Prevent flooding with UPDATE requests

6064. [security] An UPDATE message flood could cause named to exhaust all available memory. This flaw was addressed by adding a new "update-quota" statement that controls the number of simultaneous UPDATE messages that can be processed or forwarded. The default is 100. A stats counter has been added to record events when the update quota is exceeded, and the XML and JSON statistics version numbers have been updated. (CVE-2022-3094) [GL #3523] Resolves: CVE-2022-3094
2023-02-08 18:21:52 +01:00 · 2023-02-08 18:21:52 +01:00 · a85d02f014
commit a85d02f014
parent ca0f46336e
4 changed files with 988 additions and 1 deletions
--- a/bind-9.16-CVE-2022-3094-1.patch
+++ b/bind-9.16-CVE-2022-3094-1.patch
@ -0,0 +1,241 @@
 From 0c0dc08d3ef26b7411cfe089e8144454831e8af5 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 1 Sep 2022 16:05:04 -0700
 Subject: [PATCH] add an update quota
 limit the number of simultaneous DNS UPDATE events that can be
 processed by adding a quota for update and update forwarding.
 this quota currently, arbitrarily, defaults to 100.
 also add a statistics counter to record when the update quota
 has been exceeded.
 (cherry picked from commit 7c47254a140c3e9cf383cda73c7b6a55c4782826)
 ---
 bin/named/bind9.xsl        |  4 +++-
 bin/named/bind9.xsl.h      |  6 +++++-
 bin/named/statschannel.c   |  5 +++--
 doc/arm/reference.rst      |  5 +++++
 lib/ns/include/ns/server.h |  1 +
 lib/ns/include/ns/stats.h  |  4 +++-
 lib/ns/server.c            |  2 ++
 lib/ns/update.c            | 38 +++++++++++++++++++++++++++++++++++++-
 8 files changed, 59 insertions(+), 6 deletions(-)
 diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl
 index 5078115..194625b 100644
 --- a/bin/named/bind9.xsl
 +++ b/bin/named/bind9.xsl
@@ -12,7 +12,9 @@
 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
   <xsl:output method="html" indent="yes" version="4.0"/>
 -  <xsl:template match="statistics[@version=&quot;3.11&quot;]">
 +  <!-- the version number **below** must match version in bin/named/statschannel.c -->
 +  <!-- don't forget to update "/xml/v<STATS_XML_VERSION_MAJOR>" in the HTTP endpoints listed below -->
 +  <xsl:template match="statistics[@version=&quot;3.11.1&quot;]">
     <html>
       <head>
         <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
 diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
 index e30f7f5..b182742 100644
 --- a/bin/named/bind9.xsl.h
 +++ b/bin/named/bind9.xsl.h
@@ -20,7 +20,11 @@ static char xslmsg[] =
 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" "
 	"xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
 -	" <xsl:template match=\"statistics[@version=&quot;3.11&quot;]\">\n"
 +	" <!-- the version number **below** must match version in "
 +	"bin/named/statschannel.c -->\n"
 +	" <!-- don't forget to update \"/xml/v<STATS_XML_VERSION_MAJOR>\" in "
 +	"the HTTP endpoints listed below -->\n"
 +	" <xsl:template match=\"statistics[@version=&quot;3.11.1&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
 	" <script type=\"text/javascript\" "
 diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
 index 832ce93..7361ead 100644
 --- a/bin/named/statschannel.c
 +++ b/bin/named/statschannel.c
@@ -335,6 +335,7 @@ init_desc(void) {
 	SET_NSSTATDESC(reclimitdropped,
 		       "queries dropped due to recursive client limit",
 		       "RecLimitDropped");
 +	SET_NSSTATDESC(updatequota, "Update quota exceeded", "UpdateQuota");
 	INSIST(i == ns_statscounter_max);
@@ -2007,7 +2008,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 					      "href=\"/bind9.xsl\""));
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
 -					 ISC_XMLCHAR "3.11"));
 +					 ISC_XMLCHAR "3.11.1"));
 	/* Set common fields for statistics dump */
 	dumparg.type = isc_statsformat_xml;
@@ -2876,7 +2877,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 	/*
 	 * These statistics are included no matter which URL we use.
 	 */
 -	obj = json_object_new_string("1.5");
 +	obj = json_object_new_string("1.5.1");
 	CHECKMEM(obj);
 	json_object_object_add(bindstats, "json-stats-version", obj);
 diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
 index 2d05aec..25c20d7 100644
 --- a/doc/arm/reference.rst
 +++ b/doc/arm/reference.rst
@@ -6705,6 +6705,11 @@ Name Server Statistics Counters
 ``UpdateBadPrereq``
     This indicates the number of dynamic updates rejected due to a prerequisite failure.
 +``UpdateQuota``
 +    This indicates the number of times a dynamic update or update
 +    forwarding request was rejected because the number of pending
 +    requests exceeded the update quota.
