import bind-9.16.23-11.el9
This commit is contained in:
parent
8dc5c2990f
commit
f34d17d942
60
SOURCES/bind-9.16-CVE-2022-2795.patch
Normal file
60
SOURCES/bind-9.16-CVE-2022-2795.patch
Normal file
@ -0,0 +1,60 @@
|
|||||||
|
From bf2ea6d8525bfd96a84dad221ba9e004adb710a8 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
|
||||||
|
Date: Thu, 8 Sep 2022 11:11:30 +0200
|
||||||
|
Subject: [PATCH] Bound the amount of work performed for delegations
|
||||||
|
|
||||||
|
Limit the amount of database lookups that can be triggered in
|
||||||
|
fctx_getaddresses() (i.e. when determining the name server addresses to
|
||||||
|
query next) by setting a hard limit on the number of NS RRs processed
|
||||||
|
for any delegation encountered. Without any limit in place, named can
|
||||||
|
be forced to perform large amounts of database lookups per each query
|
||||||
|
received, which severely impacts resolver performance.
|
||||||
|
|
||||||
|
The limit used (20) is an arbitrary value that is considered to be big
|
||||||
|
enough for any sane DNS delegation.
|
||||||
|
|
||||||
|
(cherry picked from commit 3a44097fd6c6c260765b628cd1d2c9cb7efb0b2a)
|
||||||
|
---
|
||||||
|
lib/dns/resolver.c | 12 ++++++++++++
|
||||||
|
1 file changed, 12 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
|
||||||
|
index d2cf14bbc8..73a0ee9f77 100644
|
||||||
|
--- a/lib/dns/resolver.c
|
||||||
|
+++ b/lib/dns/resolver.c
|
||||||
|
@@ -195,6 +195,12 @@
|
||||||
|
*/
|
||||||
|
#define NS_FAIL_LIMIT 4
|
||||||
|
#define NS_RR_LIMIT 5
|
||||||
|
+/*
|
||||||
|
+ * IP address lookups are performed for at most NS_PROCESSING_LIMIT NS RRs in
|
||||||
|
+ * any NS RRset encountered, to avoid excessive resource use while processing
|
||||||
|
+ * large delegations.
|
||||||
|
+ */
|
||||||
|
+#define NS_PROCESSING_LIMIT 20
|
||||||
|
|
||||||
|
/* Number of hash buckets for zone counters */
|
||||||
|
#ifndef RES_DOMAIN_BUCKETS
|
||||||
|
@@ -3711,6 +3717,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
|
||||||
|
bool need_alternate = false;
|
||||||
|
bool all_spilled = true;
|
||||||
|
unsigned int no_addresses = 0;
|
||||||
|
+ unsigned int ns_processed = 0;
|
||||||
|
|
||||||
|
FCTXTRACE5("getaddresses", "fctx->depth=", fctx->depth);
|
||||||
|
|
||||||
|
@@ -3902,6 +3909,11 @@ normal_nses:
|
||||||
|
|
||||||
|
dns_rdata_reset(&rdata);
|
||||||
|
dns_rdata_freestruct(&ns);
|
||||||
|
+
|
||||||
|
+ if (++ns_processed >= NS_PROCESSING_LIMIT) {
|
||||||
|
+ result = ISC_R_NOMORE;
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
if (result != ISC_R_NOMORE) {
|
||||||
|
return (result);
|
||||||
|
--
|
||||||
|
2.37.3
|
||||||
|
|
116
SOURCES/bind-9.16-CVE-2022-3080.patch
Normal file
116
SOURCES/bind-9.16-CVE-2022-3080.patch
Normal file
@ -0,0 +1,116 @@
|
|||||||
|
From 3bcd32572504ac9b92e3c6ec1e2cee3df3b68309 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Mensik <pemensik@redhat.com>
|
||||||
|
Date: Tue, 20 Sep 2022 11:34:42 +0200
|
||||||
|
Subject: [PATCH 2/4] Fix CVE-2022-3080
|
||||||
|
|
||||||
|
5960. [security] Fix serve-stale crash that could happen when
|
||||||
|
stale-answer-client-timeout was set to 0 and there was
|
||||||
|
a stale CNAME in the cache for an incoming query.
|
||||||
|
(CVE-2022-3080) [GL #3517]
|
||||||
|
---
|
||||||
|
lib/ns/include/ns/query.h | 1 +
|
||||||
|
lib/ns/query.c | 42 ++++++++++++++++++++++++---------------
|
||||||
|
2 files changed, 27 insertions(+), 16 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/ns/include/ns/query.h b/lib/ns/include/ns/query.h
|
||||||
|
index 4d48cf6..34b3070 100644
|
||||||
|
--- a/lib/ns/include/ns/query.h
|
||||||
|
+++ b/lib/ns/include/ns/query.h
|
||||||
|
@@ -145,6 +145,7 @@ struct query_ctx {
|
||||||
|
bool authoritative; /* authoritative query? */
|
||||||
|
bool want_restart; /* CNAME chain or other
|
||||||
|
* restart needed */
|
||||||
|
+ bool refresh_rrset; /* stale RRset refresh needed */
|
||||||
|
bool need_wildcardproof; /* wildcard proof needed */
|
||||||
|
bool nxrewrite; /* negative answer from RPZ */
|
||||||
|
bool findcoveringnsec; /* lookup covering NSEC */
|
||||||
|
diff --git a/lib/ns/query.c b/lib/ns/query.c
|
||||||
|
index 249321c..a450cb7 100644
|
||||||
|
--- a/lib/ns/query.c
|
||||||
|
+++ b/lib/ns/query.c
|
||||||
|
@@ -5686,7 +5686,6 @@ query_lookup(query_ctx_t *qctx) {
|
||||||
|
bool dbfind_stale = false;
|
||||||
|
bool stale_timeout = false;
|
||||||
|
bool stale_found = false;
|
||||||
|
- bool refresh_rrset = false;
|
||||||
|
bool stale_refresh_window = false;
|
||||||
|
|
||||||
|
CCTRACE(ISC_LOG_DEBUG(3), "query_lookup");
|
||||||
|
@@ -5868,8 +5867,7 @@ query_lookup(query_ctx_t *qctx) {
|
||||||
|
"%s stale answer used, an attempt to "
|
||||||
|
"refresh the RRset will still be made",
|
||||||
|
namebuf);
|
||||||
|
- refresh_rrset = STALE(qctx->rdataset);
|
||||||
|
- qctx->client->nodetach = refresh_rrset;
|
||||||
|
+ qctx->refresh_rrset = STALE(qctx->rdataset);
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
/*
|
||||||
|
@@ -5907,17 +5905,6 @@ query_lookup(query_ctx_t *qctx) {
|
||||||
|
|
||||||
|
result = query_gotanswer(qctx, result);
|
||||||
|
|
||||||
|
- if (refresh_rrset) {
|
||||||
|
- /*
|
||||||
|
- * If we reached this point then it means that we have found a
|
||||||
|
- * stale RRset entry in cache and BIND is configured to allow
|
||||||
|
- * queries to be answered with stale data if no active RRset
|
||||||
|
- * is available, i.e. "stale-anwer-client-timeout 0". But, we
|
||||||
|
- * still need to refresh the RRset.
|
||||||
|
- */
|
||||||
|
- query_refresh_rrset(qctx);
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
cleanup:
|
||||||
|
return (result);
|
||||||
|
}
|
||||||
|
@@ -7737,11 +7724,14 @@ query_addanswer(query_ctx_t *qctx) {
|
||||||
|
|
||||||
|
/*
|
||||||
|
* On normal lookups, clear any rdatasets that were added on a
|
||||||
|
- * lookup due to stale-answer-client-timeout.
|
||||||
|
+ * lookup due to stale-answer-client-timeout. Do not clear if we
|
||||||
|
+ * are going to refresh the RRset, because the stale contents are
|
||||||
|
+ * prioritized.
|
||||||
|
*/
|
||||||
|
if (QUERY_STALEOK(&qctx->client->query) &&
|
||||||
|
- !QUERY_STALETIMEOUT(&qctx->client->query))
|
||||||
|
+ !QUERY_STALETIMEOUT(&qctx->client->query) && !qctx->refresh_rrset)
|
||||||
|
{
|
||||||
|
+ CCTRACE(ISC_LOG_DEBUG(3), "query_clear_stale");
|
||||||
|
query_clear_stale(qctx->client);
|
||||||
|
/*
|
||||||
|
* We can clear the attribute to prevent redundant clearing
|
||||||
|
@@ -11457,9 +11447,29 @@ ns_query_done(query_ctx_t *qctx) {
|
||||||
|
/*
|
||||||
|
* Client may have been detached after query_send(), so
|
||||||
|
* we test and store the flag state here, for safety.
|
||||||
|
+ * If we are refreshing the RRSet, we must not detach from the client
|
||||||
|
+ * in the query_send(), so we need to override the flag.
|
||||||
|
*/
|
||||||
|
+ if (qctx->refresh_rrset) {
|
||||||
|
+ qctx->client->nodetach = true;
|
||||||
|
+ }
|
||||||
|
nodetach = qctx->client->nodetach;
|
||||||
|
query_send(qctx->client);
|
||||||
|
+
|
||||||
|
+ if (qctx->refresh_rrset) {
|
||||||
|
+ /*
|
||||||
|
+ * If we reached this point then it means that we have found a
|
||||||
|
+ * stale RRset entry in cache and BIND is configured to allow
|
||||||
|
+ * queries to be answered with stale data if no active RRset
|
||||||
|
+ * is available, i.e. "stale-anwer-client-timeout 0". But, we
|
||||||
|
+ * still need to refresh the RRset. To prevent adding duplicate
|
||||||
|
+ * RRsets, clear the RRsets from the message before doing the
|
||||||
|
+ * refresh.
|
||||||
|
+ */
|
||||||
|
+ message_clearrdataset(qctx->client->message, 0);
|
||||||
|
+ query_refresh_rrset(qctx);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (!nodetach) {
|
||||||
|
qctx->detach_client = true;
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.37.3
|
||||||
|
|
240
SOURCES/bind-9.16-CVE-2022-3094-1.patch
Normal file
240
SOURCES/bind-9.16-CVE-2022-3094-1.patch
Normal file
@ -0,0 +1,240 @@
|
|||||||
|
From 18036bb3f435eaa20d60093738c61e5da42a6cfe Mon Sep 17 00:00:00 2001
|
||||||
|
From: Evan Hunt <each@isc.org>
|
||||||
|
Date: Thu, 1 Sep 2022 16:05:04 -0700
|
||||||
|
Subject: [PATCH] add an update quota
|
||||||
|
|
||||||
|
limit the number of simultaneous DNS UPDATE events that can be
|
||||||
|
processed by adding a quota for update and update forwarding.
|
||||||
|
this quota currently, arbitrarily, defaults to 100.
|
||||||
|
|
||||||
|
also add a statistics counter to record when the update quota
|
||||||
|
has been exceeded.
|
||||||
|
|
||||||
|
(cherry picked from commit 7c47254a140c3e9cf383cda73c7b6a55c4782826)
|
||||||
|
---
|
||||||
|
bin/named/bind9.xsl | 4 +++-
|
||||||
|
bin/named/bind9.xsl.h | 6 +++++-
|
||||||
|
bin/named/statschannel.c | 5 +++--
|
||||||
|
doc/arm/reference.rst | 5 +++++
|
||||||
|
lib/ns/include/ns/server.h | 1 +
|
||||||
|
lib/ns/include/ns/stats.h | 4 +++-
|
||||||
|
lib/ns/server.c | 2 ++
|
||||||
|
lib/ns/update.c | 37 ++++++++++++++++++++++++++++++++++++-
|
||||||
|
8 files changed, 58 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl
|
||||||
|
index 5078115..194625b 100644
|
||||||
|
--- a/bin/named/bind9.xsl
|
||||||
|
+++ b/bin/named/bind9.xsl
|
||||||
|
@@ -12,7 +12,9 @@
|
||||||
|
|
||||||
|
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
|
||||||
|
<xsl:output method="html" indent="yes" version="4.0"/>
|
||||||
|
- <xsl:template match="statistics[@version="3.11"]">
|
||||||
|
+ <!-- the version number **below** must match version in bin/named/statschannel.c -->
|
||||||
|
+ <!-- don't forget to update "/xml/v<STATS_XML_VERSION_MAJOR>" in the HTTP endpoints listed below -->
|
||||||
|
+ <xsl:template match="statistics[@version="3.11.1"]">
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
|
||||||
|
diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
|
||||||
|
index e30f7f5..b182742 100644
|
||||||
|
--- a/bin/named/bind9.xsl.h
|
||||||
|
+++ b/bin/named/bind9.xsl.h
|
||||||
|
@@ -20,7 +20,11 @@ static char xslmsg[] =
|
||||||
|
"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" "
|
||||||
|
"xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
|
||||||
|
" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
|
||||||
|
- " <xsl:template match=\"statistics[@version="3.11"]\">\n"
|
||||||
|
+ " <!-- the version number **below** must match version in "
|
||||||
|
+ "bin/named/statschannel.c -->\n"
|
||||||
|
+ " <!-- don't forget to update \"/xml/v<STATS_XML_VERSION_MAJOR>\" in "
|
||||||
|
+ "the HTTP endpoints listed below -->\n"
|
||||||
|
+ " <xsl:template match=\"statistics[@version="3.11.1"]\">\n"
|
||||||
|
" <html>\n"
|
||||||
|
" <head>\n"
|
||||||
|
" <script type=\"text/javascript\" "
|
||||||
|
diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
|
||||||
|
index 832ce93..7361ead 100644
|
||||||
|
--- a/bin/named/statschannel.c
|
||||||
|
+++ b/bin/named/statschannel.c
|
||||||
|
@@ -335,6 +335,7 @@ init_desc(void) {
|
||||||
|
SET_NSSTATDESC(reclimitdropped,
|
||||||
|
"queries dropped due to recursive client limit",
|
||||||
|
"RecLimitDropped");
|
||||||
|
+ SET_NSSTATDESC(updatequota, "Update quota exceeded", "UpdateQuota");
|
||||||
|
|
||||||
|
INSIST(i == ns_statscounter_max);
|
||||||
|
|
||||||
|
@@ -2007,7 +2008,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
|
||||||
|
"href=\"/bind9.xsl\""));
|
||||||
|
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
|
||||||
|
TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
|
||||||
|
- ISC_XMLCHAR "3.11"));
|
||||||
|
+ ISC_XMLCHAR "3.11.1"));
|
||||||
|
|
||||||
|
/* Set common fields for statistics dump */
|
||||||
|
dumparg.type = isc_statsformat_xml;
|
||||||
|
@@ -2876,7 +2877,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
|
||||||
|
/*
|
||||||
|
* These statistics are included no matter which URL we use.
