(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
@@ -6962,12 +6963,12 @@ addclosest(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
closest->negsig = NULL;
closest->type = neg.type;
dns_name_dup(&name, mctx, &closest->name);
@ -779,7 +755,7 @@ index e840c0665d..ca71bb9c03 100644
if (result != ISC_R_SUCCESS) {
goto cleanup;
}
@@ -7028,7 +7029,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
@@ -7048,7 +7049,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
}
result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
@ -789,7 +765,7 @@ index e840c0665d..ca71bb9c03 100644
if (result != ISC_R_SUCCESS) {
return (result);
}
@@ -7086,7 +7088,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
@@ -7106,7 +7108,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
RDATASET_ATTR_SET(newheader, RDATASET_ATTR_OPTOUT);
}
if ((rdataset->attributes & DNS_RDATASETATTR_NOQNAME) != 0) {
@ -799,7 +775,7 @@ index e840c0665d..ca71bb9c03 100644
if (result != ISC_R_SUCCESS) {
free_rdataset(rbtdb, rbtdb->common.mctx,
newheader);
@@ -7094,7 +7097,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
@@ -7114,7 +7117,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
}
}
if ((rdataset->attributes & DNS_RDATASETATTR_CLOSEST) != 0) {
@ -809,7 +785,7 @@ index e840c0665d..ca71bb9c03 100644
if (result != ISC_R_SUCCESS) {
free_rdataset(rbtdb, rbtdb->common.mctx,
newheader);
@@ -7261,7 +7265,8 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
@@ -7268,7 +7272,8 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
nodefullname(db, node, nodename);
result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
@ -819,7 +795,7 @@ index e840c0665d..ca71bb9c03 100644
if (result != ISC_R_SUCCESS) {
return (result);
}
@@ -7669,7 +7674,8 @@ loading_addrdataset(void *arg, const dns_name_t *name,
@@ -7672,7 +7677,8 @@ loading_addrdataset(void *arg, const dns_name_t *name,
}
result = dns_rdataslab_fromrdataset(rdataset, rbtdb->common.mctx,
@ -829,7 +805,7 @@ index e840c0665d..ca71bb9c03 100644
if (result != ISC_R_SUCCESS) {
return (result);
}
@@ -8608,6 +8614,15 @@ setgluecachestats(dns_db_t *db, isc_stats_t *stats) {
@@ -8612,6 +8618,15 @@ setgluecachestats(dns_db_t *db, isc_stats_t *stats) {
return (ISC_R_SUCCESS);
}
@ -845,7 +821,7 @@ index e840c0665d..ca71bb9c03 100644
static dns_stats_t *
getrrsetstats(dns_db_t *db) {
dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
@@ -8731,7 +8746,8 @@ static dns_dbmethods_t zone_methods = { attach,
@@ -8735,7 +8750,8 @@ static dns_dbmethods_t zone_methods = { attach,
NULL, /* setservestalerefresh */
NULL, /* getservestalerefresh */
setgluecachestats,
@ -855,7 +831,7 @@ index e840c0665d..ca71bb9c03 100644
static dns_dbmethods_t cache_methods = { attach,
detach,
@@ -8783,7 +8799,8 @@ static dns_dbmethods_t cache_methods = { attach,
@@ -8787,7 +8803,8 @@ static dns_dbmethods_t cache_methods = { attach,
setservestalerefresh,
getservestalerefresh,
NULL,
@ -866,10 +842,10 @@ index e840c0665d..ca71bb9c03 100644
isc_result_t
dns_rbtdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
index dda903819a..b2d1e1cddb 100644
index d74e84c..bf4e045 100644
--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
@@ -116,7 +116,8 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
@@ -118,7 +118,8 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
isc_result_t
dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
@ -879,7 +855,7 @@ index dda903819a..b2d1e1cddb 100644
/*
* Use &removed as a sentinel pointer for duplicate
* rdata as rdata.data == NULL is valid.
@@ -158,7 +159,7 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
@@ -160,7 +161,7 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
return (ISC_R_SUCCESS);
}
@ -888,7 +864,7 @@ index dda903819a..b2d1e1cddb 100644
return (DNS_R_TOOMANYRECORDS);
}
@@ -488,7 +489,8 @@ isc_result_t
@@ -492,7 +493,8 @@ isc_result_t
dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
unsigned int reservelen, isc_mem_t *mctx,
dns_rdataclass_t rdclass, dns_rdatatype_t type,
@ -898,7 +874,7 @@ index dda903819a..b2d1e1cddb 100644
unsigned char *ocurrent, *ostart, *ncurrent, *tstart, *tcurrent, *data;
unsigned int ocount, ncount, count, olength, tlength, tcount, length;
dns_rdata_t ordata = DNS_RDATA_INIT;
@@ -528,7 +530,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
@@ -532,7 +534,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
#endif /* if DNS_RDATASET_FIXED */
INSIST(ocount > 0 && ncount > 0);
@ -908,10 +884,10 @@ index dda903819a..b2d1e1cddb 100644
}
diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
index d9de422409..84cd324fb4 100644
index 7822d6e..282c327 100644
--- a/lib/dns/sdb.c
+++ b/lib/dns/sdb.c
@@ -1312,7 +1312,8 @@ static dns_dbmethods_t sdb_methods = {
@@ -1319,7 +1319,8 @@ static dns_dbmethods_t sdb_methods = {
NULL, /* setservestalerefresh */
NULL, /* getservestalerefresh */
NULL, /* setgluecachestats */
@ -922,10 +898,10 @@ index d9de422409..84cd324fb4 100644
static isc_result_t
diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
index c8a615a0f3..60a1d23b3b 100644
index 106e24b..299c7d8 100644
--- a/lib/dns/sdlz.c
+++ b/lib/dns/sdlz.c
@@ -1284,7 +1284,8 @@ static dns_dbmethods_t sdlzdb_methods = {
@@ -1292,7 +1292,8 @@ static dns_dbmethods_t sdlzdb_methods = {
NULL, /* setservestalerefresh */
NULL, /* getservestalerefresh */
NULL, /* setgluecachestats */
@ -936,10 +912,10 @@ index c8a615a0f3..60a1d23b3b 100644
/*
diff --git a/lib/dns/view.c b/lib/dns/view.c
index dcb0f1804e..a672aa8bc8 100644
index a67dd73..9f5daf7 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -869,6 +869,8 @@ dns_view_setcache(dns_view_t *view, dns_cache_t *cache, bool shared) {
@@ -871,6 +871,8 @@ dns_view_setcache(dns_view_t *view, dns_cache_t *cache, bool shared) {
dns_cache_attach(cache, &view->cache);
dns_cache_attachdb(cache, &view->cachedb);
INSIST(DNS_DB_VALID(view->cachedb));
@ -948,7 +924,7 @@ index dcb0f1804e..a672aa8bc8 100644
}
bool
@@ -2544,3 +2546,12 @@ dns_view_staleanswerenabled(dns_view_t *view) {
@@ -2640,3 +2642,12 @@ dns_view_staleanswerenabled(dns_view_t *view) {
return (result);
}
@ -962,10 +938,10 @@ index dcb0f1804e..a672aa8bc8 100644
+ }
+}
diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index a4569f545c..c61e8f5f6b 100644
index a54d0d8..9d72b82 100644
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -203,8 +203,6 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_task_t *task,
@@ -205,8 +205,6 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_task_t *task,
static isc_result_t
axfr_init(dns_xfrin_ctx_t *xfr);
static isc_result_t
@ -974,7 +950,7 @@ index a4569f545c..c61e8f5f6b 100644
axfr_putdata(dns_xfrin_ctx_t *xfr, dns_diffop_t op, dns_name_t *name,
dns_ttl_t ttl, dns_rdata_t *rdata);
static isc_result_t
@@ -277,7 +275,11 @@ axfr_init(dns_xfrin_ctx_t *xfr) {
@@ -279,7 +277,11 @@ axfr_init(dns_xfrin_ctx_t *xfr) {
dns_db_detach(&xfr->db);
}
@ -987,7 +963,7 @@ index a4569f545c..c61e8f5f6b 100644
dns_rdatacallbacks_init(&xfr->axfr);
CHECK(dns_db_beginload(xfr->db, &xfr->axfr));
result = ISC_R_SUCCESS;
@@ -285,22 +287,6 @@ failure:
@@ -287,22 +289,6 @@ failure:
return (result);
}
@ -1011,10 +987,10 @@ index a4569f545c..c61e8f5f6b 100644
axfr_putdata(dns_xfrin_ctx_t *xfr, dns_diffop_t op, dns_name_t *name,
dns_ttl_t ttl, dns_rdata_t *rdata) {
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 65a3aacab7..5c8d97ed18 100644
index b457095..301f440 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -276,6 +276,7 @@ struct dns_zone {
@@ -307,6 +307,7 @@ struct dns_zone {
uint32_t minretry;
uint32_t maxrecords;
@ -1022,7 +998,7 @@ index 65a3aacab7..5c8d97ed18 100644
isc_sockaddr_t *masters;
isc_dscp_t *masterdscps;
@@ -2254,31 +2255,13 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
@@ -2304,12 +2305,7 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
dns_zone_logc(zone, DNS_LOGCATEGORY_ZONELOAD, ISC_LOG_DEBUG(1),
"starting load");
@ -1036,26 +1012,7 @@ index 65a3aacab7..5c8d97ed18 100644
if (result != ISC_R_SUCCESS) {
dns_zone_logc(zone, DNS_LOGCATEGORY_ZONELOAD, ISC_LOG_ERROR,
"loading zone: creating database: %s",
isc_result_totext(result));
goto cleanup;
}
- dns_db_settask(db, zone->task);
-
- if (zone->type == dns_zone_primary ||
- zone->type == dns_zone_secondary || zone->type == dns_zone_mirror)
- {
- result = dns_db_setgluecachestats(db, zone->gluecachestats);
- if (result == ISC_R_NOTIMPLEMENTED) {
- result = ISC_R_SUCCESS;
- }
- if (result != ISC_R_SUCCESS) {
- goto cleanup;
- }
- }
if (!dns_db_ispersistent(db)) {
if (zone->masterfile != NULL) {
@@ -12175,6 +12158,16 @@ dns_zone_setmaxrecords(dns_zone_t *zone, uint32_t val) {
@@ -12313,6 +12309,16 @@ dns_zone_setmaxrecords(dns_zone_t *zone, uint32_t val) {
zone->maxrecords = val;
}
@ -1072,23 +1029,23 @@ index 65a3aacab7..5c8d97ed18 100644
static bool
notify_isqueued(dns_zone_t *zone, unsigned int flags, dns_name_t *name,
isc_sockaddr_t *addr, dns_tsigkey_t *key) {
@@ -14579,6 +14572,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
@@ -14726,6 +14732,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
goto cleanup;
}
dns_db_settask(stub->db, zone->task);
dns_db_settask(stub->db, zone->task, zone->task);
+ dns_db_setmaxrrperset(stub->db, zone->maxrrperset);
}
result = dns_db_newversion(stub->db, &stub->version);
@@ -17300,6 +17294,7 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump) {
@@ -17468,6 +17475,7 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump) {
}
zone_attachdb(zone, db);
dns_db_settask(zone->db, zone->task);
dns_db_settask(zone->db, zone->task, zone->task);
+ dns_db_setmaxrrperset(zone->db, zone->maxrrperset);
DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED | DNS_ZONEFLG_NEEDNOTIFY);
return (ISC_R_SUCCESS);
@@ -23413,3 +23408,44 @@ zone_nsecttl(dns_zone_t *zone) {
@@ -23615,3 +23623,44 @@ zone_nsecttl(dns_zone_t *zone) {
return (ISC_MIN(zone->minimum, zone->soattl));
}
@ -1126,7 +1083,7 @@ index 65a3aacab7..5c8d97ed18 100644
+ break;
+ }
+
+ dns_db_settask(db, zone->task);
+ dns_db_settask(db, zone->task, zone->task);
+ dns_db_setmaxrrperset(db, zone->maxrrperset);
+
+ *dbp = db;
@ -1134,10 +1091,10 @@ index 65a3aacab7..5c8d97ed18 100644
+ return (ISC_R_SUCCESS);
+}
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index aab0462936..dce30537dd 100644
index 6e63d86..ffe22b3 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -2236,6 +2236,9 @@ static cfg_clausedef_t zone_clauses[] = {
@@ -2241,6 +2241,9 @@ static cfg_clausedef_t zone_clauses[] = {
{ "max-records", &cfg_type_uint32,
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT },
@ -1148,5 +1105,5 @@ index aab0462936..dce30537dd 100644
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
{ "max-retry-time", &cfg_type_uint32,
--
2.45.2
2.51.1

