rpms/bind
7
0
Fork 1
Code Issues Pull Requests Releases Activity

Fix masterformat, reclimit, and resolver tests

Browse Source 
Some file changes were completely missing in the cherry-picks
of CVE-2024-1737 upstream test changes, as well as older backports
causing issues with the new version of bind.

Resolves: RHEL-6454
This commit is contained in:
Fedor Vorobev 2026-03-17 18:11:09 +01:00
parent c4caa41827
commit cf01b2a08d
8 changed files with 5452 additions and 160 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
bind-9.16-CVE-2024-1737-records-test.patch
View File

@ -1,4 +1,4 @@
From 37cb1cc74c954c01b2c06730b17e8cf3db589b7f Mon Sep 17 00:00:00 2001
From 6a6f31df4c3c2a886fc6df75381d72b13eb4c024 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Thu, 23 May 2024 19:12:40 +0200
Subject: [PATCH] Add test for not-loading and not-transfering huge RRSets
@ -42,7 +42,7 @@ succeed when the cap is disabled.
create mode 100644 bin/tests/system/reclimit/ns3/named5.conf.in
diff --git a/bin/tests/system/limits/ns1/named.conf.in b/bin/tests/system/limits/ns1/named.conf.in
index 118fdbd..cf0aa78 100644
index 118fdbd9b1..cf0aa783b1 100644
--- a/bin/tests/system/limits/ns1/named.conf.in
+++ b/bin/tests/system/limits/ns1/named.conf.in
@@ -22,6 +22,7 @@ options {
@ -54,7 +54,7 @@ index 118fdbd..cf0aa78 100644
zone "." {
diff --git a/bin/tests/system/masterformat/clean.sh b/bin/tests/system/masterformat/clean.sh
index c53c7ab..c606c61 100755
index c53c7ab4bc..c606c6183a 100755
--- a/bin/tests/system/masterformat/clean.sh
+++ b/bin/tests/system/masterformat/clean.sh
@@ -16,6 +16,8 @@ rm -f ./ns1/example.db.compat
@ -67,7 +67,7 @@ index c53c7ab..c606c61 100755
rm -f ./dig.out.*
rm -f ./dig.out
diff --git a/bin/tests/system/masterformat/ns1/compile.sh b/bin/tests/system/masterformat/ns1/compile.sh
index ad24bb3..3427954 100755
index ad24bb3201..34279547a0 100755
--- a/bin/tests/system/masterformat/ns1/compile.sh
+++ b/bin/tests/system/masterformat/ns1/compile.sh
@@ -29,6 +29,8 @@ $CHECKZONE -D -F raw -L 3333 -o example.db.serial.raw example \
@ -81,7 +81,7 @@ index ad24bb3..3427954 100755
$KEYGEN -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" signed >/dev/null 2>&1
diff --git a/bin/tests/system/masterformat/ns1/huge.db.in b/bin/tests/system/masterformat/ns1/huge.db.in
new file mode 100644
index 0000000..5a81863
index 0000000000..5a818632a8
--- /dev/null
+++ b/bin/tests/system/masterformat/ns1/huge.db.in
@@ -0,0 +1,22 @@
@ -108,7 +108,7 @@ index 0000000..5a81863
+ NS ns
+ns A 10.53.0.1
diff --git a/bin/tests/system/masterformat/ns1/named.conf.in b/bin/tests/system/masterformat/ns1/named.conf.in
index cc95655..1434ec3 100644
index cc95655691..1434ec34d6 100644
--- a/bin/tests/system/masterformat/ns1/named.conf.in
+++ b/bin/tests/system/masterformat/ns1/named.conf.in
@@ -22,6 +22,7 @@ options {
@ -142,7 +142,7 @@ index cc95655..1434ec3 100644
file "signed.db.map";
diff --git a/bin/tests/system/masterformat/ns1/uber.db.in b/bin/tests/system/masterformat/ns1/uber.db.in
new file mode 100644
index 0000000..5a81863
index 0000000000..5a818632a8
--- /dev/null
+++ b/bin/tests/system/masterformat/ns1/uber.db.in
@@ -0,0 +1,22 @@
@ -169,7 +169,7 @@ index 0000000..5a81863
+ NS ns
+ns A 10.53.0.1
diff --git a/bin/tests/system/masterformat/ns2/named.conf.in b/bin/tests/system/masterformat/ns2/named.conf.in
index c0f2987..df778bc 100644
index c0f2987318..df778bc64b 100644