|
||||||
|
*/
|
||||||
|
- obj = json_object_new_string("1.5");
|
||||||
|
+ obj = json_object_new_string("1.5.1");
|
||||||
|
CHECKMEM(obj);
|
||||||
|
json_object_object_add(bindstats, "json-stats-version", obj);
|
||||||
|
|
||||||
|
diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
|
||||||
|
index 2d05aec..25c20d7 100644
|
||||||
|
--- a/doc/arm/reference.rst
|
||||||
|
+++ b/doc/arm/reference.rst
|
||||||
|
@@ -6705,6 +6705,11 @@ Name Server Statistics Counters
|
||||||
|
``UpdateBadPrereq``
|
||||||
|
This indicates the number of dynamic updates rejected due to a prerequisite failure.
|
||||||
|
|
||||||
|
+``UpdateQuota``
|
||||||
|
+ This indicates the number of times a dynamic update or update
|
||||||
|
+ forwarding request was rejected because the number of pending
|
||||||
|
+ requests exceeded the update quota.
|
||||||
|
+
|
||||||
|
``RateDropped``
|
||||||
|
This indicates the number of responses dropped due to rate limits.
|
||||||
|
|
||||||
|
diff --git a/lib/ns/include/ns/server.h b/lib/ns/include/ns/server.h
|
||||||
|
index 6a1f345..0abb579 100644
|
||||||
|
--- a/lib/ns/include/ns/server.h
|
||||||
|
+++ b/lib/ns/include/ns/server.h
|
||||||
|
@@ -84,6 +84,7 @@ struct ns_server {
|
||||||
|
isc_quota_t recursionquota;
|
||||||
|
isc_quota_t tcpquota;
|
||||||
|
isc_quota_t xfroutquota;
|
||||||
|
+ isc_quota_t updquota;
|
||||||
|
|
||||||
|
/*% Test options and other configurables */
|
||||||
|
uint32_t options;
|
||||||
|
diff --git a/lib/ns/include/ns/stats.h b/lib/ns/include/ns/stats.h
|
||||||
|
index 3c08799..95b15d0 100644
|
||||||
|
--- a/lib/ns/include/ns/stats.h
|
||||||
|
+++ b/lib/ns/include/ns/stats.h
|
||||||
|
@@ -106,7 +106,9 @@ enum {
|
||||||
|
|
||||||
|
ns_statscounter_reclimitdropped = 66,
|
||||||
|
|
||||||
|
- ns_statscounter_max = 67,
|
||||||
|
+ ns_statscounter_updatequota = 67,
|
||||||
|
+
|
||||||
|
+ ns_statscounter_max = 68,
|
||||||
|
};
|
||||||
|
|
||||||
|
void
|
||||||
|
diff --git a/lib/ns/server.c b/lib/ns/server.c
|
||||||
|
index a970a28..540bc2e 100644
|
||||||
|
--- a/lib/ns/server.c
|
||||||
|
+++ b/lib/ns/server.c
|
||||||
|
@@ -52,6 +52,7 @@ ns_server_create(isc_mem_t *mctx, ns_matchview_t matchingview,
|
||||||
|
isc_quota_init(&sctx->xfroutquota, 10);
|
||||||
|
isc_quota_init(&sctx->tcpquota, 10);
|
||||||
|
isc_quota_init(&sctx->recursionquota, 100);
|
||||||
|
+ isc_quota_init(&sctx->updquota, 100);
|
||||||
|
|
||||||
|
CHECKFATAL(dns_tkeyctx_create(mctx, &sctx->tkeyctx));
|
||||||
|
|
||||||
|
@@ -131,6 +132,7 @@ ns_server_detach(ns_server_t **sctxp) {
|
||||||
|
isc_mem_put(sctx->mctx, altsecret, sizeof(*altsecret));
|
||||||
|
}
|
||||||
|
|
||||||
|
+ isc_quota_destroy(&sctx->updquota);
|
||||||
|
isc_quota_destroy(&sctx->recursionquota);
|
||||||
|
isc_quota_destroy(&sctx->tcpquota);
|
||||||
|
isc_quota_destroy(&sctx->xfroutquota);
|
||||||
|
diff --git a/lib/ns/update.c b/lib/ns/update.c
|
||||||
|
index 546b70a..1871438 100644
|
||||||
|
--- a/lib/ns/update.c
|
||||||
|
+++ b/lib/ns/update.c
|
||||||
|
@@ -1544,6 +1544,19 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
|
||||||
|
update_event_t *event = NULL;
|
||||||
|
isc_task_t *zonetask = NULL;
|
||||||
|
|
||||||
|
+ result = isc_quota_attach(&client->manager->sctx->updquota,
|
||||||
|
+ &(isc_quota_t *){ NULL });
|
||||||
|
+ if (result != ISC_R_SUCCESS) {
|
||||||
|
+ update_log(client, zone, LOGLEVEL_PROTOCOL,
|
||||||
|
+ "update failed: too many DNS UPDATEs queued (%s)",
|
||||||
|
+ isc_result_totext(result));
|
||||||
|
+ ns_stats_increment(client->manager->sctx->nsstats,
|
||||||
|
+ ns_statscounter_updatequota);
|
||||||
|
+ ns_client_drop(client, result);
|
||||||
|
+ isc_nmhandle_detach(&client->reqhandle);
|
||||||
|
+ return (DNS_R_DROP);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
event = (update_event_t *)isc_event_allocate(
|
||||||
|
client->mctx, client, DNS_EVENT_UPDATE, update_action, NULL,
|
||||||
|
sizeof(*event));
|
||||||
|
@@ -1676,12 +1689,18 @@ failure:
|
||||||
|
dns_zone_gettype(zone) == dns_zone_mirror);
|
||||||
|
inc_stats(client, zone, ns_statscounter_updaterej);
|
||||||
|
}
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* We failed without having sent an update event to the zone.
|
||||||
|
* We are still in the client task context, so we can
|
||||||
|
* simply give an error response without switching tasks.
|
||||||
|
*/
|
||||||
|
- respond(client, result);
|
||||||
|
+ if (result == DNS_R_DROP) {
|
||||||
|
+ ns_client_drop(client, result);
|
||||||
|
+ } else {
|
||||||
|
+ respond(client, result);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (zone != NULL) {
|
||||||
|
dns_zone_detach(&zone);
|
||||||
|
}
|
||||||
|
@@ -3489,6 +3508,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
|
||||||
|
|
||||||
|
respond(client, uev->result);
|
||||||
|
|
||||||
|
+ isc_quota_detach(&(isc_quota_t *){ &client->manager->sctx->updquota });
|
||||||
|
isc_event_free(&event);
|
||||||
|
isc_nmhandle_detach(&client->updatehandle);
|
||||||
|
}
|
||||||
|
@@ -3505,6 +3525,8 @@ forward_fail(isc_task_t *task, isc_event_t *event) {
|
||||||
|
INSIST(client->nupdates > 0);
|
||||||
|
client->nupdates--;
|
||||||
|
respond(client, DNS_R_SERVFAIL);
|
||||||
|
+
|
||||||
|
+ isc_quota_detach(&(isc_quota_t *){ &client->manager->sctx->updquota });
|
||||||
|
isc_event_free(&event);
|
||||||
|
isc_nmhandle_detach(&client->updatehandle);
|
||||||
|
}
|
||||||
|
@@ -3542,6 +3564,8 @@ forward_done(isc_task_t *task, isc_event_t *event) {
|
||||||
|
client->nupdates--;
|
||||||
|
ns_client_sendraw(client, uev->answer);
|
||||||
|
dns_message_detach(&uev->answer);
|
||||||
|
+
|
||||||
|
+ isc_quota_detach(&(isc_quota_t *){ &client->manager->sctx->updquota });
|
||||||
|
isc_event_free(&event);
|
||||||
|
isc_nmhandle_detach(&client->updatehandle);
|
||||||
|
}
|
||||||
|
@@ -3576,6 +3600,17 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
|
||||||
|
update_event_t *event = NULL;
|
||||||
|
isc_task_t *zonetask = NULL;
|
||||||
|
|
||||||
|
+ result = isc_quota_attach(&client->manager->sctx->updquota,
|
||||||
|
+ &(isc_quota_t *){ NULL });
|
||||||
|
+ if (result != ISC_R_SUCCESS) {
|
||||||
|
+ update_log(client, zone, LOGLEVEL_PROTOCOL,
|
||||||
|
+ "update failed: too many DNS UPDATEs queued (%s)",
|
||||||
|
+ isc_result_totext(result));
|
||||||
|
+ ns_stats_increment(client->manager->sctx->nsstats,
|
||||||
|
+ ns_statscounter_updatequota);
|
||||||
|
+ return (DNS_R_DROP);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
event = (update_event_t *)isc_event_allocate(
|
||||||
|
client->mctx, client, DNS_EVENT_UPDATE, forward_action, NULL,
|
||||||
|
sizeof(*event));
|
||||||
|
--
|
||||||
|
2.39.2
|
||||||
|
|
266
SOURCES/bind-9.16-CVE-2022-3094-2.patch
Normal file
266
SOURCES/bind-9.16-CVE-2022-3094-2.patch
Normal file
@ -0,0 +1,266 @@
|
|||||||
|
From 7fe2204a2e8952bf892e4a70fea2ef5167e1f509 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Evan Hunt <each@isc.org>
|
||||||
|
Date: Thu, 1 Sep 2022 16:22:46 -0700
|
||||||
|
Subject: [PATCH] add a configuration option for the update quota
|
||||||
|
|
||||||
|
add an "update-quota" option to configure the update quota.
|
||||||
|
|
||||||
|
(cherry picked from commit f57758a7303ad0034ff2ff08eaaf2ef899630f19)
|
||||||
|
---
|
||||||
|
bin/named/config.c | 1 +
|
||||||
|
bin/named/named.conf.rst | 9 +++++----
|
||||||
|
bin/named/server.c | 1 +
|
||||||
|
bin/tests/system/checkconf/good.conf | 1 +
|
||||||
|
doc/arm/reference.rst | 7 ++++++-
|
||||||
|
doc/man/named.conf.5in | 9 +++++----
|
||||||
|
doc/misc/master.zoneopt.rst | 2 +-
|
||||||
|
doc/misc/options | 1 +
|
||||||
|
doc/misc/options.active | 1 +
|
||||||
|
doc/misc/options.grammar.rst | 3 ++-
|
||||||
|
doc/misc/slave.zoneopt.rst | 2 +-
|
||||||
|
lib/isccfg/namedconf.c | 1 +
|
||||||
|
12 files changed, 26 insertions(+), 12 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/bin/named/config.c b/bin/named/config.c
|
||||||
|
index 5fedee84d9..494147015f 100644
|
||||||
|
--- a/bin/named/config.c
|
||||||
|
+++ b/bin/named/config.c
|
||||||
|
@@ -130,6 +130,7 @@ options {\n\
|
||||||
|
transfers-out 10;\n\
|
||||||
|
transfers-per-ns 2;\n\
|
||||||
|
trust-anchor-telemetry yes;\n\
|
||||||
|
+ update-quota 100;\n\
|
||||||
|
\n\
|
||||||
|
/* view */\n\
|
||||||
|
allow-new-zones no;\n\
|
||||||
|
diff --git a/bin/named/named.conf.rst b/bin/named/named.conf.rst
|
||||||
|
index 27eed5ca3e..4c9f9a7370 100644
|
||||||
|
--- a/bin/named/named.conf.rst
|
||||||
|
+++ b/bin/named/named.conf.rst
|
||||||
|
@@ -179,7 +179,7 @@ OPTIONS
|
||||||
|
answer-cookie boolean;
|
||||||
|
attach-cache string;
|
||||||
|
auth-nxdomain boolean; // default changed
|
||||||
|
- auto-dnssec ( allow | maintain | off );
|
||||||
|
+ auto-dnssec ( allow | maintain | off );// deprecated
|
||||||
|
automatic-interface-scan boolean;
|
||||||
|
avoid-v4-udp-ports { portrange; ... };
|
||||||
|
avoid-v6-udp-ports { portrange; ... };
|
||||||
|
@@ -446,6 +446,7 @@ OPTIONS
|
||||||
|
trust-anchor-telemetry boolean; // experimental
|
||||||
|
try-tcp-refresh boolean;
|
||||||
|
update-check-ksk boolean;
|
||||||
|
+ update-quota integer;
|
||||||
|
use-alt-transfer-source boolean;
|
||||||
|
use-v4-udp-ports { portrange; ... };
|
||||||
|
use-v6-udp-ports { portrange; ... };
|
||||||
|
@@ -584,7 +585,7 @@ VIEW
|
||||||
|
* ) ] [ dscp integer ];
|
||||||
|
attach-cache string;
|
||||||
|
auth-nxdomain boolean; // default changed
|
||||||
|
- auto-dnssec ( allow | maintain | off );
|
||||||
|
+ auto-dnssec ( allow | maintain | off );// deprecated
|
||||||
|
cache-file quoted_string;// deprecated
|
||||||
|
catalog-zones { zone string [ default-masters [ port integer ]
|
||||||
|
[ dscp integer ] { ( remote-servers | ipv4_address [ port
|
||||||
|
@@ -859,7 +860,7 @@ VIEW
|
||||||
|
integer | * ) ] [ dscp integer ];
|
||||||
|
alt-transfer-source-v6 ( ipv6_address | * ) [ port (
|
||||||
|
integer | * ) ] [ dscp integer ];
|
||||||
|
- auto-dnssec ( allow | maintain | off );
|
||||||
|
+ auto-dnssec ( allow | maintain | off );// deprecated
|
||||||
|
check-dup-records ( fail | warn | ignore );
|
||||||
|
check-integrity boolean;
|
||||||
|
check-mx ( fail | warn | ignore );
|
||||||
|
@@ -977,7 +978,7 @@ ZONE
|
||||||
|
] [ dscp integer ];
|
||||||
|
alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
|
||||||
|
* ) ] [ dscp integer ];
|
||||||
|
- auto-dnssec ( allow | maintain | off );
|
||||||
|
+ auto-dnssec ( allow | maintain | off );// deprecated
|
||||||
|
check-dup-records ( fail | warn | ignore );
|
||||||
|
check-integrity boolean;
|
||||||
|
check-mx ( fail | warn | ignore );
|
||||||
|
diff --git a/bin/named/server.c b/bin/named/server.c
|
||||||
|
index 20443ff8a9..78a21d62a2 100644
|
||||||
|
--- a/bin/named/server.c
|
||||||
|
+++ b/bin/named/server.c
|
||||||
|
@@ -8542,6 +8542,7 @@ load_configuration(const char *filename, named_server_t *server,
|
||||||
|
configure_server_quota(maps, "tcp-clients", &server->sctx->tcpquota);
|
||||||
|
configure_server_quota(maps, "recursive-clients",
|
||||||
|
&server->sctx->recursionquota);
|
||||||
|
+ configure_server_quota(maps, "update-quota", &server->sctx->updquota);
|
||||||
|
|
||||||
|
max = isc_quota_getmax(&server->sctx->recursionquota);
|
||||||
|
if (max > 1000) {
|
||||||
|
diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
|
||||||
|
index b1f7059acf..0ecdb68e95 100644
|
||||||
|
--- a/bin/tests/system/checkconf/good.conf
|
||||||
|
+++ b/bin/tests/system/checkconf/good.conf
|
||||||
|
@@ -75,6 +75,7 @@ options {
|
||||||
|
recursive-clients 3000;
|
||||||
|
serial-query-rate 100;
|
||||||
|
server-id none;
|
||||||
|
+ update-quota 200;
|
||||||
|
check-names primary warn;
|
||||||
|
check-names secondary ignore;
|
||||||
|
max-cache-size 20000000000000;
|
||||||
|
diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
|
||||||
|
index 2603d60251..703663d0ba 100644
|
||||||
|
--- a/doc/arm/reference.rst
|
||||||
|
+++ b/doc/arm/reference.rst
|
||||||
|
@@ -3151,6 +3151,11 @@ system.