 +
 ``RateDropped``
     This indicates the number of responses dropped due to rate limits.
 diff --git a/lib/ns/include/ns/server.h b/lib/ns/include/ns/server.h
 index 6a1f345..0abb579 100644
 --- a/lib/ns/include/ns/server.h
 +++ b/lib/ns/include/ns/server.h
@@ -84,6 +84,7 @@ struct ns_server {
 	isc_quota_t recursionquota;
 	isc_quota_t tcpquota;
 	isc_quota_t xfroutquota;
 +	isc_quota_t updquota;
 	/*% Test options and other configurables */
 	uint32_t options;
 diff --git a/lib/ns/include/ns/stats.h b/lib/ns/include/ns/stats.h
 index 3c08799..95b15d0 100644
 --- a/lib/ns/include/ns/stats.h
 +++ b/lib/ns/include/ns/stats.h
@@ -106,7 +106,9 @@ enum {
 	ns_statscounter_reclimitdropped = 66,
 -	ns_statscounter_max = 67,
 +	ns_statscounter_updatequota = 67,
 +
 +	ns_statscounter_max = 68,
 };
 void
 diff --git a/lib/ns/server.c b/lib/ns/server.c
 index a970a28..540bc2e 100644
 --- a/lib/ns/server.c
 +++ b/lib/ns/server.c
@@ -52,6 +52,7 @@ ns_server_create(isc_mem_t *mctx, ns_matchview_t matchingview,
 	isc_quota_init(&sctx->xfroutquota, 10);
 	isc_quota_init(&sctx->tcpquota, 10);
 	isc_quota_init(&sctx->recursionquota, 100);
 +	isc_quota_init(&sctx->updquota, 100);
 	CHECKFATAL(dns_tkeyctx_create(mctx, &sctx->tkeyctx));
@@ -131,6 +132,7 @@ ns_server_detach(ns_server_t **sctxp) {
 			isc_mem_put(sctx->mctx, altsecret, sizeof(*altsecret));
 		}
 +		isc_quota_destroy(&sctx->updquota);
 		isc_quota_destroy(&sctx->recursionquota);
 		isc_quota_destroy(&sctx->tcpquota);
 		isc_quota_destroy(&sctx->xfroutquota);
 diff --git a/lib/ns/update.c b/lib/ns/update.c
 index 546b70a..9a8c309 100644
 --- a/lib/ns/update.c
 +++ b/lib/ns/update.c
@@ -1544,6 +1544,19 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 +	result = isc_quota_attach(&client->manager->sctx->updquota,
 +				  &(isc_quota_t *){ NULL });
 +	if (result != ISC_R_SUCCESS) {
 +		update_log(client, zone, LOGLEVEL_PROTOCOL,
 +			   "update failed: too many DNS UPDATEs queued (%s)",
 +			   isc_result_totext(result));
 +		ns_stats_increment(client->manager->sctx->nsstats,
 +				   ns_statscounter_updatequota);
 +		ns_client_drop(client, result);
 +		isc_nmhandle_detach(&client->reqhandle);
 +		return (DNS_R_DROP);
 +	}
 +
 	event = (update_event_t *)isc_event_allocate(
 		client->mctx, client, DNS_EVENT_UPDATE, update_action, NULL,
 		sizeof(*event));
@@ -1676,12 +1689,19 @@ failure:
 		       dns_zone_gettype(zone) == dns_zone_mirror);
 		inc_stats(client, zone, ns_statscounter_updaterej);
 	}
 +
 	/*
 	 * We failed without having sent an update event to the zone.
 	 * We are still in the client task context, so we can
 	 * simply give an error response without switching tasks.
 	 */
 -	respond(client, result);
 +	if (result == DNS_R_DROP) {
 +		ns_client_drop(client, result);
 +		isc_nmhandle_detach(&client->reqhandle);
 +	} else {
 +		respond(client, result);
 +	}
 +
 	if (zone != NULL) {
 		dns_zone_detach(&zone);
 	}
@@ -3489,6 +3509,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
 	respond(client, uev->result);
 +	isc_quota_detach(&(isc_quota_t *){ &client->manager->sctx->updquota });
 	isc_event_free(&event);
 	isc_nmhandle_detach(&client->updatehandle);
 }
@@ -3505,6 +3526,8 @@ forward_fail(isc_task_t *task, isc_event_t *event) {
 	INSIST(client->nupdates > 0);
 	client->nupdates--;
 	respond(client, DNS_R_SERVFAIL);
 +
 +	isc_quota_detach(&(isc_quota_t *){ &client->manager->sctx->updquota });
 	isc_event_free(&event);
 	isc_nmhandle_detach(&client->updatehandle);
 }
@@ -3542,6 +3565,8 @@ forward_done(isc_task_t *task, isc_event_t *event) {
 	client->nupdates--;
 	ns_client_sendraw(client, uev->answer);
 	dns_message_detach(&uev->answer);
 +
 +	isc_quota_detach(&(isc_quota_t *){ &client->manager->sctx->updquota });
 	isc_event_free(&event);
 	isc_nmhandle_detach(&client->updatehandle);
 }
@@ -3576,6 +3601,17 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 +	result = isc_quota_attach(&client->manager->sctx->updquota,
 +				  &(isc_quota_t *){ NULL });
 +	if (result != ISC_R_SUCCESS) {
 +		update_log(client, zone, LOGLEVEL_PROTOCOL,
 +			   "update failed: too many DNS UPDATEs queued (%s)",
 +			   isc_result_totext(result));
 +		ns_stats_increment(client->manager->sctx->nsstats,
 +				   ns_statscounter_updatequota);
 +		return (DNS_R_DROP);
 +	}
 +
 	event = (update_event_t *)isc_event_allocate(
 		client->mctx, client, DNS_EVENT_UPDATE, forward_action, NULL,
 		sizeof(*event));
 -- 
 2.39.1
--- a/bind-9.16-CVE-2022-3094-2.patch
+++ b/bind-9.16-CVE-2022-3094-2.patch
@ -0,0 +1,266 @@
 From 7fe2204a2e8952bf892e4a70fea2ef5167e1f509 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 1 Sep 2022 16:22:46 -0700
 Subject: [PATCH] add a configuration option for the update quota
 add an "update-quota" option to configure the update quota.