--- a/bin/tests/system/masterformat/ns2/named.conf.in
+++ b/bin/tests/system/masterformat/ns2/named.conf.in
@@ -21,6 +21,7 @@ options {
@ -192,7 +192,7 @@ index c0f2987..df778bc 100644
+ file "huge.bk";
+};
diff --git a/bin/tests/system/masterformat/setup.sh b/bin/tests/system/masterformat/setup.sh
index f304242..57b8a24 100755
index f3042428bd..57b8a24952 100755
--- a/bin/tests/system/masterformat/setup.sh
+++ b/bin/tests/system/masterformat/setup.sh
@@ -24,8 +24,23 @@ cp ns1/example.db ns2/
@ -222,7 +222,7 @@ index f304242..57b8a24 100755
+}' </dev/null >>ns1/uber.db
cd ns1 && $SHELL compile.sh
diff --git a/bin/tests/system/masterformat/tests.sh b/bin/tests/system/masterformat/tests.sh
index 3a4eb3e..c3be164 100755
index 3a4eb3e116..c3be164d56 100755
--- a/bin/tests/system/masterformat/tests.sh
+++ b/bin/tests/system/masterformat/tests.sh
@@ -190,6 +190,66 @@ for i in 0 1 2 3 4 5 6 7 8 9; do
@ -294,7 +294,7 @@ index 3a4eb3e..c3be164 100755
sleep 1
diff --git a/bin/tests/system/reclimit/ns1/big.db b/bin/tests/system/reclimit/ns1/big.db
new file mode 100644
index 0000000..bddceb7
index 0000000000..bddceb76e7
--- /dev/null
+++ b/bin/tests/system/reclimit/ns1/big.db
@@ -0,0 +1,2515 @@
@ -2814,7 +2814,7 @@ index 0000000..bddceb7
+biganswer.big. 60 IN A 10.10.50.49
+biganswer.big. 60 IN A 10.10.50.50
diff --git a/bin/tests/system/reclimit/ns1/named.conf.in b/bin/tests/system/reclimit/ns1/named.conf.in
index 63cb706..c56c0db 100644
index 63cb706883..c56c0dbf55 100644
--- a/bin/tests/system/reclimit/ns1/named.conf.in
+++ b/bin/tests/system/reclimit/ns1/named.conf.in
@@ -22,6 +22,12 @@ options {
@ -2831,7 +2831,7 @@ index 63cb706..c56c0db 100644
+ file "big.db";
+};
diff --git a/bin/tests/system/reclimit/ns1/root.db b/bin/tests/system/reclimit/ns1/root.db
index 412715c..30e175b 100644
index 412715cc64..30e175b335 100644
--- a/bin/tests/system/reclimit/ns1/root.db
+++ b/bin/tests/system/reclimit/ns1/root.db
@@ -19,3 +19,6 @@ example.net. 60 IN NS direct.example.net.
@ -2843,7 +2843,7 @@ index 412715c..30e175b 100644
+ns.big. 60 IN A 10.53.0.1
diff --git a/bin/tests/system/reclimit/ns3/named5.conf.in b/bin/tests/system/reclimit/ns3/named5.conf.in
new file mode 100644
index 0000000..56f704a
index 0000000000..56f704a3c0
--- /dev/null
+++ b/bin/tests/system/reclimit/ns3/named5.conf.in
@@ -0,0 +1,42 @@
@ -2890,7 +2890,7 @@ index 0000000..56f704a
+
+zone "." { type hint; file "hints.db"; };
diff --git a/bin/tests/system/reclimit/tests.sh b/bin/tests/system/reclimit/tests.sh
index a203445..b332e38 100644
index a20344555b..b332e381ff 100644
--- a/bin/tests/system/reclimit/tests.sh
+++ b/bin/tests/system/reclimit/tests.sh
@@ -221,6 +221,16 @@ eval count=$(cat dig.out.3.test$n)
@ -2912,12 +2912,12 @@ index a203445..b332e38 100644
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
index b871972..e2341a6 100755
index 09fff0dd13..d9121d9ae5 100755
--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
@@ -607,7 +607,8 @@ sleep 1
# because of the order of the records in the cache
$DIG $DIGOPTS @10.53.0.5 fetchall.tld any >dig.out.3.${n} || ret=1
dig_with_opts @10.53.0.5 fetchall.tld any >dig.out.3.${n} || ret=1
ttl3=$(awk '/^fetchall.tld/ { print $2; exit }' dig.out.3.${n})
-test "${ttl3:-0}" -gt "${ttl2:-1}" || ret=1
+#test "${ttl3:-0}" -gt "${ttl2:-1}" || ret=1
@ -2926,5 +2926,5 @@ index b871972..e2341a6 100755
status=$((status + ret))
--
2.51.1
2.53.0