|
||||||
|
value as ``tcp-keepalive-timeout``. This value can be updated at
|
||||||
|
runtime by using ``rndc tcp-timeouts``.
|
||||||
|
|
||||||
|
+``update-quota``
|
||||||
|
+ This is the maximum number of simultaneous DNS UPDATE messages that
|
||||||
|
+ the server will accept for updating local authoritiative zones or
|
||||||
|
+ forwarding to a primary server. The default is ``100``.
|
||||||
|
+
|
||||||
|
.. _intervals:
|
||||||
|
|
||||||
|
Periodic Task Intervals
|
||||||
|
@@ -6840,7 +6845,7 @@ Name Server Statistics Counters
|
||||||
|
``UpdateQuota``
|
||||||
|
This indicates the number of times a dynamic update or update
|
||||||
|
forwarding request was rejected because the number of pending
|
||||||
|
- requests exceeded the update quota.
|
||||||
|
+ requests exceeded ``update-quota``.
|
||||||
|
|
||||||
|
``RateDropped``
|
||||||
|
This indicates the number of responses dropped due to rate limits.
|
||||||
|
diff --git a/doc/man/named.conf.5in b/doc/man/named.conf.5in
|
||||||
|
index 4c46f47592..c87afa2881 100644
|
||||||
|
--- a/doc/man/named.conf.5in
|
||||||
|
+++ b/doc/man/named.conf.5in
|
||||||
|
@@ -231,7 +231,7 @@ options {
|
||||||
|
answer\-cookie boolean;
|
||||||
|
attach\-cache string;
|
||||||
|
auth\-nxdomain boolean; // default changed
|
||||||
|
- auto\-dnssec ( allow | maintain | off );
|
||||||
|
+ auto\-dnssec ( allow | maintain | off );// deprecated
|
||||||
|
automatic\-interface\-scan boolean;
|
||||||
|
avoid\-v4\-udp\-ports { portrange; ... };
|
||||||
|
avoid\-v6\-udp\-ports { portrange; ... };
|
||||||
|
@@ -498,6 +498,7 @@ options {
|
||||||
|
trust\-anchor\-telemetry boolean; // experimental
|
||||||
|
try\-tcp\-refresh boolean;
|
||||||
|
update\-check\-ksk boolean;
|
||||||
|
+ update\-quota integer;
|
||||||
|
use\-alt\-transfer\-source boolean;
|
||||||
|
use\-v4\-udp\-ports { portrange; ... };
|
||||||
|
use\-v6\-udp\-ports { portrange; ... };
|
||||||
|
@@ -668,7 +669,7 @@ view string [ class ] {
|
||||||
|
* ) ] [ dscp integer ];
|
||||||
|
attach\-cache string;
|
||||||
|
auth\-nxdomain boolean; // default changed
|
||||||
|
- auto\-dnssec ( allow | maintain | off );
|
||||||
|
+ auto\-dnssec ( allow | maintain | off );// deprecated
|
||||||
|
cache\-file quoted_string;// deprecated
|
||||||
|
catalog\-zones { zone string [ default\-masters [ port integer ]
|
||||||
|
[ dscp integer ] { ( remote\-servers | ipv4_address [ port
|
||||||
|
@@ -943,7 +944,7 @@ view string [ class ] {
|
||||||
|
integer | * ) ] [ dscp integer ];
|
||||||
|
alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port (
|
||||||
|
integer | * ) ] [ dscp integer ];
|
||||||
|
- auto\-dnssec ( allow | maintain | off );
|
||||||
|
+ auto\-dnssec ( allow | maintain | off );// deprecated
|
||||||
|
check\-dup\-records ( fail | warn | ignore );
|
||||||
|
check\-integrity boolean;
|
||||||
|
check\-mx ( fail | warn | ignore );
|
||||||
|
@@ -1065,7 +1066,7 @@ zone string [ class ] {
|
||||||
|
] [ dscp integer ];
|
||||||
|
alt\-transfer\-source\-v6 ( ipv6_address | * ) [ port ( integer |
|
||||||
|
* ) ] [ dscp integer ];
|
||||||
|
- auto\-dnssec ( allow | maintain | off );
|
||||||
|
+ auto\-dnssec ( allow | maintain | off );// deprecated
|
||||||
|
check\-dup\-records ( fail | warn | ignore );
|
||||||
|
check\-integrity boolean;
|
||||||
|
check\-mx ( fail | warn | ignore );
|
||||||
|
diff --git a/doc/misc/master.zoneopt.rst b/doc/misc/master.zoneopt.rst
|
||||||
|
index 8fc7e1b4f0..346d59813e 100644
|
||||||
|
--- a/doc/misc/master.zoneopt.rst
|
||||||
|
+++ b/doc/misc/master.zoneopt.rst
|
||||||
|
@@ -20,7 +20,7 @@
|
||||||
|
also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
|
||||||
|
alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
|
||||||
|
alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
|
||||||
|
- auto-dnssec ( allow | maintain | off );
|
||||||
|
+ auto-dnssec ( allow | maintain | off ); // deprecated
|
||||||
|
check-dup-records ( fail | warn | ignore );
|
||||||
|
check-integrity <boolean>;
|
||||||
|
check-mx ( fail | warn | ignore );
|
||||||
|
diff --git a/doc/misc/options b/doc/misc/options
|
||||||
|
index f57399499a..0dbcf101e1 100644
|
||||||
|
--- a/doc/misc/options
|
||||||
|
+++ b/doc/misc/options
|
||||||
|
@@ -404,6 +404,7 @@ options {
|
||||||
|
trust-anchor-telemetry <boolean>; // experimental
|
||||||
|
try-tcp-refresh <boolean>;
|
||||||
|
update-check-ksk <boolean>;
|
||||||
|
+ update-quota <integer>;
|
||||||
|
use-alt-transfer-source <boolean>;
|
||||||
|
use-id-pool <boolean>; // ancient
|
||||||
|
use-ixfr <boolean>; // obsolete
|
||||||
|
diff --git a/doc/misc/options.active b/doc/misc/options.active
|
||||||
|
index 5fc1ab29f4..eb75a86eae 100644
|
||||||
|
--- a/doc/misc/options.active
|
||||||
|
+++ b/doc/misc/options.active
|
||||||
|
@@ -363,6 +363,7 @@ options {
|
||||||
|
trust-anchor-telemetry <boolean>; // experimental
|
||||||
|
try-tcp-refresh <boolean>;
|
||||||
|
update-check-ksk <boolean>;
|
||||||
|
+ update-quota <integer>;
|
||||||
|
use-alt-transfer-source <boolean>;
|
||||||
|
use-v4-udp-ports { <portrange>; ... };
|
||||||
|
use-v6-udp-ports { <portrange>; ... };
|
||||||
|
diff --git a/doc/misc/options.grammar.rst b/doc/misc/options.grammar.rst
|
||||||
|
index 438072c95c..beef35341a 100644
|
||||||
|
--- a/doc/misc/options.grammar.rst
|
||||||
|
+++ b/doc/misc/options.grammar.rst
|
||||||
|
@@ -33,7 +33,7 @@
|
||||||
|
answer-cookie <boolean>;
|
||||||
|
attach-cache <string>;
|
||||||
|
auth-nxdomain <boolean>; // default changed
|
||||||
|
- auto-dnssec ( allow | maintain | off );
|
||||||
|
+ auto-dnssec ( allow | maintain | off ); // deprecated
|
||||||
|
automatic-interface-scan <boolean>;
|
||||||
|
avoid-v4-udp-ports { <portrange>; ... };
|
||||||
|
avoid-v6-udp-ports { <portrange>; ... };
|
||||||
|
@@ -300,6 +300,7 @@
|
||||||
|
trust-anchor-telemetry <boolean>; // experimental
|
||||||
|
try-tcp-refresh <boolean>;
|
||||||
|
update-check-ksk <boolean>;
|
||||||
|
+ update-quota <integer>;
|
||||||
|
use-alt-transfer-source <boolean>;
|
||||||
|
use-v4-udp-ports { <portrange>; ... };
|
||||||
|
use-v6-udp-ports { <portrange>; ... };
|
||||||
|
diff --git a/doc/misc/slave.zoneopt.rst b/doc/misc/slave.zoneopt.rst
|
||||||
|
index cc72dcbf67..468a7f4d9a 100644
|
||||||
|
--- a/doc/misc/slave.zoneopt.rst
|
||||||
|
+++ b/doc/misc/slave.zoneopt.rst
|
||||||
|
@@ -21,7 +21,7 @@
|
||||||
|
also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
|
||||||
|
alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
|
||||||
|
alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
|
||||||
|
- auto-dnssec ( allow | maintain | off );
|
||||||
|
+ auto-dnssec ( allow | maintain | off ); // deprecated
|
||||||
|
check-names ( fail | warn | ignore );
|
||||||
|
database <string>;
|
||||||
|
dialup ( notify | notify-passive | passive | refresh | <boolean> );
|
||||||
|
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
|
||||||
|
index 45de0196bf..6e63d86816 100644
|
||||||
|
--- a/lib/isccfg/namedconf.c
|
||||||
|
+++ b/lib/isccfg/namedconf.c
|
||||||
|
@@ -1267,6 +1267,7 @@ static cfg_clausedef_t options_clauses[] = {
|
||||||
|
{ "transfers-out", &cfg_type_uint32, 0 },
|
||||||
|
{ "transfers-per-ns", &cfg_type_uint32, 0 },
|
||||||
|
{ "treat-cr-as-space", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
|
||||||
|
+ { "update-quota", &cfg_type_uint32, 0 },
|
||||||
|
{ "use-id-pool", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
|
||||||
|
{ "use-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
|
||||||
|
{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
|
||||||
|
--
|
||||||
|
2.39.1
|
||||||
|
|
470
SOURCES/bind-9.16-CVE-2022-3094-3.patch
Normal file
470
SOURCES/bind-9.16-CVE-2022-3094-3.patch
Normal file
@ -0,0 +1,470 @@
|
|||||||
|
From 93b8bd39145566053ad8b22cef597146e9175ea4 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Evan Hunt <each@isc.org>
|
||||||
|
Date: Tue, 8 Nov 2022 17:32:41 -0800
|
||||||
|
Subject: [PATCH] move update ACL and update-policy checks before quota
|
||||||
|
|
||||||
|
check allow-update, update-policy, and allow-update-forwarding before
|
||||||
|
consuming quota slots, so that unauthorized clients can't fill the
|
||||||
|
quota.
|
||||||
|
|
||||||
|
(this moves the access check before the prerequisite check, which
|
||||||
|
violates the precise wording of RFC 2136. however, RFC co-author Paul
|
||||||
|
Vixie has stated that the RFC is mistaken on this point; it should have
|
||||||
|
said that access checking must happen *no later than* the completion of
|
||||||
|
prerequisite checks, not that it must happen exactly then.)