 (cherry picked from commit f57758a7303ad0034ff2ff08eaaf2ef899630f19)
 ---
 bin/named/config.c                   | 1 +
 bin/named/named.conf.rst             | 9 +++++----
 bin/named/server.c                   | 1 +
 bin/tests/system/checkconf/good.conf | 1 +
 doc/arm/reference.rst                | 7 ++++++-
 doc/man/named.conf.5in               | 9 +++++----
 doc/misc/master.zoneopt.rst          | 2 +-
 doc/misc/options                     | 1 +
 doc/misc/options.active              | 1 +
 doc/misc/options.grammar.rst         | 3 ++-
 doc/misc/slave.zoneopt.rst           | 2 +-
 lib/isccfg/namedconf.c               | 1 +
 12 files changed, 26 insertions(+), 12 deletions(-)
 diff --git a/bin/named/config.c b/bin/named/config.c
 index 5fedee84d9..494147015f 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
@@ -130,6 +130,7 @@ options {\n\
 	transfers-out 10;\n\
 	transfers-per-ns 2;\n\
 	trust-anchor-telemetry yes;\n\
 +	update-quota 100;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
 diff --git a/bin/named/named.conf.rst b/bin/named/named.conf.rst
 index 27eed5ca3e..4c9f9a7370 100644
 --- a/bin/named/named.conf.rst
 +++ b/bin/named/named.conf.rst
@@ -179,7 +179,7 @@ OPTIONS
   	answer-cookie boolean;
   	attach-cache string;
   	auth-nxdomain boolean; // default changed
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off );// deprecated
   	automatic-interface-scan boolean;
   	avoid-v4-udp-ports { portrange; ... };
   	avoid-v6-udp-ports { portrange; ... };
@@ -446,6 +446,7 @@ OPTIONS
   	trust-anchor-telemetry boolean; // experimental
   	try-tcp-refresh boolean;
   	update-check-ksk boolean;
 +  	update-quota integer;
   	use-alt-transfer-source boolean;
   	use-v4-udp-ports { portrange; ... };
   	use-v6-udp-ports { portrange; ... };
@@ -584,7 +585,7 @@ VIEW
   	    * ) ] [ dscp integer ];
   	attach-cache string;
   	auth-nxdomain boolean; // default changed
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off );// deprecated
   	cache-file quoted_string;// deprecated
   	catalog-zones { zone string [ default-masters [ port integer ]
   	    [ dscp integer ] { ( remote-servers | ipv4_address [ port
@@ -859,7 +860,7 @@ VIEW
   		    integer | * ) ] [ dscp integer ];
   		alt-transfer-source-v6 ( ipv6_address | * ) [ port (
   		    integer | * ) ] [ dscp integer ];
 -  		auto-dnssec ( allow | maintain | off );
 +  		auto-dnssec ( allow | maintain | off );// deprecated
   		check-dup-records ( fail | warn | ignore );
   		check-integrity boolean;
   		check-mx ( fail | warn | ignore );
@@ -977,7 +978,7 @@ ZONE
   	    ] [ dscp integer ];
   	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
   	    * ) ] [ dscp integer ];
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off );// deprecated
   	check-dup-records ( fail | warn | ignore );
   	check-integrity boolean;
   	check-mx ( fail | warn | ignore );
 diff --git a/bin/named/server.c b/bin/named/server.c
 index 20443ff8a9..78a21d62a2 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
@@ -8542,6 +8542,7 @@ load_configuration(const char *filename, named_server_t *server,
 	configure_server_quota(maps, "tcp-clients", &server->sctx->tcpquota);
 	configure_server_quota(maps, "recursive-clients",
 			       &server->sctx->recursionquota);
 +	configure_server_quota(maps, "update-quota", &server->sctx->updquota);
 	max = isc_quota_getmax(&server->sctx->recursionquota);
 	if (max > 1000) {
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
 index b1f7059acf..0ecdb68e95 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
@@ -75,6 +75,7 @@ options {
 	recursive-clients 3000;
 	serial-query-rate 100;
 	server-id none;
 +	update-quota 200;
 	check-names primary warn;
 	check-names secondary ignore;
 	max-cache-size 20000000000000;
 diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
 index 2603d60251..703663d0ba 100644
 --- a/doc/arm/reference.rst
 +++ b/doc/arm/reference.rst
@@ -3151,6 +3151,11 @@ system.
    value as ``tcp-keepalive-timeout``. This value can be updated at
    runtime by using ``rndc tcp-timeouts``.
