rpms/bind
7
0
Fork 1
Code Issues Pull Requests Releases Activity

import UBI bind-9.11.36-14.el8_10

Browse Source
This commit is contained in:
eabdullin 2024-05-22 13:42:14 +00:00
parent 8d35d07b31
commit 6650d7fa32
4 changed files with 124 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
SOURCES/bind-9.11-stale-cache.patch Normal file
View File

@ -0,0 +1,65 @@
From 8a7bff93037432fcfe8532752e89f150ea3030a4 Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Mon, 9 Oct 2023 19:00:12 +0200
Subject: [PATCH] Do not keep stale records by default
By default set max-stale-ttl to 0, unless stale-answer-enable yes. This
were enabled by mistake when backporting fix for CVE-2023-2828. It
causes increased cache usage on servers not wanting to serve stale
records. Fix that by setting smart defaults based on stale answers
enabled with possible manual tuning.
---
bin/named/server.c | 25 +++++++++++++++++++------
1 file changed, 19 insertions(+), 6 deletions(-)
diff --git a/bin/named/server.c b/bin/named/server.c
index 7af90d0..afdc4fa 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -3295,7 +3295,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
size_t max_acache_size;
size_t max_adb_size;
uint32_t lame_ttl, fail_ttl;
- uint32_t max_stale_ttl;
+ uint32_t max_stale_ttl = 0;
dns_tsig_keyring_t *ring = NULL;
dns_view_t *pview = NULL; /* Production view */
isc_mem_t *cmctx = NULL, *hmctx = NULL;
@@ -3739,16 +3739,29 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
if (view->maxncachettl > 7 * 24 * 3600)
view->maxncachettl = 7 * 24 * 3600;
- obj = NULL;
- result = ns_config_get(maps, "max-stale-ttl", &obj);
- INSIST(result == ISC_R_SUCCESS);
- max_stale_ttl = cfg_obj_asuint32(obj);
-
obj = NULL;
result = ns_config_get(maps, "stale-answer-enable", &obj);
INSIST(result == ISC_R_SUCCESS);
view->staleanswersenable = cfg_obj_asboolean(obj);
+ // RHEL-11785 -- set the stale-ttl to non-zero value only if enabled
+ obj = NULL;
+ if (view->staleanswersenable) {
+ result = ns_config_get(maps, "max-stale-ttl", &obj);
+ INSIST(result == ISC_R_SUCCESS);
+ max_stale_ttl = cfg_obj_asuint32(obj);
+ /*
+ * If 'stale-answer-enable' is false, max_stale_ttl is set
+ * to 0, meaning keeping stale RRsets in cache is disabled.
+ */
+ } else {
+ /* Do not use default value if stale is disabled,
+ * but allow manual overriding, like 'stale-cache-enable' */
+ result = ns_config_get(optionmaps, "max-stale-ttl", &obj);
+ if (result == ISC_R_SUCCESS)
+ max_stale_ttl = cfg_obj_asuint32(obj);
+ }
+
result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
view->rdclass, &pview);
if (result == ISC_R_SUCCESS) {
--
2.41.0

31
SOURCES/bind-9.16-update-b.root-servers.net.patch Normal file
View File

@ -0,0 +1,31 @@
From 4e595a6b961e73af43350833109ccba0950119f9 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Thu, 12 Oct 2023 10:19:38 +1100
Subject: [PATCH] Update b.root-servers.net IP addresses
This covers both root hints and the default primaries for the root
zone mirror. The official change date is Nov 27, 2023.
(cherry picked from commit 2ca2f7e9852a3d6e93f065c01ea4679f723688f7)
---
lib/dns/rootns.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lib/dns/rootns.c b/lib/dns/rootns.c
index 9653f3b..d6ff76e 100644
--- a/lib/dns/rootns.c
+++ b/lib/dns/rootns.c
@@ -56,8 +56,8 @@ static char root_ns[] =
". 518400 IN NS M.ROOT-SERVERS.NET.\n"
"A.ROOT-SERVERS.NET. 3600000 IN A 198.41.0.4\n"
"A.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:503:BA3E::2:30\n"
-"B.ROOT-SERVERS.NET. 3600000 IN A 199.9.14.201\n"
-"B.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:200::b\n"
+"B.ROOT-SERVERS.NET. 3600000 IN A 170.247.170.2\n"
+"B.ROOT-SERVERS.NET. 3600000 IN AAAA 2801:1b8:10::b\n"
"C.ROOT-SERVERS.NET. 3600000 IN A 192.33.4.12\n"
"C.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:2::c\n"
"D.ROOT-SERVERS.NET. 3600000 IN A 199.7.91.13\n"
--
2.43.0