|
||||||
|
|
||||||
|
(cherry picked from commit 964f559edb5036880b8e463b8f190b9007ee055d)
|
||||||
|
---
|
||||||
|
lib/ns/update.c | 335 ++++++++++++++++++++++++++----------------------
|
||||||
|
1 file changed, 181 insertions(+), 154 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/ns/update.c b/lib/ns/update.c
|
||||||
|
index 9a8c309..036184b 100644
|
||||||
|
--- a/lib/ns/update.c
|
||||||
|
+++ b/lib/ns/update.c
|
||||||
|
@@ -261,6 +261,9 @@ static void
|
||||||
|
forward_done(isc_task_t *task, isc_event_t *event);
|
||||||
|
static isc_result_t
|
||||||
|
add_rr_prepare_action(void *data, rr_t *rr);
|
||||||
|
+static isc_result_t
|
||||||
|
+rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
|
||||||
|
+ const dns_rdata_t *rdata, bool *flag);
|
||||||
|
|
||||||
|
/**************************************************************************/
|
||||||
|
|
||||||
|
@@ -333,25 +336,26 @@ inc_stats(ns_client_t *client, dns_zone_t *zone, isc_statscounter_t counter) {
|
||||||
|
static isc_result_t
|
||||||
|
checkqueryacl(ns_client_t *client, dns_acl_t *queryacl, dns_name_t *zonename,
|
||||||
|
dns_acl_t *updateacl, dns_ssutable_t *ssutable) {
|
||||||
|
+ isc_result_t result;
|
||||||
|
char namebuf[DNS_NAME_FORMATSIZE];
|
||||||
|
char classbuf[DNS_RDATACLASS_FORMATSIZE];
|
||||||
|
- int level;
|
||||||
|
- isc_result_t result;
|
||||||
|
+ bool update_possible =
|
||||||
|
+ ((updateacl != NULL && !dns_acl_isnone(updateacl)) ||
|
||||||
|
+ ssutable != NULL);
|
||||||
|
|
||||||
|
result = ns_client_checkaclsilent(client, NULL, queryacl, true);
|
||||||
|
if (result != ISC_R_SUCCESS) {
|
||||||
|
+ int level = update_possible ? ISC_LOG_ERROR : ISC_LOG_INFO;
|
||||||
|
+
|
||||||
|
dns_name_format(zonename, namebuf, sizeof(namebuf));
|
||||||
|
dns_rdataclass_format(client->view->rdclass, classbuf,
|
||||||
|
sizeof(classbuf));
|
||||||
|
|
||||||
|
- level = (updateacl == NULL && ssutable == NULL) ? ISC_LOG_INFO
|
||||||
|
- : ISC_LOG_ERROR;
|
||||||
|
-
|
||||||
|
ns_client_log(client, NS_LOGCATEGORY_UPDATE_SECURITY,
|
||||||
|
NS_LOGMODULE_UPDATE, level,
|
||||||
|
"update '%s/%s' denied due to allow-query",
|
||||||
|
namebuf, classbuf);
|
||||||
|
- } else if (updateacl == NULL && ssutable == NULL) {
|
||||||
|
+ } else if (!update_possible) {
|
||||||
|
dns_name_format(zonename, namebuf, sizeof(namebuf));
|
||||||
|
dns_rdataclass_format(client->view->rdclass, classbuf,
|
||||||
|
sizeof(classbuf));
|
||||||
|
@@ -1543,6 +1547,156 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
|
||||||
|
isc_result_t result = ISC_R_SUCCESS;
|
||||||
|
update_event_t *event = NULL;
|
||||||
|
isc_task_t *zonetask = NULL;
|
||||||
|
+ dns_ssutable_t *ssutable = NULL;
|
||||||
|
+ dns_message_t *request = client->message;
|
||||||
|
+ dns_aclenv_t *env =
|
||||||
|
+ ns_interfacemgr_getaclenv(client->manager->interface->mgr);
|
||||||
|
+ dns_rdataclass_t zoneclass;
|
||||||
|
+ dns_rdatatype_t covers;
|
||||||
|
+ dns_name_t *zonename = NULL;
|
||||||
|
+ dns_db_t *db = NULL;
|
||||||
|
+ dns_dbversion_t *ver = NULL;
|
||||||
|
+
|
||||||
|
+ CHECK(dns_zone_getdb(zone, &db));
|
||||||
|
+ zonename = dns_db_origin(db);
|
||||||
|
+ zoneclass = dns_db_class(db);
|
||||||
|
+ dns_zone_getssutable(zone, &ssutable);
|
||||||
|
+ dns_db_currentversion(db, &ver);
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * Update message processing can leak record existence information
|
||||||
|
+ * so check that we are allowed to query this zone. Additionally,
|
||||||
|
+ * if we would refuse all updates for this zone, we bail out here.
|
||||||
|
+ */
|
||||||
|
+ CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone),
|
||||||
|
+ dns_zone_getorigin(zone),
|
||||||
|
+ dns_zone_getupdateacl(zone), ssutable));
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * Check requestor's permissions.
|
||||||
|
+ */
|
||||||
|
+ if (ssutable == NULL) {
|
||||||
|
+ CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
|
||||||
|
+ "update", dns_zone_getorigin(zone), false,
|
||||||
|
+ false));
|
||||||
|
+ } else if (client->signer == NULL && !TCPCLIENT(client)) {
|
||||||
|
+ CHECK(checkupdateacl(client, NULL, "update",
|
||||||
|
+ dns_zone_getorigin(zone), false, true));
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (dns_zone_getupdatedisabled(zone)) {
|
||||||
|
+ FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
|
||||||
|
+ "because the zone is frozen. Use "
|
||||||
|
+ "'rndc thaw' to re-enable updates.");
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * Prescan the update section, checking for updates that
|
||||||
|
+ * are illegal or violate policy.
|
||||||
|
+ */
|
||||||
|
+ for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
|
||||||
|
+ result == ISC_R_SUCCESS;
|
||||||
|
+ result = dns_message_nextname(request, DNS_SECTION_UPDATE))
|
||||||
|
+ {
|
||||||
|
+ dns_name_t *name = NULL;
|
||||||
|
+ dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||||
|
+ dns_ttl_t ttl;
|
||||||
|
+ dns_rdataclass_t update_class;
|
||||||
|
+
|
||||||
|
+ get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
|
||||||
|
+ &rdata, &covers, &ttl, &update_class);
|
||||||
|
+
|
||||||
|
+ if (!dns_name_issubdomain(name, zonename)) {
|
||||||
|
+ FAILC(DNS_R_NOTZONE, "update RR is outside zone");
|
||||||
|
+ }
|
||||||
|
+ if (update_class == zoneclass) {
|
||||||
|
+ /*
|
||||||
|
+ * Check for meta-RRs. The RFC2136 pseudocode says
|
||||||
|
+ * check for ANY|AXFR|MAILA|MAILB, but the text adds
|
||||||
|
+ * "or any other QUERY metatype"
|
||||||
|
+ */
|
||||||
|
+ if (dns_rdatatype_ismeta(rdata.type)) {
|
||||||
|
+ FAILC(DNS_R_FORMERR, "meta-RR in update");
|
||||||
|
+ }
|
||||||
|
+ result = dns_zone_checknames(zone, name, &rdata);
|
||||||
|
+ if (result != ISC_R_SUCCESS) {
|
||||||
|
+ FAIL(DNS_R_REFUSED);
|
||||||
|
+ }
|
||||||
|
+ } else if (update_class == dns_rdataclass_any) {
|
||||||
|
+ if (ttl != 0 || rdata.length != 0 ||
|
||||||
|
+ (dns_rdatatype_ismeta(rdata.type) &&
|
||||||
|
+ rdata.type != dns_rdatatype_any))
|
||||||
|
+ {
|
||||||
|
+ FAILC(DNS_R_FORMERR, "meta-RR in update");
|
||||||
|
+ }
|
||||||
|
+ } else if (update_class == dns_rdataclass_none) {
|
||||||
|
+ if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
|
||||||
|
+ FAILC(DNS_R_FORMERR, "meta-RR in update");
|
||||||
|
+ }
|
||||||
|
+ } else {
|
||||||
|
+ update_log(client, zone, ISC_LOG_WARNING,
|
||||||
|
+ "update RR has incorrect class %d",
|
||||||
|
+ update_class);
|
||||||
|
+ FAIL(DNS_R_FORMERR);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * draft-ietf-dnsind-simple-secure-update-01 says
|
||||||
|
+ * "Unlike traditional dynamic update, the client
|
||||||
|
+ * is forbidden from updating NSEC records."
|
||||||
|
+ */
|
||||||
|
+ if (rdata.type == dns_rdatatype_nsec3) {
|
||||||
|
+ FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
|
||||||
|
+ "allowed "
|
||||||
|
+ "in secure zones");
|
||||||
|
+ } else if (rdata.type == dns_rdatatype_nsec) {
|
||||||
|
+ FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
|
||||||
|
+ "allowed "
|
||||||
|
+ "in secure zones");
|
||||||
|
+ } else if (rdata.type == dns_rdatatype_rrsig &&
|
||||||
|
+ !dns_name_equal(name, zonename))
|
||||||
|
+ {
|
||||||
|
+ FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
|
||||||
|
+ "currently "
|
||||||
|
+ "not supported in secure zones "
|
||||||
|
+ "except "
|
||||||
|
+ "at the apex");
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (ssutable != NULL) {
|
||||||
|
+ isc_netaddr_t netaddr;
|
||||||
|
+ dst_key_t *tsigkey = NULL;
|
||||||
|
+ isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
|
||||||
|
+
|
||||||
|
+ if (client->message->tsigkey != NULL) {
|
||||||
|
+ tsigkey = client->message->tsigkey->key;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (rdata.type != dns_rdatatype_any) {
|
||||||
|
+ if (!dns_ssutable_checkrules(
|
||||||
|
+ ssutable, client->signer, name,
|
||||||
|
+ &netaddr, TCPCLIENT(client), env,
|
||||||
|
+ rdata.type, tsigkey))
|
||||||
|
+ {
|
||||||
|
+ FAILC(DNS_R_REFUSED, "rejected by "
|
||||||
|
+ "secure update");
|
||||||
|
+ }
|
||||||
|
+ } else {
|
||||||
|
+ if (!ssu_checkall(db, ver, name, ssutable,
|
||||||
|
+ client->signer, &netaddr, env,
|
||||||
|
+ TCPCLIENT(client), tsigkey))
|
||||||
|
+ {
|
||||||
|
+ FAILC(DNS_R_REFUSED, "rejected by "
|
||||||
|
+ "secure update");
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ if (result != ISC_R_NOMORE) {
|
||||||
|
+ FAIL(result);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
|
||||||
|
|
||||||
|
result = isc_quota_attach(&client->manager->sctx->updquota,
|
||||||
|
&(isc_quota_t *){ NULL });
|
||||||
|
@@ -1552,9 +1706,7 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
|
||||||
|
isc_result_totext(result));
|
||||||
|
ns_stats_increment(client->manager->sctx->nsstats,
|
||||||
|
ns_statscounter_updatequota);
|
||||||
|
- ns_client_drop(client, result);
|
||||||
|
- isc_nmhandle_detach(&client->reqhandle);
|
||||||
|
- return (DNS_R_DROP);
|
||||||
|
+ CHECK(DNS_R_DROP);
|
||||||
|
}
|
||||||
|
|
||||||
|
event = (update_event_t *)isc_event_allocate(
|
||||||
|
@@ -1571,6 +1723,16 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
|
||||||
|
dns_zone_gettask(zone, &zonetask);
|
||||||
|
isc_task_send(zonetask, ISC_EVENT_PTR(&event));
|
||||||
|
|
||||||
|
+failure:
|
||||||
|
+ if (db != NULL) {
|
||||||
|
+ dns_db_closeversion(db, &ver, false);
|
||||||
|
+ dns_db_detach(&db);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (ssutable != NULL) {
|
||||||
|
+ dns_ssutable_detach(&ssutable);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
return (result);
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -1671,9 +1833,6 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
|
||||||
|
break;
|
||||||
|
case dns_zone_secondary:
|
||||||
|
case dns_zone_mirror:
|
||||||
|
- CHECK(checkupdateacl(client, dns_zone_getforwardacl(zone),
|
||||||
|
- "update forwarding", zonename, true,
|
||||||
|
- false));
|
||||||
|
CHECK(send_forward_event(client, zone));
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
@@ -1685,8 +1844,6 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
|
||||||
|
|
||||||
|
failure:
|
||||||
|
if (result == DNS_R_REFUSED) {
|
||||||
|
- INSIST(dns_zone_gettype(zone) == dns_zone_secondary ||
|
||||||
|
- dns_zone_gettype(zone) == dns_zone_mirror);
|
||||||
|
inc_stats(client, zone, ns_statscounter_updaterej);
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -2578,7 +2735,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
|
||||||
|
dns_rdatatype_t covers;
|
||||||
|
dns_message_t *request = client->message;
|
||||||
|
dns_rdataclass_t zoneclass;
|
||||||
|
- dns_name_t *zonename;
|
||||||
|
+ dns_name_t *zonename = NULL;
|
||||||
|
dns_ssutable_t *ssutable = NULL;
|
||||||
|
dns_fixedname_t tmpnamefixed;
|
||||||
|
dns_name_t *tmpname = NULL;
|
||||||
|
@@ -2590,8 +2747,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
|
||||||
|
dns_ttl_t maxttl = 0;
|
||||||
|
uint32_t maxrecords;
|
||||||
|
uint64_t records;
|
||||||
|
- dns_aclenv_t *env =
|
||||||
|
- ns_interfacemgr_getaclenv(client->manager->interface->mgr);
|
||||||
|
|
||||||
|
INSIST(event->ev_type == DNS_EVENT_UPDATE);
|
||||||
|
|
||||||
|
@@ -2602,14 +2757,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
|
||||||
|
zonename = dns_db_origin(db);
|
||||||
|
zoneclass = dns_db_class(db);
|
||||||
|
dns_zone_getssutable(zone, &ssutable);
|
||||||
|
-
|
||||||
|
- /*
|
||||||
|
- * Update message processing can leak record existence information
|
||||||
|
- * so check that we are allowed to query this zone. Additionally
|
||||||
|
- * if we would refuse all updates for this zone we bail out here.
|
||||||
|
- */
|
||||||
|
- CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone), zonename,
|
||||||
|
- dns_zone_getupdateacl(zone), ssutable));
|
||||||
|
+ options = dns_zone_getoptions(zone);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Get old and new versions now that queryacl has been checked.
|
||||||
|
@@ -2745,135 +2893,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
|
||||||
|
|
||||||
|
update_log(client, zone, LOGLEVEL_DEBUG, "prerequisites are OK");
|
||||||
|
|
||||||
|
- /*
|
||||||
|
- * Check Requestor's Permissions. It seems a bit silly to do this
|
||||||
|
- * only after prerequisite testing, but that is what RFC2136 says.