 +``update-quota``
 +   This is the maximum number of simultaneous DNS UPDATE messages that
 +   the server will accept for updating local authoritiative zones or
 +   forwarding to a primary server. The default is ``100``.
 +
 .. _intervals:
 Periodic Task Intervals
@@ -6840,7 +6845,7 @@ Name Server Statistics Counters
 ``UpdateQuota``
     This indicates the number of times a dynamic update or update
     forwarding request was rejected because the number of pending
 -    requests exceeded the update quota.
 +    requests exceeded ``update-quota``.
 ``RateDropped``
     This indicates the number of responses dropped due to rate limits.
 diff --git a/doc/man/named.conf.5in b/doc/man/named.conf.5in
 index 4c46f47592..c87afa2881 100644
 --- a/doc/man/named.conf.5in
 +++ b/doc/man/named.conf.5in
@@ -231,7 +231,7 @@ options {
       answer\-cookie boolean;
       attach\-cache string;
       auth\-nxdomain boolean; // default changed
 -      auto\-dnssec ( allow | maintain | off );
 +      auto\-dnssec ( allow | maintain | off );// deprecated
       automatic\-interface\-scan boolean;
       avoid\-v4\-udp\-ports { portrange; ... };
       avoid\-v6\-udp\-ports { portrange; ... };
@@ -498,6 +498,7 @@ options {
       trust\-anchor\-telemetry boolean; // experimental
       try\-tcp\-refresh boolean;
       update\-check\-ksk boolean;
 +      update\-quota integer;
       use\-alt\-transfer\-source boolean;
       use\-v4\-udp\-ports { portrange; ... };
       use\-v6\-udp\-ports { portrange; ... };
@@ -668,7 +669,7 @@ view string [ class ] {
           * ) ] [ dscp integer ];
       attach\-cache string;
       auth\-nxdomain boolean; // default changed
 -      auto\-dnssec ( allow | maintain | off );
 +      auto\-dnssec ( allow | maintain | off );// deprecated
       cache\-file quoted_string;// deprecated
       catalog\-zones { zone string [ default\-masters [ port integer ]
           [ dscp integer ] { ( remote\-servers | ipv4_address [ port
@@ -943,7 +944,7 @@ view string [ class ] {
                   integer | * ) ] [ dscp integer ];
               alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port (
                   integer | * ) ] [ dscp integer ];
 -              auto\-dnssec ( allow | maintain | off );
 +              auto\-dnssec ( allow | maintain | off );// deprecated
               check\-dup\-records ( fail | warn | ignore );
               check\-integrity boolean;
               check\-mx ( fail | warn | ignore );
@@ -1065,7 +1066,7 @@ zone string [ class ] {
           ] [ dscp integer ];
       alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port ( integer |
           * ) ] [ dscp integer ];
 -      auto\-dnssec ( allow | maintain | off );
 +      auto\-dnssec ( allow | maintain | off );// deprecated
       check\-dup\-records ( fail | warn | ignore );
       check\-integrity boolean;
       check\-mx ( fail | warn | ignore );
 diff --git a/doc/misc/master.zoneopt.rst b/doc/misc/master.zoneopt.rst
 index 8fc7e1b4f0..346d59813e 100644
 --- a/doc/misc/master.zoneopt.rst
 +++ b/doc/misc/master.zoneopt.rst
@@ -20,7 +20,7 @@
   	also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
   	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
   	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off ); // deprecated
   	check-dup-records ( fail | warn | ignore );
   	check-integrity <boolean>;
   	check-mx ( fail | warn | ignore );
 diff --git a/doc/misc/options b/doc/misc/options
 index f57399499a..0dbcf101e1 100644
 --- a/doc/misc/options
 +++ b/doc/misc/options
@@ -404,6 +404,7 @@ options {
         trust-anchor-telemetry <boolean>; // experimental
         try-tcp-refresh <boolean>;
         update-check-ksk <boolean>;
 +        update-quota <integer>;
         use-alt-transfer-source <boolean>;
         use-id-pool <boolean>; // ancient
         use-ixfr <boolean>; // obsolete
 diff --git a/doc/misc/options.active b/doc/misc/options.active
 index 5fc1ab29f4..eb75a86eae 100644
 --- a/doc/misc/options.active
 +++ b/doc/misc/options.active
@@ -363,6 +363,7 @@ options {
         trust-anchor-telemetry <boolean>; // experimental
         try-tcp-refresh <boolean>;
         update-check-ksk <boolean>;
 +        update-quota <integer>;
         use-alt-transfer-source <boolean>;
         use-v4-udp-ports { <portrange>; ... };
         use-v6-udp-ports { <portrange>; ... };
 diff --git a/doc/misc/options.grammar.rst b/doc/misc/options.grammar.rst
 index 438072c95c..beef35341a 100644
 --- a/doc/misc/options.grammar.rst
 +++ b/doc/misc/options.grammar.rst
@@ -33,7 +33,7 @@
   	answer-cookie <boolean>;
   	attach-cache <string>;
   	auth-nxdomain <boolean>; // default changed
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off ); // deprecated
   	automatic-interface-scan <boolean>;
   	avoid-v4-udp-ports { <portrange>; ... };
   	avoid-v6-udp-ports { <portrange>; ... };
@@ -300,6 +300,7 @@
   	trust-anchor-telemetry <boolean>; // experimental
   	try-tcp-refresh <boolean>;
   	update-check-ksk <boolean>;