5681
bind-9.16-CVE-2024-1737-types-test.patch
View File

File diff suppressed because it is too large Load Diff

134
bind-9.16-CVE-2024-1737-types.patch
View File

@ -1,4 +1,4 @@
From a1c95d5fa479ac722f0cf758c494a37ffe1508c0 Mon Sep 17 00:00:00 2001
From 06236a2d32c1d8f29208321d276e742f9259efd2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Sat, 25 May 2024 11:46:56 +0200
Subject: [PATCH] Add a limit to the number of RR types for single name
@ -79,10 +79,10 @@ error being logged. This commit fixes that.
20 files changed, 156 insertions(+), 19 deletions(-)
diff --git a/bin/named/config.c b/bin/named/config.c
index 9cba6f588b..c9888ada65 100644
index 72dec1a..ec48840 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -218,6 +218,7 @@ options {\n\
@@ -229,6 +229,7 @@ options {\n\
max-records-per-type 100;\n\
max-refresh-time 2419200; /* 4 weeks */\n\
max-retry-time 1209600; /* 2 weeks */\n\
@ -91,10 +91,10 @@ index 9cba6f588b..c9888ada65 100644
max-transfer-idle-out 60;\n\
max-transfer-time-in 120;\n\
diff --git a/bin/named/server.c b/bin/named/server.c
index 7bf5f2664d..4cc69b54a1 100644
index f550814..c68b8d1 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -5427,6 +5427,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
@@ -5461,6 +5461,15 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
INSIST(result == ISC_R_SUCCESS);
dns_view_setmaxrrperset(view, cfg_obj_asuint32(obj));
@ -111,10 +111,10 @@ index 7bf5f2664d..4cc69b54a1 100644
result = named_config_get(maps, "max-recursion-depth", &obj);
INSIST(result == ISC_R_SUCCESS);
diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index ae5cc656ee..f6e8c64866 100644
index 81f6879..821e6a1 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -1100,6 +1100,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
@@ -1080,6 +1080,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
dns_zone_setmaxrrperset(zone, 0);
}
@ -130,10 +130,10 @@ index ae5cc656ee..f6e8c64866 100644
#define SIGNED ".signed"
size_t signedlen = strlen(filename) + sizeof(SIGNED);
diff --git a/bin/tests/system/dyndb/driver/db.c b/bin/tests/system/dyndb/driver/db.c
index 6725a3bacd..c95fc8212b 100644
index 727268f..398589a 100644
--- a/bin/tests/system/dyndb/driver/db.c
+++ b/bin/tests/system/dyndb/driver/db.c
@@ -593,7 +593,8 @@ static dns_dbmethods_t sampledb_methods = {
@@ -623,7 +623,8 @@ static dns_dbmethods_t sampledb_methods = {
NULL, /* getservestalerefresh */
NULL, /* setgluecachestats */
NULL, /* adjusthashsize */
@ -144,10 +144,10 @@ index 6725a3bacd..c95fc8212b 100644
/* Auxiliary driver functions. */
diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index b1983ef30d..a8a3c7911d 100644
index fbd8edb..0ce2d1f 100644
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -2902,6 +2902,18 @@ system.
@@ -2957,6 +2957,18 @@ system.
a failure. If set to 0, there is no cap on RRset size. The default is
100.
@ -167,10 +167,10 @@ index b1983ef30d..a8a3c7911d 100644
This sets the maximum number (a "hard quota") of simultaneous recursive lookups
the server performs on behalf of clients. The default is
diff --git a/lib/dns/cache.c b/lib/dns/cache.c
index 9f0412dbe7..0b474fc313 100644
index 8cb442b..125cfdc 100644
--- a/lib/dns/cache.c
+++ b/lib/dns/cache.c
@@ -150,6 +150,7 @@ struct dns_cache {
@@ -153,6 +153,7 @@ struct dns_cache {
/* Access to the on-disk cache file is also locked by 'filelock'. */
uint32_t maxrrperset;
@ -178,15 +178,15 @@ index 9f0412dbe7..0b474fc313 100644
};
/***
@@ -178,6 +179,7 @@ cache_create_db(dns_cache_t *cache, dns_db_t **db) {
if (result == ISC_R_SUCCESS) {
dns_db_setservestalettl(*db, cache->serve_stale_ttl);
@@ -187,6 +188,7 @@ cache_create_db(dns_cache_t *cache, dns_db_t **db) {
dns_db_setservestalettl(*db, cache->serve_stale_ttl);
dns_db_setmaxrrperset(*db, cache->maxrrperset);
+ dns_db_setmaxtypepername(*db, cache->maxtypepername);
}
return (result);
}
@@ -1290,6 +1292,16 @@ dns_cache_setmaxrrperset(dns_cache_t *cache, uint32_t value) {
if (cache->taskmgr == NULL) {
return (ISC_R_SUCCESS);
@@ -1329,6 +1331,16 @@ dns_cache_setmaxrrperset(dns_cache_t *cache, uint32_t value) {
}
}
@ -204,10 +204,10 @@ index 9f0412dbe7..0b474fc313 100644
* XXX: Much of the following code has been copied in from statschannel.c.
* We should refactor this into a generic function in stats.c that can be
diff --git a/lib/dns/db.c b/lib/dns/db.c
index 8439265a7f..18583d41c2 100644
index a575d62..1f19016 100644
--- a/lib/dns/db.c
+++ b/lib/dns/db.c
@@ -1131,3 +1131,12 @@ dns_db_setmaxrrperset(dns_db_t *db, uint32_t value) {
@@ -1146,3 +1146,12 @@ dns_db_setmaxrrperset(dns_db_t *db, uint32_t value) {
(db->methods->setmaxrrperset)(db, value);
}
}
@ -221,10 +221,10 @@ index 8439265a7f..18583d41c2 100644
+ }
+}
diff --git a/lib/dns/dnsrps.c b/lib/dns/dnsrps.c
index 539090d1bd..e1a1b21a8b 100644
index f4d9bae..43c28ae 100644
--- a/lib/dns/dnsrps.c
+++ b/lib/dns/dnsrps.c
@@ -971,7 +971,8 @@ static dns_dbmethods_t rpsdb_db_methods = {
@@ -976,7 +976,8 @@ static dns_dbmethods_t rpsdb_db_methods = {
NULL, /* getservestalerefresh */
NULL, /* setgluecachestats */
NULL, /* adjusthashsize */
@ -235,10 +235,10 @@ index 539090d1bd..e1a1b21a8b 100644
static dns_rdatasetmethods_t rpsdb_rdataset_methods = {
diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c
index bab5da5503..27d03b4e3a 100644
index 42a1248..3e562d8 100644
--- a/lib/dns/ecdb.c
+++ b/lib/dns/ecdb.c
@@ -560,7 +560,8 @@ static dns_dbmethods_t ecdb_methods = {
@@ -564,7 +564,8 @@ static dns_dbmethods_t ecdb_methods = {
NULL, /* getservestalerefresh */
NULL, /* setgluecachestats */
NULL, /* adjusthashsize */
@ -249,10 +249,10 @@ index bab5da5503..27d03b4e3a 100644
static isc_result_t
diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h
index 3fa2a891e0..72de21600a 100644
index 34539eb..eb6f1e9 100644
--- a/lib/dns/include/dns/cache.h
+++ b/lib/dns/include/dns/cache.h
@@ -343,6 +343,12 @@ dns_cache_setmaxrrperset(dns_cache_t *cache, uint32_t value);
@@ -340,6 +340,12 @@ dns_cache_setmaxrrperset(dns_cache_t *cache, uint32_t value);
* Set the maximum resource records per RRSet that can be cached.
*/
@ -266,18 +266,18 @@ index 3fa2a891e0..72de21600a 100644
int
dns_cache_renderxml(dns_cache_t *cache, void *writer0);
diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
index 732bfe473d..411881d48a 100644
index e0d17f2..3c6c7f2 100644
--- a/lib/dns/include/dns/db.h
+++ b/lib/dns/include/dns/db.h
@@ -183,6 +183,7 @@ typedef struct dns_dbmethods {
@@ -185,6 +185,7 @@ typedef struct dns_dbmethods {
isc_result_t (*setgluecachestats)(dns_db_t *db, isc_stats_t *stats);
isc_result_t (*adjusthashsize)(dns_db_t *db, size_t size);
void (*setmaxrrperset)(dns_db_t *db, uint32_t value);
+ void (*setmaxtypepername)(dns_db_t *db, uint32_t value);
} dns_dbmethods_t;
typedef isc_result_t (*dns_dbcreatefunc_t)(isc_mem_t *mctx,
@@ -1791,6 +1792,16 @@ dns_db_setmaxrrperset(dns_db_t *db, uint32_t value);
typedef isc_result_t (*dns_dbcreatefunc_t)(isc_mem_t *mctx,
@@ -1804,6 +1805,16 @@ dns_db_setmaxrrperset(dns_db_t *db, uint32_t value);
* is nonzero, then any subsequent attempt to add an rdataset with
* more than 'value' RRs will return ISC_R_NOSPACE.
*/
@ -295,18 +295,18 @@ index 732bfe473d..411881d48a 100644
#endif /* DNS_DB_H */
diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
index 0d502f4dd2..0a72f58e98 100644
index b7cf663..4151c11 100644
--- a/lib/dns/include/dns/view.h
+++ b/lib/dns/include/dns/view.h
@@ -187,6 +187,7 @@ struct dns_view {
@@ -189,6 +189,7 @@ struct dns_view {
uint32_t fail_ttl;
dns_badcache_t *failcache;
dns_badcache_t *failcache;
uint32_t maxrrperset;
+ uint32_t maxtypepername;
/*
* Configurable data for server use only,