|
||||||
|
- */
|
||||||
|
- if (ssutable == NULL) {
|
||||||
|
- CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
|
||||||
|
- "update", zonename, false, false));
|
||||||
|
- } else if (client->signer == NULL && !TCPCLIENT(client)) {
|
||||||
|
- CHECK(checkupdateacl(client, NULL, "update", zonename, false,
|
||||||
|
- true));
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- if (dns_zone_getupdatedisabled(zone)) {
|
||||||
|
- FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
|
||||||
|
- "because the zone is frozen. Use "
|
||||||
|
- "'rndc thaw' to re-enable updates.");
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- /*
|
||||||
|
- * Perform the Update Section Prescan.
|
||||||
|
- */
|
||||||
|
-
|
||||||
|
- for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
|
||||||
|
- result == ISC_R_SUCCESS;
|
||||||
|
- result = dns_message_nextname(request, DNS_SECTION_UPDATE))
|
||||||
|
- {
|
||||||
|
- dns_name_t *name = NULL;
|
||||||
|
- dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||||
|
- dns_ttl_t ttl;
|
||||||
|
- dns_rdataclass_t update_class;
|
||||||
|
- get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
|
||||||
|
- &rdata, &covers, &ttl, &update_class);
|
||||||
|
-
|
||||||
|
- if (!dns_name_issubdomain(name, zonename)) {
|
||||||
|
- FAILC(DNS_R_NOTZONE, "update RR is outside zone");
|
||||||
|
- }
|
||||||
|
- if (update_class == zoneclass) {
|
||||||
|
- /*
|
||||||
|
- * Check for meta-RRs. The RFC2136 pseudocode says
|
||||||
|
- * check for ANY|AXFR|MAILA|MAILB, but the text adds
|
||||||
|
- * "or any other QUERY metatype"
|
||||||
|
- */
|
||||||
|
- if (dns_rdatatype_ismeta(rdata.type)) {
|
||||||
|
- FAILC(DNS_R_FORMERR, "meta-RR in update");
|
||||||
|
- }
|
||||||
|
- result = dns_zone_checknames(zone, name, &rdata);
|
||||||
|
- if (result != ISC_R_SUCCESS) {
|
||||||
|
- FAIL(DNS_R_REFUSED);
|
||||||
|
- }
|
||||||
|
- } else if (update_class == dns_rdataclass_any) {
|
||||||
|
- if (ttl != 0 || rdata.length != 0 ||
|
||||||
|
- (dns_rdatatype_ismeta(rdata.type) &&
|
||||||
|
- rdata.type != dns_rdatatype_any))
|
||||||
|
- {
|
||||||
|
- FAILC(DNS_R_FORMERR, "meta-RR in update");
|
||||||
|
- }
|
||||||
|
- } else if (update_class == dns_rdataclass_none) {
|
||||||
|
- if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
|
||||||
|
- FAILC(DNS_R_FORMERR, "meta-RR in update");
|
||||||
|
- }
|
||||||
|
- } else {
|
||||||
|
- update_log(client, zone, ISC_LOG_WARNING,
|
||||||
|
- "update RR has incorrect class %d",
|
||||||
|
- update_class);
|
||||||
|
- FAIL(DNS_R_FORMERR);
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- /*
|
||||||
|
- * draft-ietf-dnsind-simple-secure-update-01 says
|
||||||
|
- * "Unlike traditional dynamic update, the client
|
||||||
|
- * is forbidden from updating NSEC records."
|
||||||
|
- */
|
||||||
|
- if (rdata.type == dns_rdatatype_nsec3) {
|
||||||
|
- FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
|
||||||
|
- "allowed "
|
||||||
|
- "in secure zones");
|
||||||
|
- } else if (rdata.type == dns_rdatatype_nsec) {
|
||||||
|
- FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
|
||||||
|
- "allowed "
|
||||||
|
- "in secure zones");
|
||||||
|
- } else if (rdata.type == dns_rdatatype_rrsig &&
|
||||||
|
- !dns_name_equal(name, zonename)) {
|
||||||
|
- FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
|
||||||
|
- "currently "
|
||||||
|
- "not supported in secure zones "
|
||||||
|
- "except "
|
||||||
|
- "at the apex");
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- if (ssutable != NULL) {
|
||||||
|
- isc_netaddr_t netaddr;
|
||||||
|
- dst_key_t *tsigkey = NULL;
|
||||||
|
- isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
|
||||||
|
-
|
||||||
|
- if (client->message->tsigkey != NULL) {
|
||||||
|
- tsigkey = client->message->tsigkey->key;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- if (rdata.type != dns_rdatatype_any) {
|
||||||
|
- if (!dns_ssutable_checkrules(
|
||||||
|
- ssutable, client->signer, name,
|
||||||
|
- &netaddr, TCPCLIENT(client), env,
|
||||||
|
- rdata.type, tsigkey))
|
||||||
|
- {
|
||||||
|
- FAILC(DNS_R_REFUSED, "rejected by "
|
||||||
|
- "secure update");
|
||||||
|
- }
|
||||||
|
- } else {
|
||||||
|
- if (!ssu_checkall(db, ver, name, ssutable,
|
||||||
|
- client->signer, &netaddr, env,
|
||||||
|
- TCPCLIENT(client), tsigkey))
|
||||||
|
- {
|
||||||
|
- FAILC(DNS_R_REFUSED, "rejected by "
|
||||||
|
- "secure update");
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
- if (result != ISC_R_NOMORE) {
|
||||||
|
- FAIL(result);
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
|
||||||
|
-
|
||||||
|
/*
|
||||||
|
* Process the Update Section.
|
||||||
|
*/
|
||||||
|
|
||||||
|
- options = dns_zone_getoptions(zone);
|
||||||
|
for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
|
||||||
|
result == ISC_R_SUCCESS;
|
||||||
|
result = dns_message_nextname(request, DNS_SECTION_UPDATE))
|
||||||
|
@@ -3307,10 +3330,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
|
||||||
|
if (result == ISC_R_SUCCESS && records > maxrecords) {
|
||||||
|
update_log(client, zone, ISC_LOG_ERROR,
|
||||||
|
"records in zone (%" PRIu64 ") "
|
||||||
|
- "exceeds"
|
||||||
|
- " max-"
|
||||||
|
- "records"
|
||||||
|
- " (%u)",
|
||||||
|
+ "exceeds max-records (%u)",
|
||||||
|
records, maxrecords);
|
||||||
|
result = DNS_R_TOOMANYRECORDS;
|
||||||
|
goto failure;
|
||||||
|
@@ -3601,6 +3621,13 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
|
||||||
|
update_event_t *event = NULL;
|
||||||
|
isc_task_t *zonetask = NULL;
|
||||||
|
|
||||||
|
+ result = checkupdateacl(client, dns_zone_getforwardacl(zone),
|
||||||
|
+ "update forwarding", dns_zone_getorigin(zone),
|
||||||
|
+ true, false);
|
||||||
|
+ if (result != ISC_R_SUCCESS) {
|
||||||
|
+ return (result);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
result = isc_quota_attach(&client->manager->sctx->updquota,
|
||||||
|
&(isc_quota_t *){ NULL });
|
||||||
|
if (result != ISC_R_SUCCESS) {
|
||||||
|
--
|
||||||
|
2.39.1
|
||||||
|
|
272
SOURCES/bind-9.16-CVE-2022-3094-test.patch
Normal file
272
SOURCES/bind-9.16-CVE-2022-3094-test.patch
Normal file
@ -0,0 +1,272 @@
|
|||||||
|
From 54e281c11ee13eabc3c51d6391a58fc90836000c Mon Sep 17 00:00:00 2001
|
||||||
|
From: Evan Hunt <each@isc.org>
|
||||||
|
Date: Wed, 9 Nov 2022 21:56:16 -0800
|
||||||
|
Subject: [PATCH] test failure conditions
|
||||||
|
|
||||||
|
verify that updates are refused when the client is disallowed by
|
||||||
|
allow-query, and update forwarding is refused when the client is
|
||||||
|
is disallowed by update-forwarding.
|
||||||
|
|
||||||
|
verify that "too many DNS UPDATEs" appears in the log file when too
|
||||||
|
many simultaneous updates are processing.
|
||||||
|
|
||||||
|
(cherry picked from commit b91339b80e5b82a56622c93cc1e3cca2d0c11bc0)
|
||||||
|
---
|
||||||
|
bin/tests/system/nsupdate/ns1/named.conf.in | 2 +
|
||||||
|
bin/tests/system/nsupdate/tests.sh | 28 +++++++++++++
|
||||||
|
bin/tests/system/upforwd/clean.sh | 2 +
|
||||||
|
.../ns3/{named.conf.in => named1.conf.in} | 13 ++++--
|
||||||
|
bin/tests/system/upforwd/ns3/named2.conf.in | 41 +++++++++++++++++++
|
||||||
|
bin/tests/system/upforwd/setup.sh | 2 +-
|
||||||
|
bin/tests/system/upforwd/tests.sh | 39 ++++++++++++++++++
|
||||||
|
7 files changed, 123 insertions(+), 4 deletions(-)
|
||||||
|
rename bin/tests/system/upforwd/ns3/{named.conf.in => named1.conf.in} (78%)
|
||||||
|
create mode 100644 bin/tests/system/upforwd/ns3/named2.conf.in
|
||||||
|
|
||||||
|
diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
|
||||||
|
index 436c97d..83fe884 100644
|
||||||
|
--- a/bin/tests/system/nsupdate/ns1/named.conf.in
|
||||||
|
+++ b/bin/tests/system/nsupdate/ns1/named.conf.in
|
||||||
|
@@ -21,6 +21,7 @@ options {
|
||||||
|
recursion no;
|
||||||
|
notify yes;
|
||||||
|
minimal-responses no;
|
||||||
|
+ update-quota 1;
|
||||||
|
};
|
||||||
|
|
||||||
|
acl named-acl {
|
||||||
|
@@ -81,6 +82,7 @@ zone "other.nil" {
|
||||||
|
check-integrity no;
|
||||||
|
check-mx warn;
|
||||||
|
update-policy local;
|
||||||
|
+ allow-query { !10.53.0.2; any; };
|
||||||
|
allow-query-on { 10.53.0.1; 127.0.0.1; };
|
||||||
|
allow-transfer { any; };
|
||||||
|
};
|
||||||
|
diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
|
||||||
|
index b5f562f..13ba577 100755
|
||||||
|
--- a/bin/tests/system/nsupdate/tests.sh
|
||||||
|
+++ b/bin/tests/system/nsupdate/tests.sh
|
||||||
|
@@ -1268,6 +1268,34 @@ END
|
||||||
|
grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n >/dev/null || ret=1
|
||||||
|
[ $ret = 0 ] || { echo_i "failed"; status=1; }
|
||||||
|
|
||||||
|
+n=$((n + 1))
|
||||||
|
+ret=0
|
||||||
|
+echo_i "check that update is rejected if query is not allowed ($n)"
|
||||||
|
+{
|
||||||
|
+ $NSUPDATE -d <<END
|
||||||
|
+ local 10.53.0.2
|
||||||
|
+ server 10.53.0.1 ${PORT}
|
||||||
|
+ update add reject.other.nil 3600 IN TXT Whatever
|
||||||
|
+ send
|
||||||
|
+END
|
||||||
|
+} > nsupdate.out.test$n 2>&1
|
||||||
|
+grep 'failed: REFUSED' nsupdate.out.test$n > /dev/null || ret=1
|
||||||
|
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
|
||||||
|
+
|
||||||
|
+n=$((n + 1))
|
||||||
|
+ret=0
|
||||||
|
+echo_i "check that update is rejected if quota is exceeded ($n)"
|
||||||
|
+for loop in 1 2 3 4 5 6 7 8 9 10; do
|
||||||
|
+{
|
||||||
|
+ $NSUPDATE -4 -l -p ${PORT} -k ns1/session.key > /dev/null 2>&1 <<END
|
||||||
|
+ update add txt-$loop.other.nil 3600 IN TXT Whatever
|
||||||
|
+ send
|
||||||
|
+END
|
||||||
|
+} &
|
||||||
|
+done
|
||||||
|
+wait_for_log 10 "too many DNS UPDATEs queued" ns1/named.run || ret=1
|
||||||
|
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
|
||||||
|
+
|
||||||
|
if ! $FEATURETEST --gssapi ; then
|
||||||
|
echo_i "SKIPPED: GSSAPI tests"
|
||||||
|
else
|
||||||
|
diff --git a/bin/tests/system/upforwd/clean.sh b/bin/tests/system/upforwd/clean.sh
|
||||||
|
index 2025252..12311df 100644
|
||||||
|
--- a/bin/tests/system/upforwd/clean.sh
|
||||||
|
+++ b/bin/tests/system/upforwd/clean.sh
|
||||||
|
@@ -29,3 +29,5 @@ rm -f keyname keyname.err
|
||||||
|
rm -f ns*/named.lock
|
||||||
|
rm -f ns1/example2.db
|
||||||
|
rm -f ns*/managed-keys.bind*
|
||||||
|
+rm -f nsupdate.out.*
|
||||||
|
+rm -f ns*/named.run.prev
|
||||||
|
diff --git a/bin/tests/system/upforwd/ns3/named.conf.in b/bin/tests/system/upforwd/ns3/named1.conf.in
|
||||||
|
similarity index 78%
|
||||||
|
rename from bin/tests/system/upforwd/ns3/named.conf.in
|
||||||
|
rename to bin/tests/system/upforwd/ns3/named1.conf.in
|
||||||
|
index 7bd13d3..2f690ff 100644
|
||||||
|
--- a/bin/tests/system/upforwd/ns3/named.conf.in
|
||||||
|
+++ b/bin/tests/system/upforwd/ns3/named1.conf.in
|
||||||
|
@@ -28,20 +28,27 @@ key rndc_key {
|
||||||
|
};
|
||||||
|
|
||||||
|
controls {
|
||||||
|
- inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
||||||
|
+ inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
||||||
|
};
|
||||||
|
|
||||||
|
zone "example" {
|
||||||
|
type secondary;
|
||||||
|
file "example.bk";
|
||||||
|
- allow-update-forwarding { any; };
|
||||||
|
+ allow-update-forwarding { 10.53.0.1; };
|
||||||
|
primaries { 10.53.0.1; };
|
||||||
|
};
|
||||||
|
|
||||||
|
zone "example2" {
|
||||||
|
type secondary;
|
||||||
|
file "example2.bk";
|
||||||
|
- allow-update-forwarding { any; };
|
||||||
|
+ allow-update-forwarding { 10.53.0.1; };
|
||||||
|
+ primaries { 10.53.0.1; };
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+zone "example3" {
|
||||||
|
+ type secondary;
|
||||||
|
+ file "example3.bk";
|
||||||
|
+ allow-update-forwarding { 10.53.0.1; };
|
||||||
|
primaries { 10.53.0.1; };
|
||||||
|
};
|
||||||
|
|
||||||
|
diff --git a/bin/tests/system/upforwd/ns3/named2.conf.in b/bin/tests/system/upforwd/ns3/named2.conf.in
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000..e15459a
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/bin/tests/system/upforwd/ns3/named2.conf.in
|
||||||
|
@@ -0,0 +1,41 @@
|
||||||
|
+/*
|
||||||
|
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||||
|
+ *
|
||||||
|
+ * SPDX-License-Identifier: MPL-2.0
|
||||||
|
+ *
|
||||||
|
+ * This Source Code Form is subject to the terms of the Mozilla Public
|
||||||
|
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||||
|
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||||
|
+ *
|
||||||
|
+ * See the COPYRIGHT file distributed with this work for additional
|
||||||
|
+ * information regarding copyright ownership.