5413
bind-9.16-CVE-2024-1737-types-test.patch
View File

File diff suppressed because it is too large Load Diff

23
bind-9.16-CVE-2024-1737.patch
View File

@ -1,4 +1,4 @@
From 9b50e2c7385cad43d4c8e0310229d18230fdb510 Mon Sep 17 00:00:00 2001
From aed0e33be79d1d1b133208846d943503c4f2e6a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Fri, 1 Mar 2024 08:26:07 +0100
Subject: [PATCH] Add a limit to the number of RRs in RRSets
@ -83,16 +83,16 @@ smarter:
(cherry picked from commit 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120)
(cherry picked from commit 26c9da5f2857b72077c17e06ac79f068c63782cc)
---
bin/tests/system/resolver/tests.sh | 11 ++--
bin/tests/system/resolver/tests.sh | 9 ++--
configure | 2 +-
configure.ac | 2 +-
lib/dns/rbtdb.c | 83 +++++++++++++++++++++++++++++-
lib/dns/rdataslab.c | 12 +++++
lib/dns/zone.c | 13 -----
6 files changed, 101 insertions(+), 22 deletions(-)
6 files changed, 100 insertions(+), 21 deletions(-)
diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
index fc05635..b871972 100755
index fc05635e31..09fff0dd13 100755
--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
@@ -596,18 +596,17 @@ n=$((n + 1))
@ -112,15 +112,14 @@ index fc05635..b871972 100755
-# note that only one record is prefetched, which is the AAAA record in this case,
+# note that only the first record is prefetched,
# because of the order of the records in the cache
-dig_with_opts @10.53.0.5 fetchall.tld any >dig.out.3.${n} || ret=1
dig_with_opts @10.53.0.5 fetchall.tld any >dig.out.3.${n} || ret=1
-ttl3=$(awk '/::1/ { print $2 }' dig.out.3.${n})
+$DIG $DIGOPTS @10.53.0.5 fetchall.tld any >dig.out.3.${n} || ret=1
+ttl3=$(awk '/^fetchall.tld/ { print $2; exit }' dig.out.3.${n})
test "${ttl3:-0}" -gt "${ttl2:-1}" || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status + ret))
diff --git a/configure b/configure
index 1b436d6..835cd94 100755
index 1b436d63eb..835cd94dff 100755
--- a/configure
+++ b/configure
@@ -12341,7 +12341,7 @@ fi
@ -133,7 +132,7 @@ index 1b436d6..835cd94 100755
test "${enable_querytrace+set}" = set || enable_querytrace=yes
test "${with_cmocka+set}" = set || with_cmocka=yes
diff --git a/configure.ac b/configure.ac
index fb6f172..6db4250 100644
index fb6f172eae..6db42501a2 100644
--- a/configure.ac
+++ b/configure.ac
@@ -96,7 +96,7 @@ AC_ARG_ENABLE([developer],
@ -146,7 +145,7 @@ index fb6f172..6db4250 100644
test "${enable_querytrace+set}" = set || enable_querytrace=yes
test "${with_cmocka+set}" = set || with_cmocka=yes
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 3f06545..d4c1829 100644
index 3f06545aa1..d4c1829c26 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -990,6 +990,8 @@ prio_type(rbtdb_rdatatype_t type) {
@ -296,7 +295,7 @@ index 3f06545..d4c1829 100644
}
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
index 14c4381..d74e84c 100644
index 14c43818b8..d74e84ce4a 100644
--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
@@ -112,6 +112,10 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
@ -333,7 +332,7 @@ index 14c4381..d74e84c 100644
oncount = ncount;
#endif /* if DNS_RDATASET_FIXED */
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index b457095..53da95a 100644
index b457095907..53da95a7d7 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -2316,19 +2316,6 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
@ -357,5 +356,5 @@ index b457095..53da95a 100644
if (!dns_db_ispersistent(db)) {
if (zone->masterfile != NULL) {
--
2.51.1
2.53.0