@@ -1346,6 +1347,12 @@ dns_view_setmaxrrperset(dns_view_t *view, uint32_t value);
@@ -1361,6 +1362,12 @@ dns_view_setmaxrrperset(dns_view_t *view, uint32_t value);
* Set the maximum resource records per RRSet that can be cached.
*/
@ -320,10 +320,10 @@ index 0d502f4dd2..0a72f58e98 100644
#endif /* DNS_VIEW_H */
diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index e902043357..6fca11f3fd 100644
index a98b28f..d893dd2 100644
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -356,6 +356,19 @@ dns_zone_setmaxrrperset(dns_zone_t *zone, uint32_t maxrrperset);
@@ -358,6 +358,19 @@ dns_zone_setmaxrrperset(dns_zone_t *zone, uint32_t maxrrperset);
*\li void
*/
@ -344,10 +344,10 @@ index e902043357..6fca11f3fd 100644
dns_zone_setmaxttl(dns_zone_t *zone, uint32_t maxttl);
/*%<
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index ca71bb9c03..ed5015c2d4 100644
index e8de346..c2cd63e 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -483,6 +483,7 @@ struct dns_rbtdb {
@@ -497,6 +497,7 @@ struct dns_rbtdb {
rbtdb_serial_t least_serial;
rbtdb_serial_t next_serial;
uint32_t maxrrperset;
@ -355,7 +355,7 @@ index ca71bb9c03..ed5015c2d4 100644
rbtdb_version_t *current_version;
rbtdb_version_t *future_version;
rbtdb_versionlist_t open_versions;
@@ -6222,19 +6223,13 @@ update_recordsandxfrsize(bool add, rbtdb_version_t *rbtversion,
@@ -6259,19 +6260,13 @@ update_recordsandxfrsize(bool add, rbtdb_version_t *rbtversion,
RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
}
@ -377,7 +377,7 @@ index ca71bb9c03..ed5015c2d4 100644
}
static bool
@@ -6794,7 +6789,7 @@ find_header:
@@ -6809,7 +6804,7 @@ find_header:
if (!IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
free_rdataset(rbtdb, rbtdb->common.mctx,
newheader);
@ -386,7 +386,7 @@ index ca71bb9c03..ed5015c2d4 100644
}
newheader->down = NULL;
@@ -8623,6 +8618,15 @@ setmaxrrperset(dns_db_t *db, uint32_t maxrrperset) {
@@ -8627,6 +8622,15 @@ setmaxrrperset(dns_db_t *db, uint32_t maxrrperset) {
rbtdb->maxrrperset = maxrrperset;
}
@ -402,7 +402,7 @@ index ca71bb9c03..ed5015c2d4 100644
static dns_stats_t *
getrrsetstats(dns_db_t *db) {
dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
@@ -8747,7 +8751,8 @@ static dns_dbmethods_t zone_methods = { attach,
@@ -8751,7 +8755,8 @@ static dns_dbmethods_t zone_methods = { attach,
NULL, /* getservestalerefresh */
setgluecachestats,
adjusthashsize,
@ -412,7 +412,7 @@ index ca71bb9c03..ed5015c2d4 100644
static dns_dbmethods_t cache_methods = { attach,
detach,
@@ -8800,7 +8805,8 @@ static dns_dbmethods_t cache_methods = { attach,
@@ -8804,7 +8809,8 @@ static dns_dbmethods_t cache_methods = { attach,
getservestalerefresh,
NULL,
adjusthashsize,
@ -423,10 +423,10 @@ index ca71bb9c03..ed5015c2d4 100644
isc_result_t
dns_rbtdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
index 84cd324fb4..77a5834b76 100644
index 282c327..4438091 100644
--- a/lib/dns/sdb.c
+++ b/lib/dns/sdb.c
@@ -1313,7 +1313,8 @@ static dns_dbmethods_t sdb_methods = {
@@ -1320,7 +1320,8 @@ static dns_dbmethods_t sdb_methods = {
NULL, /* getservestalerefresh */
NULL, /* setgluecachestats */
NULL, /* adjusthashsize */
@ -437,10 +437,10 @@ index 84cd324fb4..77a5834b76 100644
static isc_result_t
diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
index 60a1d23b3b..418a4a14ee 100644
index 299c7d8..a8556df 100644
--- a/lib/dns/sdlz.c
+++ b/lib/dns/sdlz.c
@@ -1285,7 +1285,8 @@ static dns_dbmethods_t sdlzdb_methods = {
@@ -1293,7 +1293,8 @@ static dns_dbmethods_t sdlzdb_methods = {
NULL, /* getservestalerefresh */
NULL, /* setgluecachestats */
NULL, /* adjusthashsize */
@ -451,10 +451,10 @@ index 60a1d23b3b..418a4a14ee 100644
/*
diff --git a/lib/dns/view.c b/lib/dns/view.c
index a672aa8bc8..98579f03d9 100644
index 9f5daf7..0de880d 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -871,6 +871,7 @@ dns_view_setcache(dns_view_t *view, dns_cache_t *cache, bool shared) {
@@ -873,6 +873,7 @@ dns_view_setcache(dns_view_t *view, dns_cache_t *cache, bool shared) {
INSIST(DNS_DB_VALID(view->cachedb));
dns_cache_setmaxrrperset(view->cache, view->maxrrperset);
@ -462,7 +462,7 @@ index a672aa8bc8..98579f03d9 100644
}
bool
@@ -2555,3 +2556,12 @@ dns_view_setmaxrrperset(dns_view_t *view, uint32_t value) {
@@ -2651,3 +2652,12 @@ dns_view_setmaxrrperset(dns_view_t *view, uint32_t value) {
dns_cache_setmaxrrperset(view->cache, value);
}
}
@ -476,10 +476,10 @@ index a672aa8bc8..98579f03d9 100644
+ }
+}
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 5c8d97ed18..e1fb9ab50b 100644
index 301f440..ae5ef43 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -277,6 +277,7 @@ struct dns_zone {
@@ -308,6 +308,7 @@ struct dns_zone {
uint32_t maxrecords;
uint32_t maxrrperset;
@ -487,7 +487,7 @@ index 5c8d97ed18..e1fb9ab50b 100644
isc_sockaddr_t *masters;
isc_dscp_t *masterdscps;
@@ -9959,6 +9960,7 @@ cleanup:
@@ -10060,6 +10061,7 @@ cleanup:
}
dns_diff_clear(&_sig_diff);
@ -495,7 +495,7 @@ index 5c8d97ed18..e1fb9ab50b 100644
for (i = 0; i < nkeys; i++) {
dst_key_free(&zone_keys[i]);
@@ -12168,6 +12170,16 @@ dns_zone_setmaxrrperset(dns_zone_t *zone, uint32_t val) {
@@ -12319,6 +12321,16 @@ dns_zone_setmaxrrperset(dns_zone_t *zone, uint32_t val) {
}
}
@ -512,36 +512,36 @@ index 5c8d97ed18..e1fb9ab50b 100644
static bool
notify_isqueued(dns_zone_t *zone, unsigned int flags, dns_name_t *name,
isc_sockaddr_t *addr, dns_tsigkey_t *key) {
@@ -14573,6 +14585,8 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
@@ -14733,6 +14745,8 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
}
dns_db_settask(stub->db, zone->task);
dns_db_settask(stub->db, zone->task, zone->task);
dns_db_setmaxrrperset(stub->db, zone->maxrrperset);
+ dns_db_setmaxtypepername(stub->db,
+ zone->maxtypepername);
}
result = dns_db_newversion(stub->db, &stub->version);
@@ -17295,6 +17309,7 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump) {
@@ -17476,6 +17490,7 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump) {
zone_attachdb(zone, db);
dns_db_settask(zone->db, zone->task);
dns_db_settask(zone->db, zone->task, zone->task);
dns_db_setmaxrrperset(zone->db, zone->maxrrperset);
+ dns_db_setmaxtypepername(zone->db, zone->maxtypepername);
DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED | DNS_ZONEFLG_NEEDNOTIFY);
return (ISC_R_SUCCESS);
@@ -23444,6 +23459,7 @@ dns_zone_makedb(dns_zone_t *zone, dns_db_t **dbp) {
@@ -23659,6 +23674,7 @@ dns_zone_makedb(dns_zone_t *zone, dns_db_t **dbp) {
dns_db_settask(db, zone->task);
dns_db_settask(db, zone->task, zone->task);
dns_db_setmaxrrperset(db, zone->maxrrperset);
+ dns_db_setmaxtypepername(db, zone->maxtypepername);
*dbp = db;
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index dce30537dd..ac9fc2af5e 100644
index ffe22b3..69525dc 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -2239,6 +2239,9 @@ static cfg_clausedef_t zone_clauses[] = {
@@ -2244,6 +2244,9 @@ static cfg_clausedef_t zone_clauses[] = {
{ "max-records-per-type", &cfg_type_uint32,
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT },
@ -552,10 +552,10 @@ index dce30537dd..ac9fc2af5e 100644
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
{ "max-retry-time", &cfg_type_uint32,
diff --git a/lib/ns/update.c b/lib/ns/update.c
index c5ce1eaf09..0e0bdc9c03 100644
index 4e51cdc..d9cea2c 100644
--- a/lib/ns/update.c
+++ b/lib/ns/update.c
@@ -3112,9 +3112,18 @@ update_action(isc_task_t *task, isc_event_t *event) {
@@ -3136,9 +3136,18 @@ update_action(isc_task_t *task, isc_event_t *event) {
dns_diff_clear(&ctx.add_diff);
goto failure;
}
@ -578,5 +578,5 @@ index c5ce1eaf09..0e0bdc9c03 100644
}
} else if (update_class == dns_rdataclass_any) {
--
2.45.2
2.51.1