17
SOURCES/named.root
View File

@ -1,13 +1,13 @@
; <<>> DiG 9.11.3-RedHat-9.11.3-3.fc27 <<>> +bufsize=1200 +norec @a.root-servers.net
; (2 servers found)
; <<>> DiG 9.18.20 <<>> -4 +tcp +norec +nostats @d.root-servers.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46900
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47286
;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 27
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
; EDNS: version: 0, flags:; udp: 1450
;; QUESTION SECTION:
;. IN NS
@ -28,7 +28,7 @@
;; ADDITIONAL SECTION:
a.root-servers.net. 518400 IN A 198.41.0.4
b.root-servers.net. 518400 IN A 199.9.14.201
b.root-servers.net. 518400 IN A 170.247.170.2
c.root-servers.net. 518400 IN A 192.33.4.12
d.root-servers.net. 518400 IN A 199.7.91.13
e.root-servers.net. 518400 IN A 192.203.230.10
@ -41,7 +41,7 @@ k.root-servers.net. 518400 IN A 193.0.14.129
l.root-servers.net. 518400 IN A 199.7.83.42
m.root-servers.net. 518400 IN A 202.12.27.33
a.root-servers.net. 518400 IN AAAA 2001:503:ba3e::2:30
b.root-servers.net. 518400 IN AAAA 2001:500:200::b
b.root-servers.net. 518400 IN AAAA 2801:1b8:10::b
c.root-servers.net. 518400 IN AAAA 2001:500:2::c
d.root-servers.net. 518400 IN AAAA 2001:500:2d::d
e.root-servers.net. 518400 IN AAAA 2001:500:a8::e
@ -54,8 +54,3 @@ k.root-servers.net. 518400 IN AAAA 2001:7fd::1
l.root-servers.net. 518400 IN AAAA 2001:500:9f::42
m.root-servers.net. 518400 IN AAAA 2001:dc3::35
;; Query time: 24 msec
;; SERVER: 198.41.0.4#53(198.41.0.4)
;; WHEN: Thu Apr 05 15:57:34 CEST 2018
;; MSG SIZE rcvd: 811

32
SPECS/bind.spec
View File

@ -68,7 +68,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
Name: bind
License: MPLv2.0
Version: 9.11.36
Release: 11%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.1
Release: 14%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
Epoch: 32
Url: https://www.isc.org/downloads/bind/
#
@ -175,14 +175,18 @@ Patch196: bind-9.16-CVE-2022-3094-test.patch
# https://gitlab.isc.org/isc-projects/bind9/commit/f1d9e9ee3859976f403914d20ad2a10855343702
Patch197: bind-9.11-CVE-2023-2828.patch
Patch198: bind-9.16-CVE-2023-3341.patch
# https://issues.redhat.com/browse/RHEL-11785, downstream
Patch199: bind-9.11-stale-cache.patch
# https://gitlab.isc.org/isc-projects/bind9/commit/8924adca613ca9daea63786563cce6fdbd742c56
Patch200: bind-9.16-update-b.root-servers.net.patch
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8768
Patch199: bind-9.11-CVE-2023-4408.patch
Patch201: bind-9.11-CVE-2023-4408.patch
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8769
Patch200: bind-9.11-CVE-2023-50387.patch
Patch202: bind-9.11-CVE-2023-50387.patch
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8778
Patch201: bind-9.11-CVE-2023-2828-fixup.patch
Patch203: bind-9.11-CVE-2023-2828-fixup.patch
# addition to patch 200
Patch202: bind-9.11-CVE-2023-50387-fixup.patch
Patch204: bind-9.11-CVE-2023-50387-fixup.patch
# SDB patches
Patch11: bind-9.3.2b2-sdbsrc.patch
@ -591,10 +595,12 @@ are used for building ISC DHCP.
%patch196 -p1 -b .CVE-2022-3094-test
%patch197 -p1 -b .CVE-2023-2828
%patch198 -p1 -b .CVE-2023-3341
%patch199 -p1 -b .CVE-2023-4408
%patch200 -p1 -b .CVE-2023-50387+50868
%patch201 -p1 -b .CVE-2023-2828-fixup
%patch202 -p1 -b .CVE-2023-50387-fixup
%patch199 -p1 -b .RHEL-11785
%patch200 -p1 -b .b.root-servers.net
%patch201 -p1 -b .CVE-2023-4408
%patch202 -p1 -b .CVE-2023-50387+50868
%patch203 -p1 -b .CVE-2023-2828-fixup
%patch204 -p1 -b .CVE-2023-50387-fixup
mkdir lib/dns/tests/testdata/dstrandom
cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@ -1647,11 +1653,17 @@ rm -rf ${RPM_BUILD_ROOT}
%endif
%changelog
* Mon Feb 26 2024 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-11.1
* Mon Feb 26 2024 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-14
- Speed up parsing of DNS messages with many different names (CVE-2023-4408)
- Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387 CVE-2023-50868)
- Do not use header_prev in expire_lru_headers
* Thu Dec 07 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-13
- Update addresses of b.root-servers.net (RHEL-18449)
* Mon Oct 09 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-12
- Disable caching of stale records by default (RHEL-11785)
* Tue Sep 19 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-11
- Prevent exahustion of memory from control channel (CVE-2023-3341)