52
bind-9.16-CVE-2025-40778.patch
View File

@ -1,4 +1,4 @@
From 27c807b45ad8479ff684c914953f34533c30e398 Mon Sep 17 00:00:00 2001
From 3f033e9822a08c02cb146c4e996ed6edfbea4636 Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Mon, 29 Sep 2025 21:46:59 -0700
Subject: [PATCH] Tighten restrictions on caching NS RRsets in authority
@ -39,14 +39,14 @@ ans3 and ans4 servers in the chain system test.
bin/tests/system/chain/ans4/ans.py | 57 ++++++--
lib/dns/include/dns/message.h | 8 ++
lib/dns/message.c | 12 ++
lib/dns/resolver.c | 114 ++++++++++++---
6 files changed, 377 insertions(+), 174 deletions(-)
lib/dns/resolver.c | 112 ++++++++++++---
6 files changed, 376 insertions(+), 173 deletions(-)
delete mode 100644 bin/tests/system/chain/ans3/ans.pl
create mode 100644 bin/tests/system/chain/ans3/ans.py
diff --git a/bin/tests/system/chain/ans3/ans.pl b/bin/tests/system/chain/ans3/ans.pl
deleted file mode 100644
index e42240b..0000000
index e42240be63..0000000000
--- a/bin/tests/system/chain/ans3/ans.pl
+++ /dev/null
@@ -1,143 +0,0 @@
@ -195,7 +195,7 @@ index e42240b..0000000
-}
diff --git a/bin/tests/system/chain/ans3/ans.py b/bin/tests/system/chain/ans3/ans.py
new file mode 100644
index 0000000..0a031c1
index 0000000000..0a031c1145
--- /dev/null
+++ b/bin/tests/system/chain/ans3/ans.py
@@ -0,0 +1,217 @@
@ -417,7 +417,7 @@ index 0000000..0a031c1
+ if not running:
+ break
diff --git a/bin/tests/system/chain/ans4/ans.py b/bin/tests/system/chain/ans4/ans.py
index 839067f..66f0193 100755
index 839067faa5..66f0193cac 100755
--- a/bin/tests/system/chain/ans4/ans.py
+++ b/bin/tests/system/chain/ans4/ans.py
@@ -316,16 +316,30 @@ try:
@ -509,7 +509,7 @@ index 839067f..66f0193 100755
if not running:
break
diff --git a/lib/dns/include/dns/message.h b/lib/dns/include/dns/message.h
index ea45742..f564e1e 100644
index ea45742439..f564e1e5ef 100644
--- a/lib/dns/include/dns/message.h
+++ b/lib/dns/include/dns/message.h
@@ -235,6 +235,7 @@ struct dns_message {
@ -533,7 +533,7 @@ index ea45742..f564e1e 100644
+
ISC_LANG_ENDDECLS
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 12331ab..f29033a 100644
index 22aa552f3f..c3f86fdbe0 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -442,6 +442,7 @@ msginit(dns_message_t *m) {
@ -556,7 +556,7 @@ index 12331ab..f29033a 100644
}
rdataset = NULL;
@@ -4770,3 +4776,9 @@ dns_message_clonebuffer(dns_message_t *msg) {
@@ -4857,3 +4863,9 @@ dns_message_clonebuffer(dns_message_t *msg) {
msg->free_query = 1;
}
}
@ -567,7 +567,7 @@ index 12331ab..f29033a 100644
+ return msg->has_dname;
+}
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 02809cc..36fe766 100644
index 0952624689..cf6a55163a 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -758,6 +758,7 @@ typedef struct respctx {
@ -578,7 +578,7 @@ index 02809cc..36fe766 100644
bool nextitem; /* invalid response; keep
* listening for the correct one */
bool truncated; /* response was truncated */
@@ -7163,7 +7164,8 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
@@ -7154,7 +7155,8 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
* locally served zone.
*/
static bool
@ -588,18 +588,16 @@ index 02809cc..36fe766 100644
isc_result_t result;
dns_forwarders_t *forwarders = NULL;
dns_fixedname_t fixed, zfixed;
@@ -7175,8 +7177,8 @@ name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
unsigned int labels;
@@ -7167,7 +7169,7 @@ name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
dns_namereln_t rel;
- apex = (ISDUALSTACK(fctx->addrinfo) || !ISFORWARDER(fctx->addrinfo))