181
bind-9.16-CVE-2024-1737.patch
View File

@ -1,4 +1,4 @@
From c5357835c98b7b028f8a041b6976bb335c9a4056 Mon Sep 17 00:00:00 2001
From 9b50e2c7385cad43d4c8e0310229d18230fdb510 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Fri, 1 Mar 2024 08:26:07 +0100
Subject: [PATCH] Add a limit to the number of RRs in RRSets
@ -83,45 +83,47 @@ smarter:
(cherry picked from commit 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120)
(cherry picked from commit 26c9da5f2857b72077c17e06ac79f068c63782cc)
---
bin/tests/system/resolver/tests.sh | 9 ++-
configure | 2 +-
configure.ac | 2 +-
lib/dns/rbtdb.c | 125 ++++++++++++++++++++++++++++-
lib/dns/rdataslab.c | 12 +++
5 files changed, 144 insertions(+), 6 deletions(-)
bin/tests/system/resolver/tests.sh | 11 ++--
configure | 2 +-
configure.ac | 2 +-
lib/dns/rbtdb.c | 83 +++++++++++++++++++++++++++++-
lib/dns/rdataslab.c | 12 +++++
lib/dns/zone.c | 13 -----
6 files changed, 101 insertions(+), 22 deletions(-)
diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
index 6c69c1104e..bd997a61a4 100755
index fc05635..b871972 100755
--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
@@ -553,15 +553,20 @@ n=`expr $n + 1`
@@ -596,18 +596,17 @@ n=$((n + 1))
echo_i "check prefetch qtype * (${n})"
ret=0
$DIG $DIGOPTS @10.53.0.5 fetchall.tld any > dig.out.1.${n} || ret=1
-ttl1=`awk '/"A" "short" "ttl"/ { print $2 - 3 }' dig.out.1.${n}`
dig_with_opts @10.53.0.5 fetchall.tld any >dig.out.1.${n} || ret=1
-ttl1=$(awk '/"A" "short" "ttl"/ { print $2 - 3 }' dig.out.1.${n})
+ttl1=$(awk '/^fetchall.tld/ { print $2 - 3; exit }' dig.out.1.${n})
# sleep so we are in prefetch range
sleep ${ttl1:-0}
sleep "${ttl1:-0}"
# trigger prefetch
$DIG $DIGOPTS @10.53.0.5 fetchall.tld any > dig.out.2.${n} || ret=1
-ttl2=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n}`
dig_with_opts @10.53.0.5 fetchall.tld any >dig.out.2.${n} || ret=1
-ttl2=$(awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n})
+ttl2=$(awk '/^fetchall.tld/ { print $2; exit }' dig.out.2.${n})
sleep 1
# check that the nameserver is still alive
$DIG $DIGOPTS @10.53.0.5 fetchall.tld any > dig.out.3.${n} || ret=1
-# check that prefetch occurred;
-# note that only one record is prefetched, which is the AAAA record in this case,
+# note that only the first record is prefetched,
+# because of the order of the records in the cache
# because of the order of the records in the cache
-dig_with_opts @10.53.0.5 fetchall.tld any >dig.out.3.${n} || ret=1
-ttl3=$(awk '/::1/ { print $2 }' dig.out.3.${n})
+$DIG $DIGOPTS @10.53.0.5 fetchall.tld any >dig.out.3.${n} || ret=1
+ttl3=$(awk '/^fetchall.tld/ { print $2; exit }' dig.out.3.${n})
+test "${ttl3:-0}" -gt "${ttl2:-1}" || ret=1
test "${ttl3:-0}" -gt "${ttl2:-1}" || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
status=$((status + ret))
diff --git a/configure b/configure
index ed2d4869e5..be0f60eaba 100755
index 1b436d6..835cd94 100755
--- a/configure
+++ b/configure
@@ -12295,7 +12295,7 @@ fi
@@ -12341,7 +12341,7 @@ fi
XTARGETS=
if test "$enable_developer" = "yes"; then :
@ -131,10 +133,10 @@ index ed2d4869e5..be0f60eaba 100755
test "${enable_querytrace+set}" = set || enable_querytrace=yes
test "${with_cmocka+set}" = set || with_cmocka=yes
diff --git a/configure.ac b/configure.ac
index 287de41369..3ff4bdd135 100644
index fb6f172..6db4250 100644
--- a/configure.ac
+++ b/configure.ac
@@ -94,7 +94,7 @@ AC_ARG_ENABLE([developer],
@@ -96,7 +96,7 @@ AC_ARG_ENABLE([developer],
XTARGETS=
AS_IF([test "$enable_developer" = "yes"],
@ -144,34 +146,22 @@ index 287de41369..3ff4bdd135 100644
test "${enable_querytrace+set}" = set || enable_querytrace=yes
test "${with_cmocka+set}" = set || with_cmocka=yes
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 2707507bd7..e840c0665d 100644
index 3f06545..d4c1829 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -967,6 +967,48 @@ set_ttl(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, dns_ttl_t newttl) {
}
}
+static bool
+prio_type(rbtdb_rdatatype_t type) {
+ switch (type) {
+ case dns_rdatatype_soa:
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa):
+ case dns_rdatatype_a:
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_a):
@@ -990,6 +990,8 @@ prio_type(rbtdb_rdatatype_t type) {
case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa):
case dns_rdatatype_a:
case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_a):
+ case dns_rdatatype_mx:
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_mx):
+ case dns_rdatatype_aaaa:
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_aaaa):
+ case dns_rdatatype_nsec:
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec):
+ case dns_rdatatype_nsec3:
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec3):
+ case dns_rdatatype_ns:
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ns):
+ case dns_rdatatype_ds:
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds):
+ case dns_rdatatype_cname:
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname):
case dns_rdatatype_aaaa:
case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_aaaa):
case dns_rdatatype_nsec:
@@ -1002,6 +1004,22 @@ prio_type(rbtdb_rdatatype_t type) {
case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds):
case dns_rdatatype_cname:
case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname):
+ case dns_rdatatype_dname:
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dname):
+ case dns_rdatatype_svcb:
@ -188,15 +178,10 @@ index 2707507bd7..e840c0665d 100644
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ptr):
+ case dns_rdatatype_naptr:
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_naptr):
+ return (true);
+ }
+ return (false);
+}
+
/*%
* These functions allow the heap code to rank the priority of each
* element. It returns true if v1 happens "sooner" than v2.
@@ -6179,6 +6221,30 @@ update_recordsandxfrsize(bool add, rbtdb_version_t *rbtversion,
return (true);
}
return (false);
@@ -6240,6 +6258,30 @@ update_recordsandxfrsize(bool add, rbtdb_version_t *rbtversion,
RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
}
@ -227,15 +212,16 @@ index 2707507bd7..e840c0665d 100644
/*
* write lock on rbtnode must be held.
*/
@@ -6190,6 +6256,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
@@ -6251,7 +6293,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
rbtdb_changed_t *changed = NULL;
rdatasetheader_t *topheader = NULL, *topheader_prev = NULL;
rdatasetheader_t *header = NULL, *sigheader = NULL;
- rdatasetheader_t *prioheader = NULL;
+ rdatasetheader_t *prioheader = NULL, *expireheader = NULL;
unsigned char *merged = NULL;
isc_result_t result;
bool header_nx;
@@ -6199,6 +6266,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
@@ -6261,6 +6303,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
rbtdb_rdatatype_t negtype, sigtype;
dns_trust_t trust;
int idx;
@ -243,35 +229,31 @@ index 2707507bd7..e840c0665d 100644
/*
* Add an rdatasetheader_t to a node.
@@ -6272,6 +6340,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
topheader = topheader->next) {
@@ -6336,6 +6379,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
{
if (topheader->type == sigtype) {
sigheader = topheader;
+ break;
}
}
negtype = RBTDB_RDATATYPE_VALUE(covers, 0);
@@ -6331,6 +6400,15 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
@@ -6398,6 +6442,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
for (topheader = rbtnode->data; topheader != NULL;
topheader = topheader->next) {
topheader = topheader->next)
{
+ if (IS_CACHE(rbtdb) && ACTIVE(topheader, now)) {
+ ++ntypes;
+ expireheader = topheader;
+ } else if (!IS_CACHE(rbtdb)) {
+ ++ntypes;
+ }
+ if (prio_header(topheader)) {
+ prioheader = topheader;
+ }
if (topheader->type == newheader->type ||
topheader->type == negtype) {
break;
@@ -6712,9 +6790,52 @@ find_header:
if (prio_type(topheader->type)) {
prioheader = topheader;
}
@@ -6755,6 +6805,12 @@ find_header:
/*
* No rdatasets of the given type exist at the node.
*/
- newheader->next = rbtnode->data;
+ if (!IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
+ free_rdataset(rbtdb, rbtdb->common.mctx,
+ newheader);
@ -279,21 +261,12 @@ index 2707507bd7..e840c0665d 100644
+ }
+
newheader->down = NULL;
- rbtnode->data = newheader;
+
+ if (prio_header(newheader)) {
+ /* This is a priority type, prepend it */
+ newheader->next = rbtnode->data;
+ rbtnode->data = newheader;
+ } else if (prioheader != NULL) {
+ /* Append after the priority headers */
+ newheader->next = prioheader->next;
+ prioheader->next = newheader;
+ } else {
+ /* There were no priority headers */
+ newheader->next = rbtnode->data;
+ rbtnode->data = newheader;
+ }
if (prio_type(newheader->type)) {
@@ -6770,6 +6826,31 @@ find_header:
newheader->next = rbtnode->data;
rbtnode->data = newheader;
}
+
+ if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
+ if (expireheader == NULL) {
@ -323,10 +296,10 @@ index 2707507bd7..e840c0665d 100644
}
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
index 1d5e88f745..dda903819a 100644
index 14c4381..d74e84c 100644
--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
@@ -110,6 +110,10 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
@@ -112,6 +112,10 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
}
#endif /* if DNS_RDATASET_FIXED */
@ -337,7 +310,7 @@ index 1d5e88f745..dda903819a 100644
isc_result_t
dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
isc_region_t *region, unsigned int reservelen) {
@@ -154,6 +158,10 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
@@ -156,6 +160,10 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
return (ISC_R_SUCCESS);
}
@ -348,7 +321,7 @@ index 1d5e88f745..dda903819a 100644
if (nitems > 0xffff) {
return (ISC_R_NOSPACE);
}
@@ -520,6 +528,10 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
@@ -524,6 +532,10 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
#endif /* if DNS_RDATASET_FIXED */
INSIST(ocount > 0 && ncount > 0);
@ -359,6 +332,30 @@ index 1d5e88f745..dda903819a 100644
#if DNS_RDATASET_FIXED
oncount = ncount;
#endif /* if DNS_RDATASET_FIXED */
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index b457095..53da95a 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -2316,19 +2316,6 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
isc_result_totext(result));
goto cleanup;
}
- dns_db_settask(db, zone->task, zone->task);
-
- if (zone->type == dns_zone_primary ||
- zone->type == dns_zone_secondary || zone->type == dns_zone_mirror)
- {
- result = dns_db_setgluecachestats(db, zone->gluecachestats);
- if (result == ISC_R_NOTIMPLEMENTED) {
- result = ISC_R_SUCCESS;
- }
- if (result != ISC_R_SUCCESS) {
- goto cleanup;
- }
- }
if (!dns_db_ispersistent(db)) {
if (zone->masterfile != NULL) {
--
2.45.2
2.51.1

