Backport also unittest change in rdata_test
CVE: CVE-2026-11721
Upstream patches:
- c63f11976f
Resolves: RHEL-213407
This commit is contained in:
Petr Menšík
parent
c33c243462
commit
fa19543642
168
bind-9.11-CVE-2026-11721-test.patch
Normal file
168
bind-9.11-CVE-2026-11721-test.patch
Normal file
@ -0,0 +1,168 @@
|
||||
From 9c1f5b579a7a4c338be8319a40927c83a0b4f886 Mon Sep 17 00:00:00 2001
|
||||
From: Mark Andrews <marka@isc.org>
|
||||
Date: Tue, 14 Apr 2026 13:46:22 +1000
|
||||
Subject: [PATCH] Test RRSIG record parsing
|
||||
|
||||
In particular test that labels and signer fields are consistent.
|
||||
|
||||
(cherry picked from commit 5a95e64731afe63d348d272cc4d3b2f9847150c2)
|
||||
(cherry picked from commit 5f3b7aef42be50630ecc349a6dbc22acf96d7413)
|
||||
|
||||
Fix failing dnssec-signzone -M sub-test
|
||||
|
||||
Restore example.db to the default contents which does not result
|
||||
in too many records causing the test to fail.
|
||||
|
||||
(cherry picked from commit 8b11c48ed044844e26eaaca4315868231014dbb7)
|
||||
---
|
||||
bin/tests/system/dnssec/tests.sh | 1 +
|
||||
lib/dns/tests/rdata_test.c | 114 +++++++++++++++++++++++++++++++
|
||||
2 files changed, 115 insertions(+)
|
||||
|
||||
diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
|
||||
index 1eb97f42c5..e5cb97924e 100644
|
||||
--- a/bin/tests/system/dnssec/tests.sh
|
||||
+++ b/bin/tests/system/dnssec/tests.sh
|
||||
@@ -1793,6 +1793,7 @@ echo_i "checking TTLs are capped by dnssec-signzone -M ($n)"
|
||||
ret=0
|
||||
(
|
||||
cd signer
|
||||
+cp example.db.in example.db
|
||||
$SIGNER -O full -f signer.out.8 -S -M 30 -o example example.db > /dev/null 2>&1
|
||||
) || ret=1
|
||||
awk '/^;/ { next; } $2 > 30 { exit 1; }' signer/signer.out.8 || ret=1
|
||||
diff --git a/lib/dns/tests/rdata_test.c b/lib/dns/tests/rdata_test.c
|
||||
index fe01e48fa3..1cde60b1d8 100644
|
||||
--- a/lib/dns/tests/rdata_test.c
|
||||
+++ b/lib/dns/tests/rdata_test.c
|
||||
@@ -2356,6 +2356,119 @@ rkey(void **state) {
|
||||
dns_rdatatype_rkey, sizeof(dns_rdata_rkey_t));
|
||||
}
|
||||
|
||||
+static void
|
||||
+rrsig(void **state) {
|
||||
+ text_ok_t text_ok[] = {
|
||||
+ TEXT_VALID("SOA 8 0 86400 20260426170000 20260413160000 54393 "
|
||||
+ ". "
|
||||
+ "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/"
|
||||
+ "TEkOZApVG0F6E "
|
||||
+ "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/"
|
||||
+ "dIdheiig1VvU+9HXLi "
|
||||
+ "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+"
|
||||
+ "KJXOaxyHbqchYkDFy4PL6qftE "
|
||||
+ "VaLkueRgjXgOsq/"
|
||||
+ "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw "
|
||||
+ "VjJsJTKw8neOTw2rQfLaigWu2LIWw+"
|
||||
+ "IyVrLjZJdLqGkiLBGd1w4X3U12 "
|
||||
+ "fFxoY3eqzNgBEtduoGKPZ/"
|
||||
+ "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="),
|
||||
+ /* labels too short for signer */
|
||||
+ TEXT_INVALID("SOA 8 0 86400 20260426170000 20260413160000 "
|
||||
+ "54393 example. "
|
||||
+ "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/"
|
||||
+ "TEkOZApVG0F6E "
|
||||
+ "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/"
|
||||
+ "dIdheiig1VvU+9HXLi "
|
||||
+ "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+"
|
||||
+ "KJXOaxyHbqchYkDFy4PL6qftE "
|
||||
+ "VaLkueRgjXgOsq/"
|
||||
+ "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw "
|
||||
+ "VjJsJTKw8neOTw2rQfLaigWu2LIWw+"
|
||||
+ "IyVrLjZJdLqGkiLBGd1w4X3U12 "
|
||||
+ "fFxoY3eqzNgBEtduoGKPZ/"
|
||||
+ "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="),
|
||||
+ /*
|
||||
+ * Sentinel.