apex = (ISDUALSTACK(fctx->addrinfo) || !ISFORWARDER(fctx->addrinfo))
- ? &fctx->domain
+ apex = (/*ISDUALSTACK(fctx->addrinfo) || */!ISFORWARDER(fctx->addrinfo))
+ ? rctx->ns_name != NULL ? rctx->ns_name : &fctx->domain
: fctx->fwdname;
/*
@@ -7285,7 +7287,7 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
@@ -7276,7 +7278,7 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
result = dns_message_findname(rctx->query->rmessage, section, addname,
dns_rdatatype_any, 0, &name, NULL);
if (result == ISC_R_SUCCESS) {
@ -608,7 +606,7 @@ index 02809cc..36fe766 100644
if (type == dns_rdatatype_a) {
for (rdataset = ISC_LIST_HEAD(name->list);
rdataset != NULL;
@@ -7897,6 +7899,47 @@ betterreferral(respctx_t *rctx) {
@@ -7888,6 +7890,47 @@ betterreferral(respctx_t *rctx) {
return (false);
}
@ -656,7 +654,7 @@ index 02809cc..36fe766 100644
/*
* resquery_response():
* Handles responses received in response to iterative queries sent by
@@ -8055,6 +8098,11 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
@@ -8046,6 +8089,11 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
break;
}
@ -668,7 +666,7 @@ index 02809cc..36fe766 100644
/*
* If the message is signed, check the signature. If not, this
* returns success anyway.
@@ -8072,9 +8120,16 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
@@ -8063,9 +8111,16 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
}
/*
@ -687,7 +685,7 @@ index 02809cc..36fe766 100644
/*
* INSIST() that the message comes from the place we sent it to,
* since the dispatch code should ensure this.
@@ -8088,10 +8143,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
@@ -8079,10 +8134,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
* This may be a misconfigured anycast server or an attempt to send
* a spoofed response. Skip if we have a valid tsig.
*/
@ -699,7 +697,7 @@ index 02809cc..36fe766 100644
unsigned char cookie[COOKIE_BUFFER_SIZE];
if (dns_adb_getcookie(fctx->adb, query->addrinfo, cookie,
sizeof(cookie)) > CLIENT_COOKIE_SIZE)
@@ -8117,6 +8169,17 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
@@ -8108,6 +8160,17 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
*/
}
@ -717,7 +715,7 @@ index 02809cc..36fe766 100644
rctx_edns(&rctx);
/*
@@ -8845,8 +8908,8 @@ rctx_answer_positive(respctx_t *rctx) {
@@ -8836,8 +8899,8 @@ rctx_answer_positive(respctx_t *rctx) {
}
/*
@ -728,7 +726,7 @@ index 02809cc..36fe766 100644
*/
rctx_authority_positive(rctx);
@@ -8918,7 +8981,7 @@ rctx_answer_scan(respctx_t *rctx) {
@@ -8909,7 +8972,7 @@ rctx_answer_scan(respctx_t *rctx) {
/*
* Don't accept DNAME from parent namespace.
*/
@ -737,7 +735,7 @@ index 02809cc..36fe766 100644
continue;
}
@@ -9217,14 +9280,14 @@ rctx_answer_dname(respctx_t *rctx) {
@@ -9208,14 +9271,14 @@ rctx_answer_dname(respctx_t *rctx) {
/*
* rctx_authority_positive():
@ -760,7 +758,7 @@ index 02809cc..36fe766 100644
*/
static void
rctx_authority_positive(respctx_t *rctx) {
@@ -9232,6 +9295,11 @@ rctx_authority_positive(respctx_t *rctx) {
@@ -9223,6 +9286,11 @@ rctx_authority_positive(respctx_t *rctx) {
bool done = false;
isc_result_t result;
@ -772,7 +770,7 @@ index 02809cc..36fe766 100644
result = dns_message_firstname(rctx->query->rmessage,
DNS_SECTION_AUTHORITY);
while (!done && result == ISC_R_SUCCESS) {
@@ -9240,7 +9308,9 @@ rctx_authority_positive(respctx_t *rctx) {
@@ -9231,7 +9299,9 @@ rctx_authority_positive(respctx_t *rctx) {
dns_message_currentname(rctx->query->rmessage,
DNS_SECTION_AUTHORITY, &name);
@ -784,5 +782,5 @@ index 02809cc..36fe766 100644
/*
--
2.52.0
2.53.0