116
bind-9.16-CVE-2024-1975.patch
View File

@ -1,4 +1,4 @@
From 34e92fc88943beeba76aa4e408951cb46d8cdb53 Mon Sep 17 00:00:00 2001
From ec67f14dc90e17acf08708e53a2166e0554b25ca Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Tue, 16 Jul 2024 19:49:09 +0200
Subject: [PATCH] Resolve CVE-2024-1975
@ -14,15 +14,15 @@ Resolves: CVE-2024-1975
doc/arm/general.rst | 6 +-
doc/arm/reference.rst | 4 +-
doc/arm/security.rst | 4 +-
lib/dns/message.c | 97 ++--------------------------
lib/dns/message.c | 99 ++--------------------------
lib/ns/client.c | 7 ++
8 files changed, 43 insertions(+), 113 deletions(-)
8 files changed, 43 insertions(+), 115 deletions(-)
diff --git a/bin/tests/system/tsiggss/authsock.pl b/bin/tests/system/tsiggss/authsock.pl
index ab3833d..0b231ee 100644
index d629c65..b3888fb 100644
--- a/bin/tests/system/tsiggss/authsock.pl
+++ b/bin/tests/system/tsiggss/authsock.pl
@@ -31,6 +31,10 @@ if (!defined($path)) {
@@ -33,6 +33,10 @@ if (!defined($path)) {
exit(1);
}
@ -33,7 +33,7 @@ index ab3833d..0b231ee 100644
unlink($path);
my $server = IO::Socket::UNIX->new(Local => $path, Type => SOCK_STREAM, Listen => 8) or
die "unable to create socket $path";
@@ -53,6 +57,7 @@ if ($timeout != 0) {
@@ -55,6 +59,7 @@ if ($timeout != 0) {
}
while (my $client = $server->accept()) {
@ -42,26 +42,26 @@ index ab3833d..0b231ee 100644
my ($version, $req_len) = unpack('N N', $buf);
diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
index 632bb87..7977e49 100644
index a665703..34b8c89 100644
--- a/bin/tests/system/tsiggss/tests.sh
+++ b/bin/tests/system/tsiggss/tests.sh
@@ -116,7 +116,7 @@ status=$((status+ret))
@@ -116,7 +116,7 @@ status=$((status + ret))
echo_i "testing external update policy (CNAME) with auth sock ($n)"
ret=0
-$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 > /dev/null 2>&1 &
-$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >/dev/null 2>&1 &
+$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >authsock.log 2>&1 &
sleep 1
test_update $n testcname.example.nil. CNAME "86400 CNAME testdenied.example.nil" "testdenied" || ret=1
n=$((n+1))
@@ -130,17 +130,19 @@ n=$((n+1))
n=$((n + 1))
@@ -130,17 +130,19 @@ n=$((n + 1))
if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
status=$((status+ret))
status=$((status + ret))
-echo_i "testing external policy with SIG(0) key ($n)"
+echo_i "testing external policy with unsupported SIG(0) key ($n)"
ret=0
-$NSUPDATE -k ns1/Kkey.example.nil.*.private <<END > /dev/null 2>&1 || ret=1
-$NSUPDATE -k ns1/Kkey.example.nil.*.private <<END >/dev/null 2>&1 || ret=1
+$NSUPDATE -d -k ns1/Kkey.example.nil.*.private <<END >nsupdate.out${n} 2>&1 || true
+debug
server 10.53.0.1 ${PORT}
@ -69,28 +69,28 @@ index 632bb87..7977e49 100644
update add fred.example.nil 120 cname foo.bar.
send
END
output=`$DIG $DIGOPTS +short cname fred.example.nil.`
output=$($DIG $DIGOPTS +short cname fred.example.nil.)
-[ -n "$output" ] || ret=1
-[ $ret -eq 0 ] || echo_i "failed"
+# update must have failed - SIG(0) signer is not supported
+[ -n "$output" ] && ret=1
+grep -F "signer=key.example.nil" authsock.log >/dev/null && ret=1
n=$((n+1))
n=$((n + 1))
if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
status=$((status+ret))
status=$((status + ret))
diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
index 20fc46f..c8fd54b 100644
index 063e28d..0947166 100644
--- a/bin/tests/system/upforwd/tests.sh
+++ b/bin/tests/system/upforwd/tests.sh
@@ -224,19 +224,22 @@ fi
@@ -262,19 +262,22 @@ if $FEATURETEST --enable-dnstap; then
fi
if test -f keyname
then
- echo_i "checking update forwarding to with sig0 ($n)"
+ echo_i "checking update forwarding to with sig0 (expected to fail) ($n)"
ret=0
keyname=`cat keyname`
- $NSUPDATE -k $keyname.private -- - <<EOF
if test -f keyname; then
- echo_i "checking update forwarding to with sig0 ($n)"
+ echo_i "checking update forwarding to with sig0 (expected to fail) ($n)"
ret=0
keyname=$(cat keyname)
- $NSUPDATE -k $keyname.private -- - <<EOF
- local 10.53.0.1
- server 10.53.0.3 ${PORT}
- zone example2
@ -108,34 +108,34 @@ index 20fc46f..c8fd54b 100644
+ send
EOF
+ } >nsupdate.out.$n 2>&1 && ret=1
$DIG -p ${PORT} unsigned.example2 A @10.53.0.1 > dig.out.ns1.test$n
- grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
+ grep "status: NOERROR" dig.out.ns1.test$n >/dev/null && ret=1
if [ $ret != 0 ] ; then echo_i "failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
$DIG -p ${PORT} unsigned.example2 A @10.53.0.1 >dig.out.ns1.test$n || ret=1
- grep "status: NOERROR" dig.out.ns1.test$n >/dev/null || ret=1
+ grep "status: NOERROR" dig.out.ns1.test$n >/dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$(expr $status + $ret)
n=$(expr $n + 1)
diff --git a/doc/arm/general.rst b/doc/arm/general.rst
index 225576b..0766dfe 100644
index d7b7c20..59f9e6b 100644
--- a/doc/arm/general.rst
+++ b/doc/arm/general.rst
@@ -534,10 +534,8 @@ than a non-authoritative response. This is considered a feature.
[2] CLASS ANY queries are not supported. This is considered a
feature.
@@ -367,10 +367,8 @@ Notes
.. [#rfc1035_2] CLASS ANY queries are not supported. This is considered a
feature.
-[3] When receiving a query signed with a SIG(0), the server is
-only able to verify the signature if it has the key in its local
-authoritative data; it cannot do recursion or validation to
-retrieve unknown keys.
+[3] Support for SIG(0) message verification was removed
+as part of the mitigation of CVE-2024-1975.
-.. [#rfc2931] When receiving a query signed with a SIG(0), the server is
- only able to verify the signature if it has the key in its local
- authoritative data; it cannot do recursion or validation to
- retrieve unknown keys.
+.. [#rfc2931] Support for SIG(0) message verification was removed
+ as part of the mitigation of CVE-2024-1975.
[4] Compliance is with loading and serving of A6 records only. A6 records were moved
to the experimental category by :rfc:`3363`.
.. [#rfc2874] Compliance is with loading and serving of A6 records only.
A6 records were moved to the experimental category by :rfc:`3363`.
diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index d4ee9d2..ad7ff27 100644
index ecc84d4..f982e0a 100644
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -5789,7 +5789,7 @@ The ``update-policy`` clause allows more fine-grained control over which
@@ -5900,7 +5900,7 @@ The ``update-policy`` clause allows more fine-grained control over which
updates are allowed. It specifies a set of rules, in which each rule
either grants or denies permission for one or more names in the zone to
be updated by one or more identities. Identity is determined by the key
@ -144,7 +144,7 @@ index d4ee9d2..ad7ff27 100644
cases, ``update-policy`` rules only apply to key-based identities. There
is no way to specify update permissions based on the client source address.
@@ -5846,7 +5846,7 @@ field), and the type of the record to be updated matches the ``types``
@@ -5957,7 +5957,7 @@ field), and the type of the record to be updated matches the ``types``
field. Details for each rule type are described below.
The ``identity`` field must be set to a fully qualified domain name. In
@ -154,10 +154,10 @@ index d4ee9d2..ad7ff27 100644
wildcard, it is subject to DNS wildcard expansion, and the rule may
apply to multiple identities. When a TKEY exchange has been used to
diff --git a/doc/arm/security.rst b/doc/arm/security.rst
index f7c8bd3..e3abfd1 100644
index 817ebd0..92b1668 100644
--- a/doc/arm/security.rst
+++ b/doc/arm/security.rst
@@ -32,7 +32,7 @@ Limiting access to the server by outside parties can help prevent
@@ -83,7 +83,7 @@ Limiting access to the server by outside parties can help prevent
spoofing and denial of service (DoS) attacks against the server.
ACLs match clients on the basis of up to three characteristics: 1) The
@ -166,7 +166,7 @@ index f7c8bd3..e3abfd1 100644
request, if any; and 3) an address prefix encoded in an EDNS
Client-Subnet option, if any.
@@ -73,7 +73,7 @@ and no queries at all from the networks specified in ``bogusnets``.
@@ -124,7 +124,7 @@ and no queries at all from the networks specified in ``bogusnets``.
In addition to network addresses and prefixes, which are matched against
the source address of the DNS request, ACLs may include ``key``
@ -176,10 +176,10 @@ index f7c8bd3..e3abfd1 100644
When BIND 9 is built with GeoIP support, ACLs can also be used for
geographic access restrictions. This is done by specifying an ACL
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 1993b2e..04315bc 100644
index 22aa552..12331ab 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -3287,109 +3287,24 @@ dns_message_dumpsig(dns_message_t *msg, char *txt1) {
@@ -3301,111 +3301,24 @@ dns_message_dumpsig(dns_message_t *msg, char *txt1) {
isc_result_t
dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
@ -229,14 +229,15 @@ index 1993b2e..04315bc 100644
- return (ISC_R_UNEXPECTEDEND);
- }
-
- result = dns_rdata_tostruct(&rdata, &sig, msg->mctx);
- result = dns_rdata_tostruct(&rdata, &sig, NULL);
- if (result != ISC_R_SUCCESS) {
- return (result);
- }
-
- dns_rdataset_init(&keyset);
- if (view == NULL) {
- return (DNS_R_KEYUNAUTHORIZED);
- result = DNS_R_KEYUNAUTHORIZED;
- goto freesig;
- }
- result = dns_view_simplefind(view, &sig.signer,
- dns_rdatatype_key /* SIG(0) */, 0,
@ -254,7 +255,8 @@ index 1993b2e..04315bc 100644
- result = dns_rdataset_first(&keyset);
- INSIST(result == ISC_R_SUCCESS);
- for (; result == ISC_R_SUCCESS;
- result = dns_rdataset_next(&keyset)) {
- result = dns_rdataset_next(&keyset))
- {
- dst_key_t *key = NULL;
-
- dns_rdata_reset(&rdata);
@ -296,10 +298,10 @@ index 1993b2e..04315bc 100644
}
diff --git a/lib/ns/client.c b/lib/ns/client.c
index 967e21b..87b8a18 100644
index d4ce000..2679a5e 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -2060,6 +2060,13 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
@@ -2041,6 +2041,13 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
"request is signed by a nonauthoritative key");
@ -314,5 +316,5 @@ index 967e21b..87b8a18 100644
char tsigrcode[64];
isc_buffer_t b;
--
2.45.2
2.51.1