 +  	update-quota <integer>;
   	use-alt-transfer-source <boolean>;
   	use-v4-udp-ports { <portrange>; ... };
   	use-v6-udp-ports { <portrange>; ... };
 diff --git a/doc/misc/slave.zoneopt.rst b/doc/misc/slave.zoneopt.rst
 index cc72dcbf67..468a7f4d9a 100644
 --- a/doc/misc/slave.zoneopt.rst
 +++ b/doc/misc/slave.zoneopt.rst
@@ -21,7 +21,7 @@
   	also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
   	alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
   	alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
 -  	auto-dnssec ( allow | maintain | off );
 +  	auto-dnssec ( allow | maintain | off ); // deprecated
   	check-names ( fail | warn | ignore );
   	database <string>;
   	dialup ( notify | notify-passive | passive | refresh | <boolean> );
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
 index 45de0196bf..6e63d86816 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
@@ -1267,6 +1267,7 @@ static cfg_clausedef_t options_clauses[] = {
 	{ "transfers-out", &cfg_type_uint32, 0 },
 	{ "transfers-per-ns", &cfg_type_uint32, 0 },
 	{ "treat-cr-as-space", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
 +	{ "update-quota", &cfg_type_uint32, 0 },
 	{ "use-id-pool", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
 	{ "use-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
 -- 
 2.39.1
--- a/bind-9.16-CVE-2022-3094-3.patch
+++ b/bind-9.16-CVE-2022-3094-3.patch
@ -0,0 +1,470 @@
 From 93b8bd39145566053ad8b22cef597146e9175ea4 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 8 Nov 2022 17:32:41 -0800
 Subject: [PATCH] move update ACL and update-policy checks before quota
 check allow-update, update-policy, and allow-update-forwarding before
 consuming quota slots, so that unauthorized clients can't fill the
 quota.
 (this moves the access check before the prerequisite check, which
 violates the precise wording of RFC 2136. however, RFC co-author Paul
 Vixie has stated that the RFC is mistaken on this point; it should have
 said that access checking must happen *no later than* the completion of
 prerequisite checks, not that it must happen exactly then.)
 (cherry picked from commit 964f559edb5036880b8e463b8f190b9007ee055d)
 ---
 lib/ns/update.c | 335 ++++++++++++++++++++++++++----------------------
 1 file changed, 181 insertions(+), 154 deletions(-)
 diff --git a/lib/ns/update.c b/lib/ns/update.c
 index 9a8c309..036184b 100644
 --- a/lib/ns/update.c
 +++ b/lib/ns/update.c
@@ -261,6 +261,9 @@ static void
 forward_done(isc_task_t *task, isc_event_t *event);
 static isc_result_t
 add_rr_prepare_action(void *data, rr_t *rr);
 +static isc_result_t
 +rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 +	  const dns_rdata_t *rdata, bool *flag);
 /**************************************************************************/
@@ -333,25 +336,26 @@ inc_stats(ns_client_t *client, dns_zone_t *zone, isc_statscounter_t counter) {
 static isc_result_t
 checkqueryacl(ns_client_t *client, dns_acl_t *queryacl, dns_name_t *zonename,
 	      dns_acl_t *updateacl, dns_ssutable_t *ssutable) {
 +	isc_result_t result;
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char classbuf[DNS_RDATACLASS_FORMATSIZE];
 -	int level;
 -	isc_result_t result;
 +	bool update_possible =
 +		((updateacl != NULL && !dns_acl_isnone(updateacl)) ||
 +		 ssutable != NULL);
 	result = ns_client_checkaclsilent(client, NULL, queryacl, true);
 	if (result != ISC_R_SUCCESS) {
 +		int level = update_possible ? ISC_LOG_ERROR : ISC_LOG_INFO;
 +
 		dns_name_format(zonename, namebuf, sizeof(namebuf));
 		dns_rdataclass_format(client->view->rdclass, classbuf,
 				      sizeof(classbuf));
 -		level = (updateacl == NULL && ssutable == NULL) ? ISC_LOG_INFO
 -								: ISC_LOG_ERROR;
 -
 		ns_client_log(client, NS_LOGCATEGORY_UPDATE_SECURITY,
 			      NS_LOGMODULE_UPDATE, level,
 			      "update '%s/%s' denied due to allow-query",
 			      namebuf, classbuf);
 -	} else if (updateacl == NULL && ssutable == NULL) {
 +	} else if (!update_possible) {
 		dns_name_format(zonename, namebuf, sizeof(namebuf));
 		dns_rdataclass_format(client->view->rdclass, classbuf,
 				      sizeof(classbuf));
@@ -1543,6 +1547,156 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	isc_result_t result = ISC_R_SUCCESS;
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 +	dns_ssutable_t *ssutable = NULL;
 +	dns_message_t *request = client->message;
 +	dns_aclenv_t *env =
 +		ns_interfacemgr_getaclenv(client->manager->interface->mgr);
 +	dns_rdataclass_t zoneclass;
 +	dns_rdatatype_t covers;
 +	dns_name_t *zonename = NULL;
 +	dns_db_t *db = NULL;
 +	dns_dbversion_t *ver = NULL;
 +
 +	CHECK(dns_zone_getdb(zone, &db));
 +	zonename = dns_db_origin(db);
 +	zoneclass = dns_db_class(db);
 +	dns_zone_getssutable(zone, &ssutable);
 +	dns_db_currentversion(db, &ver);
 +
 +	/*
 +	 * Update message processing can leak record existence information
 +	 * so check that we are allowed to query this zone.  Additionally,
 +	 * if we would refuse all updates for this zone, we bail out here.