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
+options {
|
||||||
|
+ query-source address 10.53.0.3;
|
||||||
|
+ notify-source 10.53.0.3;
|
||||||
|
+ transfer-source 10.53.0.3;
|
||||||
|
+ port @PORT@;
|
||||||
|
+ pid-file "named.pid";
|
||||||
|
+ listen-on { 10.53.0.3; };
|
||||||
|
+ listen-on-v6 { none; };
|
||||||
|
+ recursion no;
|
||||||
|
+ notify yes;
|
||||||
|
+ update-quota 1;
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+key rndc_key {
|
||||||
|
+ secret "1234abcd8765";
|
||||||
|
+ algorithm hmac-sha256;
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+controls {
|
||||||
|
+ inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+zone "example" {
|
||||||
|
+ type secondary;
|
||||||
|
+ file "example.bk";
|
||||||
|
+ allow-update-forwarding { any; };
|
||||||
|
+ primaries { 10.53.0.1; };
|
||||||
|
+};
|
||||||
|
diff --git a/bin/tests/system/upforwd/setup.sh b/bin/tests/system/upforwd/setup.sh
|
||||||
|
index e748078..88ab28d 100644
|
||||||
|
--- a/bin/tests/system/upforwd/setup.sh
|
||||||
|
+++ b/bin/tests/system/upforwd/setup.sh
|
||||||
|
@@ -17,7 +17,7 @@ cp -f ns3/nomaster.db ns3/nomaster1.db
|
||||||
|
|
||||||
|
copy_setports ns1/named.conf.in ns1/named.conf
|
||||||
|
copy_setports ns2/named.conf.in ns2/named.conf
|
||||||
|
-copy_setports ns3/named.conf.in ns3/named.conf
|
||||||
|
+copy_setports ns3/named1.conf.in ns3/named.conf
|
||||||
|
|
||||||
|
if $FEATURETEST --enable-dnstap
|
||||||
|
then
|
||||||
|
diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
|
||||||
|
index 8062d68..20fc46f 100644
|
||||||
|
--- a/bin/tests/system/upforwd/tests.sh
|
||||||
|
+++ b/bin/tests/system/upforwd/tests.sh
|
||||||
|
@@ -80,6 +80,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
|
||||||
|
echo_i "updating zone (signed) ($n)"
|
||||||
|
ret=0
|
||||||
|
$NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
|
||||||
|
+local 10.53.0.1
|
||||||
|
server 10.53.0.3 ${PORT}
|
||||||
|
update add updated.example. 600 A 10.10.10.1
|
||||||
|
update add updated.example. 600 TXT Foo
|
||||||
|
@@ -138,6 +139,7 @@ fi
|
||||||
|
echo_i "updating zone (unsigned) ($n)"
|
||||||
|
ret=0
|
||||||
|
$NSUPDATE -- - <<EOF || ret=1
|
||||||
|
+local 10.53.0.1
|
||||||
|
server 10.53.0.3 ${PORT}
|
||||||
|
update add unsigned.example. 600 A 10.10.10.1
|
||||||
|
update add unsigned.example. 600 TXT Foo
|
||||||
|
@@ -194,6 +196,7 @@ while [ $count -lt 5 -a $ret -eq 0 ]
|
||||||
|
do
|
||||||
|
(
|
||||||
|
$NSUPDATE -- - <<EOF
|
||||||
|
+local 10.53.0.1
|
||||||
|
server 10.53.0.3 ${PORT}
|
||||||
|
zone nomaster
|
||||||
|
update add unsigned.nomaster. 600 A 10.10.10.1
|
||||||
|
@@ -225,6 +228,7 @@ then
|
||||||
|
ret=0
|
||||||
|
keyname=`cat keyname`
|
||||||
|
$NSUPDATE -k $keyname.private -- - <<EOF
|
||||||
|
+ local 10.53.0.1
|
||||||
|
server 10.53.0.3 ${PORT}
|
||||||
|
zone example2
|
||||||
|
update add unsigned.example2. 600 A 10.10.10.1
|
||||||
|
@@ -249,5 +253,40 @@ EOF
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
+echo_i "attempting an update that should be rejected by ACL ($n)"
|
||||||
|
+ret=0
|
||||||
|
+{
|
||||||
|
+ $NSUPDATE -- - << EOF
|
||||||
|
+ local 10.53.0.2
|
||||||
|
+ server 10.53.0.3 ${PORT}
|
||||||
|
+ update add another.unsigned.example. 600 A 10.10.10.2
|
||||||
|
+ update add another.unsigned.example. 600 TXT Bar
|
||||||
|
+ send
|
||||||
|
+EOF
|
||||||
|
+} > nsupdate.out.$n 2>&1
|
||||||
|
+grep REFUSED nsupdate.out.$n > /dev/null || ret=1
|
||||||
|
+if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
|
||||||
|
+n=`expr $n + 1`
|
||||||
|
+
|
||||||
|
+n=$((n + 1))
|
||||||
|
+ret=0
|
||||||
|
+echo_i "attempting updates that should exceed quota ($n)"
|
||||||
|
+# lower the update quota to 1.
|
||||||
|
+copy_setports ns3/named2.conf.in ns3/named.conf
|
||||||
|
+rndc_reconfig ns3 10.53.0.3
|
||||||
|
+nextpart ns3/named.run > /dev/null
|
||||||
|
+for loop in 1 2 3 4 5 6 7 8 9 10; do
|
||||||
|
+{
|
||||||
|
+ $NSUPDATE -- - > /dev/null 2>&1 <<END
|
||||||
|
+ local 10.53.0.1
|
||||||
|
+ server 10.53.0.3 ${PORT}
|
||||||
|
+ update add txt-$loop.unsigned.example 300 IN TXT Whatever
|
||||||
|
+ send
|
||||||
|
+END
|
||||||
|
+} &
|
||||||
|
+done
|
||||||
|
+wait_for_log 10 "too many DNS UPDATEs queued" ns3/named.run || ret=1
|
||||||
|
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
|
||||||
|
+
|
||||||
|
echo_i "exit status: $status"
|
||||||
|
[ $status -eq 0 ] || exit 1
|
||||||
|
--
|
||||||
|
2.39.2
|
||||||
|
|
53
SOURCES/bind-9.16-CVE-2022-3736.patch
Normal file
53
SOURCES/bind-9.16-CVE-2022-3736.patch
Normal file
@ -0,0 +1,53 @@
|
|||||||
|
From 1b6590eafce064cbf70f5afc2fe4d6f1bfdc3804 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Mark Andrews <marka@isc.org>
|
||||||
|
Date: Thu, 27 Oct 2022 13:22:11 +1100
|
||||||
|
Subject: [PATCH] Move the mapping of SIG and RRSIG to ANY
|
||||||
|
|
||||||
|
dns_db_findext() asserts if RRSIG is passed to it and
|
||||||
|
query_lookup_stale() failed to map RRSIG to ANY to prevent this. To
|
||||||
|
avoid cases like this in the future, move the mapping of SIG and RRSIG
|
||||||
|
to ANY for qctx->type to qctx_init().
|
||||||
|
|
||||||
|
(cherry picked from commit 56eae064183488bcf7ff08c3edf59f2e1742c1b6)
|
||||||
|
---
|
||||||
|
lib/ns/query.c | 17 +++++++++--------
|
||||||
|
1 file changed, 9 insertions(+), 8 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/ns/query.c b/lib/ns/query.c
|
||||||
|
index a450cb7..f66bab4 100644
|
||||||
|
--- a/lib/ns/query.c
|
||||||
|
+++ b/lib/ns/query.c
|
||||||
|
@@ -5103,6 +5103,15 @@ qctx_init(ns_client_t *client, dns_fetchevent_t **eventp, dns_rdatatype_t qtype,
|
||||||
|
qctx->result = ISC_R_SUCCESS;
|
||||||
|
qctx->findcoveringnsec = qctx->view->synthfromdnssec;
|
||||||
|
|
||||||
|
+ /*
|
||||||
|
+ * If it's an RRSIG or SIG query, we'll iterate the node.
|
||||||
|
+ */
|
||||||
|
+ if (qctx->qtype == dns_rdatatype_rrsig ||
|
||||||
|
+ qctx->qtype == dns_rdatatype_sig)
|
||||||
|
+ {
|
||||||
|
+ qctx->type = dns_rdatatype_any;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
CALL_HOOK_NORETURN(NS_QUERY_QCTX_INITIALIZED, qctx);
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -5243,14 +5252,6 @@ query_setup(ns_client_t *client, dns_rdatatype_t qtype) {
|
||||||
|
|
||||||
|
CALL_HOOK(NS_QUERY_SETUP, &qctx);
|
||||||
|
|
||||||
|
- /*
|
||||||
|
- * If it's a SIG query, we'll iterate the node.
|
||||||
|
- */
|
||||||
|
- if (qctx.qtype == dns_rdatatype_rrsig ||
|
||||||
|
- qctx.qtype == dns_rdatatype_sig) {
|
||||||
|
- qctx.type = dns_rdatatype_any;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
/*
|
||||||
|
* Check SERVFAIL cache
|
||||||
|
*/
|
||||||
|
--
|
||||||
|
2.39.1
|
||||||
|
|
27
SOURCES/bind-9.16-CVE-2022-38177.patch
Normal file
27
SOURCES/bind-9.16-CVE-2022-38177.patch
Normal file
@ -0,0 +1,27 @@
|
|||||||
|
From df8222fb189708199a185f73543b6e0602c1c72f Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Mensik <pemensik@redhat.com>
|
||||||
|
Date: Tue, 20 Sep 2022 11:21:45 +0200
|
||||||
|
Subject: [PATCH 3/4] Fix CVE-2022-38177
|
||||||
|
|
||||||
|
5961. [security] Fix memory leak in ECDSA verify processing.
|
||||||
|
(CVE-2022-38177) [GL #3487]
|
||||||
|
---
|
||||||
|
lib/dns/opensslecdsa_link.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
|
||||||
|
index ce4c8c4..3847896 100644
|
||||||
|
--- a/lib/dns/opensslecdsa_link.c
|
||||||
|
+++ b/lib/dns/opensslecdsa_link.c
|
||||||
|
@@ -228,7 +228,7 @@ opensslecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
|
||||||
|
}
|
||||||
|
|
||||||
|
if (sig->length != siglen) {
|
||||||
|
- return (DST_R_VERIFYFAILURE);
|
||||||
|
+ DST_RET(DST_R_VERIFYFAILURE);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!EVP_DigestFinal_ex(evp_md_ctx, digest, &dgstlen)) {
|
||||||
|
--
|
||||||
|
2.37.3
|
||||||
|
|
32
SOURCES/bind-9.16-CVE-2022-38178.patch
Normal file
32
SOURCES/bind-9.16-CVE-2022-38178.patch
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
From 132ef295b8407f91e6922f4dfc4f30f1790b61c5 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Mensik <pemensik@redhat.com>
|
||||||
|
Date: Tue, 20 Sep 2022 11:22:47 +0200
|
||||||
|
Subject: [PATCH 4/4] Fix CVE-2022-38178
|
||||||
|
|
||||||
|
5962. [security] Fix memory leak in EdDSA verify processing.
|
||||||
|
(CVE-2022-38178) [GL #3487]
|
||||||
|
---
|
||||||
|
lib/dns/openssleddsa_link.c | 4 ++--
|
||||||
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
|
||||||
|
index 6a6a74d..3157011 100644
|
||||||
|
--- a/lib/dns/openssleddsa_link.c
|
||||||
|
+++ b/lib/dns/openssleddsa_link.c
|
||||||
|
@@ -234,11 +234,11 @@ openssleddsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
|
||||||
|
}
|
||||||
|
#endif /* if HAVE_OPENSSL_ED448 */
|
||||||
|
if (siglen == 0) {
|
||||||
|
- return (ISC_R_NOTIMPLEMENTED);
|
||||||
|
+ DST_RET(ISC_R_NOTIMPLEMENTED);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (sig->length != siglen) {
|
||||||
|
- return (DST_R_VERIFYFAILURE);
|
||||||
|
+ DST_RET(DST_R_VERIFYFAILURE);
|
||||||
|
}
|
||||||
|
|
||||||
|
isc_buffer_usedregion(buf, &tbsreg);
|
||||||
|
--
|
||||||
|
2.37.3
|
||||||
|
|
128
SOURCES/bind-9.16-CVE-2022-3924.patch
Normal file
128
SOURCES/bind-9.16-CVE-2022-3924.patch
Normal file
@ -0,0 +1,128 @@
|
|||||||
|
From 20424b3bfe8d3fae92c11a30e79aeffd26dc2891 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Aram Sargsyan <aram@isc.org>
|
||||||
|
Date: Mon, 14 Nov 2022 12:18:06 +0000
|
||||||
|
Subject: [PATCH] Cancel all fetch events in dns_resolver_cancelfetch()
|
||||||
|
|
||||||
|
Although 'dns_fetch_t' fetch can have two associated events, one for
|
||||||
|
each of 'DNS_EVENT_FETCHDONE' and 'DNS_EVENT_TRYSTALE' types, the
|
||||||
|
dns_resolver_cancelfetch() function is designed in a way that it
|
||||||
|
expects only one existing event, which it must cancel, and when it
|
||||||
|
happens so that 'stale-answer-client-timeout' is enabled and there
|
||||||
|
are two events, only one of them is canceled, and it results in an
|
||||||
|
assertion in dns_resolver_destroyfetch(), when it finds a dangling
|
||||||
|
event.