118
bind-9.16-CVE-2025-40778.patch
View File

@ -1,4 +1,4 @@
From 39a43add7ad19fc2d83950a9af0c4f8cf580588b Mon Sep 17 00:00:00 2001
From 27c807b45ad8479ff684c914953f34533c30e398 Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Mon, 29 Sep 2025 21:46:59 -0700
Subject: [PATCH] Tighten restrictions on caching NS RRsets in authority
@ -34,28 +34,30 @@ ans3 and ans4 servers in the chain system test.
(cherry picked from commit 2e40705c06831988106335ed77db3cf924d431f6)
(cherry picked from commit 33a7db1fe964e55b76b4ac003ecc56cc67028bd9)
---
bin/tests/system/chain/ans3/ans.pl | 129 -----------------
bin/tests/system/chain/ans3/ans.pl | 143 -------------------
bin/tests/system/chain/ans3/ans.py | 217 +++++++++++++++++++++++++++++
bin/tests/system/chain/ans4/ans.py | 58 ++++++--
lib/dns/include/dns/message.h | 10 ++
bin/tests/system/chain/ans4/ans.py | 57 ++++++--
lib/dns/include/dns/message.h | 8 ++
lib/dns/message.c | 12 ++
lib/dns/resolver.c | 114 ++++++++++++---
6 files changed, 380 insertions(+), 160 deletions(-)
6 files changed, 377 insertions(+), 174 deletions(-)
delete mode 100644 bin/tests/system/chain/ans3/ans.pl
create mode 100644 bin/tests/system/chain/ans3/ans.py
diff --git a/bin/tests/system/chain/ans3/ans.pl b/bin/tests/system/chain/ans3/ans.pl
deleted file mode 100644
index 31d22d807b..0000000000
index e42240b..0000000
--- a/bin/tests/system/chain/ans3/ans.pl
+++ /dev/null
@@ -1,129 +0,0 @@
@@ -1,143 +0,0 @@
-#!/usr/bin/env perl
-#
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
@ -72,9 +74,14 @@ index 31d22d807b..0000000000
-print $pidf "$$\n" or die "cannot write pid file: $!";
-$pidf->close or die "cannot close pid file: $!";
-sub rmpid { unlink "ans.pid"; exit 1; };
-sub term { };
-
-$SIG{INT} = \&rmpid;
-$SIG{TERM} = \&rmpid;
-if ($Net::DNS::VERSION > 1.41) {
- $SIG{TERM} = \&term;
-} else {
- $SIG{TERM} = \&rmpid;
-}
-
-my $localaddr = "10.53.0.3";
-
@ -178,10 +185,17 @@ index 31d22d807b..0000000000
- Verbose => $verbose,
-);
-
-$ns->main_loop;
-if ($Net::DNS::VERSION >= 1.42) {
- $ns->start_server();
- select(undef, undef, undef, undef);
- $ns->stop_server();
- unlink "ans.pid";
-} else {
- $ns->main_loop;
-}
diff --git a/bin/tests/system/chain/ans3/ans.py b/bin/tests/system/chain/ans3/ans.py
new file mode 100644
index 0000000000..0a031c1145
index 0000000..0a031c1
--- /dev/null
+++ b/bin/tests/system/chain/ans3/ans.py
@@ -0,0 +1,217 @@
@ -403,12 +417,12 @@ index 0000000000..0a031c1145
+ if not running:
+ break
diff --git a/bin/tests/system/chain/ans4/ans.py b/bin/tests/system/chain/ans4/ans.py
index 45d650417f..e4fc15a280 100755
index 839067f..66f0193 100755
--- a/bin/tests/system/chain/ans4/ans.py
+++ b/bin/tests/system/chain/ans4/ans.py
@@ -276,16 +276,30 @@ except: port=5300
try: ctrlport=int(os.environ['EXTRAPORT1'])
except: ctrlport=5300
@@ -316,16 +316,30 @@ try:
except:
ctrlport = 5300
-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
@ -442,8 +456,8 @@ index 45d650417f..e4fc15a280 100755
havev6 = False
except:
havev6 = False
@@ -310,9 +324,9 @@ print ("Control channel on %s port %d" % (ip4, ctrlport))
print ("Ctrl-c to quit")
@@ -350,9 +364,9 @@ print("Control channel on %s port %d" % (ip4, ctrlport))
print("Ctrl-c to quit")
if havev6:
- input = [query4_socket, query6_socket, ctrl_socket]
@ -454,13 +468,12 @@ index 45d650417f..e4fc15a280 100755
while running:
try:
@@ -335,13 +349,37 @@ while running:
@@ -375,12 +389,37 @@ while running:
break
ctl_channel(msg)
conn.close()
- if s == query4_socket or s == query6_socket:
- print ("Query received on %s" %
- (ip4 if s == query4_socket else ip6))
- print("Query received on %s" % (ip4 if s == query4_socket else ip6))
+ elif s == query4_udp or s == query6_udp:
+ print("Query received on %s" % (ip4 if s == query4_udp else ip6))
# Handle incoming queries
@ -496,19 +509,10 @@ index 45d650417f..e4fc15a280 100755
if not running:
break
diff --git a/lib/dns/include/dns/message.h b/lib/dns/include/dns/message.h
index 68c13ee6c5..53c96a5827 100644
index ea45742..f564e1e 100644
--- a/lib/dns/include/dns/message.h
+++ b/lib/dns/include/dns/message.h
@@ -1,6 +1,8 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
+ * SPDX-License-Identifier: MPL-2.0
+ *
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
@@ -233,6 +235,7 @@ struct dns_message {
@@ -235,6 +235,7 @@ struct dns_message {
unsigned int cc_bad : 1;
unsigned int tkey : 1;
unsigned int rdclass_set : 1;
@ -516,7 +520,7 @@ index 68c13ee6c5..53c96a5827 100644
unsigned int opt_reserved;
unsigned int sig_reserved;
@@ -1449,4 +1452,11 @@ dns_message_clonebuffer(dns_message_t *msg);
@@ -1451,4 +1452,11 @@ dns_message_clonebuffer(dns_message_t *msg);
* \li msg be a valid message.
*/
@ -529,10 +533,10 @@ index 68c13ee6c5..53c96a5827 100644
+
ISC_LANG_ENDDECLS
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 04315bc6d0..aa434a75f1 100644
index 12331ab..f29033a 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -438,6 +438,7 @@ msginit(dns_message_t *m) {
@@ -442,6 +442,7 @@ msginit(dns_message_t *m) {
m->cc_bad = 0;
m->tkey = 0;
m->rdclass_set = 0;
@ -540,7 +544,7 @@ index 04315bc6d0..aa434a75f1 100644
m->querytsig = NULL;
m->indent.string = "\t";
m->indent.count = 0;
@@ -1717,6 +1718,11 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
@@ -1727,6 +1728,11 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
*/
msg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
free_name = false;
@ -552,7 +556,7 @@ index 04315bc6d0..aa434a75f1 100644
}
rdataset = NULL;
@@ -4750,3 +4756,9 @@ dns_message_clonebuffer(dns_message_t *msg) {
@@ -4770,3 +4776,9 @@ dns_message_clonebuffer(dns_message_t *msg) {
msg->free_query = 1;
}
}
@ -563,10 +567,10 @@ index 04315bc6d0..aa434a75f1 100644
+ return msg->has_dname;
+}
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index ad0a1b8102..5973bc1d55 100644
index 02809cc..36fe766 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -751,6 +751,7 @@ typedef struct respctx {
@@ -758,6 +758,7 @@ typedef struct respctx {
bool get_nameservers; /* get a new NS rrset at
* zone cut? */
bool resend; /* resend this query? */
@ -574,28 +578,28 @@ index ad0a1b8102..5973bc1d55 100644
bool nextitem; /* invalid response; keep
* listening for the correct one */
bool truncated; /* response was truncated */
@@ -7155,7 +7156,8 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
@@ -7163,7 +7164,8 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
* locally served zone.
*/
static inline bool
static bool
-name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
+name_external(const dns_name_t *name, dns_rdatatype_t type, respctx_t *rctx) {
+ fetchctx_t *fctx = rctx->fctx;
isc_result_t result;
dns_forwarders_t *forwarders = NULL;
dns_fixedname_t fixed, zfixed;
@@ -7167,7 +7169,9 @@ name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
@@ -7175,8 +7177,8 @@ name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
unsigned int labels;
dns_namereln_t rel;
- apex = ISFORWARDER(fctx->addrinfo) ? fctx->fwdname : &fctx->domain;
- apex = (ISDUALSTACK(fctx->addrinfo) || !ISFORWARDER(fctx->addrinfo))
- ? &fctx->domain
+ apex = (/*ISDUALSTACK(fctx->addrinfo) || */!ISFORWARDER(fctx->addrinfo))
+ ? rctx->ns_name != NULL ? rctx->ns_name : &fctx->domain
+ : fctx->fwdname;
: fctx->fwdname;
/*
* The name is outside the queried namespace.
@@ -7275,7 +7279,7 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
@@ -7285,7 +7287,7 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
result = dns_message_findname(rctx->query->rmessage, section, addname,
dns_rdatatype_any, 0, &name, NULL);
if (result == ISC_R_SUCCESS) {
@ -604,7 +608,7 @@ index ad0a1b8102..5973bc1d55 100644
if (type == dns_rdatatype_a) {
for (rdataset = ISC_LIST_HEAD(name->list);
rdataset != NULL;
@@ -7884,6 +7888,47 @@ betterreferral(respctx_t *rctx) {
@@ -7897,6 +7899,47 @@ betterreferral(respctx_t *rctx) {
return (false);
}
@ -652,7 +656,7 @@ index ad0a1b8102..5973bc1d55 100644
/*
* resquery_response():
* Handles responses received in response to iterative queries sent by
@@ -8042,6 +8087,11 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
@@ -8055,6 +8098,11 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
break;
}
@ -664,7 +668,7 @@ index ad0a1b8102..5973bc1d55 100644
/*
* If the message is signed, check the signature. If not, this
* returns success anyway.
@@ -8058,9 +8108,16 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
@@ -8072,9 +8120,16 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
}
/*
@ -683,7 +687,7 @@ index ad0a1b8102..5973bc1d55 100644
/*
* INSIST() that the message comes from the place we sent it to,
* since the dispatch code should ensure this.
@@ -8074,10 +8131,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
@@ -8088,10 +8143,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
* This may be a misconfigured anycast server or an attempt to send
* a spoofed response. Skip if we have a valid tsig.
*/
@ -695,7 +699,7 @@ index ad0a1b8102..5973bc1d55 100644
unsigned char cookie[COOKIE_BUFFER_SIZE];
if (dns_adb_getcookie(fctx->adb, query->addrinfo, cookie,
sizeof(cookie)) > CLIENT_COOKIE_SIZE)
@@ -8103,6 +8157,17 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
@@ -8117,6 +8169,17 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
*/
}
@ -713,7 +717,7 @@ index ad0a1b8102..5973bc1d55 100644
rctx_edns(&rctx);
/*
@@ -8830,8 +8895,8 @@ rctx_answer_positive(respctx_t *rctx) {
@@ -8845,8 +8908,8 @@ rctx_answer_positive(respctx_t *rctx) {
}
/*
@ -724,7 +728,7 @@ index ad0a1b8102..5973bc1d55 100644
*/
rctx_authority_positive(rctx);
@@ -8902,7 +8967,7 @@ rctx_answer_scan(respctx_t *rctx) {
@@ -8918,7 +8981,7 @@ rctx_answer_scan(respctx_t *rctx) {
/*
* Don't accept DNAME from parent namespace.
*/
@ -733,7 +737,7 @@ index ad0a1b8102..5973bc1d55 100644
continue;
}
@@ -9200,14 +9265,14 @@ rctx_answer_dname(respctx_t *rctx) {
@@ -9217,14 +9280,14 @@ rctx_answer_dname(respctx_t *rctx) {
/*
* rctx_authority_positive():
@ -756,7 +760,7 @@ index ad0a1b8102..5973bc1d55 100644
*/
static void
rctx_authority_positive(respctx_t *rctx) {
@@ -9215,6 +9280,11 @@ rctx_authority_positive(respctx_t *rctx) {
@@ -9232,6 +9295,11 @@ rctx_authority_positive(respctx_t *rctx) {
bool done = false;
isc_result_t result;
@ -768,7 +772,7 @@ index ad0a1b8102..5973bc1d55 100644
result = dns_message_firstname(rctx->query->rmessage,
DNS_SECTION_AUTHORITY);
while (!done && result == ISC_R_SUCCESS) {
@@ -9223,7 +9293,9 @@ rctx_authority_positive(respctx_t *rctx) {
@@ -9240,7 +9308,9 @@ rctx_authority_positive(respctx_t *rctx) {
dns_message_currentname(rctx->query->rmessage,
DNS_SECTION_AUTHORITY, &name);
@ -780,5 +784,5 @@ index ad0a1b8102..5973bc1d55 100644
/*
--
2.51.1
2.52.0