38
bind-9.16-properly-process-extra-nameserver-lines.patch
View File

@ -1,38 +0,0 @@
diff --git a/CHANGES b/CHANGES
index 2b12128544..42c13c9dbd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+6173. [bug] Properly process extra "nameserver" lines in
+ resolv.conf otherwise the next line is not properly
+ processed. [GL #4066]
+
--- 9.16.23 released ---
5752. [bug] Fix an assertion failure caused by missing member zones
diff --git a/lib/irs/resconf.c b/lib/irs/resconf.c
index da6066db7b..775f4e86a4 100644
--- a/lib/irs/resconf.c
+++ b/lib/irs/resconf.c
@@ -286,10 +286,6 @@ resconf_parsenameserver(irs_resconf_t *conf, FILE *fp) {
int cp;
isc_result_t result;
- if (conf->numns == RESCONFMAXNAMESERVERS) {
- return (ISC_R_SUCCESS);
- }
-
cp = getword(fp, word, sizeof(word));
if (strlen(word) == 0U) {
return (ISC_R_UNEXPECTEDEND); /* Nothing on line. */
@@ -301,6 +297,10 @@ resconf_parsenameserver(irs_resconf_t *conf, FILE *fp) {
return (ISC_R_UNEXPECTEDTOKEN); /* Extra junk on line. */
}
+ if (conf->numns == RESCONFMAXNAMESERVERS) {
+ return (ISC_R_SUCCESS);
+ }
+
result = add_server(conf->mctx, word, &conf->nameservers);
if (result != ISC_R_SUCCESS) {
return (result);