 +	 */
 +	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone),
 +			    dns_zone_getorigin(zone),
 +			    dns_zone_getupdateacl(zone), ssutable));
 +
 +	/*
 +	 * Check requestor's permissions.
 +	 */
 +	if (ssutable == NULL) {
 +		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 +				     "update", dns_zone_getorigin(zone), false,
 +				     false));
 +	} else if (client->signer == NULL && !TCPCLIENT(client)) {
 +		CHECK(checkupdateacl(client, NULL, "update",
 +				     dns_zone_getorigin(zone), false, true));
 +	}
 +
 +	if (dns_zone_getupdatedisabled(zone)) {
 +		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
 +				     "because the zone is frozen.  Use "
 +				     "'rndc thaw' to re-enable updates.");
 +	}
 +
 +	/*
 +	 * Prescan the update section, checking for updates that
 +	 * are illegal or violate policy.
 +	 */
 +	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 +	     result == ISC_R_SUCCESS;
 +	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 +	{
 +		dns_name_t *name = NULL;
 +		dns_rdata_t rdata = DNS_RDATA_INIT;
 +		dns_ttl_t ttl;
 +		dns_rdataclass_t update_class;
 +
 +		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
 +			       &rdata, &covers, &ttl, &update_class);
 +
 +		if (!dns_name_issubdomain(name, zonename)) {
 +			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
 +		}
 +		if (update_class == zoneclass) {
 +			/*
 +			 * Check for meta-RRs.  The RFC2136 pseudocode says
 +			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
 +			 * "or any other QUERY metatype"
 +			 */
 +			if (dns_rdatatype_ismeta(rdata.type)) {
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +			result = dns_zone_checknames(zone, name, &rdata);
 +			if (result != ISC_R_SUCCESS) {
 +				FAIL(DNS_R_REFUSED);
 +			}
 +		} else if (update_class == dns_rdataclass_any) {
 +			if (ttl != 0 || rdata.length != 0 ||
 +			    (dns_rdatatype_ismeta(rdata.type) &&
 +			     rdata.type != dns_rdatatype_any))
 +			{
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +		} else if (update_class == dns_rdataclass_none) {
 +			if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
 +				FAILC(DNS_R_FORMERR, "meta-RR in update");
 +			}
 +		} else {
 +			update_log(client, zone, ISC_LOG_WARNING,
 +				   "update RR has incorrect class %d",
 +				   update_class);
 +			FAIL(DNS_R_FORMERR);
 +		}
 +
 +		/*
 +		 * draft-ietf-dnsind-simple-secure-update-01 says
 +		 * "Unlike traditional dynamic update, the client
 +		 * is forbidden from updating NSEC records."