37
bind-9.18-CVE-2024-11187-pre-test.patch
View File

@ -1,4 +1,4 @@
From cc01143082bc688a371a7378ef284c898eedc9df Mon Sep 17 00:00:00 2001
From 5ac5241d88de3a1df1ed5a1b35fa959b39223ab5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Tue, 7 Jan 2025 15:22:40 +0100
Subject: [PATCH] Isolate using the -T noaa flag only for part of the resolver
@ -14,48 +14,55 @@ system test.
(cherry picked from commit e51d4d3b88af00d6667f2055087ebfc47fb3107c)
---
bin/tests/system/resolver/ns4/named.noaa | 5 -----
bin/tests/system/resolver/tests.sh | 8 ++++++++
2 files changed, 8 insertions(+), 5 deletions(-)
bin/tests/system/resolver/ns4/named.noaa | 12 ------------
bin/tests/system/resolver/tests.sh | 8 ++++++++
2 files changed, 8 insertions(+), 12 deletions(-)
delete mode 100644 bin/tests/system/resolver/ns4/named.noaa
diff --git a/bin/tests/system/resolver/ns4/named.noaa b/bin/tests/system/resolver/ns4/named.noaa
deleted file mode 100644
index 3b121ad..0000000
index be78cc2..0000000
--- a/bin/tests/system/resolver/ns4/named.noaa
+++ /dev/null
@@ -1,5 +0,0 @@
@@ -1,12 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
-SPDX-License-Identifier: MPL-2.0
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0. If a copy of the MPL was not distributed with this
-file, you can obtain one at https://mozilla.org/MPL/2.0/.
-
-See the COPYRIGHT file distributed with this work for additional
-information regarding copyright ownership.
-
-Add -T noaa.
diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
index 711ee05..2eae16f 100755
index e2341a6..6c8eba5 100755
--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
@@ -289,6 +289,10 @@ done
@@ -309,6 +309,10 @@ done
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
status=$((status + ret))
+stop_server resolver ns4
+touch ns4/named.noaa
+start_server --noclean --restart --port ${PORT} resolver ns4 || ret=1
+
n=`expr $n + 1`
n=$((n + 1))
echo_i "RT21594 regression test check setup ($n)"
ret=0
@@ -325,6 +329,10 @@ grep "status: NXDOMAIN" dig.ns5.out.${n} > /dev/null || ret=1
@@ -345,6 +349,10 @@ grep "status: NXDOMAIN" dig.ns5.out.${n} >/dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
status=$((status + ret))
+stop_server resolver ns4
+rm ns4/named.noaa
+start_server --noclean --restart --port ${PORT} resolver ns4 || ret=1
+
n=`expr $n + 1`
n=$((n + 1))
echo_i "check that replacement of additional data by a negative cache no data entry clears the additional RRSIGs ($n)"
ret=0
--
2.48.1
2.51.1

46
bind-9.18-CVE-2024-11187.patch
View File

@ -1,4 +1,4 @@
From b095854ee885dd5960cb54e7fbefb962498e9fdb Mon Sep 17 00:00:00 2001
From 0f9d817ca87207f2695560645e12478477d345a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Thu, 14 Nov 2024 10:37:29 +0100
Subject: [PATCH] Limit the additional processing for large RDATA sets
@ -22,23 +22,23 @@ PatchNumber: 47
5 files changed, 35 insertions(+), 7 deletions(-)
diff --git a/bin/tests/system/additional/tests.sh b/bin/tests/system/additional/tests.sh
index 025f11f..846c800 100644
index 3701790..4281238 100644
--- a/bin/tests/system/additional/tests.sh
+++ b/bin/tests/system/additional/tests.sh
@@ -260,7 +260,7 @@ n=`expr $n + 1`
@@ -278,7 +278,7 @@ n=$(expr $n + 1)
echo_i "testing with 'minimal-any no;' ($n)"
ret=0
$DIG $DIGOPTS -t ANY www.rt.example @10.53.0.1 > dig.out.$n || ret=1
-grep "ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 2" dig.out.$n > /dev/null || ret=1
$DIG $DIGOPTS -t ANY www.rt.example @10.53.0.1 >dig.out.$n || ret=1
-grep "ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 2" dig.out.$n >/dev/null || ret=1
+grep "ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 1" dig.out.$n > /dev/null || ret=1
if [ $ret -eq 1 ] ; then
echo_i "failed"; status=$((status+1))
fi
if [ $ret -eq 1 ]; then
echo_i "failed"
status=$((status + 1))
diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
index f2585ef..54ad7b2 100644
index de3f638..85c081e 100644
--- a/lib/dns/include/dns/rdataset.h
+++ b/lib/dns/include/dns/rdataset.h
@@ -53,6 +53,8 @@
@@ -55,6 +55,8 @@
#include <dns/rdatastruct.h>
#include <dns/types.h>
@ -47,7 +47,7 @@ index f2585ef..54ad7b2 100644
ISC_LANG_BEGINDECLS
typedef enum {
@@ -458,13 +460,23 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
@@ -465,13 +467,23 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
*\li If a call to dns_rdata_additionaldata() is not successful, the
* result returned will be the result of dns_rdataset_additionaldata().
*
@ -72,10 +72,10 @@ index f2585ef..54ad7b2 100644
dns_rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
dns_rdataset_t *neg, dns_rdataset_t *negsig);
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index ed5015c..7586e2a 100644
index c2cd63e..b1efa0b 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -10626,7 +10626,7 @@ no_glue:
@@ -10632,7 +10632,7 @@ no_glue:
maybe_rehash_gluetable(rbtversion);
idx = hash_32(hash, rbtversion->glue_table_bits);
@ -85,10 +85,10 @@ index ed5015c..7586e2a 100644
cur = isc_mem_get(rbtdb->common.mctx, sizeof(*cur));
diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
index bf9e7af..ffe6163 100644
index 221d7f8..0f83d1f 100644
--- a/lib/dns/rdataset.c
+++ b/lib/dns/rdataset.c
@@ -27,6 +27,7 @@
@@ -29,6 +29,7 @@
#include <dns/ncache.h>
#include <dns/rdata.h>
#include <dns/rdataset.h>
@ -96,7 +96,7 @@ index bf9e7af..ffe6163 100644
static const char *trustnames[] = {
"none", "pending-additional",
@@ -577,6 +578,12 @@ dns_rdataset_towire(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
@@ -579,6 +580,12 @@ dns_rdataset_towire(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
isc_result_t
dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
dns_additionaldatafunc_t add, void *arg) {
@ -109,7 +109,7 @@ index bf9e7af..ffe6163 100644
dns_rdata_t rdata = DNS_RDATA_INIT;
isc_result_t result;
@@ -588,6 +595,10 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
@@ -590,6 +597,10 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
REQUIRE(DNS_RDATASET_VALID(rdataset));
REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0);
@ -121,10 +121,10 @@ index bf9e7af..ffe6163 100644
if (result != ISC_R_SUCCESS) {
return (result);
diff --git a/lib/ns/query.c b/lib/ns/query.c
index f7b3f78..5bc2908 100644
index ec9bf5b..b31857c 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -2030,8 +2030,9 @@ addname:
@@ -2047,8 +2047,9 @@ addname:
* This cannot go more than MAX_RESTARTS levels deep.
*/
if (trdataset != NULL && dns_rdatatype_followadditional(type)) {
@ -136,7 +136,7 @@ index f7b3f78..5bc2908 100644
}
cleanup:
@@ -2122,7 +2123,8 @@ regular:
@@ -2139,7 +2140,8 @@ regular:
* Add other additional data if needed.
* We don't care if dns_rdataset_additionaldata() fails.
*/
@ -146,7 +146,7 @@ index f7b3f78..5bc2908 100644
CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
}
@@ -2148,7 +2150,8 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
@@ -2165,7 +2167,8 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
* To the current response for 'client', add the answer RRset
* '*rdatasetp' and an optional signature set '*sigrdatasetp', with
* owner name '*namep', to section 'section', unless they are
@ -156,7 +156,7 @@ index f7b3f78..5bc2908 100644
*
* If 'dbuf' is not NULL, then '*namep' is the name whose data is
* stored in 'dbuf'. In this case, query_addrrset() guarantees that
@@ -2203,7 +2206,9 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
@@ -2220,7 +2223,9 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
*/
query_addtoname(mname, rdataset);
query_setorder(qctx, mname, rdataset);
@ -168,5 +168,5 @@ index f7b3f78..5bc2908 100644
/*
* Note: we only add SIGs if we've added the type they cover, so
--
2.48.1
2.51.1