|
||||||
|
|
||||||
|
Change the logic of dns_resolver_cancelfetch() function so that it
|
||||||
|
cancels both the events (if they exist), and in the right order.
|
||||||
|
|
||||||
|
(cherry picked from commit ec2098ca35039e4f81fd0aa7c525eb960b8f47bf)
|
||||||
|
---
|
||||||
|
lib/dns/resolver.c | 53 +++++++++++++++++++++++++++++++++++-----------
|
||||||
|
lib/ns/query.c | 4 +++-
|
||||||
|
2 files changed, 44 insertions(+), 13 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
|
||||||
|
index 18585b5..7cbfbb2 100644
|
||||||
|
--- a/lib/dns/resolver.c
|
||||||
|
+++ b/lib/dns/resolver.c
|
||||||
|
@@ -11254,8 +11254,9 @@ void
|
||||||
|
dns_resolver_cancelfetch(dns_fetch_t *fetch) {
|
||||||
|
fetchctx_t *fctx;
|
||||||
|
dns_resolver_t *res;
|
||||||
|
- dns_fetchevent_t *event, *next_event;
|
||||||
|
- isc_task_t *etask;
|
||||||
|
+ dns_fetchevent_t *event = NULL;
|
||||||
|
+ dns_fetchevent_t *event_trystale = NULL;
|
||||||
|
+ dns_fetchevent_t *event_fetchdone = NULL;
|
||||||
|
|
||||||
|
REQUIRE(DNS_FETCH_VALID(fetch));
|
||||||
|
fctx = fetch->private;
|
||||||
|
@@ -11267,32 +11268,60 @@ dns_resolver_cancelfetch(dns_fetch_t *fetch) {
|
||||||
|
LOCK(&res->buckets[fctx->bucketnum].lock);
|
||||||
|
|
||||||
|
/*
|
||||||
|
- * Find the completion event for this fetch (as opposed
|
||||||
|
+ * Find the events for this fetch (as opposed
|
||||||
|
* to those for other fetches that have joined the same
|
||||||
|
- * fctx) and send it with result = ISC_R_CANCELED.
|
||||||
|
+ * fctx) and send them with result = ISC_R_CANCELED.
|
||||||
|
*/
|
||||||
|
- event = NULL;
|
||||||
|
if (fctx->state != fetchstate_done) {
|
||||||
|
+ dns_fetchevent_t *next_event = NULL;
|
||||||
|
for (event = ISC_LIST_HEAD(fctx->events); event != NULL;
|
||||||
|
event = next_event) {
|
||||||
|
next_event = ISC_LIST_NEXT(event, ev_link);
|
||||||
|
if (event->fetch == fetch) {
|
||||||
|
ISC_LIST_UNLINK(fctx->events, event, ev_link);
|
||||||
|
- break;
|
||||||
|
+ switch (event->ev_type) {
|
||||||
|
+ case DNS_EVENT_TRYSTALE:
|
||||||
|
+ INSIST(event_trystale == NULL);
|
||||||
|
+ event_trystale = event;
|
||||||
|
+ break;
|
||||||
|
+ case DNS_EVENT_FETCHDONE:
|
||||||
|
+ INSIST(event_fetchdone == NULL);
|
||||||
|
+ event_fetchdone = event;
|
||||||
|
+ break;
|
||||||
|
+ default:
|
||||||
|
+ ISC_UNREACHABLE();
|
||||||
|
+ }
|
||||||
|
+ if (event_trystale != NULL &&
|
||||||
|
+ event_fetchdone != NULL)
|
||||||
|
+ {
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
- if (event != NULL) {
|
||||||
|
- etask = event->ev_sender;
|
||||||
|
- event->ev_sender = fctx;
|
||||||
|
- event->result = ISC_R_CANCELED;
|
||||||
|
- isc_task_sendanddetach(&etask, ISC_EVENT_PTR(&event));
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * The "trystale" event must be sent before the "fetchdone" event,
|
||||||
|
+ * because the latter clears the "recursing" query attribute, which is
|
||||||
|
+ * required by both events (handled by the same callback function).
|
||||||
|
+ */
|
||||||
|
+ if (event_trystale != NULL) {
|
||||||
|
+ isc_task_t *etask = event_trystale->ev_sender;
|
||||||
|
+ event_trystale->ev_sender = fctx;
|
||||||
|
+ event_trystale->result = ISC_R_CANCELED;
|
||||||
|
+ isc_task_sendanddetach(&etask, ISC_EVENT_PTR(&event_trystale));
|
||||||
|
}
|
||||||
|
+ if (event_fetchdone != NULL) {
|
||||||
|
+ isc_task_t *etask = event_fetchdone->ev_sender;
|
||||||
|
+ event_fetchdone->ev_sender = fctx;
|
||||||
|
+ event_fetchdone->result = ISC_R_CANCELED;
|
||||||
|
+ isc_task_sendanddetach(&etask, ISC_EVENT_PTR(&event_fetchdone));
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* The fctx continues running even if no fetches remain;
|
||||||
|
* the answer is still cached.
|
||||||
|
*/
|
||||||
|
-
|
||||||
|
UNLOCK(&res->buckets[fctx->bucketnum].lock);
|
||||||
|
}
|
||||||
|
|
||||||
|
diff --git a/lib/ns/query.c b/lib/ns/query.c
|
||||||
|
index f66bab4..4f61374 100644
|
||||||
|
--- a/lib/ns/query.c
|
||||||
|
+++ b/lib/ns/query.c
|
||||||
|
@@ -6021,7 +6021,9 @@ fetch_callback(isc_task_t *task, isc_event_t *event) {
|
||||||
|
CTRACE(ISC_LOG_DEBUG(3), "fetch_callback");
|
||||||
|
|
||||||
|
if (event->ev_type == DNS_EVENT_TRYSTALE) {
|
||||||
|
- query_lookup_stale(client);
|
||||||
|
+ if (devent->result != ISC_R_CANCELED) {
|
||||||
|
+ query_lookup_stale(client);
|
||||||
|
+ }
|
||||||
|
isc_event_free(ISC_EVENT_PTR(&event));
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.39.1
|
||||||
|
|
216
SOURCES/bind-9.16-rh2101712.patch
Normal file
216
SOURCES/bind-9.16-rh2101712.patch
Normal file
@ -0,0 +1,216 @@
|
|||||||
|
From b1871274cd2c97b63f3b90d608b7f8936d4ff3c5 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Mark Andrews <marka@isc.org>
|
||||||
|
Date: Wed, 24 Aug 2022 12:21:50 +1000
|
||||||
|
Subject: [PATCH] Have dns_zt_apply lock the zone table
|
||||||
|
|
||||||
|
There where a number of places where the zone table should have
|
||||||
|
been locked, but wasn't, when dns_zt_apply was called.
|
||||||
|
|
||||||
|
Added a isc_rwlocktype_t type parameter to dns_zt_apply and adjusted
|
||||||
|
all calls to using it. Removed locks in callers.
|
||||||
|
|
||||||
|
Modified upstream commit for v9_16
|
||||||
|
---
|
||||||
|
bin/named/server.c | 12 +++++++-----
|
||||||
|
bin/named/statschannel.c | 12 +++++++-----
|
||||||
|
lib/dns/include/dns/zt.h | 3 ++-
|
||||||
|
lib/dns/tests/zt_test.c | 4 ++--
|
||||||
|
lib/dns/view.c | 3 ++-
|
||||||
|
lib/dns/zt.c | 29 ++++++++++++++++++-----------
|
||||||
|
6 files changed, 38 insertions(+), 25 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/bin/named/server.c b/bin/named/server.c
|
||||||
|
index 860ccae..c2a5887 100644
|
||||||
|
--- a/bin/named/server.c
|
||||||
|
+++ b/bin/named/server.c
|
||||||
|
@@ -9458,7 +9458,8 @@ cleanup:
|
||||||
|
if (result == ISC_R_SUCCESS && strcmp(view->name, "_bind") != 0)
|
||||||
|
{
|
||||||
|
dns_view_setviewrevert(view);
|
||||||
|
- (void)dns_zt_apply(view->zonetable, false, NULL,
|
||||||
|
+ (void)dns_zt_apply(view->zonetable,
|
||||||
|
+ isc_rwlocktype_read, false, NULL,
|
||||||
|
removed, view);
|
||||||
|
}
|
||||||
|
dns_view_detach(&view);
|
||||||
|
@@ -10901,8 +10902,8 @@ add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {
|
||||||
|
ISC_LIST_INIT(vle->zonelist);
|
||||||
|
ISC_LIST_APPEND(dctx->viewlist, vle, link);
|
||||||
|
if (dctx->dumpzones) {
|
||||||
|
- result = dns_zt_apply(view->zonetable, true, NULL,
|
||||||
|
- add_zone_tolist, dctx);
|
||||||
|
+ result = dns_zt_apply(view->zonetable, isc_rwlocktype_read,
|
||||||
|
+ true, NULL, add_zone_tolist, dctx);
|
||||||
|
}
|
||||||
|
return (result);
|
||||||
|
}
|
||||||
|
@@ -12248,8 +12249,9 @@ named_server_sync(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
|
||||||
|
for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
|
||||||
|
view = ISC_LIST_NEXT(view, link))
|
||||||
|
{
|
||||||
|
- result = dns_zt_apply(view->zonetable, false, NULL,
|
||||||
|
- synczone, &cleanup);
|
||||||
|
+ result = dns_zt_apply(view->zonetable,
|
||||||
|
+ isc_rwlocktype_none, false,
|
||||||
|
+ NULL, synczone, &cleanup);
|
||||||
|
if (result != ISC_R_SUCCESS && tresult == ISC_R_SUCCESS)
|
||||||
|
{
|
||||||
|
tresult = result;
|
||||||
|
diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
|
||||||
|
index 8ff2567..832ce93 100644
|
||||||
|
--- a/bin/named/statschannel.c
|
||||||
|
+++ b/bin/named/statschannel.c
|
||||||
|
@@ -2296,8 +2296,9 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
|
||||||
|
if ((flags & STATS_XML_ZONES) != 0) {
|
||||||
|
TRY0(xmlTextWriterStartElement(writer,
|
||||||
|
ISC_XMLCHAR "zones"));
|
||||||
|
- result = dns_zt_apply(view->zonetable, true, NULL,
|
||||||
|
- zone_xmlrender, writer);
|
||||||
|
+ result = dns_zt_apply(view->zonetable,
|
||||||
|
+ isc_rwlocktype_read, true,
|
||||||
|
+ NULL, zone_xmlrender, writer);
|
||||||
|
if (result != ISC_R_SUCCESS) {
|
||||||
|
goto error;
|
||||||
|
}
|
||||||
|
@@ -3069,9 +3070,10 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
|
||||||
|
CHECKMEM(za);
|
||||||
|
|
||||||
|
if ((flags & STATS_JSON_ZONES) != 0) {
|
||||||
|
- result = dns_zt_apply(view->zonetable, true,
|
||||||
|
- NULL, zone_jsonrender,
|
||||||
|
- za);
|
||||||
|
+ result = dns_zt_apply(view->zonetable,
|
||||||
|
+ isc_rwlocktype_read,
|
||||||
|
+ true, NULL,
|
||||||
|
+ zone_jsonrender, za);
|
||||||
|
if (result != ISC_R_SUCCESS) {
|
||||||
|
goto error;
|
||||||
|
}
|
||||||
|
diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h
|
||||||
|
index 4a1b263..1c6c789 100644
|
||||||
|
--- a/lib/dns/include/dns/zt.h
|
||||||
|
+++ b/lib/dns/include/dns/zt.h
|
||||||
|
@@ -168,7 +168,8 @@ dns_zt_freezezones(dns_zt_t *zt, dns_view_t *view, bool freeze);
|
||||||
|
*/
|
||||||
|
|
||||||
|
isc_result_t
|
||||||
|
-dns_zt_apply(dns_zt_t *zt, bool stop, isc_result_t *sub,
|
||||||
|
+dns_zt_apply(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop,
|
||||||
|
+ isc_result_t *sub,
|
||||||
|
isc_result_t (*action)(dns_zone_t *, void *), void *uap);
|
||||||
|
/*%<
|
||||||
|
* Apply a given 'action' to all zone zones in the table.