16
bind-9.18-CVE-2024-11187-pre-test.patch
View File

@ -1,4 +1,4 @@
From 5ac5241d88de3a1df1ed5a1b35fa959b39223ab5 Mon Sep 17 00:00:00 2001
From 1e3d6c2862cb7911fdd01b9d69a8599b462b797c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
Date: Tue, 7 Jan 2025 15:22:40 +0100
Subject: [PATCH] Isolate using the -T noaa flag only for part of the resolver
@ -21,7 +21,7 @@ system test.
diff --git a/bin/tests/system/resolver/ns4/named.noaa b/bin/tests/system/resolver/ns4/named.noaa
deleted file mode 100644
index be78cc2..0000000
index be78cc2c94..0000000000
--- a/bin/tests/system/resolver/ns4/named.noaa
+++ /dev/null
@@ -1,12 +0,0 @@
@ -38,16 +38,16 @@ index be78cc2..0000000
-
-Add -T noaa.
diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
index e2341a6..6c8eba5 100755
index d9121d9ae5..29562c2db0 100755
--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
@@ -309,6 +309,10 @@ done
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status + ret))
+stop_server resolver ns4
+stop_server ns4
+touch ns4/named.noaa
+start_server --noclean --restart --port ${PORT} resolver ns4 || ret=1
+start_server --noclean --restart --port ${PORT} ns4 || ret=1
+
n=$((n + 1))
echo_i "RT21594 regression test check setup ($n)"
@ -56,13 +56,13 @@ index e2341a6..6c8eba5 100755
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status + ret))
+stop_server resolver ns4
+stop_server ns4
+rm ns4/named.noaa
+start_server --noclean --restart --port ${PORT} resolver ns4 || ret=1
+start_server --noclean --restart --port ${PORT} ns4 || ret=1
+
n=$((n + 1))
echo_i "check that replacement of additional data by a negative cache no data entry clears the additional RRSIGs ($n)"
ret=0
--
2.51.1
2.53.0