 +		 */
 +		if (rdata.type == dns_rdatatype_nsec3) {
 +			FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
 +					     "allowed "
 +					     "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_nsec) {
 +			FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
 +					     "allowed "
 +					     "in secure zones");
 +		} else if (rdata.type == dns_rdatatype_rrsig &&
 +			   !dns_name_equal(name, zonename))
 +		{
 +			FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
 +					     "currently "
 +					     "not supported in secure zones "
 +					     "except "
 +					     "at the apex");
 +		}
 +
 +		if (ssutable != NULL) {
 +			isc_netaddr_t netaddr;
 +			dst_key_t *tsigkey = NULL;
 +			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 +
 +			if (client->message->tsigkey != NULL) {
 +				tsigkey = client->message->tsigkey->key;
 +			}
 +
 +			if (rdata.type != dns_rdatatype_any) {
 +				if (!dns_ssutable_checkrules(
 +					    ssutable, client->signer, name,
 +					    &netaddr, TCPCLIENT(client), env,
 +					    rdata.type, tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED, "rejected by "
 +							     "secure update");
 +				}
 +			} else {
 +				if (!ssu_checkall(db, ver, name, ssutable,
 +						  client->signer, &netaddr, env,
 +						  TCPCLIENT(client), tsigkey))
 +				{
 +					FAILC(DNS_R_REFUSED, "rejected by "
 +							     "secure update");
 +				}
 +			}
 +		}
 +	}
 +	if (result != ISC_R_NOMORE) {
 +		FAIL(result);
 +	}
 +
 +	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
 	result = isc_quota_attach(&client->manager->sctx->updquota,
 				  &(isc_quota_t *){ NULL });
@@ -1552,9 +1706,7 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 			   isc_result_totext(result));
 		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_updatequota);
 -		ns_client_drop(client, result);
 -		isc_nmhandle_detach(&client->reqhandle);
 -		return (DNS_R_DROP);
 +		CHECK(DNS_R_DROP);
 	}
 	event = (update_event_t *)isc_event_allocate(
@@ -1571,6 +1723,16 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	dns_zone_gettask(zone, &zonetask);
 	isc_task_send(zonetask, ISC_EVENT_PTR(&event));
 +failure:
 +	if (db != NULL) {
 +		dns_db_closeversion(db, &ver, false);
 +		dns_db_detach(&db);
 +	}
 +
 +	if (ssutable != NULL) {
 +		dns_ssutable_detach(&ssutable);
 +	}
 +
 	return (result);
 }
@@ -1671,9 +1833,6 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
 		break;
 	case dns_zone_secondary:
 	case dns_zone_mirror:
 -		CHECK(checkupdateacl(client, dns_zone_getforwardacl(zone),
 -				     "update forwarding", zonename, true,
 -				     false));
 		CHECK(send_forward_event(client, zone));
 		break;
 	default:
@@ -1685,8 +1844,6 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
 failure:
 	if (result == DNS_R_REFUSED) {
 -		INSIST(dns_zone_gettype(zone) == dns_zone_secondary ||
 -		       dns_zone_gettype(zone) == dns_zone_mirror);
 		inc_stats(client, zone, ns_statscounter_updaterej);
 	}
@@ -2578,7 +2735,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	dns_rdatatype_t covers;
 	dns_message_t *request = client->message;
 	dns_rdataclass_t zoneclass;
 -	dns_name_t *zonename;
 +	dns_name_t *zonename = NULL;
 	dns_ssutable_t *ssutable = NULL;
 	dns_fixedname_t tmpnamefixed;
 	dns_name_t *tmpname = NULL;
@@ -2590,8 +2747,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	dns_ttl_t maxttl = 0;
 	uint32_t maxrecords;
 	uint64_t records;
 -	dns_aclenv_t *env =
 -		ns_interfacemgr_getaclenv(client->manager->interface->mgr);
 	INSIST(event->ev_type == DNS_EVENT_UPDATE);
@@ -2602,14 +2757,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	zonename = dns_db_origin(db);
 	zoneclass = dns_db_class(db);
 	dns_zone_getssutable(zone, &ssutable);
 -
 -	/*
 -	 * Update message processing can leak record existence information
 -	 * so check that we are allowed to query this zone.  Additionally
 -	 * if we would refuse all updates for this zone we bail out here.
 -	 */
 -	CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone), zonename,
 -			    dns_zone_getupdateacl(zone), ssutable));
 +	options = dns_zone_getoptions(zone);
 	/*
 	 * Get old and new versions now that queryacl has been checked.
@@ -2745,135 +2893,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	update_log(client, zone, LOGLEVEL_DEBUG, "prerequisites are OK");
 -	/*
 -	 * Check Requestor's Permissions.  It seems a bit silly to do this
 -	 * only after prerequisite testing, but that is what RFC2136 says.
 -	 */
 -	if (ssutable == NULL) {
 -		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 -				     "update", zonename, false, false));
 -	} else if (client->signer == NULL && !TCPCLIENT(client)) {
 -		CHECK(checkupdateacl(client, NULL, "update", zonename, false,
 -				     true));
 -	}
 -
 -	if (dns_zone_getupdatedisabled(zone)) {
 -		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
 -				     "because the zone is frozen.  Use "
 -				     "'rndc thaw' to re-enable updates.");
 -	}
 -
 -	/*
 -	 * Perform the Update Section Prescan.
 -	 */
 -
 -	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 -	     result == ISC_R_SUCCESS;
 -	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
 -	{
 -		dns_name_t *name = NULL;
 -		dns_rdata_t rdata = DNS_RDATA_INIT;
 -		dns_ttl_t ttl;
 -		dns_rdataclass_t update_class;
 -		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
 -			       &rdata, &covers, &ttl, &update_class);
 -
 -		if (!dns_name_issubdomain(name, zonename)) {
 -			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
 -		}
 -		if (update_class == zoneclass) {
 -			/*
 -			 * Check for meta-RRs.  The RFC2136 pseudocode says
 -			 * check for ANY|AXFR|MAILA|MAILB, but the text adds
 -			 * "or any other QUERY metatype"
 -			 */
 -			if (dns_rdatatype_ismeta(rdata.type)) {
 -				FAILC(DNS_R_FORMERR, "meta-RR in update");
 -			}
 -			result = dns_zone_checknames(zone, name, &rdata);
 -			if (result != ISC_R_SUCCESS) {
 -				FAIL(DNS_R_REFUSED);
 -			}
 -		} else if (update_class == dns_rdataclass_any) {
 -			if (ttl != 0 || rdata.length != 0 ||
 -			    (dns_rdatatype_ismeta(rdata.type) &&
 -			     rdata.type != dns_rdatatype_any))
 -			{
 -				FAILC(DNS_R_FORMERR, "meta-RR in update");
 -			}
 -		} else if (update_class == dns_rdataclass_none) {
 -			if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
 -				FAILC(DNS_R_FORMERR, "meta-RR in update");
 -			}
 -		} else {
 -			update_log(client, zone, ISC_LOG_WARNING,
 -				   "update RR has incorrect class %d",
 -				   update_class);
 -			FAIL(DNS_R_FORMERR);
 -		}
 -
 -		/*
 -		 * draft-ietf-dnsind-simple-secure-update-01 says
 -		 * "Unlike traditional dynamic update, the client
 -		 * is forbidden from updating NSEC records."