109
bind-9.18-dig-idn-input-always-test.patch
View File

@ -1,4 +1,4 @@
From 11f35bdef6f070412cb2c1c65d9537b82ea38c8a Mon Sep 17 00:00:00 2001
From 77105c4738a07c48d2cf52fc1fcb1c7b2eb50661 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 16 Sep 2025 11:46:03 +0200
Subject: [PATCH] Fix expectations on idna system test
@ -16,65 +16,68 @@ bind 9.16 version.
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
index a04012a..5541b94 100644
index 8c2826f..5b8ddd1 100644
--- a/bin/tests/system/idna/tests.sh
+++ b/bin/tests/system/idna/tests.sh
@@ -185,7 +185,7 @@ idna_enabled_test() {
# Note that ASCII characters are converted to lower-case.
@@ -187,7 +187,7 @@ idna_enabled_test() {
# Note that ASCII characters are converted to lower-case.
text="Checking valid non-ASCII label"
- idna_test "$text" "" "München" "M\195\188nchen."
+ idna_test "$text" "" "München" "xn--mnchen-3ya."
idna_test "$text" "+noidnin +noidnout" "München" "M\195\188nchen."
idna_test "$text" "+noidnin +idnout" "München" "M\195\188nchen."
idna_test "$text" "+idnin +noidnout" "München" "xn--mnchen-3ya."
@@ -210,7 +210,7 @@ idna_enabled_test() {
# for the valid U-label.
text="Checking valid non-ASCII label"
- idna_test "$text" "" "München" "M\195\188nchen."
+ idna_test "$text" "" "München" "xn--mnchen-3ya."
idna_test "$text" "+noidnin +noidnout" "München" "M\195\188nchen."
idna_test "$text" "+noidnin +idnout" "München" "M\195\188nchen."
idna_test "$text" "+idnin +noidnout" "München" "xn--mnchen-3ya."
@@ -211,7 +211,7 @@ idna_enabled_test() {
# for the valid U-label.
text="Checking that non-transitional IDNA processing is used"
- idna_test "$text" "" "faß.de" "fa\195\159.de."
+ idna_test "$text" "" "faß.de" "xn--fa-hia.de."
idna_test "$text" "+noidnin +noidnout" "faß.de" "fa\195\159.de."
idna_test "$text" "+noidnin +idnout" "faß.de" "fa\195\159.de."
idna_test "$text" "+idnin +noidnout" "faß.de" "xn--fa-hia.de."
@@ -220,7 +220,7 @@ idna_enabled_test() {
# onto the Greek sigma character ("σ") in IDNA2003.
text="Checking that non-transitional IDNA processing is used"
- idna_test "$text" "" "faß.de" "fa\195\159.de."
+ idna_test "$text" "" "faß.de" "xn--fa-hia.de."
idna_test "$text" "+noidnin +noidnout" "faß.de" "fa\195\159.de."
idna_test "$text" "+noidnin +idnout" "faß.de" "fa\195\159.de."
idna_test "$text" "+idnin +noidnout" "faß.de" "xn--fa-hia.de."
@@ -221,7 +221,7 @@ idna_enabled_test() {
# onto the Greek sigma character ("σ") in IDNA2003.
text="Second check that non-transitional IDNA processing is used"
- idna_test "$text" "" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
+ idna_test "$text" "" "βόλος.com" "xn--nxasmm1c.com."
idna_test "$text" "+noidnin +noidnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
idna_test "$text" "+noidnin +idnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
idna_test "$text" "+idnin +noidnout" "βόλος.com" "xn--nxasmm1c.com."
@@ -284,7 +284,7 @@ idna_enabled_test() {
idna_test "$text" "" "xn--xx" "xn--xx."
idna_test "$text" "+noidnin +noidnout" "xn--xx" "xn--xx."
idna_fail "$text" "+noidnin +idnout" "xn--xx"
- idna_fail "$text" "+idnin +noidnout" "xn--xx"
+ idna_test "$text" "+idnin +noidnout" "xn--xx" "xn--xx."
idna_fail "$text" "+idnin +idnout" "xn--xx"
text="Second check that non-transitional IDNA processing is used"
- idna_test "$text" "" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
+ idna_test "$text" "" "βόλος.com" "xn--nxasmm1c.com."
idna_test "$text" "+noidnin +noidnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
idna_test "$text" "+noidnin +idnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
idna_test "$text" "+idnin +noidnout" "βόλος.com" "xn--nxasmm1c.com."
@@ -281,7 +281,7 @@ idna_enabled_test() {
idna_test "$text" "" "xn--xx" "xn--xx."
idna_test "$text" "+noidnin +noidnout" "xn--xx" "xn--xx."
idna_fail "$text" "+noidnin +idnout" "xn--xx"
- idna_fail "$text" "+idnin +noidnout" "xn--xx"
+ idna_test "$text" "+idnin +noidnout" "xn--xx" "xn--xx."
idna_fail "$text" "+idnin +idnout" "xn--xx"
# Fake A-label - the string does not translate to anything.
@@ -293,7 +293,7 @@ idna_enabled_test() {
idna_test "$text" "" "xn--ahahah" "xn--ahahah."
idna_test "$text" "+noidnin +noidnout" "xn--ahahah" "xn--ahahah."
idna_fail "$text" "+noidnin +idnout" "xn--ahahah"
- idna_fail "$text" "+idnin +noidnout" "xn--ahahah"
+ idna_test "$text" "+idnin +noidnout" "xn--ahahah" "xn--ahahah."
idna_fail "$text" "+idnin +idnout" "xn--ahahah"
# Fake A-label - the string does not translate to anything.
@@ -290,7 +290,7 @@ idna_enabled_test() {
idna_test "$text" "" "xn--ahahah" "xn--ahahah."
idna_test "$text" "+noidnin +noidnout" "xn--ahahah" "xn--ahahah."
idna_fail "$text" "+noidnin +idnout" "xn--ahahah"
- idna_fail "$text" "+idnin +noidnout" "xn--ahahah"
+ idna_test "$text" "+idnin +noidnout" "xn--ahahah" "xn--ahahah."
idna_fail "$text" "+idnin +idnout" "xn--ahahah"
# Too long a label. The punycode string is too long (at 64 characters).
@@ -326,8 +326,8 @@ idna_enabled_test() {
idna_test "$text" "" "√.com" "\226\136\154.com."
idna_test "$text" "+noidnin +noidnout" "√.com" "\226\136\154.com."
idna_test "$text" "+noidnin +idnout" "√.com" "\226\136\154.com."
- idna_fail "$text" "+idnin +noidnout" "√.com"
- idna_fail "$text" "+idnin +idnout" "√.com"
+ idna_test "$text" "+idnin +noidnout" "√.com" "\226\136\154.com."
+ idna_test "$text" "+idnin +idnout" "√.com" "\226\136\154.com."
# Too long a label. The punycode string is too long (at 64 characters).
@@ -317,11 +317,11 @@ idna_enabled_test() {
# The +[no]idnout options should not have any effect on the test.
# Tests of a valid unicode string but an invalid U-label (output)
#
text="Checking invalid input U-label"
- idna_test "$text" "" "√.com" "\226\136\154.com."
+ idna_test "$text" "" "√.com" "xn--19g.com."
idna_test "$text" "+noidnin +noidnout" "√.com" "\226\136\154.com."
idna_test "$text" "+noidnin +idnout" "√.com" "\226\136\154.com."
idna_test "$text" "+idnin +noidnout" "√.com" "xn--19g.com."
- idna_test "$text" "+idnin +idnout" "√.com" "√.com."
+ idna_test "$text" "+idnin +idnout" "√.com" "√.com."
# Tests of a valid unicode string but an invalid U-label (output)
#
--
2.51.0
2.51.1

20
bind-9.18-dig-idn-input-always.patch
View File

@ -1,4 +1,4 @@
From d023241c7e2921926be8bd1784424eefba2a3c54 Mon Sep 17 00:00:00 2001
From cd5e88407380c5ced9a51736f0c2d679d053e188 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 6 Nov 2024 21:29:47 +0100
Subject: [PATCH] Allow always IDN input in dig
@ -37,10 +37,10 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
2 files changed, 18 insertions(+), 7 deletions(-)
diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
index a1d7cfe..85acde1 100644
index d27b1fd..3a9f9c6 100644
--- a/bin/dig/dig.rst
+++ b/bin/dig/dig.rst
@@ -358,9 +358,9 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
@@ -348,9 +348,9 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
This option processes [or does not process] IDN domain names on input. This requires
``IDN SUPPORT`` to have been enabled at compile time.
@ -54,10 +54,10 @@ index a1d7cfe..85acde1 100644
``+[no]idnout``
This option converts [or does not convert] puny code on output. This requires
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 7e88b6b..fbd5ad9 100644
index ac7e1fb..9555e63 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -620,6 +620,9 @@ clone_server_list(dig_serverlist_t src, dig_serverlist_t *dest) {
@@ -622,6 +622,9 @@ clone_server_list(dig_serverlist_t src, dig_serverlist_t *dest) {
dig_lookup_t *
make_empty_lookup(void) {
dig_lookup_t *looknew;
@ -67,7 +67,7 @@ index 7e88b6b..fbd5ad9 100644
debug("make_empty_lookup()");
@@ -671,8 +674,8 @@ make_empty_lookup(void) {
@@ -673,8 +676,8 @@ make_empty_lookup(void) {
looknew->qr = false;
looknew->accept_reply_unexpected_src = false;
#ifdef HAVE_LIBIDN2
@ -78,9 +78,9 @@ index 7e88b6b..fbd5ad9 100644
#else /* ifdef HAVE_LIBIDN2 */
looknew->idnin = false;
looknew->idnout = false;
@@ -4493,8 +4496,16 @@ idn_locale_to_ace(const char *src, char *dst, size_t dstlen) {
*/
res = idn2_to_ascii_lz(src, &ascii_src, IDN2_NONTRANSITIONAL);
@@ -4497,8 +4500,16 @@ idn_locale_to_ace(const char *src, char *dst, size_t dstlen) {
res = idn2_to_ascii_lz(src, &ascii_src, IDN2_TRANSITIONAL);
}
if (res != IDN2_OK) {
- fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
- src, idn2_strerror(res));
@ -98,5 +98,5 @@ index 7e88b6b..fbd5ad9 100644
/*
--
2.50.1
2.51.1

2
bind.spec
View File

@ -123,8 +123,6 @@ Patch211: bind-9.16-CVE-2024-1737-records-test.patch
# https://gitlab.isc.org/isc-projects/bind9/commit/3f1826f2f78792e95f56da7af3a35c46b4d6d9af
Patch212: bind-9.16-CVE-2024-1737-types.patch
Patch213: bind-9.16-CVE-2024-1737-types-test.patch
# backport issue fix
Patch214: bind-9.16-CVE-2024-1737-records-test2.patch
# https://gitlab.isc.org/isc-projects/bind9/-/commit/c6e6a7af8ac6b575dd3657b0f5cf4248d734c2b0
Patch215: bind-9.18-CVE-2024-11187-pre-test.patch
Patch216: bind-9.18-CVE-2024-11187.patch