32
bind-9.18-fix-dig-hanging-issue.patch
View File

@ -1,8 +1,8 @@
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 7e88b6b63c..768c4e56da 100644
index ac7e1fb55b..d27c7979a0 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -1577,6 +1577,31 @@ check_if_done(void) {
@@ -1571,6 +1571,31 @@ check_if_done(void) {
}
}
@ -34,7 +34,7 @@ index 7e88b6b63c..768c4e56da 100644
/*%
* Clear out a query when we're done with it. WARNING: This routine
* WILL invalidate the query pointer.
@@ -2563,7 +2588,6 @@ setup_lookup(dig_lookup_t *lookup) {
@@ -2557,7 +2582,6 @@ setup_lookup(dig_lookup_t *lookup) {
query->waiting_senddone = false;
query->pending_free = false;
query->recv_made = false;
@ -42,7 +42,7 @@ index 7e88b6b63c..768c4e56da 100644
query->first_soa_rcvd = false;
query->second_rr_rcvd = false;
query->first_repeat_rcvd = false;
@@ -2663,6 +2687,7 @@ cancel_lookup(dig_lookup_t *lookup) {
@@ -2660,6 +2684,7 @@ cancel_lookup(dig_lookup_t *lookup) {
while (query != NULL) {
REQUIRE(DIG_VALID_QUERY(query));
next = ISC_LIST_NEXT(query, link);
@ -50,7 +50,7 @@ index 7e88b6b63c..768c4e56da 100644
if (query->sock != NULL) {
isc_socket_cancel(query->sock, global_task,
ISC_SOCKCANCEL_ALL);
@@ -2905,6 +2930,12 @@ send_udp(dig_query_t *query) {
@@ -2902,6 +2927,12 @@ send_udp(dig_query_t *query) {
return;
}
@ -63,7 +63,7 @@ index 7e88b6b63c..768c4e56da 100644
result = isc_socket_create(socketmgr,
isc_sockaddr_pf(&query->sockaddr),
isc_sockettype_udp, &query->sock);
@@ -3031,6 +3062,10 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
@@ -3028,6 +3059,10 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
clear_query(query);
}
}
@ -74,7 +74,7 @@ index 7e88b6b63c..768c4e56da 100644
UNLOCK_LOOKUP;
return;
}
@@ -3286,6 +3321,14 @@ connect_done(isc_task_t *task, isc_event_t *event) {
@@ -3283,6 +3318,14 @@ connect_done(isc_task_t *task, isc_event_t *event) {
query = sevent->ev_arg;
REQUIRE(DIG_VALID_QUERY(query));
@ -89,7 +89,7 @@ index 7e88b6b63c..768c4e56da 100644
INSIST(query->waiting_connect);
query->waiting_connect = false;
@@ -4002,6 +4045,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
@@ -4004,6 +4047,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
: "recursion not available",
query->servname);
clear_query(query);
@ -99,7 +99,7 @@ index 7e88b6b63c..768c4e56da 100644
check_next_lookup(l);
dns_message_detach(&msg);
isc_event_free(&event);
@@ -4126,7 +4172,12 @@ recv_done(isc_task_t *task, isc_event_t *event) {
@@ -4129,7 +4175,12 @@ recv_done(isc_task_t *task, isc_event_t *event) {
l->trace_root = false;
usesearch = false;
} else {
@ -112,7 +112,7 @@ index 7e88b6b63c..768c4e56da 100644
}
}
}
@@ -4305,6 +4356,7 @@ cancel_all(void) {
@@ -4309,6 +4360,7 @@ cancel_all(void) {
nq = ISC_LIST_NEXT(q, link);
debug("canceling pending query %p, belonging to %p", q,
current_lookup);
@ -120,7 +120,7 @@ index 7e88b6b63c..768c4e56da 100644
if (q->sock != NULL) {
isc_socket_cancel(q->sock, NULL,
ISC_SOCKCANCEL_ALL);
@@ -4317,6 +4369,7 @@ cancel_all(void) {
@@ -4322,6 +4374,7 @@ cancel_all(void) {
nq = ISC_LIST_NEXT(q, clink);
debug("canceling connecting query %p, belonging to %p",
q, current_lookup);
@ -129,10 +129,10 @@ index 7e88b6b63c..768c4e56da 100644
isc_socket_cancel(q->sock, NULL,
ISC_SOCKCANCEL_ALL);
diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h
index 9e6035255f..48c6262008 100644
index 8bf9613db3..d7eb49963c 100644
--- a/bin/dig/include/dig/dig.h
+++ b/bin/dig/include/dig/dig.h
@@ -166,9 +166,9 @@ struct dig_lookup {
@@ -168,9 +168,9 @@ struct dig_lookup {
struct dig_query {
unsigned int magic;
dig_lookup_t *lookup;
@ -145,12 +145,12 @@ index 9e6035255f..48c6262008 100644
uint32_t second_rr_serial;
uint32_t msg_count;
diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
index 22933c7f9d..4b0ed7db10 100644
index fd7b383608..13044f4102 100644
--- a/bin/tests/system/digdelv/tests.sh
+++ b/bin/tests/system/digdelv/tests.sh
@@ -1043,6 +1043,15 @@ if [ -x "$DIG" ] ; then
@@ -1040,6 +1040,15 @@ if [ -x "$DIG" ]; then
if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=$((status+ret))
status=$((status + ret))
+ # See [GL #3248] for more information
+ n=$((n+1))

2
bind.spec
View File

@ -146,8 +146,6 @@ Patch224: bind-9.16-CVE-2025-40780.patch
# https://gitlab.isc.org/isc-projects/bind9/commit/50479358efdf432d690415131b74b5df158a9d69
# https://gitlab.isc.org/isc-projects/bind9/commit/33a7db1fe964e55b76b4ac003ecc56cc67028bd9
Patch225: bind-9.16-CVE-2025-40778.patch
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7942
Patch226: bind-9.16-properly-process-extra-nameserver-lines.patch
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11329
Patch227: bind-9.20-robust-key-rollovers.patch
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6057