|
||||
+ */
|
||||
+ TEXT_SENTINEL()
|
||||
+ };
|
||||
+ wire_ok_t wire_ok[] = {
|
||||
+ WIRE_VALID(0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69,
|
||||
+ 0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79,
|
||||
+ 0x00, 0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a,
|
||||
+ 0x5e, 0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77,
|
||||
+ 0x8d, 0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59,
|
||||
+ 0x17, 0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43,
|
||||
+ 0x99, 0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6,
|
||||
+ 0x29, 0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe,
|
||||
+ 0x37, 0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06,
|
||||
+ 0x43, 0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7,
|
||||
+ 0x48, 0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f,
|
||||
+ 0xbd, 0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2,
|
||||
+ 0x9c, 0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20,
|
||||
+ 0xb9, 0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf,
|
||||
+ 0x8a, 0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8,
|
||||
+ 0x58, 0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb,
|
||||
+ 0x44, 0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78,
|
||||
+ 0x0e, 0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00,
|
||||
+ 0x1a, 0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c,
|
||||
+ 0xb1, 0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2,
|
||||
+ 0x50, 0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32,
|
||||
+ 0x6c, 0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d,
|
||||
+ 0xab, 0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2,
|
||||
+ 0x16, 0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97,
|
||||
+ 0x4b, 0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e,
|
||||
+ 0x17, 0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77,
|
||||
+ 0xaa, 0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62,
|
||||
+ 0x8f, 0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93,
|
||||
+ 0x91, 0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14,
|
||||
+ 0x78, 0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37,
|
||||
+ 0x0c, 0x8c, 0xbc, 0x2a, 0x52),
|
||||
+ /* labels too short for signer */
|
||||
+ WIRE_INVALID(
|
||||
+ 0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69,
|
||||
+ 0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79,
|
||||
+ 0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x00,
|
||||
+ 0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a, 0x5e,
|
||||
+ 0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77, 0x8d,
|
||||
+ 0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59, 0x17,
|
||||
+ 0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43, 0x99,
|
||||
+ 0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6, 0x29,
|
||||
+ 0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe, 0x37,
|
||||
+ 0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06, 0x43,
|
||||
+ 0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7, 0x48,
|
||||
+ 0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f, 0xbd,
|
||||
+ 0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2, 0x9c,
|
||||
+ 0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20, 0xb9,
|
||||
+ 0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf, 0x8a,
|
||||
+ 0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8, 0x58,
|
||||
+ 0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb, 0x44,
|
||||
+ 0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78, 0x0e,
|
||||
+ 0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00, 0x1a,
|
||||
+ 0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c, 0xb1,
|
||||
+ 0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2, 0x50,
|
||||
+ 0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32, 0x6c,
|
||||
+ 0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d, 0xab,
|
||||
+ 0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2, 0x16,
|
||||
+ 0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97, 0x4b,
|
||||
+ 0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e, 0x17,
|
||||
+ 0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77, 0xaa,
|
||||
+ 0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62, 0x8f,
|
||||
+ 0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93, 0x91,
|
||||
+ 0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14, 0x78,
|
||||
+ 0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37, 0x0c,
|
||||
+ 0x8c, 0xbc, 0x2a, 0x52),
|
||||
+
|
||||
+ WIRE_SENTINEL()
|
||||
+ };
|
||||
+
|
||||
+ UNUSED(state);
|
||||
+
|
||||
+ check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
|
||||
+ dns_rdatatype_rrsig, sizeof(dns_rdata_rrsig_t));
|
||||
+}
|
||||
+
|
||||
/* SSHFP RDATA manipulations */
|
||||
static void
|
||||
sshfp(void **state) {
|
||||
@@ -2867,6 +2980,7 @@ main(int argc, char **argv) {
|
||||
cmocka_unit_test_setup_teardown(nsec, _setup, _teardown),
|
||||
cmocka_unit_test_setup_teardown(nsec3, _setup, _teardown),
|
||||
cmocka_unit_test_setup_teardown(nxt, _setup, _teardown),
|
||||
+ cmocka_unit_test_setup_teardown(rrsig, _setup, _teardown),
|
||||
cmocka_unit_test_setup_teardown(sshfp, _setup, _teardown),
|
||||
cmocka_unit_test_setup_teardown(wks, _setup, _teardown),
|
||||
cmocka_unit_test_setup_teardown(rkey, _setup, _teardown),
|
||||
--
|
||||
2.55.0
|
||||
|
||||
@ -224,6 +224,8 @@ Patch220: bind-9.11-CVE-2026-13321.patch
|
||||
Patch221: bind-9.11-CVE-2026-13204.patch
|
||||
# https://github.com/isc-projects/bind9/commit/6965fa47edd3b45538db2b16488dbb6b4ad8066a
|
||||
Patch223: bind-9.11-CVE-2026-10723.patch
|
||||
# https://gitlab.isc.org/isc-projects/bind9/-/commit/c63f11976ffe6e0285e0a9a3524a53420786d50e
|
||||
Patch224: bind-9.11-CVE-2026-11721-test.patch
|
||||
|
||||
# SDB patches
|
||||
Patch11: bind-9.3.2b2-sdbsrc.patch
|
||||
@ -661,6 +663,7 @@ are used for building ISC DHCP.
|
||||
%patch -P 220 -p1 -b .CVE-2026-13321
|
||||
%patch -P 221 -p1 -b .CVE-2026-13204
|
||||
%patch -P 223 -p1 -b .CVE-2026-10723
|
||||
%patch -P 224 -p1 -b .CVE-2026-11721-test
|
||||
|
||||
mkdir lib/dns/tests/testdata/dstrandom
|
||||
cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
|
||||
@ -1725,6 +1728,7 @@ rm -rf ${RPM_BUILD_ROOT}
|
||||
|
||||
* Mon Jul 27 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.11.36-16.10
|
||||
- Reject RRSIG records with invalid label counts (CVE-2026-11721)
|
||||
- Add unittest check
|
||||
|
||||
* Mon Jul 27 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.11.36-16.9
|
||||
- Add reference counting to cache dns_slabheaders (CVE-2026-11622)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user