|
||||||
|
diff --git a/lib/dns/tests/zt_test.c b/lib/dns/tests/zt_test.c
|
||||||
|
index 7945a0b..bfacb94 100644
|
||||||
|
--- a/lib/dns/tests/zt_test.c
|
||||||
|
+++ b/lib/dns/tests/zt_test.c
|
||||||
|
@@ -136,8 +136,8 @@ apply(void **state) {
|
||||||
|
assert_non_null(view->zonetable);
|
||||||
|
|
||||||
|
assert_int_equal(nzones, 0);
|
||||||
|
- result = dns_zt_apply(view->zonetable, false, NULL, count_zone,
|
||||||
|
- &nzones);
|
||||||
|
+ result = dns_zt_apply(view->zonetable, isc_rwlocktype_read, false,
|
||||||
|
+ NULL, count_zone, &nzones);
|
||||||
|
assert_int_equal(result, ISC_R_SUCCESS);
|
||||||
|
assert_int_equal(nzones, 1);
|
||||||
|
|
||||||
|
diff --git a/lib/dns/view.c b/lib/dns/view.c
|
||||||
|
index 8c7e40a..dcb0f18 100644
|
||||||
|
--- a/lib/dns/view.c
|
||||||
|
+++ b/lib/dns/view.c
|
||||||
|
@@ -704,7 +704,8 @@ dns_view_dialup(dns_view_t *view) {
|
||||||
|
REQUIRE(DNS_VIEW_VALID(view));
|
||||||
|
REQUIRE(view->zonetable != NULL);
|
||||||
|
|
||||||
|
- (void)dns_zt_apply(view->zonetable, false, NULL, dialup, NULL);
|
||||||
|
+ (void)dns_zt_apply(view->zonetable, isc_rwlocktype_read, false,
|
||||||
|
+ NULL, dialup, NULL);
|
||||||
|
}
|
||||||
|
|
||||||
|
void
|
||||||
|
diff --git a/lib/dns/zt.c b/lib/dns/zt.c
|
||||||
|
index 8ca9cd6..1bfc308 100644
|
||||||
|
--- a/lib/dns/zt.c
|
||||||
|
+++ b/lib/dns/zt.c
|
||||||
|
@@ -223,7 +223,8 @@ flush(dns_zone_t *zone, void *uap) {
|
||||||
|
static void
|
||||||
|
zt_destroy(dns_zt_t *zt) {
|
||||||
|
if (atomic_load_acquire(&zt->flush)) {
|
||||||
|
- (void)dns_zt_apply(zt, false, NULL, flush, NULL);
|
||||||
|
+ (void)dns_zt_apply(zt, isc_rwlocktype_none, false, NULL,
|
||||||
|
+ flush, NULL);
|
||||||
|
}
|
||||||
|
dns_rbt_destroy(&zt->table);
|
||||||
|
isc_rwlock_destroy(&zt->rwlock);
|
||||||
|
@@ -265,9 +266,8 @@ dns_zt_load(dns_zt_t *zt, bool stop, bool newonly) {
|
||||||
|
struct zt_load_params params;
|
||||||
|
REQUIRE(VALID_ZT(zt));
|
||||||
|
params.newonly = newonly;
|
||||||
|
- RWLOCK(&zt->rwlock, isc_rwlocktype_read);
|
||||||
|
- result = dns_zt_apply(zt, stop, NULL, load, ¶ms);
|
||||||
|
- RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
|
||||||
|
+ result = dns_zt_apply(zt, isc_rwlocktype_read, stop, NULL, load,
|
||||||
|
+ ¶ms);
|
||||||
|
return (result);
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -338,9 +338,8 @@ dns_zt_asyncload(dns_zt_t *zt, bool newonly, dns_zt_allloaded_t alldone,
|
||||||
|
zt->loaddone = alldone;
|
||||||
|
zt->loaddone_arg = arg;
|
||||||
|
|
||||||
|
- RWLOCK(&zt->rwlock, isc_rwlocktype_read);
|
||||||
|
- result = dns_zt_apply(zt, false, NULL, asyncload, zt);
|
||||||
|
- RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
|
||||||
|
+ result = dns_zt_apply(zt, isc_rwlocktype_read, false, NULL,
|
||||||
|
+ asyncload, zt);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Have all the loads completed?
|
||||||
|
@@ -386,9 +385,8 @@ dns_zt_freezezones(dns_zt_t *zt, dns_view_t *view, bool freeze) {
|
||||||
|
|
||||||
|
REQUIRE(VALID_ZT(zt));
|
||||||
|
|
||||||
|
- RWLOCK(&zt->rwlock, isc_rwlocktype_read);
|
||||||
|
- result = dns_zt_apply(zt, false, &tresult, freezezones, ¶ms);
|
||||||
|
- RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
|
||||||
|
+ result = dns_zt_apply(zt, isc_rwlocktype_read, false, &tresult,
|
||||||
|
+ freezezones, ¶ms);
|
||||||
|
if (tresult == ISC_R_NOTFOUND) {
|
||||||
|
tresult = ISC_R_SUCCESS;
|
||||||
|
}
|
||||||
|
@@ -522,7 +520,8 @@ dns_zt_setviewrevert(dns_zt_t *zt) {
|
||||||
|
}
|
||||||
|
|
||||||
|
isc_result_t
|
||||||
|
-dns_zt_apply(dns_zt_t *zt, bool stop, isc_result_t *sub,
|
||||||
|
+dns_zt_apply(dns_zt_t *zt, isc_rwlocktype_t lock, bool stop,
|
||||||
|
+ isc_result_t *sub,
|
||||||
|
isc_result_t (*action)(dns_zone_t *, void *), void *uap) {
|
||||||
|
dns_rbtnode_t *node;
|
||||||
|
dns_rbtnodechain_t chain;
|
||||||
|
@@ -532,6 +531,10 @@ dns_zt_apply(dns_zt_t *zt, bool stop, isc_result_t *sub,
|
||||||
|
REQUIRE(VALID_ZT(zt));
|
||||||
|
REQUIRE(action != NULL);
|
||||||
|
|
||||||
|
+ if (lock != isc_rwlocktype_none) {
|
||||||
|
+ RWLOCK(&zt->rwlock, lock);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
dns_rbtnodechain_init(&chain);
|
||||||
|
result = dns_rbtnodechain_first(&chain, zt->table, NULL, NULL);
|
||||||
|
if (result == ISC_R_NOTFOUND) {
|
||||||
|
@@ -568,6 +571,10 @@ cleanup:
|
||||||
|
*sub = tresult;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (lock != isc_rwlocktype_none) {
|
||||||
|
+ RWUNLOCK(&zt->rwlock, lock);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
return (result);
|
||||||
|
}
|
||||||
|
|
||||||
|
--
|
||||||
|
2.39.2
|
||||||
|
|
31
SOURCES/bind-9.16-rh2133889.patch
Normal file
31
SOURCES/bind-9.16-rh2133889.patch
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
From 606fc6d4aa8e8884f53f53e72dc1bd7babf37a47 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
|
||||||
|
Date: Mon, 16 Jan 2023 11:06:48 +0000
|
||||||
|
Subject: [PATCH] Merge branch 'feature/main/zt-rwlock.h' into 'main'
|
||||||
|
|
||||||
|
Include isc_rwlocktype_t type definition in zt.h
|
||||||
|
|
||||||
|
See merge request isc-projects/bind9!7376
|
||||||
|
|
||||||
|
(cherry picked from commit d7bcdf8bd6c5395726f708535120ce9a97eaa935)
|
||||||
|
|
||||||
|
395d6fca Include isc_rwlocktype_t type definition in zt.h
|
||||||
|
---
|
||||||
|
lib/dns/include/dns/zt.h | 1 +
|
||||||
|
1 file changed, 1 insertion(+)
|
||||||
|
|
||||||
|
diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h
|
||||||
|
index 189092bc3b..2964fc971f 100644
|
||||||
|
--- a/lib/dns/include/dns/zt.h
|
||||||
|
+++ b/lib/dns/include/dns/zt.h
|
||||||
|
@@ -19,6 +19,7 @@
|
||||||
|
#include <stdbool.h>
|
||||||
|
|
||||||
|
#include <isc/lang.h>
|
||||||
|
+#include <isc/rwlock.h>
|
||||||
|
|
||||||
|
#include <dns/types.h>
|
||||||
|
|
||||||
|
--
|
||||||
|
2.39.0
|
||||||
|
|
@ -51,7 +51,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
|
|||||||
Name: bind
|
Name: bind
|
||||||
License: MPLv2.0
|
License: MPLv2.0
|
||||||
Version: 9.16.23
|
Version: 9.16.23
|
||||||
Release: 4%{?dist}
|
Release: 11%{?dist}
|
||||||
Epoch: 32
|
Epoch: 32
|
||||||
Url: https://www.isc.org/downloads/bind/
|
Url: https://www.isc.org/downloads/bind/
|
||||||
#
|
#
|
||||||
@ -105,6 +105,25 @@ Patch171:bind-9.11-tests-variants.patch
|
|||||||
Patch172:bind-9.16-CVE-2022-0396.patch
|
Patch172:bind-9.16-CVE-2022-0396.patch
|
||||||
Patch173:bind-9.16-CVE-2021-25220.patch
|
Patch173:bind-9.16-CVE-2021-25220.patch
|
||||||
Patch174:bind-9.16-CVE-2021-25220-test.patch
|
Patch174:bind-9.16-CVE-2021-25220-test.patch
|
||||||
|
Patch175:bind-9.16-CVE-2022-3080.patch
|
||||||
|
Patch176:bind-9.16-CVE-2022-38177.patch
|
||||||
|
Patch177:bind-9.16-CVE-2022-38178.patch
|
||||||
|
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6793
|
||||||
|
# https://gitlab.isc.org/isc-projects/bind9/commit/bf2ea6d8525bfd96a84dad221ba9e004adb710a8
|
||||||
|
Patch178:bind-9.16-CVE-2022-2795.patch
|
||||||
|
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6695
|
||||||
|
Patch179:bind-9.16-rh2101712.patch
|
||||||
|
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7376
|
||||||
|
Patch181:bind-9.16-rh2133889.patch
|
||||||
|
# https://gitlab.isc.org/isc-projects/bind9/commit/82185f4f80d2fa39a4569f6740cb360ffff8f5c4
|
||||||
|
Patch182: bind-9.16-CVE-2022-3094-1.patch
|
||||||
|
Patch183: bind-9.16-CVE-2022-3094-2.patch
|
||||||
|
Patch184: bind-9.16-CVE-2022-3094-3.patch
|
||||||
|
Patch185: bind-9.16-CVE-2022-3094-test.patch
|
||||||
|
# https://gitlab.isc.org/isc-projects/bind9/commit/ea79385990c564eb478c286c089ea7ed15520690
|
||||||
|
Patch186: bind-9.16-CVE-2022-3736.patch
|
||||||
|
# https://gitlab.isc.org/isc-projects/bind9/commit/b4a65aaea19762a3712932aa2270e8a833fbde22
|
||||||
|
Patch187: bind-9.16-CVE-2022-3924.patch
|
||||||
|
|
||||||
%{?systemd_ordering}
|
%{?systemd_ordering}
|
||||||
Requires: coreutils
|
Requires: coreutils
|
||||||
@ -408,6 +427,18 @@ in HTML and PDF format.
|
|||||||
%patch172 -p1 -b .CVE-2022-0396
|
%patch172 -p1 -b .CVE-2022-0396
|
||||||
%patch173 -p1 -b .CVE-2021-25220
|
%patch173 -p1 -b .CVE-2021-25220
|
||||||
%patch174 -p1 -b .CVE-2021-25220-test
|
%patch174 -p1 -b .CVE-2021-25220-test
|
||||||
|
%patch175 -p1 -b .CVE-2022-3080
|
||||||
|
%patch176 -p1 -b .CVE-2022-38177
|
||||||
|
%patch177 -p1 -b .CVE-2022-38178
|
||||||
|
%patch178 -p1 -b .CVE-2022-2795
|
||||||
|
%patch179 -p1 -b .rh2101712
|
||||||
|
%patch181 -p1 -b .rh2133889
|
||||||
|
%patch182 -p1 -b .CVE-2022-3094
|
||||||
|
%patch183 -p1 -b .CVE-2022-3094
|
||||||
|
%patch184 -p1 -b .CVE-2022-3094
|
||||||
|
%patch185 -p1 -b .CVE-2022-3094-test
|
||||||
|
%patch186 -p1 -b .CVE-2022-3736
|
||||||
|
%patch187 -p1 -b .CVE-2022-3924
|
||||||
|
|
||||||
%if %{with PKCS11}
|
%if %{with PKCS11}
|
||||||
%patch135 -p1 -b .config-pkcs11
|
%patch135 -p1 -b .config-pkcs11
|
||||||
@ -1056,6 +1087,7 @@ fi;
|
|||||||
%dir %{chroot_prefix}/usr
|
%dir %{chroot_prefix}/usr
|
||||||
%dir %{chroot_prefix}/%{_libdir}
|
%dir %{chroot_prefix}/%{_libdir}
|
||||||
%dir %{chroot_prefix}/%{_libdir}/bind
|
%dir %{chroot_prefix}/%{_libdir}/bind
|
||||||
|
%dir %{chroot_prefix}/%{_libdir}/named
|
||||||
%dir %{chroot_prefix}/%{_datadir}/GeoIP
|
%dir %{chroot_prefix}/%{_datadir}/GeoIP
|
||||||
%{chroot_prefix}/proc
|
%{chroot_prefix}/proc
|
||||||
%defattr(0660,root,named,01770)
|
%defattr(0660,root,named,01770)
|
||||||
@ -1130,6 +1162,32 @@ fi;
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Mon Feb 27 2023 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-11
|
||||||
|
- Correct backport issue in statistics rendering fix (#2126912)
|
||||||
|
|
||||||
|
* Sat Feb 25 2023 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-10
|
||||||
|
- Handle subtle difference between upstream and rhel (CVE-2022-3094)
|
||||||
|
|
||||||
|
* Wed Feb 08 2023 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-9
|
||||||
|
- Prevent flooding with UPDATE requests (CVE-2022-3094)
|
||||||
|
- Handle RRSIG queries when server-stale is active (CVE-2022-3736)
|
||||||
|
- Fix crash when soft-quota is reached and serve-stale is active (CVE-2022-3924)
|
||||||
|
|
||||||
|
* Thu Oct 13 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-8
|
||||||
|
- Correct regression preventing bind-dyndb-ldap build (#2162795)
|
||||||
|
|
||||||
|
* Tue Oct 04 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-7
|
||||||
|
- Prevent freeing zone during statistics rendering (#2101712)
|
||||||
|
|
||||||
|
* Tue Oct 04 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-6
|
||||||
|
- Bound the amount of work performed for delegations (CVE-2022-2795)
|
||||||
|
- Add %_libdir/named to bind-chroot (#2129466)
|
||||||
|
|
||||||
|
* Thu Sep 22 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-5
|
||||||
|
- Fix possible serve-stale related crash (CVE-2022-3080)
|
||||||
|
- Fix memory leak in ECDSA verify processing (CVE-2022-38177)
|
||||||
|
- Fix memory leak in EdDSA verify processing (CVE-2022-38178)
|
||||||
|
|
||||||
* Thu Jul 14 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-4
|
* Thu Jul 14 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-4
|
||||||
- Export bind-doc package (#2104863)
|
- Export bind-doc package (#2104863)
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user