 -		 */
 -		if (rdata.type == dns_rdatatype_nsec3) {
 -			FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
 -					     "allowed "
 -					     "in secure zones");
 -		} else if (rdata.type == dns_rdatatype_nsec) {
 -			FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
 -					     "allowed "
 -					     "in secure zones");
 -		} else if (rdata.type == dns_rdatatype_rrsig &&
 -			   !dns_name_equal(name, zonename)) {
 -			FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
 -					     "currently "
 -					     "not supported in secure zones "
 -					     "except "
 -					     "at the apex");
 -		}
 -
 -		if (ssutable != NULL) {
 -			isc_netaddr_t netaddr;
 -			dst_key_t *tsigkey = NULL;
 -			isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 -
 -			if (client->message->tsigkey != NULL) {
 -				tsigkey = client->message->tsigkey->key;
 -			}
 -
 -			if (rdata.type != dns_rdatatype_any) {
 -				if (!dns_ssutable_checkrules(
 -					    ssutable, client->signer, name,
 -					    &netaddr, TCPCLIENT(client), env,
 -					    rdata.type, tsigkey))
 -				{
 -					FAILC(DNS_R_REFUSED, "rejected by "
 -							     "secure update");
 -				}
 -			} else {
 -				if (!ssu_checkall(db, ver, name, ssutable,
 -						  client->signer, &netaddr, env,
 -						  TCPCLIENT(client), tsigkey))
 -				{
 -					FAILC(DNS_R_REFUSED, "rejected by "
 -							     "secure update");
 -				}
 -			}
 -		}
 -	}
 -	if (result != ISC_R_NOMORE) {
 -		FAIL(result);
 -	}
 -
 -	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
 -
 	/*
 	 * Process the Update Section.
 	 */
 -	options = dns_zone_getoptions(zone);
 	for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
 	     result == ISC_R_SUCCESS;
 	     result = dns_message_nextname(request, DNS_SECTION_UPDATE))
@@ -3307,10 +3330,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 			if (result == ISC_R_SUCCESS && records > maxrecords) {
 				update_log(client, zone, ISC_LOG_ERROR,
 					   "records in zone (%" PRIu64 ") "
 -					   "exceeds"
 -					   " max-"
 -					   "records"
 -					   " (%u)",
 +					   "exceeds max-records (%u)",
 					   records, maxrecords);
 				result = DNS_R_TOOMANYRECORDS;
 				goto failure;
@@ -3601,6 +3621,13 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 	update_event_t *event = NULL;
 	isc_task_t *zonetask = NULL;
 +	result = checkupdateacl(client, dns_zone_getforwardacl(zone),
 +				"update forwarding", dns_zone_getorigin(zone),
 +				true, false);
 +	if (result != ISC_R_SUCCESS) {
 +		return (result);
 +	}
 +
 	result = isc_quota_attach(&client->manager->sctx->updquota,
 				  &(isc_quota_t *){ NULL });
 	if (result != ISC_R_SUCCESS) {
 -- 
 2.39.1
--- a/bind.spec
+++ b/bind.spec
@ -51,7 +51,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.16.23
-Release:  8%{?dist}
+Release:  9%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@ -115,6 +115,10 @@ Patch178:bind-9.16-CVE-2022-2795.patch
 Patch179:bind-9.16-rh2101712.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7376
 Patch181:bind-9.16-rh2133889.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/82185f4f80d2fa39a4569f6740cb360ffff8f5c4
 Patch182: bind-9.16-CVE-2022-3094-1.patch
 Patch183: bind-9.16-CVE-2022-3094-2.patch
 Patch184: bind-9.16-CVE-2022-3094-3.patch
 %{?systemd_ordering}
 Requires:       coreutils
@ -424,6 +428,9 @@ in HTML and PDF format.
 %patch178 -p1 -b .CVE-2022-2795
 %patch179 -p1 -b .rh2101712
 %patch181 -p1 -b .rh2133889
 %patch182 -p1 -b .CVE-2022-3094
 %patch183 -p1 -b .CVE-2022-3094
 %patch184 -p1 -b .CVE-2022-3094
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@ -1147,6 +1154,9 @@ fi;
 %endif
 %changelog
 * Wed Feb 08 2023 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-9
 - Prevent flooding with UPDATE requests (CVE-2022-3094)
 * Thu Oct 13 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-8
 - Correct regression preventing bind-dyndb-ldap build (